diff options
author | Parabola <dev@list.parabolagnulinux.org> | 2012-01-09 13:47:51 +0000 |
---|---|---|
committer | Parabola <dev@list.parabolagnulinux.org> | 2012-01-09 13:47:51 +0000 |
commit | 7a3611f5caa5e34c1f2b582640f97b733110ae63 (patch) | |
tree | 5b0baf1ad1b36444ffbf73707a377b15fc67692f /core/krb5/krb5-1.9.1-2011-006.patch | |
parent | 46783b68621b6ad45cdd9ed64cfa8cdcfbc6f318 (diff) |
Mon Jan 9 13:47:49 UTC 2012
Diffstat (limited to 'core/krb5/krb5-1.9.1-2011-006.patch')
-rw-r--r-- | core/krb5/krb5-1.9.1-2011-006.patch | 75 |
1 files changed, 0 insertions, 75 deletions
diff --git a/core/krb5/krb5-1.9.1-2011-006.patch b/core/krb5/krb5-1.9.1-2011-006.patch deleted file mode 100644 index 05a22caf5..000000000 --- a/core/krb5/krb5-1.9.1-2011-006.patch +++ /dev/null @@ -1,75 +0,0 @@ -diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c -index b473611..50c60b7 100644 ---- a/src/plugins/kdb/db2/lockout.c -+++ b/src/plugins/kdb/db2/lockout.c -@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context, - return 0; - } - -+ if (entry == NULL) -+ return 0; -+ - if (!db_ctx->disable_lockout) { - code = lookup_lockout_policy(context, entry, &max_fail, - &failcnt_interval, &lockout_duration); -@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context, - return code; - } - -+ /* -+ * Don't continue to modify the DB for an already locked account. -+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and -+ * this check is unneeded, but in rare cases, we can fail with an -+ * integrity error or preauth failure before a policy check.) -+ */ -+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) -+ return 0; -+ - /* Only mark the authentication as successful if the entry - * required preauthentication, otherwise we have no idea. */ - if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { -diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c -index 552e39a..c2f44ab 100644 ---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c -+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c -@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor, - CHECK_LDAP_HANDLE(ldap_context); - - if (is_principal_in_realm(ldap_context, searchfor) != 0) { -+ st = KRB5_KDB_NOENTRY; - krb5_set_error_message (context, st, "Principal does not belong to realm"); - goto cleanup; - } -diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c -index a218dc7..fd164dd 100644 ---- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c -+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c -@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context, - return 0; - } - -+ if (entry == NULL) -+ return 0; -+ - if (!ldap_context->disable_lockout) { - code = lookup_lockout_policy(context, entry, &max_fail, - &failcnt_interval, -@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context, - return code; - } - -- entry->mask = 0; -+ /* -+ * Don't continue to modify the DB for an already locked account. -+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and -+ * this check is unneeded, but in rare cases, we can fail with an -+ * integrity error or preauth failure before a policy check.) -+ */ -+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) -+ return 0; - -- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); -+ entry->mask = 0; - - /* Only mark the authentication as successful if the entry - * required preauthentication, otherwise we have no idea. */ |