rpc.c   [plain text]

/*
 * Copyright (c) 2008 Kungliga Tekniska Högskolan
 * (Royal Institute of Technology, Stockholm, Sweden).
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * 3. Neither the name of the Institute nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "kadmin_locl.h"
#include <kadm5/private.h>

#include <gssapi.h>
#include <gssapi_krb5.h>
#include <gssapi_spnego.h>

#define CHECK(x)							\
	do {								\
		int __r;						\
		if ((__r = (x))) {					\
			krb5_errx(dcontext, 1, "Failed (%d) on %s:%d",	\
			    __r, __FILE__, __LINE__);			\
		}							\
	} while(0)

static krb5_context dcontext;

#define INSIST(x) CHECK(!(x))

#define VERSION2 0x12345702

#define LAST_FRAGMENT 0x80000000

#define RPC_VERSION 2
#define KADM_SERVER 2112
#define VVERSION 2
#define FLAVOR_GSS 6
#define FLAVOR_GSS_VERSION 1

enum {
    RPG_DATA = 0,
    RPG_INIT = 1,
    RPG_CONTINUE_INIT = 2,
    RPG_DESTROY = 3
};

enum {
    rpg_privacy = 3
};

/*
struct chrand_ret {
	krb5_ui_4 api_version;
	kadm5_ret_t ret;
	int n_keys;
	krb5_keyblock *keys;
};
*/


static int
parse_name(const unsigned char *p, size_t len,
	   const gss_OID oid, char **name)
{
    size_t l;
    
    if (len < 4)
	return 1;
    
    /* TOK_ID */
    if (memcmp(p, "\x04\x01", 2) != 0)
	return 1;
    len -= 2;
    p += 2;
    
    /* MECH_LEN */
    l = (p[0] << 8) | p[1];
    len -= 2;
    p += 2;
    if (l < 2 || len < l)
	return 1;
    
    /* oid wrapping */
    if (p[0] != 6 || p[1] != l - 2)
	return 1;
    p += 2;
    l -= 2;
    len -= 2;
    
    /* MECH */
    if (l != oid->length || memcmp(p, oid->elements, oid->length) != 0)
	return 1;
    len -= l;
    p += l;
    
    /* MECHNAME_LEN */
    if (len < 4)
	return 1;
    l = p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3];
    len -= 4;
    p += 4;
    
    /* MECH NAME */
    if (len != l)
	return 1;
    
    *name = malloc(l + 1);
    INSIST(*name != NULL);
    memcpy(*name, p, l);
    (*name)[l] = '\0';

    return 0;
}



static void
gss_error(krb5_context context,
	  gss_OID mech, OM_uint32 type, OM_uint32 error)
{
    OM_uint32 new_stat;
    OM_uint32 msg_ctx = 0;
    gss_buffer_desc status_string;
    OM_uint32 ret;

    do {
	ret = gss_display_status (&new_stat,
				  error,
				  type,
				  mech,
				  &msg_ctx,
				  &status_string);
	krb5_warnx(context, "%.*s",
		   (int)status_string.length,
		   (char *)status_string.value);
	gss_release_buffer (&new_stat, &status_string);
    } while (!GSS_ERROR(ret) && msg_ctx != 0);
}

static void
gss_print_errors (krb5_context context, 
		  OM_uint32 maj_stat, OM_uint32 min_stat)
{
    gss_error(context, GSS_C_NO_OID, GSS_C_GSS_CODE, maj_stat);
    gss_error(context, GSS_C_NO_OID, GSS_C_MECH_CODE, min_stat);
}

static int
read_data(krb5_storage *sp, krb5_storage *msg, size_t len)
{
    char buf[1024];

    while (len) {
	size_t tlen = len;
	ssize_t slen;

	if (tlen > sizeof(buf))
	    tlen = sizeof(buf);
	
	slen = krb5_storage_read(sp, buf, tlen);
	INSIST(slen == tlen);
	
	slen = krb5_storage_write(msg, buf, tlen);
	INSIST(slen == tlen);
	
	len -= tlen;
    }
    return 0;
}

static int
collect_fragments(krb5_storage *sp, krb5_storage *msg)
{
    krb5_error_code ret;
    uint32_t len;
    int last_fragment;
    size_t total_len = 0;

    do {
	ret = krb5_ret_uint32(sp, &len);
	if (ret)
	    return ret;
	
	last_fragment = (len & LAST_FRAGMENT);
	len &= ~LAST_FRAGMENT;

	CHECK(read_data(sp, msg, len));
	total_len += len;

    } while(!last_fragment || total_len == 0);

    return 0;
}

/*
 *
 */

static void
proc_create_principal(kadm5_server_context *context,
		      krb5_storage *in,
		      krb5_storage *out)
{
    uint32_t version, mask;
    kadm5_principal_ent_rec ent;
    krb5_error_code ret;
    char *password;

    memset(&ent, 0, sizeof(ent));

    CHECK(krb5_ret_uint32(in, &version));
    INSIST(version == VERSION2);
    CHECK(_kadm5_xdr_ret_principal_ent(context->context, in, &ent));
    INSIST(ent.principal != NULL);
    CHECK(krb5_ret_uint32(in, &mask));
    CHECK(_kadm5_xdr_ret_string_xdr(in, &password));

    INSIST(ent.principal);


    ret = _kadm5_acl_check_permission(context, KADM5_PRIV_ADD, ent.principal);
    if (ret)
	goto fail;

    ret = kadm5_create_principal(context, &ent, mask, password);

 fail:
    krb5_warn(context->context, ret, "create principal");
    CHECK(krb5_store_uint32(out, VERSION2)); /* api version */
    CHECK(krb5_store_uint32(out, ret)); /* code */

    free(password);
    kadm5_free_principal_ent(context, &ent);
}

static void
proc_delete_principal(kadm5_server_context *context,
		      krb5_storage *in,
		      krb5_storage *out)
{
    uint32_t version;
    krb5_principal princ;
    krb5_error_code ret;

    CHECK(krb5_ret_uint32(in, &version));
    INSIST(version == VERSION2);
    CHECK(_kadm5_xdr_ret_principal_xdr(context->context, in, &princ));

    ret = _kadm5_acl_check_permission(context, KADM5_PRIV_DELETE, princ);
    if (ret)
	goto fail;

    ret = kadm5_delete_principal(context, princ);

 fail:
    krb5_warn(context->context, ret, "delete principal");
    CHECK(krb5_store_uint32(out, VERSION2)); /* api version */
    CHECK(krb5_store_uint32(out, ret)); /* code */

    krb5_free_principal(context->context, princ);
}

static void
proc_modify_principal(kadm5_server_context *context,
		      krb5_storage *in,
		      krb5_storage *out)
{
    uint32_t version, mask;
    kadm5_principal_ent_rec ent;
    krb5_error_code ret;

    CHECK(krb5_ret_uint32(in, &version));
    INSIST(version == VERSION2);
    CHECK(_kadm5_xdr_ret_principal_ent(context->context, in, &ent));
    INSIST(ent.principal != NULL);
    CHECK(krb5_ret_uint32(in, &mask));

    ret = _kadm5_acl_check_permission(context, KADM5_PRIV_MODIFY,
				      ent.principal);
    if (ret)
	goto fail;

    ret = kadm5_modify_principal(context, &ent, mask);

 fail:
    krb5_warn(context->context, ret, "modify principal");
    CHECK(krb5_store_uint32(out, VERSION2)); /* api version */
    CHECK(krb5_store_uint32(out, ret)); /* code */

    kadm5_free_principal_ent(context, &ent);
}

static void
proc_get_principal(kadm5_server_context *context,
		   krb5_storage *in,
		   krb5_storage *out)
{
    uint32_t version, mask;
    krb5_principal princ;
    kadm5_principal_ent_rec ent;
    krb5_error_code ret;

    memset(&ent, 0, sizeof(ent));

    CHECK(krb5_ret_uint32(in, &version));
    INSIST(version == VERSION2);
    CHECK(_kadm5_xdr_ret_principal_xdr(context->context, in, &princ));
    CHECK(krb5_ret_uint32(in, &mask));

    ret = _kadm5_acl_check_permission(context, KADM5_PRIV_GET, princ);
    if(ret)
	goto fail;

    ret = kadm5_get_principal(context, princ, &ent, mask);

 fail:
    krb5_warn(context->context, ret, "get principal principal");

    CHECK(krb5_store_uint32(out, VERSION2)); /* api version */
    CHECK(krb5_store_uint32(out, ret)); /* code */
    if (ret == 0) {
	CHECK(_kadm5_xdr_store_principal_ent(context->context, out, &ent));
    }
    krb5_free_principal(context->context, princ);
    kadm5_free_principal_ent(context, &ent);
}

static void
proc_chrand_principal_v2(kadm5_server_context *context,
			 krb5_storage *in, 
			 krb5_storage *out)
{
    krb5_error_code ret;
    krb5_principal princ;
    uint32_t version;
    krb5_keyblock *new_keys;
    int n_keys;

    CHECK(krb5_ret_uint32(in, &version));
    INSIST(version == VERSION2);
    CHECK(_kadm5_xdr_ret_principal_xdr(context->context, in, &princ));

    ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ);
    if(ret)
	goto fail;

    ret = kadm5_randkey_principal(context, princ,
				  &new_keys, &n_keys);

 fail:
    krb5_warn(context->context, ret, "rand key principal");

    CHECK(krb5_store_uint32(out, VERSION2)); /* api version */
    CHECK(krb5_store_uint32(out, ret));
    if (ret == 0) {
	size_t i;
	CHECK(krb5_store_int32(out, n_keys));

	for(i = 0; i < n_keys; i++){
	    CHECK(krb5_store_uint32(out, new_keys[i].keytype));
	    CHECK(_kadm5_xdr_store_data_xdr(out, new_keys[i].keyvalue));
	    krb5_free_keyblock_contents(context->context, &new_keys[i]);
	}
	free(new_keys);
    }
    krb5_free_principal(context->context, princ);
}

static void
proc_init(kadm5_server_context *context,
	  krb5_storage *in,
	  krb5_storage *out)
{
    CHECK(krb5_store_uint32(out, VERSION2)); /* api version */
    CHECK(krb5_store_uint32(out, 0)); /* code */
    CHECK(krb5_store_uint32(out, 0)); /* code */
}

struct proc {
    char *name;
    void (*func)(kadm5_server_context *, krb5_storage *, krb5_storage *);
} procs[] = {
    { "NULL", NULL },
    { "create principal", proc_create_principal },
    { "delete principal", proc_delete_principal },
    { "modify principal", proc_modify_principal },
    { "rename principal", NULL },
    { "get principal", proc_get_principal },
    { "chpass principal", NULL },
    { "chrand principal", proc_chrand_principal_v2 },
    { "create policy", NULL },
    { "delete policy", NULL },
    { "modify policy", NULL },
    { "get policy", NULL },
    { "get privs", NULL },
    { "init", proc_init },
    { "get principals", NULL },
    { "get polices", NULL },
    { "setkey principal", NULL },
    { "setkey principal v4", NULL },
    { "create principal v3", NULL },
    { "chpass principal v3", NULL },
    { "chrand principal v3", NULL },
    { "setkey principal v3", NULL }
};

static krb5_error_code
copyheader(krb5_storage *sp, krb5_data *data)
{
    off_t off;
    ssize_t sret;

    off = krb5_storage_seek(sp, 0, SEEK_CUR);

    CHECK(krb5_data_alloc(data, off));
    INSIST(off == data->length);
    krb5_storage_seek(sp, 0, SEEK_SET);
    sret = krb5_storage_read(sp, data->data, data->length);
    INSIST(sret == off);
    INSIST(off == krb5_storage_seek(sp, 0, SEEK_CUR));

    return 0;
}

struct gctx {
    krb5_data handle;
    gss_ctx_id_t ctx;
    uint32_t seq_num;
    int done;
    int inprogress;
};

static int
process_stream(krb5_context context, 
	       unsigned char *buf, size_t ilen,
	       krb5_storage *sp)
{
    krb5_error_code ret;
    krb5_storage *msg, *reply, *dreply;
    OM_uint32 maj_stat, min_stat;
    gss_buffer_desc gin, gout;
    struct gctx gctx;
    void *server_handle = NULL;

    memset(&gctx, 0, sizeof(gctx));

    msg = krb5_storage_emem();
    reply = krb5_storage_emem();
    dreply = krb5_storage_emem();

    /*
     * First packet comes partly from the caller
     */

    INSIST(ilen >= 4);

    while (1) {
	struct _kadm5_xdr_call_header chdr;
	struct _kadm5_xdr_gcred gcred;
	uint32_t mtype;
	krb5_data headercopy;

	krb5_storage_truncate(dreply, 0);
	krb5_storage_truncate(reply, 0);
	krb5_storage_truncate(msg, 0);

	krb5_data_zero(&headercopy);
	memset(&chdr, 0, sizeof(chdr));
	memset(&gcred, 0, sizeof(gcred));

	/*
	 * This is very icky to handle the the auto-detection between
	 * the Heimdal protocol and the MIT ONC-RPC based protocol.
	 */

	if (ilen) {
	    int last_fragment;
	    unsigned long len;
	    ssize_t slen;
	    unsigned char tmp[4];

	    if (ilen < 4) {
		memcpy(tmp, buf, ilen);
		slen = krb5_storage_read(sp, tmp + ilen, sizeof(tmp) - ilen);
		INSIST(slen == sizeof(tmp) - ilen);

		ilen = sizeof(tmp);
		buf = tmp;
	    }
	    INSIST(ilen >= 4);
	    
	    _krb5_get_int(buf, &len, 4);
	    last_fragment = (len & LAST_FRAGMENT) != 0;
	    len &= ~LAST_FRAGMENT;
	    
	    ilen -= 4;
	    buf += 4;

	    if (ilen) {
		if (len < ilen) {
		    slen = krb5_storage_write(msg, buf, len);
		    INSIST(slen == len);
		    ilen -= len;
		    len = 0;
		} else {
		    slen = krb5_storage_write(msg, buf, ilen);
		    INSIST(slen == ilen);
		    len -= ilen;
		}
	    }

	    CHECK(read_data(sp, msg, len));
	    
	    if (!last_fragment) {
		ret = collect_fragments(sp, msg);
		if (ret == HEIM_ERR_EOF)
		    krb5_errx(context, 0, "client disconnected");
		INSIST(ret == 0);
	    }
	} else {

	    ret = collect_fragments(sp, msg);
	    if (ret == HEIM_ERR_EOF)
		krb5_errx(context, 0, "client disconnected");
	    INSIST(ret == 0);
	}
	krb5_storage_seek(msg, 0, SEEK_SET);

	CHECK(krb5_ret_uint32(msg, &chdr.xid));
	CHECK(krb5_ret_uint32(msg, &mtype));
	CHECK(krb5_ret_uint32(msg, &chdr.rpcvers));
	CHECK(krb5_ret_uint32(msg, &chdr.prog));
	CHECK(krb5_ret_uint32(msg, &chdr.vers));
	CHECK(krb5_ret_uint32(msg, &chdr.proc));
	CHECK(_kadm5_xdr_ret_auth_opaque(msg, &chdr.cred));
	CHECK(copyheader(msg, &headercopy));
	CHECK(_kadm5_xdr_ret_auth_opaque(msg, &chdr.verf));

	INSIST(chdr.rpcvers == RPC_VERSION);
	INSIST(chdr.prog == KADM_SERVER);
	INSIST(chdr.vers == VVERSION);
	INSIST(chdr.cred.flavor == FLAVOR_GSS);

	CHECK(_kadm5_xdr_ret_gcred(&chdr.cred.data, &gcred));

	INSIST(gcred.version == FLAVOR_GSS_VERSION);

	if (gctx.done) {
	    INSIST(chdr.verf.flavor == FLAVOR_GSS);

