#17: PAM module uses bogus username
-------------------+--------------------------------------------------------
Reporter: smoku | Owner: smoku
Type: defect | Status: closed
Priority: major | Component: c2s
Version: 2.1 | Resolution: invalid
Keywords: | Blocking:
-------------------+--------------------------------------------------------
Changes (by sxw):
* blocking: =>
Comment:
I'm not sure Trac will let me change the resolution - but here's what the
problem is.
Basically, it doesn't look like a NULL realm can be set - which is what is
required for this code to work correctly at sites where they wish to
authenticate against their default system password database.
The problem is right at the heart of the way that configuration file
parsing is performed. When dealing with attributes, an empty string is
considered to be the same as NULL. Then, when attributes are retrieved,
j_attrs returns 'NULL' for both an attribute with a NULL value, and an
attribute which has never been defined.
There are a few ways that this could be fixed
* pstrdupx has strange behaviour when asked to strdup a 0 length string.
In all other cases, it's length argument means 'length of the string,
excluding the trailing NULL. When passed a 0 length, however it doesn't
create a zero length string (that is a pointer to a 1 byte block
containing NULL), it just returns NULL. This is arguably the core problem
- but pstrdupx has a lot of callers and verifying that the safety of this
behaviour change could be tricky
* Special case the realm checks - so that something other than j_attr is
used to retrieve the value, and so the difference between an empty, and a
not-provided string can be determined.
* Change the behaviour of the configuration file parser, so that it
creates 0 length, rather than NULL strings just for configuration files.
I think the last one is the safest option. Comments?
--
Ticket URL: <http://jabberd2.xiaoka.com/ticket/17#comment:3>
jabberd2 <http://jabberd2.xiaoka.com/>
jabberd2 project
_______________________________________________
jabberd2 mailing list
[email protected]
http://lists.xiaoka.com/listinfo.cgi/jabberd2-xiaoka.com
