[27600] in Kerberos
slightly expanded wildcard support for kadm5.acl
daemon@ATHENA.MIT.EDU (Mike Dopheide)
Fri Mar 30 16:28:22 2007
Message-ID: <460D72A0.2050208@ncsa.uiuc.edu>
Date: Fri, 30 Mar 2007 15:27:12 -0500
From: Mike Dopheide <dopheide@ncsa.uiuc.edu>
MIME-Version: 1.0
To: kerberos@mit.edu
Content-Type: multipart/mixed; boundary="------------040502080405090007020202"
Errors-To: kerberos-bounces@mit.edu
This is a multi-part message in MIME format.
--------------040502080405090007020202
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Attached is a patch to add wildcard support at the beginning and end of
kadm5.acl components. I'd love to see this or something like it get
added to the standard codebase. We haven't used this in the field yet,
I wanted to get people's opinions first. I may not have considered all
of the implications (please let me know if I'm missing something bad).
We've run into a couple situations here where it would be really handy
to have this.
Example 1:
Temporary guest accounts on a system that doesn't support instances.
This resulted in something similar to guest[001-100] prinicpals and a
hundred kadm5.acl entries so the event coordinator could reset
passwords. This is much more concise:
guest/admin@REALM.COM cmi guest*@REALM.COM
Example 2:
Multiple site admins using a central Kerberos realm. In this case you
can give each site admin control to create/edit host keys in their own
subdomain.
site1/admin@REALM.COM * host/*.site1.realm.com@REALM.COM
site2/admin@REALM.COM * host/*.site2.realm.com@REALM.COM
-Mike
PS. During my testing I noticed that kadmind segfaults if you forget to
add the ACL permissions to a line in kadm5.acl. :)
--------------040502080405090007020202
Content-Type: text/plain;
name="kadm5_acl.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="kadm5_acl.patch"
diff -Nur krb5-1.6/src/lib/kadm5/srv/server_acl.c krb5-1.6.dop/src/lib/kadm5/srv/server_acl.c
--- krb5-1.6/src/lib/kadm5/srv/server_acl.c 2006-06-16 01:58:42.000000000 -0500
+++ krb5-1.6.dop/src/lib/kadm5/srv/server_acl.c 2007-03-30 14:57:19.000000000 -0500
@@ -543,7 +543,8 @@
/*
* kadm5int_acl_match_data() - See if two data entries match.
*
- * Wildcarding is only supported for a whole component.
+ * Wildcarding is only supported at the beginning, end, or as a
+ * whole component.
*/
static krb5_boolean
kadm5int_acl_match_data(e1, e2, targetflag, ws)
@@ -552,12 +553,37 @@
wildstate_t *ws;
{
krb5_boolean retval;
+ int cmplen=0;
+ int e2offset;
+ int e1offset;
DPRINT(DEBUG_CALLS, acl_debug_level,
("* acl_match_entry(%s, %s)\n", e1->data, e2->data));
retval = 0;
- if (!strncmp(e1->data, "*", e1->length)) {
- retval = 1;
+
+ if(strchr(e1->data, '*')){
+ if(e1->length == 1){
+ /* whole component matches wildcard */
+ retval = 1;
+
+ }else if(e1->data[0] == '*'){
+ /* wildcard at beginning of component */
+ cmplen = e1->length - 1;
+ e2offset = e2->length - cmplen;
+ e1offset = 1;
+
+ }else if(e1->data[e1->length-1] == '*'){
+ /* wildcard at end of component */
+ cmplen = e1->length - 1;
+ e2offset=0;
+ e1offset=0;
+ }
+
+ /* Compare beginning or end of e2->data depending on offsets above */
+ if((strncmp(e1->data+e1offset, e2->data+e2offset, cmplen) == 0) && (e2offset >= 0) && (cmplen != 0)){
+ retval = 1;
+ }
+
if (ws && !targetflag) {
if (ws->nwild >= 9) {
DPRINT(DEBUG_ACL, acl_debug_level,
--------------040502080405090007020202
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--------------040502080405090007020202--
