]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge changes from CUPS 1.4svn-r7199.
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $"
3 *
4 * Authorization routines for the Common UNIX Printing System (CUPS).
5 *
6 * Copyright 2007-2008 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddLocation() - Add a location for authorization.
21 * cupsdAddName() - Add a name to a location...
22 * cupsdAllowHost() - Add a host name that is allowed to access the
23 * location.
24 * cupsdAllowIP() - Add an IP address or network that is allowed to
25 * access the location.
26 * cupsdAuthorize() - Validate any authorization credentials.
27 * cupsdCheckAccess() - Check whether the given address is allowed to
28 * access a location.
29 * cupsdCheckAuth() - Check authorization masks.
30 * cupsdCheckGroup() - Check for a user's group membership.
31 * cupsdCopyLocation() - Make a copy of a location...
32 * cupsdDeleteAllLocations() - Free all memory used for location
33 * authorization.
34 * cupsdDeleteLocation() - Free all memory used by a location.
35 * cupsdDenyHost() - Add a host name that is not allowed to access
36 * the location.
37 * cupsdDenyIP() - Add an IP address or network that is not
38 * allowed to access the location.
39 * cupsdFindBest() - Find the location entry that best matches the
40 * resource.
41 * cupsdFindLocation() - Find the named location.
42 * cupsdIsAuthorized() - Check to see if the user is authorized...
43 * add_allow() - Add an allow mask to the location.
44 * add_deny() - Add a deny mask to the location.
45 * check_authref() - Check if an authorization services reference
46 * has the supplied right.
47 * compare_locations() - Compare two locations.
48 * cups_crypt() - Encrypt the password using the DES or MD5
49 * algorithms, as needed.
50 * get_gss_creds() - Obtain GSS credentials.
51 * get_md5_password() - Get an MD5 password.
52 * pam_func() - PAM conversation function.
53 * to64() - Base64-encode an integer value...
54 */
55
56 /*
57 * Include necessary headers...
58 */
59
60 #include "cupsd.h"
61 #include <grp.h>
62 #ifdef HAVE_SHADOW_H
63 # include <shadow.h>
64 #endif /* HAVE_SHADOW_H */
65 #ifdef HAVE_CRYPT_H
66 # include <crypt.h>
67 #endif /* HAVE_CRYPT_H */
68 #if HAVE_LIBPAM
69 # ifdef HAVE_PAM_PAM_APPL_H
70 # include <pam/pam_appl.h>
71 # else
72 # include <security/pam_appl.h>
73 # endif /* HAVE_PAM_PAM_APPL_H */
74 #endif /* HAVE_LIBPAM */
75 #ifdef HAVE_USERSEC_H
76 # include <usersec.h>
77 #endif /* HAVE_USERSEC_H */
78 #ifdef HAVE_MEMBERSHIP_H
79 # include <membership.h>
80 #endif /* HAVE_MEMBERSHIP_H */
81 #ifdef HAVE_AUTHORIZATION_H
82 # include <Security/AuthorizationTags.h>
83 # ifdef HAVE_SECBASEPRIV_H
84 # include <Security/SecBasePriv.h>
85 # else
86 extern const char *cssmErrorString(int error);
87 # endif /* HAVE_SECBASEPRIV_H */
88 #endif /* HAVE_AUTHORIZATION_H */
89 #ifdef HAVE_SYS_PARAM_H
90 # include <sys/param.h>
91 #endif /* HAVE_SYS_PARAM_H */
92 #ifdef HAVE_SYS_UCRED_H
93 # include <sys/ucred.h>
94 typedef struct xucred cupsd_ucred_t;
95 # define CUPSD_UCRED_UID(c) (c).cr_uid
96 #else
97 typedef struct ucred cupsd_ucred_t;
98 # define CUPSD_UCRED_UID(c) (c).uid
99 #endif /* HAVE_SYS_UCRED_H */
100
101
102 /*
103 * Local functions...
104 */
105
106 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
107 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
108 #ifdef HAVE_AUTHORIZATION_H
109 static int check_authref(cupsd_client_t *con, const char *right);
110 #endif /* HAVE_AUTHORIZATION_H */
111 static int compare_locations(cupsd_location_t *a,
112 cupsd_location_t *b);
113 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
114 static char *cups_crypt(const char *pw, const char *salt);
115 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
116 #ifdef HAVE_GSSAPI
117 static gss_cred_id_t get_gss_creds(const char *service_name);
118 #endif /* HAVE_GSSAPI */
119 static char *get_md5_password(const char *username,
120 const char *group, char passwd[33]);
121 #if HAVE_LIBPAM
122 static int pam_func(int, const struct pam_message **,
123 struct pam_response **, void *);
124 #elif !defined(HAVE_USERSEC_H)
125 static void to64(char *s, unsigned long v, int n);
126 #endif /* HAVE_LIBPAM */
127
128
129 /*
130 * Local structures...
131 */
132
133 #if HAVE_LIBPAM
134 typedef struct cupsd_authdata_s /**** Authentication data ****/
135 {
136 char username[33], /* Username string */
137 password[33]; /* Password string */
138 } cupsd_authdata_t;
139 #endif /* HAVE_LIBPAM */
140
141
142 /*
143 * Local globals...
144 */
145
146 #if defined(__hpux) && HAVE_LIBPAM
147 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
148 #endif /* __hpux && HAVE_LIBPAM */
149
150
151 /*
152 * 'cupsdAddLocation()' - Add a location for authorization.
153 */
154
155 cupsd_location_t * /* O - Pointer to new location record */
156 cupsdAddLocation(const char *location) /* I - Location path */
157 {
158 cupsd_location_t *temp; /* New location */
159
160
161 /*
162 * Make sure the locations array is created...
163 */
164
165 if (!Locations)
166 Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
167
168 if (!Locations)
169 return (NULL);
170
171 /*
172 * Try to allocate memory for the new location.
173 */
174
175 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
176 return (NULL);
177
178 /*
179 * Initialize the record and copy the name over...
180 */
181
182 temp->location = strdup(location);
183 temp->length = strlen(temp->location);
184
185 cupsArrayAdd(Locations, temp);
186
187 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
188 location);
189
190 /*
191 * Return the new record...
192 */
193
194 return (temp);
195 }
196
197
198 /*
199 * 'cupsdAddName()' - Add a name to a location...
200 */
201
202 void
203 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
204 char *name) /* I - Name to add */
205 {
206 char **temp; /* Pointer to names array */
207
208
209 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
210 loc, name);
211
212 if (loc->num_names == 0)
213 temp = malloc(sizeof(char *));
214 else
215 temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
216
217 if (temp == NULL)
218 {
219 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
220 loc->location ? loc->location : "nil", strerror(errno));
221 return;
222 }
223
224 loc->names = temp;
225
226 if ((temp[loc->num_names] = strdup(name)) == NULL)
227 {
228 cupsdLogMessage(CUPSD_LOG_ERROR,
229 "Unable to duplicate name for location %s: %s",
230 loc->location ? loc->location : "nil", strerror(errno));
231 return;
232 }
233
234 loc->num_names ++;
235 }
236
237
238 /*
239 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
240 */
241
242 void
243 cupsdAllowHost(cupsd_location_t *loc, /* I - Location to add to */
244 char *name) /* I - Name of host or domain to add */
245 {
246 cupsd_authmask_t *temp; /* New host/domain mask */
247 char ifname[32], /* Interface name */
248 *ifptr; /* Pointer to end of name */
249
250
251 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
252 loc, loc->location ? loc->location : "nil", name);
253
254 if ((temp = add_allow(loc)) == NULL)
255 return;
256
257 if (!strcasecmp(name, "@LOCAL"))
258 {
259 /*
260 * Allow *interface*...
261 */
262
263 temp->type = AUTH_INTERFACE;
264 temp->mask.name.name = strdup("*");
265 temp->mask.name.length = 1;
266 }
267 else if (!strncasecmp(name, "@IF(", 4))
268 {
269 /*
270 * Allow *interface*...
271 */
272
273 strlcpy(ifname, name + 4, sizeof(ifname));
274
275 ifptr = ifname + strlen(ifname);
276
277 if (ifptr[-1] == ')')
278 {
279 ifptr --;
280 *ifptr = '\0';
281 }
282
283 temp->type = AUTH_INTERFACE;
284 temp->mask.name.name = strdup(ifname);
285 temp->mask.name.length = ifptr - ifname;
286 }
287 else
288 {
289 /*
290 * Allow name...
291 */
292
293 temp->type = AUTH_NAME;
294 temp->mask.name.name = strdup(name);
295 temp->mask.name.length = strlen(name);
296 }
297 }
298
299
300 /*
301 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
302 * the location.
303 */
304
305 void
306 cupsdAllowIP(cupsd_location_t *loc, /* I - Location to add to */
307 unsigned address[4], /* I - IP address to add */
308 unsigned netmask[4]) /* I - Netmask of address */
309 {
310 cupsd_authmask_t *temp; /* New host/domain mask */
311
312
313 cupsdLogMessage(CUPSD_LOG_DEBUG2,
314 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
315 loc, loc->location ? loc->location : "nil",
316 address[0], address[1], address[2], address[3],
317 netmask[0], netmask[1], netmask[2], netmask[3]);
318
319 if ((temp = add_allow(loc)) == NULL)
320 return;
321
322 temp->type = AUTH_IP;
323 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
324 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
325 }
326
327
328 /*
329 * 'cupsdAuthorize()' - Validate any authorization credentials.
