scheduler/auth.c

   1 /*
   2  * Authorization routines for the CUPS scheduler.
   3  *
   4  * Copyright 2007-2016 by Apple Inc.
   5  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * This file contains Kerberos support code, copyright 2006 by
   8  * Jelmer Vernooij.
   9  *
  10  * These coded instructions, statements, and computer programs are the
  11  * property of Apple Inc. and are protected by Federal copyright
  12  * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  13  * which should have been included with this file.  If this file is
  14  * file is missing or damaged, see the license at "http://www.cups.org/".
  15  */
  16
  17 /*
  18  * Include necessary headers...
  19  */
  20
  21 #include "cupsd.h"
  22 #include <grp.h>
  23 #ifdef HAVE_SHADOW_H
  24 #  include <shadow.h>
  25 #endif /* HAVE_SHADOW_H */
  26 #ifdef HAVE_CRYPT_H
  27 #  include <crypt.h>
  28 #endif /* HAVE_CRYPT_H */
  29 #if HAVE_LIBPAM
  30 #  ifdef HAVE_PAM_PAM_APPL_H
  31 #    include <pam/pam_appl.h>
  32 #  else
  33 #    include <security/pam_appl.h>
  34 #  endif /* HAVE_PAM_PAM_APPL_H */
  35 #endif /* HAVE_LIBPAM */
  36 #ifdef HAVE_MEMBERSHIP_H
  37 #  include <membership.h>
  38 #endif /* HAVE_MEMBERSHIP_H */
  39 #ifdef HAVE_AUTHORIZATION_H
  40 #  include <Security/AuthorizationTags.h>
  41 #  ifdef HAVE_SECBASEPRIV_H
  42 #    include <Security/SecBasePriv.h>
  43 #  else
  44 extern const char *cssmErrorString(int error);
  45 #  endif /* HAVE_SECBASEPRIV_H */
  46 #endif /* HAVE_AUTHORIZATION_H */
  47 #ifdef HAVE_SYS_PARAM_H
  48 #  include <sys/param.h>
  49 #endif /* HAVE_SYS_PARAM_H */
  50 #ifdef HAVE_SYS_UCRED_H
  51 #  include <sys/ucred.h>
  52 typedef struct xucred cupsd_ucred_t;
  53 #  define CUPSD_UCRED_UID(c) (c).cr_uid
  54 #else
  55 #  ifndef __OpenBSD__
  56 typedef struct ucred cupsd_ucred_t;
  57 #  else
  58 typedef struct sockpeercred cupsd_ucred_t;
  59 #  endif
  60 #  define CUPSD_UCRED_UID(c) (c).uid
  61 #endif /* HAVE_SYS_UCRED_H */
  62
  63
  64 /*
  65  * Local functions...
  66  */
  67
  68 #ifdef HAVE_AUTHORIZATION_H
  69 static int              check_authref(cupsd_client_t *con, const char *right);
  70 #endif /* HAVE_AUTHORIZATION_H */
  71 static int              compare_locations(cupsd_location_t *a,
  72                                           cupsd_location_t *b);
  73 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
  74 #if !HAVE_LIBPAM
  75 static char             *cups_crypt(const char *pw, const char *salt);
  76 #endif /* !HAVE_LIBPAM */
  77 static void             free_authmask(cupsd_authmask_t *am, void *data);
  78 #if HAVE_LIBPAM
  79 static int              pam_func(int, const struct pam_message **,
  80                                  struct pam_response **, void *);
  81 #else
  82 static void             to64(char *s, unsigned long v, int n);
  83 #endif /* HAVE_LIBPAM */
  84
  85
  86 /*
  87  * Local structures...
  88  */
  89
  90 #if HAVE_LIBPAM
  91 typedef struct cupsd_authdata_s         /**** Authentication data ****/
  92 {
  93   char  username[HTTP_MAX_VALUE],       /* Username string */
  94         password[HTTP_MAX_VALUE];       /* Password string */
  95 } cupsd_authdata_t;
  96 #endif /* HAVE_LIBPAM */
  97
  98
  99 /*
 100  * 'cupsdAddIPMask()' - Add an IP address authorization mask.
 101  */
 102
 103 int                                     /* O  - 1 on success, 0 on failure */
 104 cupsdAddIPMask(
 105     cups_array_t   **masks,             /* IO - Masks array (created as needed) */
 106     const unsigned address[4],          /* I  - IP address */
 107     const unsigned netmask[4])          /* I  - IP netmask */
 108 {
 109   cupsd_authmask_t      temp;           /* New host/domain mask */
 110
 111
 112   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", masks, *masks, address[0], address[1], address[2], address[3], netmask[0], netmask[1], netmask[2], netmask[3]);
 113
 114   temp.type = CUPSD_AUTH_IP;
 115   memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
 116   memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
 117
 118  /*
 119   * Create the masks array as needed and add...
 120   */
 121
 122   if (!*masks)
 123     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 124                            (cups_acopy_func_t)copy_authmask,
 125                            (cups_afree_func_t)free_authmask);
 126
 127   return (cupsArrayAdd(*masks, &temp));
 128 }
 129
 130
 131 /*
 132  * 'cupsdAddLocation()' - Add a location for authorization.
 133  */
 134
 135 void
 136 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
 137 {
 138  /*
 139   * Make sure the locations array is created...
 140   */
 141
 142   if (!Locations)
 143     Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
 144                               (cups_ahash_func_t)NULL, 0,
 145                               (cups_acopy_func_t)NULL,
 146                               (cups_afree_func_t)cupsdFreeLocation);
 147
 148   if (Locations)
 149   {
 150     cupsArrayAdd(Locations, loc);
 151
 152     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"", loc->location ? loc->location : "(null)");
 153   }
 154 }
 155
 156
 157 /*
 158  * 'cupsdAddName()' - Add a name to a location...
 159  */
 160
 161 void
 162 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 163              char             *name)    /* I - Name to add */
 164 {
 165   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")", loc, name);
 166
 167   if (!loc->names)
 168     loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
 169                                (cups_acopy_func_t)_cupsStrAlloc,
 170                                (cups_afree_func_t)_cupsStrFree);
 171
 172   if (!cupsArrayAdd(loc->names, name))
 173   {
 174     cupsdLogMessage(CUPSD_LOG_ERROR,
 175                     "Unable to duplicate name for location %s: %s",
 176                     loc->location ? loc->location : "nil", strerror(errno));
 177     return;
 178   }
 179 }
 180
 181
 182 /*
 183  * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
 184  */
 185
 186 int                                     /* O  - 1 on success, 0 on failure */
 187 cupsdAddNameMask(cups_array_t **masks,  /* IO - Masks array (created as needed) */
 188                  char         *name)    /* I  - Host or interface name */
 189 {
 190   cupsd_authmask_t      temp;           /* New host/domain mask */
 191   char                  ifname[32],     /* Interface name */
 192                         *ifptr;         /* Pointer to end of name */
 193
 194
 195   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", masks, *masks, name);
 196
 197   if (!_cups_strcasecmp(name, "@LOCAL"))
 198   {
 199    /*
 200     * Deny *interface*...
 201     */
 202
 203     temp.type           = CUPSD_AUTH_INTERFACE;
 204     temp.mask.name.name = (char *)"*";
 205   }
 206   else if (!_cups_strncasecmp(name, "@IF(", 4))
 207   {
 208    /*
 209     * Deny *interface*...
 210     */
 211
 212     strlcpy(ifname, name + 4, sizeof(ifname));
 213
 214     ifptr = ifname + strlen(ifname) - 1;
 215
 216     if (ifptr >= ifname && *ifptr == ')')
 217     {
 218       ifptr --;
 219       *ifptr = '\0';
 220     }
 221
 222     temp.type             = CUPSD_AUTH_INTERFACE;
 223     temp.mask.name.name   = ifname;
 224   }
 225   else
 226   {
 227    /*
 228     * Deny name...
 229     */
 230
 231     if (*name == '*')
 232       name ++;
 233
 234     temp.type             = CUPSD_AUTH_NAME;
 235     temp.mask.name.name   = (char *)name;
 236   }
 237
 238  /*
 239   * Set the name length...
 240   */
 241
 242   temp.mask.name.length = strlen(temp.mask.name.name);
 243
 244  /*
 245   * Create the masks array as needed and add...
 246   */
 247
 248   if (!*masks)
 249     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 250                            (cups_acopy_func_t)copy_authmask,
 251                            (cups_afree_func_t)free_authmask);
 252
 253   return (cupsArrayAdd(*masks, &temp));
 254 }
 255
 256
 257 /*
 258  * 'cupsdAuthorize()' - Validate any authorization credentials.
 259  */
 260
 261 void
 262 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 263 {
 264   int           type;                   /* Authentication type */
 265   const char    *authorization;         /* Pointer into Authorization string */
 266   char          *ptr,                   /* Pointer into string */
 267                 username[HTTP_MAX_VALUE],
 268                                         /* Username string */
 269                 password[HTTP_MAX_VALUE];
 270                                         /* Password string */
 271   cupsd_cert_t  *localuser;             /* Certificate username */
 272
 273
 274  /*
 275   * Locate the best matching location so we know what kind of
 276   * authentication to expect...
 277   */
 278
 279   con->best = cupsdFindBest(con->uri, httpGetState(con->http));
 280   con->type = CUPSD_AUTH_NONE;
 281
 282   cupsdLogClient(con, CUPSD_LOG_DEBUG2, "con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location : "");
 283
 284   if (con->best && con->best->type != CUPSD_AUTH_NONE)
 285   {
 286     if (con->best->type == CUPSD_AUTH_DEFAULT)
 287       type = cupsdDefaultAuthType();
 288     else
 289       type = con->best->type;
 290   }
 291   else
 292     type = cupsdDefaultAuthType();
 293
 294  /*
 295   * Decode the Authorization string...
 296   */
 297
 298   authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
 299
 300   username[0] = '\0';
 301   password[0] = '\0';
 302
 303 #ifdef HAVE_GSSAPI
 304   con->gss_uid = 0;
 305 #endif /* HAVE_GSSAPI */
 306
 307 #ifdef HAVE_AUTHORIZATION_H
 308   if (con->authref)
 309   {
 310     AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
 311     con->authref = NULL;
 312   }
 313 #endif /* HAVE_AUTHORIZATION_H */
 314
 315   if (!*authorization)
 316   {
 317    /*
 318     * No authorization data provided, return early...
 319     */
 320
 321     cupsdLogClient(con, CUPSD_LOG_DEBUG, "No authentication data provided.");
 322     return;
 323   }
 324 #ifdef HAVE_AUTHORIZATION_H
 325   else if (!strncmp(authorization, "AuthRef ", 8) &&
 326            httpAddrLocalhost(httpGetAddress(con->http)))
 327   {
 328     OSStatus            status;         /* Status */
 329     char                authdata[HTTP_MAX_VALUE];
 330                                         /* Nonce value from client */
 331     int                 authlen;        /* Auth string length */
 332     AuthorizationItemSet *authinfo;     /* Authorization item set */
 333
 334    /*
 335     * Get the Authorization Services data...
 336     */
 337
 338     authorization += 8;
 339     while (isspace(*authorization & 255))
 340       authorization ++;
 341
 342     authlen = sizeof(authdata);
 343     httpDecode64_2(authdata, &authlen, authorization);
 344
 345     if (authlen != kAuthorizationExternalFormLength)
 346     {
 347       cupsdLogClient(con, CUPSD_LOG_ERROR, "External Authorization reference size is incorrect.");
 348       return;
 349     }
 350
 351     if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
 352     {
 353       cupsdLogClient(con, CUPSD_LOG_ERROR, "AuthorizationCreateFromExternalForm returned %d (%s)", (int)status, cssmErrorString(status));
 354       return;
 355     }
 356
 357     username[0] = '\0';
 358
 359     if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
 360                                &authinfo))
 361     {
 362       if (authinfo->count == 1 && authinfo->items[0].value &&
 363           authinfo->items[0].valueLength >= 2)
 364       {
 365         strlcpy(username, authinfo->items[0].value, sizeof(username));
 366
 367         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef.", username);
 368       }
 369
 370       AuthorizationFreeItemSet(authinfo);
 371     }
 372
 373     if (!username[0])
 374     {
 375      /*
 376       * No username in AuthRef, grab username using peer credentials...
 377       */
 378
 379       struct passwd     *pwd;           /* Password entry for this user */
 380       cupsd_ucred_t     peercred;       /* Peer credentials */
 381       socklen_t         peersize;       /* Size of peer credentials */
 382
 383       peersize = sizeof(peercred);
 384
 385       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 386       {
 387         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 388         return;
 389       }
 390
 391       if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
 392       {
 393         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred));
 394         return;
 395       }
 396
 397       strlcpy(username, pwd->pw_name, sizeof(username));
 398
 399       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef + PeerCred.", username);
 400     }
 401
 402     con->type = CUPSD_AUTH_BASIC;
 403   }
 404 #endif /* HAVE_AUTHORIZATION_H */
 405 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
 406   else if (!strncmp(authorization, "PeerCred ", 9) &&
 407            con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
 408   {
 409    /*
 410     * Use peer credentials from domain socket connection...
 411     */
 412
 413     struct passwd       *pwd;           /* Password entry for this user */
 414     cupsd_ucred_t       peercred;       /* Peer credentials */
 415     socklen_t           peersize;       /* Size of peer credentials */
 416 #ifdef HAVE_AUTHORIZATION_H
 417     const char          *name;          /* Authorizing name */
 418     int                 no_peer = 0;    /* Don't allow peer credentials? */
 419
 420    /*
 421     * See if we should allow peer credentials...
 422     */
 423
 424     for (name = (char *)cupsArrayFirst(con->best->names);
 425          name;
 426          name = (char *)cupsArrayNext(con->best->names))
 427     {
 428       if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
 429           !_cups_strcasecmp(name, "@SYSTEM"))
 430       {
 431        /* Normally don't want peer credentials if we need an auth key... */
 432         no_peer = 1;
 433       }
 434       else if (!_cups_strcasecmp(name, "@OWNER"))
 435       {
 436        /* but if @OWNER is present then we allow it... */
 437         no_peer = 0;
 438         break;
 439       }
 440     }
 441
 442     if (no_peer)
 443     {
 444       cupsdLogClient(con, CUPSD_LOG_ERROR, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
 445       return;
 446     }
 447 #endif /* HAVE_AUTHORIZATION_H */
 448
 449     if ((pwd = getpwnam(authorization + 9)) == NULL)
 450     {
 451       cupsdLogClient(con, CUPSD_LOG_ERROR, "User \"%s\" does not exist.", authorization + 9);
 452       return;
 453     }
 454
 455     peersize = sizeof(peercred);
 456
 457 #  ifdef __APPLE__
 458     if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 459 #  else
 460     if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
 461 #  endif /* __APPLE__ */
 462     {
 463       cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 464       return;
 465     }
 466
 467     if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
 468     {
 469       cupsdLogClient(con, CUPSD_LOG_ERROR, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization + 9, CUPSD_UCRED_UID(peercred), pwd->pw_uid);
 470 #  ifdef HAVE_SYS_UCRED_H
 471       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_version=%d", peercred.cr_version);
 472       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_uid=%d", peercred.cr_uid);
 473       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_ngroups=%d", peercred.cr_ngroups);
 474       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_groups[0]=%d", peercred.cr_groups[0]);
 475 #  endif /* HAVE_SYS_UCRED_H */
 476       return;
 477     }
 478
 479     strlcpy(username, authorization + 9, sizeof(username));
 480
 481 #  ifdef HAVE_GSSAPI
 482     con->gss_uid = CUPSD_UCRED_UID(peercred);
 483 #  endif /* HAVE_GSSAPI */
 484
 485     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using PeerCred.", username);
 486
 487     con->type = CUPSD_AUTH_BASIC;
 488   }
 489 #endif /* SO_PEERCRED && AF_LOCAL */
 490   else if (!strncmp(authorization, "Local", 5) &&
 491            httpAddrLocalhost(httpGetAddress(con->http)))
 492   {
 493    /*
 494     * Get Local certificate authentication data...
 495     */
 496
 497     authorization += 5;
 498     while (isspace(*authorization & 255))
 499       authorization ++;
 500
 501     if ((localuser = cupsdFindCert(authorization)) == NULL)
 502     {
 503       cupsdLogClient(con, CUPSD_LOG_ERROR, "Local authentication certificate not found.");
 504       return;
 505     }
 506
 507     strlcpy(username, localuser->username, sizeof(username));
 508     con->type = localuser->type;
 509
 510     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using Local.", username);
 511   }
 512   else if (!strncmp(authorization, "Basic", 5))
 513   {
 514    /*
 515     * Get the Basic authentication data...
 516     */
 517
 518     int userlen;                        /* Username:password length */
 519
 520
 521     authorization += 5;
 522     while (isspace(*authorization & 255))
 523       authorization ++;
 524
 525     userlen = sizeof(username);
 526     httpDecode64_2(username, &userlen, authorization);
 527
 528    /*
 529     * Pull the username and password out...
 530     */
 531
 532     if ((ptr = strchr(username, ':')) == NULL)
 533     {
 534       cupsdLogClient(con, CUPSD_LOG_ERROR, "Missing Basic password.");
 535       return;
 536     }
 537
 538     *ptr++ = '\0';
 539
 540     if (!username[0])
 541     {
 542      /*
 543       * Username must not be empty...
 544       */
 545
 546       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic username.");
 547       return;
 548     }
 549
 550     if (!*ptr)
 551     {
 552      /*
 553       * Password must not be empty...
 554       */
 555
 556       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic password.");
 557       return;
 558     }
 559
 560     strlcpy(password, ptr, sizeof(password));
 561
 562    /*
 563     * Validate the username and password...
 564     */
 565
 566     switch (type)
 567     {
 568       default :
 569       case CUPSD_AUTH_BASIC :
 570           {
 571 #if HAVE_LIBPAM
 572            /*
 573             * Only use PAM to do authentication.  This supports MD5
 574             * passwords, among other things...
 575             */
 576
 577             pam_handle_t        *pamh;  /* PAM authentication handle */
 578             int                 pamerr; /* PAM error code */
 579             struct pam_conv     pamdata;/* PAM conversation data */
 580             cupsd_authdata_t    data;   /* Authentication data */
 581
 582
 583             strlcpy(data.username, username, sizeof(data.username));
 584             strlcpy(data.password, password, sizeof(data.password));
 585
 586 #  ifdef __sun
 587             pamdata.conv        = (int (*)(int, struct pam_message **,
 588                                            struct pam_response **,
 589                                            void *))pam_func;
 590 #  else
 591             pamdata.conv        = pam_func;
 592 #  endif /* __sun */
 593             pamdata.appdata_ptr = &data;
 594
 595             pamerr = pam_start("cups", username, &pamdata, &pamh);
 596             if (pamerr != PAM_SUCCESS)
 597             {
 598               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_start() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 599               return;
 600             }
 601
 602 #  ifdef HAVE_PAM_SET_ITEM
 603 #    ifdef PAM_RHOST
 604             pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
 605             if (pamerr != PAM_SUCCESS)
 606               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 607 #    endif /* PAM_RHOST */
 608
 609 #    ifdef PAM_TTY
 610             pamerr = pam_set_item(pamh, PAM_TTY, "cups");
 611             if (pamerr != PAM_SUCCESS)
 612               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 613 #    endif /* PAM_TTY */
 614 #  endif /* HAVE_PAM_SET_ITEM */
 615
 616             pamerr = pam_authenticate(pamh, PAM_SILENT);
 617             if (pamerr != PAM_SUCCESS)
 618             {
 619               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_authenticate() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 620               pam_end(pamh, 0);
 621               return;
 622             }
 623
 624 #  ifdef HAVE_PAM_SETCRED
 625             pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
 626             if (pamerr != PAM_SUCCESS)
 627               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_setcred() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 628 #  endif /* HAVE_PAM_SETCRED */
 629
 630             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 631             if (pamerr != PAM_SUCCESS)
 632             {
 633               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_acct_mgmt() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 634               pam_end(pamh, 0);
 635               return;
 636             }
 637
 638             pam_end(pamh, PAM_SUCCESS);
 639
 640 #else
 641            /*
 642             * Use normal UNIX password file-based authentication...
 643             */
 644
 645             char                *pass;  /* Encrypted password */
 646             struct passwd       *pw;    /* User password data */
 647 #  ifdef HAVE_SHADOW_H
 648             struct spwd         *spw;   /* Shadow password data */
 649 #  endif /* HAVE_SHADOW_H */
 650
 651
 652             pw = getpwnam(username);    /* Get the current password */
 653             endpwent();                 /* Close the password file */
 654
 655             if (!pw)
 656             {
 657              /*
 658               * No such user...
 659               */
 660
 661               cupsdLogClient(con, CUPSD_LOG_ERROR, "Unknown username \"%s\".", username);
 662               return;
 663             }
 664
 665 #  ifdef HAVE_SHADOW_H
 666             spw = getspnam(username);
 667             endspent();
 668
 669             if (!spw && !strcmp(pw->pw_passwd, "x"))
 670             {
 671              /*
 672               * Don't allow blank passwords!
 673               */
 674
 675               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no shadow password.", username);
 676               return;
 677             }
 678
 679             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 680 #  else
 681             if (!pw->pw_passwd[0])
 682 #  endif /* HAVE_SHADOW_H */
 683             {
 684              /*
 685               * Don't allow blank passwords!
 686               */
 687
 688               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no password.", username);
 689               return;
 690             }
 691
 692            /*
 693             * OK, the password isn't blank, so compare with what came from the
 694             * client...
 695             */
 696
 697             pass = cups_crypt(password, pw->pw_passwd);
 698
 699             if (!pass || strcmp(pw->pw_passwd, pass))
 700             {
 701 #  ifdef HAVE_SHADOW_H
 702               if (spw)
 703               {
 704                 pass = cups_crypt(password, spw->sp_pwdp);
 705
 706                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 707                 {
 708                   cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 709                   return;
 710                 }
 711               }
 712               else
 713 #  endif /* HAVE_SHADOW_H */
 714               {
 715                 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 716                 return;
 717               }
 718             }
 719 #endif /* HAVE_LIBPAM */
 720           }
 721
 722           cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
 723           break;
 724     }
 725
 726     con->type = type;
 727   }
 728 #ifdef HAVE_GSSAPI
 729   else if (!strncmp(authorization, "Negotiate", 9))
 730   {
 731     int                 len;            /* Length of authorization string */
 732     gss_ctx_id_t        context;        /* Authorization context */
 733     OM_uint32           major_status,   /* Major status code */
 734                         minor_status;   /* Minor status code */
 735     gss_buffer_desc     input_token = GSS_C_EMPTY_BUFFER,
 736                                         /* Input token from string */
 737                         output_token = GSS_C_EMPTY_BUFFER;
 738                                         /* Output token for username */
 739     gss_name_t          client_name;    /* Client name */
 740
 741
 742 #  ifdef __APPLE__
 743    /*
 744     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
 745     * to use it...
 746     */
 747
 748     if (&gss_init_sec_context == NULL)
 749     {
 750       cupsdLogClient(con, CUPSD_LOG_WARN, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
 751       return;
 752     }
 753 #  endif /* __APPLE__ */
 754
 755    /*
 756     * Find the start of the Kerberos input token...
 757     */
 758
 759     authorization += 9;
 760     while (isspace(*authorization & 255))
 761       authorization ++;
 762
 763     if (!*authorization)
 764     {
 765       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "No authentication data specified.");
 766       return;
 767     }
 768
 769    /*
 770     * Decode the authorization string to get the input token...
 771     */
 772
 773     len                = (int)strlen(authorization);
 774     input_token.value  = malloc((size_t)len);
 775     input_token.value  = httpDecode64_2(input_token.value, &len,
 776                                         authorization);
 777     input_token.length = (size_t)len;
 778
 779    /*
 780     * Accept the input token to get the authorization info...
 781     */
 782
 783     context      = GSS_C_NO_CONTEXT;
 784     client_name  = GSS_C_NO_NAME;
 785     major_status = gss_accept_sec_context(&minor_status,
 786                                           &context,
 787                                           ServerCreds,
 788                                           &input_token,
 789                                           GSS_C_NO_CHANNEL_BINDINGS,
 790                                           &client_name,
 791                                           NULL,
 792                                           &output_token,
 793                                           NULL,
 794                                           NULL,
 795                                           NULL);
 796
 797     if (output_token.length > 0)
 798       gss_release_buffer(&minor_status, &output_token);
 799
 800     if (GSS_ERROR(major_status))
 801     {
 802       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error accepting GSSAPI security context.", con->number);
 803
 804       if (context != GSS_C_NO_CONTEXT)
 805         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 806       return;
 807     }
 808
 809     con->have_gss = 1;
 810
 811    /*
 812     * Get the username associated with the client's credentials...
 813     */
 814
 815     if (major_status == GSS_S_CONTINUE_NEEDED)
 816       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Credentials not complete.", con->number);
 817     else if (major_status == GSS_S_COMPLETE)
 818     {
 819       major_status = gss_display_name(&minor_status, client_name,
 820                                       &output_token, NULL);
 821
 822       if (GSS_ERROR(major_status))
 823       {
 824         cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error getting username.", con->number);
 825         gss_release_name(&minor_status, &client_name);
 826         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 827         return;
 828       }
 829
 830       strlcpy(username, output_token.value, sizeof(username));
 831
 832       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Negotiate.", username);
 833
 834       gss_release_name(&minor_status, &client_name);
 835       gss_release_buffer(&minor_status, &output_token);
 836
 837       con->type = CUPSD_AUTH_NEGOTIATE;
 838     }
 839
 840     gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 841
 842 #  if defined(SO_PEERCRED) && defined(AF_LOCAL)
 843    /*
 844     * Get the client's UID if we are printing locally - that allows a backend
 845     * to run as the correct user to get Kerberos credentials of its own.
 846     */
 847
 848     if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
 849     {
 850       cupsd_ucred_t     peercred;       /* Peer credentials */
 851       socklen_t         peersize;       /* Size of peer credentials */
 852
 853       peersize = sizeof(peercred);
 854
 855 #    ifdef __APPLE__
 856       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 857 #    else
 858       if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
 859                      &peersize))
 860 #    endif /* __APPLE__ */
 861       {
 862         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 863       }
 864       else
 865       {
 866         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred));
 867         con->gss_uid = CUPSD_UCRED_UID(peercred);
 868       }
 869     }
 870 #  endif /* SO_PEERCRED && AF_LOCAL */
 871   }
 872 #endif /* HAVE_GSSAPI */
 873   else
 874   {
 875     char        scheme[256];            /* Auth scheme... */
 876
 877
 878     if (sscanf(authorization, "%255s", scheme) != 1)
 879       strlcpy(scheme, "UNKNOWN", sizeof(scheme));
 880
 881     cupsdLogClient(con, CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\".", scheme);
 882     return;
 883   }
 884
 885  /*
 886   * If we get here, then we were able to validate the username and
 887   * password - copy the validated username and password to the client
 888   * data and return...
 889   */
 890
 891   strlcpy(con->username, username, sizeof(con->username));
 892   strlcpy(con->password, password, sizeof(con->password));
 893 }
 894
 895
 896 /*
 897  * 'cupsdCheckAccess()' - Check whether the given address is allowed to
 898  *                        access a location.
 899  */
 900
 901 int                                     /* O - 1 if allowed, 0 otherwise */
 902 cupsdCheckAccess(
 903     unsigned         ip[4],             /* I - Client address */
 904     const char       *name,             /* I - Client hostname */
 905     size_t           namelen,           /* I - Length of hostname */
 906     cupsd_location_t *loc)              /* I - Location to check */
 907 {
 908   int   allow;                          /* 1 if allowed, 0 otherwise */
 909
 910
 911   if (!_cups_strcasecmp(name, "localhost"))
 912   {
 913    /*
 914     * Access from localhost (127.0.0.1 or ::1) is always allowed...
 915     */
 916
 917     return (1);
 918   }
 919   else
 920   {
 921    /*
 922     * Do authorization checks on the domain/address...
 923     */
 924
 925     switch (loc->order_type)
 926     {
 927       default :
 928           allow = 0;    /* anti-compiler-warning-code */
 929           break;
 930
 931       case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
 932           allow = 1;
 933
 934           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 935             allow = 0;
 936
 937           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 938             allow = 1;
 939           break;
 940
 941       case CUPSD_AUTH_DENY : /* Order Allow,Deny */
 942           allow = 0;
 943
 944           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 945             allow = 1;
 946
 947           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 948             allow = 0;
 949           break;
 950     }
 951   }
 952
 953   return (allow);
 954 }
 955
 956
 957 /*
 958  * 'cupsdCheckAuth()' - Check authorization masks.
 959  */
 960
 961 int                                     /* O - 1 if mask matches, 0 otherwise */
 962 cupsdCheckAuth(unsigned     ip[4],      /* I - Client address */
 963                const char   *name,      /* I - Client hostname */
 964                size_t       name_len,   /* I - Length of hostname */
 965                cups_array_t *masks)     /* I - Masks */
 966 {
 967   int                   i;              /* Looping var */
 968   cupsd_authmask_t      *mask;          /* Current mask */
 969   cupsd_netif_t         *iface;         /* Network interface */
 970   unsigned              netip4;         /* IPv4 network address */
 971 #ifdef AF_INET6
 972   unsigned              netip6[4];      /* IPv6 network address */
 973 #endif /* AF_INET6 */
 974
 975
 976   for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
 977        mask;
 978        mask = (cupsd_authmask_t *)cupsArrayNext(masks))
 979   {
 980     switch (mask->type)
 981     {
 982       case CUPSD_AUTH_INTERFACE :
 983          /*
 984           * Check for a match with a network interface...
 985           */
 986
 987           netip4 = htonl(ip[3]);
 988
 989 #ifdef AF_INET6
 990           netip6[0] = htonl(ip[0]);
 991           netip6[1] = htonl(ip[1]);
 992           netip6[2] = htonl(ip[2]);
 993           netip6[3] = htonl(ip[3]);
 994 #endif /* AF_INET6 */
 995
 996           cupsdNetIFUpdate();
 997
 998           if (!strcmp(mask->mask.name.name, "*"))
 999           {
1000 #ifdef __APPLE__
1001            /*
1002             * Allow Back-to-My-Mac addresses...
1003             */
1004
1005             if ((ip[0] & 0xff000000) == 0xfd000000)
1006               return (1);
1007 #endif /* __APPLE__ */
1008
1009            /*
1010             * Check against all local interfaces...
1011             */
1012
1013             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1014                  iface;
1015                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1016             {
1017              /*
1018               * Only check local interfaces...
1019               */
1020
1021               if (!iface->is_local)
1022                 continue;
1023
1024               if (iface->address.addr.sa_family == AF_INET)
1025               {
1026                /*
1027                 * Check IPv4 address...
1028                 */
1029
1030                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1031                     (iface->address.ipv4.sin_addr.s_addr &
1032                      iface->mask.ipv4.sin_addr.s_addr))
1033                   return (1);
1034               }
1035 #ifdef AF_INET6
1036               else
1037               {
1038                /*
1039                 * Check IPv6 address...
1040                 */
1041
1042                 for (i = 0; i < 4; i ++)
1043                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1044                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1045                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1046                     break;
1047
1048                 if (i == 4)
1049                   return (1);
1050               }
1051 #endif /* AF_INET6 */
1052             }
1053           }
1054           else
1055           {
1056            /*
1057             * Check the named interface...
