Nav apraksta
Nevar pievienot vairāk kā 25 tēmas Tēmai ir jāsākas ar burtu vai ciparu, tā var saturēt domu zīmes ('-') un var būt līdz 35 simboliem gara.

tests.py 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383
  1. import unittest
  2. from time import sleep
  3. import uuid
  4. import socket
  5. import requests
  6. import os
  7. TEST_SERVER = 'sovereign.local'
  8. TEST_ADDRESS = 'sovereign@sovereign.local'
  9. TEST_PASSWORD = 'foo'
  10. CA_BUNDLE = 'roles/common/files/wildcard_ca.pem'
  11. socket.setdefaulttimeout(5)
  12. os.environ['REQUESTS_CA_BUNDLE'] = CA_BUNDLE
  13. class SSHTests(unittest.TestCase):
  14. def test_ssh_banner(self):
  15. """SSH is responding with its banner"""
  16. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  17. s.connect((TEST_SERVER, 22))
  18. data = s.recv(1024)
  19. s.close()
  20. self.assertRegexpMatches(data, '^SSH-2.0-OpenSSH')
  21. class WebTests(unittest.TestCase):
  22. def test_blog_http(self):
  23. """Blog is redirecting to https"""
  24. # FIXME: requests won't verify sovereign.local with *.sovereign.local cert
  25. r = requests.get('http://' + TEST_SERVER, verify=False)
  26. # We should be redirected to https
  27. self.assertEquals(r.history[0].status_code, 301)
  28. self.assertEquals(r.url, 'https://' + TEST_SERVER + '/')
  29. # 403 - Since there is no documents in the blog directory
  30. self.assertEquals(r.status_code, 403)
  31. def test_mail_autoconfig_http_and_https(self):
  32. """Email autoconfiguration XML file is accessible over both HTTP and HTTPS"""
  33. # Test getting the file over HTTP and HTTPS
  34. for proto in ['http', 'https']:
  35. r = requests.get(proto + '://autoconfig.' + TEST_SERVER + '/mail/config-v1.1.xml')
  36. # 200 - We should see the XML file
  37. self.assertEquals(r.status_code, 200)
  38. self.assertIn('application/xml', r.headers['Content-Type'])
  39. self.assertIn('clientConfig version="1.1"', r.content)
  40. def test_webmail_http(self):
  41. """Webmail is redirecting to https and displaying login page"""
  42. r = requests.get('http://mail.' + TEST_SERVER)
  43. # We should be redirected to https
  44. self.assertEquals(r.history[0].status_code, 301)
  45. self.assertEquals(r.url, 'https://mail.' + TEST_SERVER + '/')
  46. # 200 - We should be at the login page
  47. self.assertEquals(r.status_code, 200)
  48. self.assertIn(
  49. 'Welcome to Roundcube Webmail',
  50. r.content
  51. )
  52. def test_zpush_http_unauthorized(self):
  53. r = requests.get('http://mail.' + TEST_SERVER + '/Microsoft-Server-ActiveSync')
  54. # We should be redirected to https
  55. self.assertEquals(r.history[0].status_code, 301)
  56. self.assertEquals(r.url, 'https://mail.' + TEST_SERVER + '/Microsoft-Server-ActiveSync')
  57. # Unauthorized
  58. self.assertEquals(r.status_code, 401)
  59. def test_zpush_https(self):
  60. r = requests.post('https://mail.' + TEST_SERVER + '/Microsoft-Server-ActiveSync',
  61. auth=('sovereign@sovereign.local', 'foo'),
  62. params={
  63. 'DeviceId': '1234',
  64. 'DeviceType': 'testbot',
  65. 'Cmd': 'Ping',
  66. })
  67. self.assertEquals(r.headers['content-type'],
  68. 'application/vnd.ms-sync.wbxml')
  69. self.assertEquals(r.headers['ms-server-activesync'],
  70. '14.0')
  71. def test_owncloud_http(self):
  72. """ownCloud is redirecting to https and displaying login page"""
  73. r = requests.get('http://cloud.' + TEST_SERVER)
  74. # We should be redirected to https
  75. self.assertEquals(r.history[0].status_code, 301)
  76. self.assertEquals(r.url, 'https://cloud.' + TEST_SERVER + '/')
  77. # 200 - We should be at the login page
  78. self.assertEquals(r.status_code, 200)
  79. self.assertIn(
  80. 'ownCloud',
  81. r.content
  82. )
  83. def test_selfoss_http(self):
  84. """selfoss is redirecting to https and displaying login page"""
  85. r = requests.get('http://news.' + TEST_SERVER)
  86. # We should be redirected to https
  87. self.assertEquals(r.history[0].status_code, 301)
  88. self.assertEquals(r.url, 'https://news.' + TEST_SERVER + '/')
  89. # 200 - We should be at the login page
  90. self.assertEquals(r.status_code, 200)
  91. self.assertIn(
  92. 'selfoss',
  93. r.content
  94. )
  95. self.assertIn(
  96. 'login',
  97. r.content
  98. )
  99. class IRCTests(unittest.TestCase):
  100. def test_irc_auth(self):
  101. """ZNC is accepting encrypted logins"""
  102. import ssl
  103. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  104. ssl_sock = ssl.wrap_socket(s, ca_certs=CA_BUNDLE, cert_reqs=ssl.CERT_REQUIRED)
  105. ssl_sock.connect((TEST_SERVER, 6697))
  106. # Check the encryption parameters
  107. cipher, version, bits = ssl_sock.cipher()
  108. self.assertEquals(cipher, 'AES256-GCM-SHA384')
  109. self.assertEquals(version, 'TLSv1/SSLv3')
  110. self.assertEquals(bits, 256)
  111. # Login
  112. ssl_sock.send('CAP REQ sasl multi-prefix\r\n')
  113. ssl_sock.send('PASS foo\r\n')
  114. ssl_sock.send('NICK sovereign\r\n')
  115. ssl_sock.send('USER sovereign 0 * Sov\r\n')
  116. # Read until we see the ZNC banner (or timeout)
  117. while 1:
  118. r = ssl_sock.recv(1024)
  119. if 'Connected to ZNC' in r:
  120. break
  121. def new_message(from_email, to_email):
  122. """Creates an email (headers & body) with a random subject"""
  123. from email.mime.text import MIMEText
  124. msg = MIMEText('Testing')
  125. msg['Subject'] = uuid.uuid4().hex[:8]
  126. msg['From'] = from_email
  127. msg['To'] = to_email
  128. return msg.as_string(), msg['subject']
  129. class MailTests(unittest.TestCase):
  130. def assertIMAPReceived(self, subject):
  131. """Connects with IMAP and asserts the existence of an email, then deletes it"""
  132. import imaplib
  133. sleep(1)
  134. # Login to IMAP
  135. m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
  136. m.login(TEST_ADDRESS, TEST_PASSWORD)
  137. m.select()
  138. # Assert the message exists
  139. typ, data = m.search(None, '(SUBJECT \"{}\")'.format(subject))
  140. self.assertTrue(len(data[0].split()), 1)
  141. # Delete it & logout
  142. m.store(data[0].strip(), '+FLAGS', '\\Deleted')
  143. m.expunge()
  144. m.close()
  145. m.logout()
  146. def assertPOP3Received(self, subject):
  147. """Connects with POP3S and asserts the existence of an email, then deletes it"""
  148. import poplib
  149. sleep(1)
  150. # Login to POP3
  151. mail = poplib.POP3_SSL(TEST_SERVER, 995)
  152. mail.user(TEST_ADDRESS)
  153. mail.pass_(TEST_PASSWORD)
  154. # Assert the message exists
  155. num = len(mail.list()[1])
  156. resp, text, octets = mail.retr(num)
  157. self.assertTrue("Subject: " + subject in text)
  158. # Delete it and log out
  159. mail.dele(num)
  160. mail.quit()
  161. def test_imap_requires_ssl(self):
  162. """IMAP without SSL is NOT available"""
  163. import imaplib
  164. with self.assertRaisesRegexp(socket.timeout, 'timed out'):
  165. imaplib.IMAP4(TEST_SERVER, 143)
  166. def test_pop3_requires_ssl(self):
  167. """POP3 without SSL is NOT available"""
  168. import poplib
  169. with self.assertRaisesRegexp(socket.timeout, 'timed out'):
  170. poplib.POP3(TEST_SERVER, 110)
  171. def test_smtps(self):
  172. """Email sent from an MUA via SMTPS is delivered"""
  173. import smtplib
  174. msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
  175. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  176. s.login(TEST_ADDRESS, TEST_PASSWORD)
  177. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
  178. s.quit()
  179. self.assertIMAPReceived(subject)
  180. def test_smtps_delimiter_to(self):
  181. """Email sent to address with delimiter is delivered"""
  182. import smtplib
  183. msg, subject = new_message(TEST_ADDRESS, 'root+foo@sovereign.local')
  184. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  185. s.login(TEST_ADDRESS, TEST_PASSWORD)
  186. s.sendmail(TEST_ADDRESS, ['root+foo@sovereign.local'], msg)
  187. s.quit()
  188. self.assertIMAPReceived(subject)
  189. def test_smtps_requires_auth(self):
  190. """SMTPS with no authentication is rejected"""
  191. import smtplib
  192. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  193. with self.assertRaisesRegexp(smtplib.SMTPRecipientsRefused, 'Access denied'):
  194. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], 'Test')
  195. s.quit()
  196. def test_smtp(self):
  197. """Email sent from an MTA is delivered"""
  198. import smtplib
  199. msg, subject = new_message('someone@example.com', TEST_ADDRESS)
  200. s = smtplib.SMTP(TEST_SERVER, 25)
  201. s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
  202. s.quit()
  203. self.assertIMAPReceived(subject)
  204. def test_smtp_tls(self):
  205. """Email sent from an MTA via SMTP+TLS is delivered"""
  206. import smtplib
  207. msg, subject = new_message('someone@example.com', TEST_ADDRESS)
  208. s = smtplib.SMTP(TEST_SERVER, 25)
  209. s.starttls()
  210. s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
  211. s.quit()
  212. self.assertIMAPReceived(subject)
  213. def test_smtps_headers(self):
  214. """Email sent from an MUA has DKIM and TLS headers"""
  215. import smtplib
  216. import imaplib
  217. # Send a message to root
  218. msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
  219. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  220. s.login(TEST_ADDRESS, TEST_PASSWORD)
  221. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
  222. s.quit()
  223. sleep(1)
  224. # Get the message
  225. m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
  226. m.login(TEST_ADDRESS, TEST_PASSWORD)
  227. m.select()
  228. _, res = m.search(None, '(SUBJECT \"{}\")'.format(subject))
  229. _, data = m.fetch(res[0], '(RFC822)')
  230. self.assertIn(
  231. 'DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sovereign.local;',
  232. data[0][1]
  233. )
  234. self.assertIn(
  235. 'ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)',
  236. data[0][1]
  237. )
  238. # Clean up
  239. m.store(res[0].strip(), '+FLAGS', '\\Deleted')
  240. m.expunge()
  241. m.close()
  242. m.logout()
  243. def test_smtp_headers(self):
  244. """Email sent from an MTA via SMTP+TLS has TLS headers"""
  245. import smtplib
  246. import imaplib
  247. # Send a message to root
  248. msg, subject = new_message('someone@example.com', TEST_ADDRESS)
  249. s = smtplib.SMTP(TEST_SERVER, 25)
  250. s.starttls()
  251. s.sendmail('someone@example.com', [TEST_ADDRESS], msg)
  252. s.quit()
  253. sleep(1)
  254. # Get the message
  255. m = imaplib.IMAP4_SSL(TEST_SERVER, 993)
  256. m.login(TEST_ADDRESS, TEST_PASSWORD)
  257. m.select()
  258. _, res = m.search(None, '(SUBJECT \"{}\")'.format(subject))
  259. _, data = m.fetch(res[0], '(RFC822)')
  260. self.assertIn(
  261. 'ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)',
  262. data[0][1]
  263. )
  264. # Clean up
  265. m.store(res[0].strip(), '+FLAGS', '\\Deleted')
  266. m.expunge()
  267. m.close()
  268. m.logout()
  269. def test_pop3s(self):
  270. """Connects with POP3S and asserts the existance of an email, then deletes it"""
  271. import smtplib
  272. msg, subject = new_message(TEST_ADDRESS, 'root@sovereign.local')
  273. s = smtplib.SMTP_SSL(TEST_SERVER, 465)
  274. s.login(TEST_ADDRESS, TEST_PASSWORD)
  275. s.sendmail(TEST_ADDRESS, ['root@sovereign.local'], msg)
  276. s.quit()
  277. self.assertPOP3Received(subject)
  278. class XMPPTests(unittest.TestCase):
  279. def test_xmpp_c2s(self):
  280. """Prosody is listening on 5222 for clients and requiring TLS"""
  281. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  282. s.connect((TEST_SERVER, 5222))
  283. # Based off http://wiki.xmpp.org/web/Programming_Jabber_Clients
  284. s.send("<stream:stream xmlns:stream='http://etherx.jabber.org/streams' "
  285. "xmlns='jabber:client' to='sovereign.local' version='1.0'>")
  286. data = s.recv(1024)
  287. s.close()
  288. self.assertRegexpMatches(
  289. data,
  290. "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><required/></starttls>"
  291. )
  292. def test_xmpp_s2s(self):
  293. """Prosody is listening on 5269 for servers"""
  294. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  295. s.connect((TEST_SERVER, 5269))
  296. # Base off http://xmpp.org/extensions/xep-0114.html
  297. s.send("<stream:stream xmlns:stream='http://etherx.jabber.org/streams' "
  298. "xmlns='jabber:component:accept' to='sovereign.local'>")
  299. data = s.recv(1024)
  300. s.close()
  301. self.assertRegexpMatches(
  302. data,
  303. "from='sovereign.local'"
  304. )