330 */
331
332 void
333 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
334 {
335 int type; /* Authentication type */
336 const char *authorization; /* Pointer into Authorization string */
337 char *ptr, /* Pointer into string */
338 username[256], /* Username string */
339 password[33]; /* Password string */
340 const char *localuser; /* Certificate username */
341 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
342 md5[33], /* MD5 password */
343 basicmd5[33]; /* MD5 of Basic password */
344 static const char * const states[] = /* HTTP client states... */
345 {
346 "WAITING",
347 "OPTIONS",
348 "GET",
349 "GET",
350 "HEAD",
351 "POST",
352 "POST",
353 "POST",
354 "PUT",
355 "PUT",
356 "DELETE",
357 "TRACE",
358 "CLOSE",
359 "STATUS"
360 };
361
362
363 /*
364 * Locate the best matching location so we know what kind of
365 * authentication to expect...
366 */
367
368 con->best = cupsdFindBest(con->uri, con->http.state);
369 con->type = AUTH_NONE;
370
371 cupsdLogMessage(CUPSD_LOG_DEBUG2,
372 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
373 con->uri, con->best, con->best ? con->best->location : "");
374
375 if (con->best && con->best->type != AUTH_NONE)
376 {
377 if (con->best->type == AUTH_DEFAULT)
378 type = DefaultAuthType;
379 else
380 type = con->best->type;
381 }
382 else
383 type = DefaultAuthType;
384
385 /*
386 * Decode the Authorization string...
387 */
388
389 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
390
391 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
392 authorization);
393
394 username[0] = '\0';
395 password[0] = '\0';
396
397 #ifdef HAVE_AUTHORIZATION_H
398 if (con->authref)
399 {
400 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
401 con->authref = NULL;
402 }
403 #endif /* HAVE_AUTHORIZATION_H */
404
405 if (!*authorization)
406 {
407 /*
408 * No authorization data provided, return early...
409 */
410
411 cupsdLogMessage(CUPSD_LOG_DEBUG,
412 "cupsdAuthorize: No authentication data provided.");
413 return;
414 }
415 #ifdef HAVE_AUTHORIZATION_H
416 else if (!strncmp(authorization, "AuthRef", 6) &&
417 !strcasecmp(con->http.hostname, "localhost"))
418 {
419 OSStatus status; /* Status */
420 int authlen; /* Auth string length */
421 AuthorizationItemSet *authinfo; /* Authorization item set */
422
423 /*
424 * Get the Authorization Services data...
425 */
426
427 authorization += 7;
428 while (isspace(*authorization & 255))
429 authorization ++;
430
431 authlen = sizeof(nonce);
432 httpDecode64_2(nonce, &authlen, authorization);
433
434 if (authlen != kAuthorizationExternalFormLength)
435 {
436 cupsdLogMessage(CUPSD_LOG_ERROR,
437 "External Authorization reference size is incorrect!");
438 return;
439 }
440
441 if ((status = AuthorizationCreateFromExternalForm(
442 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
443 {
444 cupsdLogMessage(CUPSD_LOG_ERROR,
445 "AuthorizationCreateFromExternalForm returned %d (%s)",
446 (int)status, cssmErrorString(status));
447 return;
448 }
449
450 if ((status = AuthorizationCopyInfo(con->authref,
451 kAuthorizationEnvironmentUsername,
452 &authinfo)) != 0)
453 {
454 cupsdLogMessage(CUPSD_LOG_ERROR,
455 "AuthorizationCopyInfo returned %d (%s)",
456 (int)status, cssmErrorString(status));
457 return;
458 }
459
460 if (authinfo->count == 1)
461 strlcpy(username, authinfo->items[0].value, sizeof(username));
462
463 cupsdLogMessage(CUPSD_LOG_DEBUG,
464 "cupsdAuthorize: Authorized as %s using AuthRef",
465 username);
466
467 AuthorizationFreeItemSet(authinfo);
468
469 con->type = AUTH_BASIC;
470 }
471 #endif /* HAVE_AUTHORIZATION_H */
472 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
473 else if (!strncmp(authorization, "PeerCred ", 9) &&
474 con->http.hostaddr->addr.sa_family == AF_LOCAL)
475 {
476 /*
477 * Use peer credentials from domain socket connection...
478 */
479
480 struct passwd *pwd; /* Password entry for this user */
481 cupsd_ucred_t peercred; /* Peer credentials */
482 socklen_t peersize; /* Size of peer credentials */
483
484
485 if ((pwd = getpwnam(authorization + 9)) == NULL)
486 {
487 cupsdLogMessage(CUPSD_LOG_ERROR, "User \"%s\" does not exist!",
488 authorization + 9);
489 return;
490 }
491
492 peersize = sizeof(peercred);
493
494 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
495 {
496 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
497 strerror(errno));
498 return;
499 }
500
501 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
502 {
503 cupsdLogMessage(CUPSD_LOG_ERROR,
504 "Invalid peer credentials for \"%s\" - got %d, "
505 "expected %d!", authorization + 9,
506 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
507 # ifdef HAVE_SYS_UCRED_H
508 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_version=%d",
509 peercred.cr_version);
510 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_uid=%d",
511 peercred.cr_uid);
512 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_ngroups=%d",
513 peercred.cr_ngroups);
514 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_groups[0]=%d",
515 peercred.cr_groups[0]);
516 # endif /* HAVE_SYS_UCRED_H */
517 return;
518 }
519
520 strlcpy(username, authorization + 9, sizeof(username));
521
522 cupsdLogMessage(CUPSD_LOG_DEBUG,
523 "cupsdAuthorize: Authorized as %s using PeerCred",
524 username);
525
526 con->type = AUTH_BASIC;
527 }
528 #endif /* SO_PEERCRED && AF_LOCAL */
529 else if (!strncmp(authorization, "Local", 5) &&
530 !strcasecmp(con->http.hostname, "localhost"))
531 {
532 /*
533 * Get Local certificate authentication data...
534 */
535
536 authorization += 5;
537 while (isspace(*authorization & 255))
538 authorization ++;
539
540 if ((localuser = cupsdFindCert(authorization)) != NULL)
541 {
542 strlcpy(username, localuser, sizeof(username));
543
544 cupsdLogMessage(CUPSD_LOG_DEBUG,
545 "cupsdAuthorize: Authorized as %s using Local",
546 username);
547 }
548 else
549 {
550 cupsdLogMessage(CUPSD_LOG_ERROR,
551 "cupsdAuthorize: Local authentication certificate not "
552 "found!");
553 return;
554 }
555
556 con->type = AUTH_BASIC;
557 }
558 else if (!strncmp(authorization, "Basic", 5))
559 {
560 /*
561 * Get the Basic authentication data...
562 */
563
564 int userlen; /* Username:password length */
565
566
567 authorization += 5;
568 while (isspace(*authorization & 255))
569 authorization ++;
570
571 userlen = sizeof(username);
572 httpDecode64_2(username, &userlen, authorization);
573
574 /*
575 * Pull the username and password out...
576 */
577
578 if ((ptr = strchr(username, ':')) == NULL)
579 {
580 cupsdLogMessage(CUPSD_LOG_ERROR,
581 "cupsdAuthorize: Missing Basic password!");
582 return;
583 }
584
585 *ptr++ = '\0';
586
587 if (!username[0])
588 {
589 /*
590 * Username must not be empty...
591 */
592
593 cupsdLogMessage(CUPSD_LOG_ERROR,
594 "cupsdAuthorize: Empty Basic username!");
595 return;
596 }
597
598 if (!*ptr)
599 {
600 /*
601 * Password must not be empty...
602 */
603
604 cupsdLogMessage(CUPSD_LOG_ERROR,
605 "cupsdAuthorize: Empty Basic password!");
606 return;
607 }
608
609 strlcpy(password, ptr, sizeof(password));
610
611 /*
612 * Validate the username and password...
613 */
614
615 switch (type)
616 {
617 default :
618 case AUTH_BASIC :
619 {
620 #if HAVE_LIBPAM
621 /*
622 * Only use PAM to do authentication. This supports MD5
623 * passwords, among other things...
624 */
625
626 pam_handle_t *pamh; /* PAM authentication handle */
627 int pamerr; /* PAM error code */
628 struct pam_conv pamdata;/* PAM conversation data */
629 cupsd_authdata_t data; /* Authentication data */
630
631
632 strlcpy(data.username, username, sizeof(data.username));
633 strlcpy(data.password, password, sizeof(data.password));
634
635 # if defined(__sun) || defined(__hpux)
636 pamdata.conv = (int (*)(int, struct pam_message **,
637 struct pam_response **,
638 void *))pam_func;
639 # else
640 pamdata.conv = pam_func;
641 # endif /* __sun || __hpux */
642 pamdata.appdata_ptr = &data;
643
644 # ifdef __hpux
645 /*
646 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
647 * more info...
648 */
649
650 auth_data = &data;
651 # endif /* __hpux */
652
653 pamerr = pam_start("cups", username, &pamdata, &pamh);
654 if (pamerr != PAM_SUCCESS)
655 {
656 cupsdLogMessage(CUPSD_LOG_ERROR,
657 "cupsdAuthorize: pam_start() returned %d (%s)!\n",
658 pamerr, pam_strerror(pamh, pamerr));
659 pam_end(pamh, 0);
660 return;
661 }
662
663 # if defined(HAVE_PAM_SET_ITEM) && defined(PAM_RHOST)
664 pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
665 if (pamerr != PAM_SUCCESS)
666 cupsdLogMessage(CUPSD_LOG_WARN,
667 "cupsdAuthorize: pam_set_item() returned %d "
668 "(%s)!\n", pamerr, pam_strerror(pamh, pamerr));
669 # endif /* HAVE_PAM_SET_ITEM && PAM_RHOST */
670
671 pamerr = pam_authenticate(pamh, PAM_SILENT);
672 if (pamerr != PAM_SUCCESS)
673 {
674 cupsdLogMessage(CUPSD_LOG_ERROR,
675 "cupsdAuthorize: pam_authenticate() returned %d "
676 "(%s)!\n",
677 pamerr, pam_strerror(pamh, pamerr));
678 pam_end(pamh, 0);
679 return;
680 }
681
682 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
683 if (pamerr != PAM_SUCCESS)
684 {
685 cupsdLogMessage(CUPSD_LOG_ERROR,
686 "cupsdAuthorize: pam_acct_mgmt() returned %d "
687 "(%s)!\n",
688 pamerr, pam_strerror(pamh, pamerr));
689 pam_end(pamh, 0);
690 return;
691 }
692
693 pam_end(pamh, PAM_SUCCESS);
694
695 #elif defined(HAVE_USERSEC_H)
696 /*
697 * Use AIX authentication interface...
698 */
699
700 char *authmsg; /* Authentication message */
701 int reenter; /* ??? */
702
703
704 cupsdLogMessage(CUPSD_LOG_DEBUG,
705 "cupsdAuthorize: AIX authenticate of username \"%s\"",
706 username);
707
708 reenter = 1;
709 if (authenticate(username, password, &reenter, &authmsg) != 0)
710 {
711 cupsdLogMessage(CUPSD_LOG_DEBUG,
712 "cupsdAuthorize: Unable to authenticate username "
713 "\"%s\": %s",
714 username, strerror(errno));
715 return;
716 }
717
718 #else
719 /*
720 * Use normal UNIX password file-based authentication...
721 */
722
723 char *pass; /* Encrypted password */
724 struct passwd *pw; /* User password data */
725 # ifdef HAVE_SHADOW_H
726 struct spwd *spw; /* Shadow password data */
727 # endif /* HAVE_SHADOW_H */
728
729
730 pw = getpwnam(username); /* Get the current password */
731 endpwent(); /* Close the password file */
732
733 if (!pw)
734 {
735 /*
736 * No such user...
737 */
738
739 cupsdLogMessage(CUPSD_LOG_ERROR,
740 "cupsdAuthorize: Unknown username \"%s\"!",
741 username);
742 return;
743 }
744
745 # ifdef HAVE_SHADOW_H
746 spw = getspnam(username);
747 endspent();
748
749 if (!spw && !strcmp(pw->pw_passwd, "x"))
750 {
751 /*
752 * Don't allow blank passwords!
753 */
754
755 cupsdLogMessage(CUPSD_LOG_ERROR,
756 "cupsdAuthorize: Username \"%s\" has no shadow "
757 "password!", username);
758 return;
759 }
760
761 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
762 # else
763 if (!pw->pw_passwd[0])
764 # endif /* HAVE_SHADOW_H */
765 {
766 /*
767 * Don't allow blank passwords!
768 */
769
770 cupsdLogMessage(CUPSD_LOG_ERROR,
771 "cupsdAuthorize: Username \"%s\" has no password!",
772 username);
773 return;
774 }
775
776 /*
777 * OK, the password isn't blank, so compare with what came from the
778 * client...
779 */
780
781 pass = cups_crypt(password, pw->pw_passwd);
782
783 cupsdLogMessage(CUPSD_LOG_DEBUG2,
784 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
785 pw->pw_passwd, pass);
786
787 if (!pass || strcmp(pw->pw_passwd, pass))
788 {
789 # ifdef HAVE_SHADOW_H
790 if (spw)
791 {
792 pass = cups_crypt(password, spw->sp_pwdp);
793
794 cupsdLogMessage(CUPSD_LOG_DEBUG2,
795 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
796 spw->sp_pwdp, pass);
797
798 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
799 {
800 cupsdLogMessage(CUPSD_LOG_ERROR,
801 "cupsdAuthorize: Authentication failed for "
802 "user \"%s\"!",
803 username);
804 return;
805 }
806 }
807 else
808 # endif /* HAVE_SHADOW_H */
809 {
810 cupsdLogMessage(CUPSD_LOG_ERROR,
811 "cupsdAuthorize: Authentication failed for "
812 "user \"%s\"!",
813 username);
814 return;
815 }
816 }
817 #endif /* HAVE_LIBPAM */
818 }
819
820 cupsdLogMessage(CUPSD_LOG_DEBUG,
821 "cupsdAuthorize: Authorized as %s using Basic",
822 username);
823 break;
824
825 case AUTH_BASICDIGEST :
826 /*
827 * Do Basic authentication with the Digest password file...
828 */
829
830 if (!get_md5_password(username, NULL, md5))
831 {
832 cupsdLogMessage(CUPSD_LOG_ERROR,
833 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
834 username);
835 return;
836 }
837
838 httpMD5(username, "CUPS", password, basicmd5);
839
840 if (strcmp(md5, basicmd5))
841 {
842 cupsdLogMessage(CUPSD_LOG_ERROR,
843 "cupsdAuthorize: Authentication failed for \"%s\"!",
844 username);
845 return;
846 }
847
848 cupsdLogMessage(CUPSD_LOG_DEBUG,
849 "cupsdAuthorize: Authorized as %s using BasicDigest",
850 username);
851 break;
852 }
853
854 con->type = type;
855 }
856 else if (!strncmp(authorization, "Digest", 6))
857 {
858 /*
859 * Get the username, password, and nonce from the Digest attributes...
860 */
861
862 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
863 username, sizeof(username)) || !username[0])
864 {
865 /*
866 * Username must not be empty...
867 */
868
869 cupsdLogMessage(CUPSD_LOG_ERROR,
870 "cupsdAuthorize: Empty or missing Digest username!");
871 return;
872 }
873
874 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
875 password, sizeof(password)) || !password[0])
876 {
877 /*
878 * Password must not be empty...
879 */
880
881 cupsdLogMessage(CUPSD_LOG_ERROR,
882 "cupsdAuthorize: Empty or missing Digest password!");
883 return;
884 }
885
886 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
887 nonce))
888 {
889 cupsdLogMessage(CUPSD_LOG_ERROR,
890 "cupsdAuthorize: No nonce value for Digest "
891 "authentication!");
892 return;
893 }
894
895 if (strcmp(con->http.hostname, nonce))
896 {
897 cupsdLogMessage(CUPSD_LOG_ERROR,
898 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
899 "got \"%s\"!", con->http.hostname, nonce);
900 return;
901 }
902
903 /*
904 * Validate the username and password...
905 */
906
907 if (!get_md5_password(username, NULL, md5))
908 {
909 cupsdLogMessage(CUPSD_LOG_ERROR,
910 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
911 username);
912 return;
913 }
914
915 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
916
917 if (strcmp(md5, password))
918 {
919 cupsdLogMessage(CUPSD_LOG_ERROR,
920 "cupsdAuthorize: Authentication failed for \"%s\"!",
921 username);
922 return;
923 }
924
925 cupsdLogMessage(CUPSD_LOG_DEBUG,
926 "cupsdAuthorize: Authorized as %s using Digest",
927 username);
928
929 con->type = AUTH_DIGEST;
930 }
931 #ifdef HAVE_GSSAPI
932 else if (!strncmp(authorization, "Negotiate", 9))
933 {
934 int len; /* Length of authorization string */
935 gss_cred_id_t server_creds; /* Server credentials */
936 gss_ctx_id_t context; /* Authorization context */
937 OM_uint32 major_status, /* Major status code */
938 minor_status; /* Minor status code */
939 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
940 /* Input token from string */
941 output_token = GSS_C_EMPTY_BUFFER;
942 /* Output token for username */
943 gss_name_t client_name; /* Client name */
944 unsigned int ret_flags; /* Credential flags */
945
946
947 # ifdef __APPLE__
948 /*
949 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
950 * to use it...
951 */
952
953 if (gss_init_sec_context == NULL)
954 {
955 cupsdLogMessage(CUPSD_LOG_WARN,
956 "GSSAPI/Kerberos authentication failed because the "
957 "Kerberos framework is not present.");
958 return;
959 }
960 # endif /* __APPLE__ */
961
962 con->gss_output_token.length = 0;
963
964 /*
965 * Find the start of the Kerberos input token...
966 */
967
968 authorization += 9;
969 while (isspace(*authorization & 255))
970 authorization ++;
971
972 if (!*authorization)
973 {
974 cupsdLogMessage(CUPSD_LOG_DEBUG2,
975 "cupsdAuthorize: No authentication data specified.");
976 return;
977 }
978
979 /*
980 * Get the server credentials...
981 */
982
983 if ((server_creds = get_gss_creds(GSSServiceName)) == NULL)
984 return;
985
986 /*
987 * Decode the authorization string to get the input token...
988 */
989
990 len = strlen(authorization);
991 input_token.value = malloc(len);
992 input_token.value = httpDecode64_2(input_token.value, &len,
993 authorization);
994 input_token.length = len;
995
996 /*
997 * Accept the input token to get the authorization info...
998 */
999
1000 context = GSS_C_NO_CONTEXT;
1001 client_name = GSS_C_NO_NAME;
1002 major_status = gss_accept_sec_context(&minor_status,
1003 &context,
1004 server_creds,
1005 &input_token,
1006 GSS_C_NO_CHANNEL_BINDINGS,
1007 &client_name,
1008 NULL,
1009 &con->gss_output_token,
1010 &ret_flags,
1011 NULL,
1012 &con->gss_delegated_cred);
1013
1014 if (GSS_ERROR(major_status))
1015 {
1016 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1017 "cupsdAuthorize: Error accepting GSSAPI security "
1018 "context");
1019
1020 if (context != GSS_C_NO_CONTEXT)
1021 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1022
1023 gss_release_cred(&minor_status, &server_creds);
1024 return;
1025 }
1026
1027 /*
1028 * Release our credentials...
1029 */
1030
1031 gss_release_cred(&minor_status, &server_creds);
1032
1033 /*
1034 * Get the username associated with the client's credentials...
1035 */
1036
1037 if (!con->gss_delegated_cred)
1038 cupsdLogMessage(CUPSD_LOG_DEBUG,
1039 "cupsdAuthorize: No delegated credentials!");
1040
1041 if (major_status == GSS_S_CONTINUE_NEEDED)
1042 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1043 "cupsdAuthorize: Credentials not complete");
1044 else if (major_status == GSS_S_COMPLETE)
1045 {
1046 major_status = gss_display_name(&minor_status, client_name,
1047 &output_token, NULL);
1048
1049 if (GSS_ERROR(major_status))
1050 {
1051 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1052 "cupsdAuthorize: Error getting username");
1053 gss_release_name(&minor_status, &client_name);
1054 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1055 return;
1056 }
1057
1058 gss_release_name(&minor_status, &client_name);
1059 strlcpy(username, output_token.value, sizeof(username));
1060
1061 cupsdLogMessage(CUPSD_LOG_DEBUG,
1062 "cupsdAuthorize: Authorized as %s using Negotiate",
1063 username);
1064
1065 gss_release_buffer(&minor_status, &output_token);
1066 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1067
1068 con->gss_have_creds = 1;
1069
1070 con->type = AUTH_NEGOTIATE;
1071 }
1072 else
1073 gss_release_name(&minor_status, &client_name);
1074 }
1075 #endif /* HAVE_GSSAPI */
1076 else
1077 {
1078 char scheme[256]; /* Auth scheme... */
1079
1080
1081 if (sscanf(authorization, "%255s", scheme) != 1)
1082 strcpy(scheme, "UNKNOWN");
1083
1084 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\"",
1085 scheme);
1086 return;
1087 }
1088
1089 /*
1090 * If we get here, then we were able to validate the username and
1091 * password - copy the validated username and password to the client
1092 * data and return...
1093 */
1094
1095 strlcpy(con->username, username, sizeof(con->username));
1096 strlcpy(con->password, password, sizeof(con->password));
1097 }
1098
1099
1100 /*
1101 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1102 * access a location.
1103 */
1104
1105 int /* O - 1 if allowed, 0 otherwise */
1106 cupsdCheckAccess(
1107 unsigned ip[4], /* I - Client address */
1108 char *name, /* I - Client hostname */
1109 int namelen, /* I - Length of hostname */
1110 cupsd_location_t *loc) /* I - Location to check */
1111 {
1112 int allow; /* 1 if allowed, 0 otherwise */
1113
1114
1115 if (!strcasecmp(name, "localhost"))
1116 {
1117 /*
1118 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1119 */
1120
1121 return (1);
1122 }
1123 else
1124 {
1125 /*
1126 * Do authorization checks on the domain/address...
1127 */
1128
1129 switch (loc->order_type)
1130 {
1131 default :
1132 allow = 0; /* anti-compiler-warning-code */
1133 break;
1134
1135 case AUTH_ALLOW : /* Order Deny,Allow */
1136 allow = 1;
1137
1138 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1139 allow = 0;
1140
1141 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1142 allow = 1;
1143 break;
1144
1145 case AUTH_DENY : /* Order Allow,Deny */
1146 allow = 0;
1147
1148 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1149 allow = 1;
1150
1151 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1152 allow = 0;
1153 break;
1154 }
1155 }
1156
1157 return (allow);
1158 }
1159
1160
1161 /*
1162 * 'cupsdCheckAuth()' - Check authorization masks.
1163 */
1164
1165 int /* O - 1 if mask matches, 0 otherwise */
1166 cupsdCheckAuth(
1167 unsigned ip[4], /* I - Client address */
1168 char *name, /* I - Client hostname */
1169 int name_len, /* I - Length of hostname */
1170 int num_masks, /* I - Number of masks */
1171 cupsd_authmask_t *masks) /* I - Masks */
1172 {
1173 int i; /* Looping var */
1174 cupsd_netif_t *iface; /* Network interface */
1175 unsigned netip4; /* IPv4 network address */
1176 #ifdef AF_INET6
1177 unsigned netip6[4]; /* IPv6 network address */
1178 #endif /* AF_INET6 */
1179
1180 while (num_masks > 0)
1181 {
1182 switch (masks->type)
1183 {
1184 case AUTH_INTERFACE :
1185 /*
1186 * Check for a match with a network interface...
1187 */
1188
1189 netip4 = htonl(ip[3]);
1190
1191 #ifdef AF_INET6
1192 netip6[0] = htonl(ip[0]);
1193 netip6[1] = htonl(ip[1]);
1194 netip6[2] = htonl(ip[2]);
1195 netip6[3] = htonl(ip[3]);
1196 #endif /* AF_INET6 */
1197
1198 if (!strcmp(masks->mask.name.name, "*"))
1199 {
1200 /*
1201 * Check against all local interfaces...
1202 */
1203
1204 cupsdNetIFUpdate();
1205
1206 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1207 iface;
1208 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1209 {
1210 /*
1211 * Only check local interfaces...
1212 */
1213
1214 if (!iface->is_local)
1215 continue;
1216
1217 if (iface->address.addr.sa_family == AF_INET)
1218 {
1219 /*
1220 * Check IPv4 address...
1221 */
1222
1223 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1224 (iface->address.ipv4.sin_addr.s_addr &
1225 iface->mask.ipv4.sin_addr.s_addr))
1226 return (1);
1227 }
1228 #ifdef AF_INET6
1229 else
1230 {
1231 /*
1232 * Check IPv6 address...
1233 */
1234
1235 for (i = 0; i < 4; i ++)
1236 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1237 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1238 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1239 break;
1240
1241 if (i == 4)
1242 return (1);
1243 }
1244 #endif /* AF_INET6 */
1245 }
1246 }
1247 else
1248 {
1249 /*
1250 * Check the named interface...
1251 */
1252
1253 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1254 iface;
1255 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1256 {
1257 if (strcmp(masks->mask.name.name, iface->name))
1258 continue;
1259
1260 if (iface->address.addr.sa_family == AF_INET)
1261 {
1262 /*
1263 * Check IPv4 address...
1264 */
1265
1266 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1267 (iface->address.ipv4.sin_addr.s_addr &
1268 iface->mask.ipv4.sin_addr.s_addr))
1269 return (1);
1270 }
1271 #ifdef AF_INET6
1272 else
1273 {
1274 /*
1275 * Check IPv6 address...
1276 */
1277
1278 for (i = 0; i < 4; i ++)
1279 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1280 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1281 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1282 break;
1283
1284 if (i == 4)
1285 return (1);
1286 }
1287 #endif /* AF_INET6 */
1288 }
1289 }
1290 break;
1291
1292 case AUTH_NAME :
1293 /*
1294 * Check for exact name match...
1295 */
1296
1297 if (!strcasecmp(name, masks->mask.name.name))
1298 return (1);
1299
1300 /*
1301 * Check for domain match...
1302 */
1303
1304 if (name_len >= masks->mask.name.length &&
1305 masks->mask.name.name[0] == '.' &&
1306 !strcasecmp(name + name_len - masks->mask.name.length,
1307 masks->mask.name.name))
1308 return (1);
1309 break;
1310
1311 case AUTH_IP :
1312 /*
1313 * Check for IP/network address match...
1314 */
1315
1316 for (i = 0; i < 4; i ++)
1317 if ((ip[i] & masks->mask.ip.netmask[i]) !=
1318 masks->mask.ip.address[i])
1319 break;
1320
1321 if (i == 4)
1322 return (1);
1323 break;
1324 }
1325
1326 masks ++;
1327 num_masks --;
1328 }
1329
1330 return (0);
1331 }
1332
1333
1334 /*
1335 * 'cupsdCheckGroup()' - Check for a user's group membership.
1336 */
1337
1338 int /* O - 1 if user is a member, 0 otherwise */
1339 cupsdCheckGroup(
1340 const char *username, /* I - User name */
1341 struct passwd *user, /* I - System user info */
1342 const char *groupname) /* I - Group name */
1343 {
1344 int i; /* Looping var */
1345 struct group *group; /* System group info */
1346 char junk[33]; /* MD5 password (not used) */
1347 #ifdef HAVE_MBR_UID_TO_UUID
1348 uuid_t useruuid, /* UUID for username */
1349 groupuuid; /* UUID for groupname */
1350 int is_member; /* True if user is a member of group */
1351 #endif /* HAVE_MBR_UID_TO_UUID */
1352
1353
1354 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1355 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1356 username, user, groupname);
1357
1358 /*
1359 * Validate input...
1360 */
1361
1362 if (!username || !groupname)
1363 return (0);
1364
1365 /*
1366 * Check to see if the user is a member of the named group...
1367 */
1368
1369 group = getgrnam(groupname);
1370 endgrent();
1371
1372 if (group != NULL)
1373 {
1374 /*
1375 * Group exists, check it...
1376 */
1377
1378 for (i = 0; group->gr_mem[i]; i ++)
1379 if (!strcasecmp(username, group->gr_mem[i]))
1380 return (1);
1381 }
1382
1383 /*
1384 * Group doesn't exist or user not in group list, check the group ID
1385 * against the user's group ID...
1386 */
1387
1388 if (user && group && group->gr_gid == user->pw_gid)
1389 return (1);
1390
1391 #ifdef HAVE_MBR_UID_TO_UUID
1392 /*
1393 * Check group membership through MacOS X membership API...
1394 */
1395
1396 if (user && group)
1397 if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1398 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1399 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1400 if (is_member)
1401 return (1);
1402 #endif /* HAVE_MBR_UID_TO_UUID */
1403
1404 /*
1405 * Username not found, group not found, or user is not part of the
1406 * system group... Check for a user and group in the MD5 password
1407 * file...
1408 */
1409
1410 if (get_md5_password(username, groupname, junk) != NULL)
1411 return (1);
1412
1413 /*
1414 * If we get this far, then the user isn't part of the named group...
1415 */
1416
1417 return (0);
1418 }
1419
1420
1421 /*
1422 * 'cupsdCopyLocation()' - Make a copy of a location...
1423 */
1424
1425 cupsd_location_t * /* O - New location */
1426 cupsdCopyLocation(
1427 cupsd_location_t **loc) /* IO - Original location */
1428 {
1429 int i; /* Looping var */
1430 cupsd_location_t *temp; /* New location */
1431 char location[HTTP_MAX_URI];
1432 /* Location of resource */
1433
1434
1435 /*
1436 * Use a local copy of location because cupsdAddLocation may cause
1437 * this memory to be moved...
1438 */
1439
1440 strlcpy(location, (*loc)->location, sizeof(location));
1441
1442 if ((temp = cupsdAddLocation(location)) == NULL)
1443 return (NULL);
1444
1445 /*
1446 * Copy the information from the original location to the new one.
1447 */
1448
1449 temp->limit = (*loc)->limit;
1450 temp->order_type = (*loc)->order_type;
1451 temp->type = (*loc)->type;
1452 temp->level = (*loc)->level;
1453 temp->satisfy = (*loc)->satisfy;
1454 temp->encryption = (*loc)->encryption;
1455
1456 if ((temp->num_names = (*loc)->num_names) > 0)
1457 {
1458 /*
1459 * Copy the names array...
1460 */
1461
1462 if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1463 {
1464 cupsdLogMessage(CUPSD_LOG_ERROR,
1465 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1466 temp->num_names, strerror(errno));
1467
1468 cupsdDeleteLocation(temp);
1469 return (NULL);
1470 }
1471
1472 for (i = 0; i < temp->num_names; i ++)
1473 if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1474 {
1475 cupsdLogMessage(CUPSD_LOG_ERROR,
1476 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1477 (*loc)->names[i], strerror(errno));
1478
1479 cupsdDeleteLocation(temp);
1480 return (NULL);
1481 }
1482 }
1483
1484 if ((temp->num_allow = (*loc)->num_allow) > 0)
1485 {
1486 /*
1487 * Copy allow rules...
1488 */
1489
1490 if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1491 {
1492 cupsdLogMessage(CUPSD_LOG_ERROR,
1493 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1494 temp->num_allow, strerror(errno));
1495 cupsdDeleteLocation(temp);
1496 return (NULL);
1497 }
1498
1499 for (i = 0; i < temp->num_allow; i ++)
1500 switch (temp->allow[i].type = (*loc)->allow[i].type)
1501 {
1502 case AUTH_NAME :
1503 temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1504 temp->allow[i].mask.name.name = strdup((*loc)->allow[i].mask.name.name);
1505
1506 if (temp->allow[i].mask.name.name == NULL)
1507 {
1508 cupsdLogMessage(CUPSD_LOG_ERROR,
1509 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1510 (*loc)->allow[i].mask.name.name, strerror(errno));
1511 cupsdDeleteLocation(temp);
1512 return (NULL);
1513 }
1514 break;
1515 case AUTH_IP :
1516 memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1517 sizeof(cupsd_ipmask_t));
1518 break;
1519 }
1520 }
1521
1522 if ((temp->num_deny = (*loc)->num_deny) > 0)
1523 {
1524 /*
1525 * Copy deny rules...
1526 */
1527
1528 if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1529 {
1530 cupsdLogMessage(CUPSD_LOG_ERROR,
1531 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1532 temp->num_deny, strerror(errno));
1533 cupsdDeleteLocation(temp);
1534 return (NULL);
1535 }
1536
1537 for (i = 0; i < temp->num_deny; i ++)
1538 switch (temp->deny[i].type = (*loc)->deny[i].type)
1539 {
1540 case AUTH_NAME :
1541 temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1542 temp->deny[i].mask.name.name = strdup((*loc)->deny[i].mask.name.name);
1543
1544 if (temp->deny[i].mask.name.name == NULL)
1545 {
1546 cupsdLogMessage(CUPSD_LOG_ERROR,
1547 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1548 (*loc)->deny[i].mask.name.name, strerror(errno));
1549 cupsdDeleteLocation(temp);
1550 return (NULL);
1551 }
1552 break;
1553 case AUTH_IP :
1554 memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1555 sizeof(cupsd_ipmask_t));
1556 break;
1557 }
1558 }
1559
1560 return (temp);
1561 }
1562
1563
1564 /*
1565 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1566 */
1567
1568 void
1569 cupsdDeleteAllLocations(void)
1570 {
1571 cupsd_location_t *loc; /* Current location */
1572
1573
1574 /*
1575 * Free all of the allow/deny records first...
1576 */
1577
1578 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1579 loc;
1580 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1581 cupsdDeleteLocation(loc);
1582
1583 /*
1584 * Then free the location array...
1585 */
1586
1587 cupsArrayDelete(Locations);
1588 Locations = NULL;
1589 }
1590
1591
1592 /*
1593 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1594 */
1595
1596 void
1597 cupsdDeleteLocation(
1598 cupsd_location_t *loc) /* I - Location to delete */
1599 {
1600 int i; /* Looping var */
1601 cupsd_authmask_t *mask; /* Current mask */
1602
1603
1604 cupsArrayRemove(Locations, loc);
1605
1606 for (i = loc->num_names - 1; i >= 0; i --)
1607 free(loc->names[i]);
1608
1609 if (loc->num_names > 0)
1610 free(loc->names);
1611
1612 for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1613 if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1614 free(mask->mask.name.name);
1615
1616 if (loc->num_allow > 0)
1617 free(loc->allow);
1618
1619 for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1620 if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1621 free(mask->mask.name.name);
1622
1623 if (loc->num_deny > 0)
1624 free(loc->deny);
1625
1626 free(loc->location);
1627 free(loc);
1628 }
1629
1630
1631 /*
1632 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1633 * location.
1634 */
1635
1636 void
1637 cupsdDenyHost(cupsd_location_t *loc, /* I - Location to add to */
1638 char *name) /* I - Name of host or domain to add */
1639 {
1640 cupsd_authmask_t *temp; /* New host/domain mask */
1641 char ifname[32], /* Interface name */
1642 *ifptr; /* Pointer to end of name */
1643
1644
1645 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1646 loc, loc->location ? loc->location : "nil", name);
1647
1648 if ((temp = add_deny(loc)) == NULL)
1649 return;
1650
1651 if (!strcasecmp(name, "@LOCAL"))
1652 {
1653 /*
1654 * Deny *interface*...
1655 */
1656
1657 temp->type = AUTH_INTERFACE;
1658 temp->mask.name.name = strdup("*");
1659 temp->mask.name.length = 1;
1660 }
1661 else if (!strncasecmp(name, "@IF(", 4))
1662 {
1663 /*
1664 * Deny *interface*...
1665 */
1666
1667 strlcpy(ifname, name + 4, sizeof(ifname));
1668
1669 ifptr = ifname + strlen(ifname);
1670
1671 if (ifptr[-1] == ')')
1672 {
1673 ifptr --;
1674 *ifptr = '\0';
1675 }
1676
1677 temp->type = AUTH_INTERFACE;
1678 temp->mask.name.name = strdup(ifname);
1679 temp->mask.name.length = ifptr - ifname;
1680 }
1681 else
1682 {
1683 /*
1684 * Deny name...
1685 */
1686
1687 temp->type = AUTH_NAME;
1688 temp->mask.name.name = strdup(name);
1689 temp->mask.name.length = strlen(name);
1690 }
1691 }
1692
1693
1694 /*
1695 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1696 * access the location.
1697 */
1698
1699 void
1700 cupsdDenyIP(cupsd_location_t *loc, /* I - Location to add to */
1701 unsigned address[4],/* I - IP address to add */
1702 unsigned netmask[4])/* I - Netmask of address */
1703 {
1704 cupsd_authmask_t *temp; /* New host/domain mask */
1705
1706
1707 cupsdLogMessage(CUPSD_LOG_DEBUG,
1708 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1709 loc, loc->location ? loc->location : "nil",
1710 address[0], address[1], address[2], address[3],
1711 netmask[0], netmask[1], netmask[2], netmask[3]);
1712
1713 if ((temp = add_deny(loc)) == NULL)
1714 return;
1715
1716 temp->type = AUTH_IP;
1717 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1718 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1719 }
1720
1721
1722 /*
1723 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1724 */
1725
1726 cupsd_location_t * /* O - Location that matches */
1727 cupsdFindBest(const char *path, /* I - Resource path */
1728 http_state_t state) /* I - HTTP state/request */
1729 {
1730 char uri[HTTP_MAX_URI],
1731 /* URI in request... */
1732 *uriptr; /* Pointer into URI */
1733 cupsd_location_t *loc, /* Current location */
1734 *best; /* Best match for location so far */
1735 int bestlen; /* Length of best match */
1736 int limit; /* Limit field */
1737 static const int limits[] = /* Map http_status_t to AUTH_LIMIT_xyz */
1738 {
1739 AUTH_LIMIT_ALL,
1740 AUTH_LIMIT_OPTIONS,
1741 AUTH_LIMIT_GET,
1742 AUTH_LIMIT_GET,
1743 AUTH_LIMIT_HEAD,
1744 AUTH_LIMIT_POST,
1745 AUTH_LIMIT_POST,
1746 AUTH_LIMIT_POST,
1747 AUTH_LIMIT_PUT,
1748 AUTH_LIMIT_PUT,
1749 AUTH_LIMIT_DELETE,
1750 AUTH_LIMIT_TRACE,
1751 AUTH_LIMIT_ALL,
1752 AUTH_LIMIT_ALL
1753 };
1754
1755
1756 /*
1757 * First copy the connection URI to a local string so we have drop
1758 * any .ppd extension from the pathname in /printers or /classes
1759 * URIs...
1760 */
1761
1762 strlcpy(uri, path, sizeof(uri));
1763
1764 if (!strncmp(uri, "/printers/", 10) ||
1765 !strncmp(uri, "/classes/", 9))
1766 {
1767 /*
1768 * Check if the URI has .ppd on the end...
1769 */
1770
1771 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1772
1773 if (!strcmp(uriptr, ".ppd"))
1774 *uriptr = '\0';
1775 }
1776
1777 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1778
1779 /*
1780 * Loop through the list of locations to find a match...
1781 */
1782
1783 limit = limits[state];
1784 best = NULL;
1785 bestlen = 0;
1786
1787 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1788 loc;
1789 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1790 {
1791 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1792 loc->location ? loc->location : "nil", loc->limit);
1793
1794 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1795 {
1796 /*
1797 * Use case-insensitive comparison for queue names...
1798 */
1799
1800 if (loc->length > bestlen && loc->location &&
1801 !strncasecmp(uri, loc->location, loc->length) &&
1802 loc->location[0] == '/' &&
1803 (limit & loc->limit) != 0)
1804 {
1805 best = loc;
1806 bestlen = loc->length;
1807 }
1808 }
1809 else
1810 {
1811 /*
1812 * Use case-sensitive comparison for other URIs...
1813 */
1814
1815 if (loc->length > bestlen && loc->location &&
1816 !strncmp(uri, loc->location, loc->length) &&
1817 loc->location[0] == '/' &&
1818 (limit & loc->limit) != 0)
1819 {
1820 best = loc;
1821 bestlen = loc->length;
1822 }
1823 }
1824 }
1825
1826 /*
1827 * Return the match, if any...
1828 */
1829
1830 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1831 best ? best->location : "NONE");
1832
1833 return (best);
1834 }
1835
1836
1837 /*
1838 * 'cupsdFindLocation()' - Find the named location.
1839 */
1840
1841 cupsd_location_t * /* O - Location that matches */
1842 cupsdFindLocation(const char *location) /* I - Connection */
1843 {
1844 cupsd_location_t key; /* Search key */
1845
1846
1847 key.location = (char *)location;
1848
1849 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1850 }
1851
1852
1853 /*
1854 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1855 */
1856
1857 http_status_t /* O - HTTP_OK if authorized or error code */
1858 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1859 const char *owner)/* I - Owner of object */
1860 {
1861 int i, j, /* Looping vars */
1862 auth, /* Authorization status */
1863 type; /* Type of authentication */
1864 unsigned address[4]; /* Authorization address */
1865 cupsd_location_t *best; /* Best match for location so far */
1866 int hostlen; /* Length of hostname */
1867 char username[256], /* Username to authorize */
1868 ownername[256], /* Owner name to authorize */
1869 *ptr; /* Pointer into username */
1870 struct passwd *pw; /* User password data */
1871 static const char * const levels[] = /* Auth levels */
1872 {
1873 "ANON",
1874 "USER",
1875 "GROUP"
1876 };
1877 static const char * const types[] = /* Auth types */
1878 {
1879 "None",
1880 "Basic",
1881 "Digest",
1882 "BasicDigest",
1883 "Negotiate"
1884 };
1885
1886
1887 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1888 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1889 con->uri, con->best, con->best ? con->best->location ?
1890 con->best->location : "(null)" : "");
1891 if (owner)
1892 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1893 "cupsdIsAuthorized: owner=\"%s\"", owner);
1894
1895 /*
1896 * If there is no "best" authentication rule for this request, then
1897 * access is allowed from the local system and denied from other
1898 * addresses...
1899 */
1900
1901 if (!con->best)
1902 {
1903 if (!strcmp(con->http.hostname, "localhost") ||
1904 !strcmp(con->http.hostname, ServerName))
1905 return (HTTP_OK);
1906 else
1907 return (HTTP_FORBIDDEN);
1908 }
1909
1910 best = con->best;
1911
1912 if ((type = best->type) == AUTH_DEFAULT)
1913 type = DefaultAuthType;
1914
1915 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1916 "cupsdIsAuthorized: level=AUTH_%s, type=%s, "
1917 "satisfy=AUTH_SATISFY_%s, num_names=%d",
1918 levels[best->level], types[type],
1919 best->satisfy ? "ANY" : "ALL", best->num_names);
1920
1921 if (best->limit == AUTH_LIMIT_IPP)
1922 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1923 best->op, ippOpString(best->op));
1924
1925 /*
1926 * Check host/ip-based accesses...
1927 */
1928
1929 #ifdef AF_INET6
1930 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1931 {
1932 /*
1933 * Copy IPv6 address...
1934 */
1935
1936 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1937 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1938 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1939 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1940 }
1941 else
1942 #endif /* AF_INET6 */
1943 if (con->http.hostaddr->addr.sa_family == AF_INET)
1944 {
1945 /*
1946 * Copy IPv4 address...
1947 */
1948
1949 address[0] = 0;
1950 address[1] = 0;
1951 address[2] = 0;
1952 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1953 }
1954 else
1955 memset(address, 0, sizeof(address));
1956
1957 hostlen = strlen(con->http.hostname);
1958
1959 auth = cupsdCheckAccess(address, con->http.hostname, hostlen, best)
1960 ? AUTH_ALLOW : AUTH_DENY;
1961
1962 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1963 auth ? "DENY" : "ALLOW");
1964
1965 if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1966 return (HTTP_FORBIDDEN);
1967
1968 #ifdef HAVE_SSL
1969 /*
1970 * See if encryption is required...
1971 */
1972
1973 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1974 strcasecmp(con->http.hostname, "localhost") &&
1975 best->satisfy == AUTH_SATISFY_ALL) &&
1976 !(type == AUTH_NEGOTIATE ||
1977 (type == AUTH_NONE && DefaultAuthType == AUTH_NEGOTIATE)))
1978 {
1979 cupsdLogMessage(CUPSD_LOG_DEBUG,
1980 "cupsdIsAuthorized: Need upgrade to TLS...");
1981 return (HTTP_UPGRADE_REQUIRED);
1982 }
1983 #endif /* HAVE_SSL */
1984
1985 /*
1986 * Now see what access level is required...
1987 */
1988
1989 if (best->level == AUTH_ANON || /* Anonymous access - allow it */
1990 (type == AUTH_NONE && best->num_names == 0))
1991 return (HTTP_OK);
1992
1993 if (!con->username[0] && type == AUTH_NONE &&
1994 best->limit == AUTH_LIMIT_IPP)
1995 {
1996 /*
1997 * Check for unauthenticated username...
1998 */
1999
2000 ipp_attribute_t *attr; /* requesting-user-name attribute */
2001
2002
2003 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
2004 if (attr)
2005 {
2006 cupsdLogMessage(CUPSD_LOG_DEBUG,
2007 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
2008 attr->values[0].string.text);
2009 strlcpy(username, attr->values[0].string.text, sizeof(username));
2010 }
2011 else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
2012 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2013 else
2014 return (HTTP_OK); /* unless overridden with Satisfy */
2015 }
2016 else
2017 {
2018 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
2019 con->username);
2020
2021 #ifdef HAVE_AUTHORIZATION_H
2022 if (!con->username[0] && !con->authref)
2023 #else
2024 if (!con->username[0])
2025 #endif /* HAVE_AUTHORIZATION_H */
2026 {
2027 if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
2028 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2029 else
2030 return (HTTP_OK); /* unless overridden with Satisfy */
2031 }
2032
2033 if (con->type != type && type != AUTH_NONE &&
2034 (con->type != AUTH_BASIC || type != AUTH_BASICDIGEST))
2035 {
2036 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
2037 types[con->type], types[type]);
2038
2039 return (HTTP_UNAUTHORIZED);
2040 }
2041
2042 strlcpy(username, con->username, sizeof(username));
2043 }
2044
2045 /*
2046 * OK, got a username. See if we need normal user access, or group
2047 * access... (root always matches)
2048 */
2049
2050 if (!strcmp(username, "root"))
2051 return (HTTP_OK);
2052
2053 /*
2054 * Strip any @domain or @KDC from the username and owner...
