selftest/target/Samba4.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 package Samba4;
   7
   8 use strict;
   9 use Cwd qw(abs_path);
  10 use FindBin qw($RealBin);
  11 use POSIX;
  12 use SocketWrapper;
  13 use target::Samba;
  14 use target::Samba3;
  15
  16 sub new($$$$$) {
  17         my ($classname, $bindir, $binary_mapping, $ldap, $srcdir, $server_maxtime) = @_;
  18
  19         my $self = {
  20                 vars => {},
  21                 ldap => $ldap,
  22                 bindir => $bindir,
  23                 binary_mapping => $binary_mapping,
  24                 srcdir => $srcdir,
  25                 server_maxtime => $server_maxtime,
  26                 target3 => new Samba3($bindir, $binary_mapping, $srcdir, $server_maxtime)
  27         };
  28         bless $self;
  29         return $self;
  30 }
  31
  32 sub scriptdir_path($$) {
  33         my ($self, $path) = @_;
  34         return "$self->{srcdir}/source4/scripting/$path";
  35 }
  36
  37 sub openldap_start($$$) {
  38 }
  39
  40 sub slapd_start($$)
  41 {
  42         my $count = 0;
  43         my ($self, $env_vars) = @_;
  44         my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
  45
  46         my $uri = $env_vars->{LDAP_URI};
  47
  48         if (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") == 0) {
  49             print "A SLAPD is still listening to $uri before we started the LDAP backend.  Aborting!";
  50             return 1;
  51         }
  52         # running slapd in the background means it stays in the same process group, so it can be
  53         # killed by timelimit
  54         if ($self->{ldap} eq "fedora-ds") {
  55                 system("$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd -D $env_vars->{FEDORA_DS_DIR} -d0 -i $env_vars->{FEDORA_DS_PIDFILE}> $env_vars->{LDAPDIR}/logs 2>&1 &");
  56         } elsif ($self->{ldap} eq "openldap") {
  57                 system("$ENV{OPENLDAP_SLAPD} -d0 -F $env_vars->{SLAPD_CONF_D} -h $uri > $env_vars->{LDAPDIR}/logs 2>&1 &");
  58         }
  59         while (system("$ldbsearch -H $uri -s base -b \"\" supportedLDAPVersion > /dev/null") != 0) {
  60                 $count++;
  61                 if ($count > 40) {
  62                         $self->slapd_stop($env_vars);
  63                         return 0;
  64                 }
  65                 sleep(1);
  66         }
  67         return 1;
  68 }
  69
  70 sub slapd_stop($$)
  71 {
  72         my ($self, $envvars) = @_;
  73         if ($self->{ldap} eq "fedora-ds") {
  74                 system("$envvars->{LDAPDIR}/slapd-$envvars->{LDAP_INSTANCE}/stop-slapd");
  75         } elsif ($self->{ldap} eq "openldap") {
  76                 unless (open(IN, "<$envvars->{OPENLDAP_PIDFILE}")) {
  77                         warn("unable to open slapd pid file: $envvars->{OPENLDAP_PIDFILE}");
  78                         return 0;
  79                 }
  80                 kill 9, <IN>;
  81                 close(IN);
  82         }
  83         return 1;
  84 }
  85
  86 sub check_or_start($$$)
  87 {
  88         my ($self, $env_vars, $process_model) = @_;
  89
  90         return 0 if $self->check_env($env_vars);
  91
  92         # use a pipe for stdin in the child processes. This allows
  93         # those processes to monitor the pipe for EOF to ensure they
  94         # exit when the test script exits
  95         pipe(STDIN_READER, $env_vars->{STDIN_PIPE});
  96
  97         print "STARTING SAMBA...";
  98         my $pid = fork();
  99         if ($pid == 0) {
 100                 # we want out from samba to go to the log file, but also
 101                 # to the users terminal when running 'make test' on the command
 102                 # line. This puts it on stderr on the terminal
 103                 open STDOUT, "| tee $env_vars->{SAMBA_TEST_LOG} 1>&2";
 104                 open STDERR, '>&STDOUT';
 105
 106                 SocketWrapper::set_default_iface($env_vars->{SOCKET_WRAPPER_DEFAULT_IFACE});
 107
 108                 $ENV{KRB5_CONFIG} = $env_vars->{KRB5_CONFIG};
 109                 $ENV{WINBINDD_SOCKET_DIR} = $env_vars->{WINBINDD_SOCKET_DIR};
 110                 $ENV{NMBD_SOCKET_DIR} = $env_vars->{NMBD_SOCKET_DIR};
 111
 112                 $ENV{NSS_WRAPPER_PASSWD} = $env_vars->{NSS_WRAPPER_PASSWD};
 113                 $ENV{NSS_WRAPPER_GROUP} = $env_vars->{NSS_WRAPPER_GROUP};
 114                 $ENV{NSS_WRAPPER_WINBIND_SO_PATH} = $env_vars->{NSS_WRAPPER_WINBIND_SO_PATH};
 115
 116                 $ENV{UID_WRAPPER} = "1";
 117
 118                 $ENV{MAKE_TEST_BINARY} = Samba::bindir_path($self, "samba");
 119                 my @preargs = ();
 120                 my @optargs = ();
 121                 if (defined($ENV{SAMBA_OPTIONS})) {
 122                         @optargs = split(/ /, $ENV{SAMBA_OPTIONS});
 123                 }
 124                 if(defined($ENV{SAMBA_VALGRIND})) {
 125                         @preargs = split(/ /,$ENV{SAMBA_VALGRIND});
 126                 }
 127
 128                 close($env_vars->{STDIN_PIPE});
 129                 open STDIN, ">&", \*STDIN_READER or die "can't dup STDIN_READER to STDIN: $!";
 130
 131                 exec(@preargs, Samba::bindir_path($self, "samba"), "-M", $process_model, "-i", "--maximum-runtime=$self->{server_maxtime}", $env_vars->{CONFIGURATION}, @optargs) or die("Unable to start samba: $!");
 132         }
 133         $env_vars->{SAMBA_PID} = $pid;
 134         print "DONE\n";
 135
 136         close(STDIN_READER);
 137
 138         return $pid;
 139 }
 140
 141 sub wait_for_start($$)
 142 {
 143         my ($self, $testenv_vars) = @_;
 144         my $ret;
 145         # give time for nbt server to register its names
 146         print "delaying for nbt name registration\n";
 147         sleep 2;
 148
 149         # This will return quickly when things are up, but be slow if we
 150         # need to wait for (eg) SSL init
 151         my $nmblookup =  Samba::bindir_path($self, "nmblookup4");
 152         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 153         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 154         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 155         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 156         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 157         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 158         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{SERVER}");
 159         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{SERVER}");
 160         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 161         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 162         system("$nmblookup $testenv_vars->{CONFIGURATION} $testenv_vars->{NETBIOSNAME}");
 163         system("$nmblookup $testenv_vars->{CONFIGURATION} -U $testenv_vars->{SERVER_IP} $testenv_vars->{NETBIOSNAME}");
 164
 165         # Ensure we have the first RID Set before we start tests.  This makes the tests more reliable.
 166         if ($testenv_vars->{SERVER_ROLE} eq "domain controller" and not ($testenv_vars->{NETBIOS_NAME} eq "rodc")) {
 167             print "waiting for working LDAP and a RID Set to be allocated\n";
 168             my $ldbsearch = Samba::bindir_path($self, "ldbsearch");
