Changeset 9d21120

Timestamp:

Nov 8, 2010, 4:02:43 PM (14 years ago)

Author:

Alejandro R. Sedeño <asedeno@mit.edu>

Branches:

master, release-1.10, release-1.7, release-1.8, release-1.9

Children:

35d2091

Parents:

1522e5d

git-author:

Alejandro R. Sedeño <asedeno@mit.edu> (11/04/10 15:02:02)

git-committer:

Alejandro R. Sedeño <asedeno@mit.edu> (11/08/10 16:02:43)

Message:

zephyr: update smartstrip logic

* Deal with krb5 principal types first, then krb4 princiapl types.
* Special case principals that start with 'host/', 'daemon/', 'rcmd.', and 'daemon.'.
* Drop special case for webzephyr as it is now taken care of by the more general case above.

Signed-off-by: Alejandro R. Sedeño <asedeno@mit.edu>

Files:

• owl.h (modified) (1 diff)
• zephyr.c (modified) (1 diff)

owl.h

@@ -201 +201 @@
 #define OWL_WEBZEPHYR_CLASS     "webzephyr"
 #define OWL_WEBZEPHYR_OPCODE    "webzephyr"
+
+#define OWL_ZEPHYR_NOSTRIP_HOST         "host/"
+#define OWL_ZEPHYR_NOSTRIP_RCMD         "rcmd."
+#define OWL_ZEPHYR_NOSTRIP_DAEMON5      "daemon/"
+#define OWL_ZEPHYR_NOSTRIP_DAEMON4      "daemon."
 
 #define OWL_REGEX_QUOTECHARS    "!+*.?[]^\\${}()"

zephyr.c

@@ -1229 +1229 @@
 
 /* strip out the instance from a zsender's principal.  Preserves the
- * realm if present.  daemon/webzephyr.mit.edu is a special case.
- * The caller must free the return.
+ * realm if present.  Leave host/ and daemon/ krb5 principals
+ * alone. Also leave rcmd. and daemon. krb4 principals alone. The
+ * caller must free the return.
  */
 char *owl_zephyr_smartstripped_user(const char *in)
 {
-  char *ptr, *realm, *out;
-
-  out=owl_strdup(in);
+  char *slash, *dot, *realm, *out;
+
+  out = owl_strdup(in);
 
   /* bail immeaditly if we don't have to do any work */
-  ptr=strchr(out, '.');
-  if (!strchr(out, '/') && !ptr) {
-    /* no '/' and no '.' */
+  slash = strchr(out, '/');
+  dot = strchr(out, '.');
+  if (!slash && !dot) {
     return(out);
   }
-  if (ptr && strchr(out, '@') && (ptr > strchr(out, '@'))) {
-    /* There's a '.' but it's in the realm */
+
+  if (!strncasecmp(out, OWL_ZEPHYR_NOSTRIP_HOST, strlen(OWL_ZEPHYR_NOSTRIP_HOST)) ||
+      !strncasecmp(out, OWL_ZEPHYR_NOSTRIP_RCMD, strlen(OWL_ZEPHYR_NOSTRIP_RCMD)) ||
+      !strncasecmp(out, OWL_ZEPHYR_NOSTRIP_DAEMON5, strlen(OWL_ZEPHYR_NOSTRIP_DAEMON5)) ||
+      !strncasecmp(out, OWL_ZEPHYR_NOSTRIP_DAEMON4, strlen(OWL_ZEPHYR_NOSTRIP_DAEMON4))) {
     return(out);
   }
-  if (!strncasecmp(out, OWL_WEBZEPHYR_PRINCIPAL, strlen(OWL_WEBZEPHYR_PRINCIPAL))) {
+
+  realm = strchr(out, '@');
+  if (!slash && dot && realm && (dot > realm)) {
+    /* There's no '/', and the first '.' is in the realm */
     return(out);
   }
 
   /* remove the realm from out, but hold on to it */
-  realm=strchr(out, '@');
   if (realm) realm[0]='\0';
 
   /* strip */
-  ptr=strchr(out, '.');
-  if (!ptr) ptr=strchr(out, '/');
-  ptr[0]='\0';
+  if (slash) slash[0] = '\0';  /* krb5 style user/instance */
+  else if (dot) dot[0] = '\0'; /* krb4 style user.instance */
 
   /* reattach the realm if we had one */