canonical / lightdm

Display Manager
GNU General Public License v3.0
813 stars 137 forks source link

Multiple XDMCP connections from same /8 subnet overwrite utmp entries #360

Open acarapetis opened 1 month ago

acarapetis commented 1 month ago

When multiple clients connect over XDMCP from the same host, only one entry appears in utmp.

For example, if I connect a new client from localhost using Xephyr -query localhost :2, then who shows me the login as I expect:

anthony               2024-06-07 09:59 (172.18.64.3:2) # first XDMCP session
anthony               2024-06-07 09:31 (:1) # my local session

But if I then start another simultaneous session with Xephyr -query localhost :3, it seems the :2 session in utmp is overwritten with the :3 session:

anthony               2024-06-07 10:01 (172.18.64.3:3)
anthony               2024-06-07 09:31 (:1)

I believe the cause is that ut_id is being set as the first four characters of xdisplay, which for XDMCP connections is a string of the form {ip}:{display}; so any client connecting from the 172/8 subnet will get the ID "172.". Thus pututxline thinks we're trying to update an existing entry, not add a new one. https://github.com/canonical/lightdm/blob/main/src/session-child.c#L739-L740

See this near-identical issue in gdm3, which looks like it was fixed by just not setting ut_id at all: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690197