 169             my $count = 0;
 170             my $base_dn = "DC=".join(",DC=", split(/\./, $testenv_vars->{REALM}));
 171             my $rid_set_dn = "cn=RID Set,cn=$testenv_vars->{NETBIOSNAME},ou=domain controllers,$base_dn";
 172             while (system("$ldbsearch -H ldap://$testenv_vars->{SERVER} -U$testenv_vars->{USERNAME}%$testenv_vars->{PASSWORD} -s base -b \"$rid_set_dn\" rIDAllocationPool > /dev/null") != 0) {
 173                 $count++;
 174                 if ($count > 40) {
 175                     $ret = 1;
 176                     last;
 177                 }
 178                 sleep(1);
 179             }
 180         }
 181         print $self->getlog_env($testenv_vars);
 182
 183         return $ret
 184 }
 185
 186 sub write_ldb_file($$$)
 187 {
 188         my ($self, $file, $ldif) = @_;
 189
 190         my $ldbadd =  Samba::bindir_path($self, "ldbadd");
 191         open(LDIF, "|$ldbadd -H $file >/dev/null");
 192         print LDIF $ldif;
 193         return(close(LDIF));
 194 }
 195
 196 sub add_wins_config($$)
 197 {
 198         my ($self, $privatedir) = @_;
 199
 200         return $self->write_ldb_file("$privatedir/wins_config.ldb", "
 201 dn: name=TORTURE_11,CN=PARTNERS
 202 objectClass: wreplPartner
 203 name: TORTURE_11
 204 address: 127.0.0.11
 205 pullInterval: 0
 206 pushChangeCount: 0
 207 type: 0x3
 208 ");
 209 }
 210
 211 sub mk_fedora_ds($$)
 212 {
 213         my ($self, $ctx) = @_;
 214
 215         #Make the subdirectory be as fedora DS would expect
 216         my $fedora_ds_dir = "$ctx->{ldapdir}/slapd-$ctx->{ldap_instance}";
 217
 218         my $pidfile = "$fedora_ds_dir/logs/slapd-$ctx->{ldap_instance}.pid";
 219
 220         return ($fedora_ds_dir, $pidfile);
 221 }
 222
 223 sub mk_openldap($$)
 224 {
 225         my ($self, $ctx) = @_;
 226
 227         my $slapd_conf_d = "$ctx->{ldapdir}/slapd.d";
 228         my $pidfile = "$ctx->{ldapdir}/slapd.pid";
 229
 230         return ($slapd_conf_d, $pidfile);
 231 }
 232
 233 sub mk_keyblobs($$)
 234 {
 235         my ($self, $tlsdir) = @_;
 236
 237         #TLS and PKINIT crypto blobs
 238         my $dhfile = "$tlsdir/dhparms.pem";
 239         my $cafile = "$tlsdir/ca.pem";
 240         my $certfile = "$tlsdir/cert.pem";
 241         my $reqkdc = "$tlsdir/req-kdc.der";
 242         my $kdccertfile = "$tlsdir/kdc.pem";
 243         my $keyfile = "$tlsdir/key.pem";
 244         my $adminkeyfile = "$tlsdir/adminkey.pem";
 245         my $reqadmin = "$tlsdir/req-admin.der";
 246         my $admincertfile = "$tlsdir/admincert.pem";
 247         my $admincertupnfile = "$tlsdir/admincertupn.pem";
 248
 249         mkdir($tlsdir, 0700);
 250         my $oldumask = umask;
 251         umask 0077;
 252
 253         #This is specified here to avoid draining entropy on every run
 254         open(DHFILE, ">$dhfile");
 255         print DHFILE <<EOF;
 256 -----BEGIN DH PARAMETERS-----
 257 MGYCYQC/eWD2xkb7uELmqLi+ygPMKyVcpHUo2yCluwnbPutEueuxrG/Cys8j8wLO
 258 svCN/jYNyR2NszOmg7ZWcOC/4z/4pWDVPUZr8qrkhj5MRKJc52MncfaDglvEdJrv
 259 YX70obsCAQI=
 260 -----END DH PARAMETERS-----
 261 EOF
 262         close(DHFILE);
 263
 264         #Likewise, we pregenerate the key material.  This allows the
 265         #other certificates to be pre-generated
 266         open(KEYFILE, ">$keyfile");
 267         print KEYFILE <<EOF;
 268 -----BEGIN RSA PRIVATE KEY-----
 269 MIICXQIBAAKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpc
 270 ol3+S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H
 271 6H+pPqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQAB
 272 AoGAAqDLzFRR/BF1kpsiUfL4WFvTarCe9duhwj7ORc6fs785qAXuwUYAJ0Uvzmy6
 273 HqoGv3t3RfmeHDmjcpPHsbOKnsOQn2MgmthidQlPBMWtQMff5zdoYNUFiPS0XQBq
 274 szNW4PRjaA9KkLQVTwnzdXGkBSkn/nGxkaVu7OR3vJOBoo0CQQDO4upypesnbe6p
 275 9/xqfZ2uim8IwV1fLlFClV7WlCaER8tsQF4lEi0XSzRdXGUD/dilpY88Nb+xok/X
 276 8Z8OvgAXAkEA+pcLsx1gN7kxnARxv54jdzQjC31uesJgMKQXjJ0h75aUZwTNHmZQ
 277 vPxi6u62YiObrN5oivkixwFNncT9MxTxVQJBAMaWUm2SjlLe10UX4Zdm1MEB6OsC
 278 kVoX37CGKO7YbtBzCfTzJGt5Mwc1DSLA2cYnGJqIfSFShptALlwedot0HikCQAJu
 279 jNKEKnbf+TdGY8Q0SKvTebOW2Aeg80YFkaTvsXCdyXrmdQcifw4WdO9KucJiDhSz
 280 Y9hVapz7ykEJtFtWjLECQQDIlfc63I5ZpXfg4/nN4IJXUW6AmPVOYIA5215itgki
 281 cSlMYli1H9MEXH0pQMGv5Qyd0OYIx2DDg96mZ+aFvqSG
 282 -----END RSA PRIVATE KEY-----
 283 EOF
 284         close(KEYFILE);
 285
 286         open(ADMINKEYFILE, ">$adminkeyfile");
 287
 288         print ADMINKEYFILE <<EOF;
 289 -----BEGIN RSA PRIVATE KEY-----
 290 MIICXQIBAAKBgQD0+OL7TQBj0RejbIH1+g5GeRaWaM9xF43uE5y7jUHEsi5owhZF
 291 5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMFxB6esnXhl0Jpip1JkUMM
 292 XLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xdl3JRlwIDAQAB
 293 AoGAP8mjCP628Ebc2eACQzOWjgEvwYCPK4qPmYOf1zJkArzG2t5XAGJ5WGrENRuB
 294 cm3XFh1lpmaADl982UdW3gul4gXUy6w4XjKK4vVfhyHj0kZ/LgaXUK9BAGhroJ2L
 295 osIOUsaC6jdx9EwSRctwdlF3wWJ8NK0g28AkvIk+FlolW4ECQQD7w5ouCDnf58CN
 296 u4nARx4xv5XJXekBvOomkCQAmuOsdOb6b9wn3mm2E3au9fueITjb3soMR31AF6O4
 297 eAY126rXAkEA+RgHzybzZEP8jCuznMqoN2fq/Vrs6+W3M8/G9mzGEMgLLpaf2Jiz
 298 I9tLZ0+OFk9tkRaoCHPfUOCrVWJZ7Y53QQJBAMhoA6rw0WDyUcyApD5yXg6rusf4
 299 ASpo/tqDkqUIpoL464Qe1tjFqtBM3gSXuhs9xsz+o0bzATirmJ+WqxrkKTECQHt2
 300 OLCpKqwAspU7N+w32kaUADoRLisCEdrhWklbwpQgwsIVsCaoEOpt0CLloJRYTANE
 301 yoZeAErTALjyZYZEPcECQQDlUi0N8DFxQ/lOwWyR3Hailft+mPqoPCa8QHlQZnlG
 302 +cfgNl57YHMTZFwgUVFRdJNpjH/WdZ5QxDcIVli0q+Ko
 303 -----END RSA PRIVATE KEY-----
 304 EOF
 305
 306         #generated with
 307         # hxtool issue-certificate --self-signed --issue-ca \
 308         # --ca-private-key="FILE:$KEYFILE" \
 309         # --subject="CN=CA,DC=samba,DC=example,DC=com" \
 310         # --certificate="FILE:$CAFILE" --lifetime="25 years"
 311
 312         open(CAFILE, ">$cafile");
 313         print CAFILE <<EOF;
 314 -----BEGIN CERTIFICATE-----
 315 MIICcTCCAdqgAwIBAgIUaBPmjnPVqyFqR5foICmLmikJTzgwCwYJKoZIhvcNAQEFMFIxEzAR
 316 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 317 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDgwMzAxMTIyMzEyWhgPMjAzMzAyMjQx
 318 MjIzMTJaMFIxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 319 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMIGfMA0GCSqGSIb3DQEBAQUA
 320 A4GNADCBiQKBgQDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+S9/6
 321 I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+pPqVIRLOmrWIm
 322 ai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABo0IwQDAOBgNVHQ8BAf8EBAMC
 323 AaYwHQYDVR0OBBYEFMLZufegDKLZs0VOyFXYK1L6M8oyMA8GA1UdEwEB/wQFMAMBAf8wDQYJ
 324 KoZIhvcNAQEFBQADgYEAAZJbCAAkaqgFJ0xgNovn8Ydd0KswQPjicwiODPgw9ZPoD2HiOUVO
 325 yYDRg/dhFF9y656OpcHk4N7qZ2sl3RlHkzDu+dseETW+CnKvQIoXNyeARRJSsSlwrwcoD4JR
 326 HTLk2sGigsWwrJ2N99sG/cqSJLJ1MFwLrs6koweBnYU0f/g=
 327 -----END CERTIFICATE-----
 328 EOF
 329
 330         #generated with GNUTLS internally in Samba.
 331
 332         open(CERTFILE, ">$certfile");
 333         print CERTFILE <<EOF;
 334 -----BEGIN CERTIFICATE-----
 335 MIICYTCCAcygAwIBAgIE5M7SRDALBgkqhkiG9w0BAQUwZTEdMBsGA1UEChMUU2Ft
 336 YmEgQWRtaW5pc3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1
 337 dG9nZW5lcmF0ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMB4XDTA2MDgw
 338 NDA0MzY1MloXDTA4MDcwNDA0MzY1MlowZTEdMBsGA1UEChMUU2FtYmEgQWRtaW5p
 339 c3RyYXRpb24xNDAyBgNVBAsTK1NhbWJhIC0gdGVtcG9yYXJ5IGF1dG9nZW5lcmF0
 340 ZWQgY2VydGlmaWNhdGUxDjAMBgNVBAMTBVNhbWJhMIGcMAsGCSqGSIb3DQEBAQOB
 341 jAAwgYgCgYDKg6pAwCHUMA1DfHDmWhZfd+F0C+9Jxcqvpw9ii9En3E1uflpcol3+
 342 S9/6I/uaTmJHZre+DF3dTzb/UOZo0Zem8N+IzzkgoGkFafjXuT3BL5UPY2/H6H+p
 343 PqVIRLOmrWImai359YyoKhFyo37Y6HPeU8QcZ+u2rS9geapIWfeuowIDAQABoyUw
 344 IzAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGCSqGSIb3DQEB
 345 BQOBgQAmkN6XxvDnoMkGcWLCTwzxGfNNSVcYr7TtL2aJh285Xw9zaxcm/SAZBFyG
 346 LYOChvh6hPU7joMdDwGfbiLrBnMag+BtGlmPLWwp/Kt1wNmrRhduyTQFhN3PP6fz
 347 nBr9vVny2FewB2gHmelaPS//tXdxivSXKz3NFqqXLDJjq7P8wA==
 348 -----END CERTIFICATE-----
 349 EOF
 350         close(CERTFILE);
 351
 352         #KDC certificate
 353         # hxtool request-create \
 354         # --subject="CN=krbtgt,CN=users,DC=samba,DC=example,DC=com" \
 355         # --key="FILE:$KEYFILE" $KDCREQ
 356
 357         # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
 358         # --type="pkinit-kdc" \
 359         # --pk-init-principal="krbtgt/SAMBA.EXAMPLE.COM@SAMBA.EXAMPLE.COM" \
 360         # --req="PKCS10:$KDCREQ" --certificate="FILE:$KDCCERTFILE" \
 361         # --lifetime="25 years"
 362
 363         open(KDCCERTFILE, ">$kdccertfile");
 364         print KDCCERTFILE <<EOF;
 365 -----BEGIN CERTIFICATE-----
 366 MIIDDDCCAnWgAwIBAgIUI2Tzj+JnMzMcdeabcNo30rovzFAwCwYJKoZIhvcNAQEFMFIxEzAR
 367 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 368 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDgwMzAxMTMxOTIzWhgPMjAzMzAyMjQx
 369 MzE5MjNaMGYxEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 370 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMQ8wDQYDVQQDDAZrcmJ0
 371 Z3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMqDqkDAIdQwDUN8cOZaFl934XQL70nF
 372 yq+nD2KL0SfcTW5+WlyiXf5L3/oj+5pOYkdmt74MXd1PNv9Q5mjRl6bw34jPOSCgaQVp+Ne5
 373 PcEvlQ9jb8fof6k+pUhEs6atYiZqLfn1jKgqEXKjftjoc95TxBxn67atL2B5qkhZ966jAgMB
 374 AAGjgcgwgcUwDgYDVR0PAQH/BAQDAgWgMBIGA1UdJQQLMAkGBysGAQUCAwUwVAYDVR0RBE0w
 375 S6BJBgYrBgEFAgKgPzA9oBMbEVNBTUJBLkVYQU1QTEUuQ09NoSYwJKADAgEBoR0wGxsGa3Ji
 376 dGd0GxFTQU1CQS5FWEFNUExFLkNPTTAfBgNVHSMEGDAWgBTC2bn3oAyi2bNFTshV2CtS+jPK
 377 MjAdBgNVHQ4EFgQUwtm596AMotmzRU7IVdgrUvozyjIwCQYDVR0TBAIwADANBgkqhkiG9w0B
 378 AQUFAAOBgQBmrVD5MCmZjfHp1nEnHqTIh8r7lSmVtDx4s9MMjxm9oNrzbKXynvdhwQYFVarc
 379 ge4yRRDXtSebErOl71zVJI9CVeQQpwcH+tA85oGA7oeFtO/S7ls581RUU6tGgyxV4veD+lJv
 380 KPH5LevUtgD+q9H4LU4Sq5N3iFwBaeryB0g2wg==
 381 -----END CERTIFICATE-----
 382 EOF
 383
 384         # hxtool request-create \
 385         # --subject="CN=Administrator,CN=users,DC=samba,DC=example,DC=com" \
 386         # --key="FILE:$ADMINKEYFILE" $ADMINREQFILE
 387
 388         # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
 389         # --type="pkinit-client" \
 390         # --pk-init-principal="administrator@SAMBA.EXAMPLE.COM" \
 391         # --req="PKCS10:$ADMINREQFILE" --certificate="FILE:$ADMINCERTFILE" \
 392         # --lifetime="25 years"
 393
 394         open(ADMINCERTFILE, ">$admincertfile");
 395         print ADMINCERTFILE <<EOF;
 396 -----BEGIN CERTIFICATE-----
 397 MIIDHTCCAoagAwIBAgIUUggzW4lLRkMKe1DAR2NKatkMDYwwCwYJKoZIhvcNAQELMFIxEzAR
 398 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 399 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDkwNzI3MDMzMjE1WhgPMjAzNDA3MjIw
 400 MzMyMTVaMG0xEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 401 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMRYwFAYDVQQDDA1BZG1p
 402 bmlzdHJhdG9yMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0+OL7TQBj0RejbIH1+g5G
 403 eRaWaM9xF43uE5y7jUHEsi5owhZF5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMF
 404 xB6esnXhl0Jpip1JkUMMXLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xd
 405 l3JRlwIDAQABo4HSMIHPMA4GA1UdDwEB/wQEAwIFoDAoBgNVHSUEITAfBgcrBgEFAgMEBggr
 406 BgEFBQcDAgYKKwYBBAGCNxQCAjBIBgNVHREEQTA/oD0GBisGAQUCAqAzMDGgExsRU0FNQkEu
 407 RVhBTVBMRS5DT02hGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yMB8GA1UdIwQYMBaAFMLZ
 408 ufegDKLZs0VOyFXYK1L6M8oyMB0GA1UdDgQWBBQg81bLyfCA88C2B/BDjXlGuaFaxjAJBgNV
 409 HRMEAjAAMA0GCSqGSIb3DQEBCwUAA4GBAEf/OSHUDJaGdtWGNuJeqcVYVMwrfBAc0OSwVhz1
 410 7/xqKHWo8wIMPkYRtaRHKLNDsF8GkhQPCpVsa6mX/Nt7YQnNvwd+1SBP5E8GvwWw9ZzLJvma
 411 nk2n89emuayLpVtp00PymrDLRBcNaRjFReQU8f0o509kiVPHduAp3jOiy13l
 412 -----END CERTIFICATE-----
 413 EOF
 414         close(ADMINCERTFILE);
 415
 416         # hxtool issue-certificate --ca-certificate=FILE:$CAFILE,$KEYFILE \
 417         # --type="pkinit-client" \
 418         # --ms-upn="administrator@samba.example.com" \
 419         # --req="PKCS10:$ADMINREQFILE" --certificate="FILE:$ADMINCERTUPNFILE" \
 420         # --lifetime="25 years"
 421
 422         open(ADMINCERTUPNFILE, ">$admincertupnfile");
 423         print ADMINCERTUPNFILE <<EOF;
 424 -----BEGIN CERTIFICATE-----
 425 MIIDDzCCAnigAwIBAgIUUp3CJMuNaEaAdPKp3QdNIwG7a4wwCwYJKoZIhvcNAQELMFIxEzAR
 426 BgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxlMRUwEwYKCZImiZPy
 427 LGQBGQwFc2FtYmExCzAJBgNVBAMMAkNBMCIYDzIwMDkwNzI3MDMzMzA1WhgPMjAzNDA3MjIw
 428 MzMzMDVaMG0xEzARBgoJkiaJk/IsZAEZDANjb20xFzAVBgoJkiaJk/IsZAEZDAdleGFtcGxl
 429 MRUwEwYKCZImiZPyLGQBGQwFc2FtYmExDjAMBgNVBAMMBXVzZXJzMRYwFAYDVQQDDA1BZG1p
 430 bmlzdHJhdG9yMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0+OL7TQBj0RejbIH1+g5G
 431 eRaWaM9xF43uE5y7jUHEsi5owhZF5iIoHZeeL6cpDF5y1BZRs0JlA1VqMry1jjKlzFYVEMMF
 432 xB6esnXhl0Jpip1JkUMMXLOP1m/0dqayuHBWozj9f/cdyCJr0wJIX1Z8Pr+EjYRGPn/MF0xd
 433 l3JRlwIDAQABo4HEMIHBMA4GA1UdDwEB/wQEAwIFoDAoBgNVHSUEITAfBgcrBgEFAgMEBggr
 434 BgEFBQcDAgYKKwYBBAGCNxQCAjA6BgNVHREEMzAxoC8GCisGAQQBgjcUAgOgIQwfYWRtaW5p
 435 c3RyYXRvckBzYW1iYS5leGFtcGxlLmNvbTAfBgNVHSMEGDAWgBTC2bn3oAyi2bNFTshV2CtS
 436 +jPKMjAdBgNVHQ4EFgQUIPNWy8nwgPPAtgfwQ415RrmhWsYwCQYDVR0TBAIwADANBgkqhkiG
 437 9w0BAQsFAAOBgQBk42+egeUB3Ji2PC55fbt3FNKxvmm2xUUFkV9POK/YR9rajKOwk5jtYSeS
 438 Zd7J9s//rNFNa7waklFkDaY56+QWTFtdvxfE+KoHaqt6X8u6pqi7p3M4wDKQox+9Dx8yWFyq
 439 Wfz/8alZ5aMezCQzXJyIaJsCLeKABosSwHcpAFmxlQ==
 440 -----END CERTIFICATE-----
 441 EOF
 442
 443         umask $oldumask;
 444 }
 445
 446 sub provision_raw_prepare($$$$$$$$$$)
 447 {
 448         my ($self, $prefix, $server_role, $hostname,
 449             $domain, $realm, $functional_level,
 450             $password, $kdc_ipv4) = @_;
 451         my $ctx;
 452         my $netbiosname = uc($hostname);
 453
 454         unless(-d $prefix or mkdir($prefix, 0777)) {
 455                 warn("Unable to create $prefix");
 456                 return undef;
 457         }
 458         my $prefix_abs = abs_path($prefix);
 459
 460         die ("prefix=''") if $prefix_abs eq "";
 461         die ("prefix='/'") if $prefix_abs eq "/";
 462
 463         unless (system("rm -rf $prefix_abs/*") == 0) {
 464                 warn("Unable to clean up");
 465         }
 466
 467
 468         my $swiface = Samba::get_interface($hostname);
 469
 470         $ctx->{prefix} = $prefix;
 471         $ctx->{prefix_abs} = $prefix_abs;
 472
 473         $ctx->{dns_host_file} = "$ENV{SELFTEST_PREFIX}/dns_host_file";
 474
 475         $ctx->{server_role} = $server_role;
 476         $ctx->{hostname} = $hostname;
 477         $ctx->{netbiosname} = $netbiosname;
 478         $ctx->{swiface} = $swiface;
 479         $ctx->{password} = $password;
 480         $ctx->{kdc_ipv4} = $kdc_ipv4;
 481
 482 #
 483 # Set smbd log level here.
 484 #
 485         $ctx->{server_loglevel} =$ENV{SERVER_LOG_LEVEL} || 1;
 486         $ctx->{username} = "Administrator";
 487         $ctx->{domain} = $domain;
 488         $ctx->{realm} = uc($realm);
 489         $ctx->{dnsname} = lc($realm);
 490
 491         $ctx->{functional_level} = $functional_level;
 492
 493         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `whoami`);
 494         chomp $unix_name;
 495         $ctx->{unix_name} = $unix_name;
 496         $ctx->{unix_uid} = $>;
 497         $ctx->{unix_gids_str} = $);
 498         @{$ctx->{unix_gids}} = split(" ", $ctx->{unix_gids_str});
 499
 500         $ctx->{etcdir} = "$prefix_abs/etc";
 501         $ctx->{piddir} = "$prefix_abs/pid";
 502         $ctx->{smb_conf} = "$ctx->{etcdir}/smb.conf";
 503         $ctx->{krb5_conf} = "$ctx->{etcdir}/krb5.conf";
 504         $ctx->{privatedir} = "$prefix_abs/private";
 505         $ctx->{ncalrpcdir} = "$prefix_abs/ncalrpc";
 506         $ctx->{lockdir} = "$prefix_abs/lockdir";
 507         $ctx->{logdir} = "$prefix_abs/logs";
 508         $ctx->{statedir} = "$prefix_abs/statedir";
 509         $ctx->{cachedir} = "$prefix_abs/cachedir";
 510         $ctx->{winbindd_socket_dir} = "$prefix_abs/winbindd_socket";
 511         $ctx->{winbindd_privileged_socket_dir} = "$prefix_abs/winbindd_privileged_socket";
 512         $ctx->{ntp_signd_socket_dir} = "$prefix_abs/ntp_signd_socket";
 513         $ctx->{nsswrap_passwd} = "$ctx->{etcdir}/passwd";
 514         $ctx->{nsswrap_group} = "$ctx->{etcdir}/group";
 515
 516         $ctx->{tlsdir} = "$ctx->{privatedir}/tls";
 517
 518         $ctx->{ipv4} = "127.0.0.$swiface";
 519         $ctx->{ipv6} = sprintf("fd00:0000:0000:0000:0000:0000:5357:5f%02x", $swiface);
 520         $ctx->{interfaces} = "$ctx->{ipv4}/8 $ctx->{ipv6}/64";
 521
 522         push(@{$ctx->{directories}}, $ctx->{privatedir});
 523         push(@{$ctx->{directories}}, $ctx->{etcdir});
 524         push(@{$ctx->{directories}}, $ctx->{piddir});
 525         push(@{$ctx->{directories}}, $ctx->{lockdir});
 526         push(@{$ctx->{directories}}, $ctx->{logdir});
 527         push(@{$ctx->{directories}}, $ctx->{statedir});
 528         push(@{$ctx->{directories}}, $ctx->{cachedir});
 529
 530         $ctx->{smb_conf_extra_options} = "";
 531
 532         my @provision_options = ();
 533         push (@provision_options, "NSS_WRAPPER_PASSWD=\"$ctx->{nsswrap_passwd}\"");
 534         push (@provision_options, "NSS_WRAPPER_GROUP=\"$ctx->{nsswrap_group}\"");
 535         if (defined($ENV{GDB_PROVISION})) {
 536                 push (@provision_options, "gdb --args");
 537                 if (!defined($ENV{PYTHON})) {
 538                     push (@provision_options, "env");
 539                     push (@provision_options, "python");
 540                 }
 541         }
 542         if (defined($ENV{VALGRIND_PROVISION})) {
 543                 push (@provision_options, "valgrind");
 544                 if (!defined($ENV{PYTHON})) {
 545                     push (@provision_options, "env");
 546                     push (@provision_options, "python");
 547                 }
 548         }
 549         if (defined($ENV{PYTHON})) {
 550                 push (@provision_options, $ENV{PYTHON});
 551         }
 552         push (@provision_options, Samba::bindir_path($self, "samba-tool"));
 553         push (@provision_options, "domain");
 554         push (@provision_options, "provision");
 555         push (@provision_options, "--configfile=$ctx->{smb_conf}");
 556         push (@provision_options, "--host-name=$ctx->{hostname}");
 557         push (@provision_options, "--host-ip=$ctx->{ipv4}");
 558         push (@provision_options, "--quiet");
 559         push (@provision_options, "--domain=$ctx->{domain}");
 560         push (@provision_options, "--realm=$ctx->{realm}");
 561         push (@provision_options, "--adminpass=$ctx->{password}");
 562         push (@provision_options, "--krbtgtpass=krbtgt$ctx->{password}");
 563         push (@provision_options, "--machinepass=machine$ctx->{password}");
 564         push (@provision_options, "--root=$ctx->{unix_name}");
 565         push (@provision_options, "--server-role=\"$ctx->{server_role}\"");
 566         push (@provision_options, "--function-level=\"$ctx->{functional_level}\"");
 567
 568         @{$ctx->{provision_options}} = @provision_options;
 569
 570         return $ctx;
 571 }
 572
 573 #
 574 # Step1 creates the basic configuration
 575 #
 576 sub provision_raw_step1($$)
 577 {
 578         my ($self, $ctx) = @_;
 579
 580         mkdir($_, 0777) foreach (@{$ctx->{directories}});
 581
 582         ##
 583         ## lockdir and piddir must be 0755
 584         ##
 585         chmod 0755, $ctx->{lockdir};
 586         chmod 0755, $ctx->{piddir};
 587
 588         unless (open(CONFFILE, ">$ctx->{smb_conf}")) {
 589                 warn("can't open $ctx->{smb_conf}$?");
 590                 return undef;
 591         }
 592         print CONFFILE "
 593 [global]
 594         netbios name = $ctx->{netbiosname}
 595         posix:eadb = $ctx->{statedir}/eadb.tdb
 596         workgroup = $ctx->{domain}
 597         realm = $ctx->{realm}
 598         private dir = $ctx->{privatedir}
 599         pid directory = $ctx->{piddir}
 600         ncalrpc dir = $ctx->{ncalrpcdir}
 601         lock dir = $ctx->{lockdir}
 602         state directory = $ctx->{statedir}
 603         cache directory = $ctx->{cachedir}
 604         winbindd socket directory = $ctx->{winbindd_socket_dir}
 605         winbindd privileged socket directory = $ctx->{winbindd_privileged_socket_dir}
 606         ntp signd socket directory = $ctx->{ntp_signd_socket_dir}
 607         winbind separator = /
 608         name resolve order = file bcast
 609         interfaces = $ctx->{interfaces}
 610         tls dh params file = $ctx->{tlsdir}/dhparms.pem
 611         panic action = $RealBin/gdb_backtrace \%d
 612         wins support = yes
 613         server role = $ctx->{server_role}
 614         server services = +echo +smb -s3fs
 615         dcerpc endpoint servers = +winreg +srvsvc
 616         notify:inotify = false
 617         ldb:nosync = true
 618 #We don't want to pass our self-tests if the PAC code is wrong
 619         gensec:require_pac = true
 620         log file = $ctx->{logdir}/log.\%m
 621         log level = $ctx->{server_loglevel}
 622         lanman auth = Yes
 623         rndc command = true
 624         dns update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_dnsupdate --all-interfaces --use-file=$ctx->{dns_host_file} -s $ctx->{smb_conf}
 625         spn update command = $ENV{SRCDIR_ABS}/source4/scripting/bin/samba_spnupdate -s $ctx->{smb_conf}
 626         resolv:host file = $ctx->{dns_host_file}
 627         dreplsrv:periodic_startup_interval = 0
 628         dsdb:schema update allowed = yes
 629
 630         vfs objects = dfs_samba4 acl_xattr fake_acls xattr_tdb streams_depot
 631
 632         # remove this again, when our smb2 client library
 633         # supports signin on compound related requests
 634         server signing = on
 635
 636         idmap_ldb:use rfc2307=yes
 637 ";
 638
 639         print CONFFILE "
 640
 641         # Begin extra options
 642         $ctx->{smb_conf_extra_options}
 643         # End extra options
 644 ";
 645         close(CONFFILE);
 646
 647         $self->mk_keyblobs($ctx->{tlsdir});
 648
 649         #Default the KDC IP to the server's IP
 650         if (not defined($ctx->{kdc_ipv4})) {
 651              $ctx->{kdc_ipv4} = $ctx->{ipv4};
 652         }
 653
 654         Samba::mk_krb5_conf($ctx, "");
 655
 656         open(PWD, ">$ctx->{nsswrap_passwd}");
 657         print PWD "
 658 root:x:0:0:root gecos:$ctx->{prefix_abs}:/bin/false
 659 nobody:x:65534:65533:nobody gecos:$ctx->{prefix_abs}:/bin/false
 660 pdbtest:x:65533:65533:pdbtest gecos:$ctx->{prefix_abs}:/bin/false
 661 ";
 662         close(PWD);
 663         my $uid_rfc2307test = 65533;
 664
 665         open(GRP, ">$ctx->{nsswrap_group}");
 666         print GRP "
 667 root:x:0:
 668 wheel:x:10:
 669 users:x:100:
 670 nobody:x:65533:
 671 nogroup:x:65534:nobody
 672 ";
 673         close(GRP);
 674         my $gid_rfc2307test = 65532;
 675
 676         my $configuration = "--configfile=$ctx->{smb_conf}";
 677
 678 #Ensure the config file is valid before we start
 679         my $testparm = Samba::bindir_path($self, "samba-tool") . " testparm";
 680         if (system("$testparm $configuration -v --suppress-prompt >/dev/null 2>&1") != 0) {
 681                 system("$testparm -v --suppress-prompt $configuration >&2");
 682                 warn("Failed to create a valid smb.conf configuration $testparm!");
 683                 return undef;
 684         }
 685         unless (system("($testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global 2> /dev/null | grep -i \"^$ctx->{netbiosname}\" ) >/dev/null 2>&1") == 0) {
 686                 warn("Failed to create a valid smb.conf configuration! $testparm $configuration -v --suppress-prompt --parameter-name=\"netbios name\" --section-name=global");
 687                 return undef;
 688         }
 689
 690         my $ret = {
 691                 KRB5_CONFIG => $ctx->{krb5_conf},
 692                 PIDDIR => $ctx->{piddir},
 693                 SERVER => $ctx->{hostname},
 694                 SERVER_IP => $ctx->{ipv4},
 695                 SERVER_IPV6 => $ctx->{ipv6},
 696                 NETBIOSNAME => $ctx->{netbiosname},
 697                 DOMAIN => $ctx->{domain},
 698                 USERNAME => $ctx->{username},
 699                 REALM => $ctx->{realm},
 700                 PASSWORD => $ctx->{password},
 701                 LDAPDIR => $ctx->{ldapdir},
 702                 LDAP_INSTANCE => $ctx->{ldap_instance},
 703                 WINBINDD_SOCKET_DIR => $ctx->{winbindd_socket_dir},
 704                 NCALRPCDIR => $ctx->{ncalrpcdir},
 705                 LOCKDIR => $ctx->{lockdir},
 706                 STATEDIR => $ctx->{statedir},
 707                 CACHEDIR => $ctx->{cachedir},
 708                 PRIVATEDIR => $ctx->{privatedir},
 709                 SERVERCONFFILE => $ctx->{smb_conf},
 710                 CONFIGURATION => $configuration,
 711                 SOCKET_WRAPPER_DEFAULT_IFACE => $ctx->{swiface},
 712                 NSS_WRAPPER_PASSWD => $ctx->{nsswrap_passwd},
 713                 NSS_WRAPPER_GROUP => $ctx->{nsswrap_group},
 714                 SAMBA_TEST_FIFO => "$ctx->{prefix}/samba_test.fifo",
 715                 SAMBA_TEST_LOG => "$ctx->{prefix}/samba_test.log",
 716                 SAMBA_TEST_LOG_POS => 0,
 717                 NSS_WRAPPER_WINBIND_SO_PATH => Samba::nss_wrapper_winbind_so_path($self),
 718                 LOCAL_PATH => $ctx->{share},
 719                 UID_RFC2307TEST => $uid_rfc2307test,
 720                 GID_RFC2307TEST => $gid_rfc2307test,
 721                 SERVER_ROLE => $ctx->{server_role}
 722         };
 723
 724         return $ret;
 725 }
 726
 727 #
 728 # Step2 runs the provision script
 729 #
 730 sub provision_raw_step2($$$)
 731 {
 732         my ($self, $ctx, $ret) = @_;
 733
 734         my $provision_cmd = join(" ", @{$ctx->{provision_options}});
 735         unless (system($provision_cmd) == 0) {
 736                 warn("Unable to provision: \n$provision_cmd\n");
 737                 return undef;
 738         }
 739
 740         return $ret;
 741 }
 742
 743 sub provision($$$$$$$$$)
 744 {
 745         my ($self, $prefix, $server_role, $hostname,
 746             $domain, $realm, $functional_level,
 747             $password, $kdc_ipv4, $extra_smbconf_options, $extra_smbconf_shares,
 748             $extra_provision_options) = @_;
 749
 750         my $ctx = $self->provision_raw_prepare($prefix, $server_role,
 751                                                $hostname,
 752                                                $domain, $realm, $functional_level,
 753                                                $password, $kdc_ipv4);
 754
 755         if (defined($extra_provision_options)) {
 756                 push (@{$ctx->{provision_options}}, @{$extra_provision_options});
 757         } else {
 758                 push (@{$ctx->{provision_options}}, "--use-ntvfs");
 759         }
 760
 761         $ctx->{share} = "$ctx->{prefix_abs}/share";
 762         push(@{$ctx->{directories}}, "$ctx->{share}");
 763         push(@{$ctx->{directories}}, "$ctx->{share}/test1");
 764         push(@{$ctx->{directories}}, "$ctx->{share}/test2");
 765
 766         # precreate directories for printer drivers
 767         push(@{$ctx->{directories}}, "$ctx->{share}/W32X86");
 768         push(@{$ctx->{directories}}, "$ctx->{share}/x64");
 769         push(@{$ctx->{directories}}, "$ctx->{share}/WIN40");
 770
 771         my $msdfs = "no";
 772         $msdfs = "yes" if ($server_role eq "domain controller");
 773         $ctx->{smb_conf_extra_options} = "
 774
 775         max xmit = 32K
 776         server max protocol = SMB2
 777         host msdfs = $msdfs
 778         lanman auth = yes
 779
 780         $extra_smbconf_options
 781
 782 [tmp]
 783         path = $ctx->{share}
 784         read only = no
 785         posix:sharedelay = 10000
 786         posix:oplocktimeout = 3
 787         posix:writetimeupdatedelay = 50000
 788
 789 [xcopy_share]
 790         path = $ctx->{share}
 791         read only = no
 792         posix:sharedelay = 10000
 793         posix:oplocktimeout = 3
 794         posix:writetimeupdatedelay = 50000
 795         create mask = 777
 796         force create mode = 777
 797
 798 [posix_share]
 799         path = $ctx->{share}
 800         read only = no
 801         create mask = 0777
 802         force create mode = 0
 803         directory mask = 0777
 804         force directory mode = 0
 805
 806 [test1]
 807         path = $ctx->{share}/test1
 808         read only = no
 809         posix:sharedelay = 10000
 810         posix:oplocktimeout = 3
 811         posix:writetimeupdatedelay = 50000
 812
 813 [test2]
 814         path = $ctx->{share}/test2
 815         read only = no
 816         posix:sharedelay = 10000
 817         posix:oplocktimeout = 3
 818         posix:writetimeupdatedelay = 50000
 819
 820 [cifs]
 821         read only = no
 822         ntvfs handler = cifs
 823         cifs:server = $ctx->{netbiosname}
 824         cifs:share = tmp
 825         cifs:use-s4u2proxy = yes
 826         # There is no username specified here, instead the client is expected
 827         # to log in with kerberos, and the serverwill use delegated credentials.
 828         # Or the server tries s4u2self/s4u2proxy to impersonate the client
 829
 830 [simple]
 831         path = $ctx->{share}
 832         read only = no
 833         ntvfs handler = simple
 834
 835 [sysvol]
 836         path = $ctx->{statedir}/sysvol
 837         read only = no
 838
 839 [netlogon]
 840         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
 841         read only = no
 842
 843 [cifsposix]
 844         copy = simple
 845         ntvfs handler = cifsposix
 846
 847 $extra_smbconf_shares
 848 ";
 849
 850         if (defined($self->{ldap})) {
 851                 $ctx->{ldapdir} = "$ctx->{privatedir}/ldap";
 852                 push(@{$ctx->{directories}}, "$ctx->{ldapdir}");
 853
 854                 my $ldap_uri= "$ctx->{ldapdir}/ldapi";
 855                 $ldap_uri =~ s|/|%2F|g;
 856                 $ldap_uri = "ldapi://$ldap_uri";
 857                 $ctx->{ldap_uri} = $ldap_uri;
 858
 859                 $ctx->{ldap_instance} = lc($ctx->{netbiosname});
 860         }
 861
 862         my $ret = $self->provision_raw_step1($ctx);
 863         unless (defined $ret) {
 864                 return undef;
 865         }
 866
 867         if (defined($self->{ldap})) {
 868                 $ret->{LDAP_URI} = $ctx->{ldap_uri};
 869                 push (@{$ctx->{provision_options}}, "--ldap-backend-type=" . $self->{ldap});
 870                 push (@{$ctx->{provision_options}}, "--ldap-backend-nosync");
 871                 if ($self->{ldap} eq "openldap") {
 872                         push (@{$ctx->{provision_options}}, "--slapd-path=" . $ENV{OPENLDAP_SLAPD});
 873                         ($ret->{SLAPD_CONF_D}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ctx) or die("Unable to create openldap directories");
 874
 875                 } elsif ($self->{ldap} eq "fedora-ds") {
 876                         push (@{$ctx->{provision_options}}, "--slapd-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/ns-slapd");
 877                         push (@{$ctx->{provision_options}}, "--setup-ds-path=" . "$ENV{FEDORA_DS_ROOT}/sbin/setup-ds.pl");
 878                         ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ctx) or die("Unable to create fedora ds directories");
 879                 }
 880
 881         }
 882
 883         return $self->provision_raw_step2($ctx, $ret);
 884 }
 885
 886 sub provision_member($$$)
 887 {
 888         my ($self, $prefix, $dcvars) = @_;
 889         print "PROVISIONING MEMBER...";
 890
 891         my $ret = $self->provision($prefix,
 892                                    "member server",
 893                                    "s4member",
 894                                    "SAMBADOMAIN",
 895                                    "samba.example.com",
 896                                    "2008",
 897                                    "locMEMpass3",
 898                                    $dcvars->{SERVER_IP},
 899                                    "", "", undef);
 900         unless ($ret) {
 901                 return undef;
 902         }
 903
 904         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 905         my $cmd = "";
 906         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 907         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 908         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
 909         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
 910         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
 911
 912         unless (system($cmd) == 0) {
 913                 warn("Join failed\n$cmd");
 914                 return undef;
 915         }
 916
 917         $ret->{MEMBER_SERVER} = $ret->{SERVER};
 918         $ret->{MEMBER_SERVER_IP} = $ret->{SERVER_IP};
 919         $ret->{MEMBER_SERVER_IPV6} = $ret->{SERVER_IPV6};
 920         $ret->{MEMBER_NETBIOSNAME} = $ret->{NETBIOSNAME};
 921         $ret->{MEMBER_USERNAME} = $ret->{USERNAME};
 922         $ret->{MEMBER_PASSWORD} = $ret->{PASSWORD};
 923
 924         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
 925         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
 926         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
 927         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
 928         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
 929         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
 930
 931         return $ret;
 932 }
 933
 934 sub provision_rpc_proxy($$$)
 935 {
 936         my ($self, $prefix, $dcvars) = @_;
 937         print "PROVISIONING RPC PROXY...";
 938
 939         my $extra_smbconf_options = "
 940
 941         # rpc_proxy
 942         dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
 943         dcerpc endpoint servers = epmapper, remote
 944         dcerpc_remote:interfaces = rpcecho
 945
 946 [cifs_to_dc]
 947         read only = no
 948         ntvfs handler = cifs
 949         cifs:server = $dcvars->{SERVER}
 950         cifs:share = cifs
 951         cifs:use-s4u2proxy = yes
 952         # There is no username specified here, instead the client is expected
 953         # to log in with kerberos, and the serverwill use delegated credentials.
 954         # Or the server tries s4u2self/s4u2proxy to impersonate the client
 955
 956 ";
 957
 958         my $ret = $self->provision($prefix,
 959                                    "member server",
 960                                    "localrpcproxy",
 961                                    "SAMBADOMAIN",
 962                                    "samba.example.com",
 963                                    "2008",
 964                                    "locRPCproxypass4",
 965                                    $dcvars->{SERVER_IP},
 966                                    $extra_smbconf_options, "", undef);
 967
 968         unless ($ret) {
 969                 return undef;
 970         }
 971
 972         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
 973
 974         # The joind runs in the context of the rpc_proxy/member for now
 975         my $cmd = "";
 976         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 977         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 978         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} member";
 979         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
 980         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
 981
 982         unless (system($cmd) == 0) {
 983                 warn("Join failed\n$cmd");
 984                 return undef;
 985         }
 986
 987         # Setting up delegation runs in the context of the DC for now
 988         $cmd = "";
 989         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 990         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
 991         $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
 992         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
 993
 994         unless (system($cmd) == 0) {
 995                 warn("Delegation failed\n$cmd");
 996                 return undef;
 997         }
 998
 999         # Setting up delegation runs in the context of the DC for now
1000         $cmd = "";
1001         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1002         $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
1003         $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
1004         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
1005
1006         unless (system($cmd) == 0) {
1007                 warn("Delegation failed\n$cmd");
1008                 return undef;
1009         }
1010
1011         $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
1012         $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
1013         $ret->{RPC_PROXY_SERVER_IPV6} = $ret->{SERVER_IPV6};
1014         $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};
1015         $ret->{RPC_PROXY_USERNAME} = $ret->{USERNAME};
1016         $ret->{RPC_PROXY_PASSWORD} = $ret->{PASSWORD};
1017
1018         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1019         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1020         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1021         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1022         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1023         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1024
1025         return $ret;
1026 }
1027
1028 sub provision_promoted_dc($$$)
1029 {
1030         my ($self, $prefix, $dcvars) = @_;
1031         print "PROVISIONING VAMPIRE DC...";
1032
1033         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1034         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1035                                                "promotedvdc",
1036                                                "SAMBADOMAIN",
1037                                                "samba.example.com",
1038                                                "2008",
1039                                                $dcvars->{PASSWORD},
1040                                                $dcvars->{SERVER_IP});
1041
1042         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1043
1044         $ctx->{smb_conf_extra_options} = "
1045         max xmit = 32K
1046         server max protocol = SMB2
1047
1048 [sysvol]
1049         path = $ctx->{statedir}/sysvol
1050         read only = yes
1051
1052 [netlogon]
1053         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1054         read only = no
1055
1056 ";
1057
1058         my $ret = $self->provision_raw_step1($ctx);
1059         unless ($ret) {
1060                 return undef;
1061         }
1062
1063         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1064         my $cmd = "";
1065         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1066         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1067         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} MEMBER --realm=$dcvars->{REALM}";
1068         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1069         $cmd .= " --machinepass=machine$ret->{PASSWORD}";
1070
1071         unless (system($cmd) == 0) {
1072                 warn("Join failed\n$cmd");
1073                 return undef;
1074         }
1075
1076         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1077         my $cmd = "";
1078         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1079         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1080         $cmd .= "$samba_tool domain dcpromo $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1081         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1082         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs --dns-backend=BIND9_DLZ";
1083
1084         unless (system($cmd) == 0) {
1085                 warn("Join failed\n$cmd");
1086                 return undef;
1087         }
1088
1089         $ret->{PROMOTED_DC_SERVER} = $ret->{SERVER};
1090         $ret->{PROMOTED_DC_SERVER_IP} = $ret->{SERVER_IP};
1091         $ret->{PROMOTED_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1092         $ret->{PROMOTED_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1093
1094         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1095         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1096         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1097         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1098         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1099         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1100
1101         return $ret;
1102 }
1103
1104 sub provision_vampire_dc($$$)
1105 {
1106         my ($self, $prefix, $dcvars) = @_;
1107         print "PROVISIONING VAMPIRE DC...";
1108
1109         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1110         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1111                                                "localvampiredc",
1112                                                "SAMBADOMAIN",
1113                                                "samba.example.com",
1114                                                "2008",
1115                                                $dcvars->{PASSWORD},
1116                                                $dcvars->{SERVER_IP});
1117
1118         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1119
1120         $ctx->{smb_conf_extra_options} = "
1121         max xmit = 32K
1122         server max protocol = SMB2
1123
1124 [sysvol]
1125         path = $ctx->{statedir}/sysvol
1126         read only = yes
1127
1128 [netlogon]
1129         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1130         read only = no
1131
1132 ";
1133
1134         my $ret = $self->provision_raw_step1($ctx);
1135         unless ($ret) {
1136                 return undef;
1137         }
1138
1139         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1140         my $cmd = "";
1141         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1142         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1143         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} DC --realm=$dcvars->{REALM}";
1144         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} --domain-critical-only";
1145         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1146
1147         unless (system($cmd) == 0) {
1148                 warn("Join failed\n$cmd");
1149                 return undef;
1150         }
1151
1152         $ret->{VAMPIRE_DC_SERVER} = $ret->{SERVER};
1153         $ret->{VAMPIRE_DC_SERVER_IP} = $ret->{SERVER_IP};
1154         $ret->{VAMPIRE_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1155         $ret->{VAMPIRE_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1156
1157         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1158         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1159         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1160         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1161         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1162         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1163
1164         return $ret;
1165 }
1166
1167 sub provision_subdom_dc($$$)
1168 {
1169         my ($self, $prefix, $dcvars) = @_;
1170         print "PROVISIONING SUBDOMAIN DC...";
1171
1172         # We do this so that we don't run the provision.  That's the job of 'net vampire'.
1173         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1174                                                "localsubdc",
1175                                                "SAMBASUBDOM",
1176                                                "sub.samba.example.com",
1177                                                "2008",
1178                                                $dcvars->{PASSWORD},
1179                                                undef);
1180
1181         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1182
1183         $ctx->{smb_conf_extra_options} = "
1184         max xmit = 32K
1185         server max protocol = SMB2
1186
1187 [sysvol]
1188         path = $ctx->{statedir}/sysvol
1189         read only = yes
1190
1191 [netlogon]
1192         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1193         read only = no
1194
1195 ";
1196
1197         my $ret = $self->provision_raw_step1($ctx);
1198         unless ($ret) {
1199                 return undef;
1200         }
1201
1202         my $dc_realms = Samba::mk_realms_stanza($dcvars->{REALM}, lc($dcvars->{REALM}),
1203                                                 $dcvars->{DOMAIN}, $dcvars->{SERVER_IP});
1204         Samba::mk_krb5_conf($ctx, $dc_realms);
1205
1206         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1207         my $cmd = "";
1208         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1209         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1210         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $ctx->{realm} subdomain ";
1211         $cmd .= "--parent-domain=$dcvars->{REALM} -U$dcvars->{DC_USERNAME}\@$dcvars->{REALM}\%$dcvars->{DC_PASSWORD}";
1212         $cmd .= " --machinepass=machine$ret->{PASSWORD} --use-ntvfs";
1213
1214         unless (system($cmd) == 0) {
1215                 warn("Join failed\n$cmd");
1216                 return undef;
1217         }
1218
1219         $ret->{SUBDOM_DC_SERVER} = $ret->{SERVER};
1220         $ret->{SUBDOM_DC_SERVER_IP} = $ret->{SERVER_IP};
1221         $ret->{SUBDOM_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1222         $ret->{SUBDOM_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1223
1224         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1225         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1226         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1227         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1228         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1229         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1230
1231         return $ret;
1232 }
1233
1234 sub provision_dc($$)
1235 {
1236         my ($self, $prefix) = @_;
1237
1238         print "PROVISIONING DC...";
1239         my $extra_conf_options = "netbios aliases = localDC1-a";
1240         my $ret = $self->provision($prefix,
1241                                    "domain controller",
1242                                    "localdc",
1243                                    "SAMBADOMAIN",
1244                                    "samba.example.com",
1245                                    "2008",
1246                                    "locDCpass1",
1247                                    undef, $extra_conf_options, "", undef);
1248
1249         return undef unless(defined $ret);
1250         unless($self->add_wins_config("$prefix/private")) {
1251                 warn("Unable to add wins configuration");
1252                 return undef;
1253         }
1254         $ret->{NETBIOSALIAS} = "localdc1-a";
1255         $ret->{DC_SERVER} = $ret->{SERVER};
1256         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1257         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1258         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1259         $ret->{DC_USERNAME} = $ret->{USERNAME};
1260         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1261
1262         return $ret;
1263 }
1264
1265 sub provision_fl2000dc($$)
1266 {
1267         my ($self, $prefix) = @_;
1268
1269         print "PROVISIONING DC...";
1270         my $ret = $self->provision($prefix,
1271                                    "domain controller",
1272                                    "dc5",
1273                                    "SAMBA2000",
1274                                    "samba2000.example.com",
1275                                    "2000",
1276                                    "locDCpass5",
1277                                    undef, "", "", undef);
1278
1279         unless($self->add_wins_config("$prefix/private")) {
1280                 warn("Unable to add wins configuration");
1281                 return undef;
1282         }
1283
1284         return $ret;
1285 }
1286
1287 sub provision_fl2003dc($$)
1288 {
1289         my ($self, $prefix) = @_;
1290
1291         print "PROVISIONING DC...";
1292         my $ret = $self->provision($prefix,
1293                                    "domain controller",
1294                                    "dc6",
1295                                    "SAMBA2003",
1296                                    "samba2003.example.com",
1297                                    "2003",
1298                                    "locDCpass6",
1299                                    undef, "allow dns updates = nonsecure and secure", "", undef);
1300
1301         unless($self->add_wins_config("$prefix/private")) {
1302                 warn("Unable to add wins configuration");
1303                 return undef;
1304         }
1305
1306         return $ret;
1307 }
1308
1309 sub provision_fl2008r2dc($$)
1310 {
1311         my ($self, $prefix) = @_;
1312
1313         print "PROVISIONING DC...";
1314         my $ret = $self->provision($prefix,
1315                                    "domain controller",
1316                                    "dc7",
1317                                    "SAMBA2008R2",
1318                                    "samba2008R2.example.com",
1319                                    "2008_R2",
1320                                    "locDCpass7",
1321                                    undef, "", "", undef);
1322
1323         unless ($self->add_wins_config("$prefix/private")) {
1324                 warn("Unable to add wins configuration");
1325                 return undef;
1326         }
1327
1328         return $ret;
1329 }
1330
1331
1332 sub provision_rodc($$$)
1333 {
1334         my ($self, $prefix, $dcvars) = @_;
1335         print "PROVISIONING RODC...";
1336
1337         # We do this so that we don't run the provision.  That's the job of 'net join RODC'.
