base/SOURCES/0006-Sshd-revert-Sshd-module-to-1.1.0-compatible-add-Sshd.patch

From 1c936bb38d39b238001364e1a7ee5479bdfff053 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 11:01:57 +0100
Subject: [PATCH] Sshd: revert Sshd module to 1.1.0-compatible, add Sshd_140

In order to keep the default sshd config lens compatible with 1.1.0,
the lens from 1.4.0 has been kept in the Sshd_140 module and is not
loaded by default.  Use aug_transform, augtool --transform etc. to use
it instead of Sshd.
---
 lenses/sshd.aug                |  52 ++++++---------
 lenses/sshd_140.aug            | 141 +++++++++++++++++++++++++++++++++++++++++
 lenses/tests/test_sshd.aug     |  56 ----------------
 lenses/tests/test_sshd_140.aug | 136 +++++++++++++++++++++++++++++++++++++++
 tests/Makefile.am              |   1 +
 5 files changed, 298 insertions(+), 88 deletions(-)
 create mode 100644 lenses/sshd_140.aug
 create mode 100644 lenses/tests/test_sshd_140.aug

diff --git a/lenses/sshd.aug b/lenses/sshd.aug
index 55f6c4f7..785102ec 100644
--- a/lenses/sshd.aug
+++ b/lenses/sshd.aug
@@ -70,55 +70,41 @@ module Sshd =

    let sep = Util.del_ws_spc

-   let indent = del /[ \t]*/ "  "
-
    let key_re = /[A-Za-z0-9]+/
-         - /MACs|Match|AcceptEnv|Subsystem|Ciphers|KexAlgorithms|(Allow|Deny)(Groups|Users)/i
+         - /MACs|Match|AcceptEnv|Subsystem|(Allow|Deny)(Groups|Users)/

    let comment = Util.comment
-   let comment_noindent = Util.comment_noindent
    let empty = Util.empty

-   let array_entry (kw:regexp) (sq:string) =
+   let array_entry (k:string) =
      let value = store /[^ \t\n]+/ in
-     [ key kw . [ sep . seq sq . value]* . eol ]
+     [ key k . [ sep . seq k . value]* . eol ]

    let other_entry =
      let value = store /[^ \t\n]+([ \t]+[^ \t\n]+)*/ in
      [ key key_re . sep . value . eol ]

-   let accept_env = array_entry /AcceptEnv/i "AcceptEnv"
+   let accept_env = array_entry "AcceptEnv"

-   let allow_groups = array_entry /AllowGroups/i "AllowGroups"
-   let allow_users = array_entry /AllowUsers/i "AllowUsers"
-   let deny_groups = array_entry /DenyGroups/i "DenyGroups"
-   let deny_users = array_entry /DenyUsers/i "DenyUsers"
+   let allow_groups = array_entry "AllowGroups"
+   let allow_users = array_entry "AllowUsers"
+   let deny_groups = array_entry "DenyGroups"
+   let deny_users = array_entry "DenyUsers"

    let subsystemvalue =
      let value = store (/[^ \t\n](.*[^ \t\n])?/) in
      [ key /[A-Za-z0-9\-]+/ . sep . value . eol ]

    let subsystem =
-     [ key /Subsystem/i .  sep .  subsystemvalue ]
+     [ key "Subsystem" .  sep .  subsystemvalue ]

-   let list (kw:regexp) (sq:string) =
-     let value = store /[^, \t\n]+/ in
-     [ key kw . sep .
-         [ seq sq . value ] .
-         ([ seq sq . Util.del_str "," . value])* .
+   let macs =
+     let mac_value = store /[^, \t\n]+/ in
+     [ key "MACs" . sep .
+         [ seq "macs" . mac_value ] .
+         ([ seq "macs" . Util.del_str "," . mac_value])* .
          eol ]

-   let macs = list /MACs/i "MACs"
-
-   let ciphers = list /Ciphers/i "Ciphers"
-
-   let kexalgorithms = list /KexAlgorithms/i "KexAlgorithms"
-
-   let entry = accept_env | allow_groups | allow_users
-             | deny_groups | subsystem | deny_users
-             | macs | ciphers | kexalgorithms
-             | other_entry
-
    let condition_entry =
     let value = store  /[^ \t\n]+/ in
     [ sep . key /[A-Za-z0-9]+/ . sep . value ]
@@ -126,15 +112,17 @@ module Sshd =
    let match_cond =
      [ label "Condition" . condition_entry+ . eol ]

-   let match_entry = indent . (entry | comment_noindent)
-                   | empty
+   let match_entry =
+     ( comment | empty | (Util.indent . other_entry) )

    let match =
-     [ key /Match/i . match_cond
+     [ key "Match" . match_cond
         . [ label "Settings" .  match_entry+ ]
      ]

