CVE-2016-2113: selftest: use "tls verify peer = no_check"

[samba.git] / selftest / selftest.pl

diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index f08a8f9e373630b641fcc19a4cc6eeacdcee3a47..ff5f27d08555c5177721ab504e63daa615b1efd6 100755 (executable)
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -27,6 +27,7 @@ use Cwd qw(abs_path);
 use lib "$RealBin";
 use Subunit;
 use SocketWrapper;
+use target::Samba;
 
 eval {
 require Time::HiRes;
@@ -50,7 +51,6 @@ my $opt_testenv = 0;
 my $opt_list = 0;
 my $ldap = undef;
 my $opt_resetup_env = undef;
-my $opt_binary_mapping = "";
 my $opt_load_list = undef;
 my $opt_libnss_wrapper_so_path = "";
 my $opt_libresolv_wrapper_so_path = "";
@@ -248,7 +248,6 @@ my $result = GetOptions (
                'testlist=s' => \@testlists,
                'random-order' => \$opt_random_order,
                'load-list=s' => \$opt_load_list,
-               'binary-mapping=s' => \$opt_binary_mapping,
                'nss_wrapper_so_path=s' => \$opt_libnss_wrapper_so_path,
                'resolv_wrapper_so_path=s' => \$opt_libresolv_wrapper_so_path,
                'socket_wrapper_so_path=s' => \$opt_libsocket_wrapper_so_path,
@@ -413,35 +412,32 @@ if ($opt_use_dns_faking) {
 my $target;
 my $testenv_default = "none";
 
-my %binary_mapping = ();
-if ($opt_binary_mapping) {
-    my @binmapping_list = split(/,/, $opt_binary_mapping);
-    foreach my $mapping (@binmapping_list) {
-       my ($bin, $map) = split(/\:/, $mapping);
-       $binary_mapping{$bin} = $map;
-    }
-}
-
-$ENV{BINARY_MAPPING} = $opt_binary_mapping;
-
 # After this many seconds, the server will self-terminate.  All tests
 # must terminate in this time, and testenv will only stay alive this
 # long
 
-my $server_maxtime = 9000;
+my $server_maxtime;
+if ($opt_testenv) {
+    # 1 year should be enough :-)
+    $server_maxtime = 365 * 24 * 60 * 60;
+} else {
+    # make test should run under 4 hours
+    $server_maxtime = 4 * 60 * 60;
+}
+
 if (defined($ENV{SMBD_MAXTIME}) and $ENV{SMBD_MAXTIME} ne "") {
     $server_maxtime = $ENV{SMBD_MAXTIME};
 }
 
 unless ($opt_list) {
        if ($opt_target eq "samba") {
-               $testenv_default = "dc";
+               $testenv_default = "ad_dc_ntvfs";
                require target::Samba;
-               $target = new Samba($bindir, \%binary_mapping, $ldap, $srcdir, $server_maxtime);
+               $target = new Samba($bindir, $ldap, $srcdir, $server_maxtime);
        } elsif ($opt_target eq "samba3") {
-               $testenv_default = "member";
+               $testenv_default = "nt4_member";
                require target::Samba3;
-               $target = new Samba3($bindir, \%binary_mapping, $srcdir_abs, $server_maxtime);
+               $target = new Samba3($bindir, $srcdir_abs, $server_maxtime);
        }
 }
 
@@ -529,6 +525,42 @@ sub write_clientconf($$$)
        mkdir("$clientdir/ncalrpcdir", 0755);
        umask $mask;
 
+       my $cadir = "$ENV{SRCDIR_ABS}/selftest/manage-ca/CA-samba.example.com";
+       my $cacert = "$cadir/Public/CA-samba.example.com-cert.pem";
+       my $cacrl_pem = "$cadir/Public/CA-samba.example.com-crl.pem";
+       my $ca_users_dir = "$cadir/Users";
+
+       if ( -d "$clientdir/pkinit" ) {
+               unlink <$clientdir/pkinit/*>;
+       } else {
+               mkdir("$clientdir/pkinit", 0700);
+       }
+
+       # each user has a USER-${USER_PRINCIPAL_NAME}-cert.pem and
+       # USER-${USER_PRINCIPAL_NAME}-private-key.pem symlink
+       # We make a copy here and make the certificated easily
+       # accessable in the client environment.
+       my $mask = umask;
+       umask 0077;
+       opendir USERS, "${ca_users_dir}" or die "Could not open dir '${ca_users_dir}': $!";
+       for my $d (readdir USERS) {
+               my $user_dir = "${ca_users_dir}/${d}";
+               next if ${d} =~ /^\./;
+               next if (! -d "${user_dir}");
+               opendir USER, "${user_dir}" or die "Could not open dir '${user_dir}': $!";
+               for my $l (readdir USER) {
+                       my $user_link = "${user_dir}/${l}";
+                       next if ${l} =~ /^\./;
+                       next if (! -l "${user_link}");
+
+                       my $dest = "${clientdir}/pkinit/${l}";
+                       Samba::copy_file_content(${user_link}, ${dest});
+               }
+               closedir USER;
+       }
+       closedir USERS;
+       umask $mask;
+
        open(CF, ">$conffile");
        print CF "[global]\n";
        print CF "\tnetbios name = client\n";
@@ -560,6 +592,9 @@ sub write_clientconf($$$)
 #We don't want to run 'speed' tests for very long
         torture:timelimit = 1
         winbind separator = /
+       tls cafile = ${cacert}
+       tls crlfile = ${cacrl_pem}
+       tls verify peer = no_check
 ";
        close(CF);
 }
@@ -730,6 +765,16 @@ my @exported_envvars = (
        "DOMAIN",
        "REALM",
 
+       # stuff related to a trusted domain
+       "TRUST_SERVER",
+       "TRUST_SERVER_IP",
+       "TRUST_SERVER_IPV6",
+       "TRUST_NETBIOSNAME",
+       "TRUST_USERNAME",
+       "TRUST_PASSWORD",
+       "TRUST_DOMAIN",
+       "TRUST_REALM",
+
        # domain controller stuff
        "DC_SERVER",
        "DC_SERVER_IP",
@@ -798,6 +843,7 @@ my @exported_envvars = (
 
        # resolv_wrapper
        "RESOLV_WRAPPER_CONF",
+       "RESOLV_WRAPPER_HOSTS",
 );
 
 sub sighandler($)
@@ -833,9 +879,7 @@ sub setup_env($$)
 
        $option = "client" if $option eq "";
 
-       if ($envname eq "none") {
-               $testenv_vars = {};
-       } elsif (defined(get_running_env($envname))) {
+       if (defined(get_running_env($envname))) {
                $testenv_vars = get_running_env($envname);
                if (not $testenv_vars->{target}->check_env($testenv_vars)) {
                        print $testenv_vars->{target}->getlog_env($testenv_vars);
@@ -903,7 +947,6 @@ sub getlog_env($)
 sub check_env($)
 {
        my ($envname) = @_;
-       return 1 if ($envname eq "none");
        my $env = get_running_env($envname);
        return $env->{target}->check_env($env);
 }