File: //proc/self/root/lib/python3.9/site-packages/ipaclient/__pycache__/discovery.cpython-39.opt-1.pyc
a
}�f;] � @ sT d dl mZ d dlZd dlZd dlmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
d dlmZmZ d d lmZ d d
lmZmZ d d lmZ z d dlZW n ey� dZY n0 d d lmZ e� e �Z d Z d
Z dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)e de de!de"de#de$d e%d e&d e'd e(d i
Z*d!d"� Z+G d#d$� d$�Z,d%d&� Z-e d'k�rPe-� dS )(� )�absolute_importN)� rdatatype)� DNSException)�errors)�FQDN)�validate_domain_name)� query_srv�resolve)�paths)�valid_ip�realm_to_suffix)�DN)�ipaldap���������������i����i����i����i�zipa v2.0ZSuccess�NOT_FQDN�NO_LDAP_SERVER�REALM_NOT_FOUND�NOT_IPA_SERVER�NO_ACCESS_TO_LDAP� NO_TLS_LDAP�PYTHON_LDAP_NOT_INSTALLED�BAD_HOST_CONFIG�
UNKNOWN_ERRORc C s | j t� ddgd�}dd� |jd D �}d|v rd|jd \}|�d�}||v rX|�|� |�d|� |D ]�}t�d|� z| �t|�| j d �\}W n" t
j y� t�d
� Y qhY n0 |jd \}|�d�� � }|t
kr�t�d |t
� qht�d
|� t|� S dS )z�
Get base DN of IPA suffix in given LDAP server.
None is returned if the suffix is not found
:param conn: Bound LDAPClient that will be used for searching
ZdefaultnamingcontextZnamingcontexts)Z
attrs_listc S s g | ]}|� d ��qS )�utf-8)�decode)�.0�c� r! �7/usr/lib/python3.9/site-packages/ipaclient/discovery.py�
<listcomp>T � z"get_ipa_basedn.<locals>.<listcomp>r r z'Check if naming context '%s' is for IPAz (info=IPA*)zBLDAP server did not return info attribute to check for IPA version�infoz>Detected IPA server version (%s) did not match the client (%s)z*Naming context '%s' is a valid IPA contextN)Z get_entryr
�rawr �remove�insert�logger�debug� get_entriesZ
SCOPE_BASEr �NotFound�lower�IPA_BASEDN_INFO)Zconn�entryZcontexts�default�contextr% r! r! r" �get_ipa_basednI s<
�
�
� r2 c @ s~ e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
d dd�Z d dd�Z d dd�Z
d!dd�Zd"d d �ZdS )#� IPADiscoveryc C s: d | _ d | _d | _g | _d | _d | _d | _d | _d | _d S �N) �realm�domain�server�servers�basedn� realm_source�
domain_source�
server_source�
basedn_source��selfr! r! r" �__init__t s zIPADiscovery.__init__c C s� g }d}z�t tjd��}|�� }W d � n1 s40 Y |D ]R}|�� �d�rf|�� d df}qB|�� �d�rB|�dd� |�� d d� D �� qBW n ty� Y n0 |r�|g| }|S )
z�Read /etc/resolv.conf and return all domains
Returns a list of (domain, info) pairs. The info contains a reason
why the domain is returned.
N�rr6 r z"local domain from /etc/resolv.conf�searchc s s | ]}|d fV qdS )z#search domain from /etc/resolv.confNr! )r �dr! r! r" � <genexpr>� s �z6IPADiscovery.__get_resolver_domains.<locals>.<genexpr>� ) �openr
Z RESOLV_CONF� readlinesr- �
startswith�split�extend� Exception)r? �domainsr6 �f�lines�liner! r! r" Z__get_resolver_domains� s& &
�
�
z#IPADiscovery.__get_resolver_domainsc C s | j S r4 )r7 r> r! r! r" �
getServerName� s zIPADiscovery.getServerNamec C s | j S r4 )r6 r> r! r! r" �
getDomainName� s zIPADiscovery.getDomainNamec C s | j S r4 )r5 r> r! r! r" � getRealmName� s zIPADiscovery.getRealmNamec C s | j S r4 )�kdcr> r! r! r" �
getKDCName� s zIPADiscovery.getKDCNamec C s | j S r4 )r9 r> r! r! r" � getBaseDN� s zIPADiscovery.getBaseDNc C s� d}t �d||� |s|||v r,t �d|� q||�|� | j|dddd�}|rT||fS |�d�}|d krjd
S ||d d� }qd
S ) a�
Given a domain search it for SRV records, breaking it down to search
all subdomains too.
Returns a tuple (servers, domain) or (None,None) if a SRV record
isn't found. servers is a list of servers found. domain is a string.
