Revision: 3608 http://trac.macosforge.org/projects/calendarserver/changeset/3608 Author: cdaboo@apple.com Date: 2009-01-26 08:43:17 -0800 (Mon, 26 Jan 2009) Log Message: ----------- Tests to make sure various iTIP security issues have been addressed. Added Paths: ----------- CalDAVTester/trunk/Resource/implicit/security/ CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/ CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/1.ics CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/2.ics CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/3.xml CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/4.ics CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/5.ics CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/ CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/1.ics CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/2.ics CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/3.xml CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/4.ics CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/5.ics CalDAVTester/trunk/Resource/implicit/security/organizerforgery/ CalDAVTester/trunk/Resource/implicit/security/organizerforgery/1.ics CalDAVTester/trunk/Resource/implicit/security/organizerforgery/2.ics CalDAVTester/trunk/Resource/implicit/security/organizerforgery/3.xml CalDAVTester/trunk/Resource/implicit/security/organizerforgery/4.ics CalDAVTester/trunk/Resource/implicit/security/organizerforgery/5.ics CalDAVTester/trunk/Resource/implicit/security/organizerforgery/6.ics CalDAVTester/trunk/scripts/tests/implicitsecurity.xml Added: CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/1.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/1.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/1.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,34 @@ +BEGIN:VCALENDAR +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +VERSION:2.0 +BEGIN:VTIMEZONE +LAST-MODIFIED:20040110T032845Z +TZID:US/Eastern +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +END:VTIMEZONE +BEGIN:VEVENT +DTSTAMP:20051222T205953Z +CREATED:20060101T150000Z +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +SUMMARY:event 2 +UID:event2@ninevah.local +ORGANIZER;CN=$username1::$cuaddr1: +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED:$cuaddr1: +ATTENDEE;CN=$username2:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr2: +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/2.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/2.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/2.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,35 @@ +BEGIN:VCALENDAR +VERSION:2.0 +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +BEGIN:VTIMEZONE +TZID:US/Eastern +LAST-MODIFIED:20040110T032845Z +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +END:VTIMEZONE +BEGIN:VEVENT +UID:event2@ninevah.local +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +ATTENDEE;CN=$username2:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;SCHEDULE-STATUS="1.2;S + cheduling message has been delivered";X-CALENDARSERVER-EMAIL=$email2::$cuaddrurn2: +CREATED:20060101T150000Z +DTSTAMP:20051222T205953Z +ORGANIZER;CN=$username1:;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +SUMMARY:event 2 +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/3.xml =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/3.xml (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/3.xml 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,7 @@ +<?xml version="1.0" encoding="utf-8" ?> +<D:propfind xmlns:D="DAV:"> +<D:prop> +<D:resourcetype/> +<D:getetag/> +</D:prop> +</D:propfind> Added: CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/4.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/4.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/4.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,35 @@ +BEGIN:VCALENDAR +VERSION:2.0 +CALSCALE:GREGORIAN +PRODID:-//CALENDARSERVER.ORG//NONSGML Version 1//EN +BEGIN:VTIMEZONE +TZID:US/Eastern +LAST-MODIFIED:20040110T032845Z +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +END:VTIMEZONE +BEGIN:VEVENT +UID:event2@ninevah.local +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +ATTENDEE;CN=$username2:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;X-CALENDARSERVER-EMAIL=$email2::$cuaddrurn2: +CREATED:20060101T150000Z +DTSTAMP:20051222T205953Z +ORGANIZER;CN=$username1:;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +SUMMARY:event 2 +X-APPLE-NEEDS-REPLY:TRUE +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/5.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/5.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeepartycrash/5.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,35 @@ +BEGIN:VCALENDAR +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +VERSION:2.0 +BEGIN:VTIMEZONE +LAST-MODIFIED:20040110T032845Z +TZID:US/Eastern +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +END:VTIMEZONE +BEGIN:VEVENT +DTSTAMP:20051222T205953Z +CREATED:20060101T150000Z +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +SUMMARY:event 2 +UID:event2@ninevah.local +ORGANIZER;CN=$username1::$cuaddr1: +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED:$cuaddr1: +ATTENDEE;CN=$username2:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr2: +ATTENDEE;CN=$username3:;PARTSTAT=ACCEPTED:$cuaddr3: +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/1.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/1.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/1.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,35 @@ +BEGIN:VCALENDAR +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +VERSION:2.0 +BEGIN:VTIMEZONE +LAST-MODIFIED:20040110T032845Z +TZID:US/Eastern +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +END:VTIMEZONE +BEGIN:VEVENT +DTSTAMP:20051222T205953Z +CREATED:20060101T150000Z +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +SUMMARY:event 3 +UID:event3@ninevah.local +ORGANIZER;CN=$username1::$cuaddr1: +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED:$cuaddr1: +ATTENDEE;CN=$username2:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr2: +ATTENDEE;CN=$username3:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr3: +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/2.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/2.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/2.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,37 @@ +BEGIN:VCALENDAR +VERSION:2.0 +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +BEGIN:VTIMEZONE +TZID:US/Eastern +LAST-MODIFIED:20040110T032845Z +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +END:VTIMEZONE +BEGIN:VEVENT +UID:event3@ninevah.local +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +ATTENDEE;CN=$username2:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;SCHEDULE-STATUS="1.2;S + cheduling message has been delivered";X-CALENDARSERVER-EMAIL=$email2::$cuaddrurn2: +ATTENDEE;CN=$username3:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;SCHEDULE-STATUS="1.2;S + cheduling message has been delivered";X-CALENDARSERVER-EMAIL=$email3::$cuaddrurn3: +CREATED:20060101T150000Z +DTSTAMP:20051222T205953Z +ORGANIZER;CN=$username1:;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +SUMMARY:event 3 +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/3.xml =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/3.xml (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/3.xml 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,7 @@ +<?xml version="1.0" encoding="utf-8" ?> +<D:propfind xmlns:D="DAV:"> +<D:prop> +<D:resourcetype/> +<D:getetag/> +</D:prop> +</D:propfind> Added: CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/4.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/4.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/4.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,36 @@ +BEGIN:VCALENDAR +VERSION:2.0 +CALSCALE:GREGORIAN +PRODID:-//CALENDARSERVER.ORG//NONSGML Version 1//EN +BEGIN:VTIMEZONE +TZID:US/Eastern +LAST-MODIFIED:20040110T032845Z +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +END:VTIMEZONE +BEGIN:VEVENT +UID:event3@ninevah.local +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +ATTENDEE;CN=$username2:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;X-CALENDARSERVER-EMAIL=$email2::$cuaddrurn2: +ATTENDEE;CN=$username3:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;X-CALENDARSERVER-EMAIL=$email3::$cuaddrurn3: +CREATED:20060101T150000Z +DTSTAMP:20051222T205953Z +ORGANIZER;CN=$username1:;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +SUMMARY:event 3 +X-APPLE-NEEDS-REPLY:TRUE +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/5.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/5.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/attendeeswitchorganizer/5.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,35 @@ +BEGIN:VCALENDAR +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +VERSION:2.0 +BEGIN:VTIMEZONE +LAST-MODIFIED:20040110T032845Z +TZID:US/Eastern +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +END:VTIMEZONE +BEGIN:VEVENT +DTSTAMP:20051222T205953Z +CREATED:20060101T150000Z +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +SUMMARY:event 3 +UID:event3@ninevah.local +ORGANIZER;CN=$username3::$cuaddr3: +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED:$cuaddr1: +ATTENDEE;CN=$username2:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr2: +ATTENDEE;CN=$username3:;PARTSTAT=ACCEPTED:$cuaddr3: +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/organizerforgery/1.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/organizerforgery/1.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/organizerforgery/1.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,34 @@ +BEGIN:VCALENDAR +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +VERSION:2.0 +BEGIN:VTIMEZONE +LAST-MODIFIED:20040110T032845Z +TZID:US/Eastern +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +END:VTIMEZONE +BEGIN:VEVENT +DTSTAMP:20051222T205953Z +CREATED:20060101T150000Z +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +SUMMARY:event 1 +UID:event1@ninevah.local +ORGANIZER;CN=$username1::$cuaddr1: +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED:$cuaddr1: +ATTENDEE;CN=$username2:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr2: +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/organizerforgery/2.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/organizerforgery/2.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/organizerforgery/2.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,35 @@ +BEGIN:VCALENDAR +VERSION:2.0 +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +BEGIN:VTIMEZONE +TZID:US/Eastern +LAST-MODIFIED:20040110T032845Z +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +END:VTIMEZONE +BEGIN:VEVENT +UID:event1@ninevah.local +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +ATTENDEE;CN=$username2:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;SCHEDULE-STATUS="1.2;S + cheduling message has been delivered";X-CALENDARSERVER-EMAIL=$email2::$cuaddrurn2: +CREATED:20060101T150000Z +DTSTAMP:20051222T205953Z +ORGANIZER;CN=$username1:;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +SUMMARY:event 1 +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/organizerforgery/3.xml =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/organizerforgery/3.xml (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/organizerforgery/3.xml 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,7 @@ +<?xml version="1.0" encoding="utf-8" ?> +<D:propfind xmlns:D="DAV:"> +<D:prop> +<D:resourcetype/> +<D:getetag/> +</D:prop> +</D:propfind> Added: CalDAVTester/trunk/Resource/implicit/security/organizerforgery/4.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/organizerforgery/4.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/organizerforgery/4.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,35 @@ +BEGIN:VCALENDAR +VERSION:2.0 +CALSCALE:GREGORIAN +PRODID:-//CALENDARSERVER.ORG//NONSGML Version 1//EN +BEGIN:VTIMEZONE +TZID:US/Eastern +LAST-MODIFIED:20040110T032845Z +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +END:VTIMEZONE +BEGIN:VEVENT +UID:event1@ninevah.local +DTSTART;TZID=US/Eastern:20060101T100000 +DURATION:PT1H +ATTENDEE;CN=$username1:;PARTSTAT=ACCEPTED;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +ATTENDEE;CN=$username2:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;X-CALENDARSERVER-EMAIL=$email2::$cuaddrurn2: +CREATED:20060101T150000Z +DTSTAMP:20051222T205953Z +ORGANIZER;CN=$username1:;X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +SUMMARY:event 1 +X-APPLE-NEEDS-REPLY:TRUE +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/organizerforgery/5.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/organizerforgery/5.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/organizerforgery/5.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,34 @@ +BEGIN:VCALENDAR +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +VERSION:2.0 +BEGIN:VTIMEZONE +LAST-MODIFIED:20040110T032845Z +TZID:US/Eastern +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +END:VTIMEZONE +BEGIN:VEVENT +DTSTAMP:20051222T205953Z +CREATED:20060101T150000Z +DTSTART;TZID=US/Eastern:20060101T120000 +DURATION:PT1H +SUMMARY:spoofed event 1 +UID:event1@ninevah.local +ORGANIZER;CN=$username3::$cuaddr3: +ATTENDEE;CN=$username1:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr1: +ATTENDEE;CN=$username2:;RSVP=TRUE;PARTSTAT=NEEDS-ACTION:$cuaddr2: +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/Resource/implicit/security/organizerforgery/6.ics =================================================================== --- CalDAVTester/trunk/Resource/implicit/security/organizerforgery/6.ics (rev 0) +++ CalDAVTester/trunk/Resource/implicit/security/organizerforgery/6.ics 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,36 @@ +BEGIN:VCALENDAR +VERSION:2.0 +CALSCALE:GREGORIAN +PRODID:-//Example Inc.//Example Calendar//EN +BEGIN:VTIMEZONE +TZID:US/Eastern +LAST-MODIFIED:20040110T032845Z +BEGIN:STANDARD +DTSTART:20001026T020000 +RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 +TZNAME:EST +TZOFFSETFROM:-0400 +TZOFFSETTO:-0500 +END:STANDARD +BEGIN:DAYLIGHT +DTSTART:20000404T020000 +RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 +TZNAME:EDT +TZOFFSETFROM:-0500 +TZOFFSETTO:-0400 +END:DAYLIGHT +END:VTIMEZONE +BEGIN:VEVENT +UID:event1@ninevah.local +DTSTART;TZID=US/Eastern:20060101T120000 +DURATION:PT1H +ATTENDEE;CN=$username1:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;SCHEDULE-STATUS="5.3;O + rganizer change not allowed";X-CALENDARSERVER-EMAIL=$email1::$cuaddrurn1: +ATTENDEE;CN=$username2:;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;SCHEDULE-STATUS="5.3;O + rganizer change not allowed";X-CALENDARSERVER-EMAIL=$email2::$cuaddrurn2: +CREATED:20060101T150000Z +DTSTAMP:20051222T205953Z +ORGANIZER;CN=$username3:;X-CALENDARSERVER-EMAIL=$email3::$cuaddrurn3: +SUMMARY:spoofed event 1 +END:VEVENT +END:VCALENDAR Added: CalDAVTester/trunk/scripts/tests/implicitsecurity.xml =================================================================== --- CalDAVTester/trunk/scripts/tests/implicitsecurity.xml (rev 0) +++ CalDAVTester/trunk/scripts/tests/implicitsecurity.xml 2009-01-26 16:43:17 UTC (rev 3608) @@ -0,0 +1,574 @@ +<?xml version="1.0" standalone="no"?> + +<!DOCTYPE caldavtest SYSTEM "caldavtest.dtd"> + +<!-- + Copyright (c) 2006-2008 Apple Inc. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + --> + +<caldavtest> + <description>Test security of implicit CalDAV scheduling</description> + + <start> + <request user="$userid1:" pswd="$pswd1:"> + <method>GET</method> + <ruri>$calendarpath1:/</ruri> + </request> + <request user="$userid2:" pswd="$pswd2:"> + <method>GET</method> + <ruri>$calendarpath2:/</ruri> + </request> + </start> + + <test-suite name='Prevent ORGANIZER forgeries' ignore='no'> + <test name='1'> + <description>Organizer invites Attendee</description> + <request print-response='no'> + <method>PUT</method> + <ruri>$calendarpath1:/1.ics</ruri> + <data> + <content-type>text/calendar; charset=utf-8</content-type> + <filepath>Resource/implicit/security/organizerforgery/1.ics</filepath> + </data> + <verify> + <callback>statusCode</callback> + </verify> + </request> + </test> + <test name='2'> + <description>Organizer checks data</description> + <request print-response='no'> + <method>GET</method> + <ruri>$calendarpath1:/1.ics</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/organizerforgery/2.ics</value> + </arg> + </verify> + </request> + </test> + <test name='3'> + <description>Attendee Inbox Item</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>PROPFIND</method> + <ruri>$inboxpath2:/</ruri> + <header> + <name>Depth</name> + <value>1</value> + </header> + <data> + <content-type>application/xml; charset=utf-8</content-type> + <filepath>Resource/implicit/security/organizerforgery/3.xml</filepath> + </data> + <verify> + <callback>multistatusItems</callback> + <arg> + <name>count</name> + <value>1</value> + </arg> + </verify> + </request> + </test> + <test name='4'> + <description>Attendee has data</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath2:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/organizerforgery/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='5'> + <description>Attendee deletes Inbox Item</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$inboxpath2:/</ruri> + <verify> + <callback>statusCode</callback> + </verify> + </request> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>DELETE</method> + <ruri>$</ruri> + <verify> + <callback>statusCode</callback> + <arg> + <name>status</name> + <value>204</value> + </arg> + </verify> + </request> + </test> + <test name='6'> + <description>Malicious user invites Attendee with UID forgery</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>PUT</method> + <ruri>$calendarpath3:/1.ics</ruri> + <data> + <content-type>text/calendar; charset=utf-8</content-type> + <filepath>Resource/implicit/security/organizerforgery/5.ics</filepath> + </data> + <verify> + <callback>statusCode</callback> + </verify> + </request> + </test> + <test name='7'> + <description>Organizer checks same data</description> + <request print-response='no'> + <method>GET</method> + <ruri>$calendarpath1:/1.ics</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/organizerforgery/2.ics</value> + </arg> + </verify> + </request> + </test> + <test name='8'> + <description>Attendee has same data</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath2:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/organizerforgery/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='9'> + <description>Malicious user has error data</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>GET</method> + <ruri>$calendarpath3:/1.ics</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/organizerforgery/6.ics</value> + </arg> + </verify> + </request> + </test> + <test name='10'> + <description>Clean-up</description> + <request user="$userid1:" pswd="$pswd1:"> + <method>DELETEALL</method> + <ruri>$calendarpath1:/</ruri> + <ruri>$inboxpath1:/</ruri> + </request> + <request user="$userid2:" pswd="$pswd2:"> + <method>DELETEALL</method> + <ruri>$calendarpath2:/</ruri> + <ruri>$inboxpath2:/</ruri> + </request> + <request user="$userid3:" pswd="$pswd3:"> + <method>DELETEALL</method> + <ruri>$calendarpath3:/</ruri> + <ruri>$inboxpath3:/</ruri> + </request> + </test> + </test-suite> + + <test-suite name='Prevent ATTENDEE party crash' ignore='no'> + <test name='1'> + <description>Organizer invites Attendee</description> + <request print-response='no'> + <method>PUT</method> + <ruri>$calendarpath1:/1.ics</ruri> + <data> + <content-type>text/calendar; charset=utf-8</content-type> + <filepath>Resource/implicit/security/attendeepartycrash/1.ics</filepath> + </data> + <verify> + <callback>statusCode</callback> + </verify> + </request> + </test> + <test name='2'> + <description>Organizer checks data</description> + <request print-response='no'> + <method>GET</method> + <ruri>$calendarpath1:/1.ics</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeepartycrash/2.ics</value> + </arg> + </verify> + </request> + </test> + <test name='3'> + <description>Attendee Inbox Item</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>PROPFIND</method> + <ruri>$inboxpath2:/</ruri> + <header> + <name>Depth</name> + <value>1</value> + </header> + <data> + <content-type>application/xml; charset=utf-8</content-type> + <filepath>Resource/implicit/security/attendeepartycrash/3.xml</filepath> + </data> + <verify> + <callback>multistatusItems</callback> + <arg> + <name>count</name> + <value>1</value> + </arg> + </verify> + </request> + </test> + <test name='4'> + <description>Attendee has data</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath2:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeepartycrash/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='5'> + <description>Attendee deletes Inbox Item</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$inboxpath2:/</ruri> + <verify> + <callback>statusCode</callback> + </verify> + </request> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>DELETE</method> + <ruri>$</ruri> + <verify> + <callback>statusCode</callback> + <arg> + <name>status</name> + <value>204</value> + </arg> + </verify> + </request> + </test> + <test name='6'> + <description>Malicious user tries to party crash with UID forgery</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>PUT</method> + <ruri>$calendarpath3:/1.ics</ruri> + <data> + <content-type>text/calendar; charset=utf-8</content-type> + <filepath>Resource/implicit/security/attendeepartycrash/5.ics</filepath> + </data> + <verify> + <callback>statusCode</callback> + <arg> + <name>status</name> + <value>403</value> + </arg> + </verify> + </request> + </test> + <test name='7'> + <description>Organizer checks same data</description> + <request print-response='no'> + <method>GET</method> + <ruri>$calendarpath1:/1.ics</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeepartycrash/2.ics</value> + </arg> + </verify> + </request> + </test> + <test name='8'> + <description>Attendee has same data</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath2:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeepartycrash/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='9'> + <description>Clean-up</description> + <request user="$userid1:" pswd="$pswd1:"> + <method>DELETEALL</method> + <ruri>$calendarpath1:/</ruri> + <ruri>$inboxpath1:/</ruri> + </request> + <request user="$userid2:" pswd="$pswd2:"> + <method>DELETEALL</method> + <ruri>$calendarpath2:/</ruri> + <ruri>$inboxpath2:/</ruri> + </request> + <request user="$userid3:" pswd="$pswd3:"> + <method>DELETEALL</method> + <ruri>$calendarpath3:/</ruri> + <ruri>$inboxpath3:/</ruri> + </request> + </test> + </test-suite> + + <test-suite name='Prevent ATTENDEE switching ORGANIZER' ignore='no'> + <test name='1'> + <description>Organizer invites Attendees</description> + <request print-response='no'> + <method>PUT</method> + <ruri>$calendarpath1:/1.ics</ruri> + <data> + <content-type>text/calendar; charset=utf-8</content-type> + <filepath>Resource/implicit/security/attendeeswitchorganizer/1.ics</filepath> + </data> + <verify> + <callback>statusCode</callback> + </verify> + </request> + </test> + <test