Dne 28.8.2012 14:15, Jakub Hrozek napsal(a):
>On Mon, Aug 27, 2012 at 04:08:48PM +0200, Jan Cholasta wrote:
>>Dne 27.8.2012 11:36, Jan Cholasta napsal(a):
>>>Dne 24.8.2012 12:01, Jan Cholasta napsal(a):
>>>>Dne 24.8.2012 10:04, Jan Cholasta napsal(a):
>>>>>Hi,
>>>>>
>>>>>this patch allows use of OpenSSH formatted public keys in LDAP. This
is
>>>>>needed to fix <
https://fedorahosted.org/freeipa/ticket/2932>.
>>>>>
>>>>>Note that this is just a quick fix, only the public key portion of
an
>>>>>OpenSSH formatted public key is used, options and comments are
ignored.
>>>>>A full fix will need more extensive changes in the code.
>>>>>
>>>>>Honza
>>>>>
>>>>
>>>>Self-NACK, the parser is not very robust, I need to improve it.
>>>>
>>>>Honza
>>>>
>>>
>>>Updated the patch & split it in two.
>>>
>>>Honza
>>>
>>
>>Made several improvements to the parser to better match OpenSSH's behavior:
>> - do not allow newlines in the string
>> - allow non-ASCII and control characters in option values and comments
>> - allow backslash-escaped quotes in option values
>>
>>Honza
>>
>
>We were discussing the patches with Honza off-list. In general I'm OK
>with them, but we were talking about creating a simple Python binding so
>that the regular expression could be reused in FreeIPA, too.
>
>The Python bindings would also allow for a unit test, which would be
>very welcome judging by the complexity of the regular expression.
I have given this some thought and I think we don't actually need to
fully parse OpenSSH public keys in SSSD. We can safely differentiate
between raw public key blob and a textual public key, so all we need
to do is to check that the textual public key does not contain nulls
or newlines and let OpenSSH handle the rest.
Full parsing will probably be needed some time in the future. When
that happens, I will revisit the idea of a python binding.
New patches attached.
Honza