From faf60bc7b1cb727482a17de9a2483998763978c0 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 11:14:32 +0100
Subject: [PATCH] Slapd: revert Slapd module to 1.1.0-compatible, add Slapd_140
In order to keep the default sshd config lens compatible with 1.1.0,
the lens from 1.4.0 has been kept in the Slapd_140 module and is not
loaded by default. Use aug_transform, augtool --transform etc. to use
it instead of Slapd.
---
lenses/slapd.aug | 18 ++--
lenses/slapd_140.aug | 158 ++++++++++++++++++++++++++++++++
lenses/tests/test_slapd.aug | 55 +++--------
lenses/tests/test_slapd_140.aug | 94 +++++++++++++++++++
tests/Makefile.am | 1 +
5 files changed, 273 insertions(+), 53 deletions(-)
create mode 100644 lenses/slapd_140.aug
create mode 100644 lenses/tests/test_slapd_140.aug
diff --git a/lenses/slapd.aug b/lenses/slapd.aug
index e1195655..afe074b1 100644
--- a/lenses/slapd.aug
+++ b/lenses/slapd.aug
@@ -18,6 +18,7 @@ let sep = del /[ \t\n]+/ " "
let sto_to_eol = store /([^ \t\n].*[^ \t\n]|[^ \t\n])/
let sto_to_spc = store /[^\\# \t\n]+/
+let sto_to_by = store (/[^\\# \t\n]+/ - "by")
let comment = Util.comment
let empty = Util.empty
@@ -27,14 +28,12 @@ let empty = Util.empty
*************************************************************************)
let access_re = "access to"
-let control_re = "stop" | "continue" | "break"
-let what = [ spc . label "access"
- . store (/[^\\# \t\n]+/ - ("by" | control_re)) ]
+let who = [ spc . label "who" . sto_to_spc ]
+let what = [ spc . label "what" . sto_to_spc ]
(* TODO: parse the control field, see man slapd.access (5) *)
-let control = [ spc . label "control" . store control_re ]
-let by = [ sep . key "by" . spc . sto_to_spc
- . what? . control? ]
+let control = [ spc . label "control" . sto_to_by ]
+let by = [ sep . key "by". who . what. control? ]
let access = [ key access_re . spc. sto_to_spc . by+ . eol ]
@@ -134,21 +133,18 @@ let database_re = "suffix"
| "restrict"
| "rootdn"
| "rootpw"
+ | "suffix"
| "subordinate"
| "syncrepl rid"
| "updatedn"
| "updateref"
| database_hdb
-let database_entry =
- let val = Quote.double_opt
- in Build.key_value_line database_re Sep.space val
-
let database = [ key "database"
. spc
. sto_to_eol
. eol
- . (comment|empty|database_entry|access)* ]
+ . (comment|empty|Build.key_ws_value database_re|access)* ]
(************************************************************************
* LENS
diff --git a/lenses/slapd_140.aug b/lenses/slapd_140.aug
new file mode 100644
index 00000000..8d1cd074
--- /dev/null
+++ b/lenses/slapd_140.aug
@@ -0,0 +1,158 @@
+(* Slapd module for Augeas
+ This module is compatible with Augeas 1.4.0, but is not loaded by default.
+
+ Author: Free Ekanayaka <free@64studio.com>
+
+ Reference: man slapd.conf(5), man slapd.access (5)
+
+*)
+
+module Slapd_140 =
+
+(************************************************************************
+ * USEFUL PRIMITIVES
+ *************************************************************************)
+
+let eol = Util.eol
+let spc = Util.del_ws_spc
+let sep = del /[ \t\n]+/ " "
+
+let sto_to_eol = store /([^ \t\n].*[^ \t\n]|[^ \t\n])/
+let sto_to_spc = store /[^\\# \t\n]+/
+
+let comment = Util.comment
+let empty = Util.empty
+
+(************************************************************************
+ * ACCESS TO
+ *************************************************************************)
+
+let access_re = "access to"
+let control_re = "stop" | "continue" | "break"
+let what = [ spc . label "access"
+ . store (/[^\\# \t\n]+/ - ("by" | control_re)) ]
+
+(* TODO: parse the control field, see man slapd.access (5) *)
+let control = [ spc . label "control" . store control_re ]
+let by = [ sep . key "by" . spc . sto_to_spc
+ . what? . control? ]
+
+let access = [ key access_re . spc. sto_to_spc . by+ . eol ]
+
+(************************************************************************
+ * GLOBAL
+ *************************************************************************)
+
+(* TODO: parse special field separately, see man slapd.conf (5) *)
+let global_re = "allow"
+ | "argsfile"
+ | "attributeoptions"
+ | "attributetype"
+ | "authz-policy"
+ | "ldap"
+ | "dn"
+ | "concurrency"
+ | "cron_max_pending"
+ | "conn_max_pending_auth"
+ | "defaultsearchbase"
+ | "disallow"
+ | "ditcontentrule"
+ | "gentlehup"
