Skynet/misc_nixos-mailserver
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Restore tests and script deleted in b8661825

Browse source
This commit is contained in:
Xavier Vello 2019-12-14 22:19:57 +01:00
parent 14cabd62e5
commit 81e4a49708
12 changed files with 573 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

BIN
tests/clamav/bytecode.cvd (Stored with Git LFS) Normal file
View file

Binary file not shown.

BIN
tests/clamav/daily.cvd (Stored with Git LFS) Normal file
View file

Binary file not shown.

1
tests/clamav/freshclam.conf Normal file
View file

@ -0,0 +1 @@
DatabaseMirror database.clamav.net

5
tests/clamav/hashes.json Normal file
View file

@ -0,0 +1,5 @@
{
"bytecode.cvd": "a6800da4e3740b611e4f8a8e835be4a867abf8009af502e5bbf038d3ad162fa8",
"daily.cvd": "da96006e191412806bac1a2cef5d48ed0ec1b46efa150cf0aa6c27e734f4c4f8",
"main.cvd": "081884225087021e718599e8458ff6c9ee3cdebed8775dd8e445fc7b589d88a6"
}

BIN
tests/clamav/main.cvd (Stored with Git LFS) Normal file
View file

Binary file not shown.

15
tests/clamav/update-clamav-database.sh Executable file
View file

@ -0,0 +1,15 @@
#!/bin/sh
set -e
cd "$(dirname "${0}")"
rm ./*.cvd hashes.json || :
freshclam --datadir=. --config-file=freshclam.conf
(for i in ./*.cvd;
do echo '{}' |
jq --arg path "$(basename "${i}")" \
--arg sha256sum "$(sha256sum "${i}" | awk '{ print $1; }')" \
'.[$path] = $sha256sum'; done) |
jq -s add > hashes.json

