diff --git a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh index 4b66e2a5c..3f2e6925e 100644 --- a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh +++ b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh @@ -22,7 +22,7 @@ smp-server --version # Initialize server ip_address=$(curl ifconfig.me) -smp-server init -l --ip $ip_address +smp-server init -l --disable-web --ip $ip_address # Server fingerprint fingerprint=$(cat /etc/opt/simplex/fingerprint) diff --git a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh index c7e63914e..8f4443d0d 100644 --- a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh +++ b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh @@ -12,6 +12,11 @@ Check SMP server status with: systemctl status smp-server To keep this server secure, the UFW firewall is enabled. All ports are BLOCKED except 22 (SSH), 443 (HTTPS), 5223 (SMP server). +Embedded HTTPS web is disabled because this image does not provision +/etc/opt/simplex/web.crt or /etc/opt/simplex/web.key. To enable it, provision +those files, uncomment WEB https/cert/key in /etc/opt/simplex/smp-server.ini, +and restart smp-server. + ******************************************************************************** To stop seeing this message delete line - bash /opt/simplex/on_login.sh - from /root/.bashrc EOF diff --git a/scripts/smp-server-linode.sh b/scripts/smp-server-linode.sh index 2f57479c3..0babd32af 100644 --- a/scripts/smp-server-linode.sh +++ b/scripts/smp-server-linode.sh @@ -75,6 +75,9 @@ init_opts=() [[ $ENABLE_STORE_LOG == "on" ]] && init_opts+=(-l) +# This script does not provision /etc/opt/simplex/web.crt or web.key. +init_opts+=(--disable-web) + ip_address=$(curl ifconfig.me) init_opts+=(--ip $ip_address) @@ -111,6 +114,11 @@ Check SMP server status with: systemctl status smp-server To keep this server secure, the UFW firewall is enabled. All ports are BLOCKED except 22 (SSH), 443 (HTTPS), 5223 (SMP server). +Embedded HTTPS web is disabled because this script does not provision +/etc/opt/simplex/web.crt or /etc/opt/simplex/web.key. To enable it, provision +those files, uncomment WEB https/cert/key in /etc/opt/simplex/smp-server.ini, +and restart smp-server. + ******************************************************************************** To stop seeing this message delete line - bash /opt/simplex/on_login.sh - from /root/.bashrc EOF2 diff --git a/src/Simplex/Messaging/Crypto/BBS.hs b/src/Simplex/Messaging/Crypto/BBS.hs index 453e5d63f..7b19ca004 100644 --- a/src/Simplex/Messaging/Crypto/BBS.hs +++ b/src/Simplex/Messaging/Crypto/BBS.hs @@ -287,8 +287,10 @@ bbsProofVerify :: [ByteString] -> IO Bool bbsProofVerify (BBSPublicKey pk) (BBSProof proof) (BBSHeader header) (BBSPresHeader ph) disclosedIdxs numMessages disclosedMsgs + | numMessages < 0 = pure False | length disclosedIdxs /= length disclosedMsgs = pure False | not (ascendingInRange disclosedIdxs numMessages) = pure False + | B.length proof /= bbsProofLen (numMessages - length disclosedIdxs) = pure False | otherwise = withBS pk $ \pkPtr _ -> withBS proof $ \proofPtr proofLen -> diff --git a/tests/CLITests.hs b/tests/CLITests.hs index 66af74ab8..b177d6004 100644 --- a/tests/CLITests.hs +++ b/tests/CLITests.hs @@ -13,7 +13,7 @@ import qualified Crypto.PubKey.RSA as RSA import qualified Data.ByteString.Lazy as BL import qualified Data.HashMap.Strict as HM import Data.Ini (Ini (..), lookupValue, readIniFile, writeIniFile) -import Data.List (isPrefixOf) +import Data.List (isInfixOf, isPrefixOf) import qualified