mgr/smb: relax name length validation to support KMIP/GKLM aliases

Introduce new regex for mem/kmip key names to allow up to 63 characters, which
matches the maximum permitted DNS label length (RFC 1035).

Signed-off-by: Avan Thakkar <athakkar@redhat.com>

diff --git a/src/pybind/mgr/smb/resources.py b/src/pybind/mgr/smb/resources.py
index 9e772c56d3271babc589520825b41a9279547e36..d3b9079de95ddd355f64b265d7d9cff90978532c 100644 (file)
--- a/src/pybind/mgr/smb/resources.py
+++ b/src/pybind/mgr/smb/resources.py
@@ -229,7 +229,7 @@ class FSCryptKeySelector(_RBase):
 
     def validate(self) -> None:
         self.scope_identity()  # raises value error if scope invalid
-        validation.check_id(self.name)
+        validation.check_fscrypt_key_name(self.name)
 
 
 @resourcelib.component()

diff --git a/src/pybind/mgr/smb/tests/test_validation.py b/src/pybind/mgr/smb/tests/test_validation.py
index 3c30b6b02f69adbefcabbc4c51d54963fbbdf538..ea587c82e5a1206ae7b35e6af60564b62aa47888 100644 (file)
--- a/src/pybind/mgr/smb/tests/test_validation.py
+++ b/src/pybind/mgr/smb/tests/test_validation.py
@@ -52,6 +52,31 @@ def test_valid_share_name(value, valid):
             smb.validation.check_share_name(value)
 
 
+@pytest.mark.parametrize(
+    "value,valid",
+    [
+        ("x", True),
+        ("aa", True),
+        ("test-key-1", True),
+        ("mem-scope-key", True),
+        ("kmip0123456789", True),
+        ("A" * 63, True),  # max allowed
+        ("A" * 64, False),  # invalid >63
+        ("-bad", False),
+        ("bad-", False),
+        ("", False),
+        ("bad$key", False),
+    ],
+)
+def test_valid_fscrypt_key_name(value, valid):
+    assert smb.validation.valid_fscrypt_key_name(value) == valid
+    if valid:
+        smb.validation.check_fscrypt_key_name(value)
+    else:
+        with pytest.raises(ValueError):
+            smb.validation.check_fscrypt_key_name(value)
+
+
 @pytest.mark.parametrize(
     "value,valid",
     [

diff --git a/src/pybind/mgr/smb/validation.py b/src/pybind/mgr/smb/validation.py
index 41d76b77d3f30c00e7cf2a3243c0cd196506bce1..5526e49bc30f6bb91ca275d8d368091a8fcd0417 100644 (file)
--- a/src/pybind/mgr/smb/validation.py
+++ b/src/pybind/mgr/smb/validation.py
@@ -19,6 +19,10 @@ _name_re = re.compile('^[a-zA-Z0-9]($|[a-zA-Z0-9-]{,16}[a-zA-Z0-9]$)')
 # but as above it's easier to start strict.
 _share_re = re.compile('^[a-zA-Z0-9_][a-zA-Z0-9. _-]{,63}$')
 
+_fscrypt_key_name_re = re.compile(
+    '^[a-zA-Z0-9]($|[a-zA-Z0-9-]{,61}[a-zA-Z0-9]$)'
+)
+
 
 def valid_id(value: str) -> bool:
     """Return true if value is a valid (cluster|share|etc) ID."""
@@ -42,6 +46,17 @@ def check_share_name(value: str) -> None:
         raise ValueError(f"{value!r} is not a valid share name")
 
 
+def valid_fscrypt_key_name(value: str) -> bool:
+    """Return true if value is a valid fscrypt key name."""
+    return bool(_fscrypt_key_name_re.match(value))
+
+
+def check_fscrypt_key_name(value: str) -> None:
+    """Raise ValueError if value is not a valid fscrypt key name."""
+    if not valid_fscrypt_key_name(value):
+        raise ValueError(f"{value!r} is not a valid fscrypt key name")
+
+
 # alias for normpath so other smb libs can just import validation module
 normalize_path = posixpath.normpath