selftest/target/Samba.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 package Samba;
   7
   8 use strict;
   9 use warnings;
  10 use target::Samba3;
  11 use target::Samba4;
  12 use POSIX;
  13 use Cwd qw(abs_path);
  14 use IO::Poll qw(POLLIN);
  15
  16 sub new($$$$$) {
  17         my ($classname, $bindir, $srcdir, $server_maxtime,
  18             $opt_socket_wrapper_pcap, $opt_socket_wrapper_keep_pcap,
  19             $default_ldb_backend) = @_;
  20
  21         my $self = {
  22             opt_socket_wrapper_pcap => $opt_socket_wrapper_pcap,
  23             opt_socket_wrapper_keep_pcap => $opt_socket_wrapper_keep_pcap,
  24         };
  25         $self->{samba3} = new Samba3($self, $bindir, $srcdir, $server_maxtime);
  26         $self->{samba4} = new Samba4($self, $bindir, $srcdir, $server_maxtime, $default_ldb_backend);
  27         bless $self;
  28         return $self;
  29 }
  30
  31 %Samba::ENV_DEPS = (%Samba3::ENV_DEPS, %Samba4::ENV_DEPS);
  32 our %ENV_DEPS;
  33
  34 %Samba::ENV_DEPS_POST = (%Samba3::ENV_DEPS_POST, %Samba4::ENV_DEPS_POST);
  35 our %ENV_DEPS_POST;
  36
  37 %Samba::ENV_TARGETS = (
  38         (map { $_ => "Samba3" } keys %Samba3::ENV_DEPS),
  39         (map { $_ => "Samba4" } keys %Samba4::ENV_DEPS),
  40 );
  41 our %ENV_TARGETS;
  42
  43 %Samba::ENV_NEEDS_AD_DC = (
  44         (map { $_ => 1 } keys %Samba4::ENV_DEPS)
  45 );
  46 our %ENV_NEEDS_AD_DC;
  47 foreach my $env (keys %Samba3::ENV_DEPS) {
  48     $ENV_NEEDS_AD_DC{$env} = ($env =~ /^ad_/);
  49 }
  50
  51 sub setup_pcap($$)
  52 {
  53         my ($self, $name) = @_;
  54
  55         return unless ($self->{opt_socket_wrapper_pcap});
  56         return unless defined($ENV{SOCKET_WRAPPER_PCAP_DIR});
  57
  58         my $fname = $name;
  59         $fname =~ s%[^abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\-]%_%g;
  60
  61         my $pcap_file = "$ENV{SOCKET_WRAPPER_PCAP_DIR}/$fname.pcap";
  62
  63         SocketWrapper::setup_pcap($pcap_file);
  64
  65         return $pcap_file;
  66 }
  67
  68 sub cleanup_pcap($$$)
  69 {
  70         my ($self, $pcap_file, $exitcode) = @_;
  71
  72         return unless ($self->{opt_socket_wrapper_pcap});
  73         return if ($self->{opt_socket_wrapper_keep_pcap});
  74         return unless ($exitcode == 0);
  75         return unless defined($pcap_file);
  76
  77         unlink($pcap_file);
  78 }
  79
  80 sub setup_env($$$)
  81 {
  82         my ($self, $envname, $path) = @_;
  83
  84         my $targetname = $ENV_TARGETS{$envname};
  85         if (not defined($targetname)) {
  86                 warn("Samba can't provide environment '$envname'");
  87                 return "UNKNOWN";
  88         }
  89
  90         my %targetlookup = (
  91                 "Samba3" => $self->{samba3},
  92                 "Samba4" => $self->{samba4}
  93         );
  94         my $target = $targetlookup{$targetname};
  95
  96         if (defined($target->{vars}->{$envname})) {
  97                 return $target->{vars}->{$envname};
  98         }
  99
 100         $target->{vars}->{$envname} = "";
 101
 102         my @dep_vars;
 103         foreach(@{$ENV_DEPS{$envname}}) {
 104                 my $vars = $self->setup_env($_, $path);
 105                 if (defined($vars)) {
 106                         push(@dep_vars, $vars);
 107                 } else {
 108                         warn("Failed setting up $_ as a dependency of $envname");
 109                         return undef;
 110                 }
 111         }
 112
 113         $ENV{ENVNAME} = $envname;
 114         # Avoid hitting system krb5.conf -
 115         # An env that needs Kerberos will reset this to the real value.
 116         $ENV{KRB5_CONFIG} = "$path/no_krb5.conf";
 117         $ENV{RESOLV_CONF} = "$path/no_resolv.conf";
 118
 119         my $setup_name = $ENV_TARGETS{$envname}."::setup_".$envname;
 120         my $setup_sub = \&$setup_name;
 121         my $setup_pcap_file = $self->setup_pcap("env-$ENV{ENVNAME}-setup");
 122         my $env = &$setup_sub($target, "$path/$envname", @dep_vars);
 123         $self->cleanup_pcap($setup_pcap_file, not defined($env));
 124         SocketWrapper::setup_pcap(undef);
 125
 126         if (not defined($env)) {
 127                 warn("failed to start up environment '$envname'");
 128                 return undef;
 129         }
 130         if ($env eq "UNKNOWN") {
 131                 warn("unknown environment '$envname'");
 132                 return $env;
 133         }
 134
 135         $target->{vars}->{$envname} = $env;
 136         $target->{vars}->{$envname}->{target} = $target;
 137
 138         foreach(@{$ENV_DEPS_POST{$envname}}) {
 139                 if (not defined $_) {
 140                         continue;
 141                 }
 142                 my $vars = $self->setup_env($_, $path);
 143                 if (not defined($vars)) {
 144                         return undef;
 145                 }
 146         }
 147
 148         return $env;
 149 }
 150
 151 sub bindir_path($$) {
 152         my ($object, $path) = @_;
 153
 154         my $valpath = "$object->{bindir}/$path";
 155         my $python_cmd = "";
 156         my $result = $path;
 157         if (defined $ENV{'PYTHON'}) {
 158                 $python_cmd = $ENV{'PYTHON'} . " ";
 159         }
 160
 161         if (-f $valpath or -d $valpath) {
 162                 $result = $valpath;
 163         }
 164         # make sure we prepend samba-tool with calling $PYTHON python version
 165         if ($path eq "samba-tool") {
 166                 $result = $python_cmd . $result;
 167         }
 168         return $result;
 169 }
 170
 171 sub nss_wrapper_winbind_so_path($) {
 172         my ($object) = @_;
 173         my $ret = $ENV{NSS_WRAPPER_WINBIND_SO_PATH};
 174         if (not defined($ret)) {
 175             $ret = bindir_path($object, "plugins/libnss_wrapper_winbind.so.2");
 176             $ret = abs_path($ret);
 177         }
 178         return $ret;
 179 }
 180
 181 sub copy_file_content($$)
 182 {
 183         my ($in, $out) = @_;
 184         open(IN, "${in}") or die("failed to open in[${in}] for reading: $!");
 185         open(OUT, ">${out}") or die("failed to open out[${out}] for writing: $!");
 186         while(<IN>) {
 187                 print OUT $_;
 188         }
 189         close(OUT);
 190         close(IN);
 191 }
 192
 193 sub prepare_keyblobs($)
 194 {
 195         my ($ctx) = @_;
 196
 197         my $cadir = "$ENV{SRCDIR_ABS}/selftest/manage-ca/CA-samba.example.com";
 198         my $cacert = "$cadir/Public/CA-samba.example.com-cert.pem";
 199         # A file containing a CRL with no revocations.
 200         my $cacrl_pem = "$cadir/Public/CA-samba.example.com-crl.pem";
 201         my $dcdnsname = "$ctx->{hostname}.$ctx->{dnsname}";
 202         my $dcdir = "$cadir/DCs/$dcdnsname";
 203         my $dccert = "$dcdir/DC-$dcdnsname-cert.pem";
 204         my $dckey_private = "$dcdir/DC-$dcdnsname-private-key.pem";
 205         my $adminprincipalname = "administrator\@$ctx->{dnsname}";
 206         my $admindir = "$cadir/Users/$adminprincipalname";
 207         my $admincert = "$admindir/USER-$adminprincipalname-cert.pem";
 208         my $adminkey_private = "$admindir/USER-$adminprincipalname-private-key.pem";
 209         my $pkinitprincipalname = "pkinit\@$ctx->{dnsname}";
 210         my $ca_pkinitdir = "$cadir/Users/$pkinitprincipalname";
 211         my $pkinitcert = "$ca_pkinitdir/USER-$pkinitprincipalname-cert.pem";
 212         my $pkinitkey_private = "$ca_pkinitdir/USER-$pkinitprincipalname-private-key.pem";
 213
 214         my $tlsdir = "$ctx->{tlsdir}";
 215         my $pkinitdir = "$ctx->{prefix_abs}/pkinit";
 216         #TLS and PKINIT crypto blobs
 217         my $dhfile = "$tlsdir/dhparms.pem";
 218         my $cafile = "$tlsdir/ca.pem";
 219         my $crlfile = "$tlsdir/crl.pem";
 220         my $certfile = "$tlsdir/cert.pem";
 221         my $keyfile = "$tlsdir/key.pem";
 222         my $admincertfile = "$pkinitdir/USER-$adminprincipalname-cert.pem";
 223         my $adminkeyfile = "$pkinitdir/USER-$adminprincipalname-private-key.pem";
 224         my $pkinitcertfile = "$pkinitdir/USER-$pkinitprincipalname-cert.pem";
 225         my $pkinitkeyfile = "$pkinitdir/USER-$pkinitprincipalname-private-key.pem";
 226
 227         mkdir($tlsdir, 0700);
 228         mkdir($pkinitdir, 0700);
 229         my $oldumask = umask;
 230         umask 0077;
 231
 232         # This is specified here to avoid draining entropy on every run
 233         # generate by
 234         # openssl dhparam -out dhparms.pem -text -2 8192
 235         open(DHFILE, ">$dhfile");
 236         print DHFILE <<EOF;
 237 -----BEGIN DH PARAMETERS-----
 238 MIIECAKCBAEAlcpjuJptCzC2bIIApLuyFLw2nODQUztqs/peysY9e3LgWh/xrc87
 239 SWJNSUrqFJFh2m357WH0XGcTdTk0b/8aIYIWjbwEhWR/5hZ+1x2TDrX1awkYayAe
 240 pr0arycmWHaAmhw+m+dBdj2O2jRMe7gn0ha85JALNl+Z3wv2q2eys8TIiQ2dbHPx
 241 XvpMmlAv7QHZnpSpX/XgueQr6T3EYggljppZwk1fe4W2cxBjCv9w/Q83pJXMEVVB
 242 WESEQPZC38v6hVIXIlF4J7jXjV3+NtCLL4nvsy0jrLEntyKz5OB8sNPRzJr0Ju2Y
 243 yXORCSMMXMygP+dxJtQ6txzQYWyaCYN1HqHDZy3cFL9Qy8kTFqIcW56Lti2GsW/p
 244 jSMzEOa1NevhKNFL3dSZJx5m+5ZeMvWXlCqXSptmVdbs5wz5jkMUm/E6pVfM5lyb
 245 Ttlcq2iYPqnJz1jcL5xwhoufID8zSJCPJ7C0jb0Ngy5wLIUZfjXJUXxUyxTnNR9i
 246 N9Sc+UkDvLxnCW+qzjyPXGlQU1SsJwMLWa2ZecL/uYE4bOdcN3g+5WHkevyDnXqR
 247 +yy9x7sGXjBT3bRWK5tVHJWOi6eBu1hp39U6aK8oOJWiUt3vmC2qEdIsT6JaLNNi
 248 YKrSfRGBf19IJBaagen1S19bb3dnmwoU1RaWM0EeJQW1oXOBg7zLisB2yuu5azBn
 249 tse00+0nc+GbH2y+jP0sE7xil1QeilZl+aQ3tX9vL0cnCa+8602kXxU7P5HaX2+d
 250 05pvoHmeZbDV85io36oF976gBYeYN+qAkTUMsIZhuLQDuyn0963XOLyn1Pm6SBrU
 251 OkIZXW7WoKEuO/YSfizUIqXwmAMJjnEMJCWG51MZZKx//9Hsdp1RXSm/bRSbvXB7
 252 MscjvQYWmfCFnIk8LYnEt3Yey40srEiS9xyZqdrvobxz+sU1XcqR38kpVf4gKASL
 253 xURia64s4emuJF+YHIObyydazQ+6/wX/C+m+nyfhuxSO6j1janPwtYbU+Uj3TzeM
 254 04K1mpPQpZcaMdZZiNiu7i8VJlOPKAz7aJT8TnMMF5GMyzyLpSMpc+NF9L/BSocV
 255 /cUM4wQT2PTHrcyYzmTVH7c9bzBkuxqrwVB1BY1jitDV9LIYIVBglKcX88qrfHIM
 256 XiXPAIwGclD59qm2cG8OdM9NA5pNMI119KuUAIJsUdgPbR1LkT2XTT15YVoHmFSQ
 257 DlaWOXn4td031jr0EisX8QtFR7+/0Nfoni6ydFGs5fNH/L1ckq6FEO4OhgucJw9H
 258 YRmiFlsQBQNny78vNchwZne3ZixkShtGW0hWDdi2n+h7St1peNJCNJjMbEhRsPRx
 259 RmNGWh4AL8rho4RO9OBao0MnUdjbbffD+wIBAg==
 260 -----END DH PARAMETERS-----
 261 EOF
 262         close(DHFILE);
 263
 264         if (! -e ${dckey_private}) {
 265                 umask $oldumask;
 266                 return;
 267         }
 268
 269         copy_file_content(${cacert}, ${cafile});
 270         copy_file_content(${cacrl_pem}, ${crlfile});
 271         copy_file_content(${dccert}, ${certfile});
 272         copy_file_content(${dckey_private}, ${keyfile});
 273         if (-e ${adminkey_private}) {
 274                 copy_file_content(${admincert}, ${admincertfile});
 275                 copy_file_content(${adminkey_private}, ${adminkeyfile});
 276         }
 277         if (-e ${pkinitkey_private}) {
 278                 copy_file_content(${pkinitcert}, ${pkinitcertfile});
 279                 copy_file_content(${pkinitkey_private}, ${pkinitkeyfile});
 280         }
 281
 282         # COMPAT stuff to be removed in a later commit
 283         my $kdccertfile = "$tlsdir/kdc.pem";
 284         copy_file_content(${dccert}, ${kdccertfile});
 285
 286         umask $oldumask;
 287 }
 288
 289 sub copy_gnupg_home($)
 290 {
 291         my ($ctx) = @_;
 292
 293         my $gnupg_srcdir = "$ENV{SRCDIR_ABS}/selftest/gnupg";
 294         my @files = (
 295                 "gpg.conf",
 296                 "pubring.gpg",
 297                 "secring.gpg",
 298                 "trustdb.gpg",
 299         );
 300
 301         my $oldumask = umask;
 302         umask 0077;
 303         mkdir($ctx->{gnupghome}, 0777);
 304         umask 0177;
 305         foreach my $file (@files) {
 306                 my $srcfile = "${gnupg_srcdir}/${file}";
 307                 my $dstfile = "$ctx->{gnupghome}/${file}";
 308                 copy_file_content(${srcfile}, ${dstfile});
 309         }
 310         umask $oldumask;
 311 }
 312
 313 sub mk_krb5_conf($$)
 314 {
 315         my ($ctx) = @_;
 316
 317         unless (open(KRB5CONF, ">$ctx->{krb5_conf}")) {
 318                 warn("can't open $ctx->{krb5_conf}$?");
 319                 return undef;
 320         }
 321
 322         my $our_realms_stanza = mk_realms_stanza($ctx->{realm},
 323                                                  $ctx->{dnsname},
 324                                                  $ctx->{domain},
 325                                                  $ctx->{kdc_ipv4});
 326         print KRB5CONF "
 327 #Generated krb5.conf for $ctx->{realm}
 328
 329 [libdefaults]
 330  default_realm = $ctx->{realm}
 331  dns_lookup_realm = false
 332  dns_lookup_kdc = true
 333  ticket_lifetime = 24h
 334  forwardable = yes
 335
 336  # We are running on the same machine, do not correct
 337  # system clock differences
 338  kdc_timesync = 0
 339
 340  fcache_strict_checking = false
 341 ";
 342
 343         if (defined($ENV{MITKRB5})) {
 344                 print KRB5CONF "
 345  # Set the grace clocskew to 5 seconds
 346  # This is especially required by samba3.raw.session krb5 and
 347  # reauth tests when not using Heimdal
 348  clockskew = 5
 349     ";
 350         }
 351
 352         if (defined($ctx->{krb5_ccname})) {
 353                 print KRB5CONF "
 354  default_ccache_name = $ctx->{krb5_ccname}
 355 ";
 356         }
 357
 358
 359         if (defined($ctx->{supported_enctypes})) {
 360                 print KRB5CONF "
 361  default_etypes = $ctx->{supported_enctypes}
 362  default_as_etypes = $ctx->{supported_enctypes}
 363  default_tgs_enctypes = $ctx->{supported_enctypes}
 364  default_tkt_enctypes = $ctx->{supported_enctypes}
 365  permitted_enctypes = $ctx->{supported_enctypes}
 366 ";
 367         }
 368
 369         if (defined($ctx->{tlsdir})) {
 370                 if (defined($ENV{MITKRB5})) {
 371                         print KRB5CONF "
 372  pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
 373  pkinit_kdc_hostname = $ctx->{hostname}.$ctx->{dnsname}
 374
 375 ";
 376                 } else {
 377                         print KRB5CONF "
 378
 379 [appdefaults]
 380         pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
 381
 382 [kdc]
 383         enable-pkinit = true
 384         pkinit_identity = FILE:$ctx->{tlsdir}/kdc.pem,$ctx->{tlsdir}/key.pem
 385         pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
 386         pkinit_revoke = FILE:$ctx->{tlsdir}/crl.pem
 387
 388 ";
 389                 }
 390         }
 391
 392         print KRB5CONF "
 393 [realms]
 394  $our_realms_stanza
 395 ";
 396
 397         close(KRB5CONF);
 398 }
 399
 400 sub append_krb5_conf_trust_realms($$)
 401 {
 402         my ($ctx) = @_;
 403
 404         unless (open(KRB5CONF, ">>$ctx->{KRB5_CONFIG}")) {
 405                 warn("can't open $ctx->{KRB5_CONFIG}$?");
 406                 return undef;
 407         }
 408
 409         my $trust_realms_stanza = mk_realms_stanza($ctx->{TRUST_REALM},
 410                                                    $ctx->{TRUST_DNSNAME},
 411                                                    $ctx->{TRUST_DOMAIN},
 412                                                    $ctx->{TRUST_SERVER_IP});
 413
 414         print KRB5CONF " $trust_realms_stanza";
 415
 416         close(KRB5CONF)
 417 }
 418
 419 sub mk_realms_stanza($$$$)
 420 {
 421         my ($realm, $dnsname, $domain, $kdc_ipv4) = @_;
 422         my $lc_domain = lc($domain);
 423
 424         # The   pkinit_require_krbtgt_otherName = false
 425         # is just because the certificates we have saved
 426         # do not have the realm in the subjectAltName
 427         # (specially encoded as a principal)
 428         # per
 429         # https://github.com/heimdal/heimdal/wiki/Setting-up-PK-INIT-and-Certificates
 430         my $realms_stanza = "
 431  $realm = {
 432   kdc = $kdc_ipv4:88
 433   admin_server = $kdc_ipv4:88
 434   default_domain = $dnsname
 435   pkinit_require_krbtgt_otherName = false
 436  }
 437  $dnsname = {
 438   kdc = $kdc_ipv4:88
 439   admin_server = $kdc_ipv4:88
 440   default_domain = $dnsname
 441   pkinit_require_krbtgt_otherName = false
 442  }
 443  $domain = {
 444   kdc = $kdc_ipv4:88
 445   admin_server = $kdc_ipv4:88
 446   default_domain = $dnsname
 447   pkinit_require_krbtgt_otherName = false
 448  }
 449  $lc_domain = {
 450   kdc = $kdc_ipv4:88
 451   admin_server = $kdc_ipv4:88
 452   default_domain = $dnsname
 453   pkinit_require_krbtgt_otherName = false
 454  }
 455
 456 ";
 457         return $realms_stanza;
 458 }
 459
 460 sub mk_mitkdc_conf($$)
 461 {
 462         # samba_kdb_dir is the path to mit_samba.so
 463         my ($ctx, $samba_kdb_dir) = @_;
 464
 465         unless (open(KDCCONF, ">$ctx->{mitkdc_conf}")) {
 466                 warn("can't open $ctx->{mitkdc_conf}$?");
 467                 return undef;
 468         }
 469
 470         print KDCCONF "
 471 # Generated kdc.conf for $ctx->{realm}
 472
 473 [kdcdefaults]
 474         kdc_ports = 88
 475         kdc_tcp_ports = 88
 476         restrict_anonymous_to_tgt = true
 477
 478 [realms]
 479         $ctx->{realm} = {
 480                 master_key_type = aes256-cts
 481                 default_principal_flags = +preauth
 482                 pkinit_identity = FILE:$ctx->{tlsdir}/kdc.pem,$ctx->{tlsdir}/key.pem
 483                 pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
 484                 pkinit_eku_checking = scLogin
 485                 pkinit_indicator = pkinit
 486                 pkinit_allow_upn = true
 487         }
 488
 489         $ctx->{dnsname} = {
 490                 master_key_type = aes256-cts
 491                 default_principal_flags = +preauth
 492                 pkinit_identity = FILE:$ctx->{tlsdir}/kdc.pem,$ctx->{tlsdir}/key.pem
 493                 pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
 494                 pkinit_eku_checking = scLogin
 495                 pkinit_indicator = pkinit
 496                 pkinit_allow_upn = true
 497         }
 498
 499         $ctx->{domain} = {
 500                 master_key_type = aes256-cts
 501                 default_principal_flags = +preauth
 502                 pkinit_identity = FILE:$ctx->{tlsdir}/kdc.pem,$ctx->{tlsdir}/key.pem
 503                 pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
 504                 pkinit_eku_checking = scLogin
 505                 pkinit_indicator = pkinit
 506                 pkinit_allow_upn = true
 507         }
 508
 509 [dbmodules]
 510         db_module_dir = $samba_kdb_dir
 511
 512         $ctx->{realm} = {
 513                 db_library = samba
 514         }
 515
 516         $ctx->{dnsname} = {
 517                 db_library = samba
 518         }
 519
 520         $ctx->{domain} = {
 521                 db_library = samba
 522         }
 523
 524 [logging]
 525         kdc = FILE:$ctx->{logdir}/mit_kdc.log
 526 ";
 527
 528         close(KDCCONF);
 529 }
 530
 531 sub mk_resolv_conf($$)
 532 {
 533         my ($ctx) = @_;
 534
 535         unless (open(RESOLV_CONF, ">$ctx->{resolv_conf}")) {
 536                 warn("can't open $ctx->{resolv_conf}$?");
 537                 return undef;
 538         }
 539
 540         print RESOLV_CONF "nameserver $ctx->{dns_ipv4}\n";
 541         print RESOLV_CONF "nameserver $ctx->{dns_ipv6}\n";
 542         close(RESOLV_CONF);
 543 }
 544
 545 sub realm_to_ip_mappings
 546 {
 547         # this maps the DNS realms for the various testenvs to the corresponding
 548         # PDC (i.e. the first DC created for that realm).
 549         my %realm_to_pdc_mapping = (
 550                 'adnonssdom.samba.example.com'    => 'addc_no_nss',
 551                 'adnontlmdom.samba.example.com'   => 'addc_no_ntlm',
 552                 'samba2000.example.com'           => 'dc5',
 553                 'samba2003.example.com'           => 'dc6',
 554                 'samba2008r2.example.com'         => 'dc7',
 555                 'addom.samba.example.com'         => 'addc',
 556                 'addom2.samba.example.com'        => 'addcsmb1',
 557                 'sub.samba.example.com'           => 'localsubdc',
 558                 'chgdcpassword.samba.example.com' => 'chgdcpass',
 559                 'backupdom.samba.example.com'     => 'backupfromdc',
 560                 'renamedom.samba.example.com'     => 'renamedc',
 561                 'labdom.samba.example.com'        => 'labdc',
 562                 'schema.samba.example.com'        => 'liveupgrade1dc',
 563                 'prockilldom.samba.example.com'   => 'prockilldc',
 564                 'proclimit.samba.example.com'     => 'proclimitdc',
 565                 'samba.example.com'               => 'localdc',
 566                 'fips.samba.example.com'          => 'fipsdc',
 567         );
 568
 569         my @mapping = ();
 570
 571         # convert the hashmap to a list of key=value strings, where key is the
 572         # realm and value is the IP address
 573         foreach my $realm (sort(keys %realm_to_pdc_mapping)) {
 574                 my $pdc = $realm_to_pdc_mapping{$realm};
 575                 my $ipaddr = get_ipv4_addr($pdc);
 576                 push(@mapping, "$realm=$ipaddr");
 577         }
 578         # return the mapping as a single comma-separated string
 579         return join(',', @mapping);
 580 }
 581
 582 sub get_interface($)
 583 {
 584         my ($netbiosname) = @_;
 585         $netbiosname = lc($netbiosname);
 586
 587         # this maps the SOCKET_WRAPPER_DEFAULT_IFACE value for each possible
 588         # testenv to the DC's NETBIOS name. This value also corresponds to last
 589         # digit of the DC's IP address. Note that the NETBIOS name may differ from
 590         # the testenv name.
 591         # Note that when adding a DC with a new realm, also update
 592         # get_realm_ip_mappings() above.
 593         my %testenv_iface_mapping = (
 594                 localnt4dc2       => 3,
 595                 localnt4member3   => 4,
 596                 localshare4       => 5,
 597                 # 6 is spare
 598                 localktest6       => 7,
 599                 maptoguest        => 8,
 600                 localnt4dc9       => 9,
 601                 # 10 is spare
 602
 603                 # 11-16 are used by selftest.pl for the client.conf. Most tests only
 604                 # use the first .11 IP. However, some tests (like winsreplication) rely
 605                 # on the client having multiple IPs.
 606                 client            => 11,
 607
 608                 addc_no_nss       => 17,
 609                 addc_no_ntlm      => 18,
 610                 idmapadmember     => 19,
 611                 idmapridmember    => 20,
 612                 localdc           => 21,
 613                 localvampiredc    => 22,
 614                 s4member          => 23,
 615                 localrpcproxy     => 24,
 616                 dc5               => 25,
 617                 dc6               => 26,
 618                 dc7               => 27,
 619                 rodc              => 28,
 620                 localadmember     => 29,
 621                 addc              => 30,
 622                 localsubdc        => 31,
 623                 chgdcpass         => 32,
 624                 promotedvdc       => 33,
 625                 rfc2307member     => 34,
 626                 fileserver        => 35,
 627                 fakednsforwarder1 => 36,
 628                 fakednsforwarder2 => 37,
 629                 s4member_dflt     => 38,
 630                 vampire2000dc     => 39,
 631                 backupfromdc      => 40,
 632                 restoredc         => 41,
 633                 renamedc          => 42,
 634                 labdc             => 43,
 635                 offlinebackupdc   => 44,
 636                 customdc          => 45,
 637                 prockilldc        => 46,
 638                 proclimitdc       => 47,
 639                 liveupgrade1dc    => 48,
 640                 liveupgrade2dc    => 49,
 641                 ctdb0             => 50,
 642                 ctdb1             => 51,
 643                 ctdb2             => 52,
 644                 fileserversmb1    => 53,
 645                 addcsmb1          => 54,
 646                 lclnt4dc2smb1     => 55,
 647                 fipsdc            => 56,
 648                 fipsadmember      => 57,
 649                 offlineadmem      => 58,
 650                 s2kmember         => 59,
 651                 admemidmapnss     => 60,
 652                 localadmember2    => 61,
 653                 admemautorid      => 62,
 654
 655                 rootdnsforwarder  => 64,
 656
 657                 # Note: that you also need to update dns_hub.py when adding a new
 658                 # multi-DC testenv
 659                 # update lib/socket_wrapper/socket_wrapper.c
 660                 #  #define MAX_WRAPPED_INTERFACES 64
 661                 # if you wish to have more than 64 interfaces
 662         );
 663
 664         if (not defined($testenv_iface_mapping{$netbiosname})) {
 665                 die();
 666         }
 667
 668         return $testenv_iface_mapping{$netbiosname};
 669 }
 670
 671 sub get_ipv4_addr
 672 {
 673         my ($hostname, $iface_num) = @_;
 674         my $swiface = Samba::get_interface($hostname);
 675
 676         # Handle testenvs with multiple different addresses, i.e. IP multihoming.
 677         # Currently only the selftest client has multiple IPv4 addresses.
 678         if (defined($iface_num)) {
 679                 $swiface += $iface_num;
 680         }
 681
 682         return "10.53.57.$swiface";
 683 }
 684
 685 sub get_ipv6_addr
 686 {
 687         (my $hostname) = @_;
 688         my $swiface = Samba::get_interface($hostname);
 689
 690         return sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
 691 }
 692
 693 # returns the 'interfaces' setting for smb.conf, i.e. the IPv4/IPv6
 694 # addresses for testenv
 695 sub get_interfaces_config
 696 {
 697         my ($hostname, $num_ips) = @_;
 698         my $interfaces = "";
 699
 700         # We give the client.conf multiple different IPv4 addresses.
 701         # All other testenvs generally just have one IPv4 address.
 702         if (! defined($num_ips)) {
 703                 $num_ips = 1;
 704         }
 705         for (my $i = 0; $i < $num_ips; $i++) {
 706                 my $ipv4_addr = Samba::get_ipv4_addr($hostname, $i);
 707                 if (use_namespaces()) {
 708                         # use a /24 subnet with network namespaces
 709                         $interfaces .= "$ipv4_addr/24 ";
 710                 } else {
 711                         $interfaces .= "$ipv4_addr/8 ";
 712                 }
 713         }
 714
 715         my $ipv6_addr = Samba::get_ipv6_addr($hostname);
 716         $interfaces .= "$ipv6_addr/64";
 717
 718         return $interfaces;
 719 }
 720
 721 sub cleanup_child($$)
 722 {
 723     my ($pid, $name) = @_;
 724
 725     if (!defined($pid)) {
 726         print STDERR "cleanup_child: pid not defined ... not calling waitpid\n";
 727         return -1;
 728     }
 729
 730     my $childpid = waitpid($pid, WNOHANG);
 731
 732     if ($childpid == 0) {
 733     } elsif ($childpid < 0) {
 734         printf STDERR "%s child process %d isn't here any more\n", $name, $pid;
 735         return $childpid;
 736     } elsif ($? & 127) {
 737         printf STDERR "%s child process %d, died with signal %d, %s coredump\n",
 738                 $name, $childpid, ($? & 127),  ($? & 128) ? 'with' : 'without';
 739     } else {
 740         printf STDERR "%s child process %d exited with value %d\n", $name, $childpid, $? >> 8;
 741     }
 742     return $childpid;
 743 }
 744
 745 sub random_domain_sid()
 746 {
 747         my $domain_sid = "S-1-5-21-". int(rand(4294967295)) . "-" . int(rand(4294967295)) . "-" . int(rand(4294967295));
 748         return $domain_sid;
 749 }
 750
 751 # sets the environment variables ready for running a given process
 752 sub set_env_for_process
 753 {
 754         my ($proc_name, $env_vars, $proc_envs) = @_;
 755
 756         if (not defined($proc_envs)) {
 757                 $proc_envs = get_env_for_process($proc_name, $env_vars);
 758         }
 759
 760         foreach my $key (keys %{ $proc_envs }) {
 761                 $ENV{$key} = $proc_envs->{$key};
 762         }
 763 }
 764
 765 sub get_env_for_process
 766 {
 767         my ($proc_name, $env_vars) = @_;
 768         my $proc_envs = {
 769                 RESOLV_CONF => $env_vars->{RESOLV_CONF},
 770                 KRB5_CONFIG => $env_vars->{KRB5_CONFIG},
 771                 KRB5CCNAME => "$env_vars->{KRB5_CCACHE}.$proc_name",
 772                 GNUPGHOME => $env_vars->{GNUPGHOME},
 773                 SELFTEST_WINBINDD_SOCKET_DIR => $env_vars->{SELFTEST_WINBINDD_SOCKET_DIR},
 774                 NMBD_SOCKET_DIR => $env_vars->{NMBD_SOCKET_DIR},
 775                 NSS_WRAPPER_PASSWD => $env_vars->{NSS_WRAPPER_PASSWD},
 776                 NSS_WRAPPER_GROUP => $env_vars->{NSS_WRAPPER_GROUP},
 777                 NSS_WRAPPER_HOSTS => $env_vars->{NSS_WRAPPER_HOSTS},
 778                 NSS_WRAPPER_HOSTNAME => $env_vars->{NSS_WRAPPER_HOSTNAME},
 779                 NSS_WRAPPER_MODULE_SO_PATH => $env_vars->{NSS_WRAPPER_MODULE_SO_PATH},
 780                 NSS_WRAPPER_MODULE_FN_PREFIX => $env_vars->{NSS_WRAPPER_MODULE_FN_PREFIX},
 781                 UID_WRAPPER_ROOT => "1",
 782                 ENVNAME => "$ENV{ENVNAME}.$proc_name",
 783         };
 784
 785         if (defined($env_vars->{RESOLV_WRAPPER_CONF})) {
 786                 $proc_envs->{RESOLV_WRAPPER_CONF} = $env_vars->{RESOLV_WRAPPER_CONF};
 787         } else {
 788                 $proc_envs->{RESOLV_WRAPPER_HOSTS} = $env_vars->{RESOLV_WRAPPER_HOSTS};
 789         }
 790         if (defined($env_vars->{GNUTLS_FORCE_FIPS_MODE})) {
 791                 $proc_envs->{GNUTLS_FORCE_FIPS_MODE} = $env_vars->{GNUTLS_FORCE_FIPS_MODE};
 792         }
 793         if (defined($env_vars->{OPENSSL_FORCE_FIPS_MODE})) {
 794                 $proc_envs->{OPENSSL_FORCE_FIPS_MODE} = $env_vars->{OPENSSL_FORCE_FIPS_MODE};
 795         }
 796         return $proc_envs;
 797 }
 798
 799 sub fork_and_exec
 800 {
 801         my ($self, $env_vars, $daemon_ctx, $STDIN_READER, $child_cleanup) = @_;
 802         my $SambaCtx = $self;
 803         $SambaCtx = $self->{SambaCtx} if defined($self->{SambaCtx});
 804
 805         # we close the child's write-end of the pipe and redirect the
 806         # read-end to its stdin. That way the daemon will receive an
 807         # EOF on stdin when parent selftest process closes its
 808         # write-end.
 809         $child_cleanup //= sub { close($env_vars->{STDIN_PIPE}) };
 810
 811         unlink($daemon_ctx->{LOG_FILE});
 812         print "STARTING $daemon_ctx->{NAME} for $ENV{ENVNAME}...";
 813
 814         my $parent_pid = $$;
 815         my $pid = fork();
 816
 817         # exec the daemon in the child process
 818         if ($pid == 0) {
 819                 my @preargs = ();
 820
 821                 # redirect the daemon's stdout/stderr to a log file
 822                 if (defined($daemon_ctx->{TEE_STDOUT})) {
 823                         # in some cases, we want out from samba to go to the log file,
 824                         # but also to the users terminal when running 'make test' on the
 825                         # command line. This puts it on stderr on the terminal
 826                         open STDOUT, "| tee $daemon_ctx->{LOG_FILE} 1>&2";
 827                 } else {
 828                         open STDOUT, ">$daemon_ctx->{LOG_FILE}";
 829                 }
 830                 open STDERR, '>&STDOUT';
 831
 832                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
 833                 if (defined($daemon_ctx->{PCAP_FILE})) {
 834                         $SambaCtx->setup_pcap("$daemon_ctx->{PCAP_FILE}");
 835                 }
 836
 837                 # setup ENV variables in the child process
 838                 set_env_for_process($daemon_ctx->{NAME}, $env_vars,
 839                                     $daemon_ctx->{ENV_VARS});
 840
 841                 $child_cleanup->();
 842
 843                 # not all s3 daemons run in all testenvs (e.g. fileserver doesn't
 844                 # run winbindd). In which case, the child process just sleeps
 845                 if (defined($daemon_ctx->{SKIP_DAEMON})) {
 846                         $SIG{USR1} = $SIG{ALRM} = $SIG{INT} = $SIG{QUIT} = $SIG{TERM} = sub {
 847                                 my $signame = shift;
 848                                 print("Skip $daemon_ctx->{NAME} received signal $signame");
 849                                 exit 0;
 850                         };
 851                         my $poll = IO::Poll->new();
 852                         $poll->mask($STDIN_READER, POLLIN);
 853                         $poll->poll($self->{server_maxtime});
 854                         exit 0;
 855                 }
 856
 857                 $ENV{MAKE_TEST_BINARY} = $daemon_ctx->{BINARY_PATH};
 858
 859                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 860
 861                 # if using kernel namespaces, prepend the command so the process runs in
 862                 # its own namespace
 863                 if (Samba::use_namespaces()) {
 864                         @preargs = ns_exec_preargs($parent_pid, $env_vars);
 865                 }
 866
 867                 # the command args are stored as an array reference (because...Perl),
 868                 # so convert the reference back to an array
 869                 my @full_cmd = @{ $daemon_ctx->{FULL_CMD} };
 870
 871                 exec(@preargs, @full_cmd) or die("Unable to start $ENV{MAKE_TEST_BINARY}: $!");
 872         }
 873
 874         print "DONE ($pid)\n";
 875
 876         # if using kernel namespaces, we now establish a connection between the
 877         # main selftest namespace (i.e. this process) and the new child namespace
 878         if (use_namespaces()) {
 879                 ns_child_forked($pid, $env_vars);
 880         }
 881
 882         return $pid;
 883 }
 884
 885 my @exported_envvars = (
 886         # domain stuff
 887         "DOMAIN",
 888         "DNSNAME",
 889         "REALM",
 890         "DOMSID",
 891
 892         # stuff related to a trusted domain
 893         "TRUST_SERVER",
 894         "TRUST_USERNAME",
 895         "TRUST_PASSWORD",
 896         "TRUST_DOMAIN",
 897         "TRUST_REALM",
 898         "TRUST_DOMSID",
 899
 900         # stuff related to a trusted domain, on a trust_member
 901         # the domain behind a forest trust (two-way)
 902         "TRUST_F_BOTH_SERVER",
 903         "TRUST_F_BOTH_SERVER_IP",
 904         "TRUST_F_BOTH_SERVER_IPV6",
 905         "TRUST_F_BOTH_NETBIOSNAME",
 906         "TRUST_F_BOTH_USERNAME",
 907         "TRUST_F_BOTH_PASSWORD",
 908         "TRUST_F_BOTH_DOMAIN",
 909         "TRUST_F_BOTH_REALM",
 910
 911         # stuff related to a trusted domain, on a trust_member
 912         # the domain behind an external trust (two-way)
 913         "TRUST_E_BOTH_SERVER",
 914         "TRUST_E_BOTH_SERVER_IP",
 915         "TRUST_E_BOTH_SERVER_IPV6",
 916         "TRUST_E_BOTH_NETBIOSNAME",
 917         "TRUST_E_BOTH_USERNAME",
 918         "TRUST_E_BOTH_PASSWORD",
 919         "TRUST_E_BOTH_DOMAIN",
 920         "TRUST_E_BOTH_REALM",
 921
 922         # domain controller stuff
 923         "DC_SERVER",
 924         "DC_SERVER_IP",
 925         "DC_SERVER_IPV6",
 926         "DC_NETBIOSNAME",
 927         "DC_NETBIOSALIAS",
 928
 929         # server stuff
 930         "SERVER",
 931         "SERVER_IP",
 932         "SERVER_IPV6",
 933         "NETBIOSNAME",
 934         "NETBIOSALIAS",
 935         "SAMSID",
 936
 937         # only use these 2 as a last resort. Some tests need to test both client-
 938         # side and server-side. In this case, run as default client, ans access
 939         # server's smb.conf as needed, typically using:
 940         #  param.LoadParm(filename_for_non_global_lp=os.environ['SERVERCONFFILE'])
 941         "SERVERCONFFILE",
 942         "DC_SERVERCONFFILE",
 943
 944         # user stuff
 945         "USERNAME",
 946         "USERID",
 947         "PASSWORD",
 948         "DC_USERNAME",
 949         "DC_PASSWORD",
 950         "DOMAIN_ADMIN",
 951         "DOMAIN_ADMIN_PASSWORD",
 952         "DOMAIN_USER",
 953         "DOMAIN_USER_PASSWORD",
 954
 955         # UID/GID for rfc2307 mapping tests
 956         "UID_RFC2307TEST",
 957         "GID_RFC2307TEST",
 958
 959         # misc stuff
 960         "KRB5_CONFIG",
 961         "KRB5CCNAME",
 962         "GNUPGHOME",
 963         "SELFTEST_WINBINDD_SOCKET_DIR",
 964         "NMBD_SOCKET_DIR",
 965         "LOCAL_PATH",
 966         "DNS_FORWARDER1",
 967         "DNS_FORWARDER2",
 968         "RESOLV_CONF",
 969         "UNACCEPTABLE_PASSWORD",
 970         "LOCK_DIR",
 971         "SMBD_TEST_LOG",
 972         "KRB5_CRL_FILE",
 973
 974         # nss_wrapper
 975         "NSS_WRAPPER_PASSWD",
 976         "NSS_WRAPPER_GROUP",
 977         "NSS_WRAPPER_HOSTS",
 978         "NSS_WRAPPER_HOSTNAME",
 979         "NSS_WRAPPER_MODULE_SO_PATH",
 980         "NSS_WRAPPER_MODULE_FN_PREFIX",
 981
 982         # resolv_wrapper
 983         "RESOLV_WRAPPER_CONF",
 984         "RESOLV_WRAPPER_HOSTS",
 985
 986         # ctdb stuff
 987         "NUM_NODES",
 988         "CTDB_BASE",
 989         "CTDB_SOCKET",
 990         "CTDB_SERVER_NAME",
 991         "CTDB_IFACE_IP",
 992         "CTDB_BASE_NODE0",
 993         "CTDB_SOCKET_NODE0",
 994         "CTDB_SERVER_NAME_NODE0",
 995         "CTDB_IFACE_IP_NODE0",
 996         "CTDB_BASE_NODE1",
 997         "CTDB_SOCKET_NODE1",
 998         "CTDB_SERVER_NAME_NODE1",
 999         "CTDB_IFACE_IP_NODE1",
1000         "CTDB_BASE_NODE2",
1001         "CTDB_SOCKET_NODE2",
1002         "CTDB_SERVER_NAME_NODE2",
1003         "CTDB_IFACE_IP_NODE2",
1004 );
1005
1006 sub exported_envvars_str
1007 {
1008         my ($testenv_vars) = @_;
1009         my $out = "";
1010
1011         foreach (@exported_envvars) {
1012                 next unless defined($testenv_vars->{$_});
1013                 $out .= $_."=".$testenv_vars->{$_}."\n";
1014         }
1015
1016         return $out;
1017 }
1018
1019 sub clear_exported_envvars
1020 {
1021         foreach (@exported_envvars) {
1022                 delete $ENV{$_};
1023         }
1024 }
1025
1026 sub export_envvars
1027 {
1028         my ($testenv_vars) = @_;
1029
1030         foreach (@exported_envvars) {
1031                 if (defined($testenv_vars->{$_})) {
1032                         $ENV{$_} = $testenv_vars->{$_};
1033                 } else {
1034                         delete $ENV{$_};
1035                 }
1036         }
1037 }
1038
1039 sub export_envvars_to_file
1040 {
1041         my ($filepath, $testenv_vars) = @_;
1042         my $env_str = exported_envvars_str($testenv_vars);
1043
1044         open(FILE, "> $filepath");
1045         print FILE "$env_str";
1046         close(FILE);
1047 }
1048
1049 # Returns true if kernel namespaces are being used instead of socket-wrapper.
1050 # The default is false.
1051 sub use_namespaces
1052 {
1053         return defined($ENV{USE_NAMESPACES});
1054 }
1055
1056 # returns a given testenv's interface-name (only when USE_NAMESPACES=1)
1057 sub ns_interface_name
1058 {
1059         my ($hostname) = @_;
1060
1061         # when using namespaces, each testenv has its own vethX interface,
1062         # where X = Samba::get_interface(testenv_name)
1063         my $iface = get_interface($hostname);
1064         return "veth$iface";
1065 }
1066
1067 # Called after a new child namespace has been forked
1068 sub ns_child_forked
1069 {
1070         my ($child_pid, $env_vars) = @_;
1071
1072         # we only need to do this for the first child forked for this testenv
1073         if (defined($env_vars->{NS_PID})) {
1074                 return;
1075         }
1076
1077         # store the child PID. It's the only way the main (selftest) namespace can
1078         # access the new child (testenv) namespace.
1079         $env_vars->{NS_PID} = $child_pid;
1080
1081         # Add the new child namespace's interface to the main selftest bridge.
1082         # This connects together the various testenvs so that selftest can talk to
1083         # them all
1084         my $iface = ns_interface_name($env_vars->{NETBIOSNAME});
1085         system "$ENV{SRCDIR}/selftest/ns/add_bridge_iface.sh $iface-br selftest0";
1086 }
1087
1088 # returns args to prepend to a command in order to execute it the correct
1089 # namespace for the testenv (creating a new namespace if needed).
1090 # This should only used when USE_NAMESPACES=1 is set.
1091 sub ns_exec_preargs
1092 {
1093         my ($parent_pid, $env_vars) = @_;
1094
1095         # NS_PID stores the pid of the first child daemon run in this namespace
1096         if (defined($env_vars->{NS_PID})) {
1097
1098                 # the namespace has already been created previously. So we use nsenter
1099                 # to execute the command in the given testenv's namespace. We need to
1100                 # use the NS_PID to identify this particular namespace
1101                 return ("nsenter", "-t", "$env_vars->{NS_PID}", "--net");
1102         } else {
1103
1104                 # We need to create a new namespace for this daemon (i.e. we're
1105                 # setting up a new testenv). First, write the environment variables to
1106                 # an exports.sh file for this testenv (for convenient access by the
1107                 # namespace scripts).
1108                 my $exports_file = "$env_vars->{TESTENV_DIR}/exports.sh";
1109                 export_envvars_to_file($exports_file, $env_vars);
1110
1111                 # when using namespaces, each testenv has its own veth interface
1112                 my $interface = ns_interface_name($env_vars->{NETBIOSNAME});
1113
1114                 # we use unshare to create a new network namespace. The start_in_ns.sh
1115                 # helper script gets run first to setup the new namespace's interfaces.
1116                 # (This all gets prepended around the actual command to run in the new
1117                 # namespace)
1118                 return ("unshare", "--net", "$ENV{SRCDIR}/selftest/ns/start_in_ns.sh",
1119                                 $interface, $exports_file, $parent_pid);
1120         }
1121 }
1122
1123
1124 sub check_env {
1125         my ($self, $envvars) = @_;
1126         return 1;
1127 }
1128
1129 sub teardown_env {
1130         my ($self, $env) = @_;
1131         return 1;
1132 }
1133
1134
1135 sub getlog_env {
1136         return '';
1137 }
1138
1139 1;