File: //lib/python3.6/site-packages/ipapython/__pycache__/ipautil.cpython-36.pyc
3
�d[e� � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dlZd dlZd dl Z d dl Z d dl m Z y d dl Z W n e!k
�r dZ Y nX d dl"m#Z# d dl$m%Z% d dl&m'Z'm(Z( ej)e*�Z+d Z,ej-d
ej.d iZ/ej0d d
dg�Z1G dd� dej2�Z3G dd� de3�Z4G dd� de4�Z5dd� Z6dsdd�Z7dd� Z8dd � Z9d d � Z:d d � Z;d!d"� Z<d#d$� Z=d%d&� Z>d'd(� Z?G d)d*� d*ej0d*d+��Z@G d,d-� d-ejA�ZAdd.f dd/d/ddf d/dd/dd/d/fd0d1�ZBd2d3� ZCd4d5� ZDd6d7� ZEG d8d9� d9eF�ZGG d:d;� d;ejH�ZId<d=� ZJdtd@dA�ZKdudBdC�ZLej-dd/ejMfdDdE�ZNej-fdFdG�ZOeF� eF� dfdHdI�ZPeF� eF� fdJdK�ZQeF� eF� fdLdM�ZRdvdNdO�ZSdwdPdQ�ZTdRdS� ZUdTdU� ZVedxdVdW��ZWedydYdZ��ZXe jY�rDd[d\� ZZne jZZZd]d^� Z[d_d`� Z\dadb� Z]G dcdd� dde^�Z_dedf� Z`dzdgdh�Zadidj� Zbdkdl� Zcd{dmdn�ZdG dodp� dp�Zedqdr� ZfdS )|� )�print_functionN)�contextmanager)�RawConfigParser� ParsingError)�input)�DN)�paths)�User�Group� ZtcpZudp�InterfaceDetails�name�ifnetc s> e Zd ZdZejZ� fdd�Z� fdd�Z� fdd�Z � Z
S )�UnsafeIPAddressz-Any valid IP address with or without netmask.c sH t |t�r,|j| _tt| �j|| jd� d S t |tj�rXd | _tt| �j|| jd� d S t |tj�r�|| _tt| �j| jj | jd� d S d | _t
|�}yfytj|| jd�}W nL tj k
r� |j d�\}}}|dkr tj|| jd�}|j
dkr� Y nX W n0 tk
�r, tj|| jd�| _| jj }Y nX tt| �j|| jd� d S )N)�flags�%� )�
isinstancer �_net�super�__init__�netaddr_ip_flags�netaddr� IPAddress� IPNetwork�ip�str�AddrFormatError� partition�version�
ValueError)�self�addr�sepZ_foo)� __class__� � /usr/lib/python3.6/ipautil.pyr V s@
zUnsafeIPAddress.__init__c s | j tt| �j� d�}|S )N)r � super_state)r r r � __getstate__)r! �state)r$ r% r& r( s z UnsafeIPAddress.__getstate__c s" t t| �j|d � |d | _d S )Nr' r )r r � __setstate__r )r! r) )r$ r% r& r* � s z UnsafeIPAddress.__setstate__) �__name__�
__module__� __qualname__�__doc__r Z INET_PTONr r r( r* �
__classcell__r% r% )r$ r& r N s
) r c sZ e Zd ZdZd� fdd� Z� fdd�Z� fdd �Zd
d � Zd d
� Zdd� Z dd� Z
� Z S )�CheckedIPAddresszpIPv4 or IPv6 address with additional constraints.
Reserved or link-local addresses are never accepted.
TFc sh yt t| �j|� W n. tjjk
rB } zt|��W Y d d }~X nX t|t�rZ|j| _d S | rt| j rttdj
|���| j d
kr�tdj
| j ���| r�| j � r�tdj
|���| j � r�| j
� s�| tjjkr�tdj
|���| j� r�tdj
|���| o�| j� �r
tdj
|���| j d k�rZ| j dk�r:tjtjt| ���| _ n | j dk�rZtjt| �d �| _ | j j| _d S ) Nz.netmask and prefix length not allowed here: {}� r zunsupported IP version {}z!cannot use loopback IP address {}z&cannot use IANA reserved IP address {}z#cannot use link-local IP address {}z"cannot use multicast IP address {}z/64)r1 r )r r0 r r Zcorer r r � prefixlenr �formatr � is_loopbackZ is_reservedr Z IPV4_6TO4Z
is_link_localZ is_multicastr Zcidr_abbrev_to_verboser )r! r" �
parse_netmask�allow_loopback�allow_multicast�e)r$ r% r& r � s<
zCheckedIPAddress.__init__c s | j tt| �j� d�}|S )N)r2 r' )r2 r r0 r( )r! r) )r$ r% r& r( � s z CheckedIPAddress.__getstate__c s" t t| �j|d � |d | _d S )Nr' r2 )r r0 r* r2 )r! r) )r$ r% r& r* � s z CheckedIPAddress.__setstate__c C s | | j jkS )N)r Znetwork)r! r% r% r& �is_network_addr� s z CheckedIPAddress.is_network_addrc C s | j dko| | jjkS )Nr1 )r r Z broadcast)r! r% r% r& �is_broadcast_addr� s z"CheckedIPAddress.is_broadcast_addrc C s� t dkrtd��tjd| � | jdkr.t j}n"| jdkr@t j}ntdj| j���x�t j � D ]�}xzt j
|�j |g �D ]d}|d j dd �d
}|d j d �d }d
j||d�}tjd||� t
j|�}|j| krrt||�S qrW qZW dS )z�Find matching local interface for address
:return: InterfaceDetails named tuple or None if no interface has
this address
N� netifacesz,Searching for an interface of IP address: %sr1 r z Unsupported address family ({})r" r � r �netmask�/z{addr}/{netmask})r" r= z,Testing local IP address: %s (interface: %s)���)r; � ImportError�logger�debugr �AF_INET�AF_INET6r r3 Z
interfacesZ ifaddresses�get�splitr r r r )r! ZfamilyZ interfaceZifdataZifaddrZifmaskZ
ifaddrmaskr r% r% r& �get_matching_interface� s.
z'CheckedIPAddress.get_matching_interfacec C s t |tj�st�|| _dS )a Set IP Network details for this address. IPNetwork is valid only
locally, so this should be set only for local IP addresses
:param ifnet: netaddr.IPNetwork object with information about IP
network where particula address belongs locally
N)r r r �AssertionErrorr )r! r r% r% r& �
set_ip_net� s zCheckedIPAddress.set_ip_net)TFF) r+ r, r- r. r r( r* r9 r: rG rI r/ r% r% )r$ r& r0 � s ' +r0 c s" e Zd ZdZd� fdd� Z� ZS )�CheckedIPAddressLoopbackz�IPv4 or IPv6 address with additional constraints with
possibility to use a loopback IP.
