File 0226-ITS-9197-back-ldap-added-task-that-prunes-... of Package openldap2.23252

Overview Repositories Revisions Requests Users Attributes Meta

File 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch of Package openldap2.23252

From 8ee47ce0fdb1e6796fdf46c3eb7bd453933c3a6b Mon Sep 17 00:00:00 2001
From: Tero Saarni <tero.saarni@gmail.com>
Date: Wed, 24 Feb 2021 22:07:48 +0000
Subject: [PATCH 226/230] ITS#9197 back-ldap: added task that prunes expired
 connections

---
 servers/slapd/back-ldap/back-ldap.h |   3 +-
 servers/slapd/back-ldap/bind.c      | 206 +++++++++++++++---
 servers/slapd/back-ldap/chain.c     | 141 +++++-------
 servers/slapd/back-ldap/config.c    |   2 +-
 servers/slapd/back-ldap/distproc.c  | 114 +++++-----
 servers/slapd/back-ldap/init.c      |  16 +-
 servers/slapd/back-ldap/monitor.c   |  10 +-
 servers/slapd/back-ldap/unbind.c    |   2 +-
 servers/slapd/back-meta/bind.c      |   4 +-
 servers/slapd/back-meta/conn.c      |  14 +-
 servers/slapd/back-meta/init.c      |   2 +-
 servers/slapd/back-meta/unbind.c    |   2 +-
 tests/data/slapd-proxytimeout.conf  |  71 ++++++
 tests/scripts/conf.sh               |   1 +
 tests/scripts/defines.sh            |   1 +
 tests/scripts/test079-proxy-timeout | 324 ++++++++++++++++++++++++++++
 16 files changed, 716 insertions(+), 197 deletions(-)
 create mode 100644 tests/data/slapd-proxytimeout.conf
 create mode 100644 tests/scripts/test079-proxy-timeout

diff --git a/servers/slapd/back-ldap/back-ldap.h b/servers/slapd/back-ldap/back-ldap.h
index c4639e4f4..1f5054cf3 100644
--- a/servers/slapd/back-ldap/back-ldap.h
+++ b/servers/slapd/back-ldap/back-ldap.h
@@ -180,7 +180,7 @@ typedef struct ldapconn_t {
 
 typedef struct ldap_avl_info_t {
 	ldap_pvt_thread_mutex_t		lai_mutex;
-	Avlnode				*lai_tree;
+	TAvlnode			*lai_tree;
 } ldap_avl_info_t;
 
 typedef struct slap_retry_info_t {
@@ -414,6 +414,7 @@ typedef struct ldapinfo_t {
 
 	ldap_pvt_thread_mutex_t li_counter_mutex;
 	ldap_pvt_mp_t		li_ops_completed[SLAP_OP_LAST];
+	struct re_s*		li_conn_expire_task;
 } ldapinfo_t;
 
 #define	LDAP_ERR_OK(err) ((err) == LDAP_SUCCESS || (err) == LDAP_COMPARE_FALSE || (err) == LDAP_COMPARE_TRUE)
diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index 998b2c796..1f9cbf185 100644
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -34,6 +34,7 @@
 #include "back-ldap.h"
 #include "lutil.h"
 #include "lutil_ldap.h"
+#include "ldap_rq.h"
 
 #define LDAP_CONTROL_OBSOLETE_PROXY_AUTHZ	"2.16.840.1.113730.3.4.12"
 
@@ -60,7 +61,7 @@ static const struct {
 };
 
 static void
-ldap_back_conn_print( ldapconn_t *lc, const char *avlstr )
+ldap_back_conn_print( ldapconn_t *lc )
 {
 	char buf[ SLAP_TEXT_BUFLEN ];
 	char fbuf[ sizeof("BAPTIENSC") ];
@@ -77,31 +78,10 @@ ldap_back_conn_print( ldapconn_t *lc, const char *avlstr )
 	}
 	fbuf[i] = '\0';
 	
-	fprintf( stderr, "lc=%p %s %s flags=0x%08x (%s)\n",
-		(void *)lc, buf, avlstr, lc->lc_lcflags, fbuf );
+	fprintf( stderr, "lc=%p %s flags=0x%08x (%s)\n",
+		(void *)lc, buf, lc->lc_lcflags, fbuf );
 }
 
-static void
-ldap_back_ravl_print( Avlnode *root, int depth )
-{
-	int		i;
-	ldapconn_t	*lc;
-	
-	if ( root == 0 ) {
-		return;
-	}
-	
-	ldap_back_ravl_print( root->avl_right, depth+1 );
-	
-	for ( i = 0; i < depth; i++ ) {
-		fprintf( stderr, "-" );
-	}
-
-	lc = root->avl_data;
-	ldap_back_conn_print( lc, avl_bf2str( root->avl_bf ) );
-
-	ldap_back_ravl_print( root->avl_left, depth + 1 );
-}
 
 static char* priv2str[] = {
 	"privileged",
@@ -129,7 +109,7 @@ ldap_back_print_conntree( ldapinfo_t *li, char *msg )
 		LDAP_TAILQ_FOREACH( lc, &li->li_conn_priv[ c ].lic_priv, lc_q )
 		{
 			fprintf( stderr, "    [%d] ", i );
-			ldap_back_conn_print( lc, "" );
+			ldap_back_conn_print( lc );
 			i++;
 		}
 	}
@@ -138,7 +118,11 @@ ldap_back_print_conntree( ldapinfo_t *li, char *msg )
 		fprintf( stderr, "\t(empty)\n" );
 
 	} else {
-		ldap_back_ravl_print( li->li_conninfo.lai_tree, 0 );
+		TAvlnode *edge = tavl_end( li->li_conninfo.lai_tree, TAVL_DIR_LEFT );
+		while ( edge ) {
+			ldap_back_conn_print( (ldapconn_t *)edge->avl_data );
+			edge = tavl_next( edge, TAVL_DIR_RIGHT );
+		}
 	}
 	
 	fprintf( stderr, "<======== %s\n", msg );
@@ -167,6 +151,12 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs,
 static int
 ldap_back_conndnlc_cmp( const void *c1, const void *c2 );
 
+static void
+ldap_back_conn_prune( ldapinfo_t *li );
+
+static void
+ldap_back_schedule_conn_expiry( ldapinfo_t *li, ldapconn_t *lc );
+
 ldapconn_t *
 ldap_back_conn_delete( ldapinfo_t *li, ldapconn_t *lc )
 {
@@ -189,7 +179,7 @@ ldap_back_conn_delete( ldapinfo_t *li, ldapconn_t *lc )
 
 		if ( LDAP_BACK_CONN_CACHED( lc ) ) {
 			assert( !LDAP_BACK_CONN_TAINTED( lc ) );
-			tmplc = avl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc,
+			tmplc = tavl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc,
 				ldap_back_conndnlc_cmp );
 			assert( tmplc == lc );
 			LDAP_BACK_CONN_CACHED_CLEAR( lc );
@@ -343,7 +333,7 @@ retry_lock:;
 
 		/* delete all cached connections with the current connection */
 		if ( LDAP_BACK_SINGLECONN( li ) ) {
-			while ( ( tmplc = avl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc, ldap_back_conn_cmp ) ) != NULL )
+			while ( ( tmplc = tavl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc, ldap_back_conn_cmp ) ) != NULL )
 			{
 				assert( !LDAP_BACK_PCONN_ISPRIV( lc ) );
 				Debug( LDAP_DEBUG_TRACE,
@@ -371,7 +361,7 @@ retry_lock:;
 			if ( be_isroot_dn( op->o_bd, &op->o_req_ndn ) ) {
 				LDAP_BACK_PCONN_ROOTDN_SET( lc, op );
 			}
-			lerr = avl_insert( &li->li_conninfo.lai_tree, (caddr_t)lc,
+			lerr = tavl_insert( &li->li_conninfo.lai_tree, (caddr_t)lc,
 				ldap_back_conndn_cmp, ldap_back_conndn_dup );
 		}
 
