HEX
Server: LiteSpeed
System: Linux s1049.use1.mysecurecloudhost.com 4.18.0-477.27.2.lve.el8.x86_64 #1 SMP Wed Oct 11 12:32:56 UTC 2023 x86_64
User: xedaptot (3356)
PHP: 8.3.31
Disabled: NONE
$ pwd: /lib/python3.6/site-packages/ipapython/__pycache__/
Upload Files
File: //lib/python3.6/site-packages/ipapython/__pycache__/ipaldap.cpython-36.pyc
3

�d[eK�@slddlZddlZddlZddlZddlmZddlmZddlmZddl	Z	ddl
Z
ddlZddlZddl
mZddlmZddlmZddlZddlZddlZddlmZmZddlZddlZdd	lmZmZmZdd
lm Z ddl!m"Z"ddl#m$Z$m%Z%dd
l&m'Z'm(Z(ddl)m*Z*ddl+m,Z,ddl-m.Z.ej/�r<e0Z1ej2e3�Z4ej5j5id�Z6ej5j5id�Z7dZ8e9�Z:dZ;dZ<dZ=e9�Z>e9�Z?e9�Z@e'd8�ZAejB�r�eCed��r�ejDdejEd�dd�ZFdd�ZGd9d d!�ZHGd"d#�d#�ZIGd$d%�d%�ZJeJ�ZKGd&d'�d'e.�ZLGd(d)�d)e.�ZMGd*d+�d+eM�ZNGd,d-�d-eM�ZOGd.d/�d/�ZPd:d2d3�ZQGd4d5�d5�ZRGd6d7�d7eP�ZSdS);�N)�datetime)�Decimal)�deepcopy)�OrderedDict)�x509)�
serialization)�SimplePagedResultsControl�GetEffectiveRightsControl)�errorsr�_)�LDAP_GENERALIZED_TIME_FORMAT)�paths)�
format_netloc�CIDict)�DN�RDN)�DNSName)�	Principal)�MutableMappingZGSSAPIz
GSS-SPNEGOF����cn�directory manager�LDAPBytesWarning�ignore)�action�categorycCsdj|jd��S)z/Convert Kerberos realm name to 389-DS server id�-�.)�join�split)�
realm_name�r#�/usr/lib/python3.6/ipaldap.py�realm_to_serverid[sr%cCs"t|�}tj|f}dtj|�S)z(Get ldapi:// URI to 389-DS's Unix socketzldapi://)r%r
ZSLAPD_INSTANCE_SOCKET_TEMPLATE�ldapurlZ
ldapUrlEscape)r"ZserveridZ
socketnamer#r#r$�realm_to_ldapi_uri`sr'cCs~tj|�}|jtjtj�|jd�sz|rNtjj|�s@t	t
j|��|jtj|�|jtj
d�|jtjtj�|jtjd�|S)a�Wrapper around ldap.initialize()

    The function undoes global and local ldap.conf settings that may cause
    issues or reduce security:

    * Canonization of SASL host names is disabled.
    * With cacertfile=None, the connection uses OpenSSL's default verify
      locations, also known as system-wide trust store.
    * Cert validation is enforced.
    * SSLv2 and SSLv3 are disabled.
    zldapi://ir)�ldapZ
initialize�
set_option�OPT_X_SASL_NOCANONZOPT_ON�
startswith�os�path�isfile�IOError�errno�ENOENTZOPT_X_TLS_CACERTFILEZOPT_X_TLS_PROTOCOL_MINZOPT_X_TLS_REQUIRE_CERTZOPT_X_TLS_DEMANDZOPT_X_TLS_NEWCTX)�uri�
cacertfile�connr#r#r$�ldap_initializegs

	r5c@seZdZdZdd�ZdS)�
_ServerSchemaz?
    Properties of a schema retrieved from an LDAP server.
    cCs||_||_tj�|_dS)N)�server�schema�timeZretrieve_timestamp)�selfr7r8r#r#r$�__init__�sz_ServerSchema.__init__N)�__name__�
__module__�__qualname__�__doc__r;r#r#r#r$r6�sr6c@s2eZdZdZdd�Zddd�Zdd�Zd	d
�ZdS)
�SchemaCachez:
    Cache the schema's from individual LDAP servers.
    cCs
i|_dS)N)�servers)r:r#r#r$r;�szSchemaCache.__init__FcCsH|r|j|�|jj|�}|dkrB|j||�}t||�}||j|<|jS)a
        Return schema belonging to a specific LDAP server.

        For performance reasons the schema is retrieved once and
        cached unless force_update is True. force_update flushes the
        existing schema for the server from the cache and reacquires
        it.
        N)�flushrA�get�_retrieve_schema_from_serverr6r8)r:�urlr4�force_updateZ
server_schemar8r#r#r$�
get_schema�s



zSchemaCache.get_schemacCs2tjd|�y|j|=Wntk
r,YnXdS)Nzflushing %s from SchemaCache)�logger�debugrA�KeyError)r:rEr#r#r$rB�s
zSchemaCache.flushcCs|dk	st�tjd||�y^y|jdtjddgd�d}Wn:tjk
rttjd�|jd	tjddgd�d}YnXWn�tjk
r�tj	|d
d��Ynhtj
k
�r}zH|jddj�}|jdj
d
d�j�}tjd|d||fd��WYdd}~XnXtjj|d�S)a

        Retrieve the LDAP schema from the provided url and determine if
        User-Private Groups (upg) are configured.

        Bind using kerberos credentials. If in the context of the
        in-tree "lite" server then use the current ccache. If in the context of
        Apache then create a new ccache and bind using the Apache HTTP service
        principal.

        If a connection is provided then it the credentials bound to it are
        used. The connection is not closed when the request is done.
        Nz0retrieving schema for SchemaCache url=%s conn=%sz	cn=schema�attributetypes�
objectclasses)Zattrlistrz-cn=schema not found, fallback to cn=subschemazcn=subschemaz0LDAP Server Down, unable to retrieve LDAP schema)r2�error�desc�info�zuri=%sz&Unable to retrieve LDAP schema: %s: %s)rNrOr)�AssertionErrorrHrIZsearch_sr(�
SCOPE_BASE�NO_SUCH_OBJECT�SERVER_DOWNr
�NetworkError�	LDAPError�args�striprC�
DatabaseErrorr8Z	SubSchema)r:rEr4Zschema_entry�erNrOr#r#r$rD�s(





"z(SchemaCache._retrieve_schema_from_serverN)F)r<r=r>r?r;rGrBrDr#r#r#r$r@�s

r@c
seZdZdCZdZdD�fdd
�	Zedd��Zedd��Zej	dd��Zedd��Z
edd��Zdd�Zdd�Z
dd�Zdd�Zdd �Zd!d"�Zd#d$�Zd%d&�Zd'd(�Zd)d*�Zd+d,�Zd-d.�Zd/d0�Zd1d2�Zd3d4�Zd5d6�Zd7d8�Zd9d:�Zd;d<�ZdEd=d>�Zd?d@�Z dAdB�Z!�Z"S)F�	LDAPEntry�_conn�_dn�_names�_nice�_raw�_sync�	_not_list�	_orig_raw�	_raw_view�_single_value_viewNcs<tt|�j�t|t�r.|dks$t�|}|j}t|t�s<t�t|t�r\|dksRt�|}|j}t|t�sjt�|dkrvi}||_||_t	�|_
i|_i|_i|_
t�|_i|_d|_d|_t|t��r*t|j�|_t|j�|_|j|k�rt	|j
�|_
t|j�|_t|j�|_t|j
�|_
n|jj|j�i}|j|f|�dS)a�
        LDAPEntry constructor.