:param tried: A set of domains that were tried already
:param reason: Reason this domain is searched (included in the log)
NzDStart searching for LDAP SRV record in "%s" (%s) and its sub-domainsz Already searched %s; skipping�
_ldap._tcp� F��break_on_first�.r )NNrE )r) r* �add�ipadns_search_srv�find)r? r6 �tried�reasonr8 �pr! r! r" � check_domain� s& �
�
zIPADiscovery.check_domain� Nc C s^ t �d� t �d|||� d| _d}|�s�|�sF|sDt}t �d|� |sLtS t|�rXtS |�d�}|dkrntS ||d d� }| �� }|d fg| }t � } |D ]�\}}
z t
|� W n> t y� } z&t �d
|| � W Y d} ~ q�W Y d} ~ n
d} ~ 0 0 | � || |
�\}}|r�d }|| _
d ||
f | _| _ �q.q�| j
�s�t �d
� tS nTt �d|� | j|dddd�}|�r�d }|| _
d| | _| _nd| _t �d
� tS n t �d� || _
d | _| _t �d� |�r�t �d� || _d| _n| �� }|| _d| j
| _|�s
|�s
tS |�r(| �� | _d| j
| _nd�|�| _d| _tg} d }
t �d� g }|D �]<}t �d|| j� | j|| j|d �} | d t k�r zt
| d d d � W n> t �y� } z$t �d!| d | � tg} W Y d} ~ nFd} ~ 0 0 | d | _| d | _d"| j | _| _|� |� |�r� �q�nt| d t t t fv �rNd}
|� |� |�r� �q�nD| d tk�rjt �!d#|� n(| d tk�r�t �!d$|� n t �!d%|� �qV|
�s�| jdu �r�| j
�"� | _d&| _t �d'| j� |
�s�| j#du �r�t$| j�| _#d(| _%t �d)| j#� t �d*t&�'| d | d �| j| j
| j| j#� t �d+d,�|�� || _(|�rV|d | _t | d < | d S )-a
Use DNS discovery to identify valid IPA servers.
servers may contain an optional list of servers which will be used
instead of discovering available LDAP SRV records.
Returns a constant representing the overall search result.
z[IPA Discovery]z>Starting IPA discovery with domain=%s, servers=%s, hostname=%sNFz Hostname: %srZ r rE zdomain of the hostnamez!Skipping invalid domain '%s' (%s)Tz(Discovered LDAP SRV records from %s (%s)zNo LDAP server foundz Search for LDAP SRV record in %srV rW rX z#Discovered LDAP SRV records from %szServer and domain forcedZForcedz[Kerberos realm search]zKerberos realm forcedz'Discovered Kerberos DNS records from %sz, z&Kerberos DNS record discovery bypassedz[LDAP server check]z-Verifying that %s (realm %s) is an IPA server�� ca_cert_pathr � r5 �Zentity� Skipping invalid realm '%s' (%s)z&Discovered from LDAP DNS records in %szSkip %s: not an IPA serverzQSkip %s: LDAP server is not responding, unable to verify if this is an IPA serverz/Skip %s: cannot verify if this is an IPA serverzAssumed same as domainz(Assuming realm is the same as domain: %sz Generated from Kerberos realmz Generated basedn from realm: %sz=Discovery result: %s; server=%s, domain=%s, kdc=%s, basedn=%szValidated servers: %s�,))r) r* r7 r r r r r] �#_IPADiscovery__get_resolver_domains�setr �
ValueErrorra r6 r< r; r r\ r5 r: �ipadnssearchkrbrealmr �ipadnssearchkrbkdcrS Z
kdc_source�joinr � ipacheckldap�SUCCESS�appendr r r Zwarning�upperr9 r r= � error_names�getr8 )r? r6 r8 r5 �hostnamerd Zautodiscoveredr` rL r^ r_ �eZldapretZ
ldapaccessZ
valid_serversr7 r! r! r" rB � s
�
�"��
��
�
�
���
�
�
���
� �
zIPADiscovery.searchc
C s. t du rtgS g }�z t �|�}d}|r,d}t�d|� t j|||ddd�}z$|�t� d� t�d� t|�}W n� t j
y� t�d� t g Y W S t j �y } zTt�
d | j� |du r�t�d
� tgW Y d} ~ W S tgW Y d} ~ W S W Y d} ~ n
d} ~ 0 0 |du �r"t�d � tgW S || _d |j | _t�d
| j� z |�td| j�|jd�}
W n t j�y| tg Y W S 0 |
D ]<} t�d| j� | jd \} tj �r�| � d�} |� | � �q�|�r |D ] }
||
k�r�t ||g W S �q�t�d|� tgW S t |�dk�r t�d� tgW S t ||d gW S W � n� t j!�yZ t�d� t"g Y S t j#�y� } z t�d| j� t"gW Y d} ~ S d} ~ 0 t j
�y� t�d� t g Y S t j �y� } z t�d | j� tgW Y d} ~ S d} ~ 0 t$�y( } z t�d | � tgW Y d} ~ S d} ~ 0 0 dS )a-
Given a host and kerberos realm verify that it is an IPA LDAP
server hosting the realm.
Returns a list [errno, host, realm] or an empty list on error.
Errno is an error number:
0 means all ok
negative number means something went wrong
NFTzInit LDAP connection to: %s)Zcacert� start_tlsZ no_schemaZ decode_attrsrb z"Search LDAP server for IPA base DNz(LDAP Error: Anonymous access not allowedzError checking LDAP: %sz?Cannot connect to LDAP server. Check that minssf is not enabledz The server is not an IPA serverzFrom IPA server %sz6Search for (objectClass=krbRealmContainer) in %s (sub))�cnZkerberosz (objectClass=krbRealmContainer)z Found: %srx r z2Realm %s does not match any realm in LDAP databaserE zYMultiple realms found, cannot decide which realm is the correct realm without working DNSr zLDAP Error: timeoutzLDAP Error: %s)%r r Z get_ldap_urir) r* Z
LDAPClientZ simple_bindr
r2 r ZACIErrorr Z
DatabaseError�error�strerrorr r r r9 �ldap_urir= r+ Z
SCOPE_SUBTREEr, r Zdnr& �sixZPY3r rq rp �lenZDatabaseTimeoutr Z NetworkErrorrK )r? ZthostZtrealmrd Zlrealmsr{ rw Zlhr9 �errZlretZlresrx rA r! r! r" ro � s�
�
�*
�
�
��
zIPADiscovery.ipacheckldapTc
C s� g }d||f }t �d|� z t|�}W n8 ty` } z t �d|jj� g }W Y d}~n
d}~0 0 |D ]h} t �d| � t| j��d�}
|
s�t �d| � qf|dur�| j |kr�d|
t| j �f }
|�
|
� |rf q�qf|S ) a_
Search for SRV records in given domain. When no record is found,
en empty list is returned
:param domain: Search domain name
:param srv_record_name: SRV record name, e.g. "_ldap._tcp"
:param default_port: When default_port is not None, it is being
checked with the port in SRV record and if they don't
match, the port from SRV record is appended to
found hostname in this format: "hostname:port"
:param break_on_first: break on the first find and return just one
entry
z%s.%sz Search DNS for SRV record of %s�DNS record not found: %sN�DNS record found: %srZ z-Cannot parse the hostname from SRV record: %sz%s:%s) r) r* r r � __class__�__name__�str�target�rstrip�portrq ) r? r6 Zsrv_record_nameZ default_portrY r8 �qname�answersrv �answerr7 r! r! r" r\ � s, �
z IPADiscovery.ipadns_search_srvc C s< |s
| j }d| }t�d|� zt|tj�}W n8 tyf } z t�d|jj� g }W Y d}~n
d}~0 0 d}|D ]�}t�d|� |j rpz|j d �
d�}W n< t y� } z$t�d|� W Y d}~qpW Y d}~n
d}~0 0 |rpzt |d d
� W n@ t
�y, } z&t�d ||� W Y d}~qpW Y d}~n
d}~0 0 | S qpdS ) z�
:param domain: Domain to be searched in
:returns: string of a realm found in a TXT record
None if no realm was found
z
_kerberos.z Search DNS for TXT record of %sr Nr� r r z+A TXT record cannot be decoded as UTF-8: %sr5 rf rg )r6 r) r* r r ZTXTr r� r� �stringsr �UnicodeDecodeErrorr rk )r? r6 r� r� rv r5 r� r! r! r" rl ' s< �"�"
z!IPADiscovery.ipadnssearchkrbrealmc C s@ |s
| j }| j|dddd�}|r,d�|�}nt�d|� d }|S )Nz_kerberos._udp�X FrX rh z(SRV record for KDC not found! Domain: %s)r6 r\ rn r) r* )r? r6 rS r! r! r" rm O s
� z IPADiscovery.ipadnssearchkrbkdc)rb rb NNN)N)T)N)N)r� �
__module__� __qualname__r@ ri rP rQ rR rT rU ra rB ro r\ rl rm r! r! r! r" r3 r s" ! �
E
p �
)
(r3 c C s dd l } dd l}ddlm} | �t�}|j�tj �r<tj }nd }|j
d|d� |j
ddd� |�
d� |� � }||j d � t
� }|j|j|jd
�}d D ]T}tt||��} d �|�}
t||
d �} | d ur�td
�|| | �� q�td�|| �� q�|�t|�d�t�||��� d S )Nr )�standard_logging_setupz --ca-cert)r0 z--debug�
store_true)�actionr6 )r* rc )r5 r6 r9 r7 r8 z {}_sourcez{:<8} {:<32} ({})z {:<8} {:<32}z{}
)�argparse�osZipapython.ipa_log_managerr� �ArgumentParserr� �path�isfiler
Z
IPA_CA_CRT� add_argument�
parse_argsr* r3 rB r6 Zca_certr� �getattr�format�print�exit�absrs rt ) r� r� r� �parserZ
default_ca�argsZdiscover�result�key�valueZ
source_key�sourcer! r! r" �main_ s2
�r� �__main__).Z
__future__r Zloggingr| Zdnsr Z
dns.exceptionr Zipalibr Zipalib.constantsr Z ipalib.utilr Zipapython.dnsutilr r Zipaplatform.pathsr
Zipapython.ipautilr r Z ipapython.dnr
Zldap� ImportErrorr Z ipapythonZ getLoggerr� r) rp r r r r r r r r r r. rs r2 r3 r� r! r! r! r" �<module> s^
�) p%