mxautologin/tests/keygen_script_test.php

<?php
declare(strict_types=1);

test('keygen script creates plugin key and direct ssh authorized keys line', function (): void {
    $keyDir = TEST_TMP . '/keys-direct';
    $script = PLUGIN_ROOT . '/scripts/keygen.sh';
    $cmd = sprintf(
        'MAIL_LOGIN_KEY_DIR=%s SERVERNAME=%s SOURCE_IP=%s %s',
        escapeshellarg($keyDir),
        escapeshellarg('h4'),
        escapeshellarg('203.0.113.10'),
        escapeshellarg($script)
    );

    exec($cmd, $out, $code);

    assert_same(0, $code, implode("\n", $out));
    assert_true(is_file($keyDir . '/mx1_ed25519'));
    assert_true(is_file($keyDir . '/mx1_ed25519.pub'));
    $output = implode("\n", $out);
    assert_contains('from="203.0.113.10"', $output);
    assert_contains('restrict,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty', $output);
    assert_not_contains('command=', $output);
    assert_contains('KLUCZ PLUGINU MX-Autologin DLA SERWERA h4', $output);
});

test('keygen script detects source ip without parameters', function (): void {
    $keyDir = TEST_TMP . '/keys-auto';
    $binDir = TEST_TMP . '/fake-bin';
    mkdir($binDir, 0700, true);
    test_write($binDir . '/ip', "#!/bin/sh\nif [ \"$1 $2 $3\" = 'route get 1.1.1.1' ]; then echo '1.1.1.1 via 203.0.113.1 dev eth0 src 203.0.113.55 uid 0'; exit 0; fi\nexit 1\n");
    chmod($binDir . '/ip', 0755);

    $script = PLUGIN_ROOT . '/scripts/keygen.sh';
    $cmd = sprintf(
        'PATH=%s:$PATH MAIL_LOGIN_KEY_DIR=%s %s',
        escapeshellarg($binDir),
        escapeshellarg($keyDir),
        escapeshellarg($script)
    );

    exec($cmd, $out, $code);

    assert_same(0, $code, implode("\n", $out));
    $output = implode("\n", $out);
    assert_contains('from="203.0.113.55"', $output);
    assert_not_contains('SOURCE_SERVER_PUBLIC_IP', $output);
});

test('keygen script pins mx host key from plugin settings', function (): void {
    $keyDir = TEST_TMP . '/keys-known-hosts';
    $knownHosts = TEST_TMP . '/known-hosts/known_hosts';
    $settings = TEST_TMP . '/plugin-settings.conf';
    $binDir = TEST_TMP . '/fake-scan-bin';
    $hostKey = TEST_TMP . '/mx-host-ed25519';
    mkdir($binDir, 0700, true);

    exec(sprintf('ssh-keygen -q -t ed25519 -N "" -f %s -C %s', escapeshellarg($hostKey), escapeshellarg('mx1.test')), $keygenOut, $keygenCode);
    assert_same(0, $keygenCode, implode("\n", $keygenOut));
    $pub = trim((string)file_get_contents($hostKey . '.pub'));
    $parts = explode(' ', $pub);
    $knownHostLine = '[mx1.test]:10022 ' . $parts[0] . ' ' . $parts[1];

    test_write($settings, implode("\n", [
        'MAIL_LOGIN_SSH_HOST=mx1.test',
        'MAIL_LOGIN_SSH_PORT=10022',
        'MAIL_LOGIN_SSH_KNOWN_HOSTS=' . $knownHosts,
        'MAIL_LOGIN_CONNECT_TIMEOUT_SECONDS=5',
        '',
    ]));
    test_write($binDir . '/ssh-keyscan', "#!/bin/sh\nif [ \"$1 $2 $3 $4 $5 $6 $7\" = '-T 5 -p 10022 -t ed25519 mx1.test' ]; then cat <<'EOF'\n$knownHostLine\nEOF\nexit 0\nfi\nexit 1\n");
    chmod($binDir . '/ssh-keyscan', 0755);

    $script = PLUGIN_ROOT . '/scripts/keygen.sh';
    $cmd = sprintf(
        'PATH=%s:$PATH MAIL_LOGIN_SETTINGS_FILE=%s MAIL_LOGIN_KEY_DIR=%s SERVERNAME=%s SOURCE_IP=%s %s',
        escapeshellarg($binDir),
        escapeshellarg($settings),
        escapeshellarg($keyDir),
        escapeshellarg('h4'),
        escapeshellarg('203.0.113.10'),
        escapeshellarg($script)
    );

    exec($cmd, $out, $code);

    assert_same(0, $code, implode("\n", $out));
    assert_true(is_file($knownHosts));
    assert_contains('[mx1.test]:10022', file_get_contents($knownHosts) ?: '');
    $output = implode("\n", $out);
    assert_contains('MAIL_LOGIN_SSH_KNOWN_HOSTS=' . $knownHosts, $output);
    assert_contains('Pinned MX host key:', $output);
});

test('keygen script ignores helper mode variables and prints direct ssh line only', function (): void {
    $keyDir = TEST_TMP . '/keys-direct-only';
    $script = PLUGIN_ROOT . '/scripts/keygen.sh';
    $cmd = sprintf(
        'MAIL_LOGIN_KEY_DIR=%s MX_LOGIN_MODE=2 SERVERNAME=%s SOURCE_IP=%s %s',
        escapeshellarg($keyDir),
        escapeshellarg('h4'),
        escapeshellarg('203.0.113.10'),
        escapeshellarg($script)
    );

    exec($cmd, $out, $code);

    assert_same(0, $code, implode("\n", $out));
    $output = implode("\n", $out);
    assert_not_contains('command=', $output);
    assert_not_contains('mail-login-helper', $output);
    assert_contains('KLUCZ PLUGINU MX-Autologin DLA SERWERA h4', $output);
});