]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:


9516f28babfaacdef99b6083fbdc584e17cfee22
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $"
3 *
4 * Authorization routines for the Common UNIX Printing System (CUPS).
5 *
6 * Copyright 2007-2008 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddLocation() - Add a location for authorization.
21 * cupsdAddName() - Add a name to a location...
22 * cupsdAllowHost() - Add a host name that is allowed to access the
23 * location.
24 * cupsdAllowIP() - Add an IP address or network that is allowed to
25 * access the location.
26 * cupsdAuthorize() - Validate any authorization credentials.
27 * cupsdCheckAccess() - Check whether the given address is allowed to
28 * access a location.
29 * cupsdCheckAuth() - Check authorization masks.
30 * cupsdCheckGroup() - Check for a user's group membership.
31 * cupsdCopyLocation() - Make a copy of a location...
32 * cupsdDeleteAllLocations() - Free all memory used for location
33 * authorization.
34 * cupsdDeleteLocation() - Free all memory used by a location.
35 * cupsdDenyHost() - Add a host name that is not allowed to access
36 * the location.
37 * cupsdDenyIP() - Add an IP address or network that is not
38 * allowed to access the location.
39 * cupsdFindBest() - Find the location entry that best matches the
40 * resource.
41 * cupsdFindLocation() - Find the named location.
42 * cupsdIsAuthorized() - Check to see if the user is authorized...
43 * add_allow() - Add an allow mask to the location.
44 * add_deny() - Add a deny mask to the location.
45 * check_authref() - Check if an authorization services reference
46 * has the supplied right.
47 * compare_locations() - Compare two locations.
48 * cups_crypt() - Encrypt the password using the DES or MD5
49 * algorithms, as needed.
50 * get_gss_creds() - Obtain GSS credentials.
51 * get_md5_password() - Get an MD5 password.
52 * pam_func() - PAM conversation function.
53 * to64() - Base64-encode an integer value...
54 */
55
56 /*
57 * Include necessary headers...
58 */
59
60 #include "cupsd.h"
61 #include <grp.h>
62 #ifdef HAVE_SHADOW_H
63 # include <shadow.h>
64 #endif /* HAVE_SHADOW_H */
65 #ifdef HAVE_CRYPT_H
66 # include <crypt.h>
67 #endif /* HAVE_CRYPT_H */
68 #if HAVE_LIBPAM
69 # ifdef HAVE_PAM_PAM_APPL_H
70 # include <pam/pam_appl.h>
71 # else
72 # include <security/pam_appl.h>
73 # endif /* HAVE_PAM_PAM_APPL_H */
74 #endif /* HAVE_LIBPAM */
75 #ifdef HAVE_USERSEC_H
76 # include <usersec.h>
77 #endif /* HAVE_USERSEC_H */
78 #ifdef HAVE_MEMBERSHIP_H
79 # include <membership.h>
80 #endif /* HAVE_MEMBERSHIP_H */
81 #ifdef HAVE_AUTHORIZATION_H
82 # include <Security/AuthorizationTags.h>
83 # ifdef HAVE_SECBASEPRIV_H
84 # include <Security/SecBasePriv.h>
85 # else
86 extern const char *cssmErrorString(int error);
87 # endif /* HAVE_SECBASEPRIV_H */
88 #endif /* HAVE_AUTHORIZATION_H */
89 #ifdef HAVE_SYS_PARAM_H
90 # include <sys/param.h>
91 #endif /* HAVE_SYS_PARAM_H */
92 #ifdef HAVE_SYS_UCRED_H
93 # include <sys/ucred.h>
94 typedef struct xucred cupsd_ucred_t;
95 # define CUPSD_UCRED_UID(c) (c).cr_uid
96 #else
97 typedef struct ucred cupsd_ucred_t;
98 # define CUPSD_UCRED_UID(c) (c).uid
99 #endif /* HAVE_SYS_UCRED_H */
100
101
102 /*
103 * Local functions...
104 */
105
106 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
107 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
108 #ifdef HAVE_AUTHORIZATION_H
109 static int check_authref(cupsd_client_t *con, const char *right);
110 #endif /* HAVE_AUTHORIZATION_H */
111 static int compare_locations(cupsd_location_t *a,
112 cupsd_location_t *b);
113 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
114 static char *cups_crypt(const char *pw, const char *salt);
115 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
116 #ifdef HAVE_GSSAPI
117 static gss_cred_id_t get_gss_creds(const char *service_name,
118 const char *con_server_name);
119 #endif /* HAVE_GSSAPI */
120 static char *get_md5_password(const char *username,
121 const char *group, char passwd[33]);
122 #if HAVE_LIBPAM
123 static int pam_func(int, const struct pam_message **,
124 struct pam_response **, void *);
125 #elif !defined(HAVE_USERSEC_H)
126 static void to64(char *s, unsigned long v, int n);
127 #endif /* HAVE_LIBPAM */
128
129
130 /*
131 * Local structures...
132 */
133
134 #if HAVE_LIBPAM
135 typedef struct cupsd_authdata_s /**** Authentication data ****/
136 {
137 char username[33], /* Username string */
138 password[33]; /* Password string */
139 } cupsd_authdata_t;
140 #endif /* HAVE_LIBPAM */
141
142
143 /*
144 * Local globals...
145 */
146
147 #if defined(__hpux) && HAVE_LIBPAM
148 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
149 #endif /* __hpux && HAVE_LIBPAM */
150
151
152 /*
153 * 'cupsdAddLocation()' - Add a location for authorization.
154 */
155
156 cupsd_location_t * /* O - Pointer to new location record */
157 cupsdAddLocation(const char *location) /* I - Location path */
158 {
159 cupsd_location_t *temp; /* New location */
160
161
162 /*
163 * Make sure the locations array is created...
164 */
165
166 if (!Locations)
167 Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
168
169 if (!Locations)
170 return (NULL);
171
172 /*
173 * Try to allocate memory for the new location.
174 */
175
176 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
177 return (NULL);
178
179 /*
180 * Initialize the record and copy the name over...
181 */
182
183 if ((temp->location = strdup(location)) == NULL)
184 {
185 free(temp);
186 return (NULL);
187 }
188
189 temp->length = strlen(temp->location);
190
191 cupsArrayAdd(Locations, temp);
192
193 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
194 location);
195
196 /*
197 * Return the new record...
198 */
199
200 return (temp);
201 }
202
203
204 /*
205 * 'cupsdAddName()' - Add a name to a location...
206 */
207
208 void
209 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
210 char *name) /* I - Name to add */
211 {
212 char **temp; /* Pointer to names array */
213
214
215 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
216 loc, name);
217
218 if (loc->num_names == 0)
219 temp = malloc(sizeof(char *));
220 else
221 temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
222
223 if (temp == NULL)
224 {
225 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
226 loc->location ? loc->location : "nil", strerror(errno));
227 return;
228 }
229
230 loc->names = temp;
231
232 if ((temp[loc->num_names] = strdup(name)) == NULL)
233 {
234 cupsdLogMessage(CUPSD_LOG_ERROR,
235 "Unable to duplicate name for location %s: %s",
236 loc->location ? loc->location : "nil", strerror(errno));
237 return;
238 }
239
240 loc->num_names ++;
241 }
242
243
244 /*
245 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
246 */
247
248 void
249 cupsdAllowHost(cupsd_location_t *loc, /* I - Location to add to */
250 char *name) /* I - Name of host or domain to add */
251 {
252 cupsd_authmask_t *temp; /* New host/domain mask */
253 char ifname[32], /* Interface name */
254 *ifptr; /* Pointer to end of name */
255
256
257 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
258 loc, loc->location ? loc->location : "nil", name);
259
260 if ((temp = add_allow(loc)) == NULL)
261 return;
262
263 if (!strcasecmp(name, "@LOCAL"))
264 {
265 /*
266 * Allow *interface*...
267 */
268
269 temp->type = CUPSD_AUTH_INTERFACE;
270 temp->mask.name.name = strdup("*");
271 temp->mask.name.length = 1;
272 }
273 else if (!strncasecmp(name, "@IF(", 4))
274 {
275 /*
276 * Allow *interface*...
277 */
278
279 strlcpy(ifname, name + 4, sizeof(ifname));
280
281 ifptr = ifname + strlen(ifname);
282
283 if (ifptr[-1] == ')')
284 {
285 ifptr --;
286 *ifptr = '\0';
287 }
288
289 temp->type = CUPSD_AUTH_INTERFACE;
290 temp->mask.name.name = strdup(ifname);
291 temp->mask.name.length = ifptr - ifname;
292 }
293 else
294 {
295 /*
296 * Allow name...
297 */
298
299 temp->type = CUPSD_AUTH_NAME;
300 temp->mask.name.name = strdup(name);
301 temp->mask.name.length = strlen(name);
302 }
303 }
304
305
306 /*
307 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
308 * the location.
309 */
310
311 void
312 cupsdAllowIP(
313 cupsd_location_t *loc, /* I - Location to add to */
314 const unsigned address[4], /* I - IP address to add */
315 const unsigned netmask[4]) /* I - Netmask of address */
316 {
317 cupsd_authmask_t *temp; /* New host/domain mask */
318
319
320 cupsdLogMessage(CUPSD_LOG_DEBUG2,
321 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
322 loc, loc->location ? loc->location : "nil",
323 address[0], address[1], address[2], address[3],
324 netmask[0], netmask[1], netmask[2], netmask[3]);
325
326 if ((temp = add_allow(loc)) == NULL)
327 return;
328
329 temp->type = CUPSD_AUTH_IP;
330 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
331 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
332 }
333
334
335 /*
336 * 'cupsdAuthorize()' - Validate any authorization credentials.
337 */
338
339 void
340 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
341 {
342 int type; /* Authentication type */
343 const char *authorization; /* Pointer into Authorization string */
344 char *ptr, /* Pointer into string */
345 username[256], /* Username string */
346 password[33]; /* Password string */
347 cupsd_cert_t *localuser; /* Certificate username */
348 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
349 md5[33], /* MD5 password */
350 basicmd5[33]; /* MD5 of Basic password */
351 static const char * const states[] = /* HTTP client states... */
352 {
353 "WAITING",
354 "OPTIONS",
355 "GET",
356 "GET",
357 "HEAD",
358 "POST",
359 "POST",
360 "POST",
361 "PUT",
362 "PUT",
363 "DELETE",
364 "TRACE",
365 "CLOSE",
366 "STATUS"
367 };
368
369
370 /*
371 * Locate the best matching location so we know what kind of
372 * authentication to expect...
373 */
374
375 con->best = cupsdFindBest(con->uri, con->http.state);
376 con->type = CUPSD_AUTH_NONE;
377
378 cupsdLogMessage(CUPSD_LOG_DEBUG2,
379 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
380 con->uri, con->best, con->best ? con->best->location : "");
381
382 if (con->best && con->best->type != CUPSD_AUTH_NONE)
383 {
384 if (con->best->type == CUPSD_AUTH_DEFAULT)
385 type = DefaultAuthType;
386 else
387 type = con->best->type;
388 }
389 else
390 type = DefaultAuthType;
391
392 /*
393 * Decode the Authorization string...
394 */
395
396 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
397
398 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
399 authorization);
400
401 username[0] = '\0';
402 password[0] = '\0';
403
404 #ifdef HAVE_AUTHORIZATION_H
405 if (con->authref)
406 {
407 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
408 con->authref = NULL;
409 }
410 #endif /* HAVE_AUTHORIZATION_H */
411
412 if (!*authorization)
413 {
414 /*
415 * No authorization data provided, return early...
416 */
417
418 cupsdLogMessage(CUPSD_LOG_DEBUG,
419 "cupsdAuthorize: No authentication data provided.");
420 return;
421 }
422 #ifdef HAVE_AUTHORIZATION_H
423 else if (!strncmp(authorization, "AuthRef", 6) &&
424 !strcasecmp(con->http.hostname, "localhost"))
425 {
426 OSStatus status; /* Status */
427 int authlen; /* Auth string length */
428 AuthorizationItemSet *authinfo; /* Authorization item set */
429
430 /*
431 * Get the Authorization Services data...
