scheduler/auth.c

   1 /*
   2  * "$Id: auth.c 5222 2006-03-03 18:57:56Z mike $"
   3  *
   4  *   Authorization routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
   7  *
   8  *   These coded instructions, statements, and computer programs are the
   9  *   property of Easy Software Products and are protected by Federal
  10  *   copyright law.  Distribution and use rights are outlined in the file
  11  *   "LICENSE.txt" which should have been included with this file.  If this
  12  *   file is missing or damaged please contact Easy Software Products
  13  *   at:
  14  *
  15  *       Attn: CUPS Licensing Information
  16  *       Easy Software Products
  17  *       44141 Airport View Drive, Suite 204
  18  *       Hollywood, Maryland 20636 USA
  19  *
  20  *       Voice: (301) 373-9600
  21  *       EMail: cups-info@cups.org
  22  *         WWW: http://www.cups.org
  23  *
  24  * Contents:
  25  *
  26  *   cupsdAddLocation()        - Add a location for authorization.
  27  *   cupsdAddName()            - Add a name to a location...
  28  *   cupsdAllowHost()          - Add a host name that is allowed to access the
  29  *                               location.
  30  *   cupsdAllowIP()            - Add an IP address or network that is allowed to
  31  *                               access the location.
  32  *   cupsdCheckAuth()          - Check authorization masks.
  33  *   cupsdCheckGroup()         - Check for a user's group membership.
  34  *   cupsdCopyLocation()       - Make a copy of a location...
  35  *   cupsdDeleteAllLocations() - Free all memory used for location authorization.
  36  *   cupsdDeleteLocation()     - Free all memory used by a location.
  37  *   cupsdDenyHost()           - Add a host name that is not allowed to access the
  38  *                               location.
  39  *   cupsdDenyIP()             - Add an IP address or network that is not allowed
  40  *                               to access the location.
  41  *   cupsdFindBest()           - Find the location entry that best matches the
  42  *                               resource.
  43  *   cupsdFindLocation()       - Find the named location.
  44  *   cupsdGetMD5Passwd()       - Get an MD5 password.
  45  *   cupsdIsAuthorized()       - Check to see if the user is authorized...
  46  *   add_allow()               - Add an allow mask to the location.
  47  *   add_deny()                - Add a deny mask to the location.
  48  *   compare_locations()       - Compare two locations.
  49  *   cups_crypt()              - Encrypt the password using the DES or MD5
  50  *                               algorithms, as needed.
  51  *   pam_func()                - PAM conversation function.
  52  *   to64()                    - Base64-encode an integer value...
  53  */
  54
  55 /*
  56  * Include necessary headers...
  57  */
  58
  59 #include "cupsd.h"
  60 #include <grp.h>
  61 #ifdef HAVE_SHADOW_H
  62 #  include <shadow.h>
  63 #endif /* HAVE_SHADOW_H */
  64 #ifdef HAVE_CRYPT_H
  65 #  include <crypt.h>
  66 #endif /* HAVE_CRYPT_H */
  67 #if HAVE_LIBPAM
  68 #  ifdef HAVE_PAM_PAM_APPL_H
  69 #    include <pam/pam_appl.h>
  70 #  else
  71 #    include <security/pam_appl.h>
  72 #  endif /* HAVE_PAM_PAM_APPL_H */
  73 #endif /* HAVE_LIBPAM */
  74 #ifdef HAVE_USERSEC_H
  75 #  include <usersec.h>
  76 #endif /* HAVE_USERSEC_H */
  77 #ifdef HAVE_MEMBERSHIP_H
  78 #  include <membership.h>
  79 #endif /* HAVE_MEMBERSHIP_H */
  80
  81
  82 /*
  83  * Local functions...
  84  */
  85
  86 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
  87 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
  88 static int              compare_locations(cupsd_location_t *a,
  89                                           cupsd_location_t *b);
  90 #if !HAVE_LIBPAM
  91 static char             *cups_crypt(const char *pw, const char *salt);
  92 #endif /* !HAVE_LIBPAM */
  93 #if HAVE_LIBPAM
  94 static int              pam_func(int, const struct pam_message **,
  95                                  struct pam_response **, void *);
  96 #else
  97 static void             to64(char *s, unsigned long v, int n);
  98 #endif /* HAVE_LIBPAM */
  99
 100
 101 /*
 102  * Local structures...
 103  */
 104
 105 #if HAVE_LIBPAM
 106 typedef struct cupsd_authdata_s         /**** Authentication data ****/
 107 {
 108   char  username[33],                   /* Username string */
 109         password[33];                   /* Password string */
 110 } cupsd_authdata_t;
 111 #endif /* HAVE_LIBPAM */
 112
 113
 114 /*
 115  * Local globals...
 116  */
 117
 118 #if defined(__hpux) && defined(HAVE_LIBPAM)
 119 static cupsd_authdata_t *auth_data;     /* Current client being authenticated */
 120 #endif /* __hpux && HAVE_LIBPAM */
 121
 122
 123 /*
 124  * 'cupsdAddLocation()' - Add a location for authorization.
 125  */
 126
 127 cupsd_location_t *                      /* O - Pointer to new location record */
 128 cupsdAddLocation(const char *location)  /* I - Location path */
 129 {
 130   cupsd_location_t      *temp;          /* New location */
 131
 132
 133  /*
 134   * Make sure the locations array is created...
 135   */
 136
 137   if (!Locations)
 138     Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
 139
 140   if (!Locations)
 141     return (NULL);
 142
 143  /*
 144   * Try to allocate memory for the new location.
 145   */
 146
 147   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
 148     return (NULL);
 149
 150  /*
 151   * Initialize the record and copy the name over...
 152   */
 153
 154   temp->location = strdup(location);
 155   temp->length   = strlen(temp->location);
 156
 157   cupsArrayAdd(Locations, temp);
 158
 159   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
 160                   location);
 161
 162  /*
 163   * Return the new record...
 164   */
 165
 166   return (temp);
 167 }
 168
 169
 170 /*
 171  * 'cupsdAddName()' - Add a name to a location...
 172  */
 173
 174 void
 175 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 176              char             *name)    /* I - Name to add */
 177 {
 178   char  **temp;                         /* Pointer to names array */
 179
 180
 181   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
 182                   loc, name);
 183
 184   if (loc->num_names == 0)
 185     temp = malloc(sizeof(char *));
 186   else
 187     temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
 188
 189   if (temp == NULL)
 190   {
 191     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
 192                     loc->location, strerror(errno));
 193     return;
 194   }
 195
 196   loc->names = temp;
 197
 198   if ((temp[loc->num_names] = strdup(name)) == NULL)
 199   {
 200     cupsdLogMessage(CUPSD_LOG_ERROR,
 201                     "Unable to duplicate name for location %s: %s",
 202                     loc->location, strerror(errno));
 203     return;
 204   }
 205
 206   loc->num_names ++;
 207 }
 208
 209
 210 /*
 211  * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
 212  */
 213
 214 void
 215 cupsdAllowHost(cupsd_location_t *loc,   /* I - Location to add to */
 216                char             *name)  /* I - Name of host or domain to add */
 217 {
 218   cupsd_authmask_t      *temp;          /* New host/domain mask */
 219   char                  ifname[32],     /* Interface name */
 220                         *ifptr;         /* Pointer to end of name */
 221
 222
 223   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
 224                   loc, loc->location, name);
 225
 226   if ((temp = add_allow(loc)) == NULL)
 227     return;
 228
 229   if (!strcasecmp(name, "@LOCAL"))
 230   {
 231    /*
 232     * Allow *interface*...
 233     */
 234
 235     temp->type             = AUTH_INTERFACE;
 236     temp->mask.name.name   = strdup("*");
 237     temp->mask.name.length = 1;
 238   }
 239   else if (!strncasecmp(name, "@IF(", 4))
 240   {
 241    /*
 242     * Allow *interface*...
 243     */
 244
 245     strlcpy(ifname, name + 4, sizeof(ifname));
 246
 247     ifptr = ifname + strlen(ifname);
 248
 249     if (ifptr[-1] == ')')
 250     {
 251       ifptr --;
 252       *ifptr = '\0';
 253     }
 254
 255     temp->type             = AUTH_INTERFACE;
 256     temp->mask.name.name   = strdup(ifname);
 257     temp->mask.name.length = ifptr - ifname;
 258   }
 259   else
 260   {
 261    /*
 262     * Allow name...
 263     */
 264
 265     temp->type             = AUTH_NAME;
 266     temp->mask.name.name   = strdup(name);
 267     temp->mask.name.length = strlen(name);
 268   }
 269 }
 270
 271
 272 /*
 273  * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
 274  *                    the location.
 275  */
 276
 277 void
 278 cupsdAllowIP(cupsd_location_t *loc,     /* I - Location to add to */
 279              unsigned   address[4],     /* I - IP address to add */
 280              unsigned   netmask[4])     /* I - Netmask of address */
 281 {
 282   cupsd_authmask_t      *temp;          /* New host/domain mask */
 283
 284
 285   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 286                   "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
 287                   loc, loc->location, address[0], address[1], address[2],
 288                   address[3], netmask[0], netmask[1], netmask[2],
 289                   netmask[3]);
 290
 291   if ((temp = add_allow(loc)) == NULL)
 292     return;
 293
 294   temp->type = AUTH_IP;
 295   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
 296   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
 297 }
 298
 299
 300 /*
 301  * 'cupsdAuthorize()' - Validate any authorization credentials.
 302  */
 303
 304 void
 305 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 306 {
 307   int           type;                   /* Authentication type */
 308   char          *authorization,         /* Pointer into Authorization string */
 309                 *ptr,                   /* Pointer into string */
 310                 username[65],           /* Username string */
 311                 password[33];           /* Password string */
 312   const char    *localuser;             /* Certificate username */
 313   char          nonce[HTTP_MAX_VALUE],  /* Nonce value from client */
 314                 md5[33],                /* MD5 password */
 315                 basicmd5[33];           /* MD5 of Basic password */
 316   static const char * const states[] =  /* HTTP client states... */
 317                 {
 318                   "WAITING",
 319                   "OPTIONS",
 320                   "GET",
 321                   "GET",
 322                   "HEAD",
 323                   "POST",
 324                   "POST",
 325                   "POST",
 326                   "PUT",
 327                   "PUT",
 328                   "DELETE",
 329                   "TRACE",
 330                   "CLOSE",
 331                   "STATUS"
 332                 };
 333
 334
 335  /*
 336   * Locate the best matching location so we know what kind of
 337   * authentication to expect...
 338   */
 339
 340   con->best = cupsdFindBest(con->uri, con->http.state);
 341
 342   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 343                   "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
 344                   con->uri, con->best, con->best ? con->best->location : "");
 345
 346   if (con->best && con->best->type != AUTH_NONE)
 347     type = con->best->type;
 348   else
 349     type = DefaultAuthType;
 350
 351  /*
 352   * Decode the Authorization string...
 353   */
 354
 355   authorization = con->http.fields[HTTP_FIELD_AUTHORIZATION];
 356
 357   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
 358                   authorization);
 359
 360   username[0] = '\0';
 361   password[0] = '\0';
 362
 363   if (type == AUTH_NONE)
 364   {
 365    /*
 366     * No authorization required, return early...
 367     */
 368
 369     cupsdLogMessage(CUPSD_LOG_DEBUG,
 370                     "cupsdAuthorize: No authentication required.");
 371     return;
 372   }
 373   else if (!*authorization)
 374   {
 375    /*
 376     * No authorization data provided, return early...
 377     */
 378
 379     cupsdLogMessage(CUPSD_LOG_DEBUG,
 380                     "cupsdAuthorize: No authentication data provided.");
 381     return;
 382   }
 383   else if (!strncmp(authorization, "Local", 5) &&
 384            !strcasecmp(con->http.hostname, "localhost"))
 385   {
 386    /*
 387     * Get Local certificate authentication data...
 388     */
 389
 390     authorization += 5;
 391     while (isspace(*authorization))
 392       authorization ++;
 393
 394     if ((localuser = cupsdFindCert(authorization)) != NULL)
 395       strlcpy(username, localuser, sizeof(username));
 396     else
 397     {
 398       cupsdLogMessage(CUPSD_LOG_ERROR,
 399                       "cupsdAuthorize: Local authentication certificate not "
 400                       "found!");
 401       return;
 402     }
 403   }
 404   else if (!strncmp(authorization, "Basic", 5) &&
 405            (type == AUTH_BASIC || type == AUTH_BASICDIGEST))
 406   {
 407    /*
 408     * Get the Basic authentication data...
 409     */
 410
 411     int userlen;                        /* Username:password length */
 412
 413
 414     authorization += 5;
 415     while (isspace(*authorization))
 416       authorization ++;
 417
 418     userlen = sizeof(username);
 419     httpDecode64_2(username, &userlen, authorization);
 420
 421    /*
 422     * Pull the username and password out...
 423     */
 424
 425     if ((ptr = strchr(username, ':')) == NULL)
 426     {
 427       cupsdLogMessage(CUPSD_LOG_ERROR,
 428                       "cupsdAuthorize: Missing Basic password!");
 429       return;
 430     }
 431
 432     *ptr++ = '\0';
 433
 434     if (!username[0])
 435     {
 436      /*
 437       * Username must not be empty...
 438       */
 439
 440       cupsdLogMessage(CUPSD_LOG_ERROR,
 441                       "cupsdAuthorize: Empty Basic username!");
 442       return;
 443     }
 444
 445     if (!*ptr)
 446     {
 447      /*
 448       * Password must not be empty...
 449       */
 450
 451       cupsdLogMessage(CUPSD_LOG_ERROR,
 452                       "cupsdAuthorize: Empty Basic password!");
 453       return;
 454     }
 455
 456     strlcpy(password, ptr, sizeof(password));
 457
 458    /*
 459     * Validate the username and password...
 460     */
 461
 462     switch (type)
 463     {
 464       case AUTH_BASIC :
 465           {
 466 #if HAVE_LIBPAM
 467            /*
 468             * Only use PAM to do authentication.  This supports MD5
 469             * passwords, among other things...
 470             */
 471
 472             pam_handle_t        *pamh;  /* PAM authentication handle */
 473             int                 pamerr; /* PAM error code */
 474             struct pam_conv     pamdata;/* PAM conversation data */
 475             cupsd_authdata_t    data;   /* Authentication data */
 476
 477
 478             strlcpy(data.username, username, sizeof(data.username));
 479             strlcpy(data.password, password, sizeof(data.password));
 480
 481             pamdata.conv        = pam_func;
 482             pamdata.appdata_ptr = &data;
 483
 484 #  ifdef __hpux
 485            /*
 486             * Workaround for HP-UX bug in pam_unix; see pam_func() below for
 487             * more info...
