Merge tag '0.8.0'

Release 0.8.0

6 files changed, 214 insertions, 38 deletions

diff --git a/tests/white-box/couchdb.rb b/tests/white-box/couchdb.rb
index 5ee12ff3..85dc6840 100644
--- a/tests/white-box/couchdb.rb
+++ b/tests/white-box/couchdb.rb
@@ -9,9 +9,8 @@ class CouchDB < LeapTest
   end
 
   def test_00_Are_daemons_running?
-    assert_running '^tapicero', :single => true
+    assert_running 'bin/beam'
     if multimaster?
-      assert_running 'bin/beam'
       assert_running 'bin/epmd'
     end
     pass
@@ -70,7 +69,7 @@ class CouchDB < LeapTest
   end
 
   def test_04_Do_ACL_users_exist?
-    acl_users = ['_design/_auth', 'leap_mx', 'nickserver', 'soledad', 'tapicero', 'webapp', 'replication']
+    acl_users = ['_design/_auth', 'leap_mx', 'nickserver', 'soledad', 'webapp', 'replication']
     url = couchdb_backend_url("/_users/_all_docs", :username => 'admin')
     assert_get(url) do |body|
       response = JSON.parse(body)
@@ -128,6 +127,33 @@ class CouchDB < LeapTest
     pass
   end
 
+  #
+  # This is not really a "test", just an attempt to make sure that
+  # the mx tests that fire off dummy emails don't fill up the
+  # storage db.
+  #
+  # mx tests can't run this because they don't have access to
+  # the storage db.
+  #
+  # This "test" is responsible for both creating the db if it does not
+  # exist, and destroying if it does.
+  #
+  # Yes, this is super hacky. Properly, we should add something to
+  # the soledad api to support create/delete of user storage dbs.
+  #
+  def test_99_Delete_mail_storage_used_in_mx_tests
+    user = find_user_by_login(TEST_EMAIL_USER)
+    if user
+      if user_db_exists?(user["id"])
+        # keep the test email db from filling up:
+        assert_destroy_user_db(user["id"], :username => 'admin')
+      end
+      # either way, make sure we leave a db for the mx tests:
+      assert_create_user_db(user["id"], :username => 'admin')
+    end
+    silent_pass
+  end
+
   private
 
   def multimaster?
diff --git a/tests/white-box/mx.rb b/tests/white-box/mx.rb
index 794a9a41..6c0982ce 100644
--- a/tests/white-box/mx.rb
+++ b/tests/white-box/mx.rb
@@ -1,9 +1,11 @@
 raise SkipTest unless service?(:mx)
 
 require 'json'
+require 'net/smtp'
 
 class Mx < LeapTest
   depends_on "Network"
+  depends_on "Webapp" if service?(:webapp)
 
   def setup
   end
@@ -11,7 +13,7 @@ class Mx < LeapTest
   def test_01_Can_contact_couchdb?
     dbs = ["identities"]
     dbs.each do |db_name|
-      couchdb_urls("/"+db_name, url_options).each do |url|
+      couchdb_urls("/"+db_name, couch_url_options).each do |url|
         assert_get(url) do |body|
           assert response = JSON.parse(body)
           assert_equal db_name, response['db_name']
@@ -23,7 +25,7 @@ class Mx < LeapTest
 
   def test_02_Can_contact_couchdb_via_haproxy?
     if property('haproxy.couch')
-      url = couchdb_url_via_haproxy("", url_options)
+      url = couchdb_url_via_haproxy("", couch_url_options)
       assert_get(url) do |body|
         assert_match /"couchdb":"Welcome"/, body, "Request to #{url} should return couchdb welcome message."
       end
@@ -31,20 +33,154 @@ class Mx < LeapTest
     end
   end
 
-  def test_03_Are_MX_daemons_running?
-    assert_running 'leap_mx'
-    assert_running '/usr/lib/postfix/master'
-    assert_running '/usr/sbin/unbound'
+  #
+  # this test picks a random identity document, then queries
+  # using the by_address view for that same document again.
+  #
+  def test_03_Can_query_identities_db?
+    assert_get(couchdb_url("/identities", couch_url_options)) do |body|
+      assert response = JSON.parse(body)
+      doc_count = response['doc_count'].to_i
+      if doc_count <= 1
+        # the design document counts as one document.
+        skip "There are no identity documents yet."
+      else
+        # try five times to get a valid doc
+        for i in 1..5
+          offset    = rand(doc_count) # pick a random document
+          count_url = couchdb_url("/identities/_all_docs?include_docs=true&limit=1&skip=#{offset}", couch_url_options)
+          assert_get(count_url) do |body|
+            assert response = JSON.parse(body)
+            record = response['rows'].first
+            if record['id'] =~ /_design/
+              next
+            else
+              address = record['doc']['address']
+              assert address, "Identity document #{record['id']} is missing an address field. #{record['doc'].inspect}"
+              url_base = %(/identities/_design/Identity/_view/by_address)
+              params = %(?include_docs=true&reduce=false&startkey="#{address}"&endkey="#{address}")
+              assert_get(couchdb_url(url_base+params, couch_url_options)) do |body|
+                assert response = JSON.parse(body)
+                assert record = response['rows'].first
+                assert_equal address, record['doc']['address']
+                pass
+              end
+              break
+            end
+          end
+        end
+      end
+    end
+  end
+
+  def test_04_Are_MX_daemons_running?
+    assert_running '.*/usr/bin/twistd.*mx.tac'
+    assert_running '^/usr/lib/postfix/master$'
+    assert_running '^/usr/sbin/postfwd'
+    assert_running 'postfwd2::cache$'
+    assert_running 'postfwd2::policy$'
+    assert_running '^/usr/sbin/unbound$'
+    assert_running '^/usr/bin/freshclam'
+    assert_running '^/usr/sbin/opendkim'
+    if Dir.glob("/var/lib/clamav/main.{c[vl]d,inc}").size > 0 and Dir.glob("/var/lib/clamav/daily.{c[vl]d,inc}").size > 0
+      assert_running '^/usr/sbin/clamd'
+      assert_running '^/usr/sbin/clamav-milter'
+    else
+      skip "Downloading the clamav signature files (/var/lib/clamav/{daily,main}.{c[vl]d,inc}) is still in progress, so clamd is not running.\nDon't worry, mail delivery will work without clamav. The download should finish soon."
+    end
+    pass
+  end
+
+  #
+  # The email sent by this test might get bounced back.
+  # In this case, the test will pass, but the bounce message will
+  # get sent to root, so the sysadmin will still figure out pretty
+  # quickly that something is wrong.
+  #
+  def test_05_Can_deliver_email?
+    addr = [TEST_EMAIL_USER, property('domain.full_suffix')].join('@')
+    bad_addr = [TEST_BAD_USER, property('domain.full_suffix')].join('@')
+
+    assert !identity_exists?(bad_addr), "the address #{bad_addr} must not exist."
+    if !identity_exists?(addr)
+      user = assert_create_user(TEST_EMAIL_USER, :monitor)
+      upload_public_key(user.id, TEST_EMAIL_PUBLIC_KEY)
+    end
+    assert identity_exists?(addr), "The identity #{addr} should have been created, but it doesn't exist yet."
+    assert_send_email(addr)
+    assert_raises(Net::SMTPError) do
+      send_email(bad_addr)
+    end
     pass
   end
 
   private
 
-  def url_options
+  def couch_url_options
     {
       :username => property('couchdb_leap_mx_user.username'),
       :password => property('couchdb_leap_mx_user.password')
     }
   end
 
