John P. Eisenmenger
2004-Apr-08 00:20 UTC
patch for "gone - no logout" output from last(1)
Greetings,
After upgrading one of my systems to the linux 2.6.4 kernel, it started
having problems recording the logout entries in the wtmp file. I traced
this to a bug in loginrec.c, where a variable (line) is declared as an
array of 8 characters. This length is substantially shorter than the 16
character array size of ut_line, so openssh effectively truncates the
pseudo-tty name when the pseudo-tty number exceeds 999. With the new
linux kernels, the pseudo-ttys are not reused as in the past, so a busy
system can reach the magic number of 1000 pretty quickly...
Here's an example of what I see on my system via the last command, so you
can get an idea. The top 2 entries were after I applied the patch below.
Prior to its application, every login with a four-digit pts/ number that
had completed was marked with "gone - no logout".
$ last -20 | grep pts/
jpeisen pts/2057 some.host.com Wed Apr 7 20:00 - 20:00 (00:00)
jpeisen pts/2052 localhost Wed Apr 7 19:31 - 19:31 (00:00)
jpeisen pts/2051 localhost Wed Apr 7 19:26 gone - no logout
jpeisen pts/2050 some.host.com Wed Apr 7 19:26 still logged in
jpeisen pts/2046 some.host.com Wed Apr 7 19:07 still logged in
jpeisen pts/2035 some.host.com Wed Apr 7 17:27 gone - no logout
jpeisen pts/2030 some.host.com Wed Apr 7 16:46 still logged in
mgosk pts/2021 other.host.com Wed Apr 7 15:28 still logged in
mgosk pts/2019 other.host.com Wed Apr 7 15:14 gone - no logout
jmoras pts/2013 other.host.com Wed Apr 7 14:33 still logged in
Below is my version of the patch. Since I'm not on this list, there may
be other, better versions that have already found their way here. If so,
then I apologize for wasting your time. I did try to be good and wrap the
change in an appropriate #ifdef, and the change is very simple - just using
UT_LINESIZE for the length of the array if it is defined.
-John
--
John P. Eisenmenger
jpe at eisenmenger.org
*** openssh-3.7.1p2/loginrec.c.orig Sun Jul 6 01:20:46 2003
--- openssh-3.7.1p2/loginrec.c Wed Apr 7 19:35:43 2004
***************
*** 1349,1355 ****
--- 1349,1359 ----
syslogin_perform_logout(struct logininfo *li)
{
# ifdef HAVE_LOGOUT
+ # ifdef UT_LINESIZE
+ char line[UT_LINESIZE];
+ # else
char line[8];
+ # endif
(void)line_stripname(line, li->line, sizeof(line));
John P. Eisenmenger wrote:> After upgrading one of my systems to the linux 2.6.4 kernel, it started > having problems recording the logout entries in the wtmp file. I traced > this to a bug in loginrec.c, where a variable (line) is declared as an > array of 8 characters. This length is substantially shorter than the 16 > character array size of ut_line, so openssh effectively truncates the > pseudo-tty name when the pseudo-tty number exceeds 999. With the new > linux kernels, the pseudo-ttys are not reused as in the pastIs that deliberate? Sounds like a kernel bug... [snip]> Below is my version of the patch.Seems reasonable, applied. Thanks. -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
Darren Tucker wrote:> John P. Eisenmenger wrote: >> Below is my version of the patch. > > Seems reasonable, applied. Thanks.Hmm, I wonder if it would be cleaner to have this in defines.h: #ifndef UT_LINESIZE # define UT_LINESIZE 8 #endif Then just have this in loginrec.c: char line[UT_LINESIZE]; -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
On Thu, 8 Apr 2004, Darren Tucker wrote:> Darren Tucker wrote: > > > John P. Eisenmenger wrote: > > > Below is my version of the patch. > > > > Seems reasonable, applied. Thanks. > > Hmm, I wonder if it would be cleaner to have this in defines.h: > #ifndef UT_LINESIZE > # define UT_LINESIZE 8 > #endif > > Then just have this in loginrec.c: > char line[UT_LINESIZE];I like this better. -- Tim Rice Multitalents (707) 887-1469 tim at multitalents.net