]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:


6d573cc81fcb95922a95c50814dd7dce376a5dcf
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * Authorization routines for the CUPS scheduler.
3 *
4 * Copyright 2007-2016 by Apple Inc.
5 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
6 *
7 * This file contains Kerberos support code, copyright 2006 by
8 * Jelmer Vernooij.
9 *
10 * These coded instructions, statements, and computer programs are the
11 * property of Apple Inc. and are protected by Federal copyright
12 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
13 * which should have been included with this file. If this file is
14 * file is missing or damaged, see the license at "http://www.cups.org/".
15 */
16
17 /*
18 * Include necessary headers...
19 */
20
21 #include "cupsd.h"
22 #include <grp.h>
23 #ifdef HAVE_SHADOW_H
24 # include <shadow.h>
25 #endif /* HAVE_SHADOW_H */
26 #ifdef HAVE_CRYPT_H
27 # include <crypt.h>
28 #endif /* HAVE_CRYPT_H */
29 #if HAVE_LIBPAM
30 # ifdef HAVE_PAM_PAM_APPL_H
31 # include <pam/pam_appl.h>
32 # else
33 # include <security/pam_appl.h>
34 # endif /* HAVE_PAM_PAM_APPL_H */
35 #endif /* HAVE_LIBPAM */
36 #ifdef HAVE_MEMBERSHIP_H
37 # include <membership.h>
38 #endif /* HAVE_MEMBERSHIP_H */
39 #ifdef HAVE_AUTHORIZATION_H
40 # include <Security/AuthorizationTags.h>
41 # ifdef HAVE_SECBASEPRIV_H
42 # include <Security/SecBasePriv.h>
43 # else
44 extern const char *cssmErrorString(int error);
45 # endif /* HAVE_SECBASEPRIV_H */
46 #endif /* HAVE_AUTHORIZATION_H */
47 #ifdef HAVE_SYS_PARAM_H
48 # include <sys/param.h>
49 #endif /* HAVE_SYS_PARAM_H */
50 #ifdef HAVE_SYS_UCRED_H
51 # include <sys/ucred.h>
52 typedef struct xucred cupsd_ucred_t;
53 # define CUPSD_UCRED_UID(c) (c).cr_uid
54 #else
55 # ifndef __OpenBSD__
56 typedef struct ucred cupsd_ucred_t;
57 # else
58 typedef struct sockpeercred cupsd_ucred_t;
59 # endif
60 # define CUPSD_UCRED_UID(c) (c).uid
61 #endif /* HAVE_SYS_UCRED_H */
62
63
64 /*
65 * Local functions...
66 */
67
68 #ifdef HAVE_AUTHORIZATION_H
69 static int check_authref(cupsd_client_t *con, const char *right);
70 #endif /* HAVE_AUTHORIZATION_H */
71 static int compare_locations(cupsd_location_t *a,
72 cupsd_location_t *b);
73 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
74 #if !HAVE_LIBPAM
75 static char *cups_crypt(const char *pw, const char *salt);
76 #endif /* !HAVE_LIBPAM */
77 static void free_authmask(cupsd_authmask_t *am, void *data);
78 #if HAVE_LIBPAM
79 static int pam_func(int, const struct pam_message **,
80 struct pam_response **, void *);
81 #else
82 static void to64(char *s, unsigned long v, int n);
83 #endif /* HAVE_LIBPAM */
84
85
86 /*
87 * Local structures...
88 */
89
90 #if HAVE_LIBPAM
91 typedef struct cupsd_authdata_s /**** Authentication data ****/
92 {
93 char username[HTTP_MAX_VALUE], /* Username string */
94 password[HTTP_MAX_VALUE]; /* Password string */
95 } cupsd_authdata_t;
96 #endif /* HAVE_LIBPAM */
97
98
99 /*
100 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
101 */
102
103 int /* O - 1 on success, 0 on failure */
104 cupsdAddIPMask(
105 cups_array_t **masks, /* IO - Masks array (created as needed) */
106 const unsigned address[4], /* I - IP address */
107 const unsigned netmask[4]) /* I - IP netmask */
108 {
109 cupsd_authmask_t temp; /* New host/domain mask */
110
111
112 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", masks, *masks, address[0], address[1], address[2], address[3], netmask[0], netmask[1], netmask[2], netmask[3]);
113
114 temp.type = CUPSD_AUTH_IP;
115 memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
116 memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
117
118 /*
119 * Create the masks array as needed and add...
120 */
121
122 if (!*masks)
123 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
124 (cups_acopy_func_t)copy_authmask,
125 (cups_afree_func_t)free_authmask);
126
127 return (cupsArrayAdd(*masks, &temp));
128 }
129
130
131 /*
132 * 'cupsdAddLocation()' - Add a location for authorization.
133 */
134
135 void
136 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
137 {
138 /*
139 * Make sure the locations array is created...
140 */
141
142 if (!Locations)
143 Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
144 (cups_ahash_func_t)NULL, 0,
145 (cups_acopy_func_t)NULL,
146 (cups_afree_func_t)cupsdFreeLocation);
147
148 if (Locations)
149 {
150 cupsArrayAdd(Locations, loc);
151
152 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"", loc->location ? loc->location : "(null)");
153 }
154 }
155
156
157 /*
158 * 'cupsdAddName()' - Add a name to a location...
159 */
160
161 void
162 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
163 char *name) /* I - Name to add */
164 {
165 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")", loc, name);
166
167 if (!loc->names)
168 loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
169 (cups_acopy_func_t)_cupsStrAlloc,
170 (cups_afree_func_t)_cupsStrFree);
171
172 if (!cupsArrayAdd(loc->names, name))
173 {
174 cupsdLogMessage(CUPSD_LOG_ERROR,
175 "Unable to duplicate name for location %s: %s",
176 loc->location ? loc->location : "nil", strerror(errno));
177 return;
178 }
179 }
180
181
182 /*
183 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
184 */
185
186 int /* O - 1 on success, 0 on failure */
187 cupsdAddNameMask(cups_array_t **masks, /* IO - Masks array (created as needed) */
188 char *name) /* I - Host or interface name */
189 {
190 cupsd_authmask_t temp; /* New host/domain mask */
191 char ifname[32], /* Interface name */
192 *ifptr; /* Pointer to end of name */
193
194
195 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", masks, *masks, name);
196
197 if (!_cups_strcasecmp(name, "@LOCAL"))
198 {
199 /*
200 * Deny *interface*...
201 */
202
203 temp.type = CUPSD_AUTH_INTERFACE;
204 temp.mask.name.name = (char *)"*";
205 }
206 else if (!_cups_strncasecmp(name, "@IF(", 4))
207 {
208 /*
209 * Deny *interface*...
210 */
211
212 strlcpy(ifname, name + 4, sizeof(ifname));
213
214 ifptr = ifname + strlen(ifname) - 1;
215
216 if (ifptr >= ifname && *ifptr == ')')
217 {
218 ifptr --;
219 *ifptr = '\0';
220 }
221
222 temp.type = CUPSD_AUTH_INTERFACE;
223 temp.mask.name.name = ifname;
224 }
225 else
226 {
227 /*
228 * Deny name...
229 */
230
231 if (*name == '*')
232 name ++;
233
234 temp.type = CUPSD_AUTH_NAME;
235 temp.mask.name.name = (char *)name;
236 }
237
238 /*
239 * Set the name length...
240 */
241
242 temp.mask.name.length = strlen(temp.mask.name.name);
243
244 /*
245 * Create the masks array as needed and add...
246 */
247
248 if (!*masks)
249 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
250 (cups_acopy_func_t)copy_authmask,
251 (cups_afree_func_t)free_authmask);
252
253 return (cupsArrayAdd(*masks, &temp));
254 }
255
256
257 /*
258 * 'cupsdAuthorize()' - Validate any authorization credentials.
259 */
260
261 void
262 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
263 {
264 int type; /* Authentication type */
265 const char *authorization; /* Pointer into Authorization string */
266 char *ptr, /* Pointer into string */
267 username[HTTP_MAX_VALUE],
268 /* Username string */
269 password[HTTP_MAX_VALUE];
270 /* Password string */
271 cupsd_cert_t *localuser; /* Certificate username */
272
273
274 /*
275 * Locate the best matching location so we know what kind of
276 * authentication to expect...
277 */
278
279 con->best = cupsdFindBest(con->uri, httpGetState(con->http));
280 con->type = CUPSD_AUTH_NONE;
281
282 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location : "");
283
284 if (con->best && con->best->type != CUPSD_AUTH_NONE)
285 {
286 if (con->best->type == CUPSD_AUTH_DEFAULT)
287 type = cupsdDefaultAuthType();
288 else
289 type = con->best->type;
290 }
291 else
292 type = cupsdDefaultAuthType();
293
294 /*
295 * Decode the Authorization string...
296 */
297
298 authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
299
300 username[0] = '\0';
301 password[0] = '\0';
302
303 #ifdef HAVE_GSSAPI
304 con->gss_uid = 0;
305 #endif /* HAVE_GSSAPI */
306
307 #ifdef HAVE_AUTHORIZATION_H
308 if (con->authref)
309 {
310 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
311 con->authref = NULL;
312 }
313 #endif /* HAVE_AUTHORIZATION_H */
314
315 if (!*authorization)
316 {
317 /*
318 * No authorization data provided, return early...
319 */
320
321 cupsdLogClient(con, CUPSD_LOG_DEBUG, "No authentication data provided.");
322 return;
323 }
324 #ifdef HAVE_AUTHORIZATION_H
325 else if (!strncmp(authorization, "AuthRef ", 8) &&
326 httpAddrLocalhost(httpGetAddress(con->http)))
327 {
328 OSStatus status; /* Status */
329 char authdata[HTTP_MAX_VALUE];
330 /* Nonce value from client */
331 int authlen; /* Auth string length */
332 AuthorizationItemSet *authinfo; /* Authorization item set */
333
334 /*
335 * Get the Authorization Services data...
336 */
337
338 authorization += 8;
339 while (isspace(*authorization & 255))
340 authorization ++;
341
342 authlen = sizeof(authdata);
343 httpDecode64_2(authdata, &authlen, authorization);
344
345 if (authlen != kAuthorizationExternalFormLength)
346 {
347 cupsdLogClient(con, CUPSD_LOG_ERROR, "External Authorization reference size is incorrect.");
348 return;
349 }
350
351 if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
352 {
353 cupsdLogClient(con, CUPSD_LOG_ERROR, "AuthorizationCreateFromExternalForm returned %d (%s)", (int)status, cssmErrorString(status));
354 return;
355 }
356
357 username[0] = '\0';
358
359 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
360 &authinfo))
361 {
362 if (authinfo->count == 1 && authinfo->items[0].value &&
363 authinfo->items[0].valueLength >= 2)
364 {
365 strlcpy(username, authinfo->items[0].value, sizeof(username));
366
367 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef.", username);
368 }
369
370 AuthorizationFreeItemSet(authinfo);
371 }
372
373 if (!username[0])
374 {
375 /*
376 * No username in AuthRef, grab username using peer credentials...
377 */
378
379 struct passwd *pwd; /* Password entry for this user */
380 cupsd_ucred_t peercred; /* Peer credentials */
381 socklen_t peersize; /* Size of peer credentials */
382
383 peersize = sizeof(peercred);
384
385 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
386 {
387 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
388 return;
389 }
390
391 if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
392 {
393 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred));
394 return;
395 }
396
397 strlcpy(username, pwd->pw_name, sizeof(username));
398
399 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef + PeerCred.", username);
400 }
401
402 con->type = CUPSD_AUTH_BASIC;
403 }
404 #endif /* HAVE_AUTHORIZATION_H */
405 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
406 else if (!strncmp(authorization, "PeerCred ", 9) &&
407 con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
408 {
409 /*
410 * Use peer credentials from domain socket connection...
411 */
412
413 struct passwd *pwd; /* Password entry for this user */
414 cupsd_ucred_t peercred; /* Peer credentials */
415 socklen_t peersize; /* Size of peer credentials */
416 #ifdef HAVE_AUTHORIZATION_H
417 const char *name; /* Authorizing name */
418 int no_peer = 0; /* Don't allow peer credentials? */
419
420 /*
421 * See if we should allow peer credentials...
422 */
423
424 for (name = (char *)cupsArrayFirst(con->best->names);
425 name;
426 name = (char *)cupsArrayNext(con->best->names))
427 {
428 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
429 !_cups_strcasecmp(name, "@SYSTEM"))
430 {
431 /* Normally don't want peer credentials if we need an auth key... */
432 no_peer = 1;
433 }
434 else if (!_cups_strcasecmp(name, "@OWNER"))
435 {
436 /* but if @OWNER is present then we allow it... */
437 no_peer = 0;
438 break;
439 }
440 }
441
442 if (no_peer)
443 {
444 cupsdLogClient(con, CUPSD_LOG_ERROR, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
445 return;
446 }
447 #endif /* HAVE_AUTHORIZATION_H */
448
449 if ((pwd = getpwnam(authorization + 9)) == NULL)
450 {
451 cupsdLogClient(con, CUPSD_LOG_ERROR, "User \"%s\" does not exist.", authorization + 9);
452 return;
453 }
454
455 peersize = sizeof(peercred);
456
457 # ifdef __APPLE__
458 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
459 # else
460 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
461 # endif /* __APPLE__ */
462 {
463 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
464 return;
465 }
466
467 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
468 {
469 cupsdLogClient(con, CUPSD_LOG_ERROR, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization + 9, CUPSD_UCRED_UID(peercred), pwd->pw_uid);
470 # ifdef HAVE_SYS_UCRED_H
471 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_version=%d", peercred.cr_version);
472 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_uid=%d", peercred.cr_uid);
473 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_ngroups=%d", peercred.cr_ngroups);
474 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_groups[0]=%d", peercred.cr_groups[0]);
475 # endif /* HAVE_SYS_UCRED_H */
476 return;
477 }
478
479 strlcpy(username, authorization + 9, sizeof(username));
480
481 # ifdef HAVE_GSSAPI
482 con->gss_uid = CUPSD_UCRED_UID(peercred);
483 # endif /* HAVE_GSSAPI */
484
485 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using PeerCred.", username);
486
487 con->type = CUPSD_AUTH_BASIC;
488 }
489 #endif /* SO_PEERCRED && AF_LOCAL */
490 else if (!strncmp(authorization, "Local", 5) &&
491 httpAddrLocalhost(httpGetAddress(con->http)))
492 {
493 /*
494 * Get Local certificate authentication data...
495 */
496
497 authorization += 5;
498 while (isspace(*authorization & 255))
499 authorization ++;
500
501 if ((localuser = cupsdFindCert(authorization)) == NULL)
502 {
503 cupsdLogClient(con, CUPSD_LOG_ERROR, "Local authentication certificate not found.");
504 return;
505 }
506
507 strlcpy(username, localuser->username, sizeof(username));
508 con->type = localuser->type;
509
510 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using Local.", username);
511 }
512 else if (!strncmp(authorization, "Basic", 5))
513 {
514 /*
515 * Get the Basic authentication data...
