]>
Commit | Line | Data |
---|---|---|
ef416fc2 | 1 | /* |
7e86f2f6 | 2 | * Authentication functions for CUPS. |
ef416fc2 | 3 | * |
7ec11630 | 4 | * Copyright 2007-2017 by Apple Inc. |
7e86f2f6 | 5 | * Copyright 1997-2007 by Easy Software Products. |
ef416fc2 | 6 | * |
7e86f2f6 MS |
7 | * This file contains Kerberos support code, copyright 2006 by |
8 | * Jelmer Vernooij. | |
f7deaa1a | 9 | * |
e3101897 | 10 | * Licensed under Apache License v2.0. See the file "LICENSE" for more information. |
ef416fc2 | 11 | */ |
12 | ||
13 | /* | |
14 | * Include necessary headers... | |
15 | */ | |
16 | ||
71e16022 | 17 | #include "cups-private.h" |
ef416fc2 | 18 | #include <fcntl.h> |
19 | #include <sys/stat.h> | |
20 | #if defined(WIN32) || defined(__EMX__) | |
21 | # include <io.h> | |
22 | #else | |
23 | # include <unistd.h> | |
24 | #endif /* WIN32 || __EMX__ */ | |
25 | ||
f7deaa1a | 26 | #if HAVE_AUTHORIZATION_H |
27 | # include <Security/Authorization.h> | |
28 | # ifdef HAVE_SECBASEPRIV_H | |
29 | # include <Security/SecBasePriv.h> | |
30 | # else | |
31 | extern const char *cssmErrorString(int error); | |
32 | # endif /* HAVE_SECBASEPRIV_H */ | |
33 | #endif /* HAVE_AUTHORIZATION_H */ | |
34 | ||
bc44d920 | 35 | #if defined(SO_PEERCRED) && defined(AF_LOCAL) |
36 | # include <pwd.h> | |
37 | #endif /* SO_PEERCRED && AF_LOCAL */ | |
38 | ||
ef416fc2 | 39 | |
40 | /* | |
41 | * Local functions... | |
42 | */ | |
43 | ||
7ec11630 MS |
44 | static const char *cups_auth_find(const char *www_authenticate, const char *scheme); |
45 | static const char *cups_auth_param(const char *scheme, const char *name, char *value, size_t valsize); | |
46 | static const char *cups_auth_scheme(const char *www_authenticate, char *scheme, size_t schemesize); | |
47 | ||
f7deaa1a | 48 | #ifdef HAVE_GSSAPI |
eac3a0a0 MS |
49 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
50 | # ifdef HAVE_GSS_GSSAPI_SPI_H | |
51 | # include <GSS/gssapi_spi.h> | |
52 | # else | |
a2326b5b MS |
53 | # define GSS_AUTH_IDENTITY_TYPE_1 1 |
54 | # define gss_acquire_cred_ex_f __ApplePrivate_gss_acquire_cred_ex_f | |
53af7f21 | 55 | typedef struct gss_auth_identity /* @private@ */ |
eac3a0a0 MS |
56 | { |
57 | uint32_t type; | |
58 | uint32_t flags; | |
59 | char *username; | |
60 | char *realm; | |
61 | char *password; | |
62 | gss_buffer_t *credentialsRef; | |
49c59293 | 63 | } gss_auth_identity_desc; |
eac3a0a0 MS |
64 | extern OM_uint32 gss_acquire_cred_ex_f(gss_status_id_t, const gss_name_t, |
65 | OM_uint32, OM_uint32, const gss_OID, | |
66 | gss_cred_usage_t, gss_auth_identity_t, | |
67 | void *, void (*)(void *, OM_uint32, | |
68 | gss_status_id_t, | |
69 | gss_cred_id_t, | |
70 | gss_OID_set, | |
71 | OM_uint32)); | |
72 | # endif /* HAVE_GSS_GSSAPI_SPI_H */ | |
73 | # include <dispatch/dispatch.h> | |
74 | typedef struct _cups_gss_acquire_s /* Acquire callback data */ | |
75 | { | |
76 | dispatch_semaphore_t sem; /* Synchronization semaphore */ | |
77 | OM_uint32 major; /* Returned status code */ | |
78 | gss_cred_id_t creds; /* Returned credentials */ | |
79 | } _cups_gss_acquire_t; | |
80 | ||
81 | static void cups_gss_acquire(void *ctx, OM_uint32 major, | |
82 | gss_status_id_t status, | |
83 | gss_cred_id_t creds, gss_OID_set oids, | |
84 | OM_uint32 time_rec); | |
85 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
86 | static gss_name_t cups_gss_getname(http_t *http, const char *service_name); | |
f7deaa1a | 87 | # ifdef DEBUG |
e07d4801 MS |
88 | static void cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status, |
89 | const char *message); | |
355e94dc | 90 | # else |
e07d4801 MS |
91 | # define cups_gss_printf(major, minor, message) |
92 | # endif /* DEBUG */ | |
f7deaa1a | 93 | #endif /* HAVE_GSSAPI */ |
ef416fc2 | 94 | static int cups_local_auth(http_t *http); |
95 | ||
96 | ||
97 | /* | |
98 | * 'cupsDoAuthentication()' - Authenticate a request. | |
99 | * | |
cb7f98ee | 100 | * This function should be called in response to a @code HTTP_STATUS_UNAUTHORIZED@ |
ef416fc2 | 101 | * status, prior to resubmitting your request. |
102 | * | |
8072030b | 103 | * @since CUPS 1.1.20/macOS 10.4@ |
ef416fc2 | 104 | */ |
105 | ||
106 | int /* O - 0 on success, -1 on error */ | |
f11a948a MS |
107 | cupsDoAuthentication( |
108 | http_t *http, /* I - Connection to server or @code CUPS_HTTP_DEFAULT@ */ | |
109 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
110 | const char *resource) /* I - Resource path */ | |
ef416fc2 | 111 | { |
3e7fe0ca | 112 | const char *password, /* Password string */ |
7ec11630 MS |
113 | *www_auth, /* WWW-Authenticate header */ |
114 | *schemedata; /* Scheme-specific data */ | |
115 | char scheme[256], /* Scheme name */ | |
116 | prompt[1024], /* Prompt for user */ | |
ef416fc2 | 117 | realm[HTTP_MAX_VALUE], /* realm="xyz" string */ |
5a738aea | 118 | nonce[HTTP_MAX_VALUE]; /* nonce="xyz" string */ |
f7deaa1a | 119 | int localauth; /* Local authentication result */ |
b86bc4cf | 120 | _cups_globals_t *cg; /* Global data */ |
ef416fc2 | 121 | |
122 | ||
807315e6 | 123 | DEBUG_printf(("cupsDoAuthentication(http=%p, method=\"%s\", resource=\"%s\")", (void *)http, method, resource)); |
ef416fc2 | 124 | |
f11a948a MS |
125 | if (!http) |
126 | http = _cupsConnect(); | |
127 | ||
128 | if (!http || !method || !resource) | |
129 | return (-1); | |
130 | ||
5a6b583a MS |
131 | DEBUG_printf(("2cupsDoAuthentication: digest_tries=%d, userpass=\"%s\"", |
