Blame SOURCES/Simplify-PKINIT-cert-iteration-and-selection.patch

665228
From 68c478bbc5a130bf4cc800b856da73b2fd5e83ed Mon Sep 17 00:00:00 2001
665228
From: Matt Rogers <mrogers@redhat.com>
665228
Date: Tue, 21 Mar 2017 21:24:14 -0400
665228
Subject: [PATCH] Simplify PKINIT cert iteration and selection
665228
665228
Remove the pkinit_cert_handle structures and iteration functions used
665228
during certificate matching.  Instead, make pkinit_matching.c obtain a
665228
list of matching data objects from the crypto code, and then select a
665228
cert based on the index into that list.
665228
665228
Also fix a typo in the name of crypto_retrieve_X509_key_usage().
665228
665228
[ghudson@mit.edu: simplified code]
665228
665228
(cherry picked from commit 01b1c0e26252a00f2215408b0e473b84aa0f6a87)
665228
---
665228
 src/plugins/preauth/pkinit/pkinit_crypto.h    |  75 +---
665228
 .../preauth/pkinit/pkinit_crypto_openssl.c    | 383 +++++++-----------
665228
 .../preauth/pkinit/pkinit_crypto_openssl.h    |  19 -
665228
 src/plugins/preauth/pkinit/pkinit_matching.c  | 139 +------
665228
 4 files changed, 194 insertions(+), 422 deletions(-)
665228
665228
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
665228
index 49b96b8ee..a0176acad 100644
665228
--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
665228
+++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
665228
@@ -96,7 +96,6 @@ typedef struct _pkinit_cert_iter_info *pkinit_cert_iter_handle;
665228
 #define PKINIT_ITER_NO_MORE	0x11111111  /* XXX */
665228
 
665228
 typedef struct _pkinit_cert_matching_data {
665228
-    pkinit_cert_handle ch;  /* cert handle for this certificate */
665228
     char *subject_dn;	    /* rfc2253-style subject name string */
665228
     char *issuer_dn;	    /* rfc2253-style issuer name string */
665228
     unsigned int ku_bits;   /* key usage information */
665228
@@ -458,68 +457,38 @@ krb5_error_code crypto_free_cert_info
665228
 
665228
 
665228
 /*
665228
- * Get number of certificates available after crypto_load_certs()
665228
+ * Get a null-terminated list of certificate matching data objects for the
665228
+ * certificates loaded in id_cryptoctx.
665228
  */
665228
-krb5_error_code crypto_cert_get_count
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
665228
-	pkinit_req_crypto_context req_cryptoctx,	/* IN */
665228
-	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
665228
-	int *cert_count);				/* OUT */
665228
+krb5_error_code
665228
+crypto_cert_get_matching_data(krb5_context context,
665228
+			      pkinit_plg_crypto_context plg_cryptoctx,
665228
+			      pkinit_req_crypto_context req_cryptoctx,
665228
+			      pkinit_identity_crypto_context id_cryptoctx,
665228
+			      pkinit_cert_matching_data ***md_out);
665228
 
665228
 /*
665228
- * Begin iteration over the certs loaded in crypto_load_certs()
665228
+ * Free a matching data object.
665228
  */
665228
-krb5_error_code crypto_cert_iteration_begin
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
665228
-	pkinit_req_crypto_context req_cryptoctx,	/* IN */
665228
-	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
665228
-	pkinit_cert_iter_handle *iter_handle);		/* OUT */
665228
+void
665228
+crypto_cert_free_matching_data(krb5_context context,
665228
+			       pkinit_cert_matching_data *md);
665228
 
665228
 /*
665228
- * End iteration over the certs loaded in crypto_load_certs()
665228
+ * Free a list of matching data objects.
665228
  */
665228
-krb5_error_code crypto_cert_iteration_end
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_cert_iter_handle iter_handle);		/* IN */
665228
+void
665228
+crypto_cert_free_matching_data_list(krb5_context context,
665228
+				    pkinit_cert_matching_data **matchdata);
665228
 
665228
 /*
665228
- * Get next certificate handle
665228
+ * Choose one of the certificates loaded in idctx to use for PKINIT client
665228
+ * operations.  cred_index must be an index into the array of matching objects
665228
+ * returned by crypto_cert_get_matching_data().
665228
  */
665228
-krb5_error_code crypto_cert_iteration_next
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_cert_iter_handle iter_handle,		/* IN */
665228
-	pkinit_cert_handle *cert_handle);		/* OUT */
665228
-
665228
-/*
665228
- * Release cert handle
665228
- */
665228
-krb5_error_code crypto_cert_release
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_cert_handle cert_handle);		/* IN */
665228
-
665228
-/*
665228
- * Get certificate matching information
665228
- */
665228
-krb5_error_code crypto_cert_get_matching_data
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_cert_handle cert_handle,			/* IN */
665228
-	pkinit_cert_matching_data **ret_data);		/* OUT */
665228
-
665228
-/*
665228
- * Free certificate information
665228
- */
665228
-krb5_error_code crypto_cert_free_matching_data
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_cert_matching_data *data);		/* IN */
665228
-
665228
-/*
665228
- * Make the given certificate "the chosen one"
665228
- */
665228
-krb5_error_code crypto_cert_select
665228
-	(krb5_context context,				/* IN */
665228
-	pkinit_cert_matching_data *data);		/* IN */
665228
+krb5_error_code
665228
+crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx,
665228
+		   size_t cred_index);
665228
 
665228
 /*
665228
  * Select the default certificate as "the chosen one"
665228
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
665228
index 6a95f8035..b243dca30 100644
665228
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
665228
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
665228
@@ -4974,136 +4974,16 @@ cleanup:
665228
     return retval;
665228
 }
665228
 
665228
-/*
665228
- * Get number of certificates available after crypto_load_certs()
665228
- */
665228
-krb5_error_code
665228
-crypto_cert_get_count(krb5_context context,
665228
-                      pkinit_plg_crypto_context plg_cryptoctx,
665228
-                      pkinit_req_crypto_context req_cryptoctx,
665228
-                      pkinit_identity_crypto_context id_cryptoctx,
665228
-                      int *cert_count)
665228
-{
665228
-    int count;
665228
-
665228
-    if (id_cryptoctx == NULL || id_cryptoctx->creds[0] == NULL)
665228
-        return EINVAL;
665228
-
665228
-    for (count = 0;
665228
-         count <= MAX_CREDS_ALLOWED && id_cryptoctx->creds[count] != NULL;
665228
-         count++);
665228
-    *cert_count = count;
665228
-    return 0;
665228
-}
665228
-
665228
-
665228
-/*
665228
- * Begin iteration over the certs loaded in crypto_load_certs()
665228
- */
665228
-krb5_error_code
665228
-crypto_cert_iteration_begin(krb5_context context,
665228
-                            pkinit_plg_crypto_context plg_cryptoctx,
665228
-                            pkinit_req_crypto_context req_cryptoctx,
665228
-                            pkinit_identity_crypto_context id_cryptoctx,
665228
-                            pkinit_cert_iter_handle *ih_ret)
665228
-{
665228
-    struct _pkinit_cert_iter_data *id;
665228
-
665228
-    if (id_cryptoctx == NULL || ih_ret == NULL)
665228
-        return EINVAL;
665228
-    if (id_cryptoctx->creds[0] == NULL) /* No cred info available */
665228
-        return ENOENT;
665228
-
665228
-    id = calloc(1, sizeof(*id));
665228
-    if (id == NULL)
665228
-        return ENOMEM;
665228
-    id->magic = ITER_MAGIC;
665228
-    id->plgctx = plg_cryptoctx,
665228
-        id->reqctx = req_cryptoctx,
665228
-        id->idctx = id_cryptoctx;
665228
-    id->index = 0;
665228
-    *ih_ret = (pkinit_cert_iter_handle) id;
665228
-    return 0;
665228
-}
665228
-
665228
-/*
665228
- * End iteration over the certs loaded in crypto_load_certs()
665228
- */
665228
-krb5_error_code
665228
-crypto_cert_iteration_end(krb5_context context,
665228
-                          pkinit_cert_iter_handle ih)
665228
-{
665228
-    struct _pkinit_cert_iter_data *id = (struct _pkinit_cert_iter_data *)ih;
665228
-
665228
-    if (id == NULL || id->magic != ITER_MAGIC)
665228
-        return EINVAL;
665228
-    free(ih);
665228
-    return 0;
665228
-}
665228
-
665228
-/*
665228
- * Get next certificate handle
665228
- */
665228
-krb5_error_code
665228
-crypto_cert_iteration_next(krb5_context context,
665228
-                           pkinit_cert_iter_handle ih,
665228
-                           pkinit_cert_handle *ch_ret)
665228
-{
665228
-    struct _pkinit_cert_iter_data *id = (struct _pkinit_cert_iter_data *)ih;
665228
-    struct _pkinit_cert_data *cd;
665228
-    pkinit_identity_crypto_context id_cryptoctx;
665228
-
665228
-    if (id == NULL || id->magic != ITER_MAGIC)
665228
-        return EINVAL;
665228
-
665228
-    if (ch_ret == NULL)
665228
-        return EINVAL;
665228
-
665228
-    id_cryptoctx = id->idctx;
665228
-    if (id_cryptoctx == NULL)
665228
-        return EINVAL;
665228
-
665228
-    if (id_cryptoctx->creds[id->index] == NULL)
665228
-        return PKINIT_ITER_NO_MORE;
665228
-
665228
-    cd = calloc(1, sizeof(*cd));
665228
-    if (cd == NULL)
665228
-        return ENOMEM;
665228
-
665228
-    cd->magic = CERT_MAGIC;
665228
-    cd->plgctx = id->plgctx;
665228
-    cd->reqctx = id->reqctx;
665228
-    cd->idctx = id->idctx;
665228
-    cd->index = id->index;
665228
-    cd->cred = id_cryptoctx->creds[id->index++];
665228
-    *ch_ret = (pkinit_cert_handle)cd;
665228
-    return 0;
665228
-}
665228
-
665228
-/*
665228
- * Release cert handle
665228
- */
665228
-krb5_error_code
665228
-crypto_cert_release(krb5_context context,
665228
-                    pkinit_cert_handle ch)
665228
-{
665228
-    struct _pkinit_cert_data *cd = (struct _pkinit_cert_data *)ch;
665228
-    if (cd == NULL || cd->magic != CERT_MAGIC)
665228
-        return EINVAL;
665228
-    free(cd);
665228
-    return 0;
665228
-}
665228
-
665228
 /*
665228
  * Get certificate Key Usage and Extended Key Usage
665228
  */
665228
 static krb5_error_code
665228
-crypto_retieve_X509_key_usage(krb5_context context,
665228
-                              pkinit_plg_crypto_context plgcctx,
665228
-                              pkinit_req_crypto_context reqcctx,
665228
-                              X509 *x,
665228
-                              unsigned int *ret_ku_bits,
665228
-                              unsigned int *ret_eku_bits)
665228
+crypto_retrieve_X509_key_usage(krb5_context context,
665228
+                               pkinit_plg_crypto_context plgcctx,
665228
+                               pkinit_req_crypto_context reqcctx,
665228
+                               X509 *x,
665228
+                               unsigned int *ret_ku_bits,
665228
+                               unsigned int *ret_eku_bits)
665228
 {
665228
     krb5_error_code retval = 0;
665228
     int i;
665228
@@ -5202,55 +5082,99 @@ X509_NAME_oneline_ex(X509_NAME * a,
665228
 }
665228
 
665228
 /*
665228
- * Get certificate information
665228
+ * Get number of certificates available after crypto_load_certs()
665228
  */
665228
-krb5_error_code
665228
-crypto_cert_get_matching_data(krb5_context context,
665228
-                              pkinit_cert_handle ch,
665228
-                              pkinit_cert_matching_data **ret_md)
665228
+static krb5_error_code
665228
+crypto_cert_get_count(pkinit_identity_crypto_context id_cryptoctx,
665228
+                      int *cert_count)
665228
 {
665228
-    krb5_error_code retval;
665228
-    pkinit_cert_matching_data *md;
665228
-    krb5_principal *pkinit_sans =NULL, *upn_sans = NULL;
665228
-    struct _pkinit_cert_data *cd = (struct _pkinit_cert_data *)ch;
665228
-    unsigned int i, j;
665228
+    int count;
665228
+
665228
+    *cert_count = 0;
665228
+    if (id_cryptoctx == NULL || id_cryptoctx->creds[0] == NULL)
665228
+        return EINVAL;
665228
+
665228
+    for (count = 0;
665228
+         count <= MAX_CREDS_ALLOWED && id_cryptoctx->creds[count] != NULL;
665228
+         count++);
665228
+    *cert_count = count;
665228
+    return 0;
665228
+}
665228
+
665228
+void
665228
+crypto_cert_free_matching_data(krb5_context context,
665228
+                               pkinit_cert_matching_data *md)
665228
+{
665228
+    int i;
665228
+
665228
+    if (md == NULL)
665228
+        return;
665228
+    free(md->subject_dn);
665228
+    free(md->issuer_dn);
665228
+    for (i = 0; md->sans != NULL && md->sans[i] != NULL; i++)
665228
+        krb5_free_principal(context, md->sans[i]);
665228
+    free(md->sans);
665228
+    free(md);
665228
+}
665228
+
665228
+/*
665228
+ * Free certificate matching data.
665228
+ */
665228
+void
665228
+crypto_cert_free_matching_data_list(krb5_context context,
665228
+                                    pkinit_cert_matching_data **list)
665228
+{
665228
+    int i;
665228
+
665228
+    for (i = 0; list != NULL && list[i] != NULL; i++)
665228
+        crypto_cert_free_matching_data(context, list[i]);
665228
+    free(list);
665228
+}
665228
+
665228
+/*
665228
+ * Get certificate matching data for cert.
665228
+ */
665228
+static krb5_error_code
665228
+get_matching_data(krb5_context context,
665228
+                  pkinit_plg_crypto_context plg_cryptoctx,
665228
+                  pkinit_req_crypto_context req_cryptoctx, X509 *cert,
665228
+                  pkinit_cert_matching_data **md_out)
665228
+{
665228
+    krb5_error_code ret = ENOMEM;
665228
+    pkinit_cert_matching_data *md = NULL;
665228
+    krb5_principal *pkinit_sans = NULL, *upn_sans = NULL;
665228
+    size_t i, j;
665228
     char buf[DN_BUF_LEN];
665228
     unsigned int bufsize = sizeof(buf);
665228
 
665228
-    if (cd == NULL || cd->magic != CERT_MAGIC)
665228
-        return EINVAL;
665228
-    if (ret_md == NULL)
665228
-        return EINVAL;
665228
+    *md_out = NULL;
665228
 
665228
     md = calloc(1, sizeof(*md));
665228
     if (md == NULL)
665228
-        return ENOMEM;
665228
+        goto cleanup;
665228
 
665228
-    md->ch = ch;
665228
-
665228
-    /* get the subject name (in rfc2253 format) */
665228
-    X509_NAME_oneline_ex(X509_get_subject_name(cd->cred->cert),
665228
-                         buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS);
665228
+    /* Get the subject name (in rfc2253 format). */
665228
+    X509_NAME_oneline_ex(X509_get_subject_name(cert), buf, &bufsize,
665228
+                         XN_FLAG_SEP_COMMA_PLUS);
665228
     md->subject_dn = strdup(buf);
665228
     if (md->subject_dn == NULL) {
665228
-        retval = ENOMEM;
665228
+        ret = ENOMEM;
665228
         goto cleanup;
665228
     }
665228
 
665228
-    /* get the issuer name (in rfc2253 format) */
665228
-    X509_NAME_oneline_ex(X509_get_issuer_name(cd->cred->cert),
665228
-                         buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS);
665228
+    /* Get the issuer name (in rfc2253 format). */
665228
+    X509_NAME_oneline_ex(X509_get_issuer_name(cert), buf, &bufsize,
665228
+                         XN_FLAG_SEP_COMMA_PLUS);
665228
     md->issuer_dn = strdup(buf);
665228
     if (md->issuer_dn == NULL) {
665228
-        retval = ENOMEM;
665228
+        ret = ENOMEM;
665228
         goto cleanup;
665228
     }
665228
 
665228
-    /* get the san data */
665228
-    retval = crypto_retrieve_X509_sans(context, cd->plgctx, cd->reqctx,
665228
-                                       cd->cred->cert, &pkinit_sans,
665228
-                                       &upn_sans, NULL);
665228
-    if (retval)
665228
+    /* Get the SAN data. */
665228
+    ret = crypto_retrieve_X509_sans(context, plg_cryptoctx, req_cryptoctx,
665228
+                                    cert, &pkinit_sans, &upn_sans, NULL);
665228
+    if (ret)
665228
         goto cleanup;
665228
 
665228
     j = 0;
665228
@@ -5265,7 +5189,7 @@ crypto_cert_get_matching_data(krb5_context context,
665228
     if (j != 0) {
665228
         md->sans = calloc((size_t)j+1, sizeof(*md->sans));
665228
         if (md->sans == NULL) {
665228
-            retval = ENOMEM;
665228
+            ret = ENOMEM;
665228
             goto cleanup;
665228
         }
665228
         j = 0;
665228
@@ -5283,88 +5207,96 @@ crypto_cert_get_matching_data(krb5_context context,
665228
     } else
665228
         md->sans = NULL;
665228
 
665228
-    /* get the KU and EKU data */
665228
-
665228
-    retval = crypto_retieve_X509_key_usage(context, cd->plgctx, cd->reqctx,
665228
-                                           cd->cred->cert,
665228
-                                           &md->ku_bits, &md->eku_bits);
665228
-    if (retval)
665228
+    /* Get the KU and EKU data. */
665228
+    ret = crypto_retrieve_X509_key_usage(context, plg_cryptoctx,
665228
+                                         req_cryptoctx, cert, &md->ku_bits,
665228
+                                         &md->eku_bits);
665228
+    if (ret)
665228
         goto cleanup;
665228
 
665228
-    *ret_md = md;
665228
-    retval = 0;
665228
+    *md_out = md;
665228
+    md = NULL;
665228
+
665228
 cleanup:
665228
-    if (retval) {
665228
-        if (md)
665228
-            crypto_cert_free_matching_data(context, md);
665228
+    crypto_cert_free_matching_data(context, md);
665228
+    return ret;
665228
+}
665228
+
665228
+krb5_error_code
665228
+crypto_cert_get_matching_data(krb5_context context,
665228
+                              pkinit_plg_crypto_context plg_cryptoctx,
665228
+                              pkinit_req_crypto_context req_cryptoctx,
665228
+                              pkinit_identity_crypto_context id_cryptoctx,
665228
+                              pkinit_cert_matching_data ***md_out)
665228
+{
665228
+    krb5_error_code ret;
665228
+    pkinit_cert_matching_data **md_list = NULL;
665228
+    int count, i;
665228
+
665228
+    ret = crypto_cert_get_count(id_cryptoctx, &count);
665228
+    if (ret)
665228
+        goto cleanup;
665228
+
665228
+    md_list = calloc(count + 1, sizeof(*md_list));
665228
+    if (md_list == NULL) {
665228
+        ret = ENOMEM;
665228
+        goto cleanup;
665228
     }
665228
-    return retval;
665228
+
665228
+    for (i = 0; i < count; i++) {
665228
+        ret = get_matching_data(context, plg_cryptoctx, req_cryptoctx,
665228
+                                id_cryptoctx->creds[i]->cert, &md_list[i]);
665228
+        if (ret) {
665228
+            pkiDebug("%s: crypto_cert_get_matching_data error %d, %s\n",
665228
+                     __FUNCTION__, ret, error_message(ret));
665228
+            goto cleanup;
665228
+        }
665228
+    }
665228
+
665228
+    *md_out = md_list;
665228
+    md_list = NULL;
665228
+
665228
+cleanup:
665228
+    crypto_cert_free_matching_data_list(context, md_list);
665228
+    return ret;
665228
 }
665228
 
665228
 /*
665228
- * Free certificate information
665228
+ * Set the certificate in idctx->creds[cred_index] as the selected certificate.
665228
  */
665228
 krb5_error_code
665228
-crypto_cert_free_matching_data(krb5_context context,
665228
-                               pkinit_cert_matching_data *md)
665228
+crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx,
665228
+                   size_t cred_index)
665228
 {
665228
-    krb5_principal p;
665228
-    int i;
665228
+    pkinit_cred_info ci = NULL;
665228
 
665228
-    if (md == NULL)
665228
-        return EINVAL;
665228
-    if (md->subject_dn)
665228
-        free(md->subject_dn);
665228
-    if (md->issuer_dn)
665228
-        free(md->issuer_dn);
665228
-    if (md->sans) {
665228
-        for (i = 0, p = md->sans[i]; p != NULL; p = md->sans[++i])
665228
-            krb5_free_principal(context, p);
665228
-        free(md->sans);
665228
-    }
665228
-    free(md);
665228
-    return 0;
665228
-}
665228
-
665228
-/*
665228
- * Make this matching certificate "the chosen one"
665228
- */
665228
-krb5_error_code
665228
-crypto_cert_select(krb5_context context,
665228
-                   pkinit_cert_matching_data *md)
665228
-{
665228
-    struct _pkinit_cert_data *cd;
665228
-    if (md == NULL)
665228
-        return EINVAL;
665228
-
665228
-    cd = (struct _pkinit_cert_data *)md->ch;
665228
-    if (cd == NULL || cd->magic != CERT_MAGIC)
665228
-        return EINVAL;
665228
+    if (cred_index >= MAX_CREDS_ALLOWED || idctx->creds[cred_index] == NULL)
665228
+        return ENOENT;
665228
 
665228
+    ci = idctx->creds[cred_index];
665228
     /* copy the selected cert into our id_cryptoctx */
665228
-    if (cd->idctx->my_certs != NULL) {
665228
-        sk_X509_pop_free(cd->idctx->my_certs, X509_free);
665228
-    }
665228
-    cd->idctx->my_certs = sk_X509_new_null();
665228
-    sk_X509_push(cd->idctx->my_certs, cd->cred->cert);
665228
-    free(cd->idctx->identity);
665228
+    if (idctx->my_certs != NULL)
665228
+        sk_X509_pop_free(idctx->my_certs, X509_free);
665228
+    idctx->my_certs = sk_X509_new_null();
665228
+    sk_X509_push(idctx->my_certs, ci->cert);
665228
+    free(idctx->identity);
665228
     /* hang on to the selected credential name */
665228
-    if (cd->idctx->creds[cd->index]->name != NULL)
665228
-        cd->idctx->identity = strdup(cd->idctx->creds[cd->index]->name);
665228
+    if (ci->name != NULL)
665228
+        idctx->identity = strdup(ci->name);
665228
     else
665228
-        cd->idctx->identity = NULL;
665228
-    cd->idctx->creds[cd->index]->cert = NULL;       /* Don't free it twice */
665228
-    cd->idctx->cert_index = 0;
665228
+        idctx->identity = NULL;
665228
 