+ | "idletimeout"
+ | "include"
+ | "index_substr_if_minlen"
+ | "index_substr_if_maxlen"
+ | "index_substr_any_len"
+ | "index_substr_any_step"
+ | "localSSF"
+ | "loglevel"
+ | "moduleload"
+ | "modulepath"
+ | "objectclass"
+ | "objectidentifier"
+ | "password-hash"
+ | "password-crypt-salt-format"
+ | "pidfile"
+ | "referral"
+ | "replica-argsfile"
+ | "replica-pidfile"
+ | "replicationinterval"
+ | "require"
+ | "reverse-lookup"
+ | "rootDSE"
+ | "sasl-host "
+ | "sasl-realm"
+ | "sasl-secprops"
+ | "schemadn"
+ | "security"
+ | "sizelimit"
+ | "sockbuf_max_incoming "
+ | "sockbuf_max_incoming_auth"
+ | "threads"
+ | "timelimit time"
+ | "tool-threads"
+ | "TLSCipherSuite"
+ | "TLSCACertificateFile"
+ | "TLSCACertificatePath"
+ | "TLSCertificateFile"
+ | "TLSCertificateKeyFile"
+ | "TLSDHParamFile"
+ | "TLSRandFile"
+ | "TLSVerifyClient"
+ | "TLSCRLCheck"
+ | "backend"
+
+let global = Build.key_ws_value global_re
+
+(************************************************************************
+ * DATABASE
+ *************************************************************************)
+
+(* TODO: support all types of database backend *)
+let database_hdb = "cachesize"
+ | "cachefree"
+ | "checkpoint"
+ | "dbconfig"
+ | "dbnosync"
+ | "directory"
+ | "dirtyread"
+ | "idlcachesize"
+ | "index"
+ | "linearindex"
+ | "lockdetect"
+ | "mode"
+ | "searchstack"
+ | "shm_key"
+
+let database_re = "suffix"
+ | "lastmod"
+ | "limits"
+ | "maxderefdepth"
+ | "overlay"
+ | "readonly"
+ | "replica uri"
+ | "replogfile"
+ | "restrict"
+ | "rootdn"
+ | "rootpw"
+ | "subordinate"
+ | "syncrepl rid"
+ | "updatedn"
+ | "updateref"
+ | database_hdb
+
+let database_entry =
+ let val = Quote.double_opt
+ in Build.key_value_line database_re Sep.space val
+
+let database = [ key "database"
+ . spc
+ . sto_to_eol
+ . eol
+ . (comment|empty|database_entry|access)* ]
+
+(************************************************************************
+ * LENS
+ *************************************************************************)
+
+let lns = (comment|empty|global|access)* . (database)*
diff --git a/lenses/tests/test_slapd.aug b/lenses/tests/test_slapd.aug
index a4bbb4e9..e477342a 100644
--- a/lenses/tests/test_slapd.aug
+++ b/lenses/tests/test_slapd.aug
@@ -48,47 +48,18 @@ test Slapd.lns get conf =
{ "database" = "hdb"
{}
{ "#comment" = "The base of your directory in database #1" }
- { "suffix" = "dc=nodomain" }
+ { "suffix" = "\"dc=nodomain\"" }
{}
{ "access to" = "attrs=userPassword,shadowLastChange"
- { "by" = "dn=\"cn=admin,dc=nodomain\""
- { "access" = "write" } }
- { "by" = "anonymous"
- { "access" = "auth" } }
- { "by" = "self"
- { "access" = "write" } }
- { "by" = "*"
- { "access" = "none" } } } }
-
-(* Test: Slapd.lns
- Full access test with who/access/control *)
-test Slapd.lns get "access to dn.subtree=\"dc=example,dc=com\"
- by self write stop\n" =
- { "access to" = "dn.subtree=\"dc=example,dc=com\""
- { "by" = "self"
- { "access" = "write" }
- { "control" = "stop" } } }
-
-(* Test: Slapd.lns
- access test with who *)
-test Slapd.lns get "access to dn.subtree=\"dc=example,dc=com\"
- by self\n" =
- { "access to" = "dn.subtree=\"dc=example,dc=com\""
- { "by" = "self" } }
-
-(* Test: Slapd.lns
- access test with who/access *)
-test Slapd.lns get "access to dn.subtree=\"dc=example,dc=com\"
- by self write\n" =
- { "access to" = "dn.subtree=\"dc=example,dc=com\""
- { "by" = "self"
- { "access" = "write" } } }
-
-(* Test: Slapd.lns
- access test with who/control *)
-test Slapd.lns get "access to dn.subtree=\"dc=example,dc=com\"
- by self stop\n" =
- { "access to" = "dn.subtree=\"dc=example,dc=com\""
- { "by" = "self"
- { "control" = "stop" } } }
-
+ { "by"
+ { "who" = "dn=\"cn=admin,dc=nodomain\"" }
+ { "what" = "write" } }
+ { "by"
+ { "who" = "anonymous" }
+ { "what" = "auth" } }
+ { "by"
+ { "who" = "self" }
+ { "what" = "write" } }
+ { "by"
+ { "who" = "*" }
+ { "what" = "none" } } } }
diff --git a/lenses/tests/test_slapd_140.aug b/lenses/tests/test_slapd_140.aug
new file mode 100644
index 00000000..0118f030
--- /dev/null
+++ b/lenses/tests/test_slapd_140.aug
@@ -0,0 +1,94 @@
+module Test_slapd_140 =
+
+let conf = "# This is the main slapd configuration file. See slapd.conf(5) for more
+# info on the configuration options.
