]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Update svn:keyword properties.
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id$"
3 *
4 * Authorization routines for the CUPS scheduler.
5 *
6 * Copyright 2007-2012 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddIPMask() - Add an IP address authorization mask.
21 * cupsdAddLocation() - Add a location for authorization.
22 * cupsdAddName() - Add a name to a location...
23 * cupsdAddNameMask() - Add a host or interface name authorization
24 * mask.
25 * cupsdAuthorize() - Validate any authorization credentials.
26 * cupsdCheckAccess() - Check whether the given address is allowed to
27 * access a location.
28 * cupsdCheckAuth() - Check authorization masks.
29 * cupsdCheckGroup() - Check for a user's group membership.
30 * cupsdCopyLocation() - Make a copy of a location...
31 * cupsdDeleteAllLocations() - Free all memory used for location
32 * authorization.
33 * cupsdFindBest() - Find the location entry that best matches the
34 * resource.
35 * cupsdFindLocation() - Find the named location.
36 * cupsdFreeLocation() - Free all memory used by a location.
37 * cupsdIsAuthorized() - Check to see if the user is authorized...
38 * cupsdNewLocation() - Create a new location for authorization.
39 * check_authref() - Check if an authorization services reference
40 * has the supplied right.
41 * compare_locations() - Compare two locations.
42 * copy_authmask() - Copy function for auth masks.
43 * cups_crypt() - Encrypt the password using the DES or MD5
44 * algorithms, as needed.
45 * free_authmask() - Free function for auth masks.
46 * get_md5_password() - Get an MD5 password.
47 * pam_func() - PAM conversation function.
48 * to64() - Base64-encode an integer value...
49 */
50
51 /*
52 * Include necessary headers...
53 */
54
55 #include "cupsd.h"
56 #include <grp.h>
57 #ifdef HAVE_SHADOW_H
58 # include <shadow.h>
59 #endif /* HAVE_SHADOW_H */
60 #ifdef HAVE_CRYPT_H
61 # include <crypt.h>
62 #endif /* HAVE_CRYPT_H */
63 #if HAVE_LIBPAM
64 # ifdef HAVE_PAM_PAM_APPL_H
65 # include <pam/pam_appl.h>
66 # else
67 # include <security/pam_appl.h>
68 # endif /* HAVE_PAM_PAM_APPL_H */
69 #endif /* HAVE_LIBPAM */
70 #ifdef HAVE_USERSEC_H
71 # include <usersec.h>
72 #endif /* HAVE_USERSEC_H */
73 #ifdef HAVE_MEMBERSHIP_H
74 # include <membership.h>
75 #endif /* HAVE_MEMBERSHIP_H */
76 #ifdef HAVE_AUTHORIZATION_H
77 # include <Security/AuthorizationTags.h>
78 # ifdef HAVE_SECBASEPRIV_H
79 # include <Security/SecBasePriv.h>
80 # else
81 extern const char *cssmErrorString(int error);
82 # endif /* HAVE_SECBASEPRIV_H */
83 #endif /* HAVE_AUTHORIZATION_H */
84 #ifdef HAVE_SYS_PARAM_H
85 # include <sys/param.h>
86 #endif /* HAVE_SYS_PARAM_H */
87 #ifdef HAVE_SYS_UCRED_H
88 # include <sys/ucred.h>
89 typedef struct xucred cupsd_ucred_t;
90 # define CUPSD_UCRED_UID(c) (c).cr_uid
91 #else
92 # ifndef __OpenBSD__
93 typedef struct ucred cupsd_ucred_t;
94 # else
95 typedef struct sockpeercred cupsd_ucred_t;
96 # endif
97 # define CUPSD_UCRED_UID(c) (c).uid
98 #endif /* HAVE_SYS_UCRED_H */
99
100
101 /*
102 * Local functions...
103 */
104
105 #ifdef HAVE_AUTHORIZATION_H
106 static int check_authref(cupsd_client_t *con, const char *right);
107 #endif /* HAVE_AUTHORIZATION_H */
108 static int compare_locations(cupsd_location_t *a,
109 cupsd_location_t *b);
110 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
111 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
112 static char *cups_crypt(const char *pw, const char *salt);
113 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
114 static void free_authmask(cupsd_authmask_t *am, void *data);
115 static char *get_md5_password(const char *username,
116 const char *group, char passwd[33]);
117 #if HAVE_LIBPAM
118 static int pam_func(int, const struct pam_message **,
119 struct pam_response **, void *);
120 #elif !defined(HAVE_USERSEC_H)
121 static void to64(char *s, unsigned long v, int n);
122 #endif /* HAVE_LIBPAM */
123
124
125 /*
126 * Local structures...
127 */
128
129 #if HAVE_LIBPAM
130 typedef struct cupsd_authdata_s /**** Authentication data ****/
131 {
132 char username[HTTP_MAX_VALUE], /* Username string */
133 password[HTTP_MAX_VALUE]; /* Password string */
134 } cupsd_authdata_t;
135 #endif /* HAVE_LIBPAM */
136
137
138 /*
139 * Local globals...
140 */
141
142 #if defined(__hpux) && HAVE_LIBPAM
143 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
144 #endif /* __hpux && HAVE_LIBPAM */
145
146
147 /*
148 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
149 */
150
151 int /* O - 1 on success, 0 on failure */
152 cupsdAddIPMask(
153 cups_array_t **masks, /* IO - Masks array (created as needed) */
154 const unsigned address[4], /* I - IP address */
155 const unsigned netmask[4]) /* I - IP netmask */
156 {
157 cupsd_authmask_t temp; /* New host/domain mask */
158
159
160 cupsdLogMessage(CUPSD_LOG_DEBUG2,
161 "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, "
162 "netmask=%x:%x:%x:%x)",
163 masks, *masks,
164 address[0], address[1], address[2], address[3],
165 netmask[0], netmask[1], netmask[2], netmask[3]);
166
167 temp.type = CUPSD_AUTH_IP;
168 memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
169 memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
170
171 /*
172 * Create the masks array as needed and add...
173 */
174
175 if (!*masks)
176 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
177 (cups_acopy_func_t)copy_authmask,
178 (cups_afree_func_t)free_authmask);
179
180 return (cupsArrayAdd(*masks, &temp));
181 }
182
183
184 /*
185 * 'cupsdAddLocation()' - Add a location for authorization.
186 */
187
188 void
189 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
190 {
191 /*
192 * Make sure the locations array is created...
193 */
194
195 if (!Locations)
196 Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
197 (cups_ahash_func_t)NULL, 0,
198 (cups_acopy_func_t)NULL,
199 (cups_afree_func_t)cupsdFreeLocation);
200
201 if (Locations)
202 {
203 cupsArrayAdd(Locations, loc);
204
205 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"",
206 loc->location ? loc->location : "(null)");
207 }
208 }
209
210
211 /*
212 * 'cupsdAddName()' - Add a name to a location...
213 */
214
215 void
216 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
217 char *name) /* I - Name to add */
218 {
219 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
220 loc, name);
221
222 if (!loc->names)
223 loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
224 (cups_acopy_func_t)_cupsStrAlloc,
225 (cups_afree_func_t)_cupsStrFree);
226
227 if (!cupsArrayAdd(loc->names, name))
228 {
229 cupsdLogMessage(CUPSD_LOG_ERROR,
230 "Unable to duplicate name for location %s: %s",
231 loc->location ? loc->location : "nil", strerror(errno));
232 return;
233 }
234 }
235
236
237 /*
238 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
239 */
240
241 int /* O - 1 on success, 0 on failure */
242 cupsdAddNameMask(cups_array_t **masks, /* IO - Masks array (created as needed) */
243 char *name) /* I - Host or interface name */
244 {
245 cupsd_authmask_t temp; /* New host/domain mask */
246 char ifname[32], /* Interface name */
247 *ifptr; /* Pointer to end of name */
248
249
250 cupsdLogMessage(CUPSD_LOG_DEBUG2,
251 "cupsdAddNameMask(masks=%p(%p), name=\"%s\")",
252 masks, *masks, name);
253
254 if (!_cups_strcasecmp(name, "@LOCAL"))
255 {
256 /*
257 * Deny *interface*...
258 */
259
260 temp.type = CUPSD_AUTH_INTERFACE;
261 temp.mask.name.name = (char *)"*";
262 }
263 else if (!_cups_strncasecmp(name, "@IF(", 4))
264 {
265 /*
266 * Deny *interface*...
267 */
268
269 strlcpy(ifname, name + 4, sizeof(ifname));
270
271 ifptr = ifname + strlen(ifname) - 1;
272
273 if (ifptr >= ifname && *ifptr == ')')
274 {
275 ifptr --;
276 *ifptr = '\0';
277 }
278
279 temp.type = CUPSD_AUTH_INTERFACE;
280 temp.mask.name.name = ifname;
281 }
282 else
283 {
284 /*
285 * Deny name...
286 */
287
288 if (*name == '*')
289 name ++;
290
291 temp.type = CUPSD_AUTH_NAME;
292 temp.mask.name.name = (char *)name;
293 }
294
295 /*
296 * Set the name length...
297 */
298
299 temp.mask.name.length = strlen(temp.mask.name.name);
300
301 /*
302 * Create the masks array as needed and add...
303 */
304
305 if (!*masks)
306 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
307 (cups_acopy_func_t)copy_authmask,
308 (cups_afree_func_t)free_authmask);
309
310 return (cupsArrayAdd(*masks, &temp));
311 }
312
313
314 /*
315 * 'cupsdAuthorize()' - Validate any authorization credentials.
316 */
317
318 void
319 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
320 {
321 int type; /* Authentication type */
322 const char *authorization; /* Pointer into Authorization string */
323 char *ptr, /* Pointer into string */
324 username[HTTP_MAX_VALUE],
325 /* Username string */
326 password[HTTP_MAX_VALUE];
327 /* Password string */
328 cupsd_cert_t *localuser; /* Certificate username */
329 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
330 md5[33], /* MD5 password */
331 basicmd5[33]; /* MD5 of Basic password */
332 static const char * const states[] = /* HTTP client states... */
333 {
334 "WAITING",
335 "OPTIONS",
336 "GET",
337 "GET",
338 "HEAD",
339 "POST",
340 "POST",
341 "POST",
342 "PUT",
343 "PUT",
344 "DELETE",
345 "TRACE",
346 "CLOSE",
347 "STATUS"
348 };
349
350
351 /*
352 * Locate the best matching location so we know what kind of
353 * authentication to expect...
354 */
355
356 con->best = cupsdFindBest(con->uri, con->http.state);
357 con->type = CUPSD_AUTH_NONE;
358
359 cupsdLogMessage(CUPSD_LOG_DEBUG2,
360 "[Client %d] con->uri=\"%s\", con->best=%p(%s)",
361 con->http.fd, con->uri, con->best,
362 con->best ? con->best->location : "");
363
364 if (con->best && con->best->type != CUPSD_AUTH_NONE)
365 {
366 if (con->best->type == CUPSD_AUTH_DEFAULT)
367 type = cupsdDefaultAuthType();
368 else
369 type = con->best->type;
370 }
371 else
372 type = cupsdDefaultAuthType();
373
374 /*
375 * Decode the Authorization string...
376 */
377
378 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
379
380 cupsdLogMessage(CUPSD_LOG_DEBUG2, "[Client %d] Authorization=\"%s\"",
381 con->http.fd, authorization);
382
383 username[0] = '\0';
384 password[0] = '\0';
385
386 #ifdef HAVE_GSSAPI
387 con->gss_uid = 0;
388 #endif /* HAVE_GSSAPI */
389
390 #ifdef HAVE_AUTHORIZATION_H
391 if (con->authref)
392 {
393 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
394 con->authref = NULL;
395 }
396 #endif /* HAVE_AUTHORIZATION_H */
397
398 if (!*authorization)
399 {
400 /*
401 * No authorization data provided, return early...
402 */
403
404 cupsdLogMessage(CUPSD_LOG_DEBUG,
405 "[Client %d] No authentication data provided.",
406 con->http.fd);
407 return;
408 }
409 #ifdef HAVE_AUTHORIZATION_H
410 else if (!strncmp(authorization, "AuthRef ", 8) &&
411 !_cups_strcasecmp(con->http.hostname, "localhost"))
412 {
413 OSStatus status; /* Status */
414 int authlen; /* Auth string length */
415 AuthorizationItemSet *authinfo; /* Authorization item set */
416
417 /*
418 * Get the Authorization Services data...
419 */
420
421 authorization += 8;
422 while (isspace(*authorization & 255))
423 authorization ++;
424
425 authlen = sizeof(nonce);
426 httpDecode64_2(nonce, &authlen, authorization);
427
428 if (authlen != kAuthorizationExternalFormLength)
429 {
430 cupsdLogMessage(CUPSD_LOG_ERROR,
431 "[Client %d] External Authorization reference size is "
432 "incorrect.", con->http.fd);
433 return;
434 }
435
436 if ((status = AuthorizationCreateFromExternalForm(
437 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
438 {
439 cupsdLogMessage(CUPSD_LOG_ERROR,
440 "[Client %d] AuthorizationCreateFromExternalForm "
441 "returned %d (%s)", con->http.fd, (int)status,
442 cssmErrorString(status));
443 return;
444 }
445
446 username[0] = '\0';
447
448 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
449 &authinfo))
450 {
451 if (authinfo->count == 1 && authinfo->items[0].value &&
452 authinfo->items[0].valueLength >= 2)
453 {
454 strlcpy(username, authinfo->items[0].value, sizeof(username));
455
456 cupsdLogMessage(CUPSD_LOG_DEBUG,
457 "[Client %d] Authorized as \"%s\" using AuthRef",
458 con->http.fd, username);
459 }
460
461 AuthorizationFreeItemSet(authinfo);
462 }
463
464 if (!username[0])
465 {
466 /*
467 * No username in AuthRef, grab username using peer credentials...
468 */
469
470 struct passwd *pwd; /* Password entry for this user */
471 cupsd_ucred_t peercred; /* Peer credentials */
472 socklen_t peersize; /* Size of peer credentials */
473
474 peersize = sizeof(peercred);
475
476 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
477 {
478 cupsdLogMessage(CUPSD_LOG_ERROR,
479 "[Client %d] Unable to get peer credentials - %s",
480 con->http.fd, strerror(errno));
481 return;
482 }
483
484 if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
485 {
486 cupsdLogMessage(CUPSD_LOG_ERROR,
487 "[Client %d] Unable to find UID %d for peer "
488 "credentials.", con->http.fd,
489 (int)CUPSD_UCRED_UID(peercred));
490 return;
491 }
492
493 strlcpy(username, pwd->pw_name, sizeof(username));
494
495 cupsdLogMessage(CUPSD_LOG_DEBUG,
496 "[Client %d] Authorized as \"%s\" using "
497 "AuthRef + PeerCred", con->http.fd, username);
498 }
499
500 con->type = CUPSD_AUTH_BASIC;
501 }
502 #endif /* HAVE_AUTHORIZATION_H */
503 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
504 else if (!strncmp(authorization, "PeerCred ", 9) &&
505 con->http.hostaddr->addr.sa_family == AF_LOCAL)
506 {
507 /*
508 * Use peer credentials from domain socket connection...
509 */
510
511 struct passwd *pwd; /* Password entry for this user */
512 cupsd_ucred_t peercred; /* Peer credentials */
513 socklen_t peersize; /* Size of peer credentials */
514 #ifdef HAVE_AUTHORIZATION_H
515 const char *name; /* Authorizing name */
516 int no_peer = 0; /* Don't allow peer credentials? */
517
518 /*
519 * See if we should allow peer credentials...
520 */
521
522 for (name = (char *)cupsArrayFirst(con->best->names);
523 name;
524 name = (char *)cupsArrayNext(con->best->names))
525 {
526 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
527 !_cups_strcasecmp(name, "@SYSTEM"))
528 {
529 /* Normally don't want peer credentials if we need an auth key... */
530 no_peer = 1;
531 }
532 else if (!_cups_strcasecmp(name, "@OWNER"))
533 {
534 /* but if @OWNER is present then we allow it... */
535 no_peer = 0;
536 break;
537 }
538 }
539
540 if (no_peer)
541 {
542 cupsdLogMessage(CUPSD_LOG_ERROR,
543 "[Client %d] PeerCred authentication not allowed for "
544 "resource per AUTHKEY policy.", con->http.fd);
545 return;
546 }
547 #endif /* HAVE_AUTHORIZATION_H */
548
549 if ((pwd = getpwnam(authorization + 9)) == NULL)
550 {
551 cupsdLogMessage(CUPSD_LOG_ERROR,
552 "[Client %d] User \"%s\" does not exist.", con->http.fd,
553 authorization + 9);
554 return;
555 }
556
557 peersize = sizeof(peercred);
558
559 # ifdef __APPLE__
560 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
561 # else
562 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
563 # endif /* __APPLE__ */
564 {
565 cupsdLogMessage(CUPSD_LOG_ERROR,
566 "[Client %d] Unable to get peer credentials - %s",
567 con->http.fd, strerror(errno));
568 return;
569 }
570
571 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
572 {
573 cupsdLogMessage(CUPSD_LOG_ERROR,
574 "[Client %d] Invalid peer credentials for \"%s\" - got "
575 "%d, expected %d!", con->http.fd, authorization + 9,
576 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
577 # ifdef HAVE_SYS_UCRED_H
578 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_version=%d",
579 con->http.fd, peercred.cr_version);
580 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_uid=%d",
581 con->http.fd, peercred.cr_uid);
582 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_ngroups=%d",
583 con->http.fd, peercred.cr_ngroups);
584 cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] cr_groups[0]=%d",
585 con->http.fd, peercred.cr_groups[0]);
586 # endif /* HAVE_SYS_UCRED_H */
587 return;
588 }
589
590 strlcpy(username, authorization + 9, sizeof(username));
591
592 # ifdef HAVE_GSSAPI
593 con->gss_uid = CUPSD_UCRED_UID(peercred);
594 # endif /* HAVE_GSSAPI */
595
596 cupsdLogMessage(CUPSD_LOG_DEBUG,
597 "[Client %d] Authorized as %s using PeerCred", con->http.fd,
598 username);
599
600 con->type = CUPSD_AUTH_BASIC;
601 }
602 #endif /* SO_PEERCRED && AF_LOCAL */
603 else if (!strncmp(authorization, "Local", 5) &&
604 !_cups_strcasecmp(con->http.hostname, "localhost"))
605 {
606 /*
607 * Get Local certificate authentication data...
608 */
609
610 authorization += 5;
611 while (isspace(*authorization & 255))
612 authorization ++;
613
614 if ((localuser = cupsdFindCert(authorization)) == NULL)
615 {
616 cupsdLogMessage(CUPSD_LOG_ERROR,
617 "[Client %d] Local authentication certificate not found.",
618 con->http.fd);
619 return;
620 }
621
622 strlcpy(username, localuser->username, sizeof(username));
623 con->type = localuser->type;
624
625 cupsdLogMessage(CUPSD_LOG_DEBUG,
626 "[Client %d] Authorized as %s using Local", con->http.fd,
627 username);
628 }
629 else if (!strncmp(authorization, "Basic", 5))
630 {
631 /*
632 * Get the Basic authentication data...
633 */
634
635 int userlen; /* Username:password length */
636
637
638 authorization += 5;
639 while (isspace(*authorization & 255))
640 authorization ++;
641
642 userlen = sizeof(username);
643 httpDecode64_2(username, &userlen, authorization);
644
645 /*
646 * Pull the username and password out...
647 */
648
649 if ((ptr = strchr(username, ':')) == NULL)
650 {
651 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Missing Basic password.",
652 con->http.fd);
653 return;
654 }
655
656 *ptr++ = '\0';
657
658 if (!username[0])
659 {
660 /*
661 * Username must not be empty...
662 */
663
664 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Empty Basic username.",
665 con->http.fd);
666 return;
667 }
668
669 if (!*ptr)
670 {
671 /*
672 * Password must not be empty...
673 */
674
675 cupsdLogMessage(CUPSD_LOG_ERROR, "[Client %d] Empty Basic password.",
676 con->http.fd);
677 return;
678 }
679
680 strlcpy(password, ptr, sizeof(password));
681
682 /*
683 * Validate the username and password...
684 */
685
686 switch (type)
687 {
688 default :
689 case CUPSD_AUTH_BASIC :
690 {
691 #if HAVE_LIBPAM
692 /*
693 * Only use PAM to do authentication. This supports MD5
694 * passwords, among other things...
695 */
696
697 pam_handle_t *pamh; /* PAM authentication handle */
698 int pamerr; /* PAM error code */
699 struct pam_conv pamdata;/* PAM conversation data */
700 cupsd_authdata_t data; /* Authentication data */
701
702
703 strlcpy(data.username, username, sizeof(data.username));
704 strlcpy(data.password, password, sizeof(data.password));
705
706 # if defined(__sun) || defined(__hpux)
707 pamdata.conv = (int (*)(int, struct pam_message **,
708 struct pam_response **,
709 void *))pam_func;
710 # else
711 pamdata.conv = pam_func;
712 # endif /* __sun || __hpux */
713 pamdata.appdata_ptr = &data;
714
715 # ifdef __hpux
716 /*
717 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
718 * more info...
719 */
720
721 auth_data = &data;
722 # endif /* __hpux */
723
724 pamerr = pam_start("cups", username, &pamdata, &pamh);
725 if (pamerr != PAM_SUCCESS)
726 {
727 cupsdLogMessage(CUPSD_LOG_ERROR,
728 "[Client %d] pam_start() returned %d (%s)",
729 con->http.fd, pamerr, pam_strerror(pamh, pamerr));
730 return;
731 }
732
733 # ifdef HAVE_PAM_SET_ITEM
734 # ifdef PAM_RHOST
735 pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
736 if (pamerr != PAM_SUCCESS)
737 cupsdLogMessage(CUPSD_LOG_WARN,
738 "[Client %d] pam_set_item(PAM_RHOST) "
739 "returned %d (%s)", con->http.fd, pamerr,
740 pam_strerror(pamh, pamerr));
741 # endif /* PAM_RHOST */
742
743 # ifdef PAM_TTY
744 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
745 if (pamerr != PAM_SUCCESS)
746 cupsdLogMessage(CUPSD_LOG_WARN,
747 "[Client %d] pam_set_item(PAM_TTY) "
748 "returned %d (%s)!", con->http.fd, pamerr,
749 pam_strerror(pamh, pamerr));
750 # endif /* PAM_TTY */
751 # endif /* HAVE_PAM_SET_ITEM */
752
753 pamerr = pam_authenticate(pamh, PAM_SILENT);
754 if (pamerr != PAM_SUCCESS)
755 {
756 cupsdLogMessage(CUPSD_LOG_ERROR,
757 "[Client %d] pam_authenticate() returned %d (%s)",
758 con->http.fd, pamerr, pam_strerror(pamh, pamerr));
759 pam_end(pamh, 0);
760 return;
761 }
762
763 # ifdef HAVE_PAM_SETCRED
764 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
765 if (pamerr != PAM_SUCCESS)
766 cupsdLogMessage(CUPSD_LOG_WARN,
767 "[Client %d] pam_setcred() returned %d (%s)",
768 con->http.fd, pamerr,
769 pam_strerror(pamh, pamerr));
770 # endif /* HAVE_PAM_SETCRED */
771
772 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
773 if (pamerr != PAM_SUCCESS)
774 {
775 cupsdLogMessage(CUPSD_LOG_ERROR,
776 "[Client %d] pam_acct_mgmt() returned %d (%s)",
777 con->http.fd, pamerr, pam_strerror(pamh, pamerr));
778 pam_end(pamh, 0);
779 return;
780 }
781
782 pam_end(pamh, PAM_SUCCESS);
783
784 #elif defined(HAVE_USERSEC_H)
785 /*
786 * Use AIX authentication interface...
787 */
788
789 char *authmsg; /* Authentication message */
790 int reenter; /* ??? */
791
792
793 cupsdLogMessage(CUPSD_LOG_DEBUG,
794 "[Client %d] AIX authenticate of username \"%s\"",
795 con->http.fd, username);
796
797 reenter = 1;
798 if (authenticate(username, password, &reenter, &authmsg) != 0)
799 {
800 cupsdLogMessage(CUPSD_LOG_DEBUG,
801 "[Client %d] Unable to authenticate username "
802 "\"%s\": %s", con->http.fd, username,
803 strerror(errno));
804 return;
805 }
806
807 #else
808 /*
809 * Use normal UNIX password file-based authentication...
810 */
811
812 char *pass; /* Encrypted password */
813 struct passwd *pw; /* User password data */
814 # ifdef HAVE_SHADOW_H
815 struct spwd *spw; /* Shadow password data */
816 # endif /* HAVE_SHADOW_H */
817
818
819 pw = getpwnam(username); /* Get the current password */
820 endpwent(); /* Close the password file */
821
822 if (!pw)
823 {
824 /*
825 * No such user...
826 */
827
828 cupsdLogMessage(CUPSD_LOG_ERROR,
829 "[Client %d] Unknown username \"%s\".",
830 con->http.fd, username);
831 return;
832 }
833
834 # ifdef HAVE_SHADOW_H
835 spw = getspnam(username);
836 endspent();
837
838 if (!spw && !strcmp(pw->pw_passwd, "x"))
839 {
840 /*
841 * Don't allow blank passwords!
842 */
843
844 cupsdLogMessage(CUPSD_LOG_ERROR,
845 "[Client %d] Username \"%s\" has no shadow "
846 "password.", con->http.fd, username);
847 return;
848 }
849
850 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
851 # else
852 if (!pw->pw_passwd[0])
853 # endif /* HAVE_SHADOW_H */
854 {
855 /*
856 * Don't allow blank passwords!
857 */
858
859 cupsdLogMessage(CUPSD_LOG_ERROR,
860 "[Client %d] Username \"%s\" has no password.",
861 con->http.fd, username);
862 return;
863 }
864
865 /*
866 * OK, the password isn't blank, so compare with what came from the
867 * client...
868 */
869
870 pass = cups_crypt(password, pw->pw_passwd);
871
872 cupsdLogMessage(CUPSD_LOG_DEBUG2,
873 "[Client %d] pw_passwd=\"%s\", crypt=\"%s\"",
874 con->http.fd, pw->pw_passwd, pass);
875
876 if (!pass || strcmp(pw->pw_passwd, pass))
877 {
878 # ifdef HAVE_SHADOW_H
879 if (spw)
880 {
881 pass = cups_crypt(password, spw->sp_pwdp);
882
883 cupsdLogMessage(CUPSD_LOG_DEBUG2,
884 "[Client %d] sp_pwdp=\"%s\", crypt=\"%s\"",
885 con->http.fd, spw->sp_pwdp, pass);
886
887 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
888 {
889 cupsdLogMessage(CUPSD_LOG_ERROR,
890 "[Client %d] Authentication failed for user "
891 "\"%s\".", con->http.fd, username);
892 return;
893 }
894 }
895 else
896 # endif /* HAVE_SHADOW_H */
897 {
898 cupsdLogMessage(CUPSD_LOG_ERROR,
899 "[Client %d] Authentication failed for user "
900 "\"%s\".", con->http.fd, username);
901 return;
902 }
903 }
904 #endif /* HAVE_LIBPAM */
905 }
906
907 cupsdLogMessage(CUPSD_LOG_DEBUG,
908 "[Client %d] Authorized as %s using Basic",
909 con->http.fd, username);
910 break;
911
912 case CUPSD_AUTH_BASICDIGEST :
913 /*
914 * Do Basic authentication with the Digest password file...
915 */
916
917 if (!get_md5_password(username, NULL, md5))
918 {
919 cupsdLogMessage(CUPSD_LOG_ERROR,
920 "[Client %d] Unknown MD5 username \"%s\".",
921 con->http.fd, username);
922 return;
923 }
924
925 httpMD5(username, "CUPS", password, basicmd5);
926
927 if (strcmp(md5, basicmd5))
928 {
929 cupsdLogMessage(CUPSD_LOG_ERROR,
930 "[Client %d] Authentication failed for \"%s\".",
931 con->http.fd, username);
932 return;
933 }
934
935 cupsdLogMessage(CUPSD_LOG_DEBUG,
936 "[Client %d] Authorized as %s using BasicDigest",
937 con->http.fd, username);
938 break;
939 }
940
941 con->type = type;
942 }
943 else if (!strncmp(authorization, "Digest", 6))
944 {
945 /*
946 * Get the username, password, and nonce from the Digest attributes...
947 */
948
949 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
950 username, sizeof(username)) || !username[0])
951 {
952 /*
953 * Username must not be empty...
954 */
955
956 cupsdLogMessage(CUPSD_LOG_ERROR,
957 "[Client %d] Empty or missing Digest username.",
958 con->http.fd);
959 return;
960 }
961
962 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
963 password, sizeof(password)) || !password[0])
964 {
965 /*
966 * Password must not be empty...
967 */
968
969 cupsdLogMessage(CUPSD_LOG_ERROR,
970 "[Client %d] Empty or missing Digest password.",
971 con->http.fd);
972 return;
973 }
974
975 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
976 nonce))
977 {
978 cupsdLogMessage(CUPSD_LOG_ERROR,
979 "[Client %d] No nonce value for Digest authentication.",
980 con->http.fd);
981 return;
982 }
983
984 if (strcmp(con->http.hostname, nonce))
985 {
986 cupsdLogMessage(CUPSD_LOG_ERROR,
987 "[Client %d] Bad nonce value, expected \"%s\", "
988 "got \"%s\".", con->http.fd, con->http.hostname, nonce);
989 return;
990 }
991
992 /*
993 * Validate the username and password...
994 */
995
996 if (!get_md5_password(username, NULL, md5))
997 {
998 cupsdLogMessage(CUPSD_LOG_ERROR,
999 "[Client %d] Unknown MD5 username \"%s\".",
1000 con->http.fd, username);
1001 return;
1002 }
1003
1004 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
1005
1006 if (strcmp(md5, password))
1007 {
1008 cupsdLogMessage(CUPSD_LOG_ERROR,
1009 "[Client %d] Authentication failed for \"%s\".",
1010 con->http.fd, username);
1011 return;
1012 }
1013
1014 cupsdLogMessage(CUPSD_LOG_DEBUG,
1015 "[Client %d] Authorized as %s using Digest", con->http.fd,
1016 username);
1017
1018 con->type = CUPSD_AUTH_DIGEST;
1019 }
1020 #ifdef HAVE_GSSAPI
1021 else if (!strncmp(authorization, "Negotiate", 9))
1022 {
1023 int len; /* Length of authorization string */
1024 gss_ctx_id_t context; /* Authorization context */
1025 OM_uint32 major_status, /* Major status code */
1026 minor_status; /* Minor status code */
1027 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
1028 /* Input token from string */
1029 output_token = GSS_C_EMPTY_BUFFER;
1030 /* Output token for username */
1031 gss_name_t client_name; /* Client name */
1032
1033
1034 # ifdef __APPLE__
1035 /*
1036 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
1037 * to use it...
1038 */
1039
1040 if (gss_init_sec_context == NULL)
1041 {
1042 cupsdLogMessage(CUPSD_LOG_WARN,
1043 "[Client %d] GSSAPI/Kerberos authentication failed "
1044 "because the Kerberos framework is not present.",
1045 con->http.fd);
1046 return;
1047 }
1048 # endif /* __APPLE__ */
1049
1050 /*
1051 * Find the start of the Kerberos input token...
1052 */
1053
1054 authorization += 9;
1055 while (isspace(*authorization & 255))
1056 authorization ++;
1057
1058 if (!*authorization)
1059 {
1060 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1061 "[Client %d] No authentication data specified.",
1062 con->http.fd);
1063 return;
1064 }
1065
1066 /*
1067 * Decode the authorization string to get the input token...
1068 */
1069
1070 len = strlen(authorization);
1071 input_token.value = malloc(len);
1072 input_token.value = httpDecode64_2(input_token.value, &len,
1073 authorization);
1074 input_token.length = len;
1075
1076 /*
1077 * Accept the input token to get the authorization info...
1078 */
1079
1080 context = GSS_C_NO_CONTEXT;
1081 client_name = GSS_C_NO_NAME;
1082 major_status = gss_accept_sec_context(&minor_status,
1083 &context,
1084 ServerCreds,
1085 &input_token,
1086 GSS_C_NO_CHANNEL_BINDINGS,
1087 &client_name,
1088 NULL,
1089 &output_token,
1090 NULL,
1091 NULL,
1092 NULL);
1093
1094 if (output_token.length > 0)
1095 gss_release_buffer(&minor_status, &output_token);
1096
1097 if (GSS_ERROR(major_status))
1098 {
1099 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1100 "[Client %d] Error accepting GSSAPI security context",
1101 con->http.fd);
1102
1103 if (context != GSS_C_NO_CONTEXT)
1104 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1105 return;
1106 }
1107
1108 con->have_gss = 1;
1109
1110 /*
1111 * Get the username associated with the client's credentials...
1112 */
1113
1114 if (major_status == GSS_S_CONTINUE_NEEDED)
1115 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1116 "[Client %d] Credentials not complete", con->http.fd);
1117 else if (major_status == GSS_S_COMPLETE)
1118 {
1119 major_status = gss_display_name(&minor_status, client_name,
1120 &output_token, NULL);
1121
1122 if (GSS_ERROR(major_status))
1123 {
1124 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1125 "[Client %d] Error getting username", con->http.fd);
1126 gss_release_name(&minor_status, &client_name);
1127 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1128 return;
1129 }
1130
1131 strlcpy(username, output_token.value, sizeof(username));
1132
1133 cupsdLogMessage(CUPSD_LOG_DEBUG,
1134 "[Client %d] Authorized as %s using Negotiate",
1135 con->http.fd, username);
1136
1137 gss_release_name(&minor_status, &client_name);
1138 gss_release_buffer(&minor_status, &output_token);
1139
1140 con->type = CUPSD_AUTH_NEGOTIATE;
1141 }
1142
1143 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1144
1145 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
1146 /*
1147 * Get the client's UID if we are printing locally - that allows a backend
1148 * to run as the correct user to get Kerberos credentials of its own.
1149 */
1150
1151 if (_httpAddrFamily(con->http.hostaddr) == AF_LOCAL)
1152 {
1153 cupsd_ucred_t peercred; /* Peer credentials */
1154 socklen_t peersize; /* Size of peer credentials */
1155
1156 peersize = sizeof(peercred);
1157
1158 # ifdef __APPLE__
1159 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
1160 # else
1161 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred,
1162 &peersize))
1163 # endif /* __APPLE__ */
1164 {
1165 cupsdLogMessage(CUPSD_LOG_ERROR,
1166 "[Client %d] Unable to get peer credentials - %s",
1167 con->http.fd, strerror(errno));
1168 }
1169 else
1170 {
1171 cupsdLogMessage(CUPSD_LOG_DEBUG,
1172 "[Client %d] Using credentials for UID %d.",
1173 con->http.fd, CUPSD_UCRED_UID(peercred));
1174 con->gss_uid = CUPSD_UCRED_UID(peercred);
1175 }
1176 }
1177 # endif /* SO_PEERCRED && AF_LOCAL */
1178 }
1179 #endif /* HAVE_GSSAPI */
1180 else
1181 {
1182 char scheme[256]; /* Auth scheme... */
1183
1184
1185 if (sscanf(authorization, "%255s", scheme) != 1)
1186 strlcpy(scheme, "UNKNOWN", sizeof(scheme));
1187
1188 cupsdLogMessage(CUPSD_LOG_ERROR,
1189 "[Client %d] Bad authentication data \"%s ...\"",
1190 con->http.fd, scheme);
1191 return;
1192 }
1193
1194 /*
1195 * If we get here, then we were able to validate the username and
1196 * password - copy the validated username and password to the client
1197 * data and return...
1198 */
1199
1200 strlcpy(con->username, username, sizeof(con->username));
1201 strlcpy(con->password, password, sizeof(con->password));
1202 }
1203
1204
1205 /*
1206 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1207 * access a location.
1208 */
1209
1210 int /* O - 1 if allowed, 0 otherwise */
1211 cupsdCheckAccess(
1212 unsigned ip[4], /* I - Client address */
1213 char *name, /* I - Client hostname */
1214 int namelen, /* I - Length of hostname */
1215 cupsd_location_t *loc) /* I - Location to check */
1216 {
1217 int allow; /* 1 if allowed, 0 otherwise */
1218
1219
1220 if (!_cups_strcasecmp(name, "localhost"))
1221 {
1222 /*
1223 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1224 */
1225
1226 return (1);
1227 }
1228 else
1229 {
1230 /*
1231 * Do authorization checks on the domain/address...
1232 */
1233
1234 switch (loc->order_type)
1235 {
1236 default :
1237 allow = 0; /* anti-compiler-warning-code */
1238 break;
1239
1240 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
1241 allow = 1;
1242
1243 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1244 allow = 0;
1245
1246 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1247 allow = 1;
1248 break;
1249
1250 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
1251 allow = 0;
1252
1253 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1254 allow = 1;
1255
1256 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1257 allow = 0;
1258 break;
1259 }
1260 }
1261
1262 return (allow);
1263 }
1264
1265
1266 /*
1267 * 'cupsdCheckAuth()' - Check authorization masks.
1268 */
1269
1270 int /* O - 1 if mask matches, 0 otherwise */
1271 cupsdCheckAuth(unsigned ip[4], /* I - Client address */
1272 char *name, /* I - Client hostname */
1273 int name_len, /* I - Length of hostname */
1274 cups_array_t *masks) /* I - Masks */
1275 {
1276 int i; /* Looping var */
1277 cupsd_authmask_t *mask; /* Current mask */
1278 cupsd_netif_t *iface; /* Network interface */
1279 unsigned netip4; /* IPv4 network address */
1280 #ifdef AF_INET6
1281 unsigned netip6[4]; /* IPv6 network address */
1282 #endif /* AF_INET6 */
1283
1284
1285 for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
1286 mask;
1287 mask = (cupsd_authmask_t *)cupsArrayNext(masks))
1288 {
1289 switch (mask->type)
1290 {
1291 case CUPSD_AUTH_INTERFACE :
1292 /*
1293 * Check for a match with a network interface...
1294 */
1295
1296 netip4 = htonl(ip[3]);
1297
1298 #ifdef AF_INET6
1299 netip6[0] = htonl(ip[0]);
1300 netip6[1] = htonl(ip[1]);
1301 netip6[2] = htonl(ip[2]);
1302 netip6[3] = htonl(ip[3]);
1303 #endif /* AF_INET6 */
1304
1305 if (!strcmp(mask->mask.name.name, "*"))
1306 {
1307 #ifdef __APPLE__
1308 /*
1309 * Allow Back-to-My-Mac addresses...
1310 */
1311
1312 if ((ip[0] & 0xff000000) == 0xfd000000)
1313 return (1);
1314 #endif /* __APPLE__ */
1315
1316 /*
1317 * Check against all local interfaces...
1318 */
1319
1320 cupsdNetIFUpdate();
1321
1322 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1323 iface;
1324 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1325 {
1326 /*
1327 * Only check local interfaces...
1328 */
1329
1330 if (!iface->is_local)
1331 continue;
1332
1333 if (iface->address.addr.sa_family == AF_INET)
1334 {
1335 /*
1336 * Check IPv4 address...
1337 */
1338
1339 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1340 (iface->address.ipv4.sin_addr.s_addr &
1341 iface->mask.ipv4.sin_addr.s_addr))
1342 return (1);
1343 }
1344 #ifdef AF_INET6
1345 else
1346 {
1347 /*
1348 * Check IPv6 address...
1349 */
1350
1351 for (i = 0; i < 4; i ++)
1352 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1353 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1354 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1355 break;
1356
1357 if (i == 4)
1358 return (1);
1359 }
1360 #endif /* AF_INET6 */
1361 }
1362 }
1363 else
1364 {
1365 /*
1366 * Check the named interface...
1367 */
1368
1369 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1370 iface;
1371 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1372 {
1373 if (strcmp(mask->mask.name.name, iface->name))
1374 continue;
1375
1376 if (iface->address.addr.sa_family == AF_INET)
1377 {
1378 /*
1379 * Check IPv4 address...
1380 */
1381
1382 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1383 (iface->address.ipv4.sin_addr.s_addr &
1384 iface->mask.ipv4.sin_addr.s_addr))
1385 return (1);
1386 }
1387 #ifdef AF_INET6
1388 else
1389 {
1390 /*
1391 * Check IPv6 address...
1392 */
1393
1394 for (i = 0; i < 4; i ++)
1395 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1396 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1397 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1398 break;
1399
1400 if (i == 4)
1401 return (1);
1402 }
1403 #endif /* AF_INET6 */
1404 }
1405 }
1406 break;
1407
1408 case CUPSD_AUTH_NAME :
1409 /*
1410 * Check for exact name match...
1411 */
1412
1413 if (!_cups_strcasecmp(name, mask->mask.name.name))
1414 return (1);
1415
1416 /*
1417 * Check for domain match...
1418 */
1419
1420 if (name_len >= mask->mask.name.length &&
1421 mask->mask.name.name[0] == '.' &&
1422 !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1423 mask->mask.name.name))
1424 return (1);
1425 break;
1426
1427 case CUPSD_AUTH_IP :
1428 /*
1429 * Check for IP/network address match...
1430 */
1431
1432 for (i = 0; i < 4; i ++)
1433 if ((ip[i] & mask->mask.ip.netmask[i]) !=
1434 mask->mask.ip.address[i])
1435 break;
1436
1437 if (i == 4)
1438 return (1);
1439 break;
1440 }
1441 }
1442
1443 return (0);
1444 }
1445
1446
1447 /*
1448 * 'cupsdCheckGroup()' - Check for a user's group membership.
1449 */
1450
1451 int /* O - 1 if user is a member, 0 otherwise */
1452 cupsdCheckGroup(
1453 const char *username, /* I - User name */
1454 struct passwd *user, /* I - System user info */
1455 const char *groupname) /* I - Group name */
1456 {
1457 int i; /* Looping var */
1458 struct group *group; /* System group info */
1459 char junk[33]; /* MD5 password (not used) */
1460 #ifdef HAVE_MBR_UID_TO_UUID
1461 uuid_t useruuid, /* UUID for username */
1462 groupuuid; /* UUID for groupname */
1463 int is_member; /* True if user is a member of group */
1464 #endif /* HAVE_MBR_UID_TO_UUID */
1465
1466
1467 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1468 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1469 username, user, groupname);
1470
1471 /*
1472 * Validate input...
1473 */
1474
1475 if (!username || !groupname)
1476 return (0);
1477
1478 /*
1479 * Check to see if the user is a member of the named group...
1480 */
1481
1482 group = getgrnam(groupname);
1483 endgrent();
1484
1485 if (group != NULL)
1486 {
1487 /*
1488 * Group exists, check it...
1489 */
1490
1491 for (i = 0; group->gr_mem[i]; i ++)
1492 if (!_cups_strcasecmp(username, group->gr_mem[i]))
1493 return (1);
1494 }
1495
1496 /*
1497 * Group doesn't exist or user not in group list, check the group ID
1498 * against the user's group ID...
1499 */
1500
1501 if (user && group && group->gr_gid == user->pw_gid)
1502 return (1);
1503
1504 #ifdef HAVE_MBR_UID_TO_UUID
1505 /*
1506 * Check group membership through MacOS X membership API...
1507 */
1508
1509 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1510 {
1511 if (group)
1512 {
1513 /*
1514 * Map group name to UUID and check membership...
1515 */
1516
1517 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1518 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1519 if (is_member)
1520 return (1);
1521 }
1522 else if (groupname[0] == '#')
1523 {
1524 /*
1525 * Use UUID directly and check for equality (user UUID) and
1526 * membership (group UUID)...
1527 */
1528
1529 if (!uuid_parse((char *)groupname + 1, groupuuid))
1530 {
1531 if (!uuid_compare(useruuid, groupuuid))
1532 return (1);
1533 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1534 if (is_member)
1535 return (1);
1536 }
1537
1538 return (0);
1539 }
1540 }
1541 else if (groupname[0] == '#')
1542 return (0);
1543 #endif /* HAVE_MBR_UID_TO_UUID */
1544
1545 /*
1546 * Username not found, group not found, or user is not part of the
1547 * system group... Check for a user and group in the MD5 password
1548 * file...
1549 */
1550
1551 if (get_md5_password(username, groupname, junk) != NULL)
1552 return (1);
1553
1554 /*
1555 * If we get this far, then the user isn't part of the named group...
1556 */
1557
1558 return (0);
1559 }
1560
1561
1562 /*
1563 * 'cupsdCopyLocation()' - Make a copy of a location...
1564 */
1565
1566 cupsd_location_t * /* O - New location */
1567 cupsdCopyLocation(
1568 cupsd_location_t *loc) /* I - Original location */
1569 {
1570 cupsd_location_t *temp; /* New location */
1571
1572
1573 /*
1574 * Make a copy of the original location...
1575 */
1576
1577 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1578 return (NULL);
1579
1580 /*
1581 * Copy the information from the original location to the new one.
1582 */
1583
1584 if (!loc)
1585 return (temp);
1586
1587 if (loc->location)
1588 temp->location = _cupsStrAlloc(loc->location);
1589
1590 temp->limit = loc->limit;
1591 temp->order_type = loc->order_type;
1592 temp->type = loc->type;
1593 temp->level = loc->level;
1594 temp->satisfy = loc->satisfy;
1595 temp->encryption = loc->encryption;
1596
1597 if (loc->names)
1598 {
1599 if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1600 {
1601 cupsdLogMessage(CUPSD_LOG_ERROR,
1602 "Unable to allocate memory for %d names: %s",
1603 cupsArrayCount(loc->names), strerror(errno));
1604
1605 cupsdFreeLocation(temp);
1606 return (NULL);
1607 }
1608 }
1609
1610 if (loc->allow)
1611 {
1612 /*
1613 * Copy allow rules...
1614 */
1615
1616 if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1617 {
1618 cupsdLogMessage(CUPSD_LOG_ERROR,
1619 "Unable to allocate memory for %d allow rules: %s",
1620 cupsArrayCount(loc->allow), strerror(errno));
1621 cupsdFreeLocation(temp);
1622 return (NULL);
1623 }
1624 }
1625
1626 if (loc->deny)
1627 {
1628 /*
1629 * Copy deny rules...
1630 */
1631
1632 if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1633 {
1634 cupsdLogMessage(CUPSD_LOG_ERROR,
1635 "Unable to allocate memory for %d deny rules: %s",
1636 cupsArrayCount(loc->deny), strerror(errno));
1637 cupsdFreeLocation(temp);
1638 return (NULL);
1639 }
1640 }
1641
1642 return (temp);
1643 }
1644
1645
1646 /*
1647 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1648 */
1649
1650 void
1651 cupsdDeleteAllLocations(void)
1652 {
1653 /*
1654 * Free the location array, which will free all of the locations...
1655 */
1656
1657 cupsArrayDelete(Locations);
1658 Locations = NULL;
1659 }
1660
1661
1662 /*
1663 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1664 */
1665
1666 cupsd_location_t * /* O - Location that matches */
1667 cupsdFindBest(const char *path, /* I - Resource path */
1668 http_state_t state) /* I - HTTP state/request */
1669 {
1670 char uri[HTTP_MAX_URI],
1671 /* URI in request... */
1672 *uriptr; /* Pointer into URI */
1673 cupsd_location_t *loc, /* Current location */
1674 *best; /* Best match for location so far */
1675 int bestlen; /* Length of best match */
1676 int limit; /* Limit field */
1677 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1678 {
1679 CUPSD_AUTH_LIMIT_ALL,
1680 CUPSD_AUTH_LIMIT_OPTIONS,
1681 CUPSD_AUTH_LIMIT_GET,
1682 CUPSD_AUTH_LIMIT_GET,
1683 CUPSD_AUTH_LIMIT_HEAD,
1684 CUPSD_AUTH_LIMIT_POST,
1685 CUPSD_AUTH_LIMIT_POST,
1686 CUPSD_AUTH_LIMIT_POST,
1687 CUPSD_AUTH_LIMIT_PUT,
1688 CUPSD_AUTH_LIMIT_PUT,
1689 CUPSD_AUTH_LIMIT_DELETE,
1690 CUPSD_AUTH_LIMIT_TRACE,
1691 CUPSD_AUTH_LIMIT_ALL,
1692 CUPSD_AUTH_LIMIT_ALL
1693 };
1694
1695
1696 /*
1697 * First copy the connection URI to a local string so we have drop
1698 * any .ppd extension from the pathname in /printers or /classes
1699 * URIs...
1700 */
1701
1702 strlcpy(uri, path, sizeof(uri));
1703
1704 if (!strncmp(uri, "/printers/", 10) ||
1705 !strncmp(uri, "/classes/", 9))
1706 {
1707 /*
1708 * Check if the URI has .ppd on the end...
1709 */
1710
1711 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1712
1713 if (!strcmp(uriptr, ".ppd"))
1714 *uriptr = '\0';
1715 }
1716
1717 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1718
1719 /*
1720 * Loop through the list of locations to find a match...
1721 */
1722
1723 limit = limits[state];
1724 best = NULL;
1725 bestlen = 0;
1726
1727 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1728 loc;
1729 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1730 {
1731 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1732 loc->location ? loc->location : "nil", loc->limit);
1733
1734 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1735 {
1736 /*
1737 * Use case-insensitive comparison for queue names...
1738 */
1739
1740 if (loc->length > bestlen && loc->location &&
1741 !_cups_strncasecmp(uri, loc->location, loc->length) &&
1742 loc->location[0] == '/' &&
1743 (limit & loc->limit) != 0)
1744 {
1745 best = loc;
1746 bestlen = loc->length;
1747 }
1748 }
1749 else
1750 {
1751 /*
1752 * Use case-sensitive comparison for other URIs...
1753 */
1754
1755 if (loc->length > bestlen && loc->location &&
1756 !strncmp(uri, loc->location, loc->length) &&
1757 loc->location[0] == '/' &&
1758 (limit & loc->limit) != 0)
1759 {
1760 best = loc;
1761 bestlen = loc->length;
1762 }
1763 }
1764 }
1765
1766 /*
1767 * Return the match, if any...
1768 */
1769
1770 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1771 best ? best->location : "NONE");
1772
1773 return (best);
1774 }
1775
1776
1777 /*
1778 * 'cupsdFindLocation()' - Find the named location.
1779 */
1780
1781 cupsd_location_t * /* O - Location that matches */
1782 cupsdFindLocation(const char *location) /* I - Connection */
1783 {
1784 cupsd_location_t key; /* Search key */
1785
1786
1787 key.location = (char *)location;
1788
1789 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1790 }
1791
1792
1793 /*
1794 * 'cupsdFreeLocation()' - Free all memory used by a location.
1795 */
1796
1797 void
1798 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1799 {
1800 cupsArrayDelete(loc->names);
1801 cupsArrayDelete(loc->allow);
1802 cupsArrayDelete(loc->deny);
1803
1804 _cupsStrFree(loc->location);
1805 free(loc);
1806 }
1807
1808
1809 /*
1810 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1811 */
1812
1813 http_status_t /* O - HTTP_OK if authorized or error code */
1814 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1815 const char *owner)/* I - Owner of object */
1816 {
1817 int i, /* Looping vars */
1818 auth, /* Authorization status */
1819 type; /* Type of authentication */
1820 unsigned address[4]; /* Authorization address */
1821 cupsd_location_t *best; /* Best match for location so far */
1822 int hostlen; /* Length of hostname */
1823 char *name, /* Current username */
1824 username[256], /* Username to authorize */
1825 ownername[256], /* Owner name to authorize */
1826 *ptr; /* Pointer into username */
1827 struct passwd *pw; /* User password data */
1828 static const char * const levels[] = /* Auth levels */
1829 {
1830 "ANON",
1831 "USER",
1832 "GROUP"
1833 };
1834 static const char * const types[] = /* Auth types */
1835 {
1836 "None",
1837 "Basic",
1838 "Digest",
1839 "BasicDigest",
1840 "Negotiate"
1841 };
1842
1843
1844 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1845 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1846 con->uri, con->best, con->best ? con->best->location ?
1847 con->best->location : "(null)" : "");
1848 if (owner)
1849 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1850 "cupsdIsAuthorized: owner=\"%s\"", owner);
1851
1852 /*
1853 * If there is no "best" authentication rule for this request, then
1854 * access is allowed from the local system and denied from other
1855 * addresses...
1856 */
1857
1858 if (!con->best)
1859 {
1860 if (!strcmp(con->http.hostname, "localhost") ||
1861 !strcmp(con->http.hostname, ServerName))
1862 return (HTTP_OK);
1863 else
1864 return (HTTP_FORBIDDEN);
1865 }
1866
1867 best = con->best;
1868
1869 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1870 type = cupsdDefaultAuthType();
1871
1872 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1873 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
1874 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
1875 levels[best->level], types[type],
1876 best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1877
1878 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1879 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1880 best->op, ippOpString(best->op));
1881
1882 /*
1883 * Check host/ip-based accesses...
1884 */
1885
1886 #ifdef AF_INET6
1887 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1888 {
1889 /*
1890 * Copy IPv6 address...
1891 */
1892
1893 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1894 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1895 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1896 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1897 }
1898 else
1899 #endif /* AF_INET6 */
1900 if (con->http.hostaddr->addr.sa_family == AF_INET)
1901 {
1902 /*
1903 * Copy IPv4 address...
1904 */
1905
1906 address[0] = 0;
1907 address[1] = 0;
1908 address[2] = 0;
1909 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1910 }
1911 else
1912 memset(address, 0, sizeof(address));
1913
1914 hostlen = strlen(con->http.hostname);
1915
1916 auth = cupsdCheckAccess(address, con->http.hostname, hostlen, best)
1917 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1918
1919 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
1920 auth ? "DENY" : "ALLOW");
1921
1922 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1923 return (HTTP_FORBIDDEN);
1924
1925 #ifdef HAVE_SSL
1926 /*
1927 * See if encryption is required...
1928 */
1929
1930 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1931 _cups_strcasecmp(con->http.hostname, "localhost") &&
1932 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1933 !(type == CUPSD_AUTH_NEGOTIATE ||
1934 (type == CUPSD_AUTH_NONE &&
1935 cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1936 {
1937 cupsdLogMessage(CUPSD_LOG_DEBUG,
1938 "cupsdIsAuthorized: Need upgrade to TLS...");
1939 return (HTTP_UPGRADE_REQUIRED);
1940 }
1941 #endif /* HAVE_SSL */
1942
1943 /*
1944 * Now see what access level is required...
1945 */
1946
1947 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1948 (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1949 return (HTTP_OK);
1950
1951 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1952 best->limit == CUPSD_AUTH_LIMIT_IPP)
1953 {
1954 /*
1955 * Check for unauthenticated username...
1956 */
1957
1958 ipp_attribute_t *attr; /* requesting-user-name attribute */
1959
1960
1961 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1962 if (attr)
1963 {
1964 cupsdLogMessage(CUPSD_LOG_DEBUG,
1965 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1966 attr->values[0].string.text);
1967 strlcpy(username, attr->values[0].string.text, sizeof(username));
1968 }
1969 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1970 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1971 else
1972 return (HTTP_OK); /* unless overridden with Satisfy */
1973 }
1974 else
1975 {
1976 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1977 con->username);
1978
1979 #ifdef HAVE_AUTHORIZATION_H
1980 if (!con->username[0] && !con->authref)
1981 #else
1982 if (!con->username[0])
1983 #endif /* HAVE_AUTHORIZATION_H */
1984 {
1985 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1986 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1987 else
1988 return (HTTP_OK); /* unless overridden with Satisfy */
1989 }
1990
1991
1992 if (con->type != type && type != CUPSD_AUTH_NONE &&
1993 #ifdef HAVE_GSSAPI
1994 (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1995 #endif /* HAVE_GSSAPI */
1996 (con->type != CUPSD_AUTH_BASIC || type != CUPSD_AUTH_BASICDIGEST))
1997 {
1998 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
1999 types[con->type], types[type]);
2000
2001 return (HTTP_UNAUTHORIZED);
2002 }
2003
2004 strlcpy(username, con->username, sizeof(username));
2005 }
2006
2007 /*
2008 * OK, got a username. See if we need normal user access, or group
2009 * access... (root always matches)
2010 */
2011
2012 if (!strcmp(username, "root"))
2013 return (HTTP_OK);
2014
2015 /*
2016 * Strip any @domain or @KDC from the username and owner...
2017 */
2018
2019 if ((ptr = strchr(username, '@')) != NULL)
2020 *ptr = '\0';
2021
2022 if (owner)
2023 {
2024 strlcpy(ownername, owner, sizeof(ownername));
2025
2026 if ((ptr = strchr(ownername, '@')) != NULL)
2027 *ptr = '\0';
2028 }
2029 else
2030 ownername[0] = '\0';
2031
2032 /*
2033 * Get the user info...
2034 */
2035
2036 if (username[0])
2037 {
2038 pw = getpwnam(username);
2039 endpwent();
2040 }
2041 else
2042 pw = NULL;
2043
2044 if (best->level == CUPSD_AUTH_USER)
2045 {
2046 /*
2047 * If there are no names associated with this location, then
2048 * any valid user is OK...
2049 */
2050
2051 if (cupsArrayCount(best->names) == 0)
2052 return (HTTP_OK);
2053
2054 /*
2055 * Otherwise check the user list and return OK if this user is
2056 * allowed...
2057 */
2058
2059 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2060 "cupsdIsAuthorized: Checking user membership...");
2061
2062 #ifdef HAVE_AUTHORIZATION_H
2063 /*
2064 * If an authorization reference was supplied it must match a right name...
2065 */
2066
2067 if (con->authref)
2068 {
2069 for (name = (char *)cupsArrayFirst(best->names);
2070 name;
2071 name = (char *)cupsArrayNext(best->names))
2072 {
2073 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
2074 return (HTTP_OK);
2075 else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
2076 check_authref(con, SystemGroupAuthKey))
2077 return (HTTP_OK);
2078 }
2079
2080 return (HTTP_FORBIDDEN);
2081 }
2082 #endif /* HAVE_AUTHORIZATION_H */
2083
2084 for (name = (char *)cupsArrayFirst(best->names);
2085 name;
2086 name = (char *)cupsArrayNext(best->names))
2087 {
2088 if (!_cups_strcasecmp(name, "@OWNER") && owner &&
2089 !_cups_strcasecmp(username, ownername))
2090 return (HTTP_OK);
2091 else if (!_cups_strcasecmp(name, "@SYSTEM"))
2092 {
2093 for (i = 0; i < NumSystemGroups; i ++)
2094 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
2095 return (HTTP_OK);
2096 }
2097 else if (name[0] == '@')
2098 {
2099 if (cupsdCheckGroup(username, pw, name + 1))
2100 return (HTTP_OK);
2101 }
2102 else if (!_cups_strcasecmp(username, name))
2103 return (HTTP_OK);
2104 }
2105
2106 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
2107 }
2108
2109 /*
2110 * Check to see if this user is in any of the named groups...
2111 */
2112
2113 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2114 "cupsdIsAuthorized: Checking group membership...");
2115
2116 /*
2117 * Check to see if this user is in any of the named groups...
2118 */
2119
2120 for (name = (char *)cupsArrayFirst(best->names);
2121 name;
2122 name = (char *)cupsArrayNext(best->names))
2123 {
2124 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2125 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2126 name);
2127
2128 if (!_cups_strcasecmp(name, "@SYSTEM"))
2129 {
2130 for (i = 0; i < NumSystemGroups; i ++)
2131 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
2132 return (HTTP_OK);
2133 }
2134 else if (cupsdCheckGroup(username, pw, name))
2135 return (HTTP_OK);
2136 }
2137
2138 /*
2139 * The user isn't part of the specified group, so deny access...
2140 */
2141
2142 cupsdLogMessage(CUPSD_LOG_DEBUG,
2143 "cupsdIsAuthorized: User not in group(s)!");
2144
2145 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
2146 }
2147
2148
2149 /*
2150 * 'cupsdNewLocation()' - Create a new location for authorization.
2151 *
2152 * Note: Still need to call cupsdAddLocation() to add it to the list of global
2153 * locations.
2154 */
2155
2156 cupsd_location_t * /* O - Pointer to new location record */
2157 cupsdNewLocation(const char *location) /* I - Location path */
2158 {
2159 cupsd_location_t *temp; /* New location */
2160
2161
2162 /*
2163 * Try to allocate memory for the new location.
2164 */
2165
2166 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
2167 return (NULL);
2168
2169 /*
2170 * Initialize the record and copy the name over...
2171 */
2172
2173 if ((temp->location = _cupsStrAlloc(location)) == NULL)
2174 {
2175 free(temp);
2176 return (NULL);
2177 }
2178
2179 temp->length = strlen(temp->location);
2180
2181 /*
2182 * Return the new record...
2183 */
2184
2185 return (temp);
2186 }
2187
2188
2189 #ifdef HAVE_AUTHORIZATION_H
2190 /*
2191 * 'check_authref()' - Check if an authorization services reference has the
2192 * supplied right.
2193 */
2194
2195 static int /* O - 1 if right is valid, 0 otherwise */
2196 check_authref(cupsd_client_t *con, /* I - Connection */
2197 const char *right) /* I - Right name */
2198 {
2199 OSStatus status; /* OS Status */
2200 AuthorizationItem authright; /* Authorization right */
2201 AuthorizationRights authrights; /* Authorization rights */
2202 AuthorizationFlags authflags; /* Authorization flags */
2203
2204
2205 /*
2206 * Check to see if the user is allowed to perform the task...
2207 */
2208
2209 if (!con->authref)
2210 return (0);
2211
2212 authright.name = right;
2213 authright.valueLength = 0;
2214 authright.value = NULL;
2215 authright.flags = 0;
2216
2217 authrights.count = 1;
2218 authrights.items = &authright;
2219
2220 authflags = kAuthorizationFlagDefaults |
2221 kAuthorizationFlagExtendRights;
2222
2223 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2224 kAuthorizationEmptyEnvironment,
2225 authflags, NULL)) != 0)
2226 {
2227 cupsdLogMessage(CUPSD_LOG_ERROR,
2228 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2229 authright.name, (int)status, cssmErrorString(status));
2230 return (0);
2231 }
2232
2233 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2234 "AuthorizationCopyRights(\"%s\") succeeded!",
2235 authright.name);
2236
2237 return (1);
2238 }
2239 #endif /* HAVE_AUTHORIZATION_H */
2240
2241
2242 /*
2243 * 'compare_locations()' - Compare two locations.
2244 */
2245
2246 static int /* O - Result of comparison */
2247 compare_locations(cupsd_location_t *a, /* I - First location */
2248 cupsd_location_t *b) /* I - Second location */
2249 {
2250 return (strcmp(b->location, a->location));
2251 }
2252
2253
2254 /*
2255 * 'copy_authmask()' - Copy function for auth masks.
2256 */
2257
2258 static cupsd_authmask_t * /* O - New auth mask */
2259 copy_authmask(cupsd_authmask_t *mask, /* I - Existing auth mask */
2260 void *data) /* I - User data (unused) */
2261 {
2262 cupsd_authmask_t *temp; /* New auth mask */
2263
2264
2265 (void)data;
2266
2267 if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
2268 {
2269 memcpy(temp, mask, sizeof(cupsd_authmask_t));
2270
2271 if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
2272 {
2273 /*
2274 * Make a copy of the name...
2275 */
2276
2277 if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
2278 {
2279 /*
2280 * Failed to make copy...
2281 */
2282
2283 free(temp);
2284 temp = NULL;
2285 }
2286 }
2287 }
2288
2289 return (temp);
2290 }
2291
2292
2293 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2294 /*
2295 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2296 * as needed.
2297 */
2298
2299 static char * /* O - Encrypted password */
2300 cups_crypt(const char *pw, /* I - Password string */
2301 const char *salt) /* I - Salt (key) string */
2302 {
2303 if (!strncmp(salt, "$1$", 3))
2304 {
2305 /*
2306 * Use MD5 passwords without the benefit of PAM; this is for
2307 * Slackware Linux, and the algorithm was taken from the
2308 * old shadow-19990827/lib/md5crypt.c source code... :(
2309 */
2310
2311 int i; /* Looping var */
2312 unsigned long n; /* Output number */
2313 int pwlen; /* Length of password string */
2314 const char *salt_end; /* End of "salt" data for MD5 */
2315 char *ptr; /* Pointer into result string */
2316 _cups_md5_state_t state; /* Primary MD5 state info */
2317 _cups_md5_state_t state2; /* Secondary MD5 state info */
2318 unsigned char digest[16]; /* MD5 digest result */
2319 static char result[120]; /* Final password string */
2320
2321
2322 /*
2323 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2324 * Get a maximum of 8 characters of salt data after $1$...
2325 */
2326
2327 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2328 if (*salt_end == '$')
2329 break;
2330
2331 /*
2332 * Compute the MD5 sum we need...
2333 */
2334
2335 pwlen = strlen(pw);
2336
2337 _cupsMD5Init(&state);
2338 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2339 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2340
2341 _cupsMD5Init(&state2);
2342 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2343 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2344 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2345 _cupsMD5Finish(&state2, digest);
2346
2347 for (i = pwlen; i > 0; i -= 16)
2348 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2349
2350 for (i = pwlen; i > 0; i >>= 1)
2351 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2352
2353 _cupsMD5Finish(&state, digest);
2354
2355 for (i = 0; i < 1000; i ++)
2356 {
2357 _cupsMD5Init(&state);
2358
2359 if (i & 1)
2360 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2361 else
2362 _cupsMD5Append(&state, digest, 16);
2363
2364 if (i % 3)
2365 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2366
2367 if (i % 7)
2368 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2369
2370 if (i & 1)
2371 _cupsMD5Append(&state, digest, 16);
2372 else
2373 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2374
2375 _cupsMD5Finish(&state, digest);
2376 }
2377
2378 /*
2379 * Copy the final sum to the result string and return...
2380 */
2381
2382 memcpy(result, salt, salt_end - salt);
2383 ptr = result + (salt_end - salt);
2384 *ptr++ = '$';
2385
2386 for (i = 0; i < 5; i ++, ptr += 4)
2387 {
2388 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2389
2390 if (i < 4)
2391 n |= digest[i + 12];
2392 else
2393 n |= digest[5];
2394
2395 to64(ptr, n, 4);
2396 }
2397
2398 to64(ptr, digest[11], 2);
2399 ptr += 2;
2400 *ptr = '\0';
2401
2402 return (result);
2403 }
2404 else
2405 {
2406 /*
2407 * Use the standard crypt() function...
2408 */
2409
2410 return (crypt(pw, salt));
2411 }
2412 }
2413 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2414
2415
2416 /*
2417 * 'free_authmask()' - Free function for auth masks.
2418 */
2419
2420 static void
2421 free_authmask(cupsd_authmask_t *mask, /* I - Auth mask to free */
2422 void *data) /* I - User data (unused) */
2423 {
2424 (void)data;
2425
2426 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2427 _cupsStrFree(mask->mask.name.name);
2428
2429 free(mask);
2430 }
2431
2432
2433 /*
2434 * 'get_md5_password()' - Get an MD5 password.
2435 */
2436
2437 static char * /* O - MD5 password string */
2438 get_md5_password(const char *username, /* I - Username */
2439 const char *group, /* I - Group */
2440 char passwd[33]) /* O - MD5 password string */
2441 {
2442 cups_file_t *fp; /* passwd.md5 file */
2443 char filename[1024], /* passwd.md5 filename */
2444 line[256], /* Line from file */
2445 tempuser[33], /* User from file */
2446 tempgroup[33]; /* Group from file */
2447
2448
2449 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2450 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2451 username, group ? group : "(null)", passwd);
2452
2453 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2454 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2455 {
2456 if (errno != ENOENT)
2457 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2458 strerror(errno));
2459
2460 return (NULL);
2461 }
2462
2463 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2464 {
2465 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2466 {
2467 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2468 continue;
2469 }
2470
2471 if (!strcmp(username, tempuser) &&
2472 (group == NULL || !strcmp(group, tempgroup)))
2473 {
2474 /*
2475 * Found the password entry!
2476 */
2477
2478 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2479 username, tempgroup);
2480
2481 cupsFileClose(fp);
2482 return (passwd);
2483 }
2484 }
2485
2486 /*
2487 * Didn't find a password entry - return NULL!
2488 */
2489
2490 cupsFileClose(fp);
2491 return (NULL);
2492 }
2493
2494
2495 #if HAVE_LIBPAM
2496 /*
2497 * 'pam_func()' - PAM conversation function.
2498 */
2499
2500 static int /* O - Success or failure */
2501 pam_func(
2502 int num_msg, /* I - Number of messages */
2503 const struct pam_message **msg, /* I - Messages */
2504 struct pam_response **resp, /* O - Responses */
2505 void *appdata_ptr)
2506 /* I - Pointer to connection */
2507 {
2508 int i; /* Looping var */
2509 struct pam_response *replies; /* Replies */
2510 cupsd_authdata_t *data; /* Pointer to auth data */
2511
2512
2513 /*
2514 * Allocate memory for the responses...
2515 */
2516
2517 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2518 return (PAM_CONV_ERR);
2519
2520 /*
2521 * Answer all of the messages...
2522 */
2523
2524 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2525
2526 #ifdef __hpux
2527 /*
2528 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2529 * module. This is a workaround...
2530 */
2531
2532 data = auth_data;
2533 (void)appdata_ptr;
2534 #else
2535 data = (cupsd_authdata_t *)appdata_ptr;
2536 #endif /* __hpux */
2537
2538 for (i = 0; i < num_msg; i ++)
2539 {
2540 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2541
2542 switch (msg[i]->msg_style)
2543 {
2544 case PAM_PROMPT_ECHO_ON:
2545 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2546 data->username));
2547 replies[i].resp_retcode = PAM_SUCCESS;
2548 replies[i].resp = strdup(data->username);
2549 break;
2550
2551 case PAM_PROMPT_ECHO_OFF:
2552 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2553 data->password));
2554 replies[i].resp_retcode = PAM_SUCCESS;
2555 replies[i].resp = strdup(data->password);
2556 break;
2557
2558 case PAM_TEXT_INFO:
2559 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2560 replies[i].resp_retcode = PAM_SUCCESS;
2561 replies[i].resp = NULL;
2562 break;
2563
2564 case PAM_ERROR_MSG:
2565 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2566 replies[i].resp_retcode = PAM_SUCCESS;
2567 replies[i].resp = NULL;
2568 break;
2569
2570 default:
2571 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2572 msg[i]->msg_style));
2573 free(replies);
2574 return (PAM_CONV_ERR);
2575 }
2576 }
2577
2578 /*
2579 * Return the responses back to PAM...
2580 */
2581
2582 *resp = replies;
2583
2584 return (PAM_SUCCESS);
2585 }
2586 #elif !defined(HAVE_USERSEC_H)
2587
2588
2589 /*
2590 * 'to64()' - Base64-encode an integer value...
2591 */
2592
2593 static void
2594 to64(char *s, /* O - Output string */
2595 unsigned long v, /* I - Value to encode */
2596 int n) /* I - Number of digits */
2597 {
2598 const char *itoa64 = "./0123456789"
2599 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2600 "abcdefghijklmnopqrstuvwxyz";
2601
2602
2603 for (; n > 0; n --, v >>= 6)
2604 *s++ = itoa64[v & 0x3f];
2605 }
2606 #endif /* HAVE_LIBPAM */
2607
2608
2609 /*
2610 * End of "$Id$".
2611 */
Unnamed repository; edit this file 'description' to name the repository.