[PATCH] Fix server side DRSUAPI_DRS_GET_ANC handling (bug #12398)

[Stefan Metzmacher]

Hi Bob,

> Garming & I have extended the tests a bit more and gotten them all to
> pass against Samba. There are two inconsistencies with Windows: Firstly,
> when two DNs aren't ancestors/children of each other, they are sorted
> differently, which has no consequence as far as we can see. Secondly, we
> still don't handle max_objects=0 the same way; Windows ignores this
> while we don't replicate any objects.
> 
> In addition to the expected issue of the conflict between
> DRSUAPI_DRS_GET_ANC and DRSUAPI_DRS_CRITICAL_ONLY, we found that the
> uptodateness_vector wasn't considered when replicating links. This meant
> that, in some cases, unnecessary links were being replicated.
> 
> We haven't made a test specifically for moving a critical object away
> from a critical parent to be under a non-critical parent as described in
> the bug report, however we have reasoned that this is merely a
> consequence of the critical object being a child of a non-critical
> object, rather than it being a consequence of the move.
> 
> It's just about the end of the workday for us, so it's likely we'll have
> it cleaned up in git tomorrow. Current work is still in
> http://git.catalyst.net.nz/gw?p=samba.git;a=shortlog;h=refs/heads/anctests

Thanks for the update.

A few comments:

- can you take the full AbstractLink changes including the __eq__() change?

- I'd really like to avoid adding the ancestors within
getncchanges_collect_objects
  as that's not how it's done in the documentation. The main problem
  I have with this is site_res_cmp_anc_order, which is the main reason
  why we need the r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
  hack, we should only have
r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn
  incremented to a number that's part of the replicated changes
  (without the ancestors) the added ancestors should not impact
  the new_highwatermark.
  I think it's also the reason why you see the different sorting
  when two DNs aren't ancestors/children of each other.

- In case we don't implement the GET_ANC handling for link targets
  and/or the DRSUAPI_DRS_GET_TGT logic, we should at least
  implement the changes with that logic in mind. Then we can
  also stop adding all links at the end of the cycle.

Anyway thanks for working on this!

metze

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20161214/22708d8c/signature.sig>