665228
-    if (cd->idctx->pkcs11_method != 1) {
665228
-        cd->idctx->my_key = cd->cred->key;
665228
-        cd->idctx->creds[cd->index]->key = NULL;    /* Don't free it twice */
665228
+    ci->cert = NULL;       /* Don't free it twice */
665228
+    idctx->cert_index = 0;
665228
+    if (idctx->pkcs11_method != 1) {
665228
+        idctx->my_key = ci->key;
665228
+        ci->key = NULL;    /* Don't free it twice */
665228
     }
665228
 #ifndef WITHOUT_PKCS11
665228
     else {
665228
-        cd->idctx->cert_id = cd->cred->cert_id;
665228
-        cd->idctx->creds[cd->index]->cert_id = NULL; /* Don't free it twice */
665228
-        cd->idctx->cert_id_len = cd->cred->cert_id_len;
665228
+        idctx->cert_id = ci->cert_id;
665228
+        ci->cert_id = NULL; /* Don't free it twice */
665228
+        idctx->cert_id_len = ci->cert_id_len;
665228
     }
665228
 #endif
665228
     return 0;
665228
@@ -5380,15 +5312,12 @@ crypto_cert_select_default(krb5_context context,
665228
                            pkinit_identity_crypto_context id_cryptoctx)
665228
 {
665228
     krb5_error_code retval;
665228
-    int cert_count = 0;
665228
+    int cert_count;
665228
 
665228
-    retval = crypto_cert_get_count(context, plg_cryptoctx, req_cryptoctx,
665228
-                                   id_cryptoctx, &cert_count);
665228
-    if (retval) {
665228
-        pkiDebug("%s: crypto_cert_get_count error %d, %s\n",
665228
-                 __FUNCTION__, retval, error_message(retval));
665228
+    retval = crypto_cert_get_count(id_cryptoctx, &cert_count);
665228
+    if (retval)
665228
         goto errout;
665228
-    }
665228
+
665228
     if (cert_count != 1) {
665228
         TRACE_PKINIT_NO_DEFAULT_CERT(context, cert_count);
665228
         retval = EINVAL;
665228
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
665228
index 2fe357c5e..7411348fa 100644
665228
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
665228
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
665228
@@ -115,23 +115,4 @@ struct _pkinit_req_crypto_context {
665228
     DH *dh;
665228
 };
665228
 
665228
-#define CERT_MAGIC 0x53534c43
665228
-struct _pkinit_cert_data {
665228
-    unsigned int magic;
665228
-    pkinit_plg_crypto_context plgctx;
665228
-    pkinit_req_crypto_context reqctx;
665228
-    pkinit_identity_crypto_context idctx;
665228
-    pkinit_cred_info cred;
665228
-    unsigned int index;	    /* Index of this cred in the creds[] array */
665228
-};
665228
-
665228
-#define ITER_MAGIC 0x53534c49
665228
-struct _pkinit_cert_iter_data {
665228
-    unsigned int magic;
665228
-    pkinit_plg_crypto_context plgctx;
665228
-    pkinit_req_crypto_context reqctx;
665228
-    pkinit_identity_crypto_context idctx;
665228
-    unsigned int index;
665228
-};
665228
-
665228
 #endif	/* _PKINIT_CRYPTO_OPENSSL_H */
665228
diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c
665228
index cad4c2b9a..d6775dc4f 100644
665228
--- a/src/plugins/preauth/pkinit/pkinit_matching.c
665228
+++ b/src/plugins/preauth/pkinit/pkinit_matching.c
665228
@@ -544,7 +544,7 @@ check_all_certs(krb5_context context,
665228
                 rule_set *rs,   /* rule to check */
665228
                 pkinit_cert_matching_data **matchdata,
665228
                 int *match_found,
665228
-                pkinit_cert_matching_data **matching_cert)
665228
+                size_t *match_index)
665228
 {
665228
     krb5_error_code retval;
665228
     pkinit_cert_matching_data *md;
665228
@@ -553,12 +553,12 @@ check_all_certs(krb5_context context,
665228
     int total_cert_matches = 0;
665228
     rule_component *rc;
665228
     int certs_checked = 0;
665228
-    pkinit_cert_matching_data *save_match = NULL;
665228
+    size_t save_index = 0;
665228
 
665228
-    if (match_found == NULL || matching_cert == NULL)
665228
+    if (match_found == NULL || match_index == NULL)
665228
         return EINVAL;
665228
 
