samba.git/source4/dsdb, branch talloc-2.3.4

dsdb: Do not reuse "ret" variable as return code and for memcmp() comparison

2022-05-05T01:19:54+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Thu May  5 01:19:54 UTC 2022 on sn-devel-184

tests/passwords: Add tests for password history with simple binds

2022-05-05T00:27:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

tests/passwords: Remove unused imports

2022-05-05T00:27:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

selftest: Rework password_lockout_base.py to allow logon_basics test to be run in ad_dc_no_ntlm

2022-05-05T00:27:33+00:00

We need to ensure that even if NTLM is disabled, that the test
can still bootstrap and fail normally.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

dsdb: Clarify that most errors in make_error_and_update_badPwdCount() are not returned

2022-05-05T00:27:33+00:00

This is mainly just to be clear, and was done while failing to work around compiler
warnings.

For the curious it was gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (CentOS 7)
build with -O3, which gave with other, later patches:

../../source4/dsdb/samdb/ldb_modules/password_hash.c: In function ‘check_password_restrictions_and_log’:
../../source4/dsdb/samdb/ldb_modules/password_hash.c:3231:5: error: assuming signed overflow does not occur when simplifying conditional to constant [-Werror=strict-overflow]
  if (ret == LDB_SUCCESS) {
     ^

Regardless, we make it clear that all values assigned to "ret" are
local small constants.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

s4/dsdb/repl_meta_data: Receive function arguments in correct order

2022-05-02T19:13:31+00:00

The incorrect ordering was introduced in commit
b9c5417b523c4c53cb275c12ec84bbc849705bec.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15007

Signed-off-by: Joseph Sutton 
Reviewed-by: Jeremy Allison

dsdb: Fix a typo

2022-04-26T21:41:29+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

s4:dsdb:tests: Also pass tests if asserted identity is present

2022-04-13T12:59:30+00:00

We should make sure that we use NTLMSSP or Kerberos consistently
for the tests and don't mix them.

We're also much stricter and symmetric_difference() to
check if the sets are actually the same.

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Andreas Schneider 
Signed-off-by: Stefan Metzmacher

s4:dsdb/descriptor: skip duplicates in descriptor_sd_propagation_object()

2022-03-30T12:06:21+00:00

We're now sure that the security descriptor propagation happened
first for parent objects.

It means we can safely skip processing the same object twice in
descriptor_sd_propagation_object().

For the database with ~ 22000 objects it reduced the commit time
from 2m 50s down to 2m 24s.

The statistics are changed from:

descriptor_prepare_commit: changes: num_registrations=50000
descriptor_prepare_commit: changes: num_registered=22000
descriptor_prepare_commit: changes: num_toplevel=5
descriptor_prepare_commit: changes: num_processed=5200
descriptor_prepare_commit: objects: num_processed=68800

to:

descriptor_prepare_commit: changes: num_registrations=50000
descriptor_prepare_commit: changes: num_registered=22000
descriptor_prepare_commit: changes: num_toplevel=5
descriptor_prepare_commit: changes: num_processed=5200
descriptor_prepare_commit: objects: num_processed=22000
descriptor_prepare_commit: objects: num_skipped=41600

It means that we have "changes: num_registered" and
"objects: num_processed" exactly match the number
of replicated objects.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Wed Mar 30 12:06:21 UTC 2022 on sn-devel-184

s4:dsdb/descriptor: sort descriptor_changes tree based

2022-03-30T11:13:35+00:00

For the hot code path, e.g. the commit after the initial replication,
we typically have one descriptor_changes for each object in the
database.

It means that we most likely have 5 naming contexts/partitions.
Except of their head/root object have a valid parent_guid,
so can move all of them into the tree structure.

Now we start the processing at the partition root objects,
which means that we also process all child objects in
the same run. While processing these objects we are most
likely able to mark their related descriptor_changes structure
as done removing it from the hierarchy.

With the 22000 object domain it reduces the time spend in
the commit stage from 3m 20s down to 2m 50s.

The statistics are changed from:

descriptor_prepare_commit: changes: num_registrations=50000
descriptor_prepare_commit: changes: num_registered=22000
descriptor_prepare_commit: changes: num_processed=22000
descriptor_prepare_commit: objects: num_processed=80800

to:

descriptor_prepare_commit: changes: num_registrations=50000
descriptor_prepare_commit: changes: num_registered=22000
descriptor_prepare_commit: changes: num_toplevel=5
descriptor_prepare_commit: changes: num_processed=5200
descriptor_prepare_commit: objects: num_processed=68800

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett