]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge changes from CUPS 1.7svn-r10791.
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $"
3 *
4 * Authorization routines for the CUPS scheduler.
5 *
6 * Copyright 2007-2012 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddIPMask() - Add an IP address authorization mask.
21 * cupsdAddLocation() - Add a location for authorization.
22 * cupsdAddName() - Add a name to a location...
23 * cupsdAddNameMask() - Add a host or interface name authorization
24 * mask.
25 * cupsdAuthorize() - Validate any authorization credentials.
26 * cupsdCheckAccess() - Check whether the given address is allowed to
27 * access a location.
28 * cupsdCheckAuth() - Check authorization masks.
29 * cupsdCheckGroup() - Check for a user's group membership.
30 * cupsdCopyLocation() - Make a copy of a location...
31 * cupsdDeleteAllLocations() - Free all memory used for location
32 * authorization.
33 * cupsdFindBest() - Find the location entry that best matches the
34 * resource.
35 * cupsdFindLocation() - Find the named location.
36 * cupsdFreeLocation() - Free all memory used by a location.
37 * cupsdIsAuthorized() - Check to see if the user is authorized...
38 * cupsdNewLocation() - Create a new location for authorization.
39 * check_authref() - Check if an authorization services reference
40 * has the supplied right.
41 * compare_locations() - Compare two locations.
42 * copy_authmask() - Copy function for auth masks.
43 * cups_crypt() - Encrypt the password using the DES or MD5
44 * algorithms, as needed.
45 * free_authmask() - Free function for auth masks.
46 * get_md5_password() - Get an MD5 password.
47 * pam_func() - PAM conversation function.
48 * to64() - Base64-encode an integer value...
49 */
50
51 /*
52 * Include necessary headers...
53 */
54
55 #include "cupsd.h"
56 #include <grp.h>
57 #ifdef HAVE_SHADOW_H
58 # include <shadow.h>
59 #endif /* HAVE_SHADOW_H */
60 #ifdef HAVE_CRYPT_H
61 # include <crypt.h>
62 #endif /* HAVE_CRYPT_H */
63 #if HAVE_LIBPAM
64 # ifdef HAVE_PAM_PAM_APPL_H
65 # include <pam/pam_appl.h>
66 # else
67 # include <security/pam_appl.h>
68 # endif /* HAVE_PAM_PAM_APPL_H */
69 #endif /* HAVE_LIBPAM */
70 #ifdef HAVE_USERSEC_H
71 # include <usersec.h>
72 #endif /* HAVE_USERSEC_H */
73 #ifdef HAVE_MEMBERSHIP_H
74 # include <membership.h>
75 #endif /* HAVE_MEMBERSHIP_H */
76 #ifdef HAVE_AUTHORIZATION_H
77 # include <Security/AuthorizationTags.h>
78 # ifdef HAVE_SECBASEPRIV_H
79 # include <Security/SecBasePriv.h>
80 # else
81 extern const char *cssmErrorString(int error);
82 # endif /* HAVE_SECBASEPRIV_H */
83 #endif /* HAVE_AUTHORIZATION_H */
84 #ifdef HAVE_SYS_PARAM_H
85 # include <sys/param.h>
86 #endif /* HAVE_SYS_PARAM_H */
87 #ifdef HAVE_SYS_UCRED_H
88 # include <sys/ucred.h>
89 typedef struct xucred cupsd_ucred_t;
90 # define CUPSD_UCRED_UID(c) (c).cr_uid
91 #else
92 # ifndef __OpenBSD__
93 typedef struct ucred cupsd_ucred_t;
94 # else
95 typedef struct sockpeercred cupsd_ucred_t;
96 # endif
97 # define CUPSD_UCRED_UID(c) (c).uid
98 #endif /* HAVE_SYS_UCRED_H */
99
100
101 /*
102 * Local functions...
103 */
104
105 #ifdef HAVE_AUTHORIZATION_H
106 static int check_authref(cupsd_client_t *con, const char *right);
107 #endif /* HAVE_AUTHORIZATION_H */
108 static int compare_locations(cupsd_location_t *a,
109 cupsd_location_t *b);
110 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
111 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
112 static char *cups_crypt(const char *pw, const char *salt);
113 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
114 static void free_authmask(cupsd_authmask_t *am, void *data);
115 static char *get_md5_password(const char *username,
116 const char *group, char passwd[33]);
117 #if HAVE_LIBPAM
118 static int pam_func(int, const struct pam_message **,
119 struct pam_response **, void *);
120 #elif !defined(HAVE_USERSEC_H)
121 static void to64(char *s, unsigned long v, int n);
122 #endif /* HAVE_LIBPAM */
123
124
125 /*
126 * Local structures...
127 */
128
129 #if HAVE_LIBPAM
130 typedef struct cupsd_authdata_s /**** Authentication data ****/
131 {
132 char username[HTTP_MAX_VALUE], /* Username string */
133 password[HTTP_MAX_VALUE]; /* Password string */
134 } cupsd_authdata_t;
135 #endif /* HAVE_LIBPAM */
136
137
138 /*
139 * Local globals...
140 */
141
142 #if defined(__hpux) && HAVE_LIBPAM
143 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
144 #endif /* __hpux && HAVE_LIBPAM */
145
146
147 /*
148 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
149 */
150
151 int /* O - 1 on success, 0 on failure */
152 cupsdAddIPMask(
153 cups_array_t **masks, /* IO - Masks array (created as needed) */
154 const unsigned address[4], /* I - IP address */
155 const unsigned netmask[4]) /* I - IP netmask */
156 {
157 cupsd_authmask_t temp; /* New host/domain mask */
158
159
160 cupsdLogMessage(CUPSD_LOG_DEBUG2,
161 "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, "
162 "netmask=%x:%x:%x:%x)",
163 masks, *masks,
164 address[0], address[1], address[2], address[3],
165 netmask[0], netmask[1], netmask[2], netmask[3]);
166
167 temp.type = CUPSD_AUTH_IP;
168 memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
169 memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
170
171 /*
172 * Create the masks array as needed and add...
173 */
174
175 if (!*masks)
176 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
177 (cups_acopy_func_t)copy_authmask,
178 (cups_afree_func_t)free_authmask);
179
180 return (cupsArrayAdd(*masks, &temp));
181 }
182
183
184 /*
185 * 'cupsdAddLocation()' - Add a location for authorization.
186 */
187
188 void
189 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
190 {
191 /*
192 * Make sure the locations array is created...
193 */
194
195 if (!Locations)
196 Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
197 (cups_ahash_func_t)NULL, 0,
198 (cups_acopy_func_t)NULL,
199 (cups_afree_func_t)cupsdFreeLocation);
200
201 if (Locations)
202 {
203 cupsArrayAdd(Locations, loc);
204
205 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"",
206 loc->location ? loc->location : "(null)");
207 }
208 }
209
210
211 /*
212 * 'cupsdAddName()' - Add a name to a location...
213 */
214
215 void
216 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
217 char *name) /* I - Name to add */
218 {
219 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
220 loc, name);
221
222 if (!loc->names)
223 loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
224 (cups_acopy_func_t)_cupsStrAlloc,
225 (cups_afree_func_t)_cupsStrFree);
226
227 if (!cupsArrayAdd(loc->names, name))
228 {
229 cupsdLogMessage(CUPSD_LOG_ERROR,
230 "Unable to duplicate name for location %s: %s",
231 loc->location ? loc->location : "nil", strerror(errno));
232 return;
233 }
234 }
235
236
237 /*
238 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
239 */
240
241 int /* O - 1 on success, 0 on failure */
242 cupsdAddNameMask(cups_array_t **masks, /* IO - Masks array (created as needed) */
243 char *name) /* I - Host or interface name */
244 {
245 cupsd_authmask_t temp; /* New host/domain mask */
246 char ifname[32], /* Interface name */
247 *ifptr; /* Pointer to end of name */
248
249
250 cupsdLogMessage(CUPSD_LOG_DEBUG2,
251 "cupsdAddNameMask(masks=%p(%p), name=\"%s\")",
252 masks, *masks, name);
253
254 if (!_cups_strcasecmp(name, "@LOCAL"))
255 {
256 /*
257 * Deny *interface*...
258 */
259
260 temp.type = CUPSD_AUTH_INTERFACE;
261 temp.mask.name.name = (char *)"*";
262 }
263 else if (!_cups_strncasecmp(name, "@IF(", 4))
264 {
265 /*
266 * Deny *interface*...
267 */
268
269 strlcpy(ifname, name + 4, sizeof(ifname));
270
271 ifptr = ifname + strlen(ifname) - 1;
272
273 if (ifptr >= ifname && *ifptr == ')')
274 {
275 ifptr --;
276 *ifptr = '\0';
277 }
278
279 temp.type = CUPSD_AUTH_INTERFACE;
280 temp.mask.name.name = ifname;
281 }
282 else
283 {
284 /*
285 * Deny name...
286 */
287
288 if (*name == '*')
289 name ++;
290
291 temp.type = CUPSD_AUTH_NAME;
292 temp.mask.name.name = (char *)name;
293 }
294
295 /*
296 * Set the name length...
