URL: https://github.com/freeipa/freeipa/pull/5148 Author: tiran Title: #5148: [Backport][ipa-4-8] Fix nsslapd-db-lock tuning of BDB backend Action: opened
PR body: """ Manual backport of PR #5145 The backport conflicted in ``Makefile.am``. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5148/head:pr5148 git checkout pr5148
From 6a6c2b238efefc90069330c322e6e625683ba807 Mon Sep 17 00:00:00 2001 From: Christian Heimes <chei...@redhat.com> Date: Thu, 24 Sep 2020 12:32:37 +0200 Subject: [PATCH] Fix nsslapd-db-lock tuning of BDB backend nsslapd-db-lock was moved from cn=config,cn=ldbm database,cn=plugins,cn=config entry to cn=bdb subentry. Manual patching of dse.ldif was no longer working. Installations with 389-DS 1.4.3 and newer are affected. Low lock count can affect performance during high load, e.g. mass-import of users or lots of concurrent connections. Bump minimal DS version to 1.4.3. Fedora 32 and RHEL 8.3 have 1.4.3. Fixes: https://pagure.io/freeipa/issue/8515 See: https://pagure.io/freeipa/issue/5914 Signed-off-by: Christian Heimes <chei...@redhat.com> Reviewed-By: Francois Cami <fc...@redhat.com> --- freeipa.spec.in | 17 ++++++----------- install/share/Makefile.am | 1 + install/share/ldbm-tuning.ldif | 4 ++++ install/updates/10-db-locks.update | 10 ++++++++++ install/updates/Makefile.am | 1 + ipapython/ipaldap.py | 1 + ipaserver/install/dsinstance.py | 9 ++++----- .../test_customized_ds_config_install.py | 3 ++- .../test_integration/test_installation.py | 19 +++++++++++++++++++ 9 files changed, 48 insertions(+), 17 deletions(-) create mode 100644 install/share/ldbm-tuning.ldif create mode 100644 install/updates/10-db-locks.update diff --git a/freeipa.spec.in b/freeipa.spec.in index 1db7d64572..8e6736b600 100755 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -55,10 +55,9 @@ %global selinux_policy_version 3.14.3-21 %global slapi_nis_version 0.56.1-4 %global python_ldap_version 3.1.0-1 -# python3-lib389 -# Fix for "Installation fails: Replica Busy" -# https://pagure.io/389-ds-base/issue/49818 -%global ds_version 1.4.0.16 +# 1.4.3 moved nsslapd-db-locks to cn=bdb sub-entry +# https://pagure.io/freeipa/issue/8515 +%global ds_version 1.4.3 # Fix for TLS 1.3 PHA, RHBZ#1775158 %global httpd_version 2.4.37-21 @@ -89,13 +88,9 @@ # fix for segfault in python3-ldap, https://pagure.io/freeipa/issue/7324 %global python_ldap_version 3.1.0-1 -# Fix for create suffix -# https://pagure.io/389-ds-base/issue/49984 -%if 0%{?fedora} >= 30 -%global ds_version 1.4.1.1 -%else -%global ds_version 1.4.0.21 -%endif +# 1.4.3 moved nsslapd-db-locks to cn=bdb sub-entry +# https://pagure.io/freeipa/issue/8515 +%global ds_version 1.4.3 # Fix for TLS 1.3 PHA, RHBZ#1775146 %if 0%{?fedora} >= 31 diff --git a/install/share/Makefile.am b/install/share/Makefile.am index 53bd8f5d54..53485edfa7 100644 --- a/install/share/Makefile.am +++ b/install/share/Makefile.am @@ -102,6 +102,7 @@ dist_app_DATA = \ ipaca_default.ini \ ipaca_customize.ini \ ipaca_softhsm2.ini \ + ldbm-tuning.ldif \ $(NULL) kdcproxyconfdir = $(IPA_SYSCONF_DIR)/kdcproxy diff --git a/install/share/ldbm-tuning.ldif b/install/share/ldbm-tuning.ldif new file mode 100644 index 0000000000..765ccb01a2 --- /dev/null +++ b/install/share/ldbm-tuning.ldif @@ -0,0 +1,4 @@ +dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config +changetype: modify +replace: nsslapd-db-locks +nsslapd-db-locks: 50000 diff --git a/install/updates/10-db-locks.update b/install/updates/10-db-locks.update new file mode 100644 index 0000000000..31d2e43526 --- /dev/null +++ b/install/updates/10-db-locks.update @@ -0,0 +1,10 @@ +# Fix nsslapd-db-locks move +# https://pagure.io/freeipa/issue/8515 + +# replace 389-DS default with 50000 locks +dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config +replace: nsslapd-db-locks:10000::50000 + +# remove setting