xref: /illumos-gate/usr/src/cmd/cmd-inet/common/kcmd.c (revision bbe72583)
1 /*
2  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 1983 Regents of the University of California.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms are permitted
11  * provided that the above copyright notice and this paragraph are
12  * duplicated in all such forms and that any documentation,
13  * advertising materials, and other materials related to such
14  * distribution and use acknowledge that the software was developed
15  * by the University of California, Berkeley.  The name of the
16  * University may not be used to endorse or promote products derived
17  * from this software without specific prior written permission.
18  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
20  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21  */
22 
23 /* derived from @(#)rcmd.c	5.17 (Berkeley) 6/27/88 */
24 
25 #include <unistd.h>
26 #include <stdlib.h>
27 #include <stdio.h>
28 #include <ctype.h>
29 #include <string.h>
30 #include <pwd.h>
31 #include <sys/param.h>
32 #include <sys/types.h>
33 #include <fcntl.h>
34 
35 #include <signal.h>
36 #include <sys/file.h>
37 #include <sys/socket.h>
38 #include <sys/stat.h>
39 
40 #include <netinet/in.h>
41 #include <arpa/inet.h>
42 #include <netdb.h>
43 #include <locale.h>
44 #include <syslog.h>
45 
46 #include <errno.h>
47 #include <com_err.h>
48 #include <k5-int.h>
49 #include <kcmd.h>
50 
51 static char *default_service = "host";
52 
53 #define	KCMD_BUFSIZ	102400
54 #define	KCMD8_BUFSIZ	(4096 - 256)
55 /*
56  * For compatibility with earlier versions of Solaris and other OS
57  * (kerborized rsh uses 4KB of RSH_BUFSIZE)- 256 to make sure
58  * there is room
59  */
60 static int deswrite_compat(int, char *, int, int);
61 
62 #define	KCMD_KEYUSAGE	1026
63 
64 static char storage[KCMD_BUFSIZ];
65 static int nstored = 0;
66 static int MAXSIZE = (KCMD_BUFSIZ + 8);
67 static char *store_ptr = storage;
68 static krb5_data desinbuf, desoutbuf;
69 
70 static boolean_t encrypt_flag = B_FALSE;
71 static krb5_context kcmd_context;
72 
73 /* XXX Overloaded: use_ivecs!=0 -> new protocol, inband signalling, etc.  */
74 static boolean_t use_ivecs = B_FALSE;
75 static krb5_data encivec_i[2], encivec_o[2];
76 static krb5_keyusage enc_keyusage_i[2], enc_keyusage_o[2];
77 static krb5_enctype final_enctype;
78 static krb5_keyblock *skey;
79 
80 /* ARGSUSED */
81 int
82 kcmd(int *sock, char **ahost, ushort_t rport,
83 	char *locuser, char *remuser,
84 	char *cmd, int *fd2p, char *service, char *realm,
85 	krb5_context bsd_context, krb5_auth_context *authconp,
86 	krb5_creds **cred, krb5_int32 *seqno, krb5_int32 *server_seqno,
87 	krb5_flags authopts,
88 	int anyport, enum kcmd_proto *protonump)
89 {
90 	int s = -1;
91 	sigset_t oldmask, urgmask;
92 	struct sockaddr_in sin;
93 	struct sockaddr_storage from;
94 	krb5_creds *get_cred = NULL;
95 	krb5_creds *ret_cred = NULL;
96 	char c;
97 	struct hostent *hp;
98 	int rc;
99 	char *host_save = NULL;
100 	krb5_error_code status;
101 	krb5_ap_rep_enc_part *rep_ret;
102 	krb5_error	*error = 0;
103 	krb5_ccache cc;
104 	krb5_data outbuf;
105 	krb5_flags options = authopts;
106 	krb5_auth_context auth_context = NULL;
107 	char *cksumbuf;
108 	krb5_data cksumdat;
109 	int bsize = 0;
110 	char *kcmd_version;
111 	enum kcmd_proto protonum = *protonump;
112 
113 	bsize = strlen(cmd) + strlen(remuser) + 64;
114 	if ((cksumbuf = malloc(bsize)) == 0) {
115 		(void) fprintf(stderr, gettext("Unable to allocate"
116 					    " memory for checksum buffer.\n"));
117 		return (-1);
118 	}
119 	(void) snprintf(cksumbuf, bsize, "%u:", ntohs(rport));
120 	if (strlcat(cksumbuf, cmd, bsize) >= bsize) {
121 		(void) fprintf(stderr, gettext("cmd buffer too long.\n"));
122 		free(cksumbuf);
123 		return (-1);
124 	}
125 	if (strlcat(cksumbuf, remuser, bsize) >= bsize) {
126 		(void) fprintf(stderr, gettext("remuser too long.\n"));
127 		free(cksumbuf);
128 		return (-1);
129 	}
130 	cksumdat.data = cksumbuf;
131 	cksumdat.length = strlen(cksumbuf);
132 
133 	hp = gethostbyname(*ahost);
134 	if (hp == 0) {
135 		(void) fprintf(stderr,
136 			    gettext("%s: unknown host\n"), *ahost);
137 		return (-1);
138 	}
139 
140 	if ((host_save = (char *)strdup(hp->h_name)) == NULL) {
141 		(void) fprintf(stderr, gettext("kcmd: no memory\n"));
142 		return (-1);
143 	}
144 
145 	/* If no service is given set to the default service */
146 	if (!service) service = default_service;
147 
148 	if (!(get_cred = (krb5_creds *)calloc(1, sizeof (krb5_creds)))) {
149 		(void) fprintf(stderr, gettext("kcmd: no memory\n"));
150 		return (-1);
151 	}
152 	(void) sigemptyset(&urgmask);
153 	(void) sigaddset(&urgmask, SIGURG);
154 	(void) sigprocmask(SIG_BLOCK, &urgmask, &oldmask);
155 
156 	status = krb5_sname_to_principal(bsd_context, host_save, service,
157 					KRB5_NT_SRV_HST, &get_cred->server);
158 	if (status) {
159 		(void) fprintf(stderr,
160 			    gettext("kcmd: "
161 				    "krb5_sname_to_principal failed: %s\n"),
162 			    error_message(status));
163 		status = -1;
164 		goto bad;
165 	}
166 
167 	if (realm && *realm) {
168 		(void) krb5_xfree(
169 			krb5_princ_realm(bsd_context, get_cred->server)->data);
170 		krb5_princ_set_realm_length(bsd_context, get_cred->server,
171 					strlen(realm));
172 		krb5_princ_set_realm_data(bsd_context, get_cred->server,
173 						strdup(realm));
174 	}
175 
176 	s = socket(AF_INET, SOCK_STREAM, 0);
177 	if (s < 0) {
178 		perror(gettext("Error creating socket"));
179 		status = -1;
180 		goto bad;
181 	}
182 	/*
183 	 * Kerberos only supports IPv4 addresses for now.
184 	 */
185 	if (hp->h_addrtype == AF_INET) {
186 		sin.sin_family = hp->h_addrtype;
187 		(void) memcpy((void *)&sin.sin_addr,
188 			    hp->h_addr, hp->h_length);
189 		sin.sin_port = rport;
190 	} else {
191 		syslog(LOG_ERR, "Address type %d not supported for "
192 		    "Kerberos", hp->h_addrtype);
193 		status = -1;
194 		goto bad;
195 	}
196 
197 	if (connect(s, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
198 		perror(host_save);
199 		status = -1;
200 		goto bad;
201 	}
202 
203 	if (fd2p == 0) {
204 		(void) write(s, "", 1);
205 	} else {
206 		char num[16];
207 		int s2;
208 		int s3;
209 		struct sockaddr_storage sname;
210 		struct sockaddr_in *sp;
211 		int len = sizeof (struct sockaddr_storage);
212 
213 		s2 = socket(AF_INET, SOCK_STREAM, 0);
214 		if (s2 < 0) {
215 			status = -1;
216 			goto bad;
217 		}
218 		(void) memset((char *)&sin, 0, sizeof (sin));
219 		sin.sin_family = AF_INET;
220 		sin.sin_addr.s_addr = INADDR_ANY;
221 		sin.sin_port = 0;
222 
223 		if (bind(s2, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
224 			perror(gettext("error binding socket"));
225 			(void) close(s2);
226 			status = -1;
227 			goto bad;
228 		}
229 		if (getsockname(s2, (struct sockaddr *)&sname, &len) < 0) {
230 			perror(gettext("getsockname error"));
231 			(void) close(s2);
232 			status = -1;
233 			goto bad;
234 		}
235 		sp = (struct sockaddr_in *)&sname;
236 		(void) listen(s2, 1);
237 		(void) snprintf(num, sizeof (num), "%d",
238 			    htons((ushort_t)sp->sin_port));
239 		if (write(s, num, strlen(num)+1) != strlen(num)+1) {
240 			perror(gettext("write: error setting up stderr"));
241 			(void) close(s2);
242 			status = -1;
243 			goto bad;
244 		}
245 
246 		s3 = accept(s2, (struct sockaddr *)&from, &len);
247 		(void) close(s2);
248 		if (s3 < 0) {
249 			perror(gettext("accept"));
250 			status = -1;
251 			goto bad;
252 		}
253 		*fd2p = s3;
254 		if (SOCK_FAMILY(from) == AF_INET) {
255 			if (!anyport && SOCK_PORT(from) >= IPPORT_RESERVED) {
256 				(void) fprintf(stderr,
257 				    gettext("socket: protocol "
258 					    "failure in circuit setup.\n"));
259 				status = -1;
260 				goto bad2;
261 			}
262 		} else {
263 			(void) fprintf(stderr,
264 				    gettext("Kerberos does not support "
265 					    "address type %d\n"),
266 				    SOCK_FAMILY(from));
267 			status = -1;
268 			goto bad2;
269 		}
270 	}
271 
272 	if (status = krb5_cc_default(bsd_context, &cc))
273 		goto bad2;
274 
275 	status = krb5_cc_get_principal(bsd_context, cc, &get_cred->client);
276 	if (status) {
277 		(void) krb5_cc_close(bsd_context, cc);
278 		goto bad2;
279 	}
280 
281 	/* Get ticket from credentials cache or kdc */
282 	status = krb5_get_credentials(bsd_context, 0, cc, get_cred, &ret_cred);
283 	(void) krb5_cc_close(bsd_context, cc);
284 	if (status) goto bad2;
285 
286 	/* Reset internal flags; these should not be sent. */
287 	authopts &= (~OPTS_FORWARD_CREDS);
288 	authopts &= (~OPTS_FORWARDABLE_CREDS);
289 
290 	if ((status = krb5_auth_con_init(bsd_context, &auth_context)))
291 		goto bad2;
292 
293 	if ((status = krb5_auth_con_setflags(bsd_context, auth_context,
294 					KRB5_AUTH_CONTEXT_RET_TIME)))
295 		goto bad2;
296 
297 	/* Only need local address for mk_cred() to send to krlogind */
298 	if ((status = krb5_auth_con_genaddrs(bsd_context, auth_context, s,
299 			KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR)))
300 		goto bad2;
301 
302 	if (protonum == KCMD_PROTOCOL_COMPAT_HACK) {
303 		krb5_boolean is_des;
304 		status = krb5_c_enctype_compare(bsd_context,
305 						ENCTYPE_DES_CBC_CRC,
306 						ret_cred->keyblock.enctype,
307 						&is_des);
308 		if (status)
309 			goto bad2;
310 		protonum = is_des ? KCMD_OLD_PROTOCOL : KCMD_NEW_PROTOCOL;
311 	}
312 
313 	switch (protonum) {
314 	case KCMD_NEW_PROTOCOL:
315 		authopts |= AP_OPTS_USE_SUBKEY;
316 		kcmd_version = "KCMDV0.2";
317 		break;
318 	case KCMD_OLD_PROTOCOL:
319 		kcmd_version = "KCMDV0.1";
320 		break;
321 	default:
322 		status = -1;
323 		goto bad2;
324 	}
325 
326 	/*
327 	 * Call the Kerberos library routine to obtain an authenticator,
328 	 * pass it over the socket to the server, and obtain mutual
329 	 * authentication.
330 	 */
331 	status = krb5_sendauth(bsd_context, &auth_context, (krb5_pointer) &s,
332 			kcmd_version, ret_cred->client, ret_cred->server,
333 			authopts, &cksumdat, ret_cred, 0, &error,
334 			&rep_ret, NULL);
335 	krb5_xfree(cksumdat.data);
336 	if (status) {
337 		(void) fprintf(stderr, gettext("Couldn't authenticate"
338 					    " to server: %s\n"),
339 			    error_message(status));
340 		if (error) {
341 			(void) fprintf(stderr, gettext("Server returned error"
342 						" code %d (%s)\n"),
343 				error->error,
344 				error_message(ERROR_TABLE_BASE_krb5 +
345 					    error->error));
346 			if (error->text.length)
347 				(void) fprintf(stderr,
348 					    gettext("Error text"
349 						    " sent from server: %s\n"),
350 					    error->text.data);
351 		}
352 		if (error) {
353 			krb5_free_error(bsd_context, error);
354 			error = 0;
355 		}
356 		goto bad2;
357 	}
358 	if (rep_ret && server_seqno) {
359 		*server_seqno = rep_ret->seq_number;
360 		krb5_free_ap_rep_enc_part(bsd_context, rep_ret);
361 	}
362 
363 	(void) write(s, remuser, strlen(remuser)+1);
364 	(void) write(s, cmd, strlen(cmd)+1);
365 	if (locuser)
366 		(void) write(s, locuser, strlen(locuser)+1);
367 	else
368 		(void) write(s, "", 1);
369 
370 	if (options & OPTS_FORWARD_CREDS) {   /* Forward credentials */
371 		if (status = krb5_fwd_tgt_creds(bsd_context, auth_context,
372 					host_save,
373 					ret_cred->client, ret_cred->server,
374 					0, options & OPTS_FORWARDABLE_CREDS,
375 					&outbuf)) {
376 			(void) fprintf(stderr,
377 				    gettext("kcmd: Error getting"
378 					    " forwarded creds\n"));
379 			goto bad2;
380 		}
381 		/* Send forwarded credentials */
382 		if (status = krb5_write_message(bsd_context, (krb5_pointer)&s,
383 						&outbuf))
384 			goto bad2;
385 	} else { /* Dummy write to signal no forwarding */
386 		outbuf.length = 0;
387 		if (status = krb5_write_message(bsd_context,
388 						(krb5_pointer)&s, &outbuf))
389 			goto bad2;
390 	}
391 
392 	if ((rc = read(s, &c, 1)) != 1) {
393 		if (rc == -1) {
394 			perror(*ahost);
395 		} else {
396 			(void) fprintf(stderr, gettext("kcmd: bad connection "
397 					"with remote host\n"));
398 		}
399 		status = -1;
400 		goto bad2;
401 	}
402 	if (c != 0) {
403 		while (read(s, &c, 1) == 1) {
404 			(void) write(2, &c, 1);
405 			if (c == '\n')
406 				break;
407 		}
408 		status = -1;
409 		goto bad2;
410 	}
411 	(void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
412 	*sock = s;
413 
414 	/* pass back credentials if wanted */
415 	if (cred) (void) krb5_copy_creds(bsd_context, ret_cred, cred);
416 		krb5_free_creds(bsd_context, ret_cred);
417 	/*
418 	 * Initialize *authconp to auth_context, so
419 	 * that the clients can make use of it
420 	 */
421 	*authconp = auth_context;
422 
423 	return (0);
424 bad2:
425 	if (fd2p != NULL)
426 		(void) close(*fd2p);
427 bad:
428 	if (s > 0)
429 		(void) close(s);
430 	if (get_cred)
431 		krb5_free_creds(bsd_context, get_cred);
432 	if (ret_cred)
433 		krb5_free_creds(bsd_context, ret_cred);
434 	if (host_save)
435 		free(host_save);
436 	(void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
437 	return (status);
438 }
439 
440 /*
441  * Strsave was a routine in the version 4 krb library: we put it here
442  * for compatablilty with version 5 krb library, since kcmd.o is linked
443  * into all programs.
444  */
445 
446 char *
447 strsave(char *sp)
448 {
449 	char *ret;
450 
451 	if ((ret = (char *)strdup(sp)) == NULL) {
452 		(void) fprintf(stderr, gettext("no memory for saving args\n"));
453 		exit(1);
454 	}
455 	return (ret);
456 }
457 
458 
459 /*
460  * This routine is to initialize the desinbuf, desoutbuf and the session key
461  * structures to carry out desread()'s and deswrite()'s successfully
462  */
463 void
464 init_encrypt(int enc, krb5_context ctxt, enum kcmd_proto protonum,
465 	krb5_data *inbuf, krb5_data *outbuf,
466 	int amclient, krb5_encrypt_block *block)
467 {
468 	krb5_error_code statuscode;
469 	size_t blocksize;
470 	int i;
471 	krb5_error_code ret;
472 
473 	kcmd_context = ctxt;
474 
475 	if (enc > 0) {
476 		desinbuf.data = inbuf->data;
477 		desoutbuf.data = outbuf->data + 4;
478 		desinbuf.length = inbuf->length;
479 		desoutbuf.length = outbuf->length + 4;
480 		encrypt_flag = B_TRUE;
481 	} else {
482 		encrypt_flag = B_FALSE;
483 		return;
484 	}
485 
486 	skey = block->key;
487 	final_enctype = skey->enctype;
488 
489 	enc_keyusage_i[0] = KCMD_KEYUSAGE;
490 	enc_keyusage_i[1] = KCMD_KEYUSAGE;
491 	enc_keyusage_o[0] = KCMD_KEYUSAGE;
492 	enc_keyusage_o[1] = KCMD_KEYUSAGE;
493 
494 	if (protonum == KCMD_OLD_PROTOCOL) {
495 		use_ivecs = B_FALSE;
496 		return;
497 	}
498 
499 	use_ivecs = B_TRUE;
500 	switch (skey->enctype) {
501 	/*
502 	 * For the DES-based enctypes and the 3DES enctype we
503 	 * want to use a non-zero  IV because that's what we did.
504 	 * In the future we use different keyusage for each
505 	 * channel and direction and a fresh cipher state.
506 	 */
507 	case ENCTYPE_DES_CBC_CRC:
508 	case ENCTYPE_DES_CBC_MD4:
509 	case ENCTYPE_DES_CBC_MD5:
510 	case ENCTYPE_DES3_CBC_SHA1:
511 		statuscode = krb5_c_block_size(kcmd_context, final_enctype,
512 				&blocksize);
513 		if (statuscode) {
514 			/* XXX what do I do? */
515 			abort();
516 		}
517 
518 		encivec_i[0].length = encivec_i[1].length =
519 		encivec_o[0].length = encivec_o[1].length = blocksize;
520 
521 		if ((encivec_i[0].data = malloc(encivec_i[0].length * 4))
522 			== NULL) {
523 			/* XXX what do I do? */
524 			abort();
525 		}
526 		encivec_i[1].data = encivec_i[0].data + encivec_i[0].length;
527 		encivec_o[0].data = encivec_i[1].data + encivec_i[0].length;
528 		encivec_o[1].data = encivec_o[0].data + encivec_i[0].length;
529 
530 		/* is there a better way to initialize this? */
531 		(void) memset(encivec_i[0].data, amclient, blocksize);
532 		(void) memset(encivec_o[0].data, 1 - amclient, blocksize);
533 		(void) memset(encivec_i[1].data, 2 | amclient, blocksize);
534 		(void) memset(encivec_o[1].data, 2 | (1 - amclient), blocksize);
535 		break;
536 	default:
537 		if (amclient) {
538 			enc_keyusage_i[0] = 1028;
539 			enc_keyusage_i[1] = 1030;
540 			enc_keyusage_o[0] = 1032;
541 			enc_keyusage_o[1] = 1034;
542 		} else { /* amclient */
543 			enc_keyusage_i[0] = 1032;
544 			enc_keyusage_i[1] = 1034;
545 			enc_keyusage_o[0] = 1028;
546 			enc_keyusage_o[1] = 1030;
547 		}
548 		for (i = 0; i < 2; i++) {
549 			ret = krb5_c_init_state(ctxt,
550 				skey, enc_keyusage_i[i],
551 				&encivec_i[i]);
552 			if (ret)
553 				goto fail;
554 			ret = krb5_c_init_state(ctxt,
555 				skey, enc_keyusage_o[i],
556 				&encivec_o[i]);
557 			if (ret)
558 				goto fail;
559 		}
560 		break;
561 	}
562 	return;
563 fail:
564 	abort();
565 }
566 
567 int
568 desread(int fd, char *buf, int len, int secondary)
569 {
570 	int nreturned = 0;
571 	long net_len, rd_len;
572 	int cc;
573 	size_t ret = 0;
574 	unsigned char len_buf[4];
575 	krb5_enc_data inputd;
576 	krb5_data outputd;
577 
578 	if (!encrypt_flag)
579 		return (read(fd, buf, len));
580 
581 	/*
582 	 * If there is stored data from a previous read,
583 	 * put it into the output buffer and return it now.
584 	 */
585 	if (nstored >= len) {
586 		(void) memcpy(buf, store_ptr, len);
587 		store_ptr += len;
588 		nstored -= len;
589 		return (len);
590 	} else if (nstored) {
591 		(void) memcpy(buf, store_ptr, nstored);
592 		nreturned += nstored;
593 		buf += nstored;
594 		len -= nstored;
595 		nstored = 0;
596 	}
597 
598 	if ((cc = krb5_net_read(kcmd_context, fd, (char *)len_buf, 4)) != 4) {
599 		if ((cc < 0) && ((errno == EWOULDBLOCK) || (errno == EAGAIN)))
600 			return (cc);
601 		/* XXX can't read enough, pipe must have closed */
602 		return (0);
603 	}
604 	rd_len = ((len_buf[0] << 24) | (len_buf[1] << 16) |
605 		    (len_buf[2] << 8) | len_buf[3]);
606 
607 	if (krb5_c_encrypt_length(kcmd_context, final_enctype,
608 				use_ivecs ? (size_t)rd_len + 4 : (size_t)rd_len,
609 				&ret))
610 		net_len = ((size_t)-1);
611 	else
612 		net_len = ret;
613 
614 	if ((net_len <= 0) || (net_len > desinbuf.length)) {
615 		/*
616 		 * preposterous length; assume out-of-sync; only recourse
617 		 * is to close connection, so return 0
618 		 */
619 		(void) fprintf(stderr, gettext("Read size problem.\n"));
620 		return (0);
621 	}
622 
623 	if ((cc = krb5_net_read(kcmd_context, fd, desinbuf.data, net_len))
624 	    != net_len) {
625 		/* pipe must have closed, return 0 */
626 		(void) fprintf(stderr,
627 			    gettext("Read error: length received %d "
628 				    "!= expected %d.\n"),
629 			    cc, net_len);
630 		return (0);
631 	}
632 
633 	/*
634 	 * Decrypt information
635 	 */
636 	inputd.enctype = ENCTYPE_UNKNOWN;
637 	inputd.ciphertext.length = net_len;
638 	inputd.ciphertext.data = (krb5_pointer)desinbuf.data;
639 
640 	outputd.length = sizeof (storage);
641 	outputd.data = (krb5_pointer)storage;
642 
643 	/*
644 	 * data is decrypted into the "storage" buffer, which
645 	 * had better be large enough!
646 	 */
647 	cc = krb5_c_decrypt(kcmd_context, skey,
648 				enc_keyusage_i[secondary],
649 				use_ivecs ? encivec_i + secondary : 0,
650 				&inputd, &outputd);
651 	if (cc) {
652 		(void) fprintf(stderr, gettext("Cannot decrypt data "
653 			"from network\n"));
654 		return (0);
655 	}
656 
657 	store_ptr = storage;
658 	nstored = rd_len;
659 	if (use_ivecs == B_TRUE) {
660 		int rd_len2;
661 		rd_len2 = storage[0] & 0xff;
662 		rd_len2 <<= 8; rd_len2 |= storage[1] & 0xff;
663 		rd_len2 <<= 8; rd_len2 |= storage[2] & 0xff;
664 		rd_len2 <<= 8; rd_len2 |= storage[3] & 0xff;
665 		if (rd_len2 != rd_len) {
666 			/* cleartext length trashed? */
667 			errno = EIO;
668 			return (-1);
669 		}
670 		store_ptr += 4;
671 	}
672 	/*
673 	 * Copy only as much data as the input buffer will allow.
674 	 * The rest is kept in the 'storage' pointer for the next
675 	 * read.
676 	 */
677 	if (nstored > len) {
678 		(void) memcpy(buf, store_ptr, len);
679 		nreturned += len;
680 		store_ptr += len;
681 		nstored -= len;
682 	} else {
683 		(void) memcpy(buf, store_ptr, nstored);
684 		nreturned += nstored;
685 		nstored = 0;
686 	}
687 
688 	return (nreturned);
689 }
690 int
691 deswrite(int fd, char *buf, int len, int secondary)
692 {
693 	int bytes_written;
694 	int r;
695 	int outlen;
696 	char *p;
697 	if (!encrypt_flag)
698 		return (write(fd, buf, len));
699 
700 	bytes_written = 0;
701 	while (len > 0) {
702 		p = buf + bytes_written;
703 		if (len > KCMD8_BUFSIZ)
704 			outlen = KCMD8_BUFSIZ;
705 		else
706 			outlen = len;
707 		r = deswrite_compat(fd, p, outlen, secondary);
708 		if (r == -1)
709 			return (r);
710 		bytes_written += r;
711 		len -= r;
712 	}
713 	return (bytes_written);
714 }
715 static int
716 deswrite_compat(int fd, char *buf, int len, int secondary)
717 {
718 	int cc;
719 	size_t ret = 0;
720 	krb5_data inputd;
721 	krb5_enc_data outputd;
722 	char tmpbuf[KCMD_BUFSIZ + 8];
723 	char encrbuf[KCMD_BUFSIZ + 8];
724 	unsigned char *len_buf = (unsigned char *)tmpbuf;
725 
726 	if (use_ivecs == B_TRUE) {
727 		unsigned char *lenbuf2 = (unsigned char *)tmpbuf;
728 		if (len + 4 > sizeof (tmpbuf))
729 			abort();
730 		lenbuf2[0] = (len & 0xff000000) >> 24;
731 		lenbuf2[1] = (len & 0xff0000) >> 16;
732 		lenbuf2[2] = (len & 0xff00) >> 8;
733 		lenbuf2[3] = (len & 0xff);
734 		(void) memcpy(tmpbuf + 4, buf, len);
735 
736 		inputd.data = (krb5_pointer)tmpbuf;
737 		inputd.length = len + 4;
738 	} else {
739 		inputd.data = (krb5_pointer)buf;
740 		inputd.length = len;
741 	}
742 
743 	desoutbuf.data = encrbuf;
744 
745 	if (krb5_c_encrypt_length(kcmd_context, final_enctype,
746 			use_ivecs ? (size_t)len + 4 : (size_t)len, &ret)) {
747 		desoutbuf.length = ((size_t)-1);
748 		goto err;
749 	} else {
750 		desoutbuf.length = ret;
751 	}
752 
753 	if (desoutbuf.length > MAXSIZE) {
754 		(void) fprintf(stderr, gettext("Write size problem.\n"));
755 		return (-1);
756 	}
757 
758 	/*
759 	 * Encrypt information
760 	 */
761 	outputd.ciphertext.length = desoutbuf.length;
762 	outputd.ciphertext.data = (krb5_pointer)desoutbuf.data;
763 
764 	cc = krb5_c_encrypt(kcmd_context, skey,
765 			enc_keyusage_o[secondary],
766 			use_ivecs ? encivec_o + secondary : 0,
767 			&inputd, &outputd);
768 
769 	if (cc) {
770 err:
771 		(void) fprintf(stderr, gettext("Write encrypt problem.\n"));
772 		return (-1);
773 	}
774 
775 	len_buf[0] = (len & 0xff000000) >> 24;
776 	len_buf[1] = (len & 0xff0000) >> 16;
777 	len_buf[2] = (len & 0xff00) >> 8;
778 	len_buf[3] = (len & 0xff);
779 	(void) write(fd, len_buf, 4);
780 
781 	if (write(fd, desoutbuf.data, desoutbuf.length) != desoutbuf.length) {
782 		(void) fprintf(stderr, gettext("Could not write "
783 			"out all data.\n"));
784 		return (-1);
785 	} else {
786 		return (len);
787 	}
788 }
789