[thirdparty/cups.git] / scheduler / auth.h

/*
 * Authorization definitions for the CUPS scheduler.
 *
 * Copyright 2007-2014 by Apple Inc.
 * Copyright 1997-2006 by Easy Software Products, all rights reserved.
 *
 * These coded instructions, statements, and computer programs are the
 * property of Apple Inc. and are protected by Federal copyright
 * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
 * which should have been included with this file.  If this file is
 * missing or damaged, see the license at "http://www.cups.org/".
 */

/*
 * Include necessary headers...
 */

#include <pwd.h>


/*
 * HTTP authorization types and levels...
 */

#define CUPSD_AUTH_DEFAULT	-1	/* Use DefaultAuthType */
#define CUPSD_AUTH_NONE		0	/* No authentication */
#define CUPSD_AUTH_BASIC	1	/* Basic authentication */
#define CUPSD_AUTH_NEGOTIATE	2	/* Kerberos authentication */
#define CUPSD_AUTH_AUTO		3	/* Kerberos or Basic, depending on configuration of server */

#define CUPSD_AUTH_ANON		0	/* Anonymous access */
#define CUPSD_AUTH_USER		1	/* Must have a valid username/password */
#define CUPSD_AUTH_GROUP	2	/* Must also be in a named group */

#define CUPSD_AUTH_ALLOW	0	/* Allow access */
#define CUPSD_AUTH_DENY		1	/* Deny access */

#define CUPSD_AUTH_NAME		0	/* Authorize host by name */
#define CUPSD_AUTH_IP		1	/* Authorize host by IP */
#define CUPSD_AUTH_INTERFACE	2	/* Authorize host by interface */

#define CUPSD_AUTH_SATISFY_ALL	0	/* Satisfy both address and auth */
#define CUPSD_AUTH_SATISFY_ANY	1	/* Satisfy either address or auth */

#define CUPSD_AUTH_LIMIT_DELETE	1	/* Limit DELETE requests */
#define CUPSD_AUTH_LIMIT_GET	2	/* Limit GET requests */
#define CUPSD_AUTH_LIMIT_HEAD	4	/* Limit HEAD requests */
#define CUPSD_AUTH_LIMIT_OPTIONS 8	/* Limit OPTIONS requests */
#define CUPSD_AUTH_LIMIT_POST	16	/* Limit POST requests */
#define CUPSD_AUTH_LIMIT_PUT	32	/* Limit PUT requests */
#define CUPSD_AUTH_LIMIT_TRACE	64	/* Limit TRACE requests */
#define CUPSD_AUTH_LIMIT_ALL	127	/* Limit all requests */
#define CUPSD_AUTH_LIMIT_IPP	128	/* Limit IPP requests */

#define IPP_ANY_OPERATION	(ipp_op_t)0
					/* Any IPP operation */
#define IPP_BAD_OPERATION	(ipp_op_t)-1
					/* No IPP operation */


/*
 * HTTP access control structures...
 */

typedef struct
{
  unsigned	address[4],		/* IP address */
		netmask[4];		/* IP netmask */
} cupsd_ipmask_t;

typedef struct
{
  size_t	length;			/* Length of name */
  char		*name;			/* Name string */
} cupsd_namemask_t;

typedef struct
{
  int		type;			/* Mask type */
  union
  {
    cupsd_namemask_t	name;		/* Host/Domain name */
    cupsd_ipmask_t	ip;		/* IP address/network */
  }		mask;			/* Mask data */
} cupsd_authmask_t;

typedef struct
{
  char			*location;	/* Location of resource */
  size_t		length;		/* Length of location string */
  ipp_op_t		op;		/* IPP operation */
  int			limit,		/* Limit for these types of requests */
			order_type,	/* Allow or Deny */
			type,		/* Type of authentication */
			level,		/* Access level required */
			satisfy;	/* Satisfy any or all limits? */
  cups_array_t		*names,		/* User or group names */
			*allow,		/* Allow lines */
			*deny;		/* Deny lines */
  http_encryption_t	encryption;	/* To encrypt or not to encrypt... */
} cupsd_location_t;

typedef struct cupsd_client_s cupsd_client_t;


/*
 * Globals...
 */

VAR cups_array_t	*Locations	VALUE(NULL);
					/* Authorization locations */
#ifdef HAVE_SSL
VAR http_encryption_t	DefaultEncryption VALUE(HTTP_ENCRYPT_REQUIRED);
					/* Default encryption for authentication */
#endif /* HAVE_SSL */


/*
 * Prototypes...
 */

extern int		cupsdAddIPMask(cups_array_t **masks,
				       const unsigned address[4],
				       const unsigned netmask[4]);
extern void		cupsdAddLocation(cupsd_location_t *loc);
extern void		cupsdAddName(cupsd_location_t *loc, char *name);
extern int		cupsdAddNameMask(cups_array_t **masks, char *name);
extern void		cupsdAuthorize(cupsd_client_t *con);
extern int		cupsdCheckAccess(unsigned ip[4], const char *name, size_t namelen, cupsd_location_t *loc);
extern int		cupsdCheckAuth(unsigned ip[4], const char *name, size_t namelen, cups_array_t *masks);
extern int		cupsdCheckGroup(const char *username,
			                struct passwd *user,
			                const char *groupname);
extern cupsd_location_t	*cupsdCopyLocation(cupsd_location_t *loc);
extern void		cupsdDeleteAllLocations(void);
extern cupsd_location_t	*cupsdFindBest(const char *path, http_state_t state);
extern cupsd_location_t	*cupsdFindLocation(const char *location);
extern void		cupsdFreeLocation(cupsd_location_t *loc);
extern http_status_t	cupsdIsAuthorized(cupsd_client_t *con, const char *owner);
extern cupsd_location_t	*cupsdNewLocation(const char *location);
Commit	Line	Data
ef416fc2	1	/*
5ec1fd3d	2	* Authorization definitions for the CUPS scheduler.
ef416fc2	3	*
7e86f2f6	4	* Copyright 2007-2014 by Apple Inc.
5ec1fd3d	5	* Copyright 1997-2006 by Easy Software Products, all rights reserved.
ef416fc2	6	*
5ec1fd3d MS	7	* These coded instructions, statements, and computer programs are the
	8	* property of Apple Inc. and are protected by Federal copyright
	9	* law. Distribution and use rights are outlined in the file "LICENSE.txt"
	10	* which should have been included with this file. If this file is
57b7b66b	11	* missing or damaged, see the license at "http://www.cups.org/".
ef416fc2	12	*/
	13
	14	/*
	15	* Include necessary headers...
	16	*/
	17
	18	#include <pwd.h>
	19
	20
	21	/*
	22	* HTTP authorization types and levels...
	23	*/
	24
5bd77a73 MS	25	#define CUPSD_AUTH_DEFAULT -1 /* Use DefaultAuthType */
	26	#define CUPSD_AUTH_NONE 0 /* No authentication */
	27	#define CUPSD_AUTH_BASIC 1 /* Basic authentication */
e0660879 MS	28	#define CUPSD_AUTH_NEGOTIATE 2 /* Kerberos authentication */
e0660879 MS	29	#define CUPSD_AUTH_AUTO 3 /* Kerberos or Basic, depending on configuration of server */
5bd77a73 MS	30
	31	#define CUPSD_AUTH_ANON 0 /* Anonymous access */
	32	#define CUPSD_AUTH_USER 1 /* Must have a valid username/password */
	33	#define CUPSD_AUTH_GROUP 2 /* Must also be in a named group */
	34
	35	#define CUPSD_AUTH_ALLOW 0 /* Allow access */
	36	#define CUPSD_AUTH_DENY 1 /* Deny access */
	37
	38	#define CUPSD_AUTH_NAME 0 /* Authorize host by name */
	39	#define CUPSD_AUTH_IP 1 /* Authorize host by IP */
	40	#define CUPSD_AUTH_INTERFACE 2 /* Authorize host by interface */
	41
	42	#define CUPSD_AUTH_SATISFY_ALL 0 /* Satisfy both address and auth */
	43	#define CUPSD_AUTH_SATISFY_ANY 1 /* Satisfy either address or auth */
	44
	45	#define CUPSD_AUTH_LIMIT_DELETE 1 /* Limit DELETE requests */
	46	#define CUPSD_AUTH_LIMIT_GET 2 /* Limit GET requests */
	47	#define CUPSD_AUTH_LIMIT_HEAD 4 /* Limit HEAD requests */
	48	#define CUPSD_AUTH_LIMIT_OPTIONS 8 /* Limit OPTIONS requests */
	49	#define CUPSD_AUTH_LIMIT_POST 16 /* Limit POST requests */
	50	#define CUPSD_AUTH_LIMIT_PUT 32 /* Limit PUT requests */
	51	#define CUPSD_AUTH_LIMIT_TRACE 64 /* Limit TRACE requests */
	52	#define CUPSD_AUTH_LIMIT_ALL 127 /* Limit all requests */
	53	#define CUPSD_AUTH_LIMIT_IPP 128 /* Limit IPP requests */
ef416fc2	54
	55	#define IPP_ANY_OPERATION (ipp_op_t)0
	56	/* Any IPP operation */
	57	#define IPP_BAD_OPERATION (ipp_op_t)-1
	58	/* No IPP operation */
	59
	60
	61	/*
	62	* HTTP access control structures...
	63	*/
	64
	65	typedef struct
	66	{
	67	unsigned address[4], /* IP address */
	68	netmask[4]; /* IP netmask */
	69	} cupsd_ipmask_t;
	70
	71	typedef struct
	72	{
7e86f2f6	73	size_t length; /* Length of name */
ef416fc2	74	char name; / Name string */
	75	} cupsd_namemask_t;
	76
	77	typedef struct
	78	{
	79	int type; /* Mask type */
	80	union
	81	{
	82	cupsd_namemask_t name; /* Host/Domain name */
	83	cupsd_ipmask_t ip; /* IP address/network */
	84	} mask; /* Mask data */
	85	} cupsd_authmask_t;
	86
	87	typedef struct
	88	{
bd7854cb	89	char location; / Location of resource */
7e86f2f6	90	size_t length; /* Length of location string */
ef416fc2	91	ipp_op_t op; /* IPP operation */
ef416fc2	92	int limit, /* Limit for these types of requests */
ef416fc2	93	order_type, /* Allow or Deny */
	94	type, /* Type of authentication */
	95	level, /* Access level required */
	96	satisfy; /* Satisfy any or all limits? */
10d09e33 MS	97	cups_array_t names, / User or group names */
	98	allow, / Allow lines */
	99	deny; / Deny lines */
ef416fc2	100	http_encryption_t encryption; /* To encrypt or not to encrypt... */
	101	} cupsd_location_t;
	102
	103	typedef struct cupsd_client_s cupsd_client_t;
	104
	105
	106	/*
	107	* Globals...
	108	*/
	109
bd7854cb	110	VAR cups_array_t *Locations VALUE(NULL);
ef416fc2	111	/* Authorization locations */
4744bd90	112	#ifdef HAVE_SSL
	113	VAR http_encryption_t DefaultEncryption VALUE(HTTP_ENCRYPT_REQUIRED);
	114	/* Default encryption for authentication */
	115	#endif /* HAVE_SSL */
ef416fc2	116
	117
	118	/*
	119	* Prototypes...
	120	*/
	121
10d09e33 MS	122	extern int cupsdAddIPMask(cups_array_t **masks,
	123	const unsigned address[4],
	124	const unsigned netmask[4]);
	125	extern void cupsdAddLocation(cupsd_location_t *loc);
ef416fc2	126	extern void cupsdAddName(cupsd_location_t loc, char name);
10d09e33	127	extern int cupsdAddNameMask(cups_array_t *masks, char name);
ef416fc2	128	extern void cupsdAuthorize(cupsd_client_t *con);
7e86f2f6 MS	129	extern int cupsdCheckAccess(unsigned ip[4], const char name, size_t namelen, cupsd_location_t loc);
7e86f2f6 MS	130	extern int cupsdCheckAuth(unsigned ip[4], const char name, size_t namelen, cups_array_t masks);
ef416fc2	131	extern int cupsdCheckGroup(const char *username,
	132	struct passwd *user,
	133	const char *groupname);
10d09e33	134	extern cupsd_location_t cupsdCopyLocation(cupsd_location_t loc);
ef416fc2	135	extern void cupsdDeleteAllLocations(void);
ef416fc2	136	extern cupsd_location_t cupsdFindBest(const char path, http_state_t state);
ef416fc2	137	extern cupsd_location_t cupsdFindLocation(const char location);
10d09e33	138	extern void cupsdFreeLocation(cupsd_location_t *loc);
ef416fc2	139	extern http_status_t cupsdIsAuthorized(cupsd_client_t con, const char owner);
10d09e33	140	extern cupsd_location_t cupsdNewLocation(const char location);