[SSSD] [PATCH] Add support for krb5 1.11's responder callback.

Simo Sorce simo at redhat.com
Fri Mar 8 14:02:02 UTC 2013


On Fri, 2013-03-08 at 13:09 +0100, Jakub Hrozek wrote:
> In general in code that uses talloc, functions that return an
> allocated
> value should accept TALLOC_CTX *mem_ctx as the first parameter. The
> output parameters should then be allocated on that memory context.
> This
> is far better than allocating on NULL as you are sure that the memory
> would eventually be freed. You wouldn't have to explicitly free the
> pin
> and/or token but if for example they were allocated on top of the
> krb5_req, then when krb5_req was freed, so would be token and pin.
> 
OTOH you may want to use safezero() on token and PIN before freeing
them, safezero() is already used automatically in
sss_authtok_wipe_password().

Nathaniel, also please change your code to use sss_auth_token getters
and setters, directly accessing pd->authotk.length and friends is not
permitted anymore as sss_auth_token is opaque. See src/util/authotk.h

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list