X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=ud-mailgate;h=f705497d32b17c0de7d66dfc386cda33808e0a18;hb=26042a727441733429ecc39dd3792158f2a2ba86;hp=99072228d69f6dcebb3594cc09b16b5525d6d082;hpb=5288a721e3a838f78746bd63c4416636fdd44825;p=mirror%2Fuserdir-ldap.git diff --git a/ud-mailgate b/ud-mailgate index 9907222..f705497 100755 --- a/ud-mailgate +++ b/ud-mailgate @@ -1,7 +1,11 @@ #!/usr/bin/env python # -*- mode: python -*- + +# Prior copyright probably rmurray, troup, joey, jgg -- weasel 2008 +# Copyright (c) 2008 Peter Palfrader + import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os; -import string, pwd +import pwd from userdir_gpg import *; from userdir_ldap import *; @@ -36,9 +40,11 @@ ArbChanges = {"c": "..", "icqUin": "^[0-9]*$", "onVacation": ".*", "labeledURI": ".*", + "birthDate": "^([0-9]{4})([01][0-9])([0-3][0-9])$", "mailDisableMessage": ".*", "mailGreylisting": "^(TRUE|FALSE)$", "mailCallout": "^(TRUE|FALSE)$", + "VoIP": ".*", }; DelItems = {"c": None, @@ -66,6 +72,7 @@ DelItems = {"c": None, "mailRHSBL": None, "mailWhitelist": None, "mailDisableMessage": None, + "VoIP": None, }; # Decode a GPS location from some common forms @@ -146,6 +153,29 @@ def DoArbChange(Str,Attrs): if re.match(ArbChanges[attrName],G[1]) == None: raise Error, "Item does not match the required format"+ArbChanges[attrName]; +# if attrName == 'birthDate': +# (re.match("^([0-9]{4})([01][0-9])([0-3][0-9])$",G[1]) { +# $bd_yr = $1; $bd_mo = $2; $bd_day = $3; +# if ($bd_mo > 0 and $bd_mo <= 12 and $bd_day > 0) { +# if ($bd_mo == 2) { +# if ($bd_day == 29 and ($bd_yr == 0 or ($bd_yr % 4 == 0 && ($bd_yr % 100 != 0 || $bd_yr % 400 == 0)))) { +# $bd_ok = 1; +# } elsif ($bd_day <= 28) { +# $bd_ok = 1; +# } +# } elsif ($bd_mo == 4 or $bd_mo == 6 or $bd_mo == 9 or $bd_mo == 11) { +# if ($bd_day <= 30) { +# $bd_ok = 1; +# } +# } else { +# if ($bd_day <= 31) { +# $bd_ok = 1; +# } +# } +# } +# } elsif (not defined($query->param('birthdate')) or $query->param('birthdate') =~ /^\s*$/) { +# $bd_ok = 1; +# } Attrs.append((ldap.MOD_REPLACE,attrName,G[1])); return "Changed entry %s to %s"%(attrName,G[1]); @@ -171,7 +201,7 @@ def DoDel(Str,Attrs): # Handle a position change message, the line format is: # Lat: -12412.23 Long: +12341.2342 def DoPosition(Str,Attrs): - Match = re.match("^lat: ([+\-]?[\d:.ns]+(?: ?[ns])?) long: ([+\-]?[\d:.ew]+(?: ?[ew])?)$",string.lower(Str)); + Match = re.match("^lat: ([+\-]?[\d:.ns]+(?: ?[ns])?) long: ([+\-]?[\d:.ew]+(?: ?[ew])?)$", Str.lower()) if Match == None: return None; @@ -208,21 +238,37 @@ def DoSSH(Str,Attrs): return "SSH Keys replaced with "+FormatSSHAuth(Str); # Handle changing a dns entry -# host in a 12.12.12.12 -# host in cname foo.bar. <- Trailing dot is required +# host IN A 12.12.12.12 +# host IN AAAA 1234::5678 +# host IN CNAME foo.bar. <- Trailing dot is required +# host IN MX foo.bar. <- Trailing dot is required def DoDNS(Str,Attrs,DnRecord): - cname = re.match("^[-\w]+\s+in\s+cname\s+[-\w.]+\.$",Str,re.IGNORECASE); - if re.match('^[-\w]+\s+in\s+a\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$',\ - Str,re.IGNORECASE) == None and cname == None and \ - re.match("^[-\w]+\s+in\s+mx\s+\d{1,3}\s+[-\w.]+\.$",Str,re.IGNORECASE) == None: - return None; + cnamerecord = re.match("^[-\w]+\s+IN\s+CNAME\s+([-\w.]+\.)