git.notmuchmail.org Git - notmuch/blob - test/T356-protected-headers.sh

   1 #!/usr/bin/env bash
   2
   3 test_description='Message decryption with protected headers'
   4 . $(dirname "$0")/test-lib.sh || exit 1
   5
   6 ##################################################
   7
   8 test_require_external_prereq gpgsm
   9
  10 add_gnupg_home
  11 add_gpgsm_home
  12
  13 add_email_corpus protected-headers
  14
  15 test_begin_subtest "verify protected header is not visible without decryption"
  16 output=$(notmuch show --format=json id:protected-header@crypto.notmuchmail.org)
  17 test_json_nodes <<<"$output" \
  18                 'no_crypto_info:[0][0][0]["crypto"]={}' \
  19                 'subject:[0][0][0]["headers"]["Subject"]="Subject Unavailable"'
  20
  21 test_begin_subtest "verify protected header is visible with decryption"
  22 output=$(notmuch show --decrypt=true --format=json id:protected-header@crypto.notmuchmail.org)
  23 test_json_nodes <<<"$output" \
  24                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "full", "header-mask": {"Subject": "Subject Unavailable"}}}' \
  25                 'subject:[0][0][0]["headers"]["Subject"]="This is a protected header"'
  26
  27 test_begin_subtest "when no external header is present, show masked subject as null"
  28 output=$(notmuch show --decrypt=true --format=json id:subjectless-protected-header@crypto.notmuchmail.org)
  29 test_json_nodes <<<"$output" \
  30                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "full", "header-mask": {"Subject": null}}}' \
  31                 'subject:[0][0][0]["headers"]["Subject"]="This is a protected header"'
  32
  33 test_begin_subtest "misplaced protected headers should not be made visible during decryption"
  34 output=$(notmuch show --decrypt=true --format=json id:misplaced-protected-header@crypto.notmuchmail.org)
  35 test_json_nodes <<<"$output" \
  36                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "full"}}' \
  37                 'subject:[0][0][0]["headers"]["Subject"]="Subject Unavailable"'
  38
  39 test_begin_subtest "verify double-wrapped phony protected header is not visible when inner decryption fails"
  40 output=$(notmuch show --decrypt=true --format=json id:double-wrapped-with-phony-protected-header@crypto.notmuchmail.org)
  41 test_json_nodes <<<"$output" \
  42                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "full"}}' \
  43                 'subject:[0][0][0]["headers"]["Subject"]="Subject Unavailable"'
  44
  45 test_begin_subtest "cleartext phony protected headers should not be made visible when decryption fails"
  46 output=$(notmuch show --decrypt=true --format=json id:phony-protected-header-bad-encryption@crypto.notmuchmail.org)
  47 test_json_nodes <<<"$output" \
  48                 'no_crypto_info:[0][0][0]["crypto"]={}' \
  49                 'subject:[0][0][0]["headers"]["Subject"]="Subject Unavailable"'
  50
  51 test_begin_subtest "wrapped protected headers should not be made visible during decryption"
  52 output=$(notmuch show --decrypt=true --format=json id:wrapped-protected-header@crypto.notmuchmail.org)
  53 test_json_nodes <<<"$output" \
  54                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "partial"}}' \
  55                 'subject:[0][0][0]["headers"]["Subject"]="[mailing-list] Subject Unavailable"'
  56
  57 test_begin_subtest "internal headers without protected-header attribute should be skipped"
  58 output=$(notmuch show --decrypt=true --format=json id:no-protected-header-attribute@crypto.notmuchmail.org)
  59 test_json_nodes <<<"$output" \
  60                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "full"}}' \
  61                 'subject:[0][0][0]["headers"]["Subject"]="Subject Unavailable"'
  62
  63 test_begin_subtest "verify nested message/rfc822 protected header is visible"
  64 output=$(notmuch show --decrypt=true --format=json id:nested-rfc822-message@crypto.notmuchmail.org)
  65 test_json_nodes <<<"$output" \
  66                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "full", "header-mask": {"Subject": "Subject Unavailable"}}}' \
  67                 'subject:[0][0][0]["headers"]["Subject"]="This is a message using draft-melnikov-smime-header-signing"'
  68
  69 test_begin_subtest "show cryptographic envelope on signed mail"
  70 output=$(notmuch show --verify --format=json id:simple-signed-mail@crypto.notmuchmail.org)
  71 test_json_nodes <<<"$output" \
  72                 'crypto:[0][0][0]["crypto"]={"signed": {"status": [{"created": 1525609971, "fingerprint": "'$FINGERPRINT'", "userid": "'"$SELF_USERID"'", "status": "good"}]}}'
  73
  74 test_begin_subtest "verify signed protected header"
  75 output=$(notmuch show --verify --format=json id:signed-protected-header@crypto.notmuchmail.org)
  76 test_json_nodes <<<"$output" \
  77                 'crypto:[0][0][0]["crypto"]={"signed": {"status": [{"created": 1525350527, "fingerprint": "'$FINGERPRINT'", "userid": "'"$SELF_USERID"'", "status": "good"}], "headers": ["Subject"]}}'
  78
  79 test_begin_subtest "protected subject does not leak by default in replies"
  80 output=$(notmuch reply --decrypt=true --format=json id:protected-header@crypto.notmuchmail.org)
  81 test_json_nodes <<<"$output" \
  82                 'crypto:["original"]["crypto"]={"decrypted": {"status": "full", "header-mask": {"Subject": "Subject Unavailable"}}}' \
  83                 'subject:["original"]["headers"]["Subject"]="This is a protected header"' \
  84                 'reply-subject:["reply-headers"]["Subject"]="Re: Subject Unavailable"'
  85
  86 test_begin_subtest "protected subject is not indexed by default"
  87 output=$(notmuch search --output=messages 'subject:"This is a protected header"')
  88 test_expect_equal "$output" ''
  89
  90 test_begin_subtest "reindex message with protected header"
  91 test_expect_success 'notmuch reindex --decrypt=true id:protected-header@crypto.notmuchmail.org'
  92
  93 test_begin_subtest "protected subject is indexed when cleartext is indexed"
  94 output=$(notmuch search --output=messages 'subject:"This is a protected header"')
  95 test_expect_equal "$output" 'id:protected-header@crypto.notmuchmail.org'
  96
  97 test_begin_subtest "indexed protected subject is visible in search"
  98 output=$(notmuch search --format=json 'id:protected-header@crypto.notmuchmail.org')
  99 test_json_nodes <<<"$output" \
 100                 'subject:[0]["subject"]="This is a protected header"'
 101
 102 test_begin_subtest "indexed protected subject is not visible in reply header"
 103 output=$(notmuch reply --format=json 'id:protected-header@crypto.notmuchmail.org')
 104 test_json_nodes <<<"$output" \
 105                 'subject:["original"]["headers"]["Subject"]="This is a protected header"' \
 106                 'reply-subject:["reply-headers"]["Subject"]="Re: Subject Unavailable"'
 107
 108 test_begin_subtest "verify correct protected header when submessage exists"
 109 output=$(notmuch show --decrypt=true --format=json id:encrypted-message-with-forwarded-attachment@crypto.notmuchmail.org)
 110 test_json_nodes <<<"$output" \
 111                 'crypto:[0][0][0]["crypto"]={"decrypted": {"status": "full", "header-mask": {"Subject": "Subject Unavailable"}}}' \
 112                 'subject:[0][0][0]["headers"]["Subject"]="This is the cryptographic envelope subject"'
 113
 114 test_begin_subtest "verify protected header is both signed and encrypted"
 115 output=$(notmuch show --decrypt=true --format=json id:encrypted-signed@crypto.notmuchmail.org)
 116 test_json_nodes <<<"$output" \
 117                 'crypto:[0][0][0]["crypto"]={
 118                    "signed":{"status": [{"status": "good", "fingerprint": "'$FINGERPRINT'", "userid": "'"$SELF_USERID"'", "created": 1525812676}],
 119                    "encrypted": true, "headers": ["Subject"]},"decrypted": {"status": "full", "header-mask": {"Subject": "Subject Unavailable"}}}' \
 120                 'subject:[0][0][0]["headers"]["Subject"]="Rhinoceros dinner"'
 121
 122 test_begin_subtest "verify protected header is signed even when not masked"
 123 output=$(notmuch show --decrypt=true --format=json id:encrypted-signed-not-masked@crypto.notmuchmail.org)
 124 test_json_nodes <<<"$output" \
 125                 'crypto:[0][0][0]["crypto"]={
 126                    "signed":{"status": [{"status": "good", "fingerprint": "'$FINGERPRINT'", "userid": "'"$SELF_USERID"'", "created": 1525812676}],
 127                    "encrypted": true, "headers": ["Subject"]},"decrypted": {"status": "full"}}' \
 128                 'subject:[0][0][0]["headers"]["Subject"]="Rhinoceros dinner"'
 129
 130 test_begin_subtest "reindex everything, ensure headers are as expected"
 131 notmuch reindex --decrypt=true from:test_suite@notmuchmail.org
 132 output=$(notmuch search --output=messages 'subject:"protected header" or subject:"Rhinoceros" or subject:"draft-melnikov-smime-header-signing" or subject:"valid"' | sort)
 133 test_expect_equal "$output" 'id:encrypted-signed-not-masked@crypto.notmuchmail.org
