]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * Authentication functions for CUPS. | |
3 | * | |
4 | * Copyright 2007-2016 by Apple Inc. | |
5 | * Copyright 1997-2007 by Easy Software Products. | |
6 | * | |
7 | * This file contains Kerberos support code, copyright 2006 by | |
8 | * Jelmer Vernooij. | |
9 | * | |
10 | * These coded instructions, statements, and computer programs are the | |
11 | * property of Apple Inc. and are protected by Federal copyright | |
12 | * law. Distribution and use rights are outlined in the file "LICENSE.txt" | |
13 | * which should have been included with this file. If this file is | |
14 | * missing or damaged, see the license at "http://www.cups.org/". | |
15 | * | |
16 | * This file is subject to the Apple OS-Developed Software exception. | |
17 | */ | |
18 | ||
19 | /* | |
20 | * Include necessary headers... | |
21 | */ | |
22 | ||
23 | #include "cups-private.h" | |
24 | #include <fcntl.h> | |
25 | #include <sys/stat.h> | |
26 | #if defined(WIN32) || defined(__EMX__) | |
27 | # include <io.h> | |
28 | #else | |
29 | # include <unistd.h> | |
30 | #endif /* WIN32 || __EMX__ */ | |
31 | ||
32 | #if HAVE_AUTHORIZATION_H | |
33 | # include <Security/Authorization.h> | |
34 | # ifdef HAVE_SECBASEPRIV_H | |
35 | # include <Security/SecBasePriv.h> | |
36 | # else | |
37 | extern const char *cssmErrorString(int error); | |
38 | # endif /* HAVE_SECBASEPRIV_H */ | |
39 | #endif /* HAVE_AUTHORIZATION_H */ | |
40 | ||
41 | #if defined(SO_PEERCRED) && defined(AF_LOCAL) | |
42 | # include <pwd.h> | |
43 | #endif /* SO_PEERCRED && AF_LOCAL */ | |
44 | ||
45 | ||
46 | /* | |
47 | * Local functions... | |
48 | */ | |
49 | ||
50 | #ifdef HAVE_GSSAPI | |
51 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F | |
52 | # ifdef HAVE_GSS_GSSAPI_SPI_H | |
53 | # include <GSS/gssapi_spi.h> | |
54 | # else | |
55 | # define GSS_AUTH_IDENTITY_TYPE_1 1 | |
56 | # define gss_acquire_cred_ex_f __ApplePrivate_gss_acquire_cred_ex_f | |
57 | typedef struct gss_auth_identity | |
58 | { | |
59 | uint32_t type; | |
60 | uint32_t flags; | |
61 | char *username; | |
62 | char *realm; | |
63 | char *password; | |
64 | gss_buffer_t *credentialsRef; | |
65 | } gss_auth_identity_desc; | |
66 | extern OM_uint32 gss_acquire_cred_ex_f(gss_status_id_t, const gss_name_t, | |
67 | OM_uint32, OM_uint32, const gss_OID, | |
68 | gss_cred_usage_t, gss_auth_identity_t, | |
69 | void *, void (*)(void *, OM_uint32, | |
70 | gss_status_id_t, | |
71 | gss_cred_id_t, | |
72 | gss_OID_set, | |
73 | OM_uint32)); | |
74 | # endif /* HAVE_GSS_GSSAPI_SPI_H */ | |
75 | # include <dispatch/dispatch.h> | |
76 | typedef struct _cups_gss_acquire_s /* Acquire callback data */ | |
77 | { | |
78 | dispatch_semaphore_t sem; /* Synchronization semaphore */ | |
79 | OM_uint32 major; /* Returned status code */ | |
80 | gss_cred_id_t creds; /* Returned credentials */ | |
81 | } _cups_gss_acquire_t; | |
82 | ||
83 | static void cups_gss_acquire(void *ctx, OM_uint32 major, | |
84 | gss_status_id_t status, | |
85 | gss_cred_id_t creds, gss_OID_set oids, | |
86 | OM_uint32 time_rec); | |
87 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
88 | static gss_name_t cups_gss_getname(http_t *http, const char *service_name); | |
89 | # ifdef DEBUG | |
90 | static void cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status, | |
91 | const char *message); | |
92 | # else | |
93 | # define cups_gss_printf(major, minor, message) | |
94 | # endif /* DEBUG */ | |
95 | #endif /* HAVE_GSSAPI */ | |
96 | static int cups_local_auth(http_t *http); | |
97 | ||
98 | ||
99 | /* | |
100 | * 'cupsDoAuthentication()' - Authenticate a request. | |
101 | * | |
102 | * This function should be called in response to a @code HTTP_STATUS_UNAUTHORIZED@ | |
103 | * status, prior to resubmitting your request. | |
104 | * | |
105 | * @since CUPS 1.1.20/macOS 10.4@ | |
106 | */ | |
107 | ||
108 | int /* O - 0 on success, -1 on error */ | |
109 | cupsDoAuthentication( | |
110 | http_t *http, /* I - Connection to server or @code CUPS_HTTP_DEFAULT@ */ | |
111 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
112 | const char *resource) /* I - Resource path */ | |
113 | { | |
114 | const char *password, /* Password string */ | |
115 | *www_auth; /* WWW-Authenticate header */ | |
116 | char prompt[1024], /* Prompt for user */ | |
117 | realm[HTTP_MAX_VALUE], /* realm="xyz" string */ | |
118 | nonce[HTTP_MAX_VALUE]; /* nonce="xyz" string */ | |
119 | int localauth; /* Local authentication result */ | |
120 | _cups_globals_t *cg; /* Global data */ | |
121 | ||
122 | ||
123 | DEBUG_printf(("cupsDoAuthentication(http=%p, method=\"%s\", resource=\"%s\")", (void *)http, method, resource)); | |
124 | ||
125 | if (!http) | |
126 | http = _cupsConnect(); | |
127 | ||
128 | if (!http || !method || !resource) | |
129 | return (-1); | |
130 | ||
131 | DEBUG_printf(("2cupsDoAuthentication: digest_tries=%d, userpass=\"%s\"", | |
132 | http->digest_tries, http->userpass)); | |
133 | DEBUG_printf(("2cupsDoAuthentication: WWW-Authenticate=\"%s\"", | |
134 | httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE))); | |
135 | ||
136 | /* | |
137 | * Clear the current authentication string... | |
138 | */ | |
139 | ||
140 | httpSetAuthString(http, NULL, NULL); | |
141 | ||
142 | /* | |
143 | * See if we can do local authentication... | |
144 | */ | |
145 | ||
146 | if (http->digest_tries < 3) | |
147 | { | |
148 | if ((localauth = cups_local_auth(http)) == 0) | |
149 | { | |
150 | DEBUG_printf(("2cupsDoAuthentication: authstring=\"%s\"", | |
151 | http->authstring)); | |
152 | ||
153 | if (http->status == HTTP_STATUS_UNAUTHORIZED) | |
154 | http->digest_tries ++; | |
155 | ||
156 | return (0); | |
157 | } | |
158 | else if (localauth == -1) | |
159 | { | |
160 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
161 | return (-1); /* Error or canceled */ | |
162 | } | |
163 | } | |
164 | ||
165 | /* | |
166 | * Nope, see if we should retry the current username:password... | |
167 | */ | |
168 | ||
169 | www_auth = http->fields[HTTP_FIELD_WWW_AUTHENTICATE]; | |
170 | ||
171 | if ((http->digest_tries > 1 || !http->userpass[0]) && | |
172 | (!_cups_strncasecmp(www_auth, "Basic", 5) || | |
173 | !_cups_strncasecmp(www_auth, "Digest", 6))) | |
174 | { | |
175 | /* | |
176 | * Nope - get a new password from the user... | |
177 | */ | |
178 | ||
179 | char default_username[HTTP_MAX_VALUE]; | |
180 | /* Default username */ | |
181 | ||
182 | cg = _cupsGlobals(); | |
183 | ||
184 | if (!cg->lang_default) | |
185 | cg->lang_default = cupsLangDefault(); | |
186 | ||
187 | if (httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "username", | |
188 | default_username)) | |
189 | cupsSetUser(default_username); | |
190 | ||
191 | snprintf(prompt, sizeof(prompt), | |
192 | _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), | |
193 | cupsUser(), | |
194 | http->hostname[0] == '/' ? "localhost" : http->hostname); | |
195 | ||
196 | http->digest_tries = _cups_strncasecmp(www_auth, "Digest", 6) != 0; | |
197 | http->userpass[0] = '\0'; | |
198 | ||
199 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) | |
200 | { | |
201 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
202 | return (-1); | |
203 | } | |
204 | ||
205 | snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), | |
206 | password); | |
