1 # Create forest updates ldif from Github markdown
3 # Each update is converted to an ldif then gets written to a corresponding
4 # .LDF output file or stored in a dictionary.
6 # Only add updates can generally be applied.
8 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
10 # This program is free software; you can redistribute it and/or modify
11 # it under the terms of the GNU General Public License as published by
12 # the Free Software Foundation; either version 3 of the License, or
13 # (at your option) any later version.
15 # This program is distributed in the hope that it will be useful,
16 # but WITHOUT ANY WARRANTY; without even the implied warranty of
17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 # GNU General Public License for more details.
20 # You should have received a copy of the GNU General Public License
21 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 """Generate LDIF from Github documentation."""
28 import xml.etree.ElementTree as ET
31 # Display specifier updates or otherwise (ignored in forest_update.py)
32 def noop(description, attributes, sd):
33 return (None, None, [], None)
36 # ACE addition updates (ignored in forest_update.py)
37 def parse_grant(description, attributes, sd):
38 return ('modify', None, [], sd if sd.lower() != 'n/a' else None)
41 # Addition of new objects to the directory (most are applied in forest_update.py)
42 def parse_add(description, attributes, sd):
43 dn = extract_dn(description)
44 return ('add', dn, extract_attrib(dn, attributes), sd if sd.lower() != 'n/a' else None)
47 # Set of a particular attribute (ignored in forest_update.py)
48 def parse_set(description, attributes, sd):
49 return ('modify', extract_dn_or_none(description),
50 extract_replace_attrib(attributes),
51 sd if sd.lower() != 'n/a' else None)
54 # Set of a particular ACE (ignored in forest_update.py)
55 # The general issue is that the list of DNs must be generated dynamically
56 def parse_ace(description, attributes, sd):
58 def extract_dn_ace(text):
59 if 'Sam-Domain' in text:
60 return ('${DOMAIN_DN}', 'CN=Sam-Domain,${SCHEMA_DN}')
61 elif 'Domain-DNS' in text:
62 return ('${...}', 'CN=Domain-DNS,${SCHEMA_DN}')
66 return [('modify', extract_dn_ace(description)[0],
67 ['replace: nTSecurityDescriptor',
68 'nTSecurityDescriptor: ${DOMAIN_SCHEMA_SD}%s' % sd], None),
69 ('modify', extract_dn_ace(description)[1],
70 ['replace: defaultSecurityDescriptor',
71 'defaultSecurityDescriptor: ${OLD_SAMBA_SD}%s' % sd], None)]
74 # We are really only interested in 'Created' items
77 'Granting': parse_grant,
83 'Added ACE': parse_ace,
93 Extract a DN from the textual description
95 :return: DN in string form
97 text = text.replace(' in the Schema partition.', ',${SCHEMA_DN}')
98 text = text.replace(' in the Configuration partition.', ',${CONFIG_DN}')
99 dn = re.search('([CDO][NCU]=.*?,)*([CDO][NCU]=.*)', text).group(0)
101 # This should probably be also fixed upstream
102 if dn == 'CN=ad://ext/AuthenticationSilo,CN=Claim Types,CN=Claims Configuration,CN=Services':
103 return 'CN=ad://ext/AuthenticationSilo,CN=Claim Types,CN=Claims Configuration,CN=Services,${CONFIG_DN}'
108 def extract_dn_or_none(text):
110 Same as above, but returns None if it doesn't work
115 return extract_dn(text)
120 def save_ldif(filename, answers, out_folder):
122 Save ldif to disk for each updates
123 :param filename: filename use ([OPERATION NUM]-{GUID}.ldif)
124 :param answers: array of tuples generated with earlier functions
125 :param out_folder: folder to prepend
127 path = os.path.join(out_folder, filename)
128 with open(path, 'w') as ldif:
129 for answer in answers:
130 change, dn, attrib, sd = answer
131 ldif.write('dn: %s\n' % dn)
132 ldif.write('changetype: %s\n' % change)
134 ldif.write('\n'.join(attrib) + '\n')
136 ldif.write('nTSecurityDescriptor: D:%s\n' % sd)
140 def save_array(guid, answers, out_dict):
142 Save ldif to an output dictionary
143 :param guid: GUID to store
144 :param answers: array of tuples generated with earlier functions
145 :param out_dict: output dictionary
148 for answer in answers:
149 change, dn, attrib, sd = answer
150 ldif += 'dn: %s\n' % dn
151 ldif += 'changetype: %s\n' % change
153 ldif += '\n'.join(attrib) + '\n'
155 ldif += 'nTSecurityDescriptor: D:%s\n' % sd
158 out_dict[guid] = ldif
161 def extract_attrib(dn, attributes):
163 Extract the attributes as an array from the attributes column
164 :param dn: parsed from markdown
165 :param attributes: from markdown
166 :return: attribute array (ldif-type format)
168 attrib = [x.lstrip('- ') for x in attributes.split('- ') if x.lower() != 'n/a' and x != '']
169 attrib = [x.replace(': True', ': TRUE') if x.endswith(': True') else x for x in attrib]
170 attrib = [x.replace(': False', ': FALSE') if x.endswith(': False') else x for x in attrib]
171 # We only have one such value, we may as well skip them all consistently
172 attrib = [x for x in attrib if not x.lower().startswith('msds-claimpossiblevalues')]
177 def extract_replace_attrib(attributes):
179 Extract the attributes as an array from the attributes column
181 :param attributes: from markdown
182 :return: attribute array (ldif-type format)
184 lines = [x.lstrip('- ') for x in attributes.split('- ') if x.lower() != 'n/a' and x != '']
185 lines = [('replace: %s' % line.split(':')[0], line) for line in lines]
186 lines = [line for pair in lines for line in pair]
191 return (tag.text or '') + \
192 ''.join(innertext(e) for e in tag) + \
196 def read_ms_markdown(in_file, out_folder=None, out_dict={}):
198 Read Github documentation to produce forest wide udpates
199 :param in_file: Forest-Wide-Updates.md
200 :param out_folder: output folder
201 :param out_dict: output dictionary
204 with open(in_file) as update_file:
205 # There is a hidden ClaimPossibleValues in this md file
206 html = markdown.markdown(re.sub(r'CN=<forest root domain.*?>',
207 '${FOREST_ROOT_DOMAIN}',
209 output_format='xhtml')
211 html = html.replace('CN=Schema,%ws', '${SCHEMA_DN}')
213 tree = ET.fromstring('<root>' + html + '</root>')
216 if node.text and node.text.startswith('|Operation'):
217 # Strip first and last |
218 updates = [x[1:len(x)-1].split('|') for x in
219 ET.tostring(node,method='text').splitlines()]
220 for update in updates[2:]:
221 output = re.match('Operation (\d+): {(.*)}', update[0])
223 # print output.group(1), output.group(2)
224 guid = output.group(2)
225 filename = "%s-{%s}.ldif" % (output.group(1).zfill(4), guid)
229 if update[3].startswith('Created') or update[1].startswith('Added ACE'):
230 # Trigger the security descriptor code
231 # Reduce info to just the security descriptor
232 update[3] = update[3].split(':')[-1]
234 result = parse_ace(update[1], update[2], update[3])
236 if filename and out_folder is not None:
237 save_ldif(filename, result, out_folder)
239 save_array(guid, result, out_dict)
243 for operation in operation_map:
244 if update[1].startswith(operation):
247 result = operation_map[operation](update[1], update[2], update[3])
249 if filename and out_folder is not None:
250 save_ldif(filename, [result], out_folder)
252 save_array(guid, [result], out_dict)
257 raise Exception(update)
259 # print ET.tostring(node, method='text')
261 if __name__ == '__main__':
266 if len(sys.argv) == 0:
267 print >>sys.stderr, "Usage: %s <Forest-Wide-Updates.md> [<output folder>]" % (sys.argv[0])
270 in_file = sys.argv[1]
271 if len(sys.argv) > 2:
272 out_folder = sys.argv[2]
274 read_ms_markdown(in_file, out_folder)