selftest/target/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 # NOTE: Refer to the README for more details about the various testenvs,
   7 # and tips about adding new testenvs.
   8
   9 package Samba4;
  10
  11 use strict;
  12 use Cwd qw(abs_path);
  13 use FindBin qw($RealBin);
  14 use POSIX;
  15 use SocketWrapper;
  16 use target::Samba;
  17 use target::Samba3;
  18 use Archive::Tar;
  19 use File::Path 'make_path';
  20
  21 sub new($$$$$) {
  22         my ($classname, $bindir, $ldap, $srcdir, $server_maxtime) = @_;
  23
  24         my $self = {
  25                 vars => {},
  26                 ldap => $ldap,
  27                 bindir => $bindir,
  28                 srcdir => $srcdir,
  29                 server_maxtime => $server_maxtime,
  30                 target3 => new Samba3($bindir, $srcdir, $server_maxtime)
  31         };
  32         bless $self;
  33         return $self;
  34 }
  35
  36 sub scriptdir_path($$) {
  37         my ($self, $path) = @_;
  38         return "$self->{srcdir}/source4/scripting/$path";
  39 }
  40
  41 sub openldap_start($$$) {
  42 }
  43
  44 sub slapd_start($$)
  45 {
  46         my $count = 0;
  47         my ($self, $env_vars, $STDIN_READER) = @_;
  48         my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
  49
  50         my $uri = $env_vars->{LDAP_URI};
  51
  52         if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
  53             print "A SLAPD is still listening to $uri before we started the LDAP backend.  Aborting!";
  54             return 1;
  55         }
  56         # running slapd in the background means it stays in the same process group, so it can be
  57         # killed by timelimit
  58         my $pid = fork();
  59         if ($pid == 0) {
  60                 open STDOUT, ">$env_vars->{LDAPDIR}/logs";
  61                 open STDERR, '>&STDOUT';
  62                 close($env_vars->{STDIN_PIPE});
  63                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
  64
  65                 if ($self->{ldap} eq "fedora-ds") {
  66                         exec("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd", "-D", $env_vars->{FEDORA_DS_DIR}, "-d0", "-i", $env_vars->{FEDORA_DS_PIDFILE});
  67                 } elsif ($self->{ldap} eq "openldap") {
  68                         exec($ENV{OPENLDAP_SLAPD}, "-dnone", "-F", $env_vars->{SLAPD_CONF_D}, "-h", $uri);
  69                 }
  70                 die("Unable to start slapd: $!");
  71         }
  72         $env_vars->{SLAPD_PID} = $pid;
  73         sleep(1);
  74         while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
  75                 $count++;
  76                 if ($count > 40) {
  77                         $self->slapd_stop($env_vars);
  78                         return 0;
  79                 }
  80                 sleep(1);
  81         }
  82         return 1;
  83 }
  84
  85 sub slapd_stop($$)
  86 {
  87         my ($self, $envvars) = @_;
  88         kill 9, $envvars->{SLAPD_PID};
  89         return 1;
  90 }
  91
  92 sub check_or_start($$$)
  93 {
  94         my ($self, $env_vars, $process_model) = @_;
  95         my $STDIN_READER;
  96
  97         my $env_ok = $self->check_env($env_vars);
  98         if ($env_ok) {
  99                 return $env_vars->{SAMBA_PID};
 100         } elsif (defined($env_vars->{SAMBA_PID})) {
 101                 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
 102                 return undef;
 103         }
 104
 105         # use a pipe for stdin in the child processes. This allows
 106         # those processes to monitor the pipe for EOF to ensure they
 107         # exit when the test script exits
 108         pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
 109
 110         # Start slapd before samba, but with the fifo on stdin
 111         if (defined($self->{ldap})) {
 112                 unless($self->slapd_start($env_vars, $STDIN_READER)) {
 113                         warn("couldn't start slapd (main run)");
 114                         return undef;
 115                 }
 116         }
 117
 118         print "STARTING SAMBA...\n";
 119         my $pid = fork();
 120         if ($pid == 0) {
 121                 # we want out from samba to go to the log file, but also
 122                 # to the users terminal when running 'make test' on the command
 123                 # line. This puts it on stderr on the terminal
 124                 open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
 125                 open STDERR, '>&STDOUT';
 126
 127                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
 128
 129                 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
 130                 $ENV{KRB5CCNAME} = "$env_vars->{KRB5_CCACHE}.samba";
 131                 if (defined($ENV{MITKRB5})) {
 132                         $ENV{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
 133                 }
 134                 $ENV{SELFTEST_WINBINDD_SOCKET_DIR} = $env_vars->{SELFTEST_WINBINDD_SOCKET_DIR};
 135                 $ENV{NMBD_SOCKET_DIR} = $env_vars->{NMBD_SOCKET_DIR};
 136
 137                 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
 138                 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
 139                 $ENV{NSS_WRAPPER_HOSTS} = $env_vars->{NSS_WRAPPER_HOSTS};
 140                 $ENV{NSS_WRAPPER_HOSTNAME} = $env_vars->{NSS_WRAPPER_HOSTNAME};
 141                 $ENV{NSS_WRAPPER_MODULE_SO_PATH} = $env_vars->{NSS_WRAPPER_MODULE_SO_PATH};
 142                 $ENV{NSS_WRAPPER_MODULE_FN_PREFIX} = $env_vars->{NSS_WRAPPER_MODULE_FN_PREFIX};
 143
 144                 if (defined($env_vars->{RESOLV_WRAPPER_CONF})) {
 145                         $ENV{RESOLV_WRAPPER_CONF} = $env_vars->{RESOLV_WRAPPER_CONF};
 146                 } else {
 147                         $ENV{RESOLV_WRAPPER_HOSTS} = $env_vars->{RESOLV_WRAPPER_HOSTS};
 148                 }
 149                 $ENV{RESOLV_CONF} = $env_vars->{RESOLV_CONF};
 150
 151                 $ENV{UID_WRAPPER} = "1";
 152                 $ENV{UID_WRAPPER_ROOT} = "1";
 153
 154                 $ENV{MAKE_TEST_BINARY} = Samba::bindir_path($self, "samba");
 155                 my @preargs = ();
 156                 my @optargs = ();
 157                 if (defined($ENV{SAMBA_OPTIONS})) {
 158                         @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
 159                 }
 160                 if(defined($ENV{SAMBA_VALGRIND})) {
 161                         @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
 162                 }
 163
 164                 if (defined($process_model)) {
 165                         push @optargs, ("-M", $process_model);
 166                 }
 167                 close($env_vars->{STDIN_PIPE});
 168                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 169
 170                 exec(@preargs, Samba::bindir_path($self, "samba"), "-i", "--no-process-group", "--maximum-runtime=$self->{server_maxtime}", $env_vars->{CONFIGURATION}, @optargs) or die("Unable to start samba: $!");
 171         }
 172         $env_vars->{SAMBA_PID} = $pid;
 173         print "DONE ($pid)\n";
 174
 175         close($STDIN_READER);
 176
 177         if ($self->wait_for_start($env_vars) != 0) {
 178             warn("Samba $pid failed to start up");
 179             return undef;
 180         }
 181
 182         return $pid;
 183 }
 184
 185 sub wait_for_start($$)
 186 {
 187         my ($self, $testenv_vars) = @_;
 188         my $count = 0;
 189         my $ret = 0;
 190
 191         if (not $self->check_env($testenv_vars)) {
 192             warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
 193             return -1;
 194         }
 195
 196         # This will return quickly when things are up, but be slow if we
 197         # need to wait for (eg) SSL init
 198         my $nmblookup =  Samba::bindir_path($self, "nmblookup4");
 199
 200         do {
 201                 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 202                 if ($ret != 0) {
 203                         sleep(1);
 204                 } else {
 205                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 206                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 207                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 208                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 209                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 210                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 211                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 212                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 213                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 214                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 215                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 216                 }
 217                 $count++;
 218         } while ($ret != 0 && $count < 20);
 219         if ($count == 20) {
 220                 teardown_env($self, $testenv_vars);
 221                 warn("nbt not reachable after 20 retries\n");
 222                 return -1;
 223         }
 224
 225         # Ensure we have the first RID Set before we start tests.  This makes the tests more reliable.
 226         if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
 227                 print "waiting for working LDAP and a RID Set to be allocated\n";
 228                 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
 229                 my $count = 0;
 230                 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
 231
 232                 my $search_dn = $base_dn;
 233                 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
 234                         # TODO currently no check for actual rIDAllocationPool
 235                         $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
 236                 }
 237                 my $max_wait = 60;
 238
 239                 # Add hosts file for name lookups
 240                 my $cmd = "NSS_WRAPPER_HOSTS='$testenv_vars->{NSS_WRAPPER_HOSTS}' ";
 241                 if (defined($testenv_vars->{RESOLV_WRAPPER_CONF})) {
 242                         $cmd .= "RESOLV_WRAPPER_CONF='$testenv_vars->{RESOLV_WRAPPER_CONF}' ";
 243                 } else {
 244                         $cmd .= "RESOLV_WRAPPER_HOSTS='$testenv_vars->{RESOLV_WRAPPER_HOSTS}' ";
 245                 }
 246                 $cmd .= "RESOLV_CONF='$testenv_vars->{RESOLV_CONF}' ";
 247
 248                 $cmd .= "$ldbsearch ";
 249                 $cmd .= "$testenv_vars->{CONFIGURATION} ";
 250                 $cmd .= "-H ldap://$testenv_vars->{SERVER} ";
 251                 $cmd .= "-U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} ";
 252                 $cmd .= "-s base ";
 253                 $cmd .= "-b '$search_dn' ";
 254                 while (system("$cmd >/dev/null") != 0) {
 255                         $count++;
 256                         if ($count > $max_wait) {
 257                                 teardown_env($self, $testenv_vars);
 258                                 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
 259                                 return -1;
 260                         }
 261                         print "Waiting for working LDAP...\n";
 262                         sleep(1);
 263                 }
 264         }
 265
 266         my $wbinfo =  Samba::bindir_path($self, "wbinfo");
 267
 268         $count = 0;
 269         do {
 270                 my $cmd = "NSS_WRAPPER_PASSWD=$testenv_vars->{NSS_WRAPPER_PASSWD} ";
 271                 $cmd .= "NSS_WRAPPER_GROUP=$testenv_vars->{NSS_WRAPPER_GROUP} ";
 272                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=$testenv_vars->{SELFTEST_WINBINDD_SOCKET_DIR} ";
 273                 $cmd .= "$wbinfo -P";
 274                 $ret = system($cmd);
 275
 276                 if ($ret != 0) {
 277                         sleep(1);
 278                 }
 279                 $count++;
 280         } while ($ret != 0 && $count < 20);
 281         if ($count == 20) {
 282                 teardown_env($self, $testenv_vars);
 283                 warn("winbind not reachable after 20 retries\n");
 284                 return -1;
 285         }
 286
 287         # Ensure we registered all our names
 288         if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
 289                 my $max_wait = 60;
 290                 print "Waiting for dns_update_cache to be created.\n";
 291                 $count = 0;
 292                 while (not -e "$testenv_vars->{PRIVATEDIR}/dns_update_cache") {
 293                         $count++;
 294                         if ($count > $max_wait) {
 295                                 teardown_env($self, $testenv_vars);
 296                                 warn("Timed out ($max_wait sec) waiting for dns_update_cache PID $testenv_vars->{SAMBA_PID}");
 297                                 return -1;
 298                         }
 299                         print "Waiting for dns_update_cache to be created...\n";
 300                         sleep(1);
 301                 }
 302                 print "Waiting for dns_update_cache to be filled.\n";
 303                 $count = 0;
 304                 while ((-s "$testenv_vars->{PRIVATEDIR}/dns_update_cache") == 0) {
 305                         $count++;
 306                         if ($count > $max_wait) {
 307                                 teardown_env($self, $testenv_vars);
 308                                 warn("Timed out ($max_wait sec) waiting for dns_update_cache PID $testenv_vars->{SAMBA_PID}");
 309                                 return -1;
 310                         }
 311                         print "Waiting for dns_update_cache to be filled...\n";
 312                         sleep(1);
 313                 }
 314         }
 315
 316         print $self->getlog_env($testenv_vars);
 317
 318         print "READY ($testenv_vars->{SAMBA_PID})\n";
 319
 320         return 0
 321 }
 322
 323 sub write_ldb_file($$$)
 324 {
 325         my ($self, $file, $ldif) = @_;
 326
 327         my $ldbadd =  Samba::bindir_path($self, "ldbadd");
 328         open(LDIF, "|$ldbadd -H $file >/dev/null");
 329         print LDIF $ldif;
 330         return(close(LDIF));
 331 }
 332
 333 sub add_wins_config($$)
 334 {
 335         my ($self, $privatedir) = @_;
 336
 337         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 338 dn: name=TORTURE_11,CN=PARTNERS
 339 objectClass: wreplPartner
 340 name: TORTURE_11
 341 address: 127.0.0.11
 342 pullInterval: 0
 343 pushChangeCount: 0
 344 type: 0x3
 345 ");
 346 }
 347
 348 sub mk_fedora_ds($$)
 349 {
 350         my ($self, $ctx) = @_;
 351
 352         #Make the subdirectory be as fedora DS would expect
 353         my $fedora_ds_dir = "$ctx->{ldapdir}/slapd-$ctx->{ldap_instance}";
 354
 355         my $pidfile = "$fedora_ds_dir/logs/slapd-$ctx->{ldap_instance}.pid";
 356
 357         return ($fedora_ds_dir, $pidfile);
 358 }
 359
 360 sub mk_openldap($$)
 361 {
 362         my ($self, $ctx) = @_;
 363
 364         my $slapd_conf_d = "$ctx->{ldapdir}/slapd.d";
 365         my $pidfile = "$ctx->{ldapdir}/slapd.pid";
 366
 367         return ($slapd_conf_d, $pidfile);
 368 }
 369
 370 sub setup_dns_hub_internal($$$)
 371 {
 372         my ($self, $hostname, $prefix) = @_;
 373         my $STDIN_READER;
 374
 375         unless(-d $prefix or make_path($prefix, 0777)) {
 376                 warn("Unable to create $prefix");
 377                 return undef;
 378         }
 379         my $prefix_abs = abs_path($prefix);
 380
 381         die ("prefix=''") if $prefix_abs eq "";
 382         die ("prefix='/'") if $prefix_abs eq "/";
 383
 384         unless (system("rm -rf $prefix_abs/*") == 0) {
 385                 warn("Unable to clean up");
 386         }
 387
 388         my $swiface = Samba::get_interface($hostname);
 389
 390         my $env = undef;
 391         $env->{prefix} = $prefix;
 392         $env->{prefix_abs} = $prefix_abs;
 393
 394         $env->{hostname} = $hostname;
 395         $env->{swiface} = $swiface;
 396
 397         $env->{ipv4} = "127.0.0.$swiface";
 398         $env->{ipv6} = sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
 399
 400         $env->{DNS_HUB_LOG} = "$prefix_abs/dns_hub.log";
 401
