selftest/target/Samba3.pm

   1 #!/usr/bin/perl
   2 # Bootstrap Samba and run a number of tests against it.
   3 # Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Published under the GNU GPL, v3 or later.
   5
   6 # NOTE: Refer to the README for more details about the various testenvs,
   7 # and tips about adding new testenvs.
   8
   9 package Samba3;
  10
  11 use strict;
  12 use warnings;
  13 use Cwd qw(abs_path);
  14 use FindBin qw($RealBin);
  15 use POSIX;
  16 use target::Samba;
  17 use File::Path 'remove_tree';
  18
  19 sub return_alias_env
  20 {
  21         my ($self, $path, $env) = @_;
  22
  23         # just an alias
  24         return $env;
  25 }
  26
  27 sub have_ads($) {
  28         my ($self) = @_;
  29         my $found_ads = 0;
  30         my $smbd_build_options = Samba::bindir_path($self, "smbd") . " --configfile=/dev/null -b|";
  31         open(IN, $smbd_build_options) or die("Unable to run $smbd_build_options: $!");
  32
  33         while (<IN>) {
  34                 if (/HAVE_ADS/) {
  35                        $found_ads = 1;
  36                 }
  37         }
  38         close IN;
  39
  40         # If we were not built with ADS support, pretend we were never even available
  41         print "smbd does not have ADS support\n" unless $found_ads;
  42         return $found_ads;
  43 }
  44
  45 # return smb.conf parameters applicable to @path, based on the underlying
  46 # filesystem type
  47 sub get_fs_specific_conf($$)
  48 {
  49         my ($self, $path) = @_;
  50         my $mods = "";
  51         my $stat_out = `stat --file-system $path` or return "";
  52
  53         if ($stat_out =~ m/Type:\s+btrfs/) {
  54                 $mods .= "streams_xattr btrfs";
  55         }
  56
  57         if ($mods) {
  58                 return "vfs objects = $mods";
  59         }
  60
  61         return '';
  62 }
  63
  64 sub new($$) {
  65         my ($classname, $SambaCtx, $bindir, $srcdir, $server_maxtime) = @_;
  66         my $self = { vars => {},
  67                      SambaCtx => $SambaCtx,
  68                      bindir => $bindir,
  69                      srcdir => $srcdir,
  70                      server_maxtime => $server_maxtime
  71         };
  72         bless $self;
  73         return $self;
  74 }
  75
  76 sub teardown_env($$)
  77 {
  78         my ($self, $envvars) = @_;
  79
  80         if (defined($envvars->{CTDB_PREFIX})) {
  81                 $self->teardown_env_ctdb($envvars);
  82         } else {
  83                 $self->teardown_env_samba($envvars);
  84         }
  85
  86         return;
  87 }
  88
  89 sub teardown_env_samba($$)
  90 {
  91         my ($self, $envvars) = @_;
  92         my $count = 0;
  93
  94         # This should cause smbd to terminate gracefully
  95         close($envvars->{STDIN_PIPE});
  96
  97         my $smbdpid = $envvars->{SMBD_TL_PID};
  98         my $nmbdpid = $envvars->{NMBD_TL_PID};
  99         my $winbinddpid = $envvars->{WINBINDD_TL_PID};
 100         my $samba_dcerpcdpid = $envvars->{SAMBA_DCERPCD_TL_PID};
 101
 102         # This should give it time to write out the gcov data
 103         until ($count > 20) {
 104             my $smbdchild = Samba::cleanup_child($smbdpid, "smbd");
 105             my $nmbdchild = Samba::cleanup_child($nmbdpid, "nmbd");
 106             my $winbinddchild = Samba::cleanup_child($winbinddpid, "winbindd");
 107             my $samba_dcerpcdchild = Samba::cleanup_child(
 108                 $samba_dcerpcdpid, "samba-dcerpcd");
 109             if ($smbdchild == -1
 110                 && $nmbdchild == -1
 111                 && $winbinddchild == -1
 112                 && $samba_dcerpcdpid == -1) {
 113                 last;
 114             }
 115             sleep(1);
 116             $count++;
 117         }
 118
 119         if ($count <= 20 &&
 120             kill(0, $smbdpid, $nmbdpid, $winbinddpid, $samba_dcerpcdpid) == 0) {
 121             return;
 122         }
 123
 124         $self->stop_sig_term($smbdpid);
 125         $self->stop_sig_term($nmbdpid);
 126         $self->stop_sig_term($winbinddpid);
 127         $self->stop_sig_term($samba_dcerpcdpid);
 128
 129         $count = 0;
 130         until ($count > 10) {
 131             my $smbdchild = Samba::cleanup_child($smbdpid, "smbd");
 132             my $nmbdchild = Samba::cleanup_child($nmbdpid, "nmbd");
 133             my $winbinddchild = Samba::cleanup_child($winbinddpid, "winbindd");
 134             my $samba_dcerpcdpid = Samba::cleanup_child(
 135                 $samba_dcerpcdpid, "samba-dcerpcd");
 136             if ($smbdchild == -1
 137                 && $nmbdchild == -1
 138                 && $winbinddchild == -1
 139                 && $samba_dcerpcdpid == -1) {
 140                 last;
 141             }
 142             sleep(1);
 143             $count++;
 144         }
 145
 146         if ($count <= 10 &&
 147             kill(0, $smbdpid, $nmbdpid, $winbinddpid, $samba_dcerpcdpid) == 0) {
 148             return;
 149         }
 150
 151         warn("timelimit process did not quit on SIGTERM, sending SIGKILL");
 152         $self->stop_sig_kill($smbdpid);
 153         $self->stop_sig_kill($nmbdpid);
 154         $self->stop_sig_kill($winbinddpid);
 155         $self->stop_sig_kill($samba_dcerpcdpid);
 156
 157         return 0;
 158 }
 159
 160 sub teardown_env_ctdb($$)
 161 {
 162         my ($self, $data) = @_;
 163
 164         if (defined($data->{SAMBA_NODES})) {
 165                 my $num_nodes = $data->{NUM_NODES};
 166                 my $nodes = $data->{SAMBA_NODES};
 167
 168                 for (my $i = 0; $i < $num_nodes; $i++) {
 169                         if (defined($nodes->[$i])) {
 170                                 $self->teardown_env_samba($nodes->[$i]);
 171                         }
 172                 }
 173         }
 174
 175         close($data->{CTDB_STDIN_PIPE});
 176
 177         if (not defined($data->{SAMBA_NODES})) {
 178                 # Give waiting children time to exit
 179                 sleep(5);
 180         }
 181
 182         return 0;
 183 }
 184
 185 sub getlog_env_app($$$)
 186 {
 187         my ($self, $envvars, $name) = @_;
 188
 189         my $title = "$name LOG of: $envvars->{NETBIOSNAME}\n";
 190         my $out = $title;
 191
 192         open(LOG, "<".$envvars->{$name."_TEST_LOG"});
 193
 194         seek(LOG, $envvars->{$name."_TEST_LOG_POS"}, SEEK_SET);
 195         while (<LOG>) {
 196                 $out .= $_;
 197         }
 198         $envvars->{$name."_TEST_LOG_POS"} = tell(LOG);
 199         close(LOG);
 200
 201         return "" if $out eq $title;
 202
 203         return $out;
 204 }
 205
 206 sub getlog_env($$)
 207 {
 208         my ($self, $envvars) = @_;
 209         my $ret = "";
 210
 211         $ret .= $self->getlog_env_app($envvars, "SMBD");
 212         $ret .= $self->getlog_env_app($envvars, "NMBD");
 213         $ret .= $self->getlog_env_app($envvars, "WINBINDD");
 214
 215         return $ret;
 216 }
 217
 218 sub check_env($$)
 219 {
 220         my ($self, $envvars) = @_;
 221
 222         my $childpid = waitpid(-1, WNOHANG);
 223
 224         # TODO ...
 225         return 1;
 226 }
 227
 228 # Declare the environments Samba3 makes available.
 229 # To be set up, they will be called as
 230 #   samba3->setup_$envname($self, $path, $dep_1_vars, $dep_2_vars, ...)
 231 %Samba3::ENV_DEPS = (
 232         # name              => [dep_1, dep_2, ...],
 233         nt4_dc              => [],
 234         nt4_dc_smb1         => [],
 235         nt4_dc_smb1_done    => ["nt4_dc_smb1"],
 236         nt4_dc_schannel     => [],
 237
 238         simpleserver        => [],
 239         fileserver          => [],
 240         fileserver_smb1     => [],
 241         fileserver_smb1_done => ["fileserver_smb1"],
 242         maptoguest          => [],
 243         ktest               => [],
 244
 245         nt4_member          => ["nt4_dc"],
 246
 247         ad_member           => ["ad_dc", "fl2008r2dc", "fl2003dc"],
 248         ad_member_rfc2307   => ["ad_dc_ntvfs"],
 249         ad_member_idmap_rid => ["ad_dc"],
 250         admem_idmap_autorid => ["ad_dc"],
 251         ad_member_idmap_ad  => ["fl2008r2dc"],
 252         ad_member_fips      => ["ad_dc_fips"],
 253         ad_member_offlogon  => ["ad_dc"],
 254         ad_member_oneway    => ["fl2000dc"],
 255         ad_member_idmap_nss => ["ad_dc"],
 256         ad_member_s3_join   => ["vampire_dc"],
 257
 258         clusteredmember => ["ad_dc"],
 259 );
 260
 261 %Samba3::ENV_DEPS_POST = ();
 262
 263 sub setup_nt4_dc
 264 {
 265         my ($self, $path, $more_conf, $domain, $server) = @_;
 266
 267         print "PROVISIONING NT4 DC...";
 268
 269         my $nt4_dc_options = "
 270         domain master = yes
 271         domain logons = yes
 272         lanman auth = yes
 273         ntlm auth = yes
 274         raw NTLMv2 auth = yes
 275         rpc start on demand helpers = false
 276
 277         CVE_2020_1472:warn_about_unused_debug_level = 3
 278         server require schannel:schannel0\$ = no
 279         server require schannel:schannel1\$ = no
 280         server require schannel:schannel2\$ = no
 281         server require schannel:schannel3\$ = no
 282         server require schannel:schannel4\$ = no
 283         server require schannel:schannel5\$ = no
 284         server require schannel:schannel6\$ = no
 285         server require schannel:schannel7\$ = no
 286         server require schannel:schannel8\$ = no
 287         server require schannel:schannel9\$ = no
 288         server require schannel:schannel10\$ = no
 289         server require schannel:schannel11\$ = no
 290         server require schannel:torturetest\$ = no
 291
 292         server schannel require seal:schannel0\$ = no
 293         server schannel require seal:schannel1\$ = no
 294         server schannel require seal:schannel2\$ = no
 295         server schannel require seal:schannel3\$ = no
 296         server schannel require seal:schannel4\$ = no
 297         server schannel require seal:schannel5\$ = no
 298         server schannel require seal:schannel6\$ = no
 299         server schannel require seal:schannel7\$ = no
 300         server schannel require seal:schannel8\$ = no
 301         server schannel require seal:schannel9\$ = no
 302         server schannel require seal:schannel10\$ = no
 303         server schannel require seal:schannel11\$ = no
 304         server schannel require seal:torturetest\$ = no
 305
 306         vfs_default:VFS_OPEN_HOW_RESOLVE_NO_SYMLINKS = no
 307
 308         fss: sequence timeout = 1
 309         check parent directory delete on close = yes
 310 ";
 311
 312         if (defined($more_conf)) {
 313                 $nt4_dc_options = $nt4_dc_options . $more_conf;
 314         }
 315         if (!defined($domain)) {
 316                 $domain = "SAMBA-TEST";
 317         }
 318         if (!defined($server)) {
 319                 $server = "LOCALNT4DC2";
 320         }
 321         my $vars = $self->provision(
 322             prefix => $path,
 323             domain => $domain,
 324             server => $server,
 325             password => "localntdc2pass",
 326             extra_options => $nt4_dc_options);
 327
 328         $vars or return undef;
 329
 330         if (not $self->check_or_start(
 331                 env_vars => $vars,
 332                 samba_dcerpcd => "yes",
 333                 nmbd => "yes",
 334                 winbindd => "yes",
 335                 smbd => "yes")) {
 336                return undef;
 337         }
 338
 339         $vars->{DOMSID} = $vars->{SAMSID};
 340         $vars->{DC_SERVER} = $vars->{SERVER};
 341         $vars->{DC_SERVER_IP} = $vars->{SERVER_IP};
 342         $vars->{DC_SERVER_IPV6} = $vars->{SERVER_IPV6};
 343         $vars->{DC_NETBIOSNAME} = $vars->{NETBIOSNAME};
 344         $vars->{DC_USERNAME} = $vars->{USERNAME};
 345         $vars->{DC_PASSWORD} = $vars->{PASSWORD};
 346
 347         return $vars;
 348 }
 349
 350 sub setup_nt4_dc_smb1
 351 {
 352         my ($self, $path) = @_;
 353         my $conf = "
 354 [global]
 355         client min protocol = CORE
 356         server min protocol = LANMAN1
 357 ";
 358         return $self->setup_nt4_dc($path, $conf, "NT4SMB1", "LCLNT4DC2SMB1");
 359 }
 360
 361 sub setup_nt4_dc_smb1_done
 362 {
 363         my ($self, $path, $dep_env) = @_;
 364         return $self->return_alias_env($path, $dep_env);
 365 }
 366
 367 sub setup_nt4_dc_schannel
 368 {
 369         my ($self, $path) = @_;
 370
 371         print "PROVISIONING NT4 DC WITH SERVER SCHANNEL ...";
 372
 373         my $pdc_options = "
 374         domain master = yes
 375         domain logons = yes
 376         lanman auth = yes
 377
 378         server schannel = yes
 379         # used to reproduce bug #12772
 380         server max protocol = SMB2_02
 381 ";
 382
 383         my $vars = $self->provision(
 384             prefix => $path,
 385             domain => "NT4SCHANNEL",
 386             server => "LOCALNT4DC9",
 387             password => "localntdc9pass",
 388             extra_options => $pdc_options);
 389
 390         $vars or return undef;
 391
 392         if (not $self->check_or_start(
 393                 env_vars => $vars,
 394                 nmbd => "yes",
 395                 winbindd => "yes",
 396                 smbd => "yes")) {
 397                return undef;
 398         }
 399
 400         $vars->{DOMSID} = $vars->{SAMSID};
 401         $vars->{DC_SERVER} = $vars->{SERVER};
 402         $vars->{DC_SERVER_IP} = $vars->{SERVER_IP};
 403         $vars->{DC_SERVER_IPV6} = $vars->{SERVER_IPV6};
 404         $vars->{DC_NETBIOSNAME} = $vars->{NETBIOSNAME};
 405         $vars->{DC_USERNAME} = $vars->{USERNAME};
 406         $vars->{DC_PASSWORD} = $vars->{PASSWORD};
 407
 408         return $vars;
 409 }
 410
 411 sub setup_nt4_member
 412 {
 413         my ($self, $prefix, $nt4_dc_vars) = @_;
 414         my $count = 0;
 415         my $rc;
 416
 417         print "PROVISIONING MEMBER...";
 418
 419         my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
 420         if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} // '' eq "1") {
 421                 $require_mutexes = "";
 422         }
 423
 424         my $member_options = "
 425         security = domain
 426         lanman auth = yes
 427         ntlm auth = yes
 428         dbwrap_tdb_mutexes:* = yes
 429         ${require_mutexes}
 430 ";
 431         my $ret = $self->provision(
 432             prefix => $prefix,
 433             domain => $nt4_dc_vars->{DOMAIN},
 434             server => "LOCALNT4MEMBER3",
 435             password => "Lnt4member3p14",
 436             extra_options_before_inject => $member_options);
 437
 438         $ret or return undef;
 439
 440         my $nmblookup = Samba::bindir_path($self, "nmblookup");
 441         do {
 442                 print "Waiting for the LOGON SERVER registration ...\n";
 443                 $rc = system("$nmblookup $ret->{CONFIGURATION} $ret->{DOMAIN}\#1c");
 444                 if ($rc != 0) {
 445                         sleep(1);
 446                 }
 447                 $count++;
 448         } while ($rc != 0 && $count < 10);
 449         if ($count == 10) {
 450                 print "NMBD not reachable after 10 retries\n";
 451                 teardown_env($self, $ret);
 452                 return 0;
 453         }
 454
 455         my $net = Samba::bindir_path($self, "net");
 456         # Add hosts file for name lookups
 457         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
 458         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 459         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 460         $cmd .= "$net rpc join $ret->{CONFIGURATION} $nt4_dc_vars->{DOMAIN} member";
 461         $cmd .= " -U$nt4_dc_vars->{USERNAME}\%$nt4_dc_vars->{PASSWORD}";
 462
 463         if (system($cmd) != 0) {
 464             warn("Join failed\n$cmd");
 465             return undef;
 466         }
 467
 468         # Add hosts file for name lookups
 469         $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
 470         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 471         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 472         $cmd .= "$net $ret->{CONFIGURATION} primarytrust dumpinfo | grep -q 'REDACTED SECRET VALUES'";
 473
 474         if (system($cmd) != 0) {
 475             warn("check failed\n$cmd");
 476             return undef;
 477         }
 478
 479         if (not $self->check_or_start(
 480                 env_vars => $ret,
 481                 nmbd => "yes",
 482                 winbindd => "yes",
 483                 smbd => "yes")) {
 484                return undef;
 485         }
 486
 487         $ret->{DOMSID} = $nt4_dc_vars->{DOMSID};
 488         $ret->{DC_SERVER} = $nt4_dc_vars->{SERVER};
 489         $ret->{DC_SERVER_IP} = $nt4_dc_vars->{SERVER_IP};
 490         $ret->{DC_SERVER_IPV6} = $nt4_dc_vars->{SERVER_IPV6};
 491         $ret->{DC_NETBIOSNAME} = $nt4_dc_vars->{NETBIOSNAME};
 492         $ret->{DC_USERNAME} = $nt4_dc_vars->{USERNAME};
 493         $ret->{DC_PASSWORD} = $nt4_dc_vars->{PASSWORD};
 494
 495         return $ret;
 496 }
 497
 498 sub setup_clusteredmember
 499 {
 500         my ($self, $prefix, $dcvars) = @_;
 501         my $count = 0;
 502         my $rc;
 503         my @retvals = ();
 504         my $ret;
 505
 506         print "PROVISIONING CLUSTEREDMEMBER...\n";
 507
 508         my $prefix_abs = abs_path($prefix);
 509         mkdir($prefix_abs, 0777);
 510
 511         my $ctdb_data = $self->setup_ctdb($prefix);
 512
 513         if (not $ctdb_data) {
 514                 print "No ctdb data\n";
 515                 return undef;
 516         }
 517
 518         print "PROVISIONING CLUSTERED SAMBA...\n";
 519
 520         my $num_nodes = $ctdb_data->{NUM_NODES};
 521         my $nodes = $ctdb_data->{CTDB_NODES};
 522
 523         # Enable cleanup of earlier nodes if a later node fails
 524         $ctdb_data->{SAMBA_NODES} = \@retvals;
 525
 526         for (my $i = 0; $i < $num_nodes; $i++) {
 527                 my $node = $nodes->[$i];
 528                 my $socket = $node->{SOCKET_FILE};
 529                 my $server_name = $node->{SERVER_NAME};
 530                 my $pub_iface = $node->{SOCKET_WRAPPER_DEFAULT_IFACE};
 531                 my $node_prefix = $node->{NODE_PREFIX};
 532
 533                 print "CTDB_BASE=${node_prefix}\n";
 534                 print "CTDB_SOCKET=${socket}\n";
 535
 536                 my $require_mutexes = "dbwrap_tdb_require_mutexes:* = yes";
 537                 if ($ENV{SELFTEST_DONT_REQUIRE_TDB_MUTEX_SUPPORT} // '' eq "1") {
 538                         $require_mutexes = "" ;
 539                 }
 540
 541                 my $member_options = "
 542        security = ADS
 543        workgroup = $dcvars->{DOMAIN}
 544        realm = $dcvars->{REALM}
 545        password server = $dcvars->{SERVER}
 546        server signing = on
 547        clustering = yes
 548        rpc start on demand helpers = false
 549        rpcd witness:include node ips = yes
 550        ctdbd socket = ${socket}
 551        include = registry
 552        dbwrap_tdb_mutexes:* = yes
 553        ${require_mutexes}
 554        sync machine password to keytab = $node_prefix/keytab0:account_name:machine_password:sync_kvno
 555 ";
 556
 557                 my $node_ret = $self->provision(
 558                     prefix => "$node_prefix",
 559                     domain => $dcvars->{DOMAIN},
 560                     server => "$server_name",
 561                     password => "clustermember8pass",
 562                     netbios_name => "CLUSTEREDMEMBER",
 563                     share_dir => "${prefix_abs}/shared",
 564                     extra_options => $member_options,
 565                     no_delete_prefix => 1);
 566                 if (not $node_ret) {
 567                         print "Provision node $i failed\n";
 568                         teardown_env($self, $ctdb_data);
 569                         return undef;
 570                 }
 571
 572                 my $registry_share_template = "$node_ret->{SERVERCONFFILE}.registry_share_template";
 573                 unless (open(REGISTRYCONF, ">$registry_share_template")) {
 574                         warn("Unable to open $registry_share_template");
 575                         teardown_env($self, $node_ret);
 576                         teardown_env($self, $ctdb_data);
 577                         return undef;
 578                 }
 579
 580                 print REGISTRYCONF "
 581 [registry_share]
 582         copy = tmp
 583         comment = smb username is [%U]
 584 ";
 585
 586                 close(REGISTRYCONF);
 587
 588                 my $net = Samba::bindir_path($self, "net");
 589                 my $cmd = "";
 590
 591                 $cmd .= "UID_WRAPPER_ROOT=1 ";
 592                 $cmd .= "$net conf import $node_ret->{CONFIGURATION} ${registry_share_template}";
 593
 594                 my $net_ret = system($cmd);
 595                 if ($net_ret != 0) {
 596                         warn("net conf import failed: $net_ret\n$cmd");
 597                         teardown_env($self, $node_ret);
 598                         teardown_env($self, $ctdb_data);
 599                         return undef;
 600                 }
 601
 602                 my $nmblookup = Samba::bindir_path($self, "nmblookup");
 603                 do {
 604                         print "Waiting for the LOGON SERVER registration ...\n";
 605                         $rc = system("$nmblookup $node_ret->{CONFIGURATION} " .
 606                                      "$node_ret->{DOMAIN}\#1c");
 607                         if ($rc != 0) {
 608                                 sleep(1);
 609                         }
 610                         $count++;
 611                 } while ($rc != 0 && $count < 10);
 612
 613                 if ($count == 10) {
 614                         print "NMBD not reachable after 10 retries\n";
 615                         teardown_env($self, $node_ret);
 616                         teardown_env($self, $ctdb_data);
 617                         return undef;
 618                 }
 619
 620                 push(@retvals, $node_ret);
 621         }
 622
 623         $ret = {%$ctdb_data, %{$retvals[0]}};
 624
 625         my $ctx;
 626         $ctx = {};
 627         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
 628         $ctx->{domain} = $dcvars->{DOMAIN};
 629         $ctx->{realm} = $dcvars->{REALM};
 630         $ctx->{dnsname} = lc($dcvars->{REALM});
 631         $ctx->{kdc_ipv4} = $dcvars->{SERVER_IP};
 632         $ctx->{kdc_ipv6} = $dcvars->{SERVER_IPV6};
 633         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
 634         Samba::mk_krb5_conf($ctx, "");
 635
 636         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
 637
 638         my $net = Samba::bindir_path($self, "net");
 639         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
 640         $cmd .= "UID_WRAPPER_ROOT=1 ";
 641         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 642         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
 643         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 644         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 645         $cmd .= "$net join $ret->{CONFIGURATION} $dcvars->{DOMAIN} member";
 646         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
 647
 648         if (system($cmd) != 0) {
 649                 warn("Join failed\n$cmd");
 650                 teardown_env($self, $ret);
 651                 return undef;
 652         }
 653
 654         for (my $i=0; $i<@retvals; $i++) {
 655                 my $node_provision = $retvals[$i];
 656                 my $ok;
 657                 $ok = $self->check_or_start(
 658                     env_vars => $node_provision,
 659                     samba_dcerpcd => "yes",
 660                     winbindd => "yes",
 661                     smbd => "yes",
 662                     child_cleanup => sub {
 663                         map {
 664                             my $fh = $_->{STDIN_PIPE};
 665                             close($fh) if defined($fh);
 666                         } @retvals });
 667                 if (not $ok) {
 668                         teardown_env($self, $ret);
 669                         return undef;
 670                 }
 671         }
 672
 673         #
 674         # Build a unclist for every share
 675         #
 676         unless (open(NODES, "<$ret->{CTDB_NODES_FILE}")) {
 677                 warn("Unable to open CTDB nodes file");
 678                 teardown_env($self, $ret);
 679                 return undef;
 680         }
 681         my @nodes = <NODES>;
 682         close(NODES);
 683         chomp @nodes;
 684
 685         my $conffile = $ret->{SERVERCONFFILE};
 686         $cmd = "";
 687         $cmd .= 'sed -n -e \'s|^\[\(.*\)\]$|\1|p\'';
 688         $cmd .= " \"$conffile\"";
 689         $cmd .= " | grep -vx 'global'";
 690
 691         my @shares = `$cmd`;
 692         $rc = $?;
 693         if ($rc != 0) {
 694                 warn("Listing shares failed\n$cmd");
 695                 teardown_env($self, $ret);
 696                 return undef;
 697         }
 698         chomp @shares;
 699
 700         my $unclistdir = "${prefix_abs}/unclists";
 701         mkdir($unclistdir, 0777);
 702         foreach my $share (@shares) {
 703                 my $l = "${unclistdir}/${share}.txt";
 704                 unless (open(UNCLIST, ">${l}")) {
 705                         warn("Unable to open UNC list ${l}");
 706                         teardown_env($self, $ret);
 707                         return undef;
 708                 }
 709                 foreach my $node (@nodes) {
 710                         print UNCLIST "//${node}/${share}\n";
 711                 }
 712                 close(UNCLIST);
 713         }
 714
 715         $ret->{DOMSID} = $dcvars->{DOMSID};
 716         $ret->{DC_SERVER} = $dcvars->{SERVER};
 717         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
 718         $ret->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
 719         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
 720         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
 721         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
 722         $ret->{REALM} = $dcvars->{REALM};
 723         $ret->{DOMAIN} = $dcvars->{DOMAIN};
 724
 725         return $ret;
 726 }
 727
 728 sub provision_ad_member
 729 {
 730         my ($self,
 731             $prefix,
 732             $machine_account,
 733             $dcvars,
 734             $trustvars_f,
 735             $trustvars_e,
 736             $extra_member_options,
 737             $force_fips_mode,
 738             $offline_logon,
 739             $no_nss_winbind,
 740             $sync_pw2keytab) = @_;
 741
 742         if (defined($offline_logon) && defined($no_nss_winbind)) {
 743                 warn ("Offline logon incompatible with no nss winbind\n");
 744                 return undef;
 745         }
 746
 747         my $prefix_abs = abs_path($prefix);
 748         my @dirs = ();
 749
 750         mkdir($prefix_abs, 0777);
 751
 752         my $share_dir="$prefix_abs/share";
 753         push(@dirs, $share_dir);
 754
 755         my $substitution_path = "$share_dir/D_$dcvars->{DOMAIN}";
 756         push(@dirs, $substitution_path);
 757
 758         $substitution_path = "$share_dir/D_$dcvars->{DOMAIN}/U_alice";
 759         push(@dirs, $substitution_path);
 760
 761         $substitution_path = "$share_dir/D_$dcvars->{DOMAIN}/U_alice/G_domain users";
 762         push(@dirs, $substitution_path);
 763
 764         # Using '/' as the winbind separator is a bad idea ...
 765         $substitution_path = "$share_dir/D_$dcvars->{DOMAIN}/u_$dcvars->{DOMAIN}";
 766         push(@dirs, $substitution_path);
 767
 768         $substitution_path = "$share_dir/D_$dcvars->{DOMAIN}/u_$dcvars->{DOMAIN}/alice";
 769         push(@dirs, $substitution_path);
 770
 771         $substitution_path = "$share_dir/D_$dcvars->{DOMAIN}/u_$dcvars->{DOMAIN}/alice/g_$dcvars->{DOMAIN}";
 772         push(@dirs, $substitution_path);
 773
 774         $substitution_path = "$share_dir/D_$dcvars->{DOMAIN}/u_$dcvars->{DOMAIN}/alice/g_$dcvars->{DOMAIN}/domain users";
 775         push(@dirs, $substitution_path);
 776
 777         my $smbcacls_sharedir="$share_dir/smbcacls";
 778         push(@dirs,$smbcacls_sharedir);
 779
 780         my $option_offline_logon = "no";
 781         if (defined($offline_logon)) {
 782                 $option_offline_logon = "yes";
 783         }
 784
 785         my $netbios_aliases = "";
 786         if ($machine_account eq "LOCALADMEMBER") {
 787                 $netbios_aliases = "netbios aliases = foo bar";
 788         }
 789
 790         unless (defined($extra_member_options)) {
 791                 $extra_member_options = "";
 792         }
 793
 794         my $dns_and_netbios = "";
 795         my $keytab = "";
 796         if (defined($sync_pw2keytab)) {
 797                 $dns_and_netbios = "
 798         additional dns hostnames =  host1.example.com host2.other.com
 799         netbios aliases = NETBIOS1 NETBIOS2 NETBIOS3
 800         ";
 801                 $keytab = "
 802         sync machine password to keytab = \\
 803         \"$prefix_abs/keytab0:account_name:machine_password\", \\
 804         \"$prefix_abs/keytab0k:account_name:sync_kvno:machine_password:sync_etypes\", \\
 805         \"$prefix_abs/keytab1:sync_spns:machine_password:sync_etypes\", \\
 806         \"$prefix_abs/keytab1k:sync_spns:sync_kvno:machine_password:sync_etypes\", \\
 807         \"$prefix_abs/keytab2:spn_prefixes=imap,smtp:additional_dns_hostnames:netbios_aliases:machine_password:sync_etypes\", \\
 808         \"$prefix_abs/keytab2k:spn_prefixes=imap,smtp:additional_dns_hostnames:sync_kvno:machine_password:sync_etypes\", \\
 809         \"$prefix_abs/keytab3:spns=wurst/brot\@$dcvars->{REALM}:machine_password:sync_etypes\", \\
 810         \"$prefix_abs/keytab3k:spns=wurst/brot\@$dcvars->{REALM},wurst1/brot\@$dcvars->{REALM},wurst2/brot\@$dcvars->{REALM}:sync_kvno:machine_password:sync_etypes\"
 811         ";
 812         }
 813
 814         my $member_options = "
 815         security = ads
 816         workgroup = $dcvars->{DOMAIN}
 817         realm = $dcvars->{REALM}
 818         $netbios_aliases
 819         template homedir = /home/%D/%G/%U
 820         auth event notification = true
 821         password server = $dcvars->{SERVER}
 822         winbind scan trusted domains = no
 823         winbind offline logon = $option_offline_logon
 824
 825         allow dcerpc auth level connect:lsarpc = yes
 826         dcesrv:max auth states = 8
 827         rpc start on demand helpers = false
 828
 829         # Begin extra member options
 830         $extra_member_options
 831         # End extra member options
 832         $dns_and_netbios
 833         $keytab
 834
 835 [sub_dug]
 836         path = $share_dir/D_%D/U_%U/G_%G
 837         writeable = yes
 838
 839 [sub_dug2]
 840         path = $share_dir/D_%D/u_%u/g_%g
 841         writeable = yes
 842
 843 [sub_valid_users]
 844         path = $share_dir
 845         valid users = ADDOMAIN/%U
 846
 847 [sub_valid_users_domain]
 848     path = $share_dir
 849     valid users = %D/%U
 850
 851 [sub_valid_users_group]
 852     path = $share_dir
 853     valid users = \@$dcvars->{DOMAIN}/%G
 854
 855 [valid_users]
 856     path = $share_dir
 857     valid users = $dcvars->{DOMAIN}/$dcvars->{DC_USERNAME}
 858
 859 [valid_users_group]
 860     path = $share_dir
 861     valid users = \"\@$dcvars->{DOMAIN}/domain users\"
 862
 863 [valid_users_unix_group]
 864     path = $share_dir
 865     valid users = \"+$dcvars->{DOMAIN}/domain users\"
 866
 867 [valid_users_nis_group]
 868     path = $share_dir
 869     valid users = \"&$dcvars->{DOMAIN}/domain users\"
 870
 871 [valid_users_unix_nis_group]
 872     path = $share_dir
 873     valid users = \"+&$dcvars->{DOMAIN}/domain users\"
 874
 875 [valid_users_nis_unix_group]
 876     path = $share_dir
 877     valid users = \"&+$dcvars->{DOMAIN}/domain users\"
 878
 879 [invalid_users]
 880     path = $share_dir
 881     invalid users = $dcvars->{DOMAIN}/$dcvars->{DC_USERNAME}
 882
 883 [valid_and_invalid_users]
 884     path = $share_dir
 885     valid users = $dcvars->{DOMAIN}/$dcvars->{DC_USERNAME} $dcvars->{DOMAIN}/alice
 886     invalid users = $dcvars->{DOMAIN}/$dcvars->{DC_USERNAME}
 887 ";
 888
 889         my $ret = $self->provision(
 890             prefix => $prefix,
 891             domain => $dcvars->{DOMAIN},
 892             realm => $dcvars->{REALM},
 893             server => $machine_account,
 894             password => "loCalMemberPass",
 895             extra_options => $member_options,
 896             resolv_conf => $dcvars->{RESOLV_CONF});
 897
 898         $ret or return undef;
 899
 900         mkdir($_, 0777) foreach(@dirs);
 901
 902         $ret->{DOMAIN} = $dcvars->{DOMAIN};
 903         $ret->{REALM} = $dcvars->{REALM};
 904         $ret->{DOMSID} = $dcvars->{DOMSID};
 905
 906         my $ctx;
 907         $ctx = {};
 908         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
 909         $ctx->{domain} = $dcvars->{DOMAIN};
 910         $ctx->{realm} = $dcvars->{REALM};
 911         $ctx->{dnsname} = lc($dcvars->{REALM});
 912         $ctx->{kdc_ipv4} = $dcvars->{SERVER_IP};
 913         $ctx->{kdc_ipv6} = $dcvars->{SERVER_IPV6};
 914         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
 915         Samba::mk_krb5_conf($ctx, "");
 916
 917         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
 918
 919         if (defined($force_fips_mode)) {
 920                 $ret->{GNUTLS_FORCE_FIPS_MODE} = "1";
 921                 $ret->{OPENSSL_FORCE_FIPS_MODE} = "1";
 922         }
 923
 924         my $net = Samba::bindir_path($self, "net");
 925         # Add hosts file for name lookups
 926         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
 927         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 928         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
 929                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
 930         } else {
 931                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
 932         }
 933         if (defined($force_fips_mode)) {
 934                 $cmd .= "GNUTLS_FORCE_FIPS_MODE=1 ";
 935                 $cmd .= "OPENSSL_FORCE_FIPS_MODE=1 ";
 936         }
 937         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
 938         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 939         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 940         $cmd .= "$net join $ret->{CONFIGURATION}";
 941         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD} --use-kerberos=required";
 942
 943         if (system($cmd) != 0) {
 944             warn("Join failed\n$cmd");
 945             return undef;
 946         }
 947
 948         # We need world access to this share, as otherwise the domain
 949         # administrator from the AD domain provided by Samba4 can't
 950         # access the share for tests.
 951         chmod 0777, "$prefix/share";
 952
 953         if (defined($offline_logon)) {
 954                 my $wbinfo = Samba::bindir_path($self, "wbinfo");
 955
 956                 if (not $self->check_or_start(
 957                         env_vars => $ret,
 958                         winbindd => "yes")) {
 959                         return undef;
 960                 }
 961
 962                 # Fill samlogoncache for alice
 963                 $cmd = "NSS_WRAPPER_PASSWD='$ret->{NSS_WRAPPER_PASSWD}' ";
 964                 $cmd .= "NSS_WRAPPER_GROUP='$ret->{NSS_WRAPPER_GROUP}' ";
 965                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 966                 $cmd .= "$wbinfo --pam-logon=ADDOMAIN/alice%Secret007";
 967                 if (system($cmd) != 0) {
 968                         warn("Filling the cache failed\n$cmd");
 969                         return undef;
 970                 }
 971
 972                 $cmd = "NSS_WRAPPER_PASSWD='$ret->{NSS_WRAPPER_PASSWD}' ";
 973                 $cmd .= "NSS_WRAPPER_GROUP='$ret->{NSS_WRAPPER_GROUP}' ";
 974                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 975                 $cmd .= "$wbinfo --ccache-save=ADDOMAIN/alice%Secret007";
 976                 if (system($cmd) != 0) {
 977                         warn("Filling the cache failed\n$cmd");
 978                         return undef;
 979                 }
 980
 981                 # Fill samlogoncache for bob
 982                 $cmd = "NSS_WRAPPER_PASSWD='$ret->{NSS_WRAPPER_PASSWD}' ";
 983                 $cmd .= "NSS_WRAPPER_GROUP='$ret->{NSS_WRAPPER_GROUP}' ";
 984                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 985                 $cmd .= "$wbinfo --pam-logon=ADDOMAIN/bob%Secret007";
 986                 if (system($cmd) != 0) {
 987                         warn("Filling the cache failed\n$cmd");
 988                         return undef;
 989                 }
 990
 991                 $cmd = "NSS_WRAPPER_PASSWD='$ret->{NSS_WRAPPER_PASSWD}' ";
 992                 $cmd .= "NSS_WRAPPER_GROUP='$ret->{NSS_WRAPPER_GROUP}' ";
 993                 $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
 994                 $cmd .= "$wbinfo --ccache-save=ADDOMAIN/bob%Secret007";
 995                 if (system($cmd) != 0) {
 996                         warn("Filling the cache failed\n$cmd");
 997                         return undef;
 998                 }
 999
1000                 # Set windindd offline
1001                 my $smbcontrol = Samba::bindir_path($self, "smbcontrol");
1002                 $cmd = "NSS_WRAPPER_PASSWD='$ret->{NSS_WRAPPER_PASSWD}' ";
1003                 $cmd .= "NSS_WRAPPER_GROUP='$ret->{NSS_WRAPPER_GROUP}' ";
1004                 $cmd .= "UID_WRAPPER_ROOT='1' ";
1005                 $cmd .= "$smbcontrol $ret->{CONFIGURATION} winbindd offline";
1006                 if (system($cmd) != 0) {
1007                         warn("Setting winbindd offline failed\n$cmd");
1008                         return undef;
1009                 }
1010
1011                 # Validate the offline cache
1012                 $cmd = "NSS_WRAPPER_PASSWD='$ret->{NSS_WRAPPER_PASSWD}' ";
1013                 $cmd .= "NSS_WRAPPER_GROUP='$ret->{NSS_WRAPPER_GROUP}' ";
1014                 $cmd .= "UID_WRAPPER_ROOT='1' ";
1015                 $cmd .= "$smbcontrol $ret->{CONFIGURATION} winbindd validate-cache";
1016                 if (system($cmd) != 0) {
1017                         warn("Validation of winbind credential cache failed\n$cmd");
1018                         teardown_env($self, $ret);
1019                         return undef;
1020                 }
1021
1022                 # Shut down winbindd
1023                 teardown_env($self, $ret);
1024
1025                 ### Change SOCKET_WRAPPER_DIR so it can't connect to AD
1026                 my $swrap_env = $ENV{SOCKET_WRAPPER_DIR};
1027                 $ENV{SOCKET_WRAPPER_DIR} = "$prefix_abs";
1028
1029                 # Start winbindd in offline mode
1030                 if (not $self->check_or_start(
1031                         env_vars => $ret,
1032                         winbindd => "offline")) {
1033                         return undef;
1034                 }
1035
1036                 # Set socket dir again
1037                 $ENV{SOCKET_WRAPPER_DIR} = $swrap_env;
1038
1039         } else {
1040                 if (defined($no_nss_winbind)) {
1041                         $ret->{NSS_WRAPPER_MODULE_SO_PATH} = "";
1042                         $ret->{NSS_WRAPPER_MODULE_FN_PREFIX} = "";
1043                 }
1044
1045                 if (not $self->check_or_start(
1046                         env_vars => $ret,
1047                         samba_dcerpcd => "yes",
1048                         nmbd => "yes",
1049                         winbindd => "yes",
1050                         smbd => "yes")) {
1051                         return undef;
1052                 }
1053         }
1054
1055         $ret->{DC_SERVER} = $dcvars->{SERVER};
1056         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
1057         $ret->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
1058         $ret->{DC_SERVERCONFFILE} = $dcvars->{SERVERCONFFILE};
1059         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
1060         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
1061         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
1062         $ret->{DOMAIN_ADMIN} = $dcvars->{DOMAIN_ADMIN};
1063         $ret->{DOMAIN_ADMIN_PASSWORD} = $dcvars->{DOMAIN_ADMIN_PASSWORD};
1064         $ret->{DOMAIN_USER} = $dcvars->{DOMAIN_USER};
1065         $ret->{DOMAIN_USER_PASSWORD} = $dcvars->{DOMAIN_USER_PASSWORD};
1066
1067         # forest trust
1068         $ret->{TRUST_F_BOTH_SERVER} = $trustvars_f->{SERVER};
1069         $ret->{TRUST_F_BOTH_SERVER_IP} = $trustvars_f->{SERVER_IP};
1070         $ret->{TRUST_F_BOTH_SERVER_IPV6} = $trustvars_f->{SERVER_IPV6};
1071         $ret->{TRUST_F_BOTH_NETBIOSNAME} = $trustvars_f->{NETBIOSNAME};
1072         $ret->{TRUST_F_BOTH_USERNAME} = $trustvars_f->{USERNAME};
1073         $ret->{TRUST_F_BOTH_PASSWORD} = $trustvars_f->{PASSWORD};
1074         $ret->{TRUST_F_BOTH_DOMAIN} = $trustvars_f->{DOMAIN};
1075         $ret->{TRUST_F_BOTH_REALM} = $trustvars_f->{REALM};
1076
1077         # external trust
1078         $ret->{TRUST_E_BOTH_SERVER} = $trustvars_e->{SERVER};
1079         $ret->{TRUST_E_BOTH_SERVER_IP} = $trustvars_e->{SERVER_IP};
1080         $ret->{TRUST_E_BOTH_SERVER_IPV6} = $trustvars_e->{SERVER_IPV6};
1081         $ret->{TRUST_E_BOTH_NETBIOSNAME} = $trustvars_e->{NETBIOSNAME};
1082         $ret->{TRUST_E_BOTH_USERNAME} = $trustvars_e->{USERNAME};
1083         $ret->{TRUST_E_BOTH_PASSWORD} = $trustvars_e->{PASSWORD};
1084         $ret->{TRUST_E_BOTH_DOMAIN} = $trustvars_e->{DOMAIN};
1085         $ret->{TRUST_E_BOTH_REALM} = $trustvars_e->{REALM};
1086
1087         return $ret;
1088 }
1089
1090 sub setup_ad_member
1091 {
1092         my ($self,
1093             $prefix,
1094             $dcvars,
1095             $trustvars_f,
1096             $trustvars_e) = @_;
1097
1098         # If we didn't build with ADS, pretend this env was never available
1099         if (not $self->have_ads()) {
1100                 return "UNKNOWN";
1101         }
1102
1103         print "PROVISIONING AD MEMBER...";
1104
1105         return $self->provision_ad_member($prefix,
1106                                           "LOCALADMEMBER",
1107                                           $dcvars,
1108                                           $trustvars_f,
1109                                           $trustvars_e);
1110 }
1111
1112 sub setup_ad_member_s3_join
1113 {
1114         my ($self,
1115             $prefix,
1116             $dcvars,
1117             $trustvars_f,
1118             $trustvars_e) = @_;
1119
1120         # If we didn't build with ADS, pretend this env was never available
1121         if (not $self->have_ads()) {
1122                 return "UNKNOWN";
1123         }
1124
1125         print "PROVISIONING AD MEMBER...";
1126
1127         return $self->provision_ad_member($prefix,
1128                                           "LOCALADMEMBER2",
1129                                           $dcvars,
1130                                           $trustvars_f,
1131                                           $trustvars_e);
1132 }
1133
1134 sub setup_ad_member_rfc2307
1135 {
1136         my ($self, $prefix, $dcvars) = @_;
1137
1138         # If we didn't build with ADS, pretend this env was never available
1139         if (not $self->have_ads()) {
1140                 return "UNKNOWN";
1141         }
1142
1143         print "PROVISIONING S3 AD MEMBER WITH idmap_rfc2307 config...";
1144
1145         my $member_options = "
1146         security = ads
1147         workgroup = $dcvars->{DOMAIN}
1148         realm = $dcvars->{REALM}
1149         idmap cache time = 0
1150         idmap negative cache time = 0
1151         idmap config * : backend = autorid
1152         idmap config * : range = 1000000-1999999
1153         idmap config * : rangesize = 100000
1154         idmap config $dcvars->{DOMAIN} : backend = rfc2307
1155         idmap config $dcvars->{DOMAIN} : range = 2000000-2999999
1156         idmap config $dcvars->{DOMAIN} : ldap_server = ad
1157         idmap config $dcvars->{DOMAIN} : bind_path_user = ou=idmap,dc=samba,dc=example,dc=com
1158         idmap config $dcvars->{DOMAIN} : bind_path_group = ou=idmap,dc=samba,dc=example,dc=com
1159
1160         password server = $dcvars->{SERVER}
1161 ";
1162
1163         my $ret = $self->provision(
1164             prefix => $prefix,
1165             domain => $dcvars->{DOMAIN},
1166             realm => $dcvars->{REALM},
1167             server => "RFC2307MEMBER",
1168             password => "loCalMemberPass",
1169             extra_options => $member_options,
1170             resolv_conf => $dcvars->{RESOLV_CONF});
1171
1172         $ret or return undef;
1173
1174         $ret->{DOMAIN} = $dcvars->{DOMAIN};
1175         $ret->{REALM} = $dcvars->{REALM};
1176         $ret->{DOMSID} = $dcvars->{DOMSID};
1177
1178         my $ctx;
1179         my $prefix_abs = abs_path($prefix);
1180         $ctx = {};
1181         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
1182         $ctx->{domain} = $dcvars->{DOMAIN};
1183         $ctx->{realm} = $dcvars->{REALM};
1184         $ctx->{dnsname} = lc($dcvars->{REALM});
1185         $ctx->{kdc_ipv4} = $dcvars->{SERVER_IP};
1186         $ctx->{kdc_ipv6} = $dcvars->{SERVER_IPV6};
1187         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
1188         Samba::mk_krb5_conf($ctx, "");
1189
1190         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
1191
1192         my $net = Samba::bindir_path($self, "net");
1193         # Add hosts file for name lookups
1194         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
1195         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1196         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1197                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1198         } else {
1199                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1200         }
1201         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
1202         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1203         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
1204         $cmd .= "$net join $ret->{CONFIGURATION}";
1205         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
1206
1207         if (system($cmd) != 0) {
1208             warn("Join failed\n$cmd");
1209             return undef;
1210         }
1211
1212         # We need world access to this share, as otherwise the domain
1213         # administrator from the AD domain provided by Samba4 can't
1214         # access the share for tests.
1215         chmod 0777, "$prefix/share";
1216
1217         if (not $self->check_or_start(
1218                 env_vars => $ret,
1219                 nmbd => "yes",
1220                 winbindd => "yes",
1221                 smbd => "yes")) {
1222                 return undef;
1223         }
1224
1225         $ret->{DC_SERVER} = $dcvars->{SERVER};
1226         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
1227         $ret->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
1228         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
1229         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
1230         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
1231         $ret->{DOMAIN_ADMIN} = $dcvars->{DOMAIN_ADMIN};
1232         $ret->{DOMAIN_ADMIN_PASSWORD} = $dcvars->{DOMAIN_ADMIN_PASSWORD};
1233         $ret->{DOMAIN_USER} = $dcvars->{DOMAIN_USER};
1234         $ret->{DOMAIN_USER_PASSWORD} = $dcvars->{DOMAIN_USER_PASSWORD};
1235
1236         return $ret;
1237 }
1238
1239 sub setup_admem_idmap_autorid
1240 {
1241         my ($self, $prefix, $dcvars) = @_;
1242
1243         # If we didn't build with ADS, pretend this env was never available
1244         if (not $self->have_ads()) {
1245                 return "UNKNOWN";
1246         }
1247
1248         print "PROVISIONING S3 AD MEMBER WITH idmap_autorid config...";
1249
1250         my $member_options = "
1251         security = ads
1252         workgroup = $dcvars->{DOMAIN}
1253         realm = $dcvars->{REALM}
1254         idmap config * : backend = autorid
1255         idmap config * : range = 1000000-19999999
1256         idmap config * : rangesize = 1000000
1257
1258         # Prevent overriding the provisioned lib/krb5.conf which sets certain
1259         # values required for tests to succeed
1260         create krb5 conf = no
1261 ";
1262
1263         my $ret = $self->provision(
1264             prefix => $prefix,
1265             domain => $dcvars->{DOMAIN},
1266             realm => $dcvars->{REALM},
1267             server => "ADMEMAUTORID",
1268             password => "loCalMemberPass",
1269             extra_options => $member_options,
1270             resolv_conf => $dcvars->{RESOLV_CONF});
1271
1272         $ret or return undef;
1273
1274         $ret->{DOMAIN} = $dcvars->{DOMAIN};
1275         $ret->{REALM} = $dcvars->{REALM};
1276         $ret->{DOMSID} = $dcvars->{DOMSID};
1277
1278         my $ctx;
1279         my $prefix_abs = abs_path($prefix);
1280         $ctx = {};
1281         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
1282         $ctx->{domain} = $dcvars->{DOMAIN};
1283         $ctx->{realm} = $dcvars->{REALM};
1284         $ctx->{dnsname} = lc($dcvars->{REALM});
1285         $ctx->{kdc_ipv4} = $dcvars->{SERVER_IP};
1286         $ctx->{kdc_ipv6} = $dcvars->{SERVER_IPV6};
1287         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
1288         Samba::mk_krb5_conf($ctx, "");
1289
1290         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
1291
1292         my $net = Samba::bindir_path($self, "net");
1293         # Add hosts file for name lookups
1294         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
1295         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1296         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1297                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1298         } else {
1299                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1300         }
1301         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
1302         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1303         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
1304         $cmd .= "$net join $ret->{CONFIGURATION}";
1305         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
1306
1307         if (system($cmd) != 0) {
1308             warn("Join failed\n$cmd");
1309             return undef;
1310         }
1311
1312         # We need world access to this share, as otherwise the domain
1313         # administrator from the AD domain provided by Samba4 can't
1314         # access the share for tests.
1315         chmod 0777, "$prefix/share";
1316
1317         if (not $self->check_or_start(
1318                 env_vars => $ret,
1319                 nmbd => "yes",
1320                 winbindd => "yes",
1321                 smbd => "yes")) {
1322                 return undef;
1323         }
1324
1325         $ret->{DC_SERVER} = $dcvars->{SERVER};
1326         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
1327         $ret->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
1328         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
1329         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
1330         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
1331         $ret->{DOMAIN_ADMIN} = $dcvars->{DOMAIN_ADMIN};
1332         $ret->{DOMAIN_ADMIN_PASSWORD} = $dcvars->{DOMAIN_ADMIN_PASSWORD};
1333         $ret->{DOMAIN_USER} = $dcvars->{DOMAIN_USER};
1334         $ret->{DOMAIN_USER_PASSWORD} = $dcvars->{DOMAIN_USER_PASSWORD};
1335
1336         return $ret;
1337 }
1338
1339 sub setup_ad_member_idmap_rid
1340 {
1341         my ($self, $prefix, $dcvars) = @_;
1342
1343         # If we didn't build with ADS, pretend this env was never available
1344         if (not $self->have_ads()) {
1345                 return "UNKNOWN";
1346         }
1347
1348         print "PROVISIONING S3 AD MEMBER WITH idmap_rid config...";
1349
1350         my $member_options = "
1351         security = ads
1352         workgroup = $dcvars->{DOMAIN}
1353         realm = $dcvars->{REALM}
1354         idmap config * : backend = tdb
1355         idmap config * : range = 1000000-1999999
1356         idmap config $dcvars->{DOMAIN} : backend = rid
1357         idmap config $dcvars->{DOMAIN} : range = 2000000-2999999
1358         # Prevent overriding the provisioned lib/krb5.conf which sets certain
1359         # values required for tests to succeed
1360         create krb5 conf = no
1361         map to guest = bad user
1362         winbind expand groups = 10
1363         server signing = required
1364 ";
1365
1366         my $ret = $self->provision(
1367             prefix => $prefix,
1368             domain => $dcvars->{DOMAIN},
1369             realm => $dcvars->{REALM},
1370             server => "IDMAPRIDMEMBER",
1371             password => "loCalMemberPass",
1372             extra_options => $member_options,
1373             resolv_conf => $dcvars->{RESOLV_CONF});
1374
1375         $ret or return undef;
1376
1377         $ret->{DOMAIN} = $dcvars->{DOMAIN};
1378         $ret->{REALM} = $dcvars->{REALM};
1379         $ret->{DOMSID} = $dcvars->{DOMSID};
1380
1381         my $ctx;
1382         my $prefix_abs = abs_path($prefix);
1383         $ctx = {};
1384         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
1385         $ctx->{domain} = $dcvars->{DOMAIN};
1386         $ctx->{realm} = $dcvars->{REALM};
1387         $ctx->{dnsname} = lc($dcvars->{REALM});
1388         $ctx->{kdc_ipv4} = $dcvars->{SERVER_IP};
1389         $ctx->{kdc_ipv6} = $dcvars->{SERVER_IPV6};
1390         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
1391         Samba::mk_krb5_conf($ctx, "");
1392
1393         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
1394
1395         my $net = Samba::bindir_path($self, "net");
1396         # Add hosts file for name lookups
1397         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
1398         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1399         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1400                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1401         } else {
1402                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1403         }
1404         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
1405         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1406         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
1407         $cmd .= "$net join $ret->{CONFIGURATION}";
1408         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
1409
1410         if (system($cmd) != 0) {
1411             warn("Join failed\n$cmd");
1412             return undef;
1413         }
1414
1415         # We need world access to this share, as otherwise the domain
1416         # administrator from the AD domain provided by Samba4 can't
1417         # access the share for tests.
1418         chmod 0777, "$prefix/share";
1419
1420         if (not $self->check_or_start(
1421                 env_vars => $ret,
1422                 nmbd => "yes",
1423                 winbindd => "yes",
1424                 smbd => "yes")) {
1425                 return undef;
1426         }
1427
1428         $ret->{DC_SERVER} = $dcvars->{SERVER};
1429         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
1430         $ret->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
1431         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
1432         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
1433         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
1434         $ret->{DOMAIN_ADMIN} = $dcvars->{DOMAIN_ADMIN};
1435         $ret->{DOMAIN_ADMIN_PASSWORD} = $dcvars->{DOMAIN_ADMIN_PASSWORD};
1436         $ret->{DOMAIN_USER} = $dcvars->{DOMAIN_USER};
1437         $ret->{DOMAIN_USER_PASSWORD} = $dcvars->{DOMAIN_USER_PASSWORD};
1438
1439         return $ret;
1440 }
1441
1442 sub setup_ad_member_idmap_ad
1443 {
1444         my ($self, $prefix, $dcvars) = @_;
1445
1446         # If we didn't build with ADS, pretend this env was never available
1447         if (not $self->have_ads()) {
1448                 return "UNKNOWN";
1449         }
1450
1451         print "PROVISIONING S3 AD MEMBER WITH idmap_ad config...";
1452
1453         my $member_options = "
1454         security = ads
1455         workgroup = $dcvars->{DOMAIN}
1456         realm = $dcvars->{REALM}
1457         password server = $dcvars->{SERVER}
1458         idmap config * : backend = tdb
1459         idmap config * : range = 1000000-1999999
1460         idmap config $dcvars->{DOMAIN} : backend = ad
1461         idmap config $dcvars->{DOMAIN} : range = 2000000-2999999
1462         idmap config $dcvars->{DOMAIN} : unix_primary_group = yes
1463         idmap config $dcvars->{DOMAIN} : unix_nss_info = yes
1464         idmap config $dcvars->{DOMAIN} : deny ous = \"ou=sub,DC=samba2008r2,DC=example,DC=com\"
1465         idmap config $dcvars->{TRUST_DOMAIN} : backend = ad
1466         idmap config $dcvars->{TRUST_DOMAIN} : range = 2000000-2999999
1467         gensec_gssapi:requested_life_time = 5
1468         winbind scan trusted domains = yes
1469         winbind expand groups = 1
1470 ";
1471
1472         my $ret = $self->provision(
1473             prefix => $prefix,
1474             domain => $dcvars->{DOMAIN},
1475             realm => $dcvars->{REALM},
1476             server => "IDMAPADMEMBER",
1477             password => "loCalMemberPass",
1478             extra_options => $member_options,
1479             resolv_conf => $dcvars->{RESOLV_CONF});
1480
1481         $ret or return undef;
1482
1483         $ret->{DOMAIN} = $dcvars->{DOMAIN};
1484         $ret->{REALM} = $dcvars->{REALM};
1485         $ret->{DOMSID} = $dcvars->{DOMSID};
1486
1487         my $ctx;
1488         my $prefix_abs = abs_path($prefix);
1489         $ctx = {};
1490         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
1491         $ctx->{domain} = $dcvars->{DOMAIN};
1492         $ctx->{realm} = $dcvars->{REALM};
1493         $ctx->{dnsname} = lc($dcvars->{REALM});
1494         $ctx->{kdc_ipv4} = $dcvars->{SERVER_IP};
1495         $ctx->{kdc_ipv6} = $dcvars->{SERVER_IPV6};
1496         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
1497         Samba::mk_krb5_conf($ctx, "");
1498
1499         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
1500
1501         my $net = Samba::bindir_path($self, "net");
1502         # Add hosts file for name lookups
1503         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
1504         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1505         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1506                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1507         } else {
1508                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1509         }
1510         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
1511         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1512         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
1513         $cmd .= "$net join $ret->{CONFIGURATION}";
1514         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
1515
1516         if (system($cmd) != 0) {
1517             warn("Join failed\n$cmd");
1518             return undef;
1519         }
1520
1521         # We need world access to this share, as otherwise the domain
1522         # administrator from the AD domain provided by Samba4 can't
1523         # access the share for tests.
1524         chmod 0777, "$prefix/share";
1525
1526         if (not $self->check_or_start(
1527                 env_vars => $ret,
1528                 nmbd => "yes",
1529                 winbindd => "yes",
1530                 smbd => "yes")) {
1531                 return undef;
1532         }
1533
1534         $ret->{DC_SERVER} = $dcvars->{SERVER};
1535         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
1536         $ret->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
1537         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
1538         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
1539         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
1540         $ret->{DOMAIN_ADMIN} = $dcvars->{DOMAIN_ADMIN};
1541         $ret->{DOMAIN_ADMIN_PASSWORD} = $dcvars->{DOMAIN_ADMIN_PASSWORD};
1542         $ret->{DOMAIN_USER} = $dcvars->{DOMAIN_USER};
1543         $ret->{DOMAIN_USER_PASSWORD} = $dcvars->{DOMAIN_USER_PASSWORD};
1544
1545         $ret->{TRUST_SERVER} = $dcvars->{TRUST_SERVER};
1546         $ret->{TRUST_USERNAME} = $dcvars->{TRUST_USERNAME};
1547         $ret->{TRUST_PASSWORD} = $dcvars->{TRUST_PASSWORD};
1548         $ret->{TRUST_DOMAIN} = $dcvars->{TRUST_DOMAIN};
1549         $ret->{TRUST_REALM} = $dcvars->{TRUST_REALM};
1550         $ret->{TRUST_DOMSID} = $dcvars->{TRUST_DOMSID};
1551
1552         return $ret;
1553 }
1554
1555 sub setup_ad_member_oneway
1556 {
1557         my ($self, $prefix, $dcvars) = @_;
1558
1559         # If we didn't build with ADS, pretend this env was never available
1560         if (not $self->have_ads()) {
1561                 return "UNKNOWN";
1562         }
1563
1564         print "PROVISIONING S3 AD MEMBER WITH one-way trust...";
1565
1566         my $member_options = "
1567         security = ads
1568         workgroup = $dcvars->{DOMAIN}
1569         realm = $dcvars->{REALM}
1570         password server = $dcvars->{SERVER}
1571         idmap config * : backend = tdb
1572         idmap config * : range = 1000000-1999999
1573         gensec_gssapi:requested_life_time = 5
1574 ";
1575
1576         my $ret = $self->provision(
1577             prefix => $prefix,
1578             domain => $dcvars->{DOMAIN},
1579             server => "S2KMEMBER",
1580             password => "loCalS2KMemberPass",
1581             extra_options => $member_options,
1582             resolv_conf => $dcvars->{RESOLV_CONF});
1583
1584         $ret or return undef;
1585
1586         $ret->{DOMAIN} = $dcvars->{DOMAIN};
1587         $ret->{REALM} = $dcvars->{REALM};
1588         $ret->{DOMSID} = $dcvars->{DOMSID};
1589
1590         my $ctx;
1591         my $prefix_abs = abs_path($prefix);
1592         $ctx = {};
1593         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
1594         $ctx->{domain} = $dcvars->{DOMAIN};
1595         $ctx->{realm} = $dcvars->{REALM};
1596         $ctx->{dnsname} = lc($dcvars->{REALM});
1597         $ctx->{kdc_ipv4} = $dcvars->{SERVER_IP};
1598         $ctx->{kdc_ipv6} = $dcvars->{SERVER_IPV6};
1599         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
1600         Samba::mk_krb5_conf($ctx, "");
1601
1602         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
1603
1604         my $net = Samba::bindir_path($self, "net");
1605         # Add hosts file for name lookups
1606         my $cmd = "NSS_WRAPPER_HOSTS='$ret->{NSS_WRAPPER_HOSTS}' ";
1607         $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
1608         if (defined($ret->{RESOLV_WRAPPER_CONF})) {
1609                 $cmd .= "RESOLV_WRAPPER_CONF=\"$ret->{RESOLV_WRAPPER_CONF}\" ";
1610         } else {
1611                 $cmd .= "RESOLV_WRAPPER_HOSTS=\"$ret->{RESOLV_WRAPPER_HOSTS}\" ";
1612         }
1613         $cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" ";
1614         $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
1615         $cmd .= "SELFTEST_WINBINDD_SOCKET_DIR=\"$ret->{SELFTEST_WINBINDD_SOCKET_DIR}\" ";
1616         $cmd .= "$net join $ret->{CONFIGURATION}";
1617         $cmd .= " -U$dcvars->{USERNAME}\%$dcvars->{PASSWORD}";
1618
1619         if (system($cmd) != 0) {
1620             warn("Join failed\n$cmd");
1621             return undef;
1622         }
1623
1624         if (not $self->check_or_start(
1625                 env_vars => $ret,
1626                 winbindd => "yes")) {
1627                 return undef;
1628         }
1629
1630         $ret->{DC_SERVER} = $dcvars->{SERVER};
1631         $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
1632         $ret->{DC_SERVER_IPV6} = $dcvars->{SERVER_IPV6};
1633         $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};
1634         $ret->{DC_USERNAME} = $dcvars->{USERNAME};
1635         $ret->{DC_PASSWORD} = $dcvars->{PASSWORD};
1636         $ret->{DOMAIN_ADMIN} = $dcvars->{DOMAIN_ADMIN};
1637         $ret->{DOMAIN_ADMIN_PASSWORD} = $dcvars->{DOMAIN_ADMIN_PASSWORD};
1638         $ret->{DOMAIN_USER} = $dcvars->{DOMAIN_USER};
1639         $ret->{DOMAIN_USER_PASSWORD} = $dcvars->{DOMAIN_USER_PASSWORD};
1640
1641         $ret->{TRUST_SERVER} = $dcvars->{TRUST_SERVER};
1642         $ret->{TRUST_USERNAME} = $dcvars->{TRUST_USERNAME};
1643         $ret->{TRUST_PASSWORD} = $dcvars->{TRUST_PASSWORD};
1644         $ret->{TRUST_DOMAIN} = $dcvars->{TRUST_DOMAIN};
1645         $ret->{TRUST_REALM} = $dcvars->{TRUST_REALM};
1646         $ret->{TRUST_DOMSID} = $dcvars->{TRUST_DOMSID};
1647
1648         return $ret;
1649 }
1650
1651 sub setup_ad_member_fips
1652 {
1653         my ($self,
1654             $prefix,
1655             $dcvars,
1656             $trustvars_f,
1657             $trustvars_e) = @_;
1658
1659         # If we didn't build with ADS, pretend this env was never available
1660         if (not $self->have_ads()) {
1661                 return "UNKNOWN";
1662         }
1663
1664         print "PROVISIONING AD FIPS MEMBER...";
1665
1666         return $self->provision_ad_member($prefix,
1667                                           "FIPSADMEMBER",
1668                                           $dcvars,
1669                                           $trustvars_f,
1670                                           $trustvars_e,
1671                                           undef,
1672                                           1);
1673 }
1674
1675 sub setup_ad_member_offlogon
1676 {
1677         my ($self,
1678             $prefix,
1679             $dcvars,
1680             $trustvars_f,
1681             $trustvars_e) = @_;
1682
1683         # If we didn't build with ADS, pretend this env was never available
1684         if (not $self->have_ads()) {
1685                 return "UNKNOWN";
1686         }
1687
1688         print "PROVISIONING AD MEMBER OFFLINE LOGON...";
1689
1690         return $self->provision_ad_member($prefix,
1691                                           "OFFLINEADMEM",
1692                                           $dcvars,
1693                                           $trustvars_f,
1694                                           $trustvars_e,
1695                                           undef,
1696                                           undef,
1697                                           1);
1698 }
1699
1700 sub setup_ad_member_idmap_nss
1701 {
1702         my ($self,
1703             $prefix,
1704             $dcvars,
1705             $trustvars_f,
1706             $trustvars_e) = @_;
1707
1708         # If we didn't build with ADS, pretend this env was never available
1709         if (not $self->have_ads()) {
1710                 return "UNKNOWN";
1711         }
1712
1713         print "PROVISIONING AD MEMBER WITHOUT NSS WINBIND WITH idmap_nss config...";
1714
1715         my $extra_member_options = "
1716         # bob:x:65521:65531:localbob gecos:/:/bin/false
1717         # jane:x:65520:65531:localjane gecos:/:/bin/false
1718         # jackthemapper:x:65519:65531:localjackthemaper gecos:/:/bin/false
1719         # jacknomapper:x:65518:65531:localjacknomaper gecos:/:/bin/false
1720         idmap config $dcvars->{DOMAIN} : backend = nss
1721         idmap config $dcvars->{DOMAIN} : range = 65518-65521
1722
1723         # Support SMB1 so that we can use posix_whoami().
1724         client min protocol = CORE
1725         server min protocol = LANMAN1
1726
1727         username map = $prefix/lib/username.map
1728 ";
1729
1730         my $ret = $self->provision_ad_member($prefix,
1731                                              "ADMEMIDMAPNSS",
1732                                              $dcvars,
1733                                              $trustvars_f,
1734                                              $trustvars_e,
1735                                              $extra_member_options,
1736                                              undef,
1737                                              undef,
1738                                              1,
1739                                              1);
1740
1741         open(USERMAP, ">$prefix/lib/username.map") or die("Unable to open $prefix/lib/username.map");
1742         print USERMAP "
1743 !jacknomapper = \@jackthemappergroup
1744 !root = jacknomappergroup
1745 root = $dcvars->{DOMAIN}/root
1746 bob = $dcvars->{DOMAIN}/bob
1747 ";
1748         close(USERMAP);
1749
1750         return $ret;
1751 }
1752
1753 sub setup_simpleserver
1754 {
1755         my ($self, $path) = @_;
1756
1757         print "PROVISIONING simple server...";
1758
1759         my $prefix_abs = abs_path($path);
1760
1761         my $external_streams_depot="$prefix_abs/external_streams_depot";
1762
1763         my $simpleserver_options_globals = "
1764         lanman auth = yes
1765         ntlm auth = yes
1766         vfs objects = xattr_tdb streams_depot
1767         change notify = no
1768         server smb encrypt = off
1769         allow trusted domains = no
1770 ";
1771
1772         my $simpleserver_options = "
1773 [vfs_aio_pthread]
1774         path = $prefix_abs/share
1775         read only = no
1776         vfs objects = aio_pthread
1777         aio_pthread:aio open = yes
1778         smbd async dosmode = no
1779
1780 [vfs_aio_pthread_async_dosmode_default1]
1781         path = $prefix_abs/share
1782         read only = no
1783         vfs objects = aio_pthread
1784         store dos attributes = yes
1785         aio_pthread:aio open = yes
1786         smbd async dosmode = yes
1787
1788 [vfs_aio_pthread_async_dosmode_default2]
1789         path = $prefix_abs/share
1790         read only = no
1791         vfs objects = aio_pthread xattr_tdb
1792         store dos attributes = yes
1793         aio_pthread:aio open = yes
1794         smbd async dosmode = yes
1795
1796 [async_dosmode_shadow_copy2]
1797         path = $prefix_abs/share
1798         read only = no
1799         vfs objects = shadow_copy2 xattr_tdb
1800         smbd async dosmode = yes
1801
1802 [vfs_aio_fork]
1803         path = $prefix_abs/share
1804         vfs objects = aio_fork
1805         read only = no
1806         vfs_aio_fork:erratic_testing_mode=yes
1807
1808 [dosmode]
1809         path = $prefix_abs/share
1810         vfs objects =
1811         store dos attributes = yes
1812         hide files = /hidefile/
1813         hide dot files = yes
1814
1815 [hidenewfiles]
1816         path = $prefix_abs/share
1817         hide new files timeout = 5
1818
1819 [external_streams_depot]
1820         path = $prefix_abs/share
1821         read only = no
1822         streams_depot:directory = $external_streams_depot
1823 ";
1824
1825         my $vars = $self->provision(
1826             prefix => $path,
1827             domain => "WORKGROUP",
1828             server => "LOCALSHARE4",
1829             password => "local4pass",
1830             extra_options_before_inject => $simpleserver_options_globals,
1831             extra_options => $simpleserver_options);
1832
1833         $vars or return undef;
1834
1835         remove_tree($external_streams_depot);
1836         mkdir($external_streams_depot, 0777);
1837
1838         my $pam_service_dir = "$prefix_abs/pam_services";
1839         remove_tree($pam_service_dir);
1840         mkdir($pam_service_dir, 0777);
1841         my $pam_service_file = "$pam_service_dir/samba";
1842         my $pam_matrix_passdb = "$pam_service_dir/samba_pam_matrix_passdb";
1843         my $pam_matrix_so_path = Samba::pam_matrix_so_path($self);
1844
1845         open(FILE, "> $pam_service_file");
1846         print FILE "auth required ${pam_matrix_so_path} passdb=${pam_matrix_passdb} verbose\n";
1847         print FILE "account required ${pam_matrix_so_path} passdb=${pam_matrix_passdb} verbose\n";
1848         close(FILE);
1849
1850         my $tmpusername = $vars->{USERNAME};
1851         my $tmppassword = $vars->{PASSWORD};
1852         open(FILE, "> $pam_matrix_passdb");
1853         print FILE "$tmpusername:$tmppassword:samba";
1854         close(FILE);
1855
1856         $vars->{PAM_WRAPPER} = "1";
1857         $vars->{PAM_WRAPPER_SERVICE_DIR} = $pam_service_dir;
1858         #$vars->{PAM_WRAPPER_DEBUGLEVEL} = "3";
1859
1860         if (not $self->check_or_start(
1861                 env_vars => $vars,
1862                 nmbd => "yes",
1863                 smbd => "yes")) {
1864                return undef;
1865         }
1866
1867         return $vars;
1868 }
1869
1870 sub create_file_chmod($$)
1871 {
1872     my ($name, $mode) = @_;
1873     my $fh;
1874
1875     unless (open($fh, '>', $name)) {
1876         warn("Unable to open $name");
1877         return undef;
1878     }
1879     chmod($mode, $fh);
1880 }
1881
1882 sub setup_fileserver
1883 {
1884         my ($self, $path, $more_conf, $server) = @_;
1885         my $prefix_abs = abs_path($path);
1886         my $srcdir_abs = abs_path($self->{srcdir});
1887
1888         print "PROVISIONING file server ...\n";
1889
1890         my @dirs = ();
1891
1892         mkdir($prefix_abs, 0777);
1893
1894         my $usershare_dir="$prefix_abs/lib/usershare";
1895
1896         my $share_dir="$prefix_abs/share";
1897
1898         # Create share directory structure
1899         my $lower_case_share_dir="$share_dir/lower-case";
1900         push(@dirs, $lower_case_share_dir);
1901
1902         my $lower_case_share_dir_30000="$share_dir/lower-case-30000";
1903         push(@dirs, $lower_case_share_dir_30000);
1904
1905         my $dfree_share_dir="$share_dir/dfree";
1906         push(@dirs, $dfree_share_dir);
1907         push(@dirs, "$dfree_share_dir/subdir1");
1908         push(@dirs, "$dfree_share_dir/subdir2");
1909         push(@dirs, "$dfree_share_dir/subdir3");
1910
1911         my $quotadir_dir="$share_dir/quota";
1912         push(@dirs, $quotadir_dir);
1913
1914         my $valid_users_sharedir="$share_dir/valid_users";
1915         push(@dirs,$valid_users_sharedir);
1916
1917         my $offline_sharedir="$share_dir/offline";
1918         push(@dirs,$offline_sharedir);
1919
1920         my $force_user_valid_users_dir = "$share_dir/force_user_valid_users";
1921         push(@dirs, $force_user_valid_users_dir);
1922
1923         my $tarmode_sharedir="$share_dir/tarmode";
1924         push(@dirs,$tarmode_sharedir);
1925
1926         my $tarmode2_sharedir="$share_dir/tarmode2";
1927         push(@dirs,$tarmode2_sharedir);
1928
1929         my $smbcacls_sharedir="$share_dir/smbcacls";
1930         push(@dirs,$smbcacls_sharedir);
1931
1932         my $usershare_sharedir="$share_dir/usershares";
1933         push(@dirs,$usershare_sharedir);
1934
1935         my $dropbox_sharedir="$share_dir/dropbox";
1936         push(@dirs,$dropbox_sharedir);
1937
1938         my $bad_iconv_sharedir="$share_dir/bad_iconv";
1939         push(@dirs, $bad_iconv_sharedir);
1940
1941         my $veto_sharedir="$share_dir/veto";
1942         push(@dirs,$veto_sharedir);
1943
1944         my $virusfilter_sharedir="$share_dir/virusfilter";
1945         push(@dirs,$virusfilter_sharedir);
1946
1947         my $delete_unwrite_sharedir="$share_dir/delete_unwrite";
1948         push(@dirs,$delete_unwrite_sharedir);
1949         push(@dirs, "$delete_unwrite_sharedir/delete_veto_yes");
1950         push(@dirs, "$delete_unwrite_sharedir/delete_veto_no");
1951
1952         my $volume_serial_number_sharedir="$share_dir/volume_serial_number";
1953         push(@dirs, $volume_serial_number_sharedir);
1954
1955         my $ip4 = Samba::get_ipv4_addr("FILESERVER");
1956         my $fileserver_options = "
1957         smb3 unix extensions = yes
1958         kernel change notify = yes
1959         spotlight backend = elasticsearch
1960         elasticsearch:address = $ip4
1961         elasticsearch:port = 8080
1962         elasticsearch:mappings = $srcdir_abs/source3/rpc_server/mdssvc/elasticsearch_mappings.json
1963
1964         usershare path = $usershare_dir
1965         usershare max shares = 10
1966         usershare allow guests = yes
1967         usershare prefix allow list = $usershare_sharedir
1968
1969         get quota command = $prefix_abs/getset_quota.py
1970         set quota command = $prefix_abs/getset_quota.py
1971         veto files : user1 = /user1file/
1972         veto files : +group1 = /group1file/
1973 [tarmode]
1974         path = $tarmode_sharedir
1975         comment = tar test share
1976         xattr_tdb:file = $prefix_abs/tarmode-xattr.tdb
1977 [tarmode2]
1978         path = $tarmode2_sharedir
1979         comment = tar test share
1980         xattr_tdb:file = $prefix_abs/tarmode2-xattr.tdb
1981 [spotlight]
1982         path = $share_dir
1983         spotlight = yes
1984         read only = no
1985 [no_spotlight]
1986         path = $share_dir
1987         spotlight = no
1988         read only = no
1989 [lowercase]
1990         path = $lower_case_share_dir
1991         comment = smb username is [%U]
1992         case sensitive = True
1993         default case = lower
1994         preserve case = no
1995         short preserve case = no
1996 [lowercase-30000]
1997         path = $lower_case_share_dir_30000
1998         comment = smb username is [%U]
1999         case sensitive = True
2000         default case = lower
2001         preserve case = no
2002         short preserve case = no
2003 [dfree]
2004         path = $dfree_share_dir
2005         comment = smb username is [%U]
2006         dfree command = $srcdir_abs/testprogs/blackbox/dfree.sh
2007 [valid-users-access]
2008         path = $valid_users_sharedir
2009         valid users = +userdup
2010 [offline]
2011         path = $offline_sharedir
2012         vfs objects = offline
2013
2014 # BUG: https://bugzilla.samba.org/show_bug.cgi?id=9878
2015 # RH BUG: https://bugzilla.redhat.com/show_bug.cgi?id=1077651
2016 [force_user_valid_users]
2017         path = $force_user_valid_users_dir
2018         comment = force user with valid users combination test share
2019         valid users = +force_user
2020         force user = force_user
2021         force group = everyone
2022         write list = force_user
2023
2024 [ign_sysacls]
2025         path = $share_dir
2026         comment = ignore system acls
2027         acl_xattr:ignore system acls = yes
2028 [inherit_owner]
2029         path = $share_dir
2030         comment = inherit owner
2031         inherit owner = yes
2032 [inherit_owner_u]
2033         path = $share_dir
2034         comment = inherit only unix owner
2035         inherit owner = unix only
2036         acl_xattr:ignore system acls = yes
2037 # BUG: https://bugzilla.samba.org/show_bug.cgi?id=13690
2038 [force_group_test]
2039         path = $share_dir
2040         comment = force group test
2041 #       force group = everyone
2042
2043 [create_mode_664]
2044         path = $share_dir
2045         comment = smb username is [%U]
2046         create mask = 0644
2047         force create mode = 0664
2048         vfs objects = dirsort
2049
2050 [dropbox]
2051         path = $dropbox_sharedir
2052         comment = smb username is [%U]
2053         writeable = yes
2054         vfs objects =
2055
2056 [bad_iconv]
2057         path = $bad_iconv_sharedir
2058         comment = smb username is [%U]
2059         vfs objects =
2060
2061 [veto_files_nodelete]
2062         path = $veto_sharedir
2063         read only = no
2064         msdfs root = yes
2065         veto files = /veto_name*/
2066         delete veto files = no
2067
2068 [veto_files_delete]
2069         path = $veto_sharedir
2070         msdfs root = yes
2071         veto files = /veto_name*/
2072         delete veto files = yes
2073
2074 [delete_veto_files_only]
2075         path = $veto_sharedir
2076         delete veto files = yes
2077
2078 [veto_files_nohidden]
2079         path = $veto_sharedir
2080         veto files = /.*/
2081
2082 [veto_files]
2083         path = $veto_sharedir
2084         veto files = /veto_name*/
2085         veto files : user2 = /user2file/
2086         veto files : +group2 = /group2file/
2087
2088 [delete_yes_unwrite]
2089         read only = no
2090         path = $delete_unwrite_sharedir
2091         hide unwriteable files = yes
2092         delete veto files = yes
2093
2094 [delete_no_unwrite]
2095         read only = no
2096         path = $delete_unwrite_sharedir
2097         hide unwriteable files = yes
2098         delete veto files = no
2099
2100 [virusfilter]
2101         path = $virusfilter_sharedir
2102         vfs objects = acl_xattr virusfilter
2103         virusfilter:scanner = dummy
2104         virusfilter:min file size = 0
2105         virusfilter:infected files = *infected*
2106         virusfilter:infected file action = rename
2107         virusfilter:scan on close = yes
2108         vfs_default:VFS_OPEN_HOW_RESOLVE_NO_SYMLINKS = no
2109
2110 [volumeserialnumber]
2111         path = $volume_serial_number_sharedir
2112         volume serial number = 0xdeadbeef
2113
2114 [ea_acl_xattr]
2115         path = $share_dir
2116         vfs objects = acl_xattr
2117         acl_xattr:security_acl_name = user.hackme
2118         read only = no
2119
2120 [io_uring]
2121         path = $share_dir
2122         vfs objects = acl_xattr fake_acls xattr_tdb streams_depot time_audit full_audit io_uring
2123         read only = no
2124
2125 [homes]
2126         comment = Home directories
2127         browseable = No
2128         read only = No
2129
2130 [inherit_perms]
2131         path = $share_dir
2132         vfs objects = streams_depot
2133         inherit permissions = yes
2134 ";
2135
2136         if (defined($more_conf)) {
2137                 $fileserver_options = $fileserver_options . $more_conf;
2138         }
2139         if (!defined($server)) {
2140                 $server = "FILESERVER";
2141         }
2142
2143         my $vars = $self->provision(
2144             prefix => $path,
2145             domain => "WORKGROUP",
2146             server => $server,
2147             password => "fileserver",
2148             extra_options => $fileserver_options);
2149
2150         $vars or return undef;
2151
2152         mkdir("$prefix_abs/lib", 0755);
2153         remove_tree($usershare_dir);
2154         mkdir($usershare_dir, 01770);
2155
2156         if (not $self->check_or_start(
2157                 env_vars => $vars,
2158                 nmbd => "yes",
2159                 smbd => "yes")) {
2160                return undef;
2161         }
2162
2163
2164         mkdir($_, 0777) foreach(@dirs);
2165
2166         ## Create case sensitive lower case share dir
2167         foreach my $file ('a'..'z') {
2168                 my $full_path = $lower_case_share_dir . '/' . $file;
2169                 open my $fh, '>', $full_path;
2170                 # Add some content to file
2171                 print $fh $full_path;
2172                 close $fh;
2173         }
2174
2175         for (my $file = 1; $file < 51; ++$file) {
2176                 my $full_path = $lower_case_share_dir . '/' . $file;
2177                 open my $fh, '>', $full_path;
2178                 # Add some content to file
2179                 print $fh $full_path;
2180                 close $fh;
2181         }
2182
2183         # Create content for 30000 share
2184         foreach my $file ('a'..'z') {
2185                 my $full_path = $lower_case_share_dir_30000 . '/' . $file;
2186                 open my $fh, '>', $full_path;
2187                 # Add some content to file
2188                 print $fh $full_path;
2189                 close $fh;
2190         }
2191
2192         for (my $file = 1; $file < 30001; ++$file) {
2193                 my $full_path = $lower_case_share_dir_30000 . '/' . $file;
2194                 open my $fh, '>', $full_path;
2195                 # Add some content to file
2196                 print $fh $full_path;
2197                 close $fh;
2198         }
2199
2200         ##
2201         ## create a listable file in valid_users_share
2202         ##
2203         create_file_chmod("$valid_users_sharedir/foo", 0644) or return undef;
2204
2205         ##
2206         ## create a valid utf8 filename which is invalid as a CP850 conversion
2207         ##
2208         create_file_chmod("$bad_iconv_sharedir/\xED\x9F\xBF", 0644) or return undef;
2209
2210         ##
2211         ## create unwritable files inside inside the delete unwrite veto share dirs.
2212         ##
2213         unlink("$delete_unwrite_sharedir/delete_veto_yes/file_444");
2214         create_file_chmod("$delete_unwrite_sharedir/delete_veto_yes/file_444", 0444) or return undef;
2215         unlink("$delete_unwrite_sharedir/delete_veto_no/file_444");
2216         create_file_chmod("$delete_unwrite_sharedir/delete_veto_no/file_444", 0444) or return undef;
2217
2218         return $vars;
2219 }
2220
2221 sub setup_fileserver_smb1
2222 {
2223         my ($self, $path) = @_;
2224         my $prefix_abs = abs_path($path);
2225         my $conf = "
2226 [global]
2227         client min protocol = CORE
2228         server min protocol = LANMAN1
2229         check parent directory delete on close = yes
2230
2231 [hidenewfiles]
2232         path = $prefix_abs/share
2233         hide new files timeout = 5
2234 [vfs_aio_pthread]
2235         path = $prefix_abs/share
2236         read only = no
2237         vfs objects = aio_pthread
2238         aio_pthread:aio open = yes
2239         smbd async dosmode = no
2240
2241 [vfs_aio_pthread_async_dosmode_default1]
2242         path = $prefix_abs/share
2243         read only = no
2244         vfs objects = aio_pthread
2245         store dos attributes = yes
2246         aio_pthread:aio open = yes
2247         smbd async dosmode = yes
2248
2249 [vfs_aio_pthread_async_dosmode_default2]
2250         path = $prefix_abs/share
2251         read only = no
2252         vfs objects = aio_pthread xattr_tdb
2253         store dos attributes = yes
2254         aio_pthread:aio open = yes
2255         smbd async dosmode = yes
2256
2257 [vfs_aio_fork]
2258         path = $prefix_abs/share
2259         vfs objects = aio_fork
2260         read only = no
2261         vfs_aio_fork:erratic_testing_mode=yes
2262 ";
2263         return $self->setup_fileserver($path, $conf, "FILESERVERSMB1");
2264 }
2265
2266 sub setup_fileserver_smb1_done
2267 {
2268         my ($self, $path, $dep_env) = @_;
2269         return $self->return_alias_env($path, $dep_env);
2270 }
2271
2272 sub setup_ktest
2273 {
2274         my ($self, $prefix) = @_;
2275
2276         # If we didn't build with ADS, pretend this env was never available
2277         if (not $self->have_ads()) {
2278                 return "UNKNOWN";
2279         }
2280
2281         print "PROVISIONING server with security=ads...";
2282
2283         my $ktest_options = "
2284         workgroup = KTEST
2285         realm = ktest.samba.example.com
2286         security = ads
2287         server signing = required
2288         server min protocol = SMB3_00
2289         client max protocol = SMB3
2290
2291         # This disables NTLM auth against the local SAM, which
2292         # we use can then test this setting by.
2293         ntlm auth = disabled
2294
2295         idmap config * : backend = autorid
2296         idmap config * : range = 1000000-1999999
2297         idmap config * : rangesize = 100000
2298 ";
2299
2300         my $ret = $self->provision(
2301             prefix => $prefix,
2302             domain => "KTEST",
2303             server => "LOCALKTEST6",
2304             password => "localktest6pass",
2305             extra_options => $ktest_options);
2306
2307         $ret or return undef;
2308
2309         my $ctx;
2310         my $prefix_abs = abs_path($prefix);
2311         $ctx = {};
2312         $ctx->{krb5_conf} = "$prefix_abs/lib/krb5.conf";
2313         $ctx->{domain} = "KTEST";
2314         $ctx->{realm} = "KTEST.SAMBA.EXAMPLE.COM";
2315         $ctx->{dnsname} = lc($ctx->{realm});
2316         $ctx->{kdc_ipv4} = "0.0.0.0";
2317         $ctx->{kdc_ipv6} = "::";
2318         $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}";
2319         Samba::mk_krb5_conf($ctx, "");
2320
2321         $ret->{KRB5_CONFIG} = $ctx->{krb5_conf};
2322
2323 #This is the secrets.tdb created by 'net ads join' from Samba3 to a
2324 #Samba4 DC with the same parameters as are being used here.  The
2325 #domain SID is S-1-5-21-1071277805-689288055-3486227160
2326         $ret->{SAMSID} = "S-1-5-21-1911091480-1468226576-2729736297";
2327         $ret->{DOMSID} = "S-1-5-21-1071277805-689288055-3486227160";
2328
2329         system("cp $self->{srcdir}/source3/selftest/ktest-secrets.tdb $prefix/private/secrets.tdb");
2330         chmod 0600, "$prefix/private/secrets.tdb";
2331
2332 #Make sure there's no old ntdb file.
2333         system("rm -f $prefix/private/secrets.ntdb");
2334
2335 #This uses a pre-calculated krb5 credentials cache, obtained by running Samba4 with:
2336 # "--option=kdc:service ticket lifetime=239232" "--option=kdc:user ticket lifetime=239232" "--option=kdc:renewal lifetime=239232"
2337 #
2338 #and having in krb5.conf:
2339 # ticket_lifetime = 799718400
2340 # renew_lifetime = 799718400
2341 #
2342 # The commands for the -2 keytab where were:
2343 # kinit administrator@KTEST.SAMBA.EXAMPLE.COM
2344 # kvno host/localktest6@KTEST.SAMBA.EXAMPLE.COM
2345 # kvno cifs/localktest6@KTEST.SAMBA.EXAMPLE.COM
2346 # kvno host/LOCALKTEST6@KTEST.SAMBA.EXAMPLE.COM
2347 # kvno cifs/LOCALKTEST6@KTEST.SAMBA.EXAMPLE.COM
2348 #
2349 # and then for the -3 keytab, I did
2350 #
2351 # net changetrustpw; kdestroy and the same again.
2352 #
2353 # This creates a credential cache with a very long lifetime (2036 at
2354 # at 2011-04), and shows that running 'net changetrustpw' does not
2355 # break existing logins (for the secrets.tdb method at least).
2356 #
2357
2358         $ret->{KRB5_CCACHE}="FILE:$prefix/krb5_ccache";
2359
2360         system("cp $self->{srcdir}/source3/selftest/ktest-krb5_ccache-2 $prefix/krb5_ccache-2");
2361         chmod 0600, "$prefix/krb5_ccache-2";
2362
2363         system("cp $self->{srcdir}/source3/selftest/ktest-krb5_ccache-3 $prefix/krb5_ccache-3");
2364         chmod 0600, "$prefix/krb5_ccache-3";
2365
2366         # We need world access to this share, as otherwise the domain
2367         # administrator from the AD domain provided by ktest can't
2368         # access the share for tests.
2369         chmod 0777, "$prefix/share";
2370
2371         if (not $self->check_or_start(
2372                 env_vars => $ret,
2373                 nmbd => "yes",
2374                 winbindd => "offline",
2375                 smbd => "yes")) {
2376                return undef;
2377         }
2378         return $ret;
2379 }
2380
2381 sub setup_maptoguest
2382 {
2383         my ($self, $path) = @_;
2384         my $prefix_abs = abs_path($path);
2385         my $libdir="$prefix_abs/lib";
2386         my $share_dir="$prefix_abs/share";
2387         my $errorinjectconf="$libdir/error_inject.conf";
2388
2389         print "PROVISIONING maptoguest...";
2390
2391         my $options = "
2392 domain logons = yes
2393 map to guest = bad user
2394 ntlm auth = yes
2395 server min protocol = LANMAN1
2396
2397 [force_user_error_inject]
2398         path = $share_dir
2399         vfs objects = acl_xattr fake_acls xattr_tdb error_inject
2400         force user = user1
2401         include = $errorinjectconf
2402 ";
2403
2404         my $vars = $self->provision(
2405             prefix => $path,
2406             domain => "WORKGROUP",
2407             server => "maptoguest",
2408             password => "maptoguestpass",
2409             extra_options => $options);
2410
2411         $vars or return undef;
2412
2413         if (not $self->check_or_start(
2414                 env_vars => $vars,
2415                 nmbd => "yes",
2416                 winbindd => "yes",
2417                 smbd => "yes")) {
2418                return undef;
2419         }
2420
2421         return $vars;
2422 }
2423
2424 sub stop_sig_term($$) {
2425         my ($self, $pid) = @_;
2426         kill("USR1", $pid) or kill("ALRM", $pid) or warn("Unable to kill $pid: $!");
2427 }
2428
2429 sub stop_sig_kill($$) {
2430         my ($self, $pid) = @_;
2431         kill("ALRM", $pid) or warn("Unable to kill $pid: $!");
2432 }
2433
2434 sub write_pid($$$)
2435 {
2436         my ($env_vars, $app, $pid) = @_;
2437
2438         open(PID, ">$env_vars->{PIDDIR}/timelimit.$app.pid");
2439         print PID $pid;
2440         close(PID);
2441 }
2442
2443 sub read_pid($$)
2444 {
2445         my ($env_vars, $app) = @_;
2446
2447         open(PID, "<$env_vars->{PIDDIR}/timelimit.$app.pid");
2448         my $pid = <PID>;
2449         close(PID);
2450         return $pid;
2451 }
2452
2453 # builds up the cmd args to run an s3 binary (i.e. smbd, nmbd, etc)
2454 sub make_bin_cmd
2455 {
2456         my ($self, $binary, $env_vars, $options, $valgrind, $dont_log_stdout) = @_;
2457
2458         my @optargs = ();
2459         if (defined($options)) {
2460                 @optargs = split(/ /, $options);
2461         }
2462         my @preargs = (Samba::bindir_path($self, "timelimit"), $self->{server_maxtime});
2463
2464         if (defined($valgrind)) {
2465                 @preargs = split(/ /, $valgrind);
2466         }
2467         my @args = ("-F", "--no-process-group",
2468                     "--configfile=$env_vars->{SERVERCONFFILE}",
2469                     "-l", $env_vars->{LOGDIR});
2470
2471         if (not defined($dont_log_stdout)) {
2472                 push(@args, "--debug-stdout");
2473         }
2474         return (@preargs, $binary, @args, @optargs);
2475 }
2476
2477 sub check_or_start($$) {
2478         my ($self, %args) = @_;
2479         my $env_vars = $args{env_vars};
2480         my $nmbd = $args{nmbd} // "no";
2481         my $winbindd = $args{winbindd} // "no";
2482         my $smbd = $args{smbd} // "no";
2483         my $samba_dcerpcd = $args{samba_dcerpcd} // "no";
2484         my $child_cleanup = $args{child_cleanup};
2485
2486         my $STDIN_READER;
2487
2488         # use a pipe for stdin in the child processes. This allows
2489         # those processes to monitor the pipe for EOF to ensure they
2490         # exit when the test script exits
2491         pipe($STDIN_READER, $env_vars->{STDIN_PIPE});
2492
2493         my $binary = Samba::bindir_path($self, "samba-dcerpcd");
2494         my @full_cmd = $self->make_bin_cmd(
2495             $binary,
2496             $env_vars,
2497             $ENV{SAMBA_DCERPCD_OPTIONS},
2498             $ENV{SAMBA_DCERPCD_VALGRIND},
2499             $ENV{SAMBA_DCERPCD_DONT_LOG_STDOUT});
2500         push(@full_cmd, '--libexec-rpcds');
2501
2502         my $samba_dcerpcd_envs = Samba::get_env_for_process(
2503             "samba_dcerpcd", $env_vars);
2504
2505         # fork and exec() samba_dcerpcd in the child process
2506         my $daemon_ctx = {
2507                 NAME => "samba_dcerpcd",
2508                 BINARY_PATH => $binary,
2509                 FULL_CMD => [ @full_cmd ],
2510                 LOG_FILE => $env_vars->{SAMBA_DCERPCD_TEST_LOG},
2511                 PCAP_FILE => "env-$ENV{ENVNAME}-samba_dcerpcd",
2512                 ENV_VARS => $samba_dcerpcd_envs,
2513         };
2514         if ($samba_dcerpcd ne "yes") {
2515                 $daemon_ctx->{SKIP_DAEMON} = 1;
2516         }
2517
2518         my $pid = Samba::fork_and_exec(
2519             $self, $env_vars, $daemon_ctx, $STDIN_READER, $child_cleanup);
2520
2521         $env_vars->{SAMBA_DCERPCD_TL_PID} = $pid;
2522         write_pid($env_vars, "samba_dcerpcd", $pid);
2523
2524         $binary = Samba::bindir_path($self, "nmbd");
2525         @full_cmd = $self->make_bin_cmd($binary, $env_vars,
2526                                         $ENV{NMBD_OPTIONS}, $ENV{NMBD_VALGRIND},
2527                                         $ENV{NMBD_DONT_LOG_STDOUT});
2528         my $nmbd_envs = Samba::get_env_for_process("nmbd", $env_vars);
2529         delete $nmbd_envs->{RESOLV_WRAPPER_CONF};
2530         delete $nmbd_envs->{RESOLV_WRAPPER_HOSTS};
2531
2532         # fork and exec() nmbd in the child process
2533         $daemon_ctx = {
2534                 NAME => "nmbd",
2535                 BINARY_PATH => $binary,
2536                 FULL_CMD => [ @full_cmd ],
2537                 LOG_FILE => $env_vars->{NMBD_TEST_LOG},
2538                 PCAP_FILE => "env-$ENV{ENVNAME}-nmbd",
2539                 ENV_VARS => $nmbd_envs,
2540         };
2541         if ($nmbd ne "yes") {
2542                 $daemon_ctx->{SKIP_DAEMON} = 1;
2543         }
2544         $pid = Samba::fork_and_exec(
2545             $self, $env_vars, $daemon_ctx, $STDIN_READER, $child_cleanup);
2546
2547         $env_vars->{NMBD_TL_PID} = $pid;
2548         write_pid($env_vars, "nmbd", $pid);
2549
2550         $binary = Samba::bindir_path($self, "winbindd");
2551         @full_cmd = $self->make_bin_cmd($binary, $env_vars,
2552                                          $ENV{WINBINDD_OPTIONS},
2553                                          $ENV{WINBINDD_VALGRIND},
2554                                          $ENV{WINBINDD_DONT_LOG_STDOUT});
2555
2556         # fork and exec() winbindd in the child process
2557         $daemon_ctx = {
2558                 NAME => "winbindd",
2559                 BINARY_PATH => $binary,
2560                 FULL_CMD => [ @full_cmd ],
2561                 LOG_FILE => $env_vars->{WINBINDD_TEST_LOG},
2562                 PCAP_FILE => "env-$ENV{ENVNAME}-winbindd",
2563         };
2564         if ($winbindd ne "yes" and $winbindd ne "offline") {
2565                 $daemon_ctx->{SKIP_DAEMON} = 1;
2566         }
2567
2568         $pid = Samba::fork_and_exec(
2569             $self, $env_vars, $daemon_ctx, $STDIN_READER, $child_cleanup);
2570
2571         $env_vars->{WINBINDD_TL_PID} = $pid;
2572         write_pid($env_vars, "winbindd", $pid);
2573
2574         $binary = Samba::bindir_path($self, "smbd");
2575         @full_cmd = $self->make_bin_cmd($binary, $env_vars,
2576                                          $ENV{SMBD_OPTIONS}, $ENV{SMBD_VALGRIND},
2577                                          $ENV{SMBD_DONT_LOG_STDOUT});
2578
2579         # fork and exec() smbd in the child process
2580         $daemon_ctx = {
2581                 NAME => "smbd",
2582                 BINARY_PATH => $binary,
2583                 FULL_CMD => [ @full_cmd ],
2584                 LOG_FILE => $env_vars->{SMBD_TEST_LOG},
2585                 PCAP_FILE => "env-$ENV{ENVNAME}-smbd",
2586         };
2587         if ($smbd ne "yes") {
2588                 $daemon_ctx->{SKIP_DAEMON} = 1;
2589         }
2590
2591         $pid = Samba::fork_and_exec(
2592             $self, $env_vars, $daemon_ctx, $STDIN_READER, $child_cleanup);
2593
2594         $env_vars->{SMBD_TL_PID} = $pid;
2595         write_pid($env_vars, "smbd", $pid);
2596
2597         # close the parent's read-end of the pipe
2598         close($STDIN_READER);
2599
2600         return $self->wait_for_start($env_vars,
2601                                 $nmbd,
2602                                 $winbindd,
2603                                 $smbd,
2604                                 $samba_dcerpcd);
2605 }
2606
2607 sub createuser($$$$$)
2608 {
2609         my ($self, $username, $password, $conffile, $env) = @_;
2610         my $cmd = "UID_WRAPPER_ROOT=1 " . Samba::bindir_path($self, "smbpasswd")." -c $conffile -L -s -a $username > /dev/null";
2611
2612         keys %$env;
2613         while(my($var, $val) = each %$env) {
2614                 $cmd = "$var=\"$val\" $cmd";
2615         }
2616
2617         unless (open(PWD, "|$cmd")) {
2618             warn("Unable to set password for $username account\n$cmd");
2619             return undef;
2620         }
2621         print PWD "$password\n$password\n";
2622         unless (close(PWD)) {
2623             warn("Unable to set password for $username account\n$cmd");
2624             return undef;
2625         }
2626 }
2627
2628 sub provision($$)
2629 {
2630         my ($self, %args) = @_;
2631
2632         my $prefix = $args{prefix};
2633         my $domain = $args{domain};
2634         my $realm = $args{realm};
2635         my $server = $args{server};
2636         my $password = $args{password};
2637         my $extra_options_before_inject = $args{extra_options_before_inject} // "";
2638         my $extra_options = $args{extra_options} // "";
2639         my $resolv_conf = $args{resolv_conf};
2640         my $no_delete_prefix= $args{no_delete_prefix};
2641         my $netbios_name = $args{netbios_name} // $server;
2642         my $server_log_level = $ENV{SERVER_LOG_LEVEL} || 1;
2643
2644         ##
2645         ## setup the various environment variables we need
2646         ##
2647
2648         my $samsid = Samba::random_domain_sid();
2649         my $swiface = Samba::get_interface($server);
2650         my %ret = ();
2651         my %createuser_env = ();
2652         my $server_ip = Samba::get_ipv4_addr($server);
2653         my $server_ipv6 = Samba::get_ipv6_addr($server);
2654         my $dns_domain;
2655         if (defined($realm)) {
2656             $dns_domain = lc($realm);
2657         } else {
2658             $dns_domain = "samba.example.com";
2659         }
2660
2661         my $unix_name = ($ENV{USER} or $ENV{LOGNAME} or `PATH=/usr/ucb:$ENV{PATH} whoami`);
2662         chomp $unix_name;
2663         my $unix_uid = $>;
2664         my $unix_gids_str = $);
2665         my @unix_gids = split(" ", $unix_gids_str);
2666
2667         my $prefix_abs = abs_path($prefix);
2668         my $bindir_abs = abs_path($self->{bindir});
2669
2670         my @dirs = ();
2671
2672         my $shrdir=$args{share_dir} // "$prefix_abs/share";
2673         push(@dirs,$shrdir);
2674
2675         my $libdir="$prefix_abs/lib";
2676         push(@dirs,$libdir);
2677
2678         my $piddir="$prefix_abs/pid";
2679         push(@dirs,$piddir);
2680
2681         my $privatedir="$prefix_abs/private";
2682         push(@dirs,$privatedir);
2683
2684         my $cachedir = "$prefix_abs/cachedir";
2685         push(@dirs, $cachedir);
2686
2687         my $binddnsdir = "$prefix_abs/bind-dns";
2688         push(@dirs, $binddnsdir);
2689
2690         my $lockdir="$prefix_abs/lockdir";
2691         push(@dirs,$lockdir);
2692
2693         my $eventlogdir="$prefix_abs/lockdir/eventlog";
2694         push(@dirs,$eventlogdir);
2695
2696         my $logdir="$prefix_abs/logs";
2697         push(@dirs,$logdir);
2698
2699         my $driver32dir="$shrdir/W32X86";
2700         push(@dirs,$driver32dir);
2701
2702         my $driver64dir="$shrdir/x64";
2703         push(@dirs,$driver64dir);
2704
2705         my $driver40dir="$shrdir/WIN40";
2706         push(@dirs,$driver40dir);
2707
2708         my $ro_shrdir="$shrdir/root-tmp";
2709         push(@dirs,$ro_shrdir);
2710
2711         my $noperm_shrdir="$shrdir/noperm-tmp";
2712         push(@dirs,$noperm_shrdir);
2713
2714         my $msdfs_shrdir="$shrdir/msdfsshare";
2715         push(@dirs,$msdfs_shrdir);
2716
2717         my $msdfs_shrdir2="$shrdir/msdfsshare2";
2718         push(@dirs,$msdfs_shrdir2);
2719
2720         my $msdfs_pathname_share="$shrdir/msdfs_pathname_share";
2721         push(@dirs,$msdfs_pathname_share);
2722
2723         my $non_msdfs_pathname_share="$shrdir/non_msdfs_pathname_share";
2724         push(@dirs,$non_msdfs_pathname_share);
2725
2726         my $msdfs_deeppath="$msdfs_shrdir/deeppath";
2727         push(@dirs,$msdfs_deeppath);
2728
2729         my $smbcacls_sharedir_dfs="$shrdir/smbcacls_sharedir_dfs";
2730         push(@dirs,$smbcacls_sharedir_dfs);
2731
2732         my $smbcacls_share="$shrdir/smbcacls_share";
2733         push(@dirs,$smbcacls_share);
2734
2735         my $smbcacls_share_testdir="$shrdir/smbcacls_share/smbcacls";
2736         push(@dirs,$smbcacls_share_testdir);
2737
2738         my $badnames_shrdir="$shrdir/badnames";
2739         push(@dirs,$badnames_shrdir);
2740
2741         my $lease1_shrdir="$shrdir/dynamic";
2742         push(@dirs,$lease1_shrdir);
2743
2744         my $manglenames_shrdir="$shrdir/manglenames";
2745         push(@dirs,$manglenames_shrdir);
2746
2747         my $widelinks_shrdir="$shrdir/widelinks";
2748         push(@dirs,$widelinks_shrdir);
2749
2750         my $widelinks_linkdir="$shrdir/widelinks_foo";
2751         push(@dirs,$widelinks_linkdir);
2752
2753         my $fsrvp_shrdir="$shrdir/fsrvp";
2754         push(@dirs,$fsrvp_shrdir);
2755
2756         my $shadow_tstdir="$shrdir/shadow";
2757         push(@dirs,$shadow_tstdir);
2758         my $shadow_mntdir="$shadow_tstdir/mount";
2759         push(@dirs,$shadow_mntdir);
2760         my $shadow_basedir="$shadow_mntdir/base";
2761         push(@dirs,$shadow_basedir);
2762         my $shadow_shrdir="$shadow_basedir/share";
2763         push(@dirs,$shadow_shrdir);
2764
2765         my $nosymlinks_shrdir="$shrdir/nosymlinks";
2766         push(@dirs,$nosymlinks_shrdir);
2767
2768         my $local_symlinks_shrdir="$shrdir/local_symlinks";
2769         push(@dirs,$local_symlinks_shrdir);
2770
2771         my $worm_shrdir="$shrdir/worm";
2772         push(@dirs,$worm_shrdir);
2773
2774         my $fruit_resource_stream_shrdir="$shrdir/fruit_resource_stream";
2775         push(@dirs,$fruit_resource_stream_shrdir);
2776
2777         my $smbget_sharedir="$shrdir/smbget";
2778         push(@dirs, $smbget_sharedir);
2779
2780         my $recycle_shrdir="$shrdir/recycle";
2781         push(@dirs,$recycle_shrdir);
2782
2783         my $fakedircreatetimes_shrdir="$shrdir/fakedircreatetimes";
2784         push(@dirs,$fakedircreatetimes_shrdir);
2785
2786         # this gets autocreated by winbindd
2787         my $wbsockdir="$prefix_abs/wbsock";
2788
2789         my $nmbdsockdir="$prefix_abs/nmbd";
2790         unlink($nmbdsockdir);
2791
2792         ##
2793         ## create the test directory layout
2794         ##
2795         die ("prefix_abs = ''") if $prefix_abs eq "";
2796         die ("prefix_abs = '/'") if $prefix_abs eq "/";
2797
2798         mkdir($prefix_abs, 0777);
2799         print "CREATE TEST ENVIRONMENT IN '$prefix'...";
2800         if (not defined($no_delete_prefix) or not $no_delete_prefix) {
2801             system("rm -rf $prefix_abs/*");
2802         }
2803         mkdir($_, 0777) foreach(@dirs);
2804
2805         my $fs_specific_conf = $self->get_fs_specific_conf($shrdir);
2806
2807         ##
2808         ## lockdir and piddir must be 0755
2809         ##
2810         chmod 0755, $lockdir;
2811         chmod 0755, $piddir;
2812
2813
2814         ##
2815         ## Create a directory without permissions to enter
2816         ##
2817         chmod 0000, $noperm_shrdir;
2818
2819         ##
2820         ## create ro and msdfs share layout
2821         ##
2822
2823         chmod 0755, $ro_shrdir;
2824
2825         create_file_chmod("$ro_shrdir/readable_file", 0644) or return undef;
2826         create_file_chmod("$ro_shrdir/unreadable_file", 0600) or return undef;
2827
2828         create_file_chmod("$ro_shrdir/msdfs-target", 0600) or return undef;
2829         symlink "msdfs:$server_ip\\ro-tmp,$server_ipv6\\ro-tmp",
2830                 "$msdfs_shrdir/msdfs-src1";
2831         symlink "msdfs:$server_ipv6\\ro-tmp", "$msdfs_shrdir/deeppath/msdfs-src2";
2832         symlink "msdfs:$server_ip\\smbcacls_sharedir_dfs,$server_ipv6\\smbcacls_sharedir_dfs",
2833                 "$msdfs_shrdir/smbcacls_sharedir_dfs";
2834
2835         symlink "msdfs:$server_ip\\msdfs-share2,$server_ipv6\\msdfs-share2", "$msdfs_shrdir/dfshop1";
2836         symlink "msdfs:$server_ip\\tmp,$server_ipv6\\tmp", "$msdfs_shrdir2/dfshop2";
2837         ##
2838         ## create bad names in $badnames_shrdir
2839         ##
2840         ## (An invalid name, would be mangled to 8.3).
2841         create_file_chmod("$badnames_shrdir/\340|\231\216\377\177",
2842                           0600) or return undef;
2843
2844         ## (A bad name, would not be mangled to 8.3).
2845         create_file_chmod("$badnames_shrdir/\240\276\346\327\377\177",
2846                           0666) or return undef;
2847
2848         ## (A bad good name).
2849         create_file_chmod("$badnames_shrdir/blank.txt",
2850                           0666) or return undef;
2851
2852         ##
2853         ## create mangleable directory names in $manglenames_shrdir
2854         ##
2855         my $manglename_target = "$manglenames_shrdir/foo:bar";
2856         mkdir($manglename_target, 0777);
2857
2858         ##
2859         ## create symlinks for widelinks tests.
2860         ##
2861         my $widelinks_target = "$widelinks_linkdir/target";
2862         create_file_chmod("$widelinks_target", 0666) or return undef;
2863
2864         ##
2865         ## This link should get an error
2866         ##
2867         symlink "$widelinks_target", "$widelinks_shrdir/source";
2868         ##
2869         ## This link should be allowed
2870         ##
2871         symlink "$widelinks_shrdir", "$widelinks_shrdir/dot";
2872
2873         my $conffile="$libdir/server.conf";
2874         my $dfqconffile="$libdir/dfq.conf";
2875         my $errorinjectconf="$libdir/error_inject.conf";
2876         my $delayinjectconf="$libdir/delay_inject.conf";
2877         my $globalinjectconf="$libdir/global_inject.conf";
2878         my $aliceconfdir="$libdir";
2879         my $aliceconffile="$libdir/alice.conf";
2880
2881         my $nss_wrapper_pl = "$ENV{PERL} $self->{srcdir}/third_party/nss_wrapper/nss_wrapper.pl";
2882         my $nss_wrapper_passwd = "$privatedir/passwd";
2883         my $nss_wrapper_group = "$privatedir/group";
2884         my $nss_wrapper_hosts = "$ENV{SELFTEST_PREFIX}/hosts";
2885         my $dns_host_file = "$ENV{SELFTEST_PREFIX}/dns_host_file";
2886
2887         my $mod_printer_pl = "$ENV{PERL} $self->{srcdir}/source3/script/tests/printing/modprinter.pl";
2888
2889         my $fake_snap_pl = "$ENV{PERL} $self->{srcdir}/source3/script/tests/fake_snap.pl";
2890
2891         my @eventlog_list = ("dns server", "application");
2892
2893         ##
2894         ## calculate uids and gids
2895         ##
2896
2897         my ($max_uid, $max_gid);
2898         my ($uid_nobody, $uid_root, $uid_pdbtest, $uid_pdbtest2, $uid_userdup);
2899         my ($uid_pdbtest_wkn);
2900         my ($uid_smbget);
2901         my ($uid_force_user);
2902         my ($gid_nobody, $gid_nogroup, $gid_root, $gid_domusers, $gid_domadmins);
2903         my ($gid_userdup, $gid_everyone);
2904         my ($gid_force_user);
2905         my ($gid_jackthemapper);
2906         my ($gid_jacknomapper);
2907         my ($gid_group1);
2908         my ($gid_group2);
2909         my ($uid_user1);
2910         my ($uid_user2);
2911         my ($uid_gooduser);
2912         my ($uid_eviluser);
2913         my ($uid_slashuser);
2914         my ($uid_localbob);
2915         my ($uid_localjane);
2916         my ($uid_localjackthemapper);
2917         my ($uid_localjacknomapper);
2918
2919         if ($unix_uid < 0xffff - 13) {
2920                 $max_uid = 0xffff;
2921         } else {
2922                 $max_uid = $unix_uid;
2923         }
2924
2925         $uid_root = $max_uid - 1;
2926         $uid_nobody = $max_uid - 2;
2927         $uid_pdbtest = $max_uid - 3;
2928         $uid_pdbtest2 = $max_uid - 4;
2929         $uid_userdup = $max_uid - 5;
2930         $uid_pdbtest_wkn = $max_uid - 6;
2931         $uid_force_user = $max_uid - 7;
2932         $uid_smbget = $max_uid - 8;
2933         $uid_user1 = $max_uid - 9;
2934         $uid_user2 = $max_uid - 10;
2935         $uid_gooduser = $max_uid - 11;
2936         $uid_eviluser = $max_uid - 12;
2937         $uid_slashuser = $max_uid - 13;
2938         $uid_localbob = $max_uid - 14;
2939         $uid_localjane = $max_uid - 15;
2940         $uid_localjackthemapper = $max_uid - 16;
2941         $uid_localjacknomapper = $max_uid - 17;
2942
2943         if ($unix_gids[0] < 0xffff - 8) {
2944                 $max_gid = 0xffff;
2945         } else {
2946                 $max_gid = $unix_gids[0];
2947         }
2948
2949         $gid_nobody = $max_gid - 1;
2950         $gid_nogroup = $max_gid - 2;
2951         $gid_root = $max_gid - 3;
2952         $gid_domusers = $max_gid - 4;
2953         $gid_domadmins = $max_gid - 5;
2954         $gid_userdup = $max_gid - 6;
2955         $gid_everyone = $max_gid - 7;
2956         $gid_force_user = $max_gid - 8;
2957         $gid_jackthemapper = $max_gid - 9;
2958         $gid_jacknomapper = $max_gid - 10;
2959         $gid_group1 = $max_gid - 11;
2960         $gid_group2 = $max_gid - 12;
2961
2962         ##
2963         ## create conffile
2964         ##
2965
2966         unless (open(CONF, ">$conffile")) {
2967                 warn("Unable to open $conffile");
2968                 return undef;
2969         }
2970
2971         my $interfaces = Samba::get_interfaces_config($server);
2972
2973         print CONF "
2974 [global]
2975         dcesrv:fuzz directory = $cachedir/fuzz
2976         netbios name = $netbios_name
2977         interfaces = $interfaces
2978         bind interfaces only = yes
2979         panic action = cd $self->{srcdir} && $self->{srcdir}/selftest/gdb_backtrace %d %\$(MAKE_TEST_BINARY)
2980         smbd:suicide mode = yes
2981         smbd:FSCTL_SMBTORTURE = yes
2982         smbd:validate_oplock_types = yes
2983
2984         client min protocol = SMB2_02
2985         server min protocol = SMB2_02
2986
2987         server multi channel support = yes
2988
2989         workgroup = $domain
2990
2991         private dir = $privatedir
2992         binddns dir = $binddnsdir
2993         pid directory = $piddir
2994         lock directory = $lockdir
2995         log file = $logdir/log.\%m
2996         log level = $server_log_level
2997         winbind debug traceid = yes
2998         debug pid = yes
2999         max log size = 0
3000
3001         debug syslog format = always
3002         debug hires timestamp = yes
3003
3004         state directory = $lockdir
3005         cache directory = $lockdir
3006
3007         passdb backend = tdbsam
3008
3009         time server = yes
3010
3011         add user script =               $nss_wrapper_pl --passwd_path $nss_wrapper_passwd --type passwd --action add --name %u --gid $gid_nogroup
3012         add group script =              $nss_wrapper_pl --group_path  $nss_wrapper_group  --type group  --action add --name %g
3013         add machine script =            $nss_wrapper_pl --passwd_path $nss_wrapper_passwd --type passwd --action add --name %u --gid $gid_nogroup
3014         add user to group script =      $nss_wrapper_pl --passwd_path $nss_wrapper_passwd --type member --action add --member %u --name %g --group_path $nss_wrapper_group
3015         delete user script =            $nss_wrapper_pl --passwd_path $nss_wrapper_passwd --type passwd --action delete --name %u
3016         delete group script =           $nss_wrapper_pl --group_path  $nss_wrapper_group  --type group  --action delete --name %g
3017         delete user from group script = $nss_wrapper_pl --passwd_path $nss_wrapper_passwd --type member --action delete --member %u --name %g --group_path $nss_wrapper_group
3018
3019         addprinter command =            $mod_printer_pl -a -s $conffile --
3020         deleteprinter command =         $mod_printer_pl -d -s $conffile --
3021
3022         eventlog list = application \"dns server\"
3023
3024         kernel oplocks = no
3025         kernel change notify = no
3026
3027         logging = file
3028         printing = bsd
3029         printcap name = /dev/null
3030
3031         winbindd socket directory = $wbsockdir
3032         nmbd:socket dir = $nmbdsockdir
3033         idmap config * : range = 100000-200000
3034         winbind enum users = yes
3035         winbind enum groups = yes
3036         winbind separator = /
3037         include system krb5 conf = no
3038
3039 #       min receivefile size = 4000
3040
3041         read only = no
3042
3043         smbd:sharedelay = 100000
3044         smbd:writetimeupdatedelay = 500000
3045         map hidden = no
3046         map system = no
3047         map readonly = no
3048         store dos attributes = yes
3049         create mask = 755
3050         dos filemode = yes
3051         strict rename = yes
3052         strict sync = yes
3053         mangled names = yes
3054         vfs objects = acl_xattr fake_acls xattr_tdb streams_depot time_audit full_audit
3055
3056         full_audit:syslog = no
3057         full_audit:success = none
3058         full_audit:failure = none
3059
3060         printing = vlp
3061         print command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb print %p %s
3062         lpq command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpq %p
3063         lp rm command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lprm %p %j
3064         lp pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lppause %p %j
3065         lp resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb lpresume %p %j
3066         queue pause command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queuepause %p
3067         queue resume command = $bindir_abs/vlp tdbfile=$lockdir/vlp.tdb queueresume %p
3068         lpq cache time = 0
3069         print notify backchannel = yes
3070
3071         ncalrpc dir = $prefix_abs/ncalrpc
3072
3073         # The samba3.blackbox.smbclient_s3 test uses this to test that
3074         # sending messages works, and that the %m sub works.
3075         message command = mv %s $shrdir/message.%m
3076
3077         # fsrvp server requires registry shares
3078         registry shares = yes
3079
3080         # Used by RPC SRVSVC tests
3081         add share command = $bindir_abs/smbaddshare
3082         change share command = $bindir_abs/smbchangeshare
3083         delete share command = $bindir_abs/smbdeleteshare
3084
3085         # fruit:copyfile is a global option
3086         fruit:copyfile = yes
3087
3088         #this does not mean that we use non-secure test env,
3089         #it just means we ALLOW one to be configured.
3090         allow insecure wide links = yes
3091
3092         # Begin extra options before global inject
3093         $extra_options_before_inject
3094         # End extra options befoore global inject
3095
3096         include = $globalinjectconf
3097
3098         # Begin extra options
3099         $extra_options
3100         # End extra options
3101
3102         #Include user defined custom parameters if set
3103 ";
3104
3105         if (defined($ENV{INCLUDE_CUSTOM_CONF})) {
3106                 print CONF "\t$ENV{INCLUDE_CUSTOM_CONF}\n";
3107         }
3108
3109         print CONF "
3110 [smbcacls_share]
3111         path = $smbcacls_share
3112         comment = smb username is [%U]
3113         msdfs root = yes
3114
3115 [smbcacls_sharedir_dfs]
3116         path = $smbcacls_sharedir_dfs
3117         comment = smb username is [%U]
3118 [tmp]
3119         path = $shrdir
3120         comment = smb username is [%U]
3121 [tmpsort]
3122         path = $shrdir
3123         comment = Load dirsort module
3124         vfs objects = dirsort acl_xattr fake_acls xattr_tdb streams_depot
3125 [tmpenc]
3126         path = $shrdir
3127         comment = encrypt smb username is [%U]
3128         server smb encrypt = required
3129         vfs objects = dirsort
3130 [tmpguest]
3131         path = $shrdir
3132         guest ok = yes
3133 [guestonly]
3134         path = $shrdir
3135         guest only = yes
3136         guest ok = yes
3137 [forceuser]
3138         path = $shrdir
3139         force user = $unix_name
3140         guest ok = yes
3141 [forceuser_unixonly]
3142         comment = force a user with unix user SID and group SID
3143         path = $shrdir
3144         force user = pdbtest
3145         guest ok = yes
3146 [forceuser_wkngroup]
3147         comment = force a user with well-known group SID
3148         path = $shrdir
3149         force user = pdbtest_wkn
3150         guest ok = yes
3151 [forcegroup]
3152         path = $shrdir
3153         force group = nogroup
3154         guest ok = yes
3155 [ro-tmp]
3156         path = $ro_shrdir
3157         guest ok = yes
3158 [noperm]
3159         path = $noperm_shrdir
3160         wide links = yes
3161         guest ok = yes
3162 [write-list-tmp]
3163         path = $shrdir
3164         read only = yes
3165         write list = $unix_name
3166 [valid-users-tmp]
3167         path = $shrdir
3168         valid users = $unix_name
3169         access based share enum = yes
3170 [msdfs-share]
3171         path = $msdfs_shrdir
3172         msdfs root = yes
3173         msdfs shuffle referrals = yes
3174         guest ok = yes
3175 [msdfs-share-wl]
3176         path = $msdfs_shrdir
3177         msdfs root = yes
3178         wide links = yes
3179         guest ok = yes
3180 [msdfs-share2]
3181         path = $msdfs_shrdir2
3182         msdfs root = yes
3183         guest ok = yes
3184 [msdfs-pathname-share]
3185         path = $msdfs_pathname_share
3186         msdfs root = yes
3187         guest ok = yes
3188 [non-msdfs-pathname-share]
3189         path = $non_msdfs_pathname_share
3190         msdfs root = no
3191         guest ok = yes
3192 [hideunread]
3193         copy = tmp
3194         hide unreadable = yes
3195 [tmpcase]
3196         copy = tmp
3197         case sensitive = yes
3198 [hideunwrite]
3199         copy = tmp
3200         hide unwriteable files = yes
3201 [durable]
3202         copy = tmp
3203         kernel share modes = no
3204         kernel oplocks = no
3205         posix locking = no
3206 [fs_specific]
3207         copy = tmp
3208         $fs_specific_conf
3209 [print1]
3210         copy = tmp
3211         printable = yes
3212
3213 [print2]
3214         copy = print1
3215 [print3]
3216         copy = print1
3217         default devmode = no
3218
3219 [print_var_exp]
3220         copy = print1
3221         print command = $self->{srcdir}/source3/script/tests/printing/printing_var_exp_lpr_cmd.sh \"Windows user: %U\" \"UNIX user: %u\" \"Domain: %D\"
3222
3223 [lp]
3224         copy = print1
3225
3226 [nfs4acl_simple_40]
3227         path = $shrdir
3228         comment = smb username is [%U]
3229         nfs4:mode = simple
3230         nfs4acl_xattr:version = 40
3231         vfs objects = nfs4acl_xattr xattr_tdb
3232
3233 [nfs4acl_special_40]
3234         path = $shrdir
3235         comment = smb username is [%U]
3236         nfs4:mode = special
3237         nfs4acl_xattr:version = 40
3238         vfs objects = nfs4acl_xattr xattr_tdb
3239
3240 [nfs4acl_simple_41]
3241         path = $shrdir
3242         comment = smb username is [%U]
3243         nfs4:mode = simple
3244         vfs objects = nfs4acl_xattr xattr_tdb
3245
3246 [nfs4acl_xdr_40]
3247         path = $shrdir
3248         comment = smb username is [%U]
3249         vfs objects = nfs4acl_xattr xattr_tdb
3250         nfs4:mode = simple
3251         nfs4acl_xattr:encoding = xdr
3252         nfs4acl_xattr:version = 40
3253
3254 [nfs4acl_xdr_41]
3255         path = $shrdir
3256         comment = smb username is [%U]
3257         vfs objects = nfs4acl_xattr xattr_tdb
3258         nfs4:mode = simple
3259         nfs4acl_xattr:encoding = xdr
3260         nfs4acl_xattr:version = 41
3261
3262 [nfs4acl_nfs_40]
3263         path = $shrdir
3264         comment = smb username is [%U]
3265         vfs objects = nfs4acl_xattr xattr_tdb
3266         nfs4:mode = simple
3267         nfs4acl_xattr:encoding = nfs
3268         nfs4acl_xattr:version = 40
3269         nfs4acl_xattr:xattr_name = security.nfs4acl_xdr
3270
3271 [nfs4acl_nfs_41]
3272         path = $shrdir
3273         comment = smb username is [%U]
3274         vfs objects = nfs4acl_xattr xattr_tdb
3275         nfs4:mode = simple
3276         nfs4acl_xattr:encoding = nfs
3277         nfs4acl_xattr:version = 41
3278         nfs4acl_xattr:xattr_name = security.nfs4acl_xdr
3279
3280 [xcopy_share]
3281         path = $shrdir
3282         comment = smb username is [%U]
3283         create mask = 777
3284         force create mode = 777
3285 [posix_share]
3286         path = $shrdir
3287         comment = smb username is [%U]
3288         create mask = 0777
3289         force create mode = 0
3290         directory mask = 0777
3291         force directory mode = 0
3292         vfs objects = xattr_tdb streams_depot
3293 [smb3_posix_share]
3294         vfs objects = fake_acls xattr_tdb streams_depot time_audit full_audit
3295         create mask = 07777
3296         directory mask = 07777
3297         mangled names = no
3298         path = $shrdir
3299         read only = no
3300         guest ok = yes
3301 [aio]
3302         copy = durable
3303         aio read size = 1
3304         aio write size = 1
3305
3306 [print\$]
3307         copy = tmp
3308
3309 [vfs_fruit]
3310         path = $shrdir
3311         vfs objects = catia fruit streams_xattr acl_xattr xattr_tdb
3312         fruit:resource = file
3313         fruit:metadata = netatalk
3314         fruit:locking = netatalk
3315         fruit:encoding = native
3316         fruit:veto_appledouble = no
3317
3318 [vfs_fruit_xattr]
3319         path = $shrdir
3320         # This is used by vfs.fruit tests that require real fs xattr
3321         vfs objects = catia fruit streams_xattr acl_xattr
3322         fruit:resource = file
3323         fruit:metadata = netatalk
3324         fruit:locking = netatalk
3325         fruit:encoding = native
3326         fruit:veto_appledouble = no
3327
3328 [vfs_fruit_metadata_stream]
3329         path = $shrdir
3330         vfs objects = fruit streams_xattr acl_xattr xattr_tdb
3331         fruit:resource = file
3332         fruit:metadata = stream
3333         fruit:veto_appledouble = no
3334
3335 [vfs_fruit_stream_depot]
3336         path = $shrdir
3337         vfs objects = fruit streams_depot acl_xattr xattr_tdb
3338         fruit:resource = stream
3339         fruit:metadata = stream
3340         fruit:veto_appledouble = no
3341
3342 [vfs_wo_fruit]
3343         path = $shrdir
3344         vfs objects = streams_xattr acl_xattr xattr_tdb
3345
3346 [vfs_wo_fruit_stream_depot]
3347         path = $shrdir
3348         vfs objects = streams_depot acl_xattr xattr_tdb
3349
3350 [vfs_fruit_timemachine]
3351         path = $shrdir
3352         vfs objects = fruit streams_xattr acl_xattr xattr_tdb
3353         fruit:resource = file
3354         fruit:metadata = stream
3355         fruit:time machine = yes
3356         fruit:time machine max size = 32K
3357
3358 [vfs_fruit_wipe_intentionally_left_blank_rfork]
3359         path = $shrdir
3360         vfs objects = fruit streams_xattr acl_xattr xattr_tdb
3361         fruit:resource = file
3362         fruit:metadata = stream
3363         fruit:wipe_intentionally_left_blank_rfork = true
3364         fruit:delete_empty_adfiles = false
3365         fruit:veto_appledouble = no
3366
3367 [vfs_fruit_delete_empty_adfiles]
3368         path = $shrdir
3369         vfs objects = fruit streams_xattr acl_xattr xattr_tdb
3370         fruit:resource = file
3371         fruit:metadata = stream
3372         fruit:wipe_intentionally_left_blank_rfork = true
3373         fruit:delete_empty_adfiles = true
3374         fruit:veto_appledouble = no
3375
3376 [vfs_fruit_zero_fileid]
3377         path = $shrdir
3378         vfs objects = fruit streams_xattr acl_xattr xattr_tdb
3379         fruit:resource = file
3380         fruit:metadata = stream
3381         fruit:zero_file_id=yes
3382         fruit:validate_afpinfo = no
3383
3384 [fruit_resource_stream]
3385         path = $fruit_resource_stream_shrdir
3386         vfs objects = fruit streams_xattr acl_xattr xattr_tdb
3387         fruit:resource = stream
3388         fruit:metadata = stream
3389
3390 [badname-tmp]
3391         path = $badnames_shrdir
3392         guest ok = yes
3393
3394 [manglenames_share]
3395         path = $manglenames_shrdir
3396         guest ok = yes
3397
3398 [dynamic_share]
3399         path = $shrdir/dynamic/%t
3400         guest ok = yes
3401         root preexec = mkdir %P
3402
3403 [widelinks_share]
