diff options
| author | Nathaniel McCallum <npmccallum@redhat.com> | 2014-09-19 12:18:34 -0400 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-09-30 16:19:06 +0200 |
| commit | 915837c14af5f0839d1d08683ea8332334e284ba (patch) | |
| tree | 691f34c7a649413fdbe37e35c587ecd5ccc661d6 /daemons/ipa-slapi-plugins | |
| parent | 9ba33971fad5ec3b6fb5445669228b0ea9a89ec5 (diff) | |
| download | freeipa-915837c14af5f0839d1d08683ea8332334e284ba.tar.gz freeipa-915837c14af5f0839d1d08683ea8332334e284ba.tar.xz freeipa-915837c14af5f0839d1d08683ea8332334e284ba.zip | |
Move OTP synchronization step to after counter writeback
This prevents synchronization when an authentication collision occurs.
https://fedorahosted.org/freeipa/ticket/4493
Reviewed-By: Thierry bordaz (tbordaz) <tbordaz@redhat.com>
Diffstat (limited to 'daemons/ipa-slapi-plugins')
| -rw-r--r-- | daemons/ipa-slapi-plugins/libotp/libotp.c | 18 |
1 files changed, 7 insertions, 11 deletions
diff --git a/daemons/ipa-slapi-plugins/libotp/libotp.c b/daemons/ipa-slapi-plugins/libotp/libotp.c index 870e2415f..c65aef043 100644 --- a/daemons/ipa-slapi-plugins/libotp/libotp.c +++ b/daemons/ipa-slapi-plugins/libotp/libotp.c @@ -202,17 +202,6 @@ static bool validate(struct otptoken *token, time_t now, ssize_t step, if (*second != tmp) return false; - - /* Perform optional synchronization steps. */ - switch (token->type) { - case OTPTOKEN_TOTP: - tmp = (step - now / token->totp.step) * token->totp.step; - if (!writeattr(token, T("clockOffset"), tmp)) - return false; - break; - default: - break; - } } /* Write the step value. */ @@ -222,6 +211,13 @@ static bool validate(struct otptoken *token, time_t now, ssize_t step, /* Save our modifications to the object. */ switch (token->type) { case OTPTOKEN_TOTP: + /* Perform optional synchronization steps. */ + if (second != NULL) { + tmp = (step - now / token->totp.step) * token->totp.step; + if (!writeattr(token, T("clockOffset"), tmp)) + return false; + token->totp.offset = tmp; + } token->totp.watermark = step; break; case OTPTOKEN_HOTP: |