oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

lib/krb5: krb5_init_creds_get() passes hostinfo=NULL to krb5_init_creds_step()

Browse Source 
The current prototype of krb5_init_creds_step() is completely
useless as the caller has no way to know the destination
realm for the out blob.

The only internal caller of krb5_init_creds_step()
passes hostinfo=NULL and this commit makes it more obvious that hostinfo
is always NULL.

NOTE: commit 1cdc9d5f3c
"krb5: export krb5_init_creds_step()" exported
krb5_init_creds_step() the first time, but that's
not in any released version, so it should be fine
to fix up the prototype.

The aim is to remove hostinfo from the krb5_init_creds_step() internals
completely and move krb5_init_creds_step() to a useful prototype
where it returns the destination realm for the out packet.

Which means the prototype will mostly match the one MIT is using:

   krb5_error_code KRB5_CALLCONV
   krb5_init_creds_step(krb5_context context,
                        krb5_init_creds_context ctx,
                        krb5_data *in,
                        krb5_data *out,
                        krb5_data *realm,
                        unsigned int *flags);

Follow up patches demonstrate that the hostinfo related code
in pk_verify_host() is actually dead code as all layers
just passed down the NULL value from krb5_init_creds_get().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Stefan Metzmacher
2022-03-03 16:48:08 +01:00
committed by Jeffrey Altman
parent cfb32a638e
commit acaa62636f
2 changed files with 8 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/krb5/fast.c
View File

@@ -856,7 +856,7 @@ _krb5_fast_anon_pkinit_step(krb5_context context,
struct krb5_fast_state *state,
krb5_data *in,
krb5_data *out,
krb5_krbhst_info *hostinfo,
const void *_unused,
unsigned int *flags)
{
krb5_error_code ret;
@@ -902,7 +902,7 @@ _krb5_fast_anon_pkinit_step(krb5_context context,
anon_pk_ctx = state->anon_pkinit_ctx;
ret = krb5_init_creds_step(context, anon_pk_ctx, in, out, hostinfo, flags);
ret = krb5_init_creds_step(context, anon_pk_ctx, in, out, NULL, flags);
if (ret ||
(*flags & KRB5_INIT_CREDS_STEP_FLAG_CONTINUE))
goto out;