[26140] in CVS-changelog-for-Kerberos-V5
svn rev #25480: trunk/src/ kadmin/cli/ plugins/kdb/ldap/libkdb_ldap/
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Sun Nov 20 00:19:47 2011
Date: Sun, 20 Nov 2011 00:19:45 -0500
From: ghudson@mit.edu
Message-Id: <201111200519.pAK5JjH0023039@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
http://src.mit.edu/fisheye/changelog/krb5/?cs=25480
Commit By: ghudson
Log Message:
ticket: 7021
subject: Fix failure interval of 0 in LDAP lockout code
target_version: 1.10
tags: pullup
A failure count interval of 0 caused krb5_ldap_lockout_check_policy to
pass the lockout check (but didn't cause a reset of the failure count
in krb5_ldap_lockout_audit). It should be treated as forever, as in
the DB2 back end.
This bug is the previously unknown cause of the assertion failure
fixed in CVE-2011-1528.
Changed Files:
U trunk/src/kadmin/cli/kadmin.M
U trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
Modified: trunk/src/kadmin/cli/kadmin.M
===================================================================
--- trunk/src/kadmin/cli/kadmin.M 2011-11-19 22:06:15 UTC (rev 25479)
+++ trunk/src/kadmin/cli/kadmin.M 2011-11-20 05:19:45 UTC (rev 25480)
@@ -726,12 +726,13 @@
sets the allowable time between authentication failures. If an
authentication failure happens after \fIfailuretime\fP has elapsed
since the previous failure, the number of authentication failures is
-reset to 1.
+reset to 1. A failure count interval of 0 means forever.
.TP
\fB\-lockoutduration\fP \fIlockouttime\fP
sets the duration for which the principal is locked from
authenticating if too many authentication failures occur without the
-specified failure count interval elapsing.
+specified failure count interval elapsing. A duration of 0 means
+forever.
.sp
.nf
.TP
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c 2011-11-19 22:06:15 UTC (rev 25479)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c 2011-11-20 05:19:45 UTC (rev 25480)
@@ -127,7 +127,7 @@
code = lookup_lockout_policy(context, entry, &max_fail,
&failcnt_interval,
&lockout_duration);
- if (code != 0 || failcnt_interval == 0)
+ if (code != 0)
return code;
if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
