X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=ud-generate;h=80adf62fc1b69e77ff5d1d967b88dc3c32e1bcae;hb=5e4885c91b38103cea85fbfc4677a2a2ed858a6e;hp=858d736cec157afb188bc15539527e6b9a7fd3d4;hpb=c66b8117fef6f45e48c16490874dbbe34ec4e6e2;p=mirror%2Fuserdir-ldap.git diff --git a/ud-generate b/ud-generate index 858d736..80adf62 100755 --- a/ud-generate +++ b/ud-generate @@ -28,7 +28,7 @@ # along with this program; if not, write to the Free Software # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -import string, re, time, ldap, optparse, sys, os, pwd, posix, socket, base64, hashlib, shutil, errno, tarfile, grp, fcntl +import string, re, time, ldap, optparse, sys, os, pwd, posix, socket, base64, hashlib, shutil, errno, tarfile, grp, fcntl, dbm from userdir_ldap import * from userdir_exceptions import * import UDLdap @@ -61,16 +61,18 @@ SubGroupMap = None UUID_FORMAT = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' +MAX_UD_AGE = 3600*24 EmailCheck = re.compile("^([^ <>@]+@[^ ,<>@]+)(,\s*([^ <>@]+@[^ ,<>@]+))*$") BSMTPCheck = re.compile(".*mx 0 (master)\.debian\.org\..*",re.DOTALL) PurposeHostField = re.compile(r".*\[\[([\*\-]?[a-z0-9.\-]*)(?:\|.*)?\]\]") -IsV6Addr = re.compile("^[a-fA-F0-9:]+$") IsDebianHost = re.compile(ConfModule.dns_hostmatch) isSSHFP = re.compile("^\s*IN\s+SSHFP") DNSZone = ".debian.net" Keyrings = ConfModule.sync_keyrings.split(":") GitoliteSSHRestrictions = getattr(ConfModule, "gitolitesshrestrictions", None) +GitoliteExportHosts = re.compile(getattr(ConfModule, "gitoliteexporthosts", ".")) +MX_remap = json.loads(ConfModule.MX_remap) def prettify(elem): """Return a pretty-printed XML string for the Element. @@ -172,7 +174,7 @@ def IsInGroup(account, allowed, current_host): supgroups=[] addGroups(supgroups, account['supplementaryGid'], account['uid'], current_host) for g in supgroups: - if allowed.has_key(g): + if g in allowed: return True return False @@ -335,7 +337,7 @@ def GenShadowSudo(accounts, File, untrusted, current_host): Done(File, F, None) # Generate the sudo passwd file -def GenSSHGitolite(accounts, File): +def GenSSHGitolite(accounts, hosts, File): F = None try: OldMask = os.umask(0022) @@ -356,6 +358,15 @@ def GenSSHGitolite(accounts, File): line = Sanitize(line) + "\n" F.write(line) + for dn, attrs in hosts: + if not 'sshRSAHostKey' in attrs: continue + hostname = "host-" + attrs['hostname'][0] + prefix = GitoliteSSHRestrictions.replace('@@USER@@', hostname) + for I in attrs["sshRSAHostKey"]: + line = "%s %s"%(prefix, I) + line = Sanitize(line) + "\n" + F.write(line) + # Oops, something unspeakable happened. except: Die(File, F, None) @@ -407,31 +418,18 @@ def GenVoipPassword(accounts, File): F = open(File, "w", 0600) os.umask(OldMask) - root = Element('include') - for a in accounts: if not 'voipPassword' in a: continue if not a.pw_active(): continue Pass = str(a['voipPassword']) - user = Element('user') - user.attrib['id'] = "%s" % (a['uid']) - root.append(user) - params = Element('params') - user.append(params) - param = Element('param') - params.append(param) - param.attrib['name'] = "a1-hash" - param.attrib['value'] = "%s" % (Pass) - variables = Element('variables') - user.append(variables) - variable = Element('variable') - variable.attrib['name'] = "toll_allow" - variable.attrib['value'] = "domestic,international,local" - variables.append(variable) - - F.write("%s" % (prettify(root))) + realm = 'sip.debian.org' + A1 = "%s:%s%:%s" : (a['uid'], realm, Pass) + HA1 = hashlib.md5(A1).hexdigest() + Line = "%s:%s:%s:AUTHORIZED" % (a['uid'], HA1, Pass) + Line = Sanitize(Line) + "\n" + F.write("%s" % (Line)) except: Die(File, None, F) @@ -634,6 +632,34 @@ def GenCDB(accounts, File, key): if Fdb.close() != None: raise "cdbmake gave an error" +def GenDBM(accounts, File, key): + Fdb = None + OldMask = os.umask(0022) + fn = os.path.join(File).encode('ascii', 'ignore') + try: + posix.remove(fn) + except: + pass + + try: + Fdb = dbm.open(fn, "c") + os.umask(OldMask) + + # Write out the email address for each user + for a in accounts: + if not key in a: continue + value = a[key] + user = a['uid'] + Fdb[user] = value + + Fdb.close() + except: + # python-dbm names the files Fdb.db.db so we want to them to be Fdb.db + os.remove(File + ".db") + raise + # python-dbm names the files Fdb.db.db so we want to them to be Fdb.db + os.rename (File + ".db", File) + # Generate the anon XEarth marker file def GenMarkers(accounts, File): F = None @@ -818,6 +844,13 @@ def GenDNS(accounts, File): raise Done(File, F, None) +def is_ipv6_addr(i): + try: + socket.inet_pton(socket.AF_INET6, i) + except socket.error: + return False + return True + def ExtractDNSInfo(x): TTLprefix="\t" @@ -827,7 +860,7 @@ def ExtractDNSInfo(x): DNSInfo = [] if x[1].has_key("ipHostNumber"): for I in x[1]["ipHostNumber"]: - if IsV6Addr.match(I) != None: + if is_ipv6_addr(I): DNSInfo.append("%sIN\tAAAA\t%s" % (TTLprefix, I)) else: DNSInfo.append("%sIN\tA\t%s" % (TTLprefix, I)) @@ -855,7 +888,11 @@ def ExtractDNSInfo(x): if x[1].has_key("mXRecord"): for I in x[1]["mXRecord"]: - DNSInfo.append("%sIN\tMX\t%s" % (TTLprefix, I)) + if I in MX_remap: + for e in MX_remap[I]: + DNSInfo.append("%sIN\tMX\t%s" % (TTLprefix, e)) + else: + DNSInfo.append("%sIN\tMX\t%s" % (TTLprefix, I)) return DNSInfo @@ -955,7 +992,7 @@ def HostToIP(Host, mapped=True): if Host[1].has_key("ipHostNumber"): for addr in Host[1]["ipHostNumber"]: IPAdresses.append(addr) - if IsV6Addr.match(addr) is None and mapped == "True": + if not is_ipv6_addr(addr) and mapped == "True": IPAdresses.append("::ffff:"+addr) return IPAdresses @@ -1147,7 +1184,9 @@ def generate_all(global_dir, ldap_conn): GenMailDisable(accounts, global_dir + "mail-disable") GenCDB(accounts, global_dir + "mail-forward.cdb", 'emailForward') + GenDBM(accounts, global_dir + "mail-forward.db", 'emailForward') GenCDB(accounts, global_dir + "mail-contentinspectionaction.cdb", 'mailContentInspectionAction') + GenDBM(accounts, global_dir + "mail-contentinspectionaction.db", 'mailContentInspectionAction') GenPrivate(accounts, global_dir + "debian-private") GenSSHKnown(host_attrs, global_dir+"authorized_keys", 'authorized_keys', global_dir+'ud-generate.lock') GenMailBool(accounts, global_dir + "mail-greylist", "mailGreylisting") @@ -1169,7 +1208,7 @@ def generate_all(global_dir, ldap_conn): GenMarkers(accounts, global_dir + "markers") GenSSHKnown(host_attrs, global_dir + "ssh_known_hosts") GenHosts(host_attrs, global_dir + "debianhosts") - GenSSHGitolite(accounts, global_dir + "ssh-gitolite") + GenSSHGitolite(accounts, host_attrs, global_dir + "ssh-gitolite") GenDNS(accounts, global_dir + "dns-zone") GenZoneRecords(host_attrs, global_dir + "dns-sshfp") @@ -1179,9 +1218,9 @@ def generate_all(global_dir, ldap_conn): for host in host_attrs: if not "hostname" in host[1]: continue - generate_host(host, global_dir, accounts, ssh_userkeys) + generate_host(host, global_dir, accounts, host_attrs, ssh_userkeys) -def generate_host(host, global_dir, accounts, ssh_userkeys): +def generate_host(host, global_dir, all_accounts, all_hosts, ssh_userkeys): current_host = host[1]['hostname'][0] OutDir = global_dir + current_host + '/' if not os.path.isdir(OutDir): @@ -1204,7 +1243,7 @@ def generate_host(host, global_dir, accounts, ssh_userkeys): ExtraList[extra.upper()] = True if GroupList != {}: - accounts = filter(lambda x: IsInGroup(x, GroupList, current_host), accounts) + accounts = filter(lambda x: IsInGroup(x, GroupList, current_host), all_accounts) DoLink(global_dir, OutDir, "debianhosts") DoLink(global_dir, OutDir, "ssh_known_hosts") @@ -1230,7 +1269,9 @@ def generate_host(host, global_dir, accounts, ssh_userkeys): if not 'NOMARKERS' in ExtraList: DoLink(global_dir, OutDir, "markers") DoLink(global_dir, OutDir, "mail-forward.cdb") + DoLink(global_dir, OutDir, "mail-forward.db") DoLink(global_dir, OutDir, "mail-contentinspectionaction.cdb") + DoLink(global_dir, OutDir, "mail-contentinspectionaction.db") DoLink(global_dir, OutDir, "mail-disable") DoLink(global_dir, OutDir, "mail-greylist") DoLink(global_dir, OutDir, "mail-callout") @@ -1239,8 +1280,11 @@ def generate_host(host, global_dir, accounts, ssh_userkeys): DoLink(global_dir, OutDir, "mail-whitelist") DoLink(global_dir, OutDir, "all-accounts.json") GenCDB(accounts, OutDir + "user-forward.cdb", 'emailForward') + GenDBM(accounts, OutDir + "user-forward.db", 'emailForward') GenCDB(accounts, OutDir + "batv-tokens.cdb", 'bATVToken') + GenDBM(accounts, OutDir + "batv-tokens.db", 'bATVToken') GenCDB(accounts, OutDir + "default-mail-options.cdb", 'mailDefaultOptions') + GenDBM(accounts, OutDir + "default-mail-options.db", 'mailDefaultOptions') # Compatibility. DoLink(global_dir, OutDir, "forward-alias") @@ -1260,6 +1304,13 @@ def generate_host(host, global_dir, accounts, ssh_userkeys): if 'GITOLITE' in ExtraList: DoLink(global_dir, OutDir, "ssh-gitolite") + if 'exportOptions' in host[1]: + for entry in host[1]['exportOptions']: + v = entry.split('=',1) + if v[0] != 'GITOLITE' or len(v) != 2: continue + gitolite_accounts = filter(lambda x: IsInGroup(x, [v[1]], current_host), all_accounts) + gitolite_hosts = filter(lambda x: GitoliteExportHosts.match(x[1]["hostname"][0]), all_hosts) + GenSSHGitolite(gitolite_accounts, gitolite_hosts, OutDir + "ssh-gitolite-%s"%(v[1],)) if 'WEB-PASSWORDS' in ExtraList: DoLink(global_dir, OutDir, "web-passwords") @@ -1311,11 +1362,12 @@ def getLastKeyringChangeTime(): if mt > krmod: krmod = mt - return krmod + return int(krmod) def getLastBuildTime(gdir): cache_last_ldap_mod = 0 cache_last_unix_mod = 0 + cache_last_run = 0 try: fd = open(os.path.join(gdir, "last_update.trace"), "r") @@ -1323,6 +1375,7 @@ def getLastBuildTime(gdir): try: cache_last_ldap_mod = cache_last_mod[0] cache_last_unix_mod = int(cache_last_mod[1]) + cache_last_run = int(cache_last_mod[2]) except IndexError, ValueError: pass fd.close() @@ -1332,14 +1385,14 @@ def getLastBuildTime(gdir): else: raise e - return (cache_last_ldap_mod, cache_last_unix_mod) + return (cache_last_ldap_mod, cache_last_unix_mod, cache_last_run) def ud_generate(): parser = optparse.OptionParser() parser.add_option("-g", "--generatedir", dest="generatedir", metavar="DIR", help="Output directory.") parser.add_option("-f", "--force", dest="force", action="store_true", - help="Force generation, even if not update to LDAP has happened.") + help="Force generation, even if no update to LDAP has happened.") (options, args) = parser.parse_args() if len(args) > 0: @@ -1365,19 +1418,19 @@ def ud_generate(): time_started = int(time.time()) ldap_last_mod = getLastLDAPChangeTime(l) unix_last_mod = getLastKeyringChangeTime() - cache_last_ldap_mod, cache_last_unix_mod = getLastBuildTime(generate_dir) + cache_last_ldap_mod, cache_last_unix_mod, last_run = getLastBuildTime(generate_dir) - need_update = (ldap_last_mod > cache_last_ldap_mod) or (unix_last_mod > cache_last_unix_mod) + need_update = (ldap_last_mod > cache_last_ldap_mod) or (unix_last_mod > cache_last_unix_mod) or (time_started - last_run > MAX_UD_AGE) if not options.force and not need_update: fd = open(os.path.join(generate_dir, "last_update.trace"), "w") - fd.write("%s\n%s\n" % (ldap_last_mod, time_started)) + fd.write("%s\n%s\n%s\n" % (ldap_last_mod, unix_last_mod, last_run)) fd.close() sys.exit(0) tracefd = open(os.path.join(generate_dir, "last_update.trace"), "w") generate_all(generate_dir, l) - tracefd.write("%s\n%s\n" % (ldap_last_mod, time_started)) + tracefd.write("%s\n%s\n%s\n" % (ldap_last_mod, unix_last_mod, time_started)) tracefd.close()