From 91cb297e9ebc4b0a0be2477426f36a40fbe05ed6 Mon Sep 17 00:00:00 2001 From: Paul Bottinelli Date: Sun, 21 Jun 2026 07:52:08 -0400 Subject: [PATCH 1/3] fix: disable web in cloud scripts without certs (#1804) --- .../files/opt/simplex/initialize_server.sh | 2 +- .../files/opt/simplex/on_login.sh | 5 +++++ scripts/smp-server-linode.sh | 8 ++++++++ tests/CLITests.hs | 20 ++++++++++++++++++- 4 files changed, 33 insertions(+), 2 deletions(-) diff --git a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh index 4b66e2a5c..3f2e6925e 100644 --- a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh +++ b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh @@ -22,7 +22,7 @@ smp-server --version # Initialize server ip_address=$(curl ifconfig.me) -smp-server init -l --ip $ip_address +smp-server init -l --disable-web --ip $ip_address # Server fingerprint fingerprint=$(cat /etc/opt/simplex/fingerprint) diff --git a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh index c7e63914e..8f4443d0d 100644 --- a/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh +++ b/scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh @@ -12,6 +12,11 @@ Check SMP server status with: systemctl status smp-server To keep this server secure, the UFW firewall is enabled. All ports are BLOCKED except 22 (SSH), 443 (HTTPS), 5223 (SMP server). +Embedded HTTPS web is disabled because this image does not provision +/etc/opt/simplex/web.crt or /etc/opt/simplex/web.key. To enable it, provision +those files, uncomment WEB https/cert/key in /etc/opt/simplex/smp-server.ini, +and restart smp-server. + ******************************************************************************** To stop seeing this message delete line - bash /opt/simplex/on_login.sh - from /root/.bashrc EOF diff --git a/scripts/smp-server-linode.sh b/scripts/smp-server-linode.sh index 2f57479c3..0babd32af 100644 --- a/scripts/smp-server-linode.sh +++ b/scripts/smp-server-linode.sh @@ -75,6 +75,9 @@ init_opts=() [[ $ENABLE_STORE_LOG == "on" ]] && init_opts+=(-l) +# This script does not provision /etc/opt/simplex/web.crt or web.key. +init_opts+=(--disable-web) + ip_address=$(curl ifconfig.me) init_opts+=(--ip $ip_address) @@ -111,6 +114,11 @@ Check SMP server status with: systemctl status smp-server To keep this server secure, the UFW firewall is enabled. All ports are BLOCKED except 22 (SSH), 443 (HTTPS), 5223 (SMP server). +Embedded HTTPS web is disabled because this script does not provision +/etc/opt/simplex/web.crt or /etc/opt/simplex/web.key. To enable it, provision +those files, uncomment WEB https/cert/key in /etc/opt/simplex/smp-server.ini, +and restart smp-server. + ******************************************************************************** To stop seeing this message delete line - bash /opt/simplex/on_login.sh - from /root/.bashrc EOF2 diff --git a/tests/CLITests.hs b/tests/CLITests.hs index 66af74ab8..b177d6004 100644 --- a/tests/CLITests.hs +++ b/tests/CLITests.hs @@ -13,7 +13,7 @@ import qualified Crypto.PubKey.RSA as RSA import qualified Data.ByteString.Lazy as BL import qualified Data.HashMap.Strict as HM import Data.Ini (Ini (..), lookupValue, readIniFile, writeIniFile) -import Data.List (isPrefixOf) +import Data.List (isInfixOf, isPrefixOf) import qualified Data.Text as T import qualified Data.X509 as X import qualified Data.X509.File as XF @@ -85,6 +85,7 @@ cliTests = do it "no store log, no password" $ smpServerTest False False it "with store log, no password" $ smpServerTest True False it "static files" smpServerTestStatic + it "cloud scripts disable embedded web without certificates" smpCloudScriptsDisableWeb #if defined(dbServerPostgres) around_ (postgressBracket ntfTestServerDBConnectInfo) $ before_ (createNtfSchema ntfTestServerDBConnectInfo ntfTestStoreDBOpts) $ describe "Ntf server CLI" $ do @@ -200,6 +201,23 @@ smpServerTestStatic = do let X.CertificateChain cc = tlsPeerCert tls in map (X.signedObject . X.getSigned) cc +smpCloudScriptsDisableWeb :: HasCallStack => IO () +smpCloudScriptsDisableWeb = do + linode <- readFile "scripts/smp-server-linode.sh" + digitalOceanInit <- + readFile "scripts/smp-server-digitalocean-droplet/files/opt/simplex/initialize_server.sh" + digitalOceanLogin <- + readFile "scripts/smp-server-digitalocean-droplet/files/opt/simplex/on_login.sh" + linode `shouldSatisfy` ("init_opts+=(--disable-web)" `isInfixOf`) + linode `shouldSatisfy` ("web.crt" `isInfixOf`) + linode `shouldSatisfy` ("web.key" `isInfixOf`) + linode `shouldSatisfy` ("uncomment WEB https/cert/key" `isInfixOf`) + digitalOceanInit + `shouldSatisfy` ("smp-server init -l --disable-web --ip $ip_address" `isInfixOf`) + digitalOceanLogin `shouldSatisfy` ("web.crt" `isInfixOf`) + digitalOceanLogin `shouldSatisfy` ("web.key" `isInfixOf`) + digitalOceanLogin `shouldSatisfy` ("uncomment WEB https/cert/key" `isInfixOf`) + #if defined(dbServerPostgres) createNtfSchema :: PSQL.ConnectInfo -> DBOpts -> IO () createNtfSchema connInfo DBOpts {schema} = do From 84724bc03ebffb9e747bea3da24704da236c1754 Mon Sep 17 00:00:00 2001 From: Samy Date: Sun, 21 Jun 2026 14:06:30 +0200 Subject: [PATCH 2/3] crypto: validate BBS proof parameters (#1810) --- src/Simplex/Messaging/Crypto/BBS.hs | 2 ++ tests/CoreTests/CryptoTests.hs | 22 ++++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/src/Simplex/Messaging/Crypto/BBS.hs b/src/Simplex/Messaging/Crypto/BBS.hs index 453e5d63f..7b19ca004 100644 --- a/src/Simplex/Messaging/Crypto/BBS.hs +++ b/src/Simplex/Messaging/Crypto/BBS.hs @@ -287,8 +287,10 @@ bbsProofVerify :: [ByteString] -> IO Bool bbsProofVerify (BBSPublicKey pk) (BBSProof proof) (BBSHeader header) (BBSPresHeader ph) disclosedIdxs numMessages disclosedMsgs + | numMessages < 0 = pure False | length disclosedIdxs /= length disclosedMsgs = pure False | not (ascendingInRange disclosedIdxs numMessages) = pure False + | B.length proof /= bbsProofLen (numMessages - length disclosedIdxs) = pure False | otherwise = withBS pk $ \pkPtr _ -> withBS proof $ \proofPtr proofLen -> diff --git a/tests/CoreTests/CryptoTests.hs b/tests/CoreTests/CryptoTests.hs index abf5373da..0f5347512 100644 --- a/tests/CoreTests/CryptoTests.hs +++ b/tests/CoreTests/CryptoTests.hs @@ -110,6 +110,7 @@ cryptoTests = do it "should reject tampered proof" testBBSTamperedProof it "should reject wrong disclosed message" testBBSWrongMessage it "should reject wrong public key" testBBSWrongKey + it "should reject invalid proof parameters" testBBSInvalidProofParams it "should produce unlinkable proofs" testBBSUnlinkable it "should produce proof of expected size" testBBSProofSize it "should roundtrip JSON and reject wrong-length input" testBBSJSON @@ -355,6 +356,27 @@ testBBSWrongKey = do result <- bbsProofVerify pk2 proof bbsHeader ph bbsDisclosedIdxs 3 bbsDisclosedMsgs result `shouldBe` False +testBBSInvalidProofParams :: IO () +testBBSInvalidProofParams = do + Right (pk, sk) <- bbsKeyGen + Right sig <- bbsSign sk bbsHeader bbsMessages + let ph = BBSPresHeader "test-nonce-invalid" + Right proof <- bbsProofGen pk sig bbsHeader ph bbsDisclosedIdxs bbsMessages + bbsProofGen pk sig bbsHeader ph [2, 1] bbsMessages + `shouldReturn` Left "bbsProofGen: invalid disclosed indexes" + bbsProofGen pk sig bbsHeader ph [1, 1] bbsMessages + `shouldReturn` Left "bbsProofGen: invalid disclosed indexes" + bbsProofGen pk sig bbsHeader ph [3] bbsMessages + `shouldReturn` Left "bbsProofGen: invalid disclosed indexes" + bbsProofVerify pk proof bbsHeader ph bbsDisclosedIdxs 3 ["2026-07-31"] + >>= (`shouldBe` False) + bbsProofVerify pk proof bbsHeader ph [2, 1] 3 bbsDisclosedMsgs + >>= (`shouldBe` False) + bbsProofVerify pk proof bbsHeader ph bbsDisclosedIdxs 4 bbsDisclosedMsgs + >>= (`shouldBe` False) + bbsProofVerify pk proof bbsHeader ph [] (-1) [] + >>= (`shouldBe` False) + testBBSUnlinkable :: IO () testBBSUnlinkable = do Right (pk, sk) <- bbsKeyGen From 92598c2ddb06cfc2c19797a2c900cffcb8af4d5c Mon Sep 17 00:00:00 2001 From: Evgeny Poberezkin Date: Sun, 21 Jun 2026 13:08:27 +0100 Subject: [PATCH 3/3] 6.5.5.0 --- simplexmq.cabal | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/simplexmq.cabal b/simplexmq.cabal index be0d8d72f..6414bb79d 100644 --- a/simplexmq.cabal +++ b/simplexmq.cabal @@ -1,7 +1,7 @@ cabal-version: 3.0 name: simplexmq -version: 6.5.4.0 +version: 6.5.5.0 synopsis: SimpleXMQ message broker description: This package includes <./docs/Simplex-Messaging-Server.html server>, <./docs/Simplex-Messaging-Client.html client> and