[FIX] DNS - Retrieve all records of a forward zone with more than 1000 entries - #127
Open
ValverdeVinicius wants to merge 7 commits into
Open
[FIX] DNS - Retrieve all records of a forward zone with more than 1000 entries#127ValverdeVinicius wants to merge 7 commits into
ValverdeVinicius wants to merge 7 commits into
Conversation
Add a Group Policy module to list, view, create, duplicate, rename and delete the Group Policy Objects of a domain, and to edit their content. - LDAP core (GPC): TGPO and TGPOLogic (list, create, duplicate, rename, delete, staged modifications applied in a single LDAP operation). - SYSVOL access (GPT): TGPTCore using smbclient on Linux/macOS and the native UNC API on Windows; list files, read and write GPT.INI and Registry.pol files. - Registry.pol (REGF): TGPRegPol parser and serializer (keys, values, REG_SZ/REG_DWORD/REG_BINARY/...). - UI: toolbar actions, GPO list, Summary/Configuration/Catalog/Technical tabs, GPC parameter editor and Registry.pol visual editor, with a local staging model: nothing is written to the domain until the save action. - Save flow: write the modified Registry.pol files, update the GPT.INI, calculate the new User/Machine versions and update the versionNumber. - Register the module in the main window and in the packages.
- Keep the GPO core logic in OpenRSAT (ugpocore.pas) and use the LDAP helpers added in mORMot 2.4 (GetByName, AddFmt, TAsnObjects/AsnAddItem, DNToCN with dnDC filter) instead of reimplementing them. - Fix the Registry.pol string handling: Windows stores REG_SZ/REG_MULTI_SZ values as UTF-16LE, now detected and converted on read/write. - Sanitize non UTF-8 text coming from smbclient and the SYSVOL files before it reaches the UI. - Fall back to English when a translation resource is missing, and stop logging an error when the Options TreeView has no previous selection. - Rename the GPO creation method to TGPOLogic.Add (avoid shadowing Create). - Reference the mORMot2 package of the submodule explicitly in the project files, and bump the mORMot2 submodule to the official 2.4 helpers. - Add a UTF-16LE Registry.pol unit test and keep the GPO catalog enum.
- Widen the Stage/Discard and Save/Discard changes buttons so the translated captions are not truncated, and enlarge the Configuration editor panel. - Make the GPT files list taller and add two splitters on the Technical tab: one between the GPC attributes and the GPT area, and one between the GPT files grid and the GPT.INI memo.
Remove the translation entries of the old GPO module strings that no longer exist in the code, and reorder the catalog around the new rsGPOCatalog* constants.
TThreadUpdateZone did not activate LDAP paged attribute handling
(SearchRangeBegin/SearchRangeEnd) when loading a forward zone. When a
zone holds more than 1000 records, the multivalued 'dnsRecord' attribute
exceeds the AD server attribute size limit and is returned in paged form
('dnsRecord;range=0-1499').
Without SearchRangeBegin/SearchRangeEnd the client did not fetch the
remaining pages, so no record of the zone could be displayed. Wrap the
search with SearchRangeBegin/SearchRangeEnd, matching the pattern already
used by UpdateZoneStorage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a DNS forward zone contains more than 1000 records, the application freezes and is unable to display any record of that zone.
Root cause
TThreadUpdateZone.Execute(packages/OpenRSATCore/umoduleaddns.pas) loads a zone's records via LDAP, requesting the multivalueddnsRecordattribute. When a zone holds more than 1000 records, the total size of thednsRecordattribute on a node exceeds the AD server's attribute size limit. The server then truncates it and returns it in paged form (dnsRecord;range=0-1499).The search was performed without
SearchRangeBegin/SearchRangeEnd, so the LDAP client did not detect nor fetch the remaining pageddnsRecordvalues. As a result, no record of the zone could be retrieved or displayed.Fix
Wrap the
Searchcall withSearchRangeBegin/SearchRangeEndinside the paging loop, matching the pattern already used byUpdateZoneStoragein the same file.SearchRangeEndconsolidates the paged attribute values so all records of the zone (even above 1000) are retrieved and displayed correctly.Note
This fix belongs to the OpenRSAT application (the caller), not to the mORMot library. The mORMot LDAP paged-attribute handling (
SearchRangeBegin/SearchRangeEnd) is an opt-in, documented API; it is the caller's responsibility to activate it, as OpenRSAT already does inUpdateZoneStorage.