This file is indexed.

/usr/bin/rt-mailgate-4 is in rt4-clients 4.0.7-5+deb7u4.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
#!/usr/bin/perl -w
# BEGIN BPS TAGGED BLOCK {{{
#
# COPYRIGHT:
#
# This software is Copyright (c) 1996-2012 Best Practical Solutions, LLC
#                                          <sales@bestpractical.com>
#
# (Except where explicitly superseded by other copyright notices)
#
#
# LICENSE:
#
# This work is made available to you under the terms of Version 2 of
# the GNU General Public License. A copy of that license should have
# been provided with this software, but in any event can be snarfed
# from www.gnu.org.
#
# This work is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 or visit their web page on the internet at
# http://www.gnu.org/licenses/old-licenses/gpl-2.0.html.
#
#
# CONTRIBUTION SUBMISSION POLICY:
#
# (The following paragraph is not intended to limit the rights granted
# to you to modify and distribute this software under the terms of
# the GNU General Public License and is only of importance to you if
# you choose to contribute your changes and enhancements to the
# community by submitting them to Best Practical Solutions, LLC.)
#
# By intentionally submitting any modifications, corrections or
# derivatives to this work, or any other work intended for use with
# Request Tracker, to Best Practical Solutions, LLC, you confirm that
# you are the copyright holder for those contributions and you grant
# Best Practical Solutions,  LLC a nonexclusive, worldwide, irrevocable,
# royalty-free, perpetual, license to use, copy, create derivative
# works based on those contributions, and sublicense and distribute
# those contributions and any derivatives thereof.
#
# END BPS TAGGED BLOCK }}}
=head1 NAME

rt-mailgate - Mail interface to RT.

=cut

use strict;
use warnings;

use Getopt::Long;

my $opts = { };
GetOptions( $opts,   "queue=s", "action=s", "url=s",
            "jar=s", "help",    "debug",    "extension=s",
            "timeout=i", "verify-ssl!", "ca-file=s",
          );

my $gateway = RT::Client::MailGateway->new();

$gateway->run($opts);

package RT::Client::MailGateway;

use LWP::UserAgent;
use HTTP::Request::Common qw($DYNAMIC_FILE_UPLOAD);
use File::Temp qw(tempfile tempdir);
$DYNAMIC_FILE_UPLOAD = 1;

use constant EX_TEMPFAIL => 75;
use constant BUFFER_SIZE => 8192;

sub new {
    my $class = shift;
    my $self = bless {}, $class;
    return $self;
}

sub run {
    my $self = shift;
    my $opts = shift;

    if ( $opts->{running_in_test_harness} ) {
        $self->{running_in_test_harness} = 1;
    }

    $self->validate_cli_flags($opts);

    my $ua          = $self->get_useragent($opts);
    my $post_params = $self->setup_session($opts);
    $self->upload_message( $ua => $post_params );
    $self->exit_with_success();
}

sub exit_with_success {
    my $self = shift;
    if ( $self->{running_in_test_harness} ) {
        return 1;
    } else {
        exit 0;
    }
}

sub tempfail {
    my $self = shift;
    if ( $self->{running_in_test_harness} ) {
        die "tempfail";
    } else {

        exit EX_TEMPFAIL;
    }
}

sub permfail {
    my $self = shift;
    if ( $self->{running_in_test_harness} ) {
        die "permfail";
    } else {

        exit 1;
    }
}

sub validate_cli_flags {
    my $self = shift;
    my $opts = shift;
    if ( $opts->{'help'} ) {
        require Pod::Usage;
        Pod::Usage::pod2usage( { verbose => 2 } );
        return $self->permfail()
            ;    # Don't want to succeed if this is really an email!
    }

    unless ( $opts->{'url'} ) {
        print STDERR
            "$0 invoked improperly\n\nNo 'url' provided to mail gateway!\n";
        return $self->permfail();
    }

    if (($opts->{'ca-file'} or $opts->{"verify-ssl"})
            and not LWP::UserAgent->can("ssl_opts")) {
        print STDERR "Verifying SSL certificates requires LWP::UserAgent 6.0 or higher.\n";
        return $self->tempfail();
    }

    $opts->{"verify-ssl"} = 1 unless defined $opts->{"verify-ssl"};
}

sub get_useragent {
    my $self = shift;
    my $opts = shift;
    my $ua   = LWP::UserAgent->new();
    $ua->cookie_jar( { file => $opts->{'jar'} } ) if $opts->{'jar'};

    if ( $ua->can("ssl_opts") ) {
        $ua->ssl_opts( verify_hostname => $opts->{'verify-ssl'} );
        $ua->ssl_opts( SSL_ca_file => $opts->{'ca-file'} )
            if $opts->{'ca-file'};
    }

    return $ua;
}

sub setup_session {
    my $self = shift;
    my $opts = shift;
    my %post_params;
    foreach (qw(queue action)) {
        $post_params{$_} = $opts->{$_} if defined $opts->{$_};
    }

    if ( ( $opts->{'extension'} || '' ) =~ /^(?:action|queue|ticket)$/i ) {
        $post_params{ lc $opts->{'extension'} } = $ENV{'EXTENSION'}
            || $opts->{ $opts->{'extension'} };
    } elsif ( $opts->{'extension'} && $ENV{'EXTENSION'} ) {
        print STDERR
            "Value of the --extension argument is not action, queue or ticket"
            . ", but environment variable EXTENSION is also defined. The former is ignored.\n";
    }

    # add ENV{'EXTENSION'} as X-RT-MailExtension to the message header
    if ( my $value = ( $ENV{'EXTENSION'} || $opts->{'extension'} ) ) {

        # prepare value to avoid MIME format breakage
        # strip trailing newline symbols
        $value =~ s/(\r*\n)+$//;

        # make a correct multiline header field,
        # with tabs in the beginning of each line
        $value =~ s/(\r*\n)/$1\t/g;
        $opts->{'headers'} .= "X-RT-Mail-Extension: $value\n";
    }

    # Read the message in from STDIN
    # _raw_message is used for testing
    my $message = $opts->{'_raw_message'} || $self->slurp_message();
    unless ( $message->{'filename'} ) {
        $post_params{'message'} = [
                                 undef, '',
                                 'Content-Type' => 'application/octet-stream',
                                 Content        => ${ $message->{'content'} },
        ];
    } else {
        $post_params{'message'} = [
                                 $message->{'filename'}, '',
                                 'Content-Type' => 'application/octet-stream',
        ];
    }

    return \%post_params;
}

sub upload_message {
    my $self        = shift;
    my $ua          = shift;
    my $post_params = shift;
    my $full_url    = $opts->{'url'} . "/REST/1.0/NoAuth/mail-gateway";
    print STDERR "$0: connecting to $full_url\n" if $opts->{'debug'};

    $ua->timeout( exists( $opts->{'timeout'} ) ? $opts->{'timeout'} : 180 );
    my $r = $ua->post( $full_url, $post_params, Content_Type => 'form-data' );
    $self->check_failure($r);

    my $content = $r->content;
    print STDERR $content . "\n" if $opts->{'debug'};

    return if ( $content =~ /^(ok|not ok)/ );

 # It's not the server's fault if the mail is bogus. We just want to know that
 # *something* came out of the server.
    print STDERR <<EOF;
RT server error.

The RT server which handled your email did not behave as expected. It
said:

$content
EOF

    return $self->tempfail();
}

sub check_failure {
    my $self = shift;
    my $r    = shift;
    return if $r->is_success;

    # XXX TODO 4.2: Remove the multi-line error strings in favor of something more concise
    print STDERR <<"    ERROR";
An Error Occurred
=================

@{[ $r->status_line ]}
    ERROR
    print STDERR "\n$0: undefined server error\n" if $opts->{'debug'};
    return $self->tempfail();
}

sub slurp_message {
    my $self = shift;

    local $@;

    my %message;
    my ( $fh, $filename )
        = eval { tempfile( DIR => tempdir( CLEANUP => 1 ) ) };
    if ( !$fh || $@ ) {
        print STDERR "$0: Couldn't create temp file, using memory\n";
        print STDERR "error: $@\n" if $@;

        my $message = \do { local ( @ARGV, $/ ); <STDIN> };
        unless ( $$message =~ /\S/ ) {
            print STDERR "$0: no message passed on STDIN\n";
            $self->exit_with_success;
        }
        $$message = $opts->{'headers'} . $$message if $opts->{'headers'};
        return ( { content => $message } );
    }

    binmode $fh;
    binmode \*STDIN;

    print $fh $opts->{'headers'} if $opts->{'headers'};

    my $buf;
    my $empty = 1;
    while (1) {
        my $status = read \*STDIN, $buf, BUFFER_SIZE;
        unless ( defined $status ) {
            print STDERR "$0: couldn't read message: $!\n";
            return $self->tempfail();
        } elsif ( !$status ) {
            last;
        }
        $empty = 0 if $buf =~ /\S/;
        print $fh $buf;
    }
    close $fh;

    if ($empty) {
        print STDERR "$0: no message passed on STDIN\n";
        $self->exit_with_success;
    }
    print STDERR "$0: temp file is '$filename'\n" if $opts->{'debug'};
    return ( { filename => $filename } );
}

=head1 SYNOPSIS

    rt-mailgate --help : this text

Usual invocation (from MTA):

    rt-mailgate --action (correspond|comment|...) --queue queuename
                --url http://your.rt.server/
                [ --debug ]
                [ --extension (queue|action|ticket) ]
                [ --timeout seconds ]



=head1 OPTIONS

=over 3

=item C<--action>

Specifies what happens to email sent to this alias.  The avaliable
basic actions are: C<correspond>, C<comment>.


If you've set the RT configuration variable B<< C<UnsafeEmailCommands> >>,
C<take> and C<resolve> are also available.  You can execute two or more
actions on a single message using a C<-> separated list.  RT will execute
the actions in the listed order.  For example you can use C<take-comment>,
C<correspond-resolve> or C<take-comment-resolve> as actions.

Note that C<take> and C<resolve> actions ignore message text if used
alone.  Include a  C<comment> or C<correspond> action if you want RT
to record the incoming message.

The default action is C<correspond>.

=item C<--queue>

This flag determines which queue this alias should create a ticket in if no ticket identifier
is found.

=item C<--url>

This flag tells the mail gateway where it can find your RT server. You should 
probably use the same URL that users use to log into RT.  

If your RT server uses SSL, you will need to install additional Perl
libraries. RT will detect and install these dependencies if you pass the
C<--enable-ssl-mailgate> flag to configure as documented in RT's README.

If you have a self-signed SSL certificate, you may also need to pass
C<--ca-file> or C<--no-verify-ssl>, below.

=item C<--ca-file> I<path>

Specifies the path to the public SSL certificate for the certificate
authority that should be used to verify the website's SSL certificate.
If your webserver uses a self-signed certificate, you should
preferentially use this option over C<--no-verify-ssl>, as it will
ensure that the self-signed certificate that the mailgate is seeing the
I<right> self-signed certificate.

=item C<--no-verify-ssl>

This flag tells the mail gateway to trust all SSL certificates,
regardless of if their hostname matches the certificate, and regardless
of CA.  This is required if you have a self-signed certificate, or some
other certificate which is not traceable back to an certificate your
system ultimitely trusts.

Verifying SSL certificates requires L<LWP::UserAgent> version 6.0 or
higher; explicitly passing C<--verify-ssl> on prior versions will error.

=item C<--extension> OPTIONAL

Some MTAs will route mail sent to user-foo@host or user+foo@host to user@host
and present "foo" in the environment variable $EXTENSION. By specifying
the value "queue" for this parameter, the queue this message should be
submitted to will be set to the value of $EXTENSION. By specifying
"ticket", $EXTENSION will be interpreted as the id of the ticket this message
is related to.  "action" will allow the user to specify either "comment" or
"correspond" in the address extension.

=item C<--debug> OPTIONAL

Print debugging output to standard error


=item C<--timeout> OPTIONAL

Configure the timeout for posting the message to the web server.  The
default timeout is 3 minutes (180 seconds).

=back


=head1 DESCRIPTION

The RT mail gateway is the primary mechanism for communicating with RT
via email. This program simply directs the email to the RT web server,
which handles filing correspondence and sending out any required mail.
It is designed to be run as part of the mail delivery process, either
called directly by the MTA or C<procmail>, or in a F<.forward> or
equivalent.

=head1 SETUP

Much of the set up of the mail gateway depends on your MTA and mail
routing configuration. However, you will need first of all to create an
RT user for the mail gateway and assign it a password; this helps to
ensure that mail coming into the web server did originate from the
gateway.

Next, you need to route mail to C<rt-mailgate> for the queues you're
monitoring. For instance, if you're using F</etc/aliases> and you have a
"bugs" queue, you will want something like this:

    bugs:         "|/opt/rt4/bin/rt-mailgate --queue bugs --action correspond
              --url http://rt.mycorp.com/"

    bugs-comment: "|/opt/rt4/bin/rt-mailgate --queue bugs --action comment
              --url http://rt.mycorp.com/"

Note that you don't have to run your RT server on your mail server, as
the mail gateway will happily relay to a different machine.

=head1 CUSTOMIZATION

By default, the mail gateway will accept mail from anyone. However,
there are situations in which you will want to authenticate users
before allowing them to communicate with the system. You can do this
via a plug-in mechanism in the RT configuration.

You can set the array C<@MailPlugins> to be a list of plugins. The
default plugin, if this is not given, is C<Auth::MailFrom> - that is,
authentication of the person is done based on the C<From> header of the
email. If you have additional filters or authentication mechanisms, you
can list them here and they will be called in order:

    Set( @MailPlugins =>
        "Filter::SpamAssassin",
        "Auth::LDAP",
        # ...
    );

See the documentation for any additional plugins you have.

You may also put Perl subroutines into the C<@MailPlugins> array, if
they behave as described below.

=head1 WRITING PLUGINS

What's actually going on in the above is that C<@MailPlugins> is a
list of Perl modules; RT prepends C<RT::Interface::Email::> to the name,
to form a package name, and then C<use>'s this module. The module is
expected to provide a C<GetCurrentUser> subroutine, which takes a hash of
several parameters:

=over 4

=item Message

A C<MIME::Entity> object representing the email

=item CurrentUser

An C<RT::CurrentUser> object

=item AuthStat

The authentication level returned from the previous plugin.

=item Ticket [OPTIONAL]

The ticket under discussion

=item Queue [OPTIONAL]

If we don't already have a ticket id, we need to know which queue we're talking about

=item Action

The action being performed. At the moment, it's one of "comment" or "correspond"

=back

It returns two values, the new C<RT::CurrentUser> object, and the new
authentication level. The authentication level can be zero, not allowed
to communicate with RT at all, (a "permission denied" error is mailed to
the correspondent) or one, which is the normal mode of operation.
Additionally, if C<-1> is returned, then the processing of the plug-ins
stops immediately and the message is ignored.

=head1 ENVIRONMENT

=over 4

=item EXTENSION

Some MTAs will route mail sent to user-foo@host or user+foo@host to user@host
and present "foo" in the environment variable C<EXTENSION>. Mailgate adds value
of this variable to message in the C<X-RT-Mail-Extension> field of the message
header.

See also C<--extension> option. Note that value of the environment variable is
always added to the message header when it's not empty even if C<--extension>
option is not provided.

=back

=cut