mirror of
https://github.com/tomav/docker-mailserver.git
synced 2024-07-07 16:41:06 +02:00
0bbec09529
- `disabled_clamav_spamassassin`: - Just shuffling the test order around, and removing the restart test at the end which doesn't make sense. - `postscreen`: - Now uses common helper for getting container IP - Does not appear to need the `NET_ADMIN` capability? - Reduced startup time for the 2nd container + additional context about it's relevance. - Test cases are largely the same, but refactored the `nc` alternative that properly waits it's turn. This only needs to run once. Added additional commentary and made into a generic method if needed in other tests. - `fail2ban`: - Use the common container IP helper method. - Postscreen isn't affecting this test, it's not required to do the much slower exchange with the mail server when sending a login failure. - IP being passed into ENV is no longer necessary. - `sleep 5` in the related test cases doesn't seem necessary, can better rely on polling with timeout. - `sleep 10` for `setup.sh` also doesn't appear to be necessary. - `postgrey`: - Reduced POSTGREY_DELAY to 3, which shaves a fair amount of wasted time while still verifying the delay works. - One of the checks in `main.cf` doesn't seem to need to know about the earlier spamhaus portion of the line to work, removed. - Better test case descriptions. - Improved log matching via standard method that better documents the expected triplet under test. - Removed a redundant whitelist file and test that didn't seem to have any relevance. Added a TODO with additional notes about a concern with these tests. - Reduced test time as 8 second timeouts from `-w 8` don't appear to be required, better to poll with grep instead. - Replaced `wc -l` commands with a new method to assert expected line count, better enabling assertions on the actual output. - `undef_spam_subject`: - Split to two separate test cases, and initialize each container in their case instead of `setup_file()`, allowing for using the default `teardown()` method (and slight benefit if running in parallel). - `permit_docker`: - Not a parallel test, but I realized that the repeat helper methods don't necessarily play well with `run` as the command (can cause false positive of what was successful).
89 lines
4.2 KiB
Bash
89 lines
4.2 KiB
Bash
load "${REPOSITORY_ROOT}/test/test_helper/common"
|
|
|
|
NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME=non-default-docker-mail-network
|
|
setup_file() {
|
|
docker network create --driver bridge "${NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME}"
|
|
docker network create --driver bridge "${NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME}2"
|
|
|
|
# use two networks (default ("bridge") and our custom network) to recreate problematic test case where PERMIT_DOCKER=host would not help
|
|
# currently we cannot use --network in `docker run` multiple times, it will just use the last one
|
|
# instead we need to use create, network connect and start (see https://success.docker.com/article/multiple-docker-networks)
|
|
local PRIVATE_CONFIG
|
|
|
|
PRIVATE_CONFIG=$(duplicate_config_for_container . mail_smtponly_second_network)
|
|
docker create --name mail_smtponly_second_network \
|
|
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
|
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
|
-e SMTP_ONLY=1 \
|
|
-e PERMIT_DOCKER=connected-networks \
|
|
-e OVERRIDE_HOSTNAME=mail.my-domain.com \
|
|
--network "${NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME}" \
|
|
-t "${NAME}"
|
|
|
|
docker network connect "${NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME}2" mail_smtponly_second_network
|
|
docker start mail_smtponly_second_network
|
|
|
|
PRIVATE_CONFIG=$(duplicate_config_for_container . mail_smtponly_second_network_sender)
|
|
docker run -d --name mail_smtponly_second_network_sender \
|
|
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
|
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
|
-e SMTP_ONLY=1 \
|
|
-e PERMIT_DOCKER=connected-networks \
|
|
-e OVERRIDE_HOSTNAME=mail.my-domain.com \
|
|
--network "${NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME}2" \
|
|
-t "${NAME}"
|
|
|
|
# wait until postfix is up
|
|
wait_for_smtp_port_in_container mail_smtponly_second_network
|
|
|
|
# create another container that enforces authentication even on local connections
|
|
docker run -d --name mail_smtponly_force_authentication \
|
|
-v "${PRIVATE_CONFIG}":/tmp/docker-mailserver \
|
|
-v "$(pwd)/test/test-files":/tmp/docker-mailserver-test:ro \
|
|
-e SMTP_ONLY=1 \
|
|
-e PERMIT_DOCKER=none \
|
|
-e OVERRIDE_HOSTNAME=mail.my-domain.com \
|
|
-t "${NAME}"
|
|
|
|
# wait until postfix is up
|
|
wait_for_smtp_port_in_container mail_smtponly_force_authentication
|
|
}
|
|
|
|
teardown_file() {
|
|
docker logs mail_smtponly_second_network
|
|
docker rm -f mail_smtponly_second_network mail_smtponly_second_network_sender mail_smtponly_force_authentication
|
|
docker network rm "${NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME}" "${NON_DEFAULT_DOCKER_MAIL_NETWORK_NAME}2"
|
|
}
|
|
|
|
@test "checking PERMIT_DOCKER: connected-networks" {
|
|
IPNET1=$(docker network inspect --format '{{(index .IPAM.Config 0).Subnet}}' non-default-docker-mail-network)
|
|
IPNET2=$(docker network inspect --format '{{(index .IPAM.Config 0).Subnet}}' non-default-docker-mail-network2)
|
|
run docker exec mail_smtponly_second_network /bin/sh -c "postconf | grep '^mynetworks ='"
|
|
assert_output --partial "${IPNET1}"
|
|
assert_output --partial "${IPNET2}"
|
|
|
|
run docker exec mail_smtponly_second_network /bin/sh -c "postconf smtp_host_lookup=no"
|
|
assert_success
|
|
|
|
run docker exec mail_smtponly_second_network /bin/sh -c "/etc/init.d/postfix reload"
|
|
assert_success
|
|
|
|
# we should be able to send from the other container on the second network!
|
|
run docker exec mail_smtponly_second_network_sender /bin/sh -c "nc mail_smtponly_second_network 25 < /tmp/docker-mailserver-test/email-templates/smtp-only.txt"
|
|
assert_output --partial "250 2.0.0 Ok: queued as "
|
|
repeat_in_container_until_success_or_timeout 60 mail_smtponly_second_network /bin/sh -c 'grep -cE "to=<user2\@external.tld>.*status\=sent" /var/log/mail/mail.log'
|
|
}
|
|
|
|
@test "checking PERMIT_DOCKER: none" {
|
|
run docker exec mail_smtponly_force_authentication /bin/sh -c "postconf smtp_host_lookup=no"
|
|
assert_success
|
|
|
|
run docker exec mail_smtponly_force_authentication /bin/sh -c "/etc/init.d/postfix reload"
|
|
assert_success
|
|
|
|
# the mailserver should require authentication and a protocol error should occur when using TLS
|
|
run docker exec mail_smtponly_force_authentication /bin/sh -c "nc localhost 25 < /tmp/docker-mailserver-test/email-templates/smtp-only.txt"
|
|
assert_output --partial "550 5.5.1 Protocol error"
|
|
[[ ${status} -ge 0 ]]
|
|
}
|