selftest/target/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 package Samba4;
   7
   8 use strict;
   9 use Cwd qw(abs_path);
  10 use FindBin qw($RealBin);
  11 use POSIX;
  12 use SocketWrapper;
  13 use target::Samba;
  14 use target::Samba3;
  15
  16 sub new($$$$$) {
  17         my ($classname, $bindir, $ldap, $srcdir, $server_maxtime) = @_;
  18
  19         my $self = {
  20                 vars => {},
  21                 ldap => $ldap,
  22                 bindir => $bindir,
  23                 srcdir => $srcdir,
  24                 server_maxtime => $server_maxtime,
  25                 target3 => new Samba3($bindir, $srcdir, $server_maxtime)
  26         };
  27         bless $self;
  28         return $self;
  29 }
  30
  31 sub scriptdir_path($$) {
  32         my ($self, $path) = @_;
  33         return "$self->{srcdir}/source4/scripting/$path";
  34 }
  35
  36 sub openldap_start($$$) {
  37 }
  38
  39 sub slapd_start($$)
  40 {
  41         my $count = 0;
  42         my ($self, $env_vars, $STDIN_READER) = @_;
  43         my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
  44
  45         my $uri = $env_vars->{LDAP_URI};
  46
  47         if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
  48             print "A SLAPD is still listening to $uri before we started the LDAP backend.  Aborting!";
  49             return 1;
  50         }
  51         # running slapd in the background means it stays in the same process group, so it can be
  52         # killed by timelimit
  53         my $pid = fork();
  54         if ($pid == 0) {
  55                 open STDOUT, ">$env_vars->{LDAPDIR}/logs";
  56                 open STDERR, '>&STDOUT';
  57                 close($env_vars->{STDIN_PIPE});
  58                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
  59
  60                 if ($self->{ldap} eq "fedora-ds") {
  61                         exec("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd", "-D", $env_vars->{FEDORA_DS_DIR}, "-d0", "-i", $env_vars->{FEDORA_DS_PIDFILE});
  62                 } elsif ($self->{ldap} eq "openldap") {
  63                         exec($ENV{OPENLDAP_SLAPD}, "-dnone", "-F", $env_vars->{SLAPD_CONF_D}, "-h", $uri);
  64                 }
  65                 die("Unable to start slapd: $!");
  66         }
  67         $env_vars->{SLAPD_PID} = $pid;
  68         sleep(1);
  69         while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
  70                 $count++;
  71                 if ($count > 40) {
  72                         $self->slapd_stop($env_vars);
  73                         return 0;
  74                 }
  75                 sleep(1);
  76         }
  77         return 1;
  78 }
  79
  80 sub slapd_stop($$)
  81 {
  82         my ($self, $envvars) = @_;
  83         kill 9, $envvars->{SLAPD_PID};
  84         return 1;
  85 }
  86
  87 sub check_or_start($$$)
  88 {
  89         my ($self, $env_vars, $process_model) = @_;
  90         my $STDIN_READER;
  91
  92         my $env_ok = $self->check_env($env_vars);
  93         if ($env_ok) {
  94                 return $env_vars->{SAMBA_PID};
  95         } elsif (defined($env_vars->{SAMBA_PID})) {
  96                 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
  97                 return undef;
  98         }
  99
 100         # use a pipe for stdin in the child processes. This allows
 101         # those processes to monitor the pipe for EOF to ensure they
 102         # exit when the test script exits
 103         pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
 104
 105         # Start slapd before samba, but with the fifo on stdin
 106         if (defined($self->{ldap})) {
 107                 unless($self->slapd_start($env_vars, $STDIN_READER)) {
 108                         warn("couldn't start slapd (main run)");
 109                         return undef;
 110                 }
 111         }
 112
 113         print "STARTING SAMBA...\n";
 114         my $pid = fork();
 115         if ($pid == 0) {
 116                 # we want out from samba to go to the log file, but also
 117                 # to the users terminal when running 'make test' on the command
 118                 # line. This puts it on stderr on the terminal
 119                 open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
 120                 open STDERR, '>&STDOUT';
 121
 122                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
 123
 124                 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
 125                 $ENV{KRB5CCNAME} = "$env_vars->{KRB5_CCACHE}.samba";
 126                 if (defined($ENV{MITKRB5})) {
 127                         $ENV{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
 128                 }
 129                 $ENV{SELFTEST_WINBINDD_SOCKET_DIR} = $env_vars->{SELFTEST_WINBINDD_SOCKET_DIR};
 130                 $ENV{NMBD_SOCKET_DIR} = $env_vars->{NMBD_SOCKET_DIR};
 131
 132                 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
 133                 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
 134                 $ENV{NSS_WRAPPER_HOSTS} = $env_vars->{NSS_WRAPPER_HOSTS};
 135                 $ENV{NSS_WRAPPER_HOSTNAME} = $env_vars->{NSS_WRAPPER_HOSTNAME};
 136                 $ENV{NSS_WRAPPER_MODULE_SO_PATH} = $env_vars->{NSS_WRAPPER_MODULE_SO_PATH};
 137                 $ENV{NSS_WRAPPER_MODULE_FN_PREFIX} = $env_vars->{NSS_WRAPPER_MODULE_FN_PREFIX};
 138
 139                 if (defined($env_vars->{RESOLV_WRAPPER_CONF})) {
 140                         $ENV{RESOLV_WRAPPER_CONF} = $env_vars->{RESOLV_WRAPPER_CONF};
 141                 } else {
 142                         $ENV{RESOLV_WRAPPER_HOSTS} = $env_vars->{RESOLV_WRAPPER_HOSTS};
 143                 }
 144
 145                 $ENV{UID_WRAPPER} = "1";
 146                 $ENV{UID_WRAPPER_ROOT} = "1";
 147
 148                 $ENV{MAKE_TEST_BINARY} = Samba::bindir_path($self, "samba");
 149                 my @preargs = ();
 150                 my @optargs = ();
 151                 if (defined($ENV{SAMBA_OPTIONS})) {
 152                         @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
 153                 }
 154                 if(defined($ENV{SAMBA_VALGRIND})) {
 155                         @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
 156                 }
 157
 158                 close($env_vars->{STDIN_PIPE});
 159                 open STDIN, ">&", $STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 160
 161                 exec(@preargs, Samba::bindir_path($self, "samba"), "-M", $process_model, "-i", "--no-process-group", "--maximum-runtime=$self->{server_maxtime}", $env_vars->{CONFIGURATION}, @optargs) or die("Unable to start samba: $!");
 162         }
 163         $env_vars->{SAMBA_PID} = $pid;
 164         print "DONE ($pid)\n";
 165
 166         close($STDIN_READER);
 167
 168         if ($self->wait_for_start($env_vars) != 0) {
 169             warn("Samba $pid failed to start up");
 170             return undef;
 171         }
 172
 173         return $pid;
 174 }
 175
 176 sub wait_for_start($$)
 177 {
 178         my ($self, $testenv_vars) = @_;
 179         my $count = 0;
 180         my $ret = 0;
 181
 182         if (not $self->check_env($testenv_vars)) {
 183             warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
 184             return -1;
 185         }
 186
 187         # This will return quickly when things are up, but be slow if we
 188         # need to wait for (eg) SSL init
 189         my $nmblookup =  Samba::bindir_path($self, "nmblookup4");
 190
 191         do {
 192                 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 193                 if ($ret != 0) {
 194                         sleep(1);
 195                 } else {
 196                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 197                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 198                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 199                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 200                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 201                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 202                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 203                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 204                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 205                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 206                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 207                 }
 208                 $count++;
 209         } while ($ret != 0 && $count < 20);
 210         if ($count == 20) {
 211                 warn("nbt not reachable after 20 retries\n");
 212                 teardown_env($self, $testenv_vars);
 213                 return 0;
 214         }
 215
 216         # Ensure we have the first RID Set before we start tests.  This makes the tests more reliable.
 217         if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
 218                 # Add hosts file for name lookups
 219                 $ENV{NSS_WRAPPER_HOSTS} = $testenv_vars->{NSS_WRAPPER_HOSTS};
 220                 if (defined($testenv_vars->{RESOLV_WRAPPER_CONF})) {
 221                         $ENV{RESOLV_WRAPPER_CONF} = $testenv_vars->{RESOLV_WRAPPER_CONF};
 222                 } else {
 223                         $ENV{RESOLV_WRAPPER_HOSTS} = $testenv_vars->{RESOLV_WRAPPER_HOSTS};
 224                 }
 225
 226                 print "waiting for working LDAP and a RID Set to be allocated\n";
 227                 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
 228                 my $count = 0;
 229                 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
 230
 231                 my $search_dn = $base_dn;
 232                 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
 233                         # TODO currently no check for actual rIDAllocationPool
 234                         $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
 235                 }
 236                 my $max_wait = 60;
 237                 my $cmd = "$ldbsearch $testenv_vars->{CONFIGURATION} -H ldap://$testenv_vars->{SERVER} -U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} -s base -b \"$search_dn\"";
 238                 while (system("$cmd >/dev/null") != 0) {
 239                         $count++;
 240                         if ($count > $max_wait) {
 241                                 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
 242                                 $ret = -1;
 243                                 last;
 244                         }
 245                         sleep(1);
 246                 }
 247         }
 248
 249         my $wbinfo =  Samba::bindir_path($self, "wbinfo");
 250
 251         $count = 0;
 252         do {
 253                 my $cmd = "NSS_WRAPPER_PASSWD=$testenv_vars->{NSS_WRAPPER_PASSWD} ";
 254                 $cmd .= "NSS_WRAPPER_GROUP=$testenv_vars->{NSS_WRAPPER_GROUP} ";
 255                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=$testenv_vars->{SELFTEST_WINBINDD_SOCKET_DIR} ";
 256                 $cmd .= "$wbinfo -p";
 257                 $ret = system($cmd);
 258
 259                 if ($ret != 0) {
 260                         sleep(1);
 261                 }
 262                 $count++;
 263         } while ($ret != 0 && $count < 20);
 264         if ($count == 20) {
 265                 warn("winbind not reachable after 20 retries\n");
 266                 teardown_env($self, $testenv_vars);
 267                 return 0;
 268         }
 269
 270         print $self->getlog_env($testenv_vars);
 271
 272         return $ret
 273 }
 274
 275 sub write_ldb_file($$$)
 276 {
 277         my ($self, $file, $ldif) = @_;
 278
 279         my $ldbadd =  Samba::bindir_path($self, "ldbadd");
 280         open(LDIF, "|$ldbadd -H $file >/dev/null");
 281         print LDIF $ldif;
 282         return(close(LDIF));
 283 }
 284
 285 sub add_wins_config($$)
 286 {
 287         my ($self, $privatedir) = @_;
 288
 289         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 290 dn: name=TORTURE_11,CN=PARTNERS
 291 objectClass: wreplPartner
 292 name: TORTURE_11
 293 address: 127.0.0.11
 294 pullInterval: 0
 295 pushChangeCount: 0
 296 type: 0x3
 297 ");
 298 }
 299
 300 sub mk_fedora_ds($$)
 301 {
 302         my ($self, $ctx) = @_;
 303
 304         #Make the subdirectory be as fedora DS would expect
 305         my $fedora_ds_dir = "$ctx->{ldapdir}/slapd-$ctx->{ldap_instance}";
 306
 307         my $pidfile = "$fedora_ds_dir/logs/slapd-$ctx->{ldap_instance}.pid";
 308
 309         return ($fedora_ds_dir, $pidfile);
 310 }
 311
 312 sub mk_openldap($$)
 313 {
 314         my ($self, $ctx) = @_;
 315
 316         my $slapd_conf_d = "$ctx->{ldapdir}/slapd.d";
 317         my $pidfile = "$ctx->{ldapdir}/slapd.pid";
 318
 319         return ($slapd_conf_d, $pidfile);
 320 }
 321
 322 sub setup_namespaces($$:$$)
 323 {
 324         my ($self, $localenv, $upn_array, $spn_array) = @_;
 325
 326         @{$upn_array} = [] unless defined($upn_array);
 327         my $upn_args = "";
 328         foreach my $upn (@{$upn_array}) {
 329                 $upn_args .= " --add-upn-suffix=$upn";
 330         }
 331
 332         @{$spn_array} = [] unless defined($spn_array);
 333         my $spn_args = "";
 334         foreach my $spn (@{$spn_array}) {
 335                 $spn_args .= " --add-spn-suffix=$spn";
 336         }
 337
 338         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 339
 340         my $cmd_env = "";
 341         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 342         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 343                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 344         } else {
 345                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 346         }
 347         $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 348         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 349
 350         my $cmd_config = " $localenv->{CONFIGURATION}";
 351
 352         my $namespaces = $cmd_env;
 353         $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
 354         $namespaces .= $cmd_config;
 355         unless (system($namespaces) == 0) {
 356                 warn("Failed to add namespaces \n$namespaces");
 357                 return;
 358         }
 359
 360         return;
 361 }
 362
 363 sub setup_trust($$$$$)
 364 {
 365         my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
 366
 367         $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
 368         $localenv->{TRUST_SERVER_IP} = $remoteenv->{SERVER_IP};
 369         $localenv->{TRUST_SERVER_IPV6} = $remoteenv->{SERVER_IPV6};
 370         $localenv->{TRUST_NETBIOSNAME} = $remoteenv->{NETBIOSNAME};
 371         $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
 372         $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
 373         $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
 374         $localenv->{TRUST_REALM} = $remoteenv->{REALM};
 375         $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID};
 376
 377         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 378         # setup the trust
 379         my $cmd_env = "";
 380         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 381         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 382                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 383         } else {
 384                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 385         }
 386         $cmd_env .= " KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 387         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 388
 389         my $cmd_config = " $localenv->{CONFIGURATION}";
 390         my $cmd_creds = $cmd_config;
 391         $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
 392
 393         my $create = $cmd_env;
 394         $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
 395         $create .= " $extra_args";
 396         $create .= $cmd_creds;
 397         unless (system($create) == 0) {
 398                 warn("Failed to create trust \n$create");
 399                 return undef;
 400         }
 401
 402         my $groupname = "g_$localenv->{TRUST_DOMAIN}";
 403         my $groupadd = $cmd_env;
 404         $groupadd .= " $samba_tool group add '$groupname' --group-scope=Domain $cmd_config";
 405         unless (system($groupadd) == 0) {
 406                 warn("Failed to create group \n$groupadd");
 407                 return undef;
 408         }
 409         my $groupmem = $cmd_env;
 410         $groupmem .= " $samba_tool group addmembers '$groupname' '$localenv->{TRUST_DOMSID}-513' $cmd_config";
 411         unless (system($groupmem) == 0) {
 412                 warn("Failed to add group member \n$groupmem");
 413                 return undef;
 414         }
 415
 416         return $localenv
 417 }
 418
 419 sub provision_raw_prepare($$$$$$$$$$$$)
 420 {
 421         my ($self, $prefix, $server_role, $hostname,
 422             $domain, $realm, $samsid, $functional_level,
 423             $password, $kdc_ipv4, $kdc_ipv6) = @_;
 424         my $ctx;
 425         my $netbiosname = uc($hostname);
 426
 427         unless(-d $prefix or mkdir($prefix, 0777)) {
 428                 warn("Unable to create $prefix");
 429                 return undef;
 430         }
 431         my $prefix_abs = abs_path($prefix);
 432
 433         die ("prefix=''") if $prefix_abs eq "";
 434         die ("prefix='/'") if $prefix_abs eq "/";
 435
 436         unless (system("rm -rf $prefix_abs/*") == 0) {
 437                 warn("Unable to clean up");
 438         }
 439
 440
 441         my $swiface = Samba::get_interface($hostname);
 442
 443         $ctx->{prefix} = $prefix;
 444         $ctx->{prefix_abs} = $prefix_abs;
 445
 446         $ctx->{server_role} = $server_role;
 447         $ctx->{hostname} = $hostname;
 448         $ctx->{netbiosname} = $netbiosname;
 449         $ctx->{swiface} = $swiface;
 450         $ctx->{password} = $password;
 451         $ctx->{kdc_ipv4} = $kdc_ipv4;
 452         $ctx->{kdc_ipv6} = $kdc_ipv6;
 453         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
 454         if ($functional_level eq "2000") {
 455                 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc"
 456         }
 457
 458 #
 459 # Set smbd log level here.
 460 #
 461         $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
 462         $ctx->{username} = "Administrator";
 463         $ctx->{domain} = $domain;
 464         $ctx->{realm} = uc($realm);
 465         $ctx->{dnsname} = lc($realm);
 466         $ctx->{samsid} = $samsid;
 467
 468         $ctx->{functional_level} = $functional_level;
 469
 470         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 471         chomp $unix_name;
 472         $ctx->{unix_name} = $unix_name;
 473         $ctx->{unix_uid} = $>;
 474         my @mygid = split(" ", $();
 475         $ctx->{unix_gid} = $mygid[0];
 476         $ctx->{unix_gids_str} = $);
 477         @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
 478
 479         $ctx->{etcdir} = "$prefix_abs/etc";
 480         $ctx->{piddir} = "$prefix_abs/pid";
 481         $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
 482         $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
 483         $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
 484         $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
 485         $ctx->{privatedir} = "$prefix_abs/private";
 486         $ctx->{binddnsdir} = "$prefix_abs/bind-dns";
 487         $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
 488         $ctx->{lockdir} = "$prefix_abs/lockdir";
 489         $ctx->{logdir} = "$prefix_abs/logs";
 490         $ctx->{statedir} = "$prefix_abs/statedir";
 491         $ctx->{cachedir} = "$prefix_abs/cachedir";
 492         $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
 493         $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
 494         $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
 495         $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
 496         $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
 497         $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
 498         if ($ENV{SAMBA_DNS_FAKING}) {
 499                 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 500                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
 501         } else {
 502                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces";
 503                 $ctx->{use_resolv_wrapper} = 1;
 504         }
 505         $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
 506
 507         $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
 508
 509         $ctx->{ipv4} = "127.0.0.$swiface";
 510         $ctx->{ipv6} = sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
 511         $ctx->{interfaces} = "$ctx->{ipv4}/8 $ctx->{ipv6}/64";
 512
 513         push(@{$ctx->{directories}}, $ctx->{privatedir});
 514         push(@{$ctx->{directories}}, $ctx->{binddnsdir});
 515         push(@{$ctx->{directories}}, $ctx->{etcdir});
 516         push(@{$ctx->{directories}}, $ctx->{piddir});
 517         push(@{$ctx->{directories}}, $ctx->{lockdir});
 518         push(@{$ctx->{directories}}, $ctx->{logdir});
 519         push(@{$ctx->{directories}}, $ctx->{statedir});
 520         push(@{$ctx->{directories}}, $ctx->{cachedir});
 521
 522         $ctx->{smb_conf_extra_options} = "";
 523
 524         my @provision_options = ();
 525         push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
 526         push (@provision_options, "KRB5_CCACHE=\"$ctx->{krb5_ccache}\"");
 527         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
 528         push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
 529         push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
 530         push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
 531         if (defined($ctx->{use_resolv_wrapper})) {
 532                 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
 533         } else {
 534                 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
 535         }
 536         if (defined($ENV{GDB_PROVISION})) {
 537                 push (@provision_options, "gdb --args");
 538                 if (!defined($ENV{PYTHON})) {
 539                     push (@provision_options, "env");
 540                     push (@provision_options, "python");
 541                 }
 542         }
 543         if (defined($ENV{VALGRIND_PROVISION})) {
 544                 push (@provision_options, "valgrind");