Reserved or link-local addresses are never accepted.
TFc s8 t t| �j|||dd� | j� r4tdj|�tjd� d S )NT)r5 r7 r6 z(WARNING: You are using a loopback IP: {})�file)r rJ r r4 �printr3 �sys�stderr)r! r" r5 r7 )r$ r% r& r s
z!CheckedIPAddressLoopback.__init__)TF)r+ r, r- r. r r/ r% r% )r$ r& rJ � s rJ c C s t j| �pt j| �S )N)r Z
valid_ipv4Z
valid_ipv6)r" r% r% r& �valid_ip s rO c C sZ t | �} ytjtj| � d| } W n tjk
r8 Y nX |dkrF| S d| t |�f S dS )z�
Format network location (host:port).
If the host part is a literal IPv6 address, it must be enclosed in square
brackets (RFC 2732).
z[%s]Nz%s:%s)r �socketZ inet_ptonrD �error)�host�portr% r% r& �
format_netloc s rT c C s | j d�}tdd� |D �� }|S )z)Convert a kerberos realm to a IPA suffix.�.c S s g | ]}d |j � f�qS )Zdc)�lower)�.0�xr% r% r& �
<listcomp>* s z#realm_to_suffix.<locals>.<listcomp>)rF r )Z
realm_name�s� suffix_dnr% r% r& �realm_to_suffix' s
r\ c C s& t | t�st�djdd� | D ��}|S )z)Convert a IPA suffix to a kerberos realm.rU c S s g | ]
}|j �qS r% )�value)rW rX r% r% r& rY 0 s z#suffix_to_realm.<locals>.<listcomp>)r r rH �join)r[ �realmr% r% r& �suffix_to_realm- s r` c C s. t j| �j|�}tjd�}|jdd� |�}|S )Nz(eval\s*\(([^()]*)\))c S s t t| jd���S )N� )r �eval�group)rX r% r% r& �<lambda>: s z template_str.<locals>.<lambda>)�stringZTemplateZ
substitute�re�compile�sub)�txt�vars�val�patternr% r% r& � template_str3 s
rm c
C s" t | ��}t|j� |�S Q R X dS )z.Read a file and perform template substitutionsN)�openrm �read)�
infilenamerj �fr% r% r& �
template_file> s
rr c C s. t | |�}t|d��}|j|� W dQ R X dS )z.Copy a file, performing template substitutions�wN)rr rn �write)rp Z outfilenamerj ri rK r% r% r& �copy_template_fileC s
ru c C s t jd�}|j| � |j� |S )Nzw+)�tempfile�NamedTemporaryFilert �flush)ri �fdr% r% r& �write_tmp_fileJ s
rz c C s` | j � tj| j� � tjjtjj| j��}tj|tj tj
B �}ztj|� W dtj |� X dS )zSFlush and fsync file to disk
:param f: a file object with fileno and name
N) rx �os�fsync�fileno�path�dirname�abspathr
rn �O_RDONLY� O_DIRECTORY�close)rq r �dirfdr% r% r& �
flush_syncR s r� c C s6 t | t�r d| jdd� d S d| jdd� d S d S )N�'z'\''� 's '\'')r r �replace)re r% r% r& � shell_quoted s
r� c @ s e Zd ZdZdS )�
_RunResultzResult of ipautil.runN)r+ r, r- r. r% r% r% r& r� k s r� z output error_output returncodec s. e Zd ZdZd� fdd� Zdd� ZeZ� ZS )�CalledProcessErrorzqCalledProcessError with stderr
Hold stderr of failed call and print it in repr() to simplify debugging.
Nc s t t| �j|||� || _d S )N)r r� r rN )r! �
returncode�cmd�outputrN )r$ r% r& r u s zCalledProcessError.__init__c C sN | j jdj| j�dj| j�g}| jd k r:|jdj| j�� |jd� dj|�S )Nz(Command {!s} z"returned non-zero exit status {!r}z: {!r}�)� )r$ r+ r3 r� r� rN �appendr^ )r! �argsr% r% r& �__str__y s
zCalledProcessError.__str__)NN)r+ r, r- r. r r� �__repr__r/ r% r% )r$ r& r� p s r� TFc sx t | ttf�st�d}d}d}t |t�r0td��|rD|s<|
rDtd��| rX|sP|
rXtd��|rh| rhtd��|dkr�tjtj �}d|d< |r�t
j }|r�t tj
d� }}n | r�tj}tj}n t
j }t
j }| dkr�tj� } tjr�t |t�r�|j| �}tt| �|�}tjd � tjd
|� � dk �rxt� �� d d � | D �} d
d � | D ��tjd� � j� j � | �rxx | D ]}tjd||j � �q^W � dk �s��dk �r�� ��fdd�}nd}z|y,t
j | |||d|||d�}|j |�\}}W nJ t k
�r� tjd� |j!� � Y n" t"k
�r tjd� � Y nX W d|�r.|j#� X tjd|j$� |�sJ| �rTd}d}n�tj�rp|j%tj� dd�}n|}tj�r�|j%tj� dd�}n|}t||�}|�r�tjd� n tjd|� t||�}|�r�tjd� n tjd |� |�rtj&�r�|}n
|j%| �}nd}|
�r(tj&�r |} n
|j%| �} nd} |j$d k�rN|�rNt'|j$|||��t(|| |j$�} || _)|| _*|| _+|| _,| S ) a�
Execute an external command.
