diff options
| -rw-r--r-- | source4/libcli/ldap/ldap.c | 2 | ||||
| -rw-r--r-- | source4/torture/ldap/basic.c | 118 | ||||
| -rw-r--r-- | source4/torture/ldap/common.c | 80 |
3 files changed, 200 insertions, 0 deletions
diff --git a/source4/libcli/ldap/ldap.c b/source4/libcli/ldap/ldap.c index bea78a8928..b589b6dd6d 100644 --- a/source4/libcli/ldap/ldap.c +++ b/source4/libcli/ldap/ldap.c @@ -1481,6 +1481,8 @@ int ldap_bind_sasl(struct ldap_connection *conn, const char *username, const cha return result; } + gensec_want_feature(conn->gensec, GENSEC_WANT_SIGN|GENSEC_WANT_SEAL); + status = gensec_set_domain(conn->gensec, domain); if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Failed to start set GENSEC client domain to %s: %s\n", diff --git a/source4/torture/ldap/basic.c b/source4/torture/ldap/basic.c index 06b703b4ba..574b01b226 100644 --- a/source4/torture/ldap/basic.c +++ b/source4/torture/ldap/basic.c @@ -71,6 +71,115 @@ BOOL test_multibind(struct ldap_connection *conn, const char *userdn, const char return ret; } +static BOOL test_search_rootDSE(struct ldap_connection *conn, char **basedn) +{ + BOOL ret = True; + struct ldap_message *msg, *result; + + printf("Testing RootDSE Search\n"); + + *basedn = NULL; + conn->searchid = 0; + conn->next_msgid = 30; + + msg = new_ldap_message(); + if (!msg) { + return False; + } + + msg->type = LDAP_TAG_SearchRequest; + msg->r.SearchRequest.basedn = ""; + msg->r.SearchRequest.scope = LDAP_SEARCH_SCOPE_BASE; + msg->r.SearchRequest.deref = LDAP_DEREFERENCE_NEVER; + msg->r.SearchRequest.timelimit = 0; + msg->r.SearchRequest.sizelimit = 0; + msg->r.SearchRequest.attributesonly = False; + msg->r.SearchRequest.filter = talloc_strdup(msg->mem_ctx, "(objectclass=*)"); + msg->r.SearchRequest.num_attributes = 0; + msg->r.SearchRequest.attributes = NULL; + + if (!ldap_setsearchent(conn, msg, NULL)) { + printf("Could not setsearchent\n"); + return False; + } + + result = ldap_getsearchent(conn, NULL); + if (result) { + int i; + struct ldap_SearchResEntry *r = &result->r.SearchResultEntry; + + DEBUG(1,("\tdn: %s\n", r->dn)); + for (i=0; i<r->num_attributes; i++) { + int j; + for (j=0; j<r->attributes[i].num_values; j++) { + DEBUG(1,("\t%s: %d %.*s\n", r->attributes[i].name, + r->attributes[i].values[j].length, + r->attributes[i].values[j].length, + (char *)r->attributes[i].values[j].data)); + if (!(*basedn) && + strcasecmp("defaultNamingContext",r->attributes[i].name)==0) { + *basedn = talloc_asprintf(conn->mem_ctx, "%.*s", + r->attributes[i].values[j].length, + (char *)r->attributes[i].values[j].data); + } + } + } + } else { + ret = False; + } + + ldap_endsearchent(conn, NULL); + + return ret; +} + +static BOOL test_compare_sasl(struct ldap_connection *conn, const char *basedn) +{ + BOOL ret = True; + struct ldap_message *msg, *result; + const char *val; + + printf("Testing SASL Compare: %s\n", basedn); + + if (!basedn) { + return False; + } + + conn->next_msgid = 55; + + msg = new_ldap_message(); + if (!msg) { + return False; + } + + msg->type = LDAP_TAG_CompareRequest; + msg->r.CompareRequest.dn = basedn; + msg->r.CompareRequest.attribute = talloc_strdup(msg->mem_ctx, "objectClass"); + val = "domain"; + msg->r.CompareRequest.value = data_blob_talloc(msg->mem_ctx, val, strlen(val)); + + if (!ldap_sasl_send_msg(conn, msg, NULL)) { + return False; + } + + DEBUG(5,("Code: %d DN: [%s] ERROR:[%s] REFERRAL:[%s]\n", + msg->r.CompareResponse.resultcode, + msg->r.CompareResponse.dn, + msg->r.CompareResponse.errormessage, + msg->r.CompareResponse.referral)); + + return True; + if (!result) { + return False; + } + + if (result->type != LDAP_TAG_CompareResponse) { + return False; + } + + return ret; +} + BOOL torture_ldap_basic(int dummy) { NTSTATUS status; @@ -85,6 +194,7 @@ BOOL torture_ldap_basic(int dummy) /*const char *basedn = lp_parm_string(-1, "torture", "ldap_basedn");*/ const char *secret = lp_parm_string(-1, "torture", "ldap_secret"); char *url; + char *basedn; mem_ctx = talloc_init("torture_ldap_basic"); @@ -101,10 +211,18 @@ BOOL torture_ldap_basic(int dummy) ret = False; } + if (!test_search_rootDSE(conn, &basedn)) { + ret = False; + } + if (!test_bind_sasl(conn, username, domain, password)) { ret = False; } + if (!test_compare_sasl(conn, basedn)) { + ret = False; + } + /* no more test we are closing */ talloc_destroy(mem_ctx); diff --git a/source4/torture/ldap/common.c b/source4/torture/ldap/common.c index 6c3d0c7415..48e81b42fb 100644 --- a/source4/torture/ldap/common.c +++ b/source4/torture/ldap/common.c @@ -102,3 +102,83 @@ NTSTATUS torture_ldap_close(struct ldap_connection *conn) return NT_STATUS_OK; } +BOOL ldap_sasl_send_msg(struct ldap_connection *conn, struct ldap_message *msg, + const struct timeval *endtime) +{ + NTSTATUS status; + DATA_BLOB request; + BOOL result; + DATA_BLOB creds; + DATA_BLOB pdu; + int len; + ASN1_DATA asn1; + TALLOC_CTX *mem_ctx; + + msg->messageid = conn->next_msgid++; + + if (!ldap_encode(msg, &request)) + return False; + + status = gensec_seal_packet(conn->gensec, + msg->mem_ctx, + request.data, request.length, + request.data, request.length, + &creds); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("gensec_seal_packet: %s\n",nt_errstr(status))); + return False; + } + + len = 4 + creds.length + request.length; + pdu = data_blob_talloc(msg->mem_ctx, NULL, len); + RSIVAL(pdu.data, 0, len-4); + memcpy(pdu.data + 4, creds.data, creds.length); + memcpy(pdu.data + 4 + creds.length, request.data, request.length); + + result = (write_data_until(conn->sock, pdu.data, pdu.length, + endtime) == pdu.length); + if (!result) + return result; + + pdu = data_blob(NULL, 0x4000); + data_blob_clear(&pdu); + + result = (read_data_until(conn->sock, pdu.data, 4, NULL) == 4); + if (!result) + return result; + + len = RIVAL(pdu.data,0); + + result = (read_data_until(conn->sock, pdu.data + 4, MIN(0x4000,len), NULL) == len); + if (!result) + return result; + + pdu.length = 4+len; + + creds = data_blob(pdu.data + 4 , gensec_sig_size(conn->gensec)); + + request = data_blob(pdu.data + (4 + creds.length), pdu.length - (4 + creds.length)); + + status = gensec_unseal_packet(conn->gensec, + msg->mem_ctx, + request.data, request.length, + request.data, request.length, + &creds); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("gensec_unseal_packet: %s\n",nt_errstr(status))); + return False; + } + + mem_ctx = msg->mem_ctx; + ZERO_STRUCTP(msg); + msg->mem_ctx = mem_ctx; + + asn1_load(&asn1, request); + if (!ldap_decode(&asn1, msg)) { + return False; + } + + result = True; + + return result; +} |