?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ctdb-scripts: Improve update and listing code
[samba4-gss.git] / selftest / target / Samba4.pm
blob923cc744e3588c19d2808c2944f7a9cd88ff0115
1 #!/usr/bin/perl
2 # Bootstrap Samba and run a number of tests against it.
3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
4 # Published under the GNU GPL, v3 or later.
5
6 # NOTE: Refer to the README for more details about the various testenvs,
7 # and tips about adding new testenvs.
8
9 package Samba4;
10
11 use strict;
12 use warnings;
13 use Cwd qw(abs_path);
14 use FindBin qw($RealBin);
15 use POSIX;
16 use SocketWrapper;
17 use target::Samba;
18 use target::Samba3;
19 use Archive::Tar;
20
21 sub new($$$$$) {
22 my ($classname, $SambaCtx, $bindir, $srcdir, $server_maxtime, $default_ldb_backend) = @_;
23
24 my $self = {
25 vars => {},
26 SambaCtx => $SambaCtx,
27 bindir => $bindir,
28 srcdir => $srcdir,
29 server_maxtime => $server_maxtime,
30 target3 => new Samba3($SambaCtx, $bindir, $srcdir, $server_maxtime),
31 default_ldb_backend => $default_ldb_backend,
32 };
33 bless $self;
34 return $self;
35 }
36
37 sub scriptdir_path($$) {
38 my ($self, $path) = @_;
39 return "$self->{srcdir}/source4/scripting/$path";
40 }
41
42 sub check_or_start($$$)
43 {
44 my ($self, $env_vars, $process_model) = @_;
45 my $STDIN_READER;
46
47 my $env_ok = $self->check_env($env_vars);
48 if ($env_ok) {
49 return $env_vars->{SAMBA_PID};
50 } elsif (defined($env_vars->{SAMBA_PID})) {
51 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
52 return undef;
53 }
54
55 # use a pipe for stdin in the child processes. This allows
56 # those processes to monitor the pipe for EOF to ensure they
57 # exit when the test script exits
58 pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
59
60 # build up the command to run samba
61 my @preargs = ();
62 my @optargs = ();
63 if (defined($ENV{SAMBA_OPTIONS})) {
64 @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
65 }
66 if(defined($ENV{SAMBA_VALGRIND})) {
67 @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
68 }
69
70 if (defined($process_model)) {
71 push @optargs, ("-M", $process_model);
72 }
73 my $binary = Samba::bindir_path($self, "samba");
74 my @full_cmd = (@preargs, $binary, "-i",
75 "--no-process-group", "--maximum-runtime=$self->{server_maxtime}",
76 $env_vars->{CONFIGURATION}, @optargs);
77
78 # the samba process takes some additional env variables (compared to s3)
79 my $samba_envs = Samba::get_env_for_process("samba", $env_vars);
80 if (defined($ENV{MITKRB5})) {
81 $samba_envs->{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
82 }
83
84 # fork a child process and exec() samba
85 my $daemon_ctx = {
86 NAME => "samba",
87 BINARY_PATH => $binary,
88 FULL_CMD => [ @full_cmd ],
89 LOG_FILE => $env_vars->{SAMBA_TEST_LOG},
90 TEE_STDOUT => 1,
91 PCAP_FILE => "env-$ENV{ENVNAME}-samba",
92 ENV_VARS => $samba_envs,
93 };
94 my $pid = Samba::fork_and_exec($self, $env_vars, $daemon_ctx, $STDIN_READER);
95
96 $env_vars->{SAMBA_PID} = $pid;
97
98 # close the parent's read-end of the pipe
99 close($STDIN_READER);
100
101 if ($self->wait_for_start($env_vars) != 0) {
102 warn("Samba $pid failed to start up");
103 return undef;
104 }
105
106 return $pid;
107 }
108
109 sub wait_for_start($$)
110 {
111 my ($self, $testenv_vars) = @_;
112 my $count = 0;
113 my $ret = 0;
114
115 if (not $self->check_env($testenv_vars)) {
116 warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
117 return -1;
118 }
119
120 # This will return quickly when things are up, but be slow if we
121 # need to wait for (eg) SSL init
122 my $nmblookup = Samba::bindir_path($self, "nmblookup4");
123
124 do {
125 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
126 if ($ret != 0) {
127 sleep(1);
128 } else {
129 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
130 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
131 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
132 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
133 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
134 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
135 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
136 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
137 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
138 system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
139 system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
140 }
141 $count++;
142 } while ($ret != 0 && $count < 20);
143 if ($count == 20) {
144 teardown_env($self, $testenv_vars);
145 warn("nbt not reachable after 20 retries\n");
146 return -1;
147 }
148
149 # Ensure we have the first RID Set before we start tests. This makes the tests more reliable.
150 if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
151 print "waiting for working LDAP and a RID Set to be allocated\n";
152 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
153 my $count = 0;
154 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
155
156 my $search_dn = $base_dn;
157 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
158 # TODO currently no check for actual rIDAllocationPool
159 $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
160 }
161 my $max_wait = 60;
162
163 # Add hosts file for name lookups
164 my $cmd = $self->get_cmd_env_vars($testenv_vars);
165
166 $cmd .= "$ldbsearch ";
167 $cmd .= "$testenv_vars->{CONFIGURATION} ";
168 $cmd .= "-H ldap://$testenv_vars->{SERVER} ";
169 $cmd .= "-U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} ";
170 $cmd .= "--scope base ";
171 $cmd .= "-b '$search_dn' ";
172 while (system("$cmd >/dev/null") != 0) {
173 $count++;
174 if ($count > $max_wait) {
175 teardown_env($self, $testenv_vars);
176 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
177 return -1;
178 }
179 print "Waiting for working LDAP...\n";
180 sleep(1);
181 }
182 }
183
184 my $wbinfo = Samba::bindir_path($self, "wbinfo");
185
186 $count = 0;
187 do {
188 my $cmd = "NSS_WRAPPER_PASSWD=$testenv_vars->{NSS_WRAPPER_PASSWD} ";
189 $cmd .= "NSS_WRAPPER_GROUP=$testenv_vars->{NSS_WRAPPER_GROUP} ";
190 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=$testenv_vars->{SELFTEST_WINBINDD_SOCKET_DIR} ";
191 $cmd .= "$wbinfo -P";
192 $ret = system($cmd);
193
194 if ($ret != 0) {
195 sleep(1);
196 }
197 $count++;
198 } while ($ret != 0 && $count < 20);
199 if ($count == 20) {
200 teardown_env($self, $testenv_vars);
201 warn("winbind not reachable after 20 retries\n");
202 return -1;
203 }
204
205 # Ensure we registered all our names
206 if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
207 my $max_wait = 120;
208 my $dns_update_cache = "$testenv_vars->{PRIVATEDIR}/dns_update_cache";
209 print "Waiting for $dns_update_cache to be created.\n";
210 $count = 0;
211 while (not -e $dns_update_cache) {
212 $count++;
213 if ($count > $max_wait) {
214 teardown_env($self, $testenv_vars);
215 warn("Timed out ($max_wait sec) waiting for $dns_update_cache PID $testenv_vars->{SAMBA_PID}");
216 return -1;
217 }
218 print "Waiting for $dns_update_cache to be created...\n";
219 sleep(1);
220 }
221 print "Waiting for $dns_update_cache to be filled.\n";
222 $count = 0;
223 while ((-s "$dns_update_cache") == 0) {
224 $count++;
225 if ($count > $max_wait) {
226 teardown_env($self, $testenv_vars);
227 warn("Timed out ($max_wait sec) waiting for $dns_update_cache PID $testenv_vars->{SAMBA_PID}");
228 return -1;
229 }
230 print "Waiting for $dns_update_cache to be filled...\n";
231 sleep(1);
232 }
233 }
234
235 print $self->getlog_env($testenv_vars);
236
237 print "READY ($testenv_vars->{SAMBA_PID})\n";
238
239 return 0
240 }
241
242 sub write_ldb_file($$$)
243 {
244 my ($self, $file, $ldif_in) = @_;
245
246 my $ldbadd = Samba::bindir_path($self, "ldbadd");
247 open(my $ldif, "|$ldbadd -H $file > /dev/null")
248 or die "Failed to run $ldbadd: $!";
249 print $ldif $ldif_in;
250 close($ldif);
251
252 unless ($? == 0) {
253 warn("$ldbadd failed: $?");
254 return undef;
255 }
256 return 1;
257 }
258
259 sub add_wins_config($$)
260 {
261 my ($self, $privatedir) = @_;
262 my $client_ip = Samba::get_ipv4_addr("client");
263
264 return $self->write_ldb_file("$privatedir/wins_config.ldb", "
265 dn: name=TORTURE_11,CN=PARTNERS
266 objectClass: wreplPartner
267 name: TORTURE_11
268 address: $client_ip
269 pullInterval: 0
270 pushChangeCount: 0
271 type: 0x3
272 ");
273 }
274
275 sub setup_dns_hub_internal($$$)
276 {
277 my ($self, $hostname, $prefix) = @_;
278 my $STDIN_READER;
279
280 unless(-d $prefix or mkdir($prefix, 0777)) {
281 warn("Unable to create $prefix");
282 return undef;
283 }
284 my $prefix_abs = abs_path($prefix);
285
286 die ("prefix=''") if $prefix_abs eq "";
287 die ("prefix='/'") if $prefix_abs eq "/";
288
289 unless (system("rm -rf $prefix_abs/*") == 0) {
290 warn("Unable to clean up");
291 }
292
293 my $env = undef;
294 $env->{NETBIOSNAME} = $hostname;
295
296 $env->{SERVER_IP} = Samba::get_ipv4_addr($hostname);
297 $env->{SERVER_IPV6} = Samba::get_ipv6_addr($hostname);
298 $env->{SOCKET_WRAPPER_DEFAULT_IFACE} = Samba::get_interface($hostname);
299 $env->{DNS_HUB_LOG} = "$prefix_abs/dns_hub.log";
300 $env->{RESOLV_CONF} = "$prefix_abs/resolv.conf";
301 $env->{TESTENV_DIR} = $prefix_abs;
302
303 my $ctx = undef;
304 $ctx->{resolv_conf} = $env->{RESOLV_CONF};
305 $ctx->{dns_ipv4} = $env->{SERVER_IP};
306 $ctx->{dns_ipv6} = $env->{SERVER_IPV6};
307 Samba::mk_resolv_conf($ctx);
308
309 my @preargs = ();
310 my @args = ();
311 if (!defined($ENV{PYTHON})) {
312 push (@preargs, "env");
313 push (@preargs, "python");
314 } else {
315 push (@preargs, $ENV{PYTHON});
316 }
317 my $binary = "$self->{srcdir}/selftest/target/dns_hub.py";
318 push (@args, "$self->{server_maxtime}");
319 push (@args, "$env->{SERVER_IP},$env->{SERVER_IPV6}");
320 push (@args, Samba::realm_to_ip_mappings());
321 my @full_cmd = (@preargs, $binary, @args);
322
323 my $daemon_ctx = {
324 NAME => "dnshub",
325 BINARY_PATH => $binary,
326 FULL_CMD => [ @full_cmd ],
327 LOG_FILE => $env->{DNS_HUB_LOG},
328 TEE_STDOUT => 1,
329 PCAP_FILE => "env-$ENV{ENVNAME}-dns_hub",
330 ENV_VARS => {},
331 };
332
333 # use a pipe for stdin in the child processes. This allows
334 # those processes to monitor the pipe for EOF to ensure they
335 # exit when the test script exits
336 pipe($STDIN_READER, $env->{STDIN_PIPE});
337
338 my $pid = Samba::fork_and_exec($self, $env, $daemon_ctx, $STDIN_READER);
339
340 $env->{SAMBA_PID} = $pid;
341 $env->{KRB5_CONFIG} = "$prefix_abs/no_krb5.conf";
342
343 # close the parent's read-end of the pipe
344 close($STDIN_READER);
345
346 return $env;
347 }
348
349 sub setup_dns_hub
350 {
351 my ($self, $prefix) = @_;
352
353 my $hostname = "rootdnsforwarder";
354
355 unless(-d $prefix or mkdir($prefix, 0777)) {
356 warn("Unable to create $prefix");
357 return undef;
358 }
359 my $env = $self->setup_dns_hub_internal("$hostname", "$prefix/$hostname");
360
361 $self->{dns_hub_env} = $env;
362
363 return $env;
364 }
365
366 sub get_dns_hub_env($)
367 {
368 my ($self, $prefix) = @_;
369
370 if (defined($self->{dns_hub_env})) {
371 return $self->{dns_hub_env};
372 }
373
374 die("get_dns_hub_env() not setup 'dns_hub_env'");
375 return undef;
376 }
377
378 sub return_env_value
379 {
380 my ($env, $overwrite, $key) = @_;
381
382 if (defined($overwrite) and defined($overwrite->{$key})) {
383 return $overwrite->{$key};
384 }
385
386 if (defined($env->{$key})) {
387 return $env->{$key};
388 }
389
390 return undef;
391 }
392
393 # Returns the environmental variables that we pass to samba-tool commands
394 sub get_cmd_env_vars
395 {
396 my ($self, $givenenv, $overwrite) = @_;
397
398 my @keys = (
399 "NSS_WRAPPER_HOSTS",
400 "SOCKET_WRAPPER_DEFAULT_IFACE",
401 "RESOLV_CONF",
402 "RESOLV_WRAPPER_CONF",
403 "RESOLV_WRAPPER_HOSTS",
404 "GNUTLS_FORCE_FIPS_MODE",
405 "OPENSSL_FORCE_FIPS_MODE",
406 "KRB5_CONFIG",
407 "KRB5_CCACHE",
408 "GNUPGHOME",
409 );
410
411 my $localenv = undef;
412 foreach my $key (@keys) {
413 my $v = return_env_value($givenenv, $overwrite, $key);
414 $localenv->{$key} = $v if defined($v);
415 }
416
417 my $cmd_env = "NSS_WRAPPER_HOSTS='$localenv->{NSS_WRAPPER_HOSTS}' ";
418 $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
419 if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
420 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
421 } else {
422 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
423 }
424 if (defined($localenv->{GNUTLS_FORCE_FIPS_MODE})) {
425 $cmd_env .= "GNUTLS_FORCE_FIPS_MODE=$localenv->{GNUTLS_FORCE_FIPS_MODE} ";
426 }
427 if (defined($localenv->{OPENSSL_FORCE_FIPS_MODE})) {
428 $cmd_env .= "OPENSSL_FORCE_FIPS_MODE=$localenv->{OPENSSL_FORCE_FIPS_MODE} ";
429 }
430 $cmd_env .= "KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
431 $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
432 $cmd_env .= "RESOLV_CONF=\"$localenv->{RESOLV_CONF}\" ";
433 $cmd_env .= "GNUPGHOME=\"$localenv->{GNUPGHOME}\" ";
434
435 return $cmd_env;
436 }
437
438 # Sets up a forest trust namespace.
439 # (Note this is different to kernel namespaces, setup by the
440 # USE_NAMESPACES=1 option)
441 sub setup_namespaces
442 {
443 my ($self, $localenv, $upn_array, $spn_array) = @_;
444
445 @{$upn_array} = [] unless defined($upn_array);
446 my $upn_args = "";
447 foreach my $upn (@{$upn_array}) {
448 $upn_args .= " --add-upn-suffix=$upn";
449 }
450
451 @{$spn_array} = [] unless defined($spn_array);
452 my $spn_args = "";
453 foreach my $spn (@{$spn_array}) {
454 $spn_args .= " --add-spn-suffix=$spn";
455 }
456
457 my $samba_tool = Samba::bindir_path($self, "samba-tool");
458
459 my $cmd_env = $self->get_cmd_env_vars($localenv);
460
461 my $cmd_config = " $localenv->{CONFIGURATION}";
462
463 my $namespaces = $cmd_env;
464 $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
465 $namespaces .= $cmd_config;
466 unless (system($namespaces) == 0) {
467 warn("Failed to add namespaces \n$namespaces");
468 return -1;
469 }
470
471 return 0;
472 }
473
474 sub setup_trust($$$$$)
475 {
476 my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
477
478 $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
479 $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
480 $localenv->{TRUST_DNSNAME} = $remoteenv->{DNSNAME};
481
482 $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
483 $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
484 $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
485 $localenv->{TRUST_REALM} = $remoteenv->{REALM};
486 $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID};
487
488 # Add trusted domain realms to krb5.conf
489 Samba::append_krb5_conf_trust_realms($localenv);
490
491 my $samba_tool = Samba::bindir_path($self, "samba-tool");
492
493 # setup the trust
494 my $cmd_env = $self->get_cmd_env_vars($localenv);
495
496 my $cmd_config = " $localenv->{CONFIGURATION}";
497 my $cmd_creds = $cmd_config;
498 $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
499
500 my $create = $cmd_env;
501 $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
502 $create .= " $extra_args";
503 $create .= $cmd_creds;
504 unless (system($create) == 0) {
505 warn("Failed to create trust \n$create");
506 return undef;
507 }
508
509 my $groupname = "g_$localenv->{TRUST_DOMAIN}";
510 my $groupadd = $cmd_env;
511 $groupadd .= " $samba_tool group add '$groupname' --group-scope=Domain $cmd_config";
512 unless (system($groupadd) == 0) {
513 warn("Failed to create group \n$groupadd");
514 return undef;
515 }
516 my $groupmem = $cmd_env;
517 $groupmem .= " $samba_tool group addmembers '$groupname' '$localenv->{TRUST_DOMSID}-513' $cmd_config";
518 unless (system($groupmem) == 0) {
519 warn("Failed to add group member \n$groupmem");
520 return undef;
521 }
522
523 return $localenv
524 }
525
526 sub provision_raw_prepare($$$$$$$$$$$$$$)
527 {
528 my ($self,
529 $prefix,
530 $server_role,
531 $hostname,
532 $domain,
533 $realm,
534 $samsid,
535 $functional_level,
536 $password,
537 $kdc_ipv4,
538 $kdc_ipv6,
539 $force_fips_mode,
540 $extra_provision_options) = @_;
541 my $ctx;
542 my $python_cmd = "";
543 if (defined $ENV{PYTHON}) {
544 $python_cmd = $ENV{PYTHON} . " ";
545 }
546 $ctx->{python} = $python_cmd;
547 my $netbiosname = uc($hostname);
548
549 unless(-d $prefix or mkdir($prefix, 0777)) {
550 warn("Unable to create $prefix");
551 return undef;
552 }
553 my $prefix_abs = abs_path($prefix);
554
555 die ("prefix=''") if $prefix_abs eq "";
556 die ("prefix='/'") if $prefix_abs eq "/";
557
558 unless (system("rm -rf $prefix_abs/*") == 0) {
559 warn("Unable to clean up");
560 }
561
562
563 my $swiface = Samba::get_interface($hostname);
564
565 $ctx->{prefix} = $prefix;
566 $ctx->{prefix_abs} = $prefix_abs;
567
568 $ctx->{server_role} = $server_role;
569 $ctx->{hostname} = $hostname;
570 $ctx->{netbiosname} = $netbiosname;
571 $ctx->{swiface} = $swiface;
572 $ctx->{password} = $password;
573 $ctx->{kdc_ipv4} = $kdc_ipv4;
574 $ctx->{kdc_ipv6} = $kdc_ipv6;
575 $ctx->{force_fips_mode} = $force_fips_mode;
576 $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
577 if ($functional_level eq "2000") {
578 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc";
579 }
580
581 #
582 # Set smbd log level here.
583 #
584 $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
585 $ctx->{username} = "Administrator";
586 $ctx->{domain} = $domain;
587 $ctx->{realm} = uc($realm);
588 $ctx->{dnsname} = lc($realm);
589 $ctx->{samsid} = $samsid;
590 $ctx->{domain_admin} = "Administrator";
591 $ctx->{domain_admin_password} = $password;
592 $ctx->{domain_user} = "alice";
593 $ctx->{domain_user_password} = "Secret007";
594
595 $ctx->{functional_level} = $functional_level;
596
597 my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
598 chomp $unix_name;
599 $ctx->{unix_name} = $unix_name;
600 $ctx->{unix_uid} = $>;
601 my @mygid = split(" ", $();
602 $ctx->{unix_gid} = $mygid[0];
603 $ctx->{unix_gids_str} = $);
604 @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
605
606 $ctx->{etcdir} = "$prefix_abs/etc";
607 $ctx->{piddir} = "$prefix_abs/pid";
608 $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
609 $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
610 $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
611 $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
612 $ctx->{gnupghome} = "$prefix_abs/gnupg";
613 $ctx->{privatedir} = "$prefix_abs/private";
614 $ctx->{binddnsdir} = "$prefix_abs/bind-dns";
615 $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
616 $ctx->{lockdir} = "$prefix_abs/lockdir";
617 $ctx->{logdir} = "$prefix_abs/logs";
618 $ctx->{statedir} = "$prefix_abs/statedir";
619 $ctx->{cachedir} = "$prefix_abs/cachedir";
620 $ctx->{winbindd_socket_dir} = "$prefix_abs/wbsock";
621 $ctx->{nmbd_socket_dir} = "$prefix_abs/nmbsock";
622 $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
623 $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
624 $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
625 $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
626 $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
627 if ($ENV{SAMBA_DNS_FAKING}) {
628 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
629 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --configfile=$ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
630 $ctx->{samba_dnsupdate} = $python_cmd . $ctx->{samba_dnsupdate};
631 } else {
632 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --configfile=$ctx->{smb_conf} --all-interfaces";
633 $ctx->{samba_dnsupdate} = $python_cmd . $ctx->{samba_dnsupdate};
634 $ctx->{use_resolv_wrapper} = 1;
635 }
636
637 my $dns_hub = $self->get_dns_hub_env();
638 $ctx->{resolv_conf} = $dns_hub->{RESOLV_CONF};
639
640 $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
641
642 $ctx->{ipv4} = Samba::get_ipv4_addr($hostname);
643 $ctx->{ipv6} = Samba::get_ipv6_addr($hostname);
644
645 push(@{$ctx->{directories}}, $ctx->{privatedir});
646 push(@{$ctx->{directories}}, $ctx->{binddnsdir});
647 push(@{$ctx->{directories}}, $ctx->{etcdir});
648 push(@{$ctx->{directories}}, $ctx->{piddir});
649 push(@{$ctx->{directories}}, $ctx->{lockdir});
650 push(@{$ctx->{directories}}, $ctx->{logdir});
651 push(@{$ctx->{directories}}, $ctx->{statedir});
652 push(@{$ctx->{directories}}, $ctx->{cachedir});
653
654 $ctx->{smb_conf_extra_options} = "";
655
656 my @provision_options = ();
657 push (@provision_options, "GNUPGHOME=\"$ctx->{gnupghome}\"");
658 push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
659 push (@provision_options, "KRB5CCNAME=\"$ctx->{krb5_ccache}\"");
660 push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
661 push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
662 push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
663 push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
664 if (defined($ctx->{use_resolv_wrapper})) {
665 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
666 push (@provision_options, "RESOLV_CONF=\"$ctx->{resolv_conf}\"");
667 } else {
668 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
669 }
670 if (defined($ctx->{force_fips_mode})) {
671 push (@provision_options, "GNUTLS_FORCE_FIPS_MODE=1");
672 push (@provision_options, "OPENSSL_FORCE_FIPS_MODE=1");
673 }
674
675 if (defined($ENV{GDB_PROVISION})) {
676 push (@provision_options, "gdb --args");
677 if (!defined($ENV{PYTHON})) {
678 push (@provision_options, "env");
679 push (@provision_options, "python");
680 }
681 }
682 if (defined($ENV{VALGRIND_PROVISION})) {
683 push (@provision_options, "valgrind");
684 if (!defined($ENV{PYTHON})) {
685 push (@provision_options, "env");
686 push (@provision_options, "python");
687 }
688 }
689
690 my $samba_tool = Samba::bindir_path($self, "samba-tool");
691
692 push (@provision_options, $samba_tool);
693 push (@provision_options, "domain");
694 push (@provision_options, "provision");
695 push (@provision_options, "--configfile=$ctx->{smb_conf}");
696 push (@provision_options, "--host-name=$ctx->{hostname}");
697 push (@provision_options, "--host-ip=$ctx->{ipv4}");
698 push (@provision_options, "--quiet");
699 push (@provision_options, "--domain=$ctx->{domain}");
700 push (@provision_options, "--realm=$ctx->{realm}");
701 if (defined($ctx->{samsid})) {
702 push (@provision_options, "--domain-sid=$ctx->{samsid}");
703 }
704 push (@provision_options, "--adminpass=$ctx->{password}");
705 push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
706 push (@provision_options, "--machinepass=machine$ctx->{password}");
707 push (@provision_options, "--root=$ctx->{unix_name}");
708 push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
709 push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
710
711 @{$ctx->{provision_options}} = @provision_options;
712
713 if (defined($extra_provision_options)) {
714 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
715 }
716
717 return $ctx;
718 }
719
720 sub has_option
721 {
722 my ($self, $keyword, @options_list) = @_;
723
724 # convert the options-list to a hash-map for easy keyword lookup
725 my %options_dict = map { $_ => 1 } @options_list;
726
727 return exists $options_dict{$keyword};
728 }
729
730 #
731 # Step1 creates the basic configuration
732 #
733 sub provision_raw_step1($$)
734 {
735 my ($self, $ctx) = @_;
736
737 mkdir($_, 0777) foreach (@{$ctx->{directories}});
738
739 ##
740 ## lockdir and piddir must be 0755
741 ##
742 chmod 0755, $ctx->{lockdir};
743 chmod 0755, $ctx->{piddir};
744
745 unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
746 warn("can't open $ctx->{smb_conf}$?");
747 return undef;
748 }
749
750 Samba::copy_gnupg_home($ctx);
751 Samba::prepare_keyblobs($ctx);
752 my $crlfile = "$ctx->{tlsdir}/crl.pem";
753 $crlfile = "" unless -e ${crlfile};
754
755 # work out which file server to use. Default to source3 smbd (s3fs),
756 # unless the source4 NTVFS (smb) file server has been specified
757 my $services = "-smb +s3fs";
758 if ($self->has_option("--use-ntvfs", @{$ctx->{provision_options}})) {
759 $services = "+smb -s3fs";
760 }
761
762 my $interfaces = Samba::get_interfaces_config($ctx->{netbiosname});
763
764 print CONFFILE "
765 [global]
766 netbios name = $ctx->{netbiosname}
767 posix:eadb = $ctx->{statedir}/eadb.tdb
768 workgroup = $ctx->{domain}
769 realm = $ctx->{realm}
770 private dir = $ctx->{privatedir}
771 binddns dir = $ctx->{binddnsdir}
772 pid directory = $ctx->{piddir}
773 ncalrpc dir = $ctx->{ncalrpcdir}
774 lock dir = $ctx->{lockdir}
775 state directory = $ctx->{statedir}
776 cache directory = $ctx->{cachedir}
777 winbindd socket directory = $ctx->{winbindd_socket_dir}
778 nmbd:socket dir = $ctx->{nmbd_socket_dir}
779 ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
780 winbind separator = /
781 interfaces = $interfaces
782 tls dh params file = $ctx->{tlsdir}/dhparms.pem
783 tls crlfile = ${crlfile}
784 tls verify peer = no_check
785 panic action = $RealBin/gdb_backtrace \%d
786 smbd:suicide mode = yes
787 smbd:FSCTL_SMBTORTURE = yes
788 smbd:validate_oplock_types = yes
789 wins support = yes
790 server role = $ctx->{server_role}
791 server services = +echo $services
792 dcerpc endpoint servers = +winreg +srvsvc +rpcecho
793 notify:inotify = false
794 ldb:nosync = true
795 ldap server require strong auth = yes
796 log file = $ctx->{logdir}/log.\%m
797 log level = $ctx->{server_loglevel}
798 lanman auth = Yes
799 ntlm auth = Yes
800 client min protocol = SMB2_02
801 server min protocol = SMB2_02
802 mangled names = yes
803 dns update command = $ctx->{samba_dnsupdate}
804 spn update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate --configfile $ctx->{smb_conf}
805 gpo update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba-gpupdate --configfile $ctx->{smb_conf} --target=Computer
806 samba kcc command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_kcc
807 dreplsrv:periodic_startup_interval = 0
808 dsdb:schema update allowed = yes
809
810 vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
811
812 idmap_ldb:use rfc2307=yes
813 winbind enum users = yes
814 winbind enum groups = yes
815
816 rpc server port:netlogon = 1026
817 include system krb5 conf = no
818
819 debug syslog format = always
820 debug hires timestamp = yes
821
822 ";
823
824 print CONFFILE "
825
826 # Begin extra options
827 $ctx->{smb_conf_extra_options}
828 # End extra options
829 ";
830 close(CONFFILE);
831
832 #Default the KDC IP to the server's IP
833 if (not defined($ctx->{kdc_ipv4})) {
834 $ctx->{kdc_ipv4} = $ctx->{ipv4};
835 }
836 if (not defined($ctx->{kdc_ipv6})) {
837 $ctx->{kdc_ipv6} = $ctx->{ipv6};
838 }
839
840 Samba::mk_krb5_conf($ctx);
841 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
842
843 open(PWD, ">$ctx->{nsswrap_passwd}");
844 if ($ctx->{unix_uid} != 0) {
845 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
846 }
847 print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
848 print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
849 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
850 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
851 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
852 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
853 ";
854 close(PWD);
855 my $uid_rfc2307test = 65533;
856
857 open(GRP, ">$ctx->{nsswrap_group}");
858 if ($ctx->{unix_gid} != 0) {
859 print GRP "root:x:0:\n";
860 }
861 print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
862 print GRP "wheel:x:10:
863 users:x:65531:
864 nobody:x:65533:
865 nogroup:x:65534:nobody
866 ";
867 close(GRP);
868 my $gid_rfc2307test = 65532;
869
870 my $hostname = lc($ctx->{hostname});
871 open(HOSTS, ">>$ctx->{nsswrap_hosts}");
872 if ($hostname eq "localdc") {
873 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
874 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
875 } else {
876 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
877 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
878 }
879 close(HOSTS);
880
881 my $configuration = "--configfile=$ctx->{smb_conf}";
882
883 #Ensure the config file is valid before we start
884 my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
885 if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
886 system("$testparm -v --suppress-prompt $configuration >&2");
887 warn("Failed to create a valid smb.conf configuration $testparm!");
888 return undef;
889 }
890 unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
891 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
892 return undef;
893 }
894
895 # Return the environment variables for the new testenv DC.
896 # Note that we have SERVER_X and DC_SERVER_X variables (which have the same
897 # value initially). In a 2 DC setup, $DC_SERVER_X will always be the PDC.
898 my $ret = {
899 GNUPGHOME => $ctx->{gnupghome},
900 KRB5_CONFIG => $ctx->{krb5_conf},
901 KRB5_CCACHE => $ctx->{krb5_ccache},
902 MITKDC_CONFIG => $ctx->{mitkdc_conf},
903 PIDDIR => $ctx->{piddir},
904 SERVER => $ctx->{hostname},
905 DC_SERVER => $ctx->{hostname},
906 SERVER_IP => $ctx->{ipv4},
907 DC_SERVER_IP => $ctx->{ipv4},
908 SERVER_IPV6 => $ctx->{ipv6},
909 DC_SERVER_IPV6 => $ctx->{ipv6},
910 NETBIOSNAME => $ctx->{netbiosname},
911 DC_NETBIOSNAME => $ctx->{netbiosname},
912 DOMAIN => $ctx->{domain},
913 USERNAME => $ctx->{username},
914 DC_USERNAME => $ctx->{username},
915 DOMAIN_ADMIN => $ctx->{domain_admin},
916 DOMAIN_ADMIN_PASSWORD => $ctx->{domain_admin_password},
917 DOMAIN_USER => $ctx->{domain_user},
918 DOMAIN_USER_PASSWORD => $ctx->{domain_user_password},
919 REALM => $ctx->{realm},
920 DNSNAME => $ctx->{dnsname},
921 SAMSID => $ctx->{samsid},
922 PASSWORD => $ctx->{password},
923 DC_PASSWORD => $ctx->{password},
924 LDAPDIR => $ctx->{ldapdir},
925 LDAP_INSTANCE => $ctx->{ldap_instance},
926 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
927 NCALRPCDIR => $ctx->{ncalrpcdir},
928 LOCKDIR => $ctx->{lockdir},
929 STATEDIR => $ctx->{statedir},
930 CACHEDIR => $ctx->{cachedir},
931 PRIVATEDIR => $ctx->{privatedir},
932 BINDDNSDIR => $ctx->{binddnsdir},
933 SERVERCONFFILE => $ctx->{smb_conf},
934 TESTENV_DIR => $ctx->{prefix_abs},
935 CONFIGURATION => $configuration,
936 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
937 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
938 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
939 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
940 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
941 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
942 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
943 SAMBA_TEST_LOG_POS => 0,
944 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
945 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
946 LOCAL_PATH => $ctx->{share},
947 UID_RFC2307TEST => $uid_rfc2307test,
948 GID_RFC2307TEST => $gid_rfc2307test,
949 SERVER_ROLE => $ctx->{server_role},
950 RESOLV_CONF => $ctx->{resolv_conf},
951 KRB5_CRL_FILE => $crlfile,
952 };
953
954 if (defined($ctx->{use_resolv_wrapper})) {
955 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
956 } else {
957 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
958 }
959 if (defined($ctx->{force_fips_mode})) {
960 $ret->{GNUTLS_FORCE_FIPS_MODE} = "1",
961 $ret->{OPENSSL_FORCE_FIPS_MODE} = "1",
962 }
963
964 if ($ctx->{server_role} eq "domain controller") {
965 $ret->{DOMSID} = $ret->{SAMSID};
966 }
967
968 return $ret;
969 }
970
971 #
972 # Step2 runs the provision script
973 #
974 sub provision_raw_step2($$$)
975 {
976 my ($self, $ctx, $ret) = @_;
977
978 my $ldif;
979
980 my $provision_cmd = join(" ", @{$ctx->{provision_options}});
981 unless (system($provision_cmd) == 0) {
982 warn("Unable to provision: \n$provision_cmd\n");
983 return undef;
984 }
985
986 my $cmd_env = $self->get_cmd_env_vars($ret);
987
988 my $testallowed_account = "testallowed";
989 my $samba_tool_cmd = ${cmd_env};
990 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
991 . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
992 unless (system($samba_tool_cmd) == 0) {
993 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
994 return undef;
995 }
996
997 my $srv_account = "srv_account";
998 $samba_tool_cmd = ${cmd_env};
999 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1000 . " user create --configfile=$ctx->{smb_conf} $srv_account $ctx->{password}";
1001 unless (system($samba_tool_cmd) == 0) {
1002 warn("Unable to add $srv_account user: \n$samba_tool_cmd\n");
1003 return undef;
1004 }
1005
1006 $samba_tool_cmd = ${cmd_env};
1007 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1008 . " spn add HOST/$srv_account --configfile=$ctx->{smb_conf} $srv_account";
1009 unless (system($samba_tool_cmd) == 0) {
1010 warn("Unable to add spn for $srv_account: \n$samba_tool_cmd\n");
1011 return undef;
1012 }
1013
1014 my $ldbmodify = ${cmd_env};
1015 $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
1016 $ldbmodify .= " --configfile=$ctx->{smb_conf}";
1017 my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
1018
1019 if ($ctx->{server_role} ne "domain controller") {
1020 $base_dn = "DC=$ctx->{netbiosname}";
1021 }
1022
1023 my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
1024 $testallowed_account = "testallowed account";
1025 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1026 or die "Failed to run $ldbmodify: $!";
1027 print $ldif "dn: $user_dn
1028 changetype: modify
1029 replace: samAccountName
1030 samAccountName: $testallowed_account
1031 -
1032 ";
1033 close($ldif);
1034 unless ($? == 0) {
1035 warn("$ldbmodify failed: $?");
1036 return undef;
1037 }
1038
1039 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1040 or die "Failed to run $ldbmodify: $!";
1041 print $ldif "dn: $user_dn
1042 changetype: modify
1043 replace: userPrincipalName
1044 userPrincipalName: testallowed upn\@$ctx->{realm}
1045 replace: servicePrincipalName
1046 servicePrincipalName: host/testallowed
1047 -
1048 ";
1049 close($ldif);
1050 unless ($? == 0) {
1051 warn("$ldbmodify failed: $?");
1052 return undef;
1053 }
1054
1055 $samba_tool_cmd = ${cmd_env};
1056 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1057 . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
1058 unless (system($samba_tool_cmd) == 0) {
1059 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
1060 return undef;
1061 }
1062
1063 $user_dn = "cn=testdenied,cn=users,$base_dn";
1064 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1065 or die "Failed to run $ldbmodify: $!";
1066 print $ldif "dn: $user_dn
1067 changetype: modify
1068 replace: userPrincipalName
1069 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
1070 -
1071 ";
1072 close($ldif);
1073 unless ($? == 0) {
1074 warn("$ldbmodify failed: $?");
1075 return undef;
1076 }
1077
1078 $samba_tool_cmd = ${cmd_env};
1079 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1080 . " user create --configfile=$ctx->{smb_conf} testupnspn $ctx->{password}";
1081 unless (system($samba_tool_cmd) == 0) {
1082 warn("Unable to add testupnspn user: \n$samba_tool_cmd\n");
1083 return undef;
1084 }
1085
1086 $user_dn = "cn=testupnspn,cn=users,$base_dn";
1087 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1088 or die "Failed to run $ldbmodify: $!";
1089 print $ldif "dn: $user_dn
1090 changetype: modify
1091 replace: userPrincipalName
1092 userPrincipalName: http/testupnspn.$ctx->{dnsname}\@$ctx->{realm}
1093 replace: servicePrincipalName
1094 servicePrincipalName: http/testupnspn.$ctx->{dnsname}
1095 -
1096 ";
1097 close($ldif);
1098 unless ($? == 0) {
1099 warn("$ldbmodify failed: $?");
1100 return undef;
1101 }
1102
1103 $samba_tool_cmd = ${cmd_env};
1104 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1105 . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
1106 unless (system($samba_tool_cmd) == 0) {
1107 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
1108 return undef;
1109 }
1110
1111 # Create two users alice and bob!
1112 my $user_account_array = ["alice", "bob", "jane", "joe"];
1113
1114 foreach my $user_account (@{$user_account_array}) {
1115 my $samba_tool_cmd = ${cmd_env};
1116
1117 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1118 . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
1119 unless (system($samba_tool_cmd) == 0) {
1120 warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
1121 return undef;
1122 }
1123 }
1124
1125 my $group_array = ["Samba Users"];
1126
1127 foreach my $group (@{$group_array}) {
1128 my $samba_tool_cmd = ${cmd_env};
1129
1130 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1131 . " group add --configfile=$ctx->{smb_conf} \"$group\"";
1132 unless (system($samba_tool_cmd) == 0) {
1133 warn("Unable to create group: $group\n$samba_tool_cmd\n");
1134 return undef;
1135 }
1136 }
1137
1138 # Add user joe to group "Samba Users"
1139 my $group = "Samba Users";
1140 my $user_account = "joe";
1141
1142 $samba_tool_cmd = ${cmd_env};
1143 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1144 . " group addmembers --configfile=$ctx->{smb_conf} \"$group\" $user_account";
1145 unless (system($samba_tool_cmd) == 0) {
1146 warn("Unable to add " . $user_account . "to group group : $group\n$samba_tool_cmd\n");
1147 return undef;
1148 }
1149
1150 $group = "Samba Users";
1151 $user_account = "joe";
1152
1153 $samba_tool_cmd = ${cmd_env};
1154 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1155 . " user setprimarygroup --configfile=$ctx->{smb_conf} $user_account \"$group\"";
1156 unless (system($samba_tool_cmd) == 0) {
1157 warn("Unable to set primary group of user: $user_account\n$samba_tool_cmd\n");
1158 return undef;
1159 }
1160
1161 # Change the userPrincipalName for jane
1162 $user_dn = "cn=jane,cn=users,$base_dn";
1163
1164 open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1165 or die "Failed to run $ldbmodify: $!";
1166 print $ldif "dn: $user_dn
1167 changetype: modify
1168 replace: userPrincipalName
1169 userPrincipalName: jane.doe\@$ctx->{realm}
1170 -
1171 ";
1172 close($ldif);
1173 unless ($? == 0) {
1174 warn("$ldbmodify failed: $?");
1175 return undef;
1176 }
1177
1178 return $ret;
1179 }
1180
1181 sub provision($$$$$$$$$$$)
1182 {
1183 my ($self,
1184 $prefix,
1185 $server_role,
1186 $hostname,
1187 $domain,
1188 $realm,
1189 $functional_level,
1190 $password,
1191 $kdc_ipv4,
1192 $kdc_ipv6,
1193 $force_fips_mode,
1194 $extra_smbconf_options,
1195 $extra_smbconf_shares,
1196 $extra_provision_options) = @_;
1197
1198 my $samsid = Samba::random_domain_sid();
1199
1200 my $ctx = $self->provision_raw_prepare($prefix, $server_role,
1201 $hostname,
1202 $domain, $realm,
1203 $samsid,
1204 $functional_level,
1205 $password,
1206 $kdc_ipv4,
1207 $kdc_ipv6,
1208 $force_fips_mode,
1209 $extra_provision_options);
1210
1211 $ctx->{share} = "$ctx->{prefix_abs}/share";
1212 push(@{$ctx->{directories}}, "$ctx->{share}");
1213 push(@{$ctx->{directories}}, "$ctx->{share}/test1");
1214 push(@{$ctx->{directories}}, "$ctx->{share}/test2");
1215
1216 # precreate directories for printer drivers
1217 push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
1218 push(@{$ctx->{directories}}, "$ctx->{share}/x64");
1219 push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
1220
1221 my $msdfs = "no";
1222 $msdfs = "yes" if ($server_role eq "domain controller");
1223 $ctx->{smb_conf_extra_options} = "
1224
1225 max xmit = 32K
1226 server max protocol = SMB2
1227 host msdfs = $msdfs
1228 lanman auth = yes
1229
1230 # fruit:copyfile is a global option
1231 fruit:copyfile = yes
1232
1233 $extra_smbconf_options
1234
1235 [tmp]
1236 path = $ctx->{share}
1237 read only = no
1238 posix:sharedelay = 100000
1239 posix:oplocktimeout = 3
1240 posix:writetimeupdatedelay = 500000
1241
1242 [xcopy_share]
1243 path = $ctx->{share}
1244 read only = no
1245 posix:sharedelay = 100000
1246 posix:oplocktimeout = 3
1247 posix:writetimeupdatedelay = 500000
1248 create mask = 777
1249 force create mode = 777
1250
1251 [posix_share]
1252 path = $ctx->{share}
1253 read only = no
1254 create mask = 0777
1255 force create mode = 0
1256 directory mask = 0777
1257 force directory mode = 0
1258
1259 [test1]
1260 path = $ctx->{share}/test1
1261 read only = no
1262 posix:sharedelay = 100000
1263 posix:oplocktimeout = 3
1264 posix:writetimeupdatedelay = 500000
1265
1266 [test2]
1267 path = $ctx->{share}/test2
1268 read only = no
1269 posix:sharedelay = 100000
1270 posix:oplocktimeout = 3
1271 posix:writetimeupdatedelay = 500000
1272
1273 [cifs]
1274 path = $ctx->{share}/_ignore_cifs_
1275 read only = no
1276 ntvfs handler = cifs
1277 cifs:server = $ctx->{netbiosname}
1278 cifs:share = tmp
1279 cifs:use-s4u2proxy = yes
1280 # There is no username specified here, instead the client is expected
1281 # to log in with kerberos, and the serverwill use delegated credentials.
1282 # Or the server tries s4u2self/s4u2proxy to impersonate the client
1283
1284 [simple]
1285 path = $ctx->{share}
1286 read only = no
1287 ntvfs handler = simple
1288
1289 [sysvol]
1290 path = $ctx->{statedir}/sysvol
1291 read only = no
1292
1293 [netlogon]
1294 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1295 read only = no
1296
1297 [cifsposix]
1298 copy = simple
1299 ntvfs handler = cifsposix
1300
1301 [vfs_fruit]
1302 path = $ctx->{share}
1303 vfs objects = catia fruit streams_xattr acl_xattr
1304 ea support = yes
1305 fruit:resource = file
1306 fruit:metadata = netatalk
1307 fruit:locking = netatalk
1308 fruit:encoding = native
1309
1310 [xattr]
1311 path = $ctx->{share}
1312 # This can be used for testing real fs xattr stuff
1313 vfs objects = streams_xattr acl_xattr
1314
1315 $extra_smbconf_shares
1316 ";
1317
1318 my $ret = $self->provision_raw_step1($ctx);
1319 unless (defined $ret) {
1320 return undef;
1321 }
1322
1323 return $self->provision_raw_step2($ctx, $ret);
1324 }
1325
1326 # For multi-DC testenvs, we want $DC_SERVER to always be the PDC (i.e. the
1327 # original DC) in the testenv. $SERVER is always the joined DC that we are
1328 # actually running the test against
1329 sub set_pdc_env_vars
1330 {
1331 my ($self, $env, $dcvars) = @_;
1332
1333 $env->{DC_SERVER} = $dcvars->{DC_SERVER};
1334 $env->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1335 $env->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1336 $env->{DC_SERVERCONFFILE} = $dcvars->{SERVERCONFFILE};
1337 $env->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1338 $env->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1339 $env->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1340 }
1341
1342 sub provision_s4member($$$$$)
1343 {
1344 my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
1345 print "PROVISIONING MEMBER...\n";
1346 my $extra_smb_conf = "
1347 passdb backend = samba_dsdb
1348 winbindd:use external pipes = true
1349
1350 # the source4 smb server doesn't allow signing by default
1351 server signing = enabled
1352 raw NTLMv2 auth = yes
1353
1354 # override the new SMB2 only default
1355 client min protocol = CORE
1356 server min protocol = LANMAN1
1357 ";
1358 if ($more_conf) {
1359 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1360 }
1361 my $extra_provision_options = ["--use-ntvfs"];
1362 my $ret = $self->provision($prefix,
1363 "member server",
1364 $hostname,
1365 $dcvars->{DOMAIN},
1366 $dcvars->{REALM},
1367 "2008",
1368 "locMEMpass3",
1369 $dcvars->{SERVER_IP},
1370 $dcvars->{SERVER_IPV6},
1371 undef,
1372 $extra_smb_conf, "",
1373 $extra_provision_options);
1374 unless ($ret) {
1375 return undef;
1376 }
1377
1378 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1379 my $cmd = $self->get_cmd_env_vars($ret);
1380 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member member";
1381 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1382 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1383
1384 unless (system($cmd) == 0) {
1385 warn("Join failed\n$cmd");
1386 return undef;
1387 }
1388
1389 $ret->{DOMSID} = $dcvars->{DOMSID};
1390 $self->set_pdc_env_vars($ret, $dcvars);
1391
1392 return $ret;
1393 }
1394
1395 sub provision_rpc_proxy($$$)
1396 {
1397 my ($self, $prefix, $dcvars) = @_;
1398 print "PROVISIONING RPC PROXY...\n";
1399
1400 my $extra_smbconf_options = "
1401 passdb backend = samba_dsdb
1402
1403 # rpc_proxy
1404 dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1405 dcerpc endpoint servers = epmapper, remote
1406 dcerpc_remote:interfaces = rpcecho
1407 dcerpc_remote:allow_anonymous_fallback = yes
1408 # override the new SMB2 only default
1409 client min protocol = CORE
1410 server min protocol = LANMAN1
1411 [cifs_to_dc]
1412 path = /tmp/_ignore_cifs_to_dc_/_none_
1413 read only = no
1414 ntvfs handler = cifs
1415 cifs:server = $dcvars->{SERVER}
1416 cifs:share = cifs
1417 cifs:use-s4u2proxy = yes
1418 # There is no username specified here, instead the client is expected
1419 # to log in with kerberos, and the serverwill use delegated credentials.
1420 # Or the server tries s4u2self/s4u2proxy to impersonate the client
1421
1422 ";
1423
1424 my $extra_provision_options = ["--use-ntvfs"];
1425 my $ret = $self->provision($prefix,
1426 "member server",
1427 "localrpcproxy",
1428 $dcvars->{DOMAIN},
1429 $dcvars->{REALM},
1430 "2008",
1431 "locRPCproxypass4",
1432 $dcvars->{SERVER_IP},
1433 $dcvars->{SERVER_IPV6},
1434 undef,
1435 $extra_smbconf_options, "",
1436 $extra_provision_options);
1437 unless ($ret) {
1438 return undef;
1439 }
1440
1441 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1442
1443 # The joind runs in the context of the rpc_proxy/member for now
1444 my $cmd = $self->get_cmd_env_vars($ret);
1445 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member member";
1446 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1447 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1448
1449 unless (system($cmd) == 0) {
1450 warn("Join failed\n$cmd");
1451 return undef;
1452 }
1453
1454 # Prepare a context of the DC, but using the local CCACHE.
1455 my $overwrite = undef;
1456 $overwrite->{KRB5_CCACHE} = $ret->{KRB5_CCACHE};
1457 my $dc_cmd_env = $self->get_cmd_env_vars($dcvars, $overwrite);
1458
1459 # Setting up delegation runs in the context of the DC for now
1460 $cmd = $dc_cmd_env;
1461 $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1462 $cmd .= " $dcvars->{CONFIGURATION}";
1463 print $cmd;
1464
1465 unless (system($cmd) == 0) {
1466 warn("Delegation failed\n$cmd");
1467 return undef;
1468 }
1469
1470 # Setting up delegation runs in the context of the DC for now
1471 $cmd = $dc_cmd_env;
1472 $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1473 $cmd .= " $dcvars->{CONFIGURATION}";
1474
1475 unless (system($cmd) == 0) {
1476 warn("Delegation failed\n$cmd");
1477 return undef;
1478 }
1479
1480 $ret->{DOMSID} = $dcvars->{DOMSID};
1481 $self->set_pdc_env_vars($ret, $dcvars);
1482
1483 return $ret;
1484 }
1485
1486 sub provision_promoted_dc($$$)
1487 {
1488 my ($self, $prefix, $dcvars) = @_;
1489 print "PROVISIONING PROMOTED DC...\n";
1490
1491 # We do this so that we don't run the provision. That's the job of 'samba-tool domain dcpromo'.
1492 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1493 "promotedvdc",
1494 $dcvars->{DOMAIN},
1495 $dcvars->{REALM},
1496 $dcvars->{SAMSID},
1497 "2008",
1498 $dcvars->{PASSWORD},
1499 $dcvars->{SERVER_IP},
1500 $dcvars->{SERVER_IPV6});
1501
1502 $ctx->{smb_conf_extra_options} = "
1503 max xmit = 32K
1504 server max protocol = SMB2
1505
1506 ntlm auth = ntlmv2-only
1507
1508 kdc force enable rc4 weak session keys = yes
1509
1510 [sysvol]
1511 path = $ctx->{statedir}/sysvol
1512 read only = yes
1513
1514 [netlogon]
1515 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1516 read only = no
1517
1518 ";
1519
1520 my $ret = $self->provision_raw_step1($ctx);
1521 unless ($ret) {
1522 return undef;
1523 }
1524
1525 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1526 my $cmd = $self->get_cmd_env_vars($ret);
1527 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} --experimental-s4-member MEMBER --realm=$dcvars->{REALM}";
1528 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1529 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1530
1531 unless (system($cmd) == 0) {
1532 warn("Join failed\n$cmd");
1533 return undef;
1534 }
1535
1536 $samba_tool = Samba::bindir_path($self, "samba-tool");
1537 $cmd = $self->get_cmd_env_vars($ret);
1538 $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1539 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1540 $cmd .= " --machinepass=machine$ret->{PASSWORD} --dns-backend=BIND9_DLZ";
1541
1542 unless (system($cmd) == 0) {
1543 warn("Join failed\n$cmd");
1544 return undef;
1545 }
1546
1547 $self->set_pdc_env_vars($ret, $dcvars);
1548
1549 return $ret;
1550 }
1551
1552 sub provision_vampire_dc($$$)
1553 {
1554 my ($self, $prefix, $dcvars, $fl) = @_;
1555 print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1556 my $name = "localvampiredc";
1557 my $extra_conf = "";
1558
1559 if ($fl == "2000") {
1560 $name = "vampire2000dc";
1561 } else {
1562 $extra_conf = "drs: immediate link sync = yes
1563 drs: max link sync = 250";
1564 }
1565
1566 # We do this so that we don't run the provision. That's the job of 'net vampire'.
1567 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1568 $name,
1569 $dcvars->{DOMAIN},
1570 $dcvars->{REALM},
1571 $dcvars->{DOMSID},
1572 $fl,
1573 $dcvars->{PASSWORD},
1574 $dcvars->{SERVER_IP},
1575 $dcvars->{SERVER_IPV6});
1576
1577 $ctx->{smb_conf_extra_options} = "
1578 max xmit = 32K
1579 server max protocol = SMB2
1580
1581 ntlm auth = mschapv2-and-ntlmv2-only
1582 $extra_conf
1583
1584 [sysvol]
1585 path = $ctx->{statedir}/sysvol
1586 read only = yes
1587
1588 [netlogon]
1589 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1590 read only = no
1591
1592 ";
1593
1594 my $ret = $self->provision_raw_step1($ctx);
1595 unless ($ret) {
1596 return undef;
1597 }
1598
1599 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1600 my $cmd = $self->get_cmd_env_vars($ret);
1601 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1602 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1603 $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1604 $cmd .= " --backend-store=$self->{default_ldb_backend}";
1605
1606 unless (system($cmd) == 0) {
1607 warn("Join failed\n$cmd");
1608 return undef;
1609 }
1610
1611 $self->set_pdc_env_vars($ret, $dcvars);
1612 $ret->{DC_REALM} = $dcvars->{DC_REALM};
1613
1614 return $ret;
1615 }
1616
1617 sub provision_ad_dc_ntvfs($$$)
1618 {
1619 my ($self, $prefix, $extra_provision_options) = @_;
1620
1621 # We keep the old 'winbind' name here in server services to
1622 # ensure upgrades which used that name still work with the now
1623 # alias.
1624
1625 print "PROVISIONING AD DC (NTVFS)...\n";
1626 my $extra_conf_options = "netbios aliases = localDC1-a
1627 server services = +winbind -winbindd
1628 ldap server require strong auth = allow_sasl_without_tls_channel_bindings
1629 raw NTLMv2 auth = yes
1630 lsa over netlogon = yes
1631 rpc server port = 1027
1632 auth event notification = true
1633 dsdb event notification = true
1634 dsdb password event notification = true
1635 dsdb group change notification = true
1636 # override the new SMB2 only default
1637 client min protocol = CORE
1638 server min protocol = LANMAN1
1639
1640 CVE_2020_1472:warn_about_unused_debug_level = 3
1641 CVE_2022_38023:warn_about_unused_debug_level = 3
1642 allow nt4 crypto:torturetest\$ = yes
1643 server reject md5 schannel:schannel2\$ = no
1644 server reject md5 schannel:schannel3\$ = no
1645 server reject md5 schannel:schannel8\$ = no
1646 server reject md5 schannel:schannel9\$ = no
1647 server reject md5 schannel:torturetest\$ = no
1648 server reject md5 schannel:tests4u2proxywk\$ = no
1649 server reject md5 schannel:tests4u2selfbdc\$ = no
1650 server reject md5 schannel:tests4u2selfwk\$ = no
1651 server reject md5 schannel:torturepacbdc\$ = no
1652 server reject md5 schannel:torturepacwksta\$ = no
1653 server reject aes schannel:schannel2\$ = no
1654 server reject aes schannel:schannel3\$ = no
1655 server reject aes schannel:schannel8\$ = no
1656 server reject aes schannel:schannel9\$ = no
1657 server reject aes schannel:torturetest\$ = no
1658 server reject aes schannel:tests4u2proxywk\$ = no
1659 server reject aes schannel:tests4u2selfbdc\$ = no
1660 server reject aes schannel:tests4u2selfwk\$ = no
1661 server reject aes schannel:torturepacbdc\$ = no
1662 server reject aes schannel:torturepacwksta\$ = no
1663 server require schannel:schannel0\$ = no
1664 server require schannel:schannel1\$ = no
1665 server require schannel:schannel2\$ = no
1666 server require schannel:schannel3\$ = no
1667 server require schannel:schannel4\$ = no
1668 server require schannel:schannel5\$ = no
1669 server require schannel:schannel6\$ = no
1670 server require schannel:schannel7\$ = no
1671 server require schannel:schannel8\$ = no
1672 server require schannel:schannel9\$ = no
1673 server require schannel:schannel10\$ = no
1674 server require schannel:schannel11\$ = no
1675 server require schannel:torturetest\$ = no
1676 server schannel require seal:schannel0\$ = no
1677 server schannel require seal:schannel1\$ = no
1678 server schannel require seal:schannel2\$ = no
1679 server schannel require seal:schannel3\$ = no
1680 server schannel require seal:schannel4\$ = no
1681 server schannel require seal:schannel5\$ = no
1682 server schannel require seal:schannel6\$ = no
1683 server schannel require seal:schannel7\$ = no
1684 server schannel require seal:schannel8\$ = no
1685 server schannel require seal:schannel9\$ = no
1686 server schannel require seal:schannel10\$ = no
1687 server schannel require seal:schannel11\$ = no
1688 server schannel require seal:torturetest\$ = no
1689
1690 # needed for 'samba.tests.auth_log' tests
1691 server require schannel:LOCALDC\$ = no
1692 server schannel require seal:LOCALDC\$ = no
1693 ";
1694 push (@{$extra_provision_options},
1695 "--base-schema=2008_R2",
1696 "--use-ntvfs");
1697 my $ret = $self->provision($prefix,
1698 "domain controller",
1699 "localdc",
1700 "SAMBADOMAIN",
1701 "samba.example.com",
1702 "2008",
1703 "locDCpass1",
1704 undef,
1705 undef,
1706 undef,
1707 $extra_conf_options,
1708 "",
1709 $extra_provision_options);
1710 unless ($ret) {
1711 return undef;
1712 }
1713
1714 unless($self->add_wins_config("$prefix/private")) {
1715 warn("Unable to add wins configuration");
1716 return undef;
1717 }
1718 $ret->{NETBIOSALIAS} = "localdc1-a";
1719 $ret->{DC_REALM} = $ret->{REALM};
1720
1721 return $ret;
1722 }
1723
1724 sub provision_fl2000dc($$)
1725 {
1726 my ($self, $prefix) = @_;
1727
1728 print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1729 my $extra_conf_options = "
1730 kdc enable fast = no
1731 spnego:simulate_w2k=yes
1732 ntlmssp_server:force_old_spnego=yes
1733
1734 CVE_2022_38023:warn_about_unused_debug_level = 3
1735 server reject md5 schannel:tests4u2proxywk\$ = no
1736 server reject md5 schannel:tests4u2selfbdc\$ = no
1737 server reject md5 schannel:tests4u2selfwk\$ = no
1738 server reject md5 schannel:torturepacbdc\$ = no
1739 server reject md5 schannel:torturepacwksta\$ = no
1740 server reject aes schannel:tests4u2proxywk\$ = no
1741 server reject aes schannel:tests4u2selfbdc\$ = no
1742 server reject aes schannel:tests4u2selfwk\$ = no
1743 server reject aes schannel:torturepacbdc\$ = no
1744 server reject aes schannel:torturepacwksta\$ = no
1745 ";
1746 my $extra_provision_options = ["--base-schema=2008_R2"];
1747 # This environment uses plain text secrets
1748 # i.e. secret attributes are not encrypted on disk.
1749 # This allows testing of the --plaintext-secrets option for
1750 # provision
1751 push (@{$extra_provision_options}, "--plaintext-secrets");
1752 my $ret = $self->provision($prefix,
1753 "domain controller",
1754 "dc5",
1755 "SAMBA2000",
1756 "samba2000.example.com",
1757 "2000",
1758 "locDCpass5",
1759 undef,
1760 undef,
1761 undef,
1762 $extra_conf_options,
1763 "",
1764 $extra_provision_options);
1765 unless ($ret) {
1766 return undef;
1767 }
1768
1769 unless($self->add_wins_config("$prefix/private")) {
1770 warn("Unable to add wins configuration");
1771 return undef;
1772 }
1773 $ret->{DC_REALM} = $ret->{REALM};
1774
1775 return $ret;
1776 }
1777
1778 sub provision_fl2003dc($$$)
1779 {
1780 my ($self, $prefix, $dcvars) = @_;
1781 my $ip_addr1 = Samba::get_ipv4_addr("fakednsforwarder1");
1782 my $ip_addr2 = Samba::get_ipv6_addr("fakednsforwarder2");
1783
1784 print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1785 my $extra_conf_options = "
1786 allow dns updates = nonsecure and secure
1787
1788 kdc enable fast = no
1789 dcesrv:header signing = no
1790 dcesrv:max auth states = 0
1791
1792 dns forwarder = $ip_addr1 [$ip_addr2]:54
1793
1794 CVE_2022_38023:warn_about_unused_debug_level = 3
1795 server reject md5 schannel:tests4u2proxywk\$ = no
1796 server reject md5 schannel:tests4u2selfbdc\$ = no
1797 server reject md5 schannel:tests4u2selfwk\$ = no
1798 server reject md5 schannel:torturepacbdc\$ = no
1799 server reject md5 schannel:torturepacwksta\$ = no
1800 server reject aes schannel:tests4u2proxywk\$ = no
1801 server reject aes schannel:tests4u2selfbdc\$ = no
1802 server reject aes schannel:tests4u2selfwk\$ = no
1803 server reject aes schannel:torturepacbdc\$ = no
1804 server reject aes schannel:torturepacwksta\$ = no
1805 ";
1806
1807 my $extra_provision_options = ["--base-schema=2008_R2"];
1808 my $ret = $self->provision($prefix,
1809 "domain controller",
1810 "dc6",
1811 "SAMBA2003",
1812 "samba2003.example.com",
1813 "2003",
1814 "locDCpass6",
1815 undef,
1816 undef,
1817 undef,
1818 $extra_conf_options,
1819 "",
1820 $extra_provision_options);
1821 unless (defined $ret) {
1822 return undef;
1823 }
1824
1825 $ret->{DNS_FORWARDER1} = $ip_addr1;
1826 $ret->{DNS_FORWARDER2} = $ip_addr2;
1827
1828 my @samba_tool_options;
1829 push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1830 push (@samba_tool_options, "domain");
1831 push (@samba_tool_options, "passwordsettings");
1832 push (@samba_tool_options, "set");
1833 push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1834 push (@samba_tool_options, "--min-pwd-age=0");
1835 push (@samba_tool_options, "--history-length=1");
1836
1837 my $samba_tool_cmd = join(" ", @samba_tool_options);
1838
1839 unless (system($samba_tool_cmd) == 0) {
1840 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1841 return undef;
1842 }
1843
1844 unless($self->add_wins_config("$prefix/private")) {
1845 warn("Unable to add wins configuration");
1846 return undef;
1847 }
1848
1849 return $ret;
1850 }
1851
1852 sub provision_fl2008r2dc($$$)
1853 {
1854 my ($self, $prefix, $dcvars) = @_;
1855
1856 print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1857 my $extra_conf_options = "
1858 ldap server require strong auth = no
1859 # delay by 10 seconds, 10^7 usecs
1860 ldap_server:delay_expire_disconnect = 10000
1861
1862 CVE_2022_38023:warn_about_unused_debug_level = 3
1863 server reject md5 schannel:tests4u2proxywk\$ = no
1864 server reject md5 schannel:tests4u2selfbdc\$ = no
1865 server reject md5 schannel:tests4u2selfwk\$ = no
1866 server reject md5 schannel:torturepacbdc\$ = no
1867 server reject md5 schannel:torturepacwksta\$ = no
1868 server reject aes schannel:tests4u2proxywk\$ = no
1869 server reject aes schannel:tests4u2selfbdc\$ = no
1870 server reject aes schannel:tests4u2selfwk\$ = no
1871 server reject aes schannel:torturepacbdc\$ = no
1872 server reject aes schannel:torturepacwksta\$ = no
1873 ";
1874 my $extra_provision_options = ["--base-schema=2008_R2"];
1875 my $ret = $self->provision($prefix,
1876 "domain controller",
1877 "dc7",
1878 "SAMBA2008R2",
1879 "samba2008R2.example.com",
1880 "2008_R2",
1881 "locDCpass7",
1882 undef,
1883 undef,
1884 undef,
1885 $extra_conf_options,
1886 "",
1887 $extra_provision_options);
1888 unless (defined $ret) {
1889 return undef;
1890 }
1891
1892 unless ($self->add_wins_config("$prefix/private")) {
1893 warn("Unable to add wins configuration");
1894 return undef;
1895 }
1896 $ret->{DC_REALM} = $ret->{REALM};
1897
1898 return $ret;
1899 }
1900
1901
1902 sub provision_rodc($$$)
1903 {
1904 my ($self, $prefix, $dcvars) = @_;
1905 print "PROVISIONING RODC...\n";
1906
1907 # We do this so that we don't run the provision. That's the job of 'net join RODC'.
1908 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1909 "rodc",
1910 $dcvars->{DOMAIN},
1911 $dcvars->{REALM},
1912 $dcvars->{DOMSID},
1913 "2008",
1914 $dcvars->{PASSWORD},
1915 $dcvars->{SERVER_IP},
1916 $dcvars->{SERVER_IPV6});
1917 unless ($ctx) {
1918 return undef;
1919 }
1920
1921 $ctx->{share} = "$ctx->{prefix_abs}/share";
1922 push(@{$ctx->{directories}}, "$ctx->{share}");
1923
1924 $ctx->{smb_conf_extra_options} = "
1925 max xmit = 32K
1926 server max protocol = SMB2
1927 password server = $dcvars->{DC_SERVER}
1928
1929 [sysvol]
1930 path = $ctx->{statedir}/sysvol
1931 read only = yes
1932
1933 [netlogon]
1934 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1935 read only = yes
1936
1937 [tmp]
1938 path = $ctx->{share}
1939 read only = no
1940 posix:sharedelay = 10000
1941 posix:oplocktimeout = 3
1942 posix:writetimeupdatedelay = 50000
1943
1944 ";
1945
1946 my $ret = $self->provision_raw_step1($ctx);
1947 unless ($ret) {
1948 return undef;
1949 }
1950
1951 my $samba_tool = Samba::bindir_path($self, "samba-tool");
1952 my $cmd = $self->get_cmd_env_vars($ret);
1953 $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1954 $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1955 $cmd .= " --server=$dcvars->{DC_SERVER}";
1956
1957 unless (system($cmd) == 0) {
1958 warn("RODC join failed\n$cmd");
1959 return undef;
1960 }
1961
1962 # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1963 # user password verified on the RODC
1964 my $testallowed_account = "testallowed account";
1965 $cmd = $self->get_cmd_env_vars($ret);
1966 $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1967 $cmd .= " --server=$dcvars->{DC_SERVER}";
1968
1969 unless (system($cmd) == 0) {
1970 warn("RODC join failed\n$cmd");
1971 return undef;
1972 }
1973
1974 # we overwrite the kdc after the RODC join
1975 # so that use the RODC as kdc and test
1976 # the proxy code
1977 $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1978 $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1979 Samba::mk_krb5_conf($ctx);
1980 Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1981
1982 $self->set_pdc_env_vars($ret, $dcvars);
1983
1984 return $ret;
1985 }
1986
1987 sub read_config_h($)
1988 {
1989 my ($name) = @_;
1990 my %ret;
1991 open(LF, "<$name") or die("unable to read $name: $!");
1992 while (<LF>) {
1993 chomp;
1994 next if not (/^#define /);
1995 if (/^#define (.*?)[ \t]+(.*?)$/) {
1996 $ret{$1} = $2;
1997 next;
1998 }
1999 if (/^#define (.*?)[ \t]+$/) {
2000 $ret{$1} = 1;;
2001 next;
2002 }
2003 }
2004 close(LF);
2005 return \%ret;
2006 }
2007
2008 sub provision_ad_dc()
2009 {
2010 my ($self,
2011 $prefix,
2012 $hostname,
2013 $domain,
2014 $realm,
2015 $force_fips_mode,
2016 $smbconf_args,
2017 $extra_provision_options,
2018 $functional_level) = @_;
2019
2020 my $prefix_abs = abs_path($prefix);
2021
2022 my $bindir_abs = abs_path($self->{bindir});
2023 my $lockdir="$prefix_abs/lockdir";
2024 my $conffile="$prefix_abs/etc/smb.conf";
2025
2026 my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
2027 if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} // '' eq "1") {
2028 $require_mutexes = "";
2029 }
2030
2031 my $config_h = {};
2032
2033 if (!defined($functional_level)) {
2034 $functional_level = "2016";
2035 }
2036
2037 # If we choose to have distinct environments for experimental
2038 # 2012 as well as the experimental 2016 support, we should
2039 # extend what we match here.
2040 if ($functional_level eq "2016") {
2041 $smbconf_args = "$smbconf_args
2042
2043 [global]
2044 ad dc functional level = 2016
2045 ";
2046 }
2047 if (defined($ENV{CONFIG_H})) {
2048 $config_h = read_config_h($ENV{CONFIG_H});
2049 }
2050
2051 my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
2052 $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
2053
2054 my $extra_smbconf_options = "
2055 xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
2056
2057 dbwrap_tdb_mutexes:* = yes
2058 ${require_mutexes}
2059
2060 ${password_hash_gpg_key_ids}
2061
2062 kernel oplocks = no
2063 kernel change notify = no
2064 smb2 leases = no
2065 smb2 disable oplock break retry = yes
2066 server multi channel support = yes
2067
2068 logging = file
2069 printing = bsd
2070 printcap name = /dev/null
2071
2072 max protocol = SMB3
2073 read only = no
2074
2075 smbd:sharedelay = 100000
2076 smbd:writetimeupdatedelay = 500000
2077 create mask = 755
2078 dos filemode = yes
2079 check parent directory delete on close = yes
2080
2081 dcerpc endpoint servers = -winreg -srvsvc
2082
2083 printcap name = /dev/null
2084
2085 addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
2086 deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
2087
2088 printing = vlp
2089 print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
2090 lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
2091 lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
2092 lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
2093 lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
2094 queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
2095 queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
2096 lpq cache time = 0
2097 print notify backchannel = yes
2098
2099 server support krb5 netlogon = yes
2100 CVE_2020_1472:warn_about_unused_debug_level = 3
2101 CVE_2022_38023:warn_about_unused_debug_level = 3
2102 CVE_2022_38023:error_debug_level = 2
2103 server reject md5 schannel:schannel2\$ = no
2104 server reject md5 schannel:schannel3\$ = no
2105 server reject md5 schannel:schannel8\$ = no
2106 server reject md5 schannel:schannel9\$ = no
2107 server reject md5 schannel:torturetest\$ = no
2108 server reject md5 schannel:tests4u2proxywk\$ = no
2109 server reject md5 schannel:tests4u2selfbdc\$ = no
2110 server reject md5 schannel:tests4u2selfwk\$ = no
2111 server reject md5 schannel:torturepacbdc\$ = no
2112 server reject md5 schannel:torturepacwksta\$ = no
2113 server reject md5 schannel:samlogontest\$ = no
2114 server reject aes schannel:schannel2\$ = no
2115 server reject aes schannel:schannel3\$ = no
2116 server reject aes schannel:schannel8\$ = no
2117 server reject aes schannel:schannel9\$ = no
2118 server reject aes schannel:torturetest\$ = no
2119 server reject aes schannel:tests4u2proxywk\$ = no
2120 server reject aes schannel:tests4u2selfbdc\$ = no
2121 server reject aes schannel:tests4u2selfwk\$ = no
2122 server reject aes schannel:torturepacbdc\$ = no
2123 server reject aes schannel:torturepacwksta\$ = no
2124 server reject aes schannel:samlogontest\$ = no
2125 server require schannel:schannel0\$ = no
2126 server require schannel:schannel1\$ = no
2127 server require schannel:schannel2\$ = no
2128 server require schannel:schannel3\$ = no
2129 server require schannel:schannel4\$ = no
2130 server require schannel:schannel5\$ = no
2131 server require schannel:schannel6\$ = no
2132 server require schannel:schannel7\$ = no
2133 server require schannel:schannel8\$ = no
2134 server require schannel:schannel9\$ = no
2135 server require schannel:schannel10\$ = no
2136 server require schannel:schannel11\$ = no
2137 server require schannel:torturetest\$ = no
2138 server schannel require seal:schannel0\$ = no
2139 server schannel require seal:schannel1\$ = no
2140 server schannel require seal:schannel2\$ = no
2141 server schannel require seal:schannel3\$ = no
2142 server schannel require seal:schannel4\$ = no
2143 server schannel require seal:schannel5\$ = no
2144 server schannel require seal:schannel6\$ = no
2145 server schannel require seal:schannel7\$ = no
2146 server schannel require seal:schannel8\$ = no
2147 server schannel require seal:schannel9\$ = no
2148 server schannel require seal:schannel10\$ = no
2149 server schannel require seal:schannel11\$ = no
2150 server schannel require seal:torturetest\$ = no
2151
2152 auth event notification = true
2153 dsdb event notification = true
2154 dsdb password event notification = true
2155 dsdb group change notification = true
2156 $smbconf_args
2157 ";
2158
2159 my $extra_smbconf_shares = "
2160
2161 [tmpenc]
2162 copy = tmp
2163 smb encrypt = required
2164
2165 [tmpcase]
2166 copy = tmp
2167 case sensitive = yes
2168
2169 [tmpguest]
2170 copy = tmp
2171 guest ok = yes
2172
2173 [hideunread]
2174 copy = tmp
2175 hide unreadable = yes
2176
2177 [durable]
2178 copy = tmp
2179 kernel share modes = no
2180 kernel oplocks = no
2181 posix locking = no
2182
2183 [print\$]
2184 copy = tmp
2185
2186 [print1]
2187 copy = tmp
2188 printable = yes
2189
2190 [print2]
2191 copy = print1
2192 [print3]
2193 copy = print1
2194 [print4]
2195 copy = print1
2196 guest ok = yes
2197 [lp]
2198 copy = print1
2199 ";
2200
2201 push (@{$extra_provision_options}, "--backend-store=$self->{default_ldb_backend}");
2202 print "PROVISIONING AD DC...\n";
2203 my $ret = $self->provision($prefix,
2204 "domain controller",
2205 $hostname,
2206 $domain,
2207 $realm,
2208 $functional_level,
2209 "locDCpass1",
2210 undef,
2211 undef,
2212 $force_fips_mode,
2213 $extra_smbconf_options,
2214 $extra_smbconf_shares,
2215 $extra_provision_options);
2216 unless (defined $ret) {
2217 return undef;
2218 }
2219
2220 unless($self->add_wins_config("$prefix/private")) {
2221 warn("Unable to add wins configuration");
2222 return undef;
2223 }
2224
2225 return $ret;
2226 }
2227
2228 sub provision_chgdcpass($$)
2229 {
2230 my ($self, $prefix) = @_;
2231
2232 print "PROVISIONING CHGDCPASS...\n";
2233 # This environment disallows the use of this password
2234 # (and also removes the default AD complexity checks)
2235 my $unacceptable_password = "Paßßword-widk3Dsle32jxdBdskldsk55klASKQ";
2236
2237 # This environment also sets some settings that are unusual,
2238 # to test specific behaviours. In particular, this
2239 # environment fails to correctly support DRSUAPI_DRS_GET_ANC
2240 # like Samba before 4.5 and DRSUAPI_DRS_GET_TGT before 4.8
2241 #
2242 # Additionally, disabling DRSUAPI_DRS_GET_TGT causes all links
2243 # to be sent last (in the final chunk), which is like Samba
2244 # before 4.8.
2245
2246 my $extra_smb_conf = "
2247 check password script = $self->{srcdir}/selftest/checkpassword_arg1.sh ${unacceptable_password}
2248 dcesrv:max auth states = 8
2249 drs:broken_samba_4.5_get_anc_emulation = true
2250 drs:get_tgt_support = false
2251 ";
2252 my $extra_provision_options = ["--dns-backend=BIND9_DLZ"];
2253 my $ret = $self->provision($prefix,
2254 "domain controller",
2255 "chgdcpass",
2256 "CHDCDOMAIN",
2257 "chgdcpassword.samba.example.com",
2258 "2008",
2259 "chgDCpass1",
2260 undef,
2261 undef,
2262 undef,
2263 $extra_smb_conf,
2264 "",
2265 $extra_provision_options);
2266 unless (defined $ret) {
2267 return undef;
2268 }
2269
2270 unless($self->add_wins_config("$prefix/private")) {
2271 warn("Unable to add wins configuration");
2272 return undef;
2273 }
2274
2275 # Remove secrets.tdb from this environment to test that we
2276 # still start up on systems without the new matching
2277 # secrets.tdb records.
2278 unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
2279 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
2280 return undef;
2281 }
2282
2283 $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
2284
2285 return $ret;
2286 }
2287
2288 sub teardown_env_terminate($$)
2289 {
2290 my ($self, $envvars) = @_;
2291 my $pid;
2292
2293 # This should cause samba to terminate gracefully
2294 my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
2295 my $cmd = "";
2296 $cmd .= "$smbcontrol samba shutdown $envvars->{CONFIGURATION}";
2297 my $ret = system($cmd);
2298 if ($ret != 0) {
2299 warn "'$cmd' failed with '$ret'\n";
2300 }
2301
2302 # This should cause samba to terminate gracefully
2303 close($envvars->{STDIN_PIPE});
2304
2305 $pid = $envvars->{SAMBA_PID};
2306 my $count = 0;
2307 my $childpid;
2308
2309 # This should give it time to write out the gcov data
2310 until ($count > 15) {
2311 if (Samba::cleanup_child($pid, "samba") != 0) {
2312 return;
2313 }
2314 sleep(1);
2315 $count++;
2316 }
2317
2318 # After 15 Seconds, work out why this thing is still alive
2319 warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
2320 system("$self->{srcdir}/selftest/gdb_backtrace $pid");
2321
2322 until ($count > 30) {
2323 if (Samba::cleanup_child($pid, "samba") != 0) {
2324 return;
2325 }
2326 sleep(1);
2327 $count++;
2328 }
2329
2330 if (kill(0, $pid)) {
2331 warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
2332 kill "TERM", $pid;
2333 }
2334
2335 until ($count > 40) {
2336 if (Samba::cleanup_child($pid, "samba") != 0) {
2337 return;
2338 }
2339 sleep(1);
2340 $count++;
2341 }
2342 # If it is still around, kill it
2343 if (kill(0, $pid)) {
2344 warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
2345 kill 9, $pid;
2346 }
2347 return;
2348 }
2349
2350 sub teardown_env($$)
2351 {
2352 my ($self, $envvars) = @_;
2353 teardown_env_terminate($self, $envvars);
2354
2355 print $self->getlog_env($envvars);
2356
2357 return;
2358 }
2359
2360 sub getlog_env($$)
2361 {
2362 my ($self, $envvars) = @_;
2363 my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
2364 my $out = $title;
2365
2366 open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
2367
2368 seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
2369 while (<LOG>) {
2370 $out .= $_;
2371 }
2372 $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
2373 close(LOG);
2374
2375 return "" if $out eq $title;
2376
2377 return $out;
2378 }
2379
2380 sub check_env($$)
2381 {
2382 my ($self, $envvars) = @_;
2383 my $samba_pid = $envvars->{SAMBA_PID};
2384
2385 if (not defined($samba_pid)) {
2386 return 0;
2387 } elsif ($samba_pid > 0) {
2388 my $childpid = Samba::cleanup_child($samba_pid, "samba");
2389
2390 if ($childpid == 0) {
2391 return 1;
2392 }
2393 return 0;
2394 } else {
2395 return 1;
2396 }
2397 }
2398
2399 # Declare the environments Samba4 makes available.
2400 # To be set up, they will be called as
2401 # samba4->setup_$envname($self, $path, $dep_1_vars, $dep_2_vars, ...)
2402 # The interdependencies between the testenvs are declared below. Some testenvs
2403 # are dependent on another testenv running first, e.g. vampire_dc is dependent
2404 # on ad_dc_ntvfs because vampire_dc joins ad_dc_ntvfs's domain. All DCs are
2405 # dependent on dns_hub, which handles resolving DNS queries for the realm.
2406 %Samba4::ENV_DEPS = (
2407 # name => [dep_1, dep_2, ...],
2408 dns_hub => [],
2409 ad_dc_ntvfs => ["dns_hub"],
2410 ad_dc_fips => ["dns_hub"],
2411 ad_dc => ["dns_hub"],
2412 ad_dc_smb1 => ["dns_hub"],
2413 ad_dc_smb1_done => ["ad_dc_smb1"],
2414 ad_dc_no_nss => ["dns_hub"],
2415 ad_dc_no_ntlm => ["dns_hub"],
2416
2417 fl2008r2dc => ["ad_dc", "nt4_dc"],
2418 fl2003dc => ["ad_dc"],
2419 fl2000dc => ["ad_dc"],
2420
2421 vampire_2000_dc => ["fl2000dc"],
2422 vampire_dc => ["ad_dc_ntvfs"],
2423 promoted_dc => ["ad_dc_ntvfs"],
2424
2425 rodc => ["ad_dc_ntvfs"],
2426 rpc_proxy => ["ad_dc_ntvfs"],
2427 chgdcpass => ["dns_hub"],
2428
2429 s4member_dflt_domain => ["ad_dc_ntvfs"],
2430 s4member => ["ad_dc_ntvfs"],
2431
2432 # envs that test the server process model
2433 proclimitdc => ["dns_hub"],
2434 preforkrestartdc => ["dns_hub"],
2435
2436 # backup/restore testenvs
2437 backupfromdc => ["dns_hub"],
2438 customdc => ["dns_hub"],
2439 restoredc => ["backupfromdc"],
2440 renamedc => ["backupfromdc"],
2441 offlinebackupdc => ["backupfromdc"],
2442 labdc => ["backupfromdc"],
2443
2444 # aliases in order to split autobuild tasks
2445 fl2008dc => ["ad_dc_ntvfs"],
2446 ad_dc_default => ["ad_dc"],
2447 ad_dc_default_smb1 => ["ad_dc_smb1"],
2448 ad_dc_default_smb1_done => ["ad_dc_default_smb1"],
2449 ad_dc_slowtests => ["ad_dc"],
2450 ad_dc_backup => ["ad_dc"],
2451
2452 schema_dc => ["dns_hub"],
2453 schema_pair_dc => ["schema_dc"],
2454
2455 none => [],
2456 );
2457
2458 %Samba4::ENV_DEPS_POST = (
2459 schema_dc => ["schema_pair_dc"],
2460 );
2461
2462 sub return_alias_env
2463 {
2464 my ($self, $path, $env) = @_;
2465
2466 # just an alias
2467 return $env;
2468 }
2469
2470 sub setup_fl2008dc
2471 {
2472 my ($self, $path, $dep_env) = @_;
2473 return $self->return_alias_env($path, $dep_env)
2474 }
2475
2476 sub setup_ad_dc_default
2477 {
2478 my ($self, $path, $dep_env) = @_;
2479 return $self->return_alias_env($path, $dep_env)
2480 }
2481
2482 sub setup_ad_dc_default_smb1
2483 {
2484 my ($self, $path, $dep_env) = @_;
2485 return $self->return_alias_env($path, $dep_env)
2486 }
2487
2488 sub setup_ad_dc_default_smb1_done
2489 {
2490 my ($self, $path, $dep_env) = @_;
2491 return $self->return_alias_env($path, $dep_env)
2492 }
2493
2494 sub setup_ad_dc_slowtests
2495 {
2496 my ($self, $path, $dep_env) = @_;
2497 return $self->return_alias_env($path, $dep_env)
2498 }
2499
2500 sub setup_ad_dc_backup
2501 {
2502 my ($self, $path, $dep_env) = @_;
2503 return $self->return_alias_env($path, $dep_env)
2504 }
2505
2506 sub setup_s4member
2507 {
2508 my ($self, $path, $dc_vars) = @_;
2509
2510 my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2511
2512 if (defined $env) {
2513 if (not defined($self->check_or_start($env, "standard"))) {
2514 return undef;
2515 }
2516 }
2517
2518 return $env;
2519 }
2520
2521 sub setup_s4member_dflt_domain
2522 {
2523 my ($self, $path, $dc_vars) = @_;
2524
2525 my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2526 "winbind use default domain = yes");
2527
2528 if (defined $env) {
2529 if (not defined($self->check_or_start($env, "standard"))) {
2530 return undef;
2531 }
2532 }
2533
2534 return $env;
2535 }
2536
2537 sub setup_rpc_proxy
2538 {
2539 my ($self, $path, $dc_vars) = @_;
2540
2541 my $env = $self->provision_rpc_proxy($path, $dc_vars);
2542
2543 if (defined $env) {
2544 if (not defined($self->check_or_start($env, "standard"))) {
2545 return undef;
2546 }
2547 }
2548 return $env;
2549 }
2550
2551 sub setup_ad_dc_ntvfs
2552 {
2553 my ($self, $path) = @_;
2554
2555 my $env = $self->provision_ad_dc_ntvfs($path, undef);
2556 if (defined $env) {
2557 if (not defined($self->check_or_start($env, "standard"))) {
2558 warn("Failed to start ad_dc_ntvfs");
2559 return undef;
2560 }
2561 }
2562 return $env;
2563 }
2564
2565 sub setup_chgdcpass
2566 {
2567 my ($self, $path) = @_;
2568
2569 my $env = $self->provision_chgdcpass($path);
2570 if (defined $env) {
2571 if (not defined($self->check_or_start($env, "standard"))) {
2572 return undef;
2573 }
2574 }
2575 return $env;
2576 }
2577
2578 sub setup_fl2000dc
2579 {
2580 my ($self, $path, $dc_vars) = @_;
2581
2582 my $env = $self->provision_fl2000dc($path);
2583 if (defined $env) {
2584 if (not defined($self->check_or_start($env, "standard"))) {
2585 return undef;
2586 }
2587
2588 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys --direction=outgoing");
2589 }
2590
2591 return $env;
2592 }
2593
2594 sub setup_fl2003dc
2595 {
2596 my ($self, $path, $dc_vars) = @_;
2597
2598 my $env = $self->provision_fl2003dc($path);
2599
2600 if (defined $env) {
2601 if (not defined($self->check_or_start($env, "standard"))) {
2602 return undef;
2603 }
2604
2605 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2606 }
2607 return $env;
2608 }
2609
2610 sub setup_fl2008r2dc
2611 {
2612 my ($self, $path, $ad_dc_vars, $nt4_dc_vars) = @_;
2613
2614 my $env = $self->provision_fl2008r2dc($path);
2615
2616 if (!defined $env) {
2617 return $env;
2618 }
2619
2620 if (not defined($self->check_or_start($env, "standard"))) {
2621 return undef;
2622 }
2623
2624 my $upn_array = ["$env->{REALM}.upn"];
2625 my $spn_array = ["$env->{REALM}.spn"];
2626
2627 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2628 return undef;
2629 }
2630
2631 $env = $self->setup_trust($env, $ad_dc_vars, "forest", "");
2632 if (!defined $env) {
2633 return undef;
2634 }
2635
2636 my $net = Samba::bindir_path($self, "net");
2637 my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
2638
2639 my $trustpw = "TrUsTpW";
2640 $trustpw .= "$env->{SOCKET_WRAPPER_DEFAULT_IFACE}";
2641 $trustpw .= "$nt4_dc_vars->{SOCKET_WRAPPER_DEFAULT_IFACE}";
2642
2643 my $cmd_env = $self->get_cmd_env_vars($env);
2644 my $cmd = $cmd_env;
2645 $cmd .= "$net rpc trust create ";
2646 $cmd .= "otherdomainsid=$nt4_dc_vars->{SAMSID} ";
2647 $cmd .= "otherdomain=$nt4_dc_vars->{DOMAIN} ";
2648 $cmd .= "other_netbios_domain=$nt4_dc_vars->{DOMAIN} ";
2649 $cmd .= "trustpw=$trustpw ";
2650 $cmd .= "$env->{CONFIGURATION} ";
2651 $cmd .= "-U $env->{DOMAIN}/$env->{USERNAME}\%$env->{PASSWORD} ";
2652
2653 if (system($cmd) != 0) {
2654 warn("net rpc trust create failed\n$cmd");
2655 return undef;
2656 }
2657
2658 my $nt4_cmd_env = $self->get_cmd_env_vars($nt4_dc_vars);
2659 $cmd = $nt4_cmd_env;
2660 $cmd .= "$net rpc trustdom establish $env->{DOMAIN} -U/%$trustpw $nt4_dc_vars->{CONFIGURATION}";
2661
2662 if (system($cmd) != 0) {
2663 warn("add failed\n$cmd");
2664 return undef;
2665 }
2666
2667 # Reload trusts
2668 $cmd = $nt4_cmd_env;
2669 $cmd .= "$smbcontrol winbindd reload-config $nt4_dc_vars->{CONFIGURATION}";
2670
2671 if (system($cmd) != 0) {
2672 warn("add failed\n$cmd");
2673 return undef;
2674 }
2675
2676 $env->{NT4_TRUST_SERVER} = $nt4_dc_vars->{SERVER};
2677 $env->{NT4_TRUST_SERVER_IP} = $nt4_dc_vars->{SERVER_IP};
2678 $env->{NT4_TRUST_DOMAIN} = $nt4_dc_vars->{DOMAIN};
2679 $env->{NT4_TRUST_DOMSID} = $nt4_dc_vars->{DOMSID};
2680
2681 return $env;
2682 }
2683
2684 sub setup_vampire_dc
2685 {
2686 return setup_generic_vampire_dc(@_, "2008");
2687 }
2688
2689 sub setup_vampire_2000_dc
2690 {
2691 return setup_generic_vampire_dc(@_, "2000");
2692 }
2693
2694 sub setup_generic_vampire_dc
2695 {
2696 my ($self, $path, $dc_vars, $fl) = @_;
2697
2698 my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2699
2700 if (defined $env) {
2701 if (not defined($self->check_or_start($env, "single"))) {
2702 return undef;
2703 }
2704
2705 # force replicated DC to update repsTo/repsFrom
2706 # for vampired partitions
2707 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2708
2709 # as 'vampired' dc may add data in its local replica
2710 # we need to synchronize data between DCs
2711 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2712 my $cmd = $self->get_cmd_env_vars($env);
2713 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2714 $cmd .= " $dc_vars->{CONFIGURATION}";
2715 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2716 # replicate Configuration NC
2717 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2718 unless(system($cmd_repl) == 0) {
2719 warn("Failed to replicate\n$cmd_repl");
2720 return undef;
2721 }
2722 # replicate Default NC
2723 $cmd_repl = "$cmd \"$base_dn\"";
2724 unless(system($cmd_repl) == 0) {
2725 warn("Failed to replicate\n$cmd_repl");
2726 return undef;
2727 }
2728
2729 # Pull in a full set of changes from the main DC
2730 $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2731 $cmd = $self->get_cmd_env_vars($env);
2732 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2733 $cmd .= " $dc_vars->{CONFIGURATION}";
2734 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2735 # replicate Configuration NC
2736 $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2737 unless(system($cmd_repl) == 0) {
2738 warn("Failed to replicate\n$cmd_repl");
2739 return undef;
2740 }
2741 # replicate Default NC
2742 $cmd_repl = "$cmd \"$base_dn\"";
2743 unless(system($cmd_repl) == 0) {
2744 warn("Failed to replicate\n$cmd_repl");
2745 return undef;
2746 }
2747 }
2748
2749 return $env;
2750 }
2751
2752 sub setup_promoted_dc
2753 {
2754 my ($self, $path, $dc_vars) = @_;
2755
2756 my $env = $self->provision_promoted_dc($path, $dc_vars);
2757
2758 if (defined $env) {
2759 if (not defined($self->check_or_start($env, "single"))) {
2760 return undef;
2761 }
2762
2763 # force source and replicated DC to update repsTo/repsFrom
2764 # for vampired partitions
2765 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2766 my $cmd = $self->get_cmd_env_vars($env);
2767 # as 'vampired' dc may add data in its local replica
2768 # we need to synchronize data between DCs
2769 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2770 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2771 $cmd .= " $dc_vars->{CONFIGURATION}";
2772 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2773 # replicate Configuration NC
2774 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2775 unless(system($cmd_repl) == 0) {
2776 warn("Failed to replicate\n$cmd_repl");
2777 return undef;
2778 }
2779 # replicate Default NC
2780 $cmd_repl = "$cmd \"$base_dn\"";
2781 unless(system($cmd_repl) == 0) {
2782 warn("Failed to replicate\n$cmd_repl");
2783 return undef;
2784 }
2785 }
2786
2787 return $env;
2788 }
2789
2790 sub setup_rodc
2791 {
2792 my ($self, $path, $dc_vars) = @_;
2793
2794 my $env = $self->provision_rodc($path, $dc_vars);
2795
2796 unless ($env) {
2797 return undef;
2798 }
2799
2800 if (not defined($self->check_or_start($env, "standard"))) {
2801 return undef;
2802 }
2803
2804 my $samba_tool = Samba::bindir_path($self, "samba-tool");
2805 my $cmd = $self->get_cmd_env_vars($env);
2806
2807 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2808 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2809 $cmd .= " $dc_vars->{CONFIGURATION}";
2810 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2811 # replicate Configuration NC
2812 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2813 unless(system($cmd_repl) == 0) {
2814 warn("Failed to replicate\n$cmd_repl");
2815 return undef;
2816 }
2817 # replicate Default NC
2818 $cmd_repl = "$cmd \"$base_dn\"";
2819 unless(system($cmd_repl) == 0) {
2820 warn("Failed to replicate\n$cmd_repl");
2821 return undef;
2822 }
2823
2824 return $env;
2825 }
2826
2827 sub _setup_ad_dc
2828 {
2829 my ($self, $path, $conf_opts, $server, $dom, $functional_level) = @_;
2830
2831 # If we didn't build with ADS, pretend this env was never available
2832 if (not $self->{target3}->have_ads()) {
2833 return "UNKNOWN";
2834 }
2835
2836 if (!defined($conf_opts)) {
2837 $conf_opts = "";
2838 }
2839 if (!defined($server)) {
2840 $server = "addc";
2841 }
2842 if (!defined($dom)) {
2843 $dom = "addom.samba.example.com";
2844 }
2845 my $env = $self->provision_ad_dc($path, $server, "ADDOMAIN",
2846 $dom,
2847 undef,
2848 $conf_opts,
2849 undef,
2850 $functional_level);
2851 unless ($env) {
2852 return undef;
2853 }
2854
2855 if (not defined($self->check_or_start($env, "prefork"))) {
2856 return undef;
2857 }
2858
2859 my $upn_array = ["$env->{REALM}.upn"];
2860 my $spn_array = ["$env->{REALM}.spn"];
2861
2862 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2863 return undef;
2864 }
2865
2866 return $env;
2867 }
2868
2869 sub setup_ad_dc
2870 {
2871 my ($self, $path) = @_;
2872 return _setup_ad_dc($self, $path, undef, undef, undef);
2873 }
2874
2875 sub setup_ad_dc_smb1
2876 {
2877 my ($self, $path) = @_;
2878 my $conf_opts = "
2879 [global]
2880 client min protocol = CORE
2881 server min protocol = LANMAN1
2882
2883 # needed for 'samba.tests.auth_log' tests
2884 server require schannel:ADDCSMB1\$ = no
2885 server schannel require seal:ADDCSMB1\$ = no
2886 ";
2887 return _setup_ad_dc($self, $path, $conf_opts, "addcsmb1", "addom2.samba.example.com");
2888 }
2889
2890 sub setup_ad_dc_smb1_done
2891 {
2892 my ($self, $path, $dep_env) = @_;
2893 return $self->return_alias_env($path, $dep_env);
2894 }
2895
2896 sub setup_ad_dc_no_nss
2897 {
2898 my ($self, $path) = @_;
2899
2900 # If we didn't build with ADS, pretend this env was never available
2901 if (not $self->{target3}->have_ads()) {
2902 return "UNKNOWN";
2903 }
2904
2905 my $env = $self->provision_ad_dc($path,
2906 "addc_no_nss",
2907 "ADNONSSDOMAIN",
2908 "adnonssdom.samba.example.com",
2909 undef,
2910 "",
2911 undef);
2912 unless ($env) {
2913 return undef;
2914 }
2915
2916 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2917 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2918
2919 if (not defined($self->check_or_start($env, "single"))) {
2920 return undef;
2921 }
2922
2923 my $upn_array = ["$env->{REALM}.upn"];
2924 my $spn_array = ["$env->{REALM}.spn"];
2925
2926 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2927 return undef;
2928 }
2929
2930 return $env;
2931 }
2932
2933 sub setup_ad_dc_no_ntlm
2934 {
2935 my ($self, $path) = @_;
2936
2937 # If we didn't build with ADS, pretend this env was never available
2938 if (not $self->{target3}->have_ads()) {
2939 return "UNKNOWN";
2940 }
2941
2942 my $env = $self->provision_ad_dc($path,
2943 "addc_no_ntlm",
2944 "ADNONTLMDOMAIN",
2945 "adnontlmdom.samba.example.com",
2946 undef,
2947 "ntlm auth = disabled\nnt hash store = never",
2948 undef);
2949 unless ($env) {
2950 return undef;
2951 }
2952
2953 if (not defined($self->check_or_start($env, "prefork"))) {
2954 return undef;
2955 }
2956
2957 my $upn_array = ["$env->{REALM}.upn"];
2958 my $spn_array = ["$env->{REALM}.spn"];
2959
2960 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2961 return undef;
2962 }
2963
2964 return $env;
2965 }
2966
2967 sub setup_ad_dc_fips
2968 {
2969 my ($self, $path) = @_;
2970
2971 # If we didn't build with ADS, pretend this env was never available
2972 if (not $self->{target3}->have_ads()) {
2973 return "UNKNOWN";
2974 }
2975
2976 my $env = $self->provision_ad_dc($path,
2977 "fipsdc",
2978 "FIPSDOMAIN",
2979 "fips.samba.example.com",
2980 1,
2981 "",
2982 undef);
2983 unless ($env) {
2984 return undef;
2985 }
2986
2987 if (not defined($self->check_or_start($env, "prefork"))) {
2988 return undef;
2989 }
2990
2991 my $upn_array = ["$env->{REALM}.upn"];
2992 my $spn_array = ["$env->{REALM}.spn"];
2993
2994 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
2995 return undef;
2996 }
2997
2998 return $env;
2999 }
3000
3001 #
3002 # AD DC test environment used solely to test pre-fork process restarts.
3003 # As processes get killed off and restarted it should not be used for other
3004 sub setup_preforkrestartdc
3005 {
3006 my ($self, $path) = @_;
3007
3008 # If we didn't build with ADS, pretend this env was never available
3009 if (not $self->{target3}->have_ads()) {
3010 return "UNKNOWN";
3011 }
3012
3013 # note DC name must be <= 15 chars so we use 'prockill' instead of
3014 # 'preforkrestart'
3015 my $env = $self->provision_ad_dc($path,
3016 "prockilldc",
3017 "PROCKILLDOMAIN",
3018 "prockilldom.samba.example.com",
3019 undef,
3020 "prefork backoff increment = 5\nprefork maximum backoff=10",
3021 undef);
3022 unless ($env) {
3023 return undef;
3024 }
3025
3026 # We treat processes in this environment cruelly, sometimes
3027 # sending them SIGSEGV signals. We don't need gdb_backtrace
3028 # dissecting these fake crashes in precise detail.
3029 $env->{PLEASE_NO_GDB_BACKTRACE} = '1';
3030
3031 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
3032 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
3033
3034 if (not defined($self->check_or_start($env, "prefork"))) {
3035 return undef;
3036 }
3037
3038 my $upn_array = ["$env->{REALM}.upn"];
3039 my $spn_array = ["$env->{REALM}.spn"];
3040
3041 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3042 return undef;
3043 }
3044
3045 return $env;
3046 }
3047
3048 #
3049 # ad_dc test environment used solely to test standard process model connection
3050 # process limits. As the limit is set artificially low it should not be used
3051 # for other tests.
3052 sub setup_proclimitdc
3053 {
3054 my ($self, $path) = @_;
3055
3056 # If we didn't build with ADS, pretend this env was never available
3057 if (not $self->{target3}->have_ads()) {
3058 return "UNKNOWN";
3059 }
3060
3061 my $env = $self->provision_ad_dc($path,
3062 "proclimitdc",
3063 "PROCLIMITDOM",
3064 "proclimit.samba.example.com",
3065 undef,
3066 "max smbd processes = 20",
3067 undef);
3068 unless ($env) {
3069 return undef;
3070 }
3071
3072 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
3073 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
3074
3075 if (not defined($self->check_or_start($env, "standard"))) {
3076 return undef;
3077 }
3078
3079 my $upn_array = ["$env->{REALM}.upn"];
3080 my $spn_array = ["$env->{REALM}.spn"];
3081
3082 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3083 return undef;
3084 }
3085
3086 return $env;
3087 }
3088
3089 # Used to test a live upgrade of the schema on a 2 DC network.
3090 sub setup_schema_dc
3091 {
3092 my ($self, $path) = @_;
3093
3094 # provision the PDC using an older base schema
3095 my $provision_args = ["--base-schema=2008_R2", "--backend-store=$self->{default_ldb_backend}"];
3096
3097 # We set the functional level to 2008_R2 to match the older
3098 # base-schema (to allow schema upgrade to be tested)
3099 my $env = $self->provision_ad_dc($path,
3100 "liveupgrade1dc",
3101 "SCHEMADOMAIN",
3102 "schema.samba.example.com",
3103 undef,
3104 "drs: max link sync = 2",
3105 $provision_args,
3106 "2008_R2");
3107 unless ($env) {
3108 return undef;
3109 }
3110
3111 if (not defined($self->check_or_start($env, "prefork"))) {
3112 return undef;
3113 }
3114
3115 my $upn_array = ["$env->{REALM}.upn"];
3116 my $spn_array = ["$env->{REALM}.spn"];
3117
3118 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3119 return undef;
3120 }
3121
3122 return $env;
3123 }
3124
3125 # the second DC in the live schema upgrade pair
3126 sub setup_schema_pair_dc
3127 {
3128 # note: dcvars contains the env info for the dependent testenv ('schema_dc')
3129 my ($self, $prefix, $dcvars) = @_;
3130 print "Preparing SCHEMA UPGRADE PAIR DC...\n";
3131
3132 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "liveupgrade2dc",
3133 $dcvars->{DOMAIN},
3134 $dcvars->{REALM},
3135 $dcvars->{PASSWORD},
3136 "");
3137
3138 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3139 my $cmd_vars = $self->get_cmd_env_vars($env);
3140
3141 my $join_cmd = $cmd_vars;
3142 $join_cmd .= "$samba_tool domain join $env->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
3143 $join_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} ";
3144 $join_cmd .= " --backend-store=$self->{default_ldb_backend}";
3145
3146 my $upgrade_cmd = $cmd_vars;
3147 $upgrade_cmd .= "$samba_tool domain schemaupgrade $dcvars->{CONFIGURATION}";
3148 $upgrade_cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
3149
3150 my $repl_cmd = $cmd_vars;
3151 $repl_cmd .= "$samba_tool drs replicate $env->{SERVER} $dcvars->{SERVER}";
3152 $repl_cmd .= " CN=Schema,CN=Configuration,DC=schema,DC=samba,DC=example,DC=com";
3153 $repl_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
3154
3155 unless (system($join_cmd) == 0) {
3156 warn("Join failed\n$join_cmd");
3157 return undef;
3158 }
3159
3160 $env->{DC_SERVER} = $dcvars->{SERVER};
3161 $env->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
3162 $env->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
3163 $env->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
3164
3165 # start samba for the new DC
3166 if (not defined($self->check_or_start($env, "standard"))) {
3167 return undef;
3168 }
3169
3170 unless (system($upgrade_cmd) == 0) {
3171 warn("Schema upgrade failed\n$upgrade_cmd");
3172 return undef;
3173 }
3174
3175 unless (system($repl_cmd) == 0) {
3176 warn("Post-update schema replication failed\n$repl_cmd");
3177 return undef;
3178 }
3179
3180 return $env;
3181 }
3182
3183 # Sets up a DC that's solely used to do a domain backup from. We then use the
3184 # backupfrom-DC to create the restore-DC - this proves that the backup/restore
3185 # process will create a Samba DC that will actually start up.
3186 # We don't use the backup-DC for anything else because its domain will conflict
3187 # with the restore DC.
3188 sub setup_backupfromdc
3189 {
3190 my ($self, $path) = @_;
3191
3192 # If we didn't build with ADS, pretend this env was never available
3193 if (not $self->{target3}->have_ads()) {
3194 return "UNKNOWN";
3195 }
3196
3197 my $provision_args = ["--site=Backup-Site"];
3198
3199 my $env = $self->provision_ad_dc($path,
3200 "backupfromdc",
3201 "BACKUPDOMAIN",
3202 "backupdom.samba.example.com",
3203 undef,
3204 "samba kcc command = /bin/true",
3205 $provision_args);
3206 unless ($env) {
3207 return undef;
3208 }
3209
3210 if (not defined($self->check_or_start($env))) {
3211 return undef;
3212 }
3213
3214 my $upn_array = ["$env->{REALM}.upn"];
3215 my $spn_array = ["$env->{REALM}.spn"];
3216
3217 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3218 return undef;
3219 }
3220
3221 # Set up a dangling forward link to an expunged object
3222 #
3223 # We need this to ensure that the "samba-tool domain backup rename"
3224 # that is part of the creation of the labdc environment can
3225 # cope with this situation on the source DC.
3226
3227 if (not $self->write_ldb_file("$env->{PRIVATEDIR}/sam.ldb", "
3228 dn: ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3229 objectclass: organizationalUnit
3230 -
3231
3232 dn: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3233 objectclass: msExchConfigurationContainer
3234 -
3235
3236 dn: cn=linkfrom,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3237 objectclass: msExchConfigurationContainer
3238 addressBookRoots: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
3239 -
3240
3241 ")) {
3242 return undef;
3243 }
3244 my $ldbdel = Samba::bindir_path($self, "ldbdel");
3245 my $cmd = "$ldbdel -H $env->{PRIVATEDIR}/sam.ldb cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com";
3246
3247 unless(system($cmd) == 0) {
3248 warn("Failed to delete link target: \n$cmd");
3249 return undef;
3250 }
3251
3252 # Expunge will ensure that linkto is totally wiped from the DB
3253 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3254 $cmd = "$samba_tool domain tombstones expunge --tombstone-lifetime=0 $env->{CONFIGURATION}";
3255
3256 unless(system($cmd) == 0) {
3257 warn("Failed to expunge link target: \n$cmd");
3258 return undef;
3259 }
3260 return $env;
3261 }
3262
3263 # returns the server/user-auth params needed to run an online backup cmd
3264 sub get_backup_server_args
3265 {
3266 # dcvars contains the env info for the backup DC testenv
3267 my ($self, $dcvars) = @_;
3268 my $server = $dcvars->{DC_SERVER_IP};
3269 my $server_args = "--server=$server ";
3270 $server_args .= "-U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
3271 $server_args .= " $dcvars->{CONFIGURATION}";
3272
3273 return $server_args;
3274 }
3275
3276 # Creates a backup of a running testenv DC
3277 sub create_backup
3278 {
3279 # note: dcvars contains the env info for the backup DC testenv
3280 my ($self, $env, $dcvars, $backupdir, $backup_cmd) = @_;
3281
3282 # get all the env variables we pass in with the samba-tool command
3283 # Note: use the backupfrom-DC's krb5.conf to do the backup
3284 my $overwrite = undef;
3285 $overwrite->{KRB5_CONFIG} = $dcvars->{KRB5_CONFIG};
3286 my $cmd_env = $self->get_cmd_env_vars($env, $overwrite);
3287
3288 # use samba-tool to create a backup from the 'backupfromdc' DC
3289 my $cmd = "";
3290 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3291
3292 $cmd .= "$cmd_env $samba_tool domain backup $backup_cmd";
3293 $cmd .= " --targetdir=$backupdir";
3294
3295 print "Executing: $cmd\n";
3296 unless(system($cmd) == 0) {
3297 warn("Failed to create backup using: \n$cmd");
3298 return undef;
3299 }
3300
3301 # get the name of the backup file created
3302 opendir(DIR, $backupdir);
3303 my @files = grep(/\.tar/, readdir(DIR));
3304 closedir(DIR);
3305
3306 if(scalar @files != 1) {
3307 warn("Backup file not found in directory $backupdir\n");
3308 return undef;
3309 }
3310 my $backup_file = "$backupdir/$files[0]";
3311 print "Using backup file $backup_file...\n";
3312
3313 return $backup_file;
3314 }
3315
3316 # Restores a backup-file to populate a testenv for a new DC
3317 sub restore_backup_file
3318 {
3319 my ($self, $backup_file, $restore_opts, $restoredir, $smbconf) = @_;
3320
3321 # pass the restore command the testenv's smb.conf that we've already
3322 # generated. But move it to a temp-dir first, so that the restore doesn't
3323 # overwrite it
3324 my $tmpdir = File::Temp->newdir();
3325 my $tmpconf = "$tmpdir/smb.conf";
3326 my $cmd = "cp $smbconf $tmpconf";
3327 unless(system($cmd) == 0) {
3328 warn("Failed to backup smb.conf using: \n$cmd");
3329 return -1;
3330 }
3331
3332 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3333 $cmd = "$samba_tool domain backup restore --backup-file=$backup_file";
3334 $cmd .= " --targetdir=$restoredir $restore_opts --configfile=$tmpconf";
3335
3336 print "Executing: $cmd\n";
3337 unless(system($cmd) == 0) {
3338 warn("Failed to restore backup using: \n$cmd");
3339 return -1;
3340 }
3341
3342 print "Restore complete\n";
3343 return 0
3344 }
3345
3346 # sets up the initial directory and returns the new testenv's env info
3347 # (without actually doing a 'domain join')
3348 sub prepare_dc_testenv
3349 {
3350 my ($self, $prefix, $dcname, $domain, $realm,
3351 $password, $conf_options, $dnsupdate_options) = @_;
3352
3353 my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
3354 $dcname,
3355 $domain,
3356 $realm,
3357 undef,
3358 "2008",
3359 $password,
3360 undef,
3361 undef);
3362
3363 # the restore uses a slightly different state-dir location to other testenvs
3364 $ctx->{statedir} = "$ctx->{prefix_abs}/state";
3365 push(@{$ctx->{directories}}, "$ctx->{statedir}");
3366
3367 # add support for sysvol/netlogon/tmp shares
3368 $ctx->{share} = "$ctx->{prefix_abs}/share";
3369 push(@{$ctx->{directories}}, "$ctx->{share}");
3370 push(@{$ctx->{directories}}, "$ctx->{share}/test1");
3371
3372 if (defined($dnsupdate_options)) {
3373 $ctx->{samba_dnsupdate} .= $dnsupdate_options;
3374 }
3375
3376 $ctx->{smb_conf_extra_options} = "
3377 $conf_options
3378
3379 # Some of the DCs based on this will be in FL 2016 domains, so
3380 # claim FL 2016 DC capability
3381 ad dc functional level = 2016
3382
3383 max xmit = 32K
3384 server max protocol = SMB2
3385 samba kcc command = /bin/true
3386 xattr_tdb:file = $ctx->{statedir}/xattr.tdb
3387
3388 [sysvol]
3389 path = $ctx->{statedir}/sysvol
3390 read only = no
3391
3392 [netlogon]
3393 path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
3394 read only = no
3395
3396 [tmp]
3397 path = $ctx->{share}
3398 read only = no
3399 posix:sharedelay = 10000
3400 posix:oplocktimeout = 3
3401 posix:writetimeupdatedelay = 50000
3402
3403 [test1]
3404 path = $ctx->{share}/test1
3405 read only = no
3406 posix:sharedelay = 100000
3407 posix:oplocktimeout = 3
3408 posix:writetimeupdatedelay = 500000
3409 ";
3410
3411 my $env = $self->provision_raw_step1($ctx);
3412
3413 return ($env, $ctx);
3414 }
3415
3416
3417 # Set up a DC testenv solely by using the samba-tool domain backup/restore
3418 # commands. This proves that we can backup an online DC ('backupfromdc') and
3419 # use the backup file to create a valid, working samba DC.
3420 sub setup_restoredc
3421 {
3422 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3423 my ($self, $prefix, $dcvars) = @_;
3424 print "Preparing RESTORE DC...\n";
3425
3426 # we arbitrarily designate the restored DC as having SMBv1 disabled
3427 my $extra_conf = "
3428 server min protocol = SMB2
3429 client min protocol = SMB2
3430 prefork children = 1";
3431 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3432
3433 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "restoredc",
3434 $dcvars->{DOMAIN},
3435 $dcvars->{REALM},
3436 $dcvars->{PASSWORD},
3437 $extra_conf,
3438 $dnsupdate_options);
3439
3440 # create a backup of the 'backupfromdc'
3441 my $backupdir = File::Temp->newdir();
3442 my $server_args = $self->get_backup_server_args($dcvars);
3443 my $backup_args = "online $server_args";
3444 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3445 $backup_args);
3446 unless($backup_file) {
3447 return undef;
3448 }
3449
3450 # restore the backup file to populate the restore-DC testenv
3451 my $restore_dir = abs_path($prefix);
3452 my $ret = $self->restore_backup_file($backup_file,
3453 "--newservername=$env->{SERVER}",
3454 $restore_dir, $env->{SERVERCONFFILE});
3455 unless ($ret == 0) {
3456 return undef;
3457 }
3458
3459 #
3460 # As we create the same domain as a clone
3461 # we need a separate resolv.conf!
3462 #
3463 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3464 $ctx->{dns_ipv4} = $ctx->{ipv4};
3465 $ctx->{dns_ipv6} = $ctx->{ipv6};
3466 Samba::mk_resolv_conf($ctx);
3467 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3468
3469 # start samba for the restored DC
3470 if (not defined($self->check_or_start($env))) {
3471 return undef;
3472 }
3473
3474 return $env;
3475 }
3476
3477 # Set up a DC testenv solely by using the 'samba-tool domain backup rename' and
3478 # restore commands. This proves that we can backup and rename an online DC
3479 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3480 sub setup_renamedc
3481 {
3482 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3483 my ($self, $prefix, $dcvars) = @_;
3484 print "Preparing RENAME DC...\n";
3485 my $extra_conf = "prefork children = 1";
3486
3487 my $realm = "renamedom.samba.example.com";
3488 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "renamedc",
3489 "RENAMEDOMAIN", $realm,
3490 $dcvars->{PASSWORD}, $extra_conf);
3491
3492 # create a backup of the 'backupfromdc' which renames the domain
3493 my $backupdir = File::Temp->newdir();
3494 my $server_args = $self->get_backup_server_args($dcvars);
3495 my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3496 $backup_args .= " --backend-store=tdb";
3497 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3498 $backup_args);
3499 unless($backup_file) {
3500 return undef;
3501 }
3502
3503 # restore the backup file to populate the rename-DC testenv
3504 my $restore_dir = abs_path($prefix);
3505 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3506 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3507 $restore_dir, $env->{SERVERCONFFILE});
3508 unless ($ret == 0) {
3509 return undef;
3510 }
3511
3512 # start samba for the restored DC
3513 if (not defined($self->check_or_start($env))) {
3514 return undef;
3515 }
3516
3517 my $upn_array = ["$env->{REALM}.upn"];
3518 my $spn_array = ["$env->{REALM}.spn"];
3519
3520 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3521 return undef;
3522 }
3523
3524 return $env;
3525 }
3526
3527 # Set up a DC testenv solely by using the 'samba-tool domain backup offline' and
3528 # restore commands. This proves that we do an offline backup of a local DC
3529 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3530 sub setup_offlinebackupdc
3531 {
3532 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3533 my ($self, $prefix, $dcvars) = @_;
3534 print "Preparing OFFLINE BACKUP DC...\n";
3535 my $extra_conf = "prefork children = 1";
3536 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3537
3538 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "offlinebackupdc",
3539 $dcvars->{DOMAIN},
3540 $dcvars->{REALM},
3541 $dcvars->{PASSWORD},
3542 $extra_conf,
3543 $dnsupdate_options);
3544
3545 # create an offline backup of the 'backupfromdc' target
3546 my $backupdir = File::Temp->newdir();
3547 my $cmd = "offline --configfile $dcvars->{SERVERCONFFILE}";
3548 my $backup_file = $self->create_backup($env, $dcvars,
3549 $backupdir, $cmd);
3550
3551 unless($backup_file) {
3552 return undef;
3553 }
3554
3555 # restore the backup file to populate the rename-DC testenv
3556 my $restore_dir = abs_path($prefix);
3557 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3558 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3559 $restore_dir, $env->{SERVERCONFFILE});
3560 unless ($ret == 0) {
3561 return undef;
3562 }
3563
3564 #
3565 # As we create the same domain as a clone
3566 # we need a separate resolv.conf!
3567 #
3568 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3569 $ctx->{dns_ipv4} = $ctx->{ipv4};
3570 $ctx->{dns_ipv6} = $ctx->{ipv6};
3571 Samba::mk_resolv_conf($ctx);
3572 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3573
3574 # re-create the testenv's krb5.conf (the restore may have overwritten it)
3575 Samba::mk_krb5_conf($ctx);
3576
3577 # start samba for the restored DC
3578 if (not defined($self->check_or_start($env))) {
3579 return undef;
3580 }
3581
3582 return $env;
3583 }
3584
3585 # Set up a DC testenv solely by using the samba-tool 'domain backup rename' and
3586 # restore commands, using the --no-secrets option. This proves that we can
3587 # create a realistic lab environment from an online DC ('backupfromdc').
3588 sub setup_labdc
3589 {
3590 # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3591 my ($self, $prefix, $dcvars) = @_;
3592 print "Preparing LAB-DOMAIN DC...\n";
3593 my $extra_conf = "prefork children = 1";
3594
3595 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "labdc",
3596 "LABDOMAIN",
3597 "labdom.samba.example.com",
3598 $dcvars->{PASSWORD}, $extra_conf);
3599
3600 # create a backup of the 'backupfromdc' which renames the domain and uses
3601 # the --no-secrets option to scrub any sensitive info
3602 my $backupdir = File::Temp->newdir();
3603 my $server_args = $self->get_backup_server_args($dcvars);
3604 my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3605 $backup_args .= " --no-secrets --backend-store=$self->{default_ldb_backend}";
3606 my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3607 $backup_args);
3608 unless($backup_file) {
3609 return undef;
3610 }
3611
3612 # restore the backup file to populate the lab-DC testenv
3613 my $restore_dir = abs_path($prefix);
3614 my $restore_opts = "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3615 my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3616 $restore_dir, $env->{SERVERCONFFILE});
3617 unless ($ret == 0) {
3618 return undef;
3619 }
3620
3621 # because we don't include any secrets in the backup, we need to reset the
3622 # admin user's password back to what the testenv expects
3623 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3624 my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3625 $cmd .= "--newpassword=$env->{PASSWORD} -H $restore_dir/private/sam.ldb";
3626 $cmd .= " $env->{CONFIGURATION}";
3627
3628 unless(system($cmd) == 0) {
3629 warn("Failed to reset admin's password: \n$cmd");
3630 return undef;
3631 }
3632
3633 # start samba for the restored DC
3634 if (not defined($self->check_or_start($env))) {
3635 return undef;
3636 }
3637
3638 my $upn_array = ["$env->{REALM}.upn"];
3639 my $spn_array = ["$env->{REALM}.spn"];
3640
3641 if ($self->setup_namespaces($env, $upn_array, $spn_array) != 0) {
3642 return undef;
3643 }
3644
3645 return $env;
3646 }
3647
3648 # Inspects a backup *.tar.bz2 file and determines the realm/domain it contains
3649 sub get_backup_domain_realm
3650 {
3651 my ($self, $backup_file) = @_;
3652
3653 print "Determining REALM/DOMAIN values in backup...\n";
3654
3655 # The backup will have the correct domain/realm values in the smb.conf.
3656 # So we can work out the env variables the testenv should use based on
3657 # that. Let's start by extracting the smb.conf
3658 my $tar = Archive::Tar->new($backup_file);
3659 my $tmpdir = File::Temp->newdir();
3660 my $smbconf = "$tmpdir/smb.conf";
3661
3662 # note that the filepaths within the tar-file differ slightly for online
3663 # and offline backups
3664 if ($tar->contains_file("etc/smb.conf")) {
3665 $tar->extract_file("etc/smb.conf", $smbconf);
3666 } elsif ($tar->contains_file("./etc/smb.conf")) {
3667 $tar->extract_file("./etc/smb.conf", $smbconf);
3668 } else {
3669 warn("Could not find smb.conf in $backup_file");
3670 return undef, undef;
3671 }
3672
3673 # make sure we don't try to create locks/sockets in the default install
3674 # location (i.e. /usr/local/samba/)
3675 my $options = "--option=\"private dir = $tmpdir\"";
3676 $options .= " --option=\"lock dir = $tmpdir\"";
3677
3678 # now use testparm to read the values we're interested in
3679 my $testparm = Samba::bindir_path($self, "testparm");
3680 my $domain = `$testparm $smbconf -sl --parameter-name=WORKGROUP $options`;
3681 my $realm = `$testparm $smbconf -sl --parameter-name=REALM $options`;
3682 chomp $realm;
3683 chomp $domain;
3684 print "Backup-file REALM is $realm, DOMAIN is $domain\n";
3685
3686 return ($domain, $realm);
3687 }
3688
3689 # This spins up a custom testenv that can be based on any backup-file you want.
3690 # This is just intended for manual testing (rather than automated test-cases)
3691 sub setup_customdc
3692 {
3693 my ($self, $prefix) = @_;
3694 print "Preparing CUSTOM RESTORE DC...\n";
3695 my $dc_name = "customdc";
3696 my $password = "locDCpass1";
3697 my $backup_file = $ENV{'BACKUP_FILE'};
3698 my $dnsupdate_options = " --use-samba-tool --no-credentials";
3699
3700 # user must specify a backup file to restore via an ENV variable, i.e.
3701 # BACKUP_FILE=backup-blah.tar.bz2 SELFTEST_TESTENV=customdc make testenv
3702 if (not defined($backup_file)) {
3703 warn("Please specify BACKUP_FILE");
3704 return undef;
3705 }
3706
3707 # work out the correct domain/realm env values from the backup-file
3708 my ($domain, $realm) = $self->get_backup_domain_realm($backup_file);
3709 if ($domain eq '' or $realm eq '') {
3710 warn("Could not determine domain or realm");
3711 return undef;
3712 }
3713
3714 # create a placeholder directory and smb.conf, as well as the env vars.
3715 my ($env, $ctx) = $self->prepare_dc_testenv($prefix, $dc_name,
3716 $domain, $realm, $password, "",
3717 $dnsupdate_options);
3718
3719 # restore the specified backup file to populate the testenv
3720 my $restore_dir = abs_path($prefix);
3721 my $ret = $self->restore_backup_file($backup_file,
3722 "--newservername=$env->{SERVER}",
3723 $restore_dir, $env->{SERVERCONFFILE});
3724 unless ($ret == 0) {
3725 return undef;
3726 }
3727
3728 #
3729 # As we create the same domain as a clone
3730 # we need a separate resolv.conf!
3731 #
3732 $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3733 $ctx->{dns_ipv4} = $ctx->{ipv4};
3734 $ctx->{dns_ipv6} = $ctx->{ipv6};
3735 Samba::mk_resolv_conf($ctx);
3736 $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3737
3738 # Change the admin password to the testenv default, just in case it's
3739 # different, or in case this was a --no-secrets backup
3740 my $samba_tool = Samba::bindir_path($self, "samba-tool");
3741 my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3742 $cmd .= "--newpassword=$password -H $restore_dir/private/sam.ldb";
3743 $cmd .= " $env->{CONFIGURATION}";
3744
3745 unless(system($cmd) == 0) {
3746 warn("Failed to reset admin's password: \n$cmd");
3747 return undef;
3748 }
3749
3750 # re-create the testenv's krb5.conf (the restore may have overwritten it,
3751 # if the backup-file was an offline backup)
3752 Samba::mk_krb5_conf($ctx);
3753
3754 # start samba for the restored DC
3755 if (not defined($self->check_or_start($env))) {
3756 return undef;
3757 }
3758
3759 # if this was a backup-rename, then we may need to setup namespaces
3760 my $upn_array = ["$env->{REALM}.upn"];
3761 my $spn_array = ["$env->{REALM}.spn"];
3762
3763 return $env;
3764 }
3765
3766 sub setup_none
3767 {
3768 my ($self, $path) = @_;
3769
3770 my $ret = {
3771 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
3772 SAMBA_PID => -1,
3773 }
3774 }
3775
3776 1;
GSS-enabled samba4