        Takes 1 to 3 positional arguments and an arbitrary number of keyword
        arguments. The 3 forms of positional arguments are:

          * LDAPEntry(entry) - create a shallow copy of an existing LDAPEntry.
          * LDAPEntry(dn, entry) - create a shallow copy of an existing
            LDAPEntry with a different DN.
          * LDAPEntry(conn, dn, mapping) - create a new LDAPEntry using the
            specified LDAPClient and DN and optionally initialize
            attributes from the specified mapping object.

        Keyword arguments can be used to override values of specific attributes.
        N)�superr[r;�
isinstancerQr\�
LDAPClientr]rrr^r_r`ra�setrbrcrdre�dictr4�raw�update)r:r\r]�_obj�kwargs)�	__class__r#r$r;�sD

zLDAPEntry.__init__cCs|jS)N)r\)r:r#r#r$r4-szLDAPEntry.conncCs|jS)N)r])r:r#r#r$�dn1szLDAPEntry.dncCst|t�st�||_dS)N)rgrrQr])r:�valuer#r#r$rp5scCs|jdkrt|�|_|jS)N)rd�RawLDAPEntryView)r:r#r#r$rk:s

z
LDAPEntry.rawcCs|jdkrt|�|_|jS)N)re�SingleValueLDAPEntryView)r:r#r#r$�single_value@s

zLDAPEntry.single_valuecCs:t|j�}|jdd�|jj�D��dt|�j|j|fS)Ncss"|]\}}|dk	r||fVqdS)Nr#)�.0�k�vr#r#r$�	<genexpr>Hsz%LDAPEntry.__repr__.<locals>.<genexpr>z
%s(%r, %r))rjr`rlr_�items�typer<r])r:�datar#r#r$�__repr__Fs
zLDAPEntry.__repr__cCst|�S)N)r[)r:r#r#r$�copyKszLDAPEntry.copycCs(|j|}t|t�st�|j|}t|t�s0t�|jj|ggf�\}}||krZ||krZdSt|�t|�}t|�t|�}t|�t|�}t|�t|�}	x,|D]$}
|jj	|
�}
|
|kr�q�|j
|
�q�Wxn|	D]f}
y|jj|
|�}
Wn8tk
�r}ztdj
||jd���WYdd}~XnX|
|k�r*q�|j
|
�q�Wx<t||jd�D]*}
|jj	|
�}
|
|	k�rf�qH|j|
��qHWx|t||jd�D]j}
y|jj|
|�}
Wn8tk
�r�}ztdj
||jd���WYdd}~XnX|
|k�r�q�|j|
��q�Wt|�t|�f|j|<t|�dk�r$|jj|�dS)Nz{error} in LDAP entry '{dn}')rMrp)�keyr)r_rg�listrQr`ra�
setdefaultrir\�encode�remove�decode�
ValueError�formatr]�sorted�index�appendr�lenrb�discard)r:�name�nicerkZ	nice_syncZraw_syncZ	nice_addsZ	nice_delsZraw_addsZraw_delsrqrZr#r#r$�
_sync_attrNsT



 

 
zLDAPEntry._sync_attrcCs6t|t�std|jj|f��t|t�r2|jd�}|S)Nz7attribute name must be unicode or str, got %s object %rzutf-8)rg�str�	TypeErrorror<�bytesr�)r:r�r#r#r$�
_attr_name�s


zLDAPEntry._attr_namecCs�||jkr|j|S|jjdk	r|tjr2|jd�}n|}|jjjtjj|�}|dk	r|x(|j	D]}tjrn|j
d�}||j|<qZW||j|<x6t|j�D](}|jj
|�|kr�|jj|�|j|<Pq�W|S)Nzutf-8)r^r\r8�six�PY2r��get_objr(�
AttributeType�namesr�rrcrC�pop)r:r�Zencoded_nameZattrtype�altnameZoldnamer#r#r$�_add_attr_name�s&



zLDAPEntry._add_attr_namecCs�|j|�}|j|�}t|t�s@|dkr,g}n|g}|jj|�n|jj|�|jj|�|k	r~||j|<d|j	|<|j
j|d�|j	|dk	r�|j|�dS)N)
r�r�rgrrb�addr�r_rCr`rar�r�)r:r�rqr#r#r$�	_set_nice�s




zLDAPEntry._set_nicecCs�|j|�}t|t�s*td||jj|f��x6t|�D]*\}}t|t�s4td|||jj|f��q4W|j|�}|j	j
|�|k	r�||j	|<d|j|<|jj
|d�|j|dk	r�|j|�dS)Nz'%s value must be list, got %s object %rz,%s[%d] value must be bytes, got %s object %r)r�rgrr�ror<�	enumerater�r�r`rCr_rar�r�)r:r�rq�i�itemr#r#r$�_set_raw�s 





zLDAPEntry._set_rawcCs|j||�dS)N)r�)r:r�rqr#r#r$�__setitem__�szLDAPEntry.__setitem__cCs|j|�}|j|}|S)N)r�r^)r:r�r#r#r$�_get_attr_name�s

zLDAPEntry._get_attr_namecCs�|j|�}|j|}|dkr*g}|j|<t|t�s8t�|j|dk	rP|j|�||jkr|t|�dksjt�|rx|d}nd}|S)Nrr)	r�r_rgrrQr`r�rbr�)r:r�rqr#r#r$�	_get_nice�s




zLDAPEntry._get_nicecCsT|j|�}|j|}|dkr*g}|j|<t|t�s8t�|j|dk	rP|j|�|S)N)r�r`rgrrQr_r�)r:r�rqr#r#r$�_get_raw�s


zLDAPEntry._get_rawcCs
|j|�S)N)r�)r:r�r#r#r$�__getitem__�szLDAPEntry.__getitem__cCsd|j|�}x*t|jj��D]\}}||kr|j|=qW|j|=|j|=|jj|d�|jj	|�dS)N)
r�rr^ryr_r`rar�rbr�)r:r�r�Zkeynamer#r#r$�__delitem__s
zLDAPEntry.__delitem__cCs6|jj�|jj�|jj�|jj�|jj�dS)N)r^�clearr_r`rarb)r:r#r#r$r�s




