On Fri, 2011-10-21 at 11:31 -0400, Rob Crittenden wrote:
> Martin Kosek wrote:
> > On Fri, 2011-10-14 at 14:11 -0400, Rob Crittenden wrote:
> >> Martin Kosek wrote:
> >>> Do at least a basic validation of DNS zone manager mail address.
> >>>
> >>> Do not require '@' to be in the mail address as it is not used
> >>> in common DNS zone configuration (in bind for example) and people
> >>> may be used to configure it that way. '@' is always removed by the
> >>> installer before the DNS zone is created.
> >>>
> >>> https://fedorahosted.org/freeipa/ticket/1966
> >>
> >> There is already a zonemgr_callback defined for this option, can the
> >> verify_zonemgr call be either integrated or called from that?
> >>
> >> rob
> >>
> >
> > Right. Please, try this one. I also added a parser error when more than
> > one '@' is in the checked value.
> >
> > Martin
> 
> A couple of things:
> 
> In the block where you are counting @ why not add an :
> 
> else:
>      raise ValueError('address is not fully qualified')
> 
> rather than looking for '.' in the result? I think it will be clearer 
> that way. I wonder if the error should contain an example as well, are 
> people going to know what a fully-qualified means?
> 
> The regex is very strict for e-mail addresses, perhaps too much so. It 
> doesn't allow upper-case characters, periods or _, both of which are 
> allowed in login names. A common e-mail format is first.last@domain.
> 
> rob

I reorganized the validator a little and let people enter _ in the
domain name. I also added a small explanation of what we mean by
fully-qualified.

Since we have the zonemgr validator available, why not use it for the
DNS plugin too? I enhanced the plugin to use this validator too. Please,
see attached patch.

Martin
>From d74c7421f330136405465f5864595e3427be7e17 Mon Sep 17 00:00:00 2001
From: Martin Kosek <mko...@redhat.com>
Date: Mon, 24 Oct 2011 10:03:29 +0200
Subject: [PATCH] Add --zonemgr/--admin-mail validator

Do at least a basic validation of DNS zone manager mail address.

Do not require '@' to be in the mail address as the SOA record
stores this value without it and people may be used to configure
it that way. '@' is always removed by the installer/dns plugin before
the DNS zone is created.

https://fedorahosted.org/freeipa/ticket/1966
---
 install/tools/ipa-dns-install     |    3 +-
 install/tools/ipa-server-install  |   13 +---------
 ipalib/plugins/dns.py             |    9 +++++++
 ipaserver/install/bindinstance.py |   47 +++++++++++++++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 13 deletions(-)

diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
index d81b6a2e804a815d5bece8426a286e3190f6dee3..7841c21dc89a02250d513ce3ebf5c5389aac98da 100755
--- a/install/tools/ipa-dns-install
+++ b/install/tools/ipa-dns-install
@@ -48,7 +48,8 @@ def parse_options():
     parser.add_option("--reverse-zone", dest="reverse_zone", help="The reverse DNS zone to use")
     parser.add_option("--no-reverse", dest="no_reverse", action="store_true",
                       default=False, help="Do not create reverse DNS zone")
-    parser.add_option("--zonemgr", dest="zonemgr", 
+    parser.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
+                      type="string",
                       help="DNS zone manager e-mail address. Defaults to root")
     parser.add_option("--zone-notif", dest="zone_notif",
                       action="store_true", default=False,
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 76d5f2f5af656a1947da0a5d5d855a398e34ef37..d29b806da4807531f8907229eefa783f0d570f08 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -58,7 +58,6 @@ from ipaserver.plugins.ldap2 import ldap2
 from ipapython import sysrestore
 from ipapython.ipautil import *
 from ipalib import api, errors, util
-from ipalib.parameters import IA5Str
 from ipapython.config import IPAOptionParser
 from ipalib.dn import DN
 from ipalib.x509 import load_certificate_from_file, load_certificate_chain_from_file
@@ -76,16 +75,6 @@ VALID_SUBJECT_ATTRS = ['cn', 'st', 'o', 'ou', 'dnqualifier', 'c',
                        'incorporationlocality', 'incorporationstate',
                        'incorporationcountry', 'businesscategory']
 
-def zonemgr_callback(option, opt_str, value, parser):
-    """
-    Make sure the zonemgr is an IA5String.
-    """
-    name = opt_str.replace('--','')
-    v = unicode(value, 'utf-8')
-    ia = IA5Str(name)
-    ia._convert_scalar(v)
-    parser.values.zonemgr = value
-
 def subject_callback(option, opt_str, value, parser):
     """
     Make sure the certificate subject base is a valid DN
@@ -195,7 +184,7 @@ def parse_options():
     dns_group.add_option("--reverse-zone", dest="reverse_zone", help="The reverse DNS zone to use")
     dns_group.add_option("--no-reverse", dest="no_reverse", action="store_true",
                       default=False, help="Do not create reverse DNS zone")
-    dns_group.add_option("--zonemgr", action="callback", callback=zonemgr_callback,
+    dns_group.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
                       type="string",
                       help="DNS zone manager e-mail address. Defaults to root")
     dns_group.add_option("--zone-notif", dest="zone_notif",
diff --git a/ipalib/plugins/dns.py b/ipalib/plugins/dns.py
index f6bbb3c4f1ce35e7ee5fbc793a396425610f14f0..ce2a441c508f36505729b1e67172d4c39bdd17d8 100644
--- a/ipalib/plugins/dns.py
+++ b/ipalib/plugins/dns.py
@@ -28,6 +28,7 @@ from ipalib.plugins.baseldap import *
 from ipalib import _, ngettext
 from ipapython import dnsclient
 from ipapython.ipautil import valid_ip
+from ipaserver.install.bindinstance import verify_zonemgr
 from ldap import explode_dn
 
 __doc__ = _("""
@@ -136,6 +137,13 @@ _record_attributes = [str('%srecord' % t.lower()) for t in _record_types]
 # supported DNS classes, IN = internet, rest is almost never used
 _record_classes = (u'IN', u'CS', u'CH', u'HS')
 
+def _rname_validator(ugettext, zonemgr):
+    try:
+        verify_zonemgr(zonemgr)
+    except ValueError, e:
+        return unicode(e)
+    return None
+
 # normalizer for admin email
 def _rname_normalizer(value):
     value = value.replace('@', '.')
@@ -323,6 +331,7 @@ class dnszone(LDAPObject):
             doc=_('Authoritative nameserver domain name'),
         ),
         Str('idnssoarname',
+            _rname_validator,
             cli_name='admin_email',
             label=_('Administrator e-mail address'),
             doc=_('Administrator e-mail address'),
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index ddf5497708ab8598d9a01fa0e555dd1ced55953b..12c286c94bdcb32ea4b84abe3f0172a04ff71b0d 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -22,6 +22,7 @@ import os
 import pwd
 import logging
 import netaddr
+import re
 
 import installutils
 import ldap
@@ -32,6 +33,8 @@ from ipaserver.install.installutils import resolve_host
 from ipapython import sysrestore
 from ipapython import ipautil
 from ipalib.constants import DNS_ZONE_REFRESH
+from ipalib.parameters import IA5Str
+from ipalib import _, ngettext
 
 import ipalib
 from ipalib import api, util, errors
@@ -286,6 +289,50 @@ def get_rr(zone, name, type):
 
     return []
 
+def verify_zonemgr(zonemgr):
+    """ See RFC 1033, 1035 """
+    regex_domain = re.compile(r'^[a-z0-9][a-z0-9-]*$', re.IGNORECASE)
+    regex_name = re.compile(r'^[a-z0-9][a-z0-9-_]*$', re.IGNORECASE)
+
+    if len(zonemgr) > 255:
+        raise ValueError(_('cannot be longer that 255 characters'))
+
+    if zonemgr.count('@') == 1:
+        name, dot, domain = zonemgr.partition('@')
+    elif zonemgr.count('@') > 1:
+        raise ValueError(_('too many \'@\' characters'))
+    else:
+        # address in SOA format already (without @)
+        name, dot, domain = zonemgr.partition('.')
+
+    if domain.endswith('.'):
+        domain = domain[:-1]
+
+    if '.' not in domain:
+        raise ValueError(_('address domain is not fully qualified ' \
+                          '("example.com" instead of just "example")'))
+
+    if not regex_name.match(name):
+        raise ValueError(_('mail account may only include letters, numbers, -, and _'))
+
+    if not all(regex_domain.match(part) for part in domain.split(".")):
+        raise ValueError(_('domain name may only include letters, numbers, and -'))
+
+def zonemgr_callback(option, opt_str, value, parser):
+    """
+    Properly validate and convert --zonemgr Option to IA5String
+    """
+    # validate the value first
+    try:
+        verify_zonemgr(value)
+    except ValueError, e:
+        parser.error("invalid zonemgr: " + unicode(e))
+
+    name = opt_str.replace('--','')
+    v = unicode(value, 'utf-8')
+    ia = IA5Str(name)
+    ia._convert_scalar(v)
+    parser.values.zonemgr = value
 
 class DnsBackup(object):
     def __init__(self, service):
-- 
1.7.6.4

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to