Adding upstream version 2.6.8+dfsg.upstream/2.6.8+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

18 files changed, 129 insertions, 152 deletions

diff --git a/servers/slapd/back-meta/Makefile.in b/servers/slapd/back-meta/Makefile.in
index 05b7ec7..0279abe 100644
--- a/servers/slapd/back-meta/Makefile.in
+++ b/servers/slapd/back-meta/Makefile.in
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2022 The OpenLDAP Foundation.
+## Copyright 1998-2024 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without
diff --git a/servers/slapd/back-meta/add.c b/servers/slapd/back-meta/add.c
index ec75db1..10adcd7 100644
--- a/servers/slapd/back-meta/add.c
+++ b/servers/slapd/back-meta/add.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -47,15 +47,17 @@ meta_back_add( Operation *op, SlapReply *rs )
 	int		msgid;
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	LDAPControl	**ctrls = NULL;
-
+	SlapReply *candidates = NULL;
 	Debug(LDAP_DEBUG_ARGS, "==> meta_back_add: %s\n",
 			op->o_req_dn.bv_val );
 
 	/*
 	 * get the current connection
 	 */
-	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR );
-	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR ) ) {
+	candidates = meta_back_candidates_get( op );
+	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR, candidates );
+	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR, candidates ) ) {
+		op->o_tmpfree( candidates, op->o_tmpmemctx );
 		return rs->sr_err;
 	}
 
@@ -181,7 +183,7 @@ retry:;
 		mt->mt_timeout[ SLAP_OP_ADD ], ( LDAP_BACK_SENDRESULT | retrying ) );
 	if ( rs->sr_err == LDAP_UNAVAILABLE && retrying ) {
 		retrying &= ~LDAP_BACK_RETRYING;
-		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR ) ) {
+		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR, candidates ) ) {
 			/* if the identity changed, there might be need to re-authz */
 			(void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
 			goto retry;
@@ -205,7 +207,7 @@ done:;
 	if ( mc ) {
 		meta_back_release_conn( mi, mc );
 	}
-
+	op->o_tmpfree( candidates, op->o_tmpmemctx );
 	return rs->sr_err;
 }
 
diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h
index 82b2105..c767fa2 100644
--- a/servers/slapd/back-meta/back-meta.h
+++ b/servers/slapd/back-meta/back-meta.h
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -489,7 +489,8 @@ meta_back_getconn(
 	Operation		*op,
 	SlapReply		*rs,
 	int			*candidate,
-	ldap_back_send_t	sendok );
+	ldap_back_send_t	sendok,
+	SlapReply *candidates );
 
 extern void
 meta_back_release_conn_lock(
@@ -504,7 +505,8 @@ meta_back_retry(
 	SlapReply		*rs,
 	metaconn_t		**mcp,
 	int			candidate,
-	ldap_back_send_t	sendok );
+	ldap_back_send_t	sendok,
+	SlapReply    *candidates );
 
 extern void
 meta_back_conn_free(
@@ -538,7 +540,8 @@ meta_back_dobind(
 	Operation		*op,
 	SlapReply		*rs,
 	metaconn_t		*mc,
-	ldap_back_send_t	sendok );
+	ldap_back_send_t	sendok,
+	SlapReply		*candidates );
 
 extern int
 meta_back_single_dobind(
@@ -625,7 +628,8 @@ meta_back_select_unique_candidate(
 extern int
 meta_clear_unused_candidates(
 	Operation		*op,
-	int			candidate );
+	int			candidate,
+	SlapReply *candidates );
 
 extern int
 meta_clear_one_candidate(
@@ -681,6 +685,9 @@ meta_target_finish( metainfo_t *mi, metatarget_t *mt,
 	const char *log, char *msg, size_t msize
 );
 
+extern void
+meta_back_target_free( metatarget_t	*mt );
+
 extern LDAP_REBIND_PROC		meta_back_default_rebind;
 extern LDAP_URLLIST_PROC	meta_back_default_urllist;
 
diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index edfabbb..2fce8dd 100644
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -89,10 +89,11 @@ meta_back_bind( Operation *op, SlapReply *rs )
 		return rs->sr_err;
 	}
 
