cups/auth.c

   1 /*
   2  * Authentication functions for CUPS.
   3  *
   4  * Copyright 2007-2018 by Apple Inc.
   5  * Copyright 1997-2007 by Easy Software Products.
   6  *
   7  * This file contains Kerberos support code, copyright 2006 by
   8  * Jelmer Vernooij.
   9  *
  10  * Licensed under Apache License v2.0.  See the file "LICENSE" for more information.
  11  */
  12
  13 /*
  14  * Include necessary headers...
  15  */
  16
  17 #include "cups-private.h"
  18 #include "debug-internal.h"
  19 #include <fcntl.h>
  20 #include <sys/stat.h>
  21 #if defined(_WIN32) || defined(__EMX__)
  22 #  include <io.h>
  23 #else
  24 #  include <unistd.h>
  25 #endif /* _WIN32 || __EMX__ */
  26
  27 #if HAVE_AUTHORIZATION_H
  28 #  include <Security/Authorization.h>
  29 #  ifdef HAVE_SECBASEPRIV_H
  30 #    include <Security/SecBasePriv.h>
  31 #  else
  32 extern const char *cssmErrorString(int error);
  33 #  endif /* HAVE_SECBASEPRIV_H */
  34 #endif /* HAVE_AUTHORIZATION_H */
  35
  36 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
  37 #  include <pwd.h>
  38 #endif /* SO_PEERCRED && AF_LOCAL */
  39
  40
  41 /*
  42  * Local functions...
  43  */
  44
  45 static const char       *cups_auth_find(const char *www_authenticate, const char *scheme);
  46 static const char       *cups_auth_param(const char *scheme, const char *name, char *value, size_t valsize);
  47 static const char       *cups_auth_scheme(const char *www_authenticate, char *scheme, size_t schemesize);
  48
  49 #ifdef HAVE_GSSAPI
  50 #  ifdef HAVE_GSS_ACQUIRE_CRED_EX_F
  51 #    ifdef HAVE_GSS_GSSAPI_SPI_H
  52 #      include <GSS/gssapi_spi.h>
  53 #    else
  54 #      define GSS_AUTH_IDENTITY_TYPE_1 1
  55 #      define gss_acquire_cred_ex_f __ApplePrivate_gss_acquire_cred_ex_f
  56 typedef struct gss_auth_identity /* @private@ */
  57 {
  58   uint32_t type;
  59   uint32_t flags;
  60   char *username;
  61   char *realm;
  62   char *password;
  63   gss_buffer_t *credentialsRef;
  64 } gss_auth_identity_desc;
  65 extern OM_uint32 gss_acquire_cred_ex_f(gss_status_id_t, const gss_name_t,
  66                                        OM_uint32, OM_uint32, const gss_OID,
  67                                        gss_cred_usage_t, gss_auth_identity_t,
  68                                        void *, void (*)(void *, OM_uint32,
  69                                                         gss_status_id_t,
  70                                                         gss_cred_id_t,
  71                                                         gss_OID_set,
  72                                                         OM_uint32));
  73 #    endif /* HAVE_GSS_GSSAPI_SPI_H */
  74 #    include <dispatch/dispatch.h>
  75 typedef struct _cups_gss_acquire_s      /* Acquire callback data */
  76 {
  77   dispatch_semaphore_t  sem;            /* Synchronization semaphore */
  78   OM_uint32             major;          /* Returned status code */
  79   gss_cred_id_t         creds;          /* Returned credentials */
  80 } _cups_gss_acquire_t;
  81
  82 static void     cups_gss_acquire(void *ctx, OM_uint32 major,
  83                                  gss_status_id_t status,
  84                                  gss_cred_id_t creds, gss_OID_set oids,
  85                                  OM_uint32 time_rec);
  86 #  endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */
  87 static gss_name_t cups_gss_getname(http_t *http, const char *service_name);
  88 #  ifdef DEBUG
  89 static void     cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status,
  90                                 const char *message);
  91 #  else
  92 #    define     cups_gss_printf(major, minor, message)
  93 #  endif /* DEBUG */
  94 #endif /* HAVE_GSSAPI */
  95 static int      cups_local_auth(http_t *http);
  96
  97
  98 /*
  99  * 'cupsDoAuthentication()' - Authenticate a request.
 100  *
 101  * This function should be called in response to a @code HTTP_STATUS_UNAUTHORIZED@
 102  * status, prior to resubmitting your request.
 103  *
 104  * @since CUPS 1.1.20/macOS 10.4@
 105  */
 106
 107 int                                     /* O - 0 on success, -1 on error */
 108 cupsDoAuthentication(
 109     http_t     *http,                   /* I - Connection to server or @code CUPS_HTTP_DEFAULT@ */
 110     const char *method,                 /* I - Request method ("GET", "POST", "PUT") */
 111     const char *resource)               /* I - Resource path */
 112 {
 113   const char    *password,              /* Password string */
 114                 *www_auth,              /* WWW-Authenticate header */
 115                 *schemedata;            /* Scheme-specific data */
 116   char          scheme[256],            /* Scheme name */
 117                 prompt[1024];           /* Prompt for user */
 118   int           localauth;              /* Local authentication result */
 119   _cups_globals_t *cg;                  /* Global data */
 120
 121
 122   DEBUG_printf(("cupsDoAuthentication(http=%p, method=\"%s\", resource=\"%s\")", (void *)http, method, resource));
 123
 124   if (!http)
 125     http = _cupsConnect();
 126
 127   if (!http || !method || !resource)
 128     return (-1);
 129
 130   DEBUG_printf(("2cupsDoAuthentication: digest_tries=%d, userpass=\"%s\"",
 131                 http->digest_tries, http->userpass));
 132   DEBUG_printf(("2cupsDoAuthentication: WWW-Authenticate=\"%s\"",
 133                 httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE)));
 134
 135  /*
 136   * Clear the current authentication string...
 137   */
 138
 139   httpSetAuthString(http, NULL, NULL);
 140
 141  /*
 142   * See if we can do local authentication...
 143   */
 144
 145   if (http->digest_tries < 3)
 146   {
 147     if ((localauth = cups_local_auth(http)) == 0)
 148     {
 149       DEBUG_printf(("2cupsDoAuthentication: authstring=\"%s\"",
 150                     http->authstring));
 151
 152       if (http->status == HTTP_STATUS_UNAUTHORIZED)
 153         http->digest_tries ++;
 154
 155       return (0);
 156     }
 157     else if (localauth == -1)
 158     {
 159       http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
 160       return (-1);                      /* Error or canceled */
 161     }
 162   }
 163
 164  /*
 165   * Nope, loop through the authentication schemes to find the first we support.
 166   */
 167
 168   www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE);
 169
 170   for (schemedata = cups_auth_scheme(www_auth, scheme, sizeof(scheme)); schemedata; schemedata = cups_auth_scheme(schemedata + strlen(scheme), scheme, sizeof(scheme)))
 171   {
 172    /*
 173     * Check the scheme name...
 174     */
 175
 176 #ifdef HAVE_GSSAPI
 177     if (!_cups_strcasecmp(scheme, "Negotiate"))
 178     {
 179      /*
 180       * Kerberos authentication...
 181       */
 182
 183       if (_cupsSetNegotiateAuthString(http, method, resource))
 184       {
 185         http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
 186         return (-1);
 187       }
 188
 189       break;
 190     }
 191     else
 192 #endif /* HAVE_GSSAPI */
 193     if (_cups_strcasecmp(scheme, "Basic") && _cups_strcasecmp(scheme, "Digest"))
 194       continue;                         /* Not supported (yet) */
 195
 196    /*
 197     * See if we should retry the current username:password...
 198     */
 199
 200     if ((http->digest_tries > 1 || !http->userpass[0]) && (!_cups_strcasecmp(scheme, "Basic") || (!_cups_strcasecmp(scheme, "Digest"))))
 201     {
 202      /*
 203       * Nope - get a new password from the user...
 204       */
 205
 206       char default_username[HTTP_MAX_VALUE];
 207                                         /* Default username */
 208
 209       cg = _cupsGlobals();
 210
 211       if (!cg->lang_default)
 212         cg->lang_default = cupsLangDefault();
 213
 214       if (cups_auth_param(schemedata, "username", default_username, sizeof(default_username)))
 215         cupsSetUser(default_username);
 216
 217       snprintf(prompt, sizeof(prompt), _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), cupsUser(), http->hostname[0] == '/' ? "localhost" : http->hostname);
 218
 219       http->digest_tries  = _cups_strncasecmp(scheme, "Digest", 6) != 0;
 220       http->userpass[0]   = '\0';
 221
 222       if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL)
 223       {
 224         http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
 225         return (-1);
 226       }
 227
 228       snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), password);
 229     }
 230     else if (http->status == HTTP_STATUS_UNAUTHORIZED)
 231       http->digest_tries ++;
 232
 233     if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3)
 234     {
 235       DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", http->digest_tries));
 236
 237       http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
 238       return (-1);
 239     }
 240
 241    /*
 242     * Got a password; encode it for the server...
 243     */
 244
 245     if (!_cups_strcasecmp(scheme, "Basic"))
 246     {
 247      /*
 248       * Basic authentication...
 249       */
 250
 251       char      encode[256];            /* Base64 buffer */
 252
 253       httpEncode64_2(encode, sizeof(encode), http->userpass, (int)strlen(http->userpass));
 254       httpSetAuthString(http, "Basic", encode);
 255       break;
 256     }
 257     else if (!_cups_strcasecmp(scheme, "Digest"))
 258     {
 259      /*
 260       * Digest authentication...
 261       */
 262
 263       char nonce[HTTP_MAX_VALUE];       /* nonce="xyz" string */
 264
 265       cups_auth_param(schemedata, "algorithm", http->algorithm, sizeof(http->algorithm));
 266       cups_auth_param(schemedata, "opaque", http->opaque, sizeof(http->opaque));
 267       cups_auth_param(schemedata, "nonce", nonce, sizeof(nonce));
 268       cups_auth_param(schemedata, "realm", http->realm, sizeof(http->realm));
 269
 270       if (_httpSetDigestAuthString(http, nonce, method, resource))
 271         break;
 272     }
 273   }
 274
 275   if (http->authstring)
 276   {
 277     DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\"", http->authstring));
 278
 279     return (0);
 280   }
 281   else
 282   {
 283     DEBUG_printf(("1cupsDoAuthentication: Unknown auth type: \"%s\"", www_auth));
 284     http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
 285
 286     return (-1);
 287   }
 288 }
 289
 290
 291 #ifdef HAVE_GSSAPI
 292 /*
 293  * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string.
 294  */
 295
 296 int                                     /* O - 0 on success, -1 on error */
 297 _cupsSetNegotiateAuthString(
 298     http_t     *http,                   /* I - Connection to server */
 299     const char *method,                 /* I - Request method ("GET", "POST", "PUT") */
 300     const char *resource)               /* I - Resource path */
 301 {
 302   OM_uint32     minor_status,           /* Minor status code */
 303                 major_status;           /* Major status code */
 304   gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
 305                                         /* Output token */
 306
 307
 308   (void)method;
 309   (void)resource;
 310
 311 #  ifdef __APPLE__
 312  /*
 313   * If the weak-linked GSSAPI/Kerberos library is not present, don't try
 314   * to use it...
 315   */
 316
 317   if (&gss_init_sec_context == NULL)
 318   {
 319     DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos "
 320                "framework is not present");
 321     return (-1);
 322   }
 323 #  endif /* __APPLE__ */
 324
 325   if (http->gssname == GSS_C_NO_NAME)
 326   {
 327     http->gssname = cups_gss_getname(http, _cupsGSSServiceName());
 328   }
 329
 330   if (http->gssctx != GSS_C_NO_CONTEXT)
 331   {
 332     gss_delete_sec_context(&minor_status, &http->gssctx, GSS_C_NO_BUFFER);
 333     http->gssctx = GSS_C_NO_CONTEXT;
 334   }
 335
 336   major_status = gss_init_sec_context(&minor_status, GSS_C_NO_CREDENTIAL,
 337                                       &http->gssctx,
 338                                       http->gssname, http->gssmech,
 339                                       GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG,
 340                                       GSS_C_INDEFINITE,
 341                                       GSS_C_NO_CHANNEL_BINDINGS,
 342                                       GSS_C_NO_BUFFER, &http->gssmech,
 343                                       &output_token, NULL, NULL);
 344
 345 #  ifdef HAVE_GSS_ACQUIRE_CRED_EX_F
 346   if (major_status == GSS_S_NO_CRED)
 347   {
 348    /*
 349     * Ask the user for credentials...
 350     */
 351
 352     char                prompt[1024],   /* Prompt for user */
 353                         userbuf[256];   /* Kerberos username */
 354     const char          *username,      /* Username string */
 355                         *password;      /* Password string */
 356     _cups_gss_acquire_t data;           /* Callback data */
 357     gss_auth_identity_desc identity;    /* Kerberos user identity */
 358     _cups_globals_t     *cg = _cupsGlobals();
 359                                         /* Per-thread global data */
 360
 361     if (!cg->lang_default)
 362       cg->lang_default = cupsLangDefault();
 363
 364     snprintf(prompt, sizeof(prompt),
 365              _cupsLangString(cg->lang_default, _("Password for %s on %s? ")),
 366              cupsUser(), http->gsshost);
 367
 368     if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL)
 369       return (-1);
 370
 371    /*
 372     * Try to acquire credentials...
