#17: implement DANE TLSA, MTA-STS policy resolution, ARC sealing and mail authentication
This commit is contained in:
Lucas Rayan committed
1 parent
df8b809683
commit
bd0af98076
22 files changed
+3296
No files matched your search
@@ -0,0 +1,243 @@
|
||||
package mailauth
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"net"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
dkimlib "github.com/emersion/go-msgauth/dkim"
|
||||
|
||||
"lambdamail/protocols/internal/application/port"
|
||||
"lambdamail/protocols/internal/infrastructure/dkim"
|
||||
)
|
||||
|
||||
// fakeZone answers TXT and address lookups from a fixed map, so the whole
|
||||
// authentication chain runs without touching the real internet.
|
||||
type fakeZone struct {
|
||||
txt map[string][]string
|
||||
a map[string][]string
|
||||
}
|
||||
|
||||
func (z *fakeZone) LookupTXT(_ context.Context, name string) ([]string, error) {
|
||||
return z.lookupTXT(name)
|
||||
}
|
||||
|
||||
func (z *fakeZone) lookupTXT(name string) ([]string, error) {
|
||||
name = strings.TrimSuffix(name, ".")
|
||||
if records, ok := z.txt[name]; ok {
|
||||
return records, nil
|
||||
}
|
||||
return nil, &net.DNSError{Err: "no such host", Name: name, IsNotFound: true}
|
||||
}
|
||||
|
||||
func (z *fakeZone) LookupIPAddr(_ context.Context, name string) ([]net.IPAddr, error) {
|
||||
name = strings.TrimSuffix(name, ".")
|
||||
var out []net.IPAddr
|
||||
for _, ip := range z.a[name] {
|
||||
out = append(out, net.IPAddr{IP: net.ParseIP(ip)})
|
||||
}
|
||||
if len(out) == 0 {
|
||||
return nil, &net.DNSError{Err: "no such host", Name: name, IsNotFound: true}
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (z *fakeZone) LookupMX(_ context.Context, name string) ([]*net.MX, error) {
|
||||
return nil, &net.DNSError{Err: "no such host", Name: name, IsNotFound: true}
|
||||
}
|
||||
|
||||
func (z *fakeZone) LookupAddr(_ context.Context, addr string) ([]string, error) {
|
||||
return nil, &net.DNSError{Err: "no such host", Name: addr, IsNotFound: true}
|
||||
}
|
||||
|
||||
func newTestAuthenticator(zone *fakeZone) *Authenticator {
|
||||
return NewAuthenticator("mail.lambdamail.test").WithLookupTXT(zone.lookupTXT, zone)
|
||||
}
|
||||
|
||||
const plainMessage = "From: sender@sender.test\r\n" +
|
||||
"To: rcpt@lambdamail.test\r\n" +
|
||||
"Subject: hello\r\n" +
|
||||
"Date: Mon, 20 Jul 2026 10:00:00 +0000\r\n" +
|
||||
"Message-ID: <m1@sender.test>\r\n" +
|
||||
"\r\n" +
|
||||
"body\r\n"
|
||||
|
||||
// A sender whose SPF authorises the connecting IP, with a DMARC record in
|
||||
// place, must come out as pass/pass on the aligned identifier.
|
||||
func TestAuthenticate_SpfPassAlignsDmarc(t *testing.T) {
|
||||
zone := &fakeZone{
|
||||
txt: map[string][]string{
|
||||
"sender.test": {"v=spf1 ip4:192.0.2.10 -all"},
|
||||
"_dmarc.sender.test": {"v=DMARC1; p=reject"},
|
||||
},
|
||||
}
|
||||
|
||||
got := newTestAuthenticator(zone).Authenticate(context.Background(), port.InboundAuthInput{
|
||||
ClientIP: net.ParseIP("192.0.2.10"),
|
||||
HeloDomain: "mx.sender.test",
|
||||
EnvelopeFrom: "sender@sender.test",
|
||||
Message: []byte(plainMessage),
|
||||
})
|
||||
|
||||
if got.SPF != port.AuthResultPass {
|
||||
t.Errorf("SPF = %q, want pass", got.SPF)
|
||||
}
|
||||
if got.DMARC != port.AuthResultPass {
|
||||
t.Errorf("DMARC = %q, want pass (SPF aligned with the From: domain)", got.DMARC)
|
||||
}
|
||||
if got.DmarcPolicy != "reject" {
|
||||
t.Errorf("DmarcPolicy = %q, want reject", got.DmarcPolicy)
|
||||
}
|
||||
if !strings.Contains(got.AuthenticationResults, "spf=pass") ||
|
||||
!strings.Contains(got.AuthenticationResults, "dmarc=pass") {
|
||||
t.Errorf("Authentication-Results does not report the verdicts: %s", got.AuthenticationResults)
|
||||
}
|
||||
if !strings.HasPrefix(got.AuthenticationResults, "mail.lambdamail.test") {
|
||||
t.Errorf("Authentication-Results must name this server first: %s", got.AuthenticationResults)
|
||||
}
|
||||
}
|
||||
|
||||
// An unauthorised IP must fail SPF, and with no DKIM signature to fall back
|
||||
// on, DMARC fails too - which is what lets the reject policy be honoured.
