# Basic expect script for Kerberos tests.

# This is a DejaGnu test script.

# Written by Ian Lance Taylor, Cygnus Support, <ian@cygnus.com>.

# This script is automatically run by DejaGnu before running any of

# the Kerberos test scripts.

# This file provides several functions which deal with a local

# Kerberos database.  We have to do this such that we don't interfere

# with any existing Kerberos database.  We will create all the files

# in the directory $tmppwd, which will have been created by the

# testsuite default script.  We will use $REALMNAME as our Kerberos

# realm name, defaulting to KRBTEST.COM.

set timeout 100

set stty_init {erase \^h kill \^u}

set env(TERM) dumb

if { [string length $VALGRIND] } {

    rename spawn valgrind_aux_spawn

    proc spawn { args } {

	global VALGRIND

	upvar 1 spawn_id spawn_id

	set newargs {}

	set inflags 1

	set eatnext 0

	foreach arg $args {

	    if { $arg == "-ignore" \

		     || $arg == "-open" \

		     || $arg == "-leaveopen" } {

		lappend newargs $arg

		set eatnext 1

		continue

	    }

	    if [string match "-*" $arg] {

		lappend newargs $arg

		continue

	    }

	    if { $eatnext } {

		set eatnext 0

		lappend newargs $arg

		continue

	    }

	    if { $inflags } {

		set inflags 0

		# Only run valgrind for local programs, not

		# system ones.

#&&![string match "/bin/sh" $arg] sh is used to start kadmind!

		if [string match "/" [string index $arg 0]]&&![string match "/bin/ls" $arg]&&![regexp {/kshd$} $arg] {

		    set newargs [concat $newargs $VALGRIND]

		}

	    }

	    lappend newargs $arg

	}

	set pid [eval valgrind_aux_spawn $newargs]

	return $pid

    }

}

# Hack around Solaris 9 kernel race condition that causes last output

# from a pty to get dropped.

if { $PRIOCNTL_HACK } {

    catch {exec priocntl -s -c FX -m 30 -p 30 -i pid [getpid]}

    rename spawn oldspawn

    proc spawn { args } {

	upvar 1 spawn_id spawn_id

	set newargs {}

	set inflags 1

	set eatnext 0

	foreach arg $args {

	    if { $arg == "-ignore" \

		     || $arg == "-open" \

		     || $arg == "-leaveopen" } {

		lappend newargs $arg

		set eatnext 1

		continue

	    }

	    if [string match "-*" $arg] {

		lappend newargs $arg

		continue

	    }

	    if { $eatnext } {

		set eatnext 0

		lappend newargs $arg

		continue

	    }

	    if { $inflags } {

		set inflags 0

		set newargs [concat $newargs {priocntl -e -c FX -p 0}]

	    }

	    lappend newargs $arg

	}

	set pid [eval oldspawn $newargs]

