scheduler/auth.c

   1 /*
   2  * "$Id: auth.c 5567 2006-05-22 15:33:11Z mike $"
   3  *
   4  *   Authorization routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
   7  *
   8  *   These coded instructions, statements, and computer programs are the
   9  *   property of Easy Software Products and are protected by Federal
  10  *   copyright law.  Distribution and use rights are outlined in the file
  11  *   "LICENSE.txt" which should have been included with this file.  If this
  12  *   file is missing or damaged please contact Easy Software Products
  13  *   at:
  14  *
  15  *       Attn: CUPS Licensing Information
  16  *       Easy Software Products
  17  *       44141 Airport View Drive, Suite 204
  18  *       Hollywood, Maryland 20636 USA
  19  *
  20  *       Voice: (301) 373-9600
  21  *       EMail: cups-info@cups.org
  22  *         WWW: http://www.cups.org
  23  *
  24  * Contents:
  25  *
  26  *   cupsdAddLocation()        - Add a location for authorization.
  27  *   cupsdAddName()            - Add a name to a location...
  28  *   cupsdAllowHost()          - Add a host name that is allowed to access the
  29  *                               location.
  30  *   cupsdAllowIP()            - Add an IP address or network that is allowed
  31  *                               to access the location.
  32  *   cupsdAuthorize()          - Validate any authorization credentials.
  33  *   cupsdCheckAuth()          - Check authorization masks.
  34  *   cupsdCheckGroup()         - Check for a user's group membership.
  35  *   cupsdCopyLocation()       - Make a copy of a location...
  36  *   cupsdDeleteAllLocations() - Free all memory used for location
  37  *                               authorization.
  38  *   cupsdDeleteLocation()     - Free all memory used by a location.
  39  *   cupsdDenyHost()           - Add a host name that is not allowed to access
  40  *                               the location.
  41  *   cupsdDenyIP()             - Add an IP address or network that is not
  42  *                               allowed to access the location.
  43  *   cupsdFindBest()           - Find the location entry that best matches the
  44  *                               resource.
  45  *   cupsdFindLocation()       - Find the named location.
  46  *   cupsdIsAuthorized()       - Check to see if the user is authorized...
  47  *   add_allow()               - Add an allow mask to the location.
  48  *   add_deny()                - Add a deny mask to the location.
  49  *   compare_locations()       - Compare two locations.
  50  *   cups_crypt()              - Encrypt the password using the DES or MD5
  51  *                               algorithms, as needed.
  52  *   get_md5_password()        - Get an MD5 password.
  53  *   pam_func()                - PAM conversation function.
  54  *   to64()                    - Base64-encode an integer value...
  55  */
  56
  57 /*
  58  * Include necessary headers...
  59  */
  60
  61 #include "cupsd.h"
  62 #include <grp.h>
  63 #ifdef HAVE_SHADOW_H
  64 #  include <shadow.h>
  65 #endif /* HAVE_SHADOW_H */
  66 #ifdef HAVE_CRYPT_H
  67 #  include <crypt.h>
  68 #endif /* HAVE_CRYPT_H */
  69 #if HAVE_LIBPAM
  70 #  ifdef HAVE_PAM_PAM_APPL_H
  71 #    include <pam/pam_appl.h>
  72 #  else
  73 #    include <security/pam_appl.h>
  74 #  endif /* HAVE_PAM_PAM_APPL_H */
  75 #endif /* HAVE_LIBPAM */
  76 #ifdef HAVE_USERSEC_H
  77 #  include <usersec.h>
  78 #endif /* HAVE_USERSEC_H */
  79 #ifdef HAVE_MEMBERSHIP_H
  80 #  include <membership.h>
  81 #endif /* HAVE_MEMBERSHIP_H */
  82
  83
  84 /*
  85  * Local functions...
  86  */
  87
  88 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
  89 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
  90 static int              compare_locations(cupsd_location_t *a,
  91                                           cupsd_location_t *b);
  92 #if !HAVE_LIBPAM
  93 static char             *cups_crypt(const char *pw, const char *salt);
  94 #endif /* !HAVE_LIBPAM */
  95 static char             *get_md5_password(const char *username,
  96                                           const char *group, char passwd[33]);
  97 #if HAVE_LIBPAM
  98 static int              pam_func(int, const struct pam_message **,
  99                                  struct pam_response **, void *);
 100 #else
 101 static void             to64(char *s, unsigned long v, int n);
 102 #endif /* HAVE_LIBPAM */
 103
 104
 105 /*
 106  * Local structures...
 107  */
 108
 109 #if HAVE_LIBPAM
 110 typedef struct cupsd_authdata_s         /**** Authentication data ****/
 111 {
 112   char  username[33],                   /* Username string */
 113         password[33];                   /* Password string */
 114 } cupsd_authdata_t;
 115 #endif /* HAVE_LIBPAM */
 116
 117
 118 /*
 119  * Local globals...
 120  */
 121
 122 #if defined(__hpux) && HAVE_LIBPAM
 123 static cupsd_authdata_t *auth_data;     /* Current client being authenticated */
 124 #endif /* __hpux && HAVE_LIBPAM */
 125
 126
 127 /*
 128  * 'cupsdAddLocation()' - Add a location for authorization.
 129  */
 130
 131 cupsd_location_t *                      /* O - Pointer to new location record */
 132 cupsdAddLocation(const char *location)  /* I - Location path */
 133 {
 134   cupsd_location_t      *temp;          /* New location */
 135
 136
 137  /*
 138   * Make sure the locations array is created...
 139   */
 140
 141   if (!Locations)
 142     Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
 143
 144   if (!Locations)
 145     return (NULL);
 146
 147  /*
 148   * Try to allocate memory for the new location.
 149   */
 150
 151   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
 152     return (NULL);
 153
 154  /*
 155   * Initialize the record and copy the name over...
 156   */
 157
 158   temp->location = strdup(location);
 159   temp->length   = strlen(temp->location);
 160
 161   cupsArrayAdd(Locations, temp);
 162
 163   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
 164                   location);
 165
 166  /*
 167   * Return the new record...
 168   */
 169
 170   return (temp);
 171 }
 172
 173
 174 /*
 175  * 'cupsdAddName()' - Add a name to a location...
 176  */
 177
 178 void
 179 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 180              char             *name)    /* I - Name to add */
 181 {
 182   char  **temp;                         /* Pointer to names array */
 183
 184
 185   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
 186                   loc, name);
 187
 188   if (loc->num_names == 0)
 189     temp = malloc(sizeof(char *));
 190   else
 191     temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
 192
 193   if (temp == NULL)
 194   {
 195     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
 196                     loc->location ? loc->location : "nil", strerror(errno));
 197     return;
 198   }
 199
 200   loc->names = temp;
 201
 202   if ((temp[loc->num_names] = strdup(name)) == NULL)
 203   {
 204     cupsdLogMessage(CUPSD_LOG_ERROR,
 205                     "Unable to duplicate name for location %s: %s",
 206                     loc->location ? loc->location : "nil", strerror(errno));
 207     return;
 208   }
 209
 210   loc->num_names ++;
 211 }
 212
 213
 214 /*
 215  * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
 216  */
 217
 218 void
 219 cupsdAllowHost(cupsd_location_t *loc,   /* I - Location to add to */
 220                char             *name)  /* I - Name of host or domain to add */
 221 {
 222   cupsd_authmask_t      *temp;          /* New host/domain mask */
 223   char                  ifname[32],     /* Interface name */
 224                         *ifptr;         /* Pointer to end of name */
 225
 226
 227   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
 228                   loc, loc->location ? loc->location : "nil", name);
 229
 230   if ((temp = add_allow(loc)) == NULL)
 231     return;
 232
 233   if (!strcasecmp(name, "@LOCAL"))
 234   {
 235    /*
 236     * Allow *interface*...
