2 * "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $"
4 * Authorization routines for the Common UNIX Printing System (CUPS).
6 * Copyright 2007-2009 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
9 * This file contains Kerberos support code, copyright 2006 by
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
20 * cupsdAddLocation() - Add a location for authorization.
21 * cupsdAddName() - Add a name to a location...
22 * cupsdAllowHost() - Add a host name that is allowed to access the
24 * cupsdAllowIP() - Add an IP address or network that is allowed to
25 * access the location.
26 * cupsdAuthorize() - Validate any authorization credentials.
27 * cupsdCheckAccess() - Check whether the given address is allowed to
29 * cupsdCheckAuth() - Check authorization masks.
30 * cupsdCheckGroup() - Check for a user's group membership.
31 * cupsdCopyKrb5Creds() - Get a copy of the Kerberos credentials.
32 * cupsdCopyLocation() - Make a copy of a location...
33 * cupsdDeleteAllLocations() - Free all memory used for location
35 * cupsdDeleteLocation() - Free all memory used by a location.
36 * cupsdDenyHost() - Add a host name that is not allowed to access
38 * cupsdDenyIP() - Add an IP address or network that is not
39 * allowed to access the location.
40 * cupsdFindBest() - Find the location entry that best matches the
42 * cupsdFindLocation() - Find the named location.
43 * cupsdIsAuthorized() - Check to see if the user is authorized...
44 * add_allow() - Add an allow mask to the location.
45 * add_deny() - Add a deny mask to the location.
46 * check_authref() - Check if an authorization services reference
47 * has the supplied right.
48 * compare_locations() - Compare two locations.
49 * cups_crypt() - Encrypt the password using the DES or MD5
50 * algorithms, as needed.
51 * get_md5_password() - Get an MD5 password.
52 * pam_func() - PAM conversation function.
53 * to64() - Base64-encode an integer value...
57 * Include necessary headers...
64 #endif /* HAVE_SHADOW_H */
67 #endif /* HAVE_CRYPT_H */
69 # ifdef HAVE_PAM_PAM_APPL_H
70 # include <pam/pam_appl.h>
72 # include <security/pam_appl.h>
73 # endif /* HAVE_PAM_PAM_APPL_H */
74 #endif /* HAVE_LIBPAM */
77 #endif /* HAVE_USERSEC_H */
78 #ifdef HAVE_MEMBERSHIP_H
79 # include <membership.h>
80 #endif /* HAVE_MEMBERSHIP_H */
81 #ifdef HAVE_AUTHORIZATION_H
82 # include <Security/AuthorizationTags.h>
83 # ifdef HAVE_SECBASEPRIV_H
84 # include <Security/SecBasePriv.h>
86 extern const char *cssmErrorString(int error
);
87 # endif /* HAVE_SECBASEPRIV_H */
88 #endif /* HAVE_AUTHORIZATION_H */
89 #ifdef HAVE_SYS_PARAM_H
90 # include <sys/param.h>
91 #endif /* HAVE_SYS_PARAM_H */
92 #ifdef HAVE_SYS_UCRED_H
93 # include <sys/ucred.h>
94 typedef struct xucred cupsd_ucred_t
;
95 # define CUPSD_UCRED_UID(c) (c).cr_uid
97 typedef struct ucred cupsd_ucred_t
;
98 # define CUPSD_UCRED_UID(c) (c).uid
99 #endif /* HAVE_SYS_UCRED_H */
100 #ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
101 /* Not in public headers... */
102 extern void krb5_ipc_client_set_target_uid(uid_t
);
103 extern void krb5_ipc_client_clear_target(void);
104 #endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
111 static cupsd_authmask_t
*add_allow(cupsd_location_t
*loc
);
112 static cupsd_authmask_t
*add_deny(cupsd_location_t
*loc
);
113 #ifdef HAVE_AUTHORIZATION_H
114 static int check_authref(cupsd_client_t
*con
, const char *right
);
115 #endif /* HAVE_AUTHORIZATION_H */
116 static int compare_locations(cupsd_location_t
*a
,
117 cupsd_location_t
*b
);
118 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
119 static char *cups_crypt(const char *pw
, const char *salt
);
120 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
121 static char *get_md5_password(const char *username
,
122 const char *group
, char passwd
[33]);
124 static int pam_func(int, const struct pam_message
**,
125 struct pam_response
**, void *);
126 #elif !defined(HAVE_USERSEC_H)
127 static void to64(char *s
, unsigned long v
, int n
);
128 #endif /* HAVE_LIBPAM */
132 * Local structures...
136 typedef struct cupsd_authdata_s
/**** Authentication data ****/
138 char username
[33], /* Username string */
139 password
[33]; /* Password string */
141 #endif /* HAVE_LIBPAM */
148 #if defined(__hpux) && HAVE_LIBPAM
149 static cupsd_authdata_t
*auth_data
; /* Current client being authenticated */
150 #endif /* __hpux && HAVE_LIBPAM */
154 * 'cupsdAddLocation()' - Add a location for authorization.
157 cupsd_location_t
* /* O - Pointer to new location record */
158 cupsdAddLocation(const char *location
) /* I - Location path */
160 cupsd_location_t
*temp
; /* New location */
164 * Make sure the locations array is created...
168 Locations
= cupsArrayNew((cups_array_func_t
)compare_locations
, NULL
);
174 * Try to allocate memory for the new location.
177 if ((temp
= calloc(1, sizeof(cupsd_location_t
))) == NULL
)
181 * Initialize the record and copy the name over...
184 if ((temp
->location
= strdup(location
)) == NULL
)
190 temp
->length
= strlen(temp
->location
);
192 cupsArrayAdd(Locations
, temp
);
194 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddLocation: added location \'%s\'",
198 * Return the new record...
206 * 'cupsdAddName()' - Add a name to a location...
210 cupsdAddName(cupsd_location_t
*loc
, /* I - Location to add to */
211 char *name
) /* I - Name to add */
213 char **temp
; /* Pointer to names array */
216 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddName(loc=%p, name=\"%s\")",
219 if (loc
->num_names
== 0)
220 temp
= malloc(sizeof(char *));
222 temp
= realloc(loc
->names
, (loc
->num_names
+ 1) * sizeof(char *));
226 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to add name to location %s: %s",
227 loc
->location
? loc
->location
: "nil", strerror(errno
));
233 if ((temp
[loc
->num_names
] = strdup(name
)) == NULL
)
235 cupsdLogMessage(CUPSD_LOG_ERROR
,
236 "Unable to duplicate name for location %s: %s",
237 loc
->location
? loc
->location
: "nil", strerror(errno
));
246 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
250 cupsdAllowHost(cupsd_location_t
*loc
, /* I - Location to add to */
251 char *name
) /* I - Name of host or domain to add */
253 cupsd_authmask_t
*temp
; /* New host/domain mask */
254 char ifname
[32], /* Interface name */
255 *ifptr
; /* Pointer to end of name */
258 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
259 loc
, loc
->location
? loc
->location
: "nil", name
);
261 if ((temp
= add_allow(loc
)) == NULL
)
264 if (!strcasecmp(name
, "@LOCAL"))
267 * Allow *interface*...
270 temp
->type
= CUPSD_AUTH_INTERFACE
;
271 temp
->mask
.name
.name
= strdup("*");
272 temp
->mask
.name
.length
= 1;
274 else if (!strncasecmp(name
, "@IF(", 4))
277 * Allow *interface*...
280 strlcpy(ifname
, name
+ 4, sizeof(ifname
));
282 ifptr
= ifname
+ strlen(ifname
);
284 if (ifptr
[-1] == ')')
290 temp
->type
= CUPSD_AUTH_INTERFACE
;
291 temp
->mask
.name
.name
= strdup(ifname
);
292 temp
->mask
.name
.length
= ifptr
- ifname
;
300 temp
->type
= CUPSD_AUTH_NAME
;
301 temp
->mask
.name
.name
= strdup(name
);
302 temp
->mask
.name
.length
= strlen(name
);
308 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
314 cupsd_location_t
*loc
, /* I - Location to add to */
315 const unsigned address
[4], /* I - IP address to add */
316 const unsigned netmask
[4]) /* I - Netmask of address */
318 cupsd_authmask_t
*temp
; /* New host/domain mask */
321 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
322 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
323 loc
, loc
->location
? loc
->location
: "nil",
324 address
[0], address
[1], address
[2], address
[3],
325 netmask
[0], netmask
[1], netmask
[2], netmask
[3]);
327 if ((temp
= add_allow(loc
)) == NULL
)
330 temp
->type
= CUPSD_AUTH_IP
;
331 memcpy(temp
->mask
.ip
.address
, address
, sizeof(temp
->mask
.ip
.address
));
332 memcpy(temp
->mask
.ip
.netmask
, netmask
, sizeof(temp
->mask
.ip
.netmask
));
337 * 'cupsdAuthorize()' - Validate any authorization credentials.
341 cupsdAuthorize(cupsd_client_t
*con
) /* I - Client connection */
343 int type
; /* Authentication type */
344 const char *authorization
; /* Pointer into Authorization string */
345 char *ptr
, /* Pointer into string */
346 username
[256], /* Username string */
347 password
[33]; /* Password string */
348 cupsd_cert_t
*localuser
; /* Certificate username */
349 char nonce
[HTTP_MAX_VALUE
], /* Nonce value from client */
350 md5
[33], /* MD5 password */
351 basicmd5
[33]; /* MD5 of Basic password */
352 static const char * const states
[] = /* HTTP client states... */
372 * Locate the best matching location so we know what kind of
373 * authentication to expect...
376 con
->best
= cupsdFindBest(con
->uri
, con
->http
.state
);
377 con
->type
= CUPSD_AUTH_NONE
;
379 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
380 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
381 con
->uri
, con
->best
, con
->best
? con
->best
->location
: "");
383 if (con
->best
&& con
->best
->type
!= CUPSD_AUTH_NONE
)
385 if (con
->best
->type
== CUPSD_AUTH_DEFAULT
)
386 type
= DefaultAuthType
;
388 type
= con
->best
->type
;
391 type
= DefaultAuthType
;
394 * Decode the Authorization string...
397 authorization
= httpGetField(&con
->http
, HTTP_FIELD_AUTHORIZATION
);
399 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAuthorize: Authorization=\"%s\"",
405 #ifdef HAVE_AUTHORIZATION_H
408 AuthorizationFree(con
->authref
, kAuthorizationFlagDefaults
);
411 #endif /* HAVE_AUTHORIZATION_H */
416 * No authorization data provided, return early...
419 cupsdLogMessage(CUPSD_LOG_DEBUG
,
420 "cupsdAuthorize: No authentication data provided.");
423 #ifdef HAVE_AUTHORIZATION_H
424 else if (!strncmp(authorization
, "AuthRef", 6) &&
425 !strcasecmp(con
->http
.hostname
, "localhost"))
427 OSStatus status
; /* Status */
428 int authlen
; /* Auth string length */
429 AuthorizationItemSet
*authinfo
; /* Authorization item set */
432 * Get the Authorization Services data...
436 while (isspace(*authorization
& 255))
439 authlen
= sizeof(nonce
);
440 httpDecode64_2(nonce
, &authlen
, authorization
);
442 if (authlen
!= kAuthorizationExternalFormLength
)
444 cupsdLogMessage(CUPSD_LOG_ERROR
,
445 "External Authorization reference size is incorrect!");
449 if ((status
= AuthorizationCreateFromExternalForm(
450 (AuthorizationExternalForm
*)nonce
, &con
->authref
)) != 0)
452 cupsdLogMessage(CUPSD_LOG_ERROR
,
453 "AuthorizationCreateFromExternalForm returned %d (%s)",
454 (int)status
, cssmErrorString(status
));
458 strlcpy(username
, "_AUTHREF_", sizeof(username
));
460 if (!AuthorizationCopyInfo(con
->authref
, kAuthorizationEnvironmentUsername
,
463 if (authinfo
->count
== 1 && authinfo
->items
[0].value
&&
464 authinfo
->items
[0].valueLength
>= 2)
465 strlcpy(username
, authinfo
->items
[0].value
, sizeof(username
));
467 AuthorizationFreeItemSet(authinfo
);
470 cupsdLogMessage(CUPSD_LOG_DEBUG
,
471 "cupsdAuthorize: Authorized as \"%s\" using AuthRef",
473 con
->type
= CUPSD_AUTH_BASIC
;
475 #endif /* HAVE_AUTHORIZATION_H */
476 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
477 else if (!strncmp(authorization
, "PeerCred ", 9) &&
478 con
->http
.hostaddr
->addr
.sa_family
== AF_LOCAL
)
481 * Use peer credentials from domain socket connection...
484 struct passwd
*pwd
; /* Password entry for this user */
485 cupsd_ucred_t peercred
; /* Peer credentials */
486 socklen_t peersize
; /* Size of peer credentials */
489 if ((pwd
= getpwnam(authorization
+ 9)) == NULL
)
491 cupsdLogMessage(CUPSD_LOG_ERROR
, "User \"%s\" does not exist!",
496 peersize
= sizeof(peercred
);
499 if (getsockopt(con
->http
.fd
, 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
501 if (getsockopt(con
->http
.fd
, SOL_SOCKET
, SO_PEERCRED
, &peercred
, &peersize
))
502 # endif /* __APPLE__ */
504 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s",
509 if (pwd
->pw_uid
!= CUPSD_UCRED_UID(peercred
))
511 cupsdLogMessage(CUPSD_LOG_ERROR
,
512 "Invalid peer credentials for \"%s\" - got %d, "
513 "expected %d!", authorization
+ 9,
514 CUPSD_UCRED_UID(peercred
), pwd
->pw_uid
);
515 # ifdef HAVE_SYS_UCRED_H
516 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_version=%d",
517 peercred
.cr_version
);
518 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_uid=%d",
520 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_ngroups=%d",
521 peercred
.cr_ngroups
);
522 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_groups[0]=%d",
523 peercred
.cr_groups
[0]);
524 # endif /* HAVE_SYS_UCRED_H */
528 strlcpy(username
, authorization
+ 9, sizeof(username
));
530 cupsdLogMessage(CUPSD_LOG_DEBUG
,
531 "cupsdAuthorize: Authorized as %s using PeerCred",
534 con
->type
= CUPSD_AUTH_BASIC
;
536 #endif /* SO_PEERCRED && AF_LOCAL */
537 else if (!strncmp(authorization
, "Local", 5) &&
538 !strcasecmp(con
->http
.hostname
, "localhost"))
541 * Get Local certificate authentication data...
545 while (isspace(*authorization
& 255))
548 if ((localuser
= cupsdFindCert(authorization
)) != NULL
)
550 strlcpy(username
, localuser
->username
, sizeof(username
));
552 cupsdLogMessage(CUPSD_LOG_DEBUG
,
553 "cupsdAuthorize: Authorized as %s using Local",
558 cupsdLogMessage(CUPSD_LOG_ERROR
,
559 "cupsdAuthorize: Local authentication certificate not "
565 if (localuser
->ccache
)
566 con
->type
= CUPSD_AUTH_NEGOTIATE
;
568 #endif /* HAVE_GSSAPI */
569 con
->type
= CUPSD_AUTH_BASIC
;
571 else if (!strncmp(authorization
, "Basic", 5))
574 * Get the Basic authentication data...
577 int userlen
; /* Username:password length */
581 while (isspace(*authorization
& 255))
584 userlen
= sizeof(username
);
585 httpDecode64_2(username
, &userlen
, authorization
);
588 * Pull the username and password out...
591 if ((ptr
= strchr(username
, ':')) == NULL
)
593 cupsdLogMessage(CUPSD_LOG_ERROR
,
594 "cupsdAuthorize: Missing Basic password!");
603 * Username must not be empty...
606 cupsdLogMessage(CUPSD_LOG_ERROR
,
607 "cupsdAuthorize: Empty Basic username!");
614 * Password must not be empty...
617 cupsdLogMessage(CUPSD_LOG_ERROR
,
618 "cupsdAuthorize: Empty Basic password!");
622 strlcpy(password
, ptr
, sizeof(password
));
625 * Validate the username and password...
631 case CUPSD_AUTH_BASIC
:
635 * Only use PAM to do authentication. This supports MD5
636 * passwords, among other things...
