0000-12-31 18:09:24 -05:50
|
|
|
# Authors: Karl MacMillan <kmacmill@redhat.com>
|
|
|
|
#
|
|
|
|
# Copyright (C) 2007 Red Hat
|
|
|
|
# see file 'COPYING' for use and warranty information
|
|
|
|
#
|
2010-12-09 06:59:11 -06:00
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
# (at your option) any later version.
|
0000-12-31 18:09:24 -05:50
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
2010-12-09 06:59:11 -06:00
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
0000-12-31 18:09:24 -05:50
|
|
|
#
|
2017-10-11 05:09:30 -05:00
|
|
|
from __future__ import absolute_import
|
0000-12-31 18:09:24 -05:50
|
|
|
|
2016-11-23 03:04:43 -06:00
|
|
|
# pylint: disable=deprecated-module
|
|
|
|
from optparse import (
|
|
|
|
Option, Values, OptionParser, IndentedHelpFormatter, OptionValueError)
|
|
|
|
# pylint: enable=deprecated-module
|
2011-05-27 13:17:22 -05:00
|
|
|
from copy import copy
|
2022-11-21 10:14:41 -06:00
|
|
|
from configparser import ConfigParser as SafeConfigParser
|
2018-09-27 00:47:07 -05:00
|
|
|
from urllib.parse import urlsplit
|
2017-10-23 06:45:56 -05:00
|
|
|
import functools
|
2017-03-08 04:39:51 -06:00
|
|
|
|
|
|
|
from dns.exception import DNSException
|
|
|
|
import dns.name
|
2015-09-14 07:03:58 -05:00
|
|
|
|
2017-10-11 05:09:30 -05:00
|
|
|
from ipaplatform.paths import paths
|
2012-08-13 02:38:24 -05:00
|
|
|
from ipapython.dn import DN
|
2018-06-15 10:03:29 -05:00
|
|
|
from ipapython.dnsutil import query_srv
|
2017-10-23 06:45:56 -05:00
|
|
|
from ipapython.ipautil import CheckedIPAddress, CheckedIPAddressLoopback
|
0000-12-31 18:09:24 -05:50
|
|
|
|
2017-03-08 04:39:51 -06:00
|
|
|
|
|
|
|
class IPAConfigError(Exception):
|
|
|
|
def __init__(self, msg=''):
|
|
|
|
self.msg = msg
|
|
|
|
Exception.__init__(self, msg)
|
|
|
|
|
|
|
|
def __repr__(self):
|
|
|
|
return self.msg
|
|
|
|
|
|
|
|
__str__ = __repr__
|
0000-12-31 18:09:24 -05:50
|
|
|
|
2008-08-15 11:08:01 -05:00
|
|
|
class IPAFormatter(IndentedHelpFormatter):
|
|
|
|
"""Our own optparse formatter that indents multiple lined usage string."""
|
|
|
|
def format_usage(self, usage):
|
|
|
|
usage_string = "Usage:"
|
|
|
|
spacing = " " * len(usage_string)
|
|
|
|
lines = usage.split("\n")
|
|
|
|
ret = "%s %s\n" % (usage_string, lines[0])
|
|
|
|
for line in lines[1:]:
|
|
|
|
ret += "%s %s\n" % (spacing, line)
|
|
|
|
return ret
|
|
|
|
|
2011-06-16 03:47:11 -05:00
|
|
|
|
2017-10-23 06:45:56 -05:00
|
|
|
def check_ip_option(option, opt, value, allow_loopback=False):
|
2011-05-27 13:17:22 -05:00
|
|
|
try:
|
2017-10-23 06:45:56 -05:00
|
|
|
if allow_loopback:
|
|
|
|
return CheckedIPAddressLoopback(value)
|
|
|
|
else:
|
|
|
|
return CheckedIPAddress(value)
|
2011-05-27 13:17:22 -05:00
|
|
|
except Exception as e:
|
2017-10-23 06:45:56 -05:00
|
|
|
raise OptionValueError("option {}: invalid IP address {}: {}"
|
|
|
|
.format(opt, value, e))
|
2011-05-27 13:17:22 -05:00
|
|
|
|
2012-08-13 02:38:24 -05:00
|
|
|
def check_dn_option(option, opt, value):
|
|
|
|
try:
|
|
|
|
return DN(value)
|
2015-07-30 09:49:29 -05:00
|
|
|
except Exception as e:
|
2012-08-13 02:38:24 -05:00
|
|
|
raise OptionValueError("option %s: invalid DN: %s" % (opt, e))
|
|
|
|
|
2017-05-23 04:32:24 -05:00
|
|
|
|
|
|
|
def check_constructor(option, opt, value):
|
|
|
|
con = option.constructor
|
|
|
|
assert con is not None, "Oops! Developer forgot to set 'constructor' kwarg"
|
|
|
|
try:
|
|
|
|
return con(value)
|
|
|
|
except Exception as e:
|
|
|
|
raise OptionValueError("option {} invalid: {}".format(opt, e))
|
|
|
|
|
|
|
|
|
2010-10-29 13:24:31 -05:00
|
|
|
class IPAOption(Option):
|
|
|
|
"""
|
|
|
|
optparse.Option subclass with support of options labeled as
|
|
|
|
security-sensitive such as passwords.
|
|
|
|
"""
|
2017-05-23 04:32:24 -05:00
|
|
|
ATTRS = Option.ATTRS + ["sensitive", "constructor"]
|
2017-10-23 06:45:56 -05:00
|
|
|
TYPES = Option.TYPES + ("ip", "dn", "constructor", "ip_with_loopback")
|
2011-05-27 13:17:22 -05:00
|
|
|
TYPE_CHECKER = copy(Option.TYPE_CHECKER)
|
2011-06-16 03:47:11 -05:00
|
|
|
TYPE_CHECKER["ip"] = check_ip_option
|
2017-10-23 06:45:56 -05:00
|
|
|
TYPE_CHECKER["ip_with_loopback"] = functools.partial(check_ip_option,
|
|
|
|
allow_loopback=True)
|
2012-08-13 02:38:24 -05:00
|
|
|
TYPE_CHECKER["dn"] = check_dn_option
|
2017-05-23 04:32:24 -05:00
|
|
|
TYPE_CHECKER["constructor"] = check_constructor
|
|
|
|
|
2010-10-29 13:24:31 -05:00
|
|
|
|
|
|
|
class IPAOptionParser(OptionParser):
|
|
|
|
"""
|
|
|
|
optparse.OptionParser subclass that uses IPAOption by default
|
|
|
|
for storing options.
|
|
|
|
"""
|
|
|
|
def __init__(self,
|
|
|
|
usage=None,
|
|
|
|
option_list=None,
|
|
|
|
option_class=IPAOption,
|
|
|
|
version=None,
|
|
|
|
conflict_handler="error",
|
|
|
|
description=None,
|
|
|
|
formatter=None,
|
|
|
|
add_help_option=True,
|
|
|
|
prog=None):
|
|
|
|
OptionParser.__init__(self, usage, option_list, option_class,
|
|
|
|
version, conflict_handler, description,
|
|
|
|
formatter, add_help_option, prog)
|
|
|
|
|
|
|
|
def get_safe_opts(self, opts):
|
|
|
|
"""
|
|
|
|
Returns all options except those with sensitive=True in the same
|
|
|
|
fashion as parse_args would
|
|
|
|
"""
|
2017-07-10 07:54:10 -05:00
|
|
|
all_opts_dict = {
|
|
|
|
o.dest: o for o in self._get_all_options()
|
|
|
|
if hasattr(o, 'sensitive')
|
|
|
|
}
|
2010-10-29 13:24:31 -05:00
|
|
|
safe_opts_dict = {}
|
|
|
|
|
Use Python3-compatible dict method names
Python 2 has keys()/values()/items(), which return lists,
iterkeys()/itervalues()/iteritems(), which return iterators,
and viewkeys()/viewvalues()/viewitems() which return views.
Python 3 has only keys()/values()/items(), which return views.
To get iterators, one can use iter() or a for loop/comprehension;
for lists there's the list() constructor.
When iterating through the entire dict, without modifying the dict,
the difference between Python 2's items() and iteritems() is
negligible, especially on small dicts (the main overhead is
extra memory, not CPU time). In the interest of simpler code,
this patch changes many instances of iteritems() to items(),
iterkeys() to keys() etc.
In other cases, helpers like six.itervalues are used.
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-08-11 06:51:14 -05:00
|
|
|
for option, value in opts.__dict__.items():
|
2020-04-30 08:01:51 -05:00
|
|
|
if not all_opts_dict[option].sensitive:
|
2010-10-29 13:24:31 -05:00
|
|
|
safe_opts_dict[option] = value
|
|
|
|
|
|
|
|
return Values(safe_opts_dict)
|
|
|
|
|
2008-08-15 11:08:01 -05:00
|
|
|
def verify_args(parser, args, needed_args = None):
|
|
|
|
"""Verify that we have all positional arguments we need, if not, exit."""
|
|
|
|
if needed_args:
|
|
|
|
needed_list = needed_args.split(" ")
|
|
|
|
else:
|
|
|
|
needed_list = []
|
|
|
|
len_need = len(needed_list)
|
|
|
|
len_have = len(args)
|
|
|
|
if len_have > len_need:
|
|
|
|
parser.error("too many arguments")
|
|
|
|
elif len_have < len_need:
|
|
|
|
parser.error("no %s specified" % needed_list[len_have])
|
|
|
|
|
2016-06-03 05:45:01 -05:00
|
|
|
|
2018-09-26 04:59:50 -05:00
|
|
|
class IPAConfig:
|
2017-03-08 04:39:51 -06:00
|
|
|
def __init__(self):
|
|
|
|
self.default_realm = None
|
|
|
|
self.default_server = []
|
|
|
|
self.default_domain = None
|
|
|
|
|
|
|
|
def get_realm(self):
|
|
|
|
if self.default_realm:
|
|
|
|
return self.default_realm
|
|
|
|
else:
|
|
|
|
raise IPAConfigError("no default realm")
|
|
|
|
|
|
|
|
def get_server(self):
|
|
|
|
if len(self.default_server):
|
|
|
|
return self.default_server
|
|
|
|
else:
|
|
|
|
raise IPAConfigError("no default server")
|
|
|
|
|
|
|
|
def get_domain(self):
|
|
|
|
if self.default_domain:
|
|
|
|
return self.default_domain
|
|
|
|
else:
|
|
|
|
raise IPAConfigError("no default domain")
|
|
|
|
|
|
|
|
# Global library config
|
|
|
|
config = IPAConfig()
|
|
|
|
|
|
|
|
def __parse_config(discover_server = True):
|
|
|
|
p = SafeConfigParser()
|
2017-10-11 05:09:30 -05:00
|
|
|
p.read(paths.IPA_DEFAULT_CONF)
|
2017-03-08 04:39:51 -06:00
|
|
|
|
|
|
|
try:
|
|
|
|
if not config.default_realm:
|
|
|
|
config.default_realm = p.get("global", "realm")
|
|
|
|
except Exception:
|
|
|
|
pass
|
|
|
|
if discover_server:
|
|
|
|
try:
|
|
|
|
s = p.get("global", "xmlrpc_uri")
|
|
|
|
server = urlsplit(s)
|
|
|
|
config.default_server.append(server.netloc)
|
|
|
|
except Exception:
|
|
|
|
pass
|
|
|
|
try:
|
|
|
|
if not config.default_domain:
|
|
|
|
config.default_domain = p.get("global", "domain")
|
|
|
|
except Exception:
|
|
|
|
pass
|
|
|
|
|
|
|
|
def __discover_config(discover_server = True):
|
|
|
|
servers = []
|
|
|
|
try:
|
|
|
|
if not config.default_domain:
|
|
|
|
# try once with REALM -> domain
|
|
|
|
domain = str(config.default_realm).lower()
|
|
|
|
name = "_ldap._tcp." + domain
|
|
|
|
|
|
|
|
try:
|
2018-06-15 10:03:29 -05:00
