4 # Check PGP signed emails
6 # This script verifies the signature on incoming mail for a couple of things
7 # - That the signature is valid, recent and is not replay
8 # - The signer is in the LDAP directory and is in the right group
9 # - The message contains no extra text that is not signed.
12 # -r Replay cache file, if unset replay checking is disabled
13 # -k Colon seperated list of keyrings to use
14 # -d LDAP search base DN
16 # -g supplementary group membership
17 # -p File of Phrases that must be in the plaintext.
18 # -m Disallow PGP/MIME
21 # Typical Debian invokation may look like:
22 # sigcheck -k /usr/share/keyrings/debian-keyring.gpg:/usr/share/keyrings/debian-keyring.pgp \
23 # -d ou=users,dc=debian,dc=org -l db.debian.org \
24 # -m debian.org -a admin@db.debian.org \
25 # -e /etc/userdir-ldap/templtes/error-reply -- test.sh
36 from userdir_gpg import *
39 EX_PERMFAIL = 65 # EX_DATAERR
42 ReplayCacheFile = None
51 class MessageError(Exception):
57 sys.stderr.write(msg + "\n")
60 # Match the key fingerprint against an LDAP directory
61 def CheckLDAP(FingerPrint):
65 # Connect to the ldap server
68 ErrMsg = "An error occurred while performing the LDAP lookup:"
70 l = userdir_ldap.connectLDAP(LDAPServer)
71 l.simple_bind_s("", "")
73 # Search for the matching key fingerprint
74 verbmsg("Processing fingerprint %s" % FingerPrint)
75 Attrs = l.search_s(LDAPDn, ldap.SCOPE_ONELEVEL, "keyfingerprint=" + FingerPrint)
77 raise MessageError("Key not found")
79 raise MessageError("Oddly your key fingerprint is assigned to more than one account..")
82 for key in Attrs[0][1].keys():
83 if key == "gidNumber":
86 if gidnumber_found != 1:
87 raise MessageError("No gidnumber in attributes for fingerprint %s" % FingerPrint)
89 # Look for the group with the gid of the user
90 GAttr = l.search_s(LDAPDn, ldap.SCOPE_ONELEVEL, "(&(objectClass=debianGroup)(gidnumber=%s))" % Attrs[0][1]["gidNumber"][0], ["gid"])
92 raise MessageError("Database inconsistency found: main group for account not found in database")
94 # See if the group membership is OK
95 # Only if a group was given on the commandline
96 if GroupMember is not None:
98 # Check primary group first
99 if GAttr[0][1]["gid"][0] == GroupMember:
102 # Check supplementary groups
103 for x in Attrs[0][1].get("supplementaryGid", []):
107 raise MessageError("You don't have %s group permissions." % GroupMember)
110 # Start of main program
112 options, arguments = getopt.getopt(sys.argv[1:], "r:k:d:l:g:mp:v")
113 for (switch, val) in options:
115 ReplayCacheFile = val
116 elif (switch == '-k'):
117 SetKeyrings(val.split(":"))
118 elif (switch == '-d'):
120 elif (switch == '-l'):
122 elif (switch == '-g'):
124 elif (switch == '-m'):
126 elif (switch == '-v'):
128 elif (switch == '-p'):
131 Now = time.strftime("%a, %d %b %Y %H:%M:%S", time.gmtime(time.time()))
132 ErrMsg = "Indeterminate Error"
133 ErrType = EX_TEMPFAIL
136 # Startup the replay cache
137 ErrType = EX_TEMPFAIL
138 if ReplayCacheFile is not None:
139 ErrMsg = "Failed to initialize the replay cache:"
140 RC = ReplayCache(ReplayCacheFile)
143 ErrType = EX_PERMFAIL
144 ErrMsg = "Failed to understand the email or find a signature:"
145 mail = email.parser.Parser().parse(sys.stdin)
146 MsgID = mail["Message-ID"]
148 print "Inspecting message %s" % MsgID
149 verbmsg("Processing message %s" % MsgID)
150 Msg = GetClearSig(mail, 1)
151 if AllowMIME == 0 and Msg[1] != 0:
152 raise MessageError("PGP/MIME disallowed")
154 ErrMsg = "Message is not PGP signed:"
155 if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1:
156 raise MessageError("No PGP signature")
158 # Check the signature
159 ErrMsg = "Unable to check the signature or the signature was invalid:"
160 pgp = GPGCheckSig2(Msg[0])
163 raise UDFormatError(pgp.why)
165 raise UDFormatError("Null signature text")
167 # Check the signature against the replay cache
168 if ReplayCacheFile is not None:
169 RC.process(pgp.sig_info)
172 if LDAPDn is not None:
173 CheckLDAP(pgp.key_fpr)
175 ErrMsg = "Verifying message:"
176 if Phrases is not None:
177 F = open(Phrases, "r")
182 if pgp.text.find(Line.strip()) == -1:
183 raise MessageError("Phrase '%s' was not found" % (Line.strip()))
186 ErrMsg = "[%s] \"%s\" \"%s %s\"\n" % (Now, MsgID, ErrMsg, sys.exc_value)
187 sys.stderr.write(ErrMsg)
189 Trace = "==> %s: %s\n" % (sys.exc_type, sys.exc_value)
190 List = traceback.extract_tb(sys.exc_traceback)
192 Trace = Trace + "Python Stack Trace:\n"
194 Trace = Trace + " %s %s:%u: %s\n" % (x[2], x[0], x[1], x[3])
196 sys.exit(EX_PERMFAIL)
199 print "Message %s passed" % MsgID