132 | http->digest_tries, http->userpass)); | |
133 | DEBUG_printf(("2cupsDoAuthentication: WWW-Authenticate=\"%s\"", | |
134 | httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE))); | |
135 | ||
ef416fc2 | 136 | /* |
137 | * Clear the current authentication string... | |
138 | */ | |
139 | ||
355e94dc | 140 | httpSetAuthString(http, NULL, NULL); |
ef416fc2 | 141 | |
142 | /* | |
143 | * See if we can do local authentication... | |
144 | */ | |
145 | ||
f7deaa1a | 146 | if (http->digest_tries < 3) |
ef416fc2 | 147 | { |
f7deaa1a | 148 | if ((localauth = cups_local_auth(http)) == 0) |
149 | { | |
e07d4801 | 150 | DEBUG_printf(("2cupsDoAuthentication: authstring=\"%s\"", |
f7deaa1a | 151 | http->authstring)); |
f14324a7 | 152 | |
cb7f98ee | 153 | if (http->status == HTTP_STATUS_UNAUTHORIZED) |
f7deaa1a | 154 | http->digest_tries ++; |
f14324a7 | 155 | |
f7deaa1a | 156 | return (0); |
157 | } | |
158 | else if (localauth == -1) | |
f11a948a | 159 | { |
cb7f98ee | 160 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
f7deaa1a | 161 | return (-1); /* Error or canceled */ |
f11a948a | 162 | } |
ef416fc2 | 163 | } |
164 | ||
165 | /* | |
7ec11630 | 166 | * Nope, loop through the authentication schemes to find the first we support. |
ef416fc2 | 167 | */ |
168 | ||
7ec11630 | 169 | www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE); |
3e7fe0ca | 170 | |
7ec11630 | 171 | for (schemedata = cups_auth_scheme(www_auth, scheme, sizeof(scheme)); schemedata; schemedata = cups_auth_scheme(schemedata + strlen(scheme), scheme, sizeof(scheme))) |
ef416fc2 | 172 | { |
173 | /* | |
7ec11630 | 174 | * Check the scheme name... |
ef416fc2 | 175 | */ |
176 | ||
7ec11630 MS |
177 | #ifdef HAVE_GSSAPI |
178 | if (!_cups_strcasecmp(scheme, "Negotiate")) | |
179 | { | |
180 | /* | |
181 | * Kerberos authentication... | |
182 | */ | |
5a9febac | 183 | |
7ec11630 MS |
184 | if (_cupsSetNegotiateAuthString(http, method, resource)) |
185 | { | |
186 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
187 | return (-1); | |
188 | } | |
b86bc4cf | 189 | |
7ec11630 MS |
190 | break; |
191 | } | |
192 | else | |
193 | #endif /* HAVE_GSSAPI */ | |
194 | if (_cups_strcasecmp(scheme, "Basic") && _cups_strcasecmp(scheme, "Digest")) | |
195 | continue; /* Not supported (yet) */ | |
b86bc4cf | 196 | |
7ec11630 MS |
197 | /* |
198 | * See if we should retry the current username:password... | |
199 | */ | |
5a9febac | 200 | |
7ec11630 MS |
201 | if ((http->digest_tries > 1 || !http->userpass[0]) && (!_cups_strcasecmp(scheme, "Basic") || (!_cups_strcasecmp(scheme, "Digest")))) |
202 | { | |
203 | /* | |
204 | * Nope - get a new password from the user... | |
205 | */ | |
ef416fc2 | 206 | |
7ec11630 MS |
207 | char default_username[HTTP_MAX_VALUE]; |
208 | /* Default username */ | |
ef416fc2 | 209 | |
7ec11630 | 210 | cg = _cupsGlobals(); |
ef416fc2 | 211 | |
7ec11630 MS |
212 | if (!cg->lang_default) |
213 | cg->lang_default = cupsLangDefault(); | |
ef416fc2 | 214 | |
7ec11630 MS |
215 | if (cups_auth_param(scheme, "username", default_username, sizeof(default_username))) |
216 | cupsSetUser(default_username); | |
5a6b583a | 217 | |
7ec11630 | 218 | snprintf(prompt, sizeof(prompt), _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), cupsUser(), http->hostname[0] == '/' ? "localhost" : http->hostname); |
5a6b583a | 219 | |
7ec11630 MS |
220 | http->digest_tries = _cups_strncasecmp(scheme, "Digest", 6) != 0; |
221 | http->userpass[0] = '\0'; | |
ef416fc2 | 222 | |
7ec11630 MS |
223 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) |
224 | { | |
225 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
226 | return (-1); | |
227 | } | |
f7deaa1a | 228 | |
7ec11630 MS |
229 | snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), password); |
230 | } | |
231 | else if (http->status == HTTP_STATUS_UNAUTHORIZED) | |
232 | http->digest_tries ++; | |
233 | ||
234 | if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3) | |
f7deaa1a | 235 | { |
7ec11630 MS |
236 | DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", http->digest_tries)); |
237 | ||
cb7f98ee | 238 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
f7deaa1a | 239 | return (-1); |
240 | } | |
7ec11630 | 241 | |
ef416fc2 | 242 | /* |
7ec11630 | 243 | * Got a password; encode it for the server... |
ef416fc2 | 244 | */ |
245 | ||
7ec11630 MS |
246 | if (!_cups_strcasecmp(scheme, "Basic")) |
247 | { | |
248 | /* | |
249 | * Basic authentication... | |
250 | */ | |
5a738aea | 251 | |
7ec11630 | 252 | char encode[256]; /* Base64 buffer */ |
5a738aea | 253 | |
7ec11630 MS |
254 | httpEncode64_2(encode, sizeof(encode), http->userpass, (int)strlen(http->userpass)); |
255 | httpSetAuthString(http, "Basic", encode); | |
256 | } | |
257 | else if (!_cups_strcasecmp(scheme, "Digest")) | |
258 | { | |
259 | /* | |
260 | * Digest authentication... | |
261 | */ | |
262 | ||
263 | int i; /* Looping var */ | |
264 | char algorithm[65], /* Hashing algorithm */ | |
265 | opaque[HTTP_MAX_VALUE], | |
266 | /* Opaque data from server */ | |
267 | cnonce[65], /* cnonce value */ | |
268 | kd[65], /* Final MD5/SHA-256 digest */ | |
269 | ha1[65], /* Hash of username:realm:password */ | |
270 | ha2[65], /* Hash of method:request-uri */ | |
271 | hdata[65], /* Hash of auth data */ | |
272 | temp[1024], /* Temporary string */ | |
273 | digest[1024]; /* Digest auth data */ | |
274 | unsigned char hash[32]; /* Hash buffer */ | |
275 | const char *hashalg; /* Hashing algorithm */ | |
276 | size_t hashsize; /* Size of hash */ | |
277 | ||
278 | if (strcmp(nonce, http->nonce)) | |
279 | { | |
280 | strlcpy(http->nonce, nonce, sizeof(http->nonce)); | |
281 | http->nonce_count = 1; | |
282 | } | |
283 | else | |
284 | http->nonce_count ++; | |
ef416fc2 | 285 | |
7ec11630 MS |
286 | cups_auth_param(schemedata, "opaque", opaque, sizeof(opaque)); |
287 | cups_auth_param(schemedata, "nonce", nonce, sizeof(nonce)); | |
288 | cups_auth_param(schemedata, "realm", realm, sizeof(realm)); | |
355e94dc | 289 | |
7ec11630 MS |
290 | for (i = 0; i < 64; i ++) |
291 | cnonce[i] = "0123456789ABCDEF"[CUPS_RAND() & 15]; | |
292 | cnonce[64] = '\0'; | |
ef416fc2 | 293 | |
7ec11630 MS |
294 | if (cups_auth_param(schemedata, "algorithm", algorithm, sizeof(algorithm))) |
295 | { | |
296 | /* | |
297 | * Follow RFC 2617/7616... | |
298 | */ | |
299 | ||
300 | if (!_cups_strcasecmp(algorithm, "MD5")) | |
301 | { | |
302 | /* | |
303 | * RFC 2617 Digest with MD5 | |
304 | */ | |
305 | ||
306 | hashalg = "md5"; | |
307 | } | |
308 | else if (!_cups_strcasecmp(algorithm, "SHA-256")) | |
309 | { | |
310 | /* | |
311 | * RFC 7616 Digest with SHA-256 | |
312 | */ | |
313 | ||
314 | hashalg = "sha2-256"; | |
315 | } | |
316 | else | |
317 | { | |
318 | /* | |
319 | * Some other algorithm we don't support, skip this one... | |
320 | */ | |
321 | ||
322 | continue; | |
323 | } | |
324 | ||
325 | /* | |
326 | * Calculate digest value... | |
327 | */ | |
328 | ||
329 | /* H(A1) = H(username:realm:password) */ | |
330 | snprintf(temp, sizeof(temp), "%s:%s:%s", cupsUser(), realm, strchr(http->userpass, ':') + 1); | |
331 | hashsize = (size_t)cupsHashData(hashalg, (unsigned char *)temp, strlen(temp), hash, sizeof(hash)); | |
332 | cupsHashString(hash, hashsize, ha1, sizeof(ha1)); | |
333 | ||
334 | /* H(A2) = H(method:uri) */ | |
335 | snprintf(temp, sizeof(temp), "%s:%s", method, resource); | |
336 | hashsize = (size_t)cupsHashData(hashalg, (unsigned char *)temp, strlen(temp), hash, sizeof(hash)); | |
337 | cupsHashString(hash, hashsize, ha2, sizeof(ha2)); | |
338 | ||
339 | /* H(data) = H(nonce:nc:cnonce:qop:H(A2)) */ | |
340 | snprintf(temp, sizeof(temp), "%s:%08x:%s:auth:%s", nonce, http->nonce_count, cnonce, ha2); | |
341 | hashsize = (size_t)cupsHashData(hashalg, (unsigned char *)temp, strlen(temp), hash, sizeof(hash)); | |
342 | cupsHashString(hash, hashsize, hdata, sizeof(hdata)); | |
343 | ||
344 | /* KD = H(H(A1):H(data)) */ | |
345 | snprintf(temp, sizeof(temp), "%s:%s", ha1, hdata); | |
346 | hashsize = (size_t)cupsHashData(hashalg, (unsigned char *)temp, strlen(temp), hash, sizeof(hash)); | |
347 | cupsHashString(hash, hashsize, kd, sizeof(kd)); | |
348 | ||
349 | /* Pass the RFC 2617/7616 WWW-Authenticate header */ | |
350 | if (opaque[0]) | |
351 | snprintf(digest, sizeof(digest), "username=\"%s\", realm=\"%s\", nonce=\"%s\", algorithm=%s, qop=auth, opaque=\"%s\", cnonce=\"%s\", nc=%08x, uri=\"%s\", response=\"%s\"", cupsUser(), realm, nonce, algorithm, opaque, cnonce, http->nonce_count, resource, kd); | |
352 | else | |
353 | snprintf(digest, sizeof(digest), "username=\"%s\", realm=\"%s\", nonce=\"%s\", algorithm=%s, qop=auth, cnonce=\"%s\", nc=%08x, uri=\"%s\", response=\"%s\"", cupsUser(), realm, nonce, algorithm, cnonce, http->nonce_count, resource, kd); | |
354 | } | |
355 | else | |
356 | { | |
357 | /* | |
358 | * Use old RFC 2069 Digest method... | |
359 | */ | |
360 | ||
361 | /* H(A1) = H(username:realm:password) */ | |
362 | snprintf(temp, sizeof(temp), "%s:%s:%s", cupsUser(), realm, strchr(http->userpass, ':') + 1); | |
363 | hashsize = (size_t)cupsHashData("md5", (unsigned char *)temp, strlen(temp), hash, sizeof(hash)); | |
364 | cupsHashString(hash, hashsize, ha1, sizeof(ha1)); | |
365 | ||
366 | /* H(A2) = H(method:uri) */ | |
367 | snprintf(temp, sizeof(temp), "%s:%s", method, resource); | |
368 | hashsize = (size_t)cupsHashData("md5", (unsigned char *)temp, strlen(temp), hash, sizeof(hash)); | |
369 | cupsHashString(hash, hashsize, ha2, sizeof(ha2)); | |
370 | ||
371 | /* KD = H(H(A1):nonce:H(A2)) */ | |
372 | snprintf(temp, sizeof(temp), "%s:%s:%s", ha1, nonce, ha2); | |
373 | hashsize = (size_t)cupsHashData("md5", (unsigned char *)temp, strlen(temp), hash, sizeof(hash)); | |
374 | cupsHashString(hash, hashsize, kd, sizeof(kd)); | |
375 | ||
376 | /* Pass the RFC 2069 WWW-Authenticate header */ | |
377 | snprintf(digest, sizeof(digest), "username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", response=\"%s\"", cupsUser(), realm, nonce, resource, kd); | |
378 | } | |
379 | ||
380 | httpSetAuthString(http, "Digest", digest); | |
381 | } | |
382 | } | |
383 | ||
384 | if (http->authstring) | |
385 | { | |
386 | DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\"", http->authstring)); | |
387 | ||
388 | return (0); | |
ef416fc2 | 389 | } |
f14324a7 MS |
390 | else |
391 | { | |
7ec11630 | 392 | DEBUG_printf(("1cupsDoAuthentication: Unknown auth type: \"%s\"", www_auth)); |
cb7f98ee | 393 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
7ec11630 | 394 | |
f14324a7 MS |
395 | return (-1); |
396 | } | |
ef416fc2 | 397 | } |
398 | ||
399 | ||
f7deaa1a | 400 | #ifdef HAVE_GSSAPI |
f14324a7 MS |
401 | /* |
402 | * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string. | |
403 | */ | |