 237     */
 238
 239     temp->type             = AUTH_INTERFACE;
 240     temp->mask.name.name   = strdup("*");
 241     temp->mask.name.length = 1;
 242   }
 243   else if (!strncasecmp(name, "@IF(", 4))
 244   {
 245    /*
 246     * Allow *interface*...
 247     */
 248
 249     strlcpy(ifname, name + 4, sizeof(ifname));
 250
 251     ifptr = ifname + strlen(ifname);
 252
 253     if (ifptr[-1] == ')')
 254     {
 255       ifptr --;
 256       *ifptr = '\0';
 257     }
 258
 259     temp->type             = AUTH_INTERFACE;
 260     temp->mask.name.name   = strdup(ifname);
 261     temp->mask.name.length = ifptr - ifname;
 262   }
 263   else
 264   {
 265    /*
 266     * Allow name...
 267     */
 268
 269     temp->type             = AUTH_NAME;
 270     temp->mask.name.name   = strdup(name);
 271     temp->mask.name.length = strlen(name);
 272   }
 273 }
 274
 275
 276 /*
 277  * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
 278  *                    the location.
 279  */
 280
 281 void
 282 cupsdAllowIP(cupsd_location_t *loc,     /* I - Location to add to */
 283              unsigned   address[4],     /* I - IP address to add */
 284              unsigned   netmask[4])     /* I - Netmask of address */
 285 {
 286   cupsd_authmask_t      *temp;          /* New host/domain mask */
 287
 288
 289   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 290                   "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
 291                   loc, loc->location ? loc->location : "nil",
 292                   address[0], address[1], address[2], address[3],
 293                   netmask[0], netmask[1], netmask[2], netmask[3]);
 294
 295   if ((temp = add_allow(loc)) == NULL)
 296     return;
 297
 298   temp->type = AUTH_IP;
 299   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
 300   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
 301 }
 302
 303
 304 /*
 305  * 'cupsdAuthorize()' - Validate any authorization credentials.
 306  */
 307
 308 void
 309 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 310 {
 311   int           type;                   /* Authentication type */
 312   char          *authorization,         /* Pointer into Authorization string */
 313                 *ptr,                   /* Pointer into string */
 314                 username[65],           /* Username string */
 315                 password[33];           /* Password string */
 316   const char    *localuser;             /* Certificate username */
 317   char          nonce[HTTP_MAX_VALUE],  /* Nonce value from client */
 318                 md5[33],                /* MD5 password */
 319                 basicmd5[33];           /* MD5 of Basic password */
 320   static const char * const states[] =  /* HTTP client states... */
 321                 {
 322                   "WAITING",
 323                   "OPTIONS",
 324                   "GET",
 325                   "GET",
 326                   "HEAD",
 327                   "POST",
 328                   "POST",
 329                   "POST",
 330                   "PUT",
 331                   "PUT",
 332                   "DELETE",
 333                   "TRACE",
 334                   "CLOSE",
 335                   "STATUS"
 336                 };
 337
 338
 339  /*
 340   * Locate the best matching location so we know what kind of
 341   * authentication to expect...
 342   */
 343
 344   con->best = cupsdFindBest(con->uri, con->http.state);
 345
 346   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 347                   "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
 348                   con->uri, con->best, con->best ? con->best->location : "");
 349
 350   if (con->best && con->best->type != AUTH_NONE)
 351     type = con->best->type;
 352   else
 353     type = DefaultAuthType;
 354
 355  /*
 356   * Decode the Authorization string...
 357   */
 358
 359   authorization = con->http.fields[HTTP_FIELD_AUTHORIZATION];
 360
 361   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
 362                   authorization);
 363
 364   username[0] = '\0';
 365   password[0] = '\0';
 366
 367   if (type == AUTH_NONE)
 368   {
 369    /*
 370     * No authorization required, return early...
 371     */
 372
 373     cupsdLogMessage(CUPSD_LOG_DEBUG,
 374                     "cupsdAuthorize: No authentication required.");
 375     return;
 376   }
 377   else if (!*authorization)
 378   {
 379    /*
 380     * No authorization data provided, return early...
 381     */
 382
 383     cupsdLogMessage(CUPSD_LOG_DEBUG,
 384                     "cupsdAuthorize: No authentication data provided.");
 385     return;
 386   }
 387   else if (!strncmp(authorization, "Local", 5) &&
 388            !strcasecmp(con->http.hostname, "localhost"))
 389   {
 390    /*
 391     * Get Local certificate authentication data...
 392     */
 393
 394     authorization += 5;
 395     while (isspace(*authorization & 255))
 396       authorization ++;
 397
 398     if ((localuser = cupsdFindCert(authorization)) != NULL)
 399       strlcpy(username, localuser, sizeof(username));
 400     else
 401     {
 402       cupsdLogMessage(CUPSD_LOG_ERROR,
 403                       "cupsdAuthorize: Local authentication certificate not "
 404                       "found!");
 405       return;
 406     }
 407   }
 408   else if (!strncmp(authorization, "Basic", 5) &&
 409            (type == AUTH_BASIC || type == AUTH_BASICDIGEST))
 410   {
 411    /*
 412     * Get the Basic authentication data...
 413     */
 414
 415     int userlen;                        /* Username:password length */
 416
 417
 418     authorization += 5;
 419     while (isspace(*authorization & 255))
 420       authorization ++;
 421
 422     userlen = sizeof(username);
 423     httpDecode64_2(username, &userlen, authorization);
 424
 425    /*
 426     * Pull the username and password out...
 427     */
 428
 429     if ((ptr = strchr(username, ':')) == NULL)
 430     {
 431       cupsdLogMessage(CUPSD_LOG_ERROR,
 432                       "cupsdAuthorize: Missing Basic password!");
 433       return;
 434     }
 435
 436     *ptr++ = '\0';
 437
 438     if (!username[0])
 439     {
 440      /*
 441       * Username must not be empty...
 442       */
 443
 444       cupsdLogMessage(CUPSD_LOG_ERROR,
 445                       "cupsdAuthorize: Empty Basic username!");
 446       return;
 447     }
 448
 449     if (!*ptr)
 450     {
 451      /*
 452       * Password must not be empty...
 453       */
 454
 455       cupsdLogMessage(CUPSD_LOG_ERROR,
 456                       "cupsdAuthorize: Empty Basic password!");
 457       return;
 458     }
 459
 460     strlcpy(password, ptr, sizeof(password));
 461
 462    /*
 463     * Validate the username and password...
 464     */
 465
 466     switch (type)
 467     {
 468       case AUTH_BASIC :
 469           {
 470 #if HAVE_LIBPAM
 471            /*
 472             * Only use PAM to do authentication.  This supports MD5
 473             * passwords, among other things...
 474             */
 475
 476             pam_handle_t        *pamh;  /* PAM authentication handle */
 477             int                 pamerr; /* PAM error code */
 478             struct pam_conv     pamdata;/* PAM conversation data */
 479             cupsd_authdata_t    data;   /* Authentication data */
 480
 481
 482             strlcpy(data.username, username, sizeof(data.username));
 483             strlcpy(data.password, password, sizeof(data.password));
 484
 485 #  ifdef __sun
 486             pamdata.conv        = (int (*)(int, struct pam_message **,
 487                                            struct pam_response **,
 488                                            void *))pam_func;
 489 #  else
 490             pamdata.conv        = pam_func;
 491 #  endif /* __sun */
 492             pamdata.appdata_ptr = &data;
 493
 494 #  ifdef __hpux
 495            /*
 496             * Workaround for HP-UX bug in pam_unix; see pam_func() below for
 497             * more info...
 498             */
 499
 500             auth_data = &data;
 501 #  endif /* __hpux */
 502
 503             pamerr = pam_start("cups", username, &pamdata, &pamh);
 504             if (pamerr != PAM_SUCCESS)
 505             {
 506               cupsdLogMessage(CUPSD_LOG_ERROR,
 507                               "cupsdAuthorize: pam_start() returned %d (%s)!\n",
 508                               pamerr, pam_strerror(pamh, pamerr));
 509               pam_end(pamh, 0);
 510               return;
 511             }
 512
 513             pamerr = pam_authenticate(pamh, PAM_SILENT);
 514             if (pamerr != PAM_SUCCESS)
 515             {
 516               cupsdLogMessage(CUPSD_LOG_ERROR,
 517                               "cupsdAuthorize: pam_authenticate() returned %d "
 518                               "(%s)!\n",
 519                               pamerr, pam_strerror(pamh, pamerr));
 520               pam_end(pamh, 0);
 521               return;
 522             }
 523
 524             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 525             if (pamerr != PAM_SUCCESS)
 526             {
 527               cupsdLogMessage(CUPSD_LOG_ERROR,
 528                               "cupsdAuthorize: pam_acct_mgmt() returned %d "
 529                               "(%s)!\n",
 530                               pamerr, pam_strerror(pamh, pamerr));
 531               pam_end(pamh, 0);
 532               return;
 533             }
 534
 535             pam_end(pamh, PAM_SUCCESS);
 536
 537 #elif defined(HAVE_USERSEC_H)
 538            /*
 539             * Use AIX authentication interface...
 540             */
 541
 542             char        *authmsg;       /* Authentication message */
 543             char        *loginmsg;      /* Login message */
 544             int         reenter;        /* ??? */
 545
 546
 547             cupsdLogMessage(CUPSD_LOG_DEBUG,
 548                             "cupsdAuthorize: AIX authenticate of username \"%s\"",
 549                             username);
 550
 551             reenter = 1;
 552             if (authenticate(username, password, &reenter, &authmsg) != 0)
 553             {
 554               cupsdLogMessage(CUPSD_LOG_DEBUG,
 555                               "cupsdAuthorize: Unable to authenticate username "
 556                               "\"%s\": %s",
 557                               username, strerror(errno));
 558               return;
 559             }
 560
 561 #else
 562            /*
 563             * Use normal UNIX password file-based authentication...
 564             */
 565
 566             char                *pass;  /* Encrypted password */
 567             struct passwd       *pw;    /* User password data */
 568 #  ifdef HAVE_SHADOW_H
 569             struct spwd         *spw;   /* Shadow password data */
 570 #  endif /* HAVE_SHADOW_H */
 571
 572
 573             pw = getpwnam(username);    /* Get the current password */
 574             endpwent();                 /* Close the password file */
 575
 576             if (!pw)
 577             {
 578              /*
 579               * No such user...
 580               */
 581
 582               cupsdLogMessage(CUPSD_LOG_ERROR,
 583                               "cupsdAuthorize: Unknown username \"%s\"!",
 584                               username);
 585               return;
 586             }
 587
 588 #  ifdef HAVE_SHADOW_H
 589             spw = getspnam(username);
 590             endspent();
 591
 592             if (!spw && !strcmp(pw->pw_passwd, "x"))
 593             {
 594              /*
 595               * Don't allow blank passwords!
 596               */
 597
 598               cupsdLogMessage(CUPSD_LOG_ERROR,
 599                               "cupsdAuthorize: Username \"%s\" has no shadow "
 600                               "password!", username);
 601               return;
 602             }
 603
 604             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 605 #  else
 606             if (!pw->pw_passwd[0])
 607 #  endif /* HAVE_SHADOW_H */
 608             {
 609              /*
 610               * Don't allow blank passwords!
 611               */
 612
 613               cupsdLogMessage(CUPSD_LOG_ERROR,
 614                               "cupsdAuthorize: Username \"%s\" has no password!",
 615                               username);
 616               return;
 617             }
 618
 619            /*
 620             * OK, the password isn't blank, so compare with what came from the
 621             * client...
 622             */
 623
 624             pass = cups_crypt(password, pw->pw_passwd);
 625
 626             cupsdLogMessage(CUPSD_LOG_DEBUG2,
 627                             "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
 628                             pw->pw_passwd, pass);
 629
 630             if (!pass || strcmp(pw->pw_passwd, pass))
 631             {
 632 #  ifdef HAVE_SHADOW_H
 633               if (spw)
 634               {
 635                 pass = cups_crypt(password, spw->sp_pwdp);
 636
 637                 cupsdLogMessage(CUPSD_LOG_DEBUG2,
 638                                 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
 639                                 spw->sp_pwdp, pass);
 640
 641                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 642                 {
 643                   cupsdLogMessage(CUPSD_LOG_ERROR,
 644                                   "cupsdAuthorize: Authentication failed for "
 645                                   "user \"%s\"!",
 646                                   username);
 647                   return;
 648                 }
 649               }
 650               else
 651 #  endif /* HAVE_SHADOW_H */
 652               {
 653                 cupsdLogMessage(CUPSD_LOG_ERROR,
 654                                 "cupsdAuthorize: Authentication failed for "
 655                                 "user \"%s\"!",
 656                                 username);
 657                 return;
 658               }
 659             }
 660 #endif /* HAVE_LIBPAM */
 661           }
 662           break;
 663
 664       case AUTH_BASICDIGEST :
 665          /*
 666           * Do Basic authentication with the Digest password file...
 667           */
 668
 669           if (!get_md5_password(username, NULL, md5))
 670           {
 671             cupsdLogMessage(CUPSD_LOG_ERROR,
 672                             "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 673                             username);
 674             return;
 675           }
 676
 677           httpMD5(username, "CUPS", password, basicmd5);
 678
 679           if (strcmp(md5, basicmd5))
 680           {
 681             cupsdLogMessage(CUPSD_LOG_ERROR,
 682                             "cupsdAuthorize: Authentication failed for \"%s\"!",
 683                             username);
 684             return;
 685           }
 686           break;
 687     }
 688   }
 689   else if (!strncmp(authorization, "Digest", 6) && type == AUTH_DIGEST)
 690   {
 691    /*
 692     * Get the username, password, and nonce from the Digest attributes...
 693     */
 694
 695     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
 696                           username, sizeof(username)) || !username[0])
 697     {
 698      /*
 699       * Username must not be empty...
 700       */
 701
 702       cupsdLogMessage(CUPSD_LOG_ERROR,
 703                       "cupsdAuthorize: Empty or missing Digest username!");
 704       return;
 705     }
 706
 707     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
 708                           password, sizeof(password)) || !password[0])
 709     {
 710      /*
 711       * Password must not be empty...
 712       */
 713
 714       cupsdLogMessage(CUPSD_LOG_ERROR,
 715                       "cupsdAuthorize: Empty or missing Digest password!");
 716       return;
 717     }
 718
 719     if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
 720                          nonce))
 721     {
 722       cupsdLogMessage(CUPSD_LOG_ERROR,
 723                       "cupsdAuthorize: No nonce value for Digest "
 724                       "authentication!");
 725       return;
 726     }
 727
 728     if (strcmp(con->http.hostname, nonce))
 729     {
 730       cupsdLogMessage(CUPSD_LOG_ERROR,
 731                       "cupsdAuthorize: Bad nonce value, expected \"%s\", "
 732                       "got \"%s\"!", con->http.hostname, nonce);
 733       return;
 734     }
 735
 736    /*
 737     * Validate the username and password...
 738     */
 739
 740     if (!get_md5_password(username, NULL, md5))
 741     {
 742       cupsdLogMessage(CUPSD_LOG_ERROR,
 743                       "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 744                       username);
 745       return;
 746     }
 747
 748     httpMD5Final(nonce, states[con->http.state], con->uri, md5);
 749
 750     if (strcmp(md5, password))
 751     {
 752       cupsdLogMessage(CUPSD_LOG_ERROR,
 753                       "cupsdAuthorize: Authentication failed for \"%s\"!",
 754                       username);
 755       return;
 756     }
 757   }
 758   else
 759   {
 760     cupsdLogMessage(CUPSD_LOG_DEBUG,
 761                     "cupsdAuthorize: Bad authentication data.");
 762     return;
 763   }
 764
 765  /*
 766   * If we get here, then we were able to validate the username and
 767   * password - copy the validated username and password to the client
 768   * data and return...
 769   */
 770
 771   strlcpy(con->username, username, sizeof(con->username));
 772   strlcpy(con->password, password, sizeof(con->password));
 773
 774   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: username=\"%s\"",
 775                   con->username);
 776 }
 777
 778
 779 /*
 780  * 'cupsdCheckAuth()' - Check authorization masks.
 781  */
 782
 783 int                                     /* O - 1 if mask matches, 0 otherwise */
 784 cupsdCheckAuth(
 785     unsigned         ip[4],             /* I - Client address */
 786     char             *name,             /* I - Client hostname */
 787     int              name_len,          /* I - Length of hostname */
 788     int              num_masks,         /* I - Number of masks */
 789     cupsd_authmask_t *masks)            /* I - Masks */
 790 {
 791   int           i;                      /* Looping var */
 792   cupsd_netif_t *iface;                 /* Network interface */
 793   unsigned      netip4;                 /* IPv4 network address */
 794 #ifdef AF_INET6
 795   unsigned      netip6[4];              /* IPv6 network address */
 796 #endif /* AF_INET6 */
 797
 798   while (num_masks > 0)
 799   {
 800     switch (masks->type)
 801     {
 802       case AUTH_INTERFACE :
 803          /*
 804           * Check for a match with a network interface...
 805           */
 806
 807           netip4 = htonl(ip[3]);
 808
 809 #ifdef AF_INET6
 810           netip6[0] = htonl(ip[0]);
 811           netip6[1] = htonl(ip[1]);
 812           netip6[2] = htonl(ip[2]);
 813           netip6[3] = htonl(ip[3]);
 814 #endif /* AF_INET6 */
 815
 816           if (!strcmp(masks->mask.name.name, "*"))
 817           {
 818            /*
 819             * Check against all local interfaces...
 820             */
 821
 822             cupsdNetIFUpdate();
 823
 824             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 825                  iface;
 826                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 827             {
 828              /*
 829               * Only check local interfaces...
 830               */
 831
 832               if (!iface->is_local)
 833                 continue;
 834
 835               if (iface->address.addr.sa_family == AF_INET)
 836               {
 837                /*
 838                 * Check IPv4 address...
 839                 */
 840
 841                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 842                     (iface->address.ipv4.sin_addr.s_addr &
 843                      iface->mask.ipv4.sin_addr.s_addr))
 844                   return (1);
 845               }
 846 #ifdef AF_INET6
 847               else
 848               {
 849                /*
 850                 * Check IPv6 address...
 851                 */
 852
 853                 for (i = 0; i < 4; i ++)
 854                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 855                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 856                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 857                     break;
 858
 859                 if (i == 4)
 860                   return (1);
 861               }
 862 #endif /* AF_INET6 */
 863             }
 864           }
 865           else
 866           {
 867            /*
 868             * Check the named interface...
 869             */
 870
 871             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 872                  iface && !strcmp(masks->mask.name.name, iface->name);
 873                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 874             {
 875               if (iface->address.addr.sa_family == AF_INET)
 876               {
 877                /*
 878                 * Check IPv4 address...
 879                 */
 880
 881                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 882                     (iface->address.ipv4.sin_addr.s_addr &
 883                      iface->mask.ipv4.sin_addr.s_addr))
 884                   return (1);
 885               }
 886 #ifdef AF_INET6
 887               else
 888               {
 889                /*
 890                 * Check IPv6 address...
 891                 */
 892
 893                 for (i = 0; i < 4; i ++)
 894                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 895                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 896                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 897                     break;
 898
 899                 if (i == 4)
 900                   return (1);
 901               }
 902 #endif /* AF_INET6 */
 903             }
 904           }
 905           break;
 906
 907       case AUTH_NAME :
 908          /*
 909           * Check for exact name match...
 910           */
 911
 912           if (!strcasecmp(name, masks->mask.name.name))
 913             return (1);
 914
 915          /*
 916           * Check for domain match...
 917           */
 918
 919           if (name_len >= masks->mask.name.length &&
 920               masks->mask.name.name[0] == '.' &&
 921               !strcasecmp(name + name_len - masks->mask.name.length,
 922                           masks->mask.name.name))
 923             return (1);
 924           break;
 925
 926       case AUTH_IP :
 927          /*
 928           * Check for IP/network address match...
 929           */
 930
 931           for (i = 0; i < 4; i ++)
 932             if ((ip[i] & masks->mask.ip.netmask[i]) !=
 933                     masks->mask.ip.address[i])
 934               break;
 935
 936           if (i == 4)
 937             return (1);
 938           break;
 939     }
 940
 941     masks ++;
 942     num_masks --;
 943   }
 944
 945   return (0);
 946 }
 947
 948
 949 /*
 950  * 'cupsdCheckGroup()' - Check for a user's group membership.
 951  */
 952
 953 int                                     /* O - 1 if user is a member, 0 otherwise */
 954 cupsdCheckGroup(
 955     const char    *username,            /* I - User name */
 956     struct passwd *user,                /* I - System user info */
 957     const char    *groupname)           /* I - Group name */
 958 {
 959   int                   i;              /* Looping var */
 960   struct group          *group;         /* System group info */
 961   char                  junk[33];       /* MD5 password (not used) */
 962 #ifdef HAVE_MBR_UID_TO_UUID
 963   uuid_t                useruuid,       /* UUID for username */
 964                         groupuuid;      /* UUID for groupname */
 965   int                   is_member;      /* True if user is a member of group */
 966 #endif /* HAVE_MBR_UID_TO_UUID */
 967
 968
 969   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 970                   "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
 971                   username, user, groupname);
 972
 973  /*
 974   * Validate input...
 975   */
 976
 977   if (!username || !groupname)
 978     return (0);
 979
 980  /*
 981   * Check to see if the user is a member of the named group...
 982   */
 983
 984   group = getgrnam(groupname);
 985   endgrent();
 986
 987   if (group != NULL)
 988   {
 989    /*
 990     * Group exists, check it...
 991     */
 992
 993     for (i = 0; group->gr_mem[i]; i ++)
 994       if (!strcasecmp(username, group->gr_mem[i]))
 995         return (1);
 996   }
 997
 998  /*
 999   * Group doesn't exist or user not in group list, check the group ID
1000   * against the user's group ID...
1001   */
1002
1003   if (user && group && group->gr_gid == user->pw_gid)
1004     return (1);
1005
1006 #ifdef HAVE_MBR_UID_TO_UUID
1007  /*
1008   * Check group membership through MacOS X membership API...
1009   */
1010
1011   if (user && group)
1012     if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1013       if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1014         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1015           if (is_member)
1016             return (1);
1017 #endif /* HAVE_MBR_UID_TO_UUID */
1018
1019  /*
1020   * Username not found, group not found, or user is not part of the
1021   * system group...  Check for a user and group in the MD5 password
1022   * file...
1023   */
1024
1025   if (get_md5_password(username, groupname, junk) != NULL)
1026     return (1);
1027
1028  /*
1029   * If we get this far, then the user isn't part of the named group...
1030   */
1031
1032   return (0);
1033 }
1034
1035
1036 /*
1037  * 'cupsdCopyLocation()' - Make a copy of a location...
1038  */
1039
1040 cupsd_location_t *                      /* O - New location */
1041 cupsdCopyLocation(
1042     cupsd_location_t **loc)             /* IO - Original location */
1043 {
1044   int                   i;              /* Looping var */
1045   cupsd_location_t      *temp;          /* New location */
1046   char                  location[HTTP_MAX_URI];
1047                                         /* Location of resource */
1048
1049
1050  /*
1051   * Use a local copy of location because cupsdAddLocation may cause
1052   * this memory to be moved...
1053   */
1054
1055   strlcpy(location, (*loc)->location, sizeof(location));
1056
1057   if ((temp = cupsdAddLocation(location)) == NULL)
1058     return (NULL);
1059
1060  /*
1061   * Copy the information from the original location to the new one.
1062   */
1063
1064   temp->limit      = (*loc)->limit;
1065   temp->order_type = (*loc)->order_type;
1066   temp->type       = (*loc)->type;
1067   temp->level      = (*loc)->level;
1068   temp->satisfy    = (*loc)->satisfy;
1069   temp->encryption = (*loc)->encryption;
1070
1071   if ((temp->num_names  = (*loc)->num_names) > 0)
1072   {
1073    /*
1074     * Copy the names array...
1075     */
1076
1077     if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1078     {
1079       cupsdLogMessage(CUPSD_LOG_ERROR,
1080                       "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1081                       temp->num_names, strerror(errno));
1082
1083       cupsdDeleteLocation(temp);
1084       return (NULL);
1085     }
1086
1087     for (i = 0; i < temp->num_names; i ++)
1088       if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1089       {
1090         cupsdLogMessage(CUPSD_LOG_ERROR,
1091                         "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1092                         (*loc)->names[i], strerror(errno));
1093
1094         cupsdDeleteLocation(temp);
1095         return (NULL);
1096       }
1097   }
1098
1099   if ((temp->num_allow  = (*loc)->num_allow) > 0)
1100   {
1101    /*
1102     * Copy allow rules...
1103     */
1104
1105     if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1106     {
1107       cupsdLogMessage(CUPSD_LOG_ERROR,
1108                       "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1109                       temp->num_allow, strerror(errno));
1110       cupsdDeleteLocation(temp);
1111       return (NULL);
1112     }
1113
1114     for (i = 0; i < temp->num_allow; i ++)
1115       switch (temp->allow[i].type = (*loc)->allow[i].type)
1116       {
1117         case AUTH_NAME :
1118             temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1119             temp->allow[i].mask.name.name   = strdup((*loc)->allow[i].mask.name.name);
1120
1121             if (temp->allow[i].mask.name.name == NULL)
1122             {
1123               cupsdLogMessage(CUPSD_LOG_ERROR,
1124                               "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1125                               (*loc)->allow[i].mask.name.name, strerror(errno));
1126               cupsdDeleteLocation(temp);
1127               return (NULL);
1128             }
1129             break;
1130         case AUTH_IP :
1131             memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1132                    sizeof(cupsd_ipmask_t));
1133             break;
1134       }
1135   }
1136
1137   if ((temp->num_deny  = (*loc)->num_deny) > 0)
1138   {
1139    /*
1140     * Copy deny rules...
1141     */
1142
1143     if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1144     {
1145       cupsdLogMessage(CUPSD_LOG_ERROR,
1146                       "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1147                       temp->num_deny, strerror(errno));
1148       cupsdDeleteLocation(temp);
1149       return (NULL);
1150     }
1151
1152     for (i = 0; i < temp->num_deny; i ++)
1153       switch (temp->deny[i].type = (*loc)->deny[i].type)
1154       {
1155         case AUTH_NAME :
1156             temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1157             temp->deny[i].mask.name.name   = strdup((*loc)->deny[i].mask.name.name);
1158
1159             if (temp->deny[i].mask.name.name == NULL)
1160             {
1161               cupsdLogMessage(CUPSD_LOG_ERROR,
1162                               "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1163                               (*loc)->deny[i].mask.name.name, strerror(errno));
1164               cupsdDeleteLocation(temp);
1165               return (NULL);
1166             }
1167             break;
1168         case AUTH_IP :
1169             memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1170                    sizeof(cupsd_ipmask_t));
1171             break;
1172       }
1173   }
1174
1175   return (temp);
1176 }
1177
1178
1179 /*
1180  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1181  */
1182
1183 void
1184 cupsdDeleteAllLocations(void)
1185 {
1186   cupsd_location_t      *loc;           /* Current location */
1187
1188
1189  /*
1190   * Free all of the allow/deny records first...
1191   */
1192
1193   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1194        loc;
1195        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1196     cupsdDeleteLocation(loc);
1197
1198  /*
1199   * Then free the location array...
1200   */
1201
1202   cupsArrayDelete(Locations);
1203   Locations = NULL;
1204 }
1205
1206
1207 /*
1208  * 'cupsdDeleteLocation()' - Free all memory used by a location.
1209  */
1210
1211 void
1212 cupsdDeleteLocation(
1213     cupsd_location_t *loc)              /* I - Location to delete */
1214 {
1215   int                   i;              /* Looping var */
1216   cupsd_authmask_t      *mask;          /* Current mask */
1217
1218
1219   cupsArrayRemove(Locations, loc);
1220
1221   for (i = loc->num_names - 1; i >= 0; i --)
1222     free(loc->names[i]);
1223
1224   if (loc->num_names > 0)
1225     free(loc->names);
1226
1227   for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1228     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1229       free(mask->mask.name.name);
1230
1231   if (loc->num_allow > 0)
1232     free(loc->allow);
1233
1234   for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1235     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1236       free(mask->mask.name.name);
1237
1238   if (loc->num_deny > 0)
1239     free(loc->deny);
1240
1241   free(loc->location);
1242   free(loc);
1243 }
1244
1245
1246 /*
1247  * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1248  *                     location.
1249  */
1250
1251 void
1252 cupsdDenyHost(cupsd_location_t *loc,    /* I - Location to add to */
1253               char             *name)   /* I - Name of host or domain to add */
1254 {
1255   cupsd_authmask_t      *temp;          /* New host/domain mask */
1256   char                  ifname[32],     /* Interface name */
1257                         *ifptr;         /* Pointer to end of name */
1258
1259
1260   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1261                   loc, loc->location ? loc->location : "nil", name);
1262
1263   if ((temp = add_deny(loc)) == NULL)
1264     return;
1265
1266   if (!strcasecmp(name, "@LOCAL"))
1267   {
1268    /*
1269     * Deny *interface*...
1270     */
1271
1272     temp->type             = AUTH_INTERFACE;
1273     temp->mask.name.name   = strdup("*");
1274     temp->mask.name.length = 1;
1275   }
1276   else if (!strncasecmp(name, "@IF(", 4))
1277   {
1278    /*
1279     * Deny *interface*...
1280     */
1281
1282     strlcpy(ifname, name + 4, sizeof(ifname));
1283
1284     ifptr = ifname + strlen(ifname);
1285
1286     if (ifptr[-1] == ')')
1287     {
1288       ifptr --;
1289       *ifptr = '\0';
1290     }
1291
1292     temp->type             = AUTH_INTERFACE;
1293     temp->mask.name.name   = strdup(ifname);
1294     temp->mask.name.length = ifptr - ifname;
1295   }
1296   else
1297   {
1298    /*
1299     * Deny name...
1300     */
1301
1302     temp->type             = AUTH_NAME;
1303     temp->mask.name.name   = strdup(name);
1304     temp->mask.name.length = strlen(name);
1305   }
1306 }
1307
1308
1309 /*
1310  * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1311  *                   access the location.
