userdir-ldap.conf: remove from default keyrings:

[mirror/userdir-ldap.git] / ud-generate

diff --git a/ud-generate b/ud-generate
index 11a82a8..de97265 100755 (executable)
--- a/ud-generate
+++ b/ud-generate
@@ -91,13 +91,10 @@ def IsInGroup(DnRecord):
   if DnRecord[1].has_key("supplementaryGid") == 0:
      return 0;
 
-  # Check the supplementary groups
-  for I in DnRecord[1]["supplementaryGid"]:
-     s = I.split('@', 1)
-     group = s[0]
-     if len(s) == 2 and s[1] != CurrentHost:
-           continue;
-     if Allowed.has_key(group):
+  supgroups=[]
+  addGroups(supgroups, DnRecord[1]["supplementaryGid"], GetAttr(DnRecord,"uid"))
+  for g in supgroups:
+     if Allowed.has_key(g):
         return 1;
   return 0;
 
@@ -738,6 +735,16 @@ def GenMailList(l,File,Key):
    raise;
   Done(File,F,None);
 
+def isRoleAccount(pwEntry):
+   if not pwEntry.has_key("objectClass"):
+      raise "pwEntry has no objectClass"
+   oc =  pwEntry['objectClass']
+   try:
+      i = oc.index('debianRoleAccount')
+      return True
+   except ValueError:
+      return False
+
 # Generate the DNS Zone file
 def GenDNS(l,File,HomePrefix):
   F = None;
@@ -755,7 +762,7 @@ def GenDNS(l,File,HomePrefix):
          continue;
 
       # If the account has no PGP key, do not write it
-      if x[1].has_key("keyFingerPrint") == 0:
+      if x[1].has_key("keyFingerPrint") == 0 and not isRoleAccount(x[1]):
          continue;
       try:
          F.write("; %s\n"%(EmailAddress(x)));
@@ -882,9 +889,10 @@ def HostToIP(Host):
         except socket.gaierror, (code):
             if code[0] != -2: raise
         IPAdresses = []
-        for addr in IPAdressesT:
-            if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
-            else: IPAdresses += [addr[1]]
+        if not IPAdressesT is None:
+            for addr in IPAdressesT:
+               if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
+               else: IPAdresses += [addr[1]]
         HostToIPCache[Host] = IPAdresses
     return HostToIPCache[Host]
 
@@ -945,33 +953,44 @@ def GenSSHKnown(l,File,mode=None):
 
 # Generate the debianhosts file (list of all IP addresses)
 def GenHosts(l,File):
-  F = None;
+  F = None
   try:
-   OldMask = os.umask(0022);
-   F = open(File + ".tmp","w",0644);
-   os.umask(OldMask);
-
-   # Fetch all the hosts
-   HostNames = l.search_s(HostBaseDn,ldap.SCOPE_ONELEVEL,"hostname=*",\
-                ["hostname"]);
-
-   if HostNames == None:
-      raise "No Hosts";
-
-   for x in HostNames:
-      if x[1].has_key("hostname") == 0:
-         continue;
-      Host = GetAttr(x,"hostname");
-      try:
-        Addr = socket.gethostbyname(Host);
-        F.write(Addr + "\n");
-      except:
-        pass
+    OldMask = os.umask(0022)
+    F = open(File + ".tmp","w",0644)
+    os.umask(OldMask)
+
+    # Fetch all the hosts
+    hostnames = l.search_s(HostBaseDn, ldap.SCOPE_ONELEVEL, "hostname=*",
+                           ["hostname"])
+
+    if hostnames == None:
+       raise "No Hosts"
+
+    seen = set()
+    for x in hostnames:
+      host = GetAttr(x,"hostname", None)
+      if host:
+        addrs = []
+        try:
+          addrs += socket.getaddrinfo(host, None, socket.AF_INET)
+        except socket.error:
+          pass
+        try:
+          addrs += socket.getaddrinfo(host, None, socket.AF_INET6)
+        except socket.error:
+          pass
+
+        for addrinfo in addrs:
+          if addrinfo[0] in (socket.AF_INET, socket.AF_INET6):
+            addr = addrinfo[4][0]
+            if addr not in seen:
+              print >> F, addrinfo[4][0]
+              seen.add(addr)
   # Oops, something unspeakable happened.
   except:
-   Die(File,F,None);
-   raise;
-  Done(File,F,None);
+    Die(File,F,None)
+    raise
+  Done(File,F,None)
 
 def GenKeyrings(l,OutDir):
   for k in Keyrings:
@@ -1007,7 +1026,7 @@ PasswdAttrs = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid=*",\
                  "allowedHost","sshRSAAuthKey","dnsZoneEntry","cn","sn",\
                  "keyFingerPrint","privateSub","mailDisableMessage",\
                  "mailGreylisting","mailCallout","mailRBL","mailRHSBL",\
-                 "mailWhitelist", "sudoPassword"]);
+                 "mailWhitelist", "sudoPassword", "objectClass"]);
 # Fetch all the hosts
 HostAttrs    = l.search_s(HostBaseDn,ldap.SCOPE_ONELEVEL,"sshRSAHostKey=*",\
                 ["hostname","sshRSAHostKey","purpose"]);