From 20245fc86b6f929f721435b3a0eaef71cf39297d Mon Sep 17 00:00:00 2001
From: Nalin Dahyabhai <nalin@dahyabhai.net>
Date: Wed, 5 Oct 2011 18:20:02 -0400
Subject: [PATCH 147/150] - return typed-data as a preauth-data array rather
 than an edata blob

---
 src/plugins/preauth/pkinit/pkinit_crypto_nss.c |   90 ++++++++++++++++--------
 1 files changed, 60 insertions(+), 30 deletions(-)

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
index 5d52f77..ca7e534 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
@@ -3227,7 +3227,7 @@ pkinit_create_td_dh_parameters(krb5_context context,
                                pkinit_plg_crypto_context plg_cryptoctx,
                                pkinit_req_crypto_context req_cryptoctx,
                                pkinit_identity_crypto_context id_cryptoctx,
-                               pkinit_plg_opts *opts, krb5_data **edata)
+                               pkinit_plg_opts *opts, krb5_pa_data ***pa_data)
 {
     struct domain_parameters *params;
     SECItem tmp, *oid;
@@ -3236,10 +3236,11 @@ pkinit_create_td_dh_parameters(krb5_context context,
     const krb5_algorithm_identifier *ids[(sizeof(id) / sizeof(id[0])) + 1];
     unsigned int i, j;
     krb5_data *data;
-    krb5_typed_data typed_datum;
-    const krb5_typed_data *typed_data[2];
+    krb5_pa_data **typed_data;
     krb5_error_code code;
 
+    *pa_data = NULL;
+
     /* Fetch the algorithm OID. */
     oid = get_oid_from_tag(SEC_OID_X942_DIFFIE_HELMAN_KEY);
     if (oid == NULL)
@@ -3274,14 +3275,23 @@ pkinit_create_td_dh_parameters(krb5_context context,
     code = (*k5int_encode_krb5_td_dh_parameters)(ids, &data);
     if (code != 0)
         return code;
-    memset(&typed_datum, 0, sizeof(typed_datum));
-    typed_datum.type = TD_DH_PARAMETERS;
-    typed_datum.length = data->length;
-    typed_datum.data = (unsigned char *) data->data;
-    typed_data[0] = &typed_datum;
+    typed_data = malloc(sizeof(*typed_data) * 2);
+    if (typed_data == NULL) {
+        krb5_free_data(context, data);
+        return ENOMEM;
+    }
+    typed_data[0] = malloc(sizeof(**typed_data));
+    if (typed_data[0] == NULL) {
+        free(typed_data);
+        krb5_free_data(context, data);
+        return ENOMEM;
+    }
+    typed_data[0]->pa_type = TD_DH_PARAMETERS;
+    typed_data[0]->length = data->length;
+    typed_data[0]->contents = (unsigned char *) data->data;
     typed_data[1] = NULL;
-    code = (*k5int_encode_krb5_typed_data)(typed_data, edata);
-    krb5_free_data(context, data);
+    *pa_data = typed_data;
+    free(data);
     return code;
 }
 
@@ -3328,18 +3338,19 @@ pkinit_create_td_invalid_certificate(krb5_context context,
                                      pkinit_plg_crypto_context plg_cryptoctx,
                                      pkinit_req_crypto_context req_cryptoctx,
                                      pkinit_identity_crypto_context
-                                     id_cryptoctx, krb5_data **edata)
+                                     id_cryptoctx, krb5_pa_data ***pa_data)
 {
     CERTCertificate *invalid;
     krb5_external_principal_identifier id;
     const krb5_external_principal_identifier *ids[2];
     struct issuer_and_serial_number isn;
     krb5_data *data;
-    krb5_typed_data typed_datum;
     SECItem item;
-    const krb5_typed_data *typed_data[2];
+    krb5_pa_data **typed_data;
     krb5_error_code code;
 
+    *pa_data = NULL;
+
     /* We didn't trust the peer's certificate.  FIXME: or was it a
      * certificate that was somewhere in its certifying chain? */
     if (req_cryptoctx->peer_cert == NULL)
@@ -3369,14 +3380,23 @@ pkinit_create_td_invalid_certificate(krb5_context context,
     code = (*k5int_encode_krb5_td_trusted_certifiers)(ids, &data);
     if (code != 0)
         return code;
-    memset(&typed_datum, 0, sizeof(typed_datum));
-    typed_datum.type = TD_INVALID_CERTIFICATES;
-    typed_datum.length = data->length;
-    typed_datum.data = (unsigned char *) data->data;
-    typed_data[0] = &typed_datum;
+    typed_data = malloc(sizeof(*typed_data) * 2);
+    if (typed_data == NULL) {
+        krb5_free_data(context, data);
+        return ENOMEM;
+    }
+    typed_data[0] = malloc(sizeof(**typed_data));
+    if (typed_data[0] == NULL) {
+        free(typed_data);
+        krb5_free_data(context, data);
+        return ENOMEM;
+    }
+    typed_data[0]->pa_type = TD_INVALID_CERTIFICATES;
+    typed_data[0]->length = data->length;
+    typed_data[0]->contents = (unsigned char *) data->data;
     typed_data[1] = NULL;
-    code = (*k5int_encode_krb5_typed_data)(typed_data, edata);
-    krb5_free_data(context, data);
+    *pa_data = typed_data;
+    free(data);
     return code;
 }
 
@@ -3386,15 +3406,14 @@ pkinit_create_td_trusted_certifiers(krb5_context context,
                                     pkinit_plg_crypto_context plg_cryptoctx,
                                     pkinit_req_crypto_context req_cryptoctx,
                                     pkinit_identity_crypto_context
-                                    id_cryptoctx, krb5_data **edata)
+                                    id_cryptoctx, krb5_pa_data ***pa_data)
 {
     const krb5_external_principal_identifier **ids;
     krb5_external_principal_identifier *id;
     struct issuer_and_serial_number isn;
     krb5_data *data;
-    krb5_typed_data typed_datum;
     SECItem item;
-    const krb5_typed_data *typed_data[2];
+    krb5_pa_data **typed_data;
     krb5_error_code code;
     int i;
     unsigned int trustf;
@@ -3405,6 +3424,8 @@ pkinit_create_td_trusted_certifiers(krb5_context context,
     CERTCertList *sclist, *clist;
     CERTCertListNode *node;
 
+    *pa_data = NULL;
+
     /* Build the list of trusted roots. */
     clist = CERT_NewCertList();
     if (clist == NULL)
@@ -3520,14 +3541,23 @@ pkinit_create_td_trusted_certifiers(krb5_context context,
     CERT_DestroyCertList(clist);
     if (code != 0)
         return code;
-    memset(&typed_datum, 0, sizeof(typed_datum));
-    typed_datum.type = TD_TRUSTED_CERTIFIERS;
-    typed_datum.length = data->length;
-    typed_datum.data = (unsigned char *) data->data;
-    typed_data[0] = &typed_datum;
+    typed_data = malloc(sizeof(*typed_data) * 2);
+    if (typed_data == NULL) {
+        krb5_free_data(context, data);
+        return ENOMEM;
+    }
+    typed_data[0] = malloc(sizeof(**typed_data));
+    if (typed_data[0] == NULL) {
+        free(typed_data);
+        krb5_free_data(context, data);
+        return ENOMEM;
+    }
+    typed_data[0]->pa_type = TD_TRUSTED_CERTIFIERS;
+    typed_data[0]->length = data->length;
+    typed_data[0]->contents = (unsigned char *) data->data;
     typed_data[1] = NULL;
-    code = (*k5int_encode_krb5_typed_data)(typed_data, edata);
-    krb5_free_data(context, data);
+    *pa_data = typed_data;
+    free(data);
     return code;
 }
 
-- 
1.7.6.4