$",Str,re.IGNORECASE) + arecord = re.match('^[-\w]+\s+IN\s+A\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$',Str,re.IGNORECASE) + mxrecord = re.match("^[-\w]+\s+IN\s+MX\s+(\d{1,3})\s+([-\w.]+\.)$",Str,re.IGNORECASE) + #aaaarecord = re.match('^[-\w]+\s+IN\s+AAAA\s+((?:[0-9a-f]{1,4})(?::[0-9a-f]{1,4})*(?::(?:(?::[0-9a-f]{1,4})*|:))?)$',Str,re.IGNORECASE) + aaaarecord = re.match('^[-\w]+\s+IN\s+AAAA\s+([A-F0-9:]{2,39})$',Str,re.IGNORECASE) + + if cnamerecord == None and\ + arecord == None and\ + mxrecord == None and\ + aaaarecord == None: + return None; # Check if the name is already taken - G = re.match('^([-\w+]+)\s',Str).groups(); + G = re.match('^([-\w+]+)\s',Str) + if G == None: + raise Error, "Hostname not found although we already passed record syntax checks" + hostname = G.group(1) # Check for collisions global l; - Rec = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"dnsZoneEntry="+G[0]+" *",["uid"]); + # [JT 20070409 - search for both tab and space suffixed hostnames + # since we accept either. It'd probably be better to parse the + # incoming string in order to construct what we feed LDAP rather + # than just passing it through as is.] + filter = "(|(dnsZoneEntry=%s *)(dnsZoneEntry=%s *))" % (hostname, hostname) + Rec = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,filter,["uid"]); for x in Rec: if GetAttr(x,"uid") != GetAttr(DnRecord,"uid"): return "DNS entry is already owned by " + GetAttr(x,"uid") @@ -230,28 +276,63 @@ def DoDNS(Str,Attrs,DnRecord): global SeenDNS; global DNS; - if cname: - if DNS.has_key(G[0]): + if cnamerecord: + if DNS.has_key(hostname): return "CNAME and other RR types not allowed: "+Str else: - DNS[G[0]] = 2 + DNS[hostname] = 2 else: - if DNS.has_key(G[0]) and DNS[G[0]] == 2: + if DNS.has_key(hostname) and DNS[hostname] == 2: return "CNAME and other RR types not allowed: "+Str else: - DNS[G[0]] = 1 - + DNS[hostname] = 1 + + if cnamerecord != None: + sanitized = "%s IN CNAME %s" % (hostname, cnamerecord.group(1)) + elif arecord != None: + ipaddress = arecord.group(1) + for quad in ipaddress.split('.'): + if not (int(quad) >=0 and int(quad) <= 255): + return "Invalid quad %s in IP address %s in line %s" %(quad, ipaddress, Str) + sanitized = "%s IN A %s"% (hostname, ipaddress) + elif mxrecord != None: + priority = mxrecord.group(1) + mx = mxrecord.group(2) + sanitized = "%s IN MX %s %s" % (hostname, priority, mx) + elif aaaarecord != None: + ipv6address = aaaarecord.group(1) + parts = ipv6address.split(':') + if len(parts) > 8: + return "Invalid IPv6 address (%s): too many parts"%(ipv6address) + if len(parts) <= 2: + return "Invalid IPv6 address (%s): too few parts"%(ipv6address) + if parts[0] == "": + parts.pop(0) + if parts[-1] == "": + parts.pop(-1) + seenEmptypart = False + for p in parts: + if len(p) > 4: + return "Invalid IPv6 address (%s): part %s is longer than 4 characters"%(ipv6address, p) + if p == "": + if seenEmptypart: + return "Invalid IPv6 address (%s): more than one :: (nothing in between colons) is not allowed"%(ipv6address) + seenEmptypart = True + sanitized = "%s IN AAAA %s" % (hostname, ipv6address) + else: + raise Error, "None of the types I recognize was it. I shouldn't be here. confused." + if SeenDNS: - Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",Str)); - return "DNS Entry added "+Str; - - Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",Str)); + Attrs.append((ldap.MOD_ADD,"dnsZoneEntry",sanitized)); + return "DNS Entry added "+sanitized; + + Attrs.append((ldap.MOD_REPLACE,"dnsZoneEntry",sanitized)); SeenDNS = 1; - return "DNS Entry replaced with "+Str; + return "DNS Entry replaced with "+sanitized; # Handle an RBL list (mailRBL, mailRHSBL, mailWhitelist) def DoRBL(Str,Attrs): - Match = re.compile('^mail(rbl|rhsbl|whitelist) ([-a-z0-9.]