zLDAPEntry.clearcCs
t|j�S)N)r�r_)r:r#r#r$�__len__szLDAPEntry.__len__cCs
||jkS)N)r^)r:r�r#r#r$�__contains__szLDAPEntry.__contains__cCs||kS)Nr#)r:r�r#r#r$�has_keyszLDAPEntry.has_keycCst|t�stS||kS)N)rgr[�NotImplemented)r:�otherr#r#r$�__eq__s
zLDAPEntry.__eq__cCst|t�stS||k	S)N)rgr[r�)r:r�r#r#r$�__ne__!s
zLDAPEntry.__ne__cCs.|dkr|}t|t�st�tt|j��|_dS)N)rgr[rQrrjrkrc)r:r�r#r#r$�
reset_modlist&szLDAPEntry.reset_modlistcsg}t|�}|j|j�x�|D]�}|jj|g��|jj|g���r\�r\|jtj|df�q�rz�rz|jtj|�f�q�fdd��D�}�fdd��D�}|r�|j	j
|�r�t|�dkr�tj
|d��|jtj||f�q|r�|jtj||f�|r|jtj||f�qW|jdd�d�|S)	Ncsg|]}|�kr|�qSr#r#)rurq)�oldr#r$�
<listcomp>>sz.LDAPEntry.generate_modlist.<locals>.<listcomp>csg|]}|�kr|�qSr#r#)rurq)�newr#r$r�?sr)�attrcSs|dj�dkS)NrrK)�lower)�mr#r#r$�<lambda>Qsz,LDAPEntry.generate_modlist.<locals>.<lambda>)r~)rirlrcrkrCr�r(Z
MOD_DELETEZMOD_REPLACEr4�get_attribute_single_valuer�r
ZOnlyOneValueAllowedZMOD_ADD�sort)r:�modlistr�r�ZaddsZdelsr#)r�r�r$�generate_modlist,s0


zLDAPEntry.generate_modlistcCs
t|j�S)N)�iterr_)r:r#r#r$�__iter__UszLDAPEntry.__iter__)
r\r]r^r_r`rarbrcrdre)NN)N)#r<r=r>�	__slots__�__hash__r;�propertyr4rp�setterrkrtr|r}r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r��
__classcell__r#r#)ror$r[�s@;5

)r[c@sHeZdZdZdd�Zdd�Zdd�Zdd	�Zd
d�Zdd
�Z	dd�Z
dS)�
LDAPEntryView�_entrycCst|t�st�||_dS)N)rgr[rQr�)r:�entryr#r#r$r;\szLDAPEntryView.__init__cCs|j|=dS)N)r�)r:r�r#r#r$r�`szLDAPEntryView.__delitem__cCs|jj�dS)N)r�r�)r:r#r#r$r�cszLDAPEntryView.clearcCs
t|j�S)N)r�r�)r:r#r#r$r�fszLDAPEntryView.__iter__cCs
t|j�S)N)r�r�)r:r#r#r$r�iszLDAPEntryView.__len__cCs
||jkS)N)r�)r:r�r#r#r$r�lszLDAPEntryView.__contains__cCs||kS)Nr#)r:r�r#r#r$r�oszLDAPEntryView.has_keyN)r�)r<r=r>r�r;r�r�r�r�r�r�r#r#r#r$r�Ysr�c@seZdZdd�Zdd�ZdS)rrcCs|jj|�S)N)r�r�)r:r�r#r#r$r�sszRawLDAPEntryView.__getitem__cCs|jj||�dS)N)r�r�)r:r�rqr#r#r$r�vszRawLDAPEntryView.__setitem__N)r<r=r>r�r�r#r#r#r$rrrsrrc@seZdZdd�Zdd�ZdS)rscCsL|j|}t|t�s|S|s dSt|�dkr4|dStd|t|�f��dS)Nrrz%s has %s values, one expected)r�rgrr�r�)r:r�rqr#r#r$r�zs

z$SingleValueLDAPEntryView.__getitem__cCs$|dkrd|j|<n|g|j|<dS)N)r�)r:r�rqr#r#r$r��sz$SingleValueLDAPEntryView.__setitem__N)r<r=r>r�r�r#r#r#r$rsys
rsc+@s�eZdZdZdZdZdZejZej	Z	ej
Z
eeeeeeee
eeeeeeee
e
e
e
e
e
e
e
e
e
ee
e
e
e
e
e
ee
e
eeee
e
eed�*Zee
e
e
e
e
eeeeeeejejejejeeeed��Zedddddddddd�	�ZdfZd
Zdgd
d�Zedd��Zeejdfdd��Zedd��Z dd�Z!dd�Z"e#dd��Z$e#dd��Z%dd�Z&dd �Z'd!d"�Z(d#d$�Z)d%d&�Z*d'd(�Z+d)d*�Z,d+d,�Z-e.j/dhd-d.��Z0e1d/d0��Z2e#d1d2��Z3did3d4�Z4d5d6�Z5d7d8�Z6d9d:�Z7d;d<�Z8djd=d>�Z9dkd?d@�Z:dldAdB�Z;dCdD�Z<dmdEdF�Z=dndHdI�Z>dodJdK�Z?edpdLdM��Z@edqdNdO��ZAedrdPdQ��ZBej
dddfdRdS�ZCdddej
ddddfdTdU�ZDdVdW�ZEdsdXdY�ZFdtdZd[�ZGd\d]�ZHdud^d_�ZId`da�ZJdbdc�ZKddde�ZLdS)vrha�LDAP backend class

    This class abstracts a LDAP connection, providing methods that work with
    LADPEntries.

    The purpose of this class is to provide a boundary between IPA and
    python-ldap. In IPA we use IPA defined types because they are
    richer and are designed to meet our needs. We also require that we
    consistently use those types without exception. On the other hand
    python-ldap uses different types. The goal is to be able to have
    IPA code call python-ldap methods using the types native to
    IPA. This class accomplishes that goal by exposing python-ldap
    methods which take IPA types, convert them to python-ldap types,
    call python-ldap, and then convert the results returned by
    python-ldap into IPA types.
    �|�&�!)*z1.3.6.1.4.1.1466.115.121.1.1z1.3.6.1.4.1.1466.115.121.1.4z1.3.6.1.4.1.1466.115.121.1.5z1.3.6.1.4.1.1466.115.121.1.7z1.3.6.1.4.1.1466.115.121.1.8z1.3.6.1.4.1.1466.115.121.1.9z1.3.6.1.4.1.1466.115.121.1.10z1.3.6.1.4.1.1466.115.121.1.12z1.3.6.1.4.1.1466.115.121.1.23z1.3.6.1.4.1.1466.115.121.1.24z1.3.6.1.4.1.1466.115.121.1.28z1.3.6.1.4.1.1466.115.121.1.40z1.3.6.1.4.1.1466.115.121.1.49z1.3.6.1.4.1.1466.115.121.1.51z1.3.6.1.4.1.5322.21.2.5z2.16.840.1.113730.3.8.3.3z2.16.840.1.113730.3.8.3.18z2.16.840.1.113730.3.8.3.5z2.16.840.1.113730.3.8.3.7z2.16.840.1.113730.3.8.3.20z2.16.840.1.113730.3.8.11.4z2.16.840.1.113730.3.8.11.21z2.16.840.1.113730.3.8.11.22z2.16.840.1.113730.3.8.7.1z2.16.840.1.113730.3.8.7.2z2.16.840.1.113719.1.301.4.6.1z2.16.840.1.113719.1.301.4.14.1z2.16.840.1.113719.1.301.4.17.1z2.16.840.1.113719.1.301.4.18.1z2.16.840.1.113719.1.301.4.26.1z2.16.840.1.113719.1.301.4.29.1z2.16.840.1.113719.1.301.4.36.1z2.16.840.1.113719.1.301.4.37.1z2.16.840.1.113719.1.301.4.40.1z2.16.840.1.113719.1.301.4.41.1z2.16.840.1.113719.1.301.4.45.1z2.16.840.1.113719.1.301.4.48.1z2.16.840.1.113719.1.301.4.49.1z2.16.840.1.113719.1.301.4.52.1z2.16.840.1.113719.1.301.4.53.1z2.16.840.1.113730.3.8.16.1.3z2.16.840.1.113730.3.8.16.1.4)ZmanagedtemplateZmanagedbaseZmemberindirectZmemberofindirectZoriginscope�idnsnameZidnssoamnameZidnssoarnameZdnszoneidnsnameZkrbcanonicalnameZkrbprincipalname�usercertificatezusercertificate;binaryZ
cACertificatezcACertificate;binaryZnsds5replicalastupdatestartZnsds5replicalastupdateendZnsds5replicalastinitstartZnsds5replicalastinitendT)	znsslapd-ssl-check-hostnameznsslapd-lookthroughlimitznsslapd-idlistscanlimitznsslapd-anonlimitsdnznsslapd-minssf-exclude-rootdseznsslapd-enable-upgrade-hashznsslapd-db-locksz%nsslapd-logging-hr-timestamps-enabledznsslapd-sizelimitg�?rFNcCsb|dk	r||_|jdkst�||_||_||_||_||_||_d|_	d|_
|dk	r^|j�|_dS)a�Create LDAPClient object.

