1 # BEGIN BPS TAGGED BLOCK {{{
5 # This software is Copyright (c) 1996-2013 Best Practical Solutions, LLC
6 # <sales@bestpractical.com>
8 # (Except where explicitly superseded by other copyright notices)
13 # This work is made available to you under the terms of Version 2 of
14 # the GNU General Public License. A copy of that license should have
15 # been provided with this software, but in any event can be snarfed
18 # This work is distributed in the hope that it will be useful, but
19 # WITHOUT ANY WARRANTY; without even the implied warranty of
20 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
21 # General Public License for more details.
23 # You should have received a copy of the GNU General Public License
24 # along with this program; if not, write to the Free Software
25 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
26 # 02110-1301 or visit their web page on the internet at
27 # http://www.gnu.org/licenses/old-licenses/gpl-2.0.html.
30 # CONTRIBUTION SUBMISSION POLICY:
32 # (The following paragraph is not intended to limit the rights granted
33 # to you to modify and distribute this software under the terms of
34 # the GNU General Public License and is only of importance to you if
35 # you choose to contribute your changes and enhancements to the
36 # community by submitting them to Best Practical Solutions, LLC.)
38 # By intentionally submitting any modifications, corrections or
39 # derivatives to this work, or any other work intended for use with
40 # Request Tracker, to Best Practical Solutions, LLC, you confirm that
41 # you are the copyright holder for those contributions and you grant
42 # Best Practical Solutions, LLC a nonexclusive, worldwide, irrevocable,
43 # royalty-free, perpetual, license to use, copy, create derivative
44 # works based on those contributions, and sublicense and distribute
45 # those contributions and any derivatives thereof.
47 # END BPS TAGGED BLOCK }}}
49 package RT::Interface::Email::Auth::Crypt;
56 RT::Interface::Email::Auth::Crypt - decrypting and verifying protected emails
60 This mail plugin decrypts and verifies incoming emails. Supported
61 encryption protocols are GnuPG and SMIME.
63 This code is independant from code that encrypts/sign outgoing emails, so
64 it's possible to decrypt data without bringing in encryption. To enable
65 it put the module in the mail plugins list:
67 Set(@MailPlugins, 'Auth::MailFrom', 'Auth::Crypt', ...other filters...);
71 To use the gnupg-secured mail gateway, you need to do the following:
73 Set up a GnuPG key directory with a pubring containing only the keys
74 you care about and specify the following in your SiteConfig.pm
76 Set(%GnuPGOptions, homedir => '/opt/rt4/var/data/GnuPG');
78 Read also: L<RT::Crypt> and L<RT::Crypt::GnuPG>.
82 To use the SMIME-secured mail gateway, you need to do the following:
84 Set up a SMIME key directory with files containing keys for queues'
85 addresses and specify the following in your SiteConfig.pm
89 OpenSSL => '/usr/bin/openssl',
90 Keyring => '/opt/rt4/var/data/smime',
91 CAPath => '/opt/rt4/var/data/smime/signing-ca.pem',
93 'queue.address@example.com' => 'passphrase',
98 Read also: L<RT::Crypt> and L<RT::Crypt::SMIME>.
102 sub ApplyBeforeDecode { return 1 }
105 use RT::EmailParser ();
110 RawMessageRef => undef,
116 # we clean all possible headers
119 X-RT-Incoming-Encryption
120 X-RT-Incoming-Signature X-RT-Privacy
121 X-RT-Sign X-RT-Encrypt
123 map "X-RT-$_-Status", RT::Crypt->Protocols;
124 foreach my $p ( $args{'Message'}->parts_DFS ) {
125 $p->head->delete($_) for @headers;
128 my (@res) = RT::Crypt->VerifyDecrypt(
130 Entity => $args{'Message'},
133 if (RT->Config->Get('Crypt')->{'RejectOnUnencrypted'}) {
136 Template => 'Error: unencrypted message',
137 Arguments => { Message => $args{'Message'} },
139 return (-1, 'rejected because the message is unencrypted with RejectOnUnencrypted enabled');
142 $args{'Message'}->head->replace(
143 'X-RT-Incoming-Encryption' => 'Not encrypted'
149 if ( grep {$_->{'exit_code'}} @res ) {
150 my @fail = grep {$_->{status}{Status} ne "DONE"}
151 map { my %ret = %{$_}; map {+{%ret, status => $_}} RT::Crypt->ParseStatus( Protocol => $_->{Protocol}, Status => $_->{status})}
153 for my $fail ( @fail ) {
154 $RT::Logger->warning("Failure during ".$fail->{Protocol}." ". lc($fail->{status}{Operation}) . ": ". $fail->{status}{Message});
156 my $reject = HandleErrors( Message => $args{'Message'}, Result => \@res );
157 return (0, 'rejected because of problems during decrypting and verifying')
161 # attach the original encrypted message
162 $args{'Message'}->attach(
163 Type => 'application/x-rt-original-message',
164 Disposition => 'inline',
165 Data => ${ $args{'RawMessageRef'} },
169 my @check_protocols = RT::Crypt->EnabledOnIncoming;
170 foreach my $part ( $args{'Message'}->parts_DFS ) {
173 foreach my $protocol ( @check_protocols ) {
174 my @status = grep defined && length,
175 $part->head->get( "X-RT-$protocol-Status" );
178 push @found, $protocol;
180 for ( map RT::Crypt->ParseStatus( Protocol => $protocol, Status => "$_" ), @status ) {
181 if ( $_->{Operation} eq 'Decrypt' && $_->{Status} eq 'DONE' ) {
184 if ( $_->{Operation} eq 'Verify' && $_->{Status} eq 'DONE' ) {
185 $part->head->replace(
186 'X-RT-Incoming-Signature' => $_->{UserString}
192 $part->head->replace(
193 'X-RT-Incoming-Encryption' =>
194 $decrypted ? 'Success' : 'Not encrypted'
199 $args{'Message'}->head->replace( 'X-RT-Privacy' => $_ )
200 foreach grep !$seen{$_}++, @found;
215 foreach my $run ( @{ $args{'Result'} } ) {
216 my @status = RT::Crypt->ParseStatus( Protocol => $run->{'Protocol'}, Status => $run->{'status'} );
217 unless ( $sent_once{'NoPrivateKey'} ) {
218 unless ( CheckNoPrivateKey( Message => $args{'Message'}, Status => \@status ) ) {
219 $sent_once{'NoPrivateKey'}++;
220 $reject = 1 if RT->Config->Get('Crypt')->{'RejectOnMissingPrivateKey'};
223 unless ( $sent_once{'BadData'} ) {
224 unless ( CheckBadData( Message => $args{'Message'}, Status => \@status ) ) {
225 $sent_once{'BadData'}++;
226 $reject = 1 if RT->Config->Get('Crypt')->{'RejectOnBadData'};
233 sub CheckNoPrivateKey {
234 my %args = (Message => undef, Status => [], @_ );
235 my @status = @{ $args{'Status'} };
237 my @decrypts = grep $_->{'Operation'} eq 'Decrypt', @status;
238 return 1 unless @decrypts;
239 foreach my $action ( @decrypts ) {
240 # if at least one secrete key exist then it's another error
242 grep !$_->{'User'}{'SecretKeyMissing'},
243 @{ $action->{'EncryptedTo'} };
246 $RT::Logger->error("Couldn't decrypt a message: have no private key");
248 return EmailErrorToSender(
250 Template => 'Error: no private key',
251 Arguments => { Message => $args{'Message'} },
256 my %args = (Message => undef, Status => [], @_ );
257 my @bad_data_messages =
259 grep $_->{'Status'} ne 'DONE' && $_->{'Operation'} eq 'Data',
260 @{ $args{'Status'} };
261 return 1 unless @bad_data_messages;
263 return EmailErrorToSender(
265 Template => 'Error: bad encrypted data',
266 Arguments => { Messages => [ @bad_data_messages ] },
270 sub EmailErrorToSender {
273 $args{'Arguments'} ||= {};
274 $args{'Arguments'}{'TicketObj'} ||= $args{'Ticket'};
276 my $address = (RT::Interface::Email::ParseSenderAddressFromHead( $args{'Message'}->head ))[0];
277 my ($status) = RT::Interface::Email::SendEmailUsingTemplate(
279 Template => $args{'Template'},
280 Arguments => $args{'Arguments'},
281 InReplyTo => $args{'Message'},
284 $RT::Logger->error("Couldn't send '$args{'Template'}''");
289 RT::Base->_ImportOverlays();