majic-ansible-roles Changeset

Changeset - 9254a5c167c6

Parent rev.

Child rev.

[Not reviewed]

0 3 0

Branko Majic (branko) - 5 years ago 2020-09-23 19:54:18
branko@majic.rs

MAR-158: Deduplicate SMTP/IMAP TLS connectivity tests in mail_server role.

3 files changed with 35 insertions and 58 deletions:

roles/mail_server/molecule/default/tests/test_default.py

roles/mail_server/molecule/default/tests/test_mandatory.py

roles/mail_server/molecule/default/tests/test_optional.py

0 comments (0 inline, 0 general)

roles/mail_server/molecule/default/tests/test_default.py

➞

Show inline comments

@@ @@ -402,48 +402,83 @@ def test_smtp_server_uses_correct_dh_parameters(host): @@
 def test_imap_server_uses_correct_dh_parameters(host):
     """
     Tests if the IMAP server uses correct Diffie-Hellman parameters.
     """
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=imap --port 143 "
                           "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' localhost")
     assert " - Using prime: 2048 bits" in connection.stdout
 def test_imap_and_smtp_tls_files(host):
     """
     Tests if IMAP and SMTP TLS private keys and certificates have been
     deployed correctly.
     """
     hostname = host.run('hostname').stdout.strip()
     with host.sudo():
         tls_file = host.file('/etc/ssl/private/%s_smtp.key' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o640
         assert tls_file.content_string == open("tests/data/x509/server/%s_smtp.key.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/certs/%s_smtp.pem' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o644
         assert tls_file.content_string == open("tests/data/x509/server/%s_smtp.cert.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/private/%s_imap.key' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o640
         assert tls_file.content_string == open("tests/data/x509/server/%s_imap.key.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/certs/%s_imap.pem' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o644
         assert tls_file.content_string == open("tests/data/x509/server/%s_imap.cert.pem" % hostname, "r").read().rstrip()
 def test_imap_tls_connectivity(host):
     """
     Tests connectivity over STARTTLS/TLS towards IMAP server.
     """
     hostname = host.run('hostname').stdout.strip()
     fqdn = hostname[:hostname.rfind("-")]
     starttls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -starttls imap -connect %s:143', fqdn)
     assert starttls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
     tls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -connect %s:993', fqdn)
     assert tls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
 def test_smtp_tls_connectivity(host):
     """
     Tests connectivity over default/submission port towards SMTP
     server.
     """
     hostname = host.run('hostname').stdout.strip()
     fqdn = hostname[:hostname.rfind("-")]
     starttls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect %s:25', fqdn)
     assert starttls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
     tls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect %s:587', fqdn)
     assert tls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout

roles/mail_server/molecule/default/tests/test_mandatory.py

➞

Show inline comments

@@ @@ -65,195 +65,166 @@ def test_postfix_main_cf_file_content(host): @@
 def test_dovecot_mailbox_directories(host):
     """
     Tests if mailbox directories are created correctly.
     """
     # Deliver two mails in order to make sure the directory structure is
     # created.
     send = host.run('swaks --suppress-data --to john.doe@domain1 --server localhost')
     assert send.rc == 0
     send = host.run('swaks --suppress-data --to jane.doe@domain2 --server localhost')
     assert send.rc == 0
     with host.sudo():
         for directory_path in ["/var/vmail/domain1",
                                "/var/vmail/domain1/john.doe",
                                "/var/vmail/domain1/john.doe/Maildir",
                                "/var/vmail/domain2",
                                "/var/vmail/domain2/jane.doe",
                                "/var/vmail/domain2/jane.doe/Maildir"]:
             directory = host.file(directory_path)
             assert directory.is_directory
             assert directory.user == "vmail"
             assert directory.group == "vmail"
             assert directory.mode == 0o700
 def test_mail_owner(host):
     """
     Tests creation of mail owner group and user.
     """
     group = host.group("vmail")
     assert group.exists
     assert group.gid == 1002
     user = host.user("vmail")
     assert user.exists
     assert user.uid == 1002
     assert user.home == "/var/vmail"
     assert user.group == "vmail"
     assert user.groups == ["vmail"]
 def test_imap_tls_connectivity(host):
     """
     Tests connectivity over STARTTLS/TLS towards IMAP server.
     """
     starttls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -starttls imap -connect parameters-mandatory:143')
     assert starttls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
     tls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -connect parameters-mandatory:993')
     assert tls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
 @pytest.mark.parametrize("port", [
 ,
 ,
 ,
 ])
 def test_imap_and_smtp_submission_tls_version_and_ciphers(host, port):
     """
     Tests if the correct TLS version and ciphers have been enabled for
     IMAP and SMTP submission.
     """
     expected_tls_versions = ["TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
+    ]
     # Run the nmap scanner against the server, and fetch the results.
     nmap = host.run("nmap -sV --script ssl-enum-ciphers -p %s localhost -oX /tmp/report.xml", str(port))
     assert nmap.rc == 0
     report_content = host.file('/tmp/report.xml').content_string
     report_root = ElementTree.fromstring(report_content)
     tls_versions = []
     tls_ciphers = set()
     for child in report_root.findall("./host/ports/port/script/table"):
         tls_versions.append(child.attrib['key'])
     for child in report_root.findall(".//table[@key='ciphers']/table/elem[@key='name']"):
         tls_ciphers.add(child.text)
     tls_versions.sort()
     tls_ciphers = sorted(list(tls_ciphers))
     assert tls_versions == expected_tls_versions
     assert tls_ciphers == expected_tls_ciphers
 def test_dovecot_postmaster(host):
     """
     Tests if Dovecot postmaster has been correctly configured.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  postmaster_address = postmaster@" in config.stdout
 def test_imap_max_user_connections_per_ip(host):
     """
     Tests if Dovecot per-user connection limit has been set-up correctly.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  mail_max_userip_connections = 10" in config.stdout
 def test_smtp_tls_connectivity(host):
     """
     Tests connectivity over default/submission port towards SMTP
     server.
     """
     starttls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-mandatory:25')
     assert starttls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
     tls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-mandatory:587')
     assert tls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
 def test_smtp_default_port_tls_version_and_ciphers(host):
     """
     Tests TLS configuration for SMTP default port (needs to be less
     restrictive for interoperability purposes).
     """
     expected_tls_versions = ["TLSv1.0", "TLSv1.1", "TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_128_CCM",
         "TLS_DHE_RSA_WITH_AES_128_CCM_8",
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CCM",
         "TLS_DHE_RSA_WITH_AES_256_CCM_8",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
         "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
         "TLS_DH_anon_WITH_AES_128_CBC_SHA",
         "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
         "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
         "TLS_DH_anon_WITH_AES_256_CBC_SHA",
         "TLS_DH_anon_WITH_AES_256_CBC_SHA256",
         "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
         "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA",
         "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
         "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256",
         "TLS_DH_anon_WITH_SEED_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384",
         "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
         "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
         "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
         "TLS_RSA_WITH_AES_128_CBC_SHA",

roles/mail_server/molecule/default/tests/test_optional.py

➞

Show inline comments

@@ @@ -88,199 +88,170 @@ def test_local_aliases(host): @@
 def test_dovecot_mailbox_directories(host):
     """
     Tests if mailbox directories are created correctly.
     """
     # Deliver two mails in order to make sure the directory structure is
     # created.
     send = host.run('swaks --suppress-data --to john.doe@domain1 --server localhost')
     assert send.rc == 0
     send = host.run('swaks --suppress-data --to jane.doe@domain2 --server localhost')
     assert send.rc == 0
     with host.sudo():
         for directory_path in ["/var/virtmail/domain1",
                                "/var/virtmail/domain1/john.doe",
                                "/var/virtmail/domain1/john.doe/Maildir",
                                "/var/virtmail/domain2",
                                "/var/virtmail/domain2/jane.doe",
                                "/var/virtmail/domain2/jane.doe/Maildir"]:
             directory = host.file(directory_path)
             assert directory.is_directory
             assert directory.user == "virtmail"
             assert directory.group == "virtmail"
             assert directory.mode == 0o700
 def test_mail_owner(host):
     """
     Tests creation of mail owner group and user.
     """
     group = host.group("virtmail")
     assert group.exists
     assert group.gid == 5000
     user = host.user("virtmail")
     assert user.exists
     assert user.uid == 5000
     assert user.home == "/var/virtmail"
     assert user.group == "virtmail"
     assert user.groups == ["virtmail"]
 def test_imap_tls_connectivity(host):
     """
     Tests connectivity over STARTTLS/TLS towards IMAP server.
     """
     starttls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -starttls imap -connect parameters-optional:143')
     assert starttls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
     tls = host.run('echo "a0001 LOGOUT" | openssl s_client -quiet -connect parameters-optional:993')
     assert tls.rc == 0
     assert '* BYE Logging out' in starttls.stdout
 @pytest.mark.parametrize("port", [
 ,
 ,
 ,
 ])
 def test_imap_and_smtp_submission_tls_version_and_ciphers(host, port):
     """
     Tests if the correct TLS version and ciphers have been enabled for
     IMAP and SMTP submission.
     """
     expected_tls_versions = ["TLSv1.1", "TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+    ]
     # Run the nmap scanner against the server, and fetch the results.
     nmap = host.run("nmap -sV --script ssl-enum-ciphers -p %s localhost -oX /tmp/report.xml", str(port))
     assert nmap.rc == 0
     report_content = host.file('/tmp/report.xml').content_string
     report_root = ElementTree.fromstring(report_content)
     tls_versions = []
     tls_ciphers = set()
     for child in report_root.findall("./host/ports/port/script/table"):
         tls_versions.append(child.attrib['key'])
     for child in report_root.findall(".//table[@key='ciphers']/table/elem[@key='name']"):
         tls_ciphers.add(child.text)
     tls_versions.sort()
     tls_ciphers = sorted(list(tls_ciphers))
     assert tls_versions == expected_tls_versions
     assert tls_ciphers == expected_tls_ciphers
 def test_dovecot_postmaster(host):
     """
     Tests if Dovecot postmaster has been correctly configured.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  postmaster_address = webmaster@parameters-optional" in config.stdout
 def test_imap_max_user_connections_per_ip(host):
     """
     Tests if Dovecot per-user connection limit has been set-up correctly.
     """
     with host.sudo():
         config = host.run("doveadm config")
         assert config.rc == 0
         assert "  mail_max_userip_connections = 2" in config.stdout
 def test_smtp_tls_connectivity(host):
     """
     Tests connectivity over default/submission port towards SMTP
     server.
     """
     starttls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-optional:25')
     assert starttls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
     tls = host.run('echo "QUIT" | openssl s_client -quiet -starttls smtp -connect parameters-optional:587')
     assert tls.rc == 0
     assert '221 2.0.0 Bye' in starttls.stdout
 def test_smtp_default_port_tls_version_and_ciphers(host):
     """
     Tests TLS configuration for SMTP default port (needs to be less
     restrictive for interoperability purposes).
     """
     expected_tls_versions = ["TLSv1.0", "TLSv1.1", "TLSv1.2"]
     expected_tls_ciphers = [
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_128_CCM",
         "TLS_DHE_RSA_WITH_AES_128_CCM_8",
         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_AES_256_CCM",
         "TLS_DHE_RSA_WITH_AES_256_CCM_8",
         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
         "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
         "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
         "TLS_DH_anon_WITH_AES_128_CBC_SHA",
         "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
         "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
         "TLS_DH_anon_WITH_AES_256_CBC_SHA",
         "TLS_DH_anon_WITH_AES_256_CBC_SHA256",
         "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
         "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA",
         "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
         "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256",
         "TLS_DH_anon_WITH_SEED_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
         "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
         "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384",
         "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
         "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
         "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
         "TLS_RSA_WITH_AES_128_CBC_SHA",

0 comments (0 inline, 0 general)