1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
|
# Create forest updates ldif from Github markdown
#
# Each update is converted to an ldif then gets written to a corresponding
# .LDF output file or stored in a dictionary.
#
# Only add updates can generally be applied.
#
# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""Generate LDIF from Github documentation."""
import re
import os
import markdown
import xml.etree.ElementTree as ET
from samba.common import get_string
# Display specifier updates or otherwise (ignored in forest_update.py)
def noop(description, attributes, sd):
return (None, None, [], None)
# ACE addition updates (ignored in forest_update.py)
def parse_grant(description, attributes, sd):
return ('modify', None, [], sd if sd.lower() != 'n/a' else None)
# Addition of new objects to the directory (most are applied in forest_update.py)
def parse_add(description, attributes, sd):
dn = extract_dn(description)
return ('add', dn, extract_attrib(dn, attributes), sd if sd.lower() != 'n/a' else None)
# Set of a particular attribute (ignored in forest_update.py)
def parse_set(description, attributes, sd):
return ('modify', extract_dn_or_none(description),
extract_replace_attrib(attributes),
sd if sd.lower() != 'n/a' else None)
# Set of a particular ACE (ignored in forest_update.py)
# The general issue is that the list of DNs must be generated dynamically
def parse_ace(description, attributes, sd):
def extract_dn_ace(text):
if 'Sam-Domain' in text:
return ('${DOMAIN_DN}', 'CN=Sam-Domain,${SCHEMA_DN}')
elif 'Domain-DNS' in text:
return ('${...}', 'CN=Domain-DNS,${SCHEMA_DN}')
return None
return [('modify', extract_dn_ace(description)[0],
['replace: nTSecurityDescriptor',
'nTSecurityDescriptor: ${DOMAIN_SCHEMA_SD}%s' % sd], None),
('modify', extract_dn_ace(description)[1],
['replace: defaultSecurityDescriptor',
'defaultSecurityDescriptor: ${OLD_SAMBA_SD}%s' % sd], None)]
# We are really only interested in 'Created' items
operation_map = {
# modify
'Granting': parse_grant,
# add
'Created': parse_add,
# modify
'Set': parse_set,
# modify
'Added ACE': parse_ace,
# modify
'Updated': parse_set,
# unknown
'Call': noop
}
def extract_dn(text):
"""
Extract a DN from the textual description
:param text:
:return: DN in string form
"""
text = text.replace(' in the Schema partition.', ',${SCHEMA_DN}')
text = text.replace(' in the Configuration partition.', ',${CONFIG_DN}')
dn = re.search('([CDO][NCU]=.*?,)*([CDO][NCU]=.*)', text).group(0)
# This should probably be also fixed upstream
if dn == 'CN=ad://ext/AuthenticationSilo,CN=Claim Types,CN=Claims Configuration,CN=Services':
return 'CN=ad://ext/AuthenticationSilo,CN=Claim Types,CN=Claims Configuration,CN=Services,${CONFIG_DN}'
return dn
def extract_dn_or_none(text):
"""
Same as above, but returns None if it doesn't work
:param text:
:return: DN or None
"""
try:
return extract_dn(text)
except:
return None
def save_ldif(filename, answers, out_folder):
"""
Save ldif to disk for each updates
:param filename: filename use ([OPERATION NUM]-{GUID}.ldif)
:param answers: array of tuples generated with earlier functions
:param out_folder: folder to prepend
"""
path = os.path.join(out_folder, filename)
with open(path, 'w') as ldif:
for answer in answers:
change, dn, attrib, sd = answer
ldif.write('dn: %s\n' % dn)
ldif.write('changetype: %s\n' % change)
if len(attrib) > 0:
ldif.write('\n'.join(attrib) + '\n')
if sd is not None:
ldif.write('nTSecurityDescriptor: D:%s\n' % sd)
ldif.write('-\n\n')
def save_array(guid, answers, out_dict):
"""
Save ldif to an output dictionary
:param guid: GUID to store
:param answers: array of tuples generated with earlier functions
:param out_dict: output dictionary
"""
ldif = ''
for answer in answers:
change, dn, attrib, sd = answer
ldif += 'dn: %s\n' % dn
ldif += 'changetype: %s\n' % change
if len(attrib) > 0:
ldif += '\n'.join(attrib) + '\n'
if sd is not None:
ldif += 'nTSecurityDescriptor: D:%s\n' % sd
ldif += '-\n\n'
out_dict[guid] = ldif
def extract_attrib(dn, attributes):
"""
Extract the attributes as an array from the attributes column
:param dn: parsed from markdown
:param attributes: from markdown
:return: attribute array (ldif-type format)
"""
attrib = [x.lstrip('- ') for x in attributes.split('- ') if x.lower() != 'n/a' and x != '']
attrib = [x.replace(': True', ': TRUE') if x.endswith(': True') else x for x in attrib]
attrib = [x.replace(': False', ': FALSE') if x.endswith(': False') else x for x in attrib]
# We only have one such value, we may as well skip them all consistently
attrib = [x for x in attrib if not x.lower().startswith('msds-claimpossiblevalues')]
return attrib
def extract_replace_attrib(attributes):
"""
Extract the attributes as an array from the attributes column
(for replace)
:param attributes: from markdown
:return: attribute array (ldif-type format)
"""
lines = [x.lstrip('- ') for x in attributes.split('- ') if x.lower() != 'n/a' and x != '']
lines = [('replace: %s' % line.split(':')[0], line) for line in lines]
lines = [line for pair in lines for line in pair]
return lines
def innertext(tag):
return (tag.text or '') + \
''.join(innertext(e) for e in tag) + \
(tag.tail or '')
def read_ms_markdown(in_file, out_folder=None, out_dict=None):
"""
Read Github documentation to produce forest wide udpates
:param in_file: Forest-Wide-Updates.md
:param out_folder: output folder
:param out_dict: output dictionary
"""
with open(in_file) as update_file:
# There is a hidden ClaimPossibleValues in this md file
html = markdown.markdown(re.sub(r'CN=<forest root domain.*?>',
'${FOREST_ROOT_DOMAIN}',
update_file.read()),
output_format='xhtml')
html = html.replace('CN=Schema,%ws', '${SCHEMA_DN}')
tree = ET.fromstring('<root>' + html + '</root>')
for node in tree:
if node.text and node.text.startswith('|Operation'):
# Strip first and last |
updates = [x[1:len(x) - 1].split('|') for x in
get_string(ET.tostring(node, method='text')).splitlines()]
for update in updates[2:]:
output = re.match('Operation (\d+): {(.*)}', update[0])
if output:
# print output.group(1), output.group(2)
guid = output.group(2)
filename = "%s-{%s}.ldif" % (output.group(1).zfill(4), guid)
found = False
if update[3].startswith('Created') or update[1].startswith('Added ACE'):
# Trigger the security descriptor code
# Reduce info to just the security descriptor
update[3] = update[3].split(':')[-1]
result = parse_ace(update[1], update[2], update[3])
if filename and out_folder is not None:
save_ldif(filename, result, out_folder)
else:
save_array(guid, result, out_dict)
continue
for operation in operation_map:
if update[1].startswith(operation):
found = True
result = operation_map[operation](update[1], update[2], update[3])
if filename and out_folder is not None:
save_ldif(filename, [result], out_folder)
else:
save_array(guid, [result], out_dict)
break
if not found:
raise Exception(update)
# print ET.tostring(node, method='text')
if __name__ == '__main__':
import sys
out_folder = ''
if len(sys.argv) == 0:
print("Usage: %s <Forest-Wide-Updates.md> [<output folder>]" % (sys.argv[0]), file=sys.stderr)
sys.exit(1)
in_file = sys.argv[1]
if len(sys.argv) > 2:
out_folder = sys.argv[2]
read_ms_markdown(in_file, out_folder)
|