kadmin/server.c

   1 /*
   2  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <krb5-private.h>
  36
  37 static kadm5_ret_t
  38 kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
  39                  krb5_data *in, krb5_data *out)
  40 {
  41     kadm5_ret_t ret;
  42     int32_t cmd, mask, tmp;
  43     kadm5_server_context *contextp = kadm_handlep;
  44     char client[128], name[128], name2[128];
  45     const char *op = "";
  46     krb5_principal princ, princ2;
  47     kadm5_principal_ent_rec ent;
  48     char *password, *expression;
  49     krb5_keyblock *new_keys;
  50     krb5_key_salt_tuple *ks_tuple = NULL;
  51     krb5_boolean keepold = FALSE;
  52     int n_ks_tuple = 0;
  53     int n_keys;
  54     char **princs;
  55     int n_princs;
  56     int keys_ok = 0;
  57     krb5_storage *sp;
  58
  59     krb5_unparse_name_fixed(contextp->context, contextp->caller,
  60                             client, sizeof(client));
  61
  62     sp = krb5_storage_from_data(in);
  63     if (sp == NULL)
  64         krb5_errx(contextp->context, 1, "out of memory");
  65
  66     krb5_ret_int32(sp, &cmd);
  67     switch(cmd){
  68     case kadm_get:{
  69         op = "GET";
  70         ret = krb5_ret_principal(sp, &princ);
  71         if(ret)
  72             goto fail;
  73         ret = krb5_ret_int32(sp, &mask);
  74         if(ret){
  75             krb5_free_principal(contextp->context, princ);
  76             goto fail;
  77         }
  78         mask |= KADM5_PRINCIPAL;
  79         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
  80         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
  81         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET_KEYS, princ);
  82         if (ret == 0)
  83             keys_ok = 1;
  84         else
  85             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET, princ);
  86         if(ret){
  87             krb5_free_principal(contextp->context, princ);
  88             goto fail;
  89         }
  90         ret = kadm5_get_principal(kadm_handlep, princ, &ent, mask);
  91         krb5_storage_free(sp);
  92         sp = krb5_storage_emem();
  93         krb5_store_int32(sp, ret);
  94         if(ret == 0){
  95             if (keys_ok)
  96                 kadm5_store_principal_ent(sp, &ent);
  97             else
  98                 kadm5_store_principal_ent_nokeys(sp, &ent);
  99             kadm5_free_principal_ent(kadm_handlep, &ent);
 100         }
 101         krb5_free_principal(contextp->context, princ);
 102         break;
 103     }
 104     case kadm_delete:{
 105         op = "DELETE";
 106         ret = krb5_ret_principal(sp, &princ);
 107         if(ret)
 108             goto fail;
 109         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 110         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 111         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_DELETE, princ);
 112         if(ret){
 113             krb5_free_principal(contextp->context, princ);
 114             goto fail;
 115         }
 116         ret = kadm5_delete_principal(kadm_handlep, princ);
 117         krb5_free_principal(contextp->context, princ);
 118         krb5_storage_free(sp);
 119         sp = krb5_storage_emem();
 120         krb5_store_int32(sp, ret);
 121         break;
 122     }
 123     case kadm_create:{
 124         op = "CREATE";
 125         ret = kadm5_ret_principal_ent(sp, &ent);
 126         if(ret)
 127             goto fail;
 128         ret = krb5_ret_int32(sp, &mask);
 129         if(ret){
 130             kadm5_free_principal_ent(contextp->context, &ent);
 131             goto fail;
 132         }
 133         ret = krb5_ret_string(sp, &password);
 134         if(ret){
 135             kadm5_free_principal_ent(contextp->context, &ent);
 136             goto fail;
 137         }
 138         krb5_unparse_name_fixed(contextp->context, ent.principal,
 139                                 name, sizeof(name));
 140         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 141         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD,
 142                                           ent.principal);
 143         if(ret){
 144             kadm5_free_principal_ent(contextp->context, &ent);
 145             memset(password, 0, strlen(password));
 146             free(password);
 147             goto fail;
 148         }
 149         ret = kadm5_create_principal(kadm_handlep, &ent,
 150                                      mask, password);
 151         kadm5_free_principal_ent(kadm_handlep, &ent);
 152         memset(password, 0, strlen(password));
 153         free(password);
 154         krb5_storage_free(sp);
 155         sp = krb5_storage_emem();
 156         krb5_store_int32(sp, ret);
 157         break;
 158     }
 159     case kadm_modify:{
 160         op = "MODIFY";
 161         ret = kadm5_ret_principal_ent(sp, &ent);
 162         if(ret)
 163             goto fail;
 164         ret = krb5_ret_int32(sp, &mask);
 165         if(ret){
 166             kadm5_free_principal_ent(contextp, &ent);
 167             goto fail;
 168         }
 169         krb5_unparse_name_fixed(contextp->context, ent.principal,
 170                                 name, sizeof(name));
 171         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 172         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_MODIFY,
 173                                           ent.principal);
 174         if(ret){
 175             kadm5_free_principal_ent(contextp, &ent);
 176             goto fail;
 177         }
 178         ret = kadm5_modify_principal(kadm_handlep, &ent, mask);
 179         kadm5_free_principal_ent(kadm_handlep, &ent);
 180         krb5_storage_free(sp);
 181         sp = krb5_storage_emem();
 182         krb5_store_int32(sp, ret);
 183         break;
 184     }
 185     case kadm_rename:{
 186         op = "RENAME";
 187         ret = krb5_ret_principal(sp, &princ);
 188         if(ret)
 189             goto fail;
 190         ret = krb5_ret_principal(sp, &princ2);
 191         if(ret){
 192             krb5_free_principal(contextp->context, princ);
 193             goto fail;
 194         }
 195         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 196         krb5_unparse_name_fixed(contextp->context, princ2, name2, sizeof(name2));
 197         krb5_warnx(contextp->context, "%s: %s %s -> %s",
 198                    client, op, name, name2);
 199         ret = _kadm5_acl_check_permission(contextp,
 200                                           KADM5_PRIV_ADD,
 201                                           princ2)
 202             || _kadm5_acl_check_permission(contextp,
 203                                            KADM5_PRIV_DELETE,
 204                                            princ);
 205         if(ret){
 206             krb5_free_principal(contextp->context, princ);
 207             krb5_free_principal(contextp->context, princ2);
 208             goto fail;
 209         }
 210         ret = kadm5_rename_principal(kadm_handlep, princ, princ2);
 211         krb5_free_principal(contextp->context, princ);
 212         krb5_free_principal(contextp->context, princ2);
 213         krb5_storage_free(sp);
 214         sp = krb5_storage_emem();
 215         krb5_store_int32(sp, ret);
 216         break;
 217     }
 218     case kadm_chpass:{
 219         op = "CHPASS";
 220         ret = krb5_ret_principal(sp, &princ);
 221         if (ret)
 222             goto fail;
 223         ret = krb5_ret_string(sp, &password);
 224         if (ret) {
 225             krb5_free_principal(contextp->context, princ);
 226             goto fail;
 227         }
 228         ret = krb5_ret_int32(sp, &keepold);
 229         if (ret && ret != HEIM_ERR_EOF) {
 230             krb5_free_principal(contextp->context, princ);
 231             goto fail;
 232         }
 233         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 234         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 235
 236         /*
 237          * The change is allowed if at least one of:
 238          *
 239          * a) allowed by sysadmin
 240          * b) it's for the principal him/herself and this was an
 241          *    initial ticket, but then, check with the password quality
 242          *    function.
 243          * c) the user is on the CPW ACL.
 244          */
 245
 246         if (krb5_config_get_bool_default(contextp->context, NULL, TRUE,
 247                                          "kadmin", "allow_self_change_password", NULL)
 248             && initial
 249             && krb5_principal_compare (contextp->context, contextp->caller,
 250                                        princ))
 251         {
 252             krb5_data pwd_data;
 253             const char *pwd_reason;
 254
 255             pwd_data.data = password;
 256             pwd_data.length = strlen(password);
 257
 258             pwd_reason = kadm5_check_password_quality (contextp->context,
 259                                                        princ, &pwd_data);
 260             if (pwd_reason != NULL)
 261                 ret = KADM5_PASS_Q_DICT;
 262             else
 263                 ret = 0;
 264         } else
 265             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 266
 267         if(ret) {
 268             krb5_free_principal(contextp->context, princ);
 269             memset(password, 0, strlen(password));
 270             free(password);
 271             goto fail;
 272         }
 273         ret = kadm5_chpass_principal_3(kadm_handlep, princ, keepold, 0, NULL,
 274                                        password);
 275         krb5_free_principal(contextp->context, princ);
 276         memset(password, 0, strlen(password));
 277         free(password);
 278         krb5_storage_free(sp);
 279         sp = krb5_storage_emem();
 280         krb5_store_int32(sp, ret);
 281         break;
 282     }
 283     case kadm_chpass_with_key:{
 284         int i;
 285         krb5_key_data *key_data;
 286         int n_key_data;
 287
 288         op = "CHPASS_WITH_KEY";
 289         ret = krb5_ret_principal(sp, &princ);
 290         if(ret)
 291             goto fail;
 292         ret = krb5_ret_int32(sp, &n_key_data);
 293         if (ret) {
 294             krb5_free_principal(contextp->context, princ);
 295             goto fail;
 296         }
 297         ret = krb5_ret_int32(sp, &keepold);
 298         if (ret && ret != HEIM_ERR_EOF) {
 299             krb5_free_principal(contextp->context, princ);
 300             goto fail;
 301         }
 302         /* n_key_data will be squeezed into an int16_t below. */
 303         if (n_key_data < 0 || n_key_data >= 1 << 16 ||
 304             (size_t)n_key_data > UINT_MAX/sizeof(*key_data)) {
 305             ret = ERANGE;
 306             krb5_free_principal(contextp->context, princ);
 307             goto fail;
 308         }
 309
 310         key_data = malloc (n_key_data * sizeof(*key_data));
 311         if (key_data == NULL && n_key_data != 0) {
 312             ret = ENOMEM;
 313             krb5_free_principal(contextp->context, princ);
 314             goto fail;
 315         }
 316
 317         for (i = 0; i < n_key_data; ++i) {
 318             ret = kadm5_ret_key_data (sp, &key_data[i]);
 319             if (ret) {
 320                 int16_t dummy = i;
 321
 322                 kadm5_free_key_data (contextp, &dummy, key_data);
 323                 free (key_data);
 324                 krb5_free_principal(contextp->context, princ);
 325                 goto fail;
 326             }
 327         }
 328
 329         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 330         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 331
 332         /*
 333          * The change is only allowed if the user is on the CPW ACL,
 334          * this it to force password quality check on the user.
 335          */
 336
 337         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 338         if(ret) {
 339             int16_t dummy = n_key_data;
 340
 341             kadm5_free_key_data (contextp, &dummy, key_data);
 342             free (key_data);
 343             krb5_free_principal(contextp->context, princ);
 344             goto fail;
 345         }
 346         ret = kadm5_chpass_principal_with_key_3(kadm_handlep, princ, keepold,
 347                                                 n_key_data, key_data);
 348         {
 349             int16_t dummy = n_key_data;
 350             kadm5_free_key_data (contextp, &dummy, key_data);
 351         }
 352         free (key_data);
 353         krb5_free_principal(contextp->context, princ);
 354         krb5_storage_free(sp);
 355         sp = krb5_storage_emem();
 356         krb5_store_int32(sp, ret);
 357         break;
 358     }
 359     case kadm_randkey:{
 360         op = "RANDKEY";
 361         ret = krb5_ret_principal(sp, &princ);
 362         if(ret)
 363             goto fail;
 364         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 365         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 366         /*
 367          * The change is allowed if at least one of:
 368          * a) it's for the principal him/herself and this was an initial ticket
 369          * b) the user is on the CPW ACL.
 370          */
 371
 372         if (initial
 373             && krb5_principal_compare (contextp->context, contextp->caller,
 374                                        princ))
 375             ret = 0;
 376         else
 377             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 378
 379         if(ret) {
 380             krb5_free_principal(contextp->context, princ);
 381             goto fail;
 382         }
 383
 384         /*
 385          * See comments in kadm5_c_randkey_principal() regarding the
 386          * protocol.
 387          */
 388         ret = krb5_ret_int32(sp, &keepold);
 389         if (ret != 0 && ret != HEIM_ERR_EOF) {
 390             krb5_free_principal(contextp->context, princ);
 391             goto fail;
 392         }
 393
 394         ret = krb5_ret_int32(sp, &n_ks_tuple);
 395         if (ret != 0 && ret != HEIM_ERR_EOF) {
 396             krb5_free_principal(contextp->context, princ);
 397             goto fail;
 398         } else if (ret == 0) {
 399             size_t i;
 400
 401             if (n_ks_tuple < 0) {
 402                 ret = EOVERFLOW;
 403                 krb5_free_principal(contextp->context, princ);
 404                 goto fail;
 405             }
 406
 407             if ((ks_tuple = calloc(n_ks_tuple, sizeof (*ks_tuple))) == NULL) {
 408                 ret = errno;
 409                 krb5_free_principal(contextp->context, princ);
 410                 goto fail;
 411             }
 412
 413             for (i = 0; i < n_ks_tuple; i++) {
 414                 ret = krb5_ret_int32(sp, &ks_tuple[i].ks_enctype);
 415                 if (ret != 0) {
 416                     krb5_free_principal(contextp->context, princ);
 417                     goto fail;
 418                 }
 419                 ret = krb5_ret_int32(sp, &ks_tuple[i].ks_salttype);
 420                 if (ret != 0) {
 421                     krb5_free_principal(contextp->context, princ);
 422                     goto fail;
 423                 }
 424             }
 425         }
 426         ret = kadm5_randkey_principal_3(kadm_handlep, princ, keepold,
 427                                         n_ks_tuple, ks_tuple, &new_keys,
 428                                         &n_keys);
 429         krb5_free_principal(contextp->context, princ);
 430
 431         krb5_storage_free(sp);
 432         sp = krb5_storage_emem();
 433         krb5_store_int32(sp, ret);
 434         if(ret == 0){
 435             int i;
 436             krb5_store_int32(sp, n_keys);
 437             for(i = 0; i < n_keys; i++){
 438                 krb5_store_keyblock(sp, new_keys[i]);
 439                 krb5_free_keyblock_contents(contextp->context, &new_keys[i]);
 440             }
 441             free(new_keys);
 442         }
 443         break;
 444     }
 445     case kadm_get_privs:{
 446         uint32_t privs;
 447         ret = kadm5_get_privs(kadm_handlep, &privs);
 448         krb5_storage_free(sp);
 449         sp = krb5_storage_emem();
 450         krb5_store_int32(sp, ret);
 451         if(ret == 0)
 452             krb5_store_uint32(sp, privs);
 453         break;
 454     }
 455     case kadm_get_princs:{
 456         op = "LIST";
 457         ret = krb5_ret_int32(sp, &tmp);
 458         if(ret)
 459             goto fail;
 460         if(tmp){
 461             ret = krb5_ret_string(sp, &expression);
 462             if(ret)
 463                 goto fail;
 464         }else
 465             expression = NULL;
 466         krb5_warnx(contextp->context, "%s: %s %s", client, op,
 467                    expression ? expression : "*");
 468         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_LIST, NULL);
 469         if(ret){
 470             free(expression);
 471             goto fail;
 472         }
 473         ret = kadm5_get_principals(kadm_handlep, expression, &princs, &n_princs);
 474         free(expression);
 475         krb5_storage_free(sp);
 476         sp = krb5_storage_emem();
 477         krb5_store_int32(sp, ret);
 478         if(ret == 0){
 479             int i;
 480             krb5_store_int32(sp, n_princs);
 481             for(i = 0; i < n_princs; i++)
 482                 krb5_store_string(sp, princs[i]);
 483             kadm5_free_name_list(kadm_handlep, princs, &n_princs);
 484         }
 485         break;
 486     }
 487     default:
 488         krb5_warnx(contextp->context, "%s: UNKNOWN OP %d", client, cmd);
 489         krb5_storage_free(sp);
 490         sp = krb5_storage_emem();
 491         krb5_store_int32(sp, KADM5_FAILURE);
 492         break;
 493     }
 494     krb5_storage_to_data(sp, out);
 495     krb5_storage_free(sp);
 496     return 0;
 497 fail:
 498     krb5_warn(contextp->context, ret, "%s", op);
 499     krb5_storage_seek(sp, 0, SEEK_SET);
 500     krb5_store_int32(sp, ret);
 501     krb5_storage_to_data(sp, out);
 502     krb5_storage_free(sp);
 503     return 0;
 504 }
 505
 506 static void
 507 v5_loop (krb5_context contextp,
 508          krb5_auth_context ac,
 509          krb5_boolean initial,
 510          void *kadm_handlep,