:param args: List of arguments for the command
:param stdin: Optional input to the command
:param raiseonerr: If True, raises an exception if the return code is
not zero
:param nolog: Tuple of strings that shouldn't be logged, like passwords.
Each tuple consists of a string to be replaced by XXXXXXXX.
Example:
We have a command
['/usr/bin/setpasswd', '--password', 'Secret123', 'someuser']
and we don't want to log the password so nolog would be set to:
('Secret123',)
The resulting log output would be:
/usr/bin/setpasswd --password XXXXXXXX someuser
If a value isn't found in the list it is silently ignored.
:param env: Dictionary of environment variables passed to the command.
When None, current environment is copied
:param capture_output: Capture stdout
:param skip_output: Redirect the output to /dev/null and do not log it
:param cwd: Current working directory
:param runas: Name or User object of a user that the command should be
run as. The spawned process will have both real and effective UID and
GID set.
:param suplementary_groups: List of group names or Group object that will
be used as suplementary groups for subporcess. The option runas must
be specified together with this option.
:param capture_error: Capture stderr
:param nolog_output: do not log stdout even if it is being captured
:param nolog_error: do not log stderr even if it is being captured
:param encoding: For Python 3, the encoding to use for output,
error_output, and (if it's not bytes) stdin.
If None, the current encoding according to locale is used.
:param redirect_output: Redirect (error) output to standard (error) output.
:param umask: Set file-creation mask before running the command.
:return: An object with these attributes:
`returncode`: The process' exit status
`output` and `error_output`: captured output, as strings. Under
Python 3, these are encoded with the given `encoding`.
None unless `capture_output` or `capture_error`, respectively, are
given
`raw_output`, `raw_error_output`: captured output, as bytes.
`output_log` and `error_log`: The captured output, as strings, with any
unencodable characters discarded. These should only be used
for logging or error messages.
If skip_output is given, all output-related attributes on the result
(that is, all except `returncode`) are None.
For backwards compatibility, the return value can also be used as a
(output, error_output, returncode) triple.
Nz!nolog must be a tuple of strings.z@skip_output is incompatible with capture_output or capture_errorzDredirect_output is incompatible with capture_output or capture_errorz0skip_output is incompatible with redirect_outputzB/bin:/sbin:/usr/kerberos/bin:/usr/kerberos/sbin:/usr/bin:/usr/sbin�PATHrs zStarting external processzargs=%sc S s g | ] }t |��qS r% )r
)rW rc r% r% r& rY � s zrun.<locals>.<listcomp>c S s g | ]
}|j �qS r% )�gid)rW rc r% r% r& rY � s zrunas=%s (UID %d, GID %s)z supplementary_group=%s (GID %d)c sH � d k r2t j�� t j� j� j� t j� j� j� �d k rDt j�� d S )N)r{ � setgroups�setregid�pgid�setreuid�uid�umaskr% )�runas�suplementary_gidsr� r% r& �
preexec_fn
s
zrun.<locals>.preexec_fnT)�stdin�stdoutrN Z close_fds�env�cwdr� zProcess interruptedzProcess execution failedz Process finished, return code=%sr� )�errorszstdout=<REDACTED>z stdout=%szstderr=<REDACTED>z stderr=%sr )-r �tuple�listrH r r �copy�deepcopyr{ �environ�
subprocess�PIPErn �devnullrM r� rN �locale�getpreferredencoding�sixZPY3�encode�
nolog_replace�reprrA rB r r� r� r� �PopenZ communicate�KeyboardInterrupt�wait�
BaseExceptionr� r� �decode�PY2r� r� Z
raw_outputZraw_error_output�
output_log� error_log) r� r� Z
raiseonerr�nologr� Zcapture_outputZ skip_outputr� r� Zsuplementary_groupsZ
capture_error�encodingZredirect_outputr� Z nolog_outputZ nolog_errorZp_inZp_outZp_errZ
arg_stringrc r� �pr� rN r� r� r� Z error_output�resultr% )r� r� r� r& �run� s� B
r� c C sZ xT|D ]L}| st |t� r qtjj|�}t|�}x |||fD ]}| j|d�} q>W qW | S )z<Replace occurences of strings given in `nolog` with XXXXXXXXZXXXXXXXX)r r �urllib�parseZquoter� r� )re r� r] ZquotedZshquotedZ nolog_valuer% r% r& r� c s
r� c C s6 t jj|�r t j||d � tj| |� t j| � d S )Nz.orig)r{ r~ �isfile�rename�shutilr� �remove)�fname�destr% r% r& � install_filep s r� c C s t jj| �r t j| | d � d S )Nz.orig)r{ r~ r� r� )r� r% r% r& � backup_filex s r� c s� e Zd ZdZd1� fdd� Z� fdd�Zd2� fdd� Z� fd d
�Zd3d d �Z� fd
d�Z e
j rh� fdd�Z d4dd�Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd5d#d$�Zd%d&� Z� fd'd(�Z� fd)d*�Zd+d,� Zd-d.� Zd/d0� Z � Z S )6�CIDicta>
Case-insensitive but case-respecting dictionary.
This code is derived from python-ldap's cidict.py module,
written by stroeder: http://python-ldap.sourceforge.net/
This version extends 'dict' so it works properly with TurboGears.
If you extend UserDict, isinstance(foo, dict) returns false.
Nc s4 t t| �j� i | _|r"| j|� |r0| j|� d S )N)r r� r �_keys�update)r! �default�kwargs)r$ r% r& r � s
zCIDict.__init__c s t t| �j|j� �S )N)r r� � __getitem__rV )r! �key)r$ r% r& r� � s zCIDict.__getitem__c sJ |j � }|dk r.||kr$td| ��|j|� || j|< tt| �j||�S )z�cidict[key] = value
The ``seen_keys`` argument is used by ``update()`` to keep track of
duplicate keys. It should be an initially empty set that is
passed to all calls to __setitem__ that should not set duplicate keys.
