/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  RPC server procedures for the usermode daemon kwarnd.
 */

#include <stdio.h>
#include <unistd.h>
#include <pwd.h>
#include <grp.h>
#include <strings.h>
#include <string.h>
#include <sys/param.h>
#include <sys/syslog.h>
#include "kwarnd.h"
#include <rpc/rpc.h>
#include <stdlib.h>
#include <syslog.h>
#include <poll.h>
#include <utmpx.h>
#include <pwd.h>
#include <strings.h>
#include <ctype.h>

#include <k5-int.h>
#include <profile/prof_int.h>
#include <com_err.h>
#include <libintl.h>
#include <krb5.h>

extern char progname[];

struct k5_data
{
        krb5_context ctx;
        krb5_ccache cc;
        krb5_principal me;
        char *name;
};


#define MAIL            "mail"
#define MAILPATH        "/usr/bin/mail"
#define DEFAULT_CONFIG  "* terminal 30m"
#define CONF_FILENAME   "/etc/krb5/warn.conf"

/* warn.conf info */

typedef struct config_entry_s {
        struct config_entry_s           *next;
        int                             seconds_to_warn;
        char                            *principal;
        char                            *where_to;
        char                            *email;
        int                             renew;
        int                             log_success;
        int                             log_failure;
} config_entry_list_t;
static config_entry_list_t              *config_entry_list;

/* list of principals to be warned */

typedef struct cred_warning_list_s {
        struct cred_warning_list_s      *next;
        WARNING_NAME_T                  warn_name;
        time_t                          cred_exp_time;
        time_t                          cred_warn_time;
        mutex_t                         cwm;
} cred_warning_list_t;
static cred_warning_list_t              *cred_warning_list;
static rwlock_t                         cred_lock = DEFAULTRWLOCK;

static bool_t
del_warning_pvt(char *);

static config_entry_list_t *
find_warning_info(char *);

static bool_t
parseConfigLine(char *buffer);

extern int warn_send(char *, char *);

extern int kwarnd_debug;

cred_warning_list_t *
find_cred_warning(WARNING_NAME_T warn_name)
{
        cred_warning_list_t     *cw;
        if (!cred_warning_list)
                return (NULL);
        for (cw = cred_warning_list; cw != NULL; cw = cw->next) {
                if (strcmp(warn_name, cw->warn_name) != 0)
                        continue;
                return (cw);
        }
        return (NULL);
}

/*
 * add a principal to the principal warning list
 */

bool_t
kwarn_add_warning_1_svc(kwarn_add_warning_arg *argp,
                        kwarn_add_warning_res *res,
                        struct svc_req *rqstp)
{
        cred_warning_list_t     *cred_warning;
        config_entry_list_t *config_entry;

        if (kwarnd_debug) {
                printf("kwarn_add_warning_1_svc start; cWlist=%p\n",
                    cred_warning_list);

                printf("kwarn_add_warning_1_svc: principal %s",
                    argp->warning_name);
                printf(" exp time: %d\n", argp->cred_exp_time);
        }

/*
 *  if there is no entry in the config file that matches the principal to
 *  be added to the warning list, return true because we are not going to
 *  send a warning for this principal.
 */

        if ((config_entry = find_warning_info(argp->warning_name)) == NULL) {
                if (kwarnd_debug)
                        printf(
                "kwarn_add_warning_1_svc find_warn_info: fails, cWlist=%p\n",
                                cred_warning_list);

                return (TRUE);
        }

/*
 * see if a warning has already been created for this principal, if so
 * update the warning time.
 */

