selftest/target/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 # NOTE: Refer to the README for more details about the various testenvs,
   7 # and tips about adding new testenvs.
   8
   9 package Samba4;
  10
  11 use strict;
  12 use warnings;
  13 use Cwd qw(abs_path);
  14 use FindBin qw($RealBin);
  15 use POSIX;
  16 use SocketWrapper;
  17 use target::Samba;
  18 use target::Samba3;
  19 use Archive::Tar;
  20
  21 sub new($$$$$) {
  22         my ($classname, $SambaCtx, $bindir, $srcdir, $server_maxtime) = @_;
  23
  24         my $self = {
  25                 vars => {},
  26                 SambaCtx => $SambaCtx,
  27                 bindir => $bindir,
  28                 srcdir => $srcdir,
  29                 server_maxtime => $server_maxtime,
  30                 target3 => new Samba3($SambaCtx, $bindir, $srcdir, $server_maxtime)
  31         };
  32         bless $self;
  33         return $self;
  34 }
  35
  36 sub scriptdir_path($$) {
  37         my ($self, $path) = @_;
  38         return "$self->{srcdir}/source4/scripting/$path";
  39 }
  40
  41 sub check_or_start($$$)
  42 {
  43         my ($self, $env_vars, $process_model) = @_;
  44         my $STDIN_READER;
  45
  46         my $env_ok = $self->check_env($env_vars);
  47         if ($env_ok) {
  48                 return $env_vars->{SAMBA_PID};
  49         } elsif (defined($env_vars->{SAMBA_PID})) {
  50                 warn("SAMBA PID $env_vars->{SAMBA_PID} is not running (died)");
  51                 return undef;
  52         }
  53
  54         # use a pipe for stdin in the child processes. This allows
  55         # those processes to monitor the pipe for EOF to ensure they
  56         # exit when the test script exits
  57         pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
  58
  59         # build up the command to run samba
  60         my @preargs = ();
  61         my @optargs = ();
  62         if (defined($ENV{SAMBA_OPTIONS})) {
  63                 @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
  64         }
  65         if(defined($ENV{SAMBA_VALGRIND})) {
  66                 @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
  67         }
  68
  69         if (defined($process_model)) {
  70                 push @optargs, ("-M", $process_model);
  71         }
  72         my $binary = Samba::bindir_path($self, "samba");
  73         my @full_cmd = (@preargs, $binary, "-i",
  74                         "--no-process-group", "--maximum-runtime=$self->{server_maxtime}",
  75                         $env_vars->{CONFIGURATION}, @optargs);
  76
  77         # the samba process takes some additional env variables (compared to s3)
  78         my $samba_envs = Samba::get_env_for_process("samba", $env_vars);
  79         if (defined($ENV{MITKRB5})) {
  80                 $samba_envs->{KRB5_KDC_PROFILE} = $env_vars->{MITKDC_CONFIG};
  81         }
  82
  83         # fork a child process and exec() samba
  84         my $daemon_ctx = {
  85                 NAME => "samba",
  86                 BINARY_PATH => $binary,
  87                 FULL_CMD => [ @full_cmd ],
  88                 LOG_FILE => $env_vars->{SAMBA_TEST_LOG},
  89                 TEE_STDOUT => 1,
  90                 PCAP_FILE => "env-$ENV{ENVNAME}-samba",
  91                 ENV_VARS => $samba_envs,
  92         };
  93         my $pid = Samba::fork_and_exec($self, $env_vars, $daemon_ctx, $STDIN_READER);
  94
  95         $env_vars->{SAMBA_PID} = $pid;
  96
  97         # close the parent's read-end of the pipe
  98         close($STDIN_READER);
  99
 100         if ($self->wait_for_start($env_vars) != 0) {
 101             warn("Samba $pid failed to start up");
 102             return undef;
 103         }
 104
 105         return $pid;
 106 }
 107
 108 sub wait_for_start($$)
 109 {
 110         my ($self, $testenv_vars) = @_;
 111         my $count = 0;
 112         my $ret = 0;
 113
 114         if (not $self->check_env($testenv_vars)) {
 115             warn("unable to confirm Samba $testenv_vars->{SAMBA_PID} is running");
 116             return -1;
 117         }
 118
 119         # This will return quickly when things are up, but be slow if we
 120         # need to wait for (eg) SSL init
 121         my $nmblookup =  Samba::bindir_path($self, "nmblookup4");
 122
 123         do {
 124                 $ret = system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 125                 if ($ret != 0) {
 126                         sleep(1);
 127                 } else {
 128                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 129                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 130                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 131                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 132                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 133                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 134                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 135                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 136                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 137                         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 138                         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 139                 }
 140                 $count++;
 141         } while ($ret != 0 && $count < 20);
 142         if ($count == 20) {
 143                 teardown_env($self, $testenv_vars);
 144                 warn("nbt not reachable after 20 retries\n");
 145                 return -1;
 146         }
 147
 148         # Ensure we have the first RID Set before we start tests.  This makes the tests more reliable.
 149         if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
 150                 print "waiting for working LDAP and a RID Set to be allocated\n";
 151                 my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
 152                 my $count = 0;
 153                 my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
 154
 155                 my $search_dn = $base_dn;
 156                 if ($testenv_vars->{NETBIOSNAME} ne "RODC") {
 157                         # TODO currently no check for actual rIDAllocationPool
 158                         $search_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
 159                 }
 160                 my $max_wait = 60;
 161
 162                 # Add hosts file for name lookups
 163                 my $cmd = $self->get_cmd_env_vars($testenv_vars);
 164
 165                 $cmd .= "$ldbsearch ";
 166                 $cmd .= "$testenv_vars->{CONFIGURATION} ";
 167                 $cmd .= "-H ldap://$testenv_vars->{SERVER} ";
 168                 $cmd .= "-U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} ";
 169                 $cmd .= "-s base ";
 170                 $cmd .= "-b '$search_dn' ";
 171                 while (system("$cmd >/dev/null") != 0) {
 172                         $count++;
 173                         if ($count > $max_wait) {
 174                                 teardown_env($self, $testenv_vars);
 175                                 warn("Timed out ($max_wait sec) waiting for working LDAP and a RID Set to be allocated by $testenv_vars->{NETBIOSNAME} PID $testenv_vars->{SAMBA_PID}");
 176                                 return -1;
 177                         }
 178                         print "Waiting for working LDAP...\n";
 179                         sleep(1);
 180                 }
 181         }
 182
 183         my $wbinfo =  Samba::bindir_path($self, "wbinfo");
 184
 185         $count = 0;
 186         do {
 187                 my $cmd = "NSS_WRAPPER_PASSWD=$testenv_vars->{NSS_WRAPPER_PASSWD} ";
 188                 $cmd .= "NSS_WRAPPER_GROUP=$testenv_vars->{NSS_WRAPPER_GROUP} ";
 189                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=$testenv_vars->{SELFTEST_WINBINDD_SOCKET_DIR} ";
 190                 $cmd .= "$wbinfo -P";
 191                 $ret = system($cmd);
 192
 193                 if ($ret != 0) {
 194                         sleep(1);
 195                 }
 196                 $count++;
 197         } while ($ret != 0 && $count < 20);
 198         if ($count == 20) {
 199                 teardown_env($self, $testenv_vars);
 200                 warn("winbind not reachable after 20 retries\n");
 201                 return -1;
 202         }
 203
 204         # Ensure we registered all our names
 205         if ($testenv_vars->{SERVER_ROLE} eq "domain controller") {
 206                 my $max_wait = 120;
 207                 print "Waiting for dns_update_cache to be created.\n";
 208                 $count = 0;
 209                 while (not -e "$testenv_vars->{PRIVATEDIR}/dns_update_cache") {
 210                         $count++;
 211                         if ($count > $max_wait) {
 212                                 teardown_env($self, $testenv_vars);
 213                                 warn("Timed out ($max_wait sec) waiting for dns_update_cache PID $testenv_vars->{SAMBA_PID}");
 214                                 return -1;
 215                         }
 216                         print "Waiting for dns_update_cache to be created...\n";
 217                         sleep(1);
 218                 }
 219                 print "Waiting for dns_update_cache to be filled.\n";
 220                 $count = 0;
 221                 while ((-s "$testenv_vars->{PRIVATEDIR}/dns_update_cache") == 0) {
 222                         $count++;
 223                         if ($count > $max_wait) {
 224                                 teardown_env($self, $testenv_vars);
 225                                 warn("Timed out ($max_wait sec) waiting for dns_update_cache PID $testenv_vars->{SAMBA_PID}");
 226                                 return -1;
 227                         }
 228                         print "Waiting for dns_update_cache to be filled...\n";
 229                         sleep(1);
 230                 }
 231         }
 232
 233         print $self->getlog_env($testenv_vars);
 234
 235         print "READY ($testenv_vars->{SAMBA_PID})\n";
 236
 237         return 0
 238 }
 239
 240 sub write_ldb_file($$$)
 241 {
 242         my ($self, $file, $ldif_in) = @_;
 243
 244         my $ldbadd =  Samba::bindir_path($self, "ldbadd");
 245         open(my $ldif, "|$ldbadd -H $file > /dev/null")
 246             or die "Failed to run $ldbadd: $!";
 247         print $ldif $ldif_in;
 248         close($ldif);
 249
 250         unless ($? == 0) {
 251             warn("$ldbadd failed: $?");
 252             return undef;
 253         }
 254         return 1;
 255 }
 256
 257 sub add_wins_config($$)
 258 {
 259         my ($self, $privatedir) = @_;
 260         my $client_ip = Samba::get_ipv4_addr("client");
 261
 262         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 263 dn: name=TORTURE_11,CN=PARTNERS
 264 objectClass: wreplPartner
 265 name: TORTURE_11
 266 address: $client_ip
 267 pullInterval: 0
 268 pushChangeCount: 0
 269 type: 0x3
 270 ");
 271 }
 272
 273 sub setup_dns_hub_internal($$$)
 274 {
 275         my ($self, $hostname, $prefix) = @_;
 276         my $STDIN_READER;
 277
 278         unless(-d $prefix or mkdir($prefix, 0777)) {
 279                 warn("Unable to create $prefix");
 280                 return undef;
 281         }
 282         my $prefix_abs = abs_path($prefix);
 283
 284         die ("prefix=''") if $prefix_abs eq "";
 285         die ("prefix='/'") if $prefix_abs eq "/";
 286
 287         unless (system("rm -rf $prefix_abs/*") == 0) {
 288                 warn("Unable to clean up");
 289         }
 290
 291         my $env = undef;
 292         $env->{NETBIOSNAME} = $hostname;
 293
 294         $env->{SERVER_IP} = Samba::get_ipv4_addr($hostname);
 295         $env->{SERVER_IPV6} = Samba::get_ipv6_addr($hostname);
 296         $env->{SOCKET_WRAPPER_DEFAULT_IFACE} = Samba::get_interface($hostname);
 297         $env->{DNS_HUB_LOG} = "$prefix_abs/dns_hub.log";
 298         $env->{RESOLV_CONF} = "$prefix_abs/resolv.conf";
 299         $env->{TESTENV_DIR} = $prefix_abs;
 300
 301         my $ctx = undef;
 302         $ctx->{resolv_conf} = $env->{RESOLV_CONF};
 303         $ctx->{dns_ipv4} = $env->{SERVER_IP};
 304         $ctx->{dns_ipv6} = $env->{SERVER_IPV6};
 305         Samba::mk_resolv_conf($ctx);
 306
 307         my @preargs = ();
 308         my @args = ();
 309         if (!defined($ENV{PYTHON})) {
 310             push (@preargs, "env");
 311             push (@preargs, "python");
 312         } else {
 313             push (@preargs, $ENV{PYTHON});
 314         }
 315         my $binary = "$self->{srcdir}/selftest/target/dns_hub.py";
 316         push (@args, "$self->{server_maxtime}");
 317         push (@args, "$env->{SERVER_IP},$env->{SERVER_IPV6}");
 318         push (@args, Samba::realm_to_ip_mappings());
 319         my @full_cmd = (@preargs, $binary, @args);
 320
 321         my $daemon_ctx = {
 322                 NAME => "dnshub",
 323                 BINARY_PATH => $binary,
 324                 FULL_CMD => [ @full_cmd ],
 325                 LOG_FILE => $env->{DNS_HUB_LOG},
 326                 TEE_STDOUT => 1,
 327                 PCAP_FILE => "env-$ENV{ENVNAME}-dns_hub",
 328                 ENV_VARS => {},
 329         };
 330
 331         # use a pipe for stdin in the child processes. This allows
 332         # those processes to monitor the pipe for EOF to ensure they
 333         # exit when the test script exits
 334         pipe($STDIN_READER, $env->{STDIN_PIPE});
 335
 336         my $pid = Samba::fork_and_exec($self, $env, $daemon_ctx, $STDIN_READER);
 337
 338         $env->{SAMBA_PID} = $pid;
 339         $env->{KRB5_CONFIG} = "$prefix_abs/no_krb5.conf";
 340
 341         # close the parent's read-end of the pipe
 342         close($STDIN_READER);
 343
 344         return $env;
 345 }
 346
 347 sub setup_dns_hub
 348 {
 349         my ($self, $prefix) = @_;
 350
 351         my $hostname = "rootdnsforwarder";
 352
 353         unless(-d $prefix or mkdir($prefix, 0777)) {
 354                 warn("Unable to create $prefix");
 355                 return undef;
 356         }
 357         my $env = $self->setup_dns_hub_internal("$hostname", "$prefix/$hostname");
 358
 359         $self->{dns_hub_env} = $env;
 360
 361         return $env;
 362 }
 363
 364 sub get_dns_hub_env($)
 365 {
 366         my ($self, $prefix) = @_;
 367
 368         if (defined($self->{dns_hub_env})) {
 369                 return $self->{dns_hub_env};
 370         }
 371
 372         die("get_dns_hub_env() not setup 'dns_hub_env'");
 373         return undef;
 374 }
 375
 376 sub return_env_value
 377 {
 378         my ($env, $overwrite, $key) = @_;
 379
 380         if (defined($overwrite) and defined($overwrite->{$key})) {
 381                 return $overwrite->{$key};
 382         }
 383
 384         if (defined($env->{$key})) {
 385                 return $env->{$key};
 386         }
 387
 388         return undef;
 389 }
 390
 391 # Returns the environmental variables that we pass to samba-tool commands
 392 sub get_cmd_env_vars
 393 {
 394         my ($self, $givenenv, $overwrite) = @_;
 395
 396         my @keys = (
 397                 "NSS_WRAPPER_HOSTS",
 398                 "SOCKET_WRAPPER_DEFAULT_IFACE",
 399                 "RESOLV_CONF",
 400                 "RESOLV_WRAPPER_CONF",
 401                 "RESOLV_WRAPPER_HOSTS",
 402                 "GNUTLS_FORCE_FIPS_MODE",
 403                 "OPENSSL_FORCE_FIPS_MODE",
 404                 "KRB5_CONFIG",
 405                 "KRB5_CCACHE",
 406                 "GNUPGHOME",
 407         );
 408
 409         my $localenv = undef;
 410         foreach my $key (@keys) {
 411                 my $v = return_env_value($givenenv, $overwrite, $key);
 412                 $localenv->{$key} = $v if defined($v);
 413         }
 414
 415         my $cmd_env = "NSS_WRAPPER_HOSTS='$localenv->{NSS_WRAPPER_HOSTS}' ";
 416         $cmd_env .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$localenv->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 417         if (defined($localenv->{RESOLV_WRAPPER_CONF})) {
 418                 $cmd_env .= "RESOLV_WRAPPER_CONF=\"$localenv->{RESOLV_WRAPPER_CONF}\" ";
 419         } else {
 420                 $cmd_env .= "RESOLV_WRAPPER_HOSTS=\"$localenv->{RESOLV_WRAPPER_HOSTS}\" ";
 421         }
 422         if (defined($localenv->{GNUTLS_FORCE_FIPS_MODE})) {
 423                 $cmd_env .= "GNUTLS_FORCE_FIPS_MODE=$localenv->{GNUTLS_FORCE_FIPS_MODE} ";
 424         }
 425         if (defined($localenv->{OPENSSL_FORCE_FIPS_MODE})) {
 426                 $cmd_env .= "OPENSSL_FORCE_FIPS_MODE=$localenv->{OPENSSL_FORCE_FIPS_MODE} ";
 427         }
 428         $cmd_env .= "KRB5_CONFIG=\"$localenv->{KRB5_CONFIG}\" ";
 429         $cmd_env .= "KRB5CCNAME=\"$localenv->{KRB5_CCACHE}\" ";
 430         $cmd_env .= "RESOLV_CONF=\"$localenv->{RESOLV_CONF}\" ";
 431         $cmd_env .= "GNUPGHOME=\"$localenv->{GNUPGHOME}\" ";
 432
 433         return $cmd_env;
 434 }
 435
 436 # Sets up a forest trust namespace.
 437 # (Note this is different to kernel namespaces, setup by the
 438 # USE_NAMESPACES=1 option)
 439 sub setup_namespaces
 440 {
 441         my ($self, $localenv, $upn_array, $spn_array) = @_;
 442
 443         @{$upn_array} = [] unless defined($upn_array);
 444         my $upn_args = "";
 445         foreach my $upn (@{$upn_array}) {
 446                 $upn_args .= " --add-upn-suffix=$upn";
 447         }
 448
 449         @{$spn_array} = [] unless defined($spn_array);
 450         my $spn_args = "";
 451         foreach my $spn (@{$spn_array}) {
 452                 $spn_args .= " --add-spn-suffix=$spn";
 453         }
 454
 455         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 456
 457         my $cmd_env = $self->get_cmd_env_vars($localenv);
 458
 459         my $cmd_config = " $localenv->{CONFIGURATION}";
 460
 461         my $namespaces = $cmd_env;
 462         $namespaces .= " $samba_tool domain trust namespaces $upn_args $spn_args";
 463         $namespaces .= $cmd_config;
 464         unless (system($namespaces) == 0) {
 465                 warn("Failed to add namespaces \n$namespaces");
 466                 return;
 467         }
 468
 469         return;
 470 }
 471
 472 sub setup_trust($$$$$)
 473 {
 474         my ($self, $localenv, $remoteenv, $type, $extra_args) = @_;
 475
 476         $localenv->{TRUST_SERVER} = $remoteenv->{SERVER};
 477
 478         $localenv->{TRUST_USERNAME} = $remoteenv->{USERNAME};
 479         $localenv->{TRUST_PASSWORD} = $remoteenv->{PASSWORD};
 480         $localenv->{TRUST_DOMAIN} = $remoteenv->{DOMAIN};
 481         $localenv->{TRUST_REALM} = $remoteenv->{REALM};
 482         $localenv->{TRUST_DOMSID} = $remoteenv->{DOMSID};
 483
 484         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 485
 486         # setup the trust
 487         my $cmd_env = $self->get_cmd_env_vars($localenv);
 488
 489         my $cmd_config = " $localenv->{CONFIGURATION}";
 490         my $cmd_creds = $cmd_config;
 491         $cmd_creds .= " -U$localenv->{TRUST_DOMAIN}\\\\$localenv->{TRUST_USERNAME}\%$localenv->{TRUST_PASSWORD}";
 492
 493         my $create = $cmd_env;
 494         $create .= " $samba_tool domain trust create --type=${type} $localenv->{TRUST_REALM}";
 495         $create .= " $extra_args";
 496         $create .= $cmd_creds;
 497         unless (system($create) == 0) {
 498                 warn("Failed to create trust \n$create");
 499                 return undef;
 500         }
 501
 502         my $groupname = "g_$localenv->{TRUST_DOMAIN}";
 503         my $groupadd = $cmd_env;
 504         $groupadd .= " $samba_tool group add '$groupname' --group-scope=Domain $cmd_config";
 505         unless (system($groupadd) == 0) {
 506                 warn("Failed to create group \n$groupadd");
 507                 return undef;
 508         }
 509         my $groupmem = $cmd_env;
 510         $groupmem .= " $samba_tool group addmembers '$groupname' '$localenv->{TRUST_DOMSID}-513' $cmd_config";
 511         unless (system($groupmem) == 0) {
 512                 warn("Failed to add group member \n$groupmem");
 513                 return undef;
 514         }
 515
 516         return $localenv
 517 }
 518
 519 sub provision_raw_prepare($$$$$$$$$$$$$$)
 520 {
 521         my ($self,
 522             $prefix,
 523             $server_role,
 524             $hostname,
 525             $domain,
 526             $realm,
 527             $samsid,
 528             $functional_level,
 529             $password,
 530             $kdc_ipv4,
 531             $kdc_ipv6,
 532             $force_fips_mode,
 533             $extra_provision_options) = @_;
 534         my $ctx;
 535         my $python_cmd = "";
 536         if (defined $ENV{PYTHON}) {
 537                 $python_cmd = $ENV{PYTHON} . " ";
 538         }
 539         $ctx->{python} = $python_cmd;
 540         my $netbiosname = uc($hostname);
 541
 542         unless(-d $prefix or mkdir($prefix, 0777)) {
 543                 warn("Unable to create $prefix");
 544                 return undef;
 545         }
 546         my $prefix_abs = abs_path($prefix);
 547
 548         die ("prefix=''") if $prefix_abs eq "";
 549         die ("prefix='/'") if $prefix_abs eq "/";
 550
 551         unless (system("rm -rf $prefix_abs/*") == 0) {
 552                 warn("Unable to clean up");
 553         }
 554
 555
 556         my $swiface = Samba::get_interface($hostname);
 557
 558         $ctx->{prefix} = $prefix;
 559         $ctx->{prefix_abs} = $prefix_abs;
 560
 561         $ctx->{server_role} = $server_role;
 562         $ctx->{hostname} = $hostname;
 563         $ctx->{netbiosname} = $netbiosname;
 564         $ctx->{swiface} = $swiface;
 565         $ctx->{password} = $password;
 566         $ctx->{kdc_ipv4} = $kdc_ipv4;
 567         $ctx->{kdc_ipv6} = $kdc_ipv6;
 568         $ctx->{force_fips_mode} = $force_fips_mode;
 569         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
 570         if ($functional_level eq "2000") {
 571                 $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc";
 572         }
 573
 574 #
 575 # Set smbd log level here.
 576 #
 577         $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
 578         $ctx->{username} = "Administrator";
 579         $ctx->{domain} = $domain;
 580         $ctx->{realm} = uc($realm);
 581         $ctx->{dnsname} = lc($realm);
 582         $ctx->{samsid} = $samsid;
 583
 584         $ctx->{functional_level} = $functional_level;
 585
 586         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 587         chomp $unix_name;
 588         $ctx->{unix_name} = $unix_name;
 589         $ctx->{unix_uid} = $>;
 590         my @mygid = split(" ", $();
 591         $ctx->{unix_gid} = $mygid[0];
 592         $ctx->{unix_gids_str} = $);
 593         @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
 594
 595         $ctx->{etcdir} = "$prefix_abs/etc";
 596         $ctx->{piddir} = "$prefix_abs/pid";
 597         $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
 598         $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
 599         $ctx->{krb5_ccache} = "$prefix_abs/krb5_ccache";
 600         $ctx->{mitkdc_conf} = "$ctx->{etcdir}/mitkdc.conf";
 601         $ctx->{gnupghome} = "$prefix_abs/gnupg";
 602         $ctx->{privatedir} = "$prefix_abs/private";
 603         $ctx->{binddnsdir} = "$prefix_abs/bind-dns";
 604         $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
 605         $ctx->{lockdir} = "$prefix_abs/lockdir";
 606         $ctx->{logdir} = "$prefix_abs/logs";
 607         $ctx->{statedir} = "$prefix_abs/statedir";
 608         $ctx->{cachedir} = "$prefix_abs/cachedir";
 609         $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
 610         $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
 611         $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
 612         $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
 613         $ctx->{nsswrap_hosts} = "$ENV{SELFTEST_PREFIX}/hosts";
 614         $ctx->{nsswrap_hostname} = "$ctx->{hostname}.$ctx->{dnsname}";
 615         if ($ENV{SAMBA_DNS_FAKING}) {
 616                 $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 617                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces --use-file=$ctx->{dns_host_file}";
 618                 $ctx->{samba_dnsupdate} = $python_cmd .  $ctx->{samba_dnsupdate};
 619         } else {
 620                 $ctx->{samba_dnsupdate} = "$ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate -s $ctx->{smb_conf} --all-interfaces";
 621                 $ctx->{samba_dnsupdate} = $python_cmd .  $ctx->{samba_dnsupdate};
 622                 $ctx->{use_resolv_wrapper} = 1;
 623         }
 624
 625         my $dns_hub = $self->get_dns_hub_env();
 626         $ctx->{resolv_conf} = $dns_hub->{RESOLV_CONF};
 627
 628         $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
 629
 630         $ctx->{ipv4} = Samba::get_ipv4_addr($hostname);
 631         $ctx->{ipv6} = Samba::get_ipv6_addr($hostname);
 632
 633         push(@{$ctx->{directories}}, $ctx->{privatedir});
 634         push(@{$ctx->{directories}}, $ctx->{binddnsdir});
 635         push(@{$ctx->{directories}}, $ctx->{etcdir});
 636         push(@{$ctx->{directories}}, $ctx->{piddir});
 637         push(@{$ctx->{directories}}, $ctx->{lockdir});
 638         push(@{$ctx->{directories}}, $ctx->{logdir});
 639         push(@{$ctx->{directories}}, $ctx->{statedir});
 640         push(@{$ctx->{directories}}, $ctx->{cachedir});
 641
 642         $ctx->{smb_conf_extra_options} = "";
 643
 644         my @provision_options = ();
 645         push (@provision_options, "GNUPGHOME=\"$ctx->{gnupghome}\"");
 646         push (@provision_options, "KRB5_CONFIG=\"$ctx->{krb5_conf}\"");
 647         push (@provision_options, "KRB5CCNAME=\"$ctx->{krb5_ccache}\"");
 648         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
 649         push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
 650         push (@provision_options, "NSS_WRAPPER_HOSTS=\"$ctx->{nsswrap_hosts}\"");
 651         push (@provision_options, "NSS_WRAPPER_HOSTNAME=\"$ctx->{nsswrap_hostname}\"");
 652         if (defined($ctx->{use_resolv_wrapper})) {
 653                 push (@provision_options, "RESOLV_WRAPPER_CONF=\"$ctx->{resolv_conf}\"");
 654                 push (@provision_options, "RESOLV_CONF=\"$ctx->{resolv_conf}\"");
 655         } else {
 656                 push (@provision_options, "RESOLV_WRAPPER_HOSTS=\"$ctx->{dns_host_file}\"");
 657         }
 658         if (defined($ctx->{force_fips_mode})) {
 659                 push (@provision_options, "GNUTLS_FORCE_FIPS_MODE=1");
 660                 push (@provision_options, "OPENSSL_FORCE_FIPS_MODE=1");
 661         }
 662
 663         if (defined($ENV{GDB_PROVISION})) {
 664                 push (@provision_options, "gdb --args");
 665                 if (!defined($ENV{PYTHON})) {
 666                     push (@provision_options, "env");
 667                     push (@provision_options, "python");
 668                 }
 669         }
 670         if (defined($ENV{VALGRIND_PROVISION})) {
 671                 push (@provision_options, "valgrind");
 672                 if (!defined($ENV{PYTHON})) {
 673                     push (@provision_options, "env");
 674                     push (@provision_options, "python");
 675                 }
 676         }
 677
 678         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 679
 680         push (@provision_options, $samba_tool);
 681         push (@provision_options, "domain");
 682         push (@provision_options, "provision");
 683         push (@provision_options, "--configfile=$ctx->{smb_conf}");
 684         push (@provision_options, "--host-name=$ctx->{hostname}");
 685         push (@provision_options, "--host-ip=$ctx->{ipv4}");
 686         push (@provision_options, "--quiet");
 687         push (@provision_options, "--domain=$ctx->{domain}");
 688         push (@provision_options, "--realm=$ctx->{realm}");
 689         if (defined($ctx->{samsid})) {
 690                 push (@provision_options, "--domain-sid=$ctx->{samsid}");
 691         }
 692         push (@provision_options, "--adminpass=$ctx->{password}");
 693         push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
 694         push (@provision_options, "--machinepass=machine$ctx->{password}");
 695         push (@provision_options, "--root=$ctx->{unix_name}");
 696         push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
 697         push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
 698
 699         @{$ctx->{provision_options}} = @provision_options;
 700
 701         if (defined($extra_provision_options)) {
 702                 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
 703         }
 704
 705         return $ctx;
 706 }
 707
 708 sub has_option
 709 {
 710         my ($self, $keyword, @options_list) = @_;
 711
 712         # convert the options-list to a hash-map for easy keyword lookup
 713         my %options_dict = map { $_ => 1 } @options_list;
 714
 715         return exists $options_dict{$keyword};
 716 }
 717
 718 #
 719 # Step1 creates the basic configuration
 720 #
 721 sub provision_raw_step1($$)
 722 {
 723         my ($self, $ctx) = @_;
 724
 725         mkdir($_, 0777) foreach (@{$ctx->{directories}});
 726
 727         ##
 728         ## lockdir and piddir must be 0755
 729         ##
 730         chmod 0755, $ctx->{lockdir};
 731         chmod 0755, $ctx->{piddir};
 732
 733         unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
 734                 warn("can't open $ctx->{smb_conf}$?");
 735                 return undef;
 736         }
 737
 738         Samba::copy_gnupg_home($ctx);
 739         Samba::prepare_keyblobs($ctx);
 740         my $crlfile = "$ctx->{tlsdir}/crl.pem";
 741         $crlfile = "" unless -e ${crlfile};
 742
 743         # work out which file server to use. Default to source3 smbd (s3fs),
 744         # unless the source4 NTVFS (smb) file server has been specified
 745         my $services = "-smb +s3fs";
 746         if ($self->has_option("--use-ntvfs", @{$ctx->{provision_options}})) {
 747                 $services = "+smb -s3fs";
 748         }
 749
 750         my $interfaces = Samba::get_interfaces_config($ctx->{netbiosname});
 751
 752         print CONFFILE "
 753 [global]
 754         netbios name = $ctx->{netbiosname}
 755         posix:eadb = $ctx->{statedir}/eadb.tdb
 756         workgroup = $ctx->{domain}
 757         realm = $ctx->{realm}
 758         private dir = $ctx->{privatedir}
 759         binddns dir = $ctx->{binddnsdir}
 760         pid directory = $ctx->{piddir}
 761         ncalrpc dir = $ctx->{ncalrpcdir}
 762         lock dir = $ctx->{lockdir}
 763         state directory = $ctx->{statedir}
 764         cache directory = $ctx->{cachedir}
 765         winbindd socket directory = $ctx->{winbindd_socket_dir}
 766         ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
 767         winbind separator = /
 768         interfaces = $interfaces
 769         tls dh params file = $ctx->{tlsdir}/dhparms.pem
 770         tls crlfile = ${crlfile}
 771         tls verify peer = no_check
 772         panic action = $RealBin/gdb_backtrace \%d
 773         wins support = yes
 774         server role = $ctx->{server_role}
 775         server services = +echo $services
 776         dcerpc endpoint servers = +winreg +srvsvc
 777         notify:inotify = false
 778         ldb:nosync = true
 779         ldap server require strong auth = yes
 780 #We don't want to pass our self-tests if the PAC code is wrong
 781         gensec:require_pac = true
 782         log file = $ctx->{logdir}/log.\%m
 783         log level = $ctx->{server_loglevel}
 784         lanman auth = Yes
 785         ntlm auth = Yes
 786         client min protocol = SMB2_02
 787         server min protocol = SMB2_02
 788         mangled names = yes
 789         dns update command = $ctx->{samba_dnsupdate}
 790         spn update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
 791         gpo update command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba-gpupdate -s $ctx->{smb_conf} --target=Computer
 792         samba kcc command = $ctx->{python} $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_kcc
 793         dreplsrv:periodic_startup_interval = 0
 794         dsdb:schema update allowed = yes
 795
 796         vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
 797
 798         idmap_ldb:use rfc2307=yes
 799         winbind enum users = yes
 800         winbind enum groups = yes
 801
 802         rpc server port:netlogon = 1026
 803         include system krb5 conf = no
 804
 805 ";
 806
 807         print CONFFILE "
 808
 809         # Begin extra options
 810         $ctx->{smb_conf_extra_options}
 811         # End extra options
 812 ";
 813         close(CONFFILE);
 814
 815         #Default the KDC IP to the server's IP
 816         if (not defined($ctx->{kdc_ipv4})) {
 817                 $ctx->{kdc_ipv4} = $ctx->{ipv4};
 818         }
 819         if (not defined($ctx->{kdc_ipv6})) {
 820                 $ctx->{kdc_ipv6} = $ctx->{ipv6};
 821         }
 822
 823         Samba::mk_krb5_conf($ctx);
 824         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
 825
 826         open(PWD, ">$ctx->{nsswrap_passwd}");
 827         if ($ctx->{unix_uid} != 0) {
 828                 print PWD "root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false\n";
 829         }
 830         print PWD "$ctx->{unix_name}:x:$ctx->{unix_uid}:65531:$ctx->{unix_name} gecos:$ctx->{prefix_abs}:/bin/false\n";
 831         print PWD "nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
 832 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 833 pdbtest2:x:65532:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 834 pdbtest3:x:65531:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 835 pdbtest4:x:65530:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 836 ";
 837         close(PWD);
 838         my $uid_rfc2307test = 65533;
 839
 840         open(GRP, ">$ctx->{nsswrap_group}");
 841         if ($ctx->{unix_gid} != 0) {
 842                 print GRP "root:x:0:\n";
 843         }
 844         print GRP "$ctx->{unix_name}:x:$ctx->{unix_gid}:\n";
 845         print GRP "wheel:x:10:
 846 users:x:65531:
 847 nobody:x:65533:
 848 nogroup:x:65534:nobody
 849 ";
 850         close(GRP);
 851         my $gid_rfc2307test = 65532;
 852
 853         my $hostname = lc($ctx->{hostname});
 854         open(HOSTS, ">>$ctx->{nsswrap_hosts}");
 855         if ($hostname eq "localdc") {
 856                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 857                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} $ctx->{dnsname} ${hostname}\n";
 858         } else {
 859                 print HOSTS "$ctx->{ipv4} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 860                 print HOSTS "$ctx->{ipv6} ${hostname}.$ctx->{dnsname} ${hostname}\n";
 861         }
 862         close(HOSTS);
 863
 864         my $configuration = "--configfile=$ctx->{smb_conf}";
 865
 866 #Ensure the config file is valid before we start
 867         my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
 868         if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 869                 system("$testparm -v --suppress-prompt $configuration >&2");
 870                 warn("Failed to create a valid smb.conf configuration $testparm!");
 871                 return undef;
 872         }
 873         unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
 874                 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
 875                 return undef;
 876         }
 877
 878         # Return the environment variables for the new testenv DC.
 879         # Note that we have SERVER_X and DC_SERVER_X variables (which have the same
 880         # value initially). In a 2 DC setup, $DC_SERVER_X will always be the PDC.
 881         my $ret = {
 882                 GNUPGHOME => $ctx->{gnupghome},
 883                 KRB5_CONFIG => $ctx->{krb5_conf},
 884                 KRB5_CCACHE => $ctx->{krb5_ccache},
 885                 MITKDC_CONFIG => $ctx->{mitkdc_conf},
 886                 PIDDIR => $ctx->{piddir},
 887                 SERVER => $ctx->{hostname},
 888                 DC_SERVER => $ctx->{hostname},
 889                 SERVER_IP => $ctx->{ipv4},
 890                 DC_SERVER_IP => $ctx->{ipv4},
 891                 SERVER_IPV6 => $ctx->{ipv6},
 892                 DC_SERVER_IPV6 => $ctx->{ipv6},
 893                 NETBIOSNAME => $ctx->{netbiosname},
 894                 DC_NETBIOSNAME => $ctx->{netbiosname},
 895                 DOMAIN => $ctx->{domain},
 896                 USERNAME => $ctx->{username},
 897                 DC_USERNAME => $ctx->{username},
 898                 REALM => $ctx->{realm},
 899                 DNSNAME => $ctx->{dnsname},
 900                 SAMSID => $ctx->{samsid},
 901                 PASSWORD => $ctx->{password},
 902                 DC_PASSWORD => $ctx->{password},
 903                 LDAPDIR => $ctx->{ldapdir},
 904                 LDAP_INSTANCE => $ctx->{ldap_instance},
 905                 SELFTEST_WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
 906                 NCALRPCDIR => $ctx->{ncalrpcdir},
 907                 LOCKDIR => $ctx->{lockdir},
 908                 STATEDIR => $ctx->{statedir},
 909                 CACHEDIR => $ctx->{cachedir},
 910                 PRIVATEDIR => $ctx->{privatedir},
 911                 BINDDNSDIR => $ctx->{binddnsdir},
 912                 SERVERCONFFILE => $ctx->{smb_conf},
 913                 TESTENV_DIR => $ctx->{prefix_abs},
 914                 CONFIGURATION => $configuration,
 915                 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
 916                 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
 917                 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
 918                 NSS_WRAPPER_HOSTS => $ctx->{nsswrap_hosts},
 919                 NSS_WRAPPER_HOSTNAME => $ctx->{nsswrap_hostname},
 920                 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
 921                 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
 922                 SAMBA_TEST_LOG_POS => 0,
 923                 NSS_WRAPPER_MODULE_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
 924                 NSS_WRAPPER_MODULE_FN_PREFIX => "winbind",
 925                 LOCAL_PATH => $ctx->{share},
 926                 UID_RFC2307TEST => $uid_rfc2307test,
 927                 GID_RFC2307TEST => $gid_rfc2307test,
 928                 SERVER_ROLE => $ctx->{server_role},
 929                 RESOLV_CONF => $ctx->{resolv_conf},
 930         };
 931
 932         if (defined($ctx->{use_resolv_wrapper})) {
 933                 $ret->{RESOLV_WRAPPER_CONF} = $ctx->{resolv_conf};
 934         } else {
 935                 $ret->{RESOLV_WRAPPER_HOSTS} = $ctx->{dns_host_file};
 936         }
 937         if (defined($ctx->{force_fips_mode})) {
 938                 $ret->{GNUTLS_FORCE_FIPS_MODE} = "1",
 939                 $ret->{OPENSSL_FORCE_FIPS_MODE} = "1",
 940         }
 941
 942         if ($ctx->{server_role} eq "domain controller") {
 943                 $ret->{DOMSID} = $ret->{SAMSID};
 944         }
 945
 946         return $ret;
 947 }
 948
 949 #
 950 # Step2 runs the provision script
 951 #
 952 sub provision_raw_step2($$$)
 953 {
 954         my ($self, $ctx, $ret) = @_;
 955
 956         my $ldif;
 957
 958         my $provision_cmd = join(" ", @{$ctx->{provision_options}});
 959         unless (system($provision_cmd) == 0) {
 960                 warn("Unable to provision: \n$provision_cmd\n");
 961                 return undef;
 962         }
 963
 964         my $cmd_env = $self->get_cmd_env_vars($ret);
 965
 966         my $testallowed_account = "testallowed";
 967         my $samba_tool_cmd = ${cmd_env};
 968         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 969             . " user create --configfile=$ctx->{smb_conf} $testallowed_account $ctx->{password}";
 970         unless (system($samba_tool_cmd) == 0) {
 971                 warn("Unable to add testallowed user: \n$samba_tool_cmd\n");
 972                 return undef;
 973         }
 974
 975         my $srv_account = "srv_account";
 976         $samba_tool_cmd = ${cmd_env};
 977         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 978             . " user create --configfile=$ctx->{smb_conf} $srv_account $ctx->{password}";
 979         unless (system($samba_tool_cmd) == 0) {
 980                 warn("Unable to add $srv_account user: \n$samba_tool_cmd\n");
 981                 return undef;
 982         }
 983
 984         $samba_tool_cmd = ${cmd_env};
 985         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 986             . " spn add HOST/$srv_account --configfile=$ctx->{smb_conf} $srv_account";
 987         unless (system($samba_tool_cmd) == 0) {
 988                 warn("Unable to add spn for $srv_account: \n$samba_tool_cmd\n");
 989                 return undef;
 990         }
 991
 992         my $ldbmodify = ${cmd_env};
 993         $ldbmodify .= Samba::bindir_path($self, "ldbmodify");
 994         $ldbmodify .=  " --configfile=$ctx->{smb_conf}";
 995         my $base_dn = "DC=".join(",DC=", split(/\./, $ctx->{realm}));
 996
 997         if ($ctx->{server_role} ne "domain controller") {
 998                 $base_dn = "DC=$ctx->{netbiosname}";
 999         }
1000
1001         my $user_dn = "cn=$testallowed_account,cn=users,$base_dn";
1002         $testallowed_account = "testallowed account";
1003         open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1004             or die "Failed to run $ldbmodify: $!";
1005         print $ldif "dn: $user_dn
1006 changetype: modify
1007 replace: samAccountName
1008 samAccountName: $testallowed_account
1009 -
1010 ";
1011         close($ldif);
1012         unless ($? == 0) {
1013             warn("$ldbmodify failed: $?");
1014             return undef;
1015         }
1016
1017         open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1018             or die "Failed to run $ldbmodify: $!";
1019         print $ldif "dn: $user_dn
1020 changetype: modify
1021 replace: userPrincipalName
1022 userPrincipalName: testallowed upn\@$ctx->{realm}
1023 replace: servicePrincipalName
1024 servicePrincipalName: host/testallowed
1025 -
1026 ";
1027         close($ldif);
1028         unless ($? == 0) {
1029             warn("$ldbmodify failed: $?");
1030             return undef;
1031         }
1032
1033         $samba_tool_cmd = ${cmd_env};
1034         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1035             . " user create --configfile=$ctx->{smb_conf} testdenied $ctx->{password}";
1036         unless (system($samba_tool_cmd) == 0) {
1037                 warn("Unable to add testdenied user: \n$samba_tool_cmd\n");
1038                 return undef;
1039         }
1040
1041         $user_dn = "cn=testdenied,cn=users,$base_dn";
1042         open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1043             or die "Failed to run $ldbmodify: $!";
1044         print $ldif "dn: $user_dn
1045 changetype: modify
1046 replace: userPrincipalName
1047 userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
1048 -
1049 ";
1050         close($ldif);
1051         unless ($? == 0) {
1052             warn("$ldbmodify failed: $?");
1053             return undef;
1054         }
1055
1056         $samba_tool_cmd = ${cmd_env};
1057         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1058             . " user create --configfile=$ctx->{smb_conf} testupnspn $ctx->{password}";
1059         unless (system($samba_tool_cmd) == 0) {
1060                 warn("Unable to add testupnspn user: \n$samba_tool_cmd\n");
1061                 return undef;
1062         }
1063
1064         $user_dn = "cn=testupnspn,cn=users,$base_dn";
1065         open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1066             or die "Failed to run $ldbmodify: $!";
1067         print $ldif "dn: $user_dn
1068 changetype: modify
1069 replace: userPrincipalName
1070 userPrincipalName: http/testupnspn.$ctx->{dnsname}\@$ctx->{realm}
1071 replace: servicePrincipalName
1072 servicePrincipalName: http/testupnspn.$ctx->{dnsname}
1073 -
1074 ";
1075         close($ldif);
1076         unless ($? == 0) {
1077             warn("$ldbmodify failed: $?");
1078             return undef;
1079         }
1080
1081         $samba_tool_cmd = ${cmd_env};
1082         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1083             . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
1084         unless (system($samba_tool_cmd) == 0) {
1085                 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
1086                 return undef;
1087         }
1088
1089         # Create to users alice and bob!
1090         my $user_account_array = ["alice", "bob", "jane", "joe"];
1091
1092         foreach my $user_account (@{$user_account_array}) {
1093                 my $samba_tool_cmd = ${cmd_env};
1094
1095                 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1096                     . " user create --configfile=$ctx->{smb_conf} $user_account Secret007";
1097                 unless (system($samba_tool_cmd) == 0) {
1098                         warn("Unable to create user: $user_account\n$samba_tool_cmd\n");
1099                         return undef;
1100                 }
1101         }
1102
1103         my $group_array = ["Samba Users"];
1104
1105         foreach my $group (@{$group_array}) {
1106                 my $samba_tool_cmd = ${cmd_env};
1107
1108                 $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1109                     . " group add --configfile=$ctx->{smb_conf} \"$group\"";
1110                 unless (system($samba_tool_cmd) == 0) {
1111                         warn("Unable to create group: $group\n$samba_tool_cmd\n");
1112                         return undef;
1113                 }
1114         }
1115
1116         # Add user joe to group "Samba Users"
1117         my $group = "Samba Users";
1118         my $user_account = "joe";
1119
1120         $samba_tool_cmd = ${cmd_env};
1121         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1122             . " group addmembers --configfile=$ctx->{smb_conf} \"$group\" $user_account";
1123         unless (system($samba_tool_cmd) == 0) {
1124                 warn("Unable to add " . $user_account . "to group group : $group\n$samba_tool_cmd\n");
1125                 return undef;
1126         }
1127
1128         $group = "Samba Users";
1129         $user_account = "joe";
1130
1131         $samba_tool_cmd = ${cmd_env};
1132         $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
1133             . " user setprimarygroup --configfile=$ctx->{smb_conf} $user_account \"$group\"";
1134         unless (system($samba_tool_cmd) == 0) {
1135                 warn("Unable to set primary group of user: $user_account\n$samba_tool_cmd\n");
1136                 return undef;
1137         }
1138
1139         # Change the userPrincipalName for jane
1140         $user_dn = "cn=jane,cn=users,$base_dn";
1141
1142         open($ldif, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb")
1143             or die "Failed to run $ldbmodify: $!";
1144         print $ldif "dn: $user_dn
1145 changetype: modify
1146 replace: userPrincipalName
1147 userPrincipalName: jane.doe\@$ctx->{realm}
1148 -
1149 ";
1150         close($ldif);
1151         unless ($? == 0) {
1152             warn("$ldbmodify failed: $?");
1153             return undef;
1154         }
1155
1156         return $ret;
1157 }
1158
1159 sub provision($$$$$$$$$$$)
1160 {
1161         my ($self,
1162             $prefix,
1163             $server_role,
1164             $hostname,
1165             $domain,
1166             $realm,
1167             $functional_level,
1168             $password,
1169             $kdc_ipv4,
1170             $kdc_ipv6,
1171             $force_fips_mode,
1172             $extra_smbconf_options,
1173             $extra_smbconf_shares,
1174             $extra_provision_options) = @_;
1175
1176         my $samsid = Samba::random_domain_sid();
1177
1178         my $ctx = $self->provision_raw_prepare($prefix, $server_role,
1179                                                $hostname,
1180                                                $domain, $realm,
1181                                                $samsid,
1182                                                $functional_level,
1183                                                $password,
1184                                                $kdc_ipv4,
1185                                                $kdc_ipv6,
1186                                                $force_fips_mode,
1187                                                $extra_provision_options);
1188
1189         $ctx->{share} = "$ctx->{prefix_abs}/share";
1190         push(@{$ctx->{directories}}, "$ctx->{share}");
1191         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
1192         push(@{$ctx->{directories}}, "$ctx->{share}/test2");
1193
1194         # precreate directories for printer drivers
1195         push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
1196         push(@{$ctx->{directories}}, "$ctx->{share}/x64");
1197         push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
1198
1199         my $msdfs = "no";
1200         $msdfs = "yes" if ($server_role eq "domain controller");
1201         $ctx->{smb_conf_extra_options} = "
1202
1203         max xmit = 32K
1204         server max protocol = SMB2
1205         host msdfs = $msdfs
1206         lanman auth = yes
1207
1208         # fruit:copyfile is a global option
1209         fruit:copyfile = yes
1210
1211         $extra_smbconf_options
1212
1213 [tmp]
1214         path = $ctx->{share}
1215         read only = no
1216         posix:sharedelay = 100000
1217         posix:oplocktimeout = 3
1218         posix:writetimeupdatedelay = 500000
1219
1220 [xcopy_share]
1221         path = $ctx->{share}
1222         read only = no
1223         posix:sharedelay = 100000
1224         posix:oplocktimeout = 3
1225         posix:writetimeupdatedelay = 500000
1226         create mask = 777
1227         force create mode = 777
1228
1229 [posix_share]
1230         path = $ctx->{share}
1231         read only = no
1232         create mask = 0777
1233         force create mode = 0
1234         directory mask = 0777
1235         force directory mode = 0
1236
1237 [test1]
1238         path = $ctx->{share}/test1
1239         read only = no
1240         posix:sharedelay = 100000
1241         posix:oplocktimeout = 3
1242         posix:writetimeupdatedelay = 500000
1243
1244 [test2]
1245         path = $ctx->{share}/test2
1246         read only = no
1247         posix:sharedelay = 100000
1248         posix:oplocktimeout = 3
1249         posix:writetimeupdatedelay = 500000
1250
1251 [cifs]
1252         path = $ctx->{share}/_ignore_cifs_
1253         read only = no
1254         ntvfs handler = cifs
1255         cifs:server = $ctx->{netbiosname}
1256         cifs:share = tmp
1257         cifs:use-s4u2proxy = yes
1258         # There is no username specified here, instead the client is expected
1259         # to log in with kerberos, and the serverwill use delegated credentials.
1260         # Or the server tries s4u2self/s4u2proxy to impersonate the client
1261
1262 [simple]
1263         path = $ctx->{share}
1264         read only = no
1265         ntvfs handler = simple
1266
1267 [sysvol]
1268         path = $ctx->{statedir}/sysvol
1269         read only = no
1270
1271 [netlogon]
1272         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1273         read only = no
1274
1275 [cifsposix]
1276         copy = simple
1277         ntvfs handler = cifsposix
1278
1279 [vfs_fruit]
1280         path = $ctx->{share}
1281         vfs objects = catia fruit streams_xattr acl_xattr
1282         ea support = yes
1283         fruit:resource = file
1284         fruit:metadata = netatalk
1285         fruit:locking = netatalk
1286         fruit:encoding = native
1287
1288 [xattr]
1289         path = $ctx->{share}
1290         # This can be used for testing real fs xattr stuff
1291         vfs objects = streams_xattr acl_xattr
1292
1293 $extra_smbconf_shares
1294 ";
1295
1296         my $ret = $self->provision_raw_step1($ctx);
1297         unless (defined $ret) {
1298                 return undef;
1299         }
1300
1301         return $self->provision_raw_step2($ctx, $ret);
1302 }
1303
1304 # For multi-DC testenvs, we want $DC_SERVER to always be the PDC (i.e. the
1305 # original DC) in the testenv. $SERVER is always the joined DC that we are
1306 # actually running the test against
1307 sub set_pdc_env_vars
1308 {
1309         my ($self, $env, $dcvars) = @_;
1310
1311         $env->{DC_SERVER} = $dcvars->{DC_SERVER};
1312         $env->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1313         $env->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1314         $env->{DC_SERVERCONFFILE} = $dcvars->{SERVERCONFFILE};
1315         $env->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1316         $env->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1317         $env->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1318 }
1319
1320 sub provision_s4member($$$$$)
1321 {
1322         my ($self, $prefix, $dcvars, $hostname, $more_conf) = @_;
1323         print "PROVISIONING MEMBER...\n";
1324         my $extra_smb_conf = "
1325         passdb backend = samba_dsdb
1326 winbindd:use external pipes = true
1327
1328 # the source4 smb server doesn't allow signing by default
1329 server signing = enabled
1330 raw NTLMv2 auth = yes
1331
1332 rpc_server:default = external
1333 rpc_server:svcctl = embedded
1334 rpc_server:srvsvc = embedded
1335 rpc_server:eventlog = embedded
1336 rpc_server:ntsvcs = embedded
1337 rpc_server:winreg = embedded
1338 rpc_server:spoolss = embedded
1339 rpc_daemon:spoolssd = embedded
1340 rpc_server:tcpip = no
1341 # override the new SMB2 only default
1342 client min protocol = CORE
1343 server min protocol = LANMAN1
1344 ";
1345         if ($more_conf) {
1346                 $extra_smb_conf = $extra_smb_conf . $more_conf . "\n";
1347         }
1348         my $extra_provision_options = ["--use-ntvfs"];
1349         my $ret = $self->provision($prefix,
1350                                    "member server",
1351                                    $hostname,
1352                                    $dcvars->{DOMAIN},
1353                                    $dcvars->{REALM},
1354                                    "2008",
1355                                    "locMEMpass3",
1356                                    $dcvars->{SERVER_IP},
1357                                    $dcvars->{SERVER_IPV6},
1358                                    undef,
1359                                    $extra_smb_conf, "",
1360                                    $extra_provision_options);
1361         unless ($ret) {
1362                 return undef;
1363         }
1364
1365         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1366         my $cmd = $self->get_cmd_env_vars($ret);
1367         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1368         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1369         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1370
1371         unless (system($cmd) == 0) {
1372                 warn("Join failed\n$cmd");
1373                 return undef;
1374         }
1375
1376         $ret->{DOMSID} = $dcvars->{DOMSID};
1377         $self->set_pdc_env_vars($ret, $dcvars);
1378
1379         return $ret;
1380 }
1381
1382 sub provision_rpc_proxy($$$)
1383 {
1384         my ($self, $prefix, $dcvars) = @_;
1385         print "PROVISIONING RPC PROXY...\n";
1386
1387         my $extra_smbconf_options = "
1388         passdb backend = samba_dsdb
1389
1390         # rpc_proxy
1391         dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
1392         dcerpc endpoint servers = epmapper, remote
1393         dcerpc_remote:interfaces = rpcecho
1394         dcerpc_remote:allow_anonymous_fallback = yes
1395         # override the new SMB2 only default
1396         client min protocol = CORE
1397         server min protocol = LANMAN1
1398 [cifs_to_dc]
1399         path = /tmp/_ignore_cifs_to_dc_/_none_
1400         read only = no
1401         ntvfs handler = cifs
1402         cifs:server = $dcvars->{SERVER}
1403         cifs:share = cifs
1404         cifs:use-s4u2proxy = yes
1405         # There is no username specified here, instead the client is expected
1406         # to log in with kerberos, and the serverwill use delegated credentials.
1407         # Or the server tries s4u2self/s4u2proxy to impersonate the client
1408
1409 ";
1410
1411         my $extra_provision_options = ["--use-ntvfs"];
1412         my $ret = $self->provision($prefix,
1413                                    "member server",
1414                                    "localrpcproxy",
1415                                    $dcvars->{DOMAIN},
1416                                    $dcvars->{REALM},
1417                                    "2008",
1418                                    "locRPCproxypass4",
1419                                    $dcvars->{SERVER_IP},
1420                                    $dcvars->{SERVER_IPV6},
1421                                    undef,
1422                                    $extra_smbconf_options, "",
1423                                    $extra_provision_options);
1424         unless ($ret) {
1425                 return undef;
1426         }
1427
1428         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1429
1430         # The joind runs in the context of the rpc_proxy/member for now
1431         my $cmd = $self->get_cmd_env_vars($ret);
1432         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
1433         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1434         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1435
1436         unless (system($cmd) == 0) {
1437                 warn("Join failed\n$cmd");
1438                 return undef;
1439         }
1440
1441         # Prepare a context of the DC, but using the local CCACHE.
1442         my $overwrite = undef;
1443         $overwrite->{KRB5_CCACHE} = $ret->{KRB5_CCACHE};
1444         my $dc_cmd_env = $self->get_cmd_env_vars($dcvars, $overwrite);
1445
1446         # Setting up delegation runs in the context of the DC for now
1447         $cmd = $dc_cmd_env;
1448         $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
1449         $cmd .= " $dcvars->{CONFIGURATION}";
1450         print $cmd;
1451
1452         unless (system($cmd) == 0) {
1453                 warn("Delegation failed\n$cmd");
1454                 return undef;
1455         }
1456
1457         # Setting up delegation runs in the context of the DC for now
1458         $cmd = $dc_cmd_env;
1459         $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1460         $cmd .= " $dcvars->{CONFIGURATION}";
1461
1462         unless (system($cmd) == 0) {
1463                 warn("Delegation failed\n$cmd");
1464                 return undef;
1465         }
1466
1467         $ret->{DOMSID} = $dcvars->{DOMSID};
1468         $self->set_pdc_env_vars($ret, $dcvars);
1469
1470         return $ret;
1471 }
1472
1473 sub provision_promoted_dc($$$)
1474 {
1475         my ($self, $prefix, $dcvars) = @_;
1476         print "PROVISIONING PROMOTED DC...\n";
1477
1478         # We do this so that we don't run the provision.  That's the job of 'samba-tool domain dcpromo'.
1479         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1480                                                "promotedvdc",
1481                                                $dcvars->{DOMAIN},
1482                                                $dcvars->{REALM},
1483                                                $dcvars->{SAMSID},
1484                                                "2008",
1485                                                $dcvars->{PASSWORD},
1486                                                $dcvars->{SERVER_IP},
1487                                                $dcvars->{SERVER_IPV6});
1488
1489         $ctx->{smb_conf_extra_options} = "
1490         max xmit = 32K
1491         server max protocol = SMB2
1492
1493         ntlm auth = ntlmv2-only
1494
1495 [sysvol]
1496         path = $ctx->{statedir}/sysvol
1497         read only = yes
1498
1499 [netlogon]
1500         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1501         read only = no
1502
1503 ";
1504
1505         my $ret = $self->provision_raw_step1($ctx);
1506         unless ($ret) {
1507                 return undef;
1508         }
1509
1510         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1511         my $cmd = $self->get_cmd_env_vars($ret);
1512         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1513         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1514         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1515
1516         unless (system($cmd) == 0) {
1517                 warn("Join failed\n$cmd");
1518                 return undef;
1519         }
1520
1521         $samba_tool =  Samba::bindir_path($self, "samba-tool");
1522         $cmd = $self->get_cmd_env_vars($ret);
1523         $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1524         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1525         $cmd .= " --machinepass=machine$ret->{PASSWORD} --dns-backend=BIND9_DLZ";
1526
1527         unless (system($cmd) == 0) {
1528                 warn("Join failed\n$cmd");
1529                 return undef;
1530         }
1531
1532         $self->set_pdc_env_vars($ret, $dcvars);
1533
1534         return $ret;
1535 }
1536
1537 sub provision_vampire_dc($$$)
1538 {
1539         my ($self, $prefix, $dcvars, $fl) = @_;
1540         print "PROVISIONING VAMPIRE DC @ FL $fl...\n";
1541         my $name = "localvampiredc";
1542         my $extra_conf = "";
1543
1544         if ($fl == "2000") {
1545                 $name = "vampire2000dc";
1546         } else {
1547                 $extra_conf = "drs: immediate link sync = yes
1548                        drs: max link sync = 250";
1549         }
1550
1551         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1552         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1553                                                $name,
1554                                                $dcvars->{DOMAIN},
1555                                                $dcvars->{REALM},
1556                                                $dcvars->{DOMSID},
1557                                                $fl,
1558                                                $dcvars->{PASSWORD},
1559                                                $dcvars->{SERVER_IP},
1560                                                $dcvars->{SERVER_IPV6});
1561
1562         $ctx->{smb_conf_extra_options} = "
1563         max xmit = 32K
1564         server max protocol = SMB2
1565
1566         ntlm auth = mschapv2-and-ntlmv2-only
1567         $extra_conf
1568
1569 [sysvol]
1570         path = $ctx->{statedir}/sysvol
1571         read only = yes
1572
1573 [netlogon]
1574         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1575         read only = no
1576
1577 ";
1578
1579         my $ret = $self->provision_raw_step1($ctx);
1580         unless ($ret) {
1581                 return undef;
1582         }
1583
1584         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1585         my $cmd = $self->get_cmd_env_vars($ret);
1586         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1587         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1588         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1589         $cmd .= " --backend-store=mdb";
1590
1591         unless (system($cmd) == 0) {
1592                 warn("Join failed\n$cmd");
1593                 return undef;
1594         }
1595
1596         $self->set_pdc_env_vars($ret, $dcvars);
1597         $ret->{DC_REALM} = $dcvars->{DC_REALM};
1598
1599         return $ret;
1600 }
1601
1602 sub provision_ad_dc_ntvfs($$$)
1603 {
1604         my ($self, $prefix, $extra_provision_options) = @_;
1605
1606         # We keep the old 'winbind' name here in server services to
1607         # ensure upgrades which used that name still work with the now
1608         # alias.
1609
1610         print "PROVISIONING AD DC (NTVFS)...\n";
1611         my $extra_conf_options = "netbios aliases = localDC1-a
1612         server services = +winbind -winbindd
1613         ldap server require strong auth = allow_sasl_over_tls
1614         allow nt4 crypto = yes
1615         raw NTLMv2 auth = yes
1616         lsa over netlogon = yes
1617         rpc server port = 1027
1618         auth event notification = true
1619         dsdb event notification = true
1620         dsdb password event notification = true
1621         dsdb group change notification = true
1622         server schannel = auto
1623         # override the new SMB2 only default
1624         client min protocol = CORE
1625         server min protocol = LANMAN1
1626         ";
1627         push (@{$extra_provision_options}, "--use-ntvfs");
1628         my $ret = $self->provision($prefix,
1629                                    "domain controller",
1630                                    "localdc",
1631                                    "SAMBADOMAIN",
1632                                    "samba.example.com",
1633                                    "2008",
1634                                    "locDCpass1",
1635                                    undef,
1636                                    undef,
1637                                    undef,
1638                                    $extra_conf_options,
1639                                    "",
1640                                    $extra_provision_options);
1641         unless ($ret) {
1642                 return undef;
1643         }
1644
1645         unless($self->add_wins_config("$prefix/private")) {
1646                 warn("Unable to add wins configuration");
1647                 return undef;
1648         }
1649         $ret->{NETBIOSALIAS} = "localdc1-a";
1650         $ret->{DC_REALM} = $ret->{REALM};
1651
1652         return $ret;
1653 }
1654
1655 sub provision_fl2000dc($$)
1656 {
1657         my ($self, $prefix) = @_;
1658
1659         print "PROVISIONING DC WITH FOREST LEVEL 2000...\n";
1660         my $extra_conf_options = "
1661         spnego:simulate_w2k=yes
1662         ntlmssp_server:force_old_spnego=yes
1663 ";
1664         my $extra_provision_options = ["--base-schema=2008_R2"];
1665         # This environment uses plain text secrets
1666         # i.e. secret attributes are not encrypted on disk.
1667         # This allows testing of the --plaintext-secrets option for
1668         # provision
1669         push (@{$extra_provision_options}, "--plaintext-secrets");
1670         my $ret = $self->provision($prefix,
1671                                    "domain controller",
1672                                    "dc5",
1673                                    "SAMBA2000",
1674                                    "samba2000.example.com",
1675                                    "2000",
1676                                    "locDCpass5",
1677                                    undef,
1678                                    undef,
1679                                    undef,
1680                                    $extra_conf_options,
1681                                    "",
1682                                    $extra_provision_options);
1683         unless ($ret) {
1684                 return undef;
1685         }
1686
1687         unless($self->add_wins_config("$prefix/private")) {
1688                 warn("Unable to add wins configuration");
1689                 return undef;
1690         }
1691         $ret->{DC_REALM} = $ret->{REALM};
1692
1693         return $ret;
1694 }
1695
1696 sub provision_fl2003dc($$$)
1697 {
1698         my ($self, $prefix, $dcvars) = @_;
1699         my $ip_addr1 = Samba::get_ipv4_addr("fakednsforwarder1");
1700         my $ip_addr2 = Samba::get_ipv4_addr("fakednsforwarder2");
1701
1702         print "PROVISIONING DC WITH FOREST LEVEL 2003...\n";
1703         my $extra_conf_options = "allow dns updates = nonsecure and secure
1704         dcesrv:header signing = no
1705         dcesrv:max auth states = 0
1706         dns forwarder = $ip_addr1 $ip_addr2";
1707         my $extra_provision_options = ["--base-schema=2008_R2"];
1708         my $ret = $self->provision($prefix,
1709                                    "domain controller",
1710                                    "dc6",
1711                                    "SAMBA2003",
1712                                    "samba2003.example.com",
1713                                    "2003",
1714                                    "locDCpass6",
1715                                    undef,
1716                                    undef,
1717                                    undef,
1718                                    $extra_conf_options,
1719                                    "",
1720                                    $extra_provision_options);
1721         unless (defined $ret) {
1722                 return undef;
1723         }
1724
1725         $ret->{DNS_FORWARDER1} = $ip_addr1;
1726         $ret->{DNS_FORWARDER2} = $ip_addr2;
1727
1728         my @samba_tool_options;
1729         push (@samba_tool_options, Samba::bindir_path($self, "samba-tool"));
1730         push (@samba_tool_options, "domain");
1731         push (@samba_tool_options, "passwordsettings");
1732         push (@samba_tool_options, "set");
1733         push (@samba_tool_options, "--configfile=$ret->{SERVERCONFFILE}");
1734         push (@samba_tool_options, "--min-pwd-age=0");
1735         push (@samba_tool_options, "--history-length=1");
1736
1737         my $samba_tool_cmd = join(" ", @samba_tool_options);
1738
1739         unless (system($samba_tool_cmd) == 0) {
1740                 warn("Unable to set min password age to 0: \n$samba_tool_cmd\n");
1741                 return undef;
1742         }
1743
1744         unless($self->add_wins_config("$prefix/private")) {
1745                 warn("Unable to add wins configuration");
1746                 return undef;
1747         }
1748
1749         return $ret;
1750 }
1751
1752 sub provision_fl2008r2dc($$$)
1753 {
1754         my ($self, $prefix, $dcvars) = @_;
1755
1756         print "PROVISIONING DC WITH FOREST LEVEL 2008r2...\n";
1757         my $extra_conf_options = "
1758         ldap server require strong auth = no
1759         # delay by 10 seconds, 10^7 usecs
1760         ldap_server:delay_expire_disconnect = 10000
1761 ";
1762         my $extra_provision_options = ["--base-schema=2008_R2"];
1763         my $ret = $self->provision($prefix,
1764                                    "domain controller",
1765                                    "dc7",
1766                                    "SAMBA2008R2",
1767                                    "samba2008R2.example.com",
1768                                    "2008_R2",
1769                                    "locDCpass7",
1770                                    undef,
1771                                    undef,
1772                                    undef,
1773                                    $extra_conf_options,
1774                                    "",
1775                                    $extra_provision_options);
1776         unless (defined $ret) {
1777                 return undef;
1778         }
1779
1780         unless ($self->add_wins_config("$prefix/private")) {
1781                 warn("Unable to add wins configuration");
1782                 return undef;
1783         }
1784         $ret->{DC_REALM} = $ret->{REALM};
1785
1786         return $ret;
1787 }
1788
1789
1790 sub provision_rodc($$$)
1791 {
1792         my ($self, $prefix, $dcvars) = @_;
1793         print "PROVISIONING RODC...\n";
1794
1795         # We do this so that we don't run the provision.  That's the job of 'net join RODC'.
1796         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1797                                                "rodc",
1798                                                $dcvars->{DOMAIN},
1799                                                $dcvars->{REALM},
1800                                                $dcvars->{DOMSID},
1801                                                "2008",
1802                                                $dcvars->{PASSWORD},
1803                                                $dcvars->{SERVER_IP},
1804                                                $dcvars->{SERVER_IPV6});
1805         unless ($ctx) {
1806                 return undef;
1807         }
1808
1809         $ctx->{share} = "$ctx->{prefix_abs}/share";
1810         push(@{$ctx->{directories}}, "$ctx->{share}");
1811
1812         $ctx->{smb_conf_extra_options} = "
1813         max xmit = 32K
1814         server max protocol = SMB2
1815         password server = $dcvars->{DC_SERVER}
1816
1817 [sysvol]
1818         path = $ctx->{statedir}/sysvol
1819         read only = yes
1820
1821 [netlogon]
1822         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1823         read only = yes
1824
1825 [tmp]
1826         path = $ctx->{share}
1827         read only = no
1828         posix:sharedelay = 10000
1829         posix:oplocktimeout = 3
1830         posix:writetimeupdatedelay = 50000
1831
1832 ";
1833
1834         my $ret = $self->provision_raw_step1($ctx);
1835         unless ($ret) {
1836                 return undef;
1837         }
1838
1839         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1840         my $cmd = $self->get_cmd_env_vars($ret);
1841         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1842         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1843         $cmd .= " --server=$dcvars->{DC_SERVER}";
1844
1845         unless (system($cmd) == 0) {
1846                 warn("RODC join failed\n$cmd");
1847                 return undef;
1848         }
1849
1850         # This ensures deterministic behaviour for tests that want to have the 'testallowed account'
1851         # user password verified on the RODC
1852         my $testallowed_account = "testallowed account";
1853         $cmd = $self->get_cmd_env_vars($ret);
1854         $cmd .= "$samba_tool rodc preload '$testallowed_account' $ret->{CONFIGURATION}";
1855         $cmd .= " --server=$dcvars->{DC_SERVER}";
1856
1857         unless (system($cmd) == 0) {
1858                 warn("RODC join failed\n$cmd");
1859                 return undef;
1860         }
1861
1862         # we overwrite the kdc after the RODC join
1863         # so that use the RODC as kdc and test
1864         # the proxy code
1865         $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1866         $ctx->{kdc_ipv6} = $ret->{SERVER_IPV6};
1867         Samba::mk_krb5_conf($ctx);
1868         Samba::mk_mitkdc_conf($ctx, abs_path(Samba::bindir_path($self, "shared")));
1869
1870         $self->set_pdc_env_vars($ret, $dcvars);
1871
1872         return $ret;
1873 }
1874
1875 sub read_config_h($)
1876 {
1877         my ($name) = @_;
1878         my %ret;
1879         open(LF, "<$name") or die("unable to read $name: $!");
1880         while (<LF>) {
1881                 chomp;
1882                 next if not (/^#define /);
1883                 if (/^#define (.*?)[ \t]+(.*?)$/) {
1884                         $ret{$1} = $2;
1885                         next;
1886                 }
1887                 if (/^#define (.*?)[ \t]+$/) {
1888                         $ret{$1} = 1;;
1889                         next;
1890                 }
1891         }
1892         close(LF);
1893         return \%ret;
1894 }
1895
1896 sub provision_ad_dc($$$$$$$)
1897 {
1898         my ($self,
1899             $prefix,
1900             $hostname,
1901             $domain,
1902             $realm,
1903             $force_fips_mode,
1904             $smbconf_args,
1905             $extra_provision_options) = @_;
1906
1907         my $prefix_abs = abs_path($prefix);
1908
1909         my $bindir_abs = abs_path($self->{bindir});
1910         my $lockdir="$prefix_abs/lockdir";
1911         my $conffile="$prefix_abs/etc/smb.conf";
1912
1913         my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
1914         if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} // '' eq "1") {
1915                 $require_mutexes = "";
1916         }
1917
1918         my $config_h = {};
1919
1920         if (defined($ENV{CONFIG_H})) {
1921                 $config_h = read_config_h($ENV{CONFIG_H});
1922         }
1923
1924         my $password_hash_gpg_key_ids = "password hash gpg key ids = 4952E40301FAB41A";
1925         $password_hash_gpg_key_ids = "" unless defined($config_h->{HAVE_GPGME});
1926
1927         my $extra_smbconf_options = "
1928         xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1929
1930         dbwrap_tdb_mutexes:* = yes
1931         ${require_mutexes}
1932
1933         ${password_hash_gpg_key_ids}
1934
1935         kernel oplocks = no
1936         kernel change notify = no
1937         smb2 leases = no
1938
1939         logging = file
1940         printing = bsd
1941         printcap name = /dev/null
1942
1943         max protocol = SMB3
1944         read only = no
1945
1946         smbd:sharedelay = 100000
1947         smbd:writetimeupdatedelay = 500000
1948         create mask = 755
1949         dos filemode = yes
1950         check parent directory delete on close = yes
1951
1952         dcerpc endpoint servers = -winreg -srvsvc
1953
1954         printcap name = /dev/null
1955
1956         addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1957         deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1958
1959         printing = vlp
1960         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1961         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1962         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1963         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1964         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1965         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1966         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1967         lpq cache time = 0
1968         print notify backchannel = yes
1969
1970         server schannel = auto
1971         auth event notification = true
1972         dsdb event notification = true
1973         dsdb password event notification = true
1974         dsdb group change notification = true
1975         $smbconf_args
1976 ";
1977
1978         my $extra_smbconf_shares = "
1979
1980 [tmpenc]
1981         copy = tmp
1982         smb encrypt = required
1983
1984 [tmpcase]
1985         copy = tmp
1986         case sensitive = yes
1987
1988 [tmpguest]
1989         copy = tmp
1990         guest ok = yes
1991
1992 [hideunread]
1993         copy = tmp
1994         hide unreadable = yes
1995
1996 [durable]
1997         copy = tmp
1998         kernel share modes = no
1999         kernel oplocks = no
2000         posix locking = no
2001
2002 [print\$]
2003         copy = tmp
2004
2005 [print1]
2006         copy = tmp
2007         printable = yes
2008
2009 [print2]
2010         copy = print1
2011 [print3]
2012         copy = print1
2013 [print4]
2014         copy = print1
2015         guest ok = yes
2016 [lp]
2017         copy = print1
2018 ";
2019
2020         push (@{$extra_provision_options}, "--backend-store=mdb");
2021         print "PROVISIONING AD DC...\n";
2022         my $ret = $self->provision($prefix,
2023                                    "domain controller",
2024                                    $hostname,
2025                                    $domain,
2026                                    $realm,
2027                                    "2008",
2028                                    "locDCpass1",
2029                                    undef,
2030                                    undef,
2031                                    $force_fips_mode,
2032                                    $extra_smbconf_options,
2033                                    $extra_smbconf_shares,
2034                                    $extra_provision_options);
2035         unless (defined $ret) {
2036                 return undef;
2037         }
2038
2039         unless($self->add_wins_config("$prefix/private")) {
2040                 warn("Unable to add wins configuration");
2041                 return undef;
2042         }
2043
2044         return $ret;
2045 }
2046
2047 sub provision_chgdcpass($$)
2048 {
2049         my ($self, $prefix) = @_;
2050
2051         print "PROVISIONING CHGDCPASS...\n";
2052         # This environment disallows the use of this password
2053         # (and also removes the default AD complexity checks)
2054         my $unacceptable_password = "Paßßword-widk3Dsle32jxdBdskldsk55klASKQ";
2055         my $extra_smb_conf = "
2056         check password script = $self->{srcdir}/selftest/checkpassword_arg1.sh ${unacceptable_password}
2057         allow dcerpc auth level connect:lsarpc = yes
2058         dcesrv:max auth states = 8
2059 ";
2060         my $extra_provision_options = ["--dns-backend=BIND9_DLZ"];
2061         my $ret = $self->provision($prefix,
2062                                    "domain controller",
2063                                    "chgdcpass",
2064                                    "CHDCDOMAIN",
2065                                    "chgdcpassword.samba.example.com",
2066                                    "2008",
2067                                    "chgDCpass1",
2068                                    undef,
2069                                    undef,
2070                                    undef,
2071                                    $extra_smb_conf,
2072                                    "",
2073                                    $extra_provision_options);
2074         unless (defined $ret) {
2075                 return undef;
2076         }
2077
2078         unless($self->add_wins_config("$prefix/private")) {
2079                 warn("Unable to add wins configuration");
2080                 return undef;
2081         }
2082
2083         # Remove secrets.tdb from this environment to test that we
2084         # still start up on systems without the new matching
2085         # secrets.tdb records.
2086         unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
2087                 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
2088                 return undef;
2089         }
2090
2091         $ret->{UNACCEPTABLE_PASSWORD} = $unacceptable_password;
2092
2093         return $ret;
2094 }
2095
2096 sub teardown_env_terminate($$)
2097 {
2098         my ($self, $envvars) = @_;
2099         my $pid;
2100
2101         # This should cause samba to terminate gracefully
2102         my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
2103         my $cmd = "";
2104         $cmd .= "$smbcontrol samba shutdown $envvars->{CONFIGURATION}";
2105         my $ret = system($cmd);
2106         if ($ret != 0) {
2107                 warn "'$cmd' failed with '$ret'\n";
2108         }
2109
2110         # This should cause samba to terminate gracefully
2111         close($envvars->{STDIN_PIPE});
2112
2113         $pid = $envvars->{SAMBA_PID};
2114         my $count = 0;
2115         my $childpid;
2116
2117         # This should give it time to write out the gcov data
2118         until ($count > 15) {
2119             if (Samba::cleanup_child($pid, "samba") != 0) {
2120                 return;
2121             }
2122             sleep(1);
2123             $count++;
2124         }
2125
2126         # After 15 Seconds, work out why this thing is still alive
2127         warn "server process $pid took more than $count seconds to exit, showing backtrace:\n";
2128         system("$self->{srcdir}/selftest/gdb_backtrace $pid");
2129
2130         until ($count > 30) {
2131             if (Samba::cleanup_child($pid, "samba") != 0) {
2132                 return;
2133             }
2134             sleep(1);
2135             $count++;
2136         }
2137
2138         if (kill(0, $pid)) {
2139             warn "server process $pid took more than $count seconds to exit, sending SIGTERM\n";
2140             kill "TERM", $pid;
2141         }
2142
2143         until ($count > 40) {
2144             if (Samba::cleanup_child($pid, "samba") != 0) {
2145                 return;
2146             }
2147             sleep(1);
2148             $count++;
2149         }
2150         # If it is still around, kill it
2151         if (kill(0, $pid)) {
2152             warn "server process $pid took more than $count seconds to exit, killing\n with SIGKILL\n";
2153             kill 9, $pid;
2154         }
2155         return;
2156 }
2157
2158 sub teardown_env($$)
2159 {
2160         my ($self, $envvars) = @_;
2161         teardown_env_terminate($self, $envvars);
2162
2163         print $self->getlog_env($envvars);
2164
2165         return;
2166 }
2167
2168 sub getlog_env($$)
2169 {
2170         my ($self, $envvars) = @_;
2171         my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME} pid $envvars->{SAMBA_PID}\n";
2172         my $out = $title;
2173
2174         open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
2175
2176         seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
2177         while (<LOG>) {
2178                 $out .= $_;
2179         }
2180         $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
2181         close(LOG);
2182
2183         return "" if $out eq $title;
2184
2185         return $out;
2186 }
2187
2188 sub check_env($$)
2189 {
2190         my ($self, $envvars) = @_;
2191         my $samba_pid = $envvars->{SAMBA_PID};
2192
2193         if (not defined($samba_pid)) {
2194             return 0;
2195         } elsif ($samba_pid > 0) {
2196             my $childpid = Samba::cleanup_child($samba_pid, "samba");
2197
2198             if ($childpid == 0) {
2199                 return 1;
2200             }
2201             return 0;
2202         } else {
2203             return 1;
2204         }
2205 }
2206
2207 # Declare the environments Samba4 makes available.
