|
 |
bdf6254 |
diff -up cups-2.2.7/scheduler/ipp.c.substitute-bad-attrs cups-2.2.7/scheduler/ipp.c
|
|
|
bdf6254 |
--- cups-2.2.7/scheduler/ipp.c.substitute-bad-attrs 2018-04-03 15:55:45.974344993 +0200
|
|
|
bdf6254 |
+++ cups-2.2.7/scheduler/ipp.c 2018-04-03 16:15:06.723859881 +0200
|
|
|
bdf6254 |
@@ -164,6 +164,7 @@ cupsdProcessIPPRequest(
|
|
|
bdf6254 |
ipp_attribute_t *uri = NULL; /* Printer or job URI attribute */
|
|
|
bdf6254 |
ipp_attribute_t *username; /* requesting-user-name attr */
|
|
|
bdf6254 |
int sub_id; /* Subscription ID */
|
|
|
bdf6254 |
+ int valid = 1; /* Valid request? */
|
|
|
bdf6254 |
|
|
|
bdf6254 |
|
|
|
bdf6254 |
cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdProcessIPPRequest(%p[%d]): operation_id=%04x(%s)", con, con->number, con->request->request.op.operation_id, ippOpString(con->request->request.op.operation_id));
|
|
|
bdf6254 |
@@ -423,20 +424,55 @@ cupsdProcessIPPRequest(
|
|
|
bdf6254 |
else
|
|
|
bdf6254 |
{
|
|
|
bdf6254 |
/*
|
|
|
bdf6254 |
- * OK, all the checks pass so far; make sure requesting-user-name is
|
|
|
bdf6254 |
- * not "root" from a remote host...
|
|
|
bdf6254 |
+ * OK, all the checks pass so far; validate "requesting-user-name"
|
|
|
bdf6254 |
+ * attribute value...
|
|
|
bdf6254 |
*/
|
|
|
bdf6254 |
|
|
|
bdf6254 |
- if ((username = ippFindAttribute(con->request, "requesting-user-name",
|
|
|
bdf6254 |
- IPP_TAG_NAME)) != NULL)
|
|
|
bdf6254 |
- {
|
|
|
bdf6254 |
- /*
|
|
|
bdf6254 |
- * Check for root user...
|
|
|
bdf6254 |
- */
|
|
|
bdf6254 |
-
|
|
|
bdf6254 |
- if (!strcmp(username->values[0].string.text, "root") &&
|
|
|
bdf6254 |
- _cups_strcasecmp(con->http->hostname, "localhost") &&
|
|
|
bdf6254 |
- strcmp(con->username, "root"))
|
|
|
bdf6254 |
+ if ((username = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_ZERO)) != NULL)
|
|
|
bdf6254 |
+ {
|
|
|
bdf6254 |
+ /*
|
|
|
bdf6254 |
+ * Validate "requesting-user-name"...
|
|
|
bdf6254 |
+ */
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ if (username->group_tag != IPP_TAG_OPERATION && StrictConformance)
|
|
|
bdf6254 |
+ {
|
|
|
bdf6254 |
+ cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL, "%04X %s \"requesting-user-name\" attribute in wrong group.", IPP_STATUS_ERROR_BAD_REQUEST, con->http->hostname);
|
|
|
bdf6254 |
+ send_ipp_status(con, IPP_STATUS_ERROR_BAD_REQUEST, _("\"requesting-user-name\" attribute in wrong group."));
|
|
|
bdf6254 |
+ valid = 0;
|
|
|
bdf6254 |
+ }
|
|
|
bdf6254 |
+ else if (username->value_tag != IPP_TAG_NAME && username->value_tag != IPP_TAG_NAMELANG)
|
|
|
bdf6254 |
+ {
|
|
|
bdf6254 |
+ cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL, "%04X %s \"requesting-user-name\" attribute with wrong syntax.", IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES, con->http->hostname);
|
|
|
bdf6254 |
+ send_ipp_status(con, IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES, _("\"requesting-user-name\" attribute with wrong syntax."));
|
|
|
bdf6254 |
+ if ((attr = ippCopyAttribute(con->response, username, 0)) != NULL)
|
|
|
bdf6254 |
+ attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
|
|
|
bdf6254 |
+ valid = 0;
|
|
|
bdf6254 |
+ }
|
|
|
bdf6254 |
+ else if (!ippValidateAttribute(username))
|
|
|
bdf6254 |
+ {
|
|
|
bdf6254 |
+ cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL, "%04X %s \"requesting-user-name\" attribute with bad value.", IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES, con->http->hostname);
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ if (StrictConformance)
|
|
|
bdf6254 |
+ {
|
|
|
bdf6254 |
+ /*
|
|
|
bdf6254 |
+ * Throw an error...
