|
92 | 92 | desc 'Check if the correct ca and server certificate implemented and server key. The rabbitmq server should also check the client certificates.' |
93 | 93 | ref 'Rabbitmq Security', url: 'https://docs.openstack.org/security-guide/messaging/security.html' |
94 | 94 |
|
95 | | - describe rabbitmq_config.params('rabbit','ssl_options','cacertfile') do |
| 95 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'cacertfile') do |
96 | 96 | it { should cmp TLSCACERT } |
97 | 97 | end |
98 | | - describe rabbitmq_config.params('rabbit','ssl_options','certfile') do |
| 98 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'certfile') do |
99 | 99 | it { should cmp TLSCERT } |
100 | 100 | end |
101 | | - describe rabbitmq_config.params('rabbit','ssl_options','keyfile') do |
| 101 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'keyfile') do |
102 | 102 | it { should cmp TLSKEY } |
103 | 103 | end |
104 | 104 | end |
|
108 | 108 | desc 'Rabbitmq should verify the certificates from the clients and if the server does not receive a valid certificate it should not allow the connection from the client.' |
109 | 109 | ref 'Rabbitmq Security', url: 'https://docs.openstack.org/security-guide/messaging/security.html' |
110 | 110 |
|
111 | | - describe rabbitmq_config.params('rabbit','ssl_options','verify') do |
| 111 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'verify') do |
112 | 112 | it { should cmp 'verify_peer' } |
113 | 113 | end |
114 | | - describe rabbitmq_config.params('rabbit','ssl_options','fail_if_no_peer_cert') do |
| 114 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'fail_if_no_peer_cert') do |
115 | 115 | it { should cmp 'true' } |
116 | 116 | end |
117 | 117 | end |
|
121 | 121 | desc 'Rabbitmq should only use TLSv1.2.' |
122 | 122 | ref 'Rabbitmq Security', url: 'https://docs.openstack.org/security-guide/messaging/security.html' |
123 | 123 |
|
124 | | - describe rabbitmq_config.params('ssl','versions') do |
| 124 | + describe rabbitmq_config.params('ssl', 'versions') do |
125 | 125 | it { should cmp 'tlsv1.2' } |
126 | 126 | end |
127 | | - describe rabbitmq_config.params('rabbit','ssl_options','versions') do |
| 127 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'versions') do |
128 | 128 | it { should cmp 'tlsv1.2' } |
129 | 129 | end |
130 | 130 | end |
|
135 | 135 | ref 'BSI recommendation', url: 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf;jsessionid=30F658ACD2A772B0A2430C4DEC4AF7D1.1_cid341?__blob=publicationFile&v=4' |
136 | 136 | ref 'Mozilla recommendation', url: 'https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility' |
137 | 137 |
|
138 | | - describe rabbitmq_config.params('rabbit','ssl_options','ciphers') do |
139 | | - it { should eq [["ecdhe_ecdsa", "aes_256_gcm", "null", "sha384"], ["ecdhe_rsa", "aes_256_gcm", "null", "sha384"], ["ecdhe_ecdsa", "aes_128_gcm", "null", "sha256"], ["ecdhe_rsa", "aes_128_gcm", "null", "sha256"]] } |
| 138 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'ciphers') do |
| 139 | + it { should eq [['ecdhe_ecdsa', 'aes_256_gcm', 'null', 'sha384'], ['ecdhe_rsa', 'aes_256_gcm', 'null', 'sha384'], ['ecdhe_ecdsa', 'aes_128_gcm', 'null', 'sha256'], ['ecdhe_rsa', 'aes_128_gcm', 'null', 'sha256']] } |
140 | 140 | end |
141 | 141 | end |
142 | 142 |
|
|
145 | 145 | desc 'The rabbitmq server should force the tls cipher order' |
146 | 146 | ref 'Strong Ciphers for Apache, nginx and Lighttpd', url: 'https://cipherli.st/' |
147 | 147 |
|
148 | | - describe rabbitmq_config.params('rabbit','ssl_options','honor_cipher_order') do |
| 148 | + describe rabbitmq_config.params('rabbit', 'ssl_options', 'honor_cipher_order') do |
149 | 149 | it { should eq true } |
150 | 150 | end |
151 | 151 | end |
0 commit comments