 488             */
 489
 490             auth_data = &data;
 491 #  endif /* __hpux */
 492
 493             pamerr = pam_start("cups", username, &pamdata, &pamh);
 494             if (pamerr != PAM_SUCCESS)
 495             {
 496               cupsdLogMessage(CUPSD_LOG_ERROR,
 497                               "cupsdAuthorize: pam_start() returned %d (%s)!\n",
 498                               pamerr, pam_strerror(pamh, pamerr));
 499               pam_end(pamh, 0);
 500               return;
 501             }
 502
 503             pamerr = pam_authenticate(pamh, PAM_SILENT);
 504             if (pamerr != PAM_SUCCESS)
 505             {
 506               cupsdLogMessage(CUPSD_LOG_ERROR,
 507                               "cupsdAuthorize: pam_authenticate() returned %d "
 508                               "(%s)!\n",
 509                               pamerr, pam_strerror(pamh, pamerr));
 510               pam_end(pamh, 0);
 511               return;
 512             }
 513
 514             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 515             if (pamerr != PAM_SUCCESS)
 516             {
 517               cupsdLogMessage(CUPSD_LOG_ERROR,
 518                               "cupsdAuthorize: pam_acct_mgmt() returned %d "
 519                               "(%s)!\n",
 520                               pamerr, pam_strerror(pamh, pamerr));
 521               pam_end(pamh, 0);
 522               return;
 523             }
 524
 525             pam_end(pamh, PAM_SUCCESS);
 526
 527 #elif defined(HAVE_USERSEC_H)
 528            /*
 529             * Use AIX authentication interface...
 530             */
 531
 532             char        *authmsg;       /* Authentication message */
 533             char        *loginmsg;      /* Login message */
 534             int         reenter;        /* ??? */
 535
 536
 537             cupsdLogMessage(CUPSD_LOG_DEBUG,
 538                             "cupsdAuthorize: AIX authenticate of username \"%s\"",
 539                             username);
 540
 541             reenter = 1;
 542             if (authenticate(username, password, &reenter, &authmsg) != 0)
 543             {
 544               cupsdLogMessage(CUPSD_LOG_DEBUG,
 545                               "cupsdAuthorize: Unable to authenticate username "
 546                               "\"%s\": %s",
 547                               username, strerror(errno));
 548               return;
 549             }
 550
 551 #else
 552            /*
 553             * Use normal UNIX password file-based authentication...
 554             */
 555
 556             char                *pass;  /* Encrypted password */
 557             struct passwd       *pw;    /* User password data */
 558 #  ifdef HAVE_SHADOW_H
 559             struct spwd         *spw;   /* Shadow password data */
 560 #  endif /* HAVE_SHADOW_H */
 561
 562
 563             pw = getpwnam(username);    /* Get the current password */
 564             endpwent();                 /* Close the password file */
 565
 566             if (!pw)
 567             {
 568              /*
 569               * No such user...
 570               */
 571
 572               cupsdLogMessage(CUPSD_LOG_ERROR,
 573                               "cupsdAuthorize: Unknown username \"%s\"!",
 574                               username);
 575               return (HTTP_UNAUTHORIZED);
 576             }
 577
 578 #  ifdef HAVE_SHADOW_H
 579             spw = getspnam(username);
 580             endspent();
 581
 582             if (!spw && !strcmp(pw->pw_passwd, "x"))
 583             {
 584              /*
 585               * Don't allow blank passwords!
 586               */
 587
 588               cupsdLogMessage(CUPSD_LOG_ERROR,
 589                               "cupsdAuthorize: Username \"%s\" has no shadow "
 590                               "password!", username);
 591               return;
 592             }
 593
 594             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 595 #  else
 596             if (!pw->pw_passwd[0])
 597 #  endif /* HAVE_SHADOW_H */
 598             {
 599              /*
 600               * Don't allow blank passwords!
 601               */
 602
 603               cupsdLogMessage(CUPSD_LOG_ERROR,
 604                               "cupsdAuthorize: Username \"%s\" has no password!",
 605                               username);
 606               return;
 607             }
 608
 609            /*
 610             * OK, the password isn't blank, so compare with what came from the
 611             * client...
 612             */
 613
 614             pass = cups_crypt(password, pw->pw_passwd);
 615
 616             cupsdLogMessage(CUPSD_LOG_DEBUG2,
 617                             "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
 618                             pw->pw_passwd, pass);
 619
 620             if (!pass || strcmp(pw->pw_passwd, pass))
 621             {
 622 #  ifdef HAVE_SHADOW_H
 623               if (spw)
 624               {
 625                 pass = cups_crypt(password, spw->sp_pwdp);
 626
 627                 cupsdLogMessage(CUPSD_LOG_DEBUG2,
 628                                 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
 629                                 spw->sp_pwdp, pass);
 630
 631                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 632                 {
 633                   cupsdLogMessage(CUPSD_LOG_ERROR,
 634                                   "cupsdAuthorize: Authentication failed for "
 635                                   "user \"%s\"!",
 636                                   username);
 637                   return;
 638                 }
 639               }
 640               else
 641 #  endif /* HAVE_SHADOW_H */
 642               {
 643                 cupsdLogMessage(CUPSD_LOG_ERROR,
 644                                 "cupsdAuthorize: Authentication failed for "
 645                                 "user \"%s\"!",
 646                                 username);
 647                 return;
 648               }
 649             }
 650 #endif /* HAVE_LIBPAM */
 651           }
 652           break;
 653
 654       case AUTH_BASICDIGEST :
 655          /*
 656           * Do Basic authentication with the Digest password file...
 657           */
 658
 659           if (!cupsdGetMD5Passwd(username, NULL, md5))
 660           {
 661             cupsdLogMessage(CUPSD_LOG_ERROR,
 662                             "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 663                             username);
 664             return;
 665           }
 666
 667           httpMD5(username, "CUPS", password, basicmd5);
 668
 669           if (strcmp(md5, basicmd5))
 670           {
 671             cupsdLogMessage(CUPSD_LOG_ERROR,
 672                             "cupsdAuthorize: Authentication failed for \"%s\"!",
 673                             username);
 674             return;
 675           }
 676           break;
 677     }
 678   }
 679   else if (!strncmp(authorization, "Digest", 6) && type == AUTH_DIGEST)
 680   {
 681    /*
 682     * Get the username, password, and nonce from the Digest attributes...
 683     */
 684
 685     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
 686                           username, sizeof(username)) || !username[0])
 687     {
 688      /*
 689       * Username must not be empty...
 690       */
 691
 692       cupsdLogMessage(CUPSD_LOG_ERROR,
 693                       "cupsdAuthorize: Empty or missing Digest username!");
 694       return;
 695     }
 696
 697     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
 698                           password, sizeof(password)) || !password[0])
 699     {
 700      /*
 701       * Password must not be empty...
 702       */
 703
 704       cupsdLogMessage(CUPSD_LOG_ERROR,
 705                       "cupsdAuthorize: Empty or missing Digest password!");
 706       return;
 707     }
 708
 709     if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
 710                          nonce))
 711     {
 712       cupsdLogMessage(CUPSD_LOG_ERROR,
 713                       "cupsdAuthorize: No nonce value for Digest "
 714                       "authentication!");
 715       return;
 716     }
 717
 718     if (strcmp(con->http.hostname, nonce))
 719     {
 720       cupsdLogMessage(CUPSD_LOG_ERROR,
 721                       "cupsdAuthorize: Bad nonce value, expected \"%s\", "
 722                       "got \"%s\"!", con->http.hostname, nonce);
 723       return;
 724     }
 725
 726    /*
 727     * Validate the username and password...
 728     */
 729
 730     if (!cupsdGetMD5Passwd(username, NULL, md5))
 731     {
 732       cupsdLogMessage(CUPSD_LOG_ERROR,
 733                       "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 734                       username);
 735       return;
 736     }
 737
 738     httpMD5Final(nonce, states[con->http.state], con->uri, md5);
 739
 740     if (strcmp(md5, password))
 741     {
 742       cupsdLogMessage(CUPSD_LOG_ERROR,
 743                       "cupsdAuthorize: Authentication failed for \"%s\"!",
 744                       username);
 745       return;
 746     }
 747   }
 748   else
 749   {
 750     cupsdLogMessage(CUPSD_LOG_DEBUG,
 751                     "cupsdAuthorize: Bad authentication data.");
 752     return;
 753   }
 754
 755  /*
 756   * If we get here, then we were able to validate the username and
 757   * password - copy the validated username and password to the client
 758   * data and return...