 511          krb5_socket_t fd)
 512 {
 513     krb5_error_code ret;
 514     krb5_data in, out;
 515
 516     for (;;) {
 517         doing_useful_work = 0;
 518         if(term_flag)
 519             exit(0);
 520         ret = krb5_read_priv_message(contextp, ac, &fd, &in);
 521         if(ret == HEIM_ERR_EOF)
 522             exit(0);
 523         if(ret)
 524             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 525         doing_useful_work = 1;
 526         kadmind_dispatch(kadm_handlep, initial, &in, &out);
 527         krb5_data_free(&in);
 528         ret = krb5_write_priv_message(contextp, ac, &fd, &out);
 529         if(ret)
 530             krb5_err(contextp, 1, ret, "krb5_write_priv_message");
 531     }
 532 }
 533
 534 static krb5_boolean
 535 match_appl_version(const void *data, const char *appl_version)
 536 {
 537     unsigned minor;
 538     if(sscanf(appl_version, "KADM0.%u", &minor) != 1)
 539         return 0;
 540     /*XXX*/
 541     *(unsigned*)(intptr_t)data = minor;
 542     return 1;
 543 }
 544
 545 static void
 546 handle_v5(krb5_context contextp,
 547           krb5_keytab keytab,
 548           krb5_socket_t fd)
 549 {
 550     krb5_error_code ret;
 551     krb5_ticket *ticket;
 552     char *server_name;
 553     char *client;
 554     void *kadm_handlep;
 555     krb5_boolean initial;
 556     krb5_auth_context ac = NULL;
 557
 558     unsigned kadm_version;
 559     kadm5_config_params realm_params;
 560
 561     ret = krb5_recvauth_match_version(contextp, &ac, &fd,
 562                                       match_appl_version, &kadm_version,
 563                                       NULL, KRB5_RECVAUTH_IGNORE_VERSION,
 564                                       keytab, &ticket);
 565     if (ret)
 566         krb5_err(contextp, 1, ret, "krb5_recvauth");
 567
 568     ret = krb5_unparse_name (contextp, ticket->server, &server_name);
 569     if (ret)
 570         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 571
 572     if (strncmp (server_name, KADM5_ADMIN_SERVICE,
 573                  strlen(KADM5_ADMIN_SERVICE)) != 0)
 574         krb5_errx (contextp, 1, "ticket for strange principal (%s)",
 575                    server_name);
 576
 577     free (server_name);
 578
 579     memset(&realm_params, 0, sizeof(realm_params));
 580
 581     if(kadm_version == 1) {
 582         krb5_data params;
 583         ret = krb5_read_priv_message(contextp, ac, &fd, &params);
 584         if(ret)
 585             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 586         _kadm5_unmarshal_params(contextp, &params, &realm_params);
 587     }
 588
 589     initial = ticket->ticket.flags.initial;
 590     ret = krb5_unparse_name(contextp, ticket->client, &client);
 591     if (ret)
 592         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 593     krb5_free_ticket (contextp, ticket);
 594     ret = kadm5_s_init_with_password_ctx(contextp,
 595                                          client,
 596                                          NULL,
 597                                          KADM5_ADMIN_SERVICE,
 598                                          &realm_params,
 599                                          0, 0,
 600                                          &kadm_handlep);
 601     if(ret)
 602         krb5_err (contextp, 1, ret, "kadm5_init_with_password_ctx");
 603     v5_loop (contextp, ac, initial, kadm_handlep, fd);
 604 }
 605
 606 krb5_error_code
 607 kadmind_loop(krb5_context contextp,
 608              krb5_keytab keytab,
 609              krb5_socket_t sock)
 610 {
 611     u_char buf[sizeof(KRB5_SENDAUTH_VERSION) + 4];
 612     ssize_t n;
 613     unsigned long len;
 614
 615     n = krb5_net_read(contextp, &sock, buf, 4);
 616     if(n == 0)
 617         exit(0);
 618     if(n < 0)
 619         krb5_err(contextp, 1, errno, "read");
 620     _krb5_get_int(buf, &len, 4);
 621
 622     if (len == sizeof(KRB5_SENDAUTH_VERSION)) {
 623
 624         n = krb5_net_read(contextp, &sock, buf + 4, len);
 625         if (n < 0)
 626             krb5_err (contextp, 1, errno, "reading sendauth version");
 627         if (n == 0)
 628             krb5_errx (contextp, 1, "EOF reading sendauth version");
 629
 630         if(memcmp(buf + 4, KRB5_SENDAUTH_VERSION, len) == 0) {
 631             handle_v5(contextp, keytab, sock);
 632             return 0;
 633         }
 634         len += 4;
 635     } else
 636         len = 4;
 637
 638     handle_mit(contextp, buf, len, sock);
 639
 640     return 0;
 641 }