Add test framework to test

- Mail encryption (when expected)
- Introducer listing, adding and removing
- Locals listing, adding and removing

.gitlab-ci.yml

@@ -11,5 +11,4 @@ e2e-test-job:
   stage: test
   image: localhost:5000/mta:latest
   script:
-    - bash /usr/bin/prepare.sh 
+    - bash /usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh
-    - cd e2e-tests && bash runner.sh

docker/MTAContainerFile

@@ -52,10 +52,13 @@ RUN apt-get update -yqq && \
   openssh-client \
   sudo \
   postfix \
+  postfix-pcre \
   rsyslog \
   postgresql \
   openssl \
-  sq
+  sq \
+  bind9-host \
+  inotify-tools
 
 RUN adduser --shell /bin/bash --disabled-password --gecos "" hockeypuck
 

docker/mta_provision/etc/postfix/main.cf

@@ -41,9 +41,9 @@ myhostname = example.com
 myorigin = example.com
 alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
-mydestination = $myhostname, localhost.localdomain, localhost
+mydestination = $myhostname, localhost.localdomain, localhost, example.com, example.org
 #relayhost = 
-mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 0.0.0.0/0
 mailbox_size_limit = 0
 recipient_delimiter = +
 inet_interfaces = all

docker/mta_provision/opt/husk/config.toml

@@ -4,4 +4,24 @@ sequoia_home = "/tmp/sq_home"
 
 logfile_config = "./log4rs.yml"
 
-keyservers = [ "hkps://example.com" ]
+keyservers = [ "hkp://example.com" ]
+
+[logging.appenders.console]
+kind = "console"
+[logging.appenders.console.encoder]
+pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
+
+[logging.appenders.file]
+kind = "file"
+path = "/tmp/husk.log"
+
+[logging.appenders.file.encoder]
+pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
+
+[logging.root]
+level = "debug"
+appenders = ["file"]
+
+[logging.loggers."husk"]
+level = "debug"
+

docker/mta_provision/usr/bin/gen_hockeypuck_conf.sh

@@ -35,7 +35,7 @@ webroot="/var/www/"
 bind="$IP:11371"
 
 [hockeypuck.hkps]
-bind="$IP:443"
+bind="$IP:4443"
 logRequestDetails=false
 cert="$CERTS/$DOMAIN.crt"
 key="$CERTS/$DOMAIN.key"

docker/mta_provision/usr/bin/gen_sq_home.sh

@@ -24,8 +24,8 @@ sq key export --cert $ALICE_FPR > $TMP/alice_sk.pgp
 sq key export --cert $CA_FPR > $TMP/ca_sk.pgp
 # only certs
 sq cert export --cert $BOB_FPR > $TMP/bob_pk.pgp
-sq network keyserver publish --server hkps://example.com --cert $CAROL_FPR
+sq network keyserver publish --server hkp://example.com --cert $CAROL_FPR
-sq network keyserver publish --server hkps://example.com --cert $DAVE_FPR
+sq network keyserver publish --server hkp://example.com --cert $DAVE_FPR
 
 # create store
 export SEQUOIA_HOME=$SEQUOIA_TARGET
@@ -41,4 +41,3 @@ sq pki link authorize --unconstrained --cert $CA_FPR --all --domain example.com
 # bob@example.com has a local cert, which is certified by ca@example.com
 # carol@example.com is published on a keyserver and certified by ca@example.com
 # dave@example.com is published on a keyserver but uncertified
-

docker/mta_provision/usr/bin/prepare.sh

@@ -3,12 +3,14 @@
 BRANCH=$1
 
 ## create domain
-echo "127.0.0.1 " $(hostname) > /etc/hosts
+echo "127.0.0.1 " $(hostname) >> /etc/hosts
 echo "127.0.0.2 example.com" >> /etc/hosts
+echo "127.0.0.3 example.org" >> /etc/hosts
 
 ## build milter
 if [ -f /opt/husk/mapped/Cargo.toml ] ; then
-  HUSK_BIN=/opt/husk/mapped/target/release/husk
+  HUSK_BIN=/opt/husk/mapped/target/debug/husk
+  HUSK_DIR=/opt/husk/mapped/
 else
   cd /opt/husk
   git clone https://gitlab.com/husk-project/husk-milter.git
@@ -16,9 +18,10 @@ else
   if [ "$BRANCH" != "" ] ; then
     git checkout $BRANCH
   fi
-  cargo build --release
+  cargo build
 
