HEX
Server: LiteSpeed
System: Linux s1049.use1.mysecurecloudhost.com 4.18.0-477.27.2.lve.el8.x86_64 #1 SMP Wed Oct 11 12:32:56 UTC 2023 x86_64
User: xedaptot (3356)
PHP: 8.3.31
Disabled: NONE
$ pwd: /proc/self/root/lib/python3.6/site-packages/ipaclient/__pycache__/
Upload Files
File: //proc/self/root/lib/python3.6/site-packages/ipaclient/__pycache__/discovery.cpython-36.opt-1.pyc
3

�d[e;]�@sVddlmZddlZddlZddlmZddlmZddlm	Z	ddl
mZddlm
Z
ddlmZmZdd	lmZdd
lmZmZddlmZyddlZWnek
r�dZYnXddlmZeje�ZdZd(Z d)Z!d*Z"d+Z#d,Z$d-Z%d.Z&d/Z'd0Z(dZ)ede de!de"de#de$de%de&de'de(d i
Z*d!d"�Z+Gd#d$�d$�Z,d%d&�Z-ed'k�rRe-�dS)1�)�absolute_importN)�	rdatatype)�DNSException)�errors)�FQDN)�validate_domain_name)�	query_srv�resolve)�paths)�valid_ip�realm_to_suffix)�DN)�ipaldap��������
�zipa v2.0ZSuccess�NOT_FQDN�NO_LDAP_SERVER�REALM_NOT_FOUND�NOT_IPA_SERVER�NO_ACCESS_TO_LDAP�NO_TLS_LDAP�PYTHON_LDAP_NOT_INSTALLED�BAD_HOST_CONFIG�
UNKNOWN_ERRORc
Cs|jt�ddgd�}dd�|jdD�}d|krd|jd\}|jd�}||krX|j|�|jd|�x�|D]�}tjd|�y|jt|�|j	d	�\}Wn"t
jk
r�tjd
�wjYnX|jd\}|jd�j�}|t
kr�tjd|t
�qjtjd
|�t|�SWdS)z�
    Get base DN of IPA suffix in given LDAP server.

    None is returned if the suffix is not found

    :param conn: Bound LDAPClient that will be used for searching
    ZdefaultnamingcontextZnamingcontexts)Z
attrs_listcSsg|]}|jd��qS)zutf-8)�decode)�.0�c�r$�/usr/lib/python3.6/discovery.py�
<listcomp>Tsz"get_ipa_basedn.<locals>.<listcomp>zutf-8rz'Check if naming context '%s' is for IPAz(info=IPA*)zBLDAP server did not return info attribute to check for IPA version�infoz>Detected IPA server version (%s) did not match the client (%s)z*Naming context '%s' is a valid IPA contextN)Z	get_entryr
�rawr!�remove�insert�logger�debug�get_entriesZ
SCOPE_BASEr�NotFound�lower�IPA_BASEDN_INFO)Zconn�entryZcontexts�default�contextr'r$r$r%�get_ipa_basednIs6




r4c@s~eZdZdd�Zdd�Zdd�Zdd�Zd	d
�Zdd�Zd
d�Z	dd�Z
ddd�Zddd�Zd dd�Z
d!dd�Zd"dd�ZdS)#�IPADiscoverycCs:d|_d|_d|_g|_d|_d|_d|_d|_d|_dS)N)	�realm�domain�server�servers�basedn�realm_source�
domain_source�
server_source�
basedn_source)�selfr$r$r%�__init__tszIPADiscovery.__init__cCs�g}d}y�ttjd��}|j�}WdQRXxZ|D]R}|j�jd�rT|j�d	df}q0|j�jd�r0|jdd�|j�dd�D��q0WWntk
r�YnX|r�|g|}|S)
z�Read /etc/resolv.conf and return all domains

        Returns a list of (domain, info) pairs. The info contains a reason
         why the domain is returned.
        N�rr7rz"local domain from /etc/resolv.conf�searchcss|]}|dfVqdS)z#search domain from /etc/resolv.confNr$)r"�dr$r$r%�	<genexpr>�sz6IPADiscovery.__get_resolver_domains.<locals>.<genexpr>���)	�openr
ZRESOLV_CONF�	readlinesr/�
startswith�split�extend�	Exception)r?�domainsr7�f�lines�liner$r$r%Z__get_resolver_domains�s$


z#IPADiscovery.__get_resolver_domainscCs|jS)N)r8)r?r$r$r%�
getServerName�szIPADiscovery.getServerNamecCs|jS)N)r7)r?r$r$r%�
getDomainName�szIPADiscovery.getDomainNamecCs|jS)N)r6)r?r$r$r%�getRealmName�szIPADiscovery.getRealmNamecCs|jS)N)�kdc)r?r$r$r%�
getKDCName�szIPADiscovery.getKDCNamecCs|jS)N)r:)r?r$r$r%�	getBaseDN�szIPADiscovery.getBaseDNcCs�d}tjd||�xl|s~||kr.tjd|�P|j|�|j|dddd�}|rV||fS|jd�}|d
krldS||d	d�}qWdS)
a�
        Given a domain search it for SRV records, breaking it down to search
        all subdomains too.

        Returns a tuple (servers, domain) or (None,None) if a SRV record
        isn't found. servers is a list of servers found. domain is a string.

        :param tried: A set of domains that were tried already
        :param reason: Reason this domain is searched (included in the log)
        NzDStart searching for LDAP SRV record in "%s" (%s) and its sub-domainszAlready searched %s; skippingz
_ldap._tcpi�F)�break_on_first�.rrE)NN)NN)r+r,�add�ipadns_search_srv�find)r?r7�tried�reasonr9�pr$r$r%�check_domain�s"


zIPADiscovery.check_domain�NcCsVtjd�tjd|||�d|_d}|�s�|�s:|sDt}tjd|�|sLtSt|�rXtS|jd�}|d,krntS||dd�}|j�}|dfg|}t	�}	x�|D]~\}}
yt
|�Wn2tk
r�}ztjd	||�w�WYdd}~XnX|j||	|
�\}}|r�d
}||_
d||
f|_|_Pq�W|j
�s�tjd�tSnTtjd
|�|j|dddd�}|�rzd
}||_
d||_|_nd|_tjd�tSntjd�||_
d|_|_tjd�|�r�tjd�||_d|_n|j�}||_d|j
|_|�r|�rtS|�r |j�|_d|j
|_ndj|�|_d|_tg}d
}
tjd�g}�x<|D�]2}tjd||j�|j||j|d�}|dtk�ryt
|ddd�Wn<tk
�r�}ztjd |d|�tg}WYdd}~Xn:X|d|_|d|_d!|j|_|_|j|�|�r�Pnp|dttt fk�r@d}
|j|�|�r�PnD|dtk�r\tj!d"|�n(|dtk�rxtj!d#|�ntj!d$|��qRW|
�r�|jdk�r�|j
j"�|_d%|_tjd&|j�|
�r�|j#dk�r�t$|j�|_#d'|_%tjd(|j#�tjd)t&j'|d|d�|j|j
|j|j#�tjd*d+j|��||_(|�rN|d|_t|d<|dS)-a

        Use DNS discovery to identify valid IPA servers.

        servers may contain an optional list of servers which will be used
        instead of discovering available LDAP SRV records.