@@ -938,7 +928,7 @@ retry_lock:
 		} else {
 
 			/* Searches for a ldapconn in the avl tree */
-			lc = (ldapconn_t *)avl_find( li->li_conninfo.lai_tree, 
+			lc = (ldapconn_t *)tavl_find( li->li_conninfo.lai_tree, 
 					(caddr_t)&lc_curr, ldap_back_conndn_cmp );
 		}
 
@@ -1084,7 +1074,7 @@ retry_lock:
 			rs->sr_err = 0;
 
 		} else {
-			rs->sr_err = avl_insert( &li->li_conninfo.lai_tree, (caddr_t)lc,
+			rs->sr_err = tavl_insert( &li->li_conninfo.lai_tree, (caddr_t)lc,
 				ldap_back_conndn_cmp, ldap_back_conndn_dup );
 			LDAP_BACK_CONN_CACHED_SET( lc );
 		}
@@ -1137,6 +1127,7 @@ retry_lock:
 				return NULL;
 			}
 		}
+		ldap_back_schedule_conn_expiry( li, lc );
 
 	} else {
 		int	expiring = 0;
@@ -3066,3 +3057,156 @@ ldap_back_connid2str( const ldapconn_base_t *lc, char *buf, ber_len_t buflen )
 
 	return len;
 }
+
+void *
+ldap_back_conn_expire_fn( void *ctx, void *arg )
+{
+	struct re_s *rtask = arg;
+	ldapinfo_t *li = (ldapinfo_t *)rtask->arg;
+	ldap_back_conn_prune( li );
+
+	return NULL;
+}
+
+/* Pick which expires first: connection TTL or idle timeout */
+static time_t
+ldap_back_conn_expire_time( ldapinfo_t *li, ldapconn_t *lc) {
+	if ( li->li_conn_ttl != 0 && li->li_idle_timeout != 0 ) {
+		return ( lc->lc_create_time + li->li_conn_ttl ) < ( lc->lc_time + li->li_idle_timeout ) ?
+			( lc->lc_create_time + li->li_conn_ttl ) : ( lc->lc_time + li->li_idle_timeout );
+	} else if ( li->li_conn_ttl != 0 ) {
+		return lc->lc_create_time + li->li_conn_ttl;
+	} else if ( li->li_idle_timeout != 0 ) {
+		return lc->lc_time + li->li_idle_timeout;
+	}
+	return -1;
+}
+
+static void
+ldap_back_conn_prune( ldapinfo_t *li )
+{
+	time_t		now = slap_get_time();
+	time_t 		next_timeout = -1; /* -1 means uninitialized */
+	TAvlnode	*edge;
+	int		c;
+
+	/*
+	 * Iterate though connections and close those that are pass the expiry time.
+	 * Also calculate the time for next connection to to expire.
+	 */
+	ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
+
+	for ( c = LDAP_BACK_PCONN_FIRST; c < LDAP_BACK_PCONN_LAST; c++ ) {
+		ldapconn_t *lc = LDAP_TAILQ_FIRST( &li->li_conn_priv[ c ].lic_priv );
+
+		while ( lc ) {
+			ldapconn_t *next = LDAP_TAILQ_NEXT( lc, lc_q );
+			time_t conn_expires = ldap_back_conn_expire_time( li, lc );
+
+			if ( now >= conn_expires ) {
+				if ( lc->lc_refcnt == 0 ) {
+					Debug( LDAP_DEBUG_TRACE,
+						"ldap_back_conn_prune: closing expired connection lc=%p\n",
+						lc, 0, 0 );
+					ldap_back_freeconn( li, lc, 0 );
+				} else {
+					Debug( LDAP_DEBUG_TRACE,
+						"ldap_back_conn_prune: tainting expired connection lc=%p\n",
+						lc, 0, 0 );
+					LDAP_BACK_CONN_TAINTED_SET( lc );
+				}
+			} else if ( next_timeout == -1 || conn_expires < next_timeout ) {
+				/* next_timeout was not yet initialized or current connection expires sooner */
+				next_timeout = conn_expires;
+			}
+
+			lc = next;
+		}
+	}
+
+	edge = tavl_end( li->li_conninfo.lai_tree, TAVL_DIR_LEFT );
+	while ( edge ) {
+		TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+		ldapconn_t *lc = (ldapconn_t *)edge->avl_data;
+		time_t conn_expires = ldap_back_conn_expire_time( li, lc );
+
+		if ( now >= conn_expires ) {
+			if ( lc->lc_refcnt == 0 ) {
+				Debug( LDAP_DEBUG_TRACE,
+					"ldap_back_conn_prune: closing expired connection lc=%p\n",
+					lc, 0, 0 );
+				ldap_back_freeconn( li, lc, 0 );
+			} else {
+				Debug( LDAP_DEBUG_TRACE,
+					"ldap_back_conn_prune: tainting expired connection lc=%p\n",
+					lc, 0, 0 );
+				LDAP_BACK_CONN_TAINTED_SET( lc );
+			}
+		} else if ( next_timeout == -1 || conn_expires < next_timeout ) {
+			next_timeout = conn_expires;
+		}
+
+		edge = next;
+	}
+
+	ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
+
+	/* Reschedule for next timeout or cancel the task */
+	ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
+	if ( next_timeout > 0 ) {
+		if ( ldap_pvt_runqueue_isrunning( &slapd_rq, li->li_conn_expire_task ) ) {
+			ldap_pvt_runqueue_stoptask( &slapd_rq, li->li_conn_expire_task );
+		}
+		li->li_conn_expire_task->interval.tv_sec = next_timeout - now;
+		ldap_pvt_runqueue_resched( &slapd_rq, li->li_conn_expire_task, 0 );
+
+		/*
+		 * The thread that handles runqueue might have already processed all tasks
+		 * before we insertered new task or rescheduled the existing task with new
+		 * timeout period. Wake it up to ensure that the task will be picked up.
+		 */
+		slap_wake_listener();
+		Debug( LDAP_DEBUG_TRACE,
+			"ldap_back_conn_prune: scheduled connection expiry timer to %ld sec\n",
+			li->li_conn_expire_task->interval.tv_sec, 0, 0 );
+	} else if ( next_timeout == -1 && li->li_conn_expire_task != NULL ) {
+		if ( ldap_pvt_runqueue_isrunning( &slapd_rq, li->li_conn_expire_task ) ) {
+			ldap_pvt_runqueue_stoptask( &slapd_rq, li->li_conn_expire_task );
+		}
+		ldap_pvt_runqueue_remove( &slapd_rq, li->li_conn_expire_task );
+		li->li_conn_expire_task = NULL;
+	}
+	ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
+
+	return;
+}
+
+static void
+ldap_back_schedule_conn_expiry( ldapinfo_t *li, ldapconn_t *lc ) {
+	/* Do nothing if timeouts are not set. */
+	if ( li->li_conn_ttl == 0 && li->li_idle_timeout == 0 ) {
+		return;
+	}
+
+	/*
+	 * If connection expire task is not running, create it and schedule for
+	 * timeout of this connection.
+	 *
+	 * If the task is already running, this connection cannot be next one
+	 * to expire and therefore timeout does not need to be re-calculated.
+	 */
+	ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
+	if ( li->li_conn_expire_task == NULL ) {
+		li->li_conn_expire_task = ldap_pvt_runqueue_insert( &slapd_rq,
+			ldap_back_conn_expire_time( li, lc ) - slap_get_time(),
+			ldap_back_conn_expire_fn, li, "ldap_back_conn_expire_fn",
+			"ldap_back_conn_expire_timer" );
+		slap_wake_listener();
+		Debug( LDAP_DEBUG_TRACE,
+			"ldap_back_conn_prune: scheduled connection expiry timer to %ld sec\n",
+			li->li_conn_expire_task->interval.tv_sec, 0, 0 );
+	}
+	ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
+
+	return;
+}
\ No newline at end of file
diff --git a/servers/slapd/back-ldap/chain.c b/servers/slapd/back-ldap/chain.c
index eeceb4c66..643fce9cf 100644
--- a/servers/slapd/back-ldap/chain.c
+++ b/servers/slapd/back-ldap/chain.c
@@ -556,7 +556,7 @@ Document: RFC 4511
 
