?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:torture: let remote_pac test for asserted identity sids
[Samba.git] / selftest / target / Samba4.pm
blob4c263f55de4dbf684e59c5e6354ab71371e19ef0
1 #!/usr/bin/perl
2 # Bootstrap Samba and run a number of tests against it.
3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
4 # Published under the GNU GPL, v3 or later.
5
6 # NOTE: Refer to the README for more details about the various testenvs,
7 # and tips about adding new testenvs.
8
9 package Samba4;
10
11 use strict;
12 use warnings;
13 use Cwd qw(abs_path);
14 use FindBin qw($RealBin);
15 use POSIX;
16 use SocketWrapper;
17 use target::Samba;
18 use target::Samba3;
19 use Archive::Tar;
20
21 sub new($$$$$) {
22 my ($classname, $SambaCtx, $bindir, $srcdir, $server_maxtime) = @_;
23
24 my $self = {
25 vars => {},
26 SambaCtx => $SambaCtx,
27 bindir => $bindir,
28 srcdir => $srcdir,
29 server_maxtime => $server_maxtime,
30 target3 => new Samba3($SambaCtx, $bindir, $srcdir, $server_maxtime)
31 };
32 bless $self;
33 return $self;
34 }
35
36 sub scriptdir_path($$) {
37 my ($self, $path) = @_;
38 return "$self->{srcdir}/source4/scripting/$path";
39 }
40
41 sub check_or_start($$$)
42 {
43 my ($self, $env_vars, $process_model) = @_;
44 my $STDIN_READER;
45
46 my $env_ok = $self->check_env($env_vars);
47 if ($env_ok) {
48 return $env_vars->{SAMBA_PID};
49 } elsif (defined($env_vars->{SAMBA_PID})) {
50 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
51 return undef;
52 }
53
54 # use a pipe for stdin in the child processes. This allows
55 # those processes to monitor the pipe for EOF to ensure they
56 # exit when the test script exits
57 pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
58
59 # build up the command to run samba
60 my @preargs = ();
61 my @optargs = ();
62 if (defined($ENV{SAMBA_OPTIONS})) {
63 @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
64 }
65 if(defined($ENV{SAMBA_VALGRIND})) {
66 @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
67 }
68
69 if (defined($process_model)) {
70 push @optargs, ("-M", $process_model);
71 }
72 my $binary = Samba::bindir_path($self, "samba");
73 my @full_cmd = (@preargs, $binary, "-i",
74 "--no-process-group", "--maximum-runtime=$self->{server_maxtime}",
75 $env_vars->{CONFIGURATION}, @optargs);
76
77 # the samba process takes some additional env variables (compared to s3)
78 my $samba_envs = Samba::get_env_for_process("samba", $env_vars);
79 if (defined($ENV{MITKRB5})) {
80 $samba_envs->{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
81 }
82
83 # fork a child process and exec() samba
84 my $daemon_ctx = {
85 NAME => "samba",
86 BINARY_PATH => $binary,
87 FULL_CMD => [ @full_cmd ],
88 LOG_FILE => $env_vars->{SAMBA_TEST_LOG},
89 TEE_STDOUT => 1,
90 PCAP_FILE => "env-$ENV{ENVNAME}-samba",
91 ENV_VARS => $samba_envs,
92 };
93 my $pid = Samba::fork_and_exec($self, $env_vars, $daemon_ctx, $STDIN_READER);
94
95 $env_vars->{SAMBA_PID} = $pid;
96
97 # close the parent's read-end of the pipe
98 close($STDIN_READER);
99
100 if ($self->wait_for_start($env_vars) != 0) {
101 warn("Samba $pid failed to start up");
102 return undef;
103 }
104
105 return $pid;
106 }
107
108 sub wait_for_start($$)
109 {
110 my ($self, $testenv_vars) = @_;
111 my $count = 0;
112 my $ret = 0;
113
114 if (not $self->check_env($testenv_vars)) {
115 warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
116 return -1;
117 }
118
119 # This will return quickly when things are up, but be slow if we
120 # need to wait for (eg) SSL init
121 my $nmblookup = Samba::bindir_path($self, "nmblookup4");
122
123 do {
124 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
125 if ($ret != 0) {
126 sleep(1);
127 } else {
128 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
129 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
130 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
131 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
132 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
133 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
134 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
135 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
136 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
137 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
138 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
139 }
140 $count++;
141 } while ($ret != 0 && $count < 20);
142 if ($count == 20) {
143 teardown_env($self, $testenv_vars);
144 warn("nbt not reachable after 20 retries\n");
145 return -1;
146 }
147
148 # Ensure we have the first RID Set before we start tests. This makes the tests more reliable.
149 if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
150 print "waiting for working LDAP and a RID Set to be allocated\n";
151 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
152 my $count = 0;
153 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
154
155 my $search_dn = $base_dn;
156 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
157 # TODO currently no check for actual rIDAllocationPool
158 $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
159 }
160 my $max_wait = 60;
161
162 # Add hosts file for name lookups
163 my $cmd = $self->get_cmd_env_vars($testenv_vars);
164
165 $cmd .= "$ldbsearch ";
166 $cmd .= "$testenv_vars->{CONFIGURATION} ";
167 $cmd .= "-H ldap://$testenv_vars->{SERVER} ";
168 $cmd .= "-U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} ";
169 $cmd .= "--scope base ";
170 $cmd .= "-b '$search_dn' ";
171 while (system("$cmd >/dev/null") != 0) {
172 $count++;
173 if ($count > $max_wait) {
174 teardown_env($self, $testenv_vars);
175 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
176 return -1;
177 }
178 print "Waiting for working LDAP...\n";
179 sleep(1);
180 }
181 }
182
183 my $wbinfo = Samba::bindir_path($self, "wbinfo");
184
185 $count = 0;
186 do {
187 my $cmd = "NSS_WRAPPER_PASSWD=$testenv_vars->{NSS_WRAPPER_PASSWD} ";
188 $cmd .= "NSS_WRAPPER_GROUP=$testenv_vars->{NSS_WRAPPER_GROUP} ";
189 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=$testenv_vars->{SELFTEST_WINBINDD_SOCKET_DIR} ";
190 $cmd .= "$wbinfo -P";
191 $ret = system($cmd);
192
193 if ($ret != 0) {
194 sleep(1);
195 }
196 $count++;
197 } while ($ret != 0 && $count < 20);
198 if ($count == 20) {
199 teardown_env($self, $testenv_vars);
200 warn("winbind not reachable after 20 retries\n");
201 return -1;
202 }
203
204 # Ensure we registered all our names
205 if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
206 my $max_wait = 120;
207 my $dns_update_cache = "$testenv_vars->{PRIVATEDIR}/dns_update_cache";
208 print "Waiting for $dns_update_cache to be created.\n";
209 $count = 0;
210 while (not -e $dns_update_cache) {
211 $count++;
212 if ($count > $max_wait) {
213 teardown_env($self, $testenv_vars);
214 warn("Timed out ($max_wait sec) waiting for $dns_update_cache PID $testenv_vars->{SAMBA_PID}");
215 return -1;
216 }
217 print "Waiting for $dns_update_cache to be created...\n";
218 sleep(1);
219 }
220 print "Waiting for $dns_update_cache to be filled.\n";
221 $count = 0;
222 while ((-s "$dns_update_cache") == 0) {
223 $count++;
224 if ($count > $max_wait) {
225 teardown_env($self, $testenv_vars);
226 warn("Timed out ($max_wait sec) waiting for $dns_update_cache PID $testenv_vars->{SAMBA_PID}");
227 return -1;
228 }
229 print "Waiting for $dns_update_cache to be filled...\n";
230 sleep(1);
231 }
232 }
233
234 print $self->getlog_env($testenv_vars);
235
236 print "READY ($testenv_vars->{SAMBA_PID})\n";
237
238 return 0
239 }
240
241 sub write_ldb_file($$$)
242 {
243 my ($self, $file, $ldif_in) = @_;
244
245 my $ldbadd = Samba::bindir_path($self, "ldbadd");
246 open(my $ldif, "|$ldbadd -H $file > /dev/null")
247 or die "Failed to run $ldbadd: $!";
248 print $ldif $ldif_in;
249 close($ldif);
250
251 unless ($? == 0) {
252 warn("$ldbadd failed: $?");
253 return undef;
254 }
255 return 1;
256 }
257
258 sub add_wins_config($$)
259 {
260 my ($self, $privatedir) = @_;
261 my $client_ip = Samba::get_ipv4_addr("client");
262
263 return $self->write_ldb_file("$privatedir/wins_config.ldb", "
264 dn: name=TORTURE_11,CN=PARTNERS
265 objectClass: wreplPartner
266 name: TORTURE_11
267 address: $client_ip
268 pullInterval: 0
269 pushChangeCount: 0
270 type: 0x3
271 ");
272 }
273
274 sub setup_dns_hub_internal($$$)
275 {
276 my ($self, $hostname, $prefix) = @_;
277 my $STDIN_READER;
278
279 unless(-d $prefix or mkdir($prefix, 0777)) {
280 warn("Unable to create $prefix");
281 return undef;
282 }
283 my $prefix_abs = abs_path($prefix);
284
285 die ("prefix=''") if $prefix_abs eq "";
286 die ("prefix='/'") if $prefix_abs eq "/";
287
288 unless (system("rm -rf $prefix_abs/*") == 0) {
289 warn("Unable to clean up");
290 }
291
292 my $env = undef;
293 $env->{NETBIOSNAME} = $hostname;
294
295 $env->{SERVER_IP} = Samba::get_ipv4_addr($hostname);
296 $env->{SERVER_IPV6} = Samba::get_ipv6_addr($hostname);
297 $env->{SOCKET_WRAPPER_DEFAULT_IFACE} = Samba::get_interface($hostname);
298 $env->{DNS_HUB_LOG} = "$prefix_abs/dns_hub.log";
299 $env->{RESOLV_CONF} = "$prefix_abs/resolv.conf";
300 $env->{TESTENV_DIR} = $prefix_abs;
301
302 my $ctx = undef;
303 $ctx->{resolv_conf} = $env->{RESOLV_CONF};
304 $ctx->{dns_ipv4} = $env->{SERVER_IP};
305 $ctx->{dns_ipv6} = $env->{SERVER_IPV6};
306 Samba::mk_resolv_conf($ctx);
307
308 my @preargs = ();
309 my @args = ();
310 if (!defined($ENV{PYTHON})) {
311 push (@preargs, "env");
312 push (@preargs, "python");
313 } else {
314 push (@preargs, $ENV{PYTHON});
315 }
316 my $binary = "$self->{srcdir}/selftest/target/dns_hub.py";
317 push (@args, "$self->{server_maxtime}");
318 push (@args, "$env->{SERVER_IP},$env->{SERVER_IPV6}");
319 push (@args, Samba::realm_to_ip_mappings());
320 my @full_cmd = (@preargs, $binary, @args);
321
322 my $daemon_ctx = {
323 NAME => "dnshub",
324 BINARY_PATH => $binary,
325 FULL_CMD => [ @full_cmd ],
326 LOG_FILE => $env->{DNS_HUB_LOG},
327 TEE_STDOUT => 1,
328 PCAP_FILE => "env-$ENV{ENVNAME}-dns_hub",
329 ENV_VARS => {},
330 };
331
332 # use a pipe for stdin in the child processes. This allows
333 # those processes to monitor the pipe for EOF to ensure they
334 # exit when the test script exits
335 pipe($STDIN_READER, $env->{STDIN_PIPE});
336
337 my $pid = Samba::fork_and_exec($self, $env, $daemon_ctx, $STDIN_READER);
338
339 $env->{SAMBA_PID} = $pid;
340 $env->{KRB5_CONFIG} = "$prefix_abs/no_krb5.conf";
341
342 # close the parent's read-end of the pipe
343 close($STDIN_READER);
344
345 return $env;
346 }
347
348 sub setup_dns_hub
349 {
350 my ($self, $prefix) = @_;
351
352 my $hostname = "rootdnsforwarder";
353
354 unless(-d $prefix or mkdir($prefix, 0777)) {
355 warn("Unable to create $prefix");
356 return undef;
357 }
358 my $env = $self->setup_dns_hub_internal("$hostname", "$prefix/$hostname");
359
360 $self->{dns_hub_env} = $env;
361
362 return $env;
363 }
364
365 sub get_dns_hub_env($)
366 {
367 my ($self, $prefix) = @_;
368
369 if (defined($self->{dns_hub_env})) {
370 return $self->{dns_hub_env};
371 }
372
373 die("get_dns_hub_env() not setup 'dns_hub_env'");
374 return undef;
375 }
376
377 sub return_env_value
378 {
379 my ($env, $overwrite, $key) = @_;
380
381 if (defined($overwrite) and defined($overwrite->{$key})) {
382 return $overwrite->{$key};
383 }
384
385 if (defined($env->{$key})) {
386 return $env->{$key};
387 }
388
389 return undef;
390 }
391
392 # Returns the environmental variables that we pass to samba-tool commands
393 sub get_cmd_env_vars
394 {
395 my ($self, $givenenv, $overwrite) = @_;
396
397 my @keys = (
398 "NSS_WRAPPER_HOSTS",
399 "SOCKET_WRAPPER_DEFAULT_IFACE",
400 "RESOLV_CONF",
401 "RESOLV_WRAPPER_CONF",
402 "RESOLV_WRAPPER_HOSTS",
403 "GNUTLS_FORCE_FIPS_MODE",
404 "OPENSSL_FORCE_FIPS_MODE",
405 "KRB5_CONFIG",
406 "KRB5_CCACHE",
407 "GNUPGHOME",
408 );
409
410 my $localenv = undef;
411 foreach my $key (@keys) {
412 my $v = return_env_value($givenenv, $overwrite, $key);
413 $localenv->{$key} = $v if defined($v);
414 }
415
416 my $cmd_env = "NSS_WRAPPER_HOSTS='$localenv->{NSS_WRAPPER_HOSTS}' ";
417 $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
418 if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
419 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
420 } else {
421 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
422 }
423 if (defined($localenv->{GNUTLS_FORCE_FIPS_MODE})) {
424 $cmd_env .= "GNUTLS_FORCE_FIPS_MODE=$localenv->{GNUTLS_FORCE_FIPS_MODE} ";
425 }
426 if (defined($localenv->{OPENSSL_FORCE_FIPS_MODE})) {
427 $cmd_env .= "OPENSSL_FORCE_FIPS_MODE=$localenv->{OPENSSL_FORCE_FIPS_MODE} ";
428 }
429 $cmd_env .= "KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
430 $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
431 $cmd_env .= "RESOLV_CONF=\"$localenv->{RESOLV_CONF}\" ";
432 $cmd_env .= "GNUPGHOME=\"$localenv->{GNUPGHOME}\" ";
433
434 return $cmd_env;
435 }
436
437 # Sets up a forest trust namespace.
438 # (Note this is different to kernel namespaces, setup by the
439 # USE_NAMESPACES=1 option)
440 sub setup_namespaces
441 {
442 my ($self, $localenv, $upn_array, $spn_array) = @_;
443
444 @{$upn_array} = [] unless defined($upn_array);
445 my $upn_args = "";
446 foreach my $upn (@{$upn_array}) {
447 $upn_args .= " --add-upn-suffix=$upn";
448 }
449
450 @{$spn_array} = [] unless defined($spn_array);
451 my $spn_args = "";
452 foreach my $spn (@{$spn_array}) {
453 $spn_args .= " --add-spn-suffix=$spn";
454 }
455
456 my $samba_tool = Samba::bindir_path($self, "samba-tool");
457
458 my $cmd_env = $self->get_cmd_env_vars($localenv);
459
460 my $cmd_config = " $localenv->{CONFIGURATION}";
461
462 my $namespaces = $cmd_env;
463 $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
464 $namespaces .= $cmd_config;
465 unless (system($namespaces) == 0) {
466 warn("Failed to add namespaces \n$namespaces");
467 return -1;
468 }
469
470 return 0;
471 }
472
473 sub setup_trust($$$$$)
474 {
475 my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
476
477 $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
478 $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
479 $localenv->{TRUST_DNSNAME} = $remoteenv->{DNSNAME};
480
481 $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
482 $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
483 $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
484 $localenv->{TRUST_REALM} = $remoteenv->{REALM};
485 $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID};
486
487 # Add trusted domain realms to krb5.conf
488 Samba::append_krb5_conf_trust_realms($localenv);
489
490 my $samba_tool = Samba::bindir_path($self, "samba-tool");
491
492 # setup the trust
493 my $cmd_env = $self->get_cmd_env_vars($localenv);
494
495 my $cmd_config = " $localenv->{CONFIGURATION}";
496 my $cmd_creds = $cmd_config;
497 $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
498
499 my $create = $cmd_env;
500 $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
501 $create .= " $extra_args";
502 $create .= $cmd_creds;
503 unless (system($create) == 0) {
504 warn("Failed to create trust \n$create");
505 return undef;
506 }
507
508 my $groupname = "g_$localenv->{TRUST_DOMAIN}";
509 my $groupadd = $cmd_env;
510 $groupadd .= " $samba_tool group add '$groupname' --group-scope=Domain $cmd_config";
511 unless (system($groupadd) == 0) {
512 warn("Failed to create group \n$groupadd");
513 return undef;
514 }
515 my $groupmem = $cmd_env;
516 $groupmem .= " $samba_tool group addmembers '$groupname' '$localenv->{TRUST_DOMSID}-513' $cmd_config";
517 unless (system($groupmem) == 0) {
518 warn("Failed to add group member \n$groupmem");
519 return undef;
520 }
521
522 return $localenv
523 }
524
525 sub provision_raw_prepare($$$$$$$$$$$$$$)
526 {
527 my ($self,
528 $prefix,
529 $server_role,
530 $hostname,
531 $domain,
532 $realm,
533 $samsid,
534 $functional_level,
535 $password,
536 $kdc_ipv4,
537 $kdc_ipv6,
538 $force_fips_mode,
539 $extra_provision_options) = @_;
540 my $ctx;
541 my $python_cmd = "";
542 if (defined $ENV{PYTHON}) {
543 $python_cmd = $ENV{PYTHON} . " ";
544 }
545 $ctx->{python} = $python_cmd;
546 my $netbiosname = uc($hostname);
547
548 unless(-d $prefix or mkdir($prefix, 0777)) {
549 warn("Unable to create $prefix");
550 return undef;
551 }
552 my $prefix_abs = abs_path($prefix);
553
554 die ("prefix=''") if $prefix_abs eq "";
555 die ("prefix='/'") if $prefix_abs eq "/";
556
557 unless (system("rm -rf $prefix_abs/*") == 0) {
558 warn("Unable to clean up");
559 }
560
561
562 my $swiface = Samba::get_interface($hostname);
563
564 $ctx->{prefix} = $prefix;
565 $ctx->{prefix_abs} = $prefix_abs;
566
567 $ctx->{server_role} = $server_role;
568 $ctx->{hostname} = $hostname;
569 $ctx->{netbiosname} = $netbiosname;
570 $ctx->{swiface} = $swiface;
571 $ctx->{password} = $password;
572 $ctx->{kdc_ipv4} = $kdc_ipv4;
573 $ctx->{kdc_ipv6} = $kdc_ipv6;
574 $ctx->{force_fips_mode} = $force_fips_mode;
575 $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
576 if ($functional_level eq "2000") {
577 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc";
578 }
579
580 #
581 # Set smbd log level here.
582 #
583 $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
584 $ctx->{username} = "Administrator";
585 $ctx->{domain} = $domain;
586 $ctx->{realm} = uc($realm);
587 $ctx->{dnsname} = lc($realm);
588 $ctx->{samsid} = $samsid;
589
590 $ctx->{functional_level} = $functional_level;
591
592 my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
593 chomp $unix_name;
594 $ctx->{unix_name} = $unix_name;
595 $ctx->{unix_uid} = $>;
596 my @mygid = split(" ", $();
597 $ctx->{unix_gid} = $mygid[0];
598 $ctx->{unix_gids_str} = $);
599 @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
600
601 $ctx->{etcdir} = "$prefix_abs/etc";
602 $ctx->{piddir} = "$prefix_abs/pid";
603 $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
604 $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
605 $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
606 $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
607 $ctx->{gnupghome} = "$prefix_abs/gnupg";
608 $ctx->{privatedir} = "$prefix_abs/private";
609 $ctx->{binddnsdir} = "$prefix_abs/bind-dns";
610 $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
611 $ctx->{lockdir} = "$prefix_abs/lockdir";
612 $ctx->{logdir} = "$prefix_abs/logs";
613 $ctx->{statedir} = "$prefix_abs/statedir";
614 $ctx->{cachedir} = "$prefix_abs/cachedir";
615 $ctx->{winbindd_socket_dir} = "$prefix_abs/wbsock";
616 $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
617 $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
618 $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
619 $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
620 $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
621 if ($ENV{SAMBA_DNS_FAKING}) {
622 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
623 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --configfile=$ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
624 $ctx->{samba_dnsupdate} = $python_cmd . $ctx->{samba_dnsupdate};
625 } else {
626 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --configfile=$ctx->{smb_conf} --all-interfaces";
627 $ctx->{samba_dnsupdate} = $python_cmd . $ctx->{samba_dnsupdate};
628 $ctx->{use_resolv_wrapper} = 1;
629 }
630
631 my $dns_hub = $self->get_dns_hub_env();
632 $ctx->{resolv_conf} = $dns_hub->{RESOLV_CONF};
633
634 $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
635
636 $ctx->{ipv4} = Samba::get_ipv4_addr($hostname);
637 $ctx->{ipv6} = Samba::get_ipv6_addr($hostname);
638
639 push(@{$ctx->{directories}}, $ctx->{privatedir});
640 push(@{$ctx->{directories}}, $ctx->{binddnsdir});
641 push(@{$ctx->{directories}}, $ctx->{etcdir});
642 push(@{$ctx->{directories}}, $ctx->{piddir});
643 push(@{$ctx->{directories}}, $ctx->{lockdir});
644 push(@{$ctx->{directories}}, $ctx->{logdir});
645 push(@{$ctx->{directories}}, $ctx->{statedir});
646 push(@{$ctx->{directories}}, $ctx->{cachedir});
647
648 $ctx->{smb_conf_extra_options} = "";
649
650 my @provision_options = ();
651 push (@provision_options, "GNUPGHOME=\"$ctx->{gnupghome}\"");
652 push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
653 push (@provision_options, "KRB5CCNAME=\"$ctx->{krb5_ccache}\"");
654 push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
655 push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
656 push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
657 push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
658 if (defined($ctx->{use_resolv_wrapper})) {
659 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
660 push (@provision_options, "RESOLV_CONF=\"$ctx->{resolv_conf}\"");
661 } else {
662 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
663 }
664 if (defined($ctx->{force_fips_mode})) {
665 push (@provision_options, "GNUTLS_FORCE_FIPS_MODE=1");
666 push (@provision_options, "OPENSSL_FORCE_FIPS_MODE=1");
667 }
668
669 if (defined($ENV{GDB_PROVISION})) {
670 push (@provision_options, "gdb --args");
671 if (!defined($ENV{PYTHON})) {
672 push (@provision_options, "env");
673 push (@provision_options, "python");
674 }
675 }
676 if (defined($ENV{VALGRIND_PROVISION})) {
677 push (@provision_options, "valgrind");
678 if (!defined($ENV{PYTHON})) {
679 push (@provision_options, "env");
680 push (@provision_options, "python");
681 }
682 }
683
684 my $samba_tool = Samba::bindir_path($self, "samba-tool");
685
686 push (@provision_options, $samba_tool);
687 push (@provision_options, "domain");
688 push (@provision_options, "provision");
689 push (@provision_options, "--configfile=$ctx->{smb_conf}");
690 push (@provision_options, "--host-name=$ctx->{hostname}");
691 push (@provision_options, "--host-ip=$ctx->{ipv4}");
692 push (@provision_options, "--quiet");
693 push (@provision_options, "--domain=$ctx->{domain}");
694 push (@provision_options, "--realm=$ctx->{realm}");
695 if (defined($ctx->{samsid})) {
696 push (@provision_options, "--domain-sid=$ctx->{samsid}");
697 }
698 push (@provision_options, "--adminpass=$ctx->{password}");
699 push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
700 push (@provision_options, "--machinepass=machine$ctx->{password}");
701 push (@provision_options, "--root=$ctx->{unix_name}");
702 push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
703 push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
704
705 @{$ctx->{provision_options}} = @provision_options;
706
707 if (defined($extra_provision_options)) {
708 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
709 }
710
711 return $ctx;
712 }
713
714 sub has_option
715 {
716 my ($self, $keyword, @options_list) = @_;
717
718 # convert the options-list to a hash-map for easy keyword lookup
719 my %options_dict = map { $_ => 1 } @options_list;
720
721 return exists $options_dict{$keyword};
722 }
723
724 #
725 # Step1 creates the basic configuration
726 #
727 sub provision_raw_step1($$)
728 {
729 my ($self, $ctx) = @_;
730
731 mkdir($_, 0777) foreach (@{$ctx->{directories}});
732
733 ##
734 ## lockdir and piddir must be 0755
735 ##
736 chmod 0755, $ctx->{lockdir};
737 chmod 0755, $ctx->{piddir};
738
739 unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
740 warn("can't open $ctx->{smb_conf}$?");
741 return undef;
742 }
743
744 Samba::copy_gnupg_home($ctx);
745 Samba::prepare_keyblobs($ctx);
746 my $crlfile = "$ctx->{tlsdir}/crl.pem";
747 $crlfile = "" unless -e ${crlfile};
748
749 # work out which file server to use. Default to source3 smbd (s3fs),
750 # unless the source4 NTVFS (smb) file server has been specified
751 my $services = "-smb +s3fs";
752 if ($self->has_option("--use-ntvfs", @{$ctx->{provision_options}})) {
753 $services = "+smb -s3fs";
754 }
755
756 my $interfaces = Samba::get_interfaces_config($ctx->{netbiosname});
757
758 print CONFFILE "
759 [global]
760 netbios name = $ctx->{netbiosname}
761 posix:eadb = $ctx->{statedir}/eadb.tdb
762 workgroup = $ctx->{domain}
763 realm = $ctx->{realm}
764 private dir = $ctx->{privatedir}
765 binddns dir = $ctx->{binddnsdir}
766 pid directory = $ctx->{piddir}
767 ncalrpc dir = $ctx->{ncalrpcdir}
768 lock dir = $ctx->{lockdir}
769 state directory = $ctx->{statedir}
770 cache directory = $ctx->{cachedir}
771 winbindd socket directory = $ctx->{winbindd_socket_dir}
772 ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
773 winbind separator = /
774 interfaces = $interfaces
775 tls dh params file = $ctx->{tlsdir}/dhparms.pem
776 tls crlfile = ${crlfile}
777 tls verify peer = no_check
778 panic action = $RealBin/gdb_backtrace \%d
779 smbd:suicide mode = yes
780 smbd:FSCTL_SMBTORTURE = yes
781 wins support = yes
782 server role = $ctx->{server_role}
783 server services = +echo $services
784 dcerpc endpoint servers = +winreg +srvsvc
785 notify:inotify = false
786 ldb:nosync = true
787 ldap server require strong auth = yes
788 log file = $ctx->{logdir}/log.\%m
789 log level = $ctx->{server_loglevel}
790 lanman auth = Yes
791 ntlm auth = Yes
792 client min protocol = SMB2_02
793 server min protocol = SMB2_02
794 mangled names = yes
795 dns update command = $ctx->{samba_dnsupdate}
796 spn update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate --configfile $ctx->{smb_conf}
797 gpo update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba-gpupdate --configfile $ctx->{smb_conf} --target=Computer
798 samba kcc command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_kcc
799 dreplsrv:periodic_startup_interval = 0
800 dsdb:schema update allowed = yes
801
802 vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
803
804 idmap_ldb:use rfc2307=yes
805 winbind enum users = yes
806 winbind enum groups = yes
807
808 rpc server port:netlogon = 1026
809 include system krb5 conf = no
810
811 ";
812
813 print CONFFILE "
814
815 # Begin extra options
816 $ctx->{smb_conf_extra_options}
817 # End extra options
818 ";
819 close(CONFFILE);
820
821 #Default the KDC IP to the server's IP
822 if (not defined($ctx->{kdc_ipv4})) {
823 $ctx->{kdc_ipv4} = $ctx->{ipv4};
824 }
825 if (not defined($ctx->{kdc_ipv6})) {
826 $ctx->{kdc_ipv6} = $ctx->{ipv6};
827 }
828
829 Samba::mk_krb5_conf($ctx);
830 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
831
832 open(PWD, ">$ctx->{nsswrap_passwd}");
833 if ($ctx->{unix_uid} != 0) {
834 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
835 }
836 print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
837 print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
838 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
839 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
840 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
841 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
842 ";
843 close(PWD);
844 my $uid_rfc2307test = 65533;
845
846 open(GRP, ">$ctx->{nsswrap_group}");
847 if ($ctx->{unix_gid} != 0) {
848 print GRP "root:x:0:\n";
849 }
850 print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
851 print GRP "wheel:x:10:
852 users:x:65531:
853 nobody:x:65533:
854 nogroup:x:65534:nobody
855 ";
856 close(GRP);
857 my $gid_rfc2307test = 65532;
858
859 my $hostname = lc($ctx->{hostname});
860 open(HOSTS, ">>$ctx->{nsswrap_hosts}");
861 if ($hostname eq "localdc") {
862 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
863 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
864 } else {
865 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
866 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
867 }
868 close(HOSTS);
869
870 my $configuration = "--configfile=$ctx->{smb_conf}";
871
872 #Ensure the config file is valid before we start
873 my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
874 if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
875 system("$testparm -v --suppress-prompt $configuration >&2");
876 warn("Failed to create a valid smb.conf configuration $testparm!");
877 return undef;
878 }
879 unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
880 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
881 return undef;
882 }
883
884 # Return the environment variables for the new testenv DC.
885 # Note that we have SERVER_X and DC_SERVER_X variables (which have the same
886 # value initially). In a 2 DC setup, $DC_SERVER_X will always be the PDC.
887 my $ret = {
888 GNUPGHOME => $ctx->{gnupghome},
889 KRB5_CONFIG => $ctx->{krb5_conf},
890 KRB5_CCACHE => $ctx->{krb5_ccache},
891 MITKDC_CONFIG => $ctx->{mitkdc_conf},
892 PIDDIR => $ctx->{piddir},
893 SERVER => $ctx->{hostname},
894 DC_SERVER => $ctx->{hostname},
895 SERVER_IP => $ctx->{ipv4},
896 DC_SERVER_IP => $ctx->{ipv4},
897 SERVER_IPV6 => $ctx->{ipv6},
898 DC_SERVER_IPV6 => $ctx->{ipv6},
899 NETBIOSNAME => $ctx->{netbiosname},
900 DC_NETBIOSNAME => $ctx->{netbiosname},
901 DOMAIN => $ctx->{domain},
902 USERNAME => $ctx->{username},
903 DC_USERNAME => $ctx->{username},
904 REALM => $ctx->{realm},
905 DNSNAME => $ctx->{dnsname},
906 SAMSID => $ctx->{samsid},
907 PASSWORD => $ctx->{password},
908 DC_PASSWORD => $ctx->{password},
909 LDAPDIR => $ctx->{ldapdir},
910 LDAP_INSTANCE => $ctx->{ldap_instance},
911 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
912 NCALRPCDIR => $ctx->{ncalrpcdir},
913 LOCKDIR => $ctx->{lockdir},
914 STATEDIR => $ctx->{statedir},
915 CACHEDIR => $ctx->{cachedir},
916 PRIVATEDIR => $ctx->{privatedir},
917 BINDDNSDIR => $ctx->{binddnsdir},
918 SERVERCONFFILE => $ctx->{smb_conf},
919 TESTENV_DIR => $ctx->{prefix_abs},
920 CONFIGURATION => $configuration,
921 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
922 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
923 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
924 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
925 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
926 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
927 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
928 SAMBA_TEST_LOG_POS => 0,
929 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
930 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
931 LOCAL_PATH => $ctx->{share},
932 UID_RFC2307TEST => $uid_rfc2307test,
933 GID_RFC2307TEST => $gid_rfc2307test,
934 SERVER_ROLE => $ctx->{server_role},
935 RESOLV_CONF => $ctx->{resolv_conf},
936 };
937
938 if (defined($ctx->{use_resolv_wrapper})) {
939 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
940 } else {
941 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
942 }
943 if (defined($ctx->{force_fips_mode})) {
944 $ret->{GNUTLS_FORCE_FIPS_MODE} = "1",
945 $ret->{OPENSSL_FORCE_FIPS_MODE} = "1",
946 }
947
948 if ($ctx->{server_role} eq "domain controller") {
949 $ret->{DOMSID} = $ret->{SAMSID};
950 }
951
952 return $ret;
953 }
954
955 #
956 # Step2 runs the provision script
957 #
958 sub provision_raw_step2($$$)
959 {
960 my ($self, $ctx, $ret) = @_;
961
962 my $ldif;
963
964 my $provision_cmd = join(" ", @{$ctx->{provision_options}});
965 unless (system($provision_cmd) == 0) {
966 warn("Unable to provision: \n$provision_cmd\n");
967 return undef;
968 }
969
970 my $cmd_env = $self->get_cmd_env_vars($ret);
971
972 my $testallowed_account = "testallowed";
973 my $samba_tool_cmd = ${cmd_env};
974 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
975 . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
976 unless (system($samba_tool_cmd) == 0) {
977 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
978 return undef;
979 }
980
981 my $srv_account = "srv_account";
982 $samba_tool_cmd = ${cmd_env};
983 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
984 . " user create --configfile=$ctx->{smb_conf} $srv_account $ctx->{password}";
985 unless (system($samba_tool_cmd) == 0) {
986 warn("Unable to add $srv_account user: \n$samba_tool_cmd\n");
987 return undef;
988 }
989
990 $samba_tool_cmd = ${cmd_env};
991 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
992 . " spn add HOST/$srv_account --configfile=$ctx->{smb_conf} $srv_account";
993 unless (system($samba_tool_cmd) == 0) {
994 warn("Unable to add spn for $srv_account: \n$samba_tool_cmd\n");
995 return undef;
996 }
997
998 my $ldbmodify = ${cmd_env};
999 $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
1000 $ldbmodify .= " --configfile=$ctx->{smb_conf}";
1001 my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
1002
1003 if ($ctx->{server_role} ne "domain controller") {
1004 $base_dn = "DC=$ctx->{netbiosname}";
1005 }
1006
1007 my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
1008 $testallowed_account = "testallowed account";
1009 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1010 or die "Failed to run $ldbmodify: $!";
1011 print $ldif "dn: $user_dn
1012 changetype: modify
1013 replace: samAccountName
1014 samAccountName: $testallowed_account
1015 -
1016 ";
1017 close($ldif);
1018 unless ($? == 0) {
1019 warn("$ldbmodify failed: $?");
1020 return undef;
1021 }
1022
1023 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1024 or die "Failed to run $ldbmodify: $!";
1025 print $ldif "dn: $user_dn
1026 changetype: modify
1027 replace: userPrincipalName
1028 userPrincipalName: testallowed upn\@$ctx->{realm}
1029 replace: servicePrincipalName
1030 servicePrincipalName: host/testallowed
1031 -
1032 ";
1033 close($ldif);
1034 unless ($? == 0) {
1035 warn("$ldbmodify failed: $?");
1036 return undef;
1037 }
1038
1039 $samba_tool_cmd = ${cmd_env};
1040 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1041 . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
1042 unless (system($samba_tool_cmd) == 0) {
1043 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
1044 return undef;
1045 }
1046
1047 $user_dn = "cn=testdenied,cn=users,$base_dn";
1048 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1049 or die "Failed to run $ldbmodify: $!";
1050 print $ldif "dn: $user_dn
1051 changetype: modify
1052 replace: userPrincipalName
1053 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
1054 -
1055 ";
1056 close($ldif);
1057 unless ($? == 0) {
1058 warn("$ldbmodify failed: $?");
1059 return undef;
1060 }
1061
1062 $samba_tool_cmd = ${cmd_env};
1063 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1064 . " user create --configfile=$ctx->{smb_conf} testupnspn $ctx->{password}";
1065 unless (system($samba_tool_cmd) == 0) {
1066 warn("Unable to add testupnspn user: \n$samba_tool_cmd\n");
1067 return undef;
1068 }
1069
1070 $user_dn = "cn=testupnspn,cn=users,$base_dn";
1071 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1072 or die "Failed to run $ldbmodify: $!";
1073 print $ldif "dn: $user_dn
1074 changetype: modify
1075 replace: userPrincipalName
1076 userPrincipalName: http/testupnspn.$ctx->{dnsname}\@$ctx->{realm}
1077 replace: servicePrincipalName
1078 servicePrincipalName: http/testupnspn.$ctx->{dnsname}
1079 -
1080 ";
1081 close($ldif);
1082 unless ($? == 0) {
1083 warn("$ldbmodify failed: $?");
1084 return undef;
1085 }
1086
1087 $samba_tool_cmd = ${cmd_env};
1088 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1089 . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
1090 unless (system($samba_tool_cmd) == 0) {
1091 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
1092 return undef;
1093 }
1094
1095 # Create to users alice and bob!
1096 my $user_account_array = ["alice", "bob", "jane", "joe"];
1097
1098 foreach my $user_account (@{$user_account_array}) {
1099 my $samba_tool_cmd = ${cmd_env};
1100
1101 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1102 . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
1103 unless (system($samba_tool_cmd) == 0) {
1104 warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
1105 return undef;
1106 }
1107 }
1108
1109 my $group_array = ["Samba Users"];
1110
1111 foreach my $group (@{$group_array}) {
1112 my $samba_tool_cmd = ${cmd_env};
1113
1114 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1115 . " group add --configfile=$ctx->{smb_conf} \"$group\"";
1116 unless (system($samba_tool_cmd) == 0) {
1117 warn("Unable to create group: $group\n$samba_tool_cmd\n");
1118 return undef;
1119 }
1120 }
1121
1122 # Add user joe to group "Samba Users"
1123 my $group = "Samba Users";
1124 my $user_account = "joe";
1125
1126 $samba_tool_cmd = ${cmd_env};
1127 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1128 . " group addmembers --configfile=$ctx->{smb_conf} \"$group\" $user_account";
1129 unless (system($samba_tool_cmd) == 0) {
1130 warn("Unable to add " . $user_account . "to group group : $group\n$samba_tool_cmd\n");
1131 return undef;
1132 }
1133
1134 $group = "Samba Users";
1135 $user_account = "joe";
1136
1137 $samba_tool_cmd = ${cmd_env};
1138 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1139 . " user setprimarygroup --configfile=$ctx->{smb_conf} $user_account \"$group\"";
1140 unless (system($samba_tool_cmd) == 0) {
1141 warn("Unable to set primary group of user: $user_account\n$samba_tool_cmd\n");
1142 return undef;
1143 }
1144
1145 # Change the userPrincipalName for jane
1146 $user_dn = "cn=jane,cn=users,$base_dn";
1147
1148 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1149 or die "Failed to run $ldbmodify: $!";
1150 print $ldif "dn: $user_dn
1151 changetype: modify
1152 replace: userPrincipalName
1153 userPrincipalName: jane.doe\@$ctx->{realm}
1154 -
1155 ";
1156 close($ldif);
1157 unless ($? == 0) {
1158 warn("$ldbmodify failed: $?");
1159 return undef;
1160 }
1161
1162 return $ret;
1163 }
1164
1165 sub provision($$$$$$$$$$$)
1166 {
1167 my ($self,
1168 $prefix,
1169 $server_role,
1170 $hostname,
1171 $domain,
1172 $realm,
1173 $functional_level,
1174 $password,
1175 $kdc_ipv4,
1176 $kdc_ipv6,
1177 $force_fips_mode,
1178 $extra_smbconf_options,
1179 $extra_smbconf_shares,
1180 $extra_provision_options) = @_;
1181
1182 my $samsid = Samba::random_domain_sid();
1183
1184 my $ctx = $self->provision_raw_prepare($prefix, $server_role,
1185 $hostname,
1186 $domain, $realm,
1187 $samsid,
1188 $functional_level,
1189 $password,
1190 $kdc_ipv4,
1191 $kdc_ipv6,
1192 $force_fips_mode,
1193 $extra_provision_options);
1194
1195 $ctx->{share} = "$ctx->{prefix_abs}/share";
1196 push(@{$ctx->{directories}}, "$ctx->{share}");
1197 push(@{$ctx->{directories}}, "$ctx->{share}/test1");
1198 push(@{$ctx->{directories}}, "$ctx->{share}/test2");
1199
1200 # precreate directories for printer drivers
1201 push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
1202 push(@{$ctx->{directories}}, "$ctx->{share}/x64");
1203 push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
1204
1205 my $msdfs = "no";
1206 $msdfs = "yes" if ($server_role eq "domain controller");
1207 $ctx->{smb_conf_extra_options} = "
1208
1209 max xmit = 32K
1210 server max protocol = SMB2
1211 host msdfs = $msdfs
1212 lanman auth = yes
1213
1214 # fruit:copyfile is a global option
1215 fruit:copyfile = yes
1216
1217 $extra_smbconf_options
1218
1219 [tmp]
1220 path = $ctx->{share}
1221 read only = no
1222 posix:sharedelay = 100000
1223 posix:oplocktimeout = 3
1224 posix:writetimeupdatedelay = 500000
1225
1226 [xcopy_share]
1227 path = $ctx->{share}
1228 read only = no
1229 posix:sharedelay = 100000
1230 posix:oplocktimeout = 3
1231 posix:writetimeupdatedelay = 500000
1232 create mask = 777
1233 force create mode = 777
1234
1235 [posix_share]
1236 path = $ctx->{share}
1237 read only = no
1238 create mask = 0777
1239 force create mode = 0
1240 directory mask = 0777
1241 force directory mode = 0
1242
1243 [test1]
1244 path = $ctx->{share}/test1
1245 read only = no
1246 posix:sharedelay = 100000
1247 posix:oplocktimeout = 3
1248 posix:writetimeupdatedelay = 500000
1249
1250 [test2]
1251 path = $ctx->{share}/test2
1252 read only = no
1253 posix:sharedelay = 100000
1254 posix:oplocktimeout = 3
1255 posix:writetimeupdatedelay = 500000
1256
1257 [cifs]
1258 path = $ctx->{share}/_ignore_cifs_
1259 read only = no
1260 ntvfs handler = cifs
1261 cifs:server = $ctx->{netbiosname}
1262 cifs:share = tmp
1263 cifs:use-s4u2proxy = yes
1264 # There is no username specified here, instead the client is expected
1265 # to log in with kerberos, and the serverwill use delegated credentials.
