????
Your IP : 216.73.216.67
a
�jiƲ � @ s� d Z ddlmZmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddl mZ ddlmZ ddlmZ ddlmZ ddlZzddlmZ W n ey� ddlmZ Y n0 dd l m Z m Z dd
l m Z m!Z!m"Z"m#Z#m$Z$m%Z% dd l&m'Z' dd l(m)Z) dd
l*m+Z+ ddl,m-Z- ddl.m/Z/ ddl0m1Z1 ddl2m3Z3m4Z4 ddl5m6Z6m7Z7m8Z8m9Z9 ddl:m;Z; ddl<m=Z= e j>dk�r�ddl?Z?ndZ?ej@�r�eAZBdZCdZDe�EeF�ZGdd� ZHdd� ZId d � ZJd d � ZKd d!� ZLd"d#� ZMd$d%� ZNd&d'� ZOd(d)� ZPd*d+� ZQd,d-� ZRejSdddde$e%fd.d/�ZTd�d1d2�ZUd�d4d5�ZVd6d7� ZWd8d9� ZXd�d<d=�ZYd>d?� ZZd@dA� Z[dBdC� Z\dDdE� Z]dFdG� Z^dHdI� Z_dJdK� Z`e�adLejb�ZcdMdMdMdNdNdOdOdOdPdPdPdQdQdQdRdRdRdSdSdSdSdT�ZddUdV� Zed�dXdY�Zfd�d[d\�Zge6jhd]e6jid^iZjd_d`� Zkdadb� Zldcdd� Zmdedf� ZnG dgdh� dheo�ZpG didj� djep�ZqG dkdl� dlep�ZrG dmdn� dnep�ZsG dodp� dpep�Ztdqdr� Zud�dtdu�Zvd�dvdw�Zwd�dxdy�Zxd�dzd{�Zyd�d|d}�Zzd~d� Z{d�d�� Z|d�d�� Z}d�d�� Z~G d�d�� d��ZG d�d�� d�e�Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d��d�d��Z�d�d��d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e?du�r�G d�d�� d�e?j��Z�e�� j�Z�ne�Z�dS )�z
Various utility functions.
� )�absolute_import�print_functionN)� rdatatype)� DNSException)�NXDOMAIN)�AddrFormatError)�HTTPSConnection)�errors�messages)�DOMAIN_LEVEL_0� TLS_VERSIONS�TLS_VERSION_MINIMAL�TLS_VERSION_MAXIMAL�TLS_VERSION_DEFAULT_MIN�TLS_VERSION_DEFAULT_MAX)�is_ipa_client_configured)�_)� constants)�paths)�ipautil)� SSHPublicKey)�DN�RDN)�DNSName� DNSResolver�resolve�resolve_ip_addresses)� ScriptError)� Principal)� � z /var/lib/ipa-client/sysrestorez/etc/ipa/default.confc C s� t | ttf�r dd� | D �S t | t�r8dd� | �� D �S t | ttttt d �f�rT| S t | t
�rh| � d�S t | t j
tf�r�t
| �S tt| dd ��s�dS t| �� �S )Nc S s g | ] }t |��qS � ��json_serialize)�.0�or! r! �//usr/lib/python3.9/site-packages/ipalib/util.py�
<listcomp>\ � z"json_serialize.<locals>.<listcomp>c S s i | ]\}}|t |��qS r! r" )r$ �k�vr! r! r& �
<dictcomp>^ r( z"json_serialize.<locals>.<dictcomp>zutf-8�__json__� )�
isinstance�list�tuple�dict�items�int�bool�float�unicode�type�str�decode�decimalZDecimalr �callable�getattrr# r, )�objr! r! r& r# Z s
r# c
C sR zt | �stj| d��W n4 tjjyL } ztj|d��W Y d }~n
d }~0 0 d S )N��hostname)� exception)r r ZDNSNotARecordError�dnsr@ r ZDNSResolverError)Zfqdn�exr! r! r& �verify_host_resolvablek s
rC c C s` zt | tj� d}W n ty* d}Y n0 zt | tj� d}W n tyV d}Y n0 |p^|S )zX
Checks to see if given domain has SOA or NS record.
Returns True or False.
TF)r r �SOAr ZNS)�domainZsoa_record_foundZns_record_foundr! r! r& �has_soa_or_ns_recordt s
rF c C s� t � }| �d�}t|�dkrFt|d ��� |d< t|d ��� |d< nP| �d�}t|�dkr�t|d ��� |d< t|d ��� |d< nt| ��� |d< |S ) N�@r � rE r �name�\Zflatname)r1 �split�lenr6 �lower)rI �result�
componentsr! r! r& �normalize_name� s
rP c C s: d� | �� �} t| �d dks.t�d| �du r2dS dS dS )a�
Validate the incoming data as valid base64 data or not. This is only
used in the ipalib.Parameters module which expects ``data`` to be unicode.
The character set must only include of a-z, A-Z, 0-9, + or / and
be padded with = to be a length divisible by 4 (so only 0-2 =s are
allowed). Its length must be divisible by 4. Whitespace is
not significant so it is removed.
This doesn't guarantee we have a base64-encoded value, just that it
fits the base64 requirements.
r- � r z^[a-zA-Z0-9\+\/]+\={0,2}$NFT)�joinrK rL �re�match)�datar! r! r& �isvalid_base64� s �rV c C sJ d}| � d�}|dkr$d}| � d�}|dkrF| � d�}| || |� } | S )zM
Remove the header and footer (and surrounding material) from a CSR.
�( s' -----BEGIN NEW CERTIFICATE REQUEST-----����$ s# -----BEGIN CERTIFICATE REQUEST-----r s -----END)�find)ZcsrZ headerlen�s�er! r! r& �strip_csr_header� s
r] c C sX zt �t j| � W n@ t jyR zt �t j| � W n t jyL Y Y dS 0 Y n0 dS )zj
Check to see if the given IP address is a valid IPv4 or IPv6 address.
Returns True or False
FT)�socketZ inet_ptonZAF_INET�errorZAF_INET6)�ipaddrr! r! r& �validate_ipaddr� s ra c
C s� | du rt jtd�d��zLtj�| �rPt�| tj�sbt jtd�t| d� d��nt | d�}|�
� W n8 t t fy� } z t jt
|�d��W Y d}~n
d}~0 0 dS )zr
Determine if the file is writable. If the file doesn't exist then
open the file to test writability.
NzFilename is empty)�reasonzPermission denied: %(file)s��file�w)r Z FileErrorr �os�path�isfile�access�W_OKr1 �open�close�IOError�OSErrorr8 )�filename�fpr\ r! r! r& �check_writable_file� s
rq c C sJ | rt | t�s| S d| v rF| �d�\}}}|�dd�}d�|d|f�} | S )NrG �.z\.r- )r. r8 � partition�replacerR )�zonemgrrI Z_atrE r! r! r& �normalize_zonemgr� s rv c C s | d dkr| d S | S d S )NrX rr r! )�zoner! r! r& �normalize_zone� s rx c C s� | du r|du rdS | du r t } |du r,t}t�t �}zt�| �}W n" tyf tdj| d���Y n0 zt�|�}W n" ty� tdj|d���Y n0 ||kr�td��||k r�|}t�d| t| � ||k r�|}t�d|t| � t||d � S ) a
This function checks whether the given TLS versions are known in
IPA and that these versions fulfill the requirements for minimal
TLS version (see
`ipalib.constants: TLS_VERSIONS, TLS_VERSION_MINIMAL`).
:param tls_version_min:
the lower value in the TLS min-max span, raised to the lowest
allowed value if too low
:param tls_version_max:
the higher value in the TLS min-max span, raised to tls_version_min
if lower than TLS_VERSION_MINIMAL
:raises: ValueError
Nz5tls_version_min ('{val}') is not a known TLS version.)�valz5tls_version_max ('{val}') is not a known TLS version.z/tls_version_min is higher than tls_version_max.z5tls_version_min set too low ('%s'),using '%s' insteadz5tls_version_max set too low ('%s'),using '%s' insteadrH )r
r r �index�
ValueError�format�logger�warning)�tls_version_min�tls_version_maxZmin_allowed_idxZmin_version_idxZmax_version_idxr! r! r& �get_proper_tls_version_span� s@
� ���r� c K s� t jt jt jt jt jtt dd�d�} |du r4td��tj �
|�rNt� |tj �s^tdj
|d���t �t j�}
|
jt jt jB t jB t jB O _tjdur�|
�tj� t||�} | dur�tD ]4} | | v r�|
j| | M _q�|
j| | O _q�t|
dd�du�rd |
_t j|
_ d |
_ |
� |� |du�rx|du�rft |��}
|
� � }W d � n1 �sZ0 Y nd}|
�!|||� t"| |fd
|
i|��S ) a]
Create a customized HTTPSConnection object.
:param host: The host to connect to
:param port: The port to connect to, defaults to
HTTPSConnection.default_port
:param cafile: A PEM-format file containning the trusted
CA certificates
:param client_certfile:
A PEM-format client certificate file that will be used to
identificate the user to the server.
:param client_keyfile:
A file with the client private key. If this argument is not
supplied, the key will be sought in client_certfile.
:param keyfile_passwd:
A path to the file which stores the password that is used to
encrypt client_keyfile. Leave default value if the keyfile
is not encrypted.
:returns An established HTTPS connection to host:port
Z
OP_NO_TLSv1_3r )Zssl2Zssl3ztls1.0ztls1.1ztls1.2ztls1.3NzFcafile argument is required to perform server certificate verificationz.cafile '{file}' doesn't exist or is unreadablerc �post_handshake_authT�context)#�sslZ OP_NO_SSLv2Z OP_NO_SSLv3Z OP_NO_TLSv1Z
OP_NO_TLSv1_1Z
OP_NO_TLSv1_2r< � RuntimeErrorrf rg rh ri �R_OKr| Z
SSLContextZPROTOCOL_TLS_CLIENT�optionsZOP_ALLZOP_NO_COMPRESSIONZOP_SINGLE_DH_USEZOP_SINGLE_ECDH_USEr ZTLS_HIGH_CIPHERSZ set_ciphersr� r r� Z
CERT_REQUIREDZ verify_modeZcheck_hostnameZload_verify_locationsrk �readZload_cert_chainr )�host�portZcafileZclient_certfileZclient_keyfileZkeyfile_passwdr r� �kwargsZtls_cutoff_map�ctxZtls_span�versionZpwd_f�passwdr! r! r& �create_https_connection$ sN
� � ��
*r� Fc
C s� d}d}d}|r|d7 }|r$|d7 }|d }dt |||d� }t�|tjtjB �}| sbttd���t| �d krzttd
���|�| �s�d � d d
� || D ��}d � dd
� |D ��} ttd�t || d� ��d S )Nza-z0-9r- r �/�-a6 ^[%(base)s%(extra)s] # must begin with an alphanumeric
# character, or underscore if
# allow_underscore is True
([%(base)s%(extra)s%(middle)s]* # can contain all allowed character
# classes in the middle
[%(base)s%(extra)s])*$ # must end with alphanumeric
# character or underscore if
# allow_underscore is True
)�baseZextraZmiddle�empty DNS label�? z-DNS label cannot be longer that 63 charactersz, c s s | ]}d | V qdS �z'%s'Nr! �r$ �cr! r! r& � <genexpr>� r( z%validate_dns_label.<locals>.<genexpr>c s s | ]}d | V qdS r� r! r� r! r! r& r� � r( z\only letters, numbers, %(chars)s are allowed. DNS label may not start or end with %(chars2)s)�chars�chars2)
r1 rS �compile�
IGNORECASE�VERBOSEr{ r rL rT rR )
Z dns_label�allow_underscore� allow_slashZ
base_charsZ extra_charsZ middle_charsZ label_regexZregexr� r� r! r! r& �validate_dns_label� s, �
�r� rE c C sX | � d�r| d d� } | �d�} t| �dk r>ttd�|����| D ]}t|||� qBd S )Nrr rX r z"single label {}s are not supported)�endswithrK rL r{ r r| r� )Z domain_namer� r� Zentity�labelr! r! r& �validate_domain_name� s
�r� c C s2 t | t�sJ �tdd� | jD ��r.ttd���d S )Nc s s | ]}d |v V qdS )� @Nr! )r$ r� r! r! r& r� � r( z#validate_zonemgr.<locals>.<genexpr>ztoo many '@' characters)r. r �any�labelsr{ r �ru r! r! r& �validate_zonemgr� s r� c C s t | �} t| � t| �} t| �S �N)rv �validate_idna_domainr r� r� r! r! r& �validate_zonemgr_str� s r� T� c C s~ t | �|kr ttd�|����| �d�r4| dd� } d| v rHttd���d| vrn|r`ttd���t| ||� n t| ||� dS )a See RFC 952, 1123
Length limit of 64 imposed by MAXHOSTNAMELEN on Linux.
DNS and other operating systems has a max length of 255. Default to
the theoretical max unless explicitly told to limit. The cases
where a limit would be set might include:
* *-install --hostname
* ipa host-add
The *-install commands by definition are executed on Linux hosts so
the maximum length needs to be limited.
:param hostname Checked value
:param check_fqdn Check if hostname is fully qualified
z#cannot be longer that {} charactersrr NrX z..z0hostname contains empty label (consecutive dots)znot fully qualified)rL r{ r r| r� r� r� )r? Z
check_fqdnr� r� �maxlenr! r! r& �validate_hostname� s �
r� c C s t | ��� S r� )r �openssh)�valuer! r! r& �normalize_sshpubkey� s r� c C s4 z t |� W n ttfy* td� Y S 0 d S d S )N�invalid SSH public key)r r{ �UnicodeDecodeErrorr )�ugettextr� r! r! r& �validate_sshpubkey� s
r� c C sD z t |�}W n ttfy* td� Y S 0 |�� r<td�S d S d S )Nr� zoptions are not allowed)r r{ r� r Z has_options)r� r� �pubkeyr! r! r& � validate_sshpubkey_no_options� s r� c
C s� | � d�}|sd S g }g }|D ]t}z t|�}W n ttfyH Y q Y n0 |�� }|�� }|rjd||f }d||�� f }|�|�� � |�|� q d| v r�|p�d | d< |r�|| d< d S )N� ipasshpubkeyz%s %sz%s (%s)Z sshpubkeyfp) �getr r{ r� Zfingerprint_hex_sha256�commentZkeytype�appendr� )� entry_attrsZpubkeysZ
newpubkeysZ fingerprintsr� rp r� r! r! r& �convert_sshpubkey_post s*
r� c C s* d|v s&d|v s&t | dd� |�d� dS )z�
Attribute ipasshpubkey should be added to attrs_list to be able compute
ssh fingerprint. This attribute must be removed later if was added here
(see remove_sshpubkey_from_output_post).
