cmd-inet/common/kcmd.c

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 1983 Regents of the University of California.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms are permitted
 * provided that the above copyright notice and this paragraph are
 * duplicated in all such forms and that any documentation,
 * advertising materials, and other materials related to such
 * distribution and use acknowledge that the software was developed
 * by the University of California, Berkeley.  The name of the
 * University may not be used to endorse or promote products derived
 * from this software without specific prior written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

/* derived from @(#)rcmd.c  5.17 (Berkeley) 6/27/88 */

#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <ctype.h>
#include <string.h>
#include <pwd.h>
#include <sys/param.h>
#include <sys/types.h>
#include <fcntl.h>

#include <signal.h>
#include <sys/file.h>
#include <sys/socket.h>
#include <sys/stat.h>

#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <locale.h>
#include <syslog.h>

#include <errno.h>
#include <com_err.h>
#include <k5-int.h>
#include <kcmd.h>

static char *default_service = "host";

#define KCMD_BUFSIZ 102400
#define KCMD8_BUFSIZ    (4096 - 256)
/*
 * For compatibility with earlier versions of Solaris and other OS
 * (kerborized rsh uses 4KB of RSH_BUFSIZE)- 256 to make sure
 * there is room
 */
static int deswrite_compat(int, char *, int, int);

#define KCMD_KEYUSAGE   1026

static char storage[KCMD_BUFSIZ];
static int nstored = 0;
static int MAXSIZE = (KCMD_BUFSIZ + 8);
static char *store_ptr = storage;
static krb5_data desinbuf, desoutbuf;

static boolean_t encrypt_flag = B_FALSE;
static krb5_context kcmd_context;

/* XXX Overloaded: use_ivecs!=0 -> new protocol, inband signalling, etc.  */
static boolean_t use_ivecs = B_FALSE;
static krb5_data encivec_i[2], encivec_o[2];
static krb5_keyusage enc_keyusage_i[2], enc_keyusage_o[2];
static krb5_enctype final_enctype;
static krb5_keyblock *skey;

/* ARGSUSED */
int
kcmd(int *sock, char **ahost, ushort_t rport,
    char *locuser, char *remuser,
    char *cmd, int *fd2p, char *service, char *realm,
    krb5_context bsd_context, krb5_auth_context *authconp,
    krb5_creds **cred, krb5_int32 *seqno, krb5_int32 *server_seqno,
    krb5_flags authopts,
    int anyport, enum kcmd_proto *protonump)
{
    int s = -1;
    sigset_t oldmask, urgmask;
    struct sockaddr_in sin;
    struct sockaddr_storage from;
    krb5_creds *get_cred = NULL;
    krb5_creds *ret_cred = NULL;
    char c;
    struct hostent *hp;
    int rc;
    char *host_save = NULL;
    krb5_error_code status;
    krb5_ap_rep_enc_part *rep_ret;
    krb5_error  *error = 0;
    krb5_ccache cc;
    krb5_data outbuf;
    krb5_flags options = authopts;
    krb5_auth_context auth_context = NULL;
    char *cksumbuf;
    krb5_data cksumdat;
    int bsize = 0;
    char *kcmd_version;
    enum kcmd_proto protonum = *protonump;

    bsize = strlen(cmd) + strlen(remuser) + 64;
    if ((cksumbuf = malloc(bsize)) == 0) {
        (void) fprintf(stderr, gettext("Unable to allocate"
                        " memory for checksum buffer.\n"));
        return (-1);
    }
    (void) snprintf(cksumbuf, bsize, "%u:", ntohs(rport));
    if (strlcat(cksumbuf, cmd, bsize) >= bsize) {
        (void) fprintf(stderr, gettext("cmd buffer too long.\n"));
        free(cksumbuf);
        return (-1);
    }
    if (strlcat(cksumbuf, remuser, bsize) >= bsize) {
        (void) fprintf(stderr, gettext("remuser too long.\n"));
        free(cksumbuf);
        return (-1);
    }
    cksumdat.data = cksumbuf;
    cksumdat.length = strlen(cksumbuf);

    hp = gethostbyname(*ahost);
    if (hp == 0) {
        (void) fprintf(stderr,
                gettext("%s: unknown host\n"), *ahost);
        return (-1);
    }

    if ((host_save = (char *)strdup(hp->h_name)) == NULL) {
        (void) fprintf(stderr, gettext("kcmd: no memory\n"));
        return (-1);
    }