414
tests/extern.nix Normal file
View file

@ -0,0 +1,414 @@
# nixos-mailserver: a simple mail server
# Copyright (C) 2016-2018 Robin Raymond
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
import <nixpkgs/nixos/tests/make-test.nix> {
nodes = {
server = { config, pkgs, ... }:
{
imports = [
../default.nix
./lib/config.nix
];
services.rsyslogd = {
enable = true;
defaultConfig = ''
*.* /dev/console
'';
};
mailserver = {
enable = true;
debug = true;
fqdn = "mail.example.com";
domains = [ "example.com" "example2.com" ];
rewriteMessageId = true;
dkimKeyBits = 1535;
loginAccounts = {
"user1@example.com" = {
hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";
aliases = [ "postmaster@example.com" ];
catchAll = [ "example.com" ];
};
"user2@example.com" = {
hashedPassword = "$6$u61JrAtuI0a$nGEEfTP5.eefxoScUGVG/Tl0alqla2aGax4oTd85v3j3xSmhv/02gNfSemv/aaMinlv9j/ZABosVKBrRvN5Qv0";
aliases = [ "chuck@example.com" ];
};
"user@example2.com" = {
hashedPassword = "$6$u61JrAtuI0a$nGEEfTP5.eefxoScUGVG/Tl0alqla2aGax4oTd85v3j3xSmhv/02gNfSemv/aaMinlv9j/ZABosVKBrRvN5Qv0";
};
"lowquota@example.com" = {
hashedPassword = "$6$u61JrAtuI0a$nGEEfTP5.eefxoScUGVG/Tl0alqla2aGax4oTd85v3j3xSmhv/02gNfSemv/aaMinlv9j/ZABosVKBrRvN5Qv0";
quota = "1B";
};
};
extraVirtualAliases = {
"single-alias@example.com" = "user1@example.com";
"multi-alias@example.com" = [ "user1@example.com" "user2@example.com" ];
};
enableImap = true;
enableImapSsl = true;
};
};
client = { nodes, config, pkgs, ... }: let
serverIP = nodes.server.config.networking.primaryIPAddress;
clientIP = nodes.client.config.networking.primaryIPAddress;
grep-ip = pkgs.writeScriptBin "grep-ip" ''
#!${pkgs.stdenv.shell}
echo grep '${clientIP}' "$@" >&2
exec grep '${clientIP}' "$@"
'';
check-mail-id = pkgs.writeScriptBin "check-mail-id" ''
#!${pkgs.stdenv.shell}
echo grep '^Message-ID:.*@mail.example.com>$' "$@" >&2
exec grep '^Message-ID:.*@mail.example.com>$' "$@"
'';
test-imap-spam = pkgs.writeScriptBin "imap-mark-spam" ''
#!${pkgs.python3.interpreter}
import imaplib
with imaplib.IMAP4_SSL('${serverIP}') as imap:
imap.login('user1@example.com', 'user1')
imap.select()
status, [response] = imap.search(None, 'ALL')
msg_ids = response.decode("utf-8").split(' ')
print(msg_ids)
assert status == 'OK'
assert len(msg_ids) == 1
imap.copy(','.join(msg_ids), 'Junk')
for num in msg_ids:
imap.store(num, '+FLAGS', '\\Deleted')
imap.expunge()
imap.select('Junk')
status, [response] = imap.search(None, 'ALL')
msg_ids = response.decode("utf-8").split(' ')
print(msg_ids)
assert status == 'OK'
assert len(msg_ids) == 1
imap.close()
'';
test-imap-ham = pkgs.writeScriptBin "imap-mark-ham" ''
#!${pkgs.python3.interpreter}
import imaplib
with imaplib.IMAP4_SSL('${serverIP}') as imap:
imap.login('user1@example.com', 'user1')
imap.select('Junk')
status, [response] = imap.search(None, 'ALL')
msg_ids = response.decode("utf-8").split(' ')
print(msg_ids)
assert status == 'OK'
assert len(msg_ids) == 1
imap.copy(','.join(msg_ids), 'INBOX')
for num in msg_ids:
imap.store(num, '+FLAGS', '\\Deleted')
imap.expunge()
imap.select('INBOX')
status, [response] = imap.search(None, 'ALL')
msg_ids = response.decode("utf-8").split(' ')
print(msg_ids)
assert status == 'OK'
assert len(msg_ids) == 1
imap.close()
'';
in {
imports = [
./lib/config.nix
];
environment.systemPackages = with pkgs; [
fetchmail msmtp procmail findutils grep-ip check-mail-id test-imap-spam test-imap-ham
];
environment.etc = {
"root/.fetchmailrc" = {
text = ''
poll ${serverIP} with proto IMAP
user 'user1@example.com' there with password 'user1' is 'root' here
mda procmail
'';
mode = "0700";
};
"root/.fetchmailRcLowQuota" = {
text = ''
poll ${serverIP} with proto IMAP
user 'lowquota@example.com' there with password 'user2' is 'root' here
mda procmail
'';
mode = "0700";
};
"root/.procmailrc" = {
text = "DEFAULT=$HOME/mail";
};
"root/.msmtprc" = {
text = ''
account test
host ${serverIP}
port 587
from user2@example.com
user user2@example.com
password user2
account test2
host ${serverIP}
port 587
from user@example2.com
user user@example2.com
password user2
account test3
host ${serverIP}
port 587
from chuck@example.com
user user2@example.com
password user2
account test4
host ${serverIP}
port 587
from postmaster@example.com
user user1@example.com
password user1
account test5
host ${serverIP}
port 587
from single-alias@example.com
user user1@example.com
password user1
'';
};
"root/email1".text = ''
Message-ID: <12345qwerty@host.local.network>
From: User2 <user2@example.com>
To: User1 <user1@example.com>
Cc:
Bcc:
Subject: This is a test Email from user2 to user1
Reply-To:
Hello User1,
how are you doing today?
'';
"root/email2".text = ''
Message-ID: <232323abc@host.local.network>
From: User <user@example2.com>
To: User1 <user1@example.com>
Cc:
Bcc:
Subject: This is a test Email from user@example2.com to user1
Reply-To:
Hello User1,
how are you doing today?
XOXO User1
'';
"root/email3".text = ''
Message-ID: <asdfghjkl42@host.local.network>
From: Postmaster <postmaster@example.com>
To: Chuck <chuck@example.com>
Cc:
Bcc:
Subject: This is a test Email from postmaster\@example.com to chuck
Reply-To:
Hello Chuck,
I think I may have misconfigured the mail server
XOXO Postmaster
'';
"root/email4".text = ''
Message-ID: <sdfsdf@host.local.network>
From: Single Alias <single-alias@example.com>
To: User1 <user1@example.com>
Cc:
Bcc:
Subject: This is a test Email from single-alias\@example.com to user1
Reply-To:
