.github
.zed
admin
appl
cf
doc
etc
include
kadmin
kcm
kdc
kpasswd
kuser
lib
asn1
base
com_err
gss_preauth
gssapi
hcrypto
hdb
heimdal
hx509
ipc
kadm5
kafs
kdfs
krb5
Makefile.am
NTMakefile
acache.c
acl.c
add_et_list.c
addr_families.c
aes-test.c
an2ln_plugin.h
aname_to_localname.c
appdefault.c
asn1_glue.c
auth_context.c
authdata.c
build_ap_req.c
build_auth.c
cache.c
ccache_plugin.h
changepw.c
codec.c
config_file.c
constants.c
context.c
convert_creds.c
copy_host_realm.c
crc.c
creds.c
crypto-aes-sha1.c
crypto-aes-sha2.c
crypto-algs.c
crypto-arcfour.c
crypto-des-common.c
crypto-des.c
crypto-des3.c
crypto-evp.c
crypto-null.c
crypto-pk.c
crypto-rand.c
crypto-stubs.c
crypto.c
crypto.h
data.c
db_plugin.c
db_plugin.h
dcache.c
deprecated.c
derived-key-test.c
digest.c
dll.c
doxygen.c
eai_to_heim_errno.c
enomem.c
error_string.c
expand_hostname.c
expand_path.c
fast.c
fcache.c
free.c
free_host_realm.c
generate_seq_number.c
generate_subkey.c
get_addrs.c
get_cred.c
get_default_principal.c
get_default_realm.c
get_for_creds.c
get_host_realm.c
get_in_tkt.c
get_port.c
init_creds.c
init_creds_pw.c
k524_err.et
k5e1_err.et
kcm.c
kcm.h
kerberos.8
keyblock.c
keytab.c
keytab_any.c
keytab_file.c
keytab_keyfile.c
keytab_memory.c
krb5-plugin.7
krb5.conf.5
krb5.h
krb5.moduli
krb524_convert_creds_kdc.3
krb5_425_conv_principal.3
krb5_acl_match_file.3
krb5_aname_to_localname.3
krb5_appdefault.3
krb5_auth_context.3
krb5_c_make_checksum.3
krb5_ccapi.h
krb5_check_transited.3
krb5_create_checksum.3
krb5_creds.3
krb5_digest.3
krb5_eai_to_heim_errno.3
krb5_encrypt.3
krb5_err.et
krb5_find_padata.3
krb5_generate_random_block.3
krb5_get_all_client_addrs.3
krb5_get_credentials.3
krb5_get_creds.3
krb5_get_forwarded_creds.3
krb5_get_in_cred.3
krb5_get_init_creds.3
krb5_get_krbhst.3
krb5_getportbyname.3
krb5_init_context.3
krb5_is_thread_safe.3
krb5_krbhst_init.3
krb5_locl.h
krb5_mk_req.3
krb5_mk_safe.3
krb5_openlog.3
krb5_parse_name.3
krb5_principal.3
krb5_rcache.3
krb5_rd_error.3
krb5_rd_safe.3
krb5_set_default_realm.3
krb5_set_password.3
krb5_string_to_key.3
krb5_timeofday.3
krb5_verify_init_creds.3
krb5_verify_user.3
krb_err.et
krbhst-test.c
krbhst.c
krcache.c
kuserok.c
kuserok_plugin.h
kx509.c
kx509_err.et
libkrb5-exports.def.in
locate_plugin.h
log.c
mcache.c
misc.c
mit_glue.c
mk_cred.c
mk_error.c
mk_priv.c
mk_rep.c
mk_req.c
mk_req_ext.c
mk_safe.c
n-fold-test.c
n-fold.c
net_read.c
net_write.c
pac.c
padata.c
parse-name-test.c
pcache.c
pkinit-ec.c
pkinit.c
plugin.c
principal.c
prog_setup.c
prompter_posix.c
pseudo-random-test.c
rd_cred.c
rd_error.c
rd_priv.c
rd_rep.c
rd_req.c
rd_safe.c
read_message.c
recvauth.c
replay.c
salt-aes-sha1.c
salt-aes-sha2.c
salt-arcfour.c
salt-des.c
salt-des3.c
salt.c
scache.c
send_to_kdc.c
send_to_kdc_plugin.h
sendauth.c
set_default_realm.c
sock_principal.c
sp800-108-kdf.c
store-int.c
store-int.h
store-test.c
store.c
store_emem.c
store_fd.c
store_mem.c
store_sock.c
store_stdio.c
string-to-key-test.c
test_acl.c
test_addr.c
test_alname.c
test_ap-req.c
test_canon.c
test_cc.c
test_config.c
test_config_strings.cfg
test_crypto.c
test_crypto_wrapping.c
test_expand_toks.c
test_forward.c
test_fx.c
test_get_addrs.c
test_gic.c
test_hostname.c
test_keytab.c
test_kuserok.c
test_mem.c
test_mkforwardable.c
test_pac.c
test_pkinit_dh2key.c
test_pknistkdf.c
test_plugin.c
test_prf.c
test_princ.c
test_renew.c
test_rfc3961.c
test_set_kvno0.c
test_store.c
test_time.c
test_x500.c
ticket.c
time.c
transited.c
verify_init.c
verify_krb5_conf-version.rc
verify_krb5_conf.8
verify_krb5_conf.c
verify_user.c
version-script.map
version.c
warn.c
write_message.c
libedit
ntlm
otp
roken
sl
sqlite
vers
wind
Makefile.am
NTMakefile
nix
packages
po
tests
tools
windows
.gitignore
.travis.yml
CODE_OF_CONDUCT.md
ChangeLog
ChangeLog.1998
ChangeLog.1999
ChangeLog.2000
ChangeLog.2001
ChangeLog.2002
ChangeLog.2003
ChangeLog.2004
ChangeLog.2005
ChangeLog.2006
ChangeLog.2007
LICENSE
Makefile.am
Makefile.am.common
NEWS
NTMakefile
README
README.fast
README.md
SECURITY.md
TODO
acinclude.m4
appveyor.yml
autogen.sh
configure.ac
flake.lock
flake.nix
krb5.conf

krb5_free_keyblock_contents() should use memset_s() to ensure that the key is zero'd before freeing
204 lines
5.3 KiB
C
204 lines
5.3 KiB
C
/*
|
|
* Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
|
|
* (Royal Institute of Technology, Stockholm, Sweden).
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* 3. Neither the name of the Institute nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
#include "krb5_locl.h"
|
|
|
|
/**
|
|
* Zero out a keyblock
|
|
*
|
|
* @param keyblock keyblock to zero out
|
|
*
|
|
* @ingroup krb5_crypto
|
|
*/
|
|
|
|
KRB5_LIB_FUNCTION void KRB5_LIB_CALL
|
|
krb5_keyblock_zero(krb5_keyblock *keyblock)
|
|
{
|
|
keyblock->keytype = 0;
|
|
krb5_data_zero(&keyblock->keyvalue);
|
|
}
|
|
|
|
/**
|
|
* Free a keyblock's content, also zero out the content of the keyblock.
|
|
*
|
|
* @param context a Kerberos 5 context
|
|
* @param keyblock keyblock content to free, NULL is valid argument
|
|
*
|
|
* @ingroup krb5_crypto
|
|
*/
|
|
|
|
KRB5_LIB_FUNCTION void KRB5_LIB_CALL
|
|
krb5_free_keyblock_contents(krb5_context context,
|
|
krb5_keyblock *keyblock)
|
|
{
|
|
if(keyblock) {
|
|
if (keyblock->keyvalue.data != NULL)
|
|
memset_s(keyblock->keyvalue.data, keyblock->keyvalue.length,
|
|
0, keyblock->keyvalue.length);
|
|
krb5_data_free (&keyblock->keyvalue);
|
|
keyblock->keytype = KRB5_ENCTYPE_NULL;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Free a keyblock, also zero out the content of the keyblock, uses
|
|
* krb5_free_keyblock_contents() to free the content.