 		/* Searches for a ldapinfo in the avl tree */
 		ldap_pvt_thread_mutex_lock( &lc->lc_lai.lai_mutex );
-		lip = (ldapinfo_t *)avl_find( lc->lc_lai.lai_tree, 
+		lip = (ldapinfo_t *)tavl_find( lc->lc_lai.lai_tree,
 			(caddr_t)&li, ldap_chain_uri_cmp );
 		ldap_pvt_thread_mutex_unlock( &lc->lc_lai.lai_mutex );
 
@@ -588,7 +588,7 @@ Document: RFC 4511
 
 			if ( LDAP_CHAIN_CACHE_URI( lc ) ) {
 				ldap_pvt_thread_mutex_lock( &lc->lc_lai.lai_mutex );
-				if ( avl_insert( &lc->lc_lai.lai_tree,
+				if ( tavl_insert( &lc->lc_lai.lai_tree,
 					(caddr_t)lip, ldap_chain_uri_cmp, ldap_chain_uri_dup ) )
 				{
 					/* someone just inserted another;
@@ -828,7 +828,7 @@ ldap_chain_search(
 
 		/* Searches for a ldapinfo in the avl tree */
 		ldap_pvt_thread_mutex_lock( &lc->lc_lai.lai_mutex );
-		lip = (ldapinfo_t *)avl_find( lc->lc_lai.lai_tree, 
+		lip = (ldapinfo_t *)tavl_find( lc->lc_lai.lai_tree,
 			(caddr_t)&li, ldap_chain_uri_cmp );
 		ldap_pvt_thread_mutex_unlock( &lc->lc_lai.lai_mutex );
 
@@ -861,7 +861,7 @@ ldap_chain_search(
 
 			if ( LDAP_CHAIN_CACHE_URI( lc ) ) {
 				ldap_pvt_thread_mutex_lock( &lc->lc_lai.lai_mutex );
-				if ( avl_insert( &lc->lc_lai.lai_tree,
+				if ( tavl_insert( &lc->lc_lai.lai_tree,
 					(caddr_t)lip, ldap_chain_uri_cmp, ldap_chain_uri_dup ) )
 				{
 					/* someone just inserted another;
@@ -1366,7 +1366,7 @@ fail:
 	if ( at ) {
 		li->li_uri = ch_strdup( at->a_vals[ 0 ].bv_val );
 		value_add_one( &li->li_bvuri, &at->a_vals[ 0 ] );
-		if ( avl_insert( &lc->lc_lai.lai_tree, (caddr_t)li,
+		if ( tavl_insert( &lc->lc_lai.lai_tree, (caddr_t)li,
 			ldap_chain_uri_cmp, ldap_chain_uri_dup ) )
 		{
 			Debug( LDAP_DEBUG_ANY, "slapd-chain: "
@@ -1389,34 +1389,27 @@ done:;
 	return rc;
 }
 
-typedef struct ldap_chain_cfadd_apply_t {
-	Operation	*op;
-	SlapReply	*rs;
-	Entry		*p;
-	ConfigArgs	*ca;
-	int		count;
-} ldap_chain_cfadd_apply_t;
-
-static int
-ldap_chain_cfadd_apply( void *datum, void *arg )
+static void
+ldap_chain_cfadd_apply(
+	ldapinfo_t *li,
+	Operation *op,
+	SlapReply *rs,
+	Entry *p,
+	ConfigArgs *ca,
+	int count )
 {
-	ldapinfo_t			*li = (ldapinfo_t *)datum;
-	ldap_chain_cfadd_apply_t	*lca = (ldap_chain_cfadd_apply_t *)arg;
-
 	struct berval			bv;
 
 	/* FIXME: should not hardcode "olcDatabase" here */
-	bv.bv_len = snprintf( lca->ca->cr_msg, sizeof( lca->ca->cr_msg ),
-		"olcDatabase={%d}%s", lca->count, lback->bi_type );
-	bv.bv_val = lca->ca->cr_msg;
+	bv.bv_len = snprintf( ca->cr_msg, sizeof( ca->cr_msg ),
+		"olcDatabase={%d}%s", count, lback->bi_type );
+	bv.bv_val = ca->cr_msg;
 
-	lca->ca->be->be_private = (void *)li;
-	config_build_entry( lca->op, lca->rs, lca->p->e_private, lca->ca,
+	ca->be->be_private = (void *)li;
+	config_build_entry( op, rs, p->e_private, ca,
 		&bv, lback->bi_cf_ocs, &chainocs[1] );
 
-	lca->count++;
-
-	return 0;
+	return;
 }
 
 static int
@@ -1426,20 +1419,20 @@ chain_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *ca )
 	slap_overinst	*on = (slap_overinst *)pe->ce_bi;
 	ldap_chain_t	*lc = (ldap_chain_t *)on->on_bi.bi_private;
 	void		*priv = (void *)ca->be->be_private;
+	TAvlnode	*edge;
+	int		count = 0;
 
 	if ( lback->bi_cf_ocs ) {
-		ldap_chain_cfadd_apply_t	lca = { 0 };
-
-		lca.op = op;
-		lca.rs = rs;
-		lca.p = p;
-		lca.ca = ca;
-		lca.count = 0;
 
-		(void)ldap_chain_cfadd_apply( (void *)lc->lc_common_li, (void *)&lca );
+		ldap_chain_cfadd_apply( lc->lc_common_li, op, rs, p, ca, count++ );
 
-		(void)avl_apply( lc->lc_lai.lai_tree, ldap_chain_cfadd_apply,
-			&lca, 1, AVL_INORDER );
+		edge = tavl_end( lc->lc_lai.lai_tree, TAVL_DIR_LEFT );
+		while ( edge ) {
+			TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+			ldapinfo_t *li = (ldapinfo_t *)edge->avl_data;
+			ldap_chain_cfadd_apply( li, op, rs, p, ca, count++ );
+			edge = next;
+		}
 
 		ca->be->be_private = priv;
 	}
@@ -1457,7 +1450,7 @@ chain_lddel( CfEntryInfo *ce, Operation *op )
 	ldapinfo_t	*li = (ldapinfo_t *) ce->ce_be->be_private;
 
 	if ( li != lc->lc_common_li ) {
-		if (! avl_delete( &lc->lc_lai.lai_tree, li, ldap_chain_uri_cmp ) ) {
+		if (! tavl_delete( &lc->lc_lai.lai_tree, li, ldap_chain_uri_cmp ) ) {
 			Debug( LDAP_DEBUG_ANY, "slapd-chain: avl_delete failed. "
 				"\"%s\" not found.\n", li->li_uri, 0, 0 );
 			return -1;
@@ -1866,7 +1859,7 @@ private_destroy:;
 					goto private_destroy;
 				}
 
