|
#!/usr/bin/ruby -Ku
|
|
|
|
# http://www.ruby-doc.org/stdlib/libdoc/net/imap/rdoc/index.html
|
|
# http://tmail.rubyforge.org/reference/index.html
|
|
# http://tools.ietf.org/html/rfc3156
|
|
|
|
$: << "./lib"
|
|
|
|
$KCODE = 'UTF8'
|
|
require 'jcode'
|
|
require 'log4r'
|
|
require 'net/imap'
|
|
require 'tmail'
|
|
#require 'socket'
|
|
#require 'fileutils'
|
|
#require 'tempfile'
|
|
require 'gpgme'
|
|
require 'active_ldap'
|
|
require 'shellwords'
|
|
require 'cyborghood/base'
|
|
|
|
logger = Log4r::Logger.new('test')
|
|
logger.outputters = Log4r::StderrOutputter.new('')
|
|
logger.level = Log4r::WARN
|
|
#logger.level = Log4r::DEBUG
|
|
|
|
class Person < ActiveLdap::Base
|
|
ldap_mapping :dn_attribute => 'uid', :prefix => '', :classes => ['person', 'extInetOrgPerson']
|
|
end
|
|
|
|
class DnsDomain < ActiveLdap::Base
|
|
ldap_mapping :dn_attribute => 'cn', :prefix => '', :classes => ['genericDomain']
|
|
|
|
def managers
|
|
list = self.manager
|
|
return [] if list.nil?
|
|
return list.collect{|dn| dn.to_s } if list.is_a? Array
|
|
return [list.to_s]
|
|
end
|
|
end
|
|
|
|
ldap_config = {
|
|
:host => 'localhost',
|
|
:port => 389,
|
|
:base => 'dc=milkypond,dc=org',
|
|
:bind_dn => 'cn=srv-auth,dc=milkypond,dc=org',
|
|
:password => 'teckLetsoaj5',
|
|
:logger => logger,
|
|
:allow_anonymous => false,
|
|
:try_sasl => false,
|
|
#:method => :tls,
|
|
:scope => :sub
|
|
}
|
|
|
|
ActiveLdap::Base.establish_connection(ldap_config)
|
|
|
|
#Socket.gethostname
|
|
|
|
# needed to verify _untouched_ signed MIME part
|
|
module TMail
|
|
class Mail
|
|
def raw
|
|
@port.read_all
|
|
end
|
|
end
|
|
end
|
|
|
|
#
|
|
# TODO:
|
|
# - should be able to handle encrypted messages for user to send sensitive data (postman would need a GPG key too)
|
|
#
|
|
|
|
class CommandParser
|
|
def self.run(user, txt)
|
|
txt.each_line do |line|
|
|
line.chomp!
|
|
sline = line.strip
|
|
# skip empty lines and comments
|
|
next if sline == "" or sline[0, 1] == "#"
|
|
# stop processing when detecting message signature
|
|
break if line == "-- "
|
|
|
|
logger.info "### Executing command: #{sline}"
|
|
execute_cmd(user, sline)
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def self.execute_cmd(user, cmdstr)
|
|
cmdline = Shellwords.shellwords(cmdstr)
|
|
subsys = cmdline.shift
|
|
|
|
ok = true
|
|
case subsys.upcase
|
|
when "DNS"
|
|
case cmdline.shift.upcase
|
|
when "INFO"
|
|
if cmdline.empty?