r� �*�ipasshpubkey_addedTN)�setattrr� )r� Z
attrs_listr! r! r& �add_sshpubkey_to_attrs_pre s r� c C s& t | dd�r"|�dd� t| d� dS �zJ
Remove ipasshpubkey from output if it was added in pre_callbacks
r� Fr� N�r< �pop�delattr)r� r� r! r! r& �!remove_sshpubkey_from_output_post) s r� c C s0 t | dd�r,|D ]}|�dd� qt| d� dS r� r� )r� �entriesr� r! r! r& �&remove_sshpubkey_from_output_list_post2 s r� z4([-+]?((\d+)|(\d+\.\d+)|(\.\d+)|(\d+\.)))\s*([a-z]+)i�3�� �' i�: i�Q i �< rH )ZyearZyears�yZmonthZmonthsZweekZweeksre ZdayZdays�dZhourZhours�hZminuteZminutes�min�second�secondsZsecr[ c C s� d}d}t �| �D ]z}|d7 }|�d�}|�d�}|dkr@d}n4|dkrNd}n&|�� }t�|�}|d u rttd
| ��t|�}|| }||7 }q|dkr�td | ��|S ) a�
Given a time duration string, parse it and return the total number
of seconds represented as a floating point value. Negative values
are permitted.
The string should be composed of one or more numbers followed by a
time unit. Whitespace and punctuation is optional. The numbers may
be optionally signed. The time units are case insenstive except
for the single character 'M' or 'm' which means month and minute
respectively.
Recognized time units are:
* year, years, y
* month, months, M
* week, weeks, w
* day, days, d
* hour, hours, h
* minute, minutes, min, m
* second, seconds, sec, s
Examples:
"1h" # 1 hour
"2 HOURS, 30 Minutes" # 2.5 hours
"1week -1 day" # 6 days
".5day" # 12 hours
"2M" # 2 months
"1h:15m" # 1.25 hours
"1h, -15min" # 45 minutes
"30 seconds" # .5 minute
Note: Despite the appearance you can perform arithmetic the
parsing is much simpler, the parser searches for signed values and
adds the signed value to a running total. Only + and - are permitted
and must appear prior to a digit.
:parameters:
value : string
A time duration string in the specified format
:returns:
total number of seconds as float (may be negative)
r g rH � �Mr� �mr� Nz unknown time duration unit "%s"z no time duration found in "%s")�time_duration_re�finditer�grouprM �time_duration_unitsr� r{ r5 )r� �matchesZdurationrT Z magnitudeZunitZseconds_per_unitr� r! r! r& �parse_time_durationY s( -
r� ��AZAAAAZSSHFPc s. d� � �fdd�|D �}d� |�}|d7 }|S )aj
Generate update policy for a forward DNS zone (idnsUpdatePolicy
attribute). Bind uses this policy to grant/reject access for client
machines trying to dynamically update their records.
:param realm: A realm of the of the client
:param rrtypes: A list of resource records types that client shall be
allowed to update
z&grant %(realm)s krb5-self * %(rrtype)sc s g | ]}� t �|d � �qS ))�realm�rrtype�r1 �r$ r� ��policy_elementr� r! r& r' � s �z6get_dns_forward_zone_update_policy.<locals>.<listcomp>�; �;�rR )r� �rrtypes�policies�policyr! r� r& �"get_dns_forward_zone_update_policy� s
�
r� �ZPTRc s0 d� � ��fdd�|D �}d� |�}|d7 }|S )a
Generate update policy for a reverse DNS zone (idnsUpdatePolicy
attribute). Bind uses this policy to grant/reject access for client
machines trying to dynamically update their records.
:param realm: A realm of the of the client
:param reverse_zone: Name of the actual zone. All clients with IPs in this
sub-domain will be allowed to perform changes
:param rrtypes: A list of resource records types that client shall be
allowed to update
z2grant %(realm)s krb5-subdomain %(zone)s %(rrtype)sc s g | ]}� t ��|d � �qS ))r� rw r� r� r� �r� r� � reverse_zoner! r& r' � s � �z6get_dns_reverse_zone_update_policy.<locals>.<listcomp>r� r� r� )r� r� r� r� r� r! r� r& �"get_dns_reverse_zone_update_policy� s �
r� rQ � c C s t | ��� S r� )r Z
is_reverse)Z zone_namer! r! r& �zone_is_reverse� s r� c C sV t �t| ��}|j�d�}|jdkr2|dd � }n|jdkrH|dd � }td�|��S )Nrr rQ rH � � )�netaddr� IPAddressr8 Z reverse_dnsrK r� rx rR )�
ip_address�ipr2 r! r! r& �get_reverse_zone_default� s
r� c
C sB z t |� W n, ty8 } zt|�W Y d }~S d }~0 0 d S d S r� )r � Exceptionr8 )r� r� r\ r! r! r& �validate_rdn_param� s
r� c C s6 zt �|� W n ttfy, td� Y S 0 d S d S )Nzinvalid hostmask)r� Z IPNetworkr{ r r )r� �hostmaskr! r! r& �validate_hostmask� s
r� c s" e Zd ZdZd� fdd� Z� ZS )�ForwarderValidationErrorNc s, t j| ||fi |�� tt| ��| j� d S r� )r
Zprocess_message_arguments�superr� �__init__�msg)�selfr| �message�kw�� __class__r! r& r� � s z!ForwarderValidationError.__init__)NN)�__name__�
__module__� __qualname__r| r� �
__classcell__r! r! r r& r� � s r� c @ s e Zd Zed�ZdS )�UnresolvableRecordErrorz&query '%(owner)s %(rtype)s': %(error)sN�r r r r r| r! r! r! r& r � s r c @ s e Zd Zed�ZdS )�EDNS0UnsupportedErrorz1query '%(owner)s %(rtype)s' with EDNS0: %(error)sNr r! r! r! r& r � s r c @ s e Zd Zed�ZdS )�DNSSECSignatureMissingErrorzRanswer to query '%(owner)s %(rtype)s' is missing DNSSEC signatures (no RRSIG data)Nr r! r! r! r& r
� s r
c @ s e Zd Zed�ZdS )�DNSSECValidationErrorzFrecord '%(owner)s %(rtype)s' failed DNSSEC validation on server %(ip)sNr r! r! r! r& r s r c C s6 t | t�sJ �t| di ��d�}|r2t�d| |� dS )z�
If exception contains response from server, log this response to debug log
:param log: if log is None, do not log
:param e: DNSException
r� �responsez%DNSException: %s; server response: %sN)r. r r< r� r} �debug)r\ r r! r! r& �
_log_response s r �
c C s� t |t�s|du sJ �t |t�s$J �t� }|r6|g|_||_|�tjj� |r�|� dtjj
d� tjj}|rx|tjj B }|�|� n|r�|� ddd� |� | |�S )z�
:param nameserver_ip: if None, default resolvers will be used
:param edns0: enables EDNS0
:param dnssec: enabled EDNS0, flags: DO
:param flag_cd: requires dnssec=True, adds flag CD
:raise DNSException: if error occurs
Nr i )
r. r8 r Z nameserversZlifetimeZ set_flagsrA �flagsZRDZuse_ednsZDOZCDr ) �owner�rtype�
nameserver_ip�edns0�dnssec�flag_cd�timeout�resr r! r! r& �_resolve_record s r c
C s� zt | |||d� W n< tyP } z$t|� t| |||d��W Y d}~n
d}~0 0 zt | ||d|d� W n< ty� } z$t|� t| |||d��W Y d}~n
d}~0 0 dS )z�
Validate if forwarder supports EDNS0
:raise UnresolvableRecordError: record cannot be resolved
:raise EDNS0UnsupportedError: EDNS0 is not supported by forwarder
)r r �r r r� r_ NT)r r r )r r r r r )r r �ip_addrr r\ r! r! r& �_validate_edns0_forwarder5 s �
�
�r c
C s� t | �} d}d}t||| |d� zt||| d|d�}W n: typ } z"t|� t||| d��W Y d}~n
d}~0 0 z,|j�|jjt j
j t j j
t jjt jj� W n ty� t||| d��Y n0 dS )aE Test DNS forwarder properties. against root zone.
Global forwarders should be able return signed root zone
:raise UnresolvableRecordError: record cannot be resolved
:raise EDNS0UnsupportedError: EDNS0 is not supported by forwarder
:raise DNSSECSignatureMissingError: did not receive RRSIG for root zone
rr rD �r T)r r r �r r r� N)r8 r r r r r
r Z
find_rrset�answerrA rI �rootZ
rdataclass�INr ZRRSIGrD �KeyError)r r r r Zansr\ r! r! r& � validate_dnssec_global_forwarderM s$
�
$ � r# c C s t |d| |d� dS )z�
Only forwarders in forward zones can be validated in this way
:raise UnresolvableRecordError: record cannot be resolved
:raise EDNS0UnsupportedError: ENDS0 is not supported by forwarder
rD r N)r )r �fwzoner r! r! r& �$validate_dnssec_zone_forwarder_step1n s r% c
C s d}zt ||| ddd|d�}W nt tyX } z"t|� t||| d��W Y d}~nDd}~0 ty� } z$t|� t||| |d��W Y d}~n
d}~0 0 zt ||| dd|d�}W n: ty� } z"t|� t||| d��W Y d}~n8d}~0 0 |j|jk�r|j|jk�rdS t||| d��dS )a�
This step must be executed after forwarders are added into LDAP, and only
when we are sure the forwarders work.
Query will be send to IPA DNS server, to verify if reply passed,
or DNSSEC validation failed.
Only forwarders in forward zones can be validated in this way
:raise UnresolvableRecordError: record cannot be resolved
:raise DNSSECValidationError: response from forwarder is not DNSSEC valid
rD T)r r r r r r Nr )r r r r )r r r r r r Zcanonical_nameZrrset)Z ipa_ip_addrr$ r r Zans_cdr\ Zans_dor! r! r& �$validate_dnssec_zone_forwarder_step2w s4
�
"� �
$
�r& c C s, d}z t | � W n� tjjy. td�}Y n� tjjyJ td�}Y n� tjjyf td�}Y n� tjjy� td�}Y n� tjj y� td�}Y n|0 t
j d| t
j d�}z|D ]}|�
d � q�W nN t�y td
d � |D ��}|�rtd �| d
�dd� |D ��d� }Y n0 |�r(t|��dS )z
Validate if value is valid IDNA domain.
If domain is not valid, raises ValueError
:param value:
:return:
Nz"invalid escape code in domain namer� z0domain name cannot be longer than 255 charactersz-DNS label cannot be longer than 63 characterszinvalid domain nameu [.．。｡]�r �asciic s s | ]}t j�|�|kV qd S r� �� encodingsZidnaZnameprep�r$ �xr! r! r& r� � r( z'validate_idna_domain.<locals>.<genexpr>z@domain name '%(domain)s' should be normalized to: %(normalized)srr c S s g | ]}t j�|��qS r! r) r+ r! r! r& r' � s �z(validate_idna_domain.<locals>.<listcomp>)rE Z
normalized)r rA rI Z BadEscaper Z
EmptyLabelZ NameTooLongZ LabelTooLongr@ � SyntaxErrorrS rK �UNICODE�encode� UnicodeErrorr� rR r{ )r� r_ r� r� Z
is_nonnormr! r! r& r� � s:
���
r� c
C s� t d�}t |�}|| }zrt|tj�}|jj}t|�dkr�t|d �dkr�|d jtjkr�|d d }|�� d� | j
j �kr�W dS W dS W n t y� Y n0 t d�}|| } zt| tj
� W n t y� Y dS 0 dS d S )
aP
Detects the type of the realm that the given DNS zone belongs to.
Note: This method is heuristic. Possible values:
- 'current': For IPA domains belonging in the current realm.
- 'foreign': For domains belonging in a foreing kerberos realm.
- 'unknown': For domains whose allegiance could not be detected.
Z _kerberosrH r z"{0}"�currentZforeignz_ldap._tcp.gc._msdcs�unknownN)r r r ZTXTr r rL ZrdtypeZto_textr| �envr� r ZSRV)
�apirE Zkerberos_prefixZ
domain_suffixZkerberos_record_namerN r �recordZ gc_prefixZad_specific_record_namer! r! r& �detect_dns_zone_realm_type� s0 ��
r6 c C s | j d � �dt�}|tkS )NZdomainlevel_getrN )�Commandr� r )r4 Z domainlevelr! r! r& �has_managed_topology� s r8 c C s� |r|| j �d�}|dur@td| � tdtt�| j d �� � | j �d�}|dur|td| � tdtt�| j d �� � dS )
z�Pretty print nsds5replicalastinitstatus, nsds5replicalastinitend,
nsds5replicalastupdatestatus, nsds5replicalastupdateend for a
replication agreement.
Znsds5replicalastinitstatusNz last init status: %sz last init ended: %sZnsds5replicalastinitendZ nsds5replicalastupdatestatusz last update status: %sz last update ended: %sZnsds5replicalastupdateend)� single_valuer� �printr8 r Zparse_generalized_time)�entry�verboseZ
initstatusZ updatestatusr! r! r& �print_replication_status s& ��� ��r= c @ s: e Zd ZdZd
dd�Zdd� Zdd� Zd d
� Zd d � ZdS )�
classproperty)�__doc__�fgetNc C s4 t |t�sJ �|d u r$|d ur$|j}|| _|| _d S r� )r. � classmethodr? r@ )r� r@ �docr! r! r& r� s
zclassproperty.__init__c C s& | j d ur| j �||�� S td��d S �Nzunreadable attribute�r@ �__get__�AttributeError�r� r= Zobj_typer! r! r& rE ( s
zclassproperty.__get__c C s t d��d S )Nzcan't set attribute�rF )r� r= r� r! r! r& �__set__- s zclassproperty.__set__c C s t d��d S )Nzcan't delete attributerH )r� r= r! r! r& �
__delete__0 s zclassproperty.__delete__c C s
|| _ | S r� )r@ )r� r@ r! r! r& �getter3 s zclassproperty.getter)NN) r r r � __slots__r� rE rI rJ rK r! r! r! r& r> s
r> c @ s e Zd ZdZdd� ZdS )�classobjectproperty)r? c C s( | j d ur | j �||�|�S td��d S rC rD rG r! r! r& rE = s
zclassobjectproperty.__get__N)r r r rL rE r! r! r! r& rM 8 s rM c C s" | � d�r| dd� } | �� } | S )z-Use common fqdn form without the trailing dotrr NrX )r� rM r> r! r! r& �normalize_hostnameC s
rN c
C sJ zt ||d� W n4 tyD } z td�t|� W Y d}~S d}~0 0 dS )a Validator used by plugins to ensure hostname compliance.
In Linux the maximum hostname length is 64. In DNS and
other operaring systems (Solaris) it is 255. If not explicitly
checking a Linux hostname (e.g. the server) use the DNS
default.
)r� zinvalid domain-name: %sN)r� r{ r r6 )r� r� r� r\ r! r! r& �hostname_validatorK s
&rO c C sh zBt jt|�t jd�}|d ur@|j|kr@td�t|j|d� W S W n t jtfyb td� Y S 0 d S )Nr' zFinvalid IP address version (is %(value)d, must be %(required_value)d)!)r� Zrequired_valuezinvalid IP address format) r� r� r8 Z INET_PTONr� r r1 r r{ )r� r` Z
ip_versionr� r! r! r& �ipaddr_validator[ s
���
rP c C sv |� d�\}}}t| |�}|d ur&|S |rrz"t|�}|dk sD|dkrJt� �W n$ typ tdt|d� � Y S 0 d S )Nz port r i�� z %(port)s is not a valid port)r� )rs rP r3 r{ r r1 )r� Z forwarderr� �sepr� Zip_address_validationr! r! r& �validate_bind_forwarderl s
rR c C sB t dd� | d D ��}d|vr"d S d| v r>d| vr>| d | d< d S )Nc s s | ]}|� � V qd S r� �rM )r$ �ir! r! r& r� � r( z'set_krbcanonicalname.<locals>.<genexpr>� objectclassZkrbprincipalaux�krbprincipalname�krbcanonicalname)�set)r� Z
objectclassesr! r! r& �set_krbcanonicalname s �rY c G sB | � |jddg�}|j�dd�}||d v r>tjdtd�d��dS )a
ensure that the LDAP entry has at least one value of krbprincipalname
and that this value is equal to krbcanonicalname
:param ldap: LDAP connection object
:param entry_attrs: LDAP entry made prior to update
:param options: command options
rW rV NrX zHat least one value equal to the canonical principal name must be present�rI r_ )� get_entry�dnr9 r� r �ValidationErrorr )�ldapr� �keysr; rW r! r! r& � ensure_last_krbprincipalname� s
� �r` c C sV | � |jg d��}|j�dd �d ur(d S t|� |�dd � |�dd � |�|� d S )N)rW rV rU rW rV rU )r[ r\ r9 r� rY r� �update)r^ r� Z old_entryr! r! r& �ensure_krbcanonicalname_set� s � rb c C s^ d}| durF| j tjkrFtj�| j�r*dS td| j � d| j� d�|��t� rPdS td|��dS )a
Check if IPA client is configured on the system.
This is a convenience wrapper that also supports using
a custom configuration via IPA_CONFDIR.
Raises a ScriptError exception if the client is not
configured.
Hardcode return code to avoid recursive imports
r NTz5IPA client is not configured on this system (confdir z is missing �)z+IPA client is not configured on this system) Zconfdirr ZETC_IPArf rg rh Z conf_defaultr r )r3 ZCLIENT_NOT_CONFIGUREDr! r! r& �check_client_configuration� s$ ����rd c C s� | j jddd�d }t� }|D ]\}|�dg �}|�tdd� |D ��� d|v rd|�|d d �� � |�|d d �� � q |r�|�| jj�� � |S )
z�
Return UPNs and realm names of trusted forests.
:param api_instance: API instance
:param add_local: bool flag
:return: set of namespace names as strings.
If add_local is True, add own realm namesapce
r- r )Z sizelimitrN Zipantadditionalsuffixesc s s | ]}|� � V qd S r� rS )r$ �upnr! r! r& r� � r( z,_collect_trust_namespaces.<locals>.<genexpr>Z
ipantflatnameZcn) r7 Z
trust_findrX r� ra �addrM r3 r� )� api_instance� add_localZ
trust_objects�trust_suffix_namespacer= Z nt_suffixesr! r! r& �_collect_trust_namespaces� s
�rj rV )� attr_namec G sf t | dd�}|d D ]L}t|| jjd�}|j}|jr:|jnd}||v sN||v rtj|td�d��qdS )a7
Check that principal name's suffix does not overlap with UPNs and realm
names of trusted forests.