name='2'> + <description>Organizer checks data</description> + <request print-response='no'> + <method>GET</method> + <ruri>$calendarpath1:/1.ics</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeeswitchorganizer/2.ics</value> + </arg> + </verify> + </request> + </test> + <test name='3'> + <description>Attendee Inbox Item</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>PROPFIND</method> + <ruri>$inboxpath2:/</ruri> + <header> + <name>Depth</name> + <value>1</value> + </header> + <data> + <content-type>application/xml; charset=utf-8</content-type> + <filepath>Resource/implicit/security/attendeeswitchorganizer/3.xml</filepath> + </data> + <verify> + <callback>multistatusItems</callback> + <arg> + <name>count</name> + <value>1</value> + </arg> + </verify> + </request> + </test> + <test name='4'> + <description>Attendee has data</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath2:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeeswitchorganizer/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='5'> + <description>Attendee deletes Inbox Item</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$inboxpath2:/</ruri> + <verify> + <callback>statusCode</callback> + </verify> + </request> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>DELETE</method> + <ruri>$</ruri> + <verify> + <callback>statusCode</callback> + <arg> + <name>status</name> + <value>204</value> + </arg> + </verify> + </request> + </test> + <test name='6'> + <description>Attendee Inbox Item</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>PROPFIND</method> + <ruri>$inboxpath3:/</ruri> + <header> + <name>Depth</name> + <value>1</value> + </header> + <data> + <content-type>application/xml; charset=utf-8</content-type> + <filepath>Resource/implicit/security/attendeeswitchorganizer/3.xml</filepath> + </data> + <verify> + <callback>multistatusItems</callback> + <arg> + <name>count</name> + <value>1</value> + </arg> + </verify> + </request> + </test> + <test name='7'> + <description>Attendee has data</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath3:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeeswitchorganizer/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='8'> + <description>Attendee deletes Inbox Item</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>GETNEW</method> + <ruri>$inboxpath3:/</ruri> + <verify> + <callback>statusCode</callback> + </verify> + </request> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>DELETE</method> + <ruri>$</ruri> + <verify> + <callback>statusCode</callback> + <arg> + <name>status</name> + <value>204</value> + </arg> + </verify> + </request> + </test> + <test name='9'> + <description>Malicious user tries to change ORGANIZER</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>PUT</method> + <ruri>$calendarpath3:/1.ics</ruri> + <data> + <content-type>text/calendar; charset=utf-8</content-type> + <filepath>Resource/implicit/security/attendeeswitchorganizer/5.ics</filepath> + </data> + <verify> + <callback>statusCode</callback> + <arg> + <name>status</name> + <value>403</value> + </arg> + </verify> + </request> + </test> + <test name='10'> + <description>Organizer checks same data</description> + <request print-response='no'> + <method>GET</method> + <ruri>$calendarpath1:/1.ics</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeeswitchorganizer/2.ics</value> + </arg> + </verify> + </request> + </test> + <test name='11'> + <description>Attendee has same data</description> + <request user="$userid2:" pswd="$pswd2:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath2:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeeswitchorganizer/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='12'> + <description>Attendee has same data</description> + <request user="$userid3:" pswd="$pswd3:" print-response='no'> + <method>GETNEW</method> + <ruri>$calendarpath3:/</ruri> + <verify> + <callback>calendarDataMatch</callback> + <arg> + <name>filepath</name> + <value>Resource/implicit/security/attendeeswitchorganizer/4.ics</value> + </arg> + </verify> + </request> + </test> + <test name='13'> + <description>Clean-up</description> + <request user="$userid1:" pswd="$pswd1:"> + <method>DELETEALL</method> + <ruri>$calendarpath1:/</ruri> + <ruri>$inboxpath1:/</ruri> + </request> + <request user="$userid2:" pswd="$pswd2:"> + <method>DELETEALL</method> + <ruri>$calendarpath2:/</ruri> + <ruri>$inboxpath2:/</ruri> + </request> + <request user="$userid3:" pswd="$pswd3:"> + <method>DELETEALL</method> + <ruri>$calendarpath3:/</ruri> + <ruri>$inboxpath3:/</ruri> + </request> + </test> + </test-suite> + + <end/> + +</caldavtest>
participants (1)
-
source_changes＠macosforge.org