Hello User1,
how are you doing today?
XOXO User1 aka Single Alias
'';
"root/email5".text = ''
Message-ID: <789asdf@host.local.network>
From: User2 <user2@example.com>
To: Multi Alias <multi-alias@example.com>
Cc:
Bcc:
Subject: This is a test Email from user2\@example.com to multi-alias
Reply-To:
Hello Multi Alias,
how are we doing today?
XOXO User1
'';
};
};
};
testScript = { nodes, ... }:
''
startAll;
$server->waitForUnit("multi-user.target");
$client->waitForUnit("multi-user.target");
# TODO put this blocking into the systemd units?
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
$client->execute("cp -p /etc/root/.* ~/");
$client->succeed("mkdir -p ~/mail");
$client->succeed("ls -la ~/ >&2");
$client->succeed("cat ~/.fetchmailrc >&2");
$client->succeed("cat ~/.procmailrc >&2");
$client->succeed("cat ~/.msmtprc >&2");
subtest "imap retrieving mail", sub {
# fetchmail returns EXIT_CODE 1 when no new mail
$client->succeed("fetchmail -v || [ \$? -eq 1 ] >&2");
};
subtest "submission port send mail", sub {
# send email from user2 to user1
$client->succeed("msmtp -a test --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email1 >&2");
# give the mail server some time to process the mail
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
};
subtest "imap retrieving mail 2", sub {
$client->execute("rm ~/mail/*");
# fetchmail returns EXIT_CODE 0 when it retrieves mail
$client->succeed("fetchmail -v >&2");
};
subtest "remove sensitive information on submission port", sub {
$client->succeed("cat ~/mail/* >&2");
## make sure our IP is _not_ in the email header
$client->fail("grep-ip ~/mail/*");
$client->succeed("check-mail-id ~/mail/*");
};
subtest "have correct fqdn as sender", sub {
$client->succeed("grep 'Received: from mail.example.com' ~/mail/*");
};
subtest "dkim has user-specified size", sub {
$server->succeed("openssl rsa -in /var/dkim/example.com.mail.key -text -noout | grep 'Private-Key: (1535 bit)'");
};
subtest "dkim singing, multiple domains", sub {
$client->execute("rm ~/mail/*");
# send email from user2 to user1
$client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2");
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
# fetchmail returns EXIT_CODE 0 when it retrieves mail
$client->succeed("fetchmail -v");
$client->succeed("cat ~/mail/* >&2");
# make sure it is dkim signed
$client->succeed("grep DKIM ~/mail/*");
};
subtest "aliases", sub {
$client->execute("rm ~/mail/*");
# send email from chuck to postmaster
$client->succeed("msmtp -a test3 --tls=on --tls-certcheck=off --auth=on postmaster\@example.com < /etc/root/email2 >&2");
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
# fetchmail returns EXIT_CODE 0 when it retrieves mail
$client->succeed("fetchmail -v");
};
subtest "catchAlls", sub {
$client->execute("rm ~/mail/*");
# send email from chuck to non exsitent account
$client->succeed("msmtp -a test3 --tls=on --tls-certcheck=off --auth=on lol\@example.com < /etc/root/email2 >&2");
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
# fetchmail returns EXIT_CODE 0 when it retrieves mail
$client->succeed("fetchmail -v");
$client->execute("rm ~/mail/*");
# send email from user1 to chuck
$client->succeed("msmtp -a test4 --tls=on --tls-certcheck=off --auth=on chuck\@example.com < /etc/root/email2 >&2");
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
# fetchmail returns EXIT_CODE 1 when no new mail
# if this succeeds, it means that user1 recieved the mail that was intended for chuck.
$client->fail("fetchmail -v");
};
subtest "extraVirtualAliases", sub {
$client->execute("rm ~/mail/*");
# send email from single-alias to user1
$client->succeed("msmtp -a test5 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email4 >&2");
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
# fetchmail returns EXIT_CODE 0 when it retrieves mail
$client->succeed("fetchmail -v");
$client->execute("rm ~/mail/*");
# send email from user1 to multi-alias (user{1,2}@example.com)
$client->succeed("msmtp -a test --tls=on --tls-certcheck=off --auth=on multi-alias\@example.com < /etc/root/email5 >&2");
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
# fetchmail returns EXIT_CODE 0 when it retrieves mail
$client->succeed("fetchmail -v");
};
subtest "quota", sub {
$client->execute("rm ~/mail/*");
$client->execute("mv ~/.fetchmailRcLowQuota ~/.fetchmailrc");
$client->succeed("msmtp -a test3 --tls=on --tls-certcheck=off --auth=on lowquota\@example.com < /etc/root/email2 >&2");
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
# fetchmail returns EXIT_CODE 0 when it retrieves mail
$client->fail("fetchmail -v");
};
subtest "imap sieve junk trainer", sub {
# send email from user2 to user1
$client->succeed("msmtp -a test --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email1 >&2");
# give the mail server some time to process the mail
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
$client->succeed("imap-mark-spam >&2");
$server->waitUntilSucceeds("journalctl -u dovecot2 | grep -i sa-learn-spam.sh >&2");
$client->succeed("imap-mark-ham >&2");
$server->waitUntilSucceeds("journalctl -u dovecot2 | grep -i sa-learn-ham.sh >&2");
};
subtest "no warnings or errors", sub {
$server->fail("journalctl -u postfix | grep -i error >&2");
$server->fail("journalctl -u postfix | grep -i warning >&2");
$server->fail("journalctl -u dovecot2 | grep -i error >&2");
$server->fail("journalctl -u dovecot2 | grep -i warning >&2");
};
'';
}

