fixes to tests

- restructure rspamd config. It's nicer now, and it was getting
overridden the old way.
- "scan_mime_parts = false" apparently must be used in rspamd for ClamAV
to work
- refactor the clamav test a bit for cleanliness
- wait for rspamd and clamd sockets to open, before testing
- use clamdscan for speed, and verify that the virus was found
- verify msmtp returns virus scan result
This commit is contained in:
Joey Hewitt 2019-07-06 03:31:24 -06:00
parent 0e6bb4e898
commit 93660eabcd
3 changed files with 36 additions and 22 deletions

View file

@ -27,19 +27,22 @@ in
config = with cfg; lib.mkIf enable { config = with cfg; lib.mkIf enable {
services.rspamd = { services.rspamd = {
enable = true; enable = true;
extraConfig = '' inherit debug;
locals = {
"milter_headers.conf" = { text = ''
extended_spam_headers = yes; extended_spam_headers = yes;
'' + (lib.optionalString cfg.virusScanning '' ''; };
antivirus { "antivirus.conf" = lib.mkIf cfg.virusScanning { text = ''
clamav { clamav {
action = "reject"; action = "reject";
symbol = "CLAM_VIRUS"; symbol = "CLAM_VIRUS";
type = "clamav"; type = "clamav";
log_clean = true; log_clean = true;
servers = "/run/clamav/clamd.ctl"; servers = "/run/clamav/clamd.ctl";
scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all
} }
} ''; };
''); };
workers.rspamd_proxy = { workers.rspamd_proxy = {
type = "rspamd_proxy"; type = "rspamd_proxy";

View file

@ -125,10 +125,15 @@ import <nixpkgs/nixos/tests/make-test.nix> {
}; };
"root/.msmtprc" = { "root/.msmtprc" = {
text = '' text = ''
account test2 defaults
tls on
tls_certcheck off
account user2
host ${serverIP} host ${serverIP}
port 587 port 587
from user@example2.com from user@example2.com
auth on
user user@example2.com user user@example2.com
password user2 password user2
''; '';
@ -169,7 +174,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
--Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607-- --Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607--
''; '';
"root/email2".text = '' "root/safe-email".text = ''
From: User <user@example2.com> From: User <user@example2.com>
To: User1 <user1@example.com> To: User1 <user1@example.com>
Cc: Cc:
@ -187,13 +192,17 @@ import <nixpkgs/nixos/tests/make-test.nix> {
}; };
}; };
testScript = testScript = { nodes, ... }:
'' ''
startAll; startAll;
$server->waitForUnit("multi-user.target"); $server->waitForUnit("multi-user.target");
$client->waitForUnit("multi-user.target"); $client->waitForUnit("multi-user.target");
# TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket.
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ \$? -eq 124 ]");
$client->execute("cp -p /etc/root/.* ~/"); $client->execute("cp -p /etc/root/.* ~/");
$client->succeed("mkdir -p ~/mail"); $client->succeed("mkdir -p ~/mail");
$client->succeed("ls -la ~/ >&2"); $client->succeed("ls -la ~/ >&2");
@ -206,7 +215,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
# Verify that mail can be sent and received before testing virus scanner # Verify that mail can be sent and received before testing virus scanner
$client->execute("rm ~/mail/*"); $client->execute("rm ~/mail/*");
$client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2"); $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/safe-email >&2");
# give the mail server some time to process the mail # give the mail server some time to process the mail
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]'); $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
$client->execute("rm ~/mail/*"); $client->execute("rm ~/mail/*");
@ -214,13 +223,12 @@ import <nixpkgs/nixos/tests/make-test.nix> {
$client->succeed("fetchmail -v >&2"); $client->succeed("fetchmail -v >&2");
$client->execute("rm ~/mail/*"); $client->execute("rm ~/mail/*");
subtest "virus scan file", sub { subtest "virus scan file", sub {
$server->fail("clamscan --follow-file-symlinks=2 -r /etc/root/ >&2"); $server->succeed("clamdscan \$(readlink -f /etc/root/eicar.com.txt) | grep \"Txt\\.Malware\\.Agent-1787597 FOUND\" >&2");
}; };
subtest "virus scanner", sub { subtest "virus scan email", sub {
$client->fail("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/virus-email >&2"); $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | grep \"server message: 554 5\\.7\\.1 clamav: virus found: .*\\(Eicar\\|EICAR\\)\" >&2"); # for some reason this ID is nondetermistic...
# give the mail server some time to process the mail # give the mail server some time to process the mail
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]'); $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
}; };

View file

@ -275,13 +275,16 @@ import <nixpkgs/nixos/tests/make-test.nix> {
}; };
}; };
testScript = testScript = { nodes, ... }:
'' ''
startAll; startAll;
$server->waitForUnit("multi-user.target"); $server->waitForUnit("multi-user.target");
$client->waitForUnit("multi-user.target"); $client->waitForUnit("multi-user.target");
# TODO put this blocking into the systemd units?
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
$client->execute("cp -p /etc/root/.* ~/"); $client->execute("cp -p /etc/root/.* ~/");
$client->succeed("mkdir -p ~/mail"); $client->succeed("mkdir -p ~/mail");
$client->succeed("ls -la ~/ >&2"); $client->succeed("ls -la ~/ >&2");