April 2014 - tor-commits - lists.torproject.org

[bridgedb/master] Move email address parsers from bridgedb.Dist → bridgedb.parse.addr.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit dfe81deffb272e4585af141ad58ece7d68e352f8 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Apr 8 21:37:11 2014 +0000 Move email address parsers from bridgedb.Dist → bridgedb.parse.addr. --- lib/bridgedb/Dist.py | 117 +++------------------- lib/bridgedb/EmailServer.py | 41 ++++---- lib/bridgedb/Tests.py | 9 +- lib/bridgedb/parse/addr.py | 171 +++++++++++++++++++++++++++++++-- lib/bridgedb/test/test_EmailServer.py | 2 +- 5 files changed, 208 insertions(+), 132 deletions(-) diff --git a/lib/bridgedb/Dist.py b/lib/bridgedb/Dist.py index 5b5a602..4e0a1aa 100644 --- a/lib/bridgedb/Dist.py +++ b/lib/bridgedb/Dist.py @@ -28,9 +28,20 @@ from bridgedb.Filters import filterAssignBridgesToRing from bridgedb.Filters import filterBridgesByRules from bridgedb.Filters import filterBridgesByIP4 from bridgedb.Filters import filterBridgesByIP6 +from bridgedb.parse import addr +from bridgedb.parse.addr import UnsupportedDomain from bridgedb.safelog import logSafely +MAX_EMAIL_RATE = 3*3600 + +class IgnoreEmail(addr.BadEmail): + """Raised when we get requests from this address after rate warning.""" + +class TooSoonEmail(addr.BadEmail): + """Raised when we got a request from this address too recently.""" + + def uniformMap(ip): """Map an IP to an arbitrary 'area' string, such that any two /24 addresses get the same string. @@ -322,103 +333,6 @@ class IPBasedDistributor(Distributor): def dumpAssignments(self, f, description=""): self.splitter.dumpAssignments(f, description) - -# These characters are the ones that RFC2822 allows. -#ASPECIAL = '!#$%&*+-/=?^_`{|}~' -#ASPECIAL += "\\\'" -# These are the ones we're pretty sure we can handle right. -ASPECIAL = '-_+/=_~' - -ACHAR = r'[\w%s]' % "".join("\\%s"%c for c in ASPECIAL) -DOTATOM = r'%s+(?:\.%s+)*' % (ACHAR,ACHAR) -DOMAIN = r'\w+(?:\.\w+)*' -ADDRSPEC = r'(%s)\@(%s)' % (DOTATOM, DOMAIN) - -SPACE_PAT = re.compile(r'\s+') -ADDRSPEC_PAT = re.compile(ADDRSPEC) - -MAX_EMAIL_RATE = 3*3600 - -class BadEmail(Exception): - """Exception raised when we get a bad email address.""" - def __init__(self, msg, email): - Exception.__init__(self, msg) - self.email = email - -class UnsupportedDomain(BadEmail): - """Exception raised when we get an email address from a domain we - don't know.""" - -class TooSoonEmail(BadEmail): - """Raised when we got a request from this address too recently.""" - -class IgnoreEmail(BadEmail): - """Raised when we get requests from this address after rate warning.""" - -def extractAddrSpec(addr): - """Given an email From line, try to extract and parse the addrspec - portion. Returns localpart,domain on success; raises BadEmail - on failure. - """ - orig_addr = addr - addr = SPACE_PAT.sub(' ', addr) - addr = addr.strip() - # Only works on usual-form addresses; raises BadEmail on weird - # address form. That's okay, since we'll only get those when - # people are trying to fool us. - if '<' in addr: - # Take the _last_ index of <, so that we don't need to bother - # with quoting tricks. - idx = addr.rindex('<') - addr = addr[idx:] - m = re.search(r'<([^>]*)>', addr) - if m is None: - raise BadEmail("Couldn't extract address spec", orig_addr) - addr = m.group(1) - - # At this point, addr holds a putative addr-spec. We only allow the - # following form: - # addr-spec = local-part "@" domain - # local-part = dot-atom - # domain = dot-atom - # - # In particular, we are disallowing: obs-local-part, obs-domain, - # comment, obs-FWS, - # - # Other forms exist, but none of the incoming services we recognize - # support them. - addr = addr.replace(" ", "") - m = ADDRSPEC_PAT.match(addr) - if not m: - raise BadEmail("Bad address spec format", orig_addr) - localpart, domain = m.groups() - return localpart, domain - -def normalizeEmail(addr, domainmap, domainrules): - """Given the contents of a from line, and a map of supported email - domains (in lowercase), raise BadEmail or return a normalized - email address. - """ - addr = addr.lower() - localpart, domain = extractAddrSpec(addr) - if domainmap is not None: - domain = domainmap.get(domain, None) - if domain is None: - raise UnsupportedDomain("Domain not supported", addr) - - #XXXX Do these rules also hold for Yahoo? - - # addr+foo@ is an alias for addr@ - idx = localpart.find('+') - if idx >= 0: - localpart = localpart[:idx] - rules = domainrules.get(domain, []) - if 'ignore_dots' in rules: - # j.doe@ is the same as jdoe@. - localpart = localpart.replace(".", "") - - return "%s@%s"%(localpart, domain) - class EmailBasedDistributor(Distributor): """Object that hands out bridges based on the email address of an incoming request and the current time period. @@ -475,12 +389,13 @@ class EmailBasedDistributor(Distributor): bridgeFilterRules=[] now = time.time() try: - emailaddress = normalizeEmail(emailaddress, self.domainmap, - self.domainrules) - except BadEmail as err: + emailaddress = addr.normalizeEmail(emailaddress, self.domainmap, + self.domainrules) + except addr.BadEmail as err: logging.warn(err) return [] - if emailaddress is None: + + if not emailaddress: return [] #XXXX raise an exception. with bridgedb.Storage.getDB() as db: diff --git a/lib/bridgedb/EmailServer.py b/lib/bridgedb/EmailServer.py index f9f43bb..e1aa57e 100644 --- a/lib/bridgedb/EmailServer.py +++ b/lib/bridgedb/EmailServer.py @@ -26,7 +26,6 @@ from twisted.mail import smtp from zope.interface import implements -from bridgedb.Dist import BadEmail, TooSoonEmail, IgnoreEmail from bridgedb import Dist from bridgedb import I18n from bridgedb import safelog @@ -34,6 +33,10 @@ from bridgedb.Filters import filterBridgesByIP6 from bridgedb.Filters import filterBridgesByIP4 from bridgedb.Filters import filterBridgesByTransport from bridgedb.Filters import filterBridgesByNotBlockedIn +from bridgedb.parse import addr +from bridgedb.parse.addr import BadEmail +from bridgedb.parse.addr import UnsupportedDomain +from bridgedb.parse.addr import canonicalizeEmailDomain class MailFile: @@ -97,23 +100,24 @@ def getMailResponse(lines, ctx): lang = getLocaleFromPlusAddr(clientToaddr) t = I18n.getLang(lang) + canon = ctx.cfg.EMAIL_DOMAIN_MAP + for domain, rule in ctx.cfg.EMAIL_DOMAIN_RULES.items(): + if domain not in canon.keys(): + canon[domain] = domain + for domain in ctx.cfg.EMAIL_DOMAINS: + canon[domain] = domain + try: - _, addrdomain = Dist.extractAddrSpec(clientAddr.lower()) - except BadEmail: - logging.info("Ignoring bad address on incoming email.") + _, clientDomain = addr.extractEmailAddress(clientAddr.lower()) + canonical = canonicalizeEmailDomain(clientDomain, canon) + except UnsupportedDomain as error: + logging.warn(error) return None, None - - if not addrdomain: - logging.info("Couldn't parse domain from %r" % clientAddr) - - if addrdomain and ctx.cfg.EMAIL_DOMAIN_MAP: - addrdomain = ctx.cfg.EMAIL_DOMAIN_MAP.get(addrdomain, addrdomain) - - if addrdomain not in ctx.cfg.EMAIL_DOMAINS: - logging.warn("Unrecognized email domain %r", addrdomain) + except BadEmail as error: + logging.warn(error) return None, None - rules = ctx.cfg.EMAIL_DOMAIN_RULES.get(addrdomain, []) + rules = ctx.cfg.EMAIL_DOMAIN_RULES.get(canonical, []) if 'dkim' in rules: # getheader() returns the last of a given kind of header; we want @@ -123,8 +127,8 @@ def getMailResponse(lines, ctx): if dkimHeaders: dkimHeader = dkimHeaders[0] if not dkimHeader.startswith("pass"): - logging.info("Got a bad dkim header (%r) on an incoming mail; " - "rejecting it.", dkimHeader) + logging.info("Rejecting bad DKIM header on incoming email: %r " + % dkimHeader) return None, None # Was the magic string included @@ -186,17 +190,16 @@ def getMailResponse(lines, ctx): bridgeFilterRules=bridgeFilterRules) # Handle rate limited email - except TooSoonEmail as err: + except Dist.TooSoonEmail as err: logging.info("Got a mail too frequently; warning '%s': %s." % (clientAddr, err)) - # Compose a warning email # MAX_EMAIL_RATE is in seconds, convert to hours body = buildSpamWarningTemplate(t) % (Dist.MAX_EMAIL_RATE / 3600) return composeEmail(ctx.fromAddr, clientAddr, subject, body, msgID, gpgContext=ctx.gpgContext) - except IgnoreEmail as err: + except Dist.IgnoreEmail as err: logging.info("Got a mail too frequently; ignoring '%s': %s." % (clientAddr, err)) return None, None diff --git a/lib/bridgedb/Tests.py b/lib/bridgedb/Tests.py index 72dfe5e..4147549 100644 --- a/lib/bridgedb/Tests.py +++ b/lib/bridgedb/Tests.py @@ -232,10 +232,11 @@ class EmailBridgeDistTests(unittest.TestCase): def testUnsupportedDomain(self): db = self.db - self.assertRaises(bridgedb.Dist.UnsupportedDomain, - bridgedb.Dist.normalizeEmail, 'bad(a)email.com', - {'example.com':'example.com'}, - {'example.com':[]}) + self.assertRaises(bridgedb.parse.addr.UnsupportedDomain, + bridgedb.parse.addr.normalizeEmail, + 'bad(a)email.com', + {'example.com':'example.com'}, + {'example.com':[]}) class IPBridgeDistTests(unittest.TestCase): def dumbAreaMapper(self, ip): diff --git a/lib/bridgedb/parse/addr.py b/lib/bridgedb/parse/addr.py index 455b953..f34f416 100644 --- a/lib/bridgedb/parse/addr.py +++ b/lib/bridgedb/parse/addr.py @@ -13,19 +13,22 @@ ** Module Overview: ** -.. +:: parse ||_ parse.addr - | |_ isIPAddress - Check if an arbitrary string is an IP address. - | |_ isIPv4 - Check if an arbitrary string is an IPv4 address. - | |_ isIPv6 - Check if an arbitrary string is an IPv6 address. - | \_ isValidIP - Check that an IP address is valid. + | | |_ extractEmailAddress - Validate a :rfc:2822 email address. + | | |_ isIPAddress - Check if an arbitrary string is an IP address. + | | |_ isIPv4 - Check if an arbitrary string is an IPv4 address. + | | |_ isIPv6 - Check if an arbitrary string is an IPv6 address. + | | \_ isValidIP - Check that an IP address is valid. + | | + | |_ :class:`PortList` - A container class for validated port ranges. | - |__ :mod:`bridgedbparse.headers` + |__ :mod:`bridgedb.parse.headers` |__ :mod:`bridgedb.parse.options` \__ :mod:`bridgedb.parse.versions` -.. +:: Private IP Address Ranges: '''''''''''''''''''''''''' @@ -147,12 +150,119 @@ from __future__ import print_function from __future__ import unicode_literals import logging +import re + import ipaddr +#: These are the special characters which RFC2822 allows within email addresses: +#ASPECIAL = '!#$%&*+-/=?^_`{|}~' + "\\\'" +#: These are the ones we're pretty sure we can handle right: +ASPECIAL = '-_+/=_~' +ACHAR = r'[\w%s]' % "".join("\\%s" % c for c in ASPECIAL) +DOTATOM = r'%s+(?:\.%s+)*' % (ACHAR, ACHAR) +DOMAIN = r'\w+(?:\.\w+)*' +ADDRSPEC = r'(%s)\@(%s)' % (DOTATOM, DOMAIN) +SPACE_PAT = re.compile(r'\s+') +#: A compiled regex with matches RFC2822 email address strings: +ADDRSPEC_PAT = re.compile(ADDRSPEC) + + +class BadEmail(Exception): + """Exception raised when we get a bad email address.""" + def __init__(self, msg, email): + Exception.__init__(self, msg) + self.email = email + class InvalidPort(ValueError): """Raised when a given port number is invalid.""" +class UnsupportedDomain(ValueError): + """Raised when we get an email address from an unsupported domain.""" + + +def canonicalizeEmailDomain(domain, domainmap): + """Decide if an email was sent from a permitted domain. + + :param str domain: The domain portion of an email address to validate. It + will be checked that it is one of the domains allowed to email + requests for bridges to the + :class:`~bridgedb.Dist.EmailBasedDistributor`. + :param dict domainmap: A map of permitted alternate domains (in lowercase) + to their canonical domain names (in lowercase). This can be configured + with the ``EMAIL_DOMAIN_MAP`` option in ``bridgedb.conf``, for + example:: + EMAIL_DOMAIN_MAP = {'mail.google.com': 'gmail.com', + 'googlemail.com': 'gmail.com'} + :raises UnsupportedDomain: if the domain portion of the email address is + not within the map of alternate to canonical allowed domain names. + :rtype: str + :returns: The canonical domain name for the email address. + """ + permitted = None + + try: + permitted = domainmap.get(domain) + except AttributeError: + logging.debug("Got non-dict for 'domainmap' parameter: %r" % domainmap) + + if not permitted: + raise UnsupportedDomain("Domain not permitted: %s" % domain) + + return permitted + +def extractEmailAddress(emailaddr): + """Given an email address, obtained, for example, via a ``From:`` or + ``Sender:`` email header, try to extract and parse (according to + :rfc:2822) the username and domain portions. Returns ``(username, + domain)`` on success; raises BadEmail on failure. + + We only allow the following form:: + ADDRSPEC := LOCAL_PART "@" DOMAIN + LOCAL_PART := DOTATOM + DOMAIN := DOTATOM + + In particular, we are disallowing: obs-local-part, obs-domain, comment, + and obs-FWS. Other forms exist, but none of the incoming services we + recognize support them. + + :param emailaddr: An email address to validate. + :raises BadEmail: if the **emailaddr** couldn't be validated or parsed. + :rtype: tuple + :returns: A tuple of the validated email address, containing the mail + username and the domain:: + (LOCALPART, DOMAIN) + """ + orig = emailaddr + + try: + addr = SPACE_PAT.sub(' ', emailaddr).strip() + except TypeError as error: + logging.debug(error) + raise BadEmail("Can't extract address from object type %r!" + % type(orig), orig) + + # Only works on usual-form addresses; raises BadEmail on weird + # address form. That's okay, since we'll only get those when + # people are trying to fool us. + if '<' in addr: + # Take the _last_ index of <, so that we don't need to bother + # with quoting tricks. + idx = addr.rindex('<') + addr = addr[idx:] + m = re.search(r'<([^>]*)>', addr) + if m is None: + raise BadEmail("Couldn't extract address spec", orig) + addr = m.group(1) + + # At this point, addr holds a putative addr-spec. + addr = addr.replace(" ", "") + m = ADDRSPEC_PAT.match(addr) + if not m: + raise BadEmail("Bad address spec format", orig) + + localpart, domain = m.groups() + return localpart, domain def isIPAddress(ip, compressed=True): """Check if an arbitrary string is an IP address, and that it's valid. @@ -275,6 +385,53 @@ def isValidIP(ip): return False return True +def normalizeEmail(emailaddr, domainmap, domainrules, ignorePlus=True): + """Normalise an email address according to the processing rules for its + canonical originating domain. + + The email address, **emailaddr**, will be parsed and validated, and then + checked that it originated from one of the domains allowed to email + requests for bridges to the :class:`~bridgedb.Dist.EmailBasedDistributor` + via the :func:`canonicaliseEmailDomain` function. + + :param str emailaddr: An email address to normalise. + :param dict domainmap: A map of permitted alternate domains (in lowercase) + to their canonical domain names (in lowercase). This can be configured + with the ``EMAIL_DOMAIN_MAP`` option in ``bridgedb.conf``, for + example:: + EMAIL_DOMAIN_MAP = {'mail.google.com': 'gmail.com', + 'googlemail.com': 'gmail.com'} + :param dict domainrules: A mapping of canonical permitted domain names to + a list of rules which should be applied to processing them, for + example:: + EMAIL_DOMAIN_RULES = {'gmail.com': ["ignore_dots", "dkim"] + Currently, ``"ignore_dots"`` means that all ``"."`` characters will be + removed from the local part of the validated email address. + :param bool ignorePlus: If ``True``, assume that + ``blackhole+kerr(a)torproject.org`` is an alias for + ``blackhole(a)torproject.org``, and remove everything after the first + ``'+'`` character. + :raises BadEmail: if the email address could not be parsed or validated. + :rtype: str + :returns: The validated, normalised email address, if it was from a + permitted domain. Otherwise, returns an empty string. + """ + emailaddr = emailaddr.lower() + localpart, domain = extractEmailAddress(emailaddr) + canonical = canonicalizeEmailDomain(domain, domainmap) + + if ignorePlus: + idx = localpart.find('+') + if idx >= 0: + localpart = localpart[:idx] + + rules = domainrules.get(canonical, []) + if 'ignore_dots' in rules: + localpart = localpart.replace(".", "") + + normalized = "%s@%s" % (localpart, domain) + return normalized + class PortList(object): """A container class for validated port ranges. diff --git a/lib/bridgedb/test/test_EmailServer.py b/lib/bridgedb/test/test_EmailServer.py index f828be7..8521762 100644 --- a/lib/bridgedb/test/test_EmailServer.py +++ b/lib/bridgedb/test/test_EmailServer.py @@ -20,10 +20,10 @@ from io import StringIO import copy from bridgedb import EmailServer -from bridgedb.Dist import BadEmail from bridgedb.Dist import EmailBasedDistributor from bridgedb.EmailServer import MailContext from bridgedb.Time import NoSchedule +from bridgedb.parse.addr import BadEmail from bridgedb.persistent import Conf from bridgedb.test.util import fileCheckDecorator

1 0

[bridgedb/master] Always return a Deferred from EmailServer.composeMail().
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 71127f9d2e41bec4462f979ed4d2e42d6a0be2c8 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 22:24:15 2014 +0000 Always return a Deferred from EmailServer.composeMail(). --- lib/bridgedb/EmailServer.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/lib/bridgedb/EmailServer.py b/lib/bridgedb/EmailServer.py index 58ab3b5..5d998f4 100644 --- a/lib/bridgedb/EmailServer.py +++ b/lib/bridgedb/EmailServer.py @@ -276,22 +276,25 @@ def replyToMail(lines, ctx): :param list lines: A list of lines from an incoming email message. :type ctx: :class:`MailContext` :param ctx: The configured context for the email server. + :rtype: :api:`twisted.internet.defer.Deferred` + :returns: A ``Deferred`` which will callback when the response has been + successfully sent, or errback if an error occurred while sending the + email. """ logging.info("Got an email; deciding whether to reply.") sendToUser, response = getMailResponse(lines, ctx) + d = defer.Deferred() + if response is None: - logging.debug("We don't really feel like talking to %s right now." - % sendToUser) - return + logging.debug("We don't feel like talking to %s." % sendToUser) + return d response.seek(0) - - d = defer.Deferred() + logging.info("Sending reply to %s" % sendToUser) factory = smtp.SMTPSenderFactory(ctx.smtpFromAddr, sendToUser, response, d, retries=0, timeout=30) d.addErrback(_ebReplyToMailFailure) - logging.info("Sending reply to %s" % sendToUser) reactor.connectTCP(ctx.smtpServer, ctx.smtpPort, factory) return d

1 0

[bridgedb/master] Implement correct EmailServer.MailDelivery.receivedHeader() parsing.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 714c16a8f0875c23af1cb044cc46a76e5356ac6e Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 22:29:23 2014 +0000 Implement correct EmailServer.MailDelivery.receivedHeader() parsing. --- lib/bridgedb/EmailServer.py | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/lib/bridgedb/EmailServer.py b/lib/bridgedb/EmailServer.py index 5d998f4..efa7514 100644 --- a/lib/bridgedb/EmailServer.py +++ b/lib/bridgedb/EmailServer.py @@ -432,8 +432,21 @@ class MailDelivery(object): self.ctx = ctx def receivedHeader(self, helo, origin, recipients): - #XXXX what is this for? what should it be? - return "Received: BridgeDB" + """Create the ``Received:`` header for an incoming email. + + :type helo: tuple + :param helo: The lines received during SMTP client HELO. + :type origin: :api:`twisted.mail.smtp.Address` + :param origin: The email address of the sender. + :type recipients: list + :param recipients: A list of :api:`twisted.mail.smtp.User` instances. + """ + cameFrom = "%s (%s [%s])" % (helo[0] or origin, helo[0], helo[1]) + cameFor = ', '.join(["<{0}>".format(recp.dest) for recp in recipients]) + hdr = str("Received: from %s for %s; %s" % (cameFrom, cameFor, + smtp.rfc822date())) + return hdr + def validateFrom(self, helo, origin): return origin

1 0

[bridgedb/master] Rewrite EmailServer.getMailResponse() to handle unicode.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 26198f5f513a77364965b29a19a9fe4bf58a015b Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 22:18:29 2014 +0000 Rewrite EmailServer.getMailResponse() to handle unicode. * FIXES #11522 * REMOVES EmailServer.MailFile class. * CHANGES EmailServer to use twisted.mail.smtp.rfc822 instead of rfc822. --- lib/bridgedb/EmailServer.py | 75 +++++++++++++++++++++++-------------------- 1 file changed, 40 insertions(+), 35 deletions(-) diff --git a/lib/bridgedb/EmailServer.py b/lib/bridgedb/EmailServer.py index db2cf80..58ab3b5 100644 --- a/lib/bridgedb/EmailServer.py +++ b/lib/bridgedb/EmailServer.py @@ -13,7 +13,6 @@ import gpgme import io import logging import re -import rfc822 import time from ipaddr import IPv4Address @@ -39,19 +38,6 @@ from bridgedb.parse.addr import UnsupportedDomain from bridgedb.parse.addr import canonicalizeEmailDomain -class MailFile: - """A file-like object used to hand rfc822.Message a list of lines - as though it were reading them from a file.""" - def __init__(self, lines): - self.lines = lines - self.idx = 0 - def readline(self): - try : - line = self.lines[self.idx] - self.idx += 1 - return line - except IndexError: - return "" def getBridgeDBEmailAddrFromList(ctx, address_list): """Loop through a list of (full name, email address) pairs and look up our @@ -77,27 +63,50 @@ def getMailResponse(lines, ctx): will receive the response, and a readable filelike object containing the response. Return None,None if we shouldn't answer. """ + raw = io.StringIO() + raw.writelines([unicode('{0}\n'.format(line)) for line in lines]) + raw.seek(0) + + msg = smtp.rfc822.Message(raw) # Extract data from the headers. - msg = rfc822.Message(MailFile(lines)) - subject = msg.getheader("Subject", None) - if not subject: subject = "[no subject]" - clientFromAddr = msg.getaddr("From") - clientSenderAddr = msg.getaddr("Sender") + msgID = msg.getheader("Message-ID", None) + subject = msg.getheader("Subject", None) or "[no subject]" + + fromHeader = msg.getaddr("From") + senderHeader = msg.getaddr("Sender") + + clientAddrHeader = None + try: + clientAddrHeader = fromHeader[1] + except (IndexError, TypeError, AttributeError): + pass + + if not clientAddrHeader: + logging.warn("No From header on incoming mail.") + try: + clientAddrHeader = senderHeader[1] + except (IndexError, TypeError, AttributeError): + pass + + if not clientAddrHeader: + logging.warn("No Sender header on incoming mail.") + return None, None + + try: + clientAddr = addr.normalizeEmail(clientAddrHeader, + ctx.cfg.EMAIL_DOMAIN_MAP, + ctx.cfg.EMAIL_DOMAIN_RULES) + except (UnsupportedDomain, BadEmail) as error: + logging.warn(error) + return None, None + # RFC822 requires at least one 'To' address clientToList = msg.getaddrlist("To") - clientToaddr = getBridgeDBEmailAddrFromList(ctx, clientToList) - msgID = msg.getheader("Message-ID", None) - if clientSenderAddr and clientSenderAddr[1]: - clientAddr = clientSenderAddr[1] - elif clientFromAddr and clientFromAddr[1]: - clientAddr = clientFromAddr[1] - else: - logging.info("No From or Sender header on incoming mail.") - return None,None + clientToAddr = getBridgeDBEmailAddrFromList(ctx, clientToList) # Look up the locale part in the 'To:' address, if there is one and get # the appropriate Translation object - lang = getLocaleFromPlusAddr(clientToaddr) + lang = getLocaleFromPlusAddr(clientToAddr) t = I18n.getLang(lang) canon = ctx.cfg.EMAIL_DOMAIN_MAP @@ -110,10 +119,7 @@ def getMailResponse(lines, ctx): try: _, clientDomain = addr.extractEmailAddress(clientAddr.lower()) canonical = canonicalizeEmailDomain(clientDomain, canon) - except UnsupportedDomain as error: - logging.warn(error) - return None, None - except BadEmail as error: + except (UnsupportedDomain, BadEmail) as error: logging.warn(error) return None, None @@ -209,6 +215,7 @@ def getMailResponse(lines, ctx): % (clientAddr, err)) return None, None + answer = "(no bridges currently available)" if bridges: with_fp = ctx.cfg.EMAIL_INCLUDE_FINGERPRINTS answer = "".join(" %s\n" % b.getConfigLine( @@ -216,8 +223,6 @@ def getMailResponse(lines, ctx): addressClass=addressClass, transport=transport, request=clientAddr) for b in bridges) - else: - answer = "(no bridges currently available)" body = buildMessageTemplate(t) % answer # Generate the message.

1 0

[bridgedb/master] Fix test_EmailServer unittests which expected StringIO.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 711043a94221061754600addf0cd9707b3628590 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 20:23:27 2014 +0000 Fix test_EmailServer unittests which expected StringIO. --- lib/bridgedb/test/test_EmailServer.py | 44 ++++++++++++++++++--------------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/lib/bridgedb/test/test_EmailServer.py b/lib/bridgedb/test/test_EmailServer.py index 8521762..3676642 100644 --- a/lib/bridgedb/test/test_EmailServer.py +++ b/lib/bridgedb/test/test_EmailServer.py @@ -16,7 +16,7 @@ from __future__ import print_function import os import shutil -from io import StringIO +import io import copy from bridgedb import EmailServer @@ -32,7 +32,7 @@ from twisted.internet import defer from twisted.trial import unittest -TEST_CONFIG_FILE = StringIO(unicode("""\ +TEST_CONFIG_FILE = io.StringIO(unicode("""\ EMAIL_DIST = True EMAIL_GPG_SIGNING_ENABLED = True EMAIL_GPG_SIGNING_KEY = 'TESTING.subkeys.sec' @@ -52,6 +52,20 @@ EMAIL_BIND_IP = "127.0.0.1" EMAIL_PORT = 5225 """)) +def _createMailContext(distributor=None): + configuration = {} + TEST_CONFIG_FILE.seek(0) + compiled = compile(TEST_CONFIG_FILE.read(), '<string>', 'exec') + exec compiled in configuration + config = Conf(**configuration) + + if not distributor: + distributor = FakeDistributor('key', {}, {}, []) + + ctx = MailContext(config, distributor, NoSchedule()) + return ctx + + class FakeDistributor(EmailBasedDistributor): def __init__(self, key, domainmap, domainrules, answerParameters=None, bridges=None): @@ -132,17 +146,12 @@ class EmailGnuPGTest(unittest.TestCase): ctx = EmailServer.getGPGContext(self.config) self.assertTrue(ctx is None) + class EmailResponseTests(unittest.TestCase): """Tests for :func:`bridgedb.EmailServer.getMailResponse`.""" def setUp(self): """Create fake email, distributor, and associated context data.""" - configuration = {} - TEST_CONFIG_FILE.seek(0) - compiled = compile(TEST_CONFIG_FILE.read(), '<string>', 'exec') - exec compiled in configuration - self.config = Conf(**configuration) - # TODO: Add headers if we start validating them self.lines = ["From: %s(a)%s.com", "To: bridges(a)example.net", @@ -150,7 +159,7 @@ class EmailResponseTests(unittest.TestCase): "\n", "get bridges"] self.distributor = FakeDistributor('key', {}, {}, []) - self.ctx = MailContext(self.config, self.distributor, NoSchedule()) + self.ctx = _createMailContext(self.distributor) def test_getMailResponse_noFrom(self): """A received email without a "From:" or "Sender:" header shouldn't @@ -221,7 +230,7 @@ class EmailResponseTests(unittest.TestCase): self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], StringIO) + self.assertIsInstance(ret[1], io.BytesIO) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) @@ -234,7 +243,7 @@ class EmailResponseTests(unittest.TestCase): self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], StringIO) + self.assertIsInstance(ret[1], io.BytesIO) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) @@ -249,7 +258,7 @@ class EmailResponseTests(unittest.TestCase): self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], StringIO) + self.assertIsInstance(ret[1], io.BytesIO) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) @@ -265,7 +274,7 @@ class EmailResponseTests(unittest.TestCase): self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], StringIO) + self.assertIsInstance(ret[1], io.BytesIO) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) @@ -275,12 +284,6 @@ class EmailReplyTests(unittest.TestCase): def setUp(self): """Create fake email, distributor, and associated context data.""" - configuration = {} - TEST_CONFIG_FILE.seek(0) - compiled = compile(TEST_CONFIG_FILE.read(), '<string>', 'exec') - exec compiled in configuration - self.config = Conf(**configuration) - # TODO: Add headers if we start validating them self.lines = ["From: %s(a)%s.com", "To: bridges(a)example.net", @@ -288,7 +291,7 @@ class EmailReplyTests(unittest.TestCase): "\n", "get bridges"] self.distributor = FakeDistributor('key', {}, {}, []) - self.ctx = MailContext(self.config, self.distributor, NoSchedule()) + self.ctx = _createMailContext(self.distributor) def test_replyToMail(self): self.skip = True @@ -307,6 +310,7 @@ class EmailReplyTests(unittest.TestCase): reply.addCallback(callback) return reply + class EmailServerServiceTests(unittest.TestCase): def setUp(self): configuration = {}

1 0

[bridgedb/master] Add crypto.gpgSignMessage() utility function.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit b2c7a2a20ca07dec8dd7c9a812f8173127c45b3a Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 22:41:48 2014 +0000 Add crypto.gpgSignMessage() utility function. --- lib/bridgedb/EmailServer.py | 1 + lib/bridgedb/crypto.py | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/lib/bridgedb/EmailServer.py b/lib/bridgedb/EmailServer.py index eed96bf..65a3ccd 100644 --- a/lib/bridgedb/EmailServer.py +++ b/lib/bridgedb/EmailServer.py @@ -29,6 +29,7 @@ from bridgedb import Dist from bridgedb import I18n from bridgedb import safelog from bridgedb.crypto import getGPGContext +from bridgedb.crypto import gpgSignMessage from bridgedb.Filters import filterBridgesByIP6 from bridgedb.Filters import filterBridgesByIP4 from bridgedb.Filters import filterBridgesByTransport diff --git a/lib/bridgedb/crypto.py b/lib/bridgedb/crypto.py index 5c68794..ebab733 100644 --- a/lib/bridgedb/crypto.py +++ b/lib/bridgedb/crypto.py @@ -347,6 +347,32 @@ def getGPGContext(cfg): return ctx +def gpgSignMessage(gpgmeCtx, messageString, mode=None): + """Sign a **messageString** with a GPGME context. + + :param gpgmeCtx: A ``gpgme.Context`` initialised with the appropriate + settings. + :param str messageString: The message to sign. + :param mode: The signing mode. (default: ``gpgme.SIG_MODE_CLEAR``) + :rtype: tuple + :returns: A 2-tuple of ``(signature, list)``, where: + * ``signature`` is the ascii-armored signature text. + * ``list`` is a list of ``gpgme.NewSignature``s. + + .. warning:: The returned signature text and list *may* be empty, if no + signature was created. + """ + if not mode: + mode = gpgme.SIG_MODE_CLEAR + + msgFile = io.StringIO(unicode(messageString)) + sigFile = io.StringIO() + sigList = gpgmeCtx.sign(msgFile, sigFile, mode) + sigFile.seek(0) + signature = sigFile.read() + + return (signature, sigList) + class SSLVerifyingContextFactory(ssl.CertificateOptions): """``OpenSSL.SSL.Context`` factory which does full certificate-chain and

1 0

[bridgedb/master] Fix broken test_EmailServer unittests due to extra newline.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 84c58ed6cc0b5ae4f50ed5f5e5623304c37f2526 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Apr 17 02:44:57 2014 +0000 Fix broken test_EmailServer unittests due to extra newline. --- lib/bridgedb/test/test_EmailServer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/test/test_EmailServer.py b/lib/bridgedb/test/test_EmailServer.py index d6d2f55..9e5db06 100644 --- a/lib/bridgedb/test/test_EmailServer.py +++ b/lib/bridgedb/test/test_EmailServer.py @@ -171,7 +171,7 @@ class EmailResponseTests(unittest.TestCase): self.lines = ["From: %s(a)%s.com", "To: bridges(a)example.net", "Subject: testing", - "\n", + "", "get bridges"] self.ctx = _createMailContext()

1 0

[bridgedb/master] Rewrite test_EmailServer.FakeDistributor → test_EmailServer.DummyEmailDistibutor.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 208b2d3bb116190801c469aea3af420ddcdf7396 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Apr 17 02:43:29 2014 +0000 Rewrite test_EmailServer.FakeDistributor → test_EmailServer.DummyEmailDistibutor. --- lib/bridgedb/test/test_EmailServer.py | 61 ++++++++++++++++++--------------- 1 file changed, 34 insertions(+), 27 deletions(-) diff --git a/lib/bridgedb/test/test_EmailServer.py b/lib/bridgedb/test/test_EmailServer.py index 3676642..d6d2f55 100644 --- a/lib/bridgedb/test/test_EmailServer.py +++ b/lib/bridgedb/test/test_EmailServer.py @@ -25,6 +25,7 @@ from bridgedb.EmailServer import MailContext from bridgedb.Time import NoSchedule from bridgedb.parse.addr import BadEmail from bridgedb.persistent import Conf +from bridgedb.test.test_HTTPServer import DummyBridge from bridgedb.test.util import fileCheckDecorator from twisted.python import log @@ -34,9 +35,13 @@ from twisted.trial import unittest TEST_CONFIG_FILE = io.StringIO(unicode("""\ EMAIL_DIST = True +EMAIL_INCLUDE_FINGERPRINTS = True EMAIL_GPG_SIGNING_ENABLED = True EMAIL_GPG_SIGNING_KEY = 'TESTING.subkeys.sec' -EMAIL_DOMAIN_MAP = {} +EMAIL_DOMAIN_MAP = { + 'googlemail.com': 'gmail.com', + 'mail.google.com': 'gmail.com', +} EMAIL_DOMAIN_RULES = { 'gmail.com': ["ignore_dots", "dkim"], 'example.com': [], @@ -60,25 +65,35 @@ def _createMailContext(distributor=None): config = Conf(**configuration) if not distributor: - distributor = FakeDistributor('key', {}, {}, []) + distributor = DummyEmailDistributor( + domainmap=config.EMAIL_DOMAIN_MAP, + domainrules=config.EMAIL_DOMAIN_RULES) ctx = MailContext(config, distributor, NoSchedule()) return ctx -class FakeDistributor(EmailBasedDistributor): - def __init__(self, key, domainmap, domainrules, answerParameters=None, - bridges=None): - super(FakeDistributor, self).__init__(key, domainmap, domainrules, - answerParameters) - if bridges: - self.bridges = bridges - else: - self.bridges = [] +class DummyEmailDistributor(object): + """A mocked :class:`bridgedb.Dist.EmailBasedDistributor` which is used to + test :class:`bridgedb.EmailServer`. + """ - def getBridgesForEmail(self, emailaddr, epoch, N=1, - parameters=None, countryCode=None, bridgeFilterRules=None): - return self.bridges[:N] + def __init__(self, key=None, domainmap=None, domainrules=None, + answerParameters=None): + """None of the parameters are really used, except ``ctx`` ― they are + just there to retain an identical method signature. + """ + self.key = self.__class__.__name__ + self.domainmap = domainmap + self.domainrules = domainrules + self.answerParameters = answerParameters + + def getBridgesForEmail(self, emailaddress, epoch, N=1, parameters=None, + countryCode=None, bridgeFilterRules=None): + """Needed because it's called in + :meth:`WebResourceBridges.getBridgesForIP`. + """ + return [DummyBridge() for _ in xrange(N)] class EmailGnuPGTest(unittest.TestCase): @@ -158,8 +173,7 @@ class EmailResponseTests(unittest.TestCase): "Subject: testing", "\n", "get bridges"] - self.distributor = FakeDistributor('key', {}, {}, []) - self.ctx = _createMailContext(self.distributor) + self.ctx = _createMailContext() def test_getMailResponse_noFrom(self): """A received email without a "From:" or "Sender:" header shouldn't @@ -290,8 +304,7 @@ class EmailReplyTests(unittest.TestCase): "Subject: testing", "\n", "get bridges"] - self.distributor = FakeDistributor('key', {}, {}, []) - self.ctx = _createMailContext(self.distributor) + self.ctx = _createMailContext() def test_replyToMail(self): self.skip = True @@ -313,20 +326,14 @@ class EmailReplyTests(unittest.TestCase): class EmailServerServiceTests(unittest.TestCase): def setUp(self): - configuration = {} - TEST_CONFIG_FILE.seek(0) - compiled = compile(TEST_CONFIG_FILE.read(), '<string>', 'exec') - exec compiled in configuration - self.config = Conf(**configuration) - # TODO: Add headers if we start validating them self.lines = ["From: %s(a)%s.com", "To: %s(a)example.net", "Subject: testing", "\n", "get bridges"] - self.distributor = FakeDistributor('key', {}, {}, []) - self.ctx = MailContext(self.config, self.distributor, NoSchedule()) + self.distributor = DummyEmailDistributor('key', {}, {}, []) + self.ctx = _createMailContext(self.distributor) def test_receiveMail(self): self.skip = True raise unittest.SkipTest("Not finished yet") from twisted.internet import reactor - EmailServer.addSMTPServer(self.config, self.distributor, NoSchedule) + EmailServer.addSMTPServer(self.ctx.cfg, self.distributor, NoSchedule)

1 0

[bridgedb/master] Move EmailServer.getGPGContext() → crypto.getGPGContext().
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 7b75cff76edac559e6dbf6f24584e86f948aa597 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 22:33:33 2014 +0000 Move EmailServer.getGPGContext() → crypto.getGPGContext(). * ADD new class, `bridgedb.crypto.LessCrypticGpgmeError` for parsing GPGME errors. Usually, these errors are just a tuple of integers, i.e.: (7, 32586, "Unsupported command") which means absolutely nothing to me, and is not helping with debugging. It takes a `gpgme.GpgmeError` as its initialisation argument, and it automatically makes sense of the stupid thing. Consequently, the getGPGContext() and signing done with GPGME now have better error handling. --- lib/bridgedb/EmailServer.py | 66 +------------------ lib/bridgedb/crypto.py | 153 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 154 insertions(+), 65 deletions(-) diff --git a/lib/bridgedb/EmailServer.py b/lib/bridgedb/EmailServer.py index efa7514..eed96bf 100644 --- a/lib/bridgedb/EmailServer.py +++ b/lib/bridgedb/EmailServer.py @@ -28,6 +28,7 @@ from zope.interface import implements from bridgedb import Dist from bridgedb import I18n from bridgedb import safelog +from bridgedb.crypto import getGPGContext from bridgedb.Filters import filterBridgesByIP6 from bridgedb.Filters import filterBridgesByIP4 from bridgedb.Filters import filterBridgesByTransport @@ -500,68 +501,3 @@ def addSMTPServer(cfg, dist, sched): lc = LoopingCall(dist.cleanDatabase) lc.start(1800, now=False) return factory - - - - - -def getGPGContext(cfg): - """Import a key from a file and initialise a context for GnuPG operations. - - The key should not be protected by a passphrase, and should have the - signing flag enabled. - - :type cfg: :class:`bridgedb.persistent.Conf` - :param cfg: The loaded config file. - :rtype: :class:`gpgme.Context` or None - :returns: A GPGME context with the signers initialized by the keyfile - specified by the option EMAIL_GPG_SIGNING_KEY in bridgedb.conf, or - None if the option was not enabled, or was unable to initialize. - """ - try: - # must have enabled signing and specified a key file - if not cfg.EMAIL_GPG_SIGNING_ENABLED or not cfg.EMAIL_GPG_SIGNING_KEY: - return None - except AttributeError: - return None - - keyfile = None - ctx = gpgme.Context() - - try: - logging.debug("Opening GPG keyfile %s..." % cfg.EMAIL_GPG_SIGNING_KEY) - keyfile = open(cfg.EMAIL_GPG_SIGNING_KEY) - key = ctx.import_(keyfile) - - if not (len(key.imports) > 0): - logging.debug( - "Unexpected result from gpgme.Context.import_(): %r" % key) - raise gpgme.GpgmeError("Could not import GnuPG key from file %r" - % cfg.EMAIL_GPG_SIGNING_KEY) - - fingerprint = key.imports[0][0] - logging.info("GPG Key with fingerprint %s imported" % fingerprint) - - ctx.armor = True - ctx.signers = [ctx.get_key(fingerprint)] - - logging.info("Testing signature created with GnuPG key...") - message = io.StringIO('Test') - new_sigs = ctx.sign(message, io.StringIO(), gpgme.SIG_MODE_CLEAR) - if not len(new_sigs) == 1: - raise gpgme.GpgmeError( - "Testing was unable to produce a signature with GnuPG key.") - - except (IOError, OSError) as error: - logging.debug(error) - logging.error("Could not open or read from GnuPG key file %r!" - % cfg.EMAIL_GPG_SIGNING_KEY) - ctx = None - except gpgme.GpgmeError as error: - logging.exception(error) - ctx = None - finally: - if keyfile and not keyfile.closed: - keyfile.close() - - return ctx diff --git a/lib/bridgedb/crypto.py b/lib/bridgedb/crypto.py index 7f6d597..5c68794 100644 --- a/lib/bridgedb/crypto.py +++ b/lib/bridgedb/crypto.py @@ -29,8 +29,10 @@ from __future__ import absolute_import from __future__ import unicode_literals +import gpgme import hashlib import hmac +import io import logging import os import re @@ -51,6 +53,46 @@ DIGESTMOD = hashlib.sha1 class RSAKeyGenerationError(Exception): """Raised when there was an error creating an RSA keypair.""" +class PythonicGpgmeError(Exception): + """Replacement for ``gpgme.GpgmeError`` with understandable error info.""" + +class LessCrypticGPGMEError(Exception): + """Holds interpreted info on source/type of a ``gpgme.GpgmeError``.""" + + def __init__(self, gpgmeError, *args): + self.interpretCrypticGPGMEError(gpgmeError) + super(LessCrypticGPGMEError, self).__init__(self.message) + + def interpretCrypticGPGMEError(self, gpgmeError): + """Set our ``message`` attribute with a decoded explanation of the + GPGME error code received. + + :type gpgmeError: ``gpgme.GpgmeError`` + :param gpgmeError: An exception raised by the gpgme_ module. + + .. _gpgme: https://bazaar.launchpad.net/~jamesh/pygpgme/trunk/view/head:/src/pygpgme-e… + """ + try: + errorSource, errorCode, errorMessage = gpgmeError.args + except (AttributeError, ValueError): + self.message = "Could not get error code from gpgme.GpgmeError!" + return + + if errorCode and errorSource: + try: + sources = gpgmeErrorTranslations[str(errorSource)] + except KeyError: + sources = ['UNKNOWN'] + sources = ', '.join(sources).strip(',') + + try: + names = gpgmeErrorTranslations[str(errorCode)] + except KeyError: + names = ['UNKNOWN'] + names = ', '.join(names).strip(',') + + self.message = "GpgmeError: {0} stemming from {1}: '{2}'""".format( + names, sources, str(errorMessage)) def writeKeyToFile(key, filename): """Write **key** to **filename**, with ``0400`` permissions. @@ -194,6 +236,117 @@ def getHMACFunc(key, hex=True): return h_tmp.digest() return hmac_fn +def _createGPGMEErrorInterpreters(): + errorDict = {} + errorAttrs = [] + + if gpgme is not None: + errorAttrs = dir(gpgme) + + for attr in errorAttrs: + if attr.startswith('ERR'): + errorName = attr + errorCode = getattr(gpgme, attr, None) + if errorCode is not None: + try: + allErrorNames = errorDict[str(errorCode)] + except KeyError: + allErrorNames = [] + allErrorNames.append(str(errorName)) + + errorDict.update({str(errorCode): allErrorNames}) + errorDict.update({str(errorName): str(errorCode)}) + + return errorDict + +gpgmeErrorTranslations = _createGPGMEErrorInterpreters() + +def getGPGContext(cfg): + """Import a key from a file and initialise a context for GnuPG operations. + + The key should not be protected by a passphrase, and should have the + signing flag enabled. + + :type cfg: :class:`bridgedb.persistent.Conf` + :param cfg: The loaded config file. + :rtype: :class:`gpgme.Context` or None + :returns: A GPGME context with the signers initialized by the keyfile + specified by the option EMAIL_GPG_SIGNING_KEY in bridgedb.conf, or + None if the option was not enabled, or was unable to initialize. + """ + try: + # must have enabled signing and specified a key file + if not cfg.EMAIL_GPG_SIGNING_ENABLED or not cfg.EMAIL_GPG_SIGNING_KEY: + return None + except AttributeError: + return None + + keyfile = None + ctx = gpgme.Context() + + try: + logging.debug("Opening GPG keyfile %s..." % cfg.EMAIL_GPG_SIGNING_KEY) + keyfile = open(cfg.EMAIL_GPG_SIGNING_KEY) + key = ctx.import_(keyfile) + + if not len(key.imports) > 0: + logging.debug("Unexpected result from gpgme.Context.import_(): %r" + % key) + raise PythonicGpgmeError("Could not import GnuPG key from file %r" + % cfg.EMAIL_GPG_SIGNING_KEY) + + fingerprint = key.imports[0][0] + subkeyFingerprints = [] + # For some reason, if we don't do it exactly like this, we can get + # signatures for *any* key in the current process owner's keyring + # file: + bridgedbKey = ctx.get_key(fingerprint) + bridgedbUID = bridgedbKey.uids[0].uid + logging.info("GnuPG key imported: %s" % bridgedbUID) + logging.info(" Fingerprint: %s" % fingerprint) + for subkey in bridgedbKey.subkeys: + logging.info("Subkey fingerprint: %s" % subkey.fpr) + subkeyFingerprints.append(subkey.fpr) + + ctx.armor = True + ctx.signers = (bridgedbKey,) + + logging.debug("Testing signature created with GnuPG key...") + testMessage = "Testing 1 2 3" + signatureText, sigs = gpgSignMessage(ctx, testMessage) + + if not len(sigs) == 1: + raise PythonicGpgmeError("Testing couldn't produce a signature "\ + "with GnuPG key: %s" % fingerprint) + + sigFingerprint = sigs[0].fpr + if sigFingerprint in subkeyFingerprints: + logging.info("GPG signatures will use subkey with fingerprint: %s" + % sigFingerprint) + else: + if sigFingerprint != fingerprint: + raise PythonicGpgmeError( + "Test sig fingerprint '%s' not from any appropriate key!" + % sigFingerprint) + + except (IOError, OSError) as error: + logging.debug(error) + logging.error("Could not open or read from GnuPG key file %r!" + % cfg.EMAIL_GPG_SIGNING_KEY) + ctx = None + except gpgme.GpgmeError as error: + lessCryptic = LessCrypticGPGMEError(error) + logging.error(lessCryptic) + ctx = None + except PythonicGpgmeError as error: + logging.error(error) + ctx = None + finally: + if keyfile and not keyfile.closed: + keyfile.close() + + return ctx + class SSLVerifyingContextFactory(ssl.CertificateOptions): """``OpenSSL.SSL.Context`` factory which does full certificate-chain and

1 0

[bridgedb/master] Simplify test_EmailServer.EmailResponseTests assertion checks.
by isis＠torproject.org 19 Apr '14

19 Apr '14

commit 1e9c46fc4b238085141fb50e98183aa64e90db26 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Apr 17 02:48:46 2014 +0000 Simplify test_EmailServer.EmailResponseTests assertion checks. --- lib/bridgedb/test/test_EmailServer.py | 64 +++++++++++++-------------------- 1 file changed, 24 insertions(+), 40 deletions(-) diff --git a/lib/bridgedb/test/test_EmailServer.py b/lib/bridgedb/test/test_EmailServer.py index 9e5db06..8087247 100644 --- a/lib/bridgedb/test/test_EmailServer.py +++ b/lib/bridgedb/test/test_EmailServer.py @@ -175,6 +175,20 @@ class EmailResponseTests(unittest.TestCase): "get bridges"] self.ctx = _createMailContext() + def _isTwoTupleOfNone(self, reply): + """Check that a return value is ``(None, None)``.""" + self.assertIsInstance(reply, tuple) + self.assertEqual(len(reply), 2) + self.assertEqual(reply[0], None) + self.assertEqual(reply[1], None) + + def _isTwoTupleOfAddrAndClass(self, reply, address="testing(a)example.com", + klass=io.StringIO): + self.assertIsInstance(reply, tuple) + self.assertEqual(len(reply), 2) + self.assertEqual(reply[0], address) + self.assertIsInstance(reply[1], klass) + def test_getMailResponse_noFrom(self): """A received email without a "From:" or "Sender:" header shouldn't receive a response. @@ -182,46 +196,31 @@ class EmailResponseTests(unittest.TestCase): lines = self.lines lines[0] = "" ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], None) - self.assertEqual(ret[1], None) + self._isTwoTupleOfNone(ret) def test_getMailResponse_badAddress(self): lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing*.?\"", "example") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], None) - self.assertEqual(ret[1], None) + self._isTwoTupleOfNone(ret) def test_getMailResponse_anotherBadAddress(self): lines = copy.copy(self.lines) lines[0] = "From: Mallory %s(a)%s.com" % ("<>>", "example") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], None) - self.assertEqual(ret[1], None) + self._isTwoTupleOfNone(ret) def test_getMailResponse_invalidDomain(self): lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "exa#mple") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], None) - self.assertEqual(ret[1], None) + self._isTwoTupleOfNone(ret) def test_getMailResponse_anotherInvalidDomain(self): lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "exam+ple") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], None) - self.assertEqual(ret[1], None) + self._isTwoTupleOfNone(ret) def test_getMailResponse_DKIM_badDKIMheader(self): """An email with an appended 'X-DKIM-Authentication-Result:' header should not @@ -231,20 +230,14 @@ class EmailResponseTests(unittest.TestCase): lines[0] = self.lines[0] % ("testing", "gmail") lines.append("X-DKIM-Authentication-Result: ") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], None) - self.assertEqual(ret[1], None) + self._isTwoTupleOfNone(ret) def test_getMailResponse_DKIM(self): lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "example") lines.append("X-DKIM-Authentication-Result: ") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], io.BytesIO) + self._isTwoTupleOfAddrAndClass(ret) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) @@ -254,10 +247,7 @@ class EmailResponseTests(unittest.TestCase): lines[0] = self.lines[0] % ("testing", "example") lines.append("transport obfs") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], io.BytesIO) + self._isTwoTupleOfAddrAndClass(ret) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) @@ -269,10 +259,7 @@ class EmailResponseTests(unittest.TestCase): lines.append("transport obfs") lines.append("unblocked webz") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], io.BytesIO) + self._isTwoTupleOfAddrAndClass(ret) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) @@ -285,10 +272,7 @@ class EmailResponseTests(unittest.TestCase): lines.append("unblocked webz") lines.append("ipv6") ret = EmailServer.getMailResponse(lines, self.ctx) - self.assertIsInstance(ret, tuple) - self.assertEqual(len(ret), 2) - self.assertEqual(ret[0], "testing(a)example.com") - self.assertIsInstance(ret[1], io.BytesIO) + self._isTwoTupleOfAddrAndClass(ret) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1)

1 0