selftest/target/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 package Samba4;
   7
   8 use strict;
   9 use Cwd qw(abs_path);
  10 use FindBin qw($RealBin);
  11 use POSIX;
  12 use SocketWrapper;
  13 use target::Samba;
  14 use target::Samba3;
  15
  16 sub new($$$$$) {
  17         my ($classname, $bindir, $binary_mapping, $ldap, $srcdir, $server_maxtime) = @_;
  18
  19         my $self = {
  20                 vars => {},
  21                 ldap => $ldap,
  22                 bindir => $bindir,
  23                 binary_mapping => $binary_mapping,
  24                 srcdir => $srcdir,
  25                 server_maxtime => $server_maxtime,
  26                 target3 => new Samba3($bindir, $binary_mapping, $srcdir, $server_maxtime)
  27         };
  28         bless $self;
  29         return $self;
  30 }
  31
  32 sub scriptdir_path($$) {
  33         my ($self, $path) = @_;
  34         return "$self->{srcdir}/source4/scripting/$path";
  35 }
  36
  37 sub openldap_start($$$) {
  38 }
  39
  40 sub slapd_start($$)
  41 {
  42         my $count = 0;
  43         my ($self, $env_vars, $STDIN_READER) = @_;
  44         my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
  45
  46         my $uri = $env_vars->{LDAP_URI};
  47
  48         if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
  49             print "A SLAPD is still listening to $uri before we started the LDAP backend.  Aborting!";
  50             return 1;
  51         }
  52         # running slapd in the background means it stays in the same process group, so it can be
  53         # killed by timelimit
  54         my $pid = fork();
  55         if ($pid == 0) {
  56                 open STDOUT, ">$env_vars->{LDAPDIR}/logs";
  57                 open STDERR, '>&STDOUT';
  58                 close($env_vars->{STDIN_PIPE});
  59                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
  60
  61                 if ($self->{ldap} eq "fedora-ds") {
  62                         exec("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd", "-D", $env_vars->{FEDORA_DS_DIR}, "-d0", "-i", $env_vars->{FEDORA_DS_PIDFILE});
  63                 } elsif ($self->{ldap} eq "openldap") {
  64                         exec($ENV{OPENLDAP_SLAPD}, "-dnone", "-F", $env_vars->{SLAPD_CONF_D}, "-h", $uri);
  65                 }
  66                 die("Unable to start slapd: $!");
  67         }
  68         $env_vars->{SLAPD_PID} = $pid;
  69         sleep(1);
  70         while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
  71                 $count++;
  72                 if ($count > 40) {
  73                         $self->slapd_stop($env_vars);
  74                         return 0;
  75                 }
  76                 sleep(1);
  77         }
  78         return 1;
  79 }
  80
  81 sub slapd_stop($$)
  82 {
  83         my ($self, $envvars) = @_;
  84         kill 9, $envvars->{SLAPD_PID};
  85         return 1;
  86 }
  87
  88 sub check_or_start($$$)
  89 {
  90         my ($self, $env_vars, $process_model) = @_;
  91         my $STDIN_READER;
  92
  93         return 0 if $self->check_env($env_vars);
  94
  95         # use a pipe for stdin in the child processes. This allows
  96         # those processes to monitor the pipe for EOF to ensure they
  97         # exit when the test script exits
  98         pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
  99
 100         # Start slapd before samba, but with the fifo on stdin
 101         if (defined($self->{ldap})) {
 102                 unless($self->slapd_start($env_vars, $STDIN_READER)) {
 103                         warn("couldn't start slapd (main run)");
 104                         return undef;
 105                 }
 106         }
 107
 108         print "STARTING SAMBA...";
 109         my $pid = fork();
 110         if ($pid == 0) {
 111                 # we want out from samba to go to the log file, but also
 112                 # to the users terminal when running 'make test' on the command
 113                 # line. This puts it on stderr on the terminal
 114                 open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
 115                 open STDERR, '>&STDOUT';
 116
 117                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
 118
 119                 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
 120                 $ENV{SELFTEST_WINBINDD_SOCKET_DIR} = $env_vars->{SELFTEST_WINBINDD_SOCKET_DIR};
 121                 $ENV{NMBD_SOCKET_DIR} = $env_vars->{NMBD_SOCKET_DIR};
 122
 123                 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
 124                 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
 125                 $ENV{NSS_WRAPPER_HOSTS} = $env_vars->{NSS_WRAPPER_HOSTS};
 126                 $ENV{NSS_WRAPPER_MODULE_SO_PATH} = $env_vars->{NSS_WRAPPER_MODULE_SO_PATH};
 127                 $ENV{NSS_WRAPPER_MODULE_FN_PREFIX} = $env_vars->{NSS_WRAPPER_MODULE_FN_PREFIX};
 128
 129                 $ENV{UID_WRAPPER} = "1";
 130
 131                 $ENV{MAKE_TEST_BINARY} = Samba::bindir_path($self, "samba");
 132                 my @preargs = ();
 133                 my @optargs = ();
 134                 if (defined($ENV{SAMBA_OPTIONS})) {
 135                         @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
 136                 }
 137                 if(defined($ENV{SAMBA_VALGRIND})) {
 138                         @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
 139                 }
 140
 141                 close($env_vars->{STDIN_PIPE});
 142                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 143
 144                 exec(@preargs, Samba::bindir_path($self, "samba"), "-M", $process_model, "-i", "--maximum-runtime=$self->{server_maxtime}", $env_vars->{CONFIGURATION}, @optargs) or die("Unable to start samba: $!");
 145         }
 146         $env_vars->{SAMBA_PID} = $pid;
 147         print "DONE\n";
 148
 149         close($STDIN_READER);
 150
 151         return $pid;
 152 }
 153
 154 sub wait_for_start($$)
 155 {
 156         my ($self, $testenv_vars) = @_;
 157         my $ret;
 158         # give time for nbt server to register its names
 159         print "delaying for nbt name registration\n";
 160         sleep 2;
 161
 162         # This will return quickly when things are up, but be slow if we
 163         # need to wait for (eg) SSL init
 164         my $nmblookup =  Samba::bindir_path($self, "nmblookup4");
 165         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 166         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 167         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 168         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 169         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 170         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 171         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 172         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 173         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 174         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 175         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 176         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 177
