134 lines
4.4 KiB
Diff
134 lines
4.4 KiB
Diff
From 63786a83b2e4b14772ee8742fa95d70063ba7b6c Mon Sep 17 00:00:00 2001
|
|
From: Pino Toscano <ptoscano@redhat.com>
|
|
Date: Tue, 4 Feb 2020 17:54:22 +0100
|
|
Subject: [PATCH] Krb5: improve [dbmodules] and includes (#630)
|
|
|
|
* Krb5: fix/revamp parsing of [dbmodules] subsection
|
|
|
|
The [dbmodules] subsection so far was parsed much like the [dbdefaults]
|
|
one, and thus it did not handle realms.
|
|
|
|
Revamp it a bit to handle realms, and specify the only keyword not in
|
|
realm subsections.
|
|
|
|
* Krb5: allow include/includedir directives everywhere
|
|
|
|
MIT Kerberos allows this, so do not restrict them only before any other
|
|
section.
|
|
---
|
|
lenses/krb5.aug | 27 +++++++++++++++++++--------
|
|
lenses/tests/test_krb5.aug | 36 +++++++++++++++++++++++++++++++++++-
|
|
2 files changed, 54 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/lenses/krb5.aug b/lenses/krb5.aug
|
|
index 46c22656..6b509c42 100644
|
|
--- a/lenses/krb5.aug
|
|
+++ b/lenses/krb5.aug
|
|
@@ -21,10 +21,11 @@ let closebr = del /[ \t]*\}/ "}"
|
|
and realms in the [appdefaults] section.
|
|
*)
|
|
|
|
+let include_re = /include(dir)?/
|
|
let realm_re = /[A-Z0-9][.a-zA-Z0-9-]*/
|
|
let realm_anycase_re = /[A-Za-z0-9][.a-zA-Z0-9-]*/
|
|
let app_re = /[a-z][a-zA-Z0-9_]*/
|
|
-let name_re = /[.a-zA-Z0-9_-]+/
|
|
+let name_re = /[.a-zA-Z0-9_-]+/ - include_re
|
|
|
|
let value_br = store /[^;# \t\r\n{}]+/
|
|
let value = store /[^;# \t\r\n]+/
|
|
@@ -130,10 +131,19 @@ let dbdefaults =
|
|
simple_section "dbdefaults" keys
|
|
|
|
let dbmodules =
|
|
- let keys = /db_library|ldap_kerberos_container_dn|ldap_kdc_dn/
|
|
- |/ldap_kadmind_dn|ldap_service_password_file|ldap_servers/
|
|
- |/ldap_conns_per_server/ in
|
|
- simple_section "dbmodules" keys
|
|
+ let subsec_key = /database_name|db_library|disable_last_success/
|
|
+ |/disable_lockout|ldap_conns_per_server|ldap_(kdc|kadmind)_dn/
|
|
+ |/ldap_(kdc|kadmind)_sasl_mech|ldap_(kdc|kadmind)_sasl_authcid/
|
|
+ |/ldap_(kdc|kadmind)_sasl_authzid|ldap_(kdc|kadmind)_sasl_realm/
|
|
+ |/ldap_kerberos_container_dn|ldap_servers/
|
|
+ |/ldap_service_password_file|mapsize|max_readers|nosync/
|
|
+ |/unlockiter/ in
|
|
+ let subsec_option = subsec_entry subsec_key eq comment in
|
|
+ let key = /db_module_dir/ in
|
|
+ let option = entry key eq value comment in
|
|
+ let realm = [ indent . label "realm" . store realm_re .
|
|
+ eq_openbr . (subsec_option)* . closebr . eol ] in
|
|
+ record "dbmodules" (option|realm)
|
|
|
|
(* This section is not documented in the krb5.conf manpage,
|
|
but the Fermi example uses it. *)
|
|
@@ -152,11 +162,12 @@ let kdc =
|
|
let pam =
|
|
simple_section "pam" name_re
|
|
|
|
-let includes = Build.key_value_line /include(dir)?/ Sep.space (store Rx.fspath)
|
|
+let includes = Build.key_value_line include_re Sep.space (store Rx.fspath)
|
|
+let include_lines = includes . (comment|empty)*
|
|
|
|
-let lns = (comment|empty|includes)* .
|
|
+let lns = (comment|empty)* .
|
|
(libdefaults|login|appdefaults|realms|domain_realm
|
|
- |logging|capaths|dbdefaults|dbmodules|instance_mapping|kdc|pam)*
|
|
+ |logging|capaths|dbdefaults|dbmodules|instance_mapping|kdc|pam|include_lines)*
|
|
|
|
let filter = (incl "/etc/krb5.conf.d/*.conf")
|
|
. (incl "/etc/krb5.conf")
|
|
diff --git a/lenses/tests/test_krb5.aug b/lenses/tests/test_krb5.aug
|
|
index f746543b..10b87605 100644
|
|
--- a/lenses/tests/test_krb5.aug
|
|
+++ b/lenses/tests/test_krb5.aug
|
|
@@ -1029,7 +1029,7 @@ default_ccache_name = KEYRING:persistent:%{uid}\n" =
|
|
{ }
|
|
{ "default_ccache_name" = "KEYRING:persistent:%{uid}" } }
|
|
|
|
-(* Include(dir) test *)
|
|
+(* Include(dir) tests *)
|
|
let include_test = "include /etc/krb5.other_conf.d/other.conf
|
|
includedir /etc/krb5.conf.d/
|
|
"
|
|
@@ -1037,3 +1037,37 @@ includedir /etc/krb5.conf.d/
|
|
test Krb5.lns get include_test =
|
|
{ "include" = "/etc/krb5.other_conf.d/other.conf" }
|
|
{ "includedir" = "/etc/krb5.conf.d/" }
|
|
+
|
|
+let include2_test = "[logging]
|
|
+ default = FILE:/var/log/krb5libs.log
|
|
+
|
|
+include /etc/krb5.other_conf.d/other.conf
|
|
+
|
|
+includedir /etc/krb5.conf.d/
|
|
+"
|
|
+
|
|
+test Krb5.lns get include2_test =
|
|
+ { "logging"
|
|
+ { "default"
|
|
+ { "file" = "/var/log/krb5libs.log" } }
|
|
+ { }
|
|
+ }
|
|
+ { "include" = "/etc/krb5.other_conf.d/other.conf" }
|
|
+ { }
|
|
+ { "includedir" = "/etc/krb5.conf.d/" }
|
|
+
|
|
+(* [dbmodules] test *)
|
|
+let dbmodules_test = "[dbmodules]
|
|
+ ATHENA.MIT.EDU = {
|
|
+ disable_last_success = true
|
|
+ }
|
|
+ db_module_dir = /some/path
|
|
+"
|
|
+
|
|
+test Krb5.lns get dbmodules_test =
|
|
+ { "dbmodules"
|
|
+ { "realm" = "ATHENA.MIT.EDU"
|
|
+ { "disable_last_success" = "true" }
|
|
+ }
|
|
+ { "db_module_dir" = "/some/path" }
|
|
+ }
|
|
--
|
|
2.29.2
|
|
|