|
Packit Service |
a2ae7a |
module Krb5 =
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
autoload xfm
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let comment = Inifile.comment IniFile.comment_re "#"
|
|
Packit Service |
a2ae7a |
let empty = Inifile.empty
|
|
Packit Service |
a2ae7a |
let eol = Inifile.eol
|
|
Packit Service |
a2ae7a |
let dels = Util.del_str
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let indent = del /[ \t]*/ ""
|
|
Packit Service |
a2ae7a |
let comma_or_space_sep = del /[ \t,]{1,}/ " "
|
|
Packit Service |
a2ae7a |
let eq = del /[ \t]*=[ \t]*/ " = "
|
|
Packit Service |
a2ae7a |
let eq_openbr = del /[ \t]*=[ \t\n]*\{[ \t]*\n/ " = {\n"
|
|
Packit Service |
a2ae7a |
let closebr = del /[ \t]*\}/ "}"
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
(* These two regexps for realms and apps are not entirely true
|
|
Packit Service |
a2ae7a |
- strictly speaking, there's no requirement that a realm is all upper case
|
|
Packit Service |
a2ae7a |
and an application only uses lowercase. But it's what's used in practice.
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
Without that distinction we couldn't distinguish between applications
|
|
Packit Service |
a2ae7a |
and realms in the [appdefaults] section.
|
|
Packit Service |
a2ae7a |
*)
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let realm_re = /[A-Z0-9][.a-zA-Z0-9-]*/
|
|
Packit Service |
a2ae7a |
let realm_anycase_re = /[A-Za-z0-9][.a-zA-Z0-9-]*/
|
|
Packit Service |
a2ae7a |
let app_re = /[a-z][a-zA-Z0-9_]*/
|
|
Packit Service |
06d1be |
let name_re = /[.a-zA-Z0-9_-]+/
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let value_br = store /[^;# \t\r\n{}]+/
|
|
Packit Service |
a2ae7a |
let value = store /[^;# \t\r\n]+/
|
|
Packit Service |
a2ae7a |
let entry (kw:regexp) (sep:lens) (value:lens) (comment:lens)
|
|
Packit Service |
a2ae7a |
= [ indent . key kw . sep . value . (comment|eol) ] | comment
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let subsec_entry (kw:regexp) (sep:lens) (comment:lens)
|
|
Packit Service |
a2ae7a |
= ( entry kw sep value_br comment ) | empty
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let simple_section (n:string) (k:regexp) =
|
|
Packit Service |
a2ae7a |
let title = Inifile.indented_title n in
|
|
Packit Service |
a2ae7a |
let entry = entry k eq value comment in
|
|
Packit Service |
a2ae7a |
Inifile.record title entry
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let record (t:string) (e:lens) =
|
|
Packit Service |
a2ae7a |
let title = Inifile.indented_title t in
|
|
Packit Service |
a2ae7a |
Inifile.record title e
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let v4_name_convert (subsec:lens) = [ indent . key "v4_name_convert" .
|
|
Packit Service |
a2ae7a |
eq_openbr . subsec* . closebr . eol ]
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
(*
|
|
Packit Service |
a2ae7a |
For the enctypes this appears to be a list of the valid entries:
|
|
Packit Service |
a2ae7a |
c4-hmac arcfour-hmac aes128-cts rc4-hmac
|
|
Packit Service |
a2ae7a |
arcfour-hmac-md5 des3-cbc-sha1 des-cbc-md5 des-cbc-crc
|
|
Packit Service |
a2ae7a |
*)
|
|
Packit Service |
a2ae7a |
let enctype_re = /[a-zA-Z0-9-]{3,}/
|
|
Packit Service |
a2ae7a |
let enctypes = /permitted_enctypes|default_tgs_enctypes|default_tkt_enctypes/i
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
(* An #eol label prevents ambiguity between "k = v1 v2" and "k = v1\n k = v2" *)
|
|
Packit Service |
a2ae7a |
let enctype_list (nr:regexp) (ns:string) =
|
|
Packit Service |
a2ae7a |
indent . del nr ns . eq
|
|
Packit Service |
a2ae7a |
. Build.opt_list [ label ns . store enctype_re ] comma_or_space_sep
|
|
Packit Service |
a2ae7a |
. (comment|eol) . [ label "#eol" ]
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let libdefaults =
|
|
Packit Service |
a2ae7a |
let option = entry (name_re - ("v4_name_convert" |enctypes)) eq value comment in
|
|
Packit Service |
a2ae7a |
let enctype_lists = enctype_list /permitted_enctypes/i "permitted_enctypes"
|
|
Packit Service |
a2ae7a |
| enctype_list /default_tgs_enctypes/i "default_tgs_enctypes"
|
|
Packit Service |
a2ae7a |
| enctype_list /default_tkt_enctypes/i "default_tkt_enctypes" in
|
|
Packit Service |
a2ae7a |
let subsec = [ indent . key /host|plain/ . eq_openbr .
