infrastructure/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2025-07-12 12:24:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

accept tls reports with both host & recipient domains, and with multiple recipient domains

Browse Source 
embarrassingly, we didn't accept all reports we generated. after the changed
handling of reports about mx/mail host vs recipient domains, would send reports
to mail hosts about multiple recipient domains + the mail host. and we included
a policy domain of the mail host when sending to a recipient domain. we were
still being strict in what we accepted: only a single domain in total in the
entire report, and we still enforced that a report sent to the mx host tlsrpt
address only contained the mx host as policy domain. and likewise for recipient
domains and their tls reporting addresses. those checks would reject reports
generated by a mox instance. this probably only happens with dane configured,
probably most users haven't seen it because of that.

somewhat related to issue #125
This commit is contained in:
Mechiel Lukkien
2024-03-05 11:43:49 +01:00
parent a9cb6f9d0a
commit e0c36edb8f
2 changed files with 237 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

201
tlsrptdb/report_test.go
View File

@ -62,14 +62,183 @@ const reportJSON = `{
}]
}`
const reportMultipleJSON = `{
"organization-name": "remote.example",
"date-range": {
"start-datetime": "2024-02-25T00:00:00Z",
"end-datetime": "2024-02-25T23:59:59Z"
},
"contact-info": "postmaster@remote.example",
"report-id": "20240225.mail.mox.example@remote.example",
"policies": [
{
"policy": {
"policy-type": "tlsa",
"policy-string": [
"3 1 1 206d5f55ecb9f8389bc57b5ba14716dd5b23d0834fd2c99fd402f0bda32e9523",
"3 1 1 4201e4b741c746b62ff806c142158c35ecbbbd9ac56b6d791f760e272736f8d0"
],
"policy-domain": "test2.xmox.nl",
"mx-host": [
"mail.mox.example"
]
},
"summary": {
"total-successful-session-count": 1,
"total-failure-session-count": 0
},
"failure-details": []
},
{
"policy": {
"policy-type": "tlsa",
"policy-string": [
"3 1 1 206d5f55ecb9f8389bc57b5ba14716dd5b23d0834fd2c99fd402f0bda32e9523",
"3 1 1 4201e4b741c746b62ff806c142158c35ecbbbd9ac56b6d791f760e272736f8d0"
],
"policy-domain": "test.xmox.nl",
"mx-host": [
"mail.mox.example"
]
},
"summary": {
"total-successful-session-count": 1,
"total-failure-session-count": 0
},
"failure-details": []
}
]
}
`
const reportMixedJSON = `{
"organization-name": "remote.example",
"date-range": {
"start-datetime": "2024-02-25T00:00:00Z",
"end-datetime": "2024-02-25T23:59:59Z"
},
"contact-info": "postmaster@remote.example",
"report-id": "20240225.test.xmox.nl@remote.example",
"policies": [
{
"policy": {
"policy-type": "tlsa",
"policy-string": [
"3 1 1 206d5f55ecb9f8389bc57b5ba14716dd5b23d0834fd2c99fd402f0bda32e9523",
"3 1 1 4201e4b741c746b62ff806c142158c35ecbbbd9ac56b6d791f760e272736f8d0"
],
"policy-domain": "mail.mox.example",
"mx-host": []
},
"summary": {
"total-successful-session-count": 1,
"total-failure-session-count": 0
},
"failure-details": []
},
{
"policy": {
"policy-type": "sts",
"policy-string": [
"version: STSv1",
"mode: enforce",
"max_age: 86400",
"mx: mail.mox.example"
],
"policy-domain": "unknown.xmox.nl",
"mx-host": [
"mail.mox.example"
]
},
"summary": {
"total-successful-session-count": 1,
"total-failure-session-count": 0
},
"failure-details": []
},
{
"policy": {
"policy-type": "sts",
"policy-string": [
"version: STSv1",
"mode: enforce",
"max_age: 86400",
"mx: mail.mox.example"
],
"policy-domain": "test.xmox.nl",
"mx-host": [
"mail.mox.example"
]
},
"summary": {
"total-successful-session-count": 1,
"total-failure-session-count": 0
},
"failure-details": []
}
]
}
`
const reportUnknownJSON = `{
"organization-name": "remote.example",
"date-range": {
"start-datetime": "2024-02-25T00:00:00Z",
"end-datetime": "2024-02-25T23:59:59Z"
},
"contact-info": "postmaster@remote.example",
"report-id": "20240225.test.xmox.nl@remote.example",
"policies": [
{
"policy": {
"policy-type": "tlsa",
"policy-string": [
"3 1 1 206d5f55ecb9f8389bc57b5ba14716dd5b23d0834fd2c99fd402f0bda32e9523",
"3 1 1 4201e4b741c746b62ff806c142158c35ecbbbd9ac56b6d791f760e272736f8d0"
],
"policy-domain": "unknown.mox.example",
"mx-host": []
},
"summary": {
"total-successful-session-count": 1,
"total-failure-session-count": 0
},
"failure-details": []
},
{
"policy": {
"policy-type": "sts",
"policy-string": [
"version: STSv1",
"mode: enforce",
"max_age: 86400",
"mx: mail.mox.example"
],
"policy-domain": "unknown.xmox.nl",
"mx-host": [
"unknown.mox.example"
]
},
"summary": {
"total-successful-session-count": 1,
"total-failure-session-count": 0
},
"failure-details": []
}
]
}
`
func TestReport(t *testing.T) {
mox.Context = ctxbg
mox.Shutdown, mox.ShutdownCancel = context.WithCancel(ctxbg)
mox.ConfigStaticPath = filepath.FromSlash("../testdata/tlsrpt/fake.conf")
mox.Conf.Static.HostnameDomain = dns.Domain{ASCII: "mail.mox.example"}
mox.Conf.Static.DataDir = "."
// Recognize as configured domain.
mox.Conf.Dynamic.Domains = map[string]config.Domain{
"test.xmox.nl": {},
"test.xmox.nl": {},
"test2.xmox.nl": {},
}
dbpath := mox.DataDirPath("tlsrpt.db")
@ -133,4 +302,34 @@ func TestReport(t *testing.T) {
if err != nil || len(records) != 1 {
t.Fatalf("got err %v, records %#v, expected no error with 1 record", err, records)
}
// Add report with multiple recipient domains.
reportJSON, err = tlsrpt.Parse(strings.NewReader(reportMultipleJSON))
if err != nil {
t.Fatalf("parsing report: %v", err)
}
report = reportJSON.Convert()
if err := AddReport(ctxbg, pkglog, dns.Domain{ASCII: "remote.example"}, "postmaster@remote.example", false, &report); err != nil {
t.Errorf("adding report to database: %s", err)
}
// Add report with mixed host and domain policies. The unknown domain is ignored.
reportJSON, err = tlsrpt.Parse(strings.NewReader(reportMixedJSON))
if err != nil {
t.Fatalf("parsing report: %v", err)
}
report = reportJSON.Convert()
if err := AddReport(ctxbg, pkglog, dns.Domain{ASCII: "remote.example"}, "postmaster@remote.example", false, &report); err != nil {
t.Errorf("adding report to database: %s", err)
}
// All unknown domains in report should cause error.
reportJSON, err = tlsrpt.Parse(strings.NewReader(reportUnknownJSON))
if err != nil {
t.Fatalf("parsing report: %v", err)
}
report = reportJSON.Convert()
if err := AddReport(ctxbg, pkglog, dns.Domain{ASCII: "remote.example"}, "postmaster@remote.example", false, &report); err == nil {
t.Errorf("adding report with all unknown domains, expected error")
}
}