2055 */
2056
2057 if ((ptr = strchr(username, '@')) != NULL)
2058 *ptr = '\0';
2059
2060 if (owner)
2061 {
2062 strlcpy(ownername, owner, sizeof(ownername));
2063
2064 if ((ptr = strchr(ownername, '@')) != NULL)
2065 *ptr = '\0';
2066 }
2067 else
2068 ownername[0] = '\0';
2069
2070 /*
2071 * Get the user info...
2072 */
2073
2074 if (username[0])
2075 {
2076 pw = getpwnam(username);
2077 endpwent();
2078 }
2079 else
2080 pw = NULL;
2081
2082 if (best->level == AUTH_USER)
2083 {
2084 /*
2085 * If there are no names associated with this location, then
2086 * any valid user is OK...
2087 */
2088
2089 if (best->num_names == 0)
2090 return (HTTP_OK);
2091
2092 /*
2093 * Otherwise check the user list and return OK if this user is
2094 * allowed...
2095 */
2096
2097 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2098 "cupsdIsAuthorized: Checking user membership...");
2099
2100 #ifdef HAVE_AUTHORIZATION_H
2101 /*
2102 * If an authorization reference was supplied it must match a right name...
2103 */
2104
2105 if (con->authref)
2106 {
2107 for (i = 0; i < best->num_names; i ++)
2108 {
2109 if (!strncasecmp(best->names[i], "@AUTHKEY(", 9) &&
2110 check_authref(con, best->names[i] + 9))
2111 return (HTTP_OK);
2112 else if (!strcasecmp(best->names[i], "@SYSTEM") &&
2113 SystemGroupAuthKey &&
2114 check_authref(con, SystemGroupAuthKey))
2115 return (HTTP_OK);
2116 }
2117
2118 return (HTTP_UNAUTHORIZED);
2119 }
2120 #endif /* HAVE_AUTHORIZATION_H */
2121
2122 for (i = 0; i < best->num_names; i ++)
2123 {
2124 if (!strcasecmp(best->names[i], "@OWNER") && owner &&
2125 !strcasecmp(username, ownername))
2126 return (HTTP_OK);
2127 else if (!strcasecmp(best->names[i], "@SYSTEM"))
2128 {
2129 for (j = 0; j < NumSystemGroups; j ++)
2130 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2131 return (HTTP_OK);
2132 }
2133 else if (best->names[i][0] == '@')
2134 {
2135 if (cupsdCheckGroup(username, pw, best->names[i] + 1))
2136 return (HTTP_OK);
2137 }
2138 else if (!strcasecmp(username, best->names[i]))
2139 return (HTTP_OK);
2140 }
2141
2142 return (HTTP_UNAUTHORIZED);
2143 }
2144
2145 /*
2146 * Check to see if this user is in any of the named groups...
2147 */
2148
2149 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2150 "cupsdIsAuthorized: Checking group membership...");
2151
2152 /*
2153 * Check to see if this user is in any of the named groups...
2154 */
2155
2156 for (i = 0; i < best->num_names; i ++)
2157 {
2158 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2159 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2160 best->names[i]);
2161
2162 if (!strcasecmp(best->names[i], "@SYSTEM"))
2163 {
2164 for (j = 0; j < NumSystemGroups; j ++)
2165 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2166 return (HTTP_OK);
2167 }
2168 else if (cupsdCheckGroup(username, pw, best->names[i]))
2169 return (HTTP_OK);
2170 }
2171
2172 /*
2173 * The user isn't part of the specified group, so deny access...
2174 */
2175
2176 cupsdLogMessage(CUPSD_LOG_DEBUG,
2177 "cupsdIsAuthorized: User not in group(s)!");
2178
2179 return (HTTP_UNAUTHORIZED);
2180 }
2181
2182
2183 /*
2184 * 'add_allow()' - Add an allow mask to the location.
2185 */
2186
2187 static cupsd_authmask_t * /* O - New mask record */
2188 add_allow(cupsd_location_t *loc) /* I - Location to add to */
2189 {
2190 cupsd_authmask_t *temp; /* New mask record */
2191
2192
2193 /*
2194 * Range-check...
2195 */
2196
2197 if (loc == NULL)
2198 return (NULL);
2199
2200 /*
2201 * Try to allocate memory for the record...
2202 */
2203
2204 if (loc->num_allow == 0)
2205 temp = malloc(sizeof(cupsd_authmask_t));
2206 else
2207 temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
2208
2209 if (temp == NULL)
2210 return (NULL);
2211
2212 loc->allow = temp;
2213 temp += loc->num_allow;
2214 loc->num_allow ++;
2215
2216 /*
2217 * Clear the mask record and return...
2218 */
2219
2220 memset(temp, 0, sizeof(cupsd_authmask_t));
2221 return (temp);
2222 }
2223
2224
2225 /*
2226 * 'add_deny()' - Add a deny mask to the location.
2227 */
2228
2229 static cupsd_authmask_t * /* O - New mask record */
2230 add_deny(cupsd_location_t *loc) /* I - Location to add to */
2231 {
2232 cupsd_authmask_t *temp; /* New mask record */
2233
2234
2235 /*
2236 * Range-check...
2237 */
2238
2239 if (loc == NULL)
2240 return (NULL);
2241
2242 /*
2243 * Try to allocate memory for the record...
2244 */
2245
2246 if (loc->num_deny == 0)
2247 temp = malloc(sizeof(cupsd_authmask_t));
2248 else
2249 temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
2250
2251 if (temp == NULL)
2252 return (NULL);
2253
2254 loc->deny = temp;
2255 temp += loc->num_deny;
2256 loc->num_deny ++;
2257
2258 /*
2259 * Clear the mask record and return...
2260 */
2261
2262 memset(temp, 0, sizeof(cupsd_authmask_t));
2263 return (temp);
2264 }
2265
2266
2267 #ifdef HAVE_AUTHORIZATION_H
2268 /*
2269 * 'check_authref()' - Check if an authorization services reference has the
2270 * supplied right.
2271 */
2272
2273 static int /* O - 1 if right is valid, 0 otherwise */
2274 check_authref(cupsd_client_t *con, /* I - Connection */
2275 const char *right) /* I - Right name */
2276 {
2277 OSStatus status; /* OS Status */
2278 AuthorizationItem authright; /* Authorization right */
2279 AuthorizationRights authrights; /* Authorization rights */
2280 AuthorizationFlags authflags; /* Authorization flags */
2281
2282
2283 /*
2284 * Check to see if the user is allowed to perform the task...
2285 */
2286
2287 if (!con->authref)
2288 return (0);
2289
2290 authright.name = right;
2291 authright.valueLength = 0;
2292 authright.value = NULL;
2293 authright.flags = 0;
2294
2295 authrights.count = 1;
2296 authrights.items = &authright;
2297
2298 authflags = kAuthorizationFlagDefaults |
2299 kAuthorizationFlagExtendRights;
2300
2301 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2302 kAuthorizationEmptyEnvironment,
2303 authflags, NULL)) != 0)
2304 {
2305 cupsdLogMessage(CUPSD_LOG_ERROR,
2306 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2307 authright.name, (int)status, cssmErrorString(status));
2308 return (0);
2309 }
2310
2311 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2312 "AuthorizationCopyRights(\"%s\") succeeded!",
2313 authright.name);
2314
2315 return (1);
2316 }
2317 #endif /* HAVE_AUTHORIZATION_H */
2318
2319
2320 /*
2321 * 'compare_locations()' - Compare two locations.
2322 */
2323
2324 static int /* O - Result of comparison */
2325 compare_locations(cupsd_location_t *a, /* I - First location */
2326 cupsd_location_t *b) /* I - Second location */
2327 {
2328 return (strcmp(b->location, a->location));
2329 }
2330
2331
2332 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2333 /*
2334 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2335 * as needed.
2336 */
2337
2338 static char * /* O - Encrypted password */
2339 cups_crypt(const char *pw, /* I - Password string */
2340 const char *salt) /* I - Salt (key) string */
2341 {
2342 if (!strncmp(salt, "$1$", 3))
2343 {
2344 /*
2345 * Use MD5 passwords without the benefit of PAM; this is for
2346 * Slackware Linux, and the algorithm was taken from the
2347 * old shadow-19990827/lib/md5crypt.c source code... :(
2348 */
2349
2350 int i; /* Looping var */
2351 unsigned long n; /* Output number */
2352 int pwlen; /* Length of password string */
2353 const char *salt_end; /* End of "salt" data for MD5 */
2354 char *ptr; /* Pointer into result string */
2355 _cups_md5_state_t state; /* Primary MD5 state info */
2356 _cups_md5_state_t state2; /* Secondary MD5 state info */
2357 unsigned char digest[16]; /* MD5 digest result */
2358 static char result[120]; /* Final password string */
2359
2360
2361 /*
2362 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2363 * Get a maximum of 8 characters of salt data after $1$...
