cleanup

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/authdata@22596 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/authdata.c b/src/lib/krb5/krb/authdata.c
index 4b6df0bbbcf6b46ad46b4fba26c86afbecb41761..07718d4d0786ede20d2128fa3eae21884251d2a4 100644 (file)
--- a/src/lib/krb5/krb/authdata.c
+++ b/src/lib/krb5/krb/authdata.c
@@ -30,15 +30,17 @@
 
 /* Based on preauth2.c */
 
-#define DEBUG 1
-
 #if TARGET_OS_MAC
 static const char *objdirs[] = { KRB5_AUTHDATA_PLUGIN_BUNDLE_DIR, LIBDIR "/krb5/plugins/authdata", NULL }; /* should be a list */
 #else
 static const char *objdirs[] = { LIBDIR "/krb5/plugins/authdata", NULL };
 #endif
 
-static krb5plugin_authdata_client_ftable_v0 *authdata_systems[] = { &krb5int_mspac_authdata_client_ftable, NULL };
+/* Internal authdata systems */
+static krb5plugin_authdata_client_ftable_v0 *authdata_systems[] = {
+    &krb5int_mspac_authdata_client_ftable,
+    NULL
+};
 
 static inline int
 count_ad_modules(krb5plugin_authdata_client_ftable_v0 *table)
@@ -107,6 +109,7 @@ init_ad_system(krb5_context kcontext,
             context->modules[k].client_req_fini = table->request_fini;
             rcpp = &context->modules[k].request_context;
 
+            /* For now, single request per context. That may change */
             code = (*table->request_init)(kcontext,
                                           plugin_context,
                                           rcpp);
@@ -314,6 +317,8 @@ krb5int_verify_authdata(krb5_context kcontext,
 {
     int i;
     krb5_error_code code;
+    krb5_ticket *ticket = ap_req->ticket;
+    krb5_authenticator *authenticator = (*auth_context)->authentp;
 
     for (i = 0; i < context->n_modules; i++) {
         struct _krb5_authdata_context_module *module = &context->modules[i];
@@ -323,8 +328,8 @@ krb5int_verify_authdata(krb5_context kcontext,
             continue;
 
         code = krb5int_find_authdata(kcontext,
-                                     ap_req->ticket->enc_part2->authorization_data,
-                                     (*auth_context)->authentp->authorization_data,
+                                     ticket->enc_part2->authorization_data,
+                                     authenticator->authorization_data,
                                      module->ad_type,
                                      &authdata);
         if (code != 0 || authdata == NULL)
@@ -361,7 +366,7 @@ merge_data_array_nocopy(krb5_data **dst, krb5_data *src, unsigned int *len)
     for (i = 0; src[i].data != NULL; i++)
         ;
 
-    *dst = (krb5_data *)realloc(*dst, (*len + i + 1) * sizeof(krb5_data));
+    *dst = realloc(*dst, (*len + i + 1) * sizeof(krb5_data));
     if (*dst == NULL)
         return ENOMEM;
 
@@ -397,27 +402,38 @@ krb5_authdata_get_attribute_types(krb5_context kcontext,
         if ((*module->ftable->get_attribute_types)(kcontext,
                                                    module->plugin_context,
                                                    *(module->request_context_pp),
-                                                   &asserted2,
-                                                   &verified2) != 0)
+                                                   asserted_attrs ?
+                                                       &asserted2 : NULL,
+                                                   verified_attrs ?
+                                                       &verified2 : NULL) != 0)
             continue;
 
-        code = merge_data_array_nocopy(&asserted, asserted2, &len);
-        if (code != 0)
-            break;
-
-        code = merge_data_array_nocopy(&verified, verified2, &len);
-        if (code != 0)
-            break;
+        if (asserted_attrs != NULL) {
+            code = merge_data_array_nocopy(&asserted, asserted2, &len);
+            if (code != 0) {
+                krb5int_free_data_list(kcontext, asserted2);
+                break;
+            }
+            if (asserted2 != NULL)
+                free(asserted2);
+        }
 