 759   */
 760
 761   strlcpy(con->username, username, sizeof(con->username));
 762   strlcpy(con->password, password, sizeof(con->password));
 763
 764   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: username=\"%s\"",
 765                   con->username);
 766 }
 767
 768
 769 /*
 770  * 'cupsdCheckAuth()' - Check authorization masks.
 771  */
 772
 773 int                                     /* O - 1 if mask matches, 0 otherwise */
 774 cupsdCheckAuth(
 775     unsigned         ip[4],             /* I - Client address */
 776     char             *name,             /* I - Client hostname */
 777     int              name_len,          /* I - Length of hostname */
 778     int              num_masks,         /* I - Number of masks */
 779     cupsd_authmask_t *masks)            /* I - Masks */
 780 {
 781   int           i;                      /* Looping var */
 782   cupsd_netif_t *iface;                 /* Network interface */
 783   unsigned      netip4;                 /* IPv4 network address */
 784 #ifdef AF_INET6
 785   unsigned      netip6[4];              /* IPv6 network address */
 786 #endif /* AF_INET6 */
 787
 788   while (num_masks > 0)
 789   {
 790     switch (masks->type)
 791     {
 792       case AUTH_INTERFACE :
 793          /*
 794           * Check for a match with a network interface...
 795           */
 796
 797           netip4 = htonl(ip[3]);
 798
 799 #ifdef AF_INET6
 800           netip6[0] = htonl(ip[0]);
 801           netip6[1] = htonl(ip[1]);
 802           netip6[2] = htonl(ip[2]);
 803           netip6[3] = htonl(ip[3]);
 804 #endif /* AF_INET6 */
 805
 806           if (!strcmp(masks->mask.name.name, "*"))
 807           {
 808            /*
 809             * Check against all local interfaces...
 810             */
 811
 812             cupsdNetIFUpdate();
 813
 814             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 815                  iface;
 816                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 817             {
 818              /*
 819               * Only check local interfaces...
 820               */
 821
 822               if (!iface->is_local)
 823                 continue;
 824
 825               if (iface->address.addr.sa_family == AF_INET)
 826               {
 827                /*
 828                 * Check IPv4 address...
 829                 */
 830
 831                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 832                     (iface->address.ipv4.sin_addr.s_addr &
 833                      iface->mask.ipv4.sin_addr.s_addr))
 834                   return (1);
 835               }
 836 #ifdef AF_INET6
 837               else
 838               {
 839                /*
 840                 * Check IPv6 address...
 841                 */
 842
 843                 for (i = 0; i < 4; i ++)
 844                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 845                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 846                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 847                     break;
 848
 849                 if (i == 4)
 850                   return (1);
 851               }
 852 #endif /* AF_INET6 */
 853             }
 854           }
 855           else
 856           {
 857            /*
 858             * Check the named interface...
 859             */
 860
 861             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 862                  iface && !strcmp(masks->mask.name.name, iface->name);
 863                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 864             {
 865               if (iface->address.addr.sa_family == AF_INET)
 866               {
 867                /*
 868                 * Check IPv4 address...
 869                 */
 870
 871                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 872                     (iface->address.ipv4.sin_addr.s_addr &
 873                      iface->mask.ipv4.sin_addr.s_addr))
 874                   return (1);
 875               }
 876 #ifdef AF_INET6
 877               else
 878               {
 879                /*
 880                 * Check IPv6 address...
 881                 */
 882
 883                 for (i = 0; i < 4; i ++)
 884                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 885                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 886                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 887                     break;
 888
 889                 if (i == 4)
 890                   return (1);
 891               }
 892 #endif /* AF_INET6 */
 893             }
 894           }
 895           break;
 896
 897       case AUTH_NAME :
 898          /*
 899           * Check for exact name match...
 900           */
 901
 902           if (!strcasecmp(name, masks->mask.name.name))
 903             return (1);
 904
 905          /*
 906           * Check for domain match...
 907           */
 908
 909           if (name_len >= masks->mask.name.length &&
 910               masks->mask.name.name[0] == '.' &&
 911               !strcasecmp(name + name_len - masks->mask.name.length,
 912                           masks->mask.name.name))
 913             return (1);
 914           break;
 915
 916       case AUTH_IP :
 917          /*
 918           * Check for IP/network address match...
 919           */
 920
 921           for (i = 0; i < 4; i ++)
 922             if ((ip[i] & masks->mask.ip.netmask[i]) !=
 923                     masks->mask.ip.address[i])
 924               break;
 925
 926           if (i == 4)
 927             return (1);
 928           break;
 929     }
 930
 931     masks ++;
 932     num_masks --;
 933   }
 934
 935   return (0);
 936 }
 937
 938
 939 /*
 940  * 'cupsdCheckGroup()' - Check for a user's group membership.
 941  */
 942
 943 int                                     /* O - 1 if user is a member, 0 otherwise */
 944 cupsdCheckGroup(
 945     const char    *username,            /* I - User name */
 946     struct passwd *user,                /* I - System user info */
 947     const char    *groupname)           /* I - Group name */
 948 {
 949   int                   i;              /* Looping var */
 950   struct group          *group;         /* System group info */
 951   char                  junk[33];       /* MD5 password (not used) */
 952 #ifdef HAVE_MBR_UID_TO_UUID
 953   uuid_t                useruuid,       /* UUID for username */
 954                         groupuuid;      /* UUID for groupname */
 955   int                   is_member;      /* True if user is a member of group */
 956 #endif /* HAVE_MBR_UID_TO_UUID */
 957
 958
 959   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 960                   "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
 961                   username, user, groupname);
 962
 963  /*
 964   * Validate input...
 965   */
 966
 967   if (!username || !groupname)
 968     return (0);
 969
 970  /*
 971   * Check to see if the user is a member of the named group...
 972   */
 973
 974   group = getgrnam(groupname);
 975   endgrent();
 976
 977   if (group != NULL)
 978   {
 979    /*
 980     * Group exists, check it...
 981     */
 982
 983     for (i = 0; group->gr_mem[i]; i ++)
 984       if (!strcasecmp(username, group->gr_mem[i]))
 985         return (1);
 986   }
 987
 988  /*
 989   * Group doesn't exist or user not in group list, check the group ID
 990   * against the user's group ID...
 991   */
 992
 993   if (user && group && group->gr_gid == user->pw_gid)
 994     return (1);
 995
 996 #ifdef HAVE_MBR_UID_TO_UUID
 997  /*
 998   * Check group membership through MacOS X membership API...
 999   */
1000
1001   if (user && group)
1002     if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1003       if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1004         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1005           if (is_member)
1006             return (1);
1007 #endif /* HAVE_MBR_UID_TO_UUID */
1008
1009  /*
1010   * Username not found, group not found, or user is not part of the
1011   * system group...  Check for a user and group in the MD5 password
1012   * file...
1013   */
1014
1015   if (cupsdGetMD5Passwd(username, groupname, junk) != NULL)
1016     return (1);
1017
1018  /*
1019   * If we get this far, then the user isn't part of the named group...
1020   */
1021
1022   return (0);
1023 }
1024
1025
1026 /*
1027  * 'cupsdCopyLocation()' - Make a copy of a location...
1028  */
1029
1030 cupsd_location_t *                      /* O - New location */
1031 cupsdCopyLocation(
1032     cupsd_location_t **loc)             /* IO - Original location */
1033 {
1034   int                   i;              /* Looping var */
1035   cupsd_location_t      *temp;          /* New location */
1036   char                  location[HTTP_MAX_URI];
1037                                         /* Location of resource */
1038
1039
1040  /*
1041   * Use a local copy of location because cupsdAddLocation may cause
1042   * this memory to be moved...
1043   */
1044
1045   strlcpy(location, (*loc)->location, sizeof(location));
1046
1047   if ((temp = cupsdAddLocation(location)) == NULL)
1048     return (NULL);
1049
1050  /*
1051   * Copy the information from the original location to the new one.
1052   */
1053
1054   temp->limit      = (*loc)->limit;
1055   temp->order_type = (*loc)->order_type;
1056   temp->type       = (*loc)->type;
1057   temp->level      = (*loc)->level;
1058   temp->satisfy    = (*loc)->satisfy;
1059   temp->encryption = (*loc)->encryption;
1060
1061   if ((temp->num_names  = (*loc)->num_names) > 0)
1062   {
1063    /*
1064     * Copy the names array...
1065     */
1066
1067     if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1068     {
1069       cupsdLogMessage(CUPSD_LOG_ERROR,
1070                       "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1071                       temp->num_names, strerror(errno));
1072
1073       cupsdDeleteLocation(temp);
1074       return (NULL);
1075     }
1076
1077     for (i = 0; i < temp->num_names; i ++)
1078       if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1079       {
1080         cupsdLogMessage(CUPSD_LOG_ERROR,
1081                         "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1082                         (*loc)->names[i], strerror(errno));
1083
1084         cupsdDeleteLocation(temp);
1085         return (NULL);
1086       }
1087   }
1088
1089   if ((temp->num_allow  = (*loc)->num_allow) > 0)
1090   {
1091    /*
1092     * Copy allow rules...
1093     */
1094
1095     if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1096     {
1097       cupsdLogMessage(CUPSD_LOG_ERROR,
1098                       "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1099                       temp->num_allow, strerror(errno));
1100       cupsdDeleteLocation(temp);
1101       return (NULL);
1102     }
1103
1104     for (i = 0; i < temp->num_allow; i ++)
1105       switch (temp->allow[i].type = (*loc)->allow[i].type)
1106       {
1107         case AUTH_NAME :
1108             temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1109             temp->allow[i].mask.name.name   = strdup((*loc)->allow[i].mask.name.name);
1110
1111             if (temp->allow[i].mask.name.name == NULL)
1112             {
1113               cupsdLogMessage(CUPSD_LOG_ERROR,
1114                               "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1115                               (*loc)->allow[i].mask.name.name, strerror(errno));
1116               cupsdDeleteLocation(temp);
1117               return (NULL);
1118             }
1119             break;
1120         case AUTH_IP :
1121             memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1122                    sizeof(cupsd_ipmask_t));
1123             break;
1124       }
1125   }
1126
1127   if ((temp->num_deny  = (*loc)->num_deny) > 0)
1128   {
1129    /*
1130     * Copy deny rules...
1131     */
1132
1133     if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1134     {
1135       cupsdLogMessage(CUPSD_LOG_ERROR,
1136                       "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1137                       temp->num_deny, strerror(errno));
1138       cupsdDeleteLocation(temp);
1139       return (NULL);
1140     }
1141
1142     for (i = 0; i < temp->num_deny; i ++)
1143       switch (temp->deny[i].type = (*loc)->deny[i].type)
1144       {
1145         case AUTH_NAME :
1146             temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1147             temp->deny[i].mask.name.name   = strdup((*loc)->deny[i].mask.name.name);
1148
1149             if (temp->deny[i].mask.name.name == NULL)
1150             {
1151               cupsdLogMessage(CUPSD_LOG_ERROR,
1152                               "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1153                               (*loc)->deny[i].mask.name.name, strerror(errno));
1154               cupsdDeleteLocation(temp);
1155               return (NULL);
1156             }
1157             break;
1158         case AUTH_IP :
1159             memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1160                    sizeof(cupsd_ipmask_t));
1161             break;
1162       }
1163   }
1164
1165   return (temp);
1166 }
1167
1168
1169 /*
1170  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1171  */
1172
1173 void
1174 cupsdDeleteAllLocations(void)
1175 {
1176   cupsd_location_t      *loc;           /* Current location */
1177
1178
1179  /*
1180   * Free all of the allow/deny records first...
1181   */
1182
1183   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1184        loc;
1185        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1186     cupsdDeleteLocation(loc);
1187
1188  /*
1189   * Then free the location array...
1190   */
1191
1192   cupsArrayDelete(Locations);
1193   Locations = NULL;
1194 }
1195
1196
1197 /*
1198  * 'cupsdDeleteLocation()' - Free all memory used by a location.
1199  */
1200
1201 void
1202 cupsdDeleteLocation(
1203     cupsd_location_t *loc)              /* I - Location to delete */
1204 {
1205   int                   i;              /* Looping var */
1206   cupsd_authmask_t      *mask;          /* Current mask */
1207
1208
1209   cupsArrayRemove(Locations, loc);
1210
1211   for (i = loc->num_names - 1; i >= 0; i --)
1212     free(loc->names[i]);
1213
1214   if (loc->num_names > 0)
1215     free(loc->names);
1216
1217   for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1218     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1219       free(mask->mask.name.name);
1220
1221   if (loc->num_allow > 0)
1222     free(loc->allow);
1223
1224   for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1225     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1226       free(mask->mask.name.name);
1227
1228   if (loc->num_deny > 0)
1229     free(loc->deny);
1230
1231   free(loc->location);
1232   free(loc);
1233 }
1234
1235
1236 /*
1237  * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1238  *                     location.
1239  */
1240
1241 void
1242 cupsdDenyHost(cupsd_location_t *loc,    /* I - Location to add to */
1243               char             *name)   /* I - Name of host or domain to add */
1244 {
1245   cupsd_authmask_t      *temp;          /* New host/domain mask */
1246   char                  ifname[32],     /* Interface name */
1247                         *ifptr;         /* Pointer to end of name */
1248
1249
1250   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1251                   loc, loc->location, name);
1252
1253   if ((temp = add_deny(loc)) == NULL)
1254     return;
1255
1256   if (!strcasecmp(name, "@LOCAL"))
1257   {
1258    /*
1259     * Deny *interface*...
1260     */
1261
1262     temp->type             = AUTH_INTERFACE;
1263     temp->mask.name.name   = strdup("*");
1264     temp->mask.name.length = 1;
1265   }
1266   else if (!strncasecmp(name, "@IF(", 4))
1267   {
1268    /*
1269     * Deny *interface*...
1270     */
1271
1272     strlcpy(ifname, name + 4, sizeof(ifname));
1273
1274     ifptr = ifname + strlen(ifname);
1275
1276     if (ifptr[-1] == ')')
1277     {
1278       ifptr --;
1279       *ifptr = '\0';
1280     }
1281
1282     temp->type             = AUTH_INTERFACE;
1283     temp->mask.name.name   = strdup(ifname);
1284     temp->mask.name.length = ifptr - ifname;
1285   }
1286   else
1287   {
1288    /*
1289     * Deny name...
1290     */
1291
1292     temp->type             = AUTH_NAME;
1293     temp->mask.name.name   = strdup(name);
1294     temp->mask.name.length = strlen(name);
1295   }
1296 }
1297
1298
1299 /*
1300  * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1301  *                   access the location.