665228
-    *matching_cert = NULL;
665228
+    *match_index = 0;
665228
     *match_found = 0;
665228
 
665228
     pkiDebug("%s: matching rule relation is %s with %d components\n",
665228
@@ -590,7 +590,7 @@ check_all_certs(krb5_context context,
665228
                 pkiDebug("%s: cert matches rule (OR relation)\n",
665228
                          __FUNCTION__);
665228
                 total_cert_matches++;
665228
-                save_match = md;
665228
+                save_index = i;
665228
                 goto nextcert;
665228
             }
665228
             if (!comp_match && rs->relation == relation_and) {
665228
@@ -602,7 +602,7 @@ check_all_certs(krb5_context context,
665228
         if (rc == NULL && comp_match) {
665228
             pkiDebug("%s: cert matches rule (AND relation)\n", __FUNCTION__);
665228
             total_cert_matches++;
665228
-            save_match = md;
665228
+            save_index = i;
665228
         }
665228
     nextcert:
665228
         continue;
665228
@@ -611,7 +611,7 @@ check_all_certs(krb5_context context,
665228
              __FUNCTION__, certs_checked, total_cert_matches);
665228
     if (total_cert_matches == 1) {
665228
         *match_found = 1;
665228
-        *matching_cert = save_match;
665228
+        *match_index = save_index;
665228
     }
665228
 
665228
     retval = 0;
665228
@@ -621,111 +621,6 @@ check_all_certs(krb5_context context,
665228
     return retval;
665228
 }
665228
 
665228
-static krb5_error_code
665228
-free_all_cert_matching_data(krb5_context context,
665228
-                            pkinit_cert_matching_data **matchdata)
665228
-{
665228
-    krb5_error_code retval;
665228
-    pkinit_cert_matching_data *md;
665228
-    int i;
665228
-
665228
-    if (matchdata == NULL)
665228
-        return EINVAL;
665228
-
665228
-    for (i = 0, md = matchdata[i]; md != NULL; md = matchdata[++i]) {
665228
-        pkinit_cert_handle ch = md->ch;
665228
-        retval = crypto_cert_free_matching_data(context, md);
665228
-        if (retval) {
665228
-            pkiDebug("%s: crypto_cert_free_matching_data error %d, %s\n",
665228
-                     __FUNCTION__, retval, error_message(retval));
665228
-            goto cleanup;
665228
-        }
665228
-        retval = crypto_cert_release(context, ch);
665228
-        if (retval) {
665228
-            pkiDebug("%s: crypto_cert_release error %d, %s\n",
665228
-                     __FUNCTION__, retval, error_message(retval));
665228
-            goto cleanup;
665228
-        }
665228
-    }
665228
-    free(matchdata);
665228
-    retval = 0;
665228
-
665228
-cleanup:
665228
-    return retval;
665228
-}
665228
-
665228
-static krb5_error_code
665228
-obtain_all_cert_matching_data(krb5_context context,
665228
-                              pkinit_plg_crypto_context plg_cryptoctx,
665228
-                              pkinit_req_crypto_context req_cryptoctx,
665228
-                              pkinit_identity_crypto_context id_cryptoctx,
665228
-                              pkinit_cert_matching_data ***all_matching_data)
665228
-{
665228
-    krb5_error_code retval;
665228
-    int i, cert_count;
665228
-    pkinit_cert_iter_handle ih = NULL;
665228
-    pkinit_cert_handle ch;
665228
-    pkinit_cert_matching_data **matchdata = NULL;
665228
-
665228
-    retval = crypto_cert_get_count(context, plg_cryptoctx, req_cryptoctx,
665228
-                                   id_cryptoctx, &cert_count);
665228
-    if (retval) {
665228
-        pkiDebug("%s: crypto_cert_get_count error %d, %s\n",
665228
-                 __FUNCTION__, retval, error_message(retval));
665228
-        goto cleanup;
665228
-    }
665228
-
665228
-    pkiDebug("%s: crypto_cert_get_count says there are %d certs\n",
665228
-             __FUNCTION__, cert_count);
665228
-
665228
-    matchdata = calloc((size_t)cert_count + 1, sizeof(*matchdata));
665228
-    if (matchdata == NULL)
665228
-        return ENOMEM;
665228
-
665228
-    retval = crypto_cert_iteration_begin(context, plg_cryptoctx, req_cryptoctx,
665228
-                                         id_cryptoctx, &ih;;
665228
-    if (retval) {
665228
-        pkiDebug("%s: crypto_cert_iteration_begin returned %d, %s\n",
665228
-                 __FUNCTION__, retval, error_message(retval));
665228
-        goto cleanup;
665228
-    }
665228
-
665228
-    for (i = 0; i < cert_count; i++) {
665228
-        retval = crypto_cert_iteration_next(context, ih, &ch);
665228
-        if (retval) {
665228
-            if (retval == PKINIT_ITER_NO_MORE)
665228
-                pkiDebug("%s: We thought there were %d certs, but "
665228
-                         "crypto_cert_iteration_next stopped after %d?\n",
665228
-                         __FUNCTION__, cert_count, i);
665228
-            else
665228
-                pkiDebug("%s: crypto_cert_iteration_next error %d, %s\n",
665228
-                         __FUNCTION__, retval, error_message(retval));
665228
-            goto cleanup;
665228
-        }
665228
-
665228
-        retval = crypto_cert_get_matching_data(context, ch, &matchdata[i]);
665228
-        if (retval) {
665228
-            pkiDebug("%s: crypto_cert_get_matching_data error %d, %s\n",
665228
-                     __FUNCTION__, retval, error_message(retval));
665228
-            goto cleanup;
665228
-        }
665228
-
665228
-    }
665228
-
665228
-    *all_matching_data = matchdata;
665228
-    retval = 0;
665228
-cleanup:
665228
-    if (ih != NULL)
665228
-        crypto_cert_iteration_end(context, ih);
665228
-    if (retval) {
665228
-        if (matchdata != NULL)
665228
-            free_all_cert_matching_data(context, matchdata);
665228
-    }
665228
-    pkiDebug("%s: returning %d, certinfo %p\n",
665228
-             __FUNCTION__, retval, *all_matching_data);
665228
-    return retval;
665228
-}
665228
-
665228
 krb5_error_code
665228
 pkinit_cert_matching(krb5_context context,
665228
                      pkinit_plg_crypto_context plg_cryptoctx,
665228
@@ -740,7 +635,7 @@ pkinit_cert_matching(krb5_context context,
665228
     rule_set *rs = NULL;
665228
     int match_found = 0;
665228
     pkinit_cert_matching_data **matchdata = NULL;
665228
-    pkinit_cert_matching_data *the_matching_cert = NULL;
665228
+    size_t match_index = 0;
665228
 
