scheduler/auth.c

   1 /*
   2  * Authorization routines for the CUPS scheduler.
   3  *
   4  * Copyright 2007-2015 by Apple Inc.
   5  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * This file contains Kerberos support code, copyright 2006 by
   8  * Jelmer Vernooij.
   9  *
  10  * These coded instructions, statements, and computer programs are the
  11  * property of Apple Inc. and are protected by Federal copyright
  12  * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  13  * which should have been included with this file.  If this file is
  14  * file is missing or damaged, see the license at "http://www.cups.org/".
  15  */
  16
  17 /*
  18  * Include necessary headers...
  19  */
  20
  21 #include "cupsd.h"
  22 #include <grp.h>
  23 #ifdef HAVE_SHADOW_H
  24 #  include <shadow.h>
  25 #endif /* HAVE_SHADOW_H */
  26 #ifdef HAVE_CRYPT_H
  27 #  include <crypt.h>
  28 #endif /* HAVE_CRYPT_H */
  29 #if HAVE_LIBPAM
  30 #  ifdef HAVE_PAM_PAM_APPL_H
  31 #    include <pam/pam_appl.h>
  32 #  else
  33 #    include <security/pam_appl.h>
  34 #  endif /* HAVE_PAM_PAM_APPL_H */
  35 #endif /* HAVE_LIBPAM */
  36 #ifdef HAVE_MEMBERSHIP_H
  37 #  include <membership.h>
  38 #endif /* HAVE_MEMBERSHIP_H */
  39 #ifdef HAVE_AUTHORIZATION_H
  40 #  include <Security/AuthorizationTags.h>
  41 #  ifdef HAVE_SECBASEPRIV_H
  42 #    include <Security/SecBasePriv.h>
  43 #  else
  44 extern const char *cssmErrorString(int error);
  45 #  endif /* HAVE_SECBASEPRIV_H */
  46 #endif /* HAVE_AUTHORIZATION_H */
  47 #ifdef HAVE_SYS_PARAM_H
  48 #  include <sys/param.h>
  49 #endif /* HAVE_SYS_PARAM_H */
  50 #ifdef HAVE_SYS_UCRED_H
  51 #  include <sys/ucred.h>
  52 typedef struct xucred cupsd_ucred_t;
  53 #  define CUPSD_UCRED_UID(c) (c).cr_uid
  54 #else
  55 #  ifndef __OpenBSD__
  56 typedef struct ucred cupsd_ucred_t;
  57 #  else
  58 typedef struct sockpeercred cupsd_ucred_t;
  59 #  endif
  60 #  define CUPSD_UCRED_UID(c) (c).uid
  61 #endif /* HAVE_SYS_UCRED_H */
  62
  63
  64 /*
  65  * Local functions...
  66  */
  67
  68 #ifdef HAVE_AUTHORIZATION_H
  69 static int              check_authref(cupsd_client_t *con, const char *right);
  70 #endif /* HAVE_AUTHORIZATION_H */
  71 static int              compare_locations(cupsd_location_t *a,
  72                                           cupsd_location_t *b);
  73 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
  74 #if !HAVE_LIBPAM
  75 static char             *cups_crypt(const char *pw, const char *salt);
  76 #endif /* !HAVE_LIBPAM */
  77 static void             free_authmask(cupsd_authmask_t *am, void *data);
  78 #if HAVE_LIBPAM
  79 static int              pam_func(int, const struct pam_message **,
  80                                  struct pam_response **, void *);
  81 #else
  82 static void             to64(char *s, unsigned long v, int n);
  83 #endif /* HAVE_LIBPAM */
  84
  85
  86 /*
  87  * Local structures...
  88  */
  89
  90 #if HAVE_LIBPAM
  91 typedef struct cupsd_authdata_s         /**** Authentication data ****/
  92 {
  93   char  username[HTTP_MAX_VALUE],       /* Username string */
  94         password[HTTP_MAX_VALUE];       /* Password string */
  95 } cupsd_authdata_t;
  96 #endif /* HAVE_LIBPAM */
  97
  98
  99 /*
 100  * 'cupsdAddIPMask()' - Add an IP address authorization mask.
 101  */
 102
 103 int                                     /* O  - 1 on success, 0 on failure */
 104 cupsdAddIPMask(
 105     cups_array_t   **masks,             /* IO - Masks array (created as needed) */
 106     const unsigned address[4],          /* I  - IP address */
 107     const unsigned netmask[4])          /* I  - IP netmask */
 108 {
 109   cupsd_authmask_t      temp;           /* New host/domain mask */
 110
 111
 112   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", masks, *masks, address[0], address[1], address[2], address[3], netmask[0], netmask[1], netmask[2], netmask[3]);
 113
 114   temp.type = CUPSD_AUTH_IP;
 115   memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
 116   memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
 117
 118  /*
 119   * Create the masks array as needed and add...
 120   */
 121
 122   if (!*masks)
 123     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 124                            (cups_acopy_func_t)copy_authmask,
 125                            (cups_afree_func_t)free_authmask);
 126
 127   return (cupsArrayAdd(*masks, &temp));
 128 }
 129
 130
 131 /*
 132  * 'cupsdAddLocation()' - Add a location for authorization.
 133  */
 134
 135 void
 136 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
 137 {
 138  /*
 139   * Make sure the locations array is created...
 140   */
 141
 142   if (!Locations)
 143     Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
 144                               (cups_ahash_func_t)NULL, 0,
 145                               (cups_acopy_func_t)NULL,
 146                               (cups_afree_func_t)cupsdFreeLocation);
 147
 148   if (Locations)
 149   {
 150     cupsArrayAdd(Locations, loc);
 151
 152     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"", loc->location ? loc->location : "(null)");
 153   }
 154 }
 155
 156
 157 /*
 158  * 'cupsdAddName()' - Add a name to a location...
 159  */
 160
 161 void
 162 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 163              char             *name)    /* I - Name to add */
 164 {
 165   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")", loc, name);
 166
 167   if (!loc->names)
 168     loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
 169                                (cups_acopy_func_t)_cupsStrAlloc,
 170                                (cups_afree_func_t)_cupsStrFree);
 171
 172   if (!cupsArrayAdd(loc->names, name))
 173   {
 174     cupsdLogMessage(CUPSD_LOG_ERROR,
 175                     "Unable to duplicate name for location %s: %s",
 176                     loc->location ? loc->location : "nil", strerror(errno));
 177     return;
 178   }
 179 }
 180
 181
 182 /*
 183  * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
 184  */
 185
 186 int                                     /* O  - 1 on success, 0 on failure */
 187 cupsdAddNameMask(cups_array_t **masks,  /* IO - Masks array (created as needed) */
 188                  char         *name)    /* I  - Host or interface name */
 189 {
 190   cupsd_authmask_t      temp;           /* New host/domain mask */
 191   char                  ifname[32],     /* Interface name */
 192                         *ifptr;         /* Pointer to end of name */
 193
 194
 195   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", masks, *masks, name);
 196
 197   if (!_cups_strcasecmp(name, "@LOCAL"))
 198   {
 199    /*
 200     * Deny *interface*...
 201     */
 202
 203     temp.type           = CUPSD_AUTH_INTERFACE;
 204     temp.mask.name.name = (char *)"*";
 205   }
 206   else if (!_cups_strncasecmp(name, "@IF(", 4))
 207   {
 208    /*
 209     * Deny *interface*...
 210     */
 211
 212     strlcpy(ifname, name + 4, sizeof(ifname));
 213
 214     ifptr = ifname + strlen(ifname) - 1;
 215
 216     if (ifptr >= ifname && *ifptr == ')')
 217     {
 218       ifptr --;
 219       *ifptr = '\0';
 220     }
 221
 222     temp.type             = CUPSD_AUTH_INTERFACE;
 223     temp.mask.name.name   = ifname;
 224   }
 225   else
 226   {
 227    /*
 228     * Deny name...
 229     */
 230
 231     if (*name == '*')
 232       name ++;
 233
 234     temp.type             = CUPSD_AUTH_NAME;
 235     temp.mask.name.name   = (char *)name;
 236   }
 237
 238  /*
 239   * Set the name length...
 240   */
 241
 242   temp.mask.name.length = strlen(temp.mask.name.name);
 243
 244  /*
 245   * Create the masks array as needed and add...
 246   */
 247
 248   if (!*masks)
 249     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 250                            (cups_acopy_func_t)copy_authmask,
 251                            (cups_afree_func_t)free_authmask);
 252
 253   return (cupsArrayAdd(*masks, &temp));
 254 }
 255
 256
 257 /*
 258  * 'cupsdAuthorize()' - Validate any authorization credentials.
 259  */
 260
 261 void
 262 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 263 {
 264   int           type;                   /* Authentication type */
 265   const char    *authorization;         /* Pointer into Authorization string */
 266   char          *ptr,                   /* Pointer into string */
 267                 username[HTTP_MAX_VALUE],
 268                                         /* Username string */
 269                 password[HTTP_MAX_VALUE];
 270                                         /* Password string */
 271   cupsd_cert_t  *localuser;             /* Certificate username */
 272
 273
 274  /*
 275   * Locate the best matching location so we know what kind of
 276   * authentication to expect...
 277   */
 278
 279   con->best = cupsdFindBest(con->uri, httpGetState(con->http));
 280   con->type = CUPSD_AUTH_NONE;
 281
 282   cupsdLogClient(con, CUPSD_LOG_DEBUG2, "con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location : "");
 283
 284   if (con->best && con->best->type != CUPSD_AUTH_NONE)
 285   {
 286     if (con->best->type == CUPSD_AUTH_DEFAULT)
 287       type = cupsdDefaultAuthType();
 288     else
 289       type = con->best->type;
 290   }
 291   else
 292     type = cupsdDefaultAuthType();
 293
 294  /*
 295   * Decode the Authorization string...
 296   */
 297
 298   authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
 299
 300   username[0] = '\0';
 301   password[0] = '\0';
 302
 303 #ifdef HAVE_GSSAPI
 304   con->gss_uid = 0;
 305 #endif /* HAVE_GSSAPI */
 306
 307 #ifdef HAVE_AUTHORIZATION_H
 308   if (con->authref)
 309   {
 310     AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
 311     con->authref = NULL;
 312   }
 313 #endif /* HAVE_AUTHORIZATION_H */
 314
 315   if (!*authorization)
 316   {
 317    /*
 318     * No authorization data provided, return early...
 319     */
 320
 321     cupsdLogClient(con, CUPSD_LOG_DEBUG, "No authentication data provided.");
 322     return;
 323   }
 324 #ifdef HAVE_AUTHORIZATION_H
 325   else if (!strncmp(authorization, "AuthRef ", 8) &&
 326            httpAddrLocalhost(httpGetAddress(con->http)))
 327   {
 328     OSStatus            status;         /* Status */
 329     char                authdata[HTTP_MAX_VALUE];
 330                                         /* Nonce value from client */
 331     int                 authlen;        /* Auth string length */
 332     AuthorizationItemSet *authinfo;     /* Authorization item set */
 333
 334    /*
 335     * Get the Authorization Services data...
 336     */
 337
 338     authorization += 8;
 339     while (isspace(*authorization & 255))
 340       authorization ++;
 341
 342     authlen = sizeof(authdata);
 343     httpDecode64_2(authdata, &authlen, authorization);
 344
 345     if (authlen != kAuthorizationExternalFormLength)
 346     {
 347       cupsdLogClient(con, CUPSD_LOG_ERROR, "External Authorization reference size is incorrect.");
 348       return;
 349     }
 350
 351     if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
 352     {
 353       cupsdLogClient(con, CUPSD_LOG_ERROR, "AuthorizationCreateFromExternalForm returned %d (%s)", (int)status, cssmErrorString(status));
 354       return;
 355     }
 356
 357     username[0] = '\0';
 358
 359     if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
 360                                &authinfo))
 361     {
 362       if (authinfo->count == 1 && authinfo->items[0].value &&
 363           authinfo->items[0].valueLength >= 2)
 364       {
 365         strlcpy(username, authinfo->items[0].value, sizeof(username));
 366
 367         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef.", username);
 368       }
 369
 370       AuthorizationFreeItemSet(authinfo);
 371     }
 372
 373     if (!username[0])
 374     {
 375      /*
 376       * No username in AuthRef, grab username using peer credentials...
 377       */
 378
 379       struct passwd     *pwd;           /* Password entry for this user */
 380       cupsd_ucred_t     peercred;       /* Peer credentials */
 381       socklen_t         peersize;       /* Size of peer credentials */
 382
 383       peersize = sizeof(peercred);
 384
 385       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 386       {
 387         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 388         return;
 389       }
 390
 391       if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
 392       {
 393         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred));
 394         return;
 395       }
 396
 397       strlcpy(username, pwd->pw_name, sizeof(username));
 398
 399       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef + PeerCred.", username);
 400     }
 401
 402     con->type = CUPSD_AUTH_BASIC;
 403   }
 404 #endif /* HAVE_AUTHORIZATION_H */
 405 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
 406   else if (!strncmp(authorization, "PeerCred ", 9) &&
 407            con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
 408   {
 409    /*
 410     * Use peer credentials from domain socket connection...
 411     */
 412
 413     struct passwd       *pwd;           /* Password entry for this user */
 414     cupsd_ucred_t       peercred;       /* Peer credentials */
 415     socklen_t           peersize;       /* Size of peer credentials */
 416 #ifdef HAVE_AUTHORIZATION_H
 417     const char          *name;          /* Authorizing name */
 418     int                 no_peer = 0;    /* Don't allow peer credentials? */
 419
 420    /*
 421     * See if we should allow peer credentials...
 422     */
 423
 424     for (name = (char *)cupsArrayFirst(con->best->names);
 425          name;
 426          name = (char *)cupsArrayNext(con->best->names))
 427     {
 428       if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
 429           !_cups_strcasecmp(name, "@SYSTEM"))
 430       {
 431        /* Normally don't want peer credentials if we need an auth key... */
 432         no_peer = 1;
 433       }
 434       else if (!_cups_strcasecmp(name, "@OWNER"))
 435       {
 436        /* but if @OWNER is present then we allow it... */
 437         no_peer = 0;
 438         break;
 439       }
 440     }
 441
 442     if (no_peer)
 443     {
 444       cupsdLogClient(con, CUPSD_LOG_ERROR, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
 445       return;
 446     }
 447 #endif /* HAVE_AUTHORIZATION_H */
 448
 449     if ((pwd = getpwnam(authorization + 9)) == NULL)
 450     {
 451       cupsdLogClient(con, CUPSD_LOG_ERROR, "User \"%s\" does not exist.", authorization + 9);
 452       return;
 453     }
 454
 455     peersize = sizeof(peercred);
 456
 457 #  ifdef __APPLE__
 458     if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 459 #  else
 460     if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
 461 #  endif /* __APPLE__ */
 462     {
 463       cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 464       return;
 465     }
 466
 467     if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
 468     {
 469       cupsdLogClient(con, CUPSD_LOG_ERROR, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization + 9, CUPSD_UCRED_UID(peercred), pwd->pw_uid);
 470 #  ifdef HAVE_SYS_UCRED_H
 471       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_version=%d", peercred.cr_version);
 472       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_uid=%d", peercred.cr_uid);
 473       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_ngroups=%d", peercred.cr_ngroups);
 474       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_groups[0]=%d", peercred.cr_groups[0]);
 475 #  endif /* HAVE_SYS_UCRED_H */
 476       return;
 477     }
 478
 479     strlcpy(username, authorization + 9, sizeof(username));
 480
 481 #  ifdef HAVE_GSSAPI
 482     con->gss_uid = CUPSD_UCRED_UID(peercred);
 483 #  endif /* HAVE_GSSAPI */
 484
 485     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using PeerCred.", username);
 486
 487     con->type = CUPSD_AUTH_BASIC;
 488   }
 489 #endif /* SO_PEERCRED && AF_LOCAL */
 490   else if (!strncmp(authorization, "Local", 5) &&
 491            httpAddrLocalhost(httpGetAddress(con->http)))
 492   {
 493    /*
 494     * Get Local certificate authentication data...
 495     */
 496
 497     authorization += 5;
 498     while (isspace(*authorization & 255))
 499       authorization ++;
 500
 501     if ((localuser = cupsdFindCert(authorization)) == NULL)
 502     {
 503       cupsdLogClient(con, CUPSD_LOG_ERROR, "Local authentication certificate not found.");
 504       return;
 505     }
 506
 507     strlcpy(username, localuser->username, sizeof(username));
 508     con->type = localuser->type;
 509
 510     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using Local.", username);
 511   }
 512   else if (!strncmp(authorization, "Basic", 5))
 513   {
 514    /*
 515     * Get the Basic authentication data...
 516     */
 517
 518     int userlen;                        /* Username:password length */
 519
 520
 521     authorization += 5;
 522     while (isspace(*authorization & 255))
 523       authorization ++;
 524
 525     userlen = sizeof(username);
 526     httpDecode64_2(username, &userlen, authorization);
 527
 528    /*
 529     * Pull the username and password out...
 530     */
 531
 532     if ((ptr = strchr(username, ':')) == NULL)
 533     {
 534       cupsdLogClient(con, CUPSD_LOG_ERROR, "Missing Basic password.");
 535       return;
 536     }
 537
 538     *ptr++ = '\0';
 539
 540     if (!username[0])
 541     {
 542      /*
 543       * Username must not be empty...
 544       */
 545
 546       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic username.");
 547       return;
 548     }
 549
 550     if (!*ptr)
 551     {
 552      /*
 553       * Password must not be empty...
 554       */
 555
 556       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic password.");
 557       return;
 558     }
 559
 560     strlcpy(password, ptr, sizeof(password));
 561
 562    /*
 563     * Validate the username and password...
 564     */
 565
 566     switch (type)
 567     {
 568       default :
 569       case CUPSD_AUTH_BASIC :
 570           {
 571 #if HAVE_LIBPAM
 572            /*
 573             * Only use PAM to do authentication.  This supports MD5
 574             * passwords, among other things...
 575             */
 576
 577             pam_handle_t        *pamh;  /* PAM authentication handle */
 578             int                 pamerr; /* PAM error code */
 579             struct pam_conv     pamdata;/* PAM conversation data */
 580             cupsd_authdata_t    data;   /* Authentication data */
 581
 582
 583             strlcpy(data.username, username, sizeof(data.username));
 584             strlcpy(data.password, password, sizeof(data.password));
 585
 586 #  ifdef __sun
 587             pamdata.conv        = (int (*)(int, struct pam_message **,
 588                                            struct pam_response **,
 589                                            void *))pam_func;
 590 #  else
 591             pamdata.conv        = pam_func;
 592 #  endif /* __sun */
 593             pamdata.appdata_ptr = &data;
 594
 595             pamerr = pam_start("cups", username, &pamdata, &pamh);
 596             if (pamerr != PAM_SUCCESS)
 597             {
 598               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_start() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 599               return;
 600             }
 601
 602 #  ifdef HAVE_PAM_SET_ITEM
 603 #    ifdef PAM_RHOST
 604             pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
 605             if (pamerr != PAM_SUCCESS)
 606               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 607 #    endif /* PAM_RHOST */
 608
 609 #    ifdef PAM_TTY
 610             pamerr = pam_set_item(pamh, PAM_TTY, "cups");
 611             if (pamerr != PAM_SUCCESS)
 612               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 613 #    endif /* PAM_TTY */
 614 #  endif /* HAVE_PAM_SET_ITEM */
 615
 616             pamerr = pam_authenticate(pamh, PAM_SILENT);
 617             if (pamerr != PAM_SUCCESS)
 618             {
 619               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_authenticate() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 620               pam_end(pamh, 0);
 621               return;
 622             }
 623
 624 #  ifdef HAVE_PAM_SETCRED
 625             pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
 626             if (pamerr != PAM_SUCCESS)
 627               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_setcred() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 628 #  endif /* HAVE_PAM_SETCRED */
 629
 630             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 631             if (pamerr != PAM_SUCCESS)
 632             {
 633               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_acct_mgmt() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 634               pam_end(pamh, 0);
 635               return;
 636             }
 637
 638             pam_end(pamh, PAM_SUCCESS);
 639
 640 #else
 641            /*
 642             * Use normal UNIX password file-based authentication...
 643             */
 644
 645             char                *pass;  /* Encrypted password */
 646             struct passwd       *pw;    /* User password data */
 647 #  ifdef HAVE_SHADOW_H
 648             struct spwd         *spw;   /* Shadow password data */
 649 #  endif /* HAVE_SHADOW_H */
 650
 651
 652             pw = getpwnam(username);    /* Get the current password */
 653             endpwent();                 /* Close the password file */
 654
 655             if (!pw)
 656             {
 657              /*
 658               * No such user...
 659               */
 660
 661               cupsdLogClient(con, CUPSD_LOG_ERROR, "Unknown username \"%s\".", username);
 662               return;
 663             }
 664
 665 #  ifdef HAVE_SHADOW_H
 666             spw = getspnam(username);
 667             endspent();
 668
 669             if (!spw && !strcmp(pw->pw_passwd, "x"))
 670             {
 671              /*
 672               * Don't allow blank passwords!
 673               */
 674
 675               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no shadow password.", username);
 676               return;
 677             }
 678
 679             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 680 #  else
 681             if (!pw->pw_passwd[0])
 682 #  endif /* HAVE_SHADOW_H */
 683             {
 684              /*
 685               * Don't allow blank passwords!
 686               */
 687
 688               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no password.", username);
 689               return;
 690             }
 691
 692            /*
 693             * OK, the password isn't blank, so compare with what came from the
 694             * client...
 695             */
 696
 697             pass = cups_crypt(password, pw->pw_passwd);
 698
 699             if (!pass || strcmp(pw->pw_passwd, pass))
 700             {
 701 #  ifdef HAVE_SHADOW_H
 702               if (spw)
 703               {
 704                 pass = cups_crypt(password, spw->sp_pwdp);
 705
 706                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 707                 {
 708                   cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 709                   return;
 710                 }
 711               }
 712               else
 713 #  endif /* HAVE_SHADOW_H */
 714               {
 715                 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 716                 return;
 717               }
 718             }
 719 #endif /* HAVE_LIBPAM */
 720           }
 721
 722           cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
 723           break;
 724     }
 725
 726     con->type = type;
 727   }
 728 #ifdef HAVE_GSSAPI
 729   else if (!strncmp(authorization, "Negotiate", 9))
 730   {
 731     int                 len;            /* Length of authorization string */
 732     gss_ctx_id_t        context;        /* Authorization context */
 733     OM_uint32           major_status,   /* Major status code */
 734                         minor_status;   /* Minor status code */
 735     gss_buffer_desc     input_token = GSS_C_EMPTY_BUFFER,
 736                                         /* Input token from string */
 737                         output_token = GSS_C_EMPTY_BUFFER;
 738                                         /* Output token for username */
 739     gss_name_t          client_name;    /* Client name */
 740
 741
 742 #  ifdef __APPLE__
 743    /*
 744     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
 745     * to use it...
 746     */
 747
 748     if (&gss_init_sec_context == NULL)
 749     {
 750       cupsdLogClient(con, CUPSD_LOG_WARN, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
 751       return;
 752     }
 753 #  endif /* __APPLE__ */
 754
 755    /*
 756     * Find the start of the Kerberos input token...
 757     */
 758
 759     authorization += 9;
 760     while (isspace(*authorization & 255))
 761       authorization ++;
 762
 763     if (!*authorization)
 764     {
 765       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "No authentication data specified.");
 766       return;
 767     }
 768
 769    /*
 770     * Decode the authorization string to get the input token...
 771     */
 772
 773     len                = (int)strlen(authorization);
 774     input_token.value  = malloc((size_t)len);
 775     input_token.value  = httpDecode64_2(input_token.value, &len,
 776                                         authorization);
 777     input_token.length = (size_t)len;
 778
 779    /*
 780     * Accept the input token to get the authorization info...
 781     */
 782
 783     context      = GSS_C_NO_CONTEXT;
 784     client_name  = GSS_C_NO_NAME;
 785     major_status = gss_accept_sec_context(&minor_status,
 786                                           &context,
 787                                           ServerCreds,
 788                                           &input_token,
 789                                           GSS_C_NO_CHANNEL_BINDINGS,
 790                                           &client_name,
 791                                           NULL,
 792                                           &output_token,
 793                                           NULL,
 794                                           NULL,
 795                                           NULL);
 796
 797     if (output_token.length > 0)
 798       gss_release_buffer(&minor_status, &output_token);
 799
 800     if (GSS_ERROR(major_status))
 801     {
 802       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error accepting GSSAPI security context.", con->number);
 803
 804       if (context != GSS_C_NO_CONTEXT)
 805         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 806       return;
 807     }
 808
 809     con->have_gss = 1;
 810
 811    /*
 812     * Get the username associated with the client's credentials...
 813     */
 814
 815     if (major_status == GSS_S_CONTINUE_NEEDED)
 816       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Credentials not complete.", con->number);
 817     else if (major_status == GSS_S_COMPLETE)
 818     {
 819       major_status = gss_display_name(&minor_status, client_name,
 820                                       &output_token, NULL);
 821
 822       if (GSS_ERROR(major_status))
 823       {
 824         cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error getting username.", con->number);
 825         gss_release_name(&minor_status, &client_name);
 826         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 827         return;
 828       }
 829
 830       strlcpy(username, output_token.value, sizeof(username));
 831
 832       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Negotiate.", username);
 833
 834       gss_release_name(&minor_status, &client_name);
 835       gss_release_buffer(&minor_status, &output_token);
 836
 837       con->type = CUPSD_AUTH_NEGOTIATE;
 838     }
 839
 840     gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 841
 842 #  if defined(SO_PEERCRED) && defined(AF_LOCAL)
 843    /*
 844     * Get the client's UID if we are printing locally - that allows a backend
 845     * to run as the correct user to get Kerberos credentials of its own.
 846     */
 847
 848     if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
 849     {
 850       cupsd_ucred_t     peercred;       /* Peer credentials */
 851       socklen_t         peersize;       /* Size of peer credentials */
 852
 853       peersize = sizeof(peercred);
 854
 855 #    ifdef __APPLE__
 856       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 857 #    else
 858       if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
 859                      &peersize))
 860 #    endif /* __APPLE__ */
 861       {
 862         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 863       }
 864       else
 865       {
 866         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred));
 867         con->gss_uid = CUPSD_UCRED_UID(peercred);
 868       }
 869     }
 870 #  endif /* SO_PEERCRED && AF_LOCAL */
 871   }
 872 #endif /* HAVE_GSSAPI */
 873   else
 874   {
 875     char        scheme[256];            /* Auth scheme... */
 876
 877
 878     if (sscanf(authorization, "%255s", scheme) != 1)
 879       strlcpy(scheme, "UNKNOWN", sizeof(scheme));
 880
 881     cupsdLogClient(con, CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\".", scheme);
 882     return;
 883   }
 884
 885  /*
 886   * If we get here, then we were able to validate the username and
 887   * password - copy the validated username and password to the client
 888   * data and return...
 889   */
 890
 891   strlcpy(con->username, username, sizeof(con->username));
 892   strlcpy(con->password, password, sizeof(con->password));
 893 }
 894
 895
 896 /*
 897  * 'cupsdCheckAccess()' - Check whether the given address is allowed to
 898  *                        access a location.
 899  */
 900
 901 int                                     /* O - 1 if allowed, 0 otherwise */
 902 cupsdCheckAccess(
 903     unsigned         ip[4],             /* I - Client address */
 904     const char       *name,             /* I - Client hostname */
 905     size_t           namelen,           /* I - Length of hostname */
 906     cupsd_location_t *loc)              /* I - Location to check */
 907 {
 908   int   allow;                          /* 1 if allowed, 0 otherwise */
 909
 910
 911   if (!_cups_strcasecmp(name, "localhost"))
 912   {
 913    /*
 914     * Access from localhost (127.0.0.1 or ::1) is always allowed...
 915     */
 916
 917     return (1);
 918   }
 919   else
 920   {
 921    /*
 922     * Do authorization checks on the domain/address...
 923     */
 924
 925     switch (loc->order_type)
 926     {
 927       default :
 928           allow = 0;    /* anti-compiler-warning-code */
 929           break;
 930
 931       case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
 932           allow = 1;
 933
 934           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 935             allow = 0;
 936
 937           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 938             allow = 1;
 939           break;
 940
 941       case CUPSD_AUTH_DENY : /* Order Allow,Deny */
 942           allow = 0;
 943
 944           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 945             allow = 1;
 946
 947           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 948             allow = 0;
 949           break;
 950     }
 951   }
 952
 953   return (allow);
 954 }
 955
 956
 957 /*
 958  * 'cupsdCheckAuth()' - Check authorization masks.
 959  */
 960
 961 int                                     /* O - 1 if mask matches, 0 otherwise */
 962 cupsdCheckAuth(unsigned     ip[4],      /* I - Client address */
 963                const char   *name,      /* I - Client hostname */
 964                size_t       name_len,   /* I - Length of hostname */
 965                cups_array_t *masks)     /* I - Masks */
 966 {
 967   int                   i;              /* Looping var */
 968   cupsd_authmask_t      *mask;          /* Current mask */
 969   cupsd_netif_t         *iface;         /* Network interface */
 970   unsigned              netip4;         /* IPv4 network address */
 971 #ifdef AF_INET6
 972   unsigned              netip6[4];      /* IPv6 network address */
 973 #endif /* AF_INET6 */
 974
 975
 976   for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
 977        mask;
 978        mask = (cupsd_authmask_t *)cupsArrayNext(masks))
 979   {
 980     switch (mask->type)
 981     {
 982       case CUPSD_AUTH_INTERFACE :
 983          /*
 984           * Check for a match with a network interface...
 985           */
 986
 987           netip4 = htonl(ip[3]);
 988
 989 #ifdef AF_INET6
 990           netip6[0] = htonl(ip[0]);
 991           netip6[1] = htonl(ip[1]);
 992           netip6[2] = htonl(ip[2]);
 993           netip6[3] = htonl(ip[3]);
 994 #endif /* AF_INET6 */
 995
 996           cupsdNetIFUpdate();
 997
 998           if (!strcmp(mask->mask.name.name, "*"))
 999           {
1000 #ifdef __APPLE__
1001            /*
1002             * Allow Back-to-My-Mac addresses...
1003             */
1004
1005             if ((ip[0] & 0xff000000) == 0xfd000000)
1006               return (1);
1007 #endif /* __APPLE__ */
1008
1009            /*
1010             * Check against all local interfaces...
1011             */
1012
1013             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1014                  iface;
1015                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1016             {
1017              /*
1018               * Only check local interfaces...
1019               */
1020
1021               if (!iface->is_local)
1022                 continue;
1023
1024               if (iface->address.addr.sa_family == AF_INET)
1025               {
1026                /*
1027                 * Check IPv4 address...
1028                 */
1029
1030                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1031                     (iface->address.ipv4.sin_addr.s_addr &
1032                      iface->mask.ipv4.sin_addr.s_addr))
1033                   return (1);
1034               }
1035 #ifdef AF_INET6
1036               else
1037               {
1038                /*
1039                 * Check IPv6 address...