516 */
517
518 int userlen; /* Username:password length */
519
520
521 authorization += 5;
522 while (isspace(*authorization & 255))
523 authorization ++;
524
525 userlen = sizeof(username);
526 httpDecode64_2(username, &userlen, authorization);
527
528 /*
529 * Pull the username and password out...
530 */
531
532 if ((ptr = strchr(username, ':')) == NULL)
533 {
534 cupsdLogClient(con, CUPSD_LOG_ERROR, "Missing Basic password.");
535 return;
536 }
537
538 *ptr++ = '\0';
539
540 if (!username[0])
541 {
542 /*
543 * Username must not be empty...
544 */
545
546 cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic username.");
547 return;
548 }
549
550 if (!*ptr)
551 {
552 /*
553 * Password must not be empty...
554 */
555
556 cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic password.");
557 return;
558 }
559
560 strlcpy(password, ptr, sizeof(password));
561
562 /*
563 * Validate the username and password...
564 */
565
566 switch (type)
567 {
568 default :
569 case CUPSD_AUTH_BASIC :
570 {
571 #if HAVE_LIBPAM
572 /*
573 * Only use PAM to do authentication. This supports MD5
574 * passwords, among other things...
575 */
576
577 pam_handle_t *pamh; /* PAM authentication handle */
578 int pamerr; /* PAM error code */
579 struct pam_conv pamdata;/* PAM conversation data */
580 cupsd_authdata_t data; /* Authentication data */
581
582
583 strlcpy(data.username, username, sizeof(data.username));
584 strlcpy(data.password, password, sizeof(data.password));
585
586 # ifdef __sun
587 pamdata.conv = (int (*)(int, struct pam_message **,
588 struct pam_response **,
589 void *))pam_func;
590 # else
591 pamdata.conv = pam_func;
592 # endif /* __sun */
593 pamdata.appdata_ptr = &data;
594
595 pamerr = pam_start("cups", username, &pamdata, &pamh);
596 if (pamerr != PAM_SUCCESS)
597 {
598 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_start() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
599 return;
600 }
601
602 # ifdef HAVE_PAM_SET_ITEM
603 # ifdef PAM_RHOST
604 pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
605 if (pamerr != PAM_SUCCESS)
606 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
607 # endif /* PAM_RHOST */
608
609 # ifdef PAM_TTY
610 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
611 if (pamerr != PAM_SUCCESS)
612 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
613 # endif /* PAM_TTY */
614 # endif /* HAVE_PAM_SET_ITEM */
615
616 pamerr = pam_authenticate(pamh, PAM_SILENT);
617 if (pamerr != PAM_SUCCESS)
618 {
619 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_authenticate() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
620 pam_end(pamh, 0);
621 return;
622 }
623
624 # ifdef HAVE_PAM_SETCRED
625 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
626 if (pamerr != PAM_SUCCESS)
627 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_setcred() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
628 # endif /* HAVE_PAM_SETCRED */
629
630 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
631 if (pamerr != PAM_SUCCESS)
632 {
633 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_acct_mgmt() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
634 pam_end(pamh, 0);
635 return;
636 }
637
638 pam_end(pamh, PAM_SUCCESS);
639
640 #else
641 /*
642 * Use normal UNIX password file-based authentication...
643 */
644
645 char *pass; /* Encrypted password */
646 struct passwd *pw; /* User password data */
647 # ifdef HAVE_SHADOW_H
648 struct spwd *spw; /* Shadow password data */
649 # endif /* HAVE_SHADOW_H */
650
651
652 pw = getpwnam(username); /* Get the current password */
653 endpwent(); /* Close the password file */
654
655 if (!pw)
656 {
657 /*
658 * No such user...
659 */
660
661 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unknown username \"%s\".", username);
662 return;
663 }
664
665 # ifdef HAVE_SHADOW_H
666 spw = getspnam(username);
667 endspent();
668
669 if (!spw && !strcmp(pw->pw_passwd, "x"))
670 {
671 /*
672 * Don't allow blank passwords!
673 */
674
675 cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no shadow password.", username);
676 return;
677 }
678
679 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
680 # else
681 if (!pw->pw_passwd[0])
682 # endif /* HAVE_SHADOW_H */
683 {
684 /*
685 * Don't allow blank passwords!
686 */
687
688 cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no password.", username);
689 return;
690 }
691
692 /*
693 * OK, the password isn't blank, so compare with what came from the
694 * client...
695 */
696
697 pass = cups_crypt(password, pw->pw_passwd);
698
699 if (!pass || strcmp(pw->pw_passwd, pass))
700 {
701 # ifdef HAVE_SHADOW_H
702 if (spw)
703 {
704 pass = cups_crypt(password, spw->sp_pwdp);
705
706 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
707 {
708 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
709 return;
710 }
711 }
712 else
713 # endif /* HAVE_SHADOW_H */
714 {
715 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
716 return;
717 }
718 }
719 #endif /* HAVE_LIBPAM */
720 }
721
722 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
723 break;
724 }
725
726 con->type = type;
727 }
728 #ifdef HAVE_GSSAPI
729 else if (!strncmp(authorization, "Negotiate", 9))
730 {
731 int len; /* Length of authorization string */
732 gss_ctx_id_t context; /* Authorization context */
733 OM_uint32 major_status, /* Major status code */
734 minor_status; /* Minor status code */
735 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
736 /* Input token from string */
737 output_token = GSS_C_EMPTY_BUFFER;
738 /* Output token for username */
739 gss_name_t client_name; /* Client name */
740
741
742 # ifdef __APPLE__
743 /*
744 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
745 * to use it...
746 */
747
748 if (&gss_init_sec_context == NULL)
749 {
750 cupsdLogClient(con, CUPSD_LOG_WARN, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
751 return;
752 }
753 # endif /* __APPLE__ */
754
755 /*
756 * Find the start of the Kerberos input token...
757 */
758
759 authorization += 9;
760 while (isspace(*authorization & 255))
761 authorization ++;
762
763 if (!*authorization)
764 {
765 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "No authentication data specified.");
766 return;
767 }
768
769 /*
770 * Decode the authorization string to get the input token...
771 */
772
773 len = (int)strlen(authorization);
774 input_token.value = malloc((size_t)len);
775 input_token.value = httpDecode64_2(input_token.value, &len,
776 authorization);
777 input_token.length = (size_t)len;
778
779 /*
780 * Accept the input token to get the authorization info...
781 */
782
783 context = GSS_C_NO_CONTEXT;
784 client_name = GSS_C_NO_NAME;
785 major_status = gss_accept_sec_context(&minor_status,
786 &context,
787 ServerCreds,
788 &input_token,
789 GSS_C_NO_CHANNEL_BINDINGS,
790 &client_name,
791 NULL,
792 &output_token,
793 NULL,
794 NULL,
795 NULL);
796
797 if (output_token.length > 0)
798 gss_release_buffer(&minor_status, &output_token);
799
800 if (GSS_ERROR(major_status))
801 {
802 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error accepting GSSAPI security context.", con->number);
803
804 if (context != GSS_C_NO_CONTEXT)
805 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
806 return;
807 }
808
809 con->have_gss = 1;
810
811 /*
812 * Get the username associated with the client's credentials...
