lab-time

#!/usr/bin/env bash
set -euo pipefail

STATE_DIR="/var/lib/lab-time"
STATE_FILE="${STATE_DIR}/state.env"
OVERRIDE_DIR="/etc/systemd/timesyncd.conf.d"
OVERRIDE_FILE="${OVERRIDE_DIR}/90-lab-time.conf"

need_root() {
  if [ "$EUID" -ne 0 ]; then
    echo "Please place this tool into /usr/bin and run with sudo"
    exit 1
  fi
}

print_help() {
  cat <<'EOF'
lab-time: quick time alignment to a DC or member server, with VMware host-sync control and reliable stop

Examples:
  sudo lab-time 10.8.0.160
  sudo lab-time status
  sudo lab-time stop

Notes:
  - Kerberos checks the service host time. Align to the exact host you will talk to.
  - --force stops time daemons before setting the clock so nothing reverts it.
  - On VMware guests, this tool will auto disable VMware host→guest time sync during a session
    and restore it on stop. This prevents the host from snapping your lab time back.
EOF
}

status() {
  echo "Local UTC:  $(date -u +"%a, %d %b %Y %H:%M:%S UTC")"
  echo "Local TZ :  $(date +"%Z %z")"
  echo "NTPSync  :  $(timedatectl show -p NTPSynchronized --value 2>/dev/null || echo unknown)"
  if [ -f "$OVERRIDE_FILE" ]; then
    echo "NTP override: $OVERRIDE_FILE present"
  else
    echo "NTP override: none"
  fi
  vmware_status_brief
}

# ---------- VMware helpers ----------

is_vmware_guest() {
  # returns 0 if VMware detected
  if command -v systemd-detect-virt >/dev/null 2>&1; then
    [ "$(systemd-detect-virt 2>/dev/null || true)" = "vmware" ] && return 0 || return 1
  fi
  # fallback simple DMI check
  if [ -r /sys/class/dmi/id/sys_vendor ] && grep -qi vmware /sys/class/dmi/id/sys_vendor; then
    return 0
  fi
  return 1
}

has_vmware_toolbox() {
  command -v vmware-toolbox-cmd >/dev/null 2>&1
}

vmware_timesync_status_raw() {
  vmware-toolbox-cmd timesync status 2>/dev/null || true
}

vmware_timesync_enabled_q() {
  # returns 0 if enabled, 1 if disabled or unknown
  local out
  out="$(vmware_timesync_status_raw)"
  echo "$out" | grep -qi "Enabled" && return 0
  echo "$out" | grep -qi "Disabled" && return 1
  return 1
}

vmware_disable_timesync() {
  vmware-toolbox-cmd timesync disable >/dev/null 2>&1 || true
}

vmware_enable_timesync() {
  vmware-toolbox-cmd timesync enable >/dev/null 2>&1 || true
}

vmware_status_brief() {
  if is_vmware_guest && has_vmware_toolbox; then
    local out
    out="$(vmware_timesync_status_raw)"
    [ -n "$out" ] && echo "VMware Tools timesync: $out"
  fi
}

# ---------- General helpers ----------

to_epoch_now() { date -u +%s; }
to_epoch_from_string() { date -u -d "$1" +%s; }

print_skew_calc() {
  local label="$1" host_epoch="$2"
  local local_epoch delta
  local_epoch="$(to_epoch_now)"
  delta=$(( local_epoch - host_epoch ))
  printf "%s: local - host = %+ds\n" "$label" "$delta"
}

ldap_current_time() {
  local H="$1" D="${2-}" U="${3-}" P="${4-}" out line
  if ! command -v ldapsearch >/dev/null 2>&1; then return 1; fi
  if [ -n "$U" ] && [ -n "$P" ] && [ -n "$D" ]; then
    out="$(LDAPTLS_REQCERT=never ldapsearch -H "ldap://${H}" -D "${U}@${D}" -w "${P}" -b "" -s base currentTime 2>/dev/null || true)"
  else
    out="$(LDAPTLS_REQCERT=never ldapsearch -x -H "ldap://${H}" -b "" -s base currentTime 2>/dev/null || true)"
  fi
  line="$(echo "$out" | awk -F': ' '/^currentTime:/{print $2; exit}')"
  [ -z "$line" ] && return 1
  local y=${line:0:4} m=${line:4:2} d=${line:6:2} Hh=${line:8:2} Mm=${line:10:2} Ss=${line:12:2}
  echo "${y}-${m}-${d} ${Hh}:${Mm}:${Ss} UTC"
}

smb_srvinfo_time() {
  local H="$1" D="${2-}" U="${3-}" P="${4-}" line timestr
  if ! command -v rpcclient >/dev/null 2>&1; then return 1; fi
  if [ -n "$U" ] && [ -n "$P" ] && [ -n "$D" ]; then
    line="$(rpcclient -U "${U}%${P}" -W "${D}" -c srvinfo "$H" 2>/dev/null | grep -i 'Server time is' || true)"
  else
    line="$(rpcclient -N -c srvinfo "$H" 2>/dev/null | grep -i 'Server time is' || true)"
  fi
  [ -z "$line" ] && return 1
  timestr="$(echo "$line" | sed -E 's/^.*Server time is[[:space:]]+//I')"
  timestr="$(echo "$timestr" | sed -E 's/([0-9]{2}):([0-9]{2}):([0-9]{2})\.[0-9]+/\1:\2:\3/')"
  echo "$timestr"
}

stop_time_daemons() {
  timedatectl set-ntp false >/dev/null 2>&1 || true
  systemctl stop systemd-timesyncd  >/dev/null 2>&1 || true
  systemctl stop chrony             >/dev/null 2>&1 || true
  systemctl stop chronyd            >/dev/null 2>&1 || true
  systemctl stop ntp                >/dev/null 2>&1 || true
  systemctl stop ntpd               >/dev/null 2>&1 || true
}

enable_ntp_to() {
  local NTP="$1"
  mkdir -p "$OVERRIDE_DIR"
  cat > "$OVERRIDE_FILE" <<EOF
[Time]
NTP=${NTP}
FallbackNTP=
EOF
  systemctl daemon-reload || true
  systemctl restart systemd-timesyncd || true
  timedatectl set-ntp true >/dev/null 2>&1 || true
}

remove_ntp_override() {
  rm -f "$OVERRIDE_FILE" || true
  systemctl daemon-reload || true
  systemctl restart systemd-timesyncd || true
}

save_state_once() {
  mkdir -p "$STATE_DIR"
  if [ -f "$STATE_FILE" ]; then
    return 0
  fi
  local prev_time prev_ntp has_override vmware_state vmware_mode
  prev_time="$(date -u +"%a, %d %b %Y %H:%M:%S UTC")"
  prev_ntp="$(timedatectl show -p NTP --value 2>/dev/null || echo unknown)"
  if [ -f "$OVERRIDE_FILE" ]; then has_override="yes"; else has_override="no"; fi

  vmware_state="not_vmware"
  vmware_mode="unknown"
  if is_vmware_guest && has_vmware_toolbox; then
    vmware_state="vmware"
    if vmware_timesync_enabled_q; then vmware_mode="enabled"; else vmware_mode="disabled"; fi
  fi

  cat > "$STATE_FILE" <<EOF
PREV_TIME_UTC='$prev_time'
PREV_NTP='$prev_ntp'
PREV_OVERRIDE='$has_override'
PREV_VMWARE_STATE='$vmware_state'
PREV_VMWARE_TIMESYNC='$vmware_mode'
EOF
}

restore_state() {
  if [ ! -f "$STATE_FILE" ]; then
    echo "No saved state to restore"
    return 1
  fi
  # shellcheck disable=SC1090
  . "$STATE_FILE"

  # Restore VMware timesync if we had it enabled originally
  if [ "${PREV_VMWARE_STATE:-not_vmware}" = "vmware" ] && has_vmware_toolbox; then
    if [ "${PREV_VMWARE_TIMESYNC:-unknown}" = "enabled" ]; then
      echo "Re-enabling VMware host time sync"
      vmware_enable_timesync
    fi
  fi

  # Remove our timesyncd override and restore NTP toggle
  remove_ntp_override
  if [ "$PREV_NTP" = "yes" ] || [ "$PREV_NTP" = "enabled" ] || [ "$PREV_NTP" = "true" ]; then
    timedatectl set-ntp true >/dev/null 2>&1 || true
  else
    timedatectl set-ntp false >/dev/null 2>&1 || true
  fi

  # Restore previous time
  if date -u -s "$PREV_TIME_UTC" >/dev/null 2>&1; then
    hwclock --systohc >/dev/null 2>&1 || true
    echo "Restored previous UTC time: $PREV_TIME_UTC"
  else
    echo "Failed to restore previous time"
  fi

  rm -f "$STATE_FILE" || true
  return 0
}

set_time_to_str() {
  local s="$1" force="$2"
  local before after
  before="$(to_epoch_now)"

  if [ "$force" = "yes" ]; then
    stop_time_daemons
  else
    timedatectl set-ntp false >/dev/null 2>&1 || true
  fi

  if ! date -u -s "$s" >/dev/null 2>&1; then
    echo "date -s failed. Are you in a locked environment"
    return 1
  fi

  after="$(to_epoch_now)"
  if [ "$after" -eq "$before" ]; then
    echo "Clock did not move after date -s. A service may be reverting it"
    return 1
  fi

  hwclock --systohc >/dev/null 2>&1 || true
  return 0
}

try_ntpdate_step() {
  local H="$1" force="$2"
  if ! command -v ntpdate >/dev/null 2>&1; then return 1; fi
  if [ "$force" = "yes" ]; then
    stop_time_daemons
  else
    timedatectl set-ntp false >/dev/null 2>&1 || true
  fi
  ntpdate -u "$H"
}

align_to_host() {
  local H="$1" D="${2-}" U="${3-}" P="${4-}" force="$5"
  local t epoch changed=0

  echo "== Host: $H =="

  # If running in VMware, disable host time sync for the session so the host does not revert our set
  if is_vmware_guest && has_vmware_toolbox; then
    if vmware_timesync_enabled_q; then
      echo "VMware guest detected. Disabling VMware host time sync for this session..."
      vmware_disable_timesync
      echo "VMware Tools timesync: $(vmware_timesync_status_raw)"
    fi
  fi

  # 1) LDAP time
  if t="$(ldap_current_time "$H" "$D" "$U" "$P")"; then
    epoch="$(to_epoch_from_string "$t")"
    print_skew_calc "Skew before (LDAP)" "$epoch"
    if set_time_to_str "$t" "$force"; then
      print_skew_calc "Skew after  (LDAP)" "$epoch"
      changed=1
    fi
  fi

  # 2) SMB time if still not changed
  if [ $changed -eq 0 ]; then
    if t="$(smb_srvinfo_time "$H" "$D" "$U" "$P")"; then
      epoch="$(to_epoch_from_string "$t")"
      print_skew_calc "Skew before (SMB)" "$epoch"
      if set_time_to_str "$t" "$force"; then
        print_skew_calc "Skew after  (SMB)" "$epoch"
        changed=1
      fi
    fi
  fi

  # 3) NTP step
  if [ $changed -eq 0 ]; then
    if try_ntpdate_step "$H" "$force"; then
      echo "Aligned using NTP step"
      changed=1
    fi
  fi

  if [ $changed -eq 1 ]; then
    return 0
  else
    echo "Could not read or set time for $H"
    return 1
  fi
}

enable_ntp_cmd() {
  local host="$1"
  enable_ntp_to "$host"
  status
}

stop_cmd() {
  echo "Restoring previous time, NTP, and VMware sync settings..."
  if restore_state; then
    echo "Restored."
  else
    echo "Nothing to restore. To return to defaults manually:"
    echo "  sudo timedatectl set-ntp true"
    if is_vmware_guest && has_vmware_toolbox; then
      echo "  sudo vmware-toolbox-cmd timesync enable"
    fi
  fi
  status
}

main() {
  need_root
  if [ $# -eq 0 ]; then print_help; exit 1; fi

  case "$1" in
    -h|--help|help) print_help; exit 0 ;;
    status) status; exit 0 ;;
    enable-ntp)
      shift
      [ $# -lt 1 ] && { echo "Usage: sudo lab-time enable-ntp <NTP_HOST>"; exit 1; }
      enable_ntp_cmd "$1"; exit 0
      ;;
    stop)
      stop_cmd; exit 0
      ;;
  esac

  # positional hosts until a flag
  HOSTS=(); FORCE="no"
  while [ $# -gt 0 ] && [[ "$1" != -* ]]; do HOSTS+=("$1"); shift; done

  DOMAIN=""; USER=""; PASS=""
  while [ $# -gt 0 ]; do
    case "$1" in
      -d) DOMAIN="$2"; shift 2 ;;
      -u) USER="$2"; shift 2 ;;
      -p) PASS="$2"; shift 2 ;;
      --force) FORCE="yes"; shift ;;
      *) echo "Unknown option: $1"; print_help; exit 1 ;;
    esac
  done

  if [ ${#HOSTS[@]} -eq 0 ]; then
    echo "Provide at least one host. Example: sudo lab-time FOREST.htb.local"; exit 1
  fi

  # Save original state only once per session so stop goes back to real time and VMware sync state
  save_state_once

  echo "Local before: $(date -u +"%a, %d %b %Y %H:%M:%S UTC")"
  for h in "${HOSTS[@]}"; do
    if align_to_host "$h" "$DOMAIN" "$USER" "$PASS" "$FORCE"; then
      echo "Aligned to $h"
      echo "Local after : $(date -u +"%a, %d %b %Y %H:%M:%S UTC")"
      status
      echo "Tip: keep NTP off during a lab if a daemon is fighting you. Re-enable later with:"
      echo "     sudo lab-time enable-ntp ${HOSTS[0]}"
      exit 0
    fi
  done

  echo "Failed to align to any host provided"
  exit 1
}

main "$@"