Skip Menu |

Download (untitled) / with headers
text/plain 4.1KiB
From Wed Jul 3 17:27:41 2002
by (8.9.3/8.9.3) with ESMTP id RAA09259
for <>; Wed, 3 Jul 2002 17:27:40 -0400 (EDT)
Received: from ( [])
by (8.9.2/8.9.2) with ESMTP id RAA14877
for <>; Wed, 3 Jul 2002 17:27:39 -0400 (EDT)
Received: (from smap@localhost)
by (8.8.8/8.8.8) id RAA27651
for <>; Wed, 3 Jul 2002 17:27:38 -0400 (EDT)
Received: from <> ( []) by gate via smap (V2.0)
id xmaa27585; Wed, 3 Jul 2002 17:27:22 -0400
Received: from (virscan3 [])
by (8.8.8/8.8.8) with ESMTP id RAA26520
for <>; Wed, 3 Jul 2002 17:25:05 -0400 (EDT)
Received: from ( [])
by (8.8.8/8.8.8) with ESMTP id RAA07820;
Wed, 3 Jul 2002 17:26:47 -0400 (EDT)
Received: (willian@localhost) by (8.8.8+Sun/8.6.12) id RAA11556; Wed, 3 Jul 2002 17:26:47 -0400 (EDT)
Message-Id: <>
Date: Wed, 3 Jul 2002 17:26:47 -0400 (EDT)
Subject: Aname_to_lname RULEs parsing bugs
X-Send-Pr-Version: 3.99

Show quoted text
>Number: 1132
>Category: krb5-libs
>Synopsis: Aname_to_lname RULEs parsing bugs
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: krb5-unassigned
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Wed Jul 3 17:28:01 EDT 2002
>Originator: Nicolas Williams
Show quoted text
>Release: krb5-1.2.2
The code that parse aname_to_lname rules naively uses strchr()
to find matching end-of-regexp characters, thereby making it
impossible to use those characters in aname2lname rules.

Specifically, one cannot use sub-expressions in the first regexp
of an aname2lname rule, though regcomp() is called with the
REG_EXTENDED flag, indicating the desire to support
sub-expressions and other regexp extensions. Less importantly,
rules cannot match ')' for the same reason.

Also, one cannot match '/' in the regexp portion of the
transformation part of the rule.

Register substitutions in the replacement portion of the
tranformation portion of the rule would be nice
(e.g., "s/^\(.*\);.*$/\1/").
Show quoted text
Sample rules that fail:

- RULE:[2:$1;$2](^.*;(admin|root)$)s/;.*$//
(fails due to the ')' in the first regexp)

- RULE:[2:$1/$2](^.*/admin$)s/\/.*$//
(fails due to the '/' in the second regexp)
Show quoted text
The use of strchr() in these expressions, "strchr(startp, ')')"
and "strchr(&cp[2], '/')", in lib/krb5/os/an_to_ln.c should be
replaced with a function or expression which allows the first
regexp to contain balanced parenthesis and which ignores
backslash-escaped '/' in the second regexp.

Visit our website at

This message contains confidential information and is intended only
for the individual named. If you are not the named addressee you
should not disseminate, distribute or copy this e-mail. Please
notify the sender immediately by e-mail if you have received this
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free
as information could be intercepted, corrupted, lost, destroyed,
arrive late or incomplete, or contain viruses. The sender therefore
does not accept liability for any errors or omissions in the contents
of this message which arise as a result of e-mail transmission. If
verification is required please request a hard-copy version. This
message is provided for informational purposes and should not be
construed as a solicitation or offer to buy or sell any securities or
related financial instruments.

Show quoted text
Date: Wed, 6 May 2015 19:22:51 -0400 (EDT)
From: Richard Silverman <>
To: Kerberos Bugs <>
Subject: krb5_aname_to_localname() and regcomp()

If the host has regcomp(), MIT Kerberos krb5_aname_to_localname() uses it, calling it with REG_EXTENDED. This means that parentheses should be usable for grouping within the regular expression. This doesn't work, however, because parentheses delimit the regular expression portion of an auth_to_local rule:


The local name will be formulated from exp.

The format for exp is [n:$d..string](regexp)s/pattern/replacement/g ...

and the code uses the *first* right parenthesis found after the opening one to determine the end of the expression:


/* Find the end of the regexp and make a copy of it. */
startp = *contextp + 1;
endp = strchr(startp, ')');

So, a rule like this:

auth_to_local = RULE:[1:$1@$0](^(steve|stephen|steven)@REALM$)s/.*/stephen/

is misinterpreted, since regcomp is called with the expression "^(steve|stephen|steven".

(Checked in MIT Kerberos 1.13.1 and a few older versions).


Richard E. Silverman