639 pam_handle_t
*pamh
; /* PAM authentication handle */
640 int pamerr
; /* PAM error code */
641 struct pam_conv pamdata
;/* PAM conversation data */
642 cupsd_authdata_t data
; /* Authentication data */
645 strlcpy(data
.username
, username
, sizeof(data
.username
));
646 strlcpy(data
.password
, password
, sizeof(data
.password
));
648 # if defined(__sun) || defined(__hpux)
649 pamdata
.conv
= (int (*)(int, struct pam_message
**,
650 struct pam_response
**,
653 pamdata
.conv
= pam_func
;
654 # endif /* __sun || __hpux */
655 pamdata
.appdata_ptr
= &data
;
659 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
666 pamerr
= pam_start("cups", username
, &pamdata
, &pamh
);
667 if (pamerr
!= PAM_SUCCESS
)
669 cupsdLogMessage(CUPSD_LOG_ERROR
,
670 "cupsdAuthorize: pam_start() returned %d (%s)!",
671 pamerr
, pam_strerror(pamh
, pamerr
));
675 # ifdef HAVE_PAM_SET_ITEM
677 pamerr
= pam_set_item(pamh
, PAM_RHOST
, con
->http
.hostname
);
678 if (pamerr
!= PAM_SUCCESS
)
679 cupsdLogMessage(CUPSD_LOG_WARN
,
680 "cupsdAuthorize: pam_set_item(PAM_RHOST) "
681 "returned %d (%s)!", pamerr
,
682 pam_strerror(pamh
, pamerr
));
683 # endif /* PAM_RHOST */
686 pamerr
= pam_set_item(pamh
, PAM_TTY
, "cups");
687 if (pamerr
!= PAM_SUCCESS
)
688 cupsdLogMessage(CUPSD_LOG_WARN
,
689 "cupsdAuthorize: pam_set_item(PAM_TTY) "
690 "returned %d (%s)!", pamerr
,
691 pam_strerror(pamh
, pamerr
));
692 # endif /* PAM_TTY */
693 # endif /* HAVE_PAM_SET_ITEM */
695 pamerr
= pam_authenticate(pamh
, PAM_SILENT
);
696 if (pamerr
!= PAM_SUCCESS
)
698 cupsdLogMessage(CUPSD_LOG_ERROR
,
699 "cupsdAuthorize: pam_authenticate() returned %d "
701 pamerr
, pam_strerror(pamh
, pamerr
));
706 # ifdef HAVE_PAM_SETCRED
707 pamerr
= pam_setcred(pamh
, PAM_ESTABLISH_CRED
| PAM_SILENT
);
708 if (pamerr
!= PAM_SUCCESS
)
709 cupsdLogMessage(CUPSD_LOG_WARN
,
710 "cupsdAuthorize: pam_setcred() "
711 "returned %d (%s)!", pamerr
,
712 pam_strerror(pamh
, pamerr
));
713 # endif /* HAVE_PAM_SETCRED */
715 pamerr
= pam_acct_mgmt(pamh
, PAM_SILENT
);
716 if (pamerr
!= PAM_SUCCESS
)
718 cupsdLogMessage(CUPSD_LOG_ERROR
,
719 "cupsdAuthorize: pam_acct_mgmt() returned %d "
721 pamerr
, pam_strerror(pamh
, pamerr
));
726 pam_end(pamh
, PAM_SUCCESS
);
728 #elif defined(HAVE_USERSEC_H)
730 * Use AIX authentication interface...
733 char *authmsg
; /* Authentication message */
734 int reenter
; /* ??? */
737 cupsdLogMessage(CUPSD_LOG_DEBUG
,
738 "cupsdAuthorize: AIX authenticate of username "
742 if (authenticate(username
, password
, &reenter
, &authmsg
) != 0)
744 cupsdLogMessage(CUPSD_LOG_DEBUG
,
745 "cupsdAuthorize: Unable to authenticate username "
747 username
, strerror(errno
));
753 * Use normal UNIX password file-based authentication...
756 char *pass
; /* Encrypted password */
757 struct passwd
*pw
; /* User password data */
758 # ifdef HAVE_SHADOW_H
759 struct spwd
*spw
; /* Shadow password data */
760 # endif /* HAVE_SHADOW_H */
763 pw
= getpwnam(username
); /* Get the current password */
764 endpwent(); /* Close the password file */
772 cupsdLogMessage(CUPSD_LOG_ERROR
,
773 "cupsdAuthorize: Unknown username \"%s\"!",
778 # ifdef HAVE_SHADOW_H
779 spw
= getspnam(username
);
782 if (!spw
&& !strcmp(pw
->pw_passwd
, "x"))
785 * Don't allow blank passwords!
788 cupsdLogMessage(CUPSD_LOG_ERROR
,
789 "cupsdAuthorize: Username \"%s\" has no shadow "
790 "password!", username
);
794 if (spw
&& !spw
->sp_pwdp
[0] && !pw
->pw_passwd
[0])
796 if (!pw
->pw_passwd
[0])
797 # endif /* HAVE_SHADOW_H */
800 * Don't allow blank passwords!
803 cupsdLogMessage(CUPSD_LOG_ERROR
,
804 "cupsdAuthorize: Username \"%s\" has no password!",
810 * OK, the password isn't blank, so compare with what came from the
814 pass
= cups_crypt(password
, pw
->pw_passwd
);
816 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
817 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
818 pw
->pw_passwd
, pass
);
820 if (!pass
|| strcmp(pw
->pw_passwd
, pass
))
822 # ifdef HAVE_SHADOW_H
825 pass
= cups_crypt(password
, spw
->sp_pwdp
);
827 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
828 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
831 if (pass
== NULL
|| strcmp(spw
->sp_pwdp
, pass
))
833 cupsdLogMessage(CUPSD_LOG_ERROR
,
834 "cupsdAuthorize: Authentication failed for "
841 # endif /* HAVE_SHADOW_H */
843 cupsdLogMessage(CUPSD_LOG_ERROR
,
844 "cupsdAuthorize: Authentication failed for "
850 #endif /* HAVE_LIBPAM */
853 cupsdLogMessage(CUPSD_LOG_DEBUG
,
854 "cupsdAuthorize: Authorized as %s using Basic",
858 case CUPSD_AUTH_BASICDIGEST
:
860 * Do Basic authentication with the Digest password file...
863 if (!get_md5_password(username
, NULL
, md5
))
865 cupsdLogMessage(CUPSD_LOG_ERROR
,
866 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
871 httpMD5(username
, "CUPS", password
, basicmd5
);
873 if (strcmp(md5
, basicmd5
))
875 cupsdLogMessage(CUPSD_LOG_ERROR
,
876 "cupsdAuthorize: Authentication failed for \"%s\"!",
881 cupsdLogMessage(CUPSD_LOG_DEBUG
,
882 "cupsdAuthorize: Authorized as %s using BasicDigest",
889 else if (!strncmp(authorization
, "Digest", 6))
892 * Get the username, password, and nonce from the Digest attributes...
895 if (!httpGetSubField2(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "username",
896 username
, sizeof(username
)) || !username
[0])
899 * Username must not be empty...
902 cupsdLogMessage(CUPSD_LOG_ERROR
,
903 "cupsdAuthorize: Empty or missing Digest username!");
907 if (!httpGetSubField2(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "response",
908 password
, sizeof(password
)) || !password
[0])
911 * Password must not be empty...
914 cupsdLogMessage(CUPSD_LOG_ERROR
,
915 "cupsdAuthorize: Empty or missing Digest password!");
919 if (!httpGetSubField(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "nonce",
922 cupsdLogMessage(CUPSD_LOG_ERROR
,
923 "cupsdAuthorize: No nonce value for Digest "
928 if (strcmp(con
->http
.hostname
, nonce
))
930 cupsdLogMessage(CUPSD_LOG_ERROR
,
931 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
932 "got \"%s\"!", con
->http
.hostname
, nonce
);
937 * Validate the username and password...
940 if (!get_md5_password(username
, NULL
, md5
))
942 cupsdLogMessage(CUPSD_LOG_ERROR
,
943 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
948 httpMD5Final(nonce
, states
[con
->http
.state
], con
->uri
, md5
);
950 if (strcmp(md5
, password
))
952 cupsdLogMessage(CUPSD_LOG_ERROR
,
953 "cupsdAuthorize: Authentication failed for \"%s\"!",
958 cupsdLogMessage(CUPSD_LOG_DEBUG
,
959 "cupsdAuthorize: Authorized as %s using Digest",
962 con
->type
= CUPSD_AUTH_DIGEST
;
965 else if (!strncmp(authorization
, "Negotiate", 9))
967 int len
; /* Length of authorization string */
968 gss_ctx_id_t context
; /* Authorization context */
969 OM_uint32 major_status
, /* Major status code */
970 minor_status
; /* Minor status code */
971 gss_buffer_desc input_token
= GSS_C_EMPTY_BUFFER
,
972 /* Input token from string */
973 output_token
= GSS_C_EMPTY_BUFFER
;
974 /* Output token for username */
975 gss_name_t client_name
; /* Client name */
980 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
984 if (gss_init_sec_context
== NULL
)
986 cupsdLogMessage(CUPSD_LOG_WARN
,
987 "GSSAPI/Kerberos authentication failed because the "
988 "Kerberos framework is not present.");
991 # endif /* __APPLE__ */
993 con
->gss_output_token
.length
= 0;
996 * Find the start of the Kerberos input token...
1000 while (isspace(*authorization
& 255))
1003 if (!*authorization
)
1005 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1006 "cupsdAuthorize: No authentication data specified.");
1011 * Decode the authorization string to get the input token...
1014 len
= strlen(authorization
);
1015 input_token
.value
= malloc(len
);
1016 input_token
.value
= httpDecode64_2(input_token
.value
, &len
,
1018 input_token
.length
= len
;
1021 * Accept the input token to get the authorization info...
1024 context
= GSS_C_NO_CONTEXT
;
1025 client_name
= GSS_C_NO_NAME
;
1026 major_status
= gss_accept_sec_context(&minor_status
,
1028 GSS_C_NO_CREDENTIAL
,
1030 GSS_C_NO_CHANNEL_BINDINGS
,
1033 &con
->gss_output_token
,
1038 if (GSS_ERROR(major_status
))
1040 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
,
1041 "cupsdAuthorize: Error accepting GSSAPI security "
1044 if (context
!= GSS_C_NO_CONTEXT
)
1045 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
1050 * Get the username associated with the client's credentials...