|
|
list = DnsDomain.find(:all, :attribute => 'manager', :value => user.dn)
|
|
logger.info "### User is manager of the following zones: " + list.collect{|z| z.cn }.join(", ")
|
|
else
|
|
ok = false
|
|
end
|
|
when "GET"
|
|
case cmdline.shift.upcase
|
|
when "ZONE"
|
|
zone = cmdline.shift.downcase
|
|
if zone =~ /^[a-z0-9.-]+\.[a-z]{2,4}$/
|
|
logger.info "### User requesting zone content for '#{zone}'"
|
|
begin
|
|
domain = DnsDomain.find(zone)
|
|
if domain.managers.include? user.dn
|
|
logger.info "### User is manager of the zone"
|
|
else
|
|
logger.info "### User is not allowed to manage the zone"
|
|
end
|
|
rescue
|
|
logger.info "### Zone not managed"
|
|
end
|
|
else
|
|
logger.info "### Invalid zone name specified (#{zone})"
|
|
end
|
|
else
|
|
ok = false
|
|
end
|
|
when "SET"
|
|
else
|
|
ok = false
|
|
end
|
|
else
|
|
ok = false
|
|
end
|
|
|
|
if not ok
|
|
logger.info "### Command not recognized: #{cmdstr}"
|
|
end
|
|
end
|
|
end
|
|
|
|
module CyborgHood
|
|
# not yet ready to be a real Cyborg
|
|
class Postman #< Cyborg
|
|
def initialize
|
|
# load config
|
|
Config.load(self.human_name.downcase)
|
|
@config = Config.instance
|
|
|
|
# setup logs
|
|
unless @config.log.nil?
|
|
logger.output_level(@config.log.console_level) unless @config.log.console_level.nil?
|
|
logger.log_to_file(@config.log.file) unless @config.log.file.nil?
|
|
end
|
|
|
|
logger.info "Bot '#{self.human_name}' loaded"
|
|
end
|
|
|
|
def run
|
|
# using SSL because TLS does not work in the NET::IMAP library
|
|
#imap = Net::IMAP.new('imap.duckcorp.org', 993, true, "/etc/ssl/certs/duckcorp.crt", true)
|
|
imap = Net::IMAP.new('localhost')
|
|
logger.debug "Connected to IMAP server"
|
|
logger.debug imap.capability()
|
|
imap.authenticate('LOGIN', @config.imap.login, @config.imap.passwd)
|
|
logger.debug "Logged into IMAP account"
|
|
#p imap.getquotaroot("INBOX")
|
|
imap.select('INBOX')
|
|
imap.search(["ALL"], "UTF-8").each do |message_id|
|
|
msg = imap.fetch(message_id, "RFC822")[0].attr["RFC822"]
|
|
# unquote headers and transform into TMail object
|
|
mail = TMail::Mail.parse(TMail::Unquoter.unquote_and_convert_to(msg, "UTF-8"))
|
|
|
|
logger.set_prefix()
|
|
logger.debug "######################################"
|
|
logger.set_prefix("[#{mail.message_id}] ")
|
|
logger.info "#{mail.from_addrs} -> #{mail.to_addrs}: #{mail.subject}"
|
|
# ignore mails not signed
|
|
unless mail.content_type == "multipart/signed" and mail.parts.size == 2 and mail.parts[1].content_type == "application/pgp-signature"
|
|
logger.info "Mail not signed or not RFC3156 compliant"
|
|
next
|
|
end
|
|
|
|
content = mail.parts[0].raw.chomp.gsub(/\r?\n/, "\r\n")
|
|
decoded_content = mail.parts[0].body
|
|
sig = mail.parts[1].decoded
|
|
|
|
logger.debug "Proper signed content detected"
|
|
GPGME::verify(sig, content) do |signature|
|
|
if signature.status == 0
|
|
logger.info "Mail content was properly signed by key #{signature.fingerprint}"
|
|
list = Person.find(:all, :attribute => 'keyFingerPrint', :value => signature.fingerprint)
|
|
case list.size
|
|
when 0
|
|
logger.info "Mail is from an unknow person"
|
|
when 1
|
|
user = list.first
|
|
logger.info "Mail is from user #{user.uid} (#{user.cn})"
|
|
CommandParser.run(user, decoded_content)
|
|
else
|
|
logger.warn "Multiple users match in database, so i guess there is a mistake. It is safer to skip..."
|
|
end
|
|
else
|
|
logger.info "Mail content tampered or badly signed: " + signature.to_s
|
|
end
|
|
end
|
|
end
|
|
imap.logout
|
|
end
|
|
|
|
def ask_to_stop
|
|
end
|
|
end
|
|
end
|
|
|
|
bot = CyborgHood::Postman.new
|
|
|
|
trap('INT') do
|
|
bot.ask_to_stop
|
|
end
|
|
trap('TERM') do
|
|
bot.ask_to_stop
|
|
end
|
|
|
|
bot.run
|
|
|