gensec: Remove mem_ctx from calls that do not return memory

Signed-off-by: Andrew Tridgell <tridge@samba.org>

diff --git a/auth/gensec/gensec.c b/auth/gensec/gensec.c
index 390913d01b682c9aafd41cf8064e1d76dc1cc8a1..4736e73d5a9f8fcfbbdda5997f3fb32d2e763fe5 100644 (file)
--- a/auth/gensec/gensec.c
+++ b/auth/gensec/gensec.c
@@ -31,7 +31,6 @@
   wrappers for the gensec function pointers
 */
 _PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
-                             TALLOC_CTX *mem_ctx,
                              uint8_t *data, size_t length,
                              const uint8_t *whole_pdu, size_t pdu_length,
                              const DATA_BLOB *sig)
@@ -43,14 +42,13 @@ _PUBLIC_ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       return gensec_security->ops->unseal_packet(gensec_security, mem_ctx,
+       return gensec_security->ops->unseal_packet(gensec_security,
                                                   data, length,
                                                   whole_pdu, pdu_length,
                                                   sig);
 }
 
 _PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
-                            TALLOC_CTX *mem_ctx,
                             const uint8_t *data, size_t length,
                             const uint8_t *whole_pdu, size_t pdu_length,
                             const DATA_BLOB *sig)
@@ -62,7 +60,7 @@ _PUBLIC_ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       return gensec_security->ops->check_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
+       return gensec_security->ops->check_packet(gensec_security, data, length, whole_pdu, pdu_length, sig);
 }
 
 _PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,

diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h
index b8974194739d870cd104298a7bb039fe02d4e587..852618c1af4260f74727b0ad77db9b8612e16fdc 100644 (file)
--- a/auth/gensec/gensec.h
+++ b/auth/gensec/gensec.h
@@ -104,11 +104,11 @@ struct gensec_security_ops {
        size_t   (*sig_size)(struct gensec_security *gensec_security, size_t data_size);
        size_t   (*max_input_size)(struct gensec_security *gensec_security);
        size_t   (*max_wrapped_size)(struct gensec_security *gensec_security);
-       NTSTATUS (*check_packet)(struct gensec_security *gensec_security, TALLOC_CTX *sig_mem_ctx,
+       NTSTATUS (*check_packet)(struct gensec_security *gensec_security,
                                 const uint8_t *data, size_t length,
                                 const uint8_t *whole_pdu, size_t pdu_length,
                                 const DATA_BLOB *sig);
-       NTSTATUS (*unseal_packet)(struct gensec_security *gensec_security, TALLOC_CTX *sig_mem_ctx,
+       NTSTATUS (*unseal_packet)(struct gensec_security *gensec_security,
                                  uint8_t *data, size_t length,
                                  const uint8_t *whole_pdu, size_t pdu_length,
                                  const DATA_BLOB *sig);
@@ -241,12 +241,10 @@ struct cli_credentials *gensec_get_credentials(struct gensec_security *gensec_se
 NTSTATUS gensec_init(void);
 size_t gensec_max_input_size(struct gensec_security *gensec_security);
 NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
-                             TALLOC_CTX *mem_ctx,
                              uint8_t *data, size_t length,
                              const uint8_t *whole_pdu, size_t pdu_length,
                              const DATA_BLOB *sig);
 NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
-                            TALLOC_CTX *mem_ctx,
                             const uint8_t *data, size_t length,
                             const uint8_t *whole_pdu, size_t pdu_length,
                             const DATA_BLOB *sig);

diff --git a/libcli/auth/schannel_proto.h b/libcli/auth/schannel_proto.h
index e454c3da530bdb5d5f4ca3f51ba0e9f62356a995..e3aeb5a9bcd45340d04f057456a8ae66d82e9e59 100644 (file)
--- a/libcli/auth/schannel_proto.h
+++ b/libcli/auth/schannel_proto.h
@@ -29,7 +29,6 @@ struct tdb_wrap *open_schannel_session_store(TALLOC_CTX *mem_ctx,
                                             const char *private_dir);
 
 NTSTATUS netsec_incoming_packet(struct schannel_state *state,
-                               TALLOC_CTX *mem_ctx,
                                bool do_unseal,
                                uint8_t *data, size_t length,
                                const DATA_BLOB *sig);

diff --git a/libcli/auth/schannel_sign.c b/libcli/auth/schannel_sign.c
index eb605f4b07afaeee338aeeb4c445daaca7dd3e51..29a97b92820020c4bf573ce4d6b02306705f0e2b 100644 (file)
--- a/libcli/auth/schannel_sign.c
+++ b/libcli/auth/schannel_sign.c
@@ -139,7 +139,6 @@ static void netsec_do_sign(struct schannel_state *state,
 }
 
 NTSTATUS netsec_incoming_packet(struct schannel_state *state,
-                               TALLOC_CTX *mem_ctx,
                                bool do_unseal,
                                uint8_t *data, size_t length,
                                const DATA_BLOB *sig)

diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c
index 7520d767ba1f9d60ba5f691e176fd33d32218cbe..b53587ddb38d41b1f4d5f79697f33c0e949d40f2 100644 (file)
--- a/source3/librpc/rpc/dcerpc_helpers.c
+++ b/source3/librpc/rpc/dcerpc_helpers.c
@@ -553,7 +553,7 @@ static NTSTATUS get_schannel_auth_footer(TALLOC_CTX *mem_ctx,
        case DCERPC_AUTH_LEVEL_PRIVACY:
                /* Data portion is encrypted. */
                return netsec_incoming_packet(auth_state,
-                                               mem_ctx, true,
+                                               true,
                                                data->data,
                                                data->length,
                                                auth_token);
@@ -561,7 +561,7 @@ static NTSTATUS get_schannel_auth_footer(TALLOC_CTX *mem_ctx,
        case DCERPC_AUTH_LEVEL_INTEGRITY:
                /* Data is signed. */
                return netsec_incoming_packet(auth_state,
-                                               mem_ctx, false,
+                                               false,
                                                data->data,
                                                data->length,
                                                auth_token);

diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index 6ecd29bf340ce09ba8ecc6a8ac764f4963a3d9ef..4dd809856ceffe6bbc1716d18a2dc19368a0da91 100644 (file)
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -1038,7 +1038,6 @@ static NTSTATUS gensec_gssapi_seal_packet(struct gensec_security *gensec_securit
 }
 
 static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_security, 
-                                           TALLOC_CTX *mem_ctx, 
                                            uint8_t *data, size_t length, 
                                            const uint8_t *whole_pdu, size_t pdu_length,
                                            const DATA_BLOB *sig)
@@ -1053,7 +1052,7 @@ static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_secur
 
        dump_data_pw("gensec_gssapi_unseal_packet: sig\n", sig->data, sig->length);
 
-       in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
+       in = data_blob_talloc(gensec_security, NULL, sig->length + length);
 
        memcpy(in.data, sig->data, sig->length);
        memcpy(in.data + sig->length, data, length);
@@ -1067,9 +1066,12 @@ static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_secur
                              &output_token, 
                              &conf_state,
                              &qop_state);
+       talloc_free(in.data);
        if (GSS_ERROR(maj_stat)) {
+               char *error_string = gssapi_error_string(NULL, maj_stat, min_stat, gensec_gssapi_state->gss_oid);
                DEBUG(1, ("gensec_gssapi_unseal_packet: GSS UnWrap failed: %s\n", 
-                         gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+                         error_string));
+               talloc_free(error_string);
                return NT_STATUS_ACCESS_DENIED;
        }
 