1053 if (!con
->gss_creds
)
1054 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1055 "cupsdAuthorize: No delegated credentials!");
1057 if (major_status
== GSS_S_CONTINUE_NEEDED
)
1058 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
,
1059 "cupsdAuthorize: Credentials not complete");
1060 else if (major_status
== GSS_S_COMPLETE
)
1062 major_status
= gss_display_name(&minor_status
, client_name
,
1063 &output_token
, NULL
);
1065 if (GSS_ERROR(major_status
))
1067 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
,
1068 "cupsdAuthorize: Error getting username");
1069 gss_release_cred(&minor_status
, &con
->gss_creds
);
1070 gss_release_name(&minor_status
, &client_name
);
1071 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
1075 strlcpy(username
, output_token
.value
, sizeof(username
));
1077 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1078 "cupsdAuthorize: Authorized as %s using Negotiate",
1081 gss_release_name(&minor_status
, &client_name
);
1082 gss_release_buffer(&minor_status
, &output_token
);
1084 con
->type
= CUPSD_AUTH_NEGOTIATE
;
1087 gss_release_cred(&minor_status
, &con
->gss_creds
);
1089 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
1091 #endif /* HAVE_GSSAPI */
1094 char scheme
[256]; /* Auth scheme... */
1097 if (sscanf(authorization
, "%255s", scheme
) != 1)
1098 strcpy(scheme
, "UNKNOWN");
1100 cupsdLogMessage(CUPSD_LOG_ERROR
, "Bad authentication data \"%s ...\"",
1106 * If we get here, then we were able to validate the username and
1107 * password - copy the validated username and password to the client
1108 * data and return...
1111 strlcpy(con
->username
, username
, sizeof(con
->username
));
1112 strlcpy(con
->password
, password
, sizeof(con
->password
));
1117 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1118 * access a location.
1121 int /* O - 1 if allowed, 0 otherwise */
1123 unsigned ip
[4], /* I - Client address */
1124 char *name
, /* I - Client hostname */
1125 int namelen
, /* I - Length of hostname */
1126 cupsd_location_t
*loc
) /* I - Location to check */
1128 int allow
; /* 1 if allowed, 0 otherwise */
1131 if (!strcasecmp(name
, "localhost"))
1134 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1142 * Do authorization checks on the domain/address...
1145 switch (loc
->order_type
)
1148 allow
= 0; /* anti-compiler-warning-code */
1151 case CUPSD_AUTH_ALLOW
: /* Order Deny,Allow */
1154 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->num_deny
, loc
->deny
))
1157 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->num_allow
, loc
->allow
))
1161 case CUPSD_AUTH_DENY
: /* Order Allow,Deny */
1164 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->num_allow
, loc
->allow
))
1167 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->num_deny
, loc
->deny
))
1178 * 'cupsdCheckAuth()' - Check authorization masks.
1181 int /* O - 1 if mask matches, 0 otherwise */
1183 unsigned ip
[4], /* I - Client address */
1184 char *name
, /* I - Client hostname */
1185 int name_len
, /* I - Length of hostname */
1186 int num_masks
, /* I - Number of masks */
1187 cupsd_authmask_t
*masks
) /* I - Masks */
1189 int i
; /* Looping var */
1190 cupsd_netif_t
*iface
; /* Network interface */
1191 unsigned netip4
; /* IPv4 network address */
1193 unsigned netip6
[4]; /* IPv6 network address */
1194 #endif /* AF_INET6 */
1197 while (num_masks
> 0)
1199 switch (masks
->type
)
1201 case CUPSD_AUTH_INTERFACE
:
1203 * Check for a match with a network interface...
1206 netip4
= htonl(ip
[3]);
1209 netip6
[0] = htonl(ip
[0]);
1210 netip6
[1] = htonl(ip
[1]);
1211 netip6
[2] = htonl(ip
[2]);
1212 netip6
[3] = htonl(ip
[3]);
1213 #endif /* AF_INET6 */
1215 if (!strcmp(masks
->mask
.name
.name
, "*"))
1219 * Allow Back-to-My-Mac addresses...
1222 if ((ip
[0] & 0xff000000) == 0xfd000000)
1224 #endif /* __APPLE__ */
1227 * Check against all local interfaces...
1232 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
1234 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
1237 * Only check local interfaces...
1240 if (!iface
->is_local
)
1243 if (iface
->address
.addr
.sa_family
== AF_INET
)
1246 * Check IPv4 address...
1249 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
1250 (iface
->address
.ipv4
.sin_addr
.s_addr
&
1251 iface
->mask
.ipv4
.sin_addr
.s_addr
))
1258 * Check IPv6 address...
1261 for (i
= 0; i
< 4; i
++)
1262 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
1263 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
1264 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
1270 #endif /* AF_INET6 */
1276 * Check the named interface...
1279 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
1281 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
1283 if (strcmp(masks
->mask
.name
.name
, iface
->name
))
1286 if (iface
->address
.addr
.sa_family
== AF_INET
)
1289 * Check IPv4 address...
1292 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
1293 (iface
->address
.ipv4
.sin_addr
.s_addr
&
1294 iface
->mask
.ipv4
.sin_addr
.s_addr
))
1301 * Check IPv6 address...
1304 for (i
= 0; i
< 4; i
++)
1305 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
1306 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
1307 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
1313 #endif /* AF_INET6 */
1318 case CUPSD_AUTH_NAME
:
1320 * Check for exact name match...
1323 if (!strcasecmp(name
, masks
->mask
.name
.name
))
1327 * Check for domain match...
1330 if (name_len
>= masks
->mask
.name
.length
&&
1331 masks
->mask
.name
.name
[0] == '.' &&
1332 !strcasecmp(name
+ name_len
- masks
->mask
.name
.length
,
1333 masks
->mask
.name
.name
))
1337 case CUPSD_AUTH_IP
:
1339 * Check for IP/network address match...
1342 for (i
= 0; i
< 4; i
++)
1343 if ((ip
[i
] & masks
->mask
.ip
.netmask
[i
]) !=
1344 masks
->mask
.ip
.address
[i
])
1361 * 'cupsdCheckGroup()' - Check for a user's group membership.
1364 int /* O - 1 if user is a member, 0 otherwise */
1366 const char *username
, /* I - User name */
1367 struct passwd
*user
, /* I - System user info */
1368 const char *groupname
) /* I - Group name */
1370 int i
; /* Looping var */
1371 struct group
*group
; /* System group info */
1372 char junk
[33]; /* MD5 password (not used) */
1373 #ifdef HAVE_MBR_UID_TO_UUID
1374 uuid_t useruuid
, /* UUID for username */
1375 groupuuid
; /* UUID for groupname */
1376 int is_member
; /* True if user is a member of group */
1377 #endif /* HAVE_MBR_UID_TO_UUID */
1380 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1381 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1382 username
, user
, groupname
);
1388 if (!username
|| !groupname
)
1392 * Check to see if the user is a member of the named group...
1395 group
= getgrnam(groupname
);
1401 * Group exists, check it...
1404 for (i
= 0; group
->gr_mem
[i
]; i
++)
1405 if (!strcasecmp(username
, group
->gr_mem
[i
]))
1410 * Group doesn't exist or user not in group list, check the group ID
1411 * against the user's group ID...
1414 if (user
&& group
&& group
->gr_gid
== user
->pw_gid
)
1417 #ifdef HAVE_MBR_UID_TO_UUID
1419 * Check group membership through MacOS X membership API...
1422 if (user
&& !mbr_uid_to_uuid(user
->pw_uid
, useruuid
))
1427 * Map group name to UUID and check membership...
1430 if (!mbr_gid_to_uuid(group
->gr_gid
, groupuuid
))
1431 if (!mbr_check_membership(useruuid
, groupuuid
, &is_member
))
1435 else if (groupname
[0] == '#')
1438 * Use UUID directly and check for equality (user UUID) and
1439 * membership (group UUID)...
1442 if (!uuid_parse((char *)groupname
+ 1, groupuuid
))
1444 if (!uuid_compare(useruuid
, groupuuid
))
1446 else if (!mbr_check_membership(useruuid
, groupuuid
, &is_member
))
1454 else if (groupname
[0] == '#')
1456 #endif /* HAVE_MBR_UID_TO_UUID */
1459 * Username not found, group not found, or user is not part of the
1460 * system group... Check for a user and group in the MD5 password
1464 if (get_md5_password(username
, groupname
, junk
) != NULL
)
1468 * If we get this far, then the user isn't part of the named group...
1477 * 'cupsdCopyKrb5Creds()' - Get a copy of the Kerberos credentials.
1480 krb5_ccache
/* O - Credentials or NULL */
1481 cupsdCopyKrb5Creds(cupsd_client_t
*con
) /* I - Client connection */
1483 # if !defined(HAVE_KRB5_CC_NEW_UNIQUE) && !defined(HAVE_HEIMDAL)
1484 cupsdLogMessage(CUPSD_LOG_INFO
,
1485 "Sorry, your version of Kerberos does not support delegated "
1490 krb5_ccache ccache
= NULL
; /* Credentials */
1491 krb5_error_code error
; /* Kerberos error code */
1492 OM_uint32 major_status
, /* Major status code */
1493 minor_status
; /* Minor status code */
1494 krb5_principal principal
; /* Kerberos principal */
1499 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
1503 if (krb5_init_context
== NULL
)
1505 # endif /* __APPLE__ */
1507 if (!KerberosInitialized
)
1510 * Setup a Kerberos context for the scheduler to use...
1513 KerberosInitialized
= 1;
1515 if (krb5_init_context(&KerberosContext
))
1517 KerberosContext
= NULL
;
1519 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to initialize Kerberos context");
1525 * We MUST create a file-based cache because memory-based caches are
1526 * only valid for the current process/address space.
1528 * Due to various bugs/features in different versions of Kerberos, we
1529 * need either the krb5_cc_new_unique() function or Heimdal's version
1530 * of krb5_cc_gen_new() to create a new FILE: credential cache that
1531 * can be passed to the backend. These functions create a temporary
1532 * file (typically in /tmp) containing the cached credentials, which
1533 * are removed when we have successfully printed a job.
1536 # ifdef HAVE_KRB5_CC_NEW_UNIQUE
1537 if ((error
= krb5_cc_new_unique(KerberosContext
, "FILE", NULL
, &ccache
)) != 0)
1538 # else /* HAVE_HEIMDAL */
1539 if ((error
= krb5_cc_gen_new(KerberosContext
, &krb5_fcc_ops
, &ccache
)) != 0)
1540 # endif /* HAVE_KRB5_CC_NEW_UNIQUE */
1542 cupsdLogMessage(CUPSD_LOG_ERROR
,
1543 "Unable to create new credentials cache (%d/%s)",
1544 error
, strerror(errno
));
1548 if ((error
= krb5_parse_name(KerberosContext
, con
->username
, &principal
)) != 0)
1550 cupsdLogMessage(CUPSD_LOG_ERROR
,
1551 "Unable to parse kerberos username (%d/%s)", error
,
1553 krb5_cc_destroy(KerberosContext
, ccache
);
1557 if ((error
= krb5_cc_initialize(KerberosContext
, ccache
, principal
)))
1559 cupsdLogMessage(CUPSD_LOG_ERROR
,
1560 "Unable to initialize credentials cache (%d/%s)", error
,
1562 krb5_cc_destroy(KerberosContext
, ccache
);
1563 krb5_free_principal(KerberosContext
, principal
);
1567 krb5_free_principal(KerberosContext
, principal
);
1570 * Copy the user's credentials to the new cache file...
1573 # ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
1574 if (con
->http
.hostaddr
->addr
.sa_family
== AF_LOCAL
&&
1575 !(con
->gss_flags
& GSS_C_DELEG_FLAG
))
1578 * Pull the credentials directly from the user...
1581 cupsd_ucred_t peercred
; /* Peer credentials */
1582 socklen_t peersize
; /* Size of peer credentials */
1583 krb5_ccache peerccache
; /* Peer Kerberos credentials */
1585 peersize
= sizeof(peercred
);
1588 if (getsockopt(con
->http
.fd
, 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
1590 if (getsockopt(con
->http
.fd
, SOL_SOCKET
, SO_PEERCRED
, &peercred
, &peersize
))
1591 # endif /* __APPLE__ */
1593 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s",
1595 krb5_cc_destroy(KerberosContext
, ccache
);
1599 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1600 "cupsdCopyKrb5Creds: Copying credentials for UID %d...",
1601 CUPSD_UCRED_UID(peercred
));
1603 krb5_ipc_client_set_target_uid(CUPSD_UCRED_UID(peercred
));
1605 if ((error
= krb5_cc_default(KerberosContext
, &peerccache
)) != 0)
1607 cupsdLogMessage(CUPSD_LOG_ERROR
,
1608 "Unable to get credentials cache for UID %d (%d/%s)",
1609 (int)CUPSD_UCRED_UID(peercred
), error
, strerror(errno
));
1610 krb5_cc_destroy(KerberosContext
, ccache
);
1614 error
= krb5_cc_copy_creds(KerberosContext
, peerccache
, ccache
);
1615 krb5_cc_close(KerberosContext
, peerccache
);
1616 krb5_ipc_client_clear_target();
1620 cupsdLogMessage(CUPSD_LOG_ERROR
,
1621 "Unable to copy credentials cache for UID %d (%d/%s)",
1622 (int)CUPSD_UCRED_UID(peercred
), error
, strerror(errno
));
1623 krb5_cc_destroy(KerberosContext
, ccache
);
1628 # endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
1630 major_status
= gss_krb5_copy_ccache(&minor_status
, con
->gss_creds
, ccache
);
1632 if (GSS_ERROR(major_status
))
1634 cupsdLogGSSMessage(CUPSD_LOG_ERROR
, major_status
, minor_status
,
1635 "Unable to copy client credentials cache");
1636 krb5_cc_destroy(KerberosContext
, ccache
);
1642 # endif /* !HAVE_KRB5_CC_NEW_UNIQUE && !HAVE_HEIMDAL */
1644 #endif /* HAVE_GSSAPI */
1648 * 'cupsdCopyLocation()' - Make a copy of a location...
1651 cupsd_location_t
* /* O - New location */
1653 cupsd_location_t
**loc
) /* IO - Original location */
1655 int i
; /* Looping var */
1656 cupsd_location_t
*temp
; /* New location */
1657 char location
[HTTP_MAX_URI
];
1658 /* Location of resource */
1662 * Use a local copy of location because cupsdAddLocation may cause
1663 * this memory to be moved...
1666 strlcpy(location
, (*loc
)->location
, sizeof(location
));
1668 if ((temp
= cupsdAddLocation(location
)) == NULL
)
1672 * Copy the information from the original location to the new one.
1675 temp
->limit
= (*loc
)->limit
;
1676 temp
->order_type
= (*loc
)->order_type
;
1677 temp
->type
= (*loc
)->type
;
1678 temp
->level
= (*loc
)->level
;
1679 temp
->satisfy
= (*loc
)->satisfy
;
1680 temp
->encryption
= (*loc
)->encryption
;
1682 if ((temp
->num_names
= (*loc
)->num_names
) > 0)
1685 * Copy the names array...
1688 if ((temp
->names
= calloc(temp
->num_names
, sizeof(char *))) == NULL
)
1690 cupsdLogMessage(CUPSD_LOG_ERROR
,
1691 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1692 temp
->num_names
, strerror(errno
));
1694 cupsdDeleteLocation(temp
);
1698 for (i
= 0; i
< temp
->num_names
; i
++)
1699 if ((temp
->names
[i
] = strdup((*loc
)->names
[i
])) == NULL
)
1701 cupsdLogMessage(CUPSD_LOG_ERROR
,
1702 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1703 (*loc
)->names
[i
], strerror(errno
));
1705 cupsdDeleteLocation(temp
);
1710 if ((temp
->num_allow
= (*loc
)->num_allow
) > 0)
1713 * Copy allow rules...
1716 if ((temp
->allow
= calloc(temp
->num_allow
, sizeof(cupsd_authmask_t
))) == NULL
)
1718 cupsdLogMessage(CUPSD_LOG_ERROR
,
1719 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1720 temp
->num_allow
, strerror(errno
));
1721 cupsdDeleteLocation(temp
);
1725 for (i
= 0; i
< temp
->num_allow
; i
++)
1726 switch (temp
->allow
[i
].type
= (*loc
)->allow
[i
].type
)
1728 case CUPSD_AUTH_NAME
:
1729 temp
->allow
[i
].mask
.name
.length
= (*loc
)->allow
[i
].mask
.name
.length
;
1730 temp
->allow
[i
].mask
.name
.name
= strdup((*loc
)->allow
[i
].mask
.name
.name
);
1732 if (temp
->allow
[i
].mask
.name
.name
== NULL
)
1734 cupsdLogMessage(CUPSD_LOG_ERROR
,
1735 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1736 (*loc
)->allow
[i
].mask
.name
.name
, strerror(errno
));
1737 cupsdDeleteLocation(temp
);
1741 case CUPSD_AUTH_IP
:
1742 memcpy(&(temp
->allow
[i
].mask
.ip
), &((*loc
)->allow
[i
].mask
.ip
),
1743 sizeof(cupsd_ipmask_t
));
1748 if ((temp
->num_deny
= (*loc
)->num_deny
) > 0)
1751 * Copy deny rules...
