Improved test suite, rewritten in python

Added friendly_networks variable to denote whitelisted networks

.gitignore

@@ -1,2 +1,3 @@
 .vagrant
 vagrant_ansible_inventory_default
+tests.pyc

roles/common/templates/etc_fail2ban_jail.local.j2

@@ -1,5 +1,5 @@
 [DEFAULT]
-ignoreip  = 127.0.0.1 {{ ansible_default_ipv4.address }}
+ignoreip  = 127.0.0.1 {{ ansible_default_ipv4.address }} {{ ' '.join(friendly_networks) }}
 bantime   = 86400
 destemail = {{ admin_email }}
 banaction = iptables-multiport
@@ -9,17 +9,17 @@ action    = %(action_mwl)s
 [ssh]
 enabled   = true
 maxretry  = 3
- 
+
 [pam-generic]
 enabled   = true
 banaction = iptables-allports
- 
+
 [ssh-ddos]
 enabled   = true
 
 [apache]
 enabled = true
- 
+
 [postfix]
 enabled  = true
 maxretry = 1

roles/mailserver/templates/etc_postfix_main.cf.j2

@@ -74,8 +74,8 @@ myorigin = $mydomain
 alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
 mydestination = localhost
-relayhost = 
-mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
+relayhost =
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 {{ ' '.join(friendly_networks) }}
 #mailbox_command = procmail -a "$EXTENSION"
 mailbox_size_limit = 0
 recipient_delimiter = +

tests.py

@@ -0,0 +1,260 @@
+import unittest
+from time import sleep
+import uuid
+import socket
+import requests
+import os
+
+TEST_SERVER = 'sovereign.local'
+TEST_ADDRESS = 'sovereign@sovereign.local'
+TEST_PASSWORD = 'foo'
+CA_BUNDLE = 'roles/common/files/wildcard_ca.pem'
+
+
+socket.setdefaulttimeout(5)
+os.environ['REQUESTS_CA_BUNDLE'] = CA_BUNDLE
+
+
+class SSHTests(unittest.TestCase):
+    def test_ssh_banner(self):
+        """SSH is responding with its banner"""
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.connect((TEST_SERVER, 22))
+        data = s.recv(1024)
+        s.close()
+
+        self.assertRegexpMatches(data, '^SSH-2.0-OpenSSH')
+
+
+class WebTests(unittest.TestCase):
+    def test_blog_http(self):
+        """Blog is redirecting to https"""
+        # FIXME: requests won't verify sovereign.local with *.sovereign.local cert
+        r = requests.get('http://' + TEST_SERVER, verify=False)
+
+        # We should be redirected to https
+        self.assertEquals(r.history[0].status_code, 301)
+        self.assertEquals(r.url, 'https://' + TEST_SERVER + '/')
+
+        # 403 - Since there is no documents in the blog directory
+        self.assertEquals(r.status_code, 403)
+
+    def test_webmail_http(self):
+        """Webmail is redirecting to https and displaying login page"""
+        r = requests.get('http://mail.' + TEST_SERVER)
+
+        # We should be redirected to https
+        self.assertEquals(r.history[0].status_code, 301)
+        self.assertEquals(r.url, 'https://mail.' + TEST_SERVER + '/')
+
+        # 200 - We should be at the login page
+        self.assertEquals(r.status_code, 200)
+        self.assertIn(
+            'Welcome to Roundcube Webmail',
+            r.content
+        )
+
+    def test_owncloud_http(self):
+        """ownCloud is redirecting to https and displaying login page"""
+        r = requests.get('http://cloud.' + TEST_SERVER)
+
+        # We should be redirected to https
+        self.assertEquals(r.history[0].status_code, 301)
+        self.assertEquals(r.url, 'https://cloud.' + TEST_SERVER + '/')
+
+        # 200 - We should be at the login page
+        self.assertEquals(r.status_code, 200)
+        self.assertIn(
+            'ownCloud',
+            r.content
+        )
+
+    def test_znc_http(self):
+        """ZNC web interface is displaying login page"""
+        # FIXME: requests won't verify sovereign.local with *.sovereign.local cert
+        r = requests.get('https://' + TEST_SERVER + ':6697', verify=False)
+        self.assertEquals(r.status_code, 200)
+        self.assertIn(
+            "Welcome to ZNC's web interface!",
+            r.content
+        )
+
+
+class IRCTests(unittest.TestCase):
+    def test_irc_auth(self):
+        """ZNC is accepting encrypted logins"""
+        import ssl
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        ssl_sock = ssl.wrap_socket(s, ca_certs=CA_BUNDLE, cert_reqs=ssl.CERT_REQUIRED)
+        ssl_sock.connect((TEST_SERVER, 6697))
+
+        # Check the encryption parameters
+        cipher, version, bits = ssl_sock.cipher()
+        self.assertEquals(cipher, 'AES256-SHA')
+        self.assertEquals(version, 'TLSv1/SSLv3')
+        self.assertEquals(bits, 256)
+
+        # Login
+        ssl_sock.send('CAP REQ sasl multi-prefix\r\n')
+        ssl_sock.send('PASS foo\r\n')
+        ssl_sock.send('NICK sovereign\r\n')
+        ssl_sock.send('USER sovereign 0 * Sov\r\n')
+
+        # Read until we see the ZNC banner (or timeout)
+        while 1:
+            r = ssl_sock.recv(1024)
+            if 'Connected to ZNC' in r:
+                break
+
+
+def new_message(from_email, to_email):
+    """Creates an email (headers & body) with a random subject"""
+    from email.mime.text import MIMEText
+    msg = MIMEText('Testing')
+    msg['Subject'] = uuid.uuid4().hex[:8]
+    msg['From'] = from_email
+    msg['To'] = to_email
+    return msg.as_string(), msg['subject']
+
+
+class MailTests(unittest.TestCase):
+    def assertEmailReceived(self, subject):
+        """Connects with IMAP and asserts the existance of an email, then deletes it"""
+        import imaplib
+
+        sleep(1)
+
+        # Login to IMAP
+        m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
+        m.login(TEST_ADDRESS, TEST_PASSWORD)
+        m.select()
+
+        # Assert the message exist
+        typ, data = m.search(None, '(SUBJECT \"{}\")'.format(subject))
+        self.assertTrue(len(data[0].split()), 1)
+
+        # Delete it & logout
+        m.store(data[0].strip(), '+FLAGS', '\\Deleted')
+        m.expunge()
+        m.close()
+        m.logout()
+
+    def test_imap_requires_ssl(self):
+        """IMAP without SSL is NOT available"""
+        import imaplib
+
+        with self.assertRaisesRegexp(socket.timeout, 'timed out'):
+            imaplib.IMAP4(TEST_SERVER, 143)
+
+    def test_smtps(self):
+        """Email sent from an MUA via SMTPS is delivered"""
+        import smtplib
+        msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
+        s = smtplib.SMTP_SSL(TEST_SERVER, 465)
+        s.login(TEST_ADDRESS, TEST_PASSWORD)
+        s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
+        s.quit()
+        self.assertEmailReceived(subject)
+
+    def test_smtps_requires_auth(self):
+        """SMTPS with no authentication is rejected"""
+        import smtplib
+        s = smtplib.SMTP_SSL(TEST_SERVER, 465)
+
+        with self.assertRaisesRegexp(smtplib.SMTPRecipientsRefused, 'Access denied'):
+            s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], 'Test')
+
+        s.quit()
+
+    def test_smtp(self):
+        """Email sent from an MTA is delivered"""
+        import smtplib
+        msg, subject = new_message('someone@example.com', TEST_ADDRESS)
+        s = smtplib.SMTP(TEST_SERVER, 25)
+        s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
+        s.quit()
+        self.assertEmailReceived(subject)
+
+    def test_smtp_tls(self):
+        """Email sent from an MTA via SMTP+TLS is delivered"""
+        import smtplib
+        msg, subject = new_message('someone@example.com', TEST_ADDRESS)
+        s = smtplib.SMTP(TEST_SERVER, 25)
+        s.starttls()
+        s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
+        s.quit()
+        self.assertEmailReceived(subject)
+
+    def test_smtps_headers(self):
+        """Email sent from an MUA has DKIM and TLS headers"""
+        import smtplib
+        import imaplib
+
+        # Send a message to root
+        msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
+        s = smtplib.SMTP_SSL(TEST_SERVER, 465)
+        s.login(TEST_ADDRESS, TEST_PASSWORD)
+        s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
+        s.quit()
+
+        sleep(1)
+
+        # Get the message
+        m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
+        m.login(TEST_ADDRESS, TEST_PASSWORD)
+        m.select()
+        _, res = m.search(None, '(SUBJECT \"{}\")'.format(subject))
+        _, data = m.fetch(res[0], '(RFC822)')
+
+        self.assertIn(
+            'DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sovereign.local;',
+            data[0][1]
+        )
+
+        self.assertIn(
+            '(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))',
+            data[0][1]
+        )
+
+        # Clean up
+        m.store(res[0].strip(), '+FLAGS', '\\Deleted')
+        m.expunge()
+        m.close()
+        m.logout()
+
+    def test_smtp_headers(self):
+        """Email sent from an MTA via SMTP+TLS has X-DSPAM and TLS headers"""
+        import smtplib
+        import imaplib
+
+        # Send a message to root
+        msg, subject = new_message('someone@example.com', TEST_ADDRESS)
+        s = smtplib.SMTP(TEST_SERVER, 25)
+        s.starttls()
+        s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
+        s.quit()
+
+        sleep(1)
+
+        # Get the message
+        m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
+        m.login(TEST_ADDRESS, TEST_PASSWORD)
+        m.select()
+        _, res = m.search(None, '(SUBJECT \"{}\")'.format(subject))
+        _, data = m.fetch(res[0], '(RFC822)')
+
+        self.assertIn(
+            'X-DSPAM-Result: Innocent',
+            data[0][1]
+        )
+
+        self.assertIn(
+            '(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))',
+            data[0][1]
+        )
+
+        # Clean up
+        m.store(res[0].strip(), '+FLAGS', '\\Deleted')
+        m.expunge()
+        m.close()
+        m.logout()