NzDuplicate key in update: %s)rV r �addr� r r� � __setitem__)r! r� r] Z seen_keys� lower_key)r$ r% r& r� � s
zCIDict.__setitem__c s |j � }| j|= tt| �j|�S )N)rV r� r r� � __delitem__)r! r� r� )r$ r% r& r� � s zCIDict.__delitem__c
K s� t � }|rZy
|j}W n" tk
r6 | jt|�� Y n$X x |� D ]}| j||| |� q@W t � }x"|j� D ]\}}| j|||� qjW dS )z�Update self from dict/iterable new and kwargs
Functions like ``dict.update()``.
Neither ``new`` nor ``kwargs`` may contain two keys that only differ in
case, as this situation would result in loss of data.
N)�set�keys�AttributeErrorr� �dictr� �items)r! �newr� �seenr� r� r] r% r% r& r� � s
z
CIDict.updatec s t t| �j|j� �S )N)r r� � __contains__rV )r! r� )r$ r% r& r� � s zCIDict.__contains__c s t t| �j|j� �S )N)r r� �has_keyrV )r! r� )r$ r% r& r� � s zCIDict.has_keyc C s" y| | S t k
r |S X d S )N)�KeyError)r! r� Zfailobjr% r% r& rE � s z
CIDict.getc C s t j| j�S )N)r� �
itervaluesr� )r! r% r% r& �__iter__� s zCIDict.__iter__c C s t jrt| j� �S | j� S d S )N)r� r� r� �iterkeys)r! r% r% r& r� � s z CIDict.keysc C s t jrt| j� �S | j� S d S )N)r� r� r� � iteritems)r! r% r% r& r� � s z CIDict.itemsc C s t jrt| j� �S | j� S d S )N)r� r� r� r� )r! r% r% r& �values� s z
CIDict.valuesc C s t t| j� ��S )z%Returns a shallow copy of this CIDict)r� r� r� )r! r% r% r& r� � s z CIDict.copyc s � fdd�t j� j�D �S )Nc 3 s | ]}|� | fV qd S )Nr% )rW �k)r! r% r& � <genexpr>� s z#CIDict.iteritems.<locals>.<genexpr>)r� r� r� )r! r% )r! r& r� � s zCIDict.iteritemsc C s t j| j�S )N)r� r� r� )r! r% r% r& r� � s zCIDict.iterkeysc C s dd� t j| �D �S )Nc s s | ]\}}|V qd S )Nr% )rW r� �vr% r% r& r� � s z$CIDict.itervalues.<locals>.<genexpr>)r� r� )r! r% r% r& r� � s zCIDict.itervaluesc C s* y| | S t k
r$ || |< |S X d S )N)r� )r! r� r] r% r% r& �
setdefault� s
zCIDict.setdefaultc G sB y| | }| |= |S t k
r< t|�dkr6|d S � Y nX d S )Nr< r )r� �len)r! r� r� r] r% r% r& �pop� s z
CIDict.popc s, t t| �j� \}}| j| }| j|= ||fS )N)r r� �popitemr� )r! r� r] r� )r$ r% r& r� � s
zCIDict.popitemc s | j j� tt| �j� S )N)r� �clearr r� )r! )r$ r% r& r� s
z CIDict.clearc C s t d��d S )Nz#CIDict.viewitems is not implemented)�NotImplementedError)r! r% r% r& � viewitems s zCIDict.viewitemsc C s t d��d S )Nz"CIDict.viewkeys is not implemented)r� )r! r% r% r& �viewkeys s zCIDict.viewkeysc C s t d��d S )Nz%CIDict.viewvvalues is not implemented)r� )r! r% r% r& � viewvvalues s zCIDict.viewvvalues)N)N)N)N)N) r+ r, r- r. r r� r� r� r� r� r� r� r� rE r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r/ r% r% )r$ r& r� } s2
r� c s: e Zd ZdZd � fdd� Zdd� Zdd� Zd d
� Z� ZS ) �GeneralizedTimeZonezrThis class is a basic timezone wrapper for the offset specified
in a Generalized Time. It is dst-ignorant.�Zc s� t t| �j� || _d| _d| _|dkr6d| _d| _n~t|�dkrltjd|�rlt |dd� �| _|dd � }t|�dkr�tjd|�r�t |dd� �| _|dd � }t|�dkr�t
� �| jdk r�| jd9 _d S ) Nr r� � z[-+]\d\dra z\d\dr< r? ) r r� r r
�
houroffset� minoffsetr� rf �match�intr )r! Z offsetstr)r$ r% r& r s"
z GeneralizedTimeZone.__init__c C s t j| j| jd�S )N)ZhoursZminutes)�datetime� timedeltar� r� )r! Zdtr% r% r& � utcoffset, s z GeneralizedTimeZone.utcoffsetc C s
t jd�S )Nr )r� r� )r! r% r% r& �dst/ s zGeneralizedTimeZone.dstc C s | j S )N)r
)r! r% r% r& �tzname2 s zGeneralizedTimeZone.tzname)r� ) r+ r, r- r. r r� r� r� r/ r% r% )r$ r& r� s
r� c C s t | �dk rdS �y�| dd� }| dd� }t|dd� �}t|dd� �}t|dd� �}d } } }} d}
t |�dko�tjd|d ��r:t|dd� �}|dd� }t |�dko�|d dks�|d d k�r:d } |d
d� }x:t |�dko�tjd|d ��r| |d 7 } |d
d� }q�W tt| �d �} t| d �\}}t |�dk�r tjd|d ��r t|dd� �}|dd� }t |�dk�r |d dk�s�|d d k�r d }
|d
d� }x>t |�dk�r�tjd|d ��r�|
|d 7 }
|d
d� }�q�W tt|
�d �}t |�dk�r�tjd|d ��r�t|dd� �}|dd� }t |�dk�r�|d dk�sf|d d k�r�d }|d
d� }x>t |�dk�r�tjd|d ��r�||d 7 }|d
d� }�qxW tt|�d
�} t |�dk�r�t|�}
tj||||||| |
�S tk
�r dS X dS )a> Parses are Generalized Time string (as specified in X.680),
returning a datetime object. Generalized Times are stored inside
the krbPasswordExpiration attribute in LDAP.