1040                 */
1041
1042                 for (i = 0; i < 4; i ++)
1043                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1044                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1045                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1046                     break;
1047
1048                 if (i == 4)
1049                   return (1);
1050               }
1051 #endif /* AF_INET6 */
1052             }
1053           }
1054           else
1055           {
1056            /*
1057             * Check the named interface...
1058             */
1059
1060             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1061                  iface;
1062                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1063             {
1064               if (strcmp(mask->mask.name.name, iface->name))
1065                 continue;
1066
1067               if (iface->address.addr.sa_family == AF_INET)
1068               {
1069                /*
1070                 * Check IPv4 address...
1071                 */
1072
1073                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1074                     (iface->address.ipv4.sin_addr.s_addr &
1075                      iface->mask.ipv4.sin_addr.s_addr))
1076                   return (1);
1077               }
1078 #ifdef AF_INET6
1079               else
1080               {
1081                /*
1082                 * Check IPv6 address...
1083                 */
1084
1085                 for (i = 0; i < 4; i ++)
1086                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1087                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1088                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1089                     break;
1090
1091                 if (i == 4)
1092                   return (1);
1093               }
1094 #endif /* AF_INET6 */
1095             }
1096           }
1097           break;
1098
1099       case CUPSD_AUTH_NAME :
1100          /*
1101           * Check for exact name match...
1102           */
1103
1104           if (!_cups_strcasecmp(name, mask->mask.name.name))
1105             return (1);
1106
1107          /*
1108           * Check for domain match...
1109           */
1110
1111           if (name_len >= mask->mask.name.length &&
1112               mask->mask.name.name[0] == '.' &&
1113               !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1114                           mask->mask.name.name))
1115             return (1);
1116           break;
1117
1118       case CUPSD_AUTH_IP :
1119          /*
1120           * Check for IP/network address match...
1121           */
1122
1123           for (i = 0; i < 4; i ++)
1124             if ((ip[i] & mask->mask.ip.netmask[i]) !=
1125                     mask->mask.ip.address[i])
1126               break;
1127
1128           if (i == 4)
1129             return (1);
1130           break;
1131     }
1132   }
1133
1134   return (0);
1135 }
1136
1137
1138 /*
1139  * 'cupsdCheckGroup()' - Check for a user's group membership.
1140  */
1141
1142 int                                     /* O - 1 if user is a member, 0 otherwise */
1143 cupsdCheckGroup(
1144     const char    *username,            /* I - User name */
1145     struct passwd *user,                /* I - System user info */
1146     const char    *groupname)           /* I - Group name */
1147 {
1148   int           i;                      /* Looping var */
1149   struct group  *group;                 /* System group info */
1150 #ifdef HAVE_MBR_UID_TO_UUID
1151   uuid_t        useruuid,               /* UUID for username */
1152                 groupuuid;              /* UUID for groupname */
1153   int           is_member;              /* True if user is a member of group */
1154 #endif /* HAVE_MBR_UID_TO_UUID */
1155
1156
1157   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username, user, groupname);
1158
1159  /*
1160   * Validate input...
1161   */
1162
1163   if (!username || !groupname)
1164     return (0);
1165
1166  /*
1167   * Check to see if the user is a member of the named group...
1168   */
1169
1170   group = getgrnam(groupname);
1171   endgrent();
1172
1173   if (group != NULL)
1174   {
1175    /*
1176     * Group exists, check it...
1177     */
1178
1179     for (i = 0; group->gr_mem[i]; i ++)
1180       if (!_cups_strcasecmp(username, group->gr_mem[i]))
1181         return (1);
1182   }
1183
1184  /*
1185   * Group doesn't exist or user not in group list, check the group ID
1186   * against the user's group ID...
1187   */
1188
1189   if (user && group && group->gr_gid == user->pw_gid)
1190     return (1);
1191
1192 #ifdef HAVE_MBR_UID_TO_UUID
1193  /*
1194   * Check group membership through MacOS X membership API...
1195   */
1196
1197   if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1198   {
1199     if (group)
1200     {
1201      /*
1202       * Map group name to UUID and check membership...
1203       */
1204
1205       if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1206         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1207           if (is_member)
1208             return (1);
1209     }
1210     else if (groupname[0] == '#')
1211     {
1212      /*
1213       * Use UUID directly and check for equality (user UUID) and
1214       * membership (group UUID)...
1215       */
1216
1217       if (!uuid_parse((char *)groupname + 1, groupuuid))
1218       {
1219         if (!uuid_compare(useruuid, groupuuid))
1220           return (1);
1221         else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1222           if (is_member)
1223             return (1);
1224       }
1225
1226       return (0);
1227     }
1228   }
1229   else if (groupname[0] == '#')
1230     return (0);
1231 #endif /* HAVE_MBR_UID_TO_UUID */
1232
1233  /*
1234   * If we get this far, then the user isn't part of the named group...
1235   */
1236
1237   return (0);
1238 }
1239
1240
1241 /*
1242  * 'cupsdCopyLocation()' - Make a copy of a location...
1243  */
1244
1245 cupsd_location_t *                      /* O - New location */
1246 cupsdCopyLocation(
1247     cupsd_location_t *loc)              /* I - Original location */
1248 {
1249   cupsd_location_t      *temp;          /* New location */
1250
1251
1252  /*
1253   * Make a copy of the original location...
1254   */
1255
1256   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1257     return (NULL);
1258
1259  /*
1260   * Copy the information from the original location to the new one.
1261   */
1262
1263   if (!loc)
1264     return (temp);
1265
1266   if (loc->location)
1267     temp->location = _cupsStrAlloc(loc->location);
1268
1269   temp->length     = loc->length;
1270   temp->limit      = loc->limit;
1271   temp->order_type = loc->order_type;
1272   temp->type       = loc->type;
1273   temp->level      = loc->level;
1274   temp->satisfy    = loc->satisfy;
1275   temp->encryption = loc->encryption;
1276
1277   if (loc->names)
1278   {
1279     if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1280     {
1281       cupsdLogMessage(CUPSD_LOG_ERROR,
1282                       "Unable to allocate memory for %d names: %s",
1283                       cupsArrayCount(loc->names), strerror(errno));
1284
1285       cupsdFreeLocation(temp);
1286       return (NULL);
1287     }
1288   }
1289
1290   if (loc->allow)
1291   {
1292    /*
1293     * Copy allow rules...
1294     */
1295
1296     if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1297     {
1298       cupsdLogMessage(CUPSD_LOG_ERROR,
1299                       "Unable to allocate memory for %d allow rules: %s",
1300                       cupsArrayCount(loc->allow), strerror(errno));
1301       cupsdFreeLocation(temp);
1302       return (NULL);
1303     }
1304   }
1305
1306   if (loc->deny)
1307   {
1308    /*
1309     * Copy deny rules...
1310     */
1311
1312     if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1313     {
1314       cupsdLogMessage(CUPSD_LOG_ERROR,
1315                       "Unable to allocate memory for %d deny rules: %s",
1316                       cupsArrayCount(loc->deny), strerror(errno));
1317       cupsdFreeLocation(temp);
1318       return (NULL);
1319     }
1320   }
1321
1322   return (temp);
1323 }
1324
1325
1326 /*
1327  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1328  */
1329
1330 void
1331 cupsdDeleteAllLocations(void)
1332 {
1333  /*
1334   * Free the location array, which will free all of the locations...
1335   */
1336
1337   cupsArrayDelete(Locations);
1338   Locations = NULL;
1339 }
1340
1341
1342 /*
1343  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1344  */
1345
1346 cupsd_location_t *                      /* O - Location that matches */
1347 cupsdFindBest(const char   *path,       /* I - Resource path */
1348               http_state_t state)       /* I - HTTP state/request */
1349 {
1350   char                  uri[HTTP_MAX_URI],
1351                                         /* URI in request... */
1352                         *uriptr;        /* Pointer into URI */
1353   cupsd_location_t      *loc,           /* Current location */
1354                         *best;          /* Best match for location so far */
1355   size_t                bestlen;        /* Length of best match */
1356   int                   limit;          /* Limit field */
1357   static const int      limits[] =      /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1358                 {
1359                   CUPSD_AUTH_LIMIT_ALL,
1360                   CUPSD_AUTH_LIMIT_OPTIONS,
1361                   CUPSD_AUTH_LIMIT_GET,
1362                   CUPSD_AUTH_LIMIT_GET,
1363                   CUPSD_AUTH_LIMIT_HEAD,
1364                   CUPSD_AUTH_LIMIT_POST,
1365                   CUPSD_AUTH_LIMIT_POST,
1366                   CUPSD_AUTH_LIMIT_POST,
1367                   CUPSD_AUTH_LIMIT_PUT,
1368                   CUPSD_AUTH_LIMIT_PUT,
1369                   CUPSD_AUTH_LIMIT_DELETE,
1370                   CUPSD_AUTH_LIMIT_TRACE,
1371                   CUPSD_AUTH_LIMIT_ALL,
1372                   CUPSD_AUTH_LIMIT_ALL,
1373                   CUPSD_AUTH_LIMIT_ALL,
1374                   CUPSD_AUTH_LIMIT_ALL
1375                 };
1376
1377
1378  /*
1379   * First copy the connection URI to a local string so we have drop
1380   * any .ppd extension from the pathname in /printers or /classes
1381   * URIs...
1382   */
1383
1384   strlcpy(uri, path, sizeof(uri));
1385
1386   if ((uriptr = strchr(uri, '?')) != NULL)
1387     *uriptr = '\0';             /* Drop trailing query string */
1388
1389   if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1390     *uriptr = '\0';             /* Remove trailing '/' */
1391
1392   if (!strncmp(uri, "/printers/", 10) ||
1393       !strncmp(uri, "/classes/", 9))
1394   {
1395    /*
1396     * Check if the URI has .ppd on the end...
1397     */
1398
1399     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1400
1401     if (!strcmp(uriptr, ".ppd"))
1402       *uriptr = '\0';
1403   }
1404
1405  /*
1406   * Loop through the list of locations to find a match...
1407   */
1408
1409   limit   = limits[state];
1410   best    = NULL;
1411   bestlen = 0;
1412
1413   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri=\"%s\", limit=%x...", uri, limit);
1414
1415
1416   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1417        loc;
1418        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1419   {
1420     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1421
1422     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1423     {
1424      /*
1425       * Use case-insensitive comparison for queue names...
1426       */
1427
1428       if (loc->length > bestlen && loc->location &&
1429           !_cups_strncasecmp(uri, loc->location, loc->length) &&
1430           loc->location[0] == '/' &&
1431           (limit & loc->limit) != 0)
1432       {
1433         best    = loc;
1434         bestlen = loc->length;
1435       }
1436     }
1437     else
1438     {
1439      /*
1440       * Use case-sensitive comparison for other URIs...
1441       */
1442
1443       if (loc->length > bestlen && loc->location &&
1444           !strncmp(uri, loc->location, loc->length) &&
1445           loc->location[0] == '/' &&
1446           (limit & loc->limit) != 0)
1447       {
1448         best    = loc;
1449         bestlen = loc->length;
1450       }
1451     }
1452   }
1453
1454  /*
1455   * Return the match, if any...
1456   */
1457
1458   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best=%s", best ? best->location : "NONE");
1459
1460   return (best);
1461 }
1462
1463
1464 /*
1465  * 'cupsdFindLocation()' - Find the named location.
1466  */
1467
1468 cupsd_location_t *                      /* O - Location that matches */
1469 cupsdFindLocation(const char *location) /* I - Connection */
1470 {
1471   cupsd_location_t      key;            /* Search key */
1472
1473
1474   key.location = (char *)location;
1475
1476   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1477 }
1478
1479
1480 /*
1481  * 'cupsdFreeLocation()' - Free all memory used by a location.
1482  */
1483
1484 void
1485 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1486 {
1487   cupsArrayDelete(loc->names);
1488   cupsArrayDelete(loc->allow);
1489   cupsArrayDelete(loc->deny);
1490
1491   _cupsStrFree(loc->location);
1492   free(loc);
1493 }
1494
1495
1496 /*
1497  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1498  */
1499
1500 http_status_t                           /* O - HTTP_OK if authorized or error code */
1501 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1502                   const char     *owner)/* I - Owner of object */
1503 {
1504   int                   i,              /* Looping vars */
1505                         auth,           /* Authorization status */
1506                         type;           /* Type of authentication */
1507   http_addr_t           *hostaddr = httpGetAddress(con->http);
1508                                         /* Client address */
1509   const char            *hostname = httpGetHostname(con->http, NULL, 0);
1510                                         /* Client hostname */
1511   unsigned              address[4];     /* Authorization address */
1512   cupsd_location_t      *best;          /* Best match for location so far */
1513   size_t                hostlen;        /* Length of hostname */
1514   char                  *name,          /* Current username */
1515                         username[256],  /* Username to authorize */
1516                         ownername[256], /* Owner name to authorize */
1517                         *ptr;           /* Pointer into username */
1518   struct passwd         *pw;            /* User password data */
1519   static const char * const levels[] =  /* Auth levels */
1520                 {
1521                   "ANON",
1522                   "USER",
1523                   "GROUP"
1524                 };
1525   static const char * const types[] =   /* Auth types */
1526                 {
1527                   "None",
1528                   "Basic",
1529                   "Negotiate"
1530                 };
1531
1532
1533   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location ? con->best->location : "(null)" : "");
1534   if (owner)
1535     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: owner=\"%s\"", owner);
1536
1537  /*
1538   * If there is no "best" authentication rule for this request, then
1539   * access is allowed from the local system and denied from other
1540   * addresses...
1541   */
1542
1543   if (!con->best)
1544   {
1545     if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1546         !strcmp(hostname, ServerName) ||
1547         cupsArrayFind(ServerAlias, (void *)hostname))
1548       return (HTTP_OK);
1549     else
1550       return (HTTP_FORBIDDEN);
1551   }
1552
1553   best = con->best;
1554
1555   if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1556     type = cupsdDefaultAuthType();
1557
1558   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels[best->level], types[type], best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1559
1560   if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1561     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)", best->op, ippOpString(best->op));
1562
1563  /*
1564   * Check host/ip-based accesses...
1565   */
1566
1567 #ifdef AF_INET6
1568   if (httpAddrFamily(hostaddr) == AF_INET6)
1569   {
1570    /*
1571     * Copy IPv6 address...
1572     */
1573
1574     address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1575     address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1576     address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1577     address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1578   }
1579   else
1580 #endif /* AF_INET6 */
1581   if (con->http->hostaddr->addr.sa_family == AF_INET)
1582   {
1583    /*
1584     * Copy IPv4 address...
1585     */
1586
1587     address[0] = 0;
1588     address[1] = 0;
1589     address[2] = 0;
1590     address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1591   }
1592   else
1593     memset(address, 0, sizeof(address));
1594
1595   hostlen = strlen(hostname);
1596
1597   auth = cupsdCheckAccess(address, hostname, hostlen, best)
1598              ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1599
1600   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth ? "DENY" : "ALLOW");
1601
1602   if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1603     return (HTTP_FORBIDDEN);
1604
1605 #ifdef HAVE_SSL
1606  /*
1607   * See if encryption is required...
1608   */
1609
1610   if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1611       _cups_strcasecmp(hostname, "localhost") &&
1612       !httpAddrLocalhost(hostaddr) &&
1613       best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1614       !(type == CUPSD_AUTH_NEGOTIATE ||
1615         (type == CUPSD_AUTH_NONE &&
1616          cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1617   {
1618     cupsdLogMessage(CUPSD_LOG_DEBUG,
1619                     "cupsdIsAuthorized: Need upgrade to TLS...");
1620     return (HTTP_UPGRADE_REQUIRED);
1621   }
1622 #endif /* HAVE_SSL */
1623
1624  /*
1625   * Now see what access level is required...