-				if ( avl_insert( &lc->lc_lai.lai_tree,
+				if ( tavl_insert( &lc->lc_lai.lai_tree,
 					(caddr_t)lc->lc_cfg_li,
 					ldap_chain_uri_cmp, ldap_chain_uri_dup ) )
 				{
@@ -1891,22 +1884,6 @@ enum db_which {
 	db_last
 };
 
-typedef struct ldap_chain_db_apply_t {
-	BackendDB	*be;
-	BI_db_func	*func;
-} ldap_chain_db_apply_t;
-
-static int
-ldap_chain_db_apply( void *datum, void *arg )
-{
-	ldapinfo_t		*li = (ldapinfo_t *)datum;
-	ldap_chain_db_apply_t	*lca = (ldap_chain_db_apply_t *)arg;
-
-	lca->be->be_private = (void *)li;
-
-	return lca->func( lca->be, NULL );
-}
-
 static int
 ldap_chain_db_func(
 	BackendDB *be,
@@ -1934,14 +1911,17 @@ ldap_chain_db_func(
 			}
 
 			if ( lc->lc_lai.lai_tree != NULL ) {
-				ldap_chain_db_apply_t	lca;
-
-				lca.be = &db;
-				lca.func = func;
-
-				rc = avl_apply( lc->lc_lai.lai_tree,
-					ldap_chain_db_apply, (void *)&lca,
-					1, AVL_INORDER ) != AVL_NOMORE;
+				TAvlnode *edge = tavl_end( lc->lc_lai.lai_tree, TAVL_DIR_LEFT );
+				while ( edge ) {
+					TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+					ldapinfo_t *li = (ldapinfo_t *)edge->avl_data;
+					db.be_private = (void *)li;
+					rc = func( &db, NULL );
+					if ( rc == 1 ) {
+						break;
+					}
+					edge = next;
+				}
 			}
 		}
 	}
@@ -2008,7 +1988,7 @@ ldap_chain_db_destroy(
 	rc = ldap_chain_db_func( be, db_destroy );
 
 	if ( lc ) {
-		avl_free( lc->lc_lai.lai_tree, NULL );
+		tavl_free( lc->lc_lai.lai_tree, NULL );
 		ldap_pvt_thread_mutex_destroy( &lc->lc_lai.lai_mutex );
 		ch_free( lc );
 	}
@@ -2122,22 +2102,6 @@ ldap_chain_db_open_one(
 	return lback->bi_db_open( be, NULL );
 }
 
-typedef struct ldap_chain_conn_apply_t {
-	BackendDB	*be;
-	Connection	*conn;
-} ldap_chain_conn_apply_t;
-
-static int
-ldap_chain_conn_apply( void *datum, void *arg )
-{
-	ldapinfo_t		*li = (ldapinfo_t *)datum;
-	ldap_chain_conn_apply_t	*lca = (ldap_chain_conn_apply_t *)arg;
-
-	lca->be->be_private = (void *)li;
-
-	return lback->bi_connection_destroy( lca->be, lca->conn );
-}
-
 static int
 ldap_chain_connection_destroy(
 	BackendDB *be,
@@ -2147,15 +2111,24 @@ ldap_chain_connection_destroy(
 	slap_overinst		*on = (slap_overinst *) be->bd_info;
 	ldap_chain_t		*lc = (ldap_chain_t *)on->on_bi.bi_private;
 	void			*private = be->be_private;
-	ldap_chain_conn_apply_t	lca;
+	TAvlnode		*edge;
 	int			rc;
 
 	be->be_private = NULL;
-	lca.be = be;
-	lca.conn = conn;
 	ldap_pvt_thread_mutex_lock( &lc->lc_lai.lai_mutex );
-	rc = avl_apply( lc->lc_lai.lai_tree, ldap_chain_conn_apply,
-		(void *)&lca, 1, AVL_INORDER ) != AVL_NOMORE;
+	edge = tavl_end( lc->lc_lai.lai_tree, TAVL_DIR_LEFT );
+	while ( edge ) {
+		TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+		ldapinfo_t *li = (ldapinfo_t *)edge->avl_data;
+		be->be_private = (void *)li;
+		rc = lback->bi_connection_destroy( be, conn );
+		if ( rc == 1 ) {
+			break;
+		}
+		edge = next;
+	}
+
+
 	ldap_pvt_thread_mutex_unlock( &lc->lc_lai.lai_mutex );
 	be->be_private = private;
 
diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c
index 38da178d1..cff5cd289 100644
--- a/servers/slapd/back-ldap/config.c
+++ b/servers/slapd/back-ldap/config.c
@@ -1424,7 +1424,7 @@ ldap_back_cf_gen( ConfigArgs *c )
 			/* NOTE: don't worry about locking: if we got here,
 			 * other threads are suspended. */
 			if ( li->li_conninfo.lai_tree != NULL ) {
-				avl_free( li->li_conninfo.lai_tree, ldap_back_conn_free );
+				tavl_free( li->li_conninfo.lai_tree, ldap_back_conn_free );
 				li->li_conninfo.lai_tree = NULL;
 			}
 			
diff --git a/servers/slapd/back-ldap/distproc.c b/servers/slapd/back-ldap/distproc.c
index ed978728a..a8ea803b0 100644
--- a/servers/slapd/back-ldap/distproc.c
+++ b/servers/slapd/back-ldap/distproc.c
@@ -435,7 +435,7 @@ distproc_ldadd( CfEntryInfo *p, Entry *e, ConfigArgs *ca )
 	if ( lc->lc_common_li == NULL ) {
 		lc->lc_common_li = li;
 
-	} else if ( avl_insert( &lc->lc_lai.lai_tree, (caddr_t)li,
+	} else if ( tavl_insert( &lc->lc_lai.lai_tree, (caddr_t)li,
 		ldap_distproc_uri_cmp, ldap_distproc_uri_dup ) )
 	{
 		Debug( LDAP_DEBUG_ANY, "slapd-distproc: "
@@ -463,26 +463,27 @@ typedef struct ldap_distproc_cfadd_apply_t {
 	int		count;
 } ldap_distproc_cfadd_apply_t;
 
-static int
-ldap_distproc_cfadd_apply( void *datum, void *arg )
+static void
+ldap_distproc_cfadd_apply(
+	ldapinfo_t *li,
+	Operation *op,
+	SlapReply *rs,
+	Entry *p,
+	ConfigArgs *ca,
+	int count )
 {
-	ldapinfo_t			*li = (ldapinfo_t *)datum;
-	ldap_distproc_cfadd_apply_t	*lca = (ldap_distproc_cfadd_apply_t *)arg;
-
 	struct berval			bv;
 
 	/* FIXME: should not hardcode "olcDatabase" here */
-	bv.bv_len = snprintf( lca->ca->cr_msg, sizeof( lca->ca->cr_msg ),
-		"olcDatabase={%d}%s", lca->count, lback->bi_type );
-	bv.bv_val = lca->ca->cr_msg;
+	bv.bv_len = snprintf( ca->cr_msg, sizeof( ca->cr_msg ),
+		"olcDatabase={%d}%s", count, lback->bi_type );
+	bv.bv_val = ca->cr_msg;
 
-	lca->ca->be->be_private = (void *)li;
-	config_build_entry( lca->op, lca->rs, lca->p->e_private, lca->ca,
+	ca->be->be_private = (void *)li;
+	config_build_entry( op, rs, p->e_private, ca,
 		&bv, lback->bi_cf_ocs, &distproc_ocs[ 1 ] );
 