1058             */
1059
1060             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1061                  iface;
1062                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1063             {
1064               if (strcmp(mask->mask.name.name, iface->name))
1065                 continue;
1066
1067               if (iface->address.addr.sa_family == AF_INET)
1068               {
1069                /*
1070                 * Check IPv4 address...
1071                 */
1072
1073                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1074                     (iface->address.ipv4.sin_addr.s_addr &
1075                      iface->mask.ipv4.sin_addr.s_addr))
1076                   return (1);
1077               }
1078 #ifdef AF_INET6
1079               else
1080               {
1081                /*
1082                 * Check IPv6 address...
1083                 */
1084
1085                 for (i = 0; i < 4; i ++)
1086                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1087                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1088                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1089                     break;
1090
1091                 if (i == 4)
1092                   return (1);
1093               }
1094 #endif /* AF_INET6 */
1095             }
1096           }
1097           break;
1098
1099       case CUPSD_AUTH_NAME :
1100          /*
1101           * Check for exact name match...
1102           */
1103
1104           if (!_cups_strcasecmp(name, mask->mask.name.name))
1105             return (1);
1106
1107          /*
1108           * Check for domain match...
1109           */
1110
1111           if (name_len >= mask->mask.name.length &&
1112               mask->mask.name.name[0] == '.' &&
1113               !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1114                           mask->mask.name.name))
1115             return (1);
1116           break;
1117
1118       case CUPSD_AUTH_IP :
1119          /*
1120           * Check for IP/network address match...
1121           */
1122
1123           for (i = 0; i < 4; i ++)
1124             if ((ip[i] & mask->mask.ip.netmask[i]) !=
1125                     mask->mask.ip.address[i])
1126               break;
1127
1128           if (i == 4)
1129             return (1);
1130           break;
1131     }
1132   }
1133
1134   return (0);
1135 }
1136
1137
1138 /*
1139  * 'cupsdCheckGroup()' - Check for a user's group membership.
1140  */
1141
1142 int                                     /* O - 1 if user is a member, 0 otherwise */
1143 cupsdCheckGroup(
1144     const char    *username,            /* I - User name */
1145     struct passwd *user,                /* I - System user info */
1146     const char    *groupname)           /* I - Group name */
1147 {
1148   int           i;                      /* Looping var */
1149   struct group  *group;                 /* System group info */
1150 #ifdef HAVE_MBR_UID_TO_UUID
1151   uuid_t        useruuid,               /* UUID for username */
1152                 groupuuid;              /* UUID for groupname */
1153   int           is_member;              /* True if user is a member of group */
1154 #endif /* HAVE_MBR_UID_TO_UUID */
1155
1156
1157   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username, user, groupname);
1158
1159  /*
1160   * Validate input...
1161   */
1162
1163   if (!username || !groupname)
1164     return (0);
1165
1166  /*
1167   * Check to see if the user is a member of the named group...
1168   */
1169
1170   group = getgrnam(groupname);
1171   endgrent();
1172
1173   if (group != NULL)
1174   {
1175    /*
1176     * Group exists, check it...
1177     */
1178
1179 #ifdef HAVE_GETGROUPLIST
1180     if (user)
1181     {
1182       int       ngroups,                /* Number of groups */
1183                 groups[2048];           /* Groups that user belongs to */
1184
1185       ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
1186       getgrouplist(username, (int)user->pw_gid, groups, &ngroups);
1187
1188       for (i = 0; i < ngroups; i ++)
1189         if ((int)group->gr_gid == groups[i])
1190           return (1);
1191     }
1192 #endif /* HAVE_GETGROUPLIST */
1193
1194     for (i = 0; group->gr_mem[i]; i ++)
1195       if (!_cups_strcasecmp(username, group->gr_mem[i]))
1196         return (1);
1197   }
1198
1199  /*
1200   * Group doesn't exist or user not in group list, check the group ID
1201   * against the user's group ID...
1202   */
1203
1204   if (user && group && group->gr_gid == user->pw_gid)
1205     return (1);
1206
1207 #ifdef HAVE_MBR_UID_TO_UUID
1208  /*
1209   * Check group membership through MacmacOS membership API...
1210   */
1211
1212   if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1213   {
1214     if (group)
1215     {
1216      /*
1217       * Map group name to UUID and check membership...
1218       */
1219
1220       if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1221         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1222           if (is_member)
1223             return (1);
1224     }
1225     else if (groupname[0] == '#')
1226     {
1227      /*
1228       * Use UUID directly and check for equality (user UUID) and
1229       * membership (group UUID)...
1230       */
1231
1232       if (!uuid_parse((char *)groupname + 1, groupuuid))
1233       {
1234         if (!uuid_compare(useruuid, groupuuid))
1235           return (1);
1236         else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1237           if (is_member)
1238             return (1);
1239       }
1240
1241       return (0);
1242     }
1243   }
1244   else if (groupname[0] == '#')
1245     return (0);
1246 #endif /* HAVE_MBR_UID_TO_UUID */
1247
1248  /*
1249   * If we get this far, then the user isn't part of the named group...
1250   */
1251
1252   return (0);
1253 }
1254
1255
1256 /*
1257  * 'cupsdCopyLocation()' - Make a copy of a location...
1258  */
1259
1260 cupsd_location_t *                      /* O - New location */
1261 cupsdCopyLocation(
1262     cupsd_location_t *loc)              /* I - Original location */
1263 {
1264   cupsd_location_t      *temp;          /* New location */
1265
1266
1267  /*
1268   * Make a copy of the original location...
1269   */
1270
1271   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1272     return (NULL);
1273
1274  /*
1275   * Copy the information from the original location to the new one.
1276   */
1277
1278   if (!loc)
1279     return (temp);
1280
1281   if (loc->location)
1282     temp->location = _cupsStrAlloc(loc->location);
1283
1284   temp->length     = loc->length;
1285   temp->limit      = loc->limit;
1286   temp->order_type = loc->order_type;
1287   temp->type       = loc->type;
1288   temp->level      = loc->level;
1289   temp->satisfy    = loc->satisfy;
1290   temp->encryption = loc->encryption;
1291
1292   if (loc->names)
1293   {
1294     if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1295     {
1296       cupsdLogMessage(CUPSD_LOG_ERROR,
1297                       "Unable to allocate memory for %d names: %s",
1298                       cupsArrayCount(loc->names), strerror(errno));
1299
1300       cupsdFreeLocation(temp);
1301       return (NULL);
1302     }
1303   }
1304
1305   if (loc->allow)
1306   {
1307    /*
1308     * Copy allow rules...
1309     */
1310
1311     if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1312     {
1313       cupsdLogMessage(CUPSD_LOG_ERROR,
1314                       "Unable to allocate memory for %d allow rules: %s",
1315                       cupsArrayCount(loc->allow), strerror(errno));
1316       cupsdFreeLocation(temp);
1317       return (NULL);
1318     }
1319   }
1320
1321   if (loc->deny)
1322   {
1323    /*
1324     * Copy deny rules...
1325     */
1326
1327     if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1328     {
1329       cupsdLogMessage(CUPSD_LOG_ERROR,
1330                       "Unable to allocate memory for %d deny rules: %s",
1331                       cupsArrayCount(loc->deny), strerror(errno));
1332       cupsdFreeLocation(temp);
1333       return (NULL);
1334     }
1335   }
1336
1337   return (temp);
1338 }
1339
1340
1341 /*
1342  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1343  */
1344
1345 void
1346 cupsdDeleteAllLocations(void)
1347 {
1348  /*
1349   * Free the location array, which will free all of the locations...
1350   */
1351
1352   cupsArrayDelete(Locations);
1353   Locations = NULL;
1354 }
1355
1356
1357 /*
1358  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1359  */
1360
1361 cupsd_location_t *                      /* O - Location that matches */
1362 cupsdFindBest(const char   *path,       /* I - Resource path */
1363               http_state_t state)       /* I - HTTP state/request */
1364 {
1365   char                  uri[HTTP_MAX_URI],
1366                                         /* URI in request... */
1367                         *uriptr;        /* Pointer into URI */
1368   cupsd_location_t      *loc,           /* Current location */
1369                         *best;          /* Best match for location so far */
1370   size_t                bestlen;        /* Length of best match */
1371   int                   limit;          /* Limit field */
1372   static const int      limits[] =      /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1373                 {
1374                   CUPSD_AUTH_LIMIT_ALL,
1375                   CUPSD_AUTH_LIMIT_OPTIONS,
1376                   CUPSD_AUTH_LIMIT_GET,
1377                   CUPSD_AUTH_LIMIT_GET,
1378                   CUPSD_AUTH_LIMIT_HEAD,
1379                   CUPSD_AUTH_LIMIT_POST,
1380                   CUPSD_AUTH_LIMIT_POST,
1381                   CUPSD_AUTH_LIMIT_POST,
1382                   CUPSD_AUTH_LIMIT_PUT,
1383                   CUPSD_AUTH_LIMIT_PUT,
1384                   CUPSD_AUTH_LIMIT_DELETE,
1385                   CUPSD_AUTH_LIMIT_TRACE,
1386                   CUPSD_AUTH_LIMIT_ALL,
1387                   CUPSD_AUTH_LIMIT_ALL,
1388                   CUPSD_AUTH_LIMIT_ALL,
1389                   CUPSD_AUTH_LIMIT_ALL
1390                 };
1391
1392
1393  /*
1394   * First copy the connection URI to a local string so we have drop
1395   * any .ppd extension from the pathname in /printers or /classes
1396   * URIs...
1397   */
1398
1399   strlcpy(uri, path, sizeof(uri));
1400
1401   if ((uriptr = strchr(uri, '?')) != NULL)
1402     *uriptr = '\0';             /* Drop trailing query string */
1403
1404   if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1405     *uriptr = '\0';             /* Remove trailing '/' */
1406
1407   if (!strncmp(uri, "/printers/", 10) ||
1408       !strncmp(uri, "/classes/", 9))
1409   {
1410    /*
1411     * Check if the URI has .ppd on the end...
1412     */
1413
1414     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1415
1416     if (!strcmp(uriptr, ".ppd"))
1417       *uriptr = '\0';
1418   }
1419
1420  /*
1421   * Loop through the list of locations to find a match...
1422   */
1423
1424   limit   = limits[state];
1425   best    = NULL;
1426   bestlen = 0;
1427
1428   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri=\"%s\", limit=%x...", uri, limit);
1429
1430
1431   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1432        loc;
1433        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1434   {
1435     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1436
1437     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1438     {
1439      /*
1440       * Use case-insensitive comparison for queue names...
1441       */
1442
1443       if (loc->length > bestlen && loc->location &&
1444           !_cups_strncasecmp(uri, loc->location, loc->length) &&
1445           loc->location[0] == '/' &&
1446           (limit & loc->limit) != 0)
1447       {
1448         best    = loc;
1449         bestlen = loc->length;
1450       }
1451     }
1452     else
1453     {
1454      /*
1455       * Use case-sensitive comparison for other URIs...
1456       */
1457
1458       if (loc->length > bestlen && loc->location &&
1459           !strncmp(uri, loc->location, loc->length) &&
1460           loc->location[0] == '/' &&
1461           (limit & loc->limit) != 0)
1462       {
1463         best    = loc;
1464         bestlen = loc->length;
1465       }
1466     }
1467   }
1468
1469  /*
1470   * Return the match, if any...
1471   */
1472
1473   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best=%s", best ? best->location : "NONE");
1474
1475   return (best);
1476 }
1477
1478
1479 /*
1480  * 'cupsdFindLocation()' - Find the named location.
1481  */
1482
1483 cupsd_location_t *                      /* O - Location that matches */
1484 cupsdFindLocation(const char *location) /* I - Connection */
1485 {
1486   cupsd_location_t      key;            /* Search key */
1487
1488
1489   key.location = (char *)location;
1490
1491   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1492 }
1493
1494
1495 /*
1496  * 'cupsdFreeLocation()' - Free all memory used by a location.
1497  */
1498
1499 void
1500 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1501 {
1502   cupsArrayDelete(loc->names);
1503   cupsArrayDelete(loc->allow);
1504   cupsArrayDelete(loc->deny);
1505
1506   _cupsStrFree(loc->location);
1507   free(loc);
1508 }
1509
1510
1511 /*
1512  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1513  */
1514
1515 http_status_t                           /* O - HTTP_OK if authorized or error code */
1516 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1517                   const char     *owner)/* I - Owner of object */
1518 {
1519   int                   i,              /* Looping vars */
1520                         auth,           /* Authorization status */
1521                         type;           /* Type of authentication */
1522   http_addr_t           *hostaddr = httpGetAddress(con->http);
1523                                         /* Client address */
1524   const char            *hostname = httpGetHostname(con->http, NULL, 0);
1525                                         /* Client hostname */
1526   unsigned              address[4];     /* Authorization address */
1527   cupsd_location_t      *best;          /* Best match for location so far */
1528   size_t                hostlen;        /* Length of hostname */
1529   char                  *name,          /* Current username */
1530                         username[256],  /* Username to authorize */
1531                         ownername[256], /* Owner name to authorize */
1532                         *ptr;           /* Pointer into username */
1533   struct passwd         *pw;            /* User password data */
1534   static const char * const levels[] =  /* Auth levels */
1535                 {
1536                   "ANON",
1537                   "USER",
1538                   "GROUP"
1539                 };
1540   static const char * const types[] =   /* Auth types */
1541                 {
1542                   "None",
1543                   "Basic",
1544                   "Negotiate"
1545                 };
1546
1547
1548   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location ? con->best->location : "(null)" : "");
1549   if (owner)
1550     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: owner=\"%s\"", owner);
1551
1552  /*
1553   * If there is no "best" authentication rule for this request, then
1554   * access is allowed from the local system and denied from other
1555   * addresses...
1556   */
1557
1558   if (!con->best)
1559   {
1560     if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1561         !strcmp(hostname, ServerName) ||
1562         cupsArrayFind(ServerAlias, (void *)hostname))
1563       return (HTTP_OK);
1564     else
1565       return (HTTP_FORBIDDEN);
1566   }
1567
1568   best = con->best;
1569
1570   if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1571     type = cupsdDefaultAuthType();
1572
1573   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels[best->level], types[type], best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1574
1575   if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1576     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)", best->op, ippOpString(best->op));
1577
1578  /*
1579   * Check host/ip-based accesses...
1580   */
1581
1582 #ifdef AF_INET6
1583   if (httpAddrFamily(hostaddr) == AF_INET6)
1584   {
1585    /*
1586     * Copy IPv6 address...
1587     */
1588
1589     address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1590     address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1591     address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1592     address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1593   }
1594   else
1595 #endif /* AF_INET6 */
1596   if (con->http->hostaddr->addr.sa_family == AF_INET)
1597   {
1598    /*
1599     * Copy IPv4 address...
1600     */
1601
1602     address[0] = 0;
1603     address[1] = 0;
1604     address[2] = 0;
1605     address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1606   }
1607   else
1608     memset(address, 0, sizeof(address));
1609
1610   hostlen = strlen(hostname);
1611
1612   auth = cupsdCheckAccess(address, hostname, hostlen, best)
1613              ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1614
1615   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth ? "DENY" : "ALLOW");
1616
1617   if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1618     return (HTTP_FORBIDDEN);
1619
1620 #ifdef HAVE_SSL
1621  /*
1622   * See if encryption is required...
1623   */
1624
1625   if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1626       _cups_strcasecmp(hostname, "localhost") &&
1627       !httpAddrLocalhost(hostaddr) &&
1628       best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1629       !(type == CUPSD_AUTH_NEGOTIATE ||
1630         (type == CUPSD_AUTH_NONE &&
1631          cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1632   {
1633     cupsdLogMessage(CUPSD_LOG_DEBUG,
1634                     "cupsdIsAuthorized: Need upgrade to TLS...");
1635     return (HTTP_UPGRADE_REQUIRED);
1636   }
1637 #endif /* HAVE_SSL */
1638
1639  /*
1640   * Now see what access level is required...
1641   */
1642
1643   if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1644       (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1645     return (HTTP_OK);
1646
1647   if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1648       best->limit == CUPSD_AUTH_LIMIT_IPP)
1649   {
1650    /*
1651     * Check for unauthenticated username...
1652     */
1653
1654     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1655
1656
1657     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1658     if (attr)
1659     {
1660       cupsdLogMessage(CUPSD_LOG_DEBUG,
1661                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1662                       attr->values[0].string.text);
1663       strlcpy(username, attr->values[0].string.text, sizeof(username));
1664     }
1665     else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1666       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1667     else
1668       return (HTTP_OK);                 /* unless overridden with Satisfy */
1669   }
1670   else
1671   {
1672     cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1673                     con->username);
1674
1675 #ifdef HAVE_AUTHORIZATION_H
1676     if (!con->username[0] && !con->authref)
1677 #else
1678     if (!con->username[0])
1679 #endif /* HAVE_AUTHORIZATION_H */
1680     {
1681       if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1682         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1683       else
1684         return (HTTP_OK);               /* unless overridden with Satisfy */
1685     }
1686
1687
1688     if (con->type != type && type != CUPSD_AUTH_NONE &&
1689 #ifdef HAVE_GSSAPI
1690         (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1691 #endif /* HAVE_GSSAPI */
1692         con->type != CUPSD_AUTH_BASIC)
1693     {
1694       cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1695                       types[con->type], types[type]);
1696
1697       return (HTTP_UNAUTHORIZED);
1698     }
1699
1700     strlcpy(username, con->username, sizeof(username));
1701   }
1702
1703  /*
1704   * OK, got a username.  See if we need normal user access, or group
1705   * access... (root always matches)
1706   */
1707
1708   if (!strcmp(username, "root"))
1709     return (HTTP_OK);
1710
1711  /*
1712   * Strip any @domain or @KDC from the username and owner...
1713   */
1714
1715   if ((ptr = strchr(username, '@')) != NULL)
1716     *ptr = '\0';
1717
1718   if (owner)
1719   {
1720     strlcpy(ownername, owner, sizeof(ownername));
1721
1722     if ((ptr = strchr(ownername, '@')) != NULL)
1723       *ptr = '\0';
1724   }
1725   else
1726     ownername[0] = '\0';
1727
1728  /*
1729   * Get the user info...
1730   */
1731
1732   if (username[0])
1733   {
1734     pw = getpwnam(username);
1735     endpwent();
1736   }
1737   else
1738     pw = NULL;
1739
1740   if (best->level == CUPSD_AUTH_USER)
1741   {
1742    /*
1743     * If there are no names associated with this location, then
1744     * any valid user is OK...
1745     */
1746
1747     if (cupsArrayCount(best->names) == 0)
1748       return (HTTP_OK);
1749
1750    /*
1751     * Otherwise check the user list and return OK if this user is
1752     * allowed...
1753     */
1754
1755     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking user membership...");
1756
1757 #ifdef HAVE_AUTHORIZATION_H
1758    /*
1759     * If an authorization reference was supplied it must match a right name...
1760     */
1761
1762     if (con->authref)
1763     {
1764       for (name = (char *)cupsArrayFirst(best->names);
1765            name;
1766            name = (char *)cupsArrayNext(best->names))
1767       {
1768         if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1769           return (HTTP_OK);
1770         else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1771                  check_authref(con, SystemGroupAuthKey))
1772           return (HTTP_OK);
1773       }
1774
1775       return (HTTP_FORBIDDEN);
1776     }
1777 #endif /* HAVE_AUTHORIZATION_H */
1778
1779     for (name = (char *)cupsArrayFirst(best->names);
1780          name;
1781          name = (char *)cupsArrayNext(best->names))
1782     {
1783       if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1784           !_cups_strcasecmp(username, ownername))
1785         return (HTTP_OK);
1786       else if (!_cups_strcasecmp(name, "@SYSTEM"))
1787       {
1788         for (i = 0; i < NumSystemGroups; i ++)
1789           if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1790             return (HTTP_OK);
1791       }
1792       else if (name[0] == '@')
1793       {
1794         if (cupsdCheckGroup(username, pw, name + 1))
1795           return (HTTP_OK);
1796       }
1797       else if (!_cups_strcasecmp(username, name))
1798         return (HTTP_OK);
1799     }
1800
1801     return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1802   }
1803
1804  /*
1805   * Check to see if this user is in any of the named groups...
1806   */
1807
1808   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group membership...");
1809
1810  /*
1811   * Check to see if this user is in any of the named groups...
1812   */
1813
1814   for (name = (char *)cupsArrayFirst(best->names);
1815        name;
1816        name = (char *)cupsArrayNext(best->names))
1817   {
1818     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1819
1820     if (!_cups_strcasecmp(name, "@SYSTEM"))
1821     {
1822       for (i = 0; i < NumSystemGroups; i ++)
1823         if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1824           return (HTTP_OK);
1825     }
1826     else if (cupsdCheckGroup(username, pw, name))
1827       return (HTTP_OK);
1828   }
1829
1830  /*
1831   * The user isn't part of the specified group, so deny access...
1832   */
1833
1834   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: User not in group(s).");
1835
1836   return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1837 }
1838
1839
1840 /*
1841  * 'cupsdNewLocation()' - Create a new location for authorization.
1842  *
1843  * Note: Still need to call cupsdAddLocation() to add it to the list of global
1844  * locations.
1845  */
1846
1847 cupsd_location_t *                      /* O - Pointer to new location record */
1848 cupsdNewLocation(const char *location)  /* I - Location path */
1849 {
1850   cupsd_location_t      *temp;          /* New location */
1851
1852
1853  /*
1854   * Try to allocate memory for the new location.
1855   */
1856
1857   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1858     return (NULL);
1859
1860  /*
1861   * Initialize the record and copy the name over...
1862   */
1863
1864   if ((temp->location = _cupsStrAlloc(location)) == NULL)
1865   {
1866     free(temp);
1867     return (NULL);
1868   }
1869
1870   temp->length = strlen(temp->location);
1871
1872  /*
1873   * Return the new record...
1874   */
1875
1876   return (temp);
1877 }
1878
1879
1880 #ifdef HAVE_AUTHORIZATION_H
1881 /*
1882  * 'check_authref()' - Check if an authorization services reference has the
1883  *                     supplied right.
1884  */
1885
1886 static int                              /* O - 1 if right is valid, 0 otherwise */
1887 check_authref(cupsd_client_t *con,      /* I - Connection */
1888               const char     *right)    /* I - Right name */
1889 {
1890   OSStatus              status;         /* OS Status */
1891   AuthorizationItem     authright;      /* Authorization right */
1892   AuthorizationRights   authrights;     /* Authorization rights */
1893   AuthorizationFlags    authflags;      /* Authorization flags */
1894
1895
1896  /*
1897   * Check to see if the user is allowed to perform the task...
1898   */
1899
1900   if (!con->authref)
1901     return (0);
1902
1903   authright.name        = right;
1904   authright.valueLength = 0;
1905   authright.value       = NULL;
1906   authright.flags       = 0;
1907
1908   authrights.count = 1;
1909   authrights.items = &authright;
1910
1911   authflags = kAuthorizationFlagDefaults |
1912               kAuthorizationFlagExtendRights;
1913
1914   if ((status = AuthorizationCopyRights(con->authref, &authrights,
1915                                         kAuthorizationEmptyEnvironment,
1916                                         authflags, NULL)) != 0)
1917   {
1918     cupsdLogMessage(CUPSD_LOG_ERROR,
1919                     "AuthorizationCopyRights(\"%s\") returned %d (%s)",
1920                     authright.name, (int)status, cssmErrorString(status));
1921     return (0);
1922   }
1923
1924   cupsdLogMessage(CUPSD_LOG_DEBUG2, "AuthorizationCopyRights(\"%s\") succeeded.", authright.name);
1925
1926   return (1);
1927 }
1928 #endif /* HAVE_AUTHORIZATION_H */
1929
1930
1931 /*
1932  * 'compare_locations()' - Compare two locations.
1933  */
1934
1935 static int                              /* O - Result of comparison */
1936 compare_locations(cupsd_location_t *a,  /* I - First location */
1937                   cupsd_location_t *b)  /* I - Second location */
1938 {
1939   return (strcmp(b->location, a->location));
1940 }
1941
1942
1943 /*
1944  * 'copy_authmask()' - Copy function for auth masks.
1945  */
1946
1947 static cupsd_authmask_t *               /* O - New auth mask */
1948 copy_authmask(cupsd_authmask_t *mask,   /* I - Existing auth mask */
1949               void             *data)   /* I - User data (unused) */
1950 {
1951   cupsd_authmask_t      *temp;          /* New auth mask */
1952
1953
1954   (void)data;
1955
1956   if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
1957   {
1958     memcpy(temp, mask, sizeof(cupsd_authmask_t));
1959
1960     if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
1961     {
1962      /*
1963       * Make a copy of the name...
1964       */
1965
1966       if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
1967       {
1968        /*
1969         * Failed to make copy...
1970         */
1971
1972         free(temp);
1973         temp = NULL;
1974       }
1975     }
1976   }
1977
1978   return (temp);
1979 }
1980
1981
1982 #if !HAVE_LIBPAM
1983 /*
1984  * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1985  *                  as needed.
1986  */
1987
1988 static char *                           /* O - Encrypted password */
1989 cups_crypt(const char *pw,              /* I - Password string */
1990            const char *salt)            /* I - Salt (key) string */
1991 {
1992   if (!strncmp(salt, "$1$", 3))
1993   {
1994    /*
1995     * Use MD5 passwords without the benefit of PAM; this is for
1996     * Slackware Linux, and the algorithm was taken from the
1997     * old shadow-19990827/lib/md5crypt.c source code... :(
1998     */
1999
2000     int                 i;              /* Looping var */
2001     unsigned long       n;              /* Output number */
2002     int                 pwlen;          /* Length of password string */
2003     const char          *salt_end;      /* End of "salt" data for MD5 */
2004     char                *ptr;           /* Pointer into result string */
2005     _cups_md5_state_t   state;          /* Primary MD5 state info */
2006     _cups_md5_state_t   state2;         /* Secondary MD5 state info */
2007     unsigned char       digest[16];     /* MD5 digest result */
2008     static char         result[120];    /* Final password string */
2009
2010
2011    /*
2012     * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2013     * Get a maximum of 8 characters of salt data after $1$...
2014     */
2015
2016     for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2017       if (*salt_end == '$')
2018         break;
2019
2020    /*
2021     * Compute the MD5 sum we need...
2022     */
2023
2024     pwlen = strlen(pw);
2025
2026     _cupsMD5Init(&state);
2027     _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2028     _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2029
2030     _cupsMD5Init(&state2);
2031     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2032     _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2033     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2034     _cupsMD5Finish(&state2, digest);
2035
2036     for (i = pwlen; i > 0; i -= 16)
2037       _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2038
2039     for (i = pwlen; i > 0; i >>= 1)
2040       _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2041
2042     _cupsMD5Finish(&state, digest);
2043
2044     for (i = 0; i < 1000; i ++)
2045     {
2046       _cupsMD5Init(&state);
2047
2048       if (i & 1)
2049         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2050       else
2051         _cupsMD5Append(&state, digest, 16);
2052
2053       if (i % 3)
2054         _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2055
2056       if (i % 7)
2057         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2058
2059       if (i & 1)
2060         _cupsMD5Append(&state, digest, 16);
2061       else
2062         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2063
2064       _cupsMD5Finish(&state, digest);
2065     }
2066
2067    /*
2068     * Copy the final sum to the result string and return...
2069     */
2070
2071     memcpy(result, salt, (size_t)(salt_end - salt));
2072     ptr = result + (salt_end - salt);
2073     *ptr++ = '$';
2074
2075     for (i = 0; i < 5; i ++, ptr += 4)
2076     {
2077       n = ((((unsigned)digest[i] << 8) | (unsigned)digest[i + 6]) << 8);
2078
2079       if (i < 4)
2080         n |= (unsigned)digest[i + 12];
2081       else
2082         n |= (unsigned)digest[5];
2083
2084       to64(ptr, n, 4);
2085     }
2086
2087     to64(ptr, (unsigned)digest[11], 2);
2088     ptr += 2;
2089     *ptr = '\0';
2090
2091     return (result);
2092   }
2093   else
2094   {
2095    /*
2096     * Use the standard crypt() function...
2097     */
2098
2099     return (crypt(pw, salt));
2100   }
2101 }
2102 #endif /* !HAVE_LIBPAM */
2103
2104
2105 /*
2106  * 'free_authmask()' - Free function for auth masks.
2107  */
2108
2109 static void
2110 free_authmask(cupsd_authmask_t *mask,   /* I - Auth mask to free */
2111               void             *data)   /* I - User data (unused) */
2112 {
2113   (void)data;
2114
2115   if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2116     _cupsStrFree(mask->mask.name.name);
2117
2118   free(mask);
2119 }
2120
2121
2122 #if HAVE_LIBPAM
2123 /*
2124  * 'pam_func()' - PAM conversation function.
2125  */
2126
2127 static int                              /* O - Success or failure */
2128 pam_func(
2129     int                      num_msg,   /* I - Number of messages */
2130     const struct pam_message **msg,     /* I - Messages */
2131     struct pam_response      **resp,    /* O - Responses */
2132     void                     *appdata_ptr)
2133                                         /* I - Pointer to connection */
2134 {
2135   int                   i;              /* Looping var */
2136   struct pam_response   *replies;       /* Replies */
2137   cupsd_authdata_t      *data;          /* Pointer to auth data */
2138
2139
2140  /*
2141   * Allocate memory for the responses...
2142   */
2143
2144   if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2145     return (PAM_CONV_ERR);
2146
2147  /*
2148   * Answer all of the messages...
2149   */
2150
2151   DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2152
2153   data = (cupsd_authdata_t *)appdata_ptr;
2154
2155   for (i = 0; i < num_msg; i ++)
2156   {
2157     DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2158
2159     switch (msg[i]->msg_style)
2160     {
2161       case PAM_PROMPT_ECHO_ON:
2162           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2163                         data->username));
2164           replies[i].resp_retcode = PAM_SUCCESS;
2165           replies[i].resp         = strdup(data->username);
2166           break;
2167
2168       case PAM_PROMPT_ECHO_OFF:
2169           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2170                         data->password));
2171           replies[i].resp_retcode = PAM_SUCCESS;
2172           replies[i].resp         = strdup(data->password);
2173           break;
2174
2175       case PAM_TEXT_INFO:
2176           DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2177           replies[i].resp_retcode = PAM_SUCCESS;
2178           replies[i].resp         = NULL;
2179           break;
2180
2181       case PAM_ERROR_MSG:
2182           DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2183           replies[i].resp_retcode = PAM_SUCCESS;
2184           replies[i].resp         = NULL;
2185           break;
2186
2187       default:
2188           DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2189                         msg[i]->msg_style));
2190           free(replies);
2191           return (PAM_CONV_ERR);
2192     }
2193   }
2194
2195  /*
2196   * Return the responses back to PAM...
2197   */
2198
2199   *resp = replies;
2200
2201   return (PAM_SUCCESS);
2202 }
2203 #else
2204
2205
2206 /*
2207  * 'to64()' - Base64-encode an integer value...
2208  */
2209
2210 static void
2211 to64(char          *s,                  /* O - Output string */
2212      unsigned long v,                   /* I - Value to encode */
2213      int           n)                   /* I - Number of digits */
2214 {
2215   const char    *itoa64 = "./0123456789"
2216                           "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2217                           "abcdefghijklmnopqrstuvwxyz";
2218
2219
2220   for (; n > 0; n --, v >>= 6)
2221     *s++ = itoa64[v & 0x3f];
2222 }
2223 #endif /* HAVE_LIBPAM */