[SSSD] [PATCH] Add support for krb5 1.11's responder callback.

Simo Sorce simo at redhat.com
Fri Mar 8 15:12:03 UTC 2013


On Fri, 2013-03-08 at 15:41 +0100, Jakub Hrozek wrote:
> On Fri, Mar 08, 2013 at 09:02:02AM -0500, Simo Sorce wrote:
> > On Fri, 2013-03-08 at 13:09 +0100, Jakub Hrozek wrote:
> > > In general in code that uses talloc, functions that return an
> > > allocated
> > > value should accept TALLOC_CTX *mem_ctx as the first parameter. The
> > > output parameters should then be allocated on that memory context.
> > > This
> > > is far better than allocating on NULL as you are sure that the memory
> > > would eventually be freed. You wouldn't have to explicitly free the
> > > pin
> > > and/or token but if for example they were allocated on top of the
> > > krb5_req, then when krb5_req was freed, so would be token and pin.
> > > 
> > OTOH you may want to use safezero() on token and PIN before freeing
> > them, safezero() is already used automatically in
> > sss_authtok_wipe_password().
> > 
> 
> You could do that with a talloc destructor..
> 
> > Nathaniel, also please change your code to use sss_auth_token getters
> > and setters, directly accessing pd->authotk.length and friends is not
> > permitted anymore as sss_auth_token is opaque. See src/util/authotk.h
> 
> Should we make the structure really opaque so that users would be forced
> to use the API?

I wanted to but there was a problem preventing me from doing that (which
I forgot already :-)
If you want to give it a try I am all for it.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list