- # Startup the replay cache
- ErrType = EX_TEMPFAIL;
- ErrMsg = "Failed to initialize the replay cache:";
-
- # Get the email
- ErrType = EX_PERMFAIL;
- ErrMsg = "Failed to understand the email or find a signature:";
- Email = mimetools.Message(sys.stdin,0);
- Msg = GetClearSig(Email);
-
- ErrMsg = "Message is not PGP signed:"
- if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1 and \
- Msg[0].find("-----BEGIN PGP MESSAGE-----") == -1:
- raise UDFormatError, "No PGP signature";
-
- # Check the signature
- ErrMsg = "Unable to check the signature or the signature was invalid:";
- Res = GPGCheckSig(Msg[0]);
-
- if Res[0] != None:
- raise UDFormatError, Res[0];
-
- if Res[3] == None:
- raise UDFormatError, "Null signature text";
-
- # Extract the plain message text in the event of mime encoding
- global PlainText;
- ErrMsg = "Problem stripping MIME headers from the decoded message"
- if Msg[1] == 1:
- try:
- Index = Res[3].index("\n\n") + 2;
- except ValueError:
- Index = Res[3].index("\n\r\n") + 3;
- PlainText = Res[3][Index:];
- else:
- PlainText = Res[3];
-
- # Connect to the ldap server
- ErrType = EX_TEMPFAIL;
- ErrMsg = "An error occured while performing the LDAP lookup";
- global l;
- l = connectLDAP()
- l.simple_bind_s("","");
-
- # Search for the matching key fingerprint
- Attrs = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"keyFingerPrint=" + Res[2][1]);
-
- ErrType = EX_PERMFAIL;
- if len(Attrs) == 0:
- raise UDFormatError, "Key not found"
- if len(Attrs) != 1:
- raise UDFormatError, "Oddly your key fingerprint is assigned to more than one account.."
-
-
- # Check the signature against the replay cache
- RC = ReplayCache(ReplayCacheFile);
- RC.Clean();
- ErrMsg = "The replay cache rejected your message. Check your clock!";
- Rply = RC.Check(Res[1]);
- if Rply != None:
- RC.close()
- raise UDNotAllowedError, Rply;
- RC.Add(Res[1]);
- RC.close()
-
- # Determine the sender address
- ErrMsg = "A problem occured while trying to formulate the reply";
- Sender = Email.getheader("Reply-To");
- if Sender == None:
- Sender = Email.getheader("From");
- if Sender == None:
- raise UDFormatError, "Unable to determine the sender's address";
-
- # Formulate a reply
- Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time()));
- Reply = "To: %s\nReply-To: %s\nDate: %s\n" % (Sender,ReplyTo,Date);
-
- Res = l.search_s(HostBaseDn, ldap.SCOPE_SUBTREE, '(objectClass=debianServer)', ['hostname'] )
- # Res is a list of tuples.
- # The tuples contain a dn (str) and a dictionary.
- # The dictionaries map the key "hostname" to a list.
- # These lists contain a single hostname (str).
- ValidHostNames = reduce(lambda a,b: a+b, [value.get("hostname", []) for (dn, value) in Res], [])
-
- # Dispatch
- if sys.argv[1] == "ping":
- Reply = HandlePing(Reply,Attrs[0],Res[2]);
- elif sys.argv[1] == "chpass":
- if PlainText.strip().find("Please change my Debian password") != 0:
- raise UDFormatError,"Please send a signed message where the first line of text is the string 'Please change my Debian password'";
- Reply = HandleChPass(Reply,Attrs[0],Res[2]);
- elif sys.argv[1] == "change":
- Reply = HandleChange(Reply,Attrs[0],Res[2]);
- else:
- print sys.argv;
- raise UDFormatError, "Incorrect Invokation";
-
- # Send the message through sendmail
- ErrMsg = "A problem occured while trying to send the reply";
- Child = os.popen("/usr/sbin/sendmail -t","w");
-# Child = os.popen("cat","w");
- Child.write(Reply);
- if Child.close() != None:
- raise UDExecuteError, "Sendmail gave a non-zero return code";
-
-except:
- # Error Reply Header
- Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time()));
- ErrReplyHead = "To: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'],ReplyTo,Date);
-
- # Error Body
- Subst = {};
- Subst["__ERROR__"] = ErrMsg;
- Subst["__ADMIN__"] = ReplyTo;
-
- Trace = "==> %s: %s\n" %(sys.exc_type,sys.exc_value);
- List = traceback.extract_tb(sys.exc_traceback);
- if len(List) > 1:
- Trace = Trace + "Python Stack Trace:\n";
- for x in List:
- Trace = Trace + " %s %s:%u: %s\n" %(x[2],x[0],x[1],x[3]);
-
- Subst["__TRACE__"] = Trace;
-
- # Try to send the bounce
- try:
- ErrReply = TemplateSubst(Subst,open(TemplatesDir+"error-reply","r").read());
-
- Child = os.popen("/usr/sbin/sendmail -t -oi -f ''","w");
- Child.write(ErrReplyHead);
- Child.write(ErrReply);
- if Child.close() != None:
- raise UDExecuteError, "Sendmail gave a non-zero return code";
- except:
- sys.exit(EX_TEMPFAIL);
-
- if ErrType != EX_PERMFAIL:
- sys.exit(ErrType);
- sys.exit(0);
+ # Startup the replay cache
+ ErrType = EX_TEMPFAIL
+ ErrMsg = "Failed to initialize the replay cache:"
+
+ # Get the email
+ ErrType = EX_PERMFAIL
+ ErrMsg = "Failed to understand the email or find a signature:"
+ mail = email.parser.Parser().parse(sys.stdin)
+ Msg = GetClearSig(mail)
+
+ ErrMsg = "Message is not PGP signed:"
+ if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1 and \
+ Msg[0].find("-----BEGIN PGP MESSAGE-----") == -1:
+ raise UDFormatError("No PGP signature")
+
+ # Check the signature
+ ErrMsg = "Unable to check the signature or the signature was invalid:"
+ pgp = GPGCheckSig2(Msg[0])
+
+ if not pgp.ok:
+ raise UDFormatError(pgp.why)
+
+ if pgp.text is None:
+ raise UDFormatError("Null signature text")
+
+ # Extract the plain message text in the event of mime encoding
+ global PlainText
+ ErrMsg = "Problem stripping MIME headers from the decoded message"
+ if Msg[1] == 1:
+ e = email.parser.Parser().parsestr(pgp.text)
+ PlainText = e.get_payload(decode=True)
+ else:
+ PlainText = pgp.text
+
+ # Connect to the ldap server
+ ErrType = EX_TEMPFAIL
+ ErrMsg = "An error occured while performing the LDAP lookup"
+ global lc
+ lc = connectLDAP()
+ lc.simple_bind_s("", "")
+
+ # Search for the matching key fingerprint
+ Attrs = lc.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "keyFingerPrint={}".format(pgp.key_fpr))
+
+ ErrType = EX_PERMFAIL
+ if len(Attrs) == 0:
+ raise UDFormatError("Key not found")
+ if len(Attrs) != 1:
+ raise UDFormatError("Oddly your key fingerprint is assigned to more than one account..")
+
+ # Check the signature against the replay cache
+ RC = ReplayCache(ReplayCacheFile)
+ RC.process(pgp.sig_info)
+
+ # Determine the sender address
+ ErrMsg = "A problem occured while trying to formulate the reply"
+ Sender = mail.get('Reply-To', mail.get('From'))
+ if not Sender:
+ raise UDFormatError("Unable to determine the sender's address")
+
+ # Formulate a reply
+ Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000", time.gmtime(time.time()))
+ Reply = "To: %s\nReply-To: %s\nDate: %s\n" % (Sender, ReplyTo, Date)
+
+ Res = lc.search_s(HostBaseDn, ldap.SCOPE_SUBTREE, '(objectClass=debianServer)', ['hostname'])
+ # Res is a list of tuples.
+ # The tuples contain a dn (str) and a dictionary.
+ # The dictionaries map the key "hostname" to a list.
+ # These lists contain a single hostname (str).
+ ValidHostNames = reduce(lambda a, b: a + b, [value.get("hostname", []) for (dn, value) in Res], [])
+
+ # Dispatch
+ if sys.argv[1] == "ping":
+ Reply = HandlePing(Reply, Attrs[0], pgp.key_info)
+ elif sys.argv[1] == "chpass":
+ if PlainText.strip().find("Please change my Debian password") >= 0:
+ Reply = HandleChPass(Reply, Attrs[0], pgp.key_info)
+ elif PlainText.strip().find("Please change my Kerberos password") >= 0:
+ Reply = HandleChKrbPass(Reply, Attrs[0], pgp.key_info)
+ elif PlainText.strip().find("Please change my TOTP seed") >= 0:
+ Reply = HandleChTOTPSeed(Reply, Attrs[0], pgp.key_info)
+ else:
+ raise UDFormatError("Please send a signed message where the first line of text is the string 'Please change my Debian password' or some other string we accept here.")
+ elif sys.argv[1] == "change":
+ Reply = HandleChange(Reply, Attrs[0], pgp.key_info)
+ else:
+ print sys.argv
+ raise UDFormatError("Incorrect Invokation")
+
+ # Send the message through sendmail
+ ErrMsg = "A problem occured while trying to send the reply"
+ Child = os.popen("/usr/sbin/sendmail -t", "w")
+ # Child = os.popen("cat","w")
+ Child.write(Reply)
+ if Child.close() is not None:
+ raise UDExecuteError("Sendmail gave a non-zero return code")
+
+except Exception:
+ # Error Reply Header
+ Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000", time.gmtime(time.time()))
+ ErrReplyHead = "To: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'], ReplyTo, Date)
+
+ # Error Body
+ Subst = {}
+ Subst["__ERROR__"] = ErrMsg
+ Subst["__ADMIN__"] = ReplyTo
+
+ Trace = "==> %s: %s\n" % (sys.exc_type, sys.exc_value)
+ List = traceback.extract_tb(sys.exc_traceback)
+ if len(List) > 1:
+ Trace = Trace + "Python Stack Trace:\n"
+ for x in List:
+ Trace = Trace + " %s %s:%u: %s\n" % (x[2], x[0], x[1], x[3])
+
+ Subst["__TRACE__"] = Trace
+
+ # Try to send the bounce
+ try:
+ ErrReply = TemplateSubst(Subst, open(TemplatesDir + "error-reply", "r").read())
+
+ Child = os.popen("/usr/sbin/sendmail -t -oi -f ''", "w")
+ Child.write(ErrReplyHead)
+ Child.write(ErrReply)
+ if Child.close() is not None:
+ raise UDExecuteError("Sendmail gave a non-zero return code")
+ except Exception:
+ sys.exit(EX_TEMPFAIL)
+
+ if ErrType != EX_PERMFAIL:
+ sys.exit(ErrType)
+ sys.exit(0)