Lines Matching refs:ret
118 krb5_error_code ret; in pk_check_pkauthenticator() local
131 ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, &req->req_body, &len, ret); in pk_check_pkauthenticator()
132 if (ret) { in pk_check_pkauthenticator()
134 return ret; in pk_check_pkauthenticator()
139 ret = krb5_create_checksum(context, in pk_check_pkauthenticator()
147 if (ret) { in pk_check_pkauthenticator()
149 return ret; in pk_check_pkauthenticator()
154 ret = KRB5_KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED; in pk_check_pkauthenticator()
160 ret = KRB5KRB_ERR_GENERIC; in pk_check_pkauthenticator()
166 return ret; in pk_check_pkauthenticator()
205 krb5_error_code ret; in generate_dh_keyblock() local
213 ret = KRB5KRB_ERR_GENERIC; in generate_dh_keyblock()
214 krb5_set_error_message(context, ret, "missing DH public_key"); in generate_dh_keyblock()
219 ret = KRB5KRB_ERR_GENERIC; in generate_dh_keyblock()
220 krb5_set_error_message(context, ret, in generate_dh_keyblock()
229 ret = ENOMEM; in generate_dh_keyblock()
230 krb5_set_error_message(context, ret, "malloc: out of memory"); in generate_dh_keyblock()
236 ret = KRB5KRB_ERR_GENERIC; in generate_dh_keyblock()
237 krb5_set_error_message(context, ret, in generate_dh_keyblock()
248 ret = KRB5KRB_ERR_GENERIC; in generate_dh_keyblock()
249 krb5_set_error_message(context, ret, "missing ECDH public_key"); in generate_dh_keyblock()
252 ret = _kdc_generate_ecdh_keyblock(context, in generate_dh_keyblock()
256 if (ret) in generate_dh_keyblock()
259 ret = KRB5KRB_ERR_GENERIC; in generate_dh_keyblock()
260 krb5_set_error_message(context, ret, in generate_dh_keyblock()
265 ret = _krb5_pk_octetstring2key(context, in generate_dh_keyblock()
277 return ret; in generate_dh_keyblock()
303 krb5_error_code ret; in get_dh_param() local
308 ret = KRB5_BADMSGTYPE; in get_dh_param()
309 krb5_set_error_message(context, ret, in get_dh_param()
322 ret = decode_DomainParameters(dh_key_info->algorithm.parameters->data, in get_dh_param()
326 if (ret) { in get_dh_param()
327 krb5_set_error_message(context, ret, "Can't decode algorithm " in get_dh_param()
332 ret = _krb5_dh_group_ok(context, config->pkinit_dh_min_bits, in get_dh_param()
335 if (ret) { in get_dh_param()
342 ret = ENOMEM; in get_dh_param()
343 krb5_set_error_message(context, ret, "Cannot create DH structure"); in get_dh_param()
346 ret = KRB5_BADMSGTYPE; in get_dh_param()
374 ret = decode_DHPublicKey(dh_key_info->subjectPublicKey.data, in get_dh_param()
378 if (ret) { in get_dh_param()
380 return ret; in get_dh_param()
388 ret = KRB5_BADMSGTYPE; in get_dh_param()
395 ret = 0; in get_dh_param()
401 return ret; in get_dh_param()
413 krb5_error_code ret; in _kdc_pk_rd_padata() local
433 ret = ENOMEM; in _kdc_pk_rd_padata()
437 ret = hx509_certs_init(context->hx509ctx, in _kdc_pk_rd_padata()
440 if (ret) { in _kdc_pk_rd_padata()
441 krb5_set_error_message(context, ret, "failed to create trust anchors"); in _kdc_pk_rd_padata()
445 ret = hx509_certs_merge(context->hx509ctx, trust_anchors, in _kdc_pk_rd_padata()
447 if (ret) { in _kdc_pk_rd_padata()
449 krb5_set_error_message(context, ret, "failed to create verify context"); in _kdc_pk_rd_padata()
454 ret = hdb_entry_get_pkinit_cert(&client->entry, &pc); in _kdc_pk_rd_padata()
455 if (ret == 0 && pc != NULL) { in _kdc_pk_rd_padata()
471 ret = hx509_verify_init_ctx(context->hx509ctx, &cp->verify_ctx); in _kdc_pk_rd_padata()
472 if (ret) { in _kdc_pk_rd_padata()
474 krb5_set_error_message(context, ret, "failed to create verify context"); in _kdc_pk_rd_padata()
491 ret = KRB5_KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED; in _kdc_pk_rd_padata()
492 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
497 ret = decode_PA_PK_AS_REQ_Win2k(pa->padata_value.data, in _kdc_pk_rd_padata()
501 if (ret) { in _kdc_pk_rd_padata()
502 krb5_set_error_message(context, ret, "Can't decode " in _kdc_pk_rd_padata()
503 "PK-AS-REQ-Win2k: %d", ret); in _kdc_pk_rd_padata()
507 ret = hx509_cms_unwrap_ContentInfo(&r.signed_auth_pack, in _kdc_pk_rd_padata()
512 if (ret) { in _kdc_pk_rd_padata()
513 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
514 "Can't unwrap ContentInfo(win): %d", ret); in _kdc_pk_rd_padata()
523 ret = decode_PA_PK_AS_REQ(pa->padata_value.data, in _kdc_pk_rd_padata()
527 if (ret) { in _kdc_pk_rd_padata()
528 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
529 "Can't decode PK-AS-REQ: %d", ret); in _kdc_pk_rd_padata()
538 ret = hx509_certs_init(context->hx509ctx, in _kdc_pk_rd_padata()
542 if (ret) { in _kdc_pk_rd_padata()
543 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
545 ret); in _kdc_pk_rd_padata()
565 ret = hx509_query_alloc(context->hx509ctx, &q); in _kdc_pk_rd_padata()
566 if (ret) { in _kdc_pk_rd_padata()
567 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
572 ret = decode_IssuerAndSerialNumber(edi->val[i].issuerAndSerialNumber->data, in _kdc_pk_rd_padata()
576 if (ret) { in _kdc_pk_rd_padata()
580 ret = hx509_query_match_issuer_serial(q, &iasn.issuer, &iasn.serialNumber); in _kdc_pk_rd_padata()
582 if (ret) { in _kdc_pk_rd_padata()
587 ret = hx509_certs_find(context->hx509ctx, in _kdc_pk_rd_padata()
592 if (ret) in _kdc_pk_rd_padata()
600 ret = hx509_cms_unwrap_ContentInfo(&r.signedAuthPack, in _kdc_pk_rd_padata()
605 if (ret) { in _kdc_pk_rd_padata()
606 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
607 "Can't unwrap ContentInfo: %d", ret); in _kdc_pk_rd_padata()
613 ret = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; in _kdc_pk_rd_padata()
617 ret = der_heim_oid_cmp(&contentInfoOid, &asn1_oid_id_pkcs7_signedData); in _kdc_pk_rd_padata()
618 if (ret != 0) { in _kdc_pk_rd_padata()
619 ret = KRB5KRB_ERR_GENERIC; in _kdc_pk_rd_padata()
620 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
626 ret = KRB5KRB_ERR_GENERIC; in _kdc_pk_rd_padata()
627 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
640 ret = hx509_cms_verify_signed(context->hx509ctx, in _kdc_pk_rd_padata()
650 if (ret) { in _kdc_pk_rd_padata()
651 char *s = hx509_get_error_string(context->hx509ctx, ret); in _kdc_pk_rd_padata()
653 s, ret); in _kdc_pk_rd_padata()
659 ret = hx509_get_one_cert(context->hx509ctx, signer_certs, in _kdc_pk_rd_padata()
663 if (ret) in _kdc_pk_rd_padata()
671 ret = KRB5_BADMSGTYPE; in _kdc_pk_rd_padata()
672 krb5_set_error_message(context, ret, "got wrong oid for pkauthdata"); in _kdc_pk_rd_padata()
679 ret = decode_AuthPack_Win2k(eContent.data, in _kdc_pk_rd_padata()
683 if (ret) { in _kdc_pk_rd_padata()
684 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
685 "Can't decode AuthPack: %d", ret); in _kdc_pk_rd_padata()
689 ret = pk_check_pkauthenticator_win2k(context, in _kdc_pk_rd_padata()
692 if (ret) { in _kdc_pk_rd_padata()
701 ret = KRB5KRB_ERR_GENERIC; in _kdc_pk_rd_padata()
702 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
711 ret = decode_AuthPack(eContent.data, in _kdc_pk_rd_padata()
715 if (ret) { in _kdc_pk_rd_padata()
716 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
717 "Can't decode AuthPack: %d", ret); in _kdc_pk_rd_padata()
725 ret = KRB5_KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED; in _kdc_pk_rd_padata()
726 krb5_set_error_message(context, ret, in _kdc_pk_rd_padata()
731 ret = pk_check_pkauthenticator(context, in _kdc_pk_rd_padata()
734 if (ret) { in _kdc_pk_rd_padata()
745 ret = get_dh_param(context, config, in _kdc_pk_rd_padata()
749 ret = _kdc_get_ecdh_param(context, config, in _kdc_pk_rd_padata()
753 ret = KRB5_BADMSGTYPE; in _kdc_pk_rd_padata()
754 krb5_set_error_message(context, ret, "PKINIT unknown DH mechanism"); in _kdc_pk_rd_padata()
756 if (ret) { in _kdc_pk_rd_padata()
763 ret = hx509_peer_info_alloc(context->hx509ctx, in _kdc_pk_rd_padata()
765 if (ret) { in _kdc_pk_rd_padata()
771 ret = hx509_peer_info_set_cms_algs(context->hx509ctx, in _kdc_pk_rd_padata()
775 if (ret) { in _kdc_pk_rd_padata()
795 if (ret) in _kdc_pk_rd_padata()
796 krb5_warn(context, ret, "PKINIT"); in _kdc_pk_rd_padata()
803 if (ret) { in _kdc_pk_rd_padata()
807 return ret; in _kdc_pk_rd_padata()
839 krb5_error_code ret; in pk_mk_pa_reply_enckey() local
880 ret = copy_EncryptionKey(reply_key, &kp.replyKey); in pk_mk_pa_reply_enckey()
881 if (ret) { in pk_mk_pa_reply_enckey()
889 &kp, &size,ret); in pk_mk_pa_reply_enckey()
896 ret = copy_EncryptionKey(reply_key, &kp.replyKey); in pk_mk_pa_reply_enckey()
897 if (ret) { in pk_mk_pa_reply_enckey()
902 ret = krb5_crypto_init(context, reply_key, 0, &ascrypto); in pk_mk_pa_reply_enckey()
903 if (ret) { in pk_mk_pa_reply_enckey()
908 ret = krb5_create_checksum(context, ascrypto, 6, 0, in pk_mk_pa_reply_enckey()
911 if (ret) { in pk_mk_pa_reply_enckey()
916 ret = krb5_crypto_destroy(context, ascrypto); in pk_mk_pa_reply_enckey()
917 if (ret) { in pk_mk_pa_reply_enckey()
921 ASN1_MALLOC_ENCODE(ReplyKeyPack, buf.data, buf.length, &kp, &size,ret); in pk_mk_pa_reply_enckey()
924 if (ret) { in pk_mk_pa_reply_enckey()
925 krb5_set_error_message(context, ret, "ASN.1 encoding of ReplyKeyPack " in pk_mk_pa_reply_enckey()
926 "failed (%d)", ret); in pk_mk_pa_reply_enckey()
936 ret = hx509_query_alloc(context->hx509ctx, &q); in pk_mk_pa_reply_enckey()
937 if (ret) in pk_mk_pa_reply_enckey()
944 ret = hx509_certs_find(context->hx509ctx, in pk_mk_pa_reply_enckey()
949 if (ret) in pk_mk_pa_reply_enckey()
952 ret = hx509_cms_create_signed_1(context->hx509ctx, in pk_mk_pa_reply_enckey()
967 if (ret) in pk_mk_pa_reply_enckey()
971 ret = hx509_cms_wrap_ContentInfo(&asn1_oid_id_pkcs7_signedData, in pk_mk_pa_reply_enckey()
974 if (ret) in pk_mk_pa_reply_enckey()
980 ret = hx509_cms_envelope_1(context->hx509ctx, in pk_mk_pa_reply_enckey()
986 if (ret) in pk_mk_pa_reply_enckey()
989 ret = _krb5_pk_mk_ContentInfo(context, in pk_mk_pa_reply_enckey()
994 if (ret && *kdc_cert) { in pk_mk_pa_reply_enckey()
1001 return ret; in pk_mk_pa_reply_enckey()
1018 krb5_error_code ret; in pk_mk_pa_reply_dh() local
1040 ret = BN_to_integer(context, pub_key, &i); in pk_mk_pa_reply_dh()
1041 if (ret) in pk_mk_pa_reply_dh()
1042 return ret; in pk_mk_pa_reply_dh()
1044 ASN1_MALLOC_ENCODE(DHPublicKey, buf.data, buf.length, &i, &size, ret); in pk_mk_pa_reply_dh()
1046 if (ret) { in pk_mk_pa_reply_dh()
1047 krb5_set_error_message(context, ret, "ASN.1 encoding of " in pk_mk_pa_reply_dh()
1048 "DHPublicKey failed (%d)", ret); in pk_mk_pa_reply_dh()
1049 return ret; in pk_mk_pa_reply_dh()
1059 ret = _kdc_serialize_ecdh_key(context, cp->u.ecdh.key, &p, in pk_mk_pa_reply_dh()
1062 if (ret) in pk_mk_pa_reply_dh()
1071 ret); in pk_mk_pa_reply_dh()
1072 if (ret) { in pk_mk_pa_reply_dh()
1073 krb5_set_error_message(context, ret, "ASN.1 encoding of " in pk_mk_pa_reply_dh()
1074 "KdcDHKeyInfo failed (%d)", ret); in pk_mk_pa_reply_dh()
1085 ret = hx509_query_alloc(context->hx509ctx, &q); in pk_mk_pa_reply_dh()
1086 if (ret) in pk_mk_pa_reply_dh()
1093 ret = hx509_certs_find(context->hx509ctx, in pk_mk_pa_reply_dh()
1098 if (ret) in pk_mk_pa_reply_dh()
1101 ret = hx509_cms_create_signed_1(context->hx509ctx, in pk_mk_pa_reply_dh()
1112 if (ret) { in pk_mk_pa_reply_dh()
1113 kdc_log(context, config, 0, "Failed signing the DH* reply: %d", ret); in pk_mk_pa_reply_dh()
1118 ret = _krb5_pk_mk_ContentInfo(context, in pk_mk_pa_reply_dh()
1122 if (ret) in pk_mk_pa_reply_dh()
1126 if (ret && *kdc_cert) { in pk_mk_pa_reply_dh()
1135 return ret; in pk_mk_pa_reply_dh()
1154 krb5_error_code ret; in _kdc_pk_mk_pa_reply() local
1172 ret = KRB5KRB_ERR_GENERIC; in _kdc_pk_mk_pa_reply()
1173 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1196 ret = krb5_generate_random_keyblock(context, enctype, in _kdc_pk_mk_pa_reply()
1198 if (ret) { in _kdc_pk_mk_pa_reply()
1202 ret = pk_mk_pa_reply_enckey(context, in _kdc_pk_mk_pa_reply()
1210 if (ret) { in _kdc_pk_mk_pa_reply()
1216 ret); in _kdc_pk_mk_pa_reply()
1218 if (ret) { in _kdc_pk_mk_pa_reply()
1219 krb5_set_error_message(context, ret, "encoding of Key ContentInfo " in _kdc_pk_mk_pa_reply()
1220 "failed %d", ret); in _kdc_pk_mk_pa_reply()
1227 ret = krb5_generate_random_keyblock(context, sessionetype, in _kdc_pk_mk_pa_reply()
1229 if (ret) { in _kdc_pk_mk_pa_reply()
1248 ret = generate_dh_keyblock(context, cp, enctype); in _kdc_pk_mk_pa_reply()
1249 if (ret) in _kdc_pk_mk_pa_reply()
1250 return ret; in _kdc_pk_mk_pa_reply()
1252 ret = pk_mk_pa_reply_dh(context, config, in _kdc_pk_mk_pa_reply()
1256 if (ret) { in _kdc_pk_mk_pa_reply()
1258 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1260 "failed %d", ret); in _kdc_pk_mk_pa_reply()
1266 ret); in _kdc_pk_mk_pa_reply()
1268 if (ret) { in _kdc_pk_mk_pa_reply()
1269 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1271 "failed %d", ret); in _kdc_pk_mk_pa_reply()
1291 ret = krb5_generate_random_keyblock(context, sessionetype, in _kdc_pk_mk_pa_reply()
1293 if (ret) { in _kdc_pk_mk_pa_reply()
1297 ret = krb5_crypto_init(context, &cp->reply_key, enctype, &reply_crypto); in _kdc_pk_mk_pa_reply()
1298 if (ret) { in _kdc_pk_mk_pa_reply()
1303 … ret = krb5_crypto_init(context, &kdc_contribution_key, sessionetype, &kdccont_crypto); in _kdc_pk_mk_pa_reply()
1304 if (ret) { in _kdc_pk_mk_pa_reply()
1311 ret = krb5_crypto_fx_cf2(context, kdccont_crypto, reply_crypto, in _kdc_pk_mk_pa_reply()
1314 if (ret) { in _kdc_pk_mk_pa_reply()
1321 &kdc_contribution_key, &size, ret); in _kdc_pk_mk_pa_reply()
1323 if (ret) { in _kdc_pk_mk_pa_reply()
1324 … krb5_set_error_message(context, ret, "encoding of PKINIT-KX Key failed %d", ret); in _kdc_pk_mk_pa_reply()
1331 ret = krb5_encrypt_EncryptedData(context, reply_crypto, KRB5_KU_PA_PKINIT_KX, in _kdc_pk_mk_pa_reply()
1335 if (ret) { in _kdc_pk_mk_pa_reply()
1340 &kx, &size, ret); in _kdc_pk_mk_pa_reply()
1342 if (ret) { in _kdc_pk_mk_pa_reply()
1343 … krb5_set_error_message(context, ret, "encoding of PKINIT-KX failed %d", ret); in _kdc_pk_mk_pa_reply()
1350 ret = krb5_padata_add(context, md, KRB5_PADATA_PKINIT_KX, kxdata, kxlen); in _kdc_pk_mk_pa_reply()
1351 if (ret) { in _kdc_pk_mk_pa_reply()
1352 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1353 "Failed adding PKINIT-KX %d", ret); in _kdc_pk_mk_pa_reply()
1371 ASN1_MALLOC_ENCODE(PA_PK_AS_REP_BTMM, buf, len, &btmm, &size, ret); in _kdc_pk_mk_pa_reply()
1373 ASN1_MALLOC_ENCODE(PA_PK_AS_REP, buf, len, &rep, &size, ret); in _kdc_pk_mk_pa_reply()
1377 if (ret) { in _kdc_pk_mk_pa_reply()
1378 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1379 "encode PA-PK-AS-REP failed %d", ret); in _kdc_pk_mk_pa_reply()
1392 ret = KRB5KRB_ERR_GENERIC; in _kdc_pk_mk_pa_reply()
1393 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1403 ret = krb5_generate_random_keyblock(context, enctype, in _kdc_pk_mk_pa_reply()
1405 if (ret) { in _kdc_pk_mk_pa_reply()
1409 ret = pk_mk_pa_reply_enckey(context, in _kdc_pk_mk_pa_reply()
1417 if (ret) { in _kdc_pk_mk_pa_reply()
1423 ret); in _kdc_pk_mk_pa_reply()
1425 if (ret) { in _kdc_pk_mk_pa_reply()
1426 krb5_set_error_message(context, ret, "encoding of Key ContentInfo " in _kdc_pk_mk_pa_reply()
1427 "failed %d", ret); in _kdc_pk_mk_pa_reply()
1434 ASN1_MALLOC_ENCODE(PA_PK_AS_REP_Win2k, buf, len, &rep, &size, ret); in _kdc_pk_mk_pa_reply()
1436 if (ret) { in _kdc_pk_mk_pa_reply()
1437 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1438 "encode PA-PK-AS-REP-Win2k failed %d", ret); in _kdc_pk_mk_pa_reply()
1444 ret = krb5_generate_random_keyblock(context, sessionetype, in _kdc_pk_mk_pa_reply()
1446 if (ret) { in _kdc_pk_mk_pa_reply()
1455 ret = krb5_padata_add(context, md, pa_type, buf, len); in _kdc_pk_mk_pa_reply()
1456 if (ret) { in _kdc_pk_mk_pa_reply()
1457 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1458 "Failed adding PA-PK-AS-REP %d", ret); in _kdc_pk_mk_pa_reply()
1480 ret = fstat(fd, &sb); in _kdc_pk_mk_pa_reply()
1481 if (ret) { in _kdc_pk_mk_pa_reply()
1482 ret = errno; in _kdc_pk_mk_pa_reply()
1485 "PK-INIT failed to stat ocsp data %d", ret); in _kdc_pk_mk_pa_reply()
1489 ret = krb5_data_alloc(&ocsp.data, sb.st_size); in _kdc_pk_mk_pa_reply()
1490 if (ret) { in _kdc_pk_mk_pa_reply()
1493 "PK-INIT failed to stat ocsp data %d", ret); in _kdc_pk_mk_pa_reply()
1497 ret = read(fd, ocsp.data.data, sb.st_size); in _kdc_pk_mk_pa_reply()
1499 if (ret != sb.st_size) { in _kdc_pk_mk_pa_reply()
1505 ret = hx509_ocsp_verify(context->hx509ctx, in _kdc_pk_mk_pa_reply()
1511 if (ret) { in _kdc_pk_mk_pa_reply()
1513 "PK-INIT failed to verify ocsp data %d", ret); in _kdc_pk_mk_pa_reply()
1523 ret = 0; in _kdc_pk_mk_pa_reply()
1528 ret = krb5_padata_add(context, md, in _kdc_pk_mk_pa_reply()
1531 if (ret) { in _kdc_pk_mk_pa_reply()
1532 krb5_set_error_message(context, ret, in _kdc_pk_mk_pa_reply()
1533 "Failed adding OCSP response %d", ret); in _kdc_pk_mk_pa_reply()
1543 if (ret == 0) in _kdc_pk_mk_pa_reply()
1544 ret = krb5_copy_keyblock_contents(context, &cp->reply_key, reply_key); in _kdc_pk_mk_pa_reply()
1545 return ret; in _kdc_pk_mk_pa_reply()
1556 int ret, found = 0; in match_rfc_san() local
1561 ret = hx509_cert_find_subjectAltName_otherName(hx509ctx, in match_rfc_san()
1565 if (ret) in match_rfc_san()
1573 ret = decode_KRB5PrincipalName(list.val[i].data, in match_rfc_san()
1576 if (ret) { in match_rfc_san()
1577 const char *msg = krb5_get_error_message(context, ret); in match_rfc_san()
1600 if (ret) in match_rfc_san()
1601 return ret; in match_rfc_san()
1619 int ret; in match_ms_upn_san() local
1625 ret = hx509_cert_find_subjectAltName_otherName(hx509ctx, in match_ms_upn_san()
1629 if (ret) in match_ms_upn_san()
1635 ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH; in match_ms_upn_san()
1639 ret = decode_MS_UPN_SAN(list.val[0].data, list.val[0].length, &upn, &size); in match_ms_upn_san()
1640 if (ret) { in match_ms_upn_san()
1647 ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH; in match_ms_upn_san()
1653 ret = krb5_parse_name(context, upn, &principal); in match_ms_upn_san()
1655 if (ret) { in match_ms_upn_san()
1661 ret = clientdb->hdb_check_pkinit_ms_upn_match(context, clientdb, client, principal); in match_ms_upn_san()
1670 ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH; in match_ms_upn_san()