1626   */
1627
1628   if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1629       (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1630     return (HTTP_OK);
1631
1632   if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1633       best->limit == CUPSD_AUTH_LIMIT_IPP)
1634   {
1635    /*
1636     * Check for unauthenticated username...
1637     */
1638
1639     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1640
1641
1642     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1643     if (attr)
1644     {
1645       cupsdLogMessage(CUPSD_LOG_DEBUG,
1646                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1647                       attr->values[0].string.text);
1648       strlcpy(username, attr->values[0].string.text, sizeof(username));
1649     }
1650     else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1651       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1652     else
1653       return (HTTP_OK);                 /* unless overridden with Satisfy */
1654   }
1655   else
1656   {
1657     cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1658                     con->username);
1659
1660 #ifdef HAVE_AUTHORIZATION_H
1661     if (!con->username[0] && !con->authref)
1662 #else
1663     if (!con->username[0])
1664 #endif /* HAVE_AUTHORIZATION_H */
1665     {
1666       if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1667         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1668       else
1669         return (HTTP_OK);               /* unless overridden with Satisfy */
1670     }
1671
1672
1673     if (con->type != type && type != CUPSD_AUTH_NONE &&
1674 #ifdef HAVE_GSSAPI
1675         (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1676 #endif /* HAVE_GSSAPI */
1677         con->type != CUPSD_AUTH_BASIC)
1678     {
1679       cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1680                       types[con->type], types[type]);
1681
1682       return (HTTP_UNAUTHORIZED);
1683     }
1684
1685     strlcpy(username, con->username, sizeof(username));
1686   }
1687
1688  /*
1689   * OK, got a username.  See if we need normal user access, or group
1690   * access... (root always matches)
1691   */
1692
1693   if (!strcmp(username, "root"))
1694     return (HTTP_OK);
1695
1696  /*
1697   * Strip any @domain or @KDC from the username and owner...
1698   */
1699
1700   if ((ptr = strchr(username, '@')) != NULL)
1701     *ptr = '\0';
1702
1703   if (owner)
1704   {
1705     strlcpy(ownername, owner, sizeof(ownername));
1706
1707     if ((ptr = strchr(ownername, '@')) != NULL)
1708       *ptr = '\0';
1709   }
1710   else
1711     ownername[0] = '\0';
1712
1713  /*
1714   * Get the user info...
1715   */
1716
1717   if (username[0])
1718   {
1719     pw = getpwnam(username);
1720     endpwent();
1721   }
1722   else
1723     pw = NULL;
1724
1725   if (best->level == CUPSD_AUTH_USER)
1726   {
1727    /*
1728     * If there are no names associated with this location, then
1729     * any valid user is OK...
1730     */
1731
1732     if (cupsArrayCount(best->names) == 0)
1733       return (HTTP_OK);
1734
1735    /*
1736     * Otherwise check the user list and return OK if this user is
1737     * allowed...
1738     */
1739
1740     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking user membership...");
1741
1742 #ifdef HAVE_AUTHORIZATION_H
1743    /*
1744     * If an authorization reference was supplied it must match a right name...
1745     */
1746
1747     if (con->authref)
1748     {
1749       for (name = (char *)cupsArrayFirst(best->names);
1750            name;
1751            name = (char *)cupsArrayNext(best->names))
1752       {
1753         if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1754           return (HTTP_OK);
1755         else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1756                  check_authref(con, SystemGroupAuthKey))
1757           return (HTTP_OK);
1758       }
1759
1760       return (HTTP_FORBIDDEN);
1761     }
1762 #endif /* HAVE_AUTHORIZATION_H */
1763
1764     for (name = (char *)cupsArrayFirst(best->names);
1765          name;
1766          name = (char *)cupsArrayNext(best->names))
1767     {
1768       if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1769           !_cups_strcasecmp(username, ownername))
1770         return (HTTP_OK);
1771       else if (!_cups_strcasecmp(name, "@SYSTEM"))
1772       {
1773         for (i = 0; i < NumSystemGroups; i ++)
1774           if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1775             return (HTTP_OK);
1776       }
1777       else if (name[0] == '@')
1778       {
1779         if (cupsdCheckGroup(username, pw, name + 1))
1780           return (HTTP_OK);
1781       }
1782       else if (!_cups_strcasecmp(username, name))
1783         return (HTTP_OK);
1784     }
1785
1786     return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1787   }
1788
1789  /*
1790   * Check to see if this user is in any of the named groups...
1791   */
1792
1793   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group membership...");
1794
1795  /*
1796   * Check to see if this user is in any of the named groups...
1797   */
1798
1799   for (name = (char *)cupsArrayFirst(best->names);
1800        name;
1801        name = (char *)cupsArrayNext(best->names))
1802   {
1803     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1804
1805     if (!_cups_strcasecmp(name, "@SYSTEM"))
1806     {
1807       for (i = 0; i < NumSystemGroups; i ++)
1808         if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1809           return (HTTP_OK);
1810     }
1811     else if (cupsdCheckGroup(username, pw, name))
1812       return (HTTP_OK);
1813   }
1814
1815  /*
1816   * The user isn't part of the specified group, so deny access...
1817   */
1818
1819   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: User not in group(s).");
1820
1821   return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1822 }
1823
1824
1825 /*
1826  * 'cupsdNewLocation()' - Create a new location for authorization.
1827  *
1828  * Note: Still need to call cupsdAddLocation() to add it to the list of global
1829  * locations.
1830  */
1831
1832 cupsd_location_t *                      /* O - Pointer to new location record */
1833 cupsdNewLocation(const char *location)  /* I - Location path */
1834 {
1835   cupsd_location_t      *temp;          /* New location */
1836
1837
1838  /*
1839   * Try to allocate memory for the new location.
1840   */
1841
1842   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1843     return (NULL);
1844
1845  /*
1846   * Initialize the record and copy the name over...
1847   */
1848
1849   if ((temp->location = _cupsStrAlloc(location)) == NULL)
1850   {
1851     free(temp);
1852     return (NULL);
1853   }
1854
1855   temp->length = strlen(temp->location);
1856
1857  /*
1858   * Return the new record...
1859   */
1860
1861   return (temp);
1862 }
1863
1864
1865 #ifdef HAVE_AUTHORIZATION_H
1866 /*
1867  * 'check_authref()' - Check if an authorization services reference has the
1868  *                     supplied right.
1869  */
1870
1871 static int                              /* O - 1 if right is valid, 0 otherwise */
1872 check_authref(cupsd_client_t *con,      /* I - Connection */
1873               const char     *right)    /* I - Right name */
1874 {
1875   OSStatus              status;         /* OS Status */
1876   AuthorizationItem     authright;      /* Authorization right */
1877   AuthorizationRights   authrights;     /* Authorization rights */
1878   AuthorizationFlags    authflags;      /* Authorization flags */
1879
1880
1881  /*
1882   * Check to see if the user is allowed to perform the task...
1883   */
1884
1885   if (!con->authref)
1886     return (0);
1887
1888   authright.name        = right;
1889   authright.valueLength = 0;
1890   authright.value       = NULL;
1891   authright.flags       = 0;
1892
1893   authrights.count = 1;
1894   authrights.items = &authright;
1895
1896   authflags = kAuthorizationFlagDefaults |
1897               kAuthorizationFlagExtendRights;
1898
1899   if ((status = AuthorizationCopyRights(con->authref, &authrights,
1900                                         kAuthorizationEmptyEnvironment,
1901                                         authflags, NULL)) != 0)
1902   {
1903     cupsdLogMessage(CUPSD_LOG_ERROR,
1904                     "AuthorizationCopyRights(\"%s\") returned %d (%s)",
1905                     authright.name, (int)status, cssmErrorString(status));
1906     return (0);
1907   }
1908
1909   cupsdLogMessage(CUPSD_LOG_DEBUG2, "AuthorizationCopyRights(\"%s\") succeeded.", authright.name);
1910
1911   return (1);
1912 }
1913 #endif /* HAVE_AUTHORIZATION_H */
1914
1915
1916 /*
1917  * 'compare_locations()' - Compare two locations.
1918  */
1919
1920 static int                              /* O - Result of comparison */
1921 compare_locations(cupsd_location_t *a,  /* I - First location */
1922                   cupsd_location_t *b)  /* I - Second location */
1923 {
1924   return (strcmp(b->location, a->location));
1925 }
1926
1927
1928 /*
1929  * 'copy_authmask()' - Copy function for auth masks.
1930  */
1931
1932 static cupsd_authmask_t *               /* O - New auth mask */
1933 copy_authmask(cupsd_authmask_t *mask,   /* I - Existing auth mask */
1934               void             *data)   /* I - User data (unused) */
1935 {
1936   cupsd_authmask_t      *temp;          /* New auth mask */
1937
1938
1939   (void)data;
1940
1941   if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
1942   {
1943     memcpy(temp, mask, sizeof(cupsd_authmask_t));
1944
1945     if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
1946     {
1947      /*
1948       * Make a copy of the name...
1949       */
1950
1951       if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
1952       {
1953        /*
1954         * Failed to make copy...
1955         */
1956
1957         free(temp);
1958         temp = NULL;
1959       }
1960     }
1961   }
1962
1963   return (temp);
1964 }
1965
1966
1967 #if !HAVE_LIBPAM
1968 /*
1969  * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1970  *                  as needed.
1971  */
1972
1973 static char *                           /* O - Encrypted password */
1974 cups_crypt(const char *pw,              /* I - Password string */
1975            const char *salt)            /* I - Salt (key) string */
1976 {
1977   if (!strncmp(salt, "$1$", 3))
1978   {
1979    /*
1980     * Use MD5 passwords without the benefit of PAM; this is for
1981     * Slackware Linux, and the algorithm was taken from the
1982     * old shadow-19990827/lib/md5crypt.c source code... :(
1983     */
1984
1985     int                 i;              /* Looping var */
1986     unsigned long       n;              /* Output number */
1987     int                 pwlen;          /* Length of password string */
1988     const char          *salt_end;      /* End of "salt" data for MD5 */
1989     char                *ptr;           /* Pointer into result string */
1990     _cups_md5_state_t   state;          /* Primary MD5 state info */
1991     _cups_md5_state_t   state2;         /* Secondary MD5 state info */
1992     unsigned char       digest[16];     /* MD5 digest result */
1993     static char         result[120];    /* Final password string */
1994
1995
1996    /*
1997     * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
1998     * Get a maximum of 8 characters of salt data after $1$...
1999     */
2000
2001     for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2002       if (*salt_end == '$')
2003         break;
2004
2005    /*
2006     * Compute the MD5 sum we need...
2007     */
2008
2009     pwlen = strlen(pw);
2010
2011     _cupsMD5Init(&state);
2012     _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2013     _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2014
2015     _cupsMD5Init(&state2);
2016     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2017     _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2018     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2019     _cupsMD5Finish(&state2, digest);
2020
2021     for (i = pwlen; i > 0; i -= 16)
2022       _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2023
2024     for (i = pwlen; i > 0; i >>= 1)
2025       _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2026
2027     _cupsMD5Finish(&state, digest);
2028
2029     for (i = 0; i < 1000; i ++)
2030     {
2031       _cupsMD5Init(&state);
2032
2033       if (i & 1)
2034         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2035       else
2036         _cupsMD5Append(&state, digest, 16);
2037
2038       if (i % 3)
2039         _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2040
2041       if (i % 7)
2042         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2043
2044       if (i & 1)
2045         _cupsMD5Append(&state, digest, 16);
2046       else
2047         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2048
2049       _cupsMD5Finish(&state, digest);
2050     }
2051
2052    /*
2053     * Copy the final sum to the result string and return...
2054     */
2055
2056     memcpy(result, salt, (size_t)(salt_end - salt));
2057     ptr = result + (salt_end - salt);
2058     *ptr++ = '$';
2059
2060     for (i = 0; i < 5; i ++, ptr += 4)
2061     {
2062       n = ((((unsigned)digest[i] << 8) | (unsigned)digest[i + 6]) << 8);
2063
2064       if (i < 4)
2065         n |= (unsigned)digest[i + 12];
2066       else
2067         n |= (unsigned)digest[5];
2068
2069       to64(ptr, n, 4);
2070     }
2071
2072     to64(ptr, (unsigned)digest[11], 2);
2073     ptr += 2;
2074     *ptr = '\0';
2075
2076     return (result);
2077   }
2078   else
2079   {
2080    /*
2081     * Use the standard crypt() function...
2082     */
2083
2084     return (crypt(pw, salt));
2085   }
2086 }
2087 #endif /* !HAVE_LIBPAM */
2088
2089
2090 /*
2091  * 'free_authmask()' - Free function for auth masks.
2092  */
2093
2094 static void
2095 free_authmask(cupsd_authmask_t *mask,   /* I - Auth mask to free */
2096               void             *data)   /* I - User data (unused) */
2097 {
2098   (void)data;
2099
2100   if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2101     _cupsStrFree(mask->mask.name.name);
2102
2103   free(mask);
2104 }
2105
2106
2107 #if HAVE_LIBPAM
2108 /*
2109  * 'pam_func()' - PAM conversation function.
2110  */
2111
2112 static int                              /* O - Success or failure */
2113 pam_func(
2114     int                      num_msg,   /* I - Number of messages */
2115     const struct pam_message **msg,     /* I - Messages */
2116     struct pam_response      **resp,    /* O - Responses */
2117     void                     *appdata_ptr)
2118                                         /* I - Pointer to connection */
2119 {
2120   int                   i;              /* Looping var */
2121   struct pam_response   *replies;       /* Replies */
2122   cupsd_authdata_t      *data;          /* Pointer to auth data */
2123
2124
2125  /*
2126   * Allocate memory for the responses...
2127   */
2128
2129   if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2130     return (PAM_CONV_ERR);
2131
2132  /*
2133   * Answer all of the messages...
2134   */
2135
2136   DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2137
2138   data = (cupsd_authdata_t *)appdata_ptr;
2139
2140   for (i = 0; i < num_msg; i ++)
2141   {
2142     DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2143
2144     switch (msg[i]->msg_style)
2145     {
2146       case PAM_PROMPT_ECHO_ON:
2147           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2148                         data->username));
2149           replies[i].resp_retcode = PAM_SUCCESS;
2150           replies[i].resp         = strdup(data->username);
2151           break;
2152
2153       case PAM_PROMPT_ECHO_OFF:
2154           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2155                         data->password));
2156           replies[i].resp_retcode = PAM_SUCCESS;
2157           replies[i].resp         = strdup(data->password);
2158           break;
2159
2160       case PAM_TEXT_INFO:
2161           DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2162           replies[i].resp_retcode = PAM_SUCCESS;
2163           replies[i].resp         = NULL;
2164           break;
2165
2166       case PAM_ERROR_MSG:
2167           DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2168           replies[i].resp_retcode = PAM_SUCCESS;
2169           replies[i].resp         = NULL;
2170           break;
2171
2172       default:
2173           DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2174                         msg[i]->msg_style));
2175           free(replies);
2176           return (PAM_CONV_ERR);
2177     }
2178   }
2179
2180  /*
2181   * Return the responses back to PAM...
2182   */
2183
2184   *resp = replies;
2185
2186   return (PAM_SUCCESS);
2187 }
2188 #else
2189
2190
2191 /*
2192  * 'to64()' - Base64-encode an integer value...
2193  */
2194
2195 static void
2196 to64(char          *s,                  /* O - Output string */
2197      unsigned long v,                   /* I - Value to encode */
2198      int           n)                   /* I - Number of digits */
2199 {
2200   const char    *itoa64 = "./0123456789"
2201                           "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2202                           "abcdefghijklmnopqrstuvwxyz";
2203
2204
2205   for (; n > 0; n --, v >>= 6)
2206     *s++ = itoa64[v & 0x3f];
2207 }
2208 #endif /* HAVE_LIBPAM */