This commit adds a thread safe MEMORY keytab implementation

	that is compatible with Heimdal 0.7.  Each successful resolve
	returns a handle to a keytab and increases the internal 
	reference count.  Each close invalidates the handle and 
	decreases the reference count.  When the reference count hits
	zero, the keytab is destroyed.

	When a kt_destroy function is added, the automatic destruction
	after close behavior will be removed.

ticket: 5411

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19126 dc483132-0cff-0310-8789-dd5450dbe970

5 files changed, 720 insertions, 11 deletions

diff --git a/src/lib/krb5/keytab/Makefile.in b/src/lib/krb5/keytab/Makefile.in
index 2fcfbaa068..806719053f 100644
--- a/src/lib/krb5/keytab/Makefile.in
+++ b/src/lib/krb5/keytab/Makefile.in
@@ -16,6 +16,7 @@ STLIBOBJS= \
 	ktremove.o	\
 	ktfns.o		\
 	kt_file.o	\
+	kt_memory.o	\
 	kt_srvtab.o	\
 	read_servi.o
 
@@ -27,6 +28,7 @@ OBJS=	\
 	$(OUTPRE)ktremove.$(OBJEXT)	\
 	$(OUTPRE)ktfns.$(OBJEXT)	\
 	$(OUTPRE)kt_file.$(OBJEXT)	\
+	$(OUTPRE)kt_memory.$(OBJEXT)	\
 	$(OUTPRE)kt_srvtab.$(OBJEXT)	\
 	$(OUTPRE)read_servi.$(OBJEXT)
 
@@ -38,6 +40,7 @@ SRCS=	\
 	$(srcdir)/ktremove.c	\
 	$(srcdir)/ktfns.c	\
 	$(srcdir)/kt_file.c	\
+	$(srcdir)/kt_memory.c	\
 	$(srcdir)/kt_srvtab.c	\
 	$(srcdir)/read_servi.c
 
@@ -121,6 +124,14 @@ kt_file.so kt_file.po $(OUTPRE)kt_file.$(OBJEXT): $(BUILDTOP)/include/autoconf.h
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
   $(SRCTOP)/include/socket-utils.h kt_file.c
+kt_memory.so kt_memory.po $(OUTPRE)kt_memory.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h \
+  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h kt_memory.c
 kt_srvtab.so kt_srvtab.po $(OUTPRE)kt_srvtab.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
diff --git a/src/lib/krb5/keytab/kt-int.h b/src/lib/krb5/keytab/kt-int.h
index 23bbc55057..e62b2d3f1b 100644
--- a/src/lib/krb5/keytab/kt-int.h
+++ b/src/lib/krb5/keytab/kt-int.h
@@ -36,4 +36,7 @@ int krb5int_kt_initialize(void);
 
 void krb5int_kt_finalize(void);
 
+int krb5int_mkt_initialize(void);
+
+void krb5int_mkt_finalize(void);
 #endif /* __KRB5_KEYTAB_INT_H__ */
diff --git a/src/lib/krb5/keytab/kt_memory.c b/src/lib/krb5/keytab/kt_memory.c
new file mode 100644
index 0000000000..76aa31cbf4
--- /dev/null
+++ b/src/lib/krb5/keytab/kt_memory.c
@@ -0,0 +1,654 @@
+/*

+ * lib/krb5/keytab/kt_memory.c

+ *

+ * Copyright 2007 by Secure Endpoints Inc.

+ *

+ * Permission is hereby granted, free of charge, to any person

+ * obtaining a copy of this software and associated documentation files

+ * (the "Software"), to deal in the Software without restriction,

+ * including without limitation the rights to use, copy, modify, merge,

+ * publish, distribute, sublicense, and/or sell copies of the Software,

+ * and to permit persons to whom the Software is furnished to do so,

+ * subject to the following conditions:

+ *

+ * The above copyright notice and this permission notice shall be

+ * included in all copies or substantial portions of the Software.

+ *

+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

+ * SOFTWARE.

