majic-ansible-roles Changeset

Changeset - 9254a5c167c6

Parent rev.

Child rev.

[Not reviewed]

0 3 0

Branko Majic (branko) - 5 years ago 2020-09-23 19:54:18
branko@majic.rs

MAR-158: Deduplicate SMTP/IMAP TLS connectivity tests in mail_server role.

3 files changed with 35 insertions and 58 deletions:

roles/mail_server/molecule/default/tests/test_default.py

roles/mail_server/molecule/default/tests/test_mandatory.py

roles/mail_server/molecule/default/tests/test_optional.py

0 comments (0 inline, 0 general)

roles/mail_server/molecule/default/tests/test_default.py

➞

Show inline comments

@@ @@ -426,24 +426,59 @@ def test_imap_and_smtp_tls_files(host): @@
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o640
         assert tls_file.content_string == open("tests/data/x509/server/%s_smtp.key.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/certs/%s_smtp.pem' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o644
         assert tls_file.content_string == open("tests/data/x509/server/%s_smtp.cert.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/private/%s_imap.key' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o640
         assert tls_file.content_string == open("tests/data/x509/server/%s_imap.key.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/certs/%s_imap.pem' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o644
         assert tls_file.content_string == open("tests/data/x509/server/%s_imap.cert.pem" % hostname, "r").read().rstrip()
 def test_imap_tls_connectivity(host):
     """
     Tests connectivity over STARTTLS/TLS towards IMAP server.
     """
     hostname = host.run('hostname').stdout.strip()
     fqdn = hostname[:hostname.rfind("-")]
     starttls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -starttls imap -connect %s:143', fqdn)
     assert starttls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
     tls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -connect %s:993', fqdn)
     assert tls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
 def test_smtp_tls_connectivity(host):
     """
     Tests connectivity over default/submission port towards SMTP
     server.
     """
     hostname = host.run('hostname').stdout.strip()
     fqdn = hostname[:hostname.rfind("-")]
     starttls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect %s:25', fqdn)
     assert starttls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
     tls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect %s:587', fqdn)
     assert tls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout

roles/mail_server/molecule/default/tests/test_mandatory.py

➞

Show inline comments

@@ @@ -89,62 +89,48 @@ def test_dovecot_mailbox_directories(host): @@
             assert directory.is_directory
             assert directory.user == "vmail"
             assert directory.group == "vmail"
             assert directory.mode == 0o700
 def test_mail_owner(host):
     """
     Tests creation of mail owner group and user.
     """
     group = host.group("vmail")
     assert group.exists
     assert group.gid == 1002
     user = host.user("vmail")
     assert user.exists
     assert user.uid == 1002
     assert user.home == "/var/vmail"
     assert user.group == "vmail"
     assert user.groups == ["vmail"]
 def test_imap_tls_connectivity(host):
     """
     Tests connectivity over STARTTLS/TLS towards IMAP server.
     """
     starttls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -starttls imap -connect parameters-mandatory:143')
     assert starttls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
     tls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -connect parameters-mandatory:993')
     assert tls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
 @pytest.mark.parametrize("port", [
 ,
 ,
 ,
 ])
 def test_imap_and_smtp_submission_tls_version_and_ciphers(host, port):
     """
     Tests if the correct TLS version and ciphers have been enabled for
     IMAP and SMTP submission.
     """
     expected_tls_versions = ["TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
+    ]
     # Run the nmap scanner against the server, and fetch the results.
     nmap = host.run("nmap -sV --script ssl-enum-ciphers -p %s localhost -oX /tmp/report.xml", str(port))
@@ @@ -173,63 +159,48 @@ def test_dovecot_postmaster(host): @@
     """
     Tests if Dovecot postmaster has been correctly configured.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  postmaster_address = postmaster@" in config.stdout
 def test_imap_max_user_connections_per_ip(host):
     """
     Tests if Dovecot per-user connection limit has been set-up correctly.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  mail_max_userip_connections = 10" in config.stdout
 def test_smtp_tls_connectivity(host):
     """
     Tests connectivity over default/submission port towards SMTP
     server.
     """
     starttls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-mandatory:25')
     assert starttls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
     tls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-mandatory:587')
     assert tls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
 def test_smtp_default_port_tls_version_and_ciphers(host):
     """
     Tests TLS configuration for SMTP default port (needs to be less
     restrictive for interoperability purposes).
     """
     expected_tls_versions = ["TLSv1.0", "TLSv1.1", "TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_128_CCM",
         "TLS_DHE_RSA_WITH_AES_128_CCM_8",
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CCM",
         "TLS_DHE_RSA_WITH_AES_256_CCM_8",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",

roles/mail_server/molecule/default/tests/test_optional.py

➞

Show inline comments

@@ @@ -112,62 +112,48 @@ def test_dovecot_mailbox_directories(host): @@
             assert directory.is_directory
             assert directory.user == "virtmail"
             assert directory.group == "virtmail"
             assert directory.mode == 0o700
 def test_mail_owner(host):
     """
     Tests creation of mail owner group and user.
     """
     group = host.group("virtmail")
     assert group.exists
     assert group.gid == 5000
     user = host.user("virtmail")
     assert user.exists
     assert user.uid == 5000
     assert user.home == "/var/virtmail"
     assert user.group == "virtmail"
     assert user.groups == ["virtmail"]
 def test_imap_tls_connectivity(host):
     """
     Tests connectivity over STARTTLS/TLS towards IMAP server.
     """
     starttls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -starttls imap -connect parameters-optional:143')
     assert starttls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
     tls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -connect parameters-optional:993')
     assert tls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
 @pytest.mark.parametrize("port", [
 ,
 ,
 ,
 ])
 def test_imap_and_smtp_submission_tls_version_and_ciphers(host, port):
     """
     Tests if the correct TLS version and ciphers have been enabled for
     IMAP and SMTP submission.
     """
     expected_tls_versions = ["TLSv1.1", "TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+    ]
@@ @@ -200,63 +186,48 @@ def test_dovecot_postmaster(host): @@
     Tests if Dovecot postmaster has been correctly configured.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  postmaster_address = webmaster@parameters-optional" in config.stdout
 def test_imap_max_user_connections_per_ip(host):
     """
     Tests if Dovecot per-user connection limit has been set-up correctly.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  mail_max_userip_connections = 2" in config.stdout
 def test_smtp_tls_connectivity(host):
     """
     Tests connectivity over default/submission port towards SMTP
     server.
     """
     starttls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-optional:25')
     assert starttls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
     tls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-optional:587')
     assert tls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
 def test_smtp_default_port_tls_version_and_ciphers(host):
     """
     Tests TLS configuration for SMTP default port (needs to be less
     restrictive for interoperability purposes).
     """
     expected_tls_versions = ["TLSv1.0", "TLSv1.1", "TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_128_CCM",
         "TLS_DHE_RSA_WITH_AES_128_CCM_8",
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CCM",
         "TLS_DHE_RSA_WITH_AES_256_CCM_8",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",

0 comments (0 inline, 0 general)