xref: /illumos-gate/usr/src/cmd/cmd-inet/common/kcmd.c (revision c3377ee9a5b3bff76dbf51347a8de3d215eb6cca)
1 /*
2  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 1983 Regents of the University of California.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms are permitted
11  * provided that the above copyright notice and this paragraph are
12  * duplicated in all such forms and that any documentation,
13  * advertising materials, and other materials related to such
14  * distribution and use acknowledge that the software was developed
15  * by the University of California, Berkeley.  The name of the
16  * University may not be used to endorse or promote products derived
17  * from this software without specific prior written permission.
18  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
20  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21  */
22 
23 /*
24  * Copyright (c) 2018, Joyent, Inc.
25  */
26 
27 /* derived from @(#)rcmd.c	5.17 (Berkeley) 6/27/88 */
28 
29 #include <unistd.h>
30 #include <stdlib.h>
31 #include <stdio.h>
32 #include <ctype.h>
33 #include <string.h>
34 #include <pwd.h>
35 #include <sys/param.h>
36 #include <sys/types.h>
37 #include <fcntl.h>
38 
39 #include <signal.h>
40 #include <sys/file.h>
41 #include <sys/socket.h>
42 #include <sys/stat.h>
43 
44 #include <netinet/in.h>
45 #include <arpa/inet.h>
46 #include <netdb.h>
47 #include <locale.h>
48 #include <syslog.h>
49 
50 #include <errno.h>
51 #include <com_err.h>
52 #include <k5-int.h>
53 #include <kcmd.h>
54 
55 static char *default_service = "host";
56 
57 #define	KCMD_BUFSIZ	102400
58 #define	KCMD8_BUFSIZ	(4096 - 256)
59 /*
60  * For compatibility with earlier versions of Solaris and other OS
61  * (kerborized rsh uses 4KB of RSH_BUFSIZE)- 256 to make sure
62  * there is room
63  */
64 static int deswrite_compat(int, char *, int, int);
65 
66 #define	KCMD_KEYUSAGE	1026
67 
68 static char storage[KCMD_BUFSIZ];
69 static int nstored = 0;
70 static int MAXSIZE = (KCMD_BUFSIZ + 8);
71 static char *store_ptr = storage;
72 static krb5_data desinbuf, desoutbuf;
73 
74 static boolean_t encrypt_flag = B_FALSE;
75 static krb5_context kcmd_context;
76 
77 /* XXX Overloaded: use_ivecs!=0 -> new protocol, inband signalling, etc.  */
78 static boolean_t use_ivecs = B_FALSE;
79 static krb5_data encivec_i[2], encivec_o[2];
80 static krb5_keyusage enc_keyusage_i[2], enc_keyusage_o[2];
81 static krb5_enctype final_enctype;
82 static krb5_keyblock *skey;
83 
84 /* ARGSUSED */
85 int
86 kcmd(int *sock, char **ahost, ushort_t rport,
87 	char *locuser, char *remuser,
88 	char *cmd, int *fd2p, char *service, char *realm,
89 	krb5_context bsd_context, krb5_auth_context *authconp,
90 	krb5_creds **cred, krb5_int32 *seqno, krb5_int32 *server_seqno,
91 	krb5_flags authopts,
92 	int anyport, enum kcmd_proto *protonump)
93 {
94 	int s = -1;
95 	sigset_t oldmask, urgmask;
96 	struct sockaddr_in sin;
97 	struct sockaddr_storage from;
98 	krb5_creds *get_cred = NULL;
99 	krb5_creds *ret_cred = NULL;
100 	char c;
101 	struct hostent *hp;
102 	int rc;
103 	char *host_save = NULL;
104 	krb5_error_code status;
105 	krb5_ap_rep_enc_part *rep_ret;
106 	krb5_error	*error = 0;
107 	krb5_ccache cc;
108 	krb5_data outbuf;
109 	krb5_flags options = authopts;
110 	krb5_auth_context auth_context = NULL;
111 	char *cksumbuf;
112 	krb5_data cksumdat;
113 	int bsize = 0;
114 	char *kcmd_version;
115 	enum kcmd_proto protonum = *protonump;
116 
117 	bsize = strlen(cmd) + strlen(remuser) + 64;
118 	if ((cksumbuf = malloc(bsize)) == 0) {
119 		(void) fprintf(stderr, gettext("Unable to allocate"
120 					    " memory for checksum buffer.\n"));
121 		return (-1);
122 	}
123 	(void) snprintf(cksumbuf, bsize, "%u:", ntohs(rport));
124 	if (strlcat(cksumbuf, cmd, bsize) >= bsize) {
125 		(void) fprintf(stderr, gettext("cmd buffer too long.\n"));
126 		free(cksumbuf);
127 		return (-1);
128 	}
129 	if (strlcat(cksumbuf, remuser, bsize) >= bsize) {
130 		(void) fprintf(stderr, gettext("remuser too long.\n"));
131 		free(cksumbuf);
132 		return (-1);
133 	}
134 	cksumdat.data = cksumbuf;
135 	cksumdat.length = strlen(cksumbuf);
136 
137 	hp = gethostbyname(*ahost);
138 	if (hp == 0) {
139 		(void) fprintf(stderr,
140 			    gettext("%s: unknown host\n"), *ahost);
141 		return (-1);
142 	}
143 
144 	if ((host_save = (char *)strdup(hp->h_name)) == NULL) {
145 		(void) fprintf(stderr, gettext("kcmd: no memory\n"));
146 		return (-1);
147 	}
148 
149 	/* If no service is given set to the default service */
150 	if (!service) service = default_service;
151 
152 	if (!(get_cred = (krb5_creds *)calloc(1, sizeof (krb5_creds)))) {
153 		(void) fprintf(stderr, gettext("kcmd: no memory\n"));
154 		return (-1);
155 	}
156 	(void) sigemptyset(&urgmask);
157 	(void) sigaddset(&urgmask, SIGURG);
158 	(void) sigprocmask(SIG_BLOCK, &urgmask, &oldmask);
159 
160 	status = krb5_sname_to_principal(bsd_context, host_save, service,
161 					KRB5_NT_SRV_HST, &get_cred->server);
162 	if (status) {
163 		(void) fprintf(stderr,
164 			    gettext("kcmd: "
165 				    "krb5_sname_to_principal failed: %s\n"),
166 			    error_message(status));
167 		status = -1;
168 		goto bad;
169 	}
170 
171 	if (realm && *realm) {
172 		(void) krb5_xfree(
173 			krb5_princ_realm(bsd_context, get_cred->server)->data);
174 		krb5_princ_set_realm_length(bsd_context, get_cred->server,
175 					strlen(realm));
176 		krb5_princ_set_realm_data(bsd_context, get_cred->server,
177 						strdup(realm));
178 	}
179 
180 	s = socket(AF_INET, SOCK_STREAM, 0);
181 	if (s < 0) {
182 		perror(gettext("Error creating socket"));
183 		status = -1;
184 		goto bad;
185 	}
186 	/*
187 	 * Kerberos only supports IPv4 addresses for now.
188 	 */
189 	if (hp->h_addrtype == AF_INET) {
190 		sin.sin_family = hp->h_addrtype;
191 		(void) memcpy((void *)&sin.sin_addr,
192 			    hp->h_addr, hp->h_length);
193 		sin.sin_port = rport;
194 	} else {
195 		syslog(LOG_ERR, "Address type %d not supported for "
196 		    "Kerberos", hp->h_addrtype);
197 		status = -1;
198 		goto bad;
199 	}
200 
201 	if (connect(s, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
202 		perror(host_save);
203 		status = -1;
204 		goto bad;
205 	}
206 
207 	if (fd2p == 0) {
208 		(void) write(s, "", 1);
209 	} else {
210 		char num[16];
211 		int s2;
212 		int s3;
213 		struct sockaddr_storage sname;
214 		struct sockaddr_in *sp;
215 		int len = sizeof (struct sockaddr_storage);
216 
217 		s2 = socket(AF_INET, SOCK_STREAM, 0);
218 		if (s2 < 0) {
219 			status = -1;
220 			goto bad;
221 		}
222 		(void) memset((char *)&sin, 0, sizeof (sin));
