<?php
/**
* SeekQuarry/Yioop --
* Open Source Pure PHP Search Engine, Crawler, and Indexer
*
* Copyright (C) 2009 - 2026 Chris Pollett chris@pollett.org
*
* LICENSE:
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* END LICENSE
*
* @author Chris Pollett chris@pollett.org
* @license https://www.gnu.org/licenses/ GPL3
* @link https://www.seekquarry.com/
* @copyright 2009 - 2026
* @filesource
*/
namespace seekquarry\yioop\tests;
/*
* Signal MailServer.php to define its class without running any of
* its executable top-level code, so loading it for this test never
* boots the daemon or disturbs a running web server. Defined
* before the MailServer class is referenced below.
*/
if (!defined(
"seekquarry\\yioop\\executables\\MAIL_SERVER_TEST_LOAD")) {
define("seekquarry\\yioop\\executables\\MAIL_SERVER_TEST_LOAD",
true);
}
use seekquarry\yioop\executables\MailServer;
use seekquarry\yioop\library\UnitTest;
/**
* Tests for MailServer::deriveListenConfig, the pure function that
* turns the mail settings into the listener configuration array
* MailSite::listen consumes. The cases walk the decision matrix:
* TLS available or not, STARTTLS versus implicit TLS, each delivery
* posture, and loopback versus external binding. Because the
* function takes its inputs as arguments and returns an array, the
* cases are self-contained; no setUp data or teardown is required.
*
* @author Chris Pollett
*/
class MailServerConfigTest extends UnitTest
{
/**
* The conventional port settings used by most cases: plaintext
* SMTP 25 and IMAP 143, secure SMTPS 465 and IMAPS 993.
* @var array
*/
public $ports;
/**
* A SERVER_CONTEXT carrying an ssl block, standing in for a
* configured certificate so TLS is available.
* @var array
*/
public $ssl_context;
/**
* Sets up the shared port map and a TLS-bearing server
* context reused across cases.
*/
public function setUp()
{
$this->ports = ['smtp' => 25, 'submission' => 587,
'imap' => 143, 'smtps' => 465, 'imaps' => 993];
$this->ssl_context = ['ssl' =>
['local_cert' => '/x.crt', 'local_pk' => '/x.key']];
}
/**
* No teardown needed; the function under test is pure.
*/
public function tearDown()
{
}
/**
* Calls deriveListenConfig with this test's standard inputs,
* allowing each argument to be overridden.
* @param array $server_context SERVER_CONTEXT to pass
* @param string $posture delivery-security posture
* @param bool $use_starttls STARTTLS versus implicit TLS
* @param bool $external public versus loopback bind
* @param array $ports optional port-map override
* @return array the derived listen configuration
*/
public function derive($server_context, $posture, $use_starttls,
$external, $ports = null)
{
$ports = ($ports === null) ? $this->ports : $ports;
return MailServer::deriveListenConfig($ports,
$server_context, $posture, $use_starttls, $external,
'mail.example.com');
}
/**
* With no certificate the secure ports stay closed, STARTTLS
* cannot be offered, and SERVER_CONTEXT is not forwarded to
* listen.
*/
public function noCertificateClosesSecurePortsTestCase()
{
$config = $this->derive([], 'insecure', false, false);
$this->assertEqual(25, $config['SMTP_PORT'],
"plaintext SMTP binds on 25 without a cert");
$this->assertEqual(143, $config['IMAP_PORT'],
"plaintext IMAP binds on 143 without a cert");
$this->assertEqual(587, $config['SUBMISSION_PORT'],
"submission port binds without a cert");
$this->assertEqual(0, $config['SMTPS_PORT'],
"no implicit SMTPS socket without a cert");
$this->assertEqual(0, $config['IMAPS_PORT'],
"no implicit IMAPS socket without a cert");
$this->assertTrue(!isset($config['SERVER_CONTEXT']),
"SERVER_CONTEXT not forwarded when no cert");
}
/**
* The insecure posture allows plaintext AUTH even when a
* certificate is present.
*/
public function insecurePostureAllowsPlaintextAuthTestCase()
{
$config = $this->derive($this->ssl_context, 'insecure',
false, true);
$this->assertTrue($config['ALLOW_PLAINTEXT_AUTH'],
"insecure posture allows plaintext AUTH");
}
/**
* With a certificate, STARTTLS selected, and a secure posture,
* every listener opens together: the plaintext SMTP, submission,
* and IMAP ports (which upgrade with STARTTLS) plus the wrapped
* implicit-TLS SMTPS and IMAPS ports. Plaintext AUTH is refused
* and the context is forwarded. This replaces the earlier
* either/or in which STARTTLS moved the listeners onto the
* secure port numbers and left no implicit-TLS socket.
*/
public function starttlsOpensAllPortsTestCase()
{
$config = $this->derive($this->ssl_context, 'spam', true,
false);
$this->assertEqual(25, $config['SMTP_PORT'],
"STARTTLS: plaintext SMTP stays on 25");
$this->assertEqual(587, $config['SUBMISSION_PORT'],
"STARTTLS: submission listener opens on 587");
$this->assertEqual(143, $config['IMAP_PORT'],
"STARTTLS: plaintext IMAP stays on 143");
$this->assertEqual(465, $config['SMTPS_PORT'],
"STARTTLS: wrapped SMTPS still opens on 465");
$this->assertEqual(993, $config['IMAPS_PORT'],
"STARTTLS: wrapped IMAPS still opens on 993");
$this->assertTrue(!$config['ALLOW_PLAINTEXT_AUTH'],
"spam posture refuses plaintext AUTH");
$this->assertTrue(isset($config['SERVER_CONTEXT']),
"SERVER_CONTEXT forwarded when a cert is present");
}
/**
* With a certificate and implicit TLS, the plaintext listeners
* keep the plaintext-port settings (for inbound mail and
* opportunistic STARTTLS) and the secure ports open additional
* implicit-TLS sockets.
*/
public function implicitTlsOpensWrappedSecurePortsTestCase()
{
$config = $this->derive($this->ssl_context, 'require',
false, true);
$this->assertEqual(25, $config['SMTP_PORT'],
"implicit: plaintext SMTP stays on 25");
$this->assertEqual(143, $config['IMAP_PORT'],
"implicit: plaintext IMAP stays on 143");
$this->assertEqual(465, $config['SMTPS_PORT'],
"implicit: wrapped SMTPS opens on 465");
$this->assertEqual(993, $config['IMAPS_PORT'],
"implicit: wrapped IMAPS opens on 993");
$this->assertTrue(!$config['ALLOW_PLAINTEXT_AUTH'],
"require posture refuses plaintext AUTH");
}
/**
* A loopback bind with no certificate still allows plaintext
* AUTH even under a secure posture, so a developer rig that
* cannot offer TLS is not locked out of its own mailbox.
*/
public function loopbackNoCertAllowsPlaintextAuthTestCase()
{
$config = $this->derive([], 'spam', false, false);
$this->assertTrue($config['ALLOW_PLAINTEXT_AUTH'],
"loopback without a cert keeps plaintext AUTH usable");
$this->assertEqual('127.0.0.1', $config['BIND'],
"loopback bind is 127.0.0.1");
}
/**
* An external secure posture with no certificate refuses
* plaintext AUTH: the bind is public, so the loopback
* exception does not apply and credentials must not cross the
* network in the clear.
*/
public function externalNoCertRefusesPlaintextAuthTestCase()
{
$config = $this->derive([], 'require', false, true);
$this->assertTrue(!$config['ALLOW_PLAINTEXT_AUTH'],
"external secure posture refuses plaintext AUTH");
$this->assertEqual('0.0.0.0', $config['BIND'],
"external bind is 0.0.0.0");
}
/**
* STARTTLS requested but no certificate present falls back to
* the plaintext-port settings with no secure sockets, because
* STARTTLS cannot be offered without a cert.
*/
public function starttlsWithoutCertFallsBackTestCase()
{
$config = $this->derive([], 'insecure', true, false);
$this->assertEqual(25, $config['SMTP_PORT'],
"no cert: SMTP stays on the plaintext port");
$this->assertEqual(143, $config['IMAP_PORT'],
"no cert: IMAP stays on the plaintext port");
$this->assertEqual(0, $config['SMTPS_PORT'],
"no cert: no secure SMTP socket even with STARTTLS on");
$this->assertEqual(0, $config['IMAPS_PORT'],
"no cert: no secure IMAP socket even with STARTTLS on");
}
}
(c) 2026 Seekquarry - Open Source Search Engine Software