selftest/target/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 package Samba4;
   7
   8 use strict;
   9 use Cwd qw(abs_path);
  10 use FindBin qw($RealBin);
  11 use POSIX;
  12 use SocketWrapper;
  13 use target::Samba;
  14 use target::Samba3;
  15
  16 sub new($$$$$) {
  17         my ($classname, $bindir, $ldap, $srcdir, $server_maxtime) = @_;
  18
  19         my $self = {
  20                 vars => {},
  21                 ldap => $ldap,
  22                 bindir => $bindir,
  23                 srcdir => $srcdir,
  24                 server_maxtime => $server_maxtime,
  25                 target3 => new Samba3($bindir, $srcdir, $server_maxtime)
  26         };
  27         bless $self;
  28         return $self;
  29 }
  30
  31 sub scriptdir_path($$) {
  32         my ($self, $path) = @_;
  33         return "$self->{srcdir}/source4/scripting/$path";
  34 }
  35
  36 sub openldap_start($$$) {
  37 }
  38
  39 sub slapd_start($$)
  40 {
  41         my $count = 0;
  42         my ($self, $env_vars, $STDIN_READER) = @_;
  43         my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
  44
  45         my $uri = $env_vars->{LDAP_URI};
  46
  47         if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
  48             print "A SLAPD is still listening to $uri before we started the LDAP backend.  Aborting!";
  49             return 1;
  50         }
  51         # running slapd in the background means it stays in the same process group, so it can be
  52         # killed by timelimit
  53         my $pid = fork();
  54         if ($pid == 0) {
  55                 open STDOUT, ">$env_vars->{LDAPDIR}/logs";
  56                 open STDERR, '>&STDOUT';
  57                 close($env_vars->{STDIN_PIPE});
  58                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
  59
  60                 if ($self->{ldap} eq "fedora-ds") {
  61                         exec("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd", "-D", $env_vars->{FEDORA_DS_DIR}, "-d0", "-i", $env_vars->{FEDORA_DS_PIDFILE});
  62                 } elsif ($self->{ldap} eq "openldap") {
  63                         exec($ENV{OPENLDAP_SLAPD}, "-dnone", "-F", $env_vars->{SLAPD_CONF_D}, "-h", $uri);
  64                 }
  65                 die("Unable to start slapd: $!");
  66         }
  67         $env_vars->{SLAPD_PID} = $pid;
  68         sleep(1);
  69         while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
  70                 $count++;
  71                 if ($count > 40) {
  72                         $self->slapd_stop($env_vars);
  73                         return 0;
  74                 }
  75                 sleep(1);
  76         }
  77         return 1;
  78 }
  79
  80 sub slapd_stop($$)
  81 {
  82         my ($self, $envvars) = @_;
  83         kill 9, $envvars->{SLAPD_PID};
  84         return 1;
  85 }
  86
  87 sub check_or_start($$$)
  88 {
  89         my ($self, $env_vars, $process_model) = @_;
  90         my $STDIN_READER;
  91
  92         my $env_ok = $self->check_env($env_vars);
  93         if ($env_ok) {
  94                 return $env_vars->{SAMBA_PID};
  95         } elsif (defined($env_vars->{SAMBA_PID})) {
  96                 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
  97                 return undef;
  98         }
  99
 100         # use a pipe for stdin in the child processes. This allows
 101         # those processes to monitor the pipe for EOF to ensure they
 102         # exit when the test script exits
 103         pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
 104
 105         # Start slapd before samba, but with the fifo on stdin
 106         if (defined($self->{ldap})) {
 107                 unless($self->slapd_start($env_vars, $STDIN_READER)) {
 108                         warn("couldn't start slapd (main run)");
 109                         return undef;
 110                 }
 111         }
 112
 113         print "STARTING SAMBA...\n";
 114         my $pid = fork();
 115         if ($pid == 0) {
 116                 # we want out from samba to go to the log file, but also
 117                 # to the users terminal when running 'make test' on the command
 118                 # line. This puts it on stderr on the terminal
 119                 open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
 120                 open STDERR, '>&STDOUT';
 121
 122                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
 123
 124                 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
 125                 $ENV{KRB5CCNAME} = "$env_vars->{KRB5_CCACHE}.samba";
 126                 $ENV{SELFTEST_WINBINDD_SOCKET_DIR} = $env_vars->{SELFTEST_WINBINDD_SOCKET_DIR};
 127                 $ENV{NMBD_SOCKET_DIR} = $env_vars->{NMBD_SOCKET_DIR};
 128
 129                 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
 130                 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
 131                 $ENV{NSS_WRAPPER_HOSTS} = $env_vars->{NSS_WRAPPER_HOSTS};
 132                 $ENV{NSS_WRAPPER_HOSTNAME} = $env_vars->{NSS_WRAPPER_HOSTNAME};
 133                 $ENV{NSS_WRAPPER_MODULE_SO_PATH} = $env_vars->{NSS_WRAPPER_MODULE_SO_PATH};
 134                 $ENV{NSS_WRAPPER_MODULE_FN_PREFIX} = $env_vars->{NSS_WRAPPER_MODULE_FN_PREFIX};
 135
 136                 if (defined($env_vars->{RESOLV_WRAPPER_CONF})) {
 137                         $ENV{RESOLV_WRAPPER_CONF} = $env_vars->{RESOLV_WRAPPER_CONF};
 138                 } else {
 139                         $ENV{RESOLV_WRAPPER_HOSTS} = $env_vars->{RESOLV_WRAPPER_HOSTS};
 140                 }
 141
 142                 $ENV{UID_WRAPPER} = "1";
 143                 $ENV{UID_WRAPPER_ROOT} = "1";
 144
 145                 $ENV{MAKE_TEST_BINARY} = Samba::bindir_path($self, "samba");
 146                 my @preargs = ();
 147                 my @optargs = ();
 148                 if (defined($ENV{SAMBA_OPTIONS})) {
 149                         @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
 150                 }
 151                 if(defined($ENV{SAMBA_VALGRIND})) {
 152                         @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
 153                 }
 154
 155                 close($env_vars->{STDIN_PIPE});
 156                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 157
 158                 exec(@preargs, Samba::bindir_path($self, "samba"), "-M", $process_model, "-i", "--maximum-runtime=$self->{server_maxtime}", $env_vars->{CONFIGURATION}, @optargs) or die("Unable to start samba: $!");
 159         }
 160         $env_vars->{SAMBA_PID} = $pid;
 161         print "DONE ($pid)\n";
 162
 163         close($STDIN_READER);
 164
 165         if ($self->wait_for_start($env_vars) != 0) {
 166             warn("Samba $pid failed to start up");
 167             return undef;
 168         }
 169
 170         return $pid;
 171 }
 172
 173 sub wait_for_start($$)
 174 {
 175         my ($self, $testenv_vars) = @_;
 176         my $count = 0;
 177         my $ret = 0;
 178
 179         if (not $self->check_env($testenv_vars)) {
 180             warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
 181             return -1;
 182         }
 183
 184         # This will return quickly when things are up, but be slow if we
 185         # need to wait for (eg) SSL init
 186         my $nmblookup =  Samba::bindir_path($self, "nmblookup4");
 187
 188         do {
 189                 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 190                 if ($ret != 0) {
 191                         sleep(1);
 192                 } else {
 193                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 194                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 195                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 196                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 197                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 198                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 199                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 200                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 201                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 202                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 203                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 204                 }
 205                 $count++;
 206         } while ($ret != 0 && $count < 20);
 207         if ($count == 10) {
 208                 warn("nbt not reachable after 20 retries\n");
 209                 teardown_env($self, $testenv_vars);
 210                 return 0;
 211         }
 212
 213         # Ensure we have the first RID Set before we start tests.  This makes the tests more reliable.
 214         if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
 215                 # Add hosts file for name lookups
 216                 $ENV{NSS_WRAPPER_HOSTS} = $testenv_vars->{NSS_WRAPPER_HOSTS};
 217                 if (defined($testenv_vars->{RESOLV_WRAPPER_CONF})) {
 218                         $ENV{RESOLV_WRAPPER_CONF} = $testenv_vars->{RESOLV_WRAPPER_CONF};
 219                 } else {
 220                         $ENV{RESOLV_WRAPPER_HOSTS} = $testenv_vars->{RESOLV_WRAPPER_HOSTS};
 221                 }
 222
 223                 print "waiting for working LDAP and a RID Set to be allocated\n";
 224                 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
 225                 my $count = 0;
 226                 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
 227
 228                 my $search_dn = $base_dn;
 229                 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
 230                         # TODO currently no check for actual rIDAllocationPool
 231                         $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
 232                 }
 233                 my $max_wait = 60;
 234                 my $cmd = "$ldbsearch $testenv_vars->{CONFIGURATION} -H ldap://$testenv_vars->{SERVER} -U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} -s base -b \"$search_dn\"";
 235                 while (system("$cmd >/dev/null") != 0) {
 236                         $count++;
 237                         if ($count > $max_wait) {
 238                                 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
 239                                 $ret = -1;
 240                                 last;
 241                         }
 242                         sleep(1);
 243                 }
 244         }
 245         print $self->getlog_env($testenv_vars);
 246
 247         return $ret
 248 }
 249
 250 sub write_ldb_file($$$)
 251 {
 252         my ($self, $file, $ldif) = @_;
 253
 254         my $ldbadd =  Samba::bindir_path($self, "ldbadd");
 255         open(LDIF, "|$ldbadd -H $file >/dev/null");
 256         print LDIF $ldif;
 257         return(close(LDIF));
 258 }
 259
 260 sub add_wins_config($$)
 261 {
 262         my ($self, $privatedir) = @_;
 263
 264         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 265 dn: name=TORTURE_11,CN=PARTNERS
 266 objectClass: wreplPartner
 267 name: TORTURE_11
 268 address: 127.0.0.11
 269 pullInterval: 0
 270 pushChangeCount: 0
 271 type: 0x3
 272 ");
 273 }
 274
 275 sub mk_fedora_ds($$)
 276 {
 277         my ($self, $ctx) = @_;
 278
 279         #Make the subdirectory be as fedora DS would expect
 280         my $fedora_ds_dir = "$ctx->{ldapdir}/slapd-$ctx->{ldap_instance}";
 281
 282         my $pidfile = "$fedora_ds_dir/logs/slapd-$ctx->{ldap_instance}.pid";
 283
 284         return ($fedora_ds_dir, $pidfile);
 285 }
 286
 287 sub mk_openldap($$)
 288 {
 289         my ($self, $ctx) = @_;
 290
 291         my $slapd_conf_d = "$ctx->{ldapdir}/slapd.d";
 292         my $pidfile = "$ctx->{ldapdir}/slapd.pid";
 293
 294         return ($slapd_conf_d, $pidfile);
 295 }
 296
 297 sub setup_namespaces($$:$$)
 298 {
 299         my ($self, $localenv, $upn_array, $spn_array) = @_;
 300
 301         @{$upn_array} = [] unless defined($upn_array);
 302         my $upn_args = "";
 303         foreach my $upn (@{$upn_array}) {
 304                 $upn_args .= " --add-upn-suffix=$upn";
 305         }
 306
 307         @{$spn_array} = [] unless defined($spn_array);
 308         my $spn_args = "";
 309         foreach my $spn (@{$spn_array}) {
 310                 $spn_args .= " --add-spn-suffix=$spn";
 311         }
 312
 313         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 314
 315         my $cmd_env = "";
 316         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 317         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 318                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 319         } else {
 320                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 321         }
 322         $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 323         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 324
 325         my $cmd_config = " $localenv->{CONFIGURATION}";
 326
 327         my $namespaces = $cmd_env;
 328         $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
 329         $namespaces .= $cmd_config;
 330         unless (system($namespaces) == 0) {
 331                 warn("Failed to add namespaces \n$namespaces");
 332                 return;
 333         }
 334
 335         return;
 336 }
 337
 338 sub setup_trust($$$$$)
 339 {
 340         my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
 341
 342         $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
 343         $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
 344         $localenv->{TRUST_SERVER_IPV6} = $remoteenv->{SERVER_IPV6};
 345         $localenv->{TRUST_NETBIOSNAME} = $remoteenv->{NETBIOSNAME};
 346         $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
 347         $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
 348         $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
 349         $localenv->{TRUST_REALM} = $remoteenv->{REALM};
 350
 351         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 352         # setup the trust
 353         my $cmd_env = "";
 354         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 355         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 356                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 357         } else {
 358                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 359         }
 360         $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 361         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 362
 363         my $cmd_config = " $localenv->{CONFIGURATION}";
 364         my $cmd_creds = $cmd_config;
 365         $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
 366
 367         my $create = $cmd_env;
 368         $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
 369         $create .= " $extra_args";
 370         $create .= $cmd_creds;
 371         unless (system($create) == 0) {
 372                 warn("Failed to create trust \n$create");
 373                 return undef;
 374         }
 375
 376         return $localenv
 377 }
 378
 379 sub provision_raw_prepare($$$$$$$$$$$)
 380 {
 381         my ($self, $prefix, $server_role, $hostname,
 382             $domain, $realm, $functional_level,
 383             $password, $kdc_ipv4, $kdc_ipv6) = @_;
 384         my $ctx;
 385         my $netbiosname = uc($hostname);
 386
 387         unless(-d $prefix or mkdir($prefix, 0777)) {
 388                 warn("Unable to create $prefix");
 389                 return undef;
 390         }
 391         my $prefix_abs = abs_path($prefix);
 392
 393         die ("prefix=''") if $prefix_abs eq "";
 394         die ("prefix='/'") if $prefix_abs eq "/";
 395
 396         unless (system("rm -rf $prefix_abs/*") == 0) {
 397                 warn("Unable to clean up");
 398         }
 399
 400
 401         my $swiface = Samba::get_interface($hostname);
 402
 403         $ctx->{prefix} = $prefix;
 404         $ctx->{prefix_abs} = $prefix_abs;
 405
 406         $ctx->{server_role} = $server_role;
 407         $ctx->{hostname} = $hostname;
 408         $ctx->{netbiosname} = $netbiosname;
 409         $ctx->{swiface} = $swiface;
 410         $ctx->{password} = $password;
 411         $ctx->{kdc_ipv4} = $kdc_ipv4;
 412         $ctx->{kdc_ipv6} = $kdc_ipv6;
 413         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
 414         if ($functional_level eq "2000") {
 415                 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc"
 416         }
 417
 418 #
 419 # Set smbd log level here.
 420 #
 421         $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
 422         $ctx->{username} = "Administrator";
 423         $ctx->{domain} = $domain;
 424         $ctx->{realm} = uc($realm);
 425         $ctx->{dnsname} = lc($realm);
 426
 427         $ctx->{functional_level} = $functional_level;
 428
 429         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 430         chomp $unix_name;
 431         $ctx->{unix_name} = $unix_name;
 432         $ctx->{unix_uid} = $>;
 433         my @mygid = split(" ", $();
 434         $ctx->{unix_gid} = $mygid[0];
 435         $ctx->{unix_gids_str} = $);
 436         @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
 437
 438         $ctx->{etcdir} = "$prefix_abs/etc";
 439         $ctx->{piddir} = "$prefix_abs/pid";
 440         $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
 441         $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
 442         $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
 443         $ctx->{privatedir} = "$prefix_abs/private";
 444         $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
 445         $ctx->{lockdir} = "$prefix_abs/lockdir";
 446         $ctx->{logdir} = "$prefix_abs/logs";
 447         $ctx->{statedir} = "$prefix_abs/statedir";
 448         $ctx->{cachedir} = "$prefix_abs/cachedir";
 449         $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
 450         $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
 451         $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
 452         $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
 453         $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
 454         $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
 455         if ($ENV{SAMBA_DNS_FAKING}) {
 456                 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 457                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
 458         } else {
 459                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces";
 460                 $ctx->{use_resolv_wrapper} = 1;
 461         }
 462         $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
 463
 464         $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
 465
 466         $ctx->{ipv4} = "127.0.0.$swiface";
 467         $ctx->{ipv6} = sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
 468         $ctx->{interfaces} = "$ctx->{ipv4}/8 $ctx->{ipv6}/64";
 469
 470         push(@{$ctx->{directories}}, $ctx->{privatedir});
 471         push(@{$ctx->{directories}}, $ctx->{etcdir});
 472         push(@{$ctx->{directories}}, $ctx->{piddir});
 473         push(@{$ctx->{directories}}, $ctx->{lockdir});
 474         push(@{$ctx->{directories}}, $ctx->{logdir});
 475         push(@{$ctx->{directories}}, $ctx->{statedir});
 476         push(@{$ctx->{directories}}, $ctx->{cachedir});
 477
 478         $ctx->{smb_conf_extra_options} = "";
 479
 480         my @provision_options = ();
 481         push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
 482         push (@provision_options, "KRB5_CCACHE=\"$ctx->{krb5_ccache}\"");
 483         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
 484         push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
 485         push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
 486         push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
 487         if (defined($ctx->{use_resolv_wrapper})) {
 488                 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
 489         } else {
 490                 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
 491         }
 492         if (defined($ENV{GDB_PROVISION})) {
 493                 push (@provision_options, "gdb --args");
 494                 if (!defined($ENV{PYTHON})) {
 495                     push (@provision_options, "env");
 496                     push (@provision_options, "python");
 497                 }
 498         }
 499         if (defined($ENV{VALGRIND_PROVISION})) {
 500                 push (@provision_options, "valgrind");
 501                 if (!defined($ENV{PYTHON})) {
 502                     push (@provision_options, "env");
 503                     push (@provision_options, "python");
 504                 }
 505         }
 506         if (defined($ENV{PYTHON})) {
 507                 push (@provision_options, $ENV{PYTHON});
 508         }
 509         push (@provision_options, Samba::bindir_path($self, "samba-tool"));
 510         push (@provision_options, "domain");
 511         push (@provision_options, "provision");
 512         push (@provision_options, "--configfile=$ctx->{smb_conf}");
 513         push (@provision_options, "--host-name=$ctx->{hostname}");
 514         push (@provision_options, "--host-ip=$ctx->{ipv4}");
 515         push (@provision_options, "--quiet");
 516         push (@provision_options, "--domain=$ctx->{domain}");
 517         push (@provision_options, "--realm=$ctx->{realm}");
 518         push (@provision_options, "--adminpass=$ctx->{password}");
 519         push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
 520         push (@provision_options, "--machinepass=machine$ctx->{password}");
 521         push (@provision_options, "--root=$ctx->{unix_name}");
 522         push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
 523         push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
 524
 525         @{$ctx->{provision_options}} = @provision_options;
 526
 527         return $ctx;
 528 }
 529
 530 #
 531 # Step1 creates the basic configuration
 532 #
 533 sub provision_raw_step1($$)
 534 {
 535         my ($self, $ctx) = @_;
 536
 537         mkdir($_, 0777) foreach (@{$ctx->{directories}});
 538
 539         ##
 540         ## lockdir and piddir must be 0755
 541         ##
 542         chmod 0755, $ctx->{lockdir};
 543         chmod 0755, $ctx->{piddir};
 544
 545         unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
 546                 warn("can't open $ctx->{smb_conf}$?");
 547                 return undef;
 548         }
 549
 550         Samba::prepare_keyblobs($ctx);
 551         my $crlfile = "$ctx->{tlsdir}/crl.pem";
 552         $crlfile = "" unless -e ${crlfile};
 553
 554         print CONFFILE "
 555 [global]
 556         netbios name = $ctx->{netbiosname}
 557         posix:eadb = $ctx->{statedir}/eadb.tdb
 558         workgroup = $ctx->{domain}
 559         realm = $ctx->{realm}
 560         private dir = $ctx->{privatedir}
 561         pid directory = $ctx->{piddir}
 562         ncalrpc dir = $ctx->{ncalrpcdir}
 563         lock dir = $ctx->{lockdir}
 564         state directory = $ctx->{statedir}
 565         cache directory = $ctx->{cachedir}
 566         winbindd socket directory = $ctx->{winbindd_socket_dir}
 567         ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
 568         winbind separator = /
 569         interfaces = $ctx->{interfaces}
 570         tls dh params file = $ctx->{tlsdir}/dhparms.pem
 571         tls crlfile = ${crlfile}
 572         tls verify peer = no_check
 573         panic action = $RealBin/gdb_backtrace \%d
 574         wins support = yes
 575         server role = $ctx->{server_role}
 576         server services = +echo +smb -s3fs
 577         dcerpc endpoint servers = +winreg +srvsvc
 578         notify:inotify = false
 579         ldb:nosync = true
 580         ldap server require strong auth = yes
 581 #We don't want to pass our self-tests if the PAC code is wrong
 582         gensec:require_pac = true
 583         log file = $ctx->{logdir}/log.\%m
 584         log level = $ctx->{server_loglevel}
 585         lanman auth = Yes
 586         ntlm auth = Yes
 587         rndc command = true
 588         dns update command = $ctx->{samba_dnsupdate}
 589         spn update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
 590         dreplsrv:periodic_startup_interval = 0
 591         dsdb:schema update allowed = yes
 592
 593         vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
 594
 595         idmap_ldb:use rfc2307=yes
 596         winbind enum users = yes
 597         winbind enum groups = yes
 598
 599         rpc server port:netlogon = 1026
 600
 601 ";
 602
 603         print CONFFILE "
 604
 605         # Begin extra options
 606         $ctx->{smb_conf_extra_options}
 607         # End extra options
 608 ";
 609         close(CONFFILE);
 610
 611         #Default the KDC IP to the server's IP
 612         if (not defined($ctx->{kdc_ipv4})) {
 613                 $ctx->{kdc_ipv4} = $ctx->{ipv4};
 614         }
 615         if (not defined($ctx->{kdc_ipv6})) {
 616                 $ctx->{kdc_ipv6} = $ctx->{ipv6};
 617         }
 618
 619         Samba::mk_krb5_conf($ctx);
 620
 621         open(PWD, ">$ctx->{nsswrap_passwd}");
 622         if ($ctx->{unix_uid} != 0) {
 623                 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
 624         }
 625         print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
 626         print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
 627 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 628 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 629 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 630 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 631 ";
 632         close(PWD);
 633         my $uid_rfc2307test = 65533;
 634
 635         open(GRP, ">$ctx->{nsswrap_group}");
 636         if ($ctx->{unix_gid} != 0) {
 637                 print GRP "root:x:0:\n";
 638         }
 639         print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
 640         print GRP "wheel:x:10:
 641 users:x:65531:
 642 nobody:x:65533:
 643 nogroup:x:65534:nobody
 644 ";
 645         close(GRP);
 646         my $gid_rfc2307test = 65532;
 647
 648         my $hostname = lc($ctx->{hostname});
 649         open(HOSTS, ">>$ctx->{nsswrap_hosts}");
 650         if ($hostname eq "localdc") {
 651                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 652                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 653         } else {
 654                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 655                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 656         }
 657         close(HOSTS);
 658
 659         if (defined($ctx->{resolv_conf})) {
 660                 open(RESOLV_CONF, ">$ctx->{resolv_conf}");
 661                 print RESOLV_CONF "nameserver $ctx->{kdc_ipv4}\n";
 662                 print RESOLV_CONF "nameserver $ctx->{kdc_ipv6}\n";
 663                 close(RESOLV_CONF);
 664         }
 665
 666         my $configuration = "--configfile=$ctx->{smb_conf}";
 667
 668 #Ensure the config file is valid before we start
 669         my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
 670         if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 671                 system("$testparm -v --suppress-prompt $configuration >&2");
 672                 warn("Failed to create a valid smb.conf configuration $testparm!");
 673                 return undef;
 674         }
 675         unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
 676                 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
 677                 return undef;
 678         }
 679
 680         my $ret = {
 681                 KRB5_CONFIG => $ctx->{krb5_conf},
 682                 KRB5_CCACHE => $ctx->{krb5_ccache},
 683                 PIDDIR => $ctx->{piddir},
 684                 SERVER => $ctx->{hostname},
 685                 SERVER_IP => $ctx->{ipv4},
 686                 SERVER_IPV6 => $ctx->{ipv6},
 687                 NETBIOSNAME => $ctx->{netbiosname},
 688                 DOMAIN => $ctx->{domain},
 689                 USERNAME => $ctx->{username},
 690                 REALM => $ctx->{realm},
 691                 PASSWORD => $ctx->{password},
 692                 LDAPDIR => $ctx->{ldapdir},
 693                 LDAP_INSTANCE => $ctx->{ldap_instance},
 694                 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
 695                 NCALRPCDIR => $ctx->{ncalrpcdir},
 696                 LOCKDIR => $ctx->{lockdir},
 697                 STATEDIR => $ctx->{statedir},
 698                 CACHEDIR => $ctx->{cachedir},
 699                 PRIVATEDIR => $ctx->{privatedir},
 700                 SERVERCONFFILE => $ctx->{smb_conf},
 701                 CONFIGURATION => $configuration,
 702                 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
 703                 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
 704                 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
 705                 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
 706                 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
 707                 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
 708                 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
 709                 SAMBA_TEST_LOG_POS => 0,
 710                 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
 711                 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
 712                 LOCAL_PATH => $ctx->{share},
 713                 UID_RFC2307TEST => $uid_rfc2307test,
 714                 GID_RFC2307TEST => $gid_rfc2307test,
 715                 SERVER_ROLE => $ctx->{server_role},
 716                 RESOLV_CONF => $ctx->{resolv_conf}
 717         };
 718
 719         if (defined($ctx->{use_resolv_wrapper})) {
 720                 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
 721         } else {
 722                 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
 723         }
 724
 725         return $ret;
 726 }
 727
 728 #
 729 # Step2 runs the provision script
 730 #
 731 sub provision_raw_step2($$$)
 732 {
 733         my ($self, $ctx, $ret) = @_;
 734
 735         my $provision_cmd = join(" ", @{$ctx->{provision_options}});
 736         unless (system($provision_cmd) == 0) {
 737                 warn("Unable to provision: \n$provision_cmd\n");
 738                 return undef;
 739         }
 740
 741         my $testallowed_account = "testallowed";
 742         my $samba_tool_cmd = "";
 743         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 744         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 745         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 746             . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
 747         unless (system($samba_tool_cmd) == 0) {
 748                 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
 749                 return undef;
 750         }
 751
 752         my $ldbmodify = "";
 753         $ldbmodify .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 754         $ldbmodify .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 755         $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
 756         my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
 757
 758         if ($ctx->{server_role} ne "domain controller") {
 759                 $base_dn = "DC=$ctx->{netbiosname}";
 760         }
 761
 762         my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
 763         $testallowed_account = "testallowed account";
 764         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 765         print LDIF "dn: $user_dn
 766 changetype: modify
 767 replace: samAccountName
 768 samAccountName: $testallowed_account
 769 -
 770 ";
 771         close(LDIF);
 772
 773         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 774         print LDIF "dn: $user_dn
 775 changetype: modify
 776 replace: userPrincipalName
 777 userPrincipalName: testallowed upn\@$ctx->{realm}
 778 replace: servicePrincipalName
 779 servicePrincipalName: host/testallowed
 780 -
 781 ";
 782         close(LDIF);
 783
 784         $samba_tool_cmd = "";
 785         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 786         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 787         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 788             . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
 789         unless (system($samba_tool_cmd) == 0) {
 790                 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
 791                 return undef;
 792         }
 793
 794         my $user_dn = "cn=testdenied,cn=users,$base_dn";
 795         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 796         print LDIF "dn: $user_dn
 797 changetype: modify
 798 replace: userPrincipalName
 799 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
 800 -
 801 ";
 802         close(LDIF);
 803
 804         $samba_tool_cmd = "";
 805         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 806         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 807         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 808             . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
 809         unless (system($samba_tool_cmd) == 0) {
 810                 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
 811                 return undef;
 812         }
 813
 814         # Create to users alice and bob!
