From 9827055be3caaa0e98957446dfbab0b6b62b3253 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 13 Feb 2024 16:04:57 +0100 Subject: [PATCH] s4:selftest: also test samba4.ldb.simple.ldap with starttls and SASL-BIND Signed-off-by: Stefan Metzmacher Reviewed-by: Andrew Bartlett --- selftest/expectedfail.d/samba4.ldb.simple.ldap-tls | 7 +++++++ selftest/expectedfail_heimdal | 2 ++ source4/selftest/tests.py | 3 +++ 3 files changed, 12 insertions(+) diff --git a/selftest/expectedfail.d/samba4.ldb.simple.ldap-tls b/selftest/expectedfail.d/samba4.ldb.simple.ldap-tls index 24b9b94a428..49f90c9d04e 100644 --- a/selftest/expectedfail.d/samba4.ldb.simple.ldap-tls +++ b/selftest/expectedfail.d/samba4.ldb.simple.ldap-tls @@ -6,6 +6,7 @@ # fl2003dc has ldap server require strong auth = yes # and correct channel bindings are required for TLS ^samba4.ldb.simple.ldaps.*SASL-BIND.*ldap_testing:tls_channel_bindings=no.*fl2003dc +^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*ldap_testing:tls_channel_bindings=no.*fl2003dc # ad_dc_ntvfs and fl2008r2dc have # ldap server require strong auth = allow_sasl_without_tls_channel_bindings # it means correct channel bindings are required, if the client indicated @@ -14,8 +15,14 @@ # The following are in expectedfail_heimdal for now, as MIT # behaves differently: #^samba4.ldb.simple.ldaps.with.SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*ad_dc_ntvfs +#^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*ad_dc_ntvfs #^samba4.ldb.simple.ldaps.with.SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*fl2008r2dc +#^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*fl2008r2dc ^samba4.ldb.simple.ldaps.with.SASL-BIND.*ldap_testing:channel_bound=yes.*ldap_testing:forced_channel_binding=wRoNg ^samba4.ldb.simple.ldaps.with.SASL-BIND.*ldap_testing:channel_bound=no.*ldap_testing:forced_channel_binding=wRoNg +^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*ldap_testing:channel_bound=yes.*ldap_testing:forced_channel_binding=wRoNg +^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*ldap_testing:channel_bound=no.*ldap_testing:forced_channel_binding=wRoNg ^samba4.ldb.simple.ldaps.with.SASL-BIND.*use-kerberos=disabled.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*ad_dc_ntvfs ^samba4.ldb.simple.ldaps.with.SASL-BIND.*use-kerberos=disabled.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*fl2008r2dc +^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*use-kerberos=disabled.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*ad_dc_ntvfs +^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*use-kerberos=disabled.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*fl2008r2dc diff --git a/selftest/expectedfail_heimdal b/selftest/expectedfail_heimdal index 6415a6ebb22..db2cd5f9c7e 100644 --- a/selftest/expectedfail_heimdal +++ b/selftest/expectedfail_heimdal @@ -9,4 +9,6 @@ # https://github.com/heimdal/heimdal/pull/1234 # https://github.com/krb5/krb5/pull/1329 ^samba4.ldb.simple.ldaps.with.SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*ad_dc_ntvfs +^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*ad_dc_ntvfs ^samba4.ldb.simple.ldaps.with.SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*fl2008r2dc +^samba4.ldb.simple.ldap.starttls.*SASL-BIND.*use-kerberos=required.*ldap_testing:channel_bound=yes.*ldap_testing:tls_channel_bindings=no.*fl2008r2dc diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py index 6410e3d1a8a..556fd9bd490 100755 --- a/source4/selftest/tests.py +++ b/source4/selftest/tests.py @@ -200,6 +200,9 @@ for env in ["ad_dc_ntvfs", "fl2008r2dc", "fl2003dc"]: options = '-U"$USERNAME%$PASSWORD" --option="tlsverifypeer=no_check" ' + auth_option plantestsuite("samba4.ldb.simple.ldaps with SASL-BIND %s(%s)" % (options, env), env, "%s/test_ldb_simple.sh ldaps $SERVER %s" % (bbdir, options)) + options += ' --option="clientldapsaslwrapping=starttls"' + plantestsuite("samba4.ldb.simple.ldap starttls with SASL-BIND %s(%s)" % (options, env), + env, "%s/test_ldb_simple.sh ldap $SERVER %s" % (bbdir, options)) envraw = "fl2008r2dc" -- 2.11.4.GIT