[PATCH] Final Fix for DNS wildcard performance regression

[Andrew Bartlett]

On Tue, 2017-12-19 at 13:09 +1300, Garming Sam wrote:
> I think you need to comment on why using 'name' is important somewhere
> in the patches (as opposed to the alternatives), considering it's the
> most important part of the fix.
> 
> Apart from that, you can mark them as reviewed by me.
> 

Sadly the patch fails make test, because it changes the semantics for 

scope: SCOPE_ONELEVEL
expression (dn=dc=foo,dc=com)

This is illegal in AD (need to use distinguisedName), and returns 0
results with SCOPE_SUBTREE.  However it now returns 0 results for
SCOPE_ONELEVEL now, where it used to return 1.

Clearly I need a specific testsuite to cover this, as it was found by a
random unrelated testsuite.

I'll continue to work on this tomorrow.  

I would say 'hold the release' (as the AD DC is really quite unuseable
for domains with a lot of DNS entries) but I've thought a full fix was
a day away all week.  

The DNS server changes could go in, and would help a lot (I'll
autobuild those now).

Thanks,

Andrew Bartlett
-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba