{"head":"2ac4b3a05b34eb564f2ca467692c28310e6acc6b","size":2,"push_id":46297681,"commits":[{"sha":"1f587f47642f78ceb7e170add54288ed856bd415","author":{"name":"ghudson","email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@dc483132-0cff-0310-8789-dd5450dbe970"},"url":"https://api.github.com/repos/krb5/krb5-anonsvn/commits/1f587f47642f78ceb7e170add54288ed856bd415","message":"ticket: 6978\nsubject: Allow rd_priv/rd_safe without remote address\n\nAllow krb5_rd_priv and krb5_rd_safe to work when there is no remote\naddress set in the auth context, unless the KRB5_AUTH_CONTEXT_DO_TIMES\nflag is set (in which case we need the remote address for the replay\ncache name).  Note that failing to set the remote address can create a\nvulnerability to reflection attacks in some protocols, although it is\nfairly easy to defend against--either use sequence numbers, or make\nsure that requests don't look like replies, or both.\n\ngit-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25355 dc483132-0cff-0310-8789-dd5450dbe970"},{"sha":"2ac4b3a05b34eb564f2ca467692c28310e6acc6b","author":{"name":"ghudson","email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@dc483132-0cff-0310-8789-dd5450dbe970"},"url":"https://api.github.com/repos/krb5/krb5-anonsvn/commits/2ac4b3a05b34eb564f2ca467692c28310e6acc6b","message":"ticket: 6979\nsubject: Allow password changes over NATs\n\nIn the kpasswd server code, don't set a remote address in the auth\ncontext before calling krb5_rd_priv, since the kpasswd protocol is\nwell-protected against reflection attacks.  This allows password\nchanges to work in cases where a NAT has changed the client IP address\nas it is seen by the server.\n\ngit-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25356 dc483132-0cff-0310-8789-dd5450dbe970"}],"ref":"refs/heads/master","legacy":{"head":"2ac4b3a05b34eb564f2ca467692c28310e6acc6b","size":2,"push_id":46297681,"shas":[["1f587f47642f78ceb7e170add54288ed856bd415","ghudson@dc483132-0cff-0310-8789-dd5450dbe970","ticket: 6978\nsubject: Allow rd_priv/rd_safe without remote address\n\nAllow krb5_rd_priv and krb5_rd_safe to work when there is no remote\naddress set in the auth context, unless the KRB5_AUTH_CONTEXT_DO_TIMES\nflag is set (in which case we need the remote address for the replay\ncache name).  Note that failing to set the remote address can create a\nvulnerability to reflection attacks in some protocols, although it is\nfairly easy to defend against--either use sequence numbers, or make\nsure that requests don't look like replies, or both.\n\ngit-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25355 dc483132-0cff-0310-8789-dd5450dbe970","ghudson"],["2ac4b3a05b34eb564f2ca467692c28310e6acc6b","ghudson@dc483132-0cff-0310-8789-dd5450dbe970","ticket: 6979\nsubject: Allow password changes over NATs\n\nIn the kpasswd server code, don't set a remote address in the auth\ncontext before calling krb5_rd_priv, since the kpasswd protocol is\nwell-protected against reflection attacks.  This allows password\nchanges to work in cases where a NAT has changed the client IP address\nas it is seen by the server.\n\ngit-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25356 dc483132-0cff-0310-8789-dd5450dbe970","ghudson"]],"ref":"refs/heads/master"}}