View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0012125 | Pepsi | tests | public | 2026-11-12 07:06 | 2026-11-12 07:06 |
| Reporter | vecirex | Assigned To | vecirex | Due Date | |
| Priority | normal | Severity | feature | Reproducibility | have not tried |
| Status | acknowledged | Resolution | open | ||
| Summary | 0012125: Test: full encryption matrix v0.1.1 | ||||
| Description | Systematic test of every encryption combination pepsi offers, on a real deployment (mail.g0v.ch / mail.fragdenstaat.ch, pepsi 0.1.1, rootless podman, IPv4 via DNAT and native IPv6). Each test records: command, expected result, observed result, log line. Pass = observed matches expected. A. Inbound MX, port 25 (MODE=starttls, opportunistic) 1. IPv4, STARTTLS, TLS 1.3 -> accepted, TLS logged 2. IPv4, STARTTLS, TLS 1.2 -> accepted 3. IPv4, STARTTLS, TLS 1.1/1.0 -> handshake refused, plaintext fallback allowed? 4. IPv4, no STARTTLS (plaintext) -> accepted (opportunistic), marked as unencrypted 5. IPv6, STARTTLS, TLS 1.3 -> accepted 6. IPv6, STARTTLS, TLS 1.2 -> accepted 7. IPv6, STARTTLS, TLS 1.1/1.0 -> refused 8. IPv6, plaintext -> accepted, marked as unencrypted 9. Certificate: chain, SAN covers mail.g0v.ch and mail.fragdenstaat.ch (SNI) 10. STARTTLS command injection (pipelined commands before TLS) -> rejected B. Submission, port 465 (MODE=tls, implicit TLS) 11. IPv4, TLS 1.3, AUTH -> accepted 12. IPv4, TLS 1.2, AUTH -> accepted 13. IPv4, TLS 1.1/1.0 -> refused 14. IPv6, TLS 1.3, AUTH -> accepted 15. IPv6, TLS 1.2, AUTH -> accepted 16. IPv6, TLS 1.1/1.0 -> refused 17. TLS client certificate auth (TLS_AUTH_CLIENT), valid cert -> accepted 18. TLS client certificate, unknown/expired cert -> rejected 19. No AUTH -> relay denied 20. Plaintext connection to 465 -> no banner / refused C. Submission, port 587 (MODE=starttls) 21. IPv4, STARTTLS 1.3, AUTH -> accepted 22. IPv4, STARTTLS 1.2, AUTH -> accepted 23. IPv4, AUTH before STARTTLS -> refused (no AUTH offered in EHLO) 24. IPv6, STARTTLS 1.3, AUTH -> accepted 25. IPv6, STARTTLS 1.2, AUTH -> accepted 26. IPv6, AUTH before STARTTLS -> refused 27. Submission-identity map: authenticated user sends as foreign address -> rejected D. Outbound (stage-internet, DANE=strict, DNS over TLS) 28. Remote MX with valid DNSSEC + matching TLSA -> delivered, DANE verified 29. Remote MX with valid DNSSEC + mismatching TLSA -> deferred, not downgraded 30. Remote MX with DNSSEC but no TLSA -> opportunistic TLS 31. Remote MX with bogus DNSSEC -> deferred 32. Remote MX without STARTTLS -> behaviour documented (plaintext or defer) 33. Remote MX with MTA-STS enforce, valid cert -> delivered 34. Remote MX with MTA-STS enforce, invalid cert -> deferred 35. Remote MX with MTA-STS testing -> delivered, mismatch logged 36. Outbound over IPv4 vs IPv6 (both), TLS version logged 37. DNS resolver unreachable (DoT to 1.1.1.1 blocked) -> deferred, not plaintext DNS E. HTTPS (pepsi-httpd) 38. MTA-STS policy on mta-sts.<domain> via SNI, correct cert, TLS 1.2/1.3 39. Admin listener reachable only where intended, TLS enforced 40. TLS 1.1/1.0 on HTTPS -> refused F. Message-level crypto 41. DKIM signing outbound (selector pepsi), verify at receiver (g0v.ch, fragdenstaat.ch) 42. DKIM signing on bounces and SRS-forwarded mail (dkim-sign-relay) 43. DMARC alignment of SRS envelope (SRS_DOMAIN g0v.ch warning at startup) 44. ARC stage on forwarded mail 45. Autocrypt header handling (AUTOCRYPT_LEARN=no and =yes) 46. Inbound DKIM/DMARC failure handling (cf. message failing in dkim-sign with DMARC fail) G. Mailbox access 47. IMAPS 993 / IMAP 143+STARTTLS: currently fails in rootless podman ("bind(*, 993) failed: Permission denied") -> needs high-port listener or cap 48. After fix: IMAPS TLS 1.3/1.2, IPv4/IPv6, plaintext login refused H. Negative / regression 49. TLS reports (TLS_REPORTS=no and =yes) -> TLSRPT sent/received 50. Certificate renewal (Let's Encrypt) picked up without restart Environment notes: found during setup that a VPN kill switch on the host silently dropped all inbound traffic; tests must state host firewall state. | ||||
| Tags | email, quality, testing | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-11-12 07:06 | vecirex | New Issue | |
| 2026-11-12 07:06 | vecirex | Status | new => assigned |
| 2026-11-12 07:06 | vecirex | Assigned To | => vecirex |
| 2026-11-12 07:06 | vecirex | Status | assigned => acknowledged |
| 2026-11-12 07:06 | vecirex | Tag Attached: email | |
| 2026-11-12 07:06 | vecirex | Tag Attached: testing | |
| 2026-11-12 07:06 | vecirex | Tag Attached: quality |