404 | ||
405 | int /* O - 0 on success, -1 on error */ | |
406 | _cupsSetNegotiateAuthString( | |
eac3a0a0 MS |
407 | http_t *http, /* I - Connection to server */ |
408 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
409 | const char *resource) /* I - Resource path */ | |
f14324a7 MS |
410 | { |
411 | OM_uint32 minor_status, /* Minor status code */ | |
412 | major_status; /* Major status code */ | |
413 | gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; | |
07ed0e9a | 414 | /* Output token */ |
f14324a7 MS |
415 | |
416 | ||
321d8d57 MS |
417 | (void)method; |
418 | (void)resource; | |
419 | ||
f14324a7 MS |
420 | # ifdef __APPLE__ |
421 | /* | |
422 | * If the weak-linked GSSAPI/Kerberos library is not present, don't try | |
423 | * to use it... | |
424 | */ | |
425 | ||
6d8021f4 | 426 | if (&gss_init_sec_context == NULL) |
f14324a7 MS |
427 | { |
428 | DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos " | |
429 | "framework is not present"); | |
430 | return (-1); | |
431 | } | |
432 | # endif /* __APPLE__ */ | |
433 | ||
434 | if (http->gssname == GSS_C_NO_NAME) | |
435 | { | |
eac3a0a0 | 436 | http->gssname = cups_gss_getname(http, _cupsGSSServiceName()); |
f14324a7 MS |
437 | } |
438 | ||
439 | if (http->gssctx != GSS_C_NO_CONTEXT) | |
440 | { | |
441 | gss_delete_sec_context(&minor_status, &http->gssctx, GSS_C_NO_BUFFER); | |
442 | http->gssctx = GSS_C_NO_CONTEXT; | |
443 | } | |
444 | ||
eac3a0a0 MS |
445 | major_status = gss_init_sec_context(&minor_status, GSS_C_NO_CREDENTIAL, |
446 | &http->gssctx, | |
447 | http->gssname, http->gssmech, | |
448 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
449 | GSS_C_INDEFINITE, | |
450 | GSS_C_NO_CHANNEL_BINDINGS, | |
451 | GSS_C_NO_BUFFER, &http->gssmech, | |
452 | &output_token, NULL, NULL); | |
453 | ||
454 | #ifdef HAVE_GSS_ACQUIRE_CRED_EX_F | |
455 | if (major_status == GSS_S_NO_CRED) | |
456 | { | |
457 | /* | |
458 | * Ask the user for credentials... | |
459 | */ | |
460 | ||
461 | char prompt[1024], /* Prompt for user */ | |
462 | userbuf[256]; /* Kerberos username */ | |
463 | const char *username, /* Username string */ | |
464 | *password; /* Password string */ | |
465 | _cups_gss_acquire_t data; /* Callback data */ | |
49c59293 | 466 | gss_auth_identity_desc identity; /* Kerberos user identity */ |
eac3a0a0 MS |
467 | _cups_globals_t *cg = _cupsGlobals(); |
468 | /* Per-thread global data */ | |
469 | ||
470 | if (!cg->lang_default) | |
471 | cg->lang_default = cupsLangDefault(); | |
472 | ||
473 | snprintf(prompt, sizeof(prompt), | |
474 | _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), | |
f228370c | 475 | cupsUser(), http->gsshost); |
eac3a0a0 MS |
476 | |
477 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) | |
478 | return (-1); | |
479 | ||
480 | /* | |
481 | * Try to acquire credentials... | |
482 | */ | |
483 | ||
484 | username = cupsUser(); | |
485 | if (!strchr(username, '@')) | |
486 | { | |
f228370c | 487 | snprintf(userbuf, sizeof(userbuf), "%s@%s", username, http->gsshost); |
eac3a0a0 MS |
488 | username = userbuf; |
489 | } | |
490 | ||
491 | identity.type = GSS_AUTH_IDENTITY_TYPE_1; | |
492 | identity.flags = 0; | |
493 | identity.username = (char *)username; | |
494 | identity.realm = (char *)""; | |
495 | identity.password = (char *)password; | |
496 | identity.credentialsRef = NULL; | |
497 | ||
498 | data.sem = dispatch_semaphore_create(0); | |
499 | data.major = 0; | |
500 | data.creds = NULL; | |
501 | ||
502 | if (data.sem) | |
503 | { | |
5dcbe84d | 504 | major_status = gss_acquire_cred_ex_f(NULL, GSS_C_NO_NAME, 0, GSS_C_INDEFINITE, GSS_KRB5_MECHANISM, GSS_C_INITIATE, (gss_auth_identity_t)&identity, &data, cups_gss_acquire); |
eac3a0a0 MS |
505 | |
506 | if (major_status == GSS_S_COMPLETE) | |
507 | { | |
508 | dispatch_semaphore_wait(data.sem, DISPATCH_TIME_FOREVER); | |
509 | major_status = data.major; | |
510 | } | |
511 | ||
512 | dispatch_release(data.sem); | |
513 | ||
514 | if (major_status == GSS_S_COMPLETE) | |
515 | { | |
516 | OM_uint32 release_minor; /* Minor status from releasing creds */ | |
517 | ||
518 | major_status = gss_init_sec_context(&minor_status, data.creds, | |
519 | &http->gssctx, | |
520 | http->gssname, http->gssmech, | |
521 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
522 | GSS_C_INDEFINITE, | |
523 | GSS_C_NO_CHANNEL_BINDINGS, | |
524 | GSS_C_NO_BUFFER, &http->gssmech, | |
525 | &output_token, NULL, NULL); | |
526 | gss_release_cred(&release_minor, &data.creds); | |
527 | } | |
528 | } | |
529 | } | |
eac3a0a0 | 530 | #endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */ |
f14324a7 MS |
531 | |
532 | if (GSS_ERROR(major_status)) | |
533 | { | |
534 | cups_gss_printf(major_status, minor_status, | |
535 | "_cupsSetNegotiateAuthString: Unable to initialize " | |
536 | "security context"); | |
537 | return (-1); | |
538 | } | |
539 | ||
22c9029b | 540 | #ifdef DEBUG |
eac3a0a0 | 541 | else if (major_status == GSS_S_CONTINUE_NEEDED) |
f14324a7 MS |
542 | cups_gss_printf(major_status, minor_status, |
543 | "_cupsSetNegotiateAuthString: Continuation needed!"); | |
22c9029b | 544 | #endif /* DEBUG */ |
f14324a7 MS |
545 | |
546 | if (output_token.length > 0 && output_token.length <= 65536) | |
547 | { | |
548 | /* | |
549 | * Allocate the authorization string since Windows KDCs can have | |
550 | * arbitrarily large credentials... | |
551 | */ | |
552 | ||