+)$').match(string.lower(Str)) + Match = re.compile('^mail(rbl|rhsbl|whitelist) ([-a-z0-9.]+)$').match(Str.lower()) if Match == None: return None @@ -281,7 +362,7 @@ def HandleChange(Reply,DnRecord,Key): Attrs = []; Show = 0; for Line in Lines: - Line = string.strip(Line); + Line = Line.strip() if Line == "": continue; @@ -309,13 +390,14 @@ def HandleChange(Reply,DnRecord,Key): # Connect to the ldap server l = ldap.open(LDAPServer); F = open(PassDir+"/pass-"+pwd.getpwuid(os.getuid())[0],"r"); - AccessPass = string.split(string.strip(F.readline())," "); + AccessPass = F.readline().strip().split(" ") F.close(); # Modify the record l.simple_bind_s("uid="+AccessPass[0]+","+BaseDn,AccessPass[1]); oldAttrs = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid="+GetAttr(DnRecord,"uid")); - if (string.find(GetAttr(oldAttrs[0],"userPassword"),"*LK*") != -1): + if ((GetAttr(oldAttrs[0],"userPassword").find("*LK*") != -1) + or GetAttr(oldAttrs[0],"userPassword").startswith("!")): raise Error, "This account is locked"; Dn = "uid=" + GetAttr(DnRecord,"uid") + "," + BaseDn; l.modify_s(Dn,Attrs); @@ -379,13 +461,14 @@ def HandleChPass(Reply,DnRecord,Key): # Connect to the ldap server l = ldap.open(LDAPServer); F = open(PassDir+"/pass-"+pwd.getpwuid(os.getuid())[0],"r"); - AccessPass = string.split(string.strip(F.readline())," "); + AccessPass = F.readline().strip().split(" ") F.close(); l.simple_bind_s("uid="+AccessPass[0]+","+BaseDn,AccessPass[1]); # Check for a locked account Attrs = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid="+GetAttr(DnRecord,"uid")); - if (string.find(GetAttr(Attrs[0],"userPassword"),"*LK*") != -1): + if (GetAttr(Attrs[0],"userPassword").find("*LK*") != -1) \ + or GetAttr(Attrs[0],"userPassword").startswith("!"): raise Error, "This account is locked"; # Modify the password @@ -417,8 +500,8 @@ try: Msg = GetClearSig(Email); ErrMsg = "Message is not PGP signed:" - if string.find(Msg[0],"-----BEGIN PGP SIGNED MESSAGE-----") == -1 and \ - string.find(Msg[0],"-----BEGIN PGP MESSAGE-----") == -1: + if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1 and \ + Msg[0].find("-----BEGIN PGP MESSAGE-----") == -1: raise Error, "No PGP signature"; # Check the signature @@ -436,9 +519,9 @@ try: ErrMsg = "Problem stripping MIME headers from the decoded message" if Msg[1] == 1: try: - Index = string.index(Res[3],"\n\n") + 2; + Index = Res[3].index("\n\n") + 2; except ValueError: - Index = string.index(Res[3],"\n\r\n") + 3; + Index = Res[3].index("\n\r\n") + 3; PlainText = Res[3][Index:]; else: PlainText = Res[3]; @@ -483,7 +566,7 @@ try: if sys.argv[1] == "ping": Reply = HandlePing(Reply,Attrs[0],Res[2]); elif sys.argv[1] == "chpass": - if string.find(string.strip(PlainText),"Please change my Debian password") != 0: + if PlainText.strip().find("Please change my Debian password") != 0: raise Error,"Please send a signed message where the first line of text is the string 'Please change my Debian password'"; Reply = HandleChPass(Reply,Attrs[0],Res[2]); elif sys.argv[1] == "change":