krb5_tl_data *tl;
krb5_error_code ret;
- dbentry = krb5_db_alloc(context, NULL, sizeof(*dbentry));
+ dbentry = calloc(1, sizeof(*dbentry));
if (dbentry == NULL)
return 1;
- memset(dbentry, 0, sizeof(*dbentry));
(*linenop)++;
nread = fscanf(filep, "%u\t%u\t%u\t%u\t%u\t", &u1, &u2, &u3, &u4, &u5);
if (nread == EOF) {
struct iterate_args iargs;
krb5_actkvno_node actkvno;
- entry = krb5_db_alloc(context, NULL, sizeof(*entry));
+ entry = calloc(1, sizeof(*entry));
if (entry == NULL)
return ENOMEM;
- memset(entry, 0, sizeof(*entry));
entry->len = KRB5_KDB_V1_BASE_LENGTH;
entry->attributes = pblock->flags;
krb5_tl_data *tl;
osa_policy_ent_t p;
int ret;
- size_t len;
CHECK_HANDLE(server_handle);
if ((mask & KADM5_POLICY_MAX_RLIFE))
p->max_renewable_life = entry->max_renewable_life;
if ((mask & KADM5_POLICY_ALLOWED_KEYSALTS)) {
- krb5_db_free(handle->context, p->allowed_keysalts);
+ free(p->allowed_keysalts);
p->allowed_keysalts = NULL;
if (entry->allowed_keysalts != NULL) {
- len = strlen(entry->allowed_keysalts) + 1;
- p->allowed_keysalts = krb5_db_alloc(handle->context, NULL,
- len);
+ p->allowed_keysalts = strdup(entry->allowed_keysalts);
if (p->allowed_keysalts == NULL) {
ret = ENOMEM;
goto cleanup;
}
- memcpy(p->allowed_keysalts, entry->allowed_keysalts, len);
}
}
if ((mask & KADM5_POLICY_TL_DATA)) {
int n_key_data, krb5_key_data *key_data,
krb5_keyblock **keyblocks, int *n_keys);
-static krb5_error_code
-kadm5_copy_principal(krb5_context context, krb5_const_principal inprinc, krb5_principal *outprinc)
-{
- register krb5_principal tempprinc;
- register int i, nelems;
-
- tempprinc = (krb5_principal)krb5_db_alloc(context, NULL, sizeof(krb5_principal_data));
-
- if (tempprinc == 0)
- return ENOMEM;
-
- VALGRIND_CHECK_DEFINED(*inprinc);
- *tempprinc = *inprinc;
-
- nelems = (int) krb5_princ_size(context, inprinc);
- tempprinc->data = krb5_db_alloc(context, NULL, nelems * sizeof(krb5_data));
- if (tempprinc->data == 0) {
- krb5_db_free(context, (char *)tempprinc);
- return ENOMEM;
- }
-
- for (i = 0; i < nelems; i++) {
- unsigned int len = krb5_princ_component(context, inprinc, i)->length;
- krb5_princ_component(context, tempprinc, i)->length = len;
- if (((krb5_princ_component(context, tempprinc, i)->data =
- krb5_db_alloc(context, NULL, len)) == 0) && len) {
- while (--i >= 0)
- krb5_db_free(context, krb5_princ_component(context, tempprinc, i)->data);
- krb5_db_free (context, tempprinc->data);
- krb5_db_free (context, tempprinc);
- return ENOMEM;
- }
- if (len)
- memcpy(krb5_princ_component(context, tempprinc, i)->data,
- krb5_princ_component(context, inprinc, i)->data, len);
- krb5_princ_component(context, tempprinc, i)->magic = KV5M_DATA;
- }
-
- tempprinc->realm.data =
- krb5_db_alloc(context, NULL, tempprinc->realm.length = inprinc->realm.length);
- if (!tempprinc->realm.data && tempprinc->realm.length) {
- for (i = 0; i < nelems; i++)
- krb5_db_free(context, krb5_princ_component(context, tempprinc, i)->data);
- krb5_db_free(context, tempprinc->data);
- krb5_db_free(context, tempprinc);
- return ENOMEM;
- }
- if (tempprinc->realm.length)
- memcpy(tempprinc->realm.data, inprinc->realm.data,
- inprinc->realm.length);
-
- *outprinc = tempprinc;
- return 0;
-}
-
/*
* XXX Functions that ought to be in libkrb5.a, but aren't.
