1 | #!/usr/bin/perl
|
---|
2 | # Bootstrap Samba and run a number of tests against it.
|
---|
3 | # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
|
---|
4 | # Published under the GNU GPL, v3 or later.
|
---|
5 |
|
---|
6 | package Samba4;
|
---|
7 |
|
---|
8 | use strict;
|
---|
9 | use Cwd qw(abs_path);
|
---|
10 | use FindBin qw($RealBin);
|
---|
11 | use POSIX;
|
---|
12 |
|
---|
13 | sub new($$$$$) {
|
---|
14 | my ($classname, $bindir, $ldap, $setupdir, $exeext) = @_;
|
---|
15 | $exeext = "" unless defined($exeext);
|
---|
16 | my $self = {
|
---|
17 | vars => {},
|
---|
18 | ldap => $ldap,
|
---|
19 | bindir => $bindir,
|
---|
20 | setupdir => $setupdir,
|
---|
21 | exeext => $exeext
|
---|
22 | };
|
---|
23 | bless $self;
|
---|
24 | return $self;
|
---|
25 | }
|
---|
26 |
|
---|
27 | sub bindir_path($$) {
|
---|
28 | my ($self, $path) = @_;
|
---|
29 |
|
---|
30 | return "$self->{bindir}/$path$self->{exeext}";
|
---|
31 | }
|
---|
32 |
|
---|
33 | sub openldap_start($$$) {
|
---|
34 | }
|
---|
35 |
|
---|
36 | sub slapd_start($$)
|
---|
37 | {
|
---|
38 | my $count = 0;
|
---|
39 | my ($self, $env_vars) = @_;
|
---|
40 | my $ldbsearch = $self->bindir_path("ldbsearch");
|
---|
41 |
|
---|
42 | my $uri = $env_vars->{LDAP_URI};
|
---|
43 |
|
---|
44 | if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
|
---|
45 | print "A SLAPD is still listening to $uri before we started the LDAP backend. Aborting!";
|
---|
46 | return 1;
|
---|
47 | }
|
---|
48 | # running slapd in the background means it stays in the same process group, so it can be
|
---|
49 | # killed by timelimit
|
---|
50 | if ($self->{ldap} eq "fedora-ds") {
|
---|
51 | system("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd -D $env_vars->{FEDORA_DS_DIR} -d0 -i $env_vars->{FEDORA_DS_PIDFILE}> $env_vars->{LDAPDIR}/logs 2>&1 &");
|
---|
52 | } elsif ($self->{ldap} eq "openldap") {
|
---|
53 | system("$ENV{OPENLDAP_SLAPD} -d0 -F $env_vars->{SLAPD_CONF_D} -h $uri > $env_vars->{LDAPDIR}/logs 2>&1 &");
|
---|
54 | }
|
---|
55 | while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
|
---|
56 | $count++;
|
---|
57 | if ($count > 40) {
|
---|
58 | $self->slapd_stop($env_vars);
|
---|
59 | return 0;
|
---|
60 | }
|
---|
61 | sleep(1);
|
---|
62 | }
|
---|
63 | return 1;
|
---|
64 | }
|
---|
65 |
|
---|
66 | sub slapd_stop($$)
|
---|
67 | {
|
---|
68 | my ($self, $envvars) = @_;
|
---|
69 | if ($self->{ldap} eq "fedora-ds") {
|
---|
70 | system("$envvars->{LDAPDIR}/slapd-samba4/stop-slapd");
|
---|
71 | } elsif ($self->{ldap} eq "openldap") {
|
---|
72 | open(IN, "<$envvars->{OPENLDAP_PIDFILE}") or
|
---|
73 | die("unable to open slapd pid file: $envvars->{OPENLDAP_PIDFILE}");
|
---|
74 | kill 9, <IN>;
|
---|
75 | close(IN);
|
---|
76 | }
|
---|
77 | return 1;
|
---|
78 | }
|
---|
79 |
|
---|
80 | sub check_or_start($$$)
|
---|
81 | {
|
---|
82 | my ($self, $env_vars, $max_time) = @_;
|
---|
83 | return 0 if ( -p $env_vars->{SAMBA_TEST_FIFO});
|
---|
84 |
|
---|
85 | unlink($env_vars->{SAMBA_TEST_FIFO});
|
---|
86 | POSIX::mkfifo($env_vars->{SAMBA_TEST_FIFO}, 0700);
|
---|
87 | unlink($env_vars->{SAMBA_TEST_LOG});
|
---|
88 |
|
---|
89 | print "STARTING SAMBA... ";
|
---|
90 | my $pid = fork();
|
---|
91 | if ($pid == 0) {
|
---|
92 | open STDIN, $env_vars->{SAMBA_TEST_FIFO};
|
---|
93 | # we want out from samba to go to the log file, but also
|
---|
94 | # to the users terminal when running 'make test' on the command
|
---|
95 | # line. This puts it on stderr on the terminal
|
---|
96 | open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
|
---|
97 | open STDERR, '>&STDOUT';
|
---|
98 |
|
---|
99 | SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
|
---|
100 |
|
---|
101 | my $valgrind = "";
|
---|
102 | if (defined($ENV{SAMBA_VALGRIND})) {
|
---|
103 | $valgrind = $ENV{SAMBA_VALGRIND};
|
---|
104 | }
|
---|
105 |
|
---|
106 | $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
|
---|
107 | $ENV{WINBINDD_SOCKET_DIR} = $env_vars->{WINBINDD_SOCKET_DIR};
|
---|
108 |
|
---|
109 | $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
|
---|
110 | $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
|
---|
111 |
|
---|
112 | $ENV{UID_WRAPPER} = "1";
|
---|
113 |
|
---|
114 | # Start slapd before samba, but with the fifo on stdin
|
---|
115 | if (defined($self->{ldap})) {
|
---|
116 | $self->slapd_start($env_vars) or
|
---|
117 | die("couldn't start slapd (main run)");
|
---|
118 | }
|
---|
119 |
|
---|
120 | my $optarg = "";
|
---|
121 | if (defined($max_time)) {
|
---|
122 | $optarg = "--maximum-runtime=$max_time ";
|
---|
123 | }
|
---|
124 | if (defined($ENV{SAMBA_OPTIONS})) {
|
---|
125 | $optarg.= " $ENV{SAMBA_OPTIONS}";
|
---|
126 | }
|
---|
127 | my $samba = $self->bindir_path("samba");
|
---|
128 |
|
---|
129 | # allow selection of the process model using
|
---|
130 | # the environment varibale SAMBA_PROCESS_MODEL
|
---|
131 | # that allows us to change the process model for
|
---|
132 | # individual machines in the build farm
|
---|
133 | my $model = "single";
|
---|
134 | if (defined($ENV{SAMBA_PROCESS_MODEL})) {
|
---|
135 | $model = $ENV{SAMBA_PROCESS_MODEL};
|
---|
136 | }
|
---|
137 | my $ret = system("$valgrind $samba $optarg $env_vars->{CONFIGURATION} -M $model -i");
|
---|
138 | if ($? == -1) {
|
---|
139 | print "Unable to start $samba: $ret: $!\n";
|
---|
140 | exit 1;
|
---|
141 | }
|
---|
142 | unlink($env_vars->{SAMBA_TEST_FIFO});
|
---|
143 | my $exit = $? >> 8;
|
---|
144 | if ( $ret == 0 ) {
|
---|
145 | print "$samba exits with status $exit\n";
|
---|
146 | } elsif ( $ret & 127 ) {
|
---|
147 | print "$samba got signal ".($ret & 127)." and exits with $exit!\n";
|
---|
148 | } else {
|
---|
149 | $ret = $? >> 8;
|
---|
150 | print "$samba failed with status $exit!\n";
|
---|
151 | }
|
---|
152 | exit $exit;
|
---|
153 | }
|
---|
154 | print "DONE\n";
|
---|
155 |
|
---|
156 | open(DATA, ">$env_vars->{SAMBA_TEST_FIFO}");
|
---|
157 |
|
---|
158 | return $pid;
|
---|
159 | }
|
---|
160 |
|
---|
161 | sub wait_for_start($$)
|
---|
162 | {
|
---|
163 | my ($self, $testenv_vars) = @_;
|
---|
164 | # give time for nbt server to register its names
|
---|
165 | print "delaying for nbt name registration\n";
|
---|
166 | sleep 2;
|
---|
167 |
|
---|
168 | # This will return quickly when things are up, but be slow if we
|
---|
169 | # need to wait for (eg) SSL init
|
---|
170 | my $nmblookup = $self->bindir_path("nmblookup");
|
---|
171 | system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
|
---|
172 | system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
|
---|
173 | system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
|
---|
174 | system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
|
---|
175 | system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSALIAS}");
|
---|
176 | system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSALIAS}");
|
---|
177 | system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
|
---|
178 | system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
|
---|
179 | system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
|
---|
180 | system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
|
---|
181 | system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSALIAS}");
|
---|
182 | system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSALIAS}");
|
---|
183 |
|
---|
184 | print $self->getlog_env($testenv_vars);
|
---|
185 | }
|
---|
186 |
|
---|
187 | sub write_ldb_file($$$)
|
---|
188 | {
|
---|
189 | my ($self, $file, $ldif) = @_;
|
---|
190 |
|
---|
191 | my $ldbadd = $self->bindir_path("ldbadd");
|
---|
192 | open(LDIF, "|$ldbadd -H $file >/dev/null");
|
---|
193 | print LDIF $ldif;
|
---|
194 | return close(LDIF);
|
---|
195 | }
|
---|
196 |
|
---|
197 | sub add_wins_config($$)
|
---|
198 | {
|
---|
199 | my ($self, $privatedir) = @_;
|
---|
200 |
|
---|
201 | return $self->write_ldb_file("$privatedir/wins_config.ldb", "
|
---|
202 | dn: name=TORTURE_6,CN=PARTNERS
|
---|
203 | objectClass: wreplPartner
|
---|
204 | name: TORTURE_6
|
---|
205 | address: 127.0.0.6
|
---|
206 | pullInterval: 0
|
---|
207 | pushChangeCount: 0
|
---|
208 | type: 0x3
|
---|
209 | ");
|
---|
210 | }
|
---|
211 |
|
---|
212 | sub mk_fedora_ds($$)
|
---|
213 | {
|
---|
214 | my ($self, $ldapdir) = @_;
|
---|
215 |
|
---|
216 | #Make the subdirectory be as fedora DS would expect
|
---|
217 | my $fedora_ds_dir = "$ldapdir/slapd-samba4";
|
---|
218 |
|
---|
219 | my $pidfile = "$fedora_ds_dir/logs/slapd-samba4.pid";
|
---|
220 |
|
---|
221 | return ($fedora_ds_dir, $pidfile);
|
---|
222 | }
|
---|
223 |
|
---|
224 | sub mk_openldap($$)
|
---|
225 | {
|
---|
226 | my ($self, $ldapdir) = @_;
|
---|
227 |
|
---|
228 | my $slapd_conf_d = "$ldapdir/slapd.d";
|
---|
229 | my $pidfile = "$ldapdir/slapd.pid";
|
---|
230 |
|
---|
231 | return ($slapd_conf_d, $pidfile);
|
---|
232 | }
|
---|
233 |
|
---|
234 | sub mk_keyblobs($$)
|
---|
235 | {
|
---|
236 | my ($self, $tlsdir) = @_;
|
---|
237 |
|
---|
238 | #TLS and PKINIT crypto blobs
|
---|
239 | my $dhfile = "$tlsdir/dhparms.pem";
|
---|
240 | my $cafile = "$tlsdir/ca.pem";
|
---|
241 | my $certfile = "$tlsdir/cert.pem";
|
---|
242 | my $reqkdc = "$tlsdir/req-kdc.der";
|
---|
243 | my $kdccertfile = "$tlsdir/kdc.pem";
|
---|
244 | my $keyfile = "$tlsdir/key.pem";
|
---|
245 | my $adminkeyfile = "$tlsdir/adminkey.pem";
|
---|
246 | my $reqadmin = "$tlsdir/req-admin.der";
|
---|
247 | my $admincertfile = "$tlsdir/admincert.pem";
|
---|
248 | my $admincertupnfile = "$tlsdir/admincertupn.pem";
|
---|
249 |
|
---|
250 | mkdir($tlsdir, 0777);
|
---|
251 |
|
---|
252 | #This is specified here to avoid draining entropy on every run
|
---|
253 | open(DHFILE, ">$dhfile");
|
---|
254 | print DHFILE <<EOF;
|
---|
255 | -----BEGIN DH PARAMETERS-----
|
---|
256 | MGYCYQC/eWD2xkb7uELmqLi+ygPMKyVcpHUo2yCluwnbPutEueuxrG/Cys8j8wLO
|
---|
257 | svCN/jYNyR2NszOmg7ZWcOC/4z/4pWDVPUZr8qrkhj5MRKJc52MncfaDglvEdJrv
|
---|
258 | YX70obsCAQI=
|
---|
259 | -----END DH PARAMETERS-----
|
---|
260 | EOF
|
---|
261 | close(DHFILE);
|
---|
262 |
|
---|
263 | #Likewise, we pregenerate the key material. This allows the
|
---|
264 | #other certificates to be pre-generated
|
---|
265 | open(KEYFILE, ">$keyfile");
|
---|
266 | print KEYFILE <<EOF;
|
---|
267 | -----BEGIN RSA PRIVATE KEY-----
|
---|
268 | MIICXQIBAAKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpc
|
---|
269 | ol3+S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H
|
---|
270 | 6H+pPqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQAB
|
---|
271 | AoGAAqDLzFRR/BF1kpsiUfL4WFvTarCe9duhwj7ORc6fs785qAXuwUYAJ0Uvzmy6
|
---|
272 | HqoGv3t3RfmeHDmjcpPHsbOKnsOQn2MgmthidQlPBMWtQMff5zdoYNUFiPS0XQBq
|
---|
273 | szNW4PRjaA9KkLQVTwnzdXGkBSkn/nGxkaVu7OR3vJOBoo0CQQDO4upypesnbe6p
|
---|
274 | 9/xqfZ2uim8IwV1fLlFClV7WlCaER8tsQF4lEi0XSzRdXGUD/dilpY88Nb+xok/X
|
---|
275 | 8Z8OvgAXAkEA+pcLsx1gN7kxnARxv54jdzQjC31uesJgMKQXjJ0h75aUZwTNHmZQ
|
---|
276 | vPxi6u62YiObrN5oivkixwFNncT9MxTxVQJBAMaWUm2SjlLe10UX4Zdm1MEB6OsC
|
---|
277 | kVoX37CGKO7YbtBzCfTzJGt5Mwc1DSLA2cYnGJqIfSFShptALlwedot0HikCQAJu
|
---|
278 | jNKEKnbf+TdGY8Q0SKvTebOW2Aeg80YFkaTvsXCdyXrmdQcifw4WdO9KucJiDhSz
|
---|
279 | Y9hVapz7ykEJtFtWjLECQQDIlfc63I5ZpXfg4/nN4IJXUW6AmPVOYIA5215itgki
|
---|
280 | cSlMYli1H9MEXH0pQMGv5Qyd0OYIx2DDg96mZ+aFvqSG
|
---|
281 | -----END RSA PRIVATE KEY-----
|
---|
282 | EOF
|
---|
283 | close(KEYFILE);
|
---|
284 |
|
---|
285 | open(ADMINKEYFILE, ">$adminkeyfile");
|
---|
286 |
|
---|
287 | print ADMINKEYFILE <<EOF;
|
---|
288 | -----BEGIN RSA PRIVATE KEY-----
|
---|
289 | MIICXQIBAAKBgQD0+OL7TQBj0RejbIH1+g5GeRaWaM9xF43uE5y7jUHEsi5owhZF
|
---|
290 | 5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMFxB6esnXhl0Jpip1JkUMM
|
---|
291 | XLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xdl3JRlwIDAQAB
|
---|
292 | AoGAP8mjCP628Ebc2eACQzOWjgEvwYCPK4qPmYOf1zJkArzG2t5XAGJ5WGrENRuB
|
---|
293 | cm3XFh1lpmaADl982UdW3gul4gXUy6w4XjKK4vVfhyHj0kZ/LgaXUK9BAGhroJ2L
|
---|
294 | osIOUsaC6jdx9EwSRctwdlF3wWJ8NK0g28AkvIk+FlolW4ECQQD7w5ouCDnf58CN
|
---|
295 | u4nARx4xv5XJXekBvOomkCQAmuOsdOb6b9wn3mm2E3au9fueITjb3soMR31AF6O4
|
---|
296 | eAY126rXAkEA+RgHzybzZEP8jCuznMqoN2fq/Vrs6+W3M8/G9mzGEMgLLpaf2Jiz
|
---|
297 | I9tLZ0+OFk9tkRaoCHPfUOCrVWJZ7Y53QQJBAMhoA6rw0WDyUcyApD5yXg6rusf4
|
---|
298 | ASpo/tqDkqUIpoL464Qe1tjFqtBM3gSXuhs9xsz+o0bzATirmJ+WqxrkKTECQHt2
|
---|
299 | OLCpKqwAspU7N+w32kaUADoRLisCEdrhWklbwpQgwsIVsCaoEOpt0CLloJRYTANE
|
---|
300 | yoZeAErTALjyZYZEPcECQQDlUi0N8DFxQ/lOwWyR3Hailft+mPqoPCa8QHlQZnlG
|
---|
301 | +cfgNl57YHMTZFwgUVFRdJNpjH/WdZ5QxDcIVli0q+Ko
|
---|
302 | -----END RSA PRIVATE KEY-----
|
---|
303 | EOF
|
---|
304 |
|
---|
305 | #generated with
|
---|
306 | # hxtool issue-certificate --self-signed --issue-ca \
|
---|
307 | # --ca-private-key="FILE:$KEYFILE" \
|
---|
308 | # --subject="CN=CA,DC=samba,DC=example,DC=com" \
|
---|
309 | # --certificate="FILE:$CAFILE" --lifetime="25 years"
|
---|
310 |
|
---|
311 | open(CAFILE, ">$cafile");
|
---|
312 | print CAFILE <<EOF;
|
---|
313 | -----BEGIN CERTIFICATE-----
|
---|
314 | MIICcTCCAdqgAwIBAgIUaBPmjnPVqyFqR5foICmLmikJTzgwCwYJKoZIhvcNAQEFMFIxEzAR
|
---|
315 | BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
|
---|
316 | LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDgwMzAxMTIyMzEyWhgPMjAzMzAyMjQx
|
---|
317 | MjIzMTJaMFIxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
|
---|
318 | MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMIGfMA0GCSqGSIb3DQEBAQUA
|
---|
319 | A4GNADCBiQKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+S9/6
|
---|
320 | I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+pPqVIRLOmrWIm
|
---|
321 | ai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABo0IwQDAOBgNVHQ8BAf8EBAMC
|
---|
322 | AaYwHQYDVR0OBBYEFMLZufegDKLZs0VOyFXYK1L6M8oyMA8GA1UdEwEB/wQFMAMBAf8wDQYJ
|
---|
323 | KoZIhvcNAQEFBQADgYEAAZJbCAAkaqgFJ0xgNovn8Ydd0KswQPjicwiODPgw9ZPoD2HiOUVO
|
---|
324 | yYDRg/dhFF9y656OpcHk4N7qZ2sl3RlHkzDu+dseETW+CnKvQIoXNyeARRJSsSlwrwcoD4JR
|
---|
325 | HTLk2sGigsWwrJ2N99sG/cqSJLJ1MFwLrs6koweBnYU0f/g=
|
---|
326 | -----END CERTIFICATE-----
|
---|
327 | EOF
|
---|
328 |
|
---|
329 | #generated with GNUTLS internally in Samba.
|
---|
330 |
|
---|
331 | open(CERTFILE, ">$certfile");
|
---|
332 | print CERTFILE <<EOF;
|
---|
333 | -----BEGIN CERTIFICATE-----
|
---|
334 | MIICYTCCAcygAwIBAgIE5M7SRDALBgkqhkiG9w0BAQUwZTEdMBsGA1UEChMUU2Ft
|
---|
335 | YmEgQWRtaW5pc3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1
|
---|
336 | dG9nZW5lcmF0ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMB4XDTA2MDgw
|
---|
337 | NDA0MzY1MloXDTA4MDcwNDA0MzY1MlowZTEdMBsGA1UEChMUU2FtYmEgQWRtaW5p
|
---|
338 | c3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1dG9nZW5lcmF0
|
---|
339 | ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMIGcMAsGCSqGSIb3DQEBAQOB
|
---|
340 | jAAwgYgCgYDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+
|
---|
341 | S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+p
|
---|
342 | PqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABoyUw
|
---|
343 | IzAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGCSqGSIb3DQEB
|
---|
344 | BQOBgQAmkN6XxvDnoMkGcWLCTwzxGfNNSVcYr7TtL2aJh285Xw9zaxcm/SAZBFyG
|
---|
345 | LYOChvh6hPU7joMdDwGfbiLrBnMag+BtGlmPLWwp/Kt1wNmrRhduyTQFhN3PP6fz
|
---|
346 | nBr9vVny2FewB2gHmelaPS//tXdxivSXKz3NFqqXLDJjq7P8wA==
|
---|
347 | -----END CERTIFICATE-----
|
---|
348 | EOF
|
---|
349 | close(CERTFILE);
|
---|
350 |
|
---|
351 | #KDC certificate
|
---|
352 | # hxtool request-create \
|
---|
353 | # --subject="CN=krbtgt,CN=users,DC=samba,DC=example,DC=com" \
|
---|
354 | # --key="FILE:$KEYFILE" $KDCREQ
|
---|
355 |
|
---|
356 | # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
|
---|
357 | # --type="pkinit-kdc" \
|
---|
358 | # --pk-init-principal="krbtgt/SAMBA.EXAMPLE.COM@SAMBA.EXAMPLE.COM" \
|
---|
359 | # --req="PKCS10:$KDCREQ" --certificate="FILE:$KDCCERTFILE" \
|
---|
360 | # --lifetime="25 years"
|
---|
361 |
|
---|
362 | open(KDCCERTFILE, ">$kdccertfile");
|
---|
363 | print KDCCERTFILE <<EOF;
|
---|
364 | -----BEGIN CERTIFICATE-----
|
---|
365 | MIIDDDCCAnWgAwIBAgIUI2Tzj+JnMzMcdeabcNo30rovzFAwCwYJKoZIhvcNAQEFMFIxEzAR
|
---|
366 | BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
|
---|
367 | LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDgwMzAxMTMxOTIzWhgPMjAzMzAyMjQx
|
---|
368 | MzE5MjNaMGYxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
|
---|
369 | MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMQ8wDQYDVQQDDAZrcmJ0
|
---|
370 | Z3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMqDqkDAIdQwDUN8cOZaFl934XQL70nF
|
---|
371 | yq+nD2KL0SfcTW5+WlyiXf5L3/oj+5pOYkdmt74MXd1PNv9Q5mjRl6bw34jPOSCgaQVp+Ne5
|
---|
372 | PcEvlQ9jb8fof6k+pUhEs6atYiZqLfn1jKgqEXKjftjoc95TxBxn67atL2B5qkhZ966jAgMB
|
---|
373 | AAGjgcgwgcUwDgYDVR0PAQH/BAQDAgWgMBIGA1UdJQQLMAkGBysGAQUCAwUwVAYDVR0RBE0w
|
---|
374 | S6BJBgYrBgEFAgKgPzA9oBMbEVNBTUJBLkVYQU1QTEUuQ09NoSYwJKADAgEBoR0wGxsGa3Ji
|
---|
375 | dGd0GxFTQU1CQS5FWEFNUExFLkNPTTAfBgNVHSMEGDAWgBTC2bn3oAyi2bNFTshV2CtS+jPK
|
---|
376 | MjAdBgNVHQ4EFgQUwtm596AMotmzRU7IVdgrUvozyjIwCQYDVR0TBAIwADANBgkqhkiG9w0B
|
---|
377 | AQUFAAOBgQBmrVD5MCmZjfHp1nEnHqTIh8r7lSmVtDx4s9MMjxm9oNrzbKXynvdhwQYFVarc
|
---|
378 | ge4yRRDXtSebErOl71zVJI9CVeQQpwcH+tA85oGA7oeFtO/S7ls581RUU6tGgyxV4veD+lJv
|
---|
379 | KPH5LevUtgD+q9H4LU4Sq5N3iFwBaeryB0g2wg==
|
---|
380 | -----END CERTIFICATE-----
|
---|
381 | EOF
|
---|
382 |
|
---|
383 | # hxtool request-create \
|
---|
384 | # --subject="CN=Administrator,CN=users,DC=samba,DC=example,DC=com" \
|
---|
385 | # --key="FILE:$ADMINKEYFILE" $ADMINREQFILE
|
---|
386 |
|
---|
387 | # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
|
---|
388 | # --type="pkinit-client" \
|
---|
389 | # --pk-init-principal="administrator@SAMBA.EXAMPLE.COM" \
|
---|
390 | # --req="PKCS10:$ADMINREQFILE" --certificate="FILE:$ADMINCERTFILE" \
|
---|
391 | # --lifetime="25 years"
|
---|
392 |
|
---|
393 | open(ADMINCERTFILE, ">$admincertfile");
|
---|
394 | print ADMINCERTFILE <<EOF;
|
---|
395 | -----BEGIN CERTIFICATE-----
|
---|
396 | MIIDHTCCAoagAwIBAgIUUggzW4lLRkMKe1DAR2NKatkMDYwwCwYJKoZIhvcNAQELMFIxEzAR
|
---|
397 | BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
|
---|
398 | LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDkwNzI3MDMzMjE1WhgPMjAzNDA3MjIw
|
---|
399 | MzMyMTVaMG0xEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
|
---|
400 | MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMRYwFAYDVQQDDA1BZG1p
|
---|
401 | bmlzdHJhdG9yMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0+OL7TQBj0RejbIH1+g5G
|
---|
402 | eRaWaM9xF43uE5y7jUHEsi5owhZF5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMF
|
---|
403 | xB6esnXhl0Jpip1JkUMMXLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xd
|
---|
404 | l3JRlwIDAQABo4HSMIHPMA4GA1UdDwEB/wQEAwIFoDAoBgNVHSUEITAfBgcrBgEFAgMEBggr
|
---|
405 | BgEFBQcDAgYKKwYBBAGCNxQCAjBIBgNVHREEQTA/oD0GBisGAQUCAqAzMDGgExsRU0FNQkEu
|
---|
406 | RVhBTVBMRS5DT02hGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yMB8GA1UdIwQYMBaAFMLZ
|
---|
407 | ufegDKLZs0VOyFXYK1L6M8oyMB0GA1UdDgQWBBQg81bLyfCA88C2B/BDjXlGuaFaxjAJBgNV
|
---|
408 | HRMEAjAAMA0GCSqGSIb3DQEBCwUAA4GBAEf/OSHUDJaGdtWGNuJeqcVYVMwrfBAc0OSwVhz1
|
---|
409 | 7/xqKHWo8wIMPkYRtaRHKLNDsF8GkhQPCpVsa6mX/Nt7YQnNvwd+1SBP5E8GvwWw9ZzLJvma
|
---|
410 | nk2n89emuayLpVtp00PymrDLRBcNaRjFReQU8f0o509kiVPHduAp3jOiy13l
|
---|
411 | -----END CERTIFICATE-----
|
---|
412 | EOF
|
---|
413 | close(ADMINCERTFILE);
|
---|
414 |
|
---|
415 | # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
|
---|
416 | # --type="pkinit-client" \
|
---|
417 | # --ms-upn="administrator@samba.example.com" \
|
---|
418 | # --req="PKCS10:$ADMINREQFILE" --certificate="FILE:$ADMINCERTUPNFILE" \
|
---|
419 | # --lifetime="25 years"
|
---|
420 |
|
---|
421 | open(ADMINCERTUPNFILE, ">$admincertupnfile");
|
---|
422 | print ADMINCERTUPNFILE <<EOF;
|
---|
423 | -----BEGIN CERTIFICATE-----
|
---|
424 | MIIDDzCCAnigAwIBAgIUUp3CJMuNaEaAdPKp3QdNIwG7a4wwCwYJKoZIhvcNAQELMFIxEzAR
|
---|
425 | BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
|
---|
426 | LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDkwNzI3MDMzMzA1WhgPMjAzNDA3MjIw
|
---|
427 | MzMzMDVaMG0xEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
|
---|
428 | MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMRYwFAYDVQQDDA1BZG1p
|
---|
429 | bmlzdHJhdG9yMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0+OL7TQBj0RejbIH1+g5G
|
---|
430 | eRaWaM9xF43uE5y7jUHEsi5owhZF5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMF
|
---|
431 | xB6esnXhl0Jpip1JkUMMXLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xd
|
---|
432 | l3JRlwIDAQABo4HEMIHBMA4GA1UdDwEB/wQEAwIFoDAoBgNVHSUEITAfBgcrBgEFAgMEBggr
|
---|
433 | BgEFBQcDAgYKKwYBBAGCNxQCAjA6BgNVHREEMzAxoC8GCisGAQQBgjcUAgOgIQwfYWRtaW5p
|
---|
434 | c3RyYXRvckBzYW1iYS5leGFtcGxlLmNvbTAfBgNVHSMEGDAWgBTC2bn3oAyi2bNFTshV2CtS
|
---|
435 | +jPKMjAdBgNVHQ4EFgQUIPNWy8nwgPPAtgfwQ415RrmhWsYwCQYDVR0TBAIwADANBgkqhkiG
|
---|
436 | 9w0BAQsFAAOBgQBk42+egeUB3Ji2PC55fbt3FNKxvmm2xUUFkV9POK/YR9rajKOwk5jtYSeS
|
---|
437 | Zd7J9s//rNFNa7waklFkDaY56+QWTFtdvxfE+KoHaqt6X8u6pqi7p3M4wDKQox+9Dx8yWFyq
|
---|
438 | Wfz/8alZ5aMezCQzXJyIaJsCLeKABosSwHcpAFmxlQ==
|
---|
439 | -----END CERTIFICATE-----
|
---|
440 | EOF
|
---|
441 | }
|
---|
442 |
|
---|
443 | #
|
---|
444 | # provision_raw_prepare() is also used by Samba34.pm!
|
---|
445 | #
|
---|
446 | sub provision_raw_prepare($$$$$$$)
|
---|
447 | {
|
---|
448 | my ($self, $prefix, $server_role, $netbiosname, $netbiosalias, $swiface, $password, $kdc_ipv4) = @_;
|
---|
449 | my $ctx;
|
---|
450 |
|
---|
451 | -d $prefix or mkdir($prefix, 0777) or die("Unable to create $prefix");
|
---|
452 | my $prefix_abs = abs_path($prefix);
|
---|
453 |
|
---|
454 | die ("prefix=''") if $prefix_abs eq "";
|
---|
455 | die ("prefix='/'") if $prefix_abs eq "/";
|
---|
456 |
|
---|
457 | (system("rm -rf $prefix_abs/*") == 0) or die("Unable to clean up");
|
---|
458 |
|
---|
459 | $ctx->{prefix} = $prefix;
|
---|
460 | $ctx->{prefix_abs} = $prefix_abs;
|
---|
461 | $ctx->{server_role} = $server_role;
|
---|
462 | $ctx->{netbiosname} = $netbiosname;
|
---|
463 | $ctx->{netbiosalias} = $netbiosalias;
|
---|
464 | $ctx->{swiface} = $swiface;
|
---|
465 | $ctx->{password} = $password;
|
---|
466 | $ctx->{kdc_ipv4} = $kdc_ipv4;
|
---|
467 |
|
---|
468 | $ctx->{server_loglevel} = 1;
|
---|
469 | $ctx->{username} = "Administrator";
|
---|
470 | $ctx->{domain} = "SAMBADOMAIN";
|
---|
471 | $ctx->{realm} = "SAMBA.EXAMPLE.COM";
|
---|
472 | $ctx->{dnsname} = "samba.example.com";
|
---|
473 | $ctx->{basedn} = "dc=samba,dc=example,dc=com";
|
---|
474 |
|
---|
475 | my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
|
---|
476 | chomp $unix_name;
|
---|
477 | $ctx->{unix_name} = $unix_name;
|
---|
478 | $ctx->{unix_uid} = $>;
|
---|
479 | $ctx->{unix_gids_str} = $);
|
---|
480 | @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
|
---|
481 |
|
---|
482 | $ctx->{etcdir} = "$prefix_abs/etc";
|
---|
483 | $ctx->{piddir} = "$prefix_abs/pid";
|
---|
484 | $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
|
---|
485 | $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
|
---|
486 | $ctx->{privatedir} = "$prefix_abs/private";
|
---|
487 | $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
|
---|
488 | $ctx->{lockdir} = "$prefix_abs/lockdir";
|
---|
489 | $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
|
---|
490 | $ctx->{winbindd_privileged_socket_dir} = "$prefix_abs/winbindd_privileged_socket";
|
---|
491 | $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
|
---|
492 | $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
|
---|
493 | $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
|
---|
494 |
|
---|
495 | $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
|
---|
496 |
|
---|
497 | $ctx->{ipv4} = "127.0.0.$swiface";
|
---|
498 | $ctx->{interfaces} = "$ctx->{ipv4}/8";
|
---|
499 |
|
---|
500 | $ctx->{localbasedn} = $ctx->{basedn};
|
---|
501 | $ctx->{localbasedn} = "CN=$netbiosname" if $server_role eq "member server";
|
---|
502 |
|
---|
503 | push(@{$ctx->{directories}}, $ctx->{privatedir});
|
---|
504 | push(@{$ctx->{directories}}, $ctx->{etcdir});
|
---|
505 | push(@{$ctx->{directories}}, $ctx->{piddir});
|
---|
506 | push(@{$ctx->{directories}}, $ctx->{ncalrpcdir});
|
---|
507 | push(@{$ctx->{directories}}, $ctx->{lockdir});
|
---|
508 |
|
---|
509 | $ctx->{smb_conf_extra_options} = "";
|
---|
510 |
|
---|
511 | my @provision_options = ();
|
---|
512 | push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
|
---|
513 | push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
|
---|
514 | if (defined($ENV{GDB_PROVISION})) {
|
---|
515 | push (@provision_options, "gdb --args");
|
---|
516 | }
|
---|
517 | if (defined($ENV{VALGRIND_PROVISION})) {
|
---|
518 | push (@provision_options, "valgrind");
|
---|
519 | }
|
---|
520 | if (defined($ENV{PYTHON})) {
|
---|
521 | push (@provision_options, $ENV{PYTHON});
|
---|
522 | }
|
---|
523 | push (@provision_options, "$self->{setupdir}/provision");
|
---|
524 | push (@provision_options, "--configfile=$ctx->{smb_conf}");
|
---|
525 | push (@provision_options, "--host-name=$ctx->{netbiosname}");
|
---|
526 | push (@provision_options, "--host-ip=$ctx->{ipv4}");
|
---|
527 | push (@provision_options, "--quiet");
|
---|
528 | push (@provision_options, "--domain=$ctx->{domain}");
|
---|
529 | push (@provision_options, "--realm=$ctx->{realm}");
|
---|
530 | push (@provision_options, "--adminpass=$ctx->{password}");
|
---|
531 | push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
|
---|
532 | push (@provision_options, "--machinepass=machine$ctx->{password}");
|
---|
533 | push (@provision_options, "--root=$ctx->{unix_name}");
|
---|
534 | push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
|
---|
535 |
|
---|
536 | @{$ctx->{provision_options}} = @provision_options;
|
---|
537 |
|
---|
538 | return $ctx;
|
---|
539 | }
|
---|
540 |
|
---|
541 | #
|
---|
542 | # provision_raw_step1() is also used by Samba34.pm!
|
---|
543 | #
|
---|
544 | # Step1 creates the basic configuration
|
---|
545 | #
|
---|
546 | sub provision_raw_step1($$)
|
---|
547 | {
|
---|
548 | my ($self, $ctx) = @_;
|
---|
549 |
|
---|
550 | mkdir($_, 0777) foreach (@{$ctx->{directories}});
|
---|
551 |
|
---|
552 | open(CONFFILE, ">$ctx->{smb_conf}")
|
---|
553 | or die("can't open $ctx->{smb_conf}$?");
|
---|
554 | print CONFFILE "
|
---|
555 | [global]
|
---|
556 | netbios name = $ctx->{netbiosname}
|
---|
557 | netbios aliases = $ctx->{netbiosalias}
|
---|
558 | workgroup = $ctx->{domain}
|
---|
559 | realm = $ctx->{realm}
|
---|
560 | private dir = $ctx->{privatedir}
|
---|
561 | pid directory = $ctx->{piddir}
|
---|
562 | ncalrpc dir = $ctx->{ncalrpcdir}
|
---|
563 | lock dir = $ctx->{lockdir}
|
---|
564 | setup directory = $self->{setupdir}
|
---|
565 | modules dir = $self->{bindir}/modules
|
---|
566 | winbindd socket directory = $ctx->{winbindd_socket_dir}
|
---|
567 | winbindd privileged socket directory = $ctx->{winbindd_privileged_socket_dir}
|
---|
568 | ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
|
---|
569 | winbind separator = /
|
---|
570 | name resolve order = bcast
|
---|
571 | interfaces = $ctx->{interfaces}
|
---|
572 | tls dh params file = $ctx->{tlsdir}/dhparms.pem
|
---|
573 | panic action = $RealBin/gdb_backtrace \%PID% \%PROG%
|
---|
574 | wins support = yes
|
---|
575 | server role = $ctx->{server_role}
|
---|
576 | notify:inotify = false
|
---|
577 | ldb:nosync = true
|
---|
578 | #We don't want to pass our self-tests if the PAC code is wrong
|
---|
579 | gensec:require_pac = true
|
---|
580 | log level = $ctx->{server_loglevel}
|
---|
581 | lanman auth = Yes
|
---|
582 |
|
---|
583 | # Begin extra options
|
---|
584 | $ctx->{smb_conf_extra_options}
|
---|
585 | # End extra options
|
---|
586 | ";
|
---|
587 | close(CONFFILE);
|
---|
588 |
|
---|
589 | $self->mk_keyblobs($ctx->{tlsdir});
|
---|
590 |
|
---|
591 | open(KRB5CONF, ">$ctx->{krb5_conf}")
|
---|
592 | or die("can't open $ctx->{krb5_conf}$?");
|
---|
593 | print KRB5CONF "
|
---|
594 | #Generated krb5.conf for $ctx->{realm}
|
---|
595 |
|
---|
596 | [libdefaults]
|
---|
597 | default_realm = $ctx->{realm}
|
---|
598 | dns_lookup_realm = false
|
---|
599 | dns_lookup_kdc = false
|
---|
600 | ticket_lifetime = 24h
|
---|
601 | forwardable = yes
|
---|
602 |
|
---|
603 | [realms]
|
---|
604 | $ctx->{realm} = {
|
---|
605 | kdc = $ctx->{kdc_ipv4}:88
|
---|
606 | admin_server = $ctx->{kdc_ipv4}:88
|
---|
607 | default_domain = $ctx->{dnsname}
|
---|
608 | }
|
---|
609 | $ctx->{dnsname} = {
|
---|
610 | kdc = $ctx->{kdc_ipv4}:88
|
---|
611 | admin_server = $ctx->{kdc_ipv4}:88
|
---|
612 | default_domain = $ctx->{dnsname}
|
---|
613 | }
|
---|
614 | $ctx->{domain} = {
|
---|
615 | kdc = $ctx->{kdc_ipv4}:88
|
---|
616 | admin_server = $ctx->{kdc_ipv4}:88
|
---|
617 | default_domain = $ctx->{dnsname}
|
---|
618 | }
|
---|
619 |
|
---|
620 | [appdefaults]
|
---|
621 | pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
|
---|
622 |
|
---|
623 | [kdc]
|
---|
624 | enable-pkinit = true
|
---|
625 | pkinit_identity = FILE:$ctx->{tlsdir}/kdc.pem,$ctx->{tlsdir}/key.pem
|
---|
626 | pkinit_anchors = FILE:$ctx->{tlsdir}/ca.pem
|
---|
627 |
|
---|
628 | [domain_realm]
|
---|
629 | .$ctx->{dnsname} = $ctx->{realm}
|
---|
630 | ";
|
---|
631 | close(KRB5CONF);
|
---|
632 |
|
---|
633 | open(PWD, ">$ctx->{nsswrap_passwd}");
|
---|
634 | print PWD "
|
---|
635 | root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false
|
---|
636 | $ctx->{unix_name}:x:$ctx->{unix_uid}:@{$ctx->{unix_gids}}[0]:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false
|
---|
637 | nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
|
---|
638 | ";
|
---|
639 | close(PWD);
|
---|
640 |
|
---|
641 | open(GRP, ">$ctx->{nsswrap_group}");
|
---|
642 | print GRP "
|
---|
643 | root:x:0:
|
---|
644 | wheel:x:10:
|
---|
645 | users:x:100:
|
---|
646 | nobody:x:65533:
|
---|
647 | nogroup:x:65534:nobody
|
---|
648 | ";
|
---|
649 | close(GRP);
|
---|
650 |
|
---|
651 | my $configuration = "--configfile=$ctx->{smb_conf}";
|
---|
652 |
|
---|
653 | #Ensure the config file is valid before we start
|
---|
654 | my $testparm = $self->bindir_path("testparm");
|
---|
655 | if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
|
---|
656 | system("$testparm -v --suppress-prompt $configuration >&2");
|
---|
657 | die("Failed to create a valid smb.conf configuration $testparm!");
|
---|
658 | }
|
---|
659 |
|
---|
660 | (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) or die("Failed to create a valid smb.conf configuration! $self->{bindir}/testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
|
---|
661 |
|
---|
662 | my $ret = {
|
---|
663 | KRB5_CONFIG => $ctx->{krb5_conf},
|
---|
664 | PIDDIR => $ctx->{piddir},
|
---|
665 | SERVER => $ctx->{netbiosname},
|
---|
666 | SERVER_IP => $ctx->{ipv4},
|
---|
667 | NETBIOSNAME => $ctx->{netbiosname},
|
---|
668 | NETBIOSALIAS => $ctx->{netbiosalias},
|
---|
669 | DOMAIN => $ctx->{domain},
|
---|
670 | USERNAME => $ctx->{username},
|
---|
671 | REALM => $ctx->{realm},
|
---|
672 | PASSWORD => $ctx->{password},
|
---|
673 | LDAPDIR => $ctx->{ldapdir},
|
---|
674 | WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
|
---|
675 | NCALRPCDIR => $ctx->{ncalrpcdir},
|
---|
676 | LOCKDIR => $ctx->{lockdir},
|
---|
677 | SERVERCONFFILE => $ctx->{smb_conf},
|
---|
678 | CONFIGURATION => $configuration,
|
---|
679 | SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
|
---|
680 | NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
|
---|
681 | NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
|
---|
682 | SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
|
---|
683 | SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
|
---|
684 | SAMBA_TEST_LOG_POS => 0,
|
---|
685 | };
|
---|
686 |
|
---|
687 | return $ret;
|
---|
688 | }
|
---|
689 |
|
---|
690 | #
|
---|
691 | # provision_raw_step2() is also used by Samba34.pm!
|
---|
692 | #
|
---|
693 | # Step2 runs the provision script
|
---|
694 | #
|
---|
695 | sub provision_raw_step2($$$)
|
---|
696 | {
|
---|
697 | my ($self, $ctx, $ret) = @_;
|
---|
698 |
|
---|
699 | my $provision_cmd = join(" ", @{$ctx->{provision_options}});
|
---|
700 | (system($provision_cmd) == 0) or die("Unable to provision: \n$provision_cmd\n");
|
---|
701 |
|
---|
702 | return $ret;
|
---|
703 | }
|
---|
704 |
|
---|
705 | sub provision($$$$$$$)
|
---|
706 | {
|
---|
707 | my ($self, $prefix, $server_role, $netbiosname, $netbiosalias, $swiface, $password, $kdc_ipv4) = @_;
|
---|
708 |
|
---|
709 | my $ctx = $self->provision_raw_prepare($prefix, $server_role,
|
---|
710 | $netbiosname, $netbiosalias,
|
---|
711 | $swiface, $password, $kdc_ipv4);
|
---|
712 |
|
---|
713 | $ctx->{tmpdir} = "$ctx->{prefix_abs}/tmp";
|
---|
714 | push(@{$ctx->{directories}}, "$ctx->{tmpdir}");
|
---|
715 | push(@{$ctx->{directories}}, "$ctx->{tmpdir}/test1");
|
---|
716 | push(@{$ctx->{directories}}, "$ctx->{tmpdir}/test2");
|
---|
717 |
|
---|
718 | $ctx->{smb_conf_extra_options} = "
|
---|
719 |
|
---|
720 | max xmit = 32K
|
---|
721 | server max protocol = SMB2
|
---|
722 |
|
---|
723 | [tmp]
|
---|
724 | path = $ctx->{tmpdir}
|
---|
725 | read only = no
|
---|
726 | posix:sharedelay = 100000
|
---|
727 | posix:eadb = $ctx->{lockdir}/eadb.tdb
|
---|
728 | posix:oplocktimeout = 3
|
---|
729 | posix:writetimeupdatedelay = 500000
|
---|
730 |
|
---|
731 | [test1]
|
---|
732 | path = $ctx->{tmpdir}/test1
|
---|
733 | read only = no
|
---|
734 | posix:sharedelay = 100000
|
---|
735 | posix:eadb = $ctx->{lockdir}/eadb.tdb
|
---|
736 | posix:oplocktimeout = 3
|
---|
737 | posix:writetimeupdatedelay = 500000
|
---|
738 |
|
---|
739 | [test2]
|
---|
740 | path = $ctx->{tmpdir}/test2
|
---|
741 | read only = no
|
---|
742 | posix:sharedelay = 100000
|
---|
743 | posix:eadb = $ctx->{lockdir}/eadb.tdb
|
---|
744 | posix:oplocktimeout = 3
|
---|
745 | posix:writetimeupdatedelay = 500000
|
---|
746 |
|
---|
747 | [cifs]
|
---|
748 | read only = no
|
---|
749 | ntvfs handler = cifs
|
---|
750 | cifs:server = $ctx->{netbiosname}
|
---|
751 | cifs:share = tmp
|
---|
752 | #There is no username specified here, instead the client is expected
|
---|
753 | #to log in with kerberos, and the serverwill use delegated credentials.
|
---|
754 |
|
---|
755 | [simple]
|
---|
756 | path = $ctx->{tmpdir}
|
---|
757 | read only = no
|
---|
758 | ntvfs handler = simple
|
---|
759 |
|
---|
760 | [sysvol]
|
---|
761 | path = $ctx->{lockdir}/sysvol
|
---|
762 | read only = yes
|
---|
763 |
|
---|
764 | [netlogon]
|
---|
765 | path = $ctx->{lockdir}/sysvol/$ctx->{dnsname}/scripts
|
---|
766 | read only = no
|
---|
767 |
|
---|
768 | [cifsposix]
|
---|
769 | copy = simple
|
---|
770 | ntvfs handler = cifsposix
|
---|
771 | ";
|
---|
772 |
|
---|
773 | if (defined($self->{ldap})) {
|
---|
774 | $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
|
---|
775 | push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
|
---|
776 |
|
---|
777 | my $ldap_uri= "$ctx->{ldapdir}/ldapi";
|
---|
778 | $ldap_uri =~ s|/|%2F|g;
|
---|
779 | $ldap_uri = "ldapi://$ldap_uri";
|
---|
780 | $ctx->{ldap_uri} = $ldap_uri;
|
---|
781 | }
|
---|
782 |
|
---|
783 | my $ret = $self->provision_raw_step1($ctx);
|
---|
784 |
|
---|
785 | if (defined($self->{ldap})) {
|
---|
786 | $ret->{LDAP_URI} = $ctx->{ldap_uri};
|
---|
787 | push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
|
---|
788 | if ($self->{ldap} eq "openldap") {
|
---|
789 | push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
|
---|
790 | ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx->{ldapdir}) or die("Unable to create openldap directories");
|
---|
791 |
|
---|
792 | } elsif ($self->{ldap} eq "fedora-ds") {
|
---|
793 | push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
|
---|
794 | push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
|
---|
795 | ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx->{ldapdir}) or die("Unable to create fedora ds directories");
|
---|
796 | }
|
---|
797 |
|
---|
798 | }
|
---|
799 |
|
---|
800 | $ret = $self->provision_raw_step2($ctx, $ret);
|
---|
801 |
|
---|
802 | return $ret;
|
---|
803 | }
|
---|
804 |
|
---|
805 | sub provision_member($$$)
|
---|
806 | {
|
---|
807 | my ($self, $prefix, $dcvars) = @_;
|
---|
808 | print "PROVISIONING MEMBER...";
|
---|
809 |
|
---|
810 | my $ret = $self->provision($prefix,
|
---|
811 | "member server",
|
---|
812 | "localmember3",
|
---|
813 | "localmember",
|
---|
814 | 3,
|
---|
815 | "localmemberpass",
|
---|
816 | $dcvars->{SERVER_IP});
|
---|
817 |
|
---|
818 | $ret or die("Unable to provision");
|
---|
819 |
|
---|
820 | my $net = $self->bindir_path("net");
|
---|
821 | my $cmd = "";
|
---|
822 | $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
|
---|
823 | $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
|
---|
824 | $cmd .= "$net join $ret->{CONFIGURATION} $dcvars->{DOMAIN} member";
|
---|
825 | $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
|
---|
826 |
|
---|
827 | system($cmd) == 0 or die("Join failed\n$cmd");
|
---|
828 |
|
---|
829 | $ret->{DC_SERVER} = $dcvars->{SERVER};
|
---|
830 | $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
|
---|
831 | $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
|
---|
832 | $ret->{DC_NETBIOSALIAS} = $dcvars->{NETBIOSALIAS};
|
---|
833 | $ret->{DC_USERNAME} = $dcvars->{USERNAME};
|
---|
834 | $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
|
---|
835 |
|
---|
836 | return $ret;
|
---|
837 | }
|
---|
838 |
|
---|
839 | sub provision_dc($$)
|
---|
840 | {
|
---|
841 | my ($self, $prefix) = @_;
|
---|
842 |
|
---|
843 | print "PROVISIONING DC...";
|
---|
844 | my $ret = $self->provision($prefix,
|
---|
845 | "domain controller",
|
---|
846 | "localdc1",
|
---|
847 | "localdc",
|
---|
848 | 1,
|
---|
849 | "localdcpass",
|
---|
850 | "127.0.0.1");
|
---|
851 |
|
---|
852 | $self->add_wins_config("$prefix/private") or
|
---|
853 | die("Unable to add wins configuration");
|
---|
854 |
|
---|
855 | return $ret;
|
---|
856 | }
|
---|
857 |
|
---|
858 | sub teardown_env($$)
|
---|
859 | {
|
---|
860 | my ($self, $envvars) = @_;
|
---|
861 | my $pid;
|
---|
862 |
|
---|
863 | close(DATA);
|
---|
864 |
|
---|
865 | if (-f "$envvars->{PIDDIR}/samba.pid" ) {
|
---|
866 | open(IN, "<$envvars->{PIDDIR}/samba.pid") or die("unable to open server pid file");
|
---|
867 | $pid = <IN>;
|
---|
868 | close(IN);
|
---|
869 |
|
---|
870 | # Give the process 20 seconds to exit. gcov needs
|
---|
871 | # this time to write out the covarge data
|
---|
872 | my $count = 0;
|
---|
873 | until (kill(0, $pid) == 0) {
|
---|
874 | # if no process sucessfully signalled, then we are done
|
---|
875 | sleep(1);
|
---|
876 | $count++;
|
---|
877 | last if $count > 20;
|
---|
878 | }
|
---|
879 |
|
---|
880 | # If it is still around, kill it
|
---|
881 | if ($count > 20) {
|
---|
882 | print "server process $pid took more than $count seconds to exit, killing\n";
|
---|
883 | kill 9, $pid;
|
---|
884 | }
|
---|
885 | }
|
---|
886 |
|
---|
887 | my $failed = $? >> 8;
|
---|
888 |
|
---|
889 | $self->slapd_stop($envvars) if ($self->{ldap});
|
---|
890 |
|
---|
891 | print $self->getlog_env($envvars);
|
---|
892 |
|
---|
893 | return $failed;
|
---|
894 | }
|
---|
895 |
|
---|
896 | sub getlog_env($$)
|
---|
897 | {
|
---|
898 | my ($self, $envvars) = @_;
|
---|
899 | my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME}\n";
|
---|
900 | my $out = $title;
|
---|
901 |
|
---|
902 | open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
|
---|
903 |
|
---|
904 | seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
|
---|
905 | while (<LOG>) {
|
---|
906 | $out .= $_;
|
---|
907 | }
|
---|
908 | $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
|
---|
909 | close(LOG);
|
---|
910 |
|
---|
911 | return "" if $out eq $title;
|
---|
912 |
|
---|
913 | return $out;
|
---|
914 | }
|
---|
915 |
|
---|
916 | sub check_env($$)
|
---|
917 | {
|
---|
918 | my ($self, $envvars) = @_;
|
---|
919 |
|
---|
920 | return 1 if (-p $envvars->{SAMBA_TEST_FIFO});
|
---|
921 |
|
---|
922 | print $self->getlog_env($envvars);
|
---|
923 |
|
---|
924 | return 0;
|
---|
925 | }
|
---|
926 |
|
---|
927 | sub setup_env($$$)
|
---|
928 | {
|
---|
929 | my ($self, $envname, $path) = @_;
|
---|
930 |
|
---|
931 | if ($envname eq "dc") {
|
---|
932 | return $self->setup_dc("$path/dc");
|
---|
933 | } elsif ($envname eq "member") {
|
---|
934 | if (not defined($self->{vars}->{dc})) {
|
---|
935 | $self->setup_dc("$path/dc");
|
---|
936 | }
|
---|
937 | return $self->setup_member("$path/member", $self->{vars}->{dc});
|
---|
938 | } else {
|
---|
939 | die("Samba4 can't provide environment '$envname'");
|
---|
940 | }
|
---|
941 | }
|
---|
942 |
|
---|
943 | sub setup_member($$$$)
|
---|
944 | {
|
---|
945 | my ($self, $path, $dc_vars) = @_;
|
---|
946 |
|
---|
947 | my $env = $self->provision_member($path, $dc_vars);
|
---|
948 |
|
---|
949 | $self->check_or_start($env, ($ENV{SMBD_MAXTIME} or 7500));
|
---|
950 |
|
---|
951 | $self->wait_for_start($env);
|
---|
952 |
|
---|
953 | return $env;
|
---|
954 | }
|
---|
955 |
|
---|
956 | sub setup_dc($$)
|
---|
957 | {
|
---|
958 | my ($self, $path) = @_;
|
---|
959 |
|
---|
960 | my $env = $self->provision_dc($path);
|
---|
961 |
|
---|
962 | $self->check_or_start($env,
|
---|
963 | ($ENV{SMBD_MAXTIME} or 7500));
|
---|
964 |
|
---|
965 | $self->wait_for_start($env);
|
---|
966 |
|
---|
967 | $self->{vars}->{dc} = $env;
|
---|
968 |
|
---|
969 | return $env;
|
---|
970 | }
|
---|
971 |
|
---|
972 | sub stop($)
|
---|
973 | {
|
---|
974 | my ($self) = @_;
|
---|
975 | }
|
---|
976 |
|
---|
977 | 1;
|
---|