[SSSD] [PATCH] Add support for krb5 1.11's responder callback.

Jakub Hrozek jhrozek at redhat.com
Fri Mar 8 14:41:09 UTC 2013


On Fri, Mar 08, 2013 at 09:02:02AM -0500, Simo Sorce wrote:
> On Fri, 2013-03-08 at 13:09 +0100, Jakub Hrozek wrote:
> > In general in code that uses talloc, functions that return an
> > allocated
> > value should accept TALLOC_CTX *mem_ctx as the first parameter. The
> > output parameters should then be allocated on that memory context.
> > This
> > is far better than allocating on NULL as you are sure that the memory
> > would eventually be freed. You wouldn't have to explicitly free the
> > pin
> > and/or token but if for example they were allocated on top of the
> > krb5_req, then when krb5_req was freed, so would be token and pin.
> > 
> OTOH you may want to use safezero() on token and PIN before freeing
> them, safezero() is already used automatically in
> sss_authtok_wipe_password().
> 

You could do that with a talloc destructor..

> Nathaniel, also please change your code to use sss_auth_token getters
> and setters, directly accessing pd->authotk.length and friends is not
> permitted anymore as sss_auth_token is opaque. See src/util/authotk.h

Should we make the structure really opaque so that users would be forced
to use the API?



More information about the sssd-devel mailing list