|
|
Packit Service |
a2ae7a |
(subsec_entry name_re eq comment)* . closebr . eol ] in
|
|
Packit Service |
a2ae7a |
record "libdefaults" (option|enctype_lists|v4_name_convert subsec)
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let login =
|
|
Packit Service |
a2ae7a |
let keys = /krb[45]_get_tickets|krb4_convert|krb_run_aklog/
|
|
Packit Service |
a2ae7a |
|/aklog_path|accept_passwd/ in
|
|
Packit Service |
a2ae7a |
simple_section "login" keys
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let appdefaults =
|
|
Packit Service |
a2ae7a |
let option = entry (name_re - ("realm" | "application")) eq value_br comment in
|
|
Packit Service |
a2ae7a |
let realm = [ indent . label "realm" . store realm_re .
|
|
Packit Service |
a2ae7a |
eq_openbr . (option|empty)* . closebr . eol ] in
|
|
Packit Service |
a2ae7a |
let app = [ indent . label "application" . store app_re .
|
|
Packit Service |
a2ae7a |
eq_openbr . (realm|option|empty)* . closebr . eol] in
|
|
Packit Service |
a2ae7a |
record "appdefaults" (option|realm|app)
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let realms =
|
|
Packit Service |
a2ae7a |
let simple_option = /kdc|admin_server|database_module|default_domain/
|
|
Packit Service |
a2ae7a |
|/v4_realm|auth_to_local(_names)?|master_kdc|kpasswd_server/
|
|
Packit Service |
a2ae7a |
|/admin_server|ticket_lifetime|pkinit_(anchors|identities|identity|pool)/
|
|
Packit Service |
a2ae7a |
|/krb524_server/ in
|
|
Packit Service |
a2ae7a |
let subsec_option = /v4_instance_convert/ in
|
|
Packit Service |
a2ae7a |
let option = subsec_entry simple_option eq comment in
|
|
Packit Service |
a2ae7a |
let subsec = [ indent . key subsec_option . eq_openbr .
|
|
Packit Service |
a2ae7a |
(subsec_entry name_re eq comment)* . closebr . eol ] in
|
|
Packit Service |
a2ae7a |
let v4subsec = [ indent . key /host|plain/ . eq_openbr .
|
|
Packit Service |
a2ae7a |
(subsec_entry name_re eq comment)* . closebr . eol ] in
|
|
Packit Service |
a2ae7a |
let realm = [ indent . label "realm" . store realm_anycase_re .
|
|
Packit Service |
a2ae7a |
eq_openbr . (option|subsec|(v4_name_convert v4subsec))* .
|
|
Packit Service |
a2ae7a |
closebr . eol ] in
|
|
Packit Service |
a2ae7a |
record "realms" (realm|comment)
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let domain_realm =
|
|
Packit Service |
a2ae7a |
simple_section "domain_realm" name_re
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let logging =
|
|
Packit Service |
a2ae7a |
let keys = /kdc|admin_server|default/ in
|
|
Packit Service |
a2ae7a |
let xchg (m:regexp) (d:string) (l:string) =
|
|
Packit Service |
a2ae7a |
del m d . label l in
|
|
Packit Service |
a2ae7a |
let xchgs (m:string) (l:string) = xchg m m l in
|
|
Packit Service |
a2ae7a |
let dest =
|
|
Packit Service |
a2ae7a |
[ xchg /FILE[=:]/ "FILE=" "file" . value ]
|
|
Packit Service |
a2ae7a |
|[ xchgs "STDERR" "stderr" ]
|
|
Packit Service |
a2ae7a |
|[ xchgs "CONSOLE" "console" ]
|
|
Packit Service |
a2ae7a |
|[ xchgs "DEVICE=" "device" . value ]
|
|
Packit Service |
a2ae7a |
|[ xchgs "SYSLOG" "syslog" .
|
|
Packit Service |
a2ae7a |
([ xchgs ":" "severity" . store /[A-Za-z0-9]+/ ].
|
|
Packit Service |
a2ae7a |
[ xchgs ":" "facility" . store /[A-Za-z0-9]+/ ]?)? ] in
|
|
Packit Service |
a2ae7a |
let entry = [ indent . key keys . eq . dest . (comment|eol) ] | comment in
|
|
Packit Service |
a2ae7a |
record "logging" entry
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let capaths =
|
|
Packit Service |
a2ae7a |
let realm = [ indent . key realm_re .
|
|
Packit Service |
a2ae7a |
eq_openbr .
|
|
Packit Service |
a2ae7a |
(entry realm_re eq value_br comment)* . closebr . eol ] in
|
|
Packit Service |
a2ae7a |
record "capaths" (realm|comment)
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let dbdefaults =
|
|
Packit Service |
a2ae7a |
let keys = /database_module|ldap_kerberos_container_dn|ldap_kdc_dn/
|
|
Packit Service |
a2ae7a |
|/ldap_kadmind_dn|ldap_service_password_file|ldap_servers/
|
|
Packit Service |
a2ae7a |
|/ldap_conns_per_server/ in
|
|
Packit Service |
a2ae7a |
simple_section "dbdefaults" keys
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let dbmodules =
|
|
Packit Service |
06d1be |
let keys = /db_library|ldap_kerberos_container_dn|ldap_kdc_dn/
|
|
Packit Service |
06d1be |
|/ldap_kadmind_dn|ldap_service_password_file|ldap_servers/
|
|
Packit Service |
06d1be |
|/ldap_conns_per_server/ in
|
|
Packit Service |
06d1be |
simple_section "dbmodules" keys
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
(* This section is not documented in the krb5.conf manpage,
|
|
Packit Service |
a2ae7a |
but the Fermi example uses it. *)
|
|
Packit Service |
a2ae7a |
let instance_mapping =
|
|
Packit Service |
a2ae7a |
let value = dels "\"" . store /[^;# \t\r\n{}]*/ . dels "\"" in
|
|
Packit Service |
a2ae7a |
let map_node = label "mapping" . store /[a-zA-Z0-9\/*]+/ in
|
|
Packit Service |
a2ae7a |
let mapping = [ indent . map_node . eq .
|
|
Packit Service |
a2ae7a |
[ label "value" . value ] . (comment|eol) ] in
|
|
Packit Service |
a2ae7a |
let instance = [ indent . key name_re .
|
|
Packit Service |
a2ae7a |
eq_openbr . (mapping|comment)* . closebr . eol ] in
|
|
Packit Service |
a2ae7a |
record "instancemapping" instance
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let kdc =
|
|
Packit Service |
a2ae7a |
simple_section "kdc" /profile/
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let pam =
|
|
Packit Service |
a2ae7a |
simple_section "pam" name_re
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
06d1be |
let includes = Build.key_value_line /include(dir)?/ Sep.space (store Rx.fspath)
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
06d1be |
let lns = (comment|empty|includes)* .
|
|
Packit Service |
a2ae7a |
(libdefaults|login|appdefaults|realms|domain_realm
|
|
Packit Service |
06d1be |
|logging|capaths|dbdefaults|dbmodules|instance_mapping|kdc|pam)*
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let filter = (incl "/etc/krb5.conf.d/*.conf")
|
|
Packit Service |
a2ae7a |
. (incl "/etc/krb5.conf")
|
|
Packit Service |
a2ae7a |
|
|
Packit Service |
a2ae7a |
let xfm = transform lns filter
|