Няма описание
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402
  1. import unittest
  2. from time import sleep
  3. import uuid
  4. import socket
  5. import requests
  6. import os
  7. TEST_SERVER = 'sovereign.local'
  8. TEST_ADDRESS = 'sovereign@sovereign.local'
  9. TEST_PASSWORD = 'foo'
  10. CA_BUNDLE = 'roles/common/files/wildcard_ca.pem'
  11. socket.setdefaulttimeout(5)
  12. os.environ['REQUESTS_CA_BUNDLE'] = CA_BUNDLE
  13. class SSHTests(unittest.TestCase):
  14. def test_ssh_banner(self):
  15. """SSH is responding with its banner"""
  16. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  17. s.connect((TEST_SERVER, 22))
  18. data = s.recv(1024)
  19. s.close()
  20. self.assertRegexpMatches(data, '^SSH-2.0-OpenSSH')
  21. class WebTests(unittest.TestCase):
  22. def test_blog_http(self):
  23. """Blog is redirecting to https"""
  24. # FIXME: requests won't verify sovereign.local with *.sovereign.local cert
  25. r = requests.get('http://' + TEST_SERVER, verify=False)
  26. # We should be redirected to https
  27. self.assertEquals(r.history[0].status_code, 301)
  28. self.assertEquals(r.url, 'https://' + TEST_SERVER + '/')
  29. # 403 - Since there is no documents in the blog directory
  30. self.assertEquals(r.status_code, 403)
  31. def test_webmail_http(self):
  32. """Webmail is redirecting to https and displaying login page"""
  33. r = requests.get('http://mail.' + TEST_SERVER)
  34. # We should be redirected to https
  35. self.assertEquals(r.history[0].status_code, 301)
  36. self.assertEquals(r.url, 'https://mail.' + TEST_SERVER + '/')
  37. # 200 - We should be at the login page
  38. self.assertEquals(r.status_code, 200)
  39. self.assertIn(
  40. 'Welcome to Roundcube Webmail',
  41. r.content
  42. )
  43. def test_zpush_http_unauthorized(self):
  44. r = requests.get('http://mail.' + TEST_SERVER + '/Microsoft-Server-ActiveSync')
  45. # We should be redirected to https
  46. self.assertEquals(r.history[0].status_code, 301)
  47. self.assertEquals(r.url, 'https://mail.' + TEST_SERVER + '/Microsoft-Server-ActiveSync')
  48. # Unauthorized
  49. self.assertEquals(r.status_code, 401)
  50. def test_zpush_https(self):
  51. r = requests.post('https://mail.' + TEST_SERVER + '/Microsoft-Server-ActiveSync',
  52. auth=('sovereign@sovereign.local', 'foo'),
  53. params={
  54. 'DeviceId': '1234',
  55. 'DeviceType': 'testbot',
  56. 'Cmd': 'Ping',
  57. })
  58. self.assertEquals(r.headers['content-type'],
  59. 'application/vnd.ms-sync.wbxml')
  60. self.assertEquals(r.headers['ms-server-activesync'],
  61. '14.0')
  62. def test_owncloud_http(self):
  63. """ownCloud is redirecting to https and displaying login page"""
  64. r = requests.get('http://cloud.' + TEST_SERVER)
  65. # We should be redirected to https
  66. self.assertEquals(r.history[0].status_code, 301)
  67. self.assertEquals(r.url, 'https://cloud.' + TEST_SERVER + '/')
  68. # 200 - We should be at the login page
  69. self.assertEquals(r.status_code, 200)
  70. self.assertIn(
  71. 'ownCloud',
  72. r.content
  73. )
  74. def test_selfoss_http(self):
  75. """selfoss is redirecting to https and displaying login page"""
  76. r = requests.get('http://news.' + TEST_SERVER)
  77. # We should be redirected to https
  78. self.assertEquals(r.history[0].status_code, 301)
  79. self.assertEquals(r.url, 'https://news.' + TEST_SERVER + '/')
  80. # 200 - We should be at the login page
  81. self.assertEquals(r.status_code, 200)
  82. self.assertIn(
  83. 'selfoss',
  84. r.content
  85. )
  86. self.assertIn(
  87. 'login',
  88. r.content
  89. )
  90. def test_znc_http(self):
  91. """ZNC web interface is displaying login page"""
  92. # FIXME: requests won't verify sovereign.local with *.sovereign.local cert
  93. r = requests.get('https://' + TEST_SERVER + ':6697', verify=False)
  94. self.assertEquals(r.status_code, 200)
  95. self.assertIn(
  96. "Welcome to ZNC's web interface!",
  97. r.content
  98. )
  99. def test_cgit_http(self):
  100. """CGit web interface is displaying home page"""
  101. r = requests.get('http://git.' + TEST_SERVER, verify=False)
  102. # We should be redirected to https
  103. self.assertEquals(r.history[0].status_code, 301)
  104. self.assertEquals(r.url, 'https://git.' + TEST_SERVER + '/')
  105. # 200 - We should be at the repository page
  106. self.assertEquals(r.status_code, 200)
  107. self.assertIn(
  108. 'git repository',
  109. r.content
  110. )
  111. class IRCTests(unittest.TestCase):
  112. def test_irc_auth(self):
  113. """ZNC is accepting encrypted logins"""
  114. import ssl
  115. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  116. ssl_sock = ssl.wrap_socket(s, ca_certs=CA_BUNDLE, cert_reqs=ssl.CERT_REQUIRED)
  117. ssl_sock.connect((TEST_SERVER, 6697))
  118. # Check the encryption parameters
  119. cipher, version, bits = ssl_sock.cipher()
  120. self.assertEquals(cipher, 'AES256-SHA')
  121. self.assertEquals(version, 'TLSv1/SSLv3')
  122. self.assertEquals(bits, 256)
  123. # Login
  124. ssl_sock.send('CAP REQ sasl multi-prefix\r\n')
  125. ssl_sock.send('PASS foo\r\n')
  126. ssl_sock.send('NICK sovereign\r\n')
  127. ssl_sock.send('USER sovereign 0 * Sov\r\n')
  128. # Read until we see the ZNC banner (or timeout)
  129. while 1:
  130. r = ssl_sock.recv(1024)
  131. if 'Connected to ZNC' in r:
  132. break
  133. def new_message(from_email, to_email):
  134. """Creates an email (headers & body) with a random subject"""
  135. from email.mime.text import MIMEText
  136. msg = MIMEText('Testing')
  137. msg['Subject'] = uuid.uuid4().hex[:8]
  138. msg['From'] = from_email
  139. msg['To'] = to_email
  140. return msg.as_string(), msg['subject']
  141. class MailTests(unittest.TestCase):
  142. def assertIMAPReceived(self, subject):
  143. """Connects with IMAP and asserts the existence of an email, then deletes it"""
  144. import imaplib
  145. sleep(1)
  146. # Login to IMAP
  147. m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
  148. m.login(TEST_ADDRESS, TEST_PASSWORD)
  149. m.select()
  150. # Assert the message exists
  151. typ, data = m.search(None, '(SUBJECT \"{}\")'.format(subject))
  152. self.assertTrue(len(data[0].split()), 1)
  153. # Delete it & logout
  154. m.store(data[0].strip(), '+FLAGS', '\\Deleted')
  155. m.expunge()
  156. m.close()
  157. m.logout()
  158. def assertPOP3Received(self, subject):
  159. """Connects with POP3S and asserts the existence of an email, then deletes it"""
  160. import poplib
  161. sleep(1)
  162. # Login to POP3
  163. mail = poplib.POP3_SSL(TEST_SERVER, 995)
  164. mail.user(TEST_ADDRESS)
  165. mail.pass_(TEST_PASSWORD)
  166. # Assert the message exists
  167. num = len(mail.list()[1])
  168. resp, text, octets = mail.retr(num)
  169. self.assertTrue("Subject: " + subject in text)
  170. # Delete it and log out
  171. mail.dele(num)
  172. mail.quit()
  173. def test_imap_requires_ssl(self):
  174. """IMAP without SSL is NOT available"""
  175. import imaplib
  176. with self.assertRaisesRegexp(socket.timeout, 'timed out'):
  177. imaplib.IMAP4(TEST_SERVER, 143)
  178. def test_pop3_requires_ssl(self):
  179. """POP3 without SSL is NOT available"""
  180. import poplib
  181. with self.assertRaisesRegexp(socket.timeout, 'timed out'):
  182. poplib.POP3(TEST_SERVER, 110)
  183. def test_smtps(self):
  184. """Email sent from an MUA via SMTPS is delivered"""
  185. import smtplib
  186. msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
  187. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  188. s.login(TEST_ADDRESS, TEST_PASSWORD)
  189. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
  190. s.quit()
  191. self.assertIMAPReceived(subject)
  192. def test_smtps_delimiter_to(self):
  193. """Email sent to address with delimiter is delivered"""
  194. import smtplib
  195. msg, subject = new_message(TEST_ADDRESS, 'root+foo@sovereign.local')
  196. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  197. s.login(TEST_ADDRESS, TEST_PASSWORD)
  198. s.sendmail(TEST_ADDRESS, ['root+foo@sovereign.local'], msg)
  199. s.quit()
  200. self.assertIMAPReceived(subject)
  201. def test_smtps_requires_auth(self):
  202. """SMTPS with no authentication is rejected"""
  203. import smtplib
  204. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  205. with self.assertRaisesRegexp(smtplib.SMTPRecipientsRefused, 'Access denied'):
  206. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], 'Test')
  207. s.quit()
  208. def test_smtp(self):
  209. """Email sent from an MTA is delivered"""
  210. import smtplib
  211. msg, subject = new_message('someone@example.com', TEST_ADDRESS)
  212. s = smtplib.SMTP(TEST_SERVER, 25)
  213. s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
  214. s.quit()
  215. self.assertIMAPReceived(subject)
  216. def test_smtp_tls(self):
  217. """Email sent from an MTA via SMTP+TLS is delivered"""
  218. import smtplib
  219. msg, subject = new_message('someone@example.com', TEST_ADDRESS)
  220. s = smtplib.SMTP(TEST_SERVER, 25)
  221. s.starttls()
  222. s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
  223. s.quit()
  224. self.assertIMAPReceived(subject)
  225. def test_smtps_headers(self):
  226. """Email sent from an MUA has DKIM and TLS headers"""
  227. import smtplib
  228. import imaplib
  229. # Send a message to root
  230. msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
  231. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  232. s.login(TEST_ADDRESS, TEST_PASSWORD)
  233. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
  234. s.quit()
  235. sleep(1)
  236. # Get the message
  237. m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
  238. m.login(TEST_ADDRESS, TEST_PASSWORD)
  239. m.select()
  240. _, res = m.search(None, '(SUBJECT \"{}\")'.format(subject))
  241. _, data = m.fetch(res[0], '(RFC822)')
  242. self.assertIn(
  243. 'DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sovereign.local;',
  244. data[0][1]
  245. )
  246. self.assertIn(
  247. 'DHE-RSA-AES256-SHA (256/256 bits)', # Also matches ECDHE-...
  248. data[0][1]
  249. )
  250. # Clean up
  251. m.store(res[0].strip(), '+FLAGS', '\\Deleted')
  252. m.expunge()
  253. m.close()
  254. m.logout()
  255. def test_smtp_headers(self):
  256. """Email sent from an MTA via SMTP+TLS has X-DSPAM and TLS headers"""
  257. import smtplib
  258. import imaplib
  259. # Send a message to root
  260. msg, subject = new_message('someone@example.com', TEST_ADDRESS)
  261. s = smtplib.SMTP(TEST_SERVER, 25)
  262. s.starttls()
  263. s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
  264. s.quit()
  265. sleep(1)
  266. # Get the message
  267. m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
  268. m.login(TEST_ADDRESS, TEST_PASSWORD)
  269. m.select()
  270. _, res = m.search(None, '(SUBJECT \"{}\")'.format(subject))
  271. _, data = m.fetch(res[0], '(RFC822)')
  272. self.assertIn(
  273. 'X-DSPAM-Result: ',
  274. data[0][1]
  275. )
  276. self.assertIn(
  277. 'DHE-RSA-AES256-SHA (256/256 bits)', # Also matches ECDHE-...
  278. data[0][1]
  279. )
  280. # Clean up
  281. m.store(res[0].strip(), '+FLAGS', '\\Deleted')
  282. m.expunge()
  283. m.close()
  284. m.logout()
  285. def test_pop3s(self):
  286. """Connects with POP3S and asserts the existance of an email, then deletes it"""
  287. import smtplib
  288. msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
  289. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  290. s.login(TEST_ADDRESS, TEST_PASSWORD)
  291. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
  292. s.quit()
  293. self.assertPOP3Received(subject)
  294. class XMPPTests(unittest.TestCase):
  295. def test_xmpp_c2s(self):
  296. """Prosody is listening on 5222 for clients and requiring TLS"""
  297. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  298. s.connect((TEST_SERVER, 5222))
  299. # Based off http://wiki.xmpp.org/web/Programming_Jabber_Clients
  300. s.send("<stream:stream xmlns:stream='http://etherx.jabber.org/streams' "
  301. "xmlns='jabber:client' to='sovereign.local' version='1.0'>")
  302. data = s.recv(1024)
  303. s.close()
  304. self.assertRegexpMatches(
  305. data,
  306. "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><required/></starttls>"
  307. )
  308. def test_xmpp_s2s(self):
  309. """Prosody is listening on 5269 for servers"""
  310. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  311. s.connect((TEST_SERVER, 5269))
  312. # Base off http://xmpp.org/extensions/xep-0114.html
  313. s.send("<stream:stream xmlns:stream='http://etherx.jabber.org/streams' "
  314. "xmlns='jabber:component:accept' to='sovereign.local'>")
  315. data = s.recv(1024)
  316. s.close()
  317. self.assertRegexpMatches(
  318. data,
  319. "from='sovereign.local'"
  320. )