1package mtastsdb
2
3import (
4 "context"
5 "crypto/ed25519"
6 cryptorand "crypto/rand"
7 "crypto/tls"
8 "crypto/x509"
9 "fmt"
10 "io"
11 golog "log"
12 "math/big"
13 "net"
14 "net/http"
15 "os"
16 "path/filepath"
17 "testing"
18 "testing/synctest"
19 "time"
20
21 "github.com/mjl-/bstore"
22
23 "github.com/mjl-/mox/dns"
24 "github.com/mjl-/mox/mlog"
25 "github.com/mjl-/mox/mox-"
26 "github.com/mjl-/mox/mtasts"
27)
28
29var ctxbg = context.Background()
30
31func TestRefresh(t *testing.T) {
32 mox.Shutdown = ctxbg
33 mox.ConfigStaticPath = filepath.FromSlash("../testdata/mtasts/fake.conf")
34 mox.Conf.Static.DataDir = "."
35
36 dbpath := mox.DataDirPath("mtasts.db")
37 os.MkdirAll(filepath.Dir(dbpath), 0770)
38 os.Remove(dbpath)
39 defer os.Remove(dbpath)
40
41 log := mlog.New("mtastsdb", nil)
42
43 err := Init(false)
44 tcheckf(t, err, "init database")
45 defer func() {
46 err := Close()
47 tcheckf(t, err, "close database")
48 }()
49
50 cert := fakeCert(t, false)
51
52 insert := func(domain string, validEnd, lastUpdate, lastUse time.Time, backoff bool, recordID string, mode mtasts.Mode, maxAge int, mx string) {
53 t.Helper()
54
55 mxd, err := dns.ParseDomain(mx)
56 if err != nil {
57 t.Fatalf("parsing mx domain %q: %s", mx, err)
58 }
59 policy := mtasts.Policy{
60 Version: "STSv1",
61 Mode: mode,
62 MX: []mtasts.MX{{Wildcard: false, Domain: mxd}},
63 MaxAgeSeconds: maxAge,
64 Extensions: nil,
65 }
66
67 pr := PolicyRecord{domain, time.Time{}, validEnd, lastUpdate, lastUse, backoff, recordID, policy, policy.String()}
68 if err := DB.Insert(ctxbg, &pr); err != nil {
69 t.Fatalf("insert policy: %s", err)
70 }
71 }
72
73 resolver := dns.MockResolver{
74 TXT: map[string][]string{
75 "_mta-sts.refresh.mox.example.": {"v=STSv1; id=1"},
76 "_mta-sts.policyok.mox.example.": {"v=STSv1; id=2"},
77 "_mta-sts.policybad.mox.example.": {"v=STSv1; id=2"},
78 },
79 }
80
81 pool := x509.NewCertPool()
82 pool.AddCert(cert.Leaf)
83
84 l, err := net.Listen("tcp", "127.0.0.1:0")
85 tcheckf(t, err, "listen")
86 defer l.Close()
87 go func() {
88 mux := &http.ServeMux{}
89 mux.HandleFunc("/.well-known/mta-sts.txt", func(w http.ResponseWriter, r *http.Request) {
90 if r.Host == "mta-sts.policybad.mox.example" {
91 w.WriteHeader(500)
92 return
93 }
94 fmt.Fprintf(w, "version: STSv1\nmode: enforce\nmx: mx.mox.example.com\nmax_age: 3600\n")
95 })
96 s := &http.Server{
97 Handler: mux,
98 TLSConfig: &tls.Config{
99 Certificates: []tls.Certificate{cert},
100 },
101 ErrorLog: golog.New(io.Discard, "", 0),
102 }
103 s.ServeTLS(l, "", "")
104 }()
105
106 mtasts.HTTPClient.Transport = &http.Transport{
107 DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
108 var dialer net.Dialer
109 return dialer.DialContext(ctx, "tcp", l.Addr().String())
110 },
111 TLSClientConfig: &tls.Config{
112 RootCAs: pool,
113 },
114 }
115 defer func() {
116 mtasts.HTTPClient.CloseIdleConnections()
117 mtasts.HTTPClient.Transport = nil
118 }()
119
120 slept := 0
121 sleep := func(d time.Duration) {
122 slept++
123 interval := 3 * time.Hour / 2
124 if d < time.Duration(slept)*interval-interval/2 || d > time.Duration(slept)*interval+interval/2 {
125 t.Fatalf("bad sleep duration %v", d)
126 }
127 }
128
129 // Run with synctest, to ensure all goroutines that could write results are
130 // finished before we check again if all work is finished.
131 synctest.Test(t, func(t *testing.T) {
132 now := time.Now()
133 // Updated just now.
134 insert("mox.example", now.Add(24*time.Hour), now, now, false, "1", mtasts.ModeEnforce, 3600, "mx.mox.example.com")
135 // To be removed.
136 insert("stale.mox.example", now.Add(-time.Hour), now, now.Add(-181*24*time.Hour), false, "1", mtasts.ModeEnforce, 3600, "mx.mox.example.com")
137 // To be refreshed, same id.
138 insert("refresh.mox.example", now.Add(7*24*time.Hour), now.Add(-24*time.Hour), now.Add(-179*24*time.Hour), false, "1", mtasts.ModeEnforce, 3600, "mx.mox.example.com")
139 // To be refreshed and succeed.
140 insert("policyok.mox.example", now.Add(7*24*time.Hour), now.Add(-24*time.Hour), now.Add(-179*24*time.Hour), false, "1", mtasts.ModeEnforce, 3600, "mx.mox.example.com")
141 // To be refreshed and fail to fetch.
142 insert("policybad.mox.example", now.Add(7*24*time.Hour), now.Add(-24*time.Hour), now.Add(-179*24*time.Hour), false, "1", mtasts.ModeEnforce, 3600, "mx.mox.example.com")
143
144 if n, err := refresh1(ctxbg, log, resolver, sleep); err != nil || n != 3 {
145 t.Fatalf("refresh1: err %s, n %d, expected no error, 3", err, n)
146 }
147
148 if slept != 2 {
149 t.Fatalf("bad sleeps, %d instead of 2", slept)
150 }
151 })
152
153 // Should not do any more refreshes and return immediately.
154 q := bstore.QueryDB[PolicyRecord](ctxbg, DB)
155 q.FilterNonzero(PolicyRecord{Domain: "policybad.mox.example"})
156 if _, err := q.Delete(); err != nil {
157 t.Fatalf("delete record that would be refreshed: %v", err)
158 }
159 mox.Context = ctxbg
160 mox.Shutdown, mox.ShutdownCancel = context.WithCancel(ctxbg)
161 mox.ShutdownCancel()
162 n := refresh()
163 if n != 0 {
164 t.Fatalf("refresh found unexpected work, n %d", n)
165 }
166 mox.Shutdown, mox.ShutdownCancel = context.WithCancel(ctxbg)
167}
168
169func fakeCert(t *testing.T, expired bool) tls.Certificate {
170 notAfter := time.Now()
171 if expired {
172 notAfter = notAfter.Add(-time.Hour)
173 } else {
174 notAfter = notAfter.Add(time.Hour)
175 }
176
177 privKey := ed25519.NewKeyFromSeed(make([]byte, ed25519.SeedSize)) // Fake key, don't use this for real!
178
179 template := &x509.Certificate{
180 SerialNumber: big.NewInt(1), // Required field...
181 DNSNames: []string{"mta-sts.policybad.mox.example", "mta-sts.policyok.mox.example"},
182 NotBefore: time.Date(2000, time.January, 1, 0, 0, 0, 0, time.UTC), // synctest time
183 NotAfter: notAfter,
184 }
185 localCertBuf, err := x509.CreateCertificate(cryptorand.Reader, template, template, privKey.Public(), privKey)
186 if err != nil {
187 t.Fatalf("making certificate: %s", err)
188 }
189 cert, err := x509.ParseCertificate(localCertBuf)
190 if err != nil {
191 t.Fatalf("parsing generated certificate: %s", err)
192 }
193 c := tls.Certificate{
194 Certificate: [][]byte{localCertBuf},
195 PrivateKey: privKey,
196 Leaf: cert,
197 }
198 return c
199}
200