Import CUPS 1.4svn r7023 into easysw/current.

[thirdparty/cups.git] / scheduler / auth.c

diff --git a/scheduler/auth.c b/scheduler/auth.c
index 8e32386ad059b507c69c144ae5193b5d131d9341..d77d075d61566d87cc6b38fb6fc677be262bc8d9 100644 (file)
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -1,5 +1,5 @@
 /*
- * "$Id: auth.c 6732 2007-07-26 16:50:20Z mike $"
+ * "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $"
  *
  *   Authorization routines for the Common UNIX Printing System (CUPS).
  *
@@ -83,6 +83,9 @@
 extern const char *cssmErrorString(int error);
 #  endif /* HAVE_SECBASEPRIV_H */
 #endif /* HAVE_AUTHORIZATION_H */
+#ifdef HAVE_SYS_PARAM_H
+#  include <sys/param.h>
+#endif /* HAVE_SYS_PARAM_H */
 #ifdef HAVE_SYS_UCRED_H
 #  include <sys/ucred.h>
 typedef struct xucred cupsd_ucred_t;
@@ -329,7 +332,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
   int          type;                   /* Authentication type */
   const char   *authorization;         /* Pointer into Authorization string */
   char         *ptr,                   /* Pointer into string */
-               username[65],           /* Username string */
+               username[256],          /* Username string */
                password[33];           /* Password string */
   const char   *localuser;             /* Certificate username */
   char         nonce[HTTP_MAX_VALUE],  /* Nonce value from client */
@@ -366,7 +369,12 @@ cupsdAuthorize(cupsd_client_t *con)        /* I - Client connection */
                   con->uri, con->best, con->best ? con->best->location : "");
 
   if (con->best && con->best->type != AUTH_NONE)
-    type = con->best->type;
+  {
+    if (con->best->type == AUTH_DEFAULT)
+      type = DefaultAuthType;
+    else
+      type = con->best->type;
+  }
   else
     type = DefaultAuthType;
 
@@ -909,7 +917,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
                    username);
   }
 #ifdef HAVE_GSSAPI
-  else if (!strncmp(authorization, "Negotiate", 9) && type == AUTH_NEGOTIATE) 
+  else if (!strncmp(authorization, "Negotiate", 9)) 
   {
     int                        len;            /* Length of authorization string */
     gss_cred_id_t      server_creds;   /* Server credentials */
@@ -921,6 +929,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
                        output_token = GSS_C_EMPTY_BUFFER;
                                        /* Output token for username */
     gss_name_t         client_name;    /* Client name */
+    unsigned int       ret_flags;      /* Credential flags */
 
 
 #  ifdef __APPLE__
@@ -960,10 +969,7 @@ cupsdAuthorize(cupsd_client_t *con)        /* I - Client connection */
     */
 
     if ((server_creds = get_gss_creds(GSSServiceName)) == NULL)
-    {
-      con->no_negotiate = 1;
       return;  
-    }
 
    /*
     * Decode the authorization string to get the input token...
@@ -989,7 +995,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
                                          &client_name,
                                          NULL,
                                          &con->gss_output_token,
-                                         NULL,
+                                         &ret_flags,
                                          NULL,
                                          &con->gss_delegated_cred);
 
@@ -1002,12 +1008,18 @@ cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
       if (context != GSS_C_NO_CONTEXT)
        gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 
-      con->no_negotiate = 1;
+      gss_release_cred(&minor_status, &server_creds);
       return;
     }
 
    /*
-    * Get the username associated with the credentials...
+    * Release our credentials...
+    */
+
+    gss_release_cred(&minor_status, &server_creds);
+
+   /*
+    * Get the username associated with the client's credentials...
     */
 
     if (!con->gss_delegated_cred)
@@ -1028,14 +1040,11 @@ cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
                            "cupsdAuthorize: Error getting username");
        gss_release_name(&minor_status, &client_name);
        gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
-       con->no_negotiate = 1;
        return;
       }
 
       gss_release_name(&minor_status, &client_name);
       strlcpy(username, output_token.value, sizeof(username));
-      if ((ptr = strchr(username, '@')) != NULL)
-        *ptr = '\0';                   /* Strip @KDC from the username */
 
       cupsdLogMessage(CUPSD_LOG_DEBUG,
                      "cupsdAuthorize: Authorized as %s using Negotiate",
@@ -1788,7 +1797,9 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
   unsigned             address[4];     /* Authorization address */
   cupsd_location_t     *best;          /* Best match for location so far */
   int                  hostlen;        /* Length of hostname */
-  const char           *username;      /* Username to authorize */
+  char                 username[256],  /* Username to authorize */
+                       ownername[256], /* Owner name to authorize */
+                       *ptr;           /* Pointer into username */
   struct passwd                *pw;            /* User password data */
   static const char * const levels[] = /* Auth levels */
                {
@@ -1968,7 +1979,7 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
       cupsdLogMessage(CUPSD_LOG_DEBUG,
                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
                       attr->values[0].string.text);
-      username = attr->values[0].string.text;
+      strlcpy(username, attr->values[0].string.text, sizeof(username));
     }
     else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
       return (HTTP_UNAUTHORIZED);      /* Non-anonymous needs user/pass */
@@ -1992,7 +2003,7 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
        return (HTTP_OK);               /* unless overridden with Satisfy */
     }
 
-    username = con->username;
+    strlcpy(username, con->username, sizeof(username));
   }
 
  /*
@@ -2003,6 +2014,23 @@ cupsdIsAuthorized(cupsd_client_t *con,   /* I - Connection */
   if (!strcmp(username, "root"))
     return (HTTP_OK);
 
+ /*
+  * Strip any @domain or @KDC from the username and owner...
+  */
+
+  if ((ptr = strchr(username, '@')) != NULL)
+    *ptr = '\0';
+
+  if (owner)
+  {
+    strlcpy(ownername, owner, sizeof(ownername));
+
+    if ((ptr = strchr(ownername, '@')) != NULL)
+      *ptr = '\0';
+  }
+  else
+    ownername[0] = '\0';
+
  /*
   * Get the user info...
   */
@@ -2058,7 +2086,7 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
     for (i = 0; i < best->num_names; i ++)
     {
       if (!strcasecmp(best->names[i], "@OWNER") && owner &&
-          !strcasecmp(username, owner))
+          !strcasecmp(username, ownername))
        return (HTTP_OK);
       else if (!strcasecmp(best->names[i], "@SYSTEM"))
       {
@@ -2434,7 +2462,8 @@ get_gss_creds(const char *service_name)   /* I - Service name */
     return (NULL);
   }
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Attempting to acquire credentials for %s...", 
+  cupsdLogMessage(CUPSD_LOG_DEBUG,
+                  "get_gss_creds: Attempting to acquire credentials for %s...", 
                   (char *)token.value);
 
   server_creds = GSS_C_NO_CREDENTIAL;
@@ -2450,7 +2479,8 @@ get_gss_creds(const char *service_name)   /* I - Service name */
     return (NULL);
   }
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Credentials acquired successfully for %s.", 
+  cupsdLogMessage(CUPSD_LOG_DEBUG,
+                  "get_gss_creds: Credentials acquired successfully for %s.", 
                   (char *)token.value);
 
   gss_release_name(&minor_status, &server_name);
@@ -2638,5 +2668,5 @@ to64(char          *s,                    /* O - Output string */
 
 
 /*
- * End of "$Id: auth.c 6732 2007-07-26 16:50:20Z mike $".
+ * End of "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $".
  */