mixandClaude Opus 5.5
599149bf83
Comments only, no behaviour changed. Each main.cf/master.cf parameter the
build sets, the wrapper's and the reload hook's reliance on Postfix 3.7.11
(postfix-script, master.5, postconf.5, cleanup_init.c, smtpd_peer.c,
README_FILES), supervisor 4.2.5 (process.py, options.py, events.rst),
logrotate 3.21.0, OpenDKIM's config, Cyrus SASL's sasldb, rspamd 3.11.1
(milter_headers.lua, multimap, the map watcher), Docker Compose, CoreDNS
and certbot now say where that is written. Measurements already there stay
measurements ("date not recorded" where none was); hand-composed fixtures
say so.
Contradictions left for their own commits: C-P31 cleanup's size limit,
C-P42 master outside supervisor's signal, C-V5/V6 startsecs, C-V10,
C-S3/Q3 sasldb written in place, C-Q4/A1 certbot's symlinks, C-R7 rspamd
skips local clients but the signature routine does not, C-P8, C-R4, C-R12,
C-M7, C-E2, C-K8/K9, C-D1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
89 lines
3.1 KiB
Go
89 lines
3.1 KiB
Go
package e2e
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"regexp"
|
|
"time"
|
|
|
|
"github.com/emersion/go-msgauth/dkim"
|
|
)
|
|
|
|
// findSinkMessage polls the sink-MX's dump directory (see test/e2e/sink) for
|
|
// a file whose contents contain token — the unique Subject-line marker every
|
|
// test send carries — and returns it. Polling a directory listing rather than
|
|
// sleeping a fixed duration is what keeps this deterministic even under a
|
|
// slow CI runner (plan C.4).
|
|
func findSinkMessage(stageDir, token string, timeout time.Duration) ([]byte, error) {
|
|
dir := filepath.Join(stageDir, "mail-stage")
|
|
var found []byte
|
|
err := waitFor(fmt.Sprintf("sink-MX to receive a message tagged %q", token), timeout, 300*time.Millisecond, func() (bool, error) {
|
|
entries, err := os.ReadDir(dir)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
for _, e := range entries {
|
|
if e.IsDir() {
|
|
continue
|
|
}
|
|
b, err := os.ReadFile(filepath.Join(dir, e.Name()))
|
|
if err != nil {
|
|
continue
|
|
}
|
|
if bytes.Contains(b, []byte(token)) {
|
|
found = b
|
|
return true, nil
|
|
}
|
|
}
|
|
return false, fmt.Errorf("no dumped message contains %q yet (%d on disk)", token, len(entries))
|
|
})
|
|
return found, err
|
|
}
|
|
|
|
// verifyDKIM checks that raw (a message dumped by the sink) carries a DKIM
|
|
// signature for domain that validates against the public key published in the
|
|
// fake zone — i.e. exactly what a real receiver would check, using DNS the
|
|
// harness itself controls instead of net.DefaultResolver (plan C.4).
|
|
func verifyDKIM(raw []byte, domain string) error {
|
|
verifications, err := dkim.VerifyWithOptions(bytes.NewReader(raw), &dkim.VerifyOptions{
|
|
LookupTXT: lookupTXTFunc(),
|
|
})
|
|
if err != nil {
|
|
return fmt.Errorf("dkim verify: %w", err)
|
|
}
|
|
for _, v := range verifications {
|
|
if v.Domain == domain {
|
|
if v.Err != nil {
|
|
return fmt.Errorf("dkim signature for %s did not validate: %w", domain, v.Err)
|
|
}
|
|
return nil
|
|
}
|
|
}
|
|
return fmt.Errorf("no DKIM signature found for domain %s (got %d signature(s))", domain, len(verifications))
|
|
}
|
|
|
|
// connectFromPattern matches Postfix's smtpd "connect from ...[ADDR]" log
|
|
// line, which is how the harness learns the source address Postfix itself
|
|
// observed for a just-made connection (needed to configure a level-2 rate
|
|
// limit's allowed-IPs list — the address a host-published port is seen as
|
|
// inside the container depends on Docker's NAT and isn't worth hard-coding).
|
|
// Postfix 3.7.11, src/smtpd/smtpd.c, smtpd_service(): msg_info("connect from
|
|
// %s", namaddr), namaddr being "name[addr]".
|
|
var connectFromPattern = regexp.MustCompile(`connect from [^\[]*\[([0-9a-fA-F.:]+)\]`)
|
|
|
|
// lastSMTPClientIP reads mail.log inside the selfpost container and returns
|
|
// the most recent address Postfix's smtpd logged a connection from.
|
|
func lastSMTPClientIP(s *stack) (string, error) {
|
|
out, err := s.execIn("selfpost", "tail", "-n", "200", "/data/log/mail.log")
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
matches := connectFromPattern.FindAllStringSubmatch(out, -1)
|
|
if len(matches) == 0 {
|
|
return "", fmt.Errorf("no \"connect from\" line in mail.log yet")
|
|
}
|
|
return matches[len(matches)-1][1], nil
|
|
}
|