s4-kcc: Remove also deleted objects that are not in the Deleted Object container

For the configuration container we do a full scan at every run of the
kcc-delete service. For the base DN we introduce a new parameter that
avoid the full scan to kick just when samba starts.

diff --git a/source4/dsdb/kcc/kcc_deleted.c b/source4/dsdb/kcc/kcc_deleted.c
index 7099fdee8f7d43b4b6939a107e5be48352c2a3da..4b1364f94a3dcf64c5c1d0bb5b10cdc8db526a34 100644 (file)
--- a/source4/dsdb/kcc/kcc_deleted.c
+++ b/source4/dsdb/kcc/kcc_deleted.c
@@ -47,8 +47,12 @@ NTSTATUS kccsrv_check_deleted(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
        const struct dsdb_schema *schema;
        bool add_recycled = false;
        bool rcbin_enabled = false;
+       bool do_fs = false;
 
+       time_t interval = lpcfg_parm_int(s->task->lp_ctx, NULL, "kccsrv",
+                                                   "check_deleted_full_scan_interval", 86400);
        time_t t = time(NULL);
+
        if (t - s->last_deleted_check < lpcfg_parm_int(s->task->lp_ctx, NULL, "kccsrv",
                                                    "check_deleted_interval", 600)) {
                return NT_STATUS_OK;
@@ -61,6 +65,22 @@ NTSTATUS kccsrv_check_deleted(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
                DEBUG(1,(__location__ ": Failed to get tombstone lifetime\n"));
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
        }
+       if (s->last_full_scan_deleted_check > 0 && ((t - s->last_full_scan_deleted_check) > interval )) {
+               do_fs = true;
+               s->last_full_scan_deleted_check = t;
+       }
+
+       if (s->last_full_scan_deleted_check == 0) {
+               /*
+                * If we never made a full scan set the last full scan event to be in the past
+                * and that 9/10 of the full scan interval has already passed.
+                * This is done to avoid the full scan to fire just at the begining of samba
+                * or a couple of minutes after the start.
+                * With this "setup" and default values of interval, the full scan will fire
+                * 2.4 hours after the start of samba
+                */
+               s->last_full_scan_deleted_check = t - ((9 * interval) / 10);
+       }
 
        schema = dsdb_get_schema(s->samdb, mem_ctx);
        if (!schema) {
@@ -90,8 +110,18 @@ NTSTATUS kccsrv_check_deleted(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
                           container */
                        continue;
                }
-               ret = dsdb_search(s->samdb, do_dn, &res, do_dn, LDB_SCOPE_ONELEVEL, attrs,
-                                 DSDB_SEARCH_SHOW_RECYCLED, NULL);
+
+               if (!do_fs && ldb_dn_compare(ldb_get_config_basedn(s->samdb), part->dn)) {
+                       ret = dsdb_search(s->samdb, do_dn, &res, do_dn, LDB_SCOPE_ONELEVEL, attrs,
+                                       DSDB_SEARCH_SHOW_RECYCLED, NULL);
+               } else {
+                       if (do_fs) {
+                               DEBUG(1, ("Doing a full scan on %s and looking for deleted object\n",
+                                               ldb_dn_get_linearized(part->dn)));
+                       }
+                       ret = dsdb_search(s->samdb, part->dn, &res, part->dn, LDB_SCOPE_SUBTREE, attrs,
+                                       DSDB_SEARCH_SHOW_RECYCLED, "(isDeleted=TRUE)");
+               }
 
                if (ret != LDB_SUCCESS) {
                        DEBUG(1,(__location__ ": Failed to search for deleted objects in %s\n",

diff --git a/source4/dsdb/kcc/kcc_service.h b/source4/dsdb/kcc/kcc_service.h
index 1404a9a3cd44c882bc5d75aa650adebc611a20b3..ea01b0271fe07ff7522e0336d926463eadce86cd 100644 (file)
--- a/source4/dsdb/kcc/kcc_service.h
+++ b/source4/dsdb/kcc/kcc_service.h
@@ -81,6 +81,8 @@ struct kccsrv_service {
 
        time_t last_deleted_check;
 
+       time_t last_full_scan_deleted_check;
+
        bool am_rodc;
 
        /* run new intra-site topology code */