Mirrors/go-chasquid-smtp
1
0
Fork 0
mirror of https://blitiri.com.ar/repos/chasquid synced 2025-12-17 14:37:02 +00:00
Code Releases Activity
Files
a996106eeebe81a292ecba838c7503cac7493e74
go-chasquid-smtp/test
History
Alberto Bertogli a996106eee smtpsrv: Strict CRLF enforcement in DATA contents 
The RFCs are very clear that in DATA contents:

> CR and LF MUST only occur together as CRLF; they MUST NOT appear
> independently in the body.

https://www.rfc-editor.org/rfc/rfc5322#section-2.3
https://www.rfc-editor.org/rfc/rfc5321#section-2.3.8

Allowing "independent" CR and LF can cause a number of problems.

In particular, there is a new "SMTP smuggling attack" published recently
that involves the server incorrectly parsing the end of DATA marker
`\r\n.\r\n`, which an attacker can exploit to impersonate a server when
email is transmitted server-to-server.

https://www.postfix.org/smtp-smuggling.html
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/

Currently, chasquid is vulnerable to this attack, because Go's standard
libraries net/textproto and net/mail do not enforce CRLF strictly.

This patch fixes the problem by introducing a new "dot reader" function
that strictly enforces CRLF when reading dot-terminated data, used in
the DATA input processing.

When an invalid newline terminator is found, the connection is aborted
immediately because we cannot safely recover from that state.

We still keep the internal representation as LF-terminated for
convenience and simplicity.

However, the MDA courier is changed to pass CRLF-terminated lines, since
that is an external program which could be strict when receiving email
messages.

See https://github.com/albertito/chasquid/issues/47 for more details and
discussion.
2023-12-24 10:43:27 +00:00
..
stress-01-load
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
stress-02-connections
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-01-simple_local
Fix documentation/comment typos
2023-10-07 12:41:57 +01:00
t-02-exim
test: Remove unnecessary "exit" calls
2023-02-01 23:45:51 +00:00
t-03-queue_persistency
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-04-aliases
test: Minor bash style fixes to t-04-aliases
2023-10-07 12:41:57 +01:00
t-05-null_address
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-06-idna
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-07-smtputf8
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-09-loop
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-10-hooks
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-11-dovecot
Fix documentation/comment typos
2023-10-07 12:41:57 +01:00
t-12-minor_dialogs
smtpsrv: Strict CRLF enforcement in DATA contents
2023-12-24 10:43:27 +00:00
t-13-reload
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-14-tls_tracking
chasquid-util: Use server for aliases-resolve and domaininfo-remove
2023-07-30 13:21:07 +01:00
t-15-driusan_dkim
test: Remove unnecessary "exit" calls
2023-02-01 23:45:51 +00:00
t-16-spf
test: Remove unnecessary "exit" calls
2023-02-01 23:45:51 +00:00
t-17-maillog
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
t-18-haproxy
test: Remove unnecessary "exit" calls
2023-02-01 23:45:51 +00:00
t-19-dkimpy
Fix documentation/comment typos
2023-10-07 12:41:57 +01:00
t-20-bad_configs
Reject empty listening addresses
2023-12-02 15:08:09 +00:00
util
smtpsrv: Strict CRLF enforcement in DATA contents
2023-12-24 10:43:27 +00:00
.gitignore
test: Add stress tests
2018-03-26 01:58:47 +01:00
cover.sh
test: Update coverage tests to Go 1.20
2023-02-01 23:43:12 +00:00
Dockerfile
test: Improve layout of helper binaries
2022-08-27 18:46:54 +01:00
README.md
docs: Update tests.md to reflect coverage changes, and add links
2023-05-16 10:50:26 +01:00
run.sh
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00
stress.sh
Improve bash quoting, and other similar best practices
2022-11-13 11:09:19 +00:00

README.md

Testing

Go tests

All Go packages have their own test suite, which provides easy and portable tests with decent enough coverage.

Integration tests

In the test/ directory there is a set of end to end integration tests, written usually in a combination of bash and Python 3.

They're not expected to be portable, as that gets impractical very quickly, but should be usable in most Linux environments.

They provide critical coverage and integration tests for real life scenarios, as well as interactions with other software (like Exim or Dovecot).

Dependencies

The tests depend on the following things being installed on the system (listed as Debian package, for consistency):

  • msmtp
  • util-linux (for /usr/bin/setsid)

Some individual tests have additional dependencies, and the tests are skipped if the dependencies are not found:

  • t-02-exim Exim interaction tests:
    • gettext-base (for /usr/bin/envsubst)
    • The exim binary available somewhere, but it doesn't have to be installed. There's a script get-exim4-debian.sh to get it from the archives.
  • t-11-dovecot Dovecot interaction tests:
    • dovecot
  • t-15-driusan_dkim DKIM integration tests:
    • The dkimsign dkimverify dkimkeygen binaries, from driusan/dkim (no Debian package yet).
  • t-18-haproxy HAProxy integration tests:
    • haproxy
  • t-19-dkimpy: dkimpy integration tests:
    • python3-dkim

For some tests, python >= 3.5 is required; they will be skipped if it's not available.

Most tests depend on the $HOSTALIASES environment variable being functional, and will be skipped if it isn't. This works by default in most Linux systems, but note that the use of systemd-resolved can prevent it from working properly.

Stress tests

Also in the test/ directory there is a set of stress tests, which generate load against chasquid to measure performance and resource consumption.

While they are not exhaustive, they are useful to catch regressions and track improvements on the main code paths.

Fuzz tests

Some Go packages also have instrumentation to run fuzz testing against them, using the Go native fuzzing support.

This is critical for packages that handle sensitive user input, such as authentication encoding, aliases files, or username normalization.

Command-line tool tests

Each command-line tool has their own set of tests, see the test.sh file on their corresponding directories.

Docker

The test/Dockerfile can be used to set up a suitable isolated environment to run the integration and stress tests.

This is very useful for automated tests, or running the integration tests in constrained or non supported environments.

Automated tests

There are two sets of automated tests which are run on every commit to upstream, and also weekly:

  • Github Actions, configured in the .github directory, runs the Go tests, the integration tests, checks for vulnerabilities, and finally also builds the public Docker images.

  • Cirrus CI, configured in the .cirrus.yml file, runs Go tests on FreeBSD.

Coverage

The test/cover.sh script runs the integration tests in coverage mode, and produces a code coverage report in HTML format, for ease of analysis.

The target is to keep coverage of the chasquid binary above 90%.