mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-09-05 20:47:55 +00:00
Vinícius Ferrão
b62c52b597
xcatd expands the request noderange before it authorizes the caller: once to count the nodes, and once in validate() to match the policy rules. The ^ operator makes xcatd open a caller-named file at that point. A client can connect without a certificate, because the listener does not require one, and such a client has no peername. Expand these two pre-authorization noderanges with nofile when the caller has no peername (checked with defined, so the identity "0" still counts as authenticated). If validate() finds a rejected ^file atom on such a request, deny it. An authenticated caller expands ^file as before.