mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

audit 4: findings of the two reviews
test / test (push) Canceled after 0s
Details

Browse Source 
- Two inbound domains on one upstream could never change its TLS mode,
  each save refused for the other (medium): SetTransportAs changes the
  mode for every domain on the upstream when the one saving may change
  them all; a domain user who may not is refused with the mode, not the
  other tenant's domain name (security F1: the first version named it).
- A deletion's leftover DKIM key is removed by Resync (Reload
  configuration, a restore's first start) for names no domain has.
- The backup's write deadline moves before Check.
- hasUnsavedEdit skips password and file fields and compares a multiple
  select's options; htmx.config.timeout 30 s, so a refresh never answered
  ends and is tried again; a failed refresh's promise is handled.
- An empty filtered Outbound log says no message matches the filters.
- The dummy bcrypt hash is made at start; a DMARC part over 8 MiB is
  refused for its size like the other two limits.
- Health's Configuration box says what Reload writes (design first,
  32dfe4a).
- Docs: CHANGELOG, guide § Inbound, security.md (the shared upstream's
  mode, the profile form's "username taken"), architecture.md (owed to an
  address), the plan's notes corrected.
Tests: the shared upstream (service, handler), the leftover key, all eight
Health boxes ordered, the subject from before migration 0011, the new JS
cases.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 636 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-15 12:46:52 +03:00
co-authored by Claude Opus 5.5
parent 32dfe4a2cf
commit eaa7de0754
23 changed files with 359 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/inbound/service.go
+53 -26
View File
@@ -5,6 +5,7 @@
package inbound
import (
"fmt"
"strings"
"github.com/mixeme/selfpost/internal/postfix"
@@ -54,51 +55,77 @@ func (s *Service) Add(name string) (store.InboundDomain, error) {
return d, nil
}
// SetTransport validates and saves the upstream, then rebuilds the maps.
// SetTransport validates and saves the upstream, then rebuilds the maps; the
// other domains forwarded to the same upstream take its TLS mode with it
// (SetTransportAs, with every domain changeable).
func (s *Service) SetTransport(id int64, host, portRaw, tlsMode string) error {
_, err := s.SetTransportAs(id, host, portRaw, tlsMode, func(store.InboundDomain) bool { return true })
return err
}
// UpstreamShared refuses an upstream another inbound domain forwards to with
// another TLS mode, when the one saving may not change that domain. Its text
// is for the log; the panel tells a domain user the mode, not the domain,
// which is another tenant's (security review of audit stage 4).
type UpstreamShared struct {
Upstream string
Mode string
Domain string
}
func (e *UpstreamShared) Error() string {
return fmt.Sprintf("%s is the upstream of %s too, with TLS mode %s", e.Upstream, e.Domain, e.Mode)
}
// SetTransportAs validates and saves the upstream of domain id, then rebuilds
// the maps. An upstream has one TLS mode: Postfix's TLS policy is keyed by the
// next hop, not by the domain (smtp_tls_policy_maps; Postfix 3.7.11,
// README_FILES/TLS_README: the key is the verbatim next-hop), so two domains
// to one [host]:port share one mode - the map held both keys and the first by
// domain name won with a warning (audit 2026-10-12, L5). The other domains
// forwarded to the upstream with another mode take the new one, when
// mayChange allows each; one it does not is an *UpstreamShared and nothing is
// saved. Before, the save was refused, and two domains sharing an upstream
// could never change its mode (review of audit stage 4). changed is how many
// other domains took the mode.
func (s *Service) SetTransportAs(id int64, host, portRaw, tlsMode string, mayChange func(store.InboundDomain) bool) (changed int, err error) {
if _, err := s.store.GetInboundDomain(id); err != nil {
return err
return 0, err
}
host = normalizeHost(host)
if err := checkHost(host); err != nil {
return err
return 0, err
}
port, err := parsePort(portRaw)
if err != nil {
return err
return 0, err
}
if err := checkTLSMode(tlsMode); err != nil {
return err
return 0, err
}
if err := s.checkOneTLSModePerUpstream(id, host, port, tlsMode); err != nil {
return err
}
if err := s.store.UpdateInboundTransport(id, host, port, tlsMode); err != nil {
return err
}
return s.Resync()
}
// checkOneTLSModePerUpstream refuses an upstream another inbound domain
// already forwards to with another TLS mode. Postfix's TLS policy is keyed by
// the next hop, not by the domain (smtp_tls_policy_maps; Postfix 3.7.11,
// README_FILES/TLS_README: the key is the verbatim next-hop), so two domains
// to one [host]:port share one mode: the map held both keys, and the first by
// domain name won with a warning - the form's choice for the second domain
// was not what Postfix did (audit 2026-10-12, L5).
func (s *Service) checkOneTLSModePerUpstream(id int64, host string, port int, tlsMode string) error {
domains, err := s.store.ListInboundDomains()
if err != nil {
return err
return 0, err
}
var others []store.InboundDomain
for _, d := range domains {
if d.ID == id || d.Port != port || normalizeHost(d.Host) != host || d.TLSMode == tlsMode {
continue
}
return invalid("[%s]:%d is already the upstream of %s, with TLS mode %s: an upstream has one TLS mode - choose %s here, or change it on %s first",
host, port, d.Name, d.TLSMode, d.TLSMode, d.Name)
if !mayChange(d) {
return 0, &UpstreamShared{Upstream: fmt.Sprintf("[%s]:%d", host, port), Mode: d.TLSMode, Domain: d.Name}
}
others = append(others, d)
}
return nil
if err := s.store.UpdateInboundTransport(id, host, port, tlsMode); err != nil {
return 0, err
}
for _, d := range others {
if err := s.store.UpdateInboundTransport(d.ID, d.Host, d.Port, tlsMode); err != nil {
return 0, err
}
}
return len(others), s.Resync()
}
// SetRecipients validates the mode and, in list mode, every address, then
internal/inbound/service_test.go
+37 -22
View File
@@ -2,7 +2,6 @@ package inbound
import (
"errors"
"strings"
"testing"
"github.com/mixeme/selfpost/internal/postfix"
@@ -14,9 +13,11 @@ type nullMaps struct{}
func (nullMaps) RebuildInboundMaps([]postfix.InboundRoute) error { return nil }
// An upstream has one TLS mode, since Postfix keys the policy by the next
// hop: a second domain saved to the same [host]:port with another mode is
// refused with the first domain's name and mode; the same mode is fine
// (audit 2026-10-12, L5).
// hop (audit 2026-10-12, L5): the other domains forwarded to it take the mode
// saved for one of them, when the one saving may change them; one they may
// not is refused, and nothing is saved. Two domains on one upstream can
// change its mode (review of stage 4: they could not, each refused for the
// other).
func TestOneTLSModePerUpstream(t *testing.T) {
st, err := store.Open(t.TempDir() + "/test.db")
if err != nil {
@@ -24,30 +25,44 @@ func TestOneTLSModePerUpstream(t *testing.T) {
}
defer st.Close()
s := NewService(st, nullMaps{})
a, err := s.Add("a.example")
if err != nil {
a, _ := s.Add("a.example")
b, _ := s.Add("b.example")
c, _ := s.Add("c.example")
mode := func(id int64) string {
d, err := st.GetInboundDomain(id)
if err != nil {
t.Fatal(err)
}
return d.TLSMode
}
all := func(store.InboundDomain) bool { return true }
if _, err := s.SetTransportAs(a.ID, "10.0.0.8", "25", "encrypt", all); err != nil {
t.Fatal(err)
}
b, err := s.Add("b.example")
if err != nil {
t.Fatal(err)
if n, err := s.SetTransportAs(b.ID, "[10.0.0.8]", "25", "encrypt", all); err != nil || n != 0 {
t.Fatalf("the same mode: %d, %v", n, err)
}
if err := s.SetTransport(a.ID, "10.0.0.8", "25", "encrypt"); err != nil {
t.Fatal(err)
// Either domain changes the mode, for both.
if n, err := s.SetTransportAs(a.ID, "10.0.0.8", "25", "may", all); err != nil || n != 1 {
t.Fatalf("a changes the shared mode: %d, %v", n, err)
}
err = s.SetTransport(b.ID, "[10.0.0.8]", "25", "may")
var verr *ValidationError
if !errors.As(err, &verr) || !strings.Contains(err.Error(), "[10.0.0.8]:25 is already the upstream of a.example, with TLS mode encrypt") {
t.Fatalf("a second mode for one upstream = %v", err)
if mode(a.ID) != "may" || mode(b.ID) != "may" {
t.Errorf("modes after a's change: %s, %s", mode(a.ID), mode(b.ID))
}
if err := s.SetTransport(b.ID, "10.0.0.8", "25", "encrypt"); err != nil {
t.Errorf("the same mode refused: %v", err)
// Another port is another next hop.
if n, err := s.SetTransportAs(c.ID, "10.0.0.8", "2525", "none", all); err != nil || n != 0 {
t.Errorf("another port: %d, %v", n, err)
}
if err := s.SetTransport(b.ID, "10.0.0.8", "2525", "may"); err != nil {
t.Errorf("another port refused: %v", err)
// One that may not change b is refused, with b's mode, and saves nothing.
notB := func(d store.InboundDomain) bool { return d.ID != b.ID }
_, err = s.SetTransportAs(c.ID, "10.0.0.8", "25", "encrypt", notB)
var shared *UpstreamShared
if !errors.As(err, &shared) || shared.Mode != "may" || shared.Domain != "b.example" || shared.Upstream != "[10.0.0.8]:25" {
t.Fatalf("a mode for another's upstream = %v", err)
}
// The domain itself may change its own mode.
if err := s.SetTransport(a.ID, "10.0.0.8", "25", "may"); err != nil {
t.Errorf("a domain changing its own mode refused: %v", err)
if d, _ := st.GetInboundDomain(c.ID); d.Port != 2525 || mode(a.ID) != "may" {
t.Errorf("the refused save changed something: c on %d, a %s", d.Port, mode(a.ID))
}
}