        :param ldap_uri: The LDAP URI to connect to
        :param start_tls: Use STARTTLS
        :param force_schema_updates:
            If true, this object will always request a new schema from the
            server. If false, a cached schema will be reused if it exists.

            Generally, it should be true if the API context is 'installer' or
            'updates', but it must be given explicitly since the API object
            is not always available
        :param no_schema: If true, schema is never requested from the server.
        :param decode_attrs:
            If true, attributes are decoded to Python types according to their
            syntax.
        N�ldaps�ldapir(F>r(r�r�)
�ldap_uri�protocolrQ�
_start_tls�_force_schema_updates�
_no_schema�
_decode_attrs�_cacert�
_sasl_nocanon�_has_schema�_schema�_connectr\)r:r��	start_tls�force_schema_updates�	no_schema�decode_attrs�cacert�sasl_nocanonr#r#r$r;szLDAPClient.__init__cKst|�}||fddd�|��S)z;Create a LDAPI connection to local 389-DS instance
        FN)r�r�)r')�clsr"rnr2r#r#r$�
from_realm+szLDAPClient.from_realmcKs8|rdt|d�}ndt|d�}||f||d�|��S)a�Create LDAP or LDAPS connection to a remote 389-DS instance

        This constructor is opinionated and doesn't let you shoot yourself in
        the foot. It always creates a secure connection. By default it
        returns a LDAP connection to port 389 and performs STARTTLS using the
        default CA cert. With start_tls=False, it creates a LDAPS connection
        to port 636 instead.

        Note: Microsoft AD does not support SASL encryption and integrity
        verification with a TLS connection. For AD, use a plain connection
        with GSSAPI and a MIN_SSF >= 56. SASL GSSAPI and SASL GSS SPNEGO
        ensure data integrity and confidentiality with SSF > 1. Also see
        https://msdn.microsoft.com/en-us/library/cc223500.aspx
        z	ldap://%si�z
ldaps://%si|)r�r�)r)r��hostnamer�r�rnr2r#r#r$�from_hostname_secure2szLDAPClient.from_hostname_securecKs2d|kst�d|kst�dt|d�}||f|�S)z�Create a plain LDAP connection with TLS/SSL

        Note: A plain TLS connection should only be used in combination with
        GSSAPI bind.
        r�r�z	ldap://%si�)rQr)r�r�rnr2r#r#r$�from_hostname_plainIszLDAPClient.from_hostname_plaincCs|jS)N)r�)r:r#r#r$�__str__UszLDAPClient.__str__cs6t|t�st�t|�}�fdd�|D�}�jj||�S)Ncs"g|]\}}}||�j|�f�qSr#)r�)ru�a�b�c)r:r#r$r�\sz'LDAPClient.modify_s.<locals>.<listcomp>)rgrrQr�r4�modify_s)r:rpr�r#)r:r$r�XszLDAPClient.modify_scCs|jS)N)r\)r:r#r#r$r4_szLDAPClient.conncCs |jr|jjdd�dSdSdS)Nz://rr)r�r!)r:r#r#r$r�cszLDAPClient.protocolcCsl|jr
dS|jsfytj|j|j|jd�}Wntjt	fk
rHd}YnXt
j|d|�t
j|dd�|jS)N)rFr�r�T)
r�r��schema_cacherGr�r4r�r
ZExecutionError�
IndexError�object�__setattr__r�)r:r8r#r#r$�_get_schemajs
zLDAPClient._get_schemacCs tj|dd�tj|dd�dS)zr
        Force this instance to forget it's cached schema and reacquire
        it from the schema cache.
        r�Fr�N)r�r�)r:r#r#r$�
_flush_schema|szLDAPClient._flush_schemacCs||js
tStjr$t|t�r$|jd�}||jkr8|j|S|j�}|dk	rx|j	t
jj|�}|dk	rx|j
|jkrx|j|j
StS)Nzutf-8)r�r�r�r�rg�unicoder��_SYNTAX_OVERRIDEr�r�r(r8r�Zsyntax�_SYNTAX_MAPPING)r:�name_or_oidr8�objr#r#r$�get_attribute_type�s



zLDAPClient.get_attribute_typecCs|j|�tkS)zf
        Check the schema to see if the attribute uses DN syntax.

        Returns True/False
        )r�r)r:r�r#r#r$�
has_dn_syntax�szLDAPClient.has_dn_syntaxcCs`tjrt|t�r|jd�}||jkr.|j|S|j�}|dk	r\|jtj	j
|�}|dk	r\|jSdS)z�
        Check the schema to see if the attribute is single-valued.

        If the attribute is in the schema then returns True/False

        If there is a problem loading the schema or the attribute is
        not in the schema return None
        zutf-8N)r�r�rgr�r��_SINGLE_VALUE_OVERRIDEr�r�r(r8r�rt)r:r�r8r�r#r#r$r��s	


z%LDAPClient.get_attribute_single_valuecs"t|t�r|rdSdS�nt|tttttf�r<t|�jd�St|t	�rT|j
�jd�St|t�rb|St|t�r~�fdd�|D�St|t
�r�t
�fdd�|D��St|t�r�t�fd	d�|j�D��}|St|t�r�|jt�jd�St|tj��r�|jtjj�S|d
k�r
d
Std|t|�f��d
S)zL
        Encode attribute value to LDAP representation (str/bytes).
        sTRUEsFALSEzutf-8�asciicsg|]}�j|��qSr#)r�)rur�)r:r#r$r��sz%LDAPClient.encode.<locals>.<listcomp>c3s|]}�j|�VqdS)N)r�)rur�)r:r#r$rx�sz$LDAPClient.encode.<locals>.<genexpr>c3s |]\}}|�j|�fVqdS)N)r�)rurvrw)r:r#r$rx�sNz:attempt to pass unsupported type to ldap, value=%s type=%s)rg�boolr��intrrrr�r�rZto_textr�r�tuplerjryr�strftimer�crypto_x509�Certificate�public_bytesr�Encoding�DERr�rz)r:�val�dctr#)r:r$r��s0







