D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python3.9
/
site-packages
/
ipaclient
/
__pycache__
/
Filename :
discovery.cpython-39.pyc
back
Copy
a }�f;] � @ sT d dl mZ d dlZd dlZd dlmZ d dlmZ d dlm Z d dl m Z d dl m Z d dlmZmZ d d lmZ d d lmZmZ d d lmZ z d dlZW n ey� dZY n0 d d lmZ e� e �Z d Z d Z dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)e de de!de"de#de$d e%d e&d e'd e(d i Z*d!d"� Z+G d#d$� d$�Z,d%d&� Z-e d'k�rPe-� dS )(� )�absolute_importN)� rdatatype)� DNSException)�errors)�FQDN)�validate_domain_name)� query_srv�resolve)�paths)�valid_ip�realm_to_suffix)�DN)�ipaldap���������������i����i����i����i�zipa v2.0ZSuccess�NOT_FQDN�NO_LDAP_SERVER�REALM_NOT_FOUND�NOT_IPA_SERVER�NO_ACCESS_TO_LDAP� NO_TLS_LDAP�PYTHON_LDAP_NOT_INSTALLED�BAD_HOST_CONFIG� UNKNOWN_ERRORc C s | j t� ddgd�}dd� |jd D �}d|v rd|jd \}|�d�}||v rX|�|� |�d|� |D ]�}t�d|� z| �t|�| j d �\}W n" t j y� t�d � Y qhY n0 |jd \}|�d�� � }|t kr�t�d |t � qht�d |� t|� S dS )z� Get base DN of IPA suffix in given LDAP server. None is returned if the suffix is not found :param conn: Bound LDAPClient that will be used for searching ZdefaultnamingcontextZnamingcontexts)Z attrs_listc S s g | ]}|� d ��qS )�utf-8)�decode)�.0�c� r! �7/usr/lib/python3.9/site-packages/ipaclient/discovery.py� <listcomp>T � z"get_ipa_basedn.<locals>.<listcomp>r r z'Check if naming context '%s' is for IPAz (info=IPA*)zBLDAP server did not return info attribute to check for IPA version�infoz>Detected IPA server version (%s) did not match the client (%s)z*Naming context '%s' is a valid IPA contextN)Z get_entryr �rawr �remove�insert�logger�debug� get_entriesZ SCOPE_BASEr �NotFound�lower�IPA_BASEDN_INFO)Zconn�entryZcontexts�default�contextr% r! r! r" �get_ipa_basednI s< � � � r2 c @ s~ e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z d dd�Z d dd�Z d dd�Z d!dd�Zd"d d �ZdS )#� IPADiscoveryc C s: d | _ d | _d | _g | _d | _d | _d | _d | _d | _d S �N) �realm�domain�server�servers�basedn� realm_source� domain_source� server_source� basedn_source��selfr! r! r" �__init__t s zIPADiscovery.__init__c C s� g }d}z�t tjd��}|�� }W d � n1 s40 Y |D ]R}|�� �d�rf|�� d df}qB|�� �d�rB|�dd� |�� d d� D �� qBW n ty� Y n0 |r�|g| }|S ) z�Read /etc/resolv.conf and return all domains Returns a list of (domain, info) pairs. The info contains a reason why the domain is returned. N�rr6 r z"local domain from /etc/resolv.conf�searchc s s | ]}|d fV qdS )z#search domain from /etc/resolv.confNr! )r �dr! r! r" � <genexpr>� s �z6IPADiscovery.__get_resolver_domains.<locals>.<genexpr>� ) �openr Z RESOLV_CONF� readlinesr- � startswith�split�extend� Exception)r? �domainsr6 �f�lines�liner! r! r" Z__get_resolver_domains� s& & � � z#IPADiscovery.__get_resolver_domainsc C s | j S r4 )r7 r> r! r! r" � getServerName� s zIPADiscovery.getServerNamec C s | j S r4 )r6 r> r! r! r" � getDomainName� s zIPADiscovery.getDomainNamec C s | j S r4 )r5 r> r! r! r" � getRealmName� s zIPADiscovery.getRealmNamec C s | j S r4 )�kdcr> r! r! r" � getKDCName� s zIPADiscovery.getKDCNamec C s | j S r4 )r9 r> r! r! r" � getBaseDN� s zIPADiscovery.getBaseDNc C s� d}t �d||� |s|||v r,t �d|� q||�|� | j|dddd�}|rT||fS |�d�}|d krjd S ||d d� }qd S ) a� Given a domain search it for SRV records, breaking it down to search all subdomains too. Returns a tuple (servers, domain) or (None,None) if a SRV record isn't found. servers is a list of servers found. domain is a string. :param tried: A set of domains that were tried already :param reason: Reason this domain is searched (included in the log) NzDStart searching for LDAP SRV record in "%s" (%s) and its sub-domainsz Already searched %s; skipping� _ldap._tcp� F��break_on_first�.r )NNrE )r) r* �add�ipadns_search_srv�find)r? r6 �tried�reasonr8 �pr! r! r" � check_domain� s& � � zIPADiscovery.check_domain� Nc C s^ t �d� t �d|||� d| _d}|�s�|�sF|sDt}t �d|� |sLtS t|�rXtS |�d�}|dkrntS ||d d� }| �� }|d fg| }t � } |D ]�\}} z t |� W n> t y� } z&t �d || � W Y d} ~ q�W Y d} ~ n d} ~ 0 0 | � || | �\}}|r�d }|| _ d || f | _| _ �q.q�| j �s�t �d � tS nTt �d|� | j|dddd�}|�r�d }|| _ d| | _| _nd| _t �d � tS n t �d� || _ d | _| _t �d� |�r�t �d� || _d| _n| �� }|| _d| j | _|�s |�s tS |�r(| �� | _d| j | _nd�|�| _d| _tg} d } t �d� g }|D �]<}t �d|| j� | j|| j|d �} | d t k�r zt | d d d � W n> t �y� } z$t �d!| d | � tg} W Y d} ~ nFd} ~ 0 0 | d | _| d | _d"| j | _| _|� |� |�r� �q�nt| d t t t fv �rNd} |� |� |�r� �q�nD| d tk�rjt �!d#|� n(| d tk�r�t �!d$|� n t �!d%|� �qV| �s�| jdu �r�| j �"� | _d&| _t �d'| j� | �s�| j#du �r�t$| j�| _#d(| _%t �d)| j#� t �d*t&�'| d | d �| j| j | j| j#� t �d+d,�|�� || _(|�rV|d | _t | d < | d S )-a Use DNS discovery to identify valid IPA servers. servers may contain an optional list of servers which will be used instead of discovering available LDAP SRV records. Returns a constant representing the overall search result. z[IPA Discovery]z>Starting IPA discovery with domain=%s, servers=%s, hostname=%sNFz Hostname: %srZ r rE zdomain of the hostnamez!Skipping invalid domain '%s' (%s)Tz(Discovered LDAP SRV records from %s (%s)zNo LDAP server foundz Search for LDAP SRV record in %srV rW rX z#Discovered LDAP SRV records from %szServer and domain forcedZForcedz[Kerberos realm search]zKerberos realm forcedz'Discovered Kerberos DNS records from %sz, z&Kerberos DNS record discovery bypassedz[LDAP server check]z-Verifying that %s (realm %s) is an IPA server�� ca_cert_pathr � r5 �Zentity� Skipping invalid realm '%s' (%s)z&Discovered from LDAP DNS records in %szSkip %s: not an IPA serverzQSkip %s: LDAP server is not responding, unable to verify if this is an IPA serverz/Skip %s: cannot verify if this is an IPA serverzAssumed same as domainz(Assuming realm is the same as domain: %sz Generated from Kerberos realmz Generated basedn from realm: %sz=Discovery result: %s; server=%s, domain=%s, kdc=%s, basedn=%szValidated servers: %s�,))r) r* r7 r r r r r] �#_IPADiscovery__get_resolver_domains�setr � ValueErrorra r6 r< r; r r\ r5 r: �ipadnssearchkrbrealmr �ipadnssearchkrbkdcrS Z kdc_source�joinr � ipacheckldap�SUCCESS�appendr r r Zwarning�upperr9 r r= � error_names�getr8 )r? r6 r8 r5 �hostnamerd Zautodiscoveredr` rL r^ r_ �eZldapretZ ldapaccessZ valid_serversr7 r! r! r" rB � s � �"�� �� � � ��� � � ��� � � zIPADiscovery.searchc C s< t du rtgS g }�z.t �|�}d}|r,d}t�d|� t j|||ddd�}z$|�t� d� t�d� t|�}W n� t j y� t�d� t g Y W S t j �y } zTt� d | j� |du r�t�d � tgW Y d} ~ W S tgW Y d} ~ W S W Y d} ~ n d} ~ 0 0 |du �r"t�d � tgW S || _d |j | _t�d | j� z |�td| j�|jd�} W n t j�y| tg Y W S 0 | D ]<} t�d| j� | jd \} tj �r�| � d�} |� | � �q�|�r |D ] } || k�r�t ||g W S �q�t�d|� tgW S t |�dk�r t�d� tgW S t ||d gW S d�s>J d��W � n� t j!