CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit int

Commit 442a38c918ae1666b35 refactored some code into a new
get_lockout_observation_window() function. However, in moving the code,
an ldb_msg_find_attr_as_int64() inadvertently got converted to a
ldb_msg_find_attr_as_int().

ldb_msg_find_attr_as_int() will only work for values up to -2147483648
(about 3.5 minutes in MS timestamp form). Unfortunately, the automated
tests used a low enough timeout that they still worked, however,
password lockout would not work with the Samba default settings.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/selftest/knownfail.d/password_lockout b/selftest/knownfail.d/password_lockout
index 305bcbdef256bce2035465f422b8f0be663319e1..a4e37a84c21726701b08f5052e00faaa047a69b1 100644 (file)
--- a/selftest/knownfail.d/password_lockout
+++ b/selftest/knownfail.d/password_lockout
@@ -1,4 +1,2 @@
 samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_pso_login_lockout_krb5\(ad_dc_ntvfs\)
 samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_pso_login_lockout_ntlm\(ad_dc_ntvfs\)
-samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_login_lockout_ntlm\(ad_dc_ntvfs\)
-samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_login_lockout_krb5\(ad_dc_ntvfs\)

diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index 193fa2ae653fec86a3ad0e3fcd937e8111a85386..438a29e17738db4aadc4df7f6c17b54e63eadbdb 100644 (file)
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -5400,12 +5400,12 @@ static int64_t get_lockout_observation_window(struct ldb_message *domain_msg,
                                              struct ldb_message *pso_msg)
 {
        if (pso_msg != NULL) {
-               return ldb_msg_find_attr_as_int(pso_msg,
-                                               "msDS-LockoutObservationWindow",
-                                                0);
+               return ldb_msg_find_attr_as_int64(pso_msg,
+                                                 "msDS-LockoutObservationWindow",
+                                                  0);
        } else {
-               return ldb_msg_find_attr_as_int(domain_msg,
-                                               "lockOutObservationWindow", 0);
+               return ldb_msg_find_attr_as_int64(domain_msg,
+                                                 "lockOutObservationWindow", 0);
        }
 }