|
||||
func TestAuthenticate_SpfFailWithoutDkimFailsDmarc(t *testing.T) {
|
||||
zone := &fakeZone{
|
||||
txt: map[string][]string{
|
||||
"sender.test": {"v=spf1 ip4:192.0.2.10 -all"},
|
||||
"_dmarc.sender.test": {"v=DMARC1; p=quarantine"},
|
||||
},
|
||||
}
|
||||
|
||||
got := newTestAuthenticator(zone).Authenticate(context.Background(), port.InboundAuthInput{
|
||||
ClientIP: net.ParseIP("198.51.100.66"),
|
||||
HeloDomain: "evil.test",
|
||||
EnvelopeFrom: "sender@sender.test",
|
||||
Message: []byte(plainMessage),
|
||||
})
|
||||
|
||||
if got.SPF != port.AuthResultFail {
|
||||
t.Errorf("SPF = %q, want fail", got.SPF)
|
||||
}
|
||||
if got.DMARC != port.AuthResultFail {
|
||||
t.Errorf("DMARC = %q, want fail", got.DMARC)
|
||||
}
|
||||
if got.DmarcPolicy != "quarantine" {
|
||||
t.Errorf("DmarcPolicy = %q, want quarantine", got.DmarcPolicy)
|
||||
}
|
||||
}
|
||||
|
||||
// A valid DKIM signature must rescue DMARC even when SPF fails, which is
|
||||
// exactly the forwarding case DKIM exists for.
|
||||
func TestAuthenticate_DkimPassAlignsDmarcDespiteSpfFail(t *testing.T) {
|
||||
generated, err := dkim.Generate(dkim.AlgorithmRSA2048)
|
||||
if err != nil {
|
||||
t.Fatalf("Generate: %v", err)
|
||||
}
|
||||
signer, err := dkim.ParsePrivateKey(generated.PrivateKeyPEM)
|
||||
if err != nil {
|
||||
t.Fatalf("ParsePrivateKey: %v", err)
|
||||
}
|
||||
|
||||
var signed bytes.Buffer
|
||||
err = dkimlib.Sign(&signed, strings.NewReader(plainMessage), &dkimlib.SignOptions{
|
||||
Domain: "sender.test",
|
||||
Selector: "default",
|
||||
Signer: signer,
|
||||
HeaderCanonicalization: dkimlib.CanonicalizationRelaxed,
|
||||
BodyCanonicalization: dkimlib.CanonicalizationRelaxed,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("Sign: %v", err)
|
||||
}
|
||||
|
||||
zone := &fakeZone{
|
||||
txt: map[string][]string{
|
||||
"sender.test": {"v=spf1 ip4:192.0.2.10 -all"},
|
||||
"_dmarc.sender.test": {"v=DMARC1; p=reject"},
|
||||
"default._domainkey.sender.test": {"v=DKIM1; k=rsa; p=" + generated.PublicKeyBase64},
|
||||
},
|
||||
}
|
||||
|
||||
got := newTestAuthenticator(zone).Authenticate(context.Background(), port.InboundAuthInput{
|
||||
ClientIP: net.ParseIP("203.0.113.99"), // forwarder, not in SPF
|
||||
HeloDomain: "forwarder.test",
|
||||
EnvelopeFrom: "sender@sender.test",
|
||||
Message: signed.Bytes(),
|
||||
})
|
||||
|
||||
if got.DKIM != port.AuthResultPass {
|
||||
t.Fatalf("DKIM = %q, want pass", got.DKIM)
|
||||
}
|
||||
if got.SPF == port.AuthResultPass {
|
||||
t.Fatalf("SPF unexpectedly passed; the test cannot prove DKIM rescued DMARC")
|
||||
}
|
||||
if got.DMARC != port.AuthResultPass {
|
||||
t.Errorf("DMARC = %q, want pass via the aligned DKIM signature", got.DMARC)
|
||||
}
|
||||
}
|
||||
|
||||
// A tampered body must invalidate the signature.
|
||||
func TestAuthenticate_TamperedBodyFailsDkim(t *testing.T) {
|
||||
generated, _ := dkim.Generate(dkim.AlgorithmRSA2048)
|
||||
signer, _ := dkim.ParsePrivateKey(generated.PrivateKeyPEM)
|
||||
|
||||
var signed bytes.Buffer
|
||||
dkimlib.Sign(&signed, strings.NewReader(plainMessage), &dkimlib.SignOptions{
|
||||
Domain: "sender.test", Selector: "default", Signer: signer,
|
||||
HeaderCanonicalization: dkimlib.CanonicalizationRelaxed,
|
||||
BodyCanonicalization: dkimlib.CanonicalizationRelaxed,
|
||||
})
|
||||
|
||||
tampered := bytes.Replace(signed.Bytes(), []byte("body"), []byte("evil"), 1)
|
||||
|
||||
zone := &fakeZone{txt: map[string][]string{
|
||||
"default._domainkey.sender.test": {"v=DKIM1; k=rsa; p=" + generated.PublicKeyBase64},
|
||||
}}
|
||||
|
||||
got := newTestAuthenticator(zone).Authenticate(context.Background(), port.InboundAuthInput{
|
||||
ClientIP: net.ParseIP("203.0.113.99"),
|
||||
Message: tampered,
|
||||
})
|
||||
|
||||
if got.DKIM != port.AuthResultFail {
|
||||
t.Errorf("DKIM = %q, want fail for a tampered body", got.DKIM)
|
||||
}
|
||||
}
|
||||
|
||||
// A domain publishing no DMARC record yields "none", never a hard failure.
|
||||
func TestAuthenticate_NoDmarcRecordYieldsNone(t *testing.T) {
|
||||
zone := &fakeZone{txt: map[string][]string{"sender.test": {"v=spf1 -all"}}}
|
||||
|
||||
got := newTestAuthenticator(zone).Authenticate(context.Background(), port.InboundAuthInput{
|
||||
ClientIP: net.ParseIP("198.51.100.1"),
|
||||
EnvelopeFrom: "sender@sender.test",
|
||||
Message: []byte(plainMessage),
|
||||
})
|
||||
|
||||
if got.DMARC != port.AuthResultNone {
|
||||
t.Errorf("DMARC = %q, want none", got.DMARC)
|
||||
}
|
||||
if got.DmarcPolicy != "" {
|
||||
t.Errorf("DmarcPolicy = %q, want empty", got.DmarcPolicy)
|
||||
}
|
||||
}
|
||||
|
||||
// A bounce arrives with an empty envelope sender; RFC 7208 section 2.4 says
|
||||
// the HELO identity is checked instead, and it must not crash.
|
||||
func TestAuthenticate_EmptyEnvelopeFromChecksHelo(t *testing.T) {
|
||||
zone := &fakeZone{txt: map[string][]string{
|
||||
"mx.sender.test": {"v=spf1 ip4:192.0.2.10 -all"},
|
||||
}}
|
||||
|
||||
got := newTestAuthenticator(zone).Authenticate(context.Background(), port.InboundAuthInput{
|
||||
ClientIP: net.ParseIP("192.0.2.10"),
|
||||
HeloDomain: "mx.sender.test",
|
||||
EnvelopeFrom: "",
|
||||
Message: []byte(plainMessage),
|
||||
})
|
||||
|
||||
if got.SPF != port.AuthResultPass {
|
||||
t.Errorf("SPF = %q, want pass against the HELO identity", got.SPF)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user