CVE-2016-2112: selftest: servers with explicit "ldap server require strong auth"...

The default is "ldap server require strong auth = yes",
ad_dc_ntvfs uses "ldap server require strong auth = allow_sasl_over_tls",
fl2008r2dc uses "ldap server require strong auth = no".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 7ad3b6daa39156fd9b56d50f1b86331ef37ce4e1..14fddcfb83f410cc83927594f40889dda2ff5d48 100755 (executable)
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -545,6 +545,7 @@ sub provision_raw_step1($$)
         dcerpc endpoint servers = +winreg +srvsvc
        notify:inotify = false
        ldb:nosync = true
         dcerpc endpoint servers = +winreg +srvsvc
        notify:inotify = false
        ldb:nosync = true

+       ldap server require strong auth = yes

 #We don't want to pass our self-tests if the PAC code is wrong
        gensec:require_pac = true
        log file = $ctx->{logdir}/log.\%m
 #We don't want to pass our self-tests if the PAC code is wrong
        gensec:require_pac = true
        log file = $ctx->{logdir}/log.\%m


@@ -1334,7 +1335,9 @@ sub provision_ad_dc_ntvfs($$)
 
        print "PROVISIONING AD DC (NTVFS)...";
         my $extra_conf_options = "netbios aliases = localDC1-a
 
        print "PROVISIONING AD DC (NTVFS)...";
         my $extra_conf_options = "netbios aliases = localDC1-a

-        server services = +winbind -winbindd";
+        server services = +winbind -winbindd
+       ldap server require strong auth = allow_sasl_over_tls
+       ";

        my $ret = $self->provision($prefix,
                                   "domain controller",
                                   "localdc",
        my $ret = $self->provision($prefix,
                                   "domain controller",
                                   "localdc",


@@ -1452,6 +1455,7 @@ sub provision_fl2008r2dc($$$)
        my ($self, $prefix, $dcvars) = @_;
 
        print "PROVISIONING DC WITH FOREST LEVEL 2008r2...";
        my ($self, $prefix, $dcvars) = @_;
 
        print "PROVISIONING DC WITH FOREST LEVEL 2008r2...";

+        my $extra_conf_options = "ldap server require strong auth = no";

        my $ret = $self->provision($prefix,
                                   "domain controller",
                                   "dc7",
        my $ret = $self->provision($prefix,
                                   "domain controller",
                                   "dc7",


@@ -1461,7 +1465,7 @@ sub provision_fl2008r2dc($$$)
                                   "locDCpass7",
                                   undef,
                                   undef,
                                   "locDCpass7",
                                   undef,
                                   undef,

-                                  "",
+                                  $extra_conf_options,

                                   "",
                                   undef);
 
                                   "",
                                   undef);