1678 return ret; in match_ms_upn_san()
1691 krb5_error_code ret; in _kdc_pk_check_client() local
1706 ret = hx509_cert_get_base_subject(context->hx509ctx, in _kdc_pk_check_client()
1709 if (ret) in _kdc_pk_check_client()
1710 return ret; in _kdc_pk_check_client()
1712 ret = hx509_name_to_string(name, subject_name); in _kdc_pk_check_client()
1714 if (ret) in _kdc_pk_check_client()
1715 return ret; in _kdc_pk_check_client()
1721 ret = hdb_entry_get_pkinit_cert(&client->entry, &pc); in _kdc_pk_check_client()
1722 if (ret == 0 && pc) { in _kdc_pk_check_client()
1733 ret = hx509_cert_cmp(cert, cp->cert); in _kdc_pk_check_client()
1735 if (ret == 0) { in _kdc_pk_check_client()
1745 ret = match_rfc_san(context, config, in _kdc_pk_check_client()
1749 if (ret == 0) { in _kdc_pk_check_client()
1754 ret = match_ms_upn_san(context, config, in _kdc_pk_check_client()
1759 if (ret == 0) { in _kdc_pk_check_client()
1766 ret = hdb_entry_get_pkinit_acl(&client->entry, &acl); in _kdc_pk_check_client()
1767 if (ret == 0 && acl != NULL) { in _kdc_pk_check_client()
1803 ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH; in _kdc_pk_check_client()
1804 krb5_set_error_message(context, ret, in _kdc_pk_check_client()
1815 return ret; in _kdc_pk_check_client()
1825 krb5_error_code ret; in add_principal_mapping() local
1833 ret = krb5_parse_name(context, principal_name, &principal); in add_principal_mapping()
1834 if (ret) in add_principal_mapping()
1835 return ret; in add_principal_mapping()
1856 krb5_error_code ret; in _kdc_add_inital_verified_cas() local
1865 &cas, &size, ret); in _kdc_add_inital_verified_cas()
1866 if (ret) in _kdc_add_inital_verified_cas()
1867 return ret; in _kdc_add_inital_verified_cas()
1871 ret = _kdc_tkt_add_if_relevant_ad(context, tkt, in _kdc_add_inital_verified_cas()
1875 return ret; in _kdc_add_inital_verified_cas()
1885 krb5_error_code ret; in load_mappings() local
1914 ret = add_principal_mapping(context, p, subject_name); in load_mappings()
1915 if (ret) { in load_mappings()
1916 krb5_warn(context, ret, "failed to add line %lu \":\" :%s\n", in load_mappings()
1939 krb5_error_code ret; in krb5_kdc_pk_initialize() local
1944 ret = _krb5_parse_moduli(context, file, &moduli); in krb5_kdc_pk_initialize()
1945 if (ret) in krb5_kdc_pk_initialize()
1946 krb5_err(context, 1, ret, "PKINIT: failed to load modidi file"); in krb5_kdc_pk_initialize()
1951 ret = _krb5_pk_load_id(context, in krb5_kdc_pk_initialize()
1960 if (ret) { in krb5_kdc_pk_initialize()
1961 krb5_warn(context, ret, "PKINIT: "); in krb5_kdc_pk_initialize()
1963 return ret; in krb5_kdc_pk_initialize()
1970 ret = hx509_query_alloc(context->hx509ctx, &q); in krb5_kdc_pk_initialize()
1971 if (ret) { in krb5_kdc_pk_initialize()
1980 ret = hx509_certs_find(context->hx509ctx, in krb5_kdc_pk_initialize()
1985 if (ret == 0) { in krb5_kdc_pk_initialize()
1990 ret = hx509_cert_get_subject(cert, &name); in krb5_kdc_pk_initialize()
1991 if (ret == 0) { in krb5_kdc_pk_initialize()