kadmin/server.c

   1 /*
   2  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <krb5-private.h>
  36
  37 static kadm5_ret_t
  38 kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
  39                  krb5_data *in, krb5_data *out)
  40 {
  41     kadm5_ret_t ret;
  42     int32_t cmd, mask, tmp;
  43     kadm5_server_context *contextp = kadm_handlep;
  44     char client[128], name[128], name2[128];
  45     const char *op = "";
  46     krb5_principal princ, princ2;
  47     kadm5_principal_ent_rec ent;
  48     char *password, *expression;
  49     krb5_keyblock *new_keys;
  50     krb5_key_salt_tuple *ks_tuple = NULL;
  51     krb5_boolean keepold = FALSE;
  52     int n_ks_tuple = 0;
  53     int n_keys;
  54     char **princs;
  55     int n_princs;
  56     int keys_ok = 0;
  57     krb5_storage *sp;
  58
  59     krb5_unparse_name_fixed(contextp->context, contextp->caller,
  60                             client, sizeof(client));
  61
  62     sp = krb5_storage_from_data(in);
  63     if (sp == NULL)
  64         krb5_errx(contextp->context, 1, "out of memory");
  65
  66     krb5_ret_int32(sp, &cmd);
  67     switch(cmd){
  68     case kadm_get:{
  69         op = "GET";
  70         ret = krb5_ret_principal(sp, &princ);
  71         if(ret)
  72             goto fail;
  73         ret = krb5_ret_int32(sp, &mask);
  74         if(ret){
  75             krb5_free_principal(contextp->context, princ);
  76             goto fail;
  77         }
  78         mask |= KADM5_PRINCIPAL;
  79         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
  80         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
  81
  82         /* If the caller doesn't have KADM5_PRIV_GET, we're done. */
  83         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET, princ);
  84         if (ret) {
  85             krb5_free_principal(contextp->context, princ);
  86             goto fail;
  87         }
  88
  89         /* Then check to see if it is ok to return keys */
  90         if ((mask & KADM5_KEY_DATA) != 0) {
  91             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET_KEYS,
  92                                               princ);
  93             if (ret == 0) {
  94                 keys_ok = 1;
  95             } else if ((mask == (KADM5_PRINCIPAL|KADM5_KEY_DATA)) ||
  96                        (mask == (KADM5_PRINCIPAL|KADM5_KVNO|KADM5_KEY_DATA))) {
  97                 /*
  98                  * Requests for keys will get bogus keys, which is useful if
  99                  * the client just wants to see what (kvno, enctype)s the
 100                  * principal has keys for, but terrible if the client wants to
 101                  * write the keys into a keytab or modify the principal and
 102                  * write the bogus keys back to the server.
 103                  *
 104                  * We use a heuristic to detect which case we're handling here.
 105                  * If the client only asks for the flags in the above
 106                  * condition, then it's very likely a kadmin ext_keytab,
 107                  * add_enctype, or other request that should not see bogus
 108                  * keys.  We deny them.
 109                  *
 110                  * The kadmin get command can be coaxed into making a request
 111                  * with the same mask.  But the default long and terse output
 112                  * modes request other things too, so in all likelihood this
 113                  * heuristic will not hurt any kadmin get uses.
