majic-ansible-roles Files · roles/mail_forwarder/molecule/default/tests/test_connectivity_from

Files @ 36d96a3fc472

Branch filter:

Location: majic-ansible-roles/roles/mail_forwarder/molecule/default/tests/test_connectivity_from_relay.py

36d96a3fc472 2.0 KiB text/x-python Show Annotation Show as Raw Download as Raw

branko

MAR-163: Ensure host.run is not suspectible to shell injection:

- Use host.run's built-in capability for handling parameter escaping
and insertion.

import os

import pytest
import testinfra.utils.ansible_runner


testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('mail-server')

ansible_runner = testinfra.utils.ansible_runner.AnsibleRunner(
    os.environ['MOLECULE_INVENTORY_FILE'])


@pytest.mark.parametrize("server",
                         ansible_runner.get_hosts('parameters-optional'))
def test_connectivity_from_authorised_relay(host, server):
    """
    Tests connectivity towards mail forwarder servers from authorised
    relay.
    """

    with host.sudo():

        ping = host.run('hping3 -S -p 25 -c 1 %s', server)
        assert ping.rc == 0


@pytest.mark.parametrize("server",
                         sorted(
                             set(ansible_runner.get_hosts('parameters-mandatory')) |
                             set(ansible_runner.get_hosts('parameters-no-incoming'))))
def test_connectivity_from_unauthorised_relay(host, server):
    """
    Tests connectivity towards mail forwarder servers from unauthorised
    relay.
    """

    with host.sudo():

        ping = host.run('hping3 -S -p 25 -c 1 %s', server)
        assert ping.rc != 0
        assert "100% packet loss" in ping.stderr


@pytest.mark.parametrize("server",
                         ansible_runner.get_hosts('parameters-optional'))
def test_mail_reception_from_authorised_relay(host, server):
    """
    Tests if mails can be sent from relay to servers configured to use the
    relay.
    """

    send = host.run('swaks --suppress-data --to root@{server} --server {server}'.format(server=server))
    assert send.rc == 0


@pytest.mark.parametrize("server",
                         ansible_runner.get_hosts('parameters-optional'))
def test_open_relay(host, server):
    """
    Tests if mail forwarder behaves as open relay.
    """

    no_recipients_accepted_error_code = 24

    send = host.run('swaks --suppress-data --to root@client1 --server %s', server)
    assert send.rc == no_recipients_accepted_error_code
    assert "Relay access denied" in send.stdout