scheduler/auth.c

   1 /*
   2  * Authorization routines for the CUPS scheduler.
   3  *
   4  * Copyright © 2007-2019 by Apple Inc.
   5  * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * This file contains Kerberos support code, copyright 2006 by
   8  * Jelmer Vernooij.
   9  *
  10  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
  11  * information.
  12  */
  13
  14 /*
  15  * Include necessary headers...
  16  */
  17
  18 #include "cupsd.h"
  19 #include <grp.h>
  20 #ifdef HAVE_SHADOW_H
  21 #  include <shadow.h>
  22 #endif /* HAVE_SHADOW_H */
  23 #ifdef HAVE_CRYPT_H
  24 #  include <crypt.h>
  25 #endif /* HAVE_CRYPT_H */
  26 #if HAVE_LIBPAM
  27 #  ifdef HAVE_PAM_PAM_APPL_H
  28 #    include <pam/pam_appl.h>
  29 #  else
  30 #    include <security/pam_appl.h>
  31 #  endif /* HAVE_PAM_PAM_APPL_H */
  32 #endif /* HAVE_LIBPAM */
  33 #ifdef HAVE_MEMBERSHIP_H
  34 #  include <membership.h>
  35 #endif /* HAVE_MEMBERSHIP_H */
  36 #ifdef HAVE_AUTHORIZATION_H
  37 #  include <Security/AuthorizationTags.h>
  38 #endif /* HAVE_AUTHORIZATION_H */
  39 #ifdef HAVE_SYS_PARAM_H
  40 #  include <sys/param.h>
  41 #endif /* HAVE_SYS_PARAM_H */
  42 #ifdef HAVE_SYS_UCRED_H
  43 #  include <sys/ucred.h>
  44 typedef struct xucred cupsd_ucred_t;
  45 #  define CUPSD_UCRED_UID(c) (c).cr_uid
  46 #else
  47 #  ifndef __OpenBSD__
  48 typedef struct ucred cupsd_ucred_t;
  49 #  else
  50 typedef struct sockpeercred cupsd_ucred_t;
  51 #  endif
  52 #  define CUPSD_UCRED_UID(c) (c).uid
  53 #endif /* HAVE_SYS_UCRED_H */
  54
  55
  56 /*
  57  * Local functions...
  58  */
  59
  60 #ifdef HAVE_AUTHORIZATION_H
  61 static int              check_authref(cupsd_client_t *con, const char *right);
  62 #endif /* HAVE_AUTHORIZATION_H */
  63 static int              compare_locations(cupsd_location_t *a,
  64                                           cupsd_location_t *b);
  65 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
  66 static void             free_authmask(cupsd_authmask_t *am, void *data);
  67 #if HAVE_LIBPAM
  68 static int              pam_func(int, const struct pam_message **,
  69                                  struct pam_response **, void *);
  70 #endif /* HAVE_LIBPAM */
  71
  72
  73 /*
  74  * Local structures...
  75  */
  76
  77 #if HAVE_LIBPAM
  78 typedef struct cupsd_authdata_s         /**** Authentication data ****/
  79 {
  80   char  username[HTTP_MAX_VALUE],       /* Username string */
  81         password[HTTP_MAX_VALUE];       /* Password string */
  82 } cupsd_authdata_t;
  83 #endif /* HAVE_LIBPAM */
  84
  85
  86 /*
  87  * 'cupsdAddIPMask()' - Add an IP address authorization mask.
  88  */
  89
  90 int                                     /* O  - 1 on success, 0 on failure */
  91 cupsdAddIPMask(
  92     cups_array_t   **masks,             /* IO - Masks array (created as needed) */
  93     const unsigned address[4],          /* I  - IP address */
  94     const unsigned netmask[4])          /* I  - IP netmask */
  95 {
  96   cupsd_authmask_t      temp;           /* New host/domain mask */
  97
  98
  99   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", masks, *masks, address[0], address[1], address[2], address[3], netmask[0], netmask[1], netmask[2], netmask[3]);
 100
 101   temp.type = CUPSD_AUTH_IP;
 102   memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
 103   memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
 104
 105  /*
 106   * Create the masks array as needed and add...
 107   */
 108
 109   if (!*masks)
 110     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 111                            (cups_acopy_func_t)copy_authmask,
 112                            (cups_afree_func_t)free_authmask);
 113
 114   return (cupsArrayAdd(*masks, &temp));
 115 }
 116
 117
 118 /*
 119  * 'cupsdAddLocation()' - Add a location for authorization.
 120  */
 121
 122 void
 123 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
 124 {
 125  /*
 126   * Make sure the locations array is created...
 127   */
 128
 129   if (!Locations)
 130     Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
 131                               (cups_ahash_func_t)NULL, 0,
 132                               (cups_acopy_func_t)NULL,
 133                               (cups_afree_func_t)cupsdFreeLocation);
 134
 135   if (Locations)
 136   {
 137     cupsArrayAdd(Locations, loc);
 138
 139     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"", loc->location ? loc->location : "(null)");
 140   }
 141 }
 142
 143
 144 /*
 145  * 'cupsdAddName()' - Add a name to a location...
 146  */
 147
 148 void
 149 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 150              char             *name)    /* I - Name to add */
 151 {
 152   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")", loc, name);
 153
 154   if (!loc->names)
 155     loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
 156                                (cups_acopy_func_t)_cupsStrAlloc,
 157                                (cups_afree_func_t)_cupsStrFree);
 158
 159   if (!cupsArrayAdd(loc->names, name))
 160   {
 161     cupsdLogMessage(CUPSD_LOG_ERROR,
 162                     "Unable to duplicate name for location %s: %s",
 163                     loc->location ? loc->location : "nil", strerror(errno));
 164     return;
 165   }
 166 }
 167
 168
 169 /*
 170  * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
 171  */
 172
 173 int                                     /* O  - 1 on success, 0 on failure */
 174 cupsdAddNameMask(cups_array_t **masks,  /* IO - Masks array (created as needed) */
 175                  char         *name)    /* I  - Host or interface name */
 176 {
 177   cupsd_authmask_t      temp;           /* New host/domain mask */
 178   char                  ifname[32],     /* Interface name */
 179                         *ifptr;         /* Pointer to end of name */
 180
 181
 182   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", masks, *masks, name);
 183
 184   if (!_cups_strcasecmp(name, "@LOCAL"))
 185   {
 186    /*
 187     * Deny *interface*...
 188     */
 189
 190     temp.type           = CUPSD_AUTH_INTERFACE;
 191     temp.mask.name.name = (char *)"*";
 192   }
 193   else if (!_cups_strncasecmp(name, "@IF(", 4))
 194   {
 195    /*
 196     * Deny *interface*...
 197     */
 198
 199     strlcpy(ifname, name + 4, sizeof(ifname));
 200
 201     ifptr = ifname + strlen(ifname) - 1;
 202
 203     if (ifptr >= ifname && *ifptr == ')')
 204     {
 205       ifptr --;
 206       *ifptr = '\0';
 207     }
 208
 209     temp.type             = CUPSD_AUTH_INTERFACE;
 210     temp.mask.name.name   = ifname;
 211   }
 212   else
 213   {
 214    /*
 215     * Deny name...
 216     */
 217
 218     if (*name == '*')
 219       name ++;
 220
 221     temp.type             = CUPSD_AUTH_NAME;
 222     temp.mask.name.name   = (char *)name;
 223   }
 224
 225  /*
 226   * Set the name length...
 227   */
 228
 229   temp.mask.name.length = strlen(temp.mask.name.name);
 230
 231  /*
 232   * Create the masks array as needed and add...
 233   */
 234
 235   if (!*masks)
 236     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 237                            (cups_acopy_func_t)copy_authmask,
 238                            (cups_afree_func_t)free_authmask);
 239
 240   return (cupsArrayAdd(*masks, &temp));
 241 }
 242
 243
 244 /*
 245  * 'cupsdAuthorize()' - Validate any authorization credentials.
 246  */
 247
 248 void
 249 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 250 {
 251   int           type;                   /* Authentication type */
 252   const char    *authorization;         /* Pointer into Authorization string */
 253   char          *ptr,                   /* Pointer into string */
 254                 username[HTTP_MAX_VALUE],
 255                                         /* Username string */
 256                 password[HTTP_MAX_VALUE];
 257                                         /* Password string */
 258   cupsd_cert_t  *localuser;             /* Certificate username */
 259
 260
 261  /*
 262   * Locate the best matching location so we know what kind of
 263   * authentication to expect...
 264   */
 265
 266   con->best = cupsdFindBest(con->uri, httpGetState(con->http));
 267   con->type = CUPSD_AUTH_NONE;
 268
 269   cupsdLogClient(con, CUPSD_LOG_DEBUG2, "con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location : "");
 270
 271   if (con->best && con->best->type != CUPSD_AUTH_NONE)
 272   {
 273     if (con->best->type == CUPSD_AUTH_DEFAULT)
 274       type = cupsdDefaultAuthType();
 275     else
 276       type = con->best->type;
 277   }
 278   else
 279     type = cupsdDefaultAuthType();
 280
 281  /*
 282   * Decode the Authorization string...
 283   */
 284
 285   authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
 286
 287   username[0] = '\0';
 288   password[0] = '\0';
 289
 290 #ifdef HAVE_GSSAPI
 291   con->gss_uid = 0;
 292 #endif /* HAVE_GSSAPI */
 293
 294 #ifdef HAVE_AUTHORIZATION_H
 295   if (con->authref)
 296   {
 297     AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
 298     con->authref = NULL;
 299   }
 300 #endif /* HAVE_AUTHORIZATION_H */
 301
 302   if (!*authorization)
 303   {
 304    /*
 305     * No authorization data provided, return early...
 306     */
 307
 308     cupsdLogClient(con, CUPSD_LOG_DEBUG, "No authentication data provided.");
 309     return;
 310   }
 311 #ifdef HAVE_AUTHORIZATION_H
 312   else if (!strncmp(authorization, "AuthRef ", 8) &&
 313            httpAddrLocalhost(httpGetAddress(con->http)))
 314   {
 315     OSStatus            status;         /* Status */
 316     char                authdata[HTTP_MAX_VALUE];
 317                                         /* Nonce value from client */
 318     int                 authlen;        /* Auth string length */
 319     AuthorizationItemSet *authinfo;     /* Authorization item set */
 320
 321    /*
 322     * Get the Authorization Services data...
 323     */
 324
 325     authorization += 8;
 326     while (isspace(*authorization & 255))
 327       authorization ++;
 328
 329     authlen = sizeof(authdata);
 330     httpDecode64_2(authdata, &authlen, authorization);
 331
 332     if (authlen != kAuthorizationExternalFormLength)
 333     {
 334       cupsdLogClient(con, CUPSD_LOG_ERROR, "External Authorization reference size is incorrect.");
 335       return;
 336     }
 337
 338     if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
 339     {
 340       cupsdLogClient(con, CUPSD_LOG_ERROR, "AuthorizationCreateFromExternalForm returned %d", (int)status);
 341       return;
 342     }
 343
 344     username[0] = '\0';
 345
 346     if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
 347                                &authinfo))
 348     {
 349       if (authinfo->count == 1 && authinfo->items[0].value &&
 350           authinfo->items[0].valueLength >= 2)
 351       {
 352         strlcpy(username, authinfo->items[0].value, sizeof(username));
 353
 354         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef.", username);
 355       }
 356
 357       AuthorizationFreeItemSet(authinfo);
 358     }
 359
 360     if (!username[0])
 361     {
 362      /*
 363       * No username in AuthRef, grab username using peer credentials...
 364       */
 365
 366       struct passwd     *pwd;           /* Password entry for this user */
 367       cupsd_ucred_t     peercred;       /* Peer credentials */
 368       socklen_t         peersize;       /* Size of peer credentials */
 369
 370       peersize = sizeof(peercred);
 371
 372       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 373       {
 374         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 375         return;
 376       }
 377
 378       if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
 379       {
 380         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred));
 381         return;
 382       }
 383
 384       strlcpy(username, pwd->pw_name, sizeof(username));
 385
 386       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef + PeerCred.", username);
 387     }
 388
 389     con->type = CUPSD_AUTH_BASIC;
 390   }
 391 #endif /* HAVE_AUTHORIZATION_H */
 392 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
 393   else if (!strncmp(authorization, "PeerCred ", 9) &&
 394            con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
 395   {
 396    /*
 397     * Use peer credentials from domain socket connection...
 398     */
 399
 400     struct passwd       *pwd;           /* Password entry for this user */
 401     cupsd_ucred_t       peercred;       /* Peer credentials */
 402     socklen_t           peersize;       /* Size of peer credentials */
 403 #ifdef HAVE_AUTHORIZATION_H
 404     const char          *name;          /* Authorizing name */
 405     int                 no_peer = 0;    /* Don't allow peer credentials? */
 406
 407    /*
 408     * See if we should allow peer credentials...
 409     */
 410
 411     for (name = (char *)cupsArrayFirst(con->best->names);
 412          name;
 413          name = (char *)cupsArrayNext(con->best->names))
 414     {
 415       if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
 416           !_cups_strcasecmp(name, "@SYSTEM"))
 417       {
 418        /* Normally don't want peer credentials if we need an auth key... */
 419         no_peer = 1;
 420       }
 421       else if (!_cups_strcasecmp(name, "@OWNER"))
 422       {
 423        /* but if @OWNER is present then we allow it... */
 424         no_peer = 0;
 425         break;
 426       }
 427     }
 428
 429     if (no_peer)
 430     {
 431       cupsdLogClient(con, CUPSD_LOG_ERROR, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
 432       return;
 433     }
 434 #endif /* HAVE_AUTHORIZATION_H */
 435
 436     if ((pwd = getpwnam(authorization + 9)) == NULL)
 437     {
 438       cupsdLogClient(con, CUPSD_LOG_ERROR, "User \"%s\" does not exist.", authorization + 9);
 439       return;
 440     }
 441
 442     peersize = sizeof(peercred);
 443
 444 #  ifdef __APPLE__
 445     if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 446 #  else
 447     if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
 448 #  endif /* __APPLE__ */
 449     {
 450       cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 451       return;
 452     }
 453
 454     if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
 455     {
 456       cupsdLogClient(con, CUPSD_LOG_ERROR, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization + 9, CUPSD_UCRED_UID(peercred), pwd->pw_uid);
 457 #  ifdef HAVE_SYS_UCRED_H
 458       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_version=%d", peercred.cr_version);
 459       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_uid=%d", peercred.cr_uid);
 460       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_ngroups=%d", peercred.cr_ngroups);
 461       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_groups[0]=%d", peercred.cr_groups[0]);
 462 #  endif /* HAVE_SYS_UCRED_H */
 463       return;
 464     }
 465
 466     strlcpy(username, authorization + 9, sizeof(username));
 467
 468 #  ifdef HAVE_GSSAPI
 469     con->gss_uid = CUPSD_UCRED_UID(peercred);
 470 #  endif /* HAVE_GSSAPI */
 471
 472     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using PeerCred.", username);
 473
 474     con->type = CUPSD_AUTH_BASIC;
 475   }
 476 #endif /* SO_PEERCRED && AF_LOCAL */
 477   else if (!strncmp(authorization, "Local", 5) &&
 478            httpAddrLocalhost(httpGetAddress(con->http)))
 479   {
 480    /*
 481     * Get Local certificate authentication data...
 482     */
 483
 484     authorization += 5;
 485     while (isspace(*authorization & 255))
 486       authorization ++;
 487
 488     if ((localuser = cupsdFindCert(authorization)) == NULL)
 489     {
 490       cupsdLogClient(con, CUPSD_LOG_ERROR, "Local authentication certificate not found.");
 491       return;
 492     }
 493
 494     strlcpy(username, localuser->username, sizeof(username));
 495     con->type = localuser->type;
 496
 497     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using Local.", username);
 498   }
 499   else if (!strncmp(authorization, "Basic", 5))
 500   {
 501    /*
 502     * Get the Basic authentication data...
 503     */
 504
 505     int userlen;                        /* Username:password length */
 506
 507
 508     authorization += 5;
 509     while (isspace(*authorization & 255))
 510       authorization ++;
 511
 512     userlen = sizeof(username);
 513     httpDecode64_2(username, &userlen, authorization);
 514
 515    /*
 516     * Pull the username and password out...
 517     */
 518
 519     if ((ptr = strchr(username, ':')) == NULL)
 520     {
 521       cupsdLogClient(con, CUPSD_LOG_ERROR, "Missing Basic password.");
 522       return;
 523     }
 524
 525     *ptr++ = '\0';
 526
 527     if (!username[0])
 528     {
 529      /*
 530       * Username must not be empty...
 531       */
 532
 533       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic username.");
 534       return;
 535     }
 536
 537     if (!*ptr)
 538     {
 539      /*
 540       * Password must not be empty...
 541       */
 542
 543       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic password.");
 544       return;
 545     }
 546
 547     strlcpy(password, ptr, sizeof(password));
 548
 549    /*
 550     * Validate the username and password...
 551     */
 552
 553     switch (type)
 554     {
 555       default :
 556       case CUPSD_AUTH_BASIC :
 557           {
 558 #if HAVE_LIBPAM
 559            /*
 560             * Only use PAM to do authentication.  This supports MD5
 561             * passwords, among other things...
 562             */
 563
 564             pam_handle_t        *pamh;  /* PAM authentication handle */
 565             int                 pamerr; /* PAM error code */
 566             struct pam_conv     pamdata;/* PAM conversation data */
 567             cupsd_authdata_t    data;   /* Authentication data */
 568
 569
 570             strlcpy(data.username, username, sizeof(data.username));
 571             strlcpy(data.password, password, sizeof(data.password));
 572
 573 #  ifdef __sun
 574             pamdata.conv        = (int (*)(int, struct pam_message **,
 575                                            struct pam_response **,
 576                                            void *))pam_func;
 577 #  else
 578             pamdata.conv        = pam_func;
 579 #  endif /* __sun */
 580             pamdata.appdata_ptr = &data;
 581
 582             pamerr = pam_start("cups", username, &pamdata, &pamh);
 583             if (pamerr != PAM_SUCCESS)
 584             {
 585               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_start() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 586               return;
 587             }
 588
 589 #  ifdef HAVE_PAM_SET_ITEM
 590 #    ifdef PAM_RHOST
 591             pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
 592             if (pamerr != PAM_SUCCESS)
 593               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 594 #    endif /* PAM_RHOST */
 595
 596 #    ifdef PAM_TTY
 597             pamerr = pam_set_item(pamh, PAM_TTY, "cups");
 598             if (pamerr != PAM_SUCCESS)
 599               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 600 #    endif /* PAM_TTY */
 601 #  endif /* HAVE_PAM_SET_ITEM */
 602
 603             pamerr = pam_authenticate(pamh, PAM_SILENT);
 604             if (pamerr != PAM_SUCCESS)
 605             {
 606               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_authenticate() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 607               pam_end(pamh, 0);
 608               return;
 609             }
 610
 611 #  ifdef HAVE_PAM_SETCRED
 612             pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
 613             if (pamerr != PAM_SUCCESS)
 614               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_setcred() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 615 #  endif /* HAVE_PAM_SETCRED */
 616
 617             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 618             if (pamerr != PAM_SUCCESS)
 619             {
 620               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_acct_mgmt() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 621               pam_end(pamh, 0);
 622               return;
 623             }
 624
 625             pam_end(pamh, PAM_SUCCESS);
 626
 627 #else
 628            /*
 629             * Use normal UNIX password file-based authentication...
 630             */
 631
 632             char                *pass;  /* Encrypted password */
 633             struct passwd       *pw;    /* User password data */
 634 #  ifdef HAVE_SHADOW_H
 635             struct spwd         *spw;   /* Shadow password data */
 636 #  endif /* HAVE_SHADOW_H */
 637
 638
 639             pw = getpwnam(username);    /* Get the current password */
 640             endpwent();                 /* Close the password file */
 641
 642             if (!pw)
 643             {
 644              /*
 645               * No such user...
 646               */
 647
 648               cupsdLogClient(con, CUPSD_LOG_ERROR, "Unknown username \"%s\".", username);
 649               return;
 650             }
 651
 652 #  ifdef HAVE_SHADOW_H
 653             spw = getspnam(username);
 654             endspent();
 655
 656             if (!spw && !strcmp(pw->pw_passwd, "x"))
 657             {
 658              /*
 659               * Don't allow blank passwords!
 660               */
 661
 662               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no shadow password.", username);
 663               return;
 664             }
 665
 666             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 667 #  else
 668             if (!pw->pw_passwd[0])
 669 #  endif /* HAVE_SHADOW_H */
 670             {
 671              /*
 672               * Don't allow blank passwords!
 673               */
 674
 675               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no password.", username);
 676               return;
 677             }
 678
 679            /*
 680             * OK, the password isn't blank, so compare with what came from the
 681             * client...
 682             */
 683
 684             pass = crypt(password, pw->pw_passwd);
 685
 686             if (!pass || strcmp(pw->pw_passwd, pass))
 687             {
 688 #  ifdef HAVE_SHADOW_H
 689               if (spw)
 690               {
 691                 pass = crypt(password, spw->sp_pwdp);
 692
 693                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 694                 {
 695                   cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 696                   return;
 697                 }
 698               }
 699               else
 700 #  endif /* HAVE_SHADOW_H */
 701               {
 702                 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 703                 return;
 704               }
 705             }
 706 #endif /* HAVE_LIBPAM */
 707           }
 708
 709           cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
 710           break;
 711     }
 712
 713     con->type = type;
 714   }
 715 #ifdef HAVE_GSSAPI
 716   else if (!strncmp(authorization, "Negotiate", 9))
 717   {
 718     int                 len;            /* Length of authorization string */
 719     gss_ctx_id_t        context;        /* Authorization context */
 720     OM_uint32           major_status,   /* Major status code */
 721                         minor_status;   /* Minor status code */
 722     gss_buffer_desc     input_token = GSS_C_EMPTY_BUFFER,
 723                                         /* Input token from string */
 724                         output_token = GSS_C_EMPTY_BUFFER;
 725                                         /* Output token for username */
 726     gss_name_t          client_name;    /* Client name */
 727
 728
 729 #  ifdef __APPLE__
 730    /*
 731     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
 732     * to use it...
 733     */
 734
 735     if (&gss_init_sec_context == NULL)
 736     {
 737       cupsdLogClient(con, CUPSD_LOG_WARN, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
 738       return;
 739     }
 740 #  endif /* __APPLE__ */
 741
 742    /*
 743     * Find the start of the Kerberos input token...
 744     */
 745
 746     authorization += 9;
 747     while (isspace(*authorization & 255))
 748       authorization ++;
 749
 750     if (!*authorization)
 751     {
 752       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "No authentication data specified.");
 753       return;
 754     }
 755
 756    /*
 757     * Decode the authorization string to get the input token...
 758     */
 759
 760     len                = (int)strlen(authorization);
 761     input_token.value  = malloc((size_t)len);
 762     input_token.value  = httpDecode64_2(input_token.value, &len,
 763                                         authorization);
 764     input_token.length = (size_t)len;
 765
 766    /*
 767     * Accept the input token to get the authorization info...
 768     */
 769
 770     context      = GSS_C_NO_CONTEXT;
 771     client_name  = GSS_C_NO_NAME;
 772     major_status = gss_accept_sec_context(&minor_status,
 773                                           &context,
 774                                           ServerCreds,
 775                                           &input_token,
 776                                           GSS_C_NO_CHANNEL_BINDINGS,
 777                                           &client_name,
 778                                           NULL,
 779                                           &output_token,
 780                                           NULL,
 781                                           NULL,
 782                                           NULL);
 783
 784     if (output_token.length > 0)
 785       gss_release_buffer(&minor_status, &output_token);
 786
 787     if (GSS_ERROR(major_status))
 788     {
 789       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error accepting GSSAPI security context.", con->number);
 790
 791       if (context != GSS_C_NO_CONTEXT)
 792         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 793       return;
 794     }
 795
 796     con->have_gss = 1;
 797
 798    /*
 799     * Get the username associated with the client's credentials...
 800     */
 801
 802     if (major_status == GSS_S_CONTINUE_NEEDED)
 803       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Credentials not complete.", con->number);
 804     else if (major_status == GSS_S_COMPLETE)
 805     {
 806       major_status = gss_display_name(&minor_status, client_name,
 807                                       &output_token, NULL);
 808
 809       if (GSS_ERROR(major_status))
 810       {
 811         cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error getting username.", con->number);
 812         gss_release_name(&minor_status, &client_name);
 813         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 814         return;
 815       }
 816
 817       strlcpy(username, output_token.value, sizeof(username));
 818
 819       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Negotiate.", username);
 820
 821       gss_release_name(&minor_status, &client_name);
 822       gss_release_buffer(&minor_status, &output_token);
 823
 824       con->type = CUPSD_AUTH_NEGOTIATE;
 825     }
 826
 827     gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 828
 829 #  if defined(SO_PEERCRED) && defined(AF_LOCAL)
 830    /*
 831     * Get the client's UID if we are printing locally - that allows a backend
 832     * to run as the correct user to get Kerberos credentials of its own.
 833     */
 834
 835     if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
 836     {
 837       cupsd_ucred_t     peercred;       /* Peer credentials */
 838       socklen_t         peersize;       /* Size of peer credentials */
 839
 840       peersize = sizeof(peercred);
 841
 842 #    ifdef __APPLE__
 843       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 844 #    else
 845       if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
 846                      &peersize))
 847 #    endif /* __APPLE__ */
 848       {
 849         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 850       }
 851       else
 852       {
 853         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred));
 854         con->gss_uid = CUPSD_UCRED_UID(peercred);
 855       }
 856     }
 857 #  endif /* SO_PEERCRED && AF_LOCAL */
 858   }
 859 #endif /* HAVE_GSSAPI */
 860   else
 861   {
 862     char        scheme[256];            /* Auth scheme... */
 863
 864
 865     if (sscanf(authorization, "%255s", scheme) != 1)
 866       strlcpy(scheme, "UNKNOWN", sizeof(scheme));
 867
 868     cupsdLogClient(con, CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\".", scheme);
 869     return;
 870   }
 871
 872  /*
 873   * If we get here, then we were able to validate the username and
 874   * password - copy the validated username and password to the client
 875   * data and return...
 876   */
 877
 878   strlcpy(con->username, username, sizeof(con->username));
 879   strlcpy(con->password, password, sizeof(con->password));
 880 }
 881
 882
 883 /*
 884  * 'cupsdCheckAccess()' - Check whether the given address is allowed to
 885  *                        access a location.
 886  */
 887
 888 int                                     /* O - 1 if allowed, 0 otherwise */
 889 cupsdCheckAccess(
 890     unsigned         ip[4],             /* I - Client address */
 891     const char       *name,             /* I - Client hostname */
 892     size_t           namelen,           /* I - Length of hostname */
 893     cupsd_location_t *loc)              /* I - Location to check */
 894 {
 895   int   allow;                          /* 1 if allowed, 0 otherwise */
 896
 897
 898   if (!_cups_strcasecmp(name, "localhost"))
 899   {
 900    /*
 901     * Access from localhost (127.0.0.1 or ::1) is always allowed...
 902     */
 903
 904     return (1);
 905   }
 906   else
 907   {
 908    /*
 909     * Do authorization checks on the domain/address...
 910     */
 911
 912     switch (loc->order_type)
 913     {
 914       default :
 915           allow = 0;    /* anti-compiler-warning-code */
 916           break;
 917
 918       case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
 919           allow = 1;
 920
 921           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 922             allow = 0;
 923
 924           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 925             allow = 1;
 926           break;
 927
 928       case CUPSD_AUTH_DENY : /* Order Allow,Deny */
 929           allow = 0;
 930
 931           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 932             allow = 1;
 933
 934           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 935             allow = 0;
 936           break;
 937     }
 938   }
 939
 940   return (allow);
 941 }
 942
 943
 944 /*
 945  * 'cupsdCheckAuth()' - Check authorization masks.
 946  */
 947
 948 int                                     /* O - 1 if mask matches, 0 otherwise */
 949 cupsdCheckAuth(unsigned     ip[4],      /* I - Client address */
 950                const char   *name,      /* I - Client hostname */
 951                size_t       name_len,   /* I - Length of hostname */
 952                cups_array_t *masks)     /* I - Masks */
 953 {
 954   int                   i;              /* Looping var */
 955   cupsd_authmask_t      *mask;          /* Current mask */
 956   cupsd_netif_t         *iface;         /* Network interface */
 957   unsigned              netip4;         /* IPv4 network address */
 958 #ifdef AF_INET6
 959   unsigned              netip6[4];      /* IPv6 network address */
 960 #endif /* AF_INET6 */
 961
 962
 963   for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
 964        mask;
 965        mask = (cupsd_authmask_t *)cupsArrayNext(masks))
 966   {
 967     switch (mask->type)
 968     {
 969       case CUPSD_AUTH_INTERFACE :
 970          /*
 971           * Check for a match with a network interface...
 972           */
 973
 974           netip4 = htonl(ip[3]);
 975
 976 #ifdef AF_INET6
 977           netip6[0] = htonl(ip[0]);
 978           netip6[1] = htonl(ip[1]);
 979           netip6[2] = htonl(ip[2]);
 980           netip6[3] = htonl(ip[3]);
 981 #endif /* AF_INET6 */
 982
 983           cupsdNetIFUpdate();
 984
 985           if (!strcmp(mask->mask.name.name, "*"))
 986           {
 987 #ifdef __APPLE__
 988            /*
 989             * Allow Back-to-My-Mac addresses...
 990             */
 991
 992             if ((ip[0] & 0xff000000) == 0xfd000000)
 993               return (1);
 994 #endif /* __APPLE__ */
 995
 996            /*
 997             * Check against all local interfaces...
 998             */
 999
1000             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1001                  iface;
1002                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1003             {
1004              /*
1005               * Only check local interfaces...
1006               */
1007
1008               if (!iface->is_local)
1009                 continue;
1010
1011               if (iface->address.addr.sa_family == AF_INET)
1012               {
1013                /*
1014                 * Check IPv4 address...
1015                 */
1016
1017                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1018                     (iface->address.ipv4.sin_addr.s_addr &
1019                      iface->mask.ipv4.sin_addr.s_addr))
1020                   return (1);
1021               }
1022 #ifdef AF_INET6
1023               else
1024               {
1025                /*
1026                 * Check IPv6 address...
1027                 */
1028
1029                 for (i = 0; i < 4; i ++)
1030                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1031                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1032                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1033                     break;
1034
1035                 if (i == 4)
1036                   return (1);
1037               }
1038 #endif /* AF_INET6 */
1039             }
1040           }
1041           else
1042           {
1043            /*
1044             * Check the named interface...
1045             */
1046
1047             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1048                  iface;
1049                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1050             {
1051               if (strcmp(mask->mask.name.name, iface->name))
1052                 continue;
1053
1054               if (iface->address.addr.sa_family == AF_INET)
1055               {
1056                /*
1057                 * Check IPv4 address...
1058                 */
1059
1060                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1061                     (iface->address.ipv4.sin_addr.s_addr &
1062                      iface->mask.ipv4.sin_addr.s_addr))
1063                   return (1);
1064               }
1065 #ifdef AF_INET6
1066               else
1067               {
1068                /*
1069                 * Check IPv6 address...
1070                 */
1071
1072                 for (i = 0; i < 4; i ++)
1073                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1074                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1075                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1076                     break;
1077
1078                 if (i == 4)
1079                   return (1);
1080               }
1081 #endif /* AF_INET6 */
1082             }
1083           }
1084           break;
1085
1086       case CUPSD_AUTH_NAME :
1087          /*
1088           * Check for exact name match...
1089           */
1090
1091           if (!_cups_strcasecmp(name, mask->mask.name.name))
1092             return (1);
1093
1094          /*
1095           * Check for domain match...
1096           */
1097
1098           if (name_len >= mask->mask.name.length &&
1099               mask->mask.name.name[0] == '.' &&
1100               !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1101                           mask->mask.name.name))
1102             return (1);
1103           break;
1104
1105       case CUPSD_AUTH_IP :
1106          /*
1107           * Check for IP/network address match...
1108           */
1109
1110           for (i = 0; i < 4; i ++)
1111             if ((ip[i] & mask->mask.ip.netmask[i]) !=
1112                     mask->mask.ip.address[i])
1113               break;
1114
1115           if (i == 4)
1116             return (1);
1117           break;
1118     }
1119   }
1120
1121   return (0);
1122 }
1123
1124
1125 /*
1126  * 'cupsdCheckGroup()' - Check for a user's group membership.
1127  */
1128
1129 int                                     /* O - 1 if user is a member, 0 otherwise */
1130 cupsdCheckGroup(
1131     const char    *username,            /* I - User name */
1132     struct passwd *user,                /* I - System user info */
1133     const char    *groupname)           /* I - Group name */
1134 {
1135   int           i;                      /* Looping var */
1136   struct group  *group;                 /* Group info */
1137   gid_t         groupid;                /* ID of named group */
1138 #ifdef HAVE_MBR_UID_TO_UUID
1139   uuid_t        useruuid,               /* UUID for username */
1140                 groupuuid;              /* UUID for groupname */
1141   int           is_member;              /* True if user is a member of group */
1142 #endif /* HAVE_MBR_UID_TO_UUID */
1143
1144
1145   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username, user, groupname);
1146
1147  /*
1148   * Validate input...
1149   */
1150
1151   if (!username || !groupname)
1152     return (0);
1153
1154  /*
1155   * Check to see if the user is a member of the named group...
1156   */
1157
1158   group = getgrnam(groupname);
1159   endgrent();
1160
1161   if (group != NULL)
1162   {
1163    /*
1164     * Group exists, check it...
1165     */
1166
1167     groupid = group->gr_gid;
1168
1169 #ifdef HAVE_GETGROUPLIST
1170     if (user)
1171     {
1172       int       ngroups;                /* Number of groups */
1173 #  ifdef __APPLE__
1174       int       groups[2048];           /* Groups that user belongs to */
1175 #  else
1176       gid_t     groups[2048];           /* Groups that user belongs to */
1177 #  endif /* __APPLE__ */
1178
1179       ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
1180 #  ifdef __APPLE__
1181       getgrouplist(username, (int)user->pw_gid, groups, &ngroups);
1182 #  else
1183       getgrouplist(username, user->pw_gid, groups, &ngroups);
1184 #endif /* __APPLE__ */
1185
1186       for (i = 0; i < ngroups; i ++)
1187         if ((int)groupid == (int)groups[i])
1188           return (1);
1189     }
1190
1191 #else
1192     for (i = 0; group->gr_mem[i]; i ++)
1193     {
1194       if (!_cups_strcasecmp(username, group->gr_mem[i]))
1195         return (1);
1196     }
1197 #endif /* HAVE_GETGROUPLIST */
1198   }
1199   else
1200     groupid = (gid_t)-1;
1201
1202  /*
1203   * Group doesn't exist or user not in group list, check the group ID
1204   * against the user's group ID...
1205   */
1206
1207   if (user && groupid == user->pw_gid)
1208     return (1);
1209
1210 #ifdef HAVE_MBR_UID_TO_UUID
1211  /*
1212   * Check group membership through macOS membership API...
1213   */
1214
1215   if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1216   {
1217     if (groupid != (gid_t)-1)
1218     {
1219      /*
1220       * Map group name to UUID and check membership...
1221       */
1222
1223       if (!mbr_gid_to_uuid(groupid, groupuuid))
1224         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1225           if (is_member)
1226             return (1);
1227     }
1228     else if (groupname[0] == '#')
1229     {
1230      /*
1231       * Use UUID directly and check for equality (user UUID) and
1232       * membership (group UUID)...
1233       */
1234
1235       if (!uuid_parse((char *)groupname + 1, groupuuid))
1236       {
1237         if (!uuid_compare(useruuid, groupuuid))
1238           return (1);
1239         else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1240           if (is_member)
1241             return (1);
1242       }
1243
1244       return (0);
1245     }
1246   }
1247   else if (groupname[0] == '#')
1248     return (0);
1249 #endif /* HAVE_MBR_UID_TO_UUID */
1250
1251  /*
1252   * If we get this far, then the user isn't part of the named group...
1253   */
1254
1255   return (0);
1256 }
1257
1258
1259 /*
1260  * 'cupsdCopyLocation()' - Make a copy of a location...
1261  */
1262
1263 cupsd_location_t *                      /* O - New location */
1264 cupsdCopyLocation(
1265     cupsd_location_t *loc)              /* I - Original location */
1266 {
1267   cupsd_location_t      *temp;          /* New location */
1268
1269
1270  /*
1271   * Make a copy of the original location...
1272   */
1273
1274   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1275     return (NULL);
1276
1277  /*
1278   * Copy the information from the original location to the new one.
1279   */
1280
1281   if (!loc)
1282     return (temp);
1283
1284   if (loc->location)
1285     temp->location = _cupsStrAlloc(loc->location);
1286
1287   temp->length     = loc->length;
1288   temp->limit      = loc->limit;
1289   temp->order_type = loc->order_type;
1290   temp->type       = loc->type;
1291   temp->level      = loc->level;
1292   temp->satisfy    = loc->satisfy;
1293   temp->encryption = loc->encryption;
1294
1295   if (loc->names)
1296   {
1297     if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1298     {
1299       cupsdLogMessage(CUPSD_LOG_ERROR,
1300                       "Unable to allocate memory for %d names: %s",
1301                       cupsArrayCount(loc->names), strerror(errno));
1302
1303       cupsdFreeLocation(temp);
1304       return (NULL);
1305     }
1306   }
1307
1308   if (loc->allow)
1309   {
1310    /*
1311     * Copy allow rules...
1312     */
1313
1314     if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1315     {
1316       cupsdLogMessage(CUPSD_LOG_ERROR,
1317                       "Unable to allocate memory for %d allow rules: %s",
1318                       cupsArrayCount(loc->allow), strerror(errno));
1319       cupsdFreeLocation(temp);
1320       return (NULL);
1321     }
1322   }
1323
1324   if (loc->deny)
1325   {
1326    /*
1327     * Copy deny rules...
1328     */
1329
1330     if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1331     {
1332       cupsdLogMessage(CUPSD_LOG_ERROR,
1333                       "Unable to allocate memory for %d deny rules: %s",
1334                       cupsArrayCount(loc->deny), strerror(errno));
1335       cupsdFreeLocation(temp);
1336       return (NULL);
1337     }
1338   }
1339
1340   return (temp);
1341 }
1342
1343
1344 /*
1345  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1346  */
1347
1348 void
1349 cupsdDeleteAllLocations(void)
1350 {
1351  /*
1352   * Free the location array, which will free all of the locations...
1353   */
1354
1355   cupsArrayDelete(Locations);
1356   Locations = NULL;
1357 }
1358
1359
1360 /*
1361  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1362  */
1363
1364 cupsd_location_t *                      /* O - Location that matches */
1365 cupsdFindBest(const char   *path,       /* I - Resource path */
1366               http_state_t state)       /* I - HTTP state/request */
1367 {
1368   char                  uri[HTTP_MAX_URI],
1369                                         /* URI in request... */
1370                         *uriptr;        /* Pointer into URI */
1371   cupsd_location_t      *loc,           /* Current location */
1372                         *best;          /* Best match for location so far */
1373   size_t                bestlen;        /* Length of best match */
1374   int                   limit;          /* Limit field */
1375   static const int      limits[] =      /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1376                 {
1377                   CUPSD_AUTH_LIMIT_ALL,
1378                   CUPSD_AUTH_LIMIT_OPTIONS,
1379                   CUPSD_AUTH_LIMIT_GET,
1380                   CUPSD_AUTH_LIMIT_GET,
1381                   CUPSD_AUTH_LIMIT_HEAD,
1382                   CUPSD_AUTH_LIMIT_POST,
1383                   CUPSD_AUTH_LIMIT_POST,
1384                   CUPSD_AUTH_LIMIT_POST,
1385                   CUPSD_AUTH_LIMIT_PUT,
1386                   CUPSD_AUTH_LIMIT_PUT,
1387                   CUPSD_AUTH_LIMIT_DELETE,
1388                   CUPSD_AUTH_LIMIT_TRACE,
1389                   CUPSD_AUTH_LIMIT_ALL,
1390                   CUPSD_AUTH_LIMIT_ALL,
1391                   CUPSD_AUTH_LIMIT_ALL,
1392                   CUPSD_AUTH_LIMIT_ALL
1393                 };
1394
1395
1396  /*
1397   * First copy the connection URI to a local string so we have drop
1398   * any .ppd extension from the pathname in /printers or /classes
1399   * URIs...
1400   */
1401
1402   strlcpy(uri, path, sizeof(uri));
1403
1404   if ((uriptr = strchr(uri, '?')) != NULL)
1405     *uriptr = '\0';             /* Drop trailing query string */
1406
1407   if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1408     *uriptr = '\0';             /* Remove trailing '/' */
1409
1410   if (!strncmp(uri, "/printers/", 10) ||
1411       !strncmp(uri, "/classes/", 9))
1412   {
1413    /*
1414     * Check if the URI has .ppd on the end...
1415     */
1416
1417     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1418
1419     if (!strcmp(uriptr, ".ppd"))
1420       *uriptr = '\0';
1421   }
1422
1423  /*
1424   * Loop through the list of locations to find a match...
1425   */
1426
1427   limit   = limits[state];
1428   best    = NULL;
1429   bestlen = 0;
1430
1431   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri=\"%s\", limit=%x...", uri, limit);
1432
1433
1434   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1435        loc;
1436        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1437   {
1438     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1439
1440     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1441     {
1442      /*
1443       * Use case-insensitive comparison for queue names...
1444       */
1445
1446       if (loc->length > bestlen && loc->location &&
1447           !_cups_strncasecmp(uri, loc->location, loc->length) &&
1448           loc->location[0] == '/' &&
1449           (limit & loc->limit) != 0)
1450       {
1451         best    = loc;
1452         bestlen = loc->length;
1453       }
1454     }
1455     else
1456     {
1457      /*
1458       * Use case-sensitive comparison for other URIs...
1459       */
1460
1461       if (loc->length > bestlen && loc->location &&
1462           !strncmp(uri, loc->location, loc->length) &&
1463           loc->location[0] == '/' &&
1464           (limit & loc->limit) != 0)
1465       {
1466         best    = loc;
1467         bestlen = loc->length;
1468       }
1469     }
1470   }
1471
1472  /*
1473   * Return the match, if any...
1474   */
1475
1476   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best=%s", best ? best->location : "NONE");
1477
1478   return (best);
1479 }
1480
1481
1482 /*
1483  * 'cupsdFindLocation()' - Find the named location.
1484  */
1485
1486 cupsd_location_t *                      /* O - Location that matches */
1487 cupsdFindLocation(const char *location) /* I - Connection */
1488 {
1489   cupsd_location_t      key;            /* Search key */
1490
1491
1492   key.location = (char *)location;
1493
1494   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1495 }
1496
1497
1498 /*
1499  * 'cupsdFreeLocation()' - Free all memory used by a location.
1500  */
1501
1502 void
1503 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1504 {
1505   cupsArrayDelete(loc->names);
1506   cupsArrayDelete(loc->allow);
1507   cupsArrayDelete(loc->deny);
1508
1509   _cupsStrFree(loc->location);
1510   free(loc);
1511 }
1512
1513
1514 /*
1515  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1516  */
1517
1518 http_status_t                           /* O - HTTP_OK if authorized or error code */
1519 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1520                   const char     *owner)/* I - Owner of object */
1521 {
1522   int                   i,              /* Looping vars */
1523                         auth,           /* Authorization status */
1524                         type;           /* Type of authentication */
1525   http_addr_t           *hostaddr = httpGetAddress(con->http);
1526                                         /* Client address */
1527   const char            *hostname = httpGetHostname(con->http, NULL, 0);
1528                                         /* Client hostname */
1529   unsigned              address[4];     /* Authorization address */
1530   cupsd_location_t      *best;          /* Best match for location so far */
1531   size_t                hostlen;        /* Length of hostname */
1532   char                  *name,          /* Current username */
1533                         username[256],  /* Username to authorize */
1534                         ownername[256], /* Owner name to authorize */
1535                         *ptr;           /* Pointer into username */
1536   struct passwd         *pw;            /* User password data */
1537   static const char * const levels[] =  /* Auth levels */
1538                 {
1539                   "ANON",
1540                   "USER",
1541                   "GROUP"
1542                 };
1543   static const char * const types[] =   /* Auth types */
1544                 {
1545                   "None",
1546                   "Basic",
1547                   "Negotiate"
1548                 };
1549
1550
1551   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location ? con->best->location : "(null)" : "");
1552   if (owner)
1553     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: owner=\"%s\"", owner);
1554
1555  /*
1556   * If there is no "best" authentication rule for this request, then
1557   * access is allowed from the local system and denied from other
1558   * addresses...
1559   */
1560
1561   if (!con->best)
1562   {
1563     if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1564         !strcmp(hostname, ServerName) ||
1565         cupsArrayFind(ServerAlias, (void *)hostname))
1566       return (HTTP_OK);
1567     else
1568       return (HTTP_FORBIDDEN);
1569   }
1570
1571   best = con->best;
1572
1573   if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1574     type = cupsdDefaultAuthType();
1575
1576   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels[best->level], types[type], best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1577
1578   if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1579     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)", best->op, ippOpString(best->op));
1580
1581  /*
1582   * Check host/ip-based accesses...
1583   */
1584
1585 #ifdef AF_INET6
1586   if (httpAddrFamily(hostaddr) == AF_INET6)
1587   {
1588    /*
1589     * Copy IPv6 address...
1590     */
1591
1592     address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1593     address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1594     address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1595     address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1596   }
1597   else
1598 #endif /* AF_INET6 */
1599   if (con->http->hostaddr->addr.sa_family == AF_INET)
1600   {
1601    /*
1602     * Copy IPv4 address...
1603     */
1604
1605     address[0] = 0;
1606     address[1] = 0;
1607     address[2] = 0;
1608     address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1609   }
1610   else
1611     memset(address, 0, sizeof(address));
1612
1613   hostlen = strlen(hostname);
1614
1615   auth = cupsdCheckAccess(address, hostname, hostlen, best)
1616              ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1617
1618   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth ? "DENY" : "ALLOW");
1619
1620   if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1621     return (HTTP_FORBIDDEN);
1622
1623 #ifdef HAVE_SSL
1624  /*
1625   * See if encryption is required...
1626   */
1627
1628   if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1629       _cups_strcasecmp(hostname, "localhost") &&
1630       !httpAddrLocalhost(hostaddr) &&
1631       best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1632       !(type == CUPSD_AUTH_NEGOTIATE ||
1633         (type == CUPSD_AUTH_NONE &&
1634          cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1635   {
1636     cupsdLogMessage(CUPSD_LOG_DEBUG,
1637                     "cupsdIsAuthorized: Need upgrade to TLS...");
1638     return (HTTP_UPGRADE_REQUIRED);
1639   }
1640 #endif /* HAVE_SSL */
1641
1642  /*
1643   * Now see what access level is required...
1644   */
1645
1646   if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1647       (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1648     return (HTTP_OK);
1649
1650   if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1651       best->limit == CUPSD_AUTH_LIMIT_IPP)
1652   {
1653    /*
1654     * Check for unauthenticated username...
1655     */
1656
1657     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1658
1659
1660     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1661     if (attr)
1662     {
1663       cupsdLogMessage(CUPSD_LOG_DEBUG,
1664                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1665                       attr->values[0].string.text);
1666       strlcpy(username, attr->values[0].string.text, sizeof(username));
1667     }
1668     else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1669       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1670     else
1671       return (HTTP_OK);                 /* unless overridden with Satisfy */
1672   }
1673   else
1674   {
1675     cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1676                     con->username);
1677
1678 #ifdef HAVE_AUTHORIZATION_H
1679     if (!con->username[0] && !con->authref)
1680 #else
1681     if (!con->username[0])
1682 #endif /* HAVE_AUTHORIZATION_H */
1683     {
1684       if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1685         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1686       else
1687         return (HTTP_OK);               /* unless overridden with Satisfy */
1688     }
1689
1690
1691     if (con->type != type && type != CUPSD_AUTH_NONE &&
1692 #ifdef HAVE_GSSAPI
1693         (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1694 #endif /* HAVE_GSSAPI */
1695         con->type != CUPSD_AUTH_BASIC)
1696     {
1697       cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1698                       types[con->type], types[type]);
1699
1700       return (HTTP_UNAUTHORIZED);
1701     }
1702
1703     strlcpy(username, con->username, sizeof(username));
1704   }
1705
1706  /*
1707   * OK, got a username.  See if we need normal user access, or group
1708   * access... (root always matches)
1709   */
1710
1711   if (!strcmp(username, "root"))
1712     return (HTTP_OK);
1713
1714  /*
1715   * Strip any @domain or @KDC from the username and owner...
1716   */
1717
1718   if ((ptr = strchr(username, '@')) != NULL)
1719     *ptr = '\0';
1720
1721   if (owner)
1722   {
1723     strlcpy(ownername, owner, sizeof(ownername));
1724
1725     if ((ptr = strchr(ownername, '@')) != NULL)
1726       *ptr = '\0';
1727   }
1728   else
1729     ownername[0] = '\0';
1730
1731  /*
1732   * Get the user info...
1733   */
1734
1735   if (username[0])
1736   {
1737     pw = getpwnam(username);
1738     endpwent();
1739   }
1740   else
1741     pw = NULL;
1742
1743   if (best->level == CUPSD_AUTH_USER)
1744   {
1745    /*
1746     * If there are no names associated with this location, then
1747     * any valid user is OK...
1748     */
1749
1750     if (cupsArrayCount(best->names) == 0)
1751       return (HTTP_OK);
1752
1753    /*
1754     * Otherwise check the user list and return OK if this user is
1755     * allowed...
1756     */
1757
1758     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking user membership...");
1759
1760 #ifdef HAVE_AUTHORIZATION_H
1761    /*
1762     * If an authorization reference was supplied it must match a right name...
1763     */
1764
1765     if (con->authref)
1766     {
1767       for (name = (char *)cupsArrayFirst(best->names);
1768            name;
1769            name = (char *)cupsArrayNext(best->names))
1770       {
1771         if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1772           return (HTTP_OK);
1773         else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1774                  check_authref(con, SystemGroupAuthKey))
1775           return (HTTP_OK);
1776       }
1777
1778       return (HTTP_FORBIDDEN);
1779     }
1780 #endif /* HAVE_AUTHORIZATION_H */
1781
1782     for (name = (char *)cupsArrayFirst(best->names);
1783          name;
1784          name = (char *)cupsArrayNext(best->names))
1785     {
1786       if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1787           !_cups_strcasecmp(username, ownername))
1788         return (HTTP_OK);
1789       else if (!_cups_strcasecmp(name, "@SYSTEM"))
1790       {
1791         for (i = 0; i < NumSystemGroups; i ++)
1792           if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1793             return (HTTP_OK);
1794       }
1795       else if (name[0] == '@')
1796       {
1797         if (cupsdCheckGroup(username, pw, name + 1))
1798           return (HTTP_OK);
1799       }
1800       else if (!_cups_strcasecmp(username, name))
1801         return (HTTP_OK);
1802     }
1803
1804     return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1805   }
1806
1807  /*
1808   * Check to see if this user is in any of the named groups...
1809   */
1810
1811   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group membership...");
1812
1813  /*
1814   * Check to see if this user is in any of the named groups...
1815   */
1816
1817   for (name = (char *)cupsArrayFirst(best->names);
1818        name;
1819        name = (char *)cupsArrayNext(best->names))
1820   {
1821     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1822
1823     if (!_cups_strcasecmp(name, "@SYSTEM"))
1824     {
1825       for (i = 0; i < NumSystemGroups; i ++)
1826         if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1827           return (HTTP_OK);
1828     }
1829     else if (cupsdCheckGroup(username, pw, name))
1830       return (HTTP_OK);
1831   }
1832
1833  /*
1834   * The user isn't part of the specified group, so deny access...
1835   */
1836
1837   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: User not in group(s).");
1838
1839   return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1840 }
1841
1842
1843 /*
1844  * 'cupsdNewLocation()' - Create a new location for authorization.
1845  *
1846  * Note: Still need to call cupsdAddLocation() to add it to the list of global
1847  * locations.
1848  */
1849
1850 cupsd_location_t *                      /* O - Pointer to new location record */
1851 cupsdNewLocation(const char *location)  /* I - Location path */
1852 {
1853   cupsd_location_t      *temp;          /* New location */
1854
1855
1856  /*
1857   * Try to allocate memory for the new location.
1858   */
1859
1860   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1861     return (NULL);
1862
1863  /*
1864   * Initialize the record and copy the name over...
1865   */
1866
1867   if ((temp->location = _cupsStrAlloc(location)) == NULL)
1868   {
1869     free(temp);
1870     return (NULL);
1871   }
1872
1873   temp->length = strlen(temp->location);
1874
1875  /*
1876   * Return the new record...
1877   */
1878
1879   return (temp);
1880 }
1881
1882
1883 #ifdef HAVE_AUTHORIZATION_H
1884 /*
1885  * 'check_authref()' - Check if an authorization services reference has the
1886  *                     supplied right.
1887  */
1888
1889 static int                              /* O - 1 if right is valid, 0 otherwise */
1890 check_authref(cupsd_client_t *con,      /* I - Connection */
1891               const char     *right)    /* I - Right name */
1892 {
1893   OSStatus              status;         /* OS Status */
1894   AuthorizationItem     authright;      /* Authorization right */
1895   AuthorizationRights   authrights;     /* Authorization rights */
1896   AuthorizationFlags    authflags;      /* Authorization flags */
1897
1898
1899  /*
1900   * Check to see if the user is allowed to perform the task...
1901   */
1902
1903   if (!con->authref)
1904     return (0);
1905
1906   authright.name        = right;
1907   authright.valueLength = 0;
1908   authright.value       = NULL;
1909   authright.flags       = 0;
1910
1911   authrights.count = 1;
1912   authrights.items = &authright;
1913
1914   authflags = kAuthorizationFlagDefaults |
1915               kAuthorizationFlagExtendRights;
1916
1917   if ((status = AuthorizationCopyRights(con->authref, &authrights,
1918                                         kAuthorizationEmptyEnvironment,
1919                                         authflags, NULL)) != 0)
1920   {
1921     cupsdLogMessage(CUPSD_LOG_ERROR, "AuthorizationCopyRights(\"%s\") returned %d", authright.name, (int)status);
1922     return (0);
1923   }
1924
1925   cupsdLogMessage(CUPSD_LOG_DEBUG2, "AuthorizationCopyRights(\"%s\") succeeded.", authright.name);
1926
1927   return (1);
1928 }
1929 #endif /* HAVE_AUTHORIZATION_H */
1930
1931
1932 /*
1933  * 'compare_locations()' - Compare two locations.
1934  */
1935
1936 static int                              /* O - Result of comparison */
1937 compare_locations(cupsd_location_t *a,  /* I - First location */
1938                   cupsd_location_t *b)  /* I - Second location */
1939 {
1940   return (strcmp(b->location, a->location));
1941 }
1942
1943
1944 /*
1945  * 'copy_authmask()' - Copy function for auth masks.
1946  */
1947
1948 static cupsd_authmask_t *               /* O - New auth mask */
1949 copy_authmask(cupsd_authmask_t *mask,   /* I - Existing auth mask */
1950               void             *data)   /* I - User data (unused) */
1951 {
1952   cupsd_authmask_t      *temp;          /* New auth mask */
1953
1954
1955   (void)data;
1956
1957   if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
1958   {
1959     memcpy(temp, mask, sizeof(cupsd_authmask_t));
1960
1961     if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
1962     {
1963      /*
1964       * Make a copy of the name...
1965       */
1966
1967       if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
1968       {
1969        /*
1970         * Failed to make copy...
1971         */
1972
1973         free(temp);
1974         temp = NULL;
1975       }
1976     }
1977   }
1978
1979   return (temp);
1980 }
1981
1982
1983 /*
1984  * 'free_authmask()' - Free function for auth masks.
1985  */
1986
1987 static void
1988 free_authmask(cupsd_authmask_t *mask,   /* I - Auth mask to free */
1989               void             *data)   /* I - User data (unused) */
1990 {
1991   (void)data;
1992
1993   if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
1994     _cupsStrFree(mask->mask.name.name);
1995
1996   free(mask);
1997 }
1998
1999
2000 #if HAVE_LIBPAM
2001 /*
2002  * 'pam_func()' - PAM conversation function.
2003  */
2004
2005 static int                              /* O - Success or failure */
2006 pam_func(
2007     int                      num_msg,   /* I - Number of messages */
2008     const struct pam_message **msg,     /* I - Messages */
2009     struct pam_response      **resp,    /* O - Responses */
2010     void                     *appdata_ptr)
2011                                         /* I - Pointer to connection */
2012 {
2013   int                   i;              /* Looping var */
2014   struct pam_response   *replies;       /* Replies */
2015   cupsd_authdata_t      *data;          /* Pointer to auth data */
2016
2017
2018  /*
2019   * Allocate memory for the responses...
2020   */
2021
2022   if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2023     return (PAM_CONV_ERR);
2024
2025  /*
2026   * Answer all of the messages...
2027   */
2028
2029   data = (cupsd_authdata_t *)appdata_ptr;
2030
2031   for (i = 0; i < num_msg; i ++)
2032   {
2033     switch (msg[i]->msg_style)
2034     {
2035       case PAM_PROMPT_ECHO_ON:
2036           replies[i].resp_retcode = PAM_SUCCESS;
2037           replies[i].resp         = strdup(data->username);
2038           break;
2039
2040       case PAM_PROMPT_ECHO_OFF:
2041           replies[i].resp_retcode = PAM_SUCCESS;
2042           replies[i].resp         = strdup(data->password);
2043           break;
2044
2045       case PAM_TEXT_INFO:
2046           replies[i].resp_retcode = PAM_SUCCESS;
2047           replies[i].resp         = NULL;
2048           break;
2049
2050       case PAM_ERROR_MSG:
2051           replies[i].resp_retcode = PAM_SUCCESS;
2052           replies[i].resp         = NULL;
2053           break;
2054
2055       default:
2056           free(replies);
2057           return (PAM_CONV_ERR);
2058     }
2059   }
2060
2061  /*
2062   * Return the responses back to PAM...
2063   */
2064
2065   *resp = replies;
2066
2067   return (PAM_SUCCESS);
2068 }
2069 #endif /* HAVE_LIBPAM */