 373     */
 374
 375     username = cupsUser();
 376     if (!strchr(username, '@'))
 377     {
 378       snprintf(userbuf, sizeof(userbuf), "%s@%s", username, http->gsshost);
 379       username = userbuf;
 380     }
 381
 382     identity.type           = GSS_AUTH_IDENTITY_TYPE_1;
 383     identity.flags          = 0;
 384     identity.username       = (char *)username;
 385     identity.realm          = (char *)"";
 386     identity.password       = (char *)password;
 387     identity.credentialsRef = NULL;
 388
 389     data.sem   = dispatch_semaphore_create(0);
 390     data.major = 0;
 391     data.creds = NULL;
 392
 393     if (data.sem)
 394     {
 395       major_status = gss_acquire_cred_ex_f(NULL, GSS_C_NO_NAME, 0, GSS_C_INDEFINITE, GSS_KRB5_MECHANISM, GSS_C_INITIATE, (gss_auth_identity_t)&identity, &data, cups_gss_acquire);
 396
 397       if (major_status == GSS_S_COMPLETE)
 398       {
 399         dispatch_semaphore_wait(data.sem, DISPATCH_TIME_FOREVER);
 400         major_status = data.major;
 401       }
 402
 403       dispatch_release(data.sem);
 404
 405       if (major_status == GSS_S_COMPLETE)
 406       {
 407         OM_uint32       release_minor;  /* Minor status from releasing creds */
 408
 409         major_status = gss_init_sec_context(&minor_status, data.creds,
 410                                             &http->gssctx,
 411                                             http->gssname, http->gssmech,
 412                                             GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG,
 413                                             GSS_C_INDEFINITE,
 414                                             GSS_C_NO_CHANNEL_BINDINGS,
 415                                             GSS_C_NO_BUFFER, &http->gssmech,
 416                                             &output_token, NULL, NULL);
 417         gss_release_cred(&release_minor, &data.creds);
 418       }
 419     }
 420   }
 421 #  endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */
 422
 423   if (GSS_ERROR(major_status))
 424   {
 425     cups_gss_printf(major_status, minor_status,
 426                     "_cupsSetNegotiateAuthString: Unable to initialize "
 427                     "security context");
 428     return (-1);
 429   }
 430
 431 #  ifdef DEBUG
 432   else if (major_status == GSS_S_CONTINUE_NEEDED)
 433     cups_gss_printf(major_status, minor_status,
 434                     "_cupsSetNegotiateAuthString: Continuation needed!");
 435 #  endif /* DEBUG */
 436
 437   if (output_token.length > 0 && output_token.length <= 65536)
 438   {
 439    /*
 440     * Allocate the authorization string since Windows KDCs can have
 441     * arbitrarily large credentials...
 442     */
 443
 444     int authsize = 10 +                 /* "Negotiate " */
 445                    (int)output_token.length * 4 / 3 + 1 + 1;
 446                                         /* Base64 + nul */
 447
 448     httpSetAuthString(http, NULL, NULL);
 449
 450     if ((http->authstring = malloc((size_t)authsize)) == NULL)
 451     {
 452       http->authstring = http->_authstring;
 453       authsize         = sizeof(http->_authstring);
 454     }
 455
 456     strlcpy(http->authstring, "Negotiate ", (size_t)authsize);
 457     httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value,
 458                    (int)output_token.length);
 459
 460     gss_release_buffer(&minor_status, &output_token);
 461   }
 462   else
 463   {
 464     DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos credentials too "
 465                   "large - %d bytes!", (int)output_token.length));
 466     gss_release_buffer(&minor_status, &output_token);
 467
 468     return (-1);
 469   }
 470
 471   return (0);
 472 }
 473 #endif /* HAVE_GSSAPI */
 474
 475
 476 /*
 477  * 'cups_auth_find()' - Find the named WWW-Authenticate scheme.
 478  *
 479  * The "www_authenticate" parameter points to the current position in the header.
 480  *
 481  * Returns @code NULL@ if the auth scheme is not present.
 482  */
 483
 484 static const char *                             /* O - Start of matching scheme or @code NULL@ if not found */
 485 cups_auth_find(const char *www_authenticate,    /* I - Pointer into WWW-Authenticate header */
 486                const char *scheme)              /* I - Authentication scheme */
 487 {
 488   size_t        schemelen = strlen(scheme);     /* Length of scheme */
 489
 490
 491   DEBUG_printf(("8cups_auth_find(www_authenticate=\"%s\", scheme=\"%s\"(%d))", www_authenticate, scheme, (int)schemelen));
 492
 493   while (*www_authenticate)
 494   {
 495    /*
 496     * Skip leading whitespace and commas...
 497     */
 498
 499     DEBUG_printf(("9cups_auth_find: Before whitespace: \"%s\"", www_authenticate));
 500     while (isspace(*www_authenticate & 255) || *www_authenticate == ',')
 501       www_authenticate ++;
 502     DEBUG_printf(("9cups_auth_find: After whitespace: \"%s\"", www_authenticate));
 503
 504    /*
 505     * See if this is "Scheme" followed by whitespace or the end of the string.
 506     */
 507
 508     if (!strncmp(www_authenticate, scheme, schemelen) && (isspace(www_authenticate[schemelen] & 255) || www_authenticate[schemelen] == ',' || !www_authenticate[schemelen]))
 509     {
 510      /*
 511       * Yes, this is the start of the scheme-specific information...
 512       */
 513
 514       DEBUG_printf(("9cups_auth_find: Returning \"%s\".", www_authenticate));
 515
 516       return (www_authenticate);
 517     }
 518
 519    /*
 520     * Skip the scheme name or param="value" string...