-        if (asserted2 != NULL)
-            free(asserted2);
-        if (verified2 != NULL)
-            free(verified2);
+        if (verified_attrs != NULL) {
+            code = merge_data_array_nocopy(&verified, verified2, &len);
+            if (code != 0)  {
+                krb5int_free_data_list(kcontext, verified2);
+                break;
+            }
+            if (verified2 != NULL)
+                free(verified2);
+        }
     }
 
     if (code == 0) {
-        *asserted_attrs = asserted;
-        *verified_attrs = verified;
+        if (asserted_attrs != NULL)
+            *asserted_attrs = asserted;
+        if (verified_attrs != NULL)
+            *verified_attrs = verified;
     }
 
     return code;
@@ -436,7 +452,11 @@ krb5_authdata_get_attribute(krb5_context kcontext,
     int i;
     krb5_error_code code = ENOENT;
 
-    /* NB at present a plugin is presumed to be authoritative for an attribute */
+    /*
+     * NB at present a module is presumed to be authoritative for
+     * an attribute; not sure how to federate "more" across module
+     * yet
+     */
     for (i = 0; i < context->n_modules; i++) {
         struct _krb5_authdata_context_module *module = &context->modules[i];
 
@@ -552,7 +572,7 @@ krb5_authdata_export_attributes(krb5_context kcontext,
         for (j = 0; authdata2[j] != NULL; j++)
             ;
 
-        authdata = (krb5_authdata **)realloc(authdata, (len + j + 1) * sizeof(krb5_authdata *));
+        authdata = realloc(authdata, (len + j + 1) * sizeof(krb5_authdata *));
         if (authdata == NULL)
             return ENOMEM;
 
@@ -680,19 +700,6 @@ import_export_authdata(krb5_context kcontext,
     if (dst_module == NULL)
         return ENOENT;
 
-#if 0
-    if (dst_module->client_req_init != NULL) {
-        code = (*dst_module->client_req_init)(kcontext,
-                                              dst_module->plugin_context,
-                                              dst_module->request_context_pp);
-        if ((code != 0 && code != ENOMEM) &&
-            (dst_module->flags & AD_INFORMATIONAL))
-            code = 0;
-        if (code != 0)
-            return code;
-    }
-#endif
-
     if (src_module->ftable->export_internal == NULL ||
         dst_module->ftable->import_internal == NULL)
         return 0;
@@ -730,6 +737,8 @@ krb5_authdata_context_copy(krb5_context kcontext,
     krb5_error_code code;
     krb5_authdata_context dst;
 
+    /* This is a bit of a hack and potentially very expensive. */
+
     code = krb5_authdata_context_init(kcontext, &dst);
     if (code != 0)
         return code;
@@ -769,7 +778,8 @@ debug_authdata_attribute(krb5_context kcontext,
         if (code != 0)
             break;
 
-        fprintf(stderr, "AD Attribute %.*s Value Length %d Disp Value Length %d More %d\n",
+        fprintf(stderr, "AD Attribute %.*s Value Length %d "
+                "Disp Value Length %d More %d\n",
                 attr->length, attr->data, value.length, display_value.length, more);
 
         krb5_free_data_contents(kcontext, &value);

diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c
index 88fd95a1739e737d96a91724c3e3581fb3c2e4ef..b6c15dd261da41d6a4de0bb2564e7195ce6199f1 100644 (file)
--- a/src/lib/krb5/krb/pac.c
+++ b/src/lib/krb5/krb/pac.c
@@ -1053,12 +1053,10 @@ mspac_get_attribute_types(krb5_context context,
     unsigned int i, j;
     krb5_data *attrs;
     krb5_error_code code;
-
-    *asserted = NULL;
-    *verified = NULL;
+    krb5_data **outattrs;
 
     if (pacctx->pac == NULL) {
-       attrs = (krb5_data *)calloc(MSPAC_ATTRIBUTE_COUNT + 1, sizeof(krb5_data));
+       attrs = calloc(MSPAC_ATTRIBUTE_COUNT + 1, sizeof(krb5_data));
        if (attrs == NULL)
            return ENOMEM;
 
@@ -1067,7 +1065,7 @@ mspac_get_attribute_types(krb5_context context,
                                              &mspac_attribute_types[i].attribute,
                                              &attrs[i]);
            if (code != 0) {
-               free(attrs); /* XXX leak */
+               krb5int_free_data_list(context, attrs);
                return code;
            }
        }
@@ -1077,7 +1075,11 @@ mspac_get_attribute_types(krb5_context context,
        return 0;
     }
 
