diff options
author | John Dennis <jdennis@redhat.com> | 2007-11-14 00:04:19 -0500 |
---|---|---|
committer | John Dennis <jdennis@redhat.com> | 2007-11-14 00:04:19 -0500 |
commit | c24da12fe1c68cc2ea5211763e8904b646a17d95 (patch) | |
tree | d2e14ef781916a49cf545f0fc6d986947f1a0b4e | |
parent | c4bf859bfb95a1e0ebc4501317ff4e8665ac590d (diff) | |
download | freeipa-c24da12fe1c68cc2ea5211763e8904b646a17d95.tar.gz freeipa-c24da12fe1c68cc2ea5211763e8904b646a17d95.tar.xz freeipa-c24da12fe1c68cc2ea5211763e8904b646a17d95.zip |
radius client modify and delete work
-rw-r--r-- | ipa-admintools/Makefile | 2 | ||||
-rw-r--r-- | ipa-admintools/ipa-addradiusclient | 10 | ||||
-rw-r--r-- | ipa-admintools/ipa-delradiusclient | 86 | ||||
-rw-r--r-- | ipa-admintools/ipa-radiusclientmod | 129 | ||||
-rw-r--r-- | ipa-python/ipaclient.py | 13 | ||||
-rw-r--r-- | ipa-python/radius_client.py | 12 | ||||
-rw-r--r-- | ipa-python/rpcclient.py | 41 | ||||
-rw-r--r-- | ipa-server/xmlrpc-server/funcs.py | 29 | ||||
-rw-r--r-- | ipa-server/xmlrpc-server/ipaxmlrpc.py | 3 |
9 files changed, 307 insertions, 18 deletions
diff --git a/ipa-admintools/Makefile b/ipa-admintools/Makefile index 4c8d3f1f4..15c330da2 100644 --- a/ipa-admintools/Makefile +++ b/ipa-admintools/Makefile @@ -22,6 +22,8 @@ install: install -m 755 ipa-listdelegation $(SBINDIR) install -m 755 ipa-moddelegation $(SBINDIR) install -m 755 ipa-addradiusclient $(SBINDIR) + install -m 755 ipa-radiusclientmod $(SBINDIR) + install -m 755 ipa-delradiusclient $(SBINDIR) @for subdir in $(SUBDIRS); do \ (cd $$subdir && $(MAKE) $@) || exit 1; \ diff --git a/ipa-admintools/ipa-addradiusclient b/ipa-admintools/ipa-addradiusclient index 82bd5c189..55926214f 100644 --- a/ipa-admintools/ipa-addradiusclient +++ b/ipa-admintools/ipa-addradiusclient @@ -33,22 +33,18 @@ import ldap #------------------------------------------------------------------------------ -def usage(): - print "ipa-addradiusclient" - sys.exit(1) - def parse_options(): parser = OptionParser() parser.add_option("--usage", action="store_true", help="Program usage") parser.add_option("-a", "--address", dest="ip_addr", - help="RADIUS client IP address") + help="RADIUS client IP address (required)") parser.add_option("-s", "--secret", dest="secret", - help="RADIUS client secret") + help="RADIUS client secret (required)") parser.add_option("-n", "--name", dest="name", help="RADIUS client name") parser.add_option("-t", "--type", dest="nastype", - help="RADIUS client name") + help="RADIUS client NAS Type") parser.add_option("-d", "--description", dest="desc", help="description of the RADIUS client") diff --git a/ipa-admintools/ipa-delradiusclient b/ipa-admintools/ipa-delradiusclient new file mode 100644 index 000000000..efc0bca0f --- /dev/null +++ b/ipa-admintools/ipa-delradiusclient @@ -0,0 +1,86 @@ +#! /usr/bin/python -E +# Authors: John Dennis <jdennis@redhat.com> +# +# Copyright (C) 2007 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +import sys +from optparse import OptionParser +import ipa +from ipa.radius_client import * +import ipa.ipaclient as ipaclient +import ipa.ipavalidate as ipavalidate +import ipa.config +import ipa.ipaerror + +import xmlrpclib +import kerberos +import ldap + +#------------------------------------------------------------------------------ + +def parse_options(): + parser = OptionParser() + parser.add_option("--usage", action="store_true", + help="Program usage") + args = ipa.config.init_config(sys.argv) + options, args = parser.parse_args(args) + + return options, args + +#------------------------------------------------------------------------------ + +# FIXME +def usage(): + print "ipa-delradiusclient ip_addr" + sys.exit(1) + +def main(): + ip_addr = None + secret = None + name = None + nastype = None + desc = None + + options, args = parse_options() + + if len(args) != 2: + usage() + + ip_addr = args[1] + + try: + ipa_client = ipaclient.IPAClient() + ipa_client.delete_radius_client(ip_addr) + print "successfully deleted" + except xmlrpclib.Fault, f: + print f.faultString + return 1 + except kerberos.GSSError, e: + print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0]) + return 1 + except xmlrpclib.ProtocolError, e: + print "Unable to connect to IPA server: %s" % (e.errmsg) + return 1 + except ipa.ipaerror.IPAError, e: + print "%s" % (e.message) + return 1 + + return 0 + +if __name__ == "__main__": + sys.exit(main()) diff --git a/ipa-admintools/ipa-radiusclientmod b/ipa-admintools/ipa-radiusclientmod new file mode 100644 index 000000000..3f40b7b70 --- /dev/null +++ b/ipa-admintools/ipa-radiusclientmod @@ -0,0 +1,129 @@ +#! /usr/bin/python -E +# Authors: John Dennis <jdennis@redhat.com> +# +# Copyright (C) 2007 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +import sys +from optparse import OptionParser +import ipa +from ipa.radius_client import * +import ipa.ipaclient as ipaclient +import ipa.ipavalidate as ipavalidate +import ipa.config +import ipa.ipaerror + +import xmlrpclib +import kerberos +import ldap + +#------------------------------------------------------------------------------ + +def parse_options(): + parser = OptionParser() + parser.add_option("--usage", action="store_true", + help="Program usage") + parser.add_option("-s", "--secret", dest="secret", + help="RADIUS client secret (required)") + parser.add_option("-n", "--name", dest="name", + help="RADIUS client name") + parser.add_option("-t", "--type", dest="nastype", + help="RADIUS client NAS Type") + parser.add_option("-d", "--description", dest="desc", + help="description of the RADIUS client") + + args = ipa.config.init_config(sys.argv) + options, args = parser.parse_args(args) + + return options, args + +#------------------------------------------------------------------------------ + +# FIXME +def usage(): + print "ipa-radiusclientmod ip_addr" + sys.exit(1) + +def main(): + ip_addr = None + secret = None + name = None + nastype = None + desc = None + + options, args = parse_options() + + if len(args) != 2: + usage() + + ip_addr = args[1] + + radius_client = ipa.radius_client.RadiusClient() + ipa_client = ipaclient.IPAClient() + try: + radius_client = ipa_client.get_radius_client_by_ip_addr(ip_addr) + pass + except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_NOT_FOUND): + print "client %s not found" % ip_addr + return 1 + except ipa.ipaerror.IPAError, e: + print "%s" % e.message + return 1 + except kerberos.GSSError, e: + print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0]) + return 1 + + if options.secret: + secret = options.secret + if not validate_secret(secret): return 1 + radius_client.setValue('radiusClientSecret', secret) + + if options.name: + name = options.name + if not validate_name(name): return 1 + radius_client.setValue('radiusClientShortName', name) + + if options.nastype: + nastype = options.nastype + if not validate_nastype(nastype): return 1 + radius_client.setValue('radiusClientNASType', nastype) + + if options.desc: + desc = options.desc + if not validate_desc(desc): return 1 + radius_client.setValue('description', desc) + + try: + ipa_client.update_radius_client(radius_client) + print "successfully modified" + except xmlrpclib.Fault, f: + print f.faultString + return 1 + except kerberos.GSSError, e: + print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0]) + return 1 + except xmlrpclib.ProtocolError, e: + print "Unable to connect to IPA server: %s" % (e.errmsg) + return 1 + except ipa.ipaerror.IPAError, e: + print "%s" % (e.message) + return 1 + + return 0 + +if __name__ == "__main__": + sys.exit(main()) diff --git a/ipa-python/ipaclient.py b/ipa-python/ipaclient.py index 3c54d6ab5..2d9b7a469 100644 --- a/ipa-python/ipaclient.py +++ b/ipa-python/ipaclient.py @@ -27,6 +27,7 @@ import user import group import ipa import config +import radius_client class IPAClient: @@ -332,6 +333,11 @@ class IPAClient: return entries +# radius support + def get_radius_client_by_ip_addr(self,ip_addr,sattrs=None): + result = self.transport.get_radius_client_by_ip_addr(ip_addr,sattrs) + return radius_client.RadiusClient(result) + def add_radius_client(self,client): client_dict = client.toDict() @@ -342,3 +348,10 @@ class IPAClient: result = self.transport.add_radius_client(client_dict) return result + def update_radius_client(self,client): + result = self.transport.update_radius_client(client.origDataDict(), client.toDict()) + return result + + def delete_radius_client(self,ip_addr): + return self.transport.delete_radius_client(ip_addr) + diff --git a/ipa-python/radius_client.py b/ipa-python/radius_client.py index d21273d8a..2709c4d9d 100644 --- a/ipa-python/radius_client.py +++ b/ipa-python/radius_client.py @@ -33,15 +33,15 @@ __all__ = ['RadiusClient', #------------------------------------------------------------------------------ -dotted_octet_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)\.(\d+)(/(\d+))?$") -dns_RE = re.compile(r"^[a-zA-Z][a-zA-Z.-]+$") +dotted_octet_re = re.compile(r"^(\d+)\.(\d+)\.(\d+)\.(\d+)(/(\d+))?$") +dns_re = re.compile(r"^[a-zA-Z][a-zA-Z0-9.-]+$") # secret, name, nastype all have 31 char max in freeRADIUS, max ip address len is 255 valid_secret_len = (1,31) valid_name_len = (1,31) valid_nastype_len = (1,31) valid_ip_addr_len = (1,255) -valid_ip_addr_msg = "IP address must be either a DNS name or a dotted octet with optional mask" +valid_ip_addr_msg = "IP address must be either a DNS name (letters,digits,dot,hyphen, beginning with a letter),or a dotted octet followed by an optional mask (e.g 192.168.1.0/24)" valid_desc_msg = "Description must text string" #------------------------------------------------------------------------------ @@ -72,7 +72,7 @@ def valid_ip_addr(text): # is it a dotted octet? If so there should be 4 integers seperated # by a dot and each integer should be between 0 and 255 # there may be an optional mask preceded by a slash (e.g. 1.2.3.4/24) - match = dotted_octet_RE.search(text) + match = dotted_octet_re.search(text) if match: # dotted octet notation i = 1 @@ -88,8 +88,8 @@ def valid_ip_addr(text): return False return True else: - # DNS name, can contain letters, dot and hypen - if dns_RE.search(text): return True + # DNS name, can contain letters, numbers, dot and hypen, must start with a letter + if dns_re.search(text): return True return False def validate_length(value, limits): diff --git a/ipa-python/rpcclient.py b/ipa-python/rpcclient.py index f0ffec02e..bf3f1bd93 100644 --- a/ipa-python/rpcclient.py +++ b/ipa-python/rpcclient.py @@ -592,6 +592,21 @@ class RPCClient: return ipautil.unwrap_binary_data(result) +# radius support + + def get_radius_client_by_ip_addr(self,ip_addr,sattrs=None): + server = self.setup_server() + if sattrs is None: + sattrs = "__NONE__" + try: + result = server.get_radius_client_by_ip_addr(ip_addr, sattrs) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + def add_radius_client(self,client): server = self.setup_server() @@ -603,4 +618,30 @@ class RPCClient: raise xmlrpclib.Fault(value, msg) return ipautil.unwrap_binary_data(result) + + def update_radius_client(self,oldclient,newclient): + server = self.setup_server() + + try: + result = server.update_radius_client(ipautil.wrap_binary_data(oldclient), + ipautil.wrap_binary_data(newclient)) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + + def delete_radius_client(self,ip_addr): + server = self.setup_server() + + try: + result = server.delete_radius_client(ip_addr) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + diff --git a/ipa-server/xmlrpc-server/funcs.py b/ipa-server/xmlrpc-server/funcs.py index 7c53e6d03..38ba8c2b5 100644 --- a/ipa-server/xmlrpc-server/funcs.py +++ b/ipa-server/xmlrpc-server/funcs.py @@ -456,11 +456,19 @@ class IPAServer: self.releaseConnection(conn) return res +# radius support + + # FIXME, why not just use get_entry_by_dn? + def get_radius_client_by_ip_addr(self, ip_addr, sattrs=None, opts=None): + ip_addr = self.__safe_filter(ip_addr) + basedn = 'cn=clients,cn=radius,cn=services,cn=etc,%s' % self.basedn # FIXME, should not be hardcoded + filter = "(&(radiusClientNASIpAddress=%s)(objectclass=radiusClientProfile))" % ip_addr + return self.__get_sub_entry(basedn, filter, sattrs, opts) + def __is_radius_client_unique(self, ip_addr, opts): """Return 1 if the radius client is unique in the tree, 0 otherwise.""" ip_addr = self.__safe_filter(ip_addr) basedn = 'cn=clients,cn=radius,cn=services,cn=etc,%s' % self.basedn # FIXME, should not be hardcoded - filter = "(&(radiusClientNASIpAddress=%s)(objectclass=radiusClientProfile))" % ip_addr try: @@ -470,7 +478,6 @@ class IPAServer: return 1 def add_radius_client (self, client, opts=None): - print "add_radius_client:" client_container = 'cn=clients,cn=radius,cn=services,cn=etc' # FIXME, should not be hardcoded if self.__is_radius_client_unique(client['radiusClientNASIpAddress'], opts) == 0: raise ipaerror.gen_exception(ipaerror.LDAP_DUPLICATE) @@ -478,8 +485,6 @@ class IPAServer: dn="radiusClientNASIpAddress=%s,%s,%s" % (ldap.dn.escape_dn_chars(client['radiusClientNASIpAddress']), client_container,self.basedn) - print "add_radius_client: dn=%s" % (dn) - entry = ipaserver.ipaldap.Entry(dn) # some required objectclasses @@ -487,7 +492,6 @@ class IPAServer: # fill in our new entry with everything sent by the client for u in client: - print "add_radius_client: attr=%s %s" % (u, client[u]) entry.setValues(u, client[u]) conn = self.getConnection(opts) @@ -497,6 +501,21 @@ class IPAServer: self.releaseConnection(conn) return res + def update_radius_client(self, oldentry, newentry, opts=None): + return self.update_entry(oldentry, newentry, opts) + + def delete_radius_client(self, ip_addr, opts=None): + client = self.get_radius_client_by_ip_addr(ip_addr, ['dn', 'cn'], opts) + if client is None: + raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND) + + conn = self.getConnection(opts) + try: + res = conn.deleteEntry(client['dn']) + finally: + self.releaseConnection(conn) + return res + def get_add_schema (self): """Get the list of fields to be used when adding users in the GUI.""" diff --git a/ipa-server/xmlrpc-server/ipaxmlrpc.py b/ipa-server/xmlrpc-server/ipaxmlrpc.py index fe71aec47..f958414ad 100644 --- a/ipa-server/xmlrpc-server/ipaxmlrpc.py +++ b/ipa-server/xmlrpc-server/ipaxmlrpc.py @@ -351,7 +351,10 @@ def handler(req, profiling=False): h.register_function(f.delete_group) h.register_function(f.attrs_to_labels) h.register_function(f.group_members) + h.register_function(f.get_radius_client_by_ip_addr) h.register_function(f.add_radius_client) + h.register_function(f.update_radius_client) + h.register_function(f.delete_radius_client) h.handle_request(req) finally: pass |