+	candidates = meta_back_candidates_get( op );
 	/* we need meta_back_getconn() not send result even on error,
 	 * because we want to intercept the error and make it
 	 * invalidCredentials */
-	mc = meta_back_getconn( op, rs, NULL, LDAP_BACK_BIND_DONTSEND );
+	mc = meta_back_getconn( op, rs, NULL, LDAP_BACK_BIND_DONTSEND, candidates );
 	if ( !mc ) {
 		Debug(LDAP_DEBUG_ANY,
 		      "%s meta_back_bind: no target " "for dn \"%s\" (%d%s%s).\n",
@@ -110,11 +111,10 @@ meta_back_bind( Operation *op, SlapReply *rs )
 			break;
 		}
 		send_ldap_result( op, rs );
+		op->o_tmpfree( candidates, op->o_tmpmemctx );
 		return rs->sr_err;
 	}
 
-	candidates = meta_back_candidates_get( op );
-
 	/*
 	 * Each target is scanned ...
 	 */
@@ -284,10 +284,12 @@ meta_back_bind( Operation *op, SlapReply *rs )
 			rs->sr_err = slap_map_api2result( rs );
 		}
 		send_ldap_result( op, rs );
+		op->o_tmpfree( candidates, op->o_tmpmemctx );
 		return rs->sr_err;
 
 	}
 
+	op->o_tmpfree( candidates, op->o_tmpmemctx );
 	return LDAP_SUCCESS;
 }
 
@@ -672,7 +674,8 @@ meta_back_dobind(
 	Operation		*op,
 	SlapReply		*rs,
 	metaconn_t		*mc,
-	ldap_back_send_t	sendok )
+	ldap_back_send_t	sendok,
+	SlapReply		*candidates )
 {
 	metainfo_t		*mi = ( metainfo_t * )op->o_bd->be_private;
 
@@ -680,8 +683,6 @@ meta_back_dobind(
 				i,
 				isroot = 0;
 
-	SlapReply		*candidates;
-
 	if ( be_isroot( op ) ) {
 		isroot = 1;
 	}
@@ -704,8 +705,6 @@ meta_back_dobind(
 		goto done;
 	}
 
-	candidates = meta_back_candidates_get( op );
-
 	for ( i = 0; i < mi->mi_ntargets; i++ ) {
 		metatarget_t		*mt = mi->mi_targets[ i ];
 		metasingleconn_t	*msc = &mc->mc_conns[ i ];
@@ -761,7 +760,7 @@ retry_binding:;
 			if ( rc == LDAP_UNAVAILABLE ) {
 				/* FIXME: meta_back_retry() already re-calls
 				 * meta_back_single_dobind() */
-				if ( meta_back_retry( op, rs, &mc, i, sendok ) ) {
+				if ( meta_back_retry( op, rs, &mc, i, sendok, candidates ) ) {
 					goto retry_ok;
 				}
 
diff --git a/servers/slapd/back-meta/candidates.c b/servers/slapd/back-meta/candidates.c
index ffb5992..4baae2e 100644
--- a/servers/slapd/back-meta/candidates.c
+++ b/servers/slapd/back-meta/candidates.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -222,11 +222,11 @@ meta_back_select_unique_candidate(
 int
 meta_clear_unused_candidates(
 	Operation	*op,
-	int		candidate )
+	int		candidate,
+	SlapReply	*candidates )
 {
 	metainfo_t	*mi = ( metainfo_t * )op->o_bd->be_private;
 	int		i;
-	SlapReply	*candidates = meta_back_candidates_get( op );
 	
 	for ( i = 0; i < mi->mi_ntargets; ++i ) {
 		if ( i == candidate ) {
diff --git a/servers/slapd/back-meta/compare.c b/servers/slapd/back-meta/compare.c
index f6fd54d..0fdc81c 100644
--- a/servers/slapd/back-meta/compare.c
+++ b/servers/slapd/back-meta/compare.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -46,9 +46,12 @@ meta_back_compare( Operation *op, SlapReply *rs )
 	int		msgid;
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	LDAPControl	**ctrls = NULL;
+	SlapReply *candidates = NULL;
 
-	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR );
-	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR ) ) {
+	candidates = meta_back_candidates_get( op );
+	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR, candidates );
+	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR, candidates ) ) {
+		op->o_tmpfree( candidates, op->o_tmpmemctx );
 		return rs->sr_err;
 	}
 
@@ -127,7 +130,7 @@ retry:;
 		mt->mt_timeout[ SLAP_OP_COMPARE ], ( LDAP_BACK_SENDRESULT | retrying ) );
 	if ( rs->sr_err == LDAP_UNAVAILABLE && retrying ) {
 		retrying &= ~LDAP_BACK_RETRYING;
-		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR ) ) {
+		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR, candidates ) ) {
 			/* if the identity changed, there might be need to re-authz */
 			(void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
 			goto retry;
@@ -149,6 +152,7 @@ cleanup:;
 		meta_back_release_conn( mi, mc );
 	}
 
+	op->o_tmpfree( candidates, op->o_tmpmemctx );
 	return rs->sr_err;
 }
 
diff --git a/servers/slapd/back-meta/config.c b/servers/slapd/back-meta/config.c
index 6b1e607..8b2cdbe 100644
--- a/servers/slapd/back-meta/config.c
+++ b/servers/slapd/back-meta/config.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -565,16 +565,10 @@ meta_rwi_init( struct rewrite_info **rwm_rw )
 
 static int
 meta_back_new_target(
-	metatarget_t	**mtp )
+	metatarget_t	*mt )
 {
-	metatarget_t		*mt;
-
-	*mtp = NULL;
-
-	mt = ch_calloc( sizeof( metatarget_t ), 1 );
 
 	if ( meta_rwi_init( &mt->mt_rwmap.rwm_rw )) {
-		ch_free( mt );
 		return -1;
 	}
 
@@ -587,8 +581,6 @@ meta_back_new_target(
 	/* by default, use proxyAuthz control on each operation */
 	mt->mt_idassert_flags = LDAP_BACK_AUTH_PRESCRIPTIVE;
 
-	*mtp = mt;
-
 	return 0;
 }
 
@@ -1960,7 +1952,6 @@ meta_back_cf_gen( ConfigArgs *c )
 		LDAPURLDesc 	*ludp;
 		struct berval	dn;
 		int		j;
-
 		char		**uris = NULL;
 
 		if ( c->be->be_nsuffix == NULL ) {
@@ -1970,39 +1961,17 @@ meta_back_cf_gen( ConfigArgs *c )
 			return 1;
 		}
 
-		i = mi->mi_ntargets++;
-
-		mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
-			sizeof( metatarget_t * ) * mi->mi_ntargets );
-		if ( mi->mi_targets == NULL ) {
-			snprintf( c->cr_msg, sizeof( c->cr_msg ),
-				"out of memory while storing server name"
-				" in \"%s <protocol>://<server>[:port]/<naming context>\"",
-				c->argv[0] );
-			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
-			return 1;
-		}
-
-		if ( meta_back_new_target( &mi->mi_targets[ i ] ) != 0 ) {
+		mt = ch_calloc( sizeof( metatarget_t ), 1 );
+		if ( meta_back_new_target( mt ) != 0 ) {
 			snprintf( c->cr_msg, sizeof( c->cr_msg ),
 				"unable to init server"
 				" in \"%s <protocol>://<server>[:port]/<naming context>\"",
 				c->argv[0] );
 			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
+			meta_back_target_free( mt );
 			return 1;
 		}
 
-		mt = mi->mi_targets[ i ];
-
-		mt->mt_rebind_f = mi->mi_rebind_f;
-		mt->mt_urllist_f = mi->mi_urllist_f;
-		mt->mt_urllist_p = mt;
-
-		if ( META_BACK_QUARANTINE( mi ) ) {
-			ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
-		}
-		mt->mt_mc = mi->mi_mc;
-
 		for ( j = 1; j < c->argc; j++ ) {
 			char	**tmpuris = ldap_str2charray( c->argv[ j ], "\t" );
 
@@ -2012,6 +1981,7 @@ meta_back_cf_gen( ConfigArgs *c )
 					" in \"%s <protocol>://<server>[:port]/<naming context>\"",
 					j-1, c->argv[0] );
 				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
+				meta_back_target_free( mt );
 				return 1;
 			}
 
@@ -2040,6 +2010,7 @@ meta_back_cf_gen( ConfigArgs *c )
 					j-1, c->argv[0] );
 				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 				ldap_charray_free( uris );
+				meta_back_target_free( mt );
 				return 1;
 			}
 
