Feature request: acls: utilize FNM_EXTMATCH with fnmatch(...) if possible
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 15
- Forks
- 28
- PR merge metrics
- No merged PRs in 30d
Description
There are several ACLs in luci where folks intend to match multiple characters:
[user@localhost luci]$ git grep ']\*' 'applications/*.json'
applications/luci-app-adblock/root/usr/share/rpcd/acl.d/luci-app-adblock.json: "/etc/init.d/adblock report [a-z]* [0-9]* [0-9]* *": [ "exec" ],
applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json: "/etc/init.d/banip search [A-Za-z0-9:.]*": [ "exec" ],
applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json: "/etc/init.d/banip content [A-Za-z0-9]* *": [ "exec" ],
applications/luci-app-minidlna/root/usr/share/rpcd/acl.d/luci-app-minidlna.json: "/usr/bin/wget -q http://127.0.0.1:[0-9]*/ -O -": [ "exec" ]
applications/luci-app-tinyproxy/root/usr/share/rpcd/acl.d/luci-app-tinyproxy.json: "/usr/bin/wget -q http://127.0.0.1:[0-9]*/ -O -": [ "exec" ],
applications/luci-app-travelmate/root/usr/share/rpcd/acl.d/luci-app-travelmate.json: "/etc/init.d/travelmate setup [0-9a-z_]* [0-9a-z_]* [0-9]*" : [ "exec" ],
Unfortunately, since these aren't regular expressions, these are not doing what the authors intended.
If the libraries on the system support it, FNM_EXTMATCH (which is a GNU extension) could be a useful change to rpcd so that luci's ACLs could take advantage of it:
FNM_EXTMATCH
If this flag (a GNU extension) is set, extended patterns are sup‐
ported, as introduced by 'ksh' and now supported by other shells.
The extended format is as follows, with pattern-list being a '|'
separated list of patterns.
'?(pattern-list)'
The pattern matches if zero or one occurrences of any of the pat‐
terns in the pattern-list match the input string.
'*(pattern-list)'
The pattern matches if zero or more occurrences of any of the pat‐
terns in the pattern-list match the input string.
'+(pattern-list)'
The pattern matches if one or more occurrences of any of the pat‐
terns in the pattern-list match the input string.
'@(pattern-list)'
The pattern matches if exactly one occurrence of any of the pat‐
terns in the pattern-list match the input string.
'!(pattern-list)'
The pattern matches if the input string cannot be matched with any
of the patterns in the pattern-list.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating rpcd's ACL command-pattern matching and the fnmatch(...) call, then check which target libraries expose FNM_EXTMATCH. Compare behavior against the listed luci ACL patterns and add or update relevant tests; done means supported platforms use the intended extended matching without breaking existing ACL behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authorization, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100