URL:
https://github.com/SSSD/sssd/pull/246
Title: #246: filter_users and filter_groups stop working properly in v 1.15
pbrezina commented:
"""
```c
static errno_t cache_req_search_ncache_filter(TALLOC_CTX *mem_ctx,
struct cache_req *cr,
struct ldb_result *result,
struct ldb_result **_result)
{
...
if (cr->plugin->ncache_filter_fn == NULL) {
CACHE_REQ_DEBUG(SSSDBG_TRACE_FUNC, cr,
"This request type does not support filtering negative
cache\n");
^^^ This request type does not support filtering result by negative cache
filtered_result = cache_req_create_ldb_result_from_msg_list(tmp_ctx,
result->msgs,
result->count);
if (filtered_result == NULL) {
ret = ENOMEM;
goto done;
}
goto immediately;
^^^ shorter version:
*_result = talloc_steal(mem_ctx, result);
ret = EOK;
goto done;
}
CACHE_REQ_DEBUG(SSSDBG_TRACE_FUNC, cr,
"Filtering out results from negative cache\n");
^^^ Filtering out results by negative cache
msgs = talloc_zero_array(tmp_ctx, struct ldb_message *, result->count);
msg_count = 0;
for (size_t i = 0; i < result->count; i++) {
name = sss_get_name_from_msg(cr->domain, result->msgs[i]);
if (name == NULL) {
CACHE_REQ_DEBUG(SSSDBG_CRIT_FAILURE, cr,
"sss_get_name_from_msg() returned NULL, which should never "
"happen in this scenario!\n");
ret = ERR_INTERNAL;
goto done;
}
ret = cr->plugin->ncache_filter_fn(cr->ncache, cr->domain, name);
if (ret == EEXIST) {
CACHE_REQ_DEBUG(SSSDBG_TRACE_FUNC, cr,
"[%s] filtered out! (negative cache)\n",
name);
continue;
} else if (ret != EOK && ret != ENOENT) {
CACHE_REQ_DEBUG(SSSDBG_CRIT_FAILURE, cr,
"Unable to check negative cache [%d]: %s\n",
ret, sss_strerror(ret));
goto done;
}
CACHE_REQ_DEBUG(SSSDBG_TRACE_FUNC, cr,
"[%s] is not present in negative cache\n",
name);
^^^ Please, remove this debug message.
We will know which users are removed. We know which
remain. This would be insanely long for enumeration.
msgs[msg_count] = talloc_steal(msgs, result->msgs[i]);
msg_count++;
}
if (msg_count == 0) {
ret = ENOENT;
goto done;
}
filtered_result = cache_req_create_ldb_result_from_msg_list(tmp_ctx, msgs,
msg_count);
if (filtered_result == NULL) {
ret = ENOMEM;
goto done;
}
--- immediately:
*_result = talloc_steal(mem_ctx, filtered_result);
ret = EOK;
done:
talloc_free(tmp_ctx);
return ret;
}
```
"""
See the full comment at
https://github.com/SSSD/sssd/pull/246#issuecomment-299438086