ipa_kdb.c

Bug Summary

File:	daemons/ipa-kdb/ipa_kdb.c
Warning:	line 378, column 26 Array access (from variable 'cvals') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ipa_kdb.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I . -I ../../util -D PREFIX="/usr/local" -D BINDIR="/usr/local/bin" -D LIBDIR="/usr/local/lib" -D LIBEXECDIR="/usr/local/libexec" -D DATADIR="/usr/local/share" -D LDAPIDIR="/run" -I /usr/include/samba-4.0 -D _GNU_SOURCE=1 -D HAVE_IMMEDIATE_STRUCTURES=1 -I /usr/include/nss3 -I /usr/include/nspr4 -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -D PIC -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/daemons/ipa-kdb -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c ipa_kdb.c

1/*
* MIT Kerberos KDC database backend for FreeIPA
*
* Authors: Simo Sorce <ssorce@redhat.com>
*
* Copyright (C) 2011  Simo Sorce, Red Hat
* see file 'COPYING' for use and warranty information
*
* This program is free software you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

23#include <talloc.h>
24#include <sys/utsname.h>

26#include "ipa_kdb.h"
27#include "ipa_krb5.h"

29#define IPADB_GLOBAL_CONFIG_CACHE_TIME60 60

31struct ipadb_context *ipadb_get_context(krb5_context kcontext)
32{
  void *db_ctx;
  krb5_error_code kerr;

  kerr = krb5_db_get_context(kcontext, &db_ctx);
  if (kerr != 0) {
      return NULL((void*)0);
  }

  return (struct ipadb_context *)db_ctx;
42}

44static void ipadb_context_free(krb5_context kcontext,
                             struct ipadb_context **ctx)
46{
  struct ipadb_global_config *cfg;
  size_t c;

  if (*ctx != NULL((void*)0)) {
      free((*ctx)->uri);
      free((*ctx)->base);
      free((*ctx)->realm_base);
      free((*ctx)->accounts_base);
      free((*ctx)->kdc_hostname);
      /* ldap free lcontext */
      if ((*ctx)->lcontext) {
          ldap_unbind_ext_s((*ctx)->lcontext, NULL((void*)0), NULL((void*)0));
      }
      free((*ctx)->supp_encs);
      free((*ctx)->def_encs);
      ipadb_mspac_struct_free(&(*ctx)->mspac);
      krb5_free_principal(kcontext, (*ctx)->local_tgs);
      krb5_free_default_realm(kcontext, (*ctx)->realm);

      cfg = &(*ctx)->config;
      for (c = 0; cfg->authz_data && cfg->authz_data[c]; c++) {
          free(cfg->authz_data[c]);
      }
      free(cfg->authz_data);

72#ifdef HAVE_KRB5_CERTAUTH_PLUGIN1
      ipa_certauth_free_moddata(&((*ctx)->certauth_moddata));
74#endif

      free(*ctx);
      *ctx = NULL((void*)0);
  }
79}

81#define LDAPI_URI_PREFIX"ldapi://" "ldapi://"
82#define LDAPI_PATH_PREFIX"%2fslapd-" "%2fslapd-"
83#define SOCKET_SUFFIX".socket" ".socket"
84#define APPEND_PATH_PART(pos, part)do { int partlen = strlen(part); strncpy(pos, part, partlen +
 1); p += partlen; } while (0) \
  do { \
      int partlen = strlen(part); \
      strncpy(pos, part, partlen + 1); \
      p += partlen; \
  } while (0)

91static char *ipadb_realm_to_ldapi_uri(char *realm)
92{
  char *uri = NULL((void*)0);
  char *p;
  const char *q;
  int len;

  /* uri length, assume worst case for LDAPIDIR */
  len = strlen(LDAPI_URI_PREFIX"ldapi://") + strlen(LDAPIDIR"/run") * 3
        + strlen(LDAPI_PATH_PREFIX"%2fslapd-") + strlen(realm)
        + strlen(SOCKET_SUFFIX".socket") + 1;

  /* worst case they are all '/' to escape */
  uri = malloc(len);
  if (!uri) {
      return NULL((void*)0);
  }
  p = uri;

  APPEND_PATH_PART(p, LDAPI_URI_PREFIX)do { int partlen = strlen("ldapi://"); strncpy(p, "ldapi://",
 partlen + 1); p += partlen; } while (0);

  /* copy path and escape '/' to '%2f' */
  for (q = LDAPIDIR"/run"; *q; q++) {
      if (*q == '/') {
          memcpy(p, "%2f", 3);
          p += 3;
      } else {
          *p = *q;
          p++;
      }
  }

  APPEND_PATH_PART(p, LDAPI_PATH_PREFIX)do { int partlen = strlen("%2fslapd-"); strncpy(p, "%2fslapd-"
, partlen + 1); p += partlen; } while (0);

  /* copy realm and convert '.' to '-' */
  for (q = realm; *q; q++) {
      if (*q == '.') {
          *p = '-';
      } else {
          *p = *q;
      }
      p++;
  }

  /* terminate string */
  APPEND_PATH_PART(p, SOCKET_SUFFIX)do { int partlen = strlen(".socket"); strncpy(p, ".socket", partlen
 + 1); p += partlen; } while (0);

  return uri;
139}

141/* in IPA the base is always derived from the realm name */
142static char *ipadb_get_base_from_realm(krb5_context kcontext)
143{
  krb5_error_code kerr;
  char *realm = NULL((void*)0);
  char *base = NULL((void*)0);
  char *tmp;
  size_t bi, ri;
  size_t len;

  kerr = krb5_get_default_realm(kcontext, &realm);
  if (kerr != 0) {
      return NULL((void*)0);
  }

  bi = 3;
  len = strlen(realm) + 3 + 1;

  base = malloc(len);
  if (!base) {
      goto done;
  }
  strcpy(base, "dc=");

  /* convert EXAMPLE.COM in dc=example,dc=com */
  for (ri = 0; realm[ri]; ri++) {
      if (realm[ri] == '.') {
          len += 4;
          tmp = realloc(base, len);
          if (!tmp) {
              free(base);
              base = NULL((void*)0);
              goto done;
          }
          base = tmp;
          strcpy(&base[bi], ",dc=");
          bi += 4;
      } else {
          base[bi] = tolower(realm[ri]);
          bi++;
      }
  }
  base[bi] = '\0';

185done:
  krb5_free_default_realm(kcontext, realm);
  return base;
188}

190static const struct {
  const char *name;
  enum ipadb_user_auth flag;
193} userauth_table[] = {
  { "disabled", IPADB_USER_AUTH_DISABLED },
  { "password", IPADB_USER_AUTH_PASSWORD },
  { "radius", IPADB_USER_AUTH_RADIUS },
  { "otp", IPADB_USER_AUTH_OTP },
  { "pkinit", IPADB_USER_AUTH_PKINIT },
  { "hardened", IPADB_USER_AUTH_HARDENED },
  { }
201};

203void ipadb_parse_user_auth(LDAP *lcontext, LDAPMessage *le,
                         enum ipadb_user_auth *userauth)
205{
  struct berval **vals;
  int i, j;

  *userauth = IPADB_USER_AUTH_NONE;
  vals = ldap_get_values_len(lcontext, le, IPA_USER_AUTH_TYPE"ipaUserAuthType");
  if (!vals)
      return;

  for (i = 0; vals[i]; i++) {
      for (j = 0; userauth_table[j].name; j++) {
          if (strcasecmp(vals[i]->bv_val, userauth_table[j].name) == 0) {
              *userauth |= userauth_table[j].flag;
              break;
          }
      }
  }

  ldap_value_free_len(vals);
224}

226static int ipadb_load_global_config(struct ipadb_context *ipactx)
227{
  char *attrs[] = { "ipaConfigString", IPA_KRB_AUTHZ_DATA_ATTR"ipaKrbAuthzData",
                    IPA_USER_AUTH_TYPE"ipaUserAuthType", NULL((void*)0) };
  struct berval **vals = NULL((void*)0);
  LDAPMessage *res = NULL((void*)0);
  LDAPMessage *first;
  char *base = NULL((void*)0);
  int ret;
  char **authz_data_list;

  if (!ipactx || !ipactx->lcontext) {
      return EINVAL22;
  }

  ret = asprintf(&base, "cn=ipaConfig,cn=etc,%s", ipactx->base);
  if (ret == -1) {
      ret = ENOMEM12;
      goto done;
  }

  ret = ipadb_simple_search(ipactx, base, LDAP_SCOPE_BASE((ber_int_t) 0x0000),
                            "(objectclass=*)", attrs, &res);
  if (ret) {
      goto done;
  }

  first = ldap_first_entry(ipactx->lcontext, res);
  if (!first) {
      /* no results, set nothing */
      ret = 0;
      goto done;
  }

  /* Check for permitted authentication types. */
  ipadb_parse_user_auth(ipactx->lcontext, res, &ipactx->config.user_auth);

  /* Load config strings. */
  vals = ldap_get_values_len(ipactx->lcontext, first, "ipaConfigString");
  if (vals) {
      ipactx->config.disable_last_success = false0;
      ipactx->config.disable_lockout = false0;
      for (int i = 0; vals[i]; i++) {
          if (strncasecmp("KDC:Disable Last Success",
                          vals[i]->bv_val, vals[i]->bv_len) == 0) {
              ipactx->config.disable_last_success = true1;
              continue;
          } else if (strncasecmp("KDC:Disable Lockout",
                                 vals[i]->bv_val, vals[i]->bv_len) == 0) {
              ipactx->config.disable_lockout = true1;
              continue;
          } else if (strncasecmp("KDC:Disable Default Preauth for SPNs",
                                 vals[i]->bv_val, vals[i]->bv_len) == 0) {
              ipactx->config.disable_preauth_for_spns = true1;
          }
      }
  }

/* Load authz data. */
  ret = ipadb_ldap_attr_to_strlist(ipactx->lcontext, first,
                                   IPA_KRB_AUTHZ_DATA_ATTR"ipaKrbAuthzData", &authz_data_list);
  if (ret == 0) {
      if (ipactx->config.authz_data != NULL((void*)0)) {
          for (int i = 0; ipactx->config.authz_data[i]; i++)
              free(ipactx->config.authz_data[i]);
          free(ipactx->config.authz_data);
      }

      ipactx->config.authz_data = authz_data_list;
  } else if (ret != ENOENT2)
      goto done;

  /* Success! */
  ipactx->config.last_update = time(NULL((void*)0));
  ret = 0;

302done:
  ldap_value_free_len(vals);
  ldap_msgfree(res);
  free(base);
  return ret;
307}

309const struct ipadb_global_config *
310ipadb_get_global_config(struct ipadb_context *ipactx)
311{
  time_t now = 0;
  int ret;

  if (time(&now) != (time_t)-1 &&
      now - ipactx->config.last_update > IPADB_GLOBAL_CONFIG_CACHE_TIME60) {
      if (!ipactx->lcontext) {
          ret = ipadb_get_connection(ipactx);
          if (ret != 0)
              return NULL((void*)0);
      }
      ret = ipadb_load_global_config(ipactx);
      if (ret != 0)
          return NULL((void*)0);
  }

  return &ipactx->config;
328}

330int ipadb_get_enc_salt_types(struct ipadb_context *ipactx,
                           LDAPMessage *entry, char *attr,
                           krb5_key_salt_tuple **enc_salt_types,
                           int *n_enc_salt_types)
334{
  struct berval **vals = NULL((void*)0);
  char **cvals = NULL((void*)0);
  int c = 0;
  int i;
  int ret = 0;
  krb5_key_salt_tuple *kst;
  int n_kst;

  vals = ldap_get_values_len(ipactx->lcontext, entry, attr);
  if (!vals || !vals[0]) {
40
←
Assuming 'vals' is non-null→
41
←
Assuming the condition is false→
42
←
Taking false branch→
      goto done;
  }

  for (c = 0; vals[c]; c++) /* count */ ;
43
←
Loop condition is true.  Entering loop body→
44
←
Loop condition is false. Execution continues on line 349→
  cvals = calloc(c, sizeof(char *));
45
←
Value assigned to 'cvals'→
  if (!cvals) {
46
←
Assuming 'cvals' is null→
47
←
Assuming pointer value is null→
48
←
Taking true branch→
      ret = ENOMEM12;
      goto done;
49
←
Control jumps to line 377→
  }
  for (i = 0; i < c; i++) {
      cvals[i] = strndup(vals[i]->bv_val, vals[i]->bv_len);
      if (!cvals[i]) {
          ret = ENOMEM12;
          goto done;
      }
  }

  ret = parse_bval_key_salt_tuples(ipactx->kcontext,
                                   (const char * const *)cvals, c,
                                   &kst, &n_kst);
  if (ret) {
      goto done;
  }

  if (*enc_salt_types) {
      free(*enc_salt_types);
  }

  *enc_salt_types = kst;
  *n_enc_salt_types = n_kst;

376done:
  ldap_value_free_len(vals);
  for (i = 0; i49.1
'i' is < 'c'
 < c && cvals[i]; i++) {
50
←
Array access (from variable 'cvals') results in a null pointer dereference
      free(cvals[i]);
  }
  free(cvals);
  return ret;
383}

385int ipadb_get_connection(struct ipadb_context *ipactx)
386{
  struct timeval tv = { 5, 0 };
  LDAPMessage *res = NULL((void*)0);
  LDAPMessage *first;
  int ret;
  int v3;

  if (!ipactx->uri) {
21
←
Assuming field 'uri' is non-null→
22
←
Taking false branch→
      return EINVAL22;
  }

  /* free existing conneciton if any */
  if (ipactx->lcontext) {
23
←
Assuming field 'lcontext' is null→
24
←
Taking false branch→
      ldap_unbind_ext_s(ipactx->lcontext, NULL((void*)0), NULL((void*)0));
      ipactx->lcontext = NULL((void*)0);
  }

  ret = ldap_initialize(&ipactx->lcontext, ipactx->uri);
  if (ret != LDAP_SUCCESS0x00) {
25
←
Assuming 'ret' is equal to LDAP_SUCCESS→
26
←
Taking false branch→
      goto done;
  }

  /* make sure we talk LDAPv3 */
  v3 = LDAP_VERSION33;
  ret = ldap_set_option(ipactx->lcontext, LDAP_OPT_PROTOCOL_VERSION0x0011, &v3);
  if (ret != LDAP_OPT_SUCCESS0) {
27
←
Assuming 'ret' is equal to LDAP_OPT_SUCCESS→
28
←
Taking false branch→
      goto done;
  }

  ret = ldap_set_option(ipactx->lcontext,  LDAP_OPT_NETWORK_TIMEOUT0x5005, &tv);
  if (ret != LDAP_OPT_SUCCESS0) {
29
←
Assuming 'ret' is equal to LDAP_OPT_SUCCESS→
30
←
Taking false branch→
      goto done;
  }

  ret = ldap_set_option(ipactx->lcontext,  LDAP_OPT_TIMEOUT0x5002, &tv);
  if (ret != LDAP_OPT_SUCCESS0) {
31
←
Assuming 'ret' is equal to LDAP_OPT_SUCCESS→
32
←
Taking false branch→
      goto done;
  }

  ret = ldap_sasl_bind_s(ipactx->lcontext,
                         NULL((void*)0), "EXTERNAL",
                         NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0));
  if (ret != LDAP_SUCCESS0x00) {
33
←
Assuming 'ret' is equal to LDAP_SUCCESS→
34
←
Taking false branch→
      goto done;
  }

  /* TODO: search rootdse */

  ret = ipadb_simple_search(ipactx,
                            ipactx->realm_base, LDAP_SCOPE_BASE((ber_int_t) 0x0000),
                            "(objectclass=*)", NULL((void*)0), &res);
  if (ret) {
35
←
Assuming 'ret' is 0→
36
←
Taking false branch→
      goto done;
  }

  first = ldap_first_entry(ipactx->lcontext, res);
  if (!first) {
37
←
Assuming 'first' is non-null→
38
←
Taking false branch→
      goto done;
  }

  /* defaults first, this is used to tell what default enc:salts to use
   * for kadmin password changes */
  ret = ipadb_get_enc_salt_types(ipactx, first,  "krbDefaultEncSaltTypes",
39
←
Calling 'ipadb_get_enc_salt_types'→
                                 &ipactx->def_encs, &ipactx->n_def_encs);
  if (ret) {
      goto done;
  }

  /* supported enc salt types, use to tell kadmin what to accept
   * but also to detect if kadmin is requesting the default set */
  ret = ipadb_get_enc_salt_types(ipactx, first, "krbSupportedEncSaltTypes",
                                 &ipactx->supp_encs, &ipactx->n_supp_encs);
  if (ret) {
      goto done;
  }

  /* get additional options */
  ret = ipadb_load_global_config(ipactx);
  if (ret) {
      goto done;
  }

  /* get adtrust options using default refresh interval */
  ret = ipadb_reinit_mspac(ipactx, false0);
  if (ret && ret != ENOENT2) {
      /* TODO: log that there is an issue with adtrust settings */
      if (ipactx->lcontext == NULL((void*)0)) {
          /* for some reason ldap connection was reset in ipadb_reinit_mspac
           * and is no longer established => failure of ipadb_get_connection
           */
          goto done;
      }
  }

  ret = 0;