53
tests/intern.nix Normal file
View file

@ -0,0 +1,53 @@
# nixos-mailserver: a simple mail server
# Copyright (C) 2016-2018 Robin Raymond
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
import <nixpkgs/nixos/tests/make-test.nix> {
machine =
{ config, pkgs, ... }:
{
imports = [
./../default.nix
./lib/config.nix
];
mailserver = {
enable = true;
fqdn = "mail.example.com";
domains = [ "example.com" ];
loginAccounts = {
"user1@example.com" = {
hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";
};
};
vmailGroupName = "vmail";
vmailUID = 5000;
};
};
testScript =
''
$machine->start;
$machine->waitForUnit("multi-user.target");
subtest "vmail gid is set correctly", sub {
$machine->succeed("getent group vmail | grep 5000");
};
'';
}

11
tests/lib/config.nix Normal file
View file

@ -0,0 +1,11 @@
{
security.dhparams.defaultBitSize = 16; # really low for quicker tests
# For slow non-kvm tests.
# nixos/modules/testing/test-instrumentation.nix also sets this. I don't know if there's a better way than etc to override theirs.
environment.etc."systemd/system.conf.d/bigdefaulttimeout.conf".text = ''
[Manager]
# Allow extremely slow start (default for test-VMs is 5 minutes)
DefaultTimeoutStartSec=15min
'';
}

31
tests/lib/pkgs.nokvm.nix Normal file
View file

@ -0,0 +1,31 @@
let
pkgs = (import <nixpkgs> { system = builtins.currentSystem; config = {}; });
patchedMachinePM = pkgs.writeTextFile {
name = "Machine.pm.patched-to-wait-longer-for-vm";
text = builtins.replaceStrings ["alarm 600;"] ["alarm 1200;"] (builtins.readFile (<nixpkgs>+"/nixos/lib/test-driver/Machine.pm"));
};
in
(pkgs // {
qemu_test = with pkgs; stdenv.mkDerivation {
name = "qemu_test_no_kvm";
buildInputs = [ coreutils qemu_test ];
inherit qemu_test;
inherit coreutils;
builder = builtins.toFile "builder.sh" ''
PATH=$coreutils/bin:$PATH
mkdir -p $out/bin
cp $qemu_test/bin/* $out/bin/
ln -sf $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
'';
};
stdenv = pkgs.stdenv // {
mkDerivation = args: (pkgs.stdenv.mkDerivation (args // (
pkgs.lib.optionalAttrs (args.name == "nixos-test-driver") {
installPhase = args.installPhase + ''
rm $libDir/Machine.pm
cp ${patchedMachinePM} $libDir/Machine.pm
'';
}
)));
};
})

31
tests/minimal.nix Normal file
View file

@ -0,0 +1,31 @@
# nixos-mailserver: a simple mail server
# Copyright (C) 2016-2018 Robin Raymond
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
import <nixpkgs/nixos/tests/make-test.nix> {
machine =
{ config, pkgs, ... }:
{
imports = [
./../default.nix
];
};
testScript =
''
$machine->waitForUnit("multi-user.target");
'';
}

3
update.sh Executable file
View file

@ -0,0 +1,3 @@
#!/usr/bin/env bash
sed -i -e "s/v[0-9]\+\.[0-9]\+\.[0-9]\+/$1/g" README.md