 178         # Ensure we have the first RID Set before we start tests.  This makes the tests more reliable.
 179         if ($testenv_vars->{SERVER_ROLE} eq "domain controller" and not ($testenv_vars->{NETBIOS_NAME} eq "rodc")) {
 180             # Add hosts file for name lookups
 181             $ENV{NSS_WRAPPER_HOSTS} = $testenv_vars->{NSS_WRAPPER_HOSTS};
 182
 183             print "waiting for working LDAP and a RID Set to be allocated\n";
 184             my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
 185             my $count = 0;
 186             my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
 187             my $rid_set_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
 188             sleep(1);
 189             while (system("$ldbsearch -H ldap://$testenv_vars->{SERVER} -U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} -s base -b \"$rid_set_dn\" rIDAllocationPool > /dev/null") != 0) {
 190                 $count++;
 191                 if ($count > 40) {
 192                     $ret = 1;
 193                     last;
 194                 }
 195                 sleep(1);
 196             }
 197         }
 198         print $self->getlog_env($testenv_vars);
 199
 200         return $ret
 201 }
 202
 203 sub write_ldb_file($$$)
 204 {
 205         my ($self, $file, $ldif) = @_;
 206
 207         my $ldbadd =  Samba::bindir_path($self, "ldbadd");
 208         open(LDIF, "|$ldbadd -H $file >/dev/null");
 209         print LDIF $ldif;
 210         return(close(LDIF));
 211 }
 212
 213 sub add_wins_config($$)
 214 {
 215         my ($self, $privatedir) = @_;
 216
 217         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 218 dn: name=TORTURE_11,CN=PARTNERS
 219 objectClass: wreplPartner
 220 name: TORTURE_11
 221 address: 127.0.0.11
 222 pullInterval: 0
 223 pushChangeCount: 0
 224 type: 0x3
 225 ");
 226 }
 227
 228 sub mk_fedora_ds($$)
 229 {
 230         my ($self, $ctx) = @_;
 231
 232         #Make the subdirectory be as fedora DS would expect
 233         my $fedora_ds_dir = "$ctx->{ldapdir}/slapd-$ctx->{ldap_instance}";
 234
 235         my $pidfile = "$fedora_ds_dir/logs/slapd-$ctx->{ldap_instance}.pid";
 236
 237         return ($fedora_ds_dir, $pidfile);
 238 }
 239
 240 sub mk_openldap($$)
 241 {
 242         my ($self, $ctx) = @_;
 243
 244         my $slapd_conf_d = "$ctx->{ldapdir}/slapd.d";
 245         my $pidfile = "$ctx->{ldapdir}/slapd.pid";
 246
 247         return ($slapd_conf_d, $pidfile);
 248 }
 249
 250 sub mk_keyblobs($$)
 251 {
 252         my ($self, $tlsdir) = @_;
 253
 254         #TLS and PKINIT crypto blobs
 255         my $dhfile = "$tlsdir/dhparms.pem";
 256         my $cafile = "$tlsdir/ca.pem";
 257         my $certfile = "$tlsdir/cert.pem";
 258         my $reqkdc = "$tlsdir/req-kdc.der";
 259         my $kdccertfile = "$tlsdir/kdc.pem";
 260         my $keyfile = "$tlsdir/key.pem";
 261         my $adminkeyfile = "$tlsdir/adminkey.pem";
 262         my $reqadmin = "$tlsdir/req-admin.der";
 263         my $admincertfile = "$tlsdir/admincert.pem";
 264         my $admincertupnfile = "$tlsdir/admincertupn.pem";
 265
 266         mkdir($tlsdir, 0700);
 267         my $oldumask = umask;
 268         umask 0077;
 269
 270         #This is specified here to avoid draining entropy on every run
 271         open(DHFILE, ">$dhfile");
 272         print DHFILE <<EOF;
 273 -----BEGIN DH PARAMETERS-----
 274 MGYCYQC/eWD2xkb7uELmqLi+ygPMKyVcpHUo2yCluwnbPutEueuxrG/Cys8j8wLO
 275 svCN/jYNyR2NszOmg7ZWcOC/4z/4pWDVPUZr8qrkhj5MRKJc52MncfaDglvEdJrv
 276 YX70obsCAQI=
 277 -----END DH PARAMETERS-----
 278 EOF
 279         close(DHFILE);
 280
 281         #Likewise, we pregenerate the key material.  This allows the
 282         #other certificates to be pre-generated
 283         open(KEYFILE, ">$keyfile");
 284         print KEYFILE <<EOF;
 285 -----BEGIN RSA PRIVATE KEY-----
 286 MIICXQIBAAKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpc
 287 ol3+S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H
 288 6H+pPqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQAB
 289 AoGAAqDLzFRR/BF1kpsiUfL4WFvTarCe9duhwj7ORc6fs785qAXuwUYAJ0Uvzmy6
 290 HqoGv3t3RfmeHDmjcpPHsbOKnsOQn2MgmthidQlPBMWtQMff5zdoYNUFiPS0XQBq
 291 szNW4PRjaA9KkLQVTwnzdXGkBSkn/nGxkaVu7OR3vJOBoo0CQQDO4upypesnbe6p
 292 9/xqfZ2uim8IwV1fLlFClV7WlCaER8tsQF4lEi0XSzRdXGUD/dilpY88Nb+xok/X
 293 8Z8OvgAXAkEA+pcLsx1gN7kxnARxv54jdzQjC31uesJgMKQXjJ0h75aUZwTNHmZQ
 294 vPxi6u62YiObrN5oivkixwFNncT9MxTxVQJBAMaWUm2SjlLe10UX4Zdm1MEB6OsC
 295 kVoX37CGKO7YbtBzCfTzJGt5Mwc1DSLA2cYnGJqIfSFShptALlwedot0HikCQAJu
 296 jNKEKnbf+TdGY8Q0SKvTebOW2Aeg80YFkaTvsXCdyXrmdQcifw4WdO9KucJiDhSz
 297 Y9hVapz7ykEJtFtWjLECQQDIlfc63I5ZpXfg4/nN4IJXUW6AmPVOYIA5215itgki
 298 cSlMYli1H9MEXH0pQMGv5Qyd0OYIx2DDg96mZ+aFvqSG
 299 -----END RSA PRIVATE KEY-----
 300 EOF
 301         close(KEYFILE);
 302
 303         open(ADMINKEYFILE, ">$adminkeyfile");
 304
 305         print ADMINKEYFILE <<EOF;
 306 -----BEGIN RSA PRIVATE KEY-----
 307 MIICXQIBAAKBgQD0+OL7TQBj0RejbIH1+g5GeRaWaM9xF43uE5y7jUHEsi5owhZF
 308 5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMFxB6esnXhl0Jpip1JkUMM
 309 XLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xdl3JRlwIDAQAB
 310 AoGAP8mjCP628Ebc2eACQzOWjgEvwYCPK4qPmYOf1zJkArzG2t5XAGJ5WGrENRuB
 311 cm3XFh1lpmaADl982UdW3gul4gXUy6w4XjKK4vVfhyHj0kZ/LgaXUK9BAGhroJ2L
 312 osIOUsaC6jdx9EwSRctwdlF3wWJ8NK0g28AkvIk+FlolW4ECQQD7w5ouCDnf58CN
 313 u4nARx4xv5XJXekBvOomkCQAmuOsdOb6b9wn3mm2E3au9fueITjb3soMR31AF6O4
 314 eAY126rXAkEA+RgHzybzZEP8jCuznMqoN2fq/Vrs6+W3M8/G9mzGEMgLLpaf2Jiz
 315 I9tLZ0+OFk9tkRaoCHPfUOCrVWJZ7Y53QQJBAMhoA6rw0WDyUcyApD5yXg6rusf4
 316 ASpo/tqDkqUIpoL464Qe1tjFqtBM3gSXuhs9xsz+o0bzATirmJ+WqxrkKTECQHt2
 317 OLCpKqwAspU7N+w32kaUADoRLisCEdrhWklbwpQgwsIVsCaoEOpt0CLloJRYTANE
 318 yoZeAErTALjyZYZEPcECQQDlUi0N8DFxQ/lOwWyR3Hailft+mPqoPCa8QHlQZnlG
 319 +cfgNl57YHMTZFwgUVFRdJNpjH/WdZ5QxDcIVli0q+Ko
 320 -----END RSA PRIVATE KEY-----
 321 EOF
 322
 323         #generated with
 324         # hxtool issue-certificate --self-signed --issue-ca \
 325         # --ca-private-key="FILE:$KEYFILE" \
 326         # --subject="CN=CA,DC=samba,DC=example,DC=com" \
 327         # --certificate="FILE:$CAFILE" --lifetime="25 years"
 328
 329         open(CAFILE, ">$cafile");
 330         print CAFILE <<EOF;
 331 -----BEGIN CERTIFICATE-----
 332 MIICcTCCAdqgAwIBAgIUaBPmjnPVqyFqR5foICmLmikJTzgwCwYJKoZIhvcNAQEFMFIxEzAR
 333 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 334 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDgwMzAxMTIyMzEyWhgPMjAzMzAyMjQx
 335 MjIzMTJaMFIxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 336 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMIGfMA0GCSqGSIb3DQEBAQUA
 337 A4GNADCBiQKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+S9/6
 338 I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+pPqVIRLOmrWIm
 339 ai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABo0IwQDAOBgNVHQ8BAf8EBAMC
 340 AaYwHQYDVR0OBBYEFMLZufegDKLZs0VOyFXYK1L6M8oyMA8GA1UdEwEB/wQFMAMBAf8wDQYJ
 341 KoZIhvcNAQEFBQADgYEAAZJbCAAkaqgFJ0xgNovn8Ydd0KswQPjicwiODPgw9ZPoD2HiOUVO
 342 yYDRg/dhFF9y656OpcHk4N7qZ2sl3RlHkzDu+dseETW+CnKvQIoXNyeARRJSsSlwrwcoD4JR
 343 HTLk2sGigsWwrJ2N99sG/cqSJLJ1MFwLrs6koweBnYU0f/g=
 344 -----END CERTIFICATE-----
 345 EOF
 346
 347         #generated with GNUTLS internally in Samba.
 348
 349         open(CERTFILE, ">$certfile");
 350         print CERTFILE <<EOF;
 351 -----BEGIN CERTIFICATE-----
 352 MIICYTCCAcygAwIBAgIE5M7SRDALBgkqhkiG9w0BAQUwZTEdMBsGA1UEChMUU2Ft
 353 YmEgQWRtaW5pc3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1
 354 dG9nZW5lcmF0ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMB4XDTA2MDgw
 355 NDA0MzY1MloXDTA4MDcwNDA0MzY1MlowZTEdMBsGA1UEChMUU2FtYmEgQWRtaW5p
 356 c3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1dG9nZW5lcmF0
 357 ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMIGcMAsGCSqGSIb3DQEBAQOB
 358 jAAwgYgCgYDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+
 359 S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+p
 360 PqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABoyUw
 361 IzAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGCSqGSIb3DQEB
 362 BQOBgQAmkN6XxvDnoMkGcWLCTwzxGfNNSVcYr7TtL2aJh285Xw9zaxcm/SAZBFyG
 363 LYOChvh6hPU7joMdDwGfbiLrBnMag+BtGlmPLWwp/Kt1wNmrRhduyTQFhN3PP6fz
 364 nBr9vVny2FewB2gHmelaPS//tXdxivSXKz3NFqqXLDJjq7P8wA==
 365 -----END CERTIFICATE-----
 366 EOF
 367         close(CERTFILE);
 368
 369         #KDC certificate
 370         # hxtool request-create \
 371         # --subject="CN=krbtgt,CN=users,DC=samba,DC=example,DC=com" \
 372         # --key="FILE:$KEYFILE" $KDCREQ
 373
 374         # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
 375         # --type="pkinit-kdc" \
 376         # --pk-init-principal="krbtgt/SAMBA.EXAMPLE.COM@SAMBA.EXAMPLE.COM" \
 377         # --req="PKCS10:$KDCREQ" --certificate="FILE:$KDCCERTFILE" \
 378         # --lifetime="25 years"
 379
 380         open(KDCCERTFILE, ">$kdccertfile");
 381         print KDCCERTFILE <<EOF;
 382 -----BEGIN CERTIFICATE-----
 383 MIIDDDCCAnWgAwIBAgIUI2Tzj+JnMzMcdeabcNo30rovzFAwCwYJKoZIhvcNAQEFMFIxEzAR
 384 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 385 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDgwMzAxMTMxOTIzWhgPMjAzMzAyMjQx
 386 MzE5MjNaMGYxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 387 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMQ8wDQYDVQQDDAZrcmJ0
 388 Z3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMqDqkDAIdQwDUN8cOZaFl934XQL70nF
 389 yq+nD2KL0SfcTW5+WlyiXf5L3/oj+5pOYkdmt74MXd1PNv9Q5mjRl6bw34jPOSCgaQVp+Ne5
 390 PcEvlQ9jb8fof6k+pUhEs6atYiZqLfn1jKgqEXKjftjoc95TxBxn67atL2B5qkhZ966jAgMB
 391 AAGjgcgwgcUwDgYDVR0PAQH/BAQDAgWgMBIGA1UdJQQLMAkGBysGAQUCAwUwVAYDVR0RBE0w
 392 S6BJBgYrBgEFAgKgPzA9oBMbEVNBTUJBLkVYQU1QTEUuQ09NoSYwJKADAgEBoR0wGxsGa3Ji
 393 dGd0GxFTQU1CQS5FWEFNUExFLkNPTTAfBgNVHSMEGDAWgBTC2bn3oAyi2bNFTshV2CtS+jPK
 394 MjAdBgNVHQ4EFgQUwtm596AMotmzRU7IVdgrUvozyjIwCQYDVR0TBAIwADANBgkqhkiG9w0B
 395 AQUFAAOBgQBmrVD5MCmZjfHp1nEnHqTIh8r7lSmVtDx4s9MMjxm9oNrzbKXynvdhwQYFVarc
 396 ge4yRRDXtSebErOl71zVJI9CVeQQpwcH+tA85oGA7oeFtO/S7ls581RUU6tGgyxV4veD+lJv
 397 KPH5LevUtgD+q9H4LU4Sq5N3iFwBaeryB0g2wg==
 398 -----END CERTIFICATE-----
 399 EOF
 400
 401         # hxtool request-create \
 402         # --subject="CN=Administrator,CN=users,DC=samba,DC=example,DC=com" \
 403         # --key="FILE:$ADMINKEYFILE" $ADMINREQFILE
 404
 405         # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
 406         # --type="pkinit-client" \
 407         # --pk-init-principal="administrator@SAMBA.EXAMPLE.COM" \
 408         # --req="PKCS10:$ADMINREQFILE" --certificate="FILE:$ADMINCERTFILE" \
 409         # --lifetime="25 years"
 410
 411         open(ADMINCERTFILE, ">$admincertfile");
 412         print ADMINCERTFILE <<EOF;
 413 -----BEGIN CERTIFICATE-----
 414 MIIDHTCCAoagAwIBAgIUUggzW4lLRkMKe1DAR2NKatkMDYwwCwYJKoZIhvcNAQELMFIxEzAR
 415 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 416 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDkwNzI3MDMzMjE1WhgPMjAzNDA3MjIw
 417 MzMyMTVaMG0xEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 418 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMRYwFAYDVQQDDA1BZG1p
 419 bmlzdHJhdG9yMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0+OL7TQBj0RejbIH1+g5G
 420 eRaWaM9xF43uE5y7jUHEsi5owhZF5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMF
 421 xB6esnXhl0Jpip1JkUMMXLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xd
 422 l3JRlwIDAQABo4HSMIHPMA4GA1UdDwEB/wQEAwIFoDAoBgNVHSUEITAfBgcrBgEFAgMEBggr
 423 BgEFBQcDAgYKKwYBBAGCNxQCAjBIBgNVHREEQTA/oD0GBisGAQUCAqAzMDGgExsRU0FNQkEu
 424 RVhBTVBMRS5DT02hGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yMB8GA1UdIwQYMBaAFMLZ
 425 ufegDKLZs0VOyFXYK1L6M8oyMB0GA1UdDgQWBBQg81bLyfCA88C2B/BDjXlGuaFaxjAJBgNV
 426 HRMEAjAAMA0GCSqGSIb3DQEBCwUAA4GBAEf/OSHUDJaGdtWGNuJeqcVYVMwrfBAc0OSwVhz1
 427 7/xqKHWo8wIMPkYRtaRHKLNDsF8GkhQPCpVsa6mX/Nt7YQnNvwd+1SBP5E8GvwWw9ZzLJvma
 428 nk2n89emuayLpVtp00PymrDLRBcNaRjFReQU8f0o509kiVPHduAp3jOiy13l
 429 -----END CERTIFICATE-----
 430 EOF
 431         close(ADMINCERTFILE);
 432
 433         # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
 434         # --type="pkinit-client" \
 435         # --ms-upn="administrator@samba.example.com" \
 436         # --req="PKCS10:$ADMINREQFILE" --certificate="FILE:$ADMINCERTUPNFILE" \
 437         # --lifetime="25 years"
 438
 439         open(ADMINCERTUPNFILE, ">$admincertupnfile");
 440         print ADMINCERTUPNFILE <<EOF;
 441 -----BEGIN CERTIFICATE-----
 442 MIIDDzCCAnigAwIBAgIUUp3CJMuNaEaAdPKp3QdNIwG7a4wwCwYJKoZIhvcNAQELMFIxEzAR
 443 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 444 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDkwNzI3MDMzMzA1WhgPMjAzNDA3MjIw
 445 MzMzMDVaMG0xEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 446 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMRYwFAYDVQQDDA1BZG1p
 447 bmlzdHJhdG9yMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0+OL7TQBj0RejbIH1+g5G
 448 eRaWaM9xF43uE5y7jUHEsi5owhZF5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMF
 449 xB6esnXhl0Jpip1JkUMMXLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xd
 450 l3JRlwIDAQABo4HEMIHBMA4GA1UdDwEB/wQEAwIFoDAoBgNVHSUEITAfBgcrBgEFAgMEBggr
 451 BgEFBQcDAgYKKwYBBAGCNxQCAjA6BgNVHREEMzAxoC8GCisGAQQBgjcUAgOgIQwfYWRtaW5p
 452 c3RyYXRvckBzYW1iYS5leGFtcGxlLmNvbTAfBgNVHSMEGDAWgBTC2bn3oAyi2bNFTshV2CtS
 453 +jPKMjAdBgNVHQ4EFgQUIPNWy8nwgPPAtgfwQ415RrmhWsYwCQYDVR0TBAIwADANBgkqhkiG
 454 9w0BAQsFAAOBgQBk42+egeUB3Ji2PC55fbt3FNKxvmm2xUUFkV9POK/YR9rajKOwk5jtYSeS
 455 Zd7J9s//rNFNa7waklFkDaY56+QWTFtdvxfE+KoHaqt6X8u6pqi7p3M4wDKQox+9Dx8yWFyq
 456 Wfz/8alZ5aMezCQzXJyIaJsCLeKABosSwHcpAFmxlQ==
 457 -----END CERTIFICATE-----
 458 EOF
 459
 460         umask $oldumask;
 461 }
 462
 463 sub provision_raw_prepare($$$$$$$$$$)
 464 {
 465         my ($self, $prefix, $server_role, $hostname,
 466             $domain, $realm, $functional_level,
 467             $password, $kdc_ipv4) = @_;
 468         my $ctx;
 469         my $netbiosname = uc($hostname);
 470
 471         unless(-d $prefix or mkdir($prefix, 0777)) {
 472                 warn("Unable to create $prefix");
 473                 return undef;
 474         }
 475         my $prefix_abs = abs_path($prefix);
 476
 477         die ("prefix=''") if $prefix_abs eq "";
 478         die ("prefix='/'") if $prefix_abs eq "/";
 479
 480         unless (system("rm -rf $prefix_abs/*") == 0) {
 481                 warn("Unable to clean up");
 482         }
 483
 484
 485         my $swiface = Samba::get_interface($hostname);
 486
 487         $ctx->{prefix} = $prefix;
 488         $ctx->{prefix_abs} = $prefix_abs;
 489
 490         $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 491
 492         $ctx->{server_role} = $server_role;
 493         $ctx->{hostname} = $hostname;
 494         $ctx->{netbiosname} = $netbiosname;
 495         $ctx->{swiface} = $swiface;
 496         $ctx->{password} = $password;
 497         $ctx->{kdc_ipv4} = $kdc_ipv4;
 498
 499 #
 500 # Set smbd log level here.
