2 * Authorization routines for the CUPS scheduler.
4 * Copyright 2007-2016 by Apple Inc.
5 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
7 * This file contains Kerberos support code, copyright 2006 by
10 * These coded instructions, statements, and computer programs are the
11 * property of Apple Inc. and are protected by Federal copyright
12 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
13 * which should have been included with this file. If this file is
14 * file is missing or damaged, see the license at "http://www.cups.org/".
18 * Include necessary headers...
25 #endif /* HAVE_SHADOW_H */
28 #endif /* HAVE_CRYPT_H */
30 # ifdef HAVE_PAM_PAM_APPL_H
31 # include <pam/pam_appl.h>
33 # include <security/pam_appl.h>
34 # endif /* HAVE_PAM_PAM_APPL_H */
35 #endif /* HAVE_LIBPAM */
36 #ifdef HAVE_MEMBERSHIP_H
37 # include <membership.h>
38 #endif /* HAVE_MEMBERSHIP_H */
39 #ifdef HAVE_AUTHORIZATION_H
40 # include <Security/AuthorizationTags.h>
41 # ifdef HAVE_SECBASEPRIV_H
42 # include <Security/SecBasePriv.h>
44 extern const char *cssmErrorString(int error
);
45 # endif /* HAVE_SECBASEPRIV_H */
46 #endif /* HAVE_AUTHORIZATION_H */
47 #ifdef HAVE_SYS_PARAM_H
48 # include <sys/param.h>
49 #endif /* HAVE_SYS_PARAM_H */
50 #ifdef HAVE_SYS_UCRED_H
51 # include <sys/ucred.h>
52 typedef struct xucred cupsd_ucred_t
;
53 # define CUPSD_UCRED_UID(c) (c).cr_uid
56 typedef struct ucred cupsd_ucred_t
;
58 typedef struct sockpeercred cupsd_ucred_t
;
60 # define CUPSD_UCRED_UID(c) (c).uid
61 #endif /* HAVE_SYS_UCRED_H */
68 #ifdef HAVE_AUTHORIZATION_H
69 static int check_authref(cupsd_client_t
*con
, const char *right
);
70 #endif /* HAVE_AUTHORIZATION_H */
71 static int compare_locations(cupsd_location_t
*a
,
73 static cupsd_authmask_t
*copy_authmask(cupsd_authmask_t
*am
, void *data
);
75 static char *cups_crypt(const char *pw
, const char *salt
);
76 #endif /* !HAVE_LIBPAM */
77 static void free_authmask(cupsd_authmask_t
*am
, void *data
);
79 static int pam_func(int, const struct pam_message
**,
80 struct pam_response
**, void *);
82 static void to64(char *s
, unsigned long v
, int n
);
83 #endif /* HAVE_LIBPAM */
91 typedef struct cupsd_authdata_s
/**** Authentication data ****/
93 char username
[HTTP_MAX_VALUE
], /* Username string */
94 password
[HTTP_MAX_VALUE
]; /* Password string */
96 #endif /* HAVE_LIBPAM */
100 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
103 int /* O - 1 on success, 0 on failure */
105 cups_array_t
**masks
, /* IO - Masks array (created as needed) */
106 const unsigned address
[4], /* I - IP address */
107 const unsigned netmask
[4]) /* I - IP netmask */
109 cupsd_authmask_t temp
; /* New host/domain mask */
112 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", masks
, *masks
, address
[0], address
[1], address
[2], address
[3], netmask
[0], netmask
[1], netmask
[2], netmask
[3]);
114 temp
.type
= CUPSD_AUTH_IP
;
115 memcpy(temp
.mask
.ip
.address
, address
, sizeof(temp
.mask
.ip
.address
));
116 memcpy(temp
.mask
.ip
.netmask
, netmask
, sizeof(temp
.mask
.ip
.netmask
));
119 * Create the masks array as needed and add...
123 *masks
= cupsArrayNew3(NULL
, NULL
, NULL
, 0,
124 (cups_acopy_func_t
)copy_authmask
,
125 (cups_afree_func_t
)free_authmask
);
127 return (cupsArrayAdd(*masks
, &temp
));
132 * 'cupsdAddLocation()' - Add a location for authorization.
136 cupsdAddLocation(cupsd_location_t
*loc
) /* I - Location to add */
139 * Make sure the locations array is created...
143 Locations
= cupsArrayNew3((cups_array_func_t
)compare_locations
, NULL
,
144 (cups_ahash_func_t
)NULL
, 0,
145 (cups_acopy_func_t
)NULL
,
146 (cups_afree_func_t
)cupsdFreeLocation
);
150 cupsArrayAdd(Locations
, loc
);
152 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddLocation: Added location \"%s\"", loc
->location
? loc
->location
: "(null)");
158 * 'cupsdAddName()' - Add a name to a location...
162 cupsdAddName(cupsd_location_t
*loc
, /* I - Location to add to */
163 char *name
) /* I - Name to add */
165 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddName(loc=%p, name=\"%s\")", loc
, name
);
168 loc
->names
= cupsArrayNew3(NULL
, NULL
, NULL
, 0,
169 (cups_acopy_func_t
)_cupsStrAlloc
,
170 (cups_afree_func_t
)_cupsStrFree
);
172 if (!cupsArrayAdd(loc
->names
, name
))
174 cupsdLogMessage(CUPSD_LOG_ERROR
,
175 "Unable to duplicate name for location %s: %s",
176 loc
->location
? loc
->location
: "nil", strerror(errno
));
183 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
186 int /* O - 1 on success, 0 on failure */
187 cupsdAddNameMask(cups_array_t
**masks
, /* IO - Masks array (created as needed) */
188 char *name
) /* I - Host or interface name */
190 cupsd_authmask_t temp
; /* New host/domain mask */
191 char ifname
[32], /* Interface name */
192 *ifptr
; /* Pointer to end of name */
195 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", masks
, *masks
, name
);
197 if (!_cups_strcasecmp(name
, "@LOCAL"))
200 * Deny *interface*...
203 temp
.type
= CUPSD_AUTH_INTERFACE
;
204 temp
.mask
.name
.name
= (char *)"*";
206 else if (!_cups_strncasecmp(name
, "@IF(", 4))
209 * Deny *interface*...
212 strlcpy(ifname
, name
+ 4, sizeof(ifname
));
214 ifptr
= ifname
+ strlen(ifname
) - 1;
216 if (ifptr
>= ifname
&& *ifptr
== ')')
222 temp
.type
= CUPSD_AUTH_INTERFACE
;
223 temp
.mask
.name
.name
= ifname
;
234 temp
.type
= CUPSD_AUTH_NAME
;
235 temp
.mask
.name
.name
= (char *)name
;
239 * Set the name length...
242 temp
.mask
.name
.length
= strlen(temp
.mask
.name
.name
);
245 * Create the masks array as needed and add...
249 *masks
= cupsArrayNew3(NULL
, NULL
, NULL
, 0,
250 (cups_acopy_func_t
)copy_authmask
,
251 (cups_afree_func_t
)free_authmask
);
253 return (cupsArrayAdd(*masks
, &temp
));
258 * 'cupsdAuthorize()' - Validate any authorization credentials.
262 cupsdAuthorize(cupsd_client_t
*con
) /* I - Client connection */
264 int type
; /* Authentication type */
265 const char *authorization
; /* Pointer into Authorization string */
266 char *ptr
, /* Pointer into string */
267 username
[HTTP_MAX_VALUE
],
268 /* Username string */
269 password
[HTTP_MAX_VALUE
];
270 /* Password string */
271 cupsd_cert_t
*localuser
; /* Certificate username */
275 * Locate the best matching location so we know what kind of
276 * authentication to expect...
279 con
->best
= cupsdFindBest(con
->uri
, httpGetState(con
->http
));
280 con
->type
= CUPSD_AUTH_NONE
;
282 cupsdLogClient(con
, CUPSD_LOG_DEBUG2
, "con->uri=\"%s\", con->best=%p(%s)", con
->uri
, con
->best
, con
->best
? con
->best
->location
: "");
284 if (con
->best
&& con
->best
->type
!= CUPSD_AUTH_NONE
)
286 if (con
->best
->type
== CUPSD_AUTH_DEFAULT
)
287 type
= cupsdDefaultAuthType();
289 type
= con
->best
->type
;
292 type
= cupsdDefaultAuthType();
295 * Decode the Authorization string...
298 authorization
= httpGetField(con
->http
, HTTP_FIELD_AUTHORIZATION
);
305 #endif /* HAVE_GSSAPI */
307 #ifdef HAVE_AUTHORIZATION_H
310 AuthorizationFree(con
->authref
, kAuthorizationFlagDefaults
);
313 #endif /* HAVE_AUTHORIZATION_H */
318 * No authorization data provided, return early...
321 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "No authentication data provided.");
324 #ifdef HAVE_AUTHORIZATION_H
325 else if (!strncmp(authorization
, "AuthRef ", 8) &&
326 httpAddrLocalhost(httpGetAddress(con
->http
)))
328 OSStatus status
; /* Status */
329 char authdata
[HTTP_MAX_VALUE
];
330 /* Nonce value from client */
331 int authlen
; /* Auth string length */
332 AuthorizationItemSet
*authinfo
; /* Authorization item set */
335 * Get the Authorization Services data...
339 while (isspace(*authorization
& 255))
342 authlen
= sizeof(authdata
);
343 httpDecode64_2(authdata
, &authlen
, authorization
);
345 if (authlen
!= kAuthorizationExternalFormLength
)
347 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "External Authorization reference size is incorrect.");
351 if ((status
= AuthorizationCreateFromExternalForm((AuthorizationExternalForm
*)authdata
, &con
->authref
)) != 0)
353 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "AuthorizationCreateFromExternalForm returned %d (%s)", (int)status
, cssmErrorString(status
));
359 if (!AuthorizationCopyInfo(con
->authref
, kAuthorizationEnvironmentUsername
,
362 if (authinfo
->count
== 1 && authinfo
->items
[0].value
&&
363 authinfo
->items
[0].valueLength
>= 2)
365 strlcpy(username
, authinfo
->items
[0].value
, sizeof(username
));
367 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "Authorized as \"%s\" using AuthRef.", username
);
370 AuthorizationFreeItemSet(authinfo
);
376 * No username in AuthRef, grab username using peer credentials...
379 struct passwd
*pwd
; /* Password entry for this user */
380 cupsd_ucred_t peercred
; /* Peer credentials */
381 socklen_t peersize
; /* Size of peer credentials */
383 peersize
= sizeof(peercred
);
385 if (getsockopt(httpGetFd(con
->http
), 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
387 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s", strerror(errno
));
391 if ((pwd
= getpwuid(CUPSD_UCRED_UID(peercred
))) == NULL
)
393 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred
));
397 strlcpy(username
, pwd
->pw_name
, sizeof(username
));
399 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "Authorized as \"%s\" using AuthRef + PeerCred.", username
);
402 con
->type
= CUPSD_AUTH_BASIC
;
404 #endif /* HAVE_AUTHORIZATION_H */
405 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
406 else if (!strncmp(authorization
, "PeerCred ", 9) &&
407 con
->http
->hostaddr
->addr
.sa_family
== AF_LOCAL
&& con
->best
)
410 * Use peer credentials from domain socket connection...
413 struct passwd
*pwd
; /* Password entry for this user */
414 cupsd_ucred_t peercred
; /* Peer credentials */
415 socklen_t peersize
; /* Size of peer credentials */
416 #ifdef HAVE_AUTHORIZATION_H
417 const char *name
; /* Authorizing name */
418 int no_peer
= 0; /* Don't allow peer credentials? */
421 * See if we should allow peer credentials...
424 for (name
= (char *)cupsArrayFirst(con
->best
->names
);
426 name
= (char *)cupsArrayNext(con
->best
->names
))
428 if (!_cups_strncasecmp(name
, "@AUTHKEY(", 9) ||
429 !_cups_strcasecmp(name
, "@SYSTEM"))
431 /* Normally don't want peer credentials if we need an auth key... */
434 else if (!_cups_strcasecmp(name
, "@OWNER"))
436 /* but if @OWNER is present then we allow it... */
444 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
447 #endif /* HAVE_AUTHORIZATION_H */
449 if ((pwd
= getpwnam(authorization
+ 9)) == NULL
)
451 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "User \"%s\" does not exist.", authorization
+ 9);
455 peersize
= sizeof(peercred
);
458 if (getsockopt(httpGetFd(con
->http
), 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
460 if (getsockopt(httpGetFd(con
->http
), SOL_SOCKET
, SO_PEERCRED
, &peercred
, &peersize
))
461 # endif /* __APPLE__ */
463 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s", strerror(errno
));
467 if (pwd
->pw_uid
!= CUPSD_UCRED_UID(peercred
))
469 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization
+ 9, CUPSD_UCRED_UID(peercred
), pwd
->pw_uid
);
470 # ifdef HAVE_SYS_UCRED_H
471 cupsdLogClient(con
, CUPSD_LOG_DEBUG2
, "cr_version=%d", peercred
.cr_version
);
472 cupsdLogClient(con
, CUPSD_LOG_DEBUG2
, "cr_uid=%d", peercred
.cr_uid
);
473 cupsdLogClient(con
, CUPSD_LOG_DEBUG2
, "cr_ngroups=%d", peercred
.cr_ngroups
);
474 cupsdLogClient(con
, CUPSD_LOG_DEBUG2
, "cr_groups[0]=%d", peercred
.cr_groups
[0]);
475 # endif /* HAVE_SYS_UCRED_H */
479 strlcpy(username
, authorization
+ 9, sizeof(username
));
482 con
->gss_uid
= CUPSD_UCRED_UID(peercred
);
483 # endif /* HAVE_GSSAPI */
485 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "Authorized as %s using PeerCred.", username
);
487 con
->type
= CUPSD_AUTH_BASIC
;
489 #endif /* SO_PEERCRED && AF_LOCAL */
490 else if (!strncmp(authorization
, "Local", 5) &&
491 httpAddrLocalhost(httpGetAddress(con
->http
)))
494 * Get Local certificate authentication data...
498 while (isspace(*authorization
& 255))
501 if ((localuser
= cupsdFindCert(authorization
)) == NULL
)
503 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Local authentication certificate not found.");
507 strlcpy(username
, localuser
->username
, sizeof(username
));
508 con
->type
= localuser
->type
;
510 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "Authorized as %s using Local.", username
);
512 else if (!strncmp(authorization
, "Basic", 5))
515 * Get the Basic authentication data...
518 int userlen
; /* Username:password length */
522 while (isspace(*authorization
& 255))
525 userlen
= sizeof(username
);
526 httpDecode64_2(username
, &userlen
, authorization
);
529 * Pull the username and password out...
532 if ((ptr
= strchr(username
, ':')) == NULL
)
534 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Missing Basic password.");
543 * Username must not be empty...
546 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Empty Basic username.");
553 * Password must not be empty...
556 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Empty Basic password.");
560 strlcpy(password
, ptr
, sizeof(password
));
563 * Validate the username and password...
569 case CUPSD_AUTH_BASIC
:
573 * Only use PAM to do authentication. This supports MD5
574 * passwords, among other things...
577 pam_handle_t
*pamh
; /* PAM authentication handle */
578 int pamerr
; /* PAM error code */
579 struct pam_conv pamdata
;/* PAM conversation data */
580 cupsd_authdata_t data
; /* Authentication data */
583 strlcpy(data
.username
, username
, sizeof(data
.username
));
584 strlcpy(data
.password
, password
, sizeof(data
.password
));
587 pamdata
.conv
= (int (*)(int, struct pam_message
**,
588 struct pam_response
**,
591 pamdata
.conv
= pam_func
;
593 pamdata
.appdata_ptr
= &data
;
595 pamerr
= pam_start("cups", username
, &pamdata
, &pamh
);
596 if (pamerr
!= PAM_SUCCESS
)
598 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "pam_start() returned %d (%s)", pamerr
, pam_strerror(pamh
, pamerr
));
602 # ifdef HAVE_PAM_SET_ITEM
604 pamerr
= pam_set_item(pamh
, PAM_RHOST
, con
->http
->hostname
);
605 if (pamerr
!= PAM_SUCCESS
)
606 cupsdLogClient(con
, CUPSD_LOG_WARN
, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr
, pam_strerror(pamh
, pamerr
));
607 # endif /* PAM_RHOST */
610 pamerr
= pam_set_item(pamh
, PAM_TTY
, "cups");
611 if (pamerr
!= PAM_SUCCESS
)
612 cupsdLogClient(con
, CUPSD_LOG_WARN
, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr
, pam_strerror(pamh
, pamerr
));
613 # endif /* PAM_TTY */
614 # endif /* HAVE_PAM_SET_ITEM */
616 pamerr
= pam_authenticate(pamh
, PAM_SILENT
);
617 if (pamerr
!= PAM_SUCCESS
)
619 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "pam_authenticate() returned %d (%s)", pamerr
, pam_strerror(pamh
, pamerr
));
624 # ifdef HAVE_PAM_SETCRED
625 pamerr
= pam_setcred(pamh
, PAM_ESTABLISH_CRED
| PAM_SILENT
);
626 if (pamerr
!= PAM_SUCCESS
)
627 cupsdLogClient(con
, CUPSD_LOG_WARN
, "pam_setcred() returned %d (%s)", pamerr
, pam_strerror(pamh
, pamerr
));
628 # endif /* HAVE_PAM_SETCRED */
630 pamerr
= pam_acct_mgmt(pamh
, PAM_SILENT
);
631 if (pamerr
!= PAM_SUCCESS
)
633 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "pam_acct_mgmt() returned %d (%s)", pamerr
, pam_strerror(pamh
, pamerr
));
638 pam_end(pamh
, PAM_SUCCESS
);
642 * Use normal UNIX password file-based authentication...
645 char *pass
; /* Encrypted password */
646 struct passwd
*pw
; /* User password data */
647 # ifdef HAVE_SHADOW_H
648 struct spwd
*spw
; /* Shadow password data */
649 # endif /* HAVE_SHADOW_H */
652 pw
= getpwnam(username
); /* Get the current password */
653 endpwent(); /* Close the password file */
661 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Unknown username \"%s\".", username
);
665 # ifdef HAVE_SHADOW_H
666 spw
= getspnam(username
);
669 if (!spw
&& !strcmp(pw
->pw_passwd
, "x"))
672 * Don't allow blank passwords!
675 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Username \"%s\" has no shadow password.", username
);
679 if (spw
&& !spw
->sp_pwdp
[0] && !pw
->pw_passwd
[0])
681 if (!pw
->pw_passwd
[0])
682 # endif /* HAVE_SHADOW_H */
685 * Don't allow blank passwords!
688 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Username \"%s\" has no password.", username
);
693 * OK, the password isn't blank, so compare with what came from the
697 pass
= cups_crypt(password
, pw
->pw_passwd
);
699 if (!pass
|| strcmp(pw
->pw_passwd
, pass
))
701 # ifdef HAVE_SHADOW_H
704 pass
= cups_crypt(password
, spw
->sp_pwdp
);
706 if (pass
== NULL
|| strcmp(spw
->sp_pwdp
, pass
))
708 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Authentication failed for user \"%s\".", username
);
713 # endif /* HAVE_SHADOW_H */
715 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Authentication failed for user \"%s\".", username
);
719 #endif /* HAVE_LIBPAM */
722 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "Authorized as \"%s\" using Basic.", username
);
729 else if (!strncmp(authorization
, "Negotiate", 9))
731 int len
; /* Length of authorization string */
732 gss_ctx_id_t context
; /* Authorization context */
733 OM_uint32 major_status
, /* Major status code */
734 minor_status
; /* Minor status code */
735 gss_buffer_desc input_token
= GSS_C_EMPTY_BUFFER
,
736 /* Input token from string */
737 output_token
= GSS_C_EMPTY_BUFFER
;
738 /* Output token for username */
739 gss_name_t client_name
; /* Client name */
744 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
748 if (&gss_init_sec_context
== NULL
)
750 cupsdLogClient(con
, CUPSD_LOG_WARN
, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
753 # endif /* __APPLE__ */
756 * Find the start of the Kerberos input token...
760 while (isspace(*authorization
& 255))
765 cupsdLogClient(con
, CUPSD_LOG_DEBUG2
, "No authentication data specified.");
770 * Decode the authorization string to get the input token...
773 len
= (int)strlen(authorization
);
774 input_token
.value
= malloc((size_t)len
);
775 input_token
.value
= httpDecode64_2(input_token
.value
, &len
,
777 input_token
.length
= (size_t)len
;
780 * Accept the input token to get the authorization info...
783 context
= GSS_C_NO_CONTEXT
;
784 client_name
= GSS_C_NO_NAME
;
785 major_status
= gss_accept_sec_context(&minor_status
,
789 GSS_C_NO_CHANNEL_BINDINGS
,
797 if (output_token
.length
> 0)
798 gss_release_buffer(&minor_status
, &output_token
);
800 if (GSS_ERROR(major_status
))
802 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
, "[Client %d] Error accepting GSSAPI security context.", con
->number
);
804 if (context
!= GSS_C_NO_CONTEXT
)
805 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
812 * Get the username associated with the client's credentials...
815 if (major_status
== GSS_S_CONTINUE_NEEDED
)
816 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
, "[Client %d] Credentials not complete.", con
->number
);
817 else if (major_status
== GSS_S_COMPLETE
)
819 major_status
= gss_display_name(&minor_status
, client_name
,
820 &output_token
, NULL
);
822 if (GSS_ERROR(major_status
))
824 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
, "[Client %d] Error getting username.", con
->number
);
825 gss_release_name(&minor_status
, &client_name
);
826 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
830 strlcpy(username
, output_token
.value
, sizeof(username
));
832 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "Authorized as \"%s\" using Negotiate.", username
);
834 gss_release_name(&minor_status
, &client_name
);
835 gss_release_buffer(&minor_status
, &output_token
);
837 con
->type
= CUPSD_AUTH_NEGOTIATE
;
840 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
842 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
844 * Get the client's UID if we are printing locally - that allows a backend
845 * to run as the correct user to get Kerberos credentials of its own.
848 if (httpAddrFamily(con
->http
->hostaddr
) == AF_LOCAL
)
850 cupsd_ucred_t peercred
; /* Peer credentials */
851 socklen_t peersize
; /* Size of peer credentials */
853 peersize
= sizeof(peercred
);
856 if (getsockopt(httpGetFd(con
->http
), 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
858 if (getsockopt(httpGetFd(con
->http
), SOL_SOCKET
, SO_PEERCRED
, &peercred
,
860 # endif /* __APPLE__ */
862 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s", strerror(errno
));
866 cupsdLogClient(con
, CUPSD_LOG_DEBUG
, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred
));
867 con
->gss_uid
= CUPSD_UCRED_UID(peercred
);
870 # endif /* SO_PEERCRED && AF_LOCAL */
872 #endif /* HAVE_GSSAPI */
875 char scheme
[256]; /* Auth scheme... */
878 if (sscanf(authorization
, "%255s", scheme
) != 1)
879 strlcpy(scheme
, "UNKNOWN", sizeof(scheme
));
881 cupsdLogClient(con
, CUPSD_LOG_ERROR
, "Bad authentication data \"%s ...\".", scheme
);
886 * If we get here, then we were able to validate the username and
887 * password - copy the validated username and password to the client
891 strlcpy(con
->username
, username
, sizeof(con
->username
));
892 strlcpy(con
->password
, password
, sizeof(con
->password
));
897 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
901 int /* O - 1 if allowed, 0 otherwise */
903 unsigned ip
[4], /* I - Client address */
904 const char *name
, /* I - Client hostname */
905 size_t namelen
, /* I - Length of hostname */
906 cupsd_location_t
*loc
) /* I - Location to check */
908 int allow
; /* 1 if allowed, 0 otherwise */
911 if (!_cups_strcasecmp(name
, "localhost"))
914 * Access from localhost (127.0.0.1 or ::1) is always allowed...
922 * Do authorization checks on the domain/address...
925 switch (loc
->order_type
)
928 allow
= 0; /* anti-compiler-warning-code */
931 case CUPSD_AUTH_ALLOW
: /* Order Deny,Allow */
934 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->deny
))
937 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->allow
))
941 case CUPSD_AUTH_DENY
: /* Order Allow,Deny */
944 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->allow
))
947 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->deny
))
958 * 'cupsdCheckAuth()' - Check authorization masks.
961 int /* O - 1 if mask matches, 0 otherwise */
962 cupsdCheckAuth(unsigned ip
[4], /* I - Client address */
963 const char *name
, /* I - Client hostname */
964 size_t name_len
, /* I - Length of hostname */
965 cups_array_t
*masks
) /* I - Masks */
967 int i
; /* Looping var */
968 cupsd_authmask_t
*mask
; /* Current mask */
969 cupsd_netif_t
*iface
; /* Network interface */
970 unsigned netip4
; /* IPv4 network address */
972 unsigned netip6
[4]; /* IPv6 network address */
973 #endif /* AF_INET6 */
976 for (mask
= (cupsd_authmask_t
*)cupsArrayFirst(masks
);
978 mask
= (cupsd_authmask_t
*)cupsArrayNext(masks
))
982 case CUPSD_AUTH_INTERFACE
:
984 * Check for a match with a network interface...
987 netip4
= htonl(ip
[3]);
990 netip6
[0] = htonl(ip
[0]);
991 netip6
[1] = htonl(ip
[1]);
992 netip6
[2] = htonl(ip
[2]);
993 netip6
[3] = htonl(ip
[3]);
994 #endif /* AF_INET6 */
998 if (!strcmp(mask
->mask
.name
.name
, "*"))
1002 * Allow Back-to-My-Mac addresses...
1005 if ((ip
[0] & 0xff000000) == 0xfd000000)
1007 #endif /* __APPLE__ */
1010 * Check against all local interfaces...
1013 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
1015 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
1018 * Only check local interfaces...
1021 if (!iface
->is_local
)
1024 if (iface
->address
.addr
.sa_family
== AF_INET
)
1027 * Check IPv4 address...
1030 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
1031 (iface
->address
.ipv4
.sin_addr
.s_addr
&
1032 iface
->mask
.ipv4
.sin_addr
.s_addr
))
1039 * Check IPv6 address...
1042 for (i
= 0; i
< 4; i
++)
1043 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
1044 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
1045 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
1051 #endif /* AF_INET6 */
1057 * Check the named interface...
1060 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
1062 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
1064 if (strcmp(mask
->mask
.name
.name
, iface
->name
))
1067 if (iface
->address
.addr
.sa_family
== AF_INET
)
1070 * Check IPv4 address...
1073 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
1074 (iface
->address
.ipv4
.sin_addr
.s_addr
&
1075 iface
->mask
.ipv4
.sin_addr
.s_addr
))
1082 * Check IPv6 address...
1085 for (i
= 0; i
< 4; i
++)
1086 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
1087 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
1088 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
1094 #endif /* AF_INET6 */
1099 case CUPSD_AUTH_NAME
:
1101 * Check for exact name match...
1104 if (!_cups_strcasecmp(name
, mask
->mask
.name
.name
))
1108 * Check for domain match...
1111 if (name_len
>= mask
->mask
.name
.length
&&
1112 mask
->mask
.name
.name
[0] == '.' &&
1113 !_cups_strcasecmp(name
+ name_len
- mask
->mask
.name
.length
,
1114 mask
->mask
.name
.name
))
1118 case CUPSD_AUTH_IP
:
1120 * Check for IP/network address match...
1123 for (i
= 0; i
< 4; i
++)
1124 if ((ip
[i
] & mask
->mask
.ip
.netmask
[i
]) !=
1125 mask
->mask
.ip
.address
[i
])
1139 * 'cupsdCheckGroup()' - Check for a user's group membership.
1142 int /* O - 1 if user is a member, 0 otherwise */
1144 const char *username
, /* I - User name */
1145 struct passwd
*user
, /* I - System user info */
1146 const char *groupname
) /* I - Group name */
1148 int i
; /* Looping var */
1149 struct group
*group
; /* System group info */
1150 #ifdef HAVE_MBR_UID_TO_UUID
1151 uuid_t useruuid
, /* UUID for username */
1152 groupuuid
; /* UUID for groupname */
1153 int is_member
; /* True if user is a member of group */
1154 #endif /* HAVE_MBR_UID_TO_UUID */
1157 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username
, user
, groupname
);
1163 if (!username
|| !groupname
)
1167 * Check to see if the user is a member of the named group...
1170 group
= getgrnam(groupname
);
1176 * Group exists, check it...
1179 #ifdef HAVE_GETGROUPLIST
1182 int ngroups
, /* Number of groups */
1183 groups
[2048]; /* Groups that user belongs to */
1185 ngroups
= (int)(sizeof(groups
) / sizeof(groups
[0]));
1186 getgrouplist(username
, (int)user
->pw_gid
, groups
, &ngroups
);
1188 for (i
= 0; i
< ngroups
; i
++)
1189 if ((int)group
->gr_gid
== groups
[i
])
1192 #endif /* HAVE_GETGROUPLIST */
1194 for (i
= 0; group
->gr_mem
[i
]; i
++)
1195 if (!_cups_strcasecmp(username
, group
->gr_mem
[i
]))
1200 * Group doesn't exist or user not in group list, check the group ID
1201 * against the user's group ID...
1204 if (user
&& group
&& group
->gr_gid
== user
->pw_gid
)
1207 #ifdef HAVE_MBR_UID_TO_UUID
1209 * Check group membership through macOS membership API...
1212 if (user
&& !mbr_uid_to_uuid(user
->pw_uid
, useruuid
))
1217 * Map group name to UUID and check membership...
1220 if (!mbr_gid_to_uuid(group
->gr_gid
, groupuuid
))
1221 if (!mbr_check_membership(useruuid
, groupuuid
, &is_member
))
1225 else if (groupname
[0] == '#')
1228 * Use UUID directly and check for equality (user UUID) and
1229 * membership (group UUID)...
1232 if (!uuid_parse((char *)groupname
+ 1, groupuuid
))
1234 if (!uuid_compare(useruuid
, groupuuid
))
1236 else if (!mbr_check_membership(useruuid
, groupuuid
, &is_member
))
1244 else if (groupname
[0] == '#')
1246 #endif /* HAVE_MBR_UID_TO_UUID */
1249 * If we get this far, then the user isn't part of the named group...
1257 * 'cupsdCopyLocation()' - Make a copy of a location...
1260 cupsd_location_t
* /* O - New location */
1262 cupsd_location_t
*loc
) /* I - Original location */
1264 cupsd_location_t
*temp
; /* New location */
1268 * Make a copy of the original location...
1271 if ((temp
= calloc(1, sizeof(cupsd_location_t
))) == NULL
)
1275 * Copy the information from the original location to the new one.
1282 temp
->location
= _cupsStrAlloc(loc
->location
);
1284 temp
->length
= loc
->length
;
1285 temp
->limit
= loc
->limit
;
1286 temp
->order_type
= loc
->order_type
;
1287 temp
->type
= loc
->type
;
1288 temp
->level
= loc
->level
;
1289 temp
->satisfy
= loc
->satisfy
;
1290 temp
->encryption
= loc
->encryption
;
1294 if ((temp
->names
= cupsArrayDup(loc
->names
)) == NULL
)
1296 cupsdLogMessage(CUPSD_LOG_ERROR
,
1297 "Unable to allocate memory for %d names: %s",
1298 cupsArrayCount(loc
->names
), strerror(errno
));
1300 cupsdFreeLocation(temp
);
1308 * Copy allow rules...
1311 if ((temp
->allow
= cupsArrayDup(loc
->allow
)) == NULL
)
1313 cupsdLogMessage(CUPSD_LOG_ERROR
,
1314 "Unable to allocate memory for %d allow rules: %s",
1315 cupsArrayCount(loc
->allow
), strerror(errno
));
1316 cupsdFreeLocation(temp
);
1324 * Copy deny rules...
1327 if ((temp
->deny
= cupsArrayDup(loc
->deny
)) == NULL
)
1329 cupsdLogMessage(CUPSD_LOG_ERROR
,
1330 "Unable to allocate memory for %d deny rules: %s",
1331 cupsArrayCount(loc
->deny
), strerror(errno
));
1332 cupsdFreeLocation(temp
);
1342 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1346 cupsdDeleteAllLocations(void)
1349 * Free the location array, which will free all of the locations...
1352 cupsArrayDelete(Locations
);
1358 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1361 cupsd_location_t
* /* O - Location that matches */
1362 cupsdFindBest(const char *path
, /* I - Resource path */
1363 http_state_t state
) /* I - HTTP state/request */
1365 char uri
[HTTP_MAX_URI
],
1366 /* URI in request... */
1367 *uriptr
; /* Pointer into URI */
1368 cupsd_location_t
*loc
, /* Current location */
1369 *best
; /* Best match for location so far */
1370 size_t bestlen
; /* Length of best match */
1371 int limit
; /* Limit field */
1372 static const int limits
[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1374 CUPSD_AUTH_LIMIT_ALL
,
1375 CUPSD_AUTH_LIMIT_OPTIONS
,
1376 CUPSD_AUTH_LIMIT_GET
,
1377 CUPSD_AUTH_LIMIT_GET
,
1378 CUPSD_AUTH_LIMIT_HEAD
,
1379 CUPSD_AUTH_LIMIT_POST
,
1380 CUPSD_AUTH_LIMIT_POST
,
1381 CUPSD_AUTH_LIMIT_POST
,
1382 CUPSD_AUTH_LIMIT_PUT
,
1383 CUPSD_AUTH_LIMIT_PUT
,
1384 CUPSD_AUTH_LIMIT_DELETE
,
1385 CUPSD_AUTH_LIMIT_TRACE
,
1386 CUPSD_AUTH_LIMIT_ALL
,
1387 CUPSD_AUTH_LIMIT_ALL
,
1388 CUPSD_AUTH_LIMIT_ALL
,
1389 CUPSD_AUTH_LIMIT_ALL
1394 * First copy the connection URI to a local string so we have drop
1395 * any .ppd extension from the pathname in /printers or /classes
1399 strlcpy(uri
, path
, sizeof(uri
));
1401 if ((uriptr
= strchr(uri
, '?')) != NULL
)
1402 *uriptr
= '\0'; /* Drop trailing query string */
1404 if ((uriptr
= uri
+ strlen(uri
) - 1) > uri
&& *uriptr
== '/')
1405 *uriptr
= '\0'; /* Remove trailing '/' */
1407 if (!strncmp(uri
, "/printers/", 10) ||
1408 !strncmp(uri
, "/classes/", 9))
1411 * Check if the URI has .ppd on the end...
1414 uriptr
= uri
+ strlen(uri
) - 4; /* len > 4 if we get here... */
1416 if (!strcmp(uriptr
, ".ppd"))
1421 * Loop through the list of locations to find a match...
1424 limit
= limits
[state
];
1428 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: uri=\"%s\", limit=%x...", uri
, limit
);
1431 for (loc
= (cupsd_location_t
*)cupsArrayFirst(Locations
);
1433 loc
= (cupsd_location_t
*)cupsArrayNext(Locations
))
1435 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: Location %s(%d) Limit %x", loc
->location
? loc
->location
: "(null)", (int)loc
->length
, loc
->limit
);
1437 if (!strncmp(uri
, "/printers/", 10) || !strncmp(uri
, "/classes/", 9))
1440 * Use case-insensitive comparison for queue names...
1443 if (loc
->length
> bestlen
&& loc
->location
&&
1444 !_cups_strncasecmp(uri
, loc
->location
, loc
->length
) &&
1445 loc
->location
[0] == '/' &&
1446 (limit
& loc
->limit
) != 0)
1449 bestlen
= loc
->length
;
1455 * Use case-sensitive comparison for other URIs...
1458 if (loc
->length
> bestlen
&& loc
->location
&&
1459 !strncmp(uri
, loc
->location
, loc
->length
) &&
1460 loc
->location
[0] == '/' &&
1461 (limit
& loc
->limit
) != 0)
1464 bestlen
= loc
->length
;
1470 * Return the match, if any...
1473 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: best=%s", best
? best
->location
: "NONE");
1480 * 'cupsdFindLocation()' - Find the named location.
1483 cupsd_location_t
* /* O - Location that matches */
1484 cupsdFindLocation(const char *location
) /* I - Connection */
1486 cupsd_location_t key
; /* Search key */
1489 key
.location
= (char *)location
;
1491 return ((cupsd_location_t
*)cupsArrayFind(Locations
, &key
));
1496 * 'cupsdFreeLocation()' - Free all memory used by a location.
1500 cupsdFreeLocation(cupsd_location_t
*loc
)/* I - Location to free */
1502 cupsArrayDelete(loc
->names
);
1503 cupsArrayDelete(loc
->allow
);
1504 cupsArrayDelete(loc
->deny
);
1506 _cupsStrFree(loc
->location
);
1512 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1515 http_status_t
/* O - HTTP_OK if authorized or error code */
1516 cupsdIsAuthorized(cupsd_client_t
*con
, /* I - Connection */
1517 const char *owner
)/* I - Owner of object */
1519 int i
, /* Looping vars */
1520 auth
, /* Authorization status */
1521 type
; /* Type of authentication */
1522 http_addr_t
*hostaddr
= httpGetAddress(con
->http
);
1523 /* Client address */
1524 const char *hostname
= httpGetHostname(con
->http
, NULL
, 0);
1525 /* Client hostname */
1526 unsigned address
[4]; /* Authorization address */
1527 cupsd_location_t
*best
; /* Best match for location so far */
1528 size_t hostlen
; /* Length of hostname */
1529 char *name
, /* Current username */
1530 username
[256], /* Username to authorize */
1531 ownername
[256], /* Owner name to authorize */
1532 *ptr
; /* Pointer into username */
1533 struct passwd
*pw
; /* User password data */
1534 static const char * const levels
[] = /* Auth levels */
1540 static const char * const types
[] = /* Auth types */
1548 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con
->uri
, con
->best
, con
->best
? con
->best
->location
? con
->best
->location
: "(null)" : "");
1550 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: owner=\"%s\"", owner
);
1553 * If there is no "best" authentication rule for this request, then
1554 * access is allowed from the local system and denied from other
1560 if (httpAddrLocalhost(httpGetAddress(con
->http
)) ||
1561 !strcmp(hostname
, ServerName
) ||
1562 cupsArrayFind(ServerAlias
, (void *)hostname
))
1565 return (HTTP_FORBIDDEN
);
1570 if ((type
= best
->type
) == CUPSD_AUTH_DEFAULT
)
1571 type
= cupsdDefaultAuthType();
1573 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels
[best
->level
], types
[type
], best
->satisfy
? "ANY" : "ALL", cupsArrayCount(best
->names
));
1575 if (best
->limit
== CUPSD_AUTH_LIMIT_IPP
)
1576 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: op=%x(%s)", best
->op
, ippOpString(best
->op
));
1579 * Check host/ip-based accesses...
1583 if (httpAddrFamily(hostaddr
) == AF_INET6
)
1586 * Copy IPv6 address...
1589 address
[0] = ntohl(hostaddr
->ipv6
.sin6_addr
.s6_addr32
[0]);
1590 address
[1] = ntohl(hostaddr
->ipv6
.sin6_addr
.s6_addr32
[1]);
1591 address
[2] = ntohl(hostaddr
->ipv6
.sin6_addr
.s6_addr32
[2]);
1592 address
[3] = ntohl(hostaddr
->ipv6
.sin6_addr
.s6_addr32
[3]);
1595 #endif /* AF_INET6 */
1596 if (con
->http
->hostaddr
->addr
.sa_family
== AF_INET
)
1599 * Copy IPv4 address...
1605 address
[3] = ntohl(hostaddr
->ipv4
.sin_addr
.s_addr
);
1608 memset(address
, 0, sizeof(address
));
1610 hostlen
= strlen(hostname
);
1612 auth
= cupsdCheckAccess(address
, hostname
, hostlen
, best
)
1613 ? CUPSD_AUTH_ALLOW
: CUPSD_AUTH_DENY
;
1615 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth
? "DENY" : "ALLOW");
1617 if (auth
== CUPSD_AUTH_DENY
&& best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
)
1618 return (HTTP_FORBIDDEN
);
1622 * See if encryption is required...
1625 if ((best
->encryption
>= HTTP_ENCRYPT_REQUIRED
&& !con
->http
->tls
&&
1626 _cups_strcasecmp(hostname
, "localhost") &&
1627 !httpAddrLocalhost(hostaddr
) &&
1628 best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
) &&
1629 !(type
== CUPSD_AUTH_NEGOTIATE
||
1630 (type
== CUPSD_AUTH_NONE
&&
1631 cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE
)))
1633 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1634 "cupsdIsAuthorized: Need upgrade to TLS...");
1635 return (HTTP_UPGRADE_REQUIRED
);
1637 #endif /* HAVE_SSL */
1640 * Now see what access level is required...
1643 if (best
->level
== CUPSD_AUTH_ANON
|| /* Anonymous access - allow it */
1644 (type
== CUPSD_AUTH_NONE
&& cupsArrayCount(best
->names
) == 0))
1647 if (!con
->username
[0] && type
== CUPSD_AUTH_NONE
&&
1648 best
->limit
== CUPSD_AUTH_LIMIT_IPP
)
1651 * Check for unauthenticated username...
1654 ipp_attribute_t
*attr
; /* requesting-user-name attribute */
1657 attr
= ippFindAttribute(con
->request
, "requesting-user-name", IPP_TAG_NAME
);
1660 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1661 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1662 attr
->values
[0].string
.text
);
1663 strlcpy(username
, attr
->values
[0].string
.text
, sizeof(username
));
1665 else if (best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
|| auth
== CUPSD_AUTH_DENY
)
1666 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
1668 return (HTTP_OK
); /* unless overridden with Satisfy */
1672 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdIsAuthorized: username=\"%s\"",
1675 #ifdef HAVE_AUTHORIZATION_H
1676 if (!con
->username
[0] && !con
->authref
)
1678 if (!con
->username
[0])
1679 #endif /* HAVE_AUTHORIZATION_H */
1681 if (best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
|| auth
== CUPSD_AUTH_DENY
)
1682 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
1684 return (HTTP_OK
); /* unless overridden with Satisfy */
1688 if (con
->type
!= type
&& type
!= CUPSD_AUTH_NONE
&&
1690 (type
!= CUPSD_AUTH_NEGOTIATE
|| con
->gss_uid
<= 0) &&
1691 #endif /* HAVE_GSSAPI */
1692 con
->type
!= CUPSD_AUTH_BASIC
)
1694 cupsdLogMessage(CUPSD_LOG_ERROR
, "Authorized using %s, expected %s.",
1695 types
[con
->type
], types
[type
]);
1697 return (HTTP_UNAUTHORIZED
);
1700 strlcpy(username
, con
->username
, sizeof(username
));
1704 * OK, got a username. See if we need normal user access, or group
1705 * access... (root always matches)
1708 if (!strcmp(username
, "root"))
1712 * Strip any @domain or @KDC from the username and owner...
1715 if ((ptr
= strchr(username
, '@')) != NULL
)
1720 strlcpy(ownername
, owner
, sizeof(ownername
));
1722 if ((ptr
= strchr(ownername
, '@')) != NULL
)
1726 ownername
[0] = '\0';
1729 * Get the user info...
1734 pw
= getpwnam(username
);
1740 if (best
->level
== CUPSD_AUTH_USER
)
1743 * If there are no names associated with this location, then
1744 * any valid user is OK...
1747 if (cupsArrayCount(best
->names
) == 0)
1751 * Otherwise check the user list and return OK if this user is
1755 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: Checking user membership...");
1757 #ifdef HAVE_AUTHORIZATION_H
1759 * If an authorization reference was supplied it must match a right name...
1764 for (name
= (char *)cupsArrayFirst(best
->names
);
1766 name
= (char *)cupsArrayNext(best
->names
))
1768 if (!_cups_strncasecmp(name
, "@AUTHKEY(", 9) && check_authref(con
, name
+ 9))
1770 else if (!_cups_strcasecmp(name
, "@SYSTEM") && SystemGroupAuthKey
&&
1771 check_authref(con
, SystemGroupAuthKey
))
1775 return (HTTP_FORBIDDEN
);
1777 #endif /* HAVE_AUTHORIZATION_H */
1779 for (name
= (char *)cupsArrayFirst(best
->names
);
1781 name
= (char *)cupsArrayNext(best
->names
))
1783 if (!_cups_strcasecmp(name
, "@OWNER") && owner
&&
1784 !_cups_strcasecmp(username
, ownername
))
1786 else if (!_cups_strcasecmp(name
, "@SYSTEM"))
1788 for (i
= 0; i
< NumSystemGroups
; i
++)
1789 if (cupsdCheckGroup(username
, pw
, SystemGroups
[i
]))
1792 else if (name
[0] == '@')
1794 if (cupsdCheckGroup(username
, pw
, name
+ 1))
1797 else if (!_cups_strcasecmp(username
, name
))
1801 return (con
->username
[0] ? HTTP_FORBIDDEN
: HTTP_UNAUTHORIZED
);
1805 * Check to see if this user is in any of the named groups...
1808 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: Checking group membership...");
1811 * Check to see if this user is in any of the named groups...
1814 for (name
= (char *)cupsArrayFirst(best
->names
);
1816 name
= (char *)cupsArrayNext(best
->names
))
1818 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: Checking group \"%s\" membership...", name
);
1820 if (!_cups_strcasecmp(name
, "@SYSTEM"))
1822 for (i
= 0; i
< NumSystemGroups
; i
++)
1823 if (cupsdCheckGroup(username
, pw
, SystemGroups
[i
]))
1826 else if (cupsdCheckGroup(username
, pw
, name
))
1831 * The user isn't part of the specified group, so deny access...
1834 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdIsAuthorized: User not in group(s).");
1836 return (con
->username
[0] ? HTTP_FORBIDDEN
: HTTP_UNAUTHORIZED
);
1841 * 'cupsdNewLocation()' - Create a new location for authorization.
1843 * Note: Still need to call cupsdAddLocation() to add it to the list of global
1847 cupsd_location_t
* /* O - Pointer to new location record */
1848 cupsdNewLocation(const char *location
) /* I - Location path */
1850 cupsd_location_t
*temp
; /* New location */
1854 * Try to allocate memory for the new location.
1857 if ((temp
= calloc(1, sizeof(cupsd_location_t
))) == NULL
)
1861 * Initialize the record and copy the name over...
1864 if ((temp
->location
= _cupsStrAlloc(location
)) == NULL
)
1870 temp
->length
= strlen(temp
->location
);
1873 * Return the new record...
1880 #ifdef HAVE_AUTHORIZATION_H
1882 * 'check_authref()' - Check if an authorization services reference has the
1886 static int /* O - 1 if right is valid, 0 otherwise */
1887 check_authref(cupsd_client_t
*con
, /* I - Connection */
1888 const char *right
) /* I - Right name */
1890 OSStatus status
; /* OS Status */
1891 AuthorizationItem authright
; /* Authorization right */
1892 AuthorizationRights authrights
; /* Authorization rights */
1893 AuthorizationFlags authflags
; /* Authorization flags */
1897 * Check to see if the user is allowed to perform the task...
1903 authright
.name
= right
;
1904 authright
.valueLength
= 0;
1905 authright
.value
= NULL
;
1906 authright
.flags
= 0;
1908 authrights
.count
= 1;
1909 authrights
.items
= &authright
;
1911 authflags
= kAuthorizationFlagDefaults
|
1912 kAuthorizationFlagExtendRights
;
1914 if ((status
= AuthorizationCopyRights(con
->authref
, &authrights
,
1915 kAuthorizationEmptyEnvironment
,
1916 authflags
, NULL
)) != 0)
1918 cupsdLogMessage(CUPSD_LOG_ERROR
,
1919 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
1920 authright
.name
, (int)status
, cssmErrorString(status
));
1924 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "AuthorizationCopyRights(\"%s\") succeeded.", authright
.name
);
1928 #endif /* HAVE_AUTHORIZATION_H */
1932 * 'compare_locations()' - Compare two locations.
1935 static int /* O - Result of comparison */
1936 compare_locations(cupsd_location_t
*a
, /* I - First location */
1937 cupsd_location_t
*b
) /* I - Second location */
1939 return (strcmp(b
->location
, a
->location
));
1944 * 'copy_authmask()' - Copy function for auth masks.
1947 static cupsd_authmask_t
* /* O - New auth mask */
1948 copy_authmask(cupsd_authmask_t
*mask
, /* I - Existing auth mask */
1949 void *data
) /* I - User data (unused) */
1951 cupsd_authmask_t
*temp
; /* New auth mask */
1956 if ((temp
= malloc(sizeof(cupsd_authmask_t
))) != NULL
)
1958 memcpy(temp
, mask
, sizeof(cupsd_authmask_t
));
1960 if (temp
->type
== CUPSD_AUTH_NAME
|| temp
->type
== CUPSD_AUTH_INTERFACE
)
1963 * Make a copy of the name...
1966 if ((temp
->mask
.name
.name
= _cupsStrAlloc(temp
->mask
.name
.name
)) == NULL
)
1969 * Failed to make copy...
1984 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1988 static char * /* O - Encrypted password */
1989 cups_crypt(const char *pw
, /* I - Password string */
1990 const char *salt
) /* I - Salt (key) string */
1992 if (!strncmp(salt
, "$1$", 3))
1995 * Use MD5 passwords without the benefit of PAM; this is for
1996 * Slackware Linux, and the algorithm was taken from the
1997 * old shadow-19990827/lib/md5crypt.c source code... :(
2000 int i
; /* Looping var */
2001 unsigned long n
; /* Output number */
2002 int pwlen
; /* Length of password string */
2003 const char *salt_end
; /* End of "salt" data for MD5 */
2004 char *ptr
; /* Pointer into result string */
2005 _cups_md5_state_t state
; /* Primary MD5 state info */
2006 _cups_md5_state_t state2
; /* Secondary MD5 state info */
2007 unsigned char digest
[16]; /* MD5 digest result */
2008 static char result
[120]; /* Final password string */
2012 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2013 * Get a maximum of 8 characters of salt data after $1$...
2016 for (salt_end
= salt
+ 3; *salt_end
&& (salt_end
- salt
) < 11; salt_end
++)
2017 if (*salt_end
== '$')
2021 * Compute the MD5 sum we need...
2026 _cupsMD5Init(&state
);
2027 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2028 _cupsMD5Append(&state
, (unsigned char *)salt
, salt_end
- salt
);
2030 _cupsMD5Init(&state2
);
2031 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
2032 _cupsMD5Append(&state2
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
2033 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
2034 _cupsMD5Finish(&state2
, digest
);
2036 for (i
= pwlen
; i
> 0; i
-= 16)
2037 _cupsMD5Append(&state
, digest
, i
> 16 ? 16 : i
);
2039 for (i
= pwlen
; i
> 0; i
>>= 1)
2040 _cupsMD5Append(&state
, (unsigned char *)((i
& 1) ? "" : pw
), 1);
2042 _cupsMD5Finish(&state
, digest
);
2044 for (i
= 0; i
< 1000; i
++)
2046 _cupsMD5Init(&state
);
2049 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2051 _cupsMD5Append(&state
, digest
, 16);
2054 _cupsMD5Append(&state
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
2057 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2060 _cupsMD5Append(&state
, digest
, 16);
2062 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2064 _cupsMD5Finish(&state
, digest
);
2068 * Copy the final sum to the result string and return...
2071 memcpy(result
, salt
, (size_t)(salt_end
- salt
));
2072 ptr
= result
+ (salt_end
- salt
);
2075 for (i
= 0; i
< 5; i
++, ptr
+= 4)
2077 n
= ((((unsigned)digest
[i
] << 8) | (unsigned)digest
[i
+ 6]) << 8);
2080 n
|= (unsigned)digest
[i
+ 12];
2082 n
|= (unsigned)digest
[5];
2087 to64(ptr
, (unsigned)digest
[11], 2);
2096 * Use the standard crypt() function...
2099 return (crypt(pw
, salt
));
2102 #endif /* !HAVE_LIBPAM */
2106 * 'free_authmask()' - Free function for auth masks.
2110 free_authmask(cupsd_authmask_t
*mask
, /* I - Auth mask to free */
2111 void *data
) /* I - User data (unused) */
2115 if (mask
->type
== CUPSD_AUTH_NAME
|| mask
->type
== CUPSD_AUTH_INTERFACE
)
2116 _cupsStrFree(mask
->mask
.name
.name
);
2124 * 'pam_func()' - PAM conversation function.
2127 static int /* O - Success or failure */
2129 int num_msg
, /* I - Number of messages */
2130 const struct pam_message
**msg
, /* I - Messages */
2131 struct pam_response
**resp
, /* O - Responses */
2133 /* I - Pointer to connection */
2135 int i
; /* Looping var */
2136 struct pam_response
*replies
; /* Replies */
2137 cupsd_authdata_t
*data
; /* Pointer to auth data */
2141 * Allocate memory for the responses...
2144 if ((replies
= malloc(sizeof(struct pam_response
) * (size_t)num_msg
)) == NULL
)
2145 return (PAM_CONV_ERR
);
2148 * Answer all of the messages...
2151 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr
));
2153 data
= (cupsd_authdata_t
*)appdata_ptr
;
2155 for (i
= 0; i
< num_msg
; i
++)
2157 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg
[i
]->msg
));
2159 switch (msg
[i
]->msg_style
)
2161 case PAM_PROMPT_ECHO_ON
:
2162 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2164 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2165 replies
[i
].resp
= strdup(data
->username
);
2168 case PAM_PROMPT_ECHO_OFF
:
2169 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2171 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2172 replies
[i
].resp
= strdup(data
->password
);
2176 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2177 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2178 replies
[i
].resp
= NULL
;
2182 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2183 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2184 replies
[i
].resp
= NULL
;
2188 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2189 msg
[i
]->msg_style
));
2191 return (PAM_CONV_ERR
);
2196 * Return the responses back to PAM...
2201 return (PAM_SUCCESS
);
2207 * 'to64()' - Base64-encode an integer value...
2211 to64(char *s
, /* O - Output string */
2212 unsigned long v
, /* I - Value to encode */
2213 int n
) /* I - Number of digits */
2215 const char *itoa64
= "./0123456789"
2216 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2217 "abcdefghijklmnopqrstuvwxyz";
2220 for (; n
> 0; n
--, v
>>= 6)
2221 *s
++ = itoa64
[v
& 0x3f];
2223 #endif /* HAVE_LIBPAM */