+ */

+

+#include "k5-int.h"

+#include <stdio.h>

+

+#define HEIMDAL_COMPATIBLE

+

+/*

+ * Information needed by internal routines of the file-based ticket

+ * cache implementation.

+ */

+

+

+/*

+ * Constants

+ */

+#define IGNORE_VNO 0

+#define IGNORE_ENCTYPE 0

+

+/* 

+ * Types

+ */

+/* From krb5.h: 

+ * typedef struct krb5_keytab_entry_st {

+ *    krb5_magic magic;

+ *    krb5_principal principal;    principal of this key

+ *    krb5_timestamp timestamp;    time entry written to keytable 

+ *    krb5_kvno vno;               key version number 

+ *    krb5_keyblock key;           the secret key

+ *} krb5_keytab_entry;

+ */

+

+/* Individual key entries within a table, in a linked list */

+typedef struct _krb5_mkt_link {

+    struct _krb5_mkt_link *next;

+    krb5_keytab_entry *entry;

+} krb5_mkt_link, *krb5_mkt_cursor;

+

+/* Per-keytab data header */

+typedef struct _krb5_mkt_data {

+    char 	       *name;		/* Name of the keytab */

+    k5_mutex_t 		lock;		/* Thread-safety - all but link */

+    krb5_int32		refcount;	

+    krb5_mkt_cursor	link;

+} krb5_mkt_data;

+

+/* List of memory key tables */

+typedef struct _krb5_mkt_list_node {

+    struct _krb5_mkt_list_node *next;

+    krb5_keytab keytab;

+} krb5_mkt_list_node;

+

+/* Iterator over memory key tables */

+typedef struct _krb5_mkt_ptcursor_data {

+    struct _krb5_mkt_list_node *cur;

+} krb5_mkt_ptcursor_data;

+

+/* 

+ * Globals 

+ */

+static krb5_mkt_list_node * krb5int_mkt_list = NULL;

+static k5_mutex_t krb5int_mkt_mutex = K5_MUTEX_PARTIAL_INITIALIZER;

+

+/*

+ * Macros

+ */

+#define KTLOCK(id) k5_mutex_lock(&(((krb5_mkt_data *)(id)->data)->lock))

+#define KTUNLOCK(id) k5_mutex_unlock(&(((krb5_mkt_data *)(id)->data)->lock))

+#define KTCHECKLOCK(id) k5_mutex_assert_locked(&(((krb5_mkt_data *)(id)->data)->lock))

+

+#define KTGLOCK k5_mutex_lock(&krb5int_mkt_mutex)

+#define KTGUNLOCK k5_mutex_unlock(&krb5int_mkt_mutex)

+#define KTGCHECKLOCK k5_mutex_assert_locked(&krb5int_mkt_mutex)

+

+#define KTLINK(id) (((krb5_mkt_data *)(id)->data)->link)

+#define KTREFCNT(id) (((krb5_mkt_data *)(id)->data)->refcount)

+#define KTNAME(id) (((krb5_mkt_data *)(id)->data)->name)

+

+extern const struct _krb5_kt_ops krb5_mkt_ops;

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_resolve 

+	(krb5_context,

+		   const char *,

+		   krb5_keytab *);

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_get_name 

+	(krb5_context,

+		   krb5_keytab,

+		   char *,

+		   unsigned int);

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_close 

+	(krb5_context,

+		   krb5_keytab);

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_get_entry 

+	(krb5_context,

+		   krb5_keytab,

+		   krb5_const_principal,

+		   krb5_kvno,

+		   krb5_enctype,

+		   krb5_keytab_entry *);

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_start_seq_get 

+	(krb5_context,

+		   krb5_keytab,

+		   krb5_kt_cursor *);

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_get_next 

+	(krb5_context,

+		   krb5_keytab,

+		   krb5_keytab_entry *,

+		   krb5_kt_cursor *);

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_end_get 

+	(krb5_context,

+		   krb5_keytab,

+		   krb5_kt_cursor *);

+

+/* routines to be included on extended version (write routines) */

+krb5_error_code KRB5_CALLCONV krb5_mkt_add 

+	(krb5_context,

+		   krb5_keytab,

+		   krb5_keytab_entry *);

+

+krb5_error_code KRB5_CALLCONV krb5_mkt_remove 

+	(krb5_context,

+		   krb5_keytab,

+		   krb5_keytab_entry *);

+

+int krb5int_mkt_initialize(void) {

+    return k5_mutex_finish_init(&krb5int_mkt_mutex);

+}

+

+void krb5int_mkt_finalize(void) {

+    krb5_mkt_list_node *node, *next_node;

+    krb5_mkt_cursor cursor, next_cursor;

+

+    k5_mutex_destroy(&krb5int_mkt_mutex);

+

+    for (node = krb5int_mkt_list; node; node = next_node) {

+	next_node = node->next;

+

+	/* destroy the contents of node->keytab */

+	krb5_xfree(KTNAME(node->keytab));

+

+	/* free the keytab entries */

+	for (cursor = KTLINK(node->keytab); cursor; cursor = next_cursor) {

+	    next_cursor = cursor->next;

+	    /* the call to krb5_kt_free_entry uses a NULL in place of the

+ 	     * krb5_context since we know that the context isn't used by

+	     * krb5_kt_free_entry or krb5_free_principal. */

+	    krb5_kt_free_entry(NULL, cursor->entry);

+	    krb5_xfree(cursor);

+	}

+

+	/* destroy the lock */

+	k5_mutex_destroy(&(((krb5_mkt_data *)node->keytab->data)->lock));

+

+	/* free the private data */

+	krb5_xfree(node->keytab->data);

+

+	/* and the keytab */

+	krb5_xfree(node->keytab);

+

+	/* and finally the node */

+	krb5_xfree(node);

+    }

+}

+/*

+ * This is an implementation specific resolver.  It returns a keytab 

+ * initialized with memory keytab routines.

+ */

+

+krb5_error_code KRB5_CALLCONV 

+krb5_mkt_resolve(krb5_context context, const char *name, krb5_keytab *id)

+{

+    krb5_mkt_data *data;

+    krb5_mkt_list_node *list;

+    krb5_error_code err = 0;

+

+    /* First determine if a memory keytab of this name already exists */

+    err = KTGLOCK;

+    if (err)

+	return(err);

+

+    for (list = krb5int_mkt_list; list; list = list->next)

+    {

+    	if (strcmp(name,KTNAME(list->keytab)) == 0) {

+	    /* Found */

+	    *id = list->keytab;

+	    goto done;

+	}

+    }

+

+    /* We will now create the new key table with the specified name.

+     * We do not drop the global lock, therefore the name will indeed

+     * be unique when we add it.

+     */

+

+    if ((list = (krb5_mkt_list_node *)malloc(sizeof(krb5_mkt_list_node))) == NULL) {

+	err = ENOMEM;

+	goto done;

+    }

+

+    if ((list->keytab = (krb5_keytab)malloc(sizeof(struct _krb5_kt))) == NULL) {

+	krb5_xfree(list);

+	err = ENOMEM;

+	goto done;	

+    }

+

+    list->keytab->ops = &krb5_mkt_ops;

+    if ((data = (krb5_mkt_data *)malloc(sizeof(krb5_mkt_data))) == NULL) {

+	krb5_xfree(list->keytab);

+	krb5_xfree(list);

+	err = ENOMEM;

+	goto done;

+    }

+

+    err = k5_mutex_init(&data->lock);

+    if (err) {

+	krb5_xfree(data);

+	krb5_xfree(list->keytab);

+	krb5_xfree(list);

+	goto done;

+    }

+

+    if ((data->name = (char *)calloc(strlen(name) + 1, sizeof(char))) == NULL) {

+	k5_mutex_destroy(&data->lock);

+	krb5_xfree(data);

+	krb5_xfree(list->keytab);

+	krb5_xfree(list);

+	err = ENOMEM;

+	goto done;

+    }

+

+    (void) strcpy(data->name, name);

+

+    data->link = NULL;

+    data->refcount = 0;

+    list->keytab->data = (krb5_pointer)data;

+    list->keytab->magic = KV5M_KEYTAB;

+

+    list->next = krb5int_mkt_list;

+    krb5int_mkt_list = list;

+

+    *id = list->keytab;

+

+  done:

+    err = KTLOCK(*id);

+    if (err) {

+	k5_mutex_destroy(&data->lock);

+     	krb5_xfree(data->name);

+	krb5_xfree(data);

+	krb5_xfree(list->keytab);

+	krb5_xfree(list);

+    } else {

+	KTREFCNT(*id)++;

+	KTUNLOCK(*id);

+    }

+

+    KTGUNLOCK;

+    return(err);

+}

+

+

+/*

+ * "Close" a memory-based keytab.  This is effectively a no-op.

+ * We check to see if the keytab exists and that is about it.

+ * Closing a file keytab does not destroy the contents.  Closing

+ * a memory keytab shouldn't either.

+ */

+

+krb5_error_code KRB5_CALLCONV 

+krb5_mkt_close(krb5_context context, krb5_keytab id)

+{

+    krb5_mkt_list_node **listp;

+#ifdef HEIMDAL_COMPATIBLE

+    krb5_mkt_list_node *node;

+    krb5_mkt_data * data;

+#endif

+    krb5_error_code err = 0;

+

+    /* First determine if a memory keytab of this name already exists */

+    err = KTGLOCK;

+    if (err)

+	return(err);

+    

+    for (listp = &krb5int_mkt_list; *listp; listp = &((*listp)->next))

+    {

+    	if (id == (*listp)->keytab) {

+	    /* Found */

+	    break;

+	}

+    }

+

+    if (*listp == NULL) {

+	/* The specified keytab could not be found */

+	err = KRB5_KT_NOTFOUND;

+	goto done;

+    }

+

+    /* reduce the refcount and return */

+    err = KTLOCK(id);

+    if (err)

+	goto done;

+

+    KTREFCNT(id)--;

+    KTUNLOCK(id);

+

+#ifdef HEIMDAL_COMPATIBLE

+    /* In Heimdal if the refcount hits 0, the MEMORY keytab is 

+     * destroyed since there is no krb5_kt_destroy function.

+     * There is no need to lock the entry while performing 

+     * these operations as the refcount will be 0 and we are

+     * holding the global lock.

+     */

+    data = (krb5_mkt_data *)id->data;

+    if (data->refcount == 0) {

+	krb5_mkt_cursor cursor, next_cursor;

+

+	node = *listp;

+	*listp = node->next;

+

+	/* destroy the contents of node->keytab (aka id) */

+	krb5_xfree(data->name);

+

+	/* free the keytab entries */

+	for (cursor = KTLINK(node->keytab); cursor; cursor = next_cursor) {

+	    next_cursor = cursor->next;

+

+	    krb5_kt_free_entry(context, cursor->entry);

+	    krb5_xfree(cursor);

+	}

+

+	/* destroy the lock */

+	k5_mutex_destroy(&(data->lock));

+

+	/* free the private data */

+	krb5_xfree(data);

+

+	/* and the keytab */

+	krb5_xfree(node->keytab);

+

+	/* and finally the node */

+	krb5_xfree(node);

+    }

+#endif /* HEIMDAL_COMPATIBLE */

+

+  done:

+    KTGUNLOCK;

+    return(err);

+}

+

+/*

+ * This is the get_entry routine for the memory based keytab implementation.

+ * It either retrieves the entry or returns an error.

+ */

+

+krb5_error_code KRB5_CALLCONV

+krb5_mkt_get_entry(krb5_context context, krb5_keytab id,

+		      krb5_const_principal principal, krb5_kvno kvno,

+		      krb5_enctype enctype, krb5_keytab_entry *out_entry)

+{

+    krb5_mkt_cursor   cursor;

+    krb5_keytab_entry *entry, *match = NULL;

+    krb5_error_code err = 0;

+    int found_wrong_kvno = 0;

+    krb5_boolean similar = 0;

+

+    err = KTLOCK(id);

+    if (err)

+	return err;

+

+    for (cursor = KTLINK(id); cursor && cursor->entry; cursor = cursor->next) {

+	entry = cursor->entry;

+

+	/* if the principal isn't the one requested, free new_entry

+	   and continue to the next. */

+

+	if (!krb5_principal_compare(context, principal, entry->principal))

+	    continue;

+

+	/* if the enctype is not ignored and doesn't match, free new_entry

+	   and continue to the next */

+	if (enctype != IGNORE_ENCTYPE) {

+	    if ((err = krb5_c_enctype_compare(context, enctype, 

+					      entry->key.enctype,

+					       &similar))) {

+		/* we can't determine the enctype of the entry */

+		continue;

+	    }

+

+	    if (!similar)

+		continue;

+	}

+

+	if (kvno == IGNORE_VNO) {

+	    if (match == NULL)

+		match = entry;

+	    else if (entry->vno > match->vno)

+		match = entry;

+	} else {

+	    if (entry->vno == kvno) {

+		match = entry;

+		break;

+	    } else {

+		found_wrong_kvno++;

+	    }

+	}

+    }

+

+    /* if we found an entry that matches, ... */

+    if (match) { 

+	out_entry->magic = entry->magic;

+	out_entry->timestamp = entry->timestamp;

+	out_entry->vno = entry->vno;

+	out_entry->key = entry->key; 

+	/*

+	 * Coerce the enctype of the output keyblock in case we

+	 * got an inexact match on the enctype.

+	 */

+	out_entry->key.enctype = enctype;

+	err = krb5_copy_principal(context, entry->principal, &(out_entry->principal));

+    } else {

+	if (!err)

+	    err = found_wrong_kvno ? KRB5_KT_KVNONOTFOUND : KRB5_KT_NOTFOUND;

+    }

+

+    KTUNLOCK(id);

+    return(err);

+}

+

+/*

+ * Get the name of the memory-based keytab.

+ */

+

+krb5_error_code KRB5_CALLCONV

+krb5_mkt_get_name(krb5_context context, krb5_keytab id, char *name, unsigned int len)

+{

+    memset(name, 0, len);

+

+    if (len < strlen(id->ops->prefix)+2)

+	return(KRB5_KT_NAME_TOOLONG);

+    strcpy(name, id->ops->prefix);

+    name += strlen(id->ops->prefix);

+    name[0] = ':';

+    name++;

+    len -= strlen(id->ops->prefix)+1;

+

+    if (len < strlen(KTNAME(id)+1))

+	return(KRB5_KT_NAME_TOOLONG);

+    strcpy(name, KTNAME(id));

+    /* strcpy will NUL-terminate the destination */

+

+    return(0);

+}

+

+/*

+ * krb5_mkt_start_seq_get()

+ */

+

+krb5_error_code KRB5_CALLCONV

+krb5_mkt_start_seq_get(krb5_context context, krb5_keytab id, krb5_kt_cursor *cursorp)

+{

+    krb5_error_code err = 0;

+

+    err = KTLOCK(id);

+    if (err)

+	return(err);

+

+    *cursorp = (krb5_kt_cursor)KTLINK(id);

+    KTUNLOCK(id);

+

+    return(0);

+}

+

+/*

+ * krb5_mkt_get_next()

+ */

+

+krb5_error_code KRB5_CALLCONV 

+krb5_mkt_get_next(krb5_context context, krb5_keytab id, krb5_keytab_entry *entry, krb5_kt_cursor *cursor)

+{

+    krb5_mkt_cursor mkt_cursor = (krb5_mkt_cursor)*cursor;

+    krb5_error_code err = 0;

+

+    err = KTLOCK(id);

+    if (err)

+	return err;

+

+    if (mkt_cursor == NULL) {

+	KTUNLOCK(id);

+	return KRB5_KT_END;

+    }

+

+    entry->magic = mkt_cursor->entry->magic;

+    entry->timestamp = mkt_cursor->entry->timestamp;

+    entry->vno = mkt_cursor->entry->vno;

+    entry->key = mkt_cursor->entry->key; 

+    err = krb5_copy_principal(context, mkt_cursor->entry->principal, &(entry->principal));

+    if (!err)

+	*cursor = (krb5_kt_cursor *)mkt_cursor->next;

+    KTUNLOCK(id);

+    return(err);

+}

+

+/*

+ * krb5_mkt_end_get()

+ */

+

+krb5_error_code KRB5_CALLCONV 

+krb5_mkt_end_get(krb5_context context, krb5_keytab id, krb5_kt_cursor *cursor)

+{

+    *cursor = NULL;

+    return(0);

+}

+

+

+/*

+ * krb5_mkt_add()

+ */

+

+krb5_error_code KRB5_CALLCONV 

+krb5_mkt_add(krb5_context context, krb5_keytab id, krb5_keytab_entry *entry)

+{

+    krb5_error_code err = 0;

+    krb5_mkt_cursor cursor;

+

+    err = KTLOCK(id);

+    if (err)

+	return err;

+

+    cursor = (krb5_mkt_cursor)malloc(sizeof(krb5_mkt_link));

+    if (cursor == NULL) {

+	err = ENOMEM;

+	goto done;

+    }

+    cursor->entry = (krb5_keytab_entry *)malloc(sizeof(krb5_keytab_entry));

+    if (cursor->entry == NULL) {

+	krb5_xfree(cursor);

+	err = ENOMEM;

+	goto done;

+    }

+    cursor->entry->magic = entry->magic;

+    cursor->entry->timestamp = entry->timestamp;

+    cursor->entry->vno = entry->vno;

+    cursor->entry->key = entry->key; 

+    err = krb5_copy_principal(context, entry->principal, &(cursor->entry->principal));

+    if (err) {

+	krb5_xfree(cursor->entry);

+	krb5_xfree(cursor);

+	goto done;

+    }

+

+    if (KTLINK(id) == NULL) {

+	cursor->next = NULL;

+	KTLINK(id) = cursor;

+    } else {

+	cursor->next = KTLINK(id);

+	KTLINK(id) = cursor;

+    }

+

+  done:

+    KTUNLOCK(id);

+    return err;

+}

+

+/*

+ * krb5_mkt_remove()

+ */

+

+krb5_error_code KRB5_CALLCONV 

+krb5_mkt_remove(krb5_context context, krb5_keytab id, krb5_keytab_entry *entry)

+{

+    krb5_mkt_cursor *pcursor, next;

+    krb5_error_code err = 0;

+

+    err = KTLOCK(id);

+    if (err)

+	return err;

+

+    if ( KTLINK(id) == NULL ) {

+	err = KRB5_KT_NOTFOUND;

+	goto done;

+    }

+	

+    for ( pcursor = &KTLINK(id); *pcursor; pcursor = &(*pcursor)->next ) {

+	if ( (*pcursor)->entry->vno == entry->vno &&

+	     (*pcursor)->entry->key.enctype == entry->key.enctype &&

+	     krb5_principal_compare(context, (*pcursor)->entry->principal, entry->principal))

+	     break;

+    }

+

+    if (!*pcursor) {

+	err = KRB5_KT_NOTFOUND;

+	goto done;

+    }

+

+    krb5_kt_free_entry(context, (*pcursor)->entry);

+    krb5_xfree((*pcursor)->entry);

+    next = (*pcursor)->next;

+    krb5_xfree(*pcursor);

+    (*pcursor) = next;

+

+  done:

+    KTUNLOCK(id);

+    return err;

+}

+

+

+/*

+ * krb5_mkt_ops

+ */

+

+const struct _krb5_kt_ops krb5_mkt_ops = {

+    0,

+    "MEMORY", 	/* Prefix -- this string should not appear anywhere else! */

+    krb5_mkt_resolve,

+    krb5_mkt_get_name, 

+    krb5_mkt_close,

+    krb5_mkt_get_entry,

+    krb5_mkt_start_seq_get,

+    krb5_mkt_get_next,

+    krb5_mkt_end_get,

+    krb5_mkt_add,

+    krb5_mkt_remove,

+    NULL

+};

+

diff --git a/src/lib/krb5/keytab/ktbase.c b/src/lib/krb5/keytab/ktbase.c
index 79c9151efd..3e4f6a6be6 100644
--- a/src/lib/krb5/keytab/ktbase.c
+++ b/src/lib/krb5/keytab/ktbase.c
@@ -24,6 +24,28 @@
  * or implied warranty.
  * 
  *
+ * Copyright 2007 by Secure Endpoints Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
  * Registration functions for keytab.
  */
 
@@ -34,41 +56,60 @@
 extern const krb5_kt_ops krb5_ktf_ops;
 extern const krb5_kt_ops krb5_ktf_writable_ops;
 extern const krb5_kt_ops krb5_kts_ops;
+extern const krb5_kt_ops krb5_mkt_ops;
 
 struct krb5_kt_typelist {
     const krb5_kt_ops *ops;
     const struct krb5_kt_typelist *next;
 };
+const static struct krb5_kt_typelist krb5_kt_typelist_srvtab = {
+    &krb5_kts_ops,
+    NULL
+};
+const static struct krb5_kt_typelist krb5_kt_typelist_memory = {
+    &krb5_mkt_ops,
+    &krb5_kt_typelist_srvtab
+};
 const static struct krb5_kt_typelist krb5_kt_typelist_wrfile  = {
     &krb5_ktf_writable_ops,
-    0
+    &krb5_kt_typelist_memory
 };
 const static struct krb5_kt_typelist krb5_kt_typelist_file  = {
     &krb5_ktf_ops,
     &krb5_kt_typelist_wrfile
 };
-const static struct krb5_kt_typelist krb5_kt_typelist_srvtab = {
-    &krb5_kts_ops,
-    &krb5_kt_typelist_file
-};
-static const struct krb5_kt_typelist *kt_typehead = &krb5_kt_typelist_srvtab;
+
+static const struct krb5_kt_typelist *kt_typehead = &krb5_kt_typelist_file;
 /* Lock for protecting the type list.  */
 static k5_mutex_t kt_typehead_lock = K5_MUTEX_PARTIAL_INITIALIZER;
 
 int krb5int_kt_initialize(void)
 {
-    return k5_mutex_finish_init(&kt_typehead_lock);
+    int err;
+
+    err = k5_mutex_finish_init(&kt_typehead_lock);
+    if (err)
+	goto done;
+    err = krb5int_mkt_initialize();
+    if (err)
+	goto done;
+
+  done:
+    return(err);
 }
 
 void
 krb5int_kt_finalize(void)
 {
-    struct krb5_kt_typelist *t, *t_next;
+    const struct krb5_kt_typelist *t, *t_next;
+
     k5_mutex_destroy(&kt_typehead_lock);
-    for (t = kt_typehead; t != &krb5_kt_typelist_srvtab; t = t_next) {
+    for (t = kt_typehead; t != &krb5_kt_typelist_file; t = t_next) {
 	t_next = t->next;
-	free(t);
+	free((struct krb5_kt_typelist *)t);
     }
+
+    krb5int_mkt_finalize();
 }
 
 
diff --git a/src/lib/krb5/keytab/ktfr_entry.c b/src/lib/krb5/keytab/ktfr_entry.c
index a86b38bc2d..b4305e21af 100644
--- a/src/lib/krb5/keytab/ktfr_entry.c
+++ b/src/lib/krb5/keytab/ktfr_entry.c
@@ -37,7 +37,7 @@ krb5_free_keytab_entry_contents (krb5_context context, krb5_keytab_entry *entry)
     
     krb5_free_principal(context, entry->principal);
     if (entry->key.contents) {
-	memset((char *)entry->key.contents, 0, entry->key.length);
+	zap((char *)entry->key.contents, entry->key.length);
 	krb5_xfree(entry->key.contents);
     }
     return 0;