2008-10-02 20:09:13 -05:00
# Authors:
# Jason Gerard DeRose <jderose@redhat.com>
#
# Copyright (C) 2008 Red Hat
# see file 'COPYING' for use and warranty information
#
2010-12-09 06:59:11 -06:00
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
2008-10-02 20:09:13 -05:00
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
2010-12-09 06:59:11 -06:00
# along with this program. If not, see <http://www.gnu.org/licenses/>.
2008-10-02 20:09:13 -05:00
"""
Various utility functions .
"""
2008-10-27 01:23:43 -05:00
import os
import imp
2008-10-31 21:25:33 -05:00
import time
2009-02-18 16:12:27 -06:00
import socket
2010-10-08 12:15:03 -05:00
import re
2010-08-10 15:40:00 -05:00
from types import NoneType
2011-11-01 07:58:05 -05:00
from weakref import WeakKeyDictionary
2012-05-11 07:38:09 -05:00
from dns import resolver , rdatatype
from dns . exception import DNSException
2010-08-10 15:40:00 -05:00
2009-04-23 07:51:59 -05:00
from ipalib import errors
2011-06-08 09:54:41 -05:00
from ipalib . text import _
2012-04-16 01:33:26 -05:00
from ipalib . dn import DN , RDN
2011-12-07 01:50:31 -06:00
from ipapython . ipautil import decode_ssh_pubkey
2008-10-28 02:39:02 -05:00
2008-10-02 20:09:13 -05:00
2010-08-09 15:45:26 -05:00
def json_serialize ( obj ) :
2010-08-10 15:40:00 -05:00
if isinstance ( obj , ( list , tuple ) ) :
return [ json_serialize ( o ) for o in obj ]
if isinstance ( obj , dict ) :
return dict ( ( k , json_serialize ( v ) ) for ( k , v ) in obj . iteritems ( ) )
if isinstance ( obj , ( bool , float , int , unicode , NoneType ) ) :
return obj
if isinstance ( obj , str ) :
return obj . decode ( ' utf-8 ' )
2010-08-09 15:45:26 -05:00
if not callable ( getattr ( obj , ' __json__ ' , None ) ) :
# raise TypeError('%r is not JSON serializable')
return ' '
2010-08-10 15:40:00 -05:00
return json_serialize ( obj . __json__ ( ) )
2010-08-09 15:45:26 -05:00
2008-10-22 16:54:04 -05:00
def get_current_principal ( ) :
try :
2010-09-10 14:57:40 -05:00
# krbV isn't necessarily available on client machines, fail gracefully
import krbV
2009-04-20 12:58:26 -05:00
return unicode ( krbV . default_context ( ) . default_ccache ( ) . principal ( ) . name )
2010-09-10 14:57:40 -05:00
except ImportError :
raise RuntimeError ( ' python-krbV is not available. ' )
2008-10-22 16:54:04 -05:00
except krbV . Krb5Error :
2009-04-20 12:58:26 -05:00
#TODO: do a kinit?
2009-04-23 07:51:59 -05:00
raise errors . CCacheError ( )
2008-10-27 01:23:43 -05:00
# FIXME: This function has no unit test
def find_modules_in_dir ( src_dir ) :
"""
Iterate through module names found in ` ` src_dir ` ` .
"""
2009-04-20 12:58:26 -05:00
if not ( os . path . abspath ( src_dir ) == src_dir and os . path . isdir ( src_dir ) ) :
2008-10-27 01:23:43 -05:00
return
2009-04-20 12:58:26 -05:00
if os . path . islink ( src_dir ) :
2008-10-27 01:23:43 -05:00
return
suffix = ' .py '
for name in sorted ( os . listdir ( src_dir ) ) :
if not name . endswith ( suffix ) :
continue
2009-04-20 12:58:26 -05:00
pyfile = os . path . join ( src_dir , name )
if os . path . islink ( pyfile ) or not os . path . isfile ( pyfile ) :
2008-10-27 01:23:43 -05:00
continue
module = name [ : - len ( suffix ) ]
if module == ' __init__ ' :
continue
2009-02-12 03:10:12 -06:00
yield ( module , pyfile )
2008-10-27 01:23:43 -05:00
2010-07-22 13:16:22 -05:00
def validate_host_dns ( log , fqdn ) :
"""
See if the hostname has a DNS A record .
"""
2012-05-11 07:38:09 -05:00
try :
answers = resolver . query ( fqdn , rdatatype . A )
2010-07-22 13:16:22 -05:00
log . debug (
2012-05-11 07:38:09 -05:00
' IPA: found %d records for %s : %s ' % ( len ( answers ) , fqdn ,
' ' . join ( str ( answer ) for answer in answers ) )
2010-07-22 13:16:22 -05:00
)
2012-05-11 07:38:09 -05:00
except DNSException , e :
2010-07-22 13:16:22 -05:00
log . debug (
2012-05-11 07:38:09 -05:00
' IPA: DNS A record lookup failed for %s ' % fqdn
2010-07-22 13:16:22 -05:00
)
2012-05-11 07:38:09 -05:00
raise errors . DNSNotARecordError ( )
2010-10-08 12:15:03 -05:00
def isvalid_base64 ( data ) :
"""
Validate the incoming data as valid base64 data or not .
The character set must only include of a - z , A - Z , 0 - 9 , + or / and
be padded with = to be a length divisible by 4 ( so only 0 - 2 = s are
allowed ) . Its length must be divisible by 4. White space is
not significant so it is removed .
This doesn ' t guarantee we have a base64-encoded value, just that it
fits the base64 requirements .
"""
data = ' ' . join ( data . split ( ) )
if len ( data ) % 4 > 0 or \
re . match ( ' ^[a-zA-Z0-9 \ + \ /]+ \ = { 0,2}$ ' , data ) is None :
return False
else :
return True
2010-11-23 16:47:29 -06:00
def validate_ipaddr ( ipaddr ) :
"""
Check to see if the given IP address is a valid IPv4 or IPv6 address .
Returns True or False
"""
try :
socket . inet_pton ( socket . AF_INET , ipaddr )
except socket . error :
try :
socket . inet_pton ( socket . AF_INET6 , ipaddr )
except socket . error :
return False
return True
2011-06-08 09:54:41 -05:00
def check_writable_file ( filename ) :
"""
Determine if the file is writable . If the file doesn ' t exist then
open the file to test writability .
"""
if filename is None :
raise errors . FileError ( reason = ' Filename is empty ' )
try :
if os . path . exists ( filename ) :
if not os . access ( filename , os . W_OK ) :
raise errors . FileError ( reason = _ ( ' Permission denied: %(file)s ' ) % dict ( file = filename ) )
else :
fp = open ( filename , ' w ' )
fp . close ( )
except ( IOError , OSError ) , e :
raise errors . FileError ( reason = str ( e ) )
2011-10-24 11:35:48 -05:00
2011-11-23 09:03:51 -06:00
def normalize_zonemgr ( zonemgr ) :
if not zonemgr :
# do not normalize empty or None value
return zonemgr
if ' @ ' in zonemgr :
# local-part needs to be normalized
name , at , domain = zonemgr . partition ( ' @ ' )
name = name . replace ( ' . ' , ' \\ . ' )
zonemgr = u ' ' . join ( ( name , u ' . ' , domain ) )
if not zonemgr . endswith ( ' . ' ) :
zonemgr = zonemgr + u ' . '
return zonemgr
2011-10-24 11:35:48 -05:00
2012-02-28 02:05:01 -06:00
def validate_dns_label ( dns_label , allow_underscore = False ) :
label_chars = r ' a-z0-9 '
underscore_err_msg = ' '
if allow_underscore :
label_chars + = " _ "
underscore_err_msg = u ' _, '
label_regex = r ' ^[ %(chars)s ]([ %(chars)s -]?[ %(chars)s ])*$ ' % dict ( chars = label_chars )
regex = re . compile ( label_regex , re . IGNORECASE )
2012-04-30 06:51:03 -05:00
if not dns_label :
raise ValueError ( _ ( ' empty DNS label ' ) )
2012-02-28 02:05:01 -06:00
if len ( dns_label ) > 63 :
raise ValueError ( _ ( ' DNS label cannot be longer that 63 characters ' ) )
if not regex . match ( dns_label ) :
raise ValueError ( _ ( ' only letters, numbers, %(underscore)s and - are allowed. ' \
2012-04-30 06:51:03 -05:00
' DNS label may not start or end with - ' ) \
2012-02-28 02:05:01 -06:00
% dict ( underscore = underscore_err_msg ) )
2012-03-27 08:15:20 -05:00
def validate_domain_name ( domain_name , allow_underscore = False ) :
2012-02-28 02:05:01 -06:00
if domain_name . endswith ( ' . ' ) :
domain_name = domain_name [ : - 1 ]
domain_name = domain_name . split ( " . " )
# apply DNS name validator to every name part
2012-03-27 08:15:20 -05:00
map ( lambda label : validate_dns_label ( label , allow_underscore ) , domain_name )
2012-02-28 02:05:01 -06:00
if not domain_name [ - 1 ] . isalpha ( ) :
# see RFC 1123
raise ValueError ( _ ( ' top level domain label must be alphabetic ' ) )
2011-10-24 11:35:48 -05:00
def validate_zonemgr ( zonemgr ) :
""" See RFC 1033, 1035 """
2012-04-30 06:51:03 -05:00
regex_local_part = re . compile ( r ' ^[a-z0-9]([a-z0-9-_]?[a-z0-9])*$ ' ,
2011-11-23 09:03:51 -06:00
re . IGNORECASE )
2012-04-30 06:51:03 -05:00
local_part_errmsg = _ ( ' mail account may only include letters, numbers, -, _ and a dot. There may not be consecutive -, _ and . characters. Its parts may not start or end with - or _ ' )
local_part_sep = ' . '
local_part = None
domain = None
2011-10-24 11:35:48 -05:00
if len ( zonemgr ) > 255 :
raise ValueError ( _ ( ' cannot be longer that 255 characters ' ) )
2011-11-23 09:03:51 -06:00
if zonemgr . endswith ( ' . ' ) :
zonemgr = zonemgr [ : - 1 ]
2011-10-24 11:35:48 -05:00
if zonemgr . count ( ' @ ' ) == 1 :
2011-11-23 09:03:51 -06:00
local_part , dot , domain = zonemgr . partition ( ' @ ' )
2011-10-24 11:35:48 -05:00
elif zonemgr . count ( ' @ ' ) > 1 :
raise ValueError ( _ ( ' too many \' @ \' characters ' ) )
else :
2011-11-23 09:03:51 -06:00
last_fake_sep = zonemgr . rfind ( ' \\ . ' )
if last_fake_sep != - 1 : # there is a 'fake' local-part/domain separator
2012-04-30 06:51:03 -05:00
local_part_sep = ' \\ . '
2011-11-23 09:03:51 -06:00
sep = zonemgr . find ( ' . ' , last_fake_sep + 2 )
2012-04-30 06:51:03 -05:00
if sep != - 1 :
local_part = zonemgr [ : sep ]
domain = zonemgr [ sep + 1 : ]
2011-11-23 09:03:51 -06:00
else :
local_part , dot , domain = zonemgr . partition ( ' . ' )
2011-10-24 11:35:48 -05:00
2012-04-30 06:51:03 -05:00
if not domain :
raise ValueError ( _ ( ' missing address domain ' ) )
2011-10-24 11:35:48 -05:00
2012-02-28 02:05:01 -06:00
validate_domain_name ( domain )
2011-11-09 10:35:52 -06:00
2012-04-30 06:51:03 -05:00
if not local_part :
raise ValueError ( _ ( ' missing mail account ' ) )
if not all ( regex_local_part . match ( part ) for part in \
local_part . split ( local_part_sep ) ) :
raise ValueError ( local_part_errmsg )
2012-03-27 08:15:20 -05:00
def validate_hostname ( hostname , check_fqdn = True , allow_underscore = False ) :
2012-01-06 08:12:41 -06:00
""" See RFC 952, 1123
: param hostname Checked value
: param check_fqdn Check if hostname is fully qualified
"""
2011-11-09 10:35:52 -06:00
if len ( hostname ) > 255 :
raise ValueError ( _ ( ' cannot be longer that 255 characters ' ) )
if hostname . endswith ( ' . ' ) :
hostname = hostname [ : - 1 ]
2012-02-28 02:05:01 -06:00
if ' . ' not in hostname :
if check_fqdn :
raise ValueError ( _ ( ' not fully qualified ' ) )
2012-03-27 08:15:20 -05:00
validate_dns_label ( hostname , allow_underscore )
2012-02-28 02:05:01 -06:00
else :
2012-03-27 08:15:20 -05:00
validate_domain_name ( hostname , allow_underscore )
2011-11-01 07:58:05 -05:00
2011-12-07 01:50:31 -06:00
def validate_sshpubkey ( ugettext , pubkey ) :
try :
algo , data , fp = decode_ssh_pubkey ( pubkey )
except ValueError :
return _ ( ' invalid SSH public key ' )
def output_sshpubkey ( ldap , dn , entry_attrs ) :
if ' ipasshpubkey ' in entry_attrs :
pubkeys = entry_attrs . get ( ' ipasshpubkey ' )
else :
entry = ldap . get_entry ( dn , [ ' ipasshpubkey ' ] )
pubkeys = entry [ 1 ] . get ( ' ipasshpubkey ' )
if pubkeys is None :
return
fingerprints = [ ]
for pubkey in pubkeys :
try :
algo , data , fp = decode_ssh_pubkey ( pubkey )
fp = u ' : ' . join ( [ fp [ j : j + 2 ] for j in range ( 0 , len ( fp ) , 2 ) ] )
fingerprints . append ( u ' %s ( %s ) ' % ( fp , algo ) )
except ValueError :
pass
if fingerprints :
entry_attrs [ ' sshpubkeyfp ' ] = fingerprints
def normalize_sshpubkeyfp ( value ) :
value = value . split ( ) [ 0 ]
value = unicode ( c for c in value if c in ' 0123456789ABCDEFabcdef ' )
return value
2011-11-01 07:58:05 -05:00
class cachedproperty ( object ) :
"""
A property - like attribute that caches the return value of a method call .
When the attribute is first read , the method is called and its return
value is saved and returned . On subsequent reads , the saved value is
returned .
Typical usage :
class C ( object ) :
@cachedproperty
def attr ( self ) :
return ' value '
"""
__slots__ = ( ' getter ' , ' store ' )
def __init__ ( self , getter ) :
self . getter = getter
self . store = WeakKeyDictionary ( )
def __get__ ( self , obj , cls ) :
if obj is None :
return None
if obj not in self . store :
self . store [ obj ] = self . getter ( obj )
return self . store [ obj ]
def __set__ ( self , obj , value ) :
raise AttributeError ( " can ' t set attribute " )
def __delete__ ( self , obj ) :
raise AttributeError ( " can ' t delete attribute " )
add session manager and cache krb auth
This patch adds a session manager and support for caching
authentication in the session. Major elements of the patch are:
* Add a session manager to support cookie based sessions which
stores session data in a memcached entry.
* Add ipalib/krb_utils.py which contains functions to parse ccache
names, format principals, format KRB timestamps, and a KRB_CCache
class which reads ccache entry and allows one to extract information
such as the principal, credentials, credential timestamps, etc.
* Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so
that all kerberos items are co-located.
* Modify javascript in ipa.js so that the IPA.command() RPC call
checks for authentication needed error response and if it receives
it sends a GET request to /ipa/login URL to refresh credentials.
* Add session_auth_duration config item to constants.py, used to
configure how long a session remains valid.
* Add parse_time_duration utility to ipalib/util.py. Used to parse the
session_auth_duration config item.
* Update the default.conf.5 man page to document session_auth_duration
config item (also added documentation for log_manager config items
which had been inadvertantly omitted from a previous commit).
* Add SessionError object to ipalib/errors.py
* Move Kerberos protection in Apache config from /ipa to /ipa/xml and
/ipa/login
* Add SessionCCache class to session.py to manage temporary Kerberos
ccache file in effect for the duration of an RPC command.
* Adds a krblogin plugin used to implement the /ipa/login
handler. login handler sets the session expiration time, currently
60 minutes or the expiration of the TGT, whichever is shorter. It
also copies the ccache provied by mod_auth_kerb into the session
data. The json handler will later extract and validate the ccache
belonging to the session.
* Refactored the WSGI handlers so that json and xlmrpc could have
independent behavior, this also moves where create and destroy
context occurs, now done in the individual handler rather than the
parent class.
* The json handler now looks up the session data, validates the ccache
bound to the session, if it's expired replies with authenicated
needed error.
* Add documentation to session.py. Fully documents the entire process,
got questions, read the doc.
* Add exclusions to make-lint as needed.
2012-02-06 12:29:56 -06:00
# regexp matching signed floating point number (group 1) followed by
# optional whitespace followed by time unit, e.g. day, hour (group 7)
time_duration_re = re . compile ( r ' ([-+]?(( \ d+)|( \ d+ \ . \ d+)|( \ . \ d+)|( \ d+ \ .))) \ s*([a-z]+) ' , re . IGNORECASE )
# number of seconds in a time unit
time_duration_units = {
' year ' : 365 * 24 * 60 * 60 ,
' years ' : 365 * 24 * 60 * 60 ,
' y ' : 365 * 24 * 60 * 60 ,
' month ' : 30 * 24 * 60 * 60 ,
' months ' : 30 * 24 * 60 * 60 ,
' week ' : 7 * 24 * 60 * 60 ,
' weeks ' : 7 * 24 * 60 * 60 ,
' w ' : 7 * 24 * 60 * 60 ,
' day ' : 24 * 60 * 60 ,
' days ' : 24 * 60 * 60 ,
' d ' : 24 * 60 * 60 ,
' hour ' : 60 * 60 ,
' hours ' : 60 * 60 ,
' h ' : 60 * 60 ,
' minute ' : 60 ,
' minutes ' : 60 ,
' min ' : 60 ,
' second ' : 1 ,
' seconds ' : 1 ,
' sec ' : 1 ,
' s ' : 1 ,
}
def parse_time_duration ( value ) :
'''
Given a time duration string , parse it and return the total number
of seconds represented as a floating point value . Negative values
are permitted .
The string should be composed of one or more numbers followed by a
time unit . Whitespace and punctuation is optional . The numbers may
be optionally signed . The time units are case insenstive except
for the single character ' M ' or ' m ' which means month and minute
respectively .
Recognized time units are :
* year , years , y
* month , months , M
* week , weeks , w
* day , days , d
* hour , hours , h
* minute , minutes , min , m
* second , seconds , sec , s
Examples :
" 1h " # 1 hour
" 2 HOURS, 30 Minutes " # 2.5 hours
" 1week -1 day " # 6 days
" .5day " # 12 hours
" 2M " # 2 months
" 1h:15m " # 1.25 hours
" 1h, -15min " # 45 minutes
" 30 seconds " # .5 minute
Note : Despite the appearance you can perform arithmetic the
parsing is much simpler , the parser searches for signed values and
adds the signed value to a running total . Only + and - are permitted
and must appear prior to a digit .
: parameters :
value : string
A time duration string in the specified format
: returns :
total number of seconds as float ( may be negative )
'''
matches = 0
duration = 0.0
for match in time_duration_re . finditer ( value ) :
matches + = 1
magnitude = match . group ( 1 )
unit = match . group ( 7 )
# Get the unit, only M and m are case sensitive
if unit == ' M ' : # month
seconds_per_unit = 30 * 24 * 60 * 60
elif unit == ' m ' : # minute
seconds_per_unit = 60
else :
unit = unit . lower ( )
seconds_per_unit = time_duration_units . get ( unit )
if seconds_per_unit is None :
raise ValueError ( ' unknown time duration unit " %s " ' % unit )
magnitude = float ( magnitude )
seconds = magnitude * seconds_per_unit
duration + = seconds
if matches == 0 :
raise ValueError ( ' no time duration found in " %s " ' % value )
return duration
2012-02-24 09:23:52 -06:00
2012-06-04 10:53:34 -05:00
def get_dns_forward_zone_update_policy ( realm , rrtypes = ( ' A ' , ' AAAA ' , ' SSHFP ' ) ) :
2012-02-24 09:23:52 -06:00
"""
2012-06-04 10:53:34 -05:00
Generate update policy for a forward DNS zone ( idnsUpdatePolicy
attribute ) . Bind uses this policy to grant / reject access for client
machines trying to dynamically update their records .
2012-02-24 09:23:52 -06:00
: param realm : A realm of the of the client
: param rrtypes : A list of resource records types that client shall be
allowed to update
"""
policy_element = " grant %(realm)s krb5-self * %(rrtype)s "
policies = [ policy_element % dict ( realm = realm , rrtype = rrtype ) \
for rrtype in rrtypes ]
policy = " ; " . join ( policies )
policy + = " ; "
return policy
2012-04-16 01:33:26 -05:00
2012-06-04 10:53:34 -05:00
def get_dns_reverse_zone_update_policy ( realm , reverse_zone , rrtypes = ( ' PTR ' , ) ) :
"""
Generate update policy for a reverse DNS zone ( idnsUpdatePolicy
attribute ) . Bind uses this policy to grant / reject access for client
machines trying to dynamically update their records .
: param realm : A realm of the of the client
: param reverse_zone : Name of the actual zone . All clients with IPs in this
sub - domain will be allowed to perform changes
: param rrtypes : A list of resource records types that client shall be
allowed to update
"""
policy_element = " grant %(realm)s krb5-subdomain %(zone)s %(rrtype)s "
policies = [ policy_element \
% dict ( realm = realm , zone = reverse_zone , rrtype = rrtype ) \
for rrtype in rrtypes ]
policy = " ; " . join ( policies )
policy + = " ; "
return policy
2012-04-16 01:33:26 -05:00
def validate_rdn_param ( ugettext , value ) :
try :
rdn = RDN ( value )
except Exception , e :
return str ( e )
return None
def validate_dn_param ( ugettext , value ) :
try :
rdn = DN ( value )
except Exception , e :
return str ( e )
return None