	return $pid

    }

}

# The names of the individual passes must be unique; lots of things

# depend on it.  The PASSES variable may not contain comments; only

# small pieces get evaluated, so comments will do strange things.

# Most of the purpose of using multiple passes is to exercise the

# dependency of various bugs on configuration file settings,

# particularly with regards to encryption types.

set passes {

    {

	aes-only

	mode=udp

	{supported_enctypes=aes256-cts-hmac-sha1-96:normal}

	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96}

	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96}

	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96}

	{allow_weak_crypto(kdc)=false}

	{allow_weak_crypto(replica)=false}

	{allow_weak_crypto(client)=false}

	{allow_weak_crypto(server)=false}

	{master_key_type=aes256-cts-hmac-sha1-96}

	{dummy=[verbose -log "AES enctypes"]}

    }

    {

	aes-sha2-only

	mode=udp

	{supported_enctypes=aes256-sha2:normal}

	{permitted_enctypes(kdc)=aes256-sha2}

	{permitted_enctypes(replica)=aes256-sha2}

	{permitted_enctypes(client)=aes256-sha2}

	{permitted_enctypes(server)=aes256-sha2}

	{allow_weak_crypto(kdc)=false}

	{allow_weak_crypto(replica)=false}

	{allow_weak_crypto(client)=false}

	{allow_weak_crypto(server)=false}

	{master_key_type=aes256-sha2}

	{dummy=[verbose -log "aes256-sha2 enctype"]}

    }

    {

	camellia-only

	mode=udp

	{supported_enctypes=camellia256-cts:normal}

	{permitted_enctypes(kdc)=camellia256-cts}

	{permitted_enctypes(replica)=camellia256-cts}

	{permitted_enctypes(client)=camellia256-cts}

	{permitted_enctypes(server)=camellia256-cts}

	{allow_weak_crypto(kdc)=false}

	{allow_weak_crypto(replica)=false}

	{allow_weak_crypto(client)=false}

	{allow_weak_crypto(server)=false}

	{master_key_type=camellia256-cts}

	{dummy=[verbose -log "Camellia-256 enctype"]}

    }

    {

	all-enctypes

	mode=udp

	{allow_weak_crypto(kdc)=false}

	{allow_weak_crypto(replica)=false}

	{allow_weak_crypto(client)=false}

	{allow_weak_crypto(server)=false}

	{dummy=[verbose -log "all default enctypes"]}

    }

}

# This shouldn't be necessary on dejagnu-1.4 and later, but 1.3 seems

# to need it because its runtest.exp doesn't deal with PASS at all.

if [info exists PASS] {

    foreach pass $passes {

	if { [lsearch -exact $PASS [lindex $pass 0]] >= 0 } {

	    lappend MULTIPASS $pass

	}

    }

} else {

    set MULTIPASS $passes

}

set last_passname_conf ""

set last_passname_db ""

# We do everything in a temporary directory.

if ![info exists TMPDIR] {

    set tmppwd "[pwd]/tmpdir"

    if ![file isdirectory $tmppwd] {

	catch "exec mkdir $tmppwd" status

    }

} else {

    set tmppwd $TMPDIR

}

verbose "tmppwd=$tmppwd"

# On Ultrix, use /bin/sh5 in preference to /bin/sh.

if ![info exists BINSH] {

    if [file exists /bin/sh5] {

	set BINSH /bin/sh5

    } else {

	set BINSH /bin/sh

    }

}

# For security, we must not use generally known passwords.  This is

# because some of the tests may be run as root.  If the passwords were

# generally know, then somebody could work out the appropriate

# Kerberos ticket to use, and come in when, say, the telnetd daemon

# was being tested by root.  The window for doing this is very very

# small, so the password does not have to be perfect, it just can't be

# constant.

if ![info exists KEY] {

    catch {exec $BINSH -c "echo $$"} KEY

    verbose "KEY is $KEY"

    set keyfile [open $tmppwd/KEY w]

    puts $keyfile "$KEY"

    close $keyfile

}

# Clear away any files left over from a previous run.

# We can't use them now because we don't know the right KEY.

# krb5.conf might change if running tests on another host

file delete $tmppwd/krb5.conf $tmppwd/kdc.conf $tmppwd/replica.conf \

    $tmppwd/krb5.client.conf $tmppwd/krb5.server.conf \

    $tmppwd/krb5.kdc.conf $tmppwd/krb5.replica.conf

proc delete_db {} {

    global tmppwd

    # Master and replica db files

    file delete $tmppwd/kdc-db $tmppwd/kdc-db.ok $tmppwd/kdc-db.kadm5 \

	$tmppwd/kdc-db.kadm5.lock $tmppwd/kdc-db.mdb $tmppwd/kdc-db.mdb-lock \

	$tmppwd/kdc-db.lockout.mdb $tmppwd/kdc-db.lockout.mdb-lock \

	$tmppwd/kdc-db.ulog \

	$tmppwd/replica-db $tmppwd/replica-db.ok $tmppwd/replica-db.kadm5 $tmppwd/replica-db.kadm5.lock \

	$tmppwd/replica-db~ $tmppwd/replica-db~.ok $tmppwd/replica-db~.kadm5 $tmppwd/replica-db~.kadm5.lock

