1#! /bin/sh 2# $OpenLDAP$ 3## This work is part of OpenLDAP Software <http://www.openldap.org/>. 4## 5## Copyright 1998-2021 The OpenLDAP Foundation. 6## All rights reserved. 7## 8## Redistribution and use in source and binary forms, with or without 9## modification, are permitted only as authorized by the OpenLDAP 10## Public License. 11## 12## A copy of this license is available in the file LICENSE in the 13## top-level directory of the distribution or, alternatively, at 14## <http://www.OpenLDAP.org/license.html>. 15 16echo "running defines.sh" 17. $SRCDIR/scripts/defines.sh 18 19if test $WITH_TLS = no ; then 20 echo "TLS support not available, test skipped" 21 exit 0 22fi 23 24mkdir -p $TESTDIR $DBDIR1 $DBDIR2 25cp -r $DATADIR/tls $TESTDIR 26 27cd $TESTWD 28 29$SLAPPASSWD -g -n >$CONFIGPWF 30echo "rootpw `$SLAPPASSWD -T $CONFIGPWF`" >$TESTDIR/configpw.conf 31 32echo "Running slapadd to build slapd database..." 33. $CONFFILTER $BACKEND < $TLSSASLCONF > $CONF2 34$SLAPADD -f $CONF2 -l $LDIFORDERED 35RC=$? 36if test $RC != 0 ; then 37 echo "slapadd failed ($RC)!" 38 exit $RC 39fi 40 41echo "Starting a slapd on TCP/IP port $PORT3..." 42$SLAPD -f $CONF2 -h $URI3 -d $LVL > $LOG2 2>&1 & 43PID=$! 44if test $WAIT != 0 ; then 45 echo PID $PID 46 read foo 47fi 48PID2="$PID" 49KILLPIDS="$PID" 50 51for i in 0 1 2 3 4 5; do 52 $LDAPSEARCH -s base -b "$MONITOR" -H $URI3 \ 53 '(objectclass=*)' > /dev/null 2>&1 54 RC=$? 55 if test $RC = 0 ; then 56 break 57 fi 58 echo "Waiting $SLEEP1 seconds for slapd to start..." 59 sleep $SLEEP1 60done 61if test $RC != 0 ; then 62 echo "ldapsearch failed ($RC)!" 63 test $KILLSERVERS != no && kill -HUP $KILLPIDS 64 exit $RC 65fi 66 67echo "Running slapadd to build slapd database..." 68. $CONFFILTER $BACKEND < $CONFTWO > $CONF3 69# FIXME: Hack! 70echo "TLSCertificateKeyFile $TESTDIR/tls/private/localhost.key" >>$CONF3 71echo "TLSCertificateFile $TESTDIR/tls/certs/localhost.crt" >>$CONF3 72echo 'authz-regexp "email=([^,]*),cn=[^,]*,ou=OpenLDAP,o=OpenLDAP Foundation,st=CA,c=US" ldap:///ou=People,dc=example,dc=com??sub?(mail=$1)' >>$CONF3 73$SLAPADD -f $CONF3 -l $LDIFORDERED 74RC=$? 75if test $RC != 0 ; then 76 echo "slapadd failed ($RC)!" 77 test $KILLSERVERS != no && kill -HUP $KILLPIDS 78 exit $RC 79fi 80 81echo "Running slapindex to index slapd database..." 82$SLAPINDEX -f $CONF3 83RC=$? 84if test $RC != 0 ; then 85 echo "warning: slapindex failed ($RC)" 86 echo " assuming no indexing support" 87fi 88 89echo "Starting second slapd on TCP/IP port $PORT4 w/ ldaps..." 90$SLAPD -f $CONF3 -h $SURI4 -d $LVL > $LOG3 2>&1 & 91PID=$! 92if test $WAIT != 0 ; then 93 echo PID $PID 94 read foo 95fi 96PID2="$PID" 97KILLPIDS="$KILLPIDS $PID" 98 99sleep $SLEEP0 100 101echo "Testing slapd searching..." 102for i in 0 1 2 3 4 5; do 103 $LDAPSEARCH -o tls-reqcert=never -s base -b "$MONITOR" -H $SURI4 \ 104 '(objectclass=*)' > /dev/null 2>&1 105 RC=$? 106 if test $RC = 0 ; then 107 break 108 fi 109 echo "Waiting $SLEEP1 seconds for slapd to start..." 110 sleep $SLEEP1 111done 112if test $RC != 0 ; then 113 echo "ldapsearch failed ($RC)!" 114 test $KILLSERVERS != no && kill -HUP $KILLPIDS 115 exit $RC 116fi 117 118echo "Starting lloadd on TCP/IP port $PORT1 and ldaps $PORT2..." 119. $CONFFILTER $BACKEND < $LLOADDTLSCONF > $CONF1.lloadd 120if test $AC_lloadd = lloaddyes; then 121 $LLOADD -f $CONF1.lloadd -h "$URI1 $SURI2" -d $LVL > $LOG1 2>&1 & 122else 123 . $CONFFILTER $BACKEND < $SLAPDLLOADCONF | sed -e "s,listen.*,listen \"$URI1 $SURI2\"," > $CONF1.slapd 124 $SLAPD -f $CONF1.slapd -h $URI6 -d $LVL > $LOG1 2>&1 & 125fi 126PID=$! 127if test $WAIT != 0 ; then 128 echo PID $PID 129 read foo 130fi 131KILLPIDS="$KILLPIDS $PID" 132 133echo "Testing slapd searching..." 134for i in 0 1 2 3 4 5; do 135 $LDAPSEARCH -s base -b "$MONITOR" -H $URI1 \ 136 '(objectclass=*)' > /dev/null 2>&1 137 RC=$? 138 if test $RC = 0 ; then 139 break 140 fi 141 echo "Waiting $SLEEP1 seconds for lloadd to start..." 142 sleep $SLEEP1 143done 144 145if test $RC != 0 ; then 146 echo "ldapsearch failed ($RC)!" 147 test $KILLSERVERS != no && kill -HUP $KILLPIDS 148 exit $RC 149fi 150 151echo -n "Using ldapsearch with startTLS with no server cert validation...." 152$LDAPSEARCH -o tls-reqcert=never -ZZ -b "" -s base -H $URIP1 \ 153 '@extensibleObject' > $SEARCHOUT 2>&1 154RC=$? 155if test $RC != 0 ; then 156 echo "ldapsearch (startTLS) failed ($RC)!" 157 test $KILLSERVERS != no && kill -HUP $KILLPIDS 158 exit $RC 159else 160 echo "success" 161fi 162 163echo -n "Using ldapsearch with startTLS with hard require cert...." 164$LDAPSEARCH -o tls-cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls-reqcert=hard -ZZ -b "" -s base -H $URIP1 \ 165 '@extensibleObject' > $SEARCHOUT 2>&1 166RC=$? 167if test $RC != 0 ; then 168 echo "ldapsearch (startTLS) failed ($RC)!" 169 test $KILLSERVERS != no && kill -HUP $KILLPIDS 170 exit $RC 171else 172 echo "success" 173fi 174 175if test $WITH_TLS_TYPE = openssl ; then 176 echo -n "Using ldapsearch with startTLS and specific protocol version...." 177 $LDAPSEARCH -o tls-cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls-reqcert=hard -o tls-protocol-min=3.3 -ZZ -b "" -s base -H $URIP1 \ 178 '@extensibleObject' > $SEARCHOUT 2>&1 179 RC=$? 180 if test $RC != 0 ; then 181 echo "ldapsearch (protocol-min) failed ($RC)!" 182 test $KILLSERVERS != no && kill -HUP $KILLPIDS 183 exit $RC 184 else 185 echo "success" 186 fi 187fi 188 189echo -n "Using ldapsearch on $SURI2 with no server cert validation..." 190$LDAPSEARCH -o tls-reqcert=never -b "cn=Subschema" -s base -H $SURIP2 \ 191 '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ 192 >> $SEARCHOUT 2>&1 193RC=$? 194if test $RC != 0 ; then 195 echo "ldapsearch (ldaps) failed($RC)!" 196 test $KILLSERVERS != no && kill -HUP $KILLPIDS 197 exit $RC 198else 199 echo "success" 200fi 201 202echo -n "Using ldapsearch on $SURI2 with reqcert HARD and no CA cert. Should fail..." 203$LDAPSEARCH -o tls-reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ 204 '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ 205 >> $SEARCHOUT 2>&1 206RC=$? 207if test $RC = 0 ; then 208 echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!" 209 test $KILLSERVERS != no && kill -HUP $KILLPIDS 210 exit 1 211else 212 echo "failed correctly with error code ($RC)" 213fi 214 215echo -n "Using ldapsearch on $SURI2 with CA cert and reqcert HARD..." 216$LDAPSEARCH -o tls-cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ 217 -o tls-reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ 218 '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ 219 >> $SEARCHOUT 2>&1 220RC=$? 221if test $RC != 0 ; then 222 echo "ldapsearch (ldaps) failed ($RC)!" 223 test $KILLSERVERS != no && kill -HUP $KILLPIDS 224 exit $RC 225else 226 echo "success" 227fi 228 229if test $WITH_SASL = no ; then 230 echo "SASL support not available, skipping client cert authentication" 231else 232 echo -n "Using ldapwhoami with SASL/EXTERNAL...." 233 $LDAPSASLWHOAMI -o tls-cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls-reqcert=hard \ 234 -o tls-cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt \ 235 -o tls-key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key \ 236 -ZZ -Y EXTERNAL -H $URIP1 \ 237 > $TESTOUT 2>&1 238 RC=$? 239 if test $RC != 0 ; then 240 echo "ldapwhoami (startTLS) failed ($RC)!" 241 test $KILLSERVERS != no && kill -HUP $KILLPIDS 242 exit $RC 243 else 244 echo "success" 245 fi 246 247 echo -n "Validating mapped SASL ID..." 248 echo 'dn:cn=barbara jensen,ou=information technology division,ou=people,dc=example,dc=com' > $TESTDIR/dn.out 249 $CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT 250 251 RC=$? 252 if test $RC != 0 ; then 253 echo "Comparison failed" 254 test $KILLSERVERS != no && kill -HUP $KILLPIDS 255 exit $RC 256 else 257 echo "success" 258 fi 259fi 260 261test $KILLSERVERS != no && kill -HUP $KILLPIDS 262 263if test $RC != 0 ; then 264 echo ">>>>> Test failed" 265else 266 echo ">>>>> Test succeeded" 267 RC=0 268fi 269 270test $KILLSERVERS != no && wait 271 272exit $RC 273