Adapted patch for ipatests/test_integration/test_installation.py due to

missing commit 930f4b3d1dc03f9e365b007b027d65e146a08f05 (Prevent local account

takeover).

From 87e5c0500b76b7cbeecedc0c28d44095c7063186 Mon Sep 17 00:00:00 2001

From: Christian Heimes <cheimes@redhat.com>

Date: Thu, 24 Sep 2020 12:32:37 +0200

Subject: [PATCH] Fix nsslapd-db-lock tuning of BDB backend

nsslapd-db-lock was moved from cn=config,cn=ldbm database,cn=plugins,cn=config

entry to cn=bdb subentry. Manual patching of dse.ldif was no longer

working. Installations with 389-DS 1.4.3 and newer are affected.

Low lock count can affect performance during high load, e.g. mass-import

of users or lots of concurrent connections.

Bump minimal DS version to 1.4.3. Fedora 32 and RHEL 8.3 have 1.4.3.

Fixes: https://pagure.io/freeipa/issue/8515

See: https://pagure.io/freeipa/issue/5914

Signed-off-by: Christian Heimes <cheimes@redhat.com>

Reviewed-By: Francois Cami <fcami@redhat.com>

Reviewed-By: Francois Cami <fcami@redhat.com>

---

 freeipa.spec.in                               | 17 ++++++-----------

 install/share/Makefile.am                     |  1 +

 install/share/ldbm-tuning.ldif                |  4 ++++

 install/updates/10-db-locks.update            | 10 ++++++++++

 install/updates/Makefile.am                   |  1 +

 ipapython/ipaldap.py                          |  1 +

 ipaserver/install/dsinstance.py               |  9 ++++-----

 .../test_customized_ds_config_install.py      |  3 ++-

 .../test_integration/test_installation.py     | 19 +++++++++++++++++++

 9 files changed, 48 insertions(+), 17 deletions(-)

 create mode 100644 install/share/ldbm-tuning.ldif

 create mode 100644 install/updates/10-db-locks.update

diff --git a/freeipa.spec.in b/freeipa.spec.in

index 1db7d6457..8e6736b60 100755

--- a/freeipa.spec.in

+++ b/freeipa.spec.in

@@ -55,10 +55,9 @@

 %global selinux_policy_version 3.14.3-21

 %global slapi_nis_version 0.56.1-4

 %global python_ldap_version 3.1.0-1

-# python3-lib389

-# Fix for "Installation fails: Replica Busy"

-# https://pagure.io/389-ds-base/issue/49818

-%global ds_version 1.4.0.16

+# 1.4.3 moved nsslapd-db-locks to cn=bdb sub-entry

+# https://pagure.io/freeipa/issue/8515

+%global ds_version 1.4.3

 # Fix for TLS 1.3 PHA, RHBZ#1775158

 %global httpd_version 2.4.37-21

@@ -89,13 +88,9 @@

 # fix for segfault in python3-ldap, https://pagure.io/freeipa/issue/7324

 %global python_ldap_version 3.1.0-1

-# Fix for create suffix

-# https://pagure.io/389-ds-base/issue/49984

-%if 0%{?fedora} >= 30

-%global ds_version 1.4.1.1

-%else

-%global ds_version 1.4.0.21

-%endif

+# 1.4.3 moved nsslapd-db-locks to cn=bdb sub-entry

+# https://pagure.io/freeipa/issue/8515

+%global ds_version 1.4.3

 # Fix for TLS 1.3 PHA, RHBZ#1775146

 %if 0%{?fedora} >= 31

diff --git a/install/share/Makefile.am b/install/share/Makefile.am

index 53bd8f5d5..53485edfa 100644

--- a/install/share/Makefile.am

+++ b/install/share/Makefile.am

@@ -102,6 +102,7 @@ dist_app_DATA =				\

 	ipaca_default.ini		\

 	ipaca_customize.ini		\

 	ipaca_softhsm2.ini		\

+	ldbm-tuning.ldif		\

 	$(NULL)

 kdcproxyconfdir = $(IPA_SYSCONF_DIR)/kdcproxy

diff --git a/install/share/ldbm-tuning.ldif b/install/share/ldbm-tuning.ldif

new file mode 100644

index 000000000..765ccb01a

--- /dev/null

+++ b/install/share/ldbm-tuning.ldif

@@ -0,0 +1,4 @@

+dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config

+changetype: modify

+replace: nsslapd-db-locks

+nsslapd-db-locks: 50000

diff --git a/install/updates/10-db-locks.update b/install/updates/10-db-locks.update