-    attrs = (krb5_data *)calloc(1 + pacctx->pac->pac->cBuffers + 1, sizeof(krb5_data));
+    outattrs = pacctx->pac->verified ? verified : asserted;
+    if (outattrs == NULL)
+       return EINVAL;
+
+    attrs = calloc(1 + pacctx->pac->pac->cBuffers + 1, sizeof(krb5_data));
     if (attrs == NULL)
        return ENOMEM;
 
@@ -1099,7 +1101,7 @@ mspac_get_attribute_types(krb5_context context,
        if (code == 0) {
            code = krb5int_copy_data_contents(context, &attr, &attrs[j++]);
            if (code != 0) {
-               free(attrs); /* XXX leak */
+               krb5int_free_data_list(context, attrs);
                return code;
            }
        } else {
@@ -1108,7 +1110,7 @@ mspac_get_attribute_types(krb5_context context,
            length = asprintf(&attrs[j].data, "mspac:%d",
                              pacctx->pac->pac->Buffers[i].ulType);
            if (length < 0) {
-               free(attrs); /* XXX leak */
+               krb5int_free_data_list(context, attrs);
                return ENOMEM;
            }
            attrs[j++].length = length;
@@ -1117,10 +1119,7 @@ mspac_get_attribute_types(krb5_context context,
     attrs[j].data = NULL;
     attrs[j].length = 0;
 
-    if (pacctx->pac->verified)
-       *verified = attrs;
-    else
-       *asserted = attrs;
+    *outattrs = attrs;
 
     return 0;
 }
@@ -1144,8 +1143,8 @@ mspac_get_attribute(krb5_context context,
     value->length = 0;
 
     if (display_value != NULL) {
-        display_value->data = NULL;
-        display_value->length = 0;
+       display_value->data = NULL;
+       display_value->length = 0;
     }
 
     if (*more != -1 || pacctx->pac == NULL)
@@ -1157,17 +1156,17 @@ mspac_get_attribute(krb5_context context,
 
     /* -1 is a magic type that refers to the entire PAC */
     if (type == (krb5_ui_4)-1) {
-        if (value != NULL)
+       if (value != NULL)
            code = krb5int_copy_data_contents(context,
-                                              &pacctx->pac->data,
-                                              value);
-        else
-            code = 0;
+                                             &pacctx->pac->data,
+                                             value);
+       else
+           code = 0;
     } else {
-        if (value != NULL)
+       if (value != NULL)
            code = krb5_pac_get_buffer(context, pacctx->pac, type, value);
-        else
-            code = k5_pac_locate_buffer(context, pacctx->pac, type, NULL);
+       else
+           code = k5_pac_locate_buffer(context, pacctx->pac, type, NULL);
     }
     if (code == 0) {
        *authenticated = pacctx->pac->verified;
@@ -1230,11 +1229,11 @@ mspac_export_attributes(krb5_context context,
     if (pacctx->pac == NULL)
        return EINVAL;
 
-    authdata = (krb5_authdata **)calloc(2, sizeof(krb5_authdata *));
+    authdata = calloc(2, sizeof(krb5_authdata *));
     if (authdata == NULL)
        return ENOMEM;
 
-    authdata[0] = (krb5_authdata *)calloc(1, sizeof(krb5_authdata));
+    authdata[0] = calloc(1, sizeof(krb5_authdata));
     if (authdata[0] == NULL) {
        free(authdata);
        return ENOMEM;
@@ -1259,7 +1258,7 @@ static krb5_error_code
 mspac_export_internal(krb5_context context,
                      void *plugin_context,
                      void *request_context,
-                      krb5_boolean restrict_authenticated,
+                     krb5_boolean restrict_authenticated,
                      void **ptr)
 {
     struct mspac_context *pacctx = (struct mspac_context *)request_context;
@@ -1272,13 +1271,13 @@ mspac_export_internal(krb5_context context,
        return 0;
 
     if (restrict_authenticated && (pacctx->pac->verified) == FALSE)
-        return 0;
+       return 0;
 
     code = krb5_pac_parse(context, pacctx->pac->data.data,
-                         pacctx->pac->data.length, &pac);
+                         pacctx->pac->data.length, &pac);
     if (code == 0) {
-        pac->verified = pacctx->pac->verified;
-        *ptr = pac;
+       pac->verified = pacctx->pac->verified;
+       *ptr = pac;
     }
 
     return code;