2364 */
2365
2366 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2367 if (*salt_end == '$')
2368 break;
2369
2370 /*
2371 * Compute the MD5 sum we need...
2372 */
2373
2374 pwlen = strlen(pw);
2375
2376 _cupsMD5Init(&state);
2377 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2378 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2379
2380 _cupsMD5Init(&state2);
2381 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2382 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2383 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2384 _cupsMD5Finish(&state2, digest);
2385
2386 for (i = pwlen; i > 0; i -= 16)
2387 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2388
2389 for (i = pwlen; i > 0; i >>= 1)
2390 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2391
2392 _cupsMD5Finish(&state, digest);
2393
2394 for (i = 0; i < 1000; i ++)
2395 {
2396 _cupsMD5Init(&state);
2397
2398 if (i & 1)
2399 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2400 else
2401 _cupsMD5Append(&state, digest, 16);
2402
2403 if (i % 3)
2404 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2405
2406 if (i % 7)
2407 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2408
2409 if (i & 1)
2410 _cupsMD5Append(&state, digest, 16);
2411 else
2412 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2413
2414 _cupsMD5Finish(&state, digest);
2415 }
2416
2417 /*
2418 * Copy the final sum to the result string and return...
2419 */
2420
2421 memcpy(result, salt, salt_end - salt);
2422 ptr = result + (salt_end - salt);
2423 *ptr++ = '$';
2424
2425 for (i = 0; i < 5; i ++, ptr += 4)
2426 {
2427 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2428
2429 if (i < 4)
2430 n |= digest[i + 12];
2431 else
2432 n |= digest[5];
2433
2434 to64(ptr, n, 4);
2435 }
2436
2437 to64(ptr, digest[11], 2);
2438 ptr += 2;
2439 *ptr = '\0';
2440
2441 return (result);
2442 }
2443 else
2444 {
2445 /*
2446 * Use the standard crypt() function...
2447 */
2448
2449 return (crypt(pw, salt));
2450 }
2451 }
2452 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2453
2454
2455 #ifdef HAVE_GSSAPI
2456 /*
2457 * 'get_gss_creds()' - Obtain GSS credentials.
2458 */
2459
2460 static gss_cred_id_t /* O - Server credentials */
2461 get_gss_creds(const char *service_name) /* I - Service name */
2462 {
2463 OM_uint32 major_status, /* Major status code */
2464 minor_status; /* Minor status code */
2465 gss_name_t server_name; /* Server name */
2466 gss_cred_id_t server_creds; /* Server credentials */
2467 gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
2468 /* Service name token */
2469 char buf[1024], /* Service name buffer */
2470 fqdn[HTTP_MAX_URI]; /* Hostname of server */
2471
2472
2473 snprintf(buf, sizeof(buf), "%s@%s", service_name,
2474 httpGetHostname(NULL, fqdn, sizeof(fqdn)));
2475
2476 token.value = buf;
2477 token.length = strlen(buf);
2478 server_name = GSS_C_NO_NAME;
2479 major_status = gss_import_name(&minor_status, &token,
2480 GSS_C_NT_HOSTBASED_SERVICE,
2481 &server_name);
2482
2483 memset(&token, 0, sizeof(token));
2484
2485 if (GSS_ERROR(major_status))
2486 {
2487 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2488 "gss_import_name() failed");
2489 return (NULL);
2490 }
2491
2492 major_status = gss_display_name(&minor_status, server_name, &token, NULL);
2493
2494 if (GSS_ERROR(major_status))
2495 {
2496 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2497 "gss_display_name() failed");
2498 return (NULL);
2499 }
2500
2501 cupsdLogMessage(CUPSD_LOG_DEBUG,
2502 "get_gss_creds: Attempting to acquire credentials for %s...",
2503 (char *)token.value);
2504
2505 server_creds = GSS_C_NO_CREDENTIAL;
2506 major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
2507 GSS_C_NO_OID_SET, GSS_C_ACCEPT,
2508 &server_creds, NULL, NULL);
2509 if (GSS_ERROR(major_status))
2510 {
2511 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2512 "gss_acquire_cred() failed");
2513 gss_release_name(&minor_status, &server_name);
2514 gss_release_buffer(&minor_status, &token);
2515 return (NULL);
2516 }
2517
2518 cupsdLogMessage(CUPSD_LOG_DEBUG,
2519 "get_gss_creds: Credentials acquired successfully for %s.",
2520 (char *)token.value);
2521
2522 gss_release_name(&minor_status, &server_name);
2523 gss_release_buffer(&minor_status, &token);
2524
2525 return (server_creds);
2526 }
2527 #endif /* HAVE_GSSAPI */
2528
2529
2530 /*
2531 * 'get_md5_password()' - Get an MD5 password.
2532 */
2533
2534 static char * /* O - MD5 password string */
2535 get_md5_password(const char *username, /* I - Username */
2536 const char *group, /* I - Group */
2537 char passwd[33]) /* O - MD5 password string */
2538 {
2539 cups_file_t *fp; /* passwd.md5 file */
2540 char filename[1024], /* passwd.md5 filename */
2541 line[256], /* Line from file */
2542 tempuser[33], /* User from file */
2543 tempgroup[33]; /* Group from file */
2544
2545
2546 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2547 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2548 username, group ? group : "(null)", passwd);
2549
2550 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2551 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2552 {
2553 if (errno != ENOENT)
2554 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2555 strerror(errno));
2556
2557 return (NULL);
2558 }
2559
2560 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2561 {
2562 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2563 {
2564 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2565 continue;
2566 }
2567
2568 if (!strcmp(username, tempuser) &&
2569 (group == NULL || !strcmp(group, tempgroup)))
2570 {
2571 /*
2572 * Found the password entry!
2573 */
2574
2575 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2576 username, tempgroup);
2577
2578 cupsFileClose(fp);
2579 return (passwd);
2580 }
2581 }
2582
2583 /*
2584 * Didn't find a password entry - return NULL!
2585 */
2586
2587 cupsFileClose(fp);
2588 return (NULL);
2589 }
2590
2591
2592 #if HAVE_LIBPAM
2593 /*
2594 * 'pam_func()' - PAM conversation function.
2595 */
2596
2597 static int /* O - Success or failure */
2598 pam_func(
2599 int num_msg, /* I - Number of messages */
2600 const struct pam_message **msg, /* I - Messages */
2601 struct pam_response **resp, /* O - Responses */
2602 void *appdata_ptr)
2603 /* I - Pointer to connection */
2604 {
2605 int i; /* Looping var */
2606 struct pam_response *replies; /* Replies */
2607 cupsd_authdata_t *data; /* Pointer to auth data */
2608
2609
2610 /*
2611 * Allocate memory for the responses...
2612 */
2613
2614 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2615 return (PAM_CONV_ERR);
2616
2617 /*
2618 * Answer all of the messages...
2619 */
2620
2621 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2622
2623 #ifdef __hpux
2624 /*
2625 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2626 * module. This is a workaround...
2627 */
2628
2629 data = auth_data;
2630 (void)appdata_ptr;
2631 #else
2632 data = (cupsd_authdata_t *)appdata_ptr;
2633 #endif /* __hpux */
2634
2635 for (i = 0; i < num_msg; i ++)
2636 {
2637 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2638
2639 switch (msg[i]->msg_style)
2640 {
2641 case PAM_PROMPT_ECHO_ON:
2642 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2643 data->username));
2644 replies[i].resp_retcode = PAM_SUCCESS;
2645 replies[i].resp = strdup(data->username);
2646 break;
2647
2648 case PAM_PROMPT_ECHO_OFF:
2649 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2650 data->password));
2651 replies[i].resp_retcode = PAM_SUCCESS;
2652 replies[i].resp = strdup(data->password);
2653 break;
2654
2655 case PAM_TEXT_INFO:
2656 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2657 replies[i].resp_retcode = PAM_SUCCESS;
2658 replies[i].resp = NULL;
2659 break;
2660
2661 case PAM_ERROR_MSG:
2662 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2663 replies[i].resp_retcode = PAM_SUCCESS;
2664 replies[i].resp = NULL;
2665 break;
2666
2667 default:
2668 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2669 msg[i]->msg_style));
2670 free(replies);
2671 return (PAM_CONV_ERR);
2672 }
2673 }
2674
2675 /*
2676 * Return the responses back to PAM...
2677 */
2678
2679 *resp = replies;
2680
2681 return (PAM_SUCCESS);
2682 }
2683 #elif !defined(HAVE_USERSEC_H)
2684
2685
2686 /*
2687 * 'to64()' - Base64-encode an integer value...
2688 */
2689
2690 static void
2691 to64(char *s, /* O - Output string */
2692 unsigned long v, /* I - Value to encode */
2693 int n) /* I - Number of digits */
2694 {
2695 const char *itoa64 = "./0123456789"
2696 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2697 "abcdefghijklmnopqrstuvwxyz";
2698
2699
2700 for (; n > 0; n --, v >>= 6)
2701 *s++ = itoa64[v & 0x3f];
2702 }
2703 #endif /* HAVE_LIBPAM */
2704
2705
2706 /*
2707 * End of "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $".
2708 */
Unnamed repository; edit this file 'description' to name the repository.