Import CUPS v1.7.1

[thirdparty/cups.git] / scheduler / auth.c

diff --git a/scheduler/auth.c b/scheduler/auth.c
index 00b5960f8f49d2fbb2c731240906e338a62fc9ee..35b70f394358e08eecd6ef22ce74b232aa003035 100644 (file)
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -1,5 +1,5 @@
 /*
- * "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $"
+ * "$Id: auth.c 11500 2014-01-06 22:21:15Z msweet $"
  *
  *   Authorization routines for the CUPS scheduler.
  *
@@ -89,14 +89,13 @@ extern const char *cssmErrorString(int error);
 typedef struct xucred cupsd_ucred_t;
 #  define CUPSD_UCRED_UID(c) (c).cr_uid
 #else
+#  ifndef __OpenBSD__
 typedef struct ucred cupsd_ucred_t;
+#  else
+typedef struct sockpeercred cupsd_ucred_t;
+#  endif
 #  define CUPSD_UCRED_UID(c) (c).uid
 #endif /* HAVE_SYS_UCRED_H */
-#ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
-/* Not in public headers... */
-extern void    krb5_ipc_client_set_target_uid(uid_t);
-extern void    krb5_ipc_client_clear_target(void);
-#endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
 
 
 /*
@@ -514,18 +513,37 @@ cupsdAuthorize(cupsd_client_t *con)       /* I - Client connection */
     socklen_t          peersize;       /* Size of peer credentials */
 #ifdef HAVE_AUTHORIZATION_H
     const char         *name;          /* Authorizing name */
+    int                        no_peer = 0;    /* Don't allow peer credentials? */
+
+   /*
+    * See if we should allow peer credentials...
+    */
 
     for (name = (char *)cupsArrayFirst(con->best->names);
          name;
          name = (char *)cupsArrayNext(con->best->names))
+    {
       if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
           !_cups_strcasecmp(name, "@SYSTEM"))
       {
-       cupsdLogMessage(CUPSD_LOG_ERROR,
-                       "[Client %d] PeerCred authentication not allowed for "
-                       "resource.", con->http.fd);
-       return;
+       /* Normally don't want peer credentials if we need an auth key... */
+       no_peer = 1;
       }
+      else if (!_cups_strcasecmp(name, "@OWNER"))
+      {
+       /* but if @OWNER is present then we allow it... */
+        no_peer = 0;
+        break;
+      }
+    }
+
+    if (no_peer)
+    {
+      cupsdLogMessage(CUPSD_LOG_ERROR,
+                     "[Client %d] PeerCred authentication not allowed for "
+                     "resource per AUTHKEY policy.", con->http.fd);
+      return;
+    }
 #endif /* HAVE_AUTHORIZATION_H */
 
     if ((pwd = getpwnam(authorization + 9)) == NULL)
@@ -593,15 +611,7 @@ cupsdAuthorize(cupsd_client_t *con)        /* I - Client connection */
     while (isspace(*authorization & 255))
       authorization ++;
 
-    if ((localuser = cupsdFindCert(authorization)) != NULL)
-    {
-      strlcpy(username, localuser->username, sizeof(username));
-
-      cupsdLogMessage(CUPSD_LOG_DEBUG,
-                     "[Client %d] Authorized as %s using Local", con->http.fd,
-                     username);
-    }
-    else
+    if ((localuser = cupsdFindCert(authorization)) == NULL)
     {
       cupsdLogMessage(CUPSD_LOG_ERROR,
                       "[Client %d] Local authentication certificate not found.",
@@ -609,12 +619,12 @@ cupsdAuthorize(cupsd_client_t *con)       /* I - Client connection */
       return;
     }
 
-#ifdef HAVE_GSSAPI
-    if (localuser->ccache)
-      con->type = CUPSD_AUTH_NEGOTIATE;
-    else
-#endif /* HAVE_GSSAPI */
-      con->type = CUPSD_AUTH_BASIC;
+    strlcpy(username, localuser->username, sizeof(username));
+    con->type = localuser->type;
+
+    cupsdLogMessage(CUPSD_LOG_DEBUG,
+                   "[Client %d] Authorized as %s using Local", con->http.fd,
+                   username);
   }
   else if (!strncmp(authorization, "Basic", 5))
   {
@@ -1173,7 +1183,7 @@ cupsdAuthorize(cupsd_client_t *con)       /* I - Client connection */
 
 
     if (sscanf(authorization, "%255s", scheme) != 1)
-      strcpy(scheme, "UNKNOWN");
+      strlcpy(scheme, "UNKNOWN", sizeof(scheme));
 
     cupsdLogMessage(CUPSD_LOG_ERROR,
                     "[Client %d] Bad authentication data \"%s ...\"",
@@ -1292,6 +1302,8 @@ cupsdCheckAuth(unsigned     ip[4],        /* I - Client address */
           netip6[3] = htonl(ip[3]);
 #endif /* AF_INET6 */
 
+         cupsdNetIFUpdate();
+
           if (!strcmp(mask->mask.name.name, "*"))
          {
 #ifdef __APPLE__
@@ -1307,8 +1319,6 @@ cupsdCheckAuth(unsigned     ip[4],        /* I - Client address */
            * Check against all local interfaces...
            */
 
-            cupsdNetIFUpdate();
-
            for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
                 iface;
                 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
@@ -2597,5 +2607,5 @@ to64(char          *s,                    /* O - Output string */
 
 
 /*
- * End of "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $".
+ * End of "$Id: auth.c 11500 2014-01-06 22:21:15Z msweet $".
  */