summaryrefslogtreecommitdiffstats
path: root/ipa-radius-admintools/ipa-modradiusclient
blob: 2a37929e921f5c780e482fe90193b23adf31216e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
#! /usr/bin/python -E
# Authors: John Dennis <jdennis@redhat.com>
#
# Copyright (C) 2007  Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#

import sys
import os
from optparse import OptionParser
from sets import Set

import ipa.ipaclient as ipaclient
import ipa.ipautil as ipautil
import ipa.config
import ipa.ipaerror
import ipa.radius_util as radius_util

import xmlrpclib
import kerberos
import ldap

#------------------------------------------------------------------------------

radius_attrs = radius_util.radius_client_attr_to_ldap_attr.keys()
radius_attr_to_ldap_attr = radius_util.radius_client_attr_to_ldap_attr
ldap_attr_to_radius_attr = radius_util.radius_client_ldap_attr_to_radius_attr
mandatory_radius_attrs = ['Client-IP-Address', 'Secret']
distinguished_attr = 'Client-IP-Address'

#------------------------------------------------------------------------------

def help_option_callback(option, opt_str, value, parser, *args, **kwargs):
    parser.print_help()
    print
    print "Valid interative attributes are:"
    print ipautil.format_list(radius_attrs, quote='"')
    print
    print "Required attributes are:"
    print ipautil.format_list(mandatory_radius_attrs, quote='"')
    sys.exit(0)

def main():
    opt_parser = OptionParser(add_help_option=False)

    opt_parser.add_option("-a", "--Client-IP-Address", dest="ip_addr",
                      help="RADIUS client ip address")
    opt_parser.add_option("-s", "--Secret", dest="secret",
                      help="RADIUS client ip address")
    opt_parser.add_option("-n", "--Name", dest="name",
                      help="RADIUS client name")
    opt_parser.add_option("-t", "--NAS-Type", dest="nastype",
                      help="RADIUS client NAS Type")
    opt_parser.add_option("-d", "--Description", dest="desc", 
                      help="description of the RADIUS client")

    opt_parser.add_option("-D", "--delete-attrs", dest="delete_attrs", action='store_true', default=False,
                      help="delete the specified attributes")
    opt_parser.add_option("-h", "--help", action="callback", callback=help_option_callback,
                        help="detailed help information")
    opt_parser.add_option("-i", "--interactive", dest="interactive", action='store_true', default=False,
                      help="interactive mode, prompts with auto-completion")
    opt_parser.add_option("-A", "--attr", dest="attrs", action='append',
                      help="If adding or modifying then this argument specifies one or more attribute=value pair(s), value may be optionally quoted, pairs are seperated by whitespace. If deleting attributes then this argument specifies one or more attribute names seperated by whitespace or commas")
    opt_parser.add_option("-f", "--file", dest="data_file",
                      help="If adding or modifying then attribute=value pair(s) are read from file, value may be optionally quoted, pairs are delimited by whitespace. If deleting attributes then attributes are read from file, attributes are seperated by whitespace or commas. Reads from stdin if file is -")
    opt_parser.add_option("-v", "--verbose", dest="verbose", action='store_true',
                      help="print information")

    opt_parser.set_usage("Usage: %s [options] %s" % (distinguished_attr, os.path.basename(sys.argv[0])))

    ipa.config.add_standard_options(opt_parser)
    options, args = opt_parser.parse_args()

    if len(args) < 1:
        opt_parser.error('missing %s' % (distinguished_attr))

    ipa.config.init_config(options)

    ip_addr = args[0]

    # Verify entity previously exists and get current values
    ipa_client = ipaclient.IPAClient()
    try:
        radius_entity = ipa_client.get_radius_client_by_ip_addr(ip_addr)
    except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_NOT_FOUND):
        print "client %s not found" % ip_addr
        return 1
    except ipa.ipaerror.IPAError, e:
        print "%s" % e.message
        return 1
    except kerberos.GSSError, e:
        print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0])
        return 1

    # Deleteing attributes is fundamentally different than adding/modifying an attribute.
    # When adding/modifying there is always a value the attribute is paired with,
    # so handle the two cases independently.
    if options.delete_attrs:
        attrs = Set()
        # Get attrs from a file or stdin
        if options.data_file:
            try:
                items = ipautil.read_items_file(options.data_file)
                attrs.update(items)
            except Exception, e:
                print "ERROR, could not read attrs (%s)" % (e)

        # Get attrs specified on the command line as a named argument
        if options.secret is not None: attrs.add('Secret')
        if options.name is not None: attrs.add('Name')
        if options.nastype is not None: attrs.add('NAS-Type')
        if options.desc is not None: attrs.add('Description')

        # Get attrs specified on the command line as a attr argument
        if options.attrs:
            for a in options.attrs:
                items = ipautil.parse_items(a)
                attrs.update(items)

        # Get attrs interactively
        if options.interactive:
            deletable_attrs = []
            for radius_attr in radius_attrs:
                if radius_attr in mandatory_radius_attrs: continue
                if radius_entity.hasAttr(radius_attr_to_ldap_attr[radius_attr]):
                    deletable_attrs.append(radius_attr)

            if deletable_attrs:
                c = ipautil.ItemCompleter(deletable_attrs)
                c.open()
                items = c.get_items("Enter: ")
                attrs.update(items)
                c.close()

        # Data collection done, assure no mandatory attrs are in the delete list
        valid = True
        for attr in mandatory_radius_attrs:
            if attr in attrs:
                valid = False
                print "ERROR, %s is mandatory, but is set to be deleted" % (attr)
        if not valid:
            return 1

        # Make sure each attribute is a member of the set of valid attributes
        valid = True
        for attr in attrs:
            if attr not in radius_attrs:
                valid = False
                print "ERROR, %s is not a valid attribute" % (attr)
        if not valid:
            print "Valid attributes are:"
            print ipautil.format_list(radius_attrs, quote='"')
            return 1

        # Dump what we've got so far
        if options.verbose:
            print "Attributes:"
            for attr in attrs:
                print "\t%s" % (attr)

        for attr in attrs:
            radius_entity.delValue(radius_attr_to_ldap_attr[attr])

    else:
        pairs = {}
        pairs[distinguished_attr] = ip_addr

        # Populate the pair list with pre-existing values
        for attr in radius_attrs:
            value = radius_entity.getValues(radius_attr_to_ldap_attr[attr])
            if value is None: continue
            pairs[attr] = value

        # Get pairs from a file or stdin
        if options.data_file:
            try:
                av = ipautil.read_pairs_file(options.data_file)
                pairs.update(av)
            except Exception, e:
                print "ERROR, could not read pairs (%s)" % (e)

        # Get pairs specified on the command line as a named argument
        if options.ip_addr is not None: pairs[distinguished_attr] = options.ip_addr
        if options.secret is not None: pairs['Secret'] = options.secret
        if options.name is not None: pairs['Name'] = options.name
        if options.nastype is not None: pairs['NAS-Type'] = options.nastype
        if options.desc is not None: pairs['Description'] = options.desc

        # Get pairs specified on the command line as a pair argument
        if options.attrs:
            for p in options.attrs:
                av = ipautil.parse_key_value_pairs(p)
                pairs.update(av)

        # Get pairs interactively
        if options.interactive:
            prompted_attrs = radius_attrs[:]
            prompted_attrs.remove(distinguished_attr)
            c = ipautil.AttributeValueCompleter(prompted_attrs, pairs)
            c.open()
            av = c.get_pairs("Enter: ", validate_callback=radius_util.validate)
            pairs.update(av)
            c.close()

        # FIXME: validation should be moved to xmlrpc server

        # Data collection done, assure mandatory data has been specified

        if pairs.has_key(distinguished_attr) and pairs[distinguished_attr] != ip_addr:
            print "ERROR, %s specified on command line (%s) does not match value found in pairs (%s)" % \
                (distinguished_attr, ip_addr, pairs[distinguished_attr])
            return 1

        # Make sure each attribute is a member of the set of valid attributes
        valid = True
        for attr,value in pairs.items():
            if attr not in radius_attrs:
                valid = False
                print "ERROR, %s is not a valid attribute" % (attr)
        if not valid:
            print "Valid attributes are:"
            print ipautil.format_list(radius_attrs, quote='"')
            return 1

        # Makse sure each value is valid
        valid = True
        for attr,value in pairs.items():
            if not radius_util.validate(attr, value):
                valid = False
        if not valid:
            return 1

        # Dump what we've got so far
        if options.verbose:
            print "Pairs:"
            for attr,value in pairs.items():
                print "\t%s = %s" % (attr, value)

        for attr,value in pairs.items():
            radius_entity.setValue(radius_attr_to_ldap_attr[attr], value)

    try:
        ipa_client.update_radius_client(radius_entity)
        print "successfully modified"
    except xmlrpclib.Fault, f:
        print f.faultString
        return 1
    except kerberos.GSSError, e:
        print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0])
        return 1
    except xmlrpclib.ProtocolError, e:
        print "Unable to connect to IPA server: %s" % (e.errmsg)
        return 1
    except ipa.ipaerror.IPAError, e:
        print "%s" % (e.message)
        return 1

    return 0

if __name__ == "__main__":
    sys.exit(main())