kwarn - zygaena/hammerhead

root / base / usr / src / cmd / krb5 / kwarn
kwarn Plain Text 2912 lines 64.7 KB
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#

#
# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# Copyright 2020 Joyent, Inc.

TESTPROG = kwarndtest

PROG= ktkt_warnd
MANIFEST=	ktkt_warn.xml

KWARNDOBJS = kwarnd.o kwarnd_svc.o kwarnd_proc.o kwarnd_generic.o kwarnd_send.o
KWARNTOBJS = kwarndtest.o

G_OBJS   = kwarnd_xdr.o

OBJS	= $(KWARNDOBJS) $(KWARNTOBJS) $(G_OBJS)
SRCS	= $(OBJS:.o=.c)
RSRC	= kwarnd_xdr.c kwarnd_svc.c kwarnd.h

CLOBBERFILES += $(TESTPROG)

include ../../Makefile.cmd
include $(SRC)/lib/gss_mechs/mech_krb5/Makefile.mech_krb5

ROOTMANIFESTDIR=	$(ROOTSVCNETWORKSECURITY)

POFILE = $(PROG).po
POFILES = generic.po

CPPFLAGS +=	-D_REENTRANT

CERRWARN +=	-Wno-unused-variable
CERRWARN +=	-Wno-unused-function
CERRWARN +=	-Wno-implicit-function-declaration
CERRWARN +=	-Wno-parentheses

# not linted
SMATCH=off

CPPFLAGS += -I../../lib/gss_mechs/mech_krb5/include \
                 -I$(SRC)/lib/gss_mechs/mech_krb5 \
                 -I$(SRC)/lib/gss_mechs/mech_krb5/include \
                 -I$(SRC)/uts/common/gssapi/mechs/krb5/include

ktkt_warnd :	MAPFILES =	$(MAPFILE.INT) $(MAPFILE.NGB)
ktkt_warnd :	LDFLAGS +=	$(KRUNPATH) $(MAPFILES:%=-Wl,-M%)
ktkt_warnd :	LDLIBS +=	-lnsl

LDFLAGS +=	$(KRUNPATH)
LDLIBS +=	$(KMECHLIB)

.KEEP_STATE:

all: $(PROG) $(TESTPROG)

$(PROG):	$(G_OBJS) $(KWARNDOBJS) $$(MAPFILES)
	$(LINK.c) $(KWARNDOBJS) $(G_OBJS) -o $@ $(LDLIBS)
	$(POST_PROCESS)

# the client entry points (kwarn_*_warning) are now avail in mech_krb5.so
$(TESTPROG):    $(KWARNTOBJS)
	$(LINK.c) $(KWARNTOBJS) -o $@ $(LDLIBS)
	$(POST_PROCESS)

# Hammerhead: pre-generated (rpcgen + GNU cpp truncation bug)
# kwarnd.h, kwarnd_svc.c, kwarnd_xdr.c are now committed source files.

$(OBJS): kwarnd.h

# note that nightly depends on having all of the derived
# .c files built here on 'make install', even though this
# module doesn't use all of those files.
install: $(KRB5LIBPROG) $(RSRC) $(ROOTMANIFEST)

check:	$(CHKMANIFEST)

clean:
	$(RM) $(OBJS)
	@# Hammerhead: do not delete pre-generated $(RSRC)

include ../../Makefile.targ

#additional dependencies

$(LIBRARY) : $(OBJS)
$(DYNLIB) : $(PICS)

FRC:

$(POFILE): $(DERIVED_FILES) .WAIT $(POFILES)
	$(RM) $@
	$(CAT) $(POFILES) > $@

generic.po: FRC
	$(RM) messages.po
	$(XGETTEXT) $(XGETFLAGS) `$(GREP) -l gettext *.[ch]`
	$(SED) "/^domain/d" messages.po > $@
	$(RM) messages.po
<?xml version='1.0'?>
<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
<!--
	Copyright 2015 Nexenta Systems, Inc.  All rights reserved.

	Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
	Use is subject to license terms.

	NOTE:  This service manifest is not editable; its contents will
	be overwritten by package or patch operations, including
	operating system upgrade.  Make customizations in a different
	file.

	Service manifest for the Kerberos V5 warning messages daemon
-->

<service_bundle type='manifest' name='SUNWkrbr:kwarn'>

<service
	name='network/security/ktkt_warn'
	type='service'
	version='1'>

	<create_default_instance enabled='false' />

	<restarter>
		<service_fmri value='svc:/network/inetd:default' />
	</restarter>

	<dependency name='rpcbind'
	    grouping='require_all'
	    restart_on='restart'
	    type='service'>
		<service_fmri value='svc:/network/rpc/bind' />
	</dependency>

	<exec_method
		type='method'
		name='inetd_start'
		exec='/usr/lib/krb5/ktkt_warnd'
		timeout_seconds='0'>
		<method_context working_directory='/'>
			<method_credential
				user='root'
				group='other'
				privileges='basic,!file_link_any,!proc_info,!proc_session,proc_setid,file_chown,file_dac_read,file_dac_write'
			/>
		</method_context>
	</exec_method>

	<exec_method
		type='method'
		name='inetd_offline'
		exec=':kill_process'
		timeout_seconds='0'>
	</exec_method>

	<exec_method
		type='method'
		name='inetd_disable'
		exec=':kill'
		timeout_seconds='0'>
	</exec_method>

	<property_group name='inetd' type='framework'>
		<propval name='name' type='astring' value='100134' />
		<propval name='endpoint_type' type='astring' value='tli' />
		<propval name='proto' type='astring' value='ticotsord' />
		<propval name='wait' type='boolean' value='true' />
		<propval name='isrpc' type='boolean' value='true' />
		<propval name='rpc_low_version' type='integer' value='1' />
		<propval name='rpc_high_version' type='integer' value='1' />
	</property_group>

	<stability value='Unstable' />

	<template>
		<common_name>
			<loctext xml:lang='C'>
			Kerberos V5 warning messages daemon
			</loctext>
		</common_name>
		<documentation>
			<manpage title='ktkt_warnd' section='8'
			    manpath='/usr/share/man' />
		</documentation>
	</template>
</service>

</service_bundle>
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Usermode daemon which is responsible for sending kerberos credentials
 * expiration warnings to the user, syslog or snmp (eventually), depending
 * on how it is configured through /etc/krb5/warn.conf.
 * the code in this file was borrowed from gssd.c
 */

#include <stdio.h>
#include <rpc/rpc.h>
#include <sys/syslog.h>
#include <sys/termios.h>
#include <unistd.h>
#include <sys/resource.h>
#include <sys/utsname.h>
#include <sys/systeminfo.h>
#include <stdlib.h>
#include <stropts.h>
#include <fcntl.h>
#include <strings.h>
#include <syslog.h>
#include <thread.h>
#include <netdb.h>
#include <libgen.h>
#include "kwarnd.h"

#define	MAXTHREADS 64

int kwarnd_debug = 0;		/* enable debugging printfs */

extern void kwarnprog_1(struct svc_req *, register SVCXPRT *);
static void usage(void);
static void detachfromtty(void);
extern int svc_create_local_service(void (*) (),
					ulong_t, ulong_t, char *, char *);
extern void kwarnd_check_warning_list(void);
extern bool_t loadConfigFile(void);

/* following declarations needed in rpcgen-generated code */
int _rpcpmstart = 0;		/* Started by a port monitor ? */
int _rpcfdtype;			/* Whether Stream or Datagram ? */
int _rpcsvcdirty;		/* Still serving ? */
mutex_t _svcstate_lock = ERRORCHECKMUTEX;

char myhostname[MAXHOSTNAMELEN] = {0};
char progname[MAXNAMELEN] = {0};


int
main(int argc, char **argv)
{
	SVCXPRT *transp;
	extern int optind;
	int c;
	char mname[FMNAMESZ + 1];
	int rpc_svc_mode = RPC_SVC_MT_AUTO;

	/* set locale and domain for internationalization */
	setlocale(LC_ALL, "");

#if !defined(TEXT_DOMAIN)
#define	TEXT_DOMAIN "SYS_TEST"
#endif

	textdomain(TEXT_DOMAIN);

	(void) strlcpy(progname, basename(argv[0]), sizeof (progname));

	/*
	 * Take special note that "getuid()" is called here.  This call is used
	 * rather that app_krb5_user_uid(), to ensure ktkt_warnd(8) is running
	 * as root.
	 */
#ifdef DEBUG
	(void) setuid(0);		/* DEBUG: set ruid to root */
#endif /* DEBUG */
	if (getuid()) {
		(void) fprintf(stderr,
		    gettext("[%s] must be run as root\n"), argv[0]);
#ifdef DEBUG
		(void) fprintf(stderr, gettext(" warning only\n"));
#else /* !DEBUG */
		exit(1);
#endif /* DEBUG */
	}

	while ((c = getopt(argc, argv, "d")) != -1)
		switch (c) {
		case 'd':
			/* turn on debugging */
			kwarnd_debug = 1;
			break;
		default:
			usage();
		}

	if (optind != argc) {
		usage();
	}

	(void) gethostname(myhostname, sizeof (myhostname));

	/*
	 * Started by inetd if name of module just below stream
	 * head is either a sockmod or timod.
	 */
	if (!ioctl(0, I_LOOK, mname) && ((strcmp(mname, "sockmod") == 0) ||
	    (strcmp(mname, "timod") == 0))) {
		char *netid;
		struct netconfig *nconf;

		openlog("kwarnd", LOG_PID, LOG_DAEMON);

		if ((netid = getenv("NLSPROVIDER")) ==  NULL) {
			netid = "ticotsord";
		}

		if ((nconf = getnetconfigent(netid)) == NULL) {
			syslog(LOG_ERR, gettext("cannot get transport info"));
			exit(1);
		}

		if (strcmp(mname, "sockmod") == 0) {
			if (ioctl(0, I_POP, 0) || ioctl(0, I_PUSH, "timod")) {
				syslog(LOG_ERR, gettext("could not get the "
				    "right module"));
				exit(1);
			}
		}

		/* XXX - is nconf even needed here? */
		if ((transp = svc_tli_create(0, nconf, NULL, 0, 0)) == NULL) {
			syslog(LOG_ERR, gettext("cannot create server handle"));
			exit(1);
		}

		/*
		 * We use a NULL nconf because KWARNPROG has already been
		 * registered with rpcbind.
		 */
		if (!svc_reg(transp, KWARNPROG, KWARNVERS, kwarnprog_1, NULL)) {
			syslog(LOG_ERR, gettext("unable to register "
			    "(KWARNPROG, KWARNVERS)"));
			exit(1);
		}

		if (nconf)
			freenetconfigent(nconf);
	} else {

		if (!kwarnd_debug)
			detachfromtty();

		openlog("kwarnd", LOG_PID, LOG_DAEMON);

		if (svc_create_local_service(kwarnprog_1, KWARNPROG, KWARNVERS,
		    "netpath", "kwarnd") == 0) {
			syslog(LOG_ERR, gettext("unable to create service"));
			exit(1);
		}
	}


	if (kwarnd_debug) {
		fprintf(stderr,
		    gettext("kwarnd start: \n"));
	}

	(void) signal(SIGCHLD, SIG_IGN);

	if (thr_create(NULL, 0,
	    (void *(*)(void *))kwarnd_check_warning_list, NULL,
	    THR_DETACHED | THR_DAEMON | THR_NEW_LWP, NULL)) {
		syslog(LOG_ERR,
		    gettext("unable to create cache_cleanup thread"));
		exit(1);
	}

	if (!loadConfigFile()) {
		syslog(LOG_ERR, gettext("could not read config file\n"));
		exit(1);
	}

	if (!rpc_control(RPC_SVC_MTMODE_SET, &rpc_svc_mode)) {
		syslog(LOG_ERR, gettext("unable to set automatic MT mode"));
		exit(1);
	}

	svc_run();
	abort();
	/*NOTREACHED*/
#ifdef	lint
	return (1);
#endif
}

static void
usage(void)
{
	(void) fprintf(stderr, gettext("usage: %s [-d]\n"), progname);
	exit(1);
}


/*
 * detach from tty
 */
static void
detachfromtty(void)
{
	switch (fork()) {
	case -1:
		perror(gettext("kwarnd: can not fork"));
		exit(1);
		/*NOTREACHED*/
	case 0:
		break;
	default:
		exit(0);
	}

	/*
	 * Close existing file descriptors, open "/dev/null" as
	 * standard input, output, and error, and detach from
	 * controlling terminal.
	 */
	closefrom(0);
	(void) open("/dev/null", O_RDONLY);
	(void) open("/dev/null", O_WRONLY);
	(void) dup(1);
	(void) setsid();
}

/*ARGSUSED*/
int
kwarnprog_1_freeresult(SVCXPRT *transport, xdrproc_t xdr_res, caddr_t res)
{
	xdr_free(xdr_res, res);
	return (1);
}
/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#ifndef _KWARND_H_RPCGEN
#define	_KWARND_H_RPCGEN

#include <rpc/rpc.h>
#ifndef _KERNEL
#include <synch.h>
#include <thread.h>
#endif /* !_KERNEL */
/*
 * Copyright 1990-2002 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  RPC protocol information for kwarnd, the usermode daemon that
 *  assists kinit, kdestroy with kwarnapi. It is kwarnd that executes all
 *  kwarnapi calls and sends credential cache expiration warning messages.
 *
 *  File generated from kwarnd.x
 */


#include <sys/types.h>
#include <sys/time.h>
#include <rpc/auth_sys.h>
#include <locale.h>


typedef char *WARNING_NAME_T;

typedef u_int OM_UINT32;

struct kwarn_add_warning_arg {
	WARNING_NAME_T warning_name;
	long cred_exp_time;
};
typedef struct kwarn_add_warning_arg kwarn_add_warning_arg;

struct kwarn_add_warning_res {
	OM_UINT32 status;
};
typedef struct kwarn_add_warning_res kwarn_add_warning_res;

struct kwarn_del_warning_arg {
	WARNING_NAME_T warning_name;
};
typedef struct kwarn_del_warning_arg kwarn_del_warning_arg;

struct kwarn_del_warning_res {
	OM_UINT32 status;
};
typedef struct kwarn_del_warning_res kwarn_del_warning_res;

#define	KWARNPROG	100134
#define	KWARNVERS	1
#define	KWARN_ADD_WARNING	1
extern  enum clnt_stat kwarn_add_warning_1();
extern  bool_t kwarn_add_warning_1_svc();
#define	KWARN_DEL_WARNING	2
extern  enum clnt_stat kwarn_del_warning_1();
extern  bool_t kwarn_del_warning_1_svc();
extern int kwarnprog_1_freeresult();

/* the xdr functions */
extern bool_t xdr_WARNING_NAME_T();
extern bool_t xdr_OM_UINT32();
extern bool_t xdr_kwarn_add_warning_arg();
extern bool_t xdr_kwarn_add_warning_res();
extern bool_t xdr_kwarn_del_warning_arg();
extern bool_t xdr_kwarn_del_warning_res();

#endif /* !_KWARND_H_RPCGEN */
%/*
% * Copyright 1990-2002 Sun Microsystems, Inc.  All rights reserved.
% * Use is subject to license terms.
% */
%
%/*
% *  RPC protocol information for kwarnd, the usermode daemon that
% *  assists kinit, kdestroy with kwarnapi. It is kwarnd that executes all
% *  kwarnapi calls and sends credential cache expiration warning messages.

% *
% *  File generated from kwarnd.x
% */
%
%
%#include <sys/types.h>
%#include <sys/time.h>
%#include <rpc/auth_sys.h>
%#include <locale.h>
%
/*
 * These are the definitions for the interface to KWARND.
 */

#define MAX_PRINCIPAL_LEN 128

typedef string WARNING_NAME_T<MAX_PRINCIPAL_LEN>;

typedef unsigned int				OM_UINT32;

struct kwarn_add_warning_arg {
	WARNING_NAME_T warning_name;
	long cred_exp_time;			/* time in secs after epoch */
};

struct kwarn_add_warning_res {
	OM_UINT32	status;			/* status of kwarn call */
};

struct kwarn_del_warning_arg {
	WARNING_NAME_T warning_name;
};

struct kwarn_del_warning_res {
	OM_UINT32	status;			/* status of kwarn call */
};

/*
 *  The server accepts requests only from the loopback address.
 *  Unix authentication is used, and the port must be in the reserved range.
 */

program KWARNPROG {
    version KWARNVERS {

	/*
	 *  Called by the client to add a cred expiration warning
	 */
	kwarn_add_warning_res
		KWARN_ADD_WARNING(kwarn_add_warning_arg)			= 1;

	/*
	 *  Called by the client to delete a cred expiration warning
	 */
	kwarn_del_warning_res
		KWARN_DEL_WARNING(kwarn_del_warning_arg)			= 2;


    } = 1;
} = 100134;
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  stub module for kwarnd.
 */

#include <stdio.h>
#include <stdlib.h>
#include "kwarnd.h"
#include <rpc/rpc.h>

#include <sys/types.h>
#include <sys/devops.h>
#include <sys/open.h>
#include <sys/stat.h>
#include <sys/conf.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/uio.h>
#include <syslog.h>

extern CLIENT *getkwarnd_handle(void);
extern void resetkwarnd_handle(void);

OM_UINT32
kwarn_add_warning(WARNING_NAME_T warning_name, int cred_exp_time)
{
	kwarn_add_warning_arg args;
	kwarn_add_warning_res res;
	enum clnt_stat ret;
	boolean_t first = TRUE;
	CLIENT *clnt;

	/* check the input/output parameters */
	if (warning_name == NULL || cred_exp_time == 0)
		return (1);

rebind:
	/* get the client handle to kwarnd */
	if ((clnt = getkwarnd_handle()) == NULL) {
		/*
		 * Let app output if an error occurs but we'll syslog to
		 * DEBUG to get error details if needed.
		 */
		syslog(LOG_DEBUG, "%s",
		    clnt_spcreateerror("getkwarnd_handle"));
		return (1);
	}

	/* set the rpc parameters */
	args.cred_exp_time = cred_exp_time;
	args.warning_name = warning_name;

	/* call the remote procedure */
	memset(&res, 0, sizeof (res));
	ret = kwarn_add_warning_1(&args, &res, clnt);
	if (ret != RPC_SUCCESS) {
		/*
		 * Could have timed out due to the process restarting for
		 * various reasons. Should attempt to rebind in the case
		 * process is actually running.
		 */
		if (ret == RPC_TIMEDOUT && first) {
			resetkwarnd_handle();
			first = FALSE;
			goto rebind;
		}
		return (1);
	}

	/* nothing to free */

	return (res.status);
}

OM_UINT32
kwarn_del_warning(WARNING_NAME_T warning_name)
{
	kwarn_del_warning_arg args;
	kwarn_del_warning_res res;
	enum clnt_stat ret;
	boolean_t first = TRUE;
	CLIENT *clnt;

	/* check the output parameters */
	if (warning_name == NULL)
		return (1);

rebind:
	/* get the client GSSD handle */
	if ((clnt = getkwarnd_handle()) == NULL) {
		/*
		 * Let app output if an error occurs but we'll syslog to
		 * DEBUG to get error details if needed.
		 */
		syslog(LOG_DEBUG, "%s",
		    clnt_spcreateerror("getkwarnd_handle"));
		return (1);
	}

	/* set the input parameters */
	args.warning_name = warning_name;

	/* call the remote procedure */
	memset(&res, 0, sizeof (res));
	ret = kwarn_del_warning_1(&args, &res, clnt);
	if (ret != RPC_SUCCESS) {
		/*
		 * Could have timed out due to the process restarting for
		 * various reasons. Should attempt to rebind in the case
		 * process is actually running.
		 */
		if (ret == RPC_TIMEDOUT && first) {
			resetkwarnd_handle();
			first = FALSE;
			goto rebind;
		}
		return (1);
	}

	/* nothing to free */

	return (res.status);
}
/*
 * Copyright (c) 1988-1999 by Sun Microsystems, Inc.
 * All rights reserved.
 */

#include <stdio.h>
#include <stdlib.h>
#include <rpc/rpc.h>
#include <errno.h>
#include <syslog.h>
#include <rpc/nettype.h>
#include <netconfig.h>
#include <netdir.h>
#include <tiuser.h>
#include <fcntl.h>
#include <string.h>
#include <rpc/svc.h>
#include <locale.h>

extern int __rpc_negotiate_uid(int);

/*
 * The highest level interface for server creation.
 * Copied from svc_generic.c and cmd/keyserv/key_generic.c, but adapted
 * to work only for TPI_CLTS semantics, and to be called only once
 * from kwarnd.c. Returns 1 (interface created) on success and 0
 * (no interfaces created) on failure.
 */
int
svc_create_local_service(void (*dispatch) (),		/* Dispatch function */
			u_long prognum,			/* Program number */
			u_long versnum,			/* Version number */
			char *nettype,			/* Networktype token */
			char *servname)			/* name of the srvc */
{
	int num = 0;
	SVCXPRT *xprt;
	struct netconfig *nconf;
	struct t_bind *bind_addr;
	void *net;
	int fd;
	struct nd_hostserv ns;
	struct nd_addrlist *nas;

	if ((net = __rpc_setconf(nettype)) == 0) {
		(void) syslog(LOG_ERR,
		gettext("svc_create: could not read netconfig database"));
		return (0);
	}
	while (nconf = __rpc_getconf(net)) {
		if ((strcmp(nconf->nc_protofmly, NC_LOOPBACK)) ||
				(nconf->nc_semantics != NC_TPI_COTS_ORD))
			continue;

		if ((fd = t_open(nconf->nc_device, O_RDWR, NULL)) < 0) {
			(void) syslog(LOG_ERR,
			gettext("svc_create: %s: cannot open connection: %s"),
				nconf->nc_netid, t_errlist[t_errno]);
			break;
		}

		/*
		 * Negotiate for returning the uid of the caller.
		 * This should be done before enabling the endpoint for
		 * service via t_bind() (called in svc_tli_create())
		 * so that requests to kwarnd contain the uid.
		 */
		if (__rpc_negotiate_uid(fd) != 0) {
			syslog(LOG_ERR,
			gettext("Could not negotiate for"
				" uid with loopback transport %s"),
				nconf->nc_netid);
			t_close(fd);
			break;
		}

		/* LINTED pointer alignment */
		bind_addr = (struct t_bind *) t_alloc(fd, T_BIND, T_ADDR);
		if ((bind_addr == NULL)) {
			(void) t_close(fd);
			(void) syslog(LOG_ERR,
				gettext("svc_create: t_alloc failed\n"));
			break;
		}
		ns.h_host = HOST_SELF;
		ns.h_serv = servname;
		if (!netdir_getbyname(nconf, &ns, &nas)) {
			/* Copy the address */
			bind_addr->addr.len = nas->n_addrs->len;
			(void) memcpy(bind_addr->addr.buf, nas->n_addrs->buf,
				(int) nas->n_addrs->len);
			bind_addr->qlen = 8;
			netdir_free((char *) nas, ND_ADDRLIST);
		} else {
			(void) syslog(LOG_ERR,
			gettext("svc_create: no well known "
				"address for %s on %s\n"),
				servname, nconf->nc_netid);
			(void) t_free((char *) bind_addr, T_BIND);
			bind_addr = NULL;
		}

		xprt = svc_tli_create(fd, nconf, bind_addr, 0, 0);
		if (bind_addr)
			(void) t_free((char *) bind_addr, T_BIND);
		if (xprt == NULL) {
			(void) t_close(fd);
			(void) syslog(LOG_ERR,
			    gettext("svc_create: svc_tli_create failed\n"));
			break;
		} else {
			(void) rpcb_unset(prognum, versnum, nconf);
			if (svc_reg(xprt, prognum, versnum, dispatch, nconf)
					== FALSE) {
				(void) syslog(LOG_ERR,
				gettext("svc_create: cannot"
					" register %d vers %d on %s"),
					prognum, versnum, nconf->nc_netid);
				SVC_DESTROY(xprt);	/* also t_closes fd */
				break;
			}
			num = 1;
			break;
		}
	}
	__rpc_endconf(net);
	return (num);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	from kerbd_handle.c	1.3	92/01/29 SMI */

/*
 * kwarnd_handle.c, Interface to kwarnd
 *
 */

#include <unistd.h>
#include <rpc/rpc.h>
#include <rpc/clnt.h>
#include <stdio.h>
#include <string.h>
#include <netconfig.h>
#include <sys/utsname.h>
#include "kwarnd.h"

#ifdef DEBUG
#define	dprt(msg)
#else
#define	dprt(msg)
#endif /* DEBUG */

CLIENT *kwarn_clnt;

/*
 * Keep the handle cached.  This call may be made quite often.
 */

CLIENT *
getkwarnd_handle(void)
{
	void *localhandle;
	struct netconfig *nconf;
	struct netconfig *tpconf;
	struct timeval wait_time;
	struct utsname u;
	static char *hostname;
	static bool_t first_time = TRUE;

/*
 * Total timeout (in seconds) talking to kwarnd.
 */
#define	TOTAL_TIMEOUT	5

	if (kwarn_clnt)
		return (kwarn_clnt);
	if (!(localhandle = setnetconfig()))
		return (NULL);
	tpconf = NULL;
	if (first_time == TRUE) {
		if (uname(&u) == -1) {
			(void) endnetconfig(localhandle);
			return ((CLIENT *)NULL);
		}
		if ((hostname = strdup(u.nodename)) == (char *)NULL) {
			(void) endnetconfig(localhandle);
			return ((CLIENT *)NULL);
		}
		first_time = FALSE;
	}
	while (nconf = getnetconfig(localhandle)) {
		if (strcmp(nconf->nc_protofmly, NC_LOOPBACK) == 0) {
			if (nconf->nc_semantics == NC_TPI_COTS_ORD) {
				kwarn_clnt = clnt_tp_create(hostname,
				    KWARNPROG, KWARNVERS, nconf);
				if (kwarn_clnt) {
					dprt("got COTS_ORD\n");
					break;
				}
			} else {
				tpconf = nconf;
			}
		}
	}
	if ((kwarn_clnt == NULL) && (tpconf)) {

		/* Now, try the connection-oriented loopback transport */

		kwarn_clnt = clnt_tp_create(hostname, KWARNPROG, KWARNVERS,
		    tpconf);
#ifdef DEBUG
		if (kwarn_clnt) {
			dprt("got COTS\n");
		}
#endif	/* DEBUG */
	}
	(void) endnetconfig(localhandle);

	/*
	 * This bit of code uses an as yet unimplemented argument to
	 * clnt_control(). CLSET_SVC_PRIV specifies that the underlying
	 * loopback transport should be checked to ensure it is
	 * connected to a process running as root. If so, the clnt_control()
	 * call returns TRUE. If not, it returns FALSE.
	 */

#ifdef CLSET_SVC_PRIV

	if (clnt_control(kwarn_clnt, CLSET_SVC_PRIV, NULL) != TRUE) {
		clnt_destroy(kwarn_clnt);
		kwarn_clnt = NULL;
		return (NULL);
	{
#endif
	if (kwarn_clnt == NULL)
		return (NULL);

	kwarn_clnt->cl_auth = authsys_create("", getuid(), 0, 0, NULL);
	if (kwarn_clnt->cl_auth == NULL) {
		clnt_destroy(kwarn_clnt);
		kwarn_clnt = NULL;
		return (NULL);
	}
	wait_time.tv_sec = TOTAL_TIMEOUT;
	wait_time.tv_usec = 0;
	(void) clnt_control(kwarn_clnt, CLSET_TIMEOUT, (char *)&wait_time);

	return (kwarn_clnt);
}

void
resetkwarnd_handle(void)
{
	auth_destroy(kwarn_clnt->cl_auth);
	clnt_destroy(kwarn_clnt);
	kwarn_clnt = NULL;
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  RPC server procedures for the usermode daemon kwarnd.
 */

#include <stdio.h>
#include <unistd.h>
#include <pwd.h>
#include <grp.h>
#include <strings.h>
#include <string.h>
#include <sys/param.h>
#include <sys/syslog.h>
#include "kwarnd.h"
#include <rpc/rpc.h>
#include <stdlib.h>
#include <syslog.h>
#include <poll.h>
#include <utmpx.h>
#include <pwd.h>
#include <strings.h>
#include <ctype.h>

#include <k5-int.h>
#include <profile/prof_int.h>
#include <com_err.h>
#include <libintl.h>
#include <krb5.h>

extern char progname[];

struct k5_data
{
	krb5_context ctx;
	krb5_ccache cc;
	krb5_principal me;
	char *name;
};


#define	MAIL		"mail"
#define	MAILPATH	"/usr/bin/mail"
#define	DEFAULT_CONFIG	"* terminal 30m"
#define	CONF_FILENAME	"/etc/krb5/warn.conf"

/* warn.conf info */

typedef struct config_entry_s {
	struct config_entry_s		*next;
	int				seconds_to_warn;
	char				*principal;
	char				*where_to;
	char				*email;
	int				renew;
	int				log_success;
	int				log_failure;
} config_entry_list_t;
static config_entry_list_t		*config_entry_list;

/* list of principals to be warned */

typedef struct cred_warning_list_s {
	struct cred_warning_list_s 	*next;
	WARNING_NAME_T			warn_name;
	time_t				cred_exp_time;
	time_t				cred_warn_time;
	mutex_t				cwm;
} cred_warning_list_t;
static cred_warning_list_t		*cred_warning_list;
static rwlock_t				cred_lock = DEFAULTRWLOCK;

static bool_t
del_warning_pvt(char *);

static config_entry_list_t *
find_warning_info(char *);

static bool_t
parseConfigLine(char *buffer);

extern int warn_send(char *, char *);

extern int kwarnd_debug;

cred_warning_list_t *
find_cred_warning(WARNING_NAME_T warn_name)
{
	cred_warning_list_t	*cw;
	if (!cred_warning_list)
		return (NULL);
	for (cw = cred_warning_list; cw != NULL; cw = cw->next) {
		if (strcmp(warn_name, cw->warn_name) != 0)
			continue;
		return (cw);
	}
	return (NULL);
}

/*
 * add a principal to the principal warning list
 */

bool_t
kwarn_add_warning_1_svc(kwarn_add_warning_arg *argp,
			kwarn_add_warning_res *res,
			struct svc_req *rqstp)
{
	cred_warning_list_t	*cred_warning;
	config_entry_list_t *config_entry;

	if (kwarnd_debug) {
		printf("kwarn_add_warning_1_svc start; cWlist=%p\n",
		    cred_warning_list);

		printf("kwarn_add_warning_1_svc: principal %s",
		    argp->warning_name);
		printf(" exp time: %d\n", argp->cred_exp_time);
	}

/*
 *  if there is no entry in the config file that matches the principal to
 *  be added to the warning list, return true because we are not going to
 *  send a warning for this principal.
 */

	if ((config_entry = find_warning_info(argp->warning_name)) == NULL) {
		if (kwarnd_debug)
			printf(
		"kwarn_add_warning_1_svc find_warn_info: fails, cWlist=%p\n",
				cred_warning_list);

		return (TRUE);
	}

/*
 * see if a warning has already been created for this principal, if so
 * update the warning time.
 */

	rw_wrlock(&cred_lock);
	if (cred_warning = find_cred_warning(argp->warning_name)) {
		rw_unlock(&cred_lock);
		mutex_lock(&cred_warning->cwm);
		cred_warning->cred_exp_time = argp->cred_exp_time;
		cred_warning->cred_warn_time = argp->cred_exp_time
			- config_entry->seconds_to_warn;
		mutex_unlock(&cred_warning->cwm);
	} else {
		cred_warning = (cred_warning_list_t *)malloc(
				sizeof (*cred_warning_list));
		if (cred_warning == NULL) {
			rw_unlock(&cred_lock);
			res->status = 1;
			return (FALSE);
		}
		(void) memset((char *)cred_warning, 0,
			    sizeof (*cred_warning_list));
		cred_warning->cred_exp_time = argp->cred_exp_time;
		cred_warning->cred_warn_time = argp->cred_exp_time
			- config_entry->seconds_to_warn;
		cred_warning->warn_name = strdup(argp->warning_name);
		if (cred_warning->warn_name == NULL) {
			free(cred_warning);
			rw_unlock(&cred_lock);
			res->status = 1;
			return (FALSE);
		}
		mutex_init(&cred_warning->cwm,  USYNC_THREAD, NULL);
		cred_warning->next = cred_warning_list;
		cred_warning_list = cred_warning;
		rw_unlock(&cred_lock);
	}
	res->status = 0;

	if (kwarnd_debug)
		printf(
		"kwarn_add_warning_1_svc end: returns true; cWlist=%p\n",
		cred_warning_list);

	return (TRUE);
}

/*
 * delete a warning request for a given principal
 */

bool_t
kwarn_del_warning_1_svc(kwarn_del_warning_arg *argp,
			kwarn_del_warning_res *res,
			struct svc_req *rqstp)
{
	if (kwarnd_debug)
		printf(gettext("delete principal %s requested\n"),
		    argp->warning_name);

	if (del_warning_pvt(argp->warning_name) == TRUE) {
		res->status = 0;

		if (kwarnd_debug)
			printf(gettext("delete principal %s completed\n"),
			    argp->warning_name);

		return (TRUE);
	} else {
		res->status = 1;

		if (kwarnd_debug)
			printf(gettext("delete principal %s failed\n"),
				argp->warning_name);

		return (TRUE);
	}
}

static bool_t
del_warning_pvt(char *warning_name)
{
	cred_warning_list_t	*cred_warning, *prev;
	rw_wrlock(&cred_lock);
	for (prev = NULL, cred_warning = cred_warning_list;
		cred_warning != NULL; prev = cred_warning,
		cred_warning = cred_warning->next) {
		if (strcmp(cred_warning->warn_name, warning_name) == 0) {
			if (!prev)
				cred_warning_list = cred_warning->next;
			else
				prev->next = cred_warning->next;

			free(cred_warning->warn_name);
			free(cred_warning);
			rw_unlock(&cred_lock);
			return (TRUE);
		}
	}
	rw_unlock(&cred_lock);
	return (FALSE);
}

/*
 * load the warn.conf file into the config_entry list.
 */

bool_t
loadConfigFile(void)
{
	char	buffer[BUFSIZ];
	FILE	*cfgfile;
	bool_t	retval = TRUE;

	if ((cfgfile = fopen(CONF_FILENAME, "r")) == NULL) {
		syslog(LOG_ERR, gettext(
			"could not open config file \"%s\"\n"),
			CONF_FILENAME);
		syslog(LOG_ERR, gettext(
			"using default options \"%s\"\n"),
			DEFAULT_CONFIG);
		retval = parseConfigLine(DEFAULT_CONFIG);
	} else {
		(void) memset(buffer, 0, sizeof (buffer));
		while ((fgets(buffer, BUFSIZ, cfgfile) != NULL) &&
			(retval == TRUE))
			retval = parseConfigLine(buffer);
		fclose(cfgfile);
	}
	return (retval);
}

/*
 * Return TRUE if we get a valid opt and update flags appro.
 */
static bool_t
cmp_renew_opts(char *opt,
	    int *log_success, /* out */
	    int *log_failure) /* out */
{

	if (strncasecmp(opt, "log",
			sizeof ("log")) == 0) {
		*log_success = *log_failure = 1;
	} else if (strncasecmp(opt, "log-success",
			    sizeof ("log-success")) == 0) {
		*log_success = 1;
	} else if (strncasecmp(opt, "log-failure",
			    sizeof ("log-failure")) == 0) {
		*log_failure = 1;
	} else {
		if (kwarnd_debug)
			printf("cmp_renew_opts: renew bad opt=`%s'\n",
			    opt ? opt : "null");
		return (FALSE);
	}

	return (TRUE);
}

/*
 * Make the config_entry item for the config_entry_list, based on
 * buffer.  The formats are
 *
 *    <principal> [renew[:<opt1,...optN>]] syslog|terminal <time>
 *    <principal> [renew[:<opt1,...optN>]] mail <time> <e-mail address>
 *
 * where renew opts will be:
 *
 *     log-success
 *		- Log the result of the renew attempt on success using
 *		  the specified method (syslog|terminal|mail)
 *
 *      log-failure
 *		- Log the result of the renew attempt on failure using
 *		  the specified method (syslog|terminal|mail)
 *
 *      log
 *               - Same as specifing both log-failure and log-success
 *
 *		  Note if no log options are given, there will be no logging.
 *
 */

static bool_t
parseConfigLine(char *buffer)
{
	char *principal, *send_to, *emailid, *ends, *tm;
	char			*exptime;
	int			time_mode;
	time_t			etime;
	config_entry_list_t	*config_entry;
	int renew = 0;
	int log_success = 0;
	int log_failure = 0;

	/* ignore comments */
	if (*buffer == '#')
		return (TRUE);

	if (kwarnd_debug)
		printf("parseconf: buffer=%s", buffer);

	/* find end of principal */
	principal = buffer;
	for (send_to = buffer; *send_to && !isspace(*send_to);
		send_to++);

	/* find first non whitespace after principal (start of send_to) */
	if (*send_to) {
		*send_to = '\0';
		send_to++;
		while (*send_to && isspace(*send_to))
			send_to++;
	}

	/* if no send_to, continue, bad entry */
	if (! *send_to)
		return (TRUE);

	/* find end of send_to */
	for (ends = send_to; *ends && !isspace(*ends);
		ends++);
	if (*ends)
		*ends = '\0';


	if (strchr(send_to, ':')) {
		/* we've got renew opts */
		char *st = NULL, *op = NULL;

		op = strdup(send_to);
		if (!op)
			return (FALSE);
		st = strchr(op, ':');
		*st = '\0';

		if (strncasecmp(op, "renew", sizeof ("renew")) == 0) {
			renew = 1;
		} else {
			free(op);
			/* got a ':' but not preceeded w/renew, badent, skip */
			if (kwarnd_debug)
				printf("parseconf: colon badent, skip\n");
			return (TRUE);
		}
		free(op);
		op = NULL;

		st++;
		if (!st || !*st || isspace(*st)) {
			if (kwarnd_debug)
				printf("parseconf: st badent, skip\n");
			/* bad ent, skip */
			return (TRUE);
		}
		if (renew && strchr(st, ',')) {
			while (1) {
				/* loop thru comma seperated list-o-opts */
				char *comma = NULL, *c = NULL, *l = NULL;

				if (st && (comma = strchr(st, ','))) {
					l = strdup(st);
					if (!l)
						return (FALSE);
					c = strchr(l, ',');
					*c = '\0';
					if (!cmp_renew_opts(l, &log_success,
							    &log_failure)) {
						free(l);
						/* badent, skip */
						return (TRUE);
					}
					free(l);
					l = NULL;

					st = comma;
					st++;
				} else {
					if (st) {
						if (!cmp_renew_opts(st,
							    &log_success,
							    &log_failure)) {
							/* badent, skip */
							return (TRUE);
						}
					}
					break;
				}
			} /* while */
		} else if (st) {
			/* we just have one opt */
			if (!cmp_renew_opts(st, &log_success, &log_failure)) {
				/* badent, skip */
				return (TRUE);
			}
		}

		/* if send_to is "renew", note it and refind send_to */
	} else if (strncasecmp(send_to, "renew",
			    sizeof ("renew")) == 0) {
		renew = 1;

	}

	if (kwarnd_debug) {
		printf("parseconf: renew=%d, log failure=%d, log success=%d\n",
		    renew, log_failure, log_success);
	}

	if (renew) {
		/* find first non whitespace after send_to (start of exptime) */
		for (send_to = ends+1; *send_to && isspace(*send_to);
		    send_to++);

		/* if no send_to, continue, bad entry */
		if (! *send_to) {
			if (kwarnd_debug)
				printf("parseconf: no send_to, badent, skip\n");
			return (TRUE);
		}

		/* find end of send_to */
		for (ends = send_to; *ends && !isspace(*ends);
		    ends++);
		if (*ends)
			*ends = '\0';
	}


	/* find first non whitespace after send_to (start of exptime) */
	for (exptime = ends+1; *exptime && isspace(*exptime);
		exptime++);

	/* if no exptime, continue, bad entry */
	if (! *exptime) {
		if (kwarnd_debug)
			printf("parseconf: no exptime, badent, skip\n");
		return (TRUE);
	}

	/* find end of exptime */
	for (ends = exptime; *ends && !isspace(*ends); ends++);

	tm = ends - 1;
	if (*tm == 's')
		time_mode = 1;
	else if (*tm == 'm')
		time_mode = 2;
	else if (*tm == 'h')
		time_mode = 3;
	else
		time_mode = 1;

	if (*tm)
		*tm = '\0';

	if (kwarnd_debug) {
		printf("parseconf: send_to = '%s', exptime='%s'\n",
		    send_to, exptime);
	}

	/* find first non whitespace after exptime (start of emailid) */
	for (emailid = ends+1; *emailid && isspace(*emailid); emailid++);

	/* find end of emailid */
	if (*emailid) {
		for (ends = emailid; *ends && !isspace(*ends);
			ends++);

		if (*ends)
			*ends = '\0';
	}

	/* if send to mail and no mail address, bad entry */
	if ((strcmp(send_to, "mail") == 0) && (!*emailid)) {
		if (kwarnd_debug)
			printf("parseconf: returns true; no mail addr\n");

		syslog(LOG_ERR, gettext("missing mail address"
			" in config entry: \n%s %s %s "
			" cannot mail warning"), principal,
			send_to, exptime);
		return (TRUE);
	}

	/* create an entry */
	config_entry = (config_entry_list_t *)
		malloc(sizeof (*config_entry_list));
	if (config_entry == NULL)
		return (FALSE);
	(void) memset(config_entry, 0, sizeof (*config_entry_list));
	config_entry->principal = strdup(principal);
	if (config_entry->principal == NULL)
		return (FALSE);
	config_entry->where_to = strdup(send_to);
	if (config_entry->where_to == NULL)
		return (FALSE);
	etime = atol(exptime);
	if (time_mode == 1)
		config_entry->seconds_to_warn = etime;
	else if (time_mode == 2)
		config_entry->seconds_to_warn = etime * 60;
	else if (time_mode == 3)
		config_entry->seconds_to_warn = etime * 60 * 60;

	if (*emailid) {
		config_entry->email = strdup(emailid);
		if (config_entry->email == NULL)
			return (FALSE);
	}

	config_entry->renew = renew;
	config_entry->log_success = log_success;
	config_entry->log_failure = log_failure;
	config_entry->next = config_entry_list;
	config_entry_list = config_entry;
	if (kwarnd_debug)
		printf("parseconf: returns true; celist=%p\n",
		    config_entry_list);

	return (TRUE);
}

/*
 * find a specific warn.conf entry.
 */

static config_entry_list_t *
find_warning_info(char *principal)
{
	config_entry_list_t	*config_entry;
	/* look for a specific entry */
	for (config_entry = config_entry_list; config_entry;
		config_entry = config_entry->next) {
		if (strcmp(config_entry->principal, principal) == 0) {
			return (config_entry);
		}
	}
	/* look for a wild card entry */
	for (config_entry = config_entry_list; config_entry;
		config_entry = config_entry->next) {
		if (strcmp(config_entry->principal, "*") == 0) {
			return (config_entry);
		}
	}
	/* nothing found */
	return (NULL);

}

/*
 * create a pipe, fork and exec a command,
 */
static FILE *
safe_popen_w(char *path_to_cmd, char **argv)
{

	int fd[2];
	FILE *fp;
	char *envp[2];

	if (pipe(fd) == -1)
		return (NULL);


	switch (fork()) {
	case -1:
		(void) close(fd[0]);
		(void) close(fd[1]);
		return (NULL);

	case 0:
		close(fd[1]);
		/* fd[0] is the end we read from */
		if (fd[0] != 0) {
			close(0);
			dup(fd[0]);
		}
		close(1);
		close(2);
		envp[0] = "PATH=/usr/bin";
		envp[1] = NULL;
#ifdef	DEBUG
		{
			int fd;
			fd = open("/tmp/kwarn.out", O_WRONLY|O_TRUNC|O_CREAT,
				0666);
			if (fd != 1)
				dup(fd);
			if (fd != 2)
				dup(fd);
		}
#endif
		(void) execve(path_to_cmd, argv, envp);
		syslog(LOG_ERR, "warnd: %m");
		_exit(1);

	default:
		close(fd[0]);
		/* fd[1] is the end we write to */

		fp = fdopen(fd[1], "w");

		if (fp == NULL) {
			(void) close(fd[1]);
			return (NULL);
		}
		return (fp);
	}
}


static uid_t krb5_cc_uid;

void
set_warnd_uid(uid_t uid)
{
	/*
	 * set the value of krb5_cc_uid, so it can be retrieved when
	 * app_krb5_user_uid() is called by the underlying mechanism libraries.
	 */
	if (kwarnd_debug)
		printf("set_warnd_uid called with uid = %d\n", uid);
	krb5_cc_uid = uid;
}

uid_t
app_krb5_user_uid(void)
{

	/*
	 * return the value set when one of the kwarnd procedures was
	 * entered. This is the value of the uid under which the
	 * underlying mechanism library must operate in order to
	 * get the user's credentials. This call is necessary since
	 * kwarnd runs as root and credentials are many times stored
	 * in files and directories specific to the user
	 */
	if (kwarnd_debug)
		printf("app_krb5_user_uid called and returning uid = %d\n",
		    krb5_cc_uid);
	return (krb5_cc_uid);
}


static bool_t
getpruid(char *pr, uid_t *uid)
{
	char *rcp1 = NULL, *rcp2 = NULL, *rcp3 = NULL;
	struct passwd *pw;

	rcp1 = strdup(pr);
	if (!rcp1)
		return (FALSE);
	rcp2 = strtok(rcp1, "@");
	rcp3 = strtok(rcp2, "/");

	if (rcp3) {
		pw = getpwnam(rcp3);
		*uid = pw->pw_uid;
		free(rcp1);
		return (TRUE);
	}

	free(rcp1);
	return (FALSE);
}


static krb5_error_code
renew_creds(
	char *princ,
	time_t *new_exp_time) /* out */
{
	krb5_creds my_creds;
	krb5_error_code code = 0;
	struct k5_data k5;

	uid_t saved_u = app_krb5_user_uid();
	uid_t u;

	if (kwarnd_debug)
		printf("renew start: uid=%d\n", app_krb5_user_uid());

	if (!getpruid(princ, &u)) {
		if (kwarnd_debug)
			printf("renew: getpruid failed, princ='%s'\n",
			    princ ? princ : "<null>");

		return (-1); /* better err num? */
	}

	set_warnd_uid(u);

	(void) memset(&my_creds, 0, sizeof (my_creds));
	(void) memset(&k5, 0, sizeof (k5));

	if (code = krb5_init_context(&k5.ctx)) {
		com_err(progname, code,
			gettext("while initializing Kerberos 5 library"));
		goto out;
	}

	if ((code = krb5_cc_default(k5.ctx, &k5.cc))) {
		com_err(progname, code,
			gettext("while getting default ccache"));
		goto out;

	}

	if ((code = krb5_parse_name(k5.ctx, princ,
				    &k5.me))) {
		com_err(progname, code, gettext("when parsing name %s"),
			princ);
		goto out;
	}

	if ((code = krb5_get_renewed_creds(k5.ctx, &my_creds, k5.me, k5.cc,
					NULL))) {
		com_err(progname, code, gettext("while renewing creds"));
		goto out;
	}

	if (code = krb5_cc_initialize(k5.ctx, k5.cc, k5.me)) {
		com_err(progname, code, gettext("when initializing cache %s"),
			"defcc");
		goto out;
	}

	if (code = krb5_cc_store_cred(k5.ctx, k5.cc, &my_creds)) {
		com_err(progname, code, gettext("while storing credentials"));
		goto out;
	}

	/* "return" new expire time */
	*new_exp_time = my_creds.times.endtime;

out:
	krb5_free_cred_contents(k5.ctx, &my_creds);

	if (k5.name)
		krb5_free_unparsed_name(k5.ctx, k5.name);
	if (k5.me)
		krb5_free_principal(k5.ctx, k5.me);
	if (k5.cc)
		krb5_cc_close(k5.ctx, k5.cc);
	if (k5.ctx)
		krb5_free_context(k5.ctx);

	set_warnd_uid(saved_u);

	if (kwarnd_debug)
		printf("renew end: code=%s, uid=%d\n", error_message(code),
		    app_krb5_user_uid());

	return (code);
}

static bool_t
loggedon(char *name)
{
	register struct utmpx *ubuf;
	char    *rcp1 = NULL, *rcp2 = NULL, *rcp3 = NULL;

	/*
	 * strip any realm or instance from principal so we can match
	 * against unix userid.
	 */
	rcp1 = strdup(name);
	if (!rcp1)
		return (FALSE);
	rcp2 = strtok(rcp1, "@");
	rcp3 = strtok(rcp2, "/");

	/*
	 * Scan through the "utmpx" file for the
	 * entry for the person we want to send to.
	 */

	setutxent();
	while ((ubuf = getutxent()) != NULL) {
		if (ubuf->ut_type == USER_PROCESS) {
			if (strncmp(rcp3, ubuf->ut_user,
				    sizeof (ubuf->ut_user)) == 0) {
				free(rcp1);
				endutxent();
				return (TRUE);

			}
		}
	}
	free(rcp1);
	endutxent();

	if (kwarnd_debug)
		printf("loggedon: returning false for user `%s'\n", rcp1);

	return (FALSE);
}

/*
 * main loop to check the cred warning list and send the warnings
 * the appropriate location based on warn.conf or auto-renew creds.
 */

void
kwarnd_check_warning_list(void)
{ /* func */
	cred_warning_list_t	*cw;  /* cred warning */
	config_entry_list_t	*ce;  /* config entry */
	time_t			now;
	int			minutes;
	char			buff[256];
	char			cmdline[256];
	FILE			*fp;
	char			*subj = "Kerberos credentials expiring";
	char			*renew_subj = "Kerberos credentials renewed";

	if (kwarnd_debug)
		printf("check list: start: uid=%d, cw list=%p\n",
		    app_krb5_user_uid(), cred_warning_list);

	while (1) {
		(void) poll(NULL, 0, 60000);

		for (cw = cred_warning_list;
			cw != NULL;
			cw = cw->next) {
			int send_msg = 0;

			time(&now);
			if (now >= cw->cred_warn_time) {
				int renew_attempted = 0;
				int renew_failed = 0;
				int renew_tooclose = 0;

				if (kwarnd_debug)
					printf("checklist: now >= warn_t\n");

				ce = find_warning_info(cw->warn_name);
				minutes = (cw->cred_exp_time -
					now + 59) / 60;

				if (kwarnd_debug)
					printf("checklist: where_to=%s\n",
					    ce->where_to ?
					    ce->where_to : "null");

				if (ce->renew &&
				    loggedon(cw->warn_name)) {
					krb5_error_code code;
					time_t new_exp_time;

					renew_attempted = 1;
					code = renew_creds(
						cw->warn_name,
						&new_exp_time);
					if (!code) {
						/* krb5 api renew success */

						/*
						 * So we had api success
						 * but the new exp time
						 * is same as current one
						 * so we are too close
						 * to Renewable_life time.
						 */
						if (cw->cred_exp_time
						    == new_exp_time) {
							renew_tooclose = 1;
							if (kwarnd_debug)
								printf(
		"checklist: new expire time same as old expire time\n");

							if (ce->log_failure) {
								send_msg = 1;
								snprintf(buff,
								sizeof (buff),
					gettext("%s:\r\nYour kerberos"
					" credentials have not been renewed"
					" (too close to Renewable_life).\r\n"
					"Please run kinit(1).\r\n"),
								cw->warn_name);
							}
						} else {
							/* update times */
							cw->cred_exp_time =
								new_exp_time;
							cw->cred_warn_time =
							    new_exp_time -
							    ce->seconds_to_warn;
						}

						if (kwarnd_debug)
							printf(
						    "check list: new_w_t=%d\n",
						    cw->cred_warn_time);

						if (!renew_tooclose &&
						    ce->log_success) {
							if (kwarnd_debug)
								printf(
						"check list: log success\n");

							send_msg = 1;
							snprintf(buff,
								sizeof (buff),
						gettext("%s:\r\nYour kerberos"
					" credentials have been renewed.\r\n"),
								cw->warn_name);
						}

					}  /* !(code) */

					if (!renew_tooclose && code &&
					    ce->log_failure) {
						if (kwarnd_debug)
							printf(
						"check list: log FAIL\n");

						send_msg = 1;
						snprintf(buff,
							sizeof (buff),
					    gettext("%s:\r\nYour kerberos"
				" credentials failed to be renewed (%s).\r\n"),
							cw->warn_name,
							error_message(code));
					}
					renew_failed = code ? 1 : 0;

				} else if (minutes > 0) {
					send_msg = 1;
					snprintf(buff, sizeof (buff),
					gettext("%s:\r\nyour kerberos"
					" credentials expire in less than"
					" %d minutes.\r\n"),
					cw->warn_name,
					minutes);
				} else {
					send_msg = 1;
					snprintf(buff, sizeof (buff),
					gettext("%s:\r\nyour kerberos"
					" credentials have expired.\r\n"),
					cw->warn_name);
				}

				if (kwarnd_debug)
					printf("checklist: send_msg=%d\n",
					    send_msg);
				if (!send_msg)
					goto del_warning;

				if (strncmp(ce->where_to,
					    "mail", sizeof ("mail")) == 0) {
					char *argv[3];

					argv[0] = MAIL;
					(void) snprintf(cmdline,
							sizeof (cmdline),
							"%s",
							ce->email);
					argv[1] = cmdline;
					argv[2] = NULL;

					fp = safe_popen_w(MAILPATH, argv);

					if (fp) {

						(void) fprintf(fp,
						"To: %s\nSubject: %s\n\n%s\n",
							    ce->email,
							    renew_attempted
							    ? renew_subj : subj,
							    buff);

					    fclose(fp);
					} else {
					    syslog(LOG_ERR,
						gettext("could not fork "
						"mail program to e-mail "
						"warning to %s\n"),
						cmdline);
					}

				} else if (strncmp(ce->where_to,
						"terminal",
						sizeof ("terminal")) == 0) {

					warn_send(cw->warn_name,
						buff);

