#!/bin/bash

. /usr/share/univention-lib/ucr.sh

is_ucr_false () { # test if UCS variable is "false"
	local value
	value="$(/usr/sbin/univention-config-registry get "$1")"
	case "$(echo -n "$value" | tr [:upper:] [:lower:])" in
		1|yes|on|true|enable|enabled) return 1 ;;
		0|no|off|false|disable|disabled) return 0 ;;
		*) return 2 ;;
	esac
}

eval "$(ucr shell)"

check_samba_processes() {
	local samba_pids
	local comm
	local samba_process_name
	local pid
	local samba_processes
	local min_samba_processes

	if ! [ -x /usr/bin/samba-tool ]; then
		echo "ERROR: /usr/bin/samba-tool is missing"
		return 1
	fi
	samba_pids=$(samba-tool processes 2>/dev/null | tail -n +3 | grep -v winbind_server | awk '{print $2;}' | grep -v '^0$')
	for pid in $samba_pids; do
		comm=$(ps -p "$pid" -o comm=)
		if [ -z "$comm" ]; then
			samba_process_name=$(samba-tool processes --pid="$pid")
			if [ -n "$samba_process_name" ]; then
				echo "ERROR: This Samba process $pid is missing: $samba_process_name"
			fi
		fi
	done

	samba_processes=($(pgrep -f /usr/sbin/samba))
	min_samba_processes=12
	if [ "${#samba_processes[@]}" -lt "$min_samba_processes" ]; then
		echo "WARNING: Total number of /usr/sbin/samba processes lower than $min_samba_processes"
		echo "This might be ok when the Samba release is newer than this check tool."
	fi
}

check_s4_connector_listener_active() {
	if ! is_ucr_false connector/s4/autostart; then
		if is_ucr_true connector/s4/listener/disabled; then
			echo "ERROR: connector/s4/autostart is active but connector/s4/listener/disabled is active too"
		fi
	fi
}

check_for_temporary_udm_sids() {
	local output
	output=$(univention-ldapsearch -xLLL sambasid=S-1-4-* dn sambasid)
	if [ -n "$output" ]; then
		echo "ERROR: The following objects have internal UDM SIDs"
		echo "==================================================="
		echo "$output"
		echo "==================================================="
	fi
}

check_msds_keyversionnumber() {
	local account
	account="$1"
	sam_kvno=$(ldbsearch -H ldapi:///var/lib/samba/private/ldap_priv/ldapi \
		sAMAccountName="$account" msDS-KeyVersionNumber \
		| sed -n 's/^msDS-KeyVersionNumber: //p')
	local_kvno=$(ldbsearch -H /var/lib/samba/private/secrets.ldb \
		sAMAccountName="$account" msDS-KeyVersionNumber \
		| sed -n 's/^msDS-KeyVersionNumber: //p')
	if [ "$sam_kvno" != "$local_kvno" ]; then
		echo "ERROR: The msDS-KeyVersionNumber for $account is not consistent"
		echo "       msDS-KeyVersionNumber in SAM: $sam_kvno"
		echo "       msDS-KeyVersionNumber in secrets.ldb: $local_kvno"
	fi
}

smbclient_check_via_krb5_keytab() {
	local rc
	local hostname
	hostname=$(ucr get hostname)
	kdestroy
	kinit -t /etc/krb5.keytab "${hostname^^}$" || return $?
	smbclient -k -L "$(hostname -f)" >/dev/null 2>&1
	rc=$?
	kdestroy
	return "$rc"
}

check_host_kerberos_smbclient() {
	if ! smbclient_check_via_krb5_keytab; then
		echo "ERROR: Kerberos authentication via krb5.keytab against local SMBD doesn't work"
		check_msds_keyversionnumber "$(hostname)$"
	fi
}

trivial_ddns_update() {
	local rc
	kdestroy
	kinit -t /var/lib/samba/private/dns.keytab "dns-$(hostname)" || return $?
	echo -e "server $(hostname -f)\nprereq yxdomain $(hostname -d)\n" | nsupdate -g
	rc=$?
	kdestroy
	return "$rc"
}

check_ddns_update() {
	if ! trivial_ddns_update; then
		echo "ERROR: DNS update via Kerberos doesn't work on this server"
		check_msds_keyversionnumber "dns-$(hostname)"
	fi
}

dpkg -C

univention-check-join-status

if [ "$server_role" = "memberserver" ]; then
	if [ -x /etc/init.d/samba ]; then
		net ads testjoin
	fi
fi

if [ -n "$samba4_role" ]; then
	wbinfo --ping
	wbinfo --ping-dc
	wbinfo --check-secret
fi

if [ "$server_role" != "${server_role#domaincontroller_}" ]; then
	if [ "$samba4_role" = "DC" ]; then
		check_samba_processes
		check_s4_connector_listener_active
		check_host_kerberos_smbclient
		check_ddns_update
		check_for_temporary_udm_sids
		samba-tool drs showrepl
		/usr/share/univention-samba4/scripts/check_essential_samba4_dns_records.sh
		# samba-tool dbcheck
	fi
fi

## Possibly offer to automatically upload this as encrypted email?
# wget -q "http://download.univention.de/download/univention-support.asc" -O - | gpg --import
# gpg --encrypt --trust-model always -a -r "support@univention.de" <Filename>
