gsadmin/certctl
1
0
Fork 0
mirror of https://github.com/shankar0123/certctl.git synced 2026-06-07 16:21:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(M42): Postfix/Dovecot mail server target connector

Browse Source 
Dual-mode TLS connector for mail servers — single package with mode
field selecting Postfix or Dovecot defaults. File-based cert/key
deployment with correct permissions (cert 0644, key 0600), optional
chain append, shell injection prevention, and configurable
reload/validate commands. 18 tests covering config validation,
deployment, and security. GUI wizard fields and OpenAPI enum updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Shankar
2026-04-03 01:46:15 -04:00
parent c47d83ccf5
commit 8dc78b7455
8 changed files with 931 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -3
View File
@@ -36,7 +36,7 @@ gantt
47 days :crit, 2020-01-01, 47d
```
> **Actively maintained — shipping weekly.** Found something? [Open a GitHub issue](https://github.com/shankar0123/certctl/issues) — issues get triaged same-day. CI runs 1,536+ tests with race detection, static analysis, and vulnerability scanning on every commit.
> **Actively maintained — shipping weekly.** Found something? [Open a GitHub issue](https://github.com/shankar0123/certctl/issues) — issues get triaged same-day. CI runs 1,554+ tests with race detection, static analysis, and vulnerability scanning on every commit.
## Why certctl Exists
@@ -44,7 +44,7 @@ Certificate lifecycle tooling today falls into two camps: expensive enterprise p
certctl fills that gap. It's **CA-agnostic** — plug in any certificate authority: Let's Encrypt via ACME, Smallstep step-ca, HashiCorp Vault PKI, DigiCert CertCentral, your enterprise ADCS via sub-CA mode, or any custom CA through a shell script adapter. Run multiple issuers simultaneously for different certificate types.
It's **target-agnostic**. Agents deploy certificates to NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, and IIS (local PowerShell or remote WinRM) — all using the same pluggable connector model. The control plane never initiates outbound connections — agents poll for work, which means certctl works behind firewalls, across network zones, and in air-gapped environments.
It's **target-agnostic**. Agents deploy certificates to NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, and IIS (local PowerShell or remote WinRM) — all using the same pluggable connector model. The control plane never initiates outbound connections — agents poll for work, which means certctl works behind firewalls, across network zones, and in air-gapped environments.
For a detailed comparison with CertKit, KeyTalk, and enterprise platforms, see [Why certctl?](docs/why-certctl.md)
@@ -98,6 +98,8 @@ For the full capability breakdown — revocation infrastructure (CRL + OCSP), po
| Traefik | Implemented | `Traefik` |
| Caddy | Implemented | `Caddy` |
| Envoy | Implemented | `Envoy` |
| Postfix | Implemented | `Postfix` |
| Dovecot | Implemented | `Dovecot` |
| Microsoft IIS | Implemented (local + WinRM) | `IIS` |
| F5 BIG-IP | Interface only | `F5` |
@@ -293,7 +295,7 @@ CI runs on every push: `go vet`, `go test -race`, `golangci-lint`, `govulncheck`
Core lifecycle management — Local CA + ACME v2 issuers, NGINX target connector, agent-side key generation, API auth + rate limiting, React dashboard, CI pipeline with coverage gates, Docker images on GHCR.
### V2: Operational Maturity — Shipped
30+ milestones, 1,536+ tests. Sub-CA mode, ACME DNS-01/DNS-PERSIST-01, step-ca, Vault PKI, DigiCert CertCentral, OpenSSL/Custom CA issuers. NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, IIS targets. RFC 5280 revocation with CRL + OCSP. Certificate profiles, ownership tracking, approval workflows. Filesystem and network certificate discovery. Prometheus metrics, dashboard charts, agent fleet overview. EST server (RFC 7030), ACME ARI (RFC 9702), certificate export, S/MIME support, Helm chart, MCP server, CLI, scheduled digest emails. Slack, Teams, PagerDuty, OpsGenie, SMTP notifications. Compliance mapping (SOC 2, PCI-DSS 4.0, NIST SP 800-57). See the [Feature Inventory](docs/features.md) for details.
30+ milestones, 1,554+ tests. Sub-CA mode, ACME DNS-01/DNS-PERSIST-01, step-ca, Vault PKI, DigiCert CertCentral, OpenSSL/Custom CA issuers. NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS targets. RFC 5280 revocation with CRL + OCSP. Certificate profiles, ownership tracking, approval workflows. Filesystem and network certificate discovery. Prometheus metrics, dashboard charts, agent fleet overview. EST server (RFC 7030), ACME ARI (RFC 9702), certificate export, S/MIME support, Helm chart, MCP server, CLI, scheduled digest emails. Slack, Teams, PagerDuty, OpsGenie, SMTP notifications. Compliance mapping (SOC 2, PCI-DSS 4.0, NIST SP 800-57). See the [Feature Inventory](docs/features.md) for details.
**Coming in v2.1.0:** Dynamic issuer and target configuration via GUI (no env var restarts), first-run onboarding wizard.
api/openapi.yaml
+1 -1
View File
@@ -2669,7 +2669,7 @@ components:
# ─── Targets ─────────────────────────────────────────────────────
TargetType:
type: string
enum: [NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, IIS, F5]
enum: [NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS, F5]
DeploymentTarget:
type: object
cmd/agent/main.go
+21
View File
@@ -30,6 +30,7 @@ import (
"github.com/shankar0123/certctl/internal/connector/target/apache"
"github.com/shankar0123/certctl/internal/connector/target/caddy"
"github.com/shankar0123/certctl/internal/connector/target/envoy"
pf "github.com/shankar0123/certctl/internal/connector/target/postfix"
"github.com/shankar0123/certctl/internal/connector/target/f5"
"github.com/shankar0123/certctl/internal/connector/target/haproxy"
"github.com/shankar0123/certctl/internal/connector/target/iis"
@@ -622,6 +623,26 @@ func (a *Agent) createTargetConnector(targetType string, configJSON json.RawMess
}
return envoy.New(&cfg, a.logger), nil
case "Postfix":
var cfg pf.Config
cfg.Mode = "postfix"
if len(configJSON) > 0 {
if err := json.Unmarshal(configJSON, &cfg); err != nil {
return nil, fmt.Errorf("invalid Postfix config: %w", err)
}
}
return pf.New(&cfg, a.logger), nil
case "Dovecot":
var cfg pf.Config
cfg.Mode = "dovecot"
if len(configJSON) > 0 {
if err := json.Unmarshal(configJSON, &cfg); err != nil {
return nil, fmt.Errorf("invalid Dovecot config: %w", err)
}
}
return pf.New(&cfg, a.logger), nil
default:
return nil, fmt.Errorf("unsupported target type: %s", targetType)
}
docs/connectors.md
+44
View File
@@ -22,6 +22,7 @@ Connectors extend certctl to integrate with external systems for certificate iss
- [Built-in: HAProxy](#built-in-haproxy)
- [Built-in: Traefik](#built-in-traefik)
- [Built-in: Envoy](#built-in-envoy)
- [Built-in: Postfix / Dovecot](#built-in-postfix--dovecot)
- [Built-in: Caddy](#built-in-caddy)
- [F5 BIG-IP (Interface Only)](#f5-big-ip-interface-only)
- [IIS (Implemented, Dual-Mode)](#iis-implemented-dual-mode)
@@ -620,6 +621,49 @@ When `sds_config` is `false` (the default), the connector simply writes cert and
Location: `internal/connector/target/envoy/envoy.go`
### Built-in: Postfix / Dovecot
The Postfix/Dovecot connector is a dual-mode mail server TLS connector. It writes certificate, key, and chain files to configured paths and reloads the mail service. The `mode` field selects between Postfix MTA and Dovecot IMAP/POP3, which determines default file paths and reload commands.
This connector pairs with certctl's S/MIME certificate support (email protection EKU, email SAN routing) for a complete email infrastructure story — TLS for transport encryption, S/MIME for end-to-end message signing and encryption.
**Postfix configuration:**
```json
{
"mode": "postfix",
"cert_path": "/etc/postfix/certs/cert.pem",
"key_path": "/etc/postfix/certs/key.pem",
"chain_path": "/etc/postfix/certs/chain.pem",
"reload_command": "postfix reload",
"validate_command": "postfix check"
}
```
**Dovecot configuration:**
```json
{
"mode": "dovecot",
"cert_path": "/etc/dovecot/certs/cert.pem",
"key_path": "/etc/dovecot/certs/key.pem",
"chain_path": "/etc/dovecot/certs/chain.pem",
"reload_command": "doveadm reload",
"validate_command": "doveconf -n"
}
```
| Field | Type | Default (Postfix) | Default (Dovecot) | Description |
|-------|------|-------------------|-------------------|-------------|
| `mode` | string | `postfix` | `dovecot` | Service mode — determines defaults |
| `cert_path` | string | `/etc/postfix/certs/cert.pem` | `/etc/dovecot/certs/cert.pem` | Path for certificate file |
| `key_path` | string | `/etc/postfix/certs/key.pem` | `/etc/dovecot/certs/key.pem` | Path for private key (0600 permissions) |
| `chain_path` | string | (empty) | (empty) | If set, chain written separately; otherwise appended to cert |
| `reload_command` | string | `postfix reload` | `doveadm reload` | Command to reload the mail service |
| `validate_command` | string | `postfix check` | `doveconf -n` | Optional config validation before reload |
All commands are validated against shell injection via `validation.ValidateShellCommand()`. File permissions: cert/chain 0644, key 0600.