2208 # To be set up, they will be called as
2209 #   samba4->setup_$envname($self, $path, $dep_1_vars, $dep_2_vars, ...)
2210 # The interdependencies between the testenvs are declared below. Some testenvs
2211 # are dependent on another testenv running first, e.g. vampire_dc is dependent
2212 # on ad_dc_ntvfs because vampire_dc joins ad_dc_ntvfs's domain. All DCs are
2213 # dependent on dns_hub, which handles resolving DNS queries for the realm.
2214 %Samba4::ENV_DEPS = (
2215         # name               => [dep_1, dep_2, ...],
2216         dns_hub              => [],
2217         ad_dc_ntvfs          => ["dns_hub"],
2218         ad_dc_fips           => ["dns_hub"],
2219         ad_dc                => ["dns_hub"],
2220         ad_dc_smb1           => ["dns_hub"],
2221         ad_dc_smb1_done      => ["ad_dc_smb1"],
2222         ad_dc_no_nss         => ["dns_hub"],
2223         ad_dc_no_ntlm        => ["dns_hub"],
2224
2225         fl2008r2dc           => ["ad_dc"],
2226         fl2003dc             => ["ad_dc"],
2227         fl2000dc             => ["dns_hub"],
2228
2229         vampire_2000_dc      => ["fl2000dc"],
2230         vampire_dc           => ["ad_dc_ntvfs"],
2231         promoted_dc          => ["ad_dc_ntvfs"],
2232
2233         rodc                 => ["ad_dc_ntvfs"],
2234         rpc_proxy            => ["ad_dc_ntvfs"],
2235         chgdcpass            => ["dns_hub"],
2236
2237         s4member_dflt_domain => ["ad_dc_ntvfs"],
2238         s4member             => ["ad_dc_ntvfs"],
2239
2240         # envs that test the server process model
2241         proclimitdc          => ["dns_hub"],
2242         preforkrestartdc     => ["dns_hub"],
2243
2244         # backup/restore testenvs
2245         backupfromdc         => ["dns_hub"],
2246         customdc             => ["dns_hub"],
2247         restoredc            => ["backupfromdc"],
2248         renamedc             => ["backupfromdc"],
2249         offlinebackupdc      => ["backupfromdc"],
2250         labdc                => ["backupfromdc"],
2251
2252         # aliases in order to split autbuild tasks
2253         fl2008dc             => ["ad_dc"],
2254         ad_dc_default        => ["ad_dc"],
2255         ad_dc_default_smb1   => ["ad_dc_smb1"],
2256         ad_dc_default_smb1_done   => ["ad_dc_default_smb1"],
2257         ad_dc_slowtests      => ["ad_dc"],
2258         ad_dc_backup         => ["ad_dc"],
2259
2260         schema_dc      => ["dns_hub"],
2261         schema_pair_dc => ["schema_dc"],
2262
2263         none                 => [],
2264 );
2265
2266 %Samba4::ENV_DEPS_POST = (
2267         schema_dc => ["schema_pair_dc"],
2268 );
2269
2270 sub return_alias_env
2271 {
2272         my ($self, $path, $env) = @_;
2273
2274         # just an alias
2275         return $env;
2276 }
2277
2278 sub setup_fl2008dc
2279 {
2280         my ($self, $path) = @_;
2281
2282         my $extra_args = ["--base-schema=2008_R2"];
2283         my $env = $self->provision_ad_dc_ntvfs($path, $extra_args);
2284         if (defined $env) {
2285                 if (not defined($self->check_or_start($env, "standard"))) {
2286                     warn("Failed to start fl2008dc");
2287                         return undef;
2288                 }
2289         }
2290         return $env;
2291 }
2292
2293 sub setup_ad_dc_default
2294 {
2295         my ($self, $path, $dep_env) = @_;
2296         return $self->return_alias_env($path, $dep_env)
2297 }
2298
2299 sub setup_ad_dc_default_smb1
2300 {
2301         my ($self, $path, $dep_env) = @_;
2302         return $self->return_alias_env($path, $dep_env)
2303 }
2304
2305 sub setup_ad_dc_default_smb1_done
2306 {
2307         my ($self, $path, $dep_env) = @_;
2308         return $self->return_alias_env($path, $dep_env)
2309 }
2310
2311 sub setup_ad_dc_slowtests
2312 {
2313         my ($self, $path, $dep_env) = @_;
2314         return $self->return_alias_env($path, $dep_env)
2315 }
2316
2317 sub setup_ad_dc_backup
2318 {
2319         my ($self, $path, $dep_env) = @_;
2320         return $self->return_alias_env($path, $dep_env)
2321 }
2322
2323 sub setup_s4member
2324 {
2325         my ($self, $path, $dc_vars) = @_;
2326
2327         my $env = $self->provision_s4member($path, $dc_vars, "s4member");
2328
2329         if (defined $env) {
2330                 if (not defined($self->check_or_start($env, "standard"))) {
2331                         return undef;
2332                 }
2333         }
2334
2335         return $env;
2336 }
2337
2338 sub setup_s4member_dflt_domain
2339 {
2340         my ($self, $path, $dc_vars) = @_;
2341
2342         my $env = $self->provision_s4member($path, $dc_vars, "s4member_dflt",
2343                                             "winbind use default domain = yes");
2344
2345         if (defined $env) {
2346                 if (not defined($self->check_or_start($env, "standard"))) {
2347                         return undef;
2348                 }
2349         }
2350
2351         return $env;
2352 }
2353
2354 sub setup_rpc_proxy
2355 {
2356         my ($self, $path, $dc_vars) = @_;
2357
2358         my $env = $self->provision_rpc_proxy($path, $dc_vars);
2359
2360         if (defined $env) {
2361                 if (not defined($self->check_or_start($env, "standard"))) {
2362                         return undef;
2363                 }
2364         }
2365         return $env;
2366 }
2367
2368 sub setup_ad_dc_ntvfs
2369 {
2370         my ($self, $path) = @_;
2371
2372         my $env = $self->provision_ad_dc_ntvfs($path, undef);
2373         if (defined $env) {
2374                 if (not defined($self->check_or_start($env, "standard"))) {
2375                     warn("Failed to start ad_dc_ntvfs");
2376                         return undef;
2377                 }
2378         }
2379         return $env;
2380 }
2381
2382 sub setup_chgdcpass
2383 {
2384         my ($self, $path) = @_;
2385
2386         my $env = $self->provision_chgdcpass($path);
2387         if (defined $env) {
2388                 if (not defined($self->check_or_start($env, "standard"))) {
2389                         return undef;
2390                 }
2391         }
2392         return $env;
2393 }
2394
2395 sub setup_fl2000dc
2396 {
2397         my ($self, $path) = @_;
2398
2399         my $env = $self->provision_fl2000dc($path);
2400         if (defined $env) {
2401                 if (not defined($self->check_or_start($env, "standard"))) {
2402                         return undef;
2403                 }
2404         }
2405
2406         return $env;
2407 }
2408
2409 sub setup_fl2003dc
2410 {
2411         my ($self, $path, $dc_vars) = @_;
2412
2413         my $env = $self->provision_fl2003dc($path);
2414
2415         if (defined $env) {
2416                 if (not defined($self->check_or_start($env, "standard"))) {
2417                         return undef;
2418                 }
2419
2420                 $env = $self->setup_trust($env, $dc_vars, "external", "--no-aes-keys");
2421         }
2422         return $env;
2423 }
2424
2425 sub setup_fl2008r2dc
2426 {
2427         my ($self, $path, $dc_vars) = @_;
2428
2429         my $env = $self->provision_fl2008r2dc($path);
2430
2431         if (defined $env) {
2432                 if (not defined($self->check_or_start($env, "standard"))) {
2433                         return undef;
2434                 }
2435
2436                 my $upn_array = ["$env->{REALM}.upn"];
2437                 my $spn_array = ["$env->{REALM}.spn"];
2438
2439                 $self->setup_namespaces($env, $upn_array, $spn_array);
2440
2441                 $env = $self->setup_trust($env, $dc_vars, "forest", "");
2442         }
2443
2444         return $env;
2445 }
2446
2447 sub setup_vampire_dc
2448 {
2449         return setup_generic_vampire_dc(@_, "2008");
2450 }
2451
2452 sub setup_vampire_2000_dc
2453 {
2454         return setup_generic_vampire_dc(@_, "2000");
2455 }
2456
2457 sub setup_generic_vampire_dc
2458 {
2459         my ($self, $path, $dc_vars, $fl) = @_;
2460
2461         my $env = $self->provision_vampire_dc($path, $dc_vars, $fl);
2462
2463         if (defined $env) {
2464                 if (not defined($self->check_or_start($env, "single"))) {
2465                         return undef;
2466                 }
2467
2468                 # force replicated DC to update repsTo/repsFrom
2469                 # for vampired partitions
2470                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2471
2472                 # as 'vampired' dc may add data in its local replica
2473                 # we need to synchronize data between DCs
2474                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2475                 my $cmd = $self->get_cmd_env_vars($env);
2476                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2477                 $cmd .= " $dc_vars->{CONFIGURATION}";
2478                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2479                 # replicate Configuration NC
2480                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2481                 unless(system($cmd_repl) == 0) {
2482                         warn("Failed to replicate\n$cmd_repl");
2483                         return undef;
2484                 }
2485                 # replicate Default NC
2486                 $cmd_repl = "$cmd \"$base_dn\"";
2487                 unless(system($cmd_repl) == 0) {
2488                         warn("Failed to replicate\n$cmd_repl");
2489                         return undef;
2490                 }
2491
2492                 # Pull in a full set of changes from the main DC
2493                 $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2494                 $cmd = $self->get_cmd_env_vars($env);
2495                 $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2496                 $cmd .= " $dc_vars->{CONFIGURATION}";
2497                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2498                 # replicate Configuration NC
2499                 $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2500                 unless(system($cmd_repl) == 0) {
2501                         warn("Failed to replicate\n$cmd_repl");
2502                         return undef;
2503                 }
2504                 # replicate Default NC
2505                 $cmd_repl = "$cmd \"$base_dn\"";
2506                 unless(system($cmd_repl) == 0) {
2507                         warn("Failed to replicate\n$cmd_repl");
2508                         return undef;
2509                 }
2510         }
2511
2512         return $env;
2513 }
2514
2515 sub setup_promoted_dc
2516 {
2517         my ($self, $path, $dc_vars) = @_;
2518
2519         my $env = $self->provision_promoted_dc($path, $dc_vars);
2520
2521         if (defined $env) {
2522                 if (not defined($self->check_or_start($env, "single"))) {
2523                         return undef;
2524                 }
2525
2526                 # force source and replicated DC to update repsTo/repsFrom
2527                 # for vampired partitions
2528                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2529                 my $cmd = $self->get_cmd_env_vars($env);
2530                 # as 'vampired' dc may add data in its local replica
2531                 # we need to synchronize data between DCs
2532                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2533                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
2534                 $cmd .= " $dc_vars->{CONFIGURATION}";
2535                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2536                 # replicate Configuration NC
2537                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2538                 unless(system($cmd_repl) == 0) {
2539                         warn("Failed to replicate\n$cmd_repl");
2540                         return undef;
2541                 }
2542                 # replicate Default NC
2543                 $cmd_repl = "$cmd \"$base_dn\"";
2544                 unless(system($cmd_repl) == 0) {
2545                         warn("Failed to replicate\n$cmd_repl");
2546                         return undef;
2547                 }
2548         }
2549
2550         return $env;
2551 }
2552
2553 sub setup_rodc
2554 {
2555         my ($self, $path, $dc_vars) = @_;
2556
2557         my $env = $self->provision_rodc($path, $dc_vars);
2558
2559         unless ($env) {
2560                 return undef;
2561         }
2562
2563         if (not defined($self->check_or_start($env, "standard"))) {
2564             return undef;
2565         }
2566
2567         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2568         my $cmd = $self->get_cmd_env_vars($env);
2569
2570         my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
2571         $cmd .= " $samba_tool drs replicate $env->{SERVER} $env->{DC_SERVER}";
2572         $cmd .= " $dc_vars->{CONFIGURATION}";
2573         $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
2574         # replicate Configuration NC
2575         my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
2576         unless(system($cmd_repl) == 0) {
2577             warn("Failed to replicate\n$cmd_repl");
2578             return undef;
2579         }
2580         # replicate Default NC
2581         $cmd_repl = "$cmd \"$base_dn\"";
2582         unless(system($cmd_repl) == 0) {
2583             warn("Failed to replicate\n$cmd_repl");
2584             return undef;
2585         }
2586
2587         return $env;
2588 }
2589
2590 sub _setup_ad_dc
2591 {
2592         my ($self, $path, $conf_opts, $server, $dom) = @_;
2593
2594         # If we didn't build with ADS, pretend this env was never available
2595         if (not $self->{target3}->have_ads()) {
2596                return "UNKNOWN";
2597         }
2598
2599         if (!defined($conf_opts)) {
2600                 $conf_opts = "";
2601         }
2602         if (!defined($server)) {
2603                 $server = "addc";
2604         }
2605         if (!defined($dom)) {
2606                 $dom = "addom.samba.example.com";
2607         }
2608         my $env = $self->provision_ad_dc($path, $server, "ADDOMAIN",
2609                                          $dom,
2610                                          undef,
2611                                          $conf_opts,
2612                                          undef);
2613         unless ($env) {
2614                 return undef;
2615         }
2616
2617         if (not defined($self->check_or_start($env, "prefork"))) {
2618             return undef;
2619         }
2620
2621         my $upn_array = ["$env->{REALM}.upn"];
2622         my $spn_array = ["$env->{REALM}.spn"];
2623
2624         $self->setup_namespaces($env, $upn_array, $spn_array);
2625
2626         return $env;
2627 }
2628
2629 sub setup_ad_dc
2630 {
2631         my ($self, $path) = @_;
2632         return _setup_ad_dc($self, $path, undef, undef, undef);
2633 }
2634
2635 sub setup_ad_dc_smb1
2636 {
2637         my ($self, $path) = @_;
2638         my $conf_opts = "
2639 [global]
2640         client min protocol = CORE
2641         server min protocol = LANMAN1
2642 ";
2643         return _setup_ad_dc($self, $path, $conf_opts, "addcsmb1", "addom2.samba.example.com");
2644 }
2645
2646 sub setup_ad_dc_smb1_done
2647 {
2648         my ($self, $path, $dep_env) = @_;
2649         return $self->return_alias_env($path, $dep_env);
2650 }
2651
2652 sub setup_ad_dc_no_nss
2653 {
2654         my ($self, $path) = @_;
2655
2656         # If we didn't build with ADS, pretend this env was never available
2657         if (not $self->{target3}->have_ads()) {
2658                return "UNKNOWN";
2659         }
2660
2661         my $env = $self->provision_ad_dc($path,
2662                                          "addc_no_nss",
2663                                          "ADNONSSDOMAIN",
2664                                          "adnonssdom.samba.example.com",
2665                                          undef,
2666                                          "",
2667                                          undef);
2668         unless ($env) {
2669                 return undef;
2670         }
2671
2672         $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2673         $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2674
2675         if (not defined($self->check_or_start($env, "single"))) {
2676             return undef;
2677         }
2678
2679         my $upn_array = ["$env->{REALM}.upn"];
2680         my $spn_array = ["$env->{REALM}.spn"];
2681
2682         $self->setup_namespaces($env, $upn_array, $spn_array);
2683
2684         return $env;
2685 }
2686
2687 sub setup_ad_dc_no_ntlm
2688 {
2689         my ($self, $path) = @_;
2690
2691         # If we didn't build with ADS, pretend this env was never available
2692         if (not $self->{target3}->have_ads()) {
2693                return "UNKNOWN";
2694         }
2695
2696         my $env = $self->provision_ad_dc($path,
2697                                          "addc_no_ntlm",
2698                                          "ADNONTLMDOMAIN",
2699                                          "adnontlmdom.samba.example.com",
2700                                          undef,
2701                                          "ntlm auth = disabled",
2702                                          undef);
2703         unless ($env) {
2704                 return undef;
2705         }
2706
2707         if (not defined($self->check_or_start($env, "prefork"))) {
2708             return undef;
2709         }
2710
2711         my $upn_array = ["$env->{REALM}.upn"];
2712         my $spn_array = ["$env->{REALM}.spn"];
2713
2714         $self->setup_namespaces($env, $upn_array, $spn_array);
2715
2716         return $env;
2717 }
2718
2719 sub setup_ad_dc_fips
2720 {
2721         my ($self, $path) = @_;
2722
2723         # If we didn't build with ADS, pretend this env was never available
2724         if (not $self->{target3}->have_ads()) {
2725                return "UNKNOWN";
2726         }
2727
2728         my $env = $self->provision_ad_dc($path,
2729                                          "fipsdc",
2730                                          "FIPSDOMAIN",
2731                                          "fips.samba.example.com",
2732                                          1,
2733                                          "",
2734                                          undef);
2735         unless ($env) {
2736                 return undef;
2737         }
2738
2739         if (not defined($self->check_or_start($env, "prefork"))) {
2740             return undef;
2741         }
2742
2743         my $upn_array = ["$env->{REALM}.upn"];
2744         my $spn_array = ["$env->{REALM}.spn"];
2745
2746         $self->setup_namespaces($env, $upn_array, $spn_array);
2747
2748         return $env;
2749 }
2750
2751 #
2752 # AD DC test environment used solely to test pre-fork process restarts.
2753 # As processes get killed off and restarted it should not be used for other
2754 sub setup_preforkrestartdc
2755 {
2756         my ($self, $path) = @_;
2757
2758         # If we didn't build with ADS, pretend this env was never available
2759         if (not $self->{target3}->have_ads()) {
2760                return "UNKNOWN";
2761         }
2762
2763         # note DC name must be <= 15 chars so we use 'prockill' instead of
2764         # 'preforkrestart'
2765         my $env = $self->provision_ad_dc($path,
2766                                          "prockilldc",
2767                                          "PROCKILLDOMAIN",
2768                                          "prockilldom.samba.example.com",
2769                                          undef,
2770                                          "prefork backoff increment = 5\nprefork maximum backoff=10",
2771                                          undef);
2772         unless ($env) {
2773                 return undef;
2774         }
2775
2776         $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2777         $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2778
2779         if (not defined($self->check_or_start($env, "prefork"))) {
2780             return undef;
2781         }
2782
2783         my $upn_array = ["$env->{REALM}.upn"];
2784         my $spn_array = ["$env->{REALM}.spn"];
2785
2786         $self->setup_namespaces($env, $upn_array, $spn_array);
2787
2788         return $env;
2789 }
2790
2791 #
2792 # ad_dc test environment used solely to test standard process model connection
2793 # process limits. As the limit is set artificially low it should not be used
2794 # for other tests.
2795 sub setup_proclimitdc
2796 {
2797         my ($self, $path) = @_;
2798
2799         # If we didn't build with ADS, pretend this env was never available
2800         if (not $self->{target3}->have_ads()) {
2801                return "UNKNOWN";
2802         }
2803
2804         my $env = $self->provision_ad_dc($path,
2805                                          "proclimitdc",
2806                                          "PROCLIMITDOM",
2807                                          "proclimit.samba.example.com",
2808                                          undef,
2809                                          "max smbd processes = 20",
2810                                          undef);
2811         unless ($env) {
2812                 return undef;
2813         }
2814
2815         $env->{NSS_WRAPPER_MODULE_SO_PATH} = undef;
2816         $env->{NSS_WRAPPER_MODULE_FN_PREFIX} = undef;
2817
2818         if (not defined($self->check_or_start($env, "standard"))) {
2819             return undef;
2820         }
2821
2822         my $upn_array = ["$env->{REALM}.upn"];
2823         my $spn_array = ["$env->{REALM}.spn"];
2824
2825         $self->setup_namespaces($env, $upn_array, $spn_array);
2826
2827         return $env;
2828 }
2829
2830 # Used to test a live upgrade of the schema on a 2 DC network.
2831 sub setup_schema_dc
2832 {
2833         my ($self, $path) = @_;
2834
2835         # provision the PDC using an older base schema
2836         my $provision_args = ["--base-schema=2008_R2", "--backend-store=mdb"];
2837
2838         my $env = $self->provision_ad_dc($path,
2839                                          "liveupgrade1dc",
2840                                          "SCHEMADOMAIN",
2841                                          "schema.samba.example.com",
2842                                          undef,
2843                                          "drs: max link sync = 2",
2844                                          $provision_args);
2845         unless ($env) {
2846                 return undef;
2847         }
2848
2849         if (not defined($self->check_or_start($env, "prefork"))) {
2850             return undef;
2851         }
2852
2853         my $upn_array = ["$env->{REALM}.upn"];
2854         my $spn_array = ["$env->{REALM}.spn"];
2855
2856         $self->setup_namespaces($env, $upn_array, $spn_array);
2857
2858         return $env;
2859 }
2860
2861 # the second DC in the live schema upgrade pair
2862 sub setup_schema_pair_dc
2863 {
2864         # note: dcvars contains the env info for the dependent testenv ('schema_dc')
2865         my ($self, $prefix, $dcvars) = @_;
2866         print "Preparing SCHEMA UPGRADE PAIR DC...\n";
2867
2868         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "liveupgrade2dc",
2869                                                     $dcvars->{DOMAIN},
2870                                                     $dcvars->{REALM},
2871                                                     $dcvars->{PASSWORD},
2872                                                     "");
2873
2874         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
2875         my $cmd_vars = $self->get_cmd_env_vars($env);
2876
2877         my $join_cmd = $cmd_vars;
2878         $join_cmd .= "$samba_tool domain join $env->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
2879         $join_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} ";
2880         $join_cmd .= " --backend-store=mdb";
2881
2882         my $upgrade_cmd = $cmd_vars;
2883         $upgrade_cmd .= "$samba_tool domain schemaupgrade $dcvars->{CONFIGURATION}";
2884         $upgrade_cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
2885
2886         my $repl_cmd = $cmd_vars;
2887         $repl_cmd .= "$samba_tool drs replicate $env->{SERVER} $dcvars->{SERVER}";
2888         $repl_cmd .= " CN=Schema,CN=Configuration,DC=schema,DC=samba,DC=example,DC=com";
2889         $repl_cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
2890
2891         unless (system($join_cmd) == 0) {
2892                 warn("Join failed\n$join_cmd");
2893                 return undef;
2894         }
2895
2896         $env->{DC_SERVER} = $dcvars->{SERVER};
2897         $env->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
2898         $env->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
2899         $env->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
2900
2901         # start samba for the new DC
2902         if (not defined($self->check_or_start($env, "standard"))) {
2903             return undef;
2904         }
2905
2906         unless (system($upgrade_cmd) == 0) {
2907                 warn("Schema upgrade failed\n$upgrade_cmd");
2908                 return undef;
2909         }
2910
2911         unless (system($repl_cmd) == 0) {
2912                 warn("Post-update schema replication failed\n$repl_cmd");
2913                 return undef;
2914         }
2915
2916         return $env;
2917 }
2918
2919 # Sets up a DC that's solely used to do a domain backup from. We then use the
2920 # backupfrom-DC to create the restore-DC - this proves that the backup/restore
2921 # process will create a Samba DC that will actually start up.
2922 # We don't use the backup-DC for anything else because its domain will conflict
2923 # with the restore DC.
2924 sub setup_backupfromdc
2925 {
2926         my ($self, $path) = @_;
2927
2928         # If we didn't build with ADS, pretend this env was never available
2929         if (not $self->{target3}->have_ads()) {
2930                return "UNKNOWN";
2931         }
2932
2933         my $provision_args = ["--site=Backup-Site"];
2934
2935         my $env = $self->provision_ad_dc($path,
2936                                          "backupfromdc",
2937                                          "BACKUPDOMAIN",
2938                                          "backupdom.samba.example.com",
2939                                          undef,
2940                                          "samba kcc command = /bin/true",
2941                                          $provision_args);
2942         unless ($env) {
2943                 return undef;
2944         }
2945
2946         if (not defined($self->check_or_start($env))) {
2947             return undef;
2948         }
2949
2950         my $upn_array = ["$env->{REALM}.upn"];
2951         my $spn_array = ["$env->{REALM}.spn"];
2952
2953         $self->setup_namespaces($env, $upn_array, $spn_array);
2954
2955         # Set up a dangling forward link to an expunged object
2956         #
2957         # We need this to ensure that the "samba-tool domain backup rename"
2958         # that is part of the creation of the labdc environment can
2959         # cope with this situation on the source DC.
2960
2961         if (not $self->write_ldb_file("$env->{PRIVATEDIR}/sam.ldb", "
2962 dn: ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2963 objectclass: organizationalUnit
2964 -
2965
2966 dn: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2967 objectclass: msExchConfigurationContainer
2968 -
2969
2970 dn: cn=linkfrom,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2971 objectclass: msExchConfigurationContainer
2972 addressBookRoots: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
2973 -
2974
2975 ")) {
2976             return undef;
2977         }
2978         my $ldbdel = Samba::bindir_path($self, "ldbdel");
2979         my $cmd = "$ldbdel -H $env->{PRIVATEDIR}/sam.ldb cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com";
2980
2981         unless(system($cmd) == 0) {
2982                 warn("Failed to delete link target: \n$cmd");
2983                 return undef;
2984         }
2985
2986         # Expunge will ensure that linkto is totally wiped from the DB
2987         my $samba_tool = Samba::bindir_path($self, "samba-tool");
2988         $cmd = "$samba_tool  domain tombstones expunge --tombstone-lifetime=0 $env->{CONFIGURATION}";
2989
2990         unless(system($cmd) == 0) {
2991                 warn("Failed to expunge link target: \n$cmd");
2992                 return undef;
2993         }
2994         return $env;
2995 }
2996
2997 # returns the server/user-auth params needed to run an online backup cmd
2998 sub get_backup_server_args
2999 {
3000         # dcvars contains the env info for the backup DC testenv
3001         my ($self, $dcvars) = @_;
3002         my $server = $dcvars->{DC_SERVER_IP};
3003         my $server_args = "--server=$server ";
3004         $server_args .= "-U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
3005         $server_args .= " $dcvars->{CONFIGURATION}";
3006
3007         return $server_args;
3008 }
3009
3010 # Creates a backup of a running testenv DC
3011 sub create_backup
3012 {
3013         # note: dcvars contains the env info for the backup DC testenv
3014         my ($self, $env, $dcvars, $backupdir, $backup_cmd) = @_;
3015
3016         # get all the env variables we pass in with the samba-tool command
3017         # Note: use the backupfrom-DC's krb5.conf to do the backup
3018         my $overwrite = undef;
3019         $overwrite->{KRB5_CONFIG} = $dcvars->{KRB5_CONFIG};
3020         my $cmd_env = $self->get_cmd_env_vars($env, $overwrite);
3021
3022         # use samba-tool to create a backup from the 'backupfromdc' DC
3023         my $cmd = "";
3024         my $samba_tool = Samba::bindir_path($self, "samba-tool");
3025
3026         $cmd .= "$cmd_env $samba_tool domain backup $backup_cmd";
3027         $cmd .= " --targetdir=$backupdir";
3028
3029         print "Executing: $cmd\n";
3030         unless(system($cmd) == 0) {
3031                 warn("Failed to create backup using: \n$cmd");
3032                 return undef;
3033         }
3034
3035         # get the name of the backup file created
3036         opendir(DIR, $backupdir);
3037         my @files = grep(/\.tar/, readdir(DIR));
3038         closedir(DIR);
3039
3040         if(scalar @files != 1) {
3041                 warn("Backup file not found in directory $backupdir\n");
3042                 return undef;
3043         }
3044         my $backup_file = "$backupdir/$files[0]";
3045         print "Using backup file $backup_file...\n";
3046
3047         return $backup_file;
3048 }
3049
3050 # Restores a backup-file to populate a testenv for a new DC
3051 sub restore_backup_file
3052 {
3053         my ($self, $backup_file, $restore_opts, $restoredir, $smbconf) = @_;
3054
3055         # pass the restore command the testenv's smb.conf that we've already
3056         # generated. But move it to a temp-dir first, so that the restore doesn't
3057         # overwrite it
3058         my $tmpdir = File::Temp->newdir();
3059         my $tmpconf = "$tmpdir/smb.conf";
3060         my $cmd = "cp $smbconf $tmpconf";
3061         unless(system($cmd) == 0) {
3062                 warn("Failed to backup smb.conf using: \n$cmd");
3063                 return -1;
3064         }
3065
3066         my $samba_tool = Samba::bindir_path($self, "samba-tool");
3067         $cmd = "$samba_tool domain backup restore --backup-file=$backup_file";
3068         $cmd .= " --targetdir=$restoredir $restore_opts --configfile=$tmpconf";
3069
3070         print "Executing: $cmd\n";
3071         unless(system($cmd) == 0) {
3072                 warn("Failed to restore backup using: \n$cmd");
3073                 return -1;
3074         }
3075
3076         print "Restore complete\n";
3077         return 0
3078 }
3079
3080 # sets up the initial directory and returns the new testenv's env info
3081 # (without actually doing a 'domain join')
3082 sub prepare_dc_testenv
3083 {
3084         my ($self, $prefix, $dcname, $domain, $realm,
3085                 $password, $conf_options, $dnsupdate_options) = @_;
3086
3087         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
3088                                                $dcname,
3089                                                $domain,
3090                                                $realm,
3091                                                undef,
3092                                                "2008",
3093                                                $password,
3094                                                undef,
3095                                                undef);
3096
3097         # the restore uses a slightly different state-dir location to other testenvs
3098         $ctx->{statedir} = "$ctx->{prefix_abs}/state";
3099         push(@{$ctx->{directories}}, "$ctx->{statedir}");
3100
3101         # add support for sysvol/netlogon/tmp shares
3102         $ctx->{share} = "$ctx->{prefix_abs}/share";
3103         push(@{$ctx->{directories}}, "$ctx->{share}");
3104         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
3105
3106         if (defined($dnsupdate_options)) {
3107                 $ctx->{samba_dnsupdate} .= $dnsupdate_options;
3108         }
3109
3110         $ctx->{smb_conf_extra_options} = "
3111         $conf_options
3112         max xmit = 32K
3113         server max protocol = SMB2
3114         samba kcc command = /bin/true
3115         xattr_tdb:file = $ctx->{statedir}/xattr.tdb
3116
3117 [sysvol]
3118         path = $ctx->{statedir}/sysvol
3119         read only = no
3120
3121 [netlogon]
3122         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
3123         read only = no
3124
3125 [tmp]
3126         path = $ctx->{share}
3127         read only = no
3128         posix:sharedelay = 10000
3129         posix:oplocktimeout = 3
3130         posix:writetimeupdatedelay = 50000
3131
3132 [test1]
3133         path = $ctx->{share}/test1
3134         read only = no
3135         posix:sharedelay = 100000
3136         posix:oplocktimeout = 3
3137         posix:writetimeupdatedelay = 500000
3138 ";
3139
3140         my $env = $self->provision_raw_step1($ctx);
3141
3142     return ($env, $ctx);
3143 }
3144
3145
3146 # Set up a DC testenv solely by using the samba-tool domain backup/restore
3147 # commands. This proves that we can backup an online DC ('backupfromdc') and
3148 # use the backup file to create a valid, working samba DC.
