|
 |
590d18 |
From c00b3fac15439828ce0ecffa181d1b263ad505a7 Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
590d18 |
Date: Thu, 23 Jul 2015 15:45:35 +0200
|
|
|
590d18 |
Subject: [PATCH] ACI plugin: correctly parse bind rules enclosed in
|
|
|
590d18 |
parentheses
|
|
|
590d18 |
|
|
|
590d18 |
Since bind rule such as `(userdn = "ldap:///anyone")` is also a valid
|
|
|
590d18 |
statement, the ipalib ACI parser was updated to handle this case.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5037
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
ipalib/aci.py | 8 ++++++--
|
|
|
590d18 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/ipalib/aci.py b/ipalib/aci.py
|
|
|
590d18 |
index a55732bf19e58d8a4b36fa18bee2725d5b6584da..f78c5327dbe659240f046ae15622e798c8552829 100755
|
|
|
590d18 |
--- a/ipalib/aci.py
|
|
|
590d18 |
+++ b/ipalib/aci.py
|
|
|
590d18 |
@@ -26,10 +26,11 @@ import re
|
|
|
590d18 |
ACIPat = re.compile(r'\(version\s+3.0\s*;\s*ac[li]\s+\"([^\"]*)\"\s*;\s*([^;]*);\s*\)', re.UNICODE)
|
|
|
590d18 |
|
|
|
590d18 |
# Break the permissions/bind_rules out
|
|
|
590d18 |
-PermPat = re.compile(r'(\w+)\s*\((.*)\)\s+(.*)', re.UNICODE)
|
|
|
590d18 |
+PermPat = re.compile(r'(\w+)\s*\(([^()]*)\)\s*(.*)', re.UNICODE)
|
|
|
590d18 |
|
|
|
590d18 |
# Break the bind rule out
|
|
|
590d18 |
-BindPat = re.compile(r'([a-zA-Z0-9;\.]+)\s*(\!?=)\s*(.*)', re.UNICODE)
|
|
|
590d18 |
+BindPat = re.compile(r'\(?([a-zA-Z0-9;\.]+)\s*(\!?=)\s*\"(.*)\"\)?',
|
|
|
590d18 |
+ re.UNICODE)
|
|
|
590d18 |
|
|
|
590d18 |
ACTIONS = ["allow", "deny"]
|
|
|
590d18 |
|
|
|
590d18 |
@@ -193,6 +194,9 @@ class ACI:
|
|
|
590d18 |
self.target['target']['operator'] = operator
|
|
|
590d18 |
|
|
|
590d18 |
def set_bindrule(self, bindrule):
|
|
|
590d18 |
+ if bindrule.startswith('(') != bindrule.endswith(')'):
|
|
|
590d18 |
+ raise SyntaxError("non-matching parentheses in bindrule")
|
|
|
590d18 |
+
|
|
|
590d18 |
match = BindPat.match(bindrule)
|
|
|
590d18 |
if not match or len(match.groups()) < 3:
|
|
|
590d18 |
raise SyntaxError, "malformed bind rule"
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|