]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Import CUPS v2.0.3
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 12604 2015-05-06 01:43:05Z msweet $"
3 *
4 * Authorization routines for the CUPS scheduler.
5 *
6 * Copyright 2007-2015 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 */
18
19 /*
20 * Include necessary headers...
21 */
22
23 #include "cupsd.h"
24 #include <grp.h>
25 #ifdef HAVE_SHADOW_H
26 # include <shadow.h>
27 #endif /* HAVE_SHADOW_H */
28 #ifdef HAVE_CRYPT_H
29 # include <crypt.h>
30 #endif /* HAVE_CRYPT_H */
31 #if HAVE_LIBPAM
32 # ifdef HAVE_PAM_PAM_APPL_H
33 # include <pam/pam_appl.h>
34 # else
35 # include <security/pam_appl.h>
36 # endif /* HAVE_PAM_PAM_APPL_H */
37 #endif /* HAVE_LIBPAM */
38 #ifdef HAVE_MEMBERSHIP_H
39 # include <membership.h>
40 #endif /* HAVE_MEMBERSHIP_H */
41 #ifdef HAVE_AUTHORIZATION_H
42 # include <Security/AuthorizationTags.h>
43 # ifdef HAVE_SECBASEPRIV_H
44 # include <Security/SecBasePriv.h>
45 # else
46 extern const char *cssmErrorString(int error);
47 # endif /* HAVE_SECBASEPRIV_H */
48 #endif /* HAVE_AUTHORIZATION_H */
49 #ifdef HAVE_SYS_PARAM_H
50 # include <sys/param.h>
51 #endif /* HAVE_SYS_PARAM_H */
52 #ifdef HAVE_SYS_UCRED_H
53 # include <sys/ucred.h>
54 typedef struct xucred cupsd_ucred_t;
55 # define CUPSD_UCRED_UID(c) (c).cr_uid
56 #else
57 # ifndef __OpenBSD__
58 typedef struct ucred cupsd_ucred_t;
59 # else
60 typedef struct sockpeercred cupsd_ucred_t;
61 # endif
62 # define CUPSD_UCRED_UID(c) (c).uid
63 #endif /* HAVE_SYS_UCRED_H */
64
65
66 /*
67 * Local functions...
68 */
69
70 #ifdef HAVE_AUTHORIZATION_H
71 static int check_authref(cupsd_client_t *con, const char *right);
72 #endif /* HAVE_AUTHORIZATION_H */
73 static int compare_locations(cupsd_location_t *a,
74 cupsd_location_t *b);
75 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
76 #if !HAVE_LIBPAM
77 static char *cups_crypt(const char *pw, const char *salt);
78 #endif /* !HAVE_LIBPAM */
79 static void free_authmask(cupsd_authmask_t *am, void *data);
80 #if HAVE_LIBPAM
81 static int pam_func(int, const struct pam_message **,
82 struct pam_response **, void *);
83 #else
84 static void to64(char *s, unsigned long v, int n);
85 #endif /* HAVE_LIBPAM */
86
87
88 /*
89 * Local structures...
90 */
91
92 #if HAVE_LIBPAM
93 typedef struct cupsd_authdata_s /**** Authentication data ****/
94 {
95 char username[HTTP_MAX_VALUE], /* Username string */
96 password[HTTP_MAX_VALUE]; /* Password string */
97 } cupsd_authdata_t;
98 #endif /* HAVE_LIBPAM */
99
100
101 /*
102 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
103 */
104
105 int /* O - 1 on success, 0 on failure */
106 cupsdAddIPMask(
107 cups_array_t **masks, /* IO - Masks array (created as needed) */
108 const unsigned address[4], /* I - IP address */
109 const unsigned netmask[4]) /* I - IP netmask */
110 {
111 cupsd_authmask_t temp; /* New host/domain mask */
112
113
114 cupsdLogMessage(CUPSD_LOG_DEBUG2,
115 "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, "
116 "netmask=%x:%x:%x:%x)",
117 masks, *masks,
118 address[0], address[1], address[2], address[3],
119 netmask[0], netmask[1], netmask[2], netmask[3]);
120
121 temp.type = CUPSD_AUTH_IP;
122 memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
123 memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
124
125 /*
126 * Create the masks array as needed and add...
127 */
128
129 if (!*masks)
130 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
131 (cups_acopy_func_t)copy_authmask,
132 (cups_afree_func_t)free_authmask);
133
134 return (cupsArrayAdd(*masks, &temp));
135 }
136
137
138 /*
139 * 'cupsdAddLocation()' - Add a location for authorization.
140 */
141
142 void
143 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
144 {
145 /*
146 * Make sure the locations array is created...
147 */
148
149 if (!Locations)
150 Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
151 (cups_ahash_func_t)NULL, 0,
152 (cups_acopy_func_t)NULL,
153 (cups_afree_func_t)cupsdFreeLocation);
154
155 if (Locations)
156 {
157 cupsArrayAdd(Locations, loc);
158
159 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"",
160 loc->location ? loc->location : "(null)");
161 }
162 }
163
164
165 /*
166 * 'cupsdAddName()' - Add a name to a location...
167 */
168
169 void
170 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
171 char *name) /* I - Name to add */
172 {
173 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
174 loc, name);
175
176 if (!loc->names)
177 loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
178 (cups_acopy_func_t)_cupsStrAlloc,
179 (cups_afree_func_t)_cupsStrFree);
180
181 if (!cupsArrayAdd(loc->names, name))
182 {
183 cupsdLogMessage(CUPSD_LOG_ERROR,
184 "Unable to duplicate name for location %s: %s",
185 loc->location ? loc->location : "nil", strerror(errno));
186 return;
187 }
188 }
189
190
191 /*
192 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
193 */
194
195 int /* O - 1 on success, 0 on failure */
196 cupsdAddNameMask(cups_array_t **masks, /* IO - Masks array (created as needed) */
197 char *name) /* I - Host or interface name */
198 {
199 cupsd_authmask_t temp; /* New host/domain mask */
200 char ifname[32], /* Interface name */
201 *ifptr; /* Pointer to end of name */
202
203
204 cupsdLogMessage(CUPSD_LOG_DEBUG2,
205 "cupsdAddNameMask(masks=%p(%p), name=\"%s\")",
206 masks, *masks, name);
207
208 if (!_cups_strcasecmp(name, "@LOCAL"))
209 {
210 /*
211 * Deny *interface*...
212 */
213
214 temp.type = CUPSD_AUTH_INTERFACE;
215 temp.mask.name.name = (char *)"*";
216 }
217 else if (!_cups_strncasecmp(name, "@IF(", 4))
218 {
219 /*
220 * Deny *interface*...
221 */
222
223 strlcpy(ifname, name + 4, sizeof(ifname));
224
225 ifptr = ifname + strlen(ifname) - 1;
226
227 if (ifptr >= ifname && *ifptr == ')')
228 {
229 ifptr --;
230 *ifptr = '\0';
231 }
232
233 temp.type = CUPSD_AUTH_INTERFACE;
234 temp.mask.name.name = ifname;
235 }
236 else
237 {
238 /*
239 * Deny name...
240 */
241
242 if (*name == '*')
243 name ++;
244
245 temp.type = CUPSD_AUTH_NAME;
246 temp.mask.name.name = (char *)name;
247 }
248
249 /*
250 * Set the name length...
251 */
252
253 temp.mask.name.length = strlen(temp.mask.name.name);
254
255 /*
256 * Create the masks array as needed and add...
257 */
258
259 if (!*masks)
260 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
261 (cups_acopy_func_t)copy_authmask,
262 (cups_afree_func_t)free_authmask);
263
264 return (cupsArrayAdd(*masks, &temp));
265 }
266
267
268 /*
269 * 'cupsdAuthorize()' - Validate any authorization credentials.
270 */
271
272 void
273 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
274 {
275 int type; /* Authentication type */
276 const char *authorization; /* Pointer into Authorization string */
277 char *ptr, /* Pointer into string */
278 username[HTTP_MAX_VALUE],
279 /* Username string */
280 password[HTTP_MAX_VALUE];
281 /* Password string */
282 cupsd_cert_t *localuser; /* Certificate username */
283
284
285 /*
286 * Locate the best matching location so we know what kind of
287 * authentication to expect...
288 */
289
290 con->best = cupsdFindBest(con->uri, httpGetState(con->http));
291 con->type = CUPSD_AUTH_NONE;
292
293 cupsdLogMessage(CUPSD_LOG_DEBUG2,
294 "[Client %d] con->uri=\"%s\", con->best=%p(%s)",
295 con->number, con->uri, con->best,
296 con->best ? con->best->location : "");
297
298 if (con->best && con->best->type != CUPSD_AUTH_NONE)
299 {
300 if (con->best->type == CUPSD_AUTH_DEFAULT)
301 type = cupsdDefaultAuthType();
302 else
303 type = con->best->type;
304 }
305 else
306 type = cupsdDefaultAuthType();
307
308 /*
309 * Decode the Authorization string...
310 */
311
312 authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
313
314 cupsdLogMessage(CUPSD_LOG_DEBUG2, "[Client %d] Authorization=\"%s\"",
315 con->number, authorization);
316
317 username[0] = '\0';
318 password[0] = '\0';
319
320 #ifdef HAVE_GSSAPI
321 con->gss_uid = 0;
322 #endif /* HAVE_GSSAPI */
323
324 #ifdef HAVE_AUTHORIZATION_H
325 if (con->authref)
326 {
327 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
328 con->authref = NULL;
329 }
330 #endif /* HAVE_AUTHORIZATION_H */
331
332 if (!*authorization)
333 {
334 /*
335 * No authorization data provided, return early...
336 */
337
338 cupsdLogMessage(CUPSD_LOG_DEBUG,
339 "[Client %d] No authentication data provided.",
340 con->number);
341 return;
342 }
343 #ifdef HAVE_AUTHORIZATION_H
344 else if (!strncmp(authorization, "AuthRef ", 8) &&
345 httpAddrLocalhost(httpGetAddress(con->http)))
346 {
347 OSStatus status; /* Status */
348 char authdata[HTTP_MAX_VALUE];
349 /* Nonce value from client */
350 int authlen; /* Auth string length */
351 AuthorizationItemSet *authinfo; /* Authorization item set */
352
353 /*
354 * Get the Authorization Services data...
355 */
356
357 authorization += 8;
358 while (isspace(*authorization & 255))
359 authorization ++;
360
361 authlen = sizeof(authdata);
362 httpDecode64_2(authdata, &authlen, authorization);
363
364 if (authlen != kAuthorizationExternalFormLength)
365 {
366 cupsdLogMessage(CUPSD_LOG_ERROR,
367 "[Client %d] External Authorization reference size is "
368 "incorrect.", con->number);
369 return;
370 }
371
372 if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
373 {
374 cupsdLogMessage(CUPSD_LOG_ERROR,
375 "[Client %d] AuthorizationCreateFromExternalForm "
376 "returned %d (%s)", con->number, (int)status,
377 cssmErrorString(status));
378 return;
379 }
380
381 username[0] = '\0';
382
383 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
384 &authinfo))
385 {
386 if (authinfo->count == 1 && authinfo->items[0].value &&
387 authinfo->items[0].valueLength >= 2)
388 {
389 strlcpy(username, authinfo->items[0].value, sizeof(username));
390
391 cupsdLogMessage(CUPSD_LOG_DEBUG,
392 "[Client %d] Authorized as \"%s\" using AuthRef",
393 con->number, username);
394 }
395
396 AuthorizationFreeItemSet(authinfo);
397 }
398
399 if (!username[0])
400 {
401 /*
402 * No username in AuthRef, grab username using peer credentials...
403 */
404
405 struct passwd *pwd; /* Password entry for this user */
406 cupsd_ucred_t peercred; /* Peer credentials */
407 socklen_t peersize; /* Size of peer credentials */
408
409 peersize = sizeof(peercred);
410
411 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
412 {
413 cupsdLogMessage(CUPSD_LOG_ERROR,
414 "[Client %d] Unable to get peer credentials - %s",
415 con->number, strerror(errno));
416 return;
417 }
418
419 if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
420 {
421 cupsdLogMessage(CUPSD_LOG_ERROR,
422 "[Client %d] Unable to find UID %d for peer "
423 "credentials.", con->number,
424 (int)CUPSD_UCRED_UID(peercred));
425 return;
426 }
427
428 strlcpy(username, pwd->pw_name, sizeof(username));
429
430 cupsdLogMessage(CUPSD_LOG_DEBUG,
431 "[Client %d] Authorized as \"%s\" using "
432 "AuthRef + PeerCred", con->number, username);
433 }
434
435 con->type = CUPSD_AUTH_BASIC;
436 }
437 #endif /* HAVE_AUTHORIZATION_H */
438 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
439 else if (!strncmp(authorization, "PeerCred ", 9) &&
440 con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
441 {
442 /*
443 * Use peer credentials from domain socket connection...
444 */
445
446 struct passwd *pwd; /* Password entry for this user */
447 cupsd_ucred_t peercred; /* Peer credentials */
448 socklen_t peersize; /* Size of peer credentials */
449 #ifdef HAVE_AUTHORIZATION_H
450 const char *name; /* Authorizing name */
451 int no_peer = 0; /* Don't allow peer credentials? */
452
453 /*
454 * See if we should allow peer credentials...
455 */
456
457 for (name = (char *)cupsArrayFirst(con->best->names);
458 name;
459 name = (char *)cupsArrayNext(con->best->names))
460 {
461 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
462 !_cups_strcasecmp(name, "@SYSTEM"))
463 {
464 /* Normally don't want peer credentials if we need an auth key... */
465 no_peer = 1;
466 }
467 else if (!_cups_strcasecmp(name, "@OWNER"))
468 {
469 /* but if @OWNER is present then we allow it... */
470 no_peer = 0;
471 break;
472 }
473 }
474
475 if (no_peer)
476 {
477 cupsdLogMessage(CUPSD_LOG_ERROR,
478 "[Client %d] PeerCred authentication not allowed for "
479 "resource per AUTHKEY policy.", con->number);
480 return;
481 }
482 #endif /* HAVE_AUTHORIZATION_H */
483
484 if ((pwd = getpwnam(authorization + 9)) == NULL)
485 {
486 cupsdLogMessage(CUPSD_LOG_ERROR,
487 "[Client %d] User \"%s\" does not exist.", con->number,
488 authorization + 9);
489 return;
490 }
491
492 peersize = sizeof(peercred);
493
494 # ifdef __APPLE__
495 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
496 # else
497 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
498 # endif /* __APPLE__ */
499 {
500 cupsdLogMessage(CUPSD_LOG_ERROR,
501 "[Client %d] Unable to get peer credentials - %s",
502 con->number, strerror(errno));
503 return;
504 }
505
506 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
507 {
508 cupsdLogMessage(CUPSD_LOG_ERROR,
509 "[Client %d] Invalid peer credentials for \"%s\" - got "
510 "%d, expected %d!", con->number, authorization + 9,
511 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
512 # ifdef HAVE_SYS_UCRED_H
513 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_version=%d",
514 con->number, peercred.cr_version);
515 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_uid=%d",
516 con->number, peercred.cr_uid);
517 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_ngroups=%d",
518 con->number, peercred.cr_ngroups);
519 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_groups[0]=%d",
520 con->number, peercred.cr_groups[0]);
521 # endif /* HAVE_SYS_UCRED_H */
522 return;
523 }
524
525 strlcpy(username, authorization + 9, sizeof(username));
526
527 # ifdef HAVE_GSSAPI
528 con->gss_uid = CUPSD_UCRED_UID(peercred);
529 # endif /* HAVE_GSSAPI */
530
531 cupsdLogMessage(CUPSD_LOG_DEBUG,
532 "[Client %d] Authorized as %s using PeerCred", con->number,
533 username);
534
535 con->type = CUPSD_AUTH_BASIC;
536 }
537 #endif /* SO_PEERCRED && AF_LOCAL */
538 else if (!strncmp(authorization, "Local", 5) &&
539 httpAddrLocalhost(httpGetAddress(con->http)))
540 {
541 /*
542 * Get Local certificate authentication data...
543 */
544
545 authorization += 5;
546 while (isspace(*authorization & 255))
547 authorization ++;
548
549 if ((localuser = cupsdFindCert(authorization)) == NULL)
550 {
551 cupsdLogMessage(CUPSD_LOG_ERROR,
552 "[Client %d] Local authentication certificate not found.",
553 con->number);
554 return;
555 }
556
557 strlcpy(username, localuser->username, sizeof(username));
558 con->type = localuser->type;
559
560 cupsdLogMessage(CUPSD_LOG_DEBUG,
561 "[Client %d] Authorized as %s using Local", con->number,
562 username);
563 }
564 else if (!strncmp(authorization, "Basic", 5))
565 {
566 /*
567 * Get the Basic authentication data...
568 */
569
570 int userlen; /* Username:password length */
571
572
573 authorization += 5;
574 while (isspace(*authorization & 255))
575 authorization ++;
576
577 userlen = sizeof(username);
578 httpDecode64_2(username, &userlen, authorization);
579
580 /*
581 * Pull the username and password out...
582 */
583
584 if ((ptr = strchr(username, ':')) == NULL)
585 {
586 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Missing Basic password.",
587 con->number);
588 return;
589 }
590
591 *ptr++ = '\0';
592
593 if (!username[0])
594 {
595 /*
596 * Username must not be empty...
597 */
598
599 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Empty Basic username.",
600 con->number);
601 return;
602 }
603
604 if (!*ptr)
605 {
606 /*
607 * Password must not be empty...
608 */
609
610 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Empty Basic password.",
611 con->number);
612 return;
613 }
614
615 strlcpy(password, ptr, sizeof(password));
616
617 /*
618 * Validate the username and password...
619 */
620
621 switch (type)
622 {
623 default :
624 case CUPSD_AUTH_BASIC :
625 {
626 #if HAVE_LIBPAM
627 /*
628 * Only use PAM to do authentication. This supports MD5
629 * passwords, among other things...
630 */
631
632 pam_handle_t *pamh; /* PAM authentication handle */
633 int pamerr; /* PAM error code */
634 struct pam_conv pamdata;/* PAM conversation data */
635 cupsd_authdata_t data; /* Authentication data */
636
637
638 strlcpy(data.username, username, sizeof(data.username));
639 strlcpy(data.password, password, sizeof(data.password));
640
641 # ifdef __sun
642 pamdata.conv = (int (*)(int, struct pam_message **,
643 struct pam_response **,
644 void *))pam_func;
645 # else
646 pamdata.conv = pam_func;
647 # endif /* __sun */
648 pamdata.appdata_ptr = &data;
649
650 pamerr = pam_start("cups", username, &pamdata, &pamh);
651 if (pamerr != PAM_SUCCESS)
652 {
653 cupsdLogMessage(CUPSD_LOG_ERROR,
654 "[Client %d] pam_start() returned %d (%s)",
655 con->number, pamerr, pam_strerror(pamh, pamerr));
656 return;
657 }
658
659 # ifdef HAVE_PAM_SET_ITEM
660 # ifdef PAM_RHOST
661 pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
662 if (pamerr != PAM_SUCCESS)
663 cupsdLogMessage(CUPSD_LOG_WARN,
664 "[Client %d] pam_set_item(PAM_RHOST) "
665 "returned %d (%s)", con->number, pamerr,
666 pam_strerror(pamh, pamerr));
667 # endif /* PAM_RHOST */
668
669 # ifdef PAM_TTY
670 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
671 if (pamerr != PAM_SUCCESS)
672 cupsdLogMessage(CUPSD_LOG_WARN,
673 "[Client %d] pam_set_item(PAM_TTY) "
674 "returned %d (%s)!", con->number, pamerr,
675 pam_strerror(pamh, pamerr));
676 # endif /* PAM_TTY */
677 # endif /* HAVE_PAM_SET_ITEM */
678
679 pamerr = pam_authenticate(pamh, PAM_SILENT);
680 if (pamerr != PAM_SUCCESS)
681 {
682 cupsdLogMessage(CUPSD_LOG_ERROR,
683 "[Client %d] pam_authenticate() returned %d (%s)",
684 con->number, pamerr, pam_strerror(pamh, pamerr));
685 pam_end(pamh, 0);
686 return;
687 }
688
689 # ifdef HAVE_PAM_SETCRED
690 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
691 if (pamerr != PAM_SUCCESS)
692 cupsdLogMessage(CUPSD_LOG_WARN,
693 "[Client %d] pam_setcred() returned %d (%s)",
694 con->number, pamerr,
695 pam_strerror(pamh, pamerr));
696 # endif /* HAVE_PAM_SETCRED */
697
698 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
699 if (pamerr != PAM_SUCCESS)
700 {
701 cupsdLogMessage(CUPSD_LOG_ERROR,
702 "[Client %d] pam_acct_mgmt() returned %d (%s)",
703 con->number, pamerr, pam_strerror(pamh, pamerr));
704 pam_end(pamh, 0);
705 return;
706 }
707
708 pam_end(pamh, PAM_SUCCESS);
709
710 #else
711 /*
712 * Use normal UNIX password file-based authentication...
713 */
714
715 char *pass; /* Encrypted password */
716 struct passwd *pw; /* User password data */
717 # ifdef HAVE_SHADOW_H
718 struct spwd *spw; /* Shadow password data */
719 # endif /* HAVE_SHADOW_H */
720
721
722 pw = getpwnam(username); /* Get the current password */
723 endpwent(); /* Close the password file */
724
725 if (!pw)
726 {
727 /*
728 * No such user...
729 */
730
731 cupsdLogMessage(CUPSD_LOG_ERROR,
732 "[Client %d] Unknown username \"%s\".",
733 con->number, username);
734 return;
735 }
736
737 # ifdef HAVE_SHADOW_H
738 spw = getspnam(username);
739 endspent();
740
741 if (!spw && !strcmp(pw->pw_passwd, "x"))
742 {
743 /*
744 * Don't allow blank passwords!
745 */
746
747 cupsdLogMessage(CUPSD_LOG_ERROR,
748 "[Client %d] Username \"%s\" has no shadow "
749 "password.", con->number, username);
750 return;
751 }
752
753 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
754 # else
755 if (!pw->pw_passwd[0])
756 # endif /* HAVE_SHADOW_H */
757 {
758 /*
759 * Don't allow blank passwords!
760 */
761
762 cupsdLogMessage(CUPSD_LOG_ERROR,
763 "[Client %d] Username \"%s\" has no password.",
764 con->number, username);
765 return;
766 }
767
768 /*
769 * OK, the password isn't blank, so compare with what came from the
770 * client...
771 */
772
773 pass = cups_crypt(password, pw->pw_passwd);
774
775 cupsdLogMessage(CUPSD_LOG_DEBUG2,
776 "[Client %d] pw_passwd=\"%s\", crypt=\"%s\"",
777 con->number, pw->pw_passwd, pass);
778
779 if (!pass || strcmp(pw->pw_passwd, pass))
780 {
781 # ifdef HAVE_SHADOW_H
782 if (spw)
783 {
784 pass = cups_crypt(password, spw->sp_pwdp);
785
786 cupsdLogMessage(CUPSD_LOG_DEBUG2,
787 "[Client %d] sp_pwdp=\"%s\", crypt=\"%s\"",
788 con->number, spw->sp_pwdp, pass);
789
790 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
791 {
792 cupsdLogMessage(CUPSD_LOG_ERROR,
793 "[Client %d] Authentication failed for user "
794 "\"%s\".", con->number, username);
795 return;
796 }
797 }
798 else
799 # endif /* HAVE_SHADOW_H */
800 {
801 cupsdLogMessage(CUPSD_LOG_ERROR,
802 "[Client %d] Authentication failed for user "
803 "\"%s\".", con->number, username);
804 return;
805 }
806 }
807 #endif /* HAVE_LIBPAM */
808 }
809
810 cupsdLogMessage(CUPSD_LOG_DEBUG,
811 "[Client %d] Authorized as %s using Basic",
812 con->number, username);
813 break;
814 }
815
816 con->type = type;
817 }
818 #ifdef HAVE_GSSAPI
819 else if (!strncmp(authorization, "Negotiate", 9))
820 {
821 int len; /* Length of authorization string */
822 gss_ctx_id_t context; /* Authorization context */
823 OM_uint32 major_status, /* Major status code */
824 minor_status; /* Minor status code */
825 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
826 /* Input token from string */
827 output_token = GSS_C_EMPTY_BUFFER;
828 /* Output token for username */
829 gss_name_t client_name; /* Client name */
830
831
832 # ifdef __APPLE__
833 /*
834 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
835 * to use it...
836 */
837
838 if (&gss_init_sec_context == NULL)
839 {
840 cupsdLogMessage(CUPSD_LOG_WARN,
841 "[Client %d] GSSAPI/Kerberos authentication failed "
842 "because the Kerberos framework is not present.",
843 con->number);
844 return;
845 }
846 # endif /* __APPLE__ */
847
848 /*
849 * Find the start of the Kerberos input token...
850 */
851
852 authorization += 9;
853 while (isspace(*authorization & 255))
854 authorization ++;
855
856 if (!*authorization)
857 {
858 cupsdLogMessage(CUPSD_LOG_DEBUG2,
859 "[Client %d] No authentication data specified.",
860 con->number);
861 return;
862 }
863
864 /*
865 * Decode the authorization string to get the input token...
866 */
867
868 len = (int)strlen(authorization);
869 input_token.value = malloc((size_t)len);
870 input_token.value = httpDecode64_2(input_token.value, &len,
871 authorization);
872 input_token.length = (size_t)len;
873
874 /*
875 * Accept the input token to get the authorization info...
876 */
877
878 context = GSS_C_NO_CONTEXT;
879 client_name = GSS_C_NO_NAME;
880 major_status = gss_accept_sec_context(&minor_status,
881 &context,
882 ServerCreds,
883 &input_token,
884 GSS_C_NO_CHANNEL_BINDINGS,
885 &client_name,
886 NULL,
887 &output_token,
888 NULL,
889 NULL,
890 NULL);
891
892 if (output_token.length > 0)
893 gss_release_buffer(&minor_status, &output_token);
894
895 if (GSS_ERROR(major_status))
896 {
897 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
898 "[Client %d] Error accepting GSSAPI security context",
899 con->number);
900
901 if (context != GSS_C_NO_CONTEXT)
902 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
903 return;
904 }
905
906 con->have_gss = 1;
907
908 /*
909 * Get the username associated with the client's credentials...
910 */
911
912 if (major_status == GSS_S_CONTINUE_NEEDED)
913 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
914 "[Client %d] Credentials not complete", con->number);
915 else if (major_status == GSS_S_COMPLETE)
916 {
917 major_status = gss_display_name(&minor_status, client_name,
918 &output_token, NULL);
919
920 if (GSS_ERROR(major_status))
921 {
922 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
923 "[Client %d] Error getting username", con->number);
924 gss_release_name(&minor_status, &client_name);
925 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
926 return;
927 }
928
929 strlcpy(username, output_token.value, sizeof(username));
930
931 cupsdLogMessage(CUPSD_LOG_DEBUG,
932 "[Client %d] Authorized as %s using Negotiate",
933 con->number, username);
934
935 gss_release_name(&minor_status, &client_name);
936 gss_release_buffer(&minor_status, &output_token);
937
938 con->type = CUPSD_AUTH_NEGOTIATE;
939 }
940
941 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
942
943 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
944 /*
945 * Get the client's UID if we are printing locally - that allows a backend
946 * to run as the correct user to get Kerberos credentials of its own.
947 */
948
949 if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
950 {
951 cupsd_ucred_t peercred; /* Peer credentials */
952 socklen_t peersize; /* Size of peer credentials */
953
954 peersize = sizeof(peercred);
955
956 # ifdef __APPLE__
957 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
958 # else
959 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
960 &peersize))
961 # endif /* __APPLE__ */
962 {
963 cupsdLogMessage(CUPSD_LOG_ERROR,
964 "[Client %d] Unable to get peer credentials - %s",
965 con->number, strerror(errno));
966 }
967 else
968 {
969 cupsdLogMessage(CUPSD_LOG_DEBUG,
970 "[Client %d] Using credentials for UID %d.",
971 con->number, CUPSD_UCRED_UID(peercred));
972 con->gss_uid = CUPSD_UCRED_UID(peercred);
973 }
974 }
975 # endif /* SO_PEERCRED && AF_LOCAL */
976 }
977 #endif /* HAVE_GSSAPI */
978 else
979 {
980 char scheme[256]; /* Auth scheme... */
981
982
983 if (sscanf(authorization, "%255s", scheme) != 1)
984 strlcpy(scheme, "UNKNOWN", sizeof(scheme));
985
986 cupsdLogMessage(CUPSD_LOG_ERROR,
987 "[Client %d] Bad authentication data \"%s ...\"",
988 con->number, scheme);
989 return;
990 }
991
992 /*
993 * If we get here, then we were able to validate the username and
994 * password - copy the validated username and password to the client
995 * data and return...
996 */
997
998 strlcpy(con->username, username, sizeof(con->username));
999 strlcpy(con->password, password, sizeof(con->password));
1000 }
1001
1002
1003 /*
1004 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1005 * access a location.
1006 */
1007
1008 int /* O - 1 if allowed, 0 otherwise */
1009 cupsdCheckAccess(
1010 unsigned ip[4], /* I - Client address */
1011 const char *name, /* I - Client hostname */
1012 size_t namelen, /* I - Length of hostname */
1013 cupsd_location_t *loc) /* I - Location to check */
1014 {
1015 int allow; /* 1 if allowed, 0 otherwise */
1016
1017
1018 if (!_cups_strcasecmp(name, "localhost"))
1019 {
1020 /*
1021 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1022 */
1023
1024 return (1);
1025 }
1026 else
1027 {
1028 /*
1029 * Do authorization checks on the domain/address...
1030 */
1031
1032 switch (loc->order_type)
1033 {
1034 default :
1035 allow = 0; /* anti-compiler-warning-code */
1036 break;
1037
1038 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
1039 allow = 1;
1040
1041 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1042 allow = 0;
1043
1044 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1045 allow = 1;
1046 break;
1047
1048 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
1049 allow = 0;
1050
1051 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1052 allow = 1;
1053
1054 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1055 allow = 0;
1056 break;
1057 }
1058 }
1059
1060 return (allow);
1061 }
1062
1063
1064 /*
1065 * 'cupsdCheckAuth()' - Check authorization masks.
1066 */
1067
1068 int /* O - 1 if mask matches, 0 otherwise */
1069 cupsdCheckAuth(unsigned ip[4], /* I - Client address */
1070 const char *name, /* I - Client hostname */
1071 size_t name_len, /* I - Length of hostname */
1072 cups_array_t *masks) /* I - Masks */
1073 {
1074 int i; /* Looping var */
1075 cupsd_authmask_t *mask; /* Current mask */
1076 cupsd_netif_t *iface; /* Network interface */
1077 unsigned netip4; /* IPv4 network address */
1078 #ifdef AF_INET6
1079 unsigned netip6[4]; /* IPv6 network address */
1080 #endif /* AF_INET6 */
1081
1082
1083 for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
1084 mask;
1085 mask = (cupsd_authmask_t *)cupsArrayNext(masks))
1086 {
1087 switch (mask->type)
1088 {
1089 case CUPSD_AUTH_INTERFACE :
1090 /*
1091 * Check for a match with a network interface...
1092 */
1093
1094 netip4 = htonl(ip[3]);
1095
1096 #ifdef AF_INET6
1097 netip6[0] = htonl(ip[0]);
1098 netip6[1] = htonl(ip[1]);
1099 netip6[2] = htonl(ip[2]);
1100 netip6[3] = htonl(ip[3]);
1101 #endif /* AF_INET6 */
1102
1103 cupsdNetIFUpdate();
1104
1105 if (!strcmp(mask->mask.name.name, "*"))
1106 {
1107 #ifdef __APPLE__
1108 /*
1109 * Allow Back-to-My-Mac addresses...
1110 */
1111
1112 if ((ip[0] & 0xff000000) == 0xfd000000)
1113 return (1);
1114 #endif /* __APPLE__ */
1115
1116 /*
1117 * Check against all local interfaces...
1118 */
1119
1120 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1121 iface;
1122 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1123 {
1124 /*
1125 * Only check local interfaces...
1126 */
1127
1128 if (!iface->is_local)
1129 continue;
1130
1131 if (iface->address.addr.sa_family == AF_INET)
1132 {
1133 /*
1134 * Check IPv4 address...
1135 */
1136
1137 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1138 (iface->address.ipv4.sin_addr.s_addr &
1139 iface->mask.ipv4.sin_addr.s_addr))
1140 return (1);
1141 }
1142 #ifdef AF_INET6
1143 else
1144 {
1145 /*
1146 * Check IPv6 address...
1147 */
1148
1149 for (i = 0; i < 4; i ++)
1150 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1151 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1152 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1153 break;
1154
1155 if (i == 4)
1156 return (1);
1157 }
1158 #endif /* AF_INET6 */
1159 }
1160 }
1161 else
1162 {
1163 /*
1164 * Check the named interface...
1165 */
1166
1167 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1168 iface;
1169 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1170 {
1171 if (strcmp(mask->mask.name.name, iface->name))
1172 continue;
1173
1174 if (iface->address.addr.sa_family == AF_INET)
1175 {
1176 /*
1177 * Check IPv4 address...
1178 */
1179
1180 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1181 (iface->address.ipv4.sin_addr.s_addr &
1182 iface->mask.ipv4.sin_addr.s_addr))
1183 return (1);
1184 }
1185 #ifdef AF_INET6
1186 else
1187 {
1188 /*
1189 * Check IPv6 address...
1190 */
1191
1192 for (i = 0; i < 4; i ++)
1193 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1194 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1195 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1196 break;
1197
1198 if (i == 4)
1199 return (1);
1200 }
1201 #endif /* AF_INET6 */
1202 }
1203 }
1204 break;
1205
1206 case CUPSD_AUTH_NAME :
1207 /*
1208 * Check for exact name match...
1209 */
1210
1211 if (!_cups_strcasecmp(name, mask->mask.name.name))
1212 return (1);
1213
1214 /*
1215 * Check for domain match...
1216 */
1217
1218 if (name_len >= mask->mask.name.length &&
1219 mask->mask.name.name[0] == '.' &&
1220 !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1221 mask->mask.name.name))
1222 return (1);
1223 break;
1224
1225 case CUPSD_AUTH_IP :
1226 /*
1227 * Check for IP/network address match...
1228 */
1229
1230 for (i = 0; i < 4; i ++)
1231 if ((ip[i] & mask->mask.ip.netmask[i]) !=
1232 mask->mask.ip.address[i])
1233 break;
1234
1235 if (i == 4)
1236 return (1);
1237 break;
1238 }
1239 }
1240
1241 return (0);
1242 }
1243
1244
1245 /*
1246 * 'cupsdCheckGroup()' - Check for a user's group membership.
1247 */
1248
1249 int /* O - 1 if user is a member, 0 otherwise */
1250 cupsdCheckGroup(
1251 const char *username, /* I - User name */
1252 struct passwd *user, /* I - System user info */
1253 const char *groupname) /* I - Group name */
1254 {
1255 int i; /* Looping var */
1256 struct group *group; /* System group info */
1257 #ifdef HAVE_MBR_UID_TO_UUID
1258 uuid_t useruuid, /* UUID for username */
1259 groupuuid; /* UUID for groupname */
1260 int is_member; /* True if user is a member of group */
1261 #endif /* HAVE_MBR_UID_TO_UUID */
1262
1263
1264 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1265 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1266 username, user, groupname);
1267
1268 /*
1269 * Validate input...
1270 */
1271
1272 if (!username || !groupname)
1273 return (0);
1274
1275 /*
1276 * Check to see if the user is a member of the named group...
1277 */
1278
1279 group = getgrnam(groupname);
1280 endgrent();
1281
1282 if (group != NULL)
1283 {
1284 /*
1285 * Group exists, check it...
1286 */
1287
1288 for (i = 0; group->gr_mem[i]; i ++)
1289 if (!_cups_strcasecmp(username, group->gr_mem[i]))
1290 return (1);
1291 }
1292
1293 /*
1294 * Group doesn't exist or user not in group list, check the group ID
1295 * against the user's group ID...
1296 */
1297
1298 if (user && group && group->gr_gid == user->pw_gid)
1299 return (1);
1300
1301 #ifdef HAVE_MBR_UID_TO_UUID
1302 /*
1303 * Check group membership through MacOS X membership API...
1304 */
1305
1306 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1307 {
1308 if (group)
1309 {
1310 /*
1311 * Map group name to UUID and check membership...
1312 */
1313
1314 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1315 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1316 if (is_member)
1317 return (1);
1318 }
1319 else if (groupname[0] == '#')
1320 {
1321 /*
1322 * Use UUID directly and check for equality (user UUID) and
1323 * membership (group UUID)...
1324 */
1325
1326 if (!uuid_parse((char *)groupname + 1, groupuuid))
1327 {
1328 if (!uuid_compare(useruuid, groupuuid))
1329 return (1);
1330 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1331 if (is_member)
1332 return (1);
1333 }
1334
1335 return (0);
1336 }
1337 }
1338 else if (groupname[0] == '#')
1339 return (0);
1340 #endif /* HAVE_MBR_UID_TO_UUID */
1341
1342 /*
1343 * If we get this far, then the user isn't part of the named group...
1344 */
1345
1346 return (0);
1347 }
1348
1349
1350 /*
1351 * 'cupsdCopyLocation()' - Make a copy of a location...
1352 */
1353
1354 cupsd_location_t * /* O - New location */
1355 cupsdCopyLocation(
1356 cupsd_location_t *loc) /* I - Original location */
1357 {
1358 cupsd_location_t *temp; /* New location */
1359
1360
1361 /*
1362 * Make a copy of the original location...
1363 */
1364
1365 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1366 return (NULL);
1367
1368 /*
1369 * Copy the information from the original location to the new one.
1370 */
1371
1372 if (!loc)
1373 return (temp);
1374
1375 if (loc->location)
1376 temp->location = _cupsStrAlloc(loc->location);
1377
1378 temp->length = loc->length;
1379 temp->limit = loc->limit;
1380 temp->order_type = loc->order_type;
1381 temp->type = loc->type;
1382 temp->level = loc->level;
1383 temp->satisfy = loc->satisfy;
1384 temp->encryption = loc->encryption;
1385
1386 if (loc->names)
1387 {
1388 if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1389 {
1390 cupsdLogMessage(CUPSD_LOG_ERROR,
1391 "Unable to allocate memory for %d names: %s",
1392 cupsArrayCount(loc->names), strerror(errno));
1393
1394 cupsdFreeLocation(temp);
1395 return (NULL);
1396 }
1397 }
1398
1399 if (loc->allow)
1400 {
1401 /*
1402 * Copy allow rules...
1403 */
1404
1405 if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1406 {
1407 cupsdLogMessage(CUPSD_LOG_ERROR,
1408 "Unable to allocate memory for %d allow rules: %s",
1409 cupsArrayCount(loc->allow), strerror(errno));
1410 cupsdFreeLocation(temp);
1411 return (NULL);
1412 }
1413 }
1414
1415 if (loc->deny)
1416 {
1417 /*
1418 * Copy deny rules...
1419 */
1420
1421 if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1422 {
1423 cupsdLogMessage(CUPSD_LOG_ERROR,
1424 "Unable to allocate memory for %d deny rules: %s",
1425 cupsArrayCount(loc->deny), strerror(errno));
1426 cupsdFreeLocation(temp);
1427 return (NULL);
1428 }
1429 }
1430
1431 return (temp);
1432 }
1433
1434
1435 /*
1436 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1437 */
1438
1439 void
1440 cupsdDeleteAllLocations(void)
1441 {
1442 /*
1443 * Free the location array, which will free all of the locations...
1444 */
1445
1446 cupsArrayDelete(Locations);
1447 Locations = NULL;
1448 }
1449
1450
1451 /*
1452 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1453 */
1454
1455 cupsd_location_t * /* O - Location that matches */
1456 cupsdFindBest(const char *path, /* I - Resource path */
1457 http_state_t state) /* I - HTTP state/request */
1458 {
1459 char uri[HTTP_MAX_URI],
1460 /* URI in request... */
1461 *uriptr; /* Pointer into URI */
1462 cupsd_location_t *loc, /* Current location */
1463 *best; /* Best match for location so far */
1464 size_t bestlen; /* Length of best match */
1465 int limit; /* Limit field */
1466 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1467 {
1468 CUPSD_AUTH_LIMIT_ALL,
1469 CUPSD_AUTH_LIMIT_OPTIONS,
1470 CUPSD_AUTH_LIMIT_GET,
1471 CUPSD_AUTH_LIMIT_GET,
1472 CUPSD_AUTH_LIMIT_HEAD,
1473 CUPSD_AUTH_LIMIT_POST,
1474 CUPSD_AUTH_LIMIT_POST,
1475 CUPSD_AUTH_LIMIT_POST,
1476 CUPSD_AUTH_LIMIT_PUT,
1477 CUPSD_AUTH_LIMIT_PUT,
1478 CUPSD_AUTH_LIMIT_DELETE,
1479 CUPSD_AUTH_LIMIT_TRACE,
1480 CUPSD_AUTH_LIMIT_ALL,
1481 CUPSD_AUTH_LIMIT_ALL,
1482 CUPSD_AUTH_LIMIT_ALL,
1483 CUPSD_AUTH_LIMIT_ALL
1484 };
1485
1486
1487 /*
1488 * First copy the connection URI to a local string so we have drop
1489 * any .ppd extension from the pathname in /printers or /classes
1490 * URIs...
1491 */
1492
1493 strlcpy(uri, path, sizeof(uri));
1494
1495 if (!strncmp(uri, "/printers/", 10) ||
1496 !strncmp(uri, "/classes/", 9))
1497 {
1498 /*
1499 * Check if the URI has .ppd on the end...
1500 */
1501
1502 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1503
1504 if (!strcmp(uriptr, ".ppd"))
1505 *uriptr = '\0';
1506 }
1507
1508 if ((uriptr = strchr(uri, '?')) != NULL)
1509 *uriptr = '\0'; /* Drop trailing query string */
1510
1511 if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1512 *uriptr = '\0'; /* Remove trailing '/' */
1513
1514 /*
1515 * Loop through the list of locations to find a match...
1516 */
1517
1518 limit = limits[state];
1519 best = NULL;
1520 bestlen = 0;
1521
1522 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\", limit=%x...", uri, limit);
1523
1524
1525 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1526 loc;
1527 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1528 {
1529 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1530
1531 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1532 {
1533 /*
1534 * Use case-insensitive comparison for queue names...
1535 */
1536
1537 if (loc->length > bestlen && loc->location &&
1538 !_cups_strncasecmp(uri, loc->location, loc->length) &&
1539 loc->location[0] == '/' &&
1540 (limit & loc->limit) != 0)
1541 {
1542 best = loc;
1543 bestlen = loc->length;
1544 }
1545 }
1546 else
1547 {
1548 /*
1549 * Use case-sensitive comparison for other URIs...
1550 */
1551
1552 if (loc->length > bestlen && loc->location &&
1553 !strncmp(uri, loc->location, loc->length) &&
1554 loc->location[0] == '/' &&
1555 (limit & loc->limit) != 0)
1556 {
1557 best = loc;
1558 bestlen = loc->length;
1559 }
1560 }
1561 }
1562
1563 /*
1564 * Return the match, if any...
1565 */
1566
1567 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1568 best ? best->location : "NONE");
1569
1570 return (best);
1571 }
1572
1573
1574 /*
1575 * 'cupsdFindLocation()' - Find the named location.
1576 */
1577
1578 cupsd_location_t * /* O - Location that matches */
1579 cupsdFindLocation(const char *location) /* I - Connection */
1580 {
1581 cupsd_location_t key; /* Search key */
1582
1583
1584 key.location = (char *)location;
1585
1586 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1587 }
1588
1589
1590 /*
1591 * 'cupsdFreeLocation()' - Free all memory used by a location.
1592 */
1593
1594 void
1595 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1596 {
1597 cupsArrayDelete(loc->names);
1598 cupsArrayDelete(loc->allow);
1599 cupsArrayDelete(loc->deny);
1600
1601 _cupsStrFree(loc->location);
1602 free(loc);
1603 }
1604
1605
1606 /*
1607 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1608 */
1609
1610 http_status_t /* O - HTTP_OK if authorized or error code */
1611 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1612 const char *owner)/* I - Owner of object */
1613 {
1614 int i, /* Looping vars */
1615 auth, /* Authorization status */
1616 type; /* Type of authentication */
1617 http_addr_t *hostaddr = httpGetAddress(con->http);
1618 /* Client address */
1619 const char *hostname = httpGetHostname(con->http, NULL, 0);
1620 /* Client hostname */
1621 unsigned address[4]; /* Authorization address */
1622 cupsd_location_t *best; /* Best match for location so far */
1623 size_t hostlen; /* Length of hostname */
1624 char *name, /* Current username */
1625 username[256], /* Username to authorize */
1626 ownername[256], /* Owner name to authorize */
1627 *ptr; /* Pointer into username */
1628 struct passwd *pw; /* User password data */
1629 static const char * const levels[] = /* Auth levels */
1630 {
1631 "ANON",
1632 "USER",
1633 "GROUP"
1634 };
1635 static const char * const types[] = /* Auth types */
1636 {
1637 "None",
1638 "Basic",
1639 "Negotiate"
1640 };
1641
1642
1643 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1644 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1645 con->uri, con->best, con->best ? con->best->location ?
1646 con->best->location : "(null)" : "");
1647 if (owner)
1648 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1649 "cupsdIsAuthorized: owner=\"%s\"", owner);
1650
1651 /*
1652 * If there is no "best" authentication rule for this request, then
1653 * access is allowed from the local system and denied from other
1654 * addresses...
1655 */
1656
1657 if (!con->best)
1658 {
1659 if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1660 !strcmp(hostname, ServerName) ||
1661 cupsArrayFind(ServerAlias, (void *)hostname))
1662 return (HTTP_OK);
1663 else
1664 return (HTTP_FORBIDDEN);
1665 }
1666
1667 best = con->best;
1668
1669 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1670 type = cupsdDefaultAuthType();
1671
1672 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1673 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
1674 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
1675 levels[best->level], types[type],
1676 best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1677
1678 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1679 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1680 best->op, ippOpString(best->op));
1681
1682 /*
1683 * Check host/ip-based accesses...
1684 */
1685
1686 #ifdef AF_INET6
1687 if (httpAddrFamily(hostaddr) == AF_INET6)
1688 {
1689 /*
1690 * Copy IPv6 address...
1691 */
1692
1693 address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1694 address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1695 address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1696 address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1697 }
1698 else
1699 #endif /* AF_INET6 */
1700 if (con->http->hostaddr->addr.sa_family == AF_INET)
1701 {
1702 /*
1703 * Copy IPv4 address...
1704 */
1705
1706 address[0] = 0;
1707 address[1] = 0;
1708 address[2] = 0;
1709 address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1710 }
1711 else
1712 memset(address, 0, sizeof(address));
1713
1714 hostlen = strlen(hostname);
1715
1716 auth = cupsdCheckAccess(address, hostname, hostlen, best)
1717 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1718
1719 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
1720 auth ? "DENY" : "ALLOW");
1721
1722 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1723 return (HTTP_FORBIDDEN);
1724
1725 #ifdef HAVE_SSL
1726 /*
1727 * See if encryption is required...
1728 */
1729
1730 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1731 _cups_strcasecmp(hostname, "localhost") &&
1732 !httpAddrLocalhost(hostaddr) &&
1733 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1734 !(type == CUPSD_AUTH_NEGOTIATE ||
1735 (type == CUPSD_AUTH_NONE &&
1736 cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1737 {
1738 cupsdLogMessage(CUPSD_LOG_DEBUG,
1739 "cupsdIsAuthorized: Need upgrade to TLS...");
1740 return (HTTP_UPGRADE_REQUIRED);
1741 }
1742 #endif /* HAVE_SSL */
1743
1744 /*
1745 * Now see what access level is required...
