]>
Commit | Line | Data |
---|---|---|
ef416fc2 | 1 | /* |
b19ccc9e | 2 | * "$Id: auth.c 7720 2008-07-11 22:46:21Z mike $" |
ef416fc2 | 3 | * |
71e16022 | 4 | * Authentication functions for CUPS. |
ef416fc2 | 5 | * |
f14324a7 | 6 | * Copyright 2007-2011 by Apple Inc. |
b86bc4cf | 7 | * Copyright 1997-2007 by Easy Software Products. |
ef416fc2 | 8 | * |
f7deaa1a | 9 | * This file contains Kerberos support code, copyright 2006 by |
10 | * Jelmer Vernooij. | |
11 | * | |
ef416fc2 | 12 | * These coded instructions, statements, and computer programs are the |
bc44d920 | 13 | * property of Apple Inc. and are protected by Federal copyright |
14 | * law. Distribution and use rights are outlined in the file "LICENSE.txt" | |
15 | * which should have been included with this file. If this file is | |
16 | * file is missing or damaged, see the license at "http://www.cups.org/". | |
ef416fc2 | 17 | * |
18 | * This file is subject to the Apple OS-Developed Software exception. | |
19 | * | |
20 | * Contents: | |
21 | * | |
22 | * cupsDoAuthentication() - Authenticate a request. | |
e07d4801 MS |
23 | * cups_get_gssname() - Get GSSAPI name for authentication. |
24 | * cups_gss_printf() - Show error messages from GSSAPI... | |
ef416fc2 | 25 | * cups_local_auth() - Get the local authorization certificate if |
26 | * available/applicable... | |
27 | */ | |
28 | ||
29 | /* | |
30 | * Include necessary headers... | |
31 | */ | |
32 | ||
71e16022 | 33 | #include "cups-private.h" |
ef416fc2 | 34 | #include <fcntl.h> |
35 | #include <sys/stat.h> | |
36 | #if defined(WIN32) || defined(__EMX__) | |
37 | # include <io.h> | |
38 | #else | |
39 | # include <unistd.h> | |
40 | #endif /* WIN32 || __EMX__ */ | |
41 | ||
f7deaa1a | 42 | #if HAVE_AUTHORIZATION_H |
43 | # include <Security/Authorization.h> | |
44 | # ifdef HAVE_SECBASEPRIV_H | |
45 | # include <Security/SecBasePriv.h> | |
46 | # else | |
47 | extern const char *cssmErrorString(int error); | |
48 | # endif /* HAVE_SECBASEPRIV_H */ | |
49 | #endif /* HAVE_AUTHORIZATION_H */ | |
50 | ||
bc44d920 | 51 | #if defined(SO_PEERCRED) && defined(AF_LOCAL) |
52 | # include <pwd.h> | |
53 | #endif /* SO_PEERCRED && AF_LOCAL */ | |
54 | ||
ef416fc2 | 55 | |
56 | /* | |
57 | * Local functions... | |
58 | */ | |
59 | ||
f7deaa1a | 60 | #ifdef HAVE_GSSAPI |
e07d4801 | 61 | static gss_name_t cups_get_gssname(http_t *http, const char *service_name); |
f7deaa1a | 62 | # ifdef DEBUG |
e07d4801 MS |
63 | static void cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status, |
64 | const char *message); | |
355e94dc | 65 | # else |
e07d4801 MS |
66 | # define cups_gss_printf(major, minor, message) |
67 | # endif /* DEBUG */ | |
f7deaa1a | 68 | #endif /* HAVE_GSSAPI */ |
ef416fc2 | 69 | static int cups_local_auth(http_t *http); |
70 | ||
71 | ||
72 | /* | |
73 | * 'cupsDoAuthentication()' - Authenticate a request. | |
74 | * | |
5a738aea | 75 | * This function should be called in response to a @code HTTP_UNAUTHORIZED@ |
ef416fc2 | 76 | * status, prior to resubmitting your request. |
77 | * | |
426c6a59 | 78 | * @since CUPS 1.1.20/Mac OS X 10.4@ |
ef416fc2 | 79 | */ |
80 | ||
81 | int /* O - 0 on success, -1 on error */ | |
f11a948a MS |
82 | cupsDoAuthentication( |
83 | http_t *http, /* I - Connection to server or @code CUPS_HTTP_DEFAULT@ */ | |
84 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
85 | const char *resource) /* I - Resource path */ | |
ef416fc2 | 86 | { |
87 | const char *password; /* Password string */ | |
88 | char prompt[1024], /* Prompt for user */ | |
89 | realm[HTTP_MAX_VALUE], /* realm="xyz" string */ | |
5a738aea | 90 | nonce[HTTP_MAX_VALUE]; /* nonce="xyz" string */ |
f7deaa1a | 91 | int localauth; /* Local authentication result */ |
b86bc4cf | 92 | _cups_globals_t *cg; /* Global data */ |
ef416fc2 | 93 | |
94 | ||
e07d4801 | 95 | DEBUG_printf(("cupsDoAuthentication(http=%p, method=\"%s\", resource=\"%s\")", |
ef416fc2 | 96 | http, method, resource)); |
ef416fc2 | 97 | |
f11a948a MS |
98 | if (!http) |
99 | http = _cupsConnect(); | |
100 | ||
101 | if (!http || !method || !resource) | |
102 | return (-1); | |
103 | ||
5a6b583a MS |
104 | DEBUG_printf(("2cupsDoAuthentication: digest_tries=%d, userpass=\"%s\"", |
105 | http->digest_tries, http->userpass)); | |
106 | DEBUG_printf(("2cupsDoAuthentication: WWW-Authenticate=\"%s\"", | |
107 | httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE))); | |
108 | ||
ef416fc2 | 109 | /* |
110 | * Clear the current authentication string... | |
111 | */ | |
112 | ||
355e94dc | 113 | httpSetAuthString(http, NULL, NULL); |
ef416fc2 | 114 | |
115 | /* | |
116 | * See if we can do local authentication... | |
117 | */ | |
118 | ||
f7deaa1a | 119 | if (http->digest_tries < 3) |
ef416fc2 | 120 | { |
f7deaa1a | 121 | if ((localauth = cups_local_auth(http)) == 0) |
122 | { | |
e07d4801 | 123 | DEBUG_printf(("2cupsDoAuthentication: authstring=\"%s\"", |
f7deaa1a | 124 | http->authstring)); |
f14324a7 | 125 | |
f7deaa1a | 126 | if (http->status == HTTP_UNAUTHORIZED) |
127 | http->digest_tries ++; | |
f14324a7 | 128 | |
f7deaa1a | 129 | return (0); |
130 | } | |
131 | else if (localauth == -1) | |
f11a948a MS |
132 | { |
133 | http->status = HTTP_AUTHORIZATION_CANCELED; | |
f7deaa1a | 134 | return (-1); /* Error or canceled */ |
f11a948a | 135 | } |
ef416fc2 | 136 | } |
137 | ||
138 | /* | |
139 | * Nope, see if we should retry the current username:password... | |
140 | */ | |
141 | ||
f7deaa1a | 142 | if ((http->digest_tries > 1 || !http->userpass[0]) && |
f14324a7 MS |
143 | (!strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Basic", 5) || |
144 | !strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Digest", 6))) | |
ef416fc2 | 145 | { |
146 | /* | |
147 | * Nope - get a new password from the user... | |
148 | */ | |
149 | ||
b86bc4cf | 150 | cg = _cupsGlobals(); |
151 | ||
152 | if (!cg->lang_default) | |
153 | cg->lang_default = cupsLangDefault(); | |
154 | ||
155 | snprintf(prompt, sizeof(prompt), | |
156 | _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), | |
157 | cupsUser(), | |
158 | http->hostname[0] == '/' ? "localhost" : http->hostname); | |
ef416fc2 | 159 | |
160 | http->digest_tries = strncasecmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], | |
161 | "Digest", 5) != 0; | |
162 | http->userpass[0] = '\0'; | |
163 | ||
f11a948a MS |
164 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) |
165 | { | |
166 | http->status = HTTP_AUTHORIZATION_CANCELED; | |
ef416fc2 | 167 | return (-1); |
f11a948a | 168 | } |
ef416fc2 | 169 | |
ef416fc2 | 170 | snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), |
171 | password); | |
172 | } | |
173 | else if (http->status == HTTP_UNAUTHORIZED) | |
174 | http->digest_tries ++; | |
175 | ||
5a6b583a MS |
176 | if (http->status == HTTP_UNAUTHORIZED && http->digest_tries >= 3) |
177 | { | |
178 | DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", | |
179 | http->digest_tries)); | |
180 | ||
181 | http->status = HTTP_AUTHORIZATION_CANCELED; | |
182 | return (-1); | |
183 | } | |
184 | ||
ef416fc2 | 185 | /* |
186 | * Got a password; encode it for the server... | |
187 | */ | |
188 | ||
f14324a7 | 189 | #ifdef HAVE_GSSAPI |
f7deaa1a | 190 | if (!strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9)) |
191 | { | |
f7deaa1a | 192 | /* |
193 | * Kerberos authentication... | |
194 | */ | |
195 | ||
f14324a7 | 196 | if (_cupsSetNegotiateAuthString(http)) |
f7deaa1a | 197 | { |
f11a948a | 198 | http->status = HTTP_AUTHORIZATION_CANCELED; |
f7deaa1a | 199 | return (-1); |
200 | } | |
f7deaa1a | 201 | } |
f14324a7 MS |
202 | else |
203 | #endif /* HAVE_GSSAPI */ | |
204 | if (!strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Basic", 5)) | |
ef416fc2 | 205 | { |
206 | /* | |
207 | * Basic authentication... | |
208 | */ | |
209 | ||
5a738aea MS |
210 | char encode[256]; /* Base64 buffer */ |
211 | ||
212 | ||
ef416fc2 | 213 | httpEncode64_2(encode, sizeof(encode), http->userpass, |
b86bc4cf | 214 | (int)strlen(http->userpass)); |
355e94dc | 215 | httpSetAuthString(http, "Basic", encode); |
ef416fc2 | 216 | } |
f14324a7 | 217 | else if (!strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Digest", 6)) |
ef416fc2 | 218 | { |
219 | /* | |
220 | * Digest authentication... | |
221 | */ | |
222 | ||
5a738aea MS |
223 | char encode[33], /* MD5 buffer */ |
224 | digest[1024]; /* Digest auth data */ | |
355e94dc MS |
225 | |
226 | ||
ef416fc2 | 227 | httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "realm", realm); |
228 | httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "nonce", nonce); | |
229 | ||
230 | httpMD5(cupsUser(), realm, strchr(http->userpass, ':') + 1, encode); | |
231 | httpMD5Final(nonce, method, resource, encode); | |
355e94dc MS |
232 | snprintf(digest, sizeof(digest), |
233 | "username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", " | |
234 | "response=\"%s\"", cupsUser(), realm, nonce, resource, encode); | |
235 | httpSetAuthString(http, "Digest", digest); | |
ef416fc2 | 236 | } |
f14324a7 MS |
237 | else |
238 | { | |
239 | DEBUG_printf(("1cupsDoAuthentication: Unknown auth type: \"%s\"", | |
240 | http->fields[HTTP_FIELD_WWW_AUTHENTICATE])); | |
241 | http->status = HTTP_AUTHORIZATION_CANCELED; | |
242 | return (-1); | |
243 | } | |
ef416fc2 | 244 | |
e07d4801 | 245 | DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\"", http->authstring)); |
ef416fc2 | 246 | |
247 | return (0); | |
248 | } | |
249 | ||
250 | ||
f7deaa1a | 251 | #ifdef HAVE_GSSAPI |
f14324a7 MS |
252 | /* |