1302  */
1303
1304 void
1305 cupsdDenyIP(cupsd_location_t *loc,      /* I - Location to add to */
1306             unsigned         address[4],/* I - IP address to add */
1307             unsigned         netmask[4])/* I - Netmask of address */
1308 {
1309   cupsd_authmask_t      *temp;          /* New host/domain mask */
1310
1311
1312   cupsdLogMessage(CUPSD_LOG_DEBUG,
1313                   "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1314                   loc, loc->location, address[0], address[1], address[2],
1315                   address[3], netmask[0], netmask[1], netmask[2],
1316                   netmask[3]);
1317
1318   if ((temp = add_deny(loc)) == NULL)
1319     return;
1320
1321   temp->type = AUTH_IP;
1322   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1323   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1324 }
1325
1326
1327 /*
1328  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1329  */
1330
1331 cupsd_location_t *                      /* O - Location that matches */
1332 cupsdFindBest(const char   *path,       /* I - Resource path */
1333               http_state_t state)       /* I - HTTP state/request */
1334 {
1335   char                  uri[HTTP_MAX_URI],
1336                                         /* URI in request... */
1337                         *uriptr;        /* Pointer into URI */
1338   cupsd_location_t      *loc,           /* Current location */
1339                         *best;          /* Best match for location so far */
1340   int                   bestlen;        /* Length of best match */
1341   int                   limit;          /* Limit field */
1342   static const int      limits[] =      /* Map http_status_t to AUTH_LIMIT_xyz */
1343                 {
1344                   AUTH_LIMIT_ALL,
1345                   AUTH_LIMIT_OPTIONS,
1346                   AUTH_LIMIT_GET,
1347                   AUTH_LIMIT_GET,
1348                   AUTH_LIMIT_HEAD,
1349                   AUTH_LIMIT_POST,
1350                   AUTH_LIMIT_POST,
1351                   AUTH_LIMIT_POST,
1352                   AUTH_LIMIT_PUT,
1353                   AUTH_LIMIT_PUT,
1354                   AUTH_LIMIT_DELETE,
1355                   AUTH_LIMIT_TRACE,
1356                   AUTH_LIMIT_ALL,
1357                   AUTH_LIMIT_ALL
1358                 };
1359
1360
1361  /*
1362   * First copy the connection URI to a local string so we have drop
1363   * any .ppd extension from the pathname in /printers or /classes
1364   * URIs...
1365   */
1366
1367   strlcpy(uri, path, sizeof(uri));
1368
1369   if (!strncmp(uri, "/printers/", 10) ||
1370       !strncmp(uri, "/classes/", 9))
1371   {
1372    /*
1373     * Check if the URI has .ppd on the end...
1374     */
1375
1376     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1377
1378     if (!strcmp(uriptr, ".ppd"))
1379       *uriptr = '\0';
1380   }
1381
1382   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1383
1384  /*
1385   * Loop through the list of locations to find a match...
1386   */
1387
1388   limit   = limits[state];
1389   best    = NULL;
1390   bestlen = 0;
1391
1392   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1393        loc;
1394        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1395   {
1396     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1397                     loc->location, loc->limit);
1398
1399     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1400     {
1401      /*
1402       * Use case-insensitive comparison for queue names...
1403       */
1404
1405       if (loc->length > bestlen &&
1406           !strncasecmp(uri, loc->location, loc->length) &&
1407           loc->location[0] == '/' &&
1408           (limit & loc->limit) != 0)
1409       {
1410         best    = loc;
1411         bestlen = loc->length;
1412       }
1413     }
1414     else
1415     {
1416      /*
1417       * Use case-sensitive comparison for other URIs...
1418       */
1419
1420       if (loc->length > bestlen &&
1421           !strncmp(uri, loc->location, loc->length) &&
1422           loc->location[0] == '/' &&
1423           (limit & loc->limit) != 0)
1424       {
1425         best    = loc;
1426         bestlen = loc->length;
1427       }
1428     }
1429   }
1430
1431  /*
1432   * Return the match, if any...
1433   */
1434
1435   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1436                   best ? best->location : "NONE");
1437
1438   return (best);
1439 }
1440
1441
1442 /*
1443  * 'cupsdFindLocation()' - Find the named location.
1444  */
1445
1446 cupsd_location_t *                      /* O - Location that matches */
1447 cupsdFindLocation(const char *location) /* I - Connection */
1448 {
1449   cupsd_location_t      key;            /* Search key */
1450
1451
1452   key.location = (char *)location;
1453
1454   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1455 }
1456
1457
1458 /*
1459  * 'cupsdGetMD5Passwd()' - Get an MD5 password.
1460  */
1461
1462 char *                                  /* O - MD5 password string */
1463 cupsdGetMD5Passwd(const char *username, /* I - Username */
1464                   const char *group,    /* I - Group */
1465                   char       passwd[33])/* O - MD5 password string */
1466 {
1467   cups_file_t   *fp;                    /* passwd.md5 file */
1468   char          filename[1024],         /* passwd.md5 filename */
1469                 line[256],              /* Line from file */
1470                 tempuser[33],           /* User from file */
1471                 tempgroup[33];          /* Group from file */
1472
1473
1474   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1475                   "cupsdGetMD5Passwd(username=\"%s\", group=\"%s\", passwd=%p)",
1476                   username, group ? group : "(null)", passwd);
1477
1478   snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
1479   if ((fp = cupsFileOpen(filename, "r")) == NULL)
1480   {
1481     if (errno != ENOENT)
1482       cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
1483                       strerror(errno));
1484
1485     return (NULL);
1486   }
1487
1488   while (cupsFileGets(fp, line, sizeof(line)) != NULL)
1489   {
1490     if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
1491     {
1492       cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
1493       continue;
1494     }
1495
1496     if (!strcmp(username, tempuser) &&
1497         (group == NULL || !strcmp(group, tempgroup)))
1498     {
1499      /*
1500       * Found the password entry!
1501       */
1502
1503       cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
1504                       username, tempgroup);
1505
1506       cupsFileClose(fp);
1507       return (passwd);
1508     }
1509   }
1510
1511  /*
1512   * Didn't find a password entry - return NULL!
1513   */
1514
1515   cupsFileClose(fp);
1516   return (NULL);
1517 }
1518
1519
1520 /*
1521  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1522  */
1523
1524 http_status_t                           /* O - HTTP_OK if authorized or error code */
1525 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1526                   const char     *owner)/* I - Owner of object */
1527 {
1528   int                   i, j,           /* Looping vars */
1529                         auth;           /* Authorization status */
1530   unsigned              address[4];     /* Authorization address */
1531   cupsd_location_t      *best;          /* Best match for location so far */
1532   int                   hostlen;        /* Length of hostname */
1533   const char            *username;      /* Username to authorize */
1534   struct passwd         *pw;            /* User password data */
1535   static const char * const levels[] =  /* Auth levels */
1536                 {
1537                   "ANON",
1538                   "USER",
1539                   "GROUP"
1540                 };
1541   static const char * const types[] =   /* Auth types */
1542                 {
1543                   "NONE",
1544                   "BASIC",
1545                   "DIGEST",
1546                   "BASICDIGEST"
1547                 };
1548
1549
1550   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1551                   "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1552                   con->uri, con->best, con->best ? con->best->location : "");
1553   if (owner)
1554     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1555                     "cupsdIsAuthorized: owner=\"%s\"", owner);
1556
1557  /*
1558   * If there is no "best" authentication rule for this request, then
1559   * access is allowed from the local system and denied from other
1560   * addresses...
1561   */
1562
1563   if (!con->best)
1564   {
1565     if (!strcmp(con->http.hostname, "localhost") ||
1566         !strcmp(con->http.hostname, ServerName))
1567       return (HTTP_OK);
1568     else
1569       return (HTTP_FORBIDDEN);
1570   }
1571
1572   best = con->best;
1573
1574   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1575                   "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, "
1576                   "satisfy=AUTH_SATISFY_%s, num_names=%d",
1577                   levels[best->level], types[best->type],
1578                   best->satisfy ? "ANY" : "ALL", best->num_names);
1579
1580   if (best->limit == AUTH_LIMIT_IPP)
1581     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1582                     best->op, ippOpString(best->op));
1583
1584  /*
1585   * Check host/ip-based accesses...
1586   */
1587
1588 #ifdef AF_INET6
1589   if (con->http.hostaddr->addr.sa_family == AF_INET6)
1590   {
1591    /*
1592     * Copy IPv6 address...
1593     */
1594
1595     address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1596     address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1597     address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1598     address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1599   }
1600   else
1601 #endif /* AF_INET6 */
1602   if (con->http.hostaddr->addr.sa_family == AF_INET)
1603   {
1604    /*
1605     * Copy IPv4 address...
