From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by arlo.cworth.org (Postfix) with ESMTP id 4784D6DE1422 for ; Sun, 26 May 2019 15:16:24 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at cworth.org X-Spam-Flag: NO X-Spam-Score: -0.176 X-Spam-Level: X-Spam-Status: No, score=-0.176 tagged_above=-999 required=5 tests=[AWL=0.025, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=disabled Received: from arlo.cworth.org ([127.0.0.1]) by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 761iXVMCfZs5 for ; Sun, 26 May 2019 15:16:22 -0700 (PDT) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by arlo.cworth.org (Postfix) with ESMTPS id E53E96DE12EB for ; Sun, 26 May 2019 15:16:20 -0700 (PDT) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1558908978; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : from; bh=vWqkQpbUuM+ZXRKGxRRBAYFOlZ5edlOnAr/f2HZoT0k=; b=CNQ73cktlF7iL5zEeXvqXa73RzFomzT9O3blGDaWFLkfrQ6G0t0d4k0i ThbICCwhJPB4jF4iO51rHjvX5kqiAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1558908978; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : from; bh=vWqkQpbUuM+ZXRKGxRRBAYFOlZ5edlOnAr/f2HZoT0k=; b=3OdNcb3FMdiJWT7EgQinM9MKaMoU00EW4sEUMqH2N1llvOq8bIUbklAt BIXZ7iYePOH3sE4MS3X1Ydy0wJIrWTHg4iKxEjUvny0ejFQb2c1tSmkTSO /au9RfhwntNUBVT3B0OmNUr4RUmzQHyWHVBa1Vt3/x8N5mjFHzozn2RKFn mvDk/fir6ebmouLoeL3tscEekrWndq5yBcz2Pgp5QlfsU5w77QOhCYQ6JQ dRs6/Oc5LMtr2XWxp3OLxcKL14OgHomilg90dK7Byi7xn3kBnkheoOPL5X HMRJTiSDGe382DjVxQn44mNfHNgRSNnNqDd3IJFc/bkMojRBNCy14Q== Received: from fifthhorseman.net (cpe-74-71-53-242.nyc.res.rr.com [74.71.53.242]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id 2031DF9A6 for ; Sun, 26 May 2019 18:16:17 -0400 (EDT) Received: by fifthhorseman.net (Postfix, from userid 1000) id 78EE2211EE; Sun, 26 May 2019 18:16:14 -0400 (EDT) From: Daniel Kahn Gillmor To: Notmuch Mail Subject: [PATCH v2 11/17] test: protected headers should work when both encrypted and signed. Date: Sun, 26 May 2019 18:16:04 -0400 Message-Id: <20190526221610.2833-12-dkg@fifthhorseman.net> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190526221610.2833-1-dkg@fifthhorseman.net> References: <20190526221610.2833-1-dkg@fifthhorseman.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 May 2019 22:16:24 -0000 Up to this point, we've tested protected headers on messages that have either been encrypted or signed, but not both. This adds a couple tests of signed+encrypted messages, one where the subject line is masked (outside subject line is "Subject Unavailable") and another where it is not (outside Subject: matches inner Subject:) See the discussion at https://dkg.fifthhorseman.net/blog/e-mail-cryptography.html#protected-headers for more details about the nuances between signed, stripped, and stubbed headers. Signed-off-by: Daniel Kahn Gillmor --- test/T356-protected-headers.sh | 16 +++++++++ .../encrypted-signed-not-masked.eml | 34 +++++++++++++++++++ .../protected-headers/encrypted-signed.eml | 34 +++++++++++++++++++ 3 files changed, 84 insertions(+) create mode 100644 test/corpora/protected-headers/encrypted-signed-not-masked.eml create mode 100644 test/corpora/protected-headers/encrypted-signed.eml diff --git a/test/T356-protected-headers.sh b/test/T356-protected-headers.sh index fee3b043..0a8d4bfa 100755 --- a/test/T356-protected-headers.sh +++ b/test/T356-protected-headers.sh @@ -99,4 +99,20 @@ output=$(notmuch search --format=json 'id:protected-header@crypto.notmuchmail.or test_json_nodes <<<"$output" \ 'subject:[0]["subject"]="This is a protected header"' +test_begin_subtest "verify protected header is both signed and encrypted" +output=$(notmuch show --decrypt=true --format=json id:encrypted-signed@crypto.notmuchmail.org) +test_json_nodes <<<"$output" \ + 'crypto:[0][0][0]["crypto"]={ + "signed":{"status": [{"status": "good", "fingerprint": "'$FINGERPRINT'", "userid": "'"$SELF_USERID"'", "created": 1525812676}], + "encrypted": true, "headers": ["Subject"]},"decrypted": {"status": "full", "header-mask": {"Subject": "Subject Unavailable"}}}' \ + 'subject:[0][0][0]["headers"]["Subject"]="Rhinoceros dinner"' + +test_begin_subtest "verify protected header is signed even when not masked" +output=$(notmuch show --decrypt=true --format=json id:encrypted-signed-not-masked@crypto.notmuchmail.org) +test_json_nodes <<<"$output" \ + 'crypto:[0][0][0]["crypto"]={ + "signed":{"status": [{"status": "good", "fingerprint": "'$FINGERPRINT'", "userid": "'"$SELF_USERID"'", "created": 1525812676}], + "encrypted": true, "headers": ["Subject"]},"decrypted": {"status": "full"}}' \ + 'subject:[0][0][0]["headers"]["Subject"]="Rhinoceros dinner"' + test_done diff --git a/test/corpora/protected-headers/encrypted-signed-not-masked.eml b/test/corpora/protected-headers/encrypted-signed-not-masked.eml new file mode 100644 index 00000000..8dfd7c39 --- /dev/null +++ b/test/corpora/protected-headers/encrypted-signed-not-masked.eml @@ -0,0 +1,34 @@ +From: test_suite@notmuchmail.org +To: test_suite@notmuchmail.org +Subject: Rhinoceros dinner +Date: Sat, 01 Jan 2000 12:00:00 +0000 +Message-ID: +MIME-Version: 1.0 +Content-Type: multipart/encrypted; boundary="=-=-="; + protocol="application/pgp-encrypted" + +--=-=-= +Content-Type: application/pgp-encrypted + +Version: 1 + +--=-=-= +Content-Type: application/octet-stream + +-----BEGIN PGP MESSAGE----- + +hIwDxE023q1UqxYBBADAJ03D4w48sefkQsBWXUc1spTljROjVN+y5a2yCKtYMt3M +wWMeQyem5hwLpLYRCfeIzXCrlBfpZffuOkA5okGGVEWFvJ5a1kZNZnH5Wg0ccBp7 +KBGnJY0gS/BlrKK2Sjmk9Z3ww7GAgDGPbc7mc3Csj9G38UvneBdrQgm6kZR3GNLA +6AGLN3KJETruI3Js6++aG+7tSkJ8Vo4WCVUR7oQROwF601X0QF/XghCoJCrx8B/1 +cw6Yb2wQj2nv3gw1rqWVsPVpAKsMc1yHx/2Vsee/VPtt4f67fSAMuJF3EJ6JkcK7 +tM761v69GoJGgvsie45pb1N2l/GfVMuwWU0wZhEsF7eXxqPzoE/kIGX1XIqleLaw +On2kPSM5RgqV6gLOcw4WaFPi0oMbDhltNs72SV9cV6ZhhuwEQRq+u/K76NKLwte2 +R1JutAiuPZVF0WanmmiN6RbIpWOB5XxQfWagfr4vcf/03TaLP4hJMnqUdFMk20HP +eI8TMQxkfryZK2Z6VxEBVdXhK05VEdkolmc4j9U+76A96Gd5zbYPApirkebmZatS +X3rKKAiBqwWrFXi/7LNDoCwhRRmqDuHXruh3vZEcz+xiPfJh0G31GJQgIpE15Sv6 +trf20u3CXAFjHg9zPpSFV7uAOsqv7bg+xtG9PgN4aLCiVbXHsT0z6PAz+6K+SiKw +QW8ZOtLikj5HyLAz/TDcsIShFaM3QHk2qq9RY10kmxlQVrf9Oyh3Wmc= +=om0O +-----END PGP MESSAGE----- +--=-=-=-- diff --git a/test/corpora/protected-headers/encrypted-signed.eml b/test/corpora/protected-headers/encrypted-signed.eml new file mode 100644 index 00000000..c97d8c3c --- /dev/null +++ b/test/corpora/protected-headers/encrypted-signed.eml @@ -0,0 +1,34 @@ +From: test_suite@notmuchmail.org +To: test_suite@notmuchmail.org +Subject: Subject Unavailable +Date: Sat, 01 Jan 2000 12:00:00 +0000 +Message-ID: +MIME-Version: 1.0 +Content-Type: multipart/encrypted; boundary="=-=-="; + protocol="application/pgp-encrypted" + +--=-=-= +Content-Type: application/pgp-encrypted + +Version: 1 + +--=-=-= +Content-Type: application/octet-stream + +-----BEGIN PGP MESSAGE----- + +hIwDxE023q1UqxYBBADAJ03D4w48sefkQsBWXUc1spTljROjVN+y5a2yCKtYMt3M +wWMeQyem5hwLpLYRCfeIzXCrlBfpZffuOkA5okGGVEWFvJ5a1kZNZnH5Wg0ccBp7 +KBGnJY0gS/BlrKK2Sjmk9Z3ww7GAgDGPbc7mc3Csj9G38UvneBdrQgm6kZR3GNLA +6AGLN3KJETruI3Js6++aG+7tSkJ8Vo4WCVUR7oQROwF601X0QF/XghCoJCrx8B/1 +cw6Yb2wQj2nv3gw1rqWVsPVpAKsMc1yHx/2Vsee/VPtt4f67fSAMuJF3EJ6JkcK7 +tM761v69GoJGgvsie45pb1N2l/GfVMuwWU0wZhEsF7eXxqPzoE/kIGX1XIqleLaw +On2kPSM5RgqV6gLOcw4WaFPi0oMbDhltNs72SV9cV6ZhhuwEQRq+u/K76NKLwte2 +R1JutAiuPZVF0WanmmiN6RbIpWOB5XxQfWagfr4vcf/03TaLP4hJMnqUdFMk20HP +eI8TMQxkfryZK2Z6VxEBVdXhK05VEdkolmc4j9U+76A96Gd5zbYPApirkebmZatS +X3rKKAiBqwWrFXi/7LNDoCwhRRmqDuHXruh3vZEcz+xiPfJh0G31GJQgIpE15Sv6 +trf20u3CXAFjHg9zPpSFV7uAOsqv7bg+xtG9PgN4aLCiVbXHsT0z6PAz+6K+SiKw +QW8ZOtLikj5HyLAz/TDcsIShFaM3QHk2qq9RY10kmxlQVrf9Oyh3Wmc= +=om0O +-----END PGP MESSAGE----- +--=-=-=-- -- 2.20.1