|
|
|
bdf6254 |
+ */
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ send_ipp_status(con, IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES, _("\"requesting-user-name\" attribute with wrong syntax."));
|
|
|
bdf6254 |
+ if ((attr = ippCopyAttribute(con->response, username, 0)) != NULL)
|
|
|
bdf6254 |
+ attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
|
|
|
bdf6254 |
+ valid = 0;
|
|
|
bdf6254 |
+ }
|
|
|
bdf6254 |
+ else
|
|
|
bdf6254 |
+ {
|
|
|
bdf6254 |
+ /*
|
|
|
bdf6254 |
+ * Map bad "requesting-user-name" to 'anonymous'...
|
|
|
bdf6254 |
+ */
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ ippSetString(con->request, &username, 0, "anonymous");
|
|
|
bdf6254 |
+ }
|
|
|
bdf6254 |
+ }
|
|
|
bdf6254 |
+ else if (!strcmp(username->values[0].string.text, "root") && _cups_strcasecmp(con->http->hostname, "localhost") && strcmp(con->username, "root"))
|
|
|
bdf6254 |
{
|
|
|
bdf6254 |
/*
|
|
|
bdf6254 |
* Remote unauthenticated user masquerading as local root...
|
|
|
bdf6254 |
@@ -452,6 +488,8 @@ cupsdProcessIPPRequest(
|
|
|
bdf6254 |
else
|
|
|
bdf6254 |
sub_id = 0;
|
|
|
bdf6254 |
|
|
|
bdf6254 |
+ if (valid)
|
|
|
bdf6254 |
+ {
|
|
|
bdf6254 |
/*
|
|
|
bdf6254 |
* Then try processing the operation...
|
|
|
bdf6254 |
*/
|
|
|
bdf6254 |
@@ -655,6 +693,7 @@ cupsdProcessIPPRequest(
|
|
|
bdf6254 |
ippOpString(
|
|
|
bdf6254 |
con->request->request.op.operation_id));
|
|
|
bdf6254 |
break;
|
|
|
bdf6254 |
+ }
|
|
|
bdf6254 |
}
|
|
|
bdf6254 |
}
|
|
|
bdf6254 |
}
|
|
|
bdf6254 |
@@ -1615,27 +1654,34 @@ add_job(cupsd_client_t *con, /* I - Cl
|
|
|
bdf6254 |
_("Bad job-name value: Wrong type or count."));
|
|
|
bdf6254 |
if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
|
|
|
bdf6254 |
attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
|
|
|
bdf6254 |
- return (NULL);
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ if (StrictConformance)
|
|
|
bdf6254 |
+ return (NULL);
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ /* Don't use invalid attribute */
|
|
|
bdf6254 |
+ ippDeleteAttribute(con->request, attr);
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "job-name", NULL, "Untitled");
|
|
|
bdf6254 |
}
|
|
|
bdf6254 |
else if (!ippValidateAttribute(attr))
|
|
|
bdf6254 |
{
|
|
|
bdf6254 |
send_ipp_status(con, IPP_ATTRIBUTES, _("Bad job-name value: %s"),
|
|
|
bdf6254 |
cupsLastErrorString());
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
|
|
|
bdf6254 |
attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
|
|
|
bdf6254 |
- return (NULL);
|
|
|
bdf6254 |
- }
|
|
|
bdf6254 |
|
|
|
bdf6254 |
- attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
|
|
|
bdf6254 |
+ if (StrictConformance)
|
|
|
bdf6254 |
+ return (NULL);
|
|
|
bdf6254 |
|
|
|
bdf6254 |
- if (attr && !ippValidateAttribute(attr))
|
|
|
bdf6254 |
- {
|
|
|
bdf6254 |
- send_ipp_status(con, IPP_ATTRIBUTES, _("Bad requesting-user-name value: %s"), cupsLastErrorString());
|
|
|
bdf6254 |
- if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
|
|
|
bdf6254 |
- attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
|
|
|
bdf6254 |
- return (NULL);
|
|
|
bdf6254 |
+ /* Don't use invalid attribute */
|
|
|
bdf6254 |
+ ippDeleteAttribute(con->request, attr);
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
+ ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "job-name", NULL, "Untitled");
|
|
|
bdf6254 |
}
|
|
|
bdf6254 |
|
|
|
bdf6254 |
+ attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
|
|
|
bdf6254 |
+
|
|
|
bdf6254 |
#ifdef WITH_LSPP
|
|
|
bdf6254 |
if (is_lspp_config())
|
|
|
bdf6254 |
{
|