1312  */
1313
1314 void
1315 cupsdDenyIP(cupsd_location_t *loc,      /* I - Location to add to */
1316             unsigned         address[4],/* I - IP address to add */
1317             unsigned         netmask[4])/* I - Netmask of address */
1318 {
1319   cupsd_authmask_t      *temp;          /* New host/domain mask */
1320
1321
1322   cupsdLogMessage(CUPSD_LOG_DEBUG,
1323                   "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1324                   loc, loc->location ? loc->location : "nil",
1325                   address[0], address[1], address[2], address[3],
1326                   netmask[0], netmask[1], netmask[2], netmask[3]);
1327
1328   if ((temp = add_deny(loc)) == NULL)
1329     return;
1330
1331   temp->type = AUTH_IP;
1332   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1333   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1334 }
1335
1336
1337 /*
1338  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1339  */
1340
1341 cupsd_location_t *                      /* O - Location that matches */
1342 cupsdFindBest(const char   *path,       /* I - Resource path */
1343               http_state_t state)       /* I - HTTP state/request */
1344 {
1345   char                  uri[HTTP_MAX_URI],
1346                                         /* URI in request... */
1347                         *uriptr;        /* Pointer into URI */
1348   cupsd_location_t      *loc,           /* Current location */
1349                         *best;          /* Best match for location so far */
1350   int                   bestlen;        /* Length of best match */
1351   int                   limit;          /* Limit field */
1352   static const int      limits[] =      /* Map http_status_t to AUTH_LIMIT_xyz */
1353                 {
1354                   AUTH_LIMIT_ALL,
1355                   AUTH_LIMIT_OPTIONS,
1356                   AUTH_LIMIT_GET,
1357                   AUTH_LIMIT_GET,
1358                   AUTH_LIMIT_HEAD,
1359                   AUTH_LIMIT_POST,
1360                   AUTH_LIMIT_POST,
1361                   AUTH_LIMIT_POST,
1362                   AUTH_LIMIT_PUT,
1363                   AUTH_LIMIT_PUT,
1364                   AUTH_LIMIT_DELETE,
1365                   AUTH_LIMIT_TRACE,
1366                   AUTH_LIMIT_ALL,
1367                   AUTH_LIMIT_ALL
1368                 };
1369
1370
1371  /*
1372   * First copy the connection URI to a local string so we have drop
1373   * any .ppd extension from the pathname in /printers or /classes
1374   * URIs...
1375   */
1376
1377   strlcpy(uri, path, sizeof(uri));
1378
1379   if (!strncmp(uri, "/printers/", 10) ||
1380       !strncmp(uri, "/classes/", 9))
1381   {
1382    /*
1383     * Check if the URI has .ppd on the end...
1384     */
1385
1386     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1387
1388     if (!strcmp(uriptr, ".ppd"))
1389       *uriptr = '\0';
1390   }
1391
1392   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1393
1394  /*
1395   * Loop through the list of locations to find a match...
1396   */
1397
1398   limit   = limits[state];
1399   best    = NULL;
1400   bestlen = 0;
1401
1402   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1403        loc;
1404        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1405   {
1406     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1407                     loc->location ? loc->location : "nil", loc->limit);
1408
1409     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1410     {
1411      /*
1412       * Use case-insensitive comparison for queue names...
1413       */
1414
1415       if (loc->length > bestlen && loc->location &&
1416           !strncasecmp(uri, loc->location, loc->length) &&
1417           loc->location[0] == '/' &&
1418           (limit & loc->limit) != 0)
1419       {
1420         best    = loc;
1421         bestlen = loc->length;
1422       }
1423     }
1424     else
1425     {
1426      /*
1427       * Use case-sensitive comparison for other URIs...
1428       */
1429
1430       if (loc->length > bestlen && loc->location &&
1431           !strncmp(uri, loc->location, loc->length) &&
1432           loc->location[0] == '/' &&
1433           (limit & loc->limit) != 0)
1434       {
1435         best    = loc;
1436         bestlen = loc->length;
1437       }
1438     }
1439   }
1440
1441  /*
1442   * Return the match, if any...
1443   */
1444
1445   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1446                   best ? best->location : "NONE");
1447
1448   return (best);
1449 }
1450
1451
1452 /*
1453  * 'cupsdFindLocation()' - Find the named location.
1454  */
1455
1456 cupsd_location_t *                      /* O - Location that matches */
1457 cupsdFindLocation(const char *location) /* I - Connection */
1458 {
1459   cupsd_location_t      key;            /* Search key */
1460
1461
1462   key.location = (char *)location;
1463
1464   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1465 }
1466
1467
1468 /*
1469  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1470  */
1471
1472 http_status_t                           /* O - HTTP_OK if authorized or error code */
1473 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1474                   const char     *owner)/* I - Owner of object */
1475 {
1476   int                   i, j,           /* Looping vars */
1477                         auth;           /* Authorization status */
1478   unsigned              address[4];     /* Authorization address */
1479   cupsd_location_t      *best;          /* Best match for location so far */
1480   int                   hostlen;        /* Length of hostname */
1481   const char            *username;      /* Username to authorize */
1482   struct passwd         *pw;            /* User password data */
1483   static const char * const levels[] =  /* Auth levels */
1484                 {
1485                   "ANON",
1486                   "USER",
1487                   "GROUP"
1488                 };
1489   static const char * const types[] =   /* Auth types */
1490                 {
1491                   "NONE",
1492                   "BASIC",
1493                   "DIGEST",
1494                   "BASICDIGEST"
1495                 };
1496
1497
1498   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1499                   "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1500                   con->uri, con->best, con->best ? con->best->location ?
1501                                            con->best->location : "(null)" : "");
1502   if (owner)
1503     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1504                     "cupsdIsAuthorized: owner=\"%s\"", owner);
1505
1506  /*
1507   * If there is no "best" authentication rule for this request, then
1508   * access is allowed from the local system and denied from other
1509   * addresses...
1510   */
1511
1512   if (!con->best)
1513   {
1514     if (!strcmp(con->http.hostname, "localhost") ||
1515         !strcmp(con->http.hostname, ServerName))
1516       return (HTTP_OK);
1517     else
1518       return (HTTP_FORBIDDEN);
1519   }
1520
1521   best = con->best;
1522
1523   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1524                   "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, "
1525                   "satisfy=AUTH_SATISFY_%s, num_names=%d",
1526                   levels[best->level], types[best->type],
1527                   best->satisfy ? "ANY" : "ALL", best->num_names);
1528
1529   if (best->limit == AUTH_LIMIT_IPP)
1530     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1531                     best->op, ippOpString(best->op));
1532
1533  /*
1534   * Check host/ip-based accesses...
1535   */
1536
1537 #ifdef AF_INET6
1538   if (con->http.hostaddr->addr.sa_family == AF_INET6)
1539   {
1540    /*
1541     * Copy IPv6 address...
1542     */
1543
1544     address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1545     address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1546     address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1547     address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1548   }
1549   else
1550 #endif /* AF_INET6 */
1551   if (con->http.hostaddr->addr.sa_family == AF_INET)
1552   {
1553    /*
1554     * Copy IPv4 address...
1555     */
1556
1557     address[0] = 0;
1558     address[1] = 0;
1559     address[2] = 0;
1560     address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1561   }
1562   else
1563     memset(address, 0, sizeof(address));
1564
1565   hostlen = strlen(con->http.hostname);
1566
1567   if (!strcasecmp(con->http.hostname, "localhost"))
1568   {
1569    /*
1570     * Access from localhost (127.0.0.1 or ::1) is always allowed...
1571     */
1572
1573     auth = AUTH_ALLOW;
1574   }
1575   else
1576   {
1577    /*
1578     * Do authorization checks on the domain/address...