253 | * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string. | |
254 | */ | |
255 | ||
256 | int /* O - 0 on success, -1 on error */ | |
257 | _cupsSetNegotiateAuthString( | |
258 | http_t *http) /* I - Connection to server */ | |
259 | { | |
260 | OM_uint32 minor_status, /* Minor status code */ | |
261 | major_status; /* Major status code */ | |
262 | gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; | |
07ed0e9a MS |
263 | /* Output token */ |
264 | _cups_globals_t *cg = _cupsGlobals(); /* Thread globals */ | |
f14324a7 MS |
265 | |
266 | ||
267 | # ifdef __APPLE__ | |
268 | /* | |
269 | * If the weak-linked GSSAPI/Kerberos library is not present, don't try | |
270 | * to use it... | |
271 | */ | |
272 | ||
273 | if (gss_init_sec_context == NULL) | |
274 | { | |
275 | DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos " | |
276 | "framework is not present"); | |
277 | return (-1); | |
278 | } | |
279 | # endif /* __APPLE__ */ | |
280 | ||
281 | if (http->gssname == GSS_C_NO_NAME) | |
282 | { | |
07ed0e9a MS |
283 | if (!cg->gss_service_name[0]) |
284 | _cupsSetDefaults(); | |
f14324a7 | 285 | |
07ed0e9a | 286 | http->gssname = cups_get_gssname(http, cg->gss_service_name); |
f14324a7 MS |
287 | } |
288 | ||
289 | if (http->gssctx != GSS_C_NO_CONTEXT) | |
290 | { | |
291 | gss_delete_sec_context(&minor_status, &http->gssctx, GSS_C_NO_BUFFER); | |
292 | http->gssctx = GSS_C_NO_CONTEXT; | |
293 | } | |
294 | ||
295 | major_status = gss_init_sec_context(&minor_status, GSS_C_NO_CREDENTIAL, | |
296 | &http->gssctx, | |
297 | http->gssname, http->gssmech, | |
f14324a7 MS |
298 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, |
299 | GSS_C_INDEFINITE, | |
300 | GSS_C_NO_CHANNEL_BINDINGS, | |
301 | GSS_C_NO_BUFFER, &http->gssmech, | |
302 | &output_token, NULL, NULL); | |
303 | ||
304 | if (GSS_ERROR(major_status)) | |
305 | { | |
306 | cups_gss_printf(major_status, minor_status, | |
307 | "_cupsSetNegotiateAuthString: Unable to initialize " | |
308 | "security context"); | |
309 | return (-1); | |
310 | } | |
311 | ||
22c9029b | 312 | #ifdef DEBUG |
f14324a7 MS |
313 | if (major_status == GSS_S_CONTINUE_NEEDED) |
314 | cups_gss_printf(major_status, minor_status, | |
315 | "_cupsSetNegotiateAuthString: Continuation needed!"); | |
22c9029b | 316 | #endif /* DEBUG */ |
f14324a7 MS |
317 | |
318 | if (output_token.length > 0 && output_token.length <= 65536) | |
319 | { | |
320 | /* | |
321 | * Allocate the authorization string since Windows KDCs can have | |
322 | * arbitrarily large credentials... | |
323 | */ | |
324 | ||
325 | int authsize = 10 + /* "Negotiate " */ | |
326 | output_token.length * 4 / 3 + 1 + /* Base64 */ | |
327 | 1; /* nul */ | |
328 | ||
329 | httpSetAuthString(http, NULL, NULL); | |
330 | ||
331 | if ((http->authstring = malloc(authsize)) == NULL) | |
332 | { | |
333 | http->authstring = http->_authstring; | |
334 | authsize = sizeof(http->_authstring); | |
335 | } | |
336 | ||
337 | strcpy(http->authstring, "Negotiate "); | |
338 | httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value, | |
339 | output_token.length); | |
340 | ||
341 | gss_release_buffer(&minor_status, &output_token); | |