@@ -2056,6 +2027,7 @@ meta_back_cf_gen( ConfigArgs *c )
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					ldap_free_urllist( ludp );
 					ldap_charray_free( uris );
+					meta_back_target_free( mt );
 					return 1;
 				}
 
@@ -2072,6 +2044,7 @@ meta_back_cf_gen( ConfigArgs *c )
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					ldap_free_urllist( ludp );
 					ldap_charray_free( uris );
+					meta_back_target_free( mt );
 					return( 1 );
 				}
 
@@ -2094,6 +2067,7 @@ meta_back_cf_gen( ConfigArgs *c )
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					ldap_free_urllist( ludp );
 					ldap_charray_free( uris );
+					meta_back_target_free( mt );
 					return( 1 );
 				}
 
@@ -2105,6 +2079,7 @@ meta_back_cf_gen( ConfigArgs *c )
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					ldap_free_urllist( ludp );
 					ldap_charray_free( uris );
+					meta_back_target_free( mt );
 					return( 1 );
 
 				}
@@ -2116,6 +2091,7 @@ meta_back_cf_gen( ConfigArgs *c )
 				snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
 				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 				ldap_charray_free( uris );
+				meta_back_target_free( mt );
 				return( 1 );
 			}
 			ldap_memfree( uris[ j ] );
@@ -2127,6 +2103,7 @@ meta_back_cf_gen( ConfigArgs *c )
 		if ( mt->mt_uri == NULL) {
 			snprintf( c->cr_msg, sizeof( c->cr_msg ), "no memory?" );
 			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
+			meta_back_target_free( mt );
 			return( 1 );
 		}
 
@@ -2143,8 +2120,34 @@ meta_back_cf_gen( ConfigArgs *c )
 			snprintf( c->cr_msg, sizeof( c->cr_msg ),
 				"<naming context> of URI must be within the naming context of this database." );
 			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
+			meta_back_target_free( mt );
 			return 1;
 		}
+
+		i = mi->mi_ntargets++;
+
+		mi->mi_targets = ( metatarget_t ** )ch_realloc( mi->mi_targets,
+			sizeof( metatarget_t * ) * mi->mi_ntargets );
+		if ( mi->mi_targets == NULL ) {
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"out of memory while storing server name"
+				" in \"%s <protocol>://<server>[:port]/<naming context>\"",
+				c->argv[0] );
+			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
+			meta_back_target_free( mt );
+			return 1;
+		}
+
+		mi->mi_targets[i] = mt;
+		mt->mt_rebind_f = mi->mi_rebind_f;
+		mt->mt_urllist_f = mi->mi_urllist_f;
+		mt->mt_urllist_p = mt;
+
+		if ( META_BACK_QUARANTINE( mi ) ) {
+			ldap_pvt_thread_mutex_init( &mt->mt_quarantine_mutex );
+		}
+
+		mt->mt_mc = mi->mi_mc;
 		c->ca_private = mt;
 		config_push_cleanup( c, meta_cf_cleanup );
 	} break;
diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c
index 91fdad3..f9a1f23 100644
--- a/servers/slapd/back-meta/conn.c
+++ b/servers/slapd/back-meta/conn.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -699,7 +699,8 @@ meta_back_retry(
 	SlapReply		*rs,
 	metaconn_t		**mcp,
 	int			candidate,
-	ldap_back_send_t	sendok )
+	ldap_back_send_t	sendok,
+	SlapReply      *candidates )
 {
 	metainfo_t		*mi = ( metainfo_t * )op->o_bd->be_private;
 	metatarget_t		*mt = mi->mi_targets[ candidate ];
@@ -971,64 +972,14 @@ meta_back_get_candidate(
 	return candidate;
 }
 
-static void	*meta_back_candidates_dummy;
-
-static void
-meta_back_candidates_keyfree(
-	void		*key,
-	void		*data )
-{
-	metacandidates_t	*mc = (metacandidates_t *)data;
-
-	ber_memfree_x( mc->mc_candidates, NULL );
-	ber_memfree_x( data, NULL );
-}
-
 SlapReply *
 meta_back_candidates_get( Operation *op )
 {
 	metainfo_t		*mi = ( metainfo_t * )op->o_bd->be_private;
-	metacandidates_t	*mc;
-
-	if ( op->o_threadctx ) {
-		void		*data = NULL;
-
-		ldap_pvt_thread_pool_getkey( op->o_threadctx,
-				&meta_back_candidates_dummy, &data, NULL );
-		mc = (metacandidates_t *)data;
+	SlapReply 	*candidates;
 
-	} else {
-		mc = mi->mi_candidates;
-	}
-
-	if ( mc == NULL ) {
-		mc = ch_calloc( sizeof( metacandidates_t ), 1 );
-		mc->mc_ntargets = mi->mi_ntargets;
-		mc->mc_candidates = ch_calloc( sizeof( SlapReply ), mc->mc_ntargets );
-		if ( op->o_threadctx ) {
-			void		*data = NULL;
-
-			data = (void *)mc;
-			ldap_pvt_thread_pool_setkey( op->o_threadctx,
-					&meta_back_candidates_dummy, data,
-					meta_back_candidates_keyfree,
-					NULL, NULL );
-
-		} else {
-			mi->mi_candidates = mc;
-		}
-
-	} else if ( mc->mc_ntargets < mi->mi_ntargets ) {
-		/* NOTE: in the future, may want to allow back-config
-		 * to add/remove targets from back-meta... */
-		mc->mc_candidates = ch_realloc( mc->mc_candidates,
-				sizeof( SlapReply ) * mi->mi_ntargets );
-		memset( &mc->mc_candidates[ mc->mc_ntargets ], 0,
-			sizeof( SlapReply ) * ( mi->mi_ntargets - mc->mc_ntargets ) );
-		mc->mc_ntargets = mi->mi_ntargets;
-	}
-
-	return mc->mc_candidates;
+	candidates = op->o_tmpcalloc( mi->mi_ntargets, sizeof( SlapReply ), op->o_tmpmemctx );
+	return candidates;
 }
 
 /*
@@ -1066,10 +1017,11 @@ meta_back_candidates_get( Operation *op )
  */
 metaconn_t *
 meta_back_getconn(
-       	Operation 		*op,
+	Operation 		*op,
 	SlapReply		*rs,
 	int 			*candidate,
-	ldap_back_send_t	sendok )
+	ldap_back_send_t	sendok,
+	SlapReply	*candidates )
 {
 	metainfo_t	*mi = ( metainfo_t * )op->o_bd->be_private;
 	metaconn_t	*mc = NULL,
@@ -1090,8 +1042,6 @@ meta_back_getconn(
 	struct berval	ndn = op->o_req_ndn,
 			pndn;
 
-	SlapReply	*candidates = meta_back_candidates_get( op );
-
 	/* Internal searches are privileged and shared. So is root. */
 	if ( ( !BER_BVISEMPTY( &op->o_ndn ) && META_BACK_PROXYAUTHZ_ALWAYS( mi ) )
 		|| ( BER_BVISEMPTY( &op->o_ndn ) && META_BACK_PROXYAUTHZ_ANON( mi ) )
@@ -1474,7 +1424,7 @@ retry_lock2:;
 		/*
 		 * Clear all other candidates
 		 */
-		( void )meta_clear_unused_candidates( op, i );
+		( void )meta_clear_unused_candidates( op, i, candidates );
 
 		mt = mi->mi_targets[ i ];
 		msc = &mc->mc_conns[ i ];
diff --git a/servers/slapd/back-meta/delete.c b/servers/slapd/back-meta/delete.c
index bec437a..6174e44 100644
--- a/servers/slapd/back-meta/delete.c
+++ b/servers/slapd/back-meta/delete.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -43,9 +43,12 @@ meta_back_delete( Operation *op, SlapReply *rs )
 	int		msgid;
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	LDAPControl	**ctrls = NULL;
+	SlapReply *candidates = NULL;
 
-	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR );
-	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR ) ) {
+	candidates = meta_back_candidates_get( op );
+	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR, candidates );
+	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR, candidates ) ) {
+		op->o_tmpfree( candidates, op->o_tmpmemctx );
 		return rs->sr_err;
 	}
 
@@ -79,7 +82,7 @@ retry:;
 		mt->mt_timeout[ SLAP_OP_DELETE ], ( LDAP_BACK_SENDRESULT | retrying ) );
 	if ( rs->sr_err == LDAP_UNAVAILABLE && retrying ) {
 		retrying &= ~LDAP_BACK_RETRYING;
-		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR ) ) {
+		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR, candidates ) ) {
 			/* if the identity changed, there might be need to re-authz */
 			(void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
 			goto retry;
@@ -98,6 +101,7 @@ cleanup:;
 		meta_back_release_conn( mi, mc );
 	}
 