Data.Text as T import qualified Data.X509 as X import qualified Data.X509.File as XF @@ -85,6 +85,7 @@ cliTests = do it "no store log, no password" $ smpServerTest False False it "with store log, no password" $ smpServerTest True False it "static files" smpServerTestStatic + it "cloud scripts disable embedded web without certificates" smpCloudScriptsDisableWeb #if defined(dbServerPostgres) around_ (postgressBracket ntfTestServerDBConnectInfo) $ before_ (createNtfSchema ntfTestServerDBConnectInfo ntfTestStoreDBOpts) $ describe "Ntf server CLI" $ do @@ -200,6 +201,23 @@ smpServerTestStatic = do let X.CertificateChain cc = tlsPeerCert tls in map (X.signedObject . X.getSigned) cc +smpCloudScriptsDisableWeb :: HasCallStack => IO () +smpCloudScriptsDisableWeb = do + linode <- readFile "scripts/smp-server-linode.sh" + digitalOceanInit <- + readFile "scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh" + digitalOceanLogin <- + readFile "scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh" + linode `shouldSatisfy` ("init_opts+=(--disable-web)" `isInfixOf`) + linode `shouldSatisfy` ("web.crt" `isInfixOf`) + linode `shouldSatisfy` ("web.key" `isInfixOf`) + linode `shouldSatisfy` ("uncomment WEB https/cert/key" `isInfixOf`) + digitalOceanInit + `shouldSatisfy` ("smp-server init -l --disable-web --ip $ip_address" `isInfixOf`) + digitalOceanLogin `shouldSatisfy` ("web.crt" `isInfixOf`) + digitalOceanLogin `shouldSatisfy` ("web.key" `isInfixOf`) + digitalOceanLogin `shouldSatisfy` ("uncomment WEB https/cert/key" `isInfixOf`) + #if defined(dbServerPostgres) createNtfSchema :: PSQL.ConnectInfo -> DBOpts -> IO () createNtfSchema connInfo DBOpts {schema} = do diff --git a/tests/CoreTests/CryptoTests.hs b/tests/CoreTests/CryptoTests.hs index ee3bc03f5..a7cf4f9ba 100644 --- a/tests/CoreTests/CryptoTests.hs +++ b/tests/CoreTests/CryptoTests.hs @@ -115,6 +115,7 @@ cryptoTests = do it "should reject tampered proof" testBBSTamperedProof it "should reject wrong disclosed message" testBBSWrongMessage it "should reject wrong public key" testBBSWrongKey + it "should reject invalid proof parameters" testBBSInvalidProofParams it "should produce unlinkable proofs" testBBSUnlinkable it "should produce proof of expected size" testBBSProofSize it "should roundtrip JSON and reject wrong-length input" testBBSJSON @@ -388,6 +389,27 @@ testBBSWrongKey = do result <- bbsProofVerify pk2 proof bbsHeader ph bbsDisclosedIdxs 3 bbsDisclosedMsgs result `shouldBe` False +testBBSInvalidProofParams :: IO () +testBBSInvalidProofParams = do + Right (pk, sk) <- bbsKeyGen + Right sig <- bbsSign sk bbsHeader bbsMessages + let ph = BBSPresHeader "test-nonce-invalid" + Right proof <- bbsProofGen pk sig bbsHeader ph bbsDisclosedIdxs bbsMessages + bbsProofGen pk sig bbsHeader ph [2, 1] bbsMessages + `shouldReturn` Left "bbsProofGen: invalid disclosed indexes" + bbsProofGen pk sig bbsHeader ph [1, 1] bbsMessages + `shouldReturn` Left "bbsProofGen: invalid disclosed indexes" + bbsProofGen pk sig bbsHeader ph [3] bbsMessages + `shouldReturn` Left "bbsProofGen: invalid disclosed indexes" + bbsProofVerify pk proof bbsHeader ph bbsDisclosedIdxs 3 ["2026-07-31"] + >>= (`shouldBe` False) + bbsProofVerify pk proof bbsHeader ph [2, 1] 3 bbsDisclosedMsgs + >>= (`shouldBe` False) + bbsProofVerify pk proof bbsHeader ph bbsDisclosedIdxs 4 bbsDisclosedMsgs + >>= (`shouldBe` False) + bbsProofVerify pk proof bbsHeader ph [] (-1) [] + >>= (`shouldBe` False) + testBBSUnlinkable :: IO () testBBSUnlinkable = do Right (pk, sk) <- bbsKeyGen