File: //usr/lib/python3.6/site-packages/ipalib/__pycache__/util.cpython-36.opt-1.pyc
3
�d[e�� � @ s� d Z ddlmZmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlZddlZddlZddl mZ ddlmZ ddlmZ ddlmZ ddlZyddlm Z W n e k
r� ddl m Z Y nX dd l m Z m!Z! dd
l"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( dd l)m*Z* dd l+m,Z, dd
l-m.Z. ddl/m0Z0 ddl1m2Z2 ddl3m4Z4 ddl5m6Z6m7Z7 ddl8m9Z9m:Z:m;Z;m<Z< ddl=m>Z> e j?d�k�r�ddl@Z@ndZ@ejA�r�eBZCdZDdZEejFeG�ZHdd� ZIdd� ZJd d � ZKd d � ZLd d!� ZMd"d#� ZNd$d%� ZOd&d'� ZPd(d)� ZQd*d+� ZRd,d-� ZSe jTdddde'e(fd.d/�ZUd�d1d2�ZVd�d4d5�ZWd6d7� ZXd8d9� ZYd�d<d=�ZZd>d?� Z[d@dA� Z\dBdC� Z]dDdE� Z^dFdG� Z_dHdI� Z`dJdK� ZaejbdLejc�Zdd�d�d�d�d�d�d�d�d�d�d�d�d�d�dOdOdOdRdRdRdRdS�ZedTdU� Zfd�dYdZ�Zgd�d\d]�Zhe9jid^e9jjd_iZkd`da� Zldbdc� Zmddde� Zndfdg� ZoG dhdi� diep�ZqG djdk� dkeq�ZrG dldm� dmeq�ZsG dndo� doeq�ZtG dpdq� dqeq�Zudrds� Zvd�dudv�Zwd�dwdx�Zxd�dydz�Zyd�d{d|�Zzd�d}d~�Z{dd�� Z|d�d�� Z}d�d�� Z~d�d�� ZG d�d�� d��Z�G d�d�� d�e��Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�e@dk �r�G d�d�� d�e@j��Z�e�� j�Z�ne�Z�dS )�z
Various utility functions.
� )�absolute_import�print_functionN)� rdatatype)� DNSException)�NXDOMAIN)�AddrFormatError)�HTTPSConnection)�errors�messages)�DOMAIN_LEVEL_0� TLS_VERSIONS�TLS_VERSION_MINIMAL�TLS_VERSION_MAXIMAL�TLS_VERSION_DEFAULT_MIN�TLS_VERSION_DEFAULT_MAX)�is_ipa_client_configured)�_)� constants)�paths)�ipautil)� SSHPublicKey)�DN�RDN)�DNSName� DNSResolver�resolve�resolve_ip_addresses)� ScriptError� � z /var/lib/ipa-client/sysrestorez/etc/ipa/default.confc C s� t | ttf�r dd� | D �S t | t�r8dd� | j� D �S t | ttttt d �f�rT| S t | t
�rh| j d�S t | t j
tf�r�t
| �S tt| dd ��s�dS t| j� �S )Nc S s g | ] }t |��qS � )�json_serialize)�.0�or r �/usr/lib/python3.6/util.py�
<listcomp>^ s z"json_serialize.<locals>.<listcomp>c S s i | ]\}}t |�|�qS r )r! )r" �k�vr r r$ �
<dictcomp>` s z"json_serialize.<locals>.<dictcomp>zutf-8�__json__� )�
isinstance�list�tuple�dict�items�int�bool�float�unicode�type�str�decode�decimalZDecimalr �callable�getattrr! r) )�objr r r$ r! \ s
r! c C sP yt | �stj| d��W n2 tjjk
rJ } ztj|d��W Y d d }~X nX d S )N)�hostname)� exception)r r ZDNSNotARecordError�dnsr< r ZDNSResolverError)ZfqdnZexr r r$ �verify_host_resolvablem s
r> c C sd yt | tj� d}W n tk
r, d}Y nX yt | tj� d}W n tk
rZ d}Y nX |pb|S )zX
Checks to see if given domain has SOA or NS record.
Returns True or False.
TF)r r �SOAr ZNS)�domainZsoa_record_foundZns_record_foundr r r$ �has_soa_or_ns_recordv s
rA c C s� t � }| jd�}t|�dkrFt|d �j� |d< t|d �j� |d< nP| jd�}t|�dkr�t|d �j� |d< t|d �j� |d< nt| �j� |d< |S ) N�@r � r@ r �name�\Zflatname)r. �split�lenr3 �lower)rD �resultZ
componentsr r r$ �normalize_name� s
rJ c C s: dj | j� �} t| �d dks.tjd| �dkr2dS dS dS )a�
Validate the incoming data as valid base64 data or not. This is only
used in the ipalib.Parameters module which expects ``data`` to be unicode.
