]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge changes from CUPS 1.4svn-r8088, the real official 1.4b1!
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $"
3 *
4 * Authorization routines for the Common UNIX Printing System (CUPS).
5 *
6 * Copyright 2007-2008 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddLocation() - Add a location for authorization.
21 * cupsdAddName() - Add a name to a location...
22 * cupsdAllowHost() - Add a host name that is allowed to access the
23 * location.
24 * cupsdAllowIP() - Add an IP address or network that is allowed to
25 * access the location.
26 * cupsdAuthorize() - Validate any authorization credentials.
27 * cupsdCheckAccess() - Check whether the given address is allowed to
28 * access a location.
29 * cupsdCheckAuth() - Check authorization masks.
30 * cupsdCheckGroup() - Check for a user's group membership.
31 * cupsdCopyLocation() - Make a copy of a location...
32 * cupsdDeleteAllLocations() - Free all memory used for location
33 * authorization.
34 * cupsdDeleteLocation() - Free all memory used by a location.
35 * cupsdDenyHost() - Add a host name that is not allowed to access
36 * the location.
37 * cupsdDenyIP() - Add an IP address or network that is not
38 * allowed to access the location.
39 * cupsdFindBest() - Find the location entry that best matches the
40 * resource.
41 * cupsdFindLocation() - Find the named location.
42 * cupsdIsAuthorized() - Check to see if the user is authorized...
43 * add_allow() - Add an allow mask to the location.
44 * add_deny() - Add a deny mask to the location.
45 * check_authref() - Check if an authorization services reference
46 * has the supplied right.
47 * compare_locations() - Compare two locations.
48 * cups_crypt() - Encrypt the password using the DES or MD5
49 * algorithms, as needed.
50 * get_gss_creds() - Obtain GSS credentials.
51 * get_md5_password() - Get an MD5 password.
52 * pam_func() - PAM conversation function.
53 * to64() - Base64-encode an integer value...
54 */
55
56 /*
57 * Include necessary headers...
58 */
59
60 #include "cupsd.h"
61 #include <grp.h>
62 #ifdef HAVE_SHADOW_H
63 # include <shadow.h>
64 #endif /* HAVE_SHADOW_H */
65 #ifdef HAVE_CRYPT_H
66 # include <crypt.h>
67 #endif /* HAVE_CRYPT_H */
68 #if HAVE_LIBPAM
69 # ifdef HAVE_PAM_PAM_APPL_H
70 # include <pam/pam_appl.h>
71 # else
72 # include <security/pam_appl.h>
73 # endif /* HAVE_PAM_PAM_APPL_H */
74 #endif /* HAVE_LIBPAM */
75 #ifdef HAVE_USERSEC_H
76 # include <usersec.h>
77 #endif /* HAVE_USERSEC_H */
78 #ifdef HAVE_MEMBERSHIP_H
79 # include <membership.h>
80 #endif /* HAVE_MEMBERSHIP_H */
81 #ifdef HAVE_AUTHORIZATION_H
82 # include <Security/AuthorizationTags.h>
83 # ifdef HAVE_SECBASEPRIV_H
84 # include <Security/SecBasePriv.h>
85 # else
86 extern const char *cssmErrorString(int error);
87 # endif /* HAVE_SECBASEPRIV_H */
88 #endif /* HAVE_AUTHORIZATION_H */
89 #ifdef HAVE_SYS_PARAM_H
90 # include <sys/param.h>
91 #endif /* HAVE_SYS_PARAM_H */
92 #ifdef HAVE_SYS_UCRED_H
93 # include <sys/ucred.h>
94 typedef struct xucred cupsd_ucred_t;
95 # define CUPSD_UCRED_UID(c) (c).cr_uid
96 #else
97 typedef struct ucred cupsd_ucred_t;
98 # define CUPSD_UCRED_UID(c) (c).uid
99 #endif /* HAVE_SYS_UCRED_H */
100
101
102 /*
103 * Local functions...
104 */
105
106 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
107 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
108 #ifdef HAVE_AUTHORIZATION_H
109 static int check_authref(cupsd_client_t *con, const char *right);
110 #endif /* HAVE_AUTHORIZATION_H */
111 static int compare_locations(cupsd_location_t *a,
112 cupsd_location_t *b);
113 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
114 static char *cups_crypt(const char *pw, const char *salt);
115 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
116 #ifdef HAVE_GSSAPI
117 static gss_cred_id_t get_gss_creds(const char *service_name,
118 const char *con_server_name);
119 #endif /* HAVE_GSSAPI */
120 static char *get_md5_password(const char *username,
121 const char *group, char passwd[33]);
122 #if HAVE_LIBPAM
123 static int pam_func(int, const struct pam_message **,
124 struct pam_response **, void *);
125 #elif !defined(HAVE_USERSEC_H)
126 static void to64(char *s, unsigned long v, int n);
127 #endif /* HAVE_LIBPAM */
128
129
130 /*
131 * Local structures...
132 */
133
134 #if HAVE_LIBPAM
135 typedef struct cupsd_authdata_s /**** Authentication data ****/
136 {
137 char username[33], /* Username string */
138 password[33]; /* Password string */
139 } cupsd_authdata_t;
140 #endif /* HAVE_LIBPAM */
141
142
143 /*
144 * Local globals...
145 */
146
147 #if defined(__hpux) && HAVE_LIBPAM
148 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
149 #endif /* __hpux && HAVE_LIBPAM */
150
151
152 /*
153 * 'cupsdAddLocation()' - Add a location for authorization.
154 */
155
156 cupsd_location_t * /* O - Pointer to new location record */
157 cupsdAddLocation(const char *location) /* I - Location path */
158 {
159 cupsd_location_t *temp; /* New location */
160
161
162 /*
163 * Make sure the locations array is created...
164 */
165
166 if (!Locations)
167 Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
168
169 if (!Locations)
170 return (NULL);
171
172 /*
173 * Try to allocate memory for the new location.
174 */
175
176 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
177 return (NULL);
178
179 /*
180 * Initialize the record and copy the name over...
181 */
182
183 if ((temp->location = strdup(location)) == NULL)
184 {
185 free(temp);
186 return (NULL);
187 }
188
189 temp->length = strlen(temp->location);
190
191 cupsArrayAdd(Locations, temp);
192
193 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
194 location);
195
196 /*
197 * Return the new record...
198 */
199
200 return (temp);
201 }
202
203
204 /*
205 * 'cupsdAddName()' - Add a name to a location...
206 */
207
208 void
209 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
210 char *name) /* I - Name to add */
211 {
212 char **temp; /* Pointer to names array */
213
214
215 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
216 loc, name);
217
218 if (loc->num_names == 0)
219 temp = malloc(sizeof(char *));
220 else
221 temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
222
223 if (temp == NULL)
224 {
225 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
226 loc->location ? loc->location : "nil", strerror(errno));
227 return;
228 }
229
230 loc->names = temp;
231
232 if ((temp[loc->num_names] = strdup(name)) == NULL)
233 {
234 cupsdLogMessage(CUPSD_LOG_ERROR,
235 "Unable to duplicate name for location %s: %s",
236 loc->location ? loc->location : "nil", strerror(errno));
237 return;
238 }
239
240 loc->num_names ++;
241 }
242
243
244 /*
245 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
246 */
247
248 void
249 cupsdAllowHost(cupsd_location_t *loc, /* I - Location to add to */
250 char *name) /* I - Name of host or domain to add */
251 {
252 cupsd_authmask_t *temp; /* New host/domain mask */
253 char ifname[32], /* Interface name */
254 *ifptr; /* Pointer to end of name */
255
256
257 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
258 loc, loc->location ? loc->location : "nil", name);
259
260 if ((temp = add_allow(loc)) == NULL)
261 return;
262
263 if (!strcasecmp(name, "@LOCAL"))
264 {
265 /*
266 * Allow *interface*...
267 */
268
269 temp->type = CUPSD_AUTH_INTERFACE;
270 temp->mask.name.name = strdup("*");
271 temp->mask.name.length = 1;
272 }
273 else if (!strncasecmp(name, "@IF(", 4))
274 {
275 /*
276 * Allow *interface*...
277 */
278
279 strlcpy(ifname, name + 4, sizeof(ifname));
280
281 ifptr = ifname + strlen(ifname);
282
283 if (ifptr[-1] == ')')
284 {
285 ifptr --;
286 *ifptr = '\0';
287 }
288
289 temp->type = CUPSD_AUTH_INTERFACE;
290 temp->mask.name.name = strdup(ifname);
291 temp->mask.name.length = ifptr - ifname;
292 }
293 else
294 {
295 /*
296 * Allow name...
297 */
298
299 temp->type = CUPSD_AUTH_NAME;
300 temp->mask.name.name = strdup(name);
301 temp->mask.name.length = strlen(name);
302 }
303 }
304
305
306 /*
307 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
308 * the location.
309 */
310
311 void
312 cupsdAllowIP(
313 cupsd_location_t *loc, /* I - Location to add to */
314 const unsigned address[4], /* I - IP address to add */
315 const unsigned netmask[4]) /* I - Netmask of address */
316 {
317 cupsd_authmask_t *temp; /* New host/domain mask */
318
319
320 cupsdLogMessage(CUPSD_LOG_DEBUG2,
321 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
322 loc, loc->location ? loc->location : "nil",
323 address[0], address[1], address[2], address[3],
324 netmask[0], netmask[1], netmask[2], netmask[3]);
325
326 if ((temp = add_allow(loc)) == NULL)
327 return;
328
329 temp->type = CUPSD_AUTH_IP;
330 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
331 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
332 }
333
334
335 /*
336 * 'cupsdAuthorize()' - Validate any authorization credentials.
337 */
338
339 void
340 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
341 {
342 int type; /* Authentication type */
343 const char *authorization; /* Pointer into Authorization string */
344 char *ptr, /* Pointer into string */
345 username[256], /* Username string */
346 password[33]; /* Password string */
347 cupsd_cert_t *localuser; /* Certificate username */
348 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
349 md5[33], /* MD5 password */
350 basicmd5[33]; /* MD5 of Basic password */
351 static const char * const states[] = /* HTTP client states... */
352 {
353 "WAITING",
354 "OPTIONS",
355 "GET",
356 "GET",
357 "HEAD",
358 "POST",
359 "POST",
360 "POST",
361 "PUT",
362 "PUT",
363 "DELETE",
364 "TRACE",
365 "CLOSE",
366 "STATUS"
367 };
368
369
370 /*
371 * Locate the best matching location so we know what kind of
372 * authentication to expect...
373 */
374
375 con->best = cupsdFindBest(con->uri, con->http.state);
376 con->type = CUPSD_AUTH_NONE;
377
378 cupsdLogMessage(CUPSD_LOG_DEBUG2,
379 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
380 con->uri, con->best, con->best ? con->best->location : "");
381
382 if (con->best && con->best->type != CUPSD_AUTH_NONE)
383 {
384 if (con->best->type == CUPSD_AUTH_DEFAULT)
385 type = DefaultAuthType;
386 else
387 type = con->best->type;
388 }
389 else
390 type = DefaultAuthType;
391
392 /*
393 * Decode the Authorization string...
394 */
395
396 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
397
398 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
399 authorization);
400
401 username[0] = '\0';
402 password[0] = '\0';
403
404 #ifdef HAVE_AUTHORIZATION_H
405 if (con->authref)
406 {
407 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
408 con->authref = NULL;
409 }
410 #endif /* HAVE_AUTHORIZATION_H */
411
412 if (!*authorization)
413 {
414 /*
415 * No authorization data provided, return early...
416 */
417
418 cupsdLogMessage(CUPSD_LOG_DEBUG,
419 "cupsdAuthorize: No authentication data provided.");
420 return;
421 }
422 #ifdef HAVE_AUTHORIZATION_H
423 else if (!strncmp(authorization, "AuthRef", 6) &&
424 !strcasecmp(con->http.hostname, "localhost"))
425 {
426 OSStatus status; /* Status */
427 int authlen; /* Auth string length */
428 AuthorizationItemSet *authinfo; /* Authorization item set */
429
430 /*
431 * Get the Authorization Services data...
432 */
433
434 authorization += 7;
435 while (isspace(*authorization & 255))
436 authorization ++;
437
438 authlen = sizeof(nonce);
439 httpDecode64_2(nonce, &authlen, authorization);
440
441 if (authlen != kAuthorizationExternalFormLength)
442 {
443 cupsdLogMessage(CUPSD_LOG_ERROR,
444 "External Authorization reference size is incorrect!");
445 return;
446 }
447
448 if ((status = AuthorizationCreateFromExternalForm(
449 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
450 {
451 cupsdLogMessage(CUPSD_LOG_ERROR,
452 "AuthorizationCreateFromExternalForm returned %d (%s)",
453 (int)status, cssmErrorString(status));
454 return;
455 }
456
457 if ((status = AuthorizationCopyInfo(con->authref,
458 kAuthorizationEnvironmentUsername,
459 &authinfo)) != 0)
460 {
461 cupsdLogMessage(CUPSD_LOG_ERROR,
462 "AuthorizationCopyInfo returned %d (%s)",
463 (int)status, cssmErrorString(status));
464 return;
465 }
466
467 if (authinfo->count == 0 || !authinfo->items[0].value ||
468 authinfo->items[0].valueLength < 2)
469 {
470 AuthorizationFreeItemSet(authinfo);
471 cupsdLogMessage(CUPSD_LOG_ERROR,
472 "AuthorizationCopyInfo returned empty rights!");
473 return;
474 }
475
476 strlcpy(username, authinfo->items[0].value, sizeof(username));
477 AuthorizationFreeItemSet(authinfo);
478
479 cupsdLogMessage(CUPSD_LOG_DEBUG,
480 "cupsdAuthorize: Authorized as \"%s\" using AuthRef",
481 username);
482 con->type = CUPSD_AUTH_BASIC;
483 }
484 #endif /* HAVE_AUTHORIZATION_H */
485 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
486 else if (!strncmp(authorization, "PeerCred ", 9) &&
487 con->http.hostaddr->addr.sa_family == AF_LOCAL)
488 {
489 /*
490 * Use peer credentials from domain socket connection...
491 */
492
493 struct passwd *pwd; /* Password entry for this user */
494 cupsd_ucred_t peercred; /* Peer credentials */
495 socklen_t peersize; /* Size of peer credentials */
496
497
498 if ((pwd = getpwnam(authorization + 9)) == NULL)
499 {
500 cupsdLogMessage(CUPSD_LOG_ERROR, "User \"%s\" does not exist!",
501 authorization + 9);
502 return;
503 }
504
505 peersize = sizeof(peercred);
506
507 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
508 {
509 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
510 strerror(errno));
511 return;
512 }
513
514 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
515 {
516 cupsdLogMessage(CUPSD_LOG_ERROR,
517 "Invalid peer credentials for \"%s\" - got %d, "
518 "expected %d!", authorization + 9,
519 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
520 # ifdef HAVE_SYS_UCRED_H
521 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_version=%d",
522 peercred.cr_version);
523 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_uid=%d",
524 peercred.cr_uid);
525 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_ngroups=%d",
526 peercred.cr_ngroups);
527 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_groups[0]=%d",
528 peercred.cr_groups[0]);
529 # endif /* HAVE_SYS_UCRED_H */
530 return;
531 }
532
533 strlcpy(username, authorization + 9, sizeof(username));
534
535 cupsdLogMessage(CUPSD_LOG_DEBUG,
536 "cupsdAuthorize: Authorized as %s using PeerCred",
537 username);
538
539 con->type = CUPSD_AUTH_BASIC;
540 }
541 #endif /* SO_PEERCRED && AF_LOCAL */
542 else if (!strncmp(authorization, "Local", 5) &&
543 !strcasecmp(con->http.hostname, "localhost"))
544 {
545 /*
546 * Get Local certificate authentication data...
547 */
548
549 authorization += 5;
550 while (isspace(*authorization & 255))
551 authorization ++;
552
553 if ((localuser = cupsdFindCert(authorization)) != NULL)
554 {
555 strlcpy(username, localuser->username, sizeof(username));
556
557 cupsdLogMessage(CUPSD_LOG_DEBUG,
558 "cupsdAuthorize: Authorized as %s using Local",
559 username);
560 }
561 else
562 {
563 cupsdLogMessage(CUPSD_LOG_ERROR,
564 "cupsdAuthorize: Local authentication certificate not "
565 "found!");
566 return;
567 }
568
569 #ifdef HAVE_GSSAPI
570 if (localuser->ccache)
571 con->type = CUPSD_AUTH_NEGOTIATE;
572 else
573 #endif /* HAVE_GSSAPI */
574 con->type = CUPSD_AUTH_BASIC;
575 }
576 else if (!strncmp(authorization, "Basic", 5))
577 {
578 /*
579 * Get the Basic authentication data...
580 */
581
582 int userlen; /* Username:password length */
583
584
585 authorization += 5;
586 while (isspace(*authorization & 255))
587 authorization ++;
588
589 userlen = sizeof(username);
590 httpDecode64_2(username, &userlen, authorization);
591
592 /*
593 * Pull the username and password out...
594 */
595
596 if ((ptr = strchr(username, ':')) == NULL)
597 {
598 cupsdLogMessage(CUPSD_LOG_ERROR,
599 "cupsdAuthorize: Missing Basic password!");
600 return;
601 }
602
603 *ptr++ = '\0';
604
605 if (!username[0])
606 {
607 /*
608 * Username must not be empty...
609 */
610
611 cupsdLogMessage(CUPSD_LOG_ERROR,
612 "cupsdAuthorize: Empty Basic username!");
613 return;
614 }
615
616 if (!*ptr)
617 {
618 /*
619 * Password must not be empty...
620 */
621
622 cupsdLogMessage(CUPSD_LOG_ERROR,
623 "cupsdAuthorize: Empty Basic password!");
624 return;
625 }
626
627 strlcpy(password, ptr, sizeof(password));
628
629 /*
630 * Validate the username and password...
631 */
632
633 switch (type)
634 {
635 default :
636 case CUPSD_AUTH_BASIC :
637 {
638 #if HAVE_LIBPAM
639 /*
640 * Only use PAM to do authentication. This supports MD5
641 * passwords, among other things...
642 */
643
644 pam_handle_t *pamh; /* PAM authentication handle */
645 int pamerr; /* PAM error code */
646 struct pam_conv pamdata;/* PAM conversation data */
647 cupsd_authdata_t data; /* Authentication data */
648
649
650 strlcpy(data.username, username, sizeof(data.username));
651 strlcpy(data.password, password, sizeof(data.password));
652
653 # if defined(__sun) || defined(__hpux)
654 pamdata.conv = (int (*)(int, struct pam_message **,
655 struct pam_response **,
656 void *))pam_func;
657 # else
658 pamdata.conv = pam_func;
659 # endif /* __sun || __hpux */
660 pamdata.appdata_ptr = &data;
661
662 # ifdef __hpux
663 /*
664 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
665 * more info...
666 */
667
668 auth_data = &data;
669 # endif /* __hpux */
670
671 pamerr = pam_start("cups", username, &pamdata, &pamh);
672 if (pamerr != PAM_SUCCESS)
673 {
674 cupsdLogMessage(CUPSD_LOG_ERROR,
675 "cupsdAuthorize: pam_start() returned %d (%s)!",
676 pamerr, pam_strerror(pamh, pamerr));
677 return;
678 }
679
680 # ifdef HAVE_PAM_SET_ITEM
681 # ifdef PAM_RHOST
682 pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
683 if (pamerr != PAM_SUCCESS)
684 cupsdLogMessage(CUPSD_LOG_WARN,
685 "cupsdAuthorize: pam_set_item(PAM_RHOST) "
686 "returned %d (%s)!", pamerr,
687 pam_strerror(pamh, pamerr));
688 # endif /* PAM_RHOST */
689
690 # ifdef PAM_TTY
691 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
692 if (pamerr != PAM_SUCCESS)
693 cupsdLogMessage(CUPSD_LOG_WARN,
694 "cupsdAuthorize: pam_set_item(PAM_TTY) "
695 "returned %d (%s)!", pamerr,
696 pam_strerror(pamh, pamerr));
697 # endif /* PAM_TTY */
698 # endif /* HAVE_PAM_SET_ITEM */
699
700 # ifdef HAVE_PAM_SETCRED
701 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
702 if (pamerr != PAM_SUCCESS)
703 cupsdLogMessage(CUPSD_LOG_WARN,
704 "cupsdAuthorize: pam_setcred() "
705 "returned %d (%s)!", pamerr,
706 pam_strerror(pamh, pamerr));
707 # endif /* HAVE_PAM_SETCRED */
708
709 pamerr = pam_authenticate(pamh, PAM_SILENT);
710 if (pamerr != PAM_SUCCESS)
711 {
712 cupsdLogMessage(CUPSD_LOG_ERROR,
713 "cupsdAuthorize: pam_authenticate() returned %d "
714 "(%s)!",
715 pamerr, pam_strerror(pamh, pamerr));
716 pam_end(pamh, 0);
717 return;
718 }
719
720 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
721 if (pamerr != PAM_SUCCESS)
722 {
723 cupsdLogMessage(CUPSD_LOG_ERROR,
724 "cupsdAuthorize: pam_acct_mgmt() returned %d "
725 "(%s)!",
726 pamerr, pam_strerror(pamh, pamerr));
727 pam_end(pamh, 0);
728 return;
729 }
730
731 pam_end(pamh, PAM_SUCCESS);
732
733 #elif defined(HAVE_USERSEC_H)
734 /*
735 * Use AIX authentication interface...
736 */
737
738 char *authmsg; /* Authentication message */
739 int reenter; /* ??? */
740
741
742 cupsdLogMessage(CUPSD_LOG_DEBUG,
743 "cupsdAuthorize: AIX authenticate of username "
744 "\"%s\"", username);
745
746 reenter = 1;
747 if (authenticate(username, password, &reenter, &authmsg) != 0)
748 {
749 cupsdLogMessage(CUPSD_LOG_DEBUG,
750 "cupsdAuthorize: Unable to authenticate username "
751 "\"%s\": %s",
752 username, strerror(errno));
753 return;
754 }
755
756 #else
757 /*
758 * Use normal UNIX password file-based authentication...
759 */
760
761 char *pass; /* Encrypted password */
762 struct passwd *pw; /* User password data */
763 # ifdef HAVE_SHADOW_H
764 struct spwd *spw; /* Shadow password data */
765 # endif /* HAVE_SHADOW_H */
766
767
768 pw = getpwnam(username); /* Get the current password */
769 endpwent(); /* Close the password file */
770
771 if (!pw)
772 {
773 /*
774 * No such user...
775 */
776
777 cupsdLogMessage(CUPSD_LOG_ERROR,
778 "cupsdAuthorize: Unknown username \"%s\"!",
779 username);
780 return;
781 }
782
783 # ifdef HAVE_SHADOW_H
784 spw = getspnam(username);
785 endspent();
786
787 if (!spw && !strcmp(pw->pw_passwd, "x"))
788 {
789 /*
790 * Don't allow blank passwords!
791 */
792
793 cupsdLogMessage(CUPSD_LOG_ERROR,
794 "cupsdAuthorize: Username \"%s\" has no shadow "
795 "password!", username);
796 return;
797 }
798
799 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
800 # else
801 if (!pw->pw_passwd[0])
802 # endif /* HAVE_SHADOW_H */
803 {
804 /*
805 * Don't allow blank passwords!
806 */
807
808 cupsdLogMessage(CUPSD_LOG_ERROR,
809 "cupsdAuthorize: Username \"%s\" has no password!",
810 username);
811 return;
812 }
813
814 /*
815 * OK, the password isn't blank, so compare with what came from the
816 * client...
817 */
818
819 pass = cups_crypt(password, pw->pw_passwd);
820
821 cupsdLogMessage(CUPSD_LOG_DEBUG2,
822 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
823 pw->pw_passwd, pass);
824
825 if (!pass || strcmp(pw->pw_passwd, pass))
826 {
827 # ifdef HAVE_SHADOW_H
828 if (spw)
829 {
830 pass = cups_crypt(password, spw->sp_pwdp);
831
832 cupsdLogMessage(CUPSD_LOG_DEBUG2,
833 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
834 spw->sp_pwdp, pass);
835
836 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
837 {
838 cupsdLogMessage(CUPSD_LOG_ERROR,
839 "cupsdAuthorize: Authentication failed for "
840 "user \"%s\"!",
841 username);
842 return;
843 }
844 }
845 else
846 # endif /* HAVE_SHADOW_H */
847 {
848 cupsdLogMessage(CUPSD_LOG_ERROR,
849 "cupsdAuthorize: Authentication failed for "
850 "user \"%s\"!",
851 username);
852 return;
853 }
854 }
855 #endif /* HAVE_LIBPAM */
856 }
857
858 cupsdLogMessage(CUPSD_LOG_DEBUG,
859 "cupsdAuthorize: Authorized as %s using Basic",
860 username);
861 break;
862
863 case CUPSD_AUTH_BASICDIGEST :
864 /*
865 * Do Basic authentication with the Digest password file...
866 */
867
868 if (!get_md5_password(username, NULL, md5))
869 {
870 cupsdLogMessage(CUPSD_LOG_ERROR,
871 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
872 username);
873 return;
874 }
875
876 httpMD5(username, "CUPS", password, basicmd5);
877
878 if (strcmp(md5, basicmd5))
879 {
880 cupsdLogMessage(CUPSD_LOG_ERROR,
881 "cupsdAuthorize: Authentication failed for \"%s\"!",
882 username);
883 return;
884 }
885
886 cupsdLogMessage(CUPSD_LOG_DEBUG,
887 "cupsdAuthorize: Authorized as %s using BasicDigest",
888 username);
889 break;
890 }
891
892 con->type = type;
893 }
894 else if (!strncmp(authorization, "Digest", 6))
895 {
896 /*
897 * Get the username, password, and nonce from the Digest attributes...
898 */
899
900 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
901 username, sizeof(username)) || !username[0])
902 {
903 /*
904 * Username must not be empty...
905 */
906
907 cupsdLogMessage(CUPSD_LOG_ERROR,
908 "cupsdAuthorize: Empty or missing Digest username!");
909 return;
910 }
911
912 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
913 password, sizeof(password)) || !password[0])
914 {
915 /*
916 * Password must not be empty...
917 */
918
919 cupsdLogMessage(CUPSD_LOG_ERROR,
920 "cupsdAuthorize: Empty or missing Digest password!");
921 return;
922 }
923
924 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
925 nonce))
926 {
927 cupsdLogMessage(CUPSD_LOG_ERROR,
928 "cupsdAuthorize: No nonce value for Digest "
929 "authentication!");
930 return;
931 }
932
933 if (strcmp(con->http.hostname, nonce))
934 {
935 cupsdLogMessage(CUPSD_LOG_ERROR,
936 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
937 "got \"%s\"!", con->http.hostname, nonce);
938 return;
939 }
940
941 /*
942 * Validate the username and password...
943 */
944
945 if (!get_md5_password(username, NULL, md5))
946 {
947 cupsdLogMessage(CUPSD_LOG_ERROR,
948 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
949 username);
950 return;
951 }
952
953 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
954
955 if (strcmp(md5, password))
956 {
957 cupsdLogMessage(CUPSD_LOG_ERROR,
958 "cupsdAuthorize: Authentication failed for \"%s\"!",
959 username);
960 return;
961 }
962
963 cupsdLogMessage(CUPSD_LOG_DEBUG,
964 "cupsdAuthorize: Authorized as %s using Digest",
965 username);
966
967 con->type = CUPSD_AUTH_DIGEST;
968 }
969 #ifdef HAVE_GSSAPI
970 else if (!strncmp(authorization, "Negotiate", 9))
971 {
972 int len; /* Length of authorization string */
973 gss_cred_id_t server_creds; /* Server credentials */
974 gss_ctx_id_t context; /* Authorization context */
975 OM_uint32 major_status, /* Major status code */
976 minor_status; /* Minor status code */
977 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
978 /* Input token from string */
979 output_token = GSS_C_EMPTY_BUFFER;
980 /* Output token for username */
981 gss_name_t client_name; /* Client name */
982 unsigned int ret_flags; /* Credential flags */
983
984
985 # ifdef __APPLE__
986 /*
987 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
988 * to use it...
989 */
990
991 if (gss_init_sec_context == NULL)
992 {
993 cupsdLogMessage(CUPSD_LOG_WARN,
994 "GSSAPI/Kerberos authentication failed because the "
995 "Kerberos framework is not present.");
996 return;
997 }
998 # endif /* __APPLE__ */
999
1000 con->gss_output_token.length = 0;
1001
1002 /*
1003 * Find the start of the Kerberos input token...
1004 */
1005
1006 authorization += 9;
1007 while (isspace(*authorization & 255))
1008 authorization ++;
1009
1010 if (!*authorization)
1011 {
1012 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1013 "cupsdAuthorize: No authentication data specified.");
1014 return;
1015 }
1016
1017 /*
1018 * Get the server credentials...
1019 */
1020
1021 if ((server_creds = get_gss_creds(GSSServiceName, con->servername)) == NULL)
1022 return;
1023
1024 /*
1025 * Decode the authorization string to get the input token...
1026 */
1027
1028 len = strlen(authorization);
1029 input_token.value = malloc(len);
1030 input_token.value = httpDecode64_2(input_token.value, &len,
1031 authorization);
1032 input_token.length = len;
1033
1034 /*
1035 * Accept the input token to get the authorization info...
1036 */
1037
1038 context = GSS_C_NO_CONTEXT;
1039 client_name = GSS_C_NO_NAME;
1040 major_status = gss_accept_sec_context(&minor_status,
1041 &context,
1042 server_creds,
1043 &input_token,
1044 GSS_C_NO_CHANNEL_BINDINGS,
1045 &client_name,
1046 NULL,
1047 &con->gss_output_token,
1048 &ret_flags,
1049 NULL,
1050 &con->gss_delegated_cred);
1051
1052 if (GSS_ERROR(major_status))
1053 {
1054 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1055 "cupsdAuthorize: Error accepting GSSAPI security "
1056 "context");
1057
1058 if (context != GSS_C_NO_CONTEXT)
1059 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1060
1061 gss_release_cred(&minor_status, &server_creds);
1062 return;
1063 }
1064
1065 /*
1066 * Release our credentials...
1067 */
1068
1069 gss_release_cred(&minor_status, &server_creds);
1070
1071 /*
1072 * Get the username associated with the client's credentials...
1073 */
1074
1075 if (!con->gss_delegated_cred)
1076 cupsdLogMessage(CUPSD_LOG_DEBUG,
1077 "cupsdAuthorize: No delegated credentials!");
1078
1079 if (major_status == GSS_S_CONTINUE_NEEDED)
1080 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1081 "cupsdAuthorize: Credentials not complete");
1082 else if (major_status == GSS_S_COMPLETE)
1083 {
1084 major_status = gss_display_name(&minor_status, client_name,
1085 &output_token, NULL);
1086
1087 if (GSS_ERROR(major_status))
1088 {
1089 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1090 "cupsdAuthorize: Error getting username");
1091 gss_release_name(&minor_status, &client_name);
1092 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1093 return;
1094 }
1095
1096 gss_release_name(&minor_status, &client_name);
1097 strlcpy(username, output_token.value, sizeof(username));
1098
1099 cupsdLogMessage(CUPSD_LOG_DEBUG,
1100 "cupsdAuthorize: Authorized as %s using Negotiate",
1101 username);
1102
1103 gss_release_buffer(&minor_status, &output_token);
1104 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1105
1106 con->gss_have_creds = 1;
1107
1108 con->type = CUPSD_AUTH_NEGOTIATE;
1109 }
1110 else
1111 gss_release_name(&minor_status, &client_name);
1112 }
1113 #endif /* HAVE_GSSAPI */
1114 else
1115 {
1116 char scheme[256]; /* Auth scheme... */
1117
1118
1119 if (sscanf(authorization, "%255s", scheme) != 1)
1120 strcpy(scheme, "UNKNOWN");
1121
1122 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\"",
1123 scheme);
1124 return;
1125 }
1126
1127 /*
1128 * If we get here, then we were able to validate the username and
1129 * password - copy the validated username and password to the client
1130 * data and return...
1131 */
1132
1133 strlcpy(con->username, username, sizeof(con->username));
1134 strlcpy(con->password, password, sizeof(con->password));
1135 }
1136
1137
1138 /*
1139 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1140 * access a location.
1141 */
1142
1143 int /* O - 1 if allowed, 0 otherwise */
1144 cupsdCheckAccess(
1145 unsigned ip[4], /* I - Client address */
1146 char *name, /* I - Client hostname */
1147 int namelen, /* I - Length of hostname */
1148 cupsd_location_t *loc) /* I - Location to check */
1149 {
1150 int allow; /* 1 if allowed, 0 otherwise */
1151
1152
1153 if (!strcasecmp(name, "localhost"))
1154 {
1155 /*
1156 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1157 */
1158
1159 return (1);
1160 }
1161 else
1162 {
1163 /*
1164 * Do authorization checks on the domain/address...
1165 */
1166
1167 switch (loc->order_type)
1168 {
1169 default :
1170 allow = 0; /* anti-compiler-warning-code */
1171 break;
1172
1173 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
1174 allow = 1;
1175
1176 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1177 allow = 0;
1178
1179 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1180 allow = 1;
1181 break;
1182
1183 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
1184 allow = 0;
1185
1186 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1187 allow = 1;
1188
1189 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1190 allow = 0;
1191 break;
1192 }
1193 }
1194
1195 return (allow);
1196 }
1197
1198
1199 /*
1200 * 'cupsdCheckAuth()' - Check authorization masks.
1201 */
1202
1203 int /* O - 1 if mask matches, 0 otherwise */
1204 cupsdCheckAuth(
1205 unsigned ip[4], /* I - Client address */
1206 char *name, /* I - Client hostname */
1207 int name_len, /* I - Length of hostname */
1208 int num_masks, /* I - Number of masks */
1209 cupsd_authmask_t *masks) /* I - Masks */
1210 {
1211 int i; /* Looping var */
1212 cupsd_netif_t *iface; /* Network interface */
1213 unsigned netip4; /* IPv4 network address */
1214 #ifdef AF_INET6
1215 unsigned netip6[4]; /* IPv6 network address */
1216 #endif /* AF_INET6 */
1217
1218 while (num_masks > 0)
1219 {
1220 switch (masks->type)
1221 {
1222 case CUPSD_AUTH_INTERFACE :
1223 /*
1224 * Check for a match with a network interface...
1225 */
1226
1227 netip4 = htonl(ip[3]);
1228
1229 #ifdef AF_INET6
1230 netip6[0] = htonl(ip[0]);
1231 netip6[1] = htonl(ip[1]);
1232 netip6[2] = htonl(ip[2]);
1233 netip6[3] = htonl(ip[3]);
1234 #endif /* AF_INET6 */
1235
1236 if (!strcmp(masks->mask.name.name, "*"))
1237 {
1238 /*
1239 * Check against all local interfaces...
1240 */
1241
1242 cupsdNetIFUpdate();
1243
1244 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1245 iface;
1246 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1247 {
1248 /*
1249 * Only check local interfaces...
1250 */
1251
1252 if (!iface->is_local)
1253 continue;
1254
1255 if (iface->address.addr.sa_family == AF_INET)
1256 {
1257 /*
1258 * Check IPv4 address...
1259 */
1260
1261 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1262 (iface->address.ipv4.sin_addr.s_addr &
1263 iface->mask.ipv4.sin_addr.s_addr))
1264 return (1);
1265 }
1266 #ifdef AF_INET6
1267 else
1268 {
1269 /*
1270 * Check IPv6 address...
1271 */
1272
1273 for (i = 0; i < 4; i ++)
1274 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1275 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1276 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1277 break;
1278
1279 if (i == 4)
1280 return (1);
1281 }
1282 #endif /* AF_INET6 */
1283 }
1284 }
1285 else
1286 {
1287 /*
1288 * Check the named interface...
1289 */
1290
1291 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1292 iface;
1293 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1294 {
1295 if (strcmp(masks->mask.name.name, iface->name))
1296 continue;
1297
1298 if (iface->address.addr.sa_family == AF_INET)
1299 {
1300 /*
1301 * Check IPv4 address...
1302 */
1303
1304 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1305 (iface->address.ipv4.sin_addr.s_addr &
1306 iface->mask.ipv4.sin_addr.s_addr))
1307 return (1);
1308 }
1309 #ifdef AF_INET6
1310 else
1311 {
1312 /*
1313 * Check IPv6 address...
1314 */
1315
1316 for (i = 0; i < 4; i ++)
1317 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1318 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1319 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1320 break;
1321
1322 if (i == 4)
1323 return (1);
1324 }
1325 #endif /* AF_INET6 */
1326 }
1327 }
1328 break;
1329
1330 case CUPSD_AUTH_NAME :
1331 /*
1332 * Check for exact name match...
1333 */
1334
1335 if (!strcasecmp(name, masks->mask.name.name))
1336 return (1);
1337
1338 /*
1339 * Check for domain match...
1340 */
1341
1342 if (name_len >= masks->mask.name.length &&
1343 masks->mask.name.name[0] == '.' &&
1344 !strcasecmp(name + name_len - masks->mask.name.length,
1345 masks->mask.name.name))
1346 return (1);
1347 break;
1348
1349 case CUPSD_AUTH_IP :
1350 /*
1351 * Check for IP/network address match...
1352 */
1353
1354 for (i = 0; i < 4; i ++)
1355 if ((ip[i] & masks->mask.ip.netmask[i]) !=
1356 masks->mask.ip.address[i])
1357 break;
1358
1359 if (i == 4)
1360 return (1);
1361 break;
1362 }
1363
1364 masks ++;
1365 num_masks --;
1366 }
1367
1368 return (0);
1369 }
1370
1371
1372 /*
1373 * 'cupsdCheckGroup()' - Check for a user's group membership.
1374 */
1375
1376 int /* O - 1 if user is a member, 0 otherwise */
1377 cupsdCheckGroup(
1378 const char *username, /* I - User name */
1379 struct passwd *user, /* I - System user info */
1380 const char *groupname) /* I - Group name */
1381 {
1382 int i; /* Looping var */
1383 struct group *group; /* System group info */
1384 char junk[33]; /* MD5 password (not used) */
1385 #ifdef HAVE_MBR_UID_TO_UUID
1386 uuid_t useruuid, /* UUID for username */
1387 groupuuid; /* UUID for groupname */
1388 int is_member; /* True if user is a member of group */
1389 #endif /* HAVE_MBR_UID_TO_UUID */
1390
1391
1392 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1393 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1394 username, user, groupname);
1395
1396 /*
1397 * Validate input...
1398 */
1399
1400 if (!username || !groupname)
1401 return (0);
1402
1403 /*
1404 * Check to see if the user is a member of the named group...
1405 */
1406
1407 group = getgrnam(groupname);
1408 endgrent();
1409
1410 if (group != NULL)
1411 {
1412 /*
1413 * Group exists, check it...
1414 */
1415
1416 for (i = 0; group->gr_mem[i]; i ++)
1417 if (!strcasecmp(username, group->gr_mem[i]))
1418 return (1);
1419 }
1420
1421 /*
1422 * Group doesn't exist or user not in group list, check the group ID
1423 * against the user's group ID...
1424 */
1425
1426 if (user && group && group->gr_gid == user->pw_gid)
1427 return (1);
1428
1429 #ifdef HAVE_MBR_UID_TO_UUID
1430 /*
1431 * Check group membership through MacOS X membership API...
1432 */
1433
1434 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1435 {
1436 if (group)
1437 {
1438 /*
1439 * Map group name to UUID and check membership...
1440 */
1441
1442 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1443 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1444 if (is_member)
1445 return (1);
1446 }
1447 else if (groupname[0] == '#')
1448 {
1449 /*
1450 * Use UUID directly and check for equality (user UUID) and
1451 * membership (group UUID)...
1452 */
1453
1454 if (!uuid_parse((char *)groupname + 1, groupuuid))
1455 {
1456 if (!uuid_compare(useruuid, groupuuid))
1457 return (1);
1458 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1459 if (is_member)
1460 return (1);
1461 }
1462
1463 return (0);
1464 }
1465 }
1466 else if (groupname[0] == '#')
1467 return (0);
1468 #endif /* HAVE_MBR_UID_TO_UUID */
1469
1470 /*
1471 * Username not found, group not found, or user is not part of the
1472 * system group... Check for a user and group in the MD5 password
1473 * file...
1474 */
1475
1476 if (get_md5_password(username, groupname, junk) != NULL)
1477 return (1);
1478
1479 /*
1480 * If we get this far, then the user isn't part of the named group...
1481 */
1482
1483 return (0);
1484 }
1485
1486
1487 /*
1488 * 'cupsdCopyLocation()' - Make a copy of a location...
1489 */
1490
1491 cupsd_location_t * /* O - New location */
1492 cupsdCopyLocation(
1493 cupsd_location_t **loc) /* IO - Original location */
1494 {
1495 int i; /* Looping var */
1496 cupsd_location_t *temp; /* New location */
1497 char location[HTTP_MAX_URI];
1498 /* Location of resource */
1499
1500
1501 /*
1502 * Use a local copy of location because cupsdAddLocation may cause
1503 * this memory to be moved...
1504 */
1505
1506 strlcpy(location, (*loc)->location, sizeof(location));
1507
1508 if ((temp = cupsdAddLocation(location)) == NULL)
1509 return (NULL);
1510
1511 /*
1512 * Copy the information from the original location to the new one.
1513 */
1514
1515 temp->limit = (*loc)->limit;
1516 temp->order_type = (*loc)->order_type;
1517 temp->type = (*loc)->type;
1518 temp->level = (*loc)->level;
1519 temp->satisfy = (*loc)->satisfy;
1520 temp->encryption = (*loc)->encryption;
1521
1522 if ((temp->num_names = (*loc)->num_names) > 0)
1523 {
1524 /*
1525 * Copy the names array...
1526 */
1527
1528 if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1529 {
1530 cupsdLogMessage(CUPSD_LOG_ERROR,
1531 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1532 temp->num_names, strerror(errno));
1533
1534 cupsdDeleteLocation(temp);
1535 return (NULL);
1536 }
1537
1538 for (i = 0; i < temp->num_names; i ++)
1539 if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1540 {
1541 cupsdLogMessage(CUPSD_LOG_ERROR,
1542 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1543 (*loc)->names[i], strerror(errno));
1544
1545 cupsdDeleteLocation(temp);
1546 return (NULL);
1547 }
1548 }
1549
1550 if ((temp->num_allow = (*loc)->num_allow) > 0)
1551 {
1552 /*
1553 * Copy allow rules...
1554 */
1555
1556 if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1557 {
1558 cupsdLogMessage(CUPSD_LOG_ERROR,
1559 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1560 temp->num_allow, strerror(errno));
1561 cupsdDeleteLocation(temp);
1562 return (NULL);
1563 }
1564
1565 for (i = 0; i < temp->num_allow; i ++)
1566 switch (temp->allow[i].type = (*loc)->allow[i].type)
1567 {
1568 case CUPSD_AUTH_NAME :
1569 temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1570 temp->allow[i].mask.name.name = strdup((*loc)->allow[i].mask.name.name);
1571
1572 if (temp->allow[i].mask.name.name == NULL)
1573 {
1574 cupsdLogMessage(CUPSD_LOG_ERROR,
1575 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1576 (*loc)->allow[i].mask.name.name, strerror(errno));
1577 cupsdDeleteLocation(temp);
1578 return (NULL);
1579 }
1580 break;
1581 case CUPSD_AUTH_IP :
1582 memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1583 sizeof(cupsd_ipmask_t));
1584 break;
1585 }
1586 }
1587
1588 if ((temp->num_deny = (*loc)->num_deny) > 0)
1589 {
1590 /*
1591 * Copy deny rules...
1592 */
1593
1594 if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1595 {
1596 cupsdLogMessage(CUPSD_LOG_ERROR,
1597 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1598 temp->num_deny, strerror(errno));
1599 cupsdDeleteLocation(temp);
1600 return (NULL);
1601 }
1602
1603 for (i = 0; i < temp->num_deny; i ++)
1604 switch (temp->deny[i].type = (*loc)->deny[i].type)
1605 {
1606 case CUPSD_AUTH_NAME :
1607 temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1608 temp->deny[i].mask.name.name = strdup((*loc)->deny[i].mask.name.name);
1609
1610 if (temp->deny[i].mask.name.name == NULL)
1611 {
1612 cupsdLogMessage(CUPSD_LOG_ERROR,
1613 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1614 (*loc)->deny[i].mask.name.name, strerror(errno));
1615 cupsdDeleteLocation(temp);
1616 return (NULL);
1617 }
1618 break;
1619 case CUPSD_AUTH_IP :
1620 memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1621 sizeof(cupsd_ipmask_t));
1622 break;
1623 }
1624 }
1625
1626 return (temp);
1627 }
1628
1629
1630 /*
1631 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1632 */
1633
1634 void
1635 cupsdDeleteAllLocations(void)
1636 {
1637 cupsd_location_t *loc; /* Current location */
1638
1639
1640 /*
1641 * Free all of the allow/deny records first...
1642 */
1643
1644 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1645 loc;
1646 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1647 cupsdDeleteLocation(loc);
1648
1649 /*
1650 * Then free the location array...
1651 */
1652
1653 cupsArrayDelete(Locations);
1654 Locations = NULL;
1655 }
1656
1657
1658 /*
1659 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1660 */
1661
1662 void
1663 cupsdDeleteLocation(
1664 cupsd_location_t *loc) /* I - Location to delete */
1665 {
1666 int i; /* Looping var */
1667 cupsd_authmask_t *mask; /* Current mask */
1668
1669
1670 cupsArrayRemove(Locations, loc);
1671
1672 for (i = loc->num_names - 1; i >= 0; i --)
1673 free(loc->names[i]);
1674
1675 if (loc->num_names > 0)
1676 free(loc->names);
1677
1678 for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1679 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
1680 free(mask->mask.name.name);
1681
1682 if (loc->num_allow > 0)
1683 free(loc->allow);
1684
1685 for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1686 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
1687 free(mask->mask.name.name);
1688
1689 if (loc->num_deny > 0)
1690 free(loc->deny);
1691
1692 free(loc->location);
1693 free(loc);
1694 }
1695
1696
1697 /*
1698 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1699 * location.
1700 */
1701
1702 void
1703 cupsdDenyHost(cupsd_location_t *loc, /* I - Location to add to */
1704 char *name) /* I - Name of host or domain to add */
1705 {
1706 cupsd_authmask_t *temp; /* New host/domain mask */
1707 char ifname[32], /* Interface name */
1708 *ifptr; /* Pointer to end of name */
1709
1710
1711 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1712 loc, loc->location ? loc->location : "nil", name);
1713
1714 if ((temp = add_deny(loc)) == NULL)
1715 return;
1716
1717 if (!strcasecmp(name, "@LOCAL"))
1718 {
1719 /*
1720 * Deny *interface*...
1721 */
1722
1723 temp->type = CUPSD_AUTH_INTERFACE;
1724 temp->mask.name.name = strdup("*");
1725 temp->mask.name.length = 1;
1726 }
1727 else if (!strncasecmp(name, "@IF(", 4))
1728 {
1729 /*
1730 * Deny *interface*...
1731 */
1732
1733 strlcpy(ifname, name + 4, sizeof(ifname));
1734
1735 ifptr = ifname + strlen(ifname);
1736
1737 if (ifptr[-1] == ')')
1738 {
1739 ifptr --;
1740 *ifptr = '\0';
1741 }
1742
1743 temp->type = CUPSD_AUTH_INTERFACE;
1744 temp->mask.name.name = strdup(ifname);
1745 temp->mask.name.length = ifptr - ifname;
1746 }
1747 else
1748 {
1749 /*
1750 * Deny name...
1751 */
1752
1753 temp->type = CUPSD_AUTH_NAME;
1754 temp->mask.name.name = strdup(name);
1755 temp->mask.name.length = strlen(name);
1756 }
1757 }
1758
1759
1760 /*
1761 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1762 * access the location.
1763 */
1764
1765 void
1766 cupsdDenyIP(cupsd_location_t *loc, /* I - Location to add to */
1767 const unsigned address[4],/* I - IP address to add */
1768 const unsigned netmask[4])/* I - Netmask of address */
1769 {
1770 cupsd_authmask_t *temp; /* New host/domain mask */
1771
1772
1773 cupsdLogMessage(CUPSD_LOG_DEBUG,
1774 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1775 loc, loc->location ? loc->location : "nil",
1776 address[0], address[1], address[2], address[3],
1777 netmask[0], netmask[1], netmask[2], netmask[3]);
1778
1779 if ((temp = add_deny(loc)) == NULL)
1780 return;
1781
1782 temp->type = CUPSD_AUTH_IP;
1783 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1784 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1785 }
1786
1787
1788 /*
1789 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1790 */
1791
1792 cupsd_location_t * /* O - Location that matches */
1793 cupsdFindBest(const char *path, /* I - Resource path */
1794 http_state_t state) /* I - HTTP state/request */
1795 {
1796 char uri[HTTP_MAX_URI],
1797 /* URI in request... */
1798 *uriptr; /* Pointer into URI */
1799 cupsd_location_t *loc, /* Current location */
1800 *best; /* Best match for location so far */
1801 int bestlen; /* Length of best match */
1802 int limit; /* Limit field */
1803 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1804 {
1805 CUPSD_AUTH_LIMIT_ALL,
1806 CUPSD_AUTH_LIMIT_OPTIONS,
1807 CUPSD_AUTH_LIMIT_GET,
1808 CUPSD_AUTH_LIMIT_GET,
1809 CUPSD_AUTH_LIMIT_HEAD,
1810 CUPSD_AUTH_LIMIT_POST,
1811 CUPSD_AUTH_LIMIT_POST,
1812 CUPSD_AUTH_LIMIT_POST,
1813 CUPSD_AUTH_LIMIT_PUT,
1814 CUPSD_AUTH_LIMIT_PUT,
1815 CUPSD_AUTH_LIMIT_DELETE,
1816 CUPSD_AUTH_LIMIT_TRACE,
1817 CUPSD_AUTH_LIMIT_ALL,
1818 CUPSD_AUTH_LIMIT_ALL
1819 };
1820
1821
1822 /*
1823 * First copy the connection URI to a local string so we have drop
1824 * any .ppd extension from the pathname in /printers or /classes
1825 * URIs...
1826 */
1827
1828 strlcpy(uri, path, sizeof(uri));
1829
1830 if (!strncmp(uri, "/printers/", 10) ||
1831 !strncmp(uri, "/classes/", 9))
1832 {
1833 /*
1834 * Check if the URI has .ppd on the end...
1835 */
1836
1837 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1838
1839 if (!strcmp(uriptr, ".ppd"))
1840 *uriptr = '\0';
1841 }
1842
1843 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1844
1845 /*
1846 * Loop through the list of locations to find a match...
1847 */
1848
1849 limit = limits[state];
1850 best = NULL;
1851 bestlen = 0;
1852
1853 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1854 loc;
1855 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1856 {
1857 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1858 loc->location ? loc->location : "nil", loc->limit);
1859
1860 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1861 {
1862 /*
1863 * Use case-insensitive comparison for queue names...
1864 */
1865
1866 if (loc->length > bestlen && loc->location &&
1867 !strncasecmp(uri, loc->location, loc->length) &&
1868 loc->location[0] == '/' &&
1869 (limit & loc->limit) != 0)
1870 {
1871 best = loc;
1872 bestlen = loc->length;
1873 }
1874 }
1875 else
1876 {
1877 /*
1878 * Use case-sensitive comparison for other URIs...
1879 */
1880
1881 if (loc->length > bestlen && loc->location &&
1882 !strncmp(uri, loc->location, loc->length) &&
1883 loc->location[0] == '/' &&
1884 (limit & loc->limit) != 0)
1885 {
1886 best = loc;
1887 bestlen = loc->length;
1888 }
1889 }
1890 }
1891
1892 /*
1893 * Return the match, if any...
1894 */
1895
1896 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1897 best ? best->location : "NONE");
1898
1899 return (best);
1900 }
1901
1902
1903 /*
1904 * 'cupsdFindLocation()' - Find the named location.
1905 */
1906
1907 cupsd_location_t * /* O - Location that matches */
1908 cupsdFindLocation(const char *location) /* I - Connection */
1909 {
1910 cupsd_location_t key; /* Search key */
1911
1912
1913 key.location = (char *)location;
1914
1915 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1916 }
1917
1918
1919 /*
1920 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1921 */
1922
1923 http_status_t /* O - HTTP_OK if authorized or error code */
1924 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1925 const char *owner)/* I - Owner of object */
1926 {
1927 int i, j, /* Looping vars */
1928 auth, /* Authorization status */
1929 type; /* Type of authentication */
1930 unsigned address[4]; /* Authorization address */
1931 cupsd_location_t *best; /* Best match for location so far */
1932 int hostlen; /* Length of hostname */
1933 char username[256], /* Username to authorize */
1934 ownername[256], /* Owner name to authorize */
1935 *ptr; /* Pointer into username */
1936 struct passwd *pw; /* User password data */
1937 static const char * const levels[] = /* Auth levels */
1938 {
1939 "ANON",
1940 "USER",
1941 "GROUP"
1942 };
1943 static const char * const types[] = /* Auth types */
1944 {
1945 "None",
1946 "Basic",
1947 "Digest",
1948 "BasicDigest",
1949 "Negotiate"
1950 };
1951
1952
1953 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1954 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1955 con->uri, con->best, con->best ? con->best->location ?
1956 con->best->location : "(null)" : "");
1957 if (owner)
1958 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1959 "cupsdIsAuthorized: owner=\"%s\"", owner);
1960
1961 /*
1962 * If there is no "best" authentication rule for this request, then
1963 * access is allowed from the local system and denied from other
1964 * addresses...
1965 */
1966
1967 if (!con->best)
1968 {
1969 if (!strcmp(con->http.hostname, "localhost") ||
1970 !strcmp(con->http.hostname, ServerName))
1971 return (HTTP_OK);
1972 else
1973 return (HTTP_FORBIDDEN);
1974 }
1975
1976 best = con->best;
1977
1978 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1979 type = DefaultAuthType;
1980
1981 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1982 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
1983 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
1984 levels[best->level], types[type],
1985 best->satisfy ? "ANY" : "ALL", best->num_names);
1986
1987 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1988 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1989 best->op, ippOpString(best->op));
1990
1991 /*
1992 * Check host/ip-based accesses...
1993 */
1994
1995 #ifdef AF_INET6
1996 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1997 {
1998 /*
1999 * Copy IPv6 address...
2000 */
2001
2002 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
2003 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
2004 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
2005 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
2006 }
2007 else
2008 #endif /* AF_INET6 */
2009 if (con->http.hostaddr->addr.sa_family == AF_INET)
2010 {
2011 /*
2012 * Copy IPv4 address...
2013 */
2014
2015 address[0] = 0;
2016 address[1] = 0;
2017 address[2] = 0;
2018 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
2019 }
2020 else
2021 memset(address, 0, sizeof(address));
2022
2023 hostlen = strlen(con->http.hostname);
2024
2025 auth = cupsdCheckAccess(address, con->http.hostname, hostlen, best)
2026 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
2027
2028 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
2029 auth ? "DENY" : "ALLOW");
2030
2031 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
2032 return (HTTP_FORBIDDEN);
2033
2034 #ifdef HAVE_SSL
2035 /*
2036 * See if encryption is required...
2037 */
2038
2039 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
2040 strcasecmp(con->http.hostname, "localhost") &&
2041 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
2042 !(type == CUPSD_AUTH_NEGOTIATE ||
2043 (type == CUPSD_AUTH_NONE && DefaultAuthType == CUPSD_AUTH_NEGOTIATE)))
2044 {
2045 cupsdLogMessage(CUPSD_LOG_DEBUG,
2046 "cupsdIsAuthorized: Need upgrade to TLS...");
2047 return (HTTP_UPGRADE_REQUIRED);
2048 }
2049 #endif /* HAVE_SSL */
2050
2051 /*
2052 * Now see what access level is required...
2053 */
2054
2055 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
2056 (type == CUPSD_AUTH_NONE && best->num_names == 0))
2057 return (HTTP_OK);
2058
2059 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
2060 best->limit == CUPSD_AUTH_LIMIT_IPP)
2061 {
2062 /*
2063 * Check for unauthenticated username...
2064 */
2065
2066 ipp_attribute_t *attr; /* requesting-user-name attribute */
2067
2068
2069 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
2070 if (attr)
2071 {
2072 cupsdLogMessage(CUPSD_LOG_DEBUG,
2073 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
2074 attr->values[0].string.text);
2075 strlcpy(username, attr->values[0].string.text, sizeof(username));
2076 }
2077 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2078 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2079 else
2080 return (HTTP_OK); /* unless overridden with Satisfy */
2081 }
2082 else
2083 {
2084 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
2085 con->username);
2086
2087 #ifdef HAVE_AUTHORIZATION_H
2088 if (!con->username[0] && !con->authref)
2089 #else
2090 if (!con->username[0])
2091 #endif /* HAVE_AUTHORIZATION_H */
2092 {
2093 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2094 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2095 else
2096 return (HTTP_OK); /* unless overridden with Satisfy */
2097 }
2098
2099 if (con->type != type && type != CUPSD_AUTH_NONE &&
2100 (con->type != CUPSD_AUTH_BASIC || type != CUPSD_AUTH_BASICDIGEST))
2101 {
2102 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
2103 types[con->type], types[type]);
2104
2105 return (HTTP_UNAUTHORIZED);
2106 }
2107
2108 strlcpy(username, con->username, sizeof(username));
2109 }
2110
2111 /*
2112 * OK, got a username. See if we need normal user access, or group
2113 * access... (root always matches)
2114 */
2115
2116 if (!strcmp(username, "root"))
2117 return (HTTP_OK);
2118
2119 /*
2120 * Strip any @domain or @KDC from the username and owner...
2121 */
2122
2123 if ((ptr = strchr(username, '@')) != NULL)
2124 *ptr = '\0';
2125
2126 if (owner)
2127 {
2128 strlcpy(ownername, owner, sizeof(ownername));
2129
2130 if ((ptr = strchr(ownername, '@')) != NULL)
2131 *ptr = '\0';
2132 }
2133 else
2134 ownername[0] = '\0';
2135
2136 /*
2137 * Get the user info...
2138 */
2139
2140 if (username[0])
2141 {
2142 pw = getpwnam(username);
2143 endpwent();
2144 }
2145 else
2146 pw = NULL;
2147
2148 if (best->level == CUPSD_AUTH_USER)
2149 {
2150 /*
2151 * If there are no names associated with this location, then
2152 * any valid user is OK...
2153 */
2154
2155 if (best->num_names == 0)
2156 return (HTTP_OK);
2157
2158 /*
2159 * Otherwise check the user list and return OK if this user is
2160 * allowed...
2161 */
2162
2163 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2164 "cupsdIsAuthorized: Checking user membership...");
2165
2166 #ifdef HAVE_AUTHORIZATION_H
2167 /*
2168 * If an authorization reference was supplied it must match a right name...
2169 */
2170
2171 if (con->authref)
2172 {
2173 for (i = 0; i < best->num_names; i ++)
2174 {
2175 if (!strncasecmp(best->names[i], "@AUTHKEY(", 9) &&
2176 check_authref(con, best->names[i] + 9))
2177 return (HTTP_OK);
2178 else if (!strcasecmp(best->names[i], "@SYSTEM") &&
2179 SystemGroupAuthKey &&
2180 check_authref(con, SystemGroupAuthKey))
2181 return (HTTP_OK);
2182 }
2183
2184 return (HTTP_FORBIDDEN);
2185 }
2186 #endif /* HAVE_AUTHORIZATION_H */
2187
2188 for (i = 0; i < best->num_names; i ++)
2189 {
2190 if (!strcasecmp(best->names[i], "@OWNER") && owner &&
2191 !strcasecmp(username, ownername))
2192 return (HTTP_OK);
2193 else if (!strcasecmp(best->names[i], "@SYSTEM"))
2194 {
2195 for (j = 0; j < NumSystemGroups; j ++)
2196 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2197 return (HTTP_OK);
2198 }
2199 else if (best->names[i][0] == '@')
2200 {
2201 if (cupsdCheckGroup(username, pw, best->names[i] + 1))
2202 return (HTTP_OK);
2203 }
2204 else if (!strcasecmp(username, best->names[i]))
2205 return (HTTP_OK);
2206 }
2207
2208 return (HTTP_FORBIDDEN);
2209 }
2210
2211 /*
2212 * Check to see if this user is in any of the named groups...
2213 */
2214
2215 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2216 "cupsdIsAuthorized: Checking group membership...");
2217
2218 /*
2219 * Check to see if this user is in any of the named groups...
2220 */
2221
2222 for (i = 0; i < best->num_names; i ++)
2223 {
2224 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2225 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2226 best->names[i]);
2227
2228 if (!strcasecmp(best->names[i], "@SYSTEM"))
2229 {
2230 for (j = 0; j < NumSystemGroups; j ++)
2231 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2232 return (HTTP_OK);
2233 }
2234 else if (cupsdCheckGroup(username, pw, best->names[i]))
2235 return (HTTP_OK);
2236 }
2237
2238 /*
2239 * The user isn't part of the specified group, so deny access...
2240 */
2241
2242 cupsdLogMessage(CUPSD_LOG_DEBUG,
2243 "cupsdIsAuthorized: User not in group(s)!");
2244
2245 return (HTTP_FORBIDDEN);
2246 }
2247
2248
2249 /*
2250 * 'add_allow()' - Add an allow mask to the location.
2251 */
2252
2253 static cupsd_authmask_t * /* O - New mask record */
2254 add_allow(cupsd_location_t *loc) /* I - Location to add to */
2255 {
2256 cupsd_authmask_t *temp; /* New mask record */
2257
2258
2259 /*
2260 * Range-check...
2261 */
2262
2263 if (loc == NULL)
2264 return (NULL);
2265
2266 /*
2267 * Try to allocate memory for the record...
2268 */
2269
2270 if (loc->num_allow == 0)
2271 temp = malloc(sizeof(cupsd_authmask_t));
2272 else
2273 temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
2274
2275 if (temp == NULL)
2276 return (NULL);
2277
2278 loc->allow = temp;
2279 temp += loc->num_allow;
2280 loc->num_allow ++;
2281
2282 /*
2283 * Clear the mask record and return...
2284 */
2285
2286 memset(temp, 0, sizeof(cupsd_authmask_t));
2287 return (temp);
2288 }
2289
2290
2291 /*
2292 * 'add_deny()' - Add a deny mask to the location.
2293 */
2294
2295 static cupsd_authmask_t * /* O - New mask record */
2296 add_deny(cupsd_location_t *loc) /* I - Location to add to */
2297 {
2298 cupsd_authmask_t *temp; /* New mask record */
2299
2300
2301 /*
2302 * Range-check...
2303 */
2304
2305 if (loc == NULL)
2306 return (NULL);
2307
2308 /*
2309 * Try to allocate memory for the record...
2310 */
2311
2312 if (loc->num_deny == 0)
2313 temp = malloc(sizeof(cupsd_authmask_t));
2314 else
2315 temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
2316
2317 if (temp == NULL)
2318 return (NULL);
2319
2320 loc->deny = temp;
2321 temp += loc->num_deny;
2322 loc->num_deny ++;
2323
2324 /*
2325 * Clear the mask record and return...
2326 */
2327
2328 memset(temp, 0, sizeof(cupsd_authmask_t));
2329 return (temp);
2330 }
2331
2332
2333 #ifdef HAVE_AUTHORIZATION_H
2334 /*
2335 * 'check_authref()' - Check if an authorization services reference has the
2336 * supplied right.
2337 */
2338
2339 static int /* O - 1 if right is valid, 0 otherwise */
2340 check_authref(cupsd_client_t *con, /* I - Connection */
2341 const char *right) /* I - Right name */
2342 {
2343 OSStatus status; /* OS Status */
2344 AuthorizationItem authright; /* Authorization right */
2345 AuthorizationRights authrights; /* Authorization rights */
2346 AuthorizationFlags authflags; /* Authorization flags */
2347
2348
2349 /*
2350 * Check to see if the user is allowed to perform the task...
2351 */
2352
2353 if (!con->authref)
2354 return (0);
2355
2356 authright.name = right;
2357 authright.valueLength = 0;
2358 authright.value = NULL;
2359 authright.flags = 0;
2360
2361 authrights.count = 1;
2362 authrights.items = &authright;
2363
2364 authflags = kAuthorizationFlagDefaults |
2365 kAuthorizationFlagExtendRights;
2366
2367 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2368 kAuthorizationEmptyEnvironment,
2369 authflags, NULL)) != 0)
2370 {
2371 cupsdLogMessage(CUPSD_LOG_ERROR,
2372 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2373 authright.name, (int)status, cssmErrorString(status));
2374 return (0);
2375 }
2376
2377 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2378 "AuthorizationCopyRights(\"%s\") succeeded!",
2379 authright.name);
2380
2381 return (1);
2382 }
2383 #endif /* HAVE_AUTHORIZATION_H */
2384
2385
2386 /*
2387 * 'compare_locations()' - Compare two locations.
2388 */
2389
2390 static int /* O - Result of comparison */
2391 compare_locations(cupsd_location_t *a, /* I - First location */
2392 cupsd_location_t *b) /* I - Second location */
2393 {
2394 return (strcmp(b->location, a->location));
2395 }
2396
2397
2398 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2399 /*
2400 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2401 * as needed.
2402 */
2403
2404 static char * /* O - Encrypted password */
2405 cups_crypt(const char *pw, /* I - Password string */
2406 const char *salt) /* I - Salt (key) string */
2407 {
2408 if (!strncmp(salt, "$1$", 3))
2409 {
2410 /*
2411 * Use MD5 passwords without the benefit of PAM; this is for
2412 * Slackware Linux, and the algorithm was taken from the
2413 * old shadow-19990827/lib/md5crypt.c source code... :(
2414 */
2415
2416 int i; /* Looping var */
2417 unsigned long n; /* Output number */
2418 int pwlen; /* Length of password string */
2419 const char *salt_end; /* End of "salt" data for MD5 */
2420 char *ptr; /* Pointer into result string */
2421 _cups_md5_state_t state; /* Primary MD5 state info */
2422 _cups_md5_state_t state2; /* Secondary MD5 state info */
2423 unsigned char digest[16]; /* MD5 digest result */
2424 static char result[120]; /* Final password string */
2425
2426
2427 /*
2428 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2429 * Get a maximum of 8 characters of salt data after $1$...
2430 */
2431
2432 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2433 if (*salt_end == '$')
2434 break;
2435
2436 /*
2437 * Compute the MD5 sum we need...
2438 */
2439
2440 pwlen = strlen(pw);
2441
2442 _cupsMD5Init(&state);
2443 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2444 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2445
2446 _cupsMD5Init(&state2);
2447 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2448 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2449 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2450 _cupsMD5Finish(&state2, digest);
2451
2452 for (i = pwlen; i > 0; i -= 16)
2453 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2454
2455 for (i = pwlen; i > 0; i >>= 1)
2456 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2457
2458 _cupsMD5Finish(&state, digest);
2459
2460 for (i = 0; i < 1000; i ++)
2461 {
2462 _cupsMD5Init(&state);
2463
2464 if (i & 1)
2465 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2466 else
2467 _cupsMD5Append(&state, digest, 16);
2468
2469 if (i % 3)
2470 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2471
2472 if (i % 7)
2473 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2474
2475 if (i & 1)
2476 _cupsMD5Append(&state, digest, 16);
2477 else
2478 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2479
2480 _cupsMD5Finish(&state, digest);
2481 }
2482
2483 /*
2484 * Copy the final sum to the result string and return...
2485 */
2486
2487 memcpy(result, salt, salt_end - salt);
2488 ptr = result + (salt_end - salt);
2489 *ptr++ = '$';
2490
2491 for (i = 0; i < 5; i ++, ptr += 4)
2492 {
2493 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2494
2495 if (i < 4)
2496 n |= digest[i + 12];
2497 else
2498 n |= digest[5];
2499
2500 to64(ptr, n, 4);
2501 }
2502
2503 to64(ptr, digest[11], 2);
2504 ptr += 2;
2505 *ptr = '\0';
2506
2507 return (result);
2508 }
2509 else
2510 {
2511 /*
2512 * Use the standard crypt() function...
2513 */
2514
2515 return (crypt(pw, salt));
2516 }
2517 }
2518 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2519
2520
2521 #ifdef HAVE_GSSAPI
2522 /*
2523 * 'get_gss_creds()' - Obtain GSS credentials.
2524 */
2525
2526 static gss_cred_id_t /* O - Server credentials */
2527 get_gss_creds(
2528 const char *service_name, /* I - Service name */
2529 const char *con_server_name) /* I - Hostname of server */
2530 {
2531 OM_uint32 major_status, /* Major status code */
2532 minor_status; /* Minor status code */
2533 gss_name_t server_name; /* Server name */
2534 gss_cred_id_t server_creds; /* Server credentials */
2535 gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
2536 /* Service name token */
2537 char buf[1024]; /* Service name buffer */
2538
2539
2540 snprintf(buf, sizeof(buf), "%s@%s", service_name, con_server_name);
2541
2542 token.value = buf;
2543 token.length = strlen(buf);
2544 server_name = GSS_C_NO_NAME;
2545 major_status = gss_import_name(&minor_status, &token,
2546 GSS_C_NT_HOSTBASED_SERVICE,
2547 &server_name);
2548
2549 memset(&token, 0, sizeof(token));
2550
2551 if (GSS_ERROR(major_status))
2552 {
2553 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2554 "gss_import_name() failed");
2555 return (NULL);
2556 }
2557
2558 major_status = gss_display_name(&minor_status, server_name, &token, NULL);
2559
2560 if (GSS_ERROR(major_status))
2561 {
2562 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2563 "gss_display_name() failed");
2564 return (NULL);
2565 }
2566
2567 cupsdLogMessage(CUPSD_LOG_DEBUG,
2568 "get_gss_creds: Attempting to acquire credentials for %s...",
2569 (char *)token.value);
2570
2571 server_creds = GSS_C_NO_CREDENTIAL;
2572 major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
2573 GSS_C_NO_OID_SET, GSS_C_ACCEPT,
2574 &server_creds, NULL, NULL);
2575 if (GSS_ERROR(major_status))
2576 {
2577 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2578 "gss_acquire_cred() failed");
2579 gss_release_name(&minor_status, &server_name);
2580 gss_release_buffer(&minor_status, &token);
2581 return (NULL);
2582 }
2583
2584 cupsdLogMessage(CUPSD_LOG_DEBUG,
2585 "get_gss_creds: Credentials acquired successfully for %s.",
2586 (char *)token.value);
2587
2588 gss_release_name(&minor_status, &server_name);
2589 gss_release_buffer(&minor_status, &token);
2590
2591 return (server_creds);
2592 }
2593 #endif /* HAVE_GSSAPI */
2594
2595
2596 /*
2597 * 'get_md5_password()' - Get an MD5 password.
2598 */
2599
2600 static char * /* O - MD5 password string */
2601 get_md5_password(const char *username, /* I - Username */
2602 const char *group, /* I - Group */
2603 char passwd[33]) /* O - MD5 password string */
2604 {
2605 cups_file_t *fp; /* passwd.md5 file */
2606 char filename[1024], /* passwd.md5 filename */
2607 line[256], /* Line from file */
2608 tempuser[33], /* User from file */
2609 tempgroup[33]; /* Group from file */
2610
2611
2612 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2613 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2614 username, group ? group : "(null)", passwd);
2615
2616 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2617 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2618 {
2619 if (errno != ENOENT)
2620 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2621 strerror(errno));
2622
2623 return (NULL);
2624 }
2625
2626 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2627 {
2628 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2629 {
2630 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2631 continue;
2632 }
2633
2634 if (!strcmp(username, tempuser) &&
2635 (group == NULL || !strcmp(group, tempgroup)))
2636 {
2637 /*
2638 * Found the password entry!
2639 */
2640
2641 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2642 username, tempgroup);
2643
2644 cupsFileClose(fp);
2645 return (passwd);
2646 }
2647 }
2648
2649 /*
2650 * Didn't find a password entry - return NULL!
2651 */
2652
2653 cupsFileClose(fp);
2654 return (NULL);
2655 }
2656
2657
2658 #if HAVE_LIBPAM
2659 /*
2660 * 'pam_func()' - PAM conversation function.
2661 */
2662
2663 static int /* O - Success or failure */
2664 pam_func(
2665 int num_msg, /* I - Number of messages */
2666 const struct pam_message **msg, /* I - Messages */
2667 struct pam_response **resp, /* O - Responses */
2668 void *appdata_ptr)
2669 /* I - Pointer to connection */
2670 {
2671 int i; /* Looping var */
2672 struct pam_response *replies; /* Replies */
2673 cupsd_authdata_t *data; /* Pointer to auth data */
2674
2675
2676 /*
2677 * Allocate memory for the responses...
2678 */
2679
2680 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2681 return (PAM_CONV_ERR);
2682
2683 /*
2684 * Answer all of the messages...
2685 */
2686
2687 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2688
2689 #ifdef __hpux
2690 /*
2691 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2692 * module. This is a workaround...
2693 */
2694
2695 data = auth_data;
2696 (void)appdata_ptr;
2697 #else
2698 data = (cupsd_authdata_t *)appdata_ptr;
2699 #endif /* __hpux */
2700
2701 for (i = 0; i < num_msg; i ++)
2702 {
2703 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2704
2705 switch (msg[i]->msg_style)
2706 {
2707 case PAM_PROMPT_ECHO_ON:
2708 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2709 data->username));
2710 replies[i].resp_retcode = PAM_SUCCESS;
2711 replies[i].resp = strdup(data->username);
2712 break;
2713
2714 case PAM_PROMPT_ECHO_OFF:
2715 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2716 data->password));
2717 replies[i].resp_retcode = PAM_SUCCESS;
2718 replies[i].resp = strdup(data->password);
2719 break;
2720
2721 case PAM_TEXT_INFO:
2722 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2723 replies[i].resp_retcode = PAM_SUCCESS;
2724 replies[i].resp = NULL;
2725 break;
2726
2727 case PAM_ERROR_MSG:
2728 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2729 replies[i].resp_retcode = PAM_SUCCESS;
2730 replies[i].resp = NULL;
2731 break;
2732
2733 default:
2734 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2735 msg[i]->msg_style));
2736 free(replies);
2737 return (PAM_CONV_ERR);
2738 }
2739 }
2740
2741 /*
2742 * Return the responses back to PAM...
2743 */
2744
2745 *resp = replies;
2746
2747 return (PAM_SUCCESS);
2748 }
2749 #elif !defined(HAVE_USERSEC_H)
2750
2751
2752 /*
2753 * 'to64()' - Base64-encode an integer value...
2754 */
2755
2756 static void
2757 to64(char *s, /* O - Output string */
2758 unsigned long v, /* I - Value to encode */
2759 int n) /* I - Number of digits */
2760 {
2761 const char *itoa64 = "./0123456789"
2762 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2763 "abcdefghijklmnopqrstuvwxyz";
2764
2765
2766 for (; n > 0; n --, v >>= 6)
2767 *s++ = itoa64[v & 0x3f];
2768 }
2769 #endif /* HAVE_LIBPAM */
2770
2771
2772 /*
2773 * End of "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $".
2774 */
Unnamed repository; edit this file 'description' to name the repository.