+
+#######################################################################
+# Global Directives:
+
+# Features to permit
+#allow bind_v2
+
+# Schema and objectClass definitions
+include /etc/ldap/schema/core.schema
+
+#######################################################################
+# Specific Directives for database #1, of type hdb:
+# Database specific directives apply to this databasse until another
+# 'database' directive occurs
+database hdb
+
+# The base of your directory in database #1
+suffix \"dc=nodomain\"
+
+access to attrs=userPassword,shadowLastChange
+ by dn=\"cn=admin,dc=nodomain\" write
+ by anonymous auth
+ by self write
+ by * none
+"
+
+test Slapd_140.lns get conf =
+ { "#comment" = "This is the main slapd configuration file. See slapd.conf(5) for more" }
+ { "#comment" = "info on the configuration options." }
+ {}
+ { "#comment" = "######################################################################" }
+ { "#comment" = "Global Directives:"}
+ {}
+ { "#comment" = "Features to permit" }
+ { "#comment" = "allow bind_v2" }
+ {}
+ { "#comment" = "Schema and objectClass definitions" }
+ { "include" = "/etc/ldap/schema/core.schema" }
+ {}
+ { "#comment" = "######################################################################" }
+ { "#comment" = "Specific Directives for database #1, of type hdb:" }
+ { "#comment" = "Database specific directives apply to this databasse until another" }
+ { "#comment" = "'database' directive occurs" }
+ { "database" = "hdb"
+ {}
+ { "#comment" = "The base of your directory in database #1" }
+ { "suffix" = "dc=nodomain" }
+ {}
+ { "access to" = "attrs=userPassword,shadowLastChange"
+ { "by" = "dn=\"cn=admin,dc=nodomain\""
+ { "access" = "write" } }
+ { "by" = "anonymous"
+ { "access" = "auth" } }
+ { "by" = "self"
+ { "access" = "write" } }
+ { "by" = "*"
+ { "access" = "none" } } } }
+
+(* Test: Slapd_140.lns
+ Full access test with who/access/control *)
+test Slapd_140.lns get "access to dn.subtree=\"dc=example,dc=com\"
+ by self write stop\n" =
+ { "access to" = "dn.subtree=\"dc=example,dc=com\""
+ { "by" = "self"
+ { "access" = "write" }
+ { "control" = "stop" } } }
+
+(* Test: Slapd_140.lns
+ access test with who *)
+test Slapd_140.lns get "access to dn.subtree=\"dc=example,dc=com\"
+ by self\n" =
+ { "access to" = "dn.subtree=\"dc=example,dc=com\""
+ { "by" = "self" } }
+
+(* Test: Slapd_140.lns
+ access test with who/access *)
+test Slapd_140.lns get "access to dn.subtree=\"dc=example,dc=com\"
+ by self write\n" =
+ { "access to" = "dn.subtree=\"dc=example,dc=com\""
+ { "by" = "self"
+ { "access" = "write" } } }
+
+(* Test: Slapd_140.lns
+ access test with who/control *)
+test Slapd_140.lns get "access to dn.subtree=\"dc=example,dc=com\"
+ by self stop\n" =
+ { "access to" = "dn.subtree=\"dc=example,dc=com\""
+ { "by" = "self"
+ { "control" = "stop" } } }
+
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 315cac9c..65d8993e 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -182,6 +182,7 @@ lens_tests = \
lens-simplevars.sh \
lens-sip_conf.sh \
lens-slapd.sh \
+ lens-slapd_140.sh \
lens-smbusers.sh \
lens-solaris_system.sh \
lens-soma.sh \
--
2.24.1