:param api_instance: API instance
:param suffixes: principal suffixes
:raises: ValidationError if the suffix coincides with realm name, UPN
suffix or netbios name of trusted domains
F�rh rX �r� Nz:realm or UPN suffix overlaps with trusted domain namespacerZ ) rj r r3 r� �
is_enterprise�
upn_suffixr r] r )rg rk �suffixesri �p� principalr� re r! r! r& �(check_principal_realm_in_trust_namespace� s � �rs c G s~ t | dd�}|d D ]d}t|| jjd�}|j}|jr:|jnd}|�� |v|duoZ|�� |vg}t|�rtj |t
d�d��qdS )aJ
Check that principal name's suffix does not overlap with UPNs and realm
names of trusted forests.
:param api_instance: API instance
:param suffixes: principal suffixes
:raises: ValidationError if the suffix does not match with realm name, UPN
suffix or netbios name of trusted domains or IPA domain
Trl rX rm NzSrealm or UPN suffix outside of supported realm domains or trusted domains namespacerZ ) rj r r3 r� rn ro rM r� r r] r ) rg rk rp ri rq rr r� re Z
conditionsr! r! r& � check_principal_realm_supported s �
��rt c C s6 | D ],}|� � st�d|� td�|�tjd� qd S )Nz.No network interface matches the IP address %sz7WARNING: No network interface matches the IP address {}rc )Zget_matching_interfacer} r~ r: r| �sys�stderr)Z addr_listr� r! r! r& �,no_matching_interface_for_ip_address_warning) s ���rw c C s
t �� jS )z�
Get current terminal height
Args:
fd (int): file descriptor. Default: 1 (stdout)
Returns:
int: Terminal height
)�shutil�get_terminal_size�linesr! r! r! r& �get_terminal_height7 s
r{ c C s t j�dd�} t�| �S )zl Get path to a pager
:return: path to the file if it exists otherwise None
:rtype: str or None
ZPAGERZless)rf �environr� rx �which)�pagerr! r! r& � get_pagerD s r c C sB t j|gt jd�}z|j�| � |�� W n ty< Y n0 dS )z�
Open text data in pager
Args:
data (bytes): data to view in pager
pager (str): path to the pager
Returns:
None
)�stdinN)�
subprocess�Popen�PIPEr� �writeZ communicaterm )rU r~ Z
pager_processr! r! r& �
open_in_pagerN s r� c sJ e Zd Zeeeeeee e
e e e
d�h Z� fdd�Zdd� Zdd� Z� ZS )�APIReprNc s> t t| ��� | j�� D ] \}}t|t�rt| |tj � qd S r� )
r� r� r� �__dict__r2 r. r3 r� ru �maxsize)r� r) r* r r! r& r� k s
zAPIRepr.__init__c C s dt |� S )zOutput with u'' prefix�u)�repr�r� r, �levelr! r! r& �repr_strr s zAPIRepr.repr_strc C s. |t u r dS || jv r"d�|j�S t|�S d S )Nz<type 'unicode'>z <type '{}'>)r8 �
builtin_typesr| r r� r� r! r! r& � repr_typev s
zAPIRepr.repr_type)r r r r4 r3 r5 r8 �bytesr1 r0 r/ rX � frozensetr7 r� r� r� r� r r! r! r r& r� c s
� r� )FF)FFrE )TFFr� )r� )r� )NFFFr )r )r )r )r )r� )N)N)F)�r? Z
__future__r r Zloggingrf r^ rS r: rA r* ru r� rx r� r� r Z
dns.exceptionr Z dns.resolverr Z netaddr.corer ZsixZhttplibr � ImportErrorZ http.clientZipalibr r
Zipalib.constantsr r r
r r r Z ipalib.factsr Z ipalib.textr Zipaplatform.constantsr Zipaplatform.pathsr Z ipapythonr Z
ipapython.sshr Z ipapython.dnr r Zipapython.dnsutilr r r r Zipapython.admintoolr Zipapython.kerberosr � version_info�reprlibZPY3r8 r6 Z_IPA_CLIENT_SYSRESTOREZ_IPA_DEFAULT_CONFZ getLoggerr r} r# rC rF rP rV r] ra rq rv rx r� Z default_portr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� Z ip4_rev_zoneZ ip6_rev_zoneZREVERSE_DNS_ZONESr� r� r� r� r� r� r r r
r r r r r# r% r& r� r6 r8 r= r> rM rN rO rP rR rY r` rb rd rj rs rt rw r{ r r� �Reprr� r� Zapireprr! r! r! r& �<module> s*
5�
^
& �
�
# �G
� �
!
!
(,4
!
� �