	    /* from first byte to last of credential */
	    gin.value = headercopy.data;
	    gin.length = headercopy.length;
	    gout.value = chdr.verf.data.data;
	    gout.length = chdr.verf.data.length;

	    maj_stat = gss_verify_mic(&min_stat, gctx.ctx, &gin, &gout, NULL);
	    INSIST(maj_stat == GSS_S_COMPLETE);
	}

	switch(gcred.proc) {
	case RPG_DATA: {
	    krb5_data data;
	    int conf_state;
	    uint32_t seq;
	    krb5_storage *sp;

	    INSIST(gcred.service == rpg_privacy);

	    INSIST(gctx.done);

	    INSIST(krb5_data_cmp(&gcred.handle, &gctx.handle) == 0);
	    
	    CHECK(_kadm5_xdr_ret_data_xdr(msg, &data));

	    gin.value = data.data;
	    gin.length = data.length;

	    maj_stat = gss_unwrap(&min_stat, gctx.ctx, &gin, &gout,
				  &conf_state, NULL);
	    krb5_data_free(&data);
	    INSIST(maj_stat == GSS_S_COMPLETE);
	    INSIST(conf_state != 0);

	    sp = krb5_storage_from_mem(gout.value, gout.length);
	    INSIST(sp != NULL);

	    CHECK(krb5_ret_uint32(sp, &seq));
	    INSIST (seq == gcred.seq_num);

	    /*
	     * Check sequence number
	     */
	    INSIST(seq > gctx.seq_num);
	    gctx.seq_num = seq;

	    /* 
	     * If context is setup, priv data have the seq_num stored
	     * first in the block, so add it here before users data is
	     * added.
	     */
	    CHECK(krb5_store_uint32(dreply, gctx.seq_num));

	    if (chdr.proc >= sizeof(procs)/sizeof(procs[0])) {
		krb5_warnx(context, "proc number out of array");
	    } else if (procs[chdr.proc].func == NULL) {
		krb5_warnx(context, "proc '%s' never implemented", 
			  procs[chdr.proc].name);
	    } else {
		krb5_warnx(context, "proc %s", procs[chdr.proc].name);
		INSIST(server_handle != NULL);
		(*procs[chdr.proc].func)(server_handle, sp, dreply);
	    }
	    krb5_storage_free(sp);
	    gss_release_buffer(&min_stat, &gout);

	    break;
	}
	case RPG_INIT:
	    INSIST(gctx.inprogress == 0);
	    INSIST(gctx.ctx == NULL);

	    gctx.inprogress = 1;
	    /* FALL THOUGH */
	case RPG_CONTINUE_INIT: {
	    gss_name_t src_name = GSS_C_NO_NAME;
	    krb5_data in;

	    INSIST(gctx.inprogress);

	    CHECK(_kadm5_xdr_ret_data_xdr(msg, &in));

	    gin.value = in.data;
	    gin.length = in.length;
	    gout.value = NULL;
	    gout.length = 0;

	    maj_stat = gss_accept_sec_context(&min_stat,
					      &gctx.ctx, 
					      GSS_C_NO_CREDENTIAL,
					      &gin,
					      GSS_C_NO_CHANNEL_BINDINGS,
					      &src_name,
					      NULL,
					      &gout,
					      NULL,
					      NULL,
					      NULL);
	    if (GSS_ERROR(maj_stat)) {
		gss_print_errors(context, maj_stat, min_stat);
		krb5_errx(context, 1, "gss error, exit");
	    }
	    if ((maj_stat & GSS_S_CONTINUE_NEEDED) == 0) {
		kadm5_config_params realm_params;
		gss_buffer_desc buf;
		char *client;

		gctx.done = 1;
		
		memset(&realm_params, 0, sizeof(realm_params));

		maj_stat = gss_export_name(&min_stat, src_name, &buf);
		INSIST(maj_stat == GSS_S_COMPLETE);