The character set must only include of a-z, A-Z, 0-9, + or / and
be padded with = to be a length divisible by 4 (so only 0-2 =s are
allowed). Its length must be divisible by 4. Whitespace is
not significant so it is removed.
This doesn't guarantee we have a base64-encoded value, just that it
fits the base64 requirements.
r* � r z^[a-zA-Z0-9\+\/]+\={0,2}$NFT)�joinrF rG �re�match)�datar r r$ �isvalid_base64� s
rP c C sJ d}| j d�}|dkr$d}| j d�}|dkrF| j d�}| || |� } | S ) zM
Remove the header and footer (and surrounding material) from a CSR.
�( s' -----BEGIN NEW CERTIFICATE REQUEST-----rC �$ s# -----BEGIN CERTIFICATE REQUEST-----r s -----END���)�find)ZcsrZ headerlen�s�er r r$ �strip_csr_header� s
rW c C sX yt jt j| � W n@ t jk
rR yt jt j| � W n t jk
rL dS X Y nX dS )zj
Check to see if the given IP address is a valid IPv4 or IPv6 address.
Returns True or False
FT)�socketZ inet_ptonZAF_INET�errorZAF_INET6)�ipaddrr r r$ �validate_ipaddr� s r[ c C s� | dkrt jtd�d��yLtjj| �rPtj| tj�sbt jtd�t| d� d��nt | d�}|j
� W n6 t t fk
r� } zt jt
|�d��W Y dd}~X nX dS )zr
Determine if the file is writable. If the file doesn't exist then
open the file to test writability.
NzFilename is empty)�reasonzPermission denied: %(file)s)�file�w)r Z FileErrorr �os�path�isfile�access�W_OKr. �open�close�IOError�OSErrorr5 )�filename�fprV r r r$ �check_writable_file� s
rj c C sN | st | t� r| S d| krJ| jd�\}}}|jdd�}dj|d|f�} | S )NrB �.z\.r* )r+ r5 � partition�replacerL )�zonemgrrD Z_atr@ r r r$ �normalize_zonemgr� s ro c C s | d dkr| d S | S d S )NrC rk rS r )�zoner r r$ �normalize_zone� s rq c C s� | dkr|dkrdS | dkr t } |dkr,t}tjt �}ytj| �}W n$ tk
rh tdj| d���Y nX ytj|�}W n$ tk
r� tdj|d���Y nX ||kr�td��||k r�|}tjd| t| � ||k r�|}tjd|t| � t||d � S ) a
This function checks whether the given TLS versions are known in
IPA and that these versions fulfill the requirements for minimal
TLS version (see
`ipalib.constants: TLS_VERSIONS, TLS_VERSION_MINIMAL`).
:param tls_version_min:
the lower value in the TLS min-max span, raised to the lowest
allowed value if too low
:param tls_version_max:
the higher value in the TLS min-max span, raised to tls_version_min
if lower than TLS_VERSION_MINIMAL
:raises: ValueError
Nz5tls_version_min ('{val}') is not a known TLS version.)�valz5tls_version_max ('{val}') is not a known TLS version.z/tls_version_min is higher than tls_version_max.z5tls_version_min set too low ('%s'),using '%s' insteadz5tls_version_max set too low ('%s'),using '%s' insteadrC )r
r r �index�
ValueError�format�logger�warning)�tls_version_min�tls_version_maxZmin_allowed_idxZmin_version_idxZmax_version_idxr r r$ �get_proper_tls_version_span� s8
rz c K s� t jt jt jt jt jtt dd�d�} |dkr4td��tj j
|� sRtj |tj � rbtdj
|d���t jt j�}
|
jt jt jB t jB t jB O _tjdk r�|
jtj� t||�} | dk r�x<tD ]4} | | kr�|
j| | M _q�|
j| | O _q�W t|
dd�dk �rd |
_t j|
_ d |
_ |
j |� |dk �rj|dk �rXt |��}
|
j � }W dQ R X nd}|
j!|||� t"| |fd
|
i|��S ) a]
Create a customized HTTPSConnection object.
:param host: The host to connect to
:param port: The port to connect to, defaults to
HTTPSConnection.default_port
:param cafile: A PEM-format file containning the trusted
CA certificates
:param client_certfile:
A PEM-format client certificate file that will be used to
identificate the user to the server.
:param client_keyfile:
A file with the client private key. If this argument is not
supplied, the key will be sought in client_certfile.
:param keyfile_passwd:
A path to the file which stores the password that is used to
encrypt client_keyfile. Leave default value if the keyfile
is not encrypted.
