A better fix would be to use the _ext interface
Also add and use a tool_destroy() function (to destroy SASL/TLS contexts).

allow slapdn to return the DN in pretty/normal only mode, without diagnostics, to be used as filter (should allow reading from stdin as well)

release lock as early as possible; deferring referral checking in searches may reduce the amount of dynamic entry generation