From ecaaf4456e5aeacae1acdb1775bb5aadd3b19e13 Mon Sep 17 00:00:00 2001 From: Iker Pedrosa Date: Wed, 16 Oct 2024 12:41:09 +0200 Subject: pam_access: always match local address * modules/pam_access/pam_access.c: match the local address regardless of the IP version in use. In some circumstances the `localhost` may be translated to IPv4 or IPv6, but the configuration file only indicated the address for one of the two versions. Since the originating value is set in `PAM_RHOST` and PAM has no control over it, let's match the local addresses regardless of the IP version in use. Resolves: https://issues.redhat.com/browse/RHEL-23018 Signed-off-by: Iker Pedrosa --- modules/pam_access/pam_access.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c index bfbc6d57..48e7c7e9 100644 --- a/modules/pam_access/pam_access.c +++ b/modules/pam_access/pam_access.c @@ -306,6 +306,23 @@ isipaddr (const char *string, int *addr_type, return is_ip; } +/* is_local_addr - checks if the IP address is local */ +static int +is_local_addr (const char *string, int addr_type) +{ + if (addr_type == AF_INET) { + if (strcmp(string, "127.0.0.1") == 0) { + return YES; + } + } else if (addr_type == AF_INET6) { + if (strcmp(string, "::1") == 0) { + return YES; + } + } + + return NO; +} + /* are_addresses_equal - translate IP address strings to real IP * addresses and compare them to find out if they are equal. @@ -327,9 +344,18 @@ are_addresses_equal (const char *ipaddr0, const char *ipaddr1, if (isipaddr (ipaddr1, &addr_type1, &addr1) == NO) return NO; - if (addr_type0 != addr_type1) - /* different address types */ + if (addr_type0 != addr_type1) { + /* different address types, but there is still a possibility that they are + * both local addresses + */ + int local1 = is_local_addr(ipaddr0, addr_type0); + int local2 = is_local_addr(ipaddr1, addr_type1); + + if (local1 == YES && local2 == YES) + return YES; + return NO; + } if (netmask != NULL) { /* Got a netmask, so normalize addresses? */ -- cgit v1.2.3