+  TEST_EMAIL_PUBLIC_KEY=<<HERE
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+mI0EVvzIKQEEAN4f8FOGntJGTTD+fFUQS6y/ihn6tYLtyGZZbCOd0t/9kHt/raoR
+xEUks8rCOPMqHX+yeHsvDBtDyZYTvyhtfuWrBUbYGW+QZ4Pdvo+7NyLHPW0dKsCB
+Czrx7pxqpq1oq+LpUFqpSfjJTfYaGVDNXrPK144a7Rox2+MCbgq3twnFABEBAAG0
+EiA8dGVzdF91c2VyX2VtYWlsPoi4BBMBAgAiBQJW/MgpAhsvBgsJCAcDAgYVCAIJ
+CgsEFgIDAQIeAQIXgAAKCRAqYf65XmeSk0orBADUXjEiGnjzyBpXqaiVmJr4MyfP
+IfKTK4a+4qvR+2fseD7hteF98m26i1YRI5omLp4/MnxGSpgKFKIuWIdkEiLg7IJc
+pFZVdoDVufEtzbj9gmOHlnteksbCtuESyB0Hytsba4uS9afcTJdGiPNMHeniI/SY
+UKcCcIrQmpNIoOA5OLiNBFb8yCkBBAC+WMUQ+FC6GQ+pyaWlwTRsBAT4+Tp8w9jD
+7PK4xeEmVZDirP0VkW18UeQEueWJ63ia7wIGf1WyVH1tbvgVyRLsjT2cpKo8c6Ok
+NkhfGfjTnUJPeBNy8734UDIdqZLXJl0z6Z1R0CfOjBqvV25kWUvMkz/NEgZBhE+c
+m3JuZy1k7QARAQABiQE9BBgBAgAJBQJW/MgpAhsuAKgJECph/rleZ5KTnSAEGQEC
+AAYFAlb8yCkACgkQsJSYitQUOv4w1wQAn3atI5EsmRyw6iC6UVWWJv/lKi1Priyt
+DsrdH5xUmHUgp6VU8Pw9Y6G+sv50KLfbVQ1l+8/3B71TjadsOxh+PBPsEyYpK6WX
+TVGy44IDvFWGyOod8tmfcFN9IpU5DmSk/vny9G7RK/nbnta2VnfZOzwm5i3cNkPr
+FGPL1z0K3qs0VwP+M7BXdqBRSFDDBpG1J0TrZioEjvKeOsT/Ul8mbVt7HQpcN93I
+wTO4uky0Woy2nb7SbTQw6wOpU54u7+5dSQ03ltUHg1owy6Y3CMOeFL+e9ALpAZAU
+aMwY7zMFhqlPVZZMfdMLRsdLin67RIM+OJ6A925AM52bEQT1YwkQlP4mvQY=
+=qclE
+-----END PGP PUBLIC KEY BLOCK-----
+HERE
+
+  TEST_EMAIL_PRIVATE_KEY = <<HERE
+-----BEGIN PGP PRIVATE KEY BLOCK-----
+lQHYBFb8yCkBBADeH/BThp7SRk0w/nxVEEusv4oZ+rWC7chmWWwjndLf/ZB7f62q
+EcRFJLPKwjjzKh1/snh7LwwbQ8mWE78obX7lqwVG2BlvkGeD3b6Puzcixz1tHSrA
+gQs68e6caqataKvi6VBaqUn4yU32GhlQzV6zyteOGu0aMdvjAm4Kt7cJxQARAQAB
+AAP8DTFfcE6UG1AioJDU6KZ9oCaGONHLuxmNaArSofDrR/ODA9rLAUlp22N5LEdJ
+46NyOhXrEwHx2aK2k+vbVDbgrP4ZTH7GxIK/2KzmH4zX0fWUNsaRy94Q12lJegXH
+sH2Im8Jjxu16YwGgFNTX1fCPqLB6WdQpf1796s6+/3PnCDcCAOXTCul3N7V5Yl+9
+N2Anupn+qNDXKT/kiKIZLHsMbo7EriGWReG3lLj1cOJPC6Nf0uOEri4ErSjFEadR
+F2TNITsCAPdsZjc5RGppUXyBfxhQkAnZ0r+UT2meCH3g3EVh3W9SBrXNhwipNpW3
+bPzRjUCDtmA8EOvd93oPCZv4/tb50P8B/jC+QIZ3GncP1CFPSVDoIZ7OUU5M1330
+DP77vG1GxeQvYO/hlxL5/KdtTR6m5zlIuooDxUaNJz1w5/oVjlG3NZKpl7QSIDx0
+ZXN0X3VzZXJfZW1haWw+iLgEEwECACIFAlb8yCkCGy8GCwkIBwMCBhUIAgkKCwQW
+AgMBAh4BAheAAAoJECph/rleZ5KTSisEANReMSIaePPIGlepqJWYmvgzJ88h8pMr
+hr7iq9H7Z+x4PuG14X3ybbqLVhEjmiYunj8yfEZKmAoUoi5Yh2QSIuDsglykVlV2
+gNW58S3NuP2CY4eWe16SxsK24RLIHQfK2xtri5L1p9xMl0aI80wd6eIj9JhQpwJw
+itCak0ig4Dk4nQHYBFb8yCkBBAC+WMUQ+FC6GQ+pyaWlwTRsBAT4+Tp8w9jD7PK4
+xeEmVZDirP0VkW18UeQEueWJ63ia7wIGf1WyVH1tbvgVyRLsjT2cpKo8c6OkNkhf
+GfjTnUJPeBNy8734UDIdqZLXJl0z6Z1R0CfOjBqvV25kWUvMkz/NEgZBhE+cm3Ju
+Zy1k7QARAQABAAP9HrUaGvdpqTwVx3cHyXUhId6GzCuuKyaP4mZoGeBCcaQS2vQR
+YtiykwBwX/AlfwSFJmmHKB6EErWIA+QyaEFR/fO56cHD2TY3Ql0BGcuHIx3+9pkp
+biPBZdiiGz7oa6k6GWsbKSksqwV8poSXV7qbn+Bjm2xCM4VnjNZIrFtL7fkCAMOf
+e9yHBFoXfc175bkNXEUXrNS34kv2ODAlx6KyY+PS77D+nprpHpGCnLn77G+xH1Xi
+qvX1Dr/iSQU5Tzsd+tcCAPkYZulaC/9itwme7wIT3ur+mdqMHymsCzv9193iLgjJ
+9t7fARo18yB845hI9Xv7TwRcoyuSpfvuM05rCMRzydsCAOI1MZeKtZSogXVa9QTX
+sVGZeCkrujSVOgsA3w48OLc2OrwZskDfx5QHfeJnumjQLut5qsnZ+1onj9P2dGdn
+JaChe4kBPQQYAQIACQUCVvzIKQIbLgCoCRAqYf65XmeSk50gBBkBAgAGBQJW/Mgp
+AAoJELCUmIrUFDr+MNcEAJ92rSORLJkcsOogulFVlib/5SotT64srQ7K3R+cVJh1
+IKelVPD8PWOhvrL+dCi321UNZfvP9we9U42nbDsYfjwT7BMmKSull01RsuOCA7xV
+hsjqHfLZn3BTfSKVOQ5kpP758vRu0Sv5257WtlZ32Ts8JuYt3DZD6xRjy9c9Ct6r
+NFcD/jOwV3agUUhQwwaRtSdE62YqBI7ynjrE/1JfJm1bex0KXDfdyMEzuLpMtFqM
+tp2+0m00MOsDqVOeLu/uXUkNN5bVB4NaMMumNwjDnhS/nvQC6QGQFGjMGO8zBYap
+T1WWTH3TC0bHS4p+u0SDPjiegPduQDOdmxEE9WMJEJT+Jr0G
+=hvJM
+-----END PGP PRIVATE KEY BLOCK-----
+HERE
+
 end
diff --git a/tests/white-box/network.rb b/tests/white-box/network.rb
index acb5c5e6..436fc8a8 100644
--- a/tests/white-box/network.rb
+++ b/tests/white-box/network.rb
@@ -1,4 +1,5 @@
 require 'socket'
+require 'openssl'
 
