diff --git a/Makefile b/Makefile index 77fbb165..dcd0e122 100644 --- a/Makefile +++ b/Makefile @@ -155,4 +155,4 @@ clean: sudo rm -rf test/config ;\ mv testconfig.bak test/config ;\ fi - -sudo rm -rf test/onedir test/alias test/quota test/relay test/config/dovecot-lmtp/userdb test/config/key* test/config/opendkim/keys/domain.tld/ test/config/opendkim/keys/example.com/ test/config/opendkim/keys/localdomain2.com/ test/config/postfix-aliases.cf test/config/postfix-receive-access.cf test/config/postfix-receive-access.cfe test/config/dovecot-quotas.cf test/config/postfix-send-access.cf test/config/postfix-send-access.cfe test/config/relay-hosts/chksum test/config/relay-hosts/postfix-aliases.cf + -sudo rm -rf test/onedir test/alias test/quota test/relay test/config/dovecot-lmtp/userdb test/config/key* test/config/opendkim/keys/domain.tld/ test/config/opendkim/keys/example.com/ test/config/opendkim/keys/localdomain2.com/ test/config/postfix-aliases.cf test/config/postfix-receive-access.cf test/config/postfix-receive-access.cfe test/config/dovecot-quotas.cf test/config/postfix-send-access.cf test/config/postfix-send-access.cfe test/config/relay-hosts/chksum test/config/relay-hosts/postfix-aliases.cf test/config/dhparams.pem diff --git a/test/mail_dhparams_default.bats b/test/mail_dhparams_default.bats new file mode 100644 index 00000000..bfc18db2 --- /dev/null +++ b/test/mail_dhparams_default.bats @@ -0,0 +1,67 @@ +load 'test_helper/common' + +function setup() { + run_setup_file_if_necessary +} + +function teardown() { + run_teardown_file_if_necessary +} + +function setup_file() { + docker run -d --name mail_default_dhparams_one_dir \ + -v "`pwd`/test/config":/tmp/docker-mailserver \ + -v "`pwd`/test/test-files":/tmp/docker-mailserver-test:ro \ + -e DMS_DEBUG=0 \ + -e ONE_DIR=1 \ + -h mail.my-domain.com -t ${NAME} + + docker run -d --name mail_default_dhparams_not_one_dir \ + -v "`pwd`/test/config":/tmp/docker-mailserver \ + -v "`pwd`/test/test-files":/tmp/docker-mailserver-test:ro \ + -e DMS_DEBUG=0 \ + -e ONE_DIR=0 \ + -h mail.my-domain.com -t ${NAME} + + wait_for_finished_setup_in_container mail_default_dhparams_one_dir + wait_for_finished_setup_in_container mail_default_dhparams_not_one_dir +} + +function teardown_file() { + docker rm -f mail_default_dhparams_one_dir + docker rm -f mail_default_dhparams_not_one_dir +} + +@test "first" { + skip 'this test must come first to reliably identify when to run setup_file' +} + +@test "checking ssl: checking dhe params are sufficient" { + # reference used: (22/04/2020) https://english.ncsc.nl/publications/publications/2019/juni/01/it-security-guidelines-for-transport-layer-security-tls + + # check ffdhe params are inchanged + repo_checksum=$(sha512sum "$(pwd)/target/shared/ffdhe4096.pem" | awk '{print $1}') + mozilla_checksum=$(curl https://ssl-config.mozilla.org/ffdhe4096.txt -s | sha512sum | awk '{print $1}') + assert_equal "$repo_checksum" "$mozilla_checksum" + run echo "$repo_checksum" + refute_output '' # checksum must not be empty + + # by default, ffdhe4096 should be used + + # ONE_DIR=1 + docker_dovecot_checksum_one_dir=$(docker exec mail_default_dhparams_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') + docker_postfix_checksum_one_dir=$(docker exec mail_default_dhparams_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') + assert_equal "$docker_dovecot_checksum_one_dir" "$repo_checksum" + assert_equal "$docker_postfix_checksum_one_dir" "$repo_checksum" + + # ONE_DIR=0 + docker_dovecot_checksum_not_one_dir=$(docker exec mail_default_dhparams_not_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') + docker_postfix_checksum_not_one_dir=$(docker exec mail_default_dhparams_not_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') + assert_equal "$docker_dovecot_checksum_not_one_dir" "$repo_checksum" + assert_equal "$docker_postfix_checksum_not_one_dir" "$repo_checksum" +} + + +@test "last" { + skip 'this test is only there to reliably mark the end for the teardown_file' +} diff --git a/test/mail_dhparams_manual_not_one_dir.bats b/test/mail_dhparams_manual_not_one_dir.bats new file mode 100644 index 00000000..620bec0a --- /dev/null +++ b/test/mail_dhparams_manual_not_one_dir.bats @@ -0,0 +1,53 @@ +load 'test_helper/common' + +function setup() { + run_setup_file_if_necessary +} + +function teardown() { + run_teardown_file_if_necessary +} + +function setup_file() { + # copy the custom DHE params in local config + cp `pwd`/test/test-files/ssl/ffdhe2048.pem `pwd`/test/config/dhparams.pem + + docker run -d --name mail_manual_dhparams_not_one_dir \ + -v "`pwd`/test/config":/tmp/docker-mailserver \ + -v "`pwd`/test/test-files":/tmp/docker-mailserver-test:ro \ + -e DMS_DEBUG=0 \ + -e ONE_DIR=0 \ + -h mail.my-domain.com -t ${NAME} + + wait_for_finished_setup_in_container mail_manual_dhparams_not_one_dir +} + +function teardown_file() { + # remove custom dhe file + rm `pwd`/test/config/dhparams.pem + docker rm -f mail_manual_dhparams_not_one_dir +} + +@test "first" { + skip 'this test must come first to reliably identify when to run setup_file' +} + +@test "checking dhparams: ONE_DIR=0 check manual dhparams is used" { + test_checksum=$(sha512sum "$(pwd)/test/test-files/ssl/ffdhe2048.pem" | awk '{print $1}') + run echo "$test_checksum" + refute_output '' # checksum must not be empty + + docker_dovecot_checksum=$(docker exec mail_manual_dhparams_not_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') + docker_postfix_checksum=$(docker exec mail_manual_dhparams_not_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') + assert_equal "$docker_dovecot_checksum" "$test_checksum" + assert_equal "$docker_postfix_checksum" "$test_checksum" +} + +@test "checking dhparams: ONE_DIR=0 check warning output when using manual dhparams" { + run sh -c "docker logs mail_manual_dhparams_not_one_dir | grep 'Using self-generated dhparams is considered as insecure'" + assert_success +} + +@test "last" { + skip 'this test is only there to reliably mark the end for the teardown_file' +} diff --git a/test/mail_manual_dhparams.bats b/test/mail_dhparams_manual_one_dir.bats similarity index 58% rename from test/mail_manual_dhparams.bats rename to test/mail_dhparams_manual_one_dir.bats index bd068f98..1496172d 100644 --- a/test/mail_manual_dhparams.bats +++ b/test/mail_dhparams_manual_one_dir.bats @@ -9,38 +9,38 @@ function teardown() { } function setup_file() { - docker run -d --name mail_manual_dhparams \ + docker run -d --name mail_manual_dhparams_one_dir \ -v "`pwd`/test/config":/tmp/docker-mailserver \ -v "`pwd`/test/test-files":/tmp/docker-mailserver-test:ro \ -v "`pwd`/test/test-files/ssl/ffdhe2048.pem":/var/mail-state/lib-shared/dhparams.pem:ro \ -e DMS_DEBUG=0 \ -e ONE_DIR=1 \ -h mail.my-domain.com -t ${NAME} - wait_for_finished_setup_in_container mail_manual_dhparams + + wait_for_finished_setup_in_container mail_manual_dhparams_one_dir } function teardown_file() { - skip - docker rm -f mail_manual_dhparams + docker rm -f mail_manual_dhparams_one_dir } @test "first" { skip 'this test must come first to reliably identify when to run setup_file' } -@test "checking dhparams: check manual dhparams is used" { +@test "checking dhparams: ONE_DIR=1 check manual dhparams is used" { test_checksum=$(sha512sum "$(pwd)/test/test-files/ssl/ffdhe2048.pem" | awk '{print $1}') run echo "$test_checksum" refute_output '' # checksum must not be empty - docker_dovecot_checksum=$(docker exec mail_manual_dhparams sha512sum /etc/dovecot/dh.pem | awk '{print $1}') - docker_postfix_checksum=$(docker exec mail_manual_dhparams sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') + docker_dovecot_checksum=$(docker exec mail_manual_dhparams_one_dir sha512sum /etc/dovecot/dh.pem | awk '{print $1}') + docker_postfix_checksum=$(docker exec mail_manual_dhparams_one_dir sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') assert_equal "$docker_dovecot_checksum" "$test_checksum" assert_equal "$docker_postfix_checksum" "$test_checksum" } -@test "checking dhparams: check warning output when using manual dhparams" { - run sh -c "docker logs mail_manual_dhparams | grep 'Using self-generated dhparams is considered as insecure'" +@test "checking dhparams: ONE_DIR=1 check warning output when using manual dhparams" { + run sh -c "docker logs mail_manual_dhparams_one_dir | grep 'Using self-generated dhparams is considered as insecure'" assert_success } diff --git a/test/tests.bats b/test/tests.bats index 3e57c69d..986a2271 100644 --- a/test/tests.bats +++ b/test/tests.bats @@ -667,23 +667,6 @@ EOF assert_success } -@test "checking ssl: checking dhe params are sufficient" { - # reference used: (22/04/2020) https://english.ncsc.nl/publications/publications/2019/juni/01/it-security-guidelines-for-transport-layer-security-tls - - # check ffdhe params are inchanged - repo_checksum=$(sha512sum "$(pwd)/target/shared/ffdhe4096.pem" | awk '{print $1}') - mozilla_checksum=$(curl https://ssl-config.mozilla.org/ffdhe4096.txt -s | sha512sum | awk '{print $1}') - assert_equal "$repo_checksum" "$mozilla_checksum" - run echo "$repo_checksum" - refute_output '' # checksum must not be empty - - # by default, ffdhe4096 should be used - docker_dovecot_checksum=$(docker exec mail sha512sum /etc/dovecot/dh.pem | awk '{print $1}') - docker_postfix_checksum=$(docker exec mail sha512sum /etc/postfix/dhparams.pem | awk '{print $1}') - assert_equal "$docker_dovecot_checksum" "$repo_checksum" - assert_equal "$docker_postfix_checksum" "$repo_checksum" -} - # # postsrsd #