From 08cd4d33718cecee9b049ead79f032c8fb96f32d Mon Sep 17 00:00:00 2001 From: Brennan Kinney <5098581+polarathene@users.noreply.github.com> Date: Wed, 15 Sep 2021 20:28:04 +1200 Subject: [PATCH] fix: Enable DH parameters (ffdhe4096) by default (#2192) This feature was originally introduced by the PR: https://github.com/docker-mailserver/docker-mailserver/pull/1463 - Assign default DH params to use via Dockerfile build instead of copy and update at runtime. - Parameterized service names and paths. - Refactor postfix and dovecot dh methods to wrap shared dh logic - I don't see any value in checking the alternative service for dh params file to copy over, so that's now dropped too. - Another conditional check is dropped and the default fallback message for existing DH params file is no longer relevant. - Improved the remaining `_notify` messages. Collapsing the warning into a single logged message also seemed relevant. - There is no apparent need for special handling with `ONE_DIR=1`. Dropped it. - Refactor DH params tests - Combine custom and default DH param tests into single test file - docs: Add instructions to use custom DH params There is no official documented support for custom DH parameters. As no guarantee is provided, this is considered an internal change, not a breaking one. --- Dockerfile | 8 +- docs/content/config/security/ssl.md | 12 +- target/scripts/startup/setup-stack.sh | 94 +++----------- test/mail_dhparams_default.bats | 81 ------------ test/mail_dhparams_manual_not_one_dir.bats | 64 ---------- test/mail_dhparams_manual_one_dir.bats | 61 --------- test/mail_tls_dhparams.bats | 142 +++++++++++++++++++++ 7 files changed, 176 insertions(+), 286 deletions(-) delete mode 100644 test/mail_dhparams_default.bats delete mode 100644 test/mail_dhparams_manual_not_one_dir.bats delete mode 100644 test/mail_dhparams_manual_one_dir.bats create mode 100644 test/mail_tls_dhparams.bats diff --git a/Dockerfile b/Dockerfile index 3f5472ff..752fb501 100644 --- a/Dockerfile +++ b/Dockerfile @@ -225,7 +225,13 @@ RUN \ COPY target/fetchmail/fetchmailrc /etc/fetchmailrc_general COPY target/postfix/main.cf target/postfix/master.cf /etc/postfix/ -COPY target/shared/ffdhe4096.pem /etc/postfix/shared/ffdhe4096.pem + +# DH parameters for DHE cipher suites, ffdhe4096 is the official standard 4096-bit DH params now part of TLS 1.3 +# This file is for TLS <1.3 handshakes that rely on DHE cipher suites +# Handled at build to avoid failures by doveadm validating ssl_dh filepath in 10-ssl.auth (eg generate-accounts) +COPY target/shared/ffdhe4096.pem /etc/postfix/dhparams.pem +COPY target/shared/ffdhe4096.pem /etc/dovecot/dh.pem + COPY \ target/postfix/header_checks.pcre \ target/postfix/sender_header_filter.pcre \ diff --git a/docs/content/config/security/ssl.md b/docs/content/config/security/ssl.md index 2d200694..812fab6f 100644 --- a/docs/content/config/security/ssl.md +++ b/docs/content/config/security/ssl.md @@ -654,6 +654,12 @@ if [ "$certcheck_2weeks" = "Certificate will not expire" ]; then fi ``` +## Custom DH Parameters + +By default `docker-mailserver` uses [`ffdhe4096`][ffdhe4096-src] from [IETF RFC 7919][ietf::rfc::ffdhe]. These are standardized pre-defined DH groups and the only available DH groups for TLS 1.3. It is [discouraged to generate your own DH parameters][dh-avoid-selfgenerated] as it is often less secure. + +Despite this, if you must use non-standard DH parameters or you would like to swap `ffdhe4096` for a different group (eg `ffdhe2048`); Add your own PEM encoded DH params file via a volume to `/tmp/docker-mailserver/dhparams.pem`. This will replace DH params for both Dovecot and Postfix services during container startup. + [docs-optional-config]: ../advanced/optional-config.md [github-file-compose]: https://github.com/docker-mailserver/docker-mailserver/blob/master/docker-compose.yml @@ -661,4 +667,8 @@ fi [hanscees-renewcerts]: https://github.com/hanscees/dockerscripts/blob/master/scripts/tomav-renew-certs [traefik::github]: https://github.com/containous/traefik -[ietf::rfc::acme]: https://tools.ietf.org/html/rfc8555 +[ietf::rfc::acme]: https://datatracker.ietf.org/doc/html/rfc8555 + +[ietf::rfc::ffdhe]: https://datatracker.ietf.org/doc/html/rfc7919 +[ffdhe4096-src]: https://github.com/internetstandards/dhe_groups +[dh-avoid-selfgenerated]: https://crypto.stackexchange.com/questions/29926/what-diffie-hellman-parameters-should-i-use diff --git a/target/scripts/startup/setup-stack.sh b/target/scripts/startup/setup-stack.sh index 27ed552e..cd20a5e6 100644 --- a/target/scripts/startup/setup-stack.sh +++ b/target/scripts/startup/setup-stack.sh @@ -1301,92 +1301,30 @@ function _setup_postfix_relay_hosts function _setup_postfix_dhparam { - _notify 'task' 'Setting up Postfix dhparam' - - if [[ ${ONE_DIR} -eq 1 ]] - then - DHPARAMS_FILE=/var/mail-state/lib-shared/dhparams.pem - - if [[ ! -f ${DHPARAMS_FILE} ]] - then - _notify 'inf' "Use ffdhe4096 for dhparams (postfix)" - cp -f /etc/postfix/shared/ffdhe4096.pem /etc/postfix/dhparams.pem - else - _notify 'inf' "Use postfix dhparams that was generated previously" - _notify 'warn' "Using self-generated dhparams is considered as insecure." - _notify 'warn' "Unless you known what you are doing, please remove /var/mail-state/lib-shared/dhparams.pem." - - # Copy from the state directory to the working location - cp -f "${DHPARAMS_FILE}" /etc/postfix/dhparams.pem - fi - else - if [[ ! -f /etc/postfix/dhparams.pem ]] - then - if [[ -f /etc/dovecot/dh.pem ]] - then - _notify 'inf' "Copy dovecot dhparams to postfix" - cp /etc/dovecot/dh.pem /etc/postfix/dhparams.pem - elif [[ -f /tmp/docker-mailserver/dhparams.pem ]] - then - _notify 'inf' "Copy pre-generated dhparams to postfix" - _notify 'warn' "Using self-generated dhparams is considered as insecure." - _notify 'warn' "Unless you known what you are doing, please remove /var/mail-state/lib-shared/dhparams.pem." - cp /tmp/docker-mailserver/dhparams.pem /etc/postfix/dhparams.pem - else - _notify 'inf' "Use ffdhe4096 for dhparams (postfix)" - cp /etc/postfix/shared/ffdhe4096.pem /etc/postfix/dhparams.pem - fi - else - _notify 'inf' "Use existing postfix dhparams" - _notify 'warn' "Using self-generated dhparams is considered insecure." - _notify 'warn' "Unless you known what you are doing, please remove /etc/postfix/dhparams.pem." - fi - fi + _setup_dhparam 'postfix' '/etc/postfix/dhparams.pem' } function _setup_dovecot_dhparam { - _notify 'task' 'Setting up Dovecot dhparam' + _setup_dhparam 'dovecot' '/etc/dovecot/dh.pem' +} - if [[ ${ONE_DIR} -eq 1 ]] - then - DHPARAMS_FILE=/var/mail-state/lib-shared/dhparams.pem +function _setup_dhparam +{ + local DH_SERVICE=$1 + local DH_DEST=$2 + local DH_CUSTOM=/tmp/docker-mailserver/dhparams.pem - if [[ ! -f ${DHPARAMS_FILE} ]] - then - _notify 'inf' "Use ffdhe4096 for dhparams (dovecot)" - cp -f /etc/postfix/shared/ffdhe4096.pem /etc/dovecot/dh.pem - else - _notify 'inf' "Use dovecot dhparams that was generated previously" - _notify 'warn' "Using self-generated dhparams is considered as insecure." - _notify 'warn' "Unless you known what you are doing, please remove /var/mail-state/lib-shared/dhparams.pem." + _notify 'task' "Setting up ${DH_SERVICE} dhparam" - # Copy from the state directory to the working location - cp -f "${DHPARAMS_FILE}" /etc/dovecot/dh.pem - fi - else - if [[ ! -f /etc/dovecot/dh.pem ]] - then - if [[ -f /etc/postfix/dhparams.pem ]] - then - _notify 'inf' "Copy postfix dhparams to dovecot" - cp /etc/postfix/dhparams.pem /etc/dovecot/dh.pem - elif [[ -f /tmp/docker-mailserver/dhparams.pem ]] - then - _notify 'inf' "Copy pre-generated dhparams to dovecot" - _notify 'warn' "Using self-generated dhparams is considered as insecure." - _notify 'warn' "Unless you known what you are doing, please remove /tmp/docker-mailserver/dhparams.pem." + if [[ -f ${DH_CUSTOM} ]] + then # use custom supplied dh params (assumes they're probably insecure) + _notify 'inf' "${DH_SERVICE} will use custom provided DH paramters." + _notify 'warn' "Using self-generated dhparams is considered insecure. Unless you know what you are doing, please remove ${DH_CUSTOM}." - cp /tmp/docker-mailserver/dhparams.pem /etc/dovecot/dh.pem - else - _notify 'inf' "Use ffdhe4096 for dhparams (dovecot)" - cp /etc/postfix/shared/ffdhe4096.pem /etc/dovecot/dh.pem - fi - else - _notify 'inf' "Use existing dovecot dhparams" - _notify 'warn' "Using self-generated dhparams is considered as insecure." - _notify 'warn' "Unless you known what you are doing, please remove /etc/dovecot/dh.pem." - fi + cp -f "${DH_CUSTOM}" "${DH_DEST}" + else # use official standardized dh params (provided via Dockerfile) + _notify 'inf' "${DH_SERVICE} will use official standardized DH parameters (ffdhe4096)." fi } diff --git a/test/mail_dhparams_default.bats b/test/mail_dhparams_default.bats deleted file mode 100644 index 59c98b1d..00000000 --- a/test/mail_dhparams_default.bats +++ /dev/null @@ -1,81 +0,0 @@ -load 'test_helper/common' - -# Test case -# --------- -# By default, this image is using audited FFDHE groups (https://github.com/docker-mailserver/docker-mailserver/pull/1463) -# -# This test case covers the described case against both boolean states for `ONE_DIR`. -# -# Description: -# - When no DHE parameters are supplied by the user: -# ~ The file `ffdhe4096.pem` has not been modified (checksum verification). -# ~ `ffdhe4096.pem` is copied to the configuration directories for postfix and dovecot. - - -function setup() { - run_setup_file_if_necessary -} - -function teardown() { - run_teardown_file_if_necessary -} - -function setup_file() { - local PRIVATE_CONFIG - PRIVATE_CONFIG="$(duplicate_config_for_container . mail_default_dhparams_both_one_dir)" - docker run -d --name mail_default_dhparams_one_dir \ - -v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \ - -v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \ - -e DMS_DEBUG=0 \ - -e ONE_DIR=1 \ - -h mail.my-domain.com -t "${NAME}" - wait_for_finished_setup_in_container mail_default_dhparams_one_dir - - PRIVATE_CONFIG="$(duplicate_config_for_container . mail_default_dhparams_both_not_one_dir)" - docker run -d --name mail_default_dhparams_not_one_dir \ - -v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \ - -v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \ - -e DMS_DEBUG=0 \ - -e ONE_DIR=0 \ - -h mail.my-domain.com -t "${NAME}" - wait_for_finished_setup_in_container mail_default_dhparams_not_one_dir -} - -function teardown_file() { - docker rm -f mail_default_dhparams_one_dir - docker rm -f mail_default_dhparams_not_one_dir -} - -@test "first" { - skip 'this test must come first to reliably identify when to run setup_file' -} - -@test "checking ssl: checking dhe params are sufficient" { - # reference used: (22/04/2020) https://english.ncsc.nl/publications/publications/2019/juni/01/it-security-guidelines-for-transport-layer-security-tls - - # check ffdhe params are inchanged - REPO_CHECKSUM=$(sha512sum "$(pwd)/target/shared/ffdhe4096.pem" | awk '{print $1}') - MOZILLA_CHECKSUM=$(curl https://ssl-config.mozilla.org/ffdhe4096.txt -s | sha512sum | awk '{print $1}') - assert_equal "${REPO_CHECKSUM}" "${MOZILLA_CHECKSUM}" - run echo "${REPO_CHECKSUM}" - refute_output '' # checksum must not be empty - - # by default, ffdhe4096 should be used - - # ONE_DIR=1 - DOCKER_DOVECOT_CHECKSUM_ONE_DIR=$(docker exec mail_default_dhparams_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') - DOCKER_POSTFIX_CHECKSUM_ONE_DIR=$(docker exec mail_default_dhparams_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') - assert_equal "${DOCKER_DOVECOT_CHECKSUM_ONE_DIR}" "${REPO_CHECKSUM}" - assert_equal "${DOCKER_POSTFIX_CHECKSUM_ONE_DIR}" "${REPO_CHECKSUM}" - - # ONE_DIR=0 - DOCKER_DOVECOT_CHECKSUM_NOT_ONE_DIR=$(docker exec mail_default_dhparams_not_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') - DOCKER_POSTFIX_CHECKSUM_NOT_ONE_DIR=$(docker exec mail_default_dhparams_not_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') - assert_equal "${DOCKER_DOVECOT_CHECKSUM_NOT_ONE_DIR}" "${REPO_CHECKSUM}" - assert_equal "${DOCKER_POSTFIX_CHECKSUM_NOT_ONE_DIR}" "${REPO_CHECKSUM}" -} - - -@test "last" { - skip 'this test is only there to reliably mark the end for the teardown_file' -} diff --git a/test/mail_dhparams_manual_not_one_dir.bats b/test/mail_dhparams_manual_not_one_dir.bats deleted file mode 100644 index a873d61b..00000000 --- a/test/mail_dhparams_manual_not_one_dir.bats +++ /dev/null @@ -1,64 +0,0 @@ -load 'test_helper/common' - -# Test case -# --------- -# By default, this image is using audited FFDHE groups (https://github.com/docker-mailserver/docker-mailserver/pull/1463) -# -# This test case covers the described case when `ONE_DIR=0`. -# -# Description: -# - When custom DHE parameters are supplied by the user: -# ~ User supplied DHE parameters are copied to the configuration directories for postfix and dovecot. -# ~ A warning is raised about usage of insecure parameters. - - -function setup() { - run_setup_file_if_necessary -} - -function teardown() { - run_teardown_file_if_necessary -} - -function setup_file() { - local PRIVATE_CONFIG - PRIVATE_CONFIG=$(duplicate_config_for_container .) - # copy the custom DHE params in local config - cp "$(pwd)/test/test-files/ssl/custom-dhe-params.pem" "${PRIVATE_CONFIG}/dhparams.pem" - - docker run -d --name mail_manual_dhparams_not_one_dir \ - -v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \ - -v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \ - -e DMS_DEBUG=0 \ - -e ONE_DIR=0 \ - -h mail.my-domain.com -t "${NAME}" - wait_for_finished_setup_in_container mail_manual_dhparams_not_one_dir -} - -function teardown_file() { - docker rm -f mail_manual_dhparams_not_one_dir -} - -@test "first" { - skip 'this test must come first to reliably identify when to run setup_file' -} - -@test "checking dhparams: ONE_DIR=0 check manual dhparams is used" { - test_checksum=$(sha512sum "$(pwd)/test/test-files/ssl/custom-dhe-params.pem" | awk '{print $1}') - run echo "${test_checksum}" - refute_output '' # checksum must not be empty - - docker_dovecot_checksum=$(docker exec mail_manual_dhparams_not_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') - docker_postfix_checksum=$(docker exec mail_manual_dhparams_not_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') - assert_equal "${docker_dovecot_checksum}" "${test_checksum}" - assert_equal "${docker_postfix_checksum}" "${test_checksum}" -} - -@test "checking dhparams: ONE_DIR=0 check warning output when using manual dhparams" { - run sh -c "docker logs mail_manual_dhparams_not_one_dir | grep 'Using self-generated dhparams is considered as insecure'" - assert_success -} - -@test "last" { - skip 'this test is only there to reliably mark the end for the teardown_file' -} diff --git a/test/mail_dhparams_manual_one_dir.bats b/test/mail_dhparams_manual_one_dir.bats deleted file mode 100644 index 6fa8c331..00000000 --- a/test/mail_dhparams_manual_one_dir.bats +++ /dev/null @@ -1,61 +0,0 @@ -load 'test_helper/common' - -# Test case -# --------- -# By default, this image is using audited FFDHE groups (https://github.com/docker-mailserver/docker-mailserver/pull/1463) -# -# This test case covers the described case when `ONE_DIR=1`. -# -# Description: -# - When custom DHE parameters are supplied by the user: -# ~ User supplied DHE parameters are copied to the configuration directories for postfix and dovecot. -# ~ A warning is raised about usage of insecure parameters. - -function setup() { - run_setup_file_if_necessary -} - -function teardown() { - run_teardown_file_if_necessary -} - -function setup_file() { - local PRIVATE_CONFIG - PRIVATE_CONFIG="$(duplicate_config_for_container .)" - docker run -d --name mail_manual_dhparams_one_dir \ - -v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \ - -v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \ - -v "$(pwd)/test/test-files/ssl/custom-dhe-params.pem":/var/mail-state/lib-shared/dhparams.pem:ro \ - -e DMS_DEBUG=0 \ - -e ONE_DIR=1 \ - -h mail.my-domain.com -t "${NAME}" - wait_for_finished_setup_in_container mail_manual_dhparams_one_dir -} - -function teardown_file() { - docker rm -f mail_manual_dhparams_one_dir -} - -@test "first" { - skip 'this test must come first to reliably identify when to run setup_file' -} - -@test "checking dhparams: ONE_DIR=1 check manual dhparams is used" { - test_checksum=$(sha512sum "$(pwd)/test/test-files/ssl/custom-dhe-params.pem" | awk '{print $1}') - run echo "${test_checksum}" - refute_output '' # checksum must not be empty - - docker_dovecot_checksum=$(docker exec mail_manual_dhparams_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') - docker_postfix_checksum=$(docker exec mail_manual_dhparams_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') - assert_equal "${docker_dovecot_checksum}" "${test_checksum}" - assert_equal "${docker_postfix_checksum}" "${test_checksum}" -} - -@test "checking dhparams: ONE_DIR=1 check warning output when using manual dhparams" { - run sh -c "docker logs mail_manual_dhparams_one_dir | grep 'Using self-generated dhparams is considered as insecure'" - assert_success -} - -@test "last" { - skip 'this test is only there to reliably mark the end for the teardown_file' -} diff --git a/test/mail_tls_dhparams.bats b/test/mail_tls_dhparams.bats new file mode 100644 index 00000000..bf787e4f --- /dev/null +++ b/test/mail_tls_dhparams.bats @@ -0,0 +1,142 @@ +load 'test_helper/common' + +# Test case +# --------- +# By default, this image is using audited FFDHE groups (https://github.com/docker-mailserver/docker-mailserver/pull/1463) +# +# This test case covers the described case against both boolean states for `ONE_DIR`. +# +# Description: +# 1. Verify that the file `ffdhe4096.pem` has not been modified (checksum verification). +# 2. Verify Postfix and Dovecot are using the default `ffdhe4096.pem` from Dockerfile build. +# 3. When custom DHE parameters are supplied by the user as `/tmp/docker-mailserver/dhparams.pem`: +# - Verify Postfix and Dovecot use the custom `custom-dhe-params.pem` (contents is actually `ffdhe2048.pem`). +# - A warning is raised about usage of potentially insecure parameters. + +function setup() { + run_setup_file_if_necessary +} + +function teardown() { + docker rm -f mail_dhparams + run_teardown_file_if_necessary +} + +function setup_file() { + # Delegated container setup to common_container_setup + # DRY - Explicit config changes between tests are more apparent this way. + + # Global scope + # Copies