 114                  */
 115                 krb5_free_principal(contextp->context, princ);
 116                 goto fail;
 117             }
 118         }
 119
 120         ret = kadm5_get_principal(kadm_handlep, princ, &ent, mask);
 121         krb5_storage_free(sp);
 122         sp = krb5_storage_emem();
 123         krb5_store_int32(sp, ret);
 124         if (ret == 0){
 125             if (keys_ok)
 126                 kadm5_store_principal_ent(sp, &ent);
 127             else
 128                 kadm5_store_principal_ent_nokeys(sp, &ent);
 129             kadm5_free_principal_ent(kadm_handlep, &ent);
 130         }
 131         krb5_free_principal(contextp->context, princ);
 132         break;
 133     }
 134     case kadm_delete:{
 135         op = "DELETE";
 136         ret = krb5_ret_principal(sp, &princ);
 137         if(ret)
 138             goto fail;
 139         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 140         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 141         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_DELETE, princ);
 142         if(ret){
 143             krb5_free_principal(contextp->context, princ);
 144             goto fail;
 145         }
 146         ret = kadm5_delete_principal(kadm_handlep, princ);
 147         krb5_free_principal(contextp->context, princ);
 148         krb5_storage_free(sp);
 149         sp = krb5_storage_emem();
 150         krb5_store_int32(sp, ret);
 151         break;
 152     }
 153     case kadm_create:{
 154         op = "CREATE";
 155         ret = kadm5_ret_principal_ent(sp, &ent);
 156         if(ret)
 157             goto fail;
 158         ret = krb5_ret_int32(sp, &mask);
 159         if(ret){
 160             kadm5_free_principal_ent(contextp->context, &ent);
 161             goto fail;
 162         }
 163         ret = krb5_ret_string(sp, &password);
 164         if(ret){
 165             kadm5_free_principal_ent(contextp->context, &ent);
 166             goto fail;
 167         }
 168         krb5_unparse_name_fixed(contextp->context, ent.principal,
 169                                 name, sizeof(name));
 170         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 171         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD,
 172                                           ent.principal);
 173         if(ret){
 174             kadm5_free_principal_ent(contextp->context, &ent);
 175             memset(password, 0, strlen(password));
 176             free(password);
 177             goto fail;
 178         }
 179         ret = kadm5_create_principal(kadm_handlep, &ent,
 180                                      mask, password);
 181         kadm5_free_principal_ent(kadm_handlep, &ent);
 182         memset(password, 0, strlen(password));
 183         free(password);
 184         krb5_storage_free(sp);
 185         sp = krb5_storage_emem();
 186         krb5_store_int32(sp, ret);
 187         break;
 188     }
 189     case kadm_modify:{
 190         op = "MODIFY";
 191         ret = kadm5_ret_principal_ent(sp, &ent);
 192         if(ret)
 193             goto fail;
 194         ret = krb5_ret_int32(sp, &mask);
 195         if(ret){
 196             kadm5_free_principal_ent(contextp, &ent);
 197             goto fail;
 198         }
 199         krb5_unparse_name_fixed(contextp->context, ent.principal,
 200                                 name, sizeof(name));
 201         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 202         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_MODIFY,
 203                                           ent.principal);
 204         if(ret){
 205             kadm5_free_principal_ent(contextp, &ent);
 206             goto fail;
 207         }
 208         ret = kadm5_modify_principal(kadm_handlep, &ent, mask);
 209         kadm5_free_principal_ent(kadm_handlep, &ent);
 210         krb5_storage_free(sp);
 211         sp = krb5_storage_emem();
 212         krb5_store_int32(sp, ret);
 213         break;
 214     }
 215     case kadm_rename:{
 216         op = "RENAME";
 217         ret = krb5_ret_principal(sp, &princ);
 218         if(ret)
 219             goto fail;
 220         ret = krb5_ret_principal(sp, &princ2);
 221         if(ret){
 222             krb5_free_principal(contextp->context, princ);
 223             goto fail;
 224         }
 225         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 226         krb5_unparse_name_fixed(contextp->context, princ2, name2, sizeof(name2));
 227         krb5_warnx(contextp->context, "%s: %s %s -> %s",
 228                    client, op, name, name2);
 229         ret = _kadm5_acl_check_permission(contextp,
 230                                           KADM5_PRIV_ADD,
 231                                           princ2)
 232             || _kadm5_acl_check_permission(contextp,
 233                                            KADM5_PRIV_DELETE,
 234                                            princ);
 235         if(ret){
 236             krb5_free_principal(contextp->context, princ);
 237             krb5_free_principal(contextp->context, princ2);
 238             goto fail;
 239         }
 240         ret = kadm5_rename_principal(kadm_handlep, princ, princ2);
 241         krb5_free_principal(contextp->context, princ);
 242         krb5_free_principal(contextp->context, princ2);
 243         krb5_storage_free(sp);
 244         sp = krb5_storage_emem();
 245         krb5_store_int32(sp, ret);
 246         break;
 247     }
 248     case kadm_chpass:{
 249         op = "CHPASS";
 250         ret = krb5_ret_principal(sp, &princ);
 251         if (ret)
 252             goto fail;
 253         ret = krb5_ret_string(sp, &password);
 254         if (ret) {
 255             krb5_free_principal(contextp->context, princ);
 256             goto fail;
 257         }
 258         ret = krb5_ret_int32(sp, &keepold);
 259         if (ret && ret != HEIM_ERR_EOF) {
 260             krb5_free_principal(contextp->context, princ);
 261             goto fail;
 262         }
 263         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 264         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 265
 266         /*
 267          * The change is allowed if at least one of:
 268          *
 269          * a) allowed by sysadmin
 270          * b) it's for the principal him/herself and this was an
 271          *    initial ticket, but then, check with the password quality
 272          *    function.
 273          * c) the user is on the CPW ACL.
 274          */
 275
 276         if (krb5_config_get_bool_default(contextp->context, NULL, TRUE,
 277                                          "kadmin", "allow_self_change_password", NULL)
 278             && initial
 279             && krb5_principal_compare (contextp->context, contextp->caller,
 280                                        princ))
 281         {
 282             krb5_data pwd_data;
 283             const char *pwd_reason;
 284
 285             pwd_data.data = password;
 286             pwd_data.length = strlen(password);
 287
 288             pwd_reason = kadm5_check_password_quality (contextp->context,
 289                                                        princ, &pwd_data);
 290             if (pwd_reason != NULL)
 291                 ret = KADM5_PASS_Q_DICT;
 292             else
 293                 ret = 0;
 294         } else
 295             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 296
 297         if(ret) {
 298             krb5_free_principal(contextp->context, princ);
 299             memset(password, 0, strlen(password));
 300             free(password);
 301             goto fail;
 302         }
 303         ret = kadm5_chpass_principal_3(kadm_handlep, princ, keepold, 0, NULL,
 304                                        password);
 305         krb5_free_principal(contextp->context, princ);
 306         memset(password, 0, strlen(password));
 307         free(password);
 308         krb5_storage_free(sp);
 309         sp = krb5_storage_emem();
 310         krb5_store_int32(sp, ret);
 311         break;
 312     }
 313     case kadm_chpass_with_key:{
 314         int i;
 315         krb5_key_data *key_data;
 316         int n_key_data;
 317
 318         op = "CHPASS_WITH_KEY";
 319         ret = krb5_ret_principal(sp, &princ);
 320         if(ret)
 321             goto fail;
 322         ret = krb5_ret_int32(sp, &n_key_data);
 323         if (ret) {
 324             krb5_free_principal(contextp->context, princ);
 325             goto fail;
 326         }
 327         ret = krb5_ret_int32(sp, &keepold);
 328         if (ret && ret != HEIM_ERR_EOF) {
 329             krb5_free_principal(contextp->context, princ);
 330             goto fail;
 331         }
 332         /* n_key_data will be squeezed into an int16_t below. */
 333         if (n_key_data < 0 || n_key_data >= 1 << 16 ||
 334             (size_t)n_key_data > UINT_MAX/sizeof(*key_data)) {
 335             ret = ERANGE;
 336             krb5_free_principal(contextp->context, princ);
 337             goto fail;
 338         }
 339
 340         key_data = malloc (n_key_data * sizeof(*key_data));
 341         if (key_data == NULL && n_key_data != 0) {
 342             ret = ENOMEM;
 343             krb5_free_principal(contextp->context, princ);
 344             goto fail;
 345         }
 346
 347         for (i = 0; i < n_key_data; ++i) {
 348             ret = kadm5_ret_key_data (sp, &key_data[i]);
 349             if (ret) {
 350                 int16_t dummy = i;
 351
 352                 kadm5_free_key_data (contextp, &dummy, key_data);
 353                 free (key_data);
 354                 krb5_free_principal(contextp->context, princ);
 355                 goto fail;
 356             }
 357         }
 358
 359         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 360         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 361
 362         /*
 363          * The change is only allowed if the user is on the CPW ACL,
 364          * this it to force password quality check on the user.
 365          */
 366
 367         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 368         if(ret) {
 369             int16_t dummy = n_key_data;
 370
 371             kadm5_free_key_data (contextp, &dummy, key_data);
 372             free (key_data);
 373             krb5_free_principal(contextp->context, princ);
 374             goto fail;
 375         }
 376         ret = kadm5_chpass_principal_with_key_3(kadm_handlep, princ, keepold,
 377                                                 n_key_data, key_data);
 378         {
 379             int16_t dummy = n_key_data;
 380             kadm5_free_key_data (contextp, &dummy, key_data);
 381         }
 382         free (key_data);
 383         krb5_free_principal(contextp->context, princ);
 384         krb5_storage_free(sp);
 385         sp = krb5_storage_emem();
 386         krb5_store_int32(sp, ret);
 387         break;
 388     }
 389     case kadm_randkey:{
 390         op = "RANDKEY";
 391         ret = krb5_ret_principal(sp, &princ);
 392         if(ret)
 393             goto fail;
 394         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 395         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 396         /*
 397          * The change is allowed if at least one of:
 398          * a) it's for the principal him/herself and this was an initial ticket
 399          * b) the user is on the CPW ACL.
 400          */
 401
 402         if (initial
 403             && krb5_principal_compare (contextp->context, contextp->caller,
 404                                        princ))
 405             ret = 0;
 406         else
 407             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 408
 409         if(ret) {
 410             krb5_free_principal(contextp->context, princ);
 411             goto fail;
 412         }
 413
 414         /*
 415          * See comments in kadm5_c_randkey_principal() regarding the
 416          * protocol.
 417          */
 418         ret = krb5_ret_int32(sp, &keepold);
 419         if (ret != 0 && ret != HEIM_ERR_EOF) {
 420             krb5_free_principal(contextp->context, princ);
 421             goto fail;
 422         }
 423
 424         ret = krb5_ret_int32(sp, &n_ks_tuple);
 425         if (ret != 0 && ret != HEIM_ERR_EOF) {
 426             krb5_free_principal(contextp->context, princ);
 427             goto fail;
 428         } else if (ret == 0) {
 429             size_t i;
 430
 431             if (n_ks_tuple < 0) {
 432                 ret = EOVERFLOW;
 433                 krb5_free_principal(contextp->context, princ);
 434                 goto fail;
 435             }
 436
 437             if ((ks_tuple = calloc(n_ks_tuple, sizeof (*ks_tuple))) == NULL) {
 438                 ret = errno;
 439                 krb5_free_principal(contextp->context, princ);
 440                 goto fail;
 441             }
 442
 443             for (i = 0; i < n_ks_tuple; i++) {
 444                 ret = krb5_ret_int32(sp, &ks_tuple[i].ks_enctype);
 445                 if (ret != 0) {
 446                     krb5_free_principal(contextp->context, princ);
 447                     goto fail;
 448                 }
 449                 ret = krb5_ret_int32(sp, &ks_tuple[i].ks_salttype);
 450                 if (ret != 0) {
 451                     krb5_free_principal(contextp->context, princ);
 452                     goto fail;
 453                 }
 454             }
 455         }
 456         ret = kadm5_randkey_principal_3(kadm_handlep, princ, keepold,
 457                                         n_ks_tuple, ks_tuple, &new_keys,
 458                                         &n_keys);
 459         krb5_free_principal(contextp->context, princ);
 460
 461         krb5_storage_free(sp);
 462         sp = krb5_storage_emem();
 463         krb5_store_int32(sp, ret);
 464         if(ret == 0){
 465             int i;
 466             krb5_store_int32(sp, n_keys);
 467             for(i = 0; i < n_keys; i++){
 468                 krb5_store_keyblock(sp, new_keys[i]);
 469                 krb5_free_keyblock_contents(contextp->context, &new_keys[i]);
 470             }
 471             free(new_keys);
 472         }
 473         break;
 474     }
 475     case kadm_get_privs:{
 476         uint32_t privs;
 477         ret = kadm5_get_privs(kadm_handlep, &privs);
 478         krb5_storage_free(sp);
 479         sp = krb5_storage_emem();
 480         krb5_store_int32(sp, ret);
 481         if(ret == 0)
 482             krb5_store_uint32(sp, privs);
 483         break;
 484     }
 485     case kadm_get_princs:{
 486         op = "LIST";
 487         ret = krb5_ret_int32(sp, &tmp);
 488         if(ret)
 489             goto fail;
 490         if(tmp){
 491             ret = krb5_ret_string(sp, &expression);
 492             if(ret)
 493                 goto fail;
 494         }else
 495             expression = NULL;
 496         krb5_warnx(contextp->context, "%s: %s %s", client, op,
 497                    expression ? expression : "*");
 498         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_LIST, NULL);
 499         if(ret){
 500             free(expression);
 501             goto fail;
 502         }
 503         ret = kadm5_get_principals(kadm_handlep, expression, &princs, &n_princs);
 504         free(expression);
 505         krb5_storage_free(sp);
 506         sp = krb5_storage_emem();
 507         krb5_store_int32(sp, ret);
 508         if(ret == 0){
 509             int i;
 510             krb5_store_int32(sp, n_princs);
 511             for(i = 0; i < n_princs; i++)
 512                 krb5_store_string(sp, princs[i]);
 513             kadm5_free_name_list(kadm_handlep, princs, &n_princs);
 514         }
 515         break;
 516     }
 517     default:
 518         krb5_warnx(contextp->context, "%s: UNKNOWN OP %d", client, cmd);
 519         krb5_storage_free(sp);
 520         sp = krb5_storage_emem();
 521         krb5_store_int32(sp, KADM5_FAILURE);
 522         break;
 523     }
 524     krb5_storage_to_data(sp, out);
 525     krb5_storage_free(sp);
 526     return 0;
 527 fail:
 528     krb5_warn(contextp->context, ret, "%s", op);
 529     krb5_storage_seek(sp, 0, SEEK_SET);
 530     krb5_store_int32(sp, ret);
 531     krb5_storage_to_data(sp, out);
 532     krb5_storage_free(sp);
 533     return 0;
 534 }
 535
 536 static void
 537 v5_loop (krb5_context contextp,
 538          krb5_auth_context ac,
 539          krb5_boolean initial,
 540          void *kadm_handlep,
 541          krb5_socket_t fd)
 542 {
 543     krb5_error_code ret;
 544     krb5_data in, out;
 545
 546     for (;;) {
 547         doing_useful_work = 0;
 548         if(term_flag)
 549             exit(0);
 550         ret = krb5_read_priv_message(contextp, ac, &fd, &in);
 551         if(ret == HEIM_ERR_EOF)
 552             exit(0);
 553         if(ret)
 554             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 555         doing_useful_work = 1;
 556         kadmind_dispatch(kadm_handlep, initial, &in, &out);
 557         krb5_data_free(&in);
 558         ret = krb5_write_priv_message(contextp, ac, &fd, &out);
 559         if(ret)
 560             krb5_err(contextp, 1, ret, "krb5_write_priv_message");
 561     }
 562 }
 563
 564 static krb5_boolean
 565 match_appl_version(const void *data, const char *appl_version)
 566 {
 567     unsigned minor;
 568     if(sscanf(appl_version, "KADM0.%u", &minor) != 1)
 569         return 0;
 570     /*XXX*/
 571     *(unsigned*)(intptr_t)data = minor;
 572     return 1;
 573 }
 574
 575 static void
 576 handle_v5(krb5_context contextp,
 577           krb5_keytab keytab,
 578           krb5_socket_t fd)
 579 {
 580     krb5_error_code ret;
 581     krb5_ticket *ticket;
 582     char *server_name;
 583     char *client;
 584     void *kadm_handlep;
 585     krb5_boolean initial;
 586     krb5_auth_context ac = NULL;
 587
 588     unsigned kadm_version;
 589     kadm5_config_params realm_params;
 590
 591     ret = krb5_recvauth_match_version(contextp, &ac, &fd,
 592                                       match_appl_version, &kadm_version,
 593                                       NULL, KRB5_RECVAUTH_IGNORE_VERSION,
 594                                       keytab, &ticket);
 595     if (ret)
 596         krb5_err(contextp, 1, ret, "krb5_recvauth");
 597
 598     ret = krb5_unparse_name (contextp, ticket->server, &server_name);
 599     if (ret)
 600         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 601
 602     if (strncmp (server_name, KADM5_ADMIN_SERVICE,
 603                  strlen(KADM5_ADMIN_SERVICE)) != 0)
 604         krb5_errx (contextp, 1, "ticket for strange principal (%s)",
 605                    server_name);
 606
 607     free (server_name);
 608
 609     memset(&realm_params, 0, sizeof(realm_params));
 610
 611     if(kadm_version == 1) {
 612         krb5_data params;
 613         ret = krb5_read_priv_message(contextp, ac, &fd, &params);
 614         if(ret)
 615             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 616         _kadm5_unmarshal_params(contextp, &params, &realm_params);
 617     }
 618
 619     initial = ticket->ticket.flags.initial;
 620     ret = krb5_unparse_name(contextp, ticket->client, &client);
 621     if (ret)
 622         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 623     krb5_free_ticket (contextp, ticket);
 624     ret = kadm5_s_init_with_password_ctx(contextp,
 625                                          client,
 626                                          NULL,
 627                                          KADM5_ADMIN_SERVICE,
 628                                          &realm_params,
 629                                          0, 0,
 630                                          &kadm_handlep);
 631     if(ret)
 632         krb5_err (contextp, 1, ret, "kadm5_init_with_password_ctx");
 633     v5_loop (contextp, ac, initial, kadm_handlep, fd);
 634 }
 635
 636 krb5_error_code
 637 kadmind_loop(krb5_context contextp,
 638              krb5_keytab keytab,
 639              krb5_socket_t sock)
 640 {
 641     u_char buf[sizeof(KRB5_SENDAUTH_VERSION) + 4];
 642     ssize_t n;
 643     unsigned long len;
 644
 645     n = krb5_net_read(contextp, &sock, buf, 4);
 646     if(n == 0)
 647         exit(0);
 648     if(n < 0)
 649         krb5_err(contextp, 1, errno, "read");
 650     _krb5_get_int(buf, &len, 4);
 651
 652     if (len == sizeof(KRB5_SENDAUTH_VERSION)) {
 653
 654         n = krb5_net_read(contextp, &sock, buf + 4, len);
 655         if (n < 0)
 656             krb5_err (contextp, 1, errno, "reading sendauth version");
 657         if (n == 0)
 658             krb5_errx (contextp, 1, "EOF reading sendauth version");
 659
 660         if(memcmp(buf + 4, KRB5_SENDAUTH_VERSION, len) == 0) {
 661             handle_v5(contextp, keytab, sock);
 662             return 0;
 663         }
 664         len += 4;
 665     } else
 666         len = 4;
 667
 668     handle_mit(contextp, buf, len, sock);
 669
 670     return 0;
 671 }