X-Git-Url: https://git.notmuchmail.org/git?p=notmuch;a=blobdiff_plain;f=test%2FT355-smime.sh;h=1f11725f76129b96268427de7c6e9575a72ffca5;hp=532cd84baff07f9877cab45025796e34615bfc9b;hb=cb88b51fe55fcb01235747d4b94072fa6efd501c;hpb=cb855d8a9d24084d0965790782c1ce04b82aa9ca diff --git a/test/T355-smime.sh b/test/T355-smime.sh index 532cd84b..1f11725f 100755 --- a/test/T355-smime.sh +++ b/test/T355-smime.sh @@ -1,27 +1,12 @@ #!/usr/bin/env bash test_description='S/MIME signature verification and decryption' -. ./test-lib.sh || exit 1 - -add_gpgsm_home () -{ - local fpr - [ -d ${GNUPGHOME} ] && return - _gnupg_exit () { gpgconf --kill all 2>/dev/null || true; } - at_exit_function _gnupg_exit - mkdir -m 0700 "$GNUPGHOME" - gpgsm --no-tty --no-common-certs-import --disable-dirmngr --import < $TEST_DIRECTORY/smime/test.crt >"$GNUPGHOME"/import.log 2>&1 - fpr=$(gpgsm --list-key test_suite@notmuchmail.org | sed -n 's/.*fingerprint: //p') - echo "$fpr S relax" >> $GNUPGHOME/trustlist.txt - test_debug "cat $GNUPGHOME/import.log" -} +. $(dirname "$0")/test-lib.sh || exit 1 test_require_external_prereq openssl test_require_external_prereq gpgsm -cp $TEST_DIRECTORY/smime/key+cert.pem test_suite.pem - -FINGERPRINT=$(openssl x509 -fingerprint -in test_suite.pem -noout | sed -e 's/^.*=//' -e s/://g) +FINGERPRINT=$(openssl x509 -fingerprint -in "$NOTMUCH_SRCDIR/test/smime/key+cert.pem" -noout | sed -e 's/^.*=//' -e s/://g) add_gpgsm_home @@ -37,27 +22,21 @@ test_begin_subtest "emacs delivery of S/MIME encrypted + signed message" test_expect_success \ 'emacs_fcc_message \ "test encrypted message 001" \ - "<#secure method=smime mode=signencrypt keyfile=\\\"test_suite.pem\\\" certfile=\\\"test_suite.pem\\\">\nThis is a test encrypted message.\n"' + "<#secure method=smime mode=signencrypt>\nThis is a test encrypted message.\n"' test_begin_subtest "Signature verification (openssl)" notmuch show --format=raw subject:"test signed message 001" |\ - openssl smime -verify -CAfile $TEST_DIRECTORY/smime/test.crt 2>OUTPUT + openssl smime -verify -CAfile $NOTMUCH_SRCDIR/test/smime/test.crt 2>OUTPUT cat < EXPECTED Verification successful EOF test_expect_equal_file EXPECTED OUTPUT test_begin_subtest "signature verification (notmuch CLI)" -if [ "${NOTMUCH_GMIME_MAJOR}" -lt 3 ]; then - # gmime 2 can't report User IDs properly for S/MIME - USERID='' -else - USERID='"userid": "CN=Notmuch Test Suite",' -fi output=$(notmuch show --format=json --verify subject:"test signed message 001" \ | notmuch_json_show_sanitize \ - | sed -e 's|"created": [-1234567890]*|"created": 946728000|' \ - -e 's|"expires": [-1234567890]*|"expires": 424242424|' ) + | sed -e 's|"created": [-1234567890]*|"created": 946728000|g' \ + -e 's|"expires": [-1234567890]*|"expires": 424242424|g' ) expected='[[[{"id": "XXXXX", "match": true, "excluded": false, @@ -65,13 +44,15 @@ expected='[[[{"id": "XXXXX", "timestamp": 946728000, "date_relative": "2000-01-01", "tags": ["inbox","signed"], + "crypto": {"signed": {"status": [{"fingerprint": "'$FINGERPRINT'", "status": "good","userid": "CN=Notmuch Test Suite","expires": 424242424, "created": 946728000}]}}, "headers": {"Subject": "test signed message 001", "From": "Notmuch Test Suite ", "To": "test_suite@notmuchmail.org", "Date": "Sat, 01 Jan 2000 12:00:00 +0000"}, "body": [{"id": 1, "sigstatus": [{"fingerprint": "'$FINGERPRINT'", - "status": "good",'$USERID' + "status": "good", + "userid": "CN=Notmuch Test Suite", "expires": 424242424, "created": 946728000}], "content-type": "multipart/signed", @@ -82,7 +63,7 @@ expected='[[[{"id": "XXXXX", "content-disposition": "attachment", "content-length": "NONZERO", "content-transfer-encoding": "base64", - "content-type": "application/x-pkcs7-signature", + "content-type": "application/pkcs7-signature", "filename": "smime.p7s"}]}]}, []]]]' test_expect_equal_json \ @@ -91,11 +72,125 @@ test_expect_equal_json \ test_begin_subtest "Decryption and signature verification (openssl)" notmuch show --format=raw subject:"test encrypted message 001" |\ - openssl smime -decrypt -recip test_suite.pem |\ - openssl smime -verify -CAfile $TEST_DIRECTORY/smime/test.crt 2>OUTPUT + openssl smime -decrypt -recip $NOTMUCH_SRCDIR/test/smime/key+cert.pem |\ + openssl smime -verify -CAfile $NOTMUCH_SRCDIR/test/smime/test.crt 2>OUTPUT cat < EXPECTED Verification successful EOF test_expect_equal_file EXPECTED OUTPUT +test_begin_subtest "Decryption (notmuch CLI)" +notmuch show --decrypt=true subject:"test encrypted message 001" |\ + grep "^This is a" > OUTPUT +cat < EXPECTED +This is a test encrypted message. +EOF +test_expect_equal_file EXPECTED OUTPUT + +test_begin_subtest "Cryptographic message status (encrypted+signed)" +output=$(notmuch show --format=json --decrypt=true subject:"test encrypted message 001") +test_json_nodes <<<"$output" \ + 'crypto_encrypted:[0][0][0]["crypto"]["decrypted"]["status"]="full"' \ + 'crypto_sigok:[0][0][0]["crypto"]["signed"]["status"][0]["status"]="good"' \ + 'crypto_fpr:[0][0][0]["crypto"]["signed"]["status"][0]["fingerprint"]="616F46CD73834C63847756AF0DFB64A6E0972A47"' \ + 'crypto_uid:[0][0][0]["crypto"]["signed"]["status"][0]["userid"]="CN=Notmuch Test Suite"' + +test_begin_subtest "encrypted+signed message is known to be encrypted, but signature is unknown" +output=$(notmuch search subject:"test encrypted message 001") +test_expect_equal "$output" "thread:0000000000000002 2000-01-01 [1/1] Notmuch Test Suite; test encrypted message 001 (encrypted inbox)" + +test_begin_subtest "Encrypted body is not indexed" +output=$(notmuch search 'this is a test encrypted message') +test_expect_equal "$output" "" + +test_begin_subtest "Reindex cleartext" +test_expect_success "notmuch reindex --decrypt=true subject:'test encrypted message 001'" + +test_begin_subtest "signature is now known" +test_subtest_known_broken +output=$(notmuch search subject:"test encrypted message 001") +test_expect_equal "$output" "thread:0000000000000002 2000-01-01 [1/1] Notmuch Test Suite; test encrypted message 001 (encrypted inbox signed)" + +test_begin_subtest "Encrypted body is indexed" +test_subtest_known_broken +output=$(notmuch search 'this is a test encrypted message') +test_expect_equal "$output" "thread:0000000000000002 2000-01-01 [1/1] Notmuch Test Suite; test encrypted message 001 (encrypted inbox signed)" + +add_email_corpus pkcs7 + +test_begin_subtest "index PKCS#7 SignedData message" +output=$(notmuch search --output=messages Thanks) +expected=id:smime-onepart-signed@protected-headers.example +test_expect_equal "$expected" "$output" + +test_begin_subtest "do not index embedded certificates from PKCS#7 SignedData" +output=$(notmuch search --output=messages 'LAMPS Certificate') +expected='' +test_expect_equal "$expected" "$output" + +test_begin_subtest "know the MIME type of the embedded part in PKCS#7 SignedData" +output=$(notmuch search --output=messages 'mimetype:text/plain') +expected=id:smime-onepart-signed@protected-headers.example +test_expect_equal "$expected" "$output" + +test_begin_subtest "PKCS#7 SignedData message is tagged 'signed'" +output=$(notmuch dump id:smime-onepart-signed@protected-headers.example) +expected='#notmuch-dump batch-tag:3 config,properties,tags ++inbox +signed +unread -- id:smime-onepart-signed@protected-headers.example' +test_expect_equal "$expected" "$output" + +test_begin_subtest "show contents of PKCS#7 SignedData message" +output=$(notmuch show --format=raw --part=2 id:smime-onepart-signed@protected-headers.example) +whitespace=' ' +expected="Bob, we need to cancel this contract. + +Please start the necessary processes to make that happen today. + +Thanks, Alice +--${whitespace} +Alice Lovelace +President +OpenPGP Example Corp" +test_expect_equal "$expected" "$output" + +test_begin_subtest "reply to PKCS#7 SignedData message with proper quoting and attribution" +output=$(notmuch reply id:smime-onepart-signed@protected-headers.example) +expected="From: Notmuch Test Suite +Subject: Re: The FooCorp contract +To: Alice Lovelace , Bob Babbage +In-Reply-To: +References: + +On Tue, 26 Nov 2019 20:11:29 -0400, Alice Lovelace wrote: +> Bob, we need to cancel this contract. +>${whitespace} +> Please start the necessary processes to make that happen today. +>${whitespace} +> Thanks, Alice +> --${whitespace} +> Alice Lovelace +> President +> OpenPGP Example Corp" +test_expect_equal "$expected" "$output" + +test_begin_subtest "show PKCS#7 SignedData outputs valid JSON" +output=$(notmuch show --format=json id:smime-onepart-signed@protected-headers.example) +test_valid_json "$output" + +test_begin_subtest "Verify signature on PKCS#7 SignedData message" +output=$(notmuch show --format=json id:smime-onepart-signed@protected-headers.example) + +test_json_nodes <<<"$output" \ + 'created:[0][0][0]["crypto"]["signed"]["status"][0]["created"]=1574813489' \ + 'expires:[0][0][0]["crypto"]["signed"]["status"][0]["expires"]=2611032858' \ + 'fingerprint:[0][0][0]["crypto"]["signed"]["status"][0]["fingerprint"]="702BA4B157F1E2B7D16B0C6A5FFC8A7DE2057DEB"' \ + 'status:[0][0][0]["crypto"]["signed"]["status"][0]["status"]="good"' + +test_begin_subtest "Verify signature on PKCS#7 SignedData message signer User ID" +if [ $NOTMUCH_GMIME_X509_CERT_VALIDITY -ne 1 ]; then + test_subtest_known_broken +fi +test_json_nodes <<<"$output" \ + 'userid:[0][0][0]["crypto"]["signed"]["status"][0]["userid"]="CN=Alice Lovelace"' + test_done