blob: 20f917ad2773e613a6ec3da72a9bf28ee4bd185f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
|
#!/bin/sh
# Blackbox tests for net ads dns register etc.
# Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
# Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
if [ $# -lt 6 ]; then
cat <<EOF
Usage: test_net_ads_dns.sh SERVER DC_USERNAME DC_PASSWORD REALM USER PASS
EOF
exit 1
fi
SERVER=$1
DC_USERNAME=$2
DC_PASSWORD=$3
REALM=$4
USERNAME=$5
PASSWORD=$6
shift 6
failed=0
samba4bindir="$BINDIR"
samba_tool="$samba4bindir/samba-tool"
net_tool="$samba4bindir/net"
smbpasswd="$samba4bindir/smbpasswd"
texpect="$samba4bindir/texpect"
newuser="$samba_tool user create"
groupaddmem="$samba_tool group addmembers"
. $(dirname $0)/subunit.sh
. "$(dirname "${0}")/common_test_fns.inc"
ldbmodify=$(system_or_builddir_binary ldbmodify "${BINDIR}")
ldbsearch=$(system_or_builddir_binary ldbsearch "${BINDIR}")
IPADDRESS=10.1.4.111
IP6ADDRESS=fd00:1a1a::1:5ee:bad:c0de
IPADDRMAC=10.1.4.124
UNPRIVIP=10.1.4.130
ADMINNAME=testname.$$
MACHINENAME=membername.$$
UNPRIVNAME=unprivname.$$
UNPRIVUSER=unprivuser.$$
UNPRIVPASS=UnPrivPass1
# These tests check that privileged users can add DNS names and that
# unprivileged users cannot do so.
echo "Starting ..."
testit "admin user should be able to add a DNS entry $ADMINNAME.$REALM $IPADDRESS $IP6ADDRESS" \
$VALGRIND $net_tool ads dns register $ADMINNAME.$REALM $IPADDRESS $IP6ADDRESS -U$DC_USERNAME%$DC_PASSWORD ||
failed=$(expr $failed + 1)
testit_grep_count \
"We should be able to see the new name $ADMINNAME.$REALM $IPADDRESS" \
"$IPADDRESS" \
1 \
dig @$SERVER +short -t a $ADMINNAME.$REALM ||
failed=$(expr $failed + 1)
testit_grep_count \
"We should be able to see the new name $ADMINNAME.$REALM $IP6ADDRESS" \
"$IP6ADDRESS" \
1 \
dig @$SERVER +short -t aaaa $ADMINNAME.$REALM ||
failed=$(expr $failed + 1)
testit "We should be able to unregister the name $ADMINNAME.$REALM" \
$VALGRIND $net_tool ads dns unregister $ADMINNAME.$REALM -U$DC_USERNAME%$DC_PASSWORD ||
failed=$(expr $failed + 1)
testit_grep_count \
"The name $ADMINNAME.$REALM $IPADDRESS should not be there any longer" \
"$IPADDRESS" \
0 \
dig @$SERVER +short -t a $ADMINNAME.$REALM ||
failed=$(expr $failed + 1)
testit_grep_count \
"The name $ADMINNAME.$REALM $IP6ADDRESS should not be there any longer" \
"$IP6ADDRESS" \
0 \
dig @$SERVER +short -t aaaa $ADMINNAME.$REALM ||
failed=$(expr $failed + 1)
# prime the kpasswd server, see "git blame" for an explanation
$VALGRIND $net_tool user add $UNPRIVUSER $UNPRIVPASS -U$DC_USERNAME%$DC_PASSWORD
$VALGRIND $net_tool user delete $UNPRIVUSER -U$DC_USERNAME%$DC_PASSWORD
# This should be an expect_failure test ...
testit "Adding an unprivileged user" $VALGRIND $net_tool user add $UNPRIVUSER $UNPRIVPASS -U$DC_USERNAME%$DC_PASSWORD || failed=$(expr $failed + 1)
BASEDN=$($VALGRIND $ldbsearch -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -b '' --scope=base defaultNamingContext | grep defaultNamingContext | sed -e 's!^defaultNamingContext: !!')
