majic-ansible-roles Changeset

Changeset - bbbc4c2cb188

Parent rev.

Child rev.

[Not reviewed]

0 2 0

Branko Majic (branko) - 10 months ago 2025-01-20 23:41:48
branko@majic.rs

MAR-230: Test for correct Diffie-Hellman parameter is not relevant for TLSv1.3:

- The test should be run only against servers where mandatory
parameters are tested since those have the TLSv1.2 enabled (by
defalt).

2 files changed with 24 insertions and 24 deletions:

roles/xmpp_server/molecule/default/tests/test_default.py

roles/xmpp_server/molecule/default/tests/test_mandatory.py

0 comments (0 inline, 0 general)

roles/xmpp_server/molecule/default/tests/test_default.py

➞

Show inline comments

@@ @@ -120,48 +120,24 @@ def test_certificate_validity_check_configuration(host): @@
     """
     hostname = host.run('hostname').stdout.strip()
     config = host.file('/etc/check_certificate/%s_xmpp.conf' % hostname)
     assert config.is_file
     assert config.user == 'root'
     assert config.group == 'root'
     assert config.mode == 0o644
     assert config.content_string == "/etc/ssl/certs/%s_xmpp.pem" % hostname
 def test_xmpp_server_uses_correct_dh_parameters(host):
     """
     Tests if the HTTP server uses the generated Diffie-Hellman parameter.
     """
     fqdn = host.run('hostname -f').stdout.strip()
     # Use first defined domain for testing.
     domain = host.ansible.get_variables()['xmpp_domains'][0]
     with host.sudo():
         expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip()
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 "
                           "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose %s", domain)
     output = connection.stdout
     begin_marker = "-----BEGIN DH PARAMETERS-----"
     end_marker = "-----END DH PARAMETERS-----"
     used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
     assert used_dhparam == expected_dhparam
 def test_tls_connectivity(host):
     """
     Tests if it is possible to connect to the XMPP server using
     STARTTLS/TLS.
     """
     # Use first defined domain for testing.
     domain = host.ansible.get_variables()['xmpp_domains'][0]
     starttls = host.run('echo "test" | openssl s_client -quiet -starttls xmpp -xmpphost %s -connect localhost:5222', domain)
     assert starttls.rc == 0
     assert 'jabber:client' in starttls.stdout

roles/xmpp_server/molecule/default/tests/test_mandatory.py

➞

Show inline comments

@@ @@ -30,24 +30,48 @@ def test_prosody_configuration_file_content(host): @@
         assert "ldap_password = \"prosodypassword\"" in config.content_string
         assert "ldap_filter = \"(&(mail=$user@$host)(memberOf=cn=xmpp,ou=groups,dc=local))\"" in config.content_string
         assert "ldap_base = \"ou=people,dc=local\"" in config.content_string
         assert "archive_expires_after = \"never\"" in config.content_string
         assert """VirtualHost "domain1"
 Component "conference.domain1" "muc"
   restrict_room_creation = "local"
 Component "proxy.domain1" "proxy65"
   proxy65_acl = { "domain1" }""" in config.content_string
 def test_xmpp_server_uses_correct_dh_parameters(host):
     """
     Tests if the HTTP server uses the generated Diffie-Hellman parameter.
     """
     fqdn = host.run('hostname -f').stdout.strip()
     # Use first defined domain for testing.
     domain = host.ansible.get_variables()['xmpp_domains'][0]
     with host.sudo():
         expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip()
     connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 "
                           "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose %s", domain)
     output = connection.stdout
     begin_marker = "-----BEGIN DH PARAMETERS-----"
     end_marker = "-----END DH PARAMETERS-----"
     used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
     assert used_dhparam == expected_dhparam
 @pytest.mark.parametrize("port", [
 ,
 ])
 def test_xmpp_c2s_tls_version_and_ciphers(host, port):
     """
     Tests if the correct TLS version and ciphers have been enabled for
     XMPP C2S ports.
     """
     expected_tls_versions = ["TLSv1.2", "TLSv1.3"]
     expected_tls_ciphers = [

0 comments (0 inline, 0 general)