From 63786a83b2e4b14772ee8742fa95d70063ba7b6c Mon Sep 17 00:00:00 2001 From: Pino Toscano Date: Tue, 4 Feb 2020 17:54:22 +0100 Subject: [PATCH] Krb5: improve [dbmodules] and includes (#630) * Krb5: fix/revamp parsing of [dbmodules] subsection The [dbmodules] subsection so far was parsed much like the [dbdefaults] one, and thus it did not handle realms. Revamp it a bit to handle realms, and specify the only keyword not in realm subsections. * Krb5: allow include/includedir directives everywhere MIT Kerberos allows this, so do not restrict them only before any other section. --- lenses/krb5.aug | 27 +++++++++++++++++++-------- lenses/tests/test_krb5.aug | 36 +++++++++++++++++++++++++++++++++++- 2 files changed, 54 insertions(+), 9 deletions(-) diff --git a/lenses/krb5.aug b/lenses/krb5.aug index 46c22656..6b509c42 100644 --- a/lenses/krb5.aug +++ b/lenses/krb5.aug @@ -21,10 +21,11 @@ let closebr = del /[ \t]*\}/ "}" and realms in the [appdefaults] section. *) +let include_re = /include(dir)?/ let realm_re = /[A-Z0-9][.a-zA-Z0-9-]*/ let realm_anycase_re = /[A-Za-z0-9][.a-zA-Z0-9-]*/ let app_re = /[a-z][a-zA-Z0-9_]*/ -let name_re = /[.a-zA-Z0-9_-]+/ +let name_re = /[.a-zA-Z0-9_-]+/ - include_re let value_br = store /[^;# \t\r\n{}]+/ let value = store /[^;# \t\r\n]+/ @@ -130,10 +131,19 @@ let dbdefaults = simple_section "dbdefaults" keys let dbmodules = - let keys = /db_library|ldap_kerberos_container_dn|ldap_kdc_dn/ - |/ldap_kadmind_dn|ldap_service_password_file|ldap_servers/ - |/ldap_conns_per_server/ in - simple_section "dbmodules" keys + let subsec_key = /database_name|db_library|disable_last_success/ + |/disable_lockout|ldap_conns_per_server|ldap_(kdc|kadmind)_dn/ + |/ldap_(kdc|kadmind)_sasl_mech|ldap_(kdc|kadmind)_sasl_authcid/ + |/ldap_(kdc|kadmind)_sasl_authzid|ldap_(kdc|kadmind)_sasl_realm/ + |/ldap_kerberos_container_dn|ldap_servers/ + |/ldap_service_password_file|mapsize|max_readers|nosync/ + |/unlockiter/ in + let subsec_option = subsec_entry subsec_key eq comment in + let key = /db_module_dir/ in + let option = entry key eq value comment in + let realm = [ indent . label "realm" . store realm_re . + eq_openbr . (subsec_option)* . closebr . eol ] in + record "dbmodules" (option|realm) (* This section is not documented in the krb5.conf manpage, but the Fermi example uses it. *) @@ -152,11 +162,12 @@ let kdc = let pam = simple_section "pam" name_re -let includes = Build.key_value_line /include(dir)?/ Sep.space (store Rx.fspath) +let includes = Build.key_value_line include_re Sep.space (store Rx.fspath) +let include_lines = includes . (comment|empty)* -let lns = (comment|empty|includes)* . +let lns = (comment|empty)* . (libdefaults|login|appdefaults|realms|domain_realm - |logging|capaths|dbdefaults|dbmodules|instance_mapping|kdc|pam)* + |logging|capaths|dbdefaults|dbmodules|instance_mapping|kdc|pam|include_lines)* let filter = (incl "/etc/krb5.conf.d/*.conf") . (incl "/etc/krb5.conf") diff --git a/lenses/tests/test_krb5.aug b/lenses/tests/test_krb5.aug index f746543b..10b87605 100644 --- a/lenses/tests/test_krb5.aug +++ b/lenses/tests/test_krb5.aug @@ -1029,7 +1029,7 @@ default_ccache_name = KEYRING:persistent:%{uid}\n" = { } { "default_ccache_name" = "KEYRING:persistent:%{uid}" } } -(* Include(dir) test *) +(* Include(dir) tests *) let include_test = "include /etc/krb5.other_conf.d/other.conf includedir /etc/krb5.conf.d/ " @@ -1037,3 +1037,37 @@ includedir /etc/krb5.conf.d/ test Krb5.lns get include_test = { "include" = "/etc/krb5.other_conf.d/other.conf" } { "includedir" = "/etc/krb5.conf.d/" } + +let include2_test = "[logging] + default = FILE:/var/log/krb5libs.log + +include /etc/krb5.other_conf.d/other.conf + +includedir /etc/krb5.conf.d/ +" + +test Krb5.lns get include2_test = + { "logging" + { "default" + { "file" = "/var/log/krb5libs.log" } } + { } + } + { "include" = "/etc/krb5.other_conf.d/other.conf" } + { } + { "includedir" = "/etc/krb5.conf.d/" } + +(* [dbmodules] test *) +let dbmodules_test = "[dbmodules] + ATHENA.MIT.EDU = { + disable_last_success = true + } + db_module_dir = /some/path +" + +test Krb5.lns get dbmodules_test = + { "dbmodules" + { "realm" = "ATHENA.MIT.EDU" + { "disable_last_success" = "true" } + } + { "db_module_dir" = "/some/path" } + } -- 2.24.1