-	lca->count++;
-
-	return 0;
+	return;
 }
 
 static int
@@ -492,6 +493,8 @@ distproc_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *ca )
 	slap_overinst	*on = (slap_overinst *)pe->ce_bi;
 	ldap_distproc_t	*lc = (ldap_distproc_t *)on->on_bi.bi_private;
 	void		*priv = (void *)ca->be->be_private;
+	TAvlnode	*edge;
+	int		count = 0;
 
 	if ( lback->bi_cf_ocs ) {
 		ldap_distproc_cfadd_apply_t	lca = { 0 };
@@ -502,10 +505,15 @@ distproc_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *ca )
 		lca.ca = ca;
 		lca.count = 0;
 
-		(void)ldap_distproc_cfadd_apply( (void *)lc->lc_common_li, (void *)&lca );
+		ldap_distproc_cfadd_apply( lc->lc_common_li, op, rs, p, ca, count++ );
 
-		(void)avl_apply( lc->lc_lai.lai_tree, ldap_distproc_cfadd_apply,
-			&lca, 1, AVL_INORDER );
+		edge = tavl_end( lc->lc_lai.lai_tree, TAVL_DIR_LEFT );
+		while ( edge ) {
+			TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+			ldapinfo_t *li = (ldapinfo_t *)edge->avl_data;
+			ldap_distproc_cfadd_apply( li, op, rs, p, ca, count++ );
+			edge = next;
+		}
 
 		ca->be->be_private = priv;
 	}
@@ -675,7 +683,7 @@ private_destroy:;
 					goto private_destroy;
 				}
 
-				if ( avl_insert( &lc->lc_lai.lai_tree,
+				if ( tavl_insert( &lc->lc_lai.lai_tree,
 					(caddr_t)lc->lc_cfg_li,
 					ldap_distproc_uri_cmp, ldap_distproc_uri_dup ) )
 				{
@@ -700,22 +708,6 @@ enum db_which {
 	db_last
 };
 
-typedef struct ldap_distproc_db_apply_t {
-	BackendDB	*be;
-	BI_db_func	*func;
-} ldap_distproc_db_apply_t;
-
-static int
-ldap_distproc_db_apply( void *datum, void *arg )
-{
-	ldapinfo_t		*li = (ldapinfo_t *)datum;
-	ldap_distproc_db_apply_t	*lca = (ldap_distproc_db_apply_t *)arg;
-
-	lca->be->be_private = (void *)li;
-
-	return lca->func( lca->be, NULL );
-}
-
 static int
 ldap_distproc_db_func(
 	BackendDB *be,
@@ -743,14 +735,17 @@ ldap_distproc_db_func(
 			}
 
 			if ( lc->lc_lai.lai_tree != NULL ) {
-				ldap_distproc_db_apply_t	lca;
-
-				lca.be = &db;
-				lca.func = func;
-
-				rc = avl_apply( lc->lc_lai.lai_tree,
-					ldap_distproc_db_apply, (void *)&lca,
-					1, AVL_INORDER ) != AVL_NOMORE;
+				TAvlnode *edge = tavl_end( lc->lc_lai.lai_tree, TAVL_DIR_LEFT );
+				while ( edge ) {
+					TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+					ldapinfo_t *li = (ldapinfo_t *)edge->avl_data;
+					be->be_private = (void *)li;
+					rc = func( &db, NULL );
+					if ( rc == 1 ) {
+						break;
+					}
+					edge = next;
+				}
 			}
 		}
 	}
@@ -787,7 +782,7 @@ ldap_distproc_db_destroy(
 	rc = ldap_distproc_db_func( be, db_destroy );
 
 	if ( lc ) {
-		avl_free( lc->lc_lai.lai_tree, NULL );
+		tavl_free( lc->lc_lai.lai_tree, NULL );
 		ldap_pvt_thread_mutex_destroy( &lc->lc_lai.lai_mutex );
 		ch_free( lc );
 	}
@@ -857,22 +852,6 @@ ldap_distproc_db_init_one(
 	return 0;
 }
 
-typedef struct ldap_distproc_conn_apply_t {
-	BackendDB	*be;
-	Connection	*conn;
-} ldap_distproc_conn_apply_t;
-
-static int
-ldap_distproc_conn_apply( void *datum, void *arg )
-{
-	ldapinfo_t		*li = (ldapinfo_t *)datum;
-	ldap_distproc_conn_apply_t	*lca = (ldap_distproc_conn_apply_t *)arg;
-
-	lca->be->be_private = (void *)li;
-
-	return lback->bi_connection_destroy( lca->be, lca->conn );
-}
-
 static int
 ldap_distproc_connection_destroy(
 	BackendDB *be,
@@ -882,15 +861,22 @@ ldap_distproc_connection_destroy(
 	slap_overinst		*on = (slap_overinst *) be->bd_info;
 	ldap_distproc_t		*lc = (ldap_distproc_t *)on->on_bi.bi_private;
 	void			*private = be->be_private;
-	ldap_distproc_conn_apply_t	lca;
 	int			rc;
+	TAvlnode		*edge;
 
 	be->be_private = NULL;
-	lca.be = be;
-	lca.conn = conn;
 	ldap_pvt_thread_mutex_lock( &lc->lc_lai.lai_mutex );
-	rc = avl_apply( lc->lc_lai.lai_tree, ldap_distproc_conn_apply,
-		(void *)&lca, 1, AVL_INORDER ) != AVL_NOMORE;
+	edge = tavl_end( lc->lc_lai.lai_tree, TAVL_DIR_LEFT );
+	while ( edge ) {
+		TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+		ldapinfo_t *li = (ldapinfo_t *)edge->avl_data;
+		be->be_private = (void *)li;
+		rc = lback->bi_connection_destroy( be, conn );
+		if ( rc == 1 ) {
+			break;
+		}
+		edge = next;
+	}
 	ldap_pvt_thread_mutex_unlock( &lc->lc_lai.lai_mutex );
 	be->be_private = private;
 
diff --git a/servers/slapd/back-ldap/init.c b/servers/slapd/back-ldap/init.c
index f73344c99..8b801ff67 100644
--- a/servers/slapd/back-ldap/init.c
+++ b/servers/slapd/back-ldap/init.c
@@ -31,6 +31,7 @@
 #include "slap.h"
 #include "config.h"
 #include "back-ldap.h"
+#include "ldap_rq.h"
 
 static const ldap_extra_t ldap_extra = {
 	ldap_back_proxy_authz_ctrl,
@@ -185,6 +186,8 @@ ldap_back_db_init( Backend *be, ConfigReply *cr )
 		ldap_pvt_mp_init( li->li_ops_completed[ i ] );
 	}
 
+	li->li_conn_expire_task = NULL;
+
 	be->be_private = li;
 	SLAP_DBFLAGS( be ) |= SLAP_DBFLAG_NOLASTMOD;
 
@@ -303,6 +306,16 @@ ldap_back_db_destroy( Backend *be, ConfigReply *cr )
 
 		(void)ldap_back_monitor_db_destroy( be );
 