 521     */
 522
 523     while (!isspace(*www_authenticate & 255) && *www_authenticate)
 524     {
 525       if (*www_authenticate == '\"')
 526       {
 527        /*
 528         * Skip quoted value...
 529         */
 530
 531         www_authenticate ++;
 532         while (*www_authenticate && *www_authenticate != '\"')
 533           www_authenticate ++;
 534
 535         DEBUG_printf(("9cups_auth_find: After quoted: \"%s\"", www_authenticate));
 536       }
 537
 538       www_authenticate ++;
 539     }
 540
 541     DEBUG_printf(("9cups_auth_find: After skip: \"%s\"", www_authenticate));
 542   }
 543
 544   DEBUG_puts("9cups_auth_find: Returning NULL.");
 545
 546   return (NULL);
 547 }
 548
 549
 550 /*
 551  * 'cups_auth_param()' - Copy the value for the named authentication parameter,
 552  *                       if present.
 553  */
 554
 555 static const char *                             /* O - Parameter value or @code NULL@ if not present */
 556 cups_auth_param(const char *scheme,             /* I - Pointer to auth data */
 557                 const char *name,               /* I - Name of parameter */
 558                 char       *value,              /* I - Value buffer */
 559                 size_t     valsize)             /* I - Size of value buffer */
 560 {
 561   char          *valptr = value,                /* Pointer into value buffer */
 562                 *valend = value + valsize - 1;  /* Pointer to end of buffer */
 563   size_t        namelen = strlen(name);         /* Name length */
 564   int           param;                          /* Is this a parameter? */
 565
 566
 567   DEBUG_printf(("8cups_auth_param(scheme=\"%s\", name=\"%s\", value=%p, valsize=%d)", scheme, name, (void *)value, (int)valsize));
 568
 569   while (!isspace(*scheme & 255) && *scheme)
 570     scheme ++;
 571
 572   while (*scheme)
 573   {
 574     while (isspace(*scheme & 255) || *scheme == ',')
 575       scheme ++;
 576
 577     if (!strncmp(scheme, name, namelen) && scheme[namelen] == '=')
 578     {
 579      /*
 580       * Found the parameter, copy the value...
 581       */
 582
 583       scheme += namelen + 1;
 584       if (*scheme == '\"')
 585       {
 586         scheme ++;
 587
 588         while (*scheme && *scheme != '\"')
 589         {
 590           if (valptr < valend)
 591             *valptr++ = *scheme;
 592
 593           scheme ++;
 594         }
 595       }
 596       else
 597       {
 598         while (*scheme && strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~+/=", *scheme))
 599         {
 600           if (valptr < valend)
 601             *valptr++ = *scheme;
 602
 603           scheme ++;
 604         }
 605       }
 606
 607       *valptr = '\0';
 608
 609       DEBUG_printf(("9cups_auth_param: Returning \"%s\".", value));
 610
 611       return (value);
 612     }
 613
 614    /*
 615     * Skip the param=value string...
 616     */
 617
 618     param = 0;
 619
 620     while (!isspace(*scheme & 255) && *scheme)
 621     {
 622       if (*scheme == '=')
 623         param = 1;
 624       else if (*scheme == '\"')
 625       {
 626        /*
 627         * Skip quoted value...
 628         */
 629
 630         scheme ++;
 631         while (*scheme && *scheme != '\"')
 632           scheme ++;
 633       }
 634
 635       scheme ++;
 636     }
 637
 638    /*
 639     * If this wasn't a parameter, we are at the end of this scheme's
 640     * parameters...
 641     */
 642
 643     if (!param)
 644       break;
 645   }
 646
 647   *value = '\0';
 648
 649   DEBUG_puts("9cups_auth_param: Returning NULL.");
 650
 651   return (NULL);
 652 }
 653
 654
 655 /*
 656  * 'cups_auth_scheme()' - Get the (next) WWW-Authenticate scheme.
 657  *
 658  * The "www_authenticate" parameter points to the current position in the header.
 659  *
 660  * Returns @code NULL@ if there are no (more) auth schemes present.
 661  */
 662
 663 static const char *                             /* O - Start of scheme or @code NULL@ if not found */
 664 cups_auth_scheme(const char *www_authenticate,  /* I - Pointer into WWW-Authenticate header */
 665                  char       *scheme,            /* I - Scheme name buffer */
 666                  size_t     schemesize)         /* I - Size of buffer */
 667 {
 668   const char    *start;                         /* Start of scheme data */
 669   char          *sptr = scheme,                 /* Pointer into scheme buffer */
 670                 *send = scheme + schemesize - 1;/* End of scheme buffer */
 671   int           param;                          /* Is this a parameter? */
 672
 673
 674   DEBUG_printf(("8cups_auth_scheme(www_authenticate=\"%s\", scheme=%p, schemesize=%d)", www_authenticate, (void *)scheme, (int)schemesize));
 675
 676   while (*www_authenticate)
 677   {
 678    /*
 679     * Skip leading whitespace and commas...
 680     */
 681
 682     while (isspace(*www_authenticate & 255) || *www_authenticate == ',')
 683       www_authenticate ++;
 684
 685    /*
 686     * Parse the scheme name or param="value" string...
 687     */
 688
 689     for (sptr = scheme, start = www_authenticate, param = 0; *www_authenticate && *www_authenticate != ',' && !isspace(*www_authenticate & 255); www_authenticate ++)
 690     {
 691       if (*www_authenticate == '=')
 692         param = 1;
 693       else if (!param && sptr < send)
 694         *sptr++ = *www_authenticate;
 695       else if (*www_authenticate == '\"')
 696       {
 697        /*
 698         * Skip quoted value...
 699         */
 700
 701         www_authenticate ++;
 702         while (*www_authenticate && *www_authenticate != '\"')
 703           www_authenticate ++;
 704       }
 705     }
 706
 707     if (sptr > scheme && !param)
 708     {
 709       *sptr = '\0';
 710
 711       DEBUG_printf(("9cups_auth_scheme: Returning \"%s\".", start));
 712
 713       return (start);
 714     }
 715   }
 716
 717   *scheme = '\0';
 718
 719   DEBUG_puts("9cups_auth_scheme: Returning NULL.");
 720
 721   return (NULL);
 722 }
 723
 724
 725 #ifdef HAVE_GSSAPI
 726 #  ifdef HAVE_GSS_ACQUIRE_CRED_EX_F
 727 /*
 728  * 'cups_gss_acquire()' - Kerberos credentials callback.
 729  */
 730 static void
 731 cups_gss_acquire(
 732     void            *ctx,               /* I - Caller context */
 733     OM_uint32       major,              /* I - Major error code */
 734     gss_status_id_t status,             /* I - Status (unused) */
 735     gss_cred_id_t   creds,              /* I - Credentials (if any) */
 736     gss_OID_set     oids,               /* I - Mechanism OIDs (unused) */
 737     OM_uint32       time_rec)           /* I - Timestamp (unused) */
 738 {
 739   uint32_t              min;            /* Minor error code */
 740   _cups_gss_acquire_t   *data;          /* Callback data */
 741
 742
 743   (void)status;
 744   (void)time_rec;
 745
 746   data        = (_cups_gss_acquire_t *)ctx;
 747   data->major = major;
 748   data->creds = creds;
 749
 750   gss_release_oid_set(&min, &oids);
 751   dispatch_semaphore_signal(data->sem);
 752 }
 753 #  endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */
 754
 755
 756 /*
 757  * 'cups_gss_getname()' - Get CUPS service credentials for authentication.
 758  */
 759
 760 static gss_name_t                       /* O - Server name */
 761 cups_gss_getname(
 762     http_t     *http,                   /* I - Connection to server */
 763     const char *service_name)           /* I - Service name */
 764 {
 765   gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
 766                                         /* Service token */
 767   OM_uint32       major_status,         /* Major status code */
 768                   minor_status;         /* Minor status code */
 769   gss_name_t      server_name;          /* Server name */
 770   char            buf[1024];            /* Name buffer */
 771
 772
 773   DEBUG_printf(("7cups_gss_getname(http=%p, service_name=\"%s\")", http,
 774                 service_name));
 775
 776
 777  /*
 778   * Get the hostname...
 779   */
 780
 781   if (!http->gsshost[0])
 782   {
 783     httpGetHostname(http, http->gsshost, sizeof(http->gsshost));
 784
 785     if (!strcmp(http->gsshost, "localhost"))
 786     {
 787       if (gethostname(http->gsshost, sizeof(http->gsshost)) < 0)
 788       {
 789         DEBUG_printf(("1cups_gss_getname: gethostname() failed: %s",
 790                       strerror(errno)));
 791         http->gsshost[0] = '\0';
 792         return (NULL);
 793       }
 794
 795       if (!strchr(http->gsshost, '.'))
 796       {
 797        /*
 798         * The hostname is not a FQDN, so look it up...
 799         */
 800
 801         struct hostent  *host;          /* Host entry to get FQDN */
 802
 803         if ((host = gethostbyname(http->gsshost)) != NULL && host->h_name)
 804         {
 805          /*
 806           * Use the resolved hostname...
 807           */
 808
 809           strlcpy(http->gsshost, host->h_name, sizeof(http->gsshost));
 810         }
 811         else
 812         {
 813           DEBUG_printf(("1cups_gss_getname: gethostbyname(\"%s\") failed.",
 814                         http->gsshost));
 815           http->gsshost[0] = '\0';
 816           return (NULL);
 817         }
 818       }
 819     }
 820   }
 821
 822  /*
 823   * Get a service name we can use for authentication purposes...