 134 id:encrypted-signed@crypto.notmuchmail.org
 135 id:nested-rfc822-message@crypto.notmuchmail.org
 136 id:protected-header@crypto.notmuchmail.org
 137 id:subjectless-protected-header@crypto.notmuchmail.org'
 138
 139 test_begin_subtest "when rendering protected headers, avoid rendering legacy-display part"
 140 output=$(notmuch show --format=json id:protected-with-legacy-display@crypto.notmuchmail.org)
 141 test_json_nodes <<<"$output" \
 142                 'subject:[0][0][0]["headers"]["Subject"]="Interrupting Cow"' \
 143                 'no_legacy_display:[0][0][0]["body"][0]["content"][1]["content-type"]="text/plain"'
 144
 145 test_begin_subtest "when replying, avoid rendering legacy-display part"
 146 output=$(notmuch reply --format=json id:protected-with-legacy-display@crypto.notmuchmail.org)
 147 test_json_nodes <<<"$output" \
 148                 'no_legacy_display:["original"]["body"][0]["content"][1]["content-type"]="text/plain"'
 149
 150 test_begin_subtest "do not treat legacy-display part as body when indexing"
 151 output=$(notmuch search --output=messages body:interrupting)
 152 test_expect_equal "$output" ''
 153
 154 test_begin_subtest "identify message that had a legacy display part skipped during indexing"
 155 output=$(notmuch search --output=messages property:index.repaired=skip-protected-headers-legacy-display)
 156 test_expect_equal "$output" id:protected-with-legacy-display@crypto.notmuchmail.org
 157
 158 for variant in multipart-signed onepart-signed; do
 159     test_begin_subtest "verify signed PKCS#7 subject ($variant)"
 160     output=$(notmuch show --verify --format=json "id:smime-${variant}@protected-headers.example")
 161     test_json_nodes <<<"$output" \
 162                     'signed_subject:[0][0][0]["crypto"]["signed"]["headers"]=["Subject"]' \
 163                     'sig_good:[0][0][0]["crypto"]["signed"]["status"][0]["status"]="good"' \
 164                     'sig_fpr:[0][0][0]["crypto"]["signed"]["status"][0]["fingerprint"]="702BA4B157F1E2B7D16B0C6A5FFC8A7DE2057DEB"' \
 165                     'not_encrypted:[0][0][0]["crypto"]!"decrypted"'
 166     test_begin_subtest "verify signed PKCS#7 subject ($variant) signer User ID"
 167     if [ $NOTMUCH_GMIME_X509_CERT_VALIDITY -ne 1 ]; then
 168         test_subtest_known_broken
 169     fi
 170     test_json_nodes <<<"$output" \
 171                     'sig_uid:[0][0][0]["crypto"]["signed"]["status"][0]["userid"]="CN=Alice Lovelace"'
 172 done
 173
 174 for variant in sign+enc sign+enc+legacy-disp; do
 175     test_begin_subtest "confirm signed and encrypted PKCS#7 subject ($variant)"
 176     output=$(notmuch show --decrypt=true --format=json "id:smime-${variant}@protected-headers.example")
 177     test_json_nodes <<<"$output" \
 178                     'signed_subject:[0][0][0]["crypto"]["signed"]["headers"]=["Subject"]' \
 179                     'sig_good:[0][0][0]["crypto"]["signed"]["status"][0]["status"]="good"' \
 180                     'sig_fpr:[0][0][0]["crypto"]["signed"]["status"][0]["fingerprint"]="702BA4B157F1E2B7D16B0C6A5FFC8A7DE2057DEB"' \
 181                     'encrypted:[0][0][0]["crypto"]["decrypted"]={"status":"full","header-mask":{"Subject":"..."}}'
 182     test_begin_subtest "confirm signed and encrypted PKCS#7 subject ($variant) signer User ID"
 183     if [ $NOTMUCH_GMIME_X509_CERT_VALIDITY -ne 1 ]; then
 184         test_subtest_known_broken
 185     fi
 186     test_json_nodes <<<"$output" \
 187                     'sig_uid:[0][0][0]["crypto"]["signed"]["status"][0]["userid"]="CN=Alice Lovelace"'
 188
 189 done
 190
 191 test_begin_subtest "confirm encryption-protected PKCS#7 subject (enc+legacy-disp)"
 192 output=$(notmuch show --decrypt=true --format=json "id:smime-enc+legacy-disp@protected-headers.example")
 193 test_json_nodes <<<"$output" \
 194                 'encrypted:[0][0][0]["crypto"]["decrypted"]={"status":"full","header-mask":{"Subject":"..."}}' \
 195                 'no_sig:[0][0][0]["crypto"]!"signed"'
 196
 197
 198 # TODO: test that a part that looks like a legacy-display in
 199 # multipart/signed, but not encrypted, is indexed and not stripped.
 200
 201 # TODO: test that a legacy-display in a decrypted subpart (not in the
 202 # cryptographic payload) is indexed and not stripped.
 203
 204 # TODO: test that a legacy-display inside multiple MIME layers that
 205 # include an encryption layer (e.g. multipart/encrypted around
 206 # multipart/signed) is stripped and not indexed.
 207
 208 test_done