docker-mailserver/test/tests/parallel/set1/spam_virus/postgrey_enabled.bats

load "${REPOSITORY_ROOT}/test/helper/setup"
load "${REPOSITORY_ROOT}/test/helper/common"

BATS_TEST_NAME_PREFIX='[Postgrey] (enabled) '
CONTAINER_NAME='dms-test_postgrey_enabled'

function setup_file() {
  local CUSTOM_SETUP_ARGUMENTS=(
    --env ENABLE_POSTGREY=1
    --env PERMIT_DOCKER=container
    --env POSTGREY_AUTO_WHITELIST_CLIENTS=5
    --env POSTGREY_DELAY=3
    --env POSTGREY_MAX_AGE=35
    --env POSTGREY_TEXT="Delayed by Postgrey"
  )

  _init_with_defaults
  _common_container_setup 'CUSTOM_SETUP_ARGUMENTS'

  # Postfix needs to be ready on port 25 for nc usage below:
  _wait_for_smtp_port_in_container
}

function teardown_file() { _default_teardown ; }

@test "should have added Postgrey to 'main.cf:check_policy_service'" {
  _run_in_container grep -F 'check_policy_service inet:127.0.0.1:10023' /etc/postfix/main.cf
  assert_success
  _should_output_number_of_lines 1
}

@test "should have configured /etc/default/postgrey with default values and ENV overrides" {
  _run_in_container grep -F 'POSTGREY_OPTS="--inet=127.0.0.1:10023 --delay=3 --max-age=35 --auto-whitelist-clients=5"' /etc/default/postgrey
  assert_success
  _should_output_number_of_lines 1

  _run_in_container grep -F 'POSTGREY_TEXT="Delayed by Postgrey"' /etc/default/postgrey
  assert_success
  _should_output_number_of_lines 1
}

@test "should initially reject (greylist) mail from 'user@external.tld'" {
  # Modify the postfix config in order to ensure that postgrey handles the test e-mail.
  # The other spam checks in `main.cf:smtpd_recipient_restrictions` would interfere with testing postgrey.
  _run_in_container sed -i \
    -e 's/permit_sasl_authenticated.*policyd-spf,$//g' \
    -e 's/reject_invalid_helo_hostname.*reject_unknown_recipient_domain,$//g' \
    -e 's/reject_rbl_client.*inet:127\.0\.0\.1:10023$//g' \
    -e 's/smtpd_recipient_restrictions =/smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:10023/g' \
    /etc/postfix/main.cf
  _reload_postfix

  # Send test mail (it should fail to deliver):
  _send_email --expect-rejection --from 'user@external.tld' --port 25 --data 'postgrey.txt'
  assert_failure
  assert_output --partial 'Recipient address rejected: Delayed by Postgrey'

  # Confirm mail was greylisted:
  _should_have_log_entry \
    'action=greylist' \
    'reason=new' \
    'client_address=127.0.0.1, sender=user@external.tld, recipient=user1@localhost.localdomain'
}

# NOTE: This test case depends on the previous one
@test "should accept mail from 'user@external.tld' after POSTGREY_DELAY duration" {
  # Wait until `$POSTGREY_DELAY` seconds pass before trying again:
  sleep 3
  # Retry delivering test mail (it should be trusted this time):
  _send_email --from 'user@external.tld' --port 25 --data 'postgrey.txt'

  # Confirm postgrey permitted delivery (triplet is now trusted):
  _should_have_log_entry \
    'action=pass' \
    'reason=triplet found' \
    'client_address=127.0.0.1, sender=user@external.tld, recipient=user1@localhost.localdomain'
}

# NOTE: These two whitelist tests use `files/nc/` instead of `files/emails`.
# `nc` option `-w 0` terminates the connection after sending the template, it does not wait for a response.
# This is required for port 10023, otherwise the connection never drops.
# - This allows to bypass the SMTP protocol on port 25, and send data directly to Postgrey instead.
# - Appears to be a workaround due to `client_name=localhost` when sent from Postfix.
# - Could send over port 25 if whitelisting `localhost`,
#   - However this does not help verify that the actual client HELO address is properly whitelisted?
#   - It'd also cause the earlier greylist test to fail.
# - TODO: Actually confirm whitelist feature works correctly as these test cases are using a workaround:
@test "should whitelist sender 'user@whitelist.tld'" {
  _nc_wrapper 'nc/postgrey_whitelist.txt' '-w 0 0.0.0.0 10023'

  _should_have_log_entry \
    'action=pass' \
    'reason=client whitelist' \
    'client_address=127.0.0.1, sender=test@whitelist.tld, recipient=user1@localhost.localdomain'
}

@test "should whitelist recipient 'user2@otherdomain.tld'" {
  _nc_wrapper 'nc/postgrey_whitelist_recipients.txt' '-w 0 0.0.0.0 10023'

  _should_have_log_entry \
    'action=pass' \
    'reason=recipient whitelist' \
    'client_address=127.0.0.1, sender=test@nonwhitelist.tld, recipient=user2@otherdomain.tld'
}

function _should_have_log_entry() {
  local ACTION=${1}
  local REASON=${2}
  local TRIPLET=${3}

  # Allow some extra time for logs to update to avoids a false-positive failure:
  _run_until_success_or_timeout 10 _exec_in_container grep \
    "${ACTION}, ${REASON}," \
    /var/log/supervisor/postgrey.log

  # Log entry matched should be for the expected triplet:
  assert_output --partial "${TRIPLET}"
  _should_output_number_of_lines 1
}

# `lines` is a special BATS variable updated via `run`:
function _should_output_number_of_lines() {
  assert_equal "${#lines[@]}" "${1}"
}