LDIF="dn: CN=$UNPRIVUSER,CN=users,${BASEDN}+changetype: modify+replace: userAccountControl+userAccountControl: 512"
echo $LDIF | tr '+' '\n' | $VALGRIND $ldbmodify -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -i
STATUS=$?
testit "We should have enabled the account" test $STATUS -eq 0 || failed=$(expr $failed + 1)
#Unprivileged users should be able to add new names
testit "Unprivileged users should be able to add new names" $net_tool ads dns register $UNPRIVNAME.$REALM $UNPRIVIP -U$UNPRIVUSER%$UNPRIVPASS || failed=$(expr $failed + 1)
# This should work as well
testit "machine account should be able to add a DNS entry net ads dns register $MACHINENAME.$REALM $IPADDRMAC -P" \
$net_tool ads dns register $MACHINENAME.$REALM $IPADDRMAC -P ||
failed=$(expr $failed + 1)
testit_grep_count \
"We should be able to see the new name $MACHINENAME.$REALM" \
"$IPADDRMAC" \
1 \
dig @$SERVER +short -t a $MACHINENAME.$REALM ||
failed=$(expr $failed + 1)
#Unprivileged users should not be able to overwrite other's names
testit_expect_failure \
"Unprivileged users should not be able to modify existing names" \
$net_tool ads dns register $MACHINENAME.$REALM $UNPRIVIP -U$UNPRIVUSER%$UNPRIVPASS ||
failed=$(expr $failed + 1)
testit "We should be able to unregister the name $UNPRIVNAME.$REALM $IPADDRESS" \
$VALGRIND $net_tool ads dns unregister $UNPRIVNAME.$REALM -U$UNPRIVUSER%$UNPRIVPASS ||
failed=$(expr $failed + 1)
testit "We should be able to unregister the name $MACHINENAME.$REALM $IPADDRESS" \
$VALGRIND $net_tool ads dns unregister $MACHINENAME.$REALM -P ||
failed=$(expr $failed + 1)
# Remove the unprivileged user, which is not required anymore
$VALGRIND $net_tool user delete $UNPRIVUSER -U$DC_USERNAME%$DC_PASSWORD
testit_grep_count \
"The name $UNPRIVNAME.$REALM ($IPADDRESS) should not be there any longer" \
"$IPADDRESS" \
0 \
dig @$SERVER +short -t a $UNPRIVNAME.$REALM ||
failed=$(expr $failed + 1)
testit_grep_count \
"The name $UNPRIVNAME.$REALM ($IP6ADDRESS) should not be there any longer" \
"$IP6ADDRESS" \
0 \
dig @$SERVER +short -t aaaa $UNPRIVNAME.$REALM ||
failed=$(expr $failed + 1)
testit_grep_count \
"The name $MACHINENAME.$REALM ($IPADDRESS) should not be there any longer" \
"$IPADDRESS" \
0 \
dig @$SERVER +short -t a $MACHINENAME.$REALM ||
failed=$(expr $failed + 1)
testit_grep_count \
"The name $MACHINENAME.$REALM ($IP6ADDRESS) should not be there any longer" \
"$IP6ADDRESS" \
0 \
dig @$SERVER +short -t aaaa $MACHINENAME.$REALM ||
failed=$(expr $failed + 1)
# Tests with --dns-ttl option
testit "net ads dns register with default TTL" \
$net_tool ads dns register $MACHINENAME.$REALM $IPADDRMAC -P ||
failed=$(expr $failed + 1)
TTL=$(dig @$SERVER.$REALM +noall +ttlid +answer -t A $MACHINENAME.$REALM |
awk '{ print $2 }')
testit "Verify default TTL of 3600 seconds" \
test "$TTL" = "3600" ||
failed=$(expr $failed + 1)
testit "Update record with TTL of 60 seconds" \
$net_tool ads dns register --dns-ttl 60 --force $MACHINENAME.$REALM $IPADDRMAC -P ||
failed=$(expr $failed + 1)
TTL=$(dig @$SERVER.$REALM +noall +ttlid +answer -t A $MACHINENAME.$REALM |
awk '{ print $2 }')
testit "Verify new TTL of 60 seconds" \
test "$TTL" = "60" ||
failed=$(expr $failed + 1)
testit "We should be able to unregister the name $MACHINENAME.$REALM $IPADDRESS" \
$VALGRIND $net_tool ads dns unregister $MACHINENAME.$REALM -P ||
failed=$(expr $failed + 1)
testit_grep_count \
"The name $MACHINENAME.$REALM ($IPADDRESS) should not be there any longer" \
"$IPADDRESS" \
0 \
dig @$SERVER.$REALM +short -t A $MACHINENAME.$REALM ||
failed=$(expr $failed + 1)
testit_grep_count \
"The name $MACHINENAME.$REALM ($IP6ADDRESS) should not be there any longer" \
"$IP6ADDRESS" \
0 \
dig @$SERVER.$REALM +short -t AAAA $MACHINENAME.$REALM ||
failed=$(expr $failed + 1)
testok $0 $failed
|