:returns An established HTTPS connection to host:port
Z
OP_NO_TLSv1_3r )Zssl2Zssl3ztls1.0ztls1.1ztls1.2ztls1.3NzFcafile argument is required to perform server certificate verificationz.cafile '{file}' doesn't exist or is unreadable)r] �post_handshake_authT�context)#�sslZ OP_NO_SSLv2Z OP_NO_SSLv3Z OP_NO_TLSv1Z
OP_NO_TLSv1_1Z
OP_NO_TLSv1_2r9 � RuntimeErrorr_ r` ra rb �R_OKru Z
SSLContextZPROTOCOL_TLS_CLIENTZoptionsZOP_ALLZOP_NO_COMPRESSIONZOP_SINGLE_DH_USEZOP_SINGLE_ECDH_USEr ZTLS_HIGH_CIPHERSZ set_ciphersrz r r{ Z
CERT_REQUIREDZ verify_modeZcheck_hostnameZload_verify_locationsrd �readZload_cert_chainr )�host�portZcafileZclient_certfileZclient_keyfileZkeyfile_passwdrx ry �kwargsZtls_cutoff_mapZctxZtls_span�versionZpwd_fZpasswdr r r$ �create_https_connection& sF
r� Fc
C s� d}d}d}|r|d7 }|r$|d7 }|d }dt |||d� }tj|tjtjB �}| sbttd���t| �d krzttd
���|j| �s�d j d d
� || D ��}d j dd
� |D ��} ttd�t || d� ��d S )Nza-z0-9r* r �/�-a6 ^[%(base)s%(extra)s] # must begin with an alphanumeric
# character, or underscore if
# allow_underscore is True
([%(base)s%(extra)s%(middle)s]* # can contain all allowed character
# classes in the middle
[%(base)s%(extra)s])*$ # must end with alphanumeric
# character or underscore if
# allow_underscore is True
)�baseZextraZmiddlezempty DNS label�? z-DNS label cannot be longer that 63 charactersz, c s s | ]}d | V qdS )z'%s'Nr )r" �cr r r$ � <genexpr>� s z%validate_dns_label.<locals>.<genexpr>c s s | ]}d | V qdS )z'%s'Nr )r" r� r r r$ r� � s z\only letters, numbers, %(chars)s are allowed. DNS label may not start or end with %(chars2)s)�chars�chars2)
r. rM �compile�
IGNORECASE�VERBOSErt r rG rN rL )
Z dns_label�allow_underscore� allow_slashZ
base_charsZ extra_charsZ middle_charsZ label_regexZregexr� r� r r r$ �validate_dns_label� s&
r� r@ c C s\ | j d�r| d d� } | jd�} t| �dk r>ttdj|����x| D ]}t|||� qDW d S )Nrk rC r z"single label {}s are not supportedrS )�endswithrF rG rt r ru r� )Z domain_namer� r� Zentity�labelr r r$ �validate_domain_name� s
r� c C s$ t dd� | jD ��r ttd���d S )Nc s s | ]}d |kV qdS )� @Nr )r" r� r r r$ r� � s z#validate_zonemgr.<locals>.<genexpr>ztoo many '@' characters)�any�labelsrt r )rn r r r$ �validate_zonemgr� s r� c C s t | �} t| � t| �} t| �S )N)ro �validate_idna_domainr r� )rn r r r$ �validate_zonemgr_str� s r� T� c C s~ t | �|kr ttdj|����| jd�r4| dd� } d| krHttd���d| krn|r`ttd���t| ||� n t| ||� dS ) a See RFC 952, 1123
Length limit of 64 imposed by MAXHOSTNAMELEN on Linux.
DNS and other operating systems has a max length of 255. Default to
the theoretical max unless explicitly told to limit. The cases
where a limit would be set might include:
* *-install --hostname
* ipa host-add
The *-install commands by definition are executed on Linux hosts so
the maximum length needs to be limited.
:param hostname Checked value
:param check_fqdn Check if hostname is fully qualified
z#cannot be longer that {} charactersrk NrC z..z0hostname contains empty label (consecutive dots)znot fully qualifiedrS )rG rt r ru r� r� r� )r; Z
check_fqdnr� r� �maxlenr r r$ �validate_hostname� s
r� c C s t | �j� S )N)r �openssh)�valuer r r$ �normalize_sshpubkey� s r� c C s2 y t |� W n ttfk
r( td�S X d S d S )Nzinvalid SSH public key)r rt �UnicodeDecodeErrorr )�ugettextr� r r r$ �validate_sshpubkey� s
r� c C sB y t |�}W n ttfk
r( td�S X |j� r:td�S d S d S )Nzinvalid SSH public keyzoptions are not allowed)r rt r� r Z has_options)r� r� �pubkeyr r r$ � validate_sshpubkey_no_options� s
r� c
C s� | j d�}|sd S g }g }x||D ]t}y t|�}W n ttfk
rJ w Y nX |j� }|j� }|rld||f }d||j� f }|j|j� � |j|� q W d| kr�|p�d | d< |r�|| d< d S )N� ipasshpubkeyz%s %sz%s (%s)Z sshpubkeyfp) �getr rt r� Zfingerprint_hex_sha256�commentZkeytype�appendr� )� entry_attrsZpubkeysZ
newpubkeysZ fingerprintsr� ri r� r r r$ �convert_sshpubkey_post s*
r� c C s* d|kpd|ks&t | dd� |jd� dS )z�
Attribute ipasshpubkey should be added to attrs_list to be able compute
ssh fingerprint. This attribute must be removed later if was added here
(see remove_sshpubkey_from_output_post).