813 */
814
815 if (major_status == GSS_S_CONTINUE_NEEDED)
816 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Credentials not complete.", con->number);
817 else if (major_status == GSS_S_COMPLETE)
818 {
819 major_status = gss_display_name(&minor_status, client_name,
820 &output_token, NULL);
821
822 if (GSS_ERROR(major_status))
823 {
824 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error getting username.", con->number);
825 gss_release_name(&minor_status, &client_name);
826 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
827 return;
828 }
829
830 strlcpy(username, output_token.value, sizeof(username));
831
832 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Negotiate.", username);
833
834 gss_release_name(&minor_status, &client_name);
835 gss_release_buffer(&minor_status, &output_token);
836
837 con->type = CUPSD_AUTH_NEGOTIATE;
838 }
839
840 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
841
842 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
843 /*
844 * Get the client's UID if we are printing locally - that allows a backend
845 * to run as the correct user to get Kerberos credentials of its own.
846 */
847
848 if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
849 {
850 cupsd_ucred_t peercred; /* Peer credentials */
851 socklen_t peersize; /* Size of peer credentials */
852
853 peersize = sizeof(peercred);
854
855 # ifdef __APPLE__
856 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
857 # else
858 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
859 &peersize))
860 # endif /* __APPLE__ */
861 {
862 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
863 }
864 else
865 {
866 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred));
867 con->gss_uid = CUPSD_UCRED_UID(peercred);
868 }
869 }
870 # endif /* SO_PEERCRED && AF_LOCAL */
871 }
872 #endif /* HAVE_GSSAPI */
873 else
874 {
875 char scheme[256]; /* Auth scheme... */
876
877
878 if (sscanf(authorization, "%255s", scheme) != 1)
879 strlcpy(scheme, "UNKNOWN", sizeof(scheme));
880
881 cupsdLogClient(con, CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\".", scheme);
882 return;
883 }
884
885 /*
886 * If we get here, then we were able to validate the username and
887 * password - copy the validated username and password to the client
888 * data and return...
889 */
890
891 strlcpy(con->username, username, sizeof(con->username));
892 strlcpy(con->password, password, sizeof(con->password));
893 }
894
895
896 /*
897 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
898 * access a location.
899 */
900
901 int /* O - 1 if allowed, 0 otherwise */
902 cupsdCheckAccess(
903 unsigned ip[4], /* I - Client address */
904 const char *name, /* I - Client hostname */
905 size_t namelen, /* I - Length of hostname */
906 cupsd_location_t *loc) /* I - Location to check */
907 {
908 int allow; /* 1 if allowed, 0 otherwise */
909
910
911 if (!_cups_strcasecmp(name, "localhost"))
912 {
913 /*
914 * Access from localhost (127.0.0.1 or ::1) is always allowed...
915 */
916
917 return (1);
918 }
919 else
920 {
921 /*
922 * Do authorization checks on the domain/address...
923 */
924
925 switch (loc->order_type)
926 {
927 default :
928 allow = 0; /* anti-compiler-warning-code */
929 break;
930
931 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
932 allow = 1;
933
934 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
935 allow = 0;
936
937 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
938 allow = 1;
939 break;
940
941 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
942 allow = 0;
943
944 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
945 allow = 1;
946
947 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
948 allow = 0;
949 break;
950 }
951 }
952
953 return (allow);
954 }
955
956
957 /*
958 * 'cupsdCheckAuth()' - Check authorization masks.
959 */
960
961 int /* O - 1 if mask matches, 0 otherwise */
962 cupsdCheckAuth(unsigned ip[4], /* I - Client address */
963 const char *name, /* I - Client hostname */
964 size_t name_len, /* I - Length of hostname */
965 cups_array_t *masks) /* I - Masks */
966 {
967 int i; /* Looping var */
968 cupsd_authmask_t *mask; /* Current mask */
969 cupsd_netif_t *iface; /* Network interface */
970 unsigned netip4; /* IPv4 network address */
971 #ifdef AF_INET6
972 unsigned netip6[4]; /* IPv6 network address */
973 #endif /* AF_INET6 */
974
975
976 for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
977 mask;
978 mask = (cupsd_authmask_t *)cupsArrayNext(masks))
979 {
980 switch (mask->type)
981 {
982 case CUPSD_AUTH_INTERFACE :
983 /*
984 * Check for a match with a network interface...
985 */
986
987 netip4 = htonl(ip[3]);
988
989 #ifdef AF_INET6
990 netip6[0] = htonl(ip[0]);
991 netip6[1] = htonl(ip[1]);
992 netip6[2] = htonl(ip[2]);
993 netip6[3] = htonl(ip[3]);
994 #endif /* AF_INET6 */
995
996 cupsdNetIFUpdate();
997
998 if (!strcmp(mask->mask.name.name, "*"))
999 {
1000 #ifdef __APPLE__
1001 /*
1002 * Allow Back-to-My-Mac addresses...
1003 */
1004
1005 if ((ip[0] & 0xff000000) == 0xfd000000)
1006 return (1);
1007 #endif /* __APPLE__ */
1008
1009 /*
1010 * Check against all local interfaces...
1011 */
1012
1013 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1014 iface;
1015 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1016 {
1017 /*
1018 * Only check local interfaces...
1019 */
1020
1021 if (!iface->is_local)
1022 continue;
1023
1024 if (iface->address.addr.sa_family == AF_INET)
1025 {
1026 /*
1027 * Check IPv4 address...
1028 */
1029
1030 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1031 (iface->address.ipv4.sin_addr.s_addr &
1032 iface->mask.ipv4.sin_addr.s_addr))
1033 return (1);
1034 }
1035 #ifdef AF_INET6
1036 else
1037 {
1038 /*
1039 * Check IPv6 address...
1040 */
1041
1042 for (i = 0; i < 4; i ++)
1043 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1044 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1045 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1046 break;
1047
1048 if (i == 4)
1049 return (1);
1050 }
1051 #endif /* AF_INET6 */
1052 }
1053 }
1054 else
1055 {
1056 /*
1057 * Check the named interface...
1058 */
1059
1060 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1061 iface;
1062 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1063 {
1064 if (strcmp(mask->mask.name.name, iface->name))
1065 continue;
1066
1067 if (iface->address.addr.sa_family == AF_INET)
1068 {
1069 /*
1070 * Check IPv4 address...
1071 */
1072
1073 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1074 (iface->address.ipv4.sin_addr.s_addr &
1075 iface->mask.ipv4.sin_addr.s_addr))
1076 return (1);
1077 }
1078 #ifdef AF_INET6
1079 else
1080 {
1081 /*
1082 * Check IPv6 address...
1083 */
1084
1085 for (i = 0; i < 4; i ++)
1086 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1087 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1088 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1089 break;
1090
1091 if (i == 4)
1092 return (1);
1093 }
1094 #endif /* AF_INET6 */
1095 }
1096 }
1097 break;
1098
1099 case CUPSD_AUTH_NAME :
1100 /*
1101 * Check for exact name match...
1102 */
1103
1104 if (!_cups_strcasecmp(name, mask->mask.name.name))
1105 return (1);
1106
1107 /*
1108 * Check for domain match...
1109 */
1110
1111 if (name_len >= mask->mask.name.length &&
1112 mask->mask.name.name[0] == '.' &&
1113 !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1114 mask->mask.name.name))
1115 return (1);
1116 break;
1117
1118 case CUPSD_AUTH_IP :
1119 /*
1120 * Check for IP/network address match...
1121 */
1122
1123 for (i = 0; i < 4; i ++)
1124 if ((ip[i] & mask->mask.ip.netmask[i]) !=
1125 mask->mask.ip.address[i])
1126 break;
1127
1128 if (i == 4)
1129 return (1);
1130 break;
1131 }
1132 }
1133
1134 return (0);
1135 }
1136
1137
1138 /*
1139 * 'cupsdCheckGroup()' - Check for a user's group membership.
1140 */
1141
1142 int /* O - 1 if user is a member, 0 otherwise */
1143 cupsdCheckGroup(
1144 const char *username, /* I - User name */
1145 struct passwd *user, /* I - System user info */
1146 const char *groupname) /* I - Group name */
1147 {
1148 int i; /* Looping var */
1149 struct group *group; /* System group info */
1150 #ifdef HAVE_MBR_UID_TO_UUID
1151 uuid_t useruuid, /* UUID for username */
1152 groupuuid; /* UUID for groupname */
1153 int is_member; /* True if user is a member of group */
1154 #endif /* HAVE_MBR_UID_TO_UUID */
1155
1156
1157 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username, user, groupname);
1158
1159 /*
1160 * Validate input...
1161 */
1162
1163 if (!username || !groupname)
1164 return (0);
1165
1166 /*
1167 * Check to see if the user is a member of the named group...
1168 */
1169
1170 group = getgrnam(groupname);
1171 endgrent();
1172
1173 if (group != NULL)
1174 {
1175 /*
1176 * Group exists, check it...
1177 */
1178
1179 #ifdef HAVE_GETGROUPLIST
1180 if (user)
1181 {
1182 int ngroups; /* Number of groups */
1183 # ifdef __APPLE__
1184 int groups[2048]; /* Groups that user belongs to */
1185 # else
1186 gid_t groups[2048]; /* Groups that user belongs to */
1187 # endif /* __APPLE__ */
1188
1189 ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
1190 # ifdef __APPLE__
1191 getgrouplist(username, (int)user->pw_gid, groups, &ngroups);
1192 # else
1193 getgrouplist(username, user->pw_gid, groups, &ngroups);
1194 #endif /* __APPLE__ */
1195
1196 for (i = 0; i < ngroups; i ++)
1197 if ((int)group->gr_gid == (int)groups[i])
1198 return (1);
1199 }
1200 #endif /* HAVE_GETGROUPLIST */
1201
1202 for (i = 0; group->gr_mem[i]; i ++)
1203 if (!_cups_strcasecmp(username, group->gr_mem[i]))
1204 return (1);
1205 }
1206
1207 /*
1208 * Group doesn't exist or user not in group list, check the group ID
1209 * against the user's group ID...
1210 */
1211
1212 if (user && group && group->gr_gid == user->pw_gid)
1213 return (1);
1214
1215 #ifdef HAVE_MBR_UID_TO_UUID
1216 /*
1217 * Check group membership through macOS membership API...
1218 */
1219
1220 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1221 {
1222 if (group)
1223 {
1224 /*
1225 * Map group name to UUID and check membership...
1226 */
1227
1228 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1229 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1230 if (is_member)
1231 return (1);
1232 }
1233 else if (groupname[0] == '#')
1234 {
1235 /*
1236 * Use UUID directly and check for equality (user UUID) and
1237 * membership (group UUID)...
1238 */
1239
1240 if (!uuid_parse((char *)groupname + 1, groupuuid))
1241 {
1242 if (!uuid_compare(useruuid, groupuuid))
1243 return (1);
1244 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1245 if (is_member)
1246 return (1);
1247 }
1248
1249 return (0);
1250 }
1251 }
1252 else if (groupname[0] == '#')
1253 return (0);
1254 #endif /* HAVE_MBR_UID_TO_UUID */
1255
1256 /*
1257 * If we get this far, then the user isn't part of the named group...
1258 */
1259
1260 return (0);
1261 }
1262
1263
1264 /*
1265 * 'cupsdCopyLocation()' - Make a copy of a location...
1266 */
1267
1268 cupsd_location_t * /* O - New location */
1269 cupsdCopyLocation(
1270 cupsd_location_t *loc) /* I - Original location */
1271 {
1272 cupsd_location_t *temp; /* New location */
1273
1274
1275 /*
1276 * Make a copy of the original location...
1277 */
1278
1279 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1280 return (NULL);
1281
1282 /*
1283 * Copy the information from the original location to the new one.
1284 */
1285
1286 if (!loc)
1287 return (temp);
1288
1289 if (loc->location)
1290 temp->location = _cupsStrAlloc(loc->location);
1291
1292 temp->length = loc->length;
1293 temp->limit = loc->limit;
1294 temp->order_type = loc->order_type;
1295 temp->type = loc->type;
1296 temp->level = loc->level;
1297 temp->satisfy = loc->satisfy;
1298 temp->encryption = loc->encryption;
1299
1300 if (loc->names)
1301 {
1302 if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1303 {
1304 cupsdLogMessage(CUPSD_LOG_ERROR,
1305 "Unable to allocate memory for %d names: %s",
1306 cupsArrayCount(loc->names), strerror(errno));
1307
1308 cupsdFreeLocation(temp);
1309 return (NULL);
1310 }
1311 }
1312
1313 if (loc->allow)
1314 {
1315 /*
1316 * Copy allow rules...
1317 */
1318
1319 if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1320 {
1321 cupsdLogMessage(CUPSD_LOG_ERROR,
1322 "Unable to allocate memory for %d allow rules: %s",
1323 cupsArrayCount(loc->allow), strerror(errno));
1324 cupsdFreeLocation(temp);
1325 return (NULL);
1326 }
1327 }
1328
1329 if (loc->deny)
1330 {
1331 /*
1332 * Copy deny rules...
1333 */
1334
1335 if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1336 {
1337 cupsdLogMessage(CUPSD_LOG_ERROR,
1338 "Unable to allocate memory for %d deny rules: %s",
1339 cupsArrayCount(loc->deny), strerror(errno));
1340 cupsdFreeLocation(temp);
1341 return (NULL);
1342 }
1343 }
1344
1345 return (temp);
1346 }
1347
1348
1349 /*
1350 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1351 */
1352
1353 void
1354 cupsdDeleteAllLocations(void)
1355 {
1356 /*
1357 * Free the location array, which will free all of the locations...
1358 */
1359
1360 cupsArrayDelete(Locations);
1361 Locations = NULL;
1362 }
1363
1364
1365 /*
1366 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1367 */
1368
1369 cupsd_location_t * /* O - Location that matches */
1370 cupsdFindBest(const char *path, /* I - Resource path */
1371 http_state_t state) /* I - HTTP state/request */
1372 {
1373 char uri[HTTP_MAX_URI],
1374 /* URI in request... */
1375 *uriptr; /* Pointer into URI */
1376 cupsd_location_t *loc, /* Current location */
1377 *best; /* Best match for location so far */
1378 size_t bestlen; /* Length of best match */
1379 int limit; /* Limit field */
1380 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1381 {
1382 CUPSD_AUTH_LIMIT_ALL,
1383 CUPSD_AUTH_LIMIT_OPTIONS,
1384 CUPSD_AUTH_LIMIT_GET,
1385 CUPSD_AUTH_LIMIT_GET,
1386 CUPSD_AUTH_LIMIT_HEAD,
1387 CUPSD_AUTH_LIMIT_POST,
1388 CUPSD_AUTH_LIMIT_POST,
1389 CUPSD_AUTH_LIMIT_POST,
1390 CUPSD_AUTH_LIMIT_PUT,
1391 CUPSD_AUTH_LIMIT_PUT,
1392 CUPSD_AUTH_LIMIT_DELETE,
1393 CUPSD_AUTH_LIMIT_TRACE,
1394 CUPSD_AUTH_LIMIT_ALL,
1395 CUPSD_AUTH_LIMIT_ALL,
1396 CUPSD_AUTH_LIMIT_ALL,
1397 CUPSD_AUTH_LIMIT_ALL
1398 };
1399
1400
1401 /*
1402 * First copy the connection URI to a local string so we have drop
1403 * any .ppd extension from the pathname in /printers or /classes
1404 * URIs...
