Bug 4180 - Exact syntax of grid-mapfile?
: Exact syntax of grid-mapfile?
Status: NEW
: GSI C
Authentication
: 4.0.1
: All All
: P3 minor
: ---
Assigned To:
:
:
:
:
  Show dependency treegraph
 
Reported: 2006-01-26 20:51 by
Modified: 2008-08-11 15:22 (History)


Attachments


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2006-01-26 20:51:55
I ran across this while looking through
    gsi/gss_assist/source/gridmap.c
I haven't verified that any problems actually occur.

The comment block at the top of the
globus_i_gss_assist_gridmap_parse_globusid() function say, in part:

 * Given a pointer to a string containing the globusid from the
 * gridmap file, return a pointer to a string containing the
 * parsed from of the id.
 *
 * Specifically handle backslashed characters - e.g. '\\',
 * '\x4a' or '\37'.

"from" should be "form".

The code appears to handle '\\' (mapping it to a single '\') and '\x4a'
(mapping it to ASCII 'J'), but there doesn't appear to be any code
that would handle '\37'.  What is '\37' supposed to mean?

I was also surprised to learn that the DN doesn't have to be enclosed
in quotation marks as long as it doesn't contain any whitespace,
*and* that anything after the username list is silently ignored.

The code uses fgets() with a 1024-byte buffer to read input lines.
If a line is longer than 1024 characters, the remaining characters 
are left in the input, to be read by the next fgets() call as if
it were a separate line.  I can imagine that this could create
a security hole, though I don't have a specific example of that.
I suggest either discarding any remaining characters on the line,
or treating any line longer than 1024 characters as an error.

I don't see a detailed description of the grid-mapfile syntax in the
on-line documentation.  If there there is one, where can I find it?

One possible problem is that it's easy to assume that '#' can introduce
an end-of-line comment; as far as I can tell, a '#' adjacent to a
username is treated as part of the username.  For example:

    "/O=FOO/OU=BAR/CN=John Doe" jdoe#this is a comment

would map the DN to the username "jdoe#this".  This problem won't 
occur if the '#' is preceded by whitespace.
------- Comment #1 From 2007-08-08 13:09:54 -------
The security team has been working on and off on a doc containing a proposed
grammar for gridmap files and some state-of-the-code documentation of how the
different  implementations parse the files. The current draft is located at
http://dev.globus.org/wiki/Gridmap though there is still more work to do in
that document and into the standardization of the gridmap files.