diff options
| author | Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> | 2019-01-16 11:56:23 +0530 |
|---|---|---|
| committer | Tom Joseph <tomjoseph@in.ibm.com> | 2019-01-28 17:15:02 +0000 |
| commit | d8e92fe158bf14e951c18885437d56d66ae3aca4 (patch) | |
| tree | e726b7eaf56681faac6d28e01c342a0d0443049a | |
| parent | 22c8a210c4428fc0918c35f2a0223c8c76d0eeaf (diff) | |
| download | phosphor-net-ipmid-d8e92fe158bf14e951c18885437d56d66ae3aca4.tar.gz phosphor-net-ipmid-d8e92fe158bf14e951c18885437d56d66ae3aca4.zip | |
Fix: match exact privilege for priv lookup
RAKP message 1 must match exact privilege, when Username/privilege
lookup bit is set as per IPMI specification. This fixes the bug
of allowing session setup if the requested privilege is less than
user privilege, which is allowed for name-only lookup.
Unit-test:
After creating a user with operator privilege verified that following
command works
ipmitool -I lanplus -H xx.xx.xx.xx -U <user> -P <passord> raw 6 1 -L user
following command failed to estabilish session
ipmitool -I lanplus -H xx.xx.xx.xx -U <user> -P <passord> raw 6 1 -L user+
Change-Id: I90a2f841b3190e95bb23ba2a368aa134c7a7aea9
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
| -rw-r--r-- | command/rakp12.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/command/rakp12.cpp b/command/rakp12.cpp index 594a8fe..2854716 100644 --- a/command/rakp12.cpp +++ b/command/rakp12.cpp @@ -194,10 +194,10 @@ std::vector<uint8_t> RAKP12(const std::vector<uint8_t>& inPayload, session->curPrivLevel = static_cast<session::Privilege>(minPriv); } // For username / privilege lookup, fail with UNAUTH_NAME, if requested - // max privilege is greater than the user privilege. + // max privilege does not match user privilege if (((request->req_max_privilege_level & userNameOnlyLookupMask) == userNamePrivLookup) && - ((request->req_max_privilege_level & session::reqMaxPrivMask) > + ((request->req_max_privilege_level & session::reqMaxPrivMask) != userAccess.privilege)) { log<level::INFO>( |
