[SSSD] [PATCH] Add support for krb5 1.11's responder callback.

Jakub Hrozek jhrozek at redhat.com
Fri Mar 8 16:09:13 UTC 2013


On Fri, Mar 08, 2013 at 10:12:03AM -0500, Simo Sorce wrote:
> On Fri, 2013-03-08 at 15:41 +0100, Jakub Hrozek wrote:
> > On Fri, Mar 08, 2013 at 09:02:02AM -0500, Simo Sorce wrote:
> > > On Fri, 2013-03-08 at 13:09 +0100, Jakub Hrozek wrote:
> > > > In general in code that uses talloc, functions that return an
> > > > allocated
> > > > value should accept TALLOC_CTX *mem_ctx as the first parameter. The
> > > > output parameters should then be allocated on that memory context.
> > > > This
> > > > is far better than allocating on NULL as you are sure that the memory
> > > > would eventually be freed. You wouldn't have to explicitly free the
> > > > pin
> > > > and/or token but if for example they were allocated on top of the
> > > > krb5_req, then when krb5_req was freed, so would be token and pin.
> > > > 
> > > OTOH you may want to use safezero() on token and PIN before freeing
> > > them, safezero() is already used automatically in
> > > sss_authtok_wipe_password().
> > > 
> > 
> > You could do that with a talloc destructor..
> > 
> > > Nathaniel, also please change your code to use sss_auth_token getters
> > > and setters, directly accessing pd->authotk.length and friends is not
> > > permitted anymore as sss_auth_token is opaque. See src/util/authotk.h
> > 
> > Should we make the structure really opaque so that users would be forced
> > to use the API?
> 
> I wanted to but there was a problem preventing me from doing that (which
> I forgot already :-)
> If you want to give it a try I am all for it.
> 
> Simo.

I don't think I can do it today and I'm afraid I would forget over my
vacation, so I'm just filing a ticket for now:
https://fedorahosted.org/sssd/ticket/1830



More information about the sssd-devel mailing list