-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/05/2011 06:12 AM, Sumit Bose wrote:
Hi,
Shanks found an issue with obfuscated password which led to
https://fedorahosted.org/sssd/ticket/762
This patch fixes the issue but might introduce some memory leaks. It
does not remove nspr_nss_cleanup() at any other places, because for me
the usage looks safe there. But we really should push
https://fedorahosted.org/sssd/ticket/752 to get a code audit for our NSS
usage.
Nack.
I think this solution is insufficient. We're not sure whether this will
introduce a memory leak because we're not terminating our use of NSS. I
think what we want to do is move the decryption to the initialization
routine of the LDAP provider and store the decrypted password with the
same mechanism we use to store deferred krb5 passwords.
This will also solve
https://fedorahosted.org/sssd/ticket/761 at the
same time.
There's no reason whatsoever that we need to be decrypting the
obfuscated password every time we perform an authentication.
While we're in that code, it would probably be a good idea to make the
non-obfuscated bind password use this mechanism as well.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk0kcs0ACgkQeiVVYja6o6PsVgCeLk1PCJfCepRSFRgfQqZVNTM1
a3MAnji3Gz4zhpBmaR/W92WoMcdqM3Jm
=b67T
-----END PGP SIGNATURE-----