]>
Commit | Line | Data |
---|---|---|
ef416fc2 | 1 | /* |
7e86f2f6 | 2 | * Authentication functions for CUPS. |
ef416fc2 | 3 | * |
fa26ab95 | 4 | * Copyright 2007-2019 by Apple Inc. |
7e86f2f6 | 5 | * Copyright 1997-2007 by Easy Software Products. |
ef416fc2 | 6 | * |
7e86f2f6 MS |
7 | * This file contains Kerberos support code, copyright 2006 by |
8 | * Jelmer Vernooij. | |
f7deaa1a | 9 | * |
e3101897 | 10 | * Licensed under Apache License v2.0. See the file "LICENSE" for more information. |
ef416fc2 | 11 | */ |
12 | ||
13 | /* | |
14 | * Include necessary headers... | |
15 | */ | |
16 | ||
71e16022 | 17 | #include "cups-private.h" |
fb863569 | 18 | #include "debug-internal.h" |
ef416fc2 | 19 | #include <fcntl.h> |
20 | #include <sys/stat.h> | |
19dc16f7 | 21 | #if defined(_WIN32) || defined(__EMX__) |
ef416fc2 | 22 | # include <io.h> |
23 | #else | |
24 | # include <unistd.h> | |
19dc16f7 | 25 | #endif /* _WIN32 || __EMX__ */ |
ef416fc2 | 26 | |
f7deaa1a | 27 | #if HAVE_AUTHORIZATION_H |
28 | # include <Security/Authorization.h> | |
f7deaa1a | 29 | #endif /* HAVE_AUTHORIZATION_H */ |
30 | ||
bc44d920 | 31 | #if defined(SO_PEERCRED) && defined(AF_LOCAL) |
32 | # include <pwd.h> | |
33 | #endif /* SO_PEERCRED && AF_LOCAL */ | |
34 | ||
ef416fc2 | 35 | |
36 | /* | |
37 | * Local functions... | |
38 | */ | |
39 | ||
7ec11630 MS |
40 | static const char *cups_auth_find(const char *www_authenticate, const char *scheme); |
41 | static const char *cups_auth_param(const char *scheme, const char *name, char *value, size_t valsize); | |
42 | static const char *cups_auth_scheme(const char *www_authenticate, char *scheme, size_t schemesize); | |
43 | ||
f7deaa1a | 44 | #ifdef HAVE_GSSAPI |
1ce6909d MS |
45 | # define CUPS_GSS_OK 0 /* Successfully set credentials */ |
46 | # define CUPS_GSS_NONE -1 /* No credentials */ | |
47 | # define CUPS_GSS_FAIL -2 /* Failed credentials/authentication */ | |
eac3a0a0 MS |
48 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
49 | # ifdef HAVE_GSS_GSSAPI_SPI_H | |
50 | # include <GSS/gssapi_spi.h> | |
51 | # else | |
a2326b5b MS |
52 | # define GSS_AUTH_IDENTITY_TYPE_1 1 |
53 | # define gss_acquire_cred_ex_f __ApplePrivate_gss_acquire_cred_ex_f | |
53af7f21 | 54 | typedef struct gss_auth_identity /* @private@ */ |
eac3a0a0 MS |
55 | { |
56 | uint32_t type; | |
57 | uint32_t flags; | |
58 | char *username; | |
59 | char *realm; | |
60 | char *password; | |
61 | gss_buffer_t *credentialsRef; | |
49c59293 | 62 | } gss_auth_identity_desc; |
eac3a0a0 MS |
63 | extern OM_uint32 gss_acquire_cred_ex_f(gss_status_id_t, const gss_name_t, |
64 | OM_uint32, OM_uint32, const gss_OID, | |
65 | gss_cred_usage_t, gss_auth_identity_t, | |
66 | void *, void (*)(void *, OM_uint32, | |
67 | gss_status_id_t, | |
68 | gss_cred_id_t, | |
69 | gss_OID_set, | |
70 | OM_uint32)); | |
71 | # endif /* HAVE_GSS_GSSAPI_SPI_H */ | |
72 | # include <dispatch/dispatch.h> | |
73 | typedef struct _cups_gss_acquire_s /* Acquire callback data */ | |
74 | { | |
75 | dispatch_semaphore_t sem; /* Synchronization semaphore */ | |
76 | OM_uint32 major; /* Returned status code */ | |
77 | gss_cred_id_t creds; /* Returned credentials */ | |
78 | } _cups_gss_acquire_t; | |
79 | ||
80 | static void cups_gss_acquire(void *ctx, OM_uint32 major, | |
81 | gss_status_id_t status, | |
82 | gss_cred_id_t creds, gss_OID_set oids, | |
83 | OM_uint32 time_rec); | |
84 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
85 | static gss_name_t cups_gss_getname(http_t *http, const char *service_name); | |
f7deaa1a | 86 | # ifdef DEBUG |
e07d4801 MS |
87 | static void cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status, |
88 | const char *message); | |
355e94dc | 89 | # else |
e07d4801 MS |
90 | # define cups_gss_printf(major, minor, message) |
91 | # endif /* DEBUG */ | |
f7deaa1a | 92 | #endif /* HAVE_GSSAPI */ |
064e50fb | 93 | static int cups_is_local_connection(http_t *http); |
ef416fc2 | 94 | static int cups_local_auth(http_t *http); |
95 | ||
96 | ||
97 | /* | |
98 | * 'cupsDoAuthentication()' - Authenticate a request. | |
99 | * | |
cb7f98ee | 100 | * This function should be called in response to a @code HTTP_STATUS_UNAUTHORIZED@ |
ef416fc2 | 101 | * status, prior to resubmitting your request. |
102 | * | |
8072030b | 103 | * @since CUPS 1.1.20/macOS 10.4@ |
ef416fc2 | 104 | */ |
105 | ||
106 | int /* O - 0 on success, -1 on error */ | |
f11a948a MS |
107 | cupsDoAuthentication( |
108 | http_t *http, /* I - Connection to server or @code CUPS_HTTP_DEFAULT@ */ | |
109 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
110 | const char *resource) /* I - Resource path */ | |
ef416fc2 | 111 | { |
3e7fe0ca | 112 | const char *password, /* Password string */ |
7ec11630 MS |
113 | *www_auth, /* WWW-Authenticate header */ |
114 | *schemedata; /* Scheme-specific data */ | |
115 | char scheme[256], /* Scheme name */ | |
16f67389 | 116 | prompt[1024]; /* Prompt for user */ |
f7deaa1a | 117 | int localauth; /* Local authentication result */ |
b86bc4cf | 118 | _cups_globals_t *cg; /* Global data */ |
ef416fc2 | 119 | |
120 | ||
807315e6 | 121 | DEBUG_printf(("cupsDoAuthentication(http=%p, method=\"%s\", resource=\"%s\")", (void *)http, method, resource)); |
ef416fc2 | 122 | |
f11a948a MS |
123 | if (!http) |
124 | http = _cupsConnect(); | |
125 | ||
126 | if (!http || !method || !resource) | |
127 | return (-1); | |
128 | ||
5a6b583a MS |
129 | DEBUG_printf(("2cupsDoAuthentication: digest_tries=%d, userpass=\"%s\"", |
130 | http->digest_tries, http->userpass)); | |
131 | DEBUG_printf(("2cupsDoAuthentication: WWW-Authenticate=\"%s\"", | |
132 | httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE))); | |
133 | ||
ef416fc2 | 134 | /* |
135 | * Clear the current authentication string... | |
136 | */ | |
137 | ||
355e94dc | 138 | httpSetAuthString(http, NULL, NULL); |
ef416fc2 | 139 | |
140 | /* | |
141 | * See if we can do local authentication... | |
142 | */ | |
143 | ||
f7deaa1a | 144 | if (http->digest_tries < 3) |
ef416fc2 | 145 | { |
f7deaa1a | 146 | if ((localauth = cups_local_auth(http)) == 0) |
147 | { | |
e07d4801 | 148 | DEBUG_printf(("2cupsDoAuthentication: authstring=\"%s\"", |
f7deaa1a | 149 | http->authstring)); |
f14324a7 | 150 | |
cb7f98ee | 151 | if (http->status == HTTP_STATUS_UNAUTHORIZED) |
f7deaa1a | 152 | http->digest_tries ++; |
f14324a7 | 153 | |
f7deaa1a | 154 | return (0); |
155 | } | |
156 | else if (localauth == -1) | |
f11a948a | 157 | { |
cb7f98ee | 158 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
f7deaa1a | 159 | return (-1); /* Error or canceled */ |
f11a948a | 160 | } |
ef416fc2 | 161 | } |
162 | ||
163 | /* | |
7ec11630 | 164 | * Nope, loop through the authentication schemes to find the first we support. |
ef416fc2 | 165 | */ |
166 | ||
7ec11630 | 167 | www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE); |
3e7fe0ca | 168 | |
7ec11630 | 169 | for (schemedata = cups_auth_scheme(www_auth, scheme, sizeof(scheme)); schemedata; schemedata = cups_auth_scheme(schemedata + strlen(scheme), scheme, sizeof(scheme))) |
ef416fc2 | 170 | { |
171 | /* | |
7ec11630 | 172 | * Check the scheme name... |
ef416fc2 | 173 | */ |
174 | ||
1ce6909d MS |
175 | DEBUG_printf(("2cupsDoAuthentication: Trying scheme \"%s\"...", scheme)); |
176 | ||
7ec11630 | 177 | #ifdef HAVE_GSSAPI |
064e50fb | 178 | if (!_cups_strcasecmp(scheme, "Negotiate") && !cups_is_local_connection(http)) |
7ec11630 MS |
179 | { |
180 | /* | |
064e50fb | 181 | * Kerberos authentication to remote server... |
7ec11630 | 182 | */ |
5a9febac | 183 | |
1ce6909d MS |
184 | int gss_status; /* Auth status */ |
185 | ||
186 | if ((gss_status = _cupsSetNegotiateAuthString(http, method, resource)) == CUPS_GSS_FAIL) | |
7ec11630 | 187 | { |
1ce6909d | 188 | DEBUG_puts("1cupsDoAuthentication: Negotiate failed."); |
7ec11630 MS |
189 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
190 | return (-1); | |
191 | } | |
1ce6909d MS |
192 | else if (gss_status == CUPS_GSS_NONE) |
193 | { | |
194 | DEBUG_puts("2cupsDoAuthentication: No credentials for Negotiate."); | |
195 | continue; | |
196 | } | |
197 | else | |
198 | { | |
199 | DEBUG_puts("2cupsDoAuthentication: Using Negotiate."); | |
200 | break; | |
201 | } | |
7ec11630 MS |
202 | } |
203 | else | |
204 | #endif /* HAVE_GSSAPI */ | |
064e50fb MS |
205 | if (_cups_strcasecmp(scheme, "Basic") && |
206 | _cups_strcasecmp(scheme, "Digest") && | |
207 | _cups_strcasecmp(scheme, "Negotiate")) | |
1ce6909d MS |
208 | { |
209 | /* | |
210 | * Other schemes not yet supported... | |
211 | */ | |
212 | ||
213 | DEBUG_printf(("2cupsDoAuthentication: Scheme \"%s\" not yet supported.", scheme)); | |
214 | continue; | |
215 | } | |
b86bc4cf | 216 | |
7ec11630 MS |
217 | /* |
218 | * See if we should retry the current username:password... | |
219 | */ | |
5a9febac | 220 | |
064e50fb | 221 | if (http->digest_tries > 1 || !http->userpass[0]) |
7ec11630 MS |
222 | { |
223 | /* | |
224 | * Nope - get a new password from the user... | |
225 | */ | |
ef416fc2 | 226 | |
7ec11630 MS |
227 | char default_username[HTTP_MAX_VALUE]; |
228 | /* Default username */ | |
ef416fc2 | 229 | |
7ec11630 | 230 | cg = _cupsGlobals(); |
ef416fc2 | 231 | |
7ec11630 MS |
232 | if (!cg->lang_default) |
233 | cg->lang_default = cupsLangDefault(); | |
ef416fc2 | 234 | |
44cb0dd2 | 235 | if (cups_auth_param(schemedata, "username", default_username, sizeof(default_username))) |
7ec11630 | 236 | cupsSetUser(default_username); |
5a6b583a | 237 | |
7ec11630 | 238 | snprintf(prompt, sizeof(prompt), _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), cupsUser(), http->hostname[0] == '/' ? "localhost" : http->hostname); |
5a6b583a | 239 | |
7ec11630 MS |
240 | http->digest_tries = _cups_strncasecmp(scheme, "Digest", 6) != 0; |
241 | http->userpass[0] = '\0'; | |
ef416fc2 | 242 | |
7ec11630 MS |
243 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) |
244 | { | |
1ce6909d | 245 | DEBUG_puts("1cupsDoAuthentication: User canceled password request."); |
7ec11630 MS |
246 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
247 | return (-1); | |
248 | } | |
f7deaa1a | 249 | |
7ec11630 MS |
250 | snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), password); |
251 | } | |
252 | else if (http->status == HTTP_STATUS_UNAUTHORIZED) | |
253 | http->digest_tries ++; | |
254 | ||
255 | if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3) | |
f7deaa1a | 256 | { |
7ec11630 MS |
257 | DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", http->digest_tries)); |
258 | ||
cb7f98ee | 259 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
f7deaa1a | 260 | return (-1); |
261 | } | |
7ec11630 | 262 | |
ef416fc2 | 263 | /* |
7ec11630 | 264 | * Got a password; encode it for the server... |
ef416fc2 | 265 | */ |
266 | ||
7ec11630 MS |
267 | if (!_cups_strcasecmp(scheme, "Basic")) |
268 | { | |
269 | /* | |
270 | * Basic authentication... | |
271 | */ | |
5a738aea | 272 | |
7ec11630 | 273 | char encode[256]; /* Base64 buffer */ |
5a738aea | 274 | |
1ce6909d | 275 | DEBUG_puts("2cupsDoAuthentication: Using Basic."); |
7ec11630 MS |
276 | httpEncode64_2(encode, sizeof(encode), http->userpass, (int)strlen(http->userpass)); |
277 | httpSetAuthString(http, "Basic", encode); | |
16f67389 | 278 | break; |
7ec11630 MS |
279 | } |
280 | else if (!_cups_strcasecmp(scheme, "Digest")) | |
281 | { | |
282 | /* | |
283 | * Digest authentication... | |
284 | */ | |
285 | ||
16f67389 MS |
286 | char nonce[HTTP_MAX_VALUE]; /* nonce="xyz" string */ |
287 | ||
288 | cups_auth_param(schemedata, "algorithm", http->algorithm, sizeof(http->algorithm)); | |
289 | cups_auth_param(schemedata, "opaque", http->opaque, sizeof(http->opaque)); | |
290 | cups_auth_param(schemedata, "nonce", nonce, sizeof(nonce)); | |
291 | cups_auth_param(schemedata, "realm", http->realm, sizeof(http->realm)); | |
7ec11630 | 292 | |
5737d5eb | 293 | if (_httpSetDigestAuthString(http, nonce, method, resource)) |
1ce6909d | 294 | { |
ec8beb89 | 295 | DEBUG_puts("2cupsDoAuthentication: Using Digest."); |
16f67389 | 296 | break; |
1ce6909d | 297 | } |
7ec11630 MS |
298 | } |
299 | } | |
300 | ||
064e50fb | 301 | if (http->authstring && http->authstring[0]) |
7ec11630 | 302 | { |
1ce6909d | 303 | DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\".", http->authstring)); |
7ec11630 MS |
304 | |
305 | return (0); | |
ef416fc2 | 306 | } |
f14324a7 MS |
307 | else |
308 | { | |
1ce6909d | 309 | DEBUG_puts("1cupsDoAuthentication: No supported schemes."); |
cb7f98ee | 310 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
7ec11630 | 311 | |
f14324a7 MS |
312 | return (-1); |
313 | } | |
ef416fc2 | 314 | } |
315 | ||
316 | ||
f7deaa1a | 317 | #ifdef HAVE_GSSAPI |
f14324a7 MS |
318 | /* |
319 | * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string. | |
320 | */ | |
321 | ||
1ce6909d | 322 | int /* O - 0 on success, negative on error */ |
f14324a7 | 323 | _cupsSetNegotiateAuthString( |
eac3a0a0 MS |
324 | http_t *http, /* I - Connection to server */ |
325 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
326 | const char *resource) /* I - Resource path */ | |
f14324a7 MS |
327 | { |
328 | OM_uint32 minor_status, /* Minor status code */ | |
329 | major_status; /* Major status code */ | |
330 | gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; | |
07ed0e9a | 331 | /* Output token */ |
f14324a7 MS |
332 | |
333 | ||
321d8d57 MS |
334 | (void)method; |
335 | (void)resource; | |
336 | ||
f14324a7 MS |
337 | # ifdef __APPLE__ |
338 | /* | |
339 | * If the weak-linked GSSAPI/Kerberos library is not present, don't try | |
340 | * to use it... | |
341 | */ | |
342 | ||
6d8021f4 | 343 | if (&gss_init_sec_context == NULL) |
f14324a7 MS |
344 | { |
345 | DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos " | |
346 | "framework is not present"); | |
1ce6909d | 347 | return (CUPS_GSS_NONE); |
f14324a7 MS |
348 | } |
349 | # endif /* __APPLE__ */ | |
350 | ||
1ce6909d MS |
351 | if (!strcmp(http->hostname, "localhost") || http->hostname[0] == '/' || isdigit(http->hostname[0] & 255) || !strchr(http->hostname, '.')) |
352 | { | |
353 | DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos not available for host \"%s\".", http->hostname)); | |
354 | return (CUPS_GSS_NONE); | |
355 | } | |
356 | ||
f14324a7 MS |
357 | if (http->gssname == GSS_C_NO_NAME) |
358 | { | |
eac3a0a0 | 359 | http->gssname = cups_gss_getname(http, _cupsGSSServiceName()); |
f14324a7 MS |
360 | } |
361 | ||
362 | if (http->gssctx != GSS_C_NO_CONTEXT) | |
363 | { | |
364 | gss_delete_sec_context(&minor_status, &http->gssctx, GSS_C_NO_BUFFER); | |
365 | http->gssctx = GSS_C_NO_CONTEXT; | |
366 | } | |
367 | ||
eac3a0a0 MS |
368 | major_status = gss_init_sec_context(&minor_status, GSS_C_NO_CREDENTIAL, |
369 | &http->gssctx, | |
370 | http->gssname, http->gssmech, | |
371 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
372 | GSS_C_INDEFINITE, | |
373 | GSS_C_NO_CHANNEL_BINDINGS, | |
374 | GSS_C_NO_BUFFER, &http->gssmech, | |
375 | &output_token, NULL, NULL); | |
376 | ||
accedcf8 | 377 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
eac3a0a0 MS |
378 | if (major_status == GSS_S_NO_CRED) |
379 | { | |
380 | /* | |
381 | * Ask the user for credentials... | |
382 | */ | |
383 | ||
384 | char prompt[1024], /* Prompt for user */ | |
385 | userbuf[256]; /* Kerberos username */ | |
386 | const char *username, /* Username string */ | |
387 | *password; /* Password string */ | |
388 | _cups_gss_acquire_t data; /* Callback data */ | |
49c59293 | 389 | gss_auth_identity_desc identity; /* Kerberos user identity */ |
eac3a0a0 MS |
390 | _cups_globals_t *cg = _cupsGlobals(); |
391 | /* Per-thread global data */ | |
392 | ||
393 | if (!cg->lang_default) | |
394 | cg->lang_default = cupsLangDefault(); | |
395 | ||
396 | snprintf(prompt, sizeof(prompt), | |
397 | _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), | |
f228370c | 398 | cupsUser(), http->gsshost); |
eac3a0a0 MS |
399 | |
400 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) | |
1ce6909d | 401 | return (CUPS_GSS_FAIL); |
eac3a0a0 MS |
402 | |
403 | /* | |
404 | * Try to acquire credentials... | |
405 | */ | |
406 | ||
407 | username = cupsUser(); | |
408 | if (!strchr(username, '@')) | |
409 | { | |
f228370c | 410 | snprintf(userbuf, sizeof(userbuf), "%s@%s", username, http->gsshost); |
eac3a0a0 MS |
411 | username = userbuf; |
412 | } | |
413 | ||
414 | identity.type = GSS_AUTH_IDENTITY_TYPE_1; | |
415 | identity.flags = 0; | |
416 | identity.username = (char *)username; | |
417 | identity.realm = (char *)""; | |
418 | identity.password = (char *)password; | |
419 | identity.credentialsRef = NULL; | |
420 | ||
421 | data.sem = dispatch_semaphore_create(0); | |
422 | data.major = 0; | |
423 | data.creds = NULL; | |
424 | ||
425 | if (data.sem) | |
426 | { | |
5dcbe84d | 427 | major_status = gss_acquire_cred_ex_f(NULL, GSS_C_NO_NAME, 0, GSS_C_INDEFINITE, GSS_KRB5_MECHANISM, GSS_C_INITIATE, (gss_auth_identity_t)&identity, &data, cups_gss_acquire); |
eac3a0a0 MS |
428 | |
429 | if (major_status == GSS_S_COMPLETE) | |
430 | { | |
431 | dispatch_semaphore_wait(data.sem, DISPATCH_TIME_FOREVER); | |
432 | major_status = data.major; | |
433 | } | |
434 | ||
435 | dispatch_release(data.sem); | |
436 | ||
437 | if (major_status == GSS_S_COMPLETE) | |
438 | { | |
439 | OM_uint32 release_minor; /* Minor status from releasing creds */ | |
440 | ||
441 | major_status = gss_init_sec_context(&minor_status, data.creds, | |
442 | &http->gssctx, | |
443 | http->gssname, http->gssmech, | |
444 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
445 | GSS_C_INDEFINITE, | |
446 | GSS_C_NO_CHANNEL_BINDINGS, | |
447 | GSS_C_NO_BUFFER, &http->gssmech, | |
448 | &output_token, NULL, NULL); | |
449 | gss_release_cred(&release_minor, &data.creds); | |
450 | } | |
451 | } | |
452 | } | |
accedcf8 | 453 | # endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */ |
f14324a7 | 454 | |
1ce6909d | 455 | if (major_status == GSS_S_NO_CRED) |
f14324a7 | 456 | { |
1ce6909d MS |
457 | cups_gss_printf(major_status, minor_status, "_cupsSetNegotiateAuthString: No credentials"); |
458 | return (CUPS_GSS_NONE); | |
459 | } | |
460 | else if (GSS_ERROR(major_status)) | |
461 | { | |
462 | cups_gss_printf(major_status, minor_status, "_cupsSetNegotiateAuthString: Unable to initialize security context"); | |
463 | return (CUPS_GSS_FAIL); | |
f14324a7 MS |
464 | } |
465 | ||
accedcf8 | 466 | # ifdef DEBUG |
eac3a0a0 | 467 | else if (major_status == GSS_S_CONTINUE_NEEDED) |
1ce6909d | 468 | cups_gss_printf(major_status, minor_status, "_cupsSetNegotiateAuthString: Continuation needed"); |
accedcf8 | 469 | # endif /* DEBUG */ |
f14324a7 MS |
470 | |
471 | if (output_token.length > 0 && output_token.length <= 65536) | |
472 | { | |
473 | /* | |
474 | * Allocate the authorization string since Windows KDCs can have | |
475 | * arbitrarily large credentials... | |
476 | */ | |
477 | ||
7e86f2f6 | 478 | int authsize = 10 + /* "Negotiate " */ |
cee8cdad | 479 | (((int)output_token.length * 4 / 3 + 3) & ~3) + 1; |
7e86f2f6 | 480 | /* Base64 + nul */ |
f14324a7 MS |
481 | |
482 | httpSetAuthString(http, NULL, NULL); | |
483 | ||
7e86f2f6 | 484 | if ((http->authstring = malloc((size_t)authsize)) == NULL) |
f14324a7 MS |
485 | { |
486 | http->authstring = http->_authstring; | |
487 | authsize = sizeof(http->_authstring); | |
488 | } | |
489 | ||
07623986 | 490 | strlcpy(http->authstring, "Negotiate ", (size_t)authsize); |
f14324a7 | 491 | httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value, |
7e86f2f6 | 492 | (int)output_token.length); |
f14324a7 MS |
493 | |
494 | gss_release_buffer(&minor_status, &output_token); | |
495 | } | |
496 | else | |
497 | { | |
498 | DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos credentials too " | |
499 | "large - %d bytes!", (int)output_token.length)); | |
500 | gss_release_buffer(&minor_status, &output_token); | |
501 | ||
1ce6909d | 502 | return (CUPS_GSS_FAIL); |
f14324a7 MS |
503 | } |
504 | ||
1ce6909d | 505 | return (CUPS_GSS_OK); |
f14324a7 | 506 | } |
accedcf8 | 507 | #endif /* HAVE_GSSAPI */ |
f14324a7 MS |
508 | |
509 | ||
7ec11630 MS |
510 | /* |
511 | * 'cups_auth_find()' - Find the named WWW-Authenticate scheme. | |
512 | * | |
513 | * The "www_authenticate" parameter points to the current position in the header. | |
514 | * | |
515 | * Returns @code NULL@ if the auth scheme is not present. | |
516 | */ | |
517 | ||
518 | static const char * /* O - Start of matching scheme or @code NULL@ if not found */ | |
519 | cups_auth_find(const char *www_authenticate, /* I - Pointer into WWW-Authenticate header */ | |
520 | const char *scheme) /* I - Authentication scheme */ | |
521 | { | |
522 | size_t schemelen = strlen(scheme); /* Length of scheme */ | |
523 | ||
524 | ||
91bc88eb MS |
525 | DEBUG_printf(("8cups_auth_find(www_authenticate=\"%s\", scheme=\"%s\"(%d))", www_authenticate, scheme, (int)schemelen)); |
526 | ||
7ec11630 MS |
527 | while (*www_authenticate) |
528 | { | |
529 | /* | |
530 | * Skip leading whitespace and commas... | |
531 | */ | |
532 | ||
91bc88eb | 533 | DEBUG_printf(("9cups_auth_find: Before whitespace: \"%s\"", www_authenticate)); |
7ec11630 MS |
534 | while (isspace(*www_authenticate & 255) || *www_authenticate == ',') |
535 | www_authenticate ++; | |
91bc88eb | 536 | DEBUG_printf(("9cups_auth_find: After whitespace: \"%s\"", www_authenticate)); |
7ec11630 MS |
537 | |
538 | /* | |
539 | * See if this is "Scheme" followed by whitespace or the end of the string. | |
540 | */ | |
541 | ||
c944b62b | 542 | if (!strncmp(www_authenticate, scheme, schemelen) && (isspace(www_authenticate[schemelen] & 255) || www_authenticate[schemelen] == ',' || !www_authenticate[schemelen])) |
7ec11630 MS |
543 | { |
544 | /* | |
545 | * Yes, this is the start of the scheme-specific information... | |
546 | */ | |
547 | ||
91bc88eb MS |
548 | DEBUG_printf(("9cups_auth_find: Returning \"%s\".", www_authenticate)); |
549 | ||
7ec11630 MS |
550 | return (www_authenticate); |
551 | } | |
552 | ||
553 | /* | |
554 | * Skip the scheme name or param="value" string... | |
555 | */ | |
556 | ||
557 | while (!isspace(*www_authenticate & 255) && *www_authenticate) | |
558 | { | |
559 | if (*www_authenticate == '\"') | |
560 | { | |
561 | /* | |
562 | * Skip quoted value... | |
563 | */ | |
564 | ||
91bc88eb MS |
565 | www_authenticate ++; |
566 | while (*www_authenticate && *www_authenticate != '\"') | |
7ec11630 | 567 | www_authenticate ++; |
91bc88eb MS |
568 | |
569 | DEBUG_printf(("9cups_auth_find: After quoted: \"%s\"", www_authenticate)); | |
7ec11630 MS |
570 | } |
571 | ||
572 | www_authenticate ++; | |
573 | } | |
91bc88eb MS |
574 | |
575 | DEBUG_printf(("9cups_auth_find: After skip: \"%s\"", www_authenticate)); | |
7ec11630 MS |
576 | } |
577 | ||
91bc88eb MS |
578 | DEBUG_puts("9cups_auth_find: Returning NULL."); |
579 | ||
7ec11630 MS |
580 | return (NULL); |
581 | } | |
582 | ||
583 | ||
584 | /* | |
585 | * 'cups_auth_param()' - Copy the value for the named authentication parameter, | |
586 | * if present. | |
587 | */ | |
588 | ||
589 | static const char * /* O - Parameter value or @code NULL@ if not present */ | |
590 | cups_auth_param(const char *scheme, /* I - Pointer to auth data */ | |
591 | const char *name, /* I - Name of parameter */ | |
592 | char *value, /* I - Value buffer */ | |
593 | size_t valsize) /* I - Size of value buffer */ | |
594 | { | |
595 | char *valptr = value, /* Pointer into value buffer */ | |
596 | *valend = value + valsize - 1; /* Pointer to end of buffer */ | |
597 | size_t namelen = strlen(name); /* Name length */ | |
598 | int param; /* Is this a parameter? */ | |
599 | ||
600 | ||
91bc88eb MS |
601 | DEBUG_printf(("8cups_auth_param(scheme=\"%s\", name=\"%s\", value=%p, valsize=%d)", scheme, name, (void *)value, (int)valsize)); |
602 | ||
7ec11630 MS |
603 | while (!isspace(*scheme & 255) && *scheme) |
604 | scheme ++; | |
605 | ||
606 | while (*scheme) | |
607 | { | |
608 | while (isspace(*scheme & 255) || *scheme == ',') | |
609 | scheme ++; | |
610 | ||
611 | if (!strncmp(scheme, name, namelen) && scheme[namelen] == '=') | |
612 | { | |
613 | /* | |
614 | * Found the parameter, copy the value... | |
615 | */ | |
616 | ||
617 | scheme += namelen + 1; | |
618 | if (*scheme == '\"') | |
619 | { | |
620 | scheme ++; | |
621 | ||
622 | while (*scheme && *scheme != '\"') | |
623 | { | |
624 | if (valptr < valend) | |
625 | *valptr++ = *scheme; | |
626 | ||
627 | scheme ++; | |
628 | } | |
629 | } | |
630 | else | |
631 | { | |
632 | while (*scheme && strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~+/=", *scheme)) | |
633 | { | |
634 | if (valptr < valend) | |
635 | *valptr++ = *scheme; | |
636 | ||
637 | scheme ++; | |
638 | } | |
639 | } | |
640 | ||
641 | *valptr = '\0'; | |
642 | ||
91bc88eb MS |
643 | DEBUG_printf(("9cups_auth_param: Returning \"%s\".", value)); |
644 | ||
7ec11630 MS |
645 | return (value); |
646 | } | |
647 | ||
648 | /* | |
649 | * Skip the param=value string... | |
650 | */ | |
651 | ||
652 | param = 0; | |
653 | ||
654 | while (!isspace(*scheme & 255) && *scheme) | |
655 | { | |
656 | if (*scheme == '=') | |
657 | param = 1; | |
658 | else if (*scheme == '\"') | |
659 | { | |
660 | /* | |
661 | * Skip quoted value... | |
662 | */ | |
663 | ||
91bc88eb MS |
664 | scheme ++; |
665 | while (*scheme && *scheme != '\"') | |
7ec11630 MS |
666 | scheme ++; |
667 | } | |
668 | ||
669 | scheme ++; | |
670 | } | |
671 | ||
672 | /* | |
673 | * If this wasn't a parameter, we are at the end of this scheme's | |
674 | * parameters... | |
675 | */ | |
676 | ||
677 | if (!param) | |
678 | break; | |
679 | } | |
680 | ||
681 | *value = '\0'; | |
682 | ||
91bc88eb MS |
683 | DEBUG_puts("9cups_auth_param: Returning NULL."); |
684 | ||
7ec11630 MS |
685 | return (NULL); |
686 | } | |
687 | ||
688 | ||
689 | /* | |
690 | * 'cups_auth_scheme()' - Get the (next) WWW-Authenticate scheme. | |
691 | * | |
692 | * The "www_authenticate" parameter points to the current position in the header. | |
693 | * | |
694 | * Returns @code NULL@ if there are no (more) auth schemes present. | |
695 | */ | |
696 | ||
697 | static const char * /* O - Start of scheme or @code NULL@ if not found */ | |
698 | cups_auth_scheme(const char *www_authenticate, /* I - Pointer into WWW-Authenticate header */ | |
699 | char *scheme, /* I - Scheme name buffer */ | |
700 | size_t schemesize) /* I - Size of buffer */ | |
701 | { | |
702 | const char *start; /* Start of scheme data */ | |
703 | char *sptr = scheme, /* Pointer into scheme buffer */ | |