1606     */
1607
1608     address[0] = 0;
1609     address[1] = 0;
1610     address[2] = 0;
1611     address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1612   }
1613   else
1614     memset(address, 0, sizeof(address));
1615
1616   hostlen = strlen(con->http.hostname);
1617
1618   if (!strcasecmp(con->http.hostname, "localhost"))
1619   {
1620    /*
1621     * Access from localhost (127.0.0.1 or ::1) is always allowed...
1622     */
1623
1624     auth = AUTH_ALLOW;
1625   }
1626   else
1627   {
1628    /*
1629     * Do authorization checks on the domain/address...
1630     */
1631
1632     switch (best->order_type)
1633     {
1634       default :
1635           auth = AUTH_DENY;     /* anti-compiler-warning-code */
1636           break;
1637
1638       case AUTH_ALLOW : /* Order Deny,Allow */
1639           auth = AUTH_ALLOW;
1640
1641           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1642                         best->num_deny, best->deny))
1643             auth = AUTH_DENY;
1644
1645           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1646                         best->num_allow, best->allow))
1647             auth = AUTH_ALLOW;
1648           break;
1649
1650       case AUTH_DENY : /* Order Allow,Deny */
1651           auth = AUTH_DENY;
1652
1653           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1654                         best->num_allow, best->allow))
1655             auth = AUTH_ALLOW;
1656
1657           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1658                         best->num_deny, best->deny))
1659             auth = AUTH_DENY;
1660           break;
1661     }
1662   }
1663
1664   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1665                   auth ? "DENY" : "ALLOW");
1666
1667   if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1668     return (HTTP_FORBIDDEN);
1669
1670 #ifdef HAVE_SSL
1671  /*
1672   * See if encryption is required...
1673   */
1674
1675   if (best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1676       best->satisfy == AUTH_SATISFY_ALL)
1677   {
1678     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1679                     "cupsdIsAuthorized: Need upgrade to TLS...");
1680     return (HTTP_UPGRADE_REQUIRED);
1681   }
1682 #endif /* HAVE_SSL */
1683
1684  /*
1685   * Now see what access level is required...
1686   */
1687
1688   if (best->level == AUTH_ANON ||       /* Anonymous access - allow it */
1689       (best->type == AUTH_NONE && best->num_names == 0))
1690     return (HTTP_OK);
1691
1692   if (!con->username[0] && best->type == AUTH_NONE &&
1693       best->limit == AUTH_LIMIT_IPP)
1694   {
1695    /*
1696     * Check for unauthenticated username...
1697     */
1698
1699     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1700
1701
1702     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1703     if (attr)
1704     {
1705       cupsdLogMessage(CUPSD_LOG_DEBUG2,
1706                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1707                       attr->values[0].string.text);
1708       username = attr->values[0].string.text;
1709     }
1710     else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1711       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1712     else
1713       return (HTTP_OK);                 /* unless overridden with Satisfy */
1714   }
1715   else
1716   {
1717     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: username=\"%s\"",
1718                     con->username);
1719
1720     if (!con->username[0])
1721     {
1722       if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1723         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1724       else
1725         return (HTTP_OK);               /* unless overridden with Satisfy */
1726     }
1727
1728     username = con->username;
1729   }
1730
1731  /*
1732   * OK, got a username.  See if we need normal user access, or group
1733   * access... (root always matches)
1734   */
1735
1736   if (!strcmp(username, "root"))
1737     return (HTTP_OK);
1738
1739  /*
1740   * Get the user info...
1741   */
1742
1743   pw = getpwnam(username);
1744   endpwent();
1745
1746   if (best->level == AUTH_USER)
1747   {
1748    /*
1749     * If there are no names associated with this location, then
1750     * any valid user is OK...
1751     */
1752
1753     if (best->num_names == 0)
1754       return (HTTP_OK);
1755
1756    /*
1757     * Otherwise check the user list and return OK if this user is
1758     * allowed...
1759     */
1760
1761     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1762                     "cupsdIsAuthorized: Checking user membership...");
1763
1764     for (i = 0; i < best->num_names; i ++)
1765     {
1766       if (!strcasecmp(best->names[i], "@OWNER") && owner &&
1767           !strcasecmp(username, owner))
1768         return (HTTP_OK);
1769       else if (!strcasecmp(best->names[i], "@SYSTEM"))
1770       {
1771         for (j = 0; j < NumSystemGroups; j ++)
1772           if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1773             return (HTTP_OK);
1774       }
1775       else if (best->names[i][0] == '@')
1776       {
1777         if (cupsdCheckGroup(username, pw, best->names[i] + 1))
1778           return (HTTP_OK);
1779       }
1780       else if (!strcasecmp(username, best->names[i]))
1781         return (HTTP_OK);
1782     }
1783
1784     return (HTTP_UNAUTHORIZED);
1785   }
1786
1787  /*
1788   * Check to see if this user is in any of the named groups...
1789   */
1790
1791   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1792                   "cupsdIsAuthorized: Checking group membership...");
1793
1794  /*
1795   * Check to see if this user is in any of the named groups...
1796   */
1797
1798   for (i = 0; i < best->num_names; i ++)
1799   {
1800     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1801                     "cupsdIsAuthorized: Checking group \"%s\" membership...",
1802                     best->names[i]);
1803
1804     if (!strcasecmp(best->names[i], "@SYSTEM"))
1805     {
1806       for (j = 0; j < NumSystemGroups; j ++)
1807         if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1808           return (HTTP_OK);
1809     }
1810     else if (cupsdCheckGroup(username, pw, best->names[i]))
1811       return (HTTP_OK);
1812   }
1813
1814  /*
1815   * The user isn't part of the specified group, so deny access...
1816   */
1817
1818   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1819                   "cupsdIsAuthorized: User not in group(s)!");
1820
1821   return (HTTP_UNAUTHORIZED);
1822 }
1823
1824
1825 /*
1826  * 'add_allow()' - Add an allow mask to the location.
1827  */
1828
1829 static cupsd_authmask_t *               /* O - New mask record */
1830 add_allow(cupsd_location_t *loc)        /* I - Location to add to */
1831 {
1832   cupsd_authmask_t      *temp;          /* New mask record */
1833
1834
1835  /*
1836   * Range-check...
1837   */
1838
1839   if (loc == NULL)
1840     return (NULL);
1841
1842  /*
1843   * Try to allocate memory for the record...
1844   */
1845
1846   if (loc->num_allow == 0)
1847     temp = malloc(sizeof(cupsd_authmask_t));
1848   else
1849     temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
1850
1851   if (temp == NULL)
1852     return (NULL);
1853
1854   loc->allow = temp;
1855   temp       += loc->num_allow;
1856   loc->num_allow ++;
1857
1858  /*
1859   * Clear the mask record and return...
1860   */
1861
1862   memset(temp, 0, sizeof(cupsd_authmask_t));
1863   return (temp);
1864 }
1865
1866
1867 /*
1868  * 'add_deny()' - Add a deny mask to the location.
1869  */
1870
1871 static cupsd_authmask_t *               /* O - New mask record */
1872 add_deny(cupsd_location_t *loc)         /* I - Location to add to */
1873 {
1874   cupsd_authmask_t      *temp;          /* New mask record */
1875
1876
1877  /*
1878   * Range-check...
1879   */
1880
1881   if (loc == NULL)
1882     return (NULL);
1883
1884  /*
1885   * Try to allocate memory for the record...
1886   */
1887
1888   if (loc->num_deny == 0)
1889     temp = malloc(sizeof(cupsd_authmask_t));
1890   else
1891     temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
1892
1893   if (temp == NULL)
1894     return (NULL);
1895
1896   loc->deny = temp;
1897   temp      += loc->num_deny;
1898   loc->num_deny ++;
1899
1900  /*
1901   * Clear the mask record and return...
