X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=make-secnet-sites;h=b4cd9afb80ac404c03b6f3575718cbf0863e3005;hb=2a875782ce3763a292cf8438936a64a953ccbc59;hp=55c66cc91b41b1b4ff3838597d66a279bf1b977f;hpb=b840a97a298d84f35da6972de468fe8bc298a570;p=secnet.git

diff --git a/make-secnet-sites b/make-secnet-sites
index 55c66cc..b4cd9af 100755
--- a/make-secnet-sites
+++ b/make-secnet-sites
@@ -71,6 +71,8 @@ sys.path.insert(1,"/usr/local/share/secnet")
 sys.path.insert(1,"/usr/share/secnet")
 import ipaddrset
 
+from argparseactionnoyes import ActionNoYes
+
 VERSION="0.1.18"
 
 from sys import version_info
@@ -84,11 +86,11 @@ if version_info.major == 2:  # for python2
 max={'rsa_bits':8200,'name':33,'dh_bits':8200}
 
 class Tainted:
-	def __init__(self,s):
+	def __init__(self,s,tline=None,tfile=None):
 		self._s=s
 		self._ok=None
-		self._line=line
-		self._file=file
+		self._line=line if tline is None else tline
+		self._file=file if tfile is None else tfile
 	def __eq__(self,e):
 		return self._s==e
 	def __ne__(self,e):
@@ -103,19 +105,19 @@ class Tainted:
 		assert(self._ok is not True)
 		self._ok=False
 		complain('bad parameter: %s: %s' % (what, why))
-		return self
+		return False
 
 	def _max_ok(self,what,maxlen):
 		if len(self._s) > maxlen:
-			self._bad(what,'too long (max %d)' % maxlen)
-		return self
+			return self._bad(what,'too long (max %d)' % maxlen)
+		return True
 
 	def _re_ok(self,bad,what,maxlen=None):
 		if maxlen is None: maxlen=max[what]
 		self._max_ok(what,maxlen)
-		if self._ok is False: return self
+		if self._ok is False: return False
 		if bad.search(self._s): return self._bad(what,'bad syntax')
-		return self
+		return True
 
 	def _rtnval(self, is_ok, ifgood, ifbad=''):
 		if is_ok:
@@ -136,6 +138,14 @@ class Tainted:
 		# caller promises to throw if syntax was dangeorus
 		return self._rtn(True)
 
+	def output(self):
+		if self._ok is False: return ''
+		if self._ok is True: return self._s
+		print('%s:%d: unchecked/unknown additional data "%s"' %
+		      (self._file,self._line,self._s),
+		      file=sys.stderr)
+		sys.exit(1)
+
 	bad_name=re.compile(r'^[^a-zA-Z]|[^-_0-9a-zA-Z]')
 	# secnet accepts _ at start of names, but we reserve that
 	bad_name_counter=0
@@ -204,21 +214,30 @@ def parse_args():
 	global group
 	global user
 	global of
+	global prefix
+	global key_prefix
 
 	ap = argparse.ArgumentParser(description='process secnet sites files')
 	ap.add_argument('--userv', '-u', action='store_true',
 			help='userv service fragment update mode')
+	ap.add_argument('--conf-key-prefix', action=ActionNoYes,
+			default=True,
+		 help='prefix conf file key names derived from sites data')
 	ap.add_argument('--prefix', '-P', nargs=1,
 			help='set prefix')
 	ap.add_argument('arg',nargs=argparse.REMAINDER)
 	av = ap.parse_args()
 	#print(repr(av), file=sys.stderr)
 	service = 1 if av.userv else 0
+	prefix = '' if av.prefix is None else av.prefix[0]
+	key_prefix = av.conf_key_prefix
 	if service:
 		if len(av.arg)!=4:
 			print("Wrong number of arguments")
 			sys.exit(1)
 		(header, groupfiledir, sitesfile, group) = av.arg
+		group = Tainted(group,0,'command line')
+		# untrusted argument from caller
 		if "USERV_USER" not in os.environ:
 			print("Environment variable USERV_USER not found")
 			sys.exit(1)
@@ -240,7 +259,7 @@ def parse_args():
 			sys.exit(1)
 		(inputfile, outputfile) = (av.arg + [None]*2)[0:2]
 		if outputfile is None: of=sys.stdout
-		else: of=open(sys.argv[2],'w')
+		else: of=open(outputfile,'w')
 
 parse_args()
 
@@ -345,6 +364,7 @@ class rsakey (basetype):
 		self.l=w[1].number(0,max['rsa_bits'],'rsa len')
 		self.e=w[2].bignum_10('rsa','rsa e')
 		self.n=w[3].bignum_10('rsa','rsa n')
+		if len(w) >= 5: w[4].email()
 	def __str__(self):
 		return 'rsa-public("%s","%s")'%(self.e,self.n)
 
@@ -399,17 +419,22 @@ class level:
 	def prop_out(self,n):
 		return self.allow_properties[n](n,str(self.properties[n]))
 	def output_props(self,w,ind):
-		for i in self.properties.keys():
+		for i in sorted(self.properties.keys()):
 			if self.allow_properties[i]:
 				self.indent(w,ind)
 				w.write("%s"%self.prop_out(i))
-	def output_data(self,w,ind,np):
+	def kname(self):
+		return ((self.type[0].upper() if key_prefix else '')
+			+ self.name)
+	def output_data(self,w,path):
+		ind = 2*len(path)
 		self.indent(w,ind)
-		w.write("%s {\n"%(self.name))
+		w.write("%s {\n"%(self.kname()))
 		self.output_props(w,ind+2)
 		if self.depth==1: w.write("\n");
-		for c in self.children.values():
-			c.output_data(w,ind+2,np+self.name+"/")
+		for k in sorted(self.children.keys()):
+			c=self.children[k]
+			c.output_data(w,path+(c,))
 		self.indent(w,ind)
 		w.write("};\n")
 
@@ -424,17 +449,18 @@ class vpnlevel(level):
 	}
 	def __init__(self,w):
 		level.__init__(self,w)
-	def output_vpnflat(self,w,ind,h):
+	def output_vpnflat(self,w,path):
 		"Output flattened list of site names for this VPN"
+		ind=2*(len(path)+1)
 		self.indent(w,ind)
-		w.write("%s {\n"%(self.name))
+		w.write("%s {\n"%(self.kname()))
 		for i in self.children.keys():
-			self.children[i].output_vpnflat(w,ind+2,
-				h+"/"+self.name+"/"+i)
+			self.children[i].output_vpnflat(w,path+(self,))
 		w.write("\n")
 		self.indent(w,ind+2)
 		w.write("all-sites %s;\n"%
-			','.join(self.children.keys()))
+			','.join(map(lambda i: i.kname(),
+				     self.children.values())))
 		self.indent(w,ind)
 		w.write("};\n")
 
@@ -450,13 +476,19 @@ class locationlevel(level):
 	def __init__(self,w):
 		level.__init__(self,w)
 		self.group=w[2].groupname()
-	def output_vpnflat(self,w,ind,h):
+	def output_vpnflat(self,w,path):
+		ind=2*(len(path)+1)
 		self.indent(w,ind)
-		# The "h=h,self=self" abomination below exists because
+		# The "path=path,self=self" abomination below exists because
 		# Python didn't support nested_scopes until version 2.1
-		w.write("%s %s;\n"%(self.name,','.join(
-			map(lambda x,h=h,self=self:
-				h+"/"+x,self.children.keys()))))
+		#
+		#"/"+self.name+"/"+i
+		w.write("%s %s;\n"%(self.kname(),','.join(
+			map(lambda x,path=path,self=self:
+			    '/'.join([prefix+"vpn-data"] + list(map(
+				    lambda i: i.kname(),
+				    path+(self,x)))),
+			    self.children.values()))))
 
 class sitelevel(level):
 	"Site level (i.e. a leafnode) in the configuration hierarchy"
@@ -481,11 +513,13 @@ class sitelevel(level):
 	}
 	def __init__(self,w):
 		level.__init__(self,w)
-	def output_data(self,w,ind,np):
+	def output_data(self,w,path):
+		ind=2*len(path)
+		np='/'.join(map(lambda i: i.name, path))
 		self.indent(w,ind)
-		w.write("%s {\n"%(self.name))
+		w.write("%s {\n"%(self.kname()))
 		self.indent(w,ind+2)
-		w.write("name \"%s\";\n"%(np+self.name))
+		w.write("name \"%s\";\n"%(np,))
 		self.output_props(w,ind+2)
 		self.indent(w,ind+2)
 		w.write("link netlink {\n");
@@ -502,11 +536,6 @@ class sitelevel(level):
 # (depth,properties)
 levels={'vpn':vpnlevel, 'location':locationlevel, 'site':sitelevel}
 
-# Reserved vpn/location/site names
-reserved={'all-sites':None}
-reserved.update(keywords)
-reserved.update(levels)
-
 def complain(msg):
 	"Complain about a particular input line"
 	global complaints
@@ -527,7 +556,6 @@ root=level([UntaintedRoot(x) for x in ['root','root']])
 # All vpns are children of this node
 obstack=[root]
 allow_defs=0   # Level above which new definitions are permitted
-prefix=''
 
 def set_property(obj,w):
 	"Set a property on a configuration node"
@@ -537,15 +565,18 @@ def set_property(obj,w):
 	else:
 		obj.properties[prop.raw()]=keywords[prop.raw_mark_ok()][0](w)
 
-def pline(i,allow_include=False):
+
+def pline(il,allow_include=False):
 	"Process a configuration file line"
 	global allow_defs, obstack, root
-	w=i.rstrip('\n').split()
-	if len(w)==0: return [i]
+	w=il.rstrip('\n').split()
+	if len(w)==0: return ['']
 	w=list([Tainted(x) for x in w])
 	keyword=w[0]
 	current=obstack[len(obstack)-1]
-	copyout=lambda: [i]
+	copyout=lambda: ['    '*len(obstack) +
+			' '.join([ww.output() for ww in w]) +
+	                '\n']
 	if keyword=='end-definitions':
 		keyword.raw_mark_ok()
 		allow_defs=sitelevel.depth
@@ -580,6 +611,7 @@ def pline(i,allow_include=False):
 			if service and group and current.depth==2:
 				if group!=current.group:
 					complain("Incorrect group!")
+				w[2].groupname()
 		else:
 			# New
 			# Ignore depth check for now
@@ -634,19 +666,19 @@ def outputsites(w):
 	# Raw VPN data section of file
 	w.write(prefix+"vpn-data {\n")
 	for i in root.children.values():
-		i.output_data(w,2,"")
+		i.output_data(w,(i,))
 	w.write("};\n")
 
 	# Per-VPN flattened lists
 	w.write(prefix+"vpn {\n")
 	for i in root.children.values():
-		i.output_vpnflat(w,2,prefix+"vpn-data")
+		i.output_vpnflat(w,())
 	w.write("};\n")
 
 	# Flattened list of sites
 	w.write(prefix+"all-sites %s;\n"%",".join(
-		map(lambda x:"%svpn/%s/all-sites"%(prefix,x),
-			root.children.keys())))
+		map(lambda x:"%svpn/%s/all-sites"%(prefix,x.kname()),
+			root.children.values())))
 
 line=0
 file=None
@@ -719,14 +751,15 @@ complaints=None # arranges to crash if we complain later
 if service:
 	# Put the user's input into their group file, and rebuild the main
 	# sites file
-	f=open(groupfiledir+"/T"+group,'w')
+	f=open(groupfiledir+"/T"+group.groupname(),'w')
 	f.write("# Section submitted by user %s, %s\n"%
 		(user,time.asctime(time.localtime(time.time()))))
 	f.write("# Checked by make-secnet-sites version %s\n\n"%VERSION)
 	for i in userinput: f.write(i)
 	f.write("\n")
 	f.close()
-	os.rename(groupfiledir+"/T"+group,groupfiledir+"/R"+group)
+	os.rename(groupfiledir+"/T"+group.groupname(),
+		  groupfiledir+"/R"+group.groupname())
 	f=open(sitesfile+"-tmp",'w')
 	f.write("# sites file autogenerated by make-secnet-sites\n")
 	f.write("# generated %s, invoked by %s\n"%