|
|
|
servers = query_srv(name)
|
2017-03-08 04:39:51 -06:00
|
|
|
except DNSException:
|
|
|
|
# try cycling on domain components of FQDN
|
2020-09-11 07:49:16 -05:00
|
|
|
# pylint: disable=ipa-forbidden-import
|
|
|
|
from ipalib.constants import FQDN
|
|
|
|
# pylint: enable=ipa-forbidden-import
|
2017-03-08 04:39:51 -06:00
|
|
|
try:
|
2020-09-11 07:49:16 -05:00
|
|
|
domain = dns.name.from_text(FQDN)
|
2017-03-08 04:39:51 -06:00
|
|
|
except DNSException:
|
|
|
|
return False
|
|
|
|
|
|
|
|
while True:
|
|
|
|
domain = domain.parent()
|
|
|
|
|
|
|
|
if str(domain) == '.':
|
|
|
|
return False
|
|
|
|
name = "_ldap._tcp.%s" % domain
|
|
|
|
try:
|
2018-06-15 10:03:29 -05:00
|
|
|
servers = query_srv(name)
|
2017-03-08 04:39:51 -06:00
|
|
|
break
|
|
|
|
except DNSException:
|
|
|
|
pass
|
|
|
|
|
|
|
|
config.default_domain = str(domain).rstrip(".")
|
|
|
|
|
|
|
|
if discover_server:
|
|
|
|
if not servers:
|
|
|
|
name = "_ldap._tcp.%s." % config.default_domain
|
|
|
|
try:
|
2018-06-15 10:03:29 -05:00
|
|
|
servers = query_srv(name)
|
2017-03-08 04:39:51 -06:00
|
|
|
except DNSException:
|
|
|
|
pass
|
|
|
|
|
|
|
|
for server in servers:
|
|
|
|
hostname = str(server.target).rstrip(".")
|
|
|
|
config.default_server.append(hostname)
|
|
|
|
|
|
|
|
except Exception:
|
|
|
|
pass
|
2017-12-15 10:00:04 -06:00
|
|
|
return None
|
|
|
|
|
2017-03-08 04:39:51 -06:00
|
|
|
|
2008-08-15 11:08:01 -05:00
|
|
|
def add_standard_options(parser):
|
|
|
|
parser.add_option("--realm", dest="realm", help="Override default IPA realm")
|
2016-09-22 10:37:25 -05:00
|
|
|
parser.add_option("--server", dest="server",
|
|
|
|
help="Override default FQDN of IPA server")
|
2008-08-15 11:08:01 -05:00
|
|
|
parser.add_option("--domain", dest="domain", help="Override default IPA DNS domain")
|
2017-03-08 04:39:51 -06:00
|
|
|
|
|
|
|
def init_config(options=None):
|
|
|
|
if options:
|
|
|
|
config.default_realm = options.realm
|
|
|
|
config.default_domain = options.domain
|
|
|
|
if options.server:
|
|
|
|
config.default_server.extend(options.server.split(","))
|
|
|
|
|
|
|
|
if len(config.default_server):
|
|
|
|
discover_server = False
|
|
|
|
else:
|
|
|
|
discover_server = True
|
|
|
|
__parse_config(discover_server)
|
|
|
|
__discover_config(discover_server)
|
|
|
|
|
|
|
|
# make sure the server list only contains unique items
|
|
|
|
new_server = []
|
|
|
|
for server in config.default_server:
|
|
|
|
if server not in new_server:
|
|
|
|
new_server.append(server)
|
|
|
|
config.default_server = new_server
|
|
|
|
|
|
|
|
if not config.default_realm:
|
|
|
|
raise IPAConfigError("IPA realm not found in DNS, in the config file (/etc/ipa/default.conf) or on the command line.")
|
|
|
|
if not config.default_server:
|
|
|
|
raise IPAConfigError("IPA server not found in DNS, in the config file (/etc/ipa/default.conf) or on the command line.")
|
|
|
|
if not config.default_domain:
|
|
|
|
raise IPAConfigError("IPA domain not found in the config file (/etc/ipa/default.conf) or on the command line.")
|