		CHECK(parse_name(buf.value, buf.length, 
				 GSS_KRB5_MECHANISM, &client));

		gss_release_buffer(&min_stat, &buf);

		krb5_warnx(context, "%s connected", client);

		ret = kadm5_s_init_with_password_ctx(context,
						     client,
						     NULL,
						     KADM5_ADMIN_SERVICE,
						     &realm_params,
						     0, 0,
						     &server_handle);
		INSIST(ret == 0);
	    }

	    INSIST(gctx.ctx != GSS_C_NO_CONTEXT);

	    CHECK(_kadm5_xdr_store_gss_init_res(dreply, gctx.handle, 
				     maj_stat, min_stat, 1, &gout));
	    if (gout.value)
		gss_release_buffer(&min_stat, &gout);
	    if (src_name)
		gss_release_name(&min_stat, &src_name);

	    break;
	}
	case RPG_DESTROY:
	    krb5_errx(context, 1, "client destroyed gss context");
	default:
	    krb5_errx(context, 1, "client sent unknown gsscode %d", 
		      (int)gcred.proc);
	}

	krb5_data_free(&gcred.handle);
	krb5_data_free(&chdr.cred.data);
	krb5_data_free(&chdr.verf.data);
	krb5_data_free(&headercopy);

	CHECK(krb5_store_uint32(reply, chdr.xid));
	CHECK(krb5_store_uint32(reply, 1)); /* REPLY */
	CHECK(krb5_store_uint32(reply, 0)); /* MSG_ACCEPTED */

	if (!gctx.done) {
	    krb5_data data;

	    CHECK(krb5_store_uint32(reply, 0)); /* flavor_none */
	    CHECK(krb5_store_uint32(reply, 0)); /* length */

	    CHECK(krb5_store_uint32(reply, 0)); /* SUCCESS */

	    CHECK(krb5_storage_to_data(dreply, &data));
	    INSIST(krb5_storage_write(reply, data.data, data.length) == data.length);
	    krb5_data_free(&data);

	} else {
	    uint32_t seqnum = htonl(gctx.seq_num);
	    krb5_data data;

	    gin.value = &seqnum;
	    gin.length = sizeof(seqnum);

	    maj_stat = gss_get_mic(&min_stat, gctx.ctx, 0, &gin, &gout);
	    INSIST(maj_stat == GSS_S_COMPLETE);

	    data.data = gout.value;
	    data.length = gout.length;

	    CHECK(krb5_store_uint32(reply, FLAVOR_GSS));
	    CHECK(_kadm5_xdr_store_data_xdr(reply, data));
	    gss_release_buffer(&min_stat, &gout);

	    CHECK(krb5_store_uint32(reply, 0)); /* SUCCESS */

	    CHECK(krb5_storage_to_data(dreply, &data));

	    if (gctx.inprogress) {
		ssize_t sret;
		gctx.inprogress = 0;
		sret = krb5_storage_write(reply, data.data, data.length);
		INSIST(sret == data.length);
		krb5_data_free(&data);
	    } else {
		int conf_state;

		gin.value = data.data;
		gin.length = data.length;
		
		maj_stat = gss_wrap(&min_stat, gctx.ctx, 1, 0,
				    &gin, &conf_state, &gout);
		INSIST(maj_stat == GSS_S_COMPLETE);
		INSIST(conf_state != 0);
		krb5_data_free(&data);
		
		data.data = gout.value;
		data.length = gout.length;
		
		_kadm5_xdr_store_data_xdr(reply, data);
		gss_release_buffer(&min_stat, &gout);
	    }
	}

	{
	    krb5_data data;
	    ssize_t sret;
	    CHECK(krb5_storage_to_data(reply, &data));
	    CHECK(krb5_store_uint32(sp, data.length | LAST_FRAGMENT));
	    sret = krb5_storage_write(sp, data.data, data.length);
	    INSIST(sret == data.length);
	    krb5_data_free(&data);
	}

    }
}

int
handle_mit(krb5_context context, void *buf, size_t len, krb5_socket_t sock)
{
    krb5_storage *sp;

    dcontext = context;

    sp = krb5_storage_from_fd(sock);
    INSIST(sp != NULL);
    
    process_stream(context, buf, len, sp);

    return 0;
}