r� �*�ipasshpubkey_addedTN)�setattrr� )r| Z
attrs_listr r r$ �add_sshpubkey_to_attrs_pre s r� c C s& t | dd�r"|jdd� t| d� dS )zJ
Remove ipasshpubkey from output if it was added in pre_callbacks
r� Fr� N)r9 �pop�delattr)r| r� r r r$ �!remove_sshpubkey_from_output_post+ s r� c C s4 t | dd�r0x|D ]}|jdd� qW t| d� dS )zJ
Remove ipasshpubkey from output if it was added in pre_callbacks
r� Fr� N)r9 r� r� )r| Zentriesr� r r r$ �&remove_sshpubkey_from_output_list_post4 s
r� z4([-+]?((\d+)|(\d+\.\d+)|(\.\d+)|(\d+\.)))\s*([a-z]+)im � �< � � rC )ZyearZyears�yZmonthZmonthsZweekZweeksr^ ZdayZdays�dZhourZhours�hZminuteZminutes�min�second�secondsZsecrU c C s� d}d}x�t j| �D ]z}|d7 }|jd�}|jd�}|dkrBd}n4|d krPd}n&|j� }tj|�}|d
krvtd | ��t|�}|| }||7 }qW |dkr�td | ��|S )a�
Given a time duration string, parse it and return the total number
of seconds represented as a floating point value. Negative values
are permitted.
The string should be composed of one or more numbers followed by a
time unit. Whitespace and punctuation is optional. The numbers may
be optionally signed. The time units are case insenstive except
for the single character 'M' or 'm' which means month and minute
respectively.
Recognized time units are:
* year, years, y
* month, months, M
* week, weeks, w
* day, days, d
* hour, hours, h
* minute, minutes, min, m
* second, seconds, sec, s
Examples:
"1h" # 1 hour
"2 HOURS, 30 Minutes" # 2.5 hours
"1week -1 day" # 6 days
".5day" # 12 hours
"2M" # 2 months
"1h:15m" # 1.25 hours
"1h, -15min" # 45 minutes
"30 seconds" # .5 minute
Note: Despite the appearance you can perform arithmetic the
parsing is much simpler, the parser searches for signed values and
adds the signed value to a running total. Only + and - are permitted
and must appear prior to a digit.
:parameters:
value : string
A time duration string in the specified format
:returns:
total number of seconds as float (may be negative)
r g rC r� �Mr� r� r� �mNz unknown time duration unit "%s"z no time duration found in "%s"i� i�� i �' )�time_duration_re�finditer�grouprH �time_duration_unitsr� rt r2 )r� ZmatchesZdurationrN Z magnitudeZunitZseconds_per_unitr� r r r$ �parse_time_duration[ s( -
r� �A�AAAA�SSHFPc s. d� � �fdd�|D �}dj |�}|d7 }|S )aj
Generate update policy for a forward DNS zone (idnsUpdatePolicy
attribute). Bind uses this policy to grant/reject access for client
machines trying to dynamically update their records.
:param realm: A realm of the of the client
:param rrtypes: A list of resource records types that client shall be
allowed to update
z&grant %(realm)s krb5-self * %(rrtype)sc s g | ]}� t �|d � �qS ))�realm�rrtype)r. )r" r� )�policy_elementr� r r$ r% � s z6get_dns_forward_zone_update_policy.<locals>.<listcomp>z; �;)rL )r� �rrtypes�policies�policyr )r� r� r$ �"get_dns_forward_zone_update_policy� s
r� �PTRc s0 d� � ��fdd�|D �}dj |�}|d7 }|S )a
Generate update policy for a reverse DNS zone (idnsUpdatePolicy
attribute). Bind uses this policy to grant/reject access for client
machines trying to dynamically update their records.
:param realm: A realm of the of the client
:param reverse_zone: Name of the actual zone. All clients with IPs in this
sub-domain will be allowed to perform changes
:param rrtypes: A list of resource records types that client shall be
allowed to update
z2grant %(realm)s krb5-subdomain %(zone)s %(rrtype)sc s g | ]}� t ��|d � �qS ))r� rp r� )r. )r" r� )r� r� � reverse_zoner r$ r% � s z6get_dns_reverse_zone_update_policy.<locals>.<listcomp>z; r� )rL )r� r� r� r� r� r )r� r� r� r$ �"get_dns_reverse_zone_update_policy� s
r� rK � c C s t | �j� S )N)r Z
is_reverse)Z zone_namer r r$ �zone_is_reverse� s r� c C sV t jt| ��}|jjd�}|jdkr2|dd � }n|jdkrH|dd � }tdj|��S )Nrk rK rC � � )�netaddr� IPAddressr5 Z reverse_dnsrF r� rq rL )�
ip_address�ipr/ r r r$ �get_reverse_zone_default� s
r� c C s: y t |� W n$ tk
r0 } zt|�S d }~X nX d S d S )N)r � Exceptionr5 )r� r� rV r r r$ �validate_rdn_param� s
r� c C s4 yt j|� W n ttfk
r* td�S X d S d S )Nzinvalid hostmask)r� Z IPNetworkrt r r )r� Zhostmaskr r r$ �validate_hostmask� s
r� c s" e Zd ZdZd� fdd� Z� ZS )�ForwarderValidationErrorNc s( t j| ||f|� tt| �j| j� d S )N)r
Zprocess_message_arguments�superr� �__init__�msg)�selfru �message�kw)� __class__r r$ r� � s z!ForwarderValidationError.__init__)NN)�__name__�
__module__� __qualname__ru r� �
__classcell__r r )r� r$ r� � s r� c @ s e Zd Zed�ZdS )�UnresolvableRecordErrorz&query '%(owner)s %(rtype)s': %(error)sN)r� r� r� r ru r r r r$ r� � s r� c @ s e Zd Zed�ZdS )�EDNS0UnsupportedErrorz1query '%(owner)s %(rtype)s' with EDNS0: %(error)sN)r� r� r� r ru r r r r$ r� � s r� c @ s e Zd Zed�ZdS )�DNSSECSignatureMissingErrorzRanswer to query '%(owner)s %(rtype)s' is missing DNSSEC signatures (no RRSIG data)N)r� r� r� r ru r r r r$ r� s r� c @ s e Zd Zed�ZdS )�DNSSECValidationErrorzFrecord '%(owner)s %(rtype)s' failed DNSSEC validation on server %(ip)sN)r� r� r� r ru r r r r$ r� s r� c C s( t | di �jd�}|r$tjd| |� dS )z�
If exception contains response from server, log this response to debug log
:param log: if log is None, do not log
:param e: DNSException
r� �responsez%DNSException: %s; server response: %sN)r9 r� rv �debug)rV r� r r r$ �
_log_response
s r� �
c C s~ t � }|r|g|_||_|jtjj� |r`|jdtjjd� tjj}|rT|tjj B }|j|� n|rr|jddd� |j
| |�S )z�
:param nameserver_ip: if None, default resolvers will be used
:param edns0: enables EDNS0
:param dnssec: enabled EDNS0, flags: DO
:param flag_cd: requires dnssec=True, adds flag CD
:raise DNSException: if error occurs
r i ) r Z nameserversZlifetimeZ set_flagsr= �flagsZRDZuse_ednsZDOZCDr ) �owner�rtype�
nameserver_ip�edns0�dnssec�flag_cd�timeout�resr� r r r$ �_resolve_record s r� c C s� yt | |||d� W n: tk
rN } z t|� t| |||d��W Y dd}~X nX yt | ||d|d� W n: tk
r� } z t|� t| |||d��W Y dd}~X nX dS )z�
Validate if forwarder supports EDNS0
:raise UnresolvableRecordError: record cannot be resolved
:raise EDNS0UnsupportedError: EDNS0 is not supported by forwarder
)r� r� )r� r� r� rY NT)r� r� r� )r� r r� r� r� )r� r� �ip_addrr� rV r r r$ �_validate_edns0_forwarder7 s
r c C s� t | �} d}d}t||| |d� yt||| d|d�}W n8 tk
rn } z t|� t||| d��W Y dd}~X nX y,|jj|jjt j
j t j j
t jjt jj� W n" tk
r� t||| d��Y nX dS )aE Test DNS forwarder properties. against root zone.
Global forwarders should be able return signed root zone
:raise UnresolvableRecordError: record cannot be resolved
:raise EDNS0UnsupportedError: EDNS0 is not supported by forwarder
:raise DNSSECSignatureMissingError: did not receive RRSIG for root zone
rk r? )r� T)r� r� r� )r� r� r� N)r5 r r� r r� r� r� Z
find_rrset�answerr= rD �rootZ
rdataclass�INr ZRRSIGr? �KeyError)r� r� r� r� ZansrV r r r$ � validate_dnssec_global_forwarderO s
r c C s t |d| |d� dS )z�
Only forwarders in forward zones can be validated in this way
:raise UnresolvableRecordError: record cannot be resolved
:raise EDNS0UnsupportedError: ENDS0 is not supported by forwarder
r? )r� N)r )r� �fwzoner� r r r$ �$validate_dnssec_zone_forwarder_step1p s r c C s d}yt ||| ddd|d�}W np tk
rV } z t|� t||| d��W Y dd}~X n: tk
r� } z t|� t||| |d��W Y dd}~X nX yt ||| dd|d�}W n8 tk
r� } z t|� t||| d��W Y dd}~X n,X |j|jkr�|j|jkr�dS t||| d��dS )a�
This step must be executed after forwarders are added into LDAP, and only
when we are sure the forwarders work.
Query will be send to IPA DNS server, to verify if reply passed,
or DNSSEC validation failed.
Only forwarders in forward zones can be validated in this way
:raise UnresolvableRecordError: record cannot be resolved
:raise DNSSECValidationError: response from forwarder is not DNSSEC valid
r? T)r� r� r� r� r� )r� r� r� N)r� r� r� rY )r� r� r� r� )r� r r� r� r r� Zcanonical_nameZrrset)Z ipa_ip_addrr r� r� Zans_cdrV Zans_dor r r$ �$validate_dnssec_zone_forwarder_step2y s,
r c C s< d}y t | � W n� tjjk
r0 td�}Y n� tjjk
rN td�}Y n� tjjk
rl td�}Y n� tjjk
r� td�}Y n� tjj k
r� td�}Y n�X t
j d| t
j d�}y x|D ]}|j
d � q�W W nP tk
�r( td
d � |D ��}|�r$td �| d
jdd� |D ��d� }Y nX |�r8t|��dS )z
Validate if value is valid IDNA domain.
If domain is not valid, raises ValueError
:param value:
:return:
Nz"invalid escape code in domain namezempty DNS labelz0domain name cannot be longer than 255 charactersz-DNS label cannot be longer than 63 characterszinvalid domain nameu [.．。｡])r� �asciic s s | ]}t jj|�|kV qd S )N)� encodings�idna�nameprep)r" �xr r r$ r� � s z'validate_idna_domain.<locals>.<genexpr>z@domain name '%(domain)s' should be normalized to: %(normalized)srk c S s g | ]}t jj|��qS r )r
r r )r" r
r r r$ r% � s z(validate_idna_domain.<locals>.<listcomp>)r@ Z
normalized)r r= rD Z BadEscaper Z
EmptyLabelZ NameTooLongZ LabelTooLongr< � SyntaxErrorrM rF �UNICODE�encode� UnicodeErrorr� rL rt )r� rY r� r� Z
is_nonnormr r r$ r� � s4
r� c
C s� t d�}t |�}|| }ynt|tj�}|jj}t|�dkr�t|d �dkr�|d jtjkr�|d d }|j� dj | j
j �kr�dS dS W n t k
r� Y nX t d�}|| } yt| tj
� W n t k
r� dS X dS d S )
aP
Detects the type of the realm that the given DNS zone belongs to.
Note: This method is heuristic. Possible values:
- 'current': For IPA domains belonging in the current realm.
- 'foreign': For domains belonging in a foreing kerberos realm.
- 'unknown': For domains whose allegiance could not be detected.
Z _kerberosrC r z"{0}"ZcurrentZforeignz_ldap._tcp.gc._msdcs�unknownN)r r r ZTXTr� r rG ZrdtypeZto_textru �envr� r ZSRV)
�apir@ Zkerberos_prefixZ
domain_suffixZkerberos_record_namerI r �recordZ gc_prefixZad_specific_record_namer r r$ �detect_dns_zone_realm_type� s, r c C s | j d � jdt�}|tkS )NZdomainlevel_getrI )�Commandr� r )r Z domainlevelr r r$ �has_managed_topology s r c C s� |r|| j jd�}|dk r@td| � tdttj| j d �� � | j jd�}|dk r|td| � tdttj| j d �� � dS )
z�Pretty print nsds5replicalastinitstatus, nsds5replicalastinitend,
nsds5replicalastupdatestatus, nsds5replicalastupdateend for a
replication agreement.
