[pve-devel] [PATCH access-control 4/5] ldap: validate LDAP DNs using the `ldap-dn` schema format

[Christoph Heiss]

Remove the dreaded DN regex, instead validating DNs using the newly
defined `ldap-dn` schema format (which uses
Net::LDAP::Util::canonical_dn() under the hood).

Result of a previous discussion [0].

[0] https://lists.proxmox.com/pipermail/pve-devel/2023-May/056839.html

Signed-off-by: Christoph Heiss <c.heiss at proxmox.com>
---
Needs a bump of libpve-common-perl due to the new 'ldap-dn' schema
format.

 src/PVE/Auth/LDAP.pm | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index fc82a17..e0ead1b 100755
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -10,9 +10,6 @@ use PVE::Tools;

 use base qw(PVE::Auth::Plugin);

-my  $dn_part_regex = qr!("[^"]+"|[^ ,+"/<>;=#][^,+"/<>;=]*[^ ,+"/<>;=]|[^ ,+"/<>;=#])!;
-our $dn_regex = qr!\w+=${dn_part_regex}(,\s*\w+=${dn_part_regex})*!;
-
 sub type {
     return 'ldap';
 }
@@ -22,7 +19,7 @@ sub properties {
 	base_dn => {
 	    description => "LDAP base domain name",
 	    type => 'string',
-	    pattern => $dn_regex,
+	    format => 'ldap-dn',
 	    optional => 1,
 	    maxLength => 256,
 	},
@@ -36,7 +33,7 @@ sub properties {
 	bind_dn => {
 	    description => "LDAP bind domain name",
 	    type => 'string',
-	    pattern => $dn_regex,
+	    format => 'ldap-dn',
 	    optional => 1,
 	    maxLength => 256,
 	},
@@ -94,7 +91,7 @@ sub properties {
 	    description => "LDAP base domain name for group sync. If not set, the"
 		." base_dn will be used.",
 	    type => 'string',
-	    pattern => $dn_regex,
+	    format => 'ldap-dn',
 	    optional => 1,
 	    maxLength => 256,
 	},
--
2.41.0