From 94bbcb0ea0b4eb9a4f16d7eb4fbf4d363b34ba61 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 26 Feb 2018 14:56:27 +0100 Subject: [PATCH] selftest: generate a ramdon domain sid during provision and export as SAMSID/[TRUST_]DOMSID This will be useful for future tests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13300 Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider --- selftest/selftest.pl | 3 +++ selftest/target/Samba.pm | 6 ++++++ selftest/target/Samba3.pm | 21 +++++++++++++++++++++ selftest/target/Samba4.pm | 27 ++++++++++++++++++++++++--- 4 files changed, 54 insertions(+), 3 deletions(-) diff --git a/selftest/selftest.pl b/selftest/selftest.pl index 12452bc420d..42c1e62736f 100755 --- a/selftest/selftest.pl +++ b/selftest/selftest.pl @@ -804,6 +804,7 @@ my @exported_envvars = ( # domain stuff "DOMAIN", "REALM", + "DOMSID", # stuff related to a trusted domain "TRUST_SERVER", @@ -814,6 +815,7 @@ my @exported_envvars = ( "TRUST_PASSWORD", "TRUST_DOMAIN", "TRUST_REALM", + "TRUST_DOMSID", # domain controller stuff "DC_SERVER", @@ -868,6 +870,7 @@ my @exported_envvars = ( "SERVER_IPV6", "NETBIOSNAME", "NETBIOSALIAS", + "SAMSID", # user stuff "USERNAME", diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm index f25507f7201..b0482d36c91 100644 --- a/selftest/target/Samba.pm +++ b/selftest/target/Samba.pm @@ -443,4 +443,10 @@ sub cleanup_child($$) return $childpid; } +sub random_domain_sid() +{ + my $domain_sid = "S-1-5-21-". int(rand(4294967295)) . "-" . int(rand(4294967295)) . "-" . int(rand(4294967295)); + return $domain_sid; +} + 1; diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index 6bedbde832f..8914507c12e 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -225,6 +225,7 @@ sub setup_nt4_dc return undef; } + $vars->{DOMSID} = $vars->{SAMSID}; $vars->{DC_SERVER} = $vars->{SERVER}; $vars->{DC_SERVER_IP} = $vars->{SERVER_IP}; $vars->{DC_SERVER_IPV6} = $vars->{SERVER_IPV6}; @@ -273,6 +274,7 @@ sub setup_nt4_dc_schannel return undef; } + $vars->{DOMSID} = $vars->{SAMSID}; $vars->{DC_SERVER} = $vars->{SERVER}; $vars->{DC_SERVER_IP} = $vars->{SERVER_IP}; $vars->{DC_SERVER_IPV6} = $vars->{SERVER_IPV6}; @@ -347,6 +349,7 @@ sub setup_nt4_member return undef; } + $ret->{DOMSID} = $nt4_dc_vars->{DOMSID}; $ret->{DC_SERVER} = $nt4_dc_vars->{SERVER}; $ret->{DC_SERVER_IP} = $nt4_dc_vars->{SERVER_IP}; $ret->{DC_SERVER_IPV6} = $nt4_dc_vars->{SERVER_IPV6}; @@ -429,6 +432,7 @@ sub setup_ad_member close(USERMAP); $ret->{DOMAIN} = $dcvars->{DOMAIN}; $ret->{REALM} = $dcvars->{REALM}; + $ret->{DOMSID} = $dcvars->{DOMSID}; my $ctx; $ctx = {}; @@ -521,6 +525,7 @@ sub setup_ad_member_rfc2307 close(USERMAP); $ret->{DOMAIN} = $dcvars->{DOMAIN}; $ret->{REALM} = $dcvars->{REALM}; + $ret->{DOMSID} = $dcvars->{DOMSID}; my $ctx; my $prefix_abs = abs_path($prefix); @@ -606,6 +611,7 @@ sub setup_ad_member_idmap_rid close(USERMAP); $ret->{DOMAIN} = $dcvars->{DOMAIN}; $ret->{REALM} = $dcvars->{REALM}; + $ret->{DOMSID} = $dcvars->{DOMSID}; my $ctx; my $prefix_abs = abs_path($prefix); @@ -692,6 +698,7 @@ sub setup_ad_member_idmap_ad close(USERMAP); $ret->{DOMAIN} = $dcvars->{DOMAIN}; $ret->{REALM} = $dcvars->{REALM}; + $ret->{DOMSID} = $dcvars->{DOMSID}; my $ctx; my $prefix_abs = abs_path($prefix); @@ -1029,6 +1036,8 @@ $ret->{USERNAME} = KTEST\\Administrator #This is the secrets.tdb created by 'net ads join' from Samba3 to a #Samba4 DC with the same parameters as are being used here. The #domain SID is S-1-5-21-1071277805-689288055-3486227160 + $ret->{SAMSID} = "S-1-5-21-1911091480-1468226576-2729736297"; + $ret->{DOMSID} = "S-1-5-21-1071277805-689288055-3486227160"; system("cp $self->{srcdir}/source3/selftest/ktest-secrets.tdb $prefix/private/secrets.tdb"); chmod 0600, "$prefix/private/secrets.tdb"; @@ -1364,6 +1373,7 @@ sub provision($$$$$$$$$) ## setup the various environment variables we need ## + my $samsid = Samba::random_domain_sid(); my $swiface = Samba::get_interface($server); my %ret = (); my %createuser_env = (); @@ -2143,6 +2153,16 @@ sub provision($$$$$$$$$) "; close(CONF); + my $net = Samba::bindir_path($self, "net"); + my $cmd = ""; + $cmd .= "SMB_CONF_PATH=\"$conffile\" "; + $cmd .= "$net setlocalsid $samsid"; + + if (system($cmd) != 0) { + warn("Join failed\n$cmd"); + return undef; + } + unless (open(DFQCONF, ">$dfqconffile")) { warn("Unable to open $dfqconffile"); return undef; @@ -2266,6 +2286,7 @@ force_user:x:$gid_force_user: $ret{USERNAME} = $unix_name; $ret{USERID} = $unix_uid; $ret{DOMAIN} = $domain; + $ret{SAMSID} = $samsid; $ret{NETBIOSNAME} = $server; $ret{PASSWORD} = $password; $ret{PIDDIR} = $piddir; diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm index b537d74f31f..608265ca11c 100755 --- a/selftest/target/Samba4.pm +++ b/selftest/target/Samba4.pm @@ -372,6 +372,7 @@ sub setup_trust($$$$$) $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD}; $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN}; $localenv->{TRUST_REALM} = $remoteenv->{REALM}; + $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID}; my $samba_tool = Samba::bindir_path($self, "samba-tool"); # setup the trust @@ -401,10 +402,10 @@ sub setup_trust($$$$$) return $localenv } -sub provision_raw_prepare($$$$$$$$$$$) +sub provision_raw_prepare($$$$$$$$$$$$) { my ($self, $prefix, $server_role, $hostname, - $domain, $realm, $functional_level, + $domain, $realm, $samsid, $functional_level, $password, $kdc_ipv4, $kdc_ipv6) = @_; my $ctx; my $netbiosname = uc($hostname); @@ -448,6 +449,7 @@ sub provision_raw_prepare($$$$$$$$$$$) $ctx->{domain} = $domain; $ctx->{realm} = uc($realm); $ctx->{dnsname} = lc($realm); + $ctx->{samsid} = $samsid; $ctx->{functional_level} = $functional_level; @@ -543,6 +545,9 @@ sub provision_raw_prepare($$$$$$$$$$$) push (@provision_options, "--quiet"); push (@provision_options, "--domain=$ctx->{domain}"); push (@provision_options, "--realm=$ctx->{realm}"); + if (defined($ctx->{samsid})) { + push (@provision_options, "--domain-sid=$ctx->{samsid}"); + } push (@provision_options, "--adminpass=$ctx->{password}"); push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}"); push (@provision_options, "--machinepass=machine$ctx->{password}"); @@ -722,6 +727,7 @@ nogroup:x:65534:nobody DOMAIN => $ctx->{domain}, USERNAME => $ctx->{username}, REALM => $ctx->{realm}, + SAMSID => $ctx->{samsid}, PASSWORD => $ctx->{password}, LDAPDIR => $ctx->{ldapdir}, LDAP_INSTANCE => $ctx->{ldap_instance}, @@ -757,6 +763,10 @@ nogroup:x:65534:nobody $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file}; } + if ($ctx->{server_role} eq "domain controller") { + $ret->{DOMSID} = $ret->{SAMSID}; + } + return $ret; } @@ -872,9 +882,13 @@ sub provision($$$$$$$$$$) $password, $kdc_ipv4, $kdc_ipv6, $extra_smbconf_options, $extra_smbconf_shares, $extra_provision_options) = @_; + my $samsid = Samba::random_domain_sid(); + my $ctx = $self->provision_raw_prepare($prefix, $server_role, $hostname, - $domain, $realm, $functional_level, + $domain, $realm, + $samsid, + $functional_level, $password, $kdc_ipv4, $kdc_ipv6); if (defined($extra_provision_options)) { @@ -1086,6 +1100,7 @@ rpc_server:tcpip = no $ret->{MEMBER_USERNAME} = $ret->{USERNAME}; $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD}; + $ret->{DOMSID} = $dcvars->{DOMSID}; $ret->{DC_SERVER} = $dcvars->{DC_SERVER}; $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP}; $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6}; @@ -1191,6 +1206,7 @@ sub provision_rpc_proxy($$$) $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME}; $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD}; + $ret->{DOMSID} = $dcvars->{DOMSID}; $ret->{DC_SERVER} = $dcvars->{DC_SERVER}; $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP}; $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6}; @@ -1211,6 +1227,7 @@ sub provision_promoted_dc($$$) "promotedvdc", $dcvars->{DOMAIN}, $dcvars->{REALM}, + $dcvars->{SAMSID}, "2008", $dcvars->{PASSWORD}, $dcvars->{SERVER_IP}, @@ -1306,6 +1323,7 @@ sub provision_vampire_dc($$$) $name, $dcvars->{DOMAIN}, $dcvars->{REALM}, + $dcvars->{DOMSID}, $fl, $dcvars->{PASSWORD}, $dcvars->{SERVER_IP}, @@ -1382,10 +1400,12 @@ sub provision_subdom_dc($$$) print "PROVISIONING SUBDOMAIN DC...\n"; # We do this so that we don't run the provision. That's the job of 'net vampire'. + my $samsid = undef; # TODO pass the domain sid all the way down my $ctx = $self->provision_raw_prepare($prefix, "domain controller", "localsubdc", "SAMBASUBDOM", "sub.samba.example.com", + $samsid, "2008", $dcvars->{PASSWORD}, undef); @@ -1653,6 +1673,7 @@ sub provision_rodc($$$) "rodc", $dcvars->{DOMAIN}, $dcvars->{REALM}, + $dcvars->{DOMSID}, "2008", $dcvars->{PASSWORD}, $dcvars->{SERVER_IP}, -- 2.34.1