param: calculate server role from security, and security from server role

This allows smb.conf files from either the samba3 or samba4 tradition
to come to the same value of server role, using the information in the
smb.conf file.

This is important so that tools like 'net getlocalsid' work against a
Samba4 AD installation (yes, users have tried this).

Andrew Bartlett

Pair-Programmed-With: Amitay Isaacs <amitay@samba.org>

3 files changed, 9 insertions, 110 deletions

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 285023944a..25b5eb84dc 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -60,6 +60,7 @@
 #include "lib/smbconf/smbconf.h"
 #include "lib/smbconf/smbconf_init.h"
 #include "lib/param/loadparm.h"
+#include "lib/param/loadparm_server_role.h"
 
 #include "ads.h"
 #include "../librpc/gen_ndr/svcctl.h"
@@ -4822,7 +4823,7 @@ static void init_globals(bool reinit_globals)
 	Globals.PrintcapCacheTime = 750; 	/* 12.5 minutes */
 
 	Globals.ConfigBackend = config_backend;
-	Globals.ServerRole = ROLE_STANDALONE;
+	Globals.ServerRole = ROLE_AUTO;
 
 	/* Was 65535 (0xFFFF). 0x4101 matches W2K and causes major speed improvements... */
 	/* Discovered by 2 days of pain by Don McCall @ HP :-). */
@@ -5390,7 +5391,7 @@ FN_GLOBAL_INTEGER(lp_lock_spin_time, iLockSpinTime)
 FN_GLOBAL_INTEGER(lp_usershare_max_shares, iUsershareMaxShares)
 FN_GLOBAL_CONST_STRING(lp_socket_options, szSocketOptions)
 FN_GLOBAL_INTEGER(lp_config_backend, ConfigBackend)
-FN_GLOBAL_INTEGER(lp_server_role, ServerRole)
+static FN_GLOBAL_INTEGER(lp__server_role, ServerRole)
 FN_GLOBAL_INTEGER(lp_smb2_max_read, ismb2_max_read)
 FN_GLOBAL_INTEGER(lp_smb2_max_write, ismb2_max_write)
 FN_GLOBAL_INTEGER(lp_smb2_max_trans, ismb2_max_trans)
@@ -9121,7 +9122,6 @@ static bool lp_load_ex(const char *pszFname,
 		}
 	}
 
-	set_server_role();
 	set_allowed_client_auth();
 
 	if (lp_security() == SEC_SHARE) {
@@ -9432,7 +9432,7 @@ bool lp_domain_master(void)
  If we are PDC then prefer us as DMB
 ************************************************************/
 
-bool lp_domain_master_true_or_auto(void)
+static bool lp_domain_master_true_or_auto(void)
 {
 	if (Globals.iDomainMaster) /* auto or yes */
 		return true;
@@ -9736,7 +9736,10 @@ bool lp_readraw(void)
 	return _lp_readraw();
 }
 
-void _lp_set_server_role(int server_role)
+int lp_server_role(void)
 {
-	Globals.ServerRole = server_role;
+	return lp_find_server_role(lp__server_role(),
+				   lp_security(),
+				   lp_domain_logons(),
+				   lp_domain_master_true_or_auto());
 }
diff --git a/source3/param/loadparm_ctx.c b/source3/param/loadparm_ctx.c
index 1e11eeb4b2..61fe97462d 100644
--- a/source3/param/loadparm_ctx.c
+++ b/source3/param/loadparm_ctx.c
@@ -74,7 +74,6 @@ static const struct loadparm_s3_context s3_fns =
 	.dump = lp_dump,
 
 	.server_role = lp_server_role,
-	.domain_master = lp_domain_master,
 
 	.winbind_separator = lp_winbind_separator,
 	.template_homedir = lp_template_homedir,
diff --git a/source3/param/loadparm_server_role.c b/source3/param/loadparm_server_role.c
deleted file mode 100644
index 7fe4411b54..0000000000
--- a/source3/param/loadparm_server_role.c
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
-   Unix SMB/CIFS implementation.
-   Parameter loading functions
-   Copyright (C) Karl Auer 1993-1998
-
-   Largely re-written by Andrew Tridgell, September 1994
-
-   Copyright (C) Simo Sorce 2001
-   Copyright (C) Alexander Bokovoy 2002
-   Copyright (C) Stefan (metze) Metzmacher 2002
-   Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
-   Copyright (C) Michael Adam 2008
-   Copyright (C) Andrew Bartlett 2010
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-#include "includes.h"
-
-/*******************************************************************
- Set the server type we will announce as via nmbd.
-********************************************************************/
-
-static const struct srv_role_tab {
-	uint32 role;
-	const char *role_str;
-} srv_role_tab [] = {
-	{ ROLE_STANDALONE, "ROLE_STANDALONE" },
-	{ ROLE_DOMAIN_MEMBER, "ROLE_DOMAIN_MEMBER" },
-	{ ROLE_DOMAIN_BDC, "ROLE_DOMAIN_BDC" },
-	{ ROLE_DOMAIN_PDC, "ROLE_DOMAIN_PDC" },
-	{ 0, NULL }
-};
-
-const char* server_role_str(uint32 role)
-{
-	int i = 0;
-	for (i=0; srv_role_tab[i].role_str; i++) {
-		if (role == srv_role_tab[i].role) {
-			return srv_role_tab[i].role_str;
-		}
-	}
-	return NULL;
-}
-
-void set_server_role(void)
-{
-	int server_role = ROLE_STANDALONE;
-
-	switch (lp_security()) {
-		case SEC_SHARE:
-			if (lp_domain_logons())
-				DEBUG(0, ("Server's Role (logon server) conflicts with share-level security\n"));
-			break;
-		case SEC_SERVER:
-			if (lp_domain_logons())
-				DEBUG(0, ("Server's Role (logon server) conflicts with server-level security\n"));
-			/* this used to be considered ROLE_DOMAIN_MEMBER but that's just wrong */
-			server_role = ROLE_STANDALONE;
-			break;
-		case SEC_DOMAIN:
-			if (lp_domain_logons()) {
-				DEBUG(1, ("Server's Role (logon server) NOT ADVISED with domain-level security\n"));
-				server_role = ROLE_DOMAIN_BDC;
-				break;
-			}
-			server_role = ROLE_DOMAIN_MEMBER;
-			break;
-		case SEC_ADS:
-			if (lp_domain_logons()) {
-				server_role = ROLE_DOMAIN_CONTROLLER;
-				break;
-			}
-			server_role = ROLE_DOMAIN_MEMBER;
-			break;
-		case SEC_USER:
-			if (lp_domain_logons()) {
-
-				if (lp_domain_master_true_or_auto()) /* auto or yes */
-					server_role = ROLE_DOMAIN_PDC;
-				else
-					server_role = ROLE_DOMAIN_BDC;
-			}
-			break;
-		default:
-			DEBUG(0, ("Server's Role undefined due to unknown security mode\n"));
-			break;
-	}
-
-	_lp_set_server_role(server_role);
-	DEBUG(10, ("set_server_role: role = %s\n", server_role_str(server_role)));
-}
-