1579     */
1580
1581     switch (best->order_type)
1582     {
1583       default :
1584           auth = AUTH_DENY;     /* anti-compiler-warning-code */
1585           break;
1586
1587       case AUTH_ALLOW : /* Order Deny,Allow */
1588           auth = AUTH_ALLOW;
1589
1590           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1591                         best->num_deny, best->deny))
1592             auth = AUTH_DENY;
1593
1594           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1595                         best->num_allow, best->allow))
1596             auth = AUTH_ALLOW;
1597           break;
1598
1599       case AUTH_DENY : /* Order Allow,Deny */
1600           auth = AUTH_DENY;
1601
1602           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1603                         best->num_allow, best->allow))
1604             auth = AUTH_ALLOW;
1605
1606           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1607                         best->num_deny, best->deny))
1608             auth = AUTH_DENY;
1609           break;
1610     }
1611   }
1612
1613   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1614                   auth ? "DENY" : "ALLOW");
1615
1616   if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1617     return (HTTP_FORBIDDEN);
1618
1619 #ifdef HAVE_SSL
1620  /*
1621   * See if encryption is required...
1622   */
1623
1624   if (best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1625       strcasecmp(con->http.hostname, "localhost") &&
1626       best->satisfy == AUTH_SATISFY_ALL)
1627   {
1628     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1629                     "cupsdIsAuthorized: Need upgrade to TLS...");
1630     return (HTTP_UPGRADE_REQUIRED);
1631   }
1632 #endif /* HAVE_SSL */
1633
1634  /*
1635   * Now see what access level is required...
1636   */
1637
1638   if (best->level == AUTH_ANON ||       /* Anonymous access - allow it */
1639       (best->type == AUTH_NONE && best->num_names == 0))
1640     return (HTTP_OK);
1641
1642   if (!con->username[0] && best->type == AUTH_NONE &&
1643       best->limit == AUTH_LIMIT_IPP)
1644   {
1645    /*
1646     * Check for unauthenticated username...
1647     */
1648
1649     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1650
1651
1652     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1653     if (attr)
1654     {
1655       cupsdLogMessage(CUPSD_LOG_DEBUG2,
1656                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1657                       attr->values[0].string.text);
1658       username = attr->values[0].string.text;
1659     }
1660     else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1661       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1662     else
1663       return (HTTP_OK);                 /* unless overridden with Satisfy */
1664   }
1665   else
1666   {
1667     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: username=\"%s\"",
1668                     con->username);
1669
1670     if (!con->username[0])
1671     {
1672       if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1673         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1674       else
1675         return (HTTP_OK);               /* unless overridden with Satisfy */
1676     }
1677
1678     username = con->username;
1679   }
1680
1681  /*
1682   * OK, got a username.  See if we need normal user access, or group
1683   * access... (root always matches)
1684   */
1685
1686   if (!strcmp(username, "root"))
1687     return (HTTP_OK);
1688
1689  /*
1690   * Get the user info...
1691   */
1692
1693   pw = getpwnam(username);
1694   endpwent();
1695
1696   if (best->level == AUTH_USER)
1697   {
1698    /*
1699     * If there are no names associated with this location, then
1700     * any valid user is OK...
1701     */
1702
1703     if (best->num_names == 0)
1704       return (HTTP_OK);
1705
1706    /*
1707     * Otherwise check the user list and return OK if this user is
1708     * allowed...
1709     */
1710
1711     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1712                     "cupsdIsAuthorized: Checking user membership...");
1713
1714     for (i = 0; i < best->num_names; i ++)
1715     {
1716       if (!strcasecmp(best->names[i], "@OWNER") && owner &&
1717           !strcasecmp(username, owner))
1718         return (HTTP_OK);
1719       else if (!strcasecmp(best->names[i], "@SYSTEM"))
1720       {
1721         for (j = 0; j < NumSystemGroups; j ++)
1722           if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1723             return (HTTP_OK);
1724       }
1725       else if (best->names[i][0] == '@')
1726       {
1727         if (cupsdCheckGroup(username, pw, best->names[i] + 1))
1728           return (HTTP_OK);
1729       }
1730       else if (!strcasecmp(username, best->names[i]))
1731         return (HTTP_OK);
1732     }
1733
1734     return (HTTP_UNAUTHORIZED);
1735   }
1736
1737  /*
1738   * Check to see if this user is in any of the named groups...
1739   */
1740
1741   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1742                   "cupsdIsAuthorized: Checking group membership...");
1743
1744  /*
1745   * Check to see if this user is in any of the named groups...
1746   */
1747
1748   for (i = 0; i < best->num_names; i ++)
1749   {
1750     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1751                     "cupsdIsAuthorized: Checking group \"%s\" membership...",
1752                     best->names[i]);
1753
1754     if (!strcasecmp(best->names[i], "@SYSTEM"))
1755     {
1756       for (j = 0; j < NumSystemGroups; j ++)
1757         if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1758           return (HTTP_OK);
1759     }
1760     else if (cupsdCheckGroup(username, pw, best->names[i]))
1761       return (HTTP_OK);
1762   }
1763
1764  /*
1765   * The user isn't part of the specified group, so deny access...
1766   */
1767
1768   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1769                   "cupsdIsAuthorized: User not in group(s)!");
1770
1771   return (HTTP_UNAUTHORIZED);
1772 }
1773
1774
1775 /*
1776  * 'add_allow()' - Add an allow mask to the location.
1777  */
1778
1779 static cupsd_authmask_t *               /* O - New mask record */
1780 add_allow(cupsd_location_t *loc)        /* I - Location to add to */
1781 {
1782   cupsd_authmask_t      *temp;          /* New mask record */
1783
1784
1785  /*
1786   * Range-check...
1787   */
1788
1789   if (loc == NULL)
1790     return (NULL);
1791
1792  /*
1793   * Try to allocate memory for the record...
1794   */
1795
1796   if (loc->num_allow == 0)
1797     temp = malloc(sizeof(cupsd_authmask_t));
1798   else
1799     temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
1800
1801   if (temp == NULL)
1802     return (NULL);
1803
1804   loc->allow = temp;
1805   temp       += loc->num_allow;
1806   loc->num_allow ++;
1807
1808  /*
1809   * Clear the mask record and return...
1810   */
1811
1812   memset(temp, 0, sizeof(cupsd_authmask_t));
1813   return (temp);
1814 }
1815
1816
1817 /*
1818  * 'add_deny()' - Add a deny mask to the location.
1819  */
1820
1821 static cupsd_authmask_t *               /* O - New mask record */
1822 add_deny(cupsd_location_t *loc)         /* I - Location to add to */
1823 {
1824   cupsd_authmask_t      *temp;          /* New mask record */
1825
1826
1827  /*
1828   * Range-check...
1829   */
1830
1831   if (loc == NULL)
1832     return (NULL);
1833
1834  /*
1835   * Try to allocate memory for the record...
1836   */
1837
1838   if (loc->num_deny == 0)
1839     temp = malloc(sizeof(cupsd_authmask_t));
1840   else
1841     temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
1842
1843   if (temp == NULL)
1844     return (NULL);
1845
1846   loc->deny = temp;
1847   temp      += loc->num_deny;
1848   loc->num_deny ++;
1849
1850  /*
1851   * Clear the mask record and return...
1852   */
1853
1854   memset(temp, 0, sizeof(cupsd_authmask_t));
1855   return (temp);
1856 }
1857
1858
1859 /*
1860  * 'compare_locations()' - Compare two locations.
1861  */
1862
1863 static int                              /* O - Result of comparison */
1864 compare_locations(cupsd_location_t *a,  /* I - First location */
1865                   cupsd_location_t *b)  /* I - Second location */
1866 {
1867   return (strcmp(b->location, a->location));
1868 }
1869
1870
1871 #if !HAVE_LIBPAM
1872 /*
1873  * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1874  *                  as needed.
