Files
@ 75bfe558bba9
Branch filter:
Location: majic-ansible-roles/roles/web_server/molecule/default/tests/test_optional.py
75bfe558bba9
3.4 KiB
text/x-python
MAR-158: Refactor ldap_server TLS-related tests to use nmap:
- Updated requirements to include defusedxml for safe parsing of XML
reports from nmap.
- Install nmap as part of preparation step.
- Refactored tests for TLS to use nmap ssl-enum-ciphers script for
listing available TLS versions and ciphers.
- Updated requirements to include defusedxml for safe parsing of XML
reports from nmap.
- Install nmap as part of preparation step.
- Refactored tests for TLS to use nmap ssl-enum-ciphers script for
listing available TLS versions and ciphers.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 | import os
import pytest
import testinfra.utils.ansible_runner
from tls_ciphers import ALL_CIPHERS
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-optional')
def test_tls_version(host):
"""
Tests if only the configured TLS protocol versions are allowed by
the server.
"""
old_tls_versions_disabled = host.run("echo 'Q' | openssl s_client -no_tls1_1 -no_tls1_2 -connect parameters-optional:443")
tls1_1_enabled = host.run("echo 'Q' | openssl s_client -tls1_1 -connect parameters-optional:443")
tls1_2_enabled = host.run("echo 'Q' | openssl s_client -tls1_2 -connect parameters-optional:443")
# Avoid false negatives by ensuring the client had actually
# established the TCP connection.
assert "CONNECTED" in old_tls_versions_disabled.stdout
assert old_tls_versions_disabled.rc != 0
# Avoid false negatives by ensuring the client had actually
# established the TCP connection.
assert "CONNECTED" in tls1_1_enabled.stdout
assert tls1_1_enabled.rc == 0
# Avoid false negatives by ensuring the client had actually
# established the TCP connection.
assert "CONNECTED" in tls1_2_enabled.stdout
assert tls1_2_enabled.rc == 0
ENABLED_CIPHERS = [
"DHE-RSA-AES128-GCM-SHA256",
"DHE-RSA-AES128-SHA256",
"DHE-RSA-AES256-GCM-SHA384",
"DHE-RSA-AES256-SHA256",
"ECDHE-RSA-AES128-GCM-SHA256",
"ECDHE-RSA-AES128-SHA",
"ECDHE-RSA-AES128-SHA256",
"ECDHE-RSA-AES256-GCM-SHA384",
"ECDHE-RSA-AES256-SHA384",
]
DISABLED_CIPHERS = sorted(list(set(ALL_CIPHERS)-set(ENABLED_CIPHERS)))
@pytest.mark.parametrize("cipher", ENABLED_CIPHERS)
def test_enabled_tls_ciphers(host, cipher):
"""
Tests available TLS ciphers on the server.
"""
hostname = host.run('hostname').stdout.strip()
fqdn = hostname[:hostname.rfind('-')]
client = host.run("echo 'Q' | openssl s_client -cipher %s -connect %s:443", cipher, fqdn)
assert client.rc == 0
assert cipher in client.stdout
@pytest.mark.parametrize("cipher", DISABLED_CIPHERS)
def test_disabled_tls_ciphers(host, cipher):
"""
Tests available TLS ciphers on the server.
"""
hostname = host.run('hostname').stdout.strip()
fqdn = hostname[:hostname.rfind('-')]
client = host.run("echo 'Q' | openssl s_client -cipher %s -connect %s:443", cipher, fqdn)
assert client.rc != 0
assert cipher not in client.stdout
def test_https_enforcement(host):
"""
Tests if HTTPS is (not) being enforced.
"""
https_enforcement = host.run('curl -I http://parameters-optional/')
assert https_enforcement.rc == 0
assert 'HTTP/1.1 200 OK' in https_enforcement.stdout
assert 'HTTP/1.1 301 Moved Permanently' not in https_enforcement.stdout
assert 'Location: https://parameters-optional/' not in https_enforcement.stdout
https_enforcement = host.run('curl -I https://parameters-optional/')
assert https_enforcement.rc == 0
assert 'Strict-Transport-Security' not in https_enforcement.stdout
def test_default_vhost_index_page(host):
"""
Tests content of default vhost index page.
"""
page = host.run('curl https://parameters-optional/')
assert page.rc == 0
assert "<title>Optional Welcome</title>" in page.stdout
assert "<h1>Optional Welcome</h1>" in page.stdout
assert "<p>Welcome to parameters-optional, default virtual host.</p>" in page.stdout
|