    # Creating a new database invalidates the keytab and ccache.

    file delete $tmppwd/keytab $tmppwd/tkt

}

delete_db

# Put the installed kerberos directories on PATH.

# This needs to be fixed for V5.

# set env(PATH) $env(PATH):/usr/kerberos/bin:/usr/kerberos/etc

# verbose "PATH=$env(PATH)"

# Some of the tests expect $env(USER) to be set.

if ![info exists env(USER)] {

    if [info exists env(LOGNAME)] {

	set env(USER) $env(LOGNAME)

    } else {

	if [info exists logname] {

	    set env(USER) $logname

	} else {

	    catch "exec whoami" env(USER)

	}

    }

}

# set the realm. The user can override this on the runtest line.

if ![info exists REALMNAME] {

    set REALMNAME "KRBTEST.COM"

}

verbose "Test realm is $REALMNAME"

# Find some programs we need.  We use the binaries from the build tree

# if they exist.  If they do not, then they must be in PATH.  We

# expect $objdir to be ...tests/dejagnu.

foreach i {

    {KDB5_UTIL $objdir/../../kadmin/dbutil/kdb5_util}

    {KRB5KDC $objdir/../../kdc/krb5kdc}

    {KADMIND $objdir/../../kadmin/server/kadmind}

    {KADMIN $objdir/../../kadmin/cli/kadmin}

    {KADMIN_LOCAL $objdir/../../kadmin/cli/kadmin.local}

    {KINIT $objdir/../../clients/kinit/kinit}

    {KTUTIL $objdir/../../kadmin/ktutil/ktutil}

    {KLIST $objdir/../../clients/klist/klist}

    {KDESTROY $objdir/../../clients/kdestroy/kdestroy}

    {RESOLVE $objdir/../resolve/resolve}

    {T_INETD $objdir/t_inetd}

    {KPROPLOG $objdir/../../kprop/kproplog}

    {KPASSWD $objdir/../../clients/kpasswd/kpasswd}

    {KPROPD $objdir/../../kprop/kpropd}

    {KPROP $objdir/../../kprop/kprop}

} {

    set varname [lindex $i 0]

    if ![info exists $varname] {

	eval set varval [lindex $i 1]

	set varval [findfile $varval]

	set $varname $varval

	verbose "$varname=$varval"

    } {

	eval set varval \$$varname

	verbose "$varname already set to $varval"

    }

}

verbose "setting up onexit handler (old handler=[exit -onexit])"

exit -onexit [concat {

    verbose "calling stop_kerberos_daemons (onexit handler)"

    stop_kerberos_daemons;

} [exit -onexit]]

# run_once

# Many tests are independent of the actual enctypes used, which is

# what our passes are (currently) all about.  Use this to prevent

# multiple invocations.  If a test depends on, say, the master key

# type but nothing else, you could also use the master key type in the

# tag name, and avoid redundant tests in additional passes using the

# same master key type.

proc run_once { tag body } {

    global run_once_tags

    if ![info exists run_once_tags($tag)] {

	set run_once_tags($tag) 1

	uplevel 1 $body

    }

}

# check_exit_status

# Check the exit status of a spawned program (using the caller's value

# of spawn_id).  Returns 1 if the program succeeded, 0 if it failed.

proc check_exit_status { testname } {

    upvar 1 spawn_id spawn_id

    verbose "about to wait ($testname)"

    set status_list [wait -i $spawn_id]

    verbose "wait -i $spawn_id returned $status_list ($testname)"

    catch "close -i $spawn_id"

    if { [lindex $status_list 2] != 0 || [lindex $status_list 3] != 0 } {

	verbose -log "exit status: $status_list"

	fail "$testname"

	return 0

    } else {

	return 1

    }

}

#

# ENVSTACK

#

# These procedures implement an environment variable stack.  They use

# the global variable $envvars_tosave for the purpose of identifying

# which environment variables to save.  They also track which ones are

# unset at any particular point.  The stack pointer is $envstackp,

# which is an integer.  The arrays $envstack$envstackp and

# $unenvstack$envstackp store respectively the set of old environment

# variables/values pushed onto the stack and the set of old unset

# environment variables for a given value of $envstackp.

# Changing the value of $envvars_tosave after performing the first

# push operation may result in strangeness.

#

# envstack_push

#

# Push set of current environment variables.

#

proc envstack_push { } {

    global env

    global envvars_tosave

    global envstackp

    global envstack$envstackp

    global unenvstack$envstackp

    verbose "envstack_push: starting, sp=$envstackp"

    foreach i $envvars_tosave {

	if [info exists env($i)] {

	    verbose "envstack_push: saving $i=$env($i)"

	    set envstack${envstackp}($i) $env($i)

	} {

	    verbose "envstack_push: marking $i as unset"

	    set unenvstack${envstackp}($i) unset

	}

    }

    incr envstackp

    verbose "envstack_push: exiting, sp=$envstackp"

}

#

# envstack_pop

#

# Pop set of current environment variables.

#

proc envstack_pop { } {

    global env

    global envstackp

    verbose "envstack_pop: starting, sp=$envstackp"

    incr envstackp -1

    global envstack$envstackp	# YUCK!!! no obvious better way though...

    global unenvstack$envstackp

    if {$envstackp < 0} {

	perror "envstack_pop: stack underflow!"

	return

    }

    if [info exists envstack$envstackp] {

	foreach i [array names envstack$envstackp] {

	    if [info exists env($i)] {

		verbose "envstack_pop: $i was $env($i)"

	    }

	    eval set env($i) \$envstack${envstackp}($i)

	    verbose "envstack_pop: restored $i to $env($i)"

	}

	unset envstack$envstackp

    }

    if [info exists unenvstack$envstackp] {

	foreach i [array names unenvstack$envstackp] {

	    if [info exists env($i)] {

		verbose "envstack_pop: $i was $env($i)"

		unset env($i)

		verbose "envstack_pop: $i unset"

	    } {

		verbose "envstack_pop: ignoring already unset $i"

	    }

	}

	unset unenvstack$envstackp

    }

    verbose "envstack_pop: exiting, sp=$envstackp"

}

#

# Initialize the envstack

#

set envvars_tosave {

    KRB5_CONFIG KRB5CCNAME KRB5_CLIENT_KTNAME KRB5RCACHEDIR KRB5_KDC_PROFILE

    GSS_MECH_CONFIG

}

set krb5_init_vars [list ]

# XXX -- fix me later!

foreach i $runvarlist {

    verbose "processing $i"

    if {[regexp "^(\[^=\]*)=(.*)" $i foo evar evalue]} {

	verbose "adding $evar to savelist"

	lappend envvars_tosave $evar

	verbose "savelist $envvars_tosave"

	lappend krb5_init_vars $i

    }

    # Make sure we don't get confused by translated messages

    # or localized times.

    lappend envvars_tosave "LC_ALL"

    lappend krb5_init_vars "LC_ALL=C"

}

set envstackp 0

envstack_push

# setup_runtime_flags

# Sets the proper flags for shared libraries. 

# Configuration is through a site.exp and the runvarlist variable

# Returns 1 if variables were already set, otherwise 0

proc setup_runtime_env { } {

    global env

    global krb5_init_vars

    # Set the variables

    foreach i $krb5_init_vars {

	regexp "^(\[^=\]*)=(.*)" $i foo evar evalue

	set env($evar) "$evalue"

	verbose "$evar=$evalue"

    }

    return 0

}

# get_hostname

# This procedure sets the global variable hostname to the local

# hostname as seen by krb5_sname_to_principal.  Returns 1 on success,

# 0 on failure.

proc get_hostname { } {

    global RESOLVE

    global hostname

    global tmppwd

    if {[info exists hostname]} {

	return 1

    }

    envstack_push

    setup_runtime_env

    catch "exec $RESOLVE -q >$tmppwd/hostname" exec_output

    envstack_pop

    if ![string match "" $exec_output] {

	verbose -log $exec_output

	perror "can't get hostname"

	return 0

    }

    set file [open $tmppwd/hostname r]

    if { [ gets $file hostname ] == -1 } {

	perror "no output from hostname"

	return 0

    }

    close $file

    file delete $tmppwd/hostname

    set hostname [string tolower $hostname]

    return 1

}

# modify_principal name options...

proc modify_principal { name args } {

    global KADMIN_LOCAL

    global REALMNAME

    envstack_push

    setup_kerberos_env kdc

    spawn $KADMIN_LOCAL -r $REALMNAME

    envstack_pop

    expect_after {

	eof {

	    fail "modprinc (kadmin.local)"

	    return 0

	}

	timeout {

	    fail "modprinc (kadmin.local)"

	    return 0

	}

    }

    expect "kadmin.local: "

    send "modprinc $args $name\r"

    expect -re "modprinc \[^\n\r\]* $name"

    expect -re "Principal .* modified."

    send "quit\r"

    expect eof

    catch expect_after

    if ![check_exit_status "kadmin.local modprinc"] {

	perror "kadmin.local modprinc exited abnormally"

    }

    return 1

}

# kdc listens on +0..+3, depending whether we're testing reachable or not

# client tries +1 and +6

# kadmind +4

# kpasswd +5

# (nothing) +6

# application servers (krlogind, telnetd, krshd, ftpd, etc) +8

# iprop +9 (if enabled)

# kpropd +10

if [info exists PORTBASE] {

    set portbase $PORTBASE

} else {

    set portbase 3085

}

set ulog 0

# setup_kerberos_files

# This procedure will create some Kerberos files which must be created

# manually before trying to run any Kerberos programs.  Returns 1 on

# success, 0 on failure.

proc setup_kerberos_files { } {

    global REALMNAME

    global hostname

    global tmppwd

    global supported_enctypes

    global last_passname_conf

    global multipass_name

    global master_key_type

    global mode

    global portbase

    global ulog

    if ![get_hostname] { 

	return 0

    }

    setup_krb5_conf client

    setup_krb5_conf server

    setup_krb5_conf kdc

    setup_krb5_conf replica

    # Create a kdc.conf file.

    if { ![file exists $tmppwd/kdc.conf] \

	    || $last_passname_conf != $multipass_name } {

	set conffile [open $tmppwd/kdc.conf w]

	puts $conffile "\[kdcdefaults\]"

	puts $conffile "	kdc_listen = $portbase,[expr 1 + $portbase],[expr 2 + $portbase]"

	puts $conffile "	kdc_tcp_listen = $portbase,[expr 1 + $portbase],[expr 2 + $portbase]"

	puts $conffile ""

	puts $conffile "\[realms\]"

	puts $conffile "	$REALMNAME = \{"

	# Testing with a colon in the name exercises default handling

	# for pathnames.

	puts $conffile "		key_stash_file = $tmppwd/stash:foo"

	puts $conffile "		acl_file = $tmppwd/acl"

	puts $conffile "		kadmind_port = [expr 4 + $portbase]"

	puts $conffile "		kpasswd_port = [expr 5 + $portbase]"

	puts $conffile "		max_life = 1:00:00"

	puts $conffile "		max_renewable_life = 3:00:00"

	if [info exists master_key_type] {

	    puts $conffile "		master_key_type = $master_key_type"

	}

	puts $conffile "		master_key_name = master/key"

	if [info exists supported_enctypes] {

	    puts $conffile "		supported_enctypes = $supported_enctypes"

	}

	if { $mode == "tcp" } {

	    puts $conffile "		kdc_listen = [expr 3 + $portbase]"

	    puts $conffile "		kdc_tcp_listen = [expr 1 + $portbase],[expr 3 + $portbase]"

	} else {

	    puts $conffile "		kdc_listen = [expr 1 + $portbase]"

	    puts $conffile "		kdc_tcp_listen = [expr 3 + $portbase]"

	}

	puts $conffile "		default_principal_expiration = 2037.12.31.23.59.59"

	puts $conffile "		default_principal_flags = -postdateable forwardable"

	puts $conffile "		dict_file = $tmppwd/dictfile"

	if { $ulog != 0 } {

	    puts $conffile "		iprop_enable = true"

	    puts $conffile "		iprop_port = [expr 9 + $portbase]"

	    puts $conffile "		iprop_logfile = $tmppwd/db.ulog"

	} else {

	    puts $conffile "# no ulog"

	}

	puts $conffile "	\}"

	puts $conffile ""

	close $conffile

    }

    # Create a config file for the replica KDC (kpropd only, no normal

    # KDC processes).

    if { ![file exists $tmppwd/replica.conf] \

	    || $last_passname_conf != $multipass_name } {

	set conffile [open $tmppwd/replica.conf w]

	puts $conffile "\[kdcdefaults\]"

	puts $conffile "	kdc_listen = $portbase,[expr 1 + $portbase],[expr 2 + $portbase]"

	puts $conffile "	kdc_tcp_listen = $portbase,[expr 1 + $portbase],[expr 2 + $portbase]"

	puts $conffile ""

	puts $conffile "\[realms\]"

	puts $conffile "	$REALMNAME = \{"

	# Testing with a colon in the name exercises default handling

	# for pathnames.

	puts $conffile "		key_stash_file = $tmppwd/replica-stash"

	puts $conffile "		acl_file = $tmppwd/replica-acl"

	puts $conffile "		kadmind_port = [expr 4 + $portbase]"

	puts $conffile "		kpasswd_port = [expr 5 + $portbase]"

	puts $conffile "		max_life = 1:00:00"

	puts $conffile "		max_renewable_life = 3:00:00"

	if [info exists master_key_type] {

	    puts $conffile "		master_key_type = $master_key_type"

	}

	puts $conffile "		master_key_name = master/key"

	if [info exists supported_enctypes] {

	    puts $conffile "		supported_enctypes = $supported_enctypes"

	}

	if { $mode == "tcp" } {

	    puts $conffile "		kdc_listen = [expr 3 + $portbase]"

	    puts $conffile "		kdc_tcp_listen = [expr 1 + $portbase],[expr 3 + $portbase]"

	} else {

	    puts $conffile "		kdc_listen = [expr 1 + $portbase]"

	    puts $conffile "		kdc_tcp_listen = [expr 3 + $portbase]"

	}

	puts $conffile "		default_principal_expiration = 2037.12.31.23.59.59"

	puts $conffile "		default_principal_flags = -postdateable forwardable"

	puts $conffile "		dict_file = $tmppwd/dictfile"

	if { $ulog != 0 } {

	    puts $conffile "		iprop_enable = true"

	    puts $conffile "		iprop_port = [expr 9 + $portbase]"

	    puts $conffile "		iprop_logfile = $tmppwd/replica-db.ulog"

	} else {

	    puts $conffile "# no ulog"

	}

	puts $conffile "	\}"

	puts $conffile ""

	close $conffile

    }

    # Create ACL file.

    set aclfile [open $tmppwd/acl w]

    puts $aclfile "krbtest/admin@$REALMNAME *"

    puts $aclfile "kiprop/$hostname@$REALMNAME p"

    close $aclfile

    # Create dictfile file.

    if ![file exists $tmppwd/dictfile] {

	set dictfile [open $tmppwd/dictfile w]

	puts $dictfile "weak_password"

	close $dictfile

    }

    set last_passname_conf $multipass_name

    return 1

}

proc reset_kerberos_files { } {

    global tmppwd

    file delete $tmppwd/kdc.conf $tmppwd/replica.conf \

	$tmppwd/krb5.client.conf $tmppwd/krb5.server.conf \

	$tmppwd/krb5.kdc.conf

    setup_kerberos_files

}

proc setup_krb5_conf { {type client} } {

    global tmppwd

    global hostname

    global REALMNAME

    global last_passname_conf

    global multipass_name

    global default_tgs_enctypes

    global default_tkt_enctypes

    global permitted_enctypes

    global allow_weak_crypto

    global mode

    global portbase

    global srcdir

    global env

    set pkinit_certs [findfile "[pwd]/$srcdir/pkinit-certs" "[pwd]/$srcdir/pkinit-certs" "$srcdir/pkinit-certs"]

