author | Peter Marschall <peter@adpm.de> |
Sat, 05 Mar 2011 17:33:41 +0100 (2011-03-05) | |
changeset 16 | a2e3faa3d2fc |
parent 15 | f6157d378459 |
child 17 | 669085d93aa3 |
permissions | -rwxr-xr-x |
0 | 1 |
#!/usr/bin/env perl |
2 |
# vim: set nosta noet ts=4 sw=4: |
|
3 |
# |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
4 |
# Copyright (c) 2006-2011, Mahlon E. Smith <mahlon@martini.nu> |
0 | 5 |
# All rights reserved. |
6 |
# Redistribution and use in source and binary forms, with or without |
|
7 |
# modification, are permitted provided that the following conditions are met: |
|
8 |
# |
|
9 |
# * Redistributions of source code must retain the above copyright |
|
10 |
# notice, this list of conditions and the following disclaimer. |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
11 |
# |
0 | 12 |
# * Redistributions in binary form must reproduce the above copyright |
13 |
# notice, this list of conditions and the following disclaimer in the |
|
14 |
# documentation and/or other materials provided with the distribution. |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
15 |
# |
0 | 16 |
# * Neither the name of Mahlon E. Smith nor the names of his |
17 |
# contributors may be used to endorse or promote products derived |
|
18 |
# from this software without specific prior written permission. |
|
19 |
# |
|
20 |
# THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY |
|
21 |
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
|
22 |
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
|
23 |
# DISCLAIMED. IN NO EVENT SHALL THE REGENTS AND CONTRIBUTORS BE LIABLE FOR ANY |
|
24 |
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
|
25 |
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
|
26 |
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
|
27 |
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
|
28 |
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
|
29 |
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
|
30 |
||
31 |
=head1 NAME |
|
32 |
||
10
664bbe3dcd44
Follow regular man page conventions. Patch from
Mahlon E. Smith <mahlon@laika.com>
parents:
9
diff
changeset
|
33 |
Shelldap - A program for interacting with an LDAP server via a shell-like interface |
0 | 34 |
|
10
664bbe3dcd44
Follow regular man page conventions. Patch from
Mahlon E. Smith <mahlon@laika.com>
parents:
9
diff
changeset
|
35 |
=head1 DESCRIPTION |
664bbe3dcd44
Follow regular man page conventions. Patch from
Mahlon E. Smith <mahlon@laika.com>
parents:
9
diff
changeset
|
36 |
|
664bbe3dcd44
Follow regular man page conventions. Patch from
Mahlon E. Smith <mahlon@laika.com>
parents:
9
diff
changeset
|
37 |
Shelldap /LDAP::Shell is a program for interacting with an LDAP server via a shell-like |
0 | 38 |
interface. |
39 |
||
40 |
This is not meant to be an exhaustive LDAP editing and browsing |
|
41 |
interface, but rather an intuitive shell for performing basic LDAP |
|
42 |
tasks quickly and with minimal effort. |
|
43 |
||
44 |
=head1 SYNPOSIS |
|
45 |
||
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
46 |
shelldap --server example.net [--help] |
0 | 47 |
|
48 |
=head1 FEATURES |
|
49 |
||
50 |
- Upon successful authenticated binding, credential information is |
|
51 |
auto-cached to ~/.shelldap.rc -- future loads require no command line |
|
52 |
flags. |
|
53 |
||
54 |
- Custom 'description maps' for entry listings. (See the 'list' command.) |
|
55 |
||
56 |
- History and autocomplete via readline, if installed. |
|
57 |
||
58 |
- Automatic reconnection attempts if the connection is lost with the |
|
59 |
LDAP server. |
|
60 |
||
61 |
- It feels like a semi-crippled shell, making LDAP browsing and editing |
|
62 |
at least halfway pleasurable. |
|
63 |
||
64 |
=head1 OPTIONS |
|
65 |
||
66 |
All command line options follow getopts long conventions. |
|
67 |
||
68 |
shelldap --server example.net --basedn dc=your,o=company |
|
69 |
||
70 |
You may also optionally create a ~/.shelldap.rc file with command line |
|
71 |
defaults. This file should be valid YAML. (This file is generated |
|
72 |
automatically on a successful bind auth.) |
|
73 |
||
74 |
Example: |
|
75 |
||
76 |
server: ldap.example.net |
|
77 |
binddn: cn=Manager,dc=your,o=company |
|
78 |
bindpass: xxxxxxxxx |
|
79 |
basedn: dc=your,o=company |
|
80 |
tls: yes |
|
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
81 |
tls_cacert: /etc/ssl/certs/cacert.pem |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
82 |
tls_cert: ~/.ssl/client.cert.pem |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
83 |
tls_key: ~/.ssl/private/client.key.pem |
0 | 84 |
|
85 |
=over 4 |
|
86 |
||
87 |
=item B<server> |
|
88 |
||
89 |
Required. The LDAP server to connect to. This can be a hostname, IP |
|
90 |
address, or a URI. |
|
91 |
||
92 |
--server ldaps://ldap.example.net |
|
93 |
||
94 |
=back |
|
95 |
||
96 |
=over 4 |
|
97 |
||
98 |
=item B<binddn> |
|
99 |
||
100 |
The full dn of a user to authenticate as. If not specified, defaults to |
|
101 |
an anonymous bind. You will be prompted for a password. |
|
102 |
||
103 |
--binddn cn=Manager,dc=your,o=company |
|
104 |
||
105 |
=back |
|
106 |
||
107 |
=over 4 |
|
108 |
||
109 |
=item B<basedn> |
|
110 |
||
111 |
The directory 'root' of your LDAP server. If omitted, shelldap will |
|
112 |
try and ask the server for a sane default. |
|
113 |
||
114 |
--basedn dc=your,o=company |
|
115 |
||
116 |
=back |
|
117 |
||
118 |
=over 4 |
|
119 |
||
120 |
=item B< tls> |
|
121 |
||
122 |
Enables TLS over what would normally be an insecure connection. |
|
123 |
Requires server side support. |
|
124 |
||
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
125 |
=item B<tls_cacert> |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
126 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
127 |
Specify CA Certificate to trust. |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
128 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
129 |
--tls_cacert /etc/ssl/certs/cacert.pem |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
130 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
131 |
=item B<tls_cert> |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
132 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
133 |
The TLS client certificate. |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
134 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
135 |
--tls_cert ~/.ssl/client.cert.pem |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
136 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
137 |
=item B<tls_key> |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
138 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
139 |
The TLS client key. Not specifying a key will connect via TLS without |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
140 |
key verification. |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
141 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
142 |
--tls_key ~/.ssl/private/client.key.pem |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
143 |
|
0 | 144 |
=back |
145 |
||
146 |
=over 4 |
|
147 |
||
148 |
=item B<cacheage> |
|
149 |
||
150 |
Set the time to cache directory lookups in seconds. |
|
151 |
||
152 |
By default, directory lookups are cached for 300 seconds, to speed |
|
153 |
autocomplete up when changing between different basedns. |
|
154 |
||
155 |
Modifications to the directory automatically reset the cache. Directory |
|
156 |
listings are not cached. (This is just used for autocomplete.) Set it |
|
157 |
to 0 to disable caching completely. |
|
158 |
||
159 |
=back |
|
160 |
||
161 |
=over 4 |
|
162 |
||
163 |
=item B<timeout> |
|
164 |
||
165 |
Set the maximum time an LDAP operation can take before it is cancelled. |
|
166 |
||
167 |
=back |
|
168 |
||
169 |
=over 4 |
|
170 |
||
171 |
=item B<debug> |
|
172 |
||
173 |
Print extra operational info out, and backtrace on fatal error. |
|
174 |
||
175 |
=back |
|
176 |
||
177 |
=head1 SHELL COMMANDS |
|
178 |
||
179 |
=over 4 |
|
180 |
||
181 |
=item B< cat> |
|
182 |
||
183 |
Display an LDIF dump of an entry. Globbing is supported. Specify |
|
184 |
either the full dn, or an rdn. For most commands, rdns are local to the |
|
185 |
current search base. ('cwd', as translated to shell speak.) You may additionally |
|
186 |
add a list of attributes to display. Use '+' for server side attributes. |
|
187 |
||
188 |
cat uid=mahlon |
|
189 |
cat ou=* |
|
190 |
cat uid=mahlon,ou=People,dc=example,o=company |
|
191 |
cat uid=mahlon + userPassword |
|
192 |
||
193 |
=item B< cd> |
|
194 |
||
195 |
Change directory. Translated to LDAP, this changes the current basedn. |
|
196 |
All commands after a 'cd' operate within the new basedn. |
|
197 |
||
198 |
cd cd to 'home' basedn |
|
199 |
cd ~ same thing |
|
200 |
cd - cd to previous directory |
|
201 |
cd ou=People cd to explicit path |
|
202 |
cd .. cd to parent node |
|
203 |
||
204 |
Since LDAP doesn't actually limit what can be a container object, you |
|
205 |
can actually cd into any entry. Many commands then work on '.', meaning |
|
206 |
"wherever I currently am." |
|
207 |
||
208 |
cd uid=mahlon |
|
209 |
cat . |
|
210 |
||
211 |
=item B<clear> |
|
212 |
||
213 |
Clear the screen. |
|
214 |
||
215 |
=item B<copy> |
|
216 |
||
217 |
Copy an entry to a different dn path. All copies are relative to the |
|
218 |
current basedn, unless a full dn is specified. All attributes are |
|
219 |
copied, then an LDAP moddn() is performed. |
|
220 |
||
221 |
copy uid=mahlon uid=bob |
|
222 |
copy uid=mahlon ou=Others,dc=example,o=company |
|
223 |
copy uid=mahlon,ou=People,dc=example,o=company uid=mahlon,ou=Others,dc=example,o=company |
|
224 |
||
225 |
aliased to: cp |
|
226 |
||
227 |
=item B<create> |
|
228 |
||
229 |
Create an entry from scratch. Arguments are space separated objectClass |
|
230 |
names. Possible objectClasses are derived automatically from the |
|
231 |
server, and will tab-complete. |
|
232 |
||
233 |
After the classes are specified, an editor will launch. Required |
|
234 |
attributes are listed first, then optional attributes. Optionals are |
|
235 |
commented out. After the editor exits, the resulting LDIF is validated |
|
236 |
and added to the LDAP directory. |
|
237 |
||
238 |
create top person organizationalPerson inetOrgPerson posixAccount |
|
239 |
||
240 |
aliased to: touch |
|
241 |
||
242 |
=item B<delete> |
|
243 |
||
244 |
Remove an entry from the directory. Globbing is supported. |
|
245 |
All deletes are sanity-prompted. |
|
246 |
||
247 |
delete uid=mahlon |
|
248 |
delete uid=ma* |
|
249 |
||
250 |
aliased to: rm |
|
251 |
||
252 |
=item B<edit> |
|
253 |
||
254 |
Edit an entry in an external editor. After the editor exits, the |
|
255 |
resulting LDIF is sanity checked, and changes are written to the LDAP |
|
256 |
directory. |
|
257 |
||
258 |
edit uid=mahlon |
|
259 |
||
260 |
aliased to: vi |
|
261 |
||
262 |
=item B< env> |
|
263 |
||
264 |
Show values for various runtime variables. |
|
265 |
||
266 |
=item B<grep> |
|
267 |
||
268 |
Search for arbitrary LDAP filters, and return matching dn results. |
|
269 |
The search string must be a valid LDAP filter. |
|
270 |
||
271 |
grep uid=mahlon |
|
272 |
grep uid=mahlon ou=People |
|
273 |
grep -r (&(uid=mahlon)(objectClass=*)) |
|
274 |
||
275 |
aliased to: search |
|
276 |
||
277 |
=item B<list> |
|
278 |
||
279 |
List entries for the current basedn. Globbing is supported. |
|
280 |
||
281 |
aliased to: ls |
|
282 |
||
283 |
ls -l |
|
284 |
ls -lR uid=mahlon |
|
285 |
list uid=m* |
|
286 |
list verbose |
|
287 |
||
288 |
In 'verbose' mode, descriptions are listed as well, if they exist. |
|
289 |
There are also some 'sane' long listings for common objectClass types. |
|
290 |
You can actually specify your own in your .shelldap.rc, like so: |
|
291 |
||
292 |
... |
|
293 |
descmaps: |
|
294 |
objectClass: attributename |
|
295 |
posixAccount: gecos |
|
296 |
posixGroup: gidNumber |
|
297 |
ipHost: ipHostNumber |
|
298 |
puppetClient: puppetclass |
|
299 |
||
300 |
=item B<mkdir> |
|
301 |
||
302 |
Creates a new 'organizationalUnit' entry. |
|
303 |
||
304 |
mkdir containername |
|
305 |
mkdir ou=whatever |
|
306 |
||
307 |
=item B<move> |
|
308 |
||
309 |
Move an entry to a different dn path. Usage is identical to B<copy>. |
|
310 |
||
311 |
aliased to: mv |
|
312 |
||
313 |
=item B<passwd> |
|
314 |
||
315 |
If supported server side, change the password for a specified entry. |
|
316 |
The entry must have a 'userPassword' attribute. |
|
317 |
||
318 |
passwd uid=mahlon |
|
319 |
||
320 |
=item B< pwd> |
|
321 |
||
322 |
Print the 'working directory' - aka, the current ldap basedn. |
|
323 |
||
324 |
=item B<setenv> |
|
325 |
||
326 |
Modify various runtime variables normally set from the command line. |
|
327 |
||
328 |
setenv debug 1 |
|
329 |
export debug=1 |
|
330 |
||
331 |
=item B<whoami> |
|
332 |
||
333 |
Show current auth credentials. Unless you specified a binddn, this |
|
334 |
will just show an anonymous bind. |
|
335 |
||
336 |
=back |
|
337 |
||
338 |
=head1 TODO |
|
339 |
||
340 |
Referral support. Currently, if you try to write to a replicant slave, |
|
341 |
you'll just get a referral. It would be nice if shelldap automatically |
|
342 |
tried to follow it. |
|
343 |
||
344 |
For now, it only makes sense to connect to a master if you plan on doing |
|
345 |
any writes. |
|
346 |
||
347 |
"cd ../ou=SomewhereElse" doesn't work, but "cd ../../" does. This is |
|
348 |
weird, as both should probably work. |
|
349 |
||
350 |
=head1 BUGS / LIMITATIONS |
|
351 |
||
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
352 |
There is no support for editing binary data. If you need to edit base64 |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
353 |
stuff, just feed it to the regular ldapmodify/ldapadd/etc tools. |
0 | 354 |
|
355 |
=head1 AUTHOR |
|
356 |
||
357 |
Mahlon E. Smith <mahlon@martini.nu> |
|
358 |
||
359 |
=cut |
|
360 |
||
361 |
package LDAP::Shell; |
|
362 |
use strict; |
|
363 |
use warnings; |
|
364 |
use Term::ReadKey; |
|
365 |
use Term::Shell; |
|
366 |
use Digest::MD5; |
|
16
a2e3faa3d2fc
use symbolic LDAP error codes instead of numbers
Peter Marschall <peter@adpm.de>
parents:
15
diff
changeset
|
367 |
use Net::LDAP qw(LDAP_SUCCESS LDAP_SERVER_DOWN); |
0 | 368 |
use Net::LDAP::LDIF; |
369 |
use Data::Dumper; |
|
370 |
use File::Temp; |
|
371 |
use Algorithm::Diff; |
|
372 |
use Carp 'confess'; |
|
373 |
use base 'Term::Shell'; |
|
374 |
require Net::LDAP::Extension::SetPassword; |
|
375 |
||
376 |
my $conf = $main::conf; |
|
377 |
||
378 |
# make 'die' backtrace in debug mode |
|
379 |
$SIG{'__DIE__'} = \&Carp::confess if $conf->{'debug'}; |
|
380 |
||
381 |
############################################################### |
|
382 |
# |
|
383 |
# UTILITY FUNCTIONS |
|
384 |
# |
|
385 |
############################################################### |
|
386 |
||
387 |
# initial shell behaviors |
|
388 |
# |
|
389 |
sub init |
|
390 |
{ |
|
391 |
my $self = shift; |
|
392 |
$self->{'API'}->{'match_uniq'} = 0; |
|
393 |
||
394 |
$self->{'editor'} = $ENV{'EDITOR'} || 'vi'; |
|
395 |
$self->{'env'} = [ qw/ debug cacheage timeout / ]; |
|
396 |
||
397 |
# let autocomplete work with the '=' character |
|
398 |
my $term = $self->term(); |
|
399 |
$term->Attribs->{'basic_word_break_characters'} =~ s/=//m; |
|
400 |
$term->Attribs->{'completer_word_break_characters'} =~ s/=//m; |
|
401 |
||
402 |
# read in history |
|
403 |
eval { |
|
404 |
$term->history_truncate_file("$ENV{'HOME'}/.shelldap_history", 50); |
|
405 |
$term->ReadHistory("$ENV{'HOME'}/.shelldap_history"); |
|
406 |
}; |
|
407 |
||
408 |
$self->{'root_dse'} = $self->ldap->root_dse(); |
|
409 |
if ( $conf->{'debug'} ) { |
|
410 |
$self->{'schema'} = $self->ldap->schema(); |
|
411 |
my @versions = |
|
412 |
@{ $self->{'root_dse'}->get_value('supportedLDAPVersion', asref => 1) }; |
|
413 |
print "Connected to $conf->{'server'}\n"; |
|
414 |
print "Supported LDAP version: ", ( join ', ', @versions ), "\n"; |
|
415 |
print "Cipher in use: ", $self->ldap()->cipher(), "\n"; |
|
416 |
} |
|
417 |
||
418 |
# try an initial search and die if it doesn't work |
|
419 |
# (bad baseDN) |
|
420 |
my $s = $self->search(); |
|
421 |
die "LDAP baseDN error: ", $s->{'message'}, "\n" if $s->{'code'}; |
|
422 |
||
423 |
$self->{'schema'} = $self->ldap->schema(); |
|
424 |
||
425 |
# okay, now do an initial population of 'cwd' |
|
426 |
# for autocomplete. |
|
427 |
$self->update_entries(); |
|
428 |
||
429 |
# whew, okay. Update prompt, wait for input! |
|
430 |
$self->update_prompt(); |
|
431 |
||
432 |
return; |
|
433 |
} |
|
434 |
||
435 |
||
436 |
# get an ldap connection handle |
|
437 |
# |
|
438 |
sub ldap |
|
439 |
{ |
|
440 |
my $self = shift; |
|
441 |
||
442 |
# use cached connection object if it exists |
|
443 |
return $self->{'ldap'} if $self->{'ldap'}; |
|
444 |
||
445 |
# fill in potentially missing info |
|
446 |
die "No server specified.\n" unless $conf->{'server'}; |
|
15
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
447 |
|
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
448 |
# Emit a nicer error message if IO::Socket::SSL is |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
449 |
# not installed and Net::LDAP decides it is required. |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
450 |
# |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
451 |
if ( $conf->{'tls'} || $conf->{'server'} =~ m|ldaps://| ) { |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
452 |
eval 'use IO::Socket::SSL'; |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
453 |
die qq{IO::Socket::SSL not installed, but is required for SSL or TLS connections. |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
454 |
You may try connecting insecurely, or install the module and try again.\n} if $@; |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
455 |
} |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
456 |
|
0 | 457 |
if ( $conf->{'binddn'} && ! $conf->{'bindpass'} ) { |
458 |
print "Bind password: "; |
|
459 |
Term::ReadKey::ReadMode 2; |
|
460 |
chomp($conf->{'bindpass'} = <STDIN>); |
|
461 |
Term::ReadKey::ReadMode 0; |
|
462 |
print "\n"; |
|
463 |
} |
|
464 |
||
465 |
# make connection |
|
466 |
my $ldap = Net::LDAP->new( $conf->{'server'} ) |
|
467 |
or die "Unable to connect to LDAP server '$conf->{'server'}': $!\n"; |
|
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
468 |
|
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
469 |
# secure connection options |
15
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
470 |
# |
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
471 |
if ( $conf->{'tls'} ) { |
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
472 |
if ( $conf->{'tls_key'} ) { |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
473 |
$ldap->start_tls( |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
474 |
verify => 'require', |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
475 |
cafile => $conf->{'tls_cacert'}, |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
476 |
clientcert => $conf->{'tls_cert'}, |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
477 |
clientkey => $conf->{'tls_key'}, |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
478 |
keydecrypt => sub { |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
479 |
print "Key Passphrase: "; |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
480 |
Term::ReadKey::ReadMode 2; |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
481 |
chomp(my $secret = <STDIN>); |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
482 |
Term::ReadKey::ReadMode 0; |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
483 |
print "\n"; |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
484 |
return $secret; |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
485 |
}); |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
486 |
} |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
487 |
else { |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
488 |
$ldap->start_tls( verify => 'none' ); |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
489 |
} |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
490 |
} |
0 | 491 |
|
492 |
# bind |
|
493 |
my $rv; |
|
494 |
if ( $conf->{'binddn'} ) { |
|
495 |
# authed |
|
496 |
$rv = $ldap->bind( |
|
497 |
$conf->{'binddn'}, |
|
498 |
password => $conf->{'bindpass'} |
|
499 |
); |
|
500 |
} |
|
501 |
else { |
|
502 |
# anon |
|
503 |
$rv = $ldap->bind(); |
|
504 |
} |
|
505 |
||
506 |
my $err = $rv->error(); |
|
507 |
if ( $rv->code() ) { |
|
15
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
508 |
$err .= " (try the --tls flag?)" |
0 | 509 |
if $err =~ /confidentiality required/i; |
510 |
die "LDAP bind error: $err\n"; |
|
511 |
} |
|
512 |
||
513 |
# offer to cache authentication info |
|
514 |
# if we enter this conditional, we have successfully |
|
515 |
# authed with the server (non anonymous), and |
|
516 |
# we haven't cached anything in the past. |
|
15
f6157d378459
Exit with a nicer error message if IO::Socket::SSL isn't installed,
Mahlon E. Smith <mahlon@martini.nu>
parents:
14
diff
changeset
|
517 |
# |
0 | 518 |
if ( $conf->{'binddn'} && ! -e $conf->{'confpath'} ) { |
519 |
print "Would you like to cache your connection information? [Y/n]: "; |
|
520 |
chomp( my $response = <STDIN> ); |
|
521 |
unless ( $response =~ /^n/i ) { |
|
522 |
YAML::Syck::DumpFile( $conf->{'confpath'}, $conf ); |
|
523 |
chmod 0600, $conf->{'confpath'}; |
|
524 |
print "Connection info cached.\n"; |
|
525 |
} |
|
526 |
} |
|
527 |
||
528 |
$self->{'ldap'} = $ldap; |
|
529 |
return $ldap; |
|
530 |
} |
|
531 |
||
532 |
# just return an LDIF object |
|
533 |
# |
|
534 |
sub ldif |
|
535 |
{ |
|
536 |
my $self = shift; |
|
537 |
my $use_temp = shift; |
|
538 |
||
539 |
# create tmpfile and link ldif object with it |
|
540 |
if ( $use_temp ) { |
|
541 |
my ( undef, $fname ) = |
|
542 |
File::Temp::tempfile( 'shelldap_XXXXXXXX', DIR => '/tmp', UNLINK => 1 ); |
|
543 |
$self->{'ldif'} = Net::LDAP::LDIF->new( $fname, 'w', sort => 1 ); |
|
544 |
$self->{'ldif_fname'} = $fname; |
|
545 |
} |
|
546 |
||
547 |
# ldif -> stdout |
|
548 |
else { |
|
549 |
$self->{'ldif'} = Net::LDAP::LDIF->new( \*STDOUT, 'w', sort => 1 ); |
|
550 |
} |
|
551 |
||
552 |
return $self->{'ldif'}; |
|
553 |
} |
|
554 |
||
555 |
# load and return an Entry object from LDIF |
|
556 |
# |
|
557 |
sub load_ldif |
|
558 |
{ |
|
559 |
my $self = shift; |
|
560 |
||
561 |
my $ldif = Net::LDAP::LDIF->new( shift(), 'r' ); |
|
562 |
return unless $ldif; |
|
563 |
||
564 |
my $e; |
|
565 |
eval { $e = $ldif->read_entry(); }; |
|
566 |
||
567 |
return if $@; |
|
568 |
return $e; |
|
569 |
} |
|
570 |
||
571 |
# given a filename, return an md5 checksum |
|
572 |
# |
|
573 |
sub chksum |
|
574 |
{ |
|
575 |
my $self = shift; |
|
576 |
my $file = shift or return; |
|
577 |
||
578 |
my $md5 = Digest::MD5->new(); |
|
579 |
open F, $file or die "Unable to read temporary ldif: $!\n"; |
|
580 |
my $hash = $md5->addfile( *F )->hexdigest(); |
|
581 |
close F; |
|
582 |
||
583 |
return $hash; |
|
584 |
} |
|
585 |
||
586 |
# prompt functions |
|
587 |
# |
|
588 |
sub prompt_str |
|
589 |
{ |
|
590 |
my $self = shift; |
|
591 |
return $self->{'prompt'}; |
|
592 |
} |
|
593 |
sub update_prompt |
|
594 |
{ |
|
595 |
my $self = shift; |
|
596 |
my $base = $self->base(); |
|
597 |
||
598 |
if ( length $base > 50 ) { |
|
599 |
my $cwd_dn = $1 if $base =~ /^(.*?),/; |
|
600 |
$self->{'prompt'} = "... $cwd_dn > "; |
|
601 |
} |
|
602 |
else { |
|
603 |
my $prompt = $base; |
|
604 |
$prompt =~ s/$conf->{'basedn'}/~/; |
|
605 |
$self->{'prompt'} = "$prompt > "; |
|
606 |
} |
|
607 |
return; |
|
608 |
} |
|
609 |
||
610 |
# search base accessor |
|
611 |
# |
|
612 |
sub base |
|
613 |
{ |
|
614 |
my $self = shift; |
|
615 |
$self->{'base'} ||= $conf->{'basedn'}; |
|
616 |
||
617 |
# try and determine base automatically from rootDSE |
|
618 |
# |
|
619 |
unless ( $self->{'base'} ) { |
|
620 |
my $base = $self->{'root_dse'}->{'asn'} || {}; |
|
621 |
$base = $base->{'attributes'} || []; |
|
622 |
$base = $base->[0] || {}; |
|
623 |
$base = $base->{'vals'} || []; |
|
624 |
$conf->{'basedn'} = $base->[0]; |
|
625 |
$self->{'base'} = $base->[0]; |
|
626 |
} |
|
627 |
if ( $_[0] ) { |
|
628 |
$self->{'base'} = $_[0]; |
|
629 |
} |
|
630 |
return $self->{'base'}; |
|
631 |
} |
|
632 |
||
633 |
# make sure a given rdn includes the current |
|
634 |
# base, making it a dn. |
|
635 |
# accepts a string reference. |
|
636 |
# |
|
637 |
sub rdn_to_dn |
|
638 |
{ |
|
639 |
my $self = shift; |
|
640 |
my $rdn = shift or return; |
|
641 |
||
642 |
return unless ref $rdn; |
|
643 |
||
644 |
# allow cd to 'basedn' and cd to directories 'higher' in the tree |
|
645 |
return if $$rdn =~ /$conf->{'basedn'}$/; |
|
646 |
||
647 |
# auto fill in current base for deeper DNs |
|
648 |
my ( $dn, $curbase ) = ( $$rdn, $self->base() ); |
|
649 |
$dn = "$$rdn," . $curbase unless $$rdn =~ /$curbase/i; |
|
650 |
||
651 |
$$rdn = $dn; |
|
652 |
} |
|
653 |
||
654 |
# do a search on a dn to determine if it is valid. |
|
655 |
# returns a bool. |
|
656 |
# |
|
657 |
sub is_valid_dn |
|
658 |
{ |
|
659 |
my $self = shift; |
|
660 |
my $dn = shift or return 0; |
|
661 |
||
662 |
my $r = $self->search({ base => $dn }); |
|
663 |
||
16
a2e3faa3d2fc
use symbolic LDAP error codes instead of numbers
Peter Marschall <peter@adpm.de>
parents:
15
diff
changeset
|
664 |
return $r->{'code'} == LDAP_SUCCESS ? 1 : 0; |
0 | 665 |
} |
666 |
||
667 |
# perform an ldap search |
|
668 |
# return an hashref containing return code and |
|
669 |
# arrayref of Net::LDAP::Entry objects |
|
670 |
# |
|
671 |
sub search |
|
672 |
{ |
|
673 |
my $self = shift; |
|
674 |
my $opts = shift || {}; |
|
675 |
||
676 |
$opts->{'base'} ||= $self->base(), |
|
677 |
$opts->{'filter'} ||= '(objectClass=*)'; |
|
678 |
$opts->{'scope'} ||= 'base'; |
|
679 |
||
680 |
my $s = $self->ldap->search( |
|
681 |
base => $opts->{'base'}, |
|
682 |
filter => $opts->{'filter'}, |
|
683 |
scope => $opts->{'scope'}, |
|
684 |
timelimit => $conf->{'timeout'}, |
|
685 |
typesonly => ! $opts->{'vals'}, |
|
686 |
attrs => $opts->{'attrs'} || ['*'] |
|
687 |
); |
|
688 |
||
689 |
my $rv = { |
|
690 |
code => $s->code(), |
|
691 |
message => $s->error(), |
|
692 |
entries => [] |
|
693 |
}; |
|
694 |
||
695 |
# since search is used just about everywhere, this seems like |
|
696 |
# a pretty good place to check for connection errors. |
|
697 |
# |
|
698 |
# check for a lost connection, kill cached object so we |
|
699 |
# try to reconnect on the next search. |
|
700 |
# |
|
16
a2e3faa3d2fc
use symbolic LDAP error codes instead of numbers
Peter Marschall <peter@adpm.de>
parents:
15
diff
changeset
|
701 |
$self->{'ldap'} = undef if $s->code() == LDAP_SERVER_DOWN; |
0 | 702 |
|
703 |
$rv->{'entries'} = |
|
704 |
$opts->{'scope'} eq 'base' ? [ $s->shift_entry() ] : [ $s->entries() ]; |
|
705 |
||
706 |
return $rv; |
|
707 |
} |
|
708 |
||
709 |
# update the autocomplete for entries |
|
710 |
# in the current base tree, respecting or creating cache. |
|
711 |
# |
|
712 |
sub update_entries |
|
713 |
{ |
|
714 |
my $self = shift; |
|
715 |
my %opts = @_; |
|
716 |
my $base = lc( $self->base() ); |
|
717 |
||
718 |
my $s = $opts{'search'} || $self->search({ scope => 'one' }); |
|
719 |
||
720 |
$self->{'cwd_entries'} = []; |
|
721 |
return if $s->{'code'}; |
|
722 |
||
723 |
# setup cache object |
|
724 |
$self->{'cache'} ||= {}; |
|
725 |
$self->{'cache'}->{ $base } ||= {}; |
|
726 |
$self->{'cache'}->{ $base } = {} if $opts{'clearcache'}; |
|
727 |
my $cache = $self->{'cache'}->{ $base }; |
|
728 |
||
729 |
my $now = time(); |
|
730 |
if ( ! exists $cache->{'entries'} |
|
731 |
or $now - $cache->{'timestamp'} > $conf->{'cacheage'} ) |
|
732 |
{ |
|
733 |
$self->debug("Caching entries for $base\n"); |
|
734 |
foreach my $e ( @{ $s->{'entries'} } ) { |
|
735 |
my $dn = $e->dn(); |
|
736 |
my $rdn = $dn; |
|
737 |
$rdn =~ s/,$base//i; # remove base from display |
|
738 |
push @{ $self->{'cwd_entries'} }, $rdn; |
|
739 |
} |
|
740 |
$cache->{'timestamp'} = $now; |
|
741 |
$cache->{'entries'} = $self->{'cwd_entries'}; |
|
742 |
} |
|
743 |
else { |
|
744 |
$self->debug("Using cached lookups for $base\n"); |
|
745 |
} |
|
746 |
||
747 |
$self->{'cwd_entries'} = $cache->{'entries'}; |
|
748 |
return; |
|
749 |
} |
|
750 |
||
751 |
# parse parent ('..') cn requests |
|
752 |
# |
|
753 |
sub parent_dn |
|
754 |
{ |
|
755 |
my $self = shift; |
|
756 |
my $rdn = shift or return; |
|
757 |
return unless ref $rdn; |
|
758 |
||
759 |
# FIXME: 'cd ../ou=somewhere' should work |
|
760 |
my $dn = $self->base(); |
|
761 |
my $dotcount = $$rdn =~ s/\.\./\.\./g; |
|
762 |
$dn =~ s/^.*?,// for 1 .. $dotcount; |
|
763 |
||
764 |
$$rdn = $dn; |
|
765 |
} |
|
766 |
||
767 |
# given an array ref of shell-like globs, |
|
768 |
# make and return an LDAP filter object. |
|
769 |
# |
|
770 |
sub make_filter |
|
771 |
{ |
|
772 |
my $self = shift; |
|
773 |
my $globs = shift or return; |
|
774 |
||
775 |
return unless ref $globs eq 'ARRAY'; |
|
776 |
return unless scalar @$globs; |
|
777 |
||
778 |
my $filter; |
|
779 |
$filter = join '', map { "($_)" } @$globs; |
|
780 |
$filter = '(|' . $filter . ')' if scalar @$globs > 1; |
|
781 |
$filter = Net::LDAP::Filter->new( $filter ); |
|
782 |
||
783 |
if ( $filter ) { |
|
784 |
$self->debug('Filter parsed as: ' . $filter->as_string() . "\n"); |
|
785 |
} |
|
786 |
else { |
|
787 |
print "Error parsing filter.\n"; |
|
788 |
return; |
|
789 |
} |
|
790 |
||
791 |
return $filter; |
|
792 |
} |
|
793 |
||
794 |
# little. yellow. different. better. |
|
795 |
# |
|
796 |
sub debug |
|
797 |
{ |
|
798 |
my $self = shift; |
|
799 |
return unless $conf->{'debug'}; |
|
800 |
print "\e[33m"; |
|
801 |
print shift(); |
|
802 |
print "\e[0m"; |
|
803 |
return; |
|
804 |
} |
|
805 |
||
806 |
# setup command autocompletes for |
|
807 |
# all commands that have the same possible values |
|
808 |
# |
|
809 |
sub autocomplete_cwd |
|
810 |
{ |
|
811 |
my $self = shift; |
|
812 |
my $word = $_[0]; |
|
813 |
||
814 |
return sort @{ $self->{'cwd_entries'} }; |
|
815 |
} |
|
816 |
||
817 |
sub comp_setenv |
|
818 |
{ |
|
819 |
my $self = shift; |
|
820 |
return @{ $self->{'env'} }; |
|
821 |
} |
|
822 |
||
823 |
sub comp_create |
|
824 |
{ |
|
825 |
my $self = shift; |
|
826 |
return @{ $self->{'objectclasses'} } if $self->{'objectclasses'}; |
|
827 |
||
828 |
my @oc_data = $self->{'schema'}->all_objectclasses(); |
|
829 |
my @oc; |
|
830 |
foreach my $o ( @oc_data ) { |
|
831 |
push @oc, $o->{'name'}; |
|
832 |
} |
|
833 |
@oc = sort @oc; |
|
834 |
$self->{'objectclasses'} = \@oc; |
|
835 |
||
836 |
return @oc; |
|
837 |
} |
|
838 |
||
839 |
{ |
|
840 |
no warnings; |
|
841 |
no strict 'refs'; |
|
842 |
||
843 |
# command, alias |
|
844 |
my %cmd_map = ( |
|
845 |
whoami => 'id', |
|
846 |
list => 'ls', |
|
847 |
grep => 'search', |
|
848 |
edit => 'vi', |
|
849 |
delete => 'rm', |
|
850 |
copy => 'cp', |
|
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
851 |
cat => 'read', |
0 | 852 |
move => 'mv', |
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
853 |
cd => undef, |
0 | 854 |
passwd => undef |
855 |
); |
|
856 |
||
857 |
# setup autocompletes |
|
858 |
foreach ( %cmd_map ) { |
|
859 |
next unless $_; |
|
860 |
my $sub = "comp_$_"; |
|
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
861 |
*$sub = \&autocomplete_cwd; |
0 | 862 |
} |
863 |
*comp_touch = \&comp_create; |
|
864 |
*comp_export = \&comp_setenv; |
|
865 |
||
866 |
# setup alias subs |
|
867 |
# |
|
868 |
# Term::Shell has an alias_* feature, but |
|
869 |
# it seems to work about 90% of the time. |
|
870 |
# that last 10% is something of a mystery. |
|
871 |
# |
|
872 |
$cmd_map{'create'} = 'touch'; |
|
873 |
foreach my $cmd ( keys %cmd_map ) { |
|
874 |
next unless defined $cmd_map{$cmd}; |
|
875 |
my $alias_sub = 'run_' . $cmd_map{$cmd}; |
|
876 |
my $real_sub = 'run_' . $cmd; |
|
877 |
*$alias_sub = \&$real_sub; |
|
878 |
} |
|
879 |
} |
|
880 |
||
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
881 |
|
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
882 |
# Given an $arrayref, remove LDIF continuation wrapping, |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
883 |
# effectively making each entry a single line. |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
884 |
# |
5
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
885 |
sub unwrap { |
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
886 |
my $array = shift; |
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
887 |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
888 |
my $i = 1; |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
889 |
while ( $i < scalar(@$array) ) { |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
890 |
if ( $array->[$i] =~ /^\s/ ) { |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
891 |
$array->[ $i - 1 ] =~ s/\n$//; |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
892 |
$array->[ $i ] =~ s/^\s//; |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
893 |
splice( @$array, $i - 1, 2, $array->[$i - 1] . $array->[$i] ); |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
894 |
} |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
895 |
else { |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
896 |
$i++; |
5
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
897 |
} |
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
898 |
} |
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
899 |
} |
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
900 |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
901 |
|
0 | 902 |
############################################################### |
903 |
# |
|
904 |
# SHELL METHODS |
|
905 |
# |
|
906 |
############################################################### |
|
907 |
||
908 |
# don't die on a newline |
|
909 |
# |
|
910 |
sub run_ { return; } |
|
911 |
||
912 |
# print shell debug actions |
|
913 |
# |
|
914 |
sub precmd |
|
915 |
{ |
|
916 |
my $self = shift; |
|
917 |
my ( $handler, $cmd, $args ) = @_; |
|
918 |
||
919 |
my $term = $self->term(); |
|
920 |
eval { $term->WriteHistory("$ENV{'HOME'}/.shelldap_history"); }; |
|
921 |
||
922 |
return unless $conf->{'debug'}; |
|
923 |
$self->debug( "$$cmd (" . ( join ' ', @$args ) . "), calling '$$handler'\n" ); |
|
924 |
return; |
|
925 |
} |
|
926 |
||
927 |
sub run_cat |
|
928 |
{ |
|
929 |
my $self = shift; |
|
930 |
my $dn = shift; |
|
931 |
my $attrs = \@_; |
|
932 |
$attrs->[0] = '*' unless scalar @$attrs; |
|
933 |
||
934 |
unless ( $dn ) { |
|
935 |
print "No dn provided.\n"; |
|
936 |
return; |
|
937 |
} |
|
938 |
||
939 |
# support '.' |
|
940 |
$dn = $self->base() if $dn eq '.'; |
|
941 |
||
942 |
# support globbing |
|
943 |
my $s; |
|
944 |
if ( $dn eq '*' ) { |
|
945 |
$s = $self->search({ |
|
946 |
scope => 'one', |
|
947 |
vals => 1, |
|
948 |
attrs => $attrs |
|
949 |
}); |
|
950 |
} |
|
951 |
elsif ( $dn =~ /\*/ ) { |
|
952 |
$s = $self->search({ |
|
953 |
scope => 'one', |
|
954 |
vals => 1, |
|
955 |
filter => $dn, |
|
956 |
attrs => $attrs |
|
957 |
}); |
|
958 |
} |
|
959 |
else { |
|
960 |
$self->rdn_to_dn( \$dn ); |
|
961 |
$s = $self->search({ |
|
962 |
base => $dn, |
|
963 |
vals => 1, |
|
964 |
attrs => $attrs |
|
965 |
}); |
|
966 |
} |
|
967 |
||
968 |
if ( $s->{'code'} ) { |
|
969 |
print $s->{'message'} . "\n"; |
|
970 |
return; |
|
971 |
} |
|
972 |
||
973 |
foreach my $e ( @{ $s->{'entries'} } ) { |
|
974 |
$self->ldif->write_entry( $e ); |
|
975 |
print "\n"; |
|
976 |
} |
|
977 |
return; |
|
978 |
} |
|
979 |
||
980 |
sub run_cd |
|
981 |
{ |
|
982 |
my $self = shift; |
|
983 |
my $newbase = join ' ', @_; |
|
984 |
||
985 |
# support 'cd' going to root |
|
986 |
$newbase ||= $conf->{'basedn'}; |
|
987 |
||
988 |
# support 'cd -' |
|
989 |
if ( $newbase eq '-' ) { |
|
990 |
$newbase = $self->{'previous_base'} || return; |
|
991 |
} |
|
992 |
||
993 |
# support '..' |
|
994 |
if ( $newbase =~ /\.\./ ) { |
|
995 |
$self->parent_dn( \$newbase ); |
|
996 |
} |
|
997 |
else { |
|
998 |
$self->rdn_to_dn( \$newbase ); |
|
999 |
} |
|
1000 |
||
1001 |
unless ( $self->is_valid_dn( $newbase ) ) { |
|
1002 |
print "No such object\n"; |
|
1003 |
return; |
|
1004 |
} |
|
1005 |
||
1006 |
# store old base |
|
1007 |
$self->{'previous_base'} = $self->base(); |
|
1008 |
||
1009 |
# update new base |
|
1010 |
$self->base( $newbase ); |
|
1011 |
||
1012 |
# get new 'cwd' listing |
|
8
38aaae38427a
Improve performance for cd/ls for containers with a large number of
Mahlon E. Smith <mahlon@laika.com>
parents:
6
diff
changeset
|
1013 |
my $s = $self->search({ scope => 'one', attrs => ['dn'] }); |
0 | 1014 |
if ( $s->{'code'} ) { |
1015 |
print "$s->{'message'}\n"; |
|
1016 |
return; |
|
1017 |
} |
|
1018 |
$self->update_entries( search => $s ); |
|
1019 |
||
1020 |
# reflect cwd change in prompt |
|
1021 |
$self->update_prompt(); |
|
1022 |
return; |
|
1023 |
} |
|
1024 |
||
1025 |
sub run_clear |
|
1026 |
{ |
|
1027 |
my $self = shift; |
|
1028 |
system('clear'); |
|
1029 |
return; |
|
1030 |
} |
|
1031 |
||
1032 |
sub run_copy |
|
1033 |
{ |
|
1034 |
my $self = shift; |
|
1035 |
my ( $s_dn, $d_dn ) = @_; |
|
1036 |
||
1037 |
unless ( $s_dn ) { |
|
1038 |
print "No source dn provided.\n"; |
|
1039 |
return; |
|
1040 |
} |
|
1041 |
unless ( $d_dn ) { |
|
1042 |
print "No destination dn provided.\n"; |
|
1043 |
return; |
|
1044 |
} |
|
1045 |
||
1046 |
my $s_rdn = $s_dn; |
|
1047 |
$self->rdn_to_dn( \$s_dn ); |
|
1048 |
my $s = $self->search({ base => $s_dn, vals => 1 }); |
|
16
a2e3faa3d2fc
use symbolic LDAP error codes instead of numbers
Peter Marschall <peter@adpm.de>
parents:
15
diff
changeset
|
1049 |
unless ( $s->{'code'} == LDAP_SUCCESS ) { |
0 | 1050 |
print "No such object\n"; |
1051 |
return; |
|
1052 |
} |
|
1053 |
||
1054 |
# see if we're copying the entry to a totally new path |
|
1055 |
my ( $new_dn, $old_dn ); |
|
1056 |
( $d_dn, $new_dn ) = ( $1, $2 ) if $d_dn =~ /^([\w=]+),(.*)$/; |
|
1057 |
if ( $new_dn ) { |
|
1058 |
unless ( $self->is_valid_dn( $new_dn ) ) { |
|
1059 |
print "Invalid destination.\n"; |
|
1060 |
return; |
|
1061 |
} |
|
1062 |
} |
|
1063 |
else { |
|
1064 |
$new_dn = $self->base(); |
|
1065 |
} |
|
1066 |
$old_dn = $1 if $s_dn =~ /^[\w=]+,(.*)$/; |
|
1067 |
||
1068 |
# get the source object |
|
1069 |
my $e = ${ $s->{'entries'} }[0]; |
|
1070 |
$e->dn( $s_dn ); |
|
1071 |
||
1072 |
# add changes in new entry instead of modifying existing |
|
1073 |
$e->changetype('add'); |
|
1074 |
$e->dn( "$d_dn,$new_dn" ); |
|
1075 |
||
1076 |
# get the unique attribute from the dn for modification |
|
1077 |
# perhaps there is a better way to do this...? |
|
1078 |
# |
|
1079 |
my ( $uniqkey, $uniqval ) = ( $1, $2 ) |
|
14
b8fae8fb7942
Allow '-' on RDN name when copying
Giacomo Tenaglia <Giacomo.Tenaglia@cern.ch>
parents:
12
diff
changeset
|
1080 |
if $d_dn =~ /^([\.\w\-]+)(?:\s+)?=(?:\s+)?([\.\-\s\w]+),?/; |
0 | 1081 |
unless ( $uniqkey && $uniqval ) { |
1082 |
print "Unable to parse unique values from rdn.\n"; |
|
1083 |
return; |
|
1084 |
} |
|
1085 |
$e->replace( $uniqkey => $uniqval ); |
|
1086 |
||
1087 |
# update |
|
1088 |
my $rv = $e->update( $self->ldap() ); |
|
1089 |
print $rv->error , "\n"; |
|
1090 |
||
1091 |
# clear caches |
|
1092 |
$self->{'cache'}->{ $new_dn } = {} if $new_dn; |
|
1093 |
$self->{'cache'}->{ $old_dn } = {} if $old_dn; |
|
1094 |
$self->update_entries( clearcache => 1 ); |
|
1095 |
return; |
|
1096 |
} |
|
1097 |
||
1098 |
sub run_create |
|
1099 |
{ |
|
1100 |
my $self = shift; |
|
1101 |
my @ocs = @_; |
|
1102 |
||
1103 |
my ( $fh, $fname ) = |
|
1104 |
File::Temp::tempfile( 'shelldap_XXXXXXXX', DIR => '/tmp', UNLINK => 1 ); |
|
1105 |
||
1106 |
# first print out the dn and object classes. |
|
1107 |
print $fh 'dn: ???,', $self->base(), "\n"; |
|
1108 |
foreach my $oc ( sort @ocs ) { |
|
1109 |
print $fh "objectClass: $oc\n"; |
|
1110 |
} |
|
1111 |
||
1112 |
# now gather attributes for requested objectClasses |
|
1113 |
# |
|
1114 |
my ( %seen, @must_attr, @may_attr ); |
|
1115 |
foreach my $oc ( sort @ocs ) { |
|
1116 |
||
1117 |
# required |
|
1118 |
my @must = $self->{'schema'}->must( $oc ); |
|
1119 |
foreach my $attr ( sort { $a->{'name'} cmp $b->{'name'} } @must ) { |
|
1120 |
next if $attr->{'name'} =~ /^objectclass$/i; |
|
1121 |
next if $seen{ $attr->{'name'} }; |
|
1122 |
push @must_attr, $attr->{'name'}; |
|
1123 |
$seen{ $attr->{'name'} }++; |
|
1124 |
} |
|
1125 |
||
1126 |
# optional |
|
1127 |
my @may = $self->{'schema'}->may( $oc ); |
|
1128 |
foreach my $attr ( sort { $a->{'name'} cmp $b->{'name'} } @may ) { |
|
1129 |
next if $attr->{'name'} =~ /^objectclass$/i; |
|
1130 |
next if $seen{ $attr->{'name'} }; |
|
1131 |
push @may_attr, $attr->{'name'}; |
|
1132 |
$seen{ $attr->{'name'} }++; |
|
1133 |
} |
|
1134 |
} |
|
1135 |
||
1136 |
# print attributes |
|
1137 |
print $fh "$_: \n" foreach @must_attr; |
|
1138 |
print $fh "# $_: \n" foreach @may_attr; |
|
1139 |
close $fh; |
|
1140 |
my $hash_a = $self->chksum( $fname ); |
|
1141 |
system( $self->{'editor'}, $fname ) && die "Unable to launch editor: $!\n"; |
|
1142 |
||
1143 |
# hash compare |
|
1144 |
my $hash_b = $self->chksum( $fname ); |
|
1145 |
if ( $hash_a eq $hash_b ) { |
|
1146 |
print "Entry not modified.\n"; |
|
1147 |
unlink $fname; |
|
1148 |
return; |
|
1149 |
} |
|
1150 |
||
1151 |
# load in LDIF |
|
1152 |
my $ldif = Net::LDAP::LDIF->new( $fname, 'r', onerror => 'warn' ); |
|
1153 |
my $e = $ldif->read_entry(); |
|
1154 |
unless ( $e ) { |
|
1155 |
print "Unable to parse LDIF.\n"; |
|
1156 |
unlink $fname; |
|
1157 |
return; |
|
1158 |
} |
|
1159 |
$e->changetype('add'); |
|
1160 |
my $rv = $e->update( $self->ldap() ); |
|
1161 |
print $rv->error(), "\n"; |
|
1162 |
||
1163 |
$self->update_entries( clearcache => 1 ) unless $rv->code(); |
|
1164 |
||
1165 |
unlink $fname; |
|
1166 |
return; |
|
1167 |
} |
|
1168 |
||
1169 |
sub run_delete |
|
1170 |
{ |
|
1171 |
my $self = shift; |
|
1172 |
my @DNs = @_; |
|
1173 |
||
1174 |
unless ( scalar @DNs ) { |
|
1175 |
print "No dn specified.\n"; |
|
1176 |
return; |
|
1177 |
} |
|
1178 |
||
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1179 |
my $filter; |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1180 |
unless ( $DNs[0] eq '*' ) { |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1181 |
$filter = $self->make_filter( \@DNs ) or return; |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1182 |
} |
0 | 1183 |
|
1184 |
my $s = $self->search({ scope => 'one', filter => $filter }); |
|
1185 |
if ( $s->{'code'} ) { |
|
1186 |
print "$s->{'message'}\n"; |
|
1187 |
return; |
|
1188 |
} |
|
1189 |
||
1190 |
print "Are you sure? [N/y]: "; |
|
1191 |
chomp( my $resp = <STDIN> ); |
|
1192 |
return unless $resp =~ /^y/i; |
|
1193 |
||
1194 |
foreach my $e ( @{ $s->{'entries'} } ) { |
|
1195 |
my $dn = $e->dn(); |
|
1196 |
my $rv = $self->ldap->delete( $dn ); |
|
1197 |
print "$dn: ", $rv->error(), "\n"; |
|
1198 |
} |
|
1199 |
||
1200 |
$self->update_entries( clearcache => 1 ); |
|
1201 |
return; |
|
1202 |
} |
|
1203 |
||
1204 |
sub run_edit |
|
1205 |
{ |
|
1206 |
my $self = shift; |
|
1207 |
my $dn = join ' ', @_; |
|
1208 |
||
1209 |
unless ( $dn ) { |
|
1210 |
print "No dn provided.\n"; |
|
1211 |
return; |
|
1212 |
} |
|
1213 |
||
1214 |
# support '.' |
|
1215 |
$dn = $self->base() if $dn eq '.'; |
|
1216 |
||
1217 |
$self->rdn_to_dn( \$dn ); |
|
1218 |
my $s = $self->search({ base => $dn, vals => 1 }); |
|
1219 |
||
1220 |
if ( $s->{'code'} ) { |
|
1221 |
print $s->{'message'} . "\n"; |
|
1222 |
return; |
|
1223 |
} |
|
1224 |
||
1225 |
# fetch entry and write it out to disk |
|
1226 |
my $e = ${ $s->{'entries'} }[0]; |
|
1227 |
my $ldif = $self->ldif(1); |
|
1228 |
$ldif->write_entry( $e ); |
|
1229 |
$ldif->done(); # force sync |
|
1230 |
||
1231 |
# load it into an array for potential comparison |
|
1232 |
open LDIF, "$self->{'ldif_fname'}" or return; |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1233 |
my @orig_ldif = <LDIF>; |
0 | 1234 |
close LDIF; |
1235 |
||
1236 |
# checksum it, then open it in an editor |
|
1237 |
my $hash_a = $self->chksum( $self->{'ldif_fname'} ); |
|
1238 |
system( "$self->{'editor'} $self->{'ldif_fname'}" ) && |
|
1239 |
die "Unable to launch editor: $!\n"; |
|
1240 |
||
1241 |
# detect a total lack of change |
|
1242 |
my $hash_b = $self->chksum( $self->{'ldif_fname'} ); |
|
1243 |
if ( $hash_a eq $hash_b ) { |
|
1244 |
print "Entry not modified.\n"; |
|
1245 |
unlink $self->{'ldif_fname'}; |
|
1246 |
return; |
|
1247 |
} |
|
1248 |
||
1249 |
# check changes for basic LDIF validity |
|
1250 |
my $new_e = $self->load_ldif( $self->{'ldif_fname'} ); |
|
1251 |
unless ( $new_e ) { |
|
1252 |
print "Unable to parse LDIF.\n"; |
|
1253 |
unlink $self->{'ldif_fname'}; |
|
1254 |
return; |
|
1255 |
} |
|
1256 |
||
1257 |
# load changes into a new array for comparison |
|
1258 |
open LDIF, "$self->{'ldif_fname'}" or return; |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1259 |
my @new_ldif = <LDIF>; |
0 | 1260 |
close LDIF; |
1261 |
||
1262 |
$e->changetype('modify'); |
|
1263 |
||
1264 |
my $parse = sub { |
|
1265 |
my $line = shift || $_; |
|
1266 |
return if $line =~ /^\#/; # ignore comments |
|
1267 |
my ( $attr, $val ) = ( $1, $2 ) if $line =~ /^(.+?): (.*)$/; |
|
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1268 |
return unless $attr; |
0 | 1269 |
return if index($attr, ':') != -1; # ignore base64 |
1270 |
return ( $attr, $val ); |
|
1271 |
}; |
|
1272 |
||
6
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1273 |
unwrap( \@orig_ldif ); |
46dfe9d6f368
Update documentation, now that multiline edits work. Minor other
Mahlon E. Smith <mahlon@laika.com>
parents:
5
diff
changeset
|
1274 |
unwrap( \@new_ldif ); |
5
78b2a48e07db
Combine multiple lines into a single one before displaying LDIF. Patch
Mahlon E. Smith <mahlon@laika.com>
parents:
4
diff
changeset
|
1275 |
|
0 | 1276 |
my $diff = Algorithm::Diff->new( \@orig_ldif, \@new_ldif ); |
1277 |
HUNK: |
|
1278 |
while ( $diff->Next() ) { |
|
1279 |
next if $diff->Same(); |
|
1280 |
my $diff_bit = $diff->Diff(); |
|
1281 |
my %seen_attr; |
|
1282 |
||
1283 |
# total deletions |
|
1284 |
if ( $diff_bit == 1 ) { |
|
1285 |
foreach ( $diff->Items(1) ) { |
|
1286 |
$self->debug("DELETE: $_"); |
|
1287 |
my ( $attr, $val ) = $parse->( $_ ) or next; |
|
1288 |
$e->delete( $attr => [ $val ] ); |
|
1289 |
} |
|
1290 |
} |
|
1291 |
||
1292 |
# new insertions |
|
1293 |
if ( $diff_bit == 2 ) { |
|
1294 |
foreach ( $diff->Items(2) ) { |
|
1295 |
$self->debug("INSERT: $_"); |
|
1296 |
my ( $attr, $val ) = $parse->( $_ ) or next; |
|
1297 |
$e->add( $attr => $val ); |
|
1298 |
} |
|
1299 |
} |
|
1300 |
||
1301 |
# replacements |
|
1302 |
if ( $diff_bit == 3 ) { |
|
1303 |
foreach ( $diff->Items(2) ) { |
|
1304 |
$self->debug("MODIFY: $_"); |
|
1305 |
my ( $attr, $val ) = $parse->( $_ ) or next; |
|
1306 |
||
1307 |
my $cur_vals = $e->get_value( $attr, asref => 1 ) || []; |
|
1308 |
my $cur_valcount = scalar @$cur_vals; |
|
1309 |
next if $cur_valcount == 0; # should have been an 'add' |
|
1310 |
||
1311 |
# replace immediately |
|
1312 |
# |
|
1313 |
if ( $cur_valcount == 1 ) { |
|
1314 |
$e->replace( $attr => $val ); |
|
1315 |
} |
|
1316 |
else { |
|
1317 |
||
1318 |
# make sure the replace doesn't squash |
|
1319 |
# other attributes listed with the same name |
|
1320 |
# |
|
1321 |
next if $seen_attr{ $attr }; |
|
1322 |
my @new_vals; |
|
1323 |
foreach my $line ( @new_ldif ) { |
|
1324 |
my ( $new_attr, $new_val ) = $parse->( $line ) or next; |
|
1325 |
next unless $new_attr eq $attr; |
|
1326 |
$seen_attr{ $attr }++; |
|
1327 |
push @new_vals, $new_val; |
|
1328 |
} |
|
1329 |
$e->replace( $attr => \@new_vals ); |
|
1330 |
} |
|
1331 |
} |
|
1332 |
} |
|
1333 |
||
1334 |
} |
|
1335 |
||
1336 |
unlink $self->{'ldif_fname'}; |
|
1337 |
my $rv = $e->update( $self->ldap ); |
|
1338 |
print $rv->error(), "\n"; |
|
1339 |
||
1340 |
return; |
|
1341 |
} |
|
1342 |
||
1343 |
sub run_env |
|
1344 |
{ |
|
1345 |
my $self = shift; |
|
1346 |
||
1347 |
foreach ( sort @{ $self->{'env'} } ) { |
|
1348 |
print "$_: "; |
|
1349 |
print $conf->{$_} ? $conf->{$_} : 0; |
|
1350 |
print "\n" |
|
1351 |
} |
|
1352 |
} |
|
1353 |
||
1354 |
sub run_grep |
|
1355 |
{ |
|
1356 |
my $self = shift; |
|
1357 |
my ( $recurse, $filter, $base ) = @_; |
|
1358 |
||
1359 |
# set 'recursion' |
|
1360 |
unless ( $recurse && $recurse =~ /\-r|recurse/ ) { |
|
1361 |
# shift args to the left |
|
1362 |
( $recurse, $filter, $base ) = ( undef, $recurse, $filter ); |
|
1363 |
} |
|
1364 |
||
1365 |
$filter = Net::LDAP::Filter->new( $filter ); |
|
1366 |
unless ( $filter ) { |
|
1367 |
print "Invalid search filter.\n"; |
|
1368 |
return; |
|
1369 |
} |
|
1370 |
||
1371 |
# support '*' |
|
1372 |
$base = $self->base() if ! $base or $base eq '*'; |
|
1373 |
||
1374 |
unless ( $base ) { |
|
1375 |
print "No search base specified.\n"; |
|
1376 |
return; |
|
1377 |
} |
|
1378 |
$self->rdn_to_dn( \$base ); |
|
1379 |
||
1380 |
$self->debug("Filter parsed as: " . $filter->as_string() . "\n"); |
|
1381 |
||
1382 |
my $s = $self->search( |
|
1383 |
{ |
|
1384 |
scope => $recurse ? 'sub' : 'one', |
|
1385 |
base => $base, |
|
1386 |
filter => $filter |
|
1387 |
} |
|
1388 |
); |
|
1389 |
||
1390 |
foreach my $e ( @{ $s->{'entries'} } ) { |
|
1391 |
my $dn = $e->dn(); |
|
1392 |
print "$dn\n"; |
|
1393 |
} |
|
1394 |
||
1395 |
return; |
|
1396 |
} |
|
1397 |
||
1398 |
# override internal help functions |
|
1399 |
# with pod2usage |
|
1400 |
# |
|
1401 |
sub run_help |
|
1402 |
{ |
|
1403 |
return Pod::Usage::pod2usage( |
|
1404 |
-exitval => 'NOEXIT', |
|
1405 |
-verbose => 99, |
|
1406 |
-sections => 'SHELL COMMANDS' |
|
1407 |
); |
|
1408 |
} |
|
1409 |
||
1410 |
sub run_list |
|
1411 |
{ |
|
1412 |
my $self = shift; |
|
1413 |
my @filters = @_; |
|
1414 |
my $base = $self->base(); |
|
8
38aaae38427a
Improve performance for cd/ls for containers with a large number of
Mahlon E. Smith <mahlon@laika.com>
parents:
6
diff
changeset
|
1415 |
my $attrs = [ 'dn', 'hasSubordinates' ]; |
0 | 1416 |
|
1417 |
# setup filters |
|
1418 |
my ( $flags, $filter ); |
|
1419 |
if ( scalar @filters ) { |
|
1420 |
# support '-l' or '-R' listings |
|
1421 |
if ( $filters[0] =~ /\-[lR]|verbose/ ) { |
|
1422 |
$flags = shift @filters; |
|
1423 |
} |
|
1424 |
||
1425 |
$filter = $self->make_filter( \@filters ); |
|
1426 |
} |
|
1427 |
||
1428 |
# flag booleans |
|
1429 |
my ( $recurse, $long ); |
|
1430 |
if ( $flags ) { |
|
1431 |
$recurse = $flags =~ /R/; |
|
9 | 1432 |
$long = $flags =~ /l/; |
1433 |
$attrs = [ '*', 'hasSubordinates' ] if $long; |
|
0 | 1434 |
} |
1435 |
||
4
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1436 |
my $s = $self->search({ |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1437 |
scope => $recurse ? 'sub' : 'one', |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1438 |
vals => 1, |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1439 |
filter => $filter, |
8
38aaae38427a
Improve performance for cd/ls for containers with a large number of
Mahlon E. Smith <mahlon@laika.com>
parents:
6
diff
changeset
|
1440 |
attrs => $attrs |
4
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1441 |
}); |
0 | 1442 |
if ( $s->{'code'} ) { |
1443 |
print "$s->{'message'}\n"; |
|
1444 |
return; |
|
1445 |
} |
|
1446 |
||
1447 |
# if an entry doesn't have a description field, |
|
1448 |
# try and show some nice defaults for ls -l ! |
|
1449 |
# |
|
1450 |
# objectClass -> Attribute to show |
|
1451 |
# |
|
1452 |
my %descs = %{ |
|
1453 |
$conf->{'descmaps'} |
|
1454 |
|| { |
|
1455 |
posixAccount => 'gecos', |
|
1456 |
posixGroup => 'gidNumber', |
|
4
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1457 |
ipHost => 'ipHostNumber', |
0 | 1458 |
} |
1459 |
}; |
|
1460 |
||
1461 |
# iterate and print |
|
1462 |
# |
|
1463 |
my $dn_count = 0; |
|
1464 |
my $dn; |
|
1465 |
foreach my $e ( sort { $a->dn() cmp $b->dn() } @{ $s->{'entries'} } ) { |
|
1466 |
$dn = $e->dn(); |
|
4
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1467 |
|
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1468 |
# if this entry is a container for other entries, append a |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1469 |
# trailing slash. |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1470 |
if ( $e->get_value('hasSubordinates') eq 'TRUE' ) { |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1471 |
$dn .= '/'; |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1472 |
} |
5a65bc849363
Append a trailing slash to entries that contain other entries. Thanks
Mahlon E. Smith <mahlon@martini.nu>
parents:
3
diff
changeset
|
1473 |
|
0 | 1474 |
my $rdn = $dn; |
1475 |
$rdn =~ s/,$base//i; |
|
1476 |
||
1477 |
unless ( $long ) { |
|
1478 |
$dn = $rdn; |
|
1479 |
next; |
|
1480 |
} |
|
1481 |
||
1482 |
# show descriptions |
|
1483 |
my $desc = $e->get_value('description'); |
|
1484 |
if ( $desc ) { |
|
1485 |
$desc =~ s/\n.*//s; # 1st line only |
|
1486 |
$dn .= " ($desc)"; |
|
1487 |
} |
|
1488 |
||
1489 |
# no desc? Try and infer something useful |
|
1490 |
# to display. |
|
1491 |
else { |
|
1492 |
||
1493 |
# pull objectClasses, hash for lookup speed |
|
1494 |
my @oc = @{ $e->get_value( 'objectClass', asref => 1 ) || [] }; |
|
1495 |
my %ochash; |
|
1496 |
map { $ochash{$_} = 1 } @oc; |
|
1497 |
||
1498 |
foreach my $d_listing ( sort keys %descs ) { |
|
1499 |
if ( exists $ochash{ $d_listing } ) { |
|
1500 |
my $str = $e->get_value( $descs{ $d_listing }, asref => 1 ); |
|
1501 |
$dn .= ' (' . (join ', ', @$str) . ')' if $str && scalar @$str; |
|
1502 |
} |
|
1503 |
next; |
|
1504 |
} |
|
1505 |
} |
|
1506 |
} |
|
1507 |
continue { |
|
1508 |
print "$dn\n"; |
|
1509 |
$dn_count++; |
|
1510 |
} |
|
1511 |
||
1512 |
print "\n$dn_count " . |
|
1513 |
( $dn_count == 1 ? 'object.' : 'objects.') . |
|
1514 |
"\n" if $long; |
|
1515 |
return; |
|
1516 |
} |
|
1517 |
||
1518 |
sub run_mkdir |
|
1519 |
{ |
|
1520 |
my $self = shift; |
|
1521 |
my $dir = join ' ', @_; |
|
1522 |
||
1523 |
unless ( $dir ) { |
|
1524 |
print "No 'directory' provided.\n"; |
|
1525 |
return; |
|
1526 |
} |
|
1527 |
||
1528 |
# normalize ou name, then pull uniq val back out. |
|
1529 |
$dir = "ou=$dir" unless $dir =~ /^ou=/i; |
|
1530 |
$self->rdn_to_dn( \$dir ); |
|
1531 |
||
1532 |
my $ou = $1 |
|
1533 |
if $dir =~ /^[\.\w]+(?:\s+)?=(?:\s+)?([\.\-\s\w]+),?/; |
|
1534 |
||
1535 |
# add |
|
1536 |
my $r = $self->ldap()->add( $dir, attr => [ |
|
1537 |
objectClass => [ 'top', 'organizationalUnit' ], |
|
1538 |
ou => $ou, |
|
1539 |
]); |
|
1540 |
||
1541 |
print $r->error(), "\n"; |
|
1542 |
$self->update_entries( clearcache => 1 ); |
|
1543 |
return; |
|
1544 |
} |
|
1545 |
||
1546 |
sub run_move |
|
1547 |
{ |
|
1548 |
my $self = shift; |
|
1549 |
my ( $s_dn, $d_dn ) = @_; |
|
1550 |
||
1551 |
unless ( $s_dn ) { |
|
1552 |
print "No source dn provided.\n"; |
|
1553 |
return; |
|
1554 |
} |
|
1555 |
unless ( $d_dn ) { |
|
1556 |
print "No destination dn provided.\n"; |
|
1557 |
return; |
|
1558 |
} |
|
1559 |
||
1560 |
my $s_rdn = $s_dn; |
|
1561 |
$self->rdn_to_dn( \$s_dn ); |
|
1562 |
unless ( $self->is_valid_dn( $s_dn ) ) { |
|
1563 |
print "No such object\n"; |
|
1564 |
return; |
|
1565 |
} |
|
1566 |
||
1567 |
# see if we're moving the entry to a totally new path |
|
1568 |
my ( $new_dn, $old_dn ); |
|
1569 |
( $d_dn, $new_dn ) = ( $1, $2 ) if $d_dn =~ /^([\w=]+),(.*)$/; |
|
1570 |
$old_dn = $1 if $s_dn =~ /^[\w=]+,(.*)$/; |
|
1571 |
||
1572 |
my $rv = $self->ldap()->moddn( |
|
1573 |
$s_dn, |
|
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
1574 |
newrdn => $d_dn, |
0 | 1575 |
deleteoldrdn => 1, |
1576 |
newsuperior => $new_dn |
|
1577 |
); |
|
1578 |
print $rv->error(), "\n"; |
|
1579 |
||
1580 |
# clear caches |
|
1581 |
$self->{'cache'}->{ $new_dn } = {} if $new_dn; |
|
1582 |
$self->{'cache'}->{ $old_dn } = {} if $old_dn; |
|
1583 |
$self->update_entries( clearcache => 1 ); |
|
1584 |
return; |
|
1585 |
} |
|
1586 |
||
1587 |
sub run_passwd |
|
1588 |
{ |
|
1589 |
my $self = shift; |
|
1590 |
my $dn = shift || $self->base(); |
|
1591 |
||
1592 |
$self->{'root_dse'} ||= $self->ldap->root_dse(); |
|
1593 |
||
1594 |
my $pw_extension = '1.3.6.1.4.1.4203.1.11.1'; |
|
1595 |
unless ( $self->{'root_dse'}->supported_extension( $pw_extension ) ) { |
|
1596 |
print "Sorry, password changes not supported by LDAP server.\n"; |
|
1597 |
return; |
|
1598 |
} |
|
1599 |
||
1600 |
# support '.' |
|
1601 |
$dn = $self->base() if $dn eq '.'; |
|
1602 |
||
1603 |
$self->rdn_to_dn( \$dn ); |
|
1604 |
my $s = $self->search( { base => $dn, scope => 'base' } ); |
|
1605 |
if ( $s->{'code'} ) { |
|
1606 |
print $s->{'message'}, "\n"; |
|
1607 |
return; |
|
1608 |
} |
|
1609 |
my $e = ${ $s->{'entries'} }[0]; |
|
1610 |
||
1611 |
unless ( $e->exists('userPassword') ) { |
|
1612 |
print "No userPassword attribute for $dn\n"; |
|
1613 |
return; |
|
1614 |
} |
|
1615 |
||
1616 |
print "Changing password for $dn\n"; |
|
1617 |
Term::ReadKey::ReadMode 2; |
|
1618 |
print "Enter new password: "; |
|
1619 |
chomp( my $pw = <STDIN> ); |
|
1620 |
print "\nRetype new password: "; |
|
1621 |
chomp( my $pw2 = <STDIN> ); |
|
1622 |
print "\n"; |
|
1623 |
Term::ReadKey::ReadMode 0; |
|
1624 |
||
1625 |
if ( $pw ne $pw2 ) { |
|
1626 |
print "Sorry, passwords do not match.\n"; |
|
1627 |
return; |
|
1628 |
} |
|
1629 |
||
1630 |
my $rv = $self->ldap->set_password( |
|
1631 |
user => $dn, |
|
1632 |
newpasswd => $pw |
|
1633 |
); |
|
1634 |
||
16
a2e3faa3d2fc
use symbolic LDAP error codes instead of numbers
Peter Marschall <peter@adpm.de>
parents:
15
diff
changeset
|
1635 |
if ( $rv->code() == LDAP_SUCCESS ) { |
0 | 1636 |
print "Password updated successfully.\n"; |
1637 |
} else { |
|
1638 |
print "Password error: " . $rv->error() . "\n"; |
|
1639 |
} |
|
1640 |
||
1641 |
return; |
|
1642 |
} |
|
1643 |
||
1644 |
sub run_pwd |
|
1645 |
{ |
|
1646 |
my $self = shift; |
|
1647 |
print $self->base() . "\n"; |
|
1648 |
return; |
|
1649 |
} |
|
1650 |
||
1651 |
sub run_setenv |
|
1652 |
{ |
|
1653 |
my $self = shift; |
|
1654 |
my ( $key, $val ) = @_; |
|
1655 |
||
1656 |
( $key, $val ) = split /=/, $key if $key && ! defined $val; |
|
1657 |
return unless $key && defined $val; |
|
1658 |
$key = lc $key; |
|
1659 |
||
1660 |
$conf->{$key} = $val; |
|
1661 |
return; |
|
1662 |
} |
|
1663 |
||
1664 |
sub run_whoami |
|
1665 |
{ |
|
1666 |
my $self = shift; |
|
1667 |
print $conf->{'binddn'} || 'anonymous bind'; |
|
1668 |
print "\n"; |
|
1669 |
return; |
|
1670 |
} |
|
1671 |
||
1672 |
############################################################### |
|
1673 |
# |
|
1674 |
# MAIN |
|
1675 |
# |
|
1676 |
############################################################### |
|
1677 |
||
1678 |
package main; |
|
1679 |
use strict; |
|
1680 |
use warnings; |
|
1681 |
||
1682 |
$0 = 'shelldap'; |
|
12 | 1683 |
my $VERSION = '0.4'; |
0 | 1684 |
|
1685 |
use Getopt::Long; |
|
1686 |
use YAML::Syck; |
|
1687 |
use Pod::Usage; |
|
1688 |
eval 'use Term::ReadLine::Gnu'; |
|
1689 |
warn qq{Term::ReadLine::Gnu not installed. |
|
1690 |
Continuing, but shelldap is of limited usefulness without it.\n\n} if $@; |
|
1691 |
||
1692 |
# get config - rc file first, command line overrides |
|
1693 |
use vars '$conf'; |
|
1694 |
$conf = load_config() || {}; |
|
1695 |
Getopt::Long::GetOptions( |
|
1696 |
$conf, |
|
1697 |
'server=s', |
|
1698 |
'binddn=s', |
|
1699 |
'basedn=s', |
|
1700 |
'cacheage=i', |
|
1701 |
'timeout=i', |
|
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
1702 |
'tls_cacert=s', |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
1703 |
'tls_cert=s', |
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
1704 |
'tls_key=s', |
0 | 1705 |
'tls', 'debug', |
1706 |
help => sub { |
|
1707 |
Pod::Usage::pod2usage( |
|
1708 |
-verbose => 1, |
|
1709 |
-message => "\n$0 command line flags\n" . '-' x 65 |
|
1710 |
); |
|
1711 |
} |
|
1712 |
); |
|
1713 |
||
1714 |
# defaults |
|
1715 |
$conf->{'confpath'} = "$ENV{'HOME'}/.shelldap.rc"; |
|
1716 |
$conf->{'cacheage'} ||= 300; |
|
1717 |
$conf->{'timeout'} ||= 10; |
|
1718 |
||
1719 |
# create and enter shell loop |
|
1720 |
my $shell = LDAP::Shell->new(); |
|
1721 |
$shell->cmdloop(); |
|
1722 |
||
1723 |
# load YAML config into global conf. |
|
1724 |
# |
|
1725 |
sub load_config |
|
1726 |
{ |
|
1727 |
my ( $d, $data ); |
|
1728 |
||
1729 |
my $confpath; |
|
1730 |
my @confs = ( |
|
1731 |
"$ENV{'HOME'}/.shelldap.rc", |
|
1732 |
'/usr/local/etc/shelldap.conf', |
|
1733 |
'/etc/shelldap.conf', |
|
1734 |
); |
|
1735 |
foreach ( @confs ) { |
|
1736 |
if ( -e $_ ) { |
|
1737 |
$confpath = $_; |
|
1738 |
last; |
|
1739 |
} |
|
1740 |
} |
|
1741 |
$confpath or return undef; |
|
1742 |
||
1743 |
open YAML, $confpath or return undef; |
|
1744 |
do { |
|
1745 |
local $/ = undef; |
|
1746 |
$data = <YAML>; # slurp! |
|
1747 |
}; |
|
1748 |
close YAML; |
|
1749 |
||
1750 |
eval { $conf = YAML::Syck::Load( $data ) }; |
|
3
0f815f3daaf7
Add options to support ssl key verification when connecting with TLS.
Mahlon E. Smith <mahlon@martini.nu>
parents:
1
diff
changeset
|
1751 |
die "Invalid YAML in $confpath\n" if $@; |
0 | 1752 |
|
1753 |
return $conf; |
|
1754 |
} |
|
1755 |
||
1756 |
## EOF |
|
1757 |