223 		sin.sin_family = AF_INET;
224 		sin.sin_addr.s_addr = INADDR_ANY;
225 		sin.sin_port = 0;
226 
227 		if (bind(s2, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
228 			perror(gettext("error binding socket"));
229 			(void) close(s2);
230 			status = -1;
231 			goto bad;
232 		}
233 		if (getsockname(s2, (struct sockaddr *)&sname, &len) < 0) {
234 			perror(gettext("getsockname error"));
235 			(void) close(s2);
236 			status = -1;
237 			goto bad;
238 		}
239 		sp = (struct sockaddr_in *)&sname;
240 		(void) listen(s2, 1);
241 		(void) snprintf(num, sizeof (num), "%d",
242 			    htons((ushort_t)sp->sin_port));
243 		if (write(s, num, strlen(num)+1) != strlen(num)+1) {
244 			perror(gettext("write: error setting up stderr"));
245 			(void) close(s2);
246 			status = -1;
247 			goto bad;
248 		}
249 
250 		s3 = accept(s2, (struct sockaddr *)&from, &len);
251 		(void) close(s2);
252 		if (s3 < 0) {
253 			perror(gettext("accept"));
254 			status = -1;
255 			goto bad;
256 		}
257 		*fd2p = s3;
258 		if (SOCK_FAMILY(from) == AF_INET) {
259 			if (!anyport && SOCK_PORT(from) >= IPPORT_RESERVED) {
260 				(void) fprintf(stderr,
261 				    gettext("socket: protocol "
262 					    "failure in circuit setup.\n"));
263 				status = -1;
264 				goto bad2;
265 			}
266 		} else {
267 			(void) fprintf(stderr,
268 				    gettext("Kerberos does not support "
269 					    "address type %d\n"),
270 				    SOCK_FAMILY(from));
271 			status = -1;
272 			goto bad2;
273 		}
274 	}
275 
276 	if (status = krb5_cc_default(bsd_context, &cc))
277 		goto bad2;
278 
279 	status = krb5_cc_get_principal(bsd_context, cc, &get_cred->client);
280 	if (status) {
281 		(void) krb5_cc_close(bsd_context, cc);
282 		goto bad2;
283 	}
284 
285 	/* Get ticket from credentials cache or kdc */
286 	status = krb5_get_credentials(bsd_context, 0, cc, get_cred, &ret_cred);
287 	(void) krb5_cc_close(bsd_context, cc);
288 	if (status) goto bad2;
289 
290 	/* Reset internal flags; these should not be sent. */
291 	authopts &= (~OPTS_FORWARD_CREDS);
292 	authopts &= (~OPTS_FORWARDABLE_CREDS);
293 
294 	if ((status = krb5_auth_con_init(bsd_context, &auth_context)))
295 		goto bad2;
296 
297 	if ((status = krb5_auth_con_setflags(bsd_context, auth_context,
298 					KRB5_AUTH_CONTEXT_RET_TIME)))
299 		goto bad2;
300 
301 	/* Only need local address for mk_cred() to send to krlogind */
302 	if ((status = krb5_auth_con_genaddrs(bsd_context, auth_context, s,
303 			KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR)))
304 		goto bad2;
305 
306 	if (protonum == KCMD_PROTOCOL_COMPAT_HACK) {
307 		krb5_boolean is_des;
308 		status = krb5_c_enctype_compare(bsd_context,
309 						ENCTYPE_DES_CBC_CRC,
310 						ret_cred->keyblock.enctype,
311 						&is_des);
312 		if (status)
313 			goto bad2;
314 		protonum = is_des ? KCMD_OLD_PROTOCOL : KCMD_NEW_PROTOCOL;
315 	}
316 
317 	switch (protonum) {
318 	case KCMD_NEW_PROTOCOL:
319 		authopts |= AP_OPTS_USE_SUBKEY;
320 		kcmd_version = "KCMDV0.2";
321 		break;
322 	case KCMD_OLD_PROTOCOL:
323 		kcmd_version = "KCMDV0.1";
324 		break;
325 	default:
326 		status = -1;
327 		goto bad2;
328 	}
329 
330 	/*
331 	 * Call the Kerberos library routine to obtain an authenticator,
332 	 * pass it over the socket to the server, and obtain mutual
333 	 * authentication.
334 	 */
335 	status = krb5_sendauth(bsd_context, &auth_context, (krb5_pointer) &s,
336 			kcmd_version, ret_cred->client, ret_cred->server,
337 			authopts, &cksumdat, ret_cred, 0, &error,
338 			&rep_ret, NULL);
339 	krb5_xfree(cksumdat.data);
340 	if (status) {
341 		(void) fprintf(stderr, gettext("Couldn't authenticate"
342 					    " to server: %s\n"),
343 			    error_message(status));
344 		if (error) {
345 			(void) fprintf(stderr, gettext("Server returned error"
346 						" code %d (%s)\n"),
347 				error->error,
348 				error_message(ERROR_TABLE_BASE_krb5 +
349 					    error->error));
350 			if (error->text.length)
351 				(void) fprintf(stderr,
352 					    gettext("Error text"
353 						    " sent from server: %s\n"),
354 					    error->text.data);
355 		}
356 		if (error) {
357 			krb5_free_error(bsd_context, error);
358 			error = 0;
359 		}
360 		goto bad2;
361 	}
362 	if (rep_ret && server_seqno) {
363 		*server_seqno = rep_ret->seq_number;
364 		krb5_free_ap_rep_enc_part(bsd_context, rep_ret);
365 	}
366 
367 	(void) write(s, remuser, strlen(remuser)+1);
368 	(void) write(s, cmd, strlen(cmd)+1);
369 	if (locuser)
370 		(void) write(s, locuser, strlen(locuser)+1);
371 	else
372 		(void) write(s, "", 1);
373 
374 	if (options & OPTS_FORWARD_CREDS) {   /* Forward credentials */
375 		if (status = krb5_fwd_tgt_creds(bsd_context, auth_context,
376 					host_save,
377 					ret_cred->client, ret_cred->server,
378 					0, options & OPTS_FORWARDABLE_CREDS,
379 					&outbuf)) {
380 			(void) fprintf(stderr,
381 				    gettext("kcmd: Error getting"
382 					    " forwarded creds\n"));
383 			goto bad2;
384 		}
385 		/* Send forwarded credentials */
386 		if (status = krb5_write_message(bsd_context, (krb5_pointer)&s,
387 						&outbuf))
388 			goto bad2;
389 	} else { /* Dummy write to signal no forwarding */
390 		outbuf.length = 0;
391 		if (status = krb5_write_message(bsd_context,
392 						(krb5_pointer)&s, &outbuf))
393 			goto bad2;
394 	}
395 
396 	if ((rc = read(s, &c, 1)) != 1) {
397 		if (rc == -1) {
398 			perror(*ahost);
399 		} else {
400 			(void) fprintf(stderr, gettext("kcmd: bad connection "
401 					"with remote host\n"));
402 		}
403 		status = -1;
404 		goto bad2;
405 	}
406 	if (c != 0) {
407 		while (read(s, &c, 1) == 1) {
408 			(void) write(2, &c, 1);
409 			if (c == '\n')
410 				break;
411 		}
412 		status = -1;
413 		goto bad2;
414 	}
415 	(void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
416 	*sock = s;
417 
418 	/* pass back credentials if wanted */
419 	if (cred)
420 		(void) krb5_copy_creds(bsd_context, ret_cred, cred);
421 
422 	krb5_free_creds(bsd_context, ret_cred);
423 
424 	/*
425 	 * Initialize *authconp to auth_context, so
426 	 * that the clients can make use of it
427 	 */
428 	*authconp = auth_context;
429 
430 	return (0);
431 bad2:
432 	if (fd2p != NULL)
433 		(void) close(*fd2p);
434 bad:
435 	if (s > 0)
436 		(void) close(s);
437 	if (get_cred)
438 		krb5_free_creds(bsd_context, get_cred);
439 	if (ret_cred)
440 		krb5_free_creds(bsd_context, ret_cred);
441 	if (host_save)
442 		free(host_save);
443 	(void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
444 	return (status);
445 }
446 
447 /*
448  * Strsave was a routine in the version 4 krb library: we put it here
449  * for compatablilty with version 5 krb library, since kcmd.o is linked
450  * into all programs.
451  */
452 
453 char *
454 strsave(char *sp)
455 {
456 	char *ret;
457 
458 	if ((ret = (char *)strdup(sp)) == NULL) {
459 		(void) fprintf(stderr, gettext("no memory for saving args\n"));
460 		exit(1);
461 	}
462 	return (ret);
463 }
464 
465 
466 /*
467  * This routine is to initialize the desinbuf, desoutbuf and the session key
468  * structures to carry out desread()'s and deswrite()'s successfully
469  */
470 void
471 init_encrypt(int enc, krb5_context ctxt, enum kcmd_proto protonum,
472 	krb5_data *inbuf, krb5_data *outbuf,
473 	int amclient, krb5_encrypt_block *block)
474 {
475 	krb5_error_code statuscode;
476 	size_t blocksize;
477 	int i;
478 	krb5_error_code ret;
479 
480 	kcmd_context = ctxt;
481 
482 	if (enc > 0) {
483 		desinbuf.data = inbuf->data;
484 		desoutbuf.data = outbuf->data + 4;
485 		desinbuf.length = inbuf->length;
486 		desoutbuf.length = outbuf->length + 4;
487 		encrypt_flag = B_TRUE;
488 	} else {
489 		encrypt_flag = B_FALSE;
490 		return;
491 	}
492 
493 	skey = block->key;
494 	final_enctype = skey->enctype;
495 
496 	enc_keyusage_i[0] = KCMD_KEYUSAGE;
497 	enc_keyusage_i[1] = KCMD_KEYUSAGE;
498 	enc_keyusage_o[0] = KCMD_KEYUSAGE;
499 	enc_keyusage_o[1] = KCMD_KEYUSAGE;
500 
501 	if (protonum == KCMD_OLD_PROTOCOL) {
502 		use_ivecs = B_FALSE;
503 		return;
504 	}
505 
506 	use_ivecs = B_TRUE;
507 	switch (skey->enctype) {
508 	/*
509 	 * For the DES-based enctypes and the 3DES enctype we
510 	 * want to use a non-zero  IV because that's what we did.
511 	 * In the future we use different keyusage for each
512 	 * channel and direction and a fresh cipher state.
513 	 */
514 	case ENCTYPE_DES_CBC_CRC:
515 	case ENCTYPE_DES_CBC_MD4:
516 	case ENCTYPE_DES_CBC_MD5:
517 	case ENCTYPE_DES3_CBC_SHA1:
518 		statuscode = krb5_c_block_size(kcmd_context, final_enctype,
519 				&blocksize);
520 		if (statuscode) {
521 			/* XXX what do I do? */
522 			abort();
523 		}
524 
525 		encivec_i[0].length = encivec_i[1].length =
526 		encivec_o[0].length = encivec_o[1].length = blocksize;
527 
528 		if ((encivec_i[0].data = malloc(encivec_i[0].length * 4))
529 			== NULL) {
530 			/* XXX what do I do? */
531 			abort();
532 		}
533 		encivec_i[1].data = encivec_i[0].data + encivec_i[0].length;
534 		encivec_o[0].data = encivec_i[1].data + encivec_i[0].length;
535 		encivec_o[1].data = encivec_o[0].data + encivec_i[0].length;
536 
537 		/* is there a better way to initialize this? */
538 		(void) memset(encivec_i[0].data, amclient, blocksize);
539 		(void) memset(encivec_o[0].data, 1 - amclient, blocksize);
540 		(void) memset(encivec_i[1].data, 2 | amclient, blocksize);
541 		(void) memset(encivec_o[1].data, 2 | (1 - amclient), blocksize);
542 		break;
543 	default:
544 		if (amclient) {
545 			enc_keyusage_i[0] = 1028;
546 			enc_keyusage_i[1] = 1030;
547 			enc_keyusage_o[0] = 1032;
548 			enc_keyusage_o[1] = 1034;
549 		} else { /* amclient */
550 			enc_keyusage_i[0] = 1032;
551 			enc_keyusage_i[1] = 1034;
552 			enc_keyusage_o[0] = 1028;
553 			enc_keyusage_o[1] = 1030;
554 		}
555 		for (i = 0; i < 2; i++) {
556 			ret = krb5_c_init_state(ctxt,
557 				skey, enc_keyusage_i[i],
558 				&encivec_i[i]);
559 			if (ret)
560 				goto fail;
561 			ret = krb5_c_init_state(ctxt,
562 				skey, enc_keyusage_o[i],
563 				&encivec_o[i]);
564 			if (ret)
565 				goto fail;
566 		}
567 		break;
568 	}
569 	return;
570 fail:
571 	abort();
572 }
573 
574 int
575 desread(int fd, char *buf, int len, int secondary)
576 {
577 	int nreturned = 0;
578 	long net_len, rd_len;
579 	int cc;
580 	size_t ret = 0;
581 	unsigned char len_buf[4];
582 	krb5_enc_data inputd;
583 	krb5_data outputd;
584 
585 	if (!encrypt_flag)
586 		return (read(fd, buf, len));
587 
588 	/*
589 	 * If there is stored data from a previous read,
590 	 * put it into the output buffer and return it now.
591 	 */
592 	if (nstored >= len) {
593 		(void) memcpy(buf, store_ptr, len);
594 		store_ptr += len;
595 		nstored -= len;
596 		return (len);
597 	} else if (nstored) {
598 		(void) memcpy(buf, store_ptr, nstored);
599 		nreturned += nstored;
600 		buf += nstored;
601 		len -= nstored;
602 		nstored = 0;
603 	}
604 
605 	if ((cc = krb5_net_read(kcmd_context, fd, (char *)len_buf, 4)) != 4) {
606 		if ((cc < 0) && ((errno == EWOULDBLOCK) || (errno == EAGAIN)))
607 			return (cc);
608 		/* XXX can't read enough, pipe must have closed */
609 		return (0);
610 	}
611 	rd_len = ((len_buf[0] << 24) | (len_buf[1] << 16) |
612 		    (len_buf[2] << 8) | len_buf[3]);
613 
614 	if (krb5_c_encrypt_length(kcmd_context, final_enctype,
615 				use_ivecs ? (size_t)rd_len + 4 : (size_t)rd_len,
616 				&ret))
617 		net_len = ((size_t)-1);
618 	else
619 		net_len = ret;
620 
621 	if ((net_len <= 0) || (net_len > desinbuf.length)) {
622 		/*
623 		 * preposterous length; assume out-of-sync; only recourse
624 		 * is to close connection, so return 0
625 		 */
626 		(void) fprintf(stderr, gettext("Read size problem.\n"));
627 		return (0);
628 	}
629 
630 	if ((cc = krb5_net_read(kcmd_context, fd, desinbuf.data, net_len))
631 	    != net_len) {
632 		/* pipe must have closed, return 0 */
633 		(void) fprintf(stderr,
634 			    gettext("Read error: length received %d "
635 				    "!= expected %d.\n"),
636 			    cc, net_len);
637 		return (0);
638 	}
639 
640 	/*
641 	 * Decrypt information
642 	 */
643 	inputd.enctype = ENCTYPE_UNKNOWN;
644 	inputd.ciphertext.length = net_len;
645 	inputd.ciphertext.data = (krb5_pointer)desinbuf.data;
646 
647 	outputd.length = sizeof (storage);
648 	outputd.data = (krb5_pointer)storage;
649 
650 	/*
651 	 * data is decrypted into the "storage" buffer, which
652 	 * had better be large enough!
653 	 */
654 	cc = krb5_c_decrypt(kcmd_context, skey,
655 				enc_keyusage_i[secondary],
656 				use_ivecs ? encivec_i + secondary : 0,
657 				&inputd, &outputd);
658 	if (cc) {
659 		(void) fprintf(stderr, gettext("Cannot decrypt data "
660 			"from network\n"));
661 		return (0);
662 	}
663 
664 	store_ptr = storage;
665 	nstored = rd_len;
666 	if (use_ivecs == B_TRUE) {
667 		int rd_len2;
668 		rd_len2 = storage[0] & 0xff;
669 		rd_len2 <<= 8; rd_len2 |= storage[1] & 0xff;
670 		rd_len2 <<= 8; rd_len2 |= storage[2] & 0xff;
671 		rd_len2 <<= 8; rd_len2 |= storage[3] & 0xff;
672 		if (rd_len2 != rd_len) {
673 			/* cleartext length trashed? */
674 			errno = EIO;
675 			return (-1);
676 		}
677 		store_ptr += 4;
678 	}
679 	/*
680 	 * Copy only as much data as the input buffer will allow.
