bin/51508: pam_unix.so problem with xdm/kdm

[Peter Grimshaw]

>Number:         51508
>Category:       bin
>Synopsis:       pam_unix.so problem with xdm/kdm
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 28 13:30:13 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator:     Peter Grimshaw
>Release:        FreeBSD 5.0-RELEASE i386
>Organization:
N/A
>Environment:
System: FreeBSD tesseract.demon.co.uk 5.0-RELEASE FreeBSD 5.0-RELEASE #0: Fri Mar 7 15:46:41 GMT 2003 peter at tesseract.demon.co.uk:/usr/obj/usr/src/sys/TESSERACT i386

>Description:
Function pam_sm_acct_mgmt in /usr/src/lib/libpam/modules/pam_unix/pam_unix.c
uses getaddrinfo to resolve the PAM_RHOST host name, if this is set to a
non-NULL value.  Unfortunately, xdm and kdm set PAM_RHOST to "" rather than
NULL.  

Also, in the same function, char rhostip[MAXHOSTNAMELEN] is not always
initialized before use.

On my dial-up host, the name servers are not always accessible, so the
attempt to resolve "" causes login delays when using xdm or kdm.  This
is how I became aware of the problem.

>How-To-Repeat:
The problem is clear from inspection of the source code.
	
>Fix:
I've patched my source as follows, and rebuilt pam_unix.so:

*** pam_unix.c.orig	Thu May 23 00:18:25 2002
--- pam_unix.c	Mon Apr 28 20:34:57 2003
***************
*** 35,41 ****
   */
  
  #include <sys/cdefs.h>
! __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_unix/pam_unix.c,v 1.40 2002/05/22 23:18:25 jmallett Exp $");
  
  #include <sys/param.h>
  #include <sys/socket.h>
--- 35,41 ----
   */
  
  #include <sys/cdefs.h>
! __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_unix/pam_unix.c,unofficial fix 2003/04/28 by Peter Grimshaw$");
  
  #include <sys/param.h>
  #include <sys/socket.h>
***************
*** 170,176 ****
  	time_t warntime;
  	int retval;
  	const char *rhost, *tty, *user;
! 	char rhostip[MAXHOSTNAMELEN];
  
  	pam_std_option(&options, other_options, argc, argv);
  
--- 170,176 ----
  	time_t warntime;
  	int retval;
  	const char *rhost, *tty, *user;
! 	char rhostip[MAXHOSTNAMELEN] = "";
  
  	pam_std_option(&options, other_options, argc, argv);
  
***************
*** 246,252 ****
  	 * PAM_NEW_AUTHTOK_REQD.
  	 */
  
! 	if (rhost) {
  		memset(&hints, 0, sizeof(hints));
  		hints.ai_family = AF_UNSPEC;
  		if (getaddrinfo(rhost, NULL, &hints, &res) == 0) {
--- 246,252 ----
  	 * PAM_NEW_AUTHTOK_REQD.
  	 */
  
! 	if (rhost && rhost[0]) {
  		memset(&hints, 0, sizeof(hints));
  		hints.ai_family = AF_UNSPEC;
  		if (getaddrinfo(rhost, NULL, &hints, &res) == 0) {

>Release-Note:
>Audit-Trail:
>Unformatted: