Files
@ 5a9a31d16029
Branch filter:
Location: majic-ansible-roles/roles/xmpp_server/molecule/default/tests/test_optional.py
5a9a31d16029
4.4 KiB
text/x-python
MAR-230: Added TLS version/cipher tests to the xmpp_server role for server-to-server communications.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 | import os
import defusedxml.ElementTree as ElementTree
import pytest
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-optional')
def test_prosody_configuration_file_content(host):
"""
Tests if Prosody configuration file has correct content.
"""
hostname = host.run('hostname').stdout.strip()
with host.sudo():
config = host.file('/etc/prosody/prosody.cfg.lua')
assert "admins = { \"jane.doe@domain2\", \"mick.doe@domain3\", }" in config.content_string
assert "key = \"/etc/ssl/private/%s_xmpp.key\";" % hostname in config.content_string
assert "certificate = \"/etc/ssl/certs/%s_xmpp.pem\";" % hostname in config.content_string
assert "ldap_server = \"ldap-server\"" in config.content_string
assert "ldap_rootdn = \"cn=prosody,ou=services,dc=local\"" in config.content_string
assert "ldap_password = \"prosodypassword\"" in config.content_string
assert "ldap_filter = \"(&(mail=$user@$host)(memberOf=cn=xmpp,ou=groups,dc=local))\"" in config.content_string
assert "ldap_base = \"ou=people,dc=local\"" in config.content_string
assert "archive_expires_after = \"1w\"" in config.content_string
assert """VirtualHost "domain2"
Component "conference.domain2" "muc"
restrict_room_creation = "local"
Component "proxy.domain2" "proxy65"
proxy65_acl = { "domain2" }""" in config.content_string
assert """VirtualHost "domain3"
Component "conference.domain3" "muc"
restrict_room_creation = "local"
Component "proxy.domain3" "proxy65"
proxy65_acl = { "domain3" }""" in config.content_string
@pytest.mark.parametrize("port", [
5222,
5223
])
def test_xmpp_c2s_tls_version_and_ciphers(host, port):
"""
Tests if the correct TLS version and ciphers have been enabled for
XMPP C2S ports.
"""
expected_tls_versions = ["TLSv1.3"]
expected_tls_ciphers = [
"TLS_AKE_WITH_AES_128_GCM_SHA256",
"TLS_AKE_WITH_AES_256_GCM_SHA384",
"TLS_AKE_WITH_CHACHA20_POLY1305_SHA256",
]
# Run the nmap scanner against the server, and fetch the results.
nmap = host.run("nmap -sV --script ssl-enum-ciphers -p %s domain2 -oX /tmp/report.xml", str(port))
assert nmap.rc == 0
report_content = host.file('/tmp/report.xml').content_string
report_root = ElementTree.fromstring(report_content)
tls_versions = []
tls_ciphers = set()
for child in report_root.findall("./host/ports/port/script[@id='ssl-enum-ciphers']/table"):
tls_versions.append(child.attrib['key'])
for child in report_root.findall(".//table[@key='ciphers']/table/elem[@key='name']"):
tls_ciphers.add(child.text)
tls_versions.sort()
tls_ciphers = sorted(list(tls_ciphers))
assert tls_versions == expected_tls_versions
assert tls_ciphers == expected_tls_ciphers
def test_xmpp_s2s_tls_version_and_ciphers(host):
"""
Tests if the correct TLS version and ciphers have been enabled for
XMPP S2S port.
"""
expected_tls_versions = ["TLSv1.2", "TLSv1.3"]
# Seems like TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 is off by default.
expected_tls_ciphers = [
"TLS_AKE_WITH_AES_128_GCM_SHA256",
"TLS_AKE_WITH_AES_256_GCM_SHA384",
"TLS_AKE_WITH_CHACHA20_POLY1305_SHA256",
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
]
# Run the nmap scanner against the server, and fetch the results.
nmap = host.run("nmap -sV --script ssl-enum-ciphers -p 5269 domain2 -oX /tmp/report.xml")
assert nmap.rc == 0
report_content = host.file('/tmp/report.xml').content_string
report_root = ElementTree.fromstring(report_content)
tls_versions = []
tls_ciphers = set()
for child in report_root.findall("./host/ports/port/script[@id='ssl-enum-ciphers']/table"):
tls_versions.append(child.attrib['key'])
for child in report_root.findall(".//table[@key='ciphers']/table/elem[@key='name']"):
tls_ciphers.add(child.text)
tls_versions.sort()
tls_ciphers = sorted(list(tls_ciphers))
assert tls_versions == expected_tls_versions
assert tls_ciphers == expected_tls_ciphers
|