-  let lns = (entry | comment | empty)* . match*
+  let lns = (comment | empty | accept_env | allow_groups | allow_users
+          | deny_groups | subsystem | deny_users | macs
+          | other_entry ) * . match*

   let xfm = transform lns (incl "/etc/ssh/sshd_config")

diff --git a/lenses/sshd_140.aug b/lenses/sshd_140.aug
new file mode 100644
index 00000000..8a7f176f
--- /dev/null
+++ b/lenses/sshd_140.aug
@@ -0,0 +1,141 @@
+(*
+Module: Sshd_140
+  Parses /etc/ssh/sshd_config
+
+  This module is compatible with Augeas 1.4.0, but is not loaded by default.
+
+Author: David Lutterkort lutter@redhat.com
+        Dominique Dumont dominique.dumont@hp.com
+
+About: Reference
+  sshd_config man page.
+  See http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5
+
+About: License
+  This file is licensed under the LGPL v2+.
+
+About: Lens Usage
+  Sample usage of this lens in augtool:
+
+    * Get your current setup
+      > print /files/etc/ssh/sshd_config
+      ...
+
+    * Set X11Forwarding to "no"
+      > set /files/etc/ssh/sshd_config/X11Forwarding "no"
+
+  More advanced usage:
+
+    * Set a Match section
+      > set /files/etc/ssh/sshd_config/Match[1]/Condition/User "foo"
+      > set /files/etc/ssh/sshd_config/Match[1]/Settings/X11Forwarding "yes"
+
+  Saving your file:
+
+      > save
+
+
+About: CAVEATS
+
+  In sshd_config, Match blocks must be located at the end of the file.
+  This means that any new "global" parameters (i.e. outside of a Match
+  block) must be written before the first Match block. By default,
+  Augeas will write new parameters at the end of the file.
+
+  I.e. if you have a Match section and no ChrootDirectory parameter,
+  this command:
+
+     > set /files/etc/ssh/sshd_config/ChrootDirectory "foo"
+
+  will be stored in a new node after the Match section and Augeas will
+  refuse to save sshd_config file.
+
+  To create a new parameter as the right place, you must first create
+  a new Augeas node before the Match section:
+
+     > ins ChrootDirectory before /files/etc/ssh/sshd_config/Match
+
+  Then, you can set the parameter
+
+     > set /files/etc/ssh/sshd_config/ChrootDirectory "foo"
+
+
+About: Configuration files
+  This lens applies to /etc/ssh/sshd_config
+
+*)
+
+module Sshd_140 =
+   let eol = del /[ \t]*\n/ "\n"
+
+   let sep = Util.del_ws_spc
+
+   let indent = del /[ \t]*/ "  "
+
+   let key_re = /[A-Za-z0-9]+/
+         - /MACs|Match|AcceptEnv|Subsystem|Ciphers|KexAlgorithms|(Allow|Deny)(Groups|Users)/i
+
+   let comment = Util.comment
+   let comment_noindent = Util.comment_noindent
+   let empty = Util.empty
+
+   let array_entry (kw:regexp) (sq:string) =
+     let value = store /[^ \t\n]+/ in
+     [ key kw . [ sep . seq sq . value]* . eol ]
+
+   let other_entry =
+     let value = store /[^ \t\n]+([ \t]+[^ \t\n]+)*/ in
+     [ key key_re . sep . value . eol ]
+
+   let accept_env = array_entry /AcceptEnv/i "AcceptEnv"
+
+   let allow_groups = array_entry /AllowGroups/i "AllowGroups"
+   let allow_users = array_entry /AllowUsers/i "AllowUsers"
+   let deny_groups = array_entry /DenyGroups/i "DenyGroups"
+   let deny_users = array_entry /DenyUsers/i "DenyUsers"
+
+   let subsystemvalue =
+     let value = store (/[^ \t\n](.*[^ \t\n])?/) in
+     [ key /[A-Za-z0-9\-]+/ . sep . value . eol ]
+
+   let subsystem =
+     [ key /Subsystem/i .  sep .  subsystemvalue ]
+
+   let list (kw:regexp) (sq:string) =
+     let value = store /[^, \t\n]+/ in
+     [ key kw . sep .
+         [ seq sq . value ] .
+         ([ seq sq . Util.del_str "," . value])* .
+         eol ]
+
+   let macs = list /MACs/i "MACs"
+
+   let ciphers = list /Ciphers/i "Ciphers"
+
+   let kexalgorithms = list /KexAlgorithms/i "KexAlgorithms"
+
+   let entry = accept_env | allow_groups | allow_users
+             | deny_groups | subsystem | deny_users
+             | macs | ciphers | kexalgorithms
+             | other_entry
+
+   let condition_entry =
+    let value = store  /[^ \t\n]+/ in
+    [ sep . key /[A-Za-z0-9]+/ . sep . value ]
+
+   let match_cond =
+     [ label "Condition" . condition_entry+ . eol ]
+
+   let match_entry = indent . (entry | comment_noindent)
+                   | empty
+
+   let match =
+     [ key /Match/i . match_cond
+        . [ label "Settings" .  match_entry+ ]
+     ]
+
+  let lns = (entry | comment | empty)* . match*
+
+(* Local Variables: *)
+(* mode: caml       *)
+(* End:             *)
diff --git a/lenses/tests/test_sshd.aug b/lenses/tests/test_sshd.aug
index 5954e16f..788a12f0 100644
--- a/lenses/tests/test_sshd.aug
+++ b/lenses/tests/test_sshd.aug
@@ -1,4 +1,3 @@
-(* Module: Test_sshd *)
 module Test_sshd =