        rw_wrlock(&cred_lock);
        if (cred_warning = find_cred_warning(argp->warning_name)) {
                rw_unlock(&cred_lock);
                mutex_lock(&cred_warning->cwm);
                cred_warning->cred_exp_time = argp->cred_exp_time;
                cred_warning->cred_warn_time = argp->cred_exp_time
                        - config_entry->seconds_to_warn;
                mutex_unlock(&cred_warning->cwm);
        } else {
                cred_warning = (cred_warning_list_t *)malloc(
                                sizeof (*cred_warning_list));
                if (cred_warning == NULL) {
                        rw_unlock(&cred_lock);
                        res->status = 1;
                        return (FALSE);
                }
                (void) memset((char *)cred_warning, 0,
                            sizeof (*cred_warning_list));
                cred_warning->cred_exp_time = argp->cred_exp_time;
                cred_warning->cred_warn_time = argp->cred_exp_time
                        - config_entry->seconds_to_warn;
                cred_warning->warn_name = strdup(argp->warning_name);
                if (cred_warning->warn_name == NULL) {
                        free(cred_warning);
                        rw_unlock(&cred_lock);
                        res->status = 1;
                        return (FALSE);
                }
                mutex_init(&cred_warning->cwm,  USYNC_THREAD, NULL);
                cred_warning->next = cred_warning_list;
                cred_warning_list = cred_warning;
                rw_unlock(&cred_lock);
        }
        res->status = 0;

        if (kwarnd_debug)
                printf(
                "kwarn_add_warning_1_svc end: returns true; cWlist=%p\n",
                cred_warning_list);

        return (TRUE);
}

/*
 * delete a warning request for a given principal
 */

bool_t
kwarn_del_warning_1_svc(kwarn_del_warning_arg *argp,
                        kwarn_del_warning_res *res,
                        struct svc_req *rqstp)
{
        if (kwarnd_debug)
                printf(gettext("delete principal %s requested\n"),
                    argp->warning_name);

        if (del_warning_pvt(argp->warning_name) == TRUE) {
                res->status = 0;

                if (kwarnd_debug)
                        printf(gettext("delete principal %s completed\n"),
                            argp->warning_name);

                return (TRUE);
        } else {
                res->status = 1;

                if (kwarnd_debug)
                        printf(gettext("delete principal %s failed\n"),
                                argp->warning_name);

                return (TRUE);
        }
}

static bool_t
del_warning_pvt(char *warning_name)
{
        cred_warning_list_t     *cred_warning, *prev;
        rw_wrlock(&cred_lock);
        for (prev = NULL, cred_warning = cred_warning_list;
                cred_warning != NULL; prev = cred_warning,
                cred_warning = cred_warning->next) {
                if (strcmp(cred_warning->warn_name, warning_name) == 0) {
                        if (!prev)
                                cred_warning_list = cred_warning->next;
                        else
                                prev->next = cred_warning->next;

                        free(cred_warning->warn_name);
                        free(cred_warning);
                        rw_unlock(&cred_lock);
                        return (TRUE);
                }
        }
        rw_unlock(&cred_lock);
        return (FALSE);
}

/*
 * load the warn.conf file into the config_entry list.
 */

bool_t
loadConfigFile(void)
{
        char    buffer[BUFSIZ];
        FILE    *cfgfile;
        bool_t  retval = TRUE;

        if ((cfgfile = fopen(CONF_FILENAME, "r")) == NULL) {
                syslog(LOG_ERR, gettext(
                        "could not open config file \"%s\"\n"),
                        CONF_FILENAME);
                syslog(LOG_ERR, gettext(
                        "using default options \"%s\"\n"),
                        DEFAULT_CONFIG);
                retval = parseConfigLine(DEFAULT_CONFIG);
        } else {
                (void) memset(buffer, 0, sizeof (buffer));
                while ((fgets(buffer, BUFSIZ, cfgfile) != NULL) &&
                        (retval == TRUE))
                        retval = parseConfigLine(buffer);
                fclose(cfgfile);
        }
        return (retval);
}

/*
 * Return TRUE if we get a valid opt and update flags appro.
 */
static bool_t
cmp_renew_opts(char *opt,
            int *log_success, /* out */
            int *log_failure) /* out */
{

        if (strncasecmp(opt, "log",
                        sizeof ("log")) == 0) {
                *log_success = *log_failure = 1;
        } else if (strncasecmp(opt, "log-success",
                            sizeof ("log-success")) == 0) {
                *log_success = 1;
        } else if (strncasecmp(opt, "log-failure",
                            sizeof ("log-failure")) == 0) {
                *log_failure = 1;
        } else {
                if (kwarnd_debug)
                        printf("cmp_renew_opts: renew bad opt=`%s'\n",
                            opt ? opt : "null");
                return (FALSE);
        }

        return (TRUE);
}

/*
 * Make the config_entry item for the config_entry_list, based on
 * buffer.  The formats are
 *
 *    <principal> [renew[:<opt1,...optN>]] syslog|terminal <time>
 *    <principal> [renew[:<opt1,...optN>]] mail <time> <e-mail address>
 *
 * where renew opts will be:
 *
 *     log-success
 *              - Log the result of the renew attempt on success using
 *                the specified method (syslog|terminal|mail)
 *
 *      log-failure
 *              - Log the result of the renew attempt on failure using
 *                the specified method (syslog|terminal|mail)
 *
 *      log
 *               - Same as specifing both log-failure and log-success
 *
 *                Note if no log options are given, there will be no logging.
 *
 */

static bool_t
parseConfigLine(char *buffer)
{
        char *principal, *send_to, *emailid, *ends, *tm;
        char                    *exptime;
        int                     time_mode;
        time_t                  etime;
        config_entry_list_t     *config_entry;
        int renew = 0;
        int log_success = 0;
        int log_failure = 0;

        /* ignore comments */
        if (*buffer == '#')
                return (TRUE);

        if (kwarnd_debug)
                printf("parseconf: buffer=%s", buffer);

        /* find end of principal */
        principal = buffer;
        for (send_to = buffer; *send_to && !isspace(*send_to);
                send_to++);

        /* find first non whitespace after principal (start of send_to) */
        if (*send_to) {
                *send_to = '\0';
                send_to++;
                while (*send_to && isspace(*send_to))
                        send_to++;
        }

        /* if no send_to, continue, bad entry */
        if (! *send_to)
                return (TRUE);

        /* find end of send_to */
        for (ends = send_to; *ends && !isspace(*ends);
                ends++);
        if (*ends)
                *ends = '\0';


        if (strchr(send_to, ':')) {
                /* we've got renew opts */
                char *st = NULL, *op = NULL;

                op = strdup(send_to);
                if (!op)
                        return (FALSE);
                st = strchr(op, ':');
                *st = '\0';

                if (strncasecmp(op, "renew", sizeof ("renew")) == 0) {
                        renew = 1;
                } else {
                        free(op);
                        /* got a ':' but not preceeded w/renew, badent, skip */
                        if (kwarnd_debug)
                                printf("parseconf: colon badent, skip\n");
                        return (TRUE);
                }
                free(op);
                op = NULL;

                st++;
                if (!st || !*st || isspace(*st)) {
                        if (kwarnd_debug)
                                printf("parseconf: st badent, skip\n");
                        /* bad ent, skip */
                        return (TRUE);
                }
                if (renew && strchr(st, ',')) {
                        while (1) {
                                /* loop thru comma seperated list-o-opts */
                                char *comma = NULL, *c = NULL, *l = NULL;

                                if (st && (comma = strchr(st, ','))) {
                                        l = strdup(st);
                                        if (!l)
                                                return (FALSE);
                                        c = strchr(l, ',');
                                        *c = '\0';
                                        if (!cmp_renew_opts(l, &log_success,
                                                            &log_failure)) {
                                                free(l);
                                                /* badent, skip */
                                                return (TRUE);
                                        }
                                        free(l);
                                        l = NULL;

                                        st = comma;
                                        st++;
                                } else {
                                        if (st) {
                                                if (!cmp_renew_opts(st,
                                                            &log_success,
                                                            &log_failure)) {
                                                        /* badent, skip */
                                                        return (TRUE);
                                                }
                                        }
                                        break;
                                }
                        } /* while */
                } else if (st) {
                        /* we just have one opt */
                        if (!cmp_renew_opts(st, &log_success, &log_failure)) {
                                /* badent, skip */
                                return (TRUE);
                        }
                }

                /* if send_to is "renew", note it and refind send_to */
        } else if (strncasecmp(send_to, "renew",
                            sizeof ("renew")) == 0) {
                renew = 1;

        }

        if (kwarnd_debug) {
                printf("parseconf: renew=%d, log failure=%d, log success=%d\n",
                    renew, log_failure, log_success);
        }

        if (renew) {
                /* find first non whitespace after send_to (start of exptime) */
                for (send_to = ends+1; *send_to && isspace(*send_to);
                    send_to++);

                /* if no send_to, continue, bad entry */
                if (! *send_to) {
                        if (kwarnd_debug)
                                printf("parseconf: no send_to, badent, skip\n");
                        return (TRUE);
                }

                /* find end of send_to */
                for (ends = send_to; *ends && !isspace(*ends);
                    ends++);
                if (*ends)
                        *ends = '\0';
        }


        /* find first non whitespace after send_to (start of exptime) */
        for (exptime = ends+1; *exptime && isspace(*exptime);
                exptime++);

        /* if no exptime, continue, bad entry */
        if (! *exptime) {
                if (kwarnd_debug)
                        printf("parseconf: no exptime, badent, skip\n");
                return (TRUE);
        }

        /* find end of exptime */
        for (ends = exptime; *ends && !isspace(*ends); ends++);

        tm = ends - 1;
        if (*tm == 's')
                time_mode = 1;
        else if (*tm == 'm')
                time_mode = 2;
        else if (*tm == 'h')
                time_mode = 3;
        else
                time_mode = 1;

        if (*tm)
                *tm = '\0';

        if (kwarnd_debug) {
                printf("parseconf: send_to = '%s', exptime='%s'\n",
                    send_to, exptime);
        }

        /* find first non whitespace after exptime (start of emailid) */
        for (emailid = ends+1; *emailid && isspace(*emailid); emailid++);

        /* find end of emailid */
        if (*emailid) {
                for (ends = emailid; *ends && !isspace(*ends);
                        ends++);

                if (*ends)
                        *ends = '\0';
        }

        /* if send to mail and no mail address, bad entry */
        if ((strcmp(send_to, "mail") == 0) && (!*emailid)) {
                if (kwarnd_debug)
                        printf("parseconf: returns true; no mail addr\n");

                syslog(LOG_ERR, gettext("missing mail address"
                        " in config entry: \n%s %s %s "
                        " cannot mail warning"), principal,
                        send_to, exptime);
                return (TRUE);
        }

        /* create an entry */
        config_entry = (config_entry_list_t *)
                malloc(sizeof (*config_entry_list));
        if (config_entry == NULL)
                return (FALSE);
        (void) memset(config_entry, 0, sizeof (*config_entry_list));
        config_entry->principal = strdup(principal);
        if (config_entry->principal == NULL)
                return (FALSE);
        config_entry->where_to = strdup(send_to);
        if (config_entry->where_to == NULL)
                return (FALSE);
        etime = atol(exptime);
        if (time_mode == 1)
                config_entry->seconds_to_warn = etime;
        else if (time_mode == 2)
                config_entry->seconds_to_warn = etime * 60;
        else if (time_mode == 3)
                config_entry->seconds_to_warn = etime * 60 * 60;

        if (*emailid) {
                config_entry->email = strdup(emailid);
                if (config_entry->email == NULL)
                        return (FALSE);
        }

        config_entry->renew = renew;
        config_entry->log_success = log_success;
        config_entry->log_failure = log_failure;
        config_entry->next = config_entry_list;
        config_entry_list = config_entry;
        if (kwarnd_debug)
                printf("parseconf: returns true; celist=%p\n",
                    config_entry_list);

        return (TRUE);
}

/*
 * find a specific warn.conf entry.
 */

static config_entry_list_t *
find_warning_info(char *principal)
{
        config_entry_list_t     *config_entry;
        /* look for a specific entry */
        for (config_entry = config_entry_list; config_entry;
                config_entry = config_entry->next) {
                if (strcmp(config_entry->principal, principal) == 0) {
                        return (config_entry);
                }
        }
        /* look for a wild card entry */
        for (config_entry = config_entry_list; config_entry;
                config_entry = config_entry->next) {
                if (strcmp(config_entry->principal, "*") == 0) {
                        return (config_entry);
                }
        }
        /* nothing found */
        return (NULL);

}

/*
 * create a pipe, fork and exec a command,
 */
static FILE *
safe_popen_w(char *path_to_cmd, char **argv)
{

        int fd[2];
        FILE *fp;
        char *envp[2];

        if (pipe(fd) == -1)
                return (NULL);


        switch (fork()) {
        case -1:
                (void) close(fd[0]);
                (void) close(fd[1]);
                return (NULL);

        case 0:
                close(fd[1]);
                /* fd[0] is the end we read from */
                if (fd[0] != 0) {
                        close(0);
                        dup(fd[0]);
                }
                close(1);
                close(2);
                envp[0] = "PATH=/usr/bin";
                envp[1] = NULL;
#ifdef  DEBUG
                {
                        int fd;
                        fd = open("/tmp/kwarn.out", O_WRONLY|O_TRUNC|O_CREAT,
                                0666);
                        if (fd != 1)
                                dup(fd);
                        if (fd != 2)
                                dup(fd);
                }
#endif
                (void) execve(path_to_cmd, argv, envp);
                syslog(LOG_ERR, "warnd: %m");
                _exit(1);

        default:
                close(fd[0]);
                /* fd[1] is the end we write to */

                fp = fdopen(fd[1], "w");

                if (fp == NULL) {
                        (void) close(fd[1]);
                        return (NULL);
                }
                return (fp);
        }
}


static uid_t krb5_cc_uid;

void
set_warnd_uid(uid_t uid)
{
        /*
         * set the value of krb5_cc_uid, so it can be retrieved when
         * app_krb5_user_uid() is called by the underlying mechanism libraries.
         */
        if (kwarnd_debug)
                printf("set_warnd_uid called with uid = %d\n", uid);
        krb5_cc_uid = uid;
}

uid_t
app_krb5_user_uid(void)
{

        /*
         * return the value set when one of the kwarnd procedures was
         * entered. This is the value of the uid under which the
         * underlying mechanism library must operate in order to
         * get the user's credentials. This call is necessary since
         * kwarnd runs as root and credentials are many times stored
         * in files and directories specific to the user
         */
        if (kwarnd_debug)
                printf("app_krb5_user_uid called and returning uid = %d\n",
                    krb5_cc_uid);
        return (krb5_cc_uid);
}


static bool_t
getpruid(char *pr, uid_t *uid)
{
        char *rcp1 = NULL, *rcp2 = NULL, *rcp3 = NULL;
        struct passwd *pw;

        rcp1 = strdup(pr);
        if (!rcp1)
                return (FALSE);
        rcp2 = strtok(rcp1, "@");
        rcp3 = strtok(rcp2, "/");

        if (rcp3) {
                pw = getpwnam(rcp3);
                *uid = pw->pw_uid;
                free(rcp1);
                return (TRUE);
        }

        free(rcp1);
        return (FALSE);
}


static krb5_error_code
renew_creds(
        char *princ,
        time_t *new_exp_time) /* out */
{
        krb5_creds my_creds;
        krb5_error_code code = 0;
        struct k5_data k5;

        uid_t saved_u = app_krb5_user_uid();
        uid_t u;

        if (kwarnd_debug)
                printf("renew start: uid=%d\n", app_krb5_user_uid());

        if (!getpruid(princ, &u)) {
                if (kwarnd_debug)
                        printf("renew: getpruid failed, princ='%s'\n",
                            princ ? princ : "<null>");

                return (-1); /* better err num? */
        }

        set_warnd_uid(u);

        (void) memset(&my_creds, 0, sizeof (my_creds));
        (void) memset(&k5, 0, sizeof (k5));

        if (code = krb5_init_context(&k5.ctx)) {
                com_err(progname, code,
                        gettext("while initializing Kerberos 5 library"));
                goto out;
        }

        if ((code = krb5_cc_default(k5.ctx, &k5.cc))) {
                com_err(progname, code,
                        gettext("while getting default ccache"));
                goto out;

        }

        if ((code = krb5_parse_name(k5.ctx, princ,
                                    &k5.me))) {
                com_err(progname, code, gettext("when parsing name %s"),
                        princ);
                goto out;
        }

        if ((code = krb5_get_renewed_creds(k5.ctx, &my_creds, k5.me, k5.cc,
                                        NULL))) {
                com_err(progname, code, gettext("while renewing creds"));
                goto out;
        }

        if (code = krb5_cc_initialize(k5.ctx, k5.cc, k5.me)) {
                com_err(progname, code, gettext("when initializing cache %s"),
                        "defcc");
                goto out;
        }

        if (code = krb5_cc_store_cred(k5.ctx, k5.cc, &my_creds)) {
                com_err(progname, code, gettext("while storing credentials"));
                goto out;
        }