482done:
  ldap_msgfree(res);

  if (ret) {
      if (ipactx->lcontext) {
          ldap_unbind_ext_s(ipactx->lcontext, NULL((void*)0), NULL((void*)0));
          ipactx->lcontext = NULL((void*)0);
      }
      if (ret == LDAP_SERVER_DOWN(-1)) {
          return ETIMEDOUT110;
      }
      return EIO5;
  }

  return 0;
497}

499static krb5_principal ipadb_create_local_tgs(krb5_context kcontext,
                                           struct ipadb_context *ipactx)
501{
  krb5_principal tgtp;
  unsigned int length = strlen(ipactx->realm);
  krb5_error_code kerr = 0;

  kerr = krb5_build_principal_ext(kcontext, &tgtp,
                                  length,
                                  ipactx->realm,
                                  KRB5_TGS_NAME_SIZE6,
                                  KRB5_TGS_NAME"krbtgt",
                                  length,
                                  ipactx->realm, 0);
  if (kerr != 0) {
      return NULL((void*)0);
  }

  return tgtp;
518}

520/* INTERFACE */

522static krb5_error_code ipadb_init_library(void)
523{
  return 0;
525}

527static krb5_error_code ipadb_fini_library(void)
528{
  return 0;
530}

532static krb5_error_code ipadb_init_module(krb5_context kcontext,
                                       char *conf_section,
                                       char **db_args, int mode)
535{
  struct ipadb_context *ipactx;
  krb5_error_code kerr;
  int ret;
  int i;
  struct utsname uname_data;

  /* make sure the context is freed to avoid leaking it */
  ipactx = ipadb_get_context(kcontext);
  ipadb_context_free(kcontext, &ipactx);

  ipactx = calloc(1, sizeof(struct ipadb_context));
  if (!ipactx) {
2
←
Assuming 'ipactx' is non-null→
3
←
Taking false branch→
      return ENOMEM12;
  }
  ipactx->magic = IPA_CONTEXT_MAGIC0x0c027ea7;

  /* only check for unsupported 'temporary' value for now */
  for (i = 0; db_args != NULL((void*)0) && db_args[i] != NULL((void*)0); i++) {
4
←
Assuming 'db_args' is equal to NULL→

      if (strncmp(db_args[i], IPA_SETUP"ipa-setup-override-restrictions", sizeof(IPA_SETUP"ipa-setup-override-restrictions")) == 0) {
          ipactx->override_restrictions = true1;
      }

      if (strncmp(db_args[i], "temporary", 9) == 0) {
          krb5_set_error_message(kcontext, EINVAL22,
                                 "Plugin requires -update argument!");
          ret = EINVAL22;
          goto fail;
      }
  }

  ipactx->kcontext = kcontext;

  kerr = krb5_get_default_realm(kcontext, &ipactx->realm);
  if (kerr != 0) {
5
←
Assuming 'kerr' is equal to 0→
6
←
Taking false branch→
      ret = EINVAL22;
      goto fail;
  }

  ipactx->uri = ipadb_realm_to_ldapi_uri(ipactx->realm);
  if (!ipactx->uri) {
7
←
Assuming field 'uri' is non-null→
8
←
Taking false branch→
      ret = ENOMEM12;
      goto fail;
  }

  ipactx->local_tgs = ipadb_create_local_tgs(kcontext, ipactx);
  if (!ipactx->local_tgs) {
9
←
Assuming field 'local_tgs' is non-null→
10
←
Taking false branch→
      ret = ENOMEM12;
      goto fail;
  }

  ipactx->base = ipadb_get_base_from_realm(kcontext);
  if (!ipactx->base10.1
Field 'base' is non-null
) {
11
←
Taking false branch→
      ret = ENOMEM12;
      goto fail;
  }

  ret = asprintf(&ipactx->realm_base, "cn=%s,cn=kerberos,%s",
                                      ipactx->realm, ipactx->base);
  if (ret == -1) {
12
←
Assuming the condition is false→
13
←
Taking false branch→
      ret = ENOMEM12;
      goto fail;
  }

  ret = asprintf(&ipactx->accounts_base, "cn=accounts,%s", ipactx->base);
  if (ret == -1) {
14
←
Assuming the condition is false→
15
←
Taking false branch→
      ret = ENOMEM12;
      goto fail;
  }

  ret = uname(&uname_data);
  if (ret) {
16
←
Assuming 'ret' is 0→
17
←
Taking false branch→
      ret = EINVAL22;
      goto fail;
  }

  ipactx->kdc_hostname = strdup(uname_data.nodename);
  if (!ipactx->kdc_hostname) {
18
←
Assuming field 'kdc_hostname' is non-null→
19
←
Taking false branch→
      ret = ENOMEM12;
      goto fail;
  }

  ret = ipadb_get_connection(ipactx);
20
←
Calling 'ipadb_get_connection'→
  if (ret != 0) {
      /* Not a fatal failure, as the LDAP server may be temporarily down. */
      krb5_klog_syslog(LOG_INFO6,
                       "Didn't connect to LDAP on startup: %d", ret);
  }

  kerr = krb5_db_set_context(kcontext, ipactx);
  if (kerr != 0) {
      ret = EACCES13;
      goto fail;
  }

  return 0;

633fail:
  ipadb_context_free(kcontext, &ipactx);
  return ret;
636}

638static krb5_error_code ipadb_fini_module(krb5_context kcontext)
639{
  struct ipadb_context *ipactx;

  ipactx = ipadb_get_context(kcontext);
  ipadb_context_free(kcontext, &ipactx);
  talloc_free(talloc_autofree_context())_talloc_free(talloc_autofree_context(), "ipa_kdb.c" ":" "644"
);

  return 0;
647}

649static krb5_error_code ipadb_create(krb5_context kcontext,
                                  char *conf_section,
                                  char **db_args)
652{
  return ipadb_init_module(kcontext, conf_section, db_args, 0);
1
Calling 'ipadb_init_module'→
654}

656static krb5_error_code ipadb_get_age(krb5_context kcontext,
                                   char *db_name, time_t *age)
658{
  /* just return the current time for now,
   * until we can use persistent searches and have
   * a better estimate */
  *age = time(NULL((void*)0));
  return 0;
664}

666/* KDB Virtual Table */

668/* We explicitly want to keep different ABI tables below separate. */
669/* Do not merge them together. Older ABI does not need to be updated */

671#if (KRB5_KDB_DAL_MAJOR_VERSION8 == 6) && !defined(HAVE_KDB_FREEPRINCIPAL_EDATA1)
672kdb_vftabl kdb_function_table = {
  .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION8,
  .min_ver = 0,
  .init_library = ipadb_init_library,
  .fini_library = ipadb_fini_library,
  .init_module = ipadb_init_module,
  .fini_module = ipadb_fini_module,
  .create = ipadb_create,
  .get_age = ipadb_get_age,
  .get_principal = ipadb_get_principal,
  .put_principal = ipadb_put_principal,
  .delete_principal = ipadb_delete_principal,
  .iterate = ipadb_iterate,
  .create_policy = ipadb_create_pwd_policy,
  .get_policy = ipadb_get_pwd_policy,
  .put_policy = ipadb_put_pwd_policy,
  .iter_policy = ipadb_iterate_pwd_policy,
  .delete_policy = ipadb_delete_pwd_policy,
  .fetch_master_key = ipadb_fetch_master_key,
  .store_master_key_list = ipadb_store_master_key_list,
  .change_pwd = ipadb_change_pwd,
  .sign_authdata = ipadb_sign_authdata,
  .check_transited_realms = ipadb_check_transited_realms,
  .check_policy_as = ipadb_check_policy_as,
  .audit_as_req = ipadb_audit_as_req,
  .check_allowed_to_delegate = ipadb_check_allowed_to_delegate
698};
699#endif