297 */
298
299 temp.mask.name.length = strlen(temp.mask.name.name);
300
301 /*
302 * Create the masks array as needed and add...
303 */
304
305 if (!*masks)
306 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
307 (cups_acopy_func_t)copy_authmask,
308 (cups_afree_func_t)free_authmask);
309
310 return (cupsArrayAdd(*masks, &temp));
311 }
312
313
314 /*
315 * 'cupsdAuthorize()' - Validate any authorization credentials.
316 */
317
318 void
319 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
320 {
321 int type; /* Authentication type */
322 const char *authorization; /* Pointer into Authorization string */
323 char *ptr, /* Pointer into string */
324 username[HTTP_MAX_VALUE],
325 /* Username string */
326 password[HTTP_MAX_VALUE];
327 /* Password string */
328 cupsd_cert_t *localuser; /* Certificate username */
329 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
330 md5[33], /* MD5 password */
331 basicmd5[33]; /* MD5 of Basic password */
332 static const char * const states[] = /* HTTP client states... */
333 {
334 "WAITING",
335 "OPTIONS",
336 "GET",
337 "GET",
338 "HEAD",
339 "POST",
340 "POST",
341 "POST",
342 "PUT",
343 "PUT",
344 "DELETE",
345 "TRACE",
346 "CLOSE",
347 "STATUS"
348 };
349
350
351 /*
352 * Locate the best matching location so we know what kind of
353 * authentication to expect...
354 */
355
356 con->best = cupsdFindBest(con->uri, con->http.state);
357 con->type = CUPSD_AUTH_NONE;
358
359 cupsdLogMessage(CUPSD_LOG_DEBUG2,
360 "[Client %d] con->uri=\"%s\", con->best=%p(%s)",
361 con->http.fd, con->uri, con->best,
362 con->best ? con->best->location : "");
363
364 if (con->best && con->best->type != CUPSD_AUTH_NONE)
365 {
366 if (con->best->type == CUPSD_AUTH_DEFAULT)
367 type = cupsdDefaultAuthType();
368 else
369 type = con->best->type;
370 }
371 else
372 type = cupsdDefaultAuthType();
373
374 /*
375 * Decode the Authorization string...
376 */
377
378 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
379
380 cupsdLogMessage(CUPSD_LOG_DEBUG2, "[Client %d] Authorization=\"%s\"",
381 con->http.fd, authorization);
382
383 username[0] = '\0';
384 password[0] = '\0';
385
386 #ifdef HAVE_GSSAPI
387 con->gss_uid = 0;
388 #endif /* HAVE_GSSAPI */
389
390 #ifdef HAVE_AUTHORIZATION_H
391 if (con->authref)
392 {
393 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
394 con->authref = NULL;
395 }
396 #endif /* HAVE_AUTHORIZATION_H */
397
398 if (!*authorization)
399 {
400 /*
401 * No authorization data provided, return early...
402 */
403
404 cupsdLogMessage(CUPSD_LOG_DEBUG,
405 "[Client %d] No authentication data provided.",
406 con->http.fd);
407 return;
408 }
409 #ifdef HAVE_AUTHORIZATION_H
410 else if (!strncmp(authorization, "AuthRef ", 8) &&
411 !_cups_strcasecmp(con->http.hostname, "localhost"))
412 {
413 OSStatus status; /* Status */
414 int authlen; /* Auth string length */
415 AuthorizationItemSet *authinfo; /* Authorization item set */
416
417 /*
418 * Get the Authorization Services data...
419 */
420
421 authorization += 8;
422 while (isspace(*authorization & 255))
423 authorization ++;
424
425 authlen = sizeof(nonce);
426 httpDecode64_2(nonce, &authlen, authorization);
427
428 if (authlen != kAuthorizationExternalFormLength)
429 {
430 cupsdLogMessage(CUPSD_LOG_ERROR,
431 "[Client %d] External Authorization reference size is "
432 "incorrect.", con->http.fd);
433 return;
434 }
435
436 if ((status = AuthorizationCreateFromExternalForm(
437 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
438 {
439 cupsdLogMessage(CUPSD_LOG_ERROR,
440 "[Client %d] AuthorizationCreateFromExternalForm "
441 "returned %d (%s)", con->http.fd, (int)status,
442 cssmErrorString(status));
443 return;
444 }
445
446 username[0] = '\0';
447
448 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
449 &authinfo))
450 {
451 if (authinfo->count == 1 && authinfo->items[0].value &&
452 authinfo->items[0].valueLength >= 2)
453 {
454 strlcpy(username, authinfo->items[0].value, sizeof(username));
455
456 cupsdLogMessage(CUPSD_LOG_DEBUG,
457 "[Client %d] Authorized as \"%s\" using AuthRef",
458 con->http.fd, username);
459 }
460
461 AuthorizationFreeItemSet(authinfo);
462 }
463
464 if (!username[0])
465 {
466 /*
467 * No username in AuthRef, grab username using peer credentials...
468 */
469
470 struct passwd *pwd; /* Password entry for this user */
471 cupsd_ucred_t peercred; /* Peer credentials */
472 socklen_t peersize; /* Size of peer credentials */
473
474 peersize = sizeof(peercred);
475
476 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
477 {
478 cupsdLogMessage(CUPSD_LOG_ERROR,
479 "[Client %d] Unable to get peer credentials - %s",
480 con->http.fd, strerror(errno));
481 return;
482 }
483
484 if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
485 {
486 cupsdLogMessage(CUPSD_LOG_ERROR,
487 "[Client %d] Unable to find UID %d for peer "
488 "credentials.", con->http.fd,
489 (int)CUPSD_UCRED_UID(peercred));
490 return;
491 }
492
493 strlcpy(username, pwd->pw_name, sizeof(username));
494
495 cupsdLogMessage(CUPSD_LOG_DEBUG,
496 "[Client %d] Authorized as \"%s\" using "
497 "AuthRef + PeerCred", con->http.fd, username);
498 }
499
500 con->type = CUPSD_AUTH_BASIC;
501 }
502 #endif /* HAVE_AUTHORIZATION_H */
503 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
504 else if (!strncmp(authorization, "PeerCred ", 9) &&
505 con->http.hostaddr->addr.sa_family == AF_LOCAL)
506 {
507 /*
508 * Use peer credentials from domain socket connection...
509 */
510
511 struct passwd *pwd; /* Password entry for this user */
512 cupsd_ucred_t peercred; /* Peer credentials */
513 socklen_t peersize; /* Size of peer credentials */
514 #ifdef HAVE_AUTHORIZATION_H
515 const char *name; /* Authorizing name */
516
517 for (name = (char *)cupsArrayFirst(con->best->names);
518 name;
519 name = (char *)cupsArrayNext(con->best->names))
520 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
521 !_cups_strcasecmp(name, "@SYSTEM"))
522 {
523 cupsdLogMessage(CUPSD_LOG_ERROR,
524 "[Client %d] PeerCred authentication not allowed for "
525 "resource.", con->http.fd);
526 return;
527 }
528 #endif /* HAVE_AUTHORIZATION_H */
529
530 if ((pwd = getpwnam(authorization + 9)) == NULL)
531 {
532 cupsdLogMessage(CUPSD_LOG_ERROR,
533 "[Client %d] User \"%s\" does not exist.", con->http.fd,
534 authorization + 9);
535 return;
536 }
537
538 peersize = sizeof(peercred);
539
540 # ifdef __APPLE__
541 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
542 # else
543 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
544 # endif /* __APPLE__ */
545 {
546 cupsdLogMessage(CUPSD_LOG_ERROR,
547 "[Client %d] Unable to get peer credentials - %s",
548 con->http.fd, strerror(errno));
549 return;
550 }
551
552 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
553 {
554 cupsdLogMessage(CUPSD_LOG_ERROR,
555 "[Client %d] Invalid peer credentials for \"%s\" - got "
556 "%d, expected %d!", con->http.fd, authorization + 9,
557 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
558 # ifdef HAVE_SYS_UCRED_H
559 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_version=%d",
560 con->http.fd, peercred.cr_version);
561 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_uid=%d",
562 con->http.fd, peercred.cr_uid);
563 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_ngroups=%d",
564 con->http.fd, peercred.cr_ngroups);
565 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_groups[0]=%d",
566 con->http.fd, peercred.cr_groups[0]);
567 # endif /* HAVE_SYS_UCRED_H */
568 return;
569 }
570
571 strlcpy(username, authorization + 9, sizeof(username));
572
573 # ifdef HAVE_GSSAPI
574 con->gss_uid = CUPSD_UCRED_UID(peercred);
575 # endif /* HAVE_GSSAPI */
576
577 cupsdLogMessage(CUPSD_LOG_DEBUG,
578 "[Client %d] Authorized as %s using PeerCred", con->http.fd,
579 username);
580
581 con->type = CUPSD_AUTH_BASIC;
582 }
583 #endif /* SO_PEERCRED && AF_LOCAL */
584 else if (!strncmp(authorization, "Local", 5) &&
585 !_cups_strcasecmp(con->http.hostname, "localhost"))
586 {
587 /*
588 * Get Local certificate authentication data...
589 */
590
591 authorization += 5;
592 while (isspace(*authorization & 255))
593 authorization ++;
594
595 if ((localuser = cupsdFindCert(authorization)) == NULL)
596 {
597 cupsdLogMessage(CUPSD_LOG_ERROR,
598 "[Client %d] Local authentication certificate not found.",
599 con->http.fd);
600 return;
601 }
602
603 strlcpy(username, localuser->username, sizeof(username));
604 con->type = localuser->type;
605
606 cupsdLogMessage(CUPSD_LOG_DEBUG,
607 "[Client %d] Authorized as %s using Local", con->http.fd,
608 username);
609 }
610 else if (!strncmp(authorization, "Basic", 5))
611 {
612 /*
613 * Get the Basic authentication data...
614 */
615
616 int userlen; /* Username:password length */
617
618
619 authorization += 5;
620 while (isspace(*authorization & 255))
621 authorization ++;
622
623 userlen = sizeof(username);
624 httpDecode64_2(username, &userlen, authorization);
625
626 /*
627 * Pull the username and password out...
628 */
629
630 if ((ptr = strchr(username, ':')) == NULL)
631 {
632 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Missing Basic password.",
633 con->http.fd);
634 return;
635 }
636
637 *ptr++ = '\0';
638
639 if (!username[0])
640 {
641 /*
642 * Username must not be empty...
643 */
644
645 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Empty Basic username.",
646 con->http.fd);
647 return;
648 }
649
650 if (!*ptr)
651 {
652 /*
653 * Password must not be empty...
654 */
655
656 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Empty Basic password.",
657 con->http.fd);
658 return;
659 }
660
661 strlcpy(password, ptr, sizeof(password));
662
663 /*
664 * Validate the username and password...
665 */
666
667 switch (type)
668 {
669 default :
670 case CUPSD_AUTH_BASIC :
671 {
672 #if HAVE_LIBPAM
673 /*
674 * Only use PAM to do authentication. This supports MD5
675 * passwords, among other things...
676 */
677
678 pam_handle_t *pamh; /* PAM authentication handle */
679 int pamerr; /* PAM error code */
680 struct pam_conv pamdata;/* PAM conversation data */
681 cupsd_authdata_t data; /* Authentication data */
682
683
684 strlcpy(data.username, username, sizeof(data.username));
685 strlcpy(data.password, password, sizeof(data.password));
686
687 # if defined(__sun) || defined(__hpux)
688 pamdata.conv = (int (*)(int, struct pam_message **,
689 struct pam_response **,
690 void *))pam_func;
691 # else
692 pamdata.conv = pam_func;
693 # endif /* __sun || __hpux */
694 pamdata.appdata_ptr = &data;
695
696 # ifdef __hpux
697 /*
698 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
699 * more info...
700 */
701
702 auth_data = &data;
703 # endif /* __hpux */
704
705 pamerr = pam_start("cups", username, &pamdata, &pamh);
706 if (pamerr != PAM_SUCCESS)
707 {
708 cupsdLogMessage(CUPSD_LOG_ERROR,
709 "[Client %d] pam_start() returned %d (%s)",
710 con->http.fd, pamerr, pam_strerror(pamh, pamerr));
711 return;
712 }
713
714 # ifdef HAVE_PAM_SET_ITEM
715 # ifdef PAM_RHOST
716 pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
717 if (pamerr != PAM_SUCCESS)
718 cupsdLogMessage(CUPSD_LOG_WARN,
719 "[Client %d] pam_set_item(PAM_RHOST) "
720 "returned %d (%s)", con->http.fd, pamerr,
721 pam_strerror(pamh, pamerr));
722 # endif /* PAM_RHOST */
723
724 # ifdef PAM_TTY
725 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
726 if (pamerr != PAM_SUCCESS)
727 cupsdLogMessage(CUPSD_LOG_WARN,
728 "[Client %d] pam_set_item(PAM_TTY) "
729 "returned %d (%s)!", con->http.fd, pamerr,
730 pam_strerror(pamh, pamerr));
731 # endif /* PAM_TTY */
732 # endif /* HAVE_PAM_SET_ITEM */
733
734 pamerr = pam_authenticate(pamh, PAM_SILENT);
735 if (pamerr != PAM_SUCCESS)
736 {
737 cupsdLogMessage(CUPSD_LOG_ERROR,
738 "[Client %d] pam_authenticate() returned %d (%s)",
739 con->http.fd, pamerr, pam_strerror(pamh, pamerr));
740 pam_end(pamh, 0);
741 return;
742 }
743
744 # ifdef HAVE_PAM_SETCRED
745 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
746 if (pamerr != PAM_SUCCESS)
747 cupsdLogMessage(CUPSD_LOG_WARN,
748 "[Client %d] pam_setcred() returned %d (%s)",
749 con->http.fd, pamerr,
750 pam_strerror(pamh, pamerr));
751 # endif /* HAVE_PAM_SETCRED */
752
753 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
754 if (pamerr != PAM_SUCCESS)
755 {
756 cupsdLogMessage(CUPSD_LOG_ERROR,
757 "[Client %d] pam_acct_mgmt() returned %d (%s)",
758 con->http.fd, pamerr, pam_strerror(pamh, pamerr));
759 pam_end(pamh, 0);
760 return;
761 }
762
763 pam_end(pamh, PAM_SUCCESS);
764
765 #elif defined(HAVE_USERSEC_H)
766 /*
767 * Use AIX authentication interface...
768 */
769
770 char *authmsg; /* Authentication message */
771 int reenter; /* ??? */
772
773
774 cupsdLogMessage(CUPSD_LOG_DEBUG,
775 "[Client %d] AIX authenticate of username \"%s\"",
776 con->http.fd, username);
777
778 reenter = 1;
779 if (authenticate(username, password, &reenter, &authmsg) != 0)
780 {
781 cupsdLogMessage(CUPSD_LOG_DEBUG,
782 "[Client %d] Unable to authenticate username "
783 "\"%s\": %s", con->http.fd, username,
784 strerror(errno));
785 return;
786 }
787
788 #else
789 /*
790 * Use normal UNIX password file-based authentication...
791 */
792
793 char *pass; /* Encrypted password */
794 struct passwd *pw; /* User password data */
795 # ifdef HAVE_SHADOW_H
796 struct spwd *spw; /* Shadow password data */
797 # endif /* HAVE_SHADOW_H */
798
799
800 pw = getpwnam(username); /* Get the current password */
801 endpwent(); /* Close the password file */
802
803 if (!pw)
804 {
805 /*
806 * No such user...
807 */
808
809 cupsdLogMessage(CUPSD_LOG_ERROR,
810 "[Client %d] Unknown username \"%s\".",
811 con->http.fd, username);
812 return;
813 }
814
815 # ifdef HAVE_SHADOW_H
816 spw = getspnam(username);
817 endspent();
818
819 if (!spw && !strcmp(pw->pw_passwd, "x"))
820 {
821 /*
822 * Don't allow blank passwords!
823 */
824
825 cupsdLogMessage(CUPSD_LOG_ERROR,
826 "[Client %d] Username \"%s\" has no shadow "
827 "password.", con->http.fd, username);
828 return;
829 }
830
831 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
832 # else
833 if (!pw->pw_passwd[0])
834 # endif /* HAVE_SHADOW_H */
835 {
836 /*
837 * Don't allow blank passwords!
838 */
839
840 cupsdLogMessage(CUPSD_LOG_ERROR,
841 "[Client %d] Username \"%s\" has no password.",
842 con->http.fd, username);
843 return;
844 }
845
846 /*
847 * OK, the password isn't blank, so compare with what came from the
848 * client...
849 */
850
851 pass = cups_crypt(password, pw->pw_passwd);
852
853 cupsdLogMessage(CUPSD_LOG_DEBUG2,
854 "[Client %d] pw_passwd=\"%s\", crypt=\"%s\"",
855 con->http.fd, pw->pw_passwd, pass);
856
857 if (!pass || strcmp(pw->pw_passwd, pass))
858 {
859 # ifdef HAVE_SHADOW_H
860 if (spw)
861 {
862 pass = cups_crypt(password, spw->sp_pwdp);
863
864 cupsdLogMessage(CUPSD_LOG_DEBUG2,
865 "[Client %d] sp_pwdp=\"%s\", crypt=\"%s\"",
866 con->http.fd, spw->sp_pwdp, pass);
867
868 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
869 {
870 cupsdLogMessage(CUPSD_LOG_ERROR,
871 "[Client %d] Authentication failed for user "
872 "\"%s\".", con->http.fd, username);
873 return;
874 }
875 }
876 else
877 # endif /* HAVE_SHADOW_H */
878 {
879 cupsdLogMessage(CUPSD_LOG_ERROR,
880 "[Client %d] Authentication failed for user "
881 "\"%s\".", con->http.fd, username);
882 return;
883 }
884 }
885 #endif /* HAVE_LIBPAM */
886 }
887
888 cupsdLogMessage(CUPSD_LOG_DEBUG,
889 "[Client %d] Authorized as %s using Basic",
890 con->http.fd, username);
891 break;
892
893 case CUPSD_AUTH_BASICDIGEST :
894 /*
895 * Do Basic authentication with the Digest password file...
896 */
897
898 if (!get_md5_password(username, NULL, md5))
899 {
900 cupsdLogMessage(CUPSD_LOG_ERROR,
901 "[Client %d] Unknown MD5 username \"%s\".",
902 con->http.fd, username);
903 return;
904 }
905
906 httpMD5(username, "CUPS", password, basicmd5);
907
908 if (strcmp(md5, basicmd5))
909 {
910 cupsdLogMessage(CUPSD_LOG_ERROR,
911 "[Client %d] Authentication failed for \"%s\".",
912 con->http.fd, username);
913 return;
914 }
915
916 cupsdLogMessage(CUPSD_LOG_DEBUG,
917 "[Client %d] Authorized as %s using BasicDigest",
918 con->http.fd, username);
919 break;
920 }
921
922 con->type = type;
923 }
924 else if (!strncmp(authorization, "Digest", 6))
925 {
926 /*
927 * Get the username, password, and nonce from the Digest attributes...
928 */
929
930 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
931 username, sizeof(username)) || !username[0])
932 {
933 /*
934 * Username must not be empty...
935 */
936
937 cupsdLogMessage(CUPSD_LOG_ERROR,
938 "[Client %d] Empty or missing Digest username.",
939 con->http.fd);
940 return;
941 }
942
943 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
944 password, sizeof(password)) || !password[0])
945 {
946 /*
947 * Password must not be empty...
948 */
949
950 cupsdLogMessage(CUPSD_LOG_ERROR,
951 "[Client %d] Empty or missing Digest password.",
952 con->http.fd);
953 return;
954 }
955
956 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
957 nonce))
958 {
959 cupsdLogMessage(CUPSD_LOG_ERROR,
960 "[Client %d] No nonce value for Digest authentication.",
961 con->http.fd);
962 return;
963 }
964
965 if (strcmp(con->http.hostname, nonce))
966 {
967 cupsdLogMessage(CUPSD_LOG_ERROR,
968 "[Client %d] Bad nonce value, expected \"%s\", "
969 "got \"%s\".", con->http.fd, con->http.hostname, nonce);
970 return;
971 }
972
973 /*
974 * Validate the username and password...
975 */
976
977 if (!get_md5_password(username, NULL, md5))
978 {
979 cupsdLogMessage(CUPSD_LOG_ERROR,
980 "[Client %d] Unknown MD5 username \"%s\".",
981 con->http.fd, username);
982 return;
983 }
984
985 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
986
987 if (strcmp(md5, password))
988 {
989 cupsdLogMessage(CUPSD_LOG_ERROR,
990 "[Client %d] Authentication failed for \"%s\".",
991 con->http.fd, username);
992 return;
993 }
994
995 cupsdLogMessage(CUPSD_LOG_DEBUG,
996 "[Client %d] Authorized as %s using Digest", con->http.fd,
997 username);
998
999 con->type = CUPSD_AUTH_DIGEST;
1000 }
1001 #ifdef HAVE_GSSAPI
1002 else if (!strncmp(authorization, "Negotiate", 9))
1003 {
1004 int len; /* Length of authorization string */
1005 gss_ctx_id_t context; /* Authorization context */
1006 OM_uint32 major_status, /* Major status code */
1007 minor_status; /* Minor status code */
1008 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
1009 /* Input token from string */
1010 output_token = GSS_C_EMPTY_BUFFER;
1011 /* Output token for username */
1012 gss_name_t client_name; /* Client name */
1013
1014
1015 # ifdef __APPLE__
1016 /*
1017 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
1018 * to use it...
1019 */
1020
1021 if (gss_init_sec_context == NULL)
1022 {
1023 cupsdLogMessage(CUPSD_LOG_WARN,
1024 "[Client %d] GSSAPI/Kerberos authentication failed "
1025 "because the Kerberos framework is not present.",
1026 con->http.fd);
1027 return;
1028 }
1029 # endif /* __APPLE__ */
1030
1031 /*
1032 * Find the start of the Kerberos input token...
1033 */
1034
1035 authorization += 9;
1036 while (isspace(*authorization & 255))
1037 authorization ++;
1038
1039 if (!*authorization)
1040 {
1041 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1042 "[Client %d] No authentication data specified.",
1043 con->http.fd);
1044 return;
1045 }
1046
1047 /*
1048 * Decode the authorization string to get the input token...
1049 */
1050
1051 len = strlen(authorization);
1052 input_token.value = malloc(len);
1053 input_token.value = httpDecode64_2(input_token.value, &len,
1054 authorization);
1055 input_token.length = len;
1056
1057 /*
1058 * Accept the input token to get the authorization info...
1059 */
1060
1061 context = GSS_C_NO_CONTEXT;
1062 client_name = GSS_C_NO_NAME;
1063 major_status = gss_accept_sec_context(&minor_status,
1064 &context,
1065 ServerCreds,
1066 &input_token,
1067 GSS_C_NO_CHANNEL_BINDINGS,
1068 &client_name,
1069 NULL,
1070 &output_token,
1071 NULL,
1072 NULL,
1073 NULL);
1074
1075 if (output_token.length > 0)
1076 gss_release_buffer(&minor_status, &output_token);
1077
1078 if (GSS_ERROR(major_status))
1079 {
1080 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1081 "[Client %d] Error accepting GSSAPI security context",
1082 con->http.fd);
1083
1084 if (context != GSS_C_NO_CONTEXT)
1085 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1086 return;
1087 }
1088
1089 con->have_gss = 1;
1090
1091 /*
1092 * Get the username associated with the client's credentials...
1093 */
1094
1095 if (major_status == GSS_S_CONTINUE_NEEDED)
1096 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1097 "[Client %d] Credentials not complete", con->http.fd);
1098 else if (major_status == GSS_S_COMPLETE)
1099 {
1100 major_status = gss_display_name(&minor_status, client_name,
1101 &output_token, NULL);
1102
1103 if (GSS_ERROR(major_status))
1104 {
1105 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1106 "[Client %d] Error getting username", con->http.fd);
1107 gss_release_name(&minor_status, &client_name);
1108 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1109 return;
1110 }
1111
1112 strlcpy(username, output_token.value, sizeof(username));
1113
1114 cupsdLogMessage(CUPSD_LOG_DEBUG,
1115 "[Client %d] Authorized as %s using Negotiate",
1116 con->http.fd, username);
1117
1118 gss_release_name(&minor_status, &client_name);
1119 gss_release_buffer(&minor_status, &output_token);
1120
1121 con->type = CUPSD_AUTH_NEGOTIATE;
1122 }
1123
1124 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1125
1126 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
1127 /*
1128 * Get the client's UID if we are printing locally - that allows a backend
1129 * to run as the correct user to get Kerberos credentials of its own.
1130 */
1131
1132 if (_httpAddrFamily(con->http.hostaddr) == AF_LOCAL)
1133 {
1134 cupsd_ucred_t peercred; /* Peer credentials */
1135 socklen_t peersize; /* Size of peer credentials */
1136
1137 peersize = sizeof(peercred);
1138
1139 # ifdef __APPLE__
1140 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
1141 # else
1142 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred,
1143 &peersize))
1144 # endif /* __APPLE__ */
1145 {
1146 cupsdLogMessage(CUPSD_LOG_ERROR,
1147 "[Client %d] Unable to get peer credentials - %s",
1148 con->http.fd, strerror(errno));
1149 }
1150 else
1151 {
1152 cupsdLogMessage(CUPSD_LOG_DEBUG,
1153 "[Client %d] Using credentials for UID %d.",
1154 con->http.fd, CUPSD_UCRED_UID(peercred));
1155 con->gss_uid = CUPSD_UCRED_UID(peercred);
1156 }
1157 }
1158 # endif /* SO_PEERCRED && AF_LOCAL */
1159 }
1160 #endif /* HAVE_GSSAPI */
1161 else
1162 {
1163 char scheme[256]; /* Auth scheme... */
1164
1165
1166 if (sscanf(authorization, "%255s", scheme) != 1)
1167 strlcpy(scheme, "UNKNOWN", sizeof(scheme));
1168
1169 cupsdLogMessage(CUPSD_LOG_ERROR,
1170 "[Client %d] Bad authentication data \"%s ...\"",
1171 con->http.fd, scheme);
1172 return;
1173 }
1174
1175 /*
1176 * If we get here, then we were able to validate the username and
1177 * password - copy the validated username and password to the client
1178 * data and return...
1179 */
1180
1181 strlcpy(con->username, username, sizeof(con->username));
1182 strlcpy(con->password, password, sizeof(con->password));
1183 }
1184
1185
1186 /*
1187 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1188 * access a location.
1189 */
1190
1191 int /* O - 1 if allowed, 0 otherwise */
1192 cupsdCheckAccess(
1193 unsigned ip[4], /* I - Client address */
1194 char *name, /* I - Client hostname */
1195 int namelen, /* I - Length of hostname */
1196 cupsd_location_t *loc) /* I - Location to check */
1197 {
1198 int allow; /* 1 if allowed, 0 otherwise */
1199
1200
1201 if (!_cups_strcasecmp(name, "localhost"))
1202 {
1203 /*
1204 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1205 */
1206
1207 return (1);
1208 }
1209 else
1210 {
1211 /*
1212 * Do authorization checks on the domain/address...
1213 */
1214
1215 switch (loc->order_type)
1216 {
1217 default :
1218 allow = 0; /* anti-compiler-warning-code */
1219 break;
1220
1221 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
1222 allow = 1;
1223
1224 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1225 allow = 0;
1226
1227 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1228 allow = 1;
1229 break;
1230
1231 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
1232 allow = 0;
1233
1234 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1235 allow = 1;
1236
1237 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1238 allow = 0;
1239 break;
1240 }
1241 }
1242
1243 return (allow);
1244 }
1245
1246
1247 /*
1248 * 'cupsdCheckAuth()' - Check authorization masks.
1249 */
1250
1251 int /* O - 1 if mask matches, 0 otherwise */
1252 cupsdCheckAuth(unsigned ip[4], /* I - Client address */
1253 char *name, /* I - Client hostname */
1254 int name_len, /* I - Length of hostname */
1255 cups_array_t *masks) /* I - Masks */
1256 {
1257 int i; /* Looping var */
1258 cupsd_authmask_t *mask; /* Current mask */
1259 cupsd_netif_t *iface; /* Network interface */
1260 unsigned netip4; /* IPv4 network address */
1261 #ifdef AF_INET6
1262 unsigned netip6[4]; /* IPv6 network address */
1263 #endif /* AF_INET6 */
1264
1265
1266 for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
1267 mask;
1268 mask = (cupsd_authmask_t *)cupsArrayNext(masks))
1269 {
1270 switch (mask->type)
1271 {
1272 case CUPSD_AUTH_INTERFACE :
1273 /*
1274 * Check for a match with a network interface...
1275 */
1276
1277 netip4 = htonl(ip[3]);
1278
1279 #ifdef AF_INET6
1280 netip6[0] = htonl(ip[0]);
1281 netip6[1] = htonl(ip[1]);
1282 netip6[2] = htonl(ip[2]);
1283 netip6[3] = htonl(ip[3]);
1284 #endif /* AF_INET6 */
1285
1286 if (!strcmp(mask->mask.name.name, "*"))
1287 {
1288 #ifdef __APPLE__
1289 /*
1290 * Allow Back-to-My-Mac addresses...
1291 */
1292
1293 if ((ip[0] & 0xff000000) == 0xfd000000)
1294 return (1);
1295 #endif /* __APPLE__ */
1296
1297 /*
1298 * Check against all local interfaces...
1299 */
1300
1301 cupsdNetIFUpdate();
1302
1303 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1304 iface;
1305 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1306 {
1307 /*
1308 * Only check local interfaces...
1309 */
1310
1311 if (!iface->is_local)
1312 continue;
1313
1314 if (iface->address.addr.sa_family == AF_INET)
1315 {
1316 /*
1317 * Check IPv4 address...
1318 */
1319
1320 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1321 (iface->address.ipv4.sin_addr.s_addr &
1322 iface->mask.ipv4.sin_addr.s_addr))
1323 return (1);
1324 }
1325 #ifdef AF_INET6
1326 else
1327 {
1328 /*
1329 * Check IPv6 address...
1330 */
1331
1332 for (i = 0; i < 4; i ++)
1333 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1334 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1335 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1336 break;
1337
1338 if (i == 4)
1339 return (1);
1340 }
1341 #endif /* AF_INET6 */
1342 }
1343 }
1344 else
1345 {
1346 /*
1347 * Check the named interface...
1348 */
1349
1350 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1351 iface;
1352 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1353 {
1354 if (strcmp(mask->mask.name.name, iface->name))
1355 continue;
1356
1357 if (iface->address.addr.sa_family == AF_INET)
1358 {
1359 /*
1360 * Check IPv4 address...
1361 */
1362
1363 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1364 (iface->address.ipv4.sin_addr.s_addr &
1365 iface->mask.ipv4.sin_addr.s_addr))
1366 return (1);
1367 }
1368 #ifdef AF_INET6
1369 else
1370 {
1371 /*
1372 * Check IPv6 address...
1373 */
1374
1375 for (i = 0; i < 4; i ++)
1376 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1377 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1378 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1379 break;
1380
1381 if (i == 4)
1382 return (1);
1383 }
1384 #endif /* AF_INET6 */
1385 }
1386 }
1387 break;
1388
1389 case CUPSD_AUTH_NAME :
1390 /*
1391 * Check for exact name match...
1392 */
1393
1394 if (!_cups_strcasecmp(name, mask->mask.name.name))
1395 return (1);
1396
1397 /*
1398 * Check for domain match...
1399 */
1400
1401 if (name_len >= mask->mask.name.length &&
1402 mask->mask.name.name[0] == '.' &&
1403 !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1404 mask->mask.name.name))
1405 return (1);
1406 break;
1407
1408 case CUPSD_AUTH_IP :
1409 /*
1410 * Check for IP/network address match...
1411 */
1412
1413 for (i = 0; i < 4; i ++)
1414 if ((ip[i] & mask->mask.ip.netmask[i]) !=
1415 mask->mask.ip.address[i])
1416 break;
1417
1418 if (i == 4)
1419 return (1);
1420 break;
1421 }
1422 }
1423
1424 return (0);
1425 }
1426
1427
1428 /*
1429 * 'cupsdCheckGroup()' - Check for a user's group membership.
1430 */
1431
1432 int /* O - 1 if user is a member, 0 otherwise */
1433 cupsdCheckGroup(
1434 const char *username, /* I - User name */
1435 struct passwd *user, /* I - System user info */
1436 const char *groupname) /* I - Group name */
1437 {
1438 int i; /* Looping var */
1439 struct group *group; /* System group info */
1440 char junk[33]; /* MD5 password (not used) */
1441 #ifdef HAVE_MBR_UID_TO_UUID
1442 uuid_t useruuid, /* UUID for username */
1443 groupuuid; /* UUID for groupname */
1444 int is_member; /* True if user is a member of group */
1445 #endif /* HAVE_MBR_UID_TO_UUID */
1446
1447
1448 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1449 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1450 username, user, groupname);
1451
1452 /*
1453 * Validate input...
1454 */
1455
1456 if (!username || !groupname)
1457 return (0);
1458
1459 /*
1460 * Check to see if the user is a member of the named group...
1461 */
1462
1463 group = getgrnam(groupname);
1464 endgrent();
1465
1466 if (group != NULL)
1467 {
1468 /*
1469 * Group exists, check it...
1470 */
1471
1472 for (i = 0; group->gr_mem[i]; i ++)
1473 if (!_cups_strcasecmp(username, group->gr_mem[i]))
1474 return (1);
1475 }
1476
1477 /*
1478 * Group doesn't exist or user not in group list, check the group ID
1479 * against the user's group ID...
1480 */
1481
1482 if (user && group && group->gr_gid == user->pw_gid)
1483 return (1);
1484
1485 #ifdef HAVE_MBR_UID_TO_UUID
1486 /*
1487 * Check group membership through MacOS X membership API...
1488 */
1489
1490 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1491 {
1492 if (group)
1493 {
1494 /*
1495 * Map group name to UUID and check membership...
1496 */
1497
1498 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1499 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1500 if (is_member)
1501 return (1);
1502 }
1503 else if (groupname[0] == '#')
1504 {
1505 /*
1506 * Use UUID directly and check for equality (user UUID) and
1507 * membership (group UUID)...
1508 */
1509
1510 if (!uuid_parse((char *)groupname + 1, groupuuid))
1511 {
1512 if (!uuid_compare(useruuid, groupuuid))
1513 return (1);
1514 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1515 if (is_member)
1516 return (1);
1517 }
1518
1519 return (0);
1520 }
1521 }
1522 else if (groupname[0] == '#')
1523 return (0);
1524 #endif /* HAVE_MBR_UID_TO_UUID */
1525
1526 /*
1527 * Username not found, group not found, or user is not part of the
1528 * system group... Check for a user and group in the MD5 password
1529 * file...
1530 */
1531
1532 if (get_md5_password(username, groupname, junk) != NULL)
1533 return (1);
1534
1535 /*
1536 * If we get this far, then the user isn't part of the named group...
1537 */
1538
1539 return (0);
1540 }
1541
1542
1543 /*
1544 * 'cupsdCopyLocation()' - Make a copy of a location...
1545 */
1546
1547 cupsd_location_t * /* O - New location */
1548 cupsdCopyLocation(
1549 cupsd_location_t *loc) /* I - Original location */
1550 {
1551 cupsd_location_t *temp; /* New location */
1552
1553
1554 /*
1555 * Make a copy of the original location...
1556 */
1557
1558 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1559 return (NULL);
1560
1561 /*
1562 * Copy the information from the original location to the new one.
1563 */
1564
1565 if (!loc)
1566 return (temp);
1567
1568 if (loc->location)
1569 temp->location = _cupsStrAlloc(loc->location);
1570
1571 temp->limit = loc->limit;
1572 temp->order_type = loc->order_type;
1573 temp->type = loc->type;
1574 temp->level = loc->level;
1575 temp->satisfy = loc->satisfy;
1576 temp->encryption = loc->encryption;
1577
1578 if (loc->names)
1579 {
1580 if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1581 {
1582 cupsdLogMessage(CUPSD_LOG_ERROR,
1583 "Unable to allocate memory for %d names: %s",
1584 cupsArrayCount(loc->names), strerror(errno));
1585
1586 cupsdFreeLocation(temp);
1587 return (NULL);
1588 }
1589 }
1590
1591 if (loc->allow)
1592 {
1593 /*
1594 * Copy allow rules...
1595 */
1596
1597 if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1598 {
1599 cupsdLogMessage(CUPSD_LOG_ERROR,
1600 "Unable to allocate memory for %d allow rules: %s",
1601 cupsArrayCount(loc->allow), strerror(errno));
1602 cupsdFreeLocation(temp);
1603 return (NULL);
1604 }
1605 }
1606
1607 if (loc->deny)
1608 {
1609 /*
1610 * Copy deny rules...
1611 */
1612
1613 if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1614 {
1615 cupsdLogMessage(CUPSD_LOG_ERROR,
1616 "Unable to allocate memory for %d deny rules: %s",
1617 cupsArrayCount(loc->deny), strerror(errno));
1618 cupsdFreeLocation(temp);
1619 return (NULL);
1620 }
1621 }
1622
1623 return (temp);
1624 }
1625
1626
1627 /*
1628 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1629 */
1630
1631 void
1632 cupsdDeleteAllLocations(void)
1633 {
1634 /*
1635 * Free the location array, which will free all of the locations...
1636 */
1637
1638 cupsArrayDelete(Locations);
1639 Locations = NULL;
1640 }
1641
1642
1643 /*
1644 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1645 */
1646
1647 cupsd_location_t * /* O - Location that matches */
1648 cupsdFindBest(const char *path, /* I - Resource path */
1649 http_state_t state) /* I - HTTP state/request */
1650 {
1651 char uri[HTTP_MAX_URI],
1652 /* URI in request... */
1653 *uriptr; /* Pointer into URI */
1654 cupsd_location_t *loc, /* Current location */
1655 *best; /* Best match for location so far */
1656 int bestlen; /* Length of best match */
1657 int limit; /* Limit field */
1658 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1659 {
1660 CUPSD_AUTH_LIMIT_ALL,
1661 CUPSD_AUTH_LIMIT_OPTIONS,
1662 CUPSD_AUTH_LIMIT_GET,
1663 CUPSD_AUTH_LIMIT_GET,
1664 CUPSD_AUTH_LIMIT_HEAD,
1665 CUPSD_AUTH_LIMIT_POST,
1666 CUPSD_AUTH_LIMIT_POST,
1667 CUPSD_AUTH_LIMIT_POST,
1668 CUPSD_AUTH_LIMIT_PUT,
1669 CUPSD_AUTH_LIMIT_PUT,
1670 CUPSD_AUTH_LIMIT_DELETE,
1671 CUPSD_AUTH_LIMIT_TRACE,
1672 CUPSD_AUTH_LIMIT_ALL,
1673 CUPSD_AUTH_LIMIT_ALL
1674 };
1675
1676
1677 /*
1678 * First copy the connection URI to a local string so we have drop
1679 * any .ppd extension from the pathname in /printers or /classes
1680 * URIs...
1681 */
1682
1683 strlcpy(uri, path, sizeof(uri));
1684
1685 if (!strncmp(uri, "/printers/", 10) ||
1686 !strncmp(uri, "/classes/", 9))
1687 {
1688 /*
1689 * Check if the URI has .ppd on the end...
1690 */
1691
1692 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1693
1694 if (!strcmp(uriptr, ".ppd"))
1695 *uriptr = '\0';
1696 }
1697
1698 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1699
1700 /*
1701 * Loop through the list of locations to find a match...
1702 */
1703
1704 limit = limits[state];
1705 best = NULL;
1706 bestlen = 0;
1707
1708 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1709 loc;
1710 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1711 {
1712 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1713 loc->location ? loc->location : "nil", loc->limit);
1714
1715 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1716 {
1717 /*
1718 * Use case-insensitive comparison for queue names...
1719 */
1720
1721 if (loc->length > bestlen && loc->location &&
1722 !_cups_strncasecmp(uri, loc->location, loc->length) &&
1723 loc->location[0] == '/' &&
1724 (limit & loc->limit) != 0)
1725 {
1726 best = loc;
1727 bestlen = loc->length;
1728 }
1729 }
1730 else
1731 {
1732 /*
1733 * Use case-sensitive comparison for other URIs...
1734 */
1735
1736 if (loc->length > bestlen && loc->location &&
1737 !strncmp(uri, loc->location, loc->length) &&
1738 loc->location[0] == '/' &&
1739 (limit & loc->limit) != 0)
1740 {
1741 best = loc;
1742 bestlen = loc->length;
1743 }
1744 }
1745 }
1746
1747 /*
1748 * Return the match, if any...
1749 */
1750
1751 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1752 best ? best->location : "NONE");
1753
1754 return (best);
1755 }
1756
1757
1758 /*
1759 * 'cupsdFindLocation()' - Find the named location.
1760 */
1761
1762 cupsd_location_t * /* O - Location that matches */
1763 cupsdFindLocation(const char *location) /* I - Connection */
1764 {
1765 cupsd_location_t key; /* Search key */
1766
1767
1768 key.location = (char *)location;
1769
1770 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1771 }
1772
1773
1774 /*
1775 * 'cupsdFreeLocation()' - Free all memory used by a location.
1776 */
1777
1778 void
1779 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1780 {
1781 cupsArrayDelete(loc->names);
1782 cupsArrayDelete(loc->allow);
1783 cupsArrayDelete(loc->deny);
1784
1785 _cupsStrFree(loc->location);
1786 free(loc);
1787 }
1788
1789
1790 /*
1791 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1792 */
1793
1794 http_status_t /* O - HTTP_OK if authorized or error code */
1795 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1796 const char *owner)/* I - Owner of object */
1797 {
1798 int i, /* Looping vars */
1799 auth, /* Authorization status */
1800 type; /* Type of authentication */
1801 unsigned address[4]; /* Authorization address */
1802 cupsd_location_t *best; /* Best match for location so far */
1803 int hostlen; /* Length of hostname */
1804 char *name, /* Current username */
1805 username[256], /* Username to authorize */
1806 ownername[256], /* Owner name to authorize */
1807 *ptr; /* Pointer into username */
1808 struct passwd *pw; /* User password data */
1809 static const char * const levels[] = /* Auth levels */
1810 {
1811 "ANON",
1812 "USER",
1813 "GROUP"
1814 };
1815 static const char * const types[] = /* Auth types */
1816 {
1817 "None",
1818 "Basic",
1819 "Digest",
1820 "BasicDigest",
1821 "Negotiate"
1822 };
1823
1824
1825 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1826 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1827 con->uri, con->best, con->best ? con->best->location ?
1828 con->best->location : "(null)" : "");
1829 if (owner)
1830 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1831 "cupsdIsAuthorized: owner=\"%s\"", owner);
1832
1833 /*
1834 * If there is no "best" authentication rule for this request, then
1835 * access is allowed from the local system and denied from other
1836 * addresses...
1837 */
1838
1839 if (!con->best)
1840 {
1841 if (!strcmp(con->http.hostname, "localhost") ||
1842 !strcmp(con->http.hostname, ServerName))
1843 return (HTTP_OK);
1844 else
1845 return (HTTP_FORBIDDEN);
1846 }
1847
1848 best = con->best;
1849
1850 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1851 type = cupsdDefaultAuthType();
1852
1853 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1854 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
1855 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
1856 levels[best->level], types[type],
1857 best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1858
1859 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1860 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1861 best->op, ippOpString(best->op));
1862
1863 /*
1864 * Check host/ip-based accesses...
1865 */
1866
1867 #ifdef AF_INET6
1868 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1869 {
1870 /*
1871 * Copy IPv6 address...
1872 */
1873
1874 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1875 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1876 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1877 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1878 }
1879 else
1880 #endif /* AF_INET6 */
1881 if (con->http.hostaddr->addr.sa_family == AF_INET)
1882 {
1883 /*
1884 * Copy IPv4 address...
1885 */
1886
1887 address[0] = 0;
1888 address[1] = 0;
1889 address[2] = 0;
1890 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1891 }
1892 else
1893 memset(address, 0, sizeof(address));
1894
1895 hostlen = strlen(con->http.hostname);
1896
1897 auth = cupsdCheckAccess(address, con->http.hostname, hostlen, best)
1898 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1899
1900 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
1901 auth ? "DENY" : "ALLOW");
1902
1903 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1904 return (HTTP_FORBIDDEN);
1905
1906 #ifdef HAVE_SSL
1907 /*
1908 * See if encryption is required...
1909 */
1910
1911 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1912 _cups_strcasecmp(con->http.hostname, "localhost") &&
1913 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1914 !(type == CUPSD_AUTH_NEGOTIATE ||
1915 (type == CUPSD_AUTH_NONE &&
1916 cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1917 {
1918 cupsdLogMessage(CUPSD_LOG_DEBUG,
1919 "cupsdIsAuthorized: Need upgrade to TLS...");
1920 return (HTTP_UPGRADE_REQUIRED);
1921 }
1922 #endif /* HAVE_SSL */
1923
1924 /*
1925 * Now see what access level is required...
1926 */
1927
1928 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1929 (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1930 return (HTTP_OK);
1931
1932 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1933 best->limit == CUPSD_AUTH_LIMIT_IPP)
1934 {
1935 /*
1936 * Check for unauthenticated username...
1937 */
1938
1939 ipp_attribute_t *attr; /* requesting-user-name attribute */
1940
1941
1942 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1943 if (attr)
1944 {
1945 cupsdLogMessage(CUPSD_LOG_DEBUG,
1946 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1947 attr->values[0].string.text);
1948 strlcpy(username, attr->values[0].string.text, sizeof(username));
1949 }
1950 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1951 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1952 else
1953 return (HTTP_OK); /* unless overridden with Satisfy */
1954 }
1955 else
1956 {
1957 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1958 con->username);
1959
1960 #ifdef HAVE_AUTHORIZATION_H
1961 if (!con->username[0] && !con->authref)
1962 #else
1963 if (!con->username[0])
1964 #endif /* HAVE_AUTHORIZATION_H */
1965 {
1966 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1967 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1968 else
1969 return (HTTP_OK); /* unless overridden with Satisfy */
1970 }
1971
1972
1973 if (con->type != type && type != CUPSD_AUTH_NONE &&
1974 #ifdef HAVE_GSSAPI
1975 (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1976 #endif /* HAVE_GSSAPI */
1977 (con->type != CUPSD_AUTH_BASIC || type != CUPSD_AUTH_BASICDIGEST))
1978 {
1979 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
1980 types[con->type], types[type]);
1981
1982 return (HTTP_UNAUTHORIZED);
1983 }
1984
1985 strlcpy(username, con->username, sizeof(username));
1986 }
1987
1988 /*
1989 * OK, got a username. See if we need normal user access, or group
1990 * access... (root always matches)
1991 */
1992
1993 if (!strcmp(username, "root"))
1994 return (HTTP_OK);
1995
1996 /*
1997 * Strip any @domain or @KDC from the username and owner...
1998 */
1999
2000 if ((ptr = strchr(username, '@')) != NULL)
2001 *ptr = '\0';
2002
2003 if (owner)
2004 {
2005 strlcpy(ownername, owner, sizeof(ownername));
2006
2007 if ((ptr = strchr(ownername, '@')) != NULL)
2008 *ptr = '\0';
2009 }
2010 else
2011 ownername[0] = '\0';
2012
2013 /*
2014 * Get the user info...
2015 */
2016
2017 if (username[0])
2018 {
2019 pw = getpwnam(username);
2020 endpwent();
2021 }
2022 else
2023 pw = NULL;
2024
2025 if (best->level == CUPSD_AUTH_USER)
2026 {
2027 /*
2028 * If there are no names associated with this location, then
2029 * any valid user is OK...
2030 */
2031
2032 if (cupsArrayCount(best->names) == 0)
2033 return (HTTP_OK);
2034
2035 /*
2036 * Otherwise check the user list and return OK if this user is
2037 * allowed...
2038 */
2039
2040 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2041 "cupsdIsAuthorized: Checking user membership...");
2042
2043 #ifdef HAVE_AUTHORIZATION_H
2044 /*
2045 * If an authorization reference was supplied it must match a right name...
2046 */
2047
2048 if (con->authref)
2049 {
2050 for (name = (char *)cupsArrayFirst(best->names);
2051 name;
2052 name = (char *)cupsArrayNext(best->names))
2053 {
2054 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
2055 return (HTTP_OK);
2056 else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
2057 check_authref(con, SystemGroupAuthKey))
2058 return (HTTP_OK);
2059 }
2060
2061 return (HTTP_FORBIDDEN);
2062 }
2063 #endif /* HAVE_AUTHORIZATION_H */
2064
2065 for (name = (char *)cupsArrayFirst(best->names);
2066 name;
2067 name = (char *)cupsArrayNext(best->names))
2068 {
2069 if (!_cups_strcasecmp(name, "@OWNER") && owner &&
2070 !_cups_strcasecmp(username, ownername))
2071 return (HTTP_OK);
2072 else if (!_cups_strcasecmp(name, "@SYSTEM"))
2073 {
2074 for (i = 0; i < NumSystemGroups; i ++)
2075 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
2076 return (HTTP_OK);
2077 }
2078 else if (name[0] == '@')
2079 {
2080 if (cupsdCheckGroup(username, pw, name + 1))
2081 return (HTTP_OK);
2082 }
2083 else if (!_cups_strcasecmp(username, name))
2084 return (HTTP_OK);
2085 }
2086
2087 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
2088 }
2089
2090 /*
2091 * Check to see if this user is in any of the named groups...
2092 */
2093
2094 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2095 "cupsdIsAuthorized: Checking group membership...");
2096
2097 /*
2098 * Check to see if this user is in any of the named groups...
2099 */
2100
2101 for (name = (char *)cupsArrayFirst(best->names);
2102 name;
2103 name = (char *)cupsArrayNext(best->names))
2104 {
2105 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2106 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2107 name);
2108
2109 if (!_cups_strcasecmp(name, "@SYSTEM"))
2110 {
2111 for (i = 0; i < NumSystemGroups; i ++)
2112 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
2113 return (HTTP_OK);
2114 }
2115 else if (cupsdCheckGroup(username, pw, name))
2116 return (HTTP_OK);
2117 }
2118
2119 /*
2120 * The user isn't part of the specified group, so deny access...
2121 */
2122
2123 cupsdLogMessage(CUPSD_LOG_DEBUG,
2124 "cupsdIsAuthorized: User not in group(s)!");
2125
2126 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
2127 }
2128
2129
2130 /*
2131 * 'cupsdNewLocation()' - Create a new location for authorization.
2132 *
2133 * Note: Still need to call cupsdAddLocation() to add it to the list of global
2134 * locations.
2135 */
2136
2137 cupsd_location_t * /* O - Pointer to new location record */
2138 cupsdNewLocation(const char *location) /* I - Location path */
2139 {
2140 cupsd_location_t *temp; /* New location */
2141
2142
2143 /*
2144 * Try to allocate memory for the new location.
2145 */
2146
2147 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
2148 return (NULL);
2149
2150 /*
2151 * Initialize the record and copy the name over...
2152 */
2153
2154 if ((temp->location = _cupsStrAlloc(location)) == NULL)
2155 {
2156 free(temp);
2157 return (NULL);
2158 }
2159
2160 temp->length = strlen(temp->location);
2161
2162 /*
2163 * Return the new record...
2164 */
2165
2166 return (temp);
2167 }
2168
2169
2170 #ifdef HAVE_AUTHORIZATION_H
2171 /*
2172 * 'check_authref()' - Check if an authorization services reference has the
2173 * supplied right.
2174 */
2175
2176 static int /* O - 1 if right is valid, 0 otherwise */
2177 check_authref(cupsd_client_t *con, /* I - Connection */
2178 const char *right) /* I - Right name */
2179 {
2180 OSStatus status; /* OS Status */
2181 AuthorizationItem authright; /* Authorization right */
2182 AuthorizationRights authrights; /* Authorization rights */
2183 AuthorizationFlags authflags; /* Authorization flags */
2184
2185
2186 /*
2187 * Check to see if the user is allowed to perform the task...
2188 */
2189
2190 if (!con->authref)
2191 return (0);
2192
2193 authright.name = right;
2194 authright.valueLength = 0;
2195 authright.value = NULL;
2196 authright.flags = 0;
2197
2198 authrights.count = 1;
2199 authrights.items = &authright;
2200
2201 authflags = kAuthorizationFlagDefaults |
2202 kAuthorizationFlagExtendRights;
2203
2204 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2205 kAuthorizationEmptyEnvironment,
2206 authflags, NULL)) != 0)
2207 {
2208 cupsdLogMessage(CUPSD_LOG_ERROR,
2209 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2210 authright.name, (int)status, cssmErrorString(status));
2211 return (0);
2212 }
2213
2214 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2215 "AuthorizationCopyRights(\"%s\") succeeded!",
2216 authright.name);
2217
2218 return (1);
2219 }
2220 #endif /* HAVE_AUTHORIZATION_H */
2221
2222
2223 /*
2224 * 'compare_locations()' - Compare two locations.
2225 */
2226
2227 static int /* O - Result of comparison */
2228 compare_locations(cupsd_location_t *a, /* I - First location */
2229 cupsd_location_t *b) /* I - Second location */
2230 {
2231 return (strcmp(b->location, a->location));
2232 }
2233
2234
2235 /*
2236 * 'copy_authmask()' - Copy function for auth masks.
2237 */
2238
2239 static cupsd_authmask_t * /* O - New auth mask */
2240 copy_authmask(cupsd_authmask_t *mask, /* I - Existing auth mask */
2241 void *data) /* I - User data (unused) */
2242 {
2243 cupsd_authmask_t *temp; /* New auth mask */
2244
2245
2246 (void)data;
2247
2248 if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
2249 {
2250 memcpy(temp, mask, sizeof(cupsd_authmask_t));
2251
2252 if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
2253 {
2254 /*
2255 * Make a copy of the name...
2256 */
2257
2258 if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
2259 {
2260 /*
2261 * Failed to make copy...
2262 */
2263
2264 free(temp);
2265 temp = NULL;
2266 }
2267 }
2268 }
2269
2270 return (temp);
2271 }
2272
2273
2274 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2275 /*
2276 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2277 * as needed.
2278 */
2279
2280 static char * /* O - Encrypted password */
2281 cups_crypt(const char *pw, /* I - Password string */
2282 const char *salt) /* I - Salt (key) string */
2283 {
2284 if (!strncmp(salt, "$1$", 3))
2285 {
2286 /*
2287 * Use MD5 passwords without the benefit of PAM; this is for
2288 * Slackware Linux, and the algorithm was taken from the
2289 * old shadow-19990827/lib/md5crypt.c source code... :(
2290 */
2291
2292 int i; /* Looping var */
2293 unsigned long n; /* Output number */
2294 int pwlen; /* Length of password string */
2295 const char *salt_end; /* End of "salt" data for MD5 */
2296 char *ptr; /* Pointer into result string */
2297 _cups_md5_state_t state; /* Primary MD5 state info */
2298 _cups_md5_state_t state2; /* Secondary MD5 state info */
2299 unsigned char digest[16]; /* MD5 digest result */
2300 static char result[120]; /* Final password string */
2301
2302
2303 /*
2304 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2305 * Get a maximum of 8 characters of salt data after $1$...
2306 */
2307
2308 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2309 if (*salt_end == '$')
2310 break;
2311
2312 /*
2313 * Compute the MD5 sum we need...
2314 */
2315
2316 pwlen = strlen(pw);
2317
2318 _cupsMD5Init(&state);
2319 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2320 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2321
2322 _cupsMD5Init(&state2);
2323 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2324 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2325 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2326 _cupsMD5Finish(&state2, digest);
2327
2328 for (i = pwlen; i > 0; i -= 16)
2329 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2330
2331 for (i = pwlen; i > 0; i >>= 1)
2332 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2333
2334 _cupsMD5Finish(&state, digest);
2335
2336 for (i = 0; i < 1000; i ++)
2337 {
2338 _cupsMD5Init(&state);
2339
2340 if (i & 1)
2341 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2342 else
2343 _cupsMD5Append(&state, digest, 16);
2344
2345 if (i % 3)
2346 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2347
2348 if (i % 7)
2349 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2350
2351 if (i & 1)
2352 _cupsMD5Append(&state, digest, 16);
2353 else
2354 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2355
2356 _cupsMD5Finish(&state, digest);
2357 }
2358
2359 /*
2360 * Copy the final sum to the result string and return...
2361 */
2362
2363 memcpy(result, salt, salt_end - salt);
2364 ptr = result + (salt_end - salt);
2365 *ptr++ = '$';
2366
2367 for (i = 0; i < 5; i ++, ptr += 4)
2368 {
2369 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2370
2371 if (i < 4)
2372 n |= digest[i + 12];
2373 else
2374 n |= digest[5];
2375
2376 to64(ptr, n, 4);
2377 }
2378
2379 to64(ptr, digest[11], 2);
2380 ptr += 2;
2381 *ptr = '\0';
2382
2383 return (result);
2384 }
2385 else
2386 {
2387 /*
2388 * Use the standard crypt() function...
2389 */
2390
2391 return (crypt(pw, salt));
2392 }
2393 }
2394 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2395
2396
2397 /*
2398 * 'free_authmask()' - Free function for auth masks.
2399 */
2400
2401 static void
2402 free_authmask(cupsd_authmask_t *mask, /* I - Auth mask to free */
2403 void *data) /* I - User data (unused) */
2404 {
2405 (void)data;
2406
2407 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2408 _cupsStrFree(mask->mask.name.name);
2409
2410 free(mask);
2411 }
2412
2413
2414 /*
2415 * 'get_md5_password()' - Get an MD5 password.
2416 */
2417
2418 static char * /* O - MD5 password string */
2419 get_md5_password(const char *username, /* I - Username */
2420 const char *group, /* I - Group */
2421 char passwd[33]) /* O - MD5 password string */
2422 {
2423 cups_file_t *fp; /* passwd.md5 file */
2424 char filename[1024], /* passwd.md5 filename */
2425 line[256], /* Line from file */
2426 tempuser[33], /* User from file */
2427 tempgroup[33]; /* Group from file */
2428
2429
2430 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2431 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2432 username, group ? group : "(null)", passwd);
2433
2434 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2435 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2436 {
2437 if (errno != ENOENT)
2438 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2439 strerror(errno));
2440
2441 return (NULL);
2442 }
2443
2444 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2445 {
2446 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2447 {
2448 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2449 continue;
2450 }
2451
2452 if (!strcmp(username, tempuser) &&
2453 (group == NULL || !strcmp(group, tempgroup)))
2454 {
2455 /*
2456 * Found the password entry!
2457 */
2458
2459 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2460 username, tempgroup);
2461
2462 cupsFileClose(fp);
2463 return (passwd);
2464 }
2465 }
2466
2467 /*
2468 * Didn't find a password entry - return NULL!
2469 */
2470
2471 cupsFileClose(fp);
2472 return (NULL);
2473 }
2474
2475
2476 #if HAVE_LIBPAM
2477 /*
2478 * 'pam_func()' - PAM conversation function.
2479 */
2480
2481 static int /* O - Success or failure */
2482 pam_func(
2483 int num_msg, /* I - Number of messages */
2484 const struct pam_message **msg, /* I - Messages */
2485 struct pam_response **resp, /* O - Responses */
2486 void *appdata_ptr)
2487 /* I - Pointer to connection */
2488 {
2489 int i; /* Looping var */
2490 struct pam_response *replies; /* Replies */
2491 cupsd_authdata_t *data; /* Pointer to auth data */
2492
2493
2494 /*
2495 * Allocate memory for the responses...
2496 */
2497
2498 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2499 return (PAM_CONV_ERR);
2500
2501 /*
2502 * Answer all of the messages...
2503 */
2504
2505 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2506
2507 #ifdef __hpux
2508 /*
2509 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2510 * module. This is a workaround...
2511 */
2512
2513 data = auth_data;
2514 (void)appdata_ptr;
2515 #else
2516 data = (cupsd_authdata_t *)appdata_ptr;
2517 #endif /* __hpux */
2518
2519 for (i = 0; i < num_msg; i ++)
2520 {
2521 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2522
2523 switch (msg[i]->msg_style)
2524 {
2525 case PAM_PROMPT_ECHO_ON:
2526 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2527 data->username));
2528 replies[i].resp_retcode = PAM_SUCCESS;
2529 replies[i].resp = strdup(data->username);
2530 break;
2531
2532 case PAM_PROMPT_ECHO_OFF:
2533 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2534 data->password));
2535 replies[i].resp_retcode = PAM_SUCCESS;
2536 replies[i].resp = strdup(data->password);
2537 break;
2538
2539 case PAM_TEXT_INFO:
2540 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2541 replies[i].resp_retcode = PAM_SUCCESS;
2542 replies[i].resp = NULL;
2543 break;
2544
2545 case PAM_ERROR_MSG:
2546 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2547 replies[i].resp_retcode = PAM_SUCCESS;
2548 replies[i].resp = NULL;
2549 break;
2550
2551 default:
2552 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2553 msg[i]->msg_style));
2554 free(replies);
2555 return (PAM_CONV_ERR);
2556 }
2557 }
2558
2559 /*
2560 * Return the responses back to PAM...
2561 */
2562
2563 *resp = replies;
2564
2565 return (PAM_SUCCESS);
2566 }
2567 #elif !defined(HAVE_USERSEC_H)
2568
2569
2570 /*
2571 * 'to64()' - Base64-encode an integer value...
2572 */
2573
2574 static void
2575 to64(char *s, /* O - Output string */
2576 unsigned long v, /* I - Value to encode */
2577 int n) /* I - Number of digits */
2578 {
2579 const char *itoa64 = "./0123456789"
2580 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2581 "abcdefghijklmnopqrstuvwxyz";
2582
2583
2584 for (; n > 0; n --, v >>= 6)
2585 *s++ = itoa64[v & 0x3f];
2586 }
2587 #endif /* HAVE_LIBPAM */
2588
2589
2590 /*
2591 * End of "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $".
2592 */
Unnamed repository; edit this file 'description' to name the repository.