1405 */
1406
1407 strlcpy(uri, path, sizeof(uri));
1408
1409 if ((uriptr = strchr(uri, '?')) != NULL)
1410 *uriptr = '\0'; /* Drop trailing query string */
1411
1412 if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1413 *uriptr = '\0'; /* Remove trailing '/' */
1414
1415 if (!strncmp(uri, "/printers/", 10) ||
1416 !strncmp(uri, "/classes/", 9))
1417 {
1418 /*
1419 * Check if the URI has .ppd on the end...
1420 */
1421
1422 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1423
1424 if (!strcmp(uriptr, ".ppd"))
1425 *uriptr = '\0';
1426 }
1427
1428 /*
1429 * Loop through the list of locations to find a match...
1430 */
1431
1432 limit = limits[state];
1433 best = NULL;
1434 bestlen = 0;
1435
1436 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri=\"%s\", limit=%x...", uri, limit);
1437
1438
1439 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1440 loc;
1441 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1442 {
1443 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1444
1445 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1446 {
1447 /*
1448 * Use case-insensitive comparison for queue names...
1449 */
1450
1451 if (loc->length > bestlen && loc->location &&
1452 !_cups_strncasecmp(uri, loc->location, loc->length) &&
1453 loc->location[0] == '/' &&
1454 (limit & loc->limit) != 0)
1455 {
1456 best = loc;
1457 bestlen = loc->length;
1458 }
1459 }
1460 else
1461 {
1462 /*
1463 * Use case-sensitive comparison for other URIs...
1464 */
1465
1466 if (loc->length > bestlen && loc->location &&
1467 !strncmp(uri, loc->location, loc->length) &&
1468 loc->location[0] == '/' &&
1469 (limit & loc->limit) != 0)
1470 {
1471 best = loc;
1472 bestlen = loc->length;
1473 }
1474 }
1475 }
1476
1477 /*
1478 * Return the match, if any...
1479 */
1480
1481 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best=%s", best ? best->location : "NONE");
1482
1483 return (best);
1484 }
1485
1486
1487 /*
1488 * 'cupsdFindLocation()' - Find the named location.
1489 */
1490
1491 cupsd_location_t * /* O - Location that matches */
1492 cupsdFindLocation(const char *location) /* I - Connection */
1493 {
1494 cupsd_location_t key; /* Search key */
1495
1496
1497 key.location = (char *)location;
1498
1499 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1500 }
1501
1502
1503 /*
1504 * 'cupsdFreeLocation()' - Free all memory used by a location.
1505 */
1506
1507 void
1508 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1509 {
1510 cupsArrayDelete(loc->names);
1511 cupsArrayDelete(loc->allow);
1512 cupsArrayDelete(loc->deny);
1513
1514 _cupsStrFree(loc->location);
1515 free(loc);
1516 }
1517
1518
1519 /*
1520 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1521 */
1522
1523 http_status_t /* O - HTTP_OK if authorized or error code */
1524 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1525 const char *owner)/* I - Owner of object */
1526 {
1527 int i, /* Looping vars */
1528 auth, /* Authorization status */
1529 type; /* Type of authentication */
1530 http_addr_t *hostaddr = httpGetAddress(con->http);
1531 /* Client address */
1532 const char *hostname = httpGetHostname(con->http, NULL, 0);
1533 /* Client hostname */
1534 unsigned address[4]; /* Authorization address */
1535 cupsd_location_t *best; /* Best match for location so far */
1536 size_t hostlen; /* Length of hostname */
1537 char *name, /* Current username */
1538 username[256], /* Username to authorize */
1539 ownername[256], /* Owner name to authorize */
1540 *ptr; /* Pointer into username */
1541 struct passwd *pw; /* User password data */
1542 static const char * const levels[] = /* Auth levels */
1543 {
1544 "ANON",
1545 "USER",
1546 "GROUP"
1547 };
1548 static const char * const types[] = /* Auth types */
1549 {
1550 "None",
1551 "Basic",
1552 "Negotiate"
1553 };
1554
1555
1556 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location ? con->best->location : "(null)" : "");
1557 if (owner)
1558 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: owner=\"%s\"", owner);
1559
1560 /*
1561 * If there is no "best" authentication rule for this request, then
1562 * access is allowed from the local system and denied from other
1563 * addresses...
1564 */
1565
1566 if (!con->best)
1567 {
1568 if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1569 !strcmp(hostname, ServerName) ||
1570 cupsArrayFind(ServerAlias, (void *)hostname))
1571 return (HTTP_OK);
1572 else
1573 return (HTTP_FORBIDDEN);
1574 }
1575
1576 best = con->best;
1577
1578 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1579 type = cupsdDefaultAuthType();
1580
1581 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels[best->level], types[type], best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1582
1583 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1584 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)", best->op, ippOpString(best->op));
1585
1586 /*
1587 * Check host/ip-based accesses...
1588 */
1589
1590 #ifdef AF_INET6
1591 if (httpAddrFamily(hostaddr) == AF_INET6)
1592 {
1593 /*
1594 * Copy IPv6 address...
1595 */
1596
1597 address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1598 address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1599 address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1600 address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1601 }
1602 else
1603 #endif /* AF_INET6 */
1604 if (con->http->hostaddr->addr.sa_family == AF_INET)
1605 {
1606 /*
1607 * Copy IPv4 address...
1608 */
1609
1610 address[0] = 0;
1611 address[1] = 0;
1612 address[2] = 0;
1613 address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1614 }
1615 else
1616 memset(address, 0, sizeof(address));
1617
1618 hostlen = strlen(hostname);
1619
1620 auth = cupsdCheckAccess(address, hostname, hostlen, best)
1621 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1622
1623 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth ? "DENY" : "ALLOW");
1624
1625 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1626 return (HTTP_FORBIDDEN);
1627
1628 #ifdef HAVE_SSL
1629 /*
1630 * See if encryption is required...
1631 */
1632
1633 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1634 _cups_strcasecmp(hostname, "localhost") &&
1635 !httpAddrLocalhost(hostaddr) &&
1636 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1637 !(type == CUPSD_AUTH_NEGOTIATE ||
1638 (type == CUPSD_AUTH_NONE &&
1639 cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1640 {
1641 cupsdLogMessage(CUPSD_LOG_DEBUG,
1642 "cupsdIsAuthorized: Need upgrade to TLS...");
1643 return (HTTP_UPGRADE_REQUIRED);
1644 }
1645 #endif /* HAVE_SSL */
1646
1647 /*
1648 * Now see what access level is required...
1649 */
1650
1651 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1652 (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1653 return (HTTP_OK);
1654
1655 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1656 best->limit == CUPSD_AUTH_LIMIT_IPP)
1657 {
1658 /*
1659 * Check for unauthenticated username...