+		/* Stop and remove the task that prunes expired connections */
+		if ( li->li_conn_expire_task != NULL ) {
+			ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
+			if ( ldap_pvt_runqueue_isrunning( &slapd_rq, li->li_conn_expire_task ) ) {
+					ldap_pvt_runqueue_stoptask( &slapd_rq, li->li_conn_expire_task );
+			}
+			ldap_pvt_runqueue_remove( &slapd_rq, li->li_conn_expire_task );
+			ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
+		}
+
 		ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
 
 		if ( li->li_uri != NULL ) {
@@ -323,7 +336,7 @@ ldap_back_db_destroy( Backend *be, ConfigReply *cr )
 			li->li_idassert_authz = NULL;
 		}
                	if ( li->li_conninfo.lai_tree ) {
-			avl_free( li->li_conninfo.lai_tree, ldap_back_conn_free );
+			tavl_free( li->li_conninfo.lai_tree, ldap_back_conn_free );
 		}
 		for ( i = LDAP_BACK_PCONN_FIRST; i < LDAP_BACK_PCONN_LAST; i++ ) {
 			while ( !LDAP_TAILQ_EMPTY( &li->li_conn_priv[ i ].lic_priv ) ) {
@@ -359,4 +372,3 @@ ldap_back_db_destroy( Backend *be, ConfigReply *cr )
 SLAP_BACKEND_INIT_MODULE( ldap )
 
 #endif /* SLAPD_LDAP == SLAPD_MOD_DYNAMIC */
-
diff --git a/servers/slapd/back-ldap/monitor.c b/servers/slapd/back-ldap/monitor.c
index e12de8e4e..77f11ccb5 100644
--- a/servers/slapd/back-ldap/monitor.c
+++ b/servers/slapd/back-ldap/monitor.c
@@ -540,6 +540,7 @@ ldap_back_monitor_conn_create(
 
 	struct ldap_back_monitor_conn_arg *arg;
 	int conn_type;
+	TAvlnode *edge;
 
 	assert( e_parent->e_private != NULL );
 
@@ -564,8 +565,13 @@ ldap_back_monitor_conn_create(
 		}
 	}
 
-	avl_apply( li->li_conninfo.lai_tree, (AVL_APPLY)ldap_back_monitor_conn_entry,
-		arg, -1, AVL_INORDER );
+	edge = tavl_end( li->li_conninfo.lai_tree, TAVL_DIR_LEFT );
+	while ( edge ) {
+		TAvlnode *next = tavl_next( edge, TAVL_DIR_RIGHT );
+		ldapconn_t *lc = (ldapconn_t *)edge->avl_data;
+		ldap_back_monitor_conn_entry( lc, arg );
+		edge = next;
+	}
 
 	ch_free( arg );
 
diff --git a/servers/slapd/back-ldap/unbind.c b/servers/slapd/back-ldap/unbind.c
index d8121f72d..6768baf16 100644
--- a/servers/slapd/back-ldap/unbind.c
+++ b/servers/slapd/back-ldap/unbind.c
@@ -51,7 +51,7 @@ ldap_back_conn_destroy(
 #if LDAP_BACK_PRINT_CONNTREE > 0
 	ldap_back_print_conntree( li, ">>> ldap_back_conn_destroy" );
 #endif /* LDAP_BACK_PRINT_CONNTREE */
-	while ( ( lc = avl_delete( &li->li_conninfo.lai_tree, (caddr_t)&lc_curr, ldap_back_conn_cmp ) ) != NULL )
+	while ( ( lc = tavl_delete( &li->li_conninfo.lai_tree, (caddr_t)&lc_curr, ldap_back_conn_cmp ) ) != NULL )
 	{
 		assert( !LDAP_BACK_PCONN_ISPRIV( lc ) );
 		Debug( LDAP_DEBUG_TRACE,
diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index f5d4df4e8..0e5e8853b 100644
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -220,7 +220,7 @@ meta_back_bind( Operation *op, SlapReply *rs )
 			if ( LDAP_BACK_SINGLECONN( mi ) ) {
 				metaconn_t	*tmpmc;
 
-				while ( ( tmpmc = avl_delete( &mi->mi_conninfo.lai_tree, (caddr_t)mc, meta_back_conn_cmp ) ) != NULL )
+				while ( ( tmpmc = tavl_delete( &mi->mi_conninfo.lai_tree, (caddr_t)mc, meta_back_conn_cmp ) ) != NULL )
 				{
 					assert( !LDAP_BACK_PCONN_ISPRIV( mc ) );
 					Debug( LDAP_DEBUG_TRACE,
@@ -243,7 +243,7 @@ meta_back_bind( Operation *op, SlapReply *rs )
 			}
 
 			ber_bvreplace( &mc->mc_local_ndn, &op->o_req_ndn );
-			lerr = avl_insert( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
+			lerr = tavl_insert( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
 				meta_back_conndn_cmp, meta_back_conndn_dup );
 #if META_BACK_PRINT_CONNTREE > 0
 			meta_back_print_conntree( mi, "<<< meta_back_bind" );
diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c
index 8a781e573..239c86e5e 100644
--- a/servers/slapd/back-meta/conn.c
+++ b/servers/slapd/back-meta/conn.c
@@ -160,7 +160,7 @@ meta_back_print( metaconn_t *mc, char *avlstr )
 }
 
 static void
-meta_back_ravl_print( Avlnode *root, int depth )
+meta_back_ravl_print( TAvlnode *root, int depth )
 {
 	int     	i;
 
@@ -849,7 +849,7 @@ meta_back_retry(
 
 				} else {
 					/* FIXME: check if in tree, for consistency? */
-					(void)avl_delete( &mi->mi_conninfo.lai_tree,
+					(void)tavl_delete( &mi->mi_conninfo.lai_tree,
 						( caddr_t )mc, meta_back_conndnmc_cmp );
 				}
 				LDAP_BACK_CONN_CACHED_CLEAR( mc );
@@ -1174,7 +1174,7 @@ retry_lock:;
 			
 
 		} else {
-			mc = (metaconn_t *)avl_find( mi->mi_conninfo.lai_tree, 
+			mc = (metaconn_t *)tavl_find( mi->mi_conninfo.lai_tree,
 				(caddr_t)&mc_curr, meta_back_conndn_cmp );
 		}
 
@@ -1219,7 +1219,7 @@ retry_lock:;
 						}
 
 					} else {
-						(void)avl_delete( &mi->mi_conninfo.lai_tree,
+						(void)tavl_delete( &mi->mi_conninfo.lai_tree,
 							(caddr_t)mc, meta_back_conndnmc_cmp );
 					}
 
@@ -1439,7 +1439,7 @@ retry_lock:;
 			if ( !( sendok & LDAP_BACK_BINDING ) ) {
 retry_lock2:;
 				ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
-				mc = (metaconn_t *)avl_find( mi->mi_conninfo.lai_tree, 
+				mc = (metaconn_t *)tavl_find( mi->mi_conninfo.lai_tree,
 					(caddr_t)&mc_curr, meta_back_conndn_cmp );
 				if ( mc != NULL ) {
 					/* catch taint errors */
@@ -1688,7 +1688,7 @@ done:;
 			rs->sr_err = 0;
 
 		} else if ( !( sendok & LDAP_BACK_BINDING ) ) {
-			err = avl_insert( &mi->mi_conninfo.lai_tree, ( caddr_t )mc,
+			err = tavl_insert( &mi->mi_conninfo.lai_tree, ( caddr_t )mc,
 			       	meta_back_conndn_cmp, meta_back_conndn_dup );
 			LDAP_BACK_CONN_CACHED_SET( mc );
 		}
@@ -1805,7 +1805,7 @@ meta_back_release_conn_lock(
 		} else if ( LDAP_BACK_CONN_CACHED( mc ) ) {
 			metaconn_t	*tmpmc;
 
-			tmpmc = avl_delete( &mi->mi_conninfo.lai_tree,
+			tmpmc = tavl_delete( &mi->mi_conninfo.lai_tree,
 				( caddr_t )mc, meta_back_conndnmc_cmp );
 