zLDAPClient.encodecs~t|t�r�j��}y�|tkr"|S|tkr4|jd�S|tkrJ|jd�dkS|tkrdtj|jd�t�S|t	kr|t	j
|jd��S|ttfkr�||jd��S|t
jkr�tj|�S||�SWn6tk
r�d�||f}tjd|�t|��YnXn�t|t��r��fdd�|D�St|t��r2t��fdd�|D��St|t��rX�fd	d
�|j�D�}|S|dk�rfdStd|t|�f��dS)
zN
        Decode attribute value from LDAP representation (str/bytes).
        zutf-8ZTRUEz6unable to convert the attribute %r value %r to type %sz%scsg|]}�j|���qSr#)r�)rur�)r�r:r#r$r�
sz%LDAPClient.decode.<locals>.<listcomp>c3s|]}�j|��VqdS)N)r�)rur�)r�r:r#r$rxsz$LDAPClient.decode.<locals>.<genexpr>cs$i|]\}}�j||�|jd��qS)zutf-8)r�)rurvrw)r:r#r$�
<dictcomp>sz%LDAPClient.decode.<locals>.<dictcomp>Nz<attempt to pass unsupported type from ldap, value=%s type=%s)rgr�r�r�r�r�rZstrptimerrZ	from_textrrr�r�rZload_der_x509_certificate�	ExceptionrHrMr�rr�rjryr�rz)r:r�r�Ztarget_type�msgr�r#)r�r:r$r��sD






zLDAPClient.decodec
Cs�g}x�|D]z}|d}|d}|dkrDdjt|�d�}tjd|�q
t|t|��}x|j�D]\}}	|	|j|<q\W|j�|j	|�q
Wt
r�tjd|�|S)a�
        result is a python-ldap result tuple of the form (dn, attrs),
        where dn is a string containing the dn (distinguished name) of
        the entry, and attrs is a dictionary containing the attributes
        associated with the entry. The keys of attrs are strings, and
        the associated values are lists of strings.

        We convert the tuple to an LDAPEntry object.
        rrNzReferral entry ignored: {ref})�refz%szldap.result: %s)r�r�rHrIr[rryrkr�r��_debug_log_ldap)
r:�resultZ
ipa_resultZdn_tupleZoriginal_dnZoriginal_attrsZlog_msgZ	ipa_entryr��original_valuesr#r#r$�_convert_results"
zLDAPClient._convert_resultccsy�y
dVWn~tjk
r*tj��Ynbtjk
r�}zD|jddj�}|jdjdd�j�}|dk	rxd||f}�WYdd}~XnXW�n�tjk
r�tj	|p�dd��Y�n`tj
k
r�tj��Y�nBtjk
r�tj|d	��Y�n tj
k
�r8d
}|j|��r$tj��ntj||d��Y�n�tjk
�r\tj|d��Y�n�tjk
�r�tjd
||fd��Y�n�tjk
�r�tjd||fd��Y�ndtjk
�r�tj��Y�nDtjk
�r�tj|d��Y�n tjk
�rtj|d��Y�n�tjk
�r<tj��Y�n�tjk
�r\tj��Y�n�tjk
�r|tj��Y�n�tj k
�r�tj!|d��Y�nxtj"k
�r�tj#|d��Y�nTtj$k
�r�tj%��Y�n4tj&k
�rtj'|j(|d��Y�ntj)k
�r.tj|d��Yn�tj*k
�rDYn�tj+k
�rhtj||d��Yn�tj,k
�r�tj||d��Yn�tj-k
�r�tjd||fd��Ynbtjk
�r}zBd|k�r�tjdd��t.j/dt0|�j1t2|��tj||d��WYdd}~XnXdS)z0Context manager that handles LDAPErrors
        NrrNrOrPz%s arguments: %sz
no such entry)�reason)�messagez:Another entry with the same attribute value already exists)rNrO)rOz%s %sz%s: %s)r�)r2rMz%s (%s)ZNOT_ALLOWED_TO_DELEGATEz$KDC returned NOT_ALLOWED_TO_DELEGATEzUnhandled LDAPError: %s: %s)3r(ZTIMEOUTr
ZDatabaseTimeoutrVrWrXrCrS�NotFoundZALREADY_EXISTSZDuplicateEntryZTYPE_OR_VALUE_EXISTSZCONSTRAINT_VIOLATIONr+rYZINSUFFICIENT_ACCESSZACIErrorZINVALID_CREDENTIALSZINAPPROPRIATE_AUTHZNO_SUCH_ATTRIBUTEZMidairCollisionZINVALID_SYNTAXZ
InvalidSyntaxZOBJECT_CLASS_VIOLATIONZObjectclassViolation�ADMINLIMIT_EXCEEDED�AdminLimitExceeded�SIZELIMIT_EXCEEDED�SizeLimitExceeded�TIMELIMIT_EXCEEDED�TimeLimitExceededZNOT_ALLOWED_ON_RDNZNotAllowedOnRDNZFILTER_ERRORZBadSearchFilterZNOT_ALLOWED_ON_NONLEAFZNotAllowedOnNonLeafrTrUr�ZLOCAL_ERROR�SUCCESSZ
CONNECT_ERRORZUNWILLING_TO_PERFORMZAUTH_UNKNOWNrHrIrzr<r�)r:Zarg_descrZrNrOZ_msgr#r#r$�
error_handler?s�


zLDAPClient.error_handlercCsJ|sdS|tkrtj��n,|tkr,tj��n|tkr>tj��ntj��dS)N)�TRUNCATED_ADMIN_LIMITr
r�TRUNCATED_SIZE_LIMITr�TRUNCATED_TIME_LIMITr�LimitsExceeded)�	truncatedr#r#r$�handle_truncated_result�s


z"LDAPClient.handle_truncated_resultcCs|j�S)z'schema associated with this LDAP server)r�)r:r#r#r$r8�szLDAPClient.schemacCsz|jdkrdSg}xP|D]H}|jjtjj|�}|dk	rH||j|j7}q|rtjtd�|d��qWdd�t	t
|��D�S)Nzobjectclass %s not found)rcSsg|]}t|�j��qSr#)r�r�)rur�r#r#r$r��sz5LDAPClient.get_allowed_attributes.<locals>.<listcomp>)r8r�r(ZObjectClassZmustZmayr
r
rrri)r:rLZraise_on_unknownZallowed_attributesZocr�r#r#r$�get_allowed_attributes�s

z!LDAPClient.get_allowed_attributescCs|S)Nr#)r:r#r#r$�	__enter__�szLDAPClient.__enter__cCs|j�dS)N)�close)r:�exc_type�	exc_value�	tracebackr#r#r$�__exit__�szLDAPClient.__exit__cCs
d|_dS)z'
        Close the connection.
        N)r\)r:r#r#r$r�szLDAPClient.closecCsV|j��Dt|j|jd�}|js0|jtjtj�|j	rH|j
dkrH|j�WdQRX|S)N)r3r()rr5r�r�r�r)r(r*ZOPT_OFFr�r�Zstart_tls_s)r:r4r#r#r$r��s
zLDAPClient._connectcCsv|jdkr$|jr$|r$|r$td��|j��@|j�t|t�sDt�t|�}|j	|�}|j
j||||�WdQRXdS)z0
        Perform simple bind operation.
        r(z)simple_bind over insecure LDAP connectionN)r�r�r�rr�rgrrQr�r�r4Z
simple_bind_s)r:�bind_dnZ
bind_password�server_controls�client_controlsZ
insecure_bindr#r#r$�simple_bind�s


zLDAPClient.simple_bindcCsNtjtj��j}|j��,tjj|�}|j	�|j
jd|||�WdQRXdS)zP
        Perform SASL bind operation using the SASL EXTERNAL mechanism.
        rPN)�pwd�getpwuidr,�geteuidZpw_namerr(�saslZexternalr�r4�sasl_interactive_bind_s)r:r!r"Z	user_name�auth_tokensr#r#r$�
external_bind�s
zLDAPClient.external_bindcCsF|j��4|jdkrt}nt}|j�|jjd|||�WdQRXdS)zN
        Perform SASL bind operation using the SASL GSSAPI mechanism.
        r�rPN)rr��SASL_GSS_SPNEGO�SASL_GSSAPIr�r4r()r:r!r"r)r#r#r$�gssapi_bind�s

zLDAPClient.gssapi_bindc	Cs*|j��|j�|jj�WdQRXdS)z+
        Perform unbind operation.
        N)rr�r4Zunbind_s)r:r#r#r$�unbind�s
zLDAPClient.unbindcCs2|dkrt�}t|ttf�r$|d}t||f|�S)z�
        Make distinguished name from attribute.

        Keyword arguments:
        parent_dn -- DN of the parent entry (default '')
        Nr)rrgrr�)r:r�rq�	parent_dnr#r#r$�make_dn_from_attr�s
zLDAPClient.make_dn_from_attrrcCs,||kst�t|t�st�t|||f|�S)z�
        Make distinguished name from entry attributes.

        Keyword arguments:
        primary_key -- attribute from which to make RDN (default 'cn')
        parent_dn -- DN of the parent entry (default '')
        )rQrgr)r:�entry_attrsZprimary_keyr/r#r#r$�make_dn
s	zLDAPClient.make_dncKst|||f|�S)N)r[)r:r]rmrnr#r#r$�
make_entryszLDAPClient.make_entrycCs�t|ttf�st�dd�|D�}|rF||jkrFd|j|j||j�fSt|�dkr\d|}nd}x*|D]"}|jd�s|d|}d	||f}qfWt|�dkr�d
|}|S)z�
        Combine filters into one for ldap2.find_entries.

        Keyword arguments:
        rules -- see ldap2.make_filter
        cSsg|]}|r|�qSr#r#)ruZfxr#r#r$r�0sz.LDAPClient.combine_filters.<locals>.<listcomp>z(%s%s)rz(%srP�(z(%s)z%s%sz%s))	rgrr�rQ�
MATCH_NONE�combine_filters�	MATCH_ANYr�r+)r��filters�rulesZflt�fr#r#r$r6%s	


zLDAPClient.combine_filtersc	s$t�ttf�r4�����fdd��D�}�j||�S�dk	�r t�tj�rX�jtjj	��t�t
�r�tj��j
d��dj�fdd�tjjdt��d�D���n6t�t�r��jt��tjj���nt���tjj�����s�d	}�r�d
|}�r�|d
}|��|�jk�rd��fSd��fSd
S)a]
        Make filter for ldap2.find_entries from attribute.

        Keyword arguments:
        rules -- see ldap2.make_filter
        exact -- boolean, True - make filter as (attr=value)
                          False - make filter as (attr=*value*)
        leading_wildcard -- boolean:
            True - allow heading filter wildcard when exact=False
            False - forbid heading filter wildcard when exact=False
        trailing_wildcard -- boolean:
            True - allow trailing filter wildcard when exact=False
            False - forbid trailing filter wildcard when exact=False
        c	s g|]}�j�|���d��qS))�exact�leading_wildcard�trailing_wildcard)�make_filter_from_attr)rurw)r�r�r;r<r=r#r$r�Usz4LDAPClient.make_filter_from_attr.<locals>.<listcomp>Nr��\c3s|]}�||d�VqdS)rNr#)rur�)rqr#r$rxcsz3LDAPClient.make_filter_from_attr.<locals>.<genexpr>rz%s�*z
(!(%s=%s))z(%s=%s)rP���)rgrr�r6r�r�r�rr�r�r��binasciiZhexlifyr�r r�Zmoves�ranger�rr�rr(�filterZescape_filter_charsr�r5)	r�r�rqr9r;r<r=�flts�templater#)r�r�r;r<r=rqr$r>As8

&
z LDAPClient.make_filter_from_attrc
	Cs�||jkr|j}n|}g}|dkrTxl|j�D]"\}	}
|j|j|	|
||||��q,Wn<x:|D]2}|j|d�}|dk	rZ|j|j||||||��qZW|j||�S)a�
        Make filter for ldap2.find_entries from entry attributes.

        Keyword arguments:
        attrs_list -- list of attributes to use, all if None (default None)
        rules -- specifies how to determine a match (default ldap2.MATCH_ANY)
        exact -- boolean, True - make filter as (attr=value)
                          False - make filter as (attr=*value*)
        leading_wildcard -- boolean:
            True - allow heading filter wildcard when exact=False
            False - forbid heading filter wildcard when exact=False
        trailing_wildcard -- boolean:
            True - allow trailing filter wildcard when exact=False
            False - forbid trailing filter wildcard when exact=False

        rules can be one of the following:
        ldap2.MATCH_NONE - match entries that do not match any attribute
        ldap2.MATCH_ALL - match entries that match all attributes
        ldap2.MATCH_ANY - match entries that match any of attribute
        N)r5r7ryr�r>rCr6)
r�r1�
attrs_listr9r;r<r=Zmake_filter_rulesrErvrwr�rqr#r#r$�make_filterxs$

zLDAPClient.make_filterc
Ksj|jf|||||d�|��\}}y|j|�Wn6tjk
rd}	ztjd|	||��WYdd}	~	XnX|S)a�Return a list of matching entries.

        :raises: errors.LimitsExceeded if the list is truncated by the server
        :raises: errors.NotFound if result set is empty
                                 or base_dn doesn't exist

        :param base_dn: dn of the entry at which to start the search
        :param scope: search scope, see LDAP docs (default ldap2.SCOPE_SUBTREE)
        :param filter: LDAP filter to apply
        :param attrs_list: ist of attributes to return, all if None (default)
        :param get_effective_rights: use GetEffectiveRights control
        :param kwargs: additional keyword arguments. See find_entries method
        for their description.
        )�base_dn�scoperDrG�get_effective_rightsz2%s while getting entries (base DN: %s, filter: %s)N)�find_entriesrr
rrHrM)
r:rIrJrDrGrKrn�entriesrrZr#r#r$�get_entries�s
zLDAPClient.get_entriesc	.Cs|dkrt�}t|t�st�|s$d}g}	d}
|dkr:|j}|dkrFd}|dkrT|j}t|t�sft|�}t|t�sxt|�}|r�dd�t|�D�}g}|r�|j|j	��d}|dkr�|nd	d
}
|
dkr�d}|j
��� tjr�|j
|�}|j
|�}�x�|�r|td|
|�g}n
|�pd}y�|jjt|�||||||d�}xL|jj|d�}|\}}}}|tjk�r`P|j|�}|�r8|	j|d��q8W|�r�x&|D]}t|t��r�|j}P�q�Wd}W�n"tjk
�r�t}
PY�ntjk
�r�t}
PYn�tjk
�rt}
PYn�tjk
�r�}z�|�r�|�r�tdd|�g}y"|jjt|�||||||d�Wn2tjk
�r�}ztj d|�WYdd}~XnXd}y|�Wn(tjtjtjfk
�r�d
}
PYnXWYdd}~XnX|�s�|r�Pq�WWdQRX|	�r|
�rt!j"dd��|	|
fS)a%
        Return a list of entries and indication of whether the results were
        truncated ([(dn, entry_attrs)], truncated) matching specified search
        parameters followed by truncated flag. If the truncated flag is True,
        search hit a server limit and its results are incomplete.

        Keyword arguments:
        :param attrs_list: list of attributes to return, all if None
                           (default None)
        :param base_dn: dn of the entry at which to start the search
                        (default '')
        :param scope: search scope, see LDAP docs (default ldap2.SCOPE_SUBTREE)
        :param time_limit: time limit in seconds (default unlimited)
        :param size_limit: size (number of entries returned) limit
                           (default unlimited)
        :param paged_search: search using paged results control
        :param get_effective_rights: use GetEffectiveRights control

        :raises: errors.NotFound if result set is empty
                                 or base_dn doesn't exist
        Nz(objectClass=*)Frg�?cSsg|]}|j��qSr#)r�)rur�r#r#r$r��sz+LDAPClient.find_entries.<locals>.<listcomp>rPi�r)ZserverctrlsZtimeoutZ	sizelimitz!Error cancelling paged search: %sTzno matching entry found)rg�)#rrgrQ�
time_limit�
size_limitr��floatrir��)_LDAPClient__get_effective_rights_controlrr�r�r�rr4Z
search_extr�Zresult3r(ZRES_SEARCH_RESULTr�cookierrr
rrrrVZsearch_ext_srHZwarningr
�EmptyResult)r:rDrGrIrJrOrPZpaged_searchrK�resrZbase_sctrlsrSZ	page_sizeZsctrls�idrZobjtypeZres_listZ_res_idZ	res_ctrlsZctrlrZZe2r#r#r$rL�s�








zLDAPClient.find_entriescCs(|jj�dd�}tddj|�jd��S)z8Construct a GetEffectiveRights control for current user.�NTzdn: {0}zutf-8)r4Zwhoami_sr	r�r�)r:r r#r#r$Z__get_effective_rights_controlKsz)LDAPClient.__get_effective_rights_controlc	Csl|dkrt�}t|t�st�||d|i}|j||jd�}|j|||d�}t|�dkrdtjt|�d��|dS)a
        Find entry (dn, entry_attrs) by attribute and object class.

        Keyword arguments:
        attrs_list - list of attributes to return, all if None (default None)
        base_dn - dn of the entry at which to start the search (default '')
        NZobjectClass)r9)rDrGr)�foundr)	rrgrQrH�	MATCH_ALLrNr�r
ZSingleMatchExpected)	r:r�rqZobject_classrGrIZ	search_kwrDrMr#r#r$�find_entry_by_attrQs
zLDAPClient.find_entry_by_attrc	Cs0t|t�st�|j||jd||||d�}|dS)z�
        Get entry (dn, entry_attrs) by dn.

        Keyword arguments:
        attrs_list - list of attributes to return, all if None (default None)
        N)rOrPrKr)rgrrQrNrR)r:rprGrOrPrKrMr#r#r$�	get_entryis
	
zLDAPClient.get_entrycCs^tdd�|jj�D��}|j��,|j|�}|jjt|j�t	|j���WdQRX|j
�dS)zPCreate a new entry.

        This should be called as add_entry(entry).
        css|]\}}|r||fVqdS)Nr#)rurvrwr#r#r$rx�sz'LDAPClient.add_entry.<locals>.<genexpr>N)rjrkryrr�r4Zadd_sr�rprr�)r:r��attrsr#r#r$�	add_entry{s


&zLDAPClient.add_entryc
Cs�t|t�st�t|t�st�||kr,tj��|d}|dd�|dd�krRd}ntt|dd���}|j��0|jjt|�t|�|t	|�d�t
jd�WdQRXdS)a�
        Move an entry (either to a new superior or/and changing relative distinguished name)

        Keyword arguments:
        dn: DN of the source entry
        new_dn: DN of the target entry
        del_old -- delete old RDN value (default True)

        :raises:
        errors.NotFound if source entry or target superior entry doesn't exist
        errors.EmptyModlist if source and target are identical
        rrN)ZnewsuperiorZdeloldg333333�?)rgrrQr
�EmptyModlistr�rr4Zrename_sr�r9Zsleep)r:rp�new_dn�del_oldZnew_rdnZnew_superiorr#r#r$�
move_entry�s

zLDAPClient.move_entryc
sf|j�}|stj��tjd|��j��,�fdd�|D�}�jjt|j	�|�WdQRX|j
�dS)zZUpdate entry's attributes.

        This should be called as update_entry(entry).
        zupdate_entry modlist %scs&g|]\}}}|t|��j|�f�qSr#)r�r�)rur�r�r�)r:r#r$r��sz+LDAPClient.update_entry.<locals>.<listcomp>N)r�r
r^rHrIrr4r�r�rpr�)r:r�r�r#)r:r$�update_entry�s

zLDAPClient.update_entryc
Cs>t|t�r|}n|j}|j��|jjt|��WdQRXdS)z7Delete an entry given either the DN or the entry itselfN)rgrrprr4Zdelete_sr�)r:�entry_or_dnrpr#r#r$�delete_entry�s


zLDAPClient.delete_entrycCs@t|t�st�y|j|gd�Wntjk
r6dSXdSdS)z?
        Test whether the given object exists in LDAP.
        )rGFTN)rgrrQr[r
r
)r:rpr#r#r$�entry_exists�szLDAPClient.entry_existsg�)FFFTNT)N)F)NNF)NN)NN)N)rN)NN)r�)r�TTT)Nr�TTT)NN)NNNF)T)Mr<r=r>r?r7rYr5r(rRZSCOPE_ONELEVELZ
SCOPE_SUBTREEr�r�rrr�rrrr�r�r�r�r�rOrPr;�classmethodr�r
Z
IPA_CA_CRTr�r�r�r�r�r4r�r�r�r�r�r�r�r�r�
contextlib�contextmanagerr�staticmethodrr8rrrrr�r#r*r-r.r0r2r3r6r>rHrNrLrRrZr[r]rarbrdrer#r#r#r$rh�s



"#*%N









4,



rhrP�cCs||dkr$|rd}n|dk	r d}nd}|dkr:dt||�S|dkrVddj|jd��S|dkrldt||�Std	|��dS)
Nr�r�r(z
ldaps://%sz)ldapi://%%2fvar%%2frun%%2fslapd-%s.socketrrz	ldap://%szProtocol %r not supported)rr r!r�)�hostZportr�r�Zrealmr�r#r#r$�get_ldap_uri�srlc@seZdZddd�ZdS)�
CacheEntryNFcCs||_||_||_||_dS)N)r�rG�	exception�all)r:r�rGrnrKror#r#r$r;�szCacheEntry.__init__)NNNFF)r<r=r>r;r#r#r#r$rm�srmc	s�eZdZdZd&�fdd�	Zedd	��Zed
d��Zedd
��Zdd�Z	gfdd�Z
d'dd�Zdd�Zdd�Z
dd�Z�fdd�Z�fdd�Z�fdd�Zd(�fd d!�	Z�fd"d#�Zd)�fd$d%�	Z�ZS)*�	LDAPCachez+A very basic LRU Cache using an OrderedDictFTN�dcs�t�|_d|_d|_tj|dd�tj|dd�tj|d|oB|	dk�tj|d|
�tj|d|	�tt|�j|||||||�dS)	NTF�
_cache_missesr�_cache_hits�
_enable_cache�_debug_cache�_cache_size)	r�cachertrur�r�rfrpr;)r:r�r�r�r�r�r�r�Zenable_cacheZ
cache_sizeZdebug_cache)ror#r$r;�s
zLDAPCache.__init__cCs|jS)N)rs)r:r#r#r$�hitsz
LDAPCache.hitcCs|jS)N)rr)r:r#r#r$�missszLDAPCache.misscCs|jS)N)rv)r:r#r#r$�max_entriesszLDAPCache.max_entriescOs"|jr|jrtj|f|�|�dS)N)rtrurHrI)r:rrWrnr#r#r$�emitszLDAPCache.emitcCs~t|t|��}|s*|jjtt|j���n8x6|jj�D](\}}|j�|krLq6t|�|j|j�<q6Wtt|j��|_|j	�|S)N)
r[rrkrlrrjryr�rcr�)r:rpr�r\Z	new_entryr�rr#r#r$�
copy_entryszLDAPCache.copy_entrycCs�ddddh}|jsdS|j|�td�|ksDtd�|ksDtd�|krHdS|rj|jd|�t|d	�|j|<n,|j|�s�t|j�|j�|d
�|j|<ndS|jd|||�|jj|�t	|j�|j
kr�|jjdd
�\}}|jd|�dS)Nr�Zcospriorityr�zusercertificate;binaryz	cn=configzcn=kerberoszo=ipacazEXC: Caching exception %s)rn)r�rGrozADD: %s: %s all=%sF)ZlastzLRU: removed %s)rt�remove_cache_entryrr{rmrw�intersectionr}�move_to_endr�rz�popitem)r:rprG�get_allr�rnZBANNED_ATTRSr#r#r$�add_cache_entry(s2


zLDAPCache.add_cache_entrycCs:|jd�tj|dt��tj|dd�tj|dd�dS)NZFINALrwrsrrr)�cache_statusr�r�r)r:r#r#r$�clear_cacheXs
zLDAPCache.clear_cachecCs |jd||j|jt|j��dS)Nz%s: Hits %d Misses %d Size %d)r{rxryr�rw)r:rzr#r#r$r�^szLDAPCache.cache_statuscCs>t|t�st�|jd|�||jkr.|j|=n|jd|�dS)NzDROP: %szDROP: not in cache %s)rgrrQr{rw)r:rpr#r#r$r}bs


zLDAPCache.remove_cache_entrycs*|jd�|j|j�tt|�j|�dS)Nr])r{r}rprfrpr])r:r�)ror#r$r]ls
zLDAPCache.add_entrycs*|jd�|j|j�tt|�j|�dS)Nrb)r{r}rprfrprb)r:r�)ror#r$rbqs
zLDAPCache.update_entrycs>|jd�t|t�r|}n|j}|j|�tt|�j|�dS)Nrd)r{rgrrpr}rfrprd)r:rcrp)ror#r$rdvs


zLDAPCache.delete_entrycs6|jd�|j|�|j|�tt|�j|||�dS)Nra)r{r}rfrpra)r:rpr_r`)ror#r$ra�s


zLDAPCache.move_entrycs�|jd�t|t�st|�}|jd|�x^|D]V\}}}|j�dkr.x>|D]6}t|ttf�sJt|jd��}|jd|�|j|�qJWq.W|jd|�|j|�tt|�j	||�S)	Nr�z
modlist %s�member�ipaallowedtoperform_write_keys�managedby_hostzutf-8zmodify_s %s)r�r�r�)
r{rgrr�rr�r}rfrpr�)r:rpr�Z_opr�Zmod_dn�d)ror#r$r��s 



zLDAPCache.modify_sc
s�|jstt|�j|||||�S|jd|�|jj|�}|rB|rBd}|r�|jr�|jd}t	j
|d|�|jd|j�|jd�|j�|jd|�|r�|jd|j�|s�dg}n|d	gkr�d
g}d}|r�|dgd	gfkr�|j
r�d}|o�|j
o�|�r|jd}t	j
|d|�|jd�|j||j�S|�r�|�r�td
d�t|�D��}	tdd�|jD��}
|	j|
��r�|jd}t	j
|d|�|jd�|j||j|	�Sytt|�j|||||�}Wnxtjtjfk
�r}z<|j||d�|jd}t	j
|d|�|jd|��WYdd}~Xn\tk
�r&�YnFX|dgd	gfk�r>d}|j|tdd�|jj�D��||j||�d�|jd}t	j
|d|�|jd�|S)NzCache lookup: %srrszHIT: Re-raising %sZHITzRequested attrs_list %szCached attrs_list %sr@rPrpFTcss|]}|j�VqdS)N)r�)rur�r#r#r$rx�sz&LDAPCache.get_entry.<locals>.<genexpr>css|]}|j�VqdS)N)r�)rur�r#r#r$rx�s)rnrrzMISS: %scss|]}|j�VqdS)N)r�)rurvr#r#r$rx�s)rGr�r�ZMISS)rtrfrpr[r{rwrCrnrsr�r�r�rGror|r�ri�issubsetr
r
rTr�rrrr^�keys)
r:rprGrOrPrKr��hitsr�Z	req_attrsZcache_attrsrZ�misses)ror#r$r[�sx












zLDAPCache.get_entry)	FFFTNTTrqF)NFNN)T)NNNF)r<r=r>r?r;r�rxryrzr{r|r�r�r�r}r]rbrdrar�r[r�r#r#)ror$rp�s,
/
rp)rr)N)rPrjNFNN)TrBr0Zloggingr9rZdecimalrr}rrgr,r$�warnings�collectionsrZcryptographyrr�Zcryptography.hazmat.primitivesrr(Z	ldap.saslZldap.filterZ
ldap.controlsrr	r&r�Zipalibr
rZipalib.constantsrZipaplatform.pathsr
Zipapython.ipautilrrZipapython.dnrrZipapython.dnsutilrZipapython.kerberosr�collections.abcrZPY3r�r�Z	getLoggerr<rHr'r,r+rr�Z_missingZ
AUTOBIND_AUTOZAUTOBIND_ENABLEDZAUTOBIND_DISABLEDrrrZ	DIRMAN_DNr��hasattr�filterwarningsrr%r'r5r6r@r�r[r�rrrsrhrlrmrpr#r#r#r$�<module>s�


(NpL

@ Telegram