432 */
433
434 authorization += 7;
435 while (isspace(*authorization & 255))
436 authorization ++;
437
438 authlen = sizeof(nonce);
439 httpDecode64_2(nonce, &authlen, authorization);
440
441 if (authlen != kAuthorizationExternalFormLength)
442 {
443 cupsdLogMessage(CUPSD_LOG_ERROR,
444 "External Authorization reference size is incorrect!");
445 return;
446 }
447
448 if ((status = AuthorizationCreateFromExternalForm(
449 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
450 {
451 cupsdLogMessage(CUPSD_LOG_ERROR,
452 "AuthorizationCreateFromExternalForm returned %d (%s)",
453 (int)status, cssmErrorString(status));
454 return;
455 }
456
457 if ((status = AuthorizationCopyInfo(con->authref,
458 kAuthorizationEnvironmentUsername,
459 &authinfo)) != 0)
460 {
461 cupsdLogMessage(CUPSD_LOG_ERROR,
462 "AuthorizationCopyInfo returned %d (%s)",
463 (int)status, cssmErrorString(status));
464 return;
465 }
466
467 if (authinfo->count == 1)
468 strlcpy(username, authinfo->items[0].value, sizeof(username));
469
470 cupsdLogMessage(CUPSD_LOG_DEBUG,
471 "cupsdAuthorize: Authorized as %s using AuthRef",
472 username);
473
474 AuthorizationFreeItemSet(authinfo);
475
476 con->type = CUPSD_AUTH_BASIC;
477 }
478 #endif /* HAVE_AUTHORIZATION_H */
479 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
480 else if (!strncmp(authorization, "PeerCred ", 9) &&
481 con->http.hostaddr->addr.sa_family == AF_LOCAL)
482 {
483 /*
484 * Use peer credentials from domain socket connection...
485 */
486
487 struct passwd *pwd; /* Password entry for this user */
488 cupsd_ucred_t peercred; /* Peer credentials */
489 socklen_t peersize; /* Size of peer credentials */
490
491
492 if ((pwd = getpwnam(authorization + 9)) == NULL)
493 {
494 cupsdLogMessage(CUPSD_LOG_ERROR, "User \"%s\" does not exist!",
495 authorization + 9);
496 return;
497 }
498
499 peersize = sizeof(peercred);
500
501 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
502 {
503 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
504 strerror(errno));
505 return;
506 }
507
508 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
509 {
510 cupsdLogMessage(CUPSD_LOG_ERROR,
511 "Invalid peer credentials for \"%s\" - got %d, "
512 "expected %d!", authorization + 9,
513 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
514 # ifdef HAVE_SYS_UCRED_H
515 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_version=%d",
516 peercred.cr_version);
517 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_uid=%d",
518 peercred.cr_uid);
519 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_ngroups=%d",
520 peercred.cr_ngroups);
521 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_groups[0]=%d",
522 peercred.cr_groups[0]);
523 # endif /* HAVE_SYS_UCRED_H */
524 return;
525 }
526
527 strlcpy(username, authorization + 9, sizeof(username));
528
529 cupsdLogMessage(CUPSD_LOG_DEBUG,
530 "cupsdAuthorize: Authorized as %s using PeerCred",
531 username);
532
533 con->type = CUPSD_AUTH_BASIC;
534 }
535 #endif /* SO_PEERCRED && AF_LOCAL */
536 else if (!strncmp(authorization, "Local", 5) &&
537 !strcasecmp(con->http.hostname, "localhost"))
538 {
539 /*
540 * Get Local certificate authentication data...
541 */
542
543 authorization += 5;
544 while (isspace(*authorization & 255))
545 authorization ++;
546
547 if ((localuser = cupsdFindCert(authorization)) != NULL)
548 {
549 strlcpy(username, localuser->username, sizeof(username));
550
551 cupsdLogMessage(CUPSD_LOG_DEBUG,
552 "cupsdAuthorize: Authorized as %s using Local",
553 username);
554 }
555 else
556 {
557 cupsdLogMessage(CUPSD_LOG_ERROR,
558 "cupsdAuthorize: Local authentication certificate not "
559 "found!");
560 return;
561 }
562
563 #ifdef HAVE_GSSAPI
564 if (localuser->ccache)
565 con->type = CUPSD_AUTH_NEGOTIATE;
566 else
567 #endif /* HAVE_GSSAPI */
568 con->type = CUPSD_AUTH_BASIC;
569 }
570 else if (!strncmp(authorization, "Basic", 5))
571 {
572 /*
573 * Get the Basic authentication data...
574 */
575
576 int userlen; /* Username:password length */
577
578
579 authorization += 5;
580 while (isspace(*authorization & 255))
581 authorization ++;
582
583 userlen = sizeof(username);
584 httpDecode64_2(username, &userlen, authorization);
585
586 /*
587 * Pull the username and password out...
588 */
589
590 if ((ptr = strchr(username, ':')) == NULL)
591 {
592 cupsdLogMessage(CUPSD_LOG_ERROR,
593 "cupsdAuthorize: Missing Basic password!");
594 return;
595 }
596
597 *ptr++ = '\0';
598
599 if (!username[0])
600 {
601 /*
602 * Username must not be empty...
603 */
604
605 cupsdLogMessage(CUPSD_LOG_ERROR,
606 "cupsdAuthorize: Empty Basic username!");
607 return;
608 }
609
610 if (!*ptr)
611 {
612 /*
613 * Password must not be empty...
614 */
615
616 cupsdLogMessage(CUPSD_LOG_ERROR,
617 "cupsdAuthorize: Empty Basic password!");
618 return;
619 }
620
621 strlcpy(password, ptr, sizeof(password));
622
623 /*
624 * Validate the username and password...
625 */
626
627 switch (type)
628 {
629 default :
630 case CUPSD_AUTH_BASIC :
631 {
632 #if HAVE_LIBPAM
633 /*
634 * Only use PAM to do authentication. This supports MD5
635 * passwords, among other things...
636 */
637
638 pam_handle_t *pamh; /* PAM authentication handle */
639 int pamerr; /* PAM error code */
640 struct pam_conv pamdata;/* PAM conversation data */
641 cupsd_authdata_t data; /* Authentication data */
642
643
644 strlcpy(data.username, username, sizeof(data.username));
645 strlcpy(data.password, password, sizeof(data.password));
646
647 # if defined(__sun) || defined(__hpux)
648 pamdata.conv = (int (*)(int, struct pam_message **,
649 struct pam_response **,
650 void *))pam_func;
651 # else
652 pamdata.conv = pam_func;
653 # endif /* __sun || __hpux */
654 pamdata.appdata_ptr = &data;
655
656 # ifdef __hpux
657 /*
658 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
659 * more info...
660 */
661
662 auth_data = &data;
663 # endif /* __hpux */
664
665 pamerr = pam_start("cups", username, &pamdata, &pamh);
666 if (pamerr != PAM_SUCCESS)
667 {
668 cupsdLogMessage(CUPSD_LOG_ERROR,
669 "cupsdAuthorize: pam_start() returned %d (%s)!\n",
670 pamerr, pam_strerror(pamh, pamerr));
671 return;
672 }
673
674 # if defined(HAVE_PAM_SET_ITEM) && defined(PAM_RHOST)
675 pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
676 if (pamerr != PAM_SUCCESS)
677 cupsdLogMessage(CUPSD_LOG_WARN,
678 "cupsdAuthorize: pam_set_item() returned %d "
679 "(%s)!\n", pamerr, pam_strerror(pamh, pamerr));
680 # endif /* HAVE_PAM_SET_ITEM && PAM_RHOST */
681
682 pamerr = pam_authenticate(pamh, PAM_SILENT);
683 if (pamerr != PAM_SUCCESS)
684 {
685 cupsdLogMessage(CUPSD_LOG_ERROR,
686 "cupsdAuthorize: pam_authenticate() returned %d "
687 "(%s)!\n",
688 pamerr, pam_strerror(pamh, pamerr));
689 pam_end(pamh, 0);
690 return;
691 }
692
693 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
694 if (pamerr != PAM_SUCCESS)
695 {
696 cupsdLogMessage(CUPSD_LOG_ERROR,
697 "cupsdAuthorize: pam_acct_mgmt() returned %d "
698 "(%s)!\n",
699 pamerr, pam_strerror(pamh, pamerr));
700 pam_end(pamh, 0);
701 return;
702 }
703
704 pam_end(pamh, PAM_SUCCESS);
705
706 #elif defined(HAVE_USERSEC_H)
707 /*
708 * Use AIX authentication interface...
709 */
710
711 char *authmsg; /* Authentication message */
712 int reenter; /* ??? */
713
714
715 cupsdLogMessage(CUPSD_LOG_DEBUG,
716 "cupsdAuthorize: AIX authenticate of username \"%s\"",
717 username);
718
719 reenter = 1;
720 if (authenticate(username, password, &reenter, &authmsg) != 0)
721 {
722 cupsdLogMessage(CUPSD_LOG_DEBUG,
723 "cupsdAuthorize: Unable to authenticate username "
724 "\"%s\": %s",
725 username, strerror(errno));
726 return;
727 }
728
729 #else
730 /*
731 * Use normal UNIX password file-based authentication...
732 */
733
734 char *pass; /* Encrypted password */
735 struct passwd *pw; /* User password data */
736 # ifdef HAVE_SHADOW_H
737 struct spwd *spw; /* Shadow password data */
738 # endif /* HAVE_SHADOW_H */
739
740
741 pw = getpwnam(username); /* Get the current password */
742 endpwent(); /* Close the password file */
743
744 if (!pw)
745 {
746 /*
747 * No such user...
748 */
749
750 cupsdLogMessage(CUPSD_LOG_ERROR,
751 "cupsdAuthorize: Unknown username \"%s\"!",
752 username);
753 return;
754 }
755
756 # ifdef HAVE_SHADOW_H
757 spw = getspnam(username);
758 endspent();
759
760 if (!spw && !strcmp(pw->pw_passwd, "x"))
761 {
762 /*
763 * Don't allow blank passwords!
764 */
765
766 cupsdLogMessage(CUPSD_LOG_ERROR,
767 "cupsdAuthorize: Username \"%s\" has no shadow "
768 "password!", username);
769 return;
770 }
771
772 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
773 # else
774 if (!pw->pw_passwd[0])
775 # endif /* HAVE_SHADOW_H */
776 {
777 /*
778 * Don't allow blank passwords!
779 */
780
781 cupsdLogMessage(CUPSD_LOG_ERROR,
782 "cupsdAuthorize: Username \"%s\" has no password!",
783 username);
784 return;
785 }
786
787 /*
788 * OK, the password isn't blank, so compare with what came from the
789 * client...
790 */
791
792 pass = cups_crypt(password, pw->pw_passwd);
793
794 cupsdLogMessage(CUPSD_LOG_DEBUG2,
795 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
796 pw->pw_passwd, pass);
797
798 if (!pass || strcmp(pw->pw_passwd, pass))
799 {
800 # ifdef HAVE_SHADOW_H
801 if (spw)
802 {
803 pass = cups_crypt(password, spw->sp_pwdp);
804
805 cupsdLogMessage(CUPSD_LOG_DEBUG2,
806 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
807 spw->sp_pwdp, pass);
808
809 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
810 {
811 cupsdLogMessage(CUPSD_LOG_ERROR,
812 "cupsdAuthorize: Authentication failed for "
813 "user \"%s\"!",
814 username);
815 return;
816 }
817 }
818 else
819 # endif /* HAVE_SHADOW_H */
820 {
821 cupsdLogMessage(CUPSD_LOG_ERROR,
822 "cupsdAuthorize: Authentication failed for "
823 "user \"%s\"!",
824 username);
825 return;
826 }
827 }
828 #endif /* HAVE_LIBPAM */
829 }
830
831 cupsdLogMessage(CUPSD_LOG_DEBUG,
832 "cupsdAuthorize: Authorized as %s using Basic",
833 username);
834 break;
835
836 case CUPSD_AUTH_BASICDIGEST :
837 /*
838 * Do Basic authentication with the Digest password file...
839 */
840
841 if (!get_md5_password(username, NULL, md5))
842 {
843 cupsdLogMessage(CUPSD_LOG_ERROR,
844 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
845 username);
846 return;
847 }
848
849 httpMD5(username, "CUPS", password, basicmd5);
850
851 if (strcmp(md5, basicmd5))
852 {
853 cupsdLogMessage(CUPSD_LOG_ERROR,
854 "cupsdAuthorize: Authentication failed for \"%s\"!",
855 username);
856 return;
857 }
858
859 cupsdLogMessage(CUPSD_LOG_DEBUG,
860 "cupsdAuthorize: Authorized as %s using BasicDigest",
861 username);
862 break;
863 }
864
865 con->type = type;
866 }
867 else if (!strncmp(authorization, "Digest", 6))
868 {
869 /*
870 * Get the username, password, and nonce from the Digest attributes...
