[Test] Add tests for strict pubkey checking

diff --git a/test/functional/cases/131_dkim_signing/001_simple.robot b/test/functional/cases/131_dkim_signing/001_simple.robot
index 66bcffe3795dec03b2442a5fa4f9b8389b5d4da6..d5bd5684128c6c95aa02811a2f9f4a2bca0dccc6 100644 (file)
--- a/test/functional/cases/131_dkim_signing/001_simple.robot
+++ b/test/functional/cases/131_dkim_signing/001_simple.robot
@@ -8,6 +8,7 @@ Variables       ${TESTDIR}/lib/vars.py
 *** Variables ***
 ${CONFIG}       ${TESTDIR}/configs/plugins.conf
 ${MESSAGE}      ${TESTDIR}/messages/dmarc/fail_none.eml
+${MESSAGE_FAIL}      ${TESTDIR}/messages/dmarc/fail_none1.eml
 ${REDIS_SCOPE}  Suite
 ${RSPAMD_SCOPE}  Suite
 ${URL_TLD}      ${TESTDIR}/../lua/unit/test_tld.dat
@@ -23,6 +24,11 @@ TEST NOT SIGNED - USERNAME WRONG DOMAIN
   Check Rspamc  ${result}  DKIM-Signature:  inverse=1
   Should Not Contain  ${result.stdout}  DKIM_SIGNED (1.00)
 
+TEST NOT SIGNED - USERNAME WRONG PUBKEY
+  ${result} =  Scan Message With Rspamc  ${MESSAGE_FAIL}  -u  bob@invalid.za.org
+  Check Rspamc  ${result}  DKIM-Signature:  inverse=1
+  Should Not Contain  ${result.stdout}  DKIM_SIGNED (1.00)
+
 *** Keywords ***
 DKIM Signing Setup
   ${PLUGIN_CONFIG} =  Get File  ${TESTDIR}/configs/dkim_signing/simple.conf

diff --git a/test/functional/configs/dkim.conf b/test/functional/configs/dkim.conf
index d3593a12d79b886767b8641733791a320a356aa9..f4d7c96fd7ddea2b911baab43a27d9df23d7ee8b 100644 (file)
--- a/test/functional/configs/dkim.conf
+++ b/test/functional/configs/dkim.conf
@@ -8,6 +8,11 @@ options = {
       name = "test._domainkey.example.com";
       type = txt;
       replies = ["k=ed25519; p=yi50DjK5O9pqbFpNHklsv9lqaS0ArSYu02qp1S0DW1Y="];
+    },
+    {
+      name = "dkim._domainkey.cacophony.za.org",
+      type = "txt";
+      replies = ["v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXtxBE5IiNRMcq2/lc2zErfdCvDFyQNBnMjbOjBQrPST2k4fdGbtpe5Iu5uS01Met+dAEf94XL8I0hwmYw+n70PP834zfJGi2egwGqrakpaWsCDPvIJZLkxJCJKQRA/zrQ622uEXdvYixVbsEGVw7U4wAGSmT5rU2eU1y63AlOlQIDAQAB"];
     }];
   }
 }

diff --git a/test/functional/configs/dkim_signing/simple.conf b/test/functional/configs/dkim_signing/simple.conf
index d233beff616329ae113356912e9d2eacf48c89a4..2302a0c4f259976ab4a528f9ffa61c2a8200df45 100644 (file)
--- a/test/functional/configs/dkim_signing/simple.conf
+++ b/test/functional/configs/dkim_signing/simple.conf
@@ -1,3 +1,5 @@
 dkim_signing {
   path = "${TESTDIR}/configs/dkim.key";
+  check_pubkey = true;
+  allow_pubkey_mismatch = false;
 }

diff --git a/test/functional/configs/plugins.conf b/test/functional/configs/plugins.conf
index eb7971478c37e4f93278b740c7e88660d1e88bd8..65141d5c0294f545dce4c365247c633df0534e14 100644 (file)
--- a/test/functional/configs/plugins.conf
+++ b/test/functional/configs/plugins.conf
@@ -1,31 +1,46 @@
 options = {
-       filters = ["spf", "dkim", "regexp"]
-       url_tld = "${URL_TLD}"
-       pidfile = "${TMPDIR}/rspamd.pid"
-       lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua"
-       dns {
-               nameserver = ["8.8.8.8", "8.8.4.4"];
-               retransmits = 10;
-               timeout = 2s;
-       }
+  filters = ["spf", "dkim", "regexp"]
+  url_tld = "${URL_TLD}"
+  pidfile = "${TMPDIR}/rspamd.pid"
+  lua_path = "${INSTALLROOT}/share/rspamd/lib/?.lua"
+  dns {
+    nameserver = ["8.8.8.8", "8.8.4.4"];
+    retransmits = 10;
+    timeout = 2s;
+        fake_records = [{ # ed25519
+          name = "test._domainkey.example.com";
+          type = txt;
+          replies = ["k=ed25519; p=yi50DjK5O9pqbFpNHklsv9lqaS0ArSYu02qp1S0DW1Y="];
+        },
+        {
+          name = "dkim._domainkey.cacophony.za.org",
+          type = "txt";
+          replies = ["v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXtxBE5IiNRMcq2/lc2zErfdCvDFyQNBnMjbOjBQrPST2k4fdGbtpe5Iu5uS01Met+dAEf94XL8I0hwmYw+n70PP834zfJGi2egwGqrakpaWsCDPvIJZLkxJCJKQRA/zrQ622uEXdvYixVbsEGVw7U4wAGSmT5rU2eU1y63AlOlQIDAQAB"];
+        },
+        {
+          name = "dkim._domainkey.invalid.za.org",
+          type = "txt";
+          replies = ["v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEEXmNGQq7PUrr9Mg4UakTFHgXBCy2DOztkrZm+0OrVWtiRzGluxBkbOWTBwuU3/Yw97yTphBMQxzWFN603/f/KPAQcF/Lc1l+6kmIBBxNXjjGuOK/3PYKZVntUdKmqcQBYfnHdzH2Tohbuyx1a7xqnv6VSChqQrZU4CwkeT3+eQIDAQAB"];
+        }];
+  }
 }
 logging = {
-       type = "file",
-       level = "debug"
-       filename = "${TMPDIR}/rspamd.log"
+  type = "file",
+  level = "debug"
+  filename = "${TMPDIR}/rspamd.log"
 }
 metric = {
-       name = "default",
-       actions = {
-               reject = 100500,
-       }
-       unknown_weight = 1
+  name = "default",
+  actions = {
+    reject = 100500,
+  }
+  unknown_weight = 1
 }
 worker {
-       type = normal
-       bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
-       count = 1
-       task_timeout = 60s;
+  type = normal
+  bind_socket = ${LOCAL_ADDR}:${PORT_NORMAL}
+  count = 1
+  task_timeout = 60s;
 }
 worker {
         type = controller

diff --git a/test/functional/messages/dmarc/fail_none1.eml b/test/functional/messages/dmarc/fail_none1.eml
new file mode 100644 (file)
index 0000000..1579bb7
--- /dev/null
+++ b/test/functional/messages/dmarc/fail_none1.eml
@@ -0,0 +1,3 @@
+From: Rspamd <foo@invalid.za.org>
+
+hello