1#! /bin/sh
2# $OpenLDAP$
3## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4##
5## Copyright 1998-2021 The OpenLDAP Foundation.
6## All rights reserved.
7##
8## Redistribution and use in source and binary forms, with or without
9## modification, are permitted only as authorized by the OpenLDAP
10## Public License.
11##
12## A copy of this license is available in the file LICENSE in the
13## top-level directory of the distribution or, alternatively, at
14## <http://www.OpenLDAP.org/license.html>.
15
16echo "running defines.sh"
17. $SRCDIR/scripts/defines.sh
18
19if test $WITH_TLS = no ; then
20        echo "TLS support not available, test skipped"
21        exit 0
22fi
23
24openssl=`command -v openssl 2>/dev/null`
25certtool=`command -v certtool 2>/dev/null`
26base64=`command -v base64 2>/dev/null`
27
28mkdir -p $TESTDIR $DBDIR1
29cp -r $DATADIR/tls $TESTDIR
30
31cd $TESTWD
32
33if test -z "$TLS_PEERKEY_HASHALG"; then
34          TLS_PEERKEY_HASHALG=sha256
35fi
36if test -n "${openssl}"; then
37          TLS_PEERKEY="`"${openssl}" x509 -pubkey -noout -in $TESTDIR/tls/certs/localhost.crt | \
38                    "${openssl}" rsa -pubin -outform der 2>/dev/null | \
39                    "${openssl}" enc -base64 2>/dev/null`"
40
41          TLS_PEERKEY_HASHED="$TLS_PEERKEY_HASHALG:`"${openssl}" x509 -pubkey -noout -in $TESTDIR/tls/certs/localhost.crt | \
42                    "${openssl}" rsa -pubin -outform der 2>/dev/null | \
43                    "${openssl}" dgst "-$TLS_PEERKEY_HASHALG" -binary 2>/dev/null | \
44                    "${openssl}" enc -base64 2>/dev/null`"
45
46          TLS_PEERKEY_HASHED_FAIL="$TLS_PEERKEY_HASHALG:`echo \"a fake key to hash\" | \
47                    "${openssl}" dgst "-$TLS_PEERKEY_HASHALG" -binary 2>/dev/null | \
48                    "${openssl}" enc -base64 2>/dev/null`"
49elif test -n "${certtool}" && test -n "${base64}"; then
50          echo "OpenSSL not found, falling back to certtool"
51          echo "This will not exercise hashed pin functionality"
52          TLS_PEERKEY="`"${certtool}" --certificate-pubkey --outder \
53                    --infile $TESTDIR/tls/certs/localhost.crt \
54                    --load-pubkey $TESTDIR/tls/certs/localhost.crt \
55                    | "${base64}"`"
56else
57          echo "No way to extract the public key from certificate, key pinning tests will be skipped..."
58fi
59
60echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..."
61. $CONFFILTER $BACKEND < $TLSCONF > $CONF1
62$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL > $LOG1 2>&1 &
63PID=$!
64if test $WAIT != 0 ; then
65    echo PID $PID
66    read foo
67fi
68KILLPIDS="$PID"
69
70sleep 1
71
72for i in 0 1 2 3 4 5; do
73          $LDAPSEARCH -s base -b "" -H $URI1 \
74                    'objectclass=*' > /dev/null 2>&1
75        RC=$?
76        if test $RC = 0 ; then
77                break
78        fi
79        echo "Waiting 5 seconds for slapd to start..."
80        sleep 5
81done
82
83if test $RC != 0 ; then
84          echo "ldapsearch failed ($RC)!"
85          test $KILLSERVERS != no && kill -HUP $KILLPIDS
86          exit $RC
87fi
88
89echo -n "Using ldapsearch with startTLS with no server cert validation...."
90$LDAPSEARCH -o tls_reqcert=never -ZZ -b "" -s base -H $URIP1 \
91          '@extensibleObject' > $SEARCHOUT 2>&1
92RC=$?
93if test $RC != 0 ; then
94          echo "ldapsearch (startTLS) failed ($RC)!"
95          test $KILLSERVERS != no && kill -HUP $KILLPIDS
96          exit $RC
97else
98          echo "success"
99fi
100
101echo -n "Using ldapsearch with startTLS with hard require cert...."
102$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -ZZ -b "" -s base -H $URIP1 \
103          '@extensibleObject' > $SEARCHOUT 2>&1
104RC=$?
105if test $RC != 0 ; then
106          echo "ldapsearch (startTLS) failed ($RC)!"
107          test $KILLSERVERS != no && kill -HUP $KILLPIDS
108          exit $RC
109else
110          echo "success"
111fi
112
113if test $WITH_TLS_TYPE = openssl ; then
114          echo -n "Using ldapsearch with startTLS and specific protocol version...."
115          $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -o tls_protocol_min=3.3 -ZZ -b "" -s base -H $URIP1 \
116                    '@extensibleObject' > $SEARCHOUT 2>&1
117          RC=$?
118          if test $RC != 0 ; then
119                    echo "ldapsearch (protocol-min) failed ($RC)!"
120                    test $KILLSERVERS != no && kill -HUP $KILLPIDS
121                    exit $RC
122          else
123                    echo "success"
124          fi
125fi
126
127echo -n "Using ldapsearch with StartTLS and pinning enabled but a pin that doesn't match..."
128$LDAPSEARCH -o tls_reqcert=never -o tls_peerkey_hash=abcd -ZZ \
129          -b "" -s base -H $URIP1 '@extensibleObject' > $SEARCHOUT 2>&1
130RC=$?
131if test $RC = 0 ; then
132          echo "ldapsearch (StartTLS) succeeded when it should have failed($RC)!"
133          test $KILLSERVERS != no && kill -HUP $KILLPIDS
134          exit 1
135else
136          echo "failed correctly with error code ($RC)"
137fi
138
139echo -n "Using ldapsearch with StartTLS and a valid plaintext pin..."
140if test -n "$TLS_PEERKEY"; then
141          $LDAPSEARCH -o tls_reqcert=hard -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \
142                    -o tls_peerkey_hash="${TLS_PEERKEY}" \
143                    -ZZ -b "" -s base -H $URIP1 '@extensibleObject' > $SEARCHOUT 2>&1
144          RC=$?
145          if test $RC != 0 ; then
146                    echo "ldapsearch (StartTLS) failed ($RC)!"
147                    test $KILLSERVERS != no && kill -HUP $KILLPIDS
148                    exit $RC
149          else
150                    echo "success"
151          fi
152else
153          echo "skipped"
154fi
155
156echo -n "Using ldapsearch with StartTLS and an invalid hashed pin..."
157if test -n "$TLS_PEERKEY_HASHED_FAIL"; then
158          $LDAPSEARCH -o tls_reqcert=hard -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \
159                    -o tls_peerkey_hash="${TLS_PEERKEY_HASHED_FAIL}" \
160                    -ZZ -b "" -s base -H $URIP1 '@extensibleObject' > $SEARCHOUT 2>&1
161          RC=$?
162          if test $RC = 0 ; then
163                    echo "ldapsearch (StartTLS) succeeded when it should have failed($RC)!"
164                    test $KILLSERVERS != no && kill -HUP $KILLPIDS
165                    exit 1
166          else
167                    echo "failed correctly with error code ($RC)"
168          fi
169else
170          echo "skipped"
171fi
172
173echo -n "Using ldapsearch with StartTLS and a valid hashed pin..."
174if test -n "$TLS_PEERKEY_HASHED"; then
175          $LDAPSEARCH -o tls_reqcert=hard -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \
176                    -o tls_peerkey_hash="${TLS_PEERKEY_HASHED}" \
177                    -ZZ -b "" -s base -H $URIP1 '@extensibleObject' > $SEARCHOUT 2>&1
178          RC=$?
179          if test $RC != 0 ; then
180                    echo "ldapsearch (StartTLS) failed ($RC)!"
181                    test $KILLSERVERS != no && kill -HUP $KILLPIDS
182                    exit $RC
183          else
184                    echo "success"
185          fi
186else
187          echo "skipped"
188fi
189
190echo -n "Using ldapsearch on $SURI2 with no server cert validation..."
191$LDAPSEARCH -o tls_reqcert=never -b "cn=Subschema" -s base -H $SURIP2 \
192          '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
193          >> $SEARCHOUT  2>&1
194RC=$?
195if test $RC != 0 ; then
196          echo "ldapsearch (ldaps) failed($RC)!"
197          test $KILLSERVERS != no && kill -HUP $KILLPIDS
198          exit $RC
199else
200          echo "success"
201fi
202
203echo -n "Using ldapsearch on $SURI2 with reqcert HARD and no CA cert.  Should fail..."
204$LDAPSEARCH -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \
205          '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
206          >> $SEARCHOUT  2>&1
207RC=$?
208if test $RC = 0 ; then
209          echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!"
210          test $KILLSERVERS != no && kill -HUP $KILLPIDS
211          exit 1
212else
213          echo "failed correctly with error code ($RC)"
214fi
215
216echo -n "Using ldapsearch on $SURI2 with CA cert and reqcert HARD..."
217$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \
218          '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
219          >> $SEARCHOUT  2>&1
220RC=$?
221if test $RC != 0 ; then
222          echo "ldapsearch (ldaps) failed ($RC)!"
223          test $KILLSERVERS != no && kill -HUP $KILLPIDS
224          exit $RC
225else
226          echo "success"
227fi
228
229echo -n "Using ldapsearch on $SURI2 with pinning enabled but a pin that doesn't match..."
230$LDAPSEARCH -o tls_reqcert=never -o tls_peerkey_hash=abcd \
231          -b "cn=Subschema" -s base -H $SURIP2 \
232          '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
233          >> $SEARCHOUT  2>&1
234RC=$?
235if test $RC = 0 ; then
236          echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!"
237          test $KILLSERVERS != no && kill -HUP $KILLPIDS
238          exit 1
239else
240          echo "failed correctly with error code ($RC)"
241fi
242
243echo -n "Using ldapsearch on $SURI2 with a valid plaintext pin..."
244if test -n "$TLS_PEERKEY"; then
245          $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard \
246                    -o tls_peerkey_hash="${TLS_PEERKEY}" -b "cn=Subschema" -s base -H $SURIP2 \
247                    '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
248                    >> $SEARCHOUT  2>&1
249          RC=$?
250          if test $RC != 0 ; then
251                    echo "ldapsearch (ldaps) failed ($RC)!"
252                    test $KILLSERVERS != no && kill -HUP $KILLPIDS
253                    exit $RC
254          else
255                    echo "success"
256          fi
257else
258          echo "skipped"
259fi
260
261echo -n "Using ldapsearch on $SURI2 with an invalid hashed pin..."
262if test -n "$TLS_PEERKEY_HASHED_FAIL"; then
263          $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard \
264                    -o tls_peerkey_hash="${TLS_PEERKEY_HASHED_FAIL}" -b "cn=Subschema" -s base -H $SURIP2 \
265                    '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
266                    >> $SEARCHOUT  2>&1
267          RC=$?
268          if test $RC = 0 ; then
269                    echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!"
270                    test $KILLSERVERS != no && kill -HUP $KILLPIDS
271                    exit 1
272          else
273                    echo "failed correctly with error code ($RC)"
274          fi
275else
276          echo "skipped"
277fi
278
279echo -n "Using ldapsearch on $SURI2 with a valid hashed pin..."
280if test -n "$TLS_PEERKEY_HASHED"; then
281          $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard \
282                    -o tls_peerkey_hash="${TLS_PEERKEY_HASHED}" -b "cn=Subschema" -s base -H $SURIP2 \
283                    '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
284                    >> $SEARCHOUT  2>&1
285          RC=$?
286          if test $RC != 0 ; then
287                    echo "ldapsearch (ldaps) failed ($RC)!"
288                    test $KILLSERVERS != no && kill -HUP $KILLPIDS
289                    exit $RC
290          else
291                    echo "success"
292          fi
293else
294          echo "skipped"
295fi
296
297test $KILLSERVERS != no && kill -HUP $KILLPIDS
298
299echo ">>>>> Test succeeded"
300RC=0
301
302test $KILLSERVERS != no && wait
303
304exit $RC
305