Merge ~ahasenack/ubuntu/+source/samba:jammy-samba-kb5028166-2027716 into ubuntu/+source/samba:ubuntu/jammy-devel

[Andreas Hasenack]

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/samba-kb5028166/

Bug fix for #2027716. SRU template is filled in, including a test case.

I split the patch in two commits: one that introduces the upstream patch, pristine, and another that removes the hunks that changed the upstream test suite. We don't run that test suite, and I think a smaller patch is easier to review, specially when comparing to the other ubuntu releases which needed a small backport change.

I tried to make incremental changes to this branch when compared to lunar, so it's easier to review. But range-diff is still a bit noisy, because the patch that fixes the problem needed a small backport.

The DEP8 test also needed tweaking for jammy, and I tried to keep the differences as additional commits.

DEP8 is green. It doesn't exercise this bug in particular, but does exercise a domain join with linux<->linux, which is a good regression test.

[Lucas Kanashiro (lucaskanashiro)]

Thanks for this MP Andreas! The packaging changes look good to me. I tried to build the package locally to run the DEP-8 test you are introducing locally and I got the following build error:

[2984/4247] Compiling source4/torture/smb2/sessid.c
20:35:19 runner ['/usr/bin/gcc', '-D_SAMBA_BUILD_=4', '-DHAVE_CONFIG_H=1', '-g', '-O2', '-ffile-prefix-map=/<<PKGBUILDDIR>>=.', '-flto=auto', '-ffat-lto-objects', '-flto=auto', '-ffat-lto-objects', '-fstack-protector-strong', '-Wformat', '-Werror=format-security', '-MMD', '-D_GNU_SOURCE=1', '-D_XOPEN_SOURCE_EXTENDED=1', '-DHAVE_CONFIG_H=1', '-fPIC', '-D__STDC_WANT_LIB_EXT1__=1', '-D_REENTRANT', '-DCTDB_HELPER_BINDIR="/usr/lib/x86_64-linux-gnu/ctdb"', '-DLOGDIR="/var/log/ctdb"', '-DCTDB_DATADIR="/usr/share/ctdb"', '-DCTDB_ETCDIR="/etc/ctdb"', '-DCTDB_VARDIR="/var/lib/ctdb"', '-DCTDB_RUNDIR="/var/run/ctdb"', '-fstack-protector-strong', '-fstack-clash-protection', '-DSTATIC_TORTURE_SMB2_MODULES=NULL', '-DSTATIC_TORTURE_SMB2_MODULES_PROTO=extern void __TORTURE_SMB2_dummy_module_proto(void)', '-Isource4/torture/smb2', '-I../../source4/torture/smb2', '-Iinclude/public', '-I../../include/public', '-Isource4', '-I../../source4', '-Ilib', '-I../../lib', '-Isource4/lib', '-I../../source4/lib', '-Isource4/include', '-I../../source4/include', '-Iinclude', '-I../../include', '-Ilib/replace', '-I../../lib/replace', '-Ictdb/include', '-I../../ctdb/include', '-Ictdb', '-I../../ctdb', '-I.', '-I../..', '-Ilib/torture', '-I../../lib/torture', '-Ilibrpc', '-I../../librpc', '-Ilib/tsocket', '-I../../lib/tsocket', '-Iauth', '-I../../auth', '-Ilib/util/<<PKGBUILDDIR>>/third_party/gpfs', '-I../../lib/util/<<PKGBUILDDIR>>/third_party/gpfs', '-Ilib/ldb-samba', '-I../../lib/ldb-samba', '-Ilibcli/util', '-I../../libcli/util', '-Ilib/dbwrap', '-I../../lib/dbwrap', '-Isource4/auth/kerberos', '-I../../source4/auth/kerberos', '-Iauth/credentials', '-I../../auth/credentials', '-Isource4/heimdal/lib/asn1', '-I../../source4/heimdal/lib/asn1', '-Isource4/heimdal_build', '-I../../source4/heimdal_build', '-Ilibcli/auth', '-I../../libcli/auth', '-Isource4/heimdal/lib/roken', '-I../../source4/heimdal/lib/roken', '-Isource4/heimdal/include', '-I../../source4/heimdal/include', '-Isource4/heimdal_build/include', '-I../../source4/heimdal_build/include', '-Isource4/auth', '-I../../source4/auth', '-Isource4/libcli/smb2', '-I../../source4/libcli/smb2', '-Isource4/dsdb', '-I../../source4/dsdb', '-Isource4/heimdal/lib/gssapi', '-I../../source4/heimdal/lib/gssapi', '-Isource4/heimdal/lib/gssapi/gssapi', '-I../../source4/heimdal/lib/gssapi/gssapi', '-Isource4/heimdal/lib/gssapi/spnego', '-I../../source4/heimdal/lib/gssapi/spnego', '-Isource4/heimdal/lib/gssapi/krb5', '-I../../source4/heimdal/lib/gssapi/krb5', '-Isource4/heimdal/lib/gssapi/mech', '-I../../source4/heimdal/lib/gssapi/mech', '-Isource4/heimdal/lib/hx509', '-I../../source4/heimdal/lib/hx509', '-Ilib/param', '-I../../lib/param', '-Isource4/libcli', '-I../../source4/libcli', '-Iauth/gensec', '-I../../auth/gensec', '-Isource3', '-I../../source3', '-Isource3/include', '-I../../source3/include', '-Isource3/lib', '-I../../source3/lib', '-Isource4/heimdal/lib/com_err', '-I../../source4/heimdal/lib...

review: Needs Information

[Lucas Kanashiro (lucaskanashiro)]

Argh, it built fine locally now, not sure exactly what happened, but there is this DEP-8 test failing locally for me:

autopkgtest [18:17:02]: test samba-ad-dc-provisioning-internal-dns: - - - - - - - - - - results - - - - - - - - - -
samba-ad-dc-provisioning-internal-dns FAIL non-zero exit status 253

Summary of a local autopkgtest run:

autopkgtest [19:09:04]: @@@@@@@@@@@@@@@@@@@@ summary
cifs-share-access PASS
cifs-share-access-uring PASS
python-smoke PASS
smbclient-anonymous-share-list PASS
smbclient-authenticated-share-list PASS
smbclient-share-access PASS
smbclient-share-access-uring PASS
samba-ad-dc-provisioning-internal-dns FAIL non-zero exit status 253

[Andreas Hasenack (ahasenack)]

Hm, that's odd:

660s Error loading module '/usr/lib/x86_64-linux-gnu/samba/vfs/acl_xattr.so': /usr/lib/x86_64-linux-gnu/samba/vfs/acl_xattr.so: cannot open shared object file: No such file or directory

Looks like jammy also needs the samba-vfs-modules package added to the test dependency, just like I found out for focal. Not sure how I didn't see this before.

[Andreas Hasenack (ahasenack)]

PPA rebuilt (jammy), all tests re-triggered, let's see tomorrow what we get.

[Andreas Hasenack (ahasenack)]

And this time it's green all around:
Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-ahasenack-samba-kb5028166/?format=plain)
  samba @ amd64:
    26.07.23 00:00:56 Log 🗒️ ✅ Triggers: samba/2:4.15.13+dfsg-0ubuntu1.3~ppa2
  samba @ arm64:
    26.07.23 00:40:52 Log 🗒️ ✅ Triggers: samba/2:4.15.13+dfsg-0ubuntu1.3~ppa2
  samba @ armhf:
    26.07.23 00:01:31 Log 🗒️ ✅ Triggers: samba/2:4.15.13+dfsg-0ubuntu1.3~ppa2
  samba @ ppc64el:
    26.07.23 00:15:03 Log 🗒️ ✅ Triggers: samba/2:4.15.13+dfsg-0ubuntu1.3~ppa2
  samba @ s390x:
    26.07.23 00:18:25 Log 🗒️ ✅ Triggers: samba/2:4.15.13+dfsg-0ubuntu1.3~ppa2

[Lucas Kanashiro (lucaskanashiro)]

Awesome! Now, LGTM, +1.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, lucaskanashiro
Uploaders: ahasenack, lucaskanashiro
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded with rich history:

Uploading samba_4.15.13+dfsg-0ubuntu1.3.dsc
Uploading samba_4.15.13+dfsg-0ubuntu1.3.debian.tar.xz
Uploading samba_4.15.13+dfsg-0ubuntu1.3_source.buildinfo
Uploading samba_4.15.13+dfsg-0ubuntu1.3_source.changes

diff --git a/debian/changelog b/debian/changelog
index b951fb0..5e12a5e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+samba (2:4.15.13+dfsg-0ubuntu1.3) jammy; urgency=medium
+
+  * d/p/secure-channel-faulty-kb5028166.patch: fix domain membership
+    after Windows KB5028166 update (LP: #2027716)
+  * Cherry pick samba AD DC provisioning DEP8 test from later Ubuntu
+    releases (LP: #1977746, LP: #2011745):
+    - d/t/control, d/t/util, d/t/samba-ad-dc-provisioning-internal-dns:
+      samba AD DC provisioning and domain join tests with internal DNS
+      + d/t/control: adjust package dependencies
+      + d/t/samba-ad-dc-provisioning-internal-dns: handle the case where
+        libnss-winbind does not automatically add winbind to
+        /etc/nsswitch.conf (that is done only in Lunar and later)
+      + d/t/samba-ad-dc-provisioning-internal-dns: use case insensitive
+        match when inspecting kerberos tickets, as the hostname may be
+        capitalized
+
+ -- Andreas Hasenack <[e-mail]>  Sun, 23 Jul 2023 17:09:59 -0300
+
 samba (2:4.15.13+dfsg-0ubuntu1.2) jammy-security; urgency=medium
 
   * SECURITY UPDATE: Out-Of-Bounds read in winbind AUTH_CRAP
diff --git a/debian/patches/secure-channel-faulty-kb5028166.patch b/debian/patches/secure-channel-faulty-kb5028166.patch
 new file mode 100644
index 0000000..c1367f7
--- /dev/null
+++ b/debian/patches/secure-channel-faulty-kb5028166.patch
@@ -0,0 +1,215 @@
+From 2150e7f3dc409b415ca8b6a541729a49932c5073 Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <[e-mail]>
+Date: Sat, 15 Jul 2023 17:20:32 +0200
+Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities
+ response level 2
+
+We don't have any documentation about this yet, but tests against
+a Windows Server 2022 patched with KB5028166 revealed that
+the response for query_level=2 is exactly the same as
+for querey_level=1.
+
+Until we know the reason for query_level=2 we won't
+use it as client nor support it in the server, but
+we want ndrdump to work.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418
+
+Signed-off-by: Stefan Metzmacher <[e-mail]>
+Reviewed-by: Andrew Bartlett <[e-mail]>
+(cherry picked from commit 5f87888ed53320538cf773d64868390d8641a40e)
+---
+ librpc/idl/netlogon.idl | 1 +
+ 1 file changed, 1 insertion(+)
+
+Ubuntu patch note: removed the parts that changed the upstream test suite
+
+Origin: backport, https://bugzilla.samba.org/attachment.cgi?id=17987
+Bug: https://bugzilla.samba.org/show_bug.cgi?id=15418
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/2027716
+Last-Update: 2023-07-17
+
+diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl
+index d956a661fff7..b51767136d3c 100644
+--- a/librpc/idl/netlogon.idl
++++ b/librpc/idl/netlogon.idl
+@@ -1241,6 +1241,7 @@ interface netlogon
+ 	/* Function 0x15 */
+ 	typedef [switch_type(uint32)] union {
+ 		[case(1)] netr_NegotiateFlags server_capabilities;
++		[case(2)] netr_NegotiateFlags server_capabilities;
+ 	} netr_Capabilities;
+ 
+ 	NTSTATUS netr_LogonGetCapabilities(
+-- 
+2.34.1
+
+
+From fa71e7b4b027dc8224fda7125f1faaefa4e71eae Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <[e-mail]>
+Date: Sat, 15 Jul 2023 16:11:48 +0200
+Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for
+ invalid netr_LogonGetCapabilities levels
+
+This is important as Windows clients with KB5028166 seem to
+call netr_LogonGetCapabilities with query_level=2 after
+a call with query_level=1.
+
+An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG
+for query_level values other than 1.
+While Samba tries to return NT_STATUS_NOT_SUPPORTED, but
+later fails to marshall the response, which results
+in DCERPC_FAULT_BAD_STUB_DATA instead.
+
+Because we don't have any documentation for level 2 yet,
+we just try to behave like an unpatched server and
+generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of
+DCERPC_FAULT_BAD_STUB_DATA.
+Which allows patched Windows clients to keep working
+against a Samba DC.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418
+
+Signed-off-by: Stefan Metzmacher <[e-mail]>
+Reviewed-by: Andrew Bartlett <[e-mail]>
+(cherry picked from commit d5f1097b6220676d56ed5fc6707acf667b704518)
+---
+ .../knownfail.d/netr_LogonGetCapabilities     |  2 --
+ source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++---
+ 2 files changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
+index 6a3e044eb9da..26be4f567513 100644
+--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
++++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
+@@ -2399,6 +2399,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c
+ 	struct netlogon_creds_CredentialState *creds;
+ 	NTSTATUS status;
+ 
++	switch (r->in.query_level) {
++	case 1:
++		break;
++	case 2:
++		/*
++		 * Until we know the details behind KB5028166
++		 * just return DCERPC_NCA_S_FAULT_INVALID_TAG
++		 * like an unpatched Windows Server.
++		 */
++		FALL_THROUGH;
++	default:
++		/*
++		 * There would not be a way to marshall the
++		 * the response. Which would mean our final
++		 * ndr_push would fail an we would return
++		 * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA.
++		 *
++		 * But it's important to match a Windows server
++		 * especially before KB5028166, see also our bug #15418
++		 * Otherwise Windows client would stop talking to us.
++		 */
++		DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG);
++	}
++
+ 	status = dcesrv_netr_creds_server_step_check(dce_call,
+ 						     mem_ctx,
+ 						     r->in.computer_name,
+@@ -2410,10 +2434,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c
+ 	}
+ 	NT_STATUS_NOT_OK_RETURN(status);
+ 
+-	if (r->in.query_level != 1) {
+-		return NT_STATUS_NOT_SUPPORTED;
+-	}
+-
+ 	r->out.capabilities->server_capabilities = creds->negotiate_flags;
+ 
+ 	return NT_STATUS_OK;
+-- 
+2.34.1
+
+
+From 05f110e1a4d4b38bfbaaa3a92fda7a9127b3b456 Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <[e-mail]>
+Date: Sat, 15 Jul 2023 16:11:48 +0200
+Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for
+ invalid netr_LogonGetCapabilities levels
+
+This is important as Windows clients with KB5028166 seem to
+call netr_LogonGetCapabilities with query_level=2 after
+a call with query_level=1.
+
+An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG
+for query_level values other than 1.
+While Samba tries to return NT_STATUS_NOT_SUPPORTED, but
+later fails to marshall the response, which results
+in DCERPC_FAULT_BAD_STUB_DATA instead.
+
+Because we don't have any documentation for level 2 yet,
+we just try to behave like an unpatched server and
+generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of
+DCERPC_FAULT_BAD_STUB_DATA.
+Which allows patched Windows clients to keep working
+against a Samba DC.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418
+
+Signed-off-by: Stefan Metzmacher <[e-mail]>
+Reviewed-by: Andrew Bartlett <[e-mail]>
+
+Autobuild-User(master): Stefan Metzmacher <[e-mail]>
+Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224
+
+(cherry picked from commit dfeabce44fbb78083fbbb2aa634fc4172cf83db9)
+---
+ .../knownfail.d/netr_LogonGetCapabilities     |  1 -
+ source3/rpc_server/netlogon/srv_netlog_nt.c   | 29 ++++++++++++++++---
+ 2 files changed, 25 insertions(+), 5 deletions(-)
+ delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities
+
+diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
+index 5906464a9f3..35433ec6781 100644
+--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
+@@ -2421,6 +2421,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p,
+ 	struct netlogon_creds_CredentialState *creds;
+ 	NTSTATUS status;
+ 
++	switch (r->in.query_level) {
++	case 1:
++		break;
++	case 2:
++		/*
++		 * Until we know the details behind KB5028166
++		 * just return DCERPC_NCA_S_FAULT_INVALID_TAG
++		 * like an unpatched Windows Server.
++		 */
++		FALL_THROUGH;
++	default:
++		/*
++		 * There would not be a way to marshall the
++		 * the response. Which would mean our final
++		 * ndr_push would fail an we would return
++		 * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA.
++		 *
++		 * But it's important to match a Windows server
++		 * especially before KB5028166, see also our bug #15418
++		 * Otherwise Windows client would stop talking to us.
++		 */
++		p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG;
++		return NT_STATUS_NOT_SUPPORTED;
++	}
++
+ 	become_root();
+ 	status = netr_creds_server_step_check(p, p->mem_ctx,
+ 					      r->in.computer_name,
+@@ -2432,10 +2457,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p,
+ 		return status;
+ 	}
+ 
+-	if (r->in.query_level != 1) {
+-		return NT_STATUS_NOT_SUPPORTED;
+-	}
+-
+ 	r->out.capabilities->server_capabilities = creds->negotiate_flags;
+ 
+ 	return NT_STATUS_OK;
diff --git a/debian/patches/series b/debian/patches/series
index 5791d76..0a6a142 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -64,3 +64,4 @@ CVE-2023-34968-09.patch
 CVE-2023-34968-10.patch
 CVE-2023-34968-11.patch
 CVE-2023-34968-12.patch
+secure-channel-faulty-kb5028166.patch
diff --git a/debian/tests/control b/debian/tests/control
index 3ecb853..6814243 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -24,3 +24,7 @@ Restrictions: needs-root, allow-stderr, isolation-container
 Tests: smbclient-share-access-uring
 Depends: samba, samba-vfs-modules, smbclient, coreutils, systemd, passwd
 Restrictions: needs-root, allow-stderr, isolation-container, skippable
+
+Tests: samba-ad-dc-provisioning-internal-dns
+Depends: samba, samba-dsdb-modules, samba-vfs-modules, winbind, smbclient, krb5-user, bind9-dnsutils, lxd | snapd, lsb-release, dctrl-tools
+Restrictions: needs-root, isolation-machine, allow-stderr, breaks-testbed
diff --git a/debian/tests/samba-ad-dc-provisioning-internal-dns b/debian/tests/samba-ad-dc-provisioning-internal-dns
 new file mode 100755
index 0000000..592a608
--- /dev/null
+++ b/debian/tests/samba-ad-dc-provisioning-internal-dns
@@ -0,0 +1,404 @@
+#!/bin/bash
+
+set -e
+set -o pipefail
+
+source debian/tests/util
+
+declare -r domain="EXAMPLE"
+declare -r realm="EXAMPLE.FAKE"
+declare -r adminpass="Passw0rd"
+declare -r test_user="test_user_${RANDOM}"
+declare -r test_pw="test_user_secret_${RANDOM}"
+declare -A user_pass
+user_pass[Administrator]="${adminpass}"
+user_pass[${test_user}]="${test_pw}"
+declare -A join_method_deps
+# Minimum set of deps: let realmd install the extra dependencies
+# as needed, depending on the join method.
+join_method_deps[realmd_sssd]="realmd krb5-user smbclient"
+join_method_deps[realmd_winbind]="realmd krb5-user smbclient"
+
+
+cleanup() {
+    rc=$?
+    set +e # so we don't exit midcleanup
+    if [ ${rc} -ne 0 ]; then
+        echo "## Something failed, gathering logs"
+        echo
+        echo "## smb.conf"
+        cat /etc/samba/smb.conf
+        echo
+        echo "## resolv.conf"
+        cat /etc/resolv.conf
+        echo
+        echo "## resolvectl status"
+        resolvectl status
+        echo "## journal for samba-ad-dc.service"
+        journalctl -u samba-ad-dc.service --lines 500
+        echo
+        for log in /var/log/samba/log.*; do
+            # skip compressed logrotated files
+            if [ "${log%.gz}" != "${log}" ]; then
+                continue
+            fi
+            [ -s "${log}" ] || continue
+            echo "## $(basename ${log}):"
+            tail -n 500 "${log}"
+            echo
+        done
+        echo "## syslog"
+        tail -n 500 /var/log/syslog
+    fi
+}
+
+trap cleanup EXIT
+
+assert_testparm() {
+    local parameter="${1}"
+    local expected_value="${2}"
+    local current_value=""
+    local -i retval=0
+
+    echo -n "Asserting ${parameter} is ${expected_value}: "
+    current_value=$(testparm -s --parameter-name "${parameter}" 2>/dev/null) || {
+        retval=$?
+        echo "FAIL"
+        return ${retval}
+    }
+    if [ "${current_value}" = "${expected_value}" ]; then
+        echo "OK"
+        return 0
+    else
+        echo "FAIL"
+        return 1
+    fi
+}
+
+basic_config_tests() {
+    echo "## Basic config tests"
+    testparm -s > /dev/null
+    assert_testparm "realm" "${realm}"
+    assert_testparm "workgroup" "${domain}"
+    assert_testparm "server role" "active directory domain controller"
+    echo
+}
+
+dns_tests() {
+    echo "## DNS tests"
+    echo "Obtaining administrator kerberos ticket"
+    echo "${adminpass}" | timeout --verbose 30 kinit Administrator
+    echo
+    echo "Querying server info"
+    samba-tool dns serverinfo "$(hostname)"
+    echo
+    echo "Checking we got a service ticket of type host/"
+    klist | grep -i "host/$(hostname)"
+    echo
+    echo "Checking specific DNS records"
+    for srv in _ldap._tcp _kerberos._tcp _kerberos._udp _kpasswd._udp; do
+        echo -n "${srv}.${realm,,}: "
+        dig @localhost +short -t SRV ${srv}.${realm,,}
+        echo
+    done
+    echo
+    echo -n "Checking that our hostname \"$(hostname)\" is in DNS: "
+    myip=$(dig @localhost +short -t A "$(hostname).${realm,,}")
+    echo "${myip}"
+    echo
+}
+
+user_creation_tests() {
+    echo "## User creation tests"
+    samba-tool domain passwordsettings set --complexity=off
+    echo "Creating user \"${test_user}\" with password ${test_pw}"
+    samba-tool user add "${test_user}" "${test_pw}"
+    echo
+    echo "Attempting to obtain kerberos ticket for user \"${test_user}\""
+    # just in case it ends up waiting at a prompt, we use "timeout"
+    echo "${test_pw}" | timeout --verbose 30 kinit "${test_user}"
+    echo "Ticket obtained"
+    klist
+    echo
+}
+
+smbclient_tests() {
+    echo "## smbclient tests"
+    kdestroy || :
+    echo
+    echo "Obtaining a TGT for ${test_user}"
+    echo "${test_pw}" | timeout --verbose 30 kinit "${test_user}"
+    klist | grep krbtgt
+    echo
+    echo "Attempting password-less authentication with smbclient"
+    echo
+    echo "Listing shares"
+    smbclient -L "$(hostname)" --use-kerberos=required -k
+    echo
+    echo "Listing the sysvol share"
+    smbclient "//$(hostname)/sysvol" --use-kerberos=required -k -c "ls"
+    echo
+    echo "Listing policies"
+    # lowercase the ${realm}
+    smbclient "//$(hostname)/sysvol" --use-kerberos=required -k -c "ls ${realm,,}/Policies/*"
+    echo
+    echo "Checking that we have a ticket for the cifs service after all these commands"
+    klist | grep cifs/
+    echo
+}
+
+server_join_tests() {
+    local member_server
+    # the join methods are the keys of the join_method_deps dict
+    local -a methods=("${!join_method_deps[@]}")
+    local member_server="member-server"
+
+    echo "## Server join tests"
+    echo "## Initializing lxd"
+    setup_lxd "${realm,,}"
+
+    for method in "${methods[@]}"; do
+        echo "## Setting up member server to join a domain using method ${method}"
+        setup_member_server "${member_server}" "${method}"
+        echo "## Joining domain with method ${method}"
+        join_domain "${member_server}" "${method}"
+        echo
+        echo "## Verifying join with method ${method}"
+        verify_join "${member_server}" "${method}"
+        echo
+        echo "## Leaving domain with method ${method}"
+        leave_domain "${member_server}" "${method}"
+        echo
+        echo "## Destroying member server"
+        lxc delete --force "${member_server}"
+    done
+}
+
+setup_member_server() {
+    local container_name="${1}"
+    local method="${2}"
+    local release
+
+    release="$(lsb_release -cs)"
+    if [ -z "${join_method_deps[${method}]}" ]; then
+        echo "## INTERNAL ERROR, invalid join method: ${method}"
+        return 1
+    fi
+    echo "## Got test dependencies: ${join_method_deps[${method}]}"
+    # can't use cloud-init here to install packages, because we first need to
+    # sync the apt config from the host to the container
+    echo "## Launching ${release} container"
+    lxc launch "ubuntu-daily:${release}" "${container_name}" -q
+    wait_container_ready "${container_name}"
+    send_apt_config "${container_name}"
+    copy_local_apt_files "${container_name}"
+    echo "## Installing dependencies in test container"
+    install_packages_in_container "${container_name}" ${join_method_deps[${method}]}
+}
+
+join_domain_realmd_winbind() {
+    local server="${1}"
+    local discover_cmd="realm discover -v --membership-software=samba --client-software=winbind ${realm,,}"
+    local join_cmd="realm join -v --membership-software=samba --client-software=winbind ${realm,,}"
+
+    echo "## Domain information"
+    lxc exec "${server}" -- ${discover_cmd}
+    echo
+    echo "## Running join command: ${join_cmd}"
+    echo "${adminpass}" | lxc exec "${server}" -- ${join_cmd}
+    # LP: #1980246
+    # So far, only lunar and later automatically add winbind to /etc/nsswitch.conf.
+    lxc exec "${server}" -- sed -r -i \
+          -e  '/^(passwd|group):.*[[:space:]]winbind\b/b' \
+          -e 's/^(passwd|group):.*/& winbind/' \
+          /etc/nsswitch.conf
+}
+
+verify_join_realmd_winbind() {
+    local server="${1}"
+    local member_domain
+
+    echo -n "## Verifying member server joined domain name: "
+    member_domain=$(lxc exec "${server}" -- wbinfo --own-domain)
+    echo "${member_domain}"
+    if [ "${member_domain}" != "${domain}" ]; then
+        echo "ERROR: expected member server domain to match the joined domain:"
+        echo "member server domain: ${member_domain}"
+        echo "AD domain: ${domain}"
+        return 1
+    fi
+    echo
+    # we just want to see the output, not parse it
+    echo "## Domain status in member server"
+    lxc exec "${server}" -- wbinfo --domain-info "${member_domain}"
+    echo
+    echo "## User status in member server"
+    for u in "${!user_pass[@]}"; do
+        echo "## User \"${u}@${realm}\" information:"
+        lxc exec "${server}" -- wbinfo --user-info "${u}@${realm}"
+        echo
+        echo "## id ${u}@${realm}"
+        lxc exec "${server}" -- id ${u}@${realm}
+        echo
+        echo "## kinit authentication check for user \"${u}@${realm}\" inside member server"
+        echo "${user_pass[${u}]}" | lxc exec "${server}" -- timeout --verbose 30 kinit "${u}@${realm}"
+        lxc exec "${server}" -- klist
+        echo
+        echo "## Listing shares with the obtained kerberos ticket"
+        lxc exec "${server}" -- smbclient -L "$(hostname)" --use-kerberos=required -k
+        lxc exec "${server}" -- kdestroy
+        echo
+        echo "## wbinfo authentication check for user \"${u}@${realm}\" inside member server"
+        # non-interactive format for username is user%password
+        lxc exec "${server}" -- wbinfo --authenticate="${u}@${realm}%${user_pass[${u}]}"
+        echo
+        echo "## wbinfo kerberos authentication check for user \"${u}@${realm}\" inside member server"
+        lxc exec "${server}" -- wbinfo --krb5auth="${u}@${realm}%${user_pass[${u}]}"
+        echo
+        echo "## Listing shares with the obtained kerberos ticket"
+        lxc exec "${server}" -- smbclient -L "$(hostname)" --use-kerberos=required -k
+        lxc exec "${server}" -- kdestroy
+    done
+}
+
+leave_domain_realmd_winbind() {
+    local server="${1}"
+    local leave_cmd="realm leave -v --remove --client-software=winbind"
+
+    echo "## Running leave command: ${leave_cmd}"
+    echo "${adminpass}" | lxc exec "${server}" -- ${leave_cmd}
+}
+
+join_domain_realmd_sssd() {
+    local server="${1}"
+    local discover_cmd="realm discover -v --membership-software=adcli --client-software=sssd ${realm,,}"
+    local join_cmd="realm join -v --membership-software=adcli --client-software=sssd ${realm,,}"
+
+    echo "## Domain information"
+    lxc exec "${server}" -- ${discover_cmd}
+    echo
+    echo "## Running join command: ${join_cmd}"
+    echo "${adminpass}" | lxc exec "${server}" -- ${join_cmd}
+    echo
+}
+
+verify_join_realmd_sssd() {
+    local server="${1}"
+    local samba_domain
+
+    echo -n "## Verifying member server joined domain name: "
+    samba_domain=$(lxc exec "${server}" -- sssctl domain-list)
+    echo "${samba_domain}"
+    if [ "${samba_domain}" != "${realm,,}" ]; then
+        echo "ERROR: expected member server domain to match the joined domain:"
+        echo "member server domain: ${samba_domain}"
+        echo "AD domain: ${realm,,}"
+        return 1
+    fi
+    echo
+    # we just want to see the output, not parse it
+    echo "## Domain status in member server"
+    lxc exec "${server}" -- sssctl domain-status "${realm}"
+    echo
+    echo "## User status in member server"
+    for u in "${!user_pass[@]}"; do
+        echo "## User \"${u}@${realm}\" information:"
+        lxc exec "${server}" -- sssctl user-checks "${u}@${realm}"
+        echo
+        echo "## id ${u}@${realm}"
+        lxc exec "${server}" -- id "${u}@${realm}"
+        echo
+        echo "## kinit authentication check for user \"${u}@${realm}\" inside member server"
+        echo "${user_pass[${u}]}" | lxc exec "${server}" -- timeout --verbose 30 kinit "${u}@${realm}"
+        lxc exec "${server}" -- klist
+        echo
+        echo "## Listing shares with the obtained kerberos ticket"
+        lxc exec "${server}" -- smbclient -L "$(hostname)" --use-kerberos=required -k
+        lxc exec "${server}" -- kdestroy
+    done
+}
+
+leave_domain_realmd_sssd() {
+    local server="${1}"
+    local leave_cmd="realm leave -v --remove --client-software=sssd"
+
+    echo "## Running leave command: ${leave_cmd}"
+    echo "${adminpass}" | lxc exec "${server}" -- ${leave_cmd}
+}
+
+join_domain() {
+    local server="${1}"
+    local m="${2}"
+
+    join_domain_${m} "${server}"
+}
+
+verify_join() {
+    local server="${1}"
+    local m="${2}"
+
+    verify_join_${m} "${server}"
+}
+
+leave_domain() {
+    local server="${1}"
+    local m="${2}"
+
+    leave_domain_${m} "${server}"
+}
+
+systemctl stop smbd nmbd winbind
+systemctl disable smbd nmbd winbind
+systemctl mask smbd nmbd winbind
+
+systemctl unmask samba-ad-dc
+systemctl enable samba-ad-dc
+
+if [ -f /etc/samba/smb.conf ]; then
+    mv /etc/samba/smb.conf{,.orig}
+fi
+
+# make sure we are starting fresh, as previous tests might left things around
+
+rm -rf /var/lib/samba/* /var/cache/samba/* /run/samba/*
+kdestroy || :
+
+samba-tool domain provision \
+    --domain="${domain}" \
+    --realm="${realm}" \
+    --adminpass="${adminpass}" \
+    --server-role=dc \
+    --use-rfc2307 \
+    --dns-backend=SAMBA_INTERNAL
+
+current_dns=$(resolvectl status | grep "^Current DNS Server:" | awk '{print $4}')
+
+if [ -n "${current_dns}" ]; then
+    echo "## Setting dns forwarder to ${current_dns} in smb.conf"
+    sed -r -i "s,dns forwarder = .*,dns forwarder = ${current_dns}," \
+        /etc/samba/smb.conf
+    unlink /etc/resolv.conf
+    echo "nameserver 127.0.0.1" > /etc/resolv.conf
+    # lowercase substitution
+    echo "search ${realm,,}" >> /etc/resolv.conf
+    systemctl stop systemd-resolved
+    systemctl disable systemd-resolved
+else
+    echo "## Warning, couldn't detect the current DNS server to use as forwarder in smb.conf"
+    echo "## resolvectl status:"
+    resolvectl status
+    echo "## Continuing, and hoping for the best"
+fi
+
+cp -f /var/lib/samba/private/krb5.conf /etc/krb5.conf
+
+systemctl start samba-ad-dc
+
+# give it some time, it's a lot of services to start
+sleep 5s
+
+basic_config_tests
+dns_tests
+user_creation_tests
+smbclient_tests
+server_join_tests
diff --git a/debian/tests/util b/debian/tests/util
index 87a2ccd..af7a0aa 100644
--- a/debian/tests/util
+++ b/debian/tests/util
@@ -16,7 +16,7 @@ EOFEOF
         if [ -n "${vfs}" ]; then
             echo "vfs objects = ${vfs}" >> /etc/samba/smb.conf
         fi
-        systemctl restart smbd.service
+        systemctl reload smbd.service
     else
         echo "Share [${share}] already exists, continuing"
     fi
@@ -63,3 +63,113 @@ check_kernel_version() {
         return 1
     fi
 }
+
+wait_container_ready() {
+    local container="${1}"
+    local -i limit=120 # seconds
+    local -i i=0
+    local -i result=0
+    local ip
+    local output
+
+    while /bin/true; do
+        ip=$(lxc list "${container}" -c 4 --format=compact | tail -1 | awk '{print $1}')
+        if [ -n "${ip}" ]; then
+            break
+        fi
+        i=$((i+1))
+        if [ ${i} -ge ${limit} ]; then
+            return 1
+        fi
+        sleep 1s
+        echo -n "."
+    done
+    while ! nc -z "${ip}" 22; do
+        echo -n "."
+        i=$((i+1))
+        if [ ${i} -ge ${limit} ]; then
+            return 1
+        fi
+        sleep 1s
+    done
+    # cloud-init might still be doing things...
+    # this call blocks, so wrap it in its own little timeout
+    output=$(lxc exec "${container}" -- timeout --verbose $((limit-i)) cloud-init status --wait) || {
+        result=$?
+        echo "cloud-init status --wait failed on container ${container}"
+        echo "${output}"
+        return ${result}
+    }
+    echo
+}
+
+install_lxd() {
+    if ! command -v lxd > /dev/null 2>&1; then
+        # the test depends has "lxd | snapd", so if we don't have lxd, we must
+        # install the snap
+        snap list lxd > /dev/null 2>&1 || {
+            echo "Installing the LXD snap..."
+            snap install lxd
+        }
+    fi
+}
+
+setup_lxd() {
+    local dns_domain="${1}"
+    local network
+    local nic
+    local dns_ip
+
+    install_lxd
+    # Stop samba while lxd is setup, to avoid conflicts on lxdbr0:53
+    systemctl stop samba-ad-dc
+    lxd init --auto
+    lxd waitready --timeout 600
+    network=$(lxc network list --format=compact | grep -E "bridge.*YES.*CREATED")
+    nic=$(echo "${network}" | awk '{print $1}')
+    dns_ip=$(echo "${network}" | awk '{print $4}' | cut -d / -f 1) # strip the cidr
+    # port=0 effectively disables dnsmasq's DNS, so it doesn't conflict with samba's DNS
+    lxc network set "${nic:-lxdbr0}" ipv6.address=none dns.domain="${dns_domain}" raw.dnsmasq="$(echo -e port=0\\ndhcp-option=option:dns-server,${dns_ip})"
+    if [ -n "${http_proxy}" ]; then
+        lxc config set core.proxy_http "${http_proxy}"
+    fi
+    if [ -n "${https_proxy}" ]; then
+        lxc config set core.proxy_https "${https_proxy}"
+    fi
+    if [ -n "${noproxy}" ]; then
+        lxc config set core.proxy_ignore_hosts "${noproxy}"
+    fi
+    systemctl start samba-ad-dc
+    # give it some time, it's a lot of services to start
+    sleep 5s
+}
+
+# Copy the local apt package archive over to the lxd container.
+copy_local_apt_files() {
+    local container_name="${1:-docker}"
+
+    for local_source in $(apt-get indextargets | grep-dctrl -F URI -e '^file:/' -sURI | awk '{print $2}'); do
+        local_source=${local_source#file:}
+        local_dir=$(dirname "${local_source}")
+        lxc exec "${container_name}" -- mkdir -p "${local_dir}"
+        tar -cC "${local_dir}" . | lxc exec "${container_name}" -- tar -xC "${local_dir}"
+    done
+}
+
+send_apt_config() {
+    echo "Copying over /etc/apt to container ${1}"
+    lxc exec "${1}" -- rm -rf /etc/apt
+    lxc exec "${1}" -- mkdir -p /etc/apt
+    tar -cC /etc/apt . | lxc exec "${1}" -- tar -xC /etc/apt
+}
+
+install_packages_in_container() {
+    local container="${1}"
+    shift
+    local packages="${*}"
+
+    echo "### Installing dependencies in member server container: ${packages}"
+    lxc exec "${container}" --env DEBIAN_FRONTEND=noninteractive -- apt-get update -q
+    lxc exec "${container}" --env DEBIAN_FRONTEND=noninteractive -- apt-get dist-upgrade -q -y
+    lxc exec "${container}" --env DEBIAN_FRONTEND=noninteractive -- apt-get install -q -y ${packages}
+}