Skip to content

Commit bc68f10

Browse files
nikicnikic
committed
Merge branch 'PHP-7.4'
* PHP-7.4: enable ext/ldap/tests on azure fix some ext/ldap/tests
2 parents bee2cf0 + b291c92 commit bc68f10

File tree

7 files changed

+207
-8
lines changed

7 files changed

+207
-8
lines changed

‎azure/apt.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ steps:
77
sudo apt install bison \
88
re2c \
99
locales \
10+
ldap-utils \
11+
openssl \
12+
slapd \
1013
language-pack-de \
1114
re2c \
1215
libgmp-dev \
@@ -29,7 +32,6 @@ steps:
2932
libpq-dev \
3033
libreadline-dev \
3134
libldap2-dev \
32-
libsasl2-dev \
3335
libsodium-dev \
3436
libargon2-0-dev \
3537
postgresql \

‎azure/setup-slapd.sh

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
#!/bin/sh
2+
set -ev
3+
4+
# Create TLS certificate
5+
sudo mkdir -p /etc/ldap/ssl
6+
7+
alt_names() {
8+
(
9+
(
10+
(hostname && hostname -a && hostname -A && hostname -f) |
11+
xargs -n 1 |
12+
sort -u |
13+
sed -e 's/\(\S\+\)/DNS:\1/g'
14+
) && (
15+
(hostname -i && hostname -I && echo "127.0.0.1 ::1") |
16+
xargs -n 1 |
17+
sort -u |
18+
sed -e 's/\(\S\+\)/IP:\1/g'
19+
)
20+
) | paste -d, -s
21+
}
22+
23+
sudo openssl req -newkey rsa:4096 -x509 -nodes -days 3650 \
24+
-out /etc/ldap/ssl/server.crt -keyout /etc/ldap/ssl/server.key \
25+
-subj "/C=US/ST=Arizona/L=Localhost/O=localhost/CN=localhost" \
26+
-addext "subjectAltName = `alt_names`"
27+
28+
sudo chown -R openldap:openldap /etc/ldap/ssl
29+
30+
# Display the TLS certificate (should be world readable)
31+
openssl x509 -noout -text -in /etc/ldap/ssl/server.crt
32+
33+
# Point to the certificate generated
34+
if ! grep -q 'TLS_CACERT \/etc\/ldap\/ssl\/server.crt' /etc/ldap/ldap.conf; then
35+
sudo sed -e 's|^\s*TLS_CACERT|# TLS_CACERT|' -i /etc/ldap/ldap.conf
36+
echo 'TLS_CACERT /etc/ldap/ssl/server.crt' | sudo tee -a /etc/ldap/ldap.conf
37+
fi
38+
39+
# Configure LDAP protocols to serve.
40+
sudo sed -e 's|^\s*SLAPD_SERVICES\s*=.*$|SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"|' -i /etc/default/slapd
41+
42+
# Configure LDAP database.
43+
DBDN=`sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(&(olcRootDN=*)(olcSuffix=*))' dn | grep -i '^dn:' | sed -e 's/^dn:\s*//'`;
44+
45+
sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif
46+
47+
sudo service slapd restart
48+
49+
sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// << EOF
50+
dn: $DBDN
51+
changetype: modify
52+
replace: olcSuffix
53+
olcSuffix: dc=my-domain,dc=com
54+
-
55+
replace: olcRootDN
56+
olcRootDN: cn=Manager,dc=my-domain,dc=com
57+
-
58+
replace: olcRootPW
59+
olcRootPW: secret
60+
61+
dn: cn=config
62+
changetype: modify
63+
add: olcTLSCACertificateFile
64+
olcTLSCACertificateFile: /etc/ldap/ssl/server.crt
65+
-
66+
add: olcTLSCertificateFile
67+
olcTLSCertificateFile: /etc/ldap/ssl/server.crt
68+
-
69+
add: olcTLSCertificateKeyFile
70+
olcTLSCertificateKeyFile: /etc/ldap/ssl/server.key
71+
-
72+
add: olcTLSVerifyClient
73+
olcTLSVerifyClient: never
74+
-
75+
add: olcAuthzRegexp
76+
olcAuthzRegexp: uid=usera,cn=digest-md5,cn=auth cn=usera,dc=my-domain,dc=com
77+
-
78+
replace: olcLogLevel
79+
olcLogLevel: -1
80+
81+
dn: cn=module{0},cn=config
82+
changetype: modify
83+
add: olcModuleLoad
84+
olcModuleLoad: sssvlv
85+
-
86+
add: olcModuleLoad
87+
olcModuleLoad: ppolicy
88+
-
89+
add: olcModuleLoad
90+
olcModuleLoad: dds
91+
EOF
92+
93+
sudo service slapd restart
94+
95+
sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// << EOF
96+
dn: olcOverlay=sssvlv,$DBDN
97+
objectClass: olcOverlayConfig
98+
objectClass: olcSssVlvConfig
99+
olcOverlay: sssvlv
100+
olcSssVlvMax: 10
101+
olcSssVlvMaxKeys: 5
102+
103+
dn: olcOverlay=ppolicy,$DBDN
104+
objectClass: olcOverlayConfig
105+
objectClass: olcPPolicyConfig
106+
olcOverlay: ppolicy
107+
### This would clutter our DIT and make tests to fail, while ppolicy does not
108+
### seem to work as we expect (it does not seem to provide expected controls)
109+
## olcPPolicyDefault: cn=default,ou=pwpolicies,dc=my-domain,dc=com
110+
## olcPPolicyHashCleartext: FALSE
111+
## olcPPolicyUseLockout: TRUE
112+
113+
dn: olcOverlay=dds,$DBDN
114+
objectClass: olcOverlayConfig
115+
objectClass: olcDdsConfig
116+
olcOverlay: dds
117+
EOF
118+
119+
sudo service slapd restart
120+
121+
sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// << EOF
122+
dn: $DBDN
123+
changetype: modify
124+
add: olcDbIndex
125+
olcDbIndex: entryExpireTimestamp eq
126+
EOF
127+
128+
sudo service slapd restart
129+
130+
ldapadd -H ldapi:/// -D cn=Manager,dc=my-domain,dc=com -w secret <<EOF
131+
dn: dc=my-domain,dc=com
132+
objectClass: top
133+
objectClass: organization
134+
objectClass: dcObject
135+
dc: my-domain
136+
o: php ldap tests
137+
138+
### This would clutter our DIT and make tests to fail, while ppolicy does not
139+
### seem to work as we expect (it does not seem to provide expected controls)
140+
## dn: ou=pwpolicies,dc=my-domain,dc=com
141+
## objectClass: top
142+
## objectClass: organizationalUnit
143+
## ou: pwpolicies
144+
##
145+
## dn: cn=default,ou=pwpolicies,dc=my-domain,dc=com
146+
## objectClass: top
147+
## objectClass: person
148+
## objectClass: pwdPolicy
149+
## cn: default
150+
## sn: default
151+
## pwdAttribute: userPassword
152+
## pwdMaxAge: 2592000
153+
## pwdExpireWarning: 3600
154+
## #pwdInHistory: 0
155+
## pwdCheckQuality: 0
156+
## pwdMaxFailure: 5
157+
## pwdLockout: TRUE
158+
## #pwdLockoutDuration: 0
159+
## #pwdGraceAuthNLimit: 0
160+
## #pwdFailureCountInterval: 0
161+
## pwdMustChange: FALSE
162+
## pwdMinLength: 3
163+
## pwdAllowUserChange: TRUE
164+
## pwdSafeModify: FALSE
165+
EOF
166+
167+
# Verify TLS connection
168+
169+
ldapsearch -d 255 -H ldaps://localhost -D cn=Manager,dc=my-domain,dc=com -w secret -s base -b dc=my-domain,dc=com 'objectclass=*'

‎azure/setup.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,11 @@ steps:
33
set -e
44
sudo service mysql start
55
sudo service postgresql start
6+
sudo service slapd start
67
mysql -uroot -proot -e "CREATE DATABASE IF NOT EXISTS test"
78
sudo -u postgres psql -c "ALTER USER postgres PASSWORD 'postgres';"
89
sudo -u postgres psql -c "CREATE DATABASE test;"
910
displayName: 'Setup'
11+
- script: ./azure/setup-slapd.sh
12+
displayName: 'Configure slapd'
13+

‎ext/ldap/tests/CONFLICTS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ldap

‎ext/ldap/tests/connect.inc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@ $host = getenv("LDAP_TEST_HOST") ?: "localhost";
99
$port = getenv("LDAP_TEST_PORT") ?: 389;
1010
$base = getenv("LDAP_TEST_BASE") ?: "dc=my-domain,dc=com";
1111
$user = getenv("LDAP_TEST_USER") ?: "cn=Manager,$base";
12-
$sasl_user = getenv("LDAP_TEST_SASL_USER") ?: "Manager";
1312
$passwd = getenv("LDAP_TEST_PASSWD") ?: "secret";
13+
$sasl_user = getenv("LDAP_TEST_SASL_USER") ?: "userA";
14+
$sasl_passwd = getenv("LDAP_TEST_SASL_PASSWD") ?: "oops";
1415
$protocol_version = getenv("LDAP_TEST_OPT_PROTOCOL_VERSION") ?: 3;
1516
$skip_on_bind_failure = getenv("LDAP_TEST_SKIP_BIND_FAILURE") ?: true;
1617

‎ext/ldap/tests/ldap_sasl_bind_basic.phpt

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,20 @@ Patrick Allaert <patrickallaert@php.net>
1717
<?php
1818
require "connect.inc";
1919

20+
$link = ldap_connect_and_bind($host, $port, $user, $passwd, $protocol_version);
21+
insert_dummy_data($link, $base);
22+
ldap_unbind($link);
23+
2024
$link = ldap_connect($host, $port);
2125
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
22-
var_dump(ldap_sasl_bind($link, null, $passwd, 'DIGEST-MD5', 'realm', $sasl_user));
26+
var_dump(ldap_sasl_bind($link, null, $sasl_passwd, 'DIGEST-MD5', 'realm', $sasl_user));
27+
?>
28+
--CLEAN--
29+
<?php
30+
include "connect.inc";
31+
32+
$link = ldap_connect_and_bind($host, $port, $user, $passwd, $protocol_version);
33+
remove_dummy_data($link, $base);
2334
?>
2435
--EXPECT--
2536
bool(true)

‎ext/ldap/tests/ldap_sasl_bind_error.phpt

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,33 @@ Patrick Allaert <patrickallaert@php.net>
1111
<?php
1212
require "connect.inc";
1313

14+
$link = ldap_connect_and_bind($host, $port, $user, $passwd, $protocol_version);
15+
insert_dummy_data($link, $base);
16+
ldap_unbind($link);
17+
1418
$link = ldap_connect($host, $port);
1519
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
1620

1721
// Invalid DN
18-
var_dump(ldap_sasl_bind($link, "Invalid DN", $passwd, 'DIGEST-MD5', 'realm', $sasl_user));
22+
var_dump(ldap_sasl_bind($link, "Invalid DN", $sasl_passwd, 'DIGEST-MD5', 'realm', $sasl_user));
1923

2024
// Invalid user
21-
var_dump(ldap_sasl_bind($link, null, "ThisIsNotCorrect$passwd", 'DIGEST-MD5', "realm", "invalid$sasl_user"));
25+
var_dump(ldap_sasl_bind($link, null, "ThisIsNotCorrect$sasl_passwd", 'DIGEST-MD5', "realm", "invalid$sasl_user"));
2226

2327
// Invalid password
24-
var_dump(ldap_sasl_bind($link, null, "ThisIsNotCorrect$passwd", 'DIGEST-MD5', "realm", $sasl_user));
28+
var_dump(ldap_sasl_bind($link, null, "ThisIsNotCorrect$sasl_passwd", 'DIGEST-MD5', "realm", $sasl_user));
2529

26-
var_dump(ldap_sasl_bind($link, null, $passwd, 'DIGEST-MD5', "realm", "Manager", "test"));
30+
var_dump(ldap_sasl_bind($link, null, $sasl_passwd, 'DIGEST-MD5', "realm", "Manager", "test"));
2731

2832
// Invalid DN syntax
29-
var_dump(ldap_sasl_bind($link, "unexistingProperty=weirdValue,$user", $passwd));
33+
var_dump(ldap_sasl_bind($link, "unexistingProperty=weirdValue,$user", $sasl_passwd));
34+
?>
35+
--CLEAN--
36+
<?php
37+
include "connect.inc";
38+
39+
$link = ldap_connect_and_bind($host, $port, $user, $passwd, $protocol_version);
40+
remove_dummy_data($link, $base);
3041
?>
3142
--EXPECTF--
3243
Warning: ldap_sasl_bind(): Unable to bind to server: Invalid DN syntax in %s on line %d

0 commit comments

Comments
 (0)