Location: `internal/connector/target/postfix/postfix.go`
### F5 BIG-IP (Interface Only)
The F5 BIG-IP target connector interface is defined with the iControl REST flow mapped out, but the actual API calls are not yet implemented. F5 appliances can't run agents directly, so this connector uses the **proxy agent pattern**: a designated agent in the same network zone picks up F5 deployment jobs and calls the iControl REST API. The server assigns the work; the proxy agent executes it.
internal/connector/target/postfix/postfix.go
+310
View File
@@ -0,0 +1,310 @@
package postfix
import (
"context"
"encoding/json"
"fmt"
"log/slog"
"os"
"os/exec"
"path/filepath"
"time"
"github.com/shankar0123/certctl/internal/connector/target"
"github.com/shankar0123/certctl/internal/validation"
)
// Config represents the Postfix/Dovecot deployment target configuration.
// This connector supports dual-mode operation: "postfix" for Postfix MTA
// and "dovecot" for Dovecot IMAP/POP3. The mode determines default file
// paths and reload commands. Both modes write cert/key/chain files and
// reload the mail service.
type Config struct {
Mode string `json:"mode"` // "postfix" (default) or "dovecot"
CertPath string `json:"cert_path"` // Path where cert will be written
KeyPath string `json:"key_path"` // Path where private key will be written
ChainPath string `json:"chain_path"` // Path where CA chain will be written (optional — if empty, chain appended to cert)
ReloadCommand string `json:"reload_command"` // Command to reload service
ValidateCommand string `json:"validate_command"` // Optional command to validate config before reload
}
// Connector implements the target.Connector interface for Postfix and Dovecot
// mail servers. This connector runs on the AGENT side and handles local
// certificate deployment for mail server TLS (STARTTLS, SMTPS, IMAPS, POP3S).
type Connector struct {
config *Config
logger *slog.Logger
}
// New creates a new Postfix/Dovecot target connector with the given configuration and logger.
func New(config *Config, logger *slog.Logger) *Connector {
return &Connector{
config: config,
logger: logger,
}
}
// applyDefaults sets mode-specific default values for any unconfigured fields.
func applyDefaults(cfg *Config) {
if cfg.Mode == "" {
cfg.Mode = "postfix"
}
switch cfg.Mode {
case "dovecot":
if cfg.CertPath == "" {
cfg.CertPath = "/etc/dovecot/certs/cert.pem"
}
if cfg.KeyPath == "" {
cfg.KeyPath = "/etc/dovecot/certs/key.pem"
}
if cfg.ReloadCommand == "" {
cfg.ReloadCommand = "doveadm reload"
}
if cfg.ValidateCommand == "" {
cfg.ValidateCommand = "doveconf -n"
}
default: // "postfix"
if cfg.CertPath == "" {
cfg.CertPath = "/etc/postfix/certs/cert.pem"
}
if cfg.KeyPath == "" {
cfg.KeyPath = "/etc/postfix/certs/key.pem"
}
if cfg.ReloadCommand == "" {
cfg.ReloadCommand = "postfix reload"
}
if cfg.ValidateCommand == "" {
cfg.ValidateCommand = "postfix check"
}
}
}
// ValidateConfig checks that the configuration is valid for the selected mode.
// It applies mode-specific defaults, validates shell commands against injection,
// and verifies the certificate directory exists.
func (c *Connector) ValidateConfig(ctx context.Context, rawConfig json.RawMessage) error {
var cfg Config
if err := json.Unmarshal(rawConfig, &cfg); err != nil {
return fmt.Errorf("invalid mail server config: %w", err)
}
// Validate mode
if cfg.Mode != "" && cfg.Mode != "postfix" && cfg.Mode != "dovecot" {
return fmt.Errorf("invalid mode %q: must be \"postfix\" or \"dovecot\"", cfg.Mode)
}
// Apply mode-specific defaults
applyDefaults(&cfg)
// Validate commands to prevent injection attacks
if err := validation.ValidateShellCommand(cfg.ReloadCommand); err != nil {
return fmt.Errorf("invalid reload_command: %w", err)
}
if cfg.ValidateCommand != "" {
if err := validation.ValidateShellCommand(cfg.ValidateCommand); err != nil {
return fmt.Errorf("invalid validate_command: %w", err)
}
}
c.logger.Info("validating mail server configuration",
"mode", cfg.Mode,
"cert_path", cfg.CertPath,
"key_path", cfg.KeyPath,
"chain_path", cfg.ChainPath)
// Verify certificate directory exists
certDir := filepath.Dir(cfg.CertPath)
if _, err := os.Stat(certDir); os.IsNotExist(err) {
return fmt.Errorf("%s cert directory does not exist: %s", cfg.Mode, certDir)
}
// Verify validate command works (best-effort — service might not be installed yet)
if cfg.ValidateCommand != "" {
cmd := exec.CommandContext(ctx, "sh", "-c", cfg.ValidateCommand)
if err := cmd.Run(); err != nil {
c.logger.Warn("config validation command failed during config check",
"error", err,
"mode", cfg.Mode,
"validate_command", cfg.ValidateCommand)
}
}
c.config = &cfg
c.logger.Info("mail server configuration validated", "mode", cfg.Mode)
return nil
}
// DeployCertificate writes the certificate, key, and chain to the configured paths
// and reloads the mail service to pick up the new certificates.
//
// Steps:
// 1. Write certificate to cert_path with mode 0644 (if chain_path empty, append chain)
// 2. Write private key to key_path with mode 0600
// 3. If chain_path is set, write chain separately with mode 0644
// 4. Validate configuration (if validate_command is set)
// 5. Reload service
func (c *Connector) DeployCertificate(ctx context.Context, request target.DeploymentRequest) (*target.DeploymentResult, error) {
c.logger.Info("deploying certificate to mail server",
"mode", c.config.Mode,
"cert_path", c.config.CertPath,
"key_path", c.config.KeyPath)
startTime := time.Now()
// Build certificate data: if chain_path is set, write chain separately;
// otherwise append chain to cert file (fullchain behavior)
certData := request.CertPEM
if request.ChainPEM != "" && c.config.ChainPath == "" {
certData += "\n" + request.ChainPEM
}
// Write certificate with mode 0644 (rw-r--r--)
if err := os.WriteFile(c.config.CertPath, []byte(certData), 0644); err != nil {
errMsg := fmt.Sprintf("failed to write certificate: %v", err)
c.logger.Error("certificate deployment failed", "error", err)
return &target.DeploymentResult{
Success: false,
TargetAddress: c.config.CertPath,
Message: errMsg,
DeployedAt: time.Now(),
}, fmt.Errorf("%s", errMsg)
}
// Write private key with secure permissions (0600: rw-------)
if c.config.KeyPath != "" && request.KeyPEM != "" {
if err := os.WriteFile(c.config.KeyPath, []byte(request.KeyPEM), 0600); err != nil {
errMsg := fmt.Sprintf("failed to write private key: %v", err)
c.logger.Error("key deployment failed", "error", err)
return &target.DeploymentResult{
Success: false,
TargetAddress: c.config.KeyPath,
Message: errMsg,
DeployedAt: time.Now(),
}, fmt.Errorf("%s", errMsg)
}
c.logger.Info("private key written", "key_path", c.config.KeyPath)
}
// Write chain separately if chain_path is configured
if c.config.ChainPath != "" && request.ChainPEM != "" {
if err := os.WriteFile(c.config.ChainPath, []byte(request.ChainPEM), 0644); err != nil {
errMsg := fmt.Sprintf("failed to write chain: %v", err)
c.logger.Error("chain deployment failed", "error", err)
return &target.DeploymentResult{
Success: false,
TargetAddress: c.config.ChainPath,
Message: errMsg,
DeployedAt: time.Now(),
}, fmt.Errorf("%s", errMsg)
}
}
// Validate configuration before reload
if c.config.ValidateCommand != "" {
c.logger.Debug("validating configuration", "validate_command", c.config.ValidateCommand)
validateCmd := exec.CommandContext(ctx, "sh", "-c", c.config.ValidateCommand)
if output, err := validateCmd.CombinedOutput(); err != nil {
errMsg := fmt.Sprintf("%s config validation failed: %v (output: %s)", c.config.Mode, err, string(output))
c.logger.Error("config validation failed", "error", err, "output", string(output))
return &target.DeploymentResult{
Success: false,
TargetAddress: c.config.CertPath,
Message: errMsg,
DeployedAt: time.Now(),
}, fmt.Errorf("%s", errMsg)
}
}
// Reload service
c.logger.Debug("reloading service", "reload_command", c.config.ReloadCommand)
reloadCmd := exec.CommandContext(ctx, "sh", "-c", c.config.ReloadCommand)
if output, err := reloadCmd.CombinedOutput(); err != nil {
errMsg := fmt.Sprintf("%s reload failed: %v (output: %s)", c.config.Mode, err, string(output))
c.logger.Error("service reload failed", "error", err, "output", string(output))
return &target.DeploymentResult{
Success: false,
TargetAddress: c.config.CertPath,
Message: errMsg,
DeployedAt: time.Now(),
}, fmt.Errorf("%s", errMsg)
}
deploymentDuration := time.Since(startTime)
c.logger.Info("certificate deployed to mail server successfully",
"mode", c.config.Mode,
"duration", deploymentDuration.String(),
"cert_path", c.config.CertPath)
return &target.DeploymentResult{
Success: true,
TargetAddress: c.config.CertPath,
DeploymentID: fmt.Sprintf("%s-%d", c.config.Mode, time.Now().Unix()),
Message: fmt.Sprintf("Certificate deployed and %s reloaded successfully", c.config.Mode),
DeployedAt: time.Now(),
Metadata: map[string]string{
"cert_path": c.config.CertPath,
"key_path": c.config.KeyPath,
"mode": c.config.Mode,
"duration_ms": fmt.Sprintf("%d", deploymentDuration.Milliseconds()),
},
}, nil
}
// ValidateDeployment verifies that the deployed certificate is valid and accessible.
// It runs the validate command (if configured) and checks that the cert file exists.
func (c *Connector) ValidateDeployment(ctx context.Context, request target.ValidationRequest) (*target.ValidationResult, error) {
c.logger.Info("validating mail server deployment",
"mode", c.config.Mode,
"certificate_id", request.CertificateID,
"serial", request.Serial)
startTime := time.Now()
// Validate configuration if validate command is set
if c.config.ValidateCommand != "" {
validateCmd := exec.CommandContext(ctx, "sh", "-c", c.config.ValidateCommand)
if output, err := validateCmd.CombinedOutput(); err != nil {
errMsg := fmt.Sprintf("%s config validation failed: %v (output: %s)", c.config.Mode, err, string(output))
c.logger.Error("validation failed", "error", err)
return &target.ValidationResult{
Valid: false,
Serial: request.Serial,
TargetAddress: c.config.CertPath,
Message: errMsg,
ValidatedAt: time.Now(),
}, fmt.Errorf("%s", errMsg)
}
}
// Verify certificate file exists and is readable
if _, err := os.Stat(c.config.CertPath); os.IsNotExist(err) {
errMsg := fmt.Sprintf("certificate file not found: %s", c.config.CertPath)
c.logger.Error("validation failed", "error", err)
return &target.ValidationResult{
Valid: false,
Serial: request.Serial,
TargetAddress: c.config.CertPath,
Message: errMsg,
ValidatedAt: time.Now(),
}, fmt.Errorf("%s", errMsg)
}
validationDuration := time.Since(startTime)
c.logger.Info("mail server deployment validated successfully",
"mode", c.config.Mode,
"duration", validationDuration.String())
return &target.ValidationResult{
Valid: true,
Serial: request.Serial,
TargetAddress: c.config.CertPath,
Message: fmt.Sprintf("%s configuration valid and certificate accessible", c.config.Mode),
ValidatedAt: time.Now(),
Metadata: map[string]string{
"mode": c.config.Mode,
"validate_command": c.config.ValidateCommand,
"duration_ms": fmt.Sprintf("%d", validationDuration.Milliseconds()),
},
}, nil
}
internal/connector/target/postfix/postfix_test.go
+530
View File
@@ -0,0 +1,530 @@
package postfix_test
import (
"context"
"encoding/json"
"log/slog"
"os"
"path/filepath"
"strings"
"testing"
"github.com/shankar0123/certctl/internal/connector/target"
"github.com/shankar0123/certctl/internal/connector/target/postfix"
)
// --- Config Validation Tests ---
func TestPostfixConnector_ValidateConfig_Success(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ChainPath: filepath.Join(tmpDir, "chain.pem"),
ReloadCommand: "true",
ValidateCommand: "true",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err != nil {
t.Fatalf("ValidateConfig failed: %v", err)
}
}
func TestPostfixConnector_ValidateConfig_DovecotMode(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := postfix.Config{
Mode: "dovecot",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ReloadCommand: "true",
ValidateCommand: "true",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err != nil {
t.Fatalf("ValidateConfig for dovecot mode failed: %v", err)
}
}
func TestPostfixConnector_ValidateConfig_InvalidJSON(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
connector := postfix.New(&postfix.Config{}, logger)
err := connector.ValidateConfig(ctx, json.RawMessage(`{invalid}`))
if err == nil {
t.Fatal("expected error for invalid JSON")
}
}
func TestPostfixConnector_ValidateConfig_InvalidMode(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
cfg := postfix.Config{
Mode: "nginx",
CertPath: "/tmp/cert.pem",
ReloadCommand: "true",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err == nil {
t.Fatal("expected error for invalid mode")
}
if !strings.Contains(err.Error(), "invalid mode") {
t.Fatalf("expected 'invalid mode' error, got: %v", err)
}
}
func TestPostfixConnector_ValidateConfig_DirectoryNotExists(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
cfg := postfix.Config{
Mode: "postfix",
CertPath: "/nonexistent/directory/cert.pem",
KeyPath: "/nonexistent/directory/key.pem",
ReloadCommand: "true",
ValidateCommand: "true",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err == nil {
t.Fatal("expected error for non-existent cert directory")
}
}
func TestPostfixConnector_ValidateConfig_MissingCertPath(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
// An empty config with mode=postfix will get defaults applied.
// The defaults point to /etc/postfix/certs/ which won't exist in test,
// so this will fail at directory check — which is fine; it validates that
// defaults are applied and path validation catches missing dirs.
cfg := postfix.Config{
Mode: "postfix",
ReloadCommand: "true",
ValidateCommand: "true",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err == nil {
t.Fatal("expected error when default cert directory doesn't exist")
}
}
func TestPostfixConnector_ValidateConfig_DefaultsApplied(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
// Create a directory matching the postfix default path structure
tmpDir := t.TempDir()
certDir := filepath.Join(tmpDir, "postfix", "certs")
os.MkdirAll(certDir, 0755)
cfg := postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(certDir, "cert.pem"),
KeyPath: filepath.Join(certDir, "key.pem"),
// Leave ReloadCommand and ValidateCommand empty to get defaults
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
// Defaults will be applied for reload/validate commands.
// The validate command will be "postfix check" which won't exist in test env
// but ValidateConfig only warns on validate command failure (doesn't error).
// The reload command "postfix reload" will be validated by ValidateShellCommand.
err := connector.ValidateConfig(ctx, rawConfig)
if err != nil {
t.Fatalf("ValidateConfig with defaults failed: %v", err)
}
}
// --- Deployment Tests ---
func TestPostfixConnector_DeployCertificate_Success(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := &postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ChainPath: filepath.Join(tmpDir, "chain.pem"),
ReloadCommand: "true",
ValidateCommand: "true",
}
connector := postfix.New(cfg, logger)
req := target.DeploymentRequest{
CertPEM: "-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----",
KeyPEM: "-----BEGIN PRIVATE KEY-----\nkey\n-----END PRIVATE KEY-----",
ChainPEM: "-----BEGIN CERTIFICATE-----\nchain\n-----END CERTIFICATE-----",
}
result, err := connector.DeployCertificate(ctx, req)
if err != nil {
t.Fatalf("DeployCertificate failed: %v", err)
}
if !result.Success {
t.Fatalf("expected success, got: %s", result.Message)
}
// Verify cert file was written (just cert, not chain — since chain_path is set)
certData, err := os.ReadFile(cfg.CertPath)
if err != nil {
t.Fatalf("failed to read cert file: %v", err)
}
if string(certData) != req.CertPEM {
t.Errorf("cert content mismatch: got %q", string(certData))
}
// Verify key file was written
keyData, err := os.ReadFile(cfg.KeyPath)
if err != nil {
t.Fatalf("failed to read key file: %v", err)
}
if string(keyData) != req.KeyPEM {
t.Errorf("key content mismatch")
}
// Verify chain file was written
chainData, err := os.ReadFile(cfg.ChainPath)
if err != nil {
t.Fatalf("failed to read chain file: %v", err)
}
if string(chainData) != req.ChainPEM {
t.Errorf("chain content mismatch")
}
// Verify cert has correct permissions (0644)
info, err := os.Stat(cfg.CertPath)
if err != nil {
t.Fatalf("failed to stat cert file: %v", err)
}
if info.Mode().Perm() != 0644 {
t.Errorf("expected cert permissions 0644, got %v", info.Mode().Perm())
}
// Verify key has correct permissions (0600)
info, err = os.Stat(cfg.KeyPath)
if err != nil {
t.Fatalf("failed to stat key file: %v", err)
}
if info.Mode().Perm() != 0600 {
t.Errorf("expected key permissions 0600, got %v", info.Mode().Perm())
}
// Verify metadata
if result.Metadata == nil {
t.Fatal("expected metadata in result")
}
if result.Metadata["cert_path"] != cfg.CertPath {
t.Errorf("expected cert_path in metadata")
}
if result.Metadata["mode"] != "postfix" {
t.Errorf("expected mode=postfix in metadata, got %s", result.Metadata["mode"])
}
if _, ok := result.Metadata["duration_ms"]; !ok {
t.Errorf("expected duration_ms in metadata")
}
}
func TestPostfixConnector_DeployCertificate_ChainAppendedToCert(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := &postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ChainPath: "", // No chain_path — chain should be appended to cert
ReloadCommand: "true",
ValidateCommand: "true",
}
connector := postfix.New(cfg, logger)
certPEM := "-----BEGIN CERTIFICATE-----\ncert\n-----END CERTIFICATE-----"
chainPEM := "-----BEGIN CERTIFICATE-----\nchain\n-----END CERTIFICATE-----"
req := target.DeploymentRequest{
CertPEM: certPEM,
KeyPEM: "-----BEGIN PRIVATE KEY-----\nkey\n-----END PRIVATE KEY-----",
ChainPEM: chainPEM,
}
result, err := connector.DeployCertificate(ctx, req)
if err != nil {
t.Fatalf("DeployCertificate failed: %v", err)
}
if !result.Success {
t.Fatalf("expected success, got: %s", result.Message)
}
// Verify cert file contains both cert and chain (fullchain)
certData, err := os.ReadFile(cfg.CertPath)
if err != nil {
t.Fatalf("failed to read cert file: %v", err)
}
expected := certPEM + "\n" + chainPEM
if string(certData) != expected {
t.Errorf("expected fullchain content, got: %q", string(certData))
}
}
func TestPostfixConnector_DeployCertificate_CertWriteFail(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
cfg := &postfix.Config{
Mode: "postfix",
CertPath: "/nonexistent/directory/cert.pem",
KeyPath: "/nonexistent/directory/key.pem",
ReloadCommand: "true",
ValidateCommand: "true",
}
connector := postfix.New(cfg, logger)
req := target.DeploymentRequest{
CertPEM: "cert",
ChainPEM: "chain",
}
result, err := connector.DeployCertificate(ctx, req)
if err == nil {
t.Fatal("expected error when cert write fails")
}
if result.Success {
t.Fatal("expected failure result")
}
}
func TestPostfixConnector_DeployCertificate_ValidateCommandFails(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := &postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ReloadCommand: "true",
ValidateCommand: "false", // Exits with code 1
}
connector := postfix.New(cfg, logger)
req := target.DeploymentRequest{
CertPEM: "cert",
ChainPEM: "chain",
}
result, err := connector.DeployCertificate(ctx, req)
if err == nil {
t.Fatal("expected error when validate command fails")
}
if result.Success {
t.Fatal("expected failure result")
}
}
func TestPostfixConnector_DeployCertificate_ReloadCommandFails(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := &postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ReloadCommand: "false", // Exits with code 1
ValidateCommand: "true",
}
connector := postfix.New(cfg, logger)
req := target.DeploymentRequest{
CertPEM: "cert",
ChainPEM: "chain",
}
result, err := connector.DeployCertificate(ctx, req)
if err == nil {
t.Fatal("expected error when reload command fails")
}
if result.Success {
t.Fatal("expected failure result")
}
}
// --- Validation Tests ---
func TestPostfixConnector_ValidateDeployment_Success(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
certPath := filepath.Join(tmpDir, "cert.pem")
os.WriteFile(certPath, []byte("cert"), 0644)
cfg := &postfix.Config{
Mode: "postfix",
CertPath: certPath,
ValidateCommand: "true",
}
connector := postfix.New(cfg, logger)
result, err := connector.ValidateDeployment(ctx, target.ValidationRequest{
CertificateID: "mc-test",
Serial: "123",
})
if err != nil {
t.Fatalf("ValidateDeployment failed: %v", err)
}
if !result.Valid {
t.Fatal("expected valid deployment")
}
if result.Metadata == nil {
t.Fatal("expected metadata in result")
}
if result.Metadata["mode"] != "postfix" {
t.Errorf("expected mode=postfix in metadata")
}
}
func TestPostfixConnector_ValidateDeployment_CertNotFound(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
cfg := &postfix.Config{
Mode: "postfix",
CertPath: "/nonexistent/cert.pem",
ValidateCommand: "true",
}
connector := postfix.New(cfg, logger)
result, err := connector.ValidateDeployment(ctx, target.ValidationRequest{
CertificateID: "mc-test",
Serial: "123",
})
if err == nil {
t.Fatal("expected error for missing cert file")
}
if result.Valid {
t.Fatal("expected invalid result")
}
}
// --- Security Tests (Command Injection Prevention) ---
func TestPostfixConnector_ValidateConfig_RejectCommandInjectionSemicolon(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ReloadCommand: "postfix reload; rm -rf /",
ValidateCommand: "true",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err == nil {