207 | } | |
208 | else if (http->status == HTTP_STATUS_UNAUTHORIZED) | |
209 | http->digest_tries ++; | |
210 | ||
211 | if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3) | |
212 | { | |
213 | DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", | |
214 | http->digest_tries)); | |
215 | ||
216 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
217 | return (-1); | |
218 | } | |
219 | ||
220 | /* | |
221 | * Got a password; encode it for the server... | |
222 | */ | |
223 | ||
224 | #ifdef HAVE_GSSAPI | |
225 | if (!_cups_strncasecmp(www_auth, "Negotiate", 9)) | |
226 | { | |
227 | /* | |
228 | * Kerberos authentication... | |
229 | */ | |
230 | ||
231 | if (_cupsSetNegotiateAuthString(http, method, resource)) | |
232 | { | |
233 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
234 | return (-1); | |
235 | } | |
236 | } | |
237 | else | |
238 | #endif /* HAVE_GSSAPI */ | |
239 | if (!_cups_strncasecmp(www_auth, "Basic", 5)) | |
240 | { | |
241 | /* | |
242 | * Basic authentication... | |
243 | */ | |
244 | ||
245 | char encode[256]; /* Base64 buffer */ | |
246 | ||
247 | ||
248 | httpEncode64_2(encode, sizeof(encode), http->userpass, | |
249 | (int)strlen(http->userpass)); | |
250 | httpSetAuthString(http, "Basic", encode); | |
251 | } | |
252 | else if (!_cups_strncasecmp(www_auth, "Digest", 6)) | |
253 | { | |
254 | /* | |
255 | * Digest authentication... | |
256 | */ | |
257 | ||
258 | char encode[33], /* MD5 buffer */ | |
259 | digest[1024]; /* Digest auth data */ | |
260 | ||
261 | httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "realm", realm); | |
262 | httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "nonce", nonce); | |
263 | ||
264 | httpMD5(cupsUser(), realm, strchr(http->userpass, ':') + 1, encode); | |
265 | httpMD5Final(nonce, method, resource, encode); | |
266 | snprintf(digest, sizeof(digest), | |
267 | "username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", " | |
268 | "response=\"%s\"", cupsUser(), realm, nonce, resource, encode); | |
269 | httpSetAuthString(http, "Digest", digest); | |
270 | } | |
271 | else | |
272 | { | |
273 | DEBUG_printf(("1cupsDoAuthentication: Unknown auth type: \"%s\"", | |
274 | www_auth)); | |
275 | http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; | |
276 | return (-1); | |
277 | } | |
278 | ||
279 | DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\"", http->authstring)); | |
280 | ||
281 | return (0); | |
282 | } | |
283 | ||
284 | ||
285 | #ifdef HAVE_GSSAPI | |
286 | /* | |
287 | * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string. | |
288 | */ | |
289 | ||
290 | int /* O - 0 on success, -1 on error */ | |
291 | _cupsSetNegotiateAuthString( | |
292 | http_t *http, /* I - Connection to server */ | |
293 | const char *method, /* I - Request method ("GET", "POST", "PUT") */ | |
294 | const char *resource) /* I - Resource path */ | |
295 | { | |
296 | OM_uint32 minor_status, /* Minor status code */ | |
297 | major_status; /* Major status code */ | |
298 | gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; | |
299 | /* Output token */ | |
300 | ||
301 | ||
302 | (void)method; | |
303 | (void)resource; | |
304 | ||
305 | # ifdef __APPLE__ | |
306 | /* | |
307 | * If the weak-linked GSSAPI/Kerberos library is not present, don't try | |
308 | * to use it... | |
309 | */ | |
310 | ||
311 | if (&gss_init_sec_context == NULL) | |
312 | { | |
313 | DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos " | |
314 | "framework is not present"); | |
315 | return (-1); | |
316 | } | |
317 | # endif /* __APPLE__ */ | |
318 | ||
319 | if (http->gssname == GSS_C_NO_NAME) | |
320 | { | |
321 | http->gssname = cups_gss_getname(http, _cupsGSSServiceName()); | |
322 | } | |
323 | ||
324 | if (http->gssctx != GSS_C_NO_CONTEXT) | |
325 | { | |
326 | gss_delete_sec_context(&minor_status, &http->gssctx, GSS_C_NO_BUFFER); | |
327 | http->gssctx = GSS_C_NO_CONTEXT; | |
328 | } | |
329 | ||
330 | major_status = gss_init_sec_context(&minor_status, GSS_C_NO_CREDENTIAL, | |
331 | &http->gssctx, | |
332 | http->gssname, http->gssmech, | |
333 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
334 | GSS_C_INDEFINITE, | |
335 | GSS_C_NO_CHANNEL_BINDINGS, | |
336 | GSS_C_NO_BUFFER, &http->gssmech, | |
337 | &output_token, NULL, NULL); | |
338 | ||
339 | #ifdef HAVE_GSS_ACQUIRE_CRED_EX_F | |
340 | if (major_status == GSS_S_NO_CRED) | |
341 | { | |
342 | /* | |
343 | * Ask the user for credentials... | |
344 | */ | |
345 | ||
346 | char prompt[1024], /* Prompt for user */ | |
347 | userbuf[256]; /* Kerberos username */ | |
348 | const char *username, /* Username string */ | |
349 | *password; /* Password string */ | |
350 | _cups_gss_acquire_t data; /* Callback data */ | |
351 | gss_auth_identity_desc identity; /* Kerberos user identity */ | |
352 | _cups_globals_t *cg = _cupsGlobals(); | |
353 | /* Per-thread global data */ | |
354 | ||
355 | if (!cg->lang_default) | |
356 | cg->lang_default = cupsLangDefault(); | |
357 | ||
358 | snprintf(prompt, sizeof(prompt), | |
359 | _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), | |
360 | cupsUser(), http->gsshost); | |
361 | ||
362 | if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) | |
363 | return (-1); | |
364 | ||
365 | /* | |
366 | * Try to acquire credentials... | |
367 | */ | |
368 | ||
369 | username = cupsUser(); | |
370 | if (!strchr(username, '@')) | |
371 | { | |
372 | snprintf(userbuf, sizeof(userbuf), "%s@%s", username, http->gsshost); | |
373 | username = userbuf; | |
374 | } | |
375 | ||
376 | identity.type = GSS_AUTH_IDENTITY_TYPE_1; | |
377 | identity.flags = 0; | |
378 | identity.username = (char *)username; | |
379 | identity.realm = (char *)""; | |
380 | identity.password = (char *)password; | |
381 | identity.credentialsRef = NULL; | |
382 | ||
383 | data.sem = dispatch_semaphore_create(0); | |
384 | data.major = 0; | |
385 | data.creds = NULL; | |
386 | ||
387 | if (data.sem) | |
388 | { | |
389 | major_status = gss_acquire_cred_ex_f(NULL, GSS_C_NO_NAME, 0, GSS_C_INDEFINITE, GSS_KRB5_MECHANISM, GSS_C_INITIATE, (gss_auth_identity_t)&identity, &data, cups_gss_acquire); | |
390 | ||
391 | if (major_status == GSS_S_COMPLETE) | |
392 | { | |
393 | dispatch_semaphore_wait(data.sem, DISPATCH_TIME_FOREVER); | |
394 | major_status = data.major; | |
395 | } | |
396 | ||
397 | dispatch_release(data.sem); | |
398 | ||
399 | if (major_status == GSS_S_COMPLETE) | |
400 | { | |
401 | OM_uint32 release_minor; /* Minor status from releasing creds */ | |
402 | ||
403 | major_status = gss_init_sec_context(&minor_status, data.creds, | |
404 | &http->gssctx, | |
405 | http->gssname, http->gssmech, | |
406 | GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, | |
407 | GSS_C_INDEFINITE, | |
408 | GSS_C_NO_CHANNEL_BINDINGS, | |
409 | GSS_C_NO_BUFFER, &http->gssmech, | |
410 | &output_token, NULL, NULL); | |
411 | gss_release_cred(&release_minor, &data.creds); | |
412 | } | |
413 | } | |
414 | } | |
415 | #endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */ | |
416 | ||
417 | if (GSS_ERROR(major_status)) | |
418 | { | |
419 | cups_gss_printf(major_status, minor_status, | |
420 | "_cupsSetNegotiateAuthString: Unable to initialize " | |
421 | "security context"); | |
422 | return (-1); | |
423 | } | |
424 | ||
425 | #ifdef DEBUG | |
426 | else if (major_status == GSS_S_CONTINUE_NEEDED) | |
427 | cups_gss_printf(major_status, minor_status, | |
428 | "_cupsSetNegotiateAuthString: Continuation needed!"); | |
429 | #endif /* DEBUG */ | |
430 | ||
431 | if (output_token.length > 0 && output_token.length <= 65536) | |
432 | { | |
433 | /* | |
434 | * Allocate the authorization string since Windows KDCs can have | |
435 | * arbitrarily large credentials... | |
436 | */ | |
437 | ||
438 | int authsize = 10 + /* "Negotiate " */ | |
439 | (int)output_token.length * 4 / 3 + 1 + 1; | |
440 | /* Base64 + nul */ | |
441 | ||
442 | httpSetAuthString(http, NULL, NULL); | |
443 | ||
444 | if ((http->authstring = malloc((size_t)authsize)) == NULL) | |
445 | { | |
446 | http->authstring = http->_authstring; | |
447 | authsize = sizeof(http->_authstring); | |
448 | } | |
449 | ||
450 | strlcpy(http->authstring, "Negotiate ", (size_t)authsize); | |
451 | httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value, | |
452 | (int)output_token.length); | |
453 | ||
454 | gss_release_buffer(&minor_status, &output_token); | |
455 | } | |
456 | else | |
457 | { | |
458 | DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos credentials too " | |
459 | "large - %d bytes!", (int)output_token.length)); | |
460 | gss_release_buffer(&minor_status, &output_token); | |
461 | ||
462 | return (-1); | |
463 | } | |
464 | ||
465 | return (0); | |
466 | } | |
467 | ||
468 | ||
469 | # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F | |
470 | /* | |
471 | * 'cups_gss_acquire()' - Kerberos credentials callback. | |
472 | */ | |
473 | static void | |
474 | cups_gss_acquire( | |
475 | void *ctx, /* I - Caller context */ | |
476 | OM_uint32 major, /* I - Major error code */ | |
477 | gss_status_id_t status, /* I - Status (unused) */ | |
478 | gss_cred_id_t creds, /* I - Credentials (if any) */ | |
479 | gss_OID_set oids, /* I - Mechanism OIDs (unused) */ | |
480 | OM_uint32 time_rec) /* I - Timestamp (unused) */ | |
481 | { | |
482 | uint32_t min; /* Minor error code */ | |
483 | _cups_gss_acquire_t *data; /* Callback data */ | |
484 | ||
485 | ||
486 | (void)status; | |
487 | (void)time_rec; | |
488 | ||
489 | data = (_cups_gss_acquire_t *)ctx; | |
490 | data->major = major; | |
491 | data->creds = creds; | |
492 | ||
493 | gss_release_oid_set(&min, &oids); | |
494 | dispatch_semaphore_signal(data->sem); | |
495 | } | |
496 | # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ | |
497 | ||
498 | ||
499 | /* | |
500 | * 'cups_gss_getname()' - Get CUPS service credentials for authentication. | |
501 | */ | |
502 | ||
503 | static gss_name_t /* O - Server name */ | |
504 | cups_gss_getname( | |
505 | http_t *http, /* I - Connection to server */ | |
506 | const char *service_name) /* I - Service name */ | |
507 | { | |
508 | gss_buffer_desc token = GSS_C_EMPTY_BUFFER; | |
509 | /* Service token */ | |
510 | OM_uint32 major_status, /* Major status code */ | |
511 | minor_status; /* Minor status code */ | |
512 | gss_name_t server_name; /* Server name */ | |
513 | char buf[1024]; /* Name buffer */ | |
514 | ||
515 | ||
516 | DEBUG_printf(("7cups_gss_getname(http=%p, service_name=\"%s\")", http, | |
517 | service_name)); | |
518 | ||
519 | ||
520 | /* | |
521 | * Get the hostname... | |
522 | */ | |
523 | ||
524 | if (!http->gsshost[0]) | |
525 | { | |
526 | httpGetHostname(http, http->gsshost, sizeof(http->gsshost)); | |
527 | ||
528 | if (!strcmp(http->gsshost, "localhost")) | |
529 | { | |
530 | if (gethostname(http->gsshost, sizeof(http->gsshost)) < 0) | |
531 | { | |
532 | DEBUG_printf(("1cups_gss_getname: gethostname() failed: %s", | |
533 | strerror(errno))); | |
534 | http->gsshost[0] = '\0'; | |
535 | return (NULL); | |
536 | } | |
537 | ||
538 | if (!strchr(http->gsshost, '.')) | |
539 | { | |
540 | /* | |
541 | * The hostname is not a FQDN, so look it up... | |
542 | */ | |
543 | ||
544 | struct hostent *host; /* Host entry to get FQDN */ | |
545 | ||
546 | if ((host = gethostbyname(http->gsshost)) != NULL && host->h_name) | |
547 | { | |
548 | /* | |
549 | * Use the resolved hostname... | |
550 | */ | |
551 | ||
552 | strlcpy(http->gsshost, host->h_name, sizeof(http->gsshost)); | |
553 | } | |
554 | else | |
555 | { | |
556 | DEBUG_printf(("1cups_gss_getname: gethostbyname(\"%s\") failed.", | |
557 | http->gsshost)); | |
558 | http->gsshost[0] = '\0'; | |
559 | return (NULL); | |
560 | } | |
561 | } | |
562 | } | |
563 | } | |
564 | ||
565 | /* | |
566 | * Get a service name we can use for authentication purposes... | |
567 | */ | |
568 | ||
569 | snprintf(buf, sizeof(buf), "%s@%s", service_name, http->gsshost); | |
570 | ||
571 | DEBUG_printf(("8cups_gss_getname: Looking up \"%s\".", buf)); | |
572 | ||
573 | token.value = buf; | |
574 | token.length = strlen(buf); | |
575 | server_name = GSS_C_NO_NAME; | |
576 | major_status = gss_import_name(&minor_status, &token, | |
577 | GSS_C_NT_HOSTBASED_SERVICE, | |
578 | &server_name); | |
579 | ||
580 | if (GSS_ERROR(major_status)) | |
581 | { | |
582 | cups_gss_printf(major_status, minor_status, | |
583 | "cups_gss_getname: gss_import_name() failed"); | |
584 | return (NULL); | |
585 | } | |
586 | ||
587 | return (server_name); | |
588 | } | |
589 | ||
590 | ||
591 | # ifdef DEBUG | |
592 | /* | |
593 | * 'cups_gss_printf()' - Show debug error messages from GSSAPI. | |
594 | */ | |
595 | ||
596 | static void | |
597 | cups_gss_printf(OM_uint32 major_status,/* I - Major status code */ | |
598 | OM_uint32 minor_status,/* I - Minor status code */ | |
599 | const char *message) /* I - Prefix for error message */ | |
600 | { | |
601 | OM_uint32 err_major_status, /* Major status code for display */ | |
602 | err_minor_status; /* Minor status code for display */ | |
603 | OM_uint32 msg_ctx; /* Message context */ | |
604 | gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER, | |
605 | /* Major status message */ | |
606 | minor_status_string = GSS_C_EMPTY_BUFFER; | |
607 | /* Minor status message */ | |
608 | ||
609 | ||
610 | msg_ctx = 0; | |
611 | err_major_status = gss_display_status(&err_minor_status, | |
612 | major_status, | |
613 | GSS_C_GSS_CODE, | |
614 | GSS_C_NO_OID, | |
615 | &msg_ctx, | |
616 | &major_status_string); | |
617 | ||
618 | if (!GSS_ERROR(err_major_status)) | |
619 | gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE, | |
620 | GSS_C_NULL_OID, &msg_ctx, &minor_status_string); | |
621 | ||
622 | DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value, | |
623 | (char *)minor_status_string.value)); | |
624 | ||
625 | gss_release_buffer(&err_minor_status, &major_status_string); | |
626 | gss_release_buffer(&err_minor_status, &minor_status_string); | |
627 | } | |
628 | # endif /* DEBUG */ | |
629 | #endif /* HAVE_GSSAPI */ | |
630 | ||
631 | ||
632 | /* | |
633 | * 'cups_local_auth()' - Get the local authorization certificate if | |
634 | * available/applicable. | |
635 | */ | |
636 | ||
637 | static int /* O - 0 if available */ | |
638 | /* 1 if not available */ | |
639 | /* -1 error */ | |
640 | cups_local_auth(http_t *http) /* I - HTTP connection to server */ | |
641 | { | |
642 | #if defined(WIN32) || defined(__EMX__) | |
643 | /* | |
644 | * Currently WIN32 and OS-2 do not support the CUPS server... | |
645 | */ | |
646 | ||
647 | return (1); | |
648 | #else | |
649 | int pid; /* Current process ID */ | |
650 | FILE *fp; /* Certificate file */ | |
651 | char trc[16], /* Try Root Certificate parameter */ | |
652 | filename[1024]; /* Certificate filename */ | |
653 | _cups_globals_t *cg = _cupsGlobals(); /* Global data */ | |
654 | # if defined(HAVE_AUTHORIZATION_H) | |
655 | OSStatus status; /* Status */ | |
656 | AuthorizationItem auth_right; /* Authorization right */ | |
657 | AuthorizationRights auth_rights; /* Authorization rights */ | |
658 | AuthorizationFlags auth_flags; /* Authorization flags */ | |
659 | AuthorizationExternalForm auth_extrn; /* Authorization ref external */ | |
660 | char auth_key[1024]; /* Buffer */ | |
661 | char buffer[1024]; /* Buffer */ | |
662 | # endif /* HAVE_AUTHORIZATION_H */ | |
663 | ||
664 | ||
665 | DEBUG_printf(("7cups_local_auth(http=%p) hostaddr=%s, hostname=\"%s\"", (void *)http, httpAddrString(http->hostaddr, filename, sizeof(filename)), http->hostname)); | |
666 | ||
667 | /* | |
668 | * See if we are accessing localhost... | |
669 | */ | |
670 | ||
671 | if (!httpAddrLocalhost(http->hostaddr) && | |
672 | _cups_strcasecmp(http->hostname, "localhost") != 0) | |
673 | { | |
674 | DEBUG_puts("8cups_local_auth: Not a local connection!"); | |
675 | return (1); | |
676 | } | |
677 | ||
678 | # if defined(HAVE_AUTHORIZATION_H) | |
679 | /* | |
680 | * Delete any previous authorization reference... | |
681 | */ | |
682 | ||
683 | if (http->auth_ref) | |
684 | { | |
685 | AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults); | |
686 | http->auth_ref = NULL; | |
687 | } | |
688 | ||
689 | if (!getenv("GATEWAY_INTERFACE") && | |
690 | httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", | |
691 | auth_key, sizeof(auth_key))) | |
692 | { | |
693 | status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, | |
694 | kAuthorizationFlagDefaults, &http->auth_ref); | |
695 | if (status != errAuthorizationSuccess) | |
696 | { | |
697 | DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d (%s)", | |
698 | (int)status, cssmErrorString(status))); | |
699 | return (-1); | |
700 | } | |
701 | ||
702 | auth_right.name = auth_key; | |
703 | auth_right.valueLength = 0; | |
704 | auth_right.value = NULL; | |
705 | auth_right.flags = 0; | |
706 | ||
707 | auth_rights.count = 1; | |
708 | auth_rights.items = &auth_right; | |
709 | ||
710 | auth_flags = kAuthorizationFlagDefaults | | |
711 | kAuthorizationFlagPreAuthorize | | |
712 | kAuthorizationFlagInteractionAllowed | | |
713 | kAuthorizationFlagExtendRights; | |
714 | ||
715 | status = AuthorizationCopyRights(http->auth_ref, &auth_rights, | |
716 | kAuthorizationEmptyEnvironment, | |
717 | auth_flags, NULL); | |
718 | if (status == errAuthorizationSuccess) | |
719 | status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn); | |
720 | ||
721 | if (status == errAuthorizationSuccess) | |
722 | { | |
723 | /* | |
724 | * Set the authorization string and return... | |
725 | */ | |
726 | ||
727 | httpEncode64_2(buffer, sizeof(buffer), (void *)&auth_extrn, | |
728 | sizeof(auth_extrn)); | |
729 | ||
730 | httpSetAuthString(http, "AuthRef", buffer); | |
731 | ||
732 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", | |
733 | http->authstring)); | |
734 | return (0); | |
735 | } | |
736 | else if (status == errAuthorizationCanceled) | |
737 | return (-1); | |
738 | ||
739 | DEBUG_printf(("9cups_local_auth: AuthorizationCopyRights() returned %d (%s)", | |
740 | (int)status, cssmErrorString(status))); | |
741 | ||
742 | /* | |
743 | * Fall through to try certificates... | |
744 | */ | |
745 | } | |
746 | # endif /* HAVE_AUTHORIZATION_H */ | |
747 | ||
748 | # if defined(SO_PEERCRED) && defined(AF_LOCAL) | |
749 | /* | |
750 | * See if we can authenticate using the peer credentials provided over a | |
751 | * domain socket; if so, specify "PeerCred username" as the authentication | |
752 | * information... | |
753 | */ | |
754 | ||
755 | if ( | |
756 | # ifdef HAVE_GSSAPI | |
757 | _cups_strncasecmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9) && | |
758 | # endif /* HAVE_GSSAPI */ | |
759 | # ifdef HAVE_AUTHORIZATION_H | |
760 | !httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", | |
761 | auth_key, sizeof(auth_key)) && | |
762 | # endif /* HAVE_AUTHORIZATION_H */ | |
763 | http->hostaddr->addr.sa_family == AF_LOCAL && | |
764 | !getenv("GATEWAY_INTERFACE")) /* Not via CGI programs... */ | |
765 | { | |
766 | /* | |
767 | * Verify that the current cupsUser() matches the current UID... | |
768 | */ | |
769 | ||
770 | struct passwd *pwd; /* Password information */ | |
771 | const char *username; /* Current username */ | |
772 | ||
773 | username = cupsUser(); | |
774 | ||
775 | if ((pwd = getpwnam(username)) != NULL && pwd->pw_uid == getuid()) | |
776 | { | |
777 | httpSetAuthString(http, "PeerCred", username); | |
778 | ||
779 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", | |
780 | http->authstring)); | |
781 | ||
782 | return (0); | |
783 | } | |
784 | } | |
785 | # endif /* SO_PEERCRED && AF_LOCAL */ | |
786 | ||
787 | /* | |
788 | * Try opening a certificate file for this PID. If that fails, | |
789 | * try the root certificate... | |
790 | */ | |
791 | ||
792 | pid = getpid(); | |
793 | snprintf(filename, sizeof(filename), "%s/certs/%d", cg->cups_statedir, pid); | |
794 | if ((fp = fopen(filename, "r")) == NULL && pid > 0) | |
795 | { | |
796 | /* | |
797 | * No certificate for this PID; see if we can get the root certificate... | |
798 | */ | |
799 | ||
800 | DEBUG_printf(("9cups_local_auth: Unable to open file %s: %s", | |
801 | filename, strerror(errno))); | |
802 | ||
803 | # ifdef HAVE_GSSAPI | |
804 | if (!_cups_strncasecmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9)) | |
805 | { | |
806 | /* | |
807 | * Kerberos required, don't try the root certificate... | |
808 | */ | |
809 | ||
810 | return (1); | |
811 | } | |
812 | # endif /* HAVE_GSSAPI */ | |
813 | ||
814 | # ifdef HAVE_AUTHORIZATION_H | |
815 | if (httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", | |
816 | auth_key, sizeof(auth_key))) | |
817 | { | |
818 | /* | |
819 | * Don't use the root certificate as a replacement for an authkey... | |
820 | */ | |
821 | ||
822 | return (1); | |
823 | } | |
824 | # endif /* HAVE_AUTHORIZATION_H */ | |
825 | if (!httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "trc", trc, | |
826 | sizeof(trc))) | |
827 | { | |
828 | /* | |
829 | * Scheduler doesn't want us to use the root certificate... | |
830 | */ | |
831 | ||
832 | return (1); | |
833 | } | |
834 | ||
835 | snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir); | |
836 | fp = fopen(filename, "r"); | |
837 | } | |
838 | ||
839 | if (fp) | |
840 | { | |
841 | /* | |
842 | * Read the certificate from the file... | |
843 | */ | |
844 | ||
845 | char certificate[33], /* Certificate string */ | |
846 | *certptr; /* Pointer to certificate string */ | |
847 | ||
848 | certptr = fgets(certificate, sizeof(certificate), fp); | |
849 | fclose(fp); | |
850 | ||
851 | if (certptr) | |
852 | { | |
853 | /* | |
854 | * Set the authorization string and return... | |
855 | */ | |
856 | ||
857 | httpSetAuthString(http, "Local", certificate); | |
858 | ||
859 | DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", | |
860 | http->authstring)); | |
861 | ||
862 | return (0); | |
863 | } | |
864 | } | |
865 | ||
866 | return (1); | |
867 | #endif /* WIN32 || __EMX__ */ | |
868 | } |