|
|
*
|
|
* @param context a Kerberos 5 context
|
|
* @param keyblock keyblock to free, NULL is valid argument
|
|
*
|
|
* @ingroup krb5_crypto
|
|
*/
|
|
|
|
KRB5_LIB_FUNCTION void KRB5_LIB_CALL
|
|
krb5_free_keyblock(krb5_context context,
|
|
krb5_keyblock *keyblock)
|
|
{
|
|
if(keyblock){
|
|
krb5_free_keyblock_contents(context, keyblock);
|
|
free(keyblock);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Copy a keyblock, free the output keyblock with
|
|
* krb5_free_keyblock_contents().
|
|
*
|
|
* @param context a Kerberos 5 context
|
|
* @param inblock the key to copy
|
|
* @param to the output key.
|
|
*
|
|
* @return 0 on success or a Kerberos 5 error code
|
|
*
|
|
* @ingroup krb5_crypto
|
|
*/
|
|
|
|
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
|
|
krb5_copy_keyblock_contents (krb5_context context,
|
|
const krb5_keyblock *inblock,
|
|
krb5_keyblock *to)
|
|
{
|
|
return copy_EncryptionKey(inblock, to);
|
|
}
|
|
|
|
/**
|
|
* Copy a keyblock, free the output keyblock with
|
|
* krb5_free_keyblock().
|
|
*
|
|
* @param context a Kerberos 5 context
|
|
* @param inblock the key to copy
|
|
* @param to the output key.
|
|
*
|
|
* @return 0 on success or a Kerberos 5 error code
|
|
*
|
|
* @ingroup krb5_crypto
|
|
*/
|
|
|
|
|
|
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
|
|
krb5_copy_keyblock (krb5_context context,
|
|
const krb5_keyblock *inblock,
|
|
krb5_keyblock **to)
|
|
{
|
|
krb5_error_code ret;
|
|
krb5_keyblock *k;
|
|
|
|
*to = NULL;
|
|
|
|
k = calloc (1, sizeof(*k));
|
|
if (k == NULL)
|
|
return krb5_enomem(context);
|
|
|
|
ret = krb5_copy_keyblock_contents (context, inblock, k);
|
|
if (ret) {
|
|
free(k);
|
|
return ret;
|
|
}
|
|
*to = k;
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* Get encryption type of a keyblock.
|
|
*
|
|
* @ingroup krb5_crypto
|
|
*/
|
|
|
|
KRB5_LIB_FUNCTION krb5_enctype KRB5_LIB_CALL
|
|
krb5_keyblock_get_enctype(const krb5_keyblock *block)
|
|
{
|
|
return block->keytype;
|
|
}
|
|
|
|
/**
|
|
* Fill in `key' with key data of type `enctype' from `data' of length
|
|
* `size'. Key should be freed using krb5_free_keyblock_contents().
|
|
*
|
|
* @return 0 on success or a Kerberos 5 error code
|
|
*
|
|
* @ingroup krb5_crypto
|
|
*/
|
|
|
|
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
|
|
krb5_keyblock_init(krb5_context context,
|
|
krb5_enctype type,
|
|
const void *data,
|
|
size_t size,
|
|
krb5_keyblock *key)
|
|
{
|
|
krb5_error_code ret;
|
|
size_t len;
|
|
|
|
memset(key, 0, sizeof(*key));
|
|
|
|
ret = krb5_enctype_keysize(context, type, &len);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (len != size) {
|
|
krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
|
|
"Encryption key %d is %lu bytes "
|
|
"long, %lu was passed in",
|
|
type, (unsigned long)len, (unsigned long)size);
|
|
return KRB5_PROG_ETYPE_NOSUPP;
|
|
}
|
|
ret = krb5_data_copy(&key->keyvalue, data, len);
|
|
if(ret) {
|
|
krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
|
|
return ret;
|
|
}
|
|
key->keytype = type;
|
|
|
|
return 0;
|
|
}
|