Skip to content

Commit

Permalink
test/t-21-dkim: Add cross-tool check against driusan/dkimverify
Browse files Browse the repository at this point in the history
This patch adds a cross-tool integration check that uses
driusan/dkim's dkimverify to confirm it can verify our own DKIM signatures.

It is optional, since the tool may not be present.
  • Loading branch information
albertito committed Mar 10, 2024
1 parent bdbc269 commit 9b75247
Show file tree
Hide file tree
Showing 5 changed files with 44 additions and 4 deletions.
7 changes: 7 additions & 0 deletions cmd/chasquid-util/dkim.go
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,13 @@ func dkimVerify() {
})
}

if txt, ok := args["--txt"]; ok {
ctx = dkim.WithLookupTXTFunc(ctx,
func(ctx context.Context, domain string) ([]string, error) {
return []string{txt}, nil
})
}

results, err := dkim.VerifyMessage(ctx, string(msg))
if err != nil {
Fatalf("Error verifying message: %v", err)
Expand Down
8 changes: 7 additions & 1 deletion test/t-21-dkim/from_B_to_A.expected
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,18 @@ From user-a@srv-a
Authentication-Results: srv-a
;spf=none (no DNS record found)
;dkim=pass header.b=*
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=srv-b; s=sel77; *
h=from:subject:to:from:subject:date:to:cc:message-id;
bh=*
b=*
*
*
*
*
*
*
*
From: user-b@srv-b
To: user-a@srv-a
Subject: Feliz primavera!
Expand Down
21 changes: 20 additions & 1 deletion test/t-21-dkim/run.sh
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ export GOTAGS="dnsoverride"
# Use a fixed selector so we can be more thorough in from_B_to_A.expected.
rm -f B/domains/srv-b/*.pem
mkdir -p B/domains/srv-b/
CONFDIR=B chasquid-util dkim-keygen srv-b sel77 --algo=ed25519 > /dev/null
CONFDIR=B chasquid-util dkim-keygen srv-b sel77 > /dev/null

cp zones .zones
CONFDIR=B chasquid-util dkim-dns srv-b | sed 's/"//g' >> .zones
Expand Down Expand Up @@ -65,5 +65,24 @@ smtpc --addr=localhost:2465 \
wait_for_file .mail/user-a@srv-a
mail_diff from_B_to_A.expected .mail/user-a@srv-a

# Run chasquid-util dkim-verify to double check these are valid.
cat .zones | grep _domainkey.srv-b | sed 's/.*TXT//g' > .srv-b.dns.txt
CONFDIR=A chasquid-util dkim-verify -v "--txt=$(cat ./.srv-b.dns.txt)" \
< .mail/user-a@srv-a > .chasquid-util-dkim-verify.out 2>&1
if ! grep -q ";dkim=pass" .chasquid-util-dkim-verify.out; then
echo "chasquid-util dkim-verify output:"
cat .chasquid-util-dkim-verify.out
echo
fail "Failed chasquid-util dkim-verify"
fi

# If driusan/dkim's dkimverify is available, use it to check the generated
# signature.
if dkimverify --help 2>&1 > /dev/null | grep -q -- "-txt string"; then
# Verify B's signature only, because dkimverify only supports RSA.
dkimverify -txt .srv-b.dns.txt < .mail/user-a@srv-a
else
echo "skipped driusan's dkimverify cross-check (binary not available)"
fi

success
11 changes: 10 additions & 1 deletion test/util/minidns/minidns.go
Original file line number Diff line number Diff line change
Expand Up @@ -290,8 +290,17 @@ func (m *miniDNS) loadZones(f *os.File) {
}
case "txt":
qType = dnsmessage.TypeTXT

// Cut value in chunks of 255 bytes.
chunks := []string{}
v := value
for len(v) > 254 {
chunks = append(chunks, v[:254])
v = v[254:]
}
chunks = append(chunks, v)
body = &dnsmessage.TXTResource{
TXT: []string{value},
TXT: chunks,
}
default:
log.Fatalf("line %d: unknown type %q", lineno, t)
Expand Down
1 change: 0 additions & 1 deletion test/util/test-mda
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ set -e
mkdir -p ${MDA_DIR}

# TODO: use flock to lock the file, to prevent atomic writes.
echo "From ${1}" >> ${MDA_DIR}/.tmp-${1}
cat >> ${MDA_DIR}/.tmp-${1}
X=$?
if [ -e ${MDA_DIR}/.tmp-${1} ]; then
Expand Down

0 comments on commit 9b75247

Please sign in to comment.