tests.sh

@@ -1,55 +0,0 @@
-#!/bin/bash
-
-# use timeout or gtimeout
-export TIMEOUT="timeout"
-if [ -z `which timeout` ]; then
-    export TIMEOUT="gtimeout"
-fi
-
-SUITE_RET=0
-
-runtest() {
-  NAME=$1
-  OUTPUT=`$TIMEOUT -k 1 5 bash -c "$2" 2>&1`
-  RET="$?"
-  if [ $RET -eq 0 ]; then
-    printf "$NAME: \e[00;32mPASSED\e[00m\n"
-  elif [ $RET -eq 124 ]; then
-    printf "$NAME: \e[00;31mTIMEOUT\e[00m\n"
-    SUITE_RET=1
-  else
-    printf "$NAME: \e[00;31mFAILED\e[00m\n"
-    echo "$OUTPUT"
-    SUITE_RET=1
-  fi
-}
-
-
-
-# SSH
-runtest test_ssh "nc -w1 172.16.100.2 22 | grep '^SSH'"
-
-# SMTP
-runtest test_smtp "echo 'quit' | nc -w1 172.16.100.2 25 | grep 'ESMTP Postfix'"
-runtest test_smtps "echo '' | openssl s_client -connect 172.16.100.2:465 | grep 'TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA'"
-runtest test_smtp_tls "echo '' | openssl s_client -connect 172.16.100.2:25 -starttls smtp | grep 'TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA'"
-
-# IMAP
-runtest test_imaps "echo '' | openssl s_client -connect 172.16.100.2:993 | grep 'TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA'"
-
-# HTTP/S
-runtest test_http "echo 'GET /' | nc -w1 172.16.100.2 80 | grep 'It works!'"
-runtest test_https "echo '' | openssl s_client -connect 172.16.100.2:443 | grep 'TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA'"
-runtest test_blog_redirect "curl 172.16.100.2:80 -H 'Host: sovereign.local' -v | grep '301 Moved Permanently'"
-
-# The blog will give 403 because it is an empty directory
-runtest test_blog "curl https://172.16.100.2:443/ -H 'Host: sovereign.local' -v --insecure | grep '403 Forbidden'"
-
-# Other web sites
-runtest test_roundcube "curl https://172.16.100.2:443/ -H 'Host: mail.sovereign.local' -v --insecure | grep 'Welcome to Roundcube Webmail'"
-runtest test_owncloud "curl https://172.16.100.2:443/ -H 'Host: cloud.sovereign.local' -v --insecure | grep 'ownCloud'"
-
-# ZNC
-runtest test_znc "echo '' | openssl s_client -connect 172.16.100.2:6697 | grep 'TLSv1/SSLv3, Cipher is AES256-SHA'"
-
-exit $SUITE_RET

vars/defaults.yml

@@ -9,6 +9,8 @@
 # main_user_name: (required)
 admin_email: "{{ main_user_name }}@{{ domain }}"
 # encfs_password: (required)
+friendly_networks:
+  - ""
 
 # ircbouncer
 znc_version: 1.0

vars/testing.yml

@@ -8,6 +8,8 @@
 domain: sovereign.local
 main_user_name: sovereign
 encfs_password: testPassword
+friendly_networks:
+  - "172.16.100.0/24"
 
 # ircbouncer
 irc_nick: sovereign