 545                 if (!defined($ENV{PYTHON})) {
 546                     push (@provision_options, "env");
 547                     push (@provision_options, "python");
 548                 }
 549         }
 550         if (defined($ENV{PYTHON})) {
 551                 push (@provision_options, $ENV{PYTHON});
 552         }
 553         push (@provision_options, Samba::bindir_path($self, "samba-tool"));
 554         push (@provision_options, "domain");
 555         push (@provision_options, "provision");
 556         push (@provision_options, "--configfile=$ctx->{smb_conf}");
 557         push (@provision_options, "--host-name=$ctx->{hostname}");
 558         push (@provision_options, "--host-ip=$ctx->{ipv4}");
 559         push (@provision_options, "--quiet");
 560         push (@provision_options, "--domain=$ctx->{domain}");
 561         push (@provision_options, "--realm=$ctx->{realm}");
 562         if (defined($ctx->{samsid})) {
 563                 push (@provision_options, "--domain-sid=$ctx->{samsid}");
 564         }
 565         push (@provision_options, "--adminpass=$ctx->{password}");
 566         push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
 567         push (@provision_options, "--machinepass=machine$ctx->{password}");
 568         push (@provision_options, "--root=$ctx->{unix_name}");
 569         push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
 570         push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
 571
 572         @{$ctx->{provision_options}} = @provision_options;
 573
 574         return $ctx;
 575 }
 576
 577 #
 578 # Step1 creates the basic configuration
 579 #
 580 sub provision_raw_step1($$)
 581 {
 582         my ($self, $ctx) = @_;
 583
 584         mkdir($_, 0777) foreach (@{$ctx->{directories}});
 585
 586         ##
 587         ## lockdir and piddir must be 0755
 588         ##
 589         chmod 0755, $ctx->{lockdir};
 590         chmod 0755, $ctx->{piddir};
 591
 592         unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
 593                 warn("can't open $ctx->{smb_conf}$?");
 594                 return undef;
 595         }
 596
 597         Samba::prepare_keyblobs($ctx);
 598         my $crlfile = "$ctx->{tlsdir}/crl.pem";
 599         $crlfile = "" unless -e ${crlfile};
 600
 601         print CONFFILE "
 602 [global]
 603         netbios name = $ctx->{netbiosname}
 604         posix:eadb = $ctx->{statedir}/eadb.tdb
 605         workgroup = $ctx->{domain}
 606         realm = $ctx->{realm}
 607         private dir = $ctx->{privatedir}
 608         binddns dir = $ctx->{binddnsdir}
 609         pid directory = $ctx->{piddir}
 610         ncalrpc dir = $ctx->{ncalrpcdir}
 611         lock dir = $ctx->{lockdir}
 612         state directory = $ctx->{statedir}
 613         cache directory = $ctx->{cachedir}
 614         winbindd socket directory = $ctx->{winbindd_socket_dir}
 615         ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
 616         winbind separator = /
 617         interfaces = $ctx->{interfaces}
 618         tls dh params file = $ctx->{tlsdir}/dhparms.pem
 619         tls crlfile = ${crlfile}
 620         tls verify peer = no_check
 621         panic action = $RealBin/gdb_backtrace \%d
 622         wins support = yes
 623         server role = $ctx->{server_role}
 624         server services = +echo +smb -s3fs
 625         dcerpc endpoint servers = +winreg +srvsvc
 626         notify:inotify = false
 627         ldb:nosync = true
 628         ldap server require strong auth = yes
 629 #We don't want to pass our self-tests if the PAC code is wrong
 630         gensec:require_pac = true
 631         log file = $ctx->{logdir}/log.\%m
 632         log level = $ctx->{server_loglevel}
 633         lanman auth = Yes
 634         ntlm auth = Yes
 635         rndc command = true
 636         dns update command = $ctx->{samba_dnsupdate}
 637         spn update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
 638         gpo update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_gpoupdate -s $ctx->{smb_conf} -H $ctx->{privatedir}/sam.ldb --machine
 639         dreplsrv:periodic_startup_interval = 0
 640         dsdb:schema update allowed = yes
 641
 642         prefork children = 4
 643
 644         vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
 645
 646         idmap_ldb:use rfc2307=yes
 647         winbind enum users = yes
 648         winbind enum groups = yes
 649
 650         rpc server port:netlogon = 1026
 651
 652 ";
 653
 654         print CONFFILE "
 655
 656         # Begin extra options
 657         $ctx->{smb_conf_extra_options}
 658         # End extra options
 659 ";
 660         close(CONFFILE);
 661
 662         #Default the KDC IP to the server's IP
 663         if (not defined($ctx->{kdc_ipv4})) {
 664                 $ctx->{kdc_ipv4} = $ctx->{ipv4};
 665         }
 666         if (not defined($ctx->{kdc_ipv6})) {
 667                 $ctx->{kdc_ipv6} = $ctx->{ipv6};
 668         }
 669
 670         Samba::mk_krb5_conf($ctx);
 671         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
 672
 673         open(PWD, ">$ctx->{nsswrap_passwd}");
 674         if ($ctx->{unix_uid} != 0) {
 675                 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
 676         }
 677         print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
 678         print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
 679 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 680 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 681 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 682 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 683 ";
 684         close(PWD);
 685         my $uid_rfc2307test = 65533;
 686
 687         open(GRP, ">$ctx->{nsswrap_group}");
 688         if ($ctx->{unix_gid} != 0) {
 689                 print GRP "root:x:0:\n";
 690         }
 691         print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
 692         print GRP "wheel:x:10:
 693 users:x:65531:
 694 nobody:x:65533:
 695 nogroup:x:65534:nobody
 696 ";
 697         close(GRP);
 698         my $gid_rfc2307test = 65532;
 699
 700         my $hostname = lc($ctx->{hostname});
 701         open(HOSTS, ">>$ctx->{nsswrap_hosts}");
 702         if ($hostname eq "localdc") {
 703                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 704                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 705         } else {
 706                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 707                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 708         }
 709         close(HOSTS);
 710
 711         if (defined($ctx->{resolv_conf})) {
 712                 open(RESOLV_CONF, ">$ctx->{resolv_conf}");
 713                 print RESOLV_CONF "nameserver $ctx->{kdc_ipv4}\n";
 714                 print RESOLV_CONF "nameserver $ctx->{kdc_ipv6}\n";
 715                 close(RESOLV_CONF);
 716         }
 717
 718         my $configuration = "--configfile=$ctx->{smb_conf}";
 719
 720 #Ensure the config file is valid before we start
 721         my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
 722         if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 723                 system("$testparm -v --suppress-prompt $configuration >&2");
 724                 warn("Failed to create a valid smb.conf configuration $testparm!");
 725                 return undef;
 726         }
 727         unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
 728                 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
 729                 return undef;
 730         }
 731
 732         my $ret = {
 733                 KRB5_CONFIG => $ctx->{krb5_conf},
 734                 KRB5_CCACHE => $ctx->{krb5_ccache},
 735                 MITKDC_CONFIG => $ctx->{mitkdc_conf},
 736                 PIDDIR => $ctx->{piddir},
 737                 SERVER => $ctx->{hostname},
 738                 SERVER_IP => $ctx->{ipv4},
 739                 SERVER_IPV6 => $ctx->{ipv6},
 740                 NETBIOSNAME => $ctx->{netbiosname},
 741                 DOMAIN => $ctx->{domain},
 742                 USERNAME => $ctx->{username},
 743                 REALM => $ctx->{realm},
 744                 SAMSID => $ctx->{samsid},
 745                 PASSWORD => $ctx->{password},
 746                 LDAPDIR => $ctx->{ldapdir},
 747                 LDAP_INSTANCE => $ctx->{ldap_instance},
 748                 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
 749                 NCALRPCDIR => $ctx->{ncalrpcdir},
 750                 LOCKDIR => $ctx->{lockdir},
 751                 STATEDIR => $ctx->{statedir},
 752                 CACHEDIR => $ctx->{cachedir},
 753                 PRIVATEDIR => $ctx->{privatedir},
 754                 BINDDNSDIR => $ctx->{binddnsdir},
 755                 SERVERCONFFILE => $ctx->{smb_conf},
 756                 CONFIGURATION => $configuration,
 757                 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
 758                 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
 759                 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
 760                 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
 761                 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
 762                 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
 763                 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
 764                 SAMBA_TEST_LOG_POS => 0,
 765                 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
 766                 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
 767                 LOCAL_PATH => $ctx->{share},
 768                 UID_RFC2307TEST => $uid_rfc2307test,
 769                 GID_RFC2307TEST => $gid_rfc2307test,
 770                 SERVER_ROLE => $ctx->{server_role},
 771                 RESOLV_CONF => $ctx->{resolv_conf}
 772         };
 773
 774         if (defined($ctx->{use_resolv_wrapper})) {
 775                 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
 776         } else {
 777                 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
 778         }
 779
 780         if ($ctx->{server_role} eq "domain controller") {
 781                 $ret->{DOMSID} = $ret->{SAMSID};
 782         }
 783
 784         return $ret;
 785 }
 786
 787 #
 788 # Step2 runs the provision script
 789 #
 790 sub provision_raw_step2($$$)
 791 {
 792         my ($self, $ctx, $ret) = @_;
 793
 794         my $provision_cmd = join(" ", @{$ctx->{provision_options}});
 795         unless (system($provision_cmd) == 0) {
 796                 warn("Unable to provision: \n$provision_cmd\n");
 797                 return undef;
 798         }
 799
 800         my $testallowed_account = "testallowed";
 801         my $samba_tool_cmd = "";
 802         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 803         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 804         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 805             . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
 806         unless (system($samba_tool_cmd) == 0) {
 807                 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
 808                 return undef;
 809         }
 810
 811         my $ldbmodify = "";
 812         $ldbmodify .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 813         $ldbmodify .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 814         $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
 815         my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
 816
 817         if ($ctx->{server_role} ne "domain controller") {
 818                 $base_dn = "DC=$ctx->{netbiosname}";
 819         }
 820
 821         my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
 822         $testallowed_account = "testallowed account";
 823         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 824         print LDIF "dn: $user_dn
 825 changetype: modify
 826 replace: samAccountName
 827 samAccountName: $testallowed_account
 828 -
 829 ";
 830         close(LDIF);
 831
 832         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 833         print LDIF "dn: $user_dn
 834 changetype: modify
 835 replace: userPrincipalName
 836 userPrincipalName: testallowed upn\@$ctx->{realm}
 837 replace: servicePrincipalName
 838 servicePrincipalName: host/testallowed
 839 -
 840 ";
 841         close(LDIF);
 842
 843         $samba_tool_cmd = "";
 844         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 845         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 846         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 847             . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
 848         unless (system($samba_tool_cmd) == 0) {
 849                 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
 850                 return undef;
 851         }
 852
 853         my $user_dn = "cn=testdenied,cn=users,$base_dn";
 854         open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
 855         print LDIF "dn: $user_dn
 856 changetype: modify
 857 replace: userPrincipalName
 858 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
 859 -
 860 ";
 861         close(LDIF);
 862
 863         $samba_tool_cmd = "";
 864         $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 865         $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 866         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 867             . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
 868         unless (system($samba_tool_cmd) == 0) {
 869                 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
 870                 return undef;
 871         }
 872
 873         # Create to users alice and bob!
 874         my $user_account_array = ["alice", "bob"];
 875
 876         foreach my $user_account (@{$user_account_array}) {
 877                 my $samba_tool_cmd = "";
 878
 879                 $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 880                 $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 881                 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 882                     . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
 883                 unless (system($samba_tool_cmd) == 0) {
 884                         warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
 885                         return undef;
 886                 }
 887         }
 888
 889         return $ret;
 890 }
 891
 892 sub provision($$$$$$$$$$)
 893 {
 894         my ($self, $prefix, $server_role, $hostname,
 895             $domain, $realm, $functional_level,
 896             $password, $kdc_ipv4, $kdc_ipv6, $extra_smbconf_options, $extra_smbconf_shares,
 897             $extra_provision_options) = @_;
 898
 899         my $samsid = Samba::random_domain_sid();
 900
 901         my $ctx = $self->provision_raw_prepare($prefix, $server_role,
 902                                                $hostname,
 903                                                $domain, $realm,
 904                                                $samsid,
 905                                                $functional_level,
 906                                                $password, $kdc_ipv4, $kdc_ipv6);
 907
 908         if (defined($extra_provision_options)) {
 909                 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
 910         } else {
 911                 push (@{$ctx->{provision_options}}, "--use-ntvfs");
 912         }
 913
 914         $ctx->{share} = "$ctx->{prefix_abs}/share";
 915         push(@{$ctx->{directories}}, "$ctx->{share}");
 916         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
 917         push(@{$ctx->{directories}}, "$ctx->{share}/test2");
 918
 919         # precreate directories for printer drivers
 920         push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
 921         push(@{$ctx->{directories}}, "$ctx->{share}/x64");
 922         push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
 923
 924         my $msdfs = "no";
 925         $msdfs = "yes" if ($server_role eq "domain controller");
 926         $ctx->{smb_conf_extra_options} = "
 927
 928         max xmit = 32K
 929         server max protocol = SMB2
 930         host msdfs = $msdfs
 931         lanman auth = yes
 932
 933         # fruit:copyfile is a global option
 934         fruit:copyfile = yes
 935
 936         $extra_smbconf_options
 937
 938 [tmp]
 939         path = $ctx->{share}
 940         read only = no
 941         posix:sharedelay = 100000
 942         posix:oplocktimeout = 3
 943         posix:writetimeupdatedelay = 500000
 944
 945 [xcopy_share]
 946         path = $ctx->{share}
 947         read only = no
 948         posix:sharedelay = 100000
 949         posix:oplocktimeout = 3
 950         posix:writetimeupdatedelay = 500000
 951         create mask = 777
 952         force create mode = 777
 953
 954 [posix_share]
 955         path = $ctx->{share}
 956         read only = no
 957         create mask = 0777
 958         force create mode = 0
 959         directory mask = 0777
 960         force directory mode = 0
 961
 962 [test1]
 963         path = $ctx->{share}/test1
 964         read only = no
 965         posix:sharedelay = 100000
 966         posix:oplocktimeout = 3
 967         posix:writetimeupdatedelay = 500000
 968
 969 [test2]
 970         path = $ctx->{share}/test2
 971         read only = no
 972         posix:sharedelay = 100000
 973         posix:oplocktimeout = 3
 974         posix:writetimeupdatedelay = 500000
 975
 976 [cifs]
 977         path = $ctx->{share}/_ignore_cifs_
 978         read only = no
 979         ntvfs handler = cifs
 980         cifs:server = $ctx->{netbiosname}
 981         cifs:share = tmp
 982         cifs:use-s4u2proxy = yes
 983         # There is no username specified here, instead the client is expected
 984         # to log in with kerberos, and the serverwill use delegated credentials.
 985         # Or the server tries s4u2self/s4u2proxy to impersonate the client
 986
 987 [simple]
 988         path = $ctx->{share}
 989         read only = no
 990         ntvfs handler = simple
 991
 992 [sysvol]
 993         path = $ctx->{statedir}/sysvol
 994         read only = no
 995
 996 [netlogon]
 997         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
 998         read only = no
 999
1000 [cifsposix]
1001         copy = simple
1002         ntvfs handler = cifsposix
1003
1004 [vfs_fruit]
1005         path = $ctx->{share}
1006         vfs objects = catia fruit streams_xattr acl_xattr
1007         ea support = yes
1008         fruit:resource = file
1009         fruit:metadata = netatalk
1010         fruit:locking = netatalk
1011         fruit:encoding = native
1012
1013 $extra_smbconf_shares
1014 ";
1015
1016         if (defined($self->{ldap})) {
1017                 $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
1018                 push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
1019
1020                 my $ldap_uri= "$ctx->{ldapdir}/ldapi";
1021                 $ldap_uri =~ s|/|%2F|g;
1022                 $ldap_uri = "ldapi://$ldap_uri";
1023                 $ctx->{ldap_uri} = $ldap_uri;
1024
1025                 $ctx->{ldap_instance} = lc($ctx->{netbiosname});
1026         }
1027
1028         my $ret = $self->provision_raw_step1($ctx);
1029         unless (defined $ret) {
1030                 return undef;
1031         }
1032
1033         if (defined($self->{ldap})) {
1034                 $ret->{LDAP_URI} = $ctx->{ldap_uri};
1035                 push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
1036                 push (@{$ctx->{provision_options}}, "--ldap-backend-nosync");
1037                 if ($self->{ldap} eq "openldap") {
1038                         push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
1039                         ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx) or die("Unable to create openldap directories");
1040
1041                 } elsif ($self->{ldap} eq "fedora-ds") {
1042                         push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
1043                         push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
1044                         ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx) or die("Unable to create fedora ds directories");
1045                 }
1046
1047         }
1048
1049         return $self->provision_raw_step2($ctx, $ret);
1050 }
1051
1052 sub provision_s4member($$$$$)
1053 {
1054         my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
1055         print "PROVISIONING MEMBER...\n";
1056         my $extra_smb_conf = "
1057         passdb backend = samba_dsdb
1058 winbindd:use external pipes = true
1059
1060 # the source4 smb server doesn't allow signing by default
1061 server signing = enabled
1062 raw NTLMv2 auth = yes
1063
1064 rpc_server:default = external
1065 rpc_server:svcctl = embedded
1066 rpc_server:srvsvc = embedded
1067 rpc_server:eventlog = embedded
1068 rpc_server:ntsvcs = embedded
1069 rpc_server:winreg = embedded
1070 rpc_server:spoolss = embedded
1071 rpc_daemon:spoolssd = embedded
1072 rpc_server:tcpip = no
1073 ";
1074         if ($more_conf) {
1075                 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1076         }
1077         my $ret = $self->provision($prefix,
1078                                    "member server",
1079                                    $hostname,
1080                                    $dcvars->{DOMAIN},
1081                                    $dcvars->{REALM},
1082                                    "2008",
1083                                    "locMEMpass3",
1084                                    $dcvars->{SERVER_IP},
1085                                    $dcvars->{SERVER_IPV6},
1086                                    $extra_smb_conf, "", undef);
1087         unless ($ret) {
1088                 return undef;
1089         }
1090
1091         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1092         my $cmd = "";
1093         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1094         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1095                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1096         } else {
1097                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1098         }
1099         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1100         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1101         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1102         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1103         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1104
1105         unless (system($cmd) == 0) {
1106                 warn("Join failed\n$cmd");
1107                 return undef;
1108         }
1109
1110         $ret->{MEMBER_SERVER} = $ret->{SERVER};
1111         $ret->{MEMBER_SERVER_IP} = $ret->{SERVER_IP};
1112         $ret->{MEMBER_SERVER_IPV6} = $ret->{SERVER_IPV6};
1113         $ret->{MEMBER_NETBIOSNAME} = $ret->{NETBIOSNAME};
1114         $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
1115         $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
1116
1117         $ret->{DOMSID} = $dcvars->{DOMSID};
1118         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1119         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1120         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1121         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1122         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1123         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1124
1125         return $ret;
1126 }
1127
1128 sub provision_rpc_proxy($$$)
1129 {
1130         my ($self, $prefix, $dcvars) = @_;
1131         print "PROVISIONING RPC PROXY...\n";
1132
1133         my $extra_smbconf_options = "
1134         passdb backend = samba_dsdb
1135
1136         # rpc_proxy
1137         dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1138         dcerpc endpoint servers = epmapper, remote
1139         dcerpc_remote:interfaces = rpcecho
1140
1141 [cifs_to_dc]
1142         path = /tmp/_ignore_cifs_to_dc_/_none_
1143         read only = no
1144         ntvfs handler = cifs
1145         cifs:server = $dcvars->{SERVER}
1146         cifs:share = cifs
1147         cifs:use-s4u2proxy = yes
1148         # There is no username specified here, instead the client is expected
1149         # to log in with kerberos, and the serverwill use delegated credentials.
