[Da-tools-commits] ./debian/userdir-ldap r386: Teach ud-mailgate about ipv6 addresses (RT#193).
Peter Palfrader
peter at palfrader.org
Mon Apr 21 11:31:04 UTC 2008
------------------------------------------------------------
revno: 386
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Mon 2008-04-21 13:31:04 +0200
message:
Teach ud-mailgate about ipv6 addresses (RT#193).
Sanitize DNS entries somewhat before inserting them into LDAP.
modified:
debian/changelog
ud-mailgate
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2008-04-18 12:34:05 +0000
+++ b/debian/changelog 2008-04-21 11:31:04 +0000
@@ -1,3 +1,10 @@
+userdir-ldap (0.3.20) unstable; urgency=low
+
+ * Teach ud-mailgate about ipv6 addresses (RT#193).
+ * Sanitize DNS entries somewhat before inserting them into LDAP.
+
+ -- Peter Palfrader <weasel at debian.org> Mon, 21 Apr 2008 13:29:36 +0200
+
userdir-ldap (0.3.19) unstable; urgency=low
* New [KEYRING] flag to indicate the debian keyring should be synced
=== modified file 'ud-mailgate'
--- a/ud-mailgate 2007-12-26 20:49:42 +0000
+++ b/ud-mailgate 2008-04-21 11:31:04 +0000
@@ -232,17 +232,28 @@
return "SSH Keys replaced with "+FormatSSHAuth(Str);
# Handle changing a dns entry
-# host in a 12.12.12.12
-# host in cname foo.bar. <- Trailing dot is required
+# host IN A 12.12.12.12
+# host IN AAAA 1234::5678
+# host IN CNAME foo.bar. <- Trailing dot is required
+# host IN MX foo.bar. <- Trailing dot is required
def DoDNS(Str,Attrs,DnRecord):
- cname = re.match("^[-\w]+\s+in\s+cname\s+[-\w.]+\.$",Str,re.IGNORECASE);
- if re.match('^[-\w]+\s+in\s+a\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$',\
- Str,re.IGNORECASE) == None and cname == None and \
- re.match("^[-\w]+\s+in\s+mx\s+\d{1,3}\s+[-\w.]+\.$",Str,re.IGNORECASE) == None:
- return None;
+ cnamerecord = re.match("^[-\w]+\s+IN\s+CNAME\s+([-\w.]+\.)$",Str,re.IGNORECASE)
+ arecord = re.match('^[-\w]+\s+IN\s+A\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$',Str,re.IGNORECASE)
+ mxrecord = re.match("^[-\w]+\s+IN\s+MX\s+(\d{1,3})\s+([-\w.]+\.)$",Str,re.IGNORECASE)
+ #aaaarecord = re.match('^[-\w]+\s+IN\s+AAAA\s+((?:[0-9a-f]{1,4})(?::[0-9a-f]{1,4})*(?::(?:(?::[0-9a-f]{1,4})*|:))?)$',Str,re.IGNORECASE)
+ aaaarecord = re.match('^[-\w]+\s+IN\s+AAAA\s+([A-F0-9:]{2,39})$',Str,re.IGNORECASE)
+
+ if cnamerecord == None and\
+ arecord == None and\
+ mxrecord == None and\
+ aaaarecord == None:
+ return None;
# Check if the name is already taken
- G = re.match('^([-\w+]+)\s',Str).groups();
+ G = re.match('^([-\w+]+)\s',Str)
+ if G == None:
+ raise Error, "Hostname not found although we already passed record syntax checks"
+ hostname = G.group(1)
# Check for collisions
global l;
@@ -250,7 +261,7 @@
# since we accept either. It'd probably be better to parse the
# incoming string in order to construct what we feed LDAP rather
# than just passing it through as is.]
- filter = "(|(dnsZoneEntry=%s *)(dnsZoneEntry=%s *))" % (G[0], G[0])
+ filter = "(|(dnsZoneEntry=%s *)(dnsZoneEntry=%s *))" % (hostname, hostname)
Rec = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,filter,["uid"]);
for x in Rec:
if GetAttr(x,"uid") != GetAttr(DnRecord,"uid"):
@@ -259,24 +270,59 @@
global SeenDNS;
global DNS;
- if cname:
- if DNS.has_key(G[0]):
- return "CNAME and other RR types not allowed: "+Str
- else:
- DNS[G[0]] = 2
- else:
- if DNS.has_key(G[0]) and DNS[G[0]] == 2:
- return "CNAME and other RR types not allowed: "+Str
- else:
- DNS[G[0]] = 1
-
+ if cnamerecord:
+ if DNS.has_key(hostname):
+ return "CNAME and other RR types not allowed: "+Str
+ else:
+ DNS[hostname] = 2
+ else:
+ if DNS.has_key(hostname) and DNS[hostname] == 2:
+ return "CNAME and other RR types not allowed: "+Str
+ else:
+ DNS[hostname] = 1
+
+ if cnamerecord != None:
+ sanitized = "%s IN CNAME %s" % (hostname, cnamerecord.group(1))
+ elif arecord != None:
+ ipaddress = arecord.group(1)
+ for quad in ipaddress.split('.'):
+ if not (int(quad) >=0 and int(quad) <= 255):
+ return "Invalid quad %s in IP address %s in line %s" %(quad, ipaddress, Str)
+ sanitized = "%s IN A %s"% (hostname, ipaddress)
+ elif mxrecord != None:
+ priority = mxrecord.group(1)
+ mx = mxrecord.group(2)
+ sanitized = "%s IN MX %s %s" % (hostname, priority, mx)
+ elif aaaarecord != None:
+ ipv6address = aaaarecord.group(1)
+ parts = ipv6address.split(':')
+ if len(parts) > 8:
+ return "Invalid IPv6 address (%s): too many parts"%(ipv6address)
+ if len(parts) <= 2:
+ return "Invalid IPv6 address (%s): too few parts"%(ipv6address)
+ if parts[0] == "":
+ parts.pop(0)
+ if parts[-1] == "":
+ parts.pop(-1)
+ seenEmptypart = False
+ for p in parts:
+ if len(p) > 4:
+ return "Invalid IPv6 address (%s): part %s is longer than 4 characters"%(ipv6address, p)
+ if p == "":
+ if seenEmptypart:
+ return "Invalid IPv6 address (%s): more than one :: (nothing in between colons) is not allowed"%(ipv6address)
+ seenEmptypart = True
+ sanitized = "%s IN AAAA %s" % (hostname, ipv6address)
+ else:
+ raise Error, "None of the types I recognize was it. I shouldn't be here. confused."
+
if SeenDNS:
- Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",Str));
- return "DNS Entry added "+Str;
-
- Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",Str));
+ Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",sanitized));
+ return "DNS Entry added "+sanitized;
+
+ Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",sanitized));
SeenDNS = 1;
- return "DNS Entry replaced with "+Str;
+ return "DNS Entry replaced with "+sanitized;
# Handle an RBL list (mailRBL, mailRHSBL, mailWhitelist)
def DoRBL(Str,Attrs):
More information about the Da-tools-commits
mailing list