701#if ((KRB5_KDB_DAL_MAJOR_VERSION8 == 6) || \
   (KRB5_KDB_DAL_MAJOR_VERSION8 == 7)) && \
  defined(HAVE_KDB_FREEPRINCIPAL_EDATA1)
704kdb_vftabl kdb_function_table = {
  .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION8,
  .min_ver = 1,
  .init_library = ipadb_init_library,
  .fini_library = ipadb_fini_library,
  .init_module = ipadb_init_module,
  .fini_module = ipadb_fini_module,
  .create = ipadb_create,
  .get_age = ipadb_get_age,
  .get_principal = ipadb_get_principal,
  .put_principal = ipadb_put_principal,
  .delete_principal = ipadb_delete_principal,
  .iterate = ipadb_iterate,
  .create_policy = ipadb_create_pwd_policy,
  .get_policy = ipadb_get_pwd_policy,
  .put_policy = ipadb_put_pwd_policy,
  .iter_policy = ipadb_iterate_pwd_policy,
  .delete_policy = ipadb_delete_pwd_policy,
  .fetch_master_key = ipadb_fetch_master_key,
  .store_master_key_list = ipadb_store_master_key_list,
  .change_pwd = ipadb_change_pwd,
  .sign_authdata = ipadb_sign_authdata,
  .check_transited_realms = ipadb_check_transited_realms,
  .check_policy_as = ipadb_check_policy_as,
  .audit_as_req = ipadb_audit_as_req,
  .check_allowed_to_delegate = ipadb_check_allowed_to_delegate,
  /* The order is important, DAL version 6.1 added
   * the free_principal_e_data callback */
  .free_principal_e_data = ipadb_free_principal_e_data,
733};
734#endif

736#if (KRB5_KDB_DAL_MAJOR_VERSION8 == 8)
737/* Version 8 adds several arguments here.  However, if we want to actually use
* them in mspac, we really ought to drop support for older DAL versions. */
739static inline krb5_error_code
740stub_sign_authdata(krb5_context context, unsigned int flags,
                 krb5_const_principal client_princ,
                 krb5_const_principal server_princ, krb5_db_entry *client,
                 krb5_db_entry *server, krb5_db_entry *header_server,
                 krb5_db_entry *local_tgt, krb5_keyblock *client_key,
                 krb5_keyblock *server_key, krb5_keyblock *header_key,
                 krb5_keyblock *local_tgt_key, krb5_keyblock *session_key,
                 krb5_timestamp authtime, krb5_authdata **tgt_auth_data,
                 void *ad_info, krb5_data ***auth_indicators,
                 krb5_authdata ***signed_auth_data)
750{
  krb5_db_entry *krbtgt = header_server ? header_server : local_tgt;
  krb5_keyblock *krbtgt_key = header_key ? header_key : local_tgt_key;

  if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION0x00000200) {
      client = header_server;
      krbtgt = local_tgt;
      krbtgt_key = local_tgt_key;
  }

  return ipadb_sign_authdata(context, flags, client_princ, client, server,
                             krbtgt, client_key, server_key, krbtgt_key,
                             session_key, authtime, tgt_auth_data,
                             signed_auth_data);
764}

766kdb_vftabl kdb_function_table = {
  .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION8,
  .min_ver = 0,
  .init_library = ipadb_init_library,
  .fini_library = ipadb_fini_library,
  .init_module = ipadb_init_module,
  .fini_module = ipadb_fini_module,
  .create = ipadb_create,
  .get_age = ipadb_get_age,
  .get_principal = ipadb_get_principal,
  .put_principal = ipadb_put_principal,
  .delete_principal = ipadb_delete_principal,
  .iterate = ipadb_iterate,
  .create_policy = ipadb_create_pwd_policy,
  .get_policy = ipadb_get_pwd_policy,
  .put_policy = ipadb_put_pwd_policy,
  .iter_policy = ipadb_iterate_pwd_policy,
  .delete_policy = ipadb_delete_pwd_policy,
  .fetch_master_key = ipadb_fetch_master_key,
  .store_master_key_list = ipadb_store_master_key_list,
  .change_pwd = ipadb_change_pwd,
  .sign_authdata = stub_sign_authdata,
  .check_transited_realms = ipadb_check_transited_realms,
  .check_policy_as = ipadb_check_policy_as,
  .audit_as_req = ipadb_audit_as_req,
  .check_allowed_to_delegate = ipadb_check_allowed_to_delegate,
  .free_principal_e_data = ipadb_free_principal_e_data,
  .get_s4u_x509_principal = NULL((void*)0),
  .allowed_to_delegate_from = NULL((void*)0),
  .get_authdata_info = NULL((void*)0),
  .free_authdata_info = NULL((void*)0),
797};
798#endif

800#if (KRB5_KDB_DAL_MAJOR_VERSION8 != 6) && \
  (KRB5_KDB_DAL_MAJOR_VERSION8 != 7) && \
  (KRB5_KDB_DAL_MAJOR_VERSION8 != 8)
803#error unsupported DAL major version
804#endif