testprogs: Add rpcclient schannel tests

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14767

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/selftest/knownfail.d/rpcclient_schannel b/selftest/knownfail.d/rpcclient_schannel
new file mode 100644 (file)
index 0000000..9881cc3
--- /dev/null
+++ b/selftest/knownfail.d/rpcclient_schannel
@@ -0,0 +1,3 @@
+^samba.blackbox.rpcclient_schannel.ncacn_np.getusername.fips\(ad_member_fips:local\)
+^samba.blackbox.rpcclient_schannel.ncacn_ip_tcp.lookupsids\(ad_member:local\)
+^samba.blackbox.rpcclient_schannel.ncacn_ip_tcp.lookupsids\(ad_member_fips:local\)

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index 1823699cdab10f992c183e8b68f91b6b6cfb2fc0..85cd33c1206d39a1857474a0dcb47c2d23e84745 100755 (executable)
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -561,6 +561,33 @@ else:
 
 plantestsuite("samba.blackbox.client_kerberos", "ad_dc", [os.path.join(bbdir, "test_client_kerberos.sh"), '$DOMAIN', '$REALM', '$USERNAME', '$PASSWORD', '$SERVER', '$PREFIX_ABS', '$SMB_CONF_PATH'])
 
+env="ad_member:local"
+plantestsuite("samba.blackbox.rpcclient_schannel",
+              env,
+              [os.path.join(bbdir, "test_rpcclient_schannel.sh"),
+               '$DOMAIN',
+               '$REALM',
+               '$DC_USERNAME',
+               '$DC_PASSWORD',
+               '$DC_SERVER',
+               '$PREFIX_ABS',
+               '$SMB_CONF_PATH',
+               env])
+env="ad_member_fips:local"
+plantestsuite("samba.blackbox.rpcclient_schannel",
+              env,
+              [os.path.join(bbdir, "test_rpcclient_schannel.sh"),
+               '$DOMAIN',
+               '$REALM',
+               '$DC_USERNAME',
+               '$DC_PASSWORD',
+               '$DC_SERVER',
+               '$PREFIX_ABS',
+               '$SMB_CONF_PATH',
+               env],
+              environ={'GNUTLS_FORCE_FIPS_MODE': '1',
+                       'OPENSSL_FORCE_FIPS_MODE': '1'})
+
 plantestsuite("samba4.blackbox.trust_ntlm", "fl2008r2dc:local", [os.path.join(bbdir, "test_trust_ntlm.sh"), '$SERVER_IP', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$TRUST_USERNAME', '$TRUST_PASSWORD', '$TRUST_REALM', '$TRUST_DOMAIN', 'forest', 'auto', 'NT_STATUS_LOGON_FAILURE'])
 plantestsuite("samba4.blackbox.trust_ntlm", "fl2003dc:local", [os.path.join(bbdir, "test_trust_ntlm.sh"), '$SERVER_IP', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$TRUST_USERNAME', '$TRUST_PASSWORD', '$TRUST_REALM', '$TRUST_DOMAIN', 'external', 'auto', 'NT_STATUS_LOGON_FAILURE'])
 plantestsuite("samba4.blackbox.trust_ntlm", "fl2000dc:local", [os.path.join(bbdir, "test_trust_ntlm.sh"), '$SERVER_IP', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$TRUST_USERNAME', '$TRUST_PASSWORD', '$TRUST_REALM', '$TRUST_DOMAIN', 'external', 'auto', 'NT_STATUS_LOGON_FAILURE'])

diff --git a/testprogs/blackbox/test_rpcclient_schannel.sh b/testprogs/blackbox/test_rpcclient_schannel.sh
new file mode 100755 (executable)
index 0000000..9981d4d
--- /dev/null
+++ b/testprogs/blackbox/test_rpcclient_schannel.sh
@@ -0,0 +1,94 @@
+#!/bin/bash
+# Blackbox tests rpcclient with schannel
+# Copyright (c) 2021      Andreas Schneider <asn@samba.org>
+
+if [ $# -lt 8 ]; then
+    cat << EOF
+Usage: test_rpcclient_schannel.sh DOMAIN REALM USERNAME PASSWORD SERVER PREFIX CONFIGURATION TESTENV
+EOF
+    exit 1
+fi
+
+DOMAIN=$1
+REALM=$2
+USERNAME=$3
+PASSWORD=$4
+SERVER=$5
+PREFIX=$6
+CONFIGURATION=$7
+TESTENV=$8
+shift 8
+
+failed=0
+
+samba_subunit_dir=$(dirname "$0")
+. "${samba_subunit_dir}/subunit.sh"
+. "${samba_subunit_dir}/common_test_fns.inc"
+
+samba_bindir="${BINDIR}"
+samba_rpcclient="${samba_bindir}/rpcclient"
+
+test_rpc_getusername()
+{
+    cmd="$samba_rpcclient ncacn_np:${SERVER}[schannel] --machine-pass --configfile=${CONFIGURATION} -c getusername 2>&1"
+    out=$(eval "$cmd")
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Failed to connect! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    echo "$out" | grep -q "Account Name: ANONYMOUS LOGON, Authority Name: NT AUTHORITY"
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Incorrect account/authority name! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    return 0
+}
+
+test_rpc_lookupsids()
+{
+    cmd="$samba_rpcclient ncacn_ip_tcp:${SERVER}[schannel] --machine-pass --configfile=${CONFIGURATION} -c 'lookupsids3 S-1-1-0' 2>&1"
+    out=$(eval "$cmd")
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Failed to connect! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    echo "$out" | grep -q "S-1-1-0 Everyone"
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Incorrect account/authority name! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    return 0
+}
+
+testit "ncacn_np.getusername" \
+    test_rpc_getusername || \
+    failed=$((failed + 1))
+
+if [[ "$TESTENV" == "ad_member_fips"* ]]; then
+    unset GNUTLS_FORCE_FIPS_MODE
+
+    testit "ncacn_np.getusername.fips" \
+        test_rpc_getusername || \
+        failed=$((failed + 1))
+
+    GNUTLS_FORCE_FIPS_MODE=1
+    export GNUTLS_FORCE_FIPS_MODE
+fi
+
+testit "ncacn_ip_tcp.lookupsids" \
+    test_rpc_lookupsids || \
+    failed=$((failed + 1))
+
+exit ${failed}