From bba53215a8fcf7e77f781c0f02c4512fce3c8b04 Mon Sep 17 00:00:00 2001
From: Thierry Bordaz <tbordaz@redhat.com>
Date: Oct 10 2018 15:24:02 +0000
Subject: Ticket 49968 - Confusing CRITICAL message: list_candidates - NULL idl was recieved from filter_candidates_ext


Bug Description:
	When a filter component is indexed but returns an empty IDL
	an alarming message is logged although it is normal.

Fix Description:
	Remove the alarming message

https://pagure.io/389-ds-base/issue/49968

Reviewed by: Mark Reynolds

Platforms tested: F27 + testcase

Flag Day: no

Doc impact: no

---

diff --git a/dirsrvtests/tests/suites/basic/basic_test.py b/dirsrvtests/tests/suites/basic/basic_test.py
index 8a5d078..b4d811d 100644
--- a/dirsrvtests/tests/suites/basic/basic_test.py
+++ b/dirsrvtests/tests/suites/basic/basic_test.py
@@ -1016,6 +1016,78 @@ def test_connection_buffer_size(topology_st):
         with pytest.raises(ldap.OPERATIONS_ERROR):
             topology_st.standalone.config.replace('nsslapd-connection-buffer', value)
 
+@pytest.mark.bz1637439
+def test_critical_msg_on_empty_range_idl(topology_st):
+    """Doing a range index lookup should not report a critical message even if IDL is empty
+
+    :id: a07a2222-0551-44a6-b113-401d23799364
+    :setup: Standalone instance
+    :steps:
+         1. Create an index for internationalISDNNumber. (attribute chosen because it is
+         unlikely that previous tests used it)
+         2. telephoneNumber being indexed by default create 20 users without telephoneNumber
+         3. add a telephoneNumber value and delete it to trigger an empty index database
+         4. Do a search that triggers a range lookup on empty telephoneNumber
+         5. Check that the critical message is not logged in error logs
+    :expectedresults:
+         1. This should pass
+         2. This should pass
+         3. This should pass
+         4. This should pass on normal build but could abort a debug build
+         4. This should pass
+    """
+    indexedAttr = 'internationalISDNNumber'
+
+    # Step 1
+    from lib389.index import Indexes
+
+    indexes = Indexes(topology_st.standalone)
+    indexes.create(properties={
+        'cn': indexedAttr,
+        'nsSystemIndex': 'false',
+        'nsIndexType': 'eq'
+        })
+    topology_st.standalone.restart()
+
+    # Step 2
+    users = UserAccounts(topology_st.standalone, DEFAULT_SUFFIX)
+    log.info('Adding 20 users without "%s"' % indexedAttr)
+    for i in range(20):
+        name = 'user_%d' % i
+        last_user = users.create(properties={
+            'uid': name,
+            'sn': name,
+            'cn': name,
+            'uidNumber': '1000',
+            'gidNumber': '1000',
+            'homeDirectory': '/home/%s' % name,
+            'mail': '%s@example.com' % name,
+            'userpassword': 'pass%s' % name,
+        })
+
+    # Step 3
+    # required update to create the indexAttr (i.e. 'loginShell') database, and then make it empty
+    topology_st.standalone.modify_s(last_user.dn, [(ldap.MOD_ADD, indexedAttr, b'1234')])
+    ent = topology_st.standalone.getEntry(last_user.dn, ldap.SCOPE_BASE,)
+    assert ent
+    assert ent.hasAttr(indexedAttr)
+    topology_st.standalone.modify_s(last_user.dn, [(ldap.MOD_DELETE, indexedAttr, None)])
+    ent = topology_st.standalone.getEntry(last_user.dn, ldap.SCOPE_BASE,)
+    assert ent
+    assert not ent.hasAttr(indexedAttr)
+
+    # Step 4
+    # The first component being not indexed the range on second is evaluated
+    try:
+        ents = topology_st.standalone.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, '(&(sudoNotAfter=*)(%s>=111))' % indexedAttr)
+        assert len(ents) == 0
+    except ldap.SERVER_DOWN:
+        log.error('Likely testing against a debug version that asserted')
+        pass
+
+    # Step 5
+    assert not topology_st.standalone.searchErrorsLog('CRIT - list_candidates - NULL idl was recieved from filter_candidates_ext.')
+
 if __name__ == '__main__':
     # Run isolated
     # -s for DEBUG mode
diff --git a/ldap/servers/slapd/back-ldbm/filterindex.c b/ldap/servers/slapd/back-ldbm/filterindex.c
index 6d36ba3..3ef04f8 100644
--- a/ldap/servers/slapd/back-ldbm/filterindex.c
+++ b/ldap/servers/slapd/back-ldbm/filterindex.c
@@ -803,16 +803,10 @@ list_candidates(
         }
 
         /*
-         * Assert we recieved a valid idl. If it was NULL, it means somewhere we failed
-         * during the dblayer interactions.
-         *
-         * idl_set requires a valid idl structure to generate the linked list of
-         * idls that we insert.
+         * The IDL for that component is NULL, so no candidate retrieved from that component. This is all normal
+         * Just build a idl with an empty set
          */
         if (tmp == NULL) {
-            slapi_log_err(SLAPI_LOG_CRIT, "list_candidates", "NULL idl was recieved from filter_candidates_ext.");
-            slapi_log_err(SLAPI_LOG_CRIT, "list_candidates", "Falling back to empty IDL set. This may affect your search results.");
-            PR_ASSERT(tmp);
             tmp = idl_alloc(0);
         }