Changeset 745 for trunk/server/source4/heimdal/kdc/kx509.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/heimdal/kdc/kx509.c (modified) (14 diffs)

trunk/server/source4/heimdal/kdc/kx509.c

@@ -144 +144 @@
                   krb5_data *certificate)
 {
-    hx509_context hxctx = NULL;
     hx509_ca_tbs tbs = NULL;
     hx509_env env = NULL;
@@ -156 +155 @@
     }
 
-    ret = hx509_context_init(&hxctx);
-    if (ret)
-        goto out;
-
-    ret = hx509_env_add(hxctx, &env, "principal-name",
+    ret = hx509_env_add(context->hx509ctx, &env, "principal-name",
                         krb5_principal_get_comp_string(context, principal, 0));
     if (ret)
@@ -169 +164 @@
         hx509_query *q;
 
-        ret = hx509_certs_init(hxctx, config->kx509_ca, 0,
+        ret = hx509_certs_init(context->hx509ctx, config->kx509_ca, 0,
                                NULL, &certs);
         if (ret) {
@@ -176 +171 @@
             goto out;
         }
-        ret = hx509_query_alloc(hxctx, &q);
+        ret = hx509_query_alloc(context->hx509ctx, &q);
         if (ret) {
             hx509_certs_free(&certs);
@@ -185 +180 @@
         hx509_query_match_option(q, HX509_QUERY_OPTION_KU_KEYCERTSIGN);
 
-        ret = hx509_certs_find(hxctx, certs, q, &signer);
-        hx509_query_free(hxctx, q);
+        ret = hx509_certs_find(context->hx509ctx, certs, q, &signer);
+        hx509_query_free(context->hx509ctx, q);
         hx509_certs_free(&certs);
         if (ret) {
@@ -195 +190 @@
     }
 
-    ret = hx509_ca_tbs_init(hxctx, &tbs);
+    ret = hx509_ca_tbs_init(context->hx509ctx, &tbs);
     if (ret)
         goto out;
@@ -215 +210 @@
         spki.algorithm.parameters = &any;
 
-        ret = hx509_ca_tbs_set_spki(hxctx, tbs, &spki);
+        ret = hx509_ca_tbs_set_spki(context->hx509ctx, tbs, &spki);
         der_free_oid(&spki.algorithm.algorithm);
         if (ret)
@@ -225 +220 @@
         hx509_cert template;
 
-        ret = hx509_certs_init(hxctx, config->kx509_template, 0,
+        ret = hx509_certs_init(context->hx509ctx, config->kx509_template, 0,
                                NULL, &certs);
         if (ret) {
@@ -232 +227 @@
             goto out;
         }
-        ret = hx509_get_one_cert(hxctx, certs, &template);
+        ret = hx509_get_one_cert(context->hx509ctx, certs, &template);
         hx509_certs_free(&certs);
         if (ret) {
@@ -239 +234 @@
             goto out;
         }
-        ret = hx509_ca_tbs_set_template(hxctx, tbs,
+        ret = hx509_ca_tbs_set_template(context->hx509ctx, tbs,
                                         HX509_CA_TEMPLATE_SUBJECT|
                                         HX509_CA_TEMPLATE_KU|
@@ -249 +244 @@
     }
 
-    hx509_ca_tbs_set_notAfter(hxctx, tbs, endtime);
-
-    hx509_ca_tbs_subject_expand(hxctx, tbs, env);
+    hx509_ca_tbs_set_notAfter(context->hx509ctx, tbs, endtime);
+
+    hx509_ca_tbs_subject_expand(context->hx509ctx, tbs, env);
     hx509_env_free(&env);
 
-    ret = hx509_ca_sign(hxctx, tbs, signer, &cert);
+    ret = hx509_ca_sign(context->hx509ctx, tbs, signer, &cert);
     hx509_cert_free(signer);
     if (ret)
@@ -261 +256 @@
     hx509_ca_tbs_free(&tbs);
 
-    ret = hx509_cert_binary(hxctx, cert, certificate);
+    ret = hx509_cert_binary(context->hx509ctx, cert, certificate);
     hx509_cert_free(cert);
     if (ret)
         goto out;
                 
-    hx509_context_free(&hxctx);
-
     return 0;
 out:
@@ -276 +269 @@
     if (signer)
         hx509_cert_free(signer);
-    if (hxctx)
-        hx509_context_free(&hxctx);
     krb5_set_error_message(context, ret, "cert creation failed");
     return ret;
@@ -355 +346 @@
         krb5_free_principal(context, principal);
         if (ret != TRUE) {
+            char *expected, *used;
+
+            ret = krb5_unparse_name(context, sprincipal, &expected);
+            if (ret)
+                goto out;
+            ret = krb5_unparse_name(context, principal, &used);
+            if (ret) {
+                krb5_xfree(expected);
+                goto out;
+            }
+            
             ret = KRB5KDC_ERR_SERVER_NOMATCH;
             krb5_set_error_message(context, ret,
-                                   "User %s used wrong Kx509 service principal",
-                                   cname);
+                                   "User %s used wrong Kx509 service "
+                                   "principal, expected: %s, used %s",
+                                   cname, expected, used);
+            krb5_xfree(expected);
+            krb5_xfree(used);
             goto out;
         }