?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:ldap_server: terminate the connection if talloc_reference fails
[Samba.git] / selftest / target / Samba4.pm
blob316ef8346d9c3d78b782f8e0853b04cdb71c07e0
1 #!/usr/bin/perl
2 # Bootstrap Samba and run a number of tests against it.
3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
4 # Published under the GNU GPL, v3 or later.
5
6 package Samba4;
7
8 use strict;
9 use Cwd qw(abs_path);
10 use FindBin qw($RealBin);
11 use POSIX;
12 use SocketWrapper;
13 use target::Samba;
14 use target::Samba3;
15
16 sub new($$$$$) {
17 my ($classname, $bindir, $ldap, $srcdir, $server_maxtime) = @_;
18
19 my $self = {
20 vars => {},
21 ldap => $ldap,
22 bindir => $bindir,
23 srcdir => $srcdir,
24 server_maxtime => $server_maxtime,
25 target3 => new Samba3($bindir, $srcdir, $server_maxtime)
26 };
27 bless $self;
28 return $self;
29 }
30
31 sub scriptdir_path($$) {
32 my ($self, $path) = @_;
33 return "$self->{srcdir}/source4/scripting/$path";
34 }
35
36 sub openldap_start($$$) {
37 }
38
39 sub slapd_start($$)
40 {
41 my $count = 0;
42 my ($self, $env_vars, $STDIN_READER) = @_;
43 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
44
45 my $uri = $env_vars->{LDAP_URI};
46
47 if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
48 print "A SLAPD is still listening to $uri before we started the LDAP backend. Aborting!";
49 return 1;
50 }
51 # running slapd in the background means it stays in the same process group, so it can be
52 # killed by timelimit
53 my $pid = fork();
54 if ($pid == 0) {
55 open STDOUT, ">$env_vars->{LDAPDIR}/logs";
56 open STDERR, '>&STDOUT';
57 close($env_vars->{STDIN_PIPE});
58 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
59
60 if ($self->{ldap} eq "fedora-ds") {
61 exec("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd", "-D", $env_vars->{FEDORA_DS_DIR}, "-d0", "-i", $env_vars->{FEDORA_DS_PIDFILE});
62 } elsif ($self->{ldap} eq "openldap") {
63 exec($ENV{OPENLDAP_SLAPD}, "-dnone", "-F", $env_vars->{SLAPD_CONF_D}, "-h", $uri);
64 }
65 die("Unable to start slapd: $!");
66 }
67 $env_vars->{SLAPD_PID} = $pid;
68 sleep(1);
69 while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
70 $count++;
71 if ($count > 40) {
72 $self->slapd_stop($env_vars);
73 return 0;
74 }
75 sleep(1);
76 }
77 return 1;
78 }
79
80 sub slapd_stop($$)
81 {
82 my ($self, $envvars) = @_;
83 kill 9, $envvars->{SLAPD_PID};
84 return 1;
85 }
86
87 sub check_or_start($$$)
88 {
89 my ($self, $env_vars, $process_model) = @_;
90 my $STDIN_READER;
91
92 my $env_ok = $self->check_env($env_vars);
93 if ($env_ok) {
94 return $env_vars->{SAMBA_PID};
95 } elsif (defined($env_vars->{SAMBA_PID})) {
96 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
97 return undef;
98 }
99
100 # use a pipe for stdin in the child processes. This allows
101 # those processes to monitor the pipe for EOF to ensure they
102 # exit when the test script exits
103 pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
104
105 # Start slapd before samba, but with the fifo on stdin
106 if (defined($self->{ldap})) {
107 unless($self->slapd_start($env_vars, $STDIN_READER)) {
108 warn("couldn't start slapd (main run)");
109 return undef;
110 }
111 }
112
113 print "STARTING SAMBA...\n";
114 my $pid = fork();
115 if ($pid == 0) {
116 # we want out from samba to go to the log file, but also
117 # to the users terminal when running 'make test' on the command
118 # line. This puts it on stderr on the terminal
119 open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
120 open STDERR, '>&STDOUT';
121
122 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
123
124 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
125 $ENV{KRB5CCNAME} = "$env_vars->{KRB5_CCACHE}.samba";
126 if (defined($ENV{MITKRB5})) {
127 $ENV{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
128 }
129 $ENV{SELFTEST_WINBINDD_SOCKET_DIR} = $env_vars->{SELFTEST_WINBINDD_SOCKET_DIR};
130 $ENV{NMBD_SOCKET_DIR} = $env_vars->{NMBD_SOCKET_DIR};
131
132 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
133 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
134 $ENV{NSS_WRAPPER_HOSTS} = $env_vars->{NSS_WRAPPER_HOSTS};
135 $ENV{NSS_WRAPPER_HOSTNAME} = $env_vars->{NSS_WRAPPER_HOSTNAME};
136 $ENV{NSS_WRAPPER_MODULE_SO_PATH} = $env_vars->{NSS_WRAPPER_MODULE_SO_PATH};
137 $ENV{NSS_WRAPPER_MODULE_FN_PREFIX} = $env_vars->{NSS_WRAPPER_MODULE_FN_PREFIX};
138
139 if (defined($env_vars->{RESOLV_WRAPPER_CONF})) {
140 $ENV{RESOLV_WRAPPER_CONF} = $env_vars->{RESOLV_WRAPPER_CONF};
141 } else {
142 $ENV{RESOLV_WRAPPER_HOSTS} = $env_vars->{RESOLV_WRAPPER_HOSTS};
143 }
144
145 $ENV{UID_WRAPPER} = "1";
146 $ENV{UID_WRAPPER_ROOT} = "1";
147
148 $ENV{MAKE_TEST_BINARY} = Samba::bindir_path($self, "samba");
149 my @preargs = ();
150 my @optargs = ();
151 if (defined($ENV{SAMBA_OPTIONS})) {
152 @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
153 }
154 if(defined($ENV{SAMBA_VALGRIND})) {
155 @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
156 }
157
158 close($env_vars->{STDIN_PIPE});
159 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
160
161 exec(@preargs, Samba::bindir_path($self, "samba"), "-M", $process_model, "-i", "--maximum-runtime=$self->{server_maxtime}", $env_vars->{CONFIGURATION}, @optargs) or die("Unable to start samba: $!");
162 }
163 $env_vars->{SAMBA_PID} = $pid;
164 print "DONE ($pid)\n";
165
166 close($STDIN_READER);
167
168 if ($self->wait_for_start($env_vars) != 0) {
169 warn("Samba $pid failed to start up");
170 return undef;
171 }
172
173 return $pid;
174 }
175
176 sub wait_for_start($$)
177 {
178 my ($self, $testenv_vars) = @_;
179 my $count = 0;
180 my $ret = 0;
181
182 if (not $self->check_env($testenv_vars)) {
183 warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
184 return -1;
185 }
186
187 # This will return quickly when things are up, but be slow if we
188 # need to wait for (eg) SSL init
189 my $nmblookup = Samba::bindir_path($self, "nmblookup4");
190
191 do {
192 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
193 if ($ret != 0) {
194 sleep(1);
195 } else {
196 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
197 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
198 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
199 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
200 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
201 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
202 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
203 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
204 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
205 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
206 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
207 }
208 $count++;
209 } while ($ret != 0 && $count < 20);
210 if ($count == 10) {
211 warn("nbt not reachable after 20 retries\n");
212 teardown_env($self, $testenv_vars);
213 return 0;
214 }
215
216 # Ensure we have the first RID Set before we start tests. This makes the tests more reliable.
217 if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
218 # Add hosts file for name lookups
219 $ENV{NSS_WRAPPER_HOSTS} = $testenv_vars->{NSS_WRAPPER_HOSTS};
220 if (defined($testenv_vars->{RESOLV_WRAPPER_CONF})) {
221 $ENV{RESOLV_WRAPPER_CONF} = $testenv_vars->{RESOLV_WRAPPER_CONF};
222 } else {
223 $ENV{RESOLV_WRAPPER_HOSTS} = $testenv_vars->{RESOLV_WRAPPER_HOSTS};
224 }
225
226 print "waiting for working LDAP and a RID Set to be allocated\n";
227 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
228 my $count = 0;
229 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
230
231 my $search_dn = $base_dn;
232 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
233 # TODO currently no check for actual rIDAllocationPool
234 $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
235 }
236 my $max_wait = 60;
237 my $cmd = "$ldbsearch $testenv_vars->{CONFIGURATION} -H ldap://$testenv_vars->{SERVER} -U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} -s base -b \"$search_dn\"";
238 while (system("$cmd >/dev/null") != 0) {
239 $count++;
240 if ($count > $max_wait) {
241 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
242 $ret = -1;
243 last;
244 }
245 sleep(1);
246 }
247 }
248 print $self->getlog_env($testenv_vars);
249
250 return $ret
251 }
252
253 sub write_ldb_file($$$)
254 {
255 my ($self, $file, $ldif) = @_;
256
257 my $ldbadd = Samba::bindir_path($self, "ldbadd");
258 open(LDIF, "|$ldbadd -H $file >/dev/null");
259 print LDIF $ldif;
260 return(close(LDIF));
261 }
262
263 sub add_wins_config($$)
264 {
265 my ($self, $privatedir) = @_;
266
267 return $self->write_ldb_file("$privatedir/wins_config.ldb", "
268 dn: name=TORTURE_11,CN=PARTNERS
269 objectClass: wreplPartner
270 name: TORTURE_11
271 address: 127.0.0.11
272 pullInterval: 0
273 pushChangeCount: 0
274 type: 0x3
275 ");
276 }
277
278 sub mk_fedora_ds($$)
279 {
280 my ($self, $ctx) = @_;
281
282 #Make the subdirectory be as fedora DS would expect
283 my $fedora_ds_dir = "$ctx->{ldapdir}/slapd-$ctx->{ldap_instance}";
284
285 my $pidfile = "$fedora_ds_dir/logs/slapd-$ctx->{ldap_instance}.pid";
286
287 return ($fedora_ds_dir, $pidfile);
288 }
289
290 sub mk_openldap($$)
291 {
292 my ($self, $ctx) = @_;
293
294 my $slapd_conf_d = "$ctx->{ldapdir}/slapd.d";
295 my $pidfile = "$ctx->{ldapdir}/slapd.pid";
296
297 return ($slapd_conf_d, $pidfile);
298 }
299
300 sub setup_namespaces($$:$$)
301 {
302 my ($self, $localenv, $upn_array, $spn_array) = @_;
303
304 @{$upn_array} = [] unless defined($upn_array);
305 my $upn_args = "";
306 foreach my $upn (@{$upn_array}) {
307 $upn_args .= " --add-upn-suffix=$upn";
308 }
309
310 @{$spn_array} = [] unless defined($spn_array);
311 my $spn_args = "";
312 foreach my $spn (@{$spn_array}) {
313 $spn_args .= " --add-spn-suffix=$spn";
314 }
315
316 my $samba_tool = Samba::bindir_path($self, "samba-tool");
317
318 my $cmd_env = "";
319 $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
320 if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
321 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
322 } else {
323 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
324 }
325 $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
326 $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
327
328 my $cmd_config = " $localenv->{CONFIGURATION}";
329
330 my $namespaces = $cmd_env;
331 $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
332 $namespaces .= $cmd_config;
333 unless (system($namespaces) == 0) {
334 warn("Failed to add namespaces \n$namespaces");
335 return;
336 }
337
338 return;
339 }
340
341 sub setup_trust($$$$$)
342 {
343 my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
344
345 $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
346 $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
347 $localenv->{TRUST_SERVER_IPV6} = $remoteenv->{SERVER_IPV6};
348 $localenv->{TRUST_NETBIOSNAME} = $remoteenv->{NETBIOSNAME};
349 $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
350 $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
351 $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
352 $localenv->{TRUST_REALM} = $remoteenv->{REALM};
353
354 my $samba_tool = Samba::bindir_path($self, "samba-tool");
355 # setup the trust
356 my $cmd_env = "";
357 $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
358 if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
359 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
360 } else {
361 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
362 }
363 $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
364 $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
365
366 my $cmd_config = " $localenv->{CONFIGURATION}";
367 my $cmd_creds = $cmd_config;
368 $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
369
370 my $create = $cmd_env;
371 $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
372 $create .= " $extra_args";
373 $create .= $cmd_creds;
374 unless (system($create) == 0) {
375 warn("Failed to create trust \n$create");
376 return undef;
377 }
378
379 return $localenv
380 }
381
382 sub provision_raw_prepare($$$$$$$$$$$)
383 {
384 my ($self, $prefix, $server_role, $hostname,
385 $domain, $realm, $functional_level,
386 $password, $kdc_ipv4, $kdc_ipv6) = @_;
387 my $ctx;
388 my $netbiosname = uc($hostname);
389
390 unless(-d $prefix or mkdir($prefix, 0777)) {
391 warn("Unable to create $prefix");
392 return undef;
393 }
394 my $prefix_abs = abs_path($prefix);
395
396 die ("prefix=''") if $prefix_abs eq "";
397 die ("prefix='/'") if $prefix_abs eq "/";
398
399 unless (system("rm -rf $prefix_abs/*") == 0) {
400 warn("Unable to clean up");
401 }
402
403
404 my $swiface = Samba::get_interface($hostname);
405
406 $ctx->{prefix} = $prefix;
407 $ctx->{prefix_abs} = $prefix_abs;
408
409 $ctx->{server_role} = $server_role;
410 $ctx->{hostname} = $hostname;
411 $ctx->{netbiosname} = $netbiosname;
412 $ctx->{swiface} = $swiface;
413 $ctx->{password} = $password;
414 $ctx->{kdc_ipv4} = $kdc_ipv4;
415 $ctx->{kdc_ipv6} = $kdc_ipv6;
416 $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
417 if ($functional_level eq "2000") {
418 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc"
419 }
420
421 #
422 # Set smbd log level here.
423 #
424 $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
425 $ctx->{username} = "Administrator";
426 $ctx->{domain} = $domain;
427 $ctx->{realm} = uc($realm);
428 $ctx->{dnsname} = lc($realm);
429
430 $ctx->{functional_level} = $functional_level;
431
432 my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
433 chomp $unix_name;
434 $ctx->{unix_name} = $unix_name;
435 $ctx->{unix_uid} = $>;
436 my @mygid = split(" ", $();
437 $ctx->{unix_gid} = $mygid[0];
438 $ctx->{unix_gids_str} = $);
439 @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
440
441 $ctx->{etcdir} = "$prefix_abs/etc";
442 $ctx->{piddir} = "$prefix_abs/pid";
443 $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
444 $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
445 $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
446 $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
447 $ctx->{privatedir} = "$prefix_abs/private";
448 $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
449 $ctx->{lockdir} = "$prefix_abs/lockdir";
450 $ctx->{logdir} = "$prefix_abs/logs";
451 $ctx->{statedir} = "$prefix_abs/statedir";
452 $ctx->{cachedir} = "$prefix_abs/cachedir";
453 $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
454 $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
455 $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
456 $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
457 $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
458 $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
459 if ($ENV{SAMBA_DNS_FAKING}) {
460 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
461 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
462 } else {
463 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces";
464 $ctx->{use_resolv_wrapper} = 1;
465 }
466 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
467
468 $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
469
470 $ctx->{ipv4} = "127.0.0.$swiface";
471 $ctx->{ipv6} = sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
472 $ctx->{interfaces} = "$ctx->{ipv4}/8 $ctx->{ipv6}/64";
473
474 push(@{$ctx->{directories}}, $ctx->{privatedir});
475 push(@{$ctx->{directories}}, $ctx->{etcdir});
476 push(@{$ctx->{directories}}, $ctx->{piddir});
477 push(@{$ctx->{directories}}, $ctx->{lockdir});
478 push(@{$ctx->{directories}}, $ctx->{logdir});
479 push(@{$ctx->{directories}}, $ctx->{statedir});
480 push(@{$ctx->{directories}}, $ctx->{cachedir});
481
482 $ctx->{smb_conf_extra_options} = "";
483
484 my @provision_options = ();
485 push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
486 push (@provision_options, "KRB5_CCACHE=\"$ctx->{krb5_ccache}\"");
487 push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
488 push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
489 push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
490 push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
491 if (defined($ctx->{use_resolv_wrapper})) {
492 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
493 } else {
494 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
495 }
496 if (defined($ENV{GDB_PROVISION})) {
497 push (@provision_options, "gdb --args");
498 if (!defined($ENV{PYTHON})) {
499 push (@provision_options, "env");
500 push (@provision_options, "python");
501 }
502 }
503 if (defined($ENV{VALGRIND_PROVISION})) {
504 push (@provision_options, "valgrind");
505 if (!defined($ENV{PYTHON})) {
506 push (@provision_options, "env");
507 push (@provision_options, "python");
508 }
509 }
510 if (defined($ENV{PYTHON})) {
511 push (@provision_options, $ENV{PYTHON});
512 }
513 push (@provision_options, Samba::bindir_path($self, "samba-tool"));
514 push (@provision_options, "domain");
515 push (@provision_options, "provision");
516 push (@provision_options, "--configfile=$ctx->{smb_conf}");
517 push (@provision_options, "--host-name=$ctx->{hostname}");
518 push (@provision_options, "--host-ip=$ctx->{ipv4}");
519 push (@provision_options, "--quiet");
520 push (@provision_options, "--domain=$ctx->{domain}");
521 push (@provision_options, "--realm=$ctx->{realm}");
522 push (@provision_options, "--adminpass=$ctx->{password}");
523 push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
524 push (@provision_options, "--machinepass=machine$ctx->{password}");
525 push (@provision_options, "--root=$ctx->{unix_name}");
526 push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
527 push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
528
529 @{$ctx->{provision_options}} = @provision_options;
530
531 return $ctx;
532 }
533
534 #
535 # Step1 creates the basic configuration
536 #
537 sub provision_raw_step1($$)
538 {
539 my ($self, $ctx) = @_;
540
541 mkdir($_, 0777) foreach (@{$ctx->{directories}});
542
543 ##
544 ## lockdir and piddir must be 0755
545 ##
546 chmod 0755, $ctx->{lockdir};
547 chmod 0755, $ctx->{piddir};
548
549 unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
550 warn("can't open $ctx->{smb_conf}$?");
551 return undef;
552 }
553
554 Samba::prepare_keyblobs($ctx);
555 my $crlfile = "$ctx->{tlsdir}/crl.pem";
556 $crlfile = "" unless -e ${crlfile};
557
558 print CONFFILE "
559 [global]
560 netbios name = $ctx->{netbiosname}
561 posix:eadb = $ctx->{statedir}/eadb.tdb
562 workgroup = $ctx->{domain}
563 realm = $ctx->{realm}
564 private dir = $ctx->{privatedir}
565 pid directory = $ctx->{piddir}
566 ncalrpc dir = $ctx->{ncalrpcdir}
567 lock dir = $ctx->{lockdir}
568 state directory = $ctx->{statedir}
569 cache directory = $ctx->{cachedir}
570 winbindd socket directory = $ctx->{winbindd_socket_dir}
571 ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
572 winbind separator = /
573 interfaces = $ctx->{interfaces}
574 tls dh params file = $ctx->{tlsdir}/dhparms.pem
575 tls crlfile = ${crlfile}
576 tls verify peer = no_check
577 panic action = $RealBin/gdb_backtrace \%d
578 wins support = yes
579 server role = $ctx->{server_role}
580 server services = +echo +smb -s3fs
581 dcerpc endpoint servers = +winreg +srvsvc
582 notify:inotify = false
583 ldb:nosync = true
584 ldap server require strong auth = yes
585 #We don't want to pass our self-tests if the PAC code is wrong
586 gensec:require_pac = true
587 log file = $ctx->{logdir}/log.\%m
588 log level = $ctx->{server_loglevel}
589 lanman auth = Yes
590 ntlm auth = Yes
591 rndc command = true
592 dns update command = $ctx->{samba_dnsupdate}
593 spn update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
594 dreplsrv:periodic_startup_interval = 0
595 dsdb:schema update allowed = yes
596
597 vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
598
599 idmap_ldb:use rfc2307=yes
600 winbind enum users = yes
601 winbind enum groups = yes
602
603 rpc server port:netlogon = 1026
604
605 ";
606
607 print CONFFILE "
608
609 # Begin extra options
610 $ctx->{smb_conf_extra_options}
611 # End extra options
612 ";
613 close(CONFFILE);
614
615 #Default the KDC IP to the server's IP
616 if (not defined($ctx->{kdc_ipv4})) {
617 $ctx->{kdc_ipv4} = $ctx->{ipv4};
618 }
619 if (not defined($ctx->{kdc_ipv6})) {
620 $ctx->{kdc_ipv6} = $ctx->{ipv6};
621 }
622
623 Samba::mk_krb5_conf($ctx);
624 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
625
626 open(PWD, ">$ctx->{nsswrap_passwd}");
627 if ($ctx->{unix_uid} != 0) {
628 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
629 }
630 print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
631 print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
632 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
633 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
634 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
635 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
636 ";
637 close(PWD);
638 my $uid_rfc2307test = 65533;
639
640 open(GRP, ">$ctx->{nsswrap_group}");
641 if ($ctx->{unix_gid} != 0) {
642 print GRP "root:x:0:\n";
643 }
644 print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
645 print GRP "wheel:x:10:
646 users:x:65531:
647 nobody:x:65533:
648 nogroup:x:65534:nobody
649 ";
650 close(GRP);
651 my $gid_rfc2307test = 65532;
652
653 my $hostname = lc($ctx->{hostname});
654 open(HOSTS, ">>$ctx->{nsswrap_hosts}");
655 if ($hostname eq "localdc") {
656 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
657 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
658 } else {
659 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
660 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
661 }
662 close(HOSTS);
663
664 if (defined($ctx->{resolv_conf})) {
665 open(RESOLV_CONF, ">$ctx->{resolv_conf}");
666 print RESOLV_CONF "nameserver $ctx->{kdc_ipv4}\n";
667 print RESOLV_CONF "nameserver $ctx->{kdc_ipv6}\n";
668 close(RESOLV_CONF);
669 }
670
671 my $configuration = "--configfile=$ctx->{smb_conf}";
672
673 #Ensure the config file is valid before we start
674 my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
675 if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
676 system("$testparm -v --suppress-prompt $configuration >&2");
677 warn("Failed to create a valid smb.conf configuration $testparm!");
678 return undef;
679 }
680 unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
681 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
682 return undef;
683 }
684
685 my $ret = {
686 KRB5_CONFIG => $ctx->{krb5_conf},
687 KRB5_CCACHE => $ctx->{krb5_ccache},
688 MITKDC_CONFIG => $ctx->{mitkdc_conf},
689 PIDDIR => $ctx->{piddir},
690 SERVER => $ctx->{hostname},
691 SERVER_IP => $ctx->{ipv4},
692 SERVER_IPV6 => $ctx->{ipv6},
693 NETBIOSNAME => $ctx->{netbiosname},
694 DOMAIN => $ctx->{domain},
695 USERNAME => $ctx->{username},
696 REALM => $ctx->{realm},
697 PASSWORD => $ctx->{password},
698 LDAPDIR => $ctx->{ldapdir},
699 LDAP_INSTANCE => $ctx->{ldap_instance},
700 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
701 NCALRPCDIR => $ctx->{ncalrpcdir},
702 LOCKDIR => $ctx->{lockdir},
703 STATEDIR => $ctx->{statedir},
704 CACHEDIR => $ctx->{cachedir},
705 PRIVATEDIR => $ctx->{privatedir},
706 SERVERCONFFILE => $ctx->{smb_conf},
707 CONFIGURATION => $configuration,
708 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
709 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
710 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
711 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
712 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
713 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
714 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
715 SAMBA_TEST_LOG_POS => 0,
716 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
717 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
718 LOCAL_PATH => $ctx->{share},
719 UID_RFC2307TEST => $uid_rfc2307test,
720 GID_RFC2307TEST => $gid_rfc2307test,
721 SERVER_ROLE => $ctx->{server_role},
722 RESOLV_CONF => $ctx->{resolv_conf}
723 };
724
725 if (defined($ctx->{use_resolv_wrapper})) {
726 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
727 } else {
728 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
729 }
730
731 return $ret;
732 }
733
734 #
735 # Step2 runs the provision script
736 #
737 sub provision_raw_step2($$$)
738 {
739 my ($self, $ctx, $ret) = @_;
740
741 my $provision_cmd = join(" ", @{$ctx->{provision_options}});
742 unless (system($provision_cmd) == 0) {
743 warn("Unable to provision: \n$provision_cmd\n");
744 return undef;
745 }
746
747 my $testallowed_account = "testallowed";
748 my $samba_tool_cmd = "";
749 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
750 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
751 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
752 . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
753 unless (system($samba_tool_cmd) == 0) {
754 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
755 return undef;
756 }
757
758 my $ldbmodify = "";
759 $ldbmodify .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
760 $ldbmodify .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
761 $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
762 my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
763
764 if ($ctx->{server_role} ne "domain controller") {
765 $base_dn = "DC=$ctx->{netbiosname}";
766 }
767
768 my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
769 $testallowed_account = "testallowed account";
770 open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
771 print LDIF "dn: $user_dn
772 changetype: modify
773 replace: samAccountName
774 samAccountName: $testallowed_account
775 -
776 ";
777 close(LDIF);
778
779 open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
780 print LDIF "dn: $user_dn
781 changetype: modify
782 replace: userPrincipalName
783 userPrincipalName: testallowed upn\@$ctx->{realm}
784 replace: servicePrincipalName
785 servicePrincipalName: host/testallowed
786 -
787 ";
788 close(LDIF);
789
790 $samba_tool_cmd = "";
791 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
792 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
793 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
794 . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
795 unless (system($samba_tool_cmd) == 0) {
796 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
797 return undef;
798 }
799
800 my $user_dn = "cn=testdenied,cn=users,$base_dn";
801 open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
802 print LDIF "dn: $user_dn
803 changetype: modify
804 replace: userPrincipalName
805 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
806 -
807 ";
808 close(LDIF);
809
810 $samba_tool_cmd = "";
811 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
812 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
813 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
814 . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
815 unless (system($samba_tool_cmd) == 0) {
816 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
817 return undef;
818 }
819
820 # Create to users alice and bob!
821 my $user_account_array = ["alice", "bob"];
822
823 foreach my $user_account (@{$user_account_array}) {
824 my $samba_tool_cmd = "";
825
826 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
827 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
828 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
829 . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
830 unless (system($samba_tool_cmd) == 0) {
831 warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
832 return undef;
833 }
834 }
835
836 return $ret;
837 }
838
839 sub provision($$$$$$$$$$)
840 {
841 my ($self, $prefix, $server_role, $hostname,
842 $domain, $realm, $functional_level,
843 $password, $kdc_ipv4, $kdc_ipv6, $extra_smbconf_options, $extra_smbconf_shares,
844 $extra_provision_options) = @_;
845
846 my $ctx = $self->provision_raw_prepare($prefix, $server_role,
847 $hostname,
848 $domain, $realm, $functional_level,
849 $password, $kdc_ipv4, $kdc_ipv6);
850
851 if (defined($extra_provision_options)) {
852 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
853 } else {
854 push (@{$ctx->{provision_options}}, "--use-ntvfs");
855 }
856
857 $ctx->{share} = "$ctx->{prefix_abs}/share";
858 push(@{$ctx->{directories}}, "$ctx->{share}");
859 push(@{$ctx->{directories}}, "$ctx->{share}/test1");
860 push(@{$ctx->{directories}}, "$ctx->{share}/test2");
861
862 # precreate directories for printer drivers
863 push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
864 push(@{$ctx->{directories}}, "$ctx->{share}/x64");
865 push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
866
867 my $msdfs = "no";
868 $msdfs = "yes" if ($server_role eq "domain controller");
869 $ctx->{smb_conf_extra_options} = "
870
871 max xmit = 32K
872 server max protocol = SMB2
873 host msdfs = $msdfs
874 lanman auth = yes
875
876 # fruit:copyfile is a global option
877 fruit:copyfile = yes
878
879 $extra_smbconf_options
880
881 [tmp]
882 path = $ctx->{share}
883 read only = no
884 posix:sharedelay = 100000
885 posix:oplocktimeout = 3
886 posix:writetimeupdatedelay = 500000
887
888 [xcopy_share]
889 path = $ctx->{share}
890 read only = no
891 posix:sharedelay = 100000
892 posix:oplocktimeout = 3
893 posix:writetimeupdatedelay = 500000
894 create mask = 777
895 force create mode = 777
896
897 [posix_share]
898 path = $ctx->{share}
899 read only = no
900 create mask = 0777
901 force create mode = 0
902 directory mask = 0777
903 force directory mode = 0
904
905 [test1]
906 path = $ctx->{share}/test1
907 read only = no
908 posix:sharedelay = 100000
909 posix:oplocktimeout = 3
910 posix:writetimeupdatedelay = 500000
911
912 [test2]
913 path = $ctx->{share}/test2
914 read only = no
915 posix:sharedelay = 100000
916 posix:oplocktimeout = 3
917 posix:writetimeupdatedelay = 500000
918
919 [cifs]
920 path = $ctx->{share}/_ignore_cifs_
921 read only = no
922 ntvfs handler = cifs
923 cifs:server = $ctx->{netbiosname}
924 cifs:share = tmp
925 cifs:use-s4u2proxy = yes
926 # There is no username specified here, instead the client is expected
927 # to log in with kerberos, and the serverwill use delegated credentials.
928 # Or the server tries s4u2self/s4u2proxy to impersonate the client
929
930 [simple]
931 path = $ctx->{share}
932 read only = no
933 ntvfs handler = simple
934
935 [sysvol]
936 path = $ctx->{statedir}/sysvol
937 read only = no
938
939 [netlogon]
940 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
941 read only = no
942
943 [cifsposix]
944 copy = simple
945 ntvfs handler = cifsposix
946
947 [vfs_fruit]
948 path = $ctx->{share}
949 vfs objects = catia fruit streams_xattr acl_xattr
950 ea support = yes
951 fruit:resource = file
952 fruit:metadata = netatalk
953 fruit:locking = netatalk
954 fruit:encoding = native
955
956 $extra_smbconf_shares
957 ";
958
959 if (defined($self->{ldap})) {
960 $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
961 push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
962
963 my $ldap_uri= "$ctx->{ldapdir}/ldapi";
964 $ldap_uri =~ s|/|%2F|g;
965 $ldap_uri = "ldapi://$ldap_uri";
966 $ctx->{ldap_uri} = $ldap_uri;
967
968 $ctx->{ldap_instance} = lc($ctx->{netbiosname});
969 }
970
971 my $ret = $self->provision_raw_step1($ctx);
972 unless (defined $ret) {
973 return undef;
974 }
975
976 if (defined($self->{ldap})) {
977 $ret->{LDAP_URI} = $ctx->{ldap_uri};
978 push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
979 push (@{$ctx->{provision_options}}, "--ldap-backend-nosync");
980 if ($self->{ldap} eq "openldap") {
981 push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
982 ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx) or die("Unable to create openldap directories");
983
984 } elsif ($self->{ldap} eq "fedora-ds") {
985 push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
986 push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
987 ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx) or die("Unable to create fedora ds directories");
988 }
989
990 }
991
992 return $self->provision_raw_step2($ctx, $ret);
993 }
994
995 sub provision_s4member($$$$$)
996 {
997 my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
998 print "PROVISIONING MEMBER...\n";
999 my $extra_smb_conf = "
1000 passdb backend = samba_dsdb
1001 winbindd:use external pipes = true
1002
1003 # the source4 smb server doesn't allow signing by default
1004 server signing = enabled
1005
1006 rpc_server:default = external
1007 rpc_server:svcctl = embedded
1008 rpc_server:srvsvc = embedded
1009 rpc_server:eventlog = embedded
1010 rpc_server:ntsvcs = embedded
1011 rpc_server:winreg = embedded
1012 rpc_server:spoolss = embedded
1013 rpc_daemon:spoolssd = embedded
1014 rpc_server:tcpip = no
1015 ";
1016 if ($more_conf) {
1017 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1018 }
1019 my $ret = $self->provision($prefix,
1020 "member server",
1021 $hostname,
1022 "SAMBADOMAIN",
1023 "samba.example.com",
1024 "2008",
1025 "locMEMpass3",
1026 $dcvars->{SERVER_IP},
1027 $dcvars->{SERVER_IPV6},
1028 $extra_smb_conf, "", undef);
1029 unless ($ret) {
1030 return undef;
1031 }
1032
1033 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1034 my $cmd = "";
1035 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1036 if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1037 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1038 } else {
1039 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1040 }
1041 $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1042 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1043 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1044 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1045 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1046
1047 unless (system($cmd) == 0) {
1048 warn("Join failed\n$cmd");
1049 return undef;
1050 }
1051
1052 $ret->{MEMBER_SERVER} = $ret->{SERVER};
1053 $ret->{MEMBER_SERVER_IP} = $ret->{SERVER_IP};
1054 $ret->{MEMBER_SERVER_IPV6} = $ret->{SERVER_IPV6};
1055 $ret->{MEMBER_NETBIOSNAME} = $ret->{NETBIOSNAME};
1056 $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
1057 $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
1058
1059 $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1060 $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1061 $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1062 $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1063 $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1064 $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1065
1066 return $ret;
1067 }
1068
1069 sub provision_rpc_proxy($$$)
1070 {
1071 my ($self, $prefix, $dcvars) = @_;
1072 print "PROVISIONING RPC PROXY...\n";
1073
1074 my $extra_smbconf_options = "
1075 passdb backend = samba_dsdb
1076
1077 # rpc_proxy
1078 dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1079 dcerpc endpoint servers = epmapper, remote
1080 dcerpc_remote:interfaces = rpcecho
1081
1082 [cifs_to_dc]
1083 path = /tmp/_ignore_cifs_to_dc_/_none_
1084 read only = no
1085 ntvfs handler = cifs
1086 cifs:server = $dcvars->{SERVER}
1087 cifs:share = cifs
1088 cifs:use-s4u2proxy = yes
1089 # There is no username specified here, instead the client is expected
1090 # to log in with kerberos, and the serverwill use delegated credentials.
1091 # Or the server tries s4u2self/s4u2proxy to impersonate the client
1092
1093 ";
1094
1095 my $ret = $self->provision($prefix,
1096 "member server",
1097 "localrpcproxy",
1098 "SAMBADOMAIN",
1099 "samba.example.com",
1100 "2008",
1101 "locRPCproxypass4",
1102 $dcvars->{SERVER_IP},
1103 $dcvars->{SERVER_IPV6},
1104 $extra_smbconf_options, "", undef);
1105 unless ($ret) {
1106 return undef;
1107 }
1108
1109 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1110
1111 # The joind runs in the context of the rpc_proxy/member for now
1112 my $cmd = "";
1113 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1114 if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1115 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1116 } else {
1117 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1118 }
1119 $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1120 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1121 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1122 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1123 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1124
1125 unless (system($cmd) == 0) {
1126 warn("Join failed\n$cmd");
1127 return undef;
1128 }
1129
1130 # Setting up delegation runs in the context of the DC for now
1131 $cmd = "";
1132 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1133 $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1134 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1135 $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1136 $cmd .= " $dcvars->{CONFIGURATION}";
1137 print $cmd;
1138
1139 unless (system($cmd) == 0) {
1140 warn("Delegation failed\n$cmd");
1141 return undef;
1142 }
1143
1144 # Setting up delegation runs in the context of the DC for now
1145 $cmd = "";
1146 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1147 $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1148 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1149 $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1150 $cmd .= " $dcvars->{CONFIGURATION}";
1151
1152 unless (system($cmd) == 0) {
1153 warn("Delegation failed\n$cmd");
1154 return undef;
1155 }
1156
1157 $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
1158 $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
1159 $ret->{RPC_PROXY_SERVER_IPV6} = $ret->{SERVER_IPV6};
1160 $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
1161 $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
1162 $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
1163
1164 $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1165 $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1166 $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1167 $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1168 $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1169 $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1170
1171 return $ret;
1172 }
1173
1174 sub provision_promoted_dc($$$)
1175 {
1176 my ($self, $prefix, $dcvars) = @_;
1177 print "PROVISIONING PROMOTED DC...\n";
1178
1179 # We do this so that we don't run the provision. That's the job of 'samba-tool domain dcpromo'.
1180 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1181 "promotedvdc",
1182 "SAMBADOMAIN",
1183 "samba.example.com",
1184 "2008",
1185 $dcvars->{PASSWORD},
1186 $dcvars->{SERVER_IP},
1187 $dcvars->{SERVER_IPV6});
1188
1189 push (@{$ctx->{provision_options}}, "--use-ntvfs");
1190
1191 $ctx->{smb_conf_extra_options} = "
1192 max xmit = 32K
1193 server max protocol = SMB2
1194
1195 [sysvol]
1196 path = $ctx->{statedir}/sysvol
1197 read only = yes
1198
1199 [netlogon]
1200 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1201 read only = no
1202
1203 ";
1204
1205 my $ret = $self->provision_raw_step1($ctx);
1206 unless ($ret) {
1207 return undef;
1208 }
1209
1210 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1211 my $cmd = "";
1212 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1213 if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1214 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1215 } else {
1216 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1217 }
1218 $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1219 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1220 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1221 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1222 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1223
1224 unless (system($cmd) == 0) {
1225 warn("Join failed\n$cmd");
1226 return undef;
1227 }
1228
1229 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1230 my $cmd = "";
1231 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1232 $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1233 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1234 $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1235 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1236 $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs --dns-backend=BIND9_DLZ";
1237
1238 unless (system($cmd) == 0) {
1239 warn("Join failed\n$cmd");
1240 return undef;
1241 }
1242
1243 $ret->{PROMOTED_DC_SERVER} = $ret->{SERVER};
1244 $ret->{PROMOTED_DC_SERVER_IP} = $ret->{SERVER_IP};
1245 $ret->{PROMOTED_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1246 $ret->{PROMOTED_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1247
1248 $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1249 $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1250 $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1251 $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1252 $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1253 $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1254
1255 return $ret;
1256 }
1257
1258 sub provision_vampire_dc($$$)
1259 {
1260 my ($self, $prefix, $dcvars, $fl) = @_;
1261 print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1262 my $name = "localvampiredc";
1263
1264 if ($fl == "2000") {
1265 $name = "vampire2000dc";
1266 }
1267
1268 # We do this so that we don't run the provision. That's the job of 'net vampire'.
1269 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1270 $name,
1271 $dcvars->{DOMAIN},
1272 $dcvars->{REALM},
1273 $fl,
1274 $dcvars->{PASSWORD},
1275 $dcvars->{SERVER_IP},
1276 $dcvars->{SERVER_IPV6});
1277
1278 push (@{$ctx->{provision_options}}, "--use-ntvfs");
1279
1280 $ctx->{smb_conf_extra_options} = "
1281 max xmit = 32K
1282 server max protocol = SMB2
1283
1284 [sysvol]
1285 path = $ctx->{statedir}/sysvol
1286 read only = yes
1287
1288 [netlogon]
1289 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1290 read only = no
1291
1292 ";
1293
1294 my $ret = $self->provision_raw_step1($ctx);
1295 unless ($ret) {
1296 return undef;
1297 }
1298
1299 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1300 my $cmd = "";
1301 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1302 if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1303 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1304 } else {
1305 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1306 }
1307 $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1308 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1309 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1310 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1311 $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1312
1313 unless (system($cmd) == 0) {
1314 warn("Join failed\n$cmd");
1315 return undef;
1316 }
1317
1318 if ($fl == "2000") {
1319 $ret->{VAMPIRE_2000_DC_SERVER} = $ret->{SERVER};
1320 $ret->{VAMPIRE_2000_DC_SERVER_IP} = $ret->{SERVER_IP};
1321 $ret->{VAMPIRE_2000_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1322 $ret->{VAMPIRE_2000_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1323 } else {
1324 $ret->{VAMPIRE_DC_SERVER} = $ret->{SERVER};
1325 $ret->{VAMPIRE_DC_SERVER_IP} = $ret->{SERVER_IP};
1326 $ret->{VAMPIRE_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1327 $ret->{VAMPIRE_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1328 }
1329 $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1330 $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1331 $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1332 $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1333 $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1334 $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1335 $ret->{DC_REALM} = $dcvars->{DC_REALM};
1336
1337 return $ret;
1338 }
1339
1340 sub provision_subdom_dc($$$)
1341 {
1342 my ($self, $prefix, $dcvars) = @_;
1343 print "PROVISIONING SUBDOMAIN DC...\n";
1344
1345 # We do this so that we don't run the provision. That's the job of 'net vampire'.
1346 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1347 "localsubdc",
1348 "SAMBASUBDOM",
1349 "sub.samba.example.com",
1350 "2008",
1351 $dcvars->{PASSWORD},
1352 undef);
1353
1354 push (@{$ctx->{provision_options}}, "--use-ntvfs");
1355
1356 $ctx->{smb_conf_extra_options} = "
1357 max xmit = 32K
1358 server max protocol = SMB2
1359
1360 [sysvol]
1361 path = $ctx->{statedir}/sysvol
1362 read only = yes
1363
1364 [netlogon]
1365 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1366 read only = no
1367
1368 ";
1369
1370 my $ret = $self->provision_raw_step1($ctx);
1371 unless ($ret) {
1372 return undef;
1373 }
1374
1375 Samba::mk_krb5_conf($ctx);
1376 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1377
1378 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1379 my $cmd = "";
1380 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1381 if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1382 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1383 } else {
1384 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1385 }
1386 $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1387 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1388 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{dnsname} subdomain ";
1389 $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
1390 $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1391 $cmd .= " --adminpass=$ret->{PASSWORD}";
1392
1393 unless (system($cmd) == 0) {
1394 warn("Join failed\n$cmd");
1395 return undef;
1396 }
1397
1398 $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
1399 $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
1400 $ret->{SUBDOM_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1401 $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1402
1403 $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1404 $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1405 $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1406 $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1407 $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1408 $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1409
1410 return $ret;
1411 }
1412
1413 sub provision_ad_dc_ntvfs($$)
1414 {
1415 my ($self, $prefix) = @_;
1416
1417 # We keep the old 'winbind' name here in server services to
1418 # ensure upgrades which used that name still work with the now
1419 # alias.
1420
1421 print "PROVISIONING AD DC (NTVFS)...\n";
1422 my $extra_conf_options = "netbios aliases = localDC1-a
1423 server services = +winbind -winbindd
1424 ldap server require strong auth = allow_sasl_over_tls
1425 allow nt4 crypto = yes
1426 lsa over netlogon = yes
1427 rpc server port = 1027
1428 auth event notification = true
1429 ";
1430 my $ret = $self->provision($prefix,
1431 "domain controller",
1432 "localdc",
1433 "SAMBADOMAIN",
1434 "samba.example.com",
1435 "2008",
1436 "locDCpass1",
1437 undef,
1438 undef,
1439 $extra_conf_options,
1440 "",
1441 undef);
1442 unless ($ret) {
1443 return undef;
1444 }
1445
1446 unless($self->add_wins_config("$prefix/private")) {
1447 warn("Unable to add wins configuration");
1448 return undef;
1449 }
1450 $ret->{NETBIOSALIAS} = "localdc1-a";
1451 $ret->{DC_SERVER} = $ret->{SERVER};
1452 $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1453 $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1454 $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1455 $ret->{DC_USERNAME} = $ret->{USERNAME};
1456 $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1457 $ret->{DC_REALM} = $ret->{REALM};
1458
1459 return $ret;
1460 }
1461
1462 sub provision_fl2000dc($$)
1463 {
1464 my ($self, $prefix) = @_;
1465
1466 print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1467 my $extra_conf_options = "
1468 spnego:simulate_w2k=yes
1469 ntlmssp_server:force_old_spnego=yes
1470 ";
1471 my $ret = $self->provision($prefix,
1472 "domain controller",
1473 "dc5",
1474 "SAMBA2000",
1475 "samba2000.example.com",
1476 "2000",
1477 "locDCpass5",
1478 undef,
1479 undef,
1480 $extra_conf_options,
1481 "",
1482 undef);
1483 unless ($ret) {
1484 return undef;
1485 }
1486
1487 unless($self->add_wins_config("$prefix/private")) {
1488 warn("Unable to add wins configuration");
1489 return undef;
1490 }
1491 $ret->{DC_SERVER} = $ret->{SERVER};
1492 $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1493 $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1494 $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1495 $ret->{DC_USERNAME} = $ret->{USERNAME};
1496 $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1497 $ret->{DC_REALM} = $ret->{REALM};
1498
1499 return $ret;
1500 }
1501
1502 sub provision_fl2003dc($$$)
1503 {
1504 my ($self, $prefix, $dcvars) = @_;
1505 my $swiface1 = Samba::get_interface("fakednsforwarder1");
1506 my $swiface2 = Samba::get_interface("fakednsforwarder2");
1507
1508 print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1509 my $extra_conf_options = "allow dns updates = nonsecure and secure
1510 dcesrv:header signing = no
1511 dns forwarder = 127.0.0.$swiface1 127.0.0.$swiface2";
1512 my $ret = $self->provision($prefix,
1513 "domain controller",
1514 "dc6",
1515 "SAMBA2003",
1516 "samba2003.example.com",
1517 "2003",
1518 "locDCpass6",
1519 undef,
1520 undef,
1521 $extra_conf_options,
1522 "",
1523 undef);
1524 unless (defined $ret) {
1525 return undef;
1526 }
1527
1528 $ret->{DC_SERVER} = $ret->{SERVER};
1529 $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1530 $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1531 $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1532 $ret->{DC_USERNAME} = $ret->{USERNAME};
1533 $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1534 $ret->{DNS_FORWARDER1} = "127.0.0.$swiface1";
1535 $ret->{DNS_FORWARDER2} = "127.0.0.$swiface2";
1536
1537 my @samba_tool_options;
1538 push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1539 push (@samba_tool_options, "domain");
1540 push (@samba_tool_options, "passwordsettings");
1541 push (@samba_tool_options, "set");
1542 push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1543 push (@samba_tool_options, "--min-pwd-age=0");
1544 push (@samba_tool_options, "--history-length=1");
1545
1546 my $samba_tool_cmd = join(" ", @samba_tool_options);
1547
1548 unless (system($samba_tool_cmd) == 0) {
1549 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1550 return undef;
1551 }
1552
1553 unless($self->add_wins_config("$prefix/private")) {
1554 warn("Unable to add wins configuration");
1555 return undef;
1556 }
1557
1558 return $ret;
1559 }
1560
1561 sub provision_fl2008r2dc($$$)
1562 {
1563 my ($self, $prefix, $dcvars) = @_;
1564
1565 print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1566 my $extra_conf_options = "ldap server require strong auth = no";
1567 my $ret = $self->provision($prefix,
1568 "domain controller",
1569 "dc7",
1570 "SAMBA2008R2",
1571 "samba2008R2.example.com",
1572 "2008_R2",
1573 "locDCpass7",
1574 undef,
1575 undef,
1576 $extra_conf_options,
1577 "",
1578 undef);
1579 unless (defined $ret) {
1580 return undef;
1581 }
1582
1583 unless ($self->add_wins_config("$prefix/private")) {
1584 warn("Unable to add wins configuration");
1585 return undef;
1586 }
1587 $ret->{DC_SERVER} = $ret->{SERVER};
1588 $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1589 $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1590 $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1591 $ret->{DC_USERNAME} = $ret->{USERNAME};
1592 $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1593 $ret->{DC_REALM} = $ret->{REALM};
1594
1595 return $ret;
1596 }
1597
1598
1599 sub provision_rodc($$$)
1600 {
1601 my ($self, $prefix, $dcvars) = @_;
1602 print "PROVISIONING RODC...\n";
1603
1604 # We do this so that we don't run the provision. That's the job of 'net join RODC'.
1605 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1606 "rodc",
1607 "SAMBADOMAIN",
1608 "samba.example.com",
1609 "2008",
1610 $dcvars->{PASSWORD},
1611 $dcvars->{SERVER_IP},
1612 $dcvars->{SERVER_IPV6});
1613 unless ($ctx) {
1614 return undef;
1615 }
1616
1617 push (@{$ctx->{provision_options}}, "--use-ntvfs");
1618
1619 $ctx->{share} = "$ctx->{prefix_abs}/share";
1620 push(@{$ctx->{directories}}, "$ctx->{share}");
1621
1622 $ctx->{smb_conf_extra_options} = "
1623 max xmit = 32K
1624 server max protocol = SMB2
1625 password server = $dcvars->{DC_SERVER}
1626
1627 [sysvol]
1628 path = $ctx->{statedir}/sysvol
1629 read only = yes
1630
1631 [netlogon]
1632 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1633 read only = yes
1634
1635 [tmp]
1636 path = $ctx->{share}
1637 read only = no
1638 posix:sharedelay = 10000
1639 posix:oplocktimeout = 3
1640 posix:writetimeupdatedelay = 50000
1641
1642 ";
1643
1644 my $ret = $self->provision_raw_step1($ctx);
1645 unless ($ret) {
1646 return undef;
1647 }
1648
1649 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1650 my $cmd = "";
1651 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1652 if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1653 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1654 } else {
1655 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1656 }
1657 $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1658 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1659 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1660 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1661 $cmd .= " --server=$dcvars->{DC_SERVER} --use-ntvfs";
1662
1663 unless (system($cmd) == 0) {
1664 warn("RODC join failed\n$cmd");
1665 return undef;
1666 }
1667
1668 # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1669 # user password verified on the RODC
1670 my $testallowed_account = "testallowed account";
1671 $cmd = "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1672 $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1673 $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1674 $cmd .= " --server=$dcvars->{DC_SERVER}";
1675
1676 unless (system($cmd) == 0) {
1677 warn("RODC join failed\n$cmd");
1678 return undef;
1679 }
1680
1681 # we overwrite the kdc after the RODC join
1682 # so that use the RODC as kdc and test
1683 # the proxy code
1684 $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1685 $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1686 Samba::mk_krb5_conf($ctx);
1687 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1688
1689 $ret->{RODC_DC_SERVER} = $ret->{SERVER};
1690 $ret->{RODC_DC_SERVER_IP} = $ret->{SERVER_IP};
1691 $ret->{RODC_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1692 $ret->{RODC_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1693
1694 $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1695 $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1696 $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1697 $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1698 $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1699 $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1700
1701 return $ret;
1702 }
1703
1704 sub read_config_h($)
1705 {
1706 my ($name) = @_;
1707 my %ret = {};
1708 open(LF, "<$name") or die("unable to read $name: $!");
1709 while (<LF>) {
1710 chomp;
1711 next if not (/^#define /);
1712 if (/^#define (.*?)[ \t]+(.*?)$/) {
1713 $ret{$1} = $2;
1714 next;
1715 }
1716 if (/^#define (.*?)[ \t]+$/) {
1717 $ret{$1} = 1;;
1718 next;
1719 }
1720 }
1721 close(LF);
1722 return \%ret;
1723 }
1724
1725 sub provision_ad_dc($$)
1726 {
1727 my ($self, $prefix) = @_;
1728
1729 my $prefix_abs = abs_path($prefix);
1730
1731 my $bindir_abs = abs_path($self->{bindir});
1732 my $lockdir="$prefix_abs/lockdir";
1733 my $conffile="$prefix_abs/etc/smb.conf";
1734
1735 my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
1736 $require_mutexes = "" if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} eq "1");
1737
1738 my $config_h = {};
1739
1740 if (defined($ENV{CONFIG_H})) {
1741 $config_h = read_config_h($ENV{CONFIG_H});
1742 }
1743
1744 my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
1745 $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
1746
1747 my $extra_smbconf_options = "
1748 server services = -smb +s3fs
1749 xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1750
1751 dbwrap_tdb_mutexes:* = yes
1752 ${require_mutexes}
1753
1754 ${password_hash_gpg_key_ids}
1755
1756 kernel oplocks = no
1757 kernel change notify = no
1758 smb2 leases = no
1759
1760 logging = file
1761 printing = bsd
1762 printcap name = /dev/null
1763
1764 max protocol = SMB3
1765 read only = no
1766
1767 smbd:sharedelay = 100000
1768 smbd:writetimeupdatedelay = 500000
1769 create mask = 755
1770 dos filemode = yes
1771
1772 dcerpc endpoint servers = -winreg -srvsvc
1773
1774 printcap name = /dev/null
1775
1776 addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1777 deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1778
1779 printing = vlp
1780 print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1781 lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1782 lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1783 lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1784 lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1785 queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1786 queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1787 lpq cache time = 0
1788 print notify backchannel = yes
1789
1790 auth event notification = true
1791 ";
1792
1793 my $extra_smbconf_shares = "
1794
1795 [tmpenc]
1796 copy = tmp
1797 smb encrypt = required
1798
1799 [tmpcase]
1800 copy = tmp
1801 case sensitive = yes
1802
1803 [tmpguest]
1804 copy = tmp
1805 guest ok = yes
1806
1807 [hideunread]
1808 copy = tmp
1809 hide unreadable = yes
1810
1811 [durable]
1812 copy = tmp
1813 kernel share modes = no
1814 kernel oplocks = no
1815 posix locking = no
1816
1817 [print\$]
1818 copy = tmp
1819
1820 [print1]
1821 copy = tmp
1822 printable = yes
1823
1824 [print2]
1825 copy = print1
1826 [print3]
1827 copy = print1
1828 [lp]
1829 copy = print1
1830 ";
1831
1832 print "PROVISIONING AD DC...\n";
1833 my $ret = $self->provision($prefix,
1834 "domain controller",
1835 "addc",
1836 "ADDOMAIN",
1837 "addom.samba.example.com",
1838 "2008",
1839 "locDCpass1",
1840 undef,
1841 undef,
1842 $extra_smbconf_options,
1843 $extra_smbconf_shares,
1844 undef);
1845 unless (defined $ret) {
1846 return undef;
1847 }
1848
1849 unless($self->add_wins_config("$prefix/private")) {
1850 warn("Unable to add wins configuration");
1851 return undef;
1852 }
1853
1854 $ret->{DC_SERVER} = $ret->{SERVER};
1855 $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1856 $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1857 $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1858 $ret->{DC_USERNAME} = $ret->{USERNAME};
1859 $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1860
1861 return $ret;
1862 }
1863
1864 sub provision_chgdcpass($$)
1865 {
1866 my ($self, $prefix) = @_;
1867
1868 print "PROVISIONING CHGDCPASS...\n";
1869 my $extra_provision_options = undef;
1870 # This environment disallows the use of this password
1871 # (and also removes the default AD complexity checks)
1872 my $unacceptable_password = "widk3Dsle32jxdBdskldsk55klASKQ";
1873 push (@{$extra_provision_options}, "--dns-backend=BIND9_DLZ");
1874 my $ret = $self->provision($prefix,
1875 "domain controller",
1876 "chgdcpass",
1877 "CHDCDOMAIN",
1878 "chgdcpassword.samba.example.com",
1879 "2008",
1880 "chgDCpass1",
1881 undef,
1882 undef,
1883 "check password script = sed -e '/$unacceptable_password/{;q1}; /$unacceptable_password/!{q0}'\n",
1884 "",
1885 $extra_provision_options);
1886 unless (defined $ret) {
1887 return undef;
1888 }
1889
1890 unless($self->add_wins_config("$prefix/private")) {
1891 warn("Unable to add wins configuration");
1892 return undef;
1893 }
1894
1895 # Remove secrets.tdb from this environment to test that we
1896 # still start up on systems without the new matching
1897 # secrets.tdb records.
1898 unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
1899 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
1900 return undef;
1901 }
1902
1903 $ret->{DC_SERVER} = $ret->{SERVER};
1904 $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1905 $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1906 $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1907 $ret->{DC_USERNAME} = $ret->{USERNAME};
1908 $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1909 $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
1910
1911 return $ret;
1912 }
1913
1914 sub teardown_env_terminate($$)
1915 {
1916 my ($self, $envvars) = @_;
1917 my $pid;
1918
1919 # This should cause samba to terminate gracefully
1920 close($envvars->{STDIN_PIPE});
1921
1922 $pid = $envvars->{SAMBA_PID};
1923 my $count = 0;
1924 my $childpid;
1925
1926 # This should give it time to write out the gcov data
1927 until ($count > 15) {
1928 if (Samba::cleanup_child($pid, "samba") != 0) {
1929 return;
1930 }
1931 sleep(1);
1932 $count++;
1933 }
1934
1935 # After 15 Seconds, work out why this thing is still alive
1936 warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
1937 system("$self->{srcdir}/selftest/gdb_backtrace $pid");
1938
1939 until ($count > 30) {
1940 if (Samba::cleanup_child($pid, "samba") != 0) {
1941 return;
1942 }
1943 sleep(1);
1944 $count++;
1945 }
1946
1947 if (kill(0, $pid)) {
1948 warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
1949 kill "TERM", $pid;
1950 }
1951
1952 until ($count > 40) {
1953 if (Samba::cleanup_child($pid, "samba") != 0) {
1954 return;
1955 }
1956 sleep(1);
1957 $count++;
1958 }
1959 # If it is still around, kill it
1960 if (kill(0, $pid)) {
1961 warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
1962 kill 9, $pid;
1963 }
1964 return;
1965 }
1966
1967 sub teardown_env($$)
1968 {
1969 my ($self, $envvars) = @_;
1970 teardown_env_terminate($self, $envvars);
1971
1972 $self->slapd_stop($envvars) if ($self->{ldap});
1973
1974 print $self->getlog_env($envvars);
1975
1976 return;
1977 }
1978
1979 sub getlog_env($$)
1980 {
1981 my ($self, $envvars) = @_;
1982 my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
1983 my $out = $title;
1984
1985 open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
1986
1987 seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
1988 while (<LOG>) {
1989 $out .= $_;
1990 }
1991 $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
1992 close(LOG);
1993
1994 return "" if $out eq $title;
1995
1996 return $out;
1997 }
1998
1999 sub check_env($$)
2000 {
2001 my ($self, $envvars) = @_;
2002 my $samba_pid = $envvars->{SAMBA_PID};
2003
2004 if (not defined($samba_pid)) {
2005 return 0;
2006 } elsif ($samba_pid > 0) {
2007 my $childpid = Samba::cleanup_child($samba_pid, "samba");
2008
2009 if ($childpid == 0) {
2010 return 1;
2011 }
2012 return 0;
2013 } else {
2014 return 1;
2015 }
2016
2017 }
2018
2019 sub setup_env($$$)
2020 {
2021 my ($self, $envname, $path) = @_;
2022 my $target3 = $self->{target3};
2023
2024 $ENV{ENVNAME} = $envname;
2025
2026 if (defined($self->{vars}->{$envname})) {
2027 return $self->{vars}->{$envname};
2028 }
2029
2030 if ($envname eq "ad_dc_ntvfs") {
2031 return $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2032 } elsif ($envname eq "fl2000dc") {
2033 return $self->setup_fl2000dc("$path/fl2000dc");
2034 } elsif ($envname eq "vampire_2000_dc") {
2035 if (not defined($self->{vars}->{fl2000dc})) {
2036 $self->setup_fl2000dc("$path/fl2000dc");
2037 }
2038 return $self->setup_vampire_dc("$path/vampire_2000_dc", $self->{vars}->{fl2000dc}, "2000");
2039 } elsif ($envname eq "fl2003dc") {
2040 if (not defined($self->{vars}->{ad_dc})) {
2041 $self->setup_ad_dc("$path/ad_dc");
2042 }
2043 return $self->setup_fl2003dc("$path/fl2003dc", $self->{vars}->{ad_dc});
2044 } elsif ($envname eq "fl2008r2dc") {
2045 if (not defined($self->{vars}->{ad_dc})) {
2046 $self->setup_ad_dc("$path/ad_dc");
2047 }
2048 return $self->setup_fl2008r2dc("$path/fl2008r2dc", $self->{vars}->{ad_dc});
2049 } elsif ($envname eq "rpc_proxy") {
2050 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2051 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2052 }
2053 return $self->setup_rpc_proxy("$path/rpc_proxy", $self->{vars}->{ad_dc_ntvfs});
2054 } elsif ($envname eq "vampire_dc") {
2055 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2056 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2057 }
2058 return $self->setup_vampire_dc("$path/vampire_dc", $self->{vars}->{ad_dc_ntvfs}, "2008");
2059 } elsif ($envname eq "promoted_dc") {
2060 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2061 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2062 }
2063 return $self->setup_promoted_dc("$path/promoted_dc", $self->{vars}->{ad_dc_ntvfs});
2064 } elsif ($envname eq "subdom_dc") {
2065 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2066 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2067 }
2068 return $self->setup_subdom_dc("$path/subdom_dc", $self->{vars}->{ad_dc_ntvfs});
2069 } elsif ($envname eq "s4member_dflt_domain") {
2070 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2071 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2072 }
2073 return $self->setup_s4member_dflt_domain("$path/s4member_dflt_domain", $self->{vars}->{ad_dc_ntvfs});
2074 } elsif ($envname eq "s4member") {
2075 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2076 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2077 }
2078 return $self->setup_s4member("$path/s4member", $self->{vars}->{ad_dc_ntvfs});
2079 } elsif ($envname eq "rodc") {
2080 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2081 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2082 }
2083 return $self->setup_rodc("$path/rodc", $self->{vars}->{ad_dc_ntvfs});
2084 } elsif ($envname eq "chgdcpass") {
2085 return $self->setup_chgdcpass("$path/chgdcpass", $self->{vars}->{chgdcpass});
2086 } elsif ($envname eq "ad_member") {
2087 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2088 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2089 }
2090 return $target3->setup_admember("$path/ad_member", $self->{vars}->{ad_dc_ntvfs}, 29);
2091 } elsif ($envname eq "ad_dc") {
2092 return $self->setup_ad_dc("$path/ad_dc");
2093 } elsif ($envname eq "ad_dc_no_nss") {
2094 return $self->setup_ad_dc("$path/ad_dc_no_nss", "no_nss");
2095 } elsif ($envname eq "ad_member_rfc2307") {
2096 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2097 $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2098 }
2099 return $target3->setup_admember_rfc2307("$path/ad_member_rfc2307",
2100 $self->{vars}->{ad_dc_ntvfs}, 34);
2101 } elsif ($envname eq "ad_member_idmap_rid") {
2102 if (not defined($self->{vars}->{ad_dc})) {
2103 $self->setup_ad_dc("$path/ad_dc");
2104 }
2105 return $target3->setup_ad_member_idmap_rid("$path/ad_member_idmap_rid",
2106 $self->{vars}->{ad_dc});
2107 } elsif ($envname eq "none") {
2108 return $self->setup_none("$path/none");
2109 } else {
2110 return "UNKNOWN";
2111 }
2112 }
2113
2114 sub setup_s4member($$$)
2115 {
2116 my ($self, $path, $dc_vars) = @_;
2117
2118 my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2119
2120 if (defined $env) {
2121 if (not defined($self->check_or_start($env, "standard"))) {
2122 return undef;
2123 }
2124
2125 $self->{vars}->{s4member} = $env;
2126 }
2127
2128 return $env;
2129 }
2130
2131 sub setup_s4member_dflt_domain($$$)
2132 {
2133 my ($self, $path, $dc_vars) = @_;
2134
2135 my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2136 "winbind use default domain = yes");
2137
2138 if (defined $env) {
2139 if (not defined($self->check_or_start($env, "standard"))) {
2140 return undef;
2141 }
2142
2143 $self->{vars}->{s4member_dflt_domain} = $env;
2144 }
2145
2146 return $env;
2147 }
2148
2149 sub setup_rpc_proxy($$$)
2150 {
2151 my ($self, $path, $dc_vars) = @_;
2152
2153 my $env = $self->provision_rpc_proxy($path, $dc_vars);
2154
2155 if (defined $env) {
2156 if (not defined($self->check_or_start($env, "standard"))) {
2157 return undef;
2158 }
2159
2160 $self->{vars}->{rpc_proxy} = $env;
2161 }
2162 return $env;
2163 }
2164
2165 sub setup_ad_dc_ntvfs($$)
2166 {
2167 my ($self, $path) = @_;
2168
2169 my $env = $self->provision_ad_dc_ntvfs($path);
2170 if (defined $env) {
2171 if (not defined($self->check_or_start($env, "standard"))) {
2172 warn("Failed to start ad_dc_ntvfs");
2173 return undef;
2174 }
2175
2176 $self->{vars}->{ad_dc_ntvfs} = $env;
2177 }
2178 return $env;
2179 }
2180
2181 sub setup_chgdcpass($$)
2182 {
2183 my ($self, $path) = @_;
2184
2185 my $env = $self->provision_chgdcpass($path);
2186 if (defined $env) {
2187 if (not defined($self->check_or_start($env, "standard"))) {
2188 return undef;
2189 }
2190
2191 $self->{vars}->{chgdcpass} = $env;
2192 }
2193 return $env;
2194 }
2195
2196 sub setup_fl2000dc($$)
2197 {
2198 my ($self, $path) = @_;
2199
2200 my $env = $self->provision_fl2000dc($path);
2201 if (defined $env) {
2202 if (not defined($self->check_or_start($env, "standard"))) {
2203 return undef;
2204 }
2205
2206 $self->{vars}->{fl2000dc} = $env;
2207 }
2208
2209 return $env;
2210 }
2211
2212 sub setup_fl2003dc($$$)
2213 {
2214 my ($self, $path, $dc_vars) = @_;
2215
2216 my $env = $self->provision_fl2003dc($path);
2217
2218 if (defined $env) {
2219 if (not defined($self->check_or_start($env, "standard"))) {
2220 return undef;
2221 }
2222
2223 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2224
2225 $self->{vars}->{fl2003dc} = $env;
2226 }
2227 return $env;
2228 }
2229
2230 sub setup_fl2008r2dc($$$)
2231 {
2232 my ($self, $path, $dc_vars) = @_;
2233
2234 my $env = $self->provision_fl2008r2dc($path);
2235
2236 if (defined $env) {
2237 if (not defined($self->check_or_start($env, "standard"))) {
2238 return undef;
2239 }
2240
2241 my $upn_array = ["$env->{REALM}.upn"];
2242 my $spn_array = ["$env->{REALM}.spn"];
2243
2244 $self->setup_namespaces($env, $upn_array, $spn_array);
2245
2246 $env = $self->setup_trust($env, $dc_vars, "forest", "");
2247
2248 $self->{vars}->{fl2008r2dc} = $env;
2249 }
2250
2251 return $env;
2252 }
2253
2254 sub setup_vampire_dc($$$$)
2255 {
2256 my ($self, $path, $dc_vars, $fl) = @_;
2257
2258 my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2259
2260 if (defined $env) {
2261 if (not defined($self->check_or_start($env, "single"))) {
2262 return undef;
2263 }
2264
2265 $self->{vars}->{vampire_dc} = $env;
2266
2267 # force replicated DC to update repsTo/repsFrom
2268 # for vampired partitions
2269 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2270 my $cmd = "";
2271 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2272 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2273 $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2274 } else {
2275 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2276 }
2277 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2278 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2279 $cmd .= " $samba_tool drs kcc -k no $env->{DC_SERVER}";
2280 $cmd .= " $env->{CONFIGURATION}";
2281 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2282 unless (system($cmd) == 0) {
2283 warn("Failed to exec kcc on remote DC\n$cmd");
2284 return undef;
2285 }
2286
2287 # as 'vampired' dc may add data in its local replica
2288 # we need to synchronize data between DCs
2289 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2290 $cmd = "";
2291 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2292 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2293 $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2294 } else {
2295 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2296 }
2297 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2298 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2299 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2300 $cmd .= " $dc_vars->{CONFIGURATION}";
2301 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2302 # replicate Configuration NC
2303 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2304 unless(system($cmd_repl) == 0) {
2305 warn("Failed to replicate\n$cmd_repl");
2306 return undef;
2307 }
2308 # replicate Default NC
2309 $cmd_repl = "$cmd \"$base_dn\"";
2310 unless(system($cmd_repl) == 0) {
2311 warn("Failed to replicate\n$cmd_repl");
2312 return undef;
2313 }
2314
2315 # Pull in a full set of changes from the main DC
2316 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2317 $cmd = "";
2318 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2319 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2320 $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2321 } else {
2322 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2323 }
2324 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2325 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2326 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2327 $cmd .= " $dc_vars->{CONFIGURATION}";
2328 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2329 # replicate Configuration NC
2330 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2331 unless(system($cmd_repl) == 0) {
2332 warn("Failed to replicate\n$cmd_repl");
2333 return undef;
2334 }
2335 # replicate Default NC
2336 $cmd_repl = "$cmd \"$base_dn\"";
2337 unless(system($cmd_repl) == 0) {
2338 warn("Failed to replicate\n$cmd_repl");
2339 return undef;
2340 }
2341 }
2342
2343 return $env;
2344 }
2345
2346 sub setup_promoted_dc($$$)
2347 {
2348 my ($self, $path, $dc_vars) = @_;
2349
2350 my $env = $self->provision_promoted_dc($path, $dc_vars);
2351
2352 if (defined $env) {
2353 if (not defined($self->check_or_start($env, "single"))) {
2354 return undef;
2355 }
2356
2357 $self->{vars}->{promoted_dc} = $env;
2358
2359 # force source and replicated DC to update repsTo/repsFrom
2360 # for vampired partitions
2361 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2362 my $cmd = "";
2363 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2364 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2365 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2366 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
2367 $cmd .= " $env->{CONFIGURATION}";
2368 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2369 unless (system($cmd) == 0) {
2370 warn("Failed to exec kcc on remote DC\n$cmd");
2371 return undef;
2372 }
2373
2374 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2375 my $cmd = "";
2376 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2377 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2378 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2379 $cmd .= " $samba_tool drs kcc $env->{SERVER}";
2380 $cmd .= " $env->{CONFIGURATION}";
2381 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2382 unless (system($cmd) == 0) {
2383 warn("Failed to exec kcc on promoted DC\n$cmd");
2384 return undef;
2385 }
2386
2387 # as 'vampired' dc may add data in its local replica
2388 # we need to synchronize data between DCs
2389 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2390 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2391 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2392 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2393 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2394 $cmd .= " $dc_vars->{CONFIGURATION}";
2395 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2396 # replicate Configuration NC
2397 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2398 unless(system($cmd_repl) == 0) {
2399 warn("Failed to replicate\n$cmd_repl");
2400 return undef;
2401 }
2402 # replicate Default NC
2403 $cmd_repl = "$cmd \"$base_dn\"";
2404 unless(system($cmd_repl) == 0) {
2405 warn("Failed to replicate\n$cmd_repl");
2406 return undef;
2407 }
2408 }
2409
2410 return $env;
2411 }
2412
2413 sub setup_subdom_dc($$$)
2414 {
2415 my ($self, $path, $dc_vars) = @_;
2416
2417 my $env = $self->provision_subdom_dc($path, $dc_vars);
2418
2419 if (defined $env) {
2420 if (not defined($self->check_or_start($env, "single"))) {
2421 return undef;
2422 }
2423
2424 $self->{vars}->{subdom_dc} = $env;
2425
2426 # force replicated DC to update repsTo/repsFrom
2427 # for primary domain partitions
2428 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2429 my $cmd = "";
2430 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2431 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2432 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2433 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
2434 $cmd .= " $env->{CONFIGURATION}";
2435 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
2436 unless (system($cmd) == 0) {
2437 warn("Failed to exec kcc on remote DC\n$cmd");
2438 return undef;
2439 }
2440
2441 # as 'subdomain' dc may add data in its local replica
2442 # we need to synchronize data between DCs
2443 my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
2444 my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2445 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2446 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2447 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2448 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
2449 $cmd .= " $dc_vars->{CONFIGURATION}";
2450 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
2451 # replicate Configuration NC
2452 my $cmd_repl = "$cmd \"$config_dn\"";
2453 unless(system($cmd_repl) == 0) {
2454 warn("Failed to replicate\n$cmd_repl");
2455 return undef;
2456 }
2457 # replicate Default NC
2458 $cmd_repl = "$cmd \"$base_dn\"";
2459 unless(system($cmd_repl) == 0) {
2460 warn("Failed to replicate\n$cmd_repl");
2461 return undef;
2462 }
2463 }
2464
2465 return $env;
2466 }
2467
2468 sub setup_rodc($$$)
2469 {
2470 my ($self, $path, $dc_vars) = @_;
2471
2472 my $env = $self->provision_rodc($path, $dc_vars);
2473
2474 unless ($env) {
2475 return undef;
2476 }
2477
2478 if (not defined($self->check_or_start($env, "standard"))) {
2479 return undef;
2480 }
2481
2482 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2483 my $cmd = "";
2484
2485 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2486 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2487 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2488 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2489 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2490 $cmd .= " $dc_vars->{CONFIGURATION}";
2491 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2492 # replicate Configuration NC
2493 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2494 unless(system($cmd_repl) == 0) {
2495 warn("Failed to replicate\n$cmd_repl");
2496 return undef;
2497 }
2498 # replicate Default NC
2499 $cmd_repl = "$cmd \"$base_dn\"";
2500 unless(system($cmd_repl) == 0) {
2501 warn("Failed to replicate\n$cmd_repl");
2502 return undef;
2503 }
2504
2505 $self->{vars}->{rodc} = $env;
2506
2507 return $env;
2508 }
2509
2510 sub setup_ad_dc($$)
2511 {
2512 my ($self, $path, $no_nss) = @_;
2513
2514 # If we didn't build with ADS, pretend this env was never available
2515 if (not $self->{target3}->have_ads()) {
2516 return "UNKNOWN";
2517 }
2518
2519 my $env = $self->provision_ad_dc($path);
2520 unless ($env) {
2521 return undef;
2522 }
2523
2524 if (defined($no_nss) and $no_nss) {
2525 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2526 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2527 }
2528
2529 if (not defined($self->check_or_start($env, "single"))) {
2530 return undef;
2531 }
2532
2533 my $upn_array = ["$env->{REALM}.upn"];
2534 my $spn_array = ["$env->{REALM}.spn"];
2535
2536 $self->setup_namespaces($env, $upn_array, $spn_array);
2537
2538 $self->{vars}->{ad_dc} = $env;
2539 return $env;
2540 }
2541
2542 sub setup_none($$)
2543 {
2544 my ($self, $path) = @_;
2545
2546 my $ret = {
2547 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
2548 SAMBA_PID => -1,
2549 }
2550 }
2551
2552 1;
Samba GIT mirror