-  HUSK_BIN=/opt/husk/husk-milter/target/release/husk
+  HUSK_BIN=/opt/husk/husk-milter/target/debug/husk
+  HUSK_DIR=/opt/husk/husk-milter/
 fi
 
 ## start rsyslogd
@@ -52,5 +55,14 @@ done
 bash /usr/bin/gen_sq_home.sh
 
 ## start milter
-cd /opt/husk
+cd $HUSK_DIR/config
-$HUSK_BIN config.toml &
+$HUSK_BIN daemon start --config config.toml &
+
+## extract SEQUOIA_HOME from the configuration
+SEQUOIA_HOME=$(grep "sequoia_home" config.toml | cut -d '=' -f 2 | tr -d ' ')
+
+cat << EO_ENV > /tmp/env.sh
+export HUSK_BIN=$HUSK_BIN
+export HUSK_DIR=$HUSK_DIR
+export SEQUOIA_HOME=$SEQUOIA_HOME
+EO_ENV

docker/mta_provision/usr/bin/test_1.sh

@@ -1,12 +1,13 @@
 #!/usr/bin/bash
 
-echo "test message" | sendmail -t root@example.com
+adduser --shell /bin/bash --disabled-password --gecos "" mtatest
+echo "test message" | sendmail -t mtatest@example.com
 sleep 1
 
 ## simple test if mail passes
-if [ -f /var/mail/root ] ; then
+if [ -f /var/mail/mtatest ] ; then
   echo "success"
-  rm /var/mail/root
+  rm /var/mail/mtatest
 else
   echo "failure"
   exit 1

e2e-tests/common.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/bash
+
+# create a unix (shell) user
+create_unix_user() { # name
+  adduser --quiet --shell /bin/bash --disabled-password --gecos "" $1 > /dev/null 2>&1
+}
+
+# delete a unix user, plus remove $HOME and mails
+delete_unix_user() { # name
+  deluser --remove-home $1
+}
+
+# send a mail and wait for delivery
+send_test_mail() { # email_address
+  echo "test mail" | sendmail $1
+  inotifywait -qq -t 3 -e close_write /var/mail
+}
+
+# test header
+test_header() { # text
+  echo "##############################################"
+  echo $1
+  echo "Workdir: $WORKDIR"
+  echo "##############################################"
+}
+
+# Generate a key outside the cert store. The key will not be
+# authenticated.
+gen_key() { # email
+  FILE=$(echo $1 | cut -f 1 -d '@')
+  FPR=$(sq key generate --home none --shared-key --without-password \
+    --email $1 \
+    --output $WORKDIR/${FILE}_sk.pgp \
+    --rev-cert $WORKDIR/${FILE}.rev |& grep "Fingerprint:" | cut -d ':' -f 2)
+  echo $FPR
+}
+
+expect_mail() { # unix_user mode
+  if [ -f /var/mail/$1 ] ; then
+    case $2 in
+      encrypted)
+        if grep -q "BEGIN PGP MESSAGE" /var/mail/$1 ; then
+          R=0
+        else
+          echo "expected encrypted mail for $1" >&2
+          R=1
+        fi
+        ;;
+      unencrypted)
+        if grep -q "BEGIN PGP MESSAGE" /var/mail/$1 ; then
+          echo "expected unencrypted mail for $1" >&2
+          R=1
+        else
+          R=0
+        fi
+        ;;
+      delivered)
+        R=0
+        ;;
+    esac
+  else
+    echo "no mail for $1" >&2
+    R=1
+  fi
+  echo $R
+}

e2e-tests/local_run.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/bash
 
-cargo build --release
+cargo build
 
 docker run -ti \
   --rm \
   --mount type=bind,src=$(pwd),dst=/opt/husk/mapped/ \
-  localhost/mta \
+  localhost/mta:latest \
-  bash -c "/usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh"
+  bash -c "/usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh && bash -i"
 

e2e-tests/runner.sh

@@ -1,21 +1,25 @@
 #!/usr/bin/bash
 
+. /tmp/env.sh
+echo "bin:" $HUSK_BIN
+echo "home:" $SEQUOIA_HOME
+
 cd $(dirname $0)
 
 for TEST in ./tests/* ; do
+  # create a new WORKDIR
+  export WORKDIR=$(mktemp -d)
+
   if bash $TEST ; then
-    echo "success"
+    echo "SUCCESS"
   else
-    echo "failure"
+    echo "FAILURE"
-
-    # post mortem
-    echo "ls -l /var/mail"
-    ls -l /var/mail
-    echo "mailq"
-    mailq
-    echo "host example.com"
-    host example.com
 
+    # post mortem, leave WORKDIR intact for inspection
+    cat /tmp/husk.log
     exit 1
   fi
+
+  # remove WORKDIR
+  rm -rf $WORKDIR
 done

e2e-tests/tests/10_basic.sh

@@ -1,18 +1,15 @@
 #!/usr/bin/bash
 
-echo "Basic: Test if MTA is working"
+# source some functions
+. common.sh
 
-adduser --shell /bin/bash --disabled-password --gecos "" mtatest
+test_header "Basic: Test if MTA is working"
-echo "test mail" | sendmail mtatest@example.com
 
-sleep 1
+create_unix_user mtatest
+send_test_mail mtatest@example.com
 
-if [ -f /var/mail/mtatest ] ; then
+RESULT_CODE=$(expect_mail mtatest delivered)
-  RESULT_CODE=0
-else
-  RESULT_CODE=1 
-fi
 
-deluser --remove-home mtatest
+delete_unix_user mtatest
 
 exit $RESULT_CODE

e2e-tests/tests/20_simple_encrypt.sh

@@ -1,25 +1,16 @@
 #!/usr/bin/bash
 
-echo "Simple: Test encryption for available certificate"
+# source some functions
+. common.sh
+
+test_header "Simple: Test encryption for available certificate"
 
 # There is an authenticated certificate for bob in the cert store
-adduser --shell /bin/bash --disabled-password --gecos "" bob
+create_unix_user bob
-echo "test mail" | sendmail bob@example.com
+send_test_mail bob@example.com
 
-sleep 1
+RESULT_CODE=$(expect_mail bob encrypted)
 
-if [ -f /var/mail/bob ] ; then
+delete_unix_user bob
-  if grep -q "BEGIN PGP MESSAGE" /var/mail/bob ; then
-    RESULT_CODE=0
-  else
-    echo "no encryption detected"
-    RESULT_CODE=1
-  fi
-else
-  echo "no mail detected"
-  RESULT_CODE=1 
-fi
-
-deluser --remove-home bob
 
 exit $RESULT_CODE

e2e-tests/tests/21_simple_not_encrypt.sh

@@ -1,25 +1,16 @@
 #!/usr/bin/bash
 
-echo "Simple: Test encryption for unavailable certificate"
+# source some functions
+. common.sh
+
+test_header "Simple: Test encryption for unavailable certificate"
 
 # There is no authenticated certificate for alice in the cert store
-adduser --shell /bin/bash --disabled-password --gecos "" alice
+create_unix_user alice
-echo "test mail" | sendmail alice@example.com
+send_test_mail alice@example.com
 
-sleep 1
+RESULT_CODE=$(expect_mail alice unencrypted)
 
-if [ -f /var/mail/alice ] ; then
+delete_unix_user alice
-  if grep -q "BEGIN PGP MESSAGE" /var/mail/alice ; then
-    echo "encryption detected - that is wrong"
-    RESULT_CODE=1
-  else
-    RESULT_CODE=0
-  fi
-else
-  echo "no mail detected"
-  RESULT_CODE=1 
-fi
-
-deluser --remove-home alice
 
 exit $RESULT_CODE

e2e-tests/tests/30_fetch.sh

@@ -1,26 +1,17 @@
 #!/usr/bin/bash
 
-echo "Test encryption for certificate an a keyserver"
+# source some functions
+. common.sh
+
+test_header "Test encryption for certificate an a keyserver"
 
 # There is a certificate for carol on the keyserver
 # it's certified by an introducer
-adduser --shell /bin/bash --disabled-password --gecos "" carol
+create_unix_user carol
-echo "test mail" | sendmail carol@example.com
+send_test_mail carol@example.com
 
-sleep 1
+RESULT_CODE=$(expect_mail carol encrypted)
 