*/
int count;
krb5_key_data * data;
{
- int i, j;
+ int i;
for (i = 0; i < count; i++)
- for (j = 0; j < data[i].key_data_ver; j++)
- if (data[i].key_data_length[j])
- krb5_db_free(context, data[i].key_data_contents[j]);
- krb5_db_free(context, data);
+ krb5_free_key_data_contents(context, &data[i]);
+ free(data);
}
/* Check whether a ks_tuple is present in an array of ks_tuples. */
return ret;
}
- kdb = krb5_db_alloc(handle->context, NULL, sizeof(*kdb));
+ kdb = calloc(1, sizeof(*kdb));
if (kdb == NULL)
return ENOMEM;
- memset(kdb, 0, sizeof(*kdb));
memset(&adb, 0, sizeof(osa_princ_ent_rec));
/*
to free the entire kdb entry, and that will try to free the
principal. */
- if ((ret = kadm5_copy_principal(handle->context,
- entry->principal, &(kdb->princ))))
+ ret = krb5_copy_principal(handle->context, entry->principal, &kdb->princ);
+ if (ret)
goto cleanup;
if ((ret = krb5_dbe_update_last_pwd_change(handle->context, kdb, now)))
krb5_int32 now;
kadm5_policy_ent_rec pol;
krb5_keysalt keysalt;
- int i, k, kvno, ret;
+ int i, kvno, ret;
krb5_boolean have_pol = FALSE;
#if 0
int last_pwd;
if (kdb->key_data != NULL)
cleanup_key_data(handle->context, kdb->n_key_data, kdb->key_data);
- kdb->key_data = (krb5_key_data*)krb5_db_alloc(handle->context, NULL, sizeof(krb5_key_data));
+ kdb->key_data = calloc(1, sizeof(krb5_key_data));
if (kdb->key_data == NULL)
return ENOMEM;
- memset(kdb->key_data, 0, sizeof(krb5_key_data));
kdb->n_key_data = 1;
keysalt.type = KRB5_KDB_SALTTYPE_V4;
/* XXX data.magic? */
/* use tmp_key_data as temporary location and reallocate later */
ret = krb5_dbe_encrypt_key_data(handle->context, act_mkey, keyblock,
- &keysalt, kvno + 1, &tmp_key_data);
+ &keysalt, kvno + 1, kdb->key_data);
if (ret) {
goto done;
}
- for (k = 0; k < tmp_key_data.key_data_ver; k++) {
- kdb->key_data->key_data_type[k] = tmp_key_data.key_data_type[k];
- kdb->key_data->key_data_length[k] = tmp_key_data.key_data_length[k];
- if (tmp_key_data.key_data_contents[k]) {
- kdb->key_data->key_data_contents[k] = krb5_db_alloc(handle->context, NULL, tmp_key_data.key_data_length[k]);
- if (kdb->key_data->key_data_contents[k] == NULL) {
- cleanup_key_data(handle->context, kdb->n_key_data, kdb->key_data);
- kdb->key_data = NULL;
- kdb->n_key_data = 0;
- ret = ENOMEM;
- goto done;
- }
- memcpy (kdb->key_data->key_data_contents[k], tmp_key_data.key_data_contents[k], tmp_key_data.key_data_length[k]);
-
- memset (tmp_key_data.key_data_contents[k], 0, tmp_key_data.key_data_length[k]);
- free (tmp_key_data.key_data_contents[k]);
- tmp_key_data.key_data_contents[k] = NULL;
- }
- }
-
-
-
kdb->attributes &= ~KRB5_KDB_REQUIRES_PWCHANGE;
ret = krb5_timeofday(handle->context, &now);
}
n_new_key_data = n_key_data + (keepold ? kdb->n_key_data : 0);
- new_key_data = krb5_db_alloc(handle->context, NULL,
- n_new_key_data * sizeof(krb5_key_data));
+ new_key_data = calloc(n_new_key_data, sizeof(krb5_key_data));
if (new_key_data == NULL) {
n_new_key_data = 0;
ret = ENOMEM;
goto done;
}
- memset(new_key_data, 0, n_new_key_data * sizeof(krb5_key_data));
n_new_key_data = 0;
for (i = 0; i < n_key_data; i++) {
n_old_keydata = kdb->n_key_data;
kdb->n_key_data = 0;
/* Allocate one extra key_data to avoid allocating 0 bytes. */
- kdb->key_data = krb5_db_alloc(handle->context, NULL,
- (n_old_keydata + 1) * sizeof(krb5_key_data));
+ kdb->key_data = calloc(n_old_keydata, sizeof(krb5_key_data));
if (kdb->key_data == NULL) {
ret = ENOMEM;
goto done;
krb5_enc_data cipher;
for (i = 0; i < key_data->key_data_ver; i++) {
- krb5_db_free(context, key_data->key_data_contents[i]);
+ free(key_data->key_data_contents[i]);
key_data->key_data_contents[i] = NULL;
}
&len)))
return(retval);
- ptr = krb5_db_alloc(context, NULL, 2 + len);
+ ptr = malloc(2 + len);
if (ptr == NULL)
return(ENOMEM);
if ((retval = krb5_c_encrypt(context, mkey, /* XXX */ 0, 0,
&plain, &cipher))) {
- krb5_db_free(context, key_data->key_data_contents[0]);
+ free(key_data->key_data_contents[0]);
return retval;
}
key_data->key_data_ver++;
key_data->key_data_type[1] = keysalt->type;
if ((key_data->key_data_length[1] = keysalt->data.length) != 0) {
- key_data->key_data_contents[1] =
- krb5_db_alloc(context, NULL, keysalt->data.length);
+ key_data->key_data_contents[1] = malloc(keysalt->data.length);
if (key_data->key_data_contents[1] == NULL) {
- krb5_db_free(context, key_data->key_data_contents[0]);
+ free(key_data->key_data_contents[0]);
return ENOMEM;
}
memcpy(key_data->key_data_contents[1], keysalt->data.data,
log_ctx->ulog != NULL;
}
-/*
- * XXX eventually this should be consolidated with krb5_free_key_data_contents
- * so there is only a single version.
- */
void
krb5_dbe_free_key_data_contents(krb5_context context, krb5_key_data *key)
{
}
static void
-free_db_args(krb5_context kcontext, char **db_args)
+free_db_args(char **db_args)
{
int i;
if (db_args) {
- /* XXX Is this right? Or are we borrowing storage from
- the caller? */
for (i = 0; db_args[i]; i++)
- krb5_db_free(kcontext, db_args[i]);
+ free(db_args[i]);
free(db_args);
}
}
prev->tl_data_next = curr->tl_data_next;
}
(*count)--;
- krb5_db_free(kcontext, curr);
+ free(curr);
/* previous does not change */
curr = next;
status = 0;
clean_n_exit:
if (status != 0) {
- free_db_args(kcontext, db_args);
+ free_db_args(db_args);
db_args = NULL;
}
*db_argsp = db_args;
if (status)
return status;
status = v->put_principal(kcontext, entry, db_args);
- free_db_args(kcontext, db_args);
+ free_db_args(db_args);
return status;
}
}
clean_n_exit:
- if (tmp_key.contents) {
- zap(tmp_key.contents, tmp_key.length);
- krb5_db_free(context, tmp_key.contents);
- }
+ zapfree(tmp_key.contents, tmp_key.length);
return retval;
}
krb5_error_code
krb5_dbe_create_key_data(krb5_context context, krb5_db_entry *entry)
{
- if ((entry->key_data =
- (krb5_key_data *) krb5_db_alloc(context, entry->key_data,
- (sizeof(krb5_key_data) *
- (entry->n_key_data + 1)))) == NULL)
- return (ENOMEM);
+ krb5_key_data *newptr;
+
+ newptr = realloc(entry->key_data,
+ (entry->n_key_data + 1) * sizeof(*entry->key_data));
+ if (newptr == NULL)
+ return ENOMEM;
+ entry->key_data = newptr;
memset(entry->key_data + entry->n_key_data, 0, sizeof(krb5_key_data));
entry->n_key_data++;
* Copy the new data first, so we can fail cleanly if malloc()
* fails.
*/
- if ((tmp =
- (krb5_octet *) krb5_db_alloc(context, NULL,
- new_tl_data->tl_data_length)) == NULL)
+ tmp = malloc(new_tl_data->tl_data_length);
+ if (tmp == NULL)
return (ENOMEM);
/*
/* If necessary, chain a new record in the beginning and point at it. */
if (!tl_data) {
- tl_data = krb5_db_alloc(context, NULL, sizeof(krb5_tl_data));
+ tl_data = calloc(1, sizeof(*tl_data));
if (tl_data == NULL) {
free(tmp);
return (ENOMEM);
}
- memset(tl_data, 0, sizeof(krb5_tl_data));
tl_data->tl_data_next = *tl_datap;
*tl_datap = tl_data;
(*n_tl_datap)++;
/* fill in the record */
- if (tl_data->tl_data_contents)
- krb5_db_free(context, tl_data->tl_data_contents);
+ free(tl_data->tl_data_contents);
tl_data->tl_data_type = new_tl_data->tl_data_type;
tl_data->tl_data_length = new_tl_data->tl_data_length;
krb5_dbe_specialize_salt(krb5_context context, krb5_db_entry *entry)
{
krb5_int16 stype, i;
- krb5_data *salt = NULL;
- krb5_error_code ret = 0;
- uint8_t *data;
+ krb5_data *salt;
+ krb5_error_code ret;
if (context == NULL || entry == NULL)
return EINVAL;
ret = krb5_dbe_compute_salt(context, &entry->key_data[i], entry->princ,
&stype, &salt);
if (ret)
- goto cleanup;
-
- data = krb5_db_alloc(context, NULL, salt->length);
- if (data == NULL) {
- ret = ENOMEM;
- goto cleanup;
- }
- memcpy(data, salt->data, salt->length);
+ return ret;
+ /* Steal the data pointer from salt and free the container. */
+ if (entry->key_data[i].key_data_ver >= 2)
+ free(entry->key_data[i].key_data_contents[1]);
entry->key_data[i].key_data_type[1] = KRB5_KDB_SALTTYPE_SPECIAL;
- krb5_db_free(context, entry->key_data[i].key_data_contents[1]);
- entry->key_data[i].key_data_contents[1] = data;
+ entry->key_data[i].key_data_contents[1] = (uint8_t *)salt->data;
entry->key_data[i].key_data_length[1] = salt->length;
entry->key_data[i].key_data_ver = 2;
- krb5_free_data(context, salt);
- salt = NULL;
+ free(salt);
}
-cleanup:
- krb5_free_data(context, salt);
- return ret;
+ return 0;
}
/* change password functions */
* Set ent->n_tl_data = 0 initially, if this is an ADD update
*/
if (is_add) {
- ent = krb5_db_alloc(context, NULL, sizeof(*ent));
+ ent = calloc(1, sizeof(*ent));
if (ent == NULL)
return (ENOMEM);
- memset(ent, 0, sizeof(*ent));
ent->n_tl_data = 0;
}
int count;
krb5_key_data * data;
{
- int i, j;
+ int i;
/* If data is NULL, count is always 0 */
if (data == NULL) return;
- for (i = 0; i < count; i++) {
- for (j = 0; j < data[i].key_data_ver; j++) {
- if (data[i].key_data_length[j]) {
- krb5_db_free(context, data[i].key_data_contents[j]);
- }
- }
- }
- krb5_db_free(context, data);
+ for (i = 0; i < count; i++)
+ krb5_dbe_free_key_data_contents(context, &data[i]);
+ free(data);
}
-/* Copy key data from in to out, using krb5_db_alloc storage for out. */
-static krb5_error_code
-copy_key_data(krb5_context context, krb5_key_data *in, krb5_key_data *out)
-{
- int i;
- void *copies[2] = { NULL, NULL };
-
- memset(out, 0, sizeof(*out));
-
- /* Copy the key data contents using krb5_db_alloc storage. */
- for (i = 0; i < in->key_data_ver && i < 2; i++) {
- if (in->key_data_length[i] == 0)
- continue;
- copies[i] = krb5_db_alloc(context, NULL, in->key_data_length[i]);
- if (copies[i] == NULL) {
- while (--i >= 0) {
- zap(copies[i], in->key_data_length[i]);
- krb5_db_free(context, copies[i]);
- }
- return ENOMEM;
- }
- memcpy(copies[i], in->key_data_contents[i], in->key_data_length[i]);
- }
-
- /* Copy the structure and replace the allocated fields with the copies. */
- *out = *in;
- for (i = 0; i < 2; i++)
- out->key_data_contents[i] = copies[i];
-
- return 0;
-}
-
-/* Copy key data from old_kd to new_kd. new_kd will be encrypted with mkey and
- * will use krb5_db_alloc storage. */
+/* Transfer key data from old_kd to new_kd, making sure that new_kd is
+ * encrypted with mkey. May steal from old_kd and zero it out. */
static krb5_error_code
preserve_one_old_key(krb5_context context, krb5_keyblock *mkey,
krb5_db_entry *dbent, krb5_key_data *old_kd,
krb5_error_code ret;
krb5_keyblock kb;
krb5_keysalt salt;
- krb5_key_data kd;
memset(new_kd, 0, sizeof(*new_kd));
- memset(&kd, 0, sizeof(kd));
ret = krb5_dbe_decrypt_key_data(context, mkey, old_kd, &kb, NULL);
if (ret == 0) {
- /* old_kd is already encrypted in mkey, so just copy it. */
- krb5_free_keyblock_contents(context, &kb);
- return copy_key_data(context, old_kd, new_kd);
+ /* old_kd is already encrypted in mkey, so just move it. */
+ *new_kd = *old_kd;
+ memset(old_kd, 0, sizeof(*old_kd));
+ return 0;
}
/* Decrypt and re-encrypt old_kd using mkey. */
if (ret)
return ret;
ret = krb5_dbe_encrypt_key_data(context, mkey, &kb, &salt,
- old_kd->key_data_kvno, &kd);
+ old_kd->key_data_kvno, new_kd);
krb5_free_keyblock_contents(context, &kb);
krb5_free_data_contents(context, &salt.data);
- if (ret)
- return ret;
-
- /* Copy the result to ensure new_kd uses db_alloc storage. */
- ret = copy_key_data(context, &kd, new_kd);
- krb5_dbe_free_key_data_contents(context, &kd);
return ret;
}
-/* Add key_data to dbent, making sure that each entry is encrypted in mkey. If
- * kvno is non-zero, preserve only keys of that kvno. */
+/*
+ * Add key_data to dbent, making sure that each entry is encrypted in mkey. If
+ * kvno is non-zero, preserve only keys of that kvno. May steal some elements
+ * from key_data and zero them out.
+ */
static krb5_error_code
preserve_old_keys(krb5_context context, krb5_keyblock *mkey,
krb5_db_entry *dbent, int kvno, int n_key_data,
krb5_keyblock key;
int i, j;
krb5_error_code retval;
- krb5_key_data tmp_key_data;
+ krb5_key_data *kd_slot;
for (i = 0; i < ks_tuple_count; i++) {
krb5_boolean similar;
if ((retval = krb5_dbe_create_key_data(context, db_entry)))
return retval;
+ kd_slot = &db_entry->key_data[db_entry->n_key_data - 1];
/* there used to be code here to extract the old key, and derive
a new key from it. Now that there's a unified prng, that isn't
&key)))
return retval;
- memset( &tmp_key_data, 0, sizeof(tmp_key_data));
retval = krb5_dbe_encrypt_key_data(context, master_key, &key, NULL,
- kvno, &tmp_key_data);
+ kvno, kd_slot);
krb5_free_keyblock_contents(context, &key);
if( retval )
return retval;
-
- /* Copy the result to ensure we use db_alloc storage. */
- retval = copy_key_data(context, &tmp_key_data,
- &db_entry->key_data[db_entry->n_key_data - 1]);
- krb5_dbe_free_key_data_contents(context, &tmp_key_data);
- if (retval)
- return retval;
}
return 0;
krb5_data pwd;
krb5_data afs_params = string2data("\1"), *s2k_params;
int i, j;
- krb5_key_data tmp_key_data;
+ krb5_key_data *kd_slot;
for (i = 0; i < ks_tuple_count; i++) {
krb5_boolean similar;
if ((retval = krb5_dbe_create_key_data(context, db_entry)))
return(retval);
+ kd_slot = &db_entry->key_data[db_entry->n_key_data - 1];
/* Convert password string to key using appropriate salt */
switch (key_salt.type = ks_tuple[i].ks_salttype) {
return retval;
}
- memset(&tmp_key_data, 0, sizeof(tmp_key_data));
retval = krb5_dbe_encrypt_key_data(context, master_key, &key,
(const krb5_keysalt *)&key_salt,
- kvno, &tmp_key_data);
+ kvno, kd_slot);
if (key_salt.data.data)
free(key_salt.data.data);
free(key.contents);
if( retval )
return retval;
-
- /* Copy the result to ensure we use db_alloc storage. */
- retval = copy_key_data(context, &tmp_key_data,
- &db_entry->key_data[db_entry->n_key_data - 1]);
- krb5_dbe_free_key_data_contents(context, &tmp_key_data);
- if (retval)
- return retval;
}
return 0;
return ret;
}
- /* Possibly add some or all of the old keys to the back of the list. */
+ /* Possibly add some or all of the old keys to the back of the list. May
+ * steal from and zero out some of the old key data entries. */
if (savekeys != DISCARD_ALL) {
save_kvno = (savekeys == KEEP_LAST_KVNO) ? old_kvno : 0;
ret = preserve_old_keys(context, mkey, db_entry, save_kvno, n_key_data,
key_data);
}
+ /* Free any old key data entries not stolen and zeroed out above. */
cleanup_key_data(context, n_key_data, key_data);
return ret;
}
assert(krb5int_init_context_kdc(&context) == 0);
/* Start with an empty entry. */
- ent = krb5_db_alloc(context, NULL, sizeof(*ent));
+ ent = calloc(1, sizeof(*ent));
if (ent == NULL) {
fprintf(stderr, "Can't allocate memory for entry.\n");
return 1;
}
- memset(ent, 0, sizeof(*ent));
/* Check that the entry has no strings to start. */
assert(krb5_dbe_get_strings(context, ent, &strings, &count) == 0);
/* copy the new data first, so we can fail cleanly if malloc()
* fails */
-/*
- if ((tmp =
- (krb5_octet *) krb5_db_alloc(context, NULL,
- new_tl_data->tl_data_length)) == NULL)
-*/
if ((tmp = (krb5_octet *) malloc (new_tl_data->tl_data_length)) == NULL)
return (ENOMEM);
/* if necessary, chain a new record in the beginning and point at it */
if (!tl_data) {
-/*
- if ((tl_data =
- (krb5_tl_data *) krb5_db_alloc(context, NULL,
- sizeof(krb5_tl_data)))
- == NULL) {
-*/
if ((tl_data = (krb5_tl_data *) malloc (sizeof(krb5_tl_data))) == NULL) {
free(tmp);
return (ENOMEM);
/* fill in the record */
- if (tl_data->tl_data_contents)
- krb5_db_free(context, tl_data->tl_data_contents);
+ free(tl_data->tl_data_contents);
tl_data->tl_data_type = new_tl_data->tl_data_type;
tl_data->tl_data_length = new_tl_data->tl_data_length;
krb5_db_entry *newentry;
char princ_name[4096];
- newentry = krb5_db_alloc(context, NULL, sizeof(*newentry));
+ newentry = calloc(1, sizeof(*newentry));
if (newentry == NULL) {
com_err(progname, ENOMEM, "while allocating DB entry");
return;
}
- memset(newentry, 0, sizeof(*newentry));
snprintf(princ_name, sizeof(princ_name), "%s@%s", str_newprinc, cur_realm);
if ((retval = krb5_parse_name(context, princ_name, &newprinc))) {
com_err(progname, retval, "while parsing '%s'", princ_name);
projects / thirdparty / krb5.git / commitdiff