Znsds5replicalastinitstatusNz last init status: %sz last init ended: %sZnsds5replicalastinitendZ nsds5replicalastupdatestatusz last update status: %sz last update ended: %sZnsds5replicalastupdateend)� single_valuer� �printr5 r Zparse_generalized_time)�entry�verboseZ
initstatusZ updatestatusr r r$ �print_replication_status s r c @ s: e Zd ZdZddd�Zdd� Zdd � Zd
d � Zd d
� ZdS )�
classproperty�__doc__�fgetNc C s& |d kr|d k r|j }|| _|| _ d S )N)r r )r� r �docr r r$ r� " s zclassproperty.__init__c C s& | j d k r| j j||�� S td��d S )Nzunreadable attribute)r �__get__�AttributeError)r� r: �obj_typer r r$ r" * s
zclassproperty.__get__c C s t d��d S )Nzcan't set attribute)r# )r� r: r� r r r$ �__set__/ s zclassproperty.__set__c C s t d��d S )Nzcan't delete attribute)r# )r� r: r r r$ �
__delete__2 s zclassproperty.__delete__c C s
|| _ | S )N)r )r� r r r r$ �getter5 s zclassproperty.getter)r r )NN) r� r� r� � __slots__r� r" r% r& r' r r r r$ r s
r c @ s e Zd ZdZdd� ZdS )�classobjectpropertyr c C s( | j d k r | j j||�|�S td��d S )Nzunreadable attribute)r r" r# )r� r: r$ r r r$ r" ? s
zclassobjectproperty.__get__N)r )r� r� r� r( r" r r r r$ r) : s r) c C s" | j d�r| dd� } | j� } | S )z-Use common fqdn form without the trailing dotrk NrC rS )r� rH )r; r r r$ �normalize_hostnameE s
r* c C sB yt ||d� W n, tk
r< } ztd�t|� S d}~X nX dS )a Validator used by plugins to ensure hostname compliance.
In Linux the maximum hostname length is 64. In DNS and
other operaring systems (Solaris) it is 255. If not explicitly
checking a Linux hostname (e.g. the server) use the DNS
default.
)r� zinvalid domain-name: %sN)r� rt r r3 )r� r� r� rV r r r$ �hostname_validatorM s
r+ c C sd y@t jt|�t jd�}|d k r>|j|kr>td�t|j|d� S W n t jtfk
r^ td�S X d S )N)r� zFinvalid IP address version (is %(value)d, must be %(required_value)d)!)r� Zrequired_valuezinvalid IP address format) r� r� r5 Z INET_PTONr� r r. r rt )r� rZ Z
ip_versionr� r r r$ �ipaddr_validator] s
r, c C st |j d�\}}}t| |�}|d k r&|S |rpy"t|�}|dk sD|dkrJt� �W n" tk
rn tdt|d� �S X d S )Nz port r i�� z %(port)s is not a valid port)r� )rl r, r0 rt r r. )r� Z forwarderr� �sepr� Zip_address_validationr r r$ �validate_bind_forwardern s
r. c C sB t dd� | d D ��}d|kr"d S d| kr>d| kr>| d | d< d S )Nc s s | ]}|j � V qd S )N)rH )r" �ir r r$ r� � s z'set_krbcanonicalname.<locals>.<genexpr>� objectclassZkrbprincipalaux�krbprincipalname�krbcanonicalname)�set)r� Z
objectclassesr r r$ �set_krbcanonicalname� s r4 c G sB | j |jddg�}|jjdd�}||d kr>tjdtd�d��dS )a
ensure that the LDAP entry has at least one value of krbprincipalname
and that this value is equal to krbcanonicalname
:param ldap: LDAP connection object
:param entry_attrs: LDAP entry made prior to update
:param options: command options
r2 r1 NrC zHat least one value equal to the canonical principal name must be present)rD rY rS )� get_entry�dnr r� r �ValidationErrorr )�ldapr� �keysr r2 r r r$ � ensure_last_krbprincipalname� s r: c C sX | j |jdddg�}|jjdd �d k r*d S t|� |jdd � |jdd � |j|� d S )Nr2 r1 r0 )r5 r6 r r� r4 r� �update)r8 r� Z old_entryr r r$ �ensure_krbcanonicalname_set� s r< c C s^ d}| dk rF| j tjkrFtjj| j�r*dS td| j � d| j� d�|��t� rPdS td|��dS )a
Check if IPA client is configured on the system.
This is a convenience wrapper that also supports using
a custom configuration via IPA_CONFDIR.
Raises a ScriptError exception if the client is not
configured.
Hardcode return code to avoid recursive imports
r NTz5IPA client is not configured on this system (confdir z is missing �)z+IPA client is not configured on this system) Zconfdirr ZETC_IPAr_ r` ra Z conf_defaultr r )r ZCLIENT_NOT_CONFIGUREDr r r$ �check_client_configuration� s r> c G s� | j jddd�d }t� }xd|D ]\}|jdg �}|jtdd� |D ��� d|krf|j|d d j� � |j|d d j� � q W xH|d D ]<}|j}|jr�|j nd }||ks�||kr�t
j d t d
�d��q�W d S )a7
Check that principal name's suffix does not overlap with UPNs and realm
names of trusted forests.
