File: //usr/lib/python3.9/site-packages/ipalib/__pycache__/aci.cpython-39.pyc
a
}�f+ � @ sd d dl Z d dlZd dlZe�dej�Ze�dej�Ze�dej�ZddgZg d�Z G dd � d �Z
dS )
� Nz<\(version\s+3.0\s*;\s*ac[li]\s+\"([^\"]*)\"\s*;\s*(.*);\s*\)z(\w+)\s*\(([^()]*)\)\s*(.*)z+\(?([a-zA-Z0-9;\.]+)\s*(\!?=)\s*\"(.*)\"\)?�allowZdeny) �read�write�add�delete�searchZcompareZ selfwrite�proxy�allc @ s� e Zd ZdZdZd*dd�Zdd� Zdd� Zd d
� Zd d � Z d
d� Z
dd� Z dd� Z dd� Z
dd� Zd+dd�Zd,dd�Zd-d d �Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� ZeZd(d)� ZdS ).�ACIz�
Holds the basic data for an ACI entry, as stored in the cn=accounts
entry in LDAP. Has methods to parse an ACI string and export to an
ACI String.
Nc C sH d | _ d | _d | _|| _i | _d| _dg| _i | _|d urD| �|� d S )Nr r ) �name� source_group�
dest_groupZ orig_acistr�target�action� permissions�bindrule�
_parse_acistr)�self�acistr� r �./usr/lib/python3.9/site-packages/ipalib/aci.py�__init__4 s z ACI.__init__c C s: |dkr| j S |dkr | jS |dkr*| jS td| ��dS )z*Fake getting attributes by key for sortingr � � zUnknown key value %sN)r r r
� TypeError)r �keyr r r � __getitem__@ s zACI.__getitem__c C s | � � S )z An alias for export_to_string())�export_to_string)r r r r �__repr__J s z ACI.__repr__c C s� | � � d}t| j�� �D ]~\}}|d }t|d �ttfv r�d}| �|d �D ]}|| d }qP|dd� }|d|||f }q|d|||d f }q|d| j| j d �
| j �| j d
| j d | j d f d }|S ) z/Output a Directory Server-compatible ACI string� �operator�
expressionz || N���z (%s %s "%s")z((version 3.0;acl "%s";%s (%s) %s %s "%s"�,�keywordz;))
�validate�sortedr �items�type�tuple�list� _unique_listr r �joinr r )r �aci�t�v�opr �lr r r r N s :zACI.export_to_stringc C s$ g }|D ]}||vr|� |� q|S )a
A set() doesn't maintain order so make a list unique ourselves.
The number of entries in our lists are always going to be
relatively low and this code will be called infrequently
anyway so the overhead will be small.
)�append)r r1 �unique�itemr r r r+ _ s
zACI._unique_listc C s0 |� d�r|dd � }|�d�r,|d d� }|S )N�"r ���)�
startswith�endswith)r �sr r r �_remove_quotesm s
zACI._remove_quotesc
C s t jr|�d�}t�|�}|jd |_d}d}|D ]�}|dkr�t|��� }t|�}|dvrz|t|� }|dvrztd| ��|}t|��� }| �|�}t|�}|dkr�td | ��|d
kr�t �
d |�} i | j |< || j | d < | | j | d
< q2i | j |< || j | d < || j | d
< q2d S )Nzutf-8�.F�=�()r< z!=z No operator in target, got '%s'�)z$No end parenthesis in target, got %s�
targetattrz[^a-zA-Z0-9;\*]+r r! ) �sixZPY2�encode�shlexZ wordchars�next�strip� SyntaxErrorr: �re�splitr )
r r- Zlexer�varr0 �tokenr �val�endr. r r r �
_parse_targetu s8
zACI._parse_targetc C s� |� d�}|dk r td| ��t�||d d � �}|rHt|�� �dk rTtd| ��| �|d |d � � |�d�| _t �|�d��}|r�t|�� �dk r�td| ��|�d�| _
| � |�d�� d d
��
d ��| _| �|�d�� d S ) Nz version 3.0r z(malformed ACI, unable to find version %sr r z8malformed ACI, match for version and bind rule failed %s� z*malformed ACI, permissions match failed %s� r r# )�findrE �ACIPat�match�len�groupsrL �groupr �PermPatr r+ �replacerG r � set_bindrule)r r ZvstartZacimatchZ bindpermsr r r r � s
�zACI._parse_acistrc C s� t | j�ttfvrtd��| jD ] }|�� tvr td| ��q | jsLtd��t| jt �s`td��t| j
t �rzt | j
�dkr�td��t| j
t �s�td��| j
�d�r�| j
�d �r�| j
�d
�s�td ��d S )
zyDo some basic verification that this will produce a
valid LDAP ACI.
returns True if valid
zpermissions must be a listzinvalid permission: '%s'zname must be setzname must be a stringr z%target must be a non-empty dictionaryz bindrule must be a dictionaryr r$ r! z bindrule is missing a componentT)r( r r) r* rE �lower� PERMISSIONSr �
isinstance�strr �dictrR r �get)r �pr r r r% � s
$z ACI.validatec C s& t |�ttfvr|g}| �|�| _d S �N)r( r) r* r+ r )r r r r r �set_permissions� s zACI.set_permissionsr< c C s@ i | j d< |�d�s d| d }|| j d d< || j d d< d S )N� targetfilterr= r> r! r )r r7 )r �filterr r r r �set_target_filter� s
zACI.set_target_filterc C s` |sd| j v r| j d= d S t|�ttfvr0|g}i | j d< | �|�| j d d< || j d d< d S )Nr? r! r )r r( r) r* r+ )r �attrr r r r �set_target_attr� s
zACI.set_target_attrc C s8 |� d�sJ �i | jd< || jd d< || jd d< d S )Nzldap:///r r! r )r7 r )r r r r r r �
set_target� s
zACI.set_targetc C s~ |� d�|�d�kr td��t�|�}|r:t|�� �dk rBtd��| �|�d�� | � |�d�� | �
|�d�� dd �� d S )
Nr= r> z$non-matching parentheses in bindrulerM zmalformed bind ruler r r5 r ) r7 r8 rE �BindPatrQ rR rS �set_bindrule_keywordrT �set_bindrule_operator�set_bindrule_expressionrV )r r rQ r r r rW � s
zACI.set_bindrulec C s || j d< d S )Nr$ �r )r r$ r r r rh � s zACI.set_bindrule_keywordc C s || j d< d S )Nr rk )r r r r r ri � s zACI.set_bindrule_operatorc C s || j d< d S )Nr! rk )r r! r r r rj � s zACI.set_bindrule_expressionc C s� t |t�sJ ��z�| j�� |j�� kr,W dS t| j�t|j�krFW dS | j�d�|j�d�krdW dS | j�d�|j�d�kr�W dS | j�d�|j�d�kr�W dS | j�di ��d�|j�di ��d�kr�W dS | j�di ��d�|j�di ��d�kr�W dS t| j�di ��dd��t|j�di ��dd��k�r8W dS | j�di ��d�|j�di ��d�k�rhW dS | j�di ��d�|j�di ��d�k�r�W dS | j�di ��d�|j�di ��d�k�r�W dS W n t �y� Y dS 0 d S )
z�
Compare the current ACI to another one to see if they are
the same.
returns True if equal, False if not.
Fr$ r r! ra r? r r T)
rZ r
r rX �setr r r] r � Exception�r �br r r �isequal� s6 ((6***
z ACI.isequalc C s
| |k S r_ r rn r r r �__ne__! s z
ACI.__ne__)N)r< )r< )r< )�__name__�
__module__� __qualname__�__doc__�__hash__r r r r r+ r: rL r r% r` rc re rf rW rh ri rj rp �__eq__rq r r r r r
, s,
$
,r
) rB rF r@ �compile�UNICODErP rU rg ZACTIONSrY r
r r r r �<module> s ��