all of `./test/config/` to specific directory for testing + # `${PRIVATE_CONFIG}` becomes `$(pwd)/test/duplicate_configs/` + export PRIVATE_CONFIG + + export DMS_ONE_DIR=1 # default + + local DH_DEFAULT_PARAMS + export DH_DEFAULT_CHECKSUM + export DH_CUSTOM_PARAMS + export DH_CUSTOM_CHECKSUM + + + DH_DEFAULT_PARAMS="$(pwd)/target/shared/ffdhe4096.pem" + DH_DEFAULT_CHECKSUM="$(sha512sum "${DH_DEFAULT_PARAMS}" | awk '{print $1}')" + + DH_CUSTOM_PARAMS="$(pwd)/test/test-files/ssl/custom-dhe-params.pem" + DH_CUSTOM_CHECKSUM="$(sha512sum "${DH_CUSTOM_PARAMS}" | awk '{print $1}')" +} + +# Not used +# function teardown_file() { +# } + +@test "first" { + skip 'this test must come first to reliably identify when to run setup_file' +} + +@test "testing tls: DH Parameters - Verify integrity of Default (ffdhe4096)" { + # Reference used (22/04/2020): + # https://english.ncsc.nl/publications/publications/2019/juni/01/it-security-guidelines-for-transport-layer-security-tls + + run echo "${DH_DEFAULT_CHECKSUM}" + refute_output '' # checksum must not be empty + + # Verify the FFDHE params file has not been modified (equivalent to `target/shared/ffdhe4096.pem.sha512sum`): + local DH_MOZILLA_CHECKSUM + DH_MOZILLA_CHECKSUM="$(curl https://ssl-config.mozilla.org/ffdhe4096.txt -s | sha512sum | awk '{print $1}')" + assert_equal "${DH_DEFAULT_CHECKSUM}" "${DH_MOZILLA_CHECKSUM}" +} + +@test "testing tls: DH Parameters - Default [ONE_DIR=0]" { + PRIVATE_CONFIG="$(duplicate_config_for_container . mail_dhparams_default_0)" + DMS_ONE_DIR=0 + + common_container_setup + should_have_valid_checksum "${DH_DEFAULT_CHECKSUM}" +} + +@test "testing tls: DH Parameters - Default [ONE_DIR=1]" { + PRIVATE_CONFIG="$(duplicate_config_for_container . mail_dhparams_default_1)" + + common_container_setup + should_have_valid_checksum "${DH_DEFAULT_CHECKSUM}" +} + +@test "testing tls: DH Parameters - Custom [ONE_DIR=0]" { + PRIVATE_CONFIG="$(duplicate_config_for_container . mail_dhparams_custom_0)" + # shellcheck disable=SC2030 + DMS_ONE_DIR=0 + + cp "${DH_CUSTOM_PARAMS}" "${PRIVATE_CONFIG}/dhparams.pem" + + common_container_setup + should_have_valid_checksum "${DH_CUSTOM_CHECKSUM}" + should_emit_warning +} + +@test "testing tls: DH Parameters - Custom [ONE_DIR=1]" { + # shellcheck disable=SC2030 + PRIVATE_CONFIG="$(duplicate_config_for_container . mail_dhparams_custom_1)" + + cp "${DH_CUSTOM_PARAMS}" "${PRIVATE_CONFIG}/dhparams.pem" + + common_container_setup + should_have_valid_checksum "${DH_CUSTOM_CHECKSUM}" + should_emit_warning +} + +@test "last" { + skip 'this test is only there to reliably mark the end for the teardown_file' +} + +function common_container_setup() { + # shellcheck disable=SC2031 + docker run -d --name mail_dhparams \ + -v "${PRIVATE_CONFIG}:/tmp/docker-mailserver" \ + -v "$(pwd)/test/test-files:/tmp/docker-mailserver-test:ro" \ + -e DMS_DEBUG=0 \ + -e ONE_DIR="${DMS_ONE_DIR}" \ + -h mail.my-domain.com \ + --tty \ + "${NAME}" + + wait_for_finished_setup_in_container mail_dhparams +} + +# Ensures the docker image services (Postfix and Dovecot) have the intended DH files +function should_have_valid_checksum() { + local DH_CHECKSUM=$1 + + local DH_CHECKSUM_DOVECOT + DH_CHECKSUM_DOVECOT=$(docker exec mail_dhparams sha512sum /etc/dovecot/dh.pem | awk '{print $1}') + assert_equal "${DH_CHECKSUM_DOVECOT}" "${DH_CHECKSUM}" + + local DH_CHECKSUM_POSTFIX + DH_CHECKSUM_POSTFIX=$(docker exec mail_dhparams sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') + assert_equal "${DH_CHECKSUM_POSTFIX}" "${DH_CHECKSUM}" +} + +function should_emit_warning() { + run sh -c "docker logs mail_dhparams | grep 'Using self-generated dhparams is considered insecure.'" + assert_success +}