Skip to content

Commit 64e500b

Browse files
bukkabukka
committed
LDAP: Test TLS_PROTOCOL_MAX
1 parent 359f442 commit 64e500b

File tree

5 files changed

+458
-429
lines changed

5 files changed

+458
-429
lines changed

‎.circleci/config.yml

Lines changed: 156 additions & 154 deletions
Original file line numberDiff line numberDiff line change
@@ -25,161 +25,163 @@ jobs:
2525
PDO_MYSQL_TEST_USER: root
2626
PDO_PGSQL_TEST_DSN: 'pgsql:host=127.0.0.1 port=5432 dbname=test user=postgres password=postgres'
2727
steps:
28-
- checkout
2928
- run:
30-
name: apt
31-
command: |
32-
export DEBIAN_FRONTEND=noninteractive
33-
sudo apt-get update -y
34-
sudo apt-get install -y \
35-
gcc \
36-
g++ \
37-
autoconf \
38-
bison \
39-
re2c \
40-
locales \
41-
locales-all \
42-
ldap-utils \
43-
openssl \
44-
slapd \
45-
libgmp-dev \
46-
libicu-dev \
47-
libtidy-dev \
48-
libenchant-2-dev \
49-
libsasl2-dev \
50-
libxpm-dev \
51-
libzip-dev \
52-
libbz2-dev \
53-
libsqlite3-dev \
54-
libwebp-dev \
55-
libonig-dev \
56-
libcurl4-openssl-dev \
57-
libxml2-dev \
58-
libxslt1-dev \
59-
libpq-dev \
60-
libreadline-dev \
61-
libldap2-dev \
62-
libsodium-dev \
63-
libargon2-0-dev \
64-
libmm-dev \
65-
libsnmp-dev \
66-
snmpd \
67-
`#snmp-mibs-downloader` \
68-
freetds-dev \
69-
`#unixodbc-dev` \
70-
dovecot-core \
71-
dovecot-pop3d \
72-
dovecot-imapd \
73-
sendmail \
74-
firebird-dev \
75-
liblmdb-dev \
76-
libtokyocabinet-dev \
77-
libdb-dev \
78-
libqdbm-dev \
79-
libjpeg-dev \
80-
libpng-dev \
81-
libfreetype6-dev
82-
- run:
83-
name: ./configure
84-
command: |
85-
./buildconf -f
86-
./configure \
87-
--enable-debug \
88-
--enable-zts \
89-
--enable-option-checking=fatal \
90-
--prefix=/usr \
91-
--enable-phpdbg \
92-
--enable-fpm \
93-
--with-pdo-mysql=mysqlnd \
94-
--with-mysqli=mysqlnd \
95-
--with-pgsql \
96-
--with-pdo-pgsql \
97-
--with-pdo-sqlite \
98-
--enable-intl \
99-
--without-pear \
100-
--enable-gd \
101-
--with-jpeg \
102-
--with-webp \
103-
--with-freetype \
104-
--with-xpm \
105-
--enable-exif \
106-
--with-zip \
107-
--with-zlib \
108-
--enable-soap \
109-
--enable-xmlreader \
110-
--with-xsl \
111-
--with-tidy \
112-
--enable-sysvsem \
113-
--enable-sysvshm \
114-
--enable-shmop \
115-
--enable-pcntl \
116-
--with-readline \
117-
--enable-mbstring \
118-
--with-curl \
119-
--with-gettext \
120-
--enable-sockets \
121-
--with-bz2 \
122-
--with-openssl \
123-
--with-gmp \
124-
--enable-bcmath \
125-
--enable-calendar \
126-
--enable-ftp \
127-
--with-enchant=/usr \
128-
--enable-sysvmsg \
129-
--with-ffi \
130-
--enable-zend-test \
131-
--enable-dl-test=shared \
132-
--with-ldap \
133-
--with-ldap-sasl \
134-
--with-password-argon2 \
135-
--with-mhash \
136-
--with-sodium \
137-
--enable-dba \
138-
--with-cdb \
139-
--enable-flatfile \
140-
--enable-inifile \
141-
--with-tcadb \
142-
--with-lmdb \
143-
--with-qdbm \
144-
--with-snmp \
145-
`#--with-unixODBC` \
146-
`#--with-pdo-odbc=unixODBC,/usr` \
147-
--with-config-file-path=/etc \
148-
--with-config-file-scan-dir=/etc/php.d \
149-
--with-pdo-firebird \
150-
`#--with-pdo-dblib` \
151-
--disable-phpdbg \
152-
`#--enable-werror`
153-
- run:
154-
name: make
155-
no_output_timeout: 30m
156-
command: make -j2 > /dev/null
157-
- run:
158-
name: make install
159-
command: |
160-
sudo make install
161-
sudo mkdir -p /etc/php.d
162-
sudo chmod 777 /etc/php.d
163-
echo opcache.enable_cli=1 > /etc/php.d/opcache.ini
164-
echo opcache.protect_memory=1 >> /etc/php.d/opcache.ini
165-
- run:
166-
name: Test
167-
no_output_timeout: 30m
168-
command: |
169-
sapi/cli/php run-tests.php \
170-
-d opcache.enable_cli=1 \
171-
-d opcache.jit_buffer_size=64M \
172-
-d opcache.jit=tracing \
173-
-d zend_test.observer.enabled=1 \
174-
-d zend_test.observer.show_output=0 \
175-
-P -q -x -j2 \
176-
-g FAIL,BORK,LEAK,XLEAK \
177-
--no-progress \
178-
--offline \
179-
--show-diff \
180-
--show-slow 1000 \
181-
--set-timeout 120 \
182-
--repeat 2
29+
command: echo 1
30+
# - checkout
31+
# - run:
32+
# name: apt
33+
# command: |
34+
# export DEBIAN_FRONTEND=noninteractive
35+
# sudo apt-get update -y
36+
# sudo apt-get install -y \
37+
# gcc \
38+
# g++ \
39+
# autoconf \
40+
# bison \
41+
# re2c \
42+
# locales \
43+
# locales-all \
44+
# ldap-utils \
45+
# openssl \
46+
# slapd \
47+
# libgmp-dev \
48+
# libicu-dev \
49+
# libtidy-dev \
50+
# libenchant-2-dev \
51+
# libsasl2-dev \
52+
# libxpm-dev \
53+
# libzip-dev \
54+
# libbz2-dev \
55+
# libsqlite3-dev \
56+
# libwebp-dev \
57+
# libonig-dev \
58+
# libcurl4-openssl-dev \
59+
# libxml2-dev \
60+
# libxslt1-dev \
61+
# libpq-dev \
62+
# libreadline-dev \
63+
# libldap2-dev \
64+
# libsodium-dev \
65+
# libargon2-0-dev \
66+
# libmm-dev \
67+
# libsnmp-dev \
68+
# snmpd \
69+
# `#snmp-mibs-downloader` \
70+
# freetds-dev \
71+
# `#unixodbc-dev` \
72+
# dovecot-core \
73+
# dovecot-pop3d \
74+
# dovecot-imapd \
75+
# sendmail \
76+
# firebird-dev \
77+
# liblmdb-dev \
78+
# libtokyocabinet-dev \
79+
# libdb-dev \
80+
# libqdbm-dev \
81+
# libjpeg-dev \
82+
# libpng-dev \
83+
# libfreetype6-dev
84+
# - run:
85+
# name: ./configure
86+
# command: |
87+
# ./buildconf -f
88+
# ./configure \
89+
# --enable-debug \
90+
# --enable-zts \
91+
# --enable-option-checking=fatal \
92+
# --prefix=/usr \
93+
# --enable-phpdbg \
94+
# --enable-fpm \
95+
# --with-pdo-mysql=mysqlnd \
96+
# --with-mysqli=mysqlnd \
97+
# --with-pgsql \
98+
# --with-pdo-pgsql \
99+
# --with-pdo-sqlite \
100+
# --enable-intl \
101+
# --without-pear \
102+
# --enable-gd \
103+
# --with-jpeg \
104+
# --with-webp \
105+
# --with-freetype \
106+
# --with-xpm \
107+
# --enable-exif \
108+
# --with-zip \
109+
# --with-zlib \
110+
# --enable-soap \
111+
# --enable-xmlreader \
112+
# --with-xsl \
113+
# --with-tidy \
114+
# --enable-sysvsem \
115+
# --enable-sysvshm \
116+
# --enable-shmop \
117+
# --enable-pcntl \
118+
# --with-readline \
119+
# --enable-mbstring \
120+
# --with-curl \
121+
# --with-gettext \
122+
# --enable-sockets \
123+
# --with-bz2 \
124+
# --with-openssl \
125+
# --with-gmp \
126+
# --enable-bcmath \
127+
# --enable-calendar \
128+
# --enable-ftp \
129+
# --with-enchant=/usr \
130+
# --enable-sysvmsg \
131+
# --with-ffi \
132+
# --enable-zend-test \
133+
# --enable-dl-test=shared \
134+
# --with-ldap \
135+
# --with-ldap-sasl \
136+
# --with-password-argon2 \
137+
# --with-mhash \
138+
# --with-sodium \
139+
# --enable-dba \
140+
# --with-cdb \
141+
# --enable-flatfile \
142+
# --enable-inifile \
143+
# --with-tcadb \
144+
# --with-lmdb \
145+
# --with-qdbm \
146+
# --with-snmp \
147+
# `#--with-unixODBC` \
148+
# `#--with-pdo-odbc=unixODBC,/usr` \
149+
# --with-config-file-path=/etc \
150+
# --with-config-file-scan-dir=/etc/php.d \
151+
# --with-pdo-firebird \
152+
# `#--with-pdo-dblib` \
153+
# --disable-phpdbg \
154+
# `#--enable-werror`
155+
# - run:
156+
# name: make
157+
# no_output_timeout: 30m
158+
# command: make -j2 > /dev/null
159+
# - run:
160+
# name: make install
161+
# command: |
162+
# sudo make install
163+
# sudo mkdir -p /etc/php.d
164+
# sudo chmod 777 /etc/php.d
165+
# echo opcache.enable_cli=1 > /etc/php.d/opcache.ini
166+
# echo opcache.protect_memory=1 >> /etc/php.d/opcache.ini
167+
# - run:
168+
# name: Test
169+
# no_output_timeout: 30m
170+
# command: |
171+
# sapi/cli/php run-tests.php \
172+
# -d opcache.enable_cli=1 \
173+
# -d opcache.jit_buffer_size=64M \
174+
# -d opcache.jit=tracing \
175+
# -d zend_test.observer.enabled=1 \
176+
# -d zend_test.observer.show_output=0 \
177+
# -P -q -x -j2 \
178+
# -g FAIL,BORK,LEAK,XLEAK \
179+
# --no-progress \
180+
# --offline \
181+
# --show-diff \
182+
# --show-slow 1000 \
183+
# --set-timeout 120 \
184+
# --repeat 2
183185

184186
workflows:
185187
push-workflow:

‎.github/actions/setup-x64/action.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ runs:
77
set -x
88
99
sudo service slapd start
10-
docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "create login pdo_test with password='password', check_policy=off; create user pdo_test for login pdo_test; grant alter, control to pdo_test;"
11-
docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "create login odbc_test with password='password', check_policy=off; create user odbc_test for login odbc_test; grant alter, control, delete to odbc_test;"
12-
docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "ALTER SERVER ROLE sysadmin ADD MEMBER odbc_test;"
13-
docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "CREATE DATABASE odbc;"
14-
docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "CREATE DATABASE pdo_odbc;"
10+
# docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "create login pdo_test with password='password', check_policy=off; create user pdo_test for login pdo_test; grant alter, control to pdo_test;"
11+
# docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "create login odbc_test with password='password', check_policy=off; create user odbc_test for login odbc_test; grant alter, control, delete to odbc_test;"
12+
# docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "ALTER SERVER ROLE sysadmin ADD MEMBER odbc_test;"
13+
# docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "CREATE DATABASE odbc;"
14+
# docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "CREATE DATABASE pdo_odbc;"
1515
sudo locale-gen de_DE
1616
1717
./.github/scripts/setup-slapd.sh

‎.github/scripts/setup-slapd.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,36 @@ EOF
163163

164164
sudo service slapd restart
165165

166+
167+
# Debug: Test TLS_PROTOCOL_MAX setting like the failing PHP test
168+
echo "=== TLS DEBUG: Testing TLS_PROTOCOL_MAX 3.2 ==="
169+
TEMP_LDAP_CONF=$(mktemp)
170+
echo 'TLS_PROTOCOL_MAX 3.2' > "$TEMP_LDAP_CONF"
171+
172+
echo "Debug info:"
173+
echo " Temp config file: $TEMP_LDAP_CONF"
174+
echo " Contents:"
175+
cat "$TEMP_LDAP_CONF"
176+
echo ""
177+
178+
echo " Server TLS configuration check:"
179+
sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcTLSProtocolMin=*)' dn olcTLSProtocolMin 2>/dev/null || echo " No TLS protocol min configured"
180+
181+
echo ""
182+
echo " Testing with LDAPCONF and verbose TLS debug:"
183+
echo " Command: LDAPCONF=\"$TEMP_LDAP_CONF\" ldapsearch -d 1 -H ldap://localhost -D cn=Manager,dc=my-domain,dc=com -w secret -s base -b dc=my-domain,dc=com -Z 'objectclass=*'"
184+
LDAPCONF="$TEMP_LDAP_CONF" ldapsearch -d 1 -H ldap://localhost -D cn=Manager,dc=my-domain,dc=com -w secret -s base -b dc=my-domain,dc=com -Z 'objectclass=*' 2>&1 | head -20
185+
186+
echo ""
187+
echo " Testing what TLS version is actually being negotiated:"
188+
echo " Command: echo | openssl s_client -connect localhost:636 -servername localhost 2>&1 | grep -E '(Protocol|Cipher)'"
189+
echo | openssl s_client -connect localhost:636 -servername localhost 2>&1 | grep -E "(Protocol|Cipher)" || echo " LDAPS connection failed"
190+
191+
rm -f "$TEMP_LDAP_CONF"
192+
echo ""
193+
194+
exit 1
195+
166196
# Verify TLS connection
167197
tries=0
168198
while : ; do
@@ -182,3 +212,4 @@ while : ; do
182212
fi
183213
fi
184214
done
215+

0 commit comments

Comments
 (0)