v1.2.9

2024-03-01 12:50:08 +01:00
commit 656991b263
31 changed files with 2180 additions and 0 deletions
@@ -0,0 +1,82 @@
+version: "3.9"
+
+services:
+  prosody:
+    image: prosody
+    restart: unless-stopped
+    ports:
+      - "5000:5000"
+      - "5222:5222"
+      - "5223:5223"
+      - "5269:5269"
+      - "5281:5281"
+    environment:
+      DOMAIN: example.com
+      E2E_POLICY_WHITELIST: "admin@example.com, user1@example.com"
+      LOG_LEVEL: debug
+      PROSODY_ADMINS: "admin@example.com, admin2@example.com"
+    volumes:
+      - ./certs:/usr/local/etc/prosody/certs
+
+  prosody_postgres:
+    image: prosody
+    restart: unless-stopped
+    ports:
+      - "5000:5000"
+      - "5222:5222"
+      - "5223:5223"
+      - "5269:5269"
+      - "5281:5281"
+    environment:
+      DOMAIN: example.com
+      E2E_POLICY_WHITELIST: "admin@example.com, user1@example.com"
+      LOG_LEVEL: debug
+      PROSODY_ADMINS: "admin@example.com, admin2@example.com"
+      #DB_DRIVER: "MySQL"
+      DB_DRIVER: "PostgreSQL"
+      DB_DATABASE: "prosody"
+      DB_HOST: "postgres"
+      DB_PORT: "5432"
+      DB_USERNAME: "prosody"
+      DB_PASSWORD: "prosody"
+    volumes:
+      - ./certs:/usr/local/etc/prosody/certs
+    depends_on:
+      - postgres
+
+  postgres:
+    image: postgres:15-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: prosody
+      POSTGRES_USER: prosody
+      POSTGRES_PASSWORD: prosody
+
+  prosody_ldap:
+    image: prosody
+    restart: unless-stopped
+    ports:
+      - "5000:5000"
+      - "5222:5222"
+      - "5223:5223"
+      - "5269:5269"
+      - "5281:5281"
+    environment:
+      DOMAIN: example.com
+      E2E_POLICY_WHITELIST: "admin@example.com, user1@example.com"
+      LOG_LEVEL: debug
+      PROSODY_ADMINS: "admin@example.com, admin2@example.com"
+      AUTHENTICATION: "ldap"
+      LDAP_BASE: "dc=example,dc=com"
+      LDAP_SERVER: "glauth"
+      LDAP_ROOTDN: "cn=svc,dc=example,dc=com"
+      LDAP_PASSWORD: "12345678"
+    volumes:
+      - ./certs:/usr/local/etc/prosody/certs
+    depends_on:
+      - glauth
+
+  glauth:
+    image: glauth/glauth
+    volumes:
+      - "./glauth/config.cfg:/app/config/config.cfg"
@@ -0,0 +1,52 @@
+[ldap]
+  enabled = true
+  listen = "0.0.0.0:389"
+
+[ldaps]
+  enabled = false
+
+[backend]
+  datastore = "config"
+  baseDN = "dc=example,dc=com"
+
+[[groups]]
+  name = "svc"
+  gidnumber = 5500
+
+[[groups]]
+  name = "people"
+  gidnumber = 5501
+
+[[users]]
+  name = "svc"
+  uidnumber = 5000
+  primarygroup = 5500
+  passsha256 = "ef797c8118f02dfb649607dd5d3f8c7623048c9c063d532cc95c5ed7a898a64f"
+
+[[users.capabilities]]
+  action = "search"
+  object = "*"
+
+[[users]]
+  name = "admin"
+  uidnumber = 5001
+  primarygroup = 5501
+  passsha256 = "ef797c8118f02dfb649607dd5d3f8c7623048c9c063d532cc95c5ed7a898a64f"
+
+[[users]]
+  name = "user1"
+  uidnumber = 5002
+  primarygroup = 5501
+  passsha256 = "ef797c8118f02dfb649607dd5d3f8c7623048c9c063d532cc95c5ed7a898a64f"
+
+[[users]]
+  name = "user2"
+  uidnumber = 5003
+  primarygroup = 5501
+  passsha256 = "ef797c8118f02dfb649607dd5d3f8c7623048c9c063d532cc95c5ed7a898a64f"
+
+[[users]]
+  name = "user3"
+  uidnumber = 5004
+  primarygroup = 5501
+  passsha256 = "ef797c8118f02dfb649607dd5d3f8c7623048c9c063d532cc95c5ed7a898a64f"
@@ -0,0 +1,28 @@
+# Tests
+
+Pytest is used to login and send messages to other accounts.
+Bats is used to check the log for debug messages.
+
+## Dependencies
+
+* docker
+* docker-compose
+* python 3
+
+## Run tests
+
+Execute [`test.bash`](test.bash).
+
+## Upgrade python packages
+
+The following will install the newest version of packages in requirements.txt.
+
+``` bash
+cat requirements.txt | sed 's/==.*//g' | xargs pip install -U
+```
+
+If updates are available --> update and create new version with:
+
+``` bash
+pip-chill > requirements.txt
+```
@@ -0,0 +1,4 @@
+aioxmpp==0.13.3
+pip-chill==1.0.1
+pytest-asyncio==0.21.0
+pytz==2022.7.1
@@ -0,0 +1,77 @@
+#!/bin/bash
+
+set -e
+
+# generate certs for testing
+
+generateCert() {
+    local DOMAIN="$1"
+    if [[ ! -d certs/"$DOMAIN" ]] ; then
+        mkdir -p certs/"$DOMAIN"
+        cd certs/"$DOMAIN"
+        openssl req -x509 -newkey rsa:4096 -keyout privkey.pem -out fullchain.pem -days 365 -subj "/CN=$DOMAIN" -nodes
+        chmod 777 *.pem
+        cd ../../
+    fi
+}
+
+registerTestUser() {
+    local userName="$1"
+    local containerName="$2"
+    echo "Registering TestUser '$userName' in container '$containerName'"
+    sudo docker compose exec "$containerName" /bin/bash -c "/entrypoint.bash register $userName example.com 12345678"
+}
+
+registerTestUsers() {
+    local containerName="$1"
+    registerTestUser admin "$containerName"
+    registerTestUser user1 "$containerName"
+    registerTestUser user2 "$containerName"
+    registerTestUser user3 "$containerName"
+}
+
+runTests() {
+    local containerName="$1"
+    python --version \
+    && python3 --version \
+    && python3 -m venv venv \
+    && source venv/bin/activate \
+    && python --version \
+    && pip --version \
+    && pip install -r requirements.txt \
+    && pytest \
+    && deactivate \
+    && sleep 5 \
+    && sudo docker-compose logs "$containerName" \
+    && export batsContainerName="$containerName" \
+    && ./bats/bats-core/bin/bats tests.bats \
+    && ./bats/bats-core/bin/bats tests-"$containerName".bats
+}
+
+generateCert "example.com"
+generateCert "conference.example.com"
+generateCert "proxy.example.com"
+generateCert "pubsub.example.com"
+generateCert "upload.example.com"
+
+# Run tests for first container with postgres
+# Start postgres first and wait for 10 seconds before starting prosody.
+sudo docker-compose down
+sudo docker-compose up -d postgres
+sleep 10
+sudo docker-compose up -d prosody_postgres
+
+registerTestUsers prosody_postgres
+runTests prosody_postgres
+sudo docker-compose down
+
+# Run tests for second container with SQLite
+sudo docker-compose up -d prosody
+registerTestUsers prosody
+runTests prosody
+sudo docker-compose down
+
+# Run tests for prosody with ldap
+sudo docker-compose up -d prosody_ldap
+runTests prosody_ldap
+sudo docker-compose down
@@ -0,0 +1,120 @@
+import aiosasl
+import aioxmpp
+import aioxmpp.dispatcher
+import asyncio
+import pytest
+
+@pytest.fixture
+def client(client_username, password):
+
+    jid = aioxmpp.JID.fromstr(client_username)
+
+    client = aioxmpp.PresenceManagedClient(
+        jid,
+        aioxmpp.make_security_layer(
+            password,
+            no_verify=True
+        ),
+        override_peer=[("localhost", 5222, aioxmpp.connector.STARTTLSConnector())],
+    )
+    return client
+
+@pytest.fixture
+def client_with_message_dispatcher(client):
+    def message_received(msg):
+        print(msg)
+        print(msg.body)
+        assert msg.body == "Hello World!"
+
+    # obtain an instance of the service
+    message_dispatcher = client.summon(
+    aioxmpp.dispatcher.SimpleMessageDispatcher
+    )
+
+    # register a message callback here
+    message_dispatcher.register_callback(
+        aioxmpp.MessageType.CHAT,
+        None,
+        message_received,
+    )
+    return client
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_username, password", [("admin@example.com", "12345678")])
+async def test_send_message_from_admin_to_user1(client):
+    recipient_jid = aioxmpp.JID.fromstr("user1@example.com")
+    async with client.connected() as stream:
+        msg = aioxmpp.Message(
+            to=recipient_jid,
+            type_=aioxmpp.MessageType.CHAT,
+        )
+        # None is for "default language"
+        msg.body[None] = "Hello World!"
+
+        await client.send(msg)
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_username, password", [("admin@example.com", "12345678")])
+async def test_send_message_from_admin_to_user2(client):
+    recipient_jid = aioxmpp.JID.fromstr("user2@example.com")
+    async with client.connected() as stream:
+        msg = aioxmpp.Message(
+            to=recipient_jid,
+            type_=aioxmpp.MessageType.CHAT,
+        )
+        msg.body[None] = "Hello World!"
+
+        await client.send(msg)
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_username, password", [("user1@example.com", "12345678")])
+async def test_send_message_from_user1_to_user2(client):
+    recipient_jid = aioxmpp.JID.fromstr("user2@example.com")
+    async with client.connected() as stream:
+        msg = aioxmpp.Message(
+            to=recipient_jid,
+            type_=aioxmpp.MessageType.CHAT,
+        )
+        msg.body[None] = "Hello World!"
+
+        await client.send(msg)
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_username, password", [("user2@example.com", "12345678")])
+async def test_send_message_from_user2_to_user3(client):
+    recipient_jid = aioxmpp.JID.fromstr("user3@example.com")
+    async with client.connected() as stream:
+        msg = aioxmpp.Message(
+            to=recipient_jid,
+            type_=aioxmpp.MessageType.CHAT,
+        )
+        msg.body[None] = "Hello World!"
+
+        await client.send(msg)
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_username, password", [("user2@example.com", "12345678")])
+async def test_send_message_from_user2_to_nonexisting(client):
+    recipient_jid = aioxmpp.JID.fromstr("nonexisting@example.com")
+    async with client.connected() as stream:
+        msg = aioxmpp.Message(
+            to=recipient_jid,
+            type_=aioxmpp.MessageType.CHAT,
+        )
+        msg.body[None] = "Hello World!"
+
+        await client.send(msg)
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_username, password", [("user2@example.com", "wrong password")])
+async def test_can_not_log_in_with_wrong_password(client):
+    with pytest.raises(aiosasl.AuthenticationFailure):
+        recipient_jid = aioxmpp.JID.fromstr("nonexisting@example.com")
+        async with client.connected() as stream:
+            msg = aioxmpp.Message(
+                to=recipient_jid,
+                type_=aioxmpp.MessageType.CHAT,
+            )
+            msg.body[None] = "Hello World!"
+
+            await client.send(msg)
@@ -0,0 +1,10 @@
+# For tests with pipes see: https://github.com/sstephenson/bats/issues/10
+
+load 'bats/bats-support/load'
+load 'bats/bats-assert/load'
+
+@test "Should use sqlite" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Connecting to \[SQLite3\] \/usr\/local\/var\/lib\/prosody\/prosody\.sqlite\.\.\.\""
+  assert_success
+  assert_output
+}
@@ -0,0 +1,16 @@
+# For tests with pipes see: https://github.com/sstephenson/bats/issues/10
+
+load 'bats/bats-support/load'
+load 'bats/bats-assert/load'
+
+@test "Should use sqlite" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Connecting to \[SQLite3\] \/usr\/local\/var\/lib\/prosody\/prosody\.sqlite\.\.\.\""
+  assert_success
+  assert_output
+}
+
+@test "Should use ldap" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Host 'example.com' now set to use user provider 'ldap'\""
+  assert_success
+  assert_output
+}
@@ -0,0 +1,10 @@
+# For tests with pipes see: https://github.com/sstephenson/bats/issues/10
+
+load 'bats/bats-support/load'
+load 'bats/bats-assert/load'
+
+@test "Should use postgres" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Connecting to \[PostgreSQL\] prosody\.\.\.\""
+  assert_success
+  assert_output
+}
@@ -0,0 +1,88 @@
+# For tests with pipes see: https://github.com/sstephenson/bats/issues/10
+
+load 'bats/bats-support/load'
+load 'bats/bats-assert/load'
+
+@test "Should send 5 messages" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Received\[c2s\]: <message\" | wc -l"
+  assert_success
+  assert_output "5"
+}
+
+@test "Should select certificate for example.com" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \" example.com:tls\" | wc -l"
+  assert_success
+  assert_output "1"
+}
+
+@test "Should select certificate for conference.example.com" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"conference.example.com:tls\" | wc -l"
+  assert_success
+  assert_output "1"
+}
+
+@test "Should select certificate for proxy.example.com" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"proxy.example.com:tls\" | wc -l"
+  assert_success
+  assert_output "1"
+}
+
+@test "Should select certificate for pubsub.example.com" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"pubsub.example.com:tls\" | wc -l"
+  assert_success
+  assert_output "1"
+}
+
+@test "Should select certificate for upload.example.com" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Certificates loaded\" | grep \"upload.example.com:tls\" | wc -l"
+  assert_success
+  assert_output "1"
+}
+
+@test "Should log error for user with wrong password" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"Session closed by remote with error: undefined-condition (user intervention: authentication failed: authentication aborted by user)\""
+  assert_success
+  assert_output
+}
+
+@test "Should activate s2s" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 's2s' on (\[::\]:5269|\[\*\]:5269), (\[::\]:5269|\[\*\]:5269)\""
+  assert_success
+  assert_output
+}
+
+@test "Should activate c2s" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'c2s' on (\[::\]:5222|\[\*\]:5222), (\[::\]:5222|\[\*\]:5222)\""
+  assert_success
+  assert_output
+}
+
+@test "Should activate legacy_ssl" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'legacy_ssl' on (\[::\]:5223|\[\*\]:5223), (\[::\]:5223|\[\*\]:5223)\""
+  assert_success
+  assert_output
+}
+
+@test "Should activate proxy65" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'proxy65' on (\[::\]:5000|\[\*\]:5000), (\[::\]:5000|\[\*\]:5000)\""
+  assert_success
+  assert_output
+}
+
+@test "Should activate https" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep -E \"Activated service 'https' on (\[::\]:5281|\[\*\]:5281), (\[::\]:5281|\[\*\]:5281)\""
+  assert_success
+  assert_output
+}
+
+@test "Should load module cloud_notify" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"example.com:cloud_notify.*info.*Module loaded\""
+  assert_success
+  assert_output
+}
+
+@test "Should show upload URL" {
+  run bash -c "sudo docker-compose logs $batsContainerName | grep \"URL: <https:\/\/upload.example.com:5281\/upload> - Ensure this can be reached by users\""
+  assert_success
+  assert_output
+}