mixandClaude Opus 5.5
50fd6b859f
internal/notify applies the owner's rules. Each subject has a row of state, so a thing is said once and a restart says nothing again: - DNS of a sending domain: said after two hourly checks in a row found a record wrong, said to be over after two found it right. A lookup that did not answer moves nothing; a warning (no DMARC record) is not a subject. - TLS certificate: at 14 days and at 3, per certificate. - Queue: a message older than three days, once; once more when none is. - Level-2 limit: from the rejected rows of the send log, every five minutes; at most once a day per domain and application. Global users are told everything, domain users about their domains; one message per recipient. With the instance switch off nothing is checked and no state moves. A message that could not be handed to Postfix is tried again at the next check. Mail leaves by sendmail(1) as postmaster@<hostname>, addresses after "--", no shell. For it to be believed the server's own name is signed like a sending domain: domain.Service keeps a key for it and a line in OpenDKIM's tables without a registry row, and non_smtpd_milters now names OpenDKIM. A sending domain of the same name shares its key with the server. dnscheck.ServerMail checks the name's DKIM and SPF records; postfix.QueueMessages reads postqueue -j for arrival times. The notifier is a sixth role of the panel process. Nothing in the panel shows or switches it yet. Checked on Windows: go vet clean; go test passes for notify, store, postfix, dnscheck, cmd, and domain apart from TestWriteLoadPrivateKeyRoundtrip, which fails there on file modes and always did. Not yet run in a container: whether the unprivileged panel may submit is for the e2e step. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
83 lines
2.6 KiB
Go
83 lines
2.6 KiB
Go
package dnscheck
|
|
|
|
import (
|
|
"net"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/mixeme/selfpost/internal/health"
|
|
)
|
|
|
|
const serverDKIM = "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAserverkey"
|
|
|
|
func serverMailQuery() Query {
|
|
return Query{
|
|
Name: "mail.example.org",
|
|
Selector: "sp",
|
|
ExpectedDKIM: serverDKIM,
|
|
Hostname: "mail.example.org",
|
|
ServerIPs: []string{"203.0.113.25"},
|
|
}
|
|
}
|
|
|
|
// The server's own name passes with its key published and "v=spf1 a -all":
|
|
// the name's address record is this server.
|
|
func TestServerMailPublished(t *testing.T) {
|
|
f := &fakeResolver{
|
|
txt: map[string][]string{
|
|
"sp._domainkey.mail.example.org": {serverDKIM},
|
|
"mail.example.org": {ServerMailSPF},
|
|
},
|
|
addr: map[string][]net.IPAddr{"mail.example.org": ipAddrs("203.0.113.25")},
|
|
}
|
|
c := newTestChecker(f)
|
|
|
|
m := c.ServerMail(serverMailQuery(), false)
|
|
if m.DKIM.Status != health.StatusOK || m.SPF.Status != health.StatusOK || m.Overall != health.StatusOK {
|
|
t.Fatalf("DKIM %s (%s), SPF %s (%s), overall %s", m.DKIM.Status, m.DKIM.Detail, m.SPF.Status, m.SPF.Detail, m.Overall)
|
|
}
|
|
|
|
// Cached like a domain, and re-read when forced.
|
|
before := f.lookups
|
|
c.ServerMail(serverMailQuery(), false)
|
|
if f.lookups != before {
|
|
t.Errorf("a second reading looked DNS up again (%d lookups)", f.lookups-before)
|
|
}
|
|
c.ServerMail(serverMailQuery(), true)
|
|
if f.lookups == before {
|
|
t.Error("a forced reading used the cache")
|
|
}
|
|
}
|
|
|
|
// With nothing published both records are errors, and the SPF advice names the
|
|
// record for a server's own name, not the one for a sending domain.
|
|
func TestServerMailMissing(t *testing.T) {
|
|
c := newTestChecker(&fakeResolver{})
|
|
|
|
m := c.ServerMail(serverMailQuery(), false)
|
|
if m.DKIM.Status != health.StatusError || m.SPF.Status != health.StatusError || m.Overall != health.StatusError {
|
|
t.Fatalf("DKIM %s, SPF %s, overall %s; want errors", m.DKIM.Status, m.SPF.Status, m.Overall)
|
|
}
|
|
if !strings.Contains(m.SPF.Detail, ServerMailSPF) || strings.Contains(m.SPF.Detail, "a:mail.example.org") {
|
|
t.Errorf("SPF advice: %s", m.SPF.Detail)
|
|
}
|
|
}
|
|
|
|
// A sending domain of the same name does not share the cache entry.
|
|
func TestServerMailCacheIsItsOwn(t *testing.T) {
|
|
f := &fakeResolver{
|
|
txt: map[string][]string{
|
|
"sp._domainkey.mail.example.org": {serverDKIM},
|
|
"mail.example.org": {ServerMailSPF},
|
|
},
|
|
addr: map[string][]net.IPAddr{"mail.example.org": ipAddrs("203.0.113.25")},
|
|
}
|
|
c := newTestChecker(f)
|
|
c.Domain(serverMailQuery(), false)
|
|
before := f.lookups
|
|
c.ServerMail(serverMailQuery(), false)
|
|
if f.lookups == before {
|
|
t.Error("the server's mail check was answered from the domain's cache entry")
|
|
}
|
|
}
|