mixandClaude Opus 5.5
006bed7022
test / test (push) Canceled after 0s
M14, M15: queryEach gives each resolver 2 s within the check's context and asks the one that answered last first; an address or PTR lookup not answered is Unknown, an answered mismatch beside it still an error; Checker.Server keeps the last answer's addresses, so SPF does not go Unknown with it. Notifications report faults only, now tested with SPF unknown alone and beside a wrong DKIM. DMARC reports: tests of malformed XML, gzip and zip bombs, a message over the limit, the service's Resync, hosted suggestion and validation. The finding: both limits cut silently and an oversized report failed as damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into IngestMessage). healthReadings replaces map[string]any for Health and Overview. L5: an inbound upstream has one TLS mode - a second domain to the same [host]:port with another mode is refused, naming the first; the TLS policy map holds each next hop once. Tested on the test server: go vet + go test of 25 packages, make e2e (all pass, 631 s) on this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
54 lines
1.6 KiB
Go
54 lines
1.6 KiB
Go
package inbound
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/mixeme/selfpost/internal/postfix"
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
type nullMaps struct{}
|
|
|
|
func (nullMaps) RebuildInboundMaps([]postfix.InboundRoute) error { return nil }
|
|
|
|
// An upstream has one TLS mode, since Postfix keys the policy by the next
|
|
// hop: a second domain saved to the same [host]:port with another mode is
|
|
// refused with the first domain's name and mode; the same mode is fine
|
|
// (audit 2026-10-12, L5).
|
|
func TestOneTLSModePerUpstream(t *testing.T) {
|
|
st, err := store.Open(t.TempDir() + "/test.db")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer st.Close()
|
|
s := NewService(st, nullMaps{})
|
|
a, err := s.Add("a.example")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
b, err := s.Add("b.example")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.SetTransport(a.ID, "10.0.0.8", "25", "encrypt"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err = s.SetTransport(b.ID, "[10.0.0.8]", "25", "may")
|
|
var verr *ValidationError
|
|
if !errors.As(err, &verr) || !strings.Contains(err.Error(), "[10.0.0.8]:25 is already the upstream of a.example, with TLS mode encrypt") {
|
|
t.Fatalf("a second mode for one upstream = %v", err)
|
|
}
|
|
if err := s.SetTransport(b.ID, "10.0.0.8", "25", "encrypt"); err != nil {
|
|
t.Errorf("the same mode refused: %v", err)
|
|
}
|
|
if err := s.SetTransport(b.ID, "10.0.0.8", "2525", "may"); err != nil {
|
|
t.Errorf("another port refused: %v", err)
|
|
}
|
|
// The domain itself may change its own mode.
|
|
if err := s.SetTransport(a.ID, "10.0.0.8", "25", "may"); err != nil {
|
|
t.Errorf("a domain changing its own mode refused: %v", err)
|
|
}
|
|
}
|