 			/* Overparanoid, but useful... */
diff --git a/servers/slapd/back-meta/init.c b/servers/slapd/back-meta/init.c
index fefdba812..d98fe3625 100644
--- a/servers/slapd/back-meta/init.c
+++ b/servers/slapd/back-meta/init.c
@@ -407,7 +407,7 @@ meta_back_db_destroy(
 		ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 
 		if ( mi->mi_conninfo.lai_tree ) {
-			avl_free( mi->mi_conninfo.lai_tree, meta_back_conn_free );
+			tavl_free( mi->mi_conninfo.lai_tree, meta_back_conn_free );
 		}
 		for ( i = LDAP_BACK_PCONN_FIRST; i < LDAP_BACK_PCONN_LAST; i++ ) {
 			while ( !LDAP_TAILQ_EMPTY( &mi->mi_conn_priv[ i ].mic_priv ) ) {
diff --git a/servers/slapd/back-meta/unbind.c b/servers/slapd/back-meta/unbind.c
index 2a866a6c7..8589262e6 100644
--- a/servers/slapd/back-meta/unbind.c
+++ b/servers/slapd/back-meta/unbind.c
@@ -54,7 +54,7 @@ meta_back_conn_destroy(
 #if META_BACK_PRINT_CONNTREE > 0
 	meta_back_print_conntree( mi, ">>> meta_back_conn_destroy" );
 #endif /* META_BACK_PRINT_CONNTREE */
-	while ( ( mc = avl_delete( &mi->mi_conninfo.lai_tree, ( caddr_t )&mc_curr, meta_back_conn_cmp ) ) != NULL )
+	while ( ( mc = tavl_delete( &mi->mi_conninfo.lai_tree, ( caddr_t )&mc_curr, meta_back_conn_cmp ) ) != NULL )
 	{
 		assert( !LDAP_BACK_PCONN_ISPRIV( mc ) );
 		Debug( LDAP_DEBUG_TRACE,
diff --git a/tests/data/slapd-proxytimeout.conf b/tests/data/slapd-proxytimeout.conf
new file mode 100644
index 000000000..2fb7c6dfa
--- /dev/null
+++ b/tests/data/slapd-proxytimeout.conf
@@ -0,0 +1,71 @@
+# provider slapd config -- for testing
+# $OpenLDAP$
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 1998-2021 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+
+include		@SCHEMADIR@/core.schema
+include		@SCHEMADIR@/cosine.schema
+include		@SCHEMADIR@/inetorgperson.schema
+include		@SCHEMADIR@/openldap.schema
+include		@SCHEMADIR@/nis.schema
+pidfile		@TESTDIR@/slapd.m.pid
+argsfile	@TESTDIR@/slapd.m.args
+
+#######################################################################
+# database definitions
+#######################################################################
+
+#mod#modulepath ../servers/slapd/back-@BACKEND@/:../servers/slapd/overlays
+#mod#moduleload back_@BACKEND@.la
+#ldapmod#modulepath ../servers/slapd/back-ldap/
+#ldapmod#moduleload back_ldap.la
+#rwmmod#modulepath ../servers/slapd/overlays/
+#rwmmod#moduleload rwm.la
+#monitormod#modulepath ../servers/slapd/back-monitor/
+#monitormod#moduleload back_monitor.la
+
+# here the proxy is not only acting as a proxy, but it also has a local database dc=local,dc=com"
+database	@BACKEND@
+suffix		"dc=local,dc=com"
+rootdn		"cn=Manager,dc=local,dc=com"
+rootpw		"secret"
+#~null~#directory	@TESTDIR@/db.2.a
+
+
+# Configure proxy
+# - normal user binds to "*,dc=example,dc=com" are proxied through to the remote slapd
+# - admin bind to local "cn=Manager,dc=local,dc=com" is overwritten by using idassert-bind
+database	ldap
+uri			"@URI1@"
+suffix		"dc=idle-timeout,dc=example,dc=com"
+idassert-bind bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials="secret"
+idassert-authzFrom "dn.exact:cn=Manager,dc=local,dc=com"
+rebind-as-user	yes
+monitoring 		on
+idle-timeout 	@TIMEOUT@
+overlay 		rwm
+rwm-suffixmassage   "dc=idle-timeout,dc=example,dc=com" "ou=People,dc=example,dc=com"
+
+database	ldap
+uri			"@URI1@"
+suffix		"dc=conn-ttl,dc=example,dc=com"
+idassert-bind bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials="secret"
+idassert-authzFrom "dn.exact:cn=Manager,dc=local,dc=com"
+rebind-as-user	yes
+monitoring		on
+conn-ttl 		@TIMEOUT@
+overlay 		rwm
+rwm-suffixmassage   "dc=conn-ttl,dc=example,dc=com" "ou=People,dc=example,dc=com"
+
+database	monitor
+
diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh
index 98bfb5194..6200880c4 100755
--- a/tests/scripts/conf.sh
+++ b/tests/scripts/conf.sh
@@ -79,4 +79,5 @@ sed -e "s/@BACKEND@/${BACKEND}/"			\
 	-e "s;@TESTWD@;${TESTWD};"			\
 	-e "s;@DATADIR@;${DATADIR};"			\
 	-e "s;@SCHEMADIR@;${SCHEMADIR};"		\
+	-e "s;@TIMEOUT@;${TIMEOUT};"			\
 	-e "/^#/d"
diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh
index 97cf08fd7..273f039cf 100755
--- a/tests/scripts/defines.sh
+++ b/tests/scripts/defines.sh
@@ -50,6 +50,7 @@ THREADS=${AC_THREADS-threadsno}
 SLEEP0=${SLEEP0-1}
 SLEEP1=${SLEEP1-7}
 SLEEP2=${SLEEP2-15}
+TIMEOUT=${TIMEOUT-4}
 
 # dirs
 PROGDIR=./progs
diff --git a/tests/scripts/test079-proxy-timeout b/tests/scripts/test079-proxy-timeout
new file mode 100644
index 000000000..e097c0739
--- /dev/null
+++ b/tests/scripts/test079-proxy-timeout
@@ -0,0 +1,324 @@
+#! /bin/sh
+# $OpenLDAP$
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 1998-2021 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+
+echo "running defines.sh"
+. $SRCDIR/scripts/defines.sh
+
+if test $BACKLDAP = "ldapno" ; then
+	echo "LDAP backend not available, test skipped"
+	exit 0
+fi
+if test $RWM = "rwmno" ; then
+        echo "rwm (rewrite/remap) overlay not available, test skipped"
+        exit 0
+fi
+
+mkdir -p $TESTDIR $DBDIR1 $DBDIR2
+$SLAPPASSWD -g -n >$CONFIGPWF
+
+#
+# Start slapd that acts as a remote LDAP server that will be proxied
+#
+echo "Running slapadd to build database for the remote slapd server..."
+. $CONFFILTER $BACKEND < $CONF > $CONF1
+$SLAPADD -f $CONF1 -l $LDIFORDERED
+RC=$?
+if test $RC != 0 ; then
+        echo "slapadd failed ($RC)!"
+        exit $RC
+fi
+
+echo "Starting remote slapd server on TCP/IP port $PORT1..."
+$SLAPD -f $CONF1 -h $URI1 -d $LVL > $LOG1 2>&1 &
+SERVERPID=$!
+if test $WAIT != 0 ; then
+    echo SERVERPID $SERVERPID
+    read foo
+fi
+
+#
+# Start ldapd that will proxy for the remote server
+#
+# Proxy is configured with two slapd-ldap backends:
+# - one with idle timeout set: dc=idle-timeout,$BASED
+# - one with connection TTL set: dc=conn-ttl,$BASEDN
+#
+echo "Starting slapd proxy on TCP/IP port $PORT2..."
+. $CONFFILTER $BACKEND < $DATADIR/slapd-proxytimeout.conf > $CONF2
+$SLAPD -f $CONF2 -h $URI2 -d $LVL > $LOG2 2>&1 &
+PROXYPID=$!
+if test $WAIT != 0 ; then
+    echo PROXYPID $PROXYPID
+    read foo
+fi
+
+KILLPIDS="$SERVERPID $PROXYPID"
+
+sleep $SLEEP0
+
+##############################################################################
+#
+# Test 1: Test that shared connections are timed out
+#
+
+NOW=`date +%s`
+echo "Create shared connection towards remote LDAP (time_t now=$NOW timeout=`expr $NOW + $TIMEOUT`)"
+
+$LDAPSEARCH -b "dc=idle-timeout,$BASEDN" \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD \
+        'objectclass=*' > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+        echo "ldapsearch failed for base: dc=idle-timeout,$BASEDN ($RC)!"
+        test $KILLSERVERS != no && kill -HUP $KILLPIDS
+        exit $RC
+fi
+
+$LDAPSEARCH -b "dc=conn-ttl,$BASEDN" \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD \
+        'objectclass=*' >> $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+        echo "ldapsearch failed for base: dc=conn-ttl,$BASEDN ($RC)!"
+        test $KILLSERVERS != no && kill -HUP $KILLPIDS
+        exit $RC
+fi
+
+# Check that connections are established by searching for olmDbConnURI from Monitor
+
+echo "Checking that proxy has created connections towards backend"
+
+$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 0 ; then
+    echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
+    exit $RC
+fi
+
+$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 0 ; then
+    echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
+    exit $RC
+fi
+
+# Wait for connections to be closed, either due to
+# - idle-timeout and
+# - conn-ttl
+
+echo "Sleeping until idle-timeout and conn-ttl have passed"
+sleep `expr $TIMEOUT + 1`
+
+echo "Checking that proxy has closed expired connections towards the remote LDAP server (time_t now=`date +%s`)"
+
+$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 1 ; then
+    echo "Error: LDAP connection to remote LDAP server was not closed"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
+    exit $RC
+fi
+
+$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 1 ; then
+    echo "Error: LDAP connection to remote LDAP server was not closed"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
+    exit $RC
+fi
+
+
+##############################################################################
+#
+# Test 2: Test that private connections are timed out
+#
+
+NOW=`date +%s`
+echo "Create private connection towards remote LDAP (time_t now=$NOW timeout=`expr $NOW + $TIMEOUT`)"
+
+# Create fifos that are used to pass searches from the test case to ldapsearch
+rm -f $TESTDIR/ldapsearch1.fifo $TESTDIR/ldapsearch2.fifo
+mkfifo $TESTDIR/ldapsearch1.fifo $TESTDIR/ldapsearch2.fifo
+
+# Execute ldapsearch on background and have it read searches from the fifo
+$LDAPSEARCH -b "dc=idle-timeout,$BASEDN" \
+        -D "cn=Barbara Jensen,ou=Information Technology Division,dc=idle-timeout,$BASEDN" \
+        -H $URI2 \
+        -w "bjensen" \
+        -f $TESTDIR/ldapsearch1.fifo >> $TESTOUT 2>&1 &
+LDAPSEARCHPIDS=$!
+
+$LDAPSEARCH -b "dc=conn-ttl,$BASEDN" \
+        -D "cn=Barbara Jensen,ou=Information Technology Division,dc=conn-ttl,$BASEDN" \
+        -H $URI2 \
+        -w "bjensen" \
+        -f $TESTDIR/ldapsearch2.fifo >> $TESTOUT 2>&1 &
+LDAPSEARCHPIDS="$LDAPSEARCHPIDS $!"
+
+# Open fifos as file descriptor
+exec 3>$TESTDIR/ldapsearch1.fifo
+exec 4>$TESTDIR/ldapsearch2.fifo
+
+# Trigger LDAP connections towards the proxy by executing a search
+echo 'objectclass=*' >&3
+echo 'objectclass=*' >&4
+sleep 1
+
+echo "Checking that proxy has created connections towards backend"
+
+$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 0 ; then
+    echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS $LDAPSEARCHPIDS
+    exit $RC
+fi
+
+$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 0 ; then
+    echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS $LDAPSEARCHPIDS
+    exit $RC
+fi
+
+
+echo "Sleeping until idle-timeout and conn-ttl have passed"
+sleep `expr $TIMEOUT + 1`
+
+echo "Checking that proxy has closed expired connections towards the remote LDAP server (time_t now=`date +%s`)"
+
+$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 1 ; then
+    echo "Error: LDAP connection to remote LDAP server was not closed"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS $LDAPSEARCHPIDS
+    exit $RC
+fi
+
+$LDAPSEARCH -b "cn=Connections,cn=database 3,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 1 ; then
+    echo "Error: LDAP connection to remote LDAP server was not closed"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS $LDAPSEARCHPIDS
+    exit $RC
+fi
+
+# Close the file descriptors associated with the fifos.
+# This will trigger EOF to ldapsearch which will cause it to exit.
+exec 3>&-
+exec 4>&-
+
+
+##############################################################################
+#
+# Test 3: Check that idle-timeout is reset on activity
+#
+
+echo "Checking that idle-timeout is reset on activity"
+NOW=`date +%s`
+echo "Create cached connection: idle-timeout timeout starts (time_t now=$NOW, original_timeout=`expr $NOW + $TIMEOUT`)"
+$LDAPSEARCH -b "dc=idle-timeout,$BASEDN" \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD \
+        'objectclass=*' >> $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+        echo "ldapsearch failed for base: dc=idle-timeout,$BASEDN ($RC)!"
+        test $KILLSERVERS != no && kill -HUP $KILLPIDS
+        exit $RC
+fi
+
+# sleep second less than idle-timeout to extend the timeout
+sleep `expr $TIMEOUT - 1`
+NOW=`date +%s`
+echo "Do another search to reset the timeout (time_t now=$NOW, new_timeout=`expr $NOW + $TIMEOUT`)"
+$LDAPSEARCH -b "dc=idle-timeout,$BASEDN" \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD \
+        'objectclass=*' >> $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+        echo "ldapsearch failed for base: dc=idle-timeout,$BASEDN ($RC)!"
+        test $KILLSERVERS != no && kill -HUP $KILLPIDS
+        exit $RC
+fi
+
+sleep `expr $TIMEOUT - 1`
+echo "Check that connection is still alive due to idle-timeout reset (time_t now=`date +%s`)"
+$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD 2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 0 ; then
+    echo "Error: LDAP connection to remote LDAP server is not found ($RC)"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
+    exit $RC
+fi
+
+sleep 2
+echo "Check that connection is closed after extended idle-timeout has passed (time_t now=`date +%s`)"
+$LDAPSEARCH -b "cn=Connections,cn=database 2,cn=databases,cn=monitor" -s one -LLL olmDbConnURI \
+        -D "cn=Manager,dc=local,dc=com" \
+        -H $URI2 \
+        -w $PASSWD  2>&1 | tee -a $TESTOUT | grep ldap://${LOCALHOST}:$PORT1 >/dev/null
+RC=$?
+if test $RC != 1 ; then
+    echo "Error: LDAP connection to remote LDAP server was not closed"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
+    exit $RC
+fi
+
+
+test $KILLSERVERS != no && kill -HUP $KILLPIDS
+
+echo ">>>>> Test succeeded"
+
+test $KILLSERVERS != no && wait
+
+exit 0
-- 
2.30.1

Places

File 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch of Package openldap2.23252

Places