    # Create a krb5.conf file.

    if { ![file exists $tmppwd/krb5.$type.conf] \

	    || $last_passname_conf != $multipass_name } {

	set conffile [open $tmppwd/krb5.$type.conf w]

	puts $conffile "\[libdefaults\]"

	puts $conffile "	default_realm = $REALMNAME"

	puts $conffile "	dns_lookup_kdc = false"

	if [info exists allow_weak_crypto($type)] {

	    puts $conffile "	allow_weak_crypto = $allow_weak_crypto($type)"

	} else {

	    puts $conffile "	allow_weak_crypto = true"

	}

	puts $conffile "	pkinit_anchors = FILE:$pkinit_certs/ca.pem"

	if [info exists default_tgs_enctypes($type)] {

	    puts $conffile \

		    "	default_tgs_enctypes = $default_tgs_enctypes($type)"

	}

	if [info exists default_tkt_enctypes($type)] {

	    puts $conffile \

		    "	default_tkt_enctypes = $default_tkt_enctypes($type)"

	}

	if [info exists permitted_enctypes($type)] {

	    puts $conffile \

		    "	permitted_enctypes = $permitted_enctypes($type)"

	}

	if { $mode == "tcp" } {

	    puts $conffile "	udp_preference_limit = 1"

	}

	puts $conffile "	plugin_base_dir = $tmppwd/../../../plugins"

	puts $conffile ""

	puts $conffile "\[realms\]"

	puts $conffile "	$REALMNAME = \{"

	# There's probably nothing listening here.  It would be a good

	# test for the handling of a non-responsive KDC address.  However,

	# on some systems, like Tru64, we often wind up with the client's

	# socket bound to this address, causing our request to appear in

	# our incoming queue as if it were a response, which causes test

	# failures.  If we were running the client and KDC on different

	# hosts, this would be okay....

	#puts $conffile "		kdc = $hostname:[expr 6 + $portbase]"

	puts $conffile "		pkinit_identity = FILE:$pkinit_certs/kdc.pem,$pkinit_certs/privkey.pem"

	puts $conffile "		pkinit_anchors = FILE:$pkinit_certs/ca.pem"

	puts $conffile "		kdc = $hostname:[expr 1 + $portbase]"

	puts $conffile "		admin_server = $hostname:[expr 4 + $portbase]"

	puts $conffile "		kpasswd_server = $hostname:[expr 5 + $portbase]"

	puts $conffile "		database_module = db"

	puts $conffile "	\}"

	puts $conffile ""

	puts $conffile "\[domain_realm\]"

	puts $conffile "	$hostname = $REALMNAME"

	puts $conffile ""

	puts $conffile "\[logging\]"

	puts $conffile "	admin_server = FILE:$tmppwd/kadmind5.log"

	puts $conffile "	kdc = FILE:$tmppwd/kdc.log"

	puts $conffile "	default = FILE:$tmppwd/others.log"

	puts $conffile ""

	puts $conffile "\[dbmodules\]"

	puts $conffile "	db_module_dir = $tmppwd/../../../plugins/kdb"

	puts $conffile "	db = {"

	if [info exists env(K5TEST_LMDB)] {

	    puts $conffile "		db_library = klmdb"

	    puts $conffile "		nosync = true"

	} else {

	    puts $conffile "		db_library = db2"

	}

	puts $conffile "		database_name = $tmppwd/$type-db"

	puts $conffile "	}"

	close $conffile

    }

}

# Save the original values of the environment variables we are going

# to muck with.

# XXX deal with envstack later.

if [info exists env(KRB5_CONFIG)] {

    set orig_krb5_conf $env(KRB5_CONFIG)

} else {

    catch "unset orig_krb5_config"

}

if [info exists env(KRB5CCNAME)] {

    set orig_krb5ccname $env(KRB5CCNAME)

} else {

    catch "unset orig_krb5ccname"

}

if [info exists env(KRB5_CLIENT_KTNAME)] {

    set orig_krb5clientktname $env(KRB5_CLIENT_KTNAME)

} else {

    catch "unset orig_krb5clientktname"

}

if [ info exists env(KRB5RCACHEDIR)] {

    set orig_krb5rcachedir $env(KRB5RCACHEDIR)

} else {

    catch "unset orig_krb5rcachedir"

}

if [ info exists env(GSS_MECH_CONFIG)] {

    set orig_gss_mech_config $env(GSS_MECH_CONFIG)

} else {

    catch "unset orig_gss_mech_config"

}

# setup_kerberos_env

# Set the environment variables needed to run Kerberos programs.

proc setup_kerberos_env { {type client} } {

    global REALMNAME

    global env

    global tmppwd

    global hostname

    global krb5_init_vars

    global portbase

    # Set the environment variable KRB5_CONFIG to point to our krb5.conf file.

    # All the Kerberos tools check KRB5_CONFIG.

    # Actually, V5 doesn't currently use this.

    set env(KRB5_CONFIG) $tmppwd/krb5.$type.conf

    verbose "KRB5_CONFIG=$env(KRB5_CONFIG)"

    # Direct the Kerberos programs at a local ticket file.

    set env(KRB5CCNAME) $tmppwd/tkt

    verbose "KRB5CCNAME=$env(KRB5CCNAME)"

    # Direct the Kerberos programs at a local client keytab.

    set env(KRB5_CLIENT_KTNAME) $tmppwd/client_keytab

    verbose "KRB5_CLIENT_KTNAME=$env(KRB5_CLIENT_KTNAME)"

    # Direct the Kerberos server at a cache file stored in the

    # temporary directory.

    set env(KRB5RCACHEDIR) $tmppwd

    verbose "KRB5RCACHEDIR=$env(KRB5RCACHEDIR)"

    # Direct the GSS library at a nonexistent file in the temporary

    # directory, to avoid interference from system configuration.

    set env(GSS_MECH_CONFIG) $tmppwd/mech.conf

    verbose "GSS_MECH_CONFIG=$env(GSS_MECH_CONFIG)"

    # Get the run time environment variables... (including LD_LIBRARY_PATH)

    setup_runtime_env

    # Set our kdc config file, if needed.

    switch $type {

	client	-

	server	{ catch {unset env(KRB5_KDC_PROFILE)} }

	kdc	{ set env(KRB5_KDC_PROFILE) $tmppwd/kdc.conf }

	replica	{ set env(KRB5_KDC_PROFILE) $tmppwd/replica.conf }

	default	{ error "unknown config file type $type" }

    }

    if [info exists env(KRB5_KDC_PROFILE)] {

	verbose "KRB5_KDC_PROFILE=$env(KRB5_KDC_PROFILE)"

    }

    # Create an environment setup script.  (For convenience)

    if ![file exists $tmppwd/$type-env.sh] {

	set envfile [open $tmppwd/$type-env.sh w]

	puts $envfile "KRB5_CONFIG=$env(KRB5_CONFIG)"

	puts $envfile "KRB5CCNAME=$env(KRB5CCNAME)"

	puts $envfile "KRB5_CLIENT_KTNAME=$env(KRB5_CLIENT_KTNAME)"

	puts $envfile "KRB5RCACHEDIR=$env(KRB5RCACHEDIR)"

	puts $envfile "GSS_MECH_CONFIG=$env(GSS_MECH_CONFIG)"

	if [info exists env(KRB5_KDC_PROFILE)] {

	    puts $envfile "KRB5_KDC_PROFILE=$env(KRB5_KDC_PROFILE)"

	} else {

	    puts $envfile "unset KRB5_KDC_PROFILE"

	}

	puts $envfile "export KRB5_CONFIG KRB5CCNAME KRB5RCACHEDIR"

	puts $envfile "export KRB5_KDC_PROFILE KRB5_CLIENT_KTNAME"

	puts $envfile "export GSS_MECH_CONFIG"

	foreach i $krb5_init_vars {

		regexp "^(\[^=\]*)=(.*)" $i foo evar evalue