3149 sub setup_restoredc
3150 {
3151         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3152         my ($self, $prefix, $dcvars) = @_;
3153         print "Preparing RESTORE DC...\n";
3154
3155         # we arbitrarily designate the restored DC as having SMBv1 disabled
3156         my $extra_conf = "
3157         server min protocol = SMB2
3158         client min protocol = SMB2
3159         prefork children = 1";
3160         my $dnsupdate_options = " --use-samba-tool --no-credentials";
3161
3162         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "restoredc",
3163                                                     $dcvars->{DOMAIN},
3164                                                     $dcvars->{REALM},
3165                                                     $dcvars->{PASSWORD},
3166                                                     $extra_conf,
3167                                                     $dnsupdate_options);
3168
3169         # create a backup of the 'backupfromdc'
3170         my $backupdir = File::Temp->newdir();
3171         my $server_args = $self->get_backup_server_args($dcvars);
3172         my $backup_args = "online $server_args";
3173         my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3174                                                $backup_args);
3175         unless($backup_file) {
3176                 return undef;
3177         }
3178
3179         # restore the backup file to populate the restore-DC testenv
3180         my $restore_dir = abs_path($prefix);
3181         my $ret = $self->restore_backup_file($backup_file,
3182                                              "--newservername=$env->{SERVER}",
3183                                              $restore_dir, $env->{SERVERCONFFILE});
3184         unless ($ret == 0) {
3185                 return undef;
3186         }
3187
3188         #
3189         # As we create a the same domain as a clone
3190         # we need a separate resolv.conf!
3191         #
3192         $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3193         $ctx->{dns_ipv4} = $ctx->{ipv4};
3194         $ctx->{dns_ipv6} = $ctx->{ipv6};
3195         Samba::mk_resolv_conf($ctx);
3196         $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3197
3198         # start samba for the restored DC
3199         if (not defined($self->check_or_start($env))) {
3200             return undef;
3201         }
3202
3203         return $env;
3204 }
3205
3206 # Set up a DC testenv solely by using the 'samba-tool domain backup rename' and
3207 # restore commands. This proves that we can backup and rename an online DC
3208 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3209 sub setup_renamedc
3210 {
3211         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3212         my ($self, $prefix, $dcvars) = @_;
3213         print "Preparing RENAME DC...\n";
3214         my $extra_conf = "prefork children = 1";
3215
3216         my $realm = "renamedom.samba.example.com";
3217         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "renamedc",
3218                                                     "RENAMEDOMAIN", $realm,
3219                                                     $dcvars->{PASSWORD}, $extra_conf);
3220
3221         # create a backup of the 'backupfromdc' which renames the domain
3222         my $backupdir = File::Temp->newdir();
3223         my $server_args = $self->get_backup_server_args($dcvars);
3224         my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3225         $backup_args .= " --backend-store=tdb";
3226         my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3227                                                $backup_args);
3228         unless($backup_file) {
3229                 return undef;
3230         }
3231
3232         # restore the backup file to populate the rename-DC testenv
3233         my $restore_dir = abs_path($prefix);
3234         my $restore_opts =  "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3235         my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3236                                              $restore_dir, $env->{SERVERCONFFILE});
3237         unless ($ret == 0) {
3238                 return undef;
3239         }
3240
3241         # start samba for the restored DC
3242         if (not defined($self->check_or_start($env))) {
3243             return undef;
3244         }
3245
3246         my $upn_array = ["$env->{REALM}.upn"];
3247         my $spn_array = ["$env->{REALM}.spn"];
3248
3249         $self->setup_namespaces($env, $upn_array, $spn_array);
3250
3251         return $env;
3252 }
3253
3254 # Set up a DC testenv solely by using the 'samba-tool domain backup offline' and
3255 # restore commands. This proves that we do an offline backup of a local DC
3256 # ('backupfromdc') and use the backup file to create a valid, working samba DC.
3257 sub setup_offlinebackupdc
3258 {
3259         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3260         my ($self, $prefix, $dcvars) = @_;
3261         print "Preparing OFFLINE BACKUP DC...\n";
3262         my $extra_conf = "prefork children = 1";
3263         my $dnsupdate_options = " --use-samba-tool --no-credentials";
3264
3265         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "offlinebackupdc",
3266                                                     $dcvars->{DOMAIN},
3267                                                     $dcvars->{REALM},
3268                                                     $dcvars->{PASSWORD},
3269                                                     $extra_conf,
3270                                                     $dnsupdate_options);
3271
3272         # create an offline backup of the 'backupfromdc' target
3273         my $backupdir = File::Temp->newdir();
3274         my $cmd = "offline -s $dcvars->{SERVERCONFFILE}";
3275         my $backup_file = $self->create_backup($env, $dcvars,
3276                                                $backupdir, $cmd);
3277
3278         unless($backup_file) {
3279                 return undef;
3280         }
3281
3282         # restore the backup file to populate the rename-DC testenv
3283         my $restore_dir = abs_path($prefix);
3284         my $restore_opts =  "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3285         my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3286                                              $restore_dir, $env->{SERVERCONFFILE});
3287         unless ($ret == 0) {
3288                 return undef;
3289         }
3290
3291         #
3292         # As we create a the same domain as a clone
3293         # we need a separate resolv.conf!
3294         #
3295         $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3296         $ctx->{dns_ipv4} = $ctx->{ipv4};
3297         $ctx->{dns_ipv6} = $ctx->{ipv6};
3298         Samba::mk_resolv_conf($ctx);
3299         $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3300
3301         # re-create the testenv's krb5.conf (the restore may have overwritten it)
3302         Samba::mk_krb5_conf($ctx);
3303
3304         # start samba for the restored DC
3305         if (not defined($self->check_or_start($env))) {
3306             return undef;
3307         }
3308
3309         return $env;
3310 }
3311
3312 # Set up a DC testenv solely by using the samba-tool 'domain backup rename' and
3313 # restore commands, using the --no-secrets option. This proves that we can
3314 # create a realistic lab environment from an online DC ('backupfromdc').
3315 sub setup_labdc
3316 {
3317         # note: dcvars contains the env info for the dependent testenv ('backupfromdc')
3318         my ($self, $prefix, $dcvars) = @_;
3319         print "Preparing LAB-DOMAIN DC...\n";
3320         my $extra_conf = "prefork children = 1";
3321
3322         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, "labdc",
3323                                                     "LABDOMAIN",
3324                                                     "labdom.samba.example.com",
3325                                                     $dcvars->{PASSWORD}, $extra_conf);
3326
3327         # create a backup of the 'backupfromdc' which renames the domain and uses
3328         # the --no-secrets option to scrub any sensitive info
3329         my $backupdir = File::Temp->newdir();
3330         my $server_args = $self->get_backup_server_args($dcvars);
3331         my $backup_args = "rename $env->{DOMAIN} $env->{REALM} $server_args";
3332         $backup_args .= " --no-secrets --backend-store=mdb";
3333         my $backup_file = $self->create_backup($env, $dcvars, $backupdir,
3334                                                $backup_args);
3335         unless($backup_file) {
3336                 return undef;
3337         }
3338
3339         # restore the backup file to populate the lab-DC testenv
3340         my $restore_dir = abs_path($prefix);
3341         my $restore_opts =  "--newservername=$env->{SERVER} --host-ip=$env->{SERVER_IP}";
3342         my $ret = $self->restore_backup_file($backup_file, $restore_opts,
3343                                              $restore_dir, $env->{SERVERCONFFILE});
3344         unless ($ret == 0) {
3345                 return undef;
3346         }
3347
3348         # because we don't include any secrets in the backup, we need to reset the
3349         # admin user's password back to what the testenv expects
3350         my $samba_tool = Samba::bindir_path($self, "samba-tool");
3351         my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3352         $cmd .= "--newpassword=$env->{PASSWORD} -H $restore_dir/private/sam.ldb";
3353         $cmd .= " $env->{CONFIGURATION}";
3354
3355         unless(system($cmd) == 0) {
3356                 warn("Failed to reset admin's password: \n$cmd");
3357                 return undef;
3358         }
3359
3360         # start samba for the restored DC
3361         if (not defined($self->check_or_start($env))) {
3362             return undef;
3363         }
3364
3365         my $upn_array = ["$env->{REALM}.upn"];
3366         my $spn_array = ["$env->{REALM}.spn"];
3367
3368         $self->setup_namespaces($env, $upn_array, $spn_array);
3369
3370         return $env;
3371 }
3372
3373 # Inspects a backup *.tar.bz2 file and determines the realm/domain it contains
3374 sub get_backup_domain_realm
3375 {
3376         my ($self, $backup_file) = @_;
3377
3378         print "Determining REALM/DOMAIN values in backup...\n";
3379
3380         # The backup will have the correct domain/realm values in the smb.conf.
3381         # So we can work out the env variables the testenv should use based on
3382         # that. Let's start by extracting the smb.conf
3383         my $tar = Archive::Tar->new($backup_file);
3384         my $tmpdir = File::Temp->newdir();
3385         my $smbconf = "$tmpdir/smb.conf";
3386
3387         # note that the filepaths within the tar-file differ slightly for online
3388         # and offline backups
3389         if ($tar->contains_file("etc/smb.conf")) {
3390                 $tar->extract_file("etc/smb.conf", $smbconf);
3391         } elsif ($tar->contains_file("./etc/smb.conf")) {
3392                 $tar->extract_file("./etc/smb.conf", $smbconf);
3393         } else {
3394                 warn("Could not find smb.conf in $backup_file");
3395                 return undef, undef;
3396         }
3397
3398         # make sure we don't try to create locks/sockets in the default install
3399         # location (i.e. /usr/local/samba/)
3400         my $options = "--option=\"private dir = $tmpdir\"";
3401         $options .=  " --option=\"lock dir = $tmpdir\"";
3402
3403         # now use testparm to read the values we're interested in
3404         my $testparm = Samba::bindir_path($self, "testparm");
3405         my $domain = `$testparm $smbconf -sl --parameter-name=WORKGROUP $options`;
3406         my $realm = `$testparm $smbconf -sl --parameter-name=REALM $options`;
3407         chomp $realm;
3408         chomp $domain;
3409         print "Backup-file REALM is $realm, DOMAIN is $domain\n";
3410
3411         return ($domain, $realm);
3412 }
3413
3414 # This spins up a custom testenv that can be based on any backup-file you want.
3415 # This is just intended for manual testing (rather than automated test-cases)
3416 sub setup_customdc
3417 {
3418         my ($self, $prefix) = @_;
3419         print "Preparing CUSTOM RESTORE DC...\n";
3420         my $dc_name = "customdc";
3421         my $password = "locDCpass1";
3422         my $backup_file = $ENV{'BACKUP_FILE'};
3423         my $dnsupdate_options = " --use-samba-tool --no-credentials";
3424
3425         # user must specify a backup file to restore via an ENV variable, i.e.
3426         # BACKUP_FILE=backup-blah.tar.bz2 SELFTEST_TESTENV=customdc make testenv
3427         if (not defined($backup_file)) {
3428                 warn("Please specify BACKUP_FILE");
3429                 return undef;
3430         }
3431
3432         # work out the correct domain/realm env values from the backup-file
3433         my ($domain, $realm) = $self->get_backup_domain_realm($backup_file);
3434         if ($domain eq '' or $realm eq '') {
3435                 warn("Could not determine domain or realm");
3436                 return undef;
3437         }
3438
3439         # create a placeholder directory and smb.conf, as well as the env vars.
3440         my ($env, $ctx) = $self->prepare_dc_testenv($prefix, $dc_name,
3441                                                     $domain, $realm, $password, "",
3442                                                     $dnsupdate_options);
3443
3444         # restore the specified backup file to populate the testenv
3445         my $restore_dir = abs_path($prefix);
3446         my $ret = $self->restore_backup_file($backup_file,
3447                                              "--newservername=$env->{SERVER}",
3448                                              $restore_dir, $env->{SERVERCONFFILE});
3449         unless ($ret == 0) {
3450                 return undef;
3451         }
3452
3453         #
3454         # As we create a the same domain as a clone
3455         # we need a separate resolv.conf!
3456         #
3457         $ctx->{resolv_conf} = "$ctx->{etcdir}/resolv.conf";
3458         $ctx->{dns_ipv4} = $ctx->{ipv4};
3459         $ctx->{dns_ipv6} = $ctx->{ipv6};
3460         Samba::mk_resolv_conf($ctx);
3461         $env->{RESOLV_CONF} = $ctx->{resolv_conf};
3462
3463         # Change the admin password to the testenv default, just in case it's
3464         # different, or in case this was a --no-secrets backup
3465         my $samba_tool = Samba::bindir_path($self, "samba-tool");
3466         my $cmd = "$samba_tool user setpassword $env->{USERNAME} ";
3467         $cmd .= "--newpassword=$password -H $restore_dir/private/sam.ldb";
3468         $cmd .= " $env->{CONFIGURATION}";
3469
3470         unless(system($cmd) == 0) {
3471                 warn("Failed to reset admin's password: \n$cmd");
3472                 return undef;
3473         }
3474
3475         # re-create the testenv's krb5.conf (the restore may have overwritten it,
3476         # if the backup-file was an offline backup)
3477         Samba::mk_krb5_conf($ctx);
3478
3479         # start samba for the restored DC
3480         if (not defined($self->check_or_start($env))) {
3481             return undef;
3482         }
3483
3484         # if this was a backup-rename, then we may need to setup namespaces
3485         my $upn_array = ["$env->{REALM}.upn"];
3486         my $spn_array = ["$env->{REALM}.spn"];
3487
3488         $self->setup_namespaces($env, $upn_array, $spn_array);
3489
3490         return $env;
3491 }
3492
3493 sub setup_none
3494 {
3495         my ($self, $path) = @_;
3496
3497         my $ret = {
3498                 KRB5_CONFIG => abs_path($path) . "/no_krb5.conf",
3499                 SAMBA_PID => -1,
3500         }
3501 }
3502
3503 1;