+	op->o_tmpfree( candidates, op->o_tmpmemctx );
 	return rs->sr_err;
 }
 
diff --git a/servers/slapd/back-meta/dncache.c b/servers/slapd/back-meta/dncache.c
index a3e7958..2781b8c 100644
--- a/servers/slapd/back-meta/dncache.c
+++ b/servers/slapd/back-meta/dncache.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
diff --git a/servers/slapd/back-meta/init.c b/servers/slapd/back-meta/init.c
index 8639109..08890a7 100644
--- a/servers/slapd/back-meta/init.c
+++ b/servers/slapd/back-meta/init.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -326,8 +326,8 @@ meta_back_map_free( struct ldapmap *lm )
 	lm->map = NULL;
 }
 
-static void
-target_free(
+void
+meta_back_target_free(
 	metatarget_t	*mt )
 {
 	if ( mt->mt_uri ) {
@@ -433,7 +433,7 @@ meta_back_db_destroy(
 					ldap_pvt_thread_mutex_destroy( &mt->mt_quarantine_mutex );
 				}
 
-				target_free( mt );
+				meta_back_target_free( mt );
 			}
 
 			free( mi->mi_targets );
diff --git a/servers/slapd/back-meta/map.c b/servers/slapd/back-meta/map.c
index 6591341..b606d70 100644
--- a/servers/slapd/back-meta/map.c
+++ b/servers/slapd/back-meta/map.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2022 The OpenLDAP Foundation.
+ * Copyright 1998-2024 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/servers/slapd/back-meta/modify.c b/servers/slapd/back-meta/modify.c
index 459e835..9485eee 100644
--- a/servers/slapd/back-meta/modify.c
+++ b/servers/slapd/back-meta/modify.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -49,9 +49,12 @@ meta_back_modify( Operation *op, SlapReply *rs )
 	int		msgid;
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	LDAPControl	**ctrls = NULL;
+	SlapReply *candidates = NULL;
 
-	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR );
-	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR ) ) {
+	candidates = meta_back_candidates_get( op );
+	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR, candidates );
+	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR, candidates ) ) {
+		op->o_tmpfree( candidates, op->o_tmpmemctx );
 		return rs->sr_err;
 	}
 
@@ -180,7 +183,7 @@ retry:;
 		mt->mt_timeout[ SLAP_OP_MODIFY ], ( LDAP_BACK_SENDRESULT | retrying ) );
 	if ( rs->sr_err == LDAP_UNAVAILABLE && retrying ) {
 		retrying &= ~LDAP_BACK_RETRYING;
-		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR ) ) {
+		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR, candidates ) ) {
 			/* if the identity changed, there might be need to re-authz */
 			(void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
 			goto retry;
@@ -205,6 +208,7 @@ cleanup:;
 		meta_back_release_conn( mi, mc );
 	}
 
+	op->o_tmpfree( candidates, op->o_tmpmemctx );
 	return rs->sr_err;
 }
 
diff --git a/servers/slapd/back-meta/modrdn.c b/servers/slapd/back-meta/modrdn.c
index cf6e1be..818ac37 100644
--- a/servers/slapd/back-meta/modrdn.c
+++ b/servers/slapd/back-meta/modrdn.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -45,9 +45,12 @@ meta_back_modrdn( Operation *op, SlapReply *rs )
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	LDAPControl	**ctrls = NULL;
 	struct berval	newrdn = BER_BVNULL;
+	SlapReply *candidates = NULL;
 
-	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR );
-	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR ) ) {
+	candidates = meta_back_candidates_get( op );
+	mc = meta_back_getconn( op, rs, &candidate, LDAP_BACK_SENDERR, candidates );
+	if ( !mc || !meta_back_dobind( op, rs, mc, LDAP_BACK_SENDERR, candidates ) ) {
+		op->o_tmpfree( candidates, op->o_tmpmemctx );
 		return rs->sr_err;
 	}
 
