[continued from previous message]

+ cls.ldb = SamDB(url, credentials=creds, session_info=system_session(lp), lp=lp)
+ cls.base_dn = cls.ldb.domain_dn()
+
+ cls.sd_utils = sd_utils.SDUtils(cls.ldb)
+ cls.USER_NAME = "large_user" + format(random.randint(0, 99999), "05") + "-"
+ cls.OU_NAME="large_user_ou" + format(random.randint(0, 99999), "05")
+ cls.ou_dn = ldb.Dn(cls.ldb, "ou=" + cls.OU_NAME + "," + str(cls.base_dn))

- samba.tests.delete_force(self.ldb, self.ou_dn,
+
+ samba.tests.delete_force(cls.ldb, cls.ou_dn,
controls=['tree_delete:1'])

- self.ldb.add({
- "dn": self.ou_dn,
+ cls.ldb.add({
+ "dn": cls.ou_dn,
"objectclass": "organizationalUnit",
- "ou": self.OU_NAME})
+ "ou": cls.OU_NAME})

for x in range(200):
- user_name = self.USER_NAME + format(x, "03")
- self.ldb.add({
- "dn": "cn=" + user_name + "," + str(self.ou_dn),
+ user_name = cls.USER_NAME + format(x, "03")
+ cls.ldb.add({
+ "dn": "cn=" + user_name + "," + str(cls.ou_dn),
"objectclass": "user",
"sAMAccountName": user_name,
"jpegPhoto": b'a' * (2 * 1024 * 1024)})

- def tearDown(self):
+ @classmethod
+ def tearDownClass(cls):
# Remake the connection for tear-down (old Samba drops the socket)
- self.ldb = SamDB(url, credentials=creds, session_info=system_session(lp), lp=lp)
- samba.tests.delete_force(self.ldb, self.ou_dn,
+ cls.ldb = SamDB(url, credentials=creds, session_info=system_session(lp), lp=lp)
+ samba.tests.delete_force(cls.ldb, cls.ou_dn,
controls=['tree_delete:1'])

def test_unindexed_iterator_search(self):
@@ -246,6 +252,7 @@
self.assertGreater(count, count_jpeg)

def test_timeout(self):
+
policy_dn = ldb.Dn(self.ldb,
'CN=Default Query Policy,CN=Query-Policies,'
'CN=Directory Service,CN=Windows NT,CN=Services,' @@ -283,9 +290,19 @@
session_info=system_session(lp),
lp=lp)

+ for x in range(200):
+ user_name = self.USER_NAME + format(x, "03")
+ ace = "(OD;;RP;{6bc69afa-7bd9-4184-88f5-28762137eb6a};;S-1-%d)" % x
+ dn = ldb.Dn(self.ldb, "cn=" + user_name + "," + str(self.ou_dn))
+
+ # add an ACE that denies access to the above random attr
+ # for a not-existing user. This makes each SD distinct
+ # and so will slow SD parsing.
+ self.sd_utils.dacl_add_ace(dn, ace)
+
# Create a large search expression that will take a long time to
# evaluate.
- expression = '(anr=l)' * 10000
+ expression = f'(jpegPhoto=*X*)' * 1000
expression = f'(|{expression})'

# Perform the LDAP search.
diff -Nru samba-4.17.6+dfsg/source4/selftest/tests.py samba-4.17.7+dfsg/source4/selftest/tests.py
--- samba-4.17.6+dfsg/source4/selftest/tests.py 2022-12-15 19:09:31.753236500 +0300
+++ samba-4.17.7+dfsg/source4/selftest/tests.py 2023-03-20 12:04:29.107923500 +0300
@@ -1322,6 +1322,7 @@
plantestsuite_loadlist("samba4.urgent_replication.python(ad_dc_ntvfs)", "ad_dc_ntvfs:local", [python, os.path.join(DSDB_PYTEST_DIR, "urgent_replication.py"), '$PREFIX_ABS/ad_dc_ntvfs/private/sam.ldb', '$LOADLIST', '$LISTOPT'])
plantestsuite_loadlist("samba4.ldap.dirsync.python(ad_dc_ntvfs)", "ad_dc_ntvfs", [python, os.path.join(DSDB_PYTEST_DIR, "dirsync.py"), '$SERVER', '-U"$USERNAME%$PASSWORD"', '--workgroup=$DOMAIN', '$LOADLIST', '$LISTOPT'])
plantestsuite_loadlist("samba4.ldap.match_rules.python", "ad_dc_ntvfs", [python, os.path.join(srcdir(), "lib/ldb-samba/tests/match_rules.py"), '$PREFIX_ABS/ad_dc_ntvfs/private/sam.ldb', '-U"$USERNAME%$PASSWORD"', '--workgroup=$DOMAIN', '$LOADLIST', '$
LISTOPT'])
+plantestsuite_loadlist("samba4.ldap.match_rules.python", "ad_dc_ntvfs", [python, os.path.join(srcdir(), "lib/ld