1746 */
1747
1748 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1749 (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1750 return (HTTP_OK);
1751
1752 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1753 best->limit == CUPSD_AUTH_LIMIT_IPP)
1754 {
1755 /*
1756 * Check for unauthenticated username...
1757 */
1758
1759 ipp_attribute_t *attr; /* requesting-user-name attribute */
1760
1761
1762 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1763 if (attr)
1764 {
1765 cupsdLogMessage(CUPSD_LOG_DEBUG,
1766 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1767 attr->values[0].string.text);
1768 strlcpy(username, attr->values[0].string.text, sizeof(username));
1769 }
1770 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1771 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1772 else
1773 return (HTTP_OK); /* unless overridden with Satisfy */
1774 }
1775 else
1776 {
1777 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1778 con->username);
1779
1780 #ifdef HAVE_AUTHORIZATION_H
1781 if (!con->username[0] && !con->authref)
1782 #else
1783 if (!con->username[0])
1784 #endif /* HAVE_AUTHORIZATION_H */
1785 {
1786 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1787 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1788 else
1789 return (HTTP_OK); /* unless overridden with Satisfy */
1790 }
1791
1792
1793 if (con->type != type && type != CUPSD_AUTH_NONE &&
1794 #ifdef HAVE_GSSAPI
1795 (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1796 #endif /* HAVE_GSSAPI */
1797 con->type != CUPSD_AUTH_BASIC)
1798 {
1799 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1800 types[con->type], types[type]);
1801
1802 return (HTTP_UNAUTHORIZED);
1803 }
1804
1805 strlcpy(username, con->username, sizeof(username));
1806 }
1807
1808 /*
1809 * OK, got a username. See if we need normal user access, or group
1810 * access... (root always matches)
1811 */
1812
1813 if (!strcmp(username, "root"))
1814 return (HTTP_OK);
1815
1816 /*
1817 * Strip any @domain or @KDC from the username and owner...
1818 */
1819
1820 if ((ptr = strchr(username, '@')) != NULL)
1821 *ptr = '\0';
1822
1823 if (owner)
1824 {
1825 strlcpy(ownername, owner, sizeof(ownername));
1826
1827 if ((ptr = strchr(ownername, '@')) != NULL)
1828 *ptr = '\0';
1829 }
1830 else
1831 ownername[0] = '\0';
1832
1833 /*
1834 * Get the user info...
1835 */
1836
1837 if (username[0])
1838 {
1839 pw = getpwnam(username);
1840 endpwent();
1841 }
1842 else
1843 pw = NULL;
1844
1845 if (best->level == CUPSD_AUTH_USER)
1846 {
1847 /*
1848 * If there are no names associated with this location, then
1849 * any valid user is OK...
1850 */
1851
1852 if (cupsArrayCount(best->names) == 0)
1853 return (HTTP_OK);
1854
1855 /*
1856 * Otherwise check the user list and return OK if this user is
1857 * allowed...
1858 */
1859
1860 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1861 "cupsdIsAuthorized: Checking user membership...");
1862
1863 #ifdef HAVE_AUTHORIZATION_H
1864 /*
1865 * If an authorization reference was supplied it must match a right name...
1866 */
1867
1868 if (con->authref)
1869 {
1870 for (name = (char *)cupsArrayFirst(best->names);
1871 name;
1872 name = (char *)cupsArrayNext(best->names))
1873 {
1874 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1875 return (HTTP_OK);
1876 else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1877 check_authref(con, SystemGroupAuthKey))
1878 return (HTTP_OK);
1879 }
1880
1881 return (HTTP_FORBIDDEN);
1882 }
1883 #endif /* HAVE_AUTHORIZATION_H */
1884
1885 for (name = (char *)cupsArrayFirst(best->names);
1886 name;
1887 name = (char *)cupsArrayNext(best->names))
1888 {
1889 if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1890 !_cups_strcasecmp(username, ownername))
1891 return (HTTP_OK);
1892 else if (!_cups_strcasecmp(name, "@SYSTEM"))
1893 {
1894 for (i = 0; i < NumSystemGroups; i ++)
1895 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1896 return (HTTP_OK);
1897 }
1898 else if (name[0] == '@')
1899 {
1900 if (cupsdCheckGroup(username, pw, name + 1))
1901 return (HTTP_OK);
1902 }
1903 else if (!_cups_strcasecmp(username, name))
1904 return (HTTP_OK);
1905 }
1906
1907 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1908 }
1909
1910 /*
1911 * Check to see if this user is in any of the named groups...
1912 */
1913
1914 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1915 "cupsdIsAuthorized: Checking group membership...");
1916
1917 /*
1918 * Check to see if this user is in any of the named groups...
1919 */
1920
1921 for (name = (char *)cupsArrayFirst(best->names);
1922 name;
1923 name = (char *)cupsArrayNext(best->names))
1924 {
1925 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1926 "cupsdIsAuthorized: Checking group \"%s\" membership...",
1927 name);
1928
1929 if (!_cups_strcasecmp(name, "@SYSTEM"))
1930 {
1931 for (i = 0; i < NumSystemGroups; i ++)
1932 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1933 return (HTTP_OK);
1934 }
1935 else if (cupsdCheckGroup(username, pw, name))
1936 return (HTTP_OK);
1937 }
1938
1939 /*
1940 * The user isn't part of the specified group, so deny access...
1941 */
1942
1943 cupsdLogMessage(CUPSD_LOG_DEBUG,
1944 "cupsdIsAuthorized: User not in group(s)!");
1945
1946 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1947 }
1948
1949
1950 /*
1951 * 'cupsdNewLocation()' - Create a new location for authorization.
1952 *
1953 * Note: Still need to call cupsdAddLocation() to add it to the list of global
1954 * locations.
1955 */
1956
1957 cupsd_location_t * /* O - Pointer to new location record */
1958 cupsdNewLocation(const char *location) /* I - Location path */
1959 {
1960 cupsd_location_t *temp; /* New location */
1961
1962
1963 /*
1964 * Try to allocate memory for the new location.
1965 */
1966
1967 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1968 return (NULL);
1969
1970 /*
1971 * Initialize the record and copy the name over...
1972 */
1973
1974 if ((temp->location = _cupsStrAlloc(location)) == NULL)
1975 {
1976 free(temp);
1977 return (NULL);
1978 }
1979
1980 temp->length = strlen(temp->location);
1981
1982 /*
1983 * Return the new record...
1984 */
1985
1986 return (temp);
1987 }
1988
1989
1990 #ifdef HAVE_AUTHORIZATION_H
1991 /*
1992 * 'check_authref()' - Check if an authorization services reference has the
1993 * supplied right.
1994 */
1995
1996 static int /* O - 1 if right is valid, 0 otherwise */
1997 check_authref(cupsd_client_t *con, /* I - Connection */
1998 const char *right) /* I - Right name */
1999 {
2000 OSStatus status; /* OS Status */
2001 AuthorizationItem authright; /* Authorization right */
2002 AuthorizationRights authrights; /* Authorization rights */
2003 AuthorizationFlags authflags; /* Authorization flags */
2004
2005
2006 /*
2007 * Check to see if the user is allowed to perform the task...
2008 */
2009
2010 if (!con->authref)
2011 return (0);
2012
2013 authright.name = right;
2014 authright.valueLength = 0;
2015 authright.value = NULL;
2016 authright.flags = 0;
2017
2018 authrights.count = 1;
2019 authrights.items = &authright;
2020
2021 authflags = kAuthorizationFlagDefaults |
2022 kAuthorizationFlagExtendRights;
2023
2024 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2025 kAuthorizationEmptyEnvironment,
2026 authflags, NULL)) != 0)
2027 {
2028 cupsdLogMessage(CUPSD_LOG_ERROR,
2029 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2030 authright.name, (int)status, cssmErrorString(status));
2031 return (0);
2032 }
2033
2034 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2035 "AuthorizationCopyRights(\"%s\") succeeded!",
2036 authright.name);
2037
2038 return (1);
2039 }
2040 #endif /* HAVE_AUTHORIZATION_H */
2041
2042
2043 /*
2044 * 'compare_locations()' - Compare two locations.
