diff --git a/roles/xmpp_server/molecule/default/tests/test_mandatory.py b/roles/xmpp_server/molecule/default/tests/test_mandatory.py index 6557d53c49a613cb460a05418502dcac1e3b0563..e498261e66fbeef0fa8cb26ca4ff0cff6e43d78d 100644 --- a/roles/xmpp_server/molecule/default/tests/test_mandatory.py +++ b/roles/xmpp_server/molecule/default/tests/test_mandatory.py @@ -81,3 +81,24 @@ def test_correct_prosody_package_installed(host): """ assert host.package('prosody-0.10').is_installed + + +def test_xmpp_server_uses_correct_dh_parameters(host): + """ + Tests if the HTTP server uses the generated Diffie-Helman parameter. + """ + + fqdn = host.run('hostname -f').stdout.strip() + + with host.sudo(): + expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip() + + connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 " + "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose domain1") + + output = connection.stdout + begin_marker = "-----BEGIN DH PARAMETERS-----" + end_marker = "-----END DH PARAMETERS-----" + used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)] + + assert used_dhparam == expected_dhparam