1754 if ((temp
->deny
= calloc(temp
->num_deny
, sizeof(cupsd_authmask_t
))) == NULL
)
1756 cupsdLogMessage(CUPSD_LOG_ERROR
,
1757 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1758 temp
->num_deny
, strerror(errno
));
1759 cupsdDeleteLocation(temp
);
1763 for (i
= 0; i
< temp
->num_deny
; i
++)
1764 switch (temp
->deny
[i
].type
= (*loc
)->deny
[i
].type
)
1766 case CUPSD_AUTH_NAME
:
1767 temp
->deny
[i
].mask
.name
.length
= (*loc
)->deny
[i
].mask
.name
.length
;
1768 temp
->deny
[i
].mask
.name
.name
= strdup((*loc
)->deny
[i
].mask
.name
.name
);
1770 if (temp
->deny
[i
].mask
.name
.name
== NULL
)
1772 cupsdLogMessage(CUPSD_LOG_ERROR
,
1773 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1774 (*loc
)->deny
[i
].mask
.name
.name
, strerror(errno
));
1775 cupsdDeleteLocation(temp
);
1779 case CUPSD_AUTH_IP
:
1780 memcpy(&(temp
->deny
[i
].mask
.ip
), &((*loc
)->deny
[i
].mask
.ip
),
1781 sizeof(cupsd_ipmask_t
));
1791 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1795 cupsdDeleteAllLocations(void)
1797 cupsd_location_t
*loc
; /* Current location */
1801 * Free all of the allow/deny records first...
1804 for (loc
= (cupsd_location_t
*)cupsArrayFirst(Locations
);
1806 loc
= (cupsd_location_t
*)cupsArrayNext(Locations
))
1807 cupsdDeleteLocation(loc
);
1810 * Then free the location array...
1813 cupsArrayDelete(Locations
);
1819 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1823 cupsdDeleteLocation(
1824 cupsd_location_t
*loc
) /* I - Location to delete */
1826 int i
; /* Looping var */
1827 cupsd_authmask_t
*mask
; /* Current mask */
1830 cupsArrayRemove(Locations
, loc
);
1832 for (i
= loc
->num_names
- 1; i
>= 0; i
--)
1833 free(loc
->names
[i
]);
1835 if (loc
->num_names
> 0)
1838 for (i
= loc
->num_allow
, mask
= loc
->allow
; i
> 0; i
--, mask
++)
1839 if (mask
->type
== CUPSD_AUTH_NAME
|| mask
->type
== CUPSD_AUTH_INTERFACE
)
1840 free(mask
->mask
.name
.name
);
1842 if (loc
->num_allow
> 0)
1845 for (i
= loc
->num_deny
, mask
= loc
->deny
; i
> 0; i
--, mask
++)
1846 if (mask
->type
== CUPSD_AUTH_NAME
|| mask
->type
== CUPSD_AUTH_INTERFACE
)
1847 free(mask
->mask
.name
.name
);
1849 if (loc
->num_deny
> 0)
1852 free(loc
->location
);
1858 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1863 cupsdDenyHost(cupsd_location_t
*loc
, /* I - Location to add to */
1864 char *name
) /* I - Name of host or domain to add */
1866 cupsd_authmask_t
*temp
; /* New host/domain mask */
1867 char ifname
[32], /* Interface name */
1868 *ifptr
; /* Pointer to end of name */
1871 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1872 loc
, loc
->location
? loc
->location
: "nil", name
);
1874 if ((temp
= add_deny(loc
)) == NULL
)
1877 if (!strcasecmp(name
, "@LOCAL"))
1880 * Deny *interface*...
1883 temp
->type
= CUPSD_AUTH_INTERFACE
;
1884 temp
->mask
.name
.name
= strdup("*");
1885 temp
->mask
.name
.length
= 1;
1887 else if (!strncasecmp(name
, "@IF(", 4))
1890 * Deny *interface*...
1893 strlcpy(ifname
, name
+ 4, sizeof(ifname
));
1895 ifptr
= ifname
+ strlen(ifname
);
1897 if (ifptr
[-1] == ')')
1903 temp
->type
= CUPSD_AUTH_INTERFACE
;
1904 temp
->mask
.name
.name
= strdup(ifname
);
1905 temp
->mask
.name
.length
= ifptr
- ifname
;
1913 temp
->type
= CUPSD_AUTH_NAME
;
1914 temp
->mask
.name
.name
= strdup(name
);
1915 temp
->mask
.name
.length
= strlen(name
);
1921 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1922 * access the location.
1926 cupsdDenyIP(cupsd_location_t
*loc
, /* I - Location to add to */
1927 const unsigned address
[4],/* I - IP address to add */
1928 const unsigned netmask
[4])/* I - Netmask of address */
1930 cupsd_authmask_t
*temp
; /* New host/domain mask */
1933 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1934 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1935 loc
, loc
->location
? loc
->location
: "nil",
1936 address
[0], address
[1], address
[2], address
[3],
1937 netmask
[0], netmask
[1], netmask
[2], netmask
[3]);
1939 if ((temp
= add_deny(loc
)) == NULL
)
1942 temp
->type
= CUPSD_AUTH_IP
;
1943 memcpy(temp
->mask
.ip
.address
, address
, sizeof(temp
->mask
.ip
.address
));
1944 memcpy(temp
->mask
.ip
.netmask
, netmask
, sizeof(temp
->mask
.ip
.netmask
));
1949 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1952 cupsd_location_t
* /* O - Location that matches */
1953 cupsdFindBest(const char *path
, /* I - Resource path */
1954 http_state_t state
) /* I - HTTP state/request */
1956 char uri
[HTTP_MAX_URI
],
1957 /* URI in request... */
1958 *uriptr
; /* Pointer into URI */
1959 cupsd_location_t
*loc
, /* Current location */
1960 *best
; /* Best match for location so far */
1961 int bestlen
; /* Length of best match */
1962 int limit
; /* Limit field */
1963 static const int limits
[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1965 CUPSD_AUTH_LIMIT_ALL
,
1966 CUPSD_AUTH_LIMIT_OPTIONS
,
1967 CUPSD_AUTH_LIMIT_GET
,
1968 CUPSD_AUTH_LIMIT_GET
,
1969 CUPSD_AUTH_LIMIT_HEAD
,
1970 CUPSD_AUTH_LIMIT_POST
,
1971 CUPSD_AUTH_LIMIT_POST
,
1972 CUPSD_AUTH_LIMIT_POST
,
1973 CUPSD_AUTH_LIMIT_PUT
,
1974 CUPSD_AUTH_LIMIT_PUT
,
1975 CUPSD_AUTH_LIMIT_DELETE
,
1976 CUPSD_AUTH_LIMIT_TRACE
,
1977 CUPSD_AUTH_LIMIT_ALL
,
1978 CUPSD_AUTH_LIMIT_ALL
1983 * First copy the connection URI to a local string so we have drop
1984 * any .ppd extension from the pathname in /printers or /classes
1988 strlcpy(uri
, path
, sizeof(uri
));
1990 if (!strncmp(uri
, "/printers/", 10) ||
1991 !strncmp(uri
, "/classes/", 9))
1994 * Check if the URI has .ppd on the end...
1997 uriptr
= uri
+ strlen(uri
) - 4; /* len > 4 if we get here... */
1999 if (!strcmp(uriptr
, ".ppd"))
2003 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: uri = \"%s\"...", uri
);
2006 * Loop through the list of locations to find a match...
2009 limit
= limits
[state
];
2013 for (loc
= (cupsd_location_t
*)cupsArrayFirst(Locations
);
2015 loc
= (cupsd_location_t
*)cupsArrayNext(Locations
))
2017 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: Location %s Limit %x",
2018 loc
->location
? loc
->location
: "nil", loc
->limit
);
2020 if (!strncmp(uri
, "/printers/", 10) || !strncmp(uri
, "/classes/", 9))
2023 * Use case-insensitive comparison for queue names...
2026 if (loc
->length
> bestlen
&& loc
->location
&&
2027 !strncasecmp(uri
, loc
->location
, loc
->length
) &&
2028 loc
->location
[0] == '/' &&
2029 (limit
& loc
->limit
) != 0)
2032 bestlen
= loc
->length
;
2038 * Use case-sensitive comparison for other URIs...
2041 if (loc
->length
> bestlen
&& loc
->location
&&
2042 !strncmp(uri
, loc
->location
, loc
->length
) &&
2043 loc
->location
[0] == '/' &&
2044 (limit
& loc
->limit
) != 0)
2047 bestlen
= loc
->length
;
2053 * Return the match, if any...
2056 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: best = %s",
2057 best
? best
->location
: "NONE");
2064 * 'cupsdFindLocation()' - Find the named location.
2067 cupsd_location_t
* /* O - Location that matches */
2068 cupsdFindLocation(const char *location
) /* I - Connection */
2070 cupsd_location_t key
; /* Search key */
2073 key
.location
= (char *)location
;
2075 return ((cupsd_location_t
*)cupsArrayFind(Locations
, &key
));
2080 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
2083 http_status_t
/* O - HTTP_OK if authorized or error code */
2084 cupsdIsAuthorized(cupsd_client_t
*con
, /* I - Connection */
2085 const char *owner
)/* I - Owner of object */
2087 int i
, j
, /* Looping vars */
2088 auth
, /* Authorization status */
2089 type
; /* Type of authentication */
2090 unsigned address
[4]; /* Authorization address */
2091 cupsd_location_t
*best
; /* Best match for location so far */
2092 int hostlen
; /* Length of hostname */
2093 char username
[256], /* Username to authorize */
2094 ownername
[256], /* Owner name to authorize */
2095 *ptr
; /* Pointer into username */
2096 struct passwd
*pw
; /* User password data */
2097 static const char * const levels
[] = /* Auth levels */
2103 static const char * const types
[] = /* Auth types */
2113 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2114 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
2115 con
->uri
, con
->best
, con
->best
? con
->best
->location
?