   let accept_env = "Protocol 2
@@ -75,61 +74,6 @@ Match User sarko Group pres.*
 Match User bush Group pres.* Host white.house.*
 Banner /etc/welcome.txt\n"

-(* Test: Sshd.lns
-   Indent when adding to a Match group *)
-  test Sshd.lns put match_blocks after
-    set "Match[1]/Settings/PermitRootLogin" "yes";
-    set "Match[1]/Settings/#comment" "a comment" =
-"X11Forwarding yes
-Match User sarko Group pres.*
-  Banner /etc/bienvenue.txt
-  X11Forwarding no
-  PermitRootLogin yes
-  # a comment
-Match User bush Group pres.* Host white.house.*
-Banner /etc/welcome.txt\n"
-
-
-(* Test: Sshd.lns
-     Parse Ciphers and KexAlgorithms as lists (GH issue #69) *)
-test Sshd.lns get "Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
-KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1\n" =
-  { "Ciphers"
-    { "1" = "aes256-gcm@openssh.com" }
-    { "2" = "aes128-gcm@openssh.com" }
-    { "3" = "aes256-ctr" }
-    { "4" = "aes128-ctr" }
-  }
-  { "KexAlgorithms"
-    { "1" = "diffie-hellman-group-exchange-sha256" }
-    { "2" = "diffie-hellman-group14-sha1" }
-    { "3" = "diffie-hellman-group-exchange-sha1" }
-  }
-
-(* Test: Sshd.lns
-     Keys are case-insensitive *)
-test Sshd.lns get "ciPheRs aes256-gcm@openssh.com,aes128-ctr
-maTcH User foo
-  x11forwarding no\n" =
-  { "ciPheRs"
-    { "1" = "aes256-gcm@openssh.com" }
-    { "2" = "aes128-ctr" }
-  }
-  { "maTcH"
-    { "Condition"
-      { "User" = "foo" }
-    }
-    { "Settings"
-      { "x11forwarding" = "no" }
-    }
-  }
-
-(* Test: Sshd.lns
-     Allow AllowGroups in Match groups (GH issue #75) *)
-test Sshd.lns get "Match User foo
-AllowGroups users\n" =
-  { "Match" { "Condition" { "User" = "foo" } }
-    { "Settings" { "AllowGroups" { "1" = "users" } } } }