3404         path = $widelinks_shrdir
3405         wide links = no
3406         guest ok = yes
3407
3408 [fsrvp_share]
3409         path = $fsrvp_shrdir
3410         comment = fake snapshots using rsync
3411         vfs objects = shell_snap shadow_copy2
3412         shell_snap:check path command = $fake_snap_pl --check
3413         shell_snap:create command = $fake_snap_pl --create
3414         shell_snap:delete command = $fake_snap_pl --delete
3415         # a relative path here fails, the snapshot dir is no longer found
3416         shadow:snapdir = $fsrvp_shrdir/.snapshots
3417
3418 [shadow1]
3419         path = $shadow_shrdir
3420         comment = previous versions snapshots under mount point
3421         vfs objects = shadow_copy2
3422         shadow:mountpoint = $shadow_mntdir
3423
3424 [shadow2]
3425         path = $shadow_shrdir
3426         comment = previous versions snapshots outside mount point
3427         vfs objects = shadow_copy2
3428         shadow:mountpoint = $shadow_mntdir
3429         shadow:snapdir = $shadow_tstdir/.snapshots
3430
3431 [shadow3]
3432         path = $shadow_shrdir
3433         comment = previous versions with subvolume snapshots, snapshots under base dir
3434         vfs objects = shadow_copy2
3435         shadow:mountpoint = $shadow_mntdir
3436         shadow:basedir = $shadow_basedir
3437         shadow:snapdir = $shadow_basedir/.snapshots
3438
3439 [shadow4]
3440         path = $shadow_shrdir
3441         comment = previous versions with subvolume snapshots, snapshots outside mount point
3442         vfs objects = shadow_copy2
3443         shadow:mountpoint = $shadow_mntdir
3444         shadow:basedir = $shadow_basedir
3445         shadow:snapdir = $shadow_tstdir/.snapshots
3446
3447 [shadow5]
3448         path = $shadow_shrdir
3449         comment = previous versions at volume root snapshots under mount point
3450         vfs objects = shadow_copy2
3451         shadow:mountpoint = $shadow_shrdir
3452
3453 [shadow6]
3454         path = $shadow_shrdir
3455         comment = previous versions at volume root snapshots outside mount point
3456         vfs objects = shadow_copy2
3457         shadow:mountpoint = $shadow_shrdir
3458         shadow:snapdir = $shadow_tstdir/.snapshots
3459
3460 [shadow7]
3461         path = $shadow_shrdir
3462         comment = previous versions snapshots everywhere
3463         vfs objects = shadow_copy2
3464         shadow:mountpoint = $shadow_mntdir
3465         shadow:snapdirseverywhere = yes
3466
3467 [shadow8]
3468         path = $shadow_shrdir
3469         comment = previous versions using snapsharepath
3470         vfs objects = shadow_copy2
3471         shadow:mountpoint = $shadow_mntdir
3472         shadow:snapdir = $shadow_tstdir/.snapshots
3473         shadow:snapsharepath = share
3474
3475 [shadow_fmt0]
3476         comment = Testing shadow:format with default option
3477         vfs object = shadow_copy2
3478         path = $shadow_shrdir
3479         read only = no
3480         guest ok = yes
3481         shadow:mountpoint = $shadow_mntdir
3482         shadow:basedir = $shadow_basedir
3483         shadow:snapdir = $shadow_basedir/.snapshots
3484         shadow:format = \@GMT-%Y.%m.%d-%H.%M.%S
3485
3486 [shadow_fmt1]
3487         comment = Testing shadow:format with only date component
3488         vfs object = shadow_copy2
3489         path = $shadow_shrdir
3490         read only = no
3491         guest ok = yes
3492         shadow:mountpoint = $shadow_mntdir
3493         shadow:basedir = $shadow_basedir
3494         shadow:snapdir = $shadow_basedir/.snapshots
3495         shadow:format = \@GMT-%Y-%m-%d
3496
3497 [shadow_fmt2]
3498         comment = Testing shadow:format with some hardcoded prefix
3499         vfs object = shadow_copy2
3500         path = $shadow_shrdir
3501         read only = no
3502         guest ok = yes
3503         shadow:mountpoint = $shadow_mntdir
3504         shadow:basedir = $shadow_basedir
3505         shadow:snapdir = $shadow_basedir/.snapshots
3506         shadow:format = snap\@GMT-%Y.%m.%d-%H.%M.%S
3507
3508 [shadow_fmt3]
3509         comment = Testing shadow:format with modified format
3510         vfs object = shadow_copy2
3511         path = $shadow_shrdir
3512         read only = no
3513         guest ok = yes
3514         shadow:mountpoint = $shadow_mntdir
3515         shadow:basedir = $shadow_basedir
3516         shadow:snapdir = $shadow_basedir/.snapshots
3517         shadow:format = \@GMT-%Y.%m.%d-%H_%M_%S-snap
3518
3519 [shadow_fmt4]
3520         comment = Testing shadow:snapprefix regex
3521         vfs object = shadow_copy2
3522         path = $shadow_shrdir
3523         read only = no
3524         guest ok = yes
3525         shadow:mountpoint = $shadow_mntdir
3526         shadow:basedir = $shadow_basedir
3527         shadow:snapdir = $shadow_basedir/.snapshots
3528         shadow:snapprefix = \^s[a-z]*p\$
3529         shadow:format = _GMT-%Y.%m.%d-%H.%M.%S
3530
3531 [shadow_fmt5]
3532         comment = Testing shadow:snapprefix with delim regex
3533         vfs object = shadow_copy2
3534         path = $shadow_shrdir
3535         read only = no
3536         guest ok = yes
3537         shadow:mountpoint = $shadow_mntdir
3538         shadow:basedir = $shadow_basedir
3539         shadow:snapdir = $shadow_basedir/.snapshots
3540         shadow:delimiter = \@GMT
3541         shadow:snapprefix = [a-z]*
3542         shadow:format = \@GMT-%Y.%m.%d-%H.%M.%S
3543
3544 [shadow_wl]
3545         path = $shadow_shrdir
3546         comment = previous versions with wide links allowed
3547         vfs objects = shadow_copy2
3548         shadow:mountpoint = $shadow_mntdir
3549         wide links = yes
3550
3551 [shadow_write]
3552         path = $shadow_tstdir
3553         comment = previous versions snapshots under mount point
3554         vfs objects = shadow_copy2 streams_xattr
3555         shadow:mountpoint = $shadow_tstdir
3556         shadow:fixinodes = yes
3557         smbd async dosmode = yes
3558
3559 [shadow_depot]
3560         path = $shadow_shrdir
3561         comment = previous versions with streams_depot
3562         vfs objects = streams_depot shadow_copy2
3563
3564 [dfq]
3565         path = $shrdir/dfree
3566         vfs objects = acl_xattr fake_acls xattr_tdb fake_dfq
3567         admin users = $unix_name
3568         include = $dfqconffile
3569 [dfq_cache]
3570         path = $shrdir/dfree
3571         vfs objects = acl_xattr fake_acls xattr_tdb fake_dfq
3572         admin users = $unix_name
3573         include = $dfqconffile
3574         dfree cache time = 60
3575 [dfq_owner]
3576         path = $shrdir/dfree
3577         vfs objects = acl_xattr fake_acls xattr_tdb fake_dfq
3578         inherit owner = yes
3579         include = $dfqconffile
3580 [quotadir]
3581         path = $shrdir/quota
3582         admin users = $unix_name
3583
3584 [acl_xattr_ign_sysacl_posix]
3585         copy = tmp
3586         acl_xattr:ignore system acls = yes
3587         acl_xattr:default acl style = posix
3588 [acl_xattr_ign_sysacl_windows]
3589         copy = tmp
3590         acl_xattr:ignore system acls = yes
3591         acl_xattr:default acl style = windows
3592
3593 [mangle_illegal]
3594         copy = tmp
3595         mangled names = illegal
3596
3597 [nosymlinks]
3598         copy = tmp
3599         path = $nosymlinks_shrdir
3600         follow symlinks = no
3601 [nosymlinks_smb1allow]
3602         copy=nosymlinks
3603         follow symlinks = yes
3604
3605 [local_symlinks]
3606         copy = tmp
3607         path = $local_symlinks_shrdir
3608         follow symlinks = yes
3609
3610 [worm]
3611         copy = tmp
3612         path = $worm_shrdir
3613         vfs objects = worm
3614         worm:grace_period = 1
3615         comment = vfs_worm with 1s grace_period
3616
3617 [kernel_oplocks]
3618         copy = tmp
3619         kernel oplocks = yes
3620         vfs objects = streams_xattr xattr_tdb
3621
3622 [streams_xattr]
3623         copy = tmp
3624         vfs objects = streams_xattr xattr_tdb
3625
3626 [streams_xattr_nostrict]
3627         copy = tmp
3628         strict rename = no
3629         vfs objects = streams_xattr xattr_tdb
3630
3631 [acl_streams_xattr]
3632         copy = tmp
3633         vfs objects = acl_xattr streams_xattr fake_acls xattr_tdb
3634         acl_xattr:ignore system acls = yes
3635         acl_xattr:security_acl_name = user.acl
3636         xattr_tdb:ignore_user_xattr = yes
3637
3638 [compound_find]
3639         copy = tmp
3640         smbd:find async delay usec = 10000
3641 [error_inject]
3642         copy = tmp
3643         vfs objects = error_inject
3644         include = $errorinjectconf
3645
3646 [delay_inject]
3647         copy = tmp
3648         vfs objects = delay_inject
3649         kernel share modes = no
3650         kernel oplocks = no
3651         posix locking = no
3652         include = $delayinjectconf
3653
3654 [aio_delay_inject]
3655         copy = tmp
3656         vfs objects = delay_inject
3657         delay_inject:pread_send = 2000
3658         delay_inject:pwrite_send = 2000
3659
3660 [brl_delay_inject1]
3661         copy = tmp
3662         vfs objects = delay_inject
3663         delay_inject:brl_lock_windows = 90
3664         delay_inject:brl_lock_windows_use_timer = yes
3665
3666 [brl_delay_inject2]
3667         copy = tmp
3668         vfs objects = delay_inject
3669         delay_inject:brl_lock_windows = 90
3670         delay_inject:brl_lock_windows_use_timer = no
3671
3672 [delete_readonly]
3673         path = $prefix_abs/share
3674         delete readonly = yes
3675
3676 [enc_desired]
3677         path = $prefix_abs/share
3678         vfs objects =
3679         server smb encrypt = desired
3680
3681 [enc_off]
3682         path = $prefix_abs/share
3683         vfs objects =
3684         server smb encrypt = off
3685
3686 [notify_priv]
3687         copy = tmp
3688         honor change notify privilege = yes
3689
3690 [acls_non_canonical]
3691         copy = tmp
3692         acl flag inherited canonicalization = no
3693
3694 [full_audit_success_bad_name]
3695         copy = tmp
3696         full_audit:success = badname
3697
3698 [full_audit_fail_bad_name]
3699         copy = tmp
3700         full_audit:failure = badname
3701
3702 [only_ipv6]
3703         copy = tmpguest
3704         server addresses = $server_ipv6
3705
3706 [smbget]
3707         path = $smbget_sharedir
3708         comment = smb username is [%U]
3709
3710 [recycle]
3711         copy = tmp
3712         path = $recycle_shrdir
3713         vfs objects = recycle
3714         recycle : repository = .trash
3715         recycle : exclude = *.tmp
3716         recycle : directory_mode = 755
3717
3718 [fakedircreatetimes]
3719         copy = tmp
3720         path = $fakedircreatetimes_shrdir
3721         fake directory create times = yes
3722
3723 [smbget_guest]
3724         path = $smbget_sharedir
3725         comment = smb username is [%U]
3726         guest ok = yes
3727
3728 include = $aliceconfdir/%U.conf
3729         ";
3730
3731         close(CONF);
3732
3733         my $net = Samba::bindir_path($self, "net");
3734         my $cmd = "";
3735         $cmd .= "UID_WRAPPER_ROOT=1 ";
3736         $cmd .= "SMB_CONF_PATH=\"$conffile\" ";
3737         $cmd .= "$net setlocalsid $samsid";
3738
3739         my $net_ret = system($cmd);
3740         if ($net_ret != 0) {
3741             warn("net setlocalsid failed: $net_ret\n$cmd");
3742             return undef;
3743         }
3744
3745         unless (open(ERRORCONF, ">$errorinjectconf")) {
3746                 warn("Unable to open $errorinjectconf");
3747                 return undef;
3748         }
3749         close(ERRORCONF);
3750
3751         unless (open(DELAYCONF, ">$delayinjectconf")) {
3752                 warn("Unable to open $delayinjectconf");
3753                 return undef;
3754         }
3755         close(DELAYCONF);
3756
3757         unless (open(DFQCONF, ">$dfqconffile")) {
3758                 warn("Unable to open $dfqconffile");
3759                 return undef;
3760         }
3761         close(DFQCONF);
3762
3763         unless (open(DELAYCONF, ">$globalinjectconf")) {
3764                 warn("Unable to open $globalinjectconf");
3765                 return undef;
3766         }
3767         close(DELAYCONF);
3768
3769         unless (open(ALICECONF, ">$aliceconffile")) {
3770                 warn("Unable to open $aliceconffile");
3771                 return undef;
3772         }
3773
3774         print ALICECONF "
3775 [alice_share]
3776         path = $shrdir
3777         comment = smb username is [%U]
3778         ";
3779
3780         close(ALICECONF);
3781
3782         ##
3783         ## create a test account
3784         ##
3785
3786         unless (open(PASSWD, ">$nss_wrapper_passwd")) {
3787            warn("Unable to open $nss_wrapper_passwd");
3788            return undef;
3789         }
3790         print PASSWD "nobody:x:$uid_nobody:$gid_nobody:nobody gecos:$prefix_abs:/bin/false
3791 $unix_name:x:$unix_uid:$unix_gids[0]:$unix_name gecos:$prefix_abs:/bin/false
3792 pdbtest:x:$uid_pdbtest:$gid_nogroup:pdbtest gecos:$prefix_abs:/bin/false
3793 pdbtest2:x:$uid_pdbtest2:$gid_nogroup:pdbtest gecos:$prefix_abs:/bin/false
3794 userdup:x:$uid_userdup:$gid_userdup:userdup gecos:$prefix_abs:/bin/false
3795 pdbtest_wkn:x:$uid_pdbtest_wkn:$gid_everyone:pdbtest_wkn gecos:$prefix_abs:/bin/false
3796 force_user:x:$uid_force_user:$gid_force_user:force user gecos:$prefix_abs:/bin/false
3797 smbget_user:x:$uid_smbget:$gid_domusers:smbget_user gecos:$prefix_abs:/bin/false
3798 user1:x:$uid_user1:$gid_nogroup:user1 gecos:$prefix_abs:/bin/false
3799 user2:x:$uid_user2:$gid_nogroup:user2 gecos:$prefix_abs:/bin/false
3800 gooduser:x:$uid_gooduser:$gid_domusers:gooduser gecos:$prefix_abs:/bin/false
3801 eviluser:x:$uid_eviluser:$gid_domusers:eviluser gecos::/bin/false
3802 slashuser:x:$uid_slashuser:$gid_domusers:slashuser gecos:/:/bin/false
3803 bob:x:$uid_localbob:$gid_domusers:localbob gecos:/:/bin/false
3804 jane:x:$uid_localjane:$gid_domusers:localjane gecos:/:/bin/false
3805 jackthemapper:x:$uid_localjackthemapper:$gid_domusers:localjackthemaper gecos:/:/bin/false
3806 jacknomapper:x:$uid_localjacknomapper:$gid_domusers:localjacknomaper gecos:/:/bin/false
3807 ";
3808         if ($unix_uid != 0) {
3809                 print PASSWD "root:x:$uid_root:$gid_root:root gecos:$prefix_abs:/bin/false
3810 ";
3811         }
3812         close(PASSWD);
3813
3814         unless (open(GROUP, ">$nss_wrapper_group")) {
3815              warn("Unable to open $nss_wrapper_group");
3816              return undef;
3817         }
3818         print GROUP "nobody:x:$gid_nobody:
3819 nogroup:x:$gid_nogroup:nobody
3820 $unix_name-group:x:$unix_gids[0]:
3821 domusers:X:$gid_domusers:
3822 domadmins:X:$gid_domadmins:
3823 userdup:x:$gid_userdup:$unix_name
3824 everyone:x:$gid_everyone:
3825 force_user:x:$gid_force_user:
3826 jackthemappergroup:x:$gid_jackthemapper:jackthemapper
3827 jacknomappergroup:x:$gid_jacknomapper:jacknomapper
3828 group1:x:$gid_group1:user1
3829 group2:x:$gid_group2:user2
3830 ";
3831         if ($unix_gids[0] != 0) {
3832                 print GROUP "root:x:$gid_root:
3833 ";
3834         }
3835
3836         close(GROUP);
3837
3838         ## hosts
3839         my $hostname = lc($server);
3840         unless (open(HOSTS, ">>$nss_wrapper_hosts")) {
3841                 warn("Unable to open $nss_wrapper_hosts");
3842                 return undef;
3843         }
3844         print HOSTS "${server_ip} ${hostname}.${dns_domain} ${hostname}\n";
3845         print HOSTS "${server_ipv6} ${hostname}.${dns_domain} ${hostname}\n";
3846         close(HOSTS);
3847
3848         $resolv_conf = "$privatedir/no_resolv.conf" unless defined($resolv_conf);
3849
3850         foreach my $evlog (@eventlog_list) {
3851                 my $evlogtdb = "$eventlogdir/$evlog.tdb";
3852                 open(EVENTLOG, ">$evlogtdb") or die("Unable to open $evlogtdb");
3853                 close(EVENTLOG);
3854         }
3855
3856         $createuser_env{NSS_WRAPPER_PASSWD} = $nss_wrapper_passwd;
3857         $createuser_env{NSS_WRAPPER_GROUP} = $nss_wrapper_group;
3858         $createuser_env{NSS_WRAPPER_HOSTS} = $nss_wrapper_hosts;
3859         $createuser_env{NSS_WRAPPER_HOSTNAME} = "${hostname}.${dns_domain}";
3860         if ($ENV{SAMBA_DNS_FAKING}) {
3861                 $createuser_env{RESOLV_WRAPPER_HOSTS} = $dns_host_file;
3862         } else {
3863                 $createuser_env{RESOLV_WRAPPER_CONF} = $resolv_conf;
3864         }
3865         $createuser_env{RESOLV_CONF} = $resolv_conf;
3866
3867         createuser($self, $unix_name, $password, $conffile, \%createuser_env) || die("Unable to create user");
3868         createuser($self, "force_user", $password, $conffile, \%createuser_env) || die("Unable to create force_user");
3869         createuser($self, "smbget_user", $password, $conffile, \%createuser_env) || die("Unable to create smbget_user");
3870         createuser($self, "user1", $password, $conffile, \%createuser_env) || die("Unable to create user1");
3871         createuser($self, "user2", $password, $conffile, \%createuser_env) || die("Unable to create user2");
3872         createuser($self, "gooduser", $password, $conffile, \%createuser_env) || die("Unable to create gooduser");
3873         createuser($self, "eviluser", $password, $conffile, \%createuser_env) || die("Unable to create eviluser");
3874         createuser($self, "slashuser", $password, $conffile, \%createuser_env) || die("Unable to create slashuser");
3875         createuser($self, "jackthemapper", "mApsEcrEt", $conffile, \%createuser_env) || die("Unable to create jackthemapper");
3876         createuser($self, "jacknomapper", "nOmApsEcrEt", $conffile, \%createuser_env) || die("Unable to create jacknomapper");
3877
3878         open(DNS_UPDATE_LIST, ">$prefix/dns_update_list") or die("Unable to open $$prefix/dns_update_list");
3879         print DNS_UPDATE_LIST "A $server. $server_ip\n";
3880         print DNS_UPDATE_LIST "AAAA $server. $server_ipv6\n";
3881         close(DNS_UPDATE_LIST);
3882
3883         print "DONE\n";
3884
3885         $ret{SERVER_IP} = $server_ip;
3886         $ret{SERVER_IPV6} = $server_ipv6;
3887         $ret{SAMBA_DCERPCD_TEST_LOG} = "$prefix/samba_dcerpcd_test.log";
3888         $ret{SAMBA_DCERPCD_LOG_POS} = 0;
3889         $ret{NMBD_TEST_LOG} = "$prefix/nmbd_test.log";
3890         $ret{NMBD_TEST_LOG_POS} = 0;
3891         $ret{WINBINDD_TEST_LOG} = "$prefix/winbindd_test.log";
3892         $ret{WINBINDD_TEST_LOG_POS} = 0;
3893         $ret{SMBD_TEST_LOG} = "$prefix/smbd_test.log";
3894         $ret{SMBD_TEST_LOG_POS} = 0;
3895         $ret{SERVERCONFFILE} = $conffile;
3896         $ret{TESTENV_DIR} = $prefix_abs;
3897         $ret{CONFIGURATION} ="--configfile=$conffile";
3898         $ret{LOCK_DIR} = $lockdir;
3899         $ret{SERVER} = $server;
3900         $ret{USERNAME} = $unix_name;
3901         $ret{USERID} = $unix_uid;
3902         $ret{DOMAIN} = $domain;
3903         $ret{SAMSID} = $samsid;
3904         $ret{NETBIOSNAME} = $netbios_name;
3905         $ret{PASSWORD} = $password;
3906         $ret{PIDDIR} = $piddir;
3907         $ret{SELFTEST_WINBINDD_SOCKET_DIR} = $wbsockdir;
3908         $ret{NMBD_SOCKET_DIR} = $nmbdsockdir;
3909         $ret{SOCKET_WRAPPER_DEFAULT_IFACE} = $swiface;
3910         $ret{NSS_WRAPPER_PASSWD} = $nss_wrapper_passwd;
3911         $ret{NSS_WRAPPER_GROUP} = $nss_wrapper_group;
3912         $ret{NSS_WRAPPER_HOSTS} = $nss_wrapper_hosts;
3913         $ret{NSS_WRAPPER_HOSTNAME} = "${hostname}.${dns_domain}";
3914         $ret{NSS_WRAPPER_MODULE_SO_PATH} = Samba::nss_wrapper_winbind_so_path($self);
3915         $ret{NSS_WRAPPER_MODULE_FN_PREFIX} = "winbind";
3916         if ($ENV{SAMBA_DNS_FAKING}) {
3917                 $ret{RESOLV_WRAPPER_HOSTS} = $dns_host_file;
3918         } else {
3919                 $ret{RESOLV_WRAPPER_CONF} = $resolv_conf;
3920         }
3921         $ret{RESOLV_CONF} = $resolv_conf;
3922         $ret{LOCAL_PATH} = "$shrdir";
3923         $ret{LOGDIR} = $logdir;
3924
3925         #
3926         # Avoid hitting system krb5.conf -
3927         # An env that needs Kerberos will reset this to the real
3928         # value.
3929         #
3930         $ret{KRB5_CONFIG} = abs_path($prefix) . "/no_krb5.conf";
3931
3932         # Define KRB5CCNAME for each environment we set up
3933         $ret{KRB5_CCACHE} = abs_path($prefix) . "/krb5ccache";
3934         $ENV{KRB5CCNAME} = $ret{KRB5_CCACHE};
3935
3936         return \%ret;
3937 }
3938
3939 sub wait_for_start($$$$$)
3940 {
3941         my ($self, $envvars, $nmbd, $winbindd, $smbd, $samba_dcerpcd) = @_;
3942         my $cmd;
3943         my $netcmd;
3944         my $ret;
3945
3946         if ($samba_dcerpcd eq "yes") {
3947             my $count = 0;
3948             my $rpcclient = Samba::bindir_path($self, "rpcclient");
3949
3950             print "checking for samba_dcerpcd\n";
3951
3952             do {
3953                 $ret = system("UID_WRAPPER_ROOT=1 $rpcclient $envvars->{CONFIGURATION} ncalrpc: -c epmmap");
3954
3955                 if ($ret != 0) {
3956                     sleep(1);
3957                 }
3958                 $count++
3959             } while ($ret != 0 && $count < 10);
3960
3961             if ($count == 10) {
3962                 print "samba_dcerpcd not reachable after 10 retries\n";
3963                 teardown_env($self, $envvars);
3964                 return 0;
3965             }
3966         }
3967
3968         if ($nmbd eq "yes") {
3969                 my $count = 0;
3970
3971                 # give time for nbt server to register its names
3972                 print "checking for nmbd\n";
3973
3974                 # This will return quickly when things are up, but be slow if we need to wait for (eg) SSL init
3975                 my $nmblookup = Samba::bindir_path($self, "nmblookup");
3976
3977                 do {
3978                         $ret = system("$nmblookup $envvars->{CONFIGURATION} $envvars->{SERVER}");
3979                         if ($ret != 0) {
3980                                 sleep(1);
3981                         } else {
3982                                 system("$nmblookup $envvars->{CONFIGURATION} -U $envvars->{SERVER_IP} __SAMBA__");
3983                                 system("$nmblookup $envvars->{CONFIGURATION} __SAMBA__");
3984                                 system("$nmblookup $envvars->{CONFIGURATION} -U 10.255.255.255 __SAMBA__");
3985                                 system("$nmblookup $envvars->{CONFIGURATION} -U $envvars->{SERVER_IP} $envvars->{SERVER}");
3986                         }
3987                         $count++;
3988                 } while ($ret != 0 && $count < 10);
3989                 if ($count == 10) {
3990                         print "NMBD not reachable after 10 retries\n";
3991                         teardown_env($self, $envvars);
3992                         return 0;
3993                 }
3994         }
3995
3996         if ($winbindd eq "yes" or $winbindd eq "offline") {
3997             print "checking for winbindd\n";
3998             my $count = 0;
3999             $cmd = "SELFTEST_WINBINDD_SOCKET_DIR='$envvars->{SELFTEST_WINBINDD_SOCKET_DIR}' ";
4000             $cmd .= "NSS_WRAPPER_PASSWD='$envvars->{NSS_WRAPPER_PASSWD}' ";
4001             $cmd .= "NSS_WRAPPER_GROUP='$envvars->{NSS_WRAPPER_GROUP}' ";
4002             if ($winbindd eq "yes") {
4003                 $cmd .= Samba::bindir_path($self, "wbinfo") . " --ping-dc";
4004             } elsif ($winbindd eq "offline") {
4005                 $cmd .= Samba::bindir_path($self, "wbinfo") . " --ping";
4006             }
4007
4008             do {
4009                 $ret = system($cmd);
4010                 if ($ret != 0) {
4011                     sleep(1);
4012                 }
4013                 $count++;
4014             } while ($ret != 0 && $count < 20);
4015             if ($count == 20) {
4016                 print "WINBINDD not reachable after 20 seconds\n";
4017                 teardown_env($self, $envvars);
4018                 return 0;
4019             }
4020         }
4021
4022         if ($smbd eq "yes") {
4023             # make sure smbd is also up set
4024             print "wait for smbd\n";
4025
4026             my $count = 0;
4027
4028             if (defined($envvars->{GNUTLS_FORCE_FIPS_MODE})) {
4029                         # We don't have NTLM in FIPS mode, so lets use
4030                         # smbcontrol instead of smbclient.
4031                         $cmd = Samba::bindir_path($self, "smbcontrol");
4032                         $cmd .= " $envvars->{CONFIGURATION}";
4033                         $cmd .= " smbd ping";
4034             } else {
4035                         # This uses NTLM which is not available in FIPS
4036                         $cmd = "NSS_WRAPPER_HOSTS='$envvars->{NSS_WRAPPER_HOSTS}' ";
4037                         $cmd .= Samba::bindir_path($self, "smbclient");
4038                         $cmd .= " $envvars->{CONFIGURATION}";
4039                         $cmd .= " -L $envvars->{SERVER}";
4040                         $cmd .= " -U%";
4041                         $cmd .= " -I $envvars->{SERVER_IP}";
4042                         $cmd .= " -p 139";
4043             }
4044
4045             do {
4046                 $ret = system($cmd);
4047                 if ($ret != 0) {
4048                     sleep(1);
4049                 }
4050                 $count++
4051             } while ($ret != 0 && $count < 20);
4052             if ($count == 20) {
4053                 print "SMBD failed to start up in a reasonable time (20sec)\n";
4054                 teardown_env($self, $envvars);
4055                 return 0;
4056             }
4057         }
4058
4059         # Ensure we have domain users mapped.
4060         $netcmd = "NSS_WRAPPER_PASSWD='$envvars->{NSS_WRAPPER_PASSWD}' ";
4061         $netcmd .= "NSS_WRAPPER_GROUP='$envvars->{NSS_WRAPPER_GROUP}' ";
4062         $netcmd .= "UID_WRAPPER_ROOT='1' ";
4063         $netcmd .= Samba::bindir_path($self, "net") ." $envvars->{CONFIGURATION} ";
4064
4065         $cmd = $netcmd . "groupmap add rid=513 unixgroup=domusers type=domain";
4066         $ret = system($cmd);
4067         if ($ret != 0) {
4068                 print("\"$cmd\" failed\n");
4069                 return 1;
4070         }
4071
4072         $cmd = $netcmd . "groupmap add rid=512 unixgroup=domadmins type=domain";
4073         $ret = system($cmd);
4074         if ($ret != 0) {
4075                 print("\"$cmd\" failed\n");
4076                 return 1;
4077         }
4078
4079         $cmd = $netcmd . "groupmap add sid=S-1-1-0 unixgroup=everyone type=builtin";
4080         $ret = system($cmd);
4081         if ($ret != 0) {
4082                 print("\"$cmd\" failed\n");
4083                 return 1;
4084         }
4085
4086         $cmd = $netcmd . "groupmap add unixgroup=group1 type=domain";
4087         $ret = system($cmd);
4088         if ($ret != 0) {
4089                 print("\"$cmd\" failed\n");
4090                 return 1;
4091         }
4092
4093         $cmd = $netcmd . "groupmap add unixgroup=group2 type=domain";
4094         $ret = system($cmd);
4095         if ($ret != 0) {
4096                 print("\"$cmd\" failed\n");
4097                 return 1;
4098         }
4099
4100         # note: creating builtin groups requires winbindd for the
4101         # unix id allocator
4102         my $create_builtin_users = "no";
4103         if ($winbindd eq "yes") {
4104                 $cmd = "SELFTEST_WINBINDD_SOCKET_DIR='$envvars->{SELFTEST_WINBINDD_SOCKET_DIR}' ";
4105                 $cmd .= "NSS_WRAPPER_PASSWD='$envvars->{NSS_WRAPPER_PASSWD}' ";
4106                 $cmd .= "NSS_WRAPPER_GROUP='$envvars->{NSS_WRAPPER_GROUP}' ";
4107                 $cmd .= Samba::bindir_path($self, "wbinfo") . " --sid-to-gid=S-1-5-32-545";
4108                 my $wbinfo_out = qx($cmd 2>&1);
4109                 if ($? != 0) {
4110                         # wbinfo doesn't give us a better error code then
4111                         # WBC_ERR_DOMAIN_NOT_FOUND, but at least that's
4112                         # different then WBC_ERR_WINBIND_NOT_AVAILABLE
4113                         if ($wbinfo_out !~ /WBC_ERR_DOMAIN_NOT_FOUND/) {
4114                                 print("Failed to run \"wbinfo --sid-to-gid=S-1-5-32-545\": $wbinfo_out");
4115                                 teardown_env($self, $envvars);
4116                                 return 0;
4117                         }
4118                         $create_builtin_users = "yes";
4119                 }
4120         }
4121         if ($create_builtin_users eq "yes") {
4122             $cmd = "SELFTEST_WINBINDD_SOCKET_DIR='$envvars->{SELFTEST_WINBINDD_SOCKET_DIR}' ";
4123             $cmd .= "NSS_WRAPPER_PASSWD='$envvars->{NSS_WRAPPER_PASSWD}' ";
4124             $cmd .= "NSS_WRAPPER_GROUP='$envvars->{NSS_WRAPPER_GROUP}' ";
4125             $cmd .= Samba::bindir_path($self, "net") . " $envvars->{CONFIGURATION} ";
4126             $cmd .= "sam createbuiltingroup Users";
4127             $ret = system($cmd);
4128             if ($ret != 0) {
4129                 print "Failed to create BUILTIN\\Users group\n";
4130                 teardown_env($self, $envvars);
4131                 return 0;
4132             }
4133
4134             $cmd = Samba::bindir_path($self, "net") . " $envvars->{CONFIGURATION} ";
4135             $cmd .= "cache del IDMAP/SID2XID/S-1-5-32-545";
4136             system($cmd);
4137
4138             $cmd = "SELFTEST_WINBINDD_SOCKET_DIR='$envvars->{SELFTEST_WINBINDD_SOCKET_DIR}' ";
4139             $cmd .= "NSS_WRAPPER_PASSWD='$envvars->{NSS_WRAPPER_PASSWD}' ";
4140             $cmd .= "NSS_WRAPPER_GROUP='$envvars->{NSS_WRAPPER_GROUP}' ";
4141             $cmd .= Samba::bindir_path($self, "wbinfo") . " --sid-to-gid=S-1-5-32-545";
4142             $ret = system($cmd);
4143             if ($ret != 0) {
4144                 print "Missing \"BUILTIN\\Users\", did net sam createbuiltingroup Users fail?\n";
4145                 teardown_env($self, $envvars);
4146                 return 0;
4147             }
4148         }
4149
4150         print $self->getlog_env($envvars);
4151
4152         return 1;
4153 }
4154
4155 ##
4156 ## provision and start of ctdb
4157 ##
4158 sub setup_ctdb($$)
4159 {
4160         my ($self, $prefix) = @_;
4161         my $num_nodes = 3;
4162
4163         my $data = $self->provision_ctdb($prefix, $num_nodes);
4164         $data or return undef;
4165
4166         my $rc = $self->check_or_start_ctdb($data);
4167         if (not $rc) {
4168                 print("check_or_start_ctdb() failed\n");
4169                 return undef;
4170         }
4171
4172         $rc = $self->wait_for_start_ctdb($data);
4173         if (not $rc) {
4174                 print "Cluster startup failed\n";
4175                 return undef;
4176         }
4177
4178         return $data;
4179 }
4180
4181 sub provision_ctdb($$$$)
4182 {
4183         my ($self, $prefix, $num_nodes) = @_;
4184         my $rc;
4185
4186         print "PROVISIONING CTDB...\n";
4187
4188         my $prefix_abs = abs_path($prefix);
4189
4190         #
4191         # check / create directories:
4192         #
4193         die ("prefix_abs = ''") if $prefix_abs eq "";
4194         die ("prefix_abs = '/'") if $prefix_abs eq "/";
4195
4196         mkdir ($prefix_abs, 0777);
4197
4198         print "CREATE CTDB TEST ENVIRONMENT in '$prefix_abs'...\n";
4199         system("rm -rf $prefix_abs/*");
4200
4201         #
4202         # Per-node data
4203         #
4204         my @nodes = ();
4205         for (my $i = 0; $i < $num_nodes; $i++) {
4206                 my %node = ();
4207                 my $server_name = "ctdb${i}";
4208                 my $pub_iface = Samba::get_interface($server_name);
4209                 my $ip = Samba::get_ipv4_addr($server_name);
4210
4211                 $node{NODE_NUMBER} = "$i";
4212                 $node{SERVER_NAME} = "$server_name";
4213                 $node{SOCKET_WRAPPER_DEFAULT_IFACE} = "$pub_iface";
4214                 $node{IP} = "$ip";
4215
4216                 push(@nodes, \%node);
4217         }
4218
4219         #
4220         # nodes
4221         #
4222         my $nodes_file = "$prefix/nodes.in";
4223         unless (open(NODES, ">$nodes_file")) {
4224                 warn("Unable to open nodesfile '$nodes_file'");
4225                 return undef;
4226         }
4227         for (my $i = 0; $i < $num_nodes; $i++) {
4228                 my $ip = $nodes[$i]->{IP};
4229                 print NODES "${ip}\n";
4230         }
4231         close(NODES);
4232
4233         #
4234         # local_daemons.sh setup
4235         #
4236         # Socket wrapper setup is done by selftest.pl, so don't use
4237         # the CTDB-specific setup
4238         #
4239         my $cmd;
4240         $cmd .= "ctdb/tests/local_daemons.sh " . $prefix_abs . " setup";
4241         $cmd .= " -n " . $num_nodes;
4242         $cmd .= " -N " . $nodes_file;
4243         # CTDB should not attempt to manage public addresses -
4244         # clients should just connect to CTDB private addresses
4245         $cmd .= " -P " . "/dev/null";
4246
4247         my $ret = system($cmd);
4248         if ($ret != 0) {
4249                 print("\"$cmd\" failed\n");
4250                 return undef;
4251         }
4252
4253         #
4254         # Unix domain socket and node directory for each daemon
4255         #
4256         for (my $i = 0; $i < $num_nodes; $i++) {
4257                 my ($cmd, $ret, $out);
4258
4259                 my $cmd_prefix = "ctdb/tests/local_daemons.sh ${prefix_abs}";
4260
4261                 #
4262                 # socket
4263                 #
4264
4265                 $cmd = "${cmd_prefix} print-socket ${i}";
4266
4267                 $out = `$cmd`;
4268                 $ret = $?;
4269                 if ($ret != 0) {
4270                     print("\"$cmd\" failed\n");
4271                     return undef;
4272                 }
4273                 chomp $out;
4274                 $nodes[$i]->{SOCKET_FILE} = "$out";
4275
4276                 #
4277                 # node directory
4278                 #
4279
4280                 $cmd = "${cmd_prefix} onnode ${i} 'echo \$CTDB_BASE'";
4281
4282                 $out = `$cmd`;
4283                 $ret = $?;
4284                 if ($ret != 0) {
4285                     print("\"$cmd\" failed\n");
4286                     return undef;
4287                 }
4288                 chomp $out;
4289                 $nodes[$i]->{NODE_PREFIX} = "$out";
4290         }
4291
4292         my %ret = ();
4293
4294         $ret{CTDB_PREFIX} = "$prefix";
4295         $ret{NUM_NODES} = $num_nodes;
4296         $ret{CTDB_NODES} = \@nodes;
4297         $ret{CTDB_NODES_FILE} = $nodes_file;
4298
4299         for (my $i = 0; $i < $num_nodes; $i++) {
4300                 my $node = $nodes[$i];
4301                 my $socket = $node->{SOCKET_FILE};
4302                 my $server_name = $node->{SERVER_NAME};
4303                 my $node_prefix = $node->{NODE_PREFIX};
4304                 my $ip = $node->{IP};
4305
4306                 $ret{"CTDB_BASE_NODE${i}"} = $node_prefix;
4307                 $ret{"CTDB_SOCKET_NODE${i}"} = $socket;
4308                 $ret{"CTDB_SERVER_NAME_NODE${i}"} = $server_name;
4309                 $ret{"CTDB_IFACE_IP_NODE${i}"} = $ip;
4310         }
4311
4312         $ret{CTDB_BASE} = $ret{CTDB_BASE_NODE0};
4313         $ret{CTDB_SOCKET} = $ret{CTDB_SOCKET_NODE0};
4314         $ret{CTDB_SERVER_NAME} = $ret{CTDB_SERVER_NAME_NODE0};
4315         $ret{CTDB_IFACE_IP} = $ret{CTDB_IFACE_IP_NODE0};
4316
4317         return \%ret;
4318 }
4319
4320 sub check_or_start_ctdb($$) {
4321         my ($self, $data) = @_;
4322
4323         my $prefix = $data->{CTDB_PREFIX};
4324         my $num_nodes = $data->{NUM_NODES};
4325         my $nodes = $data->{CTDB_NODES};
4326         my $STDIN_READER;
4327
4328         # Share a single stdin pipe for all nodes
4329         pipe($STDIN_READER, $data->{CTDB_STDIN_PIPE});
4330
4331         for (my $i = 0; $i < $num_nodes; $i++) {
4332                 my $node = $nodes->[$i];
4333
4334                 $node->{STDIN_PIPE} = $data->{CTDB_STDIN_PIPE};
4335
4336                 my $cmd = "ctdb/tests/local_daemons.sh";
4337                 my @full_cmd = ("$cmd", "$prefix", "start", "$i");
4338                 my $daemon_ctx = {
4339                         NAME => "ctdbd",
4340                         BINARY_PATH => $cmd,
4341                         FULL_CMD => [ @full_cmd ],
4342                         TEE_STDOUT => 1,
4343                         LOG_FILE => "/dev/null",
4344                         ENV_VARS => {},
4345                 };
4346
4347                 print "STARTING CTDBD (node ${i})\n";
4348
4349                 # This does magic with $STDIN_READER, so use it
4350                 my $ret = Samba::fork_and_exec($self,
4351                                                $node,
4352                                                $daemon_ctx,
4353                                                $STDIN_READER);
4354
4355                 if ($ret == 0) {
4356                         print("\"$cmd\" failed\n");
4357                         teardown_env_ctdb($self, $data);
4358                         return 0;
4359                 }
4360         }
4361
4362         close($STDIN_READER);
4363
4364         return 1;
4365 }
4366
4367 sub wait_for_start_ctdb($$)
4368 {
4369         my ($self, $data) = @_;
4370
4371         my $prefix = $data->{CTDB_PREFIX};
4372
4373         print "Wait for ctdbd...\n";
4374
4375         my $ctdb = Samba::bindir_path($self, "ctdb");
4376         my $cmd;
4377         $cmd .= "ctdb/tests/local_daemons.sh ${prefix} onnode all";
4378         $cmd .= " ${ctdb} nodestatus all 2>&1";
4379
4380         my $count = 0;
4381         my $wait_seconds = 60;
4382         my $out;
4383
4384         until ($count > $wait_seconds) {
4385                 $out = `$cmd`;
4386                 my $ret = $?;
4387                 if ($ret == 0) {
4388                         print "\ncluster became healthy\n";
4389                         last;
4390                 }
4391                 print "Waiting for CTDB...\n";
4392                 sleep(1);
4393                 $count++;
4394         }
4395
4396         if ($count > $wait_seconds) {
4397                 print "\nGiving up to wait for CTDB...\n";
4398                 print "${out}\n\n";
4399                 print "CTDB log:\n";
4400                 $cmd = "ctdb/tests/local_daemons.sh ${prefix} print-log all >&2";
4401                 system($cmd);
4402                 teardown_env_ctdb($self, $data);
4403                 return 0;
4404         }
4405
4406         print "\nCTDB initialized\n";
4407
4408         return 1;
4409 }
4410
4411 1;