Unit testing is keeping failing...

[huan]

I'm getting many headaches to looking into it and trying to fix it... :(

docker-simple-mail-forwarder/test/simple-mail-forwarder.bats

Lines 123 to 162 in dac0ff0

	@test "ESMTP TLS AUTH by [email protected]/test" {
	#
	# # perl -MMIME::Base64 -e 'print encode_base64("testi\@testo.com\0testi\@testo.com\0test");'
	# dGVzdGlAdGVzdG8uY29tAHRlc3RpQHRlc3RvLmNvbQB0ZXN0
	#
	FIFO_SSL_I=/tmp/ssli.$$
	FIFO_SSL_O=/tmp/sslo.$$
	mkfifo $FIFO_SSL_{I,O}
	0<$FIFO_SSL_I &>$FIFO_SSL_O \
	timeout -t 7 -s TERM \
	openssl s_client -starttls smtp -crlf -connect 127.0.0.1:25 &
	exec {FD_I}> $FIFO_SSL_I
	exec {FD_O}< $FIFO_SSL_O
	ret=1
	while read line; do
	line=$(sed 's/\r$//'<<<$line)
	if [[ $line =~ 'CONNECTED' ]]; then
	>& $FD_I echo 'AUTH PLAIN dGVzdGlAdGVzdG8uY29tAHRlc3RpQHRlc3RvLmNvbQB0ZXN0'
	elif [[ $line =~ '235 2.7.0 Authentication successful' ]]; then
	>& $FD_I echo 'QUIT'
	exec {FD_I}>&-
	ret=0
	elif [[ $line =~ '503 5.5.1 Error: already authenticated' ]]; then
	>& $FD_I echo 'QUIT'
	exec {FD_I}>&-
	ret=0
	fi
	done <& $FD_O
	unlink $FIFO_SSL_I
	unlink $FIFO_SSL_O
	[ $ret = 0 ]
	}

There are no changes at all in the past dozens of weeks, what's wrong?

See: https://circleci.com/gh/huan/docker-simple-mail-forwarder/20

[huan]

version with git hash ab049ac works without any problem.

bash-4.4# openssl s_client -starttls smtp -crlf -connect 127.0.0.1:25
CONNECTED(00000003)
depth=0 C = US, ST = Matrix, L = L, O = O, CN = simple-mail-forwarder.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = US, ST = Matrix, L = L, O = O, CN = simple-mail-forwarder.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Matrix/L=L/O=O/CN=simple-mail-forwarder.com
   i:/C=US/ST=Matrix/L=L/O=O/CN=simple-mail-forwarder.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDMDCCAhgCCQCpC0dr5fDjgzANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJV
UzEPMA0GA1UECAwGTWF0cml4MQowCAYDVQQHDAFMMQowCAYDVQQKDAFPMSIwIAYD
VQQDDBlzaW1wbGUtbWFpbC1mb3J3YXJkZXIuY29tMB4XDTE5MDYwNzE1NDkzMloX
DTI5MDYwNDE1NDkzMlowWjELMAkGA1UEBhMCVVMxDzANBgNVBAgMBk1hdHJpeDEK
MAgGA1UEBwwBTDEKMAgGA1UECgwBTzEiMCAGA1UEAwwZc2ltcGxlLW1haWwtZm9y
d2FyZGVyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKbRBy6q
+dlPLlGU/EYsO4Q2BatiaxNEqPYcQC8F42A9CgUONYPkLQPC+eZ7MZAtboqlk1aN
FoARrGLqsiXkc2bzqD7DUjABSwWTR3xmT5t4L0fCVafwlAoe1CRXN8R3uodeHRWR
LTbHnIL2K2KslREtv1ioJFTQ14tlzMbej3Lnc+1at5pL3R1d4u5Rrk3+KtqY0fEW
AElwhM5ilWC2aVoLoNnStbL+8TyQi2fIQMMOhlW9esw8eOZGlTYOKXMryXoact61
pKQSXaoHzP5+w1+8+nd2Ux6sWW0aPBlgwiBLemB+2/EN6IT5LEdHNMdlPLmjqojA
w+5A04eevNMi/GkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAc5uPEnCsbmUYzg/W
l0ZgwWYAh7/9fUrgwVdxXrZy514Gxbrm9QmezH0vDX0tGgouTEnJ/67e+GBHDOR/
HH56lfSlKyOTjNvOGlRY3jZuWMg8P5J54qLLdvkeABMhKAuvRInpfmXcfcmeQH+P
uzh/IKJUBi0b/2PWlbMzfoz0D+8qD8hJAbmUyMs6U3E4lQjbBdvSCDzX7n+xmVI8
NEMw/cBa7dppfGxHMt5cSZwhcsYjlE4vrM+Y4pS1HLnynlWipzJedNHPA/PvbscC
PaZMsofb3ooChcerH1sR30bAPiYSsaQ3ba0CUlYRnlrS3szNO3vAf5V56pO9jkSo
kFnmqg==
-----END CERTIFICATE-----
subject=/C=US/ST=Matrix/L=L/O=O/CN=simple-mail-forwarder.com
issuer=/C=US/ST=Matrix/L=L/O=O/CN=simple-mail-forwarder.com
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1699 bytes and written 468 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: ABEAB3EDC6F6753D17F1C706D2AC8ABF5FB503E0CFE83F9CF5D639C8C1BBDA85
    Session-ID-ctx: 
    Master-Key: 93D5EFE19D1E9475ABCBD7DD31206BBD4B80DE8A011CF9EB7A3444D010ED08885EA65D788430A54D8672C64C00F04D39
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - c2 d3 31 23 1f 80 28 d0-5f ef 83 24 4d b2 9d 8f   ..1#..(._..$M...
    0010 - 72 53 fa 24 c0 85 e8 ee-86 7e 9c 3a c0 6e 49 38   rS.$.....~.:.nI8
    0020 - 6c ba 79 bf 7a c4 e8 ea-0b 59 86 12 56 6d b9 13   l.y.z....Y..Vm..
    0030 - 81 51 88 e2 a1 93 e7 02-7d 95 67 25 fc 76 a6 cd   .Q......}.g%.v..
    0040 - dc bd e3 47 06 08 94 bb-82 51 31 70 6c 08 06 c7   ...G.....Q1pl...
    0050 - 51 42 13 c2 a7 a3 09 03-dd b2 51 a6 2b 2c fc 86   QB........Q.+,..
    0060 - ba c9 f6 27 93 cc 07 2d-be 22 10 fa 45 bb 13 a5   ...'...-."..E...
    0070 - ba be 0e f5 87 a0 47 13-92 b6 b5 cc 9b 6d c7 9f   ......G......m..
    0080 - 89 d5 07 31 b2 5b 7c 64-6a 97 ea b3 69 40 95 ba   ...1.[|dj...i@..
    0090 - 33 1c 45 3f b9 d3 32 3f-9d 9b 68 db 85 c6 0f eb   3.E?..2?..h.....

    Start Time: 1559922634
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
250 DSN

[huan]

It seems that this issue is related to the following code block:

docker-simple-mail-forwarder/install/init-openssl.sh

Lines 9 to 18 in dac0ff0

	if [ ! -f "smtp.cert" ] || [ ! -f "smtp.ec.cert" ]; then
	#openssl dhparam -2 -out dh_512.pem 512
	#openssl dhparam -2 -out dh_1024.pem 1024
	openssl req -new -outform PEM -out smtp.cert -newkey rsa:2048 \
	-nodes -keyout smtp.key -keyform PEM -days 3650 -x509 \
	-subj "/C=US/ST=Matrix/L=L/O=O/CN=${SMF_DOMAIN:-simple-mail-forwarder.com}"
	chown -R root.postfix /etc/postfix/cert/
	chmod -R 750 /etc/postfix/cert/
	fi

Which was introduced from PR #51

[huan]

Add an EC cert/key generate script, inspired from

https://security.stackexchange.com/a/93712/209762

[huan]

All tests passing again. :-D