-if [ -f /var/mail/carol ] ; then
+delete_unix_user carol
-  if grep -q "BEGIN PGP MESSAGE" /var/mail/carol ; then
-    RESULT_CODE=0
-  else
-    echo "no encryption detected"
-    RESULT_CODE=1
-  fi
-else
-  echo "no mail detected"
-  RESULT_CODE=1 
-fi
-
-deluser --remove-home carol
 
 exit $RESULT_CODE

e2e-tests/tests/40_introducer_create.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+test_header "Add introducer"
+
+ELLEN_FPR=$(sq key generate --shared-key --without-password --name "Ellen" --email "ellen@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+
+cd $HUSK_DIR
+$HUSK_BIN introducer add --cert $ELLEN_FPR --domains "example.org" --config config/config.toml
+$HUSK_BIN introducer list --config config/config.toml
+
+create_unix_user fred
+FRED_FPR=$(sq key generate --shared-key --without-password --name "Fred" --email "fred@example.org" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+sleep 1
+sq pki link retract --cert $FRED_FPR --all
+
+sq pki vouch add --certifier $ELLEN_FPR --cert $FRED_FPR --email "fred@example.org"
+
+send_test_mail fred@example.org
+
+RESULT_CODE=$(expect_mail fred encrypted)
+
+if [ "$RESULT_CODE" == "1" ] ; then
+  exit 1
+fi
+
+test_header "Remove introducer"
+
+$HUSK_BIN introducer remove --cert $ELLEN_FPR --config config/config.toml
+$HUSK_BIN introducer list --config config/config.toml
+
+rm /var/mail/fred
+send_test_mail fred@example.org
+
+RESULT_CODE=$(expect_mail fred unencrypted)
+
+delete_unix_user fred
+
+exit $RESULT_CODE

e2e-tests/tests/41_introducer_load.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+export SEQUOIA_HOME=$(mktemp -d)
+
+test_header "Import introducer from file"
+
+# create ellen
+ELLEN_FPR=$(sq key generate --shared-key --without-password --name "Ellen" --email "ellen@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+sq cert export --cert $ELLEN_FPR > /tmp/ellen_pk.pgp
+
+cd $HUSK_DIR
+$HUSK_BIN introducer add --cert-file /tmp/ellen_pk.pgp --domains example.org --config config/config.toml
+
+LIST=$($HUSK_BIN introducer list --config config/config.toml)
+
+echo $LIST | grep -q 'ellen@example.com'

e2e-tests/tests/50_locals.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+test_header "List locals"
+
+GINA_FPR=$(sq key generate --shared-key --without-password --name "Gina" --email "gina@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+
+cd $HUSK_DIR
+$HUSK_BIN locals list --config config/config.toml | grep $GINA_FPR

e2e-tests/tests/51_add_locals.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+test_header "Add locals"
+
+sq key generate --shared-key --without-password --email 'hubert@example.com' --output /tmp/hubert.pgp --rev-cert /tmp/hubert_rev.pgp
+
+cd $HUSK_DIR
+
+$HUSK_BIN locals add --cert-file /tmp/hubert.pgp --config config/config.toml
+if ! $HUSK_BIN locals list --config config/config.toml | grep -q "hubert@example.com" ; then
+  echo "adding failed"
+  exit 1
+fi
+
+# send a mail, husk should encrypt it
+echo "send mail to hubert@example.com"
+create_unix_user hubert
+send_test_mail hubert@example.com
+
+if [ -f /var/mail/hubert ] ; then
+  if grep -q "BEGIN PGP MESSAGE" /var/mail/hubert ; then
+    RESULT_CODE=0
+  else
+    echo "no encryption detected"
+    delete_unix_user hubert
+    exit 1
+  fi
+  # remove mail
+  rm /var/mail/hubert
+else
+  echo "no mail detected"
+  delete_unix_user hubert
+  exit 1
+fi
+
+sleep 1
+# remove hubert as local
+HUBERT_FPR=$(sq cert list --cert-email hubert@example.com 2>/dev/null | head -n 1 | cut -d ' ' -f 3)
+$HUSK_BIN locals remove --cert $HUBERT_FPR --config config/config.toml
+
+echo "send mail to hubert@example.com"
+send_test_mail hubert@example.com
+
+if [ -f /var/mail/hubert ] ; then
+  if grep -q "BEGIN PGP MESSAGE" /var/mail/hubert ; then
+    echo "encryption detected where there should be none"
+    RESULT_CODE=1
+  else
+    RESULT_CODE=0
+  fi
+else
+  echo "no mail detected"
+  RESULT_CODE=1
+fi
+
+delete_unix_user hubert
+
+exit $RESULT_CODE
+