ud-host: use subprocess.Popen instead of os.popen.

[mirror/userdir-ldap.git] / sigcheck

diff --git a/sigcheck b/sigcheck
index af1be9d..2561f1c 100755 (executable)
--- a/sigcheck
+++ b/sigcheck
@@ -25,12 +25,12 @@
 #      -e /etc/userdir-ldap/templtes/error-reply -- test.sh
 
 import sys, traceback, time, os;
-import string, pwd, getopt;
+import pwd, getopt;
+import email, email.parser
 from userdir_gpg import *;
 
 EX_TEMPFAIL = 75;
 EX_PERMFAIL = 65;      # EX_DATAERR
-Error = 'Message Error';
 
 # Configuration
 ReplayCacheFile = None;
@@ -41,6 +41,9 @@ Phrases = None;
 AllowMIME = 1;
 Verbose = 0;
 
+class MessageError(Exception):
+   pass
+
 def verbmsg(msg):
    if Verbose:
       sys.stderr.write(msg + "\n")
@@ -48,31 +51,51 @@ def verbmsg(msg):
 # Match the key fingerprint against an LDAP directory
 def CheckLDAP(FingerPrint):
    import ldap;
+   import userdir_ldap;
    
    # Connect to the ldap server
    global ErrTyp, ErrMsg;
    ErrType = EX_TEMPFAIL;
    ErrMsg = "An error occurred while performing the LDAP lookup:";
    global l;
-   l = ldap.open(LDAPServer);
+   l = userdir_ldap.connectLDAP(LDAPServer);
    l.simple_bind_s("","");
 
    # Search for the matching key fingerprint
    verbmsg("Processing fingerprint %s" % FingerPrint)
    Attrs = l.search_s(LDAPDn,ldap.SCOPE_ONELEVEL,"keyfingerprint=" + FingerPrint);
    if len(Attrs) == 0:
-      raise Error, "Key not found"
+      raise MessageError("Key not found")
    if len(Attrs) != 1:
-      raise Error, "Oddly your key fingerprint is assigned to more than one account.."
+      raise MessageError("Oddly your key fingerprint is assigned to more than one account..")
+
+   gidnumber_found = 0;
+   for key in Attrs[0][1].keys():
+      if (key == "gidNumber"):
+         gidnumber_found = 1
+
+   if (gidnumber_found != 1):
+      raise MessageError("No gidnumber in attributes for fingerprint %s" % FingerPrint)
+
+   # Look for the group with the gid of the user
+   GAttr = l.search_s(LDAPDn,ldap.SCOPE_ONELEVEL,"(&(objectClass=debianGroup)(gidnumber=%s))" % Attrs[0][1]["gidNumber"][0], ["gid"])
+   if len(GAttr) == 0:
+          raise MessageError("Database inconsistency found: main group for account not found in database")
 
    # See if the group membership is OK
-   if GroupMember != None:
+   # Only if a group was given on the commandline
+   if GroupMember is not None:
       Hit = 0;
-      for x in Attrs[0][1].get("supplementarygid",[]):
-         if x == GroupMember:
-          Hit = 1;
+      # Check primary group first
+      if GAttr[0][1]["gid"][0] == GroupMember:
+        Hit = 1
+      else:
+         # Check supplementary groups
+         for x in Attrs[0][1].get("supplementaryGid",[]):
+             if x == GroupMember:
+                 Hit = 1;
       if Hit != 1:
-         raise Error, "You don't have %s group permissions."%(GroupMember);
+         raise MessageError("You don't have %s group permissions."%(GroupMember))
    
 # Start of main program
 # Process options
@@ -81,7 +104,7 @@ for (switch, val) in options:
    if (switch == '-r'):
       ReplayCacheFile = val;
    elif (switch == '-k'):
-      SetKeyrings(string.split(val,":"));
+      SetKeyrings(val.split(":"));
    elif (switch == '-d'):
       LDAPDn = val;
    elif (switch == '-l'):
@@ -102,57 +125,51 @@ MsgID = None;
 try:
    # Startup the replay cache
    ErrType = EX_TEMPFAIL;
-   if ReplayCacheFile != None:
+   if ReplayCacheFile is not None:
       ErrMsg = "Failed to initialize the replay cache:";
       RC = ReplayCache(ReplayCacheFile);
-      RC.Clean();
-   
+
    # Get the email 
    ErrType = EX_PERMFAIL;
    ErrMsg = "Failed to understand the email or find a signature:";
-   Email = mimetools.Message(sys.stdin,0);
-   MsgID = Email.getheader("Message-ID");
+   mail = email.parser.Parser().parse(sys.stdin);
+   MsgID = mail["Message-ID"]
+
    print "Inspecting message %s"%MsgID;
    verbmsg("Processing message %s" % MsgID)
-   Msg = GetClearSig(Email,1);
-   # print Msg
+   Msg = GetClearSig(mail,1);
    if AllowMIME == 0 and Msg[1] != 0:
-      raise Error, "PGP/MIME disallowed";
+      raise MessageError("PGP/MIME disallowed")
   
    ErrMsg = "Message is not PGP signed:"
-   if string.find(Msg[0],"-----BEGIN PGP SIGNED MESSAGE-----") == -1:
-      raise Error, "No PGP signature";
+   if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1:
+      raise MessageError("No PGP signature")
    
    # Check the signature
    ErrMsg = "Unable to check the signature or the signature was invalid:";
-   Res = GPGCheckSig(Msg[0]);
+   pgp = GPGCheckSig2(Msg[0])
 
-   if Res[0] != None:
-      raise Error, Res[0];
-      
-   if Res[3] == None:
-      raise Error, "Null signature text";
+   if not pgp.ok:
+      raise UDFormatError(pgp.why)
+   if pgp.text is None:
+      raise UDFormatError("Null signature text")
 
    # Check the signature against the replay cache
-   if ReplayCacheFile != None:
-      ErrMsg = "The replay cache rejected your message. Check your clock!";
-      Rply = RC.Check(Res[1]);
-      if Rply != None:
-         raise Error, Rply;
-      RC.Add(Res[1]);
+   if ReplayCacheFile is not None:
+      RC.process(pgp.sig_info)
 
    # Do LDAP stuff
-   if LDAPDn != None:
-      CheckLDAP(Res[2][1]);
-         
+   if LDAPDn is not None:
+      CheckLDAP(pgp.key_fpr)
+
    ErrMsg = "Verifying message:";
-   if Phrases != None:
+   if Phrases is not None:
       F = open(Phrases,"r");
       while 1:
          Line = F.readline();
          if Line == "": break;
-         if string.find(Res[3],string.strip(Line)) == -1:
-             raise Error,"Phrase '%s' was not found"%(string.strip(Line));
+         if pgp.text.find(Line.strip()) == -1:
+             raise MessageError("Phrase '%s' was not found" % (Line.strip()))
       
 except:
    ErrMsg = "[%s] \"%s\" \"%s %s\"\n"%(Now,MsgID,ErrMsg,sys.exc_value);