 501 #
 502         $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
 503         $ctx->{username} = "Administrator";
 504         $ctx->{domain} = $domain;
 505         $ctx->{realm} = uc($realm);
 506         $ctx->{dnsname} = lc($realm);
 507
 508         $ctx->{functional_level} = $functional_level;
 509
 510         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 511         chomp $unix_name;
 512         $ctx->{unix_name} = $unix_name;
 513         $ctx->{unix_uid} = $>;
 514         my @mygid = split(" ", $();
 515         $ctx->{unix_gid} = $mygid[0];
 516         $ctx->{unix_gids_str} = $);
 517         @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
 518
 519         $ctx->{etcdir} = "$prefix_abs/etc";
 520         $ctx->{piddir} = "$prefix_abs/pid";
 521         $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
 522         $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
 523         $ctx->{privatedir} = "$prefix_abs/private";
 524         $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
 525         $ctx->{lockdir} = "$prefix_abs/lockdir";
 526         $ctx->{logdir} = "$prefix_abs/logs";
 527         $ctx->{statedir} = "$prefix_abs/statedir";
 528         $ctx->{cachedir} = "$prefix_abs/cachedir";
 529         $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
 530         $ctx->{winbindd_privileged_socket_dir} = "$prefix_abs/winbindd_privileged_socket";
 531         $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
 532         $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
 533         $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
 534         $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
 535
 536         $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
 537
 538         $ctx->{ipv4} = "127.0.0.$swiface";
 539         $ctx->{interfaces} = "$ctx->{ipv4}/8";
 540
 541         push(@{$ctx->{directories}}, $ctx->{privatedir});
 542         push(@{$ctx->{directories}}, $ctx->{etcdir});
 543         push(@{$ctx->{directories}}, $ctx->{piddir});
 544         push(@{$ctx->{directories}}, $ctx->{lockdir});
 545         push(@{$ctx->{directories}}, $ctx->{logdir});
 546         push(@{$ctx->{directories}}, $ctx->{statedir});
 547         push(@{$ctx->{directories}}, $ctx->{cachedir});
 548
 549         $ctx->{smb_conf_extra_options} = "";
 550
 551         my @provision_options = ();
 552         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
 553         push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
 554         push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
 555         if (defined($ENV{GDB_PROVISION})) {
 556                 push (@provision_options, "gdb --args");
 557                 if (!defined($ENV{PYTHON})) {
 558                     push (@provision_options, "env");
 559                     push (@provision_options, "python");
 560                 }
 561         }
 562         if (defined($ENV{VALGRIND_PROVISION})) {
 563                 push (@provision_options, "valgrind");
 564                 if (!defined($ENV{PYTHON})) {
 565                     push (@provision_options, "env");
 566                     push (@provision_options, "python");
 567                 }
 568         }
 569         if (defined($ENV{PYTHON})) {
 570                 push (@provision_options, $ENV{PYTHON});
 571         }
 572         push (@provision_options, Samba::bindir_path($self, "samba-tool"));
 573         push (@provision_options, "domain");
 574         push (@provision_options, "provision");
 575         push (@provision_options, "--configfile=$ctx->{smb_conf}");
 576         push (@provision_options, "--host-name=$ctx->{hostname}");
 577         push (@provision_options, "--host-ip=$ctx->{ipv4}");
 578         push (@provision_options, "--quiet");
 579         push (@provision_options, "--domain=$ctx->{domain}");
 580         push (@provision_options, "--realm=$ctx->{realm}");
 581         push (@provision_options, "--adminpass=$ctx->{password}");
 582         push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
 583         push (@provision_options, "--machinepass=machine$ctx->{password}");
 584         push (@provision_options, "--root=$ctx->{unix_name}");
 585         push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
 586         push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
 587
 588         @{$ctx->{provision_options}} = @provision_options;
 589
 590         return $ctx;
 591 }
 592
 593 #
 594 # Step1 creates the basic configuration
 595 #
 596 sub provision_raw_step1($$)
 597 {
 598         my ($self, $ctx) = @_;
 599
 600         mkdir($_, 0777) foreach (@{$ctx->{directories}});
 601
 602         ##
 603         ## lockdir and piddir must be 0755
 604         ##
 605         chmod 0755, $ctx->{lockdir};
 606         chmod 0755, $ctx->{piddir};
 607
 608         unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
 609                 warn("can't open $ctx->{smb_conf}$?");
 610                 return undef;
 611         }
 612         print CONFFILE "
 613 [global]
 614         netbios name = $ctx->{netbiosname}
 615         posix:eadb = $ctx->{statedir}/eadb.tdb
 616         workgroup = $ctx->{domain}
 617         realm = $ctx->{realm}
 618         private dir = $ctx->{privatedir}
 619         pid directory = $ctx->{piddir}
 620         ncalrpc dir = $ctx->{ncalrpcdir}
 621         lock dir = $ctx->{lockdir}
 622         state directory = $ctx->{statedir}
 623         cache directory = $ctx->{cachedir}
 624         winbindd socket directory = $ctx->{winbindd_socket_dir}
 625         winbindd privileged socket directory = $ctx->{winbindd_privileged_socket_dir}
 626         ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
 627         winbind separator = /
 628         name resolve order = file bcast
 629         interfaces = $ctx->{interfaces}
 630         tls dh params file = $ctx->{tlsdir}/dhparms.pem
 631         panic action = $RealBin/gdb_backtrace \%d
 632         wins support = yes
 633         server role = $ctx->{server_role}
 634         server services = +echo +smb -s3fs
 635         dcerpc endpoint servers = +winreg +srvsvc
 636         notify:inotify = false
 637         ldb:nosync = true
 638 #We don't want to pass our self-tests if the PAC code is wrong
 639         gensec:require_pac = true
 640         log file = $ctx->{logdir}/log.\%m
 641         log level = $ctx->{server_loglevel}
 642         lanman auth = Yes
 643         rndc command = true
 644         dns update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --all-interfaces --use-file=$ctx->{dns_host_file} -s $ctx->{smb_conf}
 645         spn update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
 646         resolv:host file = $ctx->{dns_host_file}
 647         dreplsrv:periodic_startup_interval = 0
 648         dsdb:schema update allowed = yes
 649
 650         vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
 651
 652         # remove this again, when our smb2 client library
 653         # supports signin on compound related requests
 654         server signing = on
 655
 656         idmap_ldb:use rfc2307=yes
 657 ";
 658
 659         print CONFFILE "
 660
 661         # Begin extra options
 662         $ctx->{smb_conf_extra_options}
 663         # End extra options
 664 ";
 665         close(CONFFILE);
 666
 667         $self->mk_keyblobs($ctx->{tlsdir});
 668
 669         #Default the KDC IP to the server's IP
 670         if (not defined($ctx->{kdc_ipv4})) {
 671              $ctx->{kdc_ipv4} = $ctx->{ipv4};
 672         }
 673
 674         Samba::mk_krb5_conf($ctx, "");
 675
 676         open(PWD, ">$ctx->{nsswrap_passwd}");
 677         print PWD "
 678 root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false
 679 $ctx->{unix_name}:x:$ctx->{unix_uid}:100:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false
 680 nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
 681 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 682 ";
 683         close(PWD);
 684         my $uid_rfc2307test = 65533;
 685
 686         open(GRP, ">$ctx->{nsswrap_group}");
 687         print GRP "
 688 root:x:0:
 689 wheel:x:10:
 690 users:x:100:
 691 nobody:x:65533:
 692 nogroup:x:65534:nobody
 693 $ctx->{unix_name}:x:$ctx->{unix_gid}:
 694 ";
 695         close(GRP);
 696         my $gid_rfc2307test = 65532;
 697
 698         my $hostname = lc($ctx->{hostname});
 699         open(HOSTS, ">>$ctx->{nsswrap_hosts}");
 700         print HOSTS "$ctx->{ipv4} ${hostname}.samba.example.com ${hostname}
 701 ";
 702         close(HOSTS);
 703
 704         my $configuration = "--configfile=$ctx->{smb_conf}";
 705
 706 #Ensure the config file is valid before we start
 707         my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
 708         if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 709                 system("$testparm -v --suppress-prompt $configuration >&2");
 710                 warn("Failed to create a valid smb.conf configuration $testparm!");
 711                 return undef;
 712         }
 713         unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
 714                 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
 715                 return undef;
 716         }
 717
 718         my $ret = {
 719                 KRB5_CONFIG => $ctx->{krb5_conf},
 720                 PIDDIR => $ctx->{piddir},
 721                 SERVER => $ctx->{hostname},
 722                 SERVER_IP => $ctx->{ipv4},
 723                 NETBIOSNAME => $ctx->{netbiosname},
 724                 DOMAIN => $ctx->{domain},
 725                 USERNAME => $ctx->{username},
 726                 REALM => $ctx->{realm},
 727                 PASSWORD => $ctx->{password},
 728                 LDAPDIR => $ctx->{ldapdir},
 729                 LDAP_INSTANCE => $ctx->{ldap_instance},
 730                 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
 731                 NCALRPCDIR => $ctx->{ncalrpcdir},
 732                 LOCKDIR => $ctx->{lockdir},
 733                 STATEDIR => $ctx->{statedir},
 734                 CACHEDIR => $ctx->{cachedir},
 735                 PRIVATEDIR => $ctx->{privatedir},
 736                 SERVERCONFFILE => $ctx->{smb_conf},
 737                 CONFIGURATION => $configuration,
 738                 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
 739                 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
 740                 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
 741                 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
 742                 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
 743                 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
 744                 SAMBA_TEST_LOG_POS => 0,
 745                 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
 746                 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
 747                 LOCAL_PATH => $ctx->{share},
 748                 UID_RFC2307TEST => $uid_rfc2307test,
 749                 GID_RFC2307TEST => $gid_rfc2307test,
 750                 SERVER_ROLE => $ctx->{server_role}
 751         };
 752
 753         return $ret;
 754 }
 755
 756 #
 757 # Step2 runs the provision script
 758 #
 759 sub provision_raw_step2($$$)
 760 {
 761         my ($self, $ctx, $ret) = @_;
 762
 763         my $provision_cmd = join(" ", @{$ctx->{provision_options}});
 764         unless (system($provision_cmd) == 0) {
 765                 warn("Unable to provision: \n$provision_cmd\n");
 766                 return undef;
 767         }
 768
 769         return $ret;
 770 }
 771
 772 sub provision($$$$$$$$$)
 773 {
 774         my ($self, $prefix, $server_role, $hostname,
 775             $domain, $realm, $functional_level,
 776             $password, $kdc_ipv4, $extra_smbconf_options, $extra_smbconf_shares,
 777             $extra_provision_options) = @_;
 778
 779         my $ctx = $self->provision_raw_prepare($prefix, $server_role,
 780                                                $hostname,
 781                                                $domain, $realm, $functional_level,
 782                                                $password, $kdc_ipv4);
 783
 784         if (defined($extra_provision_options)) {
 785                 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
 786         } else {
 787                 push (@{$ctx->{provision_options}}, "--use-ntvfs");
 788         }
 789
 790         $ctx->{share} = "$ctx->{prefix_abs}/share";
 791         push(@{$ctx->{directories}}, "$ctx->{share}");
 792         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
 793         push(@{$ctx->{directories}}, "$ctx->{share}/test2");
 794
 795         # precreate directories for printer drivers
 796         push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
 797         push(@{$ctx->{directories}}, "$ctx->{share}/x64");
 798         push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
 799
 800         my $msdfs = "no";
 801         $msdfs = "yes" if ($server_role eq "domain controller");
 802         $ctx->{smb_conf_extra_options} = "
 803
 804         max xmit = 32K
 805         server max protocol = SMB2
 806         host msdfs = $msdfs
 807         lanman auth = yes
 808         allow nt4 crypto = yes
 809
 810         $extra_smbconf_options
 811
 812 [tmp]
 813         path = $ctx->{share}
 814         read only = no
 815         posix:sharedelay = 10000
 816         posix:oplocktimeout = 3
 817         posix:writetimeupdatedelay = 50000
 818
 819 [xcopy_share]
 820         path = $ctx->{share}
 821         read only = no
 822         posix:sharedelay = 10000
 823         posix:oplocktimeout = 3
 824         posix:writetimeupdatedelay = 50000
 825         create mask = 777
 826         force create mode = 777
 827
 828 [posix_share]
 829         path = $ctx->{share}
 830         read only = no
 831         create mask = 0777
 832         force create mode = 0
 833         directory mask = 0777
 834         force directory mode = 0
 835
 836 [test1]
 837         path = $ctx->{share}/test1
 838         read only = no
 839         posix:sharedelay = 10000
 840         posix:oplocktimeout = 3
 841         posix:writetimeupdatedelay = 50000
 842
 843 [test2]
 844         path = $ctx->{share}/test2
 845         read only = no
 846         posix:sharedelay = 10000
 847         posix:oplocktimeout = 3
 848         posix:writetimeupdatedelay = 50000
 849
 850 [cifs]
 851         read only = no
 852         ntvfs handler = cifs
 853         cifs:server = $ctx->{netbiosname}
 854         cifs:share = tmp
 855         cifs:use-s4u2proxy = yes
 856         # There is no username specified here, instead the client is expected
 857         # to log in with kerberos, and the serverwill use delegated credentials.
 858         # Or the server tries s4u2self/s4u2proxy to impersonate the client
 859
 860 [simple]
 861         path = $ctx->{share}
 862         read only = no
 863         ntvfs handler = simple
 864
 865 [sysvol]
 866         path = $ctx->{statedir}/sysvol
 867         read only = no
 868
 869 [netlogon]
 870         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
 871         read only = no
 872
 873 [cifsposix]
 874         copy = simple
 875         ntvfs handler = cifsposix
 876
 877 $extra_smbconf_shares
 878 ";
 879
 880         if (defined($self->{ldap})) {
 881                 $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
 882                 push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
 883
 884                 my $ldap_uri= "$ctx->{ldapdir}/ldapi";
 885                 $ldap_uri =~ s|/|%2F|g;
 886                 $ldap_uri = "ldapi://$ldap_uri";
 887                 $ctx->{ldap_uri} = $ldap_uri;
 888
 889                 $ctx->{ldap_instance} = lc($ctx->{netbiosname});
 890         }
 891
 892         my $ret = $self->provision_raw_step1($ctx);
 893         unless (defined $ret) {
 894                 return undef;
 895         }
 896
 897         if (defined($self->{ldap})) {
 898                 $ret->{LDAP_URI} = $ctx->{ldap_uri};
 899                 push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
 900                 push (@{$ctx->{provision_options}}, "--ldap-backend-nosync");
 901                 if ($self->{ldap} eq "openldap") {
 902                         push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
 903                         ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx) or die("Unable to create openldap directories");
 904
 905                 } elsif ($self->{ldap} eq "fedora-ds") {
 906                         push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
 907                         push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
 908                         ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx) or die("Unable to create fedora ds directories");
 909                 }
 910
 911         }
 912
 913         return $self->provision_raw_step2($ctx, $ret);
 914 }
 915
 916 sub provision_member($$$)
 917 {
 918         my ($self, $prefix, $dcvars) = @_;
 919         print "PROVISIONING MEMBER...";
 920
 921         my $ret = $self->provision($prefix,
 922                                    "member server",
 923                                    "s4member",
 924                                    "SAMBADOMAIN",
 925                                    "samba.example.com",
 926                                    "2008",
 927                                    "locMEMpass3",
 928                                    $dcvars->{SERVER_IP},
 929                                    "", "", undef);
 930         unless ($ret) {
 931                 return undef;
 932         }
 933
 934         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 935         my $cmd = "";
 936         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 937         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 938         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
 939         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
 940         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
 941
 942         unless (system($cmd) == 0) {
 943                 warn("Join failed\n$cmd");
 944                 return undef;
 945         }
 946
 947         $ret->{MEMBER_SERVER} = $ret->{SERVER};
 948         $ret->{MEMBER_SERVER_IP} = $ret->{SERVER_IP};
 949         $ret->{MEMBER_NETBIOSNAME} = $ret->{NETBIOSNAME};
 950         $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
 951         $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
 952
 953         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
 954         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
 955         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
 956         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
 957         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
 958
 959         return $ret;
 960 }
 961
 962 sub provision_rpc_proxy($$$)
 963 {
 964         my ($self, $prefix, $dcvars) = @_;
 965         print "PROVISIONING RPC PROXY...";
 966
 967         my $extra_smbconf_options = "
 968
 969         # rpc_proxy
 970         dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
 971         dcerpc endpoint servers = epmapper, remote
 972         dcerpc_remote:interfaces = rpcecho
 973
 974 [cifs_to_dc]
 975         read only = no
 976         ntvfs handler = cifs
 977         cifs:server = $dcvars->{SERVER}
 978         cifs:share = cifs
 979         cifs:use-s4u2proxy = yes
 980         # There is no username specified here, instead the client is expected
 981         # to log in with kerberos, and the serverwill use delegated credentials.
 982         # Or the server tries s4u2self/s4u2proxy to impersonate the client
 983
 984 ";
 985
 986         my $ret = $self->provision($prefix,
 987                                    "member server",
 988                                    "localrpcproxy",
 989                                    "SAMBADOMAIN",
 990                                    "samba.example.com",
 991                                    "2008",
 992                                    "locRPCproxypass4",
 993                                    $dcvars->{SERVER_IP},
 994                                    $extra_smbconf_options, "", undef);
 995
 996         unless ($ret) {
 997                 return undef;
 998         }
 999
1000         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1001
1002         # The joind runs in the context of the rpc_proxy/member for now
1003         my $cmd = "";
1004         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1005         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1006         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1007         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1008         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1009
1010         unless (system($cmd) == 0) {
1011                 warn("Join failed\n$cmd");
1012                 return undef;
1013         }
1014
1015         # Setting up delegation runs in the context of the DC for now
1016         $cmd = "";
1017         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1018         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1019         $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1020         $cmd .= " $dcvars->{CONFIGURATION}";
1021         print $cmd;
1022
1023         unless (system($cmd) == 0) {
1024                 warn("Delegation failed\n$cmd");
1025                 return undef;
1026         }
1027
1028         # Setting up delegation runs in the context of the DC for now
1029         $cmd = "";
1030         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1031         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1032         $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1033         $cmd .= " $dcvars->{CONFIGURATION}";
1034
1035         unless (system($cmd) == 0) {
1036                 warn("Delegation failed\n$cmd");
1037                 return undef;
1038         }
1039
1040         $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
1041         $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
1042         $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
1043         $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
1044         $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
1045
1046         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1047         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1048         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1049         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1050         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1051
1052         return $ret;
1053 }
1054
1055 sub provision_promoted_dc($$$)
1056 {
1057         my ($self, $prefix, $dcvars) = @_;
1058         print "PROVISIONING VAMPIRE DC...";
1059
1060         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1061         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1062                                                "promotedvdc",
1063                                                "SAMBADOMAIN",
1064                                                "samba.example.com",
1065                                                "2008",
1066                                                $dcvars->{PASSWORD},
1067                                                $dcvars->{SERVER_IP});
1068
1069         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1070
1071         $ctx->{smb_conf_extra_options} = "
1072         max xmit = 32K
1073         server max protocol = SMB2
1074
1075 [sysvol]
1076         path = $ctx->{statedir}/sysvol
1077         read only = yes
1078
1079 [netlogon]
1080         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1081         read only = no
1082
1083 ";
1084
1085         my $ret = $self->provision_raw_step1($ctx);
1086         unless ($ret) {
1087                 return undef;
1088         }
1089
1090         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1091         my $cmd = "";
1092         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1093         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1094         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1095         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1096         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1097
1098         unless (system($cmd) == 0) {
1099                 warn("Join failed\n$cmd");
1100                 return undef;
1101         }
1102
1103         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1104         my $cmd = "";
1105         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1106         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1107         $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1108         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1109         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs --dns-backend=BIND9_DLZ";
1110
1111         unless (system($cmd) == 0) {
1112                 warn("Join failed\n$cmd");
1113                 return undef;
1114         }
1115
1116         $ret->{PROMOTED_DC_SERVER} = $ret->{SERVER};
1117         $ret->{PROMOTED_DC_SERVER_IP} = $ret->{SERVER_IP};
1118         $ret->{PROMOTED_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1119
1120         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1121         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1122         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1123         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1124         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1125
1126         return $ret;
1127 }
1128
1129 sub provision_vampire_dc($$$)
1130 {
1131         my ($self, $prefix, $dcvars) = @_;
1132         print "PROVISIONING VAMPIRE DC...";
1133
1134         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1135         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1136                                                "localvampiredc",
1137                                                "SAMBADOMAIN",
1138                                                "samba.example.com",
1139                                                "2008",
1140                                                $dcvars->{PASSWORD},
1141                                                $dcvars->{SERVER_IP});
1142
1143         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1144
1145         $ctx->{smb_conf_extra_options} = "
1146         max xmit = 32K
1147         server max protocol = SMB2
1148
1149 [sysvol]
1150         path = $ctx->{statedir}/sysvol
1151         read only = yes
1152
1153 [netlogon]
1154         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1155         read only = no
1156
1157 ";
1158
1159         my $ret = $self->provision_raw_step1($ctx);
1160         unless ($ret) {
1161                 return undef;
1162         }
1163
1164         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1165         my $cmd = "";
1166         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1167         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1168         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1169         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1170         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1171
1172         unless (system($cmd) == 0) {
1173                 warn("Join failed\n$cmd");
1174                 return undef;
1175         }
1176
1177         $ret->{VAMPIRE_DC_SERVER} = $ret->{SERVER};
1178         $ret->{VAMPIRE_DC_SERVER_IP} = $ret->{SERVER_IP};
1179         $ret->{VAMPIRE_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1180
1181         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1182         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1183         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1184         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1185         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1186
1187         return $ret;
1188 }
1189
1190 sub provision_subdom_dc($$$)
1191 {
1192         my ($self, $prefix, $dcvars) = @_;
1193         print "PROVISIONING SUBDOMAIN DC...";
1194
1195         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1196         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1197                                                "localsubdc",
1198                                                "SAMBASUBDOM",
1199                                                "sub.samba.example.com",
1200                                                "2008",
1201                                                $dcvars->{PASSWORD},
1202                                                undef);
1203
1204         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1205
1206         $ctx->{smb_conf_extra_options} = "
1207         max xmit = 32K
1208         server max protocol = SMB2
1209
1210 [sysvol]
1211         path = $ctx->{statedir}/sysvol
1212         read only = yes
1213
1214 [netlogon]
1215         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1216         read only = no
1217
1218 ";
1219
1220         my $ret = $self->provision_raw_step1($ctx);
1221         unless ($ret) {
1222                 return undef;
1223         }
1224
1225         my $dc_realms = Samba::mk_realms_stanza($dcvars->{REALM}, lc($dcvars->{REALM}),
1226                                                 $dcvars->{DOMAIN}, $dcvars->{SERVER_IP});
1227         Samba::mk_krb5_conf($ctx, $dc_realms);
1228
1229         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1230         my $cmd = "";
1231         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1232         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1233         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{realm} subdomain ";
1234         $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
1235         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1236
1237         unless (system($cmd) == 0) {
1238                 warn("Join failed\n$cmd");
1239                 return undef;
1240         }
1241
1242         $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
1243         $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
1244         $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1245
1246         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1247         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1248         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1249         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1250         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1251
1252         return $ret;
1253 }
1254
1255 sub provision_dc($$)
1256 {
1257         my ($self, $prefix) = @_;
1258
1259         print "PROVISIONING DC...";
1260         my $extra_conf_options = "netbios aliases = localDC1-a";
1261         my $ret = $self->provision($prefix,
1262                                    "domain controller",
1263                                    "localdc",
1264                                    "SAMBADOMAIN",
1265                                    "samba.example.com",
1266                                    "2008",
1267                                    "locDCpass1",
1268                                    undef, $extra_conf_options, "", undef);
1269
1270         return undef unless(defined $ret);
1271         unless($self->add_wins_config("$prefix/private")) {
1272                 warn("Unable to add wins configuration");
1273                 return undef;
1274         }
1275         $ret->{NETBIOSALIAS} = "localdc1-a";
1276         $ret->{DC_SERVER} = $ret->{SERVER};
1277         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1278         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1279         $ret->{DC_USERNAME} = $ret->{USERNAME};
1280         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1281
1282         return $ret;
1283 }
1284
1285 sub provision_fl2000dc($$)
1286 {
1287         my ($self, $prefix) = @_;
1288
1289         print "PROVISIONING DC...";
1290         my $ret = $self->provision($prefix,
1291                                    "domain controller",
1292                                    "dc5",
1293                                    "SAMBA2000",
1294                                    "samba2000.example.com",
1295                                    "2000",
1296                                    "locDCpass5",
1297                                    undef, "", "", undef);
1298
1299         unless($self->add_wins_config("$prefix/private")) {
1300                 warn("Unable to add wins configuration");
1301                 return undef;
1302         }
1303
1304         return $ret;
1305 }
1306
1307 sub provision_fl2003dc($$)
1308 {
1309         my ($self, $prefix) = @_;
1310
1311         print "PROVISIONING DC...";
1312         my $ret = $self->provision($prefix,
1313                                    "domain controller",
1314                                    "dc6",
1315                                    "SAMBA2003",
1316                                    "samba2003.example.com",
1317                                    "2003",
1318                                    "locDCpass6",
1319                                    undef, "allow dns updates = nonsecure and secure", "", undef);
1320
1321         unless($self->add_wins_config("$prefix/private")) {
1322                 warn("Unable to add wins configuration");
1323                 return undef;
1324         }
1325
1326         return $ret;
1327 }
1328
1329 sub provision_fl2008r2dc($$)
1330 {
1331         my ($self, $prefix) = @_;
1332
1333         print "PROVISIONING DC...";
1334         my $ret = $self->provision($prefix,
1335                                    "domain controller",
1336                                    "dc7",
1337                                    "SAMBA2008R2",
1338                                    "samba2008R2.example.com",
1339                                    "2008_R2",
1340                                    "locDCpass7",
1341                                    undef, "", "", undef);
1342
1343         unless ($self->add_wins_config("$prefix/private")) {
1344                 warn("Unable to add wins configuration");
1345                 return undef;
1346         }
1347
1348         return $ret;
1349 }
1350
1351
1352 sub provision_rodc($$$)
1353 {
1354         my ($self, $prefix, $dcvars) = @_;
1355         print "PROVISIONING RODC...";
1356
1357         # We do this so that we don't run the provision.  That's the job of 'net join RODC'.
1358         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1359                                                "rodc",
1360                                                "SAMBADOMAIN",
1361                                                "samba.example.com",
1362                                                "2008",
1363                                                $dcvars->{PASSWORD},
1364                                                $dcvars->{SERVER_IP});
1365         unless ($ctx) {
1366                 return undef;
1367         }
1368
1369         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1370
1371         $ctx->{share} = "$ctx->{prefix_abs}/share";
1372         push(@{$ctx->{directories}}, "$ctx->{share}");
1373
1374         $ctx->{smb_conf_extra_options} = "
1375         max xmit = 32K
1376         server max protocol = SMB2
1377
1378 [sysvol]
1379         path = $ctx->{statedir}/sysvol
1380         read only = yes
1381
1382 [netlogon]
1383         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1384         read only = yes
1385
1386 [tmp]
1387         path = $ctx->{share}
1388         read only = no
1389         posix:sharedelay = 10000
1390         posix:oplocktimeout = 3
1391         posix:writetimeupdatedelay = 50000
1392
1393 ";
1394
1395         my $ret = $self->provision_raw_step1($ctx);
1396         unless ($ret) {
1397                 return undef;
1398         }
1399
1400         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1401         my $cmd = "";
1402         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1403         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1404         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1405         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1406         $cmd .= " --server=$dcvars->{DC_SERVER} --use-ntvfs";
1407
1408         unless (system($cmd) == 0) {
1409                 warn("RODC join failed\n$cmd");
1410                 return undef;
1411         }
1412
1413         # we overwrite the kdc after the RODC join
1414         # so that use the RODC as kdc and test
1415         # the proxy code
1416         $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1417         Samba::mk_krb5_conf($ctx);
1418
1419         $ret->{RODC_DC_SERVER} = $ret->{SERVER};
1420         $ret->{RODC_DC_SERVER_IP} = $ret->{SERVER_IP};
1421         $ret->{RODC_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1422
1423         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1424         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1425         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1426         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1427         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1428
1429         return $ret;
1430 }
1431
1432 sub provision_plugin_s4_dc($$)
1433 {
1434         my ($self, $prefix) = @_;
1435
1436         my $prefix_abs = abs_path($prefix);
1437
1438         my $bindir_abs = abs_path($self->{bindir});
1439         my $lockdir="$prefix_abs/lockdir";
1440         my $conffile="$prefix_abs/etc/smb.conf";
1441
1442         my $extra_smbconf_options = "
1443         server services = -smb +s3fs
1444         xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1445
1446         kernel oplocks = no
1447         kernel change notify = no
1448
1449         syslog = no
1450         printing = bsd
1451         printcap name = /dev/null
1452
1453         max protocol = SMB3
1454         read only = no
1455         server signing = auto
1456
1457         smbd:sharedelay = 100000
1458         smbd:writetimeupdatedelay = 500000
1459         create mask = 755
1460         dos filemode = yes
1461
1462         dcerpc endpoint servers = -winreg -srvsvc
1463
1464         printcap name = /dev/null
1465
1466         addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1467         deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1468
1469         printing = vlp
1470         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1471         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1472         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1473         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1474         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1475         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1476         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1477         lpq cache time = 0
1478         print notify backchannel = yes
1479
1480 ";
1481
1482         my $extra_smbconf_shares = "
1483
1484 [tmpenc]
1485         copy = tmp
1486         smb encrypt = required
1487
1488 [tmpcase]
1489         copy = tmp
1490         case sensitive = yes
1491
1492 [tmpguest]
1493         copy = tmp
1494         guest ok = yes
1495
1496 [hideunread]
1497         copy = tmp
1498         hide unreadable = yes
1499
1500 [durable]
1501         copy = tmp
1502         kernel share modes = no
1503         kernel oplocks = no
1504         posix locking = no
1505
1506 [print\$]
1507         copy = tmp
1508
1509 [print1]
1510         copy = tmp
1511         printable = yes
1512
1513 [print2]
1514         copy = print1
1515 [print3]
1516         copy = print1
1517 [lp]
1518         copy = print1
1519 ";
1520
1521         print "PROVISIONING PLUGIN S4 DC...";
1522         my $ret = $self->provision($prefix,
1523                                    "domain controller",
1524                                    "plugindc",
1525                                    "PLUGINDOMAIN",
1526                                    "plugindc.samba.example.com",
1527                                    "2008",
1528                                    "locDCpass1",
1529                                    undef, $extra_smbconf_options,
1530                                    $extra_smbconf_shares, undef);
1531
1532         return undef unless(defined $ret);
1533         unless($self->add_wins_config("$prefix/private")) {
1534                 warn("Unable to add wins configuration");
1535                 return undef;
1536         }
1537
1538         $ret->{DC_SERVER} = $ret->{SERVER};
1539         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1540         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1541         $ret->{DC_USERNAME} = $ret->{USERNAME};
1542         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1543
1544         return $ret;
1545 }
1546
1547 sub provision_chgdcpass($$)
1548 {
1549         my ($self, $prefix) = @_;
1550
1551         print "PROVISIONING CHGDCPASS...";
1552         my $extra_provision_options = undef;
1553         push (@{$extra_provision_options}, "--dns-backend=BIND9_DLZ");
1554         my $ret = $self->provision($prefix,
1555                                    "domain controller",
1556                                    "chgdcpass",
1557                                    "CHDCDOMAIN",
1558                                    "chgdcpassword.samba.example.com",
1559                                    "2008",
1560                                    "chgDCpass1",
1561                                    undef, "", "",
1562                                    $extra_provision_options);
1563
1564         return undef unless(defined $ret);
1565         unless($self->add_wins_config("$prefix/private")) {
1566                 warn("Unable to add wins configuration");
1567                 return undef;
1568         }
1569
1570         # Remove secrets.tdb from this environment to test that we still start up
1571         # on systems without the new matching secrets.tdb records
1572         unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
1573                 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
1574                 return undef;
1575         }
1576
1577         $ret->{DC_SERVER} = $ret->{SERVER};
1578         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1579         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1580         $ret->{DC_USERNAME} = $ret->{USERNAME};
1581         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1582
1583         return $ret;
1584 }
1585
1586 sub teardown_env($$)
1587 {
1588         my ($self, $envvars) = @_;
1589         my $pid;
1590
1591         # This should cause samba to terminate gracefully
1592         close($envvars->{STDIN_PIPE});
1593
1594         $pid = $envvars->{SAMBA_PID};
1595         my $count = 0;
1596         my $childpid;
1597
1598         # This should give it time to write out the gcov data
1599         until ($count > 30) {
1600             if (Samba::cleanup_child($pid, "samba") == -1) {
1601                 last;
1602             }
1603             sleep(1);
1604             $count++;
1605         }
1606
1607         if ($count > 30 || kill(0, $pid)) {
1608             kill "TERM", $pid;
1609
1610             until ($count > 40) {
1611                 if (Samba::cleanup_child($pid, "samba") == -1) {
1612                     last;
1613                 }
1614                 sleep(1);
1615                 $count++;
1616             }
1617             # If it is still around, kill it
1618             warn "server process $pid took more than $count seconds to exit, killing\n";
1619             kill 9, $pid;
1620         }
1621
1622         $self->slapd_stop($envvars) if ($self->{ldap});
1623
1624         print $self->getlog_env($envvars);
1625
1626         return;
1627 }
1628
1629 sub getlog_env($$)
1630 {
1631         my ($self, $envvars) = @_;
1632         my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME}\n";
1633         my $out = $title;
1634
1635         open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
1636
1637         seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
1638         while (<LOG>) {
1639                 $out .= $_;
1640         }
1641         $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
1642         close(LOG);
1643
1644         return "" if $out eq $title;
1645
1646         return $out;
1647 }
1648
1649 sub check_env($$)
1650 {
1651         my ($self, $envvars) = @_;
1652
1653         my $childpid = Samba::cleanup_child($envvars->{SAMBA_PID}, "samba");
1654
1655         return ($childpid == 0);
1656 }
1657
1658 sub setup_env($$$)
1659 {
1660         my ($self, $envname, $path) = @_;
1661         my $target3 = $self->{target3};
1662
1663         $ENV{ENVNAME} = $envname;
1664
1665         if (defined($self->{vars}->{$envname})) {
1666                 return $self->{vars}->{$envname};
1667         }
1668
1669         if ($envname eq "dc") {
1670                 return $self->setup_dc("$path/dc");
1671         } elsif ($envname eq "fl2000dc") {
1672                 return $self->setup_fl2000dc("$path/fl2000dc");
1673         } elsif ($envname eq "fl2003dc") {
1674                 return $self->setup_fl2003dc("$path/fl2003dc");
1675         } elsif ($envname eq "fl2008r2dc") {
1676                 return $self->setup_fl2008r2dc("$path/fl2008r2dc");
1677         } elsif ($envname eq "rpc_proxy") {
1678                 if (not defined($self->{vars}->{dc})) {
1679                         $self->setup_dc("$path/dc");
1680                 }
1681                 return $self->setup_rpc_proxy("$path/rpc_proxy", $self->{vars}->{dc});
1682         } elsif ($envname eq "vampire_dc") {
1683                 if (not defined($self->{vars}->{dc})) {
1684                         $self->setup_dc("$path/dc");
1685                 }
1686                 return $self->setup_vampire_dc("$path/vampire_dc", $self->{vars}->{dc});
1687         } elsif ($envname eq "promoted_dc") {
1688                 if (not defined($self->{vars}->{dc})) {
1689                         $self->setup_dc("$path/dc");
1690                 }
1691                 return $self->setup_promoted_dc("$path/promoted_dc", $self->{vars}->{dc});
1692         } elsif ($envname eq "subdom_dc") {
1693                 if (not defined($self->{vars}->{dc})) {
1694                         $self->setup_dc("$path/dc");
1695                 }
1696                 return $self->setup_subdom_dc("$path/subdom_dc", $self->{vars}->{dc});
1697         } elsif ($envname eq "s4member") {
1698                 if (not defined($self->{vars}->{dc})) {
1699                         $self->setup_dc("$path/dc");
1700                 }
1701                 return $self->setup_member("$path/s4member", $self->{vars}->{dc});
1702         } elsif ($envname eq "rodc") {
1703                 if (not defined($self->{vars}->{dc})) {
1704                         $self->setup_dc("$path/dc");
1705                 }
1706                 return $self->setup_rodc("$path/rodc", $self->{vars}->{dc});
1707         } elsif ($envname eq "chgdcpass") {
1708                 return $self->setup_chgdcpass("$path/chgdcpass", $self->{vars}->{chgdcpass});
1709         } elsif ($envname eq "s3member") {
1710                 if (not defined($self->{vars}->{dc})) {
1711                         $self->setup_dc("$path/dc");
1712                 }
1713                 return $target3->setup_admember("$path/s3member", $self->{vars}->{dc}, 29);
1714         } elsif ($envname eq "plugin_s4_dc") {
1715                 return $self->setup_plugin_s4_dc("$path/plugin_s4_dc");
1716         } elsif ($envname eq "s3member_rfc2307") {
1717                 if (not defined($self->{vars}->{dc})) {
1718                         $self->setup_dc("$path/dc");
1719                 }
1720                 return $target3->setup_admember_rfc2307("$path/s3member_rfc2307",
1721                                                         $self->{vars}->{dc}, 34);
1722         } else {
1723                 return "UNKNOWN";
1724         }
1725 }
1726
1727 sub setup_member($$$)
1728 {
1729         my ($self, $path, $dc_vars) = @_;
1730
1731         my $env = $self->provision_member($path, $dc_vars);
1732
1733         if (defined $env) {
1734                 $self->check_or_start($env, "single");
1735
1736                 $self->wait_for_start($env);
1737
1738                 $self->{vars}->{member} = $env;
1739         }
1740
1741         return $env;
1742 }
1743
1744 sub setup_rpc_proxy($$$)
1745 {
1746         my ($self, $path, $dc_vars) = @_;
1747
1748         my $env = $self->provision_rpc_proxy($path, $dc_vars);
1749
1750         if (defined $env) {
1751                 $self->check_or_start($env, "single");
1752
1753                 $self->wait_for_start($env);
1754
1755                 $self->{vars}->{rpc_proxy} = $env;
1756         }
1757         return $env;
1758 }
1759
1760 sub setup_dc($$)
1761 {
1762         my ($self, $path) = @_;
1763
1764         my $env = $self->provision_dc($path);
1765         if (defined $env) {
1766                 $self->check_or_start($env, "standard");
1767
1768                 $self->wait_for_start($env);
1769
1770                 $self->{vars}->{dc} = $env;
1771         }
1772         return $env;
1773 }
1774
1775 sub setup_chgdcpass($$)
1776 {
1777         my ($self, $path) = @_;
1778
1779         my $env = $self->provision_chgdcpass($path);
1780         if (defined $env) {
1781                 $self->check_or_start($env, "single");
1782
1783                 $self->wait_for_start($env);
1784
1785                 $self->{vars}->{chgdcpass} = $env;
1786         }
1787         return $env;
1788 }
1789
1790 sub setup_fl2000dc($$)
1791 {
1792         my ($self, $path) = @_;
1793
1794         my $env = $self->provision_fl2000dc($path);
1795         if (defined $env) {
1796                 $self->check_or_start($env, "single");
1797
1798                 $self->wait_for_start($env);
1799
1800                 $self->{vars}->{fl2000dc} = $env;
1801         }
1802
1803         return $env;
1804 }
1805
1806 sub setup_fl2003dc($$)
1807 {
1808         my ($self, $path) = @_;
1809
1810         my $env = $self->provision_fl2003dc($path);
1811
1812         if (defined $env) {
1813                 $self->check_or_start($env, "single");
1814
1815                 $self->wait_for_start($env);
1816
1817                 $self->{vars}->{fl2003dc} = $env;
1818         }
1819         return $env;
1820 }
1821
1822 sub setup_fl2008r2dc($$)
1823 {
1824         my ($self, $path) = @_;
1825
1826         my $env = $self->provision_fl2008r2dc($path);
1827
1828         if (defined $env) {
1829                 $self->check_or_start($env, "single");
1830
1831                 $self->wait_for_start($env);
1832
1833                 $self->{vars}->{fl2008r2dc} = $env;
1834         }
1835
1836         return $env;
1837 }
1838
1839 sub setup_vampire_dc($$$)
1840 {
1841         my ($self, $path, $dc_vars) = @_;
1842
1843         my $env = $self->provision_vampire_dc($path, $dc_vars);
1844
1845         if (defined $env) {
1846                 $self->check_or_start($env, "single");
1847
1848                 $self->wait_for_start($env);
1849
1850                 $self->{vars}->{vampire_dc} = $env;
1851
1852                 # force replicated DC to update repsTo/repsFrom
1853                 # for vampired partitions
1854                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1855                 my $cmd = "";
1856                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1857                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1858                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
1859                 $cmd .= " $env->{CONFIGURATION}";
1860                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1861                 unless (system($cmd) == 0) {
1862                         warn("Failed to exec kcc\n$cmd");
1863                         return undef;
1864                 }
1865
1866                 # as 'vampired' dc may add data in its local replica
1867                 # we need to synchronize data between DCs
1868                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
1869                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1870                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1871                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
1872                 $cmd .= " $dc_vars->{CONFIGURATION}";
1873                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1874                 # replicate Configuration NC
1875                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
1876                 unless(system($cmd_repl) == 0) {
1877                         warn("Failed to replicate\n$cmd_repl");
1878                         return undef;
1879                 }
1880                 # replicate Default NC
1881                 $cmd_repl = "$cmd \"$base_dn\"";
1882                 unless(system($cmd_repl) == 0) {
1883                         warn("Failed to replicate\n$cmd_repl");
1884                         return undef;
1885                 }
1886         }
1887
1888         return $env;
1889 }
1890
1891 sub setup_promoted_dc($$$)
1892 {
1893         my ($self, $path, $dc_vars) = @_;
1894
1895         my $env = $self->provision_promoted_dc($path, $dc_vars);
1896
1897         if (defined $env) {
1898                 $self->check_or_start($env, "single");
1899
1900                 $self->wait_for_start($env);
1901
1902                 $self->{vars}->{promoted_dc} = $env;
1903
1904                 # force replicated DC to update repsTo/repsFrom
1905                 # for vampired partitions
1906                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1907                 my $cmd = "";
1908                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1909                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1910                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
1911                 $cmd .= " $env->{CONFIGURATION}";
1912                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1913                 unless (system($cmd) == 0) {
1914                         warn("Failed to exec kcc\n$cmd");
1915                         return undef;
1916                 }
1917
1918                 # as 'vampired' dc may add data in its local replica
1919                 # we need to synchronize data between DCs
1920                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
1921                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1922                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1923                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
1924                 $cmd .= " $dc_vars->{CONFIGURATION}";
1925                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1926                 # replicate Configuration NC
1927                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
1928                 unless(system($cmd_repl) == 0) {
1929                         warn("Failed to replicate\n$cmd_repl");
1930                         return undef;
1931                 }
1932                 # replicate Default NC
1933                 $cmd_repl = "$cmd \"$base_dn\"";
1934                 unless(system($cmd_repl) == 0) {
1935                         warn("Failed to replicate\n$cmd_repl");
1936                         return undef;
1937                 }
1938         }
1939
1940         return $env;
1941 }
1942
1943 sub setup_subdom_dc($$$)
1944 {
1945         my ($self, $path, $dc_vars) = @_;
1946
1947         my $env = $self->provision_subdom_dc($path, $dc_vars);
1948
1949         if (defined $env) {
1950                 $self->check_or_start($env, "single");
1951
1952                 $self->wait_for_start($env);
1953
1954                 $self->{vars}->{subdom_dc} = $env;
1955
1956                 # force replicated DC to update repsTo/repsFrom
1957                 # for primary domain partitions
1958                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1959                 my $cmd = "";
1960                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1961                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1962                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
1963                 $cmd .= " $env->{CONFIGURATION}";
1964                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
1965                 unless (system($cmd) == 0) {
1966                         warn("Failed to exec kcc\n$cmd");
1967                         return undef;
1968                 }
1969
1970                 # as 'subdomain' dc may add data in its local replica
1971                 # we need to synchronize data between DCs
1972                 my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
1973                 my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
1974                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1975                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1976                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
1977                 $cmd .= " $dc_vars->{CONFIGURATION}";
1978                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
1979                 # replicate Configuration NC
1980                 my $cmd_repl = "$cmd \"$config_dn\"";
1981                 unless(system($cmd_repl) == 0) {
1982                         warn("Failed to replicate\n$cmd_repl");
1983                         return undef;
1984                 }
1985                 # replicate Default NC
1986                 $cmd_repl = "$cmd \"$base_dn\"";
1987                 unless(system($cmd_repl) == 0) {
1988                         warn("Failed to replicate\n$cmd_repl");
1989                         return undef;
1990                 }
1991         }
1992
1993         return $env;
1994 }
1995
1996 sub setup_rodc($$$)
1997 {
1998         my ($self, $path, $dc_vars) = @_;
1999
2000         my $env = $self->provision_rodc($path, $dc_vars);
2001
2002         unless ($env) {
2003                 return undef;
2004         }
2005
2006         $self->check_or_start($env, "single");
2007
2008         $self->wait_for_start($env);
2009
2010         $self->{vars}->{rodc} = $env;
2011
2012         return $env;
2013 }
2014
2015 sub setup_plugin_s4_dc($$)
2016 {
2017         my ($self, $path) = @_;
2018
2019         # If we didn't build with ADS, pretend this env was never available
2020         if (not $self->{target3}->have_ads()) {
2021                return "UNKNOWN";
2022         }
2023
2024         my $env = $self->provision_plugin_s4_dc($path);
2025         unless ($env) {
2026                 return undef;
2027         }
2028
2029         $self->check_or_start($env, "single");
2030
2031         $self->wait_for_start($env);
2032
2033         $self->{vars}->{plugin_s4_dc} = $env;
2034         return $env;
2035 }
2036
2037 1;