diff options
Diffstat (limited to 'lib/openldap')
| -rw-r--r-- | lib/openldap | 434 |
1 files changed, 0 insertions, 434 deletions
diff --git a/lib/openldap b/lib/openldap deleted file mode 100644 index 7293b23..0000000 --- a/lib/openldap +++ /dev/null @@ -1,434 +0,0 @@ -#!/usr/bin/python - -# Manage OpenLDAP databases -# Copyright (c) 2013 Guilhem Moulin <guilhem@fripost.org> -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. - -import ldap, ldap.sasl -from ldap.filter import filter_format -from ldap.dn import dn2str,explode_dn,str2dn -from ldap.modlist import addModlist -from ldif import LDIFParser -from functools import partial -import re, pwd -import tempfile, atexit - - -# Dirty hack to check equality between the targetted LDIF and that -# currently in the directory. The value of some configuration (olc*) -# attributes is automatically indexed when added; for those we'll add -# explicit indices to what we find in the LDIF. -indexedAttributes = frozenset([ - 'olcAttributeTypes', - 'olcObjectClasses', - 'olcAccess', - 'olcSyncrepl', - 'olcOverlay', - 'olcLimits', -]) - - -# Another hack. Configuration entries sometimes pollutes the DNs with -# indices, thus it's not possible to directly use them as base. -# Instead, we use their parent as a pase, and search for the *unique* -# match with the same ObjectClass and the matching extra attributes. -# ('%s' in the attribute value is replaced with the value of the source -# entry.) -indexedDN = { - 'olcSchemaConfig': [('cn', '{*}%s')], - 'olcHdbConfig': [('olcDbDirectory', '%s' )], - 'olcOverlayConfig': [('olcOverlay', '%s' )], -} - -# Allow for flexible ACLs for user using SASL's EXTERNAL mechanism. -# "username=postfix,cn=peercred,cn=external,cn=auth" is replaced by -# "gidNumber=106+uidNumber=102,cn=peercred,cn=external,cn=auth" where -# 102 is postfix's UID and 106 its primary GID. -# (Regular expressions are not allowed.) -sasl_ext_re = re.compile( r"""(?P<start>\sby\s+dn(?:\.exact)?)= - (?P<quote>['\"]?)username=(?P<user>[a-z][-a-z0-9_]*), - (?P<end>cn=peercred,cn=external,cn=auth) - (?P=quote)\s""" - , re.VERBOSE ) -multispaces = re.compile( r"\s+" ) -pwd_dict = {} - -def acl_sasl_ext(m): - u = m.group('user') - if u not in pwd_dict.keys(): - pwd_dict[u] = pwd.getpwnam(u) - return '%s="gidNumber=%d+uidNumber=%d,%s" ' % ( m.group('start') - , pwd_dict[u].pw_gid - , pwd_dict[u].pw_uid - , m.group('end') - ) - - -# Run the given callback on each DN seen. If its return value is not -# None, update the changed variable. -class LDIFCallback(LDIFParser): - def __init__(self, module, input, callback): - LDIFParser.__init__(self,input) - self.callback = callback - self.changed = False - - def handle(self,dn,entry): - b = self.callback(dn,entry) - if b is not None: - self.changed |= b - - -# Run slapcat(8) on the given suffix or DB number (suffix takes -# precedence) with an optional filter. (This is useful for offline -# searches, or one needs to bypass ACLs.) Returns an open pipe to the -# subprocess. -def slapcat(filter=None, suffix=None, idx=0): - cmd = [ os.path.join(os.sep, 'usr', 'sbin', 'slapcat') ] - - if filter is not None: - cmd.extend([ '-a', filter ]) - - if suffix is not None: - if type(suffix) is not str: - suffix = dn2str(suffix) - cmd.extend([ '-b', suffix ]) - else: - cmd.append( '-n%d' % idx ) - - return subprocess.Popen( cmd, stdout=subprocess.PIPE - , stderr=open(os.devnull, 'wb') ) - - -# Start / stop / whatever a service. -def service(name, state): - cmd = [ os.path.join(os.sep, 'usr', 'sbin', 'service'), name, state ] - subprocess.check_call( cmd, stdout=open(os.devnull, 'wb') - , stderr=subprocess.STDOUT ) - - -# Check if the given dn is already present in the directory. -# Returns None if doesn't exist, and give the dn,entry otherwise -def flexibleSearch(module, l, dn, entry): - idxClasses = set(entry['objectClass']).intersection(indexedDN.keys()) - if not idxClasses: - base = dn - scope = ldap.SCOPE_BASE - f = 'objectClass=*' - else: - # Search on the parent instead, and try to use a precise filter - dn = str2dn(dn) - h,t,_ = dn.pop(0)[0] - base = dn2str(dn) - scope = ldap.SCOPE_ONELEVEL - f = [] - for c in idxClasses: - f.append ( filter_format('objectClass=%s', [c]) ) - for a,v in indexedDN[c]: - if a == h: - v2 = t - elif a not in entry.keys() or len(entry[a]) > 1: - module.fail_json(msg="Multiple values found! This is a bug. Please report.") - else: - v2 = entry[a][0] - f.append ( filter_format(a+'='+v, [v2]) ) - if len(f) == 1: - f = f[0] - else: - f = '(&(' + ')('.join(f) + '))' - - r = l.search_s( base, scope, filterstr=f ) - if len(r) > 1: - module.fail_json(msg="Multiple results found! This is a bug. Please report.") - elif r: - return r.pop() - - -# Add or modify (only the attributes that differ from those in the -# directory) the entry for that DN. -# l must be an LDAPObject, and should provide an open connection to the -# directory with disclose/search/write access. -def processEntry(module, l, dn, entry): - changed = False - - for x in indexedAttributes.intersection(entry.keys()): - # remove useless extra spaces in ACLs etc - entry[x] = map( partial(multispaces.sub, ' '), entry[x] ) - - r = flexibleSearch( module, l, dn, entry ) - if r is None: - changed = True - if module.check_mode: - module.exit_json(changed=changed, msg="add DN %s" % dn) - if 'olcAccess' in entry.keys(): - # replace "username=...,cn=peercred,cn=external,cn=auth" - # by a DN with proper gidNumber and uidNumber - entry['olcAccess'] = map ( partial(sasl_ext_re.sub, acl_sasl_ext) - , entry['olcAccess'] ) - l.add_s( dn, addModlist(entry) ) - else: - d,e = r - fst = str2dn(dn).pop(0)[0][0] - diff = [] - for a,v in e.iteritems(): - if a not in entry.keys(): - if a != fst: - # delete all values except for the first attribute, - # which is implicit - diff.append(( ldap.MOD_DELETE, a, None )) - elif a in indexedAttributes: - if a == 'olcAccess': - # replace "username=...,cn=peercred,cn=external,cn=auth" - # by a DN with proper gidNumber and uidNumber - entry[a] = map ( partial(sasl_ext_re.sub, acl_sasl_ext) - , entry[a] ) - # add explicit indices in the entry from the LDIF - entry[a] = map( (lambda x: '{%d}%s' % x) - , zip(range(len(entry[a])),entry[a]) ) - if v != entry[a]: - diff.append(( ldap.MOD_REPLACE, a, entry[a] )) - elif v != entry[a]: - # for non-indexed attribute, we update values in the - # symmetric difference only - s1 = set(v) - s2 = set(entry[a]) - if s1.isdisjoint(s2): - # replace the former values with the new ones - diff.append(( ldap.MOD_REPLACE, a, entry[a] )) - else: - x = list(s1.difference(s2)) - if x: - diff.append(( ldap.MOD_DELETE, a, x )) - y = list(s2.difference(s1)) - if y: - diff.append(( ldap.MOD_ADD, a, y )) - - # add attributes that weren't in e - for a in set(entry).difference(e.keys()): - diff.append(( ldap.MOD_ADD, a, entry[a] )) - - if diff: - changed = True - if module.check_mode: - module.exit_json(changed=changed, msg="mod DN %s" % dn) - l.modify_s( d, diff ) - return changed - - -# Load the given module. -def loadModule(module, l, name): - changed = False - - f = filter_format( '(&(objectClass=olcModuleList)(olcModuleLoad=%s))', [name] ) - r = l.search_s( 'cn=config', ldap.SCOPE_ONELEVEL, filterstr = f, attrlist = [''] ) - - if not r: - changed = True - if module.check_mode: - module.exit_json(changed=changed, msg="add module %s" % name) - l.modify_s( 'cn=module{0},cn=config' - , [(ldap.MOD_ADD, 'olcModuleLoad', name)] ) - - return changed - - -# Find the database associated with a given attribute (eg, -# olcDbDirectory or olcSuffix). -def getDN_DB(module, l, a, v, attrlist=['']): - f = filter_format( '(&(objectClass=olcDatabaseConfig)('+a+'=%s))', [v] ) - return l.search_s( 'cn=config' - , ldap.SCOPE_ONELEVEL - , filterstr = f - , attrlist = attrlist ) - - -# Clear the given DB directory and delete the associated database. Fail -# if non empty, unless all existing DNS are in skipdns. -def wontRemove(module, skipdns, d, _): - if d not in skipdns: - module.fail_json(msg="won't remove '%s'" % d) -def removeDB(module, dbdir, skipdn=None): - changed = False - if not os.path.exists(dbdir): - return False - - l = ldap.initialize( 'ldapi://' ) - l.sasl_interactive_bind_s('', ldap.sasl.external()) - r = getDN_DB( module, l, 'olcDbDirectory', dbdir, attrlist=['olcSuffix'] ) - l.unbind_s() - - if len(r) > 1: - module.fail_json(msg="Multiple results found! This is a bug. Please report.") - elif r: - dn,entry = r.pop() - suffix = entry['olcSuffix'][0] - - skipdns = [suffix] - if skipdn is not None: - skipdns.extend([ "%s,%s" % (s,suffix) for s in skipdn ]) - # here we need to use slapcat not search_s, because we may - # not have read access on the database (even though we're - # root!). - p = slapcat( suffix=suffix ) - parser = LDIFCallback( module, p.stdout - , partial(wontRemove,module,skipdns) ) - parser.parse() - - changed = True - if module.check_mode: - module.exit_json(changed=changed, msg="remove dir %s" % dbdir) - - # slapd doesn't support database deletion, so we need to turn it - # off and remove it from slapd.d manually. - service( 'slapd', 'stop' ) - path = [ os.sep, 'etc', 'ldap', 'slapd.d' ] - ldif = explode_dn(dn)[::-1] - ldif[-1] += ".ldif" - path.extend( ldif ) - os.unlink( os.path.join(*path) ) - - # delete all children in path, but not the path directory itself. - for file in os.listdir(dbdir): - os.unlink( os.path.join(dbdir, file) ) - service( 'slapd', 'start' ) - return changed - - -# Convert a *.schema file into *.ldif format. The algorithm can be found -# in /etc/ldap/schema/openldap.ldif . -def slapd_to_ldif(src, name): - s = open( src, 'r' ) - d = tempfile.NamedTemporaryFile(delete=False) - atexit.register(lambda: os.unlink( d.name )) - - d.write('dn: cn=%s,cn=schema,cn=config\n' % name) - d.write('objectClass: olcSchemaConfig\n') - - re1 = re.compile( r'^objectIdentifier\s(.*)', re.I ) - re2 = re.compile( r'^objectClass\s(.*)', re.I ) - re3 = re.compile( r'^attributeType\s(.*)', re.I ) - reSp = re.compile( r'^\s+' ) - for line in s.readlines(): - if line == '\n': - line = '#\n' - m1 = re1.match(line) - m2 = re2.match(line) - m3 = re3.match(line) - if m1 is not None: - line = 'olcObjectIdentifier: %s' % m1.group(1) - elif m2 is not None: - line = 'olcObjectClasses: %s' % m2.group(1) - elif m3 is not None: - line = 'olcAttributeTypes: %s' % m3.group(1) - - d.write( reSp.sub(line, ' ') ) - - - s.close() - d.close() - return d.name - - -def main(): - module = AnsibleModule( - argument_spec = dict( - dbdirectory = dict( default=None ), - ignoredn = dict( default=None ), - state = dict( default="present", choices=["absent", "present"]), - target = dict( default=None ), - module = dict( default=None ), - suffix = dict( default=None ), - format = dict( default="ldif", choices=["ldif","slapd.conf"] ), - name = dict( default=None ), - ), - supports_check_mode=True - ) - - params = module.params - state = params['state'] - dbdirectory = params['dbdirectory'] - ignoredn = params['ignoredn'] - target = params['target'] - mod = params['module'] - suffix = params['suffix'] - form = params['format'] - name = params['name'] - - if ignoredn is not None: - ignoredn = ignoredn.split(':') - - changed = False - try: - if state == "absent": - if dbdirectory is not None: - changed = removeDB(module,dbdirectory,skipdn=ignoredn) - # TODO: might be useful to be able remove DNs - else: - module.fail_json(msg="missing dbdirectory") - - elif state == "present": - if form == 'slapd.conf': - if name is None: - module.fail_json(msg="missing name") - target = slapd_to_ldif(target, name) - - if target is None and mod is None: - module.fail_json(msg="missing target or module") - # bind only once per LDIF file for performance - l = ldap.initialize( 'ldapi://' ) - l.sasl_interactive_bind_s('', ldap.sasl.external()) - - if mod is None: - callback = partial(processEntry,module,l) - else: - changed |= loadModule (module, l, '%s.la' % mod) - if target is None and suffix is None: - l.unbind_s() - module.exit_json(changed=changed) - if target is None or suffix is None: - module.fail_json(msg="missing target or suffix") - r = getDN_DB(module, l, 'olcSuffix', suffix) - if not r: - module.fail_json(msg="No database found for suffix %s" % suffix) - elif len(r) > 1: - module.fail_json(msg="Multiple results found! This is a bug. Please report.") - else: - d = 'olcOverlay=%s,%s' % (mod, r.pop()[0]) - callback = lambda _,e: processEntry(module,l,d,e) - - parser = LDIFCallback( module, open(target, 'r'), callback ) - parser.parse() - changed = parser.changed - l.unbind_s() - - except subprocess.CalledProcessError, e: - module.fail_json(rv=e.returncode, msg=e.output.rstrip()) - except ldap.LDAPError, e: - e = e.args[0] - if 'info' in e.keys(): - msg = e['info'] - elif 'desc' in e.keys(): - msg = e['desc'] - else: - msg = str(e) - module.fail_json(msg=msg) - except KeyError, e: - module.fail_json(msg=str(e)) - - module.exit_json(changed=changed) - - -# this is magic, see lib/ansible/module_common.py -#<<INCLUDE_ANSIBLE_MODULE_COMMON>> -main() |