1660 */
1661
1662 ipp_attribute_t *attr; /* requesting-user-name attribute */
1663
1664
1665 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1666 if (attr)
1667 {
1668 cupsdLogMessage(CUPSD_LOG_DEBUG,
1669 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1670 attr->values[0].string.text);
1671 strlcpy(username, attr->values[0].string.text, sizeof(username));
1672 }
1673 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1674 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1675 else
1676 return (HTTP_OK); /* unless overridden with Satisfy */
1677 }
1678 else
1679 {
1680 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1681 con->username);
1682
1683 #ifdef HAVE_AUTHORIZATION_H
1684 if (!con->username[0] && !con->authref)
1685 #else
1686 if (!con->username[0])
1687 #endif /* HAVE_AUTHORIZATION_H */
1688 {
1689 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1690 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1691 else
1692 return (HTTP_OK); /* unless overridden with Satisfy */
1693 }
1694
1695
1696 if (con->type != type && type != CUPSD_AUTH_NONE &&
1697 #ifdef HAVE_GSSAPI
1698 (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1699 #endif /* HAVE_GSSAPI */
1700 con->type != CUPSD_AUTH_BASIC)
1701 {
1702 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1703 types[con->type], types[type]);
1704
1705 return (HTTP_UNAUTHORIZED);
1706 }
1707
1708 strlcpy(username, con->username, sizeof(username));
1709 }
1710
1711 /*
1712 * OK, got a username. See if we need normal user access, or group
1713 * access... (root always matches)
1714 */
1715
1716 if (!strcmp(username, "root"))
1717 return (HTTP_OK);
1718
1719 /*
1720 * Strip any @domain or @KDC from the username and owner...
1721 */
1722
1723 if ((ptr = strchr(username, '@')) != NULL)
1724 *ptr = '\0';
1725
1726 if (owner)
1727 {
1728 strlcpy(ownername, owner, sizeof(ownername));
1729
1730 if ((ptr = strchr(ownername, '@')) != NULL)
1731 *ptr = '\0';
1732 }
1733 else
1734 ownername[0] = '\0';
1735
1736 /*
1737 * Get the user info...
1738 */
1739
1740 if (username[0])
1741 {
1742 pw = getpwnam(username);
1743 endpwent();
1744 }
1745 else
1746 pw = NULL;
1747
1748 if (best->level == CUPSD_AUTH_USER)
1749 {
1750 /*
1751 * If there are no names associated with this location, then
1752 * any valid user is OK...
1753 */
1754
1755 if (cupsArrayCount(best->names) == 0)
1756 return (HTTP_OK);
1757
1758 /*
1759 * Otherwise check the user list and return OK if this user is
1760 * allowed...
1761 */
1762
1763 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking user membership...");
1764
1765 #ifdef HAVE_AUTHORIZATION_H
1766 /*
1767 * If an authorization reference was supplied it must match a right name...
1768 */
1769
1770 if (con->authref)
1771 {
1772 for (name = (char *)cupsArrayFirst(best->names);
1773 name;
1774 name = (char *)cupsArrayNext(best->names))
1775 {
1776 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1777 return (HTTP_OK);
1778 else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1779 check_authref(con, SystemGroupAuthKey))
1780 return (HTTP_OK);
1781 }
1782
1783 return (HTTP_FORBIDDEN);
1784 }
1785 #endif /* HAVE_AUTHORIZATION_H */
1786
1787 for (name = (char *)cupsArrayFirst(best->names);
1788 name;
1789 name = (char *)cupsArrayNext(best->names))
1790 {
1791 if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1792 !_cups_strcasecmp(username, ownername))
1793 return (HTTP_OK);
1794 else if (!_cups_strcasecmp(name, "@SYSTEM"))
1795 {
1796 for (i = 0; i < NumSystemGroups; i ++)
1797 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1798 return (HTTP_OK);
1799 }
1800 else if (name[0] == '@')
1801 {
1802 if (cupsdCheckGroup(username, pw, name + 1))
1803 return (HTTP_OK);
1804 }
1805 else if (!_cups_strcasecmp(username, name))
1806 return (HTTP_OK);
1807 }
1808
1809 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1810 }
1811
1812 /*
1813 * Check to see if this user is in any of the named groups...
1814 */
1815
1816 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group membership...");
1817
1818 /*
1819 * Check to see if this user is in any of the named groups...
1820 */
1821
1822 for (name = (char *)cupsArrayFirst(best->names);
1823 name;
1824 name = (char *)cupsArrayNext(best->names))
1825 {
1826 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1827
1828 if (!_cups_strcasecmp(name, "@SYSTEM"))
1829 {
1830 for (i = 0; i < NumSystemGroups; i ++)
1831 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1832 return (HTTP_OK);
1833 }
1834 else if (cupsdCheckGroup(username, pw, name))
1835 return (HTTP_OK);
1836 }
1837
1838 /*
1839 * The user isn't part of the specified group, so deny access...
1840 */
1841
1842 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: User not in group(s).");
1843
1844 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1845 }
1846
1847
1848 /*
1849 * 'cupsdNewLocation()' - Create a new location for authorization.
1850 *
1851 * Note: Still need to call cupsdAddLocation() to add it to the list of global
1852 * locations.
1853 */
1854
1855 cupsd_location_t * /* O - Pointer to new location record */
1856 cupsdNewLocation(const char *location) /* I - Location path */
1857 {
1858 cupsd_location_t *temp; /* New location */
1859
1860
1861 /*
1862 * Try to allocate memory for the new location.
1863 */
1864
1865 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1866 return (NULL);
1867
1868 /*
1869 * Initialize the record and copy the name over...
1870 */
1871
1872 if ((temp->location = _cupsStrAlloc(location)) == NULL)
1873 {
1874 free(temp);
1875 return (NULL);
1876 }
1877
1878 temp->length = strlen(temp->location);
1879
1880 /*
1881 * Return the new record...
1882 */
1883
1884 return (temp);
1885 }
1886
1887
1888 #ifdef HAVE_AUTHORIZATION_H
1889 /*
1890 * 'check_authref()' - Check if an authorization services reference has the
1891 * supplied right.
1892 */
1893
1894 static int /* O - 1 if right is valid, 0 otherwise */
1895 check_authref(cupsd_client_t *con, /* I - Connection */
1896 const char *right) /* I - Right name */
1897 {
1898 OSStatus status; /* OS Status */
1899 AuthorizationItem authright; /* Authorization right */
1900 AuthorizationRights authrights; /* Authorization rights */
1901 AuthorizationFlags authflags; /* Authorization flags */
1902
1903
1904 /*
1905 * Check to see if the user is allowed to perform the task...
1906 */
1907
1908 if (!con->authref)
1909 return (0);
1910
1911 authright.name = right;
1912 authright.valueLength = 0;
1913 authright.value = NULL;
1914 authright.flags = 0;
1915
1916 authrights.count = 1;
1917 authrights.items = &authright;
1918
1919 authflags = kAuthorizationFlagDefaults |
1920 kAuthorizationFlagExtendRights;
1921
1922 if ((status = AuthorizationCopyRights(con->authref, &authrights,
1923 kAuthorizationEmptyEnvironment,
1924 authflags, NULL)) != 0)
1925 {
1926 cupsdLogMessage(CUPSD_LOG_ERROR,
1927 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
1928 authright.name, (int)status, cssmErrorString(status));
1929 return (0);
1930 }
1931
1932 cupsdLogMessage(CUPSD_LOG_DEBUG2, "AuthorizationCopyRights(\"%s\") succeeded.", authright.name);
1933
1934 return (1);
1935 }
1936 #endif /* HAVE_AUTHORIZATION_H */
1937
1938
1939 /*
1940 * 'compare_locations()' - Compare two locations.
1941 */
1942
1943 static int /* O - Result of comparison */
1944 compare_locations(cupsd_location_t *a, /* I - First location */
1945 cupsd_location_t *b) /* I - Second location */
1946 {
1947 return (strcmp(b->location, a->location));
1948 }
1949
1950
1951 /*
1952 * 'copy_authmask()' - Copy function for auth masks.
1953 */
1954
1955 static cupsd_authmask_t * /* O - New auth mask */
1956 copy_authmask(cupsd_authmask_t *mask, /* I - Existing auth mask */
1957 void *data) /* I - User data (unused) */
1958 {
1959 cupsd_authmask_t *temp; /* New auth mask */
1960
1961
1962 (void)data;
1963
1964 if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
1965 {
1966 memcpy(temp, mask, sizeof(cupsd_authmask_t));
1967
1968 if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
1969 {
1970 /*
1971 * Make a copy of the name...
1972 */
1973
1974 if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
1975 {
1976 /*
1977 * Failed to make copy...
1978 */
1979
1980 free(temp);
1981 temp = NULL;
1982 }
1983 }
1984 }
1985
1986 return (temp);
1987 }
1988
1989
1990 #if !HAVE_LIBPAM
1991 /*
1992 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1993 * as needed.
1994 */
1995
1996 static char * /* O - Encrypted password */
1997 cups_crypt(const char *pw, /* I - Password string */
1998 const char *salt) /* I - Salt (key) string */
1999 {
2000 if (!strncmp(salt, "$1$", 3))
2001 {
2002 /*
2003 * Use MD5 passwords without the benefit of PAM; this is for
2004 * Slackware Linux, and the algorithm was taken from the
2005 * old shadow-19990827/lib/md5crypt.c source code... :(
2006 */
2007
2008 int i; /* Looping var */
2009 unsigned long n; /* Output number */
2010 int pwlen; /* Length of password string */
2011 const char *salt_end; /* End of "salt" data for MD5 */
2012 char *ptr; /* Pointer into result string */
2013 _cups_md5_state_t state; /* Primary MD5 state info */
2014 _cups_md5_state_t state2; /* Secondary MD5 state info */
2015 unsigned char digest[16]; /* MD5 digest result */
2016 static char result[120]; /* Final password string */
2017
2018
2019 /*
2020 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2021 * Get a maximum of 8 characters of salt data after $1$...
2022 */
2023
2024 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2025 if (*salt_end == '$')
2026 break;
2027
2028 /*
2029 * Compute the MD5 sum we need...
2030 */
2031
2032 pwlen = strlen(pw);
2033
2034 _cupsMD5Init(&state);
2035 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2036 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2037
2038 _cupsMD5Init(&state2);
2039 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2040 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2041 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2042 _cupsMD5Finish(&state2, digest);
2043
2044 for (i = pwlen; i > 0; i -= 16)
2045 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2046
2047 for (i = pwlen; i > 0; i >>= 1)
2048 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2049
2050 _cupsMD5Finish(&state, digest);
2051
2052 for (i = 0; i < 1000; i ++)
2053 {
2054 _cupsMD5Init(&state);
2055
2056 if (i & 1)
2057 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2058 else
2059 _cupsMD5Append(&state, digest, 16);
2060
2061 if (i % 3)
2062 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2063
2064 if (i % 7)
2065 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2066
2067 if (i & 1)
2068 _cupsMD5Append(&state, digest, 16);
2069 else
2070 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2071
2072 _cupsMD5Finish(&state, digest);
2073 }
2074
2075 /*
2076 * Copy the final sum to the result string and return...
2077 */
2078
2079 memcpy(result, salt, (size_t)(salt_end - salt));
2080 ptr = result + (salt_end - salt);
2081 *ptr++ = '$';
2082
2083 for (i = 0; i < 5; i ++, ptr += 4)
2084 {
2085 n = ((((unsigned)digest[i] << 8) | (unsigned)digest[i + 6]) << 8);
2086
2087 if (i < 4)
2088 n |= (unsigned)digest[i + 12];
2089 else
2090 n |= (unsigned)digest[5];
2091
2092 to64(ptr, n, 4);
2093 }
2094
2095 to64(ptr, (unsigned)digest[11], 2);
2096 ptr += 2;
2097 *ptr = '\0';
2098
2099 return (result);
2100 }
2101 else
2102 {
2103 /*
2104 * Use the standard crypt() function...
2105 */
2106
2107 return (crypt(pw, salt));
2108 }
2109 }
2110 #endif /* !HAVE_LIBPAM */
2111
2112
2113 /*
2114 * 'free_authmask()' - Free function for auth masks.
2115 */
2116
2117 static void
2118 free_authmask(cupsd_authmask_t *mask, /* I - Auth mask to free */
2119 void *data) /* I - User data (unused) */
2120 {
2121 (void)data;
2122
2123 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2124 _cupsStrFree(mask->mask.name.name);
2125
2126 free(mask);
2127 }
2128
2129
2130 #if HAVE_LIBPAM
2131 /*
2132 * 'pam_func()' - PAM conversation function.
2133 */
2134
2135 static int /* O - Success or failure */
2136 pam_func(
2137 int num_msg, /* I - Number of messages */
2138 const struct pam_message **msg, /* I - Messages */
2139 struct pam_response **resp, /* O - Responses */
2140 void *appdata_ptr)
2141 /* I - Pointer to connection */
2142 {
2143 int i; /* Looping var */
2144 struct pam_response *replies; /* Replies */
2145 cupsd_authdata_t *data; /* Pointer to auth data */
2146
2147
2148 /*
2149 * Allocate memory for the responses...
2150 */
2151
2152 if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2153 return (PAM_CONV_ERR);
2154
2155 /*
2156 * Answer all of the messages...
2157 */
2158
2159 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2160
2161 data = (cupsd_authdata_t *)appdata_ptr;
2162
2163 for (i = 0; i < num_msg; i ++)
2164 {
2165 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2166
2167 switch (msg[i]->msg_style)
2168 {
2169 case PAM_PROMPT_ECHO_ON:
2170 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2171 data->username));
2172 replies[i].resp_retcode = PAM_SUCCESS;
2173 replies[i].resp = strdup(data->username);
2174 break;
2175
2176 case PAM_PROMPT_ECHO_OFF:
2177 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2178 data->password));
2179 replies[i].resp_retcode = PAM_SUCCESS;
2180 replies[i].resp = strdup(data->password);
2181 break;
2182
2183 case PAM_TEXT_INFO:
2184 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2185 replies[i].resp_retcode = PAM_SUCCESS;
2186 replies[i].resp = NULL;
2187 break;
2188
2189 case PAM_ERROR_MSG:
2190 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2191 replies[i].resp_retcode = PAM_SUCCESS;
2192 replies[i].resp = NULL;
2193 break;
2194
2195 default:
2196 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2197 msg[i]->msg_style));
2198 free(replies);
2199 return (PAM_CONV_ERR);
2200 }
2201 }
2202
2203 /*
2204 * Return the responses back to PAM...
2205 */
2206
2207 *resp = replies;
2208
2209 return (PAM_SUCCESS);
2210 }
2211 #else
2212
2213
2214 /*
2215 * 'to64()' - Base64-encode an integer value...
2216 */
2217
2218 static void
2219 to64(char *s, /* O - Output string */
2220 unsigned long v, /* I - Value to encode */
2221 int n) /* I - Number of digits */
2222 {
2223 const char *itoa64 = "./0123456789"
2224 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2225 "abcdefghijklmnopqrstuvwxyz";
2226
2227
2228 for (; n > 0; n --, v >>= 6)
2229 *s++ = itoa64[v & 0x3f];
2230 }
2231 #endif /* HAVE_LIBPAM */
Unnamed repository; edit this file 'description' to name the repository.