X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=ud-mailgate;h=05756aa2ff367885c75fd8a7e5a847c61f107e10;hb=950e6acc8178555e33f64f0bda9af99bf9d7cfab;hp=952a4dc0e37ddba21a2e6b4868b5c0e009b97e8b;hpb=756aa679658608227f9df33f7d0a51ffff460597;p=mirror%2Fuserdir-ldap.git

diff --git a/ud-mailgate b/ud-mailgate
index 952a4dc..05756aa 100755
--- a/ud-mailgate
+++ b/ud-mailgate
@@ -10,6 +10,7 @@
 import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands
 import pwd, tempfile
 import subprocess
+import email, email.parser
 
 from userdir_gpg import *
 from userdir_ldap import *
@@ -35,7 +36,6 @@ mailRHSBL = {}
 mailWhitelist = {}
 SeenList = {}
 DNS = {}
-SudoPasswd = {}
 ValidHostNames = [] # will be initialized in later
 
 SSHFingerprint = re.compile('^(\d+) ([0-9a-f\:]{47}) (.+)$')
@@ -489,7 +489,7 @@ def DoRBL(Str,Attrs):
    return "%s replaced with %s" % (Key,Host)
 
 # Handle a ConfirmSudoPassword request
-def DoConfirmSudopassword(Str):
+def DoConfirmSudopassword(Str, SudoPasswd):
    Match = re.compile('^confirm sudopassword ('+UUID_FORMAT+') ([a-z0-9.,*]+) ([0-9a-f]{40})$').match(Str)
    if Match == None:
       return None
@@ -498,14 +498,15 @@ def DoConfirmSudopassword(Str):
    hosts = Match.group(2)
    hmac = Match.group(3)
 
-   global SudoPasswd
    SudoPasswd[uuid] = (hosts, hmac)
    return "got confirm for sudo password %s on host(s) %s, auth code %s" % (uuid,hosts, hmac)
 
-def FinishConfirmSudopassword(l, uid, Attrs):
-   global SudoPasswd
+def FinishConfirmSudopassword(l, uid, Attrs, SudoPasswd):
    result = "\n"
 
+   if len(SudoPasswd) == 0:
+       return None
+
    res = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid="+uid, ['sudoPassword']);
    if len(res) != 1:
       raise UDFormatError, "Not exactly one hit when searching for user"
@@ -578,6 +579,7 @@ def HandleChange(Reply,DnRecord,Key):
 
    Result = "";
    Attrs = [];
+   SudoPasswd = {}
    Show = 0;
    CommitChanges = 1
    for Line in Lines: 
@@ -595,7 +597,7 @@ def HandleChange(Reply,DnRecord,Key):
             badkeys = LoadBadSSH()
             Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
                   DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys,GetAttr(DnRecord,"uid")) or \
-                  DoDel(Line,Attrs) or DoRBL(Line,Attrs) or DoConfirmSudopassword(Line)
+                  DoDel(Line,Attrs) or DoRBL(Line,Attrs) or DoConfirmSudopassword(Line, SudoPasswd)
       except:
          Res = None;
          Result = Result + "==> %s: %s\n" %(sys.exc_type,sys.exc_value);
@@ -611,16 +613,16 @@ def HandleChange(Reply,DnRecord,Key):
    # Connect to the ldap server
    l = connect_to_ldap_and_check_if_locked(DnRecord)
 
-   if CommitChanges == 1: # only if we are still good to go
+   if CommitChanges == 1 and len(SudoPasswd) > 0: # only if we are still good to go
       try:
-         Res = FinishConfirmSudopassword(l, GetAttr(DnRecord,"uid"), Attrs)
-         Result = Result + Res + "\n";
+         Res = FinishConfirmSudopassword(l, GetAttr(DnRecord,"uid"), Attrs, SudoPasswd)
+         if not Res is None:
+            Result = Result + Res + "\n";
       except Error, e:
          CommitChanges = 0
          Result = Result + "FinishConfirmSudopassword raised an error (%s) - no changes committed\n"%(e);
 
-   # Modify the record
-   if CommitChanges == 1:
+   if CommitChanges == 1 and len(Attrs) > 0:
       Dn = "uid=" + GetAttr(DnRecord,"uid") + "," + BaseDn;
       l.modify_s(Dn,Attrs);
 
@@ -747,8 +749,8 @@ try:
    # Get the email 
    ErrType = EX_PERMFAIL;
    ErrMsg = "Failed to understand the email or find a signature:";
-   Email = mimetools.Message(sys.stdin,0);
-   Msg = GetClearSig(Email);
+   mail = email.parser.Parser().parse(sys.stdin);
+   Msg = GetClearSig(mail);
 
    ErrMsg = "Message is not PGP signed:"
    if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1 and \
@@ -769,11 +771,8 @@ try:
    global PlainText;
    ErrMsg = "Problem stripping MIME headers from the decoded message"
    if Msg[1] == 1:
-      try:
-         Index = pgp.text.index("\n\n") + 2
-      except ValueError:
-         Index = pgp.text.index("\n\r\n") + 3
-      PlainText = pgp.text[Index:]
+      e = email.parser.Parser().parsestr(pgp.text)
+      PlainText = e.get_payload(decode=True)
    else:
       PlainText = pgp.text
 
@@ -796,22 +795,13 @@ try:
 
    # Check the signature against the replay cache
    RC = ReplayCache(ReplayCacheFile);
-   RC.Clean();
-   ErrMsg = "The replay cache rejected your message. Check your clock!";
-   Rply = RC.Check(pgp.sig_info);
-   if Rply != None:
-      RC.close()
-      raise UDNotAllowedError, Rply;
-   RC.Add(pgp.sig_info);
-   RC.close()
+   RC.process(pgp.sig_info)
 
    # Determine the sender address
    ErrMsg = "A problem occured while trying to formulate the reply";
-   Sender = Email.getheader("Reply-To");
-   if Sender == None:
-      Sender = Email.getheader("From");
-   if Sender == None:
-      raise UDFormatError, "Unable to determine the sender's address";
+   Sender = mail['Reply-To']
+   if not Sender: Sender = mail['From']
+   if not Sender: raise UDFormatError, "Unable to determine the sender's address";
 
    # Formulate a reply
    Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time()));