[SSSD] [PATCH] SSH: Allow newline at the end of public key values in LDAP

Jan Cholasta jcholast at redhat.com
Wed Jun 11 14:57:23 UTC 2014


On 5.6.2014 16:34, Pavel Reichl wrote:
> On Wed, 2014-06-04 at 17:05 +0200, Jan Cholasta wrote:
>> Hi,
>>
>> the attached patch fixes <https://fedorahosted.org/sssd/ticket/2349>.
>>
>> Honza
>>
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
> Hello Honza,
>
> I'm little confused about this ticket - reporter complained that it's
> not allowed to have newlines *anywhere* in the public key string, not
> even at the end. But you added support for newlines only at the end of
> the file. Does is it make any sense to have newlines at the public key
> at all? I was not able to quickly find relevant RFC. :-(

My mistake, I was the one who suggested the title of the ticket to the 
reporter. Newline should indeed not be allowed anywhere in the string 
except at the end.

I'm afraid there is no RFC, I used OpenSSH source code as reference.

>
> I also noticed that key is denied if it contains '\r'. From top of my
> head I would assume that if public key was generated on Windows or Mac
> that the sequence <CR><LF> or <CR> would be used to mark eol - so we
> should tolerate them to. Should not we?

Maybe, I don't know. OpenSSH uses only '\n' as line separator in 
authorized_keys.

>
> Thanks,
>
> PR
>
> PS: Also unit test would be nice, but I can do it myself later.

-- 
Jan Cholasta



More information about the sssd-devel mailing list