342 | } | |
343 | else | |
344 | { | |
345 | DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos credentials too " | |
346 | "large - %d bytes!", (int)output_token.length)); | |
347 | gss_release_buffer(&minor_status, &output_token); | |
348 | ||
349 | return (-1); | |
350 | } | |
351 | ||
352 | return (0); | |
353 | } | |
354 | ||
355 | ||
f7deaa1a | 356 | /* |
e07d4801 | 357 | * 'cups_get_gssname()' - Get CUPS service credentials for authentication. |
f7deaa1a | 358 | */ |
359 | ||
360 | static gss_name_t /* O - Server name */ | |
e07d4801 | 361 | cups_get_gssname( |
f7deaa1a | 362 | http_t *http, /* I - Connection to server */ |
363 | const char *service_name) /* I - Service name */ | |
364 | { | |
365 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | |
366 | /* Service token */ | |
bc44d920 | 367 | OM_uint32 major_status, /* Major status code */ |
368 | minor_status; /* Minor status code */ | |
369 | gss_name_t server_name; /* Server name */ | |
370 | char buf[1024], /* Name buffer */ | |
371 | fqdn[HTTP_MAX_URI]; /* Server name buffer */ | |
372 | ||
373 | ||
e07d4801 MS |
374 | DEBUG_printf(("7cups_get_gssname(http=%p, service_name=\"%s\")", http, |
375 | service_name)); | |
376 | ||
377 | ||
bc44d920 | 378 | /* |
379 | * Get the hostname... | |
380 | */ | |
f7deaa1a | 381 | |
bc44d920 | 382 | httpGetHostname(http, fqdn, sizeof(fqdn)); |
383 | ||
384 | if (!strcmp(fqdn, "localhost")) | |
385 | httpGetHostname(NULL, fqdn, sizeof(fqdn)); | |
f7deaa1a | 386 | |
387 | /* | |
388 | * Get a server name we can use for authentication purposes... | |
389 | */ | |
390 | ||
bc44d920 | 391 | snprintf(buf, sizeof(buf), "%s@%s", service_name, fqdn); |
f7deaa1a | 392 | |
e07d4801 | 393 | DEBUG_printf(("9cups_get_gssname: Looking up %s...", buf)); |
7ff4fea9 | 394 | |
f7deaa1a | 395 | token.value = buf; |
396 | token.length = strlen(buf); | |
397 | server_name = GSS_C_NO_NAME; | |
398 | major_status = gss_import_name(&minor_status, &token, | |
399 | GSS_C_NT_HOSTBASED_SERVICE, | |
400 | &server_name); | |
401 | ||
402 | if (GSS_ERROR(major_status)) | |
403 | { | |
e07d4801 MS |
404 | cups_gss_printf(major_status, minor_status, |
405 | "cups_get_gssname: gss_import_name() failed"); | |
f7deaa1a | 406 | return (NULL); |
407 | } | |
408 | ||
409 | return (server_name); | |
410 | } | |
e07d4801 MS |
411 | |
412 | ||
413 | # ifdef DEBUG | |
414 | /* | |
415 | * 'cups_gss_printf()' - Show debug error messages from GSSAPI... | |
416 | */ | |
417 | ||
418 | static void | |
419 | cups_gss_printf(OM_uint32 major_status,/* I - Major status code */ | |
420 | OM_uint32 minor_status,/* I - Minor status code */ | |
421 | const char *message) /* I - Prefix for error message */ | |
422 | { | |
423 | OM_uint32 err_major_status, /* Major status code for display */ | |
424 | err_minor_status; /* Minor status code for display */ | |
425 | OM_uint32 msg_ctx; /* Message context */ | |
426 | gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER, | |
427 | /* Major status message */ | |
428 | minor_status_string = GSS_C_EMPTY_BUFFER; | |
429 | /* Minor status message */ | |
430 | ||
431 | ||
432 | msg_ctx = 0; | |