665228
     /* If no matching rules, select the default cert and we're done */
665228
     pkinit_libdefault_strings(context, krb5_princ_realm(context, princ),
665228
@@ -777,7 +672,7 @@ pkinit_cert_matching(krb5_context context,
665228
          * until we are done.
665228
          */
665228
         if (matchdata == NULL) {
665228
-            retval = obtain_all_cert_matching_data(context, plg_cryptoctx,
665228
+            retval = crypto_cert_get_matching_data(context, plg_cryptoctx,
665228
                                                    req_cryptoctx, id_cryptoctx,
665228
                                                    &matchdata);
665228
             if (retval || matchdata == NULL) {
665228
@@ -790,7 +685,7 @@ pkinit_cert_matching(krb5_context context,
665228
 
665228
         retval = check_all_certs(context, plg_cryptoctx, req_cryptoctx,
665228
                                  id_cryptoctx, princ, rs, matchdata,
665228
-                                 &match_found, &the_matching_cert);
665228
+                                 &match_found, &match_index);
665228
         if (retval) {
665228
             pkiDebug("%s: Error %d, checking certs against rule '%s'\n",
665228
                      __FUNCTION__, retval, rules[x]);
665228
@@ -803,9 +698,9 @@ pkinit_cert_matching(krb5_context context,
665228
         }
665228
     }
665228
 
665228
-    if (match_found && the_matching_cert != NULL) {
665228
+    if (match_found) {
665228
         pkiDebug("%s: Selecting the matching cert!\n", __FUNCTION__);
665228
-        retval = crypto_cert_select(context, the_matching_cert);
665228
+        retval = crypto_cert_select(context, id_cryptoctx, match_index);
665228
         if (retval) {
665228
             pkiDebug("%s: crypto_cert_select error %d, %s\n",
665228
                      __FUNCTION__, retval, error_message(retval));
665228
@@ -818,12 +713,10 @@ pkinit_cert_matching(krb5_context context,
665228
     }
665228
 
665228
     retval = 0;
665228
+
665228
 cleanup:
665228
-    if (rules != NULL)
665228
-        profile_free_list(rules);
665228
-    if (rs != NULL)
665228
-        free_rule_set(context, rs);
665228
-    if (matchdata != NULL)
665228
-        free_all_cert_matching_data(context, matchdata);
665228
+    profile_free_list(rules);
665228
+    free_rule_set(context, rs);
665228
+    crypto_cert_free_matching_data_list(context, matchdata);
665228
     return retval;
665228
 }