Teach ud-mailgate about ipv6 addresses (RT#193).

Sanitize DNS entries somewhat before inserting them into LDAP.

diff --git a/debian/changelog b/debian/changelog
index e9975f0..8716d70 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+userdir-ldap (0.3.20) unstable; urgency=low
+
+  * Teach ud-mailgate about ipv6 addresses (RT#193).
+  * Sanitize DNS entries somewhat before inserting them into LDAP.
+
+ -- Peter Palfrader <weasel@debian.org>  Mon, 21 Apr 2008 13:29:36 +0200
+
 userdir-ldap (0.3.19) unstable; urgency=low
 
   * New [KEYRING] flag to indicate the debian keyring should be synced

diff --git a/ud-mailgate b/ud-mailgate
index cf82b56..01e036d 100755 (executable)
--- a/ud-mailgate
+++ b/ud-mailgate
@@ -232,17 +232,28 @@ def DoSSH(Str,Attrs):
    return "SSH Keys replaced with "+FormatSSHAuth(Str);
 
 # Handle changing a dns entry
-#  host in a 12.12.12.12
-#  host in cname foo.bar.    <- Trailing dot is required
+#  host IN A     12.12.12.12
+#  host IN AAAA  1234::5678
+#  host IN CNAME foo.bar.    <- Trailing dot is required
+#  host IN MX    foo.bar.    <- Trailing dot is required
 def DoDNS(Str,Attrs,DnRecord):
-   cname = re.match("^[-\w]+\s+in\s+cname\s+[-\w.]+\.$",Str,re.IGNORECASE);
-   if re.match('^[-\w]+\s+in\s+a\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$',\
-        Str,re.IGNORECASE) == None and cname == None and \
-      re.match("^[-\w]+\s+in\s+mx\s+\d{1,3}\s+[-\w.]+\.$",Str,re.IGNORECASE) == None:
-     return None;     
+   cnamerecord = re.match("^[-\w]+\s+IN\s+CNAME\s+([-\w.]+\.)$",Str,re.IGNORECASE)
+   arecord     = re.match('^[-\w]+\s+IN\s+A\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$',Str,re.IGNORECASE)
+   mxrecord    = re.match("^[-\w]+\s+IN\s+MX\s+(\d{1,3})\s+([-\w.]+\.)$",Str,re.IGNORECASE)
+   #aaaarecord  = re.match('^[-\w]+\s+IN\s+AAAA\s+((?:[0-9a-f]{1,4})(?::[0-9a-f]{1,4})*(?::(?:(?::[0-9a-f]{1,4})*|:))?)$',Str,re.IGNORECASE)
+   aaaarecord  = re.match('^[-\w]+\s+IN\s+AAAA\s+([A-F0-9:]{2,39})$',Str,re.IGNORECASE)
+
+   if cnamerecord == None and\
+      arecord == None and\
+      mxrecord == None and\
+      aaaarecord == None:
+     return None;
 
    # Check if the name is already taken
-   G = re.match('^([-\w+]+)\s',Str).groups();
+   G = re.match('^([-\w+]+)\s',Str)
+   if G == None:
+     raise Error, "Hostname not found although we already passed record syntax checks"
+   hostname = G.group(1)
 
    # Check for collisions
    global l;
@@ -250,7 +261,7 @@ def DoDNS(Str,Attrs,DnRecord):
    #  since we accept either.  It'd probably be better to parse the
    #  incoming string in order to construct what we feed LDAP rather
    #  than just passing it through as is.]
-   filter = "(|(dnsZoneEntry=%s        *)(dnsZoneEntry=%s *))" % (G[0], G[0])
+   filter = "(|(dnsZoneEntry=%s        *)(dnsZoneEntry=%s *))" % (hostname, hostname)
    Rec = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,filter,["uid"]);
    for x in Rec:
       if GetAttr(x,"uid") != GetAttr(DnRecord,"uid"):
@@ -259,24 +270,59 @@ def DoDNS(Str,Attrs,DnRecord):
    global SeenDNS;
    global DNS;
 
-   if cname:
-     if DNS.has_key(G[0]):
+   if cnamerecord:
+     if DNS.has_key(hostname):
        return "CNAME and other RR types not allowed: "+Str
      else:
-       DNS[G[0]] = 2
+       DNS[hostname] = 2
    else:
-     if DNS.has_key(G[0]) and DNS[G[0]] == 2:
+     if DNS.has_key(hostname) and DNS[hostname] == 2:
        return "CNAME and other RR types not allowed: "+Str
      else:
-       DNS[G[0]] = 1
-     
+       DNS[hostname] = 1
+
+   if cnamerecord != None:
+     sanitized = "%s IN CNAME %s" % (hostname, cnamerecord.group(1))
+   elif arecord != None:
+     ipaddress = arecord.group(1)
+     for quad in ipaddress.split('.'):
+       if not (int(quad) >=0 and int(quad) <= 255):
+         return "Invalid quad %s in IP address %s in line %s" %(quad, ipaddress, Str)
+     sanitized = "%s IN A %s"% (hostname, ipaddress)
+   elif mxrecord != None:
+     priority = mxrecord.group(1)
+     mx = mxrecord.group(2)
+     sanitized = "%s IN MX %s %s" % (hostname, priority, mx)
+   elif aaaarecord != None:
+     ipv6address = aaaarecord.group(1)
+     parts = ipv6address.split(':')
+     if len(parts) > 8:
+       return "Invalid IPv6 address (%s): too many parts"%(ipv6address)
+     if len(parts) <= 2:
+       return "Invalid IPv6 address (%s): too few parts"%(ipv6address)
+     if parts[0] == "":
+       parts.pop(0)
+     if parts[-1] == "":
+       parts.pop(-1)
+     seenEmptypart = False
+     for p in parts:
+       if len(p) > 4:
+         return "Invalid IPv6 address (%s): part %s is longer than 4 characters"%(ipv6address, p)
+       if p == "":
+         if seenEmptypart:
+           return "Invalid IPv6 address (%s): more than one :: (nothing in between colons) is not allowed"%(ipv6address)
+         seenEmptypart = True
+     sanitized = "%s IN AAAA %s" % (hostname, ipv6address)
+   else:
+     raise Error, "None of the types I recognize was it.  I shouldn't be here.  confused."
+
    if SeenDNS:
-     Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",Str));
-     return "DNS Entry added "+Str;
-      
-   Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",Str));
+     Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",sanitized));
+     return "DNS Entry added "+sanitized;
+
+   Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",sanitized));
    SeenDNS = 1;
-   return "DNS Entry replaced with "+Str;
+   return "DNS Entry replaced with "+sanitized;
 
 # Handle an RBL list (mailRBL, mailRHSBL, mailWhitelist)
 def DoRBL(Str,Attrs):