704 | *send = scheme + schemesize - 1;/* End of scheme buffer */ | |
705 | int param; /* Is this a parameter? */ | |
706 | ||
707 | ||
91bc88eb MS |
708 | DEBUG_printf(("8cups_auth_scheme(www_authenticate=\"%s\", scheme=%p, schemesize=%d)", www_authenticate, (void *)scheme, (int)schemesize)); |
709 | ||
7ec11630 MS |
710 | while (*www_authenticate) |
711 | { | |
712 | /* | |
713 | * Skip leading whitespace and commas... | |
714 | */ | |
715 | ||
716 | while (isspace(*www_authenticate & 255) || *www_authenticate == ',') | |
717 | www_authenticate ++; | |
718 | ||
719 | /* | |
720 | * Parse the scheme name or param="value" string... | |
721 | */ | |
722 | ||
44cb0dd2 | 723 | for (sptr = scheme, start = www_authenticate, param = 0; *www_authenticate && *www_authenticate != ',' && !isspace(*www_authenticate & 255); www_authenticate ++) |
7ec11630 MS |
724 | { |
725 | if (*www_authenticate == '=') | |
726 | param = 1; | |
727 | else if (!param && sptr < send) | |
728 | *sptr++ = *www_authenticate; | |
729 | else if (*www_authenticate == '\"') | |
730 | { | |
731 | /* | |
732 | * Skip quoted value... | |
733 | */ | |
734 | ||
91bc88eb MS |
735 | www_authenticate ++; |
736 | while (*www_authenticate && *www_authenticate != '\"') | |
7ec11630 MS |
737 | www_authenticate ++; |
738 | } | |
739 | } | |
740 | ||
741 | if (sptr > scheme && !param) | |
742 | { | |
743 | *sptr = '\0'; | |
91bc88eb MS |
744 | |
745 | DEBUG_printf(("9cups_auth_scheme: Returning \"%s\".", start)); | |
746 | ||
7ec11630 MS |
747 | return (start); |
748 | } | |
749 | } | |
750 | ||
751 | *scheme = '\0'; | |
752 | ||
91bc88eb MS |
753 | DEBUG_puts("9cups_auth_scheme: Returning NULL."); |
754 | ||
7ec11630 MS |
755 | return (NULL); |
756 | } | |
757 | ||
758 | ||
accedcf8 | 759 | #ifdef HAVE_GSSAPI |
eac3a0a0 | 760 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
f7deaa1a | 761 | /* |
eac3a0a0 MS |
762 | * 'cups_gss_acquire()' - Kerberos credentials callback. |
763 | */ | |
764 | static void | |
765 | cups_gss_acquire( | |
766 | void *ctx, /* I - Caller context */ | |
767 | OM_uint32 major, /* I - Major error code */ | |
768 | gss_status_id_t status, /* I - Status (unused) */ | |
769 | gss_cred_id_t creds, /* I - Credentials (if any) */ | |
770 | gss_OID_set oids, /* I - Mechanism OIDs (unused) */ | |
771 | OM_uint32 time_rec) /* I - Timestamp (unused) */ | |
772 | { | |
773 | uint32_t min; /* Minor error code */ | |
774 | _cups_gss_acquire_t *data; /* Callback data */ | |
775 | ||
776 | ||
777 | (void)status; | |
778 | (void)time_rec; | |
779 | ||
780 | data = (_cups_gss_acquire_t *)ctx; | |
781 | data->major = major; | |
782 | data->creds = creds; | |
783 | ||
784 | gss_release_oid_set(&min, &oids); | |
785 | dispatch_semaphore_signal(data->sem); | |
786 | } | |
787 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
788 | ||
789 | ||
790 | /* | |
791 | * 'cups_gss_getname()' - Get CUPS service credentials for authentication. | |
f7deaa1a | 792 | */ |
793 | ||
794 | static gss_name_t /* O - Server name */ | |
eac3a0a0 | 795 | cups_gss_getname( |
f7deaa1a | 796 | http_t *http, /* I - Connection to server */ |
797 | const char *service_name) /* I - Service name */ | |
798 | { | |
799 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | |
800 | /* Service token */ | |
bc44d920 | 801 | OM_uint32 major_status, /* Major status code */ |
802 | minor_status; /* Minor status code */ | |
803 | gss_name_t server_name; /* Server name */ | |
eac3a0a0 | 804 | char buf[1024]; /* Name buffer */ |
bc44d920 | 805 | |
806 | ||
eac3a0a0 | 807 | DEBUG_printf(("7cups_gss_getname(http=%p, service_name=\"%s\")", http, |
e07d4801 MS |
808 | service_name)); |
809 | ||
810 | ||
bc44d920 | 811 | /* |
812 | * Get the hostname... | |
813 | */ | |
f7deaa1a | 814 | |
eac3a0a0 MS |
815 | if (!http->gsshost[0]) |
816 | { | |
817 | httpGetHostname(http, http->gsshost, sizeof(http->gsshost)); | |
bc44d920 | 818 | |
eac3a0a0 MS |
819 | if (!strcmp(http->gsshost, "localhost")) |
820 | { | |
821 | if (gethostname(http->gsshost, sizeof(http->gsshost)) < 0) | |
822 | { | |
823 | DEBUG_printf(("1cups_gss_getname: gethostname() failed: %s", | |
824 | strerror(errno))); | |
825 | http->gsshost[0] = '\0'; | |
826 | return (NULL); | |
827 | } | |
828 | ||
829 | if (!strchr(http->gsshost, '.')) | |
830 | { | |
831 | /* | |
832 | * The hostname is not a FQDN, so look it up... | |
833 | */ | |
834 | ||
835 | struct hostent *host; /* Host entry to get FQDN */ | |
836 | ||
837 | if ((host = gethostbyname(http->gsshost)) != NULL && host->h_name) | |
838 | { | |
839 | /* | |
840 | * Use the resolved hostname... | |
841 | */ | |
842 | ||
843 | strlcpy(http->gsshost, host->h_name, sizeof(http->gsshost)); | |
844 | } | |
845 | else | |
846 | { | |
847 | DEBUG_printf(("1cups_gss_getname: gethostbyname(\"%s\") failed.", | |
848 | http->gsshost)); | |
849 | http->gsshost[0] = '\0'; | |
850 | return (NULL); | |
851 | } | |
852 | } | |
853 | } | |
854 | } | |
f7deaa1a | 855 | |
856 | /* | |
eac3a0a0 | 857 | * Get a service name we can use for authentication purposes... |
f7deaa1a | 858 | */ |
859 | ||
eac3a0a0 | 860 | snprintf(buf, sizeof(buf), "%s@%s", service_name, http->gsshost); |
f7deaa1a | 861 | |
eac3a0a0 | 862 | DEBUG_printf(("8cups_gss_getname: Looking up \"%s\".", buf)); |
7ff4fea9 | 863 | |
f7deaa1a | 864 | token.value = buf; |
865 | token.length = strlen(buf); | |
866 | server_name = GSS_C_NO_NAME; | |
867 | major_status = gss_import_name(&minor_status, &token, | |
868 | GSS_C_NT_HOSTBASED_SERVICE, | |
869 | &server_name); | |
870 | ||
871 | if (GSS_ERROR(major_status)) | |
872 | { | |
e07d4801 | 873 | cups_gss_printf(major_status, minor_status, |
eac3a0a0 | 874 | "cups_gss_getname: gss_import_name() failed"); |
f7deaa1a | 875 | return (NULL); |
876 | } | |
877 | ||
878 | return (server_name); | |
879 | } | |
e07d4801 MS |
880 | |
881 | ||
882 | # ifdef DEBUG | |
883 | /* | |
eac3a0a0 | 884 | * 'cups_gss_printf()' - Show debug error messages from GSSAPI. |
e07d4801 MS |
885 | */ |
886 | ||
887 | static void | |
888 | cups_gss_printf(OM_uint32 major_status,/* I - Major status code */ | |
889 | OM_uint32 minor_status,/* I - Minor status code */ | |
890 | const char *message) /* I - Prefix for error message */ | |
891 | { | |
892 | OM_uint32 err_major_status, /* Major status code for display */ | |
893 | err_minor_status; /* Minor status code for display */ | |
894 | OM_uint32 msg_ctx; /* Message context */ | |
895 | gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER, | |
896 | /* Major status message */ | |
897 | minor_status_string = GSS_C_EMPTY_BUFFER; | |
898 | /* Minor status message */ | |
899 | ||
900 | ||
901 | msg_ctx = 0; | |
902 | err_major_status = gss_display_status(&err_minor_status, | |
903 | major_status, | |
904 | GSS_C_GSS_CODE, | |
905 | GSS_C_NO_OID, | |
906 | &msg_ctx, | |
907 | &major_status_string); | |
908 | ||
909 | if (!GSS_ERROR(err_major_status)) | |
910 | gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE, | |
911 | GSS_C_NULL_OID, &msg_ctx, &minor_status_string); | |
912 | ||
68b10830 | 913 | DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value, |
e07d4801 MS |
914 | (char *)minor_status_string.value)); |
915 | ||
916 | gss_release_buffer(&err_minor_status, &major_status_string); | |
917 | gss_release_buffer(&err_minor_status, &minor_status_string); | |
918 | } | |
919 | # endif /* DEBUG */ | |
f7deaa1a | 920 | #endif /* HAVE_GSSAPI */ |
921 | ||
064e50fb MS |
922 | static int /* O - 0 if not a local connection */ |
923 | /* 1 if local connection */ | |
924 | cups_is_local_connection(http_t *http) /* I - HTTP connection to server */ | |
925 | { | |
926 | if (!httpAddrLocalhost(http->hostaddr) && _cups_strcasecmp(http->hostname, "localhost") != 0) | |
927 | return 0; | |
928 | return 1; | |
929 | } | |
f7deaa1a | 930 | |
ef416fc2 | 931 | /* |
932 | * 'cups_local_auth()' - Get the local authorization certificate if | |
eac3a0a0 | 933 | * available/applicable. |
ef416fc2 | 934 | */ |
935 | ||
f7deaa1a | 936 | static int /* O - 0 if available */ |
bc44d920 | 937 | /* 1 if not available */ |
f7deaa1a | 938 | /* -1 error */ |
ef416fc2 | 939 | cups_local_auth(http_t *http) /* I - HTTP connection to server */ |
940 | { | |
19dc16f7 | 941 | #if defined(_WIN32) || defined(__EMX__) |
ef416fc2 | 942 | /* |
19dc16f7 | 943 | * Currently _WIN32 and OS-2 do not support the CUPS server... |
ef416fc2 | 944 | */ |
945 | ||
bc44d920 | 946 | return (1); |
ef416fc2 | 947 | #else |
f7deaa1a | 948 | int pid; /* Current process ID */ |
949 | FILE *fp; /* Certificate file */ | |
e07d4801 | 950 | char trc[16], /* Try Root Certificate parameter */ |
6961465f | 951 | filename[1024]; /* Certificate filename */ |
7ec11630 MS |
952 | const char *www_auth, /* WWW-Authenticate header */ |
953 | *schemedata; /* Data for the named auth scheme */ | |
ef416fc2 | 954 | _cups_globals_t *cg = _cupsGlobals(); /* Global data */ |
bc44d920 | 955 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 956 | OSStatus status; /* Status */ |
957 | AuthorizationItem auth_right; /* Authorization right */ | |
958 | AuthorizationRights auth_rights; /* Authorization rights */ | |
959 | AuthorizationFlags auth_flags; /* Authorization flags */ | |
960 | AuthorizationExternalForm auth_extrn; /* Authorization ref external */ | |
961 | char auth_key[1024]; /* Buffer */ | |
962 | char buffer[1024]; /* Buffer */ | |
bc44d920 | 963 | # endif /* HAVE_AUTHORIZATION_H */ |
ef416fc2 | 964 | |
965 | ||
807315e6 | 966 | DEBUG_printf(("7cups_local_auth(http=%p) hostaddr=%s, hostname=\"%s\"", (void *)http, httpAddrString(http->hostaddr, filename, sizeof(filename)), http->hostname)); |
ef416fc2 | 967 | |
968 | /* | |
969 | * See if we are accessing localhost... | |
970 | */ | |
971 | ||
064e50fb | 972 | if (!cups_is_local_connection(http)) |
ef416fc2 | 973 | { |
e07d4801 | 974 | DEBUG_puts("8cups_local_auth: Not a local connection!"); |
bc44d920 | 975 | return (1); |
ef416fc2 | 976 | } |
977 | ||
accedcf8 MS |
978 | www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE); |
979 | ||
bc44d920 | 980 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 981 | /* |
982 | * Delete any previous authorization reference... | |
983 | */ | |
f14324a7 | 984 | |
b94498cf | 985 | if (http->auth_ref) |
f7deaa1a | 986 | { |
b94498cf | 987 | AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults); |
988 | http->auth_ref = NULL; | |
f7deaa1a | 989 | } |
990 | ||
91bc88eb | 991 | if (!getenv("GATEWAY_INTERFACE") && (schemedata = cups_auth_find(www_auth, "AuthRef")) != NULL && cups_auth_param(schemedata, "key", auth_key, sizeof(auth_key))) |
f7deaa1a | 992 | { |
7ec11630 | 993 | status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &http->auth_ref); |
f7deaa1a | 994 | if (status != errAuthorizationSuccess) |
995 | { | |
fa26ab95 MS |
996 | DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d", |
997 | (int)status)); | |
f7deaa1a | 998 | return (-1); |
999 | } | |
1000 | ||
1001 | auth_right.name = auth_key; | |
1002 | auth_right.valueLength = 0; | |
1003 | auth_right.value = NULL; | |
1004 | auth_right.flags = 0; | |
1005 | ||
1006 | auth_rights.count = 1; | |
1007 | auth_rights.items = &auth_right; | |
1008 | ||
f14324a7 | 1009 | auth_flags = kAuthorizationFlagDefaults | |
f7deaa1a | 1010 | kAuthorizationFlagPreAuthorize | |
f14324a7 | 1011 | kAuthorizationFlagInteractionAllowed | |
f7deaa1a | 1012 | kAuthorizationFlagExtendRights; |
1013 | ||
f14324a7 MS |
1014 | status = AuthorizationCopyRights(http->auth_ref, &auth_rights, |
1015 | kAuthorizationEmptyEnvironment, | |
f7deaa1a | 1016 | auth_flags, NULL); |
1017 | if (status == errAuthorizationSuccess) | |
b94498cf | 1018 | status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn); |
f7deaa1a | 1019 | |
1020 | if (status == errAuthorizationSuccess) | |
1021 | { | |
1022 | /* | |
1023 | * Set the authorization string and return... | |
1024 | */ | |
1025 | ||
f14324a7 | 1026 | httpEncode64_2(buffer, sizeof(buffer), (void *)&auth_extrn, |
f7deaa1a | 1027 | sizeof(auth_extrn)); |
1028 | ||
355e94dc | 1029 | httpSetAuthString(http, "AuthRef", buffer); |
f7deaa1a | 1030 | |
e07d4801 | 1031 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
f7deaa1a | 1032 | http->authstring)); |
1033 | return (0); | |
1034 | } | |
1035 | else if (status == errAuthorizationCanceled) | |
1036 | return (-1); | |
1037 | ||
fa26ab95 | 1038 | DEBUG_printf(("9cups_local_auth: AuthorizationCopyRights() returned %d", (int)status)); |
f7deaa1a | 1039 | |
1040 | /* | |
1041 | * Fall through to try certificates... | |
1042 | */ | |
1043 | } | |
bc44d920 | 1044 | # endif /* HAVE_AUTHORIZATION_H */ |
f7deaa1a | 1045 | |
f11a948a MS |
1046 | # if defined(SO_PEERCRED) && defined(AF_LOCAL) |
1047 | /* | |
1048 | * See if we can authenticate using the peer credentials provided over a | |
1049 | * domain socket; if so, specify "PeerCred username" as the authentication | |
1050 | * information... | |
1051 | */ | |
1052 | ||
7ec11630 MS |
1053 | if (http->hostaddr->addr.sa_family == AF_LOCAL && |
1054 | !getenv("GATEWAY_INTERFACE") && /* Not via CGI programs... */ | |
1055 | cups_auth_find(www_auth, "PeerCred")) | |
f11a948a MS |
1056 | { |
1057 | /* | |
1058 | * Verify that the current cupsUser() matches the current UID... | |
1059 | */ | |
1060 | ||
1061 | struct passwd *pwd; /* Password information */ | |
1062 | const char *username; /* Current username */ | |
1063 | ||
1064 | username = cupsUser(); | |
1065 | ||
1066 | if ((pwd = getpwnam(username)) != NULL && pwd->pw_uid == getuid()) | |
1067 | { | |
1068 | httpSetAuthString(http, "PeerCred", username); | |
1069 | ||
1070 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", | |
1071 | http->authstring)); | |
1072 | ||
1073 | return (0); | |
1074 | } | |
1075 | } | |
1076 | # endif /* SO_PEERCRED && AF_LOCAL */ | |
1077 | ||
7ec11630 MS |
1078 | if ((schemedata = cups_auth_find(www_auth, "Local")) == NULL) |
1079 | return (1); | |
1080 | ||
ef416fc2 | 1081 | /* |
1082 | * Try opening a certificate file for this PID. If that fails, | |
1083 | * try the root certificate... | |
1084 | */ | |
1085 | ||
1086 | pid = getpid(); | |
1087 | snprintf(filename, sizeof(filename), "%s/certs/%d", cg->cups_statedir, pid); | |
1088 | if ((fp = fopen(filename, "r")) == NULL && pid > 0) | |
1089 | { | |
bc44d920 | 1090 | /* |
e07d4801 | 1091 | * No certificate for this PID; see if we can get the root certificate... |
bc44d920 | 1092 | */ |
1093 | ||
bf265b3a | 1094 | DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno))); |
e07d4801 | 1095 | |
7ec11630 | 1096 | if (!cups_auth_param(schemedata, "trc", trc, sizeof(trc))) |
e07d4801 MS |
1097 | { |
1098 | /* | |
1099 | * Scheduler doesn't want us to use the root certificate... | |
1100 | */ | |
1101 | ||
1102 | return (1); | |
1103 | } | |
1104 | ||
ef416fc2 | 1105 | snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir); |
bf265b3a MS |
1106 | if ((fp = fopen(filename, "r")) == NULL) |
1107 | DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno))); | |
ef416fc2 | 1108 | } |
1109 | ||
f7deaa1a | 1110 | if (fp) |
ef416fc2 | 1111 | { |
f7deaa1a | 1112 | /* |
1113 | * Read the certificate from the file... | |
1114 | */ | |
ef416fc2 | 1115 | |
6961465f MS |
1116 | char certificate[33], /* Certificate string */ |
1117 | *certptr; /* Pointer to certificate string */ | |
1118 | ||
1119 | certptr = fgets(certificate, sizeof(certificate), fp); | |
f7deaa1a | 1120 | fclose(fp); |
ef416fc2 | 1121 | |
6961465f MS |
1122 | if (certptr) |
1123 | { | |
1124 | /* | |
1125 | * Set the authorization string and return... | |
1126 | */ | |
ef416fc2 | 1127 | |
6961465f | 1128 | httpSetAuthString(http, "Local", certificate); |
ef416fc2 | 1129 | |
6961465f MS |
1130 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
1131 | http->authstring)); | |
ef416fc2 | 1132 | |
6961465f MS |
1133 | return (0); |
1134 | } | |
f7deaa1a | 1135 | } |
1136 | ||
1137 | return (1); | |
19dc16f7 | 1138 | #endif /* _WIN32 || __EMX__ */ |
ef416fc2 | 1139 | } |