				} else if (send_msg && strncmp(ce->where_to,
							    "syslog",
						sizeof ("syslog")) == 0) {
					syslog(LOG_NOTICE|LOG_AUTH,
					    "%s",
					    buff);
#if 0
				} else if (strncmp(ce->where_to,
						"snmp",
						sizeof ("snmp")) == 0) {
#endif
				} else {
					if (kwarnd_debug)
						printf(
						"unknown msg method=`%s'\n",
						ce->where_to);

					exit(1);
				}

			del_warning:
				if (!renew_attempted || renew_failed ||
				    renew_tooclose) {
					if (del_warning_pvt(cw->warn_name)
					    == TRUE) {

						if (kwarnd_debug)
							printf(
						"check list: del warn succ\n");

						break;
					} else {
						if (kwarnd_debug)
							printf(
						"could not delete warning\n");

						syslog(LOG_ERR, gettext(
						"could not delete warning"));

						exit(1);
					    }
					}

				} /* if (now) */
		} /* for */
	} /* while */
}  /* func */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include	<ctype.h>
#include	<string.h>
#include	<stdio.h>
#include	<signal.h>
#include	<sys/wait.h>
#include	<sys/types.h>
#include	<sys/stat.h>
#include	<stdlib.h>
#include	<unistd.h>
#include	<time.h>
#include	<utmpx.h>
#include	<pwd.h>
#include	<fcntl.h>
#include	<stdarg.h>
#include	<locale.h>
#include	<stdlib.h>
#include	<limits.h>
#include	<wctype.h>
#include	<errno.h>
#include	<syslog.h>

#define		TRUE	1
#define		FALSE	0
#define		FAILURE	-1
/*
 *	DATE-TIME format
 *  %a	abbreviated weekday name
 *  %b  abbreviated month name
 *  %e  day of month
 *  %H  hour - 24 hour clock
 *  %M  minute
 *  %S  second
 *
 */

extern char myhostname[];
extern char progname[];


static void openfail(int);
static void eof(void);
static void setsignals(void (*)());

static FILE	*fp;	/* File pointer for receipient's terminal */
static char *rterm; /* Pointer to receipient's terminal */

int
warn_send(char *receipient, char *msg)
{
	register struct utmpx *ubuf;
	static char rterminal[] = "/dev/\0 2345678901";
	extern FILE *fp;
	time_t tod;
	char time_buf[40];
	register int bad = 0;
	char	*rcp1, *rcp2, *rcp3;

	(void) setlocale(LC_ALL, "");
#if !defined(TEXT_DOMAIN)
#define	TEXT_DOMAIN "SYS_TEST"
#endif
	(void) textdomain(TEXT_DOMAIN);


/*	Set "rterm" to location where receipient's terminal will go.	*/

	rterm = &rterminal[sizeof ("/dev/") - 1];

/*
 * strip any realm or instance from principal so we can match against unix
 * userid.
 */
	rcp1 = strdup(receipient);
	rcp2 = strtok(rcp1, "@");
	rcp3 = strtok(rcp2, "/");

/*
 *	Scan through the "utmpx" file for the
 *	entry for the person we want to send to.
 */

	setutxent();
	while ((ubuf = getutxent()) != NULL) {
		if (ubuf->ut_type == USER_PROCESS) {
			if (strncmp(rcp3, ubuf->ut_user,
				sizeof (ubuf->ut_user)) == 0) {
				strncpy(rterm, &ubuf->ut_line[0],
					sizeof (ubuf->ut_line)+1);

/*	Try to open up the line to the receipient's terminal.		*/

				signal(SIGALRM, openfail);
				alarm(5);
				fp = fopen(&rterminal[0], "w");
				alarm(0);

/*	Catch signals SIGHUP, SIGINT, SIGQUIT, and SIGTERM, and send	*/
/*	<EOT> message to receipient.			*/

				setsignals(eof);

/*	Get the time of day, convert it to a string and throw away the	*/
/*	year information at the end of the string.			*/

				time(&tod);
				cftime(time_buf, "%c", &tod);
				(void) fprintf(fp, gettext(
	    "\r\n\007\007\007\tMessage from %s@%s [ %s ] ...\r\n"),
					    progname, myhostname, time_buf);
				sleep(1);
				fprintf(fp, gettext("\r\nMessage to %s"), msg);
				fflush(fp);

/*	Since "end of file" received, send <EOT> message to receipient.	*/

				eof();
				fclose(fp);
			}
		}
	}
	free(rcp1);


/*	Did we find a place to talk to?  If we were looking for a */
/*	specific spot and didn't find it, complain and log it. */

	if (*rterm == '\0')
		if (bad > 0) {
			(void) syslog(LOG_ERR, gettext("no place to send.\n"));
			return (1);
		}

	endutxent();
	return (0);
}

static void
setsignals(catch)
void (*catch)();
{
	signal(SIGHUP, catch);
	signal(SIGINT, catch);
	signal(SIGQUIT, catch);
	signal(SIGTERM, catch);
}
static void
openfail(int i)
{
	extern char *rterm;
#if 0
	(void) fprintf(stderr,
		gettext("Timeout trying to open line(%s).\n"),
			rterm);
#endif
	syslog(LOG_ERR, gettext("Timeout trying to open line(%s).\n"),
			rterm ? rterm : "");
	exit(1);
}

static void
eof(void)
{
	extern FILE *fp;

	(void) fprintf(fp, "%s\r\n", gettext("<EOT>"));
}
/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#include "kwarnd.h"
#include <stdio.h>
#include <stdlib.h> /* getenv, exit */
#include <signal.h>
#include <sys/types.h>
#include <memory.h>
#include <stropts.h>
#include <sys/resource.h> /* rlimit */
#include <syslog.h>

#ifdef DEBUG
#define	RPC_SVC_FG
#endif

#define	_RPCSVC_CLOSEDOWN 120
/*
 * Copyright 1990-2002 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  RPC protocol information for kwarnd, the usermode daemon that
 *  assists kinit, kdestroy with kwarnapi. It is kwarnd that executes all
 *  kwarnapi calls and sends credential cache expiration warning messages.
 *
 *  File generated from kwarnd.x
 */


#include <sys/types.h>
#include <sys/time.h>
#include <rpc/auth_sys.h>
#include <locale.h>

extern int _rpcpmstart;		/* Started by a port monitor ? */

/* States a server can be in wrt request */

#define	_IDLE 0
#define	_SERVED 1

/* LINTED static unused if no main */
static int _rpcsvcstate = _IDLE;	/* Set when a request is serviced */
static int _rpcsvccount = 0;		/* Number of requests being serviced */
extern mutex_t _svcstate_lock;		/* lock for _rpcsvcstate, _rpcsvccount */

#if	defined(RPC_MSGOUT)
extern void RPC_MSGOUT();
#else	/* defined(RPC_MSGOUT) */
static void
RPC_MSGOUT(fmt, msg)
	char *fmt;
	char *msg;
{
#ifdef RPC_SVC_FG
	if (_rpcpmstart)
		syslog(LOG_ERR, fmt, msg);
	else {
		(void) fprintf(stderr, fmt, msg);
		(void) putc('\n', stderr);
	}
#else
	syslog(LOG_ERR, fmt, msg);
#endif
}
#endif	/* defined(RPC_MSGOUT) */

void
kwarnprog_1(rqstp, transp)
	struct svc_req *rqstp;
	register SVCXPRT *transp;
{
	union {
		kwarn_add_warning_arg kwarn_add_warning_1_arg;
		kwarn_del_warning_arg kwarn_del_warning_1_arg;
	} argument;
	union {
		kwarn_add_warning_res kwarn_add_warning_1_res;
		kwarn_del_warning_res kwarn_del_warning_1_res;
	} result;
	bool_t retval;
	bool_t (*_xdr_argument)(), (*_xdr_result)();
	bool_t (*local)();

	(void) mutex_lock(&_svcstate_lock);
	_rpcsvccount++;
	(void) mutex_unlock(&_svcstate_lock);
	switch (rqstp->rq_proc) {
	case NULLPROC:
		(void) svc_sendreply(transp, xdr_void,
			NULL);
		(void) mutex_lock(&_svcstate_lock);
		_rpcsvccount--;
		_rpcsvcstate = _SERVED;
		(void) mutex_unlock(&_svcstate_lock);
		return; /* CSTYLED */

	case KWARN_ADD_WARNING:
		_xdr_argument = xdr_kwarn_add_warning_arg;
		_xdr_result = xdr_kwarn_add_warning_res;
		local = (bool_t (*)())
		    kwarn_add_warning_1_svc;
		break;

	case KWARN_DEL_WARNING:
		_xdr_argument = xdr_kwarn_del_warning_arg;
		_xdr_result = xdr_kwarn_del_warning_res;
		local = (bool_t (*)())
		    kwarn_del_warning_1_svc;
		break;

	default:
		svcerr_noproc(transp);
		(void) mutex_lock(&_svcstate_lock);
		_rpcsvccount--;
		_rpcsvcstate = _SERVED;
		(void) mutex_unlock(&_svcstate_lock);
		return; /* CSTYLED */
	}
	(void) memset((char *)&argument, 0, sizeof (argument));
	if (!svc_getargs(transp, _xdr_argument, (caddr_t)&argument)) {
		svcerr_decode(transp);
		(void) mutex_lock(&_svcstate_lock);
		_rpcsvccount--;
		_rpcsvcstate = _SERVED;
		(void) mutex_unlock(&_svcstate_lock);
		return; /* CSTYLED */
	}
	retval = (bool_t)(*local)(&argument, &result, rqstp);
	if (_xdr_result && retval > 0 &&
	    !svc_sendreply(transp, _xdr_result, (char *)&result)) {
		svcerr_systemerr(transp);
	}
	if (!svc_freeargs(transp, _xdr_argument, (caddr_t)&argument)) {
		RPC_MSGOUT("%s",
		    "unable to free arguments");
		exit(1);
	}
	if (_xdr_result != NULL) {
		if (!kwarnprog_1_freeresult(transp, _xdr_result,
		    (caddr_t)&result))
			RPC_MSGOUT("%s",
			    "unable to free results");

	}
	(void) mutex_lock(&_svcstate_lock);
	_rpcsvccount--;
	_rpcsvcstate = _SERVED;
	(void) mutex_unlock(&_svcstate_lock);
	return; /* CSTYLED */
}
/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#include "kwarnd.h"

#ifndef _KERNEL
#include <stdlib.h>
#endif /* !_KERNEL */

/*
 * Copyright 1990-2002 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  RPC protocol information for kwarnd, the usermode daemon that
 *  assists kinit, kdestroy with kwarnapi. It is kwarnd that executes all
 *  kwarnapi calls and sends credential cache expiration warning messages.
 *
 *  File generated from kwarnd.x
 */


#include <sys/types.h>
#include <sys/time.h>
#include <rpc/auth_sys.h>
#include <locale.h>


bool_t
xdr_WARNING_NAME_T(xdrs, objp)
	XDR *xdrs;
	WARNING_NAME_T *objp;
{

	rpc_inline_t *buf __unused;

	if (!xdr_string(xdrs, objp, 128))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_OM_UINT32(xdrs, objp)
	XDR *xdrs;
	OM_UINT32 *objp;
{

	rpc_inline_t *buf __unused;

	if (!xdr_u_int(xdrs, objp))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_kwarn_add_warning_arg(xdrs, objp)
	XDR *xdrs;
	kwarn_add_warning_arg *objp;
{

	rpc_inline_t *buf __unused;

	if (!xdr_WARNING_NAME_T(xdrs, &objp->warning_name))
		return (FALSE);
	if (!xdr_long(xdrs, &objp->cred_exp_time))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_kwarn_add_warning_res(xdrs, objp)
	XDR *xdrs;
	kwarn_add_warning_res *objp;
{

	rpc_inline_t *buf __unused;

	if (!xdr_OM_UINT32(xdrs, &objp->status))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_kwarn_del_warning_arg(xdrs, objp)
	XDR *xdrs;
	kwarn_del_warning_arg *objp;
{

	rpc_inline_t *buf __unused;

	if (!xdr_WARNING_NAME_T(xdrs, &objp->warning_name))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_kwarn_del_warning_res(xdrs, objp)
	XDR *xdrs;
	kwarn_del_warning_res *objp;
{

	rpc_inline_t *buf __unused;

	if (!xdr_OM_UINT32(xdrs, &objp->status))
		return (FALSE);
	return (TRUE);
}
/*
 * Copyright 1995-2002 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Copyright 2013 Nexenta Systems. All rights reserved.
 */

/*
 * Test client for kwarnd.  This program is not shipped on the binary
 * release. This code was taken and modified from gssdtest.c
 */

#include <stdio.h>
#include <strings.h>
#include <ctype.h>
#include <stdlib.h>
#include "kwarnd.h"
#include <rpc/rpc.h>

#define	LOOP_COUNTER  100

#define	OCTAL_MACRO "%03.3o."
#define	MALLOC(n) malloc(n)
#define	CALLOC(n, s) calloc((n), (s))
#define	FREE(x, n) free(x)

static void instructs(void);
static void usage(void);
static int parse_input_line(char *, int *, char ***);
extern uid_t getuid(void);

static void _kwarnd_add_warning(int, char **);
static void _kwarnd_del_warning(int, char **);

static int do_kwarndtest(char *buf);

extern OM_UINT32 kwarn_add_warning();
extern OM_UINT32 kwarn_del_warning();

static int read_line(char *buf, int size)
{
	int len;

	/* read the next line. If cntl-d, return with zero char count */
	printf(gettext("\n> "));

	if (fgets(buf, size, stdin) == NULL)
		return (0);

	len = strlen(buf);
	buf[--len] = '\0';
	return (len);
}

int
main()
{
	char buf[512];
	int len, ret;

	/* Print out usage and instructions to start off the session */

	instructs();
	usage();

	/*
	 * Loop, repeatedly calling parse_input_line() to get the
	 * next line and parse it into argc and argv. Act on the
	 * arguements found on the line.
	 */

	do {
		len = read_line(buf, 512);
		if (len)
			ret = do_kwarndtest(buf);
	} while (len && !ret);

	return (0);
}

static int
do_kwarndtest(char *buf)
{
	int argc;
	char **argv, **argv_array;

	char *cmd;

	argv = 0;

	if (parse_input_line(buf, &argc, &argv) == 0) {
		printf(gettext("\n"));
		return (1);
	}

	if (argc == 0) {
		usage();
		FREE(argv, (argc+1)*sizeof (char *));
		return (0);
	}

	/*
	 * remember argv_array address, which is memory calloc'd by
	 * parse_input_line, so it can be free'd at the end of the loop.
	 */

	argv_array = argv;

	cmd = argv[0];

	argc--;
	argv++;

	if (strcmp(cmd, "kwarn_add_warning") == 0 ||
	    strcmp(cmd, "add") == 0) {
		_kwarnd_add_warning(argc, argv);
	} else if (strcmp(cmd, "kwarn_del_warning") == 0 ||
	    strcmp(cmd, "delete") == 0) {
		_kwarnd_del_warning(argc, argv);
	} else if (strcmp(cmd, "exit") == 0) {
		printf(gettext("\n"));
		FREE(argv_array, (argc+2) * sizeof (char *));
		return (1);
	} else
		usage();

	/* free argv array */

	FREE(argv_array, (argc+2) * sizeof (char *));
	return (0);
}

static void
_kwarnd_add_warning(int argc, char **argv)
{
	OM_UINT32 status;
	time_t	exptime;
	time_t	now;

	/* set up the arguments specified in the input parameters */

	if (argc == 0) {
		usage();
		return;
	}

	if (argc != 2) {
		usage();
		return;
	}

	time(&now);
	exptime = atol(argv[1]);
	exptime = now + exptime;

	status = kwarn_add_warning(argv[0], exptime);

	if (status == 0) {
		printf(gettext("\nadd of credential\n\n"));
		printf(gettext("warning message successful for \"%s\"\n\n"),
		    argv[0]);
	} else {
		printf(gettext("server ret err (octal) %o (%s)\n"),
		    status, gettext("add warning error"));
	}

	return;

}

static void
_kwarnd_del_warning(int argc, char **argv)
{
	OM_UINT32 status;

	if (argc != 1) {
		usage();
		return;
	}

	status = kwarn_del_warning(argv[0]);

	if (status == 0) {
		printf(gettext("delete of principal warning message"
		    "for %s successful"),
		    argv[0]);
	} else {
		printf(gettext("delete of principal %s unsuccessful\n\n"),
		    argv[0]);
	}
}

static void
instructs(void)
{
	fprintf(stderr,
	    gettext(
"\nThis program will test kwarnd.  kwarnd must be running as root. Enter\n"
"the desired command and the principal to be added/deleted. If adding a\n"
"principal, also include the expiration time in seconds.\n"));
}

static void
usage(void)
{
	fprintf(stderr,
	    gettext(
	    "\nusage:\t[kwarn_add_warning | add] (principal) (exptime)\n"
	    "\t[kwarn_del_warning | delete] (principal)\n"
	    "\texit\n\n"));
}

/* Copied from parse_argv(), then modified */

static int
parse_input_line(char *input_line, int *argc, char ***argv)
{
	const char nil = '\0';
	char *chptr;
	int chr_cnt;
	int arg_cnt = 0;
	int ch_was_space = 1;
	int ch_is_space;

	chr_cnt = strlen(input_line);

	/* Count the arguments in the input_line string */

	*argc = 1;

	for (chptr = &input_line[0]; *chptr != nil; chptr++) {
		ch_is_space = isspace(*chptr);
		if (ch_is_space && !ch_was_space) {
			(*argc)++;
		}
		ch_was_space = ch_is_space;
	}

	if (ch_was_space) {
		(*argc)--;
	}	/* minus trailing spaces */

	/* Now that we know how many args calloc the argv array */

	*argv = (char **)CALLOC((*argc)+1, sizeof (char *));
	chptr = (char *)(&input_line[0]);

	for (ch_was_space = 1; *chptr != nil; chptr++) {
		ch_is_space = isspace(*chptr);
		if (ch_is_space) {
			*chptr = nil;	/* replace each space with nil	*/
		} else if (ch_was_space) {	/* begining of word? */
			(*argv)[arg_cnt++] = chptr;	/* new argument ? */
		}

		ch_was_space = ch_is_space;
	}

	return (chr_cnt);
}
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#

#
# Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
#

#
# MAPFILE HEADER START
#
# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
# Object versioning must comply with the rules detailed in
#
#	usr/src/lib/README.mapfiles
#
# You should not be making modifications here until you've read the most current
# copy of that file. If you need help, contact a gatekeeper for guidance.
#
# MAPFILE HEADER END
#

$mapfile_version 2

# ktkt_warnd exports app_krb5_user_uid() - required by mech_krb5.
SYMBOL_SCOPE {
	global:
		app_krb5_user_uid;
};