This method doesn't attempt to be perfect wrt timezones. If python
can't be bothered to implement them, how can we...� Nr1 r r ra z\d�,rU r< i �< i@B ) r� r� rf r� �float�divmodr� r� r )ZtimestrZdate�timeZyearZmonthZdayZhour�minZsecZmsecZtzoneZ
hour_fractionZ
total_secsZ min_fractionZ sec_fractionr% r% r& �parse_generalized_time6 s\ & * " * " r � r< c sr d}t jtjtt j�d�d�t jtjtt j�d�d�t jtjtt j�d�d�|tjt|�d�d�d�}t||||d�� ddj� fdd�|j � D ��i|d < tjt|d d �d�|d d
< t
j � }| } d}
x\dD ]T} || } � | }
|
dkr�q�x4|
dk�r"|
|j | d �7 }
| | d
8 } |
d8 }
q�W q�W |d }x<| dk�sJt|
�|k �rl|
|j |d �7 }
| |d
8 } �q2W |
S )a�
Generate token containing at least `entropy_bits` bits and with the given
character restraints.
:param entropy_bits:
The minimal number of entropy bits attacker has to guess:
128 bits entropy: secure
256 bits of entropy: secure enough if you care about quantum
computers
Integer values specify minimal number of characters from given
character class and length.
Value None prevents given character from appearing in the token.
Example:
TokenGenerator(uppercase=3, lowercase=3, digits=0, special=None)
At least 3 upper and 3 lower case ASCII chars, may contain digits,
no special chars.
z!$%&()*+,-./:;<>?@[]^_{|}~ra )�chars�entropy)� uppercase� lowercase�digits�specialr r� c s$ g | ] \}}� | d k r|d �qS )Nr r% )rW �charclass_name� charclass)� req_classesr% r& rY � s z)ipa_generate_password.<locals>.<listcomp>�allr r r r r
Nr r< )r r r r
)
re Zascii_uppercase�math�logr� Zascii_lowercaser r� r^ r� �randomZ SystemRandom�choice)Z entropy_bitsr r r r
Zmin_lenZ
special_charsZ pwd_charsetsZrndZ todo_entropyZpasswordr r Ztodo_charactersZallcharsr% )r
r& �ipa_generate_passwordv sH
r c C s� |d krXxNy$t d| �}|s$|j� r,|j� S W q
tk
rR |rFdS td��Y q
X q
W t|t�r�xPy6t d| |f �}| r�|s�|r�|S |j� r�|j� S W qd tk
r� |S X qdW t|t��r:|r�dnd}xlyPt d| |f �}|j� }|s�|S |j� d dk�rd S |j� d d
k�r d S W q� tk
�r4 |S X q�W t|t��r�xdy.t d| |f �}|j� }|�sl|S t|�}W n* t k
�r� Y n tk
�r� |S X |S �qHW d S ) Nz%s: r� zFailed to get user inputz %s [%s]: �yes�nor �yT�nF)
r �strip�EOFError� RuntimeErrorr r �boolrV r� r )�promptr� Z allow_empty�retr r% r% r& �
user_input� s`
r c C s� d}x�t j| |t j|�D ]�}|\}} }
} } d}
z�yLt j || |
�}
|dk rR|
j|� |
j| � |t jkrz|
jd� |
jd� W nD t jk
r� d}|r�dt |t
| | d d� }t j ||� Y nX W d|
dk r�|
j
� X qW |S ) z�
host: either hostname or IP address;
if hostname is provided, port MUST be open on ALL resolved IPs
returns True is port is open, False otherwise
TN� i Fz8Failed to connect to port %(port)s %(proto)s on %(addr)sr )rS �protor" )rP Z getaddrinfoZ AF_UNSPECZ
settimeout�connect�
SOCK_DGRAM�sendZrecvrQ r� �PROTOCOL_NAMESrA r r� )rR rS � socket_typeZsocket_timeout�
log_errorsZ log_level� port_open�resZafZsocktyper Z
_canonnameZsarZ �msgr% r% r& �host_port_open s.
r* c C s |t jkrd}n|t jkr d}nt|��y"t j t j|�}d}tjd|� W n4 t jk
r~ t j t j|�}d}tjd|� Y nX zxy.|t jkr�|j t j
t j d� |j || f� W n2 t jk
r� } ztjd| ||� d S d
}~X nX tjd | |� dS W d
|j
� X d
S ) z�Check if a port is free and not bound by any other application
:param port: port number
:param socket_type: type (SOCK_STREAM for TCP, SOCK_DGRAM for UDP)
Returns True if the port is free, False otherwise
ZTCPZUDPz::z9check_port_bindable: Checking IPv4/IPv6 dual stack and %sr� z.check_port_bindable: Checking IPv4 only and %sTz5check_port_bindable: failed to bind to port %i/%s: %sFNz(check_port_bindable: bind success: %i/%s)rP � SOCK_STREAMr" r rD rA rB rQ rC Z
setsockoptZ
SOL_SOCKETZ SO_REUSEADDRZbindr� )rS r% r rZ Zanyaddrr8 r% r% r& �check_port_bindable, s8
r, c C s� t jdt j�}tj| �}t� }d}tjddd����}|j}t | d���} x�| D ]�}
|
} |j
|
�} | �r
| j dd�\}
}|
dk �r
|r�|
|kr�d |
||
f } |||
< |r�|
|kr�|s�d |
||
f } n$|j ||
�d kr�d |
|||
f } |||
< |o�|
|k�r
|||
< d} | dk rL|j
| � qLW W dQ R X |j� }|j|� t|j� �t|j� � }t|j� �| }x$|D ] }|j
d ||| f � �qjW x$|D ] }|j
d ||| f � �q�W |j� tj|j� |j� tj|j� |j|j� W dQ R X t|| � |S )
a�
Take a key=value based configuration file, and write new version
with certain values replaced, appended, or removed.
