gentoo resync : 06.12.2017

2 files changed, 0 insertions, 364 deletions

diff --git a/sys-auth/docker_auth/Manifest b/sys-auth/docker_auth/Manifest
index 3cbcd2eade14..3e16aa31d9b4 100644
--- a/sys-auth/docker_auth/Manifest
+++ b/sys-auth/docker_auth/Manifest
@@ -1,6 +1,5 @@
 AUX docker_auth-ldap-cacert.patch 2806 BLAKE2B 3af756a2c0cd1dd41e0f17550885f0fd03520dbf8c0ae0b8e7747bd8b66f653c88c7aae366170528ff2345c0cfa4b42640882e5fecf1955f118b0bb2be91d7e8 SHA512 ae86f8d2adae073fae30753c054627a737ddbd05dd94107a65abe2935043a14a9eaf5987a83f06a5b7f827862a8df3510554f34f34693d5e97d77008d7da3b97
 AUX docker_auth-ldap-group-support-1.patch 13612 BLAKE2B 0f61d633858ca42b0f460b912f8b014fda1008359ab9ec4b7e097e4db119fec6c7676b1378413c3d4b5b03d08dacf29c05df32deb9c294eac6b5cdb63d327f7f SHA512 3479435540fd371ef2b294261e2d7196f4ee92e5621178e25c8ee240c066c49a2a846abae860b3baba5bac4e8787e0795b33a7bd1fb6689aa9961acdbd728a16
-AUX docker_auth-ldap-group-support.patch 12531 BLAKE2B 50e58a0d03e0701dc4fe580e862457b6a7b1622d4f84625d8034f4d41e5f3a2e0f2e1ac0142acb408a77dbce8384f67d873feb94120f0f203ffa3b5cf5ff047b SHA512 d6a8b77879ba27ca9adb7e9e3ae4adae87c2e08353df37c9638a1103104ff901c8051453df1474e42afe9f12907a40baf67c76e8d57f359fadfe3cbb3a0a6fda
 AUX docker_auth.confd 71 BLAKE2B 63190ce49fe26406107db51be1d0b87a0e3686287733ce2061e76fa14ed0811d0648049adaf448fbe8e4721cbe9eaf284c9d1f38c9c0aa7291cc78eaca1fd6db SHA512 b089b5ea299b701c3e0ed682e59e87e3f1fe1af4f097f21be80ed2e33c8dd021b9dca0c4310ab453518310306af3c7f2c084a4d17db1504cf1f392dcc993d337
 AUX docker_auth.initd 596 BLAKE2B 42722f51138e8d32d991b37436dddfafa0e6e460fea6ee9e3be080e6373330366ddce1ce992046569929ee660f5c1cc4c43e0baaf57d4cb82257e6e743cc656b SHA512 11dd3d6c3a947571a719b3fcb76a4fe75af4ee1d1b8957f4b0b3b7ee14cefec7acca9fb52e438b185651c38519e820ab0016d439405652f419399c823e74579c
 AUX docker_auth.logrotated 109 BLAKE2B 0ba5c48e905ee8d8987058ca68f817d4a1f3f53e5dff25cf6aa5074e587101fe02664f5b72da60400f7159699b9692ed085b924aa353f402504d3ffab27251d8 SHA512 b2b93aa327b4023481b9524649fe2be4b1ccf97f88b76969b8ab23b9a852627db92426fd0286a875c06555f51c0a61e50b789646acffdbd7916b7be3580d8751
diff --git a/sys-auth/docker_auth/files/docker_auth-ldap-group-support.patch b/sys-auth/docker_auth/files/docker_auth-ldap-group-support.patch
deleted file mode 100644
index 69858872f496..000000000000
--- a/sys-auth/docker_auth/files/docker_auth-ldap-group-support.patch
+++ /dev/null
@@ -1,363 +0,0 @@
-From 4a33badac6b74617dfe3797a716a6907cf018b27 Mon Sep 17 00:00:00 2001
-From: Kevin <kcd83@users.noreply.github.com>
-Date: Mon, 27 Feb 2017 19:09:52 +1300
-Subject: [PATCH 1/3] Initial proof of concept mapping memberOf CN to the label
- groups #63
-
----
- auth_server/authn/ldap_auth.go | 73 ++++++++++++++++++++++++++++++++++--------
- 1 file changed, 60 insertions(+), 13 deletions(-)
-
-diff --git a/auth_server/authn/ldap_auth.go b/auth_server/authn/ldap_auth.go
-index f8fc08f..42f5ad0 100644
---- a/auth_server/authn/ldap_auth.go
-+++ b/auth_server/authn/ldap_auth.go
-@@ -17,7 +17,6 @@
- package authn
- 
- import (
--	"bytes"
- 	"crypto/tls"
- 	"fmt"
- 	"io/ioutil"
-@@ -71,10 +70,20 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
- 	account = la.escapeAccountInput(account)
- 
- 	filter := la.getFilter(account)
--	accountEntryDN, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &[]string{})
-+
-+	// dnAndGroupAttr := []string{"DN"} // example of no groups mapping attribute
-+	groupAttribute := "memberOf"
-+	dnAndGroupAttr := []string{"DN", groupAttribute}
-+
-+	entryAttrMap, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &dnAndGroupAttr)
- 	if uSearchErr != nil {
- 		return false, nil, uSearchErr
- 	}
-+	if len(entryAttrMap) < 1 || entryAttrMap["DN"] == nil || len(entryAttrMap["DN"]) != 1 {
-+		return false, nil, NoMatch // User does not exist
-+	}
-+
-+	accountEntryDN := entryAttrMap["DN"][0]
- 	if accountEntryDN == "" {
- 		return false, nil, NoMatch // User does not exist
- 	}
-@@ -93,6 +102,20 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
- 		return false, nil, bindErr
- 	}
- 
-+	// Extract group names from the attribute values
-+	if entryAttrMap[groupAttribute] != nil {
-+		rawGroups := entryAttrMap[groupAttribute]
-+		labels := make(map[string][]string)
-+		var groups []string
-+		for _, value := range rawGroups {
-+			cn := la.getCNFromDN(value)
-+			groups = append(groups, cn)
-+		}
-+		labels["groups"] = groups
-+
-+		return true, labels, nil
-+	}
-+
- 	return true, nil, nil
- }
- 
-@@ -170,9 +193,9 @@ func (la *LDAPAuth) getFilter(account string) string {
- 
- //ldap search and return required attributes' value from searched entries
- //default return entry's DN value if you leave attrs array empty
--func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (string, error) {
-+func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (map[string][]string, error) {
- 	if l == nil {
--		return "", fmt.Errorf("No ldap connection!")
-+		return nil, fmt.Errorf("No ldap connection!")
- 	}
- 	glog.V(2).Infof("Searching...basedDN:%s, filter:%s", *baseDN, *filter)
- 	searchRequest := ldap.NewSearchRequest(
-@@ -183,30 +206,54 @@ func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, att
- 		nil)
- 	sr, err := l.Search(searchRequest)
- 	if err != nil {
--		return "", err
-+		return nil, err
- 	}
- 
- 	if len(sr.Entries) == 0 {
--		return "", nil // User does not exist
-+		return nil, nil // User does not exist
- 	} else if len(sr.Entries) > 1 {
--		return "", fmt.Errorf("Too many entries returned.")
-+		return nil, fmt.Errorf("Too many entries returned.")
- 	}
- 
--	var buffer bytes.Buffer
-+	result := make(map[string][]string)
- 	for _, entry := range sr.Entries {
-+
- 		if len(*attrs) == 0 {
- 			glog.V(2).Infof("Entry DN = %s", entry.DN)
--			buffer.WriteString(entry.DN)
-+			result["DN"] = []string{entry.DN}
- 		} else {
- 			for _, attr := range *attrs {
--				values := strings.Join(entry.GetAttributeValues(attr), " ")
--				glog.V(2).Infof("Entry %s = %s", attr, values)
--				buffer.WriteString(values)
-+				var values []string
-+				if attr == "DN" {
-+					// DN is excluded from attributes
-+					values = []string{entry.DN}
-+				} else {
-+					values = entry.GetAttributeValues(attr)
-+				}
-+				valuesString := strings.Join(values, "\n")
-+				glog.V(2).Infof("Entry %s = %s", attr, valuesString)
-+				result[attr] = values
-+			}
-+		}
-+	}
-+
-+	return result, nil
-+}
-+
-+func (la *LDAPAuth) getCNFromDN(dn string) string {
-+	parsedDN, err := ldap.ParseDN(dn)
-+	if err != nil || len(parsedDN.RDNs) > 0 {
-+		for _, rdn := range parsedDN.RDNs {
-+			for _, rdnAttr := range rdn.Attributes {
-+				if rdnAttr.Type == "CN" {
-+					return rdnAttr.Value
-+				}
- 			}
- 		}
- 	}
- 
--	return buffer.String(), nil
-+	// else try using raw DN
-+	return dn
- }
- 
- func (la *LDAPAuth) Stop() {
-
-From ddde2fa779e746d7e74cd972a4c6795c72f17ee6 Mon Sep 17 00:00:00 2001
-From: Kevin <kcd83@users.noreply.github.com>
-Date: Tue, 28 Feb 2017 18:09:55 +1300
-Subject: [PATCH 2/3] Apply attribute mapping from configuration
-
----
- auth_server/authn/ldap_auth.go | 125 ++++++++++++++++++++++++-----------------
- 1 file changed, 74 insertions(+), 51 deletions(-)
-
-diff --git a/auth_server/authn/ldap_auth.go b/auth_server/authn/ldap_auth.go
-index 42f5ad0..6f733a2 100644
---- a/auth_server/authn/ldap_auth.go
-+++ b/auth_server/authn/ldap_auth.go
-@@ -26,16 +26,22 @@ import (
- 	"github.com/golang/glog"
- )
- 
-+type LabelMap struct {
-+	Attribute string `yaml:"attribute,omitempty"`
-+	ParseCN   bool   `yaml:"parse_cn,omitempty"`
-+}
-+
- type LDAPAuthConfig struct {
--	Addr                  string `yaml:"addr,omitempty"`
--	TLS                   string `yaml:"tls,omitempty"`
--	InsecureTLSSkipVerify bool   `yaml:"insecure_tls_skip_verify,omitempty"`
--	Base                  string `yaml:"base,omitempty"`
--	Filter                string `yaml:"filter,omitempty"`
--	BindDN                string `yaml:"bind_dn,omitempty"`
--	BindPasswordFile      string `yaml:"bind_password_file,omitempty"`
--	GroupBaseDN           string `yaml:"group_base_dn,omitempty"`
--	GroupFilter           string `yaml:"group_filter,omitempty"`
-+	Addr                  string              `yaml:"addr,omitempty"`
-+	TLS                   string              `yaml:"tls,omitempty"`
-+	InsecureTLSSkipVerify bool                `yaml:"insecure_tls_skip_verify,omitempty"`
-+	Base                  string              `yaml:"base,omitempty"`
-+	Filter                string              `yaml:"filter,omitempty"`
-+	BindDN                string              `yaml:"bind_dn,omitempty"`
-+	BindPasswordFile      string              `yaml:"bind_password_file,omitempty"`
-+	LabelMaps             map[string]LabelMap `yaml:"labels,omitempty"`
-+	GroupBaseDN           string              `yaml:"group_base_dn,omitempty"`
-+	GroupFilter           string              `yaml:"group_filter,omitempty"`
- }
- 
- type LDAPAuth struct {
-@@ -71,22 +77,19 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
- 
- 	filter := la.getFilter(account)
- 
--	// dnAndGroupAttr := []string{"DN"} // example of no groups mapping attribute
--	groupAttribute := "memberOf"
--	dnAndGroupAttr := []string{"DN", groupAttribute}
-+	labelAttributes, labelsConfigErr := la.getLabelAttributes()
-+	if labelsConfigErr != nil {
-+		return false, nil, labelsConfigErr
-+	}
- 
--	entryAttrMap, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &dnAndGroupAttr)
-+	accountEntryDN, entryAttrMap, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &labelAttributes)
- 	if uSearchErr != nil {
- 		return false, nil, uSearchErr
- 	}
--	if len(entryAttrMap) < 1 || entryAttrMap["DN"] == nil || len(entryAttrMap["DN"]) != 1 {
--		return false, nil, NoMatch // User does not exist
--	}
--
--	accountEntryDN := entryAttrMap["DN"][0]
- 	if accountEntryDN == "" {
- 		return false, nil, NoMatch // User does not exist
- 	}
-+
- 	// Bind as the user to verify their password
- 	if len(accountEntryDN) > 0 {
- 		err := l.Bind(accountEntryDN, string(password))
-@@ -102,21 +105,13 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
- 		return false, nil, bindErr
- 	}
- 
--	// Extract group names from the attribute values
--	if entryAttrMap[groupAttribute] != nil {
--		rawGroups := entryAttrMap[groupAttribute]
--		labels := make(map[string][]string)
--		var groups []string
--		for _, value := range rawGroups {
--			cn := la.getCNFromDN(value)
--			groups = append(groups, cn)
--		}
--		labels["groups"] = groups
--
--		return true, labels, nil
-+	// Extract labels from the attribute values
-+	labels, labelsExtractErr := la.getLabelsFromMap(entryAttrMap)
-+	if labelsExtractErr != nil {
-+		return false, nil, labelsExtractErr
- 	}
- 
--	return true, nil, nil
-+	return true, labels, nil
- }
- 
- func (la *LDAPAuth) bindReadOnlyUser(l *ldap.Conn) error {
-@@ -193,9 +188,9 @@ func (la *LDAPAuth) getFilter(account string) string {
- 
- //ldap search and return required attributes' value from searched entries
- //default return entry's DN value if you leave attrs array empty
--func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (map[string][]string, error) {
-+func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (string, map[string][]string, error) {
- 	if l == nil {
--		return nil, fmt.Errorf("No ldap connection!")
-+		return "", nil, fmt.Errorf("No ldap connection!")
- 	}
- 	glog.V(2).Infof("Searching...basedDN:%s, filter:%s", *baseDN, *filter)
- 	searchRequest := ldap.NewSearchRequest(
-@@ -206,38 +201,66 @@ func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, att
- 		nil)
- 	sr, err := l.Search(searchRequest)
- 	if err != nil {
--		return nil, err
-+		return "", nil, err
- 	}
- 
- 	if len(sr.Entries) == 0 {
--		return nil, nil // User does not exist
-+		return "", nil, nil // User does not exist
- 	} else if len(sr.Entries) > 1 {
--		return nil, fmt.Errorf("Too many entries returned.")
-+		return "", nil, fmt.Errorf("Too many entries returned.")
- 	}
- 
--	result := make(map[string][]string)
-+	attributes := make(map[string][]string)
-+	var entryDn string
- 	for _, entry := range sr.Entries {
--
-+		entryDn = entry.DN
- 		if len(*attrs) == 0 {
--			glog.V(2).Infof("Entry DN = %s", entry.DN)
--			result["DN"] = []string{entry.DN}
-+			glog.V(2).Infof("Entry DN = %s", entryDn)
- 		} else {
- 			for _, attr := range *attrs {
--				var values []string
--				if attr == "DN" {
--					// DN is excluded from attributes
--					values = []string{entry.DN}
--				} else {
--					values = entry.GetAttributeValues(attr)
--				}
--				valuesString := strings.Join(values, "\n")
--				glog.V(2).Infof("Entry %s = %s", attr, valuesString)
--				result[attr] = values
-+				values := entry.GetAttributeValues(attr)
-+				glog.V(2).Infof("Entry %s = %s", attr, strings.Join(values, "\n"))
-+				attributes[attr] = values
- 			}
- 		}
- 	}
- 
--	return result, nil
-+	return entryDn, attributes, nil
-+}
-+
-+func (la *LDAPAuth) getLabelAttributes() ([]string, error) {
-+	labelAttributes := make([]string, len(la.config.LabelMaps))
-+	i := 0
-+	for key, mapping := range la.config.LabelMaps {
-+		if mapping.Attribute == "" {
-+			return nil, fmt.Errorf("Label %s is missing 'attribute' to map from", key)
-+		}
-+		labelAttributes[i] = mapping.Attribute
-+		i++
-+	}
-+	return labelAttributes, nil
-+}
-+
-+func (la *LDAPAuth) getLabelsFromMap(attrMap map[string][]string) (map[string][]string, error) {
-+	labels := make(map[string][]string)
-+	for key, mapping := range la.config.LabelMaps {
-+		if mapping.Attribute == "" {
-+			return nil, fmt.Errorf("Label %s is missing 'attribute' to map from", key)
-+		}
-+
-+		mappingValues := attrMap[mapping.Attribute]
-+		if mappingValues != nil {
-+			if mapping.ParseCN {
-+				// shorten attribute to its common name
-+				for i, value := range mappingValues {
-+					cn := la.getCNFromDN(value)
-+					mappingValues[i] = cn
-+				}
-+			}
-+			labels[key] = mappingValues
-+		}
-+	}
-+	return labels, nil
- }
- 
- func (la *LDAPAuth) getCNFromDN(dn string) string {
-
-From cd37001980267a99a9faa19f1927891af63acb90 Mon Sep 17 00:00:00 2001
-From: Kevin <kcd83@users.noreply.github.com>
-Date: Tue, 28 Feb 2017 18:27:16 +1300
-Subject: [PATCH 3/3] Remove unused configuration fields, never implemented?
-
----
- auth_server/authn/ldap_auth.go | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/auth_server/authn/ldap_auth.go b/auth_server/authn/ldap_auth.go
-index 6f733a2..9c8bcb8 100644
---- a/auth_server/authn/ldap_auth.go
-+++ b/auth_server/authn/ldap_auth.go
-@@ -40,8 +40,6 @@ type LDAPAuthConfig struct {
- 	BindDN                string              `yaml:"bind_dn,omitempty"`
- 	BindPasswordFile      string              `yaml:"bind_password_file,omitempty"`
- 	LabelMaps             map[string]LabelMap `yaml:"labels,omitempty"`
--	GroupBaseDN           string              `yaml:"group_base_dn,omitempty"`
--	GroupFilter           string              `yaml:"group_filter,omitempty"`
- }
- 
- type LDAPAuth struct {