from old location +dn: cn=config,cn=ldbm database,cn=plugins,cn=config +remove: nsslapd-db-locks: 50000 diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am index 8a4d9cc6cf..957ad4fa24 100644 --- a/install/updates/Makefile.am +++ b/install/updates/Makefile.am @@ -4,6 +4,7 @@ appdir = $(IPA_DATA_DIR)/updates app_DATA = \ 05-pre_upgrade_plugins.update \ 10-config.update \ + 10-db-locks.update \ 10-enable-betxn.update \ 10-ipapwd.update \ 10-selinuxusermap.update \ diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py index 3eac95a87e..5c43413cc4 100644 --- a/ipapython/ipaldap.py +++ b/ipapython/ipaldap.py @@ -753,6 +753,7 @@ class LDAPClient: 'nsslapd-anonlimitsdn': True, 'nsslapd-minssf-exclude-rootdse': True, 'nsslapd-enable-upgrade-hash': True, + 'nsslapd-db-locks': True, }) time_limit = -1.0 # unlimited diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index 3fc0de371e..065c6f78f0 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -226,6 +226,7 @@ def __common_setup(self): self.step("creating directory server instance", self.__create_instance) self.step("configure autobind for root", self.__root_autobind) + self.step("tune ldbm plugin", self.__tune_ldbm) self.step("stopping directory server", self.__stop_instance) self.step("updating configuration in dse.ldif", self.__update_dse_ldif) self.step("starting directory server", self.__start_instance) @@ -592,6 +593,9 @@ def __create_instance(self): # Done! logger.debug("completed creating DS instance") + def __tune_ldbm(self): + self._ldap_mod("ldbm-tuning.ldif") + def __update_dse_ldif(self): """ This method updates dse.ldif right after instance creation. This is @@ -610,11 +614,6 @@ def __update_dse_ldif(self): temp_filename = new_dse_ldif.name with open(dse_filename, "r") as input_file: parser = installutils.ModifyLDIF(input_file, new_dse_ldif) - parser.replace_value( - 'cn=config,cn=ldbm database,cn=plugins,cn=config', - 'nsslapd-db-locks', - [b'50000'] - ) if self.config_ldif: # parse modifications from ldif file supplied by the admin with open(self.config_ldif, "r") as config_ldif: diff --git a/ipatests/test_integration/test_customized_ds_config_install.py b/ipatests/test_integration/test_customized_ds_config_install.py index a2fcc7dd23..95195a0142 100644 --- a/ipatests/test_integration/test_customized_ds_config_install.py +++ b/ipatests/test_integration/test_customized_ds_config_install.py @@ -4,7 +4,8 @@ DIRSRV_CONFIG_MODS = """ # https://fedorahosted.org/freeipa/ticket/4949 -dn: cn=config,cn=ldbm database,cn=plugins,cn=config +# https://pagure.io/freeipa/issue/8515 +dn: cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config changetype: modify replace: nsslapd-db-locks nsslapd-db-locks: 100000 diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py index c939c6450e..ec826edb73 100644 --- a/ipatests/test_integration/test_installation.py +++ b/ipatests/test_integration/test_installation.py @@ -972,6 +972,25 @@ def test_ds_disable_upgrade_hash(self): ) assert "nsslapd-enable-upgrade-hash: off" in result.stdout_text + def test_ldbm_tuning(self): + # check db-locks in new cn=bdb subentry (1.4.3+) + result = tasks.ldapsearch_dm( + self.master, + "cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config", + ["nsslapd-db-locks"], + scope="base" + ) + assert "nsslapd-db-locks: 50000" in result.stdout_text + + # no db-locks configuration in old global entry + result = tasks.ldapsearch_dm( + self.master, + "cn=config,cn=ldbm database,cn=plugins,cn=config", + ["nsslapd-db-locks"], + scope="base" + ) + assert "nsslapd-db-locks" not in result.stdout_text + def test_admin_root_alias_CVE_2020_10747(self): # Test for CVE-2020-10747 fix # https://bugzilla.redhat.com/show_bug.cgi?id=1810160
_______________________________________________ FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahosted.org
