selftest/target/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 package Samba4;
   7
   8 use strict;
   9 use Cwd qw(abs_path);
  10 use FindBin qw($RealBin);
  11 use POSIX;
  12 use SocketWrapper;
  13 use target::Samba;
  14 use target::Samba3;
  15
  16 sub new($$$$$) {
  17         my ($classname, $bindir, $ldap, $srcdir, $server_maxtime) = @_;
  18
  19         my $self = {
  20                 vars => {},
  21                 ldap => $ldap,
  22                 bindir => $bindir,
  23                 srcdir => $srcdir,
  24                 server_maxtime => $server_maxtime,
  25                 target3 => new Samba3($bindir, $srcdir, $server_maxtime)
  26         };
  27         bless $self;
  28         return $self;
  29 }
  30
  31 sub scriptdir_path($$) {
  32         my ($self, $path) = @_;
  33         return "$self->{srcdir}/source4/scripting/$path";
  34 }
  35
  36 sub openldap_start($$$) {
  37 }
  38
  39 sub slapd_start($$)
  40 {
  41         my $count = 0;
  42         my ($self, $env_vars, $STDIN_READER) = @_;
  43         my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
  44
  45         my $uri = $env_vars->{LDAP_URI};
  46
  47         if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
  48             print "A SLAPD is still listening to $uri before we started the LDAP backend.  Aborting!";
  49             return 1;
  50         }
  51         # running slapd in the background means it stays in the same process group, so it can be
  52         # killed by timelimit
  53         my $pid = fork();
  54         if ($pid == 0) {
  55                 open STDOUT, ">$env_vars->{LDAPDIR}/logs";
  56                 open STDERR, '>&STDOUT';
  57                 close($env_vars->{STDIN_PIPE});
  58                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
  59
  60                 if ($self->{ldap} eq "fedora-ds") {
  61                         exec("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd", "-D", $env_vars->{FEDORA_DS_DIR}, "-d0", "-i", $env_vars->{FEDORA_DS_PIDFILE});
  62                 } elsif ($self->{ldap} eq "openldap") {
  63                         exec($ENV{OPENLDAP_SLAPD}, "-dnone", "-F", $env_vars->{SLAPD_CONF_D}, "-h", $uri);
  64                 }
  65                 die("Unable to start slapd: $!");
  66         }
  67         $env_vars->{SLAPD_PID} = $pid;
  68         sleep(1);
  69         while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
  70                 $count++;
  71                 if ($count > 40) {
  72                         $self->slapd_stop($env_vars);
  73                         return 0;
  74                 }
  75                 sleep(1);
  76         }
  77         return 1;
  78 }
  79
  80 sub slapd_stop($$)
  81 {
  82         my ($self, $envvars) = @_;
  83         kill 9, $envvars->{SLAPD_PID};
  84         return 1;
  85 }
  86
  87 sub check_or_start($$$)
  88 {
  89         my ($self, $env_vars, $process_model) = @_;
  90         my $STDIN_READER;
  91
  92         my $env_ok = $self->check_env($env_vars);
  93         if ($env_ok) {
  94                 return $env_vars->{SAMBA_PID};
  95         } elsif (defined($env_vars->{SAMBA_PID})) {
  96                 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
  97                 return undef;
  98         }
  99
 100         # use a pipe for stdin in the child processes. This allows
 101         # those processes to monitor the pipe for EOF to ensure they
 102         # exit when the test script exits
 103         pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
 104
 105         # Start slapd before samba, but with the fifo on stdin
 106         if (defined($self->{ldap})) {
 107                 unless($self->slapd_start($env_vars, $STDIN_READER)) {
 108                         warn("couldn't start slapd (main run)");
 109                         return undef;
 110                 }
 111         }
 112
 113         print "STARTING SAMBA...\n";
 114         my $pid = fork();
 115         if ($pid == 0) {
 116                 # we want out from samba to go to the log file, but also
 117                 # to the users terminal when running 'make test' on the command
 118                 # line. This puts it on stderr on the terminal
 119                 open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
 120                 open STDERR, '>&STDOUT';
 121
 122                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
 123
 124                 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
 125                 $ENV{KRB5CCNAME} = "$env_vars->{KRB5_CCACHE}.samba";
 126                 if (defined($ENV{MITKRB5})) {
 127                         $ENV{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
 128                 }
 129                 $ENV{SELFTEST_WINBINDD_SOCKET_DIR} = $env_vars->{SELFTEST_WINBINDD_SOCKET_DIR};
 130                 $ENV{NMBD_SOCKET_DIR} = $env_vars->{NMBD_SOCKET_DIR};
 131
 132                 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
 133                 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
 134                 $ENV{NSS_WRAPPER_HOSTS} = $env_vars->{NSS_WRAPPER_HOSTS};
 135                 $ENV{NSS_WRAPPER_HOSTNAME} = $env_vars->{NSS_WRAPPER_HOSTNAME};
 136                 $ENV{NSS_WRAPPER_MODULE_SO_PATH} = $env_vars->{NSS_WRAPPER_MODULE_SO_PATH};
 137                 $ENV{NSS_WRAPPER_MODULE_FN_PREFIX} = $env_vars->{NSS_WRAPPER_MODULE_FN_PREFIX};
 138
 139                 if (defined($env_vars->{RESOLV_WRAPPER_CONF})) {
 140                         $ENV{RESOLV_WRAPPER_CONF} = $env_vars->{RESOLV_WRAPPER_CONF};
 141                 } else {
 142                         $ENV{RESOLV_WRAPPER_HOSTS} = $env_vars->{RESOLV_WRAPPER_HOSTS};
 143                 }
 144
 145                 $ENV{UID_WRAPPER} = "1";
 146                 $ENV{UID_WRAPPER_ROOT} = "1";
 147
 148                 $ENV{MAKE_TEST_BINARY} = Samba::bindir_path($self, "samba");
 149                 my @preargs = ();
 150                 my @optargs = ();
 151                 if (defined($ENV{SAMBA_OPTIONS})) {
 152                         @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
 153                 }
 154                 if(defined($ENV{SAMBA_VALGRIND})) {
 155                         @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
 156                 }
 157
 158                 close($env_vars->{STDIN_PIPE});
 159                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 160
 161                 exec(@preargs, Samba::bindir_path($self, "samba"), "-M", $process_model, "-i", "--maximum-runtime=$self->{server_maxtime}", $env_vars->{CONFIGURATION}, @optargs) or die("Unable to start samba: $!");
 162         }
 163         $env_vars->{SAMBA_PID} = $pid;
 164         print "DONE ($pid)\n";
 165
 166         close($STDIN_READER);
 167
 168         if ($self->wait_for_start($env_vars) != 0) {
 169             warn("Samba $pid failed to start up");
 170             return undef;
 171         }
 172
 173         return $pid;
 174 }
 175
 176 sub wait_for_start($$)
 177 {
 178         my ($self, $testenv_vars) = @_;
 179         my $count = 0;
 180         my $ret = 0;
 181
 182         if (not $self->check_env($testenv_vars)) {
 183             warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
 184             return -1;
 185         }
 186
 187         # This will return quickly when things are up, but be slow if we
 188         # need to wait for (eg) SSL init
 189         my $nmblookup =  Samba::bindir_path($self, "nmblookup4");
 190
 191         do {
 192                 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 193                 if ($ret != 0) {
 194                         sleep(1);
 195                 } else {
 196                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 197                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 198                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 199                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 200                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 201                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 202                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 203                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 204                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 205                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 206                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 207                 }
 208                 $count++;
 209         } while ($ret != 0 && $count < 20);
 210         if ($count == 20) {
 211                 warn("nbt not reachable after 20 retries\n");
 212                 teardown_env($self, $testenv_vars);
 213                 return 0;
 214         }
 215
 216         # Ensure we have the first RID Set before we start tests.  This makes the tests more reliable.
 217         if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
 218                 # Add hosts file for name lookups
 219                 $ENV{NSS_WRAPPER_HOSTS} = $testenv_vars->{NSS_WRAPPER_HOSTS};
 220                 if (defined($testenv_vars->{RESOLV_WRAPPER_CONF})) {
 221                         $ENV{RESOLV_WRAPPER_CONF} = $testenv_vars->{RESOLV_WRAPPER_CONF};
 222                 } else {
 223                         $ENV{RESOLV_WRAPPER_HOSTS} = $testenv_vars->{RESOLV_WRAPPER_HOSTS};
 224                 }
 225
 226                 print "waiting for working LDAP and a RID Set to be allocated\n";
 227                 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
 228                 my $count = 0;
 229                 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
 230
 231                 my $search_dn = $base_dn;
 232                 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
 233                         # TODO currently no check for actual rIDAllocationPool
 234                         $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
 235                 }
 236                 my $max_wait = 60;
 237                 my $cmd = "$ldbsearch $testenv_vars->{CONFIGURATION} -H ldap://$testenv_vars->{SERVER} -U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} -s base -b \"$search_dn\"";
 238                 while (system("$cmd >/dev/null") != 0) {
 239                         $count++;
 240                         if ($count > $max_wait) {
 241                                 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
 242                                 $ret = -1;
 243                                 last;
 244                         }
 245                         sleep(1);
 246                 }
 247         }
 248
 249         my $wbinfo =  Samba::bindir_path($self, "wbinfo");
 250
 251         $count = 0;
 252         do {
 253                 my $cmd = "NSS_WRAPPER_PASSWD=$testenv_vars->{NSS_WRAPPER_PASSWD} ";
 254                 $cmd .= "NSS_WRAPPER_GROUP=$testenv_vars->{NSS_WRAPPER_GROUP} ";
 255                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=$testenv_vars->{SELFTEST_WINBINDD_SOCKET_DIR} ";
 256                 $cmd .= "$wbinfo -p";
 257                 $ret = system($cmd);
 258
 259                 if ($ret != 0) {
 260                         sleep(1);
 261                 }
 262                 $count++;
 263         } while ($ret != 0 && $count < 20);
 264         if ($count == 20) {
 265                 warn("winbind not reachable after 20 retries\n");
 266                 teardown_env($self, $testenv_vars);
 267                 return 0;
 268         }
 269
 270         print $self->getlog_env($testenv_vars);
 271
 272         return $ret
 273 }
 274
 275 sub write_ldb_file($$$)
 276 {
 277         my ($self, $file, $ldif) = @_;
 278
 279         my $ldbadd =  Samba::bindir_path($self, "ldbadd");
 280         open(LDIF, "|$ldbadd -H $file >/dev/null");
 281         print LDIF $ldif;
 282         return(close(LDIF));
 283 }
 284
 285 sub add_wins_config($$)
 286 {
 287         my ($self, $privatedir) = @_;
 288
 289         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 290 dn: name=TORTURE_11,CN=PARTNERS
 291 objectClass: wreplPartner
 292 name: TORTURE_11
 293 address: 127.0.0.11
 294 pullInterval: 0
 295 pushChangeCount: 0
 296 type: 0x3
 297 ");
 298 }
 299
 300 sub mk_fedora_ds($$)
 301 {
 302         my ($self, $ctx) = @_;
 303
 304         #Make the subdirectory be as fedora DS would expect
 305         my $fedora_ds_dir = "$ctx->{ldapdir}/slapd-$ctx->{ldap_instance}";
 306
 307         my $pidfile = "$fedora_ds_dir/logs/slapd-$ctx->{ldap_instance}.pid";
 308
 309         return ($fedora_ds_dir, $pidfile);
 310 }
 311
 312 sub mk_openldap($$)
 313 {
 314         my ($self, $ctx) = @_;
 315
 316         my $slapd_conf_d = "$ctx->{ldapdir}/slapd.d";
 317         my $pidfile = "$ctx->{ldapdir}/slapd.pid";
 318
 319         return ($slapd_conf_d, $pidfile);
 320 }
 321
 322 sub setup_namespaces($$:$$)
 323 {
 324         my ($self, $localenv, $upn_array, $spn_array) = @_;
 325
 326         @{$upn_array} = [] unless defined($upn_array);
 327         my $upn_args = "";
 328         foreach my $upn (@{$upn_array}) {
 329                 $upn_args .= " --add-upn-suffix=$upn";
 330         }
 331
 332         @{$spn_array} = [] unless defined($spn_array);
 333         my $spn_args = "";
 334         foreach my $spn (@{$spn_array}) {
 335                 $spn_args .= " --add-spn-suffix=$spn";
 336         }
 337
 338         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 339
 340         my $cmd_env = "";
 341         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 342         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 343                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 344         } else {
 345                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 346         }
 347         $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 348         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 349
 350         my $cmd_config = " $localenv->{CONFIGURATION}";
 351
 352         my $namespaces = $cmd_env;
 353         $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
 354         $namespaces .= $cmd_config;
 355         unless (system($namespaces) == 0) {
 356                 warn("Failed to add namespaces \n$namespaces");
 357                 return;
 358         }
 359
 360         return;
 361 }
 362
 363 sub setup_trust($$$$$)
 364 {
 365         my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
 366
 367         $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
 368         $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
 369         $localenv->{TRUST_SERVER_IPV6} = $remoteenv->{SERVER_IPV6};
 370         $localenv->{TRUST_NETBIOSNAME} = $remoteenv->{NETBIOSNAME};
 371         $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
 372         $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
 373         $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
 374         $localenv->{TRUST_REALM} = $remoteenv->{REALM};
 375
 376         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 377         # setup the trust
 378         my $cmd_env = "";
 379         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 380         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 381                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 382         } else {
 383                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 384         }
 385         $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 386         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 387
 388         my $cmd_config = " $localenv->{CONFIGURATION}";
 389         my $cmd_creds = $cmd_config;
 390         $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
 391
 392         my $create = $cmd_env;
 393         $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
 394         $create .= " $extra_args";
 395         $create .= $cmd_creds;
 396         unless (system($create) == 0) {
 397                 warn("Failed to create trust \n$create");
 398                 return undef;
 399         }
 400
 401         return $localenv
 402 }
 403
 404 sub provision_raw_prepare($$$$$$$$$$$)
 405 {
 406         my ($self, $prefix, $server_role, $hostname,
 407             $domain, $realm, $functional_level,
 408             $password, $kdc_ipv4, $kdc_ipv6) = @_;
 409         my $ctx;
 410         my $netbiosname = uc($hostname);
 411
 412         unless(-d $prefix or mkdir($prefix, 0777)) {
 413                 warn("Unable to create $prefix");
 414                 return undef;
 415         }
 416         my $prefix_abs = abs_path($prefix);
 417
 418         die ("prefix=''") if $prefix_abs eq "";
 419         die ("prefix='/'") if $prefix_abs eq "/";
 420
 421         unless (system("rm -rf $prefix_abs/*") == 0) {
 422                 warn("Unable to clean up");
 423         }
 424
 425
 426         my $swiface = Samba::get_interface($hostname);
 427
 428         $ctx->{prefix} = $prefix;
 429         $ctx->{prefix_abs} = $prefix_abs;
 430
 431         $ctx->{server_role} = $server_role;
 432         $ctx->{hostname} = $hostname;
 433         $ctx->{netbiosname} = $netbiosname;
 434         $ctx->{swiface} = $swiface;
 435         $ctx->{password} = $password;
 436         $ctx->{kdc_ipv4} = $kdc_ipv4;
 437         $ctx->{kdc_ipv6} = $kdc_ipv6;
 438         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
 439         if ($functional_level eq "2000") {
 440                 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc"
 441         }
 442
 443 #
 444 # Set smbd log level here.
 445 #
 446         $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
 447         $ctx->{username} = "Administrator";
 448         $ctx->{domain} = $domain;
 449         $ctx->{realm} = uc($realm);
 450         $ctx->{dnsname} = lc($realm);
 451
 452         $ctx->{functional_level} = $functional_level;
 453
 454         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 455         chomp $unix_name;
 456         $ctx->{unix_name} = $unix_name;
 457         $ctx->{unix_uid} = $>;
 458         my @mygid = split(" ", $();
 459         $ctx->{unix_gid} = $mygid[0];
 460         $ctx->{unix_gids_str} = $);
 461         @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
 462
 463         $ctx->{etcdir} = "$prefix_abs/etc";
 464         $ctx->{piddir} = "$prefix_abs/pid";
 465         $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
 466         $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
 467         $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
 468         $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
 469         $ctx->{privatedir} = "$prefix_abs/private";
 470         $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
 471         $ctx->{lockdir} = "$prefix_abs/lockdir";
 472         $ctx->{logdir} = "$prefix_abs/logs";
 473         $ctx->{statedir} = "$prefix_abs/statedir";
 474         $ctx->{cachedir} = "$prefix_abs/cachedir";
 475         $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
 476         $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
 477         $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
 478         $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
 479         $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
 480         $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
 481         if ($ENV{SAMBA_DNS_FAKING}) {
 482                 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 483                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
 484         } else {
 485                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces";
 486                 $ctx->{use_resolv_wrapper} = 1;
 487         }
 488         $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
 489
 490         $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
 491
 492         $ctx->{ipv4} = "127.0.0.$swiface";
 493         $ctx->{ipv6} = sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
 494         $ctx->{interfaces} = "$ctx->{ipv4}/8 $ctx->{ipv6}/64";
 495
 496         push(@{$ctx->{directories}}, $ctx->{privatedir});
 497         push(@{$ctx->{directories}}, $ctx->{etcdir});
 498         push(@{$ctx->{directories}}, $ctx->{piddir});
 499         push(@{$ctx->{directories}}, $ctx->{lockdir});
 500         push(@{$ctx->{directories}}, $ctx->{logdir});
 501         push(@{$ctx->{directories}}, $ctx->{statedir});
 502         push(@{$ctx->{directories}}, $ctx->{cachedir});
 503
 504         $ctx->{smb_conf_extra_options} = "";
 505
 506         my @provision_options = ();
 507         push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
 508         push (@provision_options, "KRB5_CCACHE=\"$ctx->{krb5_ccache}\"");
 509         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
 510         push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
 511         push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
 512         push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
 513         if (defined($ctx->{use_resolv_wrapper})) {
 514                 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
 515         } else {
 516                 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
 517         }
 518         if (defined($ENV{GDB_PROVISION})) {
 519                 push (@provision_options, "gdb --args");
 520                 if (!defined($ENV{PYTHON})) {
 521                     push (@provision_options, "env");
 522                     push (@provision_options, "python");
 523                 }
 524         }
 525         if (defined($ENV{VALGRIND_PROVISION})) {
 526                 push (@provision_options, "valgrind");
 527                 if (!defined($ENV{PYTHON})) {
 528                     push (@provision_options, "env");
 529                     push (@provision_options, "python");
