diff options
author | Nicolas Reynolds <fauno@kiwwwi.com.ar> | 2011-10-28 11:35:50 -0300 |
---|---|---|
committer | Nicolas Reynolds <fauno@kiwwwi.com.ar> | 2011-10-28 11:35:50 -0300 |
commit | 8856e6fe26ce35b4caf6beeac324f583ec1b6133 (patch) | |
tree | c42a03e2b7610a39d167af36357607399aa40045 /core/krb5/krb5-1.9.1-2011-006.patch | |
parent | 5100458465d1ed420073c3213349bf430075ddbc (diff) | |
parent | 0424b5fc47f106db6498c4cda3476e1d49fe0f82 (diff) |
Merge branch 'master' of ssh://vparabola/home/parabola/abslibre-pre-mips64el
Conflicts:
community/esmtp/PKGBUILD
community/geany-plugins/PKGBUILD
community/giggle/PKGBUILD
community/guichan/PKGBUILD
community/mxml/PKGBUILD
community/ruby-gtk2/PKGBUILD
core/libtool/PKGBUILD
core/mkinitcpio-busybox/PKGBUILD
core/udev/PKGBUILD
extra/audacious/PKGBUILD
extra/conky/PKGBUILD
extra/gnome-control-center/PKGBUILD
extra/gtk2/PKGBUILD
extra/gtk3/PKGBUILD
extra/gvfs/PKGBUILD
extra/kdeutils/PKGBUILD
extra/kino/PKGBUILD
extra/mkvtoolnix/PKGBUILD
extra/poppler/PKGBUILD
extra/postfix/PKGBUILD
extra/pulseaudio/PKGBUILD
extra/qtcurve-gtk2/PKGBUILD
extra/transmission/PKGBUILD
extra/xfburn/PKGBUILD
extra/xfce4-xkb-plugin/PKGBUILD
extra/xorg-server/PKGBUILD
extra/yelp/PKGBUILD
kde-unstable/calligra/PKGBUILD
multilib/lib32-gtk2/PKGBUILD
multilib/lib32-libpulse/PKGBUILD
multilib/libtool-multilib/PKGBUILD
multilib/wine/PKGBUILD
multilib/wine/wine.install
Diffstat (limited to 'core/krb5/krb5-1.9.1-2011-006.patch')
-rw-r--r-- | core/krb5/krb5-1.9.1-2011-006.patch | 75 |
1 files changed, 75 insertions, 0 deletions
diff --git a/core/krb5/krb5-1.9.1-2011-006.patch b/core/krb5/krb5-1.9.1-2011-006.patch new file mode 100644 index 000000000..05a22caf5 --- /dev/null +++ b/core/krb5/krb5-1.9.1-2011-006.patch @@ -0,0 +1,75 @@ +diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c +index b473611..50c60b7 100644 +--- a/src/plugins/kdb/db2/lockout.c ++++ b/src/plugins/kdb/db2/lockout.c +@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context, + return 0; + } + ++ if (entry == NULL) ++ return 0; ++ + if (!db_ctx->disable_lockout) { + code = lookup_lockout_policy(context, entry, &max_fail, + &failcnt_interval, &lockout_duration); +@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context, + return code; + } + ++ /* ++ * Don't continue to modify the DB for an already locked account. ++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and ++ * this check is unneeded, but in rare cases, we can fail with an ++ * integrity error or preauth failure before a policy check.) ++ */ ++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) ++ return 0; ++ + /* Only mark the authentication as successful if the entry + * required preauthentication, otherwise we have no idea. */ + if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +index 552e39a..c2f44ab 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor, + CHECK_LDAP_HANDLE(ldap_context); + + if (is_principal_in_realm(ldap_context, searchfor) != 0) { ++ st = KRB5_KDB_NOENTRY; + krb5_set_error_message (context, st, "Principal does not belong to realm"); + goto cleanup; + } +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +index a218dc7..fd164dd 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context, + return 0; + } + ++ if (entry == NULL) ++ return 0; ++ + if (!ldap_context->disable_lockout) { + code = lookup_lockout_policy(context, entry, &max_fail, + &failcnt_interval, +@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context, + return code; + } + +- entry->mask = 0; ++ /* ++ * Don't continue to modify the DB for an already locked account. ++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and ++ * this check is unneeded, but in rare cases, we can fail with an ++ * integrity error or preauth failure before a policy check.) ++ */ ++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) ++ return 0; + +- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); ++ entry->mask = 0; + + /* Only mark the authentication as successful if the entry + * required preauthentication, otherwise we have no idea. */ |