All (key,value) pairs from replacevars and appendvars that were not found
in the configuration file, will be added there.
All entries in set removevars are removed.
It is responsibility of a caller to ensure that replacevars and
appendvars do not overlap.
It is responsibility of a caller to back up file.
returns dictionary of affected keys and their previous values
One have to run restore_context(filepath) afterwards or
security context of the file will not be correct after modification
z�
(^
\s*
(?P<option> [^\#;]+?)
(\s*=\s*)
(?P<value> .+?)?
(\s*((\#|;).*)?)?
$)Nrs F)�mode�delete�r�optionr] z%s=%s
r< z %s=%s %s
r? )rf rg �VERBOSEr{ �statr� rv rw r
rn r� rc �findrt r� r� r� r� rx �fchmodr} �st_mode�fchown�st_uid�st_gidr� )�filepath� replacevars�
appendvarsZ
removevarsrl � orig_stat�
old_values�
temp_filename�
new_configrq �line�new_line�mr0 r] �new_vars� newvars_view� append_view�itemr% r% r& �config_replace_variables] sR
rG c C s� t jdt j�}dd� }tj| �}t� }d}tjddd����} | j}t | d���Z}
d} d} d }
�x|
D �]}|
d }
|}|j
|�}|rd|j d
d d �\}}}| r�|dk r�|| |||� d
} |dk r�t |�j
� t |�j
� k} |dk o�| �r`|o�||k�r
d||| f }|||< |�r`||k�r`|�s2d||| f }n&|j|| �dk�rXd|||| f }|||< | j|� qdW | �pv| �s�| jd| � | �s�| �r�|| |||� W dQ R X | j� tj| j� |j� tj| j� |j|j� W dQ R X t|| � |S )a�
Take a section-structured key=value based configuration file, and write new version
with certain values replaced or appended within the section
All (key,value) pairs from replacevars and appendvars that were not found
in the configuration file, will be added there.
It is responsibility of a caller to ensure that replacevars and
appendvars do not overlap.
It is responsibility of a caller to back up file.
returns dictionary of affected keys and their previous values
One have to run restore_context(filepath) afterwards or
security context of the file will not be correct after modification
a
(^
\[
(?P<section> .+) \]
(\s+((\#|;).*)?)?
$)|(^
\s*
(?P<option> [^\#;]+?)
(\s*=\s*)
(?P<value> .+?)?
(\s*((\#|;).*)?)?
$)c S s� |j � }|j|� t|j� �t|j� � }t|j� �| }x"|D ]}| jd||| f � q@W x"|D ]}| jd||| f � qdW d S )Nz%s=%s
)r� r� r� r� rt )�configr: r; ZoldvarsrC rD rE rF r% r% r& � add_options� s
z.inifile_replace_variables.<locals>.add_optionsNrs F)r- r. r/ r< �sectionr0 r] Tz%s=%s
z %s=%s %s
z[%s]
r? )rf rg r1 r{ r2 r� rv rw r
rn r� rc r rV r3 rt rx r4 r} r5 r6 r7 r8 r� )r9 rJ r: r; rl rI r< r= r> r? rq Z
in_sectionZfinishedZline_idxr@ rA rB Zsectr0 r] r% r% r& �inifile_replace_variables� sV
rK c C s | j |� t|||�}|S )aj
Take a key=value based configuration file, back up it, and
write new version with certain values replaced or appended
All (key,value) pairs from replacevars and appendvars that
were not found in the configuration file, will be added there.
The file must exist before this function is called.
It is responsibility of a caller to ensure that replacevars and
appendvars do not overlap.
returns dictionary of affected keys and their previous values
One have to run restore_context(filepath) afterwards or
security context of the file will not be correct after modification
)r� rG )Zfstorer9 r: r; r= r% r% r& �#backup_config_and_replace_variables
s
rL c C s� t |�}t|ttf�s |g}tjd| ||� tj� | }xj|D ]b}tjd|� d}xLt| ||d�}d}|rxtjd|� P |r�tj� |kr�tj d��tj
d� qTW q>W d S )
z�
Wait until the specified port(s) on the remote host are open. Timeout
in seconds may be specified to limit the wait. If the timeout is
exceeded, socket.timeout exception is raised.
z%wait_for_open_ports: %s %s timeout %dzwaiting for port: %sT)r& FzSUCCESS: port: %szTimeout exceededr< N) r� r r� r� rA rB r r* rP �timeout�sleep)rR ZportsrM �
op_timeoutrS Z log_errorr' r% r% r& �wait_for_open_ports& s"
rP c C s� t |�}tj� | }x|y$tjtj�}|j| � |j� P W q tjk
r� } z4|jdkrx|rltj� |krl|�tjd� n|�W Y dd}~X qX qW dS )z
Wait until the specified socket on the local host is open. Timeout
in seconds may be specified to limit the wait.
ra �o r< N)ra rQ ) r� r rP ZAF_UNIXr! r� rQ �errnorN )Z socket_namerM rO rZ r8 r% r% r& �wait_for_open_socketB s
rS c s" � fdd�}� fdd�}t ||�S )a8
Create a property for a dn attribute which assures the attribute
is a DN or None. If the value is not None the setter converts it to
a DN. The getter assures it's either None or a DN instance.
The private_name parameter is the class internal attribute the property
shadows.
For example if a class has an attribute called base_dn, then:
base_dn = dn_attribute_property('_base_dn')
Thus the class with have an attriubte called base_dn which can only
ever be None or a DN instance. The actual value is stored in _base_dn.
c s |d k rt |�}t| � |� d S )N)r �setattr)r! r] )� private_namer% r& �setterj s z%dn_attribute_property.<locals>.setterc s$ t | � �}|d k r t|t�s t�|S )N)�getattrr r rH )r! r] )rU r% r& �gettero s
z%dn_attribute_property.<locals>.getter)�property)rU rV rX r% )rU r& �dn_attribute_propertyY s rZ c C s. dd� }| j dd�}djt||��}|jd�S )a�
Convert a string to a more strict alpha-numeric representation.
- Alpha-numeric, underscore, dot and dash characters are accepted
- Space is converted to underscore
- Other characters are omitted
- Leading dash is stripped
Note: This mapping is not one-to-one and may map different input to the
same result. When using posixify, make sure the you do not map two different
entities to one unintentionally.
c S s | j � p| dkS )N�_rU �-)r[ rU r\ )�isalnum)�charr% r% r& �
valid_char� s z posixify.<locals>.valid_char� r[ r� r\ )r� r^ �filter�lstrip)re r_ ZreplacedZomittedr% r% r& �posixifyw s rc c c s� | d kr$t jdd�}tjj|d�} nd }tjjdd �}| tjd< z
| V W d |d k r`|tjd< ntjjdd � tjj| �r�tj | � |d k r�ytj
|� W n t k
r� Y nX X d S )NZkrbcc)�prefixZccacheZ
KRB5CCNAME) rv Zmkdtempr{ r~ r^ r� rE r� �existsr� �rmdir�OSError)r~ Zdir_path�original_valuer% r% r& �private_ccache� s$
ri �/run/ipac c s� t j}d}|rltjd�| j� |f }tj|ddd�\}}tj|ddd��}|j |� W dQ R X d j
||g�}t j j
d
d�}|t j d
< z$y
|V W n tk
r� Y nX W d|dk r�|t j d
< nt j jd
d� |dk r�t jj|�r�t j|� X dS ) a� Generate override krb5 config file for a trusted domain DC access
Provide a context where environment variable KRB5_CONFIG is set
with the overlay on top of paths.KRB5_CONF. Overlay's file path
is passed to the context in case it is needed for something else
:param realm: realm of the trusted AD domain
:param server: server to override KDC to
:param dir: path where to create a temporary krb5.conf overlay
Nze
[realms]
%s = {
kdc = %s
}
Zkrb5confT)�dirrd �textrs zutf-8)r- r� �:Z KRB5_CONFIG)r Z KRB5_CONF�textwrap�dedent�upperrv Zmkstemp�iorn rt r^ r{ r� rE �
GeneratorExitr� r~ re r� ) r_ Zserverrk ZcfgZtcfgZcontentry �orh r% r% r& �private_krb5_config� s,
rt c C sF t | t�r| jtj� �S t | t�r&| S tdjtjtjt | �j���dS )zw
Decode argument using the file system encoding, as returned by
`sys.getfilesystemencoding()`.
zexpect {0} or {1}, not {2}N)
r �bytesr� rM �getfilesystemencodingr � TypeErrorr3 r+ �type)r] r% r% r& �fsdecode� s
ry c s( t jdj� ���t� �fdd�|D ��S )z�
unescape (remove '\') all occurences of sequence in input strings.
:param seq: sequence to unescape
:param args: input string to process
:returns: tuple of strings with unescaped sequences
z\\{}c 3 s | ]}t j�� |�V qd S )N)rf rh )rW �a)�seq� unescape_rer% r& r� � s z unescape_seq.<locals>.<genexpr>)rf rg r3 r� )r{ r� r% )r{ r| r& � unescape_seq� s r} c s t � fdd�|D ��S )z�
escape (prepend '\') all occurences of sequence in input strings
:param seq: sequence to escape
:param args: input string to process
:returns: tuple of strings with escaped sequences
c 3 s | ]}|j � d j� ��V qdS )z\{}N)r� r3 )rW rz )r{ r% r& r� s z escape_seq.<locals>.<genexpr>)r� )r{ r� r% )r{ r& �
escape_seq� s
r~ c C s& dd� }t | t�r| S | j|| �d�S )ab Decode JSON bytes to string with proper encoding
Only for supporting Py 3.5
Py 3.6 supports bytes as parameter for json.load, we can drop this when
there is no need for python 3.5 anymore
Code from:
https://bugs.python.org/file43513/json_detect_encoding_3.patch
:param data: JSON bytes
:return: return JSON string
c S s� | j }|tjtjf�rdS |tjtjf�r.dS |tj�r<dS t| �dkr�| d s`| d r\dS dS | d s�| d sx| d
r|d S d S n$t| �d kr�| d s�dS | d s�d S d
S )Nzutf-32zutf-16z utf-8-sigr1 r r< z utf-16-bez utf-32-bera r� z utf-16-lez utf-32-lezutf-8)�
startswith�codecs� BOM_UTF32_BE� BOM_UTF32_LE� BOM_UTF16_BE� BOM_UTF16_LE�BOM_UTF8r� )�bZ bstartswithr% r% r& �detect_encoding s$
z$decode_json.<locals>.detect_encoding�
surrogatepass)r r r� )�datar� r% r% r& � decode_json s
r� c @ sL e Zd ZdZf Zdd� Zdd� Zdd� Zdd � Ze d
d � �Z
e d d
� �Z dS )�
APIVersionzzAPI version parser and handler
The class is used to parse ipapython.version.API_VERSION and plugin
versions.
c C s8 |j d�\}}}t|�}|r$t|�nd}tj| ||f�S )NrU r )r r� r� �__new__)�clsr �major�dot�minorr% r% r& r� D s zAPIVersion.__new__c C s
dj | � S )Nz{}.{})r3 )r! r% r% r& r� J s zAPIVersion.__str__c C s
dj | � S )Nz<APIVersion('{}.{}')>)r3 )r! r% r% r& r� M s zAPIVersion.__repr__c C s
t | �fS )N)r )r! r% r% r& �__getnewargs__P s zAPIVersion.__getnewargs__c C s | d S )Nr r% )r! r% r% r& r� S s zAPIVersion.majorc C s | d S )Nr< r% )r! r% r% r& r� W s zAPIVersion.minorN) r+ r, r- r. � __slots__r� r� r� r� rY r� r� r% r% r% r& r� < s r� c C sf yt jd| � tj| � W nF tk
r` } z*|jtjkrPt jd| |� t jd� W Y dd}~X nX dS )z|
Remove Kerberos keytab and issue a warning if the procedure fails
:param keytab_path: path to the keytab file
zRemoving service keytab: %sz)Failed to remove Kerberos keytab '%s': %sz"You may have to remove it manuallyN)rA rB r{ r� rg rR �ENOENT�warning)Z keytab_pathr8 r% r% r& �
remove_keytab\ s r� c C sz t jd� tjg}| dk r4t jd| � |jd| g� yt||i d� W n. tk
rt } zt jd|� W Y dd}~X nX dS )z�
remove Kerberos credential cache, essentially a wrapper around kdestroy.
:param ccache_path: path to the ccache file
:param run_as: run kdestroy as this user
z"Removing service credentials cacheNzCcache path: '%s'z-c)r� r� z.Failed to clear Kerberos credentials cache: %s)rA rB r ZKDESTROY�extendr� r� r� )Z ccache_pathZrun_asZ kdestroy_cmdr8 r% r% r& �
remove_ccachel s
r� c C sZ yt j| � W nF tk
rT } z*t|dd�tjkrDtjd| t|�� W Y dd}~X nX dS )z1Remove a file and log any exceptions raised.
rR NzError removing %s: %s) r{ �unlink� ExceptionrW rR r� rA rQ r )�filenamer8 r% r% r& � remove_file� s
r� c C sT yt jj| �rtj| � W n4 tk
rN } ztjd| t|�� W Y dd}~X nX dS )zE
Remove a directory structure and log any exceptions raised.
zError removing %s: %sN) r{ r~ re r� �rmtreer� rA rQ r )r~ r8 r% r% r& r� � s
r� c C sf t | tj�r ttj| ��}n t | ttf�r4t| �}nt| ��tjdddtjj d�}|tj
|| d� S )a�
Convert a timestamp or a time.struct_time to a datetime.datetime
object down to seconds, with UTC timezone
The conversion is safe for year 2038 problem
:param t: int or float timestamp in (milli)seconds since UNIX epoch
or time.struct_time
:param units: normalizing factor for the timestamp
(1 for seconds, 1000 for milliseconds)
defaults to 1
:return: datetime.datetime object in UTC timezone
i� r< )�tzinfo)Zseconds) r r Z struct_timer� Zmktimer� rw r� ZtimezoneZutcr� )�tZunitsr� Zepochr% r% r& �datetime_from_utctimestamp� s
r� c @ s2 e Zd ZdZdZdd�dd�Zdd� Zd d
� ZdS ) �Sleepera� Helper for time.sleep() loop with timeout
A sleeper object sleeps *sleep* seconds when it is called. Close to its
deadline it sleeps shorter to not oversleep the *timeout* deadline. A
sleeper object is *True* and returns *True* before it reaches *timeout*
deadline. After its deadline a sleeper raises the exception object/class
in *raises*. If *raises* is not given, it returns False instead.
sleep = Sleeper(sleep=1, timeout=60, raises=TimeoutError)
while True:
do_something()
sleep()
sleep = Sleeper(sleep=0.5, timeout=60)
while True:
do_something
if not sleep():
log.info("timeout")
break
longsleep = Sleeper(sleep=1, timeout=sys.maxsize)
ra N)�raisesc C sT |dkrt d|� ���|dk r.t d|� d���|| _|| _|| _tj� | j | _d S )Nr zinvalid timeout g{�G�z�?zsleep duration z is too short.)r rM rN r� r � monotonic�deadline)r! rN rM r� r% r% r& r � s zSleeper.__init__c C s t j� | jk S )N)r r� r� )r! r% r% r& �__bool__� s zSleeper.__bool__c C sH t j� }|| jkr(| jd k r$| j�ndS t| j| | j�}t j|� dS )NFT)r r� r� r� r rN )r! ZnowZdurr% r% r& �__call__� s
zSleeper.__call__)r+ r, r- r. Z
multiplierr r� r� r% r% r% r& r� � s
r� c C sv d}t jjdddd| �}t� }y|j|� W n tk
rB dS X |j|�sRdS |j|d�sbdS |j|d�j � dkS ) a! A simplified version of ipalib/config in order to determine if the
API should be bootstrapped in debug mode or not.
A number of daemons setup logging, then bootstrap the API in order
to capture the startup. This presents a chicken-and-egg problem
over debug output.
Debug is rather spammy and probably shouldn't be enabled by default
but if some problem is occuring during startup we want a way to
see that.
So use this limited function to pluck out the debug value out of
the system context config file (in_tree is not supported, another
chicken-and-egg).
This isn't more generalized for two reasons:
1. There is currently only a need for 'debug'
2. Type conversion. They will all be strings.
�globalr> ZetcZipaz%s.confFrB �true)
r{ r~ r^ r ro r Z has_sectionZ
has_optionrE rV )�contextZCONFIG_SECTIONZ config_file�parserr% r% r& �get_config_debug� s
r� )N)r r< r< r< r< r )NT)r )r )N)rj )NN)r< )gZ
__future__r r� Zloggingre rv r� r r r{ rM rR r� r� rP rf r� r r rn rq �
contextlibr Z configparserr r r� � collectionsr� r� Z six.movesr r; r@ Z ipapython.dnr Zipaplatform.pathsr Zipaplatform.constantsr r
Z getLoggerr+ rA ZTMP_PWD_ENTROPY_BITSr+ r" r$ �
namedtupler r r r0 rJ rO rT r\ r` rm rr ru rz r� r� r� r� r� r� r� r� r� r� r� r� r r r �DEBUGr* r, rG rK rL rP rS rZ rc ri rt r� ry r} r~ r� r� r� r� r� r� r� r� r� r� r% r% r% r& �<module> s�
=t
Y
#@
T
8'1 Mc
/
1
5