all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Christoph Heiss <c.heiss@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH common v2 1/5] schema: add `ldap-dn` format for validating LDAP distinguished names
Date: Mon, 24 Jul 2023 11:03:46 +0200	[thread overview]
Message-ID: <20230724090408.221672-2-c.heiss@proxmox.com> (raw)
In-Reply-To: <20230724090408.221672-1-c.heiss@proxmox.com>

The Net::LDAP library conveniently provides a canonical_dn() function,
which can be used to (roughly) check if a DN is valid or not. This will
be used in future changes to replace the current dreaded regex to
validate DNs.

pve-common previously already (silently) depended on the Net::LDAP
library (see PVE::LDAP), but `libnet-ldap-perl` was missing in the
control file - fix it while at it.

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
Changes v1 -> v2:
  * No changes

 debian/control        |  1 +
 src/PVE/JSONSchema.pm | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/debian/control b/debian/control
index ac4cd66..53cbb57 100644
--- a/debian/control
+++ b/debian/control
@@ -34,6 +34,7 @@ Depends: libanyevent-perl,
          libmime-base32-perl,
          libnet-dbus-perl,
          libnet-ip-perl,
+         libnet-ldap-perl,
          libnetaddr-ip-perl,
          libproxmox-acme-perl,
          libproxmox-rs-perl,
diff --git a/src/PVE/JSONSchema.pm b/src/PVE/JSONSchema.pm
index 7589bba..8238281 100644
--- a/src/PVE/JSONSchema.pm
+++ b/src/PVE/JSONSchema.pm
@@ -12,6 +12,7 @@ use PVE::Exception qw(raise);
 use HTTP::Status qw(:constants);
 use JSON;
 use Net::IP qw(:PROC);
+use Net::LDAP::Util;
 use Data::Dumper;

 use base 'Exporter';
@@ -414,6 +415,17 @@ sub verify_ldap_simple_attr {
     return undef;
 }

+PVE::JSONSchema::register_format('ldap-dn', \&verify_ldap_dn);
+sub verify_ldap_dn {
+    my ($attr, $noerr) = @_;
+
+    # canonical_dn() considers emtpy strings as valid DNs, so reject them explicitly.
+    return $attr if $attr ne '' && defined(Net::LDAP::Util::canonical_dn($attr));
+
+    die "value '$attr' does not look like a valid LDAP distinguished name\n" if !$noerr;
+    return undef;
+}
+
 my $ipv4_mask_hash = {
     '0.0.0.0' => 0,
     '128.0.0.0' => 1,
--
2.41.0





  reply	other threads:[~2023-07-24  9:04 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-07-24  9:03 [pve-devel] [PATCH common/access-control v2 0/5] improve LDAP DN and bind creds checking on creation/change Christoph Heiss
2023-07-24  9:03 ` Christoph Heiss [this message]
2023-07-24  9:03 ` [pve-devel] [PATCH common v2 2/5] test: add test cases for new 'ldap-dn' schema format Christoph Heiss
2023-07-24  9:03 ` [pve-devel] [PATCH common v2 3/5] ldap: handle errors explicitly everywhere instead of simply `die`ing Christoph Heiss
2023-07-24  9:03 ` [pve-devel] [PATCH access-control v2 4/5] ldap: validate LDAP DNs using the `ldap-dn` schema format Christoph Heiss
2023-07-24  9:03 ` [pve-devel] [PATCH access-control v2 5/5] ldap: check bind credentials with LDAP directory directly on change Christoph Heiss
2023-07-24 13:18 ` [pve-devel] [PATCH common/access-control v2 0/5] improve LDAP DN and bind creds checking on creation/change Friedrich Weber
2023-07-27  9:54 ` Lukas Wagner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230724090408.221672-2-c.heiss@proxmox.com \
    --to=c.heiss@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal