test: cover self-service registration, and fix what it found
Rig legs for the whole author path with no CLI admit anywhere: an unknown sender drawing the info mail, Twt-Register creating the feed, the token arriving so she can publish, Twt-Help, the admin notification, Twt-Block stopping a feed and Twt-Registration closing the door. Pentest probes for the attacks: no Reply-To, a claim on someone else's address, a claim on an address nobody holds, an admin command from a non-admin, and a blocked author coming back. Two real bugs, both found by asserting on what the author receives rather than on what the daemon meant to send. Five catalogue entries were wrapped across lines, and a reason is interpolated into the reply's Subject. A frontmatter value carrying a line break makes the whole block malformed, so smolmail fails closed toward display (SPEC.md sec 5.5) and the reply arrives with no subject at all — every rejection, silently. The same bug class the parent commit fixed sender-side; step 2 reintroduced it from the catalogue, because the Rust prose it replaced used backslash continuations that join without a newline. Reasons are single-line now, with a test over the enum that fails if one ever wraps again. And the flow had a step that could not work. Telling an author to accept this mailbox makes their client attach an Accept token to every later mail, and a published record is verified by rebuilding the exact bytes that were signed — which cannot include a token without publishing it. So every post from an author who followed that advice was refused forever. The info mail now says not to accept the address and where to find replies instead, and that refusal has its own reason, since "resend the bare text" is useless advice when the client adds the field by itself. Three of my own probes were wrong too, kept here as comments so they are not rewritten the same way: grep -q under `set -o pipefail` SIGPIPEs its producer and can report failure for a subject that is plainly present; the refusal reply lands in the main tier precisely because accepting the mailbox is what moves replies there; and blocking an address that was never accepted is a store no-op, so the probe has to register first.
This commit is contained in:
randogoth
parent
f1084c1056
commit
1171d2157d
6 changed files with 334 additions and 33 deletions
112
tests/pentest.sh
112
tests/pentest.sh
|
|
@ -94,6 +94,11 @@ timeout = 10
|
|||
cap_bytes = 1048576
|
||||
posts_per_day = 50
|
||||
reposts_per_day = 50
|
||||
# Open, so the probes below exercise the path an attacker would actually find.
|
||||
# Silent would make most of them pass for the wrong reason.
|
||||
registration = open
|
||||
admins = tobias@$HOST:$SMTP_PORT
|
||||
admin_notify = off
|
||||
EOF
|
||||
"$SMOLBOID" admit --config "$RIG/smolboid.toml" "tobias@$HOST:$SMTP_PORT" >"$RIG/admit.log" 2>&1 \
|
||||
|| { cat "$RIG/admit.log"; fail "admit"; }
|
||||
|
|
@ -237,7 +242,11 @@ author send "$DAEMON_ADDR" \
|
|||
sleep 4
|
||||
[[ "$(grep -cE '^# smol:repost ' "$FEED")" == 0 ]] || fail "a noncanonical repost published"
|
||||
|
||||
step "mail: unadmitted senders publish nothing"
|
||||
step "mail: an unadmitted sender publishes nothing and gets no token"
|
||||
# Rewritten for self-service registration. The old assertion was that an
|
||||
# unadmitted sender draws no reply at all; under `registration = open` she
|
||||
# draws an info mail. What must still hold is that writing in publishes
|
||||
# nothing, creates no feed, and hands over no accept token.
|
||||
mallory keygen --force >/dev/null
|
||||
mallory trust "$HOST:$SMTP_PORT" "$SERVER_KEY"
|
||||
mallory register "mallory@$HOST:$SMTP_PORT" >/dev/null
|
||||
|
|
@ -245,6 +254,107 @@ mallory send "$DAEMON_ADDR" --body "mallory was here" >/dev/null
|
|||
sleep 4
|
||||
[[ "$(grep -c "mallory was here" "$FEED")" == 0 ]] || fail "unadmitted mail published"
|
||||
[[ ! -f "$DATA/feeds/mallory.txt" ]] || fail "an unadmitted sender got a feed"
|
||||
mallory fetch >/dev/null 2>&1 || true
|
||||
# The info mail must not carry an Accept token: the token is what moves her
|
||||
# into the main tier, and it is only issued once she actually registers.
|
||||
if mallory list --requests 2>/dev/null | grep -q "how to get a feed"; then
|
||||
mallory read 1 >"$RIG/mallory-info.txt" 2>/dev/null || true
|
||||
grep -qi "^Accept:" "$RIG/mallory-info.txt" \
|
||||
&& fail "the info mail carried an accept token"
|
||||
fi
|
||||
|
||||
step "mail: no signed Reply-To draws no reply at all"
|
||||
# --anonymous omits the Reply-To, so there is no address to verify and nothing
|
||||
# to answer. This is the anti-reflector case: a freshly minted keypair must not
|
||||
# be able to make the daemon send mail anywhere.
|
||||
BEFORE_SENT="$(daemon_fumi list --sent 2>/dev/null | wc -l)"
|
||||
mallory send "$DAEMON_ADDR" --anonymous --body "no reply-to here" >/dev/null
|
||||
sleep 4
|
||||
AFTER_SENT="$(daemon_fumi list --sent 2>/dev/null | wc -l)"
|
||||
[[ "$BEFORE_SENT" == "$AFTER_SENT" ]] \
|
||||
|| fail "an anonymous sender drew a reply ($BEFORE_SENT -> $AFTER_SENT)"
|
||||
|
||||
step "mail: claiming someone else's address takes nothing and poisons nothing"
|
||||
# The squatting and contact-poisoning probe, and the most important assertion
|
||||
# in this file. Mallory signs a Reply-To naming tobias's address but carrying
|
||||
# her own key. The key matches the signer, so the claim is self-consistent —
|
||||
# which is exactly why the daemon must resolve the address and find tobias's
|
||||
# key there instead.
|
||||
#
|
||||
# Two things must hold: she gets no feed at tobias's slug, and tobias's
|
||||
# contact row must still hold tobias's key. If the daemon replied to the
|
||||
# claimed smol:// URI it would pin her key as verified under his address, and
|
||||
# his own registration would fail on KeyChanged forever after.
|
||||
MALLORY_KEY="$(mallory whoami 2>/dev/null | grep -oE '[a-z2-7]{52}' | head -1)"
|
||||
[[ -n "$MALLORY_KEY" ]] || fail "could not read mallory's key"
|
||||
mallory send "$DAEMON_ADDR" --anonymous \
|
||||
--header "Reply-To: smol://tobias@$HOST:$SMTP_PORT/$MALLORY_KEY" \
|
||||
--header "Twt-Register:" --body "" >/dev/null
|
||||
sleep 5
|
||||
# tobias's feed is his own and still bound to his address.
|
||||
grep -q "# smol:author = tobias@$HOST:$SMTP_PORT" "$FEED" \
|
||||
|| fail "tobias's feed lost its author binding"
|
||||
# And the daemon's contact for tobias must not have become mallory's key.
|
||||
CONTACT="$(daemon_fumi contacts 2>/dev/null | grep "tobias@$HOST:$SMTP_PORT" || true)"
|
||||
if [[ -n "$CONTACT" ]]; then
|
||||
echo "$CONTACT" | grep -q "$MALLORY_KEY" \
|
||||
&& fail "mallory's key got pinned under tobias's address"
|
||||
fi
|
||||
|
||||
step "mail: a claim for an address nobody holds draws nothing"
|
||||
BEFORE_SENT="$(daemon_fumi list --sent 2>/dev/null | wc -l)"
|
||||
mallory send "$DAEMON_ADDR" --anonymous \
|
||||
--header "Reply-To: smol://nobody@$HOST:$SMTP_PORT/$MALLORY_KEY" \
|
||||
--header "Twt-Register:" --body "" >/dev/null
|
||||
sleep 5
|
||||
AFTER_SENT="$(daemon_fumi list --sent 2>/dev/null | wc -l)"
|
||||
[[ "$BEFORE_SENT" == "$AFTER_SENT" ]] \
|
||||
|| fail "a claim for a nonexistent address drew a reply"
|
||||
[[ ! -f "$DATA/feeds/nobody.txt" ]] || fail "a nonexistent address got a feed"
|
||||
|
||||
step "mail: admin commands from a non-admin do nothing"
|
||||
# And must not hint that admin commands exist: mallory gets the ordinary
|
||||
# unknown-sender answer, never an ack.
|
||||
mallory send "$DAEMON_ADDR" --header "Twt-Admit: mallory@$HOST:$SMTP_PORT" \
|
||||
--body "" >/dev/null
|
||||
sleep 4
|
||||
[[ ! -f "$DATA/feeds/mallory.txt" ]] || fail "Twt-Admit from a non-admin created a feed"
|
||||
mallory fetch >/dev/null 2>&1 || true
|
||||
mallory list --requests 2>/dev/null | grep -qi "admitted" \
|
||||
&& fail "a non-admin was told an admin command ran"
|
||||
|
||||
step "mail: a blocked address stays blocked"
|
||||
# Order matters, and the first attempt at this probe got it wrong. Blocking an
|
||||
# address that was never accepted is a no-op in the store — there is no row to
|
||||
# deactivate — so `accepted_state` stays None and nothing is being tested. The
|
||||
# sequence that matters is the real one: register, get blocked, come back.
|
||||
#
|
||||
# store.block only clears the active flag, so the check has to run before any
|
||||
# network call or Twt-Block is a one-poll inconvenience.
|
||||
mallory send "$DAEMON_ADDR" --header "Twt-Register:" --body "" >/dev/null
|
||||
for ((i = 0; i < 20; i++)); do
|
||||
[[ -f "$DATA/feeds/mallory.txt" ]] && break
|
||||
sleep 1
|
||||
done
|
||||
[[ -f "$DATA/feeds/mallory.txt" ]] || fail "mallory could not register at all"
|
||||
|
||||
author send "$DAEMON_ADDR" --header "Twt-Block: mallory@$HOST:$SMTP_PORT" \
|
||||
--body "" >/dev/null
|
||||
sleep 5
|
||||
|
||||
# Blocked: her posts no longer publish.
|
||||
mallory send "$DAEMON_ADDR" --body "after being blocked" >/dev/null
|
||||
sleep 5
|
||||
grep -q "after being blocked" "$DATA/feeds/mallory.txt" \
|
||||
&& fail "a blocked author still published"
|
||||
|
||||
# And re-registering draws nothing at all, not even a reply.
|
||||
BEFORE_SENT="$(daemon_fumi list --sent 2>/dev/null | wc -l || true)"
|
||||
mallory send "$DAEMON_ADDR" --header "Twt-Register:" --body "" >/dev/null
|
||||
sleep 5
|
||||
AFTER_SENT="$(daemon_fumi list --sent 2>/dev/null | wc -l || true)"
|
||||
[[ "$BEFORE_SENT" == "$AFTER_SENT" ]] \
|
||||
|| fail "a blocked address drew a reply when re-registering"
|
||||
|
||||
step "mail: forged signing keys verify as invalid, never as verified"
|
||||
# Tamper the published feed's own signature line: the record must flip to
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue