Files @ a52f9fdabd0f
Branch filter:

Location: majic-ansible-roles/roles/xmpp_server/molecule/default/tests/test_client.py

branko
MAR-132: Added support for Debian 9 (Stretch) to web_server role:

- Introduced internal parameters for controlling differing package
names, service names, and paths for PHP FPM package.
- Added Debian 9 machines to Molecule configuration, including the
client machine.
- Restructured slightly preparaiton playbook to support both Jessie
and Stretch.
- Added custom pytest fixture for having a better way to determine
expected package names etc related to PHP.
- Created copy of private key/certificate pair used for testing of
mandatory parameters (to be used with Stretch machine).
- Fixed invalid specification for hosts on top of which the
connectivity test should be run.
- Updated a couple of task names (avoiding to reference PHP 5).
- Updated documentation.
import os

import testinfra.utils.ansible_runner


testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts(['clients'])


def test_connectivity(host):
    """
    Tests connectivity to the XMPP server (ports that should be reachable).
    """

    with host.sudo():

        for server in ["parameters-mandatory",
                       "parameters-optional"]:
            # c2s plaintext, c2s TLS, file proxy, s2s.
            for port in [5222, 5223, 5000, 5269]:

                ping = host.run('hping3 -S -p %d -c 1 %s' % (port, server))
                assert ping.rc == 0


def test_tls(host):
    """
    Tests if TLS works as expected.
    """

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-t -u john.doe -p johnpassword -j domain1:5222 john.doe@domain1")
    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-e -u john.doe -p johnpassword -j domain1:5223 john.doe@domain1")
    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-t -u jane.doe -p janepassword -j domain2:5222 jane.doe@domain2")
    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-e -u jane.doe -p janepassword -j domain2:5223 jane.doe@domain2")
    assert send.rc == 0


def test_authentication_requires_tls(host):
    """
    Tests if authentication must be done over TLS.
    """

    command = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                       "-u bogus -p bogus -j domain1:5222 john.doe@domain1 -d")
    assert "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><required/></starttls>" in command.stderr

    command = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                       "-u bogus -p bogus -j domain2:5222 jane.doe@domain2 -d")
    assert "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><required/></starttls>" in command.stderr


def test_authentication(host):
    """
    Tests if authentication works correctly.
    """

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-t -u john.doe -p johnpassword -j domain1:5222 john.doe@domain1")
    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-e -u john.doe -p johnpassword -j domain1:5223 john.doe@domain1")
    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-t -u jane.doe -p janepassword -j domain2:5222 jane.doe@domain2")
    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-e -u mick.doe -p mickpassword -j domain3:5223 mick.doe@domain3")
    assert send.rc == 0


def test_unauthorized_users_rejected(host):
    """
    Tests if unauthorized users (present in LDAP, but not member of correct
    group) are rejected from accessing the XMPP server.
    """

    send = host.run("echo 'Hello' | sendxmpp --tls-ca-path /usr/local/share/ca-certificates/testca.crt "
                    "-t -u noxmpp -p noxmpppassword -j domain1:5222 john.doe@domain1")
    assert send.rc != 0
    assert "Error 'AuthSend': error: not-authorized[?]" in send.stderr