2116 con
->best
->location
: "(null)" : "");
2118 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2119 "cupsdIsAuthorized: owner=\"%s\"", owner
);
2122 * If there is no "best" authentication rule for this request, then
2123 * access is allowed from the local system and denied from other
2129 if (!strcmp(con
->http
.hostname
, "localhost") ||
2130 !strcmp(con
->http
.hostname
, ServerName
))
2133 return (HTTP_FORBIDDEN
);
2138 if ((type
= best
->type
) == CUPSD_AUTH_DEFAULT
)
2139 type
= DefaultAuthType
;
2141 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2142 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
2143 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
2144 levels
[best
->level
], types
[type
],
2145 best
->satisfy
? "ANY" : "ALL", best
->num_names
);
2147 if (best
->limit
== CUPSD_AUTH_LIMIT_IPP
)
2148 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: op=%x(%s)",
2149 best
->op
, ippOpString(best
->op
));
2152 * Check host/ip-based accesses...
2156 if (con
->http
.hostaddr
->addr
.sa_family
== AF_INET6
)
2159 * Copy IPv6 address...
2162 address
[0] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[0]);
2163 address
[1] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[1]);
2164 address
[2] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[2]);
2165 address
[3] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[3]);
2168 #endif /* AF_INET6 */
2169 if (con
->http
.hostaddr
->addr
.sa_family
== AF_INET
)
2172 * Copy IPv4 address...
2178 address
[3] = ntohl(con
->http
.hostaddr
->ipv4
.sin_addr
.s_addr
);
2181 memset(address
, 0, sizeof(address
));
2183 hostlen
= strlen(con
->http
.hostname
);
2185 auth
= cupsdCheckAccess(address
, con
->http
.hostname
, hostlen
, best
)
2186 ? CUPSD_AUTH_ALLOW
: CUPSD_AUTH_DENY
;
2188 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
2189 auth
? "DENY" : "ALLOW");
2191 if (auth
== CUPSD_AUTH_DENY
&& best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
)
2192 return (HTTP_FORBIDDEN
);
2196 * See if encryption is required...
2199 if ((best
->encryption
>= HTTP_ENCRYPT_REQUIRED
&& !con
->http
.tls
&&
2200 strcasecmp(con
->http
.hostname
, "localhost") &&
2201 best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
) &&
2202 !(type
== CUPSD_AUTH_NEGOTIATE
||
2203 (type
== CUPSD_AUTH_NONE
&& DefaultAuthType
== CUPSD_AUTH_NEGOTIATE
)))
2205 cupsdLogMessage(CUPSD_LOG_DEBUG
,
2206 "cupsdIsAuthorized: Need upgrade to TLS...");
2207 return (HTTP_UPGRADE_REQUIRED
);
2209 #endif /* HAVE_SSL */
2212 * Now see what access level is required...
2215 if (best
->level
== CUPSD_AUTH_ANON
|| /* Anonymous access - allow it */
2216 (type
== CUPSD_AUTH_NONE
&& best
->num_names
== 0))
2219 if (!con
->username
[0] && type
== CUPSD_AUTH_NONE
&&
2220 best
->limit
== CUPSD_AUTH_LIMIT_IPP
)
2223 * Check for unauthenticated username...
2226 ipp_attribute_t
*attr
; /* requesting-user-name attribute */
2229 attr
= ippFindAttribute(con
->request
, "requesting-user-name", IPP_TAG_NAME
);
2232 cupsdLogMessage(CUPSD_LOG_DEBUG
,
2233 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
2234 attr
->values
[0].string
.text
);
2235 strlcpy(username
, attr
->values
[0].string
.text
, sizeof(username
));
2237 else if (best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
|| auth
== CUPSD_AUTH_DENY
)
2238 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
2240 return (HTTP_OK
); /* unless overridden with Satisfy */
2244 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdIsAuthorized: username=\"%s\"",
2247 #ifdef HAVE_AUTHORIZATION_H
2248 if (!con
->username
[0] && !con
->authref
)
2250 if (!con
->username
[0])
2251 #endif /* HAVE_AUTHORIZATION_H */
2253 if (best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
|| auth
== CUPSD_AUTH_DENY
)
2254 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
2256 return (HTTP_OK
); /* unless overridden with Satisfy */
2259 if (con
->type
!= type
&& type
!= CUPSD_AUTH_NONE
&&
2260 (con
->type
!= CUPSD_AUTH_BASIC
|| type
!= CUPSD_AUTH_BASICDIGEST
))
2262 cupsdLogMessage(CUPSD_LOG_ERROR
, "Authorized using %s, expected %s!",
2263 types
[con
->type
], types
[type
]);
2265 return (HTTP_UNAUTHORIZED
);
2268 strlcpy(username
, con
->username
, sizeof(username
));
2272 * OK, got a username. See if we need normal user access, or group
2273 * access... (root always matches)
2276 if (!strcmp(username
, "root"))
2280 * Strip any @domain or @KDC from the username and owner...
2283 if ((ptr
= strchr(username
, '@')) != NULL
)
2288 strlcpy(ownername
, owner
, sizeof(ownername
));
2290 if ((ptr
= strchr(ownername
, '@')) != NULL
)
2294 ownername
[0] = '\0';
2297 * Get the user info...
2302 pw
= getpwnam(username
);
2308 if (best
->level
== CUPSD_AUTH_USER
)
2311 * If there are no names associated with this location, then
2312 * any valid user is OK...
2315 if (best
->num_names
== 0)
2319 * Otherwise check the user list and return OK if this user is
2323 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2324 "cupsdIsAuthorized: Checking user membership...");
2326 #ifdef HAVE_AUTHORIZATION_H
2328 * If an authorization reference was supplied it must match a right name...
2333 for (i
= 0; i
< best
->num_names
; i
++)
2335 if (!strncasecmp(best
->names
[i
], "@AUTHKEY(", 9) &&
2336 check_authref(con
, best
->names
[i
] + 9))
2338 else if (!strcasecmp(best
->names
[i
], "@SYSTEM") &&
2339 SystemGroupAuthKey
&&
2340 check_authref(con
, SystemGroupAuthKey
))
2344 return (HTTP_FORBIDDEN
);
2346 #endif /* HAVE_AUTHORIZATION_H */
2348 for (i
= 0; i
< best
->num_names
; i
++)
2350 if (!strcasecmp(best
->names
[i
], "@OWNER") && owner
&&
2351 !strcasecmp(username
, ownername
))
2353 else if (!strcasecmp(best
->names
[i
], "@SYSTEM"))
2355 for (j
= 0; j
< NumSystemGroups
; j
++)
2356 if (cupsdCheckGroup(username
, pw
, SystemGroups
[j
]))
2359 else if (best
->names
[i
][0] == '@')
2361 if (cupsdCheckGroup(username
, pw
, best
->names
[i
] + 1))
2364 else if (!strcasecmp(username
, best
->names
[i
]))
2368 return (HTTP_FORBIDDEN
);
2372 * Check to see if this user is in any of the named groups...
2375 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2376 "cupsdIsAuthorized: Checking group membership...");
2379 * Check to see if this user is in any of the named groups...
2382 for (i
= 0; i
< best
->num_names
; i
++)
2384 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2385 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2388 if (!strcasecmp(best
->names
[i
], "@SYSTEM"))
2390 for (j
= 0; j
< NumSystemGroups
; j
++)
2391 if (cupsdCheckGroup(username
, pw
, SystemGroups
[j
]))
2394 else if (cupsdCheckGroup(username
, pw
, best
->names
[i
]))
2399 * The user isn't part of the specified group, so deny access...
2402 cupsdLogMessage(CUPSD_LOG_DEBUG
,
2403 "cupsdIsAuthorized: User not in group(s)!");
2405 return (HTTP_FORBIDDEN
);
2410 * 'add_allow()' - Add an allow mask to the location.
2413 static cupsd_authmask_t
* /* O - New mask record */
2414 add_allow(cupsd_location_t
*loc
) /* I - Location to add to */
2416 cupsd_authmask_t
*temp
; /* New mask record */
2427 * Try to allocate memory for the record...
2430 if (loc
->num_allow
== 0)
2431 temp
= malloc(sizeof(cupsd_authmask_t
));
2433 temp
= realloc(loc
->allow
, sizeof(cupsd_authmask_t
) * (loc
->num_allow
+ 1));
2439 temp
+= loc
->num_allow
;
2443 * Clear the mask record and return...
2446 memset(temp
, 0, sizeof(cupsd_authmask_t
));
2452 * 'add_deny()' - Add a deny mask to the location.
2455 static cupsd_authmask_t
* /* O - New mask record */
2456 add_deny(cupsd_location_t
*loc
) /* I - Location to add to */
2458 cupsd_authmask_t
*temp
; /* New mask record */
2469 * Try to allocate memory for the record...
2472 if (loc
->num_deny
== 0)
2473 temp
= malloc(sizeof(cupsd_authmask_t
));
2475 temp
= realloc(loc
->deny
, sizeof(cupsd_authmask_t
) * (loc
->num_deny
+ 1));
2481 temp
+= loc
->num_deny
;
2485 * Clear the mask record and return...
2488 memset(temp
, 0, sizeof(cupsd_authmask_t
));
2493 #ifdef HAVE_AUTHORIZATION_H
2495 * 'check_authref()' - Check if an authorization services reference has the
2499 static int /* O - 1 if right is valid, 0 otherwise */
2500 check_authref(cupsd_client_t
*con
, /* I - Connection */
2501 const char *right
) /* I - Right name */
2503 OSStatus status
; /* OS Status */
2504 AuthorizationItem authright
; /* Authorization right */
2505 AuthorizationRights authrights
; /* Authorization rights */
2506 AuthorizationFlags authflags
; /* Authorization flags */
2510 * Check to see if the user is allowed to perform the task...
2516 authright
.name
= right
;
2517 authright
.valueLength
= 0;
2518 authright
.value
= NULL
;
2519 authright
.flags
= 0;
2521 authrights
.count
= 1;
2522 authrights
.items
= &authright
;
2524 authflags
= kAuthorizationFlagDefaults
|
2525 kAuthorizationFlagExtendRights
;
2527 if ((status
= AuthorizationCopyRights(con
->authref
, &authrights
,
2528 kAuthorizationEmptyEnvironment
,
2529 authflags
, NULL
)) != 0)
2531 cupsdLogMessage(CUPSD_LOG_ERROR
,
2532 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2533 authright
.name
, (int)status
, cssmErrorString(status
));
2537 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2538 "AuthorizationCopyRights(\"%s\") succeeded!",
2543 #endif /* HAVE_AUTHORIZATION_H */
2547 * 'compare_locations()' - Compare two locations.
2550 static int /* O - Result of comparison */
2551 compare_locations(cupsd_location_t
*a
, /* I - First location */
2552 cupsd_location_t
*b
) /* I - Second location */
2554 return (strcmp(b
->location
, a
->location
));
2558 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2560 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2564 static char * /* O - Encrypted password */
2565 cups_crypt(const char *pw
, /* I - Password string */
2566 const char *salt
) /* I - Salt (key) string */
2568 if (!strncmp(salt
, "$1$", 3))
2571 * Use MD5 passwords without the benefit of PAM; this is for
2572 * Slackware Linux, and the algorithm was taken from the
2573 * old shadow-19990827/lib/md5crypt.c source code... :(
2576 int i
; /* Looping var */
2577 unsigned long n
; /* Output number */
2578 int pwlen
; /* Length of password string */
2579 const char *salt_end
; /* End of "salt" data for MD5 */
2580 char *ptr
; /* Pointer into result string */
2581 _cups_md5_state_t state
; /* Primary MD5 state info */
2582 _cups_md5_state_t state2
; /* Secondary MD5 state info */
2583 unsigned char digest
[16]; /* MD5 digest result */
2584 static char result
[120]; /* Final password string */
2588 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2589 * Get a maximum of 8 characters of salt data after $1$...
2592 for (salt_end
= salt
+ 3; *salt_end
&& (salt_end
- salt
) < 11; salt_end
++)
2593 if (*salt_end
== '$')
2597 * Compute the MD5 sum we need...
2602 _cupsMD5Init(&state
);
2603 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2604 _cupsMD5Append(&state
, (unsigned char *)salt
, salt_end
- salt
);
2606 _cupsMD5Init(&state2
);
2607 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
2608 _cupsMD5Append(&state2
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
2609 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
2610 _cupsMD5Finish(&state2
, digest
);
2612 for (i
= pwlen
; i
> 0; i
-= 16)
2613 _cupsMD5Append(&state
, digest
, i
> 16 ? 16 : i
);
2615 for (i
= pwlen
; i
> 0; i
>>= 1)
2616 _cupsMD5Append(&state
, (unsigned char *)((i
& 1) ? "" : pw
), 1);
2618 _cupsMD5Finish(&state
, digest
);
2620 for (i
= 0; i
< 1000; i
++)
2622 _cupsMD5Init(&state
);
2625 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2627 _cupsMD5Append(&state
, digest
, 16);
2630 _cupsMD5Append(&state
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
2633 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2636 _cupsMD5Append(&state
, digest
, 16);
2638 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2640 _cupsMD5Finish(&state
, digest
);
2644 * Copy the final sum to the result string and return...
2647 memcpy(result
, salt
, salt_end
- salt
);
2648 ptr
= result
+ (salt_end
- salt
);
2651 for (i
= 0; i
< 5; i
++, ptr
+= 4)
2653 n
= (((digest
[i
] << 8) | digest
[i
+ 6]) << 8);
2656 n
|= digest
[i
+ 12];
2663 to64(ptr
, digest
[11], 2);
2672 * Use the standard crypt() function...
2675 return (crypt(pw
, salt
));
2678 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2682 * 'get_md5_password()' - Get an MD5 password.
2685 static char * /* O - MD5 password string */
2686 get_md5_password(const char *username
, /* I - Username */
2687 const char *group
, /* I - Group */
2688 char passwd
[33]) /* O - MD5 password string */
2690 cups_file_t
*fp
; /* passwd.md5 file */
2691 char filename
[1024], /* passwd.md5 filename */
2692 line
[256], /* Line from file */
2693 tempuser
[33], /* User from file */
2694 tempgroup
[33]; /* Group from file */
2697 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2698 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2699 username
, group
? group
: "(null)", passwd
);
2701 snprintf(filename
, sizeof(filename
), "%s/passwd.md5", ServerRoot
);
2702 if ((fp
= cupsFileOpen(filename
, "r")) == NULL
)
2704 if (errno
!= ENOENT
)
2705 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to open %s - %s", filename
,
2711 while (cupsFileGets(fp
, line
, sizeof(line
)) != NULL
)
2713 if (sscanf(line
, "%32[^:]:%32[^:]:%32s", tempuser
, tempgroup
, passwd
) != 3)
2715 cupsdLogMessage(CUPSD_LOG_ERROR
, "Bad MD5 password line: %s", line
);
2719 if (!strcmp(username
, tempuser
) &&
2720 (group
== NULL
|| !strcmp(group
, tempgroup
)))
2723 * Found the password entry!
2726 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "Found MD5 user %s, group %s...",
2727 username
, tempgroup
);
2735 * Didn't find a password entry - return NULL!
2745 * 'pam_func()' - PAM conversation function.
2748 static int /* O - Success or failure */
2750 int num_msg
, /* I - Number of messages */
2751 const struct pam_message
**msg
, /* I - Messages */
2752 struct pam_response
**resp
, /* O - Responses */
2754 /* I - Pointer to connection */
2756 int i
; /* Looping var */
2757 struct pam_response
*replies
; /* Replies */
2758 cupsd_authdata_t
*data
; /* Pointer to auth data */
2762 * Allocate memory for the responses...
2765 if ((replies
= malloc(sizeof(struct pam_response
) * num_msg
)) == NULL
)
2766 return (PAM_CONV_ERR
);
2769 * Answer all of the messages...
2772 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr
));
2776 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2777 * module. This is a workaround...
2783 data
= (cupsd_authdata_t
*)appdata_ptr
;
2786 for (i
= 0; i
< num_msg
; i
++)
2788 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg
[i
]->msg
));
2790 switch (msg
[i
]->msg_style
)
2792 case PAM_PROMPT_ECHO_ON
:
2793 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2795 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2796 replies
[i
].resp
= strdup(data
->username
);
2799 case PAM_PROMPT_ECHO_OFF
:
2800 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2802 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2803 replies
[i
].resp
= strdup(data
->password
);
2807 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2808 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2809 replies
[i
].resp
= NULL
;
2813 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2814 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2815 replies
[i
].resp
= NULL
;
2819 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2820 msg
[i
]->msg_style
));
2822 return (PAM_CONV_ERR
);
2827 * Return the responses back to PAM...
2832 return (PAM_SUCCESS
);
2834 #elif !defined(HAVE_USERSEC_H)
2838 * 'to64()' - Base64-encode an integer value...
2842 to64(char *s
, /* O - Output string */
2843 unsigned long v
, /* I - Value to encode */
2844 int n
) /* I - Number of digits */
2846 const char *itoa64
= "./0123456789"
2847 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2848 "abcdefghijklmnopqrstuvwxyz";
2851 for (; n
> 0; n
--, v
>>= 6)
2852 *s
++ = itoa64
[v
& 0x3f];
2854 #endif /* HAVE_LIBPAM */
2858 * End of "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $".