scheduler/auth.c

   1 /*
   2  * Authorization routines for the CUPS scheduler.
   3  *
   4  * Copyright © 2007-2019 by Apple Inc.
   5  * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * This file contains Kerberos support code, copyright 2006 by
   8  * Jelmer Vernooij.
   9  *
  10  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
  11  * information.
  12  */
  13
  14 /*
  15  * Include necessary headers...
  16  */
  17
  18 #include "cupsd.h"
  19 #include <grp.h>
  20 #ifdef HAVE_SHADOW_H
  21 #  include <shadow.h>
  22 #endif /* HAVE_SHADOW_H */
  23 #ifdef HAVE_CRYPT_H
  24 #  include <crypt.h>
  25 #endif /* HAVE_CRYPT_H */
  26 #if HAVE_LIBPAM
  27 #  ifdef HAVE_PAM_PAM_APPL_H
  28 #    include <pam/pam_appl.h>
  29 #  else
  30 #    include <security/pam_appl.h>
  31 #  endif /* HAVE_PAM_PAM_APPL_H */
  32 #endif /* HAVE_LIBPAM */
  33 #ifdef HAVE_MEMBERSHIP_H
  34 #  include <membership.h>
  35 #endif /* HAVE_MEMBERSHIP_H */
  36 #ifdef HAVE_AUTHORIZATION_H
  37 #  include <Security/AuthorizationTags.h>
  38 #endif /* HAVE_AUTHORIZATION_H */
  39 #ifdef HAVE_SYS_PARAM_H
  40 #  include <sys/param.h>
  41 #endif /* HAVE_SYS_PARAM_H */
  42 #ifdef HAVE_SYS_UCRED_H
  43 #  include <sys/ucred.h>
  44 typedef struct xucred cupsd_ucred_t;
  45 #  define CUPSD_UCRED_UID(c) (c).cr_uid
  46 #else
  47 #  ifndef __OpenBSD__
  48 typedef struct ucred cupsd_ucred_t;
  49 #  else
  50 typedef struct sockpeercred cupsd_ucred_t;
  51 #  endif
  52 #  define CUPSD_UCRED_UID(c) (c).uid
  53 #endif /* HAVE_SYS_UCRED_H */
  54
  55
  56 /*
  57  * Local functions...
  58  */
  59
  60 #ifdef HAVE_AUTHORIZATION_H
  61 static int              check_authref(cupsd_client_t *con, const char *right);
  62 #endif /* HAVE_AUTHORIZATION_H */
  63 static int              compare_locations(cupsd_location_t *a,
  64                                           cupsd_location_t *b);
  65 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
  66 static void             free_authmask(cupsd_authmask_t *am, void *data);
  67 #if HAVE_LIBPAM
  68 static int              pam_func(int, const struct pam_message **,
  69                                  struct pam_response **, void *);
  70 #endif /* HAVE_LIBPAM */
  71
  72
  73 /*
  74  * Local structures...
  75  */
  76
  77 #if HAVE_LIBPAM
  78 typedef struct cupsd_authdata_s         /**** Authentication data ****/
  79 {
  80   char  username[HTTP_MAX_VALUE],       /* Username string */
  81         password[HTTP_MAX_VALUE];       /* Password string */
  82 } cupsd_authdata_t;
  83 #endif /* HAVE_LIBPAM */
  84
  85
  86 /*
  87  * 'cupsdAddIPMask()' - Add an IP address authorization mask.
  88  */
  89
  90 int                                     /* O  - 1 on success, 0 on failure */
  91 cupsdAddIPMask(
  92     cups_array_t   **masks,             /* IO - Masks array (created as needed) */
  93     const unsigned address[4],          /* I  - IP address */
  94     const unsigned netmask[4])          /* I  - IP netmask */
  95 {
  96   cupsd_authmask_t      temp;           /* New host/domain mask */
  97
  98
  99   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", masks, *masks, address[0], address[1], address[2], address[3], netmask[0], netmask[1], netmask[2], netmask[3]);
 100
 101   temp.type = CUPSD_AUTH_IP;
 102   memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
 103   memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
 104
 105  /*
 106   * Create the masks array as needed and add...
 107   */
 108
 109   if (!*masks)
 110     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 111                            (cups_acopy_func_t)copy_authmask,
 112                            (cups_afree_func_t)free_authmask);
 113
 114   return (cupsArrayAdd(*masks, &temp));
 115 }
 116
 117
 118 /*
 119  * 'cupsdAddLocation()' - Add a location for authorization.
 120  */
 121
 122 void
 123 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
 124 {
 125  /*
 126   * Make sure the locations array is created...
 127   */
 128
 129   if (!Locations)
 130     Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
 131                               (cups_ahash_func_t)NULL, 0,
 132                               (cups_acopy_func_t)NULL,
 133                               (cups_afree_func_t)cupsdFreeLocation);
 134
 135   if (Locations)
 136   {
 137     cupsArrayAdd(Locations, loc);
 138
 139     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"", loc->location ? loc->location : "(null)");
 140   }
 141 }
 142
 143
 144 /*
 145  * 'cupsdAddName()' - Add a name to a location...
 146  */
 147
 148 void
 149 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 150              char             *name)    /* I - Name to add */
 151 {
 152   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")", loc, name);
 153
 154   if (!loc->names)
 155     loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
 156                                (cups_acopy_func_t)_cupsStrAlloc,
 157                                (cups_afree_func_t)_cupsStrFree);
 158
 159   if (!cupsArrayAdd(loc->names, name))
 160   {
 161     cupsdLogMessage(CUPSD_LOG_ERROR,
 162                     "Unable to duplicate name for location %s: %s",
 163                     loc->location ? loc->location : "nil", strerror(errno));
 164     return;
 165   }
 166 }
 167
 168
 169 /*
 170  * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
 171  */
 172
 173 int                                     /* O  - 1 on success, 0 on failure */
 174 cupsdAddNameMask(cups_array_t **masks,  /* IO - Masks array (created as needed) */
 175                  char         *name)    /* I  - Host or interface name */
 176 {
 177   cupsd_authmask_t      temp;           /* New host/domain mask */
 178   char                  ifname[32],     /* Interface name */
 179                         *ifptr;         /* Pointer to end of name */
 180
 181
 182   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", masks, *masks, name);
 183
 184   if (!_cups_strcasecmp(name, "@LOCAL"))
 185   {
 186    /*
 187     * Deny *interface*...
 188     */
 189
 190     temp.type           = CUPSD_AUTH_INTERFACE;
 191     temp.mask.name.name = (char *)"*";
 192   }
 193   else if (!_cups_strncasecmp(name, "@IF(", 4))
 194   {
 195    /*
 196     * Deny *interface*...
 197     */
 198
 199     strlcpy(ifname, name + 4, sizeof(ifname));
 200
 201     ifptr = ifname + strlen(ifname) - 1;
 202
 203     if (ifptr >= ifname && *ifptr == ')')
 204     {
 205       ifptr --;
 206       *ifptr = '\0';
 207     }
 208
 209     temp.type             = CUPSD_AUTH_INTERFACE;
 210     temp.mask.name.name   = ifname;
 211   }
 212   else
 213   {
 214    /*
 215     * Deny name...
 216     */
 217
 218     if (*name == '*')
 219       name ++;
 220
 221     temp.type             = CUPSD_AUTH_NAME;
 222     temp.mask.name.name   = (char *)name;
 223   }
 224
 225  /*
 226   * Set the name length...
 227   */
 228
 229   temp.mask.name.length = strlen(temp.mask.name.name);
 230
 231  /*
 232   * Create the masks array as needed and add...
 233   */
 234
 235   if (!*masks)
 236     *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
 237                            (cups_acopy_func_t)copy_authmask,
 238                            (cups_afree_func_t)free_authmask);
 239
 240   return (cupsArrayAdd(*masks, &temp));
 241 }
 242
 243
 244 /*
 245  * 'cupsdAuthorize()' - Validate any authorization credentials.
 246  */
 247
 248 void
 249 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 250 {
 251   int           type;                   /* Authentication type */
 252   const char    *authorization;         /* Pointer into Authorization string */
 253   char          *ptr,                   /* Pointer into string */
 254                 username[HTTP_MAX_VALUE],
 255                                         /* Username string */
 256                 password[HTTP_MAX_VALUE];
 257                                         /* Password string */
 258   cupsd_cert_t  *localuser;             /* Certificate username */
 259
 260
 261  /*
 262   * Locate the best matching location so we know what kind of
 263   * authentication to expect...
 264   */
 265
 266   con->best = cupsdFindBest(con->uri, httpGetState(con->http));
 267   con->type = CUPSD_AUTH_NONE;
 268
 269   cupsdLogClient(con, CUPSD_LOG_DEBUG2, "con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location : "");
 270
 271   if (con->best && con->best->type != CUPSD_AUTH_NONE)
 272   {
 273     if (con->best->type == CUPSD_AUTH_DEFAULT)
 274       type = cupsdDefaultAuthType();
 275     else
 276       type = con->best->type;
 277   }
 278   else
 279     type = cupsdDefaultAuthType();
 280
 281  /*
 282   * Decode the Authorization string...
 283   */
 284
 285   authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
 286
 287   username[0] = '\0';
 288   password[0] = '\0';
 289
 290 #ifdef HAVE_GSSAPI
 291   con->gss_uid = 0;
 292 #endif /* HAVE_GSSAPI */
 293
 294 #ifdef HAVE_AUTHORIZATION_H
 295   if (con->authref)
 296   {
 297     AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
 298     con->authref = NULL;
 299   }
 300 #endif /* HAVE_AUTHORIZATION_H */
 301
 302   if (!*authorization)
 303   {
 304    /*
 305     * No authorization data provided, return early...
 306     */
 307
 308     cupsdLogClient(con, CUPSD_LOG_DEBUG, "No authentication data provided.");
 309     return;
 310   }
 311 #ifdef HAVE_AUTHORIZATION_H
 312   else if (!strncmp(authorization, "AuthRef ", 8) &&
 313            httpAddrLocalhost(httpGetAddress(con->http)))
 314   {
 315     OSStatus            status;         /* Status */
 316     char                authdata[HTTP_MAX_VALUE];
 317                                         /* Nonce value from client */
 318     int                 authlen;        /* Auth string length */
 319     AuthorizationItemSet *authinfo;     /* Authorization item set */
 320
 321    /*
 322     * Get the Authorization Services data...
 323     */
 324
 325     authorization += 8;
 326     while (isspace(*authorization & 255))
 327       authorization ++;
 328
 329     authlen = sizeof(authdata);
 330     httpDecode64_2(authdata, &authlen, authorization);
 331
 332     if (authlen != kAuthorizationExternalFormLength)
 333     {
 334       cupsdLogClient(con, CUPSD_LOG_ERROR, "External Authorization reference size is incorrect.");
 335       return;
 336     }
 337
 338     if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
 339     {
 340       cupsdLogClient(con, CUPSD_LOG_ERROR, "AuthorizationCreateFromExternalForm returned %d", (int)status);
 341       return;
 342     }
 343
 344     username[0] = '\0';
 345
 346     if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
 347                                &authinfo))
 348     {
 349       if (authinfo->count == 1 && authinfo->items[0].value &&
 350           authinfo->items[0].valueLength >= 2)
 351       {
 352         strlcpy(username, authinfo->items[0].value, sizeof(username));
 353
 354         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef.", username);
 355       }
 356
 357       AuthorizationFreeItemSet(authinfo);
 358     }
 359
 360     if (!username[0])
 361     {
 362      /*
 363       * No username in AuthRef, grab username using peer credentials...
 364       */
 365
 366       struct passwd     *pwd;           /* Password entry for this user */
 367       cupsd_ucred_t     peercred;       /* Peer credentials */
 368       socklen_t         peersize;       /* Size of peer credentials */
 369
 370       peersize = sizeof(peercred);
 371
 372       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 373       {
 374         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 375         return;
 376       }
 377
 378       if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
 379       {
 380         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred));
 381         return;
 382       }
 383
 384       strlcpy(username, pwd->pw_name, sizeof(username));
 385
 386       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef + PeerCred.", username);
 387     }
 388
 389     con->type = CUPSD_AUTH_BASIC;
 390   }
 391 #endif /* HAVE_AUTHORIZATION_H */
 392 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
 393   else if (!strncmp(authorization, "PeerCred ", 9) &&
 394            con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
 395   {
 396    /*
 397     * Use peer credentials from domain socket connection...
 398     */
 399
 400     struct passwd       *pwd;           /* Password entry for this user */
 401     cupsd_ucred_t       peercred;       /* Peer credentials */
 402     socklen_t           peersize;       /* Size of peer credentials */
 403 #ifdef HAVE_AUTHORIZATION_H
 404     const char          *name;          /* Authorizing name */
 405     int                 no_peer = 0;    /* Don't allow peer credentials? */
 406
 407    /*
 408     * See if we should allow peer credentials...
 409     */
 410
 411     for (name = (char *)cupsArrayFirst(con->best->names);
 412          name;
 413          name = (char *)cupsArrayNext(con->best->names))
 414     {
 415       if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
 416           !_cups_strcasecmp(name, "@SYSTEM"))
 417       {
 418        /* Normally don't want peer credentials if we need an auth key... */
 419         no_peer = 1;
 420       }
 421       else if (!_cups_strcasecmp(name, "@OWNER"))
 422       {
 423        /* but if @OWNER is present then we allow it... */
 424         no_peer = 0;
 425         break;
 426       }
 427     }
 428
 429     if (no_peer)
 430     {
 431       cupsdLogClient(con, CUPSD_LOG_ERROR, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
 432       return;
 433     }
 434 #endif /* HAVE_AUTHORIZATION_H */
 435
 436     if ((pwd = getpwnam(authorization + 9)) == NULL)
 437     {
 438       cupsdLogClient(con, CUPSD_LOG_ERROR, "User \"%s\" does not exist.", authorization + 9);
 439       return;
 440     }
 441
 442     peersize = sizeof(peercred);
 443
 444 #  ifdef __APPLE__
 445     if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 446 #  else
 447     if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
 448 #  endif /* __APPLE__ */
 449     {
 450       cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 451       return;
 452     }
 453
 454     if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
 455     {
 456       cupsdLogClient(con, CUPSD_LOG_ERROR, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization + 9, CUPSD_UCRED_UID(peercred), pwd->pw_uid);
 457 #  ifdef HAVE_SYS_UCRED_H
 458       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_version=%d", peercred.cr_version);
 459       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_uid=%d", peercred.cr_uid);
 460       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_ngroups=%d", peercred.cr_ngroups);
 461       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_groups[0]=%d", peercred.cr_groups[0]);
 462 #  endif /* HAVE_SYS_UCRED_H */
 463       return;
 464     }
 465
 466     strlcpy(username, authorization + 9, sizeof(username));
 467
 468 #  ifdef HAVE_GSSAPI
 469     con->gss_uid = CUPSD_UCRED_UID(peercred);
 470 #  endif /* HAVE_GSSAPI */
 471
 472     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using PeerCred.", username);
 473
 474     con->type = CUPSD_AUTH_BASIC;
 475   }
 476 #endif /* SO_PEERCRED && AF_LOCAL */
 477   else if (!strncmp(authorization, "Local", 5) &&
 478            httpAddrLocalhost(httpGetAddress(con->http)))
 479   {
 480    /*
 481     * Get Local certificate authentication data...
 482     */
 483
 484     authorization += 5;
 485     while (isspace(*authorization & 255))
 486       authorization ++;
 487
 488     if ((localuser = cupsdFindCert(authorization)) == NULL)
 489     {
 490       cupsdLogClient(con, CUPSD_LOG_ERROR, "Local authentication certificate not found.");
 491       return;
 492     }
 493
 494     strlcpy(username, localuser->username, sizeof(username));
 495     con->type = localuser->type;
 496
 497     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using Local.", username);
 498   }
 499   else if (!strncmp(authorization, "Basic", 5))
 500   {
 501    /*
 502     * Get the Basic authentication data...
 503     */
 504
 505     int userlen;                        /* Username:password length */
 506
 507
 508     authorization += 5;
 509     while (isspace(*authorization & 255))
 510       authorization ++;
 511
 512     userlen = sizeof(username);
 513     httpDecode64_2(username, &userlen, authorization);
 514
 515    /*
 516     * Pull the username and password out...
 517     */
 518
 519     if ((ptr = strchr(username, ':')) == NULL)
 520     {
 521       cupsdLogClient(con, CUPSD_LOG_ERROR, "Missing Basic password.");
 522       return;
 523     }
 524
 525     *ptr++ = '\0';
 526
 527     if (!username[0])
 528     {
 529      /*
 530       * Username must not be empty...
 531       */
 532
 533       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic username.");
 534       return;
 535     }
 536
 537     if (!*ptr)
 538     {
 539      /*
 540       * Password must not be empty...
 541       */
 542
 543       cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic password.");
 544       return;
 545     }
 546
 547     strlcpy(password, ptr, sizeof(password));
 548
 549    /*
 550     * Validate the username and password...
 551     */
 552
 553     switch (type)
 554     {
 555       default :
 556       case CUPSD_AUTH_BASIC :
 557           {
 558 #if HAVE_LIBPAM
 559            /*
 560             * Only use PAM to do authentication.  This supports MD5
 561             * passwords, among other things...
 562             */
 563
 564             pam_handle_t        *pamh;  /* PAM authentication handle */
 565             int                 pamerr; /* PAM error code */
 566             struct pam_conv     pamdata;/* PAM conversation data */
 567             cupsd_authdata_t    data;   /* Authentication data */
 568
 569
 570             strlcpy(data.username, username, sizeof(data.username));
 571             strlcpy(data.password, password, sizeof(data.password));
 572
 573 #  ifdef __sun
 574             pamdata.conv        = (int (*)(int, struct pam_message **,
 575                                            struct pam_response **,
 576                                            void *))pam_func;
 577 #  else
 578             pamdata.conv        = pam_func;
 579 #  endif /* __sun */
 580             pamdata.appdata_ptr = &data;
 581
 582             pamerr = pam_start("cups", username, &pamdata, &pamh);
 583             if (pamerr != PAM_SUCCESS)
 584             {
 585               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_start() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 586               return;
 587             }
 588
 589 #  ifdef HAVE_PAM_SET_ITEM
 590 #    ifdef PAM_RHOST
 591             pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
 592             if (pamerr != PAM_SUCCESS)
 593               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 594 #    endif /* PAM_RHOST */
 595
 596 #    ifdef PAM_TTY
 597             pamerr = pam_set_item(pamh, PAM_TTY, "cups");
 598             if (pamerr != PAM_SUCCESS)
 599               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 600 #    endif /* PAM_TTY */
 601 #  endif /* HAVE_PAM_SET_ITEM */
 602
 603             pamerr = pam_authenticate(pamh, PAM_SILENT);
 604             if (pamerr != PAM_SUCCESS)
 605             {
 606               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_authenticate() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 607               pam_end(pamh, 0);
 608               return;
 609             }
 610
 611 #  ifdef HAVE_PAM_SETCRED
 612             pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
 613             if (pamerr != PAM_SUCCESS)
 614               cupsdLogClient(con, CUPSD_LOG_WARN, "pam_setcred() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 615 #  endif /* HAVE_PAM_SETCRED */
 616
 617             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 618             if (pamerr != PAM_SUCCESS)
 619             {
 620               cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_acct_mgmt() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
 621               pam_end(pamh, 0);
 622               return;
 623             }
 624
 625             pam_end(pamh, PAM_SUCCESS);
 626
 627 #else
 628            /*
 629             * Use normal UNIX password file-based authentication...
 630             */
 631
 632             char                *pass;  /* Encrypted password */
 633             struct passwd       *pw;    /* User password data */
 634 #  ifdef HAVE_SHADOW_H
 635             struct spwd         *spw;   /* Shadow password data */
 636 #  endif /* HAVE_SHADOW_H */
 637
 638
 639             pw = getpwnam(username);    /* Get the current password */
 640             endpwent();                 /* Close the password file */
 641
 642             if (!pw)
 643             {
 644              /*
 645               * No such user...
 646               */
 647
 648               cupsdLogClient(con, CUPSD_LOG_ERROR, "Unknown username \"%s\".", username);
 649               return;
 650             }
 651
 652 #  ifdef HAVE_SHADOW_H
 653             spw = getspnam(username);
 654             endspent();
 655
 656             if (!spw && !strcmp(pw->pw_passwd, "x"))
 657             {
 658              /*
 659               * Don't allow blank passwords!
 660               */
 661
 662               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no shadow password.", username);
 663               return;
 664             }
 665
 666             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 667 #  else
 668             if (!pw->pw_passwd[0])
 669 #  endif /* HAVE_SHADOW_H */
 670             {
 671              /*
 672               * Don't allow blank passwords!
 673               */
 674
 675               cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no password.", username);
 676               return;
 677             }
 678
 679            /*
 680             * OK, the password isn't blank, so compare with what came from the
 681             * client...
 682             */
 683
 684             pass = crypt(password, pw->pw_passwd);
 685
 686             if (!pass || strcmp(pw->pw_passwd, pass))
 687             {
 688 #  ifdef HAVE_SHADOW_H
 689               if (spw)
 690               {
 691                 pass = crypt(password, spw->sp_pwdp);
 692
 693                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 694                 {
 695                   cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 696                   return;
 697                 }
 698               }
 699               else
 700 #  endif /* HAVE_SHADOW_H */
 701               {
 702                 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
 703                 return;
 704               }
 705             }
 706 #endif /* HAVE_LIBPAM */
 707           }
 708
 709           cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
 710           break;
 711     }
 712
 713     con->type = type;
 714   }
 715 #ifdef HAVE_GSSAPI
 716   else if (!strncmp(authorization, "Negotiate", 9))
 717   {
 718     int                 len;            /* Length of authorization string */
 719     gss_ctx_id_t        context;        /* Authorization context */
 720     OM_uint32           major_status,   /* Major status code */
 721                         minor_status;   /* Minor status code */
 722     gss_buffer_desc     input_token = GSS_C_EMPTY_BUFFER,
 723                                         /* Input token from string */
 724                         output_token = GSS_C_EMPTY_BUFFER;
 725                                         /* Output token for username */
 726     gss_name_t          client_name;    /* Client name */
 727
 728
 729 #  ifdef __APPLE__
 730    /*
 731     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
 732     * to use it...
 733     */
 734
 735     if (&gss_init_sec_context == NULL)
 736     {
 737       cupsdLogClient(con, CUPSD_LOG_WARN, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
 738       return;
 739     }
 740 #  endif /* __APPLE__ */
 741
 742    /*
 743     * Find the start of the Kerberos input token...
 744     */
 745
 746     authorization += 9;
 747     while (isspace(*authorization & 255))
 748       authorization ++;
 749
 750     if (!*authorization)
 751     {
 752       cupsdLogClient(con, CUPSD_LOG_DEBUG2, "No authentication data specified.");
 753       return;
 754     }
 755
 756    /*
 757     * Decode the authorization string to get the input token...
 758     */
 759
 760     len                = (int)strlen(authorization) + 0;
 761     input_token.value  = malloc((size_t)len);
 762     input_token.value  = httpDecode64_2(input_token.value, &len,
 763                                         authorization);
 764     input_token.length = (size_t)len;
 765
 766    /*
 767     * Accept the input token to get the authorization info...
 768     */
 769
 770     context      = GSS_C_NO_CONTEXT;
 771     client_name  = GSS_C_NO_NAME;
 772     major_status = gss_accept_sec_context(&minor_status,
 773                                           &context,
 774                                           ServerCreds,
 775                                           &input_token,
 776                                           GSS_C_NO_CHANNEL_BINDINGS,
 777                                           &client_name,
 778                                           NULL,
 779                                           &output_token,
 780                                           NULL,
 781                                           NULL,
 782                                           NULL);
 783
 784     if (output_token.length > 0)
 785       gss_release_buffer(&minor_status, &output_token);
 786
 787     if (GSS_ERROR(major_status))
 788     {
 789       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error accepting GSSAPI security context.", con->number);
 790
 791       if (context != GSS_C_NO_CONTEXT)
 792         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 793       return;
 794     }
 795
 796     con->have_gss = 1;
 797
 798    /*
 799     * Get the username associated with the client's credentials...
 800     */
 801
 802     if (major_status == GSS_S_CONTINUE_NEEDED)
 803       cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Credentials not complete.", con->number);
 804     else if (major_status == GSS_S_COMPLETE)
 805     {
 806       major_status = gss_display_name(&minor_status, client_name,
 807                                       &output_token, NULL);
 808
 809       if (GSS_ERROR(major_status))
 810       {
 811         cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error getting username.", con->number);
 812         gss_release_name(&minor_status, &client_name);
 813         gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 814         return;
 815       }
 816
 817       strlcpy(username, output_token.value, sizeof(username));
 818
 819       cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Negotiate.", username);
 820
 821       gss_release_name(&minor_status, &client_name);
 822       gss_release_buffer(&minor_status, &output_token);
 823
 824       con->type = CUPSD_AUTH_NEGOTIATE;
 825     }
 826
 827     gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
 828
 829 #  if defined(SO_PEERCRED) && defined(AF_LOCAL)
 830    /*
 831     * Get the client's UID if we are printing locally - that allows a backend
 832     * to run as the correct user to get Kerberos credentials of its own.
 833     */
 834
 835     if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
 836     {
 837       cupsd_ucred_t     peercred;       /* Peer credentials */
 838       socklen_t         peersize;       /* Size of peer credentials */
 839
 840       peersize = sizeof(peercred);
 841
 842 #    ifdef __APPLE__
 843       if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
 844 #    else
 845       if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
 846                      &peersize))
 847 #    endif /* __APPLE__ */
 848       {
 849         cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
 850       }
 851       else
 852       {
 853         cupsdLogClient(con, CUPSD_LOG_DEBUG, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred));
 854         con->gss_uid = CUPSD_UCRED_UID(peercred);
 855       }
 856     }
 857 #  endif /* SO_PEERCRED && AF_LOCAL */
 858   }
 859 #endif /* HAVE_GSSAPI */
 860   else
 861   {
 862     char        scheme[256];            /* Auth scheme... */
 863
 864
 865     if (sscanf(authorization, "%255s", scheme) != 1)
 866       strlcpy(scheme, "UNKNOWN", sizeof(scheme));
 867
 868     cupsdLogClient(con, CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\".", scheme);
 869     return;
 870   }
 871
 872  /*
 873   * If we get here, then we were able to validate the username and
 874   * password - copy the validated username and password to the client
 875   * data and return...
 876   */
 877
 878   strlcpy(con->username, username, sizeof(con->username));
 879   strlcpy(con->password, password, sizeof(con->password));
 880 }
 881
 882
 883 /*
 884  * 'cupsdCheckAccess()' - Check whether the given address is allowed to
 885  *                        access a location.
 886  */
 887
 888 int                                     /* O - 1 if allowed, 0 otherwise */
 889 cupsdCheckAccess(
 890     unsigned         ip[4],             /* I - Client address */
 891     const char       *name,             /* I - Client hostname */
 892     size_t           namelen,           /* I - Length of hostname */
 893     cupsd_location_t *loc)              /* I - Location to check */
 894 {
 895   int   allow;                          /* 1 if allowed, 0 otherwise */
 896
 897
 898   if (!_cups_strcasecmp(name, "localhost"))
 899   {
 900    /*
 901     * Access from localhost (127.0.0.1 or ::1) is always allowed...
 902     */
 903
 904     return (1);
 905   }
 906   else
 907   {
 908    /*
 909     * Do authorization checks on the domain/address...
 910     */
 911
 912     switch (loc->order_type)
 913     {
 914       default :
 915           allow = 0;    /* anti-compiler-warning-code */
 916           break;
 917
 918       case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
 919           allow = 1;
 920
 921           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 922             allow = 0;
 923
 924           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 925             allow = 1;
 926           break;
 927
 928       case CUPSD_AUTH_DENY : /* Order Allow,Deny */
 929           allow = 0;
 930
 931           if (cupsdCheckAuth(ip, name, namelen, loc->allow))
 932             allow = 1;
 933
 934           if (cupsdCheckAuth(ip, name, namelen, loc->deny))
 935             allow = 0;
 936           break;
 937     }
 938   }
 939
 940   return (allow);
 941 }
 942
 943
 944 /*
 945  * 'cupsdCheckAuth()' - Check authorization masks.
 946  */
 947
 948 int                                     /* O - 1 if mask matches, 0 otherwise */
 949 cupsdCheckAuth(unsigned     ip[4],      /* I - Client address */
 950                const char   *name,      /* I - Client hostname */
 951                size_t       name_len,   /* I - Length of hostname */
 952                cups_array_t *masks)     /* I - Masks */
 953 {
 954   int                   i;              /* Looping var */
 955   cupsd_authmask_t      *mask;          /* Current mask */
 956   cupsd_netif_t         *iface;         /* Network interface */
 957   unsigned              netip4;         /* IPv4 network address */
 958 #ifdef AF_INET6
 959   unsigned              netip6[4];      /* IPv6 network address */
 960 #endif /* AF_INET6 */
 961
 962
 963   for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
 964        mask;
 965        mask = (cupsd_authmask_t *)cupsArrayNext(masks))
 966   {
 967     switch (mask->type)
 968     {
 969       case CUPSD_AUTH_INTERFACE :
 970          /*
 971           * Check for a match with a network interface...
 972           */
 973
 974           netip4 = htonl(ip[3]);
 975
 976 #ifdef AF_INET6
 977           netip6[0] = htonl(ip[0]);
 978           netip6[1] = htonl(ip[1]);
 979           netip6[2] = htonl(ip[2]);
 980           netip6[3] = htonl(ip[3]);
 981 #endif /* AF_INET6 */
 982
 983           cupsdNetIFUpdate();
 984
 985           if (!strcmp(mask->mask.name.name, "*"))
 986           {
 987 #ifdef __APPLE__
 988            /*
 989             * Allow Back-to-My-Mac addresses...
 990             */
 991
 992             if ((ip[0] & 0xff000000) == 0xfd000000)
 993               return (1);
 994 #endif /* __APPLE__ */
 995
 996            /*
 997             * Check against all local interfaces...
 998             */
 999
1000             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1001                  iface;
1002                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1003             {
1004              /*
1005               * Only check local interfaces...
1006               */
1007
1008               if (!iface->is_local)
1009                 continue;
1010
1011               if (iface->address.addr.sa_family == AF_INET)
1012               {
1013                /*
1014                 * Check IPv4 address...
1015                 */
1016
1017                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1018                     (iface->address.ipv4.sin_addr.s_addr &
1019                      iface->mask.ipv4.sin_addr.s_addr))
1020                   return (1);
1021               }
1022 #ifdef AF_INET6
1023               else
1024               {
1025                /*
1026                 * Check IPv6 address...
1027                 */
1028
1029                 for (i = 0; i < 4; i ++)
1030                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1031                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1032                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1033                     break;
1034
1035                 if (i == 4)
1036                   return (1);
1037               }
1038 #endif /* AF_INET6 */
1039             }
1040           }
1041           else
1042           {
1043            /*
1044             * Check the named interface...
1045             */
1046
1047             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1048                  iface;
1049                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1050             {
1051               if (strcmp(mask->mask.name.name, iface->name))
1052                 continue;
1053
1054               if (iface->address.addr.sa_family == AF_INET)
1055               {
1056                /*
1057                 * Check IPv4 address...
1058                 */
1059
1060                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1061                     (iface->address.ipv4.sin_addr.s_addr &
1062                      iface->mask.ipv4.sin_addr.s_addr))
1063                   return (1);
1064               }
1065 #ifdef AF_INET6
1066               else
1067               {
1068                /*
1069                 * Check IPv6 address...
1070                 */
1071
1072                 for (i = 0; i < 4; i ++)
1073                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1074                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1075                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1076                     break;
1077
1078                 if (i == 4)
1079                   return (1);
1080               }
1081 #endif /* AF_INET6 */
1082             }
1083           }
1084           break;
1085
1086       case CUPSD_AUTH_NAME :
1087          /*
1088           * Check for exact name match...
1089           */
1090
1091           if (!_cups_strcasecmp(name, mask->mask.name.name))
1092             return (1);
1093
1094          /*
1095           * Check for domain match...
1096           */
1097
1098           if (name_len >= mask->mask.name.length &&
1099               mask->mask.name.name[0] == '.' &&
1100               !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1101                           mask->mask.name.name))
1102             return (1);
1103           break;
1104
1105       case CUPSD_AUTH_IP :
1106          /*
1107           * Check for IP/network address match...
1108           */
1109
1110           for (i = 0; i < 4; i ++)
1111             if ((ip[i] & mask->mask.ip.netmask[i]) !=
1112                     mask->mask.ip.address[i])
1113               break;
1114
1115           if (i == 4)
1116             return (1);
1117           break;
1118     }
1119   }
1120
1121   return (0);
1122 }
1123
1124
1125 /*
1126  * 'cupsdCheckGroup()' - Check for a user's group membership.
1127  */
1128
1129 int                                     /* O - 1 if user is a member, 0 otherwise */
1130 cupsdCheckGroup(
1131     const char    *username,            /* I - User name */
1132     struct passwd *user,                /* I - System user info */
1133     const char    *groupname)           /* I - Group name */
1134 {
1135   int           i;                      /* Looping var */
1136   struct group  *group;                 /* Group info */
1137   gid_t         groupid;                /* ID of named group */
1138 #ifdef HAVE_MBR_UID_TO_UUID
1139   uuid_t        useruuid,               /* UUID for username */
1140                 groupuuid;              /* UUID for groupname */
1141   int           is_member;              /* True if user is a member of group */
1142 #endif /* HAVE_MBR_UID_TO_UUID */
1143
1144
1145   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username, user, groupname);
1146
1147  /*
1148   * Validate input...
1149   */
1150
1151   if (!username || !groupname)
1152     return (0);
1153
1154  /*
1155   * Check to see if the user is a member of the named group...
1156   */
1157
1158   group = getgrnam(groupname);
1159   endgrent();
1160
1161   if (group != NULL)
1162   {
1163    /*
1164     * Group exists, check it...
1165     */
1166
1167     groupid = group->gr_gid;
1168
1169     for (i = 0; group->gr_mem[i]; i ++)
1170     {
1171      /*
1172       * User appears in the group membership...
1173       */
1174
1175       if (!_cups_strcasecmp(username, group->gr_mem[i]))
1176         return (1);
1177     }
1178
1179 #ifdef HAVE_GETGROUPLIST
1180    /*
1181     * If the user isn't in the group membership list, try the results from
1182     * getgrouplist() which is supposed to return the full list of groups a user
1183     * belongs to...
1184     */
1185
1186     if (user)
1187     {
1188       int       ngroups;                /* Number of groups */
1189 #  ifdef __APPLE__
1190       int       groups[2048];           /* Groups that user belongs to */
1191 #  else
1192       gid_t     groups[2048];           /* Groups that user belongs to */
1193 #  endif /* __APPLE__ */
1194
1195       ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
1196 #  ifdef __APPLE__
1197       getgrouplist(username, (int)user->pw_gid, groups, &ngroups);
1198 #  else
1199       getgrouplist(username, user->pw_gid, groups, &ngroups);
1200 #endif /* __APPLE__ */
1201
1202       for (i = 0; i < ngroups; i ++)
1203         if ((int)groupid == (int)groups[i])
1204           return (1);
1205     }
1206 #endif /* HAVE_GETGROUPLIST */
1207   }
1208   else
1209     groupid = (gid_t)-1;
1210
1211  /*
1212   * Group doesn't exist or user not in group list, check the group ID
1213   * against the user's group ID...
1214   */
1215
1216   if (user && groupid == user->pw_gid)
1217     return (1);
1218
1219 #ifdef HAVE_MBR_UID_TO_UUID
1220  /*
1221   * Check group membership through macOS membership API...
1222   */
1223
1224   if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1225   {
1226     if (groupid != (gid_t)-1)
1227     {
1228      /*
1229       * Map group name to UUID and check membership...
1230       */
1231
1232       if (!mbr_gid_to_uuid(groupid, groupuuid))
1233         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1234           if (is_member)
1235             return (1);
1236     }
1237     else if (groupname[0] == '#')
1238     {
1239      /*
1240       * Use UUID directly and check for equality (user UUID) and
1241       * membership (group UUID)...
1242       */
1243
1244       if (!uuid_parse((char *)groupname + 1, groupuuid))
1245       {
1246         if (!uuid_compare(useruuid, groupuuid))
1247           return (1);
1248         else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1249           if (is_member)
1250             return (1);
1251       }
1252
1253       return (0);
1254     }
1255   }
1256   else if (groupname[0] == '#')
1257     return (0);
1258 #endif /* HAVE_MBR_UID_TO_UUID */
1259
1260  /*
1261   * If we get this far, then the user isn't part of the named group...
1262   */
1263
1264   return (0);
1265 }
1266
1267
1268 /*
1269  * 'cupsdCopyLocation()' - Make a copy of a location...
1270  */
1271
1272 cupsd_location_t *                      /* O - New location */
1273 cupsdCopyLocation(
1274     cupsd_location_t *loc)              /* I - Original location */
1275 {
1276   cupsd_location_t      *temp;          /* New location */
1277
1278
1279  /*
1280   * Make a copy of the original location...
1281   */
1282
1283   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1284     return (NULL);
1285
1286  /*
1287   * Copy the information from the original location to the new one.
1288   */
1289
1290   if (!loc)
1291     return (temp);
1292
1293   if (loc->location)
1294     temp->location = _cupsStrAlloc(loc->location);
1295
1296   temp->length     = loc->length;
1297   temp->limit      = loc->limit;
1298   temp->order_type = loc->order_type;
1299   temp->type       = loc->type;
1300   temp->level      = loc->level;
1301   temp->satisfy    = loc->satisfy;
1302   temp->encryption = loc->encryption;
1303
1304   if (loc->names)
1305   {
1306     if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1307     {
1308       cupsdLogMessage(CUPSD_LOG_ERROR,
1309                       "Unable to allocate memory for %d names: %s",
1310                       cupsArrayCount(loc->names), strerror(errno));
1311
1312       cupsdFreeLocation(temp);
1313       return (NULL);
1314     }
1315   }
1316
1317   if (loc->allow)
1318   {
1319    /*
1320     * Copy allow rules...
1321     */
1322
1323     if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1324     {
1325       cupsdLogMessage(CUPSD_LOG_ERROR,
1326                       "Unable to allocate memory for %d allow rules: %s",
1327                       cupsArrayCount(loc->allow), strerror(errno));
1328       cupsdFreeLocation(temp);
1329       return (NULL);
1330     }
1331   }
1332
1333   if (loc->deny)
1334   {
1335    /*
1336     * Copy deny rules...
1337     */
1338
1339     if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1340     {
1341       cupsdLogMessage(CUPSD_LOG_ERROR,
1342                       "Unable to allocate memory for %d deny rules: %s",
1343                       cupsArrayCount(loc->deny), strerror(errno));
1344       cupsdFreeLocation(temp);
1345       return (NULL);
1346     }
1347   }
1348
1349   return (temp);
1350 }
1351
1352
1353 /*
1354  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1355  */
1356
1357 void
1358 cupsdDeleteAllLocations(void)
1359 {
1360  /*
1361   * Free the location array, which will free all of the locations...
1362   */
1363
1364   cupsArrayDelete(Locations);
1365   Locations = NULL;
1366 }
1367
1368
1369 /*
1370  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1371  */
1372
1373 cupsd_location_t *                      /* O - Location that matches */
1374 cupsdFindBest(const char   *path,       /* I - Resource path */
1375               http_state_t state)       /* I - HTTP state/request */
1376 {
1377   char                  uri[HTTP_MAX_URI],
1378                                         /* URI in request... */
1379                         *uriptr;        /* Pointer into URI */
1380   cupsd_location_t      *loc,           /* Current location */
1381                         *best;          /* Best match for location so far */
1382   size_t                bestlen;        /* Length of best match */
1383   int                   limit;          /* Limit field */
1384   static const int      limits[] =      /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1385                 {
1386                   CUPSD_AUTH_LIMIT_ALL,
1387                   CUPSD_AUTH_LIMIT_OPTIONS,
1388                   CUPSD_AUTH_LIMIT_GET,
1389                   CUPSD_AUTH_LIMIT_GET,
1390                   CUPSD_AUTH_LIMIT_HEAD,
1391                   CUPSD_AUTH_LIMIT_POST,
1392                   CUPSD_AUTH_LIMIT_POST,
1393                   CUPSD_AUTH_LIMIT_POST,
1394                   CUPSD_AUTH_LIMIT_PUT,
1395                   CUPSD_AUTH_LIMIT_PUT,
1396                   CUPSD_AUTH_LIMIT_DELETE,
1397                   CUPSD_AUTH_LIMIT_TRACE,
1398                   CUPSD_AUTH_LIMIT_ALL,
1399                   CUPSD_AUTH_LIMIT_ALL,
1400                   CUPSD_AUTH_LIMIT_ALL,
1401                   CUPSD_AUTH_LIMIT_ALL
1402                 };
1403
1404
1405  /*
1406   * First copy the connection URI to a local string so we have drop
1407   * any .ppd extension from the pathname in /printers or /classes
1408   * URIs...
1409   */
1410
1411   strlcpy(uri, path, sizeof(uri));
1412
1413   if ((uriptr = strchr(uri, '?')) != NULL)
1414     *uriptr = '\0';             /* Drop trailing query string */
1415
1416   if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1417     *uriptr = '\0';             /* Remove trailing '/' */
1418
1419   if (!strncmp(uri, "/printers/", 10) ||
1420       !strncmp(uri, "/classes/", 9))
1421   {
1422    /*
1423     * Check if the URI has .ppd on the end...
1424     */
1425
1426     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1427
1428     if (!strcmp(uriptr, ".ppd"))
1429       *uriptr = '\0';
1430   }
1431
1432  /*
1433   * Loop through the list of locations to find a match...
1434   */
1435
1436   limit   = limits[state];
1437   best    = NULL;
1438   bestlen = 0;
1439
1440   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri=\"%s\", limit=%x...", uri, limit);
1441
1442
1443   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1444        loc;
1445        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1446   {
1447     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1448
1449     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1450     {
1451      /*
1452       * Use case-insensitive comparison for queue names...
1453       */
1454
1455       if (loc->length > bestlen && loc->location &&
1456           !_cups_strncasecmp(uri, loc->location, loc->length) &&
1457           loc->location[0] == '/' &&
1458           (limit & loc->limit) != 0)
1459       {
1460         best    = loc;
1461         bestlen = loc->length;
1462       }
1463     }
1464     else
1465     {
1466      /*
1467       * Use case-sensitive comparison for other URIs...
1468       */
1469
1470       if (loc->length > bestlen && loc->location &&
1471           !strncmp(uri, loc->location, loc->length) &&
1472           loc->location[0] == '/' &&
1473           (limit & loc->limit) != 0)
1474       {
1475         best    = loc;
1476         bestlen = loc->length;
1477       }
1478     }
1479   }
1480
1481  /*
1482   * Return the match, if any...
1483   */
1484
1485   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best=%s", best ? best->location : "NONE");
1486
1487   return (best);
1488 }
1489
1490
1491 /*
1492  * 'cupsdFindLocation()' - Find the named location.
1493  */
1494
1495 cupsd_location_t *                      /* O - Location that matches */
1496 cupsdFindLocation(const char *location) /* I - Connection */
1497 {
1498   cupsd_location_t      key;            /* Search key */
1499
1500
1501   key.location = (char *)location;
1502
1503   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1504 }
1505
1506
1507 /*
1508  * 'cupsdFreeLocation()' - Free all memory used by a location.
1509  */
1510
1511 void
1512 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1513 {
1514   cupsArrayDelete(loc->names);
1515   cupsArrayDelete(loc->allow);
1516   cupsArrayDelete(loc->deny);
1517
1518   _cupsStrFree(loc->location);
1519   free(loc);
1520 }
1521
1522
1523 /*
1524  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1525  */
1526
1527 http_status_t                           /* O - HTTP_OK if authorized or error code */
1528 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1529                   const char     *owner)/* I - Owner of object */
1530 {
1531   int                   i,              /* Looping vars */
1532                         auth,           /* Authorization status */
1533                         type;           /* Type of authentication */
1534   http_addr_t           *hostaddr = httpGetAddress(con->http);
1535                                         /* Client address */
1536   const char            *hostname = httpGetHostname(con->http, NULL, 0);
1537                                         /* Client hostname */
1538   unsigned              address[4];     /* Authorization address */
1539   cupsd_location_t      *best;          /* Best match for location so far */
1540   size_t                hostlen;        /* Length of hostname */
1541   char                  *name,          /* Current username */
1542                         username[256],  /* Username to authorize */
1543                         ownername[256], /* Owner name to authorize */
1544                         *ptr;           /* Pointer into username */
1545   struct passwd         *pw;            /* User password data */
1546   static const char * const levels[] =  /* Auth levels */
1547                 {
1548                   "ANON",
1549                   "USER",
1550                   "GROUP"
1551                 };
1552   static const char * const types[] =   /* Auth types */
1553                 {
1554                   "None",
1555                   "Basic",
1556                   "Negotiate"
1557                 };
1558
1559
1560   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location ? con->best->location : "(null)" : "");
1561   if (owner)
1562     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: owner=\"%s\"", owner);
1563
1564  /*
1565   * If there is no "best" authentication rule for this request, then
1566   * access is allowed from the local system and denied from other
1567   * addresses...
1568   */
1569
1570   if (!con->best)
1571   {
1572     if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1573         !strcmp(hostname, ServerName) ||
1574         cupsArrayFind(ServerAlias, (void *)hostname))
1575       return (HTTP_OK);
1576     else
1577       return (HTTP_FORBIDDEN);
1578   }
1579
1580   best = con->best;
1581
1582   if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1583     type = cupsdDefaultAuthType();
1584
1585   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels[best->level], types[type], best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1586
1587   if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1588     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)", best->op, ippOpString(best->op));
1589
1590  /*
1591   * Check host/ip-based accesses...
1592   */
1593
1594 #ifdef AF_INET6
1595   if (httpAddrFamily(hostaddr) == AF_INET6)
1596   {
1597    /*
1598     * Copy IPv6 address...
1599     */
1600
1601     address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1602     address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1603     address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1604     address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1605   }
1606   else
1607 #endif /* AF_INET6 */
1608   if (con->http->hostaddr->addr.sa_family == AF_INET)
1609   {
1610    /*
1611     * Copy IPv4 address...
1612     */
1613
1614     address[0] = 0;
1615     address[1] = 0;
1616     address[2] = 0;
1617     address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1618   }
1619   else
1620     memset(address, 0, sizeof(address));
1621
1622   hostlen = strlen(hostname);
1623
1624   auth = cupsdCheckAccess(address, hostname, hostlen, best)
1625              ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1626
1627   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth ? "DENY" : "ALLOW");
1628
1629   if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1630     return (HTTP_FORBIDDEN);
1631
1632 #ifdef HAVE_SSL
1633  /*
1634   * See if encryption is required...
1635   */
1636
1637   if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1638       _cups_strcasecmp(hostname, "localhost") &&
1639       !httpAddrLocalhost(hostaddr) &&
1640       best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1641       !(type == CUPSD_AUTH_NEGOTIATE ||
1642         (type == CUPSD_AUTH_NONE &&
1643          cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1644   {
1645     cupsdLogMessage(CUPSD_LOG_DEBUG,
1646                     "cupsdIsAuthorized: Need upgrade to TLS...");
1647     return (HTTP_UPGRADE_REQUIRED);
1648   }
1649 #endif /* HAVE_SSL */
1650
1651  /*
1652   * Now see what access level is required...
1653   */
1654
1655   if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1656       (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1657     return (HTTP_OK);
1658
1659   if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1660       best->limit == CUPSD_AUTH_LIMIT_IPP)
1661   {
1662    /*
1663     * Check for unauthenticated username...
1664     */
1665
1666     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1667
1668
1669     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1670     if (attr)
1671     {
1672       cupsdLogMessage(CUPSD_LOG_DEBUG,
1673                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1674                       attr->values[0].string.text);
1675       strlcpy(username, attr->values[0].string.text, sizeof(username));
1676     }
1677     else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1678       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1679     else
1680       return (HTTP_OK);                 /* unless overridden with Satisfy */
1681   }
1682   else
1683   {
1684     cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1685                     con->username);
1686
1687 #ifdef HAVE_AUTHORIZATION_H
1688     if (!con->username[0] && !con->authref)
1689 #else
1690     if (!con->username[0])
1691 #endif /* HAVE_AUTHORIZATION_H */
1692     {
1693       if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1694         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1695       else
1696         return (HTTP_OK);               /* unless overridden with Satisfy */
1697     }
1698
1699
1700     if (con->type != type && type != CUPSD_AUTH_NONE &&
1701 #ifdef HAVE_GSSAPI
1702         (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1703 #endif /* HAVE_GSSAPI */
1704         con->type != CUPSD_AUTH_BASIC)
1705     {
1706       cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1707                       types[con->type], types[type]);
1708
1709       return (HTTP_UNAUTHORIZED);
1710     }
1711
1712     strlcpy(username, con->username, sizeof(username));
1713   }
1714
1715  /*
1716   * OK, got a username.  See if we need normal user access, or group
1717   * access... (root always matches)
1718   */
1719
1720   if (!strcmp(username, "root"))
1721     return (HTTP_OK);
1722
1723  /*
1724   * Strip any @domain or @KDC from the username and owner...
1725   */
1726
1727   if ((ptr = strchr(username, '@')) != NULL)
1728     *ptr = '\0';
1729
1730   if (owner)
1731   {
1732     strlcpy(ownername, owner, sizeof(ownername));
1733
1734     if ((ptr = strchr(ownername, '@')) != NULL)
1735       *ptr = '\0';
1736   }
1737   else
1738     ownername[0] = '\0';
1739
1740  /*
1741   * Get the user info...
1742   */
1743
1744   if (username[0])
1745   {
1746     pw = getpwnam(username);
1747     endpwent();
1748   }
1749   else
1750     pw = NULL;
1751
1752   if (best->level == CUPSD_AUTH_USER)
1753   {
1754    /*
1755     * If there are no names associated with this location, then
1756     * any valid user is OK...
1757     */
1758
1759     if (cupsArrayCount(best->names) == 0)
1760       return (HTTP_OK);
1761
1762    /*
1763     * Otherwise check the user list and return OK if this user is
1764     * allowed...
1765     */
1766
1767     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking user membership...");
1768
1769 #ifdef HAVE_AUTHORIZATION_H
1770    /*
1771     * If an authorization reference was supplied it must match a right name...
1772     */
1773
1774     if (con->authref)
1775     {
1776       for (name = (char *)cupsArrayFirst(best->names);
1777            name;
1778            name = (char *)cupsArrayNext(best->names))
1779       {
1780         if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1781           return (HTTP_OK);
1782         else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1783                  check_authref(con, SystemGroupAuthKey))
1784           return (HTTP_OK);
1785       }
1786
1787       return (HTTP_FORBIDDEN);
1788     }
1789 #endif /* HAVE_AUTHORIZATION_H */
1790
1791     for (name = (char *)cupsArrayFirst(best->names);
1792          name;
1793          name = (char *)cupsArrayNext(best->names))
1794     {
1795       if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1796           !_cups_strcasecmp(username, ownername))
1797         return (HTTP_OK);
1798       else if (!_cups_strcasecmp(name, "@SYSTEM"))
1799       {
1800         for (i = 0; i < NumSystemGroups; i ++)
1801           if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1802             return (HTTP_OK);
1803       }
1804       else if (name[0] == '@')
1805       {
1806         if (cupsdCheckGroup(username, pw, name + 1))
1807           return (HTTP_OK);
1808       }
1809       else if (!_cups_strcasecmp(username, name))
1810         return (HTTP_OK);
1811     }
1812
1813     return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1814   }
1815
1816  /*
1817   * Check to see if this user is in any of the named groups...
1818   */
1819
1820   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group membership...");
1821
1822  /*
1823   * Check to see if this user is in any of the named groups...
1824   */
1825
1826   for (name = (char *)cupsArrayFirst(best->names);
1827        name;
1828        name = (char *)cupsArrayNext(best->names))
1829   {
1830     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1831
1832     if (!_cups_strcasecmp(name, "@SYSTEM"))
1833     {
1834       for (i = 0; i < NumSystemGroups; i ++)
1835         if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1836           return (HTTP_OK);
1837     }
1838     else if (cupsdCheckGroup(username, pw, name))
1839       return (HTTP_OK);
1840   }
1841
1842  /*
1843   * The user isn't part of the specified group, so deny access...
1844   */
1845
1846   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: User not in group(s).");
1847
1848   return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1849 }
1850
1851
1852 /*
1853  * 'cupsdNewLocation()' - Create a new location for authorization.
1854  *
1855  * Note: Still need to call cupsdAddLocation() to add it to the list of global
1856  * locations.
1857  */
1858
1859 cupsd_location_t *                      /* O - Pointer to new location record */
1860 cupsdNewLocation(const char *location)  /* I - Location path */
1861 {
1862   cupsd_location_t      *temp;          /* New location */
1863
1864
1865  /*
1866   * Try to allocate memory for the new location.
1867   */
1868
1869   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1870     return (NULL);
1871
1872  /*
1873   * Initialize the record and copy the name over...
1874   */
1875
1876   if ((temp->location = _cupsStrAlloc(location)) == NULL)
1877   {
1878     free(temp);
1879     return (NULL);
1880   }
1881
1882   temp->length = strlen(temp->location);
1883
1884  /*
1885   * Return the new record...
1886   */
1887
1888   return (temp);
1889 }
1890
1891
1892 #ifdef HAVE_AUTHORIZATION_H
1893 /*
1894  * 'check_authref()' - Check if an authorization services reference has the
1895  *                     supplied right.
1896  */
1897
1898 static int                              /* O - 1 if right is valid, 0 otherwise */
1899 check_authref(cupsd_client_t *con,      /* I - Connection */
1900               const char     *right)    /* I - Right name */
1901 {
1902   OSStatus              status;         /* OS Status */
1903   AuthorizationItem     authright;      /* Authorization right */
1904   AuthorizationRights   authrights;     /* Authorization rights */
1905   AuthorizationFlags    authflags;      /* Authorization flags */
1906
1907
1908  /*
1909   * Check to see if the user is allowed to perform the task...
1910   */
1911
1912   if (!con->authref)
1913     return (0);
1914
1915   authright.name        = right;
1916   authright.valueLength = 0;
1917   authright.value       = NULL;
1918   authright.flags       = 0;
1919
1920   authrights.count = 1;
1921   authrights.items = &authright;
1922
1923   authflags = kAuthorizationFlagDefaults |
1924               kAuthorizationFlagExtendRights;
1925
1926   if ((status = AuthorizationCopyRights(con->authref, &authrights,
1927                                         kAuthorizationEmptyEnvironment,
1928                                         authflags, NULL)) != 0)
1929   {
1930     cupsdLogMessage(CUPSD_LOG_ERROR, "AuthorizationCopyRights(\"%s\") returned %d", authright.name, (int)status);
1931     return (0);
1932   }
1933
1934   cupsdLogMessage(CUPSD_LOG_DEBUG2, "AuthorizationCopyRights(\"%s\") succeeded.", authright.name);
1935
1936   return (1);
1937 }
1938 #endif /* HAVE_AUTHORIZATION_H */
1939
1940
1941 /*
1942  * 'compare_locations()' - Compare two locations.
1943  */
1944
1945 static int                              /* O - Result of comparison */
1946 compare_locations(cupsd_location_t *a,  /* I - First location */
1947                   cupsd_location_t *b)  /* I - Second location */
1948 {
1949   return (strcmp(b->location, a->location));
1950 }
1951
1952
1953 /*
1954  * 'copy_authmask()' - Copy function for auth masks.
1955  */
1956
1957 static cupsd_authmask_t *               /* O - New auth mask */
1958 copy_authmask(cupsd_authmask_t *mask,   /* I - Existing auth mask */
1959               void             *data)   /* I - User data (unused) */
1960 {
1961   cupsd_authmask_t      *temp;          /* New auth mask */
1962
1963
1964   (void)data;
1965
1966   if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
1967   {
1968     memcpy(temp, mask, sizeof(cupsd_authmask_t));
1969
1970     if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
1971     {
1972      /*
1973       * Make a copy of the name...
1974       */
1975
1976       if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
1977       {
1978        /*
1979         * Failed to make copy...
1980         */
1981
1982         free(temp);
1983         temp = NULL;
1984       }
1985     }
1986   }
1987
1988   return (temp);
1989 }
1990
1991
1992 /*
1993  * 'free_authmask()' - Free function for auth masks.
1994  */
1995
1996 static void
1997 free_authmask(cupsd_authmask_t *mask,   /* I - Auth mask to free */
1998               void             *data)   /* I - User data (unused) */
1999 {
2000   (void)data;
2001
2002   if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2003     _cupsStrFree(mask->mask.name.name);
2004
2005   free(mask);
2006 }
2007
2008
2009 #if HAVE_LIBPAM
2010 /*
2011  * 'pam_func()' - PAM conversation function.
2012  */
2013
2014 static int                              /* O - Success or failure */
2015 pam_func(
2016     int                      num_msg,   /* I - Number of messages */
2017     const struct pam_message **msg,     /* I - Messages */
2018     struct pam_response      **resp,    /* O - Responses */
2019     void                     *appdata_ptr)
2020                                         /* I - Pointer to connection */
2021 {
2022   int                   i;              /* Looping var */
2023   struct pam_response   *replies;       /* Replies */
2024   cupsd_authdata_t      *data;          /* Pointer to auth data */
2025
2026
2027  /*
2028   * Allocate memory for the responses...
2029   */
2030
2031   if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2032     return (PAM_CONV_ERR);
2033
2034  /*
2035   * Answer all of the messages...
2036   */
2037
2038   data = (cupsd_authdata_t *)appdata_ptr;
2039
2040   for (i = 0; i < num_msg; i ++)
2041   {
2042     switch (msg[i]->msg_style)
2043     {
2044       case PAM_PROMPT_ECHO_ON:
2045           replies[i].resp_retcode = PAM_SUCCESS;
2046           replies[i].resp         = strdup(data->username);
2047           break;
2048
2049       case PAM_PROMPT_ECHO_OFF:
2050           replies[i].resp_retcode = PAM_SUCCESS;
2051           replies[i].resp         = strdup(data->password);
2052           break;
2053
2054       case PAM_TEXT_INFO:
2055           replies[i].resp_retcode = PAM_SUCCESS;
2056           replies[i].resp         = NULL;
2057           break;
2058
2059       case PAM_ERROR_MSG:
2060           replies[i].resp_retcode = PAM_SUCCESS;
2061           replies[i].resp         = NULL;
2062           break;
2063
2064       default:
2065           free(replies);
2066           return (PAM_CONV_ERR);
2067     }
2068   }
2069
2070  /*
2071   * Return the responses back to PAM...
2072   */
2073
2074   *resp = replies;
2075
2076   return (PAM_SUCCESS);
2077 }
2078 #endif /* HAVE_LIBPAM */