Skip to content

Commit f8f35a6

Browse files
gpotter2gpotter2
authored
Add channel binding support in SSPs (#4723)
* Implement channel bindings * Hotpatch kerberos doc. More to come later * Try to fix LDAP test
1 parent fa70dbf commit f8f35a6

19 files changed

Lines changed: 792 additions & 349 deletions

File tree

‎.config/ci/install.sh‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,7 @@ then
3737
sudo apt-get -qy install can-utils || exit 1
3838
sudo apt-get -qy install linux-modules-extra-$(uname -r) || exit 1
3939
sudo apt-get -qy install samba smbclient
40-
# For OpenLDAP, we need to pre-populate some setup questions
41-
sudo debconf-set-selections <<< 'slapd slapd/password2 password Bonjour1'
42-
sudo debconf-set-selections <<< 'slapd slapd/password1 password Bonjour1'
43-
sudo debconf-set-selections <<< 'slapd slapd/domain string scapy.net'
44-
sudo apt-get -qy install slapd
45-
ldapadd -D "cn=admin,dc=scapy,dc=net" -w Bonjour1 -f $CUR/openldap-testdata.ldif -c
40+
sudo bash $CUR/openldap/install.sh
4641
# Make sure libpcap is installed
4742
if [ ! -z $SCAPY_USE_LIBPCAP ]
4843
then

‎.config/ci/openldap-testdata.ldif‎

Lines changed: 0 additions & 146 deletions
This file was deleted.

‎.config/ci/openldap/config.ldif‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# SPDX-License-Identifier: GPL-2.0-only
2+
# This file is part of Scapy
3+
4+
# Contains the configuration of our OpenLDAP test server
5+
6+
# Configure LDAPS
7+
dn: cn=config
8+
changetype: modify
9+
add: olcTLSCACertificateFile
10+
olcTLSCACertificateFile: {{CAFILE}}
11+
12+
dn: cn=config
13+
changetype: modify
14+
replace: olcTLSCertificateKeyFile
15+
olcTLSCertificateKeyFile: {{KEYFILE}}
16+
17+
dn: cn=config
18+
changetype: modify
19+
replace: olcTLSCertificateFile
20+
olcTLSCertificateFile: {{CRTFILE}}
21+
22+
dn: cn=config
23+
changetype: modify
24+
add: olcTLSVerifyClient
25+
olcTLSVerifyClient: never
26+
27+
# Set channel bindings to 'tls-endpoint', like it would be on Windows
28+
dn: cn=config
29+
changetype: modify
30+
replace: olcSaslCbinding
31+
olcSaslCbinding: tls-endpoint

‎.config/ci/openldap/install.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
3+
# SPDX-License-Identifier: GPL-2.0-only
4+
# This file is part of Scapy
5+
# See https://scapy.net/ for more information
6+
7+
# Install an OpenLDAP test server
8+
9+
# Pre-populate some setup questions
10+
sudo debconf-set-selections <<< 'slapd slapd/password2 password Bonjour1'
11+
sudo debconf-set-selections <<< 'slapd slapd/password1 password Bonjour1'
12+
sudo debconf-set-selections <<< 'slapd slapd/domain string scapy.net'
13+
14+
# Run setup
15+
sudo apt-get -qy install slapd
16+
17+
# Enable LDAPs
18+
echo "Enabling HTTPS on slapd..."
19+
sudo sed -i '/^SLAPD_SERVICES/ c\SLAPD_SERVICES="ldap:/// ldapi:/// ldaps://"' /etc/default/slapd
20+
sudo systemctl restart slapd
21+
22+
# Calculate the paths we're going to need.
23+
CUR=$( cd "$(dirname "${BASH_SOURCE[0]}")" ; pwd -P )
24+
PKIPATH=$(realpath "$CUR/../../../test/scapy/layers/tls/pki")
25+
OLDAPPATH=$(mktemp -d -t scapy_openldap_XXXX)
26+
27+
# Copy certificates to temp path
28+
cp ${PKIPATH}/ca_cert.pem ${OLDAPPATH}
29+
cp ${PKIPATH}/srv_cert.pem ${OLDAPPATH}
30+
cp ${PKIPATH}/srv_key.pem ${OLDAPPATH}
31+
chmod a+rx -R ${OLDAPPATH}
32+
33+
# Copy config template and replace variables.
34+
echo "Creating OpenLDAP config..."
35+
openldap_conf=${OLDAPPATH}/openldap_config.ldif
36+
cp $CUR/config.ldif $openldap_conf
37+
sed -i "s@{{CAFILE}}@${OLDAPPATH}/ca_cert.pem@g" $openldap_conf
38+
sed -i "s@{{CRTFILE}}@${OLDAPPATH}/srv_cert.pem@g" $openldap_conf
39+
sed -i "s@{{KEYFILE}}@${OLDAPPATH}/srv_key.pem@g" $openldap_conf
40+
41+
echo "Applying OpenLDAP config..."
42+
sudo ldapmodify -Y EXTERNAL -H "ldapi:///" -w Bonjour1 -f $openldap_conf -c
43+
echo "Adding initial dummy data..."
44+
sudo ldapadd -D "cn=admin,dc=scapy,dc=net" -w Bonjour1 -H "ldapi:///" -f $CUR/testdata.ldif -c

‎.config/ci/openldap/testdata.ldif‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# SPDX-License-Identifier: OLDAP-2.8
2+
# This file is based on https://git.openldap.org/openldap/openldap/-/blob/master/tests/data/ppolicy.ldif?ref_type=heads
3+
# (renamed to dc=scapy, dc=net)
4+
5+
dn: dc=scapy, dc=net
6+
objectClass: top
7+
objectClass: organization
8+
objectClass: dcObject
9+
o: Scapy
10+
dc: scapy
11+
12+
dn: ou=People, dc=scapy, dc=net
13+
objectClass: top
14+
objectClass: organizationalUnit
15+
ou: People
16+
17+
dn: ou=Groups, dc=scapy, dc=net
18+
objectClass: organizationalUnit
19+
ou: Groups
20+
21+
dn: cn=Policy Group, ou=Groups, dc=scapy, dc=net
22+
objectClass: groupOfNames
23+
cn: Policy Group
24+
member: uid=nd, ou=People, dc=scapy, dc=net
25+
owner: uid=ndadmin, ou=People, dc=scapy, dc=net
26+
27+
dn: cn=Test Group, ou=Groups, dc=scapy, dc=net
28+
objectClass: groupOfNames
29+
cn: Policy Group
30+
member: uid=another, ou=People, dc=scapy, dc=net
31+
32+
dn: ou=Policies, dc=scapy, dc=net
33+
objectClass: top
34+
objectClass: organizationalUnit
35+
ou: Policies
36+
37+
dn: uid=nd, ou=People, dc=scapy, dc=net
38+
objectClass: top
39+
objectClass: person
40+
objectClass: inetOrgPerson
41+
cn: Neil Dunbar
42+
uid: nd
43+
sn: Dunbar
44+
givenName: Neil
45+
userPassword: testpassword
46+
47+
dn: uid=ndadmin, ou=People, dc=scapy, dc=net
48+
objectClass: top
49+
objectClass: person
50+
objectClass: inetOrgPerson
51+
cn: Neil Dunbar (Admin)
52+
uid: ndadmin
53+
sn: Dunbar
54+
givenName: Neil
55+
userPassword: testpw
56+
57+
dn: uid=another, ou=People, dc=scapy, dc=net
58+
objectClass: top
59+
objectClass: person
60+
objectClass: inetOrgPerson
61+
cn: Another Test
62+
uid: another
63+
sn: Test
64+
givenName: Another
65+
userPassword: testing
66+

0 commit comments

Comments
 (0)