 raise SkipTest if $node["dummy"]
 
@@ -28,11 +29,18 @@ class Network < LeapTest
   def test_02_Is_stunnel_running?
     ignore unless $node['stunnel']
     good_stunnel_pids = []
+    release = `facter lsbmajdistrelease`
+    if release.to_i > 7
+      # on jessie, there is only one stunnel proc running instead of 6
+      expected = 1
+    else
+      expected = 6
+    end
     $node['stunnel']['clients'].each do |stunnel_type, stunnel_configs|
       stunnel_configs.each do |stunnel_name, stunnel_conf|
         config_file_name = "/etc/stunnel/#{stunnel_name}.conf"
         processes = pgrep(config_file_name)
-        assert_equal 6, processes.length, "There should be six stunnel processes running for `#{config_file_name}`"
+        assert_equal expected, processes.length, "There should be #{expected} stunnel processes running for `#{config_file_name}`"
         good_stunnel_pids += processes.map{|ps| ps[:pid]}
         assert port = stunnel_conf['accept_port'], 'Field `accept_port` must be present in `stunnel` property.'
         assert_tcp_socket('localhost', port)
@@ -41,7 +49,7 @@ class Network < LeapTest
     $node['stunnel']['servers'].each do |stunnel_name, stunnel_conf|
       config_file_name = "/etc/stunnel/#{stunnel_name}.conf"
       processes = pgrep(config_file_name)
-      assert_equal 6, processes.length, "There should be six stunnel processes running for `#{config_file_name}`"
+      assert_equal expected, processes.length, "There should be #{expected} stunnel processes running for `#{config_file_name}`"
       good_stunnel_pids += processes.map{|ps| ps[:pid]}
       assert accept_port = stunnel_conf['accept_port'], "Field `accept` must be present in property `stunnel.servers.#{stunnel_name}`"
       assert_tcp_socket('localhost', accept_port)
@@ -62,4 +70,21 @@ class Network < LeapTest
     pass
   end
 
+  THIRTY_DAYS = 60*60*24*30
+
+  def test_04_Are_server_certificates_valid?
+    cert_paths = ["/etc/x509/certs/leap_commercial.crt", "/etc/x509/certs/leap.crt"]
+    cert_paths.each do |cert_path|
+      if File.exists?(cert_path)
+        cert = OpenSSL::X509::Certificate.new(File.read(cert_path))
+        if Time.now > cert.not_after
+          fail "The certificate #{cert_path} expired on #{cert.not_after}"
+        elsif Time.now + THIRTY_DAYS > cert.not_after
+          fail "The certificate #{cert_path} will expire soon, on #{cert.not_after}"
+        end
+      end
+    end
+    pass
+  end
+
 end
diff --git a/tests/white-box/openvpn.rb b/tests/white-box/openvpn.rb
index 23a40426..170d4503 100644
--- a/tests/white-box/openvpn.rb
+++ b/tests/white-box/openvpn.rb
@@ -7,9 +7,9 @@ class OpenVPN < LeapTest
   end
 
   def test_01_Are_daemons_running?
-    assert_running '/usr/sbin/openvpn .* /etc/openvpn/tcp_config.conf'
-    assert_running '/usr/sbin/openvpn .* /etc/openvpn/udp_config.conf'
-    assert_running '/usr/sbin/unbound'
+    assert_running '^/usr/sbin/openvpn .* /etc/openvpn/tcp_config.conf$'
+    assert_running '^/usr/sbin/openvpn .* /etc/openvpn/udp_config.conf$'
+    assert_running '^/usr/sbin/unbound$'
     pass
   end
 
diff --git a/tests/white-box/soledad.rb b/tests/white-box/soledad.rb
index 5a13e4a6..d41bee58 100644
--- a/tests/white-box/soledad.rb
+++ b/tests/white-box/soledad.rb
@@ -10,7 +10,7 @@ class Soledad < LeapTest
   end
 
   def test_00_Is_Soledad_running?
-    assert_running 'soledad'
+    assert_running '.*/usr/bin/twistd.*--wsgi=leap.soledad.server.application'
     pass
   end
 
diff --git a/tests/white-box/webapp.rb b/tests/white-box/webapp.rb
index 9956eb35..68f3dcd2 100644
--- a/tests/white-box/webapp.rb
+++ b/tests/white-box/webapp.rb
@@ -27,8 +27,8 @@ class Webapp < LeapTest
   end
 
   def test_03_Are_daemons_running?
-    assert_running '/usr/sbin/apache2'
-    assert_running '/usr/bin/nickserver'
+    assert_running '^/usr/sbin/apache2'
+    assert_running '^/usr/bin/ruby /usr/bin/nickserver'
     pass
   end
 
@@ -57,10 +57,11 @@ class Webapp < LeapTest
       soledad_server = pick_soledad_server(soledad_config)
       if soledad_server
         assert_tmp_user do |user|
-          assert_user_db_exists(user)
           command = File.expand_path "../../helpers/soledad_sync.py", __FILE__
           soledad_url = "https://#{soledad_server}/user-#{user.id}"
-          assert_run "#{command} #{user.id} #{user.session_token} #{soledad_url}"
+          soledad_cert = "/usr/local/share/ca-certificates/leap_ca.crt"
+          assert_run "#{command} #{user.id} #{user.session_token} #{soledad_url} #{soledad_cert} #{user.password}"
+          assert_user_db_exists(user)
           pass
         end
       end
@@ -73,8 +74,8 @@ class Webapp < LeapTest
 
   def url_options
     {
-      :username => property('couchdb_webapp_user.username'),
-      :password => property('couchdb_webapp_user.password')
+      :username => property('webapp.couchdb_webapp_user.username'),
+      :password => property('webapp.couchdb_webapp_user.password')
     }
   end
 
@@ -95,7 +96,7 @@ class Webapp < LeapTest
   end
 
   #
-  # returns true if the per-user db created by tapicero exists.
+  # returns true if the per-user db created by soledad-server exists.
   # we try three times, and give up after that.
   #
   def assert_user_db_exists(user)
@@ -118,7 +119,9 @@ class Webapp < LeapTest
       sleep 0.2
       get(couchdb_url(url)) do |body, response, error|
         last_body, last_response, last_error = body, response, error
-        if response.code.to_i == 200
+        # After moving to couchdb, webapp user is not allowed to Read user dbs,
+        # but the return code for non-existent databases is 404. See #7674
+        if response.code.to_i == 401
           return
         end
       end
@@ -128,18 +131,4 @@ class Webapp < LeapTest
     return
   end
 
-  #
-  # I tried, but couldn't get this working:
-  # #
-  # # get an CSRF authenticity token
-  # #
-  # url = api_url("/")
-  # csrf_token = nil
-  # assert_get(url) do |body|
-  #   lines = body.split("\n").grep(/csrf-token/)
-  #   assert lines.any?, 'failed to find csrf-token'
-  #   csrf_token = lines.first.split('"')[1]
-  #   assert csrf_token, 'failed to find csrf-token'
-  # end
-
 end