From 59d97ebdfe01bf2688ba3c428e8a07f81cf13fbd Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Mon, 21 Apr 2008 13:31:04 +0200 Subject: [PATCH] Teach ud-mailgate about ipv6 addresses (RT#193). Sanitize DNS entries somewhat before inserting them into LDAP. --- debian/changelog | 7 ++++ ud-mailgate | 86 +++++++++++++++++++++++++++++++++++++----------- 2 files changed, 73 insertions(+), 20 deletions(-) diff --git a/debian/changelog b/debian/changelog index e9975f0..8716d70 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +userdir-ldap (0.3.20) unstable; urgency=low + + * Teach ud-mailgate about ipv6 addresses (RT#193). + * Sanitize DNS entries somewhat before inserting them into LDAP. + + -- Peter Palfrader Mon, 21 Apr 2008 13:29:36 +0200 + userdir-ldap (0.3.19) unstable; urgency=low * New [KEYRING] flag to indicate the debian keyring should be synced diff --git a/ud-mailgate b/ud-mailgate index cf82b56..01e036d 100755 --- a/ud-mailgate +++ b/ud-mailgate @@ -232,17 +232,28 @@ def DoSSH(Str,Attrs): return "SSH Keys replaced with "+FormatSSHAuth(Str); # Handle changing a dns entry -# host in a 12.12.12.12 -# host in cname foo.bar. <- Trailing dot is required +# host IN A 12.12.12.12 +# host IN AAAA 1234::5678 +# host IN CNAME foo.bar. <- Trailing dot is required +# host IN MX foo.bar. <- Trailing dot is required def DoDNS(Str,Attrs,DnRecord): - cname = re.match("^[-\w]+\s+in\s+cname\s+[-\w.]+\.$",Str,re.IGNORECASE); - if re.match('^[-\w]+\s+in\s+a\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$',\ - Str,re.IGNORECASE) == None and cname == None and \ - re.match("^[-\w]+\s+in\s+mx\s+\d{1,3}\s+[-\w.]+\.$",Str,re.IGNORECASE) == None: - return None; + cnamerecord = re.match("^[-\w]+\s+IN\s+CNAME\s+([-\w.]+\.)$",Str,re.IGNORECASE) + arecord = re.match('^[-\w]+\s+IN\s+A\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$',Str,re.IGNORECASE) + mxrecord = re.match("^[-\w]+\s+IN\s+MX\s+(\d{1,3})\s+([-\w.]+\.)$",Str,re.IGNORECASE) + #aaaarecord = re.match('^[-\w]+\s+IN\s+AAAA\s+((?:[0-9a-f]{1,4})(?::[0-9a-f]{1,4})*(?::(?:(?::[0-9a-f]{1,4})*|:))?)$',Str,re.IGNORECASE) + aaaarecord = re.match('^[-\w]+\s+IN\s+AAAA\s+([A-F0-9:]{2,39})$',Str,re.IGNORECASE) + + if cnamerecord == None and\ + arecord == None and\ + mxrecord == None and\ + aaaarecord == None: + return None; # Check if the name is already taken - G = re.match('^([-\w+]+)\s',Str).groups(); + G = re.match('^([-\w+]+)\s',Str) + if G == None: + raise Error, "Hostname not found although we already passed record syntax checks" + hostname = G.group(1) # Check for collisions global l; @@ -250,7 +261,7 @@ def DoDNS(Str,Attrs,DnRecord): # since we accept either. It'd probably be better to parse the # incoming string in order to construct what we feed LDAP rather # than just passing it through as is.] - filter = "(|(dnsZoneEntry=%s *)(dnsZoneEntry=%s *))" % (G[0], G[0]) + filter = "(|(dnsZoneEntry=%s *)(dnsZoneEntry=%s *))" % (hostname, hostname) Rec = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,filter,["uid"]); for x in Rec: if GetAttr(x,"uid") != GetAttr(DnRecord,"uid"): @@ -259,24 +270,59 @@ def DoDNS(Str,Attrs,DnRecord): global SeenDNS; global DNS; - if cname: - if DNS.has_key(G[0]): + if cnamerecord: + if DNS.has_key(hostname): return "CNAME and other RR types not allowed: "+Str else: - DNS[G[0]] = 2 + DNS[hostname] = 2 else: - if DNS.has_key(G[0]) and DNS[G[0]] == 2: + if DNS.has_key(hostname) and DNS[hostname] == 2: return "CNAME and other RR types not allowed: "+Str else: - DNS[G[0]] = 1 - + DNS[hostname] = 1 + + if cnamerecord != None: + sanitized = "%s IN CNAME %s" % (hostname, cnamerecord.group(1)) + elif arecord != None: + ipaddress = arecord.group(1) + for quad in ipaddress.split('.'): + if not (int(quad) >=0 and int(quad) <= 255): + return "Invalid quad %s in IP address %s in line %s" %(quad, ipaddress, Str) + sanitized = "%s IN A %s"% (hostname, ipaddress) + elif mxrecord != None: + priority = mxrecord.group(1) + mx = mxrecord.group(2) + sanitized = "%s IN MX %s %s" % (hostname, priority, mx) + elif aaaarecord != None: + ipv6address = aaaarecord.group(1) + parts = ipv6address.split(':') + if len(parts) > 8: + return "Invalid IPv6 address (%s): too many parts"%(ipv6address) + if len(parts) <= 2: + return "Invalid IPv6 address (%s): too few parts"%(ipv6address) + if parts[0] == "": + parts.pop(0) + if parts[-1] == "": + parts.pop(-1) + seenEmptypart = False + for p in parts: + if len(p) > 4: + return "Invalid IPv6 address (%s): part %s is longer than 4 characters"%(ipv6address, p) + if p == "": + if seenEmptypart: + return "Invalid IPv6 address (%s): more than one :: (nothing in between colons) is not allowed"%(ipv6address) + seenEmptypart = True + sanitized = "%s IN AAAA %s" % (hostname, ipv6address) + else: + raise Error, "None of the types I recognize was it. I shouldn't be here. confused." + if SeenDNS: - Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",Str)); - return "DNS Entry added "+Str; - - Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",Str)); + Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",sanitized)); + return "DNS Entry added "+sanitized; + + Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",sanitized)); SeenDNS = 1; - return "DNS Entry replaced with "+Str; + return "DNS Entry replaced with "+sanitized; # Handle an RBL list (mailRBL, mailRHSBL, mailWhitelist) def DoRBL(Str,Attrs): -- 2.20.1