Import CUPS 1.4svn r7023 into easysw/current.

[thirdparty/cups.git] / scheduler / auth.c

diff --git a/scheduler/auth.c b/scheduler/auth.c
index c70173edf3eebeb86cb3dd65762402d7b7f146b4..d77d075d61566d87cc6b38fb6fc677be262bc8d9 100644 (file)
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -1,5 +1,5 @@
 /*
- * "$Id: auth.c 6758 2007-08-02 00:13:44Z mike $"
+ * "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $"
  *
  *   Authorization routines for the Common UNIX Printing System (CUPS).
  *
@@ -83,6 +83,9 @@
 extern const char *cssmErrorString(int error);
 #  endif /* HAVE_SECBASEPRIV_H */
 #endif /* HAVE_AUTHORIZATION_H */
+#ifdef HAVE_SYS_PARAM_H
+#  include <sys/param.h>
+#endif /* HAVE_SYS_PARAM_H */
 #ifdef HAVE_SYS_UCRED_H
 #  include <sys/ucred.h>
 typedef struct xucred cupsd_ucred_t;
@@ -329,7 +332,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
   int          type;                   /* Authentication type */
   const char   *authorization;         /* Pointer into Authorization string */
   char         *ptr,                   /* Pointer into string */
-               username[65],           /* Username string */
+               username[256],          /* Username string */
                password[33];           /* Password string */
   const char   *localuser;             /* Certificate username */
   char         nonce[HTTP_MAX_VALUE],  /* Nonce value from client */
@@ -366,7 +369,12 @@ cupsdAuthorize(cupsd_client_t *con)        /* I - Client connection */
                   con->uri, con->best, con->best ? con->best->location : "");
 
   if (con->best && con->best->type != AUTH_NONE)
-    type = con->best->type;
+  {
+    if (con->best->type == AUTH_DEFAULT)
+      type = DefaultAuthType;
+    else
+      type = con->best->type;
+  }
   else
     type = DefaultAuthType;
 
@@ -909,7 +917,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
                    username);
   }
 #ifdef HAVE_GSSAPI
-  else if (!strncmp(authorization, "Negotiate", 9) && type == AUTH_NEGOTIATE) 
+  else if (!strncmp(authorization, "Negotiate", 9)) 
   {
     int                        len;            /* Length of authorization string */
     gss_cred_id_t      server_creds;   /* Server credentials */
@@ -999,11 +1007,19 @@ cupsdAuthorize(cupsd_client_t *con)      /* I - Client connection */
 
       if (context != GSS_C_NO_CONTEXT)
        gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
+
+      gss_release_cred(&minor_status, &server_creds);
       return;
     }
 
    /*
-    * Get the username associated with the credentials...
+    * Release our credentials...
+    */
+
+    gss_release_cred(&minor_status, &server_creds);
+
+   /*
+    * Get the username associated with the client's credentials...
     */
 
     if (!con->gss_delegated_cred)
@@ -1029,8 +1045,6 @@ cupsdAuthorize(cupsd_client_t *con)       /* I - Client connection */
 
       gss_release_name(&minor_status, &client_name);
       strlcpy(username, output_token.value, sizeof(username));
-      if ((ptr = strchr(username, '@')) != NULL)
-        *ptr = '\0';                   /* Strip @KDC from the username */
 
       cupsdLogMessage(CUPSD_LOG_DEBUG,
                      "cupsdAuthorize: Authorized as %s using Negotiate",
@@ -1783,7 +1797,9 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
   unsigned             address[4];     /* Authorization address */
   cupsd_location_t     *best;          /* Best match for location so far */
   int                  hostlen;        /* Length of hostname */
-  const char           *username;      /* Username to authorize */
+  char                 username[256],  /* Username to authorize */
+                       ownername[256], /* Owner name to authorize */
+                       *ptr;           /* Pointer into username */
   struct passwd                *pw;            /* User password data */
   static const char * const levels[] = /* Auth levels */
                {
@@ -1963,7 +1979,7 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
       cupsdLogMessage(CUPSD_LOG_DEBUG,
                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
                       attr->values[0].string.text);
-      username = attr->values[0].string.text;
+      strlcpy(username, attr->values[0].string.text, sizeof(username));
     }
     else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
       return (HTTP_UNAUTHORIZED);      /* Non-anonymous needs user/pass */
@@ -1987,7 +2003,7 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
        return (HTTP_OK);               /* unless overridden with Satisfy */
     }
 
-    username = con->username;
+    strlcpy(username, con->username, sizeof(username));
   }
 
  /*
@@ -1998,6 +2014,23 @@ cupsdIsAuthorized(cupsd_client_t *con,   /* I - Connection */
   if (!strcmp(username, "root"))
     return (HTTP_OK);
 
+ /*
+  * Strip any @domain or @KDC from the username and owner...
+  */
+
+  if ((ptr = strchr(username, '@')) != NULL)
+    *ptr = '\0';
+
+  if (owner)
+  {
+    strlcpy(ownername, owner, sizeof(ownername));
+
+    if ((ptr = strchr(ownername, '@')) != NULL)
+      *ptr = '\0';
+  }
+  else
+    ownername[0] = '\0';
+
  /*
   * Get the user info...
   */
@@ -2053,7 +2086,7 @@ cupsdIsAuthorized(cupsd_client_t *con,    /* I - Connection */
     for (i = 0; i < best->num_names; i ++)
     {
       if (!strcasecmp(best->names[i], "@OWNER") && owner &&
-          !strcasecmp(username, owner))
+          !strcasecmp(username, ownername))
        return (HTTP_OK);
       else if (!strcasecmp(best->names[i], "@SYSTEM"))
       {
@@ -2635,5 +2668,5 @@ to64(char          *s,                    /* O - Output string */
 
 
 /*
- * End of "$Id: auth.c 6758 2007-08-02 00:13:44Z mike $".
+ * End of "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $".
  */