source/selftest/env/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 package Samba4;
   7
   8 use strict;
   9 use Cwd qw(abs_path);
  10 use FindBin qw($RealBin);
  11 use POSIX;
  12
  13 sub new($$$$) {
  14         my ($classname, $bindir, $ldap, $setupdir) = @_;
  15         my $self = {
  16                 vars => {},
  17                 ldap => $ldap,
  18                 bindir => $bindir,
  19                 setupdir => $setupdir
  20         };
  21         bless $self;
  22         return $self;
  23 }
  24
  25 sub openldap_start($$$) {
  26         my ($slapd_conf, $uri, $logs) = @_;
  27         my $oldpath = $ENV{PATH};
  28         $ENV{PATH} = "/usr/local/sbin:/usr/sbin:/sbin:$ENV{PATH}";
  29         system("slapd -d0 -f $slapd_conf -h $uri > $logs 2>&1 &");
  30         $ENV{PATH} = $oldpath;
  31 }
  32
  33 sub slapd_start($$)
  34 {
  35         my $count = 0;
  36         my ($self, $env_vars) = @_;
  37
  38         my $uri = $env_vars->{LDAP_URI};
  39
  40         # running slapd in the background means it stays in the same process group, so it can be
  41         # killed by timelimit
  42         if ($self->{ldap} eq "fedora-ds") {
  43                 system("$ENV{FEDORA_DS_PREFIX}/sbin/ns-slapd -D $env_vars->{FEDORA_DS_DIR} -d0 -i $env_vars->{FEDORA_DS_PIDFILE}> $env_vars->{LDAPDIR}/logs 2>&1 &");
  44         } elsif ($self->{ldap} eq "openldap") {
  45                 openldap_start($env_vars->{SLAPD_CONF}, $uri, "$env_vars->{LDAPDIR}/logs");
  46         }
  47         while (system("$self->{bindir}/ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
  48                 $count++;
  49                 if ($count > 40) {
  50                     $self->slapd_stop($env_vars);
  51                     return 0;
  52                 }
  53                 sleep(1);
  54         }
  55         return 1;
  56 }
  57
  58 sub slapd_stop($$)
  59 {
  60         my ($self, $envvars) = @_;
  61         if ($self->{ldap} eq "fedora-ds") {
  62                 system("$envvars->{LDAPDIR}/slapd-samba4/stop-slapd");
  63         } elsif ($self->{ldap} eq "openldap") {
  64                 open(IN, "<$envvars->{OPENLDAP_PIDFILE}") or
  65                         die("unable to open slapd pid file: $envvars->{OPENLDAP_PIDFILE}");
  66                 kill 9, <IN>;
  67                 close(IN);
  68         }
  69         return 1;
  70 }
  71
  72 sub check_or_start($$$)
  73 {
  74         my ($self, $env_vars, $max_time) = @_;
  75         return 0 if ( -p $env_vars->{SMBD_TEST_FIFO});
  76
  77         unlink($env_vars->{SMBD_TEST_FIFO});
  78         POSIX::mkfifo($env_vars->{SMBD_TEST_FIFO}, 0700);
  79         unlink($env_vars->{SMBD_TEST_LOG});
  80
  81         print "STARTING SMBD... ";
  82         my $pid = fork();
  83         if ($pid == 0) {
  84                 open STDIN, $env_vars->{SMBD_TEST_FIFO};
  85                 open STDOUT, ">$env_vars->{SMBD_TEST_LOG}";
  86                 open STDERR, '>&STDOUT';
  87
  88                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
  89
  90                 my $valgrind = "";
  91                 if (defined($ENV{SMBD_VALGRIND})) {
  92                     $valgrind = $ENV{SMBD_VALGRIND};
  93                 }
  94
  95                 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
  96
  97                 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
  98                 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
  99
 100                 # Start slapd before smbd, but with the fifo on stdin
 101                 if (defined($self->{ldap})) {
 102                     $self->slapd_start($env_vars) or
 103                         die("couldn't start slapd (2nd time)");
 104                 }
 105
 106                 my $optarg = "";
 107                 if (defined($max_time)) {
 108                         $optarg = "--maximum-runtime=$max_time ";
 109                 }
 110                 if (defined($ENV{SMBD_OPTIONS})) {
 111                         $optarg.= " $ENV{SMBD_OPTIONS}";
 112                 }
 113                 my $ret = system("$valgrind $self->{bindir}/smbd $optarg $env_vars->{CONFIGURATION} -M single -i --leak-report-full");
 114                 if ($? == -1) {
 115                         print "Unable to start smbd: $ret: $!\n";
 116                         exit 1;
 117                 }
 118                 unlink($env_vars->{SMBD_TEST_FIFO});
 119                 my $exit = $? >> 8;
 120                 if ( $ret == 0 ) {
 121                         print "smbd exits with status $exit\n";
 122                 } elsif ( $ret & 127 ) {
 123                         print "smbd got signal ".($ret & 127)." and exits with $exit!\n";
 124                 } else {
 125                         $ret = $? >> 8;
 126                         print "smbd failed with status $exit!\n";
 127                 }
 128                 exit $exit;
 129         }
 130         print "DONE\n";
 131
 132         open(DATA, ">$env_vars->{SMBD_TEST_FIFO}");
 133
 134         return $pid;
 135 }
 136
 137 sub wait_for_start($$)
 138 {
 139         my ($self, $testenv_vars) = @_;
 140         # give time for nbt server to register its names
 141         print "delaying for nbt name registration\n";
 142         sleep 2;
 143
 144         # This will return quickly when things are up, but be slow if we
 145         # need to wait for (eg) SSL init
 146         system("bin/nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 147         system("bin/nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 148         system("bin/nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 149         system("bin/nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 150         system("bin/nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSALIAS}");
 151         system("bin/nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSALIAS}");
 152         system("bin/nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 153         system("bin/nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 154         system("bin/nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 155         system("bin/nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 156         system("bin/nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSALIAS}");
 157         system("bin/nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSALIAS}");
 158
 159         print $self->getlog_env($testenv_vars);
 160 }
 161
 162 sub write_ldb_file($$$)
 163 {
 164         my ($self, $file, $ldif) = @_;
 165
 166         open(LDIF, "|$self->{bindir}/ldbadd -H $file >/dev/null");
 167         print LDIF $ldif;
 168         return close(LDIF);
 169 }
 170
 171 sub add_wins_config($$)
 172 {
 173         my ($self, $privatedir) = @_;
 174
 175         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 176 dn: name=TORTURE_6,CN=PARTNERS
 177 objectClass: wreplPartner
 178 name: TORTURE_6
 179 address: 127.0.0.6
 180 pullInterval: 0
 181 pushChangeCount: 0
 182 type: 0x3
 183 ");
 184 }
 185
 186 sub mk_fedora_ds($$$)
 187 {
 188         my ($self, $ldapdir, $configuration) = @_;
 189
 190         my $fedora_ds_inf = "$ldapdir/fedorads.inf";
 191         my $fedora_ds_extra_ldif = "$ldapdir/fedorads-partitions.ldif";
 192
 193         #Make the subdirectory be as fedora DS would expect
 194         my $fedora_ds_dir = "$ldapdir/slapd-samba4";
 195
 196         my $pidfile = "$fedora_ds_dir/logs/slapd-samba4.pid";
 197
 198         system("$self->{bindir}/ad2oLschema $configuration -H $ldapdir/schema-tmp.ldb --option=convert:target=fedora-ds -I $self->{setupdir}/schema-map-fedora-ds-1.0 -O $ldapdir/99_ad.ldif >&2") == 0 or die("schema conversion for Fedora DS failed");
 199
 200 my $dir = getcwd();
 201 chdir "$ENV{FEDORA_DS_PREFIX}/bin" || die;
 202         if (system("perl $ENV{FEDORA_DS_PREFIX}/sbin/setup-ds.pl --silent --file=$fedora_ds_inf >&2") != 0) {
 203             chdir $dir;
 204             die("perl $ENV{FEDORA_DS_PREFIX}/sbin/setup-ds.pl --silent --file=$fedora_ds_inf FAILED: $?");
 205         }
 206         chdir $dir || die;
 207
 208         return ($fedora_ds_dir, $pidfile);
 209 }
 210
 211 sub mk_openldap($$$)
 212 {
 213         my ($self, $ldapdir, $configuration) = @_;
 214
 215         my $slapd_conf = "$ldapdir/slapd.conf";
 216         my $pidfile = "$ldapdir/slapd.pid";
 217         my $modconf = "$ldapdir/modules.conf";
 218
 219         #This uses the backend provision we just did, to read out the schema
 220         system("$self->{bindir}/ad2oLschema $configuration --option=convert:target=openldap -H $ldapdir/schema-tmp.ldb -I $self->{setupdir}/schema-map-openldap-2.3 -O $ldapdir/backend-schema.schema >&2") == 0 or die("schema conversion for OpenLDAP failed");
 221
 222         my $oldpath = $ENV{PATH};
 223         $ENV{PATH} = "$ENV{OPENLDAP_PATH}/usr/local/sbin:/usr/sbin:/sbin:$ENV{PATH}";
 224
 225         unlink($modconf);
 226         open(CONF, ">$modconf"); close(CONF);
 227
 228         if (system("slaptest -u -f $slapd_conf >&2") != 0) {
 229                 open(CONF, ">$modconf");
 230                 # enable slapd modules
 231                 print CONF "
 232 moduleload      back_hdb
 233 moduleload      syncprov
 234 ";
 235                 close(CONF);
 236         }
 237
 238         if (system("slaptest -u -f $slapd_conf >&2") != 0) {
 239                 open(CONF, ">$modconf");
 240                 # enable slapd modules
 241                 print CONF "
 242 modulepath      /usr/lib/ldap
 243 moduleload      back_hdb
 244 moduleload      syncprov
 245 ";
 246                 close(CONF);
 247         }
 248
 249         if (system("slaptest -u -f $slapd_conf >&2") != 0) {
 250                 open(CONF, ">$modconf");
 251                 # enable slapd modules (Fedora layout)
 252                 print CONF "
 253 modulepath      /usr/lib/openldap
 254 moduleload      syncprov
 255 ";
 256                 close(CONF);
 257         }
 258
 259         if (system("slaptest -u -f $slapd_conf >&2") != 0) {
 260                 open(CONF, ">$modconf");
 261                 # enable slapd modules (Fedora x86_64 layout)
 262                 print CONF "
 263 modulepath      /usr/lib64/openldap
 264 moduleload      syncprov
 265 ";
 266                 close(CONF);
 267         }
 268
 269         system("slaptest -u -f $slapd_conf") == 0 or die("slaptest still fails after adding modules");
 270
 271
 272         $ENV{PATH} = $oldpath;
 273
 274         return ($slapd_conf, $pidfile);
 275 }
 276
 277 sub mk_keyblobs($$)
 278 {
 279         my ($self, $tlsdir) = @_;
 280
 281         #TLS and PKINIT crypto blobs
 282         my $dhfile = "$tlsdir/dhparms.pem";
 283         my $cafile = "$tlsdir/ca.pem";
 284         my $certfile = "$tlsdir/cert.pem";
 285         my $reqkdc = "$tlsdir/req-kdc.der";
 286         my $kdccertfile = "$tlsdir/kdc.pem";
 287         my $keyfile = "$tlsdir/key.pem";
 288         my $adminkeyfile = "$tlsdir/adminkey.pem";
 289         my $reqadmin = "$tlsdir/req-admin.der";
 290         my $admincertfile = "$tlsdir/admincert.pem";
 291
 292         mkdir($tlsdir, 0777);
 293
 294         #This is specified here to avoid draining entropy on every run
 295         open(DHFILE, ">$dhfile");
 296         print DHFILE <<EOF;
 297 -----BEGIN DH PARAMETERS-----
 298 MGYCYQC/eWD2xkb7uELmqLi+ygPMKyVcpHUo2yCluwnbPutEueuxrG/Cys8j8wLO
 299 svCN/jYNyR2NszOmg7ZWcOC/4z/4pWDVPUZr8qrkhj5MRKJc52MncfaDglvEdJrv
 300 YX70obsCAQI=
 301 -----END DH PARAMETERS-----
 302 EOF
 303         close(DHFILE);
 304
 305         #Likewise, we pregenerate the key material.  This allows the
 306         #other certificates to be pre-generated
 307         open(KEYFILE, ">$keyfile");
 308         print KEYFILE <<EOF;
 309 -----BEGIN RSA PRIVATE KEY-----
 310 MIICXQIBAAKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpc
 311 ol3+S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H
 312 6H+pPqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQAB
 313 AoGAAqDLzFRR/BF1kpsiUfL4WFvTarCe9duhwj7ORc6fs785qAXuwUYAJ0Uvzmy6
 314 HqoGv3t3RfmeHDmjcpPHsbOKnsOQn2MgmthidQlPBMWtQMff5zdoYNUFiPS0XQBq
 315 szNW4PRjaA9KkLQVTwnzdXGkBSkn/nGxkaVu7OR3vJOBoo0CQQDO4upypesnbe6p
 316 9/xqfZ2uim8IwV1fLlFClV7WlCaER8tsQF4lEi0XSzRdXGUD/dilpY88Nb+xok/X
 317 8Z8OvgAXAkEA+pcLsx1gN7kxnARxv54jdzQjC31uesJgMKQXjJ0h75aUZwTNHmZQ
 318 vPxi6u62YiObrN5oivkixwFNncT9MxTxVQJBAMaWUm2SjlLe10UX4Zdm1MEB6OsC
 319 kVoX37CGKO7YbtBzCfTzJGt5Mwc1DSLA2cYnGJqIfSFShptALlwedot0HikCQAJu
 320 jNKEKnbf+TdGY8Q0SKvTebOW2Aeg80YFkaTvsXCdyXrmdQcifw4WdO9KucJiDhSz
 321 Y9hVapz7ykEJtFtWjLECQQDIlfc63I5ZpXfg4/nN4IJXUW6AmPVOYIA5215itgki
 322 cSlMYli1H9MEXH0pQMGv5Qyd0OYIx2DDg96mZ+aFvqSG
 323 -----END RSA PRIVATE KEY-----
 324 EOF
 325         close(KEYFILE);
 326
 327         open(ADMINKEYFILE, ">$adminkeyfile");
 328
 329         print ADMINKEYFILE <<EOF;
 330 -----BEGIN RSA PRIVATE KEY-----
 331 MIICXQIBAAKBgQD0+OL7TQBj0RejbIH1+g5GeRaWaM9xF43uE5y7jUHEsi5owhZF
 332 5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMFxB6esnXhl0Jpip1JkUMM
 333 XLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xdl3JRlwIDAQAB
 334 AoGAP8mjCP628Ebc2eACQzOWjgEvwYCPK4qPmYOf1zJkArzG2t5XAGJ5WGrENRuB
 335 cm3XFh1lpmaADl982UdW3gul4gXUy6w4XjKK4vVfhyHj0kZ/LgaXUK9BAGhroJ2L
 336 osIOUsaC6jdx9EwSRctwdlF3wWJ8NK0g28AkvIk+FlolW4ECQQD7w5ouCDnf58CN
 337 u4nARx4xv5XJXekBvOomkCQAmuOsdOb6b9wn3mm2E3au9fueITjb3soMR31AF6O4
 338 eAY126rXAkEA+RgHzybzZEP8jCuznMqoN2fq/Vrs6+W3M8/G9mzGEMgLLpaf2Jiz
 339 I9tLZ0+OFk9tkRaoCHPfUOCrVWJZ7Y53QQJBAMhoA6rw0WDyUcyApD5yXg6rusf4
 340 ASpo/tqDkqUIpoL464Qe1tjFqtBM3gSXuhs9xsz+o0bzATirmJ+WqxrkKTECQHt2
 341 OLCpKqwAspU7N+w32kaUADoRLisCEdrhWklbwpQgwsIVsCaoEOpt0CLloJRYTANE
 342 yoZeAErTALjyZYZEPcECQQDlUi0N8DFxQ/lOwWyR3Hailft+mPqoPCa8QHlQZnlG
 343 +cfgNl57YHMTZFwgUVFRdJNpjH/WdZ5QxDcIVli0q+Ko
 344 -----END RSA PRIVATE KEY-----
 345 EOF
 346
 347         #generated with
 348         #hxtool issue-certificate --self-signed --issue-ca --ca-private-key=FILE:$KEYFILE \
 349         #          --subject="CN=CA,$BASEDN" --certificate="FILE:$CAFILE"
 350
 351         open(CAFILE, ">$cafile");
 352         print CAFILE <<EOF;
 353 -----BEGIN CERTIFICATE-----
 354 MIIChTCCAe6gAwIBAgIUFZoF6jt0R+hQBdF7cWPy0tT3fGwwCwYJKoZIhvcNAQEFMFIxEzAR
 355 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 356 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDcwMTIzMDU1MzA5WhgPMjAwODAxMjQw
 357 NTUzMDlaMFIxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 358 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMIGfMA0GCSqGSIb3DQEBAQUA
 359 A4GNADCBiQKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+S9/6
 360 I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+pPqVIRLOmrWIm
 361 ai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABo1YwVDAOBgNVHQ8BAf8EBAMC
 362 AqQwEgYDVR0lBAswCQYHKwYBBQIDBTAdBgNVHQ4EFgQUwtm596AMotmzRU7IVdgrUvozyjIw
 363 DwYDVR0TBAgwBgEB/wIBADANBgkqhkiG9w0BAQUFAAOBgQBgzh5uLDmESGYv60iUdEfuk/T9
 364 VCpzb1z3VJVWt3uJoQYbcpR00SKeyMdlfTTLzO6tSPMmlk4hwqfvLkPzGCSObR4DRRYa0BtY
 365 2laBVlg9X59bGpMUvpFQfpvxjvFWNJDL+377ELCVpLNdoR23I9TKXlalj0bY5Ks46CVIrm6W
 366 EA==
 367 -----END CERTIFICATE-----
 368 EOF
 369
 370         #generated with GNUTLS internally in Samba.
 371
 372         open(CERTFILE, ">$certfile");
 373         print CERTFILE <<EOF;
 374 -----BEGIN CERTIFICATE-----
 375 MIICYTCCAcygAwIBAgIE5M7SRDALBgkqhkiG9w0BAQUwZTEdMBsGA1UEChMUU2Ft
 376 YmEgQWRtaW5pc3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1
 377 dG9nZW5lcmF0ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMB4XDTA2MDgw
 378 NDA0MzY1MloXDTA4MDcwNDA0MzY1MlowZTEdMBsGA1UEChMUU2FtYmEgQWRtaW5p
 379 c3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1dG9nZW5lcmF0
 380 ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMIGcMAsGCSqGSIb3DQEBAQOB
 381 jAAwgYgCgYDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+
 382 S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+p
 383 PqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABoyUw
 384 IzAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGCSqGSIb3DQEB
 385 BQOBgQAmkN6XxvDnoMkGcWLCTwzxGfNNSVcYr7TtL2aJh285Xw9zaxcm/SAZBFyG
 386 LYOChvh6hPU7joMdDwGfbiLrBnMag+BtGlmPLWwp/Kt1wNmrRhduyTQFhN3PP6fz
 387 nBr9vVny2FewB2gHmelaPS//tXdxivSXKz3NFqqXLDJjq7P8wA==
 388 -----END CERTIFICATE-----
 389 EOF
 390         close(CERTFILE);
 391
 392         #KDC certificate
 393         # hxtool request-create --subject="CN=krbtgt,cn=users,$basedn" --key=FILE:$KEYFILE $KDCREQ
 394
 395         # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE --type="pkinit-kdc" --pk-init-principal="krbtgt/$RELAM@$REALM" --req="$KDCREQ" --certificate="FILE:$KDCCERTFILE"
 396
 397         open(KDCCERTFILE, ">$kdccertfile");
 398         print KDCCERTFILE <<EOF;
 399 -----BEGIN CERTIFICATE-----
 400 MIIDDDCCAnWgAwIBAgIUDEhjaOT1ZjHjHHEn+l5eYO05oK8wCwYJKoZIhvcNAQEFMFIxEzAR
 401 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 402 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDcwMTIzMDcwNzA4WhgPMjAwODAxMjQw
 403 NzA3MDhaMGYxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 404 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMQ8wDQYDVQQDDAZrcmJ0
 405 Z3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMqDqkDAIdQwDUN8cOZaFl934XQL70nF
 406 yq+nD2KL0SfcTW5+WlyiXf5L3/oj+5pOYkdmt74MXd1PNv9Q5mjRl6bw34jPOSCgaQVp+Ne5
 407 PcEvlQ9jb8fof6k+pUhEs6atYiZqLfn1jKgqEXKjftjoc95TxBxn67atL2B5qkhZ966jAgMB
 408 AAGjgcgwgcUwDgYDVR0PAQH/BAQDAgWgMBIGA1UdJQQLMAkGBysGAQUCAwUwVAYDVR0RBE0w
 409 S6BJBgYrBgEFAgKgPzA9oBMbEVNBTUJBLkVYQU1QTEUuQ09NoSYwJKADAgEBoR0wGxsGa3Ji
 410 dGd0GxFTQU1CQS5FWEFNUExFLkNPTTAfBgNVHSMEGDAWgBTC2bn3oAyi2bNFTshV2CtS+jPK
 411 MjAdBgNVHQ4EFgQUwtm596AMotmzRU7IVdgrUvozyjIwCQYDVR0TBAIwADANBgkqhkiG9w0B
 412 AQUFAAOBgQCMSgLkIv9RobE0a95H2ECA+5YABBwKXIt4AyN/HpV7iJdRx7B9PE6vM+nboVKY
 413 E7i7ECUc3bu6NgrLu7CKHelNclHWWMiZzSUwhkXyvG/LE9qtr/onNu9NfLt1OV+dwQwyLdEP
 414 n63FxSmsKg3dfi3ryQI/DIKeisvipwDtLqOn9g==
 415 -----END CERTIFICATE-----
 416 EOF
 417
 418         #hxtool request-create --subject="CN=Administrator,cn=users,$basedn" --key=FILE:$ADMINKEYFILE $ADMINREQFILE
 419         #hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE --type="pkinit-client" --pk-init-principal="administrator@$REALM" --req="$ADMINREQFILE" --certificate="FILE:$ADMINCERTFILE"
 420
 421         open(ADMINCERTFILE, ">$admincertfile");
 422         print ADMINCERTFILE <<EOF;
 423 -----BEGIN CERTIFICATE-----
 424 MIICwjCCAiugAwIBAgIUXyECoq4im33ByZDWZMGhtpvHYWEwCwYJKoZIhvcNAQEFMFIxEzAR
 425 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 426 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDcwMTIzMDcyMzE2WhgPMjAwODAxMjQw
 427 NzIzMTZaMCgxDjAMBgNVBAMMBXVzZXJzMRYwFAYDVQQDDA1BZG1pbmlzdHJhdG9yMIGfMA0G
 428 CSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0+OL7TQBj0RejbIH1+g5GeRaWaM9xF43uE5y7jUHE
 429 si5owhZF5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMFxB6esnXhl0Jpip1JkUMM
 430 XLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xdl3JRlwIDAQABo4G8MIG5
 431 MA4GA1UdDwEB/wQEAwIFoDASBgNVHSUECzAJBgcrBgEFAgMEMEgGA1UdEQRBMD+gPQYGKwYB
 432 BQICoDMwMaATGxFTQU1CQS5FWEFNUExFLkNPTaEaMBigAwIBAaERMA8bDWFkbWluaXN0cmF0
 433 b3IwHwYDVR0jBBgwFoAUwtm596AMotmzRU7IVdgrUvozyjIwHQYDVR0OBBYEFCDzVsvJ8IDz
 434 wLYH8EONeUa5oVrGMAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEFBQADgYEAbTCnaPTieVZPV3bH
 435 UmAMbnF9+YN1mCbe2xZJ0xzve+Yw1XO82iv/9kZaZkcRkaQt2qcwsBK/aSPOgfqGx+mJ7hXQ
 436 AGWvAJhnWi25PawNaRysCN8WC6+nWKR4d2O2m5rpj3T9kH5WE7QbG0bCu92dGaS29FvWDCP3
 437 q9pRtDOoAZc=
 438 -----END CERTIFICATE-----
 439 EOF
 440         close(ADMINCERTFILE);
 441 }
 442
 443 sub provision($$$$$$)
 444 {
 445         my ($self, $prefix, $server_role, $netbiosname, $netbiosalias, $swiface, $password) = @_;
 446
 447         my $smbd_loglevel = 1;
 448         my $username = "administrator";
 449         my $domain = "SAMBADOMAIN";
 450         my $realm = "SAMBA.EXAMPLE.COM";
 451         my $dnsname = "samba.example.com";
 452         my $basedn = "dc=samba,dc=example,dc=com";
 453         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 454         chomp $unix_name;
 455         my $unix_uid = $>;
 456         my $unix_gids_str = $);
 457         my @unix_gids = split(" ", $unix_gids_str);
 458         my $srcdir="$RealBin/..";
 459         -d $prefix or mkdir($prefix, 0777) or die("Unable to create $prefix");
 460         my $prefix_abs = abs_path($prefix);
 461         my $tmpdir = "$prefix_abs/tmp";
 462         my $etcdir = "$prefix_abs/etc";
 463         my $piddir = "$prefix_abs/pid";
 464         my $conffile = "$etcdir/smb.conf";
 465         my $krb5_config = "$etcdir/krb5.conf";
 466         my $privatedir = "$prefix_abs/private";
 467         my $ncalrpcdir = "$prefix_abs/ncalrpc";
 468         my $lockdir = "$prefix_abs/lockdir";
 469         my $winbindd_socket_dir = "$prefix_abs/winbind_socket";
 470         my $winbindd_priv_pipe_dir = "$piddir/smbd.tmp/winbind_pipe";
 471         my $nsswrap_passwd = "$etcdir/passwd";
 472         my $nsswrap_group = "$etcdir/group";
 473
 474         my $configuration = "--configfile=$conffile";
 475         my $ldapdir = "$privatedir/ldap";
 476
 477         my $tlsdir = "$privatedir/tls";
 478
 479         my $ifaceipv4 = "127.0.0.$swiface";
 480         my $interfaces = "$ifaceipv4/8";
 481
 482         (system("rm -rf $prefix/*") == 0) or die("Unable to clean up");
 483         mkdir($_, 0777) foreach ($privatedir, $etcdir, $piddir, $ncalrpcdir, $lockdir,
 484                 $tmpdir);
 485
 486
 487         my $localbasedn = $basedn;
 488         $localbasedn = "DC=$netbiosname" if $server_role eq "member server";
 489
 490         open(CONFFILE, ">$conffile");
 491         print CONFFILE "
 492 [global]
 493         netbios name = $netbiosname
 494         netbios aliases = $netbiosalias
 495         workgroup = $domain
 496         realm = $realm
 497         private dir = $privatedir
 498         pid directory = $piddir
 499         ncalrpc dir = $ncalrpcdir
 500         lock dir = $lockdir
 501         setup directory = $self->{setupdir}
 502         modules dir = $self->{bindir}/modules
 503         js include = $srcdir/scripting/libjs
 504         winbindd socket directory = $winbindd_socket_dir
 505         winbind separator = /
 506         name resolve order = bcast
 507         interfaces = $interfaces
 508         tls dh params file = $tlsdir/dhparms.pem
 509         panic action = $srcdir/script/gdb_backtrace \%PID% \%PROG%
 510         wins support = yes
 511         server role = $server_role
 512         max xmit = 32K
 513         server max protocol = SMB2
 514         notify:inotify = false
 515         ldb:nosync = true
 516         system:anonymous = true
 517 #We don't want to pass our self-tests if the PAC code is wrong
 518         gensec:require_pac = true
 519         log level = $smbd_loglevel
 520
 521 [tmp]
 522         path = $tmpdir
 523         read only = no
 524         ntvfs handler = posix
 525         posix:sharedelay = 100000
 526         posix:eadb = $lockdir/eadb.tdb
 527
 528 [cifs]
 529         read only = no
 530         ntvfs handler = cifs
 531         cifs:server = $netbiosname
 532         cifs:share = tmp
 533 #There is no username specified here, instead the client is expected
 534 #to log in with kerberos, and smbd will used delegated credentials.
 535
 536 [simple]
 537         path = $tmpdir
 538         read only = no
 539         ntvfs handler = simple
 540
 541 [cifsposix]
 542         copy = simple
 543         ntvfs handler = cifsposix
 544 ";
 545         close(CONFFILE);
 546
 547         $self->mk_keyblobs($tlsdir);
 548
 549         open(KRB5CONF, ">$krb5_config");
 550         print KRB5CONF "
 551 #Generated krb5.conf for $realm
 552
 553 [libdefaults]
 554  default_realm = $realm
 555  dns_lookup_realm = false
 556  dns_lookup_kdc = false
 557  ticket_lifetime = 24h
 558  forwardable = yes
 559
 560 [realms]
 561  $realm = {
 562   kdc = 127.0.0.1:88
 563   admin_server = 127.0.0.1:88
 564   default_domain = $dnsname
 565  }
 566  $dnsname = {
 567   kdc = 127.0.0.1:88
 568   admin_server = 127.0.0.1:88
 569   default_domain = $dnsname
 570  }
 571  $domain = {
 572   kdc = 127.0.0.1:88
 573   admin_server = 127.0.0.1:88
 574   default_domain = $dnsname
 575  }
 576
 577 [appdefaults]
 578         pkinit_anchors = FILE:$tlsdir/ca.pem
 579
 580 [kdc]
 581         enable-pkinit = true
 582         pkinit_identity = FILE:$tlsdir/kdc.pem,$tlsdir/key.pem
 583         pkinit_anchors = FILE:$tlsdir/ca.pem
 584
 585 [domain_realm]
 586  .$dnsname = $realm
 587 ";
 588         close(KRB5CONF);
 589
 590         open(PWD, ">$nsswrap_passwd");
 591         print PWD "
 592 root:x:0:0:root gecos:$prefix_abs:/bin/false
 593 $unix_name:x:$unix_uid:$unix_gids[0]:$unix_name gecos:$prefix_abs:/bin/false
 594 nobody:x:65534:65533:nobody gecos:$prefix_abs:/bin/false
 595 ";
 596         close(PWD);
 597
 598         open(GRP, ">$nsswrap_group");
 599         print GRP "
 600 root:x:0:
 601 wheel:x:10:
 602 users:x:100:
 603 nobody:x:65533:
 604 nogroup:x:65534:nobody
 605 ";
 606         close(GRP);
 607
 608 #Ensure the config file is valid before we start
 609         if (system("$self->{bindir}/testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 610                 system("$self->{bindir}/testparm -v --suppress-prompt $configuration >&2");
 611                 die("Failed to create a valid smb.conf configuration!");
 612         }
 613
 614         (system("($self->{bindir}/testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$netbiosname\" ) >/dev/null 2>&1") == 0) or die("Failed to create a valid smb.conf configuration!");
 615
 616         my @provision_options = ();
 617         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$nsswrap_passwd\"");
 618         push (@provision_options, "NSS_WRAPPER_GROUP=\"$nsswrap_group\"");
 619         push (@provision_options, "$self->{bindir}/smbscript");
 620         push (@provision_options, "$self->{setupdir}/provision");
 621         push (@provision_options, split(' ', $configuration));
 622         push (@provision_options, "--host-name=$netbiosname");
 623         push (@provision_options, "--host-ip=$ifaceipv4");
 624         push (@provision_options, "--quiet");
 625         push (@provision_options, "--domain=$domain");
 626         push (@provision_options, "--realm=$realm");
 627         push (@provision_options, "--adminpass=$password");
 628         push (@provision_options, "--krbtgtpass=krbtgt$password");
 629         push (@provision_options, "--machinepass=machine$password");
 630         push (@provision_options, "--root=$unix_name");
 631         push (@provision_options, "--simple-bind-dn=cn=Manager,$localbasedn");
 632         push (@provision_options, "--password=$password");
 633         push (@provision_options, "--server-role=\"$server_role\"");
 634
 635         my $ldap_uri= "$ldapdir/ldapi";
 636         $ldap_uri =~ s|/|%2F|g;
 637         $ldap_uri = "ldapi://$ldap_uri";
 638
 639         my $ret = {
 640                 KRB5_CONFIG => $krb5_config,
 641                 PIDDIR => $piddir,
 642                 SERVER => $netbiosname,
 643                 SERVER_IP => $ifaceipv4,
 644                 NETBIOSNAME => $netbiosname,
 645                 NETBIOSALIAS => $netbiosalias,
 646                 LDAP_URI => $ldap_uri,
 647                 DOMAIN => $domain,
 648                 USERNAME => $username,
 649                 REALM => $realm,
 650                 PASSWORD => $password,
 651                 LDAPDIR => $ldapdir,
 652                 WINBINDD_SOCKET_DIR => $winbindd_socket_dir,
 653                 WINBINDD_PRIV_PIPE_DIR => $winbindd_priv_pipe_dir,
 654                 NCALRPCDIR => $ncalrpcdir,
 655                 LOCKDIR => $lockdir,
 656                 CONFIGURATION => $configuration,
 657                 SOCKET_WRAPPER_DEFAULT_IFACE => $swiface,
 658                 NSS_WRAPPER_PASSWD => $nsswrap_passwd,
 659                 NSS_WRAPPER_GROUP => $nsswrap_group,
 660         };
 661
 662         if (defined($self->{ldap})) {
 663
 664                 push (@provision_options, "--ldap-backend=$ldap_uri");
 665                 system("$self->{bindir}/smbscript $self->{setupdir}/provision-backend $configuration --ldap-manager-pass=$password --root=$unix_name --realm=$realm --host-name=$netbiosname --ldap-backend-type=$self->{ldap}>&2") == 0 or die("backend provision failed");
 666
 667                 if ($self->{ldap} eq "openldap") {
 668                        ($ret->{SLAPD_CONF}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ldapdir, $configuration) or die("Unable to create openldap directories");
 669                 } elsif ($self->{ldap} eq "fedora-ds") {
 670                        ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ldapdir, $configuration) or die("Unable to create fedora ds directories");
 671                        push (@provision_options, "--ldap-module=nsuniqueid");
 672                        push (@provision_options, "--aci=aci:: KHRhcmdldGF0dHIgPSAiKiIpICh2ZXJzaW9uIDMuMDthY2wgImZ1bGwgYWNjZXNzIHRvIGFsbCBieSBhbGwiO2FsbG93IChhbGwpKHVzZXJkbiA9ICJsZGFwOi8vL2FueW9uZSIpOykK");
 673                  }
 674
 675                 $self->slapd_start($ret) or
 676                         die("couldn't start slapd");
 677         }
 678
 679         my $provision_cmd = join(" ", @provision_options);
 680         (system($provision_cmd) == 0) or die("Unable to provision: \n$provision_cmd\n");
 681
 682         if (defined($self->{ldap})) {
 683                 $self->slapd_stop($ret) or
 684                         die("couldn't stop slapd");
 685         }
 686
 687         return $ret;
 688 }
 689
 690 sub provision_member($$$)
 691 {
 692         my ($self, $prefix, $dcvars) = @_;
 693         print "PROVISIONING MEMBER...";
 694
 695         my $ret = $self->provision($prefix,
 696                                    "member server",
 697                                    "localmember3",
 698                                    "localmember",
 699                                    3,
 700                                    "localmemberpass");
 701
 702         $ret or die("Unable to provision");
 703
 704         my $cmd = "";
 705         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 706         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 707         $cmd .= "$self->{bindir}/net join $ret->{CONFIGURATION} $dcvars->{DOMAIN} member";
 708         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
 709
 710         system($cmd) == 0 or die("Join failed\n$cmd");
 711
 712         $ret->{SMBD_TEST_FIFO} = "$prefix/smbd_test.fifo";
 713         $ret->{SMBD_TEST_LOG} = "$prefix/smbd_test.log";
 714         $ret->{SMBD_TEST_LOG_POS} = 0;
 715
 716         $ret->{DC_SERVER} = $dcvars->{SERVER};
 717         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
 718         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
 719         $ret->{DC_NETBIOSALIAS} = $dcvars->{NETBIOSALIAS};
 720         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
 721         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
 722
 723         return $ret;
 724 }
 725
 726 sub provision_dc($$)
 727 {
 728         my ($self, $prefix) = @_;
 729
 730         print "PROVISIONING DC...";
 731         my $ret = $self->provision($prefix,
 732                                    "domain controller",
 733                                    "localdc1",
 734                                    "localdc",
 735                                    1,
 736                                    "localdcpass");
 737
 738         $self->add_wins_config("$prefix/private") or
 739                 die("Unable to add wins configuration");
 740
 741         $ret->{SMBD_TEST_FIFO} = "$prefix/smbd_test.fifo";
 742         $ret->{SMBD_TEST_LOG} = "$prefix/smbd_test.log";
 743         $ret->{SMBD_TEST_LOG_POS} = 0;
 744         return $ret;
 745 }
 746
 747 sub teardown_env($$)
 748 {
 749         my ($self, $envvars) = @_;
 750         my $pid;
 751
 752         close(DATA);
 753
 754         if (-f "$envvars->{PIDDIR}/smbd.pid" ) {
 755                 open(IN, "<$envvars->{PIDDIR}/smbd.pid") or die("unable to open smbd pid file");
 756                 $pid = <IN>;
 757                 close(IN);
 758
 759                 # Give the process 20 seconds to exit.  gcov needs
 760                 # this time to write out the covarge data
 761                 my $count = 0;
 762                 until (kill(0, $pid) == 0) {
 763                     # if no process sucessfully signalled, then we are done
 764                     sleep(1);
 765                     $count++;
 766                     last if $count > 20;
 767                 }
 768
 769                 # If it is still around, kill it
 770                 if ($count > 20) {
 771                     print "smbd process $pid took more than $count seconds to exit, killing\n";
 772                     kill 9, $pid;
 773                 }
 774         }
 775
 776         my $failed = $? >> 8;
 777
 778         $self->slapd_stop($envvars) if ($self->{ldap});
 779
 780         print $self->getlog_env($envvars);
 781
 782         return $failed;
 783 }
 784
 785 sub getlog_env($$)
 786 {
 787         my ($self, $envvars) = @_;
 788         my $title = "SMBD LOG of: $envvars->{NETBIOSNAME}\n";
 789         my $out = $title;
 790
 791         open(LOG, "<$envvars->{SMBD_TEST_LOG}");
 792
 793         seek(LOG, $envvars->{SMBD_TEST_LOG_POS}, SEEK_SET);
 794         while (<LOG>) {
 795                 $out .= $_;
 796         }
 797         $envvars->{SMBD_TEST_LOG_POS} = tell(LOG);
 798         close(LOG);
 799
 800         return "" if $out eq $title;
 801
 802         return $out;
 803 }
 804
 805 sub check_env($$)
 806 {
 807         my ($self, $envvars) = @_;
 808
 809         return 1 if (-p $envvars->{SMBD_TEST_FIFO});
 810
 811         print $self->getlog_env($envvars);
 812
 813         return 0;
 814 }
 815
 816 sub setup_env($$$)
 817 {
 818         my ($self, $envname, $path) = @_;
 819
 820         if ($envname eq "dc") {
 821                 return $self->setup_dc("$path/dc");
 822         } elsif ($envname eq "member") {
 823                 if (not defined($self->{vars}->{dc})) {
 824                         $self->setup_dc("$path/dc");
 825                 }
 826                 return $self->setup_member("$path/member", $self->{vars}->{dc});
 827         } else {
 828                 die("Samba4 can't provide environment '$envname'");
 829         }
 830 }
 831
 832 sub setup_member($$$$)
 833 {
 834         my ($self, $path, $dc_vars) = @_;
 835
 836         my $env = $self->provision_member($path, $dc_vars);
 837
 838         $self->check_or_start($env, ($ENV{SMBD_MAXTIME} or 7500));
 839
 840         $self->wait_for_start($env);
 841
 842         return $env;
 843 }
 844
 845 sub setup_dc($$)
 846 {
 847         my ($self, $path) = @_;
 848
 849         my $env = $self->provision_dc($path);
 850
 851         $self->check_or_start($env,
 852                 ($ENV{SMBD_MAXTIME} or 7500));
 853
 854         $self->wait_for_start($env);
 855
 856         $self->{vars}->{dc} = $env;
 857
 858         return $env;
 859 }
 860
 861 sub stop($)
 862 {
 863         my ($self) = @_;
 864 }
 865
 866 1;