diff --git a/roles/xmpp_server/molecule/default/tests/test_optional.py b/roles/xmpp_server/molecule/default/tests/test_optional.py index abfd7c6d423c58d3f7cb4f454cb6992c6d76a401..c7aaed13a2887e3f751f59ef17aa31aa3aa6199b 100644 --- a/roles/xmpp_server/molecule/default/tests/test_optional.py +++ b/roles/xmpp_server/molecule/default/tests/test_optional.py @@ -87,3 +87,24 @@ def test_correct_prosody_package_installed(host): """ assert host.package('prosody-0.9').is_installed + + +def test_xmpp_server_uses_correct_dh_parameters(host): + """ + Tests if the HTTP server uses the generated Diffie-Helman parameter. + """ + + fqdn = host.run('hostname -f').stdout.strip() + + with host.sudo(): + expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip() + + connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 " + "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose domain2") + + output = connection.stdout + begin_marker = "-----BEGIN DH PARAMETERS-----" + end_marker = "-----END DH PARAMETERS-----" + used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)] + + assert used_dhparam == expected_dhparam