        /* "return" new expire time */
        *new_exp_time = my_creds.times.endtime;

out:
        krb5_free_cred_contents(k5.ctx, &my_creds);

        if (k5.name)
                krb5_free_unparsed_name(k5.ctx, k5.name);
        if (k5.me)
                krb5_free_principal(k5.ctx, k5.me);
        if (k5.cc)
                krb5_cc_close(k5.ctx, k5.cc);
        if (k5.ctx)
                krb5_free_context(k5.ctx);

        set_warnd_uid(saved_u);

        if (kwarnd_debug)
                printf("renew end: code=%s, uid=%d\n", error_message(code),
                    app_krb5_user_uid());

        return (code);
}

static bool_t
loggedon(char *name)
{
        register struct utmpx *ubuf;
        char    *rcp1 = NULL, *rcp2 = NULL, *rcp3 = NULL;

        /*
         * strip any realm or instance from principal so we can match
         * against unix userid.
         */
        rcp1 = strdup(name);
        if (!rcp1)
                return (FALSE);
        rcp2 = strtok(rcp1, "@");
        rcp3 = strtok(rcp2, "/");

        /*
         * Scan through the "utmpx" file for the
         * entry for the person we want to send to.
         */

        setutxent();
        while ((ubuf = getutxent()) != NULL) {
                if (ubuf->ut_type == USER_PROCESS) {
                        if (strncmp(rcp3, ubuf->ut_user,
                                    sizeof (ubuf->ut_user)) == 0) {
                                free(rcp1);
                                endutxent();
                                return (TRUE);

                        }
                }
        }
        free(rcp1);
        endutxent();

        if (kwarnd_debug)
                printf("loggedon: returning false for user `%s'\n", rcp1);

        return (FALSE);
}

/*
 * main loop to check the cred warning list and send the warnings
 * the appropriate location based on warn.conf or auto-renew creds.
 */

void
kwarnd_check_warning_list(void)
{ /* func */
        cred_warning_list_t     *cw;  /* cred warning */
        config_entry_list_t     *ce;  /* config entry */
        time_t                  now;
        int                     minutes;
        char                    buff[256];
        char                    cmdline[256];
        FILE                    *fp;
        char                    *subj = "Kerberos credentials expiring";
        char                    *renew_subj = "Kerberos credentials renewed";

        if (kwarnd_debug)
                printf("check list: start: uid=%d, cw list=%p\n",
                    app_krb5_user_uid(), cred_warning_list);

        while (1) {
                (void) poll(NULL, 0, 60000);

                for (cw = cred_warning_list;
                        cw != NULL;
                        cw = cw->next) {
                        int send_msg = 0;

                        time(&now);
                        if (now >= cw->cred_warn_time) {
                                int renew_attempted = 0;
                                int renew_failed = 0;
                                int renew_tooclose = 0;

                                if (kwarnd_debug)
                                        printf("checklist: now >= warn_t\n");

                                ce = find_warning_info(cw->warn_name);
                                minutes = (cw->cred_exp_time -
                                        now + 59) / 60;

                                if (kwarnd_debug)
                                        printf("checklist: where_to=%s\n",
                                            ce->where_to ?
                                            ce->where_to : "null");

                                if (ce->renew &&
                                    loggedon(cw->warn_name)) {
                                        krb5_error_code code;
                                        time_t new_exp_time;

                                        renew_attempted = 1;
                                        code = renew_creds(
                                                cw->warn_name,
                                                &new_exp_time);
                                        if (!code) {
                                                /* krb5 api renew success */

                                                /*
                                                 * So we had api success
                                                 * but the new exp time
                                                 * is same as current one
                                                 * so we are too close
                                                 * to Renewable_life time.
                                                 */
                                                if (cw->cred_exp_time
                                                    == new_exp_time) {
                                                        renew_tooclose = 1;
                                                        if (kwarnd_debug)
                                                                printf(
                "checklist: new expire time same as old expire time\n");

                                                        if (ce->log_failure) {
                                                                send_msg = 1;
                                                                snprintf(buff,
                                                                sizeof (buff),
                                        gettext("%s:\r\nYour kerberos"
                                        " credentials have not been renewed"
                                        " (too close to Renewable_life).\r\n"
                                        "Please run kinit(1).\r\n"),
                                                                cw->warn_name);
                                                        }
                                                } else {
                                                        /* update times */
                                                        cw->cred_exp_time =
                                                                new_exp_time;
                                                        cw->cred_warn_time =
                                                            new_exp_time -
                                                            ce->seconds_to_warn;
                                                }

                                                if (kwarnd_debug)
                                                        printf(
                                                    "check list: new_w_t=%d\n",
                                                    cw->cred_warn_time);

                                                if (!renew_tooclose &&
                                                    ce->log_success) {
                                                        if (kwarnd_debug)
                                                                printf(
                                                "check list: log success\n");

                                                        send_msg = 1;
                                                        snprintf(buff,
                                                                sizeof (buff),
                                                gettext("%s:\r\nYour kerberos"
                                        " credentials have been renewed.\r\n"),
                                                                cw->warn_name);
                                                }

                                        }  /* !(code) */

                                        if (!renew_tooclose && code &&
                                            ce->log_failure) {
                                                if (kwarnd_debug)
                                                        printf(
                                                "check list: log FAIL\n");

                                                send_msg = 1;
                                                snprintf(buff,
                                                        sizeof (buff),
                                            gettext("%s:\r\nYour kerberos"
                                " credentials failed to be renewed (%s).\r\n"),
                                                        cw->warn_name,
                                                        error_message(code));
                                        }
                                        renew_failed = code ? 1 : 0;

                                } else if (minutes > 0) {
                                        send_msg = 1;
                                        snprintf(buff, sizeof (buff),
                                        gettext("%s:\r\nyour kerberos"
                                        " credentials expire in less than"
                                        " %d minutes.\r\n"),
                                        cw->warn_name,
                                        minutes);
                                } else {
                                        send_msg = 1;
                                        snprintf(buff, sizeof (buff),
                                        gettext("%s:\r\nyour kerberos"
                                        " credentials have expired.\r\n"),
                                        cw->warn_name);
                                }

                                if (kwarnd_debug)
                                        printf("checklist: send_msg=%d\n",
                                            send_msg);
                                if (!send_msg)
                                        goto del_warning;

                                if (strncmp(ce->where_to,
                                            "mail", sizeof ("mail")) == 0) {
                                        char *argv[3];

                                        argv[0] = MAIL;
                                        (void) snprintf(cmdline,
                                                        sizeof (cmdline),
                                                        "%s",
                                                        ce->email);
                                        argv[1] = cmdline;
                                        argv[2] = NULL;

                                        fp = safe_popen_w(MAILPATH, argv);

                                        if (fp) {

                                                (void) fprintf(fp,
                                                "To: %s\nSubject: %s\n\n%s\n",
                                                            ce->email,
                                                            renew_attempted
                                                            ? renew_subj : subj,
                                                            buff);

                                            fclose(fp);
                                        } else {
                                            syslog(LOG_ERR,
                                                gettext("could not fork "
                                                "mail program to e-mail "
                                                "warning to %s\n"),
                                                cmdline);
                                        }

                                } else if (strncmp(ce->where_to,
                                                "terminal",
                                                sizeof ("terminal")) == 0) {

                                        warn_send(cw->warn_name,
                                                buff);

                                } else if (send_msg && strncmp(ce->where_to,
                                                            "syslog",
                                                sizeof ("syslog")) == 0) {
                                        syslog(LOG_NOTICE|LOG_AUTH,
                                            "%s",
                                            buff);
#if 0
                                } else if (strncmp(ce->where_to,
                                                "snmp",
                                                sizeof ("snmp")) == 0) {
#endif
                                } else {
                                        if (kwarnd_debug)
                                                printf(
                                                "unknown msg method=`%s'\n",
                                                ce->where_to);

                                        exit(1);
                                }

                        del_warning:
                                if (!renew_attempted || renew_failed ||
                                    renew_tooclose) {
                                        if (del_warning_pvt(cw->warn_name)
                                            == TRUE) {

                                                if (kwarnd_debug)
                                                        printf(
                                                "check list: del warn succ\n");

                                                break;
                                        } else {
                                                if (kwarnd_debug)
                                                        printf(
                                                "could not delete warning\n");

                                                syslog(LOG_ERR, gettext(
                                                "could not delete warning"));

                                                exit(1);
                                            }
                                        }

                                } /* if (now) */
                } /* for */
        } /* while */
}  /* func */