mixandClaude Opus 5.5
6b4106f60e
Owner, 2026-10-18: "Оба предложения делаем"; the mockup is c10cd78. The
security audit's M7: Required is Postfix's encrypt level, which checks no
certificate - it keeps the mail from a listener, not from one who answers
in the upstream's place.
- A fourth TLS mode, Verified, stored as Postfix's level secure (migration
0014 rebuilds inbound_transports with the wider CHECK; schema 14) and
written to the TLS policy map like the others. Postfix matches the
certificate against the next hop's name (smtp_tls_secure_cert_match =
nexthop, dot-nexthop, the default; postconf(5)), so Verified is refused
for an upstream given by address (checkSecureHost).
- Postfix's SMTP client trusts Debian's ca-certificates bundle
(smtp_tls_CAfile): Postfix trusts none by default (DEF_SMTP_TLS_CA_FILE
"", DEF_TLS_APPEND_DEF_CA 0). The levels may and encrypt only log the
verdict, so mail to recipients' MX is unchanged.
- The page: the select's fourth option, a help line under it, the lead
"over verified TLS", the list's tag "verified"; Help word for word with
the mockup; guide § Inbound relay, with a posttls-finger command to try
an upstream first.
Tests: TestVerifiedTLSNeedsTheUpstreamsName, TestRenderInboundMapsSecure,
TestUpstreamTLSModeSecure; schema tests at 14. e2e
inbound_upstream_verified_tls: an address refused, a name saved as
"[sink]:25 secure" in tls_policy, the page says verified, the CA file set
and present, and posttls-finger -l secure with it calls the stand's
self-signed port 25 "Untrusted" (the stand has no TLS upstream). make e2e
(65 passed) and go vet + go test (26 packages) on the test server for this
tree. Tried against the live upstream from the 2.14.5 container:
mc-ent.mixfed.ru gives "Verified TLS connection established".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
3.2 KiB
Go
69 lines
3.2 KiB
Go
package e2e
|
|
|
|
import (
|
|
"net/url"
|
|
"regexp"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// verifiedDomain is an inbound domain of its own for Verified TLS, so that its
|
|
// upstream - a next hop with a TLS mode of its own - touches no other step.
|
|
const verifiedDomain = "verified.e2e.test"
|
|
|
|
// testVerifiedUpstreamTLS is upstream-tls-verify (owner, 2026-10-18): the
|
|
// panel saves Verified TLS for an upstream given by name and writes Postfix's
|
|
// secure level for it, refuses it for one given by address, and Postfix's
|
|
// client trusts Debian's authorities and so refuses a certificate none of
|
|
// them issued. The stand has no upstream that speaks TLS (smtp-sink does
|
|
// not), so the last is asked of posttls-finger - Postfix's own TLS client,
|
|
// with the client's CA file - against the stand's own port 25, whose
|
|
// certificate is self-signed: "Untrusted", never "Verified" (Postfix 3.10.13,
|
|
// src/tls/tls_misc.c:1252, the summary line's first word).
|
|
func testVerifiedUpstreamTLS(t *testing.T, sc *scenario) {
|
|
resp, body, err := sc.panel.postForm("/inbound/domains", url.Values{"name": {verifiedDomain}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
m := regexp.MustCompile(`^/inbound/domains/(\d+)$`).FindStringSubmatch(resp.Request.URL.Path)
|
|
if m == nil {
|
|
t.Fatalf("add %s: landed on %s:\n%.800s", verifiedDomain, resp.Request.URL.Path, body)
|
|
}
|
|
base := "/inbound/domains/" + m[1]
|
|
defer sc.panel.postForm(base+"/delete", url.Values{})
|
|
|
|
// By address: refused, nothing saved.
|
|
resp, body, err = sc.panel.postForm(base+"/upstream", url.Values{"host": {"10.77.0.11"}, "port": {"25"}, "tls_mode": {"secure"}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if resp.StatusCode != 400 || !strings.Contains(body, "give the upstream by name") {
|
|
t.Fatalf("Verified TLS to an address: status %d:\n%.800s", resp.StatusCode, body)
|
|
}
|
|
// By name: saved, and the policy map says secure for that next hop.
|
|
resp, body, err = sc.panel.postForm(base+"/upstream", url.Values{"host": {"sink"}, "port": {"25"}, "tls_mode": {"secure"}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if resp.StatusCode != 200 || resp.Request.URL.Path != base {
|
|
t.Fatalf("Verified TLS to a name: status %d, landed on %s:\n%.800s", resp.StatusCode, resp.Request.URL.Path, body)
|
|
}
|
|
if out, err := h.execIn("selfpost", "cat", "/data/postfix/tls_policy"); err != nil || !strings.Contains(out, "[sink]:25 secure\n") {
|
|
t.Errorf("tls_policy has no secure line for [sink]:25 (%v):\n%s", err, out)
|
|
}
|
|
if _, page, err := sc.panel.get(base); err != nil || !strings.Contains(page, "over verified TLS") {
|
|
t.Errorf("the domain's page does not say verified TLS (%v)", err)
|
|
}
|
|
|
|
// The client's trust: the bundle is set and there, and a self-signed
|
|
// certificate is not trusted with it.
|
|
out, err := h.execIn("selfpost", "sh", "-c", `f=$(postconf -h smtp_tls_CAfile) && echo "$f" && test -s "$f" && echo present`)
|
|
if err != nil || !strings.Contains(out, "/etc/ssl/certs/ca-certificates.crt\npresent") {
|
|
t.Fatalf("smtp_tls_CAfile (%v):\n%s", err, out)
|
|
}
|
|
out, _ = h.execIn("selfpost", "posttls-finger", "-c", "-l", "secure", "-F", "/etc/ssl/certs/ca-certificates.crt", "[127.0.0.1]:25")
|
|
if !strings.Contains(out, "Untrusted TLS connection established") || strings.Contains(out, "Verified TLS connection") {
|
|
t.Errorf("posttls-finger -l secure against the stand's self-signed port 25:\n%s", out)
|
|
}
|
|
}
|