1875  */
1876
1877 static char *                           /* O - Encrypted password */
1878 cups_crypt(const char *pw,              /* I - Password string */
1879            const char *salt)            /* I - Salt (key) string */
1880 {
1881   if (!strncmp(salt, "$1$", 3))
1882   {
1883    /*
1884     * Use MD5 passwords without the benefit of PAM; this is for
1885     * Slackware Linux, and the algorithm was taken from the
1886     * old shadow-19990827/lib/md5crypt.c source code... :(
1887     */
1888
1889     int                 i;              /* Looping var */
1890     unsigned long       n;              /* Output number */
1891     int                 pwlen;          /* Length of password string */
1892     const char          *salt_end;      /* End of "salt" data for MD5 */
1893     char                *ptr;           /* Pointer into result string */
1894     _cups_md5_state_t   state;          /* Primary MD5 state info */
1895     _cups_md5_state_t   state2;         /* Secondary MD5 state info */
1896     unsigned char       digest[16];     /* MD5 digest result */
1897     static char         result[120];    /* Final password string */
1898
1899
1900    /*
1901     * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
1902     * Get a maximum of 8 characters of salt data after $1$...
1903     */
1904
1905     for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
1906       if (*salt_end == '$')
1907         break;
1908
1909    /*
1910     * Compute the MD5 sum we need...
1911     */
1912
1913     pwlen = strlen(pw);
1914
1915     _cupsMD5Init(&state);
1916     _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1917     _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
1918
1919     _cupsMD5Init(&state2);
1920     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
1921     _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
1922     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
1923     _cupsMD5Finish(&state2, digest);
1924
1925     for (i = pwlen; i > 0; i -= 16)
1926       _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
1927
1928     for (i = pwlen; i > 0; i >>= 1)
1929       _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
1930
1931     _cupsMD5Finish(&state, digest);
1932
1933     for (i = 0; i < 1000; i ++)
1934     {
1935       _cupsMD5Init(&state);
1936
1937       if (i & 1)
1938         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1939       else
1940         _cupsMD5Append(&state, digest, 16);
1941
1942       if (i % 3)
1943         _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
1944
1945       if (i % 7)
1946         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1947
1948       if (i & 1)
1949         _cupsMD5Append(&state, digest, 16);
1950       else
1951         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1952
1953       _cupsMD5Finish(&state, digest);
1954     }
1955
1956    /*
1957     * Copy the final sum to the result string and return...
1958     */
1959
1960     memcpy(result, salt, salt_end - salt);
1961     ptr = result + (salt_end - salt);
1962     *ptr++ = '$';
1963
1964     for (i = 0; i < 5; i ++, ptr += 4)
1965     {
1966       n = (((digest[i] << 8) | digest[i + 6]) << 8);
1967
1968       if (i < 4)
1969         n |= digest[i + 12];
1970       else
1971         n |= digest[5];
1972
1973       to64(ptr, n, 4);
1974     }
1975
1976     to64(ptr, digest[11], 2);
1977     ptr += 2;
1978     *ptr = '\0';
1979
1980     return (result);
1981   }
1982   else
1983   {
1984    /*
1985     * Use the standard crypt() function...
1986     */
1987
1988     return (crypt(pw, salt));
1989   }
1990 }
1991 #endif /* !HAVE_LIBPAM */
1992
1993
1994 /*
1995  * 'get_md5_password()' - Get an MD5 password.
1996  */
1997
1998 static char *                           /* O - MD5 password string */
1999 get_md5_password(const char *username,  /* I - Username */
2000                  const char *group,     /* I - Group */
2001                  char       passwd[33]) /* O - MD5 password string */
2002 {
2003   cups_file_t   *fp;                    /* passwd.md5 file */
2004   char          filename[1024],         /* passwd.md5 filename */
2005                 line[256],              /* Line from file */
2006                 tempuser[33],           /* User from file */
2007                 tempgroup[33];          /* Group from file */
2008
2009
2010   cupsdLogMessage(CUPSD_LOG_DEBUG2,
2011                   "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2012                   username, group ? group : "(null)", passwd);
2013
2014   snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2015   if ((fp = cupsFileOpen(filename, "r")) == NULL)
2016   {
2017     if (errno != ENOENT)
2018       cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2019                       strerror(errno));
2020
2021     return (NULL);
2022   }
2023
2024   while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2025   {
2026     if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2027     {
2028       cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2029       continue;
2030     }
2031
2032     if (!strcmp(username, tempuser) &&
2033         (group == NULL || !strcmp(group, tempgroup)))
2034     {
2035      /*
2036       * Found the password entry!
2037       */
2038
2039       cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2040                       username, tempgroup);
2041
2042       cupsFileClose(fp);
2043       return (passwd);
2044     }
2045   }
2046
2047  /*
2048   * Didn't find a password entry - return NULL!
2049   */
2050
2051   cupsFileClose(fp);
2052   return (NULL);
2053 }
2054
2055
2056 #if HAVE_LIBPAM
2057 /*
2058  * 'pam_func()' - PAM conversation function.
2059  */
2060
2061 static int                              /* O - Success or failure */
2062 pam_func(
2063     int                      num_msg,   /* I - Number of messages */
2064     const struct pam_message **msg,     /* I - Messages */
2065     struct pam_response      **resp,    /* O - Responses */
2066     void                     *appdata_ptr)
2067                                         /* I - Pointer to connection */
2068 {
2069   int                   i;              /* Looping var */
2070   struct pam_response   *replies;       /* Replies */
2071   cupsd_authdata_t      *data;          /* Pointer to auth data */
2072
2073
2074  /*
2075   * Allocate memory for the responses...
2076   */
2077
2078   if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2079     return (PAM_CONV_ERR);
2080
2081  /*
2082   * Answer all of the messages...
2083   */
2084
2085   DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2086
2087 #ifdef __hpux
2088  /*
2089   * Apparently some versions of HP-UX 11 have a broken pam_unix security
2090   * module.  This is a workaround...
2091   */
2092
2093   data = auth_data;
2094   (void)appdata_ptr;
2095 #else
2096   data = (cupsd_authdata_t *)appdata_ptr;
2097 #endif /* __hpux */
2098
2099   for (i = 0; i < num_msg; i ++)
2100   {
2101     DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2102
2103     switch (msg[i]->msg_style)
2104     {
2105       case PAM_PROMPT_ECHO_ON:
2106           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2107                         data->username));
2108           replies[i].resp_retcode = PAM_SUCCESS;
2109           replies[i].resp         = strdup(data->username);
2110           break;
2111
2112       case PAM_PROMPT_ECHO_OFF:
2113           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2114                         data->password));
2115           replies[i].resp_retcode = PAM_SUCCESS;
2116           replies[i].resp         = strdup(data->password);
2117           break;
2118
2119       case PAM_TEXT_INFO:
2120           DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2121           replies[i].resp_retcode = PAM_SUCCESS;
2122           replies[i].resp         = NULL;
2123           break;
2124
2125       case PAM_ERROR_MSG:
2126           DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2127           replies[i].resp_retcode = PAM_SUCCESS;
2128           replies[i].resp         = NULL;
2129           break;
2130
2131       default:
2132           DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2133                         msg[i]->msg_style));
2134           free(replies);
2135           return (PAM_CONV_ERR);
2136     }
2137   }
2138
2139  /*
2140   * Return the responses back to PAM...
2141   */
2142
2143   *resp = replies;
2144
2145   return (PAM_SUCCESS);
2146 }
2147 #else
2148
2149
2150 /*
2151  * 'to64()' - Base64-encode an integer value...
2152  */
2153
2154 static void
2155 to64(char          *s,                  /* O - Output string */
2156      unsigned long v,                   /* I - Value to encode */
2157      int           n)                   /* I - Number of digits */
2158 {
2159   const char    *itoa64 = "./0123456789"
2160                           "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2161                           "abcdefghijklmnopqrstuvwxyz";
2162
2163
2164   for (; n > 0; n --, v >>= 6)
2165     *s++ = itoa64[v & 0x3f];
2166 }
2167 #endif /* HAVE_LIBPAM */
2168
2169
2170 /*
2171  * End of "$Id: auth.c 5567 2006-05-22 15:33:11Z mike $".
2172  */