Files
@ f428e318d2ca
Branch filter:
Location: majic-ansible-roles/roles/xmpp_server/molecule/default/tests/test_optional.py
f428e318d2ca
3.9 KiB
text/x-python
MAR-162: Make the https_tls_certificate and https_tls_key parameters mandatory in wsgi_website role:
- Dropped the defaults from wsgi_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.
- Dropped the defaults from wsgi_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 | import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-optional')
def test_prosody_tls_files(host):
"""
Tests if Prosody TLS private key and certificage have been deployed
correctly.
"""
hostname = host.run('hostname').stdout.strip()
with host.sudo():
tls_file = host.file('/etc/ssl/private/%s_xmpp.key' % hostname)
assert tls_file.is_file
assert tls_file.user == 'root'
assert tls_file.group == 'prosody'
assert tls_file.mode == 0o640
assert tls_file.content_string == open("tests/data/x509/parameters-optional_xmpp.key.pem", "r").read().rstrip()
tls_file = host.file('/etc/ssl/certs/%s_xmpp.pem' % hostname)
assert tls_file.is_file
assert tls_file.user == 'root'
assert tls_file.group == 'root'
assert tls_file.mode == 0o644
assert tls_file.content_string == open("tests/data/x509/parameters-optional_xmpp.cert.pem", "r").read().rstrip()
def test_certificate_validity_check_configuration(host):
"""
Tests if certificate validity check configuration file has been deployed
correctly.
"""
hostname = host.run('hostname').stdout.strip()
config = host.file('/etc/check_certificate/%s_xmpp.conf' % hostname)
assert config.is_file
assert config.user == 'root'
assert config.group == 'root'
assert config.mode == 0o644
assert config.content_string == "/etc/ssl/certs/%s_xmpp.pem" % hostname
def test_prosody_configuration_file_content(host):
"""
Tests if Prosody configuration file has correct content.
"""
hostname = host.run('hostname').stdout.strip()
with host.sudo():
config = host.file('/etc/prosody/prosody.cfg.lua')
assert "admins = { \"jane.doe@domain2\", \"mick.doe@domain3\", }" in config.content_string
assert "key = \"/etc/ssl/private/%s_xmpp.key\";" % hostname in config.content_string
assert "certificate = \"/etc/ssl/certs/%s_xmpp.pem\";" % hostname in config.content_string
assert "ldap_server = \"ldap-server\"" in config.content_string
assert "ldap_rootdn = \"cn=prosody,ou=services,dc=local\"" in config.content_string
assert "ldap_password = \"prosodypassword\"" in config.content_string
assert "ldap_filter = \"(&(mail=$user@$host)(memberOf=cn=xmpp,ou=groups,dc=local))\"" in config.content_string
assert "ldap_base = \"ou=people,dc=local\"" in config.content_string
assert """VirtualHost "domain2"
Component "conference.domain2" "muc"
restrict_room_creation = "local"
Component "proxy.domain2" "proxy65"
proxy65_acl = { "domain2" }""" in config.content_string
assert """VirtualHost "domain3"
Component "conference.domain3" "muc"
restrict_room_creation = "local"
Component "proxy.domain3" "proxy65"
proxy65_acl = { "domain3" }""" in config.content_string
def test_correct_prosody_package_installed(host):
"""
Tests if correct Prosody package has been installed.
"""
assert host.package('prosody-0.9').is_installed
def test_xmpp_server_uses_correct_dh_parameters(host):
"""
Tests if the HTTP server uses the generated Diffie-Hellman parameter.
"""
fqdn = host.run('hostname -f').stdout.strip()
with host.sudo():
expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip()
connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 "
"--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose domain2")
output = connection.stdout
begin_marker = "-----BEGIN DH PARAMETERS-----"
end_marker = "-----END DH PARAMETERS-----"
used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
assert used_dhparam == expected_dhparam
|