7e86f2f6 MS |
553 | int authsize = 10 + /* "Negotiate " */ |
554 | (int)output_token.length * 4 / 3 + 1 + 1; | |
555 | /* Base64 + nul */ | |
f14324a7 MS |
556 | |
557 | httpSetAuthString(http, NULL, NULL); | |
558 | ||
7e86f2f6 | 559 | if ((http->authstring = malloc((size_t)authsize)) == NULL) |
f14324a7 MS |
560 | { |
561 | http->authstring = http->_authstring; | |
562 | authsize = sizeof(http->_authstring); | |
563 | } | |
564 | ||
07623986 | 565 | strlcpy(http->authstring, "Negotiate ", (size_t)authsize); |
f14324a7 | 566 | httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value, |
7e86f2f6 | 567 | (int)output_token.length); |
f14324a7 MS |
568 | |
569 | gss_release_buffer(&minor_status, &output_token); | |
570 | } | |
571 | else | |
572 | { | |
573 | DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos credentials too " | |
574 | "large - %d bytes!", (int)output_token.length)); | |
575 | gss_release_buffer(&minor_status, &output_token); | |
576 | ||
577 | return (-1); | |
578 | } | |
579 | ||
580 | return (0); | |
581 | } | |
582 | ||
583 | ||
7ec11630 MS |
584 | /* |
585 | * 'cups_auth_find()' - Find the named WWW-Authenticate scheme. | |
586 | * | |
587 | * The "www_authenticate" parameter points to the current position in the header. | |
588 | * | |
589 | * Returns @code NULL@ if the auth scheme is not present. | |
590 | */ | |
591 | ||
592 | static const char * /* O - Start of matching scheme or @code NULL@ if not found */ | |
593 | cups_auth_find(const char *www_authenticate, /* I - Pointer into WWW-Authenticate header */ | |
594 | const char *scheme) /* I - Authentication scheme */ | |
595 | { | |
596 | size_t schemelen = strlen(scheme); /* Length of scheme */ | |
597 | ||
598 | ||
599 | while (*www_authenticate) | |
600 | { | |
601 | /* | |
602 | * Skip leading whitespace and commas... | |
603 | */ | |
604 | ||
605 | while (isspace(*www_authenticate & 255) || *www_authenticate == ',') | |
606 | www_authenticate ++; | |
607 | ||
608 | /* | |
609 | * See if this is "Scheme" followed by whitespace or the end of the string. | |
610 | */ | |
611 | ||
612 | if (!strncmp(www_authenticate, scheme, schemelen) && (isspace(www_authenticate[schemelen] & 255) || !www_authenticate[schemelen])) | |
613 | { | |
614 | /* | |
615 | * Yes, this is the start of the scheme-specific information... | |
616 | */ | |
617 | ||
618 | return (www_authenticate); | |
619 | } | |
620 | ||
621 | /* | |
622 | * Skip the scheme name or param="value" string... | |
623 | */ | |
624 | ||
625 | while (!isspace(*www_authenticate & 255) && *www_authenticate) | |
626 | { | |
627 | if (*www_authenticate == '\"') | |
628 | { | |
629 | /* | |
630 | * Skip quoted value... | |
631 | */ | |
632 | ||
633 | while (www_authenticate[1] && www_authenticate[1] != '\"') | |
634 | www_authenticate ++; | |
635 | } | |
636 | ||
637 | www_authenticate ++; | |
638 | } | |
639 | } | |
640 | ||
641 | return (NULL); | |
642 | } | |
643 | ||
644 | ||
645 | /* | |
646 | * 'cups_auth_param()' - Copy the value for the named authentication parameter, | |
647 | * if present. | |
648 | */ | |
649 | ||
650 | static const char * /* O - Parameter value or @code NULL@ if not present */ | |
651 | cups_auth_param(const char *scheme, /* I - Pointer to auth data */ | |
652 | const char *name, /* I - Name of parameter */ | |
653 | char *value, /* I - Value buffer */ | |
654 | size_t valsize) /* I - Size of value buffer */ | |
655 | { | |
656 | char *valptr = value, /* Pointer into value buffer */ | |
657 | *valend = value + valsize - 1; /* Pointer to end of buffer */ | |
658 | size_t namelen = strlen(name); /* Name length */ | |
659 | int param; /* Is this a parameter? */ | |
660 | ||
661 | ||
662 | while (!isspace(*scheme & 255) && *scheme) | |
663 | scheme ++; | |
664 | ||
665 | while (*scheme) | |
666 | { | |
667 | while (isspace(*scheme & 255) || *scheme == ',') | |
668 | scheme ++; | |
669 | ||
670 | if (!strncmp(scheme, name, namelen) && scheme[namelen] == '=') | |
671 | { | |
672 | /* | |
673 | * Found the parameter, copy the value... | |
674 | */ | |
675 | ||
676 | scheme += namelen + 1; | |
677 | if (*scheme == '\"') | |
678 | { | |
679 | scheme ++; | |
680 | ||
681 | while (*scheme && *scheme != '\"') | |
682 | { | |
683 | if (valptr < valend) | |
684 | *valptr++ = *scheme; | |
685 | ||
686 | scheme ++; | |
687 | } | |
688 | } | |
689 | else | |
690 | { | |
691 | while (*scheme && strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~+/=", *scheme)) | |
692 | { | |
693 | if (valptr < valend) | |
694 | *valptr++ = *scheme; | |
695 | ||
696 | scheme ++; | |
697 | } | |
698 | } | |
699 | ||
700 | *valptr = '\0'; | |
701 | ||
702 | return (value); | |
703 | } | |
704 | ||
705 | /* | |
706 | * Skip the param=value string... | |
707 | */ | |
708 | ||
709 | param = 0; | |
710 | ||
711 | while (!isspace(*scheme & 255) && *scheme) | |
712 | { | |
713 | if (*scheme == '=') | |
714 | param = 1; | |
715 | else if (*scheme == '\"') | |
716 | { | |
717 | /* | |
718 | * Skip quoted value... | |
719 | */ | |
720 | ||
721 | while (scheme[1] && scheme[1] != '\"') | |
722 | scheme ++; | |
723 | } | |
724 | ||
725 | scheme ++; | |
726 | } | |
727 | ||
728 | /* | |
729 | * If this wasn't a parameter, we are at the end of this scheme's | |
730 | * parameters... | |
731 | */ | |
732 | ||
733 | if (!param) | |
734 | break; | |
735 | } | |
736 | ||
737 | *value = '\0'; | |
738 | ||
739 | return (NULL); | |
740 | } | |
741 | ||
742 | ||
743 | /* | |
744 | * 'cups_auth_scheme()' - Get the (next) WWW-Authenticate scheme. | |
745 | * | |
746 | * The "www_authenticate" parameter points to the current position in the header. | |
747 | * | |
748 | * Returns @code NULL@ if there are no (more) auth schemes present. | |
749 | */ | |
750 | ||
751 | static const char * /* O - Start of scheme or @code NULL@ if not found */ | |
752 | cups_auth_scheme(const char *www_authenticate, /* I - Pointer into WWW-Authenticate header */ | |
753 | char *scheme, /* I - Scheme name buffer */ | |
754 | size_t schemesize) /* I - Size of buffer */ | |
755 | { | |
756 | const char *start; /* Start of scheme data */ | |
757 | char *sptr = scheme, /* Pointer into scheme buffer */ | |
758 | *send = scheme + schemesize - 1;/* End of scheme buffer */ | |
759 | int param; /* Is this a parameter? */ | |
760 | ||
761 | ||
762 | while (*www_authenticate) | |
763 | { | |
764 | /* | |
765 | * Skip leading whitespace and commas... | |
766 | */ | |
767 | ||
768 | while (isspace(*www_authenticate & 255) || *www_authenticate == ',') | |
769 | www_authenticate ++; | |
770 | ||
771 | /* | |
772 | * Parse the scheme name or param="value" string... | |
773 | */ | |
774 | ||
775 | for (sptr = scheme, start = www_authenticate, param = 0; *www_authenticate && !isspace(*www_authenticate & 255); www_authenticate ++) | |
776 | { | |
777 | if (*www_authenticate == '=') | |
778 | param = 1; | |
779 | else if (!param && sptr < send) | |
780 | *sptr++ = *www_authenticate; | |
781 | else if (*www_authenticate == '\"') | |
782 | { | |
783 | /* | |
784 | * Skip quoted value... | |
785 | */ | |
786 | ||
787 | while (www_authenticate[1] && www_authenticate[1] != '\"') | |
788 | www_authenticate ++; | |
789 | } | |
790 | } | |
791 | ||
792 | if (sptr > scheme && !param) | |
793 | { | |
794 | *sptr = '\0'; | |
795 | return (start); | |
796 | } | |
797 | } | |
798 | ||
799 | *scheme = '\0'; | |
800 | ||
801 | return (NULL); | |
802 | } | |
803 | ||
804 | ||
eac3a0a0 | 805 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
f7deaa1a | 806 | /* |
eac3a0a0 MS |
807 | * 'cups_gss_acquire()' - Kerberos credentials callback. |
808 | */ | |
809 | static void | |
810 | cups_gss_acquire( | |
811 | void *ctx, /* I - Caller context */ | |
812 | OM_uint32 major, /* I - Major error code */ | |
813 | gss_status_id_t status, /* I - Status (unused) */ | |
814 | gss_cred_id_t creds, /* I - Credentials (if any) */ | |
815 | gss_OID_set oids, /* I - Mechanism OIDs (unused) */ | |
816 | OM_uint32 time_rec) /* I - Timestamp (unused) */ | |
817 | { | |
818 | uint32_t min; /* Minor error code */ | |
819 | _cups_gss_acquire_t *data; /* Callback data */ | |
820 | ||
821 | ||
822 | (void)status; | |
823 | (void)time_rec; | |
824 | ||
825 | data = (_cups_gss_acquire_t *)ctx; | |
826 | data->major = major; | |
827 | data->creds = creds; | |
828 | ||
829 | gss_release_oid_set(&min, &oids); | |
830 | dispatch_semaphore_signal(data->sem); | |
831 | } | |
832 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
833 | ||
834 | ||
835 | /* | |
836 | * 'cups_gss_getname()' - Get CUPS service credentials for authentication. | |
f7deaa1a | 837 | */ |
838 | ||
839 | static gss_name_t /* O - Server name */ | |
eac3a0a0 | 840 | cups_gss_getname( |
f7deaa1a | 841 | http_t *http, /* I - Connection to server */ |
842 | const char *service_name) /* I - Service name */ | |
843 | { | |
844 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | |
845 | /* Service token */ | |
bc44d920 | 846 | OM_uint32 major_status, /* Major status code */ |
847 | minor_status; /* Minor status code */ | |
848 | gss_name_t server_name; /* Server name */ | |
eac3a0a0 | 849 | char buf[1024]; /* Name buffer */ |
bc44d920 | 850 | |
851 | ||
eac3a0a0 | 852 | DEBUG_printf(("7cups_gss_getname(http=%p, service_name=\"%s\")", http, |
e07d4801 MS |
853 | service_name)); |
854 | ||
855 | ||
bc44d920 | 856 | /* |
857 | * Get the hostname... | |
858 | */ | |
f7deaa1a | 859 | |
eac3a0a0 MS |
860 | if (!http->gsshost[0]) |
861 | { | |
862 | httpGetHostname(http, http->gsshost, sizeof(http->gsshost)); | |
bc44d920 | 863 | |
eac3a0a0 MS |
864 | if (!strcmp(http->gsshost, "localhost")) |
865 | { | |
866 | if (gethostname(http->gsshost, sizeof(http->gsshost)) < 0) | |
867 | { | |
868 | DEBUG_printf(("1cups_gss_getname: gethostname() failed: %s", | |
869 | strerror(errno))); | |
870 | http->gsshost[0] = '\0'; | |
871 | return (NULL); | |
872 | } | |
873 | ||
874 | if (!strchr(http->gsshost, '.')) | |
875 | { | |
876 | /* | |
877 | * The hostname is not a FQDN, so look it up... | |
878 | */ | |
879 | ||
880 | struct hostent *host; /* Host entry to get FQDN */ | |
881 | ||
882 | if ((host = gethostbyname(http->gsshost)) != NULL && host->h_name) | |
883 | { | |
884 | /* | |
885 | * Use the resolved hostname... | |
886 | */ | |
887 | ||
888 | strlcpy(http->gsshost, host->h_name, sizeof(http->gsshost)); | |
889 | } | |
890 | else | |
891 | { | |
892 | DEBUG_printf(("1cups_gss_getname: gethostbyname(\"%s\") failed.", | |
893 | http->gsshost)); | |
894 | http->gsshost[0] = '\0'; | |
895 | return (NULL); | |
896 | } | |
897 | } | |
898 | } | |
899 | } | |
f7deaa1a | 900 | |
901 | /* | |
eac3a0a0 | 902 | * Get a service name we can use for authentication purposes... |
f7deaa1a | 903 | */ |
904 | ||
eac3a0a0 | 905 | snprintf(buf, sizeof(buf), "%s@%s", service_name, http->gsshost); |
f7deaa1a | 906 | |
eac3a0a0 | 907 | DEBUG_printf(("8cups_gss_getname: Looking up \"%s\".", buf)); |
7ff4fea9 | 908 | |
f7deaa1a | 909 | token.value = buf; |
910 | token.length = strlen(buf); | |
911 | server_name = GSS_C_NO_NAME; | |
912 | major_status = gss_import_name(&minor_status, &token, | |
913 | GSS_C_NT_HOSTBASED_SERVICE, | |
914 | &server_name); | |
915 | ||
916 | if (GSS_ERROR(major_status)) | |
917 | { | |
e07d4801 | 918 | cups_gss_printf(major_status, minor_status, |
eac3a0a0 | 919 | "cups_gss_getname: gss_import_name() failed"); |
f7deaa1a | 920 | return (NULL); |
921 | } | |
922 | ||
923 | return (server_name); | |
924 | } | |
e07d4801 MS |
925 | |
926 | ||
927 | # ifdef DEBUG | |
928 | /* | |
eac3a0a0 | 929 | * 'cups_gss_printf()' - Show debug error messages from GSSAPI. |
e07d4801 MS |
930 | */ |
931 | ||
932 | static void | |
933 | cups_gss_printf(OM_uint32 major_status,/* I - Major status code */ | |
934 | OM_uint32 minor_status,/* I - Minor status code */ | |
935 | const char *message) /* I - Prefix for error message */ | |
936 | { | |
937 | OM_uint32 err_major_status, /* Major status code for display */ | |
938 | err_minor_status; /* Minor status code for display */ | |
939 | OM_uint32 msg_ctx; /* Message context */ | |
940 | gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER, | |
941 | /* Major status message */ | |
942 | minor_status_string = GSS_C_EMPTY_BUFFER; | |
943 | /* Minor status message */ | |
944 | ||
945 | ||
946 | msg_ctx = 0; | |
947 | err_major_status = gss_display_status(&err_minor_status, | |
948 | major_status, | |
949 | GSS_C_GSS_CODE, | |
950 | GSS_C_NO_OID, | |
951 | &msg_ctx, | |
952 | &major_status_string); | |
953 | ||
954 | if (!GSS_ERROR(err_major_status)) | |
955 | gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE, | |
956 | GSS_C_NULL_OID, &msg_ctx, &minor_status_string); | |
957 | ||
68b10830 | 958 | DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value, |
e07d4801 MS |
959 | (char *)minor_status_string.value)); |
960 | ||
961 | gss_release_buffer(&err_minor_status, &major_status_string); | |
962 | gss_release_buffer(&err_minor_status, &minor_status_string); | |
963 | } | |
964 | # endif /* DEBUG */ | |
f7deaa1a | 965 | #endif /* HAVE_GSSAPI */ |
966 | ||
967 | ||
ef416fc2 | 968 | /* |
969 | * 'cups_local_auth()' - Get the local authorization certificate if | |
eac3a0a0 | 970 | * available/applicable. |
ef416fc2 | 971 | */ |
972 | ||
f7deaa1a | 973 | static int /* O - 0 if available */ |
bc44d920 | 974 | /* 1 if not available */ |
f7deaa1a | 975 | /* -1 error */ |
ef416fc2 | 976 | cups_local_auth(http_t *http) /* I - HTTP connection to server */ |
977 | { | |
978 | #if defined(WIN32) || defined(__EMX__) | |
979 | /* | |
980 | * Currently WIN32 and OS-2 do not support the CUPS server... | |
981 | */ | |
982 | ||
bc44d920 | 983 | return (1); |
ef416fc2 | 984 | #else |
f7deaa1a | 985 | int pid; /* Current process ID */ |
986 | FILE *fp; /* Certificate file */ | |
e07d4801 | 987 | char trc[16], /* Try Root Certificate parameter */ |
6961465f | 988 | filename[1024]; /* Certificate filename */ |
7ec11630 MS |
989 | const char *www_auth, /* WWW-Authenticate header */ |
990 | *schemedata; /* Data for the named auth scheme */ | |
ef416fc2 | 991 | _cups_globals_t *cg = _cupsGlobals(); /* Global data */ |
bc44d920 | 992 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 993 | OSStatus status; /* Status */ |
994 | AuthorizationItem auth_right; /* Authorization right */ | |
995 | AuthorizationRights auth_rights; /* Authorization rights */ | |
996 | AuthorizationFlags auth_flags; /* Authorization flags */ | |
997 | AuthorizationExternalForm auth_extrn; /* Authorization ref external */ | |
998 | char auth_key[1024]; /* Buffer */ | |
999 | char buffer[1024]; /* Buffer */ | |
bc44d920 | 1000 | # endif /* HAVE_AUTHORIZATION_H */ |
ef416fc2 | 1001 | |
1002 | ||
807315e6 | 1003 | DEBUG_printf(("7cups_local_auth(http=%p) hostaddr=%s, hostname=\"%s\"", (void *)http, httpAddrString(http->hostaddr, filename, sizeof(filename)), http->hostname)); |
ef416fc2 | 1004 | |
1005 | /* | |
1006 | * See if we are accessing localhost... | |
1007 | */ | |
1008 | ||
7ec11630 | 1009 | if (!httpAddrLocalhost(http->hostaddr) && _cups_strcasecmp(http->hostname, "localhost") != 0) |
ef416fc2 | 1010 | { |
e07d4801 | 1011 | DEBUG_puts("8cups_local_auth: Not a local connection!"); |
bc44d920 | 1012 | return (1); |
ef416fc2 | 1013 | } |
1014 | ||
bc44d920 | 1015 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 1016 | /* |
1017 | * Delete any previous authorization reference... | |
1018 | */ | |
f14324a7 | 1019 | |
b94498cf | 1020 | if (http->auth_ref) |
f7deaa1a | 1021 | { |
b94498cf | 1022 | AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults); |
1023 | http->auth_ref = NULL; | |
f7deaa1a | 1024 | } |
1025 | ||
7ec11630 MS |
1026 | www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE); |
1027 | ||
1028 | if (!getenv("GATEWAY_INTERFACE") && (schemedata = cups_auth_find(www_auth, "AuthKey")) != NULL && cups_auth_param(schemedata, "key", auth_key, sizeof(auth_key))) | |
f7deaa1a | 1029 | { |
7ec11630 | 1030 | status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &http->auth_ref); |
f7deaa1a | 1031 | if (status != errAuthorizationSuccess) |
1032 | { | |
e07d4801 | 1033 | DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d (%s)", |
f7deaa1a | 1034 | (int)status, cssmErrorString(status))); |
1035 | return (-1); | |
1036 | } | |
1037 | ||
1038 | auth_right.name = auth_key; | |
1039 | auth_right.valueLength = 0; | |
1040 | auth_right.value = NULL; | |
1041 | auth_right.flags = 0; | |
1042 | ||
1043 | auth_rights.count = 1; | |
1044 | auth_rights.items = &auth_right; | |
1045 | ||
f14324a7 | 1046 | auth_flags = kAuthorizationFlagDefaults | |
f7deaa1a | 1047 | kAuthorizationFlagPreAuthorize | |
f14324a7 | 1048 | kAuthorizationFlagInteractionAllowed | |
f7deaa1a | 1049 | kAuthorizationFlagExtendRights; |
1050 | ||
f14324a7 MS |
1051 | status = AuthorizationCopyRights(http->auth_ref, &auth_rights, |
1052 | kAuthorizationEmptyEnvironment, | |
f7deaa1a | 1053 | auth_flags, NULL); |
1054 | if (status == errAuthorizationSuccess) | |
b94498cf | 1055 | status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn); |
f7deaa1a | 1056 | |
1057 | if (status == errAuthorizationSuccess) | |
1058 | { | |
1059 | /* | |
1060 | * Set the authorization string and return... | |
1061 | */ | |
1062 | ||
f14324a7 | 1063 | httpEncode64_2(buffer, sizeof(buffer), (void *)&auth_extrn, |
f7deaa1a | 1064 | sizeof(auth_extrn)); |
1065 | ||
355e94dc | 1066 | httpSetAuthString(http, "AuthRef", buffer); |
f7deaa1a | 1067 | |
e07d4801 | 1068 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
f7deaa1a | 1069 | http->authstring)); |
1070 | return (0); | |
1071 | } | |
1072 | else if (status == errAuthorizationCanceled) | |
1073 | return (-1); | |
1074 | ||
e07d4801 | 1075 | DEBUG_printf(("9cups_local_auth: AuthorizationCopyRights() returned %d (%s)", |
f7deaa1a | 1076 | (int)status, cssmErrorString(status))); |
1077 | ||
1078 | /* | |
1079 | * Fall through to try certificates... | |
1080 | */ | |
1081 | } | |
bc44d920 | 1082 | # endif /* HAVE_AUTHORIZATION_H */ |
f7deaa1a | 1083 | |
7ec11630 MS |
1084 | # ifdef HAVE_GSSAPI |
1085 | if (cups_auth_find(www_auth, "Negotiate")) | |
1086 | return (1); | |
1087 | # endif /* HAVE_GSSAPI */ | |
1088 | # ifdef HAVE_AUTHORIZATION_H | |
1089 | if (cups_auth_find(www_auth, "AuthKey")) | |
1090 | return (1); | |
1091 | # endif /* HAVE_AUTHORIZATION_H */ | |
1092 | ||
f11a948a MS |
1093 | # if defined(SO_PEERCRED) && defined(AF_LOCAL) |
1094 | /* | |
1095 | * See if we can authenticate using the peer credentials provided over a | |
1096 | * domain socket; if so, specify "PeerCred username" as the authentication | |
1097 | * information... | |
1098 | */ | |
1099 | ||
7ec11630 MS |
1100 | if (http->hostaddr->addr.sa_family == AF_LOCAL && |
1101 | !getenv("GATEWAY_INTERFACE") && /* Not via CGI programs... */ | |
1102 | cups_auth_find(www_auth, "PeerCred")) | |
f11a948a MS |
1103 | { |
1104 | /* | |
1105 | * Verify that the current cupsUser() matches the current UID... | |
1106 | */ | |
1107 | ||
1108 | struct passwd *pwd; /* Password information */ | |
1109 | const char *username; /* Current username */ | |
1110 | ||
1111 | username = cupsUser(); | |
1112 | ||
1113 | if ((pwd = getpwnam(username)) != NULL && pwd->pw_uid == getuid()) | |
1114 | { | |
1115 | httpSetAuthString(http, "PeerCred", username); | |
1116 | ||
1117 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", | |
1118 | http->authstring)); | |
1119 | ||
1120 | return (0); | |
1121 | } | |
1122 | } | |
1123 | # endif /* SO_PEERCRED && AF_LOCAL */ | |
1124 | ||
7ec11630 MS |
1125 | if ((schemedata = cups_auth_find(www_auth, "Local")) == NULL) |
1126 | return (1); | |
1127 | ||
ef416fc2 | 1128 | /* |
1129 | * Try opening a certificate file for this PID. If that fails, | |
1130 | * try the root certificate... | |
1131 | */ | |
1132 | ||
1133 | pid = getpid(); | |
1134 | snprintf(filename, sizeof(filename), "%s/certs/%d", cg->cups_statedir, pid); | |
1135 | if ((fp = fopen(filename, "r")) == NULL && pid > 0) | |
1136 | { | |
bc44d920 | 1137 | /* |
e07d4801 | 1138 | * No certificate for this PID; see if we can get the root certificate... |
bc44d920 | 1139 | */ |
1140 | ||
7ec11630 | 1141 | DEBUG_printf(("9cups_local_auth: Unable to open file %s: %s", filename, strerror(errno))); |
e07d4801 | 1142 | |
7ec11630 | 1143 | if (!cups_auth_param(schemedata, "trc", trc, sizeof(trc))) |
e07d4801 MS |
1144 | { |
1145 | /* | |
1146 | * Scheduler doesn't want us to use the root certificate... | |
1147 | */ | |
1148 | ||
1149 | return (1); | |
1150 | } | |
1151 | ||
ef416fc2 | 1152 | snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir); |
1153 | fp = fopen(filename, "r"); | |
1154 | } | |
1155 | ||
f7deaa1a | 1156 | if (fp) |
ef416fc2 | 1157 | { |
f7deaa1a | 1158 | /* |
1159 | * Read the certificate from the file... | |
1160 | */ | |
ef416fc2 | 1161 | |
6961465f MS |
1162 | char certificate[33], /* Certificate string */ |
1163 | *certptr; /* Pointer to certificate string */ | |
1164 | ||
1165 | certptr = fgets(certificate, sizeof(certificate), fp); | |
f7deaa1a | 1166 | fclose(fp); |
ef416fc2 | 1167 | |
6961465f MS |
1168 | if (certptr) |
1169 | { | |
1170 | /* | |
1171 | * Set the authorization string and return... | |
1172 | */ | |
ef416fc2 | 1173 | |
6961465f | 1174 | httpSetAuthString(http, "Local", certificate); |
ef416fc2 | 1175 | |
6961465f MS |
1176 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
1177 | http->authstring)); | |
ef416fc2 | 1178 | |
6961465f MS |
1179 | return (0); |
1180 | } | |
f7deaa1a | 1181 | } |
1182 | ||
1183 | return (1); | |
ef416fc2 | 1184 | #endif /* WIN32 || __EMX__ */ |
1185 | } |