test_dhparam.py 2.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374
  1. import pytest
  2. import os
  3. import docker
  4. import time
  5. import subprocess
  6. import re
  7. docker_client = docker.from_env()
  8. def wait_for_nginxproxy_to_be_ready():
  9. """
  10. If one (and only one) container started from image jwilder/nginx-proxy:test is found,
  11. wait for its log to contain substring "Watching docker events"
  12. """
  13. containers = docker_client.containers.list(filters={"ancestor": "jwilder/nginx-proxy:test"})
  14. if len(containers) != 1:
  15. return
  16. container = containers[0]
  17. for line in container.logs(stream=True):
  18. if "Watching docker events" in line:
  19. break
  20. def test_dhparam_is_not_generated_if_present(docker_compose, nginxproxy):
  21. wait_for_nginxproxy_to_be_ready()
  22. containers = docker_client.containers.list(filters={"ancestor": "jwilder/nginx-proxy:test"})
  23. if len(containers) != 1:
  24. assert 0
  25. return
  26. sut_container = containers[0]
  27. docker_logs = sut_container.logs(stdout=True, stderr=True, stream=False, follow=False)
  28. assert "Custom dhparam.pem file found, generation skipped" in docker_logs
  29. # Make sure the dhparam in use is not the default, pre-generated one
  30. default_checksum = sut_container.exec_run("md5sum /app/dhparam.pem.default").split()
  31. current_checksum = sut_container.exec_run("md5sum /etc/nginx/dhparam/dhparam.pem").split()
  32. assert default_checksum[0] != current_checksum[0]
  33. def test_web5_https_works(docker_compose, nginxproxy):
  34. r = nginxproxy.get("https://web5.nginx-proxy.tld/port", allow_redirects=False)
  35. assert r.status_code == 200
  36. assert "answer from port 85\n" in r.text
  37. def versiontuple(v):
  38. clean_v = re.sub("[^\d\.]", "", v)
  39. return tuple(map(int, (clean_v.split("."))))
  40. # This code checks that the required version of OpenSSL is present, and skips the test if not
  41. openssl_version_required = "1.0.2"
  42. openssl_version = "0.0.0"
  43. try:
  44. openssl_version = subprocess.check_output(["openssl", "version"]).split()[1]
  45. except:
  46. pass
  47. @pytest.mark.skipif(versiontuple(openssl_version) < versiontuple(openssl_version_required),
  48. reason="openssl command is not available in test environment or is less than version %s" % openssl_version_required)
  49. def test_web5_dhparam_is_used(docker_compose, nginxproxy):
  50. containers = docker_client.containers.list(filters={"ancestor": "jwilder/nginx-proxy:test"})
  51. if len(containers) != 1:
  52. assert 0
  53. return
  54. sut_container = containers[0]
  55. host = "%s:443" % sut_container.attrs["NetworkSettings"]["IPAddress"]
  56. r = subprocess.check_output("echo '' | openssl s_client -verify 0 -connect %s -cipher 'EDH' | grep 'Server Temp Key'" % host, shell=True)
  57. assert "Server Temp Key: DH, 2048 bits" in r