871 */
872
873 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
874 username, sizeof(username)) || !username[0])
875 {
876 /*
877 * Username must not be empty...
878 */
879
880 cupsdLogMessage(CUPSD_LOG_ERROR,
881 "cupsdAuthorize: Empty or missing Digest username!");
882 return;
883 }
884
885 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
886 password, sizeof(password)) || !password[0])
887 {
888 /*
889 * Password must not be empty...
890 */
891
892 cupsdLogMessage(CUPSD_LOG_ERROR,
893 "cupsdAuthorize: Empty or missing Digest password!");
894 return;
895 }
896
897 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
898 nonce))
899 {
900 cupsdLogMessage(CUPSD_LOG_ERROR,
901 "cupsdAuthorize: No nonce value for Digest "
902 "authentication!");
903 return;
904 }
905
906 if (strcmp(con->http.hostname, nonce))
907 {
908 cupsdLogMessage(CUPSD_LOG_ERROR,
909 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
910 "got \"%s\"!", con->http.hostname, nonce);
911 return;
912 }
913
914 /*
915 * Validate the username and password...
916 */
917
918 if (!get_md5_password(username, NULL, md5))
919 {
920 cupsdLogMessage(CUPSD_LOG_ERROR,
921 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
922 username);
923 return;
924 }
925
926 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
927
928 if (strcmp(md5, password))
929 {
930 cupsdLogMessage(CUPSD_LOG_ERROR,
931 "cupsdAuthorize: Authentication failed for \"%s\"!",
932 username);
933 return;
934 }
935
936 cupsdLogMessage(CUPSD_LOG_DEBUG,
937 "cupsdAuthorize: Authorized as %s using Digest",
938 username);
939
940 con->type = CUPSD_AUTH_DIGEST;
941 }
942 #ifdef HAVE_GSSAPI
943 else if (!strncmp(authorization, "Negotiate", 9))
944 {
945 int len; /* Length of authorization string */
946 gss_cred_id_t server_creds; /* Server credentials */
947 gss_ctx_id_t context; /* Authorization context */
948 OM_uint32 major_status, /* Major status code */
949 minor_status; /* Minor status code */
950 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
951 /* Input token from string */
952 output_token = GSS_C_EMPTY_BUFFER;
953 /* Output token for username */
954 gss_name_t client_name; /* Client name */
955 unsigned int ret_flags; /* Credential flags */
956
957
958 # ifdef __APPLE__
959 /*
960 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
961 * to use it...
962 */
963
964 if (gss_init_sec_context == NULL)
965 {
966 cupsdLogMessage(CUPSD_LOG_WARN,
967 "GSSAPI/Kerberos authentication failed because the "
968 "Kerberos framework is not present.");
969 return;
970 }
971 # endif /* __APPLE__ */
972
973 con->gss_output_token.length = 0;
974
975 /*
976 * Find the start of the Kerberos input token...
977 */
978
979 authorization += 9;
980 while (isspace(*authorization & 255))
981 authorization ++;
982
983 if (!*authorization)
984 {
985 cupsdLogMessage(CUPSD_LOG_DEBUG2,
986 "cupsdAuthorize: No authentication data specified.");
987 return;
988 }
989
990 /*
991 * Get the server credentials...
992 */
993
994 if ((server_creds = get_gss_creds(GSSServiceName, con->servername)) == NULL)
995 return;
996
997 /*
998 * Decode the authorization string to get the input token...
999 */
1000
1001 len = strlen(authorization);
1002 input_token.value = malloc(len);
1003 input_token.value = httpDecode64_2(input_token.value, &len,
1004 authorization);
1005 input_token.length = len;
1006
1007 /*
1008 * Accept the input token to get the authorization info...
1009 */
1010
1011 context = GSS_C_NO_CONTEXT;
1012 client_name = GSS_C_NO_NAME;
1013 major_status = gss_accept_sec_context(&minor_status,
1014 &context,
1015 server_creds,
1016 &input_token,
1017 GSS_C_NO_CHANNEL_BINDINGS,
1018 &client_name,
1019 NULL,
1020 &con->gss_output_token,
1021 &ret_flags,
1022 NULL,
1023 &con->gss_delegated_cred);
1024
1