:param api_instance: API instance
:param suffixes: principal suffixes
:raises: ValidationError if the suffix coincides with realm name, UPN
suffix or netbios name of trusted domains
r* r )Z sizelimitrI Zipantadditionalsuffixesc s s | ]}|j � V qd S )N)rH )r" �upnr r r$ r� � s z;check_principal_realm_in_trust_namespace.<locals>.<genexpr>Z
ipantflatnameZcnrC Nr1 z:realm or UPN suffix overlaps with trusted domain namespace)rD rY rS )
r Z
trust_findr3 r� r; �addrH r� Z
is_enterpriseZ
upn_suffixr r7 r ) Z api_instancer9 Z
trust_objectsZtrust_suffix_namespacer: Z nt_suffixesZ principalr� r? r r r$ �(check_principal_realm_in_trust_namespace� s
rA c C s: x4| D ],}|j � stjd|� tdj|�tjd� qW d S )Nz.No network interface matches the IP address %sz7WARNING: No network interface matches the IP address {})r] )Zget_matching_interfacerv rw r ru �sys�stderr)Z addr_listr� r r r$ �,no_matching_interface_for_ip_address_warning� s
rD c
C sH y t jdtj| tjd��d S ttt jfk
rB t j
j dd�S X dS )z�
Get current terminal height
Args:
fd (int): file descriptor. Default: 1 (stdout)
Returns:
int: Terminal height
Zhhs 1234r ZLINES� N) �struct�unpack�fcntlZioctl�termiosZ
TIOCGWINSZrf rg rY r_ �environr� )�fdr r r$ �get_terminal_height s
rL c C s t jjdd�} tj| �S )zl Get path to a pager
:return: path to the file if it exists otherwise None
:rtype: str or None
ZPAGERZless)r_ rJ r� �shutilZwhich)�pagerr r r$ � get_pager s rO c C sD t j|gt jd�}y|jj| � |j� W n tk
r> Y nX dS )z�
Open text data in pager
Args:
data (bytes): data to view in pager
pager (str): path to the pager
Returns:
None
)�stdinN)�
subprocess�Popen�PIPErP �writeZ communicaterf )rO rN Z
pager_processr r r$ �
open_in_pager! s rU c sJ e Zd Zeeeeeee e
e e e
d�h Z� fdd�Zdd� Zdd� Z� ZS )�APIReprNc sB t t| �j� x.| jj� D ] \}}t|t�rt| |tj � qW d S )N)
r� rV r� �__dict__r/ r+ r0 r� rB �maxsize)r� r& r' )r� r r$ r� > s
zAPIRepr.__init__c C s dt |� S )zOutput with u'' prefix�u)�repr)r� r
�levelr r r$ �repr_strE s zAPIRepr.repr_strc C s. |t kr dS || jkr"dj|j�S t|�S d S )Nz<type 'unicode'>z <type '{}'>)r5 �
builtin_typesru r� rZ )r� r
r[ r r r$ � repr_typeI s
zAPIRepr.repr_type)r� r� r� r1 r0 r2 r5 �bytesr. r- r, r3 � frozensetr4 r] r� r\ r^ r� r r )r� r$ rV 6 s
rV )r r )FF)FFr@ )TFFr� i8" i i�3�i8" i i�3�i8" i i�3�i� i�� i �' i� i�� i �' � i`' i�: ra i`' i�: ra i`' i�: i� i�Q i� i�Q i� i�Q i i i �r� r� r� )rb �r� )rc )NFFFr� )r� )r� )r� )r� )r� )N)N)rC )�r Z
__future__r r Zloggingr_ rX rM r7 r= r
rB r} rI rH rM rF rQ r� r Z
dns.exceptionr Z dns.resolverr Z netaddr.corer ZsixZhttplibr � ImportErrorZ http.clientZipalibr r
Zipalib.constantsr r r
r r r Z ipalib.factsr Z ipalib.textr Zipaplatform.constantsr Zipaplatform.pathsr Z ipapythonr Z
ipapython.sshr Z ipapython.dnr r Zipapython.dnsutilr r r r Zipapython.admintoolr � version_info�reprlibZPY3r5 r3 Z_IPA_CLIENT_SYSRESTOREZ_IPA_DEFAULT_CONFZ getLoggerr� rv r! r> rA rJ rP rW r[ rj ro rq rz Z default_portr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� Z ip4_rev_zoneZ ip6_rev_zoneZREVERSE_DNS_ZONESr� r� r� r� r� r� r� r� r� r� r� r� r r r r r� r r r r r) r* r+ r, r. r4 r: r< r> rA rD rL rO rU �ReprrV rZ Zapireprr r r r$ �<module> s
5 X
&
" G
!
(,4
!%