openwrt / openwrt/rpcd

Feature request: acls: utilize FNM_EXTMATCH with fnmatch(...) if possible

Open
#28 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
15
Forks
28
PR merge metrics
No merged PRs in 30d

Description

There are several ACLs in luci where folks intend to match multiple characters:

[user@localhost luci]$ git grep ']\*' 'applications/*.json'
applications/luci-app-adblock/root/usr/share/rpcd/acl.d/luci-app-adblock.json:                          "/etc/init.d/adblock report [a-z]* [0-9]* [0-9]* *": [ "exec" ],
applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json:                              "/etc/init.d/banip search [A-Za-z0-9:.]*": [ "exec" ],
applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json:                              "/etc/init.d/banip content [A-Za-z0-9]* *": [ "exec" ],
applications/luci-app-minidlna/root/usr/share/rpcd/acl.d/luci-app-minidlna.json:                                "/usr/bin/wget -q http://127.0.0.1:[0-9]*/ -O -": [ "exec" ]
applications/luci-app-tinyproxy/root/usr/share/rpcd/acl.d/luci-app-tinyproxy.json:                              "/usr/bin/wget -q http://127.0.0.1:[0-9]*/ -O -": [ "exec" ],
applications/luci-app-travelmate/root/usr/share/rpcd/acl.d/luci-app-travelmate.json:                            "/etc/init.d/travelmate setup [0-9a-z_]* [0-9a-z_]* [0-9]*" : [ "exec" ],

Unfortunately, since these aren't regular expressions, these are not doing what the authors intended.

If the libraries on the system support it, FNM_EXTMATCH (which is a GNU extension) could be a useful change to rpcd so that luci's ACLs could take advantage of it:

       FNM_EXTMATCH
              If  this flag (a GNU extension) is set, extended patterns are sup‐
              ported, as introduced by 'ksh' and now supported by other  shells.
              The  extended  format is as follows, with pattern-list being a '|'
              separated list of patterns.

       '?(pattern-list)'
              The pattern matches if zero or one occurrences of any of the  pat‐
              terns in the pattern-list match the input string.

       '*(pattern-list)'
              The pattern matches if zero or more occurrences of any of the pat‐
              terns in the pattern-list match the input string.

       '+(pattern-list)'
              The  pattern matches if one or more occurrences of any of the pat‐
              terns in the pattern-list match the input string.

       '@(pattern-list)'
              The pattern matches if exactly one occurrence of any of  the  pat‐
              terns in the pattern-list match the input string.

       '!(pattern-list)'
              The pattern matches if the input string cannot be matched with any
              of the patterns in the pattern-list.

See https://github.com/openwrt/luci/pull/8426.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating rpcd's ACL command-pattern matching and the fnmatch(...) call, then check which target libraries expose FNM_EXTMATCH. Compare behavior against the listed luci ACL patterns and add or update relevant tests; done means supported platforms use the intended extended matching without breaking existing ACL behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
authorization, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.