�yh t�d� t"g Y S t j#�y� } z t�d| j� t"gW Y d} ~ S d} ~ 0 t j �y� t�d� t g Y S t j �y } z t�d | j� tgW Y d} ~ S d} ~ 0 t$�y6 } z t�d | � tgW Y d} ~ S d} ~ 0 0 dS )a- Given a host and kerberos realm verify that it is an IPA LDAP server hosting the realm. Returns a list [errno, host, realm] or an empty list on error. Errno is an error number: 0 means all ok negative number means something went wrong NFTzInit LDAP connection to: %s)Zcacert� start_tlsZ no_schemaZ decode_attrsrb z"Search LDAP server for IPA base DNz(LDAP Error: Anonymous access not allowedzError checking LDAP: %sz?Cannot connect to LDAP server. Check that minssf is not enabledz The server is not an IPA serverzFrom IPA server %sz6Search for (objectClass=krbRealmContainer) in %s (sub))�cnZkerberosz (objectClass=krbRealmContainer)z Found: %srx r z2Realm %s does not match any realm in LDAP databaserE zYMultiple realms found, cannot decide which realm is the correct realm without working DNSr z Unknown error in ipadiscoveryzLDAP Error: timeoutzLDAP Error: %s)%r r Z get_ldap_urir) r* Z LDAPClientZ simple_bindr r2 r ZACIErrorr Z DatabaseError�error�strerrorr r r r9 �ldap_urir= r+ Z SCOPE_SUBTREEr, r Zdnr& �sixZPY3r rq rp �lenZDatabaseTimeoutr Z NetworkErrorrK )r? ZthostZtrealmrd Zlrealmsr{ rw Zlhr9 �errZlretZlresrx rA r! r! r" ro � s� � �* � � �� zIPADiscovery.ipacheckldapTc C s� g }d||f }t �d|� z t|�}W n8 ty` } z t �d|jj� g }W Y d}~n d}~0 0 |D ]h} t �d| � t| j��d�} | s�t �d| � qf|dur�| j |kr�d| t| j �f } |� | � |rf q�qf|S ) a_ Search for SRV records in given domain. When no record is found, en empty list is returned :param domain: Search domain name :param srv_record_name: SRV record name, e.g. "_ldap._tcp" :param default_port: When default_port is not None, it is being checked with the port in SRV record and if they don't match, the port from SRV record is appended to found hostname in this format: "hostname:port" :param break_on_first: break on the first find and return just one entry z%s.%sz Search DNS for SRV record of %s�DNS record not found: %sN�DNS record found: %srZ z-Cannot parse the hostname from SRV record: %sz%s:%s) r) r* r r � __class__�__name__�str�target�rstrip�portrq ) r? r6 Zsrv_record_nameZ default_portrY r8 �qname�answersrv �answerr7 r! r! r" r\ � s, � z IPADiscovery.ipadns_search_srvc C s< |s | j }d| }t�d|� zt|tj�}W n8 tyf } z t�d|jj� g }W Y d}~n d}~0 0 d}|D ]�}t�d|� |j rpz|j d � d�}W n< t y� } z$t�d|� W Y d}~qpW Y d}~n d}~0 0 |rpzt |d d � W n@ t �y, } z&t�d ||� W Y d}~qpW Y d}~n d}~0 0 | S qpdS ) z� :param domain: Domain to be searched in :returns: string of a realm found in a TXT record None if no realm was found z _kerberos.z Search DNS for TXT record of %sr Nr� r r z+A TXT record cannot be decoded as UTF-8: %sr5 rf rg )r6 r) r* r r ZTXTr r� r� �stringsr �UnicodeDecodeErrorr rk )r? r6 r� r� rv r5 r� r! r! r" rl ' s< �"�" z!IPADiscovery.ipadnssearchkrbrealmc C s@ |s | j }| j|dddd�}|r,d�|�}nt�d|� d }|S )Nz_kerberos._udp�X FrX rh z(SRV record for KDC not found! Domain: %s)r6 r\ rn r) r* )r? r6 rS r! r! r" rm O s � z IPADiscovery.ipadnssearchkrbkdc)rb rb NNN)N)T)N)N)r� � __module__� __qualname__r@ ri rP rQ rR rT rU ra rB ro r\ rl rm r! r! r! r" r3 r s" ! � E p � ) (r3 c C s dd l } dd l}ddlm} | �t�}|j�tj �r<tj }nd }|j d|d� |j ddd� |� d� |� � }||j d � t � }|j|j|jd �}d D ]T}tt||��} d �|�} t|| d �} | d ur�td �|| | �� q�td�|| �� q�|�t|�d�t�||��� d S )Nr )�standard_logging_setupz --ca-cert)r0 z--debug� store_true)�actionr6 )r* rc )r5 r6 r9 r7 r8 z {}_sourcez{:<8} {:<32} ({})z {:<8} {:<32}z{} )�argparse�osZipapython.ipa_log_managerr� �ArgumentParserr� �path�isfiler Z IPA_CA_CRT� add_argument� parse_argsr* r3 rB r6 Zca_certr� �getattr�format�print�exit�absrs rt ) r� r� r� �parserZ default_ca�argsZdiscover�result�key�valueZ source_key�sourcer! r! r" �main_ s2 �r� �__main__).Z __future__r Zloggingr| Zdnsr Z dns.exceptionr Zipalibr Zipalib.constantsr Z ipalib.utilr Zipapython.dnsutilr r Zipaplatform.pathsr Zipapython.ipautilr r Z ipapython.dnr Zldap� ImportErrorr Z ipapythonZ getLoggerr� r) rp r r r r r r r r r r. rs r2 r3 r� r! r! r! r" �<module> s^ �) p%