1338         my $ctx = $self->provision_raw_prepare($prefix, "domain controller",
1339                                                "rodc",
1340                                                "SAMBADOMAIN",
1341                                                "samba.example.com",
1342                                                "2008",
1343                                                $dcvars->{PASSWORD},
1344                                                $dcvars->{SERVER_IP});
1345         unless ($ctx) {
1346                 return undef;
1347         }
1348
1349         push (@{$ctx->{provision_options}}, "--use-ntvfs");
1350
1351         $ctx->{share} = "$ctx->{prefix_abs}/share";
1352         push(@{$ctx->{directories}}, "$ctx->{share}");
1353
1354         $ctx->{smb_conf_extra_options} = "
1355         max xmit = 32K
1356         server max protocol = SMB2
1357
1358 [sysvol]
1359         path = $ctx->{statedir}/sysvol
1360         read only = yes
1361
1362 [netlogon]
1363         path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
1364         read only = yes
1365
1366 [tmp]
1367         path = $ctx->{share}
1368         read only = no
1369         posix:sharedelay = 10000
1370         posix:oplocktimeout = 3
1371         posix:writetimeupdatedelay = 50000
1372
1373 ";
1374
1375         my $ret = $self->provision_raw_step1($ctx);
1376         unless ($ret) {
1377                 return undef;
1378         }
1379
1380         my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1381         my $cmd = "";
1382         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1383         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1384         $cmd .= "$samba_tool domain join $ret->{CONFIGURATION} $dcvars->{REALM} RODC";
1385         $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD}";
1386         $cmd .= " --server=$dcvars->{DC_SERVER} --use-ntvfs";
1387
1388         unless (system($cmd) == 0) {
1389                 warn("RODC join failed\n$cmd");
1390                 return undef;
1391         }
1392
1393         # we overwrite the kdc after the RODC join
1394         # so that use the RODC as kdc and test
1395         # the proxy code
1396         $ctx->{kdc_ipv4} = $ret->{SERVER_IP};
1397         Samba::mk_krb5_conf($ctx);
1398
1399         $ret->{RODC_DC_SERVER} = $ret->{SERVER};
1400         $ret->{RODC_DC_SERVER_IP} = $ret->{SERVER_IP};
1401         $ret->{RODC_DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1402         $ret->{RODC_DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1403
1404         $ret->{DC_SERVER} = $dcvars->{DC_SERVER};
1405         $ret->{DC_SERVER_IP} = $dcvars->{DC_SERVER_IP};
1406         $ret->{DC_SERVER_IPV6} = $dcvars->{DC_SERVER_IPV6};
1407         $ret->{DC_NETBIOSNAME} = $dcvars->{DC_NETBIOSNAME};
1408         $ret->{DC_USERNAME} = $dcvars->{DC_USERNAME};
1409         $ret->{DC_PASSWORD} = $dcvars->{DC_PASSWORD};
1410
1411         return $ret;
1412 }
1413
1414 sub provision_plugin_s4_dc($$)
1415 {
1416         my ($self, $prefix) = @_;
1417
1418         my $prefix_abs = abs_path($prefix);
1419
1420         my $bindir_abs = abs_path($self->{bindir});
1421         my $lockdir="$prefix_abs/lockdir";
1422         my $conffile="$prefix_abs/etc/smb.conf";
1423
1424         my $extra_smbconf_options = "
1425         server services = -smb +s3fs
1426         xattr_tdb:file = $prefix_abs/statedir/xattr.tdb
1427
1428         kernel oplocks = no
1429         kernel change notify = no
1430
1431         syslog = no
1432         printing = bsd
1433         printcap name = /dev/null
1434
1435         max protocol = SMB3
1436         read only = no
1437         server signing = auto
1438
1439         smbd:sharedelay = 100000
1440         smbd:writetimeupdatedelay = 500000
1441         create mask = 755
1442         dos filemode = yes
1443
1444         dcerpc endpoint servers = -winreg -srvsvc
1445
1446         printcap name = /dev/null
1447
1448         addprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -a -s $conffile --
1449         deleteprinter command = $ENV{SRCDIR_ABS}/source3/script/tests/printing/modprinter.pl -d -s $conffile --
1450
1451         printing = vlp
1452         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
1453         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
1454         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
1455         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
1456         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
1457         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
1458         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
1459         lpq cache time = 0
1460
1461 ";
1462
1463         my $extra_smbconf_shares = "
1464
1465 [tmpenc]
1466         copy = tmp
1467         smb encrypt = required
1468
1469 [tmpcase]
1470         copy = tmp
1471         case sensitive = yes
1472
1473 [tmpguest]
1474         copy = tmp
1475         guest ok = yes
1476
1477 [hideunread]
1478         copy = tmp
1479         hide unreadable = yes
1480
1481 [durable]
1482         copy = tmp
1483         kernel share modes = no
1484         kernel oplocks = no
1485         posix locking = no
1486
1487 [print\$]
1488         copy = tmp
1489
1490 [print1]
1491         copy = tmp
1492         printable = yes
1493
1494 [print2]
1495         copy = print1
1496 [print3]
1497         copy = print1
1498 [lp]
1499         copy = print1
1500 ";
1501
1502         print "PROVISIONING PLUGIN S4 DC...";
1503         my $ret = $self->provision($prefix,
1504                                    "domain controller",
1505                                    "plugindc",
1506                                    "PLUGINDOMAIN",
1507                                    "plugindc.samba.example.com",
1508                                    "2008",
1509                                    "locDCpass1",
1510                                    undef, $extra_smbconf_options,
1511                                    $extra_smbconf_shares, undef);
1512
1513         return undef unless(defined $ret);
1514         unless($self->add_wins_config("$prefix/private")) {
1515                 warn("Unable to add wins configuration");
1516                 return undef;
1517         }
1518
1519         $ret->{DC_SERVER} = $ret->{SERVER};
1520         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1521         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1522         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1523         $ret->{DC_USERNAME} = $ret->{USERNAME};
1524         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1525
1526         return $ret;
1527 }
1528
1529 sub provision_chgdcpass($$)
1530 {
1531         my ($self, $prefix) = @_;
1532
1533         print "PROVISIONING CHGDCPASS...";
1534         my $extra_provision_options = undef;
1535         push (@{$extra_provision_options}, "--dns-backend=BIND9_DLZ");
1536         my $ret = $self->provision($prefix,
1537                                    "domain controller",
1538                                    "chgdcpass",
1539                                    "CHDCDOMAIN",
1540                                    "chgdcpassword.samba.example.com",
1541                                    "2008",
1542                                    "chgDCpass1",
1543                                    undef, "", "",
1544                                    $extra_provision_options);
1545
1546         return undef unless(defined $ret);
1547         unless($self->add_wins_config("$prefix/private")) {
1548                 warn("Unable to add wins configuration");
1549                 return undef;
1550         }
1551
1552         # Remove secrets.tdb from this environment to test that we still start up
1553         # on systems without the new matching secrets.tdb records
1554         unless (unlink("$ret->{PRIVATEDIR}/secrets.tdb") || unlink("$ret->{PRIVATEDIR}/secrets.ntdb")) {
1555                 warn("Unable to remove $ret->{PRIVATEDIR}/secrets.tdb added during provision");
1556                 return undef;
1557         }
1558
1559         $ret->{DC_SERVER} = $ret->{SERVER};
1560         $ret->{DC_SERVER_IP} = $ret->{SERVER_IP};
1561         $ret->{DC_SERVER_IPV6} = $ret->{SERVER_IPV6};
1562         $ret->{DC_NETBIOSNAME} = $ret->{NETBIOSNAME};
1563         $ret->{DC_USERNAME} = $ret->{USERNAME};
1564         $ret->{DC_PASSWORD} = $ret->{PASSWORD};
1565
1566         return $ret;
1567 }
1568
1569 sub teardown_env($$)
1570 {
1571         my ($self, $envvars) = @_;
1572         my $pid;
1573
1574         # This should cause samba to terminate gracefully
1575         close($envvars->{STDIN_PIPE});
1576
1577         $pid = $envvars->{SAMBA_PID};
1578         my $count = 0;
1579         my $childpid;
1580
1581         # This should give it time to write out the gcov data
1582         until ($count > 30) {
1583             if (Samba::cleanup_child($pid, "samba") == -1) {
1584                 last;
1585             }
1586             sleep(1);
1587             $count++;
1588         }
1589
1590         if ($count <= 20 && kill(0, $pid) == 0) {
1591             return;
1592         }
1593
1594         kill "TERM", $pid;
1595
1596         until ($count > 20) {
1597             if (Samba::cleanup_child($pid, "samba") == -1) {
1598                 last;
1599             }
1600             sleep(1);
1601             $count++;
1602         }
1603
1604         # If it is still around, kill it
1605         if ($count > 20 && kill(0, $pid) == 0) {
1606             warn "server process $pid took more than $count seconds to exit, killing\n";
1607             kill 9, $pid;
1608         }
1609
1610         $self->slapd_stop($envvars) if ($self->{ldap});
1611
1612         print $self->getlog_env($envvars);
1613
1614         return;
1615 }
1616
1617 sub getlog_env($$)
1618 {
1619         my ($self, $envvars) = @_;
1620         my $title = "SAMBA LOG of: $envvars->{NETBIOSNAME}\n";
1621         my $out = $title;
1622
1623         open(LOG, "<$envvars->{SAMBA_TEST_LOG}");
1624
1625         seek(LOG, $envvars->{SAMBA_TEST_LOG_POS}, SEEK_SET);
1626         while (<LOG>) {
1627                 $out .= $_;
1628         }
1629         $envvars->{SAMBA_TEST_LOG_POS} = tell(LOG);
1630         close(LOG);
1631
1632         return "" if $out eq $title;
1633
1634         return $out;
1635 }
1636
1637 sub check_env($$)
1638 {
1639         my ($self, $envvars) = @_;
1640
1641         my $childpid = Samba::cleanup_child($envvars->{SAMBA_PID}, "samba");
1642
1643         return ($childpid == 0);
1644 }
1645
1646 sub setup_env($$$)
1647 {
1648         my ($self, $envname, $path) = @_;
1649         my $target3 = $self->{target3};
1650
1651         $ENV{ENVNAME} = $envname;
1652
1653         if (defined($self->{vars}->{$envname})) {
1654                 return $self->{vars}->{$envname};
1655         }
1656
1657         if ($envname eq "dc") {
1658                 return $self->setup_dc("$path/dc");
1659         } elsif ($envname eq "fl2000dc") {
1660                 return $self->setup_fl2000dc("$path/fl2000dc");
1661         } elsif ($envname eq "fl2003dc") {
1662                 return $self->setup_fl2003dc("$path/fl2003dc");
1663         } elsif ($envname eq "fl2008r2dc") {
1664                 return $self->setup_fl2008r2dc("$path/fl2008r2dc");
1665         } elsif ($envname eq "rpc_proxy") {
1666                 if (not defined($self->{vars}->{dc})) {
1667                         $self->setup_dc("$path/dc");
1668                 }
1669                 return $self->setup_rpc_proxy("$path/rpc_proxy", $self->{vars}->{dc});
1670         } elsif ($envname eq "vampire_dc") {
1671                 if (not defined($self->{vars}->{dc})) {
1672                         $self->setup_dc("$path/dc");
1673                 }
1674                 return $self->setup_vampire_dc("$path/vampire_dc", $self->{vars}->{dc});
1675         } elsif ($envname eq "promoted_dc") {
1676                 if (not defined($self->{vars}->{dc})) {
1677                         $self->setup_dc("$path/dc");
1678                 }
1679                 return $self->setup_promoted_dc("$path/promoted_dc", $self->{vars}->{dc});
1680         } elsif ($envname eq "subdom_dc") {
1681                 if (not defined($self->{vars}->{dc})) {
1682                         $self->setup_dc("$path/dc");
1683                 }
1684                 return $self->setup_subdom_dc("$path/subdom_dc", $self->{vars}->{dc});
1685         } elsif ($envname eq "s4member") {
1686                 if (not defined($self->{vars}->{dc})) {