@@ -142,7 +145,7 @@ retry:;
 		mt->mt_timeout[ SLAP_OP_MODRDN ], ( LDAP_BACK_SENDRESULT | retrying ) );
 	if ( rs->sr_err == LDAP_UNAVAILABLE && retrying ) {
 		retrying &= ~LDAP_BACK_RETRYING;
-		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR ) ) {
+		if ( meta_back_retry( op, rs, &mc, candidate, LDAP_BACK_SENDERR, candidates ) ) {
 			/* if the identity changed, there might be need to re-authz */
 			(void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
 			goto retry;
@@ -172,6 +175,7 @@ cleanup:;
 		meta_back_release_conn( mi, mc );
 	}
 
+	op->o_tmpfree( candidates, op->o_tmpmemctx );
 	return rs->sr_err;
 }
 
diff --git a/servers/slapd/back-meta/proto-meta.h b/servers/slapd/back-meta/proto-meta.h
index f6c16b2..e299ce3 100644
--- a/servers/slapd/back-meta/proto-meta.h
+++ b/servers/slapd/back-meta/proto-meta.h
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c
index cfd2f4b..fd4407d 100644
--- a/servers/slapd/back-meta/search.c
+++ b/servers/slapd/back-meta/search.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.
@@ -177,7 +177,6 @@ meta_search_dobind_init(
 
 	/* NOTE: this obsoletes pseudorootdn */
 	if ( op->o_conn != NULL &&
-		!op->o_do_not_cache &&
 		( BER_BVISNULL( &msc->msc_bound_ndn ) ||
 			BER_BVISEMPTY( &msc->msc_bound_ndn ) ||
 			( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
@@ -723,7 +722,7 @@ retry:;
 		break;
 	
 	case LDAP_SERVER_DOWN:
-		if ( nretries && meta_back_retry( op, rs, mcp, candidate, LDAP_BACK_DONTSEND ) ) {
+		if ( nretries && meta_back_retry( op, rs, mcp, candidate, LDAP_BACK_DONTSEND, candidates ) ) {
 			nretries = 0;
 			/* if the identity changed, there might be need to re-authz */
 			(void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
@@ -799,8 +798,9 @@ meta_back_search( Operation *op, SlapReply *rs )
 	 * FIXME: in case of values return filter, we might want
 	 * to map attrs and maybe rewrite value
 	 */
+	candidates = meta_back_candidates_get( op );
 getconn:;
-	mc = meta_back_getconn( op, rs, NULL, sendok );
+	mc = meta_back_getconn( op, rs, NULL, sendok, candidates );
 	if ( !mc ) {
 		return rs->sr_err;
 	}
@@ -808,7 +808,6 @@ getconn:;
 	dc.conn = op->o_conn;
 	dc.rs = rs;
 
-	if ( candidates == NULL ) candidates = meta_back_candidates_get( op );
 	/*
 	 * Inits searches
 	 */
@@ -1147,7 +1146,7 @@ really_bad:;
 				if ( candidates[ i ].sr_type == REP_INTERMEDIATE ) {
 					candidates[ i ].sr_type = REP_RESULT;
 
-					if ( meta_back_retry( op, rs, &mc, i, LDAP_BACK_DONTSEND ) ) {
+					if ( meta_back_retry( op, rs, &mc, i, LDAP_BACK_DONTSEND, candidates ) ) {
 						candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 						switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates, NULL, 0 ) )
 						{
@@ -1998,6 +1997,7 @@ finish:;
 		ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 	}
 
+	op->o_tmpfree( candidates, op->o_tmpmemctx );
 	return rs->sr_err;
 }
 
diff --git a/servers/slapd/back-meta/suffixmassage.c b/servers/slapd/back-meta/suffixmassage.c
index 8d0b5e7..26be544 100644
--- a/servers/slapd/back-meta/suffixmassage.c
+++ b/servers/slapd/back-meta/suffixmassage.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2022 The OpenLDAP Foundation.
+ * Copyright 2003-2024 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/servers/slapd/back-meta/unbind.c b/servers/slapd/back-meta/unbind.c
index 6c2928d..2c5720b 100644
--- a/servers/slapd/back-meta/unbind.c
+++ b/servers/slapd/back-meta/unbind.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 2001-2003 Pierangelo Masarati.
  * Portions Copyright 1999-2003 Howard Chu.
  * All rights reserved.