1150         # Or the server tries s4u2self/s4u2proxy to impersonate the client
1151
1152 ";
1153
1154         my $ret = $self->provision($prefix,
1155                                    "member server",
1156                                    "localrpcproxy",
1157                                    $dcvars->{DOMAIN},
1158                                    $dcvars->{REALM},
1159                                    "2008",
1160                                    "locRPCproxypass4",
1161                                    $dcvars->{SERVER_IP},
1162                                    $dcvars->{SERVER_IPV6},
1163                                    $extra_smbconf_options, "", undef);
1164         unless ($ret) {
1165                 return undef;
1166         }
1167
1168         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1169
1170         # The joind runs in the context of the rpc_proxy/member for now
1171         my $cmd = "";
1172         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1173         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1174                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1175         } else {
1176                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1177         }
1178         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1179         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1180         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1181         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1182         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1183
1184         unless (system($cmd) == 0) {
1185                 warn("Join failed\n$cmd");
1186                 return undef;
1187         }
1188
1189         # Setting up delegation runs in the context of the DC for now
1190         $cmd = "";
1191         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1192         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1193         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1194         $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1195         $cmd .= " $dcvars->{CONFIGURATION}";
1196         print $cmd;
1197
1198         unless (system($cmd) == 0) {
1199                 warn("Delegation failed\n$cmd");
1200                 return undef;
1201         }
1202
1203         # Setting up delegation runs in the context of the DC for now
1204         $cmd = "";
1205         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1206         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1207         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1208         $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1209         $cmd .= " $dcvars->{CONFIGURATION}";
1210
1211         unless (system($cmd) == 0) {
1212                 warn("Delegation failed\n$cmd");
1213                 return undef;
1214         }
1215
1216         $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
1217         $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
1218         $ret->{RPC_PROXY_SERVER_IPV6} = $ret->{SERVER_IPV6};
1219         $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
1220         $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
1221         $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
1222
1223         $ret->{DOMSID} = $dcvars->{DOMSID};
1224         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1225         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1226         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1227         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1228         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1229         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1230
1231         return $ret;
1232 }
1233
1234 sub provision_promoted_dc($$$)
1235 {
1236         my ($self, $prefix, $dcvars) = @_;
1237         print "PROVISIONING PROMOTED DC...\n";
1238
1239         # We do this so that we don't run the provision.  That's the job of 'samba-tool domain dcpromo'.
1240         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1241                                                "promotedvdc",
1242                                                $dcvars->{DOMAIN},
1243                                                $dcvars->{REALM},
1244                                                $dcvars->{SAMSID},
1245                                                "2008",
1246                                                $dcvars->{PASSWORD},
1247                                                $dcvars->{SERVER_IP},
1248                                                $dcvars->{SERVER_IPV6});
1249
1250         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1251
1252         $ctx->{smb_conf_extra_options} = "
1253         max xmit = 32K
1254         server max protocol = SMB2
1255
1256         ntlm auth = ntlmv2-only
1257
1258 [sysvol]
1259         path = $ctx->{statedir}/sysvol
1260         read only = yes
1261
1262 [netlogon]
1263         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1264         read only = no
1265
1266 ";
1267
1268         my $ret = $self->provision_raw_step1($ctx);
1269         unless ($ret) {
1270                 return undef;
1271         }
1272
1273         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1274         my $cmd = "";
1275         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1276         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1277                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1278         } else {
1279                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1280         }
1281         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1282         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1283         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1284         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1285         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1286
1287         unless (system($cmd) == 0) {
1288                 warn("Join failed\n$cmd");
1289                 return undef;
1290         }
1291
1292         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1293         my $cmd = "";
1294         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1295         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1296         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1297         $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1298         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1299         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs --dns-backend=BIND9_DLZ";
1300
1301         unless (system($cmd) == 0) {
1302                 warn("Join failed\n$cmd");
1303                 return undef;
1304         }
1305
1306         $ret->{PROMOTED_DC_SERVER} = $ret->{SERVER};
1307         $ret->{PROMOTED_DC_SERVER_IP} = $ret->{SERVER_IP};
1308         $ret->{PROMOTED_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1309         $ret->{PROMOTED_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1310
1311         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1312         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1313         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1314         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1315         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1316         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1317
1318         return $ret;
1319 }
1320
1321 sub provision_vampire_dc($$$)
1322 {
1323         my ($self, $prefix, $dcvars, $fl) = @_;
1324         print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1325         my $name = "localvampiredc";
1326         my $extra_conf = "";
1327
1328         if ($fl == "2000") {
1329                 $name = "vampire2000dc";
1330         } else {
1331                 $extra_conf = "drs: immediate link sync = yes
1332                        drs: max link sync = 250";
1333         }
1334
1335         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1336         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1337                                                $name,
1338                                                $dcvars->{DOMAIN},
1339                                                $dcvars->{REALM},
1340                                                $dcvars->{DOMSID},
1341                                                $fl,
1342                                                $dcvars->{PASSWORD},
1343                                                $dcvars->{SERVER_IP},
1344                                                $dcvars->{SERVER_IPV6});
1345
1346         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1347
1348         $ctx->{smb_conf_extra_options} = "
1349         max xmit = 32K
1350         server max protocol = SMB2
1351
1352         ntlm auth = mschapv2-and-ntlmv2-only
1353         $extra_conf
1354
1355 [sysvol]
1356         path = $ctx->{statedir}/sysvol
1357         read only = yes
1358
1359 [netlogon]
1360         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1361         read only = no
1362
1363 ";
1364
1365         my $ret = $self->provision_raw_step1($ctx);
1366         unless ($ret) {
1367                 return undef;
1368         }
1369
1370         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1371         my $cmd = "";
1372         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1373         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1374                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1375         } else {
1376                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1377         }
1378         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1379         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1380         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1381         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1382         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1383
1384         unless (system($cmd) == 0) {
1385                 warn("Join failed\n$cmd");
1386                 return undef;
1387         }
1388
1389         if ($fl == "2000") {
1390                 $ret->{VAMPIRE_2000_DC_SERVER} = $ret->{SERVER};
1391                 $ret->{VAMPIRE_2000_DC_SERVER_IP} = $ret->{SERVER_IP};
1392                 $ret->{VAMPIRE_2000_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1393                 $ret->{VAMPIRE_2000_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1394         } else {
1395                 $ret->{VAMPIRE_DC_SERVER} = $ret->{SERVER};
1396                 $ret->{VAMPIRE_DC_SERVER_IP} = $ret->{SERVER_IP};
1397                 $ret->{VAMPIRE_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1398                 $ret->{VAMPIRE_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1399         }
1400         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1401         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1402         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1403         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1404         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1405         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1406         $ret->{DC_REALM} = $dcvars->{DC_REALM};
1407
1408         return $ret;
1409 }
1410
1411 sub provision_subdom_dc($$$)
1412 {
1413         my ($self, $prefix, $dcvars) = @_;
1414         print "PROVISIONING SUBDOMAIN DC...\n";
1415
1416         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1417         my $samsid = undef; # TODO pass the domain sid all the way down
1418         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1419                                                "localsubdc",
1420                                                "SAMBASUBDOM",
1421                                                "sub.samba.example.com",
1422                                                $samsid,
1423                                                "2008",
1424                                                $dcvars->{PASSWORD},
1425                                                undef);
1426
1427         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1428
1429         $ctx->{smb_conf_extra_options} = "
1430         max xmit = 32K
1431         server max protocol = SMB2
1432
1433 [sysvol]
1434         path = $ctx->{statedir}/sysvol
1435         read only = yes
1436
1437 [netlogon]
1438         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1439         read only = no
1440
1441 ";
1442
1443         my $ret = $self->provision_raw_step1($ctx);
1444         unless ($ret) {
1445                 return undef;
1446         }
1447
1448         Samba::mk_krb5_conf($ctx);
1449         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1450
1451         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1452         my $cmd = "";
1453         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1454         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1455                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1456         } else {
1457                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1458         }
1459         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1460         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1461         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{dnsname} subdomain ";
1462         $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
1463         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1464         $cmd .= " --adminpass=$ret->{PASSWORD}";
1465
1466         unless (system($cmd) == 0) {
1467                 warn("Join failed\n$cmd");
1468                 return undef;
1469         }
1470
1471         $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
1472         $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
1473         $ret->{SUBDOM_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1474         $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1475
1476         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1477         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1478         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1479         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1480         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1481         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1482
1483         return $ret;
1484 }
1485
1486 sub provision_ad_dc_ntvfs($$)
1487 {
1488         my ($self, $prefix) = @_;
1489
1490         # We keep the old 'winbind' name here in server services to
1491         # ensure upgrades which used that name still work with the now
1492         # alias.
1493
1494         print "PROVISIONING AD DC (NTVFS)...\n";
1495         my $extra_conf_options = "netbios aliases = localDC1-a
1496         server services = +winbind -winbindd
1497         ldap server require strong auth = allow_sasl_over_tls
1498         allow nt4 crypto = yes
1499         raw NTLMv2 auth = yes
1500         lsa over netlogon = yes
1501         rpc server port = 1027
1502         auth event notification = true
1503         server schannel = auto
1504         ";
1505         my $ret = $self->provision($prefix,
1506                                    "domain controller",
1507                                    "localdc",
1508                                    "SAMBADOMAIN",
1509                                    "samba.example.com",
1510                                    "2008",
1511                                    "locDCpass1",
1512                                    undef,
1513                                    undef,
1514                                    $extra_conf_options,
1515                                    "",
1516                                    undef);
1517         unless ($ret) {
1518                 return undef;
1519         }
1520
1521         unless($self->add_wins_config("$prefix/private")) {
1522                 warn("Unable to add wins configuration");
1523                 return undef;
1524         }
1525         $ret->{NETBIOSALIAS} = "localdc1-a";
1526         $ret->{DC_SERVER} = $ret->{SERVER};
1527         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1528         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1529         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1530         $ret->{DC_USERNAME} = $ret->{USERNAME};
1531         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1532         $ret->{DC_REALM} = $ret->{REALM};
1533
1534         return $ret;
1535 }
1536
1537 sub provision_fl2000dc($$)
1538 {
1539         my ($self, $prefix) = @_;
1540
1541         print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1542         my $extra_conf_options = "
1543         spnego:simulate_w2k=yes
1544         ntlmssp_server:force_old_spnego=yes
1545 ";
1546         my $extra_provision_options = undef;
1547         # This environment uses plain text secrets
1548         # i.e. secret attributes are not encrypted on disk.
