Re: auth_user_hash_pointer leak? (2.5 Bug #910)

2004-02-19 Thread Robert Collins
On Thu, 2004-02-19 at 21:50, Henrik Nordstrom wrote: > For challenge-reuse configurations it is still good but needs to purge old > entries when the challenge is changed. Will look into this. Well yes - the point is to cache some reasonable count for efficiency. But when a challenge changes, entri

Re: auth_user_hash_pointer leak? (2.5 Bug #910)

2004-02-19 Thread Henrik Nordstrom
On Thu, 19 Feb 2004, Robert Collins wrote: > On Thu, 2004-02-19 at 03:04, Henrik Nordstrom wrote: > > challenge-response caching: if the challenge given by the helper is the > same, and the response is the same, it's a valid login a priori. Ok. The use of this then obviously should be disabled i

Re: auth_user_hash_pointer leak? (2.5 Bug #910)

2004-02-19 Thread Robert Collins
On Thu, 2004-02-19 at 03:04, Henrik Nordstrom wrote: > Robert, what is the purpose of the auth_user_hash_pointer in the ntlm > scheme, and do you have any idea as to why the use of this would be > growing a lot? challenge-response caching: if the challenge given by the helper is the same, and the

auth_user_hash_pointer leak? (2.5 Bug #910)

2004-02-18 Thread Henrik Nordstrom
Robert, what is the purpose of the auth_user_hash_pointer in the ntlm scheme, and do you have any idea as to why the use of this would be growing a lot? Regards Henrik