1266 # Or the server tries s4u2self/s4u2proxy to impersonate the client
1267
1268 [simple]
1269 path = $ctx->{share}
1270 read only = no
1271 ntvfs handler = simple
1272
1273 [sysvol]
1274 path = $ctx->{statedir}/sysvol
1275 read only = no
1276
1277 [netlogon]
1278 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1279 read only = no
1280
1281 [cifsposix]
1282 copy = simple
1283 ntvfs handler = cifsposix
1284
1285 [vfs_fruit]
1286 path = $ctx->{share}
1287 vfs objects = catia fruit streams_xattr acl_xattr
1288 ea support = yes
1289 fruit:resource = file
1290 fruit:metadata = netatalk
1291 fruit:locking = netatalk
1292 fruit:encoding = native
1293
1294 [xattr]
1295 path = $ctx->{share}
1296 # This can be used for testing real fs xattr stuff
1297 vfs objects = streams_xattr acl_xattr
1298
1299 $extra_smbconf_shares
1300 ";
1301
1302 my $ret = $self->provision_raw_step1($ctx);
1303 unless (defined $ret) {
1304 return undef;
1305 }
1306
1307 return $self->provision_raw_step2($ctx, $ret);
1308 }
1309
1310 # For multi-DC testenvs, we want $DC_SERVER to always be the PDC (i.e. the
1311 # original DC) in the testenv. $SERVER is always the joined DC that we are
1312 # actually running the test against
1313 sub set_pdc_env_vars
1314 {
1315 my ($self, $env, $dcvars) = @_;
1316
1317 $env->{DC_SERVER} = $dcvars->{DC_SERVER};
1318 $env->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1319 $env->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1320 $env->{DC_SERVERCONFFILE} = $dcvars->{SERVERCONFFILE};
1321 $env->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1322 $env->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1323 $env->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1324 }
1325
1326 sub provision_s4member($$$$$)
1327 {
1328 my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
1329 print "PROVISIONING MEMBER...\n";
1330 my $extra_smb_conf = "
1331 passdb backend = samba_dsdb
1332 winbindd:use external pipes = true
1333
1334 # the source4 smb server doesn't allow signing by default
1335 server signing = enabled
1336 raw NTLMv2 auth = yes
1337
1338 # override the new SMB2 only default
1339 client min protocol = CORE
1340 server min protocol = LANMAN1
1341 ";
1342 if ($more_conf) {
1343 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1344 }
1345 my $extra_provision_options = ["--use-ntvfs"];
1346 my $ret = $self->provision($prefix,
1347 "member server",
1348 $hostname,
1349 $dcvars->{DOMAIN},
1350 $dcvars->{REALM},
1351 "2008",
1352 "locMEMpass3",
1353 $dcvars->{SERVER_IP},
1354 $dcvars->{SERVER_IPV6},
1355 undef,
1356 $extra_smb_conf, "",
1357 $extra_provision_options);
1358 unless ($ret) {
1359 return undef;
1360 }
1361
1362 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1363 my $cmd = $self->get_cmd_env_vars($ret);
1364 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member member";
1365 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1366 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1367
1368 unless (system($cmd) == 0) {
1369 warn("Join failed\n$cmd");
1370 return undef;
1371 }
1372
1373 $ret->{DOMSID} = $dcvars->{DOMSID};
1374 $self->set_pdc_env_vars($ret, $dcvars);
1375
1376 return $ret;
1377 }
1378
1379 sub provision_rpc_proxy($$$)
1380 {
1381 my ($self, $prefix, $dcvars) = @_;
1382 print "PROVISIONING RPC PROXY...\n";
1383
1384 my $extra_smbconf_options = "
1385 passdb backend = samba_dsdb
1386
1387 # rpc_proxy
1388 dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1389 dcerpc endpoint servers = epmapper, remote
1390 dcerpc_remote:interfaces = rpcecho
1391 dcerpc_remote:allow_anonymous_fallback = yes
1392 # override the new SMB2 only default
1393 client min protocol = CORE
1394 server min protocol = LANMAN1
1395 [cifs_to_dc]
1396 path = /tmp/_ignore_cifs_to_dc_/_none_
1397 read only = no
1398 ntvfs handler = cifs
1399 cifs:server = $dcvars->{SERVER}
1400 cifs:share = cifs
1401 cifs:use-s4u2proxy = yes
1402 # There is no username specified here, instead the client is expected
1403 # to log in with kerberos, and the serverwill use delegated credentials.
1404 # Or the server tries s4u2self/s4u2proxy to impersonate the client
1405
1406 ";
1407
1408 my $extra_provision_options = ["--use-ntvfs"];
1409 my $ret = $self->provision($prefix,
1410 "member server",
1411 "localrpcproxy",
1412 $dcvars->{DOMAIN},
1413 $dcvars->{REALM},
1414 "2008",
1415 "locRPCproxypass4",
1416 $dcvars->{SERVER_IP},
1417 $dcvars->{SERVER_IPV6},
1418 undef,
1419 $extra_smbconf_options, "",
1420 $extra_provision_options);
1421 unless ($ret) {
1422 return undef;
1423 }
1424
1425 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1426
1427 # The joind runs in the context of the rpc_proxy/member for now
1428 my $cmd = $self->get_cmd_env_vars($ret);
1429 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member member";
1430 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1431 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1432
1433 unless (system($cmd) == 0) {
1434 warn("Join failed\n$cmd");
1435 return undef;
1436 }
1437
1438 # Prepare a context of the DC, but using the local CCACHE.
1439 my $overwrite = undef;
1440 $overwrite->{KRB5_CCACHE} = $ret->{KRB5_CCACHE};
1441 my $dc_cmd_env = $self->get_cmd_env_vars($dcvars, $overwrite);
1442
1443 # Setting up delegation runs in the context of the DC for now
1444 $cmd = $dc_cmd_env;
1445 $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1446 $cmd .= " $dcvars->{CONFIGURATION}";
1447 print $cmd;
1448
1449 unless (system($cmd) == 0) {
1450 warn("Delegation failed\n$cmd");
1451 return undef;
1452 }
1453
1454 # Setting up delegation runs in the context of the DC for now
1455 $cmd = $dc_cmd_env;
1456 $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1457 $cmd .= " $dcvars->{CONFIGURATION}";
1458
1459 unless (system($cmd) == 0) {
1460 warn("Delegation failed\n$cmd");
1461 return undef;
1462 }
1463
1464 $ret->{DOMSID} = $dcvars->{DOMSID};
1465 $self->set_pdc_env_vars($ret, $dcvars);
1466
1467 return $ret;
1468 }
1469
1470 sub provision_promoted_dc($$$)
1471 {
1472 my ($self, $prefix, $dcvars) = @_;
1473 print "PROVISIONING PROMOTED DC...\n";
1474
1475 # We do this so that we don't run the provision. That's the job of 'samba-tool domain dcpromo'.
1476 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1477 "promotedvdc",
1478 $dcvars->{DOMAIN},
1479 $dcvars->{REALM},
1480 $dcvars->{SAMSID},
1481 "2008",
1482 $dcvars->{PASSWORD},
1483 $dcvars->{SERVER_IP},
1484 $dcvars->{SERVER_IPV6});
1485
1486 $ctx->{smb_conf_extra_options} = "
1487 max xmit = 32K
1488 server max protocol = SMB2
1489
1490 ntlm auth = ntlmv2-only
1491
1492 [sysvol]
1493 path = $ctx->{statedir}/sysvol
1494 read only = yes
1495
1496 [netlogon]
1497 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1498 read only = no
1499
1500 ";
1501
1502 my $ret = $self->provision_raw_step1($ctx);
1503 unless ($ret) {
1504 return undef;
1505 }
1506
1507 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1508 my $cmd = $self->get_cmd_env_vars($ret);
1509 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member MEMBER --realm=$dcvars->{REALM}";
1510 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1511 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1512
1513 unless (system($cmd) == 0) {
1514 warn("Join failed\n$cmd");
1515 return undef;
1516 }
1517
1518 $samba_tool = Samba::bindir_path($self, "samba-tool");
1519 $cmd = $self->get_cmd_env_vars($ret);
1520 $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1521 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1522 $cmd .= " --machinepass=machine$ret->{PASSWORD} --dns-backend=BIND9_DLZ";
1523
1524 unless (system($cmd) == 0) {
1525 warn("Join failed\n$cmd");
1526 return undef;
1527 }
1528
1529 $self->set_pdc_env_vars($ret, $dcvars);
1530
1531 return $ret;
1532 }
1533
1534 sub provision_vampire_dc($$$)
1535 {
1536 my ($self, $prefix, $dcvars, $fl) = @_;
1537 print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1538 my $name = "localvampiredc";
1539 my $extra_conf = "";
1540
1541 if ($fl == "2000") {
1542 $name = "vampire2000dc";
1543 } else {
1544 $extra_conf = "drs: immediate link sync = yes
1545 drs: max link sync = 250";
1546 }
1547
1548 # We do this so that we don't run the provision. That's the job of 'net vampire'.
1549 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1550 $name,
1551 $dcvars->{DOMAIN},
1552 $dcvars->{REALM},
1553 $dcvars->{DOMSID},
1554 $fl,
1555 $dcvars->{PASSWORD},
1556 $dcvars->{SERVER_IP},
1557 $dcvars->{SERVER_IPV6});
1558
1559 $ctx->{smb_conf_extra_options} = "
1560 max xmit = 32K
1561 server max protocol = SMB2
1562
1563 ntlm auth = mschapv2-and-ntlmv2-only
1564 $extra_conf
1565
1566 [sysvol]
1567 path = $ctx->{statedir}/sysvol
1568 read only = yes
1569
1570 [netlogon]
1571 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1572 read only = no
1573
1574 ";
1575
1576 my $ret = $self->provision_raw_step1($ctx);
1577 unless ($ret) {
1578 return undef;
1579 }
1580
1581 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1582 my $cmd = $self->get_cmd_env_vars($ret);
1583 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1584 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1585 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1586 $cmd .= " --backend-store=mdb";
1587
1588 unless (system($cmd) == 0) {
1589 warn("Join failed\n$cmd");
1590 return undef;
1591 }
1592
1593 $self->set_pdc_env_vars($ret, $dcvars);
1594 $ret->{DC_REALM} = $dcvars->{DC_REALM};
1595
1596 return $ret;
1597 }
1598
1599 sub provision_ad_dc_ntvfs($$$)
1600 {
1601 my ($self, $prefix, $extra_provision_options) = @_;
1602
1603 # We keep the old 'winbind' name here in server services to
1604 # ensure upgrades which used that name still work with the now
1605 # alias.
1606
1607 print "PROVISIONING AD DC (NTVFS)...\n";
1608 my $extra_conf_options = "netbios aliases = localDC1-a
1609 server services = +winbind -winbindd
1610 ldap server require strong auth = allow_sasl_over_tls
1611 allow nt4 crypto = yes
1612 raw NTLMv2 auth = yes
1613 lsa over netlogon = yes
1614 rpc server port = 1027
1615 auth event notification = true
1616 dsdb event notification = true
1617 dsdb password event notification = true
1618 dsdb group change notification = true
1619 server schannel = auto
1620 # override the new SMB2 only default
1621 client min protocol = CORE
1622 server min protocol = LANMAN1
1623 ";
1624 push (@{$extra_provision_options}, "--use-ntvfs");
1625 my $ret = $self->provision($prefix,
1626 "domain controller",
1627 "localdc",
1628 "SAMBADOMAIN",
1629 "samba.example.com",
1630 "2008",
1631 "locDCpass1",
1632 undef,
1633 undef,
1634 undef,
1635 $extra_conf_options,
1636 "",
1637 $extra_provision_options);
1638 unless ($ret) {
1639 return undef;
1640 }
1641
1642 unless($self->add_wins_config("$prefix/private")) {
1643 warn("Unable to add wins configuration");
1644 return undef;
1645 }
1646 $ret->{NETBIOSALIAS} = "localdc1-a";
1647 $ret->{DC_REALM} = $ret->{REALM};
1648
1649 return $ret;
1650 }
1651
1652 sub provision_fl2000dc($$)
1653 {
1654 my ($self, $prefix) = @_;
1655
1656 print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1657 my $extra_conf_options = "
1658 kdc enable fast = no
1659 spnego:simulate_w2k=yes
1660 ntlmssp_server:force_old_spnego=yes
1661 ";
1662 my $extra_provision_options = ["--base-schema=2008_R2"];
1663 # This environment uses plain text secrets
1664 # i.e. secret attributes are not encrypted on disk.
1665 # This allows testing of the --plaintext-secrets option for
1666 # provision
1667 push (@{$extra_provision_options}, "--plaintext-secrets");
1668 my $ret = $self->provision($prefix,
1669 "domain controller",
1670 "dc5",
1671 "SAMBA2000",
1672 "samba2000.example.com",
1673 "2000",
1674 "locDCpass5",
1675 undef,
1676 undef,
1677 undef,
1678 $extra_conf_options,
1679 "",
1680 $extra_provision_options);
1681 unless ($ret) {
1682 return undef;
1683 }
1684
1685 unless($self->add_wins_config("$prefix/private")) {
1686 warn("Unable to add wins configuration");
1687 return undef;
1688 }
1689 $ret->{DC_REALM} = $ret->{REALM};
1690
1691 return $ret;
1692 }
1693
1694 sub provision_fl2003dc($$$)
1695 {
1696 my ($self, $prefix, $dcvars) = @_;
1697 my $ip_addr1 = Samba::get_ipv4_addr("fakednsforwarder1");
1698 my $ip_addr2 = Samba::get_ipv6_addr("fakednsforwarder2");
1699
1700 print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1701 my $extra_conf_options = "allow dns updates = nonsecure and secure
1702 kdc enable fast = no
1703 dcesrv:header signing = no
1704 dcesrv:max auth states = 0
1705 dns forwarder = $ip_addr1 [$ip_addr2]:54";
1706 my $extra_provision_options = ["--base-schema=2008_R2"];
1707 my $ret = $self->provision($prefix,
1708 "domain controller",
1709 "dc6",
1710 "SAMBA2003",
1711 "samba2003.example.com",
1712 "2003",
1713 "locDCpass6",
1714 undef,
1715 undef,
1716 undef,
1717 $extra_conf_options,
1718 "",
1719 $extra_provision_options);
1720 unless (defined $ret) {
1721 return undef;
1722 }
1723
1724 $ret->{DNS_FORWARDER1} = $ip_addr1;
1725 $ret->{DNS_FORWARDER2} = $ip_addr2;
1726
1727 my @samba_tool_options;
1728 push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1729 push (@samba_tool_options, "domain");
1730 push (@samba_tool_options, "passwordsettings");
1731 push (@samba_tool_options, "set");
1732 push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1733 push (@samba_tool_options, "--min-pwd-age=0");
1734 push (@samba_tool_options, "--history-length=1");
1735
1736 my $samba_tool_cmd = join(" ", @samba_tool_options);
1737
1738 unless (system($samba_tool_cmd) == 0) {
1739 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1740 return undef;
1741 }
1742
1743 unless($self->add_wins_config("$prefix/private")) {
1744 warn("Unable to add wins configuration");
1745 return undef;
1746 }
1747
1748 return $ret;
1749 }
1750
1751 sub provision_fl2008r2dc($$$)
1752 {
1753 my ($self, $prefix, $dcvars) = @_;
1754
1755 print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1756 my $extra_conf_options = "
1757 ldap server require strong auth = no
1758 # delay by 10 seconds, 10^7 usecs
1759 ldap_server:delay_expire_disconnect = 10000
1760 ";
1761 my $extra_provision_options = ["--base-schema=2008_R2"];
1762 my $ret = $self->provision($prefix,
1763 "domain controller",
1764 "dc7",
1765 "SAMBA2008R2",
1766 "samba2008R2.example.com",
1767 "2008_R2",
1768 "locDCpass7",
1769 undef,
1770 undef,
1771 undef,
1772 $extra_conf_options,
1773 "",
1774 $extra_provision_options);
1775 unless (defined $ret) {
1776 return undef;
1777 }
1778
1779 unless ($self->add_wins_config("$prefix/private")) {
1780 warn("Unable to add wins configuration");
1781 return undef;
1782 }
1783 $ret->{DC_REALM} = $ret->{REALM};
1784
1785 return $ret;
1786 }
1787
1788
1789 sub provision_rodc($$$)
1790 {
1791 my ($self, $prefix, $dcvars) = @_;
1792 print "PROVISIONING RODC...\n";
1793
1794 # We do this so that we don't run the provision. That's the job of 'net join RODC'.
1795 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1796 "rodc",
1797 $dcvars->{DOMAIN},
1798 $dcvars->{REALM},
1799 $dcvars->{DOMSID},
1800 "2008",
1801 $dcvars->{PASSWORD},
1802 $dcvars->{SERVER_IP},
1803 $dcvars->{SERVER_IPV6});
1804 unless ($ctx) {
1805 return undef;
1806 }
1807
1808 $ctx->{share} = "$ctx->{prefix_abs}/share";
1809 push(@{$ctx->{directories}}, "$ctx->{share}");
1810
1811 $ctx->{smb_conf_extra_options} = "
1812 max xmit = 32K
1813 server max protocol = SMB2
1814 password server = $dcvars->{DC_SERVER}
1815
1816 [sysvol]
1817 path = $ctx->{statedir}/sysvol
1818 read only = yes
1819
1820 [netlogon]
1821 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1822 read only = yes
1823
1824 [tmp]
1825 path = $ctx->{share}
1826 read only = no
1827 posix:sharedelay = 10000
1828 posix:oplocktimeout = 3
1829 posix:writetimeupdatedelay = 50000
1830
1831 ";
1832
1833 my $ret = $self->provision_raw_step1($ctx);
1834 unless ($ret) {
1835 return undef;
1836 }
1837
1838 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1839 my $cmd = $self->get_cmd_env_vars($ret);
1840 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1841 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1842 $cmd .= " --server=$dcvars->{DC_SERVER}";
1843
1844 unless (system($cmd) == 0) {
1845 warn("RODC join failed\n$cmd");
1846 return undef;
1847 }
1848
1849 # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1850 # user password verified on the RODC
1851 my $testallowed_account = "testallowed account";
1852 $cmd = $self->get_cmd_env_vars($ret);
1853 $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1854 $cmd .= " --server=$dcvars->{DC_SERVER}";
1855
1856 unless (system($cmd) == 0) {
1857 warn("RODC join failed\n$cmd");
1858 return undef;
1859 }
1860
1861 # we overwrite the kdc after the RODC join
1862 # so that use the RODC as kdc and test
1863 # the proxy code
1864 $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1865 $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1866 Samba::mk_krb5_conf($ctx);
1867 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1868
1869 $self->set_pdc_env_vars($ret, $dcvars);
1870
1871 return $ret;
1872 }
1873
1874 sub read_config_h($)
1875 {
1876 my ($name) = @_;
1877 my %ret;
1878 open(LF, "<$name") or die("unable to read $name: $!");
1879 while (<LF>) {
1880 chomp;
1881 next if not (/^#define /);
1882 if (/^#define (.*?)[ \t]+(.*?)$/) {
1883 $ret{$1} = $2;
1884 next;
1885 }
1886 if (/^#define (.*?)[ \t]+$/) {
1887 $ret{$1} = 1;;
1888 next;
1889 }
1890 }
1891 close(LF);
1892 return \%ret;
1893 }
1894
1895 sub provision_ad_dc($$$$$$$)
1896 {
1897 my ($self,
1898 $prefix,
1899 $hostname,
1900 $domain,
1901 $realm,
1902 $force_fips_mode,
1903 $smbconf_args,
1904 $extra_provision_options) = @_;
1905
1906 my $prefix_abs = abs_path($prefix);
1907
1908 my $bindir_abs = abs_path($self->{bindir});
1909 my $lockdir="$prefix_abs/lockdir";
1910 my $conffile="$prefix_abs/etc/smb.conf";
1911
1912 my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
1913 if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} // '' eq "1") {
1914 $require_mutexes = "";
1915 }
1916
1917 my $config_h = {};
1918
1919 if (defined($ENV{CONFIG_H})) {
1920 $config_h = read_config_h($ENV{CONFIG_H});
1921 }
1922
1923 my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
1924 $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
1925
1926 my $extra_smbconf_options = "
1927 xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1928
1929 dbwrap_tdb_mutexes:* = yes
1930 ${require_mutexes}
1931
1932 ${password_hash_gpg_key_ids}
1933
1934 kernel oplocks = no
1935 kernel change notify = no
1936 smb2 leases = no
1937 smb2 disable oplock break retry = yes
1938 server multi channel support = yes
1939
1940 logging = file
1941 printing = bsd
1942 printcap name = /dev/null
1943
1944 max protocol = SMB3
1945 read only = no
1946
1947 smbd:sharedelay = 100000
1948 smbd:writetimeupdatedelay = 500000
1949 create mask = 755
1950 dos filemode = yes
1951 check parent directory delete on close = yes
1952
1953 dcerpc endpoint servers = -winreg -srvsvc
1954
1955 printcap name = /dev/null
1956
1957 addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1958 deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1959
1960 printing = vlp
1961 print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1962 lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1963 lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1964 lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1965 lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1966 queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1967 queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1968 lpq cache time = 0
1969 print notify backchannel = yes
1970
1971 server schannel = auto
1972 auth event notification = true
1973 dsdb event notification = true
1974 dsdb password event notification = true
1975 dsdb group change notification = true
1976 $smbconf_args
1977 ";
1978
1979 my $extra_smbconf_shares = "
1980
1981 [tmpenc]
1982 copy = tmp
1983 smb encrypt = required
1984
1985 [tmpcase]
1986 copy = tmp
1987 case sensitive = yes
1988
1989 [tmpguest]
1990 copy = tmp
1991 guest ok = yes
1992
1993 [hideunread]
1994 copy = tmp
1995 hide unreadable = yes
1996
1997 [durable]
1998 copy = tmp
1999 kernel share modes = no
2000 kernel oplocks = no
2001 posix locking = no
2002
2003 [print\$]
2004 copy = tmp
2005
2006 [print1]
2007 copy = tmp
2008 printable = yes
2009
2010 [print2]
2011 copy = print1
2012 [print3]
2013 copy = print1
2014 [print4]
2015 copy = print1
2016 guest ok = yes
2017 [lp]
2018 copy = print1
2019 ";
2020
2021 push (@{$extra_provision_options}, "--backend-store=mdb");
2022 print "PROVISIONING AD DC...\n";
2023 my $ret = $self->provision($prefix,
2024 "domain controller",
2025 $hostname,
2026 $domain,
2027 $realm,
2028 "2008",
2029 "locDCpass1",
2030 undef,
2031 undef,
2032 $force_fips_mode,
2033 $extra_smbconf_options,
2034 $extra_smbconf_shares,
2035 $extra_provision_options);
2036 unless (defined $ret) {
2037 return undef;
2038 }
2039
2040 unless($self->add_wins_config("$prefix/private")) {
2041 warn("Unable to add wins configuration");
2042 return undef;
2043 }
2044
2045 return $ret;
2046 }
2047
2048 sub provision_chgdcpass($$)
2049 {
2050 my ($self, $prefix) = @_;
2051
2052 print "PROVISIONING CHGDCPASS...\n";
2053 # This environment disallows the use of this password
2054 # (and also removes the default AD complexity checks)
2055 my $unacceptable_password = "Paßßword-widk3Dsle32jxdBdskldsk55klASKQ";
2056 my $extra_smb_conf = "
2057 check password script = $self->{srcdir}/selftest/checkpassword_arg1.sh ${unacceptable_password}
2058 allow dcerpc auth level connect:lsarpc = yes
2059 dcesrv:max auth states = 8
2060 ";
2061 my $extra_provision_options = ["--dns-backend=BIND9_DLZ"];
2062 my $ret = $self->provision($prefix,
2063 "domain controller",
2064 "chgdcpass",
2065 "CHDCDOMAIN",
2066 "chgdcpassword.samba.example.com",
2067 "2008",
2068 "chgDCpass1",
2069 undef,
2070 undef,
2071 undef,
2072 $extra_smb_conf,
2073 "",
2074 $extra_provision_options);
2075 unless (defined $ret) {
2076 return undef;
2077 }
2078
2079 unless($self->add_wins_config("$prefix/private")) {
2080 warn("Unable to add wins configuration");
2081 return undef;
2082 }
2083
2084 # Remove secrets.tdb from this environment to test that we
2085 # still start up on systems without the new matching
2086 # secrets.tdb records.
2087 unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
2088 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
2089 return undef;
2090 }
2091
2092 $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
2093
2094 return $ret;
2095 }
2096
2097 sub teardown_env_terminate($$)
2098 {
2099 my ($self, $envvars) = @_;
2100 my $pid;
2101
2102 # This should cause samba to terminate gracefully
2103 my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
2104 my $cmd = "";
2105 $cmd .= "$smbcontrol samba shutdown $envvars->{CONFIGURATION}";
2106 my $ret = system($cmd);
2107 if ($ret != 0) {
2108 warn "'$cmd' failed with '$ret'\n";
2109 }
2110
2111 # This should cause samba to terminate gracefully
2112 close($envvars->{STDIN_PIPE});
2113
2114 $pid = $envvars->{SAMBA_PID};
2115 my $count = 0;
2116 my $childpid;
2117
2118 # This should give it time to write out the gcov data
2119 until ($count > 15) {
2120 if (Samba::cleanup_child($pid, "samba") != 0) {
2121 return;
2122 }
2123 sleep(1);
2124 $count++;
2125 }
2126
2127 # After 15 Seconds, work out why this thing is still alive
2128 warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
2129 system("$self->{srcdir}/selftest/gdb_backtrace $pid");
2130
2131 until ($count > 30) {
2132 if (Samba::cleanup_child($pid, "samba") != 0) {
2133 return;
2134 }
2135 sleep(1);
2136 $count++;
2137 }
2138
2139 if (kill(0, $pid)) {
2140 warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
2141 kill "TERM", $pid;
2142 }
2143
2144 until ($count > 40) {
2145 if (Samba::cleanup_child($pid, "samba") != 0) {
2146 return;
2147 }
2148 sleep(1);
2149 $count++;
2150 }
2151 # If it is still around, kill it
2152 if (kill(0, $pid)) {
2153 warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
2154 kill 9, $pid;
2155 }
2156 return;
2157 }
2158
2159 sub teardown_env($$)
2160 {
2161 my ($self, $envvars) = @_;
2162 teardown_env_terminate($self, $envvars);
2163
2164 print $self->getlog_env($envvars);
2165
2166 return;
2167 }
2168
2169 sub getlog_env($$)
2170 {
2171 my ($self, $envvars) = @_;
2172 my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
2173 my $out = $title;
2174
2175 open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
2176
2177 seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
2178 while (<LOG>) {
2179 $out .= $_;
2180 }
2181 $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
2182 close(LOG);
2183
2184 return "" if $out eq $title;
2185
2186 return $out;
2187 }
2188
2189 sub check_env($$)
2190 {
2191 my ($self, $envvars) = @_;
2192 my $samba_pid = $envvars->{SAMBA_PID};
2193
2194 if (not defined($samba_pid)) {
2195 return 0;
2196 } elsif ($samba_pid > 0) {
2197 my $childpid = Samba::cleanup_child($samba_pid, "samba");
2198
2199 if ($childpid == 0) {
2200 return 1;
2201 }
2202 return 0;
2203 } else {
2204 return 1;
2205 }
2206 }
2207
2208 # Declare the environments Samba4 makes available.
2209 # To be set up, they will be called as
2210 # samba4->setup_$envname($self, $path, $dep_1_vars, $dep_2_vars, ...)
2211 # The interdependencies between the testenvs are declared below. Some testenvs
2212 # are dependent on another testenv running first, e.g. vampire_dc is dependent
2213 # on ad_dc_ntvfs because vampire_dc joins ad_dc_ntvfs's domain. All DCs are
2214 # dependent on dns_hub, which handles resolving DNS queries for the realm.
2215 %Samba4::ENV_DEPS = (
2216 # name => [dep_1, dep_2, ...],
2217 dns_hub => [],
2218 ad_dc_ntvfs => ["dns_hub"],
2219 ad_dc_fips => ["dns_hub"],
2220 ad_dc => ["dns_hub"],
2221 ad_dc_smb1 => ["dns_hub"],
2222 ad_dc_smb1_done => ["ad_dc_smb1"],
2223 ad_dc_no_nss => ["dns_hub"],
2224 ad_dc_no_ntlm => ["dns_hub"],
2225
2226 fl2008r2dc => ["ad_dc"],
2227 fl2003dc => ["ad_dc"],
2228 fl2000dc => ["ad_dc"],
2229
2230 vampire_2000_dc => ["fl2000dc"],
2231 vampire_dc => ["ad_dc_ntvfs"],
2232 promoted_dc => ["ad_dc_ntvfs"],
2233
2234 rodc => ["ad_dc_ntvfs"],
2235 rpc_proxy => ["ad_dc_ntvfs"],
2236 chgdcpass => ["dns_hub"],
2237
2238 s4member_dflt_domain => ["ad_dc_ntvfs"],
2239 s4member => ["ad_dc_ntvfs"],
2240
2241 # envs that test the server process model
2242 proclimitdc => ["dns_hub"],
2243 preforkrestartdc => ["dns_hub"],
2244
2245 # backup/restore testenvs
2246 backupfromdc => ["dns_hub"],
2247 customdc => ["dns_hub"],
2248 restoredc => ["backupfromdc"],
2249 renamedc => ["backupfromdc"],
2250 offlinebackupdc => ["backupfromdc"],
2251 labdc => ["backupfromdc"],
2252
2253 # aliases in order to split autbuild tasks
2254 fl2008dc => ["ad_dc"],
2255 ad_dc_default => ["ad_dc"],
2256 ad_dc_default_smb1 => ["ad_dc_smb1"],
2257 ad_dc_default_smb1_done => ["ad_dc_default_smb1"],
2258 ad_dc_slowtests => ["ad_dc"],
2259 ad_dc_backup => ["ad_dc"],
2260
2261 schema_dc => ["dns_hub"],
2262 schema_pair_dc => ["schema_dc"],
2263
2264 none => [],
2265 );
2266
2267 %Samba4::ENV_DEPS_POST = (
2268 schema_dc => ["schema_pair_dc"],
2269 );
2270
2271 sub return_alias_env
2272 {
2273 my ($self, $path, $env) = @_;
2274
2275 # just an alias
2276 return $env;
2277 }
2278
2279 sub setup_fl2008dc
2280 {
2281 my ($self, $path) = @_;
2282
2283 my $extra_args = ["--base-schema=2008_R2"];
2284 my $env = $self->provision_ad_dc_ntvfs($path, $extra_args);
2285 if (defined $env) {
2286 if (not defined($self->check_or_start($env, "standard"))) {
2287 warn("Failed to start fl2008dc");
2288 return undef;
2289 }
2290 }
2291 return $env;
2292 }
2293
2294 sub setup_ad_dc_default
2295 {
2296 my ($self, $path, $dep_env) = @_;
2297 return $self->return_alias_env($path, $dep_env)
2298 }
2299
2300 sub setup_ad_dc_default_smb1
2301 {
2302 my ($self, $path, $dep_env) = @_;
2303 return $self->return_alias_env($path, $dep_env)
2304 }
2305
2306 sub setup_ad_dc_default_smb1_done
2307 {
2308 my ($self, $path, $dep_env) = @_;
2309 return $self->return_alias_env($path, $dep_env)
2310 }
2311
2312 sub setup_ad_dc_slowtests
2313 {
2314 my ($self, $path, $dep_env) = @_;
2315 return $self->return_alias_env($path, $dep_env)
2316 }
2317
2318 sub setup_ad_dc_backup
2319 {
2320 my ($self, $path, $dep_env) = @_;
2321 return $self->return_alias_env($path, $dep_env)
2322 }
2323
2324 sub setup_s4member
2325 {
2326 my ($self, $path, $dc_vars) = @_;
2327
2328 my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2329
2330 if (defined $env) {
2331 if (not defined($self->check_or_start($env, "standard"))) {
2332 return undef;
2333 }
2334 }
2335
2336 return $env;
2337 }
2338
2339 sub setup_s4member_dflt_domain
2340 {
2341 my ($self, $path, $dc_vars) = @_;
2342
2343 my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2344 "winbind use default domain = yes");
2345
2346 if (defined $env) {
2347 if (not defined($self->check_or_start($env, "standard"))) {
2348 return undef;
2349 }
2350 }
2351
2352 return $env;
2353 }
2354
2355 sub setup_rpc_proxy
2356 {
2357 my ($self, $path, $dc_vars) = @_;
2358
2359 my $env = $self->provision_rpc_proxy($path, $dc_vars);
2360
2361 if (defined $env) {
2362 if (not defined($self->check_or_start($env, "standard"))) {
2363 return undef;
2364 }
2365 }
2366 return $env;
2367 }
2368
2369 sub setup_ad_dc_ntvfs
2370 {
2371 my ($self, $path) = @_;
2372
2373 my $env = $self->provision_ad_dc_ntvfs($path, undef);
2374 if (defined $env) {
2375 if (not defined($self->check_or_start($env, "standard"))) {
2376 warn("Failed to start ad_dc_ntvfs");
2377 return undef;
2378 }
2379 }
2380 return $env;
2381 }
2382
2383 sub setup_chgdcpass
2384 {
2385 my ($self, $path) = @_;
2386
2387 my $env = $self->provision_chgdcpass($path);
2388 if (defined $env) {
2389 if (not defined($self->check_or_start($env, "standard"))) {
2390 return undef;
2391 }
2392 }
2393 return $env;
2394 }
2395
2396 sub setup_fl2000dc
2397 {
2398 my ($self, $path, $dc_vars) = @_;
2399
2400 my $env = $self->provision_fl2000dc($path);
2401 if (defined $env) {
2402 if (not defined($self->check_or_start($env, "standard"))) {
2403 return undef;
2404 }
2405
2406 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys --direction=outgoing");
2407 }
2408
2409 return $env;
2410 }
2411
2412 sub setup_fl2003dc
2413 {
2414 my ($self, $path, $dc_vars) = @_;
2415
2416 my $env = $self->provision_fl2003dc($path);
2417
2418 if (defined $env) {
2419 if (not defined($self->check_or_start($env, "standard"))) {
2420 return undef;
2421 }
2422
2423 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2424 }
2425 return $env;
2426 }
2427
2428 sub setup_fl2008r2dc
2429 {
2430 my ($self, $path, $dc_vars) = @_;
2431
2432 my $env = $self->provision_fl2008r2dc($path);
2433
2434 if (defined $env) {
2435 if (not defined($self->check_or_start($env, "standard"))) {
2436 return undef;
2437 }
2438
2439 my $upn_array = ["$env->{REALM}.upn"];
2440 my $spn_array = ["$env->{REALM}.spn"];
2441
2442 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2443 return undef;
2444 }
2445
2446 $env = $self->setup_trust($env, $dc_vars, "forest", "");
2447 }
2448
2449 return $env;
2450 }
2451
2452 sub setup_vampire_dc
2453 {
2454 return setup_generic_vampire_dc(@_, "2008");
2455 }
2456
2457 sub setup_vampire_2000_dc
2458 {
2459 return setup_generic_vampire_dc(@_, "2000");
2460 }
2461
2462 sub setup_generic_vampire_dc
2463 {
2464 my ($self, $path, $dc_vars, $fl) = @_;
2465
2466 my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2467
2468 if (defined $env) {
2469 if (not defined($self->check_or_start($env, "single"))) {
2470 return undef;
2471 }
2472
2473 # force replicated DC to update repsTo/repsFrom
2474 # for vampired partitions
2475 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2476
2477 # as 'vampired' dc may add data in its local replica
2478 # we need to synchronize data between DCs
2479 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2480 my $cmd = $self->get_cmd_env_vars($env);
2481 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2482 $cmd .= " $dc_vars->{CONFIGURATION}";
2483 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2484 # replicate Configuration NC
2485 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2486 unless(system($cmd_repl) == 0) {
2487 warn("Failed to replicate\n$cmd_repl");
2488 return undef;
2489 }
2490 # replicate Default NC
2491 $cmd_repl = "$cmd \"$base_dn\"";
2492 unless(system($cmd_repl) == 0) {
2493 warn("Failed to replicate\n$cmd_repl");
2494 return undef;
2495 }
2496
2497 # Pull in a full set of changes from the main DC
2498 $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2499 $cmd = $self->get_cmd_env_vars($env);
2500 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2501 $cmd .= " $dc_vars->{CONFIGURATION}";
2502 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2503 # replicate Configuration NC
2504 $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2505 unless(system($cmd_repl) == 0) {
2506 warn("Failed to replicate\n$cmd_repl");
2507 return undef;
2508 }
2509 # replicate Default NC
2510 $cmd_repl = "$cmd \"$base_dn\"";
2511 unless(system($cmd_repl) == 0) {
2512 warn("Failed to replicate\n$cmd_repl");
2513 return undef;
2514 }
2515 }
2516
2517 return $env;
2518 }
2519
2520 sub setup_promoted_dc
2521 {
2522 my ($self, $path, $dc_vars) = @_;
2523
2524 my $env = $self->provision_promoted_dc($path, $dc_vars);
2525
2526 if (defined $env) {
2527 if (not defined($self->check_or_start($env, "single"))) {
2528 return undef;
2529 }
2530
2531 # force source and replicated DC to update repsTo/repsFrom
2532 # for vampired partitions
2533 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2534 my $cmd = $self->get_cmd_env_vars($env);
2535 # as 'vampired' dc may add data in its local replica
2536 # we need to synchronize data between DCs
2537 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2538 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2539 $cmd .= " $dc_vars->{CONFIGURATION}";
2540 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2541 # replicate Configuration NC
2542 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2543 unless(system($cmd_repl) == 0) {
2544 warn("Failed to replicate\n$cmd_repl");
2545 return undef;
2546 }
2547 # replicate Default NC
2548 $cmd_repl = "$cmd \"$base_dn\"";
2549 unless(system($cmd_repl) == 0) {
2550 warn("Failed to replicate\n$cmd_repl");
2551 return undef;
2552 }
2553 }
2554
2555 return $env;
2556 }
2557
2558 sub setup_rodc
2559 {
2560 my ($self, $path, $dc_vars) = @_;
2561
2562 my $env = $self->provision_rodc($path, $dc_vars);
2563
2564 unless ($env) {
2565 return undef;
2566 }
2567
2568 if (not defined($self->check_or_start($env, "standard"))) {
2569 return undef;
2570 }
2571
2572 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2573 my $cmd = $self->get_cmd_env_vars($env);
2574
2575 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2576 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2577 $cmd .= " $dc_vars->{CONFIGURATION}";
2578 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2579 # replicate Configuration NC
2580 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2581 unless(system($cmd_repl) == 0) {
2582 warn("Failed to replicate\n$cmd_repl");
2583 return undef;
2584 }
2585 # replicate Default NC
2586 $cmd_repl = "$cmd \"$base_dn\"";
2587 unless(system($cmd_repl) == 0) {
2588 warn("Failed to replicate\n$cmd_repl");
2589 return undef;
2590 }
2591
2592 return $env;
2593 }
2594
2595 sub _setup_ad_dc
2596 {
2597 my ($self, $path, $conf_opts, $server, $dom) = @_;
2598
2599 # If we didn't build with ADS, pretend this env was never available
2600 if (not $self->{target3}->have_ads()) {
2601 return "UNKNOWN";
2602 }
2603
2604 if (!defined($conf_opts)) {
2605 $conf_opts = "";
2606 }
2607 if (!defined($server)) {
2608 $server = "addc";
2609 }
2610 if (!defined($dom)) {
2611 $dom = "addom.samba.example.com";
2612 }
2613 my $env = $self->provision_ad_dc($path, $server, "ADDOMAIN",
2614 $dom,
2615 undef,
2616 $conf_opts,
2617 undef);
2618 unless ($env) {
2619 return undef;
2620 }
2621
2622 if (not defined($self->check_or_start($env, "prefork"))) {
2623 return undef;
2624 }
2625
2626 my $upn_array = ["$env->{REALM}.upn"];
2627 my $spn_array = ["$env->{REALM}.spn"];
2628
2629 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2630 return undef;
2631 }
2632
2633 return $env;
2634 }
2635
2636 sub setup_ad_dc
2637 {
2638 my ($self, $path) = @_;
2639 return _setup_ad_dc($self, $path, undef, undef, undef);
2640 }
2641
2642 sub setup_ad_dc_smb1
2643 {
2644 my ($self, $path) = @_;
2645 my $conf_opts = "
2646 [global]
2647 client min protocol = CORE
2648 server min protocol = LANMAN1
2649 ";
2650 return _setup_ad_dc($self, $path, $conf_opts, "addcsmb1", "addom2.samba.example.com");
2651 }
2652
2653 sub setup_ad_dc_smb1_done
2654 {
2655 my ($self, $path, $dep_env) = @_;
2656 return $self->return_alias_env($path, $dep_env);
2657 }
2658
2659 sub setup_ad_dc_no_nss
2660 {
2661 my ($self, $path) = @_;
2662
2663 # If we didn't build with ADS, pretend this env was never available
2664 if (not $self->{target3}->have_ads()) {
2665 return "UNKNOWN";
2666 }
2667
2668 my $env = $self->provision_ad_dc($path,
2669 "addc_no_nss",
2670 "ADNONSSDOMAIN",
2671 "adnonssdom.samba.example.com",
2672 undef,
2673 "",
2674 undef);
2675 unless ($env) {
2676 return undef;
2677 }
2678
2679 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2680 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2681
2682 if (not defined($self->check_or_start($env, "single"))) {
2683 return undef;
2684 }
2685
2686 my $upn_array = ["$env->{REALM}.upn"];
2687 my $spn_array = ["$env->{REALM}.spn"];
2688
2689 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2690 return undef;
2691 }
2692
2693 return $env;
2694 }
2695
2696 sub setup_ad_dc_no_ntlm
2697 {
2698 my ($self, $path) = @_;
2699
2700 # If we didn't build with ADS, pretend this env was never available
2701 if (not $self->{target3}->have_ads()) {
2702 return "UNKNOWN";
2703 }
2704
2705 my $env = $self->provision_ad_dc($path,
2706 "addc_no_ntlm",
2707 "ADNONTLMDOMAIN",
2708 "adnontlmdom.samba.example.com",
2709 undef,
2710 "ntlm auth = disabled",
2711 undef);
2712 unless ($env) {
2713 return undef;
2714 }
2715
2716 if (not defined($self->check_or_start($env, "prefork"))) {
2717 return undef;
2718 }
2719
2720 my $upn_array = ["$env->{REALM}.upn"];
2721 my $spn_array = ["$env->{REALM}.spn"];
2722
2723 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2724 return undef;
2725 }
2726
2727 return $env;
2728 }
2729
2730 sub setup_ad_dc_fips
2731 {
2732 my ($self, $path) = @_;
2733
2734 # If we didn't build with ADS, pretend this env was never available
2735 if (not $self->{target3}->have_ads()) {
2736 return "UNKNOWN";
2737 }
2738
2739 my $env = $self->provision_ad_dc($path,
2740 "fipsdc",
2741 "FIPSDOMAIN",
2742 "fips.samba.example.com",
2743 1,
2744 "",
2745 undef);
2746 unless ($env) {
2747 return undef;
2748 }
2749
2750 if (not defined($self->check_or_start($env, "prefork"))) {
2751 return undef;
2752 }
2753
2754 my $upn_array = ["$env->{REALM}.upn"];
2755 my $spn_array = ["$env->{REALM}.spn"];
2756
2757 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2758 return undef;
2759 }
2760
2761 return $env;
2762 }
2763
2764 #
2765 # AD DC test environment used solely to test pre-fork process restarts.
2766 # As processes get killed off and restarted it should not be used for other
2767 sub setup_preforkrestartdc
2768 {
2769 my ($self, $path) = @_;
2770
2771 # If we didn't build with ADS, pretend this env was never available
2772 if (not $self->{target3}->have_ads()) {
2773 return "UNKNOWN";
2774 }
2775
2776 # note DC name must be <= 15 chars so we use 'prockill' instead of
2777 # 'preforkrestart'
2778 my $env = $self->provision_ad_dc($path,
2779 "prockilldc",
2780 "PROCKILLDOMAIN",
2781 "prockilldom.samba.example.com",
2782 undef,
2783 "prefork backoff increment = 5\nprefork maximum backoff=10",
2784 undef);
2785 unless ($env) {
2786 return undef;
2787 }
2788
2789 # We treat processes in this environment cruelly, sometimes
2790 # sending them SIGSEGV signals. We don't need gdb_backtrace
2791 # dissecting these fake crashes in precise detail.
2792 $env->{PLEASE_NO_GDB_BACKTRACE} = '1';
2793
2794 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2795 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2796
2797 if (not defined($self->check_or_start($env, "prefork"))) {
2798 return undef;
2799 }
2800
2801 my $upn_array = ["$env->{REALM}.upn"];
2802 my $spn_array = ["$env->{REALM}.spn"];
2803
2804 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2805 return undef;
2806 }
2807
2808 return $env;
2809 }
2810
2811 #
2812 # ad_dc test environment used solely to test standard process model connection
2813 # process limits. As the limit is set artificially low it should not be used
2814 # for other tests.
2815 sub setup_proclimitdc
2816 {
2817 my ($self, $path) = @_;
2818
2819 # If we didn't build with ADS, pretend this env was never available
2820 if (not $self->{target3}->have_ads()) {
2821 return "UNKNOWN";
2822 }
2823
2824 my $env = $self->provision_ad_dc($path,
2825 "proclimitdc",
2826 "PROCLIMITDOM",
2827 "proclimit.samba.example.com",
2828 undef,
2829 "max smbd processes = 20",
2830 undef);
2831 unless ($env) {
2832 return undef;
2833 }
2834
2835 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2836 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2837
2838 if (not defined($self->check_or_start($env, "standard"))) {
2839 return undef;
2840 }
2841
2842 my $upn_array = ["$env->{REALM}.upn"];
2843 my $spn_array = ["$env->{REALM}.spn"];
2844
2845 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2846 return undef;
2847 }
2848
2849 return $env;
2850 }
2851
2852 # Used to test a live upgrade of the schema on a 2 DC network.
2853 sub setup_schema_dc
2854 {
2855 my ($self, $path) = @_;
2856
2857 # provision the PDC using an older base schema
2858 my $provision_args = ["--base-schema=2008_R2", "--backend-store=mdb"];
2859
2860 my $env = $self->provision_ad_dc($path,
2861 "liveupgrade1dc",
2862 "SCHEMADOMAIN",
2863 "schema.samba.example.com",
2864 undef,
2865 "drs: max link sync = 2",
2866 $provision_args);
2867 unless ($env) {
2868 return undef;
2869 }
2870
2871 if (not defined($self->check_or_start($env, "prefork"))) {
2872 return undef;
2873 }
2874
2875 my $upn_array = ["$env->{REALM}.upn"];
2876 my $spn_array = ["$env->{REALM}.spn"];
2877
2878 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2879 return undef;
2880 }
2881
2882 return $env;
2883 }
2884
2885 # the second DC in the live schema upgrade pair
2886 sub setup_schema_pair_dc
2887 {
2888 # note: dcvars contains the env info for the dependent testenv ('schema_dc')
2889 my ($self, $prefix, $dcvars) = @_;
2890 print "Preparing SCHEMA UPGRADE PAIR DC...\n";
2891
2892 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "liveupgrade2dc",
2893 $dcvars->{DOMAIN},
2894 $dcvars->{REALM},
2895 $dcvars->{PASSWORD},
2896 "");
2897
2898 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2899 my $cmd_vars = $self->get_cmd_env_vars($env);
2900
2901 my $join_cmd = $cmd_vars;
2902 $join_cmd .= "$samba_tool domain join $env->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
2903 $join_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} ";
2904 $join_cmd .= " --backend-store=mdb";
2905
2906 my $upgrade_cmd = $cmd_vars;
2907 $upgrade_cmd .= "$samba_tool domain schemaupgrade $dcvars->{CONFIGURATION}";
2908 $upgrade_cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
2909
2910 my $repl_cmd = $cmd_vars;
2911 $repl_cmd .= "$samba_tool drs replicate $env->{SERVER} $dcvars->{SERVER}";
2912 $repl_cmd .= " CN=Schema,CN=Configuration,DC=schema,DC=samba,DC=example,DC=com";
2913 $repl_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
2914
2915 unless (system($join_cmd) == 0) {
2916 warn("Join failed\n$join_cmd");
2917 return undef;
2918 }
2919
2920 $env->{DC_SERVER} = $dcvars->{SERVER};
2921 $env->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
2922 $env->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
2923 $env->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
2924
2925 # start samba for the new DC
2926 if (not defined($self->check_or_start($env, "standard"))) {
2927 return undef;
2928 }
2929
2930 unless (system($upgrade_cmd) == 0) {
2931 warn("Schema upgrade failed\n$upgrade_cmd");
2932 return undef;
2933 }
2934
2935 unless (system($repl_cmd) == 0) {
2936 warn("Post-update schema replication failed\n$repl_cmd");
2937 return undef;
2938 }
2939
2940 return $env;
2941 }
2942
2943 # Sets up a DC that's solely used to do a domain backup from. We then use the
2944 # backupfrom-DC to create the restore-DC - this proves that the backup/restore
2945 # process will create a Samba DC that will actually start up.
2946 # We don't use the backup-DC for anything else because its domain will conflict
2947 # with the restore DC.
2948 sub setup_backupfromdc
2949 {
2950 my ($self, $path) = @_;
2951
2952 # If we didn't build with ADS, pretend this env was never available
2953 if (not $self->{target3}->have_ads()) {
2954 return "UNKNOWN";
2955 }
2956
2957 my $provision_args = ["--site=Backup-Site"];
2958
2959 my $env = $self->provision_ad_dc($path,
2960 "backupfromdc",
2961 "BACKUPDOMAIN",
2962 "backupdom.samba.example.com",
2963 undef,
2964 "samba kcc command = /bin/true",
2965 $provision_args);
2966 unless ($env) {
2967 return undef;
2968 }
2969
2970 if (not defined($self->check_or_start($env))) {
2971 return undef;
2972 }
2973
2974 my $upn_array = ["$env->{REALM}.upn"];
2975 my $spn_array = ["$env->{REALM}.spn"];
2976
2977 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2978 return undef;
2979 }
2980
2981 # Set up a dangling forward link to an expunged object
2982 #
2983 # We need this to ensure that the "samba-tool domain backup rename"
2984 # that is part of the creation of the labdc environment can
2985 # cope with this situation on the source DC.
2986
2987 if (not $self->write_ldb_file("$env->{PRIVATEDIR}/sam.ldb", "
2988 dn: ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2989 objectclass: organizationalUnit
2990 -
2991
2992 dn: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2993 objectclass: msExchConfigurationContainer
2994 -
2995
2996 dn: cn=linkfrom,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2997 objectclass: msExchConfigurationContainer
2998 addressBookRoots: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2999 -
3000
3001 ")) {
3002 return undef;
3003 }
3004 my $ldbdel = Samba::bindir_path($self, "ldbdel");
3005 my $cmd = "$ldbdel -H $env->{PRIVATEDIR}/sam.ldb cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com";
3006
3007 unless(system($cmd) == 0) {
3008 warn("Failed to delete link target: \n$cmd");
3009 return undef;
3010 }
3011
3012 # Expunge will ensure that linkto is totally wiped from the DB
3013 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3014 $cmd = "$samba_tool domain tombstones expunge --tombstone-lifetime=0 $env->{CONFIGURATION}";
3015
3016 unless(system($cmd) == 0) {
3017 warn("Failed to expunge link target: \n$cmd");
3018 return undef;
3019 }
3020 return $env;
3021 }
3022
3023 # returns the server/user-auth params needed to run an online backup cmd
3024 sub get_backup_server_args
3025 {
3026 # dcvars contains the env info for the backup DC testenv
3027 my ($self, $dcvars) = @_;
3028 my $server = $dcvars->{DC_SERVER_IP};
3029 my $server_args = "--server=$server ";
3030 $server_args .= "-U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
3031 $server_args .= " $dcvars->{CONFIGURATION}";
3032
3033 return $server_args;
3034 }
3035
3036 # Creates a backup of a running testenv DC
3037 sub create_backup
3038 {
3039 # note: dcvars contains the env info for the backup DC testenv
3040 my ($self, $env, $dcvars, $backupdir, $backup_cmd) = @_;
3041
3042 # get all the env variables we pass in with the samba-tool command
3043 # Note: use the backupfrom-DC's krb5.conf to do the backup
3044 my $overwrite = undef;
3045 $overwrite->{KRB5_CONFIG} = $dcvars->{KRB5_CONFIG};
3046 my $cmd_env = $self->get_cmd_env_vars($env, $overwrite);
3047
3048 # use samba-tool to create a backup from the 'backupfromdc' DC
3049 my $cmd = "";
3050 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3051
3052 $cmd .= "$cmd_env $samba_tool domain backup $backup_cmd";
3053 $cmd .= " --targetdir=$backupdir";
3054
3055 print "Executing: $cmd\n";
3056 unless(system($cmd) == 0) {
3057 warn("Failed to create backup using: \n$cmd");
3058 return undef;
3059 }
3060
3061 # get the name of the backup file created
3062 opendir(DIR, $backupdir);
3063 my @files = grep(/\.tar/, readdir(DIR));
3064 closedir(DIR);
3065
3066 if(scalar @files != 1) {
3067 warn("Backup file not found in directory $backupdir\n");
3068 return undef;
3069 }
3070 my $backup_file = "$backupdir/$files[0]";
3071 print "Using backup file $backup_file...\n";
3072
3073 return $backup_file;
3074 }
3075
3076 # Restores a backup-file to populate a testenv for a new DC
3077 sub restore_backup_file
3078 {
3079 my ($self, $backup_file, $restore_opts, $restoredir, $smbconf) = @_;
3080
3081 # pass the restore command the testenv's smb.conf that we've already
3082 # generated. But move it to a temp-dir first, so that the restore doesn't
3083 # overwrite it
3084 my $tmpdir = File::Temp->newdir();
3085 my $tmpconf = "$tmpdir/smb.conf";
3086 my $cmd = "cp $smbconf $tmpconf";
3087 unless(system($cmd) == 0) {
3088 warn("Failed to backup smb.conf using: \n$cmd");
3089 return -1;
3090 }
3091
3092 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3093 $cmd = "$samba_tool domain backup restore --backup-file=$backup_file";
3094 $cmd .= " --targetdir=$restoredir $restore_opts --configfile=$tmpconf";
3095
3096 print "Executing: $cmd\n";
3097 unless(system($cmd) == 0) {
3098 warn("Failed to restore backup using: \n$cmd");
3099 return -1;
3100 }
3101
3102 print "Restore complete\n";
3103 return 0
3104 }
3105
3106 # sets up the initial directory and returns the new testenv's env info
3107 # (without actually doing a 'domain join')
3108 sub prepare_dc_testenv
3109 {
3110 my ($self, $prefix, $dcname, $domain, $realm,
3111 $password, $conf_options, $dnsupdate_options) = @_;
3112
3113 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
3114 $dcname,
3115 $domain,
3116 $realm,
3117 undef,
3118 "2008",
3119 $password,
3120 undef,
3121 undef);
3122
3123 # the restore uses a slightly different state-dir location to other testenvs
3124 $ctx->{statedir} = "$ctx->{prefix_abs}/state";
3125 push(@{$ctx->{directories}}, "$ctx->{statedir}");
3126
3127 # add support for sysvol/netlogon/tmp shares
3128 $ctx->{share} = "$ctx->{prefix_abs}/share";
3129 push(@{$ctx->{directories}}, "$ctx->{share}");
3130 push(@{$ctx->{directories}}, "$ctx->{share}/test1");
3131
3132 if (defined($dnsupdate_options)) {
3133 $ctx->{samba_dnsupdate} .= $dnsupdate_options;
3134 }
3135
3136 $ctx->{smb_conf_extra_options} = "
3137 $conf_options
3138 max xmit = 32K
3139 server max protocol = SMB2
3140 samba kcc command = /bin/true
3141 xattr_tdb:file = $ctx->{statedir}/xattr.tdb
3142
3143 [sysvol]
3144 path = $ctx->{statedir}/sysvol
3145 read only = no
3146
3147 [netlogon]
3148 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
3149 read only = no
3150
3151 [tmp]
3152 path = $ctx->{share}
3153 read only = no
3154 posix:sharedelay = 10000
3155 posix:oplocktimeout = 3
3156 posix:writetimeupdatedelay = 50000
3157
3158 [test1]
3159 path = $ctx->{share}/test1
3160 read only = no
3161 posix:sharedelay = 100000
3162 posix:oplocktimeout = 3
3163 posix:writetimeupdatedelay = 500000
3164 ";
3165
3166 my $env = $self->provision_raw_step1($ctx);
3167
3168 return ($env, $ctx);
3169 }
3170
3171
3172 # Set up a DC testenv solely by using the samba-tool domain backup/restore
3173 # commands. This proves that we can backup an online DC ('backupfromdc') and
3174 # use the backup file to create a valid, working samba DC.
3175 sub setup_restoredc
3176 {
3177 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3178 my ($self, $prefix, $dcvars) = @_;
3179 print "Preparing RESTORE DC...\n";
3180
3181 # we arbitrarily designate the restored DC as having SMBv1 disabled
3182 my $extra_conf = "
3183 server min protocol = SMB2
3184 client min protocol = SMB2
3185 prefork children = 1";
3186 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3187
3188 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "restoredc",
3189 $dcvars->{DOMAIN},
3190 $dcvars->{REALM},
3191 $dcvars->{PASSWORD},
3192 $extra_conf,
3193 $dnsupdate_options);
3194
3195 # create a backup of the 'backupfromdc'
3196 my $backupdir = File::Temp->newdir();
3197 my $server_args = $self->get_backup_server_args($dcvars);
3198 my $backup_args = "online $server_args";
3199 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3200 $backup_args);
3201 unless($backup_file) {
3202 return undef;
3203 }
3204
3205 # restore the backup file to populate the restore-DC testenv
3206 my $restore_dir = abs_path($prefix);
3207 my $ret = $self->restore_backup_file($backup_file,
3208 "--newservername=$env->{SERVER}",
3209 $restore_dir, $env->{SERVERCONFFILE});
3210 unless ($ret == 0) {
3211 return undef;
3212 }
3213
3214 #
3215 # As we create a the same domain as a clone
3216 # we need a separate resolv.conf!
3217 #
3218 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3219 $ctx->{dns_ipv4} = $ctx->{ipv4};
3220 $ctx->{dns_ipv6} = $ctx->{ipv6};
3221 Samba::mk_resolv_conf($ctx);
3222 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3223
3224 # start samba for the restored DC
3225 if (not defined($self->check_or_start($env))) {
3226 return undef;
3227 }
3228
3229 return $env;
3230 }
3231
3232 # Set up a DC testenv solely by using the 'samba-tool domain backup rename' and
3233 # restore commands. This proves that we can backup and rename an online DC
3234 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3235 sub setup_renamedc
3236 {
3237 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3238 my ($self, $prefix, $dcvars) = @_;
3239 print "Preparing RENAME DC...\n";
3240 my $extra_conf = "prefork children = 1";
3241
3242 my $realm = "renamedom.samba.example.com";
3243 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "renamedc",
3244 "RENAMEDOMAIN", $realm,
3245 $dcvars->{PASSWORD}, $extra_conf);
3246
3247 # create a backup of the 'backupfromdc' which renames the domain
3248 my $backupdir = File::Temp->newdir();
3249 my $server_args = $self->get_backup_server_args($dcvars);
3250 my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3251 $backup_args .= " --backend-store=tdb";
3252 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3253 $backup_args);
3254 unless($backup_file) {
3255 return undef;
3256 }
3257
3258 # restore the backup file to populate the rename-DC testenv
3259 my $restore_dir = abs_path($prefix);
3260 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3261 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3262 $restore_dir, $env->{SERVERCONFFILE});
3263 unless ($ret == 0) {
3264 return undef;
3265 }
3266
3267 # start samba for the restored DC
3268 if (not defined($self->check_or_start($env))) {
3269 return undef;
3270 }
3271
3272 my $upn_array = ["$env->{REALM}.upn"];
3273 my $spn_array = ["$env->{REALM}.spn"];
3274
3275 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3276 return undef;
3277 }
3278
3279 return $env;
3280 }
3281
3282 # Set up a DC testenv solely by using the 'samba-tool domain backup offline' and
3283 # restore commands. This proves that we do an offline backup of a local DC
3284 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3285 sub setup_offlinebackupdc
3286 {
3287 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3288 my ($self, $prefix, $dcvars) = @_;
3289 print "Preparing OFFLINE BACKUP DC...\n";
3290 my $extra_conf = "prefork children = 1";
3291 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3292
3293 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "offlinebackupdc",
3294 $dcvars->{DOMAIN},
3295 $dcvars->{REALM},
3296 $dcvars->{PASSWORD},
3297 $extra_conf,
3298 $dnsupdate_options);
3299
3300 # create an offline backup of the 'backupfromdc' target
3301 my $backupdir = File::Temp->newdir();
3302 my $cmd = "offline --configfile $dcvars->{SERVERCONFFILE}";
3303 my $backup_file = $self->create_backup($env, $dcvars,
3304 $backupdir, $cmd);
3305
3306 unless($backup_file) {
3307 return undef;
3308 }
3309
3310 # restore the backup file to populate the rename-DC testenv
3311 my $restore_dir = abs_path($prefix);
3312 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3313 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3314 $restore_dir, $env->{SERVERCONFFILE});
3315 unless ($ret == 0) {
3316 return undef;
3317 }
3318
3319 #
3320 # As we create a the same domain as a clone
3321 # we need a separate resolv.conf!
3322 #
3323 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3324 $ctx->{dns_ipv4} = $ctx->{ipv4};
3325 $ctx->{dns_ipv6} = $ctx->{ipv6};
3326 Samba::mk_resolv_conf($ctx);
3327 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3328
3329 # re-create the testenv's krb5.conf (the restore may have overwritten it)
3330 Samba::mk_krb5_conf($ctx);
3331
3332 # start samba for the restored DC
3333 if (not defined($self->check_or_start($env))) {
3334 return undef;
3335 }
3336
3337 return $env;
3338 }
3339
3340 # Set up a DC testenv solely by using the samba-tool 'domain backup rename' and
3341 # restore commands, using the --no-secrets option. This proves that we can
3342 # create a realistic lab environment from an online DC ('backupfromdc').
3343 sub setup_labdc
3344 {
3345 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3346 my ($self, $prefix, $dcvars) = @_;
3347 print "Preparing LAB-DOMAIN DC...\n";
3348 my $extra_conf = "prefork children = 1";
3349
3350 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "labdc",
3351 "LABDOMAIN",
3352 "labdom.samba.example.com",
3353 $dcvars->{PASSWORD}, $extra_conf);
3354
3355 # create a backup of the 'backupfromdc' which renames the domain and uses
3356 # the --no-secrets option to scrub any sensitive info
3357 my $backupdir = File::Temp->newdir();
3358 my $server_args = $self->get_backup_server_args($dcvars);
3359 my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3360 $backup_args .= " --no-secrets --backend-store=mdb";
3361 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3362 $backup_args);
3363 unless($backup_file) {
3364 return undef;
3365 }
3366
3367 # restore the backup file to populate the lab-DC testenv
3368 my $restore_dir = abs_path($prefix);
3369 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3370 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3371 $restore_dir, $env->{SERVERCONFFILE});
3372 unless ($ret == 0) {
3373 return undef;
3374 }
3375
3376 # because we don't include any secrets in the backup, we need to reset the
3377 # admin user's password back to what the testenv expects
3378 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3379 my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3380 $cmd .= "--newpassword=$env->{PASSWORD} -H $restore_dir/private/sam.ldb";
3381 $cmd .= " $env->{CONFIGURATION}";
3382
3383 unless(system($cmd) == 0) {
3384 warn("Failed to reset admin's password: \n$cmd");
3385 return undef;
3386 }
3387
3388 # start samba for the restored DC
3389 if (not defined($self->check_or_start($env))) {
3390 return undef;
3391 }
3392
3393 my $upn_array = ["$env->{REALM}.upn"];
3394 my $spn_array = ["$env->{REALM}.spn"];
3395
3396 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3397 return undef;
3398 }
3399
3400 return $env;
3401 }
3402
3403 # Inspects a backup *.tar.bz2 file and determines the realm/domain it contains
3404 sub get_backup_domain_realm
3405 {
3406 my ($self, $backup_file) = @_;
3407
3408 print "Determining REALM/DOMAIN values in backup...\n";
3409
3410 # The backup will have the correct domain/realm values in the smb.conf.
3411 # So we can work out the env variables the testenv should use based on
3412 # that. Let's start by extracting the smb.conf
3413 my $tar = Archive::Tar->new($backup_file);
3414 my $tmpdir = File::Temp->newdir();
3415 my $smbconf = "$tmpdir/smb.conf";
3416
3417 # note that the filepaths within the tar-file differ slightly for online
3418 # and offline backups
3419 if ($tar->contains_file("etc/smb.conf")) {
3420 $tar->extract_file("etc/smb.conf", $smbconf);
3421 } elsif ($tar->contains_file("./etc/smb.conf")) {
3422 $tar->extract_file("./etc/smb.conf", $smbconf);
3423 } else {
3424 warn("Could not find smb.conf in $backup_file");
3425 return undef, undef;
3426 }
3427
3428 # make sure we don't try to create locks/sockets in the default install
3429 # location (i.e. /usr/local/samba/)
3430 my $options = "--option=\"private dir = $tmpdir\"";
3431 $options .= " --option=\"lock dir = $tmpdir\"";
3432
3433 # now use testparm to read the values we're interested in
3434 my $testparm = Samba::bindir_path($self, "testparm");
3435 my $domain = `$testparm $smbconf -sl --parameter-name=WORKGROUP $options`;
3436 my $realm = `$testparm $smbconf -sl --parameter-name=REALM $options`;
3437 chomp $realm;
3438 chomp $domain;
3439 print "Backup-file REALM is $realm, DOMAIN is $domain\n";
3440
3441 return ($domain, $realm);
3442 }
3443
3444 # This spins up a custom testenv that can be based on any backup-file you want.
3445 # This is just intended for manual testing (rather than automated test-cases)
3446 sub setup_customdc
3447 {
3448 my ($self, $prefix) = @_;
3449 print "Preparing CUSTOM RESTORE DC...\n";
3450 my $dc_name = "customdc";
3451 my $password = "locDCpass1";
3452 my $backup_file = $ENV{'BACKUP_FILE'};
3453 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3454
3455 # user must specify a backup file to restore via an ENV variable, i.e.
3456 # BACKUP_FILE=backup-blah.tar.bz2 SELFTEST_TESTENV=customdc make testenv
3457 if (not defined($backup_file)) {
3458 warn("Please specify BACKUP_FILE");
3459 return undef;
3460 }
3461
3462 # work out the correct domain/realm env values from the backup-file
3463 my ($domain, $realm) = $self->get_backup_domain_realm($backup_file);
3464 if ($domain eq '' or $realm eq '') {
3465 warn("Could not determine domain or realm");
3466 return undef;
3467 }
3468
3469 # create a placeholder directory and smb.conf, as well as the env vars.
3470 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, $dc_name,
3471 $domain, $realm, $password, "",
3472 $dnsupdate_options);
3473
3474 # restore the specified backup file to populate the testenv
3475 my $restore_dir = abs_path($prefix);
3476 my $ret = $self->restore_backup_file($backup_file,
3477 "--newservername=$env->{SERVER}",
3478 $restore_dir, $env->{SERVERCONFFILE});
3479 unless ($ret == 0) {
3480 return undef;
3481 }
3482
3483 #
3484 # As we create a the same domain as a clone
3485 # we need a separate resolv.conf!
3486 #
3487 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3488 $ctx->{dns_ipv4} = $ctx->{ipv4};
3489 $ctx->{dns_ipv6} = $ctx->{ipv6};
3490 Samba::mk_resolv_conf($ctx);
3491 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3492
3493 # Change the admin password to the testenv default, just in case it's
3494 # different, or in case this was a --no-secrets backup
3495 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3496 my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3497 $cmd .= "--newpassword=$password -H $restore_dir/private/sam.ldb";
3498 $cmd .= " $env->{CONFIGURATION}";
3499
3500 unless(system($cmd) == 0) {
3501 warn("Failed to reset admin's password: \n$cmd");
3502 return undef;
3503 }
3504
3505 # re-create the testenv's krb5.conf (the restore may have overwritten it,
3506 # if the backup-file was an offline backup)
3507 Samba::mk_krb5_conf($ctx);
3508
3509 # start samba for the restored DC
3510 if (not defined($self->check_or_start($env))) {
3511 return undef;
3512 }
3513
3514 # if this was a backup-rename, then we may need to setup namespaces
3515 my $upn_array = ["$env->{REALM}.upn"];
3516 my $spn_array = ["$env->{REALM}.spn"];
3517
3518 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3519 return undef;
3520 }
3521
3522 return $env;
3523 }
3524
3525 sub setup_none
3526 {
3527 my ($self, $path) = @_;
3528
3529 my $ret = {
3530 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
3531 SAMBA_PID => -1,
3532 }
3533 }
3534
3535 1;
Samba GIT mirror