- add a "disallowed chars" map attribute

- disallow ':' in attributes in passwd.byname and passwd.byuid
- disallow ':,' in attributes in group.byname and group.bygid

1 files changed, 21 insertions, 8 deletions

diff --git a/src/defaults.c b/src/defaults.c
index 29e0d8d..9ecd1f8 100644
--- a/src/defaults.c
+++ b/src/defaults.c
@@ -39,32 +39,38 @@ static struct configuration {
 	char *map;
 	enum { config_exact, config_glob } config_match;
 	bool_t secure;
-	char *filter, *key_formats[3], *value_format;
+	char *filter, *key_formats[3], *value_format, *disallowed_chars;
 } config[] = {
 	{"passwd.byname", config_exact, FALSE,
 	 "(objectClass=posixAccount)",
 	 {"%{uid}", NULL, NULL},
-	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{cn!:}:%{homeDirectory:-/}:%{loginShell!:}"},
+	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{gecos:-%{cn}}:%{homeDirectory:-/}:%{loginShell}",
+	 ":"},
 	{"passwd.byuid", config_exact, FALSE,
 	 "(objectClass=posixAccount)",
 	 {"%{uidNumber}", NULL, NULL},
-	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{cn!:}:%{homeDirectory:-/}:%{loginShell!:}"},
+	 "%{uid}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{uidNumber}:%{gidNumber}:%{gecos:-%{cn}}:%{homeDirectory:-/}:%{loginShell}",
+	 ":"},
 	{"group.byname", config_exact, FALSE,
 	 "(objectClass=posixGroup)",
 	 {"%{cn}", NULL, NULL},
-	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byname\\\",\\\"memberOf\\\",\\\"uid\\\")\")"},
+	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byname\\\",\\\"memberOf\\\",\\\"uid\\\")\")",
+	 ":,"},
 	{"group.bygid", config_exact, FALSE,
 	 "(objectClass=posixGroup)",
 	 {"%{gidNumber}", NULL, NULL},
-	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byuid\\\",\\\"memberOf\\\",\\\"uid\\\")\")"},
+	 "%{cn}:%regsub(\"userPassword\",\"^\\\\{CRYPT\\\\}(..*)\",\"%1\",\"*\"):%{gidNumber}:%merge(\",\",\"%list(\\\",\\\",\\\"memberUid\\\")\",\"%deref(\\\",\\\",\\\"member\\\",\\\"uid\\\")\",\"%deref(\\\",\\\",\\\"uniqueMember\\\",\\\"uid\\\")\",\"%referred(\\\",\\\",\\\"passwd.byuid\\\",\\\"memberOf\\\",\\\"uid\\\")\")",
+	 ":,"},
 	{"netgroup", config_exact, FALSE,
 	 "(objectClass=nisNetgroup)",
 	 {"%{cn}", NULL, NULL},
-	 "%list(\" \",\"nisNetgroupTriple\",\"memberNisNetgroup\")"},
+	 "%list(\" \",\"nisNetgroupTriple\",\"memberNisNetgroup\")",
+	 NULL},
 	{"auto.*", config_glob, FALSE,
 	 "(objectClass=automount)",
 	 {"%{automountKey}", NULL, NULL},
-	 "%{automountInformation}"},
+	 "%{automountInformation}",
+	 NULL},
 };
 
 void
@@ -72,7 +78,8 @@ defaults_get_map_config(const char *mapname,
 			bool_t *secure,
 			const char **filter,
 			const char ***key_formats,
-			const char **value_format)
+			const char **value_format,
+			const char **disallowed_chars)
 {
 	unsigned int i;
 	if (filter) {
@@ -103,6 +110,9 @@ defaults_get_map_config(const char *mapname,
 				if (value_format) {
 					*value_format = config[i].value_format;
 				}
+				if (disallowed_chars) {
+					*disallowed_chars = config[i].disallowed_chars;
+				}
 			}
 			break;
 		case config_glob:
@@ -120,6 +130,9 @@ defaults_get_map_config(const char *mapname,
 				if (value_format) {
 					*value_format = config[i].value_format;
 				}
+				if (disallowed_chars) {
+					*disallowed_chars = config[i].disallowed_chars;
+				}
 			}
 			break;
 		}