1687                         $self->setup_dc("$path/dc");
1688                 }
1689                 return $self->setup_member("$path/s4member", $self->{vars}->{dc});
1690         } elsif ($envname eq "rodc") {
1691                 if (not defined($self->{vars}->{dc})) {
1692                         $self->setup_dc("$path/dc");
1693                 }
1694                 return $self->setup_rodc("$path/rodc", $self->{vars}->{dc});
1695         } elsif ($envname eq "chgdcpass") {
1696                 return $self->setup_chgdcpass("$path/chgdcpass", $self->{vars}->{chgdcpass});
1697         } elsif ($envname eq "s3member") {
1698                 if (not defined($self->{vars}->{dc})) {
1699                         $self->setup_dc("$path/dc");
1700                 }
1701                 return $target3->setup_admember("$path/s3member", $self->{vars}->{dc}, 29);
1702         } elsif ($envname eq "plugin_s4_dc") {
1703                 return $self->setup_plugin_s4_dc("$path/plugin_s4_dc");
1704         } elsif ($envname eq "s3member_rfc2307") {
1705                 if (not defined($self->{vars}->{dc})) {
1706                         $self->setup_dc("$path/dc");
1707                 }
1708                 return $target3->setup_admember_rfc2307("$path/s3member_rfc2307",
1709                                                         $self->{vars}->{dc}, 34);
1710         } else {
1711                 return "UNKNOWN";
1712         }
1713 }
1714
1715 sub setup_member($$$)
1716 {
1717         my ($self, $path, $dc_vars) = @_;
1718
1719         my $env = $self->provision_member($path, $dc_vars);
1720
1721         if (defined $env) {
1722                 $self->check_or_start($env, "single");
1723
1724                 $self->wait_for_start($env);
1725
1726                 $self->{vars}->{member} = $env;
1727         }
1728
1729         return $env;
1730 }
1731
1732 sub setup_rpc_proxy($$$)
1733 {
1734         my ($self, $path, $dc_vars) = @_;
1735
1736         my $env = $self->provision_rpc_proxy($path, $dc_vars);
1737
1738         if (defined $env) {
1739                 $self->check_or_start($env, "single");
1740
1741                 $self->wait_for_start($env);
1742
1743                 $self->{vars}->{rpc_proxy} = $env;
1744         }
1745         return $env;
1746 }
1747
1748 sub setup_dc($$)
1749 {
1750         my ($self, $path) = @_;
1751
1752         my $env = $self->provision_dc($path);
1753         if (defined $env) {
1754                 $self->check_or_start($env, "standard");
1755
1756                 $self->wait_for_start($env);
1757
1758                 $self->{vars}->{dc} = $env;
1759         }
1760         return $env;
1761 }
1762
1763 sub setup_chgdcpass($$)
1764 {
1765         my ($self, $path) = @_;
1766
1767         my $env = $self->provision_chgdcpass($path);
1768         if (defined $env) {
1769                 $self->check_or_start($env, "single");
1770
1771                 $self->wait_for_start($env);
1772
1773                 $self->{vars}->{chgdcpass} = $env;
1774         }
1775         return $env;
1776 }
1777
1778 sub setup_fl2000dc($$)
1779 {
1780         my ($self, $path) = @_;
1781
1782         my $env = $self->provision_fl2000dc($path);
1783         if (defined $env) {
1784                 $self->check_or_start($env, "single");
1785
1786                 $self->wait_for_start($env);
1787
1788                 $self->{vars}->{fl2000dc} = $env;
1789         }
1790
1791         return $env;
1792 }
1793
1794 sub setup_fl2003dc($$)
1795 {
1796         my ($self, $path) = @_;
1797
1798         my $env = $self->provision_fl2003dc($path);
1799
1800         if (defined $env) {
1801                 $self->check_or_start($env, "single");
1802
1803                 $self->wait_for_start($env);
1804
1805                 $self->{vars}->{fl2003dc} = $env;
1806         }
1807         return $env;
1808 }
1809
1810 sub setup_fl2008r2dc($$)
1811 {
1812         my ($self, $path) = @_;
1813
1814         my $env = $self->provision_fl2008r2dc($path);
1815
1816         if (defined $env) {
1817                 $self->check_or_start($env, "single");
1818
1819                 $self->wait_for_start($env);
1820
1821                 $self->{vars}->{fl2008r2dc} = $env;
1822         }
1823
1824         return $env;
1825 }
1826
1827 sub setup_vampire_dc($$$)
1828 {
1829         my ($self, $path, $dc_vars) = @_;
1830
1831         my $env = $self->provision_vampire_dc($path, $dc_vars);
1832
1833         if (defined $env) {
1834                 $self->check_or_start($env, "single");
1835
1836                 $self->wait_for_start($env);
1837
1838                 $self->{vars}->{vampire_dc} = $env;
1839
1840                 # force replicated DC to update repsTo/repsFrom
1841                 # for vampired partitions
1842                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1843                 my $cmd = "";
1844                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1845                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1846                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
1847                 $cmd .= " $env->{CONFIGURATION}";
1848                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1849                 unless (system($cmd) == 0) {
1850                         warn("Failed to exec kcc\n$cmd");
1851                         return undef;
1852                 }
1853
1854                 # as 'vampired' dc may add data in its local replica
1855                 # we need to synchronize data between DCs
1856                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
1857                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1858                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1859                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
1860                 $cmd .= " $dc_vars->{CONFIGURATION}";
1861                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1862                 # replicate Configuration NC
1863                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
1864                 unless(system($cmd_repl) == 0) {
1865                         warn("Failed to replicate\n$cmd_repl");
1866                         return undef;
1867                 }
1868                 # replicate Default NC
1869                 $cmd_repl = "$cmd \"$base_dn\"";
1870                 unless(system($cmd_repl) == 0) {
1871                         warn("Failed to replicate\n$cmd_repl");
1872                         return undef;
1873                 }
1874         }
1875
1876         return $env;
1877 }
1878
1879 sub setup_promoted_dc($$$)
1880 {
1881         my ($self, $path, $dc_vars) = @_;
1882
1883         my $env = $self->provision_promoted_dc($path, $dc_vars);
1884
1885         if (defined $env) {
1886                 $self->check_or_start($env, "single");
1887
1888                 $self->wait_for_start($env);
1889
1890                 $self->{vars}->{promoted_dc} = $env;
1891
1892                 # force replicated DC to update repsTo/repsFrom
1893                 # for vampired partitions
1894                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1895                 my $cmd = "";
1896                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1897                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1898                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
1899                 $cmd .= " $env->{CONFIGURATION}";
1900                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1901                 unless (system($cmd) == 0) {
1902                         warn("Failed to exec kcc\n$cmd");
1903                         return undef;
1904                 }
1905
1906                 # as 'vampired' dc may add data in its local replica
1907                 # we need to synchronize data between DCs
1908                 my $base_dn = "DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
1909                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1910                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1911                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SERVER}";
1912                 $cmd .= " $dc_vars->{CONFIGURATION}";
1913                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD}";
1914                 # replicate Configuration NC
1915                 my $cmd_repl = "$cmd \"CN=Configuration,$base_dn\"";
1916                 unless(system($cmd_repl) == 0) {
1917                         warn("Failed to replicate\n$cmd_repl");
1918                         return undef;
1919                 }
1920                 # replicate Default NC
1921                 $cmd_repl = "$cmd \"$base_dn\"";
1922                 unless(system($cmd_repl) == 0) {
1923                         warn("Failed to replicate\n$cmd_repl");
1924                         return undef;
1925                 }
1926         }
1927
1928         return $env;
1929 }
1930
1931 sub setup_subdom_dc($$$)
1932 {
1933         my ($self, $path, $dc_vars) = @_;
1934
1935         my $env = $self->provision_subdom_dc($path, $dc_vars);
1936
1937         if (defined $env) {
1938                 $self->check_or_start($env, "single");
1939
1940                 $self->wait_for_start($env);
1941
1942                 $self->{vars}->{subdom_dc} = $env;
1943
1944                 # force replicated DC to update repsTo/repsFrom
1945                 # for primary domain partitions
1946                 my $samba_tool =  Samba::bindir_path($self, "samba-tool");
1947                 my $cmd = "";
1948                 $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1949                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1950                 $cmd .= " $samba_tool drs kcc $env->{DC_SERVER}";
1951                 $cmd .= " $env->{CONFIGURATION}";
1952                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
1953                 unless (system($cmd) == 0) {
1954                         warn("Failed to exec kcc\n$cmd");
1955                         return undef;
1956                 }
1957
1958                 # as 'subdomain' dc may add data in its local replica
1959                 # we need to synchronize data between DCs
1960                 my $base_dn = "DC=".join(",DC=", split(/\./, $env->{REALM}));
1961                 my $config_dn = "CN=Configuration,DC=".join(",DC=", split(/\./, $dc_vars->{REALM}));
1962                 $cmd = "SOCKET_WRAPPER_DEFAULT_IFACE=\"$env->{SOCKET_WRAPPER_DEFAULT_IFACE}\"";
1963                 $cmd .= " KRB5_CONFIG=\"$env->{KRB5_CONFIG}\"";
1964                 $cmd .= " $samba_tool drs replicate $env->{DC_SERVER} $env->{SUBDOM_DC_SERVER}";
1965                 $cmd .= " $dc_vars->{CONFIGURATION}";
1966                 $cmd .= " -U$dc_vars->{DC_USERNAME}\%$dc_vars->{DC_PASSWORD} --realm=$dc_vars->{DC_REALM}";
1967                 # replicate Configuration NC
1968                 my $cmd_repl = "$cmd \"$config_dn\"";
1969                 unless(system($cmd_repl) == 0) {
1970                         warn("Failed to replicate\n$cmd_repl");
1971                         return undef;
1972                 }
1973                 # replicate Default NC
1974                 $cmd_repl = "$cmd \"$base_dn\"";
1975                 unless(system($cmd_repl) == 0) {
1976                         warn("Failed to replicate\n$cmd_repl");
1977                         return undef;
1978                 }
1979         }
1980
1981         return $env;
1982 }
1983
1984 sub setup_rodc($$$)
1985 {
1986         my ($self, $path, $dc_vars) = @_;
1987
1988         my $env = $self->provision_rodc($path, $dc_vars);
1989
1990         unless ($env) {
1991                 return undef;
1992         }
1993
1994         $self->check_or_start($env, "single");
1995
1996         $self->wait_for_start($env);
1997
1998         $self->{vars}->{rodc} = $env;
1999
2000         return $env;
2001 }
2002
2003 sub setup_plugin_s4_dc($$)
2004 {
2005         my ($self, $path) = @_;
2006
2007         # If we didn't build with ADS, pretend this env was never available
2008         if (not $self->{target3}->have_ads()) {
2009                return "UNKNOWN";
2010         }
2011
2012         my $env = $self->provision_plugin_s4_dc($path);
2013         unless ($env) {
2014                 return undef;
2015         }
2016
2017         $self->check_or_start($env, "single");
2018
2019         $self->wait_for_start($env);
2020
2021         $self->{vars}->{plugin_s4_dc} = $env;
2022         return $env;
2023 }
2024
2025 1;