[SSSD] [PATCH] subdomains: replace dot with underscore in krb5 mapping file name

Jakub Hrozek jhrozek at redhat.com
Fri Feb 1 09:12:48 UTC 2013


On Thu, Jan 31, 2013 at 02:17:21PM -0500, Dmitri Pal wrote:
> On 01/31/2013 02:07 PM, Jakub Hrozek wrote:
> > On Thu, Jan 31, 2013 at 11:52:53AM +0100, Pavel Březina wrote:
> >> https://fedorahosted.org/sssd/ticket/1795
> >> From aba6be77012e2c4f741d78e887f9524b869b78ae Mon Sep 17 00:00:00 2001
> >> From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
> >> Date: Thu, 31 Jan 2013 11:21:06 +0100
> >> Subject: [PATCH 1/2] util: add replace_char() function
> >>
> >> Replace all occurrences of character in string with other character.
> > Please add a unit test for new utility functions. I know that this is
> > a trivial C function, but in general I think we should start to be far
> > stricter especially with new code now that we are not rushing for a deadline.
> >
> > I would also say that we should be even more defensive because currently
> > the libkrb5 code only allows these file names (see valid_name() function
> > in src/util/profile/prof_parse.c):
> >
> > if (!isalnum((unsigned char)*p) && *p != '-' && *p != '_')
> >   return invalid;
> >
> > So in my opinion we should replace any character that doesn't match the
> > above. Dot would be the typical case, but I don't think we guarantee
> > that other weird characters don't appear in the domain name. Debugging
> > why the file didn't load would then be very hard.
> 
> 
> Replacing more than one character would mean you can end up with collisions.
> I am not against it just noting that the problem immediately becomes
> less than trivial.
> Example:
> 
> domain at foo
> domain.foo
> 
> will translate into the same if you replace both weird characters with '_' .

Yes, sure. I think it would be OK to just warn to the logs in this case.
The same happens with underscores btw, example.com would yield the same
filename as example_com.

I was thinking about using something else as a base for the file name
other than the domain name but the clear advantage of the domain name is
predictability in case of debugging. The admin can easily ls the includedir
and cat the files and immediatelly sees which SSSD domain maps to which
realm.

In reality, I think that we will end up replacing only dots but I want us
to be able to debug the problem if some admin decided it was a good idea
to name his domain creatively AND have multiple similar domains AND use
trusts for both of them. I don't think we should over engineer.



More information about the sssd-devel mailing list