1902   */
1903
1904   memset(temp, 0, sizeof(cupsd_authmask_t));
1905   return (temp);
1906 }
1907
1908
1909 /*
1910  * 'compare_locations()' - Compare two locations.
1911  */
1912
1913 static int                              /* O - Result of comparison */
1914 compare_locations(cupsd_location_t *a,  /* I - First location */
1915                   cupsd_location_t *b)  /* I - Second location */
1916 {
1917   return (strcmp(b->location, a->location));
1918 }
1919
1920
1921 #if !HAVE_LIBPAM
1922 /*
1923  * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1924  *                  as needed.
1925  */
1926
1927 static char *                           /* O - Encrypted password */
1928 cups_crypt(const char *pw,              /* I - Password string */
1929            const char *salt)            /* I - Salt (key) string */
1930 {
1931   if (!strncmp(salt, "$1$", 3))
1932   {
1933    /*
1934     * Use MD5 passwords without the benefit of PAM; this is for
1935     * Slackware Linux, and the algorithm was taken from the
1936     * old shadow-19990827/lib/md5crypt.c source code... :(
1937     */
1938
1939     int                 i;              /* Looping var */
1940     unsigned long       n;              /* Output number */
1941     int                 pwlen;          /* Length of password string */
1942     const char          *salt_end;      /* End of "salt" data for MD5 */
1943     char                *ptr;           /* Pointer into result string */
1944     _cups_md5_state_t   state;          /* Primary MD5 state info */
1945     _cups_md5_state_t   state2;         /* Secondary MD5 state info */
1946     unsigned char       digest[16];     /* MD5 digest result */
1947     static char         result[120];    /* Final password string */
1948
1949
1950    /*
1951     * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
1952     * Get a maximum of 8 characters of salt data after $1$...
1953     */
1954
1955     for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
1956       if (*salt_end == '$')
1957         break;
1958
1959    /*
1960     * Compute the MD5 sum we need...
1961     */
1962
1963     pwlen = strlen(pw);
1964
1965     _cups_md5_init(&state);
1966     _cups_md5_append(&state, (unsigned char *)pw, pwlen);
1967     _cups_md5_append(&state, (unsigned char *)salt, salt_end - salt);
1968
1969     _cups_md5_init(&state2);
1970     _cups_md5_append(&state2, (unsigned char *)pw, pwlen);
1971     _cups_md5_append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
1972     _cups_md5_append(&state2, (unsigned char *)pw, pwlen);
1973     _cups_md5_finish(&state2, digest);
1974
1975     for (i = pwlen; i > 0; i -= 16)
1976       _cups_md5_append(&state, digest, i > 16 ? 16 : i);
1977
1978     for (i = pwlen; i > 0; i >>= 1)
1979       _cups_md5_append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
1980
1981     _cups_md5_finish(&state, digest);
1982
1983     for (i = 0; i < 1000; i ++)
1984     {
1985       _cups_md5_init(&state);
1986
1987       if (i & 1)
1988         _cups_md5_append(&state, (unsigned char *)pw, pwlen);
1989       else
1990         _cups_md5_append(&state, digest, 16);
1991
1992       if (i % 3)
1993         _cups_md5_append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
1994
1995       if (i % 7)
1996         _cups_md5_append(&state, (unsigned char *)pw, pwlen);
1997
1998       if (i & 1)
1999         _cups_md5_append(&state, digest, 16);
2000       else
2001         _cups_md5_append(&state, (unsigned char *)pw, pwlen);
2002
2003       _cups_md5_finish(&state, digest);
2004     }
2005
2006    /*
2007     * Copy the final sum to the result string and return...
2008     */
2009
2010     memcpy(result, salt, salt_end - salt);
2011     ptr = result + (salt_end - salt);
2012     *ptr++ = '$';
2013
2014     for (i = 0; i < 5; i ++, ptr += 4)
2015     {
2016       n = (((digest[i] << 8) | digest[i + 6]) << 8);
2017
2018       if (i < 4)
2019         n |= digest[i + 12];
2020       else
2021         n |= digest[5];
2022
2023       to64(ptr, n, 4);
2024     }
2025
2026     to64(ptr, digest[11], 2);
2027     ptr += 2;
2028     *ptr = '\0';
2029
2030     return (result);
2031   }
2032   else
2033   {
2034    /*
2035     * Use the standard crypt() function...
2036     */
2037
2038     return (crypt(pw, salt));
2039   }
2040 }
2041 #endif /* !HAVE_LIBPAM */
2042
2043
2044 #if HAVE_LIBPAM
2045 /*
2046  * 'pam_func()' - PAM conversation function.
2047  */
2048
2049 static int                              /* O - Success or failure */
2050 pam_func(
2051     int                      num_msg,   /* I - Number of messages */
2052     const struct pam_message **msg,     /* I - Messages */
2053     struct pam_response      **resp,    /* O - Responses */
2054     void                     *appdata_ptr)
2055                                         /* I - Pointer to connection */
2056 {
2057   int                   i;              /* Looping var */
2058   struct pam_response   *replies;       /* Replies */
2059   cupsd_authdata_t      *data;          /* Pointer to auth data */
2060
2061
2062  /*
2063   * Allocate memory for the responses...
2064   */
2065
2066   if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2067     return (PAM_CONV_ERR);
2068
2069  /*
2070   * Answer all of the messages...
2071   */
2072
2073   DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2074
2075 #ifdef __hpux
2076  /*
2077   * Apparently some versions of HP-UX 11 have a broken pam_unix security
2078   * module.  This is a workaround...
2079   */
2080
2081   data = auth_data;
2082   (void)appdata_ptr;
2083 #else
2084   data = (cupsd_authdata_t *)appdata_ptr;
2085 #endif /* __hpux */
2086
2087   for (i = 0; i < num_msg; i ++)
2088   {
2089     DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2090
2091     switch (msg[i]->msg_style)
2092     {
2093       case PAM_PROMPT_ECHO_ON:
2094           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2095                         data->username));
2096           replies[i].resp_retcode = PAM_SUCCESS;
2097           replies[i].resp         = strdup(data->username);
2098           break;
2099
2100       case PAM_PROMPT_ECHO_OFF:
2101           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2102                         data->password));
2103           replies[i].resp_retcode = PAM_SUCCESS;
2104           replies[i].resp         = strdup(data->password);
2105           break;
2106
2107       case PAM_TEXT_INFO:
2108           DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2109           replies[i].resp_retcode = PAM_SUCCESS;
2110           replies[i].resp         = NULL;
2111           break;
2112
2113       case PAM_ERROR_MSG:
2114           DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2115           replies[i].resp_retcode = PAM_SUCCESS;
2116           replies[i].resp         = NULL;
2117           break;
2118
2119       default:
2120           DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2121                         msg[i]->msg_style));
2122           free(replies);
2123           return (PAM_CONV_ERR);
2124     }
2125   }
2126
2127  /*
2128   * Return the responses back to PAM...
2129   */
2130
2131   *resp = replies;
2132
2133   return (PAM_SUCCESS);
2134 }
2135 #else
2136
2137
2138 /*
2139  * 'to64()' - Base64-encode an integer value...
2140  */
2141
2142 static void
2143 to64(char          *s,                  /* O - Output string */
2144      unsigned long v,                   /* I - Value to encode */
2145      int           n)                   /* I - Number of digits */
2146 {
2147   const char    *itoa64 = "./0123456789"
2148                           "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2149                           "abcdefghijklmnopqrstuvwxyz";
2150
2151
2152   for (; n > 0; n --, v >>= 6)
2153     *s++ = itoa64[v & 0x3f];
2154 }
2155 #endif /* HAVE_LIBPAM */
2156
2157
2158 /*
2159  * End of "$Id: auth.c 5222 2006-03-03 18:57:56Z mike $".
2160  */