new file mode 100644

index 000000000..31d2e4352

--- /dev/null

+++ b/install/updates/10-db-locks.update

@@ -0,0 +1,10 @@

+# Fix nsslapd-db-locks move

+# https://pagure.io/freeipa/issue/8515

+

+# replace 389-DS default with 50000 locks

+dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config

+replace: nsslapd-db-locks:10000::50000

+

+# remove setting from old location

+dn: cn=config,cn=ldbm database,cn=plugins,cn=config

+remove: nsslapd-db-locks: 50000

diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am

index 8a4d9cc6c..957ad4fa2 100644

--- a/install/updates/Makefile.am

+++ b/install/updates/Makefile.am

@@ -4,6 +4,7 @@ appdir = $(IPA_DATA_DIR)/updates

 app_DATA =				\

 	05-pre_upgrade_plugins.update	\

 	10-config.update		\

+	10-db-locks.update		\

 	10-enable-betxn.update		\

 	10-ipapwd.update		\

 	10-selinuxusermap.update	\

diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py

index 3eac95a87..5c43413cc 100644

--- a/ipapython/ipaldap.py

+++ b/ipapython/ipaldap.py

@@ -753,6 +753,7 @@ class LDAPClient:

         'nsslapd-anonlimitsdn': True,

         'nsslapd-minssf-exclude-rootdse': True,

         'nsslapd-enable-upgrade-hash': True,

+        'nsslapd-db-locks': True,

     })

     time_limit = -1.0   # unlimited

diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py

index 3fc0de371..065c6f78f 100644

--- a/ipaserver/install/dsinstance.py

+++ b/ipaserver/install/dsinstance.py

@@ -226,6 +226,7 @@ class DsInstance(service.Service):

         self.step("creating directory server instance", self.__create_instance)

         self.step("configure autobind for root", self.__root_autobind)

+        self.step("tune ldbm plugin", self.__tune_ldbm)

         self.step("stopping directory server", self.__stop_instance)

         self.step("updating configuration in dse.ldif", self.__update_dse_ldif)

         self.step("starting directory server", self.__start_instance)

@@ -592,6 +593,9 @@ class DsInstance(service.Service):

         # Done!

         logger.debug("completed creating DS instance")

+    def __tune_ldbm(self):

+        self._ldap_mod("ldbm-tuning.ldif")

+

     def __update_dse_ldif(self):

         """

         This method updates dse.ldif right after instance creation. This is

@@ -610,11 +614,6 @@ class DsInstance(service.Service):

             temp_filename = new_dse_ldif.name

             with open(dse_filename, "r") as input_file:

                 parser = installutils.ModifyLDIF(input_file, new_dse_ldif)

-                parser.replace_value(

-                        'cn=config,cn=ldbm database,cn=plugins,cn=config',

-                        'nsslapd-db-locks',

-                        [b'50000']

-                        )

                 if self.config_ldif:

                     # parse modifications from ldif file supplied by the admin

                     with open(self.config_ldif, "r") as config_ldif:

diff --git a/ipatests/test_integration/test_customized_ds_config_install.py b/ipatests/test_integration/test_customized_ds_config_install.py

index a2fcc7dd2..95195a014 100644

--- a/ipatests/test_integration/test_customized_ds_config_install.py

+++ b/ipatests/test_integration/test_customized_ds_config_install.py

@@ -4,7 +4,8 @@ from ipatests.pytest_ipa.integration import tasks

 DIRSRV_CONFIG_MODS = """

 # https://fedorahosted.org/freeipa/ticket/4949

-dn: cn=config,cn=ldbm database,cn=plugins,cn=config

+# https://pagure.io/freeipa/issue/8515

+dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config

 changetype: modify

 replace: nsslapd-db-locks

 nsslapd-db-locks: 100000

diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py

index c939c6450..ec826edb7 100644

--- a/ipatests/test_integration/test_installation.py

+++ b/ipatests/test_integration/test_installation.py

@@ -972,6 +972,25 @@ class TestInstallMaster(IntegrationTest):

         )

         assert "nsslapd-enable-upgrade-hash: off" in result.stdout_text

+    def test_ldbm_tuning(self):

+        # check db-locks in new cn=bdb subentry (1.4.3+)

+        result = tasks.ldapsearch_dm(

+            self.master,

+            "cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config",

+            ["nsslapd-db-locks"],

+            scope="base"

+        )

+        assert "nsslapd-db-locks: 50000" in result.stdout_text

+

+        # no db-locks configuration in old global entry

+        result = tasks.ldapsearch_dm(

+            self.master,

+            "cn=config,cn=ldbm database,cn=plugins,cn=config",

+            ["nsslapd-db-locks"],

+            scope="base"

+        )

+        assert "nsslapd-db-locks" not in result.stdout_text

+

 class TestInstallMasterKRA(IntegrationTest):

-- 

2.26.2