681 	 * The rest is kept in the 'storage' pointer for the next
682 	 * read.
683 	 */
684 	if (nstored > len) {
685 		(void) memcpy(buf, store_ptr, len);
686 		nreturned += len;
687 		store_ptr += len;
688 		nstored -= len;
689 	} else {
690 		(void) memcpy(buf, store_ptr, nstored);
691 		nreturned += nstored;
692 		nstored = 0;
693 	}
694 
695 	return (nreturned);
696 }
697 int
698 deswrite(int fd, char *buf, int len, int secondary)
699 {
700 	int bytes_written;
701 	int r;
702 	int outlen;
703 	char *p;
704 	if (!encrypt_flag)
705 		return (write(fd, buf, len));
706 
707 	bytes_written = 0;
708 	while (len > 0) {
709 		p = buf + bytes_written;
710 		if (len > KCMD8_BUFSIZ)
711 			outlen = KCMD8_BUFSIZ;
712 		else
713 			outlen = len;
714 		r = deswrite_compat(fd, p, outlen, secondary);
715 		if (r == -1)
716 			return (r);
717 		bytes_written += r;
718 		len -= r;
719 	}
720 	return (bytes_written);
721 }
722 static int
723 deswrite_compat(int fd, char *buf, int len, int secondary)
724 {
725 	int cc;
726 	size_t ret = 0;
727 	krb5_data inputd;
728 	krb5_enc_data outputd;
729 	char tmpbuf[KCMD_BUFSIZ + 8];
730 	char encrbuf[KCMD_BUFSIZ + 8];
731 	unsigned char *len_buf = (unsigned char *)tmpbuf;
732 
733 	if (use_ivecs == B_TRUE) {
734 		unsigned char *lenbuf2 = (unsigned char *)tmpbuf;
735 		if (len + 4 > sizeof (tmpbuf))
736 			abort();
737 		lenbuf2[0] = (len & 0xff000000) >> 24;
738 		lenbuf2[1] = (len & 0xff0000) >> 16;
739 		lenbuf2[2] = (len & 0xff00) >> 8;
740 		lenbuf2[3] = (len & 0xff);
741 		(void) memcpy(tmpbuf + 4, buf, len);
742 
743 		inputd.data = (krb5_pointer)tmpbuf;
744 		inputd.length = len + 4;
745 	} else {
746 		inputd.data = (krb5_pointer)buf;
747 		inputd.length = len;
748 	}
749 
750 	desoutbuf.data = encrbuf;
751 
752 	if (krb5_c_encrypt_length(kcmd_context, final_enctype,
753 			use_ivecs ? (size_t)len + 4 : (size_t)len, &ret)) {
754 		desoutbuf.length = ((size_t)-1);
755 		goto err;
756 	} else {
757 		desoutbuf.length = ret;
758 	}
759 
760 	if (desoutbuf.length > MAXSIZE) {
761 		(void) fprintf(stderr, gettext("Write size problem.\n"));
762 		return (-1);
763 	}
764 
765 	/*
766 	 * Encrypt information
767 	 */
768 	outputd.ciphertext.length = desoutbuf.length;
769 	outputd.ciphertext.data = (krb5_pointer)desoutbuf.data;
770 
771 	cc = krb5_c_encrypt(kcmd_context, skey,
772 			enc_keyusage_o[secondary],
773 			use_ivecs ? encivec_o + secondary : 0,
774 			&inputd, &outputd);
775 
776 	if (cc) {
777 err:
778 		(void) fprintf(stderr, gettext("Write encrypt problem.\n"));
779 		return (-1);
780 	}
781 
782 	len_buf[0] = (len & 0xff000000) >> 24;
783 	len_buf[1] = (len & 0xff0000) >> 16;
784 	len_buf[2] = (len & 0xff00) >> 8;
785 	len_buf[3] = (len & 0xff);
786 	(void) write(fd, len_buf, 4);
787 
788 	if (write(fd, desoutbuf.data, desoutbuf.length) != desoutbuf.length) {
789 		(void) fprintf(stderr, gettext("Could not write "
790 			"out all data.\n"));
791 		return (-1);
792 	} else {
793 		return (len);
794 	}
795 }
796