1549         # This allows testing of the --plaintext-secrets option for
1550         # provision
1551         push (@{$extra_provision_options}, "--plaintext-secrets");
1552         my $ret = $self->provision($prefix,
1553                                    "domain controller",
1554                                    "dc5",
1555                                    "SAMBA2000",
1556                                    "samba2000.example.com",
1557                                    "2000",
1558                                    "locDCpass5",
1559                                    undef,
1560                                    undef,
1561                                    $extra_conf_options,
1562                                    "",
1563                                    $extra_provision_options);
1564         unless ($ret) {
1565                 return undef;
1566         }
1567
1568         unless($self->add_wins_config("$prefix/private")) {
1569                 warn("Unable to add wins configuration");
1570                 return undef;
1571         }
1572         $ret->{DC_SERVER} = $ret->{SERVER};
1573         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1574         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1575         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1576         $ret->{DC_USERNAME} = $ret->{USERNAME};
1577         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1578         $ret->{DC_REALM} = $ret->{REALM};
1579
1580         return $ret;
1581 }
1582
1583 sub provision_fl2003dc($$$)
1584 {
1585         my ($self, $prefix, $dcvars) = @_;
1586         my $swiface1 = Samba::get_interface("fakednsforwarder1");
1587         my $swiface2 = Samba::get_interface("fakednsforwarder2");
1588
1589         print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1590         my $extra_conf_options = "allow dns updates = nonsecure and secure
1591         dcesrv:header signing = no
1592         dns forwarder = 127.0.0.$swiface1 127.0.0.$swiface2";
1593         my $ret = $self->provision($prefix,
1594                                    "domain controller",
1595                                    "dc6",
1596                                    "SAMBA2003",
1597                                    "samba2003.example.com",
1598                                    "2003",
1599                                    "locDCpass6",
1600                                    undef,
1601                                    undef,
1602                                    $extra_conf_options,
1603                                    "",
1604                                    undef);
1605         unless (defined $ret) {
1606                 return undef;
1607         }
1608
1609         $ret->{DC_SERVER} = $ret->{SERVER};
1610         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1611         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1612         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1613         $ret->{DC_USERNAME} = $ret->{USERNAME};
1614         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1615         $ret->{DNS_FORWARDER1} = "127.0.0.$swiface1";
1616         $ret->{DNS_FORWARDER2} = "127.0.0.$swiface2";
1617
1618         my @samba_tool_options;
1619         push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1620         push (@samba_tool_options, "domain");
1621         push (@samba_tool_options, "passwordsettings");
1622         push (@samba_tool_options, "set");
1623         push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1624         push (@samba_tool_options, "--min-pwd-age=0");
1625         push (@samba_tool_options, "--history-length=1");
1626
1627         my $samba_tool_cmd = join(" ", @samba_tool_options);
1628
1629         unless (system($samba_tool_cmd) == 0) {
1630                 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1631                 return undef;
1632         }
1633
1634         unless($self->add_wins_config("$prefix/private")) {
1635                 warn("Unable to add wins configuration");
1636                 return undef;
1637         }
1638
1639         return $ret;
1640 }
1641
1642 sub provision_fl2008r2dc($$$)
1643 {
1644         my ($self, $prefix, $dcvars) = @_;
1645
1646         print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1647         my $extra_conf_options = "ldap server require strong auth = no";
1648         my $ret = $self->provision($prefix,
1649                                    "domain controller",
1650                                    "dc7",
1651                                    "SAMBA2008R2",
1652                                    "samba2008R2.example.com",
1653                                    "2008_R2",
1654                                    "locDCpass7",
1655                                    undef,
1656                                    undef,
1657                                    $extra_conf_options,
1658                                    "",
1659                                    undef);
1660         unless (defined $ret) {
1661                 return undef;
1662         }
1663
1664         unless ($self->add_wins_config("$prefix/private")) {
1665                 warn("Unable to add wins configuration");
1666                 return undef;
1667         }
1668         $ret->{DC_SERVER} = $ret->{SERVER};
1669         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1670         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1671         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1672         $ret->{DC_USERNAME} = $ret->{USERNAME};
1673         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1674         $ret->{DC_REALM} = $ret->{REALM};
1675
1676         return $ret;
1677 }
1678
1679
1680 sub provision_rodc($$$)
1681 {
1682         my ($self, $prefix, $dcvars) = @_;
1683         print "PROVISIONING RODC...\n";
1684
1685         # We do this so that we don't run the provision.  That's the job of 'net join RODC'.
1686         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1687                                                "rodc",
1688                                                $dcvars->{DOMAIN},
1689                                                $dcvars->{REALM},
1690                                                $dcvars->{DOMSID},
1691                                                "2008",
1692                                                $dcvars->{PASSWORD},
1693                                                $dcvars->{SERVER_IP},
1694                                                $dcvars->{SERVER_IPV6});
1695         unless ($ctx) {
1696                 return undef;
1697         }
1698
1699         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1700
1701         $ctx->{share} = "$ctx->{prefix_abs}/share";
1702         push(@{$ctx->{directories}}, "$ctx->{share}");
1703
1704         $ctx->{smb_conf_extra_options} = "
1705         max xmit = 32K
1706         server max protocol = SMB2
1707         password server = $dcvars->{DC_SERVER}
1708
1709 [sysvol]
1710         path = $ctx->{statedir}/sysvol
1711         read only = yes
1712
1713 [netlogon]
1714         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1715         read only = yes
1716
1717 [tmp]
1718         path = $ctx->{share}
1719         read only = no
1720         posix:sharedelay = 10000
1721         posix:oplocktimeout = 3
1722         posix:writetimeupdatedelay = 50000
1723
1724 ";
1725
1726         my $ret = $self->provision_raw_step1($ctx);
1727         unless ($ret) {
1728                 return undef;
1729         }
1730
1731         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1732         my $cmd = "";
1733         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1734         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1735                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1736         } else {
1737                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1738         }
1739         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1740         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1741         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1742         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1743         $cmd .= " --server=$dcvars->{DC_SERVER} --use-ntvfs";
1744
1745         unless (system($cmd) == 0) {
1746                 warn("RODC join failed\n$cmd");
1747                 return undef;
1748         }
1749
1750         # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1751         # user password verified on the RODC
1752         my $testallowed_account = "testallowed account";
1753         $cmd = "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1754         $cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
1755         $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1756         $cmd .= " --server=$dcvars->{DC_SERVER}";
1757
1758         unless (system($cmd) == 0) {
1759                 warn("RODC join failed\n$cmd");
1760                 return undef;
1761         }
1762
1763         # we overwrite the kdc after the RODC join
1764         # so that use the RODC as kdc and test
1765         # the proxy code
1766         $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1767         $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1768         Samba::mk_krb5_conf($ctx);
1769         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1770
1771         $ret->{RODC_DC_SERVER} = $ret->{SERVER};
1772         $ret->{RODC_DC_SERVER_IP} = $ret->{SERVER_IP};
1773         $ret->{RODC_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1774         $ret->{RODC_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1775
1776         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1777         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1778         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1779         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1780         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1781         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1782
1783         return $ret;
1784 }
1785
1786 sub read_config_h($)
1787 {
1788         my ($name) = @_;
1789         my %ret = {};
1790         open(LF, "<$name") or die("unable to read $name: $!");
1791         while (<LF>) {
1792                 chomp;
1793                 next if not (/^#define /);
1794                 if (/^#define (.*?)[ \t]+(.*?)$/) {
1795                         $ret{$1} = $2;
1796                         next;
1797                 }
1798                 if (/^#define (.*?)[ \t]+$/) {
1799                         $ret{$1} = 1;;
1800                         next;
1801                 }
1802         }
1803         close(LF);
1804         return \%ret;
1805 }
1806
1807 sub provision_ad_dc($$$$$$)
1808 {
1809         my ($self, $prefix, $hostname, $domain, $realm, $smbconf_args) = @_;
1810
1811         my $prefix_abs = abs_path($prefix);
1812
1813         my $bindir_abs = abs_path($self->{bindir});
1814         my $lockdir="$prefix_abs/lockdir";
1815         my $conffile="$prefix_abs/etc/smb.conf";
1816
1817         my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
1818         $require_mutexes = "" if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} eq "1");
1819
1820         my $config_h = {};
1821
1822         if (defined($ENV{CONFIG_H})) {
1823                 $config_h = read_config_h($ENV{CONFIG_H});
1824         }
1825
1826         my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
1827         $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
1828
1829         my $extra_smbconf_options = "
1830         server services = -smb +s3fs
1831         xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1832
1833         dbwrap_tdb_mutexes:* = yes
1834         ${require_mutexes}
1835
1836         ${password_hash_gpg_key_ids}
1837
1838         kernel oplocks = no
1839         kernel change notify = no
1840         smb2 leases = no
1841
1842         logging = file
1843         printing = bsd
1844         printcap name = /dev/null
1845
1846         max protocol = SMB3
1847         read only = no
1848
1849         smbd:sharedelay = 100000
1850         smbd:writetimeupdatedelay = 500000
1851         create mask = 755
1852         dos filemode = yes
1853         check parent directory delete on close = yes
1854
1855         dcerpc endpoint servers = -winreg -srvsvc
1856
1857         printcap name = /dev/null
1858
1859         addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1860         deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1861
1862         printing = vlp
1863         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1864         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1865         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1866         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1867         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1868         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1869         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1870         lpq cache time = 0
1871         print notify backchannel = yes
1872
1873         server schannel = auto
1874         auth event notification = true
1875         $smbconf_args
1876 ";
1877
1878         my $extra_smbconf_shares = "
1879
1880 [tmpenc]
1881         copy = tmp
1882         smb encrypt = required
1883
1884 [tmpcase]
1885         copy = tmp
1886         case sensitive = yes
1887
1888 [tmpguest]
1889         copy = tmp
1890         guest ok = yes
1891
1892 [hideunread]
1893         copy = tmp
1894         hide unreadable = yes
1895
1896 [durable]
1897         copy = tmp
1898         kernel share modes = no
1899         kernel oplocks = no
1900         posix locking = no
1901
1902 [print\$]
1903         copy = tmp
1904
1905 [print1]
1906         copy = tmp
1907         printable = yes
1908
1909 [print2]
1910         copy = print1
1911 [print3]
1912         copy = print1
1913 [lp]
1914         copy = print1
1915 ";
1916
1917         print "PROVISIONING AD DC...\n";
1918         my $ret = $self->provision($prefix,
1919                                    "domain controller",
1920                                    $hostname,
1921                                    $domain,
1922                                    $realm,
1923                                    "2008",
1924                                    "locDCpass1",
1925                                    undef,
1926                                    undef,
1927                                    $extra_smbconf_options,
1928                                    $extra_smbconf_shares,
1929                                    undef);
1930         unless (defined $ret) {
1931                 return undef;
1932         }
1933
1934         unless($self->add_wins_config("$prefix/private")) {
1935                 warn("Unable to add wins configuration");
1936                 return undef;
1937         }
1938
1939         $ret->{DC_SERVER} = $ret->{SERVER};
1940         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1941         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1942         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1943         $ret->{DC_USERNAME} = $ret->{USERNAME};
1944         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1945
1946         return $ret;
1947 }
1948
1949 sub provision_chgdcpass($$)
1950 {
1951         my ($self, $prefix) = @_;
1952
1953         print "PROVISIONING CHGDCPASS...\n";
1954         my $extra_provision_options = undef;
1955         # This environment disallows the use of this password
1956         # (and also removes the default AD complexity checks)
1957         my $unacceptable_password = "widk3Dsle32jxdBdskldsk55klASKQ";
1958         push (@{$extra_provision_options}, "--dns-backend=BIND9_DLZ");
1959         my $ret = $self->provision($prefix,
1960                                    "domain controller",
1961                                    "chgdcpass",
1962                                    "CHDCDOMAIN",
1963                                    "chgdcpassword.samba.example.com",
1964                                    "2008",
1965                                    "chgDCpass1",
1966                                    undef,
1967                                    undef,
1968                                    "check password script = sed -e '/$unacceptable_password/{;q1}; /$unacceptable_password/!{q0}'\n",
1969                                    "",
1970                                    $extra_provision_options);
1971         unless (defined $ret) {
1972                 return undef;
1973         }
1974
1975         unless($self->add_wins_config("$prefix/private")) {
1976                 warn("Unable to add wins configuration");
1977                 return undef;
1978         }
1979
1980         # Remove secrets.tdb from this environment to test that we
1981         # still start up on systems without the new matching
1982         # secrets.tdb records.
1983         unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
1984                 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
1985                 return undef;
1986         }
1987
1988         $ret->{DC_SERVER} = $ret->{SERVER};
1989         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1990         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1991         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1992         $ret->{DC_USERNAME} = $ret->{USERNAME};
1993         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1994         $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
1995
1996         return $ret;
1997 }
1998
1999 sub teardown_env_terminate($$)
2000 {
2001         my ($self, $envvars) = @_;
2002         my $pid;
2003
2004         # This should cause samba to terminate gracefully
2005         close($envvars->{STDIN_PIPE});
2006
2007         $pid = $envvars->{SAMBA_PID};
2008         my $count = 0;
2009         my $childpid;
2010
2011         # This should give it time to write out the gcov data
2012         until ($count > 15) {
2013             if (Samba::cleanup_child($pid, "samba") != 0) {
2014                 return;
2015             }
2016             sleep(1);
2017             $count++;
2018         }
2019
2020         # After 15 Seconds, work out why this thing is still alive
2021         warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
2022         system("$self->{srcdir}/selftest/gdb_backtrace $pid");
2023
2024         until ($count > 30) {
2025             if (Samba::cleanup_child($pid, "samba") != 0) {
2026                 return;
2027             }
2028             sleep(1);
2029             $count++;
2030         }
2031
2032         if (kill(0, $pid)) {
2033             warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
2034             kill "TERM", $pid;
2035         }
2036
2037         until ($count > 40) {
2038             if (Samba::cleanup_child($pid, "samba") != 0) {
2039                 return;
2040             }
2041             sleep(1);
2042             $count++;
2043         }
2044         # If it is still around, kill it
2045         if (kill(0, $pid)) {
2046             warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
2047             kill 9, $pid;
2048         }
2049         return;
2050 }
2051
2052 sub teardown_env($$)
2053 {
2054         my ($self, $envvars) = @_;
2055         teardown_env_terminate($self, $envvars);
2056
2057         $self->slapd_stop($envvars) if ($self->{ldap});
2058
2059         print $self->getlog_env($envvars);
2060
2061         return;
2062 }
2063
2064 sub getlog_env($$)
2065 {
2066         my ($self, $envvars) = @_;
2067         my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
2068         my $out = $title;
2069
2070         open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
2071
2072         seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
2073         while (<LOG>) {
2074                 $out .= $_;
2075         }
2076         $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
2077         close(LOG);
2078
2079         return "" if $out eq $title;
2080
2081         return $out;
2082 }
2083
2084 sub check_env($$)
2085 {
2086         my ($self, $envvars) = @_;
2087         my $samba_pid = $envvars->{SAMBA_PID};
2088
2089         if (not defined($samba_pid)) {
2090             return 0;
2091         } elsif ($samba_pid > 0) {
2092             my $childpid = Samba::cleanup_child($samba_pid, "samba");
2093
2094             if ($childpid == 0) {
2095                 return 1;
2096             }
2097             return 0;
2098         } else {
2099             return 1;
2100         }
2101 }
2102
2103 # Declare the environments Samba4 makes available.
2104 # To be set up, they will be called as
2105 #   samba4->setup_$envname($self, $path, $dep_1_vars, $dep_2_vars, ...)
2106 %Samba4::ENV_DEPS = (
2107         # name               => [dep_1, dep_2, ...],
2108         ad_dc_ntvfs          => [],
2109         ad_dc                => [],
2110         ad_dc_no_nss         => [],
2111         ad_dc_no_ntlm        => [],
2112         ad_dc_ntvfs          => [],
2113
2114         fl2008r2dc           => ["ad_dc"],
2115         fl2003dc             => ["ad_dc"],
2116         fl2000dc             => [],
2117
2118         vampire_2000_dc      => ["fl2000dc"],
2119         vampire_dc           => ["ad_dc_ntvfs"],
2120         promoted_dc          => ["ad_dc_ntvfs"],
2121         subdom_dc            => ["ad_dc_ntvfs"],
2122
2123         rodc                 => ["ad_dc_ntvfs"],
2124         rpc_proxy            => ["ad_dc_ntvfs"],
2125         chgdcpass            => [],
2126
2127         s4member_dflt_domain => ["ad_dc_ntvfs"],
2128         s4member             => ["ad_dc_ntvfs"],
2129
2130         none                 => [],
2131 );
2132
2133 sub setup_s4member
2134 {
2135         my ($self, $path, $dc_vars) = @_;
2136
2137         my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2138
2139         if (defined $env) {
2140                 if (not defined($self->check_or_start($env, "standard"))) {
2141                         return undef;
2142                 }
2143         }
2144
2145         return $env;
2146 }
2147
2148 sub setup_s4member_dflt_domain
2149 {
2150         my ($self, $path, $dc_vars) = @_;
2151
2152         my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2153                                             "winbind use default domain = yes");
2154
2155         if (defined $env) {
2156                 if (not defined($self->check_or_start($env, "standard"))) {
2157                         return undef;
2158                 }
2159         }
2160
2161         return $env;
2162 }
2163
2164 sub setup_rpc_proxy
2165 {
2166         my ($self, $path, $dc_vars) = @_;
2167
2168         my $env = $self->provision_rpc_proxy($path, $dc_vars);
2169
2170         if (defined $env) {
2171                 if (not defined($self->check_or_start($env, "standard"))) {
2172                         return undef;
2173                 }
2174         }
2175         return $env;
2176 }
2177
2178 sub setup_ad_dc_ntvfs
2179 {
2180         my ($self, $path) = @_;
2181
2182         my $env = $self->provision_ad_dc_ntvfs($path);
2183         if (defined $env) {
2184                 if (not defined($self->check_or_start($env, "standard"))) {
2185                     warn("Failed to start ad_dc_ntvfs");
2186                         return undef;
2187                 }
2188         }
2189         return $env;
2190 }
2191
2192 sub setup_chgdcpass
2193 {
2194         my ($self, $path) = @_;
2195
2196         my $env = $self->provision_chgdcpass($path);
2197         if (defined $env) {
2198                 if (not defined($self->check_or_start($env, "standard"))) {
2199                         return undef;
2200                 }
2201         }
2202         return $env;
2203 }
2204
2205 sub setup_fl2000dc
2206 {
2207         my ($self, $path) = @_;
2208
2209         my $env = $self->provision_fl2000dc($path);
2210         if (defined $env) {
2211                 if (not defined($self->check_or_start($env, "standard"))) {
2212                         return undef;
2213                 }
2214         }
2215
2216         return $env;
2217 }
2218
2219 sub setup_fl2003dc
2220 {
2221         my ($self, $path, $dc_vars) = @_;
2222
2223         my $env = $self->provision_fl2003dc($path);
2224
2225         if (defined $env) {
2226                 if (not defined($self->check_or_start($env, "standard"))) {
2227                         return undef;
2228                 }
2229
2230                 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2231         }
2232         return $env;
2233 }
2234
2235 sub setup_fl2008r2dc
2236 {
2237         my ($self, $path, $dc_vars) = @_;
2238
2239         my $env = $self->provision_fl2008r2dc($path);
2240
2241         if (defined $env) {
2242                 if (not defined($self->check_or_start($env, "standard"))) {
