nixos/tests/parsedmarc/default.nix

   1 # This tests parsedmarc by sending a report to its monitored email
   2 # address and reading the results out of Elasticsearch.
   3
   4 { pkgs, ... }@args:
   5 let
   6   inherit (import ../../lib/testing-python.nix args) makeTest;
   7   inherit (pkgs) lib;
   8
   9   dmarcTestReport = builtins.fetchurl {
  10     name = "dmarc-test-report";
  11     url = "https://github.com/domainaware/parsedmarc/raw/f45ab94e0608088e0433557608d9f4e9517d3afe/samples/aggregate/estadocuenta1.infonacot.gob.mx!example.com!1536853302!1536939702!2940.xml.zip";
  12     sha256 = "0dq64cj49711kbja27pjl2hy0d3azrjxg91kqrh40x46fkn1dwkx";
  13   };
  14
  15   sendEmail = address:
  16     pkgs.writeScriptBin "send-email" ''
  17       #!${pkgs.python3.interpreter}
  18       import smtplib
  19       from email import encoders
  20       from email.mime.base import MIMEBase
  21       from email.mime.multipart import MIMEMultipart
  22       from email.mime.text import MIMEText
  23
  24       sender_email = "dmarc_tester@fake.domain"
  25       receiver_email = "${address}"
  26
  27       message = MIMEMultipart()
  28       message["From"] = sender_email
  29       message["To"] = receiver_email
  30       message["Subject"] = "DMARC test"
  31
  32       message.attach(MIMEText("Testing parsedmarc", "plain"))
  33
  34       attachment = MIMEBase("application", "zip")
  35
  36       with open("${dmarcTestReport}", "rb") as report:
  37           attachment.set_payload(report.read())
  38
  39       encoders.encode_base64(attachment)
  40
  41       attachment.add_header(
  42           "Content-Disposition",
  43           "attachment; filename= estadocuenta1.infonacot.gob.mx!example.com!1536853302!1536939702!2940.xml.zip",
  44       )
  45
  46       message.attach(attachment)
  47       text = message.as_string()
  48
  49       with smtplib.SMTP('localhost') as server:
  50           server.sendmail(sender_email, receiver_email, text)
  51           server.quit()
  52     '';
  53 in
  54 {
  55   localMail = makeTest
  56     {
  57       name = "parsedmarc-local-mail";
  58       meta = with lib.maintainers; {
  59         maintainers = [ talyz ];
  60       };
  61
  62       nodes.parsedmarc =
  63         { nodes, ... }:
  64         {
  65           virtualisation.memorySize = 2048;
  66
  67           services.postfix = {
  68             enableSubmission = true;
  69             enableSubmissions = true;
  70             submissionsOptions = {
  71               smtpd_sasl_auth_enable = "yes";
  72               smtpd_client_restrictions = "permit";
  73             };
  74           };
  75
  76           services.parsedmarc = {
  77             enable = true;
  78             provision = {
  79               geoIp = false;
  80               localMail = {
  81                 enable = true;
  82                 hostname = "localhost";
  83               };
  84             };
  85           };
  86
  87           environment.systemPackages = [
  88             (sendEmail "dmarc@localhost")
  89             pkgs.jq
  90           ];
  91         };
  92
  93       testScript = { nodes }:
  94         let
  95           esPort = toString nodes.parsedmarc.config.services.elasticsearch.port;
  96           valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.config.services.elasticsearch.package.version "7") ".value";
  97         in ''
  98           parsedmarc.start()
  99           parsedmarc.wait_for_unit("postfix.service")
 100           parsedmarc.wait_for_unit("dovecot2.service")
 101           parsedmarc.wait_for_unit("parsedmarc.service")
 102           parsedmarc.wait_until_succeeds(
 103               "curl -sS -f http://localhost:${esPort}"
 104           )
 105
 106           parsedmarc.fail(
 107               "curl -sS -f http://localhost:${esPort}/_search?q=report_id:2940"
 108               + " | tee /dev/console"
 109               + " | jq -es 'if . == [] then null else .[] | .hits.total${valueObject} > 0 end'"
 110           )
 111           parsedmarc.succeed("send-email")
 112           parsedmarc.wait_until_succeeds(
 113               "curl -sS -f http://localhost:${esPort}/_search?q=report_id:2940"
 114               + " | tee /dev/console"
 115               + " | jq -es 'if . == [] then null else .[] | .hits.total${valueObject} > 0 end'"
 116           )
 117         '';
 118     };
 119
 120   externalMail =
 121     let
 122       certs = import ../common/acme/server/snakeoil-certs.nix;
 123       mailDomain = certs.domain;
 124       parsedmarcDomain = "parsedmarc.fake.domain";
 125     in
 126       makeTest {
 127         name = "parsedmarc-external-mail";
 128         meta = with lib.maintainers; {
 129           maintainers = [ talyz ];
 130         };
 131
 132         nodes = {
 133           parsedmarc =
 134             { nodes, ... }:
 135             {
 136               virtualisation.memorySize = 2048;
 137
 138               security.pki.certificateFiles = [
 139                 certs.ca.cert
 140               ];
 141
 142               networking.extraHosts = ''
 143                 127.0.0.1 ${parsedmarcDomain}
 144                 ${nodes.mail.config.networking.primaryIPAddress} ${mailDomain}
 145               '';
 146
 147               services.parsedmarc = {
 148                 enable = true;
 149                 provision.geoIp = false;
 150                 settings.imap = {
 151                   host = mailDomain;
 152                   port = 993;
 153                   ssl = true;
 154                   user = "alice";
 155                   password = "${pkgs.writeText "imap-password" "foobar"}";
 156                 };
 157               };
 158
 159               environment.systemPackages = [
 160                 pkgs.jq
 161               ];
 162             };
 163
 164           mail =
 165             { nodes, ... }:
 166             {
 167               imports = [ ../common/user-account.nix ];
 168
 169               networking.extraHosts = ''
 170                 127.0.0.1 ${mailDomain}
 171                 ${nodes.parsedmarc.config.networking.primaryIPAddress} ${parsedmarcDomain}
 172               '';
 173
 174               services.dovecot2 = {
 175                 enable = true;
 176                 protocols = [ "imap" ];
 177                 sslCACert = "${certs.ca.cert}";
 178                 sslServerCert = "${certs.${mailDomain}.cert}";
 179                 sslServerKey = "${certs.${mailDomain}.key}";
 180               };
 181
 182               services.postfix = {
 183                 enable = true;
 184                 origin = mailDomain;
 185                 config = {
 186                   myhostname = mailDomain;
 187                   mydestination = mailDomain;
 188                 };
 189                 enableSubmission = true;
 190                 enableSubmissions = true;
 191                 submissionsOptions = {
 192                   smtpd_sasl_auth_enable = "yes";
 193                   smtpd_client_restrictions = "permit";
 194                 };
 195               };
 196               environment.systemPackages = [ (sendEmail "alice@${mailDomain}") ];
 197
 198               networking.firewall.allowedTCPPorts = [ 993 ];
 199             };
 200         };
 201
 202         testScript = { nodes }:
 203           let
 204             esPort = toString nodes.parsedmarc.config.services.elasticsearch.port;
 205             valueObject = lib.optionalString (lib.versionAtLeast nodes.parsedmarc.config.services.elasticsearch.package.version "7") ".value";
 206           in ''
 207             mail.start()
 208             mail.wait_for_unit("postfix.service")
 209             mail.wait_for_unit("dovecot2.service")
 210
 211             parsedmarc.start()
 212             parsedmarc.wait_for_unit("parsedmarc.service")
 213             parsedmarc.wait_until_succeeds(
 214                 "curl -sS -f http://localhost:${esPort}"
 215             )
 216
 217             parsedmarc.fail(
 218                 "curl -sS -f http://localhost:${esPort}/_search?q=report_id:2940"
 219                 + " | tee /dev/console"
 220                 + " | jq -es 'if . == [] then null else .[] | .hits.total${valueObject} > 0 end'"
 221             )
 222             mail.succeed("send-email")
 223             parsedmarc.wait_until_succeeds(
 224                 "curl -sS -f http://localhost:${esPort}/_search?q=report_id:2940"
 225                 + " | tee /dev/console"
 226                 + " | jq -es 'if . == [] then null else .[] | .hits.total${valueObject} > 0 end'"
 227             )
 228           '';
 229       };
 230 }