xref: /titanic_50/usr/src/cmd/cmd-inet/common/kcmd.c (revision 1509e10569fba811a2b96d2fd79543c1fbfb8bb0)

/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*
 * Copyright (c) 1983 Regents of the University of California.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms are permitted
 * provided that the above copyright notice and this paragraph are
 * duplicated in all such forms and that any documentation,
 * advertising materials, and other materials related to such
 * distribution and use acknowledge that the software was developed
 * by the University of California, Berkeley.  The name of the
 * University may not be used to endorse or promote products derived
 * from this software without specific prior written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

/* derived from @(#)rcmd.c	5.17 (Berkeley) 6/27/88 */

#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <ctype.h>
#include <string.h>
#include <pwd.h>
#include <sys/param.h>
#include <sys/types.h>
#include <fcntl.h>

#include <signal.h>
#include <sys/file.h>
#include <sys/socket.h>
#include <sys/stat.h>

#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <locale.h>
#include <syslog.h>

#include <errno.h>
#include <com_err.h>
#include <k5-int.h>
#include <kcmd.h>

static char *default_service = "host";

#define	KCMD_BUFSIZ	102400
#define	KCMD8_BUFSIZ	(4096 - 256)
/*
 * For compatibility with earlier versions of Solaris and other OS
 * (kerborized rsh uses 4KB of RSH_BUFSIZE)- 256 to make sure
 * there is room
 */
static int deswrite_compat(int, char *, int, int);

#define	KCMD_KEYUSAGE	1026

static char storage[KCMD_BUFSIZ];
static int nstored = 0;
static int MAXSIZE = (KCMD_BUFSIZ + 8);
static char *store_ptr = storage;
static krb5_data desinbuf, desoutbuf;

static boolean_t encrypt_flag = B_FALSE;
static krb5_context kcmd_context;

/* XXX Overloaded: use_ivecs!=0 -> new protocol, inband signalling, etc.  */
static boolean_t use_ivecs = B_FALSE;
static krb5_data encivec_i[2], encivec_o[2];
static krb5_keyusage enc_keyusage_i[2], enc_keyusage_o[2];
static krb5_enctype final_enctype;
static krb5_keyblock *skey;

/* ARGSUSED */
int
kcmd(int *sock, char **ahost, ushort_t rport,
	char *locuser, char *remuser,
	char *cmd, int *fd2p, char *service, char *realm,
	krb5_context bsd_context, krb5_auth_context *authconp,
	krb5_creds **cred, krb5_int32 *seqno, krb5_int32 *server_seqno,
	krb5_flags authopts,
	int anyport, enum kcmd_proto *protonump)
{
	int s = -1;
	sigset_t oldmask, urgmask;
	struct sockaddr_in sin;
	struct sockaddr_storage from;
	krb5_creds *get_cred = NULL;
	krb5_creds *ret_cred = NULL;
	char c;
	struct hostent *hp;
	int rc;
	char *host_save = NULL;
	krb5_error_code status;
	krb5_ap_rep_enc_part *rep_ret;
	krb5_error	*error = 0;
	krb5_ccache cc;
	krb5_data outbuf;
	krb5_flags options = authopts;
	krb5_auth_context auth_context = NULL;
	char *cksumbuf;
	krb5_data cksumdat;
	int bsize = 0;
	char *kcmd_version;
	enum kcmd_proto protonum = *protonump;

	bsize = strlen(cmd) + strlen(remuser) + 64;
	if ((cksumbuf = malloc(bsize)) == 0) {
		(void) fprintf(stderr, gettext("Unable to allocate"
					    " memory for checksum buffer.\n"));
		return (-1);
	}
	(void) snprintf(cksumbuf, bsize, "%u:", ntohs(rport));
	if (strlcat(cksumbuf, cmd, bsize) >= bsize) {
		(void) fprintf(stderr, gettext("cmd buffer too long.\n"));
		free(cksumbuf);
		return (-1);
	}
	if (strlcat(cksumbuf, remuser, bsize) >= bsize) {
		(void) fprintf(stderr, gettext("remuser too long.\n"));
		free(cksumbuf);
		return (-1);
	}
	cksumdat.data = cksumbuf;
	cksumdat.length = strlen(cksumbuf);

	hp = gethostbyname(*ahost);
	if (hp == 0) {
		(void) fprintf(stderr,
			    gettext("%s: unknown host\n"), *ahost);
		return (-1);
	}

	if ((host_save = (char *)strdup(hp->h_name)) == NULL) {
		(void) fprintf(stderr, gettext("kcmd: no memory\n"));
		return (-1);
	}

	/* If no service is given set to the default service */
	if (!service) service = default_service;

	if (!(get_cred = (krb5_creds *)calloc(1, sizeof (krb5_creds)))) {
		(void) fprintf(stderr, gettext("kcmd: no memory\n"));
		return (-1);
	}
	(void) sigemptyset(&urgmask);
	(void) sigaddset(&urgmask, SIGURG);
	(void) sigprocmask(SIG_BLOCK, &urgmask, &oldmask);

	status = krb5_sname_to_principal(bsd_context, host_save, service,
					KRB5_NT_SRV_HST, &get_cred->server);
	if (status) {
		(void) fprintf(stderr,
			    gettext("kcmd: "
				    "krb5_sname_to_principal failed: %s\n"),
			    error_message(status));
		status = -1;
		goto bad;
	}

	if (realm && *realm) {
		(void) krb5_xfree(
			krb5_princ_realm(bsd_context, get_cred->server)->data);
		krb5_princ_set_realm_length(bsd_context, get_cred->server,
					strlen(realm));
		krb5_princ_set_realm_data(bsd_context, get_cred->server,
						strdup(realm));
	}

	s = socket(AF_INET, SOCK_STREAM, 0);
	if (s < 0) {
		perror(gettext("Error creating socket"));
		status = -1;
		goto bad;
	}
	/*
	 * Kerberos only supports IPv4 addresses for now.
	 */
	if (hp->h_addrtype == AF_INET) {
		sin.sin_family = hp->h_addrtype;
		(void) memcpy((void *)&sin.sin_addr,
			    hp->h_addr, hp->h_length);
		sin.sin_port = rport;
	} else {
		syslog(LOG_ERR, "Address type %d not supported for "
		    "Kerberos", hp->h_addrtype);
		status = -1;
		goto bad;
	}

	if (connect(s, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
		perror(host_save);
		status = -1;
		goto bad;
	}

	if (fd2p == 0) {
		(void) write(s, "", 1);
	} else {
		char num[16];
		int s2;
		int s3;
		struct sockaddr_storage sname;
		struct sockaddr_in *sp;
		int len = sizeof (struct sockaddr_storage);

		s2 = socket(AF_INET, SOCK_STREAM, 0);
		if (s2 < 0) {
			status = -1;
			goto bad;
		}
		(void) memset((char *)&sin, 0, sizeof (sin));
		sin.sin_family = AF_INET;
		sin.sin_addr.s_addr = INADDR_ANY;
		sin.sin_port = 0;

		if (bind(s2, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
			perror(gettext("error binding socket"));
			(void) close(s2);
			status = -1;
			goto bad;
		}
		if (getsockname(s2, (struct sockaddr *)&sname, &len) < 0) {
			perror(gettext("getsockname error"));
			(void) close(s2);
			status = -1;
			goto bad;
		}
		sp = (struct sockaddr_in *)&sname;
		(void) listen(s2, 1);
		(void) snprintf(num, sizeof (num), "%d",
			    htons((ushort_t)sp->sin_port));
		if (write(s, num, strlen(num)+1) != strlen(num)+1) {
			perror(gettext("write: error setting up stderr"));
			(void) close(s2);
			status = -1;
			goto bad;
		}

		s3 = accept(s2, (struct sockaddr *)&from, &len);
		(void) close(s2);
		if (s3 < 0) {
			perror(gettext("accept"));
			status = -1;
			goto bad;
		}
		*fd2p = s3;
		if (SOCK_FAMILY(from) == AF_INET) {
			if (!anyport && SOCK_PORT(from) >= IPPORT_RESERVED) {
				(void) fprintf(stderr,
				    gettext("socket: protocol "
					    "failure in circuit setup.\n"));
				status = -1;
				goto bad2;
			}
		} else {
			(void) fprintf(stderr,
				    gettext("Kerberos does not support "
					    "address type %d\n"),
				    SOCK_FAMILY(from));
			status = -1;
			goto bad2;
		}
	}

	if (status = krb5_cc_default(bsd_context, &cc))
		goto bad2;

	status = krb5_cc_get_principal(bsd_context, cc, &get_cred->client);
	if (status) {
		(void) krb5_cc_close(bsd_context, cc);
		goto bad2;
	}

	/* Get ticket from credentials cache or kdc */
	status = krb5_get_credentials(bsd_context, 0, cc, get_cred, &ret_cred);
	(void) krb5_cc_close(bsd_context, cc);
	if (status) goto bad2;

	/* Reset internal flags; these should not be sent. */
	authopts &= (~OPTS_FORWARD_CREDS);
	authopts &= (~OPTS_FORWARDABLE_CREDS);

	if ((status = krb5_auth_con_init(bsd_context, &auth_context)))
		goto bad2;

	if ((status = krb5_auth_con_setflags(bsd_context, auth_context,
					KRB5_AUTH_CONTEXT_RET_TIME)))
		goto bad2;

	/* Only need local address for mk_cred() to send to krlogind */
	if ((status = krb5_auth_con_genaddrs(bsd_context, auth_context, s,
			KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR)))
		goto bad2;

	if (protonum == KCMD_PROTOCOL_COMPAT_HACK) {
		krb5_boolean is_des;
		status = krb5_c_enctype_compare(bsd_context,
						ENCTYPE_DES_CBC_CRC,
						ret_cred->keyblock.enctype,
						&is_des);
		if (status)
			goto bad2;
		protonum = is_des ? KCMD_OLD_PROTOCOL : KCMD_NEW_PROTOCOL;
	}

	switch (protonum) {
	case KCMD_NEW_PROTOCOL:
		authopts |= AP_OPTS_USE_SUBKEY;
		kcmd_version = "KCMDV0.2";
		break;
	case KCMD_OLD_PROTOCOL:
		kcmd_version = "KCMDV0.1";
		break;
	default:
		status = -1;
		goto bad2;
	}

	/*
	 * Call the Kerberos library routine to obtain an authenticator,
	 * pass it over the socket to the server, and obtain mutual
	 * authentication.
	 */
	status = krb5_sendauth(bsd_context, &auth_context, (krb5_pointer) &s,
			kcmd_version, ret_cred->client, ret_cred->server,
			authopts, &cksumdat, ret_cred, 0, &error,
			&rep_ret, NULL);
	krb5_xfree(cksumdat.data);
	if (status) {
		(void) fprintf(stderr, gettext("Couldn't authenticate"
					    " to server: %s\n"),
			    error_message(status));
		if (error) {
			(void) fprintf(stderr, gettext("Server returned error"
						" code %d (%s)\n"),
				error->error,
				error_message(ERROR_TABLE_BASE_krb5 +
					    error->error));
			if (error->text.length)
				(void) fprintf(stderr,
					    gettext("Error text"
						    " sent from server: %s\n"),
					    error->text.data);
		}
		if (error) {
			krb5_free_error(bsd_context, error);
			error = 0;
		}
		goto bad2;
	}
	if (rep_ret && server_seqno) {
		*server_seqno = rep_ret->seq_number;
		krb5_free_ap_rep_enc_part(bsd_context, rep_ret);
	}

	(void) write(s, remuser, strlen(remuser)+1);
	(void) write(s, cmd, strlen(cmd)+1);
	if (locuser)
		(void) write(s, locuser, strlen(locuser)+1);
	else
		(void) write(s, "", 1);

	if (options & OPTS_FORWARD_CREDS) {   /* Forward credentials */
		if (status = krb5_fwd_tgt_creds(bsd_context, auth_context,
					host_save,
					ret_cred->client, ret_cred->server,
					0, options & OPTS_FORWARDABLE_CREDS,
					&outbuf)) {
			(void) fprintf(stderr,
				    gettext("kcmd: Error getting"
					    " forwarded creds\n"));
			goto bad2;
		}
		/* Send forwarded credentials */
		if (status = krb5_write_message(bsd_context, (krb5_pointer)&s,
						&outbuf))
			goto bad2;
	} else { /* Dummy write to signal no forwarding */
		outbuf.length = 0;
		if (status = krb5_write_message(bsd_context,
						(krb5_pointer)&s, &outbuf))
			goto bad2;
	}

	if ((rc = read(s, &c, 1)) != 1) {
		if (rc == -1) {
			perror(*ahost);
		} else {
			(void) fprintf(stderr, gettext("kcmd: bad connection "
					"with remote host\n"));
		}
		status = -1;
		goto bad2;
	}
	if (c != 0) {
		while (read(s, &c, 1) == 1) {
			(void) write(2, &c, 1);
			if (c == '\n')
				break;
		}
		status = -1;
		goto bad2;
	}
	(void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
	*sock = s;

	/* pass back credentials if wanted */
	if (cred) krb5_copy_creds(bsd_context, ret_cred, cred);
		krb5_free_creds(bsd_context, ret_cred);
	/*
	 * Initialize *authconp to auth_context, so
	 * that the clients can make use of it
	 */
	*authconp = auth_context;

	return (0);
bad2:
	if (fd2p != NULL)
		(void) close(*fd2p);
bad:
	if (s > 0)
		(void) close(s);
	if (get_cred)
		krb5_free_creds(bsd_context, get_cred);
	if (ret_cred)
		krb5_free_creds(bsd_context, ret_cred);
	if (host_save)
		free(host_save);
	(void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
	return (status);
}

/*
 * Strsave was a routine in the version 4 krb library: we put it here
 * for compatablilty with version 5 krb library, since kcmd.o is linked
 * into all programs.
 */

char *
strsave(char *sp)
{
	char *ret;

	if ((ret = (char *)strdup(sp)) == NULL) {
		(void) fprintf(stderr, gettext("no memory for saving args\n"));
		exit(1);
	}
	return (ret);
}

/*
 * Decode, decrypt and store the forwarded creds in the local ccache.
 */
krb5_error_code
rd_and_store_for_creds(krb5_context context,
		    krb5_auth_context auth_context,
		    krb5_data *inbuf,
		    krb5_ticket *ticket,
		    char *lusername,
		    krb5_ccache *ccache)
{
	krb5_creds ** creds;
	krb5_error_code retval;
	char ccname[64];
	struct passwd *pwd;
	uid_t uid;

	*ccache = NULL;
	if (!(pwd = (struct passwd *)getpwnam(lusername)))
		return (ENOENT);

	uid = getuid();
	if (seteuid(pwd->pw_uid))
		return (-1);

	if ((retval =
		krb5_rd_cred(context, auth_context, inbuf, &creds, NULL)) != 0)
		return (retval);

	(void) snprintf(ccname, sizeof (ccname),
			"FILE:/tmp/krb5cc_%ld", pwd->pw_uid);

	if ((retval = krb5_cc_resolve(context, ccname, ccache)) != 0)
		goto cleanup;

	if ((retval = krb5_cc_initialize(context, *ccache,
					ticket->enc_part2->client)) != 0)
		goto cleanup;

	if ((retval = krb5_cc_store_cred(context, *ccache, *creds)) != 0)
		goto cleanup;

	if ((retval = krb5_cc_close(context, *ccache)) != 0)
		goto cleanup;

cleanup:
	(void) seteuid(uid);
	krb5_free_creds(context, *creds);
	return (retval);
}

/*
 * This routine is to initialize the desinbuf, desoutbuf and the session key
 * structures to carry out desread()'s and deswrite()'s successfully
 */
void
init_encrypt(int enc, krb5_context ctxt, enum kcmd_proto protonum,
	krb5_data *inbuf, krb5_data *outbuf,
	int amclient, krb5_encrypt_block *block)
{
	krb5_error_code statuscode;
	size_t blocksize;
	int i;
	krb5_error_code ret;

	kcmd_context = ctxt;

	if (enc > 0) {
		desinbuf.data = inbuf->data;
		desoutbuf.data = outbuf->data + 4;
		desinbuf.length = inbuf->length;
		desoutbuf.length = outbuf->length + 4;
		encrypt_flag = B_TRUE;
	} else {
		encrypt_flag = B_FALSE;
		return;
	}

	skey = block->key;
	final_enctype = skey->enctype;

	enc_keyusage_i[0] = KCMD_KEYUSAGE;
	enc_keyusage_i[1] = KCMD_KEYUSAGE;
	enc_keyusage_o[0] = KCMD_KEYUSAGE;
	enc_keyusage_o[1] = KCMD_KEYUSAGE;

	if (protonum == KCMD_OLD_PROTOCOL) {
		use_ivecs = B_FALSE;
		return;
	}

	use_ivecs = B_TRUE;
	switch (skey->enctype) {
	/*
	 * For the DES-based enctypes and the 3DES enctype we
	 * want to use a non-zero  IV because that's what we did.
	 * In the future we use different keyusage for each
	 * channel and direction and a fresh cipher state.
	 */
	case ENCTYPE_DES_CBC_CRC:
	case ENCTYPE_DES_CBC_MD4:
	case ENCTYPE_DES_CBC_MD5:
	case ENCTYPE_DES3_CBC_SHA1:
		statuscode = krb5_c_block_size(kcmd_context, final_enctype,
				&blocksize);
		if (statuscode) {
			/* XXX what do I do? */
			abort();
		}

		encivec_i[0].length = encivec_i[1].length =
		encivec_o[0].length = encivec_o[1].length = blocksize;

		if ((encivec_i[0].data = malloc(encivec_i[0].length * 4))
			== NULL) {
			/* XXX what do I do? */
			abort();
		}
		encivec_i[1].data = encivec_i[0].data + encivec_i[0].length;
		encivec_o[0].data = encivec_i[1].data + encivec_i[0].length;
		encivec_o[1].data = encivec_o[0].data + encivec_i[0].length;

		/* is there a better way to initialize this? */
		(void) memset(encivec_i[0].data, amclient, blocksize);
		(void) memset(encivec_o[0].data, 1 - amclient, blocksize);
		(void) memset(encivec_i[1].data, 2 | amclient, blocksize);
		(void) memset(encivec_o[1].data, 2 | (1 - amclient), blocksize);
		break;
	default:
		if (amclient) {
			enc_keyusage_i[0] = 1028;
			enc_keyusage_i[1] = 1030;
			enc_keyusage_o[0] = 1032;
			enc_keyusage_o[1] = 1034;
		} else { /* amclient */
			enc_keyusage_i[0] = 1032;
			enc_keyusage_i[1] = 1034;
			enc_keyusage_o[0] = 1028;
			enc_keyusage_o[1] = 1030;
		}
		for (i = 0; i < 2; i++) {
			ret = krb5_c_init_state(ctxt,
				skey, enc_keyusage_i[i],
				&encivec_i[i]);
			if (ret)
				goto fail;
			ret = krb5_c_init_state(ctxt,
				skey, enc_keyusage_o[i],
				&encivec_o[i]);
			if (ret)
				goto fail;
		}
		break;
	}
	return;
fail:
	abort();
}

int
desread(int fd, char *buf, int len, int secondary)
{
	int nreturned = 0;
	long net_len, rd_len;
	int cc;
	size_t ret = 0;
	unsigned char len_buf[4];
	krb5_enc_data inputd;
	krb5_data outputd;

	if (!encrypt_flag)
		return (read(fd, buf, len));

	/*
	 * If there is stored data from a previous read,
	 * put it into the output buffer and return it now.
	 */
	if (nstored >= len) {
		(void) memcpy(buf, store_ptr, len);
		store_ptr += len;
		nstored -= len;
		return (len);
	} else if (nstored) {
		(void) memcpy(buf, store_ptr, nstored);
		nreturned += nstored;
		buf += nstored;
		len -= nstored;
		nstored = 0;
	}

	if ((cc = krb5_net_read(kcmd_context, fd, (char *)len_buf, 4)) != 4) {
		if ((cc < 0) && ((errno == EWOULDBLOCK) || (errno == EAGAIN)))
			return (cc);
		/* XXX can't read enough, pipe must have closed */
		return (0);
	}
	rd_len = ((len_buf[0] << 24) | (len_buf[1] << 16) |
		    (len_buf[2] << 8) | len_buf[3]);

	if (krb5_c_encrypt_length(kcmd_context, final_enctype,
				use_ivecs ? (size_t)rd_len + 4 : (size_t)rd_len,
				&ret))
		net_len = ((size_t)-1);
	else
		net_len = ret;

	if ((net_len <= 0) || (net_len > desinbuf.length)) {
		/*
		 * preposterous length; assume out-of-sync; only recourse
		 * is to close connection, so return 0
		 */
		(void) fprintf(stderr, gettext("Read size problem.\n"));
		return (0);
	}

	if ((cc = krb5_net_read(kcmd_context, fd, desinbuf.data, net_len))
	    != net_len) {
		/* pipe must have closed, return 0 */
		(void) fprintf(stderr,
			    gettext("Read error: length received %d "
				    "!= expected %d.\n"),
			    cc, net_len);
		return (0);
	}

	/*
	 * Decrypt information
	 */
	inputd.enctype = ENCTYPE_UNKNOWN;
	inputd.ciphertext.length = net_len;
	inputd.ciphertext.data = (krb5_pointer)desinbuf.data;

	outputd.length = sizeof (storage);
	outputd.data = (krb5_pointer)storage;