 (* Local Variables: *)
 (* mode: caml       *)
diff --git a/lenses/tests/test_sshd_140.aug b/lenses/tests/test_sshd_140.aug
new file mode 100644
index 00000000..056c53f9
--- /dev/null
+++ b/lenses/tests/test_sshd_140.aug
@@ -0,0 +1,136 @@
+(* Module: Test_sshd_140 *)
+module Test_sshd_140 =
+
+  let accept_env = "Protocol 2
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL\n"
+
+  test Sshd_140.lns get accept_env =
+    { "Protocol" = "2" }
+    { "AcceptEnv"
+        { "1" = "LC_PAPER" }
+        { "2" = "LC_NAME" }
+        { "3" = "LC_ADDRESS" }
+        { "4" = "LC_TELEPHONE" }
+        { "5" = "LC_MEASUREMENT" } }
+    { "AcceptEnv"
+        { "6" = "LC_IDENTIFICATION" }
+        { "7" = "LC_ALL" } }
+
+
+  test Sshd_140.lns get "HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key\n" =
+    { "HostKey" = "/etc/ssh/ssh_host_rsa_key" }
+    { "HostKey" = "/etc/ssh/ssh_host_dsa_key" }
+
+
+  test Sshd_140.lns put accept_env after
+      rm "AcceptEnv";
+      rm "AcceptEnv";
+      set "Protocol" "1.5";
+      set "X11Forwarding" "yes"
+   = "Protocol 1.5\nX11Forwarding yes\n"
+
+  test Sshd_140.lns get "AuthorizedKeysFile  %h/.ssh/authorized_keys\n" =
+    { "AuthorizedKeysFile" = "%h/.ssh/authorized_keys" }
+
+  test Sshd_140.lns get "Subsystem sftp /usr/lib/openssh/sftp-server\n" =
+    { "Subsystem"
+	{ "sftp" = "/usr/lib/openssh/sftp-server" } }
+
+  test Sshd_140.lns get "Subsystem sftp-test /usr/lib/openssh/sftp-server\n" =
+    { "Subsystem"
+	{ "sftp-test" = "/usr/lib/openssh/sftp-server" } }
+
+
+
+  let match_blocks = "X11Forwarding yes
+Match User sarko Group pres.*
+  Banner /etc/bienvenue.txt
+  X11Forwarding no
+Match User bush Group pres.* Host white.house.*
+Banner /etc/welcome.txt
+"
+  test Sshd_140.lns get match_blocks =
+    { "X11Forwarding" = "yes"}
+      { "Match"
+	  { "Condition" { "User" = "sarko"   }
+	                { "Group" = "pres.*" } }
+	  { "Settings"  { "Banner" = "/etc/bienvenue.txt" }
+       	                { "X11Forwarding" = "no" } } }
+      { "Match"
+	  { "Condition" { "User" = "bush"    }
+	                { "Group" = "pres.*" }
+	                { "Host"  = "white.house.*" } }
+	  { "Settings"  { "Banner" = "/etc/welcome.txt" } } }
+
+  test Sshd_140.lns put match_blocks after
+    insb "Subsystem" "/Match[1]";
+    set "/Subsystem/sftp" "/usr/libexec/openssh/sftp-server"
+  = "X11Forwarding yes
+Subsystem sftp /usr/libexec/openssh/sftp-server
+Match User sarko Group pres.*
+  Banner /etc/bienvenue.txt
+  X11Forwarding no
+Match User bush Group pres.* Host white.house.*
+Banner /etc/welcome.txt\n"
+
+(* Test: Sshd_140.lns
+   Indent when adding to a Match group *)
+  test Sshd_140.lns put match_blocks after
+    set "Match[1]/Settings/PermitRootLogin" "yes";
+    set "Match[1]/Settings/#comment" "a comment" =
+"X11Forwarding yes
+Match User sarko Group pres.*
+  Banner /etc/bienvenue.txt
+  X11Forwarding no
+  PermitRootLogin yes
+  # a comment
+Match User bush Group pres.* Host white.house.*
+Banner /etc/welcome.txt\n"
+
+
+(* Test: Sshd_140.lns
+     Parse Ciphers and KexAlgorithms as lists (GH issue #69) *)
+test Sshd_140.lns get "Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
+KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1\n" =
+  { "Ciphers"
+    { "1" = "aes256-gcm@openssh.com" }
+    { "2" = "aes128-gcm@openssh.com" }
+    { "3" = "aes256-ctr" }
+    { "4" = "aes128-ctr" }
+  }
+  { "KexAlgorithms"
+    { "1" = "diffie-hellman-group-exchange-sha256" }
+    { "2" = "diffie-hellman-group14-sha1" }
+    { "3" = "diffie-hellman-group-exchange-sha1" }
+  }
+
+(* Test: Sshd_140.lns
+     Keys are case-insensitive *)
+test Sshd_140.lns get "ciPheRs aes256-gcm@openssh.com,aes128-ctr
+maTcH User foo
+  x11forwarding no\n" =
+  { "ciPheRs"
+    { "1" = "aes256-gcm@openssh.com" }
+    { "2" = "aes128-ctr" }
+  }
+  { "maTcH"
+    { "Condition"
+      { "User" = "foo" }
+    }
+    { "Settings"
+      { "x11forwarding" = "no" }
+    }
+  }
+
+(* Test: Sshd_140.lns
+     Allow AllowGroups in Match groups (GH issue #75) *)
+test Sshd_140.lns get "Match User foo
+AllowGroups users\n" =
+  { "Match" { "Condition" { "User" = "foo" } }
+    { "Settings" { "AllowGroups" { "1" = "users" } } } }
+
+(* Local Variables: *)
+(* mode: caml       *)
+(* End:             *)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index b4563540..387ac7d2 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -189,6 +189,7 @@ lens_tests =			\
   lens-squid.sh			\
   lens-ssh.sh			\
   lens-sshd.sh			\
+  lens-sshd_140.sh			\
   lens-sssd.sh			\
   lens-stunnel.sh			\
   lens-subversion.sh		\
--
2.13.6