[SSSD] [PATCH] subdomains: replace dot with underscore in krb5 mapping file name

Pavel Březina pbrezina at redhat.com
Fri Feb 1 09:56:14 UTC 2013


On 02/01/2013 10:12 AM, Jakub Hrozek wrote:
> On Thu, Jan 31, 2013 at 02:17:21PM -0500, Dmitri Pal wrote:
>> On 01/31/2013 02:07 PM, Jakub Hrozek wrote:
>>> On Thu, Jan 31, 2013 at 11:52:53AM +0100, Pavel Březina wrote:
>>>> https://fedorahosted.org/sssd/ticket/1795
>>>>  From aba6be77012e2c4f741d78e887f9524b869b78ae Mon Sep 17 00:00:00 2001
>>>> From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
>>>> Date: Thu, 31 Jan 2013 11:21:06 +0100
>>>> Subject: [PATCH 1/2] util: add replace_char() function
>>>>
>>>> Replace all occurrences of character in string with other character.
>>> Please add a unit test for new utility functions. I know that this is
>>> a trivial C function, but in general I think we should start to be far
>>> stricter especially with new code now that we are not rushing for a deadline.
>>>
>>> I would also say that we should be even more defensive because currently
>>> the libkrb5 code only allows these file names (see valid_name() function
>>> in src/util/profile/prof_parse.c):
>>>
>>> if (!isalnum((unsigned char)*p) && *p != '-' && *p != '_')
>>>    return invalid;
>>>
>>> So in my opinion we should replace any character that doesn't match the
>>> above. Dot would be the typical case, but I don't think we guarantee
>>> that other weird characters don't appear in the domain name. Debugging
>>> why the file didn't load would then be very hard.
>>
>>
>> Replacing more than one character would mean you can end up with collisions.
>> I am not against it just noting that the problem immediately becomes
>> less than trivial.
>> Example:
>>
>> domain at foo
>> domain.foo
>>
>> will translate into the same if you replace both weird characters with '_' .
>
> Yes, sure. I think it would be OK to just warn to the logs in this case.
> The same happens with underscores btw, example.com would yield the same
> filename as example_com.

Yea, this run through my mind. If you have two SSSD domains IPA.PB, 
IPA at PB it is very likely that they point to the same IPA server so the 
mappings would be the same. I don't see any other reason for having such 
domain names but that one of it is for testing some special configuration.

> I was thinking about using something else as a base for the file name
> other than the domain name but the clear advantage of the domain name is
> predictability in case of debugging. The admin can easily ls the includedir
> and cat the files and immediatelly sees which SSSD domain maps to which
> realm.
>
> In reality, I think that we will end up replacing only dots but I want us
> to be able to debug the problem if some admin decided it was a good idea
> to name his domain creatively AND have multiple similar domains AND use
> trusts for both of them. I don't think we should over engineer.




More information about the sssd-devel mailing list