]>
Commit | Line | Data |
---|---|---|
ef416fc2 | 1 | /* |
7e86f2f6 | 2 | * Authentication functions for CUPS. |
ef416fc2 | 3 | * |
1f679daf MS |
4 | * Copyright © 2007-2018 by Apple Inc. |
5 | * Copyright © 1997-2007 by Easy Software Products. | |
ef416fc2 | 6 | * |
7e86f2f6 MS |
7 | * This file contains Kerberos support code, copyright 2006 by |
8 | * Jelmer Vernooij. | |
f7deaa1a | 9 | * |
7e86f2f6 MS |
10 | * These coded instructions, statements, and computer programs are the |
11 | * property of Apple Inc. and are protected by Federal copyright | |
12 | * law. Distribution and use rights are outlined in the file "LICENSE.txt" | |
13 | * which should have been included with this file. If this file is | |
57b7b66b | 14 | * missing or damaged, see the license at "http://www.cups.org/". |
ef416fc2 | 15 | * |
7e86f2f6 | 16 | * This file is subject to the Apple OS-Developed Software exception. |
ef416fc2 | 17 | */ |
18 | ||
19 | /* | |
20 | * Include necessary headers... | |
21 | */ | |
22 | ||
71e16022 | 23 | #include "cups-private.h" |
ef416fc2 | 24 | #include <fcntl.h> |
25 | #include <sys/stat.h> | |
26 | #if defined(WIN32) || defined(__EMX__) | |
27 | # include <io.h> | |
28 | #else | |
29 | # include <unistd.h> | |
30 | #endif /* WIN32 || __EMX__ */ | |
31 | ||
f7deaa1a | 32 | #if HAVE_AUTHORIZATION_H |
33 | # include <Security/Authorization.h> | |
34 | # ifdef HAVE_SECBASEPRIV_H | |
35 | # include <Security/SecBasePriv.h> | |
36 | # else | |
37 | extern const char *cssmErrorString(int error); | |
38 | # endif /* HAVE_SECBASEPRIV_H */ | |
39 | #endif /* HAVE_AUTHORIZATION_H */ | |
40 | ||
bc44d920 | 41 | #if defined(SO_PEERCRED) && defined(AF_LOCAL) |
42 | # include <pwd.h> | |
43 | #endif /* SO_PEERCRED && AF_LOCAL */ | |
44 | ||
ef416fc2 | 45 | |
46 | /* | |
47 | * Local functions... | |
48 | */ | |
49 | ||
1f717210 MS |
50 | static const char *cups_auth_find(const char *www_authenticate, const char *scheme); |
51 | static const char *cups_auth_param(const char *scheme, const char *name, char *value, size_t valsize); | |
52 | static const char *cups_auth_scheme(const char *www_authenticate, char *scheme, size_t schemesize); | |
53 | ||
f7deaa1a | 54 | #ifdef HAVE_GSSAPI |
eac3a0a0 MS |
55 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
56 | # ifdef HAVE_GSS_GSSAPI_SPI_H | |
57 | # include <GSS/gssapi_spi.h> | |
58 | # else | |
a2326b5b MS |
59 | # define GSS_AUTH_IDENTITY_TYPE_1 1 |
60 | # define gss_acquire_cred_ex_f __ApplePrivate_gss_acquire_cred_ex_f | |
53af7f21 | 61 | typedef struct gss_auth_identity /* @private@ */ |
eac3a0a0 MS |
62 | { |
63 | uint32_t type; | |
64 | uint32_t flags; | |
65 | char *username; | |
66 | char *realm; | |
67 | char *password; | |
68 | gss_buffer_t *credentialsRef; | |
49c59293 | 69 | } gss_auth_identity_desc; |
eac3a0a0 MS |
70 | extern OM_uint32 gss_acquire_cred_ex_f(gss_status_id_t, const gss_name_t, |
71 | OM_uint32, OM_uint32, const gss_OID, | |
72 | gss_cred_usage_t, gss_auth_identity_t, | |
73 | void *, void (*)(void *, OM_uint32, | |
74 | gss_status_id_t, | |
75 | gss_cred_id_t, | |
76 | gss_OID_set, | |
77 | OM_uint32)); | |
78 | # endif /* HAVE_GSS_GSSAPI_SPI_H */ | |
79 | # include <dispatch/dispatch.h> | |
80 | typedef struct _cups_gss_acquire_s /* Acquire callback data */ | |
81 | { | |
82 | dispatch_semaphore_t sem; /* Synchronization semaphore */ | |
83 | OM_uint32 major; /* Returned status code */ | |
84 | gss_cred_id_t creds; /* Returned credentials */ | |
85 | } _cups_gss_acquire_t; | |
86 | ||
87 | static void cups_gss_acquire(void *ctx, OM_uint32 major, | |
88 | gss_status_id_t status, | |
89 | gss_cred_id_t creds, gss_OID_set oids, | |
90 | OM_uint32 time_rec); | |
91 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
92 | static gss_name_t cups_gss_getname(http_t *http, const char *service_name); | |
f7deaa1a | 93 | # ifdef DEBUG |
e07d4801 MS |
94 | static void cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status, |
95 | const char *message); | |
355e94dc | 96 | # else |
e07d4801 MS |
97 | # define cups_gss_printf(major, minor, message) |
98 | # endif /* DEBUG */ | |
f7deaa1a | 99 | #endif /* HAVE_GSSAPI */ |
ef416fc2 | 100 | static int cups_local_auth(http_t *http); |
101 | ||
102 | ||
103 | /* | |
104 | * 'cupsDoAuthentication()' - Authenticate a request. | |
105 | * | |
cb7f98ee | 106 | * This function should be called in response to a @code HTTP_STATUS_UNAUTHORIZED@ |
ef416fc2 | 107 | * status, prior to resubmitting your request. |
108 | * | |
8072030b | 109 | * @since CUPS 1.1.20/macOS 10.4@ |
ef416fc2 | 110 | */ |
111 | ||
112 | int /* O - 0 on success, -1 on error */ | |
f11a948a MS |
113 | cupsDoAuthentication( |
114 | http_t *http, /* I - Connection to server or @code CUPS_HTTP_DEFAULT@ */ | |
115 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
116 | const char *resource) /* I - Resource path */ | |
ef416fc2 | 117 | { |
3e7fe0ca | 118 | const char *password, /* Password string */ |
1f717210 MS |
119 | *www_auth, /* WWW-Authenticate header */ |
120 | *schemedata; /* Scheme-specific data */ | |
121 | char scheme[256], /* Scheme name */ | |
598bfaad | 122 | prompt[1024]; /* Prompt for user */ |
f7deaa1a | 123 | int localauth; /* Local authentication result */ |
b86bc4cf | 124 | _cups_globals_t *cg; /* Global data */ |
ef416fc2 | 125 | |
126 | ||
807315e6 | 127 | DEBUG_printf(("cupsDoAuthentication(http=%p, method=\"%s\", resource=\"%s\")", (void *)http, method, resource)); |
ef416fc2 | 128 | |
f11a948a MS |
129 | if (!http) |
130 | http = _cupsConnect(); | |
131 | ||
132 | if (!http || !method || !resource) | |
133 | return (-1); | |
134 | ||
5a6b583a MS |
135 | DEBUG_printf(("2cupsDoAuthentication: digest_tries=%d, userpass=\"%s\"", |
136 | http->digest_tries, http->userpass)); | |
137 | DEBUG_printf(("2cupsDoAuthentication: WWW-Authenticate=\"%s\"", | |
138 | httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE))); | |
139 | ||
ef416fc2 | 140 | /* |
141 | * Clear the current authentication string... | |
142 | */ | |
143 | ||
355e94dc | 144 | httpSetAuthString(http, NULL, NULL); |
ef416fc2 | 145 | |
146 | /* | |
147 | * See if we can do local authentication... | |
148 | */ | |
149 | ||
f7deaa1a | 150 | if (http->digest_tries < 3) |
ef416fc2 | 151 | { |
f7deaa1a | 152 | if ((localauth = cups_local_auth(http)) == 0) |
153 | { | |
e07d4801 | 154 | DEBUG_printf(("2cupsDoAuthentication: authstring=\"%s\"", |
f7deaa1a | 155 | http->authstring)); |
f14324a7 | 156 | |
cb7f98ee | 157 | if (http->status == HTTP_STATUS_UNAUTHORIZED) |
f7deaa1a | 158 | http->digest_tries ++; |
f14324a7 | 159 | |
f7deaa1a | 160 | return (0); |
161 | } | |
162 | else if (localauth == -1) | |
f11a948a | 163 | { |
cb7f98ee | 164 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
f7deaa1a | 165 | return (-1); /* Error or canceled */ |
f11a948a | 166 | } |
ef416fc2 | 167 | } |
168 | ||
169 | /* | |
1f717210 | 170 | * Nope, loop through the authentication schemes to find the first we support. |
ef416fc2 | 171 | */ |
172 | ||
1f717210 | 173 | www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE); |
3e7fe0ca | 174 | |
1f717210 | 175 | for (schemedata = cups_auth_scheme(www_auth, scheme, sizeof(scheme)); schemedata; schemedata = cups_auth_scheme(schemedata + strlen(scheme), scheme, sizeof(scheme))) |
ef416fc2 | 176 | { |
177 | /* | |
1f717210 | 178 | * Check the scheme name... |
ef416fc2 | 179 | */ |
180 | ||
1f717210 MS |
181 | #ifdef HAVE_GSSAPI |
182 | if (!_cups_strcasecmp(scheme, "Negotiate")) | |
183 | { | |
184 | /* | |
185 | * Kerberos authentication... | |
186 | */ | |
5a9febac | 187 | |
1f717210 MS |
188 | if (_cupsSetNegotiateAuthString(http, method, resource)) |
189 | { | |
190 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
191 | return (-1); | |
192 | } | |
b86bc4cf | 193 | |
1f717210 MS |
194 | break; |
195 | } | |
196 | else | |
197 | #endif /* HAVE_GSSAPI */ | |
198 | if (_cups_strcasecmp(scheme, "Basic") && _cups_strcasecmp(scheme, "Digest")) | |
199 | continue; /* Not supported (yet) */ | |
b86bc4cf | 200 | |
1f717210 MS |
201 | /* |
202 | * See if we should retry the current username:password... | |
203 | */ | |
5a9febac | 204 | |
1f717210 MS |
205 | if ((http->digest_tries > 1 || !http->userpass[0]) && (!_cups_strcasecmp(scheme, "Basic") || (!_cups_strcasecmp(scheme, "Digest")))) |
206 | { | |
207 | /* | |
208 | * Nope - get a new password from the user... | |
209 | */ | |
ef416fc2 | 210 | |
1f717210 MS |
211 | char default_username[HTTP_MAX_VALUE]; |
212 | /* Default username */ | |
ef416fc2 | 213 | |
1f717210 | 214 | cg = _cupsGlobals(); |
ef416fc2 | 215 | |
1f717210 MS |
216 | if (!cg->lang_default) |
217 | cg->lang_default = cupsLangDefault(); | |
ef416fc2 | 218 | |
1f679daf | 219 | if (cups_auth_param(schemedata, "username", default_username, sizeof(default_username))) |
1f717210 | 220 | cupsSetUser(default_username); |
5a6b583a | 221 | |
1f717210 | 222 | snprintf(prompt, sizeof(prompt), _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), cupsUser(), http->hostname[0] == '/' ? "localhost" : http->hostname); |
5a6b583a | 223 | |
1f717210 MS |
224 | http->digest_tries = _cups_strncasecmp(scheme, "Digest", 6) != 0; |
225 | http->userpass[0] = '\0'; | |
ef416fc2 | 226 | |
1f717210 MS |
227 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) |
228 | { | |
229 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
230 | return (-1); | |
231 | } | |
232 | ||
233 | snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), password); | |
234 | } | |
235 | else if (http->status == HTTP_STATUS_UNAUTHORIZED) | |
236 | http->digest_tries ++; | |
f7deaa1a | 237 | |
1f717210 | 238 | if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3) |
f7deaa1a | 239 | { |
1f717210 MS |
240 | DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", http->digest_tries)); |
241 | ||
cb7f98ee | 242 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
f7deaa1a | 243 | return (-1); |
244 | } | |
1f717210 | 245 | |
ef416fc2 | 246 | /* |
1f717210 | 247 | * Got a password; encode it for the server... |
ef416fc2 | 248 | */ |
249 | ||
1f717210 MS |
250 | if (!_cups_strcasecmp(scheme, "Basic")) |
251 | { | |
252 | /* | |
253 | * Basic authentication... | |
254 | */ | |
255 | ||
256 | char encode[256]; /* Base64 buffer */ | |
5a738aea | 257 | |
1f717210 MS |
258 | httpEncode64_2(encode, sizeof(encode), http->userpass, (int)strlen(http->userpass)); |
259 | httpSetAuthString(http, "Basic", encode); | |
598bfaad | 260 | break; |
1f717210 MS |
261 | } |
262 | else if (!_cups_strcasecmp(scheme, "Digest")) | |
263 | { | |
264 | /* | |
265 | * Digest authentication... | |
266 | */ | |
5a738aea | 267 | |
598bfaad | 268 | char nonce[HTTP_MAX_VALUE]; /* nonce="xyz" string */ |
ef416fc2 | 269 | |
598bfaad MS |
270 | cups_auth_param(schemedata, "algorithm", http->algorithm, sizeof(http->algorithm)); |
271 | cups_auth_param(schemedata, "opaque", http->opaque, sizeof(http->opaque)); | |
1f717210 | 272 | cups_auth_param(schemedata, "nonce", nonce, sizeof(nonce)); |
598bfaad | 273 | cups_auth_param(schemedata, "realm", http->realm, sizeof(http->realm)); |
1f717210 | 274 | |
598bfaad MS |
275 | if (_httpSetDigestAuthString(http, nonce, method, resource)) |
276 | break; | |
1f717210 MS |
277 | } |
278 | } | |
279 | ||
280 | if (http->authstring) | |
281 | { | |
282 | DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\"", http->authstring)); | |
283 | ||
284 | return (0); | |
ef416fc2 | 285 | } |
f14324a7 MS |
286 | else |
287 | { | |
1f717210 | 288 | DEBUG_printf(("1cupsDoAuthentication: Unknown auth type: \"%s\"", www_auth)); |
cb7f98ee | 289 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; |
1f717210 | 290 | |
f14324a7 MS |
291 | return (-1); |
292 | } | |
ef416fc2 | 293 | } |
294 | ||
295 | ||
f7deaa1a | 296 | #ifdef HAVE_GSSAPI |
f14324a7 MS |
297 | /* |
298 | * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string. | |
299 | */ | |
300 | ||
301 | int /* O - 0 on success, -1 on error */ | |
302 | _cupsSetNegotiateAuthString( | |
eac3a0a0 MS |
303 | http_t *http, /* I - Connection to server */ |
304 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
305 | const char *resource) /* I - Resource path */ | |
f14324a7 MS |
306 | { |
307 | OM_uint32 minor_status, /* Minor status code */ | |
308 | major_status; /* Major status code */ | |
309 | gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; | |
07ed0e9a | 310 | /* Output token */ |
f14324a7 MS |
311 | |
312 | ||
321d8d57 MS |
313 | (void)method; |
314 | (void)resource; | |
315 | ||
f14324a7 MS |
316 | # ifdef __APPLE__ |
317 | /* | |
318 | * If the weak-linked GSSAPI/Kerberos library is not present, don't try | |
319 | * to use it... | |
320 | */ | |
321 | ||
6d8021f4 | 322 | if (&gss_init_sec_context == NULL) |
f14324a7 MS |
323 | { |
324 | DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos " | |
325 | "framework is not present"); | |
326 | return (-1); | |
327 | } | |
328 | # endif /* __APPLE__ */ | |
329 | ||
330 | if (http->gssname == GSS_C_NO_NAME) | |
331 | { | |
eac3a0a0 | 332 | http->gssname = cups_gss_getname(http, _cupsGSSServiceName()); |
f14324a7 MS |
333 | } |
334 | ||
335 | if (http->gssctx != GSS_C_NO_CONTEXT) | |
336 | { | |
337 | gss_delete_sec_context(&minor_status, &http->gssctx, GSS_C_NO_BUFFER); | |
338 | http->gssctx = GSS_C_NO_CONTEXT; | |
339 | } | |
340 | ||
eac3a0a0 MS |
341 | major_status = gss_init_sec_context(&minor_status, GSS_C_NO_CREDENTIAL, |
342 | &http->gssctx, | |
343 | http->gssname, http->gssmech, | |
344 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
345 | GSS_C_INDEFINITE, | |
346 | GSS_C_NO_CHANNEL_BINDINGS, | |
347 | GSS_C_NO_BUFFER, &http->gssmech, | |
348 | &output_token, NULL, NULL); | |
349 | ||
1f717210 | 350 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
eac3a0a0 MS |
351 | if (major_status == GSS_S_NO_CRED) |
352 | { | |
353 | /* | |
354 | * Ask the user for credentials... | |
355 | */ | |
356 | ||
357 | char prompt[1024], /* Prompt for user */ | |
358 | userbuf[256]; /* Kerberos username */ | |
359 | const char *username, /* Username string */ | |
360 | *password; /* Password string */ | |
361 | _cups_gss_acquire_t data; /* Callback data */ | |
49c59293 | 362 | gss_auth_identity_desc identity; /* Kerberos user identity */ |
eac3a0a0 MS |
363 | _cups_globals_t *cg = _cupsGlobals(); |
364 | /* Per-thread global data */ | |
365 | ||
366 | if (!cg->lang_default) | |
367 | cg->lang_default = cupsLangDefault(); | |
368 | ||
369 | snprintf(prompt, sizeof(prompt), | |
370 | _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), | |
f228370c | 371 | cupsUser(), http->gsshost); |
eac3a0a0 MS |
372 | |
373 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) | |
374 | return (-1); | |
375 | ||
376 | /* | |
377 | * Try to acquire credentials... | |
378 | */ | |
379 | ||
380 | username = cupsUser(); | |
381 | if (!strchr(username, '@')) | |
382 | { | |
f228370c | 383 | snprintf(userbuf, sizeof(userbuf), "%s@%s", username, http->gsshost); |
eac3a0a0 MS |
384 | username = userbuf; |
385 | } | |
386 | ||
387 | identity.type = GSS_AUTH_IDENTITY_TYPE_1; | |
388 | identity.flags = 0; | |
389 | identity.username = (char *)username; | |
390 | identity.realm = (char *)""; | |
391 | identity.password = (char *)password; | |
392 | identity.credentialsRef = NULL; | |
393 | ||
394 | data.sem = dispatch_semaphore_create(0); | |
395 | data.major = 0; | |
396 | data.creds = NULL; | |
397 | ||
398 | if (data.sem) | |
399 | { | |
5dcbe84d | 400 | major_status = gss_acquire_cred_ex_f(NULL, GSS_C_NO_NAME, 0, GSS_C_INDEFINITE, GSS_KRB5_MECHANISM, GSS_C_INITIATE, (gss_auth_identity_t)&identity, &data, cups_gss_acquire); |
eac3a0a0 MS |
401 | |
402 | if (major_status == GSS_S_COMPLETE) | |
403 | { | |
404 | dispatch_semaphore_wait(data.sem, DISPATCH_TIME_FOREVER); | |
405 | major_status = data.major; | |
406 | } | |
407 | ||
408 | dispatch_release(data.sem); | |
409 | ||
410 | if (major_status == GSS_S_COMPLETE) | |
411 | { | |
412 | OM_uint32 release_minor; /* Minor status from releasing creds */ | |
413 | ||
414 | major_status = gss_init_sec_context(&minor_status, data.creds, | |
415 | &http->gssctx, | |
416 | http->gssname, http->gssmech, | |
417 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
418 | GSS_C_INDEFINITE, | |
419 | GSS_C_NO_CHANNEL_BINDINGS, | |
420 | GSS_C_NO_BUFFER, &http->gssmech, | |
421 | &output_token, NULL, NULL); | |
422 | gss_release_cred(&release_minor, &data.creds); | |
423 | } | |
424 | } | |
425 | } | |
1f717210 | 426 | # endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */ |
f14324a7 MS |
427 | |
428 | if (GSS_ERROR(major_status)) | |
429 | { | |
430 | cups_gss_printf(major_status, minor_status, | |
431 | "_cupsSetNegotiateAuthString: Unable to initialize " | |
432 | "security context"); | |
433 | return (-1); | |
434 | } | |
435 | ||
1f717210 | 436 | # ifdef DEBUG |
eac3a0a0 | 437 | else if (major_status == GSS_S_CONTINUE_NEEDED) |
f14324a7 MS |
438 | cups_gss_printf(major_status, minor_status, |
439 | "_cupsSetNegotiateAuthString: Continuation needed!"); | |
1f717210 | 440 | # endif /* DEBUG */ |
f14324a7 MS |
441 | |
442 | if (output_token.length > 0 && output_token.length <= 65536) | |
443 | { | |
444 | /* | |
445 | * Allocate the authorization string since Windows KDCs can have | |
446 | * arbitrarily large credentials... | |
447 | */ | |
448 | ||
7e86f2f6 MS |
449 | int authsize = 10 + /* "Negotiate " */ |
450 | (int)output_token.length * 4 / 3 + 1 + 1; | |
451 | /* Base64 + nul */ | |
f14324a7 MS |
452 | |
453 | httpSetAuthString(http, NULL, NULL); | |
454 | ||
7e86f2f6 | 455 | if ((http->authstring = malloc((size_t)authsize)) == NULL) |
f14324a7 MS |
456 | { |
457 | http->authstring = http->_authstring; | |
458 | authsize = sizeof(http->_authstring); | |
459 | } | |
460 | ||
07623986 | 461 | strlcpy(http->authstring, "Negotiate ", (size_t)authsize); |
f14324a7 | 462 | httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value, |
7e86f2f6 | 463 | (int)output_token.length); |
f14324a7 MS |
464 | |
465 | gss_release_buffer(&minor_status, &output_token); | |
466 | } | |
467 | else | |
468 | { | |
469 | DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos credentials too " | |
470 | "large - %d bytes!", (int)output_token.length)); | |
471 | gss_release_buffer(&minor_status, &output_token); | |
472 | ||
473 | return (-1); | |
474 | } | |
475 | ||
476 | return (0); | |
477 | } | |
1f717210 MS |
478 | #endif /* HAVE_GSSAPI */ |
479 | ||
480 | ||
481 | /* | |
482 | * 'cups_auth_find()' - Find the named WWW-Authenticate scheme. | |
483 | * | |
484 | * The "www_authenticate" parameter points to the current position in the header. | |
485 | * | |
486 | * Returns @code NULL@ if the auth scheme is not present. | |
487 | */ | |
488 | ||
489 | static const char * /* O - Start of matching scheme or @code NULL@ if not found */ | |
490 | cups_auth_find(const char *www_authenticate, /* I - Pointer into WWW-Authenticate header */ | |
491 | const char *scheme) /* I - Authentication scheme */ | |
492 | { | |
493 | size_t schemelen = strlen(scheme); /* Length of scheme */ | |
494 | ||
495 | ||
496 | DEBUG_printf(("8cups_auth_find(www_authenticate=\"%s\", scheme=\"%s\"(%d))", www_authenticate, scheme, (int)schemelen)); | |
497 | ||
498 | while (*www_authenticate) | |
499 | { | |
500 | /* | |
501 | * Skip leading whitespace and commas... | |
502 | */ | |
503 | ||
504 | DEBUG_printf(("9cups_auth_find: Before whitespace: \"%s\"", www_authenticate)); | |
505 | while (isspace(*www_authenticate & 255) || *www_authenticate == ',') | |
506 | www_authenticate ++; | |
507 | DEBUG_printf(("9cups_auth_find: After whitespace: \"%s\"", www_authenticate)); | |
508 | ||
509 | /* | |
510 | * See if this is "Scheme" followed by whitespace or the end of the string. | |
511 | */ | |
512 | ||
b643d6ba | 513 | if (!strncmp(www_authenticate, scheme, schemelen) && (isspace(www_authenticate[schemelen] & 255) || www_authenticate[schemelen] == ',' || !www_authenticate[schemelen])) |
1f717210 MS |
514 | { |
515 | /* | |
516 | * Yes, this is the start of the scheme-specific information... | |
517 | */ | |
518 | ||
519 | DEBUG_printf(("9cups_auth_find: Returning \"%s\".", www_authenticate)); | |
520 | ||
521 | return (www_authenticate); | |
522 | } | |
523 | ||
524 | /* | |
525 | * Skip the scheme name or param="value" string... | |
526 | */ | |
527 | ||
528 | while (!isspace(*www_authenticate & 255) && *www_authenticate) | |
529 | { | |
530 | if (*www_authenticate == '\"') | |
531 | { | |
532 | /* | |
533 | * Skip quoted value... | |
534 | */ | |
535 | ||
536 | www_authenticate ++; | |
537 | while (*www_authenticate && *www_authenticate != '\"') | |
538 | www_authenticate ++; | |
539 | ||
540 | DEBUG_printf(("9cups_auth_find: After quoted: \"%s\"", www_authenticate)); | |
541 | } | |
542 | ||
543 | www_authenticate ++; | |
544 | } | |
545 | ||
546 | DEBUG_printf(("9cups_auth_find: After skip: \"%s\"", www_authenticate)); | |
547 | } | |
548 | ||
549 | DEBUG_puts("9cups_auth_find: Returning NULL."); | |
550 | ||
551 | return (NULL); | |
552 | } | |
553 | ||
554 | ||
555 | /* | |
556 | * 'cups_auth_param()' - Copy the value for the named authentication parameter, | |
557 | * if present. | |
558 | */ | |
559 | ||
560 | static const char * /* O - Parameter value or @code NULL@ if not present */ | |
561 | cups_auth_param(const char *scheme, /* I - Pointer to auth data */ | |
562 | const char *name, /* I - Name of parameter */ | |
563 | char *value, /* I - Value buffer */ | |
564 | size_t valsize) /* I - Size of value buffer */ | |
565 | { | |
566 | char *valptr = value, /* Pointer into value buffer */ | |
bec85069 | 567 | *valend = value + valsize - 1; /* Pointer to end of buffer */ |
1f717210 MS |
568 | size_t namelen = strlen(name); /* Name length */ |
569 | int param; /* Is this a parameter? */ | |
570 | ||
571 | ||
572 | DEBUG_printf(("8cups_auth_param(scheme=\"%s\", name=\"%s\", value=%p, valsize=%d)", scheme, name, (void *)value, (int)valsize)); | |
573 | ||
574 | while (!isspace(*scheme & 255) && *scheme) | |
575 | scheme ++; | |
576 | ||
577 | while (*scheme) | |
578 | { | |
579 | while (isspace(*scheme & 255) || *scheme == ',') | |
580 | scheme ++; | |
581 | ||
582 | if (!strncmp(scheme, name, namelen) && scheme[namelen] == '=') | |
583 | { | |
584 | /* | |
585 | * Found the parameter, copy the value... | |
586 | */ | |
587 | ||
588 | scheme += namelen + 1; | |
589 | if (*scheme == '\"') | |
590 | { | |
591 | scheme ++; | |
592 | ||
593 | while (*scheme && *scheme != '\"') | |
594 | { | |
595 | if (valptr < valend) | |
596 | *valptr++ = *scheme; | |
597 | ||
598 | scheme ++; | |
599 | } | |
600 | } | |
601 | else | |
602 | { | |
603 | while (*scheme && strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~+/=", *scheme)) | |
604 | { | |
605 | if (valptr < valend) | |
606 | *valptr++ = *scheme; | |
607 | ||
608 | scheme ++; | |
609 | } | |
610 | } | |
611 | ||
612 | *valptr = '\0'; | |
613 | ||
614 | DEBUG_printf(("9cups_auth_param: Returning \"%s\".", value)); | |
615 | ||
616 | return (value); | |
617 | } | |
618 | ||
619 | /* | |
620 | * Skip the param=value string... | |
621 | */ | |
622 | ||
623 | param = 0; | |
624 | ||
625 | while (!isspace(*scheme & 255) && *scheme) | |
626 | { | |
627 | if (*scheme == '=') | |
628 | param = 1; | |
629 | else if (*scheme == '\"') | |
630 | { | |
631 | /* | |
632 | * Skip quoted value... | |
633 | */ | |
634 | ||
635 | scheme ++; | |
636 | while (*scheme && *scheme != '\"') | |
637 | scheme ++; | |
638 | } | |
639 | ||
640 | scheme ++; | |
641 | } | |
642 | ||
643 | /* | |
644 | * If this wasn't a parameter, we are at the end of this scheme's | |
645 | * parameters... | |
646 | */ | |
647 | ||
648 | if (!param) | |
649 | break; | |
650 | } | |
651 | ||
652 | *value = '\0'; | |
653 | ||
654 | DEBUG_puts("9cups_auth_param: Returning NULL."); | |
655 | ||
656 | return (NULL); | |
657 | } | |
f14324a7 MS |
658 | |
659 | ||
1f717210 MS |
660 | /* |
661 | * 'cups_auth_scheme()' - Get the (next) WWW-Authenticate scheme. | |
662 | * | |
663 | * The "www_authenticate" parameter points to the current position in the header. | |
664 | * | |
665 | * Returns @code NULL@ if there are no (more) auth schemes present. | |
666 | */ | |
667 | ||
668 | static const char * /* O - Start of scheme or @code NULL@ if not found */ | |
669 | cups_auth_scheme(const char *www_authenticate, /* I - Pointer into WWW-Authenticate header */ | |
670 | char *scheme, /* I - Scheme name buffer */ | |
671 | size_t schemesize) /* I - Size of buffer */ | |
672 | { | |
673 | const char *start; /* Start of scheme data */ | |
674 | char *sptr = scheme, /* Pointer into scheme buffer */ | |
675 | *send = scheme + schemesize - 1;/* End of scheme buffer */ | |
676 | int param; /* Is this a parameter? */ | |
677 | ||
678 | ||
679 | DEBUG_printf(("8cups_auth_scheme(www_authenticate=\"%s\", scheme=%p, schemesize=%d)", www_authenticate, (void *)scheme, (int)schemesize)); | |
680 | ||
681 | while (*www_authenticate) | |
682 | { | |
683 | /* | |
684 | * Skip leading whitespace and commas... | |
685 | */ | |
686 | ||
687 | while (isspace(*www_authenticate & 255) || *www_authenticate == ',') | |
688 | www_authenticate ++; | |
689 | ||
690 | /* | |
691 | * Parse the scheme name or param="value" string... | |
692 | */ | |
693 | ||
1f679daf | 694 | for (sptr = scheme, start = www_authenticate, param = 0; *www_authenticate && *www_authenticate != ',' && !isspace(*www_authenticate & 255); www_authenticate ++) |
1f717210 MS |
695 | { |
696 | if (*www_authenticate == '=') | |
697 | param = 1; | |
698 | else if (!param && sptr < send) | |
699 | *sptr++ = *www_authenticate; | |
700 | else if (*www_authenticate == '\"') | |
701 | { | |
702 | /* | |
703 | * Skip quoted value... | |
704 | */ | |
705 | ||
706 | www_authenticate ++; | |
707 | while (*www_authenticate && *www_authenticate != '\"') | |
708 | www_authenticate ++; | |
709 | } | |
710 | } | |
711 | ||
712 | if (sptr > scheme && !param) | |
713 | { | |
714 | *sptr = '\0'; | |
715 | ||
716 | DEBUG_printf(("9cups_auth_scheme: Returning \"%s\".", start)); | |
717 | ||
718 | return (start); | |
719 | } | |
720 | } | |
721 | ||
722 | *scheme = '\0'; | |
723 | ||
724 | DEBUG_puts("9cups_auth_scheme: Returning NULL."); | |
725 | ||
726 | return (NULL); | |
727 | } | |
728 | ||
729 | ||
730 | #ifdef HAVE_GSSAPI | |
eac3a0a0 | 731 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F |
f7deaa1a | 732 | /* |
eac3a0a0 MS |
733 | * 'cups_gss_acquire()' - Kerberos credentials callback. |
734 | */ | |
735 | static void | |
736 | cups_gss_acquire( | |
737 | void *ctx, /* I - Caller context */ | |
738 | OM_uint32 major, /* I - Major error code */ | |
739 | gss_status_id_t status, /* I - Status (unused) */ | |
740 | gss_cred_id_t creds, /* I - Credentials (if any) */ | |
741 | gss_OID_set oids, /* I - Mechanism OIDs (unused) */ | |
742 | OM_uint32 time_rec) /* I - Timestamp (unused) */ | |
743 | { | |
744 | uint32_t min; /* Minor error code */ | |
745 | _cups_gss_acquire_t *data; /* Callback data */ | |
746 | ||
747 | ||
748 | (void)status; | |
749 | (void)time_rec; | |
750 | ||
751 | data = (_cups_gss_acquire_t *)ctx; | |
752 | data->major = major; | |
753 | data->creds = creds; | |
754 | ||
755 | gss_release_oid_set(&min, &oids); | |
756 | dispatch_semaphore_signal(data->sem); | |
757 | } | |
758 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
759 | ||
760 | ||
761 | /* | |
762 | * 'cups_gss_getname()' - Get CUPS service credentials for authentication. | |
f7deaa1a | 763 | */ |
764 | ||
765 | static gss_name_t /* O - Server name */ | |
eac3a0a0 | 766 | cups_gss_getname( |
f7deaa1a | 767 | http_t *http, /* I - Connection to server */ |
768 | const char *service_name) /* I - Service name */ | |
769 | { | |
770 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | |
771 | /* Service token */ | |
bc44d920 | 772 | OM_uint32 major_status, /* Major status code */ |
773 | minor_status; /* Minor status code */ | |
774 | gss_name_t server_name; /* Server name */ | |
eac3a0a0 | 775 | char buf[1024]; /* Name buffer */ |
bc44d920 | 776 | |
777 | ||
eac3a0a0 | 778 | DEBUG_printf(("7cups_gss_getname(http=%p, service_name=\"%s\")", http, |
e07d4801 MS |
779 | service_name)); |
780 | ||
781 | ||
bc44d920 | 782 | /* |
783 | * Get the hostname... | |
784 | */ | |
f7deaa1a | 785 | |
eac3a0a0 MS |
786 | if (!http->gsshost[0]) |
787 | { | |
788 | httpGetHostname(http, http->gsshost, sizeof(http->gsshost)); | |
bc44d920 | 789 | |
eac3a0a0 MS |
790 | if (!strcmp(http->gsshost, "localhost")) |
791 | { | |
792 | if (gethostname(http->gsshost, sizeof(http->gsshost)) < 0) | |
793 | { | |
794 | DEBUG_printf(("1cups_gss_getname: gethostname() failed: %s", | |
795 | strerror(errno))); | |
796 | http->gsshost[0] = '\0'; | |
797 | return (NULL); | |
798 | } | |
799 | ||
800 | if (!strchr(http->gsshost, '.')) | |
801 | { | |
802 | /* | |
803 | * The hostname is not a FQDN, so look it up... | |
804 | */ | |
805 | ||
806 | struct hostent *host; /* Host entry to get FQDN */ | |
807 | ||
808 | if ((host = gethostbyname(http->gsshost)) != NULL && host->h_name) | |
809 | { | |
810 | /* | |
811 | * Use the resolved hostname... | |
812 | */ | |
813 | ||
814 | strlcpy(http->gsshost, host->h_name, sizeof(http->gsshost)); | |
815 | } | |
816 | else | |
817 | { | |
818 | DEBUG_printf(("1cups_gss_getname: gethostbyname(\"%s\") failed.", | |
819 | http->gsshost)); | |
820 | http->gsshost[0] = '\0'; | |
821 | return (NULL); | |
822 | } | |
823 | } | |
824 | } | |
825 | } | |
f7deaa1a | 826 | |
827 | /* | |
eac3a0a0 | 828 | * Get a service name we can use for authentication purposes... |
f7deaa1a | 829 | */ |
830 | ||
eac3a0a0 | 831 | snprintf(buf, sizeof(buf), "%s@%s", service_name, http->gsshost); |
f7deaa1a | 832 | |
eac3a0a0 | 833 | DEBUG_printf(("8cups_gss_getname: Looking up \"%s\".", buf)); |
7ff4fea9 | 834 | |
f7deaa1a | 835 | token.value = buf; |
836 | token.length = strlen(buf); | |
837 | server_name = GSS_C_NO_NAME; | |
838 | major_status = gss_import_name(&minor_status, &token, | |
839 | GSS_C_NT_HOSTBASED_SERVICE, | |
840 | &server_name); | |
841 | ||
842 | if (GSS_ERROR(major_status)) | |
843 | { | |
e07d4801 | 844 | cups_gss_printf(major_status, minor_status, |
eac3a0a0 | 845 | "cups_gss_getname: gss_import_name() failed"); |
f7deaa1a | 846 | return (NULL); |
847 | } | |
848 | ||
849 | return (server_name); | |
850 | } | |
e07d4801 MS |
851 | |
852 | ||
853 | # ifdef DEBUG | |
854 | /* | |
eac3a0a0 | 855 | * 'cups_gss_printf()' - Show debug error messages from GSSAPI. |
e07d4801 MS |
856 | */ |
857 | ||
858 | static void | |
859 | cups_gss_printf(OM_uint32 major_status,/* I - Major status code */ | |
860 | OM_uint32 minor_status,/* I - Minor status code */ | |
861 | const char *message) /* I - Prefix for error message */ | |
862 | { | |
863 | OM_uint32 err_major_status, /* Major status code for display */ | |
864 | err_minor_status; /* Minor status code for display */ | |
865 | OM_uint32 msg_ctx; /* Message context */ | |
866 | gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER, | |
867 | /* Major status message */ | |
868 | minor_status_string = GSS_C_EMPTY_BUFFER; | |
869 | /* Minor status message */ | |
870 | ||
871 | ||
872 | msg_ctx = 0; | |
873 | err_major_status = gss_display_status(&err_minor_status, | |
874 | major_status, | |
875 | GSS_C_GSS_CODE, | |
876 | GSS_C_NO_OID, | |
877 | &msg_ctx, | |
878 | &major_status_string); | |
879 | ||
880 | if (!GSS_ERROR(err_major_status)) | |
881 | gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE, | |
882 | GSS_C_NULL_OID, &msg_ctx, &minor_status_string); | |
883 | ||
68b10830 | 884 | DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value, |
e07d4801 MS |
885 | (char *)minor_status_string.value)); |
886 | ||
887 | gss_release_buffer(&err_minor_status, &major_status_string); | |
888 | gss_release_buffer(&err_minor_status, &minor_status_string); | |
889 | } | |
890 | # endif /* DEBUG */ | |
f7deaa1a | 891 | #endif /* HAVE_GSSAPI */ |
892 | ||
893 | ||
ef416fc2 | 894 | /* |
895 | * 'cups_local_auth()' - Get the local authorization certificate if | |
eac3a0a0 | 896 | * available/applicable. |
ef416fc2 | 897 | */ |
898 | ||
f7deaa1a | 899 | static int /* O - 0 if available */ |
bc44d920 | 900 | /* 1 if not available */ |
f7deaa1a | 901 | /* -1 error */ |
ef416fc2 | 902 | cups_local_auth(http_t *http) /* I - HTTP connection to server */ |
903 | { | |
904 | #if defined(WIN32) || defined(__EMX__) | |
905 | /* | |
906 | * Currently WIN32 and OS-2 do not support the CUPS server... | |
907 | */ | |
908 | ||
bc44d920 | 909 | return (1); |
ef416fc2 | 910 | #else |
f7deaa1a | 911 | int pid; /* Current process ID */ |
912 | FILE *fp; /* Certificate file */ | |
e07d4801 | 913 | char trc[16], /* Try Root Certificate parameter */ |
6961465f | 914 | filename[1024]; /* Certificate filename */ |
1f717210 MS |
915 | const char *www_auth, /* WWW-Authenticate header */ |
916 | *schemedata; /* Data for the named auth scheme */ | |
ef416fc2 | 917 | _cups_globals_t *cg = _cupsGlobals(); /* Global data */ |
bc44d920 | 918 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 919 | OSStatus status; /* Status */ |
920 | AuthorizationItem auth_right; /* Authorization right */ | |
921 | AuthorizationRights auth_rights; /* Authorization rights */ | |
922 | AuthorizationFlags auth_flags; /* Authorization flags */ | |
923 | AuthorizationExternalForm auth_extrn; /* Authorization ref external */ | |
924 | char auth_key[1024]; /* Buffer */ | |
925 | char buffer[1024]; /* Buffer */ | |
bc44d920 | 926 | # endif /* HAVE_AUTHORIZATION_H */ |
ef416fc2 | 927 | |
928 | ||
807315e6 | 929 | DEBUG_printf(("7cups_local_auth(http=%p) hostaddr=%s, hostname=\"%s\"", (void *)http, httpAddrString(http->hostaddr, filename, sizeof(filename)), http->hostname)); |
ef416fc2 | 930 | |
931 | /* | |
932 | * See if we are accessing localhost... | |
933 | */ | |
934 | ||
1f717210 | 935 | if (!httpAddrLocalhost(http->hostaddr) && _cups_strcasecmp(http->hostname, "localhost") != 0) |
ef416fc2 | 936 | { |
e07d4801 | 937 | DEBUG_puts("8cups_local_auth: Not a local connection!"); |
bc44d920 | 938 | return (1); |
ef416fc2 | 939 | } |
940 | ||
1f717210 MS |
941 | www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE); |
942 | ||
bc44d920 | 943 | # if defined(HAVE_AUTHORIZATION_H) |
f7deaa1a | 944 | /* |
945 | * Delete any previous authorization reference... | |
946 | */ | |
f14324a7 | 947 | |
b94498cf | 948 | if (http->auth_ref) |
f7deaa1a | 949 | { |
b94498cf | 950 | AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults); |
951 | http->auth_ref = NULL; | |
f7deaa1a | 952 | } |
953 | ||
1f717210 | 954 | if (!getenv("GATEWAY_INTERFACE") && (schemedata = cups_auth_find(www_auth, "AuthRef")) != NULL && cups_auth_param(schemedata, "key", auth_key, sizeof(auth_key))) |
f7deaa1a | 955 | { |
1f717210 | 956 | status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &http->auth_ref); |
f7deaa1a | 957 | if (status != errAuthorizationSuccess) |
958 | { | |
e07d4801 | 959 | DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d (%s)", |
f7deaa1a | 960 | (int)status, cssmErrorString(status))); |
961 | return (-1); | |
962 | } | |
963 | ||
964 | auth_right.name = auth_key; | |
965 | auth_right.valueLength = 0; | |
966 | auth_right.value = NULL; | |
967 | auth_right.flags = 0; | |
968 | ||
969 | auth_rights.count = 1; | |
970 | auth_rights.items = &auth_right; | |
971 | ||
f14324a7 | 972 | auth_flags = kAuthorizationFlagDefaults | |
f7deaa1a | 973 | kAuthorizationFlagPreAuthorize | |
f14324a7 | 974 | kAuthorizationFlagInteractionAllowed | |
f7deaa1a | 975 | kAuthorizationFlagExtendRights; |
976 | ||
f14324a7 MS |
977 | status = AuthorizationCopyRights(http->auth_ref, &auth_rights, |
978 | kAuthorizationEmptyEnvironment, | |
f7deaa1a | 979 | auth_flags, NULL); |
980 | if (status == errAuthorizationSuccess) | |
b94498cf | 981 | status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn); |
f7deaa1a | 982 | |
983 | if (status == errAuthorizationSuccess) | |
984 | { | |
985 | /* | |
986 | * Set the authorization string and return... | |
987 | */ | |
988 | ||
f14324a7 | 989 | httpEncode64_2(buffer, sizeof(buffer), (void *)&auth_extrn, |
f7deaa1a | 990 | sizeof(auth_extrn)); |
991 | ||
355e94dc | 992 | httpSetAuthString(http, "AuthRef", buffer); |
f7deaa1a | 993 | |
e07d4801 | 994 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
f7deaa1a | 995 | http->authstring)); |
996 | return (0); | |
997 | } | |
998 | else if (status == errAuthorizationCanceled) | |
999 | return (-1); | |
1000 | ||
e07d4801 | 1001 | DEBUG_printf(("9cups_local_auth: AuthorizationCopyRights() returned %d (%s)", |
f7deaa1a | 1002 | (int)status, cssmErrorString(status))); |
1003 | ||
1004 | /* | |
1005 | * Fall through to try certificates... | |
1006 | */ | |
1007 | } | |
bc44d920 | 1008 | # endif /* HAVE_AUTHORIZATION_H */ |
f7deaa1a | 1009 | |
1f717210 MS |
1010 | # ifdef HAVE_GSSAPI |
1011 | if (cups_auth_find(www_auth, "Negotiate")) | |
1012 | return (1); | |
1013 | # endif /* HAVE_GSSAPI */ | |
1f717210 | 1014 | |
f11a948a MS |
1015 | # if defined(SO_PEERCRED) && defined(AF_LOCAL) |
1016 | /* | |
1017 | * See if we can authenticate using the peer credentials provided over a | |
1018 | * domain socket; if so, specify "PeerCred username" as the authentication | |
1019 | * information... | |
1020 | */ | |
1021 | ||
1f717210 MS |
1022 | if (http->hostaddr->addr.sa_family == AF_LOCAL && |
1023 | !getenv("GATEWAY_INTERFACE") && /* Not via CGI programs... */ | |
1024 | cups_auth_find(www_auth, "PeerCred")) | |
f11a948a MS |
1025 | { |
1026 | /* | |
1027 | * Verify that the current cupsUser() matches the current UID... | |
1028 | */ | |
1029 | ||
1030 | struct passwd *pwd; /* Password information */ | |
1031 | const char *username; /* Current username */ | |
1032 | ||
1033 | username = cupsUser(); | |
1034 | ||
1035 | if ((pwd = getpwnam(username)) != NULL && pwd->pw_uid == getuid()) | |
1036 | { | |
1037 | httpSetAuthString(http, "PeerCred", username); | |
1038 | ||
1039 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", | |
1040 | http->authstring)); | |
1041 | ||
1042 | return (0); | |
1043 | } | |
1044 | } | |
1045 | # endif /* SO_PEERCRED && AF_LOCAL */ | |
1046 | ||
1f717210 MS |
1047 | if ((schemedata = cups_auth_find(www_auth, "Local")) == NULL) |
1048 | return (1); | |
1049 | ||
ef416fc2 | 1050 | /* |
1051 | * Try opening a certificate file for this PID. If that fails, | |
1052 | * try the root certificate... | |
1053 | */ | |
1054 | ||
1055 | pid = getpid(); | |
1056 | snprintf(filename, sizeof(filename), "%s/certs/%d", cg->cups_statedir, pid); | |
1057 | if ((fp = fopen(filename, "r")) == NULL && pid > 0) | |
1058 | { | |
bc44d920 | 1059 | /* |
e07d4801 | 1060 | * No certificate for this PID; see if we can get the root certificate... |
bc44d920 | 1061 | */ |
1062 | ||
7927b44a | 1063 | DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno))); |
e07d4801 | 1064 | |
1f717210 | 1065 | if (!cups_auth_param(schemedata, "trc", trc, sizeof(trc))) |
e07d4801 MS |
1066 | { |
1067 | /* | |
1068 | * Scheduler doesn't want us to use the root certificate... | |
1069 | */ | |
1070 | ||
1071 | return (1); | |
1072 | } | |
1073 | ||
ef416fc2 | 1074 | snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir); |
7927b44a MS |
1075 | if ((fp = fopen(filename, "r")) == NULL) |
1076 | DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno))); | |
ef416fc2 | 1077 | } |
1078 | ||
f7deaa1a | 1079 | if (fp) |
ef416fc2 | 1080 | { |
f7deaa1a | 1081 | /* |
1082 | * Read the certificate from the file... | |
1083 | */ | |
ef416fc2 | 1084 | |
6961465f MS |
1085 | char certificate[33], /* Certificate string */ |
1086 | *certptr; /* Pointer to certificate string */ | |
1087 | ||
1088 | certptr = fgets(certificate, sizeof(certificate), fp); | |
f7deaa1a | 1089 | fclose(fp); |
ef416fc2 | 1090 | |
6961465f MS |
1091 | if (certptr) |
1092 | { | |
1093 | /* | |
1094 | * Set the authorization string and return... | |
1095 | */ | |
ef416fc2 | 1096 | |
6961465f | 1097 | httpSetAuthString(http, "Local", certificate); |
ef416fc2 | 1098 | |
6961465f MS |
1099 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", |
1100 | http->authstring)); | |
ef416fc2 | 1101 | |
6961465f MS |
1102 | return (0); |
1103 | } | |
f7deaa1a | 1104 | } |
1105 | ||
1106 | return (1); | |
ef416fc2 | 1107 | #endif /* WIN32 || __EMX__ */ |
1108 | } |