 530                 }
 531         }
 532         if (defined($ENV{PYTHON})) {
 533                 push (@provision_options, $ENV{PYTHON});
 534         }
 535         push (@provision_options, Samba::bindir_path($self, "samba-tool"));
 536         push (@provision_options, "domain");
 537         push (@provision_options, "provision");
 538         push (@provision_options, "--configfile=$ctx->{smb_conf}");
 539         push (@provision_options, "--host-name=$ctx->{hostname}");
 540         push (@provision_options, "--host-ip=$ctx->{ipv4}");
 541         push (@provision_options, "--quiet");
 542         push (@provision_options, "--domain=$ctx->{domain}");
 543         push (@provision_options, "--realm=$ctx->{realm}");
 544         push (@provision_options, "--adminpass=$ctx->{password}");
 545         push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
 546         push (@provision_options, "--machinepass=machine$ctx->{password}");
 547         push (@provision_options, "--root=$ctx->{unix_name}");
 548         push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
 549         push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
 550
 551         @{$ctx->{provision_options}} = @provision_options;
 552
 553         return $ctx;
 554 }
 555
 556 #
 557 # Step1 creates the basic configuration
 558 #
 559 sub provision_raw_step1($$)
 560 {
 561         my ($self, $ctx) = @_;
 562
 563         mkdir($_, 0777) foreach (@{$ctx->{directories}});
 564
 565         ##
 566         ## lockdir and piddir must be 0755
 567         ##
 568         chmod 0755, $ctx->{lockdir};
 569         chmod 0755, $ctx->{piddir};
 570
 571         unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
 572                 warn("can't open $ctx->{smb_conf}$?");
 573                 return undef;
 574         }
 575
 576         Samba::prepare_keyblobs($ctx);
 577         my $crlfile = "$ctx->{tlsdir}/crl.pem";
 578         $crlfile = "" unless -e ${crlfile};
 579
 580         print CONFFILE "
 581 [global]
 582         netbios name = $ctx->{netbiosname}
 583         posix:eadb = $ctx->{statedir}/eadb.tdb
 584         workgroup = $ctx->{domain}
 585         realm = $ctx->{realm}
 586         private dir = $ctx->{privatedir}
 587         pid directory = $ctx->{piddir}
 588         ncalrpc dir = $ctx->{ncalrpcdir}
 589         lock dir = $ctx->{lockdir}
 590         state directory = $ctx->{statedir}
 591         cache directory = $ctx->{cachedir}
 592         winbindd socket directory = $ctx->{winbindd_socket_dir}
 593         ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
 594         winbind separator = /
 595         interfaces = $ctx->{interfaces}
 596         tls dh params file = $ctx->{tlsdir}/dhparms.pem
 597         tls crlfile = ${crlfile}
 598         tls verify peer = no_check
 599         panic action = $RealBin/gdb_backtrace \%d
 600         wins support = yes
 601         server role = $ctx->{server_role}
 602         server services = +echo +smb -s3fs
 603         dcerpc endpoint servers = +winreg +srvsvc
 604         notify:inotify = false
 605         ldb:nosync = true
 606         ldap server require strong auth = yes
 607 #We don't want to pass our self-tests if the PAC code is wrong
 608         gensec:require_pac = true
 609         log file = $ctx->{logdir}/log.\%m
 610         log level = $ctx->{server_loglevel}
 611         lanman auth = Yes
 612         ntlm auth = Yes
 613         rndc command = true
 614         dns update command = $ctx->{samba_dnsupdate}
 615         spn update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
 616         dreplsrv:periodic_startup_interval = 0
 617         dsdb:schema update allowed = yes
 618
 619         vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
 620
 621         idmap_ldb:use rfc2307=yes
 622         winbind enum users = yes
 623         winbind enum groups = yes
 624
 625         rpc server port:netlogon = 1026
 626
 627 ";
 628
 629         print CONFFILE "
 630
 631         # Begin extra options
 632         $ctx->{smb_conf_extra_options}
 633         # End extra options
 634 ";
 635         close(CONFFILE);
 636
 637         #Default the KDC IP to the server's IP
 638         if (not defined($ctx->{kdc_ipv4})) {
 639                 $ctx->{kdc_ipv4} = $ctx->{ipv4};
 640         }
 641         if (not defined($ctx->{kdc_ipv6})) {
 642                 $ctx->{kdc_ipv6} = $ctx->{ipv6};
 643         }
 644
 645         Samba::mk_krb5_conf($ctx);
 646         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
 647
 648         open(PWD, ">$ctx->{nsswrap_passwd}");
 649         if ($ctx->{unix_uid} != 0) {
 650                 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
 651         }
 652         print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
 653         print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
 654 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 655 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 656 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 657 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 658 ";
 659         close(PWD);
 660         my $uid_rfc2307test = 65533;
 661
 662         open(GRP, ">$ctx->{nsswrap_group}");
 663         if ($ctx->{unix_gid} != 0) {
 664                 print GRP "root:x:0:\n";
 665         }
 666         print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
 667         print GRP "wheel:x:10:
 668 users:x:65531:
 669 nobody:x:65533:
 670 nogroup:x:65534:nobody
 671 ";
 672         close(GRP);
 673         my $gid_rfc2307test = 65532;
 674
 675         my $hostname = lc($ctx->{hostname});
 676         open(HOSTS, ">>$ctx->{nsswrap_hosts}");
 677         if ($hostname eq "localdc") {
 678                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 679                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 680         } else {
 681                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 682                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 683         }
 684         close(HOSTS);
 685
 686         if (defined($ctx->{resolv_conf})) {
 687                 open(RESOLV_CONF, ">$ctx->{resolv_conf}");
 688                 print RESOLV_CONF "nameserver $ctx->{kdc_ipv4}\n";
 689                 print RESOLV_CONF "nameserver $ctx->{kdc_ipv6}\n";
 690                 close(RESOLV_CONF);
 691         }
 692
 693         my $configuration = "--configfile=$ctx->{smb_conf}";
 694
 695 #Ensure the config file is valid before we start
 696         my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
 697         if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 698                 system("$testparm -v --suppress-prompt $configuration >&2");
 699                 warn("Failed to create a valid smb.conf configuration $testparm!");
 700                 return undef;
 701         }
 702         unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
 703                 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
 704                 return undef;
 705         }
 706
 707         my $ret = {
 708                 KRB5_CONFIG => $ctx->{krb5_conf},
 709                 KRB5_CCACHE => $ctx->{krb5_ccache},
 710                 MITKDC_CONFIG => $ctx->{mitkdc_conf},
 711                 PIDDIR => $ctx->{piddir},
 712                 SERVER => $ctx->{hostname},
 713                 SERVER_IP => $ctx->{ipv4},
 714                 SERVER_IPV6 => $ctx->{ipv6},
 715                 NETBIOSNAME => $ctx->{netbiosname},
 716                 DOMAIN => $ctx->{domain},
 717                 USERNAME => $ctx->{username},
 718                 REALM => $ctx->{realm},
 719                 PASSWORD => $ctx->{password},
 720                 LDAPDIR => $ctx->{ldapdir},
 721                 LDAP_INSTANCE => $ctx->{ldap_instance},
 722                 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
 723                 NCALRPCDIR => $ctx->{ncalrpcdir},
 724                 LOCKDIR => $ctx->{lockdir},
 725                 STATEDIR => $ctx->{statedir},
 726                 CACHEDIR => $ctx->{cachedir},
 727                 PRIVATEDIR => $ctx->{privatedir},
 728                 SERVERCONFFILE => $ctx->{smb_conf},
 729                 CONFIGURATION => $configuration,
 730                 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
 731                 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
 732                 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
 733                 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
 734                 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
 735                 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
 736                 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
 737                 SAMBA_TEST_LOG_POS => 0,
 738                 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
 739                 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
 740                 LOCAL_PATH => $ctx->{share},
 741                 UID_RFC2307TEST => $uid_rfc2307test,
 742                 GID_RFC2307TEST => $gid_rfc2307test,
 743                 SERVER_ROLE => $ctx->{server_role},
 744                 RESOLV_CONF => $ctx->{resolv_conf}
 745         };
 746
 747         if (defined($ctx->{use_resolv_wrapper})) {
 748                 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
 749         } else {
 750                 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
 751         }
 752
 753         return $ret;
 754 }
 755
 756 #
 757 # Step2 runs the provision script
 758 #
 759 sub provision_raw_step2($$$)
 760 {
 761         my ($self, $ctx, $ret) = @_;
 762
 763         my $provision_cmd = join(" ", @{$ctx->{provision_options}});
 764         unless (system($provision_cmd) == 0) {
 765                 warn("Unable to provision: \n$provision_cmd\n");
 766                 return undef;
 767         }
 768
 769         my $testallowed_account = "testallowed";
 770         my $samba_tool_cmd = "";
 771         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 772         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 773         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 774             . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
 775         unless (system($samba_tool_cmd) == 0) {
 776                 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
 777                 return undef;
 778         }
 779
 780         my $ldbmodify = "";
 781         $ldbmodify .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 782         $ldbmodify .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 783         $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
 784         my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
 785
 786         if ($ctx->{server_role} ne "domain controller") {
 787                 $base_dn = "DC=$ctx->{netbiosname}";
 788         }
 789
 790         my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
 791         $testallowed_account = "testallowed account";
 792         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 793         print LDIF "dn: $user_dn
 794 changetype: modify
 795 replace: samAccountName
 796 samAccountName: $testallowed_account
 797 -
 798 ";
 799         close(LDIF);
 800
 801         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 802         print LDIF "dn: $user_dn
 803 changetype: modify
 804 replace: userPrincipalName
 805 userPrincipalName: testallowed upn\@$ctx->{realm}
 806 replace: servicePrincipalName
 807 servicePrincipalName: host/testallowed
 808 -
 809 ";
 810         close(LDIF);
 811
 812         $samba_tool_cmd = "";
 813         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 814         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 815         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 816             . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
 817         unless (system($samba_tool_cmd) == 0) {
 818                 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
 819                 return undef;
 820         }
 821
 822         my $user_dn = "cn=testdenied,cn=users,$base_dn";
 823         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 824         print LDIF "dn: $user_dn
 825 changetype: modify
 826 replace: userPrincipalName
 827 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
 828 -
 829 ";
 830         close(LDIF);
 831
 832         $samba_tool_cmd = "";
 833         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 834         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 835         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 836             . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
 837         unless (system($samba_tool_cmd) == 0) {
 838                 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
 839                 return undef;
 840         }
 841
 842         # Create to users alice and bob!
 843         my $user_account_array = ["alice", "bob"];
 844
 845         foreach my $user_account (@{$user_account_array}) {
 846                 my $samba_tool_cmd = "";
 847
 848                 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 849                 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 850                 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 851                     . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
 852                 unless (system($samba_tool_cmd) == 0) {
 853                         warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
 854                         return undef;
 855                 }
 856         }
 857
 858         return $ret;
 859 }
 860
 861 sub provision($$$$$$$$$$)
 862 {
 863         my ($self, $prefix, $server_role, $hostname,
 864             $domain, $realm, $functional_level,
 865             $password, $kdc_ipv4, $kdc_ipv6, $extra_smbconf_options, $extra_smbconf_shares,
 866             $extra_provision_options) = @_;
 867
 868         my $ctx = $self->provision_raw_prepare($prefix, $server_role,
 869                                                $hostname,
 870                                                $domain, $realm, $functional_level,
 871                                                $password, $kdc_ipv4, $kdc_ipv6);
 872
 873         if (defined($extra_provision_options)) {
 874                 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
 875         } else {
 876                 push (@{$ctx->{provision_options}}, "--use-ntvfs");
 877         }
 878
 879         $ctx->{share} = "$ctx->{prefix_abs}/share";
 880         push(@{$ctx->{directories}}, "$ctx->{share}");
 881         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
 882         push(@{$ctx->{directories}}, "$ctx->{share}/test2");
 883
 884         # precreate directories for printer drivers
 885         push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
 886         push(@{$ctx->{directories}}, "$ctx->{share}/x64");
 887         push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
 888
 889         my $msdfs = "no";
 890         $msdfs = "yes" if ($server_role eq "domain controller");
 891         $ctx->{smb_conf_extra_options} = "
 892
 893         max xmit = 32K
 894         server max protocol = SMB2
 895         host msdfs = $msdfs
 896         lanman auth = yes
 897
 898         # fruit:copyfile is a global option
 899         fruit:copyfile = yes
 900
 901         $extra_smbconf_options
 902
 903 [tmp]
 904         path = $ctx->{share}
 905         read only = no
 906         posix:sharedelay = 100000
 907         posix:oplocktimeout = 3
 908         posix:writetimeupdatedelay = 500000
 909
 910 [xcopy_share]
 911         path = $ctx->{share}
 912         read only = no
 913         posix:sharedelay = 100000
 914         posix:oplocktimeout = 3
 915         posix:writetimeupdatedelay = 500000
 916         create mask = 777
 917         force create mode = 777
 918
 919 [posix_share]
 920         path = $ctx->{share}
 921         read only = no
 922         create mask = 0777
 923         force create mode = 0
 924         directory mask = 0777
 925         force directory mode = 0
 926
 927 [test1]
 928         path = $ctx->{share}/test1
 929         read only = no
 930         posix:sharedelay = 100000
 931         posix:oplocktimeout = 3
 932         posix:writetimeupdatedelay = 500000
 933
 934 [test2]
 935         path = $ctx->{share}/test2
 936         read only = no
 937         posix:sharedelay = 100000
 938         posix:oplocktimeout = 3
 939         posix:writetimeupdatedelay = 500000
 940
 941 [cifs]
 942         path = $ctx->{share}/_ignore_cifs_
 943         read only = no
 944         ntvfs handler = cifs
 945         cifs:server = $ctx->{netbiosname}
 946         cifs:share = tmp
 947         cifs:use-s4u2proxy = yes
 948         # There is no username specified here, instead the client is expected
 949         # to log in with kerberos, and the serverwill use delegated credentials.
 950         # Or the server tries s4u2self/s4u2proxy to impersonate the client
 951
 952 [simple]
 953         path = $ctx->{share}
 954         read only = no
 955         ntvfs handler = simple
 956
 957 [sysvol]
 958         path = $ctx->{statedir}/sysvol
 959         read only = no
 960
 961 [netlogon]
 962         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
 963         read only = no
 964
 965 [cifsposix]
 966         copy = simple
 967         ntvfs handler = cifsposix
 968
 969 [vfs_fruit]
 970         path = $ctx->{share}
 971         vfs objects = catia fruit streams_xattr acl_xattr
 972         ea support = yes
 973         fruit:resource = file
 974         fruit:metadata = netatalk
 975         fruit:locking = netatalk
 976         fruit:encoding = native
 977
 978 $extra_smbconf_shares
 979 ";
 980
 981         if (defined($self->{ldap})) {
 982                 $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
 983                 push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
 984
 985                 my $ldap_uri= "$ctx->{ldapdir}/ldapi";
 986                 $ldap_uri =~ s|/|%2F|g;
 987                 $ldap_uri = "ldapi://$ldap_uri";
 988                 $ctx->{ldap_uri} = $ldap_uri;
 989
 990                 $ctx->{ldap_instance} = lc($ctx->{netbiosname});
 991         }
 992
 993         my $ret = $self->provision_raw_step1($ctx);
 994         unless (defined $ret) {
 995                 return undef;
 996         }
 997
 998         if (defined($self->{ldap})) {
 999                 $ret->{LDAP_URI} = $ctx->{ldap_uri};
1000                 push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
1001                 push (@{$ctx->{provision_options}}, "--ldap-backend-nosync");
1002                 if ($self->{ldap} eq "openldap") {
1003                         push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
1004                         ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx) or die("Unable to create openldap directories");
1005
1006                 } elsif ($self->{ldap} eq "fedora-ds") {
1007                         push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
1008                         push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
1009                         ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx) or die("Unable to create fedora ds directories");
1010                 }
1011
1012         }
1013
1014         return $self->provision_raw_step2($ctx, $ret);
1015 }
1016
1017 sub provision_s4member($$$$$)
1018 {
1019         my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
1020         print "PROVISIONING MEMBER...\n";
1021         my $extra_smb_conf = "
1022         passdb backend = samba_dsdb
1023 winbindd:use external pipes = true
1024
1025 # the source4 smb server doesn't allow signing by default
1026 server signing = enabled
1027
1028 rpc_server:default = external
1029 rpc_server:svcctl = embedded
1030 rpc_server:srvsvc = embedded
1031 rpc_server:eventlog = embedded
1032 rpc_server:ntsvcs = embedded
1033 rpc_server:winreg = embedded
1034 rpc_server:spoolss = embedded
1035 rpc_daemon:spoolssd = embedded
1036 rpc_server:tcpip = no
1037 ";
1038         if ($more_conf) {
1039                 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1040         }
1041         my $ret = $self->provision($prefix,
1042                                    "member server",
1043                                    $hostname,
1044                                    "SAMBADOMAIN",
1045                                    "samba.example.com",
1046                                    "2008",
1047                                    "locMEMpass3",
1048                                    $dcvars->{SERVER_IP},
1049                                    $dcvars->{SERVER_IPV6},
1050                                    $extra_smb_conf, "", undef);
1051         unless ($ret) {
1052                 return undef;
1053         }
1054
1055         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1056         my $cmd = "";
1057         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1058         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1059                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1060         } else {
1061                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1062         }
1063         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1064         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1065         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1066         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1067         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1068
1069         unless (system($cmd) == 0) {
1070                 warn("Join failed\n$cmd");
1071                 return undef;
1072         }
1073
1074         $ret->{MEMBER_SERVER} = $ret->{SERVER};
1075         $ret->{MEMBER_SERVER_IP} = $ret->{SERVER_IP};
1076         $ret->{MEMBER_SERVER_IPV6} = $ret->{SERVER_IPV6};
1077         $ret->{MEMBER_NETBIOSNAME} = $ret->{NETBIOSNAME};
1078         $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
1079         $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
1080
1081         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1082         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1083         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1084         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1085         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1086         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1087
1088         return $ret;
1089 }
1090
1091 sub provision_rpc_proxy($$$)
1092 {
1093         my ($self, $prefix, $dcvars) = @_;
1094         print "PROVISIONING RPC PROXY...\n";
1095
1096         my $extra_smbconf_options = "
1097         passdb backend = samba_dsdb
1098
1099         # rpc_proxy
1100         dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1101         dcerpc endpoint servers = epmapper, remote
1102         dcerpc_remote:interfaces = rpcecho
1103
1104 [cifs_to_dc]
1105         path = /tmp/_ignore_cifs_to_dc_/_none_
1106         read only = no
1107         ntvfs handler = cifs
1108         cifs:server = $dcvars->{SERVER}
1109         cifs:share = cifs
1110         cifs:use-s4u2proxy = yes
1111         # There is no username specified here, instead the client is expected
1112         # to log in with kerberos, and the serverwill use delegated credentials.
1113         # Or the server tries s4u2self/s4u2proxy to impersonate the client
1114
1115 ";
1116
1117         my $ret = $self->provision($prefix,
1118                                    "member server",
1119                                    "localrpcproxy",
1120                                    "SAMBADOMAIN",
1121                                    "samba.example.com",
1122                                    "2008",
1123                                    "locRPCproxypass4",
1124                                    $dcvars->{SERVER_IP},
1125                                    $dcvars->{SERVER_IPV6},
1126                                    $extra_smbconf_options, "", undef);
1127         unless ($ret) {
1128                 return undef;
1129         }
1130
1131         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1132
1133         # The joind runs in the context of the rpc_proxy/member for now
1134         my $cmd = "";
1135         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1136         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1137                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1138         } else {
1139                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1140         }
1141         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1142         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1143         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1144         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1145         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1146
1147         unless (system($cmd) == 0) {
1148                 warn("Join failed\n$cmd");
1149                 return undef;
1150         }
1151
1152         # Setting up delegation runs in the context of the DC for now
1153         $cmd = "";
1154         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1155         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1156         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1157         $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1158         $cmd .= " $dcvars->{CONFIGURATION}";
1159         print $cmd;
1160
1161         unless (system($cmd) == 0) {
1162                 warn("Delegation failed\n$cmd");
1163                 return undef;
1164         }
1165
1166         # Setting up delegation runs in the context of the DC for now
1167         $cmd = "";
1168         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1169         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1170         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1171         $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1172         $cmd .= " $dcvars->{CONFIGURATION}";
1173
1174         unless (system($cmd) == 0) {
1175                 warn("Delegation failed\n$cmd");
1176                 return undef;
1177         }
1178
1179         $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
1180         $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
1181         $ret->{RPC_PROXY_SERVER_IPV6} = $ret->{SERVER_IPV6};
1182         $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
1183         $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
1184         $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
1185
1186         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1187         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1188         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1189         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1190         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1191         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1192
1193         return $ret;
1194 }
1195
1196 sub provision_promoted_dc($$$)
1197 {
1198         my ($self, $prefix, $dcvars) = @_;
1199         print "PROVISIONING PROMOTED DC...\n";
1200
1201         # We do this so that we don't run the provision.  That's the job of 'samba-tool domain dcpromo'.
1202         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1203                                                "promotedvdc",
1204                                                "SAMBADOMAIN",
1205                                                "samba.example.com",
1206                                                "2008",
1207                                                $dcvars->{PASSWORD},
1208                                                $dcvars->{SERVER_IP},
1209                                                $dcvars->{SERVER_IPV6});
1210
1211         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1212
1213         $ctx->{smb_conf_extra_options} = "
1214         max xmit = 32K
1215         server max protocol = SMB2
1216
1217         ntlm auth = ntlmv2-only
1218
1219 [sysvol]
1220         path = $ctx->{statedir}/sysvol
1221         read only = yes
1222
1223 [netlogon]
1224         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1225         read only = no
1226
1227 ";
1228
1229         my $ret = $self->provision_raw_step1($ctx);
1230         unless ($ret) {
1231                 return undef;
1232         }
1233
1234         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1235         my $cmd = "";
1236         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1237         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1238                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1239         } else {
1240                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1241         }
1242         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1243         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1244         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1245         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1246         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1247
1248         unless (system($cmd) == 0) {
1249                 warn("Join failed\n$cmd");
1250                 return undef;
1251         }
1252
1253         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1254         my $cmd = "";
1255         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1256         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1257         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1258         $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1259         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1260         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs --dns-backend=BIND9_DLZ";
1261
1262         unless (system($cmd) == 0) {
1263                 warn("Join failed\n$cmd");
1264                 return undef;
1265         }
1266
1267         $ret->{PROMOTED_DC_SERVER} = $ret->{SERVER};
1268         $ret->{PROMOTED_DC_SERVER_IP} = $ret->{SERVER_IP};
1269         $ret->{PROMOTED_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1270         $ret->{PROMOTED_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1271
1272         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1273         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1274         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1275         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1276         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1277         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1278
1279         return $ret;
1280 }
1281
1282 sub provision_vampire_dc($$$)
1283 {
1284         my ($self, $prefix, $dcvars, $fl) = @_;
1285         print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1286         my $name = "localvampiredc";
1287
1288         if ($fl == "2000") {
1289             $name = "vampire2000dc";
1290         }
1291
1292         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1293         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1294                                                $name,
1295                                                $dcvars->{DOMAIN},
1296                                                $dcvars->{REALM},
1297                                                $fl,
1298                                                $dcvars->{PASSWORD},
1299                                                $dcvars->{SERVER_IP},
1300                                                $dcvars->{SERVER_IPV6});
1301
1302         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1303
1304         $ctx->{smb_conf_extra_options} = "
1305         max xmit = 32K
1306         server max protocol = SMB2
1307
1308         ntlm auth = mschapv2-and-ntlmv2-only
1309
1310 [sysvol]
1311         path = $ctx->{statedir}/sysvol
1312         read only = yes
1313
1314 [netlogon]
1315         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1316         read only = no
1317
1318 ";
1319
1320         my $ret = $self->provision_raw_step1($ctx);
1321         unless ($ret) {
1322                 return undef;
1323         }
1324
1325         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1326         my $cmd = "";
1327         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1328         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1329                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1330         } else {
1331                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1332         }
1333         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1334         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1335         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1336         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1337         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1338
1339         unless (system($cmd) == 0) {
1340                 warn("Join failed\n$cmd");
1341                 return undef;
1342         }
1343
1344         if ($fl == "2000") {
1345                 $ret->{VAMPIRE_2000_DC_SERVER} = $ret->{SERVER};
1346                 $ret->{VAMPIRE_2000_DC_SERVER_IP} = $ret->{SERVER_IP};
1347                 $ret->{VAMPIRE_2000_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1348                 $ret->{VAMPIRE_2000_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1349         } else {
1350                 $ret->{VAMPIRE_DC_SERVER} = $ret->{SERVER};
1351                 $ret->{VAMPIRE_DC_SERVER_IP} = $ret->{SERVER_IP};
1352                 $ret->{VAMPIRE_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1353                 $ret->{VAMPIRE_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1354         }
1355         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1356         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1357         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1358         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1359         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1360         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1361         $ret->{DC_REALM} = $dcvars->{DC_REALM};
1362
1363         return $ret;
1364 }
1365
1366 sub provision_subdom_dc($$$)
1367 {
1368         my ($self, $prefix, $dcvars) = @_;
1369         print "PROVISIONING SUBDOMAIN DC...\n";
1370
1371         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1372         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1373                                                "localsubdc",
1374                                                "SAMBASUBDOM",
1375                                                "sub.samba.example.com",
1376                                                "2008",
1377                                                $dcvars->{PASSWORD},
1378                                                undef);
1379
1380         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1381
1382         $ctx->{smb_conf_extra_options} = "
1383         max xmit = 32K
1384         server max protocol = SMB2
1385
1386 [sysvol]
1387         path = $ctx->{statedir}/sysvol
1388         read only = yes
1389
1390 [netlogon]
1391         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1392         read only = no
1393
1394 ";
1395
1396         my $ret = $self->provision_raw_step1($ctx);
1397         unless ($ret) {
1398                 return undef;
1399         }
1400
1401         Samba::mk_krb5_conf($ctx);
1402         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1403
1404         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1405         my $cmd = "";
1406         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1407         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1408                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1409         } else {
1410                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1411         }
1412         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1413         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1414         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{dnsname} subdomain ";
1415         $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
1416         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1417         $cmd .= " --adminpass=$ret->{PASSWORD}";
1418
1419         unless (system($cmd) == 0) {
1420                 warn("Join failed\n$cmd");
1421                 return undef;
1422         }
1423
1424         $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
1425         $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
1426         $ret->{SUBDOM_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1427         $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1428
1429         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1430         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1431         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1432         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1433         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1434         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1435
1436         return $ret;
1437 }
1438
1439 sub provision_ad_dc_ntvfs($$)
1440 {
1441         my ($self, $prefix) = @_;
1442
1443         # We keep the old 'winbind' name here in server services to
1444         # ensure upgrades which used that name still work with the now
1445         # alias.
1446
1447         print "PROVISIONING AD DC (NTVFS)...\n";
1448         my $extra_conf_options = "netbios aliases = localDC1-a
1449         server services = +winbind -winbindd
1450         ldap server require strong auth = allow_sasl_over_tls
1451         allow nt4 crypto = yes
1452         lsa over netlogon = yes
1453         rpc server port = 1027
1454         auth event notification = true
1455         ";
1456         my $ret = $self->provision($prefix,
1457                                    "domain controller",
1458                                    "localdc",
1459                                    "SAMBADOMAIN",
1460                                    "samba.example.com",
1461                                    "2008",
1462                                    "locDCpass1",
1463                                    undef,
1464                                    undef,
1465                                    $extra_conf_options,
1466                                    "",
1467                                    undef);
1468         unless ($ret) {
1469                 return undef;
1470         }
1471
1472         unless($self->add_wins_config("$prefix/private")) {
1473                 warn("Unable to add wins configuration");
1474                 return undef;
1475         }
1476         $ret->{NETBIOSALIAS} = "localdc1-a";
1477         $ret->{DC_SERVER} = $ret->{SERVER};
1478         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1479         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1480         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1481         $ret->{DC_USERNAME} = $ret->{USERNAME};
1482         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1483         $ret->{DC_REALM} = $ret->{REALM};
1484
1485         return $ret;
1486 }
1487
1488 sub provision_fl2000dc($$)
1489 {
1490         my ($self, $prefix) = @_;
1491
1492         print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1493         my $extra_conf_options = "
1494         spnego:simulate_w2k=yes
1495         ntlmssp_server:force_old_spnego=yes
1496 ";
1497         my $ret = $self->provision($prefix,
1498                                    "domain controller",
1499                                    "dc5",
1500                                    "SAMBA2000",
1501                                    "samba2000.example.com",
1502                                    "2000",
1503                                    "locDCpass5",
1504                                    undef,
1505                                    undef,
1506                                    $extra_conf_options,
1507                                    "",
1508                                    undef);
1509         unless ($ret) {
1510                 return undef;
1511         }
1512
1513         unless($self->add_wins_config("$prefix/private")) {
1514                 warn("Unable to add wins configuration");
1515                 return undef;
1516         }
1517         $ret->{DC_SERVER} = $ret->{SERVER};
1518         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1519         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1520         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1521         $ret->{DC_USERNAME} = $ret->{USERNAME};
1522         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1523         $ret->{DC_REALM} = $ret->{REALM};
1524
1525         return $ret;
1526 }
1527
1528 sub provision_fl2003dc($$$)
1529 {
1530         my ($self, $prefix, $dcvars) = @_;
1531         my $swiface1 = Samba::get_interface("fakednsforwarder1");
1532         my $swiface2 = Samba::get_interface("fakednsforwarder2");
1533
1534         print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1535         my $extra_conf_options = "allow dns updates = nonsecure and secure
1536         dcesrv:header signing = no
1537         dns forwarder = 127.0.0.$swiface1 127.0.0.$swiface2";
1538         my $ret = $self->provision($prefix,
1539                                    "domain controller",
1540                                    "dc6",
1541                                    "SAMBA2003",
1542                                    "samba2003.example.com",
1543                                    "2003",
1544                                    "locDCpass6",
1545                                    undef,
1546                                    undef,
1547                                    $extra_conf_options,
1548                                    "",
1549                                    undef);
1550         unless (defined $ret) {
1551                 return undef;
1552         }
1553
1554         $ret->{DC_SERVER} = $ret->{SERVER};
1555         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1556         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1557         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1558         $ret->{DC_USERNAME} = $ret->{USERNAME};
1559         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1560         $ret->{DNS_FORWARDER1} = "127.0.0.$swiface1";
1561         $ret->{DNS_FORWARDER2} = "127.0.0.$swiface2";
1562
1563         my @samba_tool_options;
1564         push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1565         push (@samba_tool_options, "domain");
1566         push (@samba_tool_options, "passwordsettings");
1567         push (@samba_tool_options, "set");
1568         push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1569         push (@samba_tool_options, "--min-pwd-age=0");
1570         push (@samba_tool_options, "--history-length=1");
1571
1572         my $samba_tool_cmd = join(" ", @samba_tool_options);
1573
1574         unless (system($samba_tool_cmd) == 0) {
1575                 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1576                 return undef;
1577         }
1578
1579         unless($self->add_wins_config("$prefix/private")) {
1580                 warn("Unable to add wins configuration");
1581                 return undef;
1582         }
1583
1584         return $ret;
1585 }
1586
1587 sub provision_fl2008r2dc($$$)
1588 {
1589         my ($self, $prefix, $dcvars) = @_;
1590
1591         print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1592         my $extra_conf_options = "ldap server require strong auth = no";
1593         my $ret = $self->provision($prefix,
1594                                    "domain controller",
1595                                    "dc7",
1596                                    "SAMBA2008R2",
1597                                    "samba2008R2.example.com",
1598                                    "2008_R2",
1599                                    "locDCpass7",
1600                                    undef,
1601                                    undef,
1602                                    $extra_conf_options,
1603                                    "",
1604                                    undef);
1605         unless (defined $ret) {
1606                 return undef;
1607         }
1608
1609         unless ($self->add_wins_config("$prefix/private")) {
1610                 warn("Unable to add wins configuration");
1611                 return undef;
1612         }
1613         $ret->{DC_SERVER} = $ret->{SERVER};
1614         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1615         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1616         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1617         $ret->{DC_USERNAME} = $ret->{USERNAME};
1618         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1619         $ret->{DC_REALM} = $ret->{REALM};
1620
1621         return $ret;
1622 }
1623
1624
1625 sub provision_rodc($$$)
1626 {
1627         my ($self, $prefix, $dcvars) = @_;
1628         print "PROVISIONING RODC...\n";
1629
1630         # We do this so that we don't run the provision.  That's the job of 'net join RODC'.
1631         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1632                                                "rodc",
1633                                                "SAMBADOMAIN",
1634                                                "samba.example.com",
1635                                                "2008",
1636                                                $dcvars->{PASSWORD},
1637                                                $dcvars->{SERVER_IP},
1638                                                $dcvars->{SERVER_IPV6});
1639         unless ($ctx) {
1640                 return undef;
1641         }
1642
1643         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1644
1645         $ctx->{share} = "$ctx->{prefix_abs}/share";
1646         push(@{$ctx->{directories}}, "$ctx->{share}");
1647
1648         $ctx->{smb_conf_extra_options} = "
1649         max xmit = 32K
1650         server max protocol = SMB2
1651         password server = $dcvars->{DC_SERVER}
1652
1653 [sysvol]
1654         path = $ctx->{statedir}/sysvol
1655         read only = yes
1656
1657 [netlogon]
1658         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1659         read only = yes
1660
1661 [tmp]
1662         path = $ctx->{share}
1663         read only = no
1664         posix:sharedelay = 10000
1665         posix:oplocktimeout = 3
1666         posix:writetimeupdatedelay = 50000
1667
1668 ";
1669
1670         my $ret = $self->provision_raw_step1($ctx);
1671         unless ($ret) {
1672                 return undef;
1673         }
1674
1675         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1676         my $cmd = "";
1677         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1678         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1679                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1680         } else {
1681                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1682         }
1683         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1684         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1685         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1686         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1687         $cmd .= " --server=$dcvars->{DC_SERVER} --use-ntvfs";
1688
1689         unless (system($cmd) == 0) {
1690                 warn("RODC join failed\n$cmd");
1691                 return undef;
1692         }
1693
1694         # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1695         # user password verified on the RODC
1696         my $testallowed_account = "testallowed account";
1697         $cmd = "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1698         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1699         $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1700         $cmd .= " --server=$dcvars->{DC_SERVER}";
1701
1702         unless (system($cmd) == 0) {
1703                 warn("RODC join failed\n$cmd");
1704                 return undef;
1705         }
1706
1707         # we overwrite the kdc after the RODC join
1708         # so that use the RODC as kdc and test
1709         # the proxy code
1710         $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1711         $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1712         Samba::mk_krb5_conf($ctx);
1713         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1714
1715         $ret->{RODC_DC_SERVER} = $ret->{SERVER};
1716         $ret->{RODC_DC_SERVER_IP} = $ret->{SERVER_IP};
1717         $ret->{RODC_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1718         $ret->{RODC_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1719
1720         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1721         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1722         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1723         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1724         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1725         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1726
1727         return $ret;
1728 }
1729
1730 sub read_config_h($)
1731 {
1732         my ($name) = @_;
1733         my %ret = {};
1734         open(LF, "<$name") or die("unable to read $name: $!");
1735         while (<LF>) {
1736                 chomp;
1737                 next if not (/^#define /);
1738                 if (/^#define (.*?)[ \t]+(.*?)$/) {
1739                         $ret{$1} = $2;
1740                         next;
1741                 }
1742                 if (/^#define (.*?)[ \t]+$/) {
1743                         $ret{$1} = 1;;
1744                         next;
1745                 }
1746         }
1747         close(LF);
1748         return \%ret;
1749 }
1750
1751 sub provision_ad_dc($$)
1752 {
1753         my ($self, $prefix) = @_;
1754
1755         my $prefix_abs = abs_path($prefix);
1756
1757         my $bindir_abs = abs_path($self->{bindir});
1758         my $lockdir="$prefix_abs/lockdir";
1759         my $conffile="$prefix_abs/etc/smb.conf";
1760
1761         my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
1762         $require_mutexes = "" if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} eq "1");
1763
1764         my $config_h = {};
1765
1766         if (defined($ENV{CONFIG_H})) {
1767                 $config_h = read_config_h($ENV{CONFIG_H});
1768         }
1769
1770         my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
1771         $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
1772
1773         my $extra_smbconf_options = "
1774         server services = -smb +s3fs
1775         xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1776
1777         dbwrap_tdb_mutexes:* = yes
1778         ${require_mutexes}
1779
1780         ${password_hash_gpg_key_ids}
1781
1782         kernel oplocks = no
1783         kernel change notify = no
1784         smb2 leases = no
1785
1786         logging = file
1787         printing = bsd
1788         printcap name = /dev/null
1789
1790         max protocol = SMB3
1791         read only = no
1792
1793         smbd:sharedelay = 100000
1794         smbd:writetimeupdatedelay = 500000
1795         create mask = 755
1796         dos filemode = yes
1797
1798         dcerpc endpoint servers = -winreg -srvsvc
1799
1800         printcap name = /dev/null
1801
1802         addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1803         deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1804
1805         printing = vlp
1806         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1807         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1808         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1809         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1810         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1811         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1812         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1813         lpq cache time = 0
1814         print notify backchannel = yes
1815
1816         auth event notification = true
1817 ";
1818
1819         my $extra_smbconf_shares = "
1820
1821 [tmpenc]
1822         copy = tmp
1823         smb encrypt = required
1824
1825 [tmpcase]
1826         copy = tmp
1827         case sensitive = yes
1828
1829 [tmpguest]
1830         copy = tmp
1831         guest ok = yes
1832
1833 [hideunread]
1834         copy = tmp
1835         hide unreadable = yes
1836
1837 [durable]
1838         copy = tmp
1839         kernel share modes = no
1840         kernel oplocks = no
1841         posix locking = no
1842
1843 [print\$]
1844         copy = tmp
1845
1846 [print1]
1847         copy = tmp
1848         printable = yes
1849
1850 [print2]
1851         copy = print1
1852 [print3]
1853         copy = print1
1854 [lp]
1855         copy = print1
1856 ";
1857
1858         print "PROVISIONING AD DC...\n";
1859         my $ret = $self->provision($prefix,
1860                                    "domain controller",
1861                                    "addc",
1862                                    "ADDOMAIN",
1863                                    "addom.samba.example.com",
1864                                    "2008",
1865                                    "locDCpass1",
1866                                    undef,
1867                                    undef,
1868                                    $extra_smbconf_options,
1869                                    $extra_smbconf_shares,
1870                                    undef);
1871         unless (defined $ret) {
1872                 return undef;
1873         }
1874
1875         unless($self->add_wins_config("$prefix/private")) {
1876                 warn("Unable to add wins configuration");
1877                 return undef;
1878         }
1879
1880         $ret->{DC_SERVER} = $ret->{SERVER};
1881         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1882         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1883         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1884         $ret->{DC_USERNAME} = $ret->{USERNAME};
1885         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1886
1887         return $ret;
1888 }
1889
1890 sub provision_chgdcpass($$)
1891 {
1892         my ($self, $prefix) = @_;
1893
1894         print "PROVISIONING CHGDCPASS...\n";
1895         my $extra_provision_options = undef;
1896         # This environment disallows the use of this password
1897         # (and also removes the default AD complexity checks)
1898         my $unacceptable_password = "widk3Dsle32jxdBdskldsk55klASKQ";
1899         push (@{$extra_provision_options}, "--dns-backend=BIND9_DLZ");
1900         my $ret = $self->provision($prefix,
1901                                    "domain controller",
1902                                    "chgdcpass",
1903                                    "CHDCDOMAIN",
1904                                    "chgdcpassword.samba.example.com",
1905                                    "2008",
1906                                    "chgDCpass1",
1907                                    undef,
1908                                    undef,
1909                                    "check password script = sed -e '/$unacceptable_password/{;q1}; /$unacceptable_password/!{q0}'\n",
1910                                    "",
1911                                    $extra_provision_options);
1912         unless (defined $ret) {
1913                 return undef;
1914         }
1915
1916         unless($self->add_wins_config("$prefix/private")) {
1917                 warn("Unable to add wins configuration");
1918                 return undef;
1919         }
1920
1921         # Remove secrets.tdb from this environment to test that we
1922         # still start up on systems without the new matching
1923         # secrets.tdb records.
1924         unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
1925                 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
1926                 return undef;
1927         }
1928
1929         $ret->{DC_SERVER} = $ret->{SERVER};
1930         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1931         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1932         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1933         $ret->{DC_USERNAME} = $ret->{USERNAME};
1934         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1935         $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
1936
1937         return $ret;
1938 }
1939
1940 sub teardown_env_terminate($$)
1941 {
1942         my ($self, $envvars) = @_;
1943         my $pid;
1944
1945         # This should cause samba to terminate gracefully
1946         close($envvars->{STDIN_PIPE});
1947
1948         $pid = $envvars->{SAMBA_PID};
1949         my $count = 0;
1950         my $childpid;
1951
1952         # This should give it time to write out the gcov data
1953         until ($count > 15) {
1954             if (Samba::cleanup_child($pid, "samba") != 0) {
1955                 return;
1956             }
1957             sleep(1);
1958             $count++;
1959         }
1960
1961         # After 15 Seconds, work out why this thing is still alive
1962         warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
1963         system("$self->{srcdir}/selftest/gdb_backtrace $pid");
1964
1965         until ($count > 30) {
1966             if (Samba::cleanup_child($pid, "samba") != 0) {
1967                 return;
1968             }
1969             sleep(1);
1970             $count++;
1971         }
1972
1973         if (kill(0, $pid)) {
1974             warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
1975             kill "TERM", $pid;
1976         }
1977
1978         until ($count > 40) {
1979             if (Samba::cleanup_child($pid, "samba") != 0) {
1980                 return;
1981             }
1982             sleep(1);
1983             $count++;
1984         }
1985         # If it is still around, kill it
1986         if (kill(0, $pid)) {
1987             warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
1988             kill 9, $pid;
1989         }
1990         return;
1991 }
1992
1993 sub teardown_env($$)
1994 {
1995         my ($self, $envvars) = @_;
1996         teardown_env_terminate($self, $envvars);
1997
1998         $self->slapd_stop($envvars) if ($self->{ldap});
1999
2000         print $self->getlog_env($envvars);
2001
2002         return;
2003 }
2004
2005 sub getlog_env($$)
2006 {
2007         my ($self, $envvars) = @_;
2008         my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
2009         my $out = $title;
2010
2011         open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
2012
2013         seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
2014         while (<LOG>) {
2015                 $out .= $_;
2016         }
2017         $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
2018         close(LOG);
2019
2020         return "" if $out eq $title;
2021
2022         return $out;
2023 }
2024
2025 sub check_env($$)
2026 {
2027         my ($self, $envvars) = @_;
2028         my $samba_pid = $envvars->{SAMBA_PID};
2029
2030         if (not defined($samba_pid)) {
2031             return 0;
2032         } elsif ($samba_pid > 0) {
2033             my $childpid = Samba::cleanup_child($samba_pid, "samba");
2034
2035             if ($childpid == 0) {
2036                 return 1;
2037             }
2038             return 0;
2039         } else {
2040             return 1;
2041         }
2042
2043 }
2044
2045 sub setup_env($$$)
2046 {
2047         my ($self, $envname, $path) = @_;
2048         my $target3 = $self->{target3};
2049
2050         $ENV{ENVNAME} = $envname;
2051
2052         if (defined($self->{vars}->{$envname})) {
2053                 return $self->{vars}->{$envname};
2054         }
2055
2056         if ($envname eq "ad_dc_ntvfs") {
2057                 return $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2058         } elsif ($envname eq "fl2000dc") {
2059                 return $self->setup_fl2000dc("$path/fl2000dc");
2060         } elsif ($envname eq "vampire_2000_dc") {
2061                 if (not defined($self->{vars}->{fl2000dc})) {
2062                         $self->setup_fl2000dc("$path/fl2000dc");
2063                 }
2064                 return $self->setup_vampire_dc("$path/vampire_2000_dc", $self->{vars}->{fl2000dc}, "2000");
2065         } elsif ($envname eq "fl2003dc") {
2066                 if (not defined($self->{vars}->{ad_dc})) {
2067                         $self->setup_ad_dc("$path/ad_dc");
2068                 }
2069                 return $self->setup_fl2003dc("$path/fl2003dc", $self->{vars}->{ad_dc});
2070         } elsif ($envname eq "fl2008r2dc") {
2071                 if (not defined($self->{vars}->{ad_dc})) {
2072                         $self->setup_ad_dc("$path/ad_dc");
2073                 }
2074                 return $self->setup_fl2008r2dc("$path/fl2008r2dc", $self->{vars}->{ad_dc});
2075         } elsif ($envname eq "rpc_proxy") {
2076                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2077                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2078                 }
2079                 return $self->setup_rpc_proxy("$path/rpc_proxy", $self->{vars}->{ad_dc_ntvfs});
2080         } elsif ($envname eq "vampire_dc") {
2081                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2082                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2083                 }
2084                 return $self->setup_vampire_dc("$path/vampire_dc", $self->{vars}->{ad_dc_ntvfs}, "2008");
2085         } elsif ($envname eq "promoted_dc") {
2086                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2087                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2088                 }
2089                 return $self->setup_promoted_dc("$path/promoted_dc", $self->{vars}->{ad_dc_ntvfs});
2090         } elsif ($envname eq "subdom_dc") {
2091                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2092                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2093                 }
2094                 return $self->setup_subdom_dc("$path/subdom_dc", $self->{vars}->{ad_dc_ntvfs});
2095         } elsif ($envname eq "s4member_dflt_domain") {
2096                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2097                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2098                 }
2099                 return $self->setup_s4member_dflt_domain("$path/s4member_dflt_domain", $self->{vars}->{ad_dc_ntvfs});
2100         } elsif ($envname eq "s4member") {
2101                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2102                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2103                 }
2104                 return $self->setup_s4member("$path/s4member", $self->{vars}->{ad_dc_ntvfs});
2105         } elsif ($envname eq "rodc") {
2106                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2107                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2108                 }
2109                 return $self->setup_rodc("$path/rodc", $self->{vars}->{ad_dc_ntvfs});
2110         } elsif ($envname eq "chgdcpass") {
2111                 return $self->setup_chgdcpass("$path/chgdcpass", $self->{vars}->{chgdcpass});
2112         } elsif ($envname eq "ad_member") {
2113                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2114                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2115                 }
2116                 return $target3->setup_admember("$path/ad_member", $self->{vars}->{ad_dc_ntvfs}, 29);
2117         } elsif ($envname eq "ad_dc") {
2118                 return $self->setup_ad_dc("$path/ad_dc");
2119         } elsif ($envname eq "ad_dc_no_nss") {
2120                 return $self->setup_ad_dc("$path/ad_dc_no_nss", "no_nss");
2121         } elsif ($envname eq "ad_member_rfc2307") {
2122                 if (not defined($self->{vars}->{ad_dc_ntvfs})) {
2123                         $self->setup_ad_dc_ntvfs("$path/ad_dc_ntvfs");
2124                 }
2125                 return $target3->setup_admember_rfc2307("$path/ad_member_rfc2307",
2126                                                         $self->{vars}->{ad_dc_ntvfs}, 34);
2127         } elsif ($envname eq "ad_member_idmap_rid") {
2128                 if (not defined($self->{vars}->{ad_dc})) {
2129                         $self->setup_ad_dc("$path/ad_dc");
2130                 }
2131                 return $target3->setup_ad_member_idmap_rid("$path/ad_member_idmap_rid",
2132                                                            $self->{vars}->{ad_dc});
2133         } elsif ($envname eq "none") {
2134                 return $self->setup_none("$path/none");
2135         } else {
2136                 return "UNKNOWN";
2137         }
2138 }
2139
2140 sub setup_s4member($$$)
2141 {
2142         my ($self, $path, $dc_vars) = @_;
2143
2144         my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2145
2146         if (defined $env) {
2147                 if (not defined($self->check_or_start($env, "standard"))) {
2148                         return undef;
2149                 }
2150
2151                 $self->{vars}->{s4member} = $env;
2152         }
2153
2154         return $env;
2155 }
2156
2157 sub setup_s4member_dflt_domain($$$)
2158 {
2159         my ($self, $path, $dc_vars) = @_;
2160
2161         my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2162                                             "winbind use default domain = yes");
2163
2164         if (defined $env) {
2165                 if (not defined($self->check_or_start($env, "standard"))) {
2166                         return undef;
2167                 }
2168
2169                 $self->{vars}->{s4member_dflt_domain} = $env;
2170         }
2171
2172         return $env;
2173 }
2174
2175 sub setup_rpc_proxy($$$)
2176 {
2177         my ($self, $path, $dc_vars) = @_;
2178
2179         my $env = $self->provision_rpc_proxy($path, $dc_vars);
2180
2181         if (defined $env) {
2182                 if (not defined($self->check_or_start($env, "standard"))) {
2183                         return undef;
2184                 }
2185
2186                 $self->{vars}->{rpc_proxy} = $env;
2187         }
2188         return $env;
2189 }
2190
2191 sub setup_ad_dc_ntvfs($$)
2192 {
2193         my ($self, $path) = @_;
2194
2195         my $env = $self->provision_ad_dc_ntvfs($path);
2196         if (defined $env) {
2197                 if (not defined($self->check_or_start($env, "standard"))) {
2198                     warn("Failed to start ad_dc_ntvfs");
2199                         return undef;
2200                 }
2201
2202                 $self->{vars}->{ad_dc_ntvfs} = $env;
2203         }
2204         return $env;
2205 }
2206
2207 sub setup_chgdcpass($$)
2208 {
2209         my ($self, $path) = @_;
2210
2211         my $env = $self->provision_chgdcpass($path);
2212         if (defined $env) {
2213                 if (not defined($self->check_or_start($env, "standard"))) {
2214                         return undef;
2215                 }
2216
2217                 $self->{vars}->{chgdcpass} = $env;
2218         }
2219         return $env;
2220 }
2221
2222 sub setup_fl2000dc($$)
2223 {
2224         my ($self, $path) = @_;
2225
2226         my $env = $self->provision_fl2000dc($path);
2227         if (defined $env) {
2228                 if (not defined($self->check_or_start($env, "standard"))) {
2229                         return undef;
2230                 }
2231
2232                 $self->{vars}->{fl2000dc} = $env;
2233         }
2234
2235         return $env;
2236 }
2237
2238 sub setup_fl2003dc($$$)
2239 {
2240         my ($self, $path, $dc_vars) = @_;
2241
2242         my $env = $self->provision_fl2003dc($path);
2243
2244         if (defined $env) {
2245                 if (not defined($self->check_or_start($env, "standard"))) {
2246                         return undef;
2247                 }
2248
2249                 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2250
2251                 $self->{vars}->{fl2003dc} = $env;
2252         }
2253         return $env;
2254 }
2255
2256 sub setup_fl2008r2dc($$$)
2257 {
2258         my ($self, $path, $dc_vars) = @_;
2259
2260         my $env = $self->provision_fl2008r2dc($path);
2261
2262         if (defined $env) {
2263                 if (not defined($self->check_or_start($env, "standard"))) {
2264                         return undef;
2265                 }
2266
2267                 my $upn_array = ["$env->{REALM}.upn"];
2268                 my $spn_array = ["$env->{REALM}.spn"];
2269
2270                 $self->setup_namespaces($env, $upn_array, $spn_array);
2271
2272                 $env = $self->setup_trust($env, $dc_vars, "forest", "");
2273
2274                 $self->{vars}->{fl2008r2dc} = $env;
2275         }
2276
2277         return $env;
2278 }
2279
2280 sub setup_vampire_dc($$$$)
2281 {
2282         my ($self, $path, $dc_vars, $fl) = @_;
2283
2284         my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2285
2286         if (defined $env) {
2287                 if (not defined($self->check_or_start($env, "single"))) {
2288                         return undef;
2289                 }
2290
2291                 $self->{vars}->{vampire_dc} = $env;
2292
2293                 # force replicated DC to update repsTo/repsFrom
2294                 # for vampired partitions
2295                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2296
2297                 # as 'vampired' dc may add data in its local replica
2298                 # we need to synchronize data between DCs
2299                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2300                 my $cmd = "";
2301                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2302                 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2303                         $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2304                 } else {
2305                         $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2306                 }
2307                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2308                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2309                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2310                 $cmd .= " $dc_vars->{CONFIGURATION}";
2311                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2312                 # replicate Configuration NC
2313                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2314                 unless(system($cmd_repl) == 0) {
2315                         warn("Failed to replicate\n$cmd_repl");
2316                         return undef;
2317                 }
2318                 # replicate Default NC
2319                 $cmd_repl = "$cmd \"$base_dn\"";
2320                 unless(system($cmd_repl) == 0) {
2321                         warn("Failed to replicate\n$cmd_repl");
2322                         return undef;
2323                 }
2324
2325                 # Pull in a full set of changes from the main DC
2326                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2327                 $cmd = "";
2328                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2329                 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2330                         $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2331                 } else {
2332                         $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2333                 }
2334                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2335                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2336                 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2337                 $cmd .= " $dc_vars->{CONFIGURATION}";
2338                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2339                 # replicate Configuration NC
2340                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2341                 unless(system($cmd_repl) == 0) {
2342                         warn("Failed to replicate\n$cmd_repl");
2343                         return undef;
2344                 }
2345                 # replicate Default NC
2346                 $cmd_repl = "$cmd \"$base_dn\"";
2347                 unless(system($cmd_repl) == 0) {
2348                         warn("Failed to replicate\n$cmd_repl");
2349                         return undef;
2350                 }
2351         }
2352
2353         return $env;
2354 }
2355
2356 sub setup_promoted_dc($$$)
2357 {
2358         my ($self, $path, $dc_vars) = @_;
2359
2360         my $env = $self->provision_promoted_dc($path, $dc_vars);
2361
2362         if (defined $env) {
2363                 if (not defined($self->check_or_start($env, "single"))) {
2364                         return undef;
2365                 }
2366
2367                 $self->{vars}->{promoted_dc} = $env;
2368
2369                 # force source and replicated DC to update repsTo/repsFrom
2370                 # for vampired partitions
2371                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2372                 my $cmd = "";
2373                 # as 'vampired' dc may add data in its local replica
2374                 # we need to synchronize data between DCs
2375                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2376                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2377                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2378                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2379                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2380                 $cmd .= " $dc_vars->{CONFIGURATION}";
2381                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2382                 # replicate Configuration NC
2383                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2384                 unless(system($cmd_repl) == 0) {
2385                         warn("Failed to replicate\n$cmd_repl");
2386                         return undef;
2387                 }
2388                 # replicate Default NC
2389                 $cmd_repl = "$cmd \"$base_dn\"";
2390                 unless(system($cmd_repl) == 0) {
2391                         warn("Failed to replicate\n$cmd_repl");
2392                         return undef;
2393                 }
2394         }
2395
2396         return $env;
2397 }
2398
2399 sub setup_subdom_dc($$$)
2400 {
2401         my ($self, $path, $dc_vars) = @_;
2402
2403         my $env = $self->provision_subdom_dc($path, $dc_vars);
2404
2405         if (defined $env) {
2406                 if (not defined($self->check_or_start($env, "single"))) {
2407                         return undef;
2408                 }
2409
2410                 $self->{vars}->{subdom_dc} = $env;
2411
2412                 # force replicated DC to update repsTo/repsFrom
2413                 # for primary domain partitions
2414                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2415                 my $cmd = "";
2416                 # as 'subdomain' dc may add data in its local replica
2417                 # we need to synchronize data between DCs
2418                 my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
2419                 my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2420                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2421                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2422                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2423                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
2424                 $cmd .= " $dc_vars->{CONFIGURATION}";
2425                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
2426                 # replicate Configuration NC
2427                 my $cmd_repl = "$cmd \"$config_dn\"";
2428                 unless(system($cmd_repl) == 0) {
2429                         warn("Failed to replicate\n$cmd_repl");
2430                         return undef;
2431                 }
2432                 # replicate Default NC
2433                 $cmd_repl = "$cmd \"$base_dn\"";
2434                 unless(system($cmd_repl) == 0) {
2435                         warn("Failed to replicate\n$cmd_repl");
2436                         return undef;
2437                 }
2438         }
2439
2440         return $env;
2441 }
2442
2443 sub setup_rodc($$$)
2444 {
2445         my ($self, $path, $dc_vars) = @_;
2446
2447         my $env = $self->provision_rodc($path, $dc_vars);
2448
2449         unless ($env) {
2450                 return undef;
2451         }
2452
2453         if (not defined($self->check_or_start($env, "standard"))) {
2454             return undef;
2455         }
2456
2457         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2458         my $cmd = "";
2459
2460         my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2461         $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2462         $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2463         $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2464         $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2465         $cmd .= " $dc_vars->{CONFIGURATION}";
2466         $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2467         # replicate Configuration NC
2468         my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2469         unless(system($cmd_repl) == 0) {
2470             warn("Failed to replicate\n$cmd_repl");
2471             return undef;
2472         }
2473         # replicate Default NC
2474         $cmd_repl = "$cmd \"$base_dn\"";
2475         unless(system($cmd_repl) == 0) {
2476             warn("Failed to replicate\n$cmd_repl");
2477             return undef;
2478         }
2479
2480         $self->{vars}->{rodc} = $env;
2481
2482         return $env;
2483 }
2484
2485 sub setup_ad_dc($$)
2486 {
2487         my ($self, $path, $no_nss) = @_;
2488
2489         # If we didn't build with ADS, pretend this env was never available
2490         if (not $self->{target3}->have_ads()) {
2491                return "UNKNOWN";
2492         }
2493
2494         my $env = $self->provision_ad_dc($path);
2495         unless ($env) {
2496                 return undef;
2497         }
2498
2499         if (defined($no_nss) and $no_nss) {
2500                 $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2501                 $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2502         }
2503
2504         if (not defined($self->check_or_start($env, "single"))) {
2505             return undef;
2506         }
2507
2508         my $upn_array = ["$env->{REALM}.upn"];
2509         my $spn_array = ["$env->{REALM}.spn"];
2510
2511         $self->setup_namespaces($env, $upn_array, $spn_array);
2512
2513         $self->{vars}->{ad_dc} = $env;
2514         return $env;
2515 }
2516
2517 sub setup_none($$)
2518 {
2519         my ($self, $path) = @_;
2520
2521         my $ret = {
2522                 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
2523                 SAMBA_PID => -1,
2524         }
2525 }
2526
2527 1;