2045 */
2046
2047 static int /* O - Result of comparison */
2048 compare_locations(cupsd_location_t *a, /* I - First location */
2049 cupsd_location_t *b) /* I - Second location */
2050 {
2051 return (strcmp(b->location, a->location));
2052 }
2053
2054
2055 /*
2056 * 'copy_authmask()' - Copy function for auth masks.
2057 */
2058
2059 static cupsd_authmask_t * /* O - New auth mask */
2060 copy_authmask(cupsd_authmask_t *mask, /* I - Existing auth mask */
2061 void *data) /* I - User data (unused) */
2062 {
2063 cupsd_authmask_t *temp; /* New auth mask */
2064
2065
2066 (void)data;
2067
2068 if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
2069 {
2070 memcpy(temp, mask, sizeof(cupsd_authmask_t));
2071
2072 if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
2073 {
2074 /*
2075 * Make a copy of the name...
2076 */
2077
2078 if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
2079 {
2080 /*
2081 * Failed to make copy...
2082 */
2083
2084 free(temp);
2085 temp = NULL;
2086 }
2087 }
2088 }
2089
2090 return (temp);
2091 }
2092
2093
2094 #if !HAVE_LIBPAM
2095 /*
2096 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2097 * as needed.
2098 */
2099
2100 static char * /* O - Encrypted password */
2101 cups_crypt(const char *pw, /* I - Password string */
2102 const char *salt) /* I - Salt (key) string */
2103 {
2104 if (!strncmp(salt, "$1$", 3))
2105 {
2106 /*
2107 * Use MD5 passwords without the benefit of PAM; this is for
2108 * Slackware Linux, and the algorithm was taken from the
2109 * old shadow-19990827/lib/md5crypt.c source code... :(
2110 */
2111
2112 int i; /* Looping var */
2113 unsigned long n; /* Output number */
2114 int pwlen; /* Length of password string */
2115 const char *salt_end; /* End of "salt" data for MD5 */
2116 char *ptr; /* Pointer into result string */
2117 _cups_md5_state_t state; /* Primary MD5 state info */
2118 _cups_md5_state_t state2; /* Secondary MD5 state info */
2119 unsigned char digest[16]; /* MD5 digest result */
2120 static char result[120]; /* Final password string */
2121
2122
2123 /*
2124 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2125 * Get a maximum of 8 characters of salt data after $1$...
2126 */
2127
2128 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2129 if (*salt_end == '$')
2130 break;
2131
2132 /*
2133 * Compute the MD5 sum we need...
2134 */
2135
2136 pwlen = strlen(pw);
2137
2138 _cupsMD5Init(&state);
2139 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2140 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2141
2142 _cupsMD5Init(&state2);
2143 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2144 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2145 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2146 _cupsMD5Finish(&state2, digest);
2147
2148 for (i = pwlen; i > 0; i -= 16)
2149 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2150
2151 for (i = pwlen; i > 0; i >>= 1)
2152 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2153
2154 _cupsMD5Finish(&state, digest);
2155
2156 for (i = 0; i < 1000; i ++)
2157 {
2158 _cupsMD5Init(&state);
2159
2160 if (i & 1)
2161 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2162 else
2163 _cupsMD5Append(&state, digest, 16);
2164
2165 if (i % 3)
2166 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2167
2168 if (i % 7)
2169 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2170
2171 if (i & 1)
2172 _cupsMD5Append(&state, digest, 16);
2173 else
2174 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2175
2176 _cupsMD5Finish(&state, digest);
2177 }
2178
2179 /*
2180 * Copy the final sum to the result string and return...
2181 */
2182
2183 memcpy(result, salt, (size_t)(salt_end - salt));
2184 ptr = result + (salt_end - salt);
2185 *ptr++ = '$';
2186
2187 for (i = 0; i < 5; i ++, ptr += 4)
2188 {
2189 n = ((((unsigned)digest[i] << 8) | (unsigned)digest[i + 6]) << 8);
2190
2191 if (i < 4)
2192 n |= (unsigned)digest[i + 12];
2193 else
2194 n |= (unsigned)digest[5];
2195
2196 to64(ptr, n, 4);
2197 }
2198
2199 to64(ptr, (unsigned)digest[11], 2);
2200 ptr += 2;
2201 *ptr = '\0';
2202
2203 return (result);
2204 }
2205 else
2206 {
2207 /*
2208 * Use the standard crypt() function...
2209 */
2210
2211 return (crypt(pw, salt));
2212 }
2213 }
2214 #endif /* !HAVE_LIBPAM */
2215
2216
2217 /*
2218 * 'free_authmask()' - Free function for auth masks.
2219 */
2220
2221 static void
2222 free_authmask(cupsd_authmask_t *mask, /* I - Auth mask to free */
2223 void *data) /* I - User data (unused) */
2224 {
2225 (void)data;
2226
2227 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2228 _cupsStrFree(mask->mask.name.name);
2229
2230 free(mask);
2231 }
2232
2233
2234 #if HAVE_LIBPAM
2235 /*
2236 * 'pam_func()' - PAM conversation function.
2237 */
2238
2239 static int /* O - Success or failure */
2240 pam_func(
2241 int num_msg, /* I - Number of messages */
2242 const struct pam_message **msg, /* I - Messages */
2243 struct pam_response **resp, /* O - Responses */
2244 void *appdata_ptr)
2245 /* I - Pointer to connection */
2246 {
2247 int i; /* Looping var */
2248 struct pam_response *replies; /* Replies */
2249 cupsd_authdata_t *data; /* Pointer to auth data */
2250
2251
2252 /*
2253 * Allocate memory for the responses...
2254 */
2255
2256 if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2257 return (PAM_CONV_ERR);
2258
2259 /*
2260 * Answer all of the messages...
2261 */
2262
2263 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2264
2265 data = (cupsd_authdata_t *)appdata_ptr;
2266
2267 for (i = 0; i < num_msg; i ++)
2268 {
2269 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2270
2271 switch (msg[i]->msg_style)
2272 {
2273 case PAM_PROMPT_ECHO_ON:
2274 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2275 data->username));
2276 replies[i].resp_retcode = PAM_SUCCESS;
2277 replies[i].resp = strdup(data->username);
2278 break;
2279
2280 case PAM_PROMPT_ECHO_OFF:
2281 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2282 data->password));
2283 replies[i].resp_retcode = PAM_SUCCESS;
2284 replies[i].resp = strdup(data->password);
2285 break;
2286
2287 case PAM_TEXT_INFO:
2288 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2289 replies[i].resp_retcode = PAM_SUCCESS;
2290 replies[i].resp = NULL;
2291 break;
2292
2293 case PAM_ERROR_MSG:
2294 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2295 replies[i].resp_retcode = PAM_SUCCESS;
2296 replies[i].resp = NULL;
2297 break;
2298
2299 default:
2300 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2301 msg[i]->msg_style));
2302 free(replies);
2303 return (PAM_CONV_ERR);
2304 }
2305 }
2306
2307 /*
2308 * Return the responses back to PAM...
2309 */
2310
2311 *resp = replies;
2312
2313 return (PAM_SUCCESS);
2314 }
2315 #else
2316
2317
2318 /*
2319 * 'to64()' - Base64-encode an integer value...
2320 */
2321
2322 static void
2323 to64(char *s, /* O - Output string */
2324 unsigned long v, /* I - Value to encode */
2325 int n) /* I - Number of digits */
2326 {
2327 const char *itoa64 = "./0123456789"
2328 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2329 "abcdefghijklmnopqrstuvwxyz";
2330
2331
2332 for (; n > 0; n --, v >>= 6)
2333 *s++ = itoa64[v & 0x3f];
2334 }
2335 #endif /* HAVE_LIBPAM */
2336
2337
2338 /*
2339 * End of "$Id: auth.c 12604 2015-05-06 01:43:05Z msweet $".
2340 */
Unnamed repository; edit this file 'description' to name the repository.