@@ -1128,7 +1130,6 @@ static NTSTATUS gensec_gssapi_sign_packet(struct gensec_security *gensec_securit
 }
 
 static NTSTATUS gensec_gssapi_check_packet(struct gensec_security *gensec_security, 
-                                          TALLOC_CTX *mem_ctx, 
                                           const uint8_t *data, size_t length, 
                                           const uint8_t *whole_pdu, size_t pdu_length, 
                                           const DATA_BLOB *sig)
@@ -1159,8 +1160,10 @@ static NTSTATUS gensec_gssapi_check_packet(struct gensec_security *gensec_securi
                              &input_token,
                              &qop_state);
        if (GSS_ERROR(maj_stat)) {
-               DEBUG(1, ("GSS VerifyMic failed: %s\n",
-                         gssapi_error_string(mem_ctx, maj_stat, min_stat, gensec_gssapi_state->gss_oid)));
+               char *error_string = gssapi_error_string(NULL, maj_stat, min_stat, gensec_gssapi_state->gss_oid);
+               DEBUG(1, ("GSS VerifyMic failed: %s\n", error_string));
+               talloc_free(error_string);
+
                return NT_STATUS_ACCESS_DENIED;
        }
 

diff --git a/source4/auth/gensec/schannel.c b/source4/auth/gensec/schannel.c
index 2e3f0219e9d6adbaec0482adf96ef1443da79430..8f9aa921a9ba257746185747e075fd2014645f85 100644 (file)
--- a/source4/auth/gensec/schannel.c
+++ b/source4/auth/gensec/schannel.c
@@ -290,7 +290,6 @@ static bool schannel_have_feature(struct gensec_security *gensec_security,
   unseal a packet
 */
 static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
-                                      TALLOC_CTX *mem_ctx,
                                       uint8_t *data, size_t length,
                                       const uint8_t *whole_pdu, size_t pdu_length,
                                       const DATA_BLOB *sig)
@@ -299,7 +298,7 @@ static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
                talloc_get_type(gensec_security->private_data,
                                struct schannel_state);
 
-       return netsec_incoming_packet(state, mem_ctx, true,
+       return netsec_incoming_packet(state, true,
                                      discard_const_p(uint8_t, data),
                                      length, sig);
 }
@@ -308,7 +307,6 @@ static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
   check the signature on a packet
 */
 static NTSTATUS schannel_check_packet(struct gensec_security *gensec_security,
-                                     TALLOC_CTX *mem_ctx,
                                      const uint8_t *data, size_t length,
                                      const uint8_t *whole_pdu, size_t pdu_length,
                                      const DATA_BLOB *sig)
@@ -317,7 +315,7 @@ static NTSTATUS schannel_check_packet(struct gensec_security *gensec_security,
                talloc_get_type(gensec_security->private_data,
                                struct schannel_state);
 
-       return netsec_incoming_packet(state, mem_ctx, false,
+       return netsec_incoming_packet(state, false,
                                      discard_const_p(uint8_t, data),
                                      length, sig);
 }

diff --git a/source4/auth/gensec/spnego.c b/source4/auth/gensec/spnego.c
index 3611d31a236d3162bfcbbc066411e8d6270fb55c..c48e87e8b5866063f775b1da79caef00718e54e7 100644 (file)
--- a/source4/auth/gensec/spnego.c
+++ b/source4/auth/gensec/spnego.c
@@ -96,7 +96,6 @@ static NTSTATUS gensec_spnego_server_start(struct gensec_security *gensec_securi
   wrappers for the spnego_*() functions
 */
 static NTSTATUS gensec_spnego_unseal_packet(struct gensec_security *gensec_security, 
-                                           TALLOC_CTX *mem_ctx, 
                                            uint8_t *data, size_t length, 
                                            const uint8_t *whole_pdu, size_t pdu_length, 
                                            const DATA_BLOB *sig)
@@ -109,14 +108,12 @@ static NTSTATUS gensec_spnego_unseal_packet(struct gensec_security *gensec_secur
        }
        
        return gensec_unseal_packet(spnego_state->sub_sec_security, 
-                                   mem_ctx, 
                                    data, length, 
                                    whole_pdu, pdu_length,
                                    sig); 
 }
 
 static NTSTATUS gensec_spnego_check_packet(struct gensec_security *gensec_security, 
-                                          TALLOC_CTX *mem_ctx, 
                                           const uint8_t *data, size_t length, 
                                           const uint8_t *whole_pdu, size_t pdu_length, 
                                           const DATA_BLOB *sig)
@@ -129,7 +126,6 @@ static NTSTATUS gensec_spnego_check_packet(struct gensec_security *gensec_securi
        }
        
        return gensec_check_packet(spnego_state->sub_sec_security, 
-                                  mem_ctx, 
                                   data, length, 
                                   whole_pdu, pdu_length,
                                   sig);
@@ -922,7 +918,6 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
                if (NT_STATUS_IS_OK(nt_status) && spnego.negTokenTarg.mechListMIC.length > 0) {
                        new_spnego = true;
                        nt_status = gensec_check_packet(spnego_state->sub_sec_security,
-                                                       out_mem_ctx,
                                                        spnego_state->mech_types.data,
                                                        spnego_state->mech_types.length,
                                                        spnego_state->mech_types.data,
@@ -1029,7 +1024,6 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
                        }
                        if (NT_STATUS_IS_OK(nt_status) && spnego.negTokenTarg.mechListMIC.length > 0) {
                                nt_status = gensec_check_packet(spnego_state->sub_sec_security,
-                                                               out_mem_ctx,
                                                                spnego_state->mech_types.data,
                                                                spnego_state->mech_types.length,
                                                                spnego_state->mech_types.data,

diff --git a/source4/auth/ntlmssp/ntlmssp_sign.c b/source4/auth/ntlmssp/ntlmssp_sign.c
index 95466b0407c1553c14d86322ab51a5c755cf9614..72cd1549fefae48729279380436cf51685d494b1 100644 (file)
--- a/source4/auth/ntlmssp/ntlmssp_sign.c
+++ b/source4/auth/ntlmssp/ntlmssp_sign.c
@@ -45,7 +45,6 @@ NTSTATUS gensec_ntlmssp_sign_packet(struct gensec_security *gensec_security,
 }
 
 NTSTATUS gensec_ntlmssp_check_packet(struct gensec_security *gensec_security,
-                                    TALLOC_CTX *sig_mem_ctx,
                                     const uint8_t *data, size_t length,
                                     const uint8_t *whole_pdu, size_t pdu_length,
                                     const DATA_BLOB *sig)
@@ -87,7 +86,6 @@ NTSTATUS gensec_ntlmssp_seal_packet(struct gensec_security *gensec_security,
   wrappers for the ntlmssp_*() functions
 */
 NTSTATUS gensec_ntlmssp_unseal_packet(struct gensec_security *gensec_security,
-                                     TALLOC_CTX *sig_mem_ctx,
                                      uint8_t *data, size_t length,
                                      const uint8_t *whole_pdu, size_t pdu_length,
                                      const DATA_BLOB *sig)

diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 110da57c939be489caa657d34d47a704c112ffdb..496cc0b2a684dd25e0980bbfa27c8c02d68167b9 100644 (file)
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -708,7 +708,6 @@ static NTSTATUS ncacn_pull_request_auth(struct dcecli_connection *c, TALLOC_CTX
        switch (c->security_state.auth_info->auth_level) {
        case DCERPC_AUTH_LEVEL_PRIVACY:
                status = gensec_unseal_packet(c->security_state.generic_state, 
-                                             mem_ctx, 
                                              raw_packet->data + DCERPC_REQUEST_LENGTH,
                                              pkt->u.response.stub_and_verifier.length, 
                                              raw_packet->data,
@@ -721,7 +720,6 @@ static NTSTATUS ncacn_pull_request_auth(struct dcecli_connection *c, TALLOC_CTX
                
        case DCERPC_AUTH_LEVEL_INTEGRITY:
                status = gensec_check_packet(c->security_state.generic_state, 
-                                            mem_ctx, 
                                             pkt->u.response.stub_and_verifier.data, 
                                             pkt->u.response.stub_and_verifier.length, 
                                             raw_packet->data,

diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index 1e6aa24c82097bc2b99265183adbad1138ed9629..0802cd4323de251408a387d778b9e785b35cd2e9 100644 (file)
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -328,7 +328,6 @@ bool dcesrv_auth_request(struct dcesrv_call_state *call, DATA_BLOB *full_packet)
        switch (dce_conn->auth_state.auth_info->auth_level) {
        case DCERPC_AUTH_LEVEL_PRIVACY:
                status = gensec_unseal_packet(dce_conn->auth_state.gensec_security,
-                                             call,
                                              full_packet->data + hdr_size,
                                              pkt->u.request.stub_and_verifier.length, 
                                              full_packet->data,
@@ -341,7 +340,6 @@ bool dcesrv_auth_request(struct dcesrv_call_state *call, DATA_BLOB *full_packet)
 
        case DCERPC_AUTH_LEVEL_INTEGRITY:
                status = gensec_check_packet(dce_conn->auth_state.gensec_security,
-                                            call,
                                             pkt->u.request.stub_and_verifier.data, 
                                             pkt->u.request.stub_and_verifier.length,
                                             full_packet->data,

diff --git a/source4/torture/auth/ntlmssp.c b/source4/torture/auth/ntlmssp.c
index 93529eeb1d2d30a2c4674dd141cf6a2834a20378..c98985c97c3a15d098684f3f7092ea2bd1a8a355 100644 (file)
--- a/source4/torture/auth/ntlmssp.c
+++ b/source4/torture/auth/ntlmssp.c
@@ -78,14 +78,14 @@ static bool torture_ntlmssp_self_check(struct torture_context *tctx)
                                   "data mismatch");
 
        torture_assert_ntstatus_equal(tctx, 
-                                     gensec_ntlmssp_check_packet(gensec_security, gensec_security,
+                                     gensec_ntlmssp_check_packet(gensec_security,
                                                                  data.data, data.length, data.data, data.length, &sig),
                                      NT_STATUS_ACCESS_DENIED, "Check of just signed packet (should fail, wrong end)");
 
        ntlmssp_state->session_key = data_blob(NULL, 0);
 
        torture_assert_ntstatus_equal(tctx, 
-                                     gensec_ntlmssp_check_packet(gensec_security, gensec_security,
+                                     gensec_ntlmssp_check_packet(gensec_security,
                                                                  data.data, data.length, data.data, data.length, &sig),
                                      NT_STATUS_NO_USER_SESSION_KEY, "Check of just signed packet without a session key should fail");
 
@@ -135,14 +135,14 @@ static bool torture_ntlmssp_self_check(struct torture_context *tctx)
                                   "data mismatch");
 
        torture_assert_ntstatus_equal(tctx, 
-                                     gensec_ntlmssp_check_packet(gensec_security, gensec_security,
+                                     gensec_ntlmssp_check_packet(gensec_security,
                                                                  data.data, data.length, data.data, data.length, &sig),
                                      NT_STATUS_ACCESS_DENIED, "Check of just signed packet (should fail, wrong end)");
 
        sig.length /= 2;
 
        torture_assert_ntstatus_equal(tctx, 
-                                     gensec_ntlmssp_check_packet(gensec_security, gensec_security,
+                                     gensec_ntlmssp_check_packet(gensec_security,
                                                                  data.data, data.length, data.data, data.length, &sig),
                                      NT_STATUS_ACCESS_DENIED, "Check of just signed packet with short sig");