diff options
author | Isaac Boukris <iboukris@gmail.com> | 2020-06-29 16:55:33 +0300 |
---|---|---|
committer | Isaac Boukris <iboukris@sn-devel-184> | 2020-07-13 10:41:37 +0000 |
commit | 10f61cd39b9e03e7bb781edf04022ea6ae1f1cac (patch) | |
tree | 6e6002a49fc0b2d259ad6d1f65384c59dc08407c /testprogs | |
parent | 4c74db6978c682f8ba4e74a6ee8157cfcbb54971 (diff) | |
download | samba-10f61cd39b9e03e7bb781edf04022ea6ae1f1cac.tar.gz |
selftest: add tests for net-ads over TLS
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14439
Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Diffstat (limited to 'testprogs')
-rwxr-xr-x | testprogs/blackbox/test_net_ads_base.sh | 76 |
1 files changed, 76 insertions, 0 deletions
diff --git a/testprogs/blackbox/test_net_ads_base.sh b/testprogs/blackbox/test_net_ads_base.sh new file mode 100755 index 00000000000..59e3da67a7f --- /dev/null +++ b/testprogs/blackbox/test_net_ads_base.sh @@ -0,0 +1,76 @@ +#!/bin/sh + +if [ $# -lt 5 ]; then +cat <<EOF +Usage: test_net_ads_base.sh DC_SERVER DC_USERNAME DC_PASSWORD TLS_MODE NO_MECH PREFIX_ABS +EOF +exit 1; +fi + +DC_SERVER=$1 +DC_USERNAME=$2 +DC_PASSWORD=$3 +TLS_MODE=$4 +NO_MECH=$5 +BASEDIR=$6 +shift 6 + +HOSTNAME=`dd if=/dev/urandom bs=1 count=32 2>/dev/null | sha1sum | cut -b 1-10` +HOSTNAME=`echo hn$HOSTNAME | tr '[:lower:]' '[:upper:]'` +LCHOSTNAME=`echo $HOSTNAME | tr '[:upper:]' '[:lower:]'` + +RUNDIR=`pwd` +cd $BASEDIR +WORKDIR=`mktemp -d -p .` +WORKDIR=`basename $WORKDIR` +cp -a client/* $WORKDIR/ +sed -ri "s@(dir|directory) = (.*)/client/@\1 = \2/$WORKDIR/@" $WORKDIR/client.conf +sed -ri "s/netbios name = .*/netbios name = $HOSTNAME/" $WORKDIR/client.conf +sed -ri "s/workgroup = .*/workgroup = $DOMAIN/" $WORKDIR/client.conf +sed -ri "s/realm = .*/realm = $REALM/" $WORKDIR/client.conf +rm -f $WORKDIR/private/secrets.tdb +cd $RUNDIR + +failed=0 + +export LDAPTLS_CACERT=$(grep "tls cafile" $BASEDIR/$WORKDIR/client.conf | cut -f2 -d= | awk '{$1=$1};1') + +xoptions="" +if [ $TLS_MODE != "no" ]; then + xoptions="--option=ldapsslads=yes" +fi + +if [ $NO_MECH != "none" ]; then + xoptions="$xoptions --option=gensec:$NO_MECH=no" +fi + +if [ $TLS_MODE = "noverify" ]; then + export LDAPTLS_REQCERT=allow +fi + +net_tool="$VALGRIND $BINDIR/net -s $BASEDIR/$WORKDIR/client.conf --option=security=ads -k $xoptions" + +# Load test functions +. `dirname $0`/subunit.sh + +testit "join" $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD --no-dns-updates || failed=`expr $failed + 1` + +testit "testjoin" $net_tool ads testjoin -P || failed=`expr $failed + 1` + +testit_grep "check dNSHostName" $LCHOSTNAME $net_tool ads search -P samaccountname=$HOSTNAME\$ dNSHostName || failed=`expr $failed + 1` + +tls_log="StartTLS issued: using a TLS connection" +opt="-d3 --option=ldapssl=off" +if [ $TLS_MODE != "no" ]; then + testit_grep "check ldapssl=off" "$tls_log" $net_tool $opt ads search -P samaccountname=$HOSTNAME\$ dn || failed=`expr $failed + 1` +fi + +testit_grep "check SPN" "HOST/$HOSTNAME" $net_tool ads search -P samaccountname=$HOSTNAME\$ servicePrincipalName || failed=`expr $failed + 1` + +testit_grep "test setspn list" "HOST/$HOSTNAME" $net_tool ads setspn list $HOSTNAME -P || failed=`expr $failed + 1` + +testit "leave" $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` + +rm -rf $BASEDIR/$WORKDIR + +exit $failed |