 824   */
 825
 826   snprintf(buf, sizeof(buf), "%s@%s", service_name, http->gsshost);
 827
 828   DEBUG_printf(("8cups_gss_getname: Looking up \"%s\".", buf));
 829
 830   token.value  = buf;
 831   token.length = strlen(buf);
 832   server_name  = GSS_C_NO_NAME;
 833   major_status = gss_import_name(&minor_status, &token,
 834                                  GSS_C_NT_HOSTBASED_SERVICE,
 835                                  &server_name);
 836
 837   if (GSS_ERROR(major_status))
 838   {
 839     cups_gss_printf(major_status, minor_status,
 840                     "cups_gss_getname: gss_import_name() failed");
 841     return (NULL);
 842   }
 843
 844   return (server_name);
 845 }
 846
 847
 848 #  ifdef DEBUG
 849 /*
 850  * 'cups_gss_printf()' - Show debug error messages from GSSAPI.
 851  */
 852
 853 static void
 854 cups_gss_printf(OM_uint32  major_status,/* I - Major status code */
 855                 OM_uint32  minor_status,/* I - Minor status code */
 856                 const char *message)    /* I - Prefix for error message */
 857 {
 858   OM_uint32     err_major_status,       /* Major status code for display */
 859                 err_minor_status;       /* Minor status code for display */
 860   OM_uint32     msg_ctx;                /* Message context */
 861   gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER,
 862                                         /* Major status message */
 863                 minor_status_string = GSS_C_EMPTY_BUFFER;
 864                                         /* Minor status message */
 865
 866
 867   msg_ctx          = 0;
 868   err_major_status = gss_display_status(&err_minor_status,
 869                                         major_status,
 870                                         GSS_C_GSS_CODE,
 871                                         GSS_C_NO_OID,
 872                                         &msg_ctx,
 873                                         &major_status_string);
 874
 875   if (!GSS_ERROR(err_major_status))
 876     gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE,
 877                        GSS_C_NULL_OID, &msg_ctx, &minor_status_string);
 878
 879   DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value,
 880                 (char *)minor_status_string.value));
 881
 882   gss_release_buffer(&err_minor_status, &major_status_string);
 883   gss_release_buffer(&err_minor_status, &minor_status_string);
 884 }
 885 #  endif /* DEBUG */
 886 #endif /* HAVE_GSSAPI */
 887
 888
 889 /*
 890  * 'cups_local_auth()' - Get the local authorization certificate if
 891  *                       available/applicable.
 892  */
 893
 894 static int                              /* O - 0 if available */
 895                                         /*     1 if not available */
 896                                         /*    -1 error */
 897 cups_local_auth(http_t *http)           /* I - HTTP connection to server */
 898 {
 899 #if defined(_WIN32) || defined(__EMX__)
 900  /*
 901   * Currently _WIN32 and OS-2 do not support the CUPS server...
 902   */
 903
 904   return (1);
 905 #else
 906   int                   pid;            /* Current process ID */
 907   FILE                  *fp;            /* Certificate file */
 908   char                  trc[16],        /* Try Root Certificate parameter */
 909                         filename[1024]; /* Certificate filename */
 910   const char            *www_auth,      /* WWW-Authenticate header */
 911                         *schemedata;    /* Data for the named auth scheme */
 912   _cups_globals_t *cg = _cupsGlobals(); /* Global data */
 913 #  if defined(HAVE_AUTHORIZATION_H)
 914   OSStatus              status;         /* Status */
 915   AuthorizationItem     auth_right;     /* Authorization right */
 916   AuthorizationRights   auth_rights;    /* Authorization rights */
 917   AuthorizationFlags    auth_flags;     /* Authorization flags */
 918   AuthorizationExternalForm auth_extrn; /* Authorization ref external */
 919   char                  auth_key[1024]; /* Buffer */
 920   char                  buffer[1024];   /* Buffer */
 921 #  endif /* HAVE_AUTHORIZATION_H */
 922
 923
 924   DEBUG_printf(("7cups_local_auth(http=%p) hostaddr=%s, hostname=\"%s\"", (void *)http, httpAddrString(http->hostaddr, filename, sizeof(filename)), http->hostname));
 925
 926  /*
 927   * See if we are accessing localhost...
 928   */
 929
 930   if (!httpAddrLocalhost(http->hostaddr) && _cups_strcasecmp(http->hostname, "localhost") != 0)
 931   {
 932     DEBUG_puts("8cups_local_auth: Not a local connection!");
 933     return (1);
 934   }
 935
 936   www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE);
 937
 938 #  if defined(HAVE_AUTHORIZATION_H)
 939  /*
 940   * Delete any previous authorization reference...
 941   */
 942
 943   if (http->auth_ref)
 944   {
 945     AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults);
 946     http->auth_ref = NULL;
 947   }
 948
 949   if (!getenv("GATEWAY_INTERFACE") && (schemedata = cups_auth_find(www_auth, "AuthRef")) != NULL && cups_auth_param(schemedata, "key", auth_key, sizeof(auth_key)))
 950   {
 951     status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &http->auth_ref);
 952     if (status != errAuthorizationSuccess)
 953     {
 954       DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d (%s)",
 955                     (int)status, cssmErrorString(status)));
 956       return (-1);
 957     }
 958
 959     auth_right.name        = auth_key;
 960     auth_right.valueLength = 0;
 961     auth_right.value       = NULL;
 962     auth_right.flags       = 0;
 963
 964     auth_rights.count = 1;
 965     auth_rights.items = &auth_right;
 966
 967     auth_flags = kAuthorizationFlagDefaults |
 968                  kAuthorizationFlagPreAuthorize |
 969                  kAuthorizationFlagInteractionAllowed |
 970                  kAuthorizationFlagExtendRights;
 971
 972     status = AuthorizationCopyRights(http->auth_ref, &auth_rights,
 973                                      kAuthorizationEmptyEnvironment,
 974                                      auth_flags, NULL);
 975     if (status == errAuthorizationSuccess)
 976       status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn);
 977
 978     if (status == errAuthorizationSuccess)
 979     {
 980      /*
 981       * Set the authorization string and return...
 982       */
 983
 984       httpEncode64_2(buffer, sizeof(buffer), (void *)&auth_extrn,
 985                      sizeof(auth_extrn));
 986
 987       httpSetAuthString(http, "AuthRef", buffer);
 988
 989       DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"",
 990                     http->authstring));
 991       return (0);
 992     }
 993     else if (status == errAuthorizationCanceled)
 994       return (-1);
 995
 996     DEBUG_printf(("9cups_local_auth: AuthorizationCopyRights() returned %d (%s)",
 997                   (int)status, cssmErrorString(status)));
 998
 999   /*
1000    * Fall through to try certificates...
1001    */
1002   }
1003 #  endif /* HAVE_AUTHORIZATION_H */
1004
1005 #  ifdef HAVE_GSSAPI
1006   if (cups_auth_find(www_auth, "Negotiate"))
1007     return (1);
1008 #  endif /* HAVE_GSSAPI */
1009
1010 #  if defined(SO_PEERCRED) && defined(AF_LOCAL)
1011  /*
1012   * See if we can authenticate using the peer credentials provided over a
1013   * domain socket; if so, specify "PeerCred username" as the authentication
1014   * information...
1015   */
1016
1017   if (http->hostaddr->addr.sa_family == AF_LOCAL &&
1018       !getenv("GATEWAY_INTERFACE") &&   /* Not via CGI programs... */
1019       cups_auth_find(www_auth, "PeerCred"))
1020   {
1021    /*
1022     * Verify that the current cupsUser() matches the current UID...
1023     */
1024
1025     struct passwd       *pwd;           /* Password information */
1026     const char          *username;      /* Current username */
1027
1028     username = cupsUser();
1029
1030     if ((pwd = getpwnam(username)) != NULL && pwd->pw_uid == getuid())
1031     {
1032       httpSetAuthString(http, "PeerCred", username);
1033
1034       DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"",
1035                     http->authstring));
1036
1037       return (0);
1038     }
1039   }
1040 #  endif /* SO_PEERCRED && AF_LOCAL */
1041
1042   if ((schemedata = cups_auth_find(www_auth, "Local")) == NULL)
1043     return (1);
1044
1045  /*
1046   * Try opening a certificate file for this PID.  If that fails,
1047   * try the root certificate...
1048   */
1049
1050   pid = getpid();
1051   snprintf(filename, sizeof(filename), "%s/certs/%d", cg->cups_statedir, pid);
1052   if ((fp = fopen(filename, "r")) == NULL && pid > 0)
1053   {
1054    /*
1055     * No certificate for this PID; see if we can get the root certificate...
1056     */
1057
1058     DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno)));
1059
1060     if (!cups_auth_param(schemedata, "trc", trc, sizeof(trc)))
1061     {
1062      /*
1063       * Scheduler doesn't want us to use the root certificate...
1064       */
1065
1066       return (1);
1067     }
1068
1069     snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir);
1070     if ((fp = fopen(filename, "r")) == NULL)
1071       DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno)));
1072   }
1073
1074   if (fp)
1075   {
1076    /*
1077     * Read the certificate from the file...
1078     */
1079
1080     char        certificate[33],        /* Certificate string */
1081                 *certptr;               /* Pointer to certificate string */
1082
1083     certptr = fgets(certificate, sizeof(certificate), fp);
1084     fclose(fp);
1085
1086     if (certptr)
1087     {
1088      /*
1089       * Set the authorization string and return...
1090       */
1091
1092       httpSetAuthString(http, "Local", certificate);
1093
1094       DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"",
1095                     http->authstring));
1096
1097       return (0);
1098     }
1099   }
1100
1101   return (1);
1102 #endif /* _WIN32 || __EMX__ */
1103 }