 402         $env->{RESOLV_CONF} = "$prefix_abs/resolv.conf";
 403
 404         open(RESOLV_CONF, ">$env->{RESOLV_CONF}");
 405         print RESOLV_CONF "nameserver $env->{ipv4}\n";
 406         print RESOLV_CONF "nameserver $env->{ipv6}\n";
 407         close(RESOLV_CONF);
 408
 409         # use a pipe for stdin in the child processes. This allows
 410         # those processes to monitor the pipe for EOF to ensure they
 411         # exit when the test script exits
 412         pipe($STDIN_READER, $env->{STDIN_PIPE});
 413
 414         print "STARTING rootdnsforwarder...\n";
 415         my $pid = fork();
 416         if ($pid == 0) {
 417                 # we want out from samba to go to the log file, but also
 418                 # to the users terminal when running 'make test' on the command
 419                 # line. This puts it on stderr on the terminal
 420                 open STDOUT, "| tee $env->{DNS_HUB_LOG} 1>&2";
 421                 open STDERR, '>&STDOUT';
 422
 423                 SocketWrapper::set_default_iface($swiface);
 424                 my $pcap_file = "$ENV{SOCKET_WRAPPER_PCAP_DIR}/env-$hostname$.pcap";
 425                 SocketWrapper::setup_pcap($pcap_file);
 426
 427                 my @preargs = ();
 428                 my @args = ();
 429                 my @optargs = ();
 430                 if (!defined($ENV{PYTHON})) {
 431                     push (@preargs, "env");
 432                     push (@preargs, "python");
 433                 } else {
 434                     push (@preargs, $ENV{PYTHON});
 435                 }
 436                 $ENV{MAKE_TEST_BINARY} = "$self->{srcdir}/selftest/target/dns_hub.py";
 437                 push (@args, "$self->{server_maxtime}");
 438                 push (@args, "$env->{ipv4}");
 439                 close($env->{STDIN_PIPE});
 440                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 441
 442                 exec(@preargs, $ENV{MAKE_TEST_BINARY}, @args, @optargs)
 443                         or die("Unable to start $ENV{MAKE_TEST_BINARY}: $!");
 444         }
 445         $env->{SAMBA_PID} = $pid;
 446         $env->{KRB5_CONFIG} = "${prefix_abs}/no_krb5.conf";
 447         close($STDIN_READER);
 448
 449         print "DONE\n";
 450         return $env;
 451 }
 452
 453 sub setup_dns_hub
 454 {
 455         my ($self, $prefix) = @_;
 456
 457         my $hostname = "rootdnsforwarder";
 458
 459         my $env = $self->setup_dns_hub_internal("$hostname", "$prefix/$hostname");
 460
 461         $self->{dns_hub_env} = $env;
 462
 463         return $env;
 464 }
 465
 466 sub get_dns_hub_env($)
 467 {
 468         my ($self, $prefix) = @_;
 469
 470         if (defined($self->{dns_hub_env})) {
 471                 return $self->{dns_hub_env};
 472         }
 473
 474         die("get_dns_hub_env() not setup 'dns_hub_env'");
 475         return undef;
 476 }
 477
 478 # Returns the environmental variables that we pass to samba-tool commands
 479 sub get_cmd_env_vars
 480 {
 481         my ($self, $localenv) = @_;
 482
 483         my $cmd_env = "NSS_WRAPPER_HOSTS='$localenv->{NSS_WRAPPER_HOSTS}' ";
 484         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 485         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 486                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 487         } else {
 488                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 489         }
 490         $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 491         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 492         $cmd_env .= "RESOLV_CONF=\"$localenv->{RESOLV_CONF}\" ";
 493
 494         return $cmd_env;
 495 }
 496
 497 sub setup_namespaces($$:$$)
 498 {
 499         my ($self, $localenv, $upn_array, $spn_array) = @_;
 500
 501         @{$upn_array} = [] unless defined($upn_array);
 502         my $upn_args = "";
 503         foreach my $upn (@{$upn_array}) {
 504                 $upn_args .= " --add-upn-suffix=$upn";
 505         }
 506
 507         @{$spn_array} = [] unless defined($spn_array);
 508         my $spn_args = "";
 509         foreach my $spn (@{$spn_array}) {
 510                 $spn_args .= " --add-spn-suffix=$spn";
 511         }
 512
 513         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 514
 515         my $cmd_env = $self->get_cmd_env_vars($localenv);
 516
 517         my $cmd_config = " $localenv->{CONFIGURATION}";
 518
 519         my $namespaces = $cmd_env;
 520         $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
 521         $namespaces .= $cmd_config;
 522         unless (system($namespaces) == 0) {
 523                 warn("Failed to add namespaces \n$namespaces");
 524                 return;
 525         }
 526
 527         return;
 528 }
 529
 530 sub setup_trust($$$$$)
 531 {
 532         my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
 533
 534         $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
 535         $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
 536         $localenv->{TRUST_SERVER_IPV6} = $remoteenv->{SERVER_IPV6};
 537         $localenv->{TRUST_NETBIOSNAME} = $remoteenv->{NETBIOSNAME};
 538         $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
 539         $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
 540         $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
 541         $localenv->{TRUST_REALM} = $remoteenv->{REALM};
 542         $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID};
 543
 544         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 545
 546         # setup the trust
 547         my $cmd_env = $self->get_cmd_env_vars($localenv);
 548
 549         my $cmd_config = " $localenv->{CONFIGURATION}";
 550         my $cmd_creds = $cmd_config;
 551         $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
 552
 553         my $create = $cmd_env;
 554         $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
 555         $create .= " $extra_args";
 556         $create .= $cmd_creds;
 557         unless (system($create) == 0) {
 558                 warn("Failed to create trust \n$create");
 559                 return undef;
 560         }
 561
 562         my $groupname = "g_$localenv->{TRUST_DOMAIN}";
 563         my $groupadd = $cmd_env;
 564         $groupadd .= " $samba_tool group add '$groupname' --group-scope=Domain $cmd_config";
 565         unless (system($groupadd) == 0) {
 566                 warn("Failed to create group \n$groupadd");
 567                 return undef;
 568         }
 569         my $groupmem = $cmd_env;
 570         $groupmem .= " $samba_tool group addmembers '$groupname' '$localenv->{TRUST_DOMSID}-513' $cmd_config";
 571         unless (system($groupmem) == 0) {
 572                 warn("Failed to add group member \n$groupmem");
 573                 return undef;
 574         }
 575
 576         return $localenv
 577 }
 578
 579 sub provision_raw_prepare($$$$$$$$$$$$)
 580 {
 581         my ($self, $prefix, $server_role, $hostname,
 582             $domain, $realm, $samsid, $functional_level,
 583             $password, $kdc_ipv4, $kdc_ipv6) = @_;
 584         my $ctx;
 585         my $python_cmd = "";
 586         if (defined $ENV{PYTHON}) {
 587                 $python_cmd = $ENV{PYTHON} . " ";
 588         }
 589         $ctx->{python} = $python_cmd;
 590         my $netbiosname = uc($hostname);
 591
 592         unless(-d $prefix or mkdir($prefix, 0777)) {
 593                 warn("Unable to create $prefix");
 594                 return undef;
 595         }
 596         my $prefix_abs = abs_path($prefix);
 597
 598         die ("prefix=''") if $prefix_abs eq "";
 599         die ("prefix='/'") if $prefix_abs eq "/";
 600
 601         unless (system("rm -rf $prefix_abs/*") == 0) {
 602                 warn("Unable to clean up");
 603         }
 604
 605
 606         my $swiface = Samba::get_interface($hostname);
 607
 608         $ctx->{prefix} = $prefix;
 609         $ctx->{prefix_abs} = $prefix_abs;
 610
 611         $ctx->{server_role} = $server_role;
 612         $ctx->{hostname} = $hostname;
 613         $ctx->{netbiosname} = $netbiosname;
 614         $ctx->{swiface} = $swiface;
 615         $ctx->{password} = $password;
 616         $ctx->{kdc_ipv4} = $kdc_ipv4;
 617         $ctx->{kdc_ipv6} = $kdc_ipv6;
 618         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
 619         if ($functional_level eq "2000") {
 620                 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc"
 621         }
 622
 623 #
 624 # Set smbd log level here.
 625 #
 626         $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
 627         $ctx->{username} = "Administrator";
 628         $ctx->{domain} = $domain;
 629         $ctx->{realm} = uc($realm);
 630         $ctx->{dnsname} = lc($realm);
 631         $ctx->{samsid} = $samsid;
 632
 633         $ctx->{functional_level} = $functional_level;
 634
 635         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 636         chomp $unix_name;
 637         $ctx->{unix_name} = $unix_name;
 638         $ctx->{unix_uid} = $>;
 639         my @mygid = split(" ", $();
 640         $ctx->{unix_gid} = $mygid[0];
 641         $ctx->{unix_gids_str} = $);
 642         @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
 643
 644         $ctx->{etcdir} = "$prefix_abs/etc";
 645         $ctx->{piddir} = "$prefix_abs/pid";
 646         $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
 647         $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
 648         $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
 649         $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
 650         $ctx->{privatedir} = "$prefix_abs/private";
 651         $ctx->{binddnsdir} = "$prefix_abs/bind-dns";
 652         $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
 653         $ctx->{lockdir} = "$prefix_abs/lockdir";
 654         $ctx->{logdir} = "$prefix_abs/logs";
 655         $ctx->{statedir} = "$prefix_abs/statedir";
 656         $ctx->{cachedir} = "$prefix_abs/cachedir";
 657         $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
 658         $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
 659         $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
 660         $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
 661         $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
 662         $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
 663         if ($ENV{SAMBA_DNS_FAKING}) {
 664                 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 665                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
 666                 $ctx->{samba_dnsupdate} = $python_cmd .  $ctx->{samba_dnsupdate};
 667         } else {
 668                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces";
 669                 $ctx->{samba_dnsupdate} = $python_cmd .  $ctx->{samba_dnsupdate};
 670                 $ctx->{use_resolv_wrapper} = 1;
 671         }
 672
 673         my $dns_hub = $self->get_dns_hub_env();
 674         $ctx->{resolv_conf} = $dns_hub->{RESOLV_CONF};
 675
 676         $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
 677
 678         $ctx->{ipv4} = "127.0.0.$swiface";
 679         $ctx->{ipv6} = sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
 680         $ctx->{interfaces} = "$ctx->{ipv4}/8 $ctx->{ipv6}/64";
 681
 682         push(@{$ctx->{directories}}, $ctx->{privatedir});
 683         push(@{$ctx->{directories}}, $ctx->{binddnsdir});
 684         push(@{$ctx->{directories}}, $ctx->{etcdir});
 685         push(@{$ctx->{directories}}, $ctx->{piddir});
 686         push(@{$ctx->{directories}}, $ctx->{lockdir});
 687         push(@{$ctx->{directories}}, $ctx->{logdir});
 688         push(@{$ctx->{directories}}, $ctx->{statedir});
 689         push(@{$ctx->{directories}}, $ctx->{cachedir});
 690
 691         $ctx->{smb_conf_extra_options} = "";
 692
 693         my @provision_options = ();
 694         push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
 695         push (@provision_options, "KRB5_CCACHE=\"$ctx->{krb5_ccache}\"");
 696         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
 697         push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
 698         push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
 699         push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
 700         if (defined($ctx->{use_resolv_wrapper})) {
 701                 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
 702                 push (@provision_options, "RESOLV_CONF=\"$ctx->{resolv_conf}\"");
 703         } else {
 704                 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
 705         }
 706         if (defined($ENV{GDB_PROVISION})) {
 707                 push (@provision_options, "gdb --args");
 708                 if (!defined($ENV{PYTHON})) {
 709                     push (@provision_options, "env");
 710                     push (@provision_options, "python");
 711                 }
 712         }
 713         if (defined($ENV{VALGRIND_PROVISION})) {
 714                 push (@provision_options, "valgrind");
 715                 if (!defined($ENV{PYTHON})) {
 716                     push (@provision_options, "env");
 717                     push (@provision_options, "python");
 718                 }
 719         }
 720
 721         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 722
 723         push (@provision_options, $samba_tool);
 724         push (@provision_options, "domain");
 725         push (@provision_options, "provision");
 726         push (@provision_options, "--configfile=$ctx->{smb_conf}");
 727         push (@provision_options, "--host-name=$ctx->{hostname}");
 728         push (@provision_options, "--host-ip=$ctx->{ipv4}");
 729         push (@provision_options, "--quiet");
 730         push (@provision_options, "--domain=$ctx->{domain}");
 731         push (@provision_options, "--realm=$ctx->{realm}");
 732         if (defined($ctx->{samsid})) {
 733                 push (@provision_options, "--domain-sid=$ctx->{samsid}");
 734         }
 735         push (@provision_options, "--adminpass=$ctx->{password}");
 736         push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
 737         push (@provision_options, "--machinepass=machine$ctx->{password}");
 738         push (@provision_options, "--root=$ctx->{unix_name}");
 739         push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
 740         push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
 741
 742         @{$ctx->{provision_options}} = @provision_options;
 743
 744         return $ctx;
 745 }
 746
 747 sub has_option
 748 {
 749         my ($self, $keyword, @options_list) = @_;
 750
 751         # convert the options-list to a hash-map for easy keyword lookup
 752         my %options_dict = map { $_ => 1 } @options_list;
 753
 754         return exists $options_dict{$keyword};
 755 }
 756
 757 #
 758 # Step1 creates the basic configuration
 759 #
 760 sub provision_raw_step1($$)
 761 {
 762         my ($self, $ctx) = @_;
 763
 764         mkdir($_, 0777) foreach (@{$ctx->{directories}});
 765
 766         ##
 767         ## lockdir and piddir must be 0755
 768         ##
 769         chmod 0755, $ctx->{lockdir};
 770         chmod 0755, $ctx->{piddir};
 771
 772         unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
 773                 warn("can't open $ctx->{smb_conf}$?");
 774                 return undef;
 775         }
 776
 777         Samba::prepare_keyblobs($ctx);
 778         my $crlfile = "$ctx->{tlsdir}/crl.pem";
 779         $crlfile = "" unless -e ${crlfile};
 780
 781         # work out which file server to use. Default to source3 smbd (s3fs),
 782         # unless the source4 NTVFS (smb) file server has been specified
 783         my $services = "-smb +s3fs";
 784         if ($self->has_option("--use-ntvfs", @{$ctx->{provision_options}})) {
 785                 $services = "+smb -s3fs";
 786         }
 787
 788         print CONFFILE "
 789 [global]
 790         netbios name = $ctx->{netbiosname}
 791         posix:eadb = $ctx->{statedir}/eadb.tdb
 792         workgroup = $ctx->{domain}
 793         realm = $ctx->{realm}
 794         private dir = $ctx->{privatedir}
 795         binddns dir = $ctx->{binddnsdir}
 796         pid directory = $ctx->{piddir}
 797         ncalrpc dir = $ctx->{ncalrpcdir}
 798         lock dir = $ctx->{lockdir}
 799         state directory = $ctx->{statedir}
 800         cache directory = $ctx->{cachedir}
 801         winbindd socket directory = $ctx->{winbindd_socket_dir}
 802         ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
 803         winbind separator = /
 804         interfaces = $ctx->{interfaces}
 805         tls dh params file = $ctx->{tlsdir}/dhparms.pem
 806         tls crlfile = ${crlfile}
 807         tls verify peer = no_check
 808         panic action = $RealBin/gdb_backtrace \%d
 809         wins support = yes
 810         server role = $ctx->{server_role}
 811         server services = +echo $services
 812         dcerpc endpoint servers = +winreg +srvsvc
 813         notify:inotify = false
 814         ldb:nosync = true
 815         ldap server require strong auth = yes
 816 #We don't want to pass our self-tests if the PAC code is wrong
 817         gensec:require_pac = true
 818         log file = $ctx->{logdir}/log.\%m
 819         log level = $ctx->{server_loglevel}
 820         lanman auth = Yes
 821         ntlm auth = Yes
 822         rndc command = true
 823         dns update command = $ctx->{samba_dnsupdate}
 824         spn update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
 825         gpo update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba-gpupdate -s $ctx->{smb_conf} --target=Computer
 826         samba kcc command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_kcc
 827         dreplsrv:periodic_startup_interval = 0
 828         dsdb:schema update allowed = yes
 829
 830         vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
 831
 832         idmap_ldb:use rfc2307=yes
 833         winbind enum users = yes
 834         winbind enum groups = yes
 835
 836         rpc server port:netlogon = 1026
 837
 838 ";
 839
 840         print CONFFILE "
 841
 842         # Begin extra options
 843         $ctx->{smb_conf_extra_options}
 844         # End extra options
 845 ";
 846         close(CONFFILE);
 847
 848         #Default the KDC IP to the server's IP
 849         if (not defined($ctx->{kdc_ipv4})) {
 850                 $ctx->{kdc_ipv4} = $ctx->{ipv4};
 851         }
 852         if (not defined($ctx->{kdc_ipv6})) {
 853                 $ctx->{kdc_ipv6} = $ctx->{ipv6};
 854         }
 855
 856         Samba::mk_krb5_conf($ctx);
 857         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
 858
 859         open(PWD, ">$ctx->{nsswrap_passwd}");
 860         if ($ctx->{unix_uid} != 0) {
 861                 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
 862         }
 863         print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
 864         print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
 865 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 866 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 867 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 868 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 869 ";
 870         close(PWD);
 871         my $uid_rfc2307test = 65533;
 872
 873         open(GRP, ">$ctx->{nsswrap_group}");
 874         if ($ctx->{unix_gid} != 0) {
 875                 print GRP "root:x:0:\n";
 876         }
 877         print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
 878         print GRP "wheel:x:10:
 879 users:x:65531:
 880 nobody:x:65533:
 881 nogroup:x:65534:nobody
 882 ";
 883         close(GRP);
 884         my $gid_rfc2307test = 65532;
 885
 886         my $hostname = lc($ctx->{hostname});
 887         open(HOSTS, ">>$ctx->{nsswrap_hosts}");
 888         if ($hostname eq "localdc") {
 889                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 890                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 891         } else {
 892                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 893                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 894         }
 895         close(HOSTS);
 896
 897         my $configuration = "--configfile=$ctx->{smb_conf}";
 898
 899 #Ensure the config file is valid before we start
 900         my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
 901         if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 902                 system("$testparm -v --suppress-prompt $configuration >&2");
 903                 warn("Failed to create a valid smb.conf configuration $testparm!");
 904                 return undef;
 905         }
 906         unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
 907                 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
 908                 return undef;
 909         }
 910
 911         my $ret = {
 912                 KRB5_CONFIG => $ctx->{krb5_conf},
 913                 KRB5_CCACHE => $ctx->{krb5_ccache},
 914                 MITKDC_CONFIG => $ctx->{mitkdc_conf},
 915                 PIDDIR => $ctx->{piddir},
 916                 SERVER => $ctx->{hostname},
 917                 SERVER_IP => $ctx->{ipv4},
 918                 SERVER_IPV6 => $ctx->{ipv6},
 919                 NETBIOSNAME => $ctx->{netbiosname},
 920                 DOMAIN => $ctx->{domain},
 921                 USERNAME => $ctx->{username},
 922                 REALM => $ctx->{realm},
 923                 DNSNAME => $ctx->{dnsname},
 924                 SAMSID => $ctx->{samsid},
 925                 PASSWORD => $ctx->{password},
 926                 LDAPDIR => $ctx->{ldapdir},
 927                 LDAP_INSTANCE => $ctx->{ldap_instance},
 928                 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
 929                 NCALRPCDIR => $ctx->{ncalrpcdir},
 930                 LOCKDIR => $ctx->{lockdir},
 931                 STATEDIR => $ctx->{statedir},
 932                 CACHEDIR => $ctx->{cachedir},
 933                 PRIVATEDIR => $ctx->{privatedir},
 934                 BINDDNSDIR => $ctx->{binddnsdir},
 935                 SERVERCONFFILE => $ctx->{smb_conf},
 936                 CONFIGURATION => $configuration,
 937                 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
 938                 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
 939                 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
 940                 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
 941                 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
 942                 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
 943                 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
 944                 SAMBA_TEST_LOG_POS => 0,
 945                 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
 946                 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
 947                 LOCAL_PATH => $ctx->{share},
 948                 UID_RFC2307TEST => $uid_rfc2307test,
 949                 GID_RFC2307TEST => $gid_rfc2307test,
 950                 SERVER_ROLE => $ctx->{server_role},
 951                 RESOLV_CONF => $ctx->{resolv_conf}
 952         };
 953
 954         if (defined($ctx->{use_resolv_wrapper})) {
 955                 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
 956         } else {
 957                 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
 958         }
 959
 960         if ($ctx->{server_role} eq "domain controller") {
 961                 $ret->{DOMSID} = $ret->{SAMSID};
 962         }
 963
 964         return $ret;
 965 }
 966
 967 #
 968 # Step2 runs the provision script
 969 #
 970 sub provision_raw_step2($$$)
 971 {
 972         my ($self, $ctx, $ret) = @_;
 973
 974         my $provision_cmd = join(" ", @{$ctx->{provision_options}});
 975         unless (system($provision_cmd) == 0) {
 976                 warn("Unable to provision: \n$provision_cmd\n");
 977                 return undef;
 978         }
 979
 980         my $testallowed_account = "testallowed";
 981         my $samba_tool_cmd = "";
 982         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 983         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 984         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 985             . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
 986         unless (system($samba_tool_cmd) == 0) {
 987                 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
 988                 return undef;
 989         }
 990
 991         my $ldbmodify = "";
 992         $ldbmodify .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 993         $ldbmodify .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 994         $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
 995         my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
 996
 997         if ($ctx->{server_role} ne "domain controller") {
 998                 $base_dn = "DC=$ctx->{netbiosname}";
 999         }
1000
1001         my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
1002         $testallowed_account = "testallowed account";
1003         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
1004         print LDIF "dn: $user_dn
1005 changetype: modify
1006 replace: samAccountName
1007 samAccountName: $testallowed_account
1008 -
1009 ";
1010         close(LDIF);
1011
1012         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
1013         print LDIF "dn: $user_dn
1014 changetype: modify
1015 replace: userPrincipalName
1016 userPrincipalName: testallowed upn\@$ctx->{realm}
1017 replace: servicePrincipalName
1018 servicePrincipalName: host/testallowed
1019 -
1020 ";
1021         close(LDIF);
1022
1023         $samba_tool_cmd = "";
1024         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1025         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1026         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1027             . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
1028         unless (system($samba_tool_cmd) == 0) {
1029                 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
1030                 return undef;
1031         }
1032
1033         my $user_dn = "cn=testdenied,cn=users,$base_dn";
1034         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
1035         print LDIF "dn: $user_dn
1036 changetype: modify
1037 replace: userPrincipalName
1038 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
1039 -
1040 ";
1041         close(LDIF);
1042
1043         $samba_tool_cmd = "";
1044         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1045         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1046         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1047             . " user create --configfile=$ctx->{smb_conf} testupnspn $ctx->{password}";
1048         unless (system($samba_tool_cmd) == 0) {
1049                 warn("Unable to add testupnspn user: \n$samba_tool_cmd\n");
1050                 return undef;
1051         }
1052
1053         my $user_dn = "cn=testupnspn,cn=users,$base_dn";
1054         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
1055         print LDIF "dn: $user_dn
1056 changetype: modify
1057 replace: userPrincipalName
1058 userPrincipalName: http/testupnspn.$ctx->{dnsname}\@$ctx->{realm}
1059 replace: servicePrincipalName
1060 servicePrincipalName: http/testupnspn.$ctx->{dnsname}
1061 -
1062 ";
1063         close(LDIF);
1064
1065         $samba_tool_cmd = "";
1066         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1067         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1068         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1069             . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
1070         unless (system($samba_tool_cmd) == 0) {
1071                 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
1072                 return undef;
1073         }
1074
1075         # Create to users alice and bob!
1076         my $user_account_array = ["alice", "bob", "jane"];
1077
1078         foreach my $user_account (@{$user_account_array}) {
1079                 my $samba_tool_cmd = "";
1080
1081                 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1082                 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1083                 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1084                     . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
1085                 unless (system($samba_tool_cmd) == 0) {
1086                         warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
1087                         return undef;
1088                 }
1089         }
1090
1091         my $ldbmodify = "";
1092         $ldbmodify .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1093         $ldbmodify .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1094         $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
1095
1096         my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
1097         my $user_dn = "cn=jane,cn=users,$base_dn";
1098
1099         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
1100         print LDIF "dn: $user_dn
1101 changetype: modify
1102 replace: userPrincipalName
1103 userPrincipalName: jane.doe\@$ctx->{realm}
1104 -
1105 ";
1106         close(LDIF);
1107
1108         return $ret;
1109 }
1110
1111 sub provision($$$$$$$$$$)
1112 {
1113         my ($self, $prefix, $server_role, $hostname,
1114             $domain, $realm, $functional_level,
1115             $password, $kdc_ipv4, $kdc_ipv6, $extra_smbconf_options, $extra_smbconf_shares,
1116             $extra_provision_options) = @_;
1117
1118         my $samsid = Samba::random_domain_sid();
1119
1120         my $ctx = $self->provision_raw_prepare($prefix, $server_role,
1121                                                $hostname,
1122                                                $domain, $realm,
1123                                                $samsid,
1124                                                $functional_level,
1125                                                $password, $kdc_ipv4, $kdc_ipv6);
1126
1127         if (defined($extra_provision_options)) {
1128                 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
1129         }
1130
1131         $ctx->{share} = "$ctx->{prefix_abs}/share";
1132         push(@{$ctx->{directories}}, "$ctx->{share}");
1133         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
1134         push(@{$ctx->{directories}}, "$ctx->{share}/test2");
1135
1136         # precreate directories for printer drivers
1137         push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
1138         push(@{$ctx->{directories}}, "$ctx->{share}/x64");
1139         push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
1140
1141         my $msdfs = "no";
1142         $msdfs = "yes" if ($server_role eq "domain controller");
1143         $ctx->{smb_conf_extra_options} = "
1144
1145         max xmit = 32K
1146         server max protocol = SMB2
1147         host msdfs = $msdfs
1148         lanman auth = yes
1149
1150         # fruit:copyfile is a global option
1151         fruit:copyfile = yes
1152
1153         $extra_smbconf_options
1154
1155 [tmp]
1156         path = $ctx->{share}
1157         read only = no
1158         posix:sharedelay = 100000
1159         posix:oplocktimeout = 3
1160         posix:writetimeupdatedelay = 500000
1161
1162 [xcopy_share]
1163         path = $ctx->{share}
1164         read only = no
1165         posix:sharedelay = 100000
1166         posix:oplocktimeout = 3
1167         posix:writetimeupdatedelay = 500000
1168         create mask = 777
1169         force create mode = 777
1170
1171 [posix_share]
1172         path = $ctx->{share}
1173         read only = no
1174         create mask = 0777
1175         force create mode = 0
1176         directory mask = 0777
1177         force directory mode = 0
1178
1179 [test1]
1180         path = $ctx->{share}/test1
1181         read only = no
1182         posix:sharedelay = 100000
1183         posix:oplocktimeout = 3
1184         posix:writetimeupdatedelay = 500000
1185
1186 [test2]
1187         path = $ctx->{share}/test2
1188         read only = no
1189         posix:sharedelay = 100000
1190         posix:oplocktimeout = 3
1191         posix:writetimeupdatedelay = 500000
1192
1193 [cifs]
1194         path = $ctx->{share}/_ignore_cifs_
1195         read only = no
1196         ntvfs handler = cifs
1197         cifs:server = $ctx->{netbiosname}
1198         cifs:share = tmp
1199         cifs:use-s4u2proxy = yes
1200         # There is no username specified here, instead the client is expected
1201         # to log in with kerberos, and the serverwill use delegated credentials.
1202         # Or the server tries s4u2self/s4u2proxy to impersonate the client
1203
1204 [simple]
1205         path = $ctx->{share}
1206         read only = no
1207         ntvfs handler = simple
1208
1209 [sysvol]
1210         path = $ctx->{statedir}/sysvol
1211         read only = no
1212
1213 [netlogon]
1214         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1215         read only = no
1216
1217 [cifsposix]
1218         copy = simple
1219         ntvfs handler = cifsposix
1220
1221 [vfs_fruit]
1222         path = $ctx->{share}
1223         vfs objects = catia fruit streams_xattr acl_xattr
1224         ea support = yes
1225         fruit:resource = file
1226         fruit:metadata = netatalk
1227         fruit:locking = netatalk
1228         fruit:encoding = native
1229
1230 $extra_smbconf_shares
1231 ";
1232
1233         if (defined($self->{ldap})) {
1234                 $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
1235                 push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
1236
1237                 my $ldap_uri= "$ctx->{ldapdir}/ldapi";
1238                 $ldap_uri =~ s|/|%2F|g;
1239                 $ldap_uri = "ldapi://$ldap_uri";
1240                 $ctx->{ldap_uri} = $ldap_uri;
1241
1242                 $ctx->{ldap_instance} = lc($ctx->{netbiosname});
1243         }
1244
1245         my $ret = $self->provision_raw_step1($ctx);
1246         unless (defined $ret) {
1247                 return undef;
1248         }
1249
1250         if (defined($self->{ldap})) {
1251                 $ret->{LDAP_URI} = $ctx->{ldap_uri};
1252                 push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
1253                 push (@{$ctx->{provision_options}}, "--ldap-backend-nosync");
1254                 if ($self->{ldap} eq "openldap") {
1255                         push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
1256                         ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx) or die("Unable to create openldap directories");
1257
1258                 } elsif ($self->{ldap} eq "fedora-ds") {
1259                         push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
1260                         push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
1261                         ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx) or die("Unable to create fedora ds directories");
1262                 }
1263
1264         }
1265
1266         return $self->provision_raw_step2($ctx, $ret);
1267 }
1268
1269 sub provision_s4member($$$$$)
1270 {
1271         my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
1272         print "PROVISIONING MEMBER...\n";
1273         my $extra_smb_conf = "
1274         passdb backend = samba_dsdb
1275 winbindd:use external pipes = true
1276
1277 # the source4 smb server doesn't allow signing by default
1278 server signing = enabled
1279 raw NTLMv2 auth = yes
1280
1281 rpc_server:default = external
1282 rpc_server:svcctl = embedded
1283 rpc_server:srvsvc = embedded
1284 rpc_server:eventlog = embedded
1285 rpc_server:ntsvcs = embedded
1286 rpc_server:winreg = embedded
1287 rpc_server:spoolss = embedded
1288 rpc_daemon:spoolssd = embedded
1289 rpc_server:tcpip = no
1290 ";
1291         if ($more_conf) {
1292                 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1293         }
1294         my $extra_provision_options = ["--use-ntvfs"];
1295         my $ret = $self->provision($prefix,
1296                                    "member server",
1297                                    $hostname,
1298                                    $dcvars->{DOMAIN},
1299                                    $dcvars->{REALM},
1300                                    "2008",
1301                                    "locMEMpass3",
1302                                    $dcvars->{SERVER_IP},
1303                                    $dcvars->{SERVER_IPV6},
1304                                    $extra_smb_conf, "",
1305                                    $extra_provision_options);
1306         unless ($ret) {
1307                 return undef;
1308         }
1309
1310         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1311         my $cmd = $self->get_cmd_env_vars($ret);
1312         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1313         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1314         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1315
1316         unless (system($cmd) == 0) {
1317                 warn("Join failed\n$cmd");
1318                 return undef;
1319         }
1320
1321         $ret->{MEMBER_SERVER} = $ret->{SERVER};
1322         $ret->{MEMBER_SERVER_IP} = $ret->{SERVER_IP};
1323         $ret->{MEMBER_SERVER_IPV6} = $ret->{SERVER_IPV6};
1324         $ret->{MEMBER_NETBIOSNAME} = $ret->{NETBIOSNAME};
1325         $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
1326         $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
1327
1328         $ret->{DOMSID} = $dcvars->{DOMSID};
1329         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1330         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1331         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1332         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1333         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1334         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1335
1336         return $ret;
1337 }
1338
1339 sub provision_rpc_proxy($$$)
1340 {
1341         my ($self, $prefix, $dcvars) = @_;
1342         print "PROVISIONING RPC PROXY...\n";
1343
1344         my $extra_smbconf_options = "
1345         passdb backend = samba_dsdb
1346
1347         # rpc_proxy
1348         dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1349         dcerpc endpoint servers = epmapper, remote
1350         dcerpc_remote:interfaces = rpcecho
1351         dcerpc_remote:allow_anonymous_fallback = yes
1352
1353 [cifs_to_dc]
1354         path = /tmp/_ignore_cifs_to_dc_/_none_
1355         read only = no
1356         ntvfs handler = cifs
1357         cifs:server = $dcvars->{SERVER}
1358         cifs:share = cifs
1359         cifs:use-s4u2proxy = yes
1360         # There is no username specified here, instead the client is expected
1361         # to log in with kerberos, and the serverwill use delegated credentials.
1362         # Or the server tries s4u2self/s4u2proxy to impersonate the client
1363
1364 ";
1365
1366         my $extra_provision_options = ["--use-ntvfs"];
1367         my $ret = $self->provision($prefix,
1368                                    "member server",
1369                                    "localrpcproxy",
1370                                    $dcvars->{DOMAIN},
1371                                    $dcvars->{REALM},
1372                                    "2008",
1373                                    "locRPCproxypass4",
1374                                    $dcvars->{SERVER_IP},
1375                                    $dcvars->{SERVER_IPV6},
1376                                    $extra_smbconf_options, "",
1377                                    $extra_provision_options);
1378         unless ($ret) {
1379                 return undef;
1380         }
1381
1382         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1383
1384         # The joind runs in the context of the rpc_proxy/member for now
1385         my $cmd = $self->get_cmd_env_vars($ret);
1386         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1387         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1388         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1389
1390         unless (system($cmd) == 0) {
1391                 warn("Join failed\n$cmd");
1392                 return undef;
1393         }
1394
1395         # Setting up delegation runs in the context of the DC for now
1396         $cmd = "";
1397         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1398         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1399         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1400         $cmd .= "RESOLV_CONF=\"$dcvars->{RESOLV_CONF}\" ";
1401         $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1402         $cmd .= " $dcvars->{CONFIGURATION}";
1403         print $cmd;
1404
1405         unless (system($cmd) == 0) {
1406                 warn("Delegation failed\n$cmd");
1407                 return undef;
1408         }
1409
1410         # Setting up delegation runs in the context of the DC for now
1411         $cmd = "";
1412         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1413         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1414         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1415         $cmd .= "RESOLV_CONF=\"$dcvars->{RESOLV_CONF}\" ";
1416         $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1417         $cmd .= " $dcvars->{CONFIGURATION}";
1418
1419         unless (system($cmd) == 0) {
1420                 warn("Delegation failed\n$cmd");
1421                 return undef;
1422         }
1423
1424         $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
1425         $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
1426         $ret->{RPC_PROXY_SERVER_IPV6} = $ret->{SERVER_IPV6};
1427         $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
1428         $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
1429         $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
1430
1431         $ret->{DOMSID} = $dcvars->{DOMSID};
1432         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1433         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1434         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1435         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1436         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1437         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1438
1439         return $ret;
1440 }
1441
1442 sub provision_promoted_dc($$$)
1443 {
1444         my ($self, $prefix, $dcvars) = @_;
1445         print "PROVISIONING PROMOTED DC...\n";
1446
1447         # We do this so that we don't run the provision.  That's the job of 'samba-tool domain dcpromo'.
1448         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1449                                                "promotedvdc",
1450                                                $dcvars->{DOMAIN},
1451                                                $dcvars->{REALM},
1452                                                $dcvars->{SAMSID},
1453                                                "2008",
1454                                                $dcvars->{PASSWORD},
1455                                                $dcvars->{SERVER_IP},
1456                                                $dcvars->{SERVER_IPV6});
1457
1458         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1459
1460         $ctx->{smb_conf_extra_options} = "
1461         max xmit = 32K
1462         server max protocol = SMB2
1463
1464         ntlm auth = ntlmv2-only
1465
1466 [sysvol]
1467         path = $ctx->{statedir}/sysvol
1468         read only = yes
1469
1470 [netlogon]
1471         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1472         read only = no
1473
1474 ";
1475
1476         my $ret = $self->provision_raw_step1($ctx);
1477         unless ($ret) {
1478                 return undef;
1479         }
1480
1481         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1482         my $cmd = $self->get_cmd_env_vars($ret);
1483         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1484         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1485         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1486
1487         unless (system($cmd) == 0) {
1488                 warn("Join failed\n$cmd");
1489                 return undef;
1490         }
1491
1492         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1493         my $cmd = $self->get_cmd_env_vars($ret);
1494         $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1495         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1496         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs --dns-backend=BIND9_DLZ";
1497
1498         unless (system($cmd) == 0) {
1499                 warn("Join failed\n$cmd");
1500                 return undef;
1501         }
1502
1503         $ret->{PROMOTED_DC_SERVER} = $ret->{SERVER};
1504         $ret->{PROMOTED_DC_SERVER_IP} = $ret->{SERVER_IP};
1505         $ret->{PROMOTED_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1506         $ret->{PROMOTED_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1507
1508         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1509         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1510         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1511         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1512         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1513         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1514
1515         return $ret;
1516 }
1517
1518 sub provision_vampire_dc($$$)
1519 {
1520         my ($self, $prefix, $dcvars, $fl) = @_;
1521         print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1522         my $name = "localvampiredc";
1523         my $extra_conf = "";
1524
1525         if ($fl == "2000") {
1526                 $name = "vampire2000dc";
1527         } else {
1528                 $extra_conf = "drs: immediate link sync = yes
1529                        drs: max link sync = 250";
1530         }
1531
1532         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1533         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1534                                                $name,
1535                                                $dcvars->{DOMAIN},
1536                                                $dcvars->{REALM},
1537                                                $dcvars->{DOMSID},
1538                                                $fl,
1539                                                $dcvars->{PASSWORD},
1540                                                $dcvars->{SERVER_IP},
1541                                                $dcvars->{SERVER_IPV6});
1542
1543         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1544
1545         $ctx->{smb_conf_extra_options} = "
1546         max xmit = 32K
1547         server max protocol = SMB2
1548
1549         ntlm auth = mschapv2-and-ntlmv2-only
1550         $extra_conf
1551
1552 [sysvol]
1553         path = $ctx->{statedir}/sysvol
1554         read only = yes
1555
1556 [netlogon]
1557         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1558         read only = no
1559
1560 ";
1561
1562         my $ret = $self->provision_raw_step1($ctx);
1563         unless ($ret) {
1564                 return undef;
1565         }
1566
1567         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1568         my $cmd = $self->get_cmd_env_vars($ret);
1569         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1570         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1571         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1572         $cmd .= " --backend-store=mdb";
1573
1574         unless (system($cmd) == 0) {
1575                 warn("Join failed\n$cmd");
1576                 return undef;
1577         }
1578
1579         if ($fl == "2000") {
1580                 $ret->{VAMPIRE_2000_DC_SERVER} = $ret->{SERVER};
1581                 $ret->{VAMPIRE_2000_DC_SERVER_IP} = $ret->{SERVER_IP};
1582                 $ret->{VAMPIRE_2000_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1583                 $ret->{VAMPIRE_2000_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1584         } else {
1585                 $ret->{VAMPIRE_DC_SERVER} = $ret->{SERVER};
1586                 $ret->{VAMPIRE_DC_SERVER_IP} = $ret->{SERVER_IP};
1587                 $ret->{VAMPIRE_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1588                 $ret->{VAMPIRE_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1589         }
1590         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1591         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1592         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1593         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1594         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1595         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1596         $ret->{DC_REALM} = $dcvars->{DC_REALM};
1597
1598         return $ret;
1599 }
1600
1601 sub provision_subdom_dc($$$)
1602 {
1603         my ($self, $prefix, $dcvars) = @_;
1604         print "PROVISIONING SUBDOMAIN DC...\n";
1605
1606         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1607         my $samsid = undef; # TODO pass the domain sid all the way down
1608         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1609                                                "localsubdc",
1610                                                "SAMBASUBDOM",
1611                                                "sub.samba.example.com",
1612                                                $samsid,
1613                                                "2008",
1614                                                $dcvars->{PASSWORD},
1615                                                undef);
1616
1617         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1618
1619         $ctx->{smb_conf_extra_options} = "
1620         max xmit = 32K
1621         server max protocol = SMB2
1622
1623 [sysvol]
1624         path = $ctx->{statedir}/sysvol
1625         read only = yes
1626
1627 [netlogon]
1628         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1629         read only = no
1630
1631 ";
1632
1633         my $ret = $self->provision_raw_step1($ctx);
1634         unless ($ret) {
1635                 return undef;
1636         }
1637
1638         Samba::mk_krb5_conf($ctx);
1639         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1640
1641         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1642         my $cmd = $self->get_cmd_env_vars($ret);
1643         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{dnsname} subdomain ";
1644         $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
1645         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1646         $cmd .= " --adminpass=$ret->{PASSWORD}";
1647
1648         unless (system($cmd) == 0) {
1649                 warn("Join failed\n$cmd");
1650                 return undef;
1651         }
1652
1653         $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
1654         $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
1655         $ret->{SUBDOM_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1656         $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1657
1658         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1659         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1660         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1661         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1662         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1663         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1664
1665         return $ret;
1666 }
1667
1668 sub provision_ad_dc_ntvfs($$)
1669 {
1670         my ($self, $prefix) = @_;
1671
1672         # We keep the old 'winbind' name here in server services to
1673         # ensure upgrades which used that name still work with the now
1674         # alias.
1675
1676         print "PROVISIONING AD DC (NTVFS)...\n";
1677         my $extra_conf_options = "netbios aliases = localDC1-a
1678         server services = +winbind -winbindd
1679         ldap server require strong auth = allow_sasl_over_tls
1680         allow nt4 crypto = yes
1681         raw NTLMv2 auth = yes
1682         lsa over netlogon = yes
1683         rpc server port = 1027
1684         auth event notification = true
1685         dsdb event notification = true
1686         dsdb password event notification = true
1687         dsdb group change notification = true
1688         server schannel = auto
1689         ";
1690         my $extra_provision_options = ["--use-ntvfs"];
1691         my $ret = $self->provision($prefix,
1692                                    "domain controller",
1693                                    "localdc",
1694                                    "SAMBADOMAIN",
1695                                    "samba.example.com",
1696                                    "2008",
1697                                    "locDCpass1",
1698                                    undef,
1699                                    undef,
1700                                    $extra_conf_options,
1701                                    "",
1702                                    $extra_provision_options);
1703         unless ($ret) {
1704                 return undef;
1705         }
1706
1707         unless($self->add_wins_config("$prefix/private")) {
1708                 warn("Unable to add wins configuration");
1709                 return undef;
1710         }
1711         $ret->{NETBIOSALIAS} = "localdc1-a";
1712         $ret->{DC_SERVER} = $ret->{SERVER};
1713         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1714         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1715         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1716         $ret->{DC_USERNAME} = $ret->{USERNAME};
1717         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1718         $ret->{DC_REALM} = $ret->{REALM};
1719
1720         return $ret;
1721 }
1722
1723 sub provision_fl2000dc($$)
1724 {
1725         my ($self, $prefix) = @_;
1726
1727         print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1728         my $extra_conf_options = "
1729         spnego:simulate_w2k=yes
1730         ntlmssp_server:force_old_spnego=yes
1731 ";
1732         my $extra_provision_options = ["--use-ntvfs"];
1733         # This environment uses plain text secrets
1734         # i.e. secret attributes are not encrypted on disk.
1735         # This allows testing of the --plaintext-secrets option for
1736         # provision
1737         push (@{$extra_provision_options}, "--plaintext-secrets");
1738         my $ret = $self->provision($prefix,
1739                                    "domain controller",
1740                                    "dc5",
1741                                    "SAMBA2000",
1742                                    "samba2000.example.com",
1743                                    "2000",
1744                                    "locDCpass5",
1745                                    undef,
1746                                    undef,
1747                                    $extra_conf_options,
1748                                    "",
1749                                    $extra_provision_options);
1750         unless ($ret) {
1751                 return undef;
1752         }
1753
1754         unless($self->add_wins_config("$prefix/private")) {
1755                 warn("Unable to add wins configuration");
1756                 return undef;
1757         }
1758         $ret->{DC_SERVER} = $ret->{SERVER};
1759         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1760         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1761         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1762         $ret->{DC_USERNAME} = $ret->{USERNAME};
1763         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1764         $ret->{DC_REALM} = $ret->{REALM};
1765
1766         return $ret;
1767 }
1768
1769 sub provision_fl2003dc($$$)
1770 {
1771         my ($self, $prefix, $dcvars) = @_;
1772         my $swiface1 = Samba::get_interface("fakednsforwarder1");
1773         my $swiface2 = Samba::get_interface("fakednsforwarder2");
1774
1775         print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1776         my $extra_conf_options = "allow dns updates = nonsecure and secure
1777         dcesrv:header signing = no
1778         dcesrv:max auth states = 0
1779         dns forwarder = 127.0.0.$swiface1 127.0.0.$swiface2";
1780         my $extra_provision_options = ["--use-ntvfs"];
1781         my $ret = $self->provision($prefix,
1782                                    "domain controller",
1783                                    "dc6",
1784                                    "SAMBA2003",
1785                                    "samba2003.example.com",
1786                                    "2003",
1787                                    "locDCpass6",
1788                                    undef,
1789                                    undef,
1790                                    $extra_conf_options,
1791                                    "",
1792                                    $extra_provision_options);
1793         unless (defined $ret) {
1794                 return undef;
1795         }
1796
1797         $ret->{DC_SERVER} = $ret->{SERVER};
1798         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1799         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1800         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1801         $ret->{DC_USERNAME} = $ret->{USERNAME};
1802         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1803         $ret->{DNS_FORWARDER1} = "127.0.0.$swiface1";
1804         $ret->{DNS_FORWARDER2} = "127.0.0.$swiface2";
1805
1806         my @samba_tool_options;
1807         push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1808         push (@samba_tool_options, "domain");
1809         push (@samba_tool_options, "passwordsettings");
1810         push (@samba_tool_options, "set");
1811         push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1812         push (@samba_tool_options, "--min-pwd-age=0");
1813         push (@samba_tool_options, "--history-length=1");
1814
1815         my $samba_tool_cmd = join(" ", @samba_tool_options);
1816
1817         unless (system($samba_tool_cmd) == 0) {
1818                 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1819                 return undef;
1820         }
1821
1822         unless($self->add_wins_config("$prefix/private")) {
1823                 warn("Unable to add wins configuration");
1824                 return undef;
1825         }
1826
1827         return $ret;
1828 }
1829
1830 sub provision_fl2008r2dc($$$)
1831 {
1832         my ($self, $prefix, $dcvars) = @_;
1833
1834         print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1835         my $extra_conf_options = "ldap server require strong auth = no";
1836         my $extra_provision_options = ["--use-ntvfs"];
1837         my $ret = $self->provision($prefix,
1838                                    "domain controller",
1839                                    "dc7",
1840                                    "SAMBA2008R2",
1841                                    "samba2008R2.example.com",
1842                                    "2008_R2",
1843                                    "locDCpass7",
1844                                    undef,
1845                                    undef,
1846                                    $extra_conf_options,
1847                                    "",
1848                                    $extra_provision_options);
1849         unless (defined $ret) {
1850                 return undef;
1851         }
1852
1853         unless ($self->add_wins_config("$prefix/private")) {
1854                 warn("Unable to add wins configuration");
1855                 return undef;
1856         }
1857         $ret->{DC_SERVER} = $ret->{SERVER};
1858         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1859         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1860         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1861         $ret->{DC_USERNAME} = $ret->{USERNAME};
1862         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1863         $ret->{DC_REALM} = $ret->{REALM};
1864
1865         return $ret;
1866 }
1867
1868
1869 sub provision_rodc($$$)
1870 {
1871         my ($self, $prefix, $dcvars) = @_;
1872         print "PROVISIONING RODC...\n";
1873
1874         # We do this so that we don't run the provision.  That's the job of 'net join RODC'.
1875         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1876                                                "rodc",
1877                                                $dcvars->{DOMAIN},
1878                                                $dcvars->{REALM},
1879                                                $dcvars->{DOMSID},
1880                                                "2008",
1881                                                $dcvars->{PASSWORD},
1882                                                $dcvars->{SERVER_IP},
1883                                                $dcvars->{SERVER_IPV6});
1884         unless ($ctx) {
1885                 return undef;
1886         }
1887
1888         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1889
1890         $ctx->{share} = "$ctx->{prefix_abs}/share";
1891         push(@{$ctx->{directories}}, "$ctx->{share}");
1892
1893         $ctx->{smb_conf_extra_options} = "
1894         max xmit = 32K
1895         server max protocol = SMB2
1896         password server = $dcvars->{DC_SERVER}
1897
1898 [sysvol]
1899         path = $ctx->{statedir}/sysvol
1900         read only = yes
1901
1902 [netlogon]
1903         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1904         read only = yes
1905
1906 [tmp]
1907         path = $ctx->{share}
1908         read only = no
1909         posix:sharedelay = 10000
1910         posix:oplocktimeout = 3
1911         posix:writetimeupdatedelay = 50000
1912
1913 ";
1914
1915         my $ret = $self->provision_raw_step1($ctx);
1916         unless ($ret) {
1917                 return undef;
1918         }
1919
1920         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1921         my $cmd = $self->get_cmd_env_vars($ret);
1922         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1923         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1924         $cmd .= " --server=$dcvars->{DC_SERVER} --use-ntvfs";
1925
1926         unless (system($cmd) == 0) {
1927                 warn("RODC join failed\n$cmd");
1928                 return undef;
1929         }
1930
1931         # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1932         # user password verified on the RODC
1933         my $testallowed_account = "testallowed account";
1934         $cmd = "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1935         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1936         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
1937         $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1938         $cmd .= " --server=$dcvars->{DC_SERVER}";
1939
1940         unless (system($cmd) == 0) {
1941                 warn("RODC join failed\n$cmd");
1942                 return undef;
1943         }
1944
1945         # we overwrite the kdc after the RODC join
1946         # so that use the RODC as kdc and test
1947         # the proxy code
1948         $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1949         $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1950         Samba::mk_krb5_conf($ctx);
1951         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1952
1953         $ret->{RODC_DC_SERVER} = $ret->{SERVER};
1954         $ret->{RODC_DC_SERVER_IP} = $ret->{SERVER_IP};
1955         $ret->{RODC_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1956         $ret->{RODC_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1957
1958         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1959         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1960         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1961         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1962         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1963         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1964
1965         return $ret;
1966 }
1967
1968 sub read_config_h($)
1969 {
1970         my ($name) = @_;
1971         my %ret = {};
1972         open(LF, "<$name") or die("unable to read $name: $!");
1973         while (<LF>) {
1974                 chomp;
1975                 next if not (/^#define /);
1976                 if (/^#define (.*?)[ \t]+(.*?)$/) {
1977                         $ret{$1} = $2;
1978                         next;
1979                 }
1980                 if (/^#define (.*?)[ \t]+$/) {
1981                         $ret{$1} = 1;;
1982                         next;
1983                 }
1984         }
1985         close(LF);
1986         return \%ret;
1987 }
1988
1989 sub provision_ad_dc($$$$$$)
1990 {
1991         my ($self, $prefix, $hostname, $domain, $realm, $smbconf_args,
1992                 $extra_provision_options) = @_;
1993
1994         my $prefix_abs = abs_path($prefix);
1995
1996         my $bindir_abs = abs_path($self->{bindir});
1997         my $lockdir="$prefix_abs/lockdir";
1998         my $conffile="$prefix_abs/etc/smb.conf";
1999
2000         my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
2001         $require_mutexes = "" if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} eq "1");
2002
2003         my $config_h = {};
2004
2005         if (defined($ENV{CONFIG_H})) {
2006                 $config_h = read_config_h($ENV{CONFIG_H});
2007         }
2008
2009         my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
2010         $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
2011
2012         my $extra_smbconf_options = "
2013         xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
2014
2015         dbwrap_tdb_mutexes:* = yes
2016         ${require_mutexes}
2017
2018         ${password_hash_gpg_key_ids}
2019
2020         kernel oplocks = no
2021         kernel change notify = no
2022         smb2 leases = no
2023
2024         logging = file
2025         printing = bsd
2026         printcap name = /dev/null
2027
2028         max protocol = SMB3
2029         read only = no
2030
2031         smbd:sharedelay = 100000
2032         smbd:writetimeupdatedelay = 500000
2033         create mask = 755
2034         dos filemode = yes
2035         check parent directory delete on close = yes
2036
2037         dcerpc endpoint servers = -winreg -srvsvc
2038
2039         printcap name = /dev/null
2040
2041         addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
2042         deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
2043
2044         printing = vlp
2045         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
2046         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
2047         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
2048         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
2049         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
2050         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
2051         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
2052         lpq cache time = 0
2053         print notify backchannel = yes
2054
2055         server schannel = auto
2056         auth event notification = true
2057         dsdb event notification = true
2058         dsdb password event notification = true
2059         dsdb group change notification = true
2060         $smbconf_args
2061 ";
2062
2063         my $extra_smbconf_shares = "
2064
2065 [tmpenc]
2066         copy = tmp
2067         smb encrypt = required
2068
2069 [tmpcase]
2070         copy = tmp
2071         case sensitive = yes
2072
2073 [tmpguest]
2074         copy = tmp
2075         guest ok = yes
2076
2077 [hideunread]
2078         copy = tmp
2079         hide unreadable = yes
2080
2081 [durable]
2082         copy = tmp
2083         kernel share modes = no
2084         kernel oplocks = no
2085         posix locking = no
2086
2087 [print\$]
2088         copy = tmp
2089
2090 [print1]
2091         copy = tmp
2092         printable = yes
2093
2094 [print2]
2095         copy = print1
2096 [print3]
2097         copy = print1
2098 [lp]
2099         copy = print1
2100 ";
2101
2102         push (@{$extra_provision_options}, "--backend-store=mdb");
2103         print "PROVISIONING AD DC...\n";
2104         my $ret = $self->provision($prefix,
2105                                    "domain controller",
2106                                    $hostname,
2107                                    $domain,
2108                                    $realm,
2109                                    "2008",
2110                                    "locDCpass1",
2111                                    undef,
2112                                    undef,
2113                                    $extra_smbconf_options,
2114                                    $extra_smbconf_shares,
2115                                    $extra_provision_options);
2116         unless (defined $ret) {
2117                 return undef;
2118         }
2119
2120         unless($self->add_wins_config("$prefix/private")) {
2121                 warn("Unable to add wins configuration");
2122                 return undef;
2123         }
2124
2125         $ret->{DC_SERVER} = $ret->{SERVER};
2126         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
2127         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
2128         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
2129         $ret->{DC_USERNAME} = $ret->{USERNAME};
2130         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
2131
2132         return $ret;
2133 }
2134
2135 sub provision_chgdcpass($$)
2136 {
2137         my ($self, $prefix) = @_;
2138
2139         print "PROVISIONING CHGDCPASS...\n";
2140         # This environment disallows the use of this password
2141         # (and also removes the default AD complexity checks)
2142         my $unacceptable_password = "widk3Dsle32jxdBdskldsk55klASKQ";
2143         my $extra_smb_conf = "
2144         check password script = $self->{srcdir}/selftest/checkpassword_arg1.sh ${unacceptable_password}
2145         allow dcerpc auth level connect:lsarpc = yes
2146         dcesrv:max auth states = 8
2147 ";
2148         my $extra_provision_options = ["--use-ntvfs"];
2149         push (@{$extra_provision_options}, "--dns-backend=BIND9_DLZ");
2150         my $ret = $self->provision($prefix,
2151                                    "domain controller",
2152                                    "chgdcpass",
2153                                    "CHDCDOMAIN",
2154                                    "chgdcpassword.samba.example.com",
2155                                    "2008",
2156                                    "chgDCpass1",
2157                                    undef,
2158                                    undef,
2159                                    $extra_smb_conf,
2160                                    "",
2161                                    $extra_provision_options);
2162         unless (defined $ret) {
2163                 return undef;
2164         }
2165
2166         unless($self->add_wins_config("$prefix/private")) {
2167                 warn("Unable to add wins configuration");
2168                 return undef;
2169         }
2170
2171         # Remove secrets.tdb from this environment to test that we
2172         # still start up on systems without the new matching
2173         # secrets.tdb records.
2174         unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
2175                 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
2176                 return undef;
2177         }
2178
2179         $ret->{DC_SERVER} = $ret->{SERVER};
2180         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
2181         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
2182         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
2183         $ret->{DC_USERNAME} = $ret->{USERNAME};
2184         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
2185         $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
2186
2187         return $ret;
2188 }
2189
2190 sub teardown_env_terminate($$)
2191 {
2192         my ($self, $envvars) = @_;
2193         my $pid;
2194
2195         # This should cause samba to terminate gracefully
2196         my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
2197         my $cmd = "";
2198         $cmd .= "$smbcontrol samba shutdown $envvars->{CONFIGURATION}";
2199         my $ret = system($cmd);
2200         if ($ret != 0) {
2201                 warn "'$cmd' failed with '$ret'\n";
2202         }
2203
2204         # This should cause samba to terminate gracefully
2205         close($envvars->{STDIN_PIPE});
2206
2207         $pid = $envvars->{SAMBA_PID};
2208         my $count = 0;
2209         my $childpid;
2210
2211         # This should give it time to write out the gcov data
2212         until ($count > 15) {
2213             if (Samba::cleanup_child($pid, "samba") != 0) {
2214                 return;
2215             }
2216             sleep(1);
2217             $count++;
2218         }
2219
2220         # After 15 Seconds, work out why this thing is still alive
2221         warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
2222         system("$self->{srcdir}/selftest/gdb_backtrace $pid");
2223
2224         until ($count > 30) {
2225             if (Samba::cleanup_child($pid, "samba") != 0) {
2226                 return;
2227             }
2228             sleep(1);
2229             $count++;
2230         }
2231
2232         if (kill(0, $pid)) {
2233             warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
2234             kill "TERM", $pid;
2235         }
2236
2237         until ($count > 40) {
2238             if (Samba::cleanup_child($pid, "samba") != 0) {
2239                 return;
2240             }
2241             sleep(1);
2242             $count++;
2243         }
2244         # If it is still around, kill it
2245         if (kill(0, $pid)) {
2246             warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
2247             kill 9, $pid;
2248         }
2249         return;
2250 }
2251
2252 sub teardown_env($$)
2253 {
2254         my ($self, $envvars) = @_;
2255         teardown_env_terminate($self, $envvars);
2256
2257         $self->slapd_stop($envvars) if ($self->{ldap});
2258
2259         print $self->getlog_env($envvars);
2260
2261         return;
2262 }
2263
2264 sub getlog_env($$)
2265 {
2266         my ($self, $envvars) = @_;
2267         my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
2268         my $out = $title;
2269
2270         open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
2271
2272         seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
2273         while (<LOG>) {
2274                 $out .= $_;
2275         }
2276         $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
2277         close(LOG);
2278
2279         return "" if $out eq $title;
2280
2281         return $out;
2282 }
2283
2284 sub check_env($$)
2285 {
2286         my ($self, $envvars) = @_;
2287         my $samba_pid = $envvars->{SAMBA_PID};
2288
2289         if (not defined($samba_pid)) {
2290             return 0;
2291         } elsif ($samba_pid > 0) {
2292             my $childpid = Samba::cleanup_child($samba_pid, "samba");
2293
2294             if ($childpid == 0) {
2295                 return 1;
2296             }
2297             return 0;
2298         } else {
2299             return 1;
2300         }
2301 }
2302
2303 # Declare the environments Samba4 makes available.
2304 # To be set up, they will be called as
2305 #   samba4->setup_$envname($self, $path, $dep_1_vars, $dep_2_vars, ...)
2306 # The interdependencies between the testenvs are declared below. Some testenvs
2307 # are dependent on another testenv running first, e.g. vampire_dc is dependent
2308 # on ad_dc_ntvfs because vampire_dc joins ad_dc_ntvfs's domain. All DCs are
2309 # dependent on dns_hub, which handles resolving DNS queries for the realm.
2310 %Samba4::ENV_DEPS = (
2311         # name               => [dep_1, dep_2, ...],
2312         dns_hub              => [],
2313         ad_dc_ntvfs          => ["dns_hub"],
2314         ad_dc                => ["dns_hub"],
2315         ad_dc_no_nss         => ["dns_hub"],
2316         ad_dc_no_ntlm        => ["dns_hub"],
2317
2318         fl2008r2dc           => ["ad_dc"],
2319         fl2003dc             => ["ad_dc"],
2320         fl2000dc             => ["dns_hub"],
2321
2322         vampire_2000_dc      => ["fl2000dc"],
2323         vampire_dc           => ["ad_dc_ntvfs"],
2324         promoted_dc          => ["ad_dc_ntvfs"],
2325         subdom_dc            => ["ad_dc_ntvfs"],
2326
2327         rodc                 => ["ad_dc_ntvfs"],
2328         rpc_proxy            => ["ad_dc_ntvfs"],
2329         chgdcpass            => ["dns_hub"],
2330
2331         s4member_dflt_domain => ["ad_dc_ntvfs"],
2332         s4member             => ["ad_dc_ntvfs"],
2333
2334         # envs that test the server process model
2335         proclimitdc          => ["dns_hub"],
2336         preforkrestartdc     => ["dns_hub"],
2337
2338         # backup/restore testenvs
2339         backupfromdc         => ["dns_hub"],
2340         customdc             => ["dns_hub"],
2341         restoredc            => ["backupfromdc"],
2342         renamedc             => ["backupfromdc"],
2343         offlinebackupdc      => ["backupfromdc"],
2344         labdc                => ["backupfromdc"],
2345
2346         none                 => [],
2347 );
2348
2349 sub setup_s4member
2350 {
2351         my ($self, $path, $dc_vars) = @_;
2352
2353         my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2354
2355         if (defined $env) {
2356                 if (not defined($self->check_or_start($env, "standard"))) {
2357                         return undef;
2358                 }
2359         }
2360
2361         return $env;
2362 }
2363
2364 sub setup_s4member_dflt_domain
2365 {
2366         my ($self, $path, $dc_vars) = @_;
2367
2368         my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2369                                             "winbind use default domain = yes");
2370
2371         if (defined $env) {
2372                 if (not defined($self->check_or_start($env, "standard"))) {
2373                         return undef;
2374                 }
2375         }
2376
2377         return $env;
2378 }
2379
2380 sub setup_rpc_proxy
2381 {
2382         my ($self, $path, $dc_vars) = @_;
2383
2384         my $env = $self->provision_rpc_proxy($path, $dc_vars);
2385
2386         if (defined $env) {
2387                 if (not defined($self->check_or_start($env, "standard"))) {
2388                         return undef;
2389                 }
2390         }
2391         return $env;
2392 }
2393
2394 sub setup_ad_dc_ntvfs
2395 {
2396         my ($self, $path) = @_;
2397
2398         my $env = $self->provision_ad_dc_ntvfs($path);
2399         if (defined $env) {
2400                 if (not defined($self->check_or_start($env, "standard"))) {
2401                     warn("Failed to start ad_dc_ntvfs");
2402                         return undef;
2403                 }
2404         }
2405         return $env;
2406 }
2407
2408 sub setup_chgdcpass
2409 {
2410         my ($self, $path) = @_;
2411
2412         my $env = $self->provision_chgdcpass($path);
2413         if (defined $env) {
2414                 if (not defined($self->check_or_start($env, "standard"))) {
2415                         return undef;
2416                 }
2417         }
2418         return $env;
2419 }
2420
2421 sub setup_fl2000dc
2422 {
2423         my ($self, $path) = @_;
2424
2425         my $env = $self->provision_fl2000dc($path);
2426         if (defined $env) {
2427                 if (not defined($self->check_or_start($env, "standard"))) {
2428                         return undef;
2429                 }
2430         }
2431
2432         return $env;
2433 }
2434
2435 sub setup_fl2003dc
2436 {
2437         my ($self, $path, $dc_vars) = @_;
2438
2439         my $env = $self->provision_fl2003dc($path);
2440
2441         if (defined $env) {
2442                 if (not defined($self->check_or_start($env, "standard"))) {
2443                         return undef;
2444                 }
2445
2446                 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2447         }
2448         return $env;
2449 }
2450
2451 sub setup_fl2008r2dc
2452 {
2453         my ($self, $path, $dc_vars) = @_;
2454
2455         my $env = $self->provision_fl2008r2dc($path);
2456
2457         if (defined $env) {
2458                 if (not defined($self->check_or_start($env, "standard"))) {
2459                         return undef;
2460                 }
2461
2462                 my $upn_array = ["$env->{REALM}.upn"];
2463                 my $spn_array = ["$env->{REALM}.spn"];
2464
2465                 $self->setup_namespaces($env, $upn_array, $spn_array);
2466
2467                 $env = $self->setup_trust($env, $dc_vars, "forest", "");
2468         }
2469
2470         return $env;
2471 }
2472
2473 sub setup_vampire_dc
2474 {
2475         return setup_generic_vampire_dc(@_, "2008");
2476 }
2477
2478 sub setup_vampire_2000_dc
2479 {
2480         return setup_generic_vampire_dc(@_, "2000");
2481 }
2482
2483 sub setup_generic_vampire_dc
2484 {
2485         my ($self, $path, $dc_vars, $fl) = @_;
2486
2487         my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2488
2489         if (defined $env) {
2490                 if (not defined($self->check_or_start($env, "single"))) {
2491                         return undef;
2492                 }
2493
2494                 # force replicated DC to update repsTo/repsFrom
2495                 # for vampired partitions
2496                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2497
2498                 # as 'vampired' dc may add data in its local replica
2499                 # we need to synchronize data between DCs
2500                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2501                 my $cmd = $self->get_cmd_env_vars($env);
2502                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2503                 $cmd .= " $dc_vars->{CONFIGURATION}";
2504                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2505                 # replicate Configuration NC
2506                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2507                 unless(system($cmd_repl) == 0) {
2508                         warn("Failed to replicate\n$cmd_repl");
2509                         return undef;
2510                 }
2511                 # replicate Default NC
2512                 $cmd_repl = "$cmd \"$base_dn\"";
2513                 unless(system($cmd_repl) == 0) {
2514                         warn("Failed to replicate\n$cmd_repl");
2515                         return undef;
2516                 }
2517
2518                 # Pull in a full set of changes from the main DC
2519                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2520                 $cmd = $self->get_cmd_env_vars($env);
2521                 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2522                 $cmd .= " $dc_vars->{CONFIGURATION}";
2523                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2524                 # replicate Configuration NC
2525                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2526                 unless(system($cmd_repl) == 0) {
2527                         warn("Failed to replicate\n$cmd_repl");
2528                         return undef;
2529                 }
2530                 # replicate Default NC
2531                 $cmd_repl = "$cmd \"$base_dn\"";
2532                 unless(system($cmd_repl) == 0) {
2533                         warn("Failed to replicate\n$cmd_repl");
2534                         return undef;
2535                 }
2536         }
2537
2538         return $env;
2539 }
2540
2541 sub setup_promoted_dc
2542 {
2543         my ($self, $path, $dc_vars) = @_;
2544
2545         my $env = $self->provision_promoted_dc($path, $dc_vars);
2546
2547         if (defined $env) {
2548                 if (not defined($self->check_or_start($env, "single"))) {
2549                         return undef;
2550                 }
2551
2552                 # force source and replicated DC to update repsTo/repsFrom
2553                 # for vampired partitions
2554                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2555                 my $cmd = "NSS_WRAPPER_HOSTS='$env->{NSS_WRAPPER_HOSTS}' ";
2556                 # as 'vampired' dc may add data in its local replica
2557                 # we need to synchronize data between DCs
2558                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2559                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2560                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2561                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2562                 $cmd .= "RESOLV_CONF=\"$env->{RESOLV_CONF}\" ";
2563                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2564                 $cmd .= " $dc_vars->{CONFIGURATION}";
2565                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2566                 # replicate Configuration NC
2567                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2568                 unless(system($cmd_repl) == 0) {
2569                         warn("Failed to replicate\n$cmd_repl");
2570                         return undef;
2571                 }
2572                 # replicate Default NC
2573                 $cmd_repl = "$cmd \"$base_dn\"";
2574                 unless(system($cmd_repl) == 0) {
2575                         warn("Failed to replicate\n$cmd_repl");
2576                         return undef;
2577                 }
2578         }
2579
2580         return $env;
2581 }
2582
2583 sub setup_subdom_dc
2584 {
2585         my ($self, $path, $dc_vars) = @_;
2586
2587         my $env = $self->provision_subdom_dc($path, $dc_vars);
2588
2589         if (defined $env) {
2590                 if (not defined($self->check_or_start($env, "single"))) {
2591                         return undef;
2592                 }
2593
2594                 # force replicated DC to update repsTo/repsFrom
2595                 # for primary domain partitions
2596                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2597                 my $cmd = "NSS_WRAPPER_HOSTS='$env->{NSS_WRAPPER_HOSTS}' ";
2598                 # as 'subdomain' dc may add data in its local replica
2599                 # we need to synchronize data between DCs
2600                 my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
2601                 my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2602                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2603                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2604                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2605                 $cmd .= "RESOLV_CONF=\"$env->{RESOLV_CONF}\" ";
2606                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
2607                 $cmd .= " $dc_vars->{CONFIGURATION}";
2608                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
2609                 # replicate Configuration NC
2610                 my $cmd_repl = "$cmd \"$config_dn\"";
2611                 unless(system($cmd_repl) == 0) {
2612                         warn("Failed to replicate\n$cmd_repl");
2613                         return undef;
2614                 }
2615                 # replicate Default NC
2616                 $cmd_repl = "$cmd \"$base_dn\"";
2617                 unless(system($cmd_repl) == 0) {
2618                         warn("Failed to replicate\n$cmd_repl");
2619                         return undef;
2620                 }
2621         }
2622
2623         return $env;
2624 }
2625
2626 sub setup_rodc
2627 {
2628         my ($self, $path, $dc_vars) = @_;
2629
2630         my $env = $self->provision_rodc($path, $dc_vars);
2631
2632         unless ($env) {
2633                 return undef;
2634         }
2635
2636         if (not defined($self->check_or_start($env, "standard"))) {
2637             return undef;
2638         }
2639
2640         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2641         my $cmd = "";
2642
2643         my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2644         $cmd .= "NSS_WRAPPER_HOSTS='$env->{NSS_WRAPPER_HOSTS}' ";
2645         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2646         $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2647         $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2648         $cmd .= "RESOLV_CONF=\"$env->{RESOLV_CONF}\" ";
2649         $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2650         $cmd .= " $dc_vars->{CONFIGURATION}";
2651         $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2652         # replicate Configuration NC
2653         my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2654         unless(system($cmd_repl) == 0) {
2655             warn("Failed to replicate\n$cmd_repl");
2656             return undef;
2657         }
2658         # replicate Default NC
2659         $cmd_repl = "$cmd \"$base_dn\"";
2660         unless(system($cmd_repl) == 0) {
2661             warn("Failed to replicate\n$cmd_repl");
2662             return undef;
2663         }
2664
2665         return $env;
2666 }
2667
2668 sub setup_ad_dc
2669 {
2670         my ($self, $path) = @_;
2671
2672         # If we didn't build with ADS, pretend this env was never available
2673         if (not $self->{target3}->have_ads()) {
2674                return "UNKNOWN";
2675         }
2676
2677         my $env = $self->provision_ad_dc($path, "addc", "ADDOMAIN",
2678                                          "addom.samba.example.com", "", undef);
2679         unless ($env) {
2680                 return undef;
2681         }
2682
2683         if (not defined($self->check_or_start($env, "prefork"))) {
2684             return undef;
2685         }
2686
2687         my $upn_array = ["$env->{REALM}.upn"];
2688         my $spn_array = ["$env->{REALM}.spn"];
2689
2690         $self->setup_namespaces($env, $upn_array, $spn_array);
2691
2692         return $env;
2693 }
2694
2695 sub setup_ad_dc_no_nss
2696 {
2697         my ($self, $path) = @_;
2698
2699         # If we didn't build with ADS, pretend this env was never available
2700         if (not $self->{target3}->have_ads()) {
2701                return "UNKNOWN";
2702         }
2703
2704         my $env = $self->provision_ad_dc($path, "addc_no_nss", "ADNONSSDOMAIN",
2705                                          "adnonssdom.samba.example.com", "", undef);
2706         unless ($env) {
2707                 return undef;
2708         }
2709
2710         $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2711         $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2712
2713         if (not defined($self->check_or_start($env, "single"))) {
2714             return undef;
2715         }
2716
2717         my $upn_array = ["$env->{REALM}.upn"];
2718         my $spn_array = ["$env->{REALM}.spn"];
2719
2720         $self->setup_namespaces($env, $upn_array, $spn_array);
2721
2722         return $env;
2723 }
2724
2725 sub setup_ad_dc_no_ntlm
2726 {
2727         my ($self, $path) = @_;
2728
2729         # If we didn't build with ADS, pretend this env was never available
2730         if (not $self->{target3}->have_ads()) {
2731                return "UNKNOWN";
2732         }
2733
2734         my $env = $self->provision_ad_dc($path, "addc_no_ntlm", "ADNONTLMDOMAIN",
2735                                          "adnontlmdom.samba.example.com",
2736                                          "ntlm auth = disabled", undef);
2737         unless ($env) {
2738                 return undef;
2739         }
2740
2741         if (not defined($self->check_or_start($env, "prefork"))) {
2742             return undef;
2743         }
2744
2745         my $upn_array = ["$env->{REALM}.upn"];
2746         my $spn_array = ["$env->{REALM}.spn"];
2747
2748         $self->setup_namespaces($env, $upn_array, $spn_array);
2749
2750         return $env;
2751 }
2752
2753 #
2754 # AD DC test environment used solely to test pre-fork process restarts.
2755 # As processes get killed off and restarted it should not be used for other
2756 sub setup_preforkrestartdc
2757 {
2758         my ($self, $path) = @_;
2759
2760         # If we didn't build with ADS, pretend this env was never available
2761         if (not $self->{target3}->have_ads()) {
2762                return "UNKNOWN";
2763         }
2764
2765         # note DC name must be <= 15 chars so we use 'prockill' instead of
2766         # 'preforkrestart'
2767         my $env = $self->provision_ad_dc(
2768                 $path,
2769                 "prockilldc",
2770                 "PROCKILLDOMAIN",
2771                 "prockilldom.samba.example.com",
2772                 "prefork backoff increment = 5\nprefork maximum backoff=10");
2773         unless ($env) {
2774                 return undef;
2775         }
2776
2777         $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2778         $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2779
2780         if (not defined($self->check_or_start($env, "prefork"))) {
2781             return undef;
2782         }
2783
2784         my $upn_array = ["$env->{REALM}.upn"];
2785         my $spn_array = ["$env->{REALM}.spn"];
2786
2787         $self->setup_namespaces($env, $upn_array, $spn_array);
2788
2789         return $env;
2790 }
2791
2792 #
2793 # ad_dc test environment used solely to test standard process model connection
2794 # process limits. As the limit is set artificially low it should not be used
2795 # for other tests.
2796 sub setup_proclimitdc
2797 {
2798         my ($self, $path) = @_;
2799
2800         # If we didn't build with ADS, pretend this env was never available
2801         if (not $self->{target3}->have_ads()) {
2802                return "UNKNOWN";
2803         }
2804
2805         my $env = $self->provision_ad_dc(
2806                 $path,
2807                 "proclimitdc",
2808                 "PROCLIMITDOM",
2809                 "proclimit.samba.example.com",
2810                 "max smbd processes = 20");
2811         unless ($env) {
2812                 return undef;
2813         }
2814
2815         $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2816         $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2817
2818         if (not defined($self->check_or_start($env, "standard"))) {
2819             return undef;
2820         }
2821
2822         my $upn_array = ["$env->{REALM}.upn"];
2823         my $spn_array = ["$env->{REALM}.spn"];
2824
2825         $self->setup_namespaces($env, $upn_array, $spn_array);
2826
2827         return $env;
2828 }
2829
2830 # Sets up a DC that's solely used to do a domain backup from. We then use the
2831 # backupfrom-DC to create the restore-DC - this proves that the backup/restore
2832 # process will create a Samba DC that will actually start up.
2833 # We don't use the backup-DC for anything else because its domain will conflict
2834 # with the restore DC.
2835 sub setup_backupfromdc
2836 {
2837         my ($self, $path) = @_;
2838
2839         # If we didn't build with ADS, pretend this env was never available
2840         if (not $self->{target3}->have_ads()) {
2841                return "UNKNOWN";
2842         }
2843
2844         my $provision_args = ["--site=Backup-Site"];
2845
2846         my $env = $self->provision_ad_dc($path, "backupfromdc", "BACKUPDOMAIN",
2847                                          "backupdom.samba.example.com",
2848                                          "samba kcc command = /bin/true",
2849                                          $provision_args);
2850         unless ($env) {
2851                 return undef;
2852         }
2853
2854         if (not defined($self->check_or_start($env))) {
2855             return undef;
2856         }
2857
2858         my $upn_array = ["$env->{REALM}.upn"];
2859         my $spn_array = ["$env->{REALM}.spn"];
2860
2861         $self->setup_namespaces($env, $upn_array, $spn_array);
2862
2863         return $env;
2864 }
2865
2866 # returns the server/user-auth params needed to run an online backup cmd
2867 sub get_backup_server_args
2868 {
2869         # dcvars contains the env info for the backup DC testenv
2870         my ($self, $dcvars) = @_;
2871         my $server = $dcvars->{DC_SERVER_IP};
2872         my $server_args = "--server=$server ";
2873         $server_args .= "-U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
2874         $server_args .= " $dcvars->{CONFIGURATION}";
2875
2876         return $server_args;
2877 }
2878
2879 # Creates a backup of a running testenv DC
2880 sub create_backup
2881 {
2882         # note: dcvars contains the env info for the backup DC testenv
2883         my ($self, $env, $dcvars, $backupdir, $backup_cmd) = @_;
2884
2885         # get all the env variables we pass in with the samba-tool command
2886         my $cmd_env = "NSS_WRAPPER_HOSTS='$env->{NSS_WRAPPER_HOSTS}' ";
2887         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2888         if (defined($env->{RESOLV_WRAPPER_CONF})) {
2889                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2890         } else {
2891                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2892         }
2893         # Note: use the backupfrom-DC's krb5.conf to do the backup
2894         $cmd_env .= " KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
2895         $cmd_env .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2896
2897         # use samba-tool to create a backup from the 'backupfromdc' DC
2898         my $cmd = "";
2899         my $samba_tool = Samba::bindir_path($self, "samba-tool");
2900
2901         $cmd .= "$cmd_env $samba_tool domain backup $backup_cmd";
2902         $cmd .= " --targetdir=$backupdir";
2903
2904         print "Executing: $cmd\n";
2905         unless(system($cmd) == 0) {
2906                 warn("Failed to create backup using: \n$cmd");
2907                 return undef;
2908         }
2909
2910         # get the name of the backup file created
2911         opendir(DIR, $backupdir);
2912         my @files = grep(/\.tar/, readdir(DIR));
2913         closedir(DIR);
2914
2915         if(scalar @files != 1) {
2916                 warn("Backup file not found in directory $backupdir\n");
2917                 return undef;
2918         }
2919         my $backup_file = "$backupdir/$files[0]";
2920         print "Using backup file $backup_file...\n";
2921
2922         return $backup_file;
2923 }
2924
2925 # Restores a backup-file to populate a testenv for a new DC
2926 sub restore_backup_file
2927 {
2928         my ($self, $backup_file, $restore_opts, $restoredir, $smbconf) = @_;
2929
2930         # pass the restore command the testenv's smb.conf that we've already
2931         # generated. But move it to a temp-dir first, so that the restore doesn't
2932         # overwrite it
2933         my $tmpdir = File::Temp->newdir();
2934         my $tmpconf = "$tmpdir/smb.conf";
2935         my $cmd = "cp $smbconf $tmpconf";
2936         unless(system($cmd) == 0) {
2937                 warn("Failed to backup smb.conf using: \n$cmd");
2938                 return -1;
2939         }
2940
2941         my $samba_tool = Samba::bindir_path($self, "samba-tool");
2942         $cmd = "$samba_tool domain backup restore --backup-file=$backup_file";
2943         $cmd .= " --targetdir=$restoredir $restore_opts --configfile=$tmpconf";
2944
2945         print "Executing: $cmd\n";
2946         unless(system($cmd) == 0) {
2947                 warn("Failed to restore backup using: \n$cmd");
2948                 return -1;
2949         }
2950
2951         print "Restore complete\n";
2952         return 0
2953 }
2954
2955 # sets up the initial directory and returns the new testenv's env info
2956 # (without actually doing a 'domain join')
2957 sub prepare_dc_testenv
2958 {
2959         my ($self, $prefix, $dcname, $domain, $realm,
2960                 $password, $conf_options) = @_;
2961
2962         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
2963                                                $dcname,
2964                                                $domain,
2965                                                $realm,
2966                                                undef,
2967                                                "2008",
2968                                                $password,
2969                                                undef,
2970                                                undef);
2971
2972         # the restore uses a slightly different state-dir location to other testenvs
2973         $ctx->{statedir} = "$ctx->{prefix_abs}/state";
2974         push(@{$ctx->{directories}}, "$ctx->{statedir}");
2975
2976         # add support for sysvol/netlogon/tmp shares
2977         $ctx->{share} = "$ctx->{prefix_abs}/share";
2978         push(@{$ctx->{directories}}, "$ctx->{share}");
2979         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
2980
2981         $ctx->{smb_conf_extra_options} = "
2982         $conf_options
2983         max xmit = 32K
2984         server max protocol = SMB2
2985         samba kcc command = /bin/true
2986         xattr_tdb:file = $ctx->{statedir}/xattr.tdb
2987
2988 [sysvol]
2989         path = $ctx->{statedir}/sysvol
2990         read only = no
2991
2992 [netlogon]
2993         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
2994         read only = no
2995
2996 [tmp]
2997         path = $ctx->{share}
2998         read only = no
2999         posix:sharedelay = 10000
3000         posix:oplocktimeout = 3
3001         posix:writetimeupdatedelay = 50000
3002
3003 [test1]
3004         path = $ctx->{share}/test1
3005         read only = no
3006         posix:sharedelay = 100000
3007         posix:oplocktimeout = 3
3008         posix:writetimeupdatedelay = 500000
3009 ";
3010
3011         my $env = $self->provision_raw_step1($ctx);
3012
3013         $env->{DC_SERVER} = $env->{SERVER};
3014         $env->{DC_SERVER_IP} = $env->{SERVER_IP};
3015         $env->{DC_SERVER_IPV6} = $env->{SERVER_IPV6};
3016         $env->{DC_NETBIOSNAME} = $env->{NETBIOSNAME};
3017         $env->{DC_USERNAME} = $env->{USERNAME};
3018         $env->{DC_PASSWORD} = $env->{PASSWORD};
3019
3020     return ($env, $ctx);
3021 }
3022
3023
3024 # Set up a DC testenv solely by using the samba-tool domain backup/restore
3025 # commands. This proves that we can backup an online DC ('backupfromdc') and
3026 # use the backup file to create a valid, working samba DC.
3027 sub setup_restoredc
3028 {
3029         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3030         my ($self, $prefix, $dcvars) = @_;
3031         print "Preparing RESTORE DC...\n";
3032
3033         # we arbitrarily designate the restored DC as having SMBv1 disabled
3034         my $extra_conf = "
3035         server min protocol = SMB2
3036         client min protocol = SMB2
3037         prefork children = 1";
3038
3039         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "restoredc",
3040                                                     $dcvars->{DOMAIN},
3041                                                     $dcvars->{REALM},
3042                                                     $dcvars->{PASSWORD},
3043                                                     $extra_conf);
3044
3045         # create a backup of the 'backupfromdc'
3046         my $backupdir = File::Temp->newdir();
3047         my $server_args = $self->get_backup_server_args($dcvars);
3048         my $backup_args = "online $server_args";
3049         my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3050                                                $backup_args);
3051         unless($backup_file) {
3052                 return undef;
3053         }
3054
3055         # restore the backup file to populate the restore-DC testenv
3056         my $restore_dir = abs_path($prefix);
3057         my $ret = $self->restore_backup_file($backup_file,
3058                                              "--newservername=$env->{SERVER}",
3059                                              $restore_dir, $env->{SERVERCONFFILE});
3060         unless ($ret == 0) {
3061                 return undef;
3062         }
3063
3064         # start samba for the restored DC
3065         if (not defined($self->check_or_start($env))) {
3066             return undef;
3067         }
3068
3069         return $env;
3070 }
3071
3072 # Set up a DC testenv solely by using the 'samba-tool domain backup rename' and
3073 # restore commands. This proves that we can backup and rename an online DC
3074 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3075 sub setup_renamedc
3076 {
3077         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3078         my ($self, $prefix, $dcvars) = @_;
3079         print "Preparing RENAME DC...\n";
3080         my $extra_conf = "prefork children = 1";
3081
3082         my $realm = "renamedom.samba.example.com";
3083         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "renamedc",
3084                                                     "RENAMEDOMAIN", $realm,
3085                                                     $dcvars->{PASSWORD}, $extra_conf);
3086
3087         # create a backup of the 'backupfromdc' which renames the domain
3088         my $backupdir = File::Temp->newdir();
3089         my $server_args = $self->get_backup_server_args($dcvars);
3090         my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3091         $backup_args .= " --backend-store=tdb";
3092         my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3093                                                $backup_args);
3094         unless($backup_file) {
3095                 return undef;
3096         }
3097
3098         # restore the backup file to populate the rename-DC testenv
3099         my $restore_dir = abs_path($prefix);
3100         my $restore_opts =  "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3101         my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3102                                              $restore_dir, $env->{SERVERCONFFILE});
3103         unless ($ret == 0) {
3104                 return undef;
3105         }
3106
3107         # start samba for the restored DC
3108         if (not defined($self->check_or_start($env))) {
3109             return undef;
3110         }
3111
3112         my $upn_array = ["$env->{REALM}.upn"];
3113         my $spn_array = ["$env->{REALM}.spn"];
3114
3115         $self->setup_namespaces($env, $upn_array, $spn_array);
3116
3117         return $env;
3118 }
3119
3120 # Set up a DC testenv solely by using the 'samba-tool domain backup offline' and
3121 # restore commands. This proves that we do an offline backup of a local DC
3122 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3123 sub setup_offlinebackupdc
3124 {
3125         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3126         my ($self, $prefix, $dcvars) = @_;
3127         print "Preparing OFFLINE BACKUP DC...\n";
3128         my $extra_conf = "prefork children = 1";
3129
3130         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "offlinebackupdc",
3131                                                     $dcvars->{DOMAIN},
3132                                                     $dcvars->{REALM},
3133                                                     $dcvars->{PASSWORD}, $extra_conf);
3134
3135         # create an offline backup of the 'backupfromdc' target
3136         my $backupdir = File::Temp->newdir();
3137         my $cmd = "offline -s $dcvars->{SERVERCONFFILE}";
3138         my $backup_file = $self->create_backup($env, $dcvars,
3139                                                $backupdir, $cmd);
3140
3141         unless($backup_file) {
3142                 return undef;
3143         }
3144
3145         # restore the backup file to populate the rename-DC testenv
3146         my $restore_dir = abs_path($prefix);
3147         my $restore_opts =  "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3148         my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3149                                              $restore_dir, $env->{SERVERCONFFILE});
3150         unless ($ret == 0) {
3151                 return undef;
3152         }
3153
3154         # re-create the testenv's krb5.conf (the restore may have overwritten it)
3155         Samba::mk_krb5_conf($ctx);
3156
3157         # start samba for the restored DC
3158         if (not defined($self->check_or_start($env))) {
3159             return undef;
3160         }
3161
3162         return $env;
3163 }
3164
3165 # Set up a DC testenv solely by using the samba-tool 'domain backup rename' and
3166 # restore commands, using the --no-secrets option. This proves that we can
3167 # create a realistic lab environment from an online DC ('backupfromdc').
3168 sub setup_labdc
3169 {
3170         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3171         my ($self, $prefix, $dcvars) = @_;
3172         print "Preparing LAB-DOMAIN DC...\n";
3173         my $extra_conf = "prefork children = 1";
3174
3175         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "labdc",
3176                                                     "LABDOMAIN",
3177                                                     "labdom.samba.example.com",
3178                                                     $dcvars->{PASSWORD}, $extra_conf);
3179
3180         # create a backup of the 'backupfromdc' which renames the domain and uses
3181         # the --no-secrets option to scrub any sensitive info
3182         my $backupdir = File::Temp->newdir();
3183         my $server_args = $self->get_backup_server_args($dcvars);
3184         my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3185         $backup_args .= " --no-secrets --backend-store=mdb";
3186         my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3187                                                $backup_args);
3188         unless($backup_file) {
3189                 return undef;
3190         }
3191
3192         # restore the backup file to populate the lab-DC testenv
3193         my $restore_dir = abs_path($prefix);
3194         my $restore_opts =  "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3195         my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3196                                              $restore_dir, $env->{SERVERCONFFILE});
3197         unless ($ret == 0) {
3198                 return undef;
3199         }
3200
3201         # because we don't include any secrets in the backup, we need to reset the
3202         # admin user's password back to what the testenv expects
3203         my $samba_tool = Samba::bindir_path($self, "samba-tool");
3204         my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3205         $cmd .= "--newpassword=$env->{PASSWORD} -H $restore_dir/private/sam.ldb";
3206         $cmd .= " $env->{CONFIGURATION}";
3207
3208         unless(system($cmd) == 0) {
3209                 warn("Failed to reset admin's password: \n$cmd");
3210                 return undef;
3211         }
3212
3213         # start samba for the restored DC
3214         if (not defined($self->check_or_start($env))) {
3215             return undef;
3216         }
3217
3218         my $upn_array = ["$env->{REALM}.upn"];
3219         my $spn_array = ["$env->{REALM}.spn"];
3220
3221         $self->setup_namespaces($env, $upn_array, $spn_array);
3222
3223         return $env;
3224 }
3225
3226 # Inspects a backup *.tar.bz2 file and determines the realm/domain it contains
3227 sub get_backup_domain_realm
3228 {
3229         my ($self, $backup_file) = @_;
3230
3231         print "Determining REALM/DOMAIN values in backup...\n";
3232
3233         # The backup will have the correct domain/realm values in the smb.conf.
3234         # So we can work out the env variables the testenv should use based on
3235         # that. Let's start by extracting the smb.conf
3236         my $tar = Archive::Tar->new($backup_file);
3237         my $tmpdir = File::Temp->newdir();
3238         my $smbconf = "$tmpdir/smb.conf";
3239
3240         # note that the filepaths within the tar-file differ slightly for online
3241         # and offline backups
3242         if ($tar->contains_file("etc/smb.conf")) {
3243                 $tar->extract_file("etc/smb.conf", $smbconf);
3244         } elsif ($tar->contains_file("./etc/smb.conf")) {
3245                 $tar->extract_file("./etc/smb.conf", $smbconf);
3246         } else {
3247                 warn("Could not find smb.conf in $backup_file");
3248                 return undef, undef;
3249         }
3250
3251         # now use testparm to read the values we're interested in
3252         my $testparm = Samba::bindir_path($self, "testparm");
3253         my $domain = `$testparm $smbconf -sl --parameter-name=WORKGROUP`;
3254         my $realm = `$testparm $smbconf -sl --parameter-name=REALM`;
3255         chomp $realm;
3256         chomp $domain;
3257         print "Backup-file REALM is $realm, DOMAIN is $domain\n";
3258
3259         return ($domain, $realm);
3260 }
3261
3262 # This spins up a custom testenv that can be based on any backup-file you want.
3263 # This is just intended for manual testing (rather than automated test-cases)
3264 sub setup_customdc
3265 {
3266         my ($self, $prefix) = @_;
3267         print "Preparing CUSTOM RESTORE DC...\n";
3268         my $dc_name = "customdc";
3269         my $password = "locDCpass1";
3270         my $backup_file = $ENV{'BACKUP_FILE'};
3271
3272         # user must specify a backup file to restore via an ENV variable, i.e.
3273         # BACKUP_FILE=backup-blah.tar.bz2 SELFTEST_TESTENV=customdc make testenv
3274         if (not defined($backup_file)) {
3275                 warn("Please specify BACKUP_FILE");
3276                 return undef;
3277         }
3278
3279         # work out the correct domain/realm env values from the backup-file
3280         my ($domain, $realm) = $self->get_backup_domain_realm($backup_file);
3281
3282         # create a placeholder directory and smb.conf, as well as the env vars.
3283         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, $dc_name,
3284                                                     $domain, $realm, $password, "");
3285
3286         # restore the specified backup file to populate the testenv
3287         my $restore_dir = abs_path($prefix);
3288         my $ret = $self->restore_backup_file($backup_file,
3289                                              "--newservername=$env->{SERVER}",
3290                                              $restore_dir, $env->{SERVERCONFFILE});
3291         unless ($ret == 0) {
3292                 return undef;
3293         }
3294
3295         # Change the admin password to the testenv default, just in case it's
3296         # different, or in case this was a --no-secrets backup
3297         my $samba_tool = Samba::bindir_path($self, "samba-tool");
3298         my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3299         $cmd .= "--newpassword=$password -H $restore_dir/private/sam.ldb";
3300         $cmd .= " $env->{CONFIGURATION}";
3301
3302         unless(system($cmd) == 0) {
3303                 warn("Failed to reset admin's password: \n$cmd");
3304                 return undef;
3305         }
3306
3307         # re-create the testenv's krb5.conf (the restore may have overwritten it,
3308         # if the backup-file was an offline backup)
3309         Samba::mk_krb5_conf($ctx);
3310
3311         # start samba for the restored DC
3312         if (not defined($self->check_or_start($env))) {
3313             return undef;
3314         }
3315
3316         # if this was a backup-rename, then we may need to setup namespaces
3317         my $upn_array = ["$env->{REALM}.upn"];
3318         my $spn_array = ["$env->{REALM}.spn"];
3319
3320         $self->setup_namespaces($env, $upn_array, $spn_array);
3321
3322         return $env;
3323 }
3324
3325 sub setup_none
3326 {
3327         my ($self, $path) = @_;
3328
3329         my $ret = {
3330                 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
3331                 SAMBA_PID => -1,
3332         }
3333 }
3334
3335 1;