    /* If no service is given set to the default service */
    if (!service) service = default_service;

    if (!(get_cred = (krb5_creds *)calloc(1, sizeof (krb5_creds)))) {
        (void) fprintf(stderr, gettext("kcmd: no memory\n"));
        return (-1);
    }
    (void) sigemptyset(&urgmask);
    (void) sigaddset(&urgmask, SIGURG);
    (void) sigprocmask(SIG_BLOCK, &urgmask, &oldmask);

    status = krb5_sname_to_principal(bsd_context, host_save, service,
                    KRB5_NT_SRV_HST, &get_cred->server);
    if (status) {
        (void) fprintf(stderr,
                gettext("kcmd: "
                    "krb5_sname_to_principal failed: %s\n"),
                error_message(status));
        status = -1;
        goto bad;
    }

    if (realm && *realm) {
        (void) krb5_xfree(
            krb5_princ_realm(bsd_context, get_cred->server)->data);
        krb5_princ_set_realm_length(bsd_context, get_cred->server,
                    strlen(realm));
        krb5_princ_set_realm_data(bsd_context, get_cred->server,
                        strdup(realm));
    }

    s = socket(AF_INET, SOCK_STREAM, 0);
    if (s < 0) {
        perror(gettext("Error creating socket"));
        status = -1;
        goto bad;
    }
    /*
     * Kerberos only supports IPv4 addresses for now.
     */
    if (hp->h_addrtype == AF_INET) {
        sin.sin_family = hp->h_addrtype;
        (void) memcpy((void *)&sin.sin_addr,
                hp->h_addr, hp->h_length);
        sin.sin_port = rport;
    } else {
        syslog(LOG_ERR, "Address type %d not supported for "
            "Kerberos", hp->h_addrtype);
        status = -1;
        goto bad;
    }

    if (connect(s, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
        perror(host_save);
        status = -1;
        goto bad;
    }

    if (fd2p == 0) {
        (void) write(s, "", 1);
    } else {
        char num[16];
        int s2;
        int s3;
        struct sockaddr_storage sname;
        struct sockaddr_in *sp;
        int len = sizeof (struct sockaddr_storage);

        s2 = socket(AF_INET, SOCK_STREAM, 0);
        if (s2 < 0) {
            status = -1;
            goto bad;
        }
        (void) memset((char *)&sin, 0, sizeof (sin));
        sin.sin_family = AF_INET;
        sin.sin_addr.s_addr = INADDR_ANY;
        sin.sin_port = 0;

        if (bind(s2, (struct sockaddr *)&sin, sizeof (sin)) < 0) {
            perror(gettext("error binding socket"));
            (void) close(s2);
            status = -1;
            goto bad;
        }
        if (getsockname(s2, (struct sockaddr *)&sname, &len) < 0) {
            perror(gettext("getsockname error"));
            (void) close(s2);
            status = -1;
            goto bad;
        }
        sp = (struct sockaddr_in *)&sname;
        (void) listen(s2, 1);
        (void) snprintf(num, sizeof (num), "%d",
                htons((ushort_t)sp->sin_port));
        if (write(s, num, strlen(num)+1) != strlen(num)+1) {
            perror(gettext("write: error setting up stderr"));
            (void) close(s2);
            status = -1;
            goto bad;
        }

        s3 = accept(s2, (struct sockaddr *)&from, &len);
        (void) close(s2);
        if (s3 < 0) {
            perror(gettext("accept"));
            status = -1;
            goto bad;
        }
        *fd2p = s3;
        if (SOCK_FAMILY(from) == AF_INET) {
            if (!anyport && SOCK_PORT(from) >= IPPORT_RESERVED) {
                (void) fprintf(stderr,
                    gettext("socket: protocol "
                        "failure in circuit setup.\n"));
                status = -1;
                goto bad2;
            }
        } else {
            (void) fprintf(stderr,
                    gettext("Kerberos does not support "
                        "address type %d\n"),
                    SOCK_FAMILY(from));
            status = -1;
            goto bad2;
        }
    }

    if (status = krb5_cc_default(bsd_context, &cc))
        goto bad2;

    status = krb5_cc_get_principal(bsd_context, cc, &get_cred->client);
    if (status) {
        (void) krb5_cc_close(bsd_context, cc);
        goto bad2;
    }

    /* Get ticket from credentials cache or kdc */
    status = krb5_get_credentials(bsd_context, 0, cc, get_cred, &ret_cred);
    (void) krb5_cc_close(bsd_context, cc);
    if (status) goto bad2;

    /* Reset internal flags; these should not be sent. */
    authopts &= (~OPTS_FORWARD_CREDS);
    authopts &= (~OPTS_FORWARDABLE_CREDS);

    if ((status = krb5_auth_con_init(bsd_context, &auth_context)))
        goto bad2;

    if ((status = krb5_auth_con_setflags(bsd_context, auth_context,
                    KRB5_AUTH_CONTEXT_RET_TIME)))
        goto bad2;

    /* Only need local address for mk_cred() to send to krlogind */
    if ((status = krb5_auth_con_genaddrs(bsd_context, auth_context, s,
            KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR)))
        goto bad2;

    if (protonum == KCMD_PROTOCOL_COMPAT_HACK) {
        krb5_boolean is_des;
        status = krb5_c_enctype_compare(bsd_context,
                        ENCTYPE_DES_CBC_CRC,
                        ret_cred->keyblock.enctype,
                        &is_des);
        if (status)
            goto bad2;
        protonum = is_des ? KCMD_OLD_PROTOCOL : KCMD_NEW_PROTOCOL;
    }

    switch (protonum) {
    case KCMD_NEW_PROTOCOL:
        authopts |= AP_OPTS_USE_SUBKEY;
        kcmd_version = "KCMDV0.2";
        break;
    case KCMD_OLD_PROTOCOL:
        kcmd_version = "KCMDV0.1";
        break;
    default:
        status = -1;
        goto bad2;
    }

    /*
     * Call the Kerberos library routine to obtain an authenticator,
     * pass it over the socket to the server, and obtain mutual
     * authentication.
     */
    status = krb5_sendauth(bsd_context, &auth_context, (krb5_pointer) &s,
            kcmd_version, ret_cred->client, ret_cred->server,
            authopts, &cksumdat, ret_cred, 0, &error,
            &rep_ret, NULL);
    krb5_xfree(cksumdat.data);
    if (status) {
        (void) fprintf(stderr, gettext("Couldn't authenticate"
                        " to server: %s\n"),
                error_message(status));
        if (error) {
            (void) fprintf(stderr, gettext("Server returned error"
                        " code %d (%s)\n"),
                error->error,
                error_message(ERROR_TABLE_BASE_krb5 +
                        error->error));
            if (error->text.length)
                (void) fprintf(stderr,
                        gettext("Error text"
                            " sent from server: %s\n"),
                        error->text.data);
        }
        if (error) {
            krb5_free_error(bsd_context, error);
            error = 0;
        }
        goto bad2;
    }
    if (rep_ret && server_seqno) {
        *server_seqno = rep_ret->seq_number;
        krb5_free_ap_rep_enc_part(bsd_context, rep_ret);
    }

    (void) write(s, remuser, strlen(remuser)+1);
    (void) write(s, cmd, strlen(cmd)+1);
    if (locuser)
        (void) write(s, locuser, strlen(locuser)+1);
    else
        (void) write(s, "", 1);

    if (options & OPTS_FORWARD_CREDS) {   /* Forward credentials */
        if (status = krb5_fwd_tgt_creds(bsd_context, auth_context,
                    host_save,
                    ret_cred->client, ret_cred->server,
                    0, options & OPTS_FORWARDABLE_CREDS,
                    &outbuf)) {
            (void) fprintf(stderr,
                    gettext("kcmd: Error getting"
                        " forwarded creds\n"));
            goto bad2;
        }
        /* Send forwarded credentials */
        if (status = krb5_write_message(bsd_context, (krb5_pointer)&s,
                        &outbuf))
            goto bad2;
    } else { /* Dummy write to signal no forwarding */
        outbuf.length = 0;
        if (status = krb5_write_message(bsd_context,
                        (krb5_pointer)&s, &outbuf))
            goto bad2;
    }

    if ((rc = read(s, &c, 1)) != 1) {
        if (rc == -1) {
            perror(*ahost);
        } else {
            (void) fprintf(stderr, gettext("kcmd: bad connection "
                    "with remote host\n"));
        }
        status = -1;
        goto bad2;
    }
    if (c != 0) {
        while (read(s, &c, 1) == 1) {
            (void) write(2, &c, 1);
            if (c == '\n')
                break;
        }
        status = -1;
        goto bad2;
    }
    (void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
    *sock = s;

    /* pass back credentials if wanted */
    if (cred) (void) krb5_copy_creds(bsd_context, ret_cred, cred);
        krb5_free_creds(bsd_context, ret_cred);
    /*
     * Initialize *authconp to auth_context, so
     * that the clients can make use of it
     */
    *authconp = auth_context;

    return (0);
bad2:
    if (fd2p != NULL)
        (void) close(*fd2p);
bad:
    if (s > 0)
        (void) close(s);
    if (get_cred)
        krb5_free_creds(bsd_context, get_cred);
    if (ret_cred)
        krb5_free_creds(bsd_context, ret_cred);
    if (host_save)
        free(host_save);
    (void) sigprocmask(SIG_SETMASK, &oldmask, (sigset_t *)0);
    return (status);
}

/*
 * Strsave was a routine in the version 4 krb library: we put it here
 * for compatablilty with version 5 krb library, since kcmd.o is linked
 * into all programs.
 */

char *
strsave(char *sp)
{
    char *ret;

    if ((ret = (char *)strdup(sp)) == NULL) {
        (void) fprintf(stderr, gettext("no memory for saving args\n"));
        exit(1);
    }
    return (ret);
}


/*
 * This routine is to initialize the desinbuf, desoutbuf and the session key
 * structures to carry out desread()'s and deswrite()'s successfully
 */
void
init_encrypt(int enc, krb5_context ctxt, enum kcmd_proto protonum,
    krb5_data *inbuf, krb5_data *outbuf,
    int amclient, krb5_encrypt_block *block)
{
    krb5_error_code statuscode;
    size_t blocksize;
    int i;
    krb5_error_code ret;

    kcmd_context = ctxt;

    if (enc > 0) {
        desinbuf.data = inbuf->data;
        desoutbuf.data = outbuf->data + 4;
        desinbuf.length = inbuf->length;
        desoutbuf.length = outbuf->length + 4;
        encrypt_flag = B_TRUE;
    } else {
        encrypt_flag = B_FALSE;
        return;
    }

    skey = block->key;
    final_enctype = skey->enctype;

    enc_keyusage_i[0] = KCMD_KEYUSAGE;
    enc_keyusage_i[1] = KCMD_KEYUSAGE;
    enc_keyusage_o[0] = KCMD_KEYUSAGE;
    enc_keyusage_o[1] = KCMD_KEYUSAGE;

    if (protonum == KCMD_OLD_PROTOCOL) {
        use_ivecs = B_FALSE;
        return;
    }

    use_ivecs = B_TRUE;
    switch (skey->enctype) {
    /*
     * For the DES-based enctypes and the 3DES enctype we
     * want to use a non-zero  IV because that's what we did.
     * In the future we use different keyusage for each
     * channel and direction and a fresh cipher state.
     */
    case ENCTYPE_DES_CBC_CRC:
    case ENCTYPE_DES_CBC_MD4:
    case ENCTYPE_DES_CBC_MD5:
    case ENCTYPE_DES3_CBC_SHA1:
        statuscode = krb5_c_block_size(kcmd_context, final_enctype,
                &blocksize);
        if (statuscode) {
            /* XXX what do I do? */
            abort();
        }

        encivec_i[0].length = encivec_i[1].length =
        encivec_o[0].length = encivec_o[1].length = blocksize;

        if ((encivec_i[0].data = malloc(encivec_i[0].length * 4))
            == NULL) {
            /* XXX what do I do? */
            abort();
        }
        encivec_i[1].data = encivec_i[0].data + encivec_i[0].length;
        encivec_o[0].data = encivec_i[1].data + encivec_i[0].length;
        encivec_o[1].data = encivec_o[0].data + encivec_i[0].length;

        /* is there a better way to initialize this? */
        (void) memset(encivec_i[0].data, amclient, blocksize);
        (void) memset(encivec_o[0].data, 1 - amclient, blocksize);
        (void) memset(encivec_i[1].data, 2 | amclient, blocksize);
        (void) memset(encivec_o[1].data, 2 | (1 - amclient), blocksize);
        break;
    default:
        if (amclient) {
            enc_keyusage_i[0] = 1028;
            enc_keyusage_i[1] = 1030;
            enc_keyusage_o[0] = 1032;
            enc_keyusage_o[1] = 1034;
        } else { /* amclient */
            enc_keyusage_i[0] = 1032;
            enc_keyusage_i[1] = 1034;
            enc_keyusage_o[0] = 1028;
            enc_keyusage_o[1] = 1030;
        }
        for (i = 0; i < 2; i++) {
            ret = krb5_c_init_state(ctxt,
                skey, enc_keyusage_i[i],
                &encivec_i[i]);
            if (ret)
                goto fail;
            ret = krb5_c_init_state(ctxt,
                skey, enc_keyusage_o[i],
                &encivec_o[i]);
            if (ret)
                goto fail;
        }
        break;
    }
    return;
fail:
    abort();
}

int
desread(int fd, char *buf, int len, int secondary)
{
    int nreturned = 0;
    long net_len, rd_len;
    int cc;
    size_t ret = 0;
    unsigned char len_buf[4];
    krb5_enc_data inputd;
    krb5_data outputd;

    if (!encrypt_flag)
        return (read(fd, buf, len));

    /*
     * If there is stored data from a previous read,
     * put it into the output buffer and return it now.
     */
    if (nstored >= len) {
        (void) memcpy(buf, store_ptr, len);
        store_ptr += len;
        nstored -= len;
        return (len);
    } else if (nstored) {
        (void) memcpy(buf, store_ptr, nstored);
        nreturned += nstored;
        buf += nstored;
        len -= nstored;
        nstored = 0;
    }

    if ((cc = krb5_net_read(kcmd_context, fd, (char *)len_buf, 4)) != 4) {
        if ((cc < 0) && ((errno == EWOULDBLOCK) || (errno == EAGAIN)))
            return (cc);
        /* XXX can't read enough, pipe must have closed */
        return (0);
    }
    rd_len = ((len_buf[0] << 24) | (len_buf[1] << 16) |
            (len_buf[2] << 8) | len_buf[3]);

    if (krb5_c_encrypt_length(kcmd_context, final_enctype,
                use_ivecs ? (size_t)rd_len + 4 : (size_t)rd_len,
                &ret))
        net_len = ((size_t)-1);
    else
        net_len = ret;

    if ((net_len <= 0) || (net_len > desinbuf.length)) {
        /*
         * preposterous length; assume out-of-sync; only recourse
         * is to close connection, so return 0
         */
        (void) fprintf(stderr, gettext("Read size problem.\n"));
        return (0);
    }

    if ((cc = krb5_net_read(kcmd_context, fd, desinbuf.data, net_len))
        != net_len) {
        /* pipe must have closed, return 0 */
        (void) fprintf(stderr,
                gettext("Read error: length received %d "
                    "!= expected %d.\n"),
                cc, net_len);
        return (0);
    }

    /*
     * Decrypt information
     */
    inputd.enctype = ENCTYPE_UNKNOWN;
    inputd.ciphertext.length = net_len;
    inputd.ciphertext.data = (krb5_pointer)desinbuf.data;

    outputd.length = sizeof (storage);
    outputd.data = (krb5_pointer)storage;

    /*
     * data is decrypted into the "storage" buffer, which
     * had better be large enough!
     */
    cc = krb5_c_decrypt(kcmd_context, skey,
                enc_keyusage_i[secondary],
                use_ivecs ? encivec_i + secondary : 0,
                &inputd, &outputd);
    if (cc) {
        (void) fprintf(stderr, gettext("Cannot decrypt data "
            "from network\n"));
        return (0);
    }

    store_ptr = storage;
    nstored = rd_len;
    if (use_ivecs == B_TRUE) {
        int rd_len2;
        rd_len2 = storage[0] & 0xff;
        rd_len2 <<= 8; rd_len2 |= storage[1] & 0xff;
        rd_len2 <<= 8; rd_len2 |= storage[2] & 0xff;
        rd_len2 <<= 8; rd_len2 |= storage[3] & 0xff;
        if (rd_len2 != rd_len) {
            /* cleartext length trashed? */
            errno = EIO;
            return (-1);
        }
        store_ptr += 4;
    }
    /*
     * Copy only as much data as the input buffer will allow.
     * The rest is kept in the 'storage' pointer for the next
     * read.
     */
    if (nstored > len) {
        (void) memcpy(buf, store_ptr, len);
        nreturned += len;
        store_ptr += len;
        nstored -= len;
    } else {
        (void) memcpy(buf, store_ptr, nstored);
        nreturned += nstored;
        nstored = 0;
    }

    return (nreturned);
}
int
deswrite(int fd, char *buf, int len, int secondary)
{
    int bytes_written;
    int r;
    int outlen;
    char *p;
    if (!encrypt_flag)
        return (write(fd, buf, len));

    bytes_written = 0;
    while (len > 0) {
        p = buf + bytes_written;
        if (len > KCMD8_BUFSIZ)
            outlen = KCMD8_BUFSIZ;
        else
            outlen = len;
        r = deswrite_compat(fd, p, outlen, secondary);
        if (r == -1)
            return (r);
        bytes_written += r;
        len -= r;
    }
    return (bytes_written);
}
static int
deswrite_compat(int fd, char *buf, int len, int secondary)
{
    int cc;
    size_t ret = 0;
    krb5_data inputd;
    krb5_enc_data outputd;
    char tmpbuf[KCMD_BUFSIZ + 8];
    char encrbuf[KCMD_BUFSIZ + 8];
    unsigned char *len_buf = (unsigned char *)tmpbuf;

    if (use_ivecs == B_TRUE) {
        unsigned char *lenbuf2 = (unsigned char *)tmpbuf;
        if (len + 4 > sizeof (tmpbuf))
            abort();
        lenbuf2[0] = (len & 0xff000000) >> 24;
        lenbuf2[1] = (len & 0xff0000) >> 16;
        lenbuf2[2] = (len & 0xff00) >> 8;
        lenbuf2[3] = (len & 0xff);
        (void) memcpy(tmpbuf + 4, buf, len);

        inputd.data = (krb5_pointer)tmpbuf;
        inputd.length = len + 4;
    } else {
        inputd.data = (krb5_pointer)buf;
        inputd.length = len;
    }

    desoutbuf.data = encrbuf;

    if (krb5_c_encrypt_length(kcmd_context, final_enctype,
            use_ivecs ? (size_t)len + 4 : (size_t)len, &ret)) {
        desoutbuf.length = ((size_t)-1);
        goto err;
    } else {
        desoutbuf.length = ret;
    }

    if (desoutbuf.length > MAXSIZE) {
        (void) fprintf(stderr, gettext("Write size problem.\n"));
        return (-1);
    }

    /*
     * Encrypt information
     */
    outputd.ciphertext.length = desoutbuf.length;
    outputd.ciphertext.data = (krb5_pointer)desoutbuf.data;

    cc = krb5_c_encrypt(kcmd_context, skey,
            enc_keyusage_o[secondary],
            use_ivecs ? encivec_o + secondary : 0,
            &inputd, &outputd);

    if (cc) {
err:
        (void) fprintf(stderr, gettext("Write encrypt problem.\n"));
        return (-1);
    }

    len_buf[0] = (len & 0xff000000) >> 24;
    len_buf[1] = (len & 0xff0000) >> 16;
    len_buf[2] = (len & 0xff00) >> 8;
    len_buf[3] = (len & 0xff);
    (void) write(fd, len_buf, 4);

    if (write(fd, desoutbuf.data, desoutbuf.length) != desoutbuf.length) {
        (void) fprintf(stderr, gettext("Could not write "
            "out all data.\n"));
        return (-1);
    } else {
        return (len);
    }
}