?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:utils: Fix 'Usage:' for 'net ads enctypes'
[samba4-gss.git] / selftest / target / Samba4.pm
blob9da339f62397a606800e7fcfe4e6b49e1edd7a34
1 #!/usr/bin/perl
2 # Bootstrap Samba and run a number of tests against it.
3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
4 # Published under the GNU GPL, v3 or later.
5
6 # NOTE: Refer to the README for more details about the various testenvs,
7 # and tips about adding new testenvs.
8
9 package Samba4;
10
11 use strict;
12 use warnings;
13 use Cwd qw(abs_path);
14 use FindBin qw($RealBin);
15 use POSIX;
16 use SocketWrapper;
17 use target::Samba;
18 use target::Samba3;
19 use Archive::Tar;
20
21 sub new($$$$$) {
22 my ($classname, $SambaCtx, $bindir, $srcdir, $server_maxtime, $default_ldb_backend) = @_;
23
24 my $self = {
25 vars => {},
26 SambaCtx => $SambaCtx,
27 bindir => $bindir,
28 srcdir => $srcdir,
29 server_maxtime => $server_maxtime,
30 target3 => new Samba3($SambaCtx, $bindir, $srcdir, $server_maxtime),
31 default_ldb_backend => $default_ldb_backend,
32 };
33 bless $self;
34 return $self;
35 }
36
37 sub scriptdir_path($$) {
38 my ($self, $path) = @_;
39 return "$self->{srcdir}/source4/scripting/$path";
40 }
41
42 sub check_or_start($$$)
43 {
44 my ($self, $env_vars, $process_model) = @_;
45 my $STDIN_READER;
46
47 my $env_ok = $self->check_env($env_vars);
48 if ($env_ok) {
49 return $env_vars->{SAMBA_PID};
50 } elsif (defined($env_vars->{SAMBA_PID})) {
51 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
52 return undef;
53 }
54
55 # use a pipe for stdin in the child processes. This allows
56 # those processes to monitor the pipe for EOF to ensure they
57 # exit when the test script exits
58 pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
59
60 # build up the command to run samba
61 my @preargs = ();
62 my @optargs = ();
63 if (defined($ENV{SAMBA_OPTIONS})) {
64 @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
65 }
66 if(defined($ENV{SAMBA_VALGRIND})) {
67 @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
68 }
69
70 if (defined($process_model)) {
71 push @optargs, ("-M", $process_model);
72 }
73 my $binary = Samba::bindir_path($self, "samba");
74 my @full_cmd = (@preargs, $binary, "-i",
75 "--no-process-group", "--maximum-runtime=$self->{server_maxtime}",
76 $env_vars->{CONFIGURATION}, @optargs);
77
78 # the samba process takes some additional env variables (compared to s3)
79 my $samba_envs = Samba::get_env_for_process("samba", $env_vars);
80 if (defined($ENV{MITKRB5})) {
81 $samba_envs->{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
82 }
83
84 # fork a child process and exec() samba
85 my $daemon_ctx = {
86 NAME => "samba",
87 BINARY_PATH => $binary,
88 FULL_CMD => [ @full_cmd ],
89 LOG_FILE => $env_vars->{SAMBA_TEST_LOG},
90 TEE_STDOUT => 1,
91 PCAP_FILE => "env-$ENV{ENVNAME}-samba",
92 ENV_VARS => $samba_envs,
93 };
94 my $pid = Samba::fork_and_exec($self, $env_vars, $daemon_ctx, $STDIN_READER);
95
96 $env_vars->{SAMBA_PID} = $pid;
97
98 # close the parent's read-end of the pipe
99 close($STDIN_READER);
100
101 if ($self->wait_for_start($env_vars) != 0) {
102 warn("Samba $pid failed to start up");
103 return undef;
104 }
105
106 return $pid;
107 }
108
109 sub wait_for_start($$)
110 {
111 my ($self, $testenv_vars) = @_;
112 my $count = 0;
113 my $ret = 0;
114
115 if (not $self->check_env($testenv_vars)) {
116 warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
117 return -1;
118 }
119
120 # This will return quickly when things are up, but be slow if we
121 # need to wait for (eg) SSL init
122 my $nmblookup = Samba::bindir_path($self, "nmblookup4");
123
124 do {
125 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
126 if ($ret != 0) {
127 sleep(1);
128 } else {
129 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
130 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
131 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
132 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
133 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
134 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
135 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
136 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
137 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
138 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
139 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
140 }
141 $count++;
142 } while ($ret != 0 && $count < 20);
143 if ($count == 20) {
144 teardown_env($self, $testenv_vars);
145 warn("nbt not reachable after 20 retries\n");
146 return -1;
147 }
148
149 # Ensure we have the first RID Set before we start tests. This makes the tests more reliable.
150 if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
151 print "waiting for working LDAP and a RID Set to be allocated\n";
152 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
153 my $count = 0;
154 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
155
156 my $search_dn = $base_dn;
157 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
158 # TODO currently no check for actual rIDAllocationPool
159 $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
160 }
161 my $max_wait = 60;
162
163 # Add hosts file for name lookups
164 my $cmd = $self->get_cmd_env_vars($testenv_vars);
165
166 $cmd .= "$ldbsearch ";
167 $cmd .= "$testenv_vars->{CONFIGURATION} ";
168 $cmd .= "-H ldap://$testenv_vars->{SERVER} ";
169 $cmd .= "-U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} ";
170 $cmd .= "--scope base ";
171 $cmd .= "-b '$search_dn' ";
172 while (system("$cmd >/dev/null") != 0) {
173 $count++;
174 if ($count > $max_wait) {
175 teardown_env($self, $testenv_vars);
176 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
177 return -1;
178 }
179 print "Waiting for working LDAP...\n";
180 sleep(1);
181 }
182 }
183
184 my $wbinfo = Samba::bindir_path($self, "wbinfo");
185
186 $count = 0;
187 do {
188 my $cmd = "NSS_WRAPPER_PASSWD=$testenv_vars->{NSS_WRAPPER_PASSWD} ";
189 $cmd .= "NSS_WRAPPER_GROUP=$testenv_vars->{NSS_WRAPPER_GROUP} ";
190 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=$testenv_vars->{SELFTEST_WINBINDD_SOCKET_DIR} ";
191 $cmd .= "$wbinfo -P";
192 $ret = system($cmd);
193
194 if ($ret != 0) {
195 sleep(1);
196 }
197 $count++;
198 } while ($ret != 0 && $count < 20);
199 if ($count == 20) {
200 teardown_env($self, $testenv_vars);
201 warn("winbind not reachable after 20 retries\n");
202 return -1;
203 }
204
205 # Ensure we registered all our names
206 if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
207 my $max_wait = 120;
208 my $dns_update_cache = "$testenv_vars->{PRIVATEDIR}/dns_update_cache";
209 print "Waiting for $dns_update_cache to be created.\n";
210 $count = 0;
211 while (not -e $dns_update_cache) {
212 $count++;
213 if ($count > $max_wait) {
214 teardown_env($self, $testenv_vars);
215 warn("Timed out ($max_wait sec) waiting for $dns_update_cache PID $testenv_vars->{SAMBA_PID}");
216 return -1;
217 }
218 print "Waiting for $dns_update_cache to be created...\n";
219 sleep(1);
220 }
221 print "Waiting for $dns_update_cache to be filled.\n";
222 $count = 0;
223 while ((-s "$dns_update_cache") == 0) {
224 $count++;
225 if ($count > $max_wait) {
226 teardown_env($self, $testenv_vars);
227 warn("Timed out ($max_wait sec) waiting for $dns_update_cache PID $testenv_vars->{SAMBA_PID}");
228 return -1;
229 }
230 print "Waiting for $dns_update_cache to be filled...\n";
231 sleep(1);
232 }
233 }
234
235 print $self->getlog_env($testenv_vars);
236
237 print "READY ($testenv_vars->{SAMBA_PID})\n";
238
239 return 0
240 }
241
242 sub write_ldb_file($$$)
243 {
244 my ($self, $file, $ldif_in) = @_;
245
246 my $ldbadd = Samba::bindir_path($self, "ldbadd");
247 open(my $ldif, "|$ldbadd -H $file > /dev/null")
248 or die "Failed to run $ldbadd: $!";
249 print $ldif $ldif_in;
250 close($ldif);
251
252 unless ($? == 0) {
253 warn("$ldbadd failed: $?");
254 return undef;
255 }
256 return 1;
257 }
258
259 sub add_wins_config($$)
260 {
261 my ($self, $privatedir) = @_;
262 my $client_ip = Samba::get_ipv4_addr("client");
263
264 return $self->write_ldb_file("$privatedir/wins_config.ldb", "
265 dn: name=TORTURE_11,CN=PARTNERS
266 objectClass: wreplPartner
267 name: TORTURE_11
268 address: $client_ip
269 pullInterval: 0
270 pushChangeCount: 0
271 type: 0x3
272 ");
273 }
274
275 sub setup_dns_hub_internal($$$)
276 {
277 my ($self, $hostname, $prefix) = @_;
278 my $STDIN_READER;
279
280 unless(-d $prefix or mkdir($prefix, 0777)) {
281 warn("Unable to create $prefix");
282 return undef;
283 }
284 my $prefix_abs = abs_path($prefix);
285
286 die ("prefix=''") if $prefix_abs eq "";
287 die ("prefix='/'") if $prefix_abs eq "/";
288
289 unless (system("rm -rf $prefix_abs/*") == 0) {
290 warn("Unable to clean up");
291 }
292
293 my $env = undef;
294 $env->{NETBIOSNAME} = $hostname;
295
296 $env->{SERVER_IP} = Samba::get_ipv4_addr($hostname);
297 $env->{SERVER_IPV6} = Samba::get_ipv6_addr($hostname);
298 $env->{SOCKET_WRAPPER_DEFAULT_IFACE} = Samba::get_interface($hostname);
299 $env->{DNS_HUB_LOG} = "$prefix_abs/dns_hub.log";
300 $env->{RESOLV_CONF} = "$prefix_abs/resolv.conf";
301 $env->{TESTENV_DIR} = $prefix_abs;
302
303 my $ctx = undef;
304 $ctx->{resolv_conf} = $env->{RESOLV_CONF};
305 $ctx->{dns_ipv4} = $env->{SERVER_IP};
306 $ctx->{dns_ipv6} = $env->{SERVER_IPV6};
307 Samba::mk_resolv_conf($ctx);
308
309 my @preargs = ();
310 my @args = ();
311 if (!defined($ENV{PYTHON})) {
312 push (@preargs, "env");
313 push (@preargs, "python");
314 } else {
315 push (@preargs, $ENV{PYTHON});
316 }
317 my $binary = "$self->{srcdir}/selftest/target/dns_hub.py";
318 push (@args, "$self->{server_maxtime}");
319 push (@args, "$env->{SERVER_IP},$env->{SERVER_IPV6}");
320 push (@args, Samba::realm_to_ip_mappings());
321 my @full_cmd = (@preargs, $binary, @args);
322
323 my $daemon_ctx = {
324 NAME => "dnshub",
325 BINARY_PATH => $binary,
326 FULL_CMD => [ @full_cmd ],
327 LOG_FILE => $env->{DNS_HUB_LOG},
328 TEE_STDOUT => 1,
329 PCAP_FILE => "env-$ENV{ENVNAME}-dns_hub",
330 ENV_VARS => {},
331 };
332
333 # use a pipe for stdin in the child processes. This allows
334 # those processes to monitor the pipe for EOF to ensure they
335 # exit when the test script exits
336 pipe($STDIN_READER, $env->{STDIN_PIPE});
337
338 my $pid = Samba::fork_and_exec($self, $env, $daemon_ctx, $STDIN_READER);
339
340 $env->{SAMBA_PID} = $pid;
341 $env->{KRB5_CONFIG} = "$prefix_abs/no_krb5.conf";
342
343 # close the parent's read-end of the pipe
344 close($STDIN_READER);
345
346 return $env;
347 }
348
349 sub setup_dns_hub
350 {
351 my ($self, $prefix) = @_;
352
353 my $hostname = "rootdnsforwarder";
354
355 unless(-d $prefix or mkdir($prefix, 0777)) {
356 warn("Unable to create $prefix");
357 return undef;
358 }
359 my $env = $self->setup_dns_hub_internal("$hostname", "$prefix/$hostname");
360
361 $self->{dns_hub_env} = $env;
362
363 return $env;
364 }
365
366 sub get_dns_hub_env($)
367 {
368 my ($self, $prefix) = @_;
369
370 if (defined($self->{dns_hub_env})) {
371 return $self->{dns_hub_env};
372 }
373
374 die("get_dns_hub_env() not setup 'dns_hub_env'");
375 return undef;
376 }
377
378 sub return_env_value
379 {
380 my ($env, $overwrite, $key) = @_;
381
382 if (defined($overwrite) and defined($overwrite->{$key})) {
383 return $overwrite->{$key};
384 }
385
386 if (defined($env->{$key})) {
387 return $env->{$key};
388 }
389
390 return undef;
391 }
392
393 # Returns the environmental variables that we pass to samba-tool commands
394 sub get_cmd_env_vars
395 {
396 my ($self, $givenenv, $overwrite) = @_;
397
398 my @keys = (
399 "NSS_WRAPPER_HOSTS",
400 "SOCKET_WRAPPER_DEFAULT_IFACE",
401 "RESOLV_CONF",
402 "RESOLV_WRAPPER_CONF",
403 "RESOLV_WRAPPER_HOSTS",
404 "GNUTLS_FORCE_FIPS_MODE",
405 "OPENSSL_FORCE_FIPS_MODE",
406 "KRB5_CONFIG",
407 "KRB5_CCACHE",
408 "GNUPGHOME",
409 );
410
411 my $localenv = undef;
412 foreach my $key (@keys) {
413 my $v = return_env_value($givenenv, $overwrite, $key);
414 $localenv->{$key} = $v if defined($v);
415 }
416
417 my $cmd_env = "NSS_WRAPPER_HOSTS='$localenv->{NSS_WRAPPER_HOSTS}' ";
418 $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
419 if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
420 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
421 } else {
422 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
423 }
424 if (defined($localenv->{GNUTLS_FORCE_FIPS_MODE})) {
425 $cmd_env .= "GNUTLS_FORCE_FIPS_MODE=$localenv->{GNUTLS_FORCE_FIPS_MODE} ";
426 }
427 if (defined($localenv->{OPENSSL_FORCE_FIPS_MODE})) {
428 $cmd_env .= "OPENSSL_FORCE_FIPS_MODE=$localenv->{OPENSSL_FORCE_FIPS_MODE} ";
429 }
430 $cmd_env .= "KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
431 $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
432 $cmd_env .= "RESOLV_CONF=\"$localenv->{RESOLV_CONF}\" ";
433 $cmd_env .= "GNUPGHOME=\"$localenv->{GNUPGHOME}\" ";
434
435 return $cmd_env;
436 }
437
438 # Sets up a forest trust namespace.
439 # (Note this is different to kernel namespaces, setup by the
440 # USE_NAMESPACES=1 option)
441 sub setup_namespaces
442 {
443 my ($self, $localenv, $upn_array, $spn_array) = @_;
444
445 @{$upn_array} = [] unless defined($upn_array);
446 my $upn_args = "";
447 foreach my $upn (@{$upn_array}) {
448 $upn_args .= " --add-upn-suffix=$upn";
449 }
450
451 @{$spn_array} = [] unless defined($spn_array);
452 my $spn_args = "";
453 foreach my $spn (@{$spn_array}) {
454 $spn_args .= " --add-spn-suffix=$spn";
455 }
456
457 my $samba_tool = Samba::bindir_path($self, "samba-tool");
458
459 my $cmd_env = $self->get_cmd_env_vars($localenv);
460
461 my $cmd_config = " $localenv->{CONFIGURATION}";
462
463 my $namespaces = $cmd_env;
464 $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
465 $namespaces .= $cmd_config;
466 unless (system($namespaces) == 0) {
467 warn("Failed to add namespaces \n$namespaces");
468 return -1;
469 }
470
471 return 0;
472 }
473
474 sub setup_trust($$$$$)
475 {
476 my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
477
478 $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
479 $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
480 $localenv->{TRUST_DNSNAME} = $remoteenv->{DNSNAME};
481
482 $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
483 $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
484 $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
485 $localenv->{TRUST_REALM} = $remoteenv->{REALM};
486 $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID};
487
488 # Add trusted domain realms to krb5.conf
489 Samba::append_krb5_conf_trust_realms($localenv);
490
491 my $samba_tool = Samba::bindir_path($self, "samba-tool");
492
493 # setup the trust
494 my $cmd_env = $self->get_cmd_env_vars($localenv);
495
496 my $cmd_config = " $localenv->{CONFIGURATION}";
497 my $cmd_creds = $cmd_config;
498 $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
499
500 my $create = $cmd_env;
501 $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
502 $create .= " $extra_args";
503 $create .= $cmd_creds;
504 unless (system($create) == 0) {
505 warn("Failed to create trust \n$create");
506 return undef;
507 }
508
509 my $groupname = "g_$localenv->{TRUST_DOMAIN}";
510 my $groupadd = $cmd_env;
511 $groupadd .= " $samba_tool group add '$groupname' --group-scope=Domain $cmd_config";
512 unless (system($groupadd) == 0) {
513 warn("Failed to create group \n$groupadd");
514 return undef;
515 }
516 my $groupmem = $cmd_env;
517 $groupmem .= " $samba_tool group addmembers '$groupname' '$localenv->{TRUST_DOMSID}-513' $cmd_config";
518 unless (system($groupmem) == 0) {
519 warn("Failed to add group member \n$groupmem");
520 return undef;
521 }
522
523 return $localenv
524 }
525
526 sub provision_raw_prepare($$$$$$$$$$$$$$)
527 {
528 my ($self,
529 $prefix,
530 $server_role,
531 $hostname,
532 $domain,
533 $realm,
534 $samsid,
535 $functional_level,
536 $password,
537 $kdc_ipv4,
538 $kdc_ipv6,
539 $force_fips_mode,
540 $extra_provision_options) = @_;
541 my $ctx;
542 my $python_cmd = "";
543 if (defined $ENV{PYTHON}) {
544 $python_cmd = $ENV{PYTHON} . " ";
545 }
546 $ctx->{python} = $python_cmd;
547 my $netbiosname = uc($hostname);
548
549 unless(-d $prefix or mkdir($prefix, 0777)) {
550 warn("Unable to create $prefix");
551 return undef;
552 }
553 my $prefix_abs = abs_path($prefix);
554
555 die ("prefix=''") if $prefix_abs eq "";
556 die ("prefix='/'") if $prefix_abs eq "/";
557
558 unless (system("rm -rf $prefix_abs/*") == 0) {
559 warn("Unable to clean up");
560 }
561
562
563 my $swiface = Samba::get_interface($hostname);
564
565 $ctx->{prefix} = $prefix;
566 $ctx->{prefix_abs} = $prefix_abs;
567
568 $ctx->{server_role} = $server_role;
569 $ctx->{hostname} = $hostname;
570 $ctx->{netbiosname} = $netbiosname;
571 $ctx->{swiface} = $swiface;
572 $ctx->{password} = $password;
573 $ctx->{kdc_ipv4} = $kdc_ipv4;
574 $ctx->{kdc_ipv6} = $kdc_ipv6;
575 $ctx->{force_fips_mode} = $force_fips_mode;
576 $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
577 if ($functional_level eq "2000") {
578 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc";
579 }
580
581 #
582 # Set smbd log level here.
583 #
584 $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
585 $ctx->{username} = "Administrator";
586 $ctx->{domain} = $domain;
587 $ctx->{realm} = uc($realm);
588 $ctx->{dnsname} = lc($realm);
589 $ctx->{samsid} = $samsid;
590 $ctx->{domain_admin} = "Administrator";
591 $ctx->{domain_admin_password} = $password;
592 $ctx->{domain_user} = "alice";
593 $ctx->{domain_user_password} = "Secret007";
594
595 $ctx->{functional_level} = $functional_level;
596
597 my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
598 chomp $unix_name;
599 $ctx->{unix_name} = $unix_name;
600 $ctx->{unix_uid} = $>;
601 my @mygid = split(" ", $();
602 $ctx->{unix_gid} = $mygid[0];
603 $ctx->{unix_gids_str} = $);
604 @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
605
606 $ctx->{etcdir} = "$prefix_abs/etc";
607 $ctx->{piddir} = "$prefix_abs/pid";
608 $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
609 $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
610 $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
611 $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
612 $ctx->{gnupghome} = "$prefix_abs/gnupg";
613 $ctx->{privatedir} = "$prefix_abs/private";
614 $ctx->{binddnsdir} = "$prefix_abs/bind-dns";
615 $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
616 $ctx->{lockdir} = "$prefix_abs/lockdir";
617 $ctx->{logdir} = "$prefix_abs/logs";
618 $ctx->{statedir} = "$prefix_abs/statedir";
619 $ctx->{cachedir} = "$prefix_abs/cachedir";
620 $ctx->{winbindd_socket_dir} = "$prefix_abs/wbsock";
621 $ctx->{nmbd_socket_dir} = "$prefix_abs/nmbsock";
622 $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
623 $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
624 $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
625 $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
626 $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
627 if ($ENV{SAMBA_DNS_FAKING}) {
628 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
629 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --configfile=$ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
630 $ctx->{samba_dnsupdate} = $python_cmd . $ctx->{samba_dnsupdate};
631 } else {
632 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --configfile=$ctx->{smb_conf} --all-interfaces";
633 $ctx->{samba_dnsupdate} = $python_cmd . $ctx->{samba_dnsupdate};
634 $ctx->{use_resolv_wrapper} = 1;
635 }
636
637 my $dns_hub = $self->get_dns_hub_env();
638 $ctx->{resolv_conf} = $dns_hub->{RESOLV_CONF};
639
640 $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
641
642 $ctx->{ipv4} = Samba::get_ipv4_addr($hostname);
643 $ctx->{ipv6} = Samba::get_ipv6_addr($hostname);
644
645 push(@{$ctx->{directories}}, $ctx->{privatedir});
646 push(@{$ctx->{directories}}, $ctx->{binddnsdir});
647 push(@{$ctx->{directories}}, $ctx->{etcdir});
648 push(@{$ctx->{directories}}, $ctx->{piddir});
649 push(@{$ctx->{directories}}, $ctx->{lockdir});
650 push(@{$ctx->{directories}}, $ctx->{logdir});
651 push(@{$ctx->{directories}}, $ctx->{statedir});
652 push(@{$ctx->{directories}}, $ctx->{cachedir});
653
654 $ctx->{smb_conf_extra_options} = "";
655
656 my @provision_options = ();
657 push (@provision_options, "GNUPGHOME=\"$ctx->{gnupghome}\"");
658 push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
659 push (@provision_options, "KRB5CCNAME=\"$ctx->{krb5_ccache}\"");
660 push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
661 push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
662 push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
663 push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
664 if (defined($ctx->{use_resolv_wrapper})) {
665 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
666 push (@provision_options, "RESOLV_CONF=\"$ctx->{resolv_conf}\"");
667 } else {
668 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
669 }
670 if (defined($ctx->{force_fips_mode})) {
671 push (@provision_options, "GNUTLS_FORCE_FIPS_MODE=1");
672 push (@provision_options, "OPENSSL_FORCE_FIPS_MODE=1");
673 }
674
675 if (defined($ENV{GDB_PROVISION}) ||
676 defined($ENV{RR_PROVISION}) ||
677 defined($ENV{PY_DEV_PROVISION}) ||
678 defined($ENV{VALGRIND_PROVISION})) {
679 if (defined($ENV{GDB_PROVISION})) {
680 push (@provision_options, "gdb --args");
681 }
682 if (defined($ENV{RR_PROVISION})) {
683 push (@provision_options, "rr");
684 }
685 if (defined($ENV{VALGRIND_PROVISION})) {
686 push (@provision_options, "valgrind");
687 }
688 if (!defined($ENV{PYTHON})) {
689 push (@provision_options, "env");
690 push (@provision_options, "python");
691 }
692 if (defined($ENV{PY_DEV_PROVISION})) {
693 # makes Python more likely to emit warnings
694 # and debug info.
695 push (@provision_options, "-X dev");
696 }
697 }
698
699 my $samba_tool = Samba::bindir_path($self, "samba-tool");
700
701 push (@provision_options, $samba_tool);
702 push (@provision_options, "domain");
703 push (@provision_options, "provision");
704 push (@provision_options, "--configfile=$ctx->{smb_conf}");
705 push (@provision_options, "--host-name=$ctx->{hostname}");
706 push (@provision_options, "--host-ip=$ctx->{ipv4}");
707 push (@provision_options, "--quiet");
708 push (@provision_options, "--domain=$ctx->{domain}");
709 push (@provision_options, "--realm=$ctx->{realm}");
710 if (defined($ctx->{samsid})) {
711 push (@provision_options, "--domain-sid=$ctx->{samsid}");
712 }
713 push (@provision_options, "--adminpass=$ctx->{password}");
714 push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
715 push (@provision_options, "--machinepass=machine$ctx->{password}");
716 push (@provision_options, "--root=$ctx->{unix_name}");
717 push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
718 push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
719
720 @{$ctx->{provision_options}} = @provision_options;
721
722 if (defined($extra_provision_options)) {
723 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
724 }
725
726 return $ctx;
727 }
728
729 sub has_option
730 {
731 my ($self, $keyword, @options_list) = @_;
732
733 # convert the options-list to a hash-map for easy keyword lookup
734 my %options_dict = map { $_ => 1 } @options_list;
735
736 return exists $options_dict{$keyword};
737 }
738
739 #
740 # Step1 creates the basic configuration
741 #
742 sub provision_raw_step1($$)
743 {
744 my ($self, $ctx) = @_;
745
746 mkdir($_, 0777) foreach (@{$ctx->{directories}});
747
748 ##
749 ## lockdir and piddir must be 0755
750 ##
751 chmod 0755, $ctx->{lockdir};
752 chmod 0755, $ctx->{piddir};
753
754 unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
755 warn("can't open $ctx->{smb_conf}$?");
756 return undef;
757 }
758
759 Samba::copy_gnupg_home($ctx);
760 Samba::prepare_keyblobs($ctx);
761 my $crlfile = "$ctx->{tlsdir}/crl.pem";
762 $crlfile = "" unless -e ${crlfile};
763
764 # work out which file server to use. Default to source3 smbd (s3fs),
765 # unless the source4 NTVFS (smb) file server has been specified
766 my $services = "-smb +s3fs";
767 if ($self->has_option("--use-ntvfs", @{$ctx->{provision_options}})) {
768 $services = "+smb -s3fs";
769 }
770
771 my $interfaces = Samba::get_interfaces_config($ctx->{netbiosname});
772
773 print CONFFILE "
774 [global]
775 netbios name = $ctx->{netbiosname}
776 posix:eadb = $ctx->{statedir}/eadb.tdb
777 workgroup = $ctx->{domain}
778 realm = $ctx->{realm}
779 private dir = $ctx->{privatedir}
780 binddns dir = $ctx->{binddnsdir}
781 pid directory = $ctx->{piddir}
782 ncalrpc dir = $ctx->{ncalrpcdir}
783 lock dir = $ctx->{lockdir}
784 state directory = $ctx->{statedir}
785 cache directory = $ctx->{cachedir}
786 winbindd socket directory = $ctx->{winbindd_socket_dir}
787 nmbd:socket dir = $ctx->{nmbd_socket_dir}
788 ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
789 winbind separator = /
790 interfaces = $interfaces
791 tls dh params file = $ctx->{tlsdir}/dhparms.pem
792 tls crlfile = ${crlfile}
793 tls verify peer = no_check
794 panic action = $RealBin/gdb_backtrace \%d
795 smbd:suicide mode = yes
796 smbd:FSCTL_SMBTORTURE = yes
797 smbd:validate_oplock_types = yes
798 wins support = yes
799 server role = $ctx->{server_role}
800 server services = +echo $services
801 dcerpc endpoint servers = +winreg +srvsvc +rpcecho
802 notify:inotify = false
803 ldb:nosync = true
804 ldap server require strong auth = yes
805 log file = $ctx->{logdir}/log.\%m
806 log level = $ctx->{server_loglevel}
807 lanman auth = Yes
808 ntlm auth = Yes
809 client min protocol = SMB2_02
810 server min protocol = SMB2_02
811 mangled names = yes
812 dns update command = $ctx->{samba_dnsupdate}
813 spn update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate --configfile $ctx->{smb_conf}
814 gpo update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba-gpupdate --configfile $ctx->{smb_conf} --target=Computer
815 samba kcc command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_kcc
816 dreplsrv:periodic_startup_interval = 0
817 dsdb:schema update allowed = yes
818
819 vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
820
821 idmap_ldb:use rfc2307=yes
822 winbind enum users = yes
823 winbind enum groups = yes
824
825 rpc server port:netlogon = 1026
826 include system krb5 conf = no
827
828 debug syslog format = always
829 debug hires timestamp = yes
830
831 ";
832
833 print CONFFILE "
834
835 # Begin extra options
836 $ctx->{smb_conf_extra_options}
837 # End extra options
838 ";
839 close(CONFFILE);
840
841 #Default the KDC IP to the server's IP
842 if (not defined($ctx->{kdc_ipv4})) {
843 $ctx->{kdc_ipv4} = $ctx->{ipv4};
844 }
845 if (not defined($ctx->{kdc_ipv6})) {
846 $ctx->{kdc_ipv6} = $ctx->{ipv6};
847 }
848
849 Samba::mk_krb5_conf($ctx);
850 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
851
852 open(PWD, ">$ctx->{nsswrap_passwd}");
853 if ($ctx->{unix_uid} != 0) {
854 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
855 }
856 print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
857 print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
858 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
859 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
860 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
861 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
862 ";
863 close(PWD);
864 my $uid_rfc2307test = 65533;
865
866 open(GRP, ">$ctx->{nsswrap_group}");
867 if ($ctx->{unix_gid} != 0) {
868 print GRP "root:x:0:\n";
869 }
870 print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
871 print GRP "wheel:x:10:
872 users:x:65531:
873 nobody:x:65533:
874 nogroup:x:65534:nobody
875 ";
876 close(GRP);
877 my $gid_rfc2307test = 65532;
878
879 my $hostname = lc($ctx->{hostname});
880 open(HOSTS, ">>$ctx->{nsswrap_hosts}");
881 if ($hostname eq "localdc") {
882 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
883 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
884 } else {
885 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
886 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
887 }
888 close(HOSTS);
889
890 my $configuration = "--configfile=$ctx->{smb_conf}";
891
892 #Ensure the config file is valid before we start
893 my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
894 if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
895 system("$testparm -v --suppress-prompt $configuration >&2");
896 warn("Failed to create a valid smb.conf configuration $testparm!");
897 return undef;
898 }
899 unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
900 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
901 return undef;
902 }
903
904 # Return the environment variables for the new testenv DC.
905 # Note that we have SERVER_X and DC_SERVER_X variables (which have the same
906 # value initially). In a 2 DC setup, $DC_SERVER_X will always be the PDC.
907 my $ret = {
908 GNUPGHOME => $ctx->{gnupghome},
909 KRB5_CONFIG => $ctx->{krb5_conf},
910 KRB5_CCACHE => $ctx->{krb5_ccache},
911 MITKDC_CONFIG => $ctx->{mitkdc_conf},
912 PIDDIR => $ctx->{piddir},
913 SERVER => $ctx->{hostname},
914 DC_SERVER => $ctx->{hostname},
915 SERVER_IP => $ctx->{ipv4},
916 DC_SERVER_IP => $ctx->{ipv4},
917 SERVER_IPV6 => $ctx->{ipv6},
918 DC_SERVER_IPV6 => $ctx->{ipv6},
919 NETBIOSNAME => $ctx->{netbiosname},
920 DC_NETBIOSNAME => $ctx->{netbiosname},
921 DOMAIN => $ctx->{domain},
922 USERNAME => $ctx->{username},
923 DC_USERNAME => $ctx->{username},
924 DOMAIN_ADMIN => $ctx->{domain_admin},
925 DOMAIN_ADMIN_PASSWORD => $ctx->{domain_admin_password},
926 DOMAIN_USER => $ctx->{domain_user},
927 DOMAIN_USER_PASSWORD => $ctx->{domain_user_password},
928 REALM => $ctx->{realm},
929 DNSNAME => $ctx->{dnsname},
930 SAMSID => $ctx->{samsid},
931 PASSWORD => $ctx->{password},
932 DC_PASSWORD => $ctx->{password},
933 LDAPDIR => $ctx->{ldapdir},
934 LDAP_INSTANCE => $ctx->{ldap_instance},
935 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
936 NCALRPCDIR => $ctx->{ncalrpcdir},
937 LOCKDIR => $ctx->{lockdir},
938 STATEDIR => $ctx->{statedir},
939 CACHEDIR => $ctx->{cachedir},
940 PRIVATEDIR => $ctx->{privatedir},
941 BINDDNSDIR => $ctx->{binddnsdir},
942 SERVERCONFFILE => $ctx->{smb_conf},
943 TESTENV_DIR => $ctx->{prefix_abs},
944 CONFIGURATION => $configuration,
945 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
946 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
947 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
948 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
949 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
950 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
951 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
952 SAMBA_TEST_LOG_POS => 0,
953 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
954 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
955 LOCAL_PATH => $ctx->{share},
956 UID_RFC2307TEST => $uid_rfc2307test,
957 GID_RFC2307TEST => $gid_rfc2307test,
958 SERVER_ROLE => $ctx->{server_role},
959 RESOLV_CONF => $ctx->{resolv_conf},
960 KRB5_CRL_FILE => $crlfile,
961 };
962
963 if (defined($ctx->{use_resolv_wrapper})) {
964 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
965 } else {
966 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
967 }
968 if (defined($ctx->{force_fips_mode})) {
969 $ret->{GNUTLS_FORCE_FIPS_MODE} = "1",
970 $ret->{OPENSSL_FORCE_FIPS_MODE} = "1",
971 }
972
973 if ($ctx->{server_role} eq "domain controller") {
974 $ret->{DOMSID} = $ret->{SAMSID};
975 }
976
977 return $ret;
978 }
979
980 #
981 # Step2 runs the provision script
982 #
983 sub provision_raw_step2($$$)
984 {
985 my ($self, $ctx, $ret) = @_;
986
987 my $ldif;
988
989 my $provision_cmd = join(" ", @{$ctx->{provision_options}});
990 unless (system($provision_cmd) == 0) {
991 warn("Unable to provision: \n$provision_cmd\n");
992 return undef;
993 }
994
995 my $cmd_env = $self->get_cmd_env_vars($ret);
996
997 my $testallowed_account = "testallowed";
998 my $samba_tool_cmd = ${cmd_env};
999 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1000 . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
1001 unless (system($samba_tool_cmd) == 0) {
1002 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
1003 return undef;
1004 }
1005
1006 my $srv_account = "srv_account";
1007 $samba_tool_cmd = ${cmd_env};
1008 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1009 . " user create --configfile=$ctx->{smb_conf} $srv_account $ctx->{password}";
1010 unless (system($samba_tool_cmd) == 0) {
1011 warn("Unable to add $srv_account user: \n$samba_tool_cmd\n");
1012 return undef;
1013 }
1014
1015 $samba_tool_cmd = ${cmd_env};
1016 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1017 . " spn add HOST/$srv_account --configfile=$ctx->{smb_conf} $srv_account";
1018 unless (system($samba_tool_cmd) == 0) {
1019 warn("Unable to add spn for $srv_account: \n$samba_tool_cmd\n");
1020 return undef;
1021 }
1022
1023 my $ldbmodify = ${cmd_env};
1024 $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
1025 $ldbmodify .= " --configfile=$ctx->{smb_conf}";
1026 my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
1027
1028 if ($ctx->{server_role} ne "domain controller") {
1029 $base_dn = "DC=$ctx->{netbiosname}";
1030 }
1031
1032 my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
1033 $testallowed_account = "testallowed account";
1034 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1035 or die "Failed to run $ldbmodify: $!";
1036 print $ldif "dn: $user_dn
1037 changetype: modify
1038 replace: samAccountName
1039 samAccountName: $testallowed_account
1040 -
1041 ";
1042 close($ldif);
1043 unless ($? == 0) {
1044 warn("$ldbmodify failed: $?");
1045 return undef;
1046 }
1047
1048 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1049 or die "Failed to run $ldbmodify: $!";
1050 print $ldif "dn: $user_dn
1051 changetype: modify
1052 replace: userPrincipalName
1053 userPrincipalName: testallowed upn\@$ctx->{realm}
1054 replace: servicePrincipalName
1055 servicePrincipalName: host/testallowed
1056 -
1057 ";
1058 close($ldif);
1059 unless ($? == 0) {
1060 warn("$ldbmodify failed: $?");
1061 return undef;
1062 }
1063
1064 $samba_tool_cmd = ${cmd_env};
1065 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1066 . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
1067 unless (system($samba_tool_cmd) == 0) {
1068 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
1069 return undef;
1070 }
1071
1072 $user_dn = "cn=testdenied,cn=users,$base_dn";
1073 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1074 or die "Failed to run $ldbmodify: $!";
1075 print $ldif "dn: $user_dn
1076 changetype: modify
1077 replace: userPrincipalName
1078 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
1079 -
1080 ";
1081 close($ldif);
1082 unless ($? == 0) {
1083 warn("$ldbmodify failed: $?");
1084 return undef;
1085 }
1086
1087 $samba_tool_cmd = ${cmd_env};
1088 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1089 . " user create --configfile=$ctx->{smb_conf} testupnspn $ctx->{password}";
1090 unless (system($samba_tool_cmd) == 0) {
1091 warn("Unable to add testupnspn user: \n$samba_tool_cmd\n");
1092 return undef;
1093 }
1094
1095 $user_dn = "cn=testupnspn,cn=users,$base_dn";
1096 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1097 or die "Failed to run $ldbmodify: $!";
1098 print $ldif "dn: $user_dn
1099 changetype: modify
1100 replace: userPrincipalName
1101 userPrincipalName: http/testupnspn.$ctx->{dnsname}\@$ctx->{realm}
1102 replace: servicePrincipalName
1103 servicePrincipalName: http/testupnspn.$ctx->{dnsname}
1104 -
1105 ";
1106 close($ldif);
1107 unless ($? == 0) {
1108 warn("$ldbmodify failed: $?");
1109 return undef;
1110 }
1111
1112 $samba_tool_cmd = ${cmd_env};
1113 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1114 . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
1115 unless (system($samba_tool_cmd) == 0) {
1116 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
1117 return undef;
1118 }
1119
1120 # Create two users alice and bob!
1121 my $user_account_array = ["alice", "bob", "jane", "joe"];
1122
1123 foreach my $user_account (@{$user_account_array}) {
1124 my $samba_tool_cmd = ${cmd_env};
1125
1126 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1127 . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
1128 unless (system($samba_tool_cmd) == 0) {
1129 warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
1130 return undef;
1131 }
1132 }
1133
1134 my $group_array = ["Samba Users"];
1135
1136 foreach my $group (@{$group_array}) {
1137 my $samba_tool_cmd = ${cmd_env};
1138
1139 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1140 . " group add --configfile=$ctx->{smb_conf} \"$group\"";
1141 unless (system($samba_tool_cmd) == 0) {
1142 warn("Unable to create group: $group\n$samba_tool_cmd\n");
1143 return undef;
1144 }
1145 }
1146
1147 # Add user joe to group "Samba Users"
1148 my $group = "Samba Users";
1149 my $user_account = "joe";
1150
1151 $samba_tool_cmd = ${cmd_env};
1152 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1153 . " group addmembers --configfile=$ctx->{smb_conf} \"$group\" $user_account";
1154 unless (system($samba_tool_cmd) == 0) {
1155 warn("Unable to add " . $user_account . "to group group : $group\n$samba_tool_cmd\n");
1156 return undef;
1157 }
1158
1159 $group = "Samba Users";
1160 $user_account = "joe";
1161
1162 $samba_tool_cmd = ${cmd_env};
1163 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1164 . " user setprimarygroup --configfile=$ctx->{smb_conf} $user_account \"$group\"";
1165 unless (system($samba_tool_cmd) == 0) {
1166 warn("Unable to set primary group of user: $user_account\n$samba_tool_cmd\n");
1167 return undef;
1168 }
1169
1170 # Change the userPrincipalName for jane
1171 $user_dn = "cn=jane,cn=users,$base_dn";
1172
1173 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1174 or die "Failed to run $ldbmodify: $!";
1175 print $ldif "dn: $user_dn
1176 changetype: modify
1177 replace: userPrincipalName
1178 userPrincipalName: jane.doe\@$ctx->{realm}
1179 -
1180 ";
1181 close($ldif);
1182 unless ($? == 0) {
1183 warn("$ldbmodify failed: $?");
1184 return undef;
1185 }
1186
1187 return $ret;
1188 }
1189
1190 sub provision($$$$$$$$$$$)
1191 {
1192 my ($self,
1193 $prefix,
1194 $server_role,
1195 $hostname,
1196 $domain,
1197 $realm,
1198 $functional_level,
1199 $password,
1200 $kdc_ipv4,
1201 $kdc_ipv6,
1202 $force_fips_mode,
1203 $extra_smbconf_options,
1204 $extra_smbconf_shares,
1205 $extra_provision_options) = @_;
1206
1207 my $samsid = Samba::random_domain_sid();
1208
1209 my $ctx = $self->provision_raw_prepare($prefix, $server_role,
1210 $hostname,
1211 $domain, $realm,
1212 $samsid,
1213 $functional_level,
1214 $password,
1215 $kdc_ipv4,
1216 $kdc_ipv6,
1217 $force_fips_mode,
1218 $extra_provision_options);
1219
1220 $ctx->{share} = "$ctx->{prefix_abs}/share";
1221 push(@{$ctx->{directories}}, "$ctx->{share}");
1222 push(@{$ctx->{directories}}, "$ctx->{share}/test1");
1223 push(@{$ctx->{directories}}, "$ctx->{share}/test2");
1224
1225 # precreate directories for printer drivers
1226 push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
1227 push(@{$ctx->{directories}}, "$ctx->{share}/x64");
1228 push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
1229
1230 my $msdfs = "no";
1231 $msdfs = "yes" if ($server_role eq "domain controller");
1232 $ctx->{smb_conf_extra_options} = "
1233
1234 max xmit = 32K
1235 server max protocol = SMB2
1236 host msdfs = $msdfs
1237 lanman auth = yes
1238
1239 # fruit:copyfile is a global option
1240 fruit:copyfile = yes
1241
1242 $extra_smbconf_options
1243
1244 [tmp]
1245 path = $ctx->{share}
1246 read only = no
1247 posix:sharedelay = 100000
1248 posix:oplocktimeout = 3
1249 posix:writetimeupdatedelay = 500000
1250
1251 [xcopy_share]
1252 path = $ctx->{share}
1253 read only = no
1254 posix:sharedelay = 100000
1255 posix:oplocktimeout = 3
1256 posix:writetimeupdatedelay = 500000
1257 create mask = 777
1258 force create mode = 777
1259
1260 [posix_share]
1261 path = $ctx->{share}
1262 read only = no
1263 create mask = 0777
1264 force create mode = 0
1265 directory mask = 0777
1266 force directory mode = 0
1267
1268 [test1]
1269 path = $ctx->{share}/test1
1270 read only = no
1271 posix:sharedelay = 100000
1272 posix:oplocktimeout = 3
1273 posix:writetimeupdatedelay = 500000
1274
1275 [test2]
1276 path = $ctx->{share}/test2
1277 read only = no
1278 posix:sharedelay = 100000
1279 posix:oplocktimeout = 3
1280 posix:writetimeupdatedelay = 500000
1281
1282 [cifs]
1283 path = $ctx->{share}/_ignore_cifs_
1284 read only = no
1285 ntvfs handler = cifs
1286 cifs:server = $ctx->{netbiosname}
1287 cifs:share = tmp
1288 cifs:use-s4u2proxy = yes
1289 # There is no username specified here, instead the client is expected
1290 # to log in with kerberos, and the serverwill use delegated credentials.
1291 # Or the server tries s4u2self/s4u2proxy to impersonate the client
1292
1293 [simple]
1294 path = $ctx->{share}
1295 read only = no
1296 ntvfs handler = simple
1297
1298 [sysvol]
1299 path = $ctx->{statedir}/sysvol
1300 read only = no
1301
1302 [netlogon]
1303 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1304 read only = no
1305
1306 [cifsposix]
1307 copy = simple
1308 ntvfs handler = cifsposix
1309
1310 [vfs_fruit]
1311 path = $ctx->{share}
1312 vfs objects = catia fruit streams_xattr acl_xattr
1313 ea support = yes
1314 fruit:resource = file
1315 fruit:metadata = netatalk
1316 fruit:locking = netatalk
1317 fruit:encoding = native
1318
1319 [xattr]
1320 path = $ctx->{share}
1321 # This can be used for testing real fs xattr stuff
1322 vfs objects = streams_xattr acl_xattr
1323
1324 $extra_smbconf_shares
1325 ";
1326
1327 my $ret = $self->provision_raw_step1($ctx);
1328 unless (defined $ret) {
1329 return undef;
1330 }
1331
1332 return $self->provision_raw_step2($ctx, $ret);
1333 }
1334
1335 # For multi-DC testenvs, we want $DC_SERVER to always be the PDC (i.e. the
1336 # original DC) in the testenv. $SERVER is always the joined DC that we are
1337 # actually running the test against
1338 sub set_pdc_env_vars
1339 {
1340 my ($self, $env, $dcvars) = @_;
1341
1342 $env->{DC_SERVER} = $dcvars->{DC_SERVER};
1343 $env->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1344 $env->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1345 $env->{DC_SERVERCONFFILE} = $dcvars->{SERVERCONFFILE};
1346 $env->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1347 $env->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1348 $env->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1349 }
1350
1351 sub provision_s4member($$$$$)
1352 {
1353 my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
1354 print "PROVISIONING MEMBER...\n";
1355 my $extra_smb_conf = "
1356 passdb backend = samba_dsdb
1357 winbindd:use external pipes = true
1358
1359 # the source4 smb server doesn't allow signing by default
1360 server signing = enabled
1361 raw NTLMv2 auth = yes
1362
1363 # override the new SMB2 only default
1364 client min protocol = CORE
1365 server min protocol = LANMAN1
1366 ";
1367 if ($more_conf) {
1368 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1369 }
1370 my $extra_provision_options = ["--use-ntvfs"];
1371 my $ret = $self->provision($prefix,
1372 "member server",
1373 $hostname,
1374 $dcvars->{DOMAIN},
1375 $dcvars->{REALM},
1376 "2008",
1377 "locMEMpass3",
1378 $dcvars->{SERVER_IP},
1379 $dcvars->{SERVER_IPV6},
1380 undef,
1381 $extra_smb_conf, "",
1382 $extra_provision_options);
1383 unless ($ret) {
1384 return undef;
1385 }
1386
1387 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1388 my $cmd = $self->get_cmd_env_vars($ret);
1389 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member member";
1390 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1391 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1392
1393 unless (system($cmd) == 0) {
1394 warn("Join failed\n$cmd");
1395 return undef;
1396 }
1397
1398 $ret->{DOMSID} = $dcvars->{DOMSID};
1399 $self->set_pdc_env_vars($ret, $dcvars);
1400
1401 return $ret;
1402 }
1403
1404 sub provision_rpc_proxy($$$)
1405 {
1406 my ($self, $prefix, $dcvars) = @_;
1407 print "PROVISIONING RPC PROXY...\n";
1408
1409 my $extra_smbconf_options = "
1410 passdb backend = samba_dsdb
1411
1412 # rpc_proxy
1413 dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1414 dcerpc endpoint servers = epmapper, remote
1415 dcerpc_remote:interfaces = rpcecho
1416 dcerpc_remote:allow_anonymous_fallback = yes
1417 # override the new SMB2 only default
1418 client min protocol = CORE
1419 server min protocol = LANMAN1
1420 [cifs_to_dc]
1421 path = /tmp/_ignore_cifs_to_dc_/_none_
1422 read only = no
1423 ntvfs handler = cifs
1424 cifs:server = $dcvars->{SERVER}
1425 cifs:share = cifs
1426 cifs:use-s4u2proxy = yes
1427 # There is no username specified here, instead the client is expected
1428 # to log in with kerberos, and the serverwill use delegated credentials.
1429 # Or the server tries s4u2self/s4u2proxy to impersonate the client
1430
1431 ";
1432
1433 my $extra_provision_options = ["--use-ntvfs"];
1434 my $ret = $self->provision($prefix,
1435 "member server",
1436 "localrpcproxy",
1437 $dcvars->{DOMAIN},
1438 $dcvars->{REALM},
1439 "2008",
1440 "locRPCproxypass4",
1441 $dcvars->{SERVER_IP},
1442 $dcvars->{SERVER_IPV6},
1443 undef,
1444 $extra_smbconf_options, "",
1445 $extra_provision_options);
1446 unless ($ret) {
1447 return undef;
1448 }
1449
1450 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1451
1452 # The joind runs in the context of the rpc_proxy/member for now
1453 my $cmd = $self->get_cmd_env_vars($ret);
1454 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member member";
1455 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1456 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1457
1458 unless (system($cmd) == 0) {
1459 warn("Join failed\n$cmd");
1460 return undef;
1461 }
1462
1463 # Prepare a context of the DC, but using the local CCACHE.
1464 my $overwrite = undef;
1465 $overwrite->{KRB5_CCACHE} = $ret->{KRB5_CCACHE};
1466 my $dc_cmd_env = $self->get_cmd_env_vars($dcvars, $overwrite);
1467
1468 # Setting up delegation runs in the context of the DC for now
1469 $cmd = $dc_cmd_env;
1470 $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1471 $cmd .= " $dcvars->{CONFIGURATION}";
1472 print $cmd;
1473
1474 unless (system($cmd) == 0) {
1475 warn("Delegation failed\n$cmd");
1476 return undef;
1477 }
1478
1479 # Setting up delegation runs in the context of the DC for now
1480 $cmd = $dc_cmd_env;
1481 $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1482 $cmd .= " $dcvars->{CONFIGURATION}";
1483
1484 unless (system($cmd) == 0) {
1485 warn("Delegation failed\n$cmd");
1486 return undef;
1487 }
1488
1489 $ret->{DOMSID} = $dcvars->{DOMSID};
1490 $self->set_pdc_env_vars($ret, $dcvars);
1491
1492 return $ret;
1493 }
1494
1495 sub provision_promoted_dc($$$)
1496 {
1497 my ($self, $prefix, $dcvars) = @_;
1498 print "PROVISIONING PROMOTED DC...\n";
1499
1500 # We do this so that we don't run the provision. That's the job of 'samba-tool domain dcpromo'.
1501 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1502 "promotedvdc",
1503 $dcvars->{DOMAIN},
1504 $dcvars->{REALM},
1505 $dcvars->{SAMSID},
1506 "2008",
1507 $dcvars->{PASSWORD},
1508 $dcvars->{SERVER_IP},
1509 $dcvars->{SERVER_IPV6});
1510
1511 $ctx->{smb_conf_extra_options} = "
1512 max xmit = 32K
1513 server max protocol = SMB2
1514
1515 ntlm auth = ntlmv2-only
1516
1517 kdc force enable rc4 weak session keys = yes
1518
1519 [sysvol]
1520 path = $ctx->{statedir}/sysvol
1521 read only = yes
1522
1523 [netlogon]
1524 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1525 read only = no
1526
1527 ";
1528
1529 my $ret = $self->provision_raw_step1($ctx);
1530 unless ($ret) {
1531 return undef;
1532 }
1533
1534 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1535 my $cmd = $self->get_cmd_env_vars($ret);
1536 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member MEMBER --realm=$dcvars->{REALM}";
1537 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1538 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1539
1540 unless (system($cmd) == 0) {
1541 warn("Join failed\n$cmd");
1542 return undef;
1543 }
1544
1545 $samba_tool = Samba::bindir_path($self, "samba-tool");
1546 $cmd = $self->get_cmd_env_vars($ret);
1547 $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1548 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1549 $cmd .= " --machinepass=machine$ret->{PASSWORD} --dns-backend=BIND9_DLZ";
1550
1551 unless (system($cmd) == 0) {
1552 warn("Join failed\n$cmd");
1553 return undef;
1554 }
1555
1556 $self->set_pdc_env_vars($ret, $dcvars);
1557
1558 return $ret;
1559 }
1560
1561 sub provision_vampire_dc($$$)
1562 {
1563 my ($self, $prefix, $dcvars, $fl) = @_;
1564 print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1565 my $name = "localvampiredc";
1566 my $extra_conf = "";
1567
1568 if ($fl == "2000") {
1569 $name = "vampire2000dc";
1570 } else {
1571 $extra_conf = "drs: immediate link sync = yes
1572 drs: max link sync = 250";
1573 }
1574
1575 # We do this so that we don't run the provision. That's the job of 'net vampire'.
1576 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1577 $name,
1578 $dcvars->{DOMAIN},
1579 $dcvars->{REALM},
1580 $dcvars->{DOMSID},
1581 $fl,
1582 $dcvars->{PASSWORD},
1583 $dcvars->{SERVER_IP},
1584 $dcvars->{SERVER_IPV6});
1585
1586 $ctx->{smb_conf_extra_options} = "
1587 max xmit = 32K
1588 server max protocol = SMB2
1589
1590 ntlm auth = mschapv2-and-ntlmv2-only
1591 $extra_conf
1592
1593 [sysvol]
1594 path = $ctx->{statedir}/sysvol
1595 read only = yes
1596
1597 [netlogon]
1598 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1599 read only = no
1600
1601 ";
1602
1603 my $ret = $self->provision_raw_step1($ctx);
1604 unless ($ret) {
1605 return undef;
1606 }
1607
1608 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1609 my $cmd = $self->get_cmd_env_vars($ret);
1610 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1611 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1612 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1613 $cmd .= " --backend-store=$self->{default_ldb_backend}";
1614
1615 unless (system($cmd) == 0) {
1616 warn("Join failed\n$cmd");
1617 return undef;
1618 }
1619
1620 $self->set_pdc_env_vars($ret, $dcvars);
1621 $ret->{DC_REALM} = $dcvars->{DC_REALM};
1622
1623 return $ret;
1624 }
1625
1626 sub provision_ad_dc_ntvfs($$$)
1627 {
1628 my ($self, $prefix, $extra_provision_options) = @_;
1629
1630 # We keep the old 'winbind' name here in server services to
1631 # ensure upgrades which used that name still work with the now
1632 # alias.
1633
1634 print "PROVISIONING AD DC (NTVFS)...\n";
1635 my $extra_conf_options = "netbios aliases = localDC1-a
1636 server services = +winbind -winbindd
1637 ldap server require strong auth = allow_sasl_without_tls_channel_bindings
1638 raw NTLMv2 auth = yes
1639 lsa over netlogon = yes
1640 rpc server port = 1027
1641 auth event notification = true
1642 dsdb event notification = true
1643 dsdb password event notification = true
1644 dsdb group change notification = true
1645 # override the new SMB2 only default
1646 client min protocol = CORE
1647 server min protocol = LANMAN1
1648
1649 server support krb5 netlogon = yes
1650 CVE_2020_1472:warn_about_unused_debug_level = 3
1651 CVE_2022_38023:warn_about_unused_debug_level = 3
1652 allow nt4 crypto:torturetest\$ = yes
1653 server reject md5 schannel:schannel2\$ = no
1654 server reject md5 schannel:schannel3\$ = no
1655 server reject md5 schannel:schannel8\$ = no
1656 server reject md5 schannel:schannel9\$ = no
1657 server reject md5 schannel:torturetest\$ = no
1658 server reject md5 schannel:tests4u2proxywk\$ = no
1659 server reject md5 schannel:tests4u2selfbdc\$ = no
1660 server reject md5 schannel:tests4u2selfwk\$ = no
1661 server reject md5 schannel:torturepacbdc\$ = no
1662 server reject md5 schannel:torturepacwksta\$ = no
1663 server reject aes schannel:schannel2\$ = no
1664 server reject aes schannel:schannel3\$ = no
1665 server reject aes schannel:schannel8\$ = no
1666 server reject aes schannel:schannel9\$ = no
1667 server reject aes schannel:torturetest\$ = no
1668 server reject aes schannel:tests4u2proxywk\$ = no
1669 server reject aes schannel:tests4u2selfbdc\$ = no
1670 server reject aes schannel:tests4u2selfwk\$ = no
1671 server reject aes schannel:torturepacbdc\$ = no
1672 server reject aes schannel:torturepacwksta\$ = no
1673 server require schannel:schannel0\$ = no
1674 server require schannel:schannel1\$ = no
1675 server require schannel:schannel2\$ = no
1676 server require schannel:schannel3\$ = no
1677 server require schannel:schannel4\$ = no
1678 server require schannel:schannel5\$ = no
1679 server require schannel:schannel6\$ = no
1680 server require schannel:schannel7\$ = no
1681 server require schannel:schannel8\$ = no
1682 server require schannel:schannel9\$ = no
1683 server require schannel:schannel10\$ = no
1684 server require schannel:schannel11\$ = no
1685 server require schannel:torturetest\$ = no
1686 server schannel require seal:schannel0\$ = no
1687 server schannel require seal:schannel1\$ = no
1688 server schannel require seal:schannel2\$ = no
1689 server schannel require seal:schannel3\$ = no
1690 server schannel require seal:schannel4\$ = no
1691 server schannel require seal:schannel5\$ = no
1692 server schannel require seal:schannel6\$ = no
1693 server schannel require seal:schannel7\$ = no
1694 server schannel require seal:schannel8\$ = no
1695 server schannel require seal:schannel9\$ = no
1696 server schannel require seal:schannel10\$ = no
1697 server schannel require seal:schannel11\$ = no
1698 server schannel require seal:torturetest\$ = no
1699
1700 # needed for 'samba.tests.auth_log' tests
1701 server require schannel:LOCALDC\$ = no
1702 server schannel require seal:LOCALDC\$ = no
1703 ";
1704 push (@{$extra_provision_options},
1705 "--base-schema=2008_R2",
1706 "--use-ntvfs");
1707 my $ret = $self->provision($prefix,
1708 "domain controller",
1709 "localdc",
1710 "SAMBADOMAIN",
1711 "samba.example.com",
1712 "2008",
1713 "locDCpass1",
1714 undef,
1715 undef,
1716 undef,
1717 $extra_conf_options,
1718 "",
1719 $extra_provision_options);
1720 unless ($ret) {
1721 return undef;
1722 }
1723
1724 unless($self->add_wins_config("$prefix/private")) {
1725 warn("Unable to add wins configuration");
1726 return undef;
1727 }
1728 $ret->{NETBIOSALIAS} = "localdc1-a";
1729 $ret->{DC_REALM} = $ret->{REALM};
1730
1731 return $ret;
1732 }
1733
1734 sub provision_fl2000dc($$)
1735 {
1736 my ($self, $prefix) = @_;
1737
1738 print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1739 my $extra_conf_options = "
1740 kdc enable fast = no
1741 spnego:simulate_w2k=yes
1742 ntlmssp_server:force_old_spnego=yes
1743
1744 CVE_2022_38023:warn_about_unused_debug_level = 3
1745 server reject md5 schannel:tests4u2proxywk\$ = no
1746 server reject md5 schannel:tests4u2selfbdc\$ = no
1747 server reject md5 schannel:tests4u2selfwk\$ = no
1748 server reject md5 schannel:torturepacbdc\$ = no
1749 server reject md5 schannel:torturepacwksta\$ = no
1750 server reject aes schannel:tests4u2proxywk\$ = no
1751 server reject aes schannel:tests4u2selfbdc\$ = no
1752 server reject aes schannel:tests4u2selfwk\$ = no
1753 server reject aes schannel:torturepacbdc\$ = no
1754 server reject aes schannel:torturepacwksta\$ = no
1755 ";
1756 my $extra_provision_options = ["--base-schema=2008_R2"];
1757 # This environment uses plain text secrets
1758 # i.e. secret attributes are not encrypted on disk.
1759 # This allows testing of the --plaintext-secrets option for
1760 # provision
1761 push (@{$extra_provision_options}, "--plaintext-secrets");
1762 my $ret = $self->provision($prefix,
1763 "domain controller",
1764 "dc5",
1765 "SAMBA2000",
1766 "samba2000.example.com",
1767 "2000",
1768 "locDCpass5",
1769 undef,
1770 undef,
1771 undef,
1772 $extra_conf_options,
1773 "",
1774 $extra_provision_options);
1775 unless ($ret) {
1776 return undef;
1777 }
1778
1779 unless($self->add_wins_config("$prefix/private")) {
1780 warn("Unable to add wins configuration");
1781 return undef;
1782 }
1783 $ret->{DC_REALM} = $ret->{REALM};
1784
1785 return $ret;
1786 }
1787
1788 sub provision_fl2003dc($$$)
1789 {
1790 my ($self, $prefix, $dcvars) = @_;
1791 my $ip_addr1 = Samba::get_ipv4_addr("fakednsforwarder1");
1792 my $ip_addr2 = Samba::get_ipv6_addr("fakednsforwarder2");
1793
1794 print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1795 my $extra_conf_options = "
1796 allow dns updates = nonsecure and secure
1797
1798 kdc enable fast = no
1799 dcesrv:header signing = no
1800 dcesrv:max auth states = 0
1801
1802 dns forwarder = $ip_addr1 [$ip_addr2]:54
1803
1804 CVE_2022_38023:warn_about_unused_debug_level = 3
1805 server reject md5 schannel:tests4u2proxywk\$ = no
1806 server reject md5 schannel:tests4u2selfbdc\$ = no
1807 server reject md5 schannel:tests4u2selfwk\$ = no
1808 server reject md5 schannel:torturepacbdc\$ = no
1809 server reject md5 schannel:torturepacwksta\$ = no
1810 server reject aes schannel:tests4u2proxywk\$ = no
1811 server reject aes schannel:tests4u2selfbdc\$ = no
1812 server reject aes schannel:tests4u2selfwk\$ = no
1813 server reject aes schannel:torturepacbdc\$ = no
1814 server reject aes schannel:torturepacwksta\$ = no
1815 ";
1816
1817 my $extra_provision_options = ["--base-schema=2008_R2"];
1818 my $ret = $self->provision($prefix,
1819 "domain controller",
1820 "dc6",
1821 "SAMBA2003",
1822 "samba2003.example.com",
1823 "2003",
1824 "locDCpass6",
1825 undef,
1826 undef,
1827 undef,
1828 $extra_conf_options,
1829 "",
1830 $extra_provision_options);
1831 unless (defined $ret) {
1832 return undef;
1833 }
1834
1835 $ret->{DNS_FORWARDER1} = $ip_addr1;
1836 $ret->{DNS_FORWARDER2} = $ip_addr2;
1837
1838 my @samba_tool_options;
1839 push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1840 push (@samba_tool_options, "domain");
1841 push (@samba_tool_options, "passwordsettings");
1842 push (@samba_tool_options, "set");
1843 push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1844 push (@samba_tool_options, "--min-pwd-age=0");
1845 push (@samba_tool_options, "--history-length=1");
1846
1847 my $samba_tool_cmd = join(" ", @samba_tool_options);
1848
1849 unless (system($samba_tool_cmd) == 0) {
1850 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1851 return undef;
1852 }
1853
1854 unless($self->add_wins_config("$prefix/private")) {
1855 warn("Unable to add wins configuration");
1856 return undef;
1857 }
1858
1859 return $ret;
1860 }
1861
1862 sub provision_fl2008r2dc($$$)
1863 {
1864 my ($self, $prefix, $dcvars) = @_;
1865
1866 print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1867 my $extra_conf_options = "
1868 ldap server require strong auth = no
1869 # delay by 10 seconds, 10^7 usecs
1870 ldap_server:delay_expire_disconnect = 10000
1871
1872 server support krb5 netlogon = yes
1873 CVE_2022_38023:warn_about_unused_debug_level = 3
1874 server reject md5 schannel:tests4u2proxywk\$ = no
1875 server reject md5 schannel:tests4u2selfbdc\$ = no
1876 server reject md5 schannel:tests4u2selfwk\$ = no
1877 server reject md5 schannel:torturepacbdc\$ = no
1878 server reject md5 schannel:torturepacwksta\$ = no
1879 server reject aes schannel:tests4u2proxywk\$ = no
1880 server reject aes schannel:tests4u2selfbdc\$ = no
1881 server reject aes schannel:tests4u2selfwk\$ = no
1882 server reject aes schannel:torturepacbdc\$ = no
1883 server reject aes schannel:torturepacwksta\$ = no
1884 ";
1885 my $extra_provision_options = ["--base-schema=2008_R2"];
1886 my $ret = $self->provision($prefix,
1887 "domain controller",
1888 "dc7",
1889 "SAMBA2008R2",
1890 "samba2008R2.example.com",
1891 "2008_R2",
1892 "locDCpass7",
1893 undef,
1894 undef,
1895 undef,
1896 $extra_conf_options,
1897 "",
1898 $extra_provision_options);
1899 unless (defined $ret) {
1900 return undef;
1901 }
1902
1903 unless ($self->add_wins_config("$prefix/private")) {
1904 warn("Unable to add wins configuration");
1905 return undef;
1906 }
1907 $ret->{DC_REALM} = $ret->{REALM};
1908
1909 return $ret;
1910 }
1911
1912
1913 sub provision_rodc($$$)
1914 {
1915 my ($self, $prefix, $dcvars) = @_;
1916 print "PROVISIONING RODC...\n";
1917
1918 # We do this so that we don't run the provision. That's the job of 'net join RODC'.
1919 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1920 "rodc",
1921 $dcvars->{DOMAIN},
1922 $dcvars->{REALM},
1923 $dcvars->{DOMSID},
1924 "2008",
1925 $dcvars->{PASSWORD},
1926 $dcvars->{SERVER_IP},
1927 $dcvars->{SERVER_IPV6});
1928 unless ($ctx) {
1929 return undef;
1930 }
1931
1932 $ctx->{share} = "$ctx->{prefix_abs}/share";
1933 push(@{$ctx->{directories}}, "$ctx->{share}");
1934
1935 $ctx->{smb_conf_extra_options} = "
1936 max xmit = 32K
1937 server max protocol = SMB2
1938 password server = $dcvars->{DC_SERVER}
1939
1940 [sysvol]
1941 path = $ctx->{statedir}/sysvol
1942 read only = yes
1943
1944 [netlogon]
1945 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1946 read only = yes
1947
1948 [tmp]
1949 path = $ctx->{share}
1950 read only = no
1951 posix:sharedelay = 10000
1952 posix:oplocktimeout = 3
1953 posix:writetimeupdatedelay = 50000
1954
1955 ";
1956
1957 my $ret = $self->provision_raw_step1($ctx);
1958 unless ($ret) {
1959 return undef;
1960 }
1961
1962 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1963 my $cmd = $self->get_cmd_env_vars($ret);
1964 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1965 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1966 $cmd .= " --server=$dcvars->{DC_SERVER}";
1967
1968 unless (system($cmd) == 0) {
1969 warn("RODC join failed\n$cmd");
1970 return undef;
1971 }
1972
1973 # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1974 # user password verified on the RODC
1975 my $testallowed_account = "testallowed account";
1976 $cmd = $self->get_cmd_env_vars($ret);
1977 $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1978 $cmd .= " --server=$dcvars->{DC_SERVER}";
1979
1980 unless (system($cmd) == 0) {
1981 warn("RODC join failed\n$cmd");
1982 return undef;
1983 }
1984
1985 # we overwrite the kdc after the RODC join
1986 # so that use the RODC as kdc and test
1987 # the proxy code
1988 $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1989 $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1990 Samba::mk_krb5_conf($ctx);
1991 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1992
1993 $self->set_pdc_env_vars($ret, $dcvars);
1994
1995 return $ret;
1996 }
1997
1998 sub read_config_h($)
1999 {
2000 my ($name) = @_;
2001 my %ret;
2002 open(LF, "<$name") or die("unable to read $name: $!");
2003 while (<LF>) {
2004 chomp;
2005 next if not (/^#define /);
2006 if (/^#define (.*?)[ \t]+(.*?)$/) {
2007 $ret{$1} = $2;
2008 next;
2009 }
2010 if (/^#define (.*?)[ \t]+$/) {
2011 $ret{$1} = 1;;
2012 next;
2013 }
2014 }
2015 close(LF);
2016 return \%ret;
2017 }
2018
2019 sub provision_ad_dc()
2020 {
2021 my ($self,
2022 $prefix,
2023 $hostname,
2024 $domain,
2025 $realm,
2026 $force_fips_mode,
2027 $smbconf_args,
2028 $extra_provision_options,
2029 $functional_level) = @_;
2030
2031 my $prefix_abs = abs_path($prefix);
2032
2033 my $bindir_abs = abs_path($self->{bindir});
2034 my $lockdir="$prefix_abs/lockdir";
2035 my $conffile="$prefix_abs/etc/smb.conf";
2036
2037 my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
2038 if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} // '' eq "1") {
2039 $require_mutexes = "";
2040 }
2041
2042 my $config_h = {};
2043
2044 if (!defined($functional_level)) {
2045 $functional_level = "2016";
2046 }
2047
2048 # If we choose to have distinct environments for experimental
2049 # 2012 as well as the experimental 2016 support, we should
2050 # extend what we match here.
2051 if ($functional_level eq "2016") {
2052 $smbconf_args = "$smbconf_args
2053
2054 [global]
2055 ad dc functional level = 2016
2056 ";
2057 }
2058 if (defined($ENV{CONFIG_H})) {
2059 $config_h = read_config_h($ENV{CONFIG_H});
2060 }
2061
2062 my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
2063 $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
2064
2065 my $extra_smbconf_options = "
2066 xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
2067
2068 dbwrap_tdb_mutexes:* = yes
2069 ${require_mutexes}
2070
2071 ${password_hash_gpg_key_ids}
2072
2073 kernel oplocks = no
2074 kernel change notify = no
2075 smb2 leases = no
2076 smb2 disable oplock break retry = yes
2077 server multi channel support = yes
2078
2079 logging = file
2080 printing = bsd
2081 printcap name = /dev/null
2082
2083 max protocol = SMB3
2084 read only = no
2085
2086 smbd:sharedelay = 100000
2087 smbd:writetimeupdatedelay = 500000
2088 create mask = 755
2089 dos filemode = yes
2090 check parent directory delete on close = yes
2091
2092 dcerpc endpoint servers = -winreg -srvsvc
2093
2094 printcap name = /dev/null
2095
2096 addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
2097 deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
2098
2099 printing = vlp
2100 print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
2101 lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
2102 lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
2103 lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
2104 lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
2105 queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
2106 queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
2107 lpq cache time = 0
2108 print notify backchannel = yes
2109
2110 server support krb5 netlogon = yes
2111 CVE_2020_1472:warn_about_unused_debug_level = 3
2112 CVE_2022_38023:warn_about_unused_debug_level = 3
2113 CVE_2022_38023:error_debug_level = 2
2114 allow nt4 crypto:samlogontest\$ = yes
2115 server reject md5 schannel:schannel2\$ = no
2116 server reject md5 schannel:schannel3\$ = no
2117 server reject md5 schannel:schannel8\$ = no
2118 server reject md5 schannel:schannel9\$ = no
2119 server reject md5 schannel:torturetest\$ = no
2120 server reject md5 schannel:tests4u2proxywk\$ = no
2121 server reject md5 schannel:tests4u2selfbdc\$ = no
2122 server reject md5 schannel:tests4u2selfwk\$ = no
2123 server reject md5 schannel:torturepacbdc\$ = no
2124 server reject md5 schannel:torturepacwksta\$ = no
2125 server reject md5 schannel:samlogontest\$ = no
2126 server reject aes schannel:schannel2\$ = no
2127 server reject aes schannel:schannel3\$ = no
2128 server reject aes schannel:schannel8\$ = no
2129 server reject aes schannel:schannel9\$ = no
2130 server reject aes schannel:torturetest\$ = no
2131 server reject aes schannel:tests4u2proxywk\$ = no
2132 server reject aes schannel:tests4u2selfbdc\$ = no
2133 server reject aes schannel:tests4u2selfwk\$ = no
2134 server reject aes schannel:torturepacbdc\$ = no
2135 server reject aes schannel:torturepacwksta\$ = no
2136 server reject aes schannel:samlogontest\$ = no
2137 server require schannel:schannel0\$ = no
2138 server require schannel:schannel1\$ = no
2139 server require schannel:schannel2\$ = no
2140 server require schannel:schannel3\$ = no
2141 server require schannel:schannel4\$ = no
2142 server require schannel:schannel5\$ = no
2143 server require schannel:schannel6\$ = no
2144 server require schannel:schannel7\$ = no
2145 server require schannel:schannel8\$ = no
2146 server require schannel:schannel9\$ = no
2147 server require schannel:schannel10\$ = no
2148 server require schannel:schannel11\$ = no
2149 server require schannel:torturetest\$ = no
2150 server schannel require seal:schannel0\$ = no
2151 server schannel require seal:schannel1\$ = no
2152 server schannel require seal:schannel2\$ = no
2153 server schannel require seal:schannel3\$ = no
2154 server schannel require seal:schannel4\$ = no
2155 server schannel require seal:schannel5\$ = no
2156 server schannel require seal:schannel6\$ = no
2157 server schannel require seal:schannel7\$ = no
2158 server schannel require seal:schannel8\$ = no
2159 server schannel require seal:schannel9\$ = no
2160 server schannel require seal:schannel10\$ = no
2161 server schannel require seal:schannel11\$ = no
2162 server schannel require seal:torturetest\$ = no
2163
2164 auth event notification = true
2165 dsdb event notification = true
2166 dsdb password event notification = true
2167 dsdb group change notification = true
2168 $smbconf_args
2169 ";
2170
2171 my $extra_smbconf_shares = "
2172
2173 [tmpenc]
2174 copy = tmp
2175 smb encrypt = required
2176
2177 [tmpcase]
2178 copy = tmp
2179 case sensitive = yes
2180
2181 [tmpguest]
2182 copy = tmp
2183 guest ok = yes
2184
2185 [hideunread]
2186 copy = tmp
2187 hide unreadable = yes
2188
2189 [durable]
2190 copy = tmp
2191 kernel share modes = no
2192 kernel oplocks = no
2193 posix locking = no
2194
2195 [print\$]
2196 copy = tmp
2197
2198 [print1]
2199 copy = tmp
2200 printable = yes
2201
2202 [print2]
2203 copy = print1
2204 [print3]
2205 copy = print1
2206 [print4]
2207 copy = print1
2208 guest ok = yes
2209 [lp]
2210 copy = print1
2211 ";
2212
2213 push (@{$extra_provision_options}, "--backend-store=$self->{default_ldb_backend}");
2214 print "PROVISIONING AD DC...\n";
2215 my $ret = $self->provision($prefix,
2216 "domain controller",
2217 $hostname,
2218 $domain,
2219 $realm,
2220 $functional_level,
2221 "locDCpass1",
2222 undef,
2223 undef,
2224 $force_fips_mode,
2225 $extra_smbconf_options,
2226 $extra_smbconf_shares,
2227 $extra_provision_options);
2228 unless (defined $ret) {
2229 return undef;
2230 }
2231
2232 unless($self->add_wins_config("$prefix/private")) {
2233 warn("Unable to add wins configuration");
2234 return undef;
2235 }
2236
2237 return $ret;
2238 }
2239
2240 sub provision_chgdcpass($$)
2241 {
2242 my ($self, $prefix) = @_;
2243
2244 print "PROVISIONING CHGDCPASS...\n";
2245 # This environment disallows the use of this password
2246 # (and also removes the default AD complexity checks)
2247 my $unacceptable_password = "Paßßword-widk3Dsle32jxdBdskldsk55klASKQ";
2248
2249 # This environment also sets some settings that are unusual,
2250 # to test specific behaviours. In particular, this
2251 # environment fails to correctly support DRSUAPI_DRS_GET_ANC
2252 # like Samba before 4.5 and DRSUAPI_DRS_GET_TGT before 4.8
2253 #
2254 # Additionally, disabling DRSUAPI_DRS_GET_TGT causes all links
2255 # to be sent last (in the final chunk), which is like Samba
2256 # before 4.8.
2257
2258 my $extra_smb_conf = "
2259 check password script = $self->{srcdir}/selftest/checkpassword_arg1.sh ${unacceptable_password}
2260 dcesrv:max auth states = 8
2261 drs:broken_samba_4.5_get_anc_emulation = true
2262 drs:get_tgt_support = false
2263 ";
2264 my $extra_provision_options = ["--dns-backend=BIND9_DLZ"];
2265 my $ret = $self->provision($prefix,
2266 "domain controller",
2267 "chgdcpass",
2268 "CHDCDOMAIN",
2269 "chgdcpassword.samba.example.com",
2270 "2008",
2271 "chgDCpass1",
2272 undef,
2273 undef,
2274 undef,
2275 $extra_smb_conf,
2276 "",
2277 $extra_provision_options);
2278 unless (defined $ret) {
2279 return undef;
2280 }
2281
2282 unless($self->add_wins_config("$prefix/private")) {
2283 warn("Unable to add wins configuration");
2284 return undef;
2285 }
2286
2287 # Remove secrets.tdb from this environment to test that we
2288 # still start up on systems without the new matching
2289 # secrets.tdb records.
2290 unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
2291 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
2292 return undef;
2293 }
2294
2295 $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
2296
2297 return $ret;
2298 }
2299
2300 sub teardown_env_terminate($$)
2301 {
2302 my ($self, $envvars) = @_;
2303 my $pid;
2304
2305 # This should cause samba to terminate gracefully
2306 my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
2307 my $cmd = "";
2308 $cmd .= "$smbcontrol samba shutdown $envvars->{CONFIGURATION}";
2309 my $ret = system($cmd);
2310 if ($ret != 0) {
2311 warn "'$cmd' failed with '$ret'\n";
2312 }
2313
2314 # This should cause samba to terminate gracefully
2315 close($envvars->{STDIN_PIPE});
2316
2317 $pid = $envvars->{SAMBA_PID};
2318 my $count = 0;
2319 my $childpid;
2320
2321 # This should give it time to write out the gcov data
2322 until ($count > 15) {
2323 if (Samba::cleanup_child($pid, "samba") != 0) {
2324 return;
2325 }
2326 sleep(1);
2327 $count++;
2328 }
2329
2330 # After 15 Seconds, work out why this thing is still alive
2331 warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
2332 system("$self->{srcdir}/selftest/gdb_backtrace $pid");
2333
2334 until ($count > 30) {
2335 if (Samba::cleanup_child($pid, "samba") != 0) {
2336 return;
2337 }
2338 sleep(1);
2339 $count++;
2340 }
2341
2342 if (kill(0, $pid)) {
2343 warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
2344 kill "TERM", $pid;
2345 }
2346
2347 until ($count > 40) {
2348 if (Samba::cleanup_child($pid, "samba") != 0) {
2349 return;
2350 }
2351 sleep(1);
2352 $count++;
2353 }
2354 # If it is still around, kill it
2355 if (kill(0, $pid)) {
2356 warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
2357 kill 9, $pid;
2358 }
2359 return;
2360 }
2361
2362 sub teardown_env($$)
2363 {
2364 my ($self, $envvars) = @_;
2365 teardown_env_terminate($self, $envvars);
2366
2367 print $self->getlog_env($envvars);
2368
2369 return;
2370 }
2371
2372 sub getlog_env($$)
2373 {
2374 my ($self, $envvars) = @_;
2375 my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
2376 my $out = $title;
2377
2378 open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
2379
2380 seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
2381 while (<LOG>) {
2382 $out .= $_;
2383 }
2384 $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
2385 close(LOG);
2386
2387 return "" if $out eq $title;
2388
2389 return $out;
2390 }
2391
2392 sub check_env($$)
2393 {
2394 my ($self, $envvars) = @_;
2395 my $samba_pid = $envvars->{SAMBA_PID};
2396
2397 if (not defined($samba_pid)) {
2398 return 0;
2399 } elsif ($samba_pid > 0) {
2400 my $childpid = Samba::cleanup_child($samba_pid, "samba");
2401
2402 if ($childpid == 0) {
2403 return 1;
2404 }
2405 return 0;
2406 } else {
2407 return 1;
2408 }
2409 }
2410
2411 # Declare the environments Samba4 makes available.
2412 # To be set up, they will be called as
2413 # samba4->setup_$envname($self, $path, $dep_1_vars, $dep_2_vars, ...)
2414 # The interdependencies between the testenvs are declared below. Some testenvs
2415 # are dependent on another testenv running first, e.g. vampire_dc is dependent
2416 # on ad_dc_ntvfs because vampire_dc joins ad_dc_ntvfs's domain. All DCs are
2417 # dependent on dns_hub, which handles resolving DNS queries for the realm.
2418 %Samba4::ENV_DEPS = (
2419 # name => [dep_1, dep_2, ...],
2420 dns_hub => [],
2421 ad_dc_ntvfs => ["dns_hub"],
2422 ad_dc_fips => ["dns_hub"],
2423 ad_dc => ["dns_hub"],
2424 ad_dc_smb1 => ["dns_hub"],
2425 ad_dc_smb1_done => ["ad_dc_smb1"],
2426 ad_dc_no_nss => ["dns_hub"],
2427 ad_dc_no_ntlm => ["dns_hub"],
2428
2429 fl2008r2dc => ["ad_dc", "nt4_dc"],
2430 fl2003dc => ["ad_dc"],
2431 fl2000dc => ["ad_dc"],
2432
2433 vampire_2000_dc => ["fl2000dc"],
2434 vampire_dc => ["ad_dc_ntvfs"],
2435 promoted_dc => ["ad_dc_ntvfs"],
2436
2437 rodc => ["ad_dc_ntvfs"],
2438 rpc_proxy => ["ad_dc_ntvfs"],
2439 chgdcpass => ["dns_hub"],
2440
2441 s4member_dflt_domain => ["ad_dc_ntvfs"],
2442 s4member => ["ad_dc_ntvfs"],
2443
2444 # envs that test the server process model
2445 proclimitdc => ["dns_hub"],
2446 preforkrestartdc => ["dns_hub"],
2447
2448 # backup/restore testenvs
2449 backupfromdc => ["dns_hub"],
2450 customdc => ["dns_hub"],
2451 restoredc => ["backupfromdc"],
2452 renamedc => ["backupfromdc"],
2453 offlinebackupdc => ["backupfromdc"],
2454 labdc => ["backupfromdc"],
2455
2456 # aliases in order to split autobuild tasks
2457 fl2008dc => ["ad_dc_ntvfs"],
2458 ad_dc_default => ["ad_dc"],
2459 ad_dc_default_smb1 => ["ad_dc_smb1"],
2460 ad_dc_default_smb1_done => ["ad_dc_default_smb1"],
2461 ad_dc_slowtests => ["ad_dc"],
2462 ad_dc_backup => ["ad_dc"],
2463
2464 schema_dc => ["dns_hub"],
2465 schema_pair_dc => ["schema_dc"],
2466
2467 none => [],
2468 );
2469
2470 %Samba4::ENV_DEPS_POST = (
2471 schema_dc => ["schema_pair_dc"],
2472 );
2473
2474 sub return_alias_env
2475 {
2476 my ($self, $path, $env) = @_;
2477
2478 # just an alias
2479 return $env;
2480 }
2481
2482 sub setup_fl2008dc
2483 {
2484 my ($self, $path, $dep_env) = @_;
2485 return $self->return_alias_env($path, $dep_env)
2486 }
2487
2488 sub setup_ad_dc_default
2489 {
2490 my ($self, $path, $dep_env) = @_;
2491 return $self->return_alias_env($path, $dep_env)
2492 }
2493
2494 sub setup_ad_dc_default_smb1
2495 {
2496 my ($self, $path, $dep_env) = @_;
2497 return $self->return_alias_env($path, $dep_env)
2498 }
2499
2500 sub setup_ad_dc_default_smb1_done
2501 {
2502 my ($self, $path, $dep_env) = @_;
2503 return $self->return_alias_env($path, $dep_env)
2504 }
2505
2506 sub setup_ad_dc_slowtests
2507 {
2508 my ($self, $path, $dep_env) = @_;
2509 return $self->return_alias_env($path, $dep_env)
2510 }
2511
2512 sub setup_ad_dc_backup
2513 {
2514 my ($self, $path, $dep_env) = @_;
2515 return $self->return_alias_env($path, $dep_env)
2516 }
2517
2518 sub setup_s4member
2519 {
2520 my ($self, $path, $dc_vars) = @_;
2521
2522 my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2523
2524 if (defined $env) {
2525 if (not defined($self->check_or_start($env, "standard"))) {
2526 return undef;
2527 }
2528 }
2529
2530 return $env;
2531 }
2532
2533 sub setup_s4member_dflt_domain
2534 {
2535 my ($self, $path, $dc_vars) = @_;
2536
2537 my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2538 "winbind use default domain = yes");
2539
2540 if (defined $env) {
2541 if (not defined($self->check_or_start($env, "standard"))) {
2542 return undef;
2543 }
2544 }
2545
2546 return $env;
2547 }
2548
2549 sub setup_rpc_proxy
2550 {
2551 my ($self, $path, $dc_vars) = @_;
2552
2553 my $env = $self->provision_rpc_proxy($path, $dc_vars);
2554
2555 if (defined $env) {
2556 if (not defined($self->check_or_start($env, "standard"))) {
2557 return undef;
2558 }
2559 }
2560 return $env;
2561 }
2562
2563 sub setup_ad_dc_ntvfs
2564 {
2565 my ($self, $path) = @_;
2566
2567 my $env = $self->provision_ad_dc_ntvfs($path, undef);
2568 if (defined $env) {
2569 if (not defined($self->check_or_start($env, "standard"))) {
2570 warn("Failed to start ad_dc_ntvfs");
2571 return undef;
2572 }
2573 }
2574 return $env;
2575 }
2576
2577 sub setup_chgdcpass
2578 {
2579 my ($self, $path) = @_;
2580
2581 my $env = $self->provision_chgdcpass($path);
2582 if (defined $env) {
2583 if (not defined($self->check_or_start($env, "standard"))) {
2584 return undef;
2585 }
2586 }
2587 return $env;
2588 }
2589
2590 sub setup_fl2000dc
2591 {
2592 my ($self, $path, $dc_vars) = @_;
2593
2594 my $env = $self->provision_fl2000dc($path);
2595 if (defined $env) {
2596 if (not defined($self->check_or_start($env, "standard"))) {
2597 return undef;
2598 }
2599
2600 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys --direction=outgoing");
2601 }
2602
2603 return $env;
2604 }
2605
2606 sub setup_fl2003dc
2607 {
2608 my ($self, $path, $dc_vars) = @_;
2609
2610 my $env = $self->provision_fl2003dc($path);
2611
2612 if (defined $env) {
2613 if (not defined($self->check_or_start($env, "standard"))) {
2614 return undef;
2615 }
2616
2617 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2618 }
2619 return $env;
2620 }
2621
2622 sub setup_fl2008r2dc
2623 {
2624 my ($self, $path, $ad_dc_vars, $nt4_dc_vars) = @_;
2625
2626 my $env = $self->provision_fl2008r2dc($path);
2627
2628 if (!defined $env) {
2629 return $env;
2630 }
2631
2632 if (not defined($self->check_or_start($env, "standard"))) {
2633 return undef;
2634 }
2635
2636 my $upn_array = ["$env->{REALM}.upn"];
2637 my $spn_array = ["$env->{REALM}.spn"];
2638
2639 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2640 return undef;
2641 }
2642
2643 $env = $self->setup_trust($env, $ad_dc_vars, "forest", "");
2644 if (!defined $env) {
2645 return undef;
2646 }
2647
2648 my $net = Samba::bindir_path($self, "net");
2649 my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
2650
2651 my $trustpw = "TrUsTpW";
2652 $trustpw .= "$env->{SOCKET_WRAPPER_DEFAULT_IFACE}";
2653 $trustpw .= "$nt4_dc_vars->{SOCKET_WRAPPER_DEFAULT_IFACE}";
2654
2655 my $cmd_env = $self->get_cmd_env_vars($env);
2656 my $cmd = $cmd_env;
2657 $cmd .= "$net rpc trust create ";
2658 $cmd .= "otherdomainsid=$nt4_dc_vars->{SAMSID} ";
2659 $cmd .= "otherdomain=$nt4_dc_vars->{DOMAIN} ";
2660 $cmd .= "other_netbios_domain=$nt4_dc_vars->{DOMAIN} ";
2661 $cmd .= "trustpw=$trustpw ";
2662 $cmd .= "$env->{CONFIGURATION} ";
2663 $cmd .= "-U $env->{DOMAIN}/$env->{USERNAME}\%$env->{PASSWORD} ";
2664
2665 if (system($cmd) != 0) {
2666 warn("net rpc trust create failed\n$cmd");
2667 return undef;
2668 }
2669
2670 my $nt4_cmd_env = $self->get_cmd_env_vars($nt4_dc_vars);
2671 $cmd = $nt4_cmd_env;
2672 $cmd .= "$net rpc trustdom establish $env->{DOMAIN} -U/%$trustpw $nt4_dc_vars->{CONFIGURATION}";
2673
2674 if (system($cmd) != 0) {
2675 warn("add failed\n$cmd");
2676 return undef;
2677 }
2678
2679 # Reload trusts
2680 $cmd = $nt4_cmd_env;
2681 $cmd .= "$smbcontrol winbindd reload-config $nt4_dc_vars->{CONFIGURATION}";
2682
2683 if (system($cmd) != 0) {
2684 warn("add failed\n$cmd");
2685 return undef;
2686 }
2687
2688 $env->{NT4_TRUST_SERVER} = $nt4_dc_vars->{SERVER};
2689 $env->{NT4_TRUST_SERVER_IP} = $nt4_dc_vars->{SERVER_IP};
2690 $env->{NT4_TRUST_DOMAIN} = $nt4_dc_vars->{DOMAIN};
2691 $env->{NT4_TRUST_DOMSID} = $nt4_dc_vars->{DOMSID};
2692
2693 return $env;
2694 }
2695
2696 sub setup_vampire_dc
2697 {
2698 return setup_generic_vampire_dc(@_, "2008");
2699 }
2700
2701 sub setup_vampire_2000_dc
2702 {
2703 return setup_generic_vampire_dc(@_, "2000");
2704 }
2705
2706 sub setup_generic_vampire_dc
2707 {
2708 my ($self, $path, $dc_vars, $fl) = @_;
2709
2710 my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2711
2712 if (defined $env) {
2713 if (not defined($self->check_or_start($env, "single"))) {
2714 return undef;
2715 }
2716
2717 # force replicated DC to update repsTo/repsFrom
2718 # for vampired partitions
2719 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2720
2721 # as 'vampired' dc may add data in its local replica
2722 # we need to synchronize data between DCs
2723 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2724 my $cmd = $self->get_cmd_env_vars($env);
2725 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2726 $cmd .= " $dc_vars->{CONFIGURATION}";
2727 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2728 # replicate Configuration NC
2729 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2730 unless(system($cmd_repl) == 0) {
2731 warn("Failed to replicate\n$cmd_repl");
2732 return undef;
2733 }
2734 # replicate Default NC
2735 $cmd_repl = "$cmd \"$base_dn\"";
2736 unless(system($cmd_repl) == 0) {
2737 warn("Failed to replicate\n$cmd_repl");
2738 return undef;
2739 }
2740
2741 # Pull in a full set of changes from the main DC
2742 $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2743 $cmd = $self->get_cmd_env_vars($env);
2744 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2745 $cmd .= " $dc_vars->{CONFIGURATION}";
2746 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2747 # replicate Configuration NC
2748 $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2749 unless(system($cmd_repl) == 0) {
2750 warn("Failed to replicate\n$cmd_repl");
2751 return undef;
2752 }
2753 # replicate Default NC
2754 $cmd_repl = "$cmd \"$base_dn\"";
2755 unless(system($cmd_repl) == 0) {
2756 warn("Failed to replicate\n$cmd_repl");
2757 return undef;
2758 }
2759 }
2760
2761 return $env;
2762 }
2763
2764 sub setup_promoted_dc
2765 {
2766 my ($self, $path, $dc_vars) = @_;
2767
2768 my $env = $self->provision_promoted_dc($path, $dc_vars);
2769
2770 if (defined $env) {
2771 if (not defined($self->check_or_start($env, "single"))) {
2772 return undef;
2773 }
2774
2775 # force source and replicated DC to update repsTo/repsFrom
2776 # for vampired partitions
2777 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2778 my $cmd = $self->get_cmd_env_vars($env);
2779 # as 'vampired' dc may add data in its local replica
2780 # we need to synchronize data between DCs
2781 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2782 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2783 $cmd .= " $dc_vars->{CONFIGURATION}";
2784 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2785 # replicate Configuration NC
2786 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2787 unless(system($cmd_repl) == 0) {
2788 warn("Failed to replicate\n$cmd_repl");
2789 return undef;
2790 }
2791 # replicate Default NC
2792 $cmd_repl = "$cmd \"$base_dn\"";
2793 unless(system($cmd_repl) == 0) {
2794 warn("Failed to replicate\n$cmd_repl");
2795 return undef;
2796 }
2797 }
2798
2799 return $env;
2800 }
2801
2802 sub setup_rodc
2803 {
2804 my ($self, $path, $dc_vars) = @_;
2805
2806 my $env = $self->provision_rodc($path, $dc_vars);
2807
2808 unless ($env) {
2809 return undef;
2810 }
2811
2812 if (not defined($self->check_or_start($env, "standard"))) {
2813 return undef;
2814 }
2815
2816 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2817 my $cmd = $self->get_cmd_env_vars($env);
2818
2819 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2820 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2821 $cmd .= " $dc_vars->{CONFIGURATION}";
2822 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2823 # replicate Configuration NC
2824 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2825 unless(system($cmd_repl) == 0) {
2826 warn("Failed to replicate\n$cmd_repl");
2827 return undef;
2828 }
2829 # replicate Default NC
2830 $cmd_repl = "$cmd \"$base_dn\"";
2831 unless(system($cmd_repl) == 0) {
2832 warn("Failed to replicate\n$cmd_repl");
2833 return undef;
2834 }
2835
2836 return $env;
2837 }
2838
2839 sub _setup_ad_dc
2840 {
2841 my ($self, $path, $conf_opts, $server, $dom, $functional_level) = @_;
2842
2843 # If we didn't build with ADS, pretend this env was never available
2844 if (not $self->{target3}->have_ads()) {
2845 return "UNKNOWN";
2846 }
2847
2848 if (!defined($conf_opts)) {
2849 $conf_opts = "";
2850 }
2851 if (!defined($server)) {
2852 $server = "addc";
2853 }
2854 if (!defined($dom)) {
2855 $dom = "addom.samba.example.com";
2856 }
2857 my $env = $self->provision_ad_dc($path, $server, "ADDOMAIN",
2858 $dom,
2859 undef,
2860 $conf_opts,
2861 undef,
2862 $functional_level);
2863 unless ($env) {
2864 return undef;
2865 }
2866
2867 if (not defined($self->check_or_start($env, "prefork"))) {
2868 return undef;
2869 }
2870
2871 my $upn_array = ["$env->{REALM}.upn"];
2872 my $spn_array = ["$env->{REALM}.spn"];
2873
2874 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2875 return undef;
2876 }
2877
2878 return $env;
2879 }
2880
2881 sub setup_ad_dc
2882 {
2883 my ($self, $path) = @_;
2884 return _setup_ad_dc($self, $path, undef, undef, undef);
2885 }
2886
2887 sub setup_ad_dc_smb1
2888 {
2889 my ($self, $path) = @_;
2890 my $conf_opts = "
2891 [global]
2892 client min protocol = CORE
2893 server min protocol = LANMAN1
2894
2895 # needed for 'samba.tests.auth_log' tests
2896 server require schannel:ADDCSMB1\$ = no
2897 server schannel require seal:ADDCSMB1\$ = no
2898 ";
2899 return _setup_ad_dc($self, $path, $conf_opts, "addcsmb1", "addom2.samba.example.com");
2900 }
2901
2902 sub setup_ad_dc_smb1_done
2903 {
2904 my ($self, $path, $dep_env) = @_;
2905 return $self->return_alias_env($path, $dep_env);
2906 }
2907
2908 sub setup_ad_dc_no_nss
2909 {
2910 my ($self, $path) = @_;
2911
2912 # If we didn't build with ADS, pretend this env was never available
2913 if (not $self->{target3}->have_ads()) {
2914 return "UNKNOWN";
2915 }
2916
2917 my $env = $self->provision_ad_dc($path,
2918 "addc_no_nss",
2919 "ADNONSSDOMAIN",
2920 "adnonssdom.samba.example.com",
2921 undef,
2922 "",
2923 undef);
2924 unless ($env) {
2925 return undef;
2926 }
2927
2928 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2929 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2930
2931 if (not defined($self->check_or_start($env, "single"))) {
2932 return undef;
2933 }
2934
2935 my $upn_array = ["$env->{REALM}.upn"];
2936 my $spn_array = ["$env->{REALM}.spn"];
2937
2938 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2939 return undef;
2940 }
2941
2942 return $env;
2943 }
2944
2945 sub setup_ad_dc_no_ntlm
2946 {
2947 my ($self, $path) = @_;
2948
2949 # If we didn't build with ADS, pretend this env was never available
2950 if (not $self->{target3}->have_ads()) {
2951 return "UNKNOWN";
2952 }
2953
2954 my $env = $self->provision_ad_dc($path,
2955 "addc_no_ntlm",
2956 "ADNONTLMDOMAIN",
2957 "adnontlmdom.samba.example.com",
2958 undef,
2959 "ntlm auth = disabled\nnt hash store = never",
2960 undef);
2961 unless ($env) {
2962 return undef;
2963 }
2964
2965 if (not defined($self->check_or_start($env, "prefork"))) {
2966 return undef;
2967 }
2968
2969 my $upn_array = ["$env->{REALM}.upn"];
2970 my $spn_array = ["$env->{REALM}.spn"];
2971
2972 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2973 return undef;
2974 }
2975
2976 return $env;
2977 }
2978
2979 sub setup_ad_dc_fips
2980 {
2981 my ($self, $path) = @_;
2982
2983 # If we didn't build with ADS, pretend this env was never available
2984 if (not $self->{target3}->have_ads()) {
2985 return "UNKNOWN";
2986 }
2987
2988 my $env = $self->provision_ad_dc($path,
2989 "fipsdc",
2990 "FIPSDOMAIN",
2991 "fips.samba.example.com",
2992 1,
2993 "",
2994 undef);
2995 unless ($env) {
2996 return undef;
2997 }
2998
2999 if (not defined($self->check_or_start($env, "prefork"))) {
3000 return undef;
3001 }
3002
3003 my $upn_array = ["$env->{REALM}.upn"];
3004 my $spn_array = ["$env->{REALM}.spn"];
3005
3006 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3007 return undef;
3008 }
3009
3010 return $env;
3011 }
3012
3013 #
3014 # AD DC test environment used solely to test pre-fork process restarts.
3015 # As processes get killed off and restarted it should not be used for other
3016 sub setup_preforkrestartdc
3017 {
3018 my ($self, $path) = @_;
3019
3020 # If we didn't build with ADS, pretend this env was never available
3021 if (not $self->{target3}->have_ads()) {
3022 return "UNKNOWN";
3023 }
3024
3025 # note DC name must be <= 15 chars so we use 'prockill' instead of
3026 # 'preforkrestart'
3027 my $env = $self->provision_ad_dc($path,
3028 "prockilldc",
3029 "PROCKILLDOMAIN",
3030 "prockilldom.samba.example.com",
3031 undef,
3032 "prefork backoff increment = 5\nprefork maximum backoff=10",
3033 undef);
3034 unless ($env) {
3035 return undef;
3036 }
3037
3038 # We treat processes in this environment cruelly, sometimes
3039 # sending them SIGSEGV signals. We don't need gdb_backtrace
3040 # dissecting these fake crashes in precise detail.
3041 $env->{PLEASE_NO_GDB_BACKTRACE} = '1';
3042
3043 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
3044 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
3045
3046 if (not defined($self->check_or_start($env, "prefork"))) {
3047 return undef;
3048 }
3049
3050 my $upn_array = ["$env->{REALM}.upn"];
3051 my $spn_array = ["$env->{REALM}.spn"];
3052
3053 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3054 return undef;
3055 }
3056
3057 return $env;
3058 }
3059
3060 #
3061 # ad_dc test environment used solely to test standard process model connection
3062 # process limits. As the limit is set artificially low it should not be used
3063 # for other tests.
3064 sub setup_proclimitdc
3065 {
3066 my ($self, $path) = @_;
3067
3068 # If we didn't build with ADS, pretend this env was never available
3069 if (not $self->{target3}->have_ads()) {
3070 return "UNKNOWN";
3071 }
3072
3073 my $env = $self->provision_ad_dc($path,
3074 "proclimitdc",
3075 "PROCLIMITDOM",
3076 "proclimit.samba.example.com",
3077 undef,
3078 "max smbd processes = 20",
3079 undef);
3080 unless ($env) {
3081 return undef;
3082 }
3083
3084 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
3085 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
3086
3087 if (not defined($self->check_or_start($env, "standard"))) {
3088 return undef;
3089 }
3090
3091 my $upn_array = ["$env->{REALM}.upn"];
3092 my $spn_array = ["$env->{REALM}.spn"];
3093
3094 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3095 return undef;
3096 }
3097
3098 return $env;
3099 }
3100
3101 # Used to test a live upgrade of the schema on a 2 DC network.
3102 sub setup_schema_dc
3103 {
3104 my ($self, $path) = @_;
3105
3106 # provision the PDC using an older base schema
3107 my $provision_args = ["--base-schema=2008_R2", "--backend-store=$self->{default_ldb_backend}"];
3108
3109 # We set the functional level to 2008_R2 to match the older
3110 # base-schema (to allow schema upgrade to be tested)
3111 my $env = $self->provision_ad_dc($path,
3112 "liveupgrade1dc",
3113 "SCHEMADOMAIN",
3114 "schema.samba.example.com",
3115 undef,
3116 "drs: max link sync = 2",
3117 $provision_args,
3118 "2008_R2");
3119 unless ($env) {
3120 return undef;
3121 }
3122
3123 if (not defined($self->check_or_start($env, "prefork"))) {
3124 return undef;
3125 }
3126
3127 my $upn_array = ["$env->{REALM}.upn"];
3128 my $spn_array = ["$env->{REALM}.spn"];
3129
3130 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3131 return undef;
3132 }
3133
3134 return $env;
3135 }
3136
3137 # the second DC in the live schema upgrade pair
3138 sub setup_schema_pair_dc
3139 {
3140 # note: dcvars contains the env info for the dependent testenv ('schema_dc')
3141 my ($self, $prefix, $dcvars) = @_;
3142 print "Preparing SCHEMA UPGRADE PAIR DC...\n";
3143
3144 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "liveupgrade2dc",
3145 $dcvars->{DOMAIN},
3146 $dcvars->{REALM},
3147 $dcvars->{PASSWORD},
3148 "");
3149
3150 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3151 my $cmd_vars = $self->get_cmd_env_vars($env);
3152
3153 my $join_cmd = $cmd_vars;
3154 $join_cmd .= "$samba_tool domain join $env->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
3155 $join_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} ";
3156 $join_cmd .= " --backend-store=$self->{default_ldb_backend}";
3157
3158 my $upgrade_cmd = $cmd_vars;
3159 $upgrade_cmd .= "$samba_tool domain schemaupgrade $dcvars->{CONFIGURATION}";
3160 $upgrade_cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
3161
3162 my $repl_cmd = $cmd_vars;
3163 $repl_cmd .= "$samba_tool drs replicate $env->{SERVER} $dcvars->{SERVER}";
3164 $repl_cmd .= " CN=Schema,CN=Configuration,DC=schema,DC=samba,DC=example,DC=com";
3165 $repl_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
3166
3167 unless (system($join_cmd) == 0) {
3168 warn("Join failed\n$join_cmd");
3169 return undef;
3170 }
3171
3172 $env->{DC_SERVER} = $dcvars->{SERVER};
3173 $env->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
3174 $env->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
3175 $env->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
3176
3177 # start samba for the new DC
3178 if (not defined($self->check_or_start($env, "standard"))) {
3179 return undef;
3180 }
3181
3182 unless (system($upgrade_cmd) == 0) {
3183 warn("Schema upgrade failed\n$upgrade_cmd");
3184 return undef;
3185 }
3186
3187 unless (system($repl_cmd) == 0) {
3188 warn("Post-update schema replication failed\n$repl_cmd");
3189 return undef;
3190 }
3191
3192 return $env;
3193 }
3194
3195 # Sets up a DC that's solely used to do a domain backup from. We then use the
3196 # backupfrom-DC to create the restore-DC - this proves that the backup/restore
3197 # process will create a Samba DC that will actually start up.
3198 # We don't use the backup-DC for anything else because its domain will conflict
3199 # with the restore DC.
3200 sub setup_backupfromdc
3201 {
3202 my ($self, $path) = @_;
3203
3204 # If we didn't build with ADS, pretend this env was never available
3205 if (not $self->{target3}->have_ads()) {
3206 return "UNKNOWN";
3207 }
3208
3209 my $provision_args = ["--site=Backup-Site"];
3210
3211 my $env = $self->provision_ad_dc($path,
3212 "backupfromdc",
3213 "BACKUPDOMAIN",
3214 "backupdom.samba.example.com",
3215 undef,
3216 "samba kcc command = /bin/true",
3217 $provision_args);
3218 unless ($env) {
3219 return undef;
3220 }
3221
3222 if (not defined($self->check_or_start($env))) {
3223 return undef;
3224 }
3225
3226 my $upn_array = ["$env->{REALM}.upn"];
3227 my $spn_array = ["$env->{REALM}.spn"];
3228
3229 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3230 return undef;
3231 }
3232
3233 # Set up a dangling forward link to an expunged object
3234 #
3235 # We need this to ensure that the "samba-tool domain backup rename"
3236 # that is part of the creation of the labdc environment can
3237 # cope with this situation on the source DC.
3238
3239 if (not $self->write_ldb_file("$env->{PRIVATEDIR}/sam.ldb", "
3240 dn: ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3241 objectclass: organizationalUnit
3242 -
3243
3244 dn: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3245 objectclass: msExchConfigurationContainer
3246 -
3247
3248 dn: cn=linkfrom,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3249 objectclass: msExchConfigurationContainer
3250 addressBookRoots: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3251 -
3252
3253 ")) {
3254 return undef;
3255 }
3256 my $ldbdel = Samba::bindir_path($self, "ldbdel");
3257 my $cmd = "$ldbdel -H $env->{PRIVATEDIR}/sam.ldb cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com";
3258
3259 unless(system($cmd) == 0) {
3260 warn("Failed to delete link target: \n$cmd");
3261 return undef;
3262 }
3263
3264 # Expunge will ensure that linkto is totally wiped from the DB
3265 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3266 $cmd = "$samba_tool domain tombstones expunge --tombstone-lifetime=0 $env->{CONFIGURATION}";
3267
3268 unless(system($cmd) == 0) {
3269 warn("Failed to expunge link target: \n$cmd");
3270 return undef;
3271 }
3272 return $env;
3273 }
3274
3275 # returns the server/user-auth params needed to run an online backup cmd
3276 sub get_backup_server_args
3277 {
3278 # dcvars contains the env info for the backup DC testenv
3279 my ($self, $dcvars) = @_;
3280 my $server = $dcvars->{DC_SERVER_IP};
3281 my $server_args = "--server=$server ";
3282 $server_args .= "-U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
3283 $server_args .= " $dcvars->{CONFIGURATION}";
3284
3285 return $server_args;
3286 }
3287
3288 # Creates a backup of a running testenv DC
3289 sub create_backup
3290 {
3291 # note: dcvars contains the env info for the backup DC testenv
3292 my ($self, $env, $dcvars, $backupdir, $backup_cmd) = @_;
3293
3294 # get all the env variables we pass in with the samba-tool command
3295 # Note: use the backupfrom-DC's krb5.conf to do the backup
3296 my $overwrite = undef;
3297 $overwrite->{KRB5_CONFIG} = $dcvars->{KRB5_CONFIG};
3298 my $cmd_env = $self->get_cmd_env_vars($env, $overwrite);
3299
3300 # use samba-tool to create a backup from the 'backupfromdc' DC
3301 my $cmd = "";
3302 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3303
3304 $cmd .= "$cmd_env $samba_tool domain backup $backup_cmd";
3305 $cmd .= " --targetdir=$backupdir";
3306
3307 print "Executing: $cmd\n";
3308 unless(system($cmd) == 0) {
3309 warn("Failed to create backup using: \n$cmd");
3310 return undef;
3311 }
3312
3313 # get the name of the backup file created
3314 opendir(DIR, $backupdir);
3315 my @files = grep(/\.tar/, readdir(DIR));
3316 closedir(DIR);
3317
3318 if(scalar @files != 1) {
3319 warn("Backup file not found in directory $backupdir\n");
3320 return undef;
3321 }
3322 my $backup_file = "$backupdir/$files[0]";
3323 print "Using backup file $backup_file...\n";
3324
3325 return $backup_file;
3326 }
3327
3328 # Restores a backup-file to populate a testenv for a new DC
3329 sub restore_backup_file
3330 {
3331 my ($self, $backup_file, $restore_opts, $restoredir, $smbconf) = @_;
3332
3333 # pass the restore command the testenv's smb.conf that we've already
3334 # generated. But move it to a temp-dir first, so that the restore doesn't
3335 # overwrite it
3336 my $tmpdir = File::Temp->newdir();
3337 my $tmpconf = "$tmpdir/smb.conf";
3338 my $cmd = "cp $smbconf $tmpconf";
3339 unless(system($cmd) == 0) {
3340 warn("Failed to backup smb.conf using: \n$cmd");
3341 return -1;
3342 }
3343
3344 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3345 $cmd = "$samba_tool domain backup restore --backup-file=$backup_file";
3346 $cmd .= " --targetdir=$restoredir $restore_opts --configfile=$tmpconf";
3347
3348 print "Executing: $cmd\n";
3349 unless(system($cmd) == 0) {
3350 warn("Failed to restore backup using: \n$cmd");
3351 return -1;
3352 }
3353
3354 print "Restore complete\n";
3355 return 0
3356 }
3357
3358 # sets up the initial directory and returns the new testenv's env info
3359 # (without actually doing a 'domain join')
3360 sub prepare_dc_testenv
3361 {
3362 my ($self, $prefix, $dcname, $domain, $realm,
3363 $password, $conf_options, $dnsupdate_options) = @_;
3364
3365 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
3366 $dcname,
3367 $domain,
3368 $realm,
3369 undef,
3370 "2008",
3371 $password,
3372 undef,
3373 undef);
3374
3375 # the restore uses a slightly different state-dir location to other testenvs
3376 $ctx->{statedir} = "$ctx->{prefix_abs}/state";
3377 push(@{$ctx->{directories}}, "$ctx->{statedir}");
3378
3379 # add support for sysvol/netlogon/tmp shares
3380 $ctx->{share} = "$ctx->{prefix_abs}/share";
3381 push(@{$ctx->{directories}}, "$ctx->{share}");
3382 push(@{$ctx->{directories}}, "$ctx->{share}/test1");
3383
3384 if (defined($dnsupdate_options)) {
3385 $ctx->{samba_dnsupdate} .= $dnsupdate_options;
3386 }
3387
3388 $ctx->{smb_conf_extra_options} = "
3389 $conf_options
3390
3391 # Some of the DCs based on this will be in FL 2016 domains, so
3392 # claim FL 2016 DC capability
3393 ad dc functional level = 2016
3394
3395 max xmit = 32K
3396 server max protocol = SMB2
3397 samba kcc command = /bin/true
3398 xattr_tdb:file = $ctx->{statedir}/xattr.tdb
3399
3400 [sysvol]
3401 path = $ctx->{statedir}/sysvol
3402 read only = no
3403
3404 [netlogon]
3405 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
3406 read only = no
3407
3408 [tmp]
3409 path = $ctx->{share}
3410 read only = no
3411 posix:sharedelay = 10000
3412 posix:oplocktimeout = 3
3413 posix:writetimeupdatedelay = 50000
3414
3415 [test1]
3416 path = $ctx->{share}/test1
3417 read only = no
3418 posix:sharedelay = 100000
3419 posix:oplocktimeout = 3
3420 posix:writetimeupdatedelay = 500000
3421 ";
3422
3423 my $env = $self->provision_raw_step1($ctx);
3424
3425 return ($env, $ctx);
3426 }
3427
3428
3429 # Set up a DC testenv solely by using the samba-tool domain backup/restore
3430 # commands. This proves that we can backup an online DC ('backupfromdc') and
3431 # use the backup file to create a valid, working samba DC.
3432 sub setup_restoredc
3433 {
3434 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3435 my ($self, $prefix, $dcvars) = @_;
3436 print "Preparing RESTORE DC...\n";
3437
3438 # we arbitrarily designate the restored DC as having SMBv1 disabled
3439 my $extra_conf = "
3440 server min protocol = SMB2
3441 client min protocol = SMB2
3442 prefork children = 1";
3443 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3444
3445 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "restoredc",
3446 $dcvars->{DOMAIN},
3447 $dcvars->{REALM},
3448 $dcvars->{PASSWORD},
3449 $extra_conf,
3450 $dnsupdate_options);
3451
3452 # create a backup of the 'backupfromdc'
3453 my $backupdir = File::Temp->newdir();
3454 my $server_args = $self->get_backup_server_args($dcvars);
3455 my $backup_args = "online $server_args";
3456 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3457 $backup_args);
3458 unless($backup_file) {
3459 return undef;
3460 }
3461
3462 # restore the backup file to populate the restore-DC testenv
3463 my $restore_dir = abs_path($prefix);
3464 my $ret = $self->restore_backup_file($backup_file,
3465 "--newservername=$env->{SERVER}",
3466 $restore_dir, $env->{SERVERCONFFILE});
3467 unless ($ret == 0) {
3468 return undef;
3469 }
3470
3471 #
3472 # As we create the same domain as a clone
3473 # we need a separate resolv.conf!
3474 #
3475 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3476 $ctx->{dns_ipv4} = $ctx->{ipv4};
3477 $ctx->{dns_ipv6} = $ctx->{ipv6};
3478 Samba::mk_resolv_conf($ctx);
3479 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3480
3481 # start samba for the restored DC
3482 if (not defined($self->check_or_start($env))) {
3483 return undef;
3484 }
3485
3486 return $env;
3487 }
3488
3489 # Set up a DC testenv solely by using the 'samba-tool domain backup rename' and
3490 # restore commands. This proves that we can backup and rename an online DC
3491 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3492 sub setup_renamedc
3493 {
3494 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3495 my ($self, $prefix, $dcvars) = @_;
3496 print "Preparing RENAME DC...\n";
3497 my $extra_conf = "prefork children = 1";
3498
3499 my $realm = "renamedom.samba.example.com";
3500 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "renamedc",
3501 "RENAMEDOMAIN", $realm,
3502 $dcvars->{PASSWORD}, $extra_conf);
3503
3504 # create a backup of the 'backupfromdc' which renames the domain
3505 my $backupdir = File::Temp->newdir();
3506 my $server_args = $self->get_backup_server_args($dcvars);
3507 my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3508 $backup_args .= " --backend-store=tdb";
3509 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3510 $backup_args);
3511 unless($backup_file) {
3512 return undef;
3513 }
3514
3515 # restore the backup file to populate the rename-DC testenv
3516 my $restore_dir = abs_path($prefix);
3517 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3518 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3519 $restore_dir, $env->{SERVERCONFFILE});
3520 unless ($ret == 0) {
3521 return undef;
3522 }
3523
3524 # start samba for the restored DC
3525 if (not defined($self->check_or_start($env))) {
3526 return undef;
3527 }
3528
3529 my $upn_array = ["$env->{REALM}.upn"];
3530 my $spn_array = ["$env->{REALM}.spn"];
3531
3532 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3533 return undef;
3534 }
3535
3536 return $env;
3537 }
3538
3539 # Set up a DC testenv solely by using the 'samba-tool domain backup offline' and
3540 # restore commands. This proves that we do an offline backup of a local DC
3541 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3542 sub setup_offlinebackupdc
3543 {
3544 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3545 my ($self, $prefix, $dcvars) = @_;
3546 print "Preparing OFFLINE BACKUP DC...\n";
3547 my $extra_conf = "prefork children = 1";
3548 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3549
3550 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "offlinebackupdc",
3551 $dcvars->{DOMAIN},
3552 $dcvars->{REALM},
3553 $dcvars->{PASSWORD},
3554 $extra_conf,
3555 $dnsupdate_options);
3556
3557 # create an offline backup of the 'backupfromdc' target
3558 my $backupdir = File::Temp->newdir();
3559 my $cmd = "offline --configfile $dcvars->{SERVERCONFFILE}";
3560 my $backup_file = $self->create_backup($env, $dcvars,
3561 $backupdir, $cmd);
3562
3563 unless($backup_file) {
3564 return undef;
3565 }
3566
3567 # restore the backup file to populate the rename-DC testenv
3568 my $restore_dir = abs_path($prefix);
3569 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3570 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3571 $restore_dir, $env->{SERVERCONFFILE});
3572 unless ($ret == 0) {
3573 return undef;
3574 }
3575
3576 #
3577 # As we create the same domain as a clone
3578 # we need a separate resolv.conf!
3579 #
3580 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3581 $ctx->{dns_ipv4} = $ctx->{ipv4};
3582 $ctx->{dns_ipv6} = $ctx->{ipv6};
3583 Samba::mk_resolv_conf($ctx);
3584 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3585
3586 # re-create the testenv's krb5.conf (the restore may have overwritten it)
3587 Samba::mk_krb5_conf($ctx);
3588
3589 # start samba for the restored DC
3590 if (not defined($self->check_or_start($env))) {
3591 return undef;
3592 }
3593
3594 return $env;
3595 }
3596
3597 # Set up a DC testenv solely by using the samba-tool 'domain backup rename' and
3598 # restore commands, using the --no-secrets option. This proves that we can
3599 # create a realistic lab environment from an online DC ('backupfromdc').
3600 sub setup_labdc
3601 {
3602 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3603 my ($self, $prefix, $dcvars) = @_;
3604 print "Preparing LAB-DOMAIN DC...\n";
3605 my $extra_conf = "prefork children = 1";
3606
3607 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "labdc",
3608 "LABDOMAIN",
3609 "labdom.samba.example.com",
3610 $dcvars->{PASSWORD}, $extra_conf);
3611
3612 # create a backup of the 'backupfromdc' which renames the domain and uses
3613 # the --no-secrets option to scrub any sensitive info
3614 my $backupdir = File::Temp->newdir();
3615 my $server_args = $self->get_backup_server_args($dcvars);
3616 my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3617 $backup_args .= " --no-secrets --backend-store=$self->{default_ldb_backend}";
3618 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3619 $backup_args);
3620 unless($backup_file) {
3621 return undef;
3622 }
3623
3624 # restore the backup file to populate the lab-DC testenv
3625 my $restore_dir = abs_path($prefix);
3626 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3627 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3628 $restore_dir, $env->{SERVERCONFFILE});
3629 unless ($ret == 0) {
3630 return undef;
3631 }
3632
3633 # because we don't include any secrets in the backup, we need to reset the
3634 # admin user's password back to what the testenv expects
3635 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3636 my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3637 $cmd .= "--newpassword=$env->{PASSWORD} -H $restore_dir/private/sam.ldb";
3638 $cmd .= " $env->{CONFIGURATION}";
3639
3640 unless(system($cmd) == 0) {
3641 warn("Failed to reset admin's password: \n$cmd");
3642 return undef;
3643 }
3644
3645 # start samba for the restored DC
3646 if (not defined($self->check_or_start($env))) {
3647 return undef;
3648 }
3649
3650 my $upn_array = ["$env->{REALM}.upn"];
3651 my $spn_array = ["$env->{REALM}.spn"];
3652
3653 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3654 return undef;
3655 }
3656
3657 return $env;
3658 }
3659
3660 # Inspects a backup *.tar.bz2 file and determines the realm/domain it contains
3661 sub get_backup_domain_realm
3662 {
3663 my ($self, $backup_file) = @_;
3664
3665 print "Determining REALM/DOMAIN values in backup...\n";
3666
3667 # The backup will have the correct domain/realm values in the smb.conf.
3668 # So we can work out the env variables the testenv should use based on
3669 # that. Let's start by extracting the smb.conf
3670 my $tar = Archive::Tar->new($backup_file);
3671 my $tmpdir = File::Temp->newdir();
3672 my $smbconf = "$tmpdir/smb.conf";
3673
3674 # note that the filepaths within the tar-file differ slightly for online
3675 # and offline backups
3676 if ($tar->contains_file("etc/smb.conf")) {
3677 $tar->extract_file("etc/smb.conf", $smbconf);
3678 } elsif ($tar->contains_file("./etc/smb.conf")) {
3679 $tar->extract_file("./etc/smb.conf", $smbconf);
3680 } else {
3681 warn("Could not find smb.conf in $backup_file");
3682 return undef, undef;
3683 }
3684
3685 # make sure we don't try to create locks/sockets in the default install
3686 # location (i.e. /usr/local/samba/)
3687 my $options = "--option=\"private dir = $tmpdir\"";
3688 $options .= " --option=\"lock dir = $tmpdir\"";
3689
3690 # now use testparm to read the values we're interested in
3691 my $testparm = Samba::bindir_path($self, "testparm");
3692 my $domain = `$testparm $smbconf -sl --parameter-name=WORKGROUP $options`;
3693 my $realm = `$testparm $smbconf -sl --parameter-name=REALM $options`;
3694 chomp $realm;
3695 chomp $domain;
3696 print "Backup-file REALM is $realm, DOMAIN is $domain\n";
3697
3698 return ($domain, $realm);
3699 }
3700
3701 # This spins up a custom testenv that can be based on any backup-file you want.
3702 # This is just intended for manual testing (rather than automated test-cases)
3703 sub setup_customdc
3704 {
3705 my ($self, $prefix) = @_;
3706 print "Preparing CUSTOM RESTORE DC...\n";
3707 my $dc_name = "customdc";
3708 my $password = "locDCpass1";
3709 my $backup_file = $ENV{'BACKUP_FILE'};
3710 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3711
3712 # user must specify a backup file to restore via an ENV variable, i.e.
3713 # BACKUP_FILE=backup-blah.tar.bz2 SELFTEST_TESTENV=customdc make testenv
3714 if (not defined($backup_file)) {
3715 warn("Please specify BACKUP_FILE");
3716 return undef;
3717 }
3718
3719 # work out the correct domain/realm env values from the backup-file
3720 my ($domain, $realm) = $self->get_backup_domain_realm($backup_file);
3721 if ($domain eq '' or $realm eq '') {
3722 warn("Could not determine domain or realm");
3723 return undef;
3724 }
3725
3726 # create a placeholder directory and smb.conf, as well as the env vars.
3727 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, $dc_name,
3728 $domain, $realm, $password, "",
3729 $dnsupdate_options);
3730
3731 # restore the specified backup file to populate the testenv
3732 my $restore_dir = abs_path($prefix);
3733 my $ret = $self->restore_backup_file($backup_file,
3734 "--newservername=$env->{SERVER}",
3735 $restore_dir, $env->{SERVERCONFFILE});
3736 unless ($ret == 0) {
3737 return undef;
3738 }
3739
3740 #
3741 # As we create the same domain as a clone
3742 # we need a separate resolv.conf!
3743 #
3744 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3745 $ctx->{dns_ipv4} = $ctx->{ipv4};
3746 $ctx->{dns_ipv6} = $ctx->{ipv6};
3747 Samba::mk_resolv_conf($ctx);
3748 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3749
3750 # Change the admin password to the testenv default, just in case it's
3751 # different, or in case this was a --no-secrets backup
3752 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3753 my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3754 $cmd .= "--newpassword=$password -H $restore_dir/private/sam.ldb";
3755 $cmd .= " $env->{CONFIGURATION}";
3756
3757 unless(system($cmd) == 0) {
3758 warn("Failed to reset admin's password: \n$cmd");
3759 return undef;
3760 }
3761
3762 # re-create the testenv's krb5.conf (the restore may have overwritten it,
3763 # if the backup-file was an offline backup)
3764 Samba::mk_krb5_conf($ctx);
3765
3766 # start samba for the restored DC
3767 if (not defined($self->check_or_start($env))) {
3768 return undef;
3769 }
3770
3771 # if this was a backup-rename, then we may need to setup namespaces
3772 my $upn_array = ["$env->{REALM}.upn"];
3773 my $spn_array = ["$env->{REALM}.spn"];
3774
3775 return $env;
3776 }
3777
3778 sub setup_none
3779 {
3780 my ($self, $path) = @_;
3781
3782 my $ret = {
3783 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
3784 SAMBA_PID => -1,
3785 }
3786 }
3787
3788 1;
GSS-enabled samba4