http://web.mit.edu/kerberos/advisories/2011-006-patch-r18.txt diff -Naurp krb5-1.8.1/src/plugins/kdb/db2/lockout.c krb5-1.8.1.oden/src/plugins/kdb/db2/lockout.c --- krb5-1.8.1/src/plugins/kdb/db2/lockout.c 2009-11-24 23:52:25.000000000 +0000 +++ krb5-1.8.1.oden/src/plugins/kdb/db2/lockout.c 2011-10-22 08:14:06.000000000 +0000 @@ -158,13 +158,23 @@ krb5_db2_lockout_audit(krb5_context cont return 0; } + if (entry == NULL) + return 0; + code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, &lockout_duration); if (code != 0) return code; - assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); + /* + * Don't continue to modify the DB for an already locked account. + * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and + * this check is unneeded, but in rare cases, we can fail with an + * integrity error or preauth failure before a policy check.) + */ + if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) + return 0; if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { /* diff -Naurp krb5-1.8.1/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c krb5-1.8.1.oden/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c --- krb5-1.8.1/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c 2011-10-22 08:13:47.000000000 +0000 +++ krb5-1.8.1.oden/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c 2011-10-22 08:14:06.000000000 +0000 @@ -131,6 +131,7 @@ krb5_ldap_get_principal(krb5_context con CHECK_LDAP_HANDLE(ldap_context); if (is_principal_in_realm(ldap_context, searchfor) != 0) { + st = KRB5_KDB_NOENTRY; *more = 0; krb5_set_error_message (context, st, "Principal does not belong to realm"); goto cleanup; diff -Naurp krb5-1.8.1/src/plugins/kdb/ldap/libkdb_ldap/lockout.c krb5-1.8.1.oden/src/plugins/kdb/ldap/libkdb_ldap/lockout.c --- krb5-1.8.1/src/plugins/kdb/ldap/libkdb_ldap/lockout.c 2009-11-24 23:52:25.000000000 +0000 +++ krb5-1.8.1.oden/src/plugins/kdb/ldap/libkdb_ldap/lockout.c 2011-10-22 08:14:06.000000000 +0000 @@ -150,15 +150,25 @@ krb5_ldap_lockout_audit(krb5_context con return 0; } + if (entry == NULL) + return 0; + code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, &lockout_duration); if (code != 0) return code; - entry->mask = 0; + /* + * Don't continue to modify the DB for an already locked account. + * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and + * this check is unneeded, but in rare cases, we can fail with an + * integrity error or preauth failure before a policy check.) + */ + if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) + return 0; - assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); + entry->mask = 0; if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { /*