]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge changes from CUPS 1.4svn-r8346.
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $"
3 *
4 * Authorization routines for the Common UNIX Printing System (CUPS).
5 *
6 * Copyright 2007-2009 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddLocation() - Add a location for authorization.
21 * cupsdAddName() - Add a name to a location...
22 * cupsdAllowHost() - Add a host name that is allowed to access the
23 * location.
24 * cupsdAllowIP() - Add an IP address or network that is allowed to
25 * access the location.
26 * cupsdAuthorize() - Validate any authorization credentials.
27 * cupsdCheckAccess() - Check whether the given address is allowed to
28 * access a location.
29 * cupsdCheckAuth() - Check authorization masks.
30 * cupsdCheckGroup() - Check for a user's group membership.
31 * cupsdCopyLocation() - Make a copy of a location...
32 * cupsdDeleteAllLocations() - Free all memory used for location
33 * authorization.
34 * cupsdDeleteLocation() - Free all memory used by a location.
35 * cupsdDenyHost() - Add a host name that is not allowed to access
36 * the location.
37 * cupsdDenyIP() - Add an IP address or network that is not
38 * allowed to access the location.
39 * cupsdFindBest() - Find the location entry that best matches the
40 * resource.
41 * cupsdFindLocation() - Find the named location.
42 * cupsdIsAuthorized() - Check to see if the user is authorized...
43 * add_allow() - Add an allow mask to the location.
44 * add_deny() - Add a deny mask to the location.
45 * check_authref() - Check if an authorization services reference
46 * has the supplied right.
47 * compare_locations() - Compare two locations.
48 * cups_crypt() - Encrypt the password using the DES or MD5
49 * algorithms, as needed.
50 * get_gss_creds() - Obtain GSS credentials.
51 * get_md5_password() - Get an MD5 password.
52 * pam_func() - PAM conversation function.
53 * to64() - Base64-encode an integer value...
54 */
55
56 /*
57 * Include necessary headers...
58 */
59
60 #include "cupsd.h"
61 #include <grp.h>
62 #ifdef HAVE_SHADOW_H
63 # include <shadow.h>
64 #endif /* HAVE_SHADOW_H */
65 #ifdef HAVE_CRYPT_H
66 # include <crypt.h>
67 #endif /* HAVE_CRYPT_H */
68 #if HAVE_LIBPAM
69 # ifdef HAVE_PAM_PAM_APPL_H
70 # include <pam/pam_appl.h>
71 # else
72 # include <security/pam_appl.h>
73 # endif /* HAVE_PAM_PAM_APPL_H */
74 #endif /* HAVE_LIBPAM */
75 #ifdef HAVE_USERSEC_H
76 # include <usersec.h>
77 #endif /* HAVE_USERSEC_H */
78 #ifdef HAVE_MEMBERSHIP_H
79 # include <membership.h>
80 #endif /* HAVE_MEMBERSHIP_H */
81 #ifdef HAVE_AUTHORIZATION_H
82 # include <Security/AuthorizationTags.h>
83 # ifdef HAVE_SECBASEPRIV_H
84 # include <Security/SecBasePriv.h>
85 # else
86 extern const char *cssmErrorString(int error);
87 # endif /* HAVE_SECBASEPRIV_H */
88 #endif /* HAVE_AUTHORIZATION_H */
89 #ifdef HAVE_SYS_PARAM_H
90 # include <sys/param.h>
91 #endif /* HAVE_SYS_PARAM_H */
92 #ifdef HAVE_SYS_UCRED_H
93 # include <sys/ucred.h>
94 typedef struct xucred cupsd_ucred_t;
95 # define CUPSD_UCRED_UID(c) (c).cr_uid
96 #else
97 typedef struct ucred cupsd_ucred_t;
98 # define CUPSD_UCRED_UID(c) (c).uid
99 #endif /* HAVE_SYS_UCRED_H */
100
101
102 /*
103 * Local functions...
104 */
105
106 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
107 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
108 #ifdef HAVE_AUTHORIZATION_H
109 static int check_authref(cupsd_client_t *con, const char *right);
110 #endif /* HAVE_AUTHORIZATION_H */
111 static int compare_locations(cupsd_location_t *a,
112 cupsd_location_t *b);
113 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
114 static char *cups_crypt(const char *pw, const char *salt);
115 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
116 #ifdef HAVE_GSSAPI
117 static gss_cred_id_t get_gss_creds(const char *service_name,
118 const char *con_server_name);
119 #endif /* HAVE_GSSAPI */
120 static char *get_md5_password(const char *username,
121 const char *group, char passwd[33]);
122 #if HAVE_LIBPAM
123 static int pam_func(int, const struct pam_message **,
124 struct pam_response **, void *);
125 #elif !defined(HAVE_USERSEC_H)
126 static void to64(char *s, unsigned long v, int n);
127 #endif /* HAVE_LIBPAM */
128
129
130 /*
131 * Local structures...
132 */
133
134 #if HAVE_LIBPAM
135 typedef struct cupsd_authdata_s /**** Authentication data ****/
136 {
137 char username[33], /* Username string */
138 password[33]; /* Password string */
139 } cupsd_authdata_t;
140 #endif /* HAVE_LIBPAM */
141
142
143 /*
144 * Local globals...
145 */
146
147 #if defined(__hpux) && HAVE_LIBPAM
148 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
149 #endif /* __hpux && HAVE_LIBPAM */
150
151
152 /*
153 * 'cupsdAddLocation()' - Add a location for authorization.
154 */
155
156 cupsd_location_t * /* O - Pointer to new location record */
157 cupsdAddLocation(const char *location) /* I - Location path */
158 {
159 cupsd_location_t *temp; /* New location */
160
161
162 /*
163 * Make sure the locations array is created...
164 */
165
166 if (!Locations)
167 Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
168
169 if (!Locations)
170 return (NULL);
171
172 /*
173 * Try to allocate memory for the new location.
174 */
175
176 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
177 return (NULL);
178
179 /*
180 * Initialize the record and copy the name over...
181 */
182
183 if ((temp->location = strdup(location)) == NULL)
184 {
185 free(temp);
186 return (NULL);
187 }
188
189 temp->length = strlen(temp->location);
190
191 cupsArrayAdd(Locations, temp);
192
193 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
194 location);
195
196 /*
197 * Return the new record...
198 */
199
200 return (temp);
201 }
202
203
204 /*
205 * 'cupsdAddName()' - Add a name to a location...
206 */
207
208 void
209 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
210 char *name) /* I - Name to add */
211 {
212 char **temp; /* Pointer to names array */
213
214
215 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
216 loc, name);
217
218 if (loc->num_names == 0)
219 temp = malloc(sizeof(char *));
220 else
221 temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
222
223 if (temp == NULL)
224 {
225 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
226 loc->location ? loc->location : "nil", strerror(errno));
227 return;
228 }
229
230 loc->names = temp;
231
232 if ((temp[loc->num_names] = strdup(name)) == NULL)
233 {
234 cupsdLogMessage(CUPSD_LOG_ERROR,
235 "Unable to duplicate name for location %s: %s",
236 loc->location ? loc->location : "nil", strerror(errno));
237 return;
238 }
239
240 loc->num_names ++;
241 }
242
243
244 /*
245 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
246 */
247
248 void
249 cupsdAllowHost(cupsd_location_t *loc, /* I - Location to add to */
250 char *name) /* I - Name of host or domain to add */
251 {
252 cupsd_authmask_t *temp; /* New host/domain mask */
253 char ifname[32], /* Interface name */
254 *ifptr; /* Pointer to end of name */
255
256
257 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
258 loc, loc->location ? loc->location : "nil", name);
259
260 if ((temp = add_allow(loc)) == NULL)
261 return;
262
263 if (!strcasecmp(name, "@LOCAL"))
264 {
265 /*
266 * Allow *interface*...
267 */
268
269 temp->type = CUPSD_AUTH_INTERFACE;
270 temp->mask.name.name = strdup("*");
271 temp->mask.name.length = 1;
272 }
273 else if (!strncasecmp(name, "@IF(", 4))
274 {
275 /*
276 * Allow *interface*...
277 */
278
279 strlcpy(ifname, name + 4, sizeof(ifname));
280
281 ifptr = ifname + strlen(ifname);
282
283 if (ifptr[-1] == ')')
284 {
285 ifptr --;
286 *ifptr = '\0';
287 }
288
289 temp->type = CUPSD_AUTH_INTERFACE;
290 temp->mask.name.name = strdup(ifname);
291 temp->mask.name.length = ifptr - ifname;
292 }
293 else
294 {
295 /*
296 * Allow name...
297 */
298
299 temp->type = CUPSD_AUTH_NAME;
300 temp->mask.name.name = strdup(name);
301 temp->mask.name.length = strlen(name);
302 }
303 }
304
305
306 /*
307 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
308 * the location.
309 */
310
311 void
312 cupsdAllowIP(
313 cupsd_location_t *loc, /* I - Location to add to */
314 const unsigned address[4], /* I - IP address to add */
315 const unsigned netmask[4]) /* I - Netmask of address */
316 {
317 cupsd_authmask_t *temp; /* New host/domain mask */
318
319
320 cupsdLogMessage(CUPSD_LOG_DEBUG2,
321 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
322 loc, loc->location ? loc->location : "nil",
323 address[0], address[1], address[2], address[3],
324 netmask[0], netmask[1], netmask[2], netmask[3]);
325
326 if ((temp = add_allow(loc)) == NULL)
327 return;
328
329 temp->type = CUPSD_AUTH_IP;
330 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
331 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
332 }
333
334
335 /*
336 * 'cupsdAuthorize()' - Validate any authorization credentials.
337 */
338
339 void
340 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
341 {
342 int type; /* Authentication type */
343 const char *authorization; /* Pointer into Authorization string */
344 char *ptr, /* Pointer into string */
345 username[256], /* Username string */
346 password[33]; /* Password string */
347 cupsd_cert_t *localuser; /* Certificate username */
348 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
349 md5[33], /* MD5 password */
350 basicmd5[33]; /* MD5 of Basic password */
351 static const char * const states[] = /* HTTP client states... */
352 {
353 "WAITING",
354 "OPTIONS",
355 "GET",
356 "GET",
357 "HEAD",
358 "POST",
359 "POST",
360 "POST",
361 "PUT",
362 "PUT",
363 "DELETE",
364 "TRACE",
365 "CLOSE",
366 "STATUS"
367 };
368
369
370 /*
371 * Locate the best matching location so we know what kind of
372 * authentication to expect...
373 */
374
375 con->best = cupsdFindBest(con->uri, con->http.state);
376 con->type = CUPSD_AUTH_NONE;
377
378 cupsdLogMessage(CUPSD_LOG_DEBUG2,
379 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
380 con->uri, con->best, con->best ? con->best->location : "");
381
382 if (con->best && con->best->type != CUPSD_AUTH_NONE)
383 {
384 if (con->best->type == CUPSD_AUTH_DEFAULT)
385 type = DefaultAuthType;
386 else
387 type = con->best->type;
388 }
389 else
390 type = DefaultAuthType;
391
392 /*
393 * Decode the Authorization string...
394 */
395
396 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
397
398 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
399 authorization);
400
401 username[0] = '\0';
402 password[0] = '\0';
403
404 #ifdef HAVE_AUTHORIZATION_H
405 if (con->authref)
406 {
407 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
408 con->authref = NULL;
409 }
410 #endif /* HAVE_AUTHORIZATION_H */
411
412 if (!*authorization)
413 {
414 /*
415 * No authorization data provided, return early...
416 */
417
418 cupsdLogMessage(CUPSD_LOG_DEBUG,
419 "cupsdAuthorize: No authentication data provided.");
420 return;
421 }
422 #ifdef HAVE_AUTHORIZATION_H
423 else if (!strncmp(authorization, "AuthRef", 6) &&
424 !strcasecmp(con->http.hostname, "localhost"))
425 {
426 OSStatus status; /* Status */
427 int authlen; /* Auth string length */
428 AuthorizationItemSet *authinfo; /* Authorization item set */
429
430 /*
431 * Get the Authorization Services data...
432 */
433
434 authorization += 7;
435 while (isspace(*authorization & 255))
436 authorization ++;
437
438 authlen = sizeof(nonce);
439 httpDecode64_2(nonce, &authlen, authorization);
440
441 if (authlen != kAuthorizationExternalFormLength)
442 {
443 cupsdLogMessage(CUPSD_LOG_ERROR,
444 "External Authorization reference size is incorrect!");
445 return;
446 }
447
448 if ((status = AuthorizationCreateFromExternalForm(
449 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
450 {
451 cupsdLogMessage(CUPSD_LOG_ERROR,
452 "AuthorizationCreateFromExternalForm returned %d (%s)",
453 (int)status, cssmErrorString(status));
454 return;
455 }
456
457 strlcpy(username, "_AUTHREF_", sizeof(username));
458
459 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
460 &authinfo))
461 {
462 if (authinfo->count == 1 && authinfo->items[0].value &&
463 authinfo->items[0].valueLength >= 2)
464 strlcpy(username, authinfo->items[0].value, sizeof(username));
465
466 AuthorizationFreeItemSet(authinfo);
467 }
468
469 cupsdLogMessage(CUPSD_LOG_DEBUG,
470 "cupsdAuthorize: Authorized as \"%s\" using AuthRef",
471 username);
472 con->type = CUPSD_AUTH_BASIC;
473 }
474 #endif /* HAVE_AUTHORIZATION_H */
475 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
476 else if (!strncmp(authorization, "PeerCred ", 9) &&
477 con->http.hostaddr->addr.sa_family == AF_LOCAL)
478 {
479 /*
480 * Use peer credentials from domain socket connection...
481 */
482
483 struct passwd *pwd; /* Password entry for this user */
484 cupsd_ucred_t peercred; /* Peer credentials */
485 socklen_t peersize; /* Size of peer credentials */
486
487
488 if ((pwd = getpwnam(authorization + 9)) == NULL)
489 {
490 cupsdLogMessage(CUPSD_LOG_ERROR, "User \"%s\" does not exist!",
491 authorization + 9);
492 return;
493 }
494
495 peersize = sizeof(peercred);
496
497 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
498 {
499 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
500 strerror(errno));
501 return;
502 }
503
504 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
505 {
506 cupsdLogMessage(CUPSD_LOG_ERROR,
507 "Invalid peer credentials for \"%s\" - got %d, "
508 "expected %d!", authorization + 9,
509 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
510 # ifdef HAVE_SYS_UCRED_H
511 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_version=%d",
512 peercred.cr_version);
513 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_uid=%d",
514 peercred.cr_uid);
515 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_ngroups=%d",
516 peercred.cr_ngroups);
517 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_groups[0]=%d",
518 peercred.cr_groups[0]);
519 # endif /* HAVE_SYS_UCRED_H */
520 return;
521 }
522
523 strlcpy(username, authorization + 9, sizeof(username));
524
525 cupsdLogMessage(CUPSD_LOG_DEBUG,
526 "cupsdAuthorize: Authorized as %s using PeerCred",
527 username);
528
529 con->type = CUPSD_AUTH_BASIC;
530 }
531 #endif /* SO_PEERCRED && AF_LOCAL */
532 else if (!strncmp(authorization, "Local", 5) &&
533 !strcasecmp(con->http.hostname, "localhost"))
534 {
535 /*
536 * Get Local certificate authentication data...
537 */
538
539 authorization += 5;
540 while (isspace(*authorization & 255))
541 authorization ++;
542
543 if ((localuser = cupsdFindCert(authorization)) != NULL)
544 {
545 strlcpy(username, localuser->username, sizeof(username));
546
547 cupsdLogMessage(CUPSD_LOG_DEBUG,
548 "cupsdAuthorize: Authorized as %s using Local",
549 username);
550 }
551 else
552 {
553 cupsdLogMessage(CUPSD_LOG_ERROR,
554 "cupsdAuthorize: Local authentication certificate not "
555 "found!");
556 return;
557 }
558
559 #ifdef HAVE_GSSAPI
560 if (localuser->ccache)
561 con->type = CUPSD_AUTH_NEGOTIATE;
562 else
563 #endif /* HAVE_GSSAPI */
564 con->type = CUPSD_AUTH_BASIC;
565 }
566 else if (!strncmp(authorization, "Basic", 5))
567 {
568 /*
569 * Get the Basic authentication data...
570 */
571
572 int userlen; /* Username:password length */
573
574
575 authorization += 5;
576 while (isspace(*authorization & 255))
577 authorization ++;
578
579 userlen = sizeof(username);
580 httpDecode64_2(username, &userlen, authorization);
581
582 /*
583 * Pull the username and password out...
584 */
585
586 if ((ptr = strchr(username, ':')) == NULL)
587 {
588 cupsdLogMessage(CUPSD_LOG_ERROR,
589 "cupsdAuthorize: Missing Basic password!");
590 return;
591 }
592
593 *ptr++ = '\0';
594
595 if (!username[0])
596 {
597 /*
598 * Username must not be empty...
599 */
600
601 cupsdLogMessage(CUPSD_LOG_ERROR,
602 "cupsdAuthorize: Empty Basic username!");
603 return;
604 }
605
606 if (!*ptr)
607 {
608 /*
609 * Password must not be empty...
610 */
611
612 cupsdLogMessage(CUPSD_LOG_ERROR,
613 "cupsdAuthorize: Empty Basic password!");
614 return;
615 }
616
617 strlcpy(password, ptr, sizeof(password));
618
619 /*
620 * Validate the username and password...
621 */
622
623 switch (type)
624 {
625 default :
626 case CUPSD_AUTH_BASIC :
627 {
628 #if HAVE_LIBPAM
629 /*
630 * Only use PAM to do authentication. This supports MD5
631 * passwords, among other things...
632 */
633
634 pam_handle_t *pamh; /* PAM authentication handle */
635 int pamerr; /* PAM error code */
636 struct pam_conv pamdata;/* PAM conversation data */
637 cupsd_authdata_t data; /* Authentication data */
638
639
640 strlcpy(data.username, username, sizeof(data.username));
641 strlcpy(data.password, password, sizeof(data.password));
642
643 # if defined(__sun) || defined(__hpux)
644 pamdata.conv = (int (*)(int, struct pam_message **,
645 struct pam_response **,
646 void *))pam_func;
647 # else
648 pamdata.conv = pam_func;
649 # endif /* __sun || __hpux */
650 pamdata.appdata_ptr = &data;
651
652 # ifdef __hpux
653 /*
654 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
655 * more info...
656 */
657
658 auth_data = &data;
659 # endif /* __hpux */
660
661 pamerr = pam_start("cups", username, &pamdata, &pamh);
662 if (pamerr != PAM_SUCCESS)
663 {
664 cupsdLogMessage(CUPSD_LOG_ERROR,
665 "cupsdAuthorize: pam_start() returned %d (%s)!",
666 pamerr, pam_strerror(pamh, pamerr));
667 return;
668 }
669
670 # ifdef HAVE_PAM_SET_ITEM
671 # ifdef PAM_RHOST
672 pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
673 if (pamerr != PAM_SUCCESS)
674 cupsdLogMessage(CUPSD_LOG_WARN,
675 "cupsdAuthorize: pam_set_item(PAM_RHOST) "
676 "returned %d (%s)!", pamerr,
677 pam_strerror(pamh, pamerr));
678 # endif /* PAM_RHOST */
679
680 # ifdef PAM_TTY
681 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
682 if (pamerr != PAM_SUCCESS)
683 cupsdLogMessage(CUPSD_LOG_WARN,
684 "cupsdAuthorize: pam_set_item(PAM_TTY) "
685 "returned %d (%s)!", pamerr,
686 pam_strerror(pamh, pamerr));
687 # endif /* PAM_TTY */
688 # endif /* HAVE_PAM_SET_ITEM */
689
690 # ifdef HAVE_PAM_SETCRED
691 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
692 if (pamerr != PAM_SUCCESS)
693 cupsdLogMessage(CUPSD_LOG_WARN,
694 "cupsdAuthorize: pam_setcred() "
695 "returned %d (%s)!", pamerr,
696 pam_strerror(pamh, pamerr));
697 # endif /* HAVE_PAM_SETCRED */
698
699 pamerr = pam_authenticate(pamh, PAM_SILENT);
700 if (pamerr != PAM_SUCCESS)
701 {
702 cupsdLogMessage(CUPSD_LOG_ERROR,
703 "cupsdAuthorize: pam_authenticate() returned %d "
704 "(%s)!",
705 pamerr, pam_strerror(pamh, pamerr));
706 pam_end(pamh, 0);
707 return;
708 }
709
710 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
711 if (pamerr != PAM_SUCCESS)
712 {
713 cupsdLogMessage(CUPSD_LOG_ERROR,
714 "cupsdAuthorize: pam_acct_mgmt() returned %d "
715 "(%s)!",
716 pamerr, pam_strerror(pamh, pamerr));
717 pam_end(pamh, 0);
718 return;
719 }
720
721 pam_end(pamh, PAM_SUCCESS);
722
723 #elif defined(HAVE_USERSEC_H)
724 /*
725 * Use AIX authentication interface...
726 */
727
728 char *authmsg; /* Authentication message */
729 int reenter; /* ??? */
730
731
732 cupsdLogMessage(CUPSD_LOG_DEBUG,
733 "cupsdAuthorize: AIX authenticate of username "
734 "\"%s\"", username);
735
736 reenter = 1;
737 if (authenticate(username, password, &reenter, &authmsg) != 0)
738 {
739 cupsdLogMessage(CUPSD_LOG_DEBUG,
740 "cupsdAuthorize: Unable to authenticate username "
741 "\"%s\": %s",
742 username, strerror(errno));
743 return;
744 }
745
746 #else
747 /*
748 * Use normal UNIX password file-based authentication...
749 */
750
751 char *pass; /* Encrypted password */
752 struct passwd *pw; /* User password data */
753 # ifdef HAVE_SHADOW_H
754 struct spwd *spw; /* Shadow password data */
755 # endif /* HAVE_SHADOW_H */
756
757
758 pw = getpwnam(username); /* Get the current password */
759 endpwent(); /* Close the password file */
760
761 if (!pw)
762 {
763 /*
764 * No such user...
765 */
766
767 cupsdLogMessage(CUPSD_LOG_ERROR,
768 "cupsdAuthorize: Unknown username \"%s\"!",
769 username);
770 return;
771 }
772
773 # ifdef HAVE_SHADOW_H
774 spw = getspnam(username);
775 endspent();
776
777 if (!spw && !strcmp(pw->pw_passwd, "x"))
778 {
779 /*
780 * Don't allow blank passwords!
781 */
782
783 cupsdLogMessage(CUPSD_LOG_ERROR,
784 "cupsdAuthorize: Username \"%s\" has no shadow "
785 "password!", username);
786 return;
787 }
788
789 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
790 # else
791 if (!pw->pw_passwd[0])
792 # endif /* HAVE_SHADOW_H */
793 {
794 /*
795 * Don't allow blank passwords!
796 */
797
798 cupsdLogMessage(CUPSD_LOG_ERROR,
799 "cupsdAuthorize: Username \"%s\" has no password!",
800 username);
801 return;
802 }
803
804 /*
805 * OK, the password isn't blank, so compare with what came from the
806 * client...
807 */
808
809 pass = cups_crypt(password, pw->pw_passwd);
810
811 cupsdLogMessage(CUPSD_LOG_DEBUG2,
812 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
813 pw->pw_passwd, pass);
814
815 if (!pass || strcmp(pw->pw_passwd, pass))
816 {
817 # ifdef HAVE_SHADOW_H
818 if (spw)
819 {
820 pass = cups_crypt(password, spw->sp_pwdp);
821
822 cupsdLogMessage(CUPSD_LOG_DEBUG2,
823 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
824 spw->sp_pwdp, pass);
825
826 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
827 {
828 cupsdLogMessage(CUPSD_LOG_ERROR,
829 "cupsdAuthorize: Authentication failed for "
830 "user \"%s\"!",
831 username);
832 return;
833 }
834 }
835 else
836 # endif /* HAVE_SHADOW_H */
837 {
838 cupsdLogMessage(CUPSD_LOG_ERROR,
839 "cupsdAuthorize: Authentication failed for "
840 "user \"%s\"!",
841 username);
842 return;
843 }
844 }
845 #endif /* HAVE_LIBPAM */
846 }
847
848 cupsdLogMessage(CUPSD_LOG_DEBUG,
849 "cupsdAuthorize: Authorized as %s using Basic",
850 username);
851 break;
852
853 case CUPSD_AUTH_BASICDIGEST :
854 /*
855 * Do Basic authentication with the Digest password file...
856 */
857
858 if (!get_md5_password(username, NULL, md5))
859 {
860 cupsdLogMessage(CUPSD_LOG_ERROR,
861 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
862 username);
863 return;
864 }
865
866 httpMD5(username, "CUPS", password, basicmd5);
867
868 if (strcmp(md5, basicmd5))
869 {
870 cupsdLogMessage(CUPSD_LOG_ERROR,
871 "cupsdAuthorize: Authentication failed for \"%s\"!",
872 username);
873 return;
874 }
875
876 cupsdLogMessage(CUPSD_LOG_DEBUG,
877 "cupsdAuthorize: Authorized as %s using BasicDigest",
878 username);
879 break;
880 }
881
882 con->type = type;
883 }
884 else if (!strncmp(authorization, "Digest", 6))
885 {
886 /*
887 * Get the username, password, and nonce from the Digest attributes...
888 */
889
890 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
891 username, sizeof(username)) || !username[0])
892 {
893 /*
894 * Username must not be empty...
895 */
896
897 cupsdLogMessage(CUPSD_LOG_ERROR,
898 "cupsdAuthorize: Empty or missing Digest username!");
899 return;
900 }
901
902 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
903 password, sizeof(password)) || !password[0])
904 {
905 /*
906 * Password must not be empty...
907 */
908
909 cupsdLogMessage(CUPSD_LOG_ERROR,
910 "cupsdAuthorize: Empty or missing Digest password!");
911 return;
912 }
913
914 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
915 nonce))
916 {
917 cupsdLogMessage(CUPSD_LOG_ERROR,
918 "cupsdAuthorize: No nonce value for Digest "
919 "authentication!");
920 return;
921 }
922
923 if (strcmp(con->http.hostname, nonce))
924 {
925 cupsdLogMessage(CUPSD_LOG_ERROR,
926 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
927 "got \"%s\"!", con->http.hostname, nonce);
928 return;
929 }
930
931 /*
932 * Validate the username and password...
933 */
934
935 if (!get_md5_password(username, NULL, md5))
936 {
937 cupsdLogMessage(CUPSD_LOG_ERROR,
938 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
939 username);
940 return;
941 }
942
943 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
944
945 if (strcmp(md5, password))
946 {
947 cupsdLogMessage(CUPSD_LOG_ERROR,
948 "cupsdAuthorize: Authentication failed for \"%s\"!",
949 username);
950 return;
951 }
952
953 cupsdLogMessage(CUPSD_LOG_DEBUG,
954 "cupsdAuthorize: Authorized as %s using Digest",
955 username);
956
957 con->type = CUPSD_AUTH_DIGEST;
958 }
959 #ifdef HAVE_GSSAPI
960 else if (!strncmp(authorization, "Negotiate", 9))
961 {
962 int len; /* Length of authorization string */
963 gss_cred_id_t server_creds; /* Server credentials */
964 gss_ctx_id_t context; /* Authorization context */
965 OM_uint32 major_status, /* Major status code */
966 minor_status; /* Minor status code */
967 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
968 /* Input token from string */
969 output_token = GSS_C_EMPTY_BUFFER;
970 /* Output token for username */
971 gss_name_t client_name; /* Client name */
972 unsigned int ret_flags; /* Credential flags */
973
974
975 # ifdef __APPLE__
976 /*
977 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
978 * to use it...
979 */
980
981 if (gss_init_sec_context == NULL)
982 {
983 cupsdLogMessage(CUPSD_LOG_WARN,
984 "GSSAPI/Kerberos authentication failed because the "
985 "Kerberos framework is not present.");
986 return;
987 }
988 # endif /* __APPLE__ */
989
990 con->gss_output_token.length = 0;
991
992 /*
993 * Find the start of the Kerberos input token...
994 */
995
996 authorization += 9;
997 while (isspace(*authorization & 255))
998 authorization ++;
999
1000 if (!*authorization)
1001 {
1002 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1003 "cupsdAuthorize: No authentication data specified.");
1004 return;
1005 }
1006
1007 /*
1008 * Get the server credentials...
1009 */
1010
1011 if ((server_creds = get_gss_creds(GSSServiceName, con->servername)) == NULL)
1012 return;
1013
1014 /*
1015 * Decode the authorization string to get the input token...
1016 */
1017
1018 len = strlen(authorization);
1019 input_token.value = malloc(len);
1020 input_token.value = httpDecode64_2(input_token.value, &len,
1021 authorization);
1022 input_token.length = len;
1023
1024 /*
1025 * Accept the input token to get the authorization info...
1026 */
1027
1028 context = GSS_C_NO_CONTEXT;
1029 client_name = GSS_C_NO_NAME;
1030 major_status = gss_accept_sec_context(&minor_status,
1031 &context,
1032 server_creds,
1033 &input_token,
1034 GSS_C_NO_CHANNEL_BINDINGS,
1035 &client_name,
1036 NULL,
1037 &con->gss_output_token,
1038 &ret_flags,
1039 NULL,
1040 &con->gss_delegated_cred);
1041
1042 if (GSS_ERROR(major_status))
1043 {
1044 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1045 "cupsdAuthorize: Error accepting GSSAPI security "
1046 "context");
1047
1048 if (context != GSS_C_NO_CONTEXT)
1049 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1050
1051 gss_release_cred(&minor_status, &server_creds);
1052 return;
1053 }
1054
1055 /*
1056 * Release our credentials...
1057 */
1058
1059 gss_release_cred(&minor_status, &server_creds);
1060
1061 /*
1062 * Get the username associated with the client's credentials...
1063 */
1064
1065 if (!con->gss_delegated_cred)
1066 cupsdLogMessage(CUPSD_LOG_DEBUG,
1067 "cupsdAuthorize: No delegated credentials!");
1068
1069 if (major_status == GSS_S_CONTINUE_NEEDED)
1070 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1071 "cupsdAuthorize: Credentials not complete");
1072 else if (major_status == GSS_S_COMPLETE)
1073 {
1074 major_status = gss_display_name(&minor_status, client_name,
1075 &output_token, NULL);
1076
1077 if (GSS_ERROR(major_status))
1078 {
1079 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1080 "cupsdAuthorize: Error getting username");
1081 gss_release_name(&minor_status, &client_name);
1082 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1083 return;
1084 }
1085
1086 gss_release_name(&minor_status, &client_name);
1087 strlcpy(username, output_token.value, sizeof(username));
1088
1089 cupsdLogMessage(CUPSD_LOG_DEBUG,
1090 "cupsdAuthorize: Authorized as %s using Negotiate",
1091 username);
1092
1093 gss_release_buffer(&minor_status, &output_token);
1094 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1095
1096 con->gss_have_creds = 1;
1097
1098 con->type = CUPSD_AUTH_NEGOTIATE;
1099 }
1100 else
1101 gss_release_name(&minor_status, &client_name);
1102 }
1103 #endif /* HAVE_GSSAPI */
1104 else
1105 {
1106 char scheme[256]; /* Auth scheme... */
1107
1108
1109 if (sscanf(authorization, "%255s", scheme) != 1)
1110 strcpy(scheme, "UNKNOWN");
1111
1112 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\"",
1113 scheme);
1114 return;
1115 }
1116
1117 /*
1118 * If we get here, then we were able to validate the username and
1119 * password - copy the validated username and password to the client
1120 * data and return...
1121 */
1122
1123 strlcpy(con->username, username, sizeof(con->username));
1124 strlcpy(con->password, password, sizeof(con->password));
1125 }
1126
1127
1128 /*
1129 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1130 * access a location.
1131 */
1132
1133 int /* O - 1 if allowed, 0 otherwise */
1134 cupsdCheckAccess(
1135 unsigned ip[4], /* I - Client address */
1136 char *name, /* I - Client hostname */
1137 int namelen, /* I - Length of hostname */
1138 cupsd_location_t *loc) /* I - Location to check */
1139 {
1140 int allow; /* 1 if allowed, 0 otherwise */
1141
1142
1143 if (!strcasecmp(name, "localhost"))
1144 {
1145 /*
1146 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1147 */
1148
1149 return (1);
1150 }
1151 else
1152 {
1153 /*
1154 * Do authorization checks on the domain/address...
1155 */
1156
1157 switch (loc->order_type)
1158 {
1159 default :
1160 allow = 0; /* anti-compiler-warning-code */
1161 break;
1162
1163 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
1164 allow = 1;
1165
1166 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1167 allow = 0;
1168
1169 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1170 allow = 1;
1171 break;
1172
1173 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
1174 allow = 0;
1175
1176 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1177 allow = 1;
1178
1179 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1180 allow = 0;
1181 break;
1182 }
1183 }
1184
1185 return (allow);
1186 }
1187
1188
1189 /*
1190 * 'cupsdCheckAuth()' - Check authorization masks.
1191 */
1192
1193 int /* O - 1 if mask matches, 0 otherwise */
1194 cupsdCheckAuth(
1195 unsigned ip[4], /* I - Client address */
1196 char *name, /* I - Client hostname */
1197 int name_len, /* I - Length of hostname */
1198 int num_masks, /* I - Number of masks */
1199 cupsd_authmask_t *masks) /* I - Masks */
1200 {
1201 int i; /* Looping var */
1202 cupsd_netif_t *iface; /* Network interface */
1203 unsigned netip4; /* IPv4 network address */
1204 #ifdef AF_INET6
1205 unsigned netip6[4]; /* IPv6 network address */
1206 #endif /* AF_INET6 */
1207
1208 while (num_masks > 0)
1209 {
1210 switch (masks->type)
1211 {
1212 case CUPSD_AUTH_INTERFACE :
1213 /*
1214 * Check for a match with a network interface...
1215 */
1216
1217 netip4 = htonl(ip[3]);
1218
1219 #ifdef AF_INET6
1220 netip6[0] = htonl(ip[0]);
1221 netip6[1] = htonl(ip[1]);
1222 netip6[2] = htonl(ip[2]);
1223 netip6[3] = htonl(ip[3]);
1224 #endif /* AF_INET6 */
1225
1226 if (!strcmp(masks->mask.name.name, "*"))
1227 {
1228 /*
1229 * Check against all local interfaces...
1230 */
1231
1232 cupsdNetIFUpdate();
1233
1234 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1235 iface;
1236 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1237 {
1238 /*
1239 * Only check local interfaces...
1240 */
1241
1242 if (!iface->is_local)
1243 continue;
1244
1245 if (iface->address.addr.sa_family == AF_INET)
1246 {
1247 /*
1248 * Check IPv4 address...
1249 */
1250
1251 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1252 (iface->address.ipv4.sin_addr.s_addr &
1253 iface->mask.ipv4.sin_addr.s_addr))
1254 return (1);
1255 }
1256 #ifdef AF_INET6
1257 else
1258 {
1259 /*
1260 * Check IPv6 address...
1261 */
1262
1263 for (i = 0; i < 4; i ++)
1264 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1265 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1266 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1267 break;
1268
1269 if (i == 4)
1270 return (1);
1271 }
1272 #endif /* AF_INET6 */
1273 }
1274 }
1275 else
1276 {
1277 /*
1278 * Check the named interface...
1279 */
1280
1281 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1282 iface;
1283 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1284 {
1285 if (strcmp(masks->mask.name.name, iface->name))
1286 continue;
1287
1288 if (iface->address.addr.sa_family == AF_INET)
1289 {
1290 /*
1291 * Check IPv4 address...
1292 */
1293
1294 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1295 (iface->address.ipv4.sin_addr.s_addr &
1296 iface->mask.ipv4.sin_addr.s_addr))
1297 return (1);
1298 }
1299 #ifdef AF_INET6
1300 else
1301 {
1302 /*
1303 * Check IPv6 address...
1304 */
1305
1306 for (i = 0; i < 4; i ++)
1307 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1308 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1309 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1310 break;
1311
1312 if (i == 4)
1313 return (1);
1314 }
1315 #endif /* AF_INET6 */
1316 }
1317 }
1318 break;
1319
1320 case CUPSD_AUTH_NAME :
1321 /*
1322 * Check for exact name match...
1323 */
1324
1325 if (!strcasecmp(name, masks->mask.name.name))
1326 return (1);
1327
1328 /*
1329 * Check for domain match...
1330 */
1331
1332 if (name_len >= masks->mask.name.length &&
1333 masks->mask.name.name[0] == '.' &&
1334 !strcasecmp(name + name_len - masks->mask.name.length,
1335 masks->mask.name.name))
1336 return (1);
1337 break;
1338
1339 case CUPSD_AUTH_IP :
1340 /*
1341 * Check for IP/network address match...
1342 */
1343
1344 for (i = 0; i < 4; i ++)
1345 if ((ip[i] & masks->mask.ip.netmask[i]) !=
1346 masks->mask.ip.address[i])
1347 break;
1348
1349 if (i == 4)
1350 return (1);
1351 break;
1352 }
1353
1354 masks ++;
1355 num_masks --;
1356 }
1357
1358 return (0);
1359 }
1360
1361
1362 /*
1363 * 'cupsdCheckGroup()' - Check for a user's group membership.
1364 */
1365
1366 int /* O - 1 if user is a member, 0 otherwise */
1367 cupsdCheckGroup(
1368 const char *username, /* I - User name */
1369 struct passwd *user, /* I - System user info */
1370 const char *groupname) /* I - Group name */
1371 {
1372 int i; /* Looping var */
1373 struct group *group; /* System group info */
1374 char junk[33]; /* MD5 password (not used) */
1375 #ifdef HAVE_MBR_UID_TO_UUID
1376 uuid_t useruuid, /* UUID for username */
1377 groupuuid; /* UUID for groupname */
1378 int is_member; /* True if user is a member of group */
1379 #endif /* HAVE_MBR_UID_TO_UUID */
1380
1381
1382 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1383 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1384 username, user, groupname);
1385
1386 /*
1387 * Validate input...
1388 */
1389
1390 if (!username || !groupname)
1391 return (0);
1392
1393 /*
1394 * Check to see if the user is a member of the named group...
1395 */
1396
1397 group = getgrnam(groupname);
1398 endgrent();
1399
1400 if (group != NULL)
1401 {
1402 /*
1403 * Group exists, check it...
1404 */
1405
1406 for (i = 0; group->gr_mem[i]; i ++)
1407 if (!strcasecmp(username, group->gr_mem[i]))
1408 return (1);
1409 }
1410
1411 /*
1412 * Group doesn't exist or user not in group list, check the group ID
1413 * against the user's group ID...
1414 */
1415
1416 if (user && group && group->gr_gid == user->pw_gid)
1417 return (1);
1418
1419 #ifdef HAVE_MBR_UID_TO_UUID
1420 /*
1421 * Check group membership through MacOS X membership API...
1422 */
1423
1424 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1425 {
1426 if (group)
1427 {
1428 /*
1429 * Map group name to UUID and check membership...
1430 */
1431
1432 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1433 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1434 if (is_member)
1435 return (1);
1436 }
1437 else if (groupname[0] == '#')
1438 {
1439 /*
1440 * Use UUID directly and check for equality (user UUID) and
1441 * membership (group UUID)...
1442 */
1443
1444 if (!uuid_parse((char *)groupname + 1, groupuuid))
1445 {
1446 if (!uuid_compare(useruuid, groupuuid))
1447 return (1);
1448 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1449 if (is_member)
1450 return (1);
1451 }
1452
1453 return (0);
1454 }
1455 }
1456 else if (groupname[0] == '#')
1457 return (0);
1458 #endif /* HAVE_MBR_UID_TO_UUID */
1459
1460 /*
1461 * Username not found, group not found, or user is not part of the
1462 * system group... Check for a user and group in the MD5 password
1463 * file...
1464 */
1465
1466 if (get_md5_password(username, groupname, junk) != NULL)
1467 return (1);
1468
1469 /*
1470 * If we get this far, then the user isn't part of the named group...
1471 */
1472
1473 return (0);
1474 }
1475
1476
1477 /*
1478 * 'cupsdCopyLocation()' - Make a copy of a location...
1479 */
1480
1481 cupsd_location_t * /* O - New location */
1482 cupsdCopyLocation(
1483 cupsd_location_t **loc) /* IO - Original location */
1484 {
1485 int i; /* Looping var */
1486 cupsd_location_t *temp; /* New location */
1487 char location[HTTP_MAX_URI];
1488 /* Location of resource */
1489
1490
1491 /*
1492 * Use a local copy of location because cupsdAddLocation may cause
1493 * this memory to be moved...
1494 */
1495
1496 strlcpy(location, (*loc)->location, sizeof(location));
1497
1498 if ((temp = cupsdAddLocation(location)) == NULL)
1499 return (NULL);
1500
1501 /*
1502 * Copy the information from the original location to the new one.
1503 */
1504
1505 temp->limit = (*loc)->limit;
1506 temp->order_type = (*loc)->order_type;
1507 temp->type = (*loc)->type;
1508 temp->level = (*loc)->level;
1509 temp->satisfy = (*loc)->satisfy;
1510 temp->encryption = (*loc)->encryption;
1511
1512 if ((temp->num_names = (*loc)->num_names) > 0)
1513 {
1514 /*
1515 * Copy the names array...
1516 */
1517
1518 if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1519 {
1520 cupsdLogMessage(CUPSD_LOG_ERROR,
1521 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1522 temp->num_names, strerror(errno));
1523
1524 cupsdDeleteLocation(temp);
1525 return (NULL);
1526 }
1527
1528 for (i = 0; i < temp->num_names; i ++)
1529 if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1530 {
1531 cupsdLogMessage(CUPSD_LOG_ERROR,
1532 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1533 (*loc)->names[i], strerror(errno));
1534
1535 cupsdDeleteLocation(temp);
1536 return (NULL);
1537 }
1538 }
1539
1540 if ((temp->num_allow = (*loc)->num_allow) > 0)
1541 {
1542 /*
1543 * Copy allow rules...
1544 */
1545
1546 if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1547 {
1548 cupsdLogMessage(CUPSD_LOG_ERROR,
1549 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1550 temp->num_allow, strerror(errno));
1551 cupsdDeleteLocation(temp);
1552 return (NULL);
1553 }
1554
1555 for (i = 0; i < temp->num_allow; i ++)
1556 switch (temp->allow[i].type = (*loc)->allow[i].type)
1557 {
1558 case CUPSD_AUTH_NAME :
1559 temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1560 temp->allow[i].mask.name.name = strdup((*loc)->allow[i].mask.name.name);
1561
1562 if (temp->allow[i].mask.name.name == NULL)
1563 {
1564 cupsdLogMessage(CUPSD_LOG_ERROR,
1565 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1566 (*loc)->allow[i].mask.name.name, strerror(errno));
1567 cupsdDeleteLocation(temp);
1568 return (NULL);
1569 }
1570 break;
1571 case CUPSD_AUTH_IP :
1572 memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1573 sizeof(cupsd_ipmask_t));
1574 break;
1575 }
1576 }
1577
1578 if ((temp->num_deny = (*loc)->num_deny) > 0)
1579 {
1580 /*
1581 * Copy deny rules...
1582 */
1583
1584 if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1585 {
1586 cupsdLogMessage(CUPSD_LOG_ERROR,
1587 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1588 temp->num_deny, strerror(errno));
1589 cupsdDeleteLocation(temp);
1590 return (NULL);
1591 }
1592
1593 for (i = 0; i < temp->num_deny; i ++)
1594 switch (temp->deny[i].type = (*loc)->deny[i].type)
1595 {
1596 case CUPSD_AUTH_NAME :
1597 temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1598 temp->deny[i].mask.name.name = strdup((*loc)->deny[i].mask.name.name);
1599
1600 if (temp->deny[i].mask.name.name == NULL)
1601 {
1602 cupsdLogMessage(CUPSD_LOG_ERROR,
1603 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1604 (*loc)->deny[i].mask.name.name, strerror(errno));
1605 cupsdDeleteLocation(temp);
1606 return (NULL);
1607 }
1608 break;
1609 case CUPSD_AUTH_IP :
1610 memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1611 sizeof(cupsd_ipmask_t));
1612 break;
1613 }
1614 }
1615
1616 return (temp);
1617 }
1618
1619
1620 /*
1621 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1622 */
1623
1624 void
1625 cupsdDeleteAllLocations(void)
1626 {
1627 cupsd_location_t *loc; /* Current location */
1628
1629
1630 /*
1631 * Free all of the allow/deny records first...
1632 */
1633
1634 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1635 loc;
1636 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1637 cupsdDeleteLocation(loc);
1638
1639 /*
1640 * Then free the location array...
1641 */
1642
1643 cupsArrayDelete(Locations);
1644 Locations = NULL;
1645 }
1646
1647
1648 /*
1649 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1650 */
1651
1652 void
1653 cupsdDeleteLocation(
1654 cupsd_location_t *loc) /* I - Location to delete */
1655 {
1656 int i; /* Looping var */
1657 cupsd_authmask_t *mask; /* Current mask */
1658
1659
1660 cupsArrayRemove(Locations, loc);
1661
1662 for (i = loc->num_names - 1; i >= 0; i --)
1663 free(loc->names[i]);
1664
1665 if (loc->num_names > 0)
1666 free(loc->names);
1667
1668 for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1669 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
1670 free(mask->mask.name.name);
1671
1672 if (loc->num_allow > 0)
1673 free(loc->allow);
1674
1675 for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1676 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
1677 free(mask->mask.name.name);
1678
1679 if (loc->num_deny > 0)
1680 free(loc->deny);
1681
1682 free(loc->location);
1683 free(loc);
1684 }
1685
1686
1687 /*
1688 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1689 * location.
1690 */
1691
1692 void
1693 cupsdDenyHost(cupsd_location_t *loc, /* I - Location to add to */
1694 char *name) /* I - Name of host or domain to add */
1695 {
1696 cupsd_authmask_t *temp; /* New host/domain mask */
1697 char ifname[32], /* Interface name */
1698 *ifptr; /* Pointer to end of name */
1699
1700
1701 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1702 loc, loc->location ? loc->location : "nil", name);
1703
1704 if ((temp = add_deny(loc)) == NULL)
1705 return;
1706
1707 if (!strcasecmp(name, "@LOCAL"))
1708 {
1709 /*
1710 * Deny *interface*...
1711 */
1712
1713 temp->type = CUPSD_AUTH_INTERFACE;
1714 temp->mask.name.name = strdup("*");
1715 temp->mask.name.length = 1;
1716 }
1717 else if (!strncasecmp(name, "@IF(", 4))
1718 {
1719 /*
1720 * Deny *interface*...
1721 */
1722
1723 strlcpy(ifname, name + 4, sizeof(ifname));
1724
1725 ifptr = ifname + strlen(ifname);
1726
1727 if (ifptr[-1] == ')')
1728 {
1729 ifptr --;
1730 *ifptr = '\0';
1731 }
1732
1733 temp->type = CUPSD_AUTH_INTERFACE;
1734 temp->mask.name.name = strdup(ifname);
1735 temp->mask.name.length = ifptr - ifname;
1736 }
1737 else
1738 {
1739 /*
1740 * Deny name...
1741 */
1742
1743 temp->type = CUPSD_AUTH_NAME;
1744 temp->mask.name.name = strdup(name);
1745 temp->mask.name.length = strlen(name);
1746 }
1747 }
1748
1749
1750 /*
1751 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1752 * access the location.
1753 */
1754
1755 void
1756 cupsdDenyIP(cupsd_location_t *loc, /* I - Location to add to */
1757 const unsigned address[4],/* I - IP address to add */
1758 const unsigned netmask[4])/* I - Netmask of address */
1759 {
1760 cupsd_authmask_t *temp; /* New host/domain mask */
1761
1762
1763 cupsdLogMessage(CUPSD_LOG_DEBUG,
1764 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1765 loc, loc->location ? loc->location : "nil",
1766 address[0], address[1], address[2], address[3],
1767 netmask[0], netmask[1], netmask[2], netmask[3]);
1768
1769 if ((temp = add_deny(loc)) == NULL)
1770 return;
1771
1772 temp->type = CUPSD_AUTH_IP;
1773 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1774 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1775 }
1776
1777
1778 /*
1779 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1780 */
1781
1782 cupsd_location_t * /* O - Location that matches */
1783 cupsdFindBest(const char *path, /* I - Resource path */
1784 http_state_t state) /* I - HTTP state/request */
1785 {
1786 char uri[HTTP_MAX_URI],
1787 /* URI in request... */
1788 *uriptr; /* Pointer into URI */
1789 cupsd_location_t *loc, /* Current location */
1790 *best; /* Best match for location so far */
1791 int bestlen; /* Length of best match */
1792 int limit; /* Limit field */
1793 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1794 {
1795 CUPSD_AUTH_LIMIT_ALL,
1796 CUPSD_AUTH_LIMIT_OPTIONS,
1797 CUPSD_AUTH_LIMIT_GET,
1798 CUPSD_AUTH_LIMIT_GET,
1799 CUPSD_AUTH_LIMIT_HEAD,
1800 CUPSD_AUTH_LIMIT_POST,
1801 CUPSD_AUTH_LIMIT_POST,
1802 CUPSD_AUTH_LIMIT_POST,
1803 CUPSD_AUTH_LIMIT_PUT,
1804 CUPSD_AUTH_LIMIT_PUT,
1805 CUPSD_AUTH_LIMIT_DELETE,
1806 CUPSD_AUTH_LIMIT_TRACE,
1807 CUPSD_AUTH_LIMIT_ALL,
1808 CUPSD_AUTH_LIMIT_ALL
1809 };
1810
1811
1812 /*
1813 * First copy the connection URI to a local string so we have drop
1814 * any .ppd extension from the pathname in /printers or /classes
1815 * URIs...
1816 */
1817
1818 strlcpy(uri, path, sizeof(uri));
1819
1820 if (!strncmp(uri, "/printers/", 10) ||
1821 !strncmp(uri, "/classes/", 9))
1822 {
1823 /*
1824 * Check if the URI has .ppd on the end...
1825 */
1826
1827 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1828
1829 if (!strcmp(uriptr, ".ppd"))
1830 *uriptr = '\0';
1831 }
1832
1833 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1834
1835 /*
1836 * Loop through the list of locations to find a match...
1837 */
1838
1839 limit = limits[state];
1840 best = NULL;
1841 bestlen = 0;
1842
1843 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1844 loc;
1845 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1846 {
1847 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1848 loc->location ? loc->location : "nil", loc->limit);
1849
1850 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1851 {
1852 /*
1853 * Use case-insensitive comparison for queue names...
1854 */
1855
1856 if (loc->length > bestlen && loc->location &&
1857 !strncasecmp(uri, loc->location, loc->length) &&
1858 loc->location[0] == '/' &&
1859 (limit & loc->limit) != 0)
1860 {
1861 best = loc;
1862 bestlen = loc->length;
1863 }
1864 }
1865 else
1866 {
1867 /*
1868 * Use case-sensitive comparison for other URIs...
1869 */
1870
1871 if (loc->length > bestlen && loc->location &&
1872 !strncmp(uri, loc->location, loc->length) &&
1873 loc->location[0] == '/' &&
1874 (limit & loc->limit) != 0)
1875 {
1876 best = loc;
1877 bestlen = loc->length;
1878 }
1879 }
1880 }
1881
1882 /*
1883 * Return the match, if any...
1884 */
1885
1886 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1887 best ? best->location : "NONE");
1888
1889 return (best);
1890 }
1891
1892
1893 /*
1894 * 'cupsdFindLocation()' - Find the named location.
1895 */
1896
1897 cupsd_location_t * /* O - Location that matches */
1898 cupsdFindLocation(const char *location) /* I - Connection */
1899 {
1900 cupsd_location_t key; /* Search key */
1901
1902
1903 key.location = (char *)location;
1904
1905 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1906 }
1907
1908
1909 /*
1910 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1911 */
1912
1913 http_status_t /* O - HTTP_OK if authorized or error code */
1914 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1915 const char *owner)/* I - Owner of object */
1916 {
1917 int i, j, /* Looping vars */
1918 auth, /* Authorization status */
1919 type; /* Type of authentication */
1920 unsigned address[4]; /* Authorization address */
1921 cupsd_location_t *best; /* Best match for location so far */
1922 int hostlen; /* Length of hostname */
1923 char username[256], /* Username to authorize */
1924 ownername[256], /* Owner name to authorize */
1925 *ptr; /* Pointer into username */
1926 struct passwd *pw; /* User password data */
1927 static const char * const levels[] = /* Auth levels */
1928 {
1929 "ANON",
1930 "USER",
1931 "GROUP"
1932 };
1933 static const char * const types[] = /* Auth types */
1934 {
1935 "None",
1936 "Basic",
1937 "Digest",
1938 "BasicDigest",
1939 "Negotiate"
1940 };
1941
1942
1943 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1944 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1945 con->uri, con->best, con->best ? con->best->location ?
1946 con->best->location : "(null)" : "");
1947 if (owner)
1948 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1949 "cupsdIsAuthorized: owner=\"%s\"", owner);
1950
1951 /*
1952 * If there is no "best" authentication rule for this request, then
1953 * access is allowed from the local system and denied from other
1954 * addresses...
1955 */
1956
1957 if (!con->best)
1958 {
1959 if (!strcmp(con->http.hostname, "localhost") ||
1960 !strcmp(con->http.hostname, ServerName))
1961 return (HTTP_OK);
1962 else
1963 return (HTTP_FORBIDDEN);
1964 }
1965
1966 best = con->best;
1967
1968 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1969 type = DefaultAuthType;
1970
1971 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1972 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
1973 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
1974 levels[best->level], types[type],
1975 best->satisfy ? "ANY" : "ALL", best->num_names);
1976
1977 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1978 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1979 best->op, ippOpString(best->op));
1980
1981 /*
1982 * Check host/ip-based accesses...
1983 */
1984
1985 #ifdef AF_INET6
1986 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1987 {
1988 /*
1989 * Copy IPv6 address...
1990 */
1991
1992 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1993 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1994 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1995 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1996 }
1997 else
1998 #endif /* AF_INET6 */
1999 if (con->http.hostaddr->addr.sa_family == AF_INET)
2000 {
2001 /*
2002 * Copy IPv4 address...
2003 */
2004
2005 address[0] = 0;
2006 address[1] = 0;
2007 address[2] = 0;
2008 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
2009 }
2010 else
2011 memset(address, 0, sizeof(address));
2012
2013 hostlen = strlen(con->http.hostname);
2014
2015 auth = cupsdCheckAccess(address, con->http.hostname, hostlen, best)
2016 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
2017
2018 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
2019 auth ? "DENY" : "ALLOW");
2020
2021 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
2022 return (HTTP_FORBIDDEN);
2023
2024 #ifdef HAVE_SSL
2025 /*
2026 * See if encryption is required...
2027 */
2028
2029 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
2030 strcasecmp(con->http.hostname, "localhost") &&
2031 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
2032 !(type == CUPSD_AUTH_NEGOTIATE ||
2033 (type == CUPSD_AUTH_NONE && DefaultAuthType == CUPSD_AUTH_NEGOTIATE)))
2034 {
2035 cupsdLogMessage(CUPSD_LOG_DEBUG,
2036 "cupsdIsAuthorized: Need upgrade to TLS...");
2037 return (HTTP_UPGRADE_REQUIRED);
2038 }
2039 #endif /* HAVE_SSL */
2040
2041 /*
2042 * Now see what access level is required...
2043 */
2044
2045 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
2046 (type == CUPSD_AUTH_NONE && best->num_names == 0))
2047 return (HTTP_OK);
2048
2049 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
2050 best->limit == CUPSD_AUTH_LIMIT_IPP)
2051 {
2052 /*
2053 * Check for unauthenticated username...
2054 */
2055
2056 ipp_attribute_t *attr; /* requesting-user-name attribute */
2057
2058
2059 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
2060 if (attr)
2061 {
2062 cupsdLogMessage(CUPSD_LOG_DEBUG,
2063 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
2064 attr->values[0].string.text);
2065 strlcpy(username, attr->values[0].string.text, sizeof(username));
2066 }
2067 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2068 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2069 else
2070 return (HTTP_OK); /* unless overridden with Satisfy */
2071 }
2072 else
2073 {
2074 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
2075 con->username);
2076
2077 #ifdef HAVE_AUTHORIZATION_H
2078 if (!con->username[0] && !con->authref)
2079 #else
2080 if (!con->username[0])
2081 #endif /* HAVE_AUTHORIZATION_H */
2082 {
2083 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2084 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2085 else
2086 return (HTTP_OK); /* unless overridden with Satisfy */
2087 }
2088
2089 if (con->type != type && type != CUPSD_AUTH_NONE &&
2090 (con->type != CUPSD_AUTH_BASIC || type != CUPSD_AUTH_BASICDIGEST))
2091 {
2092 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
2093 types[con->type], types[type]);
2094
2095 return (HTTP_UNAUTHORIZED);
2096 }
2097
2098 strlcpy(username, con->username, sizeof(username));
2099 }
2100
2101 /*
2102 * OK, got a username. See if we need normal user access, or group
2103 * access... (root always matches)
2104 */
2105
2106 if (!strcmp(username, "root"))
2107 return (HTTP_OK);
2108
2109 /*
2110 * Strip any @domain or @KDC from the username and owner...
2111 */
2112
2113 if ((ptr = strchr(username, '@')) != NULL)
2114 *ptr = '\0';
2115
2116 if (owner)
2117 {
2118 strlcpy(ownername, owner, sizeof(ownername));
2119
2120 if ((ptr = strchr(ownername, '@')) != NULL)
2121 *ptr = '\0';
2122 }
2123 else
2124 ownername[0] = '\0';
2125
2126 /*
2127 * Get the user info...
2128 */
2129
2130 if (username[0])
2131 {
2132 pw = getpwnam(username);
2133 endpwent();
2134 }
2135 else
2136 pw = NULL;
2137
2138 if (best->level == CUPSD_AUTH_USER)
2139 {
2140 /*
2141 * If there are no names associated with this location, then
2142 * any valid user is OK...
2143 */
2144
2145 if (best->num_names == 0)
2146 return (HTTP_OK);
2147
2148 /*
2149 * Otherwise check the user list and return OK if this user is
2150 * allowed...
2151 */
2152
2153 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2154 "cupsdIsAuthorized: Checking user membership...");
2155
2156 #ifdef HAVE_AUTHORIZATION_H
2157 /*
2158 * If an authorization reference was supplied it must match a right name...
2159 */
2160
2161 if (con->authref)
2162 {
2163 for (i = 0; i < best->num_names; i ++)
2164 {
2165 if (!strncasecmp(best->names[i], "@AUTHKEY(", 9) &&
2166 check_authref(con, best->names[i] + 9))
2167 return (HTTP_OK);
2168 else if (!strcasecmp(best->names[i], "@SYSTEM") &&
2169 SystemGroupAuthKey &&
2170 check_authref(con, SystemGroupAuthKey))
2171 return (HTTP_OK);
2172 }
2173
2174 return (HTTP_FORBIDDEN);
2175 }
2176 #endif /* HAVE_AUTHORIZATION_H */
2177
2178 for (i = 0; i < best->num_names; i ++)
2179 {
2180 if (!strcasecmp(best->names[i], "@OWNER") && owner &&
2181 !strcasecmp(username, ownername))
2182 return (HTTP_OK);
2183 else if (!strcasecmp(best->names[i], "@SYSTEM"))
2184 {
2185 for (j = 0; j < NumSystemGroups; j ++)
2186 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2187 return (HTTP_OK);
2188 }
2189 else if (best->names[i][0] == '@')
2190 {
2191 if (cupsdCheckGroup(username, pw, best->names[i] + 1))
2192 return (HTTP_OK);
2193 }
2194 else if (!strcasecmp(username, best->names[i]))
2195 return (HTTP_OK);
2196 }
2197
2198 return (HTTP_FORBIDDEN);
2199 }
2200
2201 /*
2202 * Check to see if this user is in any of the named groups...
2203 */
2204
2205 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2206 "cupsdIsAuthorized: Checking group membership...");
2207
2208 /*
2209 * Check to see if this user is in any of the named groups...
2210 */
2211
2212 for (i = 0; i < best->num_names; i ++)
2213 {
2214 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2215 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2216 best->names[i]);
2217
2218 if (!strcasecmp(best->names[i], "@SYSTEM"))
2219 {
2220 for (j = 0; j < NumSystemGroups; j ++)
2221 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2222 return (HTTP_OK);
2223 }
2224 else if (cupsdCheckGroup(username, pw, best->names[i]))
2225 return (HTTP_OK);
2226 }
2227
2228 /*
2229 * The user isn't part of the specified group, so deny access...
2230 */
2231
2232 cupsdLogMessage(CUPSD_LOG_DEBUG,
2233 "cupsdIsAuthorized: User not in group(s)!");
2234
2235 return (HTTP_FORBIDDEN);
2236 }
2237
2238
2239 /*
2240 * 'add_allow()' - Add an allow mask to the location.
2241 */
2242
2243 static cupsd_authmask_t * /* O - New mask record */
2244 add_allow(cupsd_location_t *loc) /* I - Location to add to */
2245 {
2246 cupsd_authmask_t *temp; /* New mask record */
2247
2248
2249 /*
2250 * Range-check...
2251 */
2252
2253 if (loc == NULL)
2254 return (NULL);
2255
2256 /*
2257 * Try to allocate memory for the record...
2258 */
2259
2260 if (loc->num_allow == 0)
2261 temp = malloc(sizeof(cupsd_authmask_t));
2262 else
2263 temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
2264
2265 if (temp == NULL)
2266 return (NULL);
2267
2268 loc->allow = temp;
2269 temp += loc->num_allow;
2270 loc->num_allow ++;
2271
2272 /*
2273 * Clear the mask record and return...
2274 */
2275
2276 memset(temp, 0, sizeof(cupsd_authmask_t));
2277 return (temp);
2278 }
2279
2280
2281 /*
2282 * 'add_deny()' - Add a deny mask to the location.
2283 */
2284
2285 static cupsd_authmask_t * /* O - New mask record */
2286 add_deny(cupsd_location_t *loc) /* I - Location to add to */
2287 {
2288 cupsd_authmask_t *temp; /* New mask record */
2289
2290
2291 /*
2292 * Range-check...
2293 */
2294
2295 if (loc == NULL)
2296 return (NULL);
2297
2298 /*
2299 * Try to allocate memory for the record...
2300 */
2301
2302 if (loc->num_deny == 0)
2303 temp = malloc(sizeof(cupsd_authmask_t));
2304 else
2305 temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
2306
2307 if (temp == NULL)
2308 return (NULL);
2309
2310 loc->deny = temp;
2311 temp += loc->num_deny;
2312 loc->num_deny ++;
2313
2314 /*
2315 * Clear the mask record and return...
2316 */
2317
2318 memset(temp, 0, sizeof(cupsd_authmask_t));
2319 return (temp);
2320 }
2321
2322
2323 #ifdef HAVE_AUTHORIZATION_H
2324 /*
2325 * 'check_authref()' - Check if an authorization services reference has the
2326 * supplied right.
2327 */
2328
2329 static int /* O - 1 if right is valid, 0 otherwise */
2330 check_authref(cupsd_client_t *con, /* I - Connection */
2331 const char *right) /* I - Right name */
2332 {
2333 OSStatus status; /* OS Status */
2334 AuthorizationItem authright; /* Authorization right */
2335 AuthorizationRights authrights; /* Authorization rights */
2336 AuthorizationFlags authflags; /* Authorization flags */
2337
2338
2339 /*
2340 * Check to see if the user is allowed to perform the task...
2341 */
2342
2343 if (!con->authref)
2344 return (0);
2345
2346 authright.name = right;
2347 authright.valueLength = 0;
2348 authright.value = NULL;
2349 authright.flags = 0;
2350
2351 authrights.count = 1;
2352 authrights.items = &authright;
2353
2354 authflags = kAuthorizationFlagDefaults |
2355 kAuthorizationFlagExtendRights;
2356
2357 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2358 kAuthorizationEmptyEnvironment,
2359 authflags, NULL)) != 0)
2360 {
2361 cupsdLogMessage(CUPSD_LOG_ERROR,
2362 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2363 authright.name, (int)status, cssmErrorString(status));
2364 return (0);
2365 }
2366
2367 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2368 "AuthorizationCopyRights(\"%s\") succeeded!",
2369 authright.name);
2370
2371 return (1);
2372 }
2373 #endif /* HAVE_AUTHORIZATION_H */
2374
2375
2376 /*
2377 * 'compare_locations()' - Compare two locations.
2378 */
2379
2380 static int /* O - Result of comparison */
2381 compare_locations(cupsd_location_t *a, /* I - First location */
2382 cupsd_location_t *b) /* I - Second location */
2383 {
2384 return (strcmp(b->location, a->location));
2385 }
2386
2387
2388 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2389 /*
2390 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2391 * as needed.
2392 */
2393
2394 static char * /* O - Encrypted password */
2395 cups_crypt(const char *pw, /* I - Password string */
2396 const char *salt) /* I - Salt (key) string */
2397 {
2398 if (!strncmp(salt, "$1$", 3))
2399 {
2400 /*
2401 * Use MD5 passwords without the benefit of PAM; this is for
2402 * Slackware Linux, and the algorithm was taken from the
2403 * old shadow-19990827/lib/md5crypt.c source code... :(
2404 */
2405
2406 int i; /* Looping var */
2407 unsigned long n; /* Output number */
2408 int pwlen; /* Length of password string */
2409 const char *salt_end; /* End of "salt" data for MD5 */
2410 char *ptr; /* Pointer into result string */
2411 _cups_md5_state_t state; /* Primary MD5 state info */
2412 _cups_md5_state_t state2; /* Secondary MD5 state info */
2413 unsigned char digest[16]; /* MD5 digest result */
2414 static char result[120]; /* Final password string */
2415
2416
2417 /*
2418 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2419 * Get a maximum of 8 characters of salt data after $1$...
2420 */
2421
2422 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2423 if (*salt_end == '$')
2424 break;
2425
2426 /*
2427 * Compute the MD5 sum we need...
2428 */
2429
2430 pwlen = strlen(pw);
2431
2432 _cupsMD5Init(&state);
2433 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2434 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2435
2436 _cupsMD5Init(&state2);
2437 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2438 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2439 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2440 _cupsMD5Finish(&state2, digest);
2441
2442 for (i = pwlen; i > 0; i -= 16)
2443 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2444
2445 for (i = pwlen; i > 0; i >>= 1)
2446 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2447
2448 _cupsMD5Finish(&state, digest);
2449
2450 for (i = 0; i < 1000; i ++)
2451 {
2452 _cupsMD5Init(&state);
2453
2454 if (i & 1)
2455 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2456 else
2457 _cupsMD5Append(&state, digest, 16);
2458
2459 if (i % 3)
2460 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2461
2462 if (i % 7)
2463 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2464
2465 if (i & 1)
2466 _cupsMD5Append(&state, digest, 16);
2467 else
2468 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2469
2470 _cupsMD5Finish(&state, digest);
2471 }
2472
2473 /*
2474 * Copy the final sum to the result string and return...
2475 */
2476
2477 memcpy(result, salt, salt_end - salt);
2478 ptr = result + (salt_end - salt);
2479 *ptr++ = '$';
2480
2481 for (i = 0; i < 5; i ++, ptr += 4)
2482 {
2483 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2484
2485 if (i < 4)
2486 n |= digest[i + 12];
2487 else
2488 n |= digest[5];
2489
2490 to64(ptr, n, 4);
2491 }
2492
2493 to64(ptr, digest[11], 2);
2494 ptr += 2;
2495 *ptr = '\0';
2496
2497 return (result);
2498 }
2499 else
2500 {
2501 /*
2502 * Use the standard crypt() function...
2503 */
2504
2505 return (crypt(pw, salt));
2506 }
2507 }
2508 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2509
2510
2511 #ifdef HAVE_GSSAPI
2512 /*
2513 * 'get_gss_creds()' - Obtain GSS credentials.
2514 */
2515
2516 static gss_cred_id_t /* O - Server credentials */
2517 get_gss_creds(
2518 const char *service_name, /* I - Service name */
2519 const char *con_server_name) /* I - Hostname of server */
2520 {
2521 OM_uint32 major_status, /* Major status code */
2522 minor_status; /* Minor status code */
2523 gss_name_t server_name; /* Server name */
2524 gss_cred_id_t server_creds; /* Server credentials */
2525 gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
2526 /* Service name token */
2527 char buf[1024]; /* Service name buffer */
2528
2529
2530 snprintf(buf, sizeof(buf), "%s@%s", service_name, con_server_name);
2531
2532 token.value = buf;
2533 token.length = strlen(buf);
2534 server_name = GSS_C_NO_NAME;
2535 major_status = gss_import_name(&minor_status, &token,
2536 GSS_C_NT_HOSTBASED_SERVICE,
2537 &server_name);
2538
2539 memset(&token, 0, sizeof(token));
2540
2541 if (GSS_ERROR(major_status))
2542 {
2543 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2544 "gss_import_name() failed");
2545 return (NULL);
2546 }
2547
2548 major_status = gss_display_name(&minor_status, server_name, &token, NULL);
2549
2550 if (GSS_ERROR(major_status))
2551 {
2552 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2553 "gss_display_name() failed");
2554 return (NULL);
2555 }
2556
2557 cupsdLogMessage(CUPSD_LOG_DEBUG,
2558 "get_gss_creds: Attempting to acquire credentials for %s...",
2559 (char *)token.value);
2560
2561 server_creds = GSS_C_NO_CREDENTIAL;
2562 major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
2563 GSS_C_NO_OID_SET, GSS_C_ACCEPT,
2564 &server_creds, NULL, NULL);
2565 if (GSS_ERROR(major_status))
2566 {
2567 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2568 "gss_acquire_cred() failed");
2569 gss_release_name(&minor_status, &server_name);
2570 gss_release_buffer(&minor_status, &token);
2571 return (NULL);
2572 }
2573
2574 cupsdLogMessage(CUPSD_LOG_DEBUG,
2575 "get_gss_creds: Credentials acquired successfully for %s.",
2576 (char *)token.value);
2577
2578 gss_release_name(&minor_status, &server_name);
2579 gss_release_buffer(&minor_status, &token);
2580
2581 return (server_creds);
2582 }
2583 #endif /* HAVE_GSSAPI */
2584
2585
2586 /*
2587 * 'get_md5_password()' - Get an MD5 password.
2588 */
2589
2590 static char * /* O - MD5 password string */
2591 get_md5_password(const char *username, /* I - Username */
2592 const char *group, /* I - Group */
2593 char passwd[33]) /* O - MD5 password string */
2594 {
2595 cups_file_t *fp; /* passwd.md5 file */
2596 char filename[1024], /* passwd.md5 filename */
2597 line[256], /* Line from file */
2598 tempuser[33], /* User from file */
2599 tempgroup[33]; /* Group from file */
2600
2601
2602 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2603 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2604 username, group ? group : "(null)", passwd);
2605
2606 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2607 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2608 {
2609 if (errno != ENOENT)
2610 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2611 strerror(errno));
2612
2613 return (NULL);
2614 }
2615
2616 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2617 {
2618 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2619 {
2620 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2621 continue;
2622 }
2623
2624 if (!strcmp(username, tempuser) &&
2625 (group == NULL || !strcmp(group, tempgroup)))
2626 {
2627 /*
2628 * Found the password entry!
2629 */
2630
2631 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2632 username, tempgroup);
2633
2634 cupsFileClose(fp);
2635 return (passwd);
2636 }
2637 }
2638
2639 /*
2640 * Didn't find a password entry - return NULL!
2641 */
2642
2643 cupsFileClose(fp);
2644 return (NULL);
2645 }
2646
2647
2648 #if HAVE_LIBPAM
2649 /*
2650 * 'pam_func()' - PAM conversation function.
2651 */
2652
2653 static int /* O - Success or failure */
2654 pam_func(
2655 int num_msg, /* I - Number of messages */
2656 const struct pam_message **msg, /* I - Messages */
2657 struct pam_response **resp, /* O - Responses */
2658 void *appdata_ptr)
2659 /* I - Pointer to connection */
2660 {
2661 int i; /* Looping var */
2662 struct pam_response *replies; /* Replies */
2663 cupsd_authdata_t *data; /* Pointer to auth data */
2664
2665
2666 /*
2667 * Allocate memory for the responses...
2668 */
2669
2670 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2671 return (PAM_CONV_ERR);
2672
2673 /*
2674 * Answer all of the messages...
2675 */
2676
2677 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2678
2679 #ifdef __hpux
2680 /*
2681 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2682 * module. This is a workaround...
2683 */
2684
2685 data = auth_data;
2686 (void)appdata_ptr;
2687 #else
2688 data = (cupsd_authdata_t *)appdata_ptr;
2689 #endif /* __hpux */
2690
2691 for (i = 0; i < num_msg; i ++)
2692 {
2693 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2694
2695 switch (msg[i]->msg_style)
2696 {
2697 case PAM_PROMPT_ECHO_ON:
2698 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2699 data->username));
2700 replies[i].resp_retcode = PAM_SUCCESS;
2701 replies[i].resp = strdup(data->username);
2702 break;
2703
2704 case PAM_PROMPT_ECHO_OFF:
2705 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2706 data->password));
2707 replies[i].resp_retcode = PAM_SUCCESS;
2708 replies[i].resp = strdup(data->password);
2709 break;
2710
2711 case PAM_TEXT_INFO:
2712 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2713 replies[i].resp_retcode = PAM_SUCCESS;
2714 replies[i].resp = NULL;
2715 break;
2716
2717 case PAM_ERROR_MSG:
2718 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2719 replies[i].resp_retcode = PAM_SUCCESS;
2720 replies[i].resp = NULL;
2721 break;
2722
2723 default:
2724 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2725 msg[i]->msg_style));
2726 free(replies);
2727 return (PAM_CONV_ERR);
2728 }
2729 }
2730
2731 /*
2732 * Return the responses back to PAM...
2733 */
2734
2735 *resp = replies;
2736
2737 return (PAM_SUCCESS);
2738 }
2739 #elif !defined(HAVE_USERSEC_H)
2740
2741
2742 /*
2743 * 'to64()' - Base64-encode an integer value...
2744 */
2745
2746 static void
2747 to64(char *s, /* O - Output string */
2748 unsigned long v, /* I - Value to encode */
2749 int n) /* I - Number of digits */
2750 {
2751 const char *itoa64 = "./0123456789"
2752 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2753 "abcdefghijklmnopqrstuvwxyz";
2754
2755
2756 for (; n > 0; n --, v >>= 6)
2757 *s++ = itoa64[v & 0x3f];
2758 }
2759 #endif /* HAVE_LIBPAM */
2760
2761
2762 /*
2763 * End of "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $".
2764 */
Unnamed repository; edit this file 'description' to name the repository.