+# Handle a ConfirmSudoPassword request
+def DoConfirmSudopassword(Str):
+ Match = re.compile('^confirm sudopassword ('+UUID_FORMAT+') ([a-z0-9,*]+) ([0-9a-f]{40})$').match(Str.lower())
+ if Match == None:
+ return None
+
+ uuid = Match.group(1)
+ hosts = Match.group(2)
+ hmac = Match.group(3)
+
+ global SudoPasswd
+ SudoPasswd[uuid] = (hosts, hmac)
+ return "got confirm for sudo password %s on host(s) %s, auth code %s" % (uuid,hosts, hmac)
+
+def FinishConfirmSudopassword(l, dn, Attrs):
+ global SudoPasswd
+ result = "\n"
+
+ res = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid="+uid, ['sudoPassword']);
+ if len(res) != 1:
+ raise Error, "Not exactly one hit when searching for user"
+ Attrs = res[0][1]
+ if Attrs.has_key('sudoPassword'):
+ inldap = Attrs['sudoPassword']
+ else:
+ inldap = []
+
+ first_entry = 0
+ for entry in inldap:
+ Match = re.compile('^('+UUID_FORMAT+') (confirmed|unconfirmed) ([a-z0-9,*]+) ([^ ]+)$'),match(entry.lower())
+ if Match == None:
+ raise Error, "Could not parse existing sudopasswd entry"
+ uuid = Match.group(1)
+ status = Match.group(2)
+ hosts = Match.group(3)
+ cryptedpass = Match.group(4)
+
+ if SudoPasswd.has_key(uuid):
+ confirmedHosts = SudoPasswd[uuid][0]
+ confirmedHmac = SudoPasswd[uuid][1]
+ if status == "confirmed":
+ result = result + "Entry %s for sudo password on hosts %s already confirmed.\n"%(uuid, hosts)
+ elif confirmedHosts != hosts:
+ result = result + "Entry %s hostlist mismatch (%s vs. %s).\n"%(uuid, hosts, confirmedHosts)
+ elif make_hmac(':'.join([uuid, hosts, cryptedpass])) == confirmedHmac:
+ result = result + "Entry %s for sudo password on hosts %s now confirmed.\n"%(uuid, hosts)
+ status = 'confirmed'
+ else:
+ result = result + "Entry %s for sudo password on hosts %s HMAC verify failed.\n"%(uuid, hosts)
+ del SudoPasswd[uuid]
+
+ newentry = " ".join([uuid, status, hosts, cryptedpass])
+ if first_entry:
+ Attrs.append((ldap.MOD_ADD,"sudoPassword",newentry))
+ else:
+ Attrs.append((ldap.MOD_REPLACE,"sudoPassword",newentry))
+ first_entry = 1
+
+ for entry in SudoPasswd:
+ result = result + "Entry %s that you confirm is not listed in ldap."%(entry)
+
+ return result
+