t.Fatal("expected error for command injection in reload_command")
}
}
func TestPostfixConnector_ValidateConfig_RejectCommandInjectionPipe(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ReloadCommand: "true",
ValidateCommand: "postfix check | cat /etc/passwd",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err == nil {
t.Fatal("expected error for command injection in validate_command")
}
}
func TestPostfixConnector_ValidateConfig_RejectCommandSubstitution(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ReloadCommand: "echo $(whoami)",
ValidateCommand: "true",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err == nil {
t.Fatal("expected error for command substitution in reload_command")
}
}
func TestPostfixConnector_ValidateConfig_RejectBackticks(t *testing.T) {
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}))
ctx := context.Background()
tmpDir := t.TempDir()
cfg := postfix.Config{
Mode: "postfix",
CertPath: filepath.Join(tmpDir, "cert.pem"),
KeyPath: filepath.Join(tmpDir, "key.pem"),
ReloadCommand: "true",
ValidateCommand: "postfix check `whoami`",
}
connector := postfix.New(&cfg, logger)
rawConfig, _ := json.Marshal(cfg)
err := connector.ValidateConfig(ctx, rawConfig)
if err == nil {
t.Fatal("expected error for backtick injection in validate_command")
}
}
internal/domain/connector.go
+2
View File
@@ -85,4 +85,6 @@ const (
TargetTypeTraefik TargetType = "Traefik"
TargetTypeCaddy TargetType = "Caddy"
TargetTypeEnvoy TargetType = "Envoy"
TargetTypePostfix TargetType = "Postfix"
TargetTypeDovecot TargetType = "Dovecot"
)
web/src/pages/TargetsPage.tsx
+18
View File
@@ -17,6 +17,8 @@ const typeLabels: Record<string, string> = {
traefik: 'Traefik',
caddy: 'Caddy',
envoy: 'Envoy',
postfix: 'Postfix',
dovecot: 'Dovecot',
f5_bigip: 'F5 BIG-IP',
iis: 'IIS',
};
@@ -28,6 +30,8 @@ const TARGET_TYPES = [
{ value: 'traefik', label: 'Traefik', description: 'File provider deployment — writes cert/key to watched directory, auto-reload' },
{ value: 'caddy', label: 'Caddy', description: 'Admin API hot-reload or file-based deployment with configurable mode' },
{ value: 'envoy', label: 'Envoy', description: 'File-based deployment — writes cert/key to watched directory. Optional SDS file generation.' },
{ value: 'postfix', label: 'Postfix', description: 'Postfix MTA — file write + postfix reload' },
{ value: 'dovecot', label: 'Dovecot', description: 'Dovecot IMAP/POP3 — file write + doveadm reload' },
{ value: 'f5_bigip', label: 'F5 BIG-IP', description: 'iControl REST via proxy agent (V3 implementation)' },
{ value: 'iis', label: 'IIS', description: 'Windows IIS via agent-local PowerShell or remote WinRM proxy agent' },
];
@@ -69,6 +73,20 @@ const CONFIG_FIELDS: Record<string, { key: string; label: string; placeholder: s
{ key: 'chain_filename', label: 'Chain Filename (optional)', placeholder: 'chain.pem (leave empty to append to cert)' },
{ key: 'sds_config', label: 'Generate SDS Config', placeholder: 'true or false' },
],
postfix: [
{ key: 'cert_path', label: 'Certificate Path', placeholder: '/etc/postfix/certs/cert.pem' },
{ key: 'key_path', label: 'Key Path', placeholder: '/etc/postfix/certs/key.pem' },
{ key: 'chain_path', label: 'Chain Path (optional)', placeholder: '/etc/postfix/certs/chain.pem' },
{ key: 'reload_command', label: 'Reload Command', placeholder: 'postfix reload' },
{ key: 'validate_command', label: 'Validate Command', placeholder: 'postfix check' },
],
dovecot: [
{ key: 'cert_path', label: 'Certificate Path', placeholder: '/etc/dovecot/certs/cert.pem' },
{ key: 'key_path', label: 'Key Path', placeholder: '/etc/dovecot/certs/key.pem' },
{ key: 'chain_path', label: 'Chain Path (optional)', placeholder: '/etc/dovecot/certs/chain.pem' },
{ key: 'reload_command', label: 'Reload Command', placeholder: 'doveadm reload' },
{ key: 'validate_command', label: 'Validate Command', placeholder: 'doveconf -n' },
],
f5_bigip: [
{ key: 'management_ip', label: 'Management IP', placeholder: '192.168.1.100', required: true },
{ key: 'partition', label: 'Partition', placeholder: 'Common' },