Bug 1851975

Summary: Add option to reject internal unindexed searches
Product: Red Hat Enterprise Linux 8 Reporter: mreynolds
Component: 389-ds-baseAssignee: mreynolds
Status: CLOSED ERRATA QA Contact: RHDS QE <ds-qe-bugs>
Severity: unspecified Docs Contact: Marc Muehlfeld <mmuehlfe>
Priority: unspecified    
Version: 8.0CC: aadhikar, pasik, sgouvern, spichugi, tbordaz, tmihinto, vashirov
Target Milestone: rcKeywords: TestCaseProvided
Target Release: 8.0Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 389-ds-devel-1.4-8040020201105165416.866effaa Doc Type: Enhancement
Doc Text:
.Directory Server can now reject internal unindexed searches This enhancement adds the `nsslapd-require-internalop-index` parameter to the `cn=__<database_name>__,cn=ldbm database,cn=plugins,cn=config` entry to reject internal unindexed searches. When a plug-in modifies data, it has a write lock on the database. On large databases, if a plug-in then executes an unindexed search, the plug-in sometimes uses all database locks, which corrupts the database or causes the server to become unresponsive. To avoid this problem, you can now reject internal unindexed searches by enabling the `nsslapd-require-internalop-index` parameter.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-05-18 15:45:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description mreynolds 2020-06-29 14:32:22 UTC
This bug is created as a clone of upstream ticket:
https://pagure.io/389-ds-base/issue/51192

#### Issue Description

The current implementation of nsslapd-require-index for backends does not apply to internal operations.  There are cases where we would want to block internal unindexed searches, so we should add a new option.

We should also log the filter and scope that is causing the search to be unindexed.  This should be done for nsslapd-require-index and for the new setting

Comment 2 mreynolds 2020-07-06 20:57:06 UTC
Doc bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1854234

Comment 8 Akshay Adhikari 2020-11-25 11:03:32 UTC
Tested with build 389-ds-base-libs-1.4.3.16-2.module+el8.4.0+8803+fd0f8fe3.x86_64

============================================================================ test session starts ================================================================
platform linux -- Python 3.6.8, pytest-6.1.2, py-1.9.0, pluggy-0.13.1 -- /usr/bin/python3.6
cachedir: .pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-4.18.0-240.10.el8.x86_64-x86_64-with-redhat-8.4-Ootpa', 'Packages': {'pytest': '6.1.2', 'py': '1.9.0', 'pluggy': '0.13.1'}, 'Plugins': {'html': '2.1.1', 'metadata': '1.10.0'}}
389-ds-base: 1.4.3.16-2.module+el8.4.0+8803+fd0f8fe3
nss: 3.53.1-11.el8_2
nspr: 4.25.0-2.el8_2
openldap: 2.4.46-16.el8
cyrus-sasl: not installed
FIPS: disabled
rootdir: /root/389-ds-base/dirsrvtests, configfile: pytest.ini
plugins: html-2.1.1, metadata-1.10.0
collected 10 items / 8 deselected / 2 selected                                                                                                                              

dirsrvtests/tests/suites/config/config_test.py::test_require_index PASSED                                                                                             [ 50%]
dirsrvtests/tests/suites/config/config_test.py::test_require_internal_index PASSED                                                                                    [100%]

=============================================================== 2 passed, 8 deselected, 8 warnings in 15.87s ====================================================

-> marking as verified: tested

Comment 12 sgouvern 2020-11-30 16:39:30 UTC
verified:tested (see comment 8) with build 389-ds-1.4-8040020201125182123.866effaa / 389-ds-base-libs-1.4.3.16-2.module+el8.4.0+8803+fd0f8fe3.x86_64
-> marking as VERIFIED

Comment 16 errata-xmlrpc 2021-05-18 15:45:18 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (389-ds:1.4 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1835