433 | err_major_status = gss_display_status(&err_minor_status, | |
434 | major_status, | |
435 | GSS_C_GSS_CODE, | |
436 | GSS_C_NO_OID, | |
437 | &msg_ctx, | |
438 | &major_status_string); | |
439 | ||
440 | if (!GSS_ERROR(err_major_status)) | |
441 | gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE, | |
442 | GSS_C_NULL_OID, &msg_ctx, &minor_status_string); | |
443 | ||
68b10830 | 444 | DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value, |
e07d4801 MS |
445 | (char *)minor_status_string.value)); |
446 | ||
447 | gss_release_buffer(&err_minor_status, &major_status_string); | |
448 | gss_release_buffer(&err_minor_status, &minor_status_string); | |
449 | } | |
450 | # endif /* DEBUG */ | |
f7deaa1a | 451 | #endif /* HAVE_GSSAPI */ |
452 | ||
453 | ||
ef416fc2 | 454 | /* |
455 | * 'cups_local_auth()' - Get the local authorization certificate if | |
456 | * available/applicable... | |
457 | */ | |
458 | ||
f7deaa1a | 459 | static int /* O - 0 if available */ |
bc44d920 | 460 | /* 1 if not available */ |
f7deaa1a | 461 | /* -1 error */ |
ef416fc2 | 462 | cups_local_auth(http_t *http) /* I - HTTP connection to server */ |
463 | { | |
464 | #if defined(WIN32) || defined(__EMX__) | |
465 | /* | |
466 | * Currently WIN32 and OS-2 do not support the CUPS server... | |
467 | */ | |
468 | ||
bc44d920 | 469 | return (1); |
ef416fc2 | 470 | #else |
f7deaa1a | 471 | int pid; /* Current process ID */ |
472 | FILE *fp; /* Certificate file */ | |
e07d4801 MS |
473 | char trc[16], /* Try Root Certificate parameter */ |
474 | filename[1024], /* Certificate filename */ | |
f7deaa1a | 475 | certificate[33];/* Certificate string */ |
ef416fc2 | 476 | _cups_globals_t *cg = _cupsGlobals(); /* Global data */ |
bc44d920 | 477 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 478 | OSStatus status; /* Status */ |
479 | AuthorizationItem auth_right; /* Authorization right */ | |
480 | AuthorizationRights auth_rights; /* Authorization rights */ | |
481 | AuthorizationFlags auth_flags; /* Authorization flags */ | |
482 | AuthorizationExternalForm auth_extrn; /* Authorization ref external */ | |
483 | char auth_key[1024]; /* Buffer */ | |
484 | char buffer[1024]; /* Buffer */ | |
bc44d920 | 485 | # endif /* HAVE_AUTHORIZATION_H */ |
ef416fc2 | 486 | |
487 | ||
e07d4801 | 488 | DEBUG_printf(("7cups_local_auth(http=%p) hostaddr=%s, hostname=\"%s\"", |
ef416fc2 | 489 | http, httpAddrString(http->hostaddr, filename, sizeof(filename)), http->hostname)); |
490 | ||
491 | /* | |
492 | * See if we are accessing localhost... | |
493 | */ | |
494 | ||
495 | if (!httpAddrLocalhost(http->hostaddr) && | |
496 | strcasecmp(http->hostname, "localhost") != 0) | |
497 | { | |
e07d4801 | 498 | DEBUG_puts("8cups_local_auth: Not a local connection!"); |
bc44d920 | 499 | return (1); |
ef416fc2 | 500 | } |
501 | ||
bc44d920 | 502 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 503 | /* |
504 | * Delete any previous authorization reference... | |
505 | */ | |
f14324a7 | 506 | |
b94498cf | 507 | if (http->auth_ref) |
f7deaa1a | 508 | { |
b94498cf | 509 | AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults); |
510 | http->auth_ref = NULL; | |
f7deaa1a | 511 | } |
512 | ||
e4572d57 | 513 | if (!getenv("GATEWAY_INTERFACE") && |
f14324a7 | 514 | httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", |
f7deaa1a | 515 | auth_key, sizeof(auth_key))) |
516 | { | |
f14324a7 | 517 | status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, |
b94498cf | 518 | kAuthorizationFlagDefaults, &http->auth_ref); |
f7deaa1a | 519 | if (status != errAuthorizationSuccess) |
520 | { | |
e07d4801 | 521 | DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d (%s)", |
f7deaa1a | 522 | (int)status, cssmErrorString(status))); |
523 | return (-1); | |
524 | } | |
525 | ||
526 | auth_right.name = auth_key; | |
527 | auth_right.valueLength = 0; | |
528 | auth_right.value = NULL; | |
529 | auth_right.flags = 0; | |
530 | ||
531 | auth_rights.count = 1; | |
532 | auth_rights.items = &auth_right; | |
533 | ||
f14324a7 | 534 | auth_flags = kAuthorizationFlagDefaults | |
f7deaa1a | 535 | kAuthorizationFlagPreAuthorize | |
f14324a7 | 536 | kAuthorizationFlagInteractionAllowed | |
f7deaa1a | 537 | kAuthorizationFlagExtendRights; |
538 | ||
f14324a7 MS |
539 | status = AuthorizationCopyRights(http->auth_ref, &auth_rights, |
540 | kAuthorizationEmptyEnvironment, | |
f7deaa1a | 541 | auth_flags, NULL); |
542 | if (status == errAuthorizationSuccess) | |
b94498cf | 543 | status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn); |
f7deaa1a | 544 | |
545 | if (status == errAuthorizationSuccess) | |
546 | { | |
547 | /* | |
548 | * Set the authorization string and return... | |
549 | */ | |
550 | ||
f14324a7 | 551 | httpEncode64_2(buffer, sizeof(buffer), (void *)&auth_extrn, |
f7deaa1a | 552 | sizeof(auth_extrn)); |
553 | ||
355e94dc | 554 | httpSetAuthString(http, "AuthRef", buffer); |
f7deaa1a | 555 | |
e07d4801 | 556 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
f7deaa1a | 557 | http->authstring)); |
558 | return (0); | |
559 | } | |
560 | else if (status == errAuthorizationCanceled) | |
561 | return (-1); | |
562 | ||
e07d4801 | 563 | DEBUG_printf(("9cups_local_auth: AuthorizationCopyRights() returned %d (%s)", |
f7deaa1a | 564 | (int)status, cssmErrorString(status))); |
565 | ||
566 | /* | |
567 | * Fall through to try certificates... | |
568 | */ | |
569 | } | |
bc44d920 | 570 | # endif /* HAVE_AUTHORIZATION_H */ |
f7deaa1a | 571 | |
f11a948a MS |
572 | # if defined(SO_PEERCRED) && defined(AF_LOCAL) |
573 | /* | |
574 | * See if we can authenticate using the peer credentials provided over a | |
575 | * domain socket; if so, specify "PeerCred username" as the authentication | |
576 | * information... | |
577 | */ | |
578 | ||
68b10830 | 579 | if ( |
f14324a7 MS |
580 | # ifdef HAVE_GSSAPI |
581 | strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9) && | |
68b10830 | 582 | # endif /* HAVE_GSSAPI */ |
f14324a7 MS |
583 | # ifdef HAVE_AUTHORIZATION_H |
584 | !httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", | |
585 | auth_key, sizeof(auth_key)) && | |
586 | # endif /* HAVE_AUTHORIZATION_H */ | |
68b10830 | 587 | http->hostaddr->addr.sa_family == AF_LOCAL && |
f11a948a MS |
588 | !getenv("GATEWAY_INTERFACE")) /* Not via CGI programs... */ |
589 | { | |
590 | /* | |
591 | * Verify that the current cupsUser() matches the current UID... | |
592 | */ | |
593 | ||
594 | struct passwd *pwd; /* Password information */ | |
595 | const char *username; /* Current username */ | |
596 | ||
597 | username = cupsUser(); | |
598 | ||
599 | if ((pwd = getpwnam(username)) != NULL && pwd->pw_uid == getuid()) | |
600 | { | |
601 | httpSetAuthString(http, "PeerCred", username); | |
602 | ||
603 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", | |
604 | http->authstring)); | |
605 | ||
606 | return (0); | |
607 | } | |
608 | } | |
609 | # endif /* SO_PEERCRED && AF_LOCAL */ | |
610 | ||
ef416fc2 | 611 | /* |
612 | * Try opening a certificate file for this PID. If that fails, | |
613 | * try the root certificate... | |
614 | */ | |
615 | ||
616 | pid = getpid(); | |
617 | snprintf(filename, sizeof(filename), "%s/certs/%d", cg->cups_statedir, pid); | |
618 | if ((fp = fopen(filename, "r")) == NULL && pid > 0) | |
619 | { | |
bc44d920 | 620 | /* |
e07d4801 | 621 | * No certificate for this PID; see if we can get the root certificate... |
bc44d920 | 622 | */ |
623 | ||
e07d4801 MS |
624 | DEBUG_printf(("9cups_local_auth: Unable to open file %s: %s", |
625 | filename, strerror(errno))); | |
626 | ||
07ed0e9a | 627 | # ifdef HAVE_GSSAPI |
355e94dc | 628 | if (!strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9)) |
bc44d920 | 629 | { |
630 | /* | |
e07d4801 | 631 | * Kerberos required, don't try the root certificate... |
bc44d920 | 632 | */ |
633 | ||
634 | return (1); | |
635 | } | |
07ed0e9a | 636 | # endif /* HAVE_GSSAPI */ |
bc44d920 | 637 | |
07ed0e9a MS |
638 | # ifdef HAVE_AUTHORIZATION_H |
639 | if (httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", | |
640 | auth_key, sizeof(auth_key))) | |
641 | { | |
642 | /* | |
643 | * Don't use the root certificate as a replacement for an authkey... | |
644 | */ | |
645 | ||
646 | return (1); | |
647 | } | |
648 | # endif /* HAVE_AUTHORIZATION_H */ | |
e07d4801 MS |
649 | if (!httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "trc", trc, |
650 | sizeof(trc))) | |
651 | { | |
652 | /* | |
653 | * Scheduler doesn't want us to use the root certificate... | |
654 | */ | |
655 | ||
656 | return (1); | |
657 | } | |
658 | ||
ef416fc2 | 659 | snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir); |
660 | fp = fopen(filename, "r"); | |
661 | } | |
662 | ||
f7deaa1a | 663 | if (fp) |
ef416fc2 | 664 | { |
f7deaa1a | 665 | /* |
666 | * Read the certificate from the file... | |
667 | */ | |
ef416fc2 | 668 | |
f7deaa1a | 669 | fgets(certificate, sizeof(certificate), fp); |
670 | fclose(fp); | |
ef416fc2 | 671 | |
f7deaa1a | 672 | /* |
673 | * Set the authorization string and return... | |
674 | */ | |
ef416fc2 | 675 | |
355e94dc | 676 | httpSetAuthString(http, "Local", certificate); |
ef416fc2 | 677 | |
e07d4801 | 678 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
f7deaa1a | 679 | http->authstring)); |
ef416fc2 | 680 | |
f7deaa1a | 681 | return (0); |
682 | } | |
683 | ||
684 | return (1); | |
ef416fc2 | 685 | #endif /* WIN32 || __EMX__ */ |
686 | } | |
687 | ||
688 | ||
689 | /* | |
b19ccc9e | 690 | * End of "$Id: auth.c 7720 2008-07-11 22:46:21Z mike $". |
ef416fc2 | 691 | */ |