backend/ipp.c: Fix infinite loop with Kerberos

If IP address was used with Kerberos, IPP backend retried connection
indefinitely. The fix is to abort when we find out hostname is an IP
address and we require Kerberos.

diff --git a/CHANGES.md b/CHANGES.md
index b1594a67a37c8ee0d639078dc179b65efc05e253..a0c7edcc9a9247a6dd2bf2773ba1b78e7cbee567 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -14,9 +14,12 @@ Changes in CUPS v2.4.8 (TBA)
   successfully printed jobs (Issue #830)
 - Fixed crash in `scan_ps()` if incoming argument is NULL (Issue #831)
 - Fixed setting job state reasons for successful jobs (Issue #832)
+- Fixed infinite loop in IPP backend if hostname is IP address with Kerberos (Issue #838)
 - Added additional check on socket if `revents` from `poll()` returns POLLHUP
   together with POLLIN or POLLOUT in `httpAddrConnect2()` (Issue #839)
 - Fixed crash in `ppdEmitString()` if `size` is NULL (Issue #850)
+- Fixed reporting `media-source-supported` when sharing printer which has numbers as strings
+  instead of keywords as `InputSlot` values (Issue #859)
 - Fixed IPP backend to support the "print-scaling" option with IPP printers
   (Issue #862)
 
@@ -35,8 +38,6 @@ Changes in CUPS v2.4.7 (2023-09-20)
 - Fixed purging job files via `cancel -x` (Issue #742)
 - Fixed RFC 1179 port reserving behavior in LPD backend (Issue #743)
 - Fixed a bug in the PPD command interpretation code (Issue #768)
-- Fixed reporting `media-source-supported` when sharing printer which has numbers as strings
-  instead of keywords as `InputSlot` values (Issue #859)
 
 
 Changes in CUPS v2.4.6 (2023-06-22)

diff --git a/backend/ipp.c b/backend/ipp.c
index b2213746b844ea9145dee2744a8536ce6b12a190..b5da8b88ca457bec577e2bf1484408f4f2f23034 100644 (file)
--- a/backend/ipp.c
+++ b/backend/ipp.c
@@ -424,6 +424,19 @@ main(int  argc,                            /* I - Number of command-line args */
   else
     cupsSetEncryption(HTTP_ENCRYPTION_IF_REQUESTED);
 
+  if (!strcmp(auth_info_required, "negotiate") &&
+      (isdigit(hostname[0] & 255) || hostname[0] == '['))
+  {
+   /*
+    * IP addresses are not allowed with Kerberos...
+    */
+
+    _cupsLangPrintFilter(stderr, "ERROR",
+                        _("IP address is not allowed as hostname when using Negotiate - use FQDN."));
+    update_reasons(NULL, "-connecting-to-device");
+    return (CUPS_BACKEND_FAILED);
+  }
+
  /*
   * See if there are any options...
   */