2243                         return undef;
2244                 }
2245
2246                 my $upn_array = ["$env->{REALM}.upn"];
2247                 my $spn_array = ["$env->{REALM}.spn"];
2248
2249                 $self->setup_namespaces($env, $upn_array, $spn_array);
2250
2251                 $env = $self->setup_trust($env, $dc_vars, "forest", "");
2252         }
2253
2254         return $env;
2255 }
2256
2257 sub setup_vampire_dc
2258 {
2259         return setup_generic_vampire_dc(@_, "2008");
2260 }
2261
2262 sub setup_vampire_2000_dc
2263 {
2264         return setup_generic_vampire_dc(@_, "2000");
2265 }
2266
2267 sub setup_generic_vampire_dc
2268 {
2269         my ($self, $path, $dc_vars, $fl) = @_;
2270
2271         my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2272
2273         if (defined $env) {
2274                 if (not defined($self->check_or_start($env, "single"))) {
2275                         return undef;
2276                 }
2277
2278                 # force replicated DC to update repsTo/repsFrom
2279                 # for vampired partitions
2280                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2281
2282                 # as 'vampired' dc may add data in its local replica
2283                 # we need to synchronize data between DCs
2284                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2285                 my $cmd = "";
2286                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2287                 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2288                         $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2289                 } else {
2290                         $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2291                 }
2292                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2293                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2294                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2295                 $cmd .= " $dc_vars->{CONFIGURATION}";
2296                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2297                 # replicate Configuration NC
2298                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2299                 unless(system($cmd_repl) == 0) {
2300                         warn("Failed to replicate\n$cmd_repl");
2301                         return undef;
2302                 }
2303                 # replicate Default NC
2304                 $cmd_repl = "$cmd \"$base_dn\"";
2305                 unless(system($cmd_repl) == 0) {
2306                         warn("Failed to replicate\n$cmd_repl");
2307                         return undef;
2308                 }
2309
2310                 # Pull in a full set of changes from the main DC
2311                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2312                 $cmd = "";
2313                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
2314                 if (defined($env->{RESOLV_WRAPPER_CONF})) {
2315                         $cmd .= "RESOLV_WRAPPER_CONF=\"$env->{RESOLV_WRAPPER_CONF}\" ";
2316                 } else {
2317                         $cmd .= "RESOLV_WRAPPER_HOSTS=\"$env->{RESOLV_WRAPPER_HOSTS}\" ";
2318                 }
2319                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2320                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2321                 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2322                 $cmd .= " $dc_vars->{CONFIGURATION}";
2323                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2324                 # replicate Configuration NC
2325                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2326                 unless(system($cmd_repl) == 0) {
2327                         warn("Failed to replicate\n$cmd_repl");
2328                         return undef;
2329                 }
2330                 # replicate Default NC
2331                 $cmd_repl = "$cmd \"$base_dn\"";
2332                 unless(system($cmd_repl) == 0) {
2333                         warn("Failed to replicate\n$cmd_repl");
2334                         return undef;
2335                 }
2336         }
2337
2338         return $env;
2339 }
2340
2341 sub setup_promoted_dc
2342 {
2343         my ($self, $path, $dc_vars) = @_;
2344
2345         my $env = $self->provision_promoted_dc($path, $dc_vars);
2346
2347         if (defined $env) {
2348                 if (not defined($self->check_or_start($env, "single"))) {
2349                         return undef;
2350                 }
2351
2352                 # force source and replicated DC to update repsTo/repsFrom
2353                 # for vampired partitions
2354                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2355                 my $cmd = "";
2356                 # as 'vampired' dc may add data in its local replica
2357                 # we need to synchronize data between DCs
2358                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2359                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2360                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2361                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2362                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2363                 $cmd .= " $dc_vars->{CONFIGURATION}";
2364                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2365                 # replicate Configuration NC
2366                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2367                 unless(system($cmd_repl) == 0) {
2368                         warn("Failed to replicate\n$cmd_repl");
2369                         return undef;
2370                 }
2371                 # replicate Default NC
2372                 $cmd_repl = "$cmd \"$base_dn\"";
2373                 unless(system($cmd_repl) == 0) {
2374                         warn("Failed to replicate\n$cmd_repl");
2375                         return undef;
2376                 }
2377         }
2378
2379         return $env;
2380 }
2381
2382 sub setup_subdom_dc
2383 {
2384         my ($self, $path, $dc_vars) = @_;
2385
2386         my $env = $self->provision_subdom_dc($path, $dc_vars);
2387
2388         if (defined $env) {
2389                 if (not defined($self->check_or_start($env, "single"))) {
2390                         return undef;
2391                 }
2392
2393                 # force replicated DC to update repsTo/repsFrom
2394                 # for primary domain partitions
2395                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2396                 my $cmd = "";
2397                 # as 'subdomain' dc may add data in its local replica
2398                 # we need to synchronize data between DCs
2399                 my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
2400                 my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2401                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2402                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2403                 $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2404                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
2405                 $cmd .= " $dc_vars->{CONFIGURATION}";
2406                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
2407                 # replicate Configuration NC
2408                 my $cmd_repl = "$cmd \"$config_dn\"";
2409                 unless(system($cmd_repl) == 0) {
2410                         warn("Failed to replicate\n$cmd_repl");
2411                         return undef;
2412                 }
2413                 # replicate Default NC
2414                 $cmd_repl = "$cmd \"$base_dn\"";
2415                 unless(system($cmd_repl) == 0) {
2416                         warn("Failed to replicate\n$cmd_repl");
2417                         return undef;
2418                 }
2419         }
2420
2421         return $env;
2422 }
2423
2424 sub setup_rodc
2425 {
2426         my ($self, $path, $dc_vars) = @_;
2427
2428         my $env = $self->provision_rodc($path, $dc_vars);
2429
2430         unless ($env) {
2431                 return undef;
2432         }
2433
2434         if (not defined($self->check_or_start($env, "standard"))) {
2435             return undef;
2436         }
2437
2438         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2439         my $cmd = "";
2440
2441         my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2442         $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
2443         $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
2444         $cmd .= "KRB5CCNAME=\"$env->{KRB5_CCACHE}\" ";
2445         $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2446         $cmd .= " $dc_vars->{CONFIGURATION}";
2447         $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2448         # replicate Configuration NC
2449         my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2450         unless(system($cmd_repl) == 0) {
2451             warn("Failed to replicate\n$cmd_repl");
2452             return undef;
2453         }
2454         # replicate Default NC
2455         $cmd_repl = "$cmd \"$base_dn\"";
2456         unless(system($cmd_repl) == 0) {
2457             warn("Failed to replicate\n$cmd_repl");
2458             return undef;
2459         }
2460
2461         return $env;
2462 }
2463
2464 sub setup_ad_dc
2465 {
2466         my ($self, $path) = @_;
2467
2468         # If we didn't build with ADS, pretend this env was never available
2469         if (not $self->{target3}->have_ads()) {
2470                return "UNKNOWN";
2471         }
2472
2473         my $env = $self->provision_ad_dc($path, "addc", "ADDOMAIN",
2474                                          "addom.samba.example.com", "");
2475         unless ($env) {
2476                 return undef;
2477         }
2478
2479         if (not defined($self->check_or_start($env, "single"))) {
2480             return undef;
2481         }
2482
2483         my $upn_array = ["$env->{REALM}.upn"];
2484         my $spn_array = ["$env->{REALM}.spn"];
2485
2486         $self->setup_namespaces($env, $upn_array, $spn_array);
2487
2488         return $env;
2489 }
2490
2491 sub setup_ad_dc_no_nss
2492 {
2493         my ($self, $path) = @_;
2494
2495         # If we didn't build with ADS, pretend this env was never available
2496         if (not $self->{target3}->have_ads()) {
2497                return "UNKNOWN";
2498         }
2499
2500         my $env = $self->provision_ad_dc($path, "addc_no_nss", "ADNONSSDOMAIN",
2501                                          "adnonssdom.samba.example.com", "");
2502         unless ($env) {
2503                 return undef;
2504         }
2505
2506         $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2507         $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2508
2509         if (not defined($self->check_or_start($env, "single"))) {
2510             return undef;
2511         }
2512
2513         my $upn_array = ["$env->{REALM}.upn"];
2514         my $spn_array = ["$env->{REALM}.spn"];
2515
2516         $self->setup_namespaces($env, $upn_array, $spn_array);
2517
2518         return $env;
2519 }
2520
2521 sub setup_ad_dc_no_ntlm
2522 {
2523         my ($self, $path) = @_;
2524
2525         # If we didn't build with ADS, pretend this env was never available
2526         if (not $self->{target3}->have_ads()) {
2527                return "UNKNOWN";
2528         }
2529
2530         my $env = $self->provision_ad_dc($path, "addc_no_ntlm", "ADNONTLMDOMAIN",
2531                                          "adnontlmdom.samba.example.com",
2532                                          "ntlm auth = disabled");
2533         unless ($env) {
2534                 return undef;
2535         }
2536
2537         if (not defined($self->check_or_start($env, "prefork"))) {
2538             return undef;
2539         }
2540
2541         my $upn_array = ["$env->{REALM}.upn"];
2542         my $spn_array = ["$env->{REALM}.spn"];
2543
2544         $self->setup_namespaces($env, $upn_array, $spn_array);
2545
2546         return $env;
2547 }
2548
2549 sub setup_none
2550 {
2551         my ($self, $path) = @_;
2552
2553         my $ret = {
2554                 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
2555                 SAMBA_PID => -1,
2556         }
2557 }
2558
2559 1;