 815         my $user_account_array = ["alice", "bob"];
 816
 817         foreach my $user_account (@{$user_account_array}) {
 818                 my $samba_tool_cmd = "";
 819
 820                 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 821                 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 822                 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 823                     . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
 824                 unless (system($samba_tool_cmd) == 0) {
 825                         warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
 826                         return undef;
 827                 }
 828         }
 829
 830         return $ret;
 831 }
 832
 833 sub provision($$$$$$$$$$)
 834 {
 835         my ($self, $prefix, $server_role, $hostname,
 836             $domain, $realm, $functional_level,
 837             $password, $kdc_ipv4, $kdc_ipv6, $extra_smbconf_options, $extra_smbconf_shares,
 838             $extra_provision_options) = @_;
 839
 840         my $ctx = $self->provision_raw_prepare($prefix, $server_role,
 841                                                $hostname,
 842                                                $domain, $realm, $functional_level,
 843                                                $password, $kdc_ipv4, $kdc_ipv6);
 844
 845         if (defined($extra_provision_options)) {
 846                 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
 847         } else {
 848                 push (@{$ctx->{provision_options}}, "--use-ntvfs");
 849         }
 850
 851         $ctx->{share} = "$ctx->{prefix_abs}/share";
 852         push(@{$ctx->{directories}}, "$ctx->{share}");
 853         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
 854         push(@{$ctx->{directories}}, "$ctx->{share}/test2");
 855
 856         # precreate directories for printer drivers
 857         push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
 858         push(@{$ctx->{directories}}, "$ctx->{share}/x64");
 859         push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
 860
 861         my $msdfs = "no";
 862         $msdfs = "yes" if ($server_role eq "domain controller");
 863         $ctx->{smb_conf_extra_options} = "
 864
 865         max xmit = 32K
 866         server max protocol = SMB2
 867         host msdfs = $msdfs
 868         lanman auth = yes
 869
 870         # fruit:copyfile is a global option
 871         fruit:copyfile = yes
 872
 873         $extra_smbconf_options
 874
 875 [tmp]
 876         path = $ctx->{share}
 877         read only = no
 878         posix:sharedelay = 100000
 879         posix:oplocktimeout = 3
 880         posix:writetimeupdatedelay = 500000
 881
 882 [xcopy_share]
 883         path = $ctx->{share}
 884         read only = no
 885         posix:sharedelay = 100000
 886         posix:oplocktimeout = 3
 887         posix:writetimeupdatedelay = 500000
 888         create mask = 777
 889         force create mode = 777
 890
 891 [posix_share]
 892         path = $ctx->{share}
 893         read only = no
 894         create mask = 0777
 895         force create mode = 0
 896         directory mask = 0777
 897         force directory mode = 0
 898
 899 [test1]
 900         path = $ctx->{share}/test1
 901         read only = no
 902         posix:sharedelay = 100000
 903         posix:oplocktimeout = 3
 904         posix:writetimeupdatedelay = 500000
 905
 906 [test2]
 907         path = $ctx->{share}/test2
 908         read only = no
 909         posix:sharedelay = 100000
 910         posix:oplocktimeout = 3
 911         posix:writetimeupdatedelay = 500000
 912
 913 [cifs]
 914         path = $ctx->{share}/_ignore_cifs_
 915         read only = no
 916         ntvfs handler = cifs
 917         cifs:server = $ctx->{netbiosname}
 918         cifs:share = tmp
 919         cifs:use-s4u2proxy = yes
 920         # There is no username specified here, instead the client is expected
 921         # to log in with kerberos, and the serverwill use delegated credentials.
 922         # Or the server tries s4u2self/s4u2proxy to impersonate the client
 923
 924 [simple]
 925         path = $ctx->{share}
 926         read only = no
 927         ntvfs handler = simple
 928
 929 [sysvol]
 930         path = $ctx->{statedir}/sysvol
 931         read only = no
 932
 933 [netlogon]
 934         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
 935         read only = no
 936
 937 [cifsposix]
 938         copy = simple
 939         ntvfs handler = cifsposix
 940
 941 [vfs_fruit]
 942         path = $ctx->{share}
 943         vfs objects = catia fruit streams_xattr acl_xattr
 944         ea support = yes
 945         fruit:resource = file
 946         fruit:metadata = netatalk
 947         fruit:locking = netatalk
 948         fruit:encoding = native
 949
 950 $extra_smbconf_shares
 951 ";
 952
 953         if (defined($self->{ldap})) {
 954                 $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
 955                 push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
 956
 957                 my $ldap_uri= "$ctx->{ldapdir}/ldapi";
 958                 $ldap_uri =~ s|/|%2F|g;
 959                 $ldap_uri = "ldapi://$ldap_uri";
 960                 $ctx->{ldap_uri} = $ldap_uri;
 961
 962                 $ctx->{ldap_instance} = lc($ctx->{netbiosname});
 963         }
 964
 965         my $ret = $self->provision_raw_step1($ctx);
 966         unless (defined $ret) {
 967                 return undef;
 968         }
 969
 970         if (defined($self->{ldap})) {
 971                 $ret->{LDAP_URI} = $ctx->{ldap_uri};
 972                 push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
 973                 push (@{$ctx->{provision_options}}, "--ldap-backend-nosync");
 974                 if ($self->{ldap} eq "openldap") {
 975                         push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
 976                         ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx) or die("Unable to create openldap directories");
 977
 978                 } elsif ($self->{ldap} eq "fedora-ds") {
 979                         push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
 980                         push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
 981                         ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx) or die("Unable to create fedora ds directories");
 982                 }
 983
 984         }
 985
 986         return $self->provision_raw_step2($ctx, $ret);
 987 }
 988
 989 sub provision_s4member($$$$$)
 990 {
 991         my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
 992         print "PROVISIONING MEMBER...\n";
 993         my $extra_smb_conf = "
 994         passdb backend = samba_dsdb
 995 winbindd:use external pipes = true
 996
 997 # the source4 smb server doesn't allow signing by default
 998 server signing = enabled
 999
1000 rpc_server:default = external
1001 rpc_server:svcctl = embedded
1002 rpc_server:srvsvc = embedded
1003 rpc_server:eventlog = embedded
1004 rpc_server:ntsvcs = embedded
1005 rpc_server:winreg = embedded
1006 rpc_server:spoolss = embedded
1007 rpc_daemon:spoolssd = embedded
1008 rpc_server:tcpip = no
1009 ";
1010         if ($more_conf) {
1011                 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1012         }
1013         my $ret = $self->provision($prefix,
1014                                    "member server",
1015                                    $hostname,
1016                                    "SAMBADOMAIN",
1017                                    "samba.example.com",
1018                                    "2008",
1019                                    "locMEMpass3",
1020                                    $dcvars->{SERVER_IP},
1021                                    $dcvars->{SERVER_IPV6},
1022                                    $extra_smb_conf, "", undef);
1023         unless ($ret) {
1024                 return undef;
1025         }
1026
1027         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1028         my $cmd = "";
1029         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1030         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1031                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1032         } else {
1033                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1034         }
1035         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1036         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1037         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1038         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1039         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1040
1041         unless (system($cmd) == 0) {
1042                 warn("Join failed\n$cmd");
1043                 return undef;
1044         }
1045
1046         $ret->{MEMBER_SERVER} = $ret->{SERVER};
1047         $ret->{MEMBER_SERVER_IP} = $ret->{SERVER_IP};
1048         $ret->{MEMBER_SERVER_IPV6} = $ret->{SERVER_IPV6};
1049         $ret->{MEMBER_NETBIOSNAME} = $ret->{NETBIOSNAME};
1050         $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
1051         $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
1052
1053         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1054         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1055         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1056         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1057         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1058         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1059
1060         return $ret;
1061 }
1062
1063 sub provision_rpc_proxy($$$)
1064 {
1065         my ($self, $prefix, $dcvars) = @_;
1066         print "PROVISIONING RPC PROXY...\n";
1067
1068         my $extra_smbconf_options = "
1069         passdb backend = samba_dsdb
1070
1071         # rpc_proxy
1072         dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1073         dcerpc endpoint servers = epmapper, remote
1074         dcerpc_remote:interfaces = rpcecho
1075
1076 [cifs_to_dc]
1077         path = /tmp/_ignore_cifs_to_dc_/_none_
1078         read only = no
1079         ntvfs handler = cifs
1080         cifs:server = $dcvars->{SERVER}
1081         cifs:share = cifs
1082         cifs:use-s4u2proxy = yes
1083         # There is no username specified here, instead the client is expected
1084         # to log in with kerberos, and the serverwill use delegated credentials.
1085         # Or the server tries s4u2self/s4u2proxy to impersonate the client
1086
1087 ";
1088
1089         my $ret = $self->provision($prefix,
1090                                    "member server",
1091                                    "localrpcproxy",
1092                                    "SAMBADOMAIN",
1093                                    "samba.example.com",
1094                                    "2008",
1095                                    "locRPCproxypass4",
1096                                    $dcvars->{SERVER_IP},
1097                                    $dcvars->{SERVER_IPV6},
1098                                    $extra_smbconf_options, "", undef);
1099         unless ($ret) {
1100                 return undef;
1101         }
1102
1103         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1104
1105         # The joind runs in the context of the rpc_proxy/member for now
1106         my $cmd = "";
1107         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1108         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1109                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1110         } else {
1111                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1112         }
1113         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1114         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1115         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1116         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1117         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1118
1119         unless (system($cmd) == 0) {
1120                 warn("Join failed\n$cmd");
1121                 return undef;
1122         }
1123
1124         # Setting up delegation runs in the context of the DC for now
1125         $cmd = "";
1126         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1127         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1128         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1129         $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1130         $cmd .= " $dcvars->{CONFIGURATION}";
1131         print $cmd;
1132
1133         unless (system($cmd) == 0) {
1134                 warn("Delegation failed\n$cmd");
1135                 return undef;
1136         }
1137
1138         # Setting up delegation runs in the context of the DC for now
1139         $cmd = "";
1140         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1141         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1142         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1143         $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1144         $cmd .= " $dcvars->{CONFIGURATION}";
1145
1146         unless (system($cmd) == 0) {
1147                 warn("Delegation failed\n$cmd");
1148                 return undef;
1149         }
1150
1151         $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
1152         $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
1153         $ret->{RPC_PROXY_SERVER_IPV6} = $ret->{SERVER_IPV6};
1154         $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
1155         $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
1156         $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
1157
1158         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1159         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1160         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1161         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1162         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1163         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1164
1165         return $ret;
1166 }
1167
1168 sub provision_promoted_dc($$$)
1169 {
1170         my ($self, $prefix, $dcvars) = @_;
1171         print "PROVISIONING PROMOTED DC...\n";
1172
1173         # We do this so that we don't run the provision.  That's the job of 'samba-tool domain dcpromo'.
1174         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1175                                                "promotedvdc",
1176                                                "SAMBADOMAIN",
1177                                                "samba.example.com",
1178                                                "2008",
1179                                                $dcvars->{PASSWORD},
1180                                                $dcvars->{SERVER_IP},
1181                                                $dcvars->{SERVER_IPV6});
1182
1183         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1184
1185         $ctx->{smb_conf_extra_options} = "
1186         max xmit = 32K
1187         server max protocol = SMB2
1188
1189 [sysvol]
1190         path = $ctx->{statedir}/sysvol
1191         read only = yes
1192
1193 [netlogon]
1194         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1195         read only = no
1196
1197 ";
1198
1199         my $ret = $self->provision_raw_step1($ctx);
1200         unless ($ret) {
1201                 return undef;
1202         }
1203
1204         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1205         my $cmd = "";
1206         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1207         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1208                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1209         } else {
1210                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1211         }
1212         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1213         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1214         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1215         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1216         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1217
1218         unless (system($cmd) == 0) {
1219                 warn("Join failed\n$cmd");
1220                 return undef;
1221         }
1222
1223         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1224         my $cmd = "";
1225         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1226         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1227         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1228         $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1229         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1230         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs --dns-backend=BIND9_DLZ";
1231
1232         unless (system($cmd) == 0) {
1233                 warn("Join failed\n$cmd");
1234                 return undef;
1235         }
1236
1237         $ret->{PROMOTED_DC_SERVER} = $ret->{SERVER};
1238         $ret->{PROMOTED_DC_SERVER_IP} = $ret->{SERVER_IP};
1239         $ret->{PROMOTED_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1240         $ret->{PROMOTED_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1241
1242         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1243         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1244         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1245         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1246         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1247         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1248
1249         return $ret;
1250 }
1251
1252 sub provision_vampire_dc($$$)
1253 {
1254         my ($self, $prefix, $dcvars, $fl) = @_;
1255         print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1256         my $name = "localvampiredc";
1257
1258         if ($fl == "2000") {
1259             $name = "vampire2000dc";
1260         }
1261
1262         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1263         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1264                                                $name,
1265                                                $dcvars->{DOMAIN},
1266                                                $dcvars->{REALM},
1267                                                $fl,
1268                                                $dcvars->{PASSWORD},
1269                                                $dcvars->{SERVER_IP},
1270                                                $dcvars->{SERVER_IPV6});
1271
1272         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1273
1274         $ctx->{smb_conf_extra_options} = "
1275         max xmit = 32K
1276         server max protocol = SMB2
1277
1278 [sysvol]
1279         path = $ctx->{statedir}/sysvol
1280         read only = yes
1281
1282 [netlogon]
1283         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1284         read only = no
1285
1286 ";
1287
1288         my $ret = $self->provision_raw_step1($ctx);
1289         unless ($ret) {
1290                 return undef;
1291         }
1292
1293         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1294         my $cmd = "";
1295         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1296         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1297                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1298         } else {
1299                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1300         }
1301         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1302         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1303         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1304         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1305         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1306
1307         unless (system($cmd) == 0) {
1308                 warn("Join failed\n$cmd");
1309                 return undef;
1310         }
1311
1312         if ($fl == "2000") {
1313                 $ret->{VAMPIRE_2000_DC_SERVER} = $ret->{SERVER};
1314                 $ret->{VAMPIRE_2000_DC_SERVER_IP} = $ret->{SERVER_IP};
1315                 $ret->{VAMPIRE_2000_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1316                 $ret->{VAMPIRE_2000_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1317         } else {
1318                 $ret->{VAMPIRE_DC_SERVER} = $ret->{SERVER};
1319                 $ret->{VAMPIRE_DC_SERVER_IP} = $ret->{SERVER_IP};
1320                 $ret->{VAMPIRE_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1321                 $ret->{VAMPIRE_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1322         }
1323         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1324         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1325         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1326         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1327         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1328         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1329         $ret->{DC_REALM} = $dcvars->{DC_REALM};
1330
1331         return $ret;
1332 }
1333
1334 sub provision_subdom_dc($$$)
1335 {
1336         my ($self, $prefix, $dcvars) = @_;
1337         print "PROVISIONING SUBDOMAIN DC...\n";
1338
1339         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1340         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1341                                                "localsubdc",
1342                                                "SAMBASUBDOM",
1343                                                "sub.samba.example.com",
1344                                                "2008",
1345                                                $dcvars->{PASSWORD},
1346                                                undef);
1347
1348         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1349
1350         $ctx->{smb_conf_extra_options} = "
1351         max xmit = 32K
1352         server max protocol = SMB2
1353
1354 [sysvol]
1355         path = $ctx->{statedir}/sysvol
1356         read only = yes
1357
1358 [netlogon]
1359         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1360         read only = no
1361
1362 ";
1363
1364         my $ret = $self->provision_raw_step1($ctx);
1365         unless ($ret) {
1366                 return undef;
1367         }
1368
1369         Samba::mk_krb5_conf($ctx);
1370
1371         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1372         my $cmd = "";
1373         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1374         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1375                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1376         } else {
1377                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1378         }
1379         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1380         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1381         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{dnsname} subdomain ";
1382         $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
1383         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1384         $cmd .= " --adminpass=$ret->{PASSWORD}";
1385
1386         unless (system($cmd) == 0) {
1387                 warn("Join failed\n$cmd");
1388                 return undef;
1389         }
1390
1391         $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
1392         $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
1393         $ret->{SUBDOM_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1394         $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1395
1396         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1397         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1398         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1399         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1400         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1401         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1402
1403         return $ret;
1404 }
1405
1406 sub provision_ad_dc_ntvfs($$)
1407 {
1408         my ($self, $prefix) = @_;
1409
1410         # We keep the old 'winbind' name here in server services to
1411         # ensure upgrades which used that name still work with the now
1412         # alias.
1413
1414         print "PROVISIONING AD DC (NTVFS)...\n";
1415         my $extra_conf_options = "netbios aliases = localDC1-a
1416         server services = +winbind -winbindd
1417         ldap server require strong auth = allow_sasl_over_tls
1418         allow nt4 crypto = yes
1419         lsa over netlogon = yes
1420         rpc server port = 1027
1421         ";
1422         my $ret = $self->provision($prefix,
1423                                    "domain controller",
1424                                    "localdc",
1425                                    "SAMBADOMAIN",
1426                                    "samba.example.com",
1427                                    "2008",
1428                                    "locDCpass1",
1429                                    undef,
1430                                    undef,
1431                                    $extra_conf_options,
1432                                    "",
1433                                    undef);
1434         unless ($ret) {
1435                 return undef;
1436         }
1437
1438         unless($self->add_wins_config("$prefix/private")) {
1439                 warn("Unable to add wins configuration");
1440                 return undef;
1441         }
1442         $ret->{NETBIOSALIAS} = "localdc1-a";
1443         $ret->{DC_SERVER} = $ret->{SERVER};
1444         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1445         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1446         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1447         $ret->{DC_USERNAME} = $ret->{USERNAME};
1448         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1449         $ret->{DC_REALM} = $ret->{REALM};
1450
1451         return $ret;
1452 }
1453
1454 sub provision_fl2000dc($$)
1455 {
1456         my ($self, $prefix) = @_;
1457
1458         print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1459         my $extra_conf_options = "
1460         spnego:simulate_w2k=yes
1461         ntlmssp_server:force_old_spnego=yes
1462 ";
1463         my $ret = $self->provision($prefix,
1464                                    "domain controller",
1465                                    "dc5",
1466                                    "SAMBA2000",
1467                                    "samba2000.example.com",
1468                                    "2000",
1469                                    "locDCpass5",
1470                                    undef,
1471                                    undef,
1472                                    $extra_conf_options,
1473                                    "",
1474                                    undef);
1475         unless ($ret) {
1476                 return undef;
1477         }
1478
1479         unless($self->add_wins_config("$prefix/private")) {
1480                 warn("Unable to add wins configuration");
1481                 return undef;
1482         }
1483         $ret->{DC_SERVER} = $ret->{SERVER};
1484         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1485         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1486         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1487         $ret->{DC_USERNAME} = $ret->{USERNAME};
1488         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1489         $ret->{DC_REALM} = $ret->{REALM};
1490
1491         return $ret;
1492 }
1493
1494 sub provision_fl2003dc($$$)
1495 {
1496         my ($self, $prefix, $dcvars) = @_;
1497         my $swiface1 = Samba::get_interface("fakednsforwarder1");
1498         my $swiface2 = Samba::get_interface("fakednsforwarder2");
1499
1500         print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1501         my $extra_conf_options = "allow dns updates = nonsecure and secure
1502         dns forwarder = 127.0.0.$swiface1 127.0.0.$swiface2";
1503         my $ret = $self->provision($prefix,
1504                                    "domain controller",
1505                                    "dc6",
1506                                    "SAMBA2003",
1507                                    "samba2003.example.com",
1508                                    "2003",
1509                                    "locDCpass6",
1510                                    undef,
1511                                    undef,
1512                                    $extra_conf_options,
1513                                    "",
1514                                    undef);
1515         unless (defined $ret) {
1516                 return undef;
1517         }
1518
1519         $ret->{DC_SERVER} = $ret->{SERVER};
1520         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1521         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1522         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1523         $ret->{DC_USERNAME} = $ret->{USERNAME};
1524         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1525         $ret->{DNS_FORWARDER1} = "127.0.0.$swiface1";
1526         $ret->{DNS_FORWARDER2} = "127.0.0.$swiface2";
1527
1528         my @samba_tool_options;
1529         push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1530         push (@samba_tool_options, "domain");
1531         push (@samba_tool_options, "passwordsettings");
1532         push (@samba_tool_options, "set");
1533         push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1534         push (@samba_tool_options, "--min-pwd-age=0");
1535         push (@samba_tool_options, "--history-length=1");
1536
1537         my $samba_tool_cmd = join(" ", @samba_tool_options);
1538
1539         unless (system($samba_tool_cmd) == 0) {
1540                 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1541                 return undef;
1542         }
1543
1544         unless($self->add_wins_config("$prefix/private")) {
1545                 warn("Unable to add wins configuration");
1546                 return undef;
1547         }
1548
1549         return $ret;
1550 }
1551
1552 sub provision_fl2008r2dc($$$)
1553 {
1554         my ($self, $prefix, $dcvars) = @_;
1555
1556         print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1557         my $extra_conf_options = "ldap server require strong auth = no";
1558         my $ret = $self->provision($prefix,
1559                                    "domain controller",
1560                                    "dc7",
1561                                    "SAMBA2008R2",
1562                                    "samba2008R2.example.com",
1563                                    "2008_R2",
1564                                    "locDCpass7",
1565                                    undef,
1566                                    undef,
1567                                    $extra_conf_options,
1568                                    "",
1569                                    undef);
1570         unless (defined $ret) {
1571                 return undef;
1572         }
1573
1574         unless ($self->add_wins_config("$prefix/private")) {
1575                 warn("Unable to add wins configuration");
1576                 return undef;
1577         }
1578         $ret->{DC_SERVER} = $ret->{SERVER};
1579         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1580         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1581         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1582         $ret->{DC_USERNAME} = $ret->{USERNAME};
1583         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1584         $ret->{DC_REALM} = $ret->{REALM};
1585
1586         return $ret;
1587 }
1588
1589
1590 sub provision_rodc($$$)
1591 {
1592         my ($self, $prefix, $dcvars) = @_;
1593         print "PROVISIONING RODC...\n";
1594
1595         # We do this so that we don't run the provision.  That's the job of 'net join RODC'.
1596         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1597                                                "rodc",
1598                                                "SAMBADOMAIN",
1599                                                "samba.example.com",
1600                                                "2008",
1601                                                $dcvars->{PASSWORD},
1602                                                $dcvars->{SERVER_IP},
1603                                                $dcvars->{SERVER_IPV6});
1604         unless ($ctx) {
1605                 return undef;
1606         }
1607
1608         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1609
1610         $ctx->{share} = "$ctx->{prefix_abs}/share";
1611         push(@{$ctx->{directories}}, "$ctx->{share}");
1612
1613         $ctx->{smb_conf_extra_options} = "
1614         max xmit = 32K
1615         server max protocol = SMB2
1616
1617 [sysvol]
1618         path = $ctx->{statedir}/sysvol
1619         read only = yes
1620
1621 [netlogon]
1622         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1623         read only = yes
1624
1625 [tmp]
1626         path = $ctx->{share}
1627         read only = no
1628         posix:sharedelay = 10000
1629         posix:oplocktimeout = 3
1630         posix:writetimeupdatedelay = 50000
1631
1632 ";
1633
1634         my $ret = $self->provision_raw_step1($ctx);
1635         unless ($ret) {
1636                 return undef;
1637         }
1638
1639         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1640         my $cmd = "";
1641         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1642         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1643                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1644         } else {
1645                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1646         }
1647         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1648         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1649         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1650         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1651         $cmd .= " --server=$dcvars->{DC_SERVER} --use-ntvfs";
1652
1653         unless (system($cmd) == 0) {
1654                 warn("RODC join failed\n$cmd");
1655                 return undef;
1656         }
1657
1658         # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1659         # user password verified on the RODC
1660         my $testallowed_account = "testallowed account";
1661         $cmd = "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1662         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1663         $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1664         $cmd .= " --server=$dcvars->{DC_SERVER}";
1665
1666         unless (system($cmd) == 0) {
1667                 warn("RODC join failed\n$cmd");
1668                 return undef;
1669         }
1670
1671         # we overwrite the kdc after the RODC join
1672         # so that use the RODC as kdc and test
1673         # the proxy code
1674         $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1675         $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1676         Samba::mk_krb5_conf($ctx);
1677
1678         $ret->{RODC_DC_SERVER} = $ret->{SERVER};
1679         $ret->{RODC_DC_SERVER_IP} = $ret->{SERVER_IP};
1680         $ret->{RODC_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1681         $ret->{RODC_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1682
1683         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1684         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1685         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1686         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1687         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1688         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1689
1690         return $ret;
1691 }
1692
1693 sub read_config_h($)
1694 {
1695         my ($name) = @_;
1696         my %ret = {};
1697         open(LF, "<$name") or die("unable to read $name: $!");
1698         while (<LF>) {
1699                 chomp;
1700                 next if not (/^#define /);
1701                 if (/^#define (.*?)[ \t]+(.*?)$/) {
1702                         $ret{$1} = $2;
1703                         next;
1704                 }
1705                 if (/^#define (.*?)[ \t]+$/) {
1706                         $ret{$1} = 1;;
1707                         next;
1708                 }
1709         }
1710         close(LF);
1711         return \%ret;
1712 }
1713
1714 sub provision_ad_dc($$)
1715 {
1716         my ($self, $prefix) = @_;
1717
1718         my $prefix_abs = abs_path($prefix);
1719
1720         my $bindir_abs = abs_path($self->{bindir});
1721         my $lockdir="$prefix_abs/lockdir";
1722         my $conffile="$prefix_abs/etc/smb.conf";
1723
1724         my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
1725         $require_mutexes = "" if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} eq "1");
1726
1727         my $config_h = {};
1728
1729         if (defined($ENV{CONFIG_H})) {
1730                 $config_h = read_config_h($ENV{CONFIG_H});
1731         }
1732
1733         my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
1734         $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
1735
1736         my $extra_smbconf_options = "
1737         server services = -smb +s3fs
1738         xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1739
1740         dbwrap_tdb_mutexes:* = yes
1741         ${require_mutexes}
1742
1743         ${password_hash_gpg_key_ids}
1744
1745         kernel oplocks = no
1746         kernel change notify = no
1747         smb2 leases = no
1748
1749         logging = file
1750         printing = bsd
1751         printcap name = /dev/null
1752
1753         max protocol = SMB3
1754         read only = no
1755
1756         smbd:sharedelay = 100000
1757         smbd:writetimeupdatedelay = 500000
1758         create mask = 755
1759         dos filemode = yes
1760
1761         dcerpc endpoint servers = -winreg -srvsvc
1762
1763         printcap name = /dev/null
1764
1765         addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1766         deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1767
1768         printing = vlp
1769         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1770         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1771         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1772         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1773         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1774         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1775         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1776         lpq cache time = 0
1777         print notify backchannel = yes
1778 ";
1779
1780         my $extra_smbconf_shares = "
1781
1782 [tmpenc]
1783         copy = tmp
1784         smb encrypt = required
1785
1786 [tmpcase]
1787         copy = tmp
1788         case sensitive = yes
1789
1790 [tmpguest]
1791         copy = tmp
1792         guest ok = yes
1793
1794 [hideunread]
1795         copy = tmp
1796         hide unreadable = yes
1797
1798 [durable]
1799         copy = tmp
1800         kernel share modes = no
1801         kernel oplocks = no
1802         posix locking = no
1803
1804 [print\$]
1805         copy = tmp
1806
1807 [print1]
1808         copy = tmp
1809         printable = yes
1810
1811 [print2]
1812         copy = print1
1813 [print3]
1814         copy = print1
1815 [lp]
1816         copy = print1
1817 ";
1818
1819         print "PROVISIONING AD DC...\n";
1820         my $ret = $self->provision($prefix,
1821                                    "domain controller",
1822                                    "addc",
1823                                    "ADDOMAIN",
1824                                    "addom.samba.example.com",
1825                                    "2008",
1826                                    "locDCpass1",
1827                                    undef,
1828                                    undef,
1829                                    $extra_smbconf_options,
1830                                    $extra_smbconf_shares,
1831                                    undef);
1832         unless (defined $ret) {
1833                 return undef;
1834         }
1835
1836         unless($self->add_wins_config("$prefix/private")) {
1837                 warn("Unable to add wins configuration");
1838                 return undef;
1839         }
1840
1841         $ret->{DC_SERVER} = $ret->{SERVER};
1842         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1843         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1844         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1845         $ret->{DC_USERNAME} = $ret->{USERNAME};
1846         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1847
1848         return $ret;
1849 }
1850
1851 sub provision_chgdcpass($$)
1852 {
1853         my ($self, $prefix) = @_;
1854
1855         print "PROVISIONING CHGDCPASS...\n";
1856         my $extra_provision_options = undef;
1857         # This environment disallows the use of this password
1858         # (and also removes the default AD complexity checks)
1859         my $unacceptable_password = "widk3Dsle32jxdBdskldsk55klASKQ";
1860         push (@{$extra_provision_options}, "--dns-backend=BIND9_DLZ");
1861         my $ret = $self->provision($prefix,
1862                                    "domain controller",
1863                                    "chgdcpass",
1864                                    "CHDCDOMAIN",
1865                                    "chgdcpassword.samba.example.com",
1866                                    "2008",
1867                                    "chgDCpass1",
1868                                    undef,
1869                                    undef,
1870                                    "check password script = sed -e '/$unacceptable_password/{;q1}; /$unacceptable_password/!{q0}'\n",
1871                                    "",
1872                                    $extra_provision_options);
1873         unless (defined $ret) {
1874                 return undef;
1875         }
1876
1877         unless($self->add_wins_config("$prefix/private")) {
1878                 warn("Unable to add wins configuration");
1879                 return undef;
1880         }
1881
1882         # Remove secrets.tdb from this environment to test that we
1883         # still start up on systems without the new matching
1884         # secrets.tdb records.
1885         unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
1886                 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
1887                 return undef;
1888         }
1889
1890         $ret->{DC_SERVER} = $ret->{SERVER};
1891         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1892         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1893         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1894         $ret->{DC_USERNAME} = $ret->{USERNAME};
1895         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1896         $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
1897
1898         return $ret;
1899 }
1900
1901 sub teardown_env_terminate($$)
1902 {
1903         my ($self, $envvars) = @_;
1904         my $pid;
1905
1906         # This should cause samba to terminate gracefully
1907         close($envvars->{STDIN_PIPE});
1908
1909         $pid = $envvars->{SAMBA_PID};
1910         my $count = 0;
1911         my $childpid;
1912
1913         # This should give it time to write out the gcov data
1914         until ($count > 15) {
1915             if (Samba::cleanup_child($pid, "samba") != 0) {
1916                 return;
1917             }
1918             sleep(1);
1919             $count++;
1920         }
1921
1922         # After 15 Seconds, work out why this thing is still alive
1923         warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
1924         system("$self->{srcdir}/selftest/gdb_backtrace $pid");
1925
1926         until ($count > 30) {
1927             if (Samba::cleanup_child($pid, "samba") != 0) {
1928                 return;
1929             }
1930             sleep(1);
1931             $count++;
1932         }
1933
1934         if (kill(0, $pid)) {
1935             warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
1936             kill "TERM", $pid;
1937         }
1938
1939         until ($count > 40) {
1940             if (Samba::cleanup_child($pid, "samba") != 0) {
1941                 return;
1942             }
1943             sleep(1);
1944             $count++;
1945         }
1946         # If it is still around, kill it
1947         if (kill(0, $pid)) {
1948             warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
1949             kill 9, $pid;
1950         }
1951         return;
1952 }
1953
1954 sub teardown_env($$)
1955 {
1956         my ($self, $envvars) = @_;
1957         teardown_env_terminate($self, $envvars);
1958
1959         $self->slapd_stop($envvars) if ($self->{ldap});
1960
1961         print $self->getlog_env($envvars);
1962
1963         return;
1964 }
1965
1966 sub getlog_env($$)
1967 {
1968         my ($self, $envvars) = @_;
1969         my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
1970         my $out = $title;
1971
1972         open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
1973
1974         seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
1975         while (<LOG>) {
1976                 $out .= $_;
1977         }
1978         $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
1979         close(LOG);
1980
1981         return "" if $out eq $title;
1982
1983         return $out;
1984 }
1985
1986 sub check_env($$)
1987 {
1988         my ($self, $envvars) = @_;
1989         my $samba_pid = $envvars->{SAMBA_PID};
1990
1991         if (not defined($samba_pid)) {
1992             return 0;
1993         } elsif ($samba_pid > 0) {
1994             my $childpid = Samba::cleanup_child($samba_pid, "samba");
1995
1996             if ($childpid == 0) {
1997                 return 1;
1998             }
1999             return 0;
2000         } else {
2001             return 1;
2002         }
2003
2004 }
2005
2006 sub setup_env($$$)
2007 {
2008         my ($self, $envname, $path) = @_;
2009         my $target3 = $self->{target3};
2010
2011         $ENV{ENVNAME} = $envname;
2012
2013         if (defined($self->{vars}->{$envname})) {
2014                 return $self->{vars}->{$envname};
2015         }
2016
2017         if ($envname eq "ad_dc_ntvfs") {
2018                 return $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2019         } elsif ($envname eq "fl2000dc") {
2020                 return $self->setup_fl2000dc("$path/fl2000dc");
2021         } elsif ($envname eq "vampire_2000_dc") {
2022                 if (not defined($self->{vars}->{fl2000dc})) {
2023                         $self->setup_fl2000dc("$path/fl2000dc");
2024                 }
2025                 return $self->setup_vampire_dc("$path/vampire_2000_dc", $self->{vars}->{fl2000dc}, "2000");
2026         } elsif ($envname eq "fl2003dc") {
2027                 if (not defined($self->{vars}->{ad_dc})) {
2028                         $self->setup_ad_dc("$path/ad_dc");
2029                 }
2030                 return $self->setup_fl2003dc("$path/fl2003dc", $self->{vars}->{ad_dc});
2031         } elsif ($envname eq "fl2008r2dc") {
2032                 if (not defined($self->{vars}->{ad_dc})) {
2033                         $self->setup_ad_dc("$path/ad_dc");
2034                 }
2035                 return $self->setup_fl2008r2dc("$path/fl2008r2dc", $self->{vars}->{ad_dc});
2036         } elsif ($envname eq "rpc_proxy") {
2037                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2038                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2039                 }
2040                 return $self->setup_rpc_proxy("$path/rpc_proxy", $self->{vars}->{ad_dc_ntvfs});
2041         } elsif ($envname eq "vampire_dc") {
2042                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2043                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2044                 }
2045                 return $self->setup_vampire_dc("$path/vampire_dc", $self->{vars}->{ad_dc_ntvfs}, "2008");
2046         } elsif ($envname eq "promoted_dc") {
2047                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2048                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2049                 }
2050                 return $self->setup_promoted_dc("$path/promoted_dc", $self->{vars}->{ad_dc_ntvfs});
2051         } elsif ($envname eq "subdom_dc") {
2052                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2053                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2054                 }
2055                 return $self->setup_subdom_dc("$path/subdom_dc", $self->{vars}->{ad_dc_ntvfs});
2056         } elsif ($envname eq "s4member_dflt_domain") {
2057                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2058                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2059                 }
2060                 return $self->setup_s4member_dflt_domain("$path/s4member_dflt_domain", $self->{vars}->{ad_dc_ntvfs});
2061         } elsif ($envname eq "s4member") {
2062                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2063                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2064                 }
2065                 return $self->setup_s4member("$path/s4member", $self->{vars}->{ad_dc_ntvfs});
2066         } elsif ($envname eq "rodc") {
2067                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2068                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2069                 }
2070                 return $self->setup_rodc("$path/rodc", $self->{vars}->{ad_dc_ntvfs});
2071         } elsif ($envname eq "chgdcpass") {
2072                 return $self->setup_chgdcpass("$path/chgdcpass", $self->{vars}->{chgdcpass});
2073         } elsif ($envname eq "ad_member") {
2074                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2075                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2076                 }
2077                 return $target3->setup_admember("$path/ad_member", $self->{vars}->{ad_dc_ntvfs}, 29);
2078         } elsif ($envname eq "ad_dc") {
2079                 return $self->setup_ad_dc("$path/ad_dc");
2080         } elsif ($envname eq "ad_dc_no_nss") {
2081                 return $self->setup_ad_dc("$path/ad_dc_no_nss", "no_nss");
2082         } elsif ($envname eq "ad_member_rfc2307") {
2083                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2084                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2085                 }
2086                 return $target3->setup_admember_rfc2307("$path/ad_member_rfc2307",
2087                                                         $self->{vars}->{ad_dc_ntvfs}, 34);
2088         } elsif ($envname eq "none") {
2089                 return $self->setup_none("$path/none");
2090         } else {
2091                 return "UNKNOWN";
2092         }
2093 }
2094
2095 sub setup_s4member($$$)
2096 {
2097         my ($self, $path, $dc_vars) = @_;
2098
2099         my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2100
2101         if (defined $env) {
2102                 if (not defined($self->check_or_start($env, "standard"))) {
2103                         return undef;
2104                 }
2105
2106                 $self->{vars}->{s4member} = $env;
2107         }
2108
2109         return $env;
2110 }
2111
2112 sub setup_s4member_dflt_domain($$$)
2113 {
2114         my ($self, $path, $dc_vars) = @_;
2115
2116         my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2117                                             "winbind use default domain = yes");
2118
2119         if (defined $env) {
2120                 if (not defined($self->check_or_start($env, "standard"))) {
2121                         return undef;
2122                 }
2123
2124                 $self->{vars}->{s4member_dflt_domain} = $env;
2125         }
2126
2127         return $env;
2128 }
2129
2130 sub setup_rpc_proxy($$$)
2131 {
2132         my ($self, $path, $dc_vars) = @_;
2133
2134         my $env = $self->provision_rpc_proxy($path, $dc_vars);
2135
2136         if (defined $env) {
2137                 if (not defined($self->check_or_start($env, "standard"))) {
2138                         return undef;
2139                 }
2140
2141                 $self->{vars}->{rpc_proxy} = $env;
2142         }
2143         return $env;
2144 }
2145
2146 sub setup_ad_dc_ntvfs($$)
2147 {
2148         my ($self, $path) = @_;
2149
2150         my $env = $self->provision_ad_dc_ntvfs($path);
2151         if (defined $env) {
2152                 if (not defined($self->check_or_start($env, "standard"))) {
2153                     warn("Failed to start ad_dc_ntvfs");
2154                         return undef;
2155                 }
2156
2157                 $self->{vars}->{ad_dc_ntvfs} = $env;
2158         }
2159         return $env;
2160 }
2161
2162 sub setup_chgdcpass($$)
2163 {
2164         my ($self, $path) = @_;
2165
2166         my $env = $self->provision_chgdcpass($path);
2167         if (defined $env) {
2168                 if (not defined($self->check_or_start($env, "standard"))) {
2169                         return undef;
2170                 }
2171
2172                 $self->{vars}->{chgdcpass} = $env;
2173         }
2174         return $env;
2175 }
2176
2177 sub setup_fl2000dc($$)
2178 {
2179         my ($self, $path) = @_;
2180
2181         my $env = $self->provision_fl2000dc($path);
2182         if (defined $env) {
2183                 if (not defined($self->check_or_start($env, "standard"))) {
2184                         return undef;
2185                 }
2186
2187                 $self->{vars}->{fl2000dc} = $env;
2188         }
2189
2190         return $env;
2191 }
2192
2193 sub setup_fl2003dc($$$)
2194 {
2195         my ($self, $path, $dc_vars) = @_;
2196
2197         my $env = $self->provision_fl2003dc($path);
2198
2199         if (defined $env) {
2200                 if (not defined($self->check_or_start($env, "standard"))) {
2201                         return undef;
2202                 }
2203
2204                 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2205
2206                 $self->{vars}->{fl2003dc} = $env;
2207         }
2208         return $env;
2209 }
2210
2211 sub setup_fl2008r2dc($$$)
2212 {
2213         my ($self, $path, $dc_vars) = @_;
2214
2215         my $env = $self->provision_fl2008r2dc($path);
2216
2217         if (defined $env) {
2218                 if (not defined($self->check_or_start($env, "standard"))) {
2219                         return undef;
2220                 }
2221
2222                 my $upn_array = ["$env->{REALM}.upn"];
2223                 my $spn_array = ["$env->{REALM}.spn"];
2224
2225                 $self->setup_namespaces($env, $upn_array, $spn_array);
2226
2227                 $env = $self->setup_trust($env, $dc_vars, "forest", "");
2228
2229                 $self->{vars}->{fl2008r2dc} = $env;
2230         }
2231
2232         return $env;
2233 }
2234
2235 sub setup_vampire_dc($$$$)
2236 {
2237         my ($self, $path, $dc_vars, $fl) = @_;
2238
2239         my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2240
2241         if (defined $env) {
2242                 if (not defined($self->check_or_start($env, "single"))) {
2243                         return undef;
2244                 }
2245
2246                 $self->{vars}->{vampire_dc} = $env;
2247
2248                 # force replicated DC to update repsTo/repsFrom
2249                 # for vampired partitions
2250                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2251                 my $cmd = "";
2252                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2253                 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2254                         $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2255                 } else {
2256                         $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2257                 }
2258                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2259                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2260                 $cmd .= " $samba_tool drs kcc -k no $env->{DC_SERVER}";
2261                 $cmd .= " $env->{CONFIGURATION}";
2262                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2263                 unless (system($cmd) == 0) {
2264                         warn("Failed to exec kcc on remote DC\n$cmd");
2265                         return undef;
2266                 }
2267
2268                 # as 'vampired' dc may add data in its local replica
2269                 # we need to synchronize data between DCs
2270                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2271                 $cmd = "";
2272                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2273                 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2274                         $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2275                 } else {
2276                         $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2277                 }
2278                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2279                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2280                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2281                 $cmd .= " $dc_vars->{CONFIGURATION}";
2282                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2283                 # replicate Configuration NC
2284                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2285                 unless(system($cmd_repl) == 0) {
2286                         warn("Failed to replicate\n$cmd_repl");
2287                         return undef;
2288                 }
2289                 # replicate Default NC
2290                 $cmd_repl = "$cmd \"$base_dn\"";
2291                 unless(system($cmd_repl) == 0) {
2292                         warn("Failed to replicate\n$cmd_repl");
2293                         return undef;
2294                 }
2295
2296                 # Pull in a full set of changes from the main DC
2297                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2298                 $cmd = "";
2299                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2300                 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2301                         $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2302                 } else {
2303                         $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2304                 }
2305                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2306                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2307                 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2308                 $cmd .= " $dc_vars->{CONFIGURATION}";
2309                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2310                 # replicate Configuration NC
2311                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2312                 unless(system($cmd_repl) == 0) {
2313                         warn("Failed to replicate\n$cmd_repl");
2314                         return undef;
2315                 }
2316                 # replicate Default NC
2317                 $cmd_repl = "$cmd \"$base_dn\"";
2318                 unless(system($cmd_repl) == 0) {
2319                         warn("Failed to replicate\n$cmd_repl");
2320                         return undef;
2321                 }
2322         }
2323
2324         return $env;
2325 }
2326
2327 sub setup_promoted_dc($$$)
2328 {
2329         my ($self, $path, $dc_vars) = @_;
2330
2331         my $env = $self->provision_promoted_dc($path, $dc_vars);
2332
2333         if (defined $env) {
2334                 if (not defined($self->check_or_start($env, "single"))) {
2335                         return undef;
2336                 }
2337
2338                 $self->{vars}->{promoted_dc} = $env;
2339
2340                 # force source and replicated DC to update repsTo/repsFrom
2341                 # for vampired partitions
2342                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2343                 my $cmd = "";
2344                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2345                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2346                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2347                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
2348                 $cmd .= " $env->{CONFIGURATION}";
2349                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2350                 unless (system($cmd) == 0) {
2351                         warn("Failed to exec kcc on remote DC\n$cmd");
2352                         return undef;
2353                 }
2354
2355                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2356                 my $cmd = "";
2357                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2358                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2359                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2360                 $cmd .= " $samba_tool drs kcc $env->{SERVER}";
2361                 $cmd .= " $env->{CONFIGURATION}";
2362                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2363                 unless (system($cmd) == 0) {
2364                         warn("Failed to exec kcc on promoted DC\n$cmd");
2365                         return undef;
2366                 }
2367
2368                 # as 'vampired' dc may add data in its local replica
2369                 # we need to synchronize data between DCs
2370                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2371                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2372                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2373                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2374                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2375                 $cmd .= " $dc_vars->{CONFIGURATION}";
2376                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2377                 # replicate Configuration NC
2378                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2379                 unless(system($cmd_repl) == 0) {
2380                         warn("Failed to replicate\n$cmd_repl");
2381                         return undef;
2382                 }
2383                 # replicate Default NC
2384                 $cmd_repl = "$cmd \"$base_dn\"";
2385                 unless(system($cmd_repl) == 0) {
2386                         warn("Failed to replicate\n$cmd_repl");
2387                         return undef;
2388                 }
2389         }
2390
2391         return $env;
2392 }
2393
2394 sub setup_subdom_dc($$$)
2395 {
2396         my ($self, $path, $dc_vars) = @_;
2397
2398         my $env = $self->provision_subdom_dc($path, $dc_vars);
2399
2400         if (defined $env) {
2401                 if (not defined($self->check_or_start($env, "single"))) {
2402                         return undef;
2403                 }
2404
2405                 $self->{vars}->{subdom_dc} = $env;
2406
2407                 # force replicated DC to update repsTo/repsFrom
2408                 # for primary domain partitions
2409                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2410                 my $cmd = "";
2411                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2412                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2413                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2414                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
2415                 $cmd .= " $env->{CONFIGURATION}";
2416                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
2417                 unless (system($cmd) == 0) {
2418                         warn("Failed to exec kcc on remote DC\n$cmd");
2419                         return undef;
2420                 }
2421
2422                 # as 'subdomain' dc may add data in its local replica
2423                 # we need to synchronize data between DCs
2424                 my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
2425                 my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2426                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2427                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2428                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2429                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
2430                 $cmd .= " $dc_vars->{CONFIGURATION}";
2431                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
2432                 # replicate Configuration NC
2433                 my $cmd_repl = "$cmd \"$config_dn\"";
2434                 unless(system($cmd_repl) == 0) {
2435                         warn("Failed to replicate\n$cmd_repl");
2436                         return undef;
2437                 }
2438                 # replicate Default NC
2439                 $cmd_repl = "$cmd \"$base_dn\"";
2440                 unless(system($cmd_repl) == 0) {
2441                         warn("Failed to replicate\n$cmd_repl");
2442                         return undef;
2443                 }
2444         }
2445
2446         return $env;
2447 }
2448
2449 sub setup_rodc($$$)
2450 {
2451         my ($self, $path, $dc_vars) = @_;
2452
2453         my $env = $self->provision_rodc($path, $dc_vars);
2454
2455         unless ($env) {
2456                 return undef;
2457         }
2458
2459         if (not defined($self->check_or_start($env, "single"))) {
2460             return undef;
2461         }
2462
2463         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2464         my $cmd = "";
2465
2466         my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2467         $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2468         $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2469         $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2470         $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2471         $cmd .= " $dc_vars->{CONFIGURATION}";
2472         $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2473         # replicate Configuration NC
2474         my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2475         unless(system($cmd_repl) == 0) {
2476             warn("Failed to replicate\n$cmd_repl");
2477             return undef;
2478         }
2479         # replicate Default NC
2480         $cmd_repl = "$cmd \"$base_dn\"";
2481         unless(system($cmd_repl) == 0) {
2482             warn("Failed to replicate\n$cmd_repl");
2483             return undef;
2484         }
2485
2486         $self->{vars}->{rodc} = $env;
2487
2488         return $env;
2489 }
2490
2491 sub setup_ad_dc($$)
2492 {
2493         my ($self, $path, $no_nss) = @_;
2494
2495         # If we didn't build with ADS, pretend this env was never available
2496         if (not $self->{target3}->have_ads()) {
2497                return "UNKNOWN";
2498         }
2499
2500         my $env = $self->provision_ad_dc($path);
2501         unless ($env) {
2502                 return undef;
2503         }
2504
2505         if (defined($no_nss) and $no_nss) {
2506                 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2507                 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2508         }
2509
2510         if (not defined($self->check_or_start($env, "single"))) {
2511             return undef;
2512         }
2513
2514         my $upn_array = ["$env->{REALM}.upn"];
2515         my $spn_array = ["$env->{REALM}.spn"];
2516
2517         $self->setup_namespaces($env, $upn_array, $spn_array);
2518
2519         $self->{vars}->{ad_dc} = $env;
2520         return $env;
2521 }
2522
2523 sub setup_none($$)
2524 {
2525         my ($self, $path) = @_;
2526
2527         my $ret = {
2528                 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
2529                 SAMBA_PID => -1,
2530         }
2531 }
2532
2533 1;