diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 2e5b6aa..ac6f54b 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,41 +1,47 @@ +before_script: + # report CPU info so we can monitor if real KVM becomes available. create /dev/kvm to fool nix + - cat /proc/cpuinfo + - ls -l /dev/kvm || true + - touch /dev/kvm + nixos-intern: image: nixos/nix variables: NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz" script: - - nix-build tests/intern.nix + - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix nixos-extern: image: nixos/nix variables: NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz" script: - - nix-build tests/extern.nix + - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix nixos-clamav: image: nixos/nix variables: NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz" script: - - nix-build tests/clamav.nix + - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix nixos-unstable-intern: image: nixos/nix variables: NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz" script: - - nix-build tests/intern.nix + - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix nixos-unstable-extern: image: nixos/nix variables: NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz" script: - - nix-build tests/extern.nix + - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix nixos-unstable-clamav: image: nixos/nix variables: NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz" script: - - nix-build tests/clamav.nix + - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix diff --git a/mail-server/opendkim.nix b/mail-server/opendkim.nix index d060323..33e2e06 100644 --- a/mail-server/opendkim.nix +++ b/mail-server/opendkim.nix @@ -40,16 +40,6 @@ let fi ''; createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains); - create_dkim_cert = - '' - # Create dkim dir - mkdir -p "${cfg.dkimKeyDirectory}" - chown ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}" - - ${createAllCerts} - - chown -R ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}" - ''; keyTable = pkgs.writeText "opendkim-KeyTable" (lib.concatStringsSep "\n" (lib.flip map cfg.domains @@ -80,11 +70,17 @@ in }; users.users = optionalAttrs (config.services.postfix.user == "postfix") { - postfix.extraGroups = [ "${config.services.opendkim.group}" ]; + postfix.extraGroups = [ "${dkimGroup}" ]; }; systemd.services.opendkim = { - preStart = create_dkim_cert; - serviceConfig.ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}"; + preStart = lib.mkForce createAllCerts; + serviceConfig = { + ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}"; + PermissionsStartOnly = lib.mkForce false; + }; }; + systemd.tmpfiles.rules = [ + "d '${cfg.dkimKeyDirectory}' - ${dkimUser} ${dkimGroup} - -" + ]; }; -} \ No newline at end of file +} diff --git a/mail-server/rspamd.nix b/mail-server/rspamd.nix index 0174e41..b46b7de 100644 --- a/mail-server/rspamd.nix +++ b/mail-server/rspamd.nix @@ -27,19 +27,22 @@ in config = with cfg; lib.mkIf enable { services.rspamd = { enable = true; - extraConfig = '' - extended_spam_headers = yes; - '' + (lib.optionalString cfg.virusScanning '' - antivirus { - clamav { - action = "reject"; - symbol = "CLAM_VIRUS"; - type = "clamav"; - log_clean = true; - servers = "/run/clamav/clamd.ctl"; - } - } - ''); + inherit debug; + locals = { + "milter_headers.conf" = { text = '' + extended_spam_headers = yes; + ''; }; + "antivirus.conf" = lib.mkIf cfg.virusScanning { text = '' + clamav { + action = "reject"; + symbol = "CLAM_VIRUS"; + type = "clamav"; + log_clean = true; + servers = "/run/clamav/clamd.ctl"; + scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all + } + ''; }; + }; overrides = { "milter_headers.conf" = { diff --git a/tests/clamav.nix b/tests/clamav.nix index 7c81b2d..434b196 100644 --- a/tests/clamav.nix +++ b/tests/clamav.nix @@ -34,6 +34,7 @@ import { { imports = [ ../default.nix + ./lib/config.nix ]; virtualisation.memorySize = 1500; @@ -103,6 +104,10 @@ import { exec grep '${clientIP}' "$@" ''; in { + imports = [ + ./lib/config.nix + ]; + environment.systemPackages = with pkgs; [ fetchmail msmtp procmail findutils grep-ip ]; @@ -120,10 +125,15 @@ import { }; "root/.msmtprc" = { text = '' - account test2 + defaults + tls on + tls_certcheck off + + account user2 host ${serverIP} port 587 from user@example2.com + auth on user user@example2.com password user2 ''; @@ -164,7 +174,7 @@ import { X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* --Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607-- ''; - "root/email2".text = '' + "root/safe-email".text = '' From: User To: User1 Cc: @@ -182,13 +192,17 @@ import { }; }; - testScript = + testScript = { nodes, ... }: '' startAll; $server->waitForUnit("multi-user.target"); $client->waitForUnit("multi-user.target"); + # TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket. + $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]"); + $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ \$? -eq 124 ]"); + $client->execute("cp -p /etc/root/.* ~/"); $client->succeed("mkdir -p ~/mail"); $client->succeed("ls -la ~/ >&2"); @@ -201,7 +215,7 @@ import { # Verify that mail can be sent and received before testing virus scanner $client->execute("rm ~/mail/*"); - $client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2"); + $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/safe-email >&2"); # give the mail server some time to process the mail $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]'); $client->execute("rm ~/mail/*"); @@ -209,13 +223,12 @@ import { $client->succeed("fetchmail -v >&2"); $client->execute("rm ~/mail/*"); - subtest "virus scan file", sub { - $server->fail("clamscan --follow-file-symlinks=2 -r /etc/root/ >&2"); + $server->succeed("clamdscan \$(readlink -f /etc/root/eicar.com.txt) | grep \"Txt\\.Malware\\.Agent-1787597 FOUND\" >&2"); }; - subtest "virus scanner", sub { - $client->fail("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/virus-email >&2"); + subtest "virus scan email", sub { + $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | grep \"server message: 554 5\\.7\\.1 clamav: virus found: .*\\(Eicar\\|EICAR\\)\" >&2"); # for some reason this ID is nondetermistic... # give the mail server some time to process the mail $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]'); }; diff --git a/tests/extern.nix b/tests/extern.nix index 0816d91..78a5266 100644 --- a/tests/extern.nix +++ b/tests/extern.nix @@ -21,6 +21,7 @@ import { { imports = [ ../default.nix + ./lib/config.nix ]; services.rsyslogd = { @@ -134,6 +135,9 @@ import { imap.close() ''; in { + imports = [ + ./lib/config.nix + ]; environment.systemPackages = with pkgs; [ fetchmail msmtp procmail findutils grep-ip check-mail-id test-imap-spam test-imap-ham ]; @@ -271,13 +275,16 @@ import { }; }; - testScript = + testScript = { nodes, ... }: '' startAll; $server->waitForUnit("multi-user.target"); $client->waitForUnit("multi-user.target"); + # TODO put this blocking into the systemd units? + $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]"); + $client->execute("cp -p /etc/root/.* ~/"); $client->succeed("mkdir -p ~/mail"); $client->succeed("ls -la ~/ >&2"); diff --git a/tests/intern.nix b/tests/intern.nix index ce50123..5abf379 100644 --- a/tests/intern.nix +++ b/tests/intern.nix @@ -21,6 +21,7 @@ import { { imports = [ ./../default.nix + ./lib/config.nix ]; mailserver = { diff --git a/tests/lib/config.nix b/tests/lib/config.nix new file mode 100644 index 0000000..b247c66 --- /dev/null +++ b/tests/lib/config.nix @@ -0,0 +1,11 @@ +{ + security.dhparams.defaultBitSize = 16; # really low for quicker tests + + # For slow non-kvm tests. + # nixos/modules/testing/test-instrumentation.nix also sets this. I don't know if there's a better way than etc to override theirs. + environment.etc."systemd/system.conf.d/bigdefaulttimeout.conf".text = '' + [Manager] + # Allow extremely slow start (default for test-VMs is 5 minutes) + DefaultTimeoutStartSec=15min + ''; +} diff --git a/tests/lib/pkgs.nokvm.nix b/tests/lib/pkgs.nokvm.nix new file mode 100644 index 0000000..fa13fde --- /dev/null +++ b/tests/lib/pkgs.nokvm.nix @@ -0,0 +1,31 @@ +let + pkgs = (import { system = builtins.currentSystem; config = {}; }); + patchedMachinePM = pkgs.writeTextFile { + name = "Machine.pm.patched-to-wait-longer-for-vm"; + text = builtins.replaceStrings ["alarm 600;"] ["alarm 1200;"] (builtins.readFile (+"/nixos/lib/test-driver/Machine.pm")); + }; +in +(pkgs // { + qemu_test = with pkgs; stdenv.mkDerivation { + name = "qemu_test_no_kvm"; + buildInputs = [ coreutils qemu_test ]; + inherit qemu_test; + inherit coreutils; + builder = builtins.toFile "builder.sh" '' + PATH=$coreutils/bin:$PATH + mkdir -p $out/bin + cp $qemu_test/bin/* $out/bin/ + ln -sf $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm + ''; + }; + stdenv = pkgs.stdenv // { + mkDerivation = args: (pkgs.stdenv.mkDerivation (args // ( + pkgs.lib.optionalAttrs (args.name == "nixos-test-driver") { + installPhase = args.installPhase + '' + rm $libDir/Machine.pm + cp ${patchedMachinePM} $libDir/Machine.pm + ''; + } + ))); + }; +})