        Returns a constant representing the overall search result.
        z[IPA Discovery]z>Starting IPA discovery with domain=%s, servers=%s, hostname=%sNFzHostname: %srWrzdomain of the hostnamez!Skipping invalid domain '%s' (%s)Tz(Discovered LDAP SRV records from %s (%s)zNo LDAP server foundz Search for LDAP SRV record in %sz
_ldap._tcpi�)rVz#Discovered LDAP SRV records from %szServer and domain forcedZForcedz[Kerberos realm search]zKerberos realm forcedz'Discovered Kerberos DNS records from %sz, z&Kerberos DNS record discovery bypassedz[LDAP server check]z-Verifying that %s (realm %s) is an IPA server)�ca_cert_pathrrr6)�entityz Skipping invalid realm '%s' (%s)z&Discovered from LDAP DNS records in %szSkip %s: not an IPA serverzQSkip %s: LDAP server is not responding, unable to verify if this is an IPA serverz/Skip %s: cannot verify if this is an IPA serverzAssumed same as domainz(Assuming realm is the same as domain: %szGenerated from Kerberos realmzGenerated basedn from realm: %sz=Discovery result: %s; server=%s, domain=%s, kdc=%s, basedn=%szValidated servers: %s�,rE))r+r,r8rrrrrZ�#_IPADiscovery__get_resolver_domains�setr�
ValueErrorr^r7r=r<rrYr6r;�ipadnssearchkrbrealmr�ipadnssearchkrbkdcrSZ
kdc_source�joinr�ipacheckldap�SUCCESS�appendrrrZwarning�upperr:rr>�error_names�getr9)r?r7r9r6Zhostnamer`Zautodiscoveredr]rLr[r\�eZldapretZ
ldapaccessZ
valid_serversr8r$r$r%rB�s�



















	

zIPADiscovery.searchc Cs�tdkrtgSg}�y�tj|�}d}|r,d}tjd|�tj|||ddd�}y$|jt�d�tjd�t|�}Wnpt	j
k
r�tjd�tgSt	jk
r�}	z2tj
d	|	j�|dkr�tjd
�tgStgSWYdd}	~	XnX|dk�r�tjd�tgS||_d|j|_tjd
|j�y|jtd|j�|jd�}
Wnt	jk
�rRtgSXxD|
D]<}tjd|j�|jd\}tj�r�|jd�}|j|��qZW|�r�x"|D]}
||
k�r�t||gS�q�Wtjd|�tgSt |�dk�r�tjd�tgSt||dgSWn�t	j!k
�r(tjd�t"gSt	j#k
�rZ}	ztjd|	j�t"gSd}	~	Xn�t	j
k
�r|tjd�tgSt	jk
�r�}	ztjd	|	j�tgSd}	~	Xn0t$k
�r�}	ztjd	|	�tgSd}	~	XnXdS)a-
        Given a host and kerberos realm verify that it is an IPA LDAP
        server hosting the realm.

        Returns a list [errno, host, realm] or an empty list on error.
        Errno is an error number:
            0 means all ok
            negative number means something went wrong
        NFTzInit LDAP connection to: %s)Zcacert�	start_tlsZ	no_schemaZdecode_attrsr_z"Search LDAP server for IPA base DNz(LDAP Error: Anonymous access not allowedzError checking LDAP: %sz?Cannot connect to LDAP server. Check that minssf is not enabledzThe server is not an IPA serverzFrom IPA server %sz6Search for (objectClass=krbRealmContainer) in %s (sub)�cn�kerberosz(objectClass=krbRealmContainer)z	Found: %szutf-8z2Realm %s does not match any realm in LDAP databaserzYMultiple realms found, cannot decide which realm is the correct realm without working DNSrzLDAP Error: timeoutzLDAP Error: %s)rqrr)%rrZget_ldap_urir+r,Z
LDAPClientZsimple_bindr
r4rZACIErrorrZ
DatabaseError�error�strerrorrr rr:�ldap_urir>r-Z
SCOPE_SUBTREEr.rZdnr(�sixZPY3r!rkrj�lenZDatabaseTimeoutrZNetworkErrorrK)r?ZthostZtrealmr`ZlrealmsrurpZlhr:�errZlretZlresrqrAr$r$r%ri�s�













zIPADiscovery.ipacheckldapTcCs�g}d||f}tjd|�yt|�}Wn6tk
r^}ztjd|jj�g}WYdd}~XnXxn|D]f}	tjd|	�t|	j�jd�}
|
s�tjd|	�qf|dk	r�|	j	|kr�d|
t|	j	�f}
|j
|
�|rfPqfW|S)	a_
        Search for SRV records in given domain. When no record is found,
        en empty list is returned

        :param domain: Search domain name
        :param srv_record_name: SRV record name, e.g. "_ldap._tcp"
        :param default_port: When default_port is not None, it is being
                    checked with the port in SRV record and if they don't
                    match, the port from SRV record is appended to
                    found hostname in this format: "hostname:port"
        :param break_on_first: break on the first find and return just one
                    entry
        z%s.%szSearch DNS for SRV record of %szDNS record not found: %sNzDNS record found: %srWz-Cannot parse the hostname from SRV record: %sz%s:%s)r+r,rr�	__class__�__name__�str�target�rstripZportrk)r?r7Zsrv_record_nameZdefault_portrVr9�qname�answersro�answerr8r$r$r%rY�s*

zIPADiscovery.ipadns_search_srvc-Cs"|s
|j}d|}tjd|�yt|tj�}Wn6tk
rd}ztjd|jj�g}WYdd}~XnXd}x�|D]�}tjd|�|j	rpy|j	dj
d�}Wn0tk
r�}ztjd|�wpWYdd}~XnX|rpyt|d	d
�Wn4t
k
�r}ztjd||�wpWYdd}~XnX|SqpWdS)z�
        :param domain: Domain to be searched in
        :returns: string of a realm found in a TXT record
                  None if no realm was found
        z
_kerberos.zSearch DNS for TXT record of %szDNS record not found: %sNzDNS record found: %srzutf-8z+A TXT record cannot be decoded as UTF-8: %sr6)raz Skipping invalid realm '%s' (%s))r7r+r,r	rZTXTrryrzZstringsr!�UnicodeDecodeErrorrre)r?r7r~rror6r�r$r$r%rf's8
z!IPADiscovery.ipadnssearchkrbrealmcCs@|s
|j}|j|dddd�}|r,dj|�}ntjd|�d}|S)Nz_kerberos._udp�XF)rVrbz(SRV record for KDC not found! Domain: %s)r7rYrhr+r,)r?r7rSr$r$r%rgOs
zIPADiscovery.ipadnssearchkrbkdc)r_r_NNN)N)T)N)N)rz�
__module__�__qualname__r@rcrPrQrRrTrUr^rBrirYrfrgr$r$r$r%r5rs!
D
p
(
(r5cCsddl}ddl}ddlm}|jt�}|jjtj	�r<tj	}nd}|j
d|d�|j
ddd�|j
d�|j�}||jd	�t
�}|j|j|jd
�}x\dD]T}tt||��}	dj|�}
t||
d�}|dk	r�tdj||	|��q�tdj||	��q�W|jt|�djtj||���dS)Nr)�standard_logging_setupz	--ca-cert)r2z--debug�
store_true)�actionr7)r,)r`r6r:r8r9z	{}_sourcez{:<8} {:<32}	({})z{:<8} {:<32}z{}
)r6r7r:r8r9)�argparse�osZipapython.ipa_log_managerr��ArgumentParserrz�path�isfiler
Z
IPA_CA_CRT�add_argument�
parse_argsr,r5rBr7Zca_certr{�getattr�format�print�exit�absrmrn)r�r�r��parserZ
default_ca�argsZdiscover�result�key�valueZ
source_key�sourcer$r$r%�main_s0



r��__main__rE������������i����i����i����i�).Z
__future__rZloggingrvZdnsrZ
dns.exceptionrZipalibrZipalib.constantsrZipalib.utilrZipapython.dnsutilrr	Zipaplatform.pathsr
Zipapython.ipautilrrZipapython.dnr
Zldap�ImportErrorrZ	ipapythonZ	getLoggerrzr+rjrrrrrrrrr r0rmr4r5r�r$r$r$r%�<module>s\

)p%

@ Telegram