rfc2253 says we need to escape " and leading and trailing space.

diff --git a/plugins/sudoers/cvtsudoers_ldif.c b/plugins/sudoers/cvtsudoers_ldif.c
index 39f9015c9618a6c8b81a09c94979cd483ae55a11..973d240b8f92207030c4599d42e1a0505b03d1fd 100644 (file)
--- a/plugins/sudoers/cvtsudoers_ldif.c
+++ b/plugins/sudoers/cvtsudoers_ldif.c
@@ -326,6 +326,7 @@ print_cmndspec_ldif(FILE *fp, struct cmndspec *cs, struct cmndspec **nextp, stru
 
 /*
  * Convert user name to cn, avoiding duplicates and quoting as needed.
+ * See http://www.faqs.org/rfcs/rfc2253.html
  */
 static char *
 user_to_cn(const char *user)
@@ -363,19 +364,23 @@ user_to_cn(const char *user)
     for (src = user, dst = cn; *src != '\0'; src++) {
        switch (*src) {
        case ',':
-       case '\\':
-       case '#':
        case '+':
+       case '"':
+       case '\\':
        case '<':
        case '>':
+       case '#':
        case ';':
-           *dst++ = '\\';
-           *dst++ = *src;
+           *dst++ = '\\';      /* always escape */
+           break;
+       case ' ':
+           if (src == user || src[1] == '\0')
+               *dst++ = '\\';  /* only escape at beginning or end of string */
            break;
        default:
-           *dst++ = *src;
            break;
        }
+       *dst++ = *src;
     }
     *dst = '\0';
 

diff --git a/plugins/sudoers/regress/sudoers/test2.ldif.ok b/plugins/sudoers/regress/sudoers/test2.ldif.ok
index 94714879757c3e7a3d21acec8caf4be03f768a18..a9e7df92104b8ecb4233b53264ff951299203fba 100644 (file)
--- a/plugins/sudoers/regress/sudoers/test2.ldif.ok
+++ b/plugins/sudoers/regress/sudoers/test2.ldif.ok
@@ -45,10 +45,10 @@ sudoRunAsUser: root
 sudoCommand: ALL
 sudoOrder: 2
 
-dn: cn=foo",ou=SUDOers,dc=sudo,dc=ws
+dn: cn=foo\",ou=SUDOers,dc=sudo,dc=ws
 objectClass: top
 objectClass: sudoRole
-cn: foo"
+cn: foo\"
 sudoUser: foo"
 sudoHost: hostc
 sudoRunAsUser: root
@@ -65,10 +65,10 @@ sudoRunAsUser: root
 sudoCommand: ALL
 sudoOrder: 4
 
-dn: cn=foo:bar",ou=SUDOers,dc=sudo,dc=ws
+dn: cn=foo:bar\",ou=SUDOers,dc=sudo,dc=ws
 objectClass: top
 objectClass: sudoRole
-cn: foo:bar"
+cn: foo:bar\"
 sudoUser: foo:bar"
 sudoHost: hoste
 sudoRunAsUser: root
@@ -115,10 +115,10 @@ sudoRunAsUser: root
 sudoCommand: ALL
 sudoOrder: 9
 
-dn: cn=%:C/non"UNIX"0 c,ou=SUDOers,dc=sudo,dc=ws
+dn: cn=%:C/non\"UNIX\"0 c,ou=SUDOers,dc=sudo,dc=ws
 objectClass: top
 objectClass: sudoRole
-cn: %:C/non"UNIX"0 c
+cn: %:C/non\"UNIX\"0 c
 sudoUser: %:C/non"UNIX"0 c
 sudoHost: hoste
 sudoRunAsUser: root