#49443 scope one searches in 1.3.7 give incorrect results
Closed: fixed 2 months ago by mreynolds. Opened 2 years ago by lkrispen.

IPA did run in an issue which seems to be triggered by incorrect search results for scope=1 searches, I did reproduce it and in 1.3.7 we see results like this:

 ldapsearch -LLL -o ldif-wrap=no -h localhost  -p 39001 -x -D "cn=directory manager" -w  -b "ou=sub,dc=example,dc=com" -s sub  description=ca description
 dn: cn=ca,ou=sub,dc=example,dc=com
 description: ca

 ldapsearch -LLL -o ldif-wrap=no -h localhost  -p 39001 -x -D "cn=directory manager" -w  -b "ou=sub,dc=example,dc=com" -s one  description=ca description
 dn: cn=domain,ou=sub,dc=example,dc=com
 description: domain

 dn: cn=ca,ou=sub,dc=example,dc=com
 description: ca

for the sub search the result is correct, but the one level search returns all entries independent of the filter match.

This bug was introduced with the patch for filter optimisation: #49290

In master it is fixed since #49372, which was again a major change in the area. But looking into this ticket the patch had a couple of problems.
so it cannot just be backported. we need to investigate in 1.3.7 and fix there


@lkrispen Do you want me to look into this?

Metadata Update from @firstyear:
- Custom field component adjusted to None
- Custom field origin adjusted to None
- Custom field reviewstatus adjusted to None
- Custom field type adjusted to None
- Custom field version adjusted to None

2 years ago

@lkrispen Do you want me to look into this?

I hoped you would resolve it overnight. Now I am looking into it and I think it is in idl_set_intersect().
if we have allids set, we need to set the DONT_BYPASS_FILTERTEST flag

Ahhh @lkrispen sadly I was on a flight from Sydney to Brissy, and I'm work working late instead of "overnight". sorry about that :(

Where are we missing the flag set for filtertest .... ?

0001-Ticket-49443-scope-one-searches-in-1.3.7-give-incorr.patch

This fixes it for my test, it is also missing in master, although in master since 49372 the result is also correct, but I am not sure if all cases are handled, would prefer to apply this patch to master also

I think this is a safe addition here. What about union? That may need the same for allids?

Anyway, ack to the patch, but I want to have this test added to filter test suite so that I don't mess it up again like I did here :( :( :( :(

I think union is safe because it will always be followed by an intersect with the scope, so if either the union or the scope is allids the flag should be set.
But will double check

Metadata Update from @mreynolds:
- Custom field reviewstatus adjusted to ack (was: None)

2 years ago

b0689cd..c917b93 master -> master

5878619..584264a 389-ds-base-1.3.7 -> 389-ds-base-1.3.7

Metadata Update from @mreynolds:
- Issue set to the milestone: 1.3.7.0

2 years ago

Metadata Update from @mreynolds:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1511462

2 years ago

@lkrispen I see no issue with this in master. I think it's safe. What about some lib389 tests?

I seem te recall this was the related issue for the repl issue in ipa.

0001-Issue-49443-Add-CI-test-case.patch

@spichugi I've reviewed this an am happy, it's pretty simple. You?

The docstring is not related to the code. And the added imports are not used.
Besides that, the code looks good. :)

commit b66b712
Author: Amita Sharma amsharma@redhat.com
Date: Wed Dec 6 16:13:19 2017 +0530

Metadata Update from @mreynolds:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

2 months ago

Login to comment on this ticket.

Metadata