Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

9 files changed, 2290 insertions, 0 deletions

diff --git a/source4/torture/local/dbspeed.c b/source4/torture/local/dbspeed.c
new file mode 100644
index 0000000..9452d6a
--- /dev/null
+++ b/source4/torture/local/dbspeed.c
@@ -0,0 +1,268 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   local test for tdb/ldb speed
+
+   Copyright (C) Andrew Tridgell 2004
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "system/filesys.h"
+#include <tdb.h>
+#include <ldb.h>
+#include <ldb_errors.h>
+#include "ldb_wrap.h"
+#include "lib/tdb_wrap/tdb_wrap.h"
+#include "torture/smbtorture.h"
+#include "torture/local/proto.h"
+#include "param/param.h"
+
+float tdb_speed;
+
+static bool tdb_add_record(struct tdb_wrap *tdbw, const char *p1,
+			   const char *p2, int i)
+{
+	TDB_DATA key, data;
+	int ret;
+
+	key.dptr = (uint8_t *)talloc_asprintf(tdbw, "%s%u", p1, i);
+	key.dsize = strlen((char *)key.dptr)+1;
+	data.dptr = (uint8_t *)talloc_asprintf(tdbw, "%s%u", p2, i+10000);
+	data.dsize = strlen((char *)data.dptr)+1;
+
+	ret = tdb_store(tdbw->tdb, key, data, TDB_INSERT);
+
+	talloc_free(key.dptr);
+	talloc_free(data.dptr);
+	return ret == 0;
+}
+
+/*
+  test tdb speed
+*/
+static bool test_tdb_speed(struct torture_context *torture, const void *_data)
+{
+	struct timeval tv;
+	struct tdb_wrap *tdbw;
+	int timelimit = torture_setting_int(torture, "timelimit", 10);
+	int i, count;
+	TALLOC_CTX *tmp_ctx = talloc_new(torture);
+
+	unlink("test.tdb");
+
+	torture_comment(torture, "Testing tdb speed for sidmap\n");
+
+	tdbw = tdb_wrap_open(tmp_ctx, "test.tdb", 10000,
+			     lpcfg_tdb_flags(torture->lp_ctx, 0),
+			     O_RDWR|O_CREAT|O_TRUNC, 0600);
+	if (!tdbw) {
+		torture_result(torture, TORTURE_FAIL, "Failed to open test.tdb");
+		goto failed;
+	}
+
+	torture_comment(torture, "Adding %d SID records\n", torture_entries);
+
+	for (i=0;i<torture_entries;i++) {
+		if (!tdb_add_record(tdbw, 
+				    "S-1-5-21-53173311-3623041448-2049097239-",
+				    "UID ", i)) {
+			torture_result(torture, TORTURE_FAIL, "Failed to add SID %d!", i);
+			goto failed;
+		}
+		if (!tdb_add_record(tdbw, 
+				    "UID ",
+				    "S-1-5-21-53173311-3623041448-2049097239-", i)) {
+			torture_result(torture, TORTURE_FAIL, "Failed to add UID %d!", i);
+			goto failed;
+		}
+	}
+
+	torture_comment(torture, "Testing for %d seconds\n", timelimit);
+
+	tv = timeval_current();
+
+	for (count=0;timeval_elapsed(&tv) < timelimit;count++) {
+		TDB_DATA key, data;
+		i = random() % torture_entries;
+		key.dptr = (uint8_t *)talloc_asprintf(tmp_ctx, "S-1-5-21-53173311-3623041448-2049097239-%u", i);
+		key.dsize = strlen((char *)key.dptr)+1;
+		data = tdb_fetch(tdbw->tdb, key);
+		talloc_free(key.dptr);
+		if (data.dptr == NULL) {
+			torture_result(torture, TORTURE_FAIL, "Failed to find SID %d!", i);
+			goto failed;
+		}
+		free(data.dptr);
+		key.dptr = (uint8_t *)talloc_asprintf(tmp_ctx, "UID %u", i);
+		key.dsize = strlen((char *)key.dptr)+1;
+		data = tdb_fetch(tdbw->tdb, key);
+		talloc_free(key.dptr);
+		if (data.dptr == NULL) {
+			torture_result(torture, TORTURE_FAIL, "Failed to find UID %d!", i);
+			goto failed;
+		}
+		free(data.dptr);
+	}
+
+	tdb_speed = count/timeval_elapsed(&tv);
+	torture_comment(torture, "tdb speed %.2f ops/sec\n", tdb_speed);
+	
+	talloc_free(tmp_ctx);
+	unlink("test.tdb");
+	return true;
+
+failed:
+	talloc_free(tmp_ctx);
+	unlink("test.tdb");
+	return false;
+}
+
+
+static bool ldb_add_record(struct ldb_context *ldb, unsigned rid)
+{
+	struct ldb_message *msg;	
+	int ret;
+
+	msg = ldb_msg_new(ldb);
+	if (msg == NULL) {
+		return false;
+	}
+
+	msg->dn = ldb_dn_new_fmt(msg, ldb, "SID=S-1-5-21-53173311-3623041448-2049097239-%u", rid);
+	if (msg->dn == NULL) {
+		talloc_free(msg);
+		return false;
+	}
+
+	ret = ldb_msg_add_fmt(msg, "UID", "%u", rid);
+	if (ret != LDB_SUCCESS) {
+		talloc_free(msg);
+		return false;
+	}
+
+	ret = ldb_add(ldb, msg);
+
+	talloc_free(msg);
+
+	return ret == LDB_SUCCESS;
+}
+
+
+/*
+  test ldb speed
+*/
+static bool test_ldb_speed(struct torture_context *torture, const void *_data)
+{
+	struct timeval tv;
+	struct ldb_context *ldb;
+	int timelimit = torture_setting_int(torture, "timelimit", 10);
+	int i, count;
+	TALLOC_CTX *tmp_ctx = talloc_new(torture);
+	struct ldb_ldif *ldif;
+	const char *init_ldif = "dn: @INDEXLIST\n" \
+		"@IDXATTR: UID\n";
+	float ldb_speed;
+
+	unlink("./test.ldb");
+
+	torture_comment(torture, "Testing ldb speed for sidmap\n");
+
+	ldb = ldb_wrap_connect(tmp_ctx, torture->ev, torture->lp_ctx, "tdb://test.ldb",
+				NULL, NULL, LDB_FLG_NOSYNC);
+	if (!ldb) {
+		torture_result(torture, TORTURE_FAIL, "Failed to open test.ldb");
+		goto failed;
+	}
+
+	/* add an index */
+	ldif = ldb_ldif_read_string(ldb, &init_ldif);
+	if (ldif == NULL) {
+		torture_result(torture, TORTURE_FAIL, "Didn't get LDIF data!");
+		goto failed;
+	}
+	if (ldb_add(ldb, ldif->msg) != LDB_SUCCESS) {
+		torture_result(torture, TORTURE_FAIL, "Couldn't apply LDIF data!");
+		talloc_free(ldif);
+		goto failed;
+	}
+	talloc_free(ldif);
+
+	torture_comment(torture, "Adding %d SID records\n", torture_entries);
+
+	for (i=0;i<torture_entries;i++) {
+		if (!ldb_add_record(ldb, i)) {
+			torture_result(torture, TORTURE_FAIL, "Failed to add SID %d", i);
+			goto failed;
+		}
+	}
+
+	if (talloc_total_blocks(tmp_ctx) > 100) {
+		torture_result(torture, TORTURE_FAIL, "memory leak in ldb add");
+		goto failed;
+	}
+
+	torture_comment(torture, "Testing for %d seconds\n", timelimit);
+
+	tv = timeval_current();
+
+	for (count=0;timeval_elapsed(&tv) < timelimit;count++) {
+		struct ldb_dn *dn;
+		struct ldb_result *res;
+
+		i = random() % torture_entries;
+		dn = ldb_dn_new_fmt(tmp_ctx, ldb, "SID=S-1-5-21-53173311-3623041448-2049097239-%u", i);
+		if (ldb_search(ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE, NULL, NULL) != LDB_SUCCESS || res->count != 1) {
+			torture_result(torture, TORTURE_FAIL, "Failed to find SID %d!", i);
+			goto failed;
+		}
+		talloc_free(res);
+		talloc_free(dn);
+		if (ldb_search(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, NULL, "(UID=%u)", i) != LDB_SUCCESS || res->count != 1) {
+			torture_result(torture, TORTURE_FAIL, "Failed to find UID %d!", i);
+			goto failed;
+		}
+		talloc_free(res);
+	}
+
+	if (talloc_total_blocks(tmp_ctx) > 100) {
+		torture_result(torture, TORTURE_FAIL, "memory leak in ldb search");
+		goto failed;
+	}
+
+	ldb_speed = count/timeval_elapsed(&tv);
+	torture_comment(torture, "ldb speed %.2f ops/sec\n", ldb_speed);
+
+	torture_comment(torture, "ldb/tdb speed ratio is %.2f%%\n", (100*ldb_speed/tdb_speed));
+	
+	talloc_free(tmp_ctx);
+	unlink("./test.ldb");
+	return true;
+
+failed:
+	talloc_free(tmp_ctx);
+	unlink("./test.ldb");
+	return false;
+}
+
+struct torture_suite *torture_local_dbspeed(TALLOC_CTX *mem_ctx)
+{
+	struct torture_suite *s = torture_suite_create(mem_ctx, "dbspeed");
+	torture_suite_add_simple_tcase_const(s, "tdb_speed", test_tdb_speed,
+			NULL);
+	torture_suite_add_simple_tcase_const(s, "ldb_speed", test_ldb_speed,
+			NULL);
+	return s;
+}
diff --git a/source4/torture/local/fsrvp_state.c b/source4/torture/local/fsrvp_state.c
new file mode 100644
index 0000000..9b63ec1
--- /dev/null
+++ b/source4/torture/local/fsrvp_state.c
@@ -0,0 +1,492 @@
+/*
+   Test suite for FSRVP server state
+
+   Copyright (C) David Disseldorp 2012-2015
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include <unistd.h>
+
+#include "librpc/gen_ndr/security.h"
+#include "lib/param/param.h"
+#include "lib/util/dlinklist.h"
+#include "libcli/resolve/resolve.h"
+#include "librpc/gen_ndr/ndr_fsrvp.h"
+#include "librpc/gen_ndr/ndr_fsrvp_c.h"
+#include "source3/rpc_server/fss/srv_fss_private.h"
+#include "torture/torture.h"
+#include "torture/local/proto.h"
+
+static bool test_fsrvp_state_empty(struct torture_context *tctx)
+{
+	NTSTATUS status;
+	struct fss_global fss_global;
+	struct stat sbuf;
+	char db_dir[] = "fsrvp_torture_XXXXXX";
+	char *db_path = talloc_asprintf(NULL, "%s/%s",
+					mkdtemp(db_dir), FSS_DB_NAME);
+
+	memset(&fss_global, 0, sizeof(fss_global));
+	fss_global.mem_ctx = talloc_new(NULL);
+	fss_global.db_path = db_path;
+
+	status = fss_state_store(fss_global.mem_ctx, fss_global.sc_sets,
+				 fss_global.sc_sets_count, fss_global.db_path);
+	torture_assert_ntstatus_ok(tctx, status,
+				   "failed to store empty fss state");
+
+	torture_assert_int_equal(tctx, stat(fss_global.db_path, &sbuf), 0,
+			"failed to stat fss state tdb");
+	talloc_free(fss_global.mem_ctx);
+
+	memset(&fss_global, 0, sizeof(fss_global));
+	fss_global.mem_ctx = talloc_new(NULL);
+	fss_global.db_path = db_path;
+
+	status = fss_state_retrieve(fss_global.mem_ctx, &fss_global.sc_sets,
+				    &fss_global.sc_sets_count,
+				    fss_global.db_path);
+	torture_assert_ntstatus_ok(tctx, status,
+				   "failed to retrieve empty fss state");
+	torture_assert_int_equal(tctx, fss_global.sc_sets_count, 0,
+				 "sc_sets_count set when it should be zero");
+	talloc_free(fss_global.mem_ctx);
+	unlink(db_path);
+	rmdir(db_dir);
+	talloc_free(db_path);
+
+	return true;
+}
+
+static bool test_fsrvp_state_sc_set(struct torture_context *tctx,
+				    TALLOC_CTX *mem_ctx,
+				    struct fss_sc_set **sc_set_out)
+{
+	struct fss_sc_set *sc_set;
+
+	sc_set = talloc_zero(mem_ctx, struct fss_sc_set);
+	sc_set->id = GUID_random();
+	sc_set->id_str = GUID_string(sc_set, &sc_set->id);
+	sc_set->state = FSS_SC_COMMITED;
+	sc_set->context = FSRVP_CTX_FILE_SHARE_BACKUP;
+	*sc_set_out = sc_set;
+
+	return true;
+}
+
+static bool test_fsrvp_state_sc(struct torture_context *tctx,
+				TALLOC_CTX *mem_ctx,
+				struct fss_sc **sc_out)
+{
+	struct fss_sc *sc;
+
+	sc = talloc_zero(mem_ctx, struct fss_sc);
+	sc->id = GUID_random();
+	sc->id_str = GUID_string(sc, &sc->id);
+	sc->volume_name = talloc_strdup(sc, "/this/is/a/path");
+	/* keep snap path NULL, i.e. not yet committed */
+	sc->create_ts = time(NULL);
+	*sc_out = sc;
+
+	return true;
+}
+
+static bool test_fsrvp_state_smap(struct torture_context *tctx,
+				TALLOC_CTX *mem_ctx,
+				const char *base_share_name,
+				const char *sc_share_name,
+				struct fss_sc_smap **smap_out)
+{
+	struct fss_sc_smap *smap;
+
+	smap = talloc_zero(mem_ctx, struct fss_sc_smap);
+	smap->share_name = talloc_strdup(mem_ctx, base_share_name);
+	smap->sc_share_name = talloc_strdup(mem_ctx, sc_share_name);
+	smap->sc_share_comment = talloc_strdup(mem_ctx, "test sc share comment");
+	smap->is_exposed = false;
+	*smap_out = smap;
+
+	return true;
+}
+
+static bool test_fsrvp_state_smap_compare(struct torture_context *tctx,
+					  struct fss_sc_smap *smap_1,
+					  struct fss_sc_smap *smap_2)
+{
+	/* already confirmed by caller */
+	torture_assert_str_equal(tctx, smap_1->sc_share_name,
+				 smap_2->sc_share_name,
+				 "smap sc share name strings differ");
+
+	torture_assert_str_equal(tctx, smap_1->share_name,
+				 smap_2->share_name,
+				 "smap share name strings differ");
+
+	torture_assert_str_equal(tctx, smap_1->sc_share_comment,
+				 smap_2->sc_share_comment,
+				 "smap sc share comment strings differ");
+
+	torture_assert(tctx, (smap_1->is_exposed == smap_2->is_exposed),
+		       "smap exposure settings differ");
+
+	return true;
+}
+
+static bool test_fsrvp_state_sc_compare(struct torture_context *tctx,
+					struct fss_sc *sc_1,
+					struct fss_sc *sc_2)
+{
+	struct fss_sc_smap *smap_1;
+	struct fss_sc_smap *smap_2;
+	bool ok;
+
+	/* should have already been confirmed by the caller */
+	torture_assert(tctx, GUID_equal(&sc_1->id, &sc_2->id),
+		       "sc guids differ");
+
+	torture_assert_str_equal(tctx, sc_1->volume_name, sc_2->volume_name,
+				 "sc volume_name strings differ");
+
+	/* may be null, assert_str_eq handles null ptrs safely */
+	torture_assert_str_equal(tctx, sc_1->sc_path, sc_2->sc_path,
+				 "sc path strings differ");
+
+	torture_assert(tctx, difftime(sc_1->create_ts, sc_2->create_ts) == 0,
+		       "sc create timestamps differ");
+
+	torture_assert_int_equal(tctx, sc_1->smaps_count, sc_2->smaps_count,
+				 "sc smaps counts differ");
+
+	for (smap_1 = sc_1->smaps; smap_1; smap_1 = smap_1->next) {
+		bool matched = false;
+		for (smap_2 = sc_2->smaps; smap_2; smap_2 = smap_2->next) {
+			if (strcmp(smap_1->sc_share_name,
+				   smap_2->sc_share_name) == 0) {
+				matched = true;
+				ok = test_fsrvp_state_smap_compare(tctx,
+								   smap_1,
+								   smap_2);
+				torture_assert(tctx, ok, "");
+				break;
+			}
+		}
+		torture_assert(tctx, matched, "no match for smap");
+	}
+
+	return true;
+}
+
+static bool test_fsrvp_state_sc_set_compare(struct torture_context *tctx,
+					    struct fss_sc_set *sc_set_1,
+					    struct fss_sc_set *sc_set_2)
+{
+	struct fss_sc *sc_1;
+	struct fss_sc *sc_2;
+	bool ok;
+
+	/* should have already been confirmed by the caller */
+	torture_assert(tctx, GUID_equal(&sc_set_1->id, &sc_set_2->id),
+		       "sc_set guids differ");
+
+	torture_assert_str_equal(tctx, sc_set_1->id_str, sc_set_2->id_str,
+				 "sc_set guid strings differ");
+
+	torture_assert_int_equal(tctx, sc_set_1->state, sc_set_2->state,
+				 "sc_set state enums differ");
+
+	torture_assert_int_equal(tctx, sc_set_1->context, sc_set_2->context,
+				 "sc_set contexts differ");
+
+	torture_assert_int_equal(tctx, sc_set_1->scs_count, sc_set_2->scs_count,
+				 "sc_set sc counts differ");
+
+	for (sc_1 = sc_set_1->scs; sc_1; sc_1 = sc_1->next) {
+		bool matched = false;
+		for (sc_2 = sc_set_2->scs; sc_2; sc_2 = sc_2->next) {
+			if (GUID_equal(&sc_1->id, &sc_2->id)) {
+				matched = true;
+				ok = test_fsrvp_state_sc_compare(tctx, sc_1,
+								       sc_2);
+				torture_assert(tctx, ok, "");
+				break;
+			}
+		}
+		torture_assert(tctx, matched, "no match for sc");
+	}
+	return true;
+}
+
+static bool test_fsrvp_state_compare(struct torture_context *tctx,
+				     struct fss_global *fss_1,
+				     struct fss_global *fss_2)
+{
+	struct fss_sc_set *sc_set_1;
+	struct fss_sc_set *sc_set_2;
+	bool ok;
+
+	torture_assert_int_equal(tctx, fss_1->sc_sets_count,
+				 fss_2->sc_sets_count,
+				 "sc_sets_count differ");
+
+	for (sc_set_1 = fss_1->sc_sets; sc_set_1; sc_set_1 = sc_set_1->next) {
+		bool matched = false;
+		for (sc_set_2 = fss_2->sc_sets;
+		     sc_set_2;
+		     sc_set_2 = sc_set_2->next) {
+			if (GUID_equal(&sc_set_1->id, &sc_set_2->id)) {
+				matched = true;
+				ok = test_fsrvp_state_sc_set_compare(tctx,
+								     sc_set_1,
+								     sc_set_2);
+				torture_assert(tctx, ok, "");
+				break;
+			}
+		}
+		torture_assert(tctx, matched, "no match for sc_set");
+	}
+
+	return true;
+}
+
+/*
+ * test a simple hierarchy of:
+ *
+ *       |
+ *     sc_set
+ *       |
+ *      sc
+ *        \
+ *       smap
+ */
+static bool test_fsrvp_state_single(struct torture_context *tctx)
+{
+	NTSTATUS status;
+	bool ok;
+	struct fss_global fss_gs;
+	struct fss_global fss_gr;
+	struct fss_sc_set *sc_set;
+	struct fss_sc *sc;
+	struct fss_sc_smap *smap;
+	char db_dir[] = "fsrvp_torture_XXXXXX";
+	char *db_path = talloc_asprintf(NULL, "%s/%s",
+					mkdtemp(db_dir), FSS_DB_NAME);
+
+	memset(&fss_gs, 0, sizeof(fss_gs));
+	fss_gs.mem_ctx = talloc_new(NULL);
+	fss_gs.db_path = db_path;
+
+	ok = test_fsrvp_state_sc_set(tctx, fss_gs.mem_ctx, &sc_set);
+	torture_assert(tctx, ok, "failed to create sc set");
+
+	/* use parent as mem ctx */
+	ok = test_fsrvp_state_sc(tctx, sc_set, &sc);
+	torture_assert(tctx, ok, "failed to create sc");
+
+	ok = test_fsrvp_state_smap(tctx, sc, "base_share", "sc_share", &smap);
+	torture_assert(tctx, ok, "failed to create smap");
+
+	DLIST_ADD_END(fss_gs.sc_sets, sc_set);
+	fss_gs.sc_sets_count++;
+	DLIST_ADD_END(sc_set->scs, sc);
+	sc_set->scs_count++;
+	sc->sc_set = sc_set;
+	DLIST_ADD_END(sc->smaps, smap);
+	sc->smaps_count++;
+
+	status = fss_state_store(fss_gs.mem_ctx, fss_gs.sc_sets,
+				 fss_gs.sc_sets_count, fss_gs.db_path);
+	torture_assert_ntstatus_ok(tctx, status,
+				   "failed to store fss state");
+
+	memset(&fss_gr, 0, sizeof(fss_gr));
+	fss_gr.mem_ctx = talloc_new(NULL);
+	fss_gr.db_path = db_path;
+
+	status = fss_state_retrieve(fss_gr.mem_ctx, &fss_gr.sc_sets,
+				    &fss_gr.sc_sets_count, fss_gr.db_path);
+	torture_assert_ntstatus_ok(tctx, status,
+				   "failed to retrieve fss state");
+
+	ok = test_fsrvp_state_compare(tctx, &fss_gs, &fss_gr);
+	torture_assert(tctx, ok,
+		       "stored and retrieved state comparison failed");
+
+	talloc_free(fss_gs.mem_ctx);
+	talloc_free(fss_gr.mem_ctx);
+	unlink(db_path);
+	rmdir(db_dir);
+	talloc_free(db_path);
+
+	return true;
+}
+
+/*
+ * test a complex hierarchy of:
+ *
+ *              /\
+ *             /  \
+ *     sc_set_a    sc_set_b
+ *     /     \
+ * sc_aa      sc_ab
+ * |          |   \
+ * smap_aaa   |    \
+ *            |     \
+ *       smap_aba   smap_abb
+ */
+static bool test_fsrvp_state_multi(struct torture_context *tctx)
+{
+	NTSTATUS status;
+	bool ok;
+	struct fss_global fss_gs;
+	struct fss_global fss_gr;
+	struct fss_sc_set *sc_set_a;
+	struct fss_sc_set *sc_set_b;
+	struct fss_sc *sc_aa;
+	struct fss_sc *sc_ab;
+	struct fss_sc_smap *smap_aaa;
+	struct fss_sc_smap *smap_aba;
+	struct fss_sc_smap *smap_abb;
+	char db_dir[] = "fsrvp_torture_XXXXXX";
+	char *db_path = talloc_asprintf(NULL, "%s/%s",
+					mkdtemp(db_dir), FSS_DB_NAME);
+
+	memset(&fss_gs, 0, sizeof(fss_gs));
+	fss_gs.mem_ctx = talloc_new(NULL);
+	fss_gs.db_path = db_path;
+
+	ok = test_fsrvp_state_sc_set(tctx, fss_gs.mem_ctx, &sc_set_a);
+	torture_assert(tctx, ok, "failed to create sc set");
+
+	ok = test_fsrvp_state_sc_set(tctx, fss_gs.mem_ctx, &sc_set_b);
+	torture_assert(tctx, ok, "failed to create sc set");
+
+	/* use parent as mem ctx */
+	ok = test_fsrvp_state_sc(tctx, sc_set_a, &sc_aa);
+	torture_assert(tctx, ok, "failed to create sc");
+
+	ok = test_fsrvp_state_sc(tctx, sc_set_a, &sc_ab);
+	torture_assert(tctx, ok, "failed to create sc");
+
+	ok = test_fsrvp_state_smap(tctx, sc_ab, "share_aa", "sc_share_aaa",
+				   &smap_aaa);
+	torture_assert(tctx, ok, "failed to create smap");
+
+	ok = test_fsrvp_state_smap(tctx, sc_ab, "share_ab", "sc_share_aba",
+				   &smap_aba);
+	torture_assert(tctx, ok, "failed to create smap");
+
+	ok = test_fsrvp_state_smap(tctx, sc_ab, "share_ab", "sc_share_abb",
+				   &smap_abb);
+	torture_assert(tctx, ok, "failed to create smap");
+
+	DLIST_ADD_END(fss_gs.sc_sets, sc_set_a);
+	fss_gs.sc_sets_count++;
+	DLIST_ADD_END(fss_gs.sc_sets, sc_set_b);
+	fss_gs.sc_sets_count++;
+
+	DLIST_ADD_END(sc_set_a->scs, sc_aa);
+	sc_set_a->scs_count++;
+	sc_aa->sc_set = sc_set_a;
+	DLIST_ADD_END(sc_set_a->scs, sc_ab);
+	sc_set_a->scs_count++;
+	sc_ab->sc_set = sc_set_a;
+
+	DLIST_ADD_END(sc_aa->smaps, smap_aaa);
+	sc_aa->smaps_count++;
+	DLIST_ADD_END(sc_ab->smaps, smap_aba);
+	sc_ab->smaps_count++;
+	DLIST_ADD_END(sc_ab->smaps, smap_abb);
+	sc_ab->smaps_count++;
+
+	status = fss_state_store(fss_gs.mem_ctx, fss_gs.sc_sets,
+				 fss_gs.sc_sets_count, fss_gs.db_path);
+	torture_assert_ntstatus_ok(tctx, status,
+				   "failed to store fss state");
+
+	memset(&fss_gr, 0, sizeof(fss_gr));
+	fss_gr.mem_ctx = talloc_new(NULL);
+	fss_gr.db_path = db_path;
+	status = fss_state_retrieve(fss_gr.mem_ctx, &fss_gr.sc_sets,
+				    &fss_gr.sc_sets_count, fss_gr.db_path);
+	torture_assert_ntstatus_ok(tctx, status,
+				   "failed to retrieve fss state");
+
+	ok = test_fsrvp_state_compare(tctx, &fss_gs, &fss_gr);
+	torture_assert(tctx, ok,
+		       "stored and retrieved state comparison failed");
+
+	talloc_free(fss_gs.mem_ctx);
+	talloc_free(fss_gr.mem_ctx);
+	unlink(db_path);
+	rmdir(db_dir);
+	talloc_free(db_path);
+
+	return true;
+}
+
+static bool test_fsrvp_state_none(struct torture_context *tctx)
+{
+	NTSTATUS status;
+	struct fss_global fss_global;
+	char db_dir[] = "fsrvp_torture_XXXXXX";
+	char *db_path = talloc_asprintf(NULL, "%s/%s",
+					mkdtemp(db_dir), FSS_DB_NAME);
+
+	memset(&fss_global, 0, sizeof(fss_global));
+	fss_global.mem_ctx = talloc_new(NULL);
+	fss_global.db_path = db_path;
+
+	status = fss_state_retrieve(fss_global.mem_ctx, &fss_global.sc_sets,
+				    &fss_global.sc_sets_count,
+				    fss_global.db_path);
+	torture_assert_ntstatus_ok(tctx, status,
+				   "failed to retrieve fss state");
+	torture_assert_int_equal(tctx, fss_global.sc_sets_count, 0,
+				 "sc_sets_count set when it should be zero");
+	talloc_free(fss_global.mem_ctx);
+	unlink(db_path);
+	rmdir(db_dir);
+	talloc_free(db_path);
+
+	return true;
+}
+
+struct torture_suite *torture_local_fsrvp(TALLOC_CTX *mem_ctx)
+{
+	struct torture_suite *suite = torture_suite_create(mem_ctx,
+							   "fsrvp_state");
+
+	/* dbwrap uses talloc_tos(), hence we need a stackframe :( */
+	talloc_stackframe();
+
+	torture_suite_add_simple_test(suite,
+				      "state_empty",
+				      test_fsrvp_state_empty);
+
+	torture_suite_add_simple_test(suite,
+				      "state_single",
+				      test_fsrvp_state_single);
+
+	torture_suite_add_simple_test(suite,
+				      "state_multi",
+				      test_fsrvp_state_multi);
+
+	torture_suite_add_simple_test(suite,
+				      "state_none",
+				      test_fsrvp_state_none);
+
+	return suite;
+}
diff --git a/source4/torture/local/local.c b/source4/torture/local/local.c
new file mode 100644
index 0000000..95417ef
--- /dev/null
+++ b/source4/torture/local/local.c
@@ -0,0 +1,105 @@
+/*
+   Unix SMB/CIFS implementation.
+   SMB torture tester
+   Copyright (C) Jelmer Vernooij 2006
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "torture/smbtorture.h"
+#include "torture/local/proto.h"
+#include "torture/ndr/proto.h"
+#include "torture/auth/proto.h"
+#include "../lib/crypto/test_proto.h"
+#include "lib/registry/tests/proto.h"
+#include "lib/replace/replace-testsuite.h"
+
+/* ignore me */ static struct torture_suite *
+	(*suite_generators[]) (TALLOC_CTX *mem_ctx) =
+{
+	torture_local_binding_string,
+	torture_ntlmssp,
+	torture_smbencrypt,
+	torture_local_messaging,
+	torture_local_irpc,
+	torture_local_util_strlist,
+	torture_local_util_file,
+	torture_local_util_str,
+	torture_local_util_time,
+	torture_local_util_data_blob,
+	torture_local_util_binsearch,
+	torture_local_util_asn1,
+	torture_local_util_anonymous_shared,
+	torture_local_util_strv,
+	torture_local_util_strv_util,
+	torture_local_util,
+	torture_local_idtree,
+	torture_local_dlinklist,
+	torture_local_genrand,
+	torture_local_iconv,
+	torture_local_socket,
+	torture_pac,
+	torture_local_resolve,
+	torture_local_ndr,
+	torture_local_tdr,
+	torture_local_share,
+	torture_local_loadparm,
+	torture_local_charset,
+	torture_local_convert_string_handle,
+	torture_local_convert_string,
+	torture_local_string_case_handle,
+	torture_local_string_case,
+	torture_local_util_unistr,
+	torture_local_event,
+	torture_local_tevent_req,
+	torture_local_torture,
+	torture_local_dbspeed,
+	torture_ldb,
+	torture_dsdb_dn,
+	torture_dsdb_syntax,
+	torture_registry,
+	torture_local_verif_trailer,
+	torture_local_nss,
+	torture_local_fsrvp,
+	torture_local_util_str_escape,
+	torture_local_tfork,
+	torture_local_mdspkt,
+	torture_local_smbtorture,
+	NULL
+};
+
+NTSTATUS torture_local_init(TALLOC_CTX *ctx)
+{
+	int i;
+	struct torture_suite *suite = torture_suite_create(
+		ctx, "local");
+
+	torture_suite_add_simple_test(suite, "talloc", torture_local_talloc);
+	torture_suite_add_simple_test(suite, "replace", torture_local_replace);
+
+	torture_suite_add_simple_test(suite,
+				      "crypto.md4", torture_local_crypto_md4);
+
+	for (i = 0; suite_generators[i]; i++)
+		torture_suite_add_suite(suite,
+					suite_generators[i](ctx));
+
+	suite->description = talloc_strdup(suite,
+					   "Local, Samba-specific tests");
+
+	torture_register_suite(ctx, suite);
+
+	return NT_STATUS_OK;
+}
diff --git a/source4/torture/local/mdspkt.c b/source4/torture/local/mdspkt.c
new file mode 100644
index 0000000..dd9c391
--- /dev/null
+++ b/source4/torture/local/mdspkt.c
@@ -0,0 +1,104 @@
+/*
+ * Tests for mdssvc packets (un)marshalling
+ *
+ * Copyright Ralph Boehme <slow@samba.org> 2019
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "replace.h"
+#include <talloc.h>
+#include "libcli/util/ntstatus.h"
+#include "lib/util/samba_util.h"
+#include "lib/torture/torture.h"
+#include "lib/util/data_blob.h"
+#include "torture/local/proto.h"
+#include "mdssvc/marshalling.h"
+
+static const unsigned char mdspkt_empty_cnid_fm[] = {
+	0x34, 0x33, 0x32, 0x31, 0x33, 0x30, 0x64, 0x6d,
+	0x0c, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
+	0x01, 0x00, 0x00, 0x02, 0x01, 0x00, 0x00, 0x00,
+	0x02, 0x00, 0x00, 0x84, 0x01, 0x00, 0x00, 0x00,
+	0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x01, 0x00, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00,
+	0x01, 0x00, 0x00, 0x87, 0x08, 0x00, 0x00, 0x00,
+	0x01, 0x00, 0x00, 0x02, 0x03, 0x00, 0x00, 0x00,
+	0x01, 0x00, 0x00, 0x07, 0x08, 0x00, 0x00, 0x00,
+	0x04, 0x00, 0x00, 0x88, 0x00, 0x00, 0x00, 0x00,
+	0x02, 0x00, 0x00, 0x0a, 0x03, 0x00, 0x00, 0x00,
+	0x05, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00, 0x00,
+	0x07, 0x00, 0x00, 0x1b, 0x00, 0x00, 0x00, 0x00
+};
+
+static const char *mdspkt_empty_cnid_fm_dump =
+"DALLOC_CTX(#1): {\n"
+"	sl_array_t(#3): {\n"
+"		uint64_t: 0x0023\n"
+"		CNIDs: unkn1: 0x0, unkn2: 0x0\n"
+"			DALLOC_CTX(#0): {\n"
+"			}\n"
+"		sl_filemeta_t(#0): {\n"
+"		}\n"
+"	}\n"
+"}\n";
+
+static bool test_mdspkt_empty_cnid_fm(struct torture_context *tctx)
+{
+	DALLOC_CTX *d = NULL;
+	sl_cnids_t *cnids = NULL;
+	char *dstr = NULL;
+	size_t ncnids;
+	bool ret = true;
+
+	d = dalloc_new(tctx);
+	torture_assert_not_null_goto(tctx, d, ret, done,
+				     "dalloc_new failed\n");
+
+	ret = sl_unpack(d,
+			(const char *)mdspkt_empty_cnid_fm,
+			sizeof(mdspkt_empty_cnid_fm));
+	torture_assert_goto(tctx, ret, ret, done, "sl_unpack failed\n");
+
+	cnids = dalloc_get(d, "DALLOC_CTX", 0, "sl_cnids_t", 1);
+	torture_assert_not_null_goto(tctx, cnids, ret, done,
+				     "dalloc_get cnids failed\n");
+
+	ncnids = dalloc_size(cnids->ca_cnids);
+	torture_assert_int_equal_goto(tctx, ncnids, 0, ret, done,
+				      "Wrong number of CNIDs\n");
+
+	dstr = dalloc_dump(d, 0);
+	torture_assert_not_null_goto(tctx, dstr, ret, done,
+				     "dalloc_dump failed\n");
+
+	torture_assert_str_equal_goto(tctx, dstr, mdspkt_empty_cnid_fm_dump,
+				      ret, done, "Bad dump\n");
+
+done:
+	TALLOC_FREE(d);
+	return ret;
+}
+
+struct torture_suite *torture_local_mdspkt(TALLOC_CTX *mem_ctx)
+{
+	struct torture_suite *suite =
+		torture_suite_create(mem_ctx, "mdspkt");
+
+	torture_suite_add_simple_test(suite,
+				      "empty_cnid_fm",
+				      test_mdspkt_empty_cnid_fm);
+
+	return suite;
+}
diff --git a/source4/torture/local/nss_tests.c b/source4/torture/local/nss_tests.c
new file mode 100644
index 0000000..e911aa2
--- /dev/null
+++ b/source4/torture/local/nss_tests.c
@@ -0,0 +1,1061 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   local testing of the nss wrapper
+
+   Copyright (C) Guenther Deschner 2009-2010
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+
+#include "torture/torture.h"
+#include "torture/local/proto.h"
+#include "lib/replace/system/passwd.h"
+
+static bool copy_passwd(struct torture_context *tctx,
+			const struct passwd *pwd,
+			struct passwd *p)
+{
+	p->pw_name	= talloc_strdup(tctx, pwd->pw_name);
+	torture_assert(tctx, (p->pw_name != NULL || pwd->pw_name == NULL), __location__);
+	p->pw_passwd	= talloc_strdup(tctx, pwd->pw_passwd);
+	torture_assert(tctx, (p->pw_passwd != NULL || pwd->pw_passwd == NULL), __location__);
+	p->pw_uid	= pwd->pw_uid;
+	p->pw_gid	= pwd->pw_gid;
+	p->pw_gecos	= talloc_strdup(tctx, pwd->pw_gecos);
+	torture_assert(tctx, (p->pw_gecos != NULL || pwd->pw_gecos == NULL), __location__);
+	p->pw_dir	= talloc_strdup(tctx, pwd->pw_dir);
+	torture_assert(tctx, (p->pw_dir != NULL || pwd->pw_dir == NULL), __location__);
+	p->pw_shell	= talloc_strdup(tctx, pwd->pw_shell);
+	torture_assert(tctx, (p->pw_shell != NULL || pwd->pw_shell == NULL), __location__);
+
+	return true;
+}
+
+static void print_passwd(struct passwd *pwd)
+{
+	printf("%s:%s:%lu:%lu:%s:%s:%s\n",
+	       pwd->pw_name,
+	       pwd->pw_passwd,
+	       (unsigned long)pwd->pw_uid,
+	       (unsigned long)pwd->pw_gid,
+	       pwd->pw_gecos,
+	       pwd->pw_dir,
+	       pwd->pw_shell);
+}
+
+
+static bool test_getpwnam(struct torture_context *tctx,
+			  const char *name,
+			  struct passwd *pwd_p)
+{
+	struct passwd *pwd;
+	int ret;
+
+	torture_comment(tctx, "Testing getpwnam: %s\n", name);
+
+	errno = 0;
+	pwd = getpwnam(name);
+	ret = errno;
+	torture_assert(tctx, (pwd != NULL), talloc_asprintf(tctx,
+		       "getpwnam(%s) failed - %d - %s",
+		       name, ret, strerror(ret)));
+
+	if (pwd_p != NULL) {
+		torture_assert(tctx, copy_passwd(tctx, pwd, pwd_p), __location__);
+	}
+
+	return true;
+}
+
+static bool test_getpwnam_r(struct torture_context *tctx,
+			    const char *name,
+			    struct passwd *pwd_p)
+{
+	struct passwd pwd, *pwdp;
+	char buffer[4096];
+	int ret;
+
+	torture_comment(tctx, "Testing getpwnam_r: %s\n", name);
+
+	ret = getpwnam_r(name, &pwd, buffer, sizeof(buffer), &pwdp);
+	torture_assert(tctx, ret == 0, talloc_asprintf(tctx,
+		       "getpwnam_r(%s) failed - %d - %s",
+		       name, ret, strerror(ret)));
+
+	print_passwd(&pwd);
+
+	if (pwd_p != NULL) {
+		torture_assert(tctx, copy_passwd(tctx, &pwd, pwd_p), __location__);
+	}
+
+	return true;
+}
+
+static bool test_getpwuid(struct torture_context *tctx,
+			  uid_t uid,
+			  struct passwd *pwd_p)
+{
+	struct passwd *pwd;
+	int ret;
+
+	torture_comment(tctx, "Testing getpwuid: %lu\n", (unsigned long)uid);
+
+	errno = 0;
+	pwd = getpwuid(uid);
+	ret = errno;
+	torture_assert(tctx, (pwd != NULL), talloc_asprintf(tctx,
+		       "getpwuid(%lu) failed - %d - %s",
+		       (unsigned long)uid, ret, strerror(ret)));
+
+	print_passwd(pwd);
+
+	if (pwd_p != NULL) {
+		torture_assert(tctx, copy_passwd(tctx, pwd, pwd_p), __location__);
+	}
+
+	return true;
+}
+
+static bool test_getpwuid_r(struct torture_context *tctx,
+			    uid_t uid,
+			    struct passwd *pwd_p)
+{
+	struct passwd pwd, *pwdp;
+	char buffer[4096];
+	int ret;
+
+	torture_comment(tctx, "Testing getpwuid_r: %lu\n", (unsigned long)uid);
+
+	ret = getpwuid_r(uid, &pwd, buffer, sizeof(buffer), &pwdp);
+	torture_assert(tctx, ret == 0, talloc_asprintf(tctx,
+		       "getpwuid_r(%lu) failed - %d - %s",
+		       (unsigned long)uid, ret, strerror(ret)));
+
+	print_passwd(&pwd);
+
+	if (pwd_p != NULL) {
+		torture_assert(tctx, copy_passwd(tctx, &pwd, pwd_p), __location__);
+	}
+
+	return true;
+}
+
+
+static bool copy_group(struct torture_context *tctx,
+		       const struct group *grp,
+		       struct group *g)
+{
+	int i;
+
+	g->gr_name	= talloc_strdup(tctx, grp->gr_name);
+	torture_assert(tctx, (g->gr_name != NULL || grp->gr_name == NULL), __location__);
+	g->gr_passwd	= talloc_strdup(tctx, grp->gr_passwd);
+	torture_assert(tctx, (g->gr_passwd != NULL || grp->gr_passwd == NULL), __location__);
+	g->gr_gid	= grp->gr_gid;
+	g->gr_mem	= NULL;
+
+	for (i=0; grp->gr_mem && grp->gr_mem[i]; i++) {
+		g->gr_mem = talloc_realloc(tctx, g->gr_mem, char *, i + 2);
+		torture_assert(tctx, (g->gr_mem != NULL), __location__);
+		g->gr_mem[i] = talloc_strdup(g->gr_mem, grp->gr_mem[i]);
+		torture_assert(tctx, (g->gr_mem[i] != NULL), __location__);
+		g->gr_mem[i+1] = NULL;
+	}
+
+	return true;
+}
+
+static void print_group(struct group *grp)
+{
+	int i;
+	printf("%s:%s:%lu:",
+	       grp->gr_name,
+	       grp->gr_passwd,
+	       (unsigned long)grp->gr_gid);
+
+	if ((grp->gr_mem == NULL) || !grp->gr_mem[0]) {
+		printf("\n");
+		return;
+	}
+
+	for (i=0; grp->gr_mem[i+1]; i++) {
+		printf("%s,", grp->gr_mem[i]);
+	}
+	printf("%s\n", grp->gr_mem[i]);
+}
+
+static bool test_getgrnam(struct torture_context *tctx,
+			  const char *name,
+			  struct group *grp_p)
+{
+	struct group *grp;
+	int ret;
+
+	torture_comment(tctx, "Testing getgrnam: %s\n", name);
+
+	errno = 0;
+	grp = getgrnam(name);
+	ret = errno;
+	torture_assert(tctx, (grp != NULL), talloc_asprintf(tctx,
+		       "getgrnam(%s) failed - %d - %s",
+		       name, ret, strerror(ret)));
+
+	print_group(grp);
+
+	if (grp_p != NULL) {
+		torture_assert(tctx, copy_group(tctx, grp, grp_p), __location__);
+	}
+
+	return true;
+}
+
+static bool test_getgrnam_r(struct torture_context *tctx,
+			    const char *name,
+			    struct group *grp_p)
+{
+	struct group grp, *grpp;
+	char buffer[4096];
+	int ret;
+
+	torture_comment(tctx, "Testing getgrnam_r: %s\n", name);
+
+	ret = getgrnam_r(name, &grp, buffer, sizeof(buffer), &grpp);
+	torture_assert(tctx, ret == 0, talloc_asprintf(tctx,
+		       "getgrnam_r(%s) failed - %d - %s",
+		       name, ret, strerror(ret)));
+
+	print_group(&grp);
+
+	if (grp_p != NULL) {
+		torture_assert(tctx, copy_group(tctx, &grp, grp_p), __location__);
+	}
+
+	return true;
+}
+
+
+static bool test_getgrgid(struct torture_context *tctx,
+			  gid_t gid,
+			  struct group *grp_p)
+{
+	struct group *grp;
+	int ret;
+
+	torture_comment(tctx, "Testing getgrgid: %lu\n", (unsigned long)gid);
+
+	errno = 0;
+	grp = getgrgid(gid);
+	ret = errno;
+	torture_assert(tctx, (grp != NULL), talloc_asprintf(tctx,
+		       "getgrgid(%lu) failed - %d - %s",
+		       (unsigned long)gid, ret, strerror(ret)));
+
+	print_group(grp);
+
+	if (grp_p != NULL) {
+		torture_assert(tctx, copy_group(tctx, grp, grp_p), __location__);
+	}
+
+	return true;
+}
+
+static bool test_getgrgid_r(struct torture_context *tctx,
+			    gid_t gid,
+			    struct group *grp_p)
+{
+	struct group grp, *grpp;
+	char buffer[4096];
+	int ret;
+
+	torture_comment(tctx, "Testing getgrgid_r: %lu\n", (unsigned long)gid);
+
+	ret = getgrgid_r(gid, &grp, buffer, sizeof(buffer), &grpp);
+	torture_assert(tctx, ret == 0, talloc_asprintf(tctx,
+		       "getgrgid_r(%lu) failed - %d - %s",
+		       (unsigned long)gid, ret, strerror(ret)));
+
+	print_group(&grp);
+
+	if (grp_p != NULL) {
+		torture_assert(tctx, copy_group(tctx, &grp, grp_p), __location__);
+	}
+
+	return true;
+}
+
+static bool test_enum_passwd(struct torture_context *tctx,
+			     struct passwd **pwd_array_p,
+			     size_t *num_pwd_p)
+{
+	struct passwd *pwd;
+	struct passwd *pwd_array = NULL;
+	size_t num_pwd = 0;
+
+	torture_comment(tctx, "Testing setpwent\n");
+	setpwent();
+
+	while ((pwd = getpwent()) != NULL) {
+		torture_comment(tctx, "Testing getpwent\n");
+
+		print_passwd(pwd);
+		if (pwd_array_p && num_pwd_p) {
+			pwd_array = talloc_realloc(tctx, pwd_array, struct passwd, num_pwd+1);
+			torture_assert(tctx, pwd_array, "out of memory");
+			copy_passwd(tctx, pwd, &pwd_array[num_pwd]);
+			num_pwd++;
+		}
+	}
+
+	torture_comment(tctx, "Testing endpwent\n");
+	endpwent();
+
+	if (pwd_array_p) {
+		*pwd_array_p = pwd_array;
+	}
+	if (num_pwd_p) {
+		*num_pwd_p = num_pwd;
+	}
+
+	return true;
+}
+
+static bool test_enum_r_passwd(struct torture_context *tctx,
+			       struct passwd **pwd_array_p,
+			       size_t *num_pwd_p)
+{
+	struct passwd pwd, *pwdp;
+	struct passwd *pwd_array = NULL;
+	size_t num_pwd = 0;
+	char buffer[4096];
+	int ret;
+
+	torture_comment(tctx, "Testing setpwent\n");
+	setpwent();
+
+#ifdef HAVE_GETPWENT_R /* getpwent_r not supported on macOS */
+	while (1) {
+		torture_comment(tctx, "Testing getpwent_r\n");
+
+#ifdef SOLARIS_GETPWENT_R
+		ret = getpwent_r(&pwd, buffer, sizeof(buffer));
+#else /* SOLARIS_GETPWENT_R */
+		ret = getpwent_r(&pwd, buffer, sizeof(buffer), &pwdp);
+#endif /* SOLARIS_GETPWENT_R */
+		if (ret != 0) {
+			if (ret != ENOENT) {
+				torture_comment(tctx, "got %d return code\n", ret);
+			}
+			break;
+		}
+		print_passwd(&pwd);
+		if (pwd_array_p && num_pwd_p) {
+			pwd_array = talloc_realloc(tctx, pwd_array, struct passwd, num_pwd+1);
+			torture_assert(tctx, pwd_array, "out of memory");
+			copy_passwd(tctx, &pwd, &pwd_array[num_pwd]);
+			num_pwd++;
+		}
+	}
+#endif /* getpwent_r not supported on macOS */
+
+	torture_comment(tctx, "Testing endpwent\n");
+	endpwent();
+
+	if (pwd_array_p) {
+		*pwd_array_p = pwd_array;
+	}
+	if (num_pwd_p) {
+		*num_pwd_p = num_pwd;
+	}
+
+	return true;
+}
+
+static bool torture_assert_passwd_equal(struct torture_context *tctx,
+					const struct passwd *p1,
+					const struct passwd *p2,
+					const char *comment)
+{
+	torture_assert_str_equal(tctx, p1->pw_name, p2->pw_name, comment);
+	torture_assert_str_equal(tctx, p1->pw_passwd, p2->pw_passwd, comment);
+	torture_assert_int_equal(tctx, p1->pw_uid, p2->pw_uid, comment);
+	torture_assert_int_equal(tctx, p1->pw_gid, p2->pw_gid, comment);
+	torture_assert_str_equal(tctx, p1->pw_gecos, p2->pw_gecos, comment);
+	torture_assert_str_equal(tctx, p1->pw_dir, p2->pw_dir, comment);
+	torture_assert_str_equal(tctx, p1->pw_shell, p2->pw_shell, comment);
+
+	return true;
+}
+
+static bool test_passwd(struct torture_context *tctx)
+{
+	int i;
+	struct passwd *pwd, pwd1, pwd2;
+	size_t num_pwd;
+
+	torture_assert(tctx, test_enum_passwd(tctx, &pwd, &num_pwd),
+					      "failed to enumerate passwd");
+
+	for (i=0; i < num_pwd; i++) {
+		torture_assert(tctx, test_getpwnam(tctx, pwd[i].pw_name, &pwd1),
+			"failed to call getpwnam for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd1,
+			"getpwent and getpwnam gave different results"),
+			__location__);
+		torture_assert(tctx, test_getpwuid(tctx, pwd[i].pw_uid, &pwd2),
+			"failed to call getpwuid for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd2,
+			"getpwent and getpwuid gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd1, &pwd2,
+			"getpwnam and getpwuid gave different results"),
+			__location__);
+	}
+
+	return true;
+}
+
+static bool test_passwd_r(struct torture_context *tctx)
+{
+	int i;
+	struct passwd *pwd, pwd1, pwd2;
+	size_t num_pwd;
+
+	torture_assert(tctx, test_enum_r_passwd(tctx, &pwd, &num_pwd),
+						"failed to enumerate passwd");
+
+	for (i=0; i < num_pwd; i++) {
+		torture_assert(tctx, test_getpwnam_r(tctx, pwd[i].pw_name, &pwd1),
+			"failed to call getpwnam_r for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd1,
+			"getpwent_r and getpwnam_r gave different results"),
+			__location__);
+		torture_assert(tctx, test_getpwuid_r(tctx, pwd[i].pw_uid, &pwd2),
+			"failed to call getpwuid_r for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd2,
+			"getpwent_r and getpwuid_r gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd1, &pwd2,
+			"getpwnam_r and getpwuid_r gave different results"),
+			__location__);
+	}
+
+	return true;
+}
+
+static bool test_passwd_r_cross(struct torture_context *tctx)
+{
+	int i;
+	struct passwd *pwd, pwd1, pwd2, pwd3, pwd4;
+	size_t num_pwd;
+
+	torture_assert(tctx, test_enum_r_passwd(tctx, &pwd, &num_pwd),
+						"failed to enumerate passwd");
+
+	for (i=0; i < num_pwd; i++) {
+		torture_assert(tctx, test_getpwnam_r(tctx, pwd[i].pw_name, &pwd1),
+			"failed to call getpwnam_r for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd1,
+			"getpwent_r and getpwnam_r gave different results"),
+			__location__);
+		torture_assert(tctx, test_getpwuid_r(tctx, pwd[i].pw_uid, &pwd2),
+			"failed to call getpwuid_r for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd2,
+			"getpwent_r and getpwuid_r gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd1, &pwd2,
+			"getpwnam_r and getpwuid_r gave different results"),
+			__location__);
+		torture_assert(tctx, test_getpwnam(tctx, pwd[i].pw_name, &pwd3),
+			"failed to call getpwnam for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd3,
+			"getpwent_r and getpwnam gave different results"),
+			__location__);
+		torture_assert(tctx, test_getpwuid(tctx, pwd[i].pw_uid, &pwd4),
+			"failed to call getpwuid for enumerated user");
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd[i], &pwd4,
+			"getpwent_r and getpwuid gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_passwd_equal(tctx, &pwd3, &pwd4,
+			"getpwnam and getpwuid gave different results"),
+			__location__);
+	}
+
+	return true;
+}
+
+static bool test_enum_group(struct torture_context *tctx,
+			    struct group **grp_array_p,
+			    size_t *num_grp_p)
+{
+	struct group *grp;
+	struct group *grp_array = NULL;
+	size_t num_grp = 0;
+
+	torture_comment(tctx, "Testing setgrent\n");
+	setgrent();
+
+	while ((grp = getgrent()) != NULL) {
+		torture_comment(tctx, "Testing getgrent\n");
+
+		print_group(grp);
+		if (grp_array_p && num_grp_p) {
+			grp_array = talloc_realloc(tctx, grp_array, struct group, num_grp+1);
+			torture_assert(tctx, grp_array, "out of memory");
+			copy_group(tctx, grp, &grp_array[num_grp]);
+			num_grp++;
+		}
+	}
+
+	torture_comment(tctx, "Testing endgrent\n");
+	endgrent();
+
+	if (grp_array_p) {
+		*grp_array_p = grp_array;
+	}
+	if (num_grp_p) {
+		*num_grp_p = num_grp;
+	}
+
+	return true;
+}
+
+static bool test_enum_r_group(struct torture_context *tctx,
+			      struct group **grp_array_p,
+			      size_t *num_grp_p)
+{
+	struct group grp, *grpp;
+	struct group *grp_array = NULL;
+	size_t num_grp = 0;
+	char buffer[4096];
+	int ret;
+
+	torture_comment(tctx, "Testing setgrent\n");
+	setgrent();
+
+#ifdef HAVE_GETGRENT_R /* getgrent_r not supported on macOS */
+	while (1) {
+		torture_comment(tctx, "Testing getgrent_r\n");
+
+#ifdef SOLARIS_GETGRENT_R
+		ret = getgrent_r(&grp, buffer, sizeof(buffer));
+#else /* SOLARIS_GETGRENT_R */
+		ret = getgrent_r(&grp, buffer, sizeof(buffer), &grpp);
+#endif /* SOLARIS_GETGRENT_R */
+		if (ret != 0) {
+			if (ret != ENOENT) {
+				torture_comment(tctx, "got %d return code\n", ret);
+			}
+			break;
+		}
+		print_group(&grp);
+		if (grp_array_p && num_grp_p) {
+			grp_array = talloc_realloc(tctx, grp_array, struct group, num_grp+1);
+			torture_assert(tctx, grp_array, "out of memory");
+			copy_group(tctx, &grp, &grp_array[num_grp]);
+			num_grp++;
+		}
+	}
+#endif /* getgrent_r not supported on macOS */
+
+	torture_comment(tctx, "Testing endgrent\n");
+	endgrent();
+
+	if (grp_array_p) {
+		*grp_array_p = grp_array;
+	}
+	if (num_grp_p) {
+		*num_grp_p = num_grp;
+	}
+
+	return true;
+}
+
+static bool torture_assert_group_equal(struct torture_context *tctx,
+				       const struct group *g1,
+				       const struct group *g2,
+				       const char *comment)
+{
+	int i;
+	torture_assert_str_equal(tctx, g1->gr_name, g2->gr_name, comment);
+	torture_assert_str_equal(tctx, g1->gr_passwd, g2->gr_passwd, comment);
+	torture_assert_int_equal(tctx, g1->gr_gid, g2->gr_gid, comment);
+	torture_assert(tctx, !(g1->gr_mem && !g2->gr_mem), __location__);
+	torture_assert(tctx, !(!g1->gr_mem && g2->gr_mem), __location__);
+	if (!g1->gr_mem && !g2->gr_mem) {
+		return true;
+	}
+	for (i=0; g1->gr_mem[i] && g2->gr_mem[i]; i++) {
+		torture_assert_str_equal(tctx, g1->gr_mem[i], g2->gr_mem[i], comment);
+	}
+
+	return true;
+}
+
+static bool test_group(struct torture_context *tctx)
+{
+	int i;
+	struct group *grp, grp1, grp2;
+	size_t num_grp;
+
+	torture_assert(tctx, test_enum_group(tctx, &grp, &num_grp),
+					     "failed to enumerate group");
+
+	for (i=0; i < num_grp; i++) {
+		torture_assert(tctx, test_getgrnam(tctx, grp[i].gr_name, &grp1),
+			"failed to call getgrnam for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp1,
+			"getgrent and getgrnam gave different results"),
+			__location__);
+		torture_assert(tctx, test_getgrgid(tctx, grp[i].gr_gid, &grp2),
+			"failed to call getgrgid for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp2,
+			"getgrent and getgrgid gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp1, &grp2,
+			"getgrnam and getgrgid gave different results"),
+			__location__);
+	}
+
+	return true;
+}
+
+static bool test_group_r(struct torture_context *tctx)
+{
+	int i;
+	struct group *grp, grp1, grp2;
+	size_t num_grp;
+
+	torture_assert(tctx, test_enum_r_group(tctx, &grp, &num_grp),
+					       "failed to enumerate group");
+
+	for (i=0; i < num_grp; i++) {
+		torture_assert(tctx, test_getgrnam_r(tctx, grp[i].gr_name, &grp1),
+			"failed to call getgrnam_r for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp1,
+			"getgrent_r and getgrnam_r gave different results"),
+			__location__);
+		torture_assert(tctx, test_getgrgid_r(tctx, grp[i].gr_gid, &grp2),
+			"failed to call getgrgid_r for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp2,
+			"getgrent_r and getgrgid_r gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp1, &grp2,
+			"getgrnam_r and getgrgid_r gave different results"),
+			__location__);
+	}
+
+	return true;
+}
+
+static bool test_group_r_cross(struct torture_context *tctx)
+{
+	int i;
+	struct group *grp, grp1, grp2, grp3, grp4;
+	size_t num_grp;
+
+	torture_assert(tctx, test_enum_r_group(tctx, &grp, &num_grp),
+					       "failed to enumerate group");
+
+	for (i=0; i < num_grp; i++) {
+		torture_assert(tctx, test_getgrnam_r(tctx, grp[i].gr_name, &grp1),
+			"failed to call getgrnam_r for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp1,
+			"getgrent_r and getgrnam_r gave different results"),
+			__location__);
+		torture_assert(tctx, test_getgrgid_r(tctx, grp[i].gr_gid, &grp2),
+			"failed to call getgrgid_r for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp2,
+			"getgrent_r and getgrgid_r gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp1, &grp2,
+			"getgrnam_r and getgrgid_r gave different results"),
+			__location__);
+		torture_assert(tctx, test_getgrnam(tctx, grp[i].gr_name, &grp3),
+			"failed to call getgrnam for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp3,
+			"getgrent_r and getgrnam gave different results"),
+			__location__);
+		torture_assert(tctx, test_getgrgid(tctx, grp[i].gr_gid, &grp4),
+			"failed to call getgrgid for enumerated user");
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp[i], &grp4,
+			"getgrent_r and getgrgid gave different results"),
+			__location__);
+		torture_assert(tctx, torture_assert_group_equal(tctx, &grp3, &grp4,
+			"getgrnam and getgrgid gave different results"),
+			__location__);
+	}
+
+	return true;
+}
+
+#ifdef HAVE_GETGROUPLIST
+static bool test_getgrouplist(struct torture_context *tctx,
+			      const char *user,
+			      gid_t gid,
+			      gid_t **gids_p,
+			      int *num_gids_p)
+{
+	int ret;
+	int num_groups = 0;
+	gid_t *groups = NULL;
+
+	torture_comment(tctx, "Testing getgrouplist: %s\n", user);
+
+	ret = getgrouplist(user, gid, NULL, &num_groups);
+	if (ret == -1 || num_groups != 0) {
+
+		groups = talloc_array(tctx, gid_t, num_groups);
+		torture_assert(tctx, groups, "out of memory\n");
+
+		ret = getgrouplist(user, gid, groups, &num_groups);
+	}
+
+	torture_assert(tctx, (ret != -1), "failed to call getgrouplist");
+
+	torture_comment(tctx, "%s is member in %d groups\n", user, num_groups);
+
+	if (gids_p) {
+		*gids_p = groups;
+	}
+	if (num_gids_p) {
+		*num_gids_p = num_groups;
+	}
+
+	return true;
+}
+#endif /* HAVE_GETGROUPLIST */
+
+static bool test_user_in_group(struct torture_context *tctx,
+			       const struct passwd *pwd,
+			       const struct group *grp)
+{
+	int i;
+
+	for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) {
+		if (strequal(grp->gr_mem[i], pwd->pw_name)) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
+static bool test_membership_user(struct torture_context *tctx,
+				 const struct passwd *pwd,
+				 struct group *grp_array,
+				 size_t num_grp)
+{
+	int num_user_groups = 0;
+	int num_user_groups_from_enum = 0;
+	gid_t *user_groups = NULL;
+	int g, i;
+	bool primary_group_had_user_member = false;
+
+	/*
+	 * For the local users ('LOCALADMEMBER') below, the test fails.
+	 * wb_queryuser() wrongly defaults the group sid to RID 513 i.e.
+	 * 'LOCALADMEMBER/domusers', but those users have a different group sid.
+	 *
+	 * The fix for wb_queryuser() is not part of this MR. It is a complex
+	 * task that needs to fill samlogon cache using S4USelf and will come
+	 * sometime later. Once wb_queryuser() gets fixed, this can be removed.
+	 */
+	if (strcmp(pwd->pw_name, "user1") == 0 ||
+	    strcmp(pwd->pw_name, "user2") == 0 ||
+	    strcmp(pwd->pw_name, "force_user") == 0 || pwd->pw_uid == 1000) {
+		return true;
+	}
+
+#ifdef HAVE_GETGROUPLIST
+	torture_assert(tctx, test_getgrouplist(tctx,
+					       pwd->pw_name,
+					       pwd->pw_gid,
+					       &user_groups,
+					       &num_user_groups),
+					       "failed to test getgrouplist");
+#endif /* HAVE_GETGROUPLIST */
+
+	for (g=0; g < num_user_groups; g++) {
+		torture_assert(tctx, test_getgrgid(tctx, user_groups[g], NULL),
+			"failed to find the group the user is a member of");
+	}
+
+
+	for (i=0; i < num_grp; i++) {
+
+		struct group grp = grp_array[i];
+
+		if (test_user_in_group(tctx, pwd, &grp)) {
+
+			struct group current_grp;
+			num_user_groups_from_enum++;
+
+			torture_assert(tctx, test_getgrnam(tctx, grp.gr_name, &current_grp),
+					"failed to find the group the user is a member of");
+
+			if (current_grp.gr_gid == pwd->pw_gid) {
+				torture_comment(tctx, "primary group %s of user %s lists user as member\n",
+						current_grp.gr_name,
+						pwd->pw_name);
+				primary_group_had_user_member = true;
+			}
+
+			continue;
+		}
+	}
+
+	if (!primary_group_had_user_member) {
+		num_user_groups_from_enum++;
+	}
+
+	torture_assert_int_equal(tctx, num_user_groups, num_user_groups_from_enum,
+		"getgrouplist and real inspection of grouplist gave different results\n");
+
+	return true;
+}
+
+static bool test_membership(struct torture_context *tctx)
+{
+	const char *old_pwd = getenv("NSS_WRAPPER_PASSWD");
+	const char *old_group = getenv("NSS_WRAPPER_GROUP");
+	struct passwd *pwd;
+	size_t num_pwd;
+	struct group *grp;
+	size_t num_grp;
+	int i;
+	const char *env = getenv("ENVNAME");
+
+	if (!old_pwd || !old_group) {
+		torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n");
+		torture_skip(tctx, "nothing to test\n");
+	}
+
+	/*
+	 * test_membership_user() fails for ad_dc with error like this:
+	 *
+	 * WARNING!: ../../source4/torture/local/nss_tests.c:823:
+	 * num_user_groups was 3 (0x3), expected 2 (0x2): getgrouplist
+	 * and real inspection of grouplist gave different results
+
+	 * There are at least 3 reasons:
+
+	 * 1. For each ADDOMAIN user, there is also a group with the same name:
+
+$ bin/wbinfo --user-info ADDOMAIN/alice
+ADDOMAIN/alice:*:3000015:65531::/home/ADDOMAIN/alice:/bin/false
+
+$ bin/wbinfo --group-info ADDOMAIN/alice
+ADDOMAIN/alice:x:3000015:ADDOMAIN/alice
+
+	 * 2. ADDOMAIN/joe is the only user of "ADDOMAIN/Domain Users"
+	 * e.g. alice is not there:
+
+$ bin/wbinfo --group-info "ADDOMAIN/Domain users"
+ADDOMAIN/domain users:x:65531:ADDOMAIN/joe
+
+	 * 3. getgrouplist() for joe returns also "ADDOMAIN/samba users"
+	 * but "ADDOMAIN/samba users" is an empty group:
+
+$ bin/wbinfo --group-info "ADDOMAIN/samba users"
+ADDOMAIN/samba users:x:3000051:
+
+	 */
+
+	/* Only ad_member_idmap_rid sets 'winbind expand groups' */
+	if (strcmp(env, "ad_member_idmap_rid:local") != 0) {
+		torture_comment(tctx,
+				"Testing in env '%s' is not supported.\n",
+				env);
+		torture_skip(tctx, "nothing to test\n");
+		return true;
+	}
+
+	torture_assert(tctx, test_enum_passwd(tctx, &pwd, &num_pwd),
+					      "failed to enumerate passwd");
+	torture_assert(tctx, test_enum_group(tctx, &grp, &num_grp),
+					     "failed to enumerate group");
+
+	for (i=0; i < num_pwd; i++) {
+
+		torture_assert(tctx, test_membership_user(tctx, &pwd[i], grp, num_grp),
+			"failed to test membership for user");
+
+	}
+
+	return true;
+}
+
+static bool test_enumeration(struct torture_context *tctx)
+{
+	const char *old_pwd = getenv("NSS_WRAPPER_PASSWD");
+	const char *old_group = getenv("NSS_WRAPPER_GROUP");
+
+	if (!old_pwd || !old_group) {
+		torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n");
+		torture_skip(tctx, "nothing to test\n");
+	}
+
+	torture_assert(tctx, test_passwd(tctx),
+			"failed to test users");
+	torture_assert(tctx, test_group(tctx),
+			"failed to test groups");
+
+	return true;
+}
+
+static bool test_reentrant_enumeration(struct torture_context *tctx)
+{
+	const char *old_pwd = getenv("NSS_WRAPPER_PASSWD");
+	const char *old_group = getenv("NSS_WRAPPER_GROUP");
+
+	if (!old_pwd || !old_group) {
+		torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n");
+		torture_skip(tctx, "nothing to test\n");
+	}
+
+	torture_comment(tctx, "Testing re-entrant calls\n");
+
+	torture_assert(tctx, test_passwd_r(tctx),
+			"failed to test users");
+	torture_assert(tctx, test_group_r(tctx),
+			"failed to test groups");
+
+	return true;
+}
+
+static bool test_reentrant_enumeration_crosschecks(struct torture_context *tctx)
+{
+	const char *old_pwd = getenv("NSS_WRAPPER_PASSWD");
+	const char *old_group = getenv("NSS_WRAPPER_GROUP");
+
+	if (!old_pwd || !old_group) {
+		torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n");
+		torture_skip(tctx, "nothing to test\n");
+	}
+
+	torture_comment(tctx, "Testing re-entrant calls with cross checks\n");
+
+	torture_assert(tctx, test_passwd_r_cross(tctx),
+			"failed to test users");
+	torture_assert(tctx, test_group_r_cross(tctx),
+			"failed to test groups");
+
+	return true;
+}
+
+static bool test_passwd_duplicates(struct torture_context *tctx)
+{
+	size_t i, d;
+	struct passwd *pwd;
+	size_t num_pwd;
+	int duplicates = 0;
+
+	torture_assert(tctx, test_enum_passwd(tctx, &pwd, &num_pwd),
+	    "failed to enumerate passwd");
+
+	for (i=0; i < num_pwd; i++) {
+		const char *current_name = pwd[i].pw_name;
+		for (d=0; d < num_pwd; d++) {
+			const char *dup_name = pwd[d].pw_name;
+			if (d == i) {
+				continue;
+			}
+			if (!strequal(current_name, dup_name)) {
+				continue;
+			}
+
+			torture_warning(tctx, "found duplicate names:");
+			print_passwd(&pwd[d]);
+			print_passwd(&pwd[i]);
+			duplicates++;
+		}
+	}
+
+	if (duplicates) {
+		torture_fail(tctx, talloc_asprintf(tctx, "found %d duplicate names", duplicates));
+	}
+
+	return true;
+}
+
+static bool test_group_duplicates(struct torture_context *tctx)
+{
+	size_t i, d;
+	struct group *grp;
+	size_t num_grp;
+	int duplicates = 0;
+
+	torture_assert(tctx, test_enum_group(tctx, &grp, &num_grp),
+		"failed to enumerate group");
+
+	for (i=0; i < num_grp; i++) {
+		const char *current_name = grp[i].gr_name;
+		for (d=0; d < num_grp; d++) {
+			const char *dup_name = grp[d].gr_name;
+			if (d == i) {
+				continue;
+			}
+			if (!strequal(current_name, dup_name)) {
+				continue;
+			}
+
+			torture_warning(tctx, "found duplicate names:");
+			print_group(&grp[d]);
+			print_group(&grp[i]);
+			duplicates++;
+		}
+	}
+
+	if (duplicates) {
+		torture_fail(tctx, talloc_asprintf(tctx, "found %d duplicate names", duplicates));
+	}
+
+	return true;
+}
+
+
+static bool test_duplicates(struct torture_context *tctx)
+{
+	const char *old_pwd = getenv("NSS_WRAPPER_PASSWD");
+	const char *old_group = getenv("NSS_WRAPPER_GROUP");
+
+	if (!old_pwd || !old_group) {
+		torture_comment(tctx, "ENV NSS_WRAPPER_PASSWD or NSS_WRAPPER_GROUP not set\n");
+		torture_skip(tctx, "nothing to test\n");
+	}
+
+	torture_assert(tctx, test_passwd_duplicates(tctx),
+			"failed to test users");
+	torture_assert(tctx, test_group_duplicates(tctx),
+			"failed to test groups");
+
+	return true;
+}
+
+
+struct torture_suite *torture_local_nss(TALLOC_CTX *mem_ctx)
+{
+	struct torture_suite *suite = torture_suite_create(mem_ctx, "nss");
+
+	torture_suite_add_simple_test(suite, "enumeration", test_enumeration);
+	torture_suite_add_simple_test(suite, "reentrant enumeration", test_reentrant_enumeration);
+	torture_suite_add_simple_test(suite, "reentrant enumeration crosschecks", test_reentrant_enumeration_crosschecks);
+	torture_suite_add_simple_test(suite, "membership", test_membership);
+	torture_suite_add_simple_test(suite, "duplicates", test_duplicates);
+
+	return suite;
+}
diff --git a/source4/torture/local/smbtorture_fullname.c b/source4/torture/local/smbtorture_fullname.c
new file mode 100644
index 0000000..875b3cf
--- /dev/null
+++ b/source4/torture/local/smbtorture_fullname.c
@@ -0,0 +1,31 @@
+#include "includes.h"
+#include "torture/smbtorture.h"
+#include "torture/local/proto.h"
+
+static bool test_smbtorture_always_pass(struct torture_context *tctx)
+{
+	return true;
+}
+
+struct torture_suite *torture_local_smbtorture(TALLOC_CTX *ctx)
+{
+	struct torture_suite *suite = torture_suite_create(ctx, "smbtorture");
+	struct torture_suite *suite_level1 = torture_suite_create(ctx,
+								   "level1");
+	struct torture_suite *suite_level2 = torture_suite_create(ctx,
+								   "level2");
+	struct torture_suite *suite_level3 = torture_suite_create(ctx,
+								  "level3");
+
+	torture_suite_add_suite(suite_level2, suite_level3);
+	torture_suite_add_suite(suite_level1, suite_level2);
+	torture_suite_add_suite(suite, suite_level1);
+
+	torture_suite_add_simple_test(suite_level3, "always_pass",
+				     test_smbtorture_always_pass);
+
+	suite->description = talloc_strdup(suite,
+				"smbtorture multilevel always pass test.");
+
+	return suite;
+}
diff --git a/source4/torture/local/torture.c b/source4/torture/local/torture.c
new file mode 100644
index 0000000..ca59ebf
--- /dev/null
+++ b/source4/torture/local/torture.c
@@ -0,0 +1,85 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   local testing of torture
+
+   Copyright (C) Jelmer Vernooij 2006
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "system/wait.h"
+#include "libcli/raw/libcliraw.h"
+#include "torture/util.h"
+#include "torture/local/proto.h"
+#include "param/provision.h"
+
+static bool test_tempdir(struct torture_context *tctx)
+{
+	char *location = NULL;
+	TALLOC_CTX *mem_ctx = tctx;
+	
+	torture_assert_ntstatus_ok(tctx, torture_temp_dir(mem_ctx, "tempdir", &location), 
+								"torture_temp_dir should return NT_STATUS_OK" );
+
+	torture_assert(tctx, directory_exist(location), 
+				   "created dir doesn't exist");
+	return true;
+}
+
+static bool test_provision(struct torture_context *tctx)
+{
+	NTSTATUS status;
+	struct provision_settings *settings = talloc_zero(tctx, struct provision_settings);
+	struct provision_result result;
+	char *targetdir = NULL;
+
+	torture_assert_ntstatus_ok(tctx, torture_temp_dir(tctx, "torture_provision", &targetdir), 
+				   "torture_temp_dir should return NT_STATUS_OK" );
+	settings->targetdir = talloc_steal(settings, targetdir);
+
+	settings->site_name = "SOME-SITE-NAME";
+	settings->root_dn_str = "DC=EXAMPLE,DC=COM";
+	settings->domain_dn_str = "DC=EXAMPLE,DC=COM";
+	settings->config_dn_str = NULL;
+	settings->schema_dn_str = NULL;
+	settings->invocation_id = NULL;
+	settings->netbios_name = "FOO";
+	settings->realm = "EXAMPLE.COM";
+	settings->domain = "EXAMPLE";
+	settings->netbios_name = "torture";
+	settings->ntds_dn_str = NULL;
+	settings->machine_password = "geheim";
+	settings->use_ntvfs = true;
+
+	status = provision_bare(settings, tctx->lp_ctx, settings, &result);
+			
+	torture_assert_ntstatus_ok(tctx, status, "provision");
+
+	torture_assert_str_equal(tctx, result.domaindn, "DC=EXAMPLE,DC=COM", 
+				 "domaindn incorrect");
+
+	return true;
+}
+
+struct torture_suite *torture_local_torture(TALLOC_CTX *mem_ctx)
+{
+	struct torture_suite *suite = torture_suite_create(mem_ctx, "torture");
+
+	torture_suite_add_simple_test(suite, "tempdir", test_tempdir);
+	torture_suite_add_simple_test(suite, "provision", test_provision);
+
+	return suite;
+}
diff --git a/source4/torture/local/verif_trailer.c b/source4/torture/local/verif_trailer.c
new file mode 100644
index 0000000..acbd69b
--- /dev/null
+++ b/source4/torture/local/verif_trailer.c
@@ -0,0 +1,99 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   test suite for DCE/RPC verification trailer parsing
+
+   Copyright (C) David Disseldorp 2014
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include <unistd.h>
+
+#include "librpc/gen_ndr/security.h"
+#include "lib/param/param.h"
+#include "lib/util/dlinklist.h"
+#include "libcli/resolve/resolve.h"
+#include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "librpc/rpc/rpc_common.h"
+#include "torture/torture.h"
+#include "torture/local/proto.h"
+
+/* VT blob obtained from an FSRVP request */
+uint8_t test_vt[] = {0x8a, 0xe3, 0x13, 0x71, 0x02, 0xf4, 0x36, 0x71,
+		     0x02, 0x40, 0x28, 0x00, 0x3c, 0x65, 0xe0, 0xa8,
+		     0x44, 0x27, 0x89, 0x43, 0xa6, 0x1d, 0x73, 0x73,
+		     0xdf, 0x8b, 0x22, 0x92, 0x01, 0x00, 0x00, 0x00,
+		     0x33, 0x05, 0x71, 0x71, 0xba, 0xbe, 0x37, 0x49,
+		     0x83, 0x19, 0xb5, 0xdb, 0xef, 0x9c, 0xcc, 0x36,
+		     0x01, 0x00, 0x00, 0x00};
+
+const char *vt_abstr_syntax = "a8e0653c-2744-4389-a61d-7373df8b2292/0x00000001";
+const char *vt_trans_syntax = "71710533-beba-4937-8319-b5dbef9ccc36/0x00000001";
+
+static bool test_verif_trailer_pctx(struct torture_context *tctx)
+{
+	DATA_BLOB blob;
+	bool ok;
+	struct dcerpc_sec_vt_pcontext pctx;
+	struct dcerpc_sec_verification_trailer *vt = NULL;
+	struct ndr_pull *ndr;
+	enum ndr_err_code ndr_err;
+	struct ndr_print *ndr_print;
+	TALLOC_CTX *mem_ctx = talloc_new(tctx);
+	torture_assert(tctx, mem_ctx != NULL, "mem");
+
+	blob.data = test_vt;
+	blob.length = ARRAY_SIZE(test_vt);
+
+	ndr = ndr_pull_init_blob(&blob, mem_ctx);
+	torture_assert(tctx, ndr != NULL, "ndr");
+
+	ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr, mem_ctx, &vt);
+	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr");
+
+	ndr_print = talloc_zero(mem_ctx, struct ndr_print);
+	torture_assert(tctx, ndr_print != NULL, "mem");
+	ndr_print->print = ndr_print_printf_helper;
+	ndr_print->depth = 1;
+
+	ndr_print_dcerpc_sec_verification_trailer(ndr_print,
+						  "Verification Trailer", vt);
+
+	ZERO_STRUCT(pctx);
+	ok = ndr_syntax_id_from_string(vt_abstr_syntax, &pctx.abstract_syntax);
+	torture_assert(tctx, ok, "vt_abstr_syntax");
+	ok = ndr_syntax_id_from_string(vt_trans_syntax, &pctx.transfer_syntax);
+	torture_assert(tctx, ok, "vt_trans_syntax");
+
+	ok = dcerpc_sec_verification_trailer_check(vt, NULL, &pctx, NULL);
+	torture_assert(tctx, ok, "VT check");
+
+	talloc_free(mem_ctx);
+
+	return true;
+}
+
+struct torture_suite *torture_local_verif_trailer(TALLOC_CTX *mem_ctx)
+{
+	struct torture_suite *suite = torture_suite_create(mem_ctx,
+							   "verif_trailer");
+
+	torture_suite_add_simple_test(suite,
+				      "pctx",
+				      test_verif_trailer_pctx);
+
+	return suite;
+}
diff --git a/source4/torture/local/wscript_build b/source4/torture/local/wscript_build
new file mode 100644
index 0000000..741f667
--- /dev/null
+++ b/source4/torture/local/wscript_build
@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+
+provision = bld.pyembed_libname('PROVISION')
+
+TORTURE_LOCAL_SOURCE = '''../../../lib/util/charset/tests/iconv.c
+	../../../lib/talloc/testsuite.c ../../lib/messaging/tests/messaging.c
+	../../lib/messaging/tests/irpc.c ../../librpc/tests/binding_string.c
+	../../../lib/util/tests/idtree.c ../../../lib/util/tests/dlinklist.c
+	../../lib/socket/testsuite.c ../../libcli/resolve/testsuite.c
+	../../../lib/util/tests/strlist.c ../../../lib/util/tests/binsearch.c
+	../../../lib/util/tests/str.c ../../../lib/util/tests/time.c
+	../../../lib/util/tests/asn1_tests.c ../../../lib/util/tests/data_blob.c
+	../../../lib/util/tests/file.c ../../../lib/util/tests/genrand.c
+        ../../../lib/util/charset/tests/charset.c
+        ../../../lib/util/charset/tests/convert_string.c
+        ../../../lib/util/charset/tests/util_unistr.c
+	../../../lib/tdr/testsuite.c
+	../../../lib/tevent/testsuite.c ../../param/tests/share.c
+        ../../../lib/tevent/test_req.c
+	../../param/tests/loadparm.c local.c
+	dbspeed.c torture.c ../ldb/ldb.c ../../dsdb/common/tests/dsdb_dn.c
+	../../dsdb/schema/tests/schema_syntax.c
+	../../../lib/util/tests/anonymous_shared.c
+	../../../lib/util/tests/strv.c
+	../../../lib/util/tests/strv_util.c
+	../../../lib/util/tests/util.c
+	../../../lib/util/tests/util_str_escape.c
+	../../../lib/util/tests/tfork.c
+	verif_trailer.c
+	nss_tests.c
+        mdspkt.c
+	fsrvp_state.c
+	smbtorture_fullname.c'''
+
+TORTURE_LOCAL_DEPS = 'RPC_NDR_ECHO TDR LIBCLI_SMB MESSAGING iconv TORTURE_AUTH TORTURE_UTIL TORTURE_NDR TORTURE_LIBCRYPTO share torture_registry %s ldb samdb replace-test RPC_FSS_STATE util_str_escape' % provision
+
+bld.SAMBA_MODULE('TORTURE_LOCAL',
+	source=TORTURE_LOCAL_SOURCE,
+	autoproto='proto.h',
+	subsystem='smbtorture',
+	init_function='torture_local_init',
+	deps=TORTURE_LOCAL_DEPS,
+	internal_module=True,
+	enabled=bld.PYTHON_BUILD_IS_ENABLED()
+	)