	/*
	 * data is decrypted into the "storage" buffer, which
	 * had better be large enough!
	 */
	cc = krb5_c_decrypt(kcmd_context, skey,
				enc_keyusage_i[secondary],
				use_ivecs ? encivec_i + secondary : 0,
				&inputd, &outputd);
	if (cc) {
		(void) fprintf(stderr, gettext("Cannot decrypt data "
			"from network\n"));
		return (0);
	}

	store_ptr = storage;
	nstored = rd_len;
	if (use_ivecs == B_TRUE) {
		int rd_len2;
		rd_len2 = storage[0] & 0xff;
		rd_len2 <<= 8; rd_len2 |= storage[1] & 0xff;
		rd_len2 <<= 8; rd_len2 |= storage[2] & 0xff;
		rd_len2 <<= 8; rd_len2 |= storage[3] & 0xff;
		if (rd_len2 != rd_len) {
			/* cleartext length trashed? */
			errno = EIO;
			return (-1);
		}
		store_ptr += 4;
	}
	/*
	 * Copy only as much data as the input buffer will allow.
	 * The rest is kept in the 'storage' pointer for the next
	 * read.
	 */
	if (nstored > len) {
		(void) memcpy(buf, store_ptr, len);
		nreturned += len;
		store_ptr += len;
		nstored -= len;
	} else {
		(void) memcpy(buf, store_ptr, nstored);
		nreturned += nstored;
		nstored = 0;
	}

	return (nreturned);
}
int
deswrite(int fd, char *buf, int len, int secondary)
{
	int bytes_written;
	int r;
	int outlen;
	char *p;
	if (!encrypt_flag)
		return (write(fd, buf, len));

	bytes_written = 0;
	while (len > 0) {
		p = buf + bytes_written;
		if (len > KCMD8_BUFSIZ)
			outlen = KCMD8_BUFSIZ;
		else
			outlen = len;
		r = deswrite_compat(fd, p, outlen, secondary);
		if (r == -1)
			return (r);
		bytes_written += r;
		len -= r;
	}
	return (bytes_written);
}
static int
deswrite_compat(int fd, char *buf, int len, int secondary)
{
	int cc;
	size_t ret = 0;
	krb5_data inputd;
	krb5_enc_data outputd;
	char tmpbuf[KCMD_BUFSIZ + 8];
	char encrbuf[KCMD_BUFSIZ + 8];
	unsigned char *len_buf = (unsigned char *)tmpbuf;

	if (use_ivecs == B_TRUE) {
		unsigned char *lenbuf2 = (unsigned char *)tmpbuf;
		if (len + 4 > sizeof (tmpbuf))
			abort();
		lenbuf2[0] = (len & 0xff000000) >> 24;
		lenbuf2[1] = (len & 0xff0000) >> 16;
		lenbuf2[2] = (len & 0xff00) >> 8;
		lenbuf2[3] = (len & 0xff);
		(void) memcpy(tmpbuf + 4, buf, len);

		inputd.data = (krb5_pointer)tmpbuf;
		inputd.length = len + 4;
	} else {
		inputd.data = (krb5_pointer)buf;
		inputd.length = len;
	}

	desoutbuf.data = encrbuf;

	if (krb5_c_encrypt_length(kcmd_context, final_enctype,
			use_ivecs ? (size_t)len + 4 : (size_t)len, &ret)) {
		desoutbuf.length = ((size_t)-1);
		goto err;
	} else {
		desoutbuf.length = ret;
	}

	if (desoutbuf.length > MAXSIZE) {
		(void) fprintf(stderr, gettext("Write size problem.\n"));
		return (-1);
	}

	/*
	 * Encrypt information
	 */
	outputd.ciphertext.length = desoutbuf.length;
	outputd.ciphertext.data = (krb5_pointer)desoutbuf.data;

	cc = krb5_c_encrypt(kcmd_context, skey,
			enc_keyusage_o[secondary],
			use_ivecs ? encivec_o + secondary : 0,
			&inputd, &outputd);

	if (cc) {
err:
		(void) fprintf(stderr, gettext("Write encrypt problem.\n"));
		return (-1);
	}

	len_buf[0] = (len & 0xff000000) >> 24;
	len_buf[1] = (len & 0xff0000) >> 16;
	len_buf[2] = (len & 0xff00) >> 8;
	len_buf[3] = (len & 0xff);
	(void) write(fd, len_buf, 4);

	if (write(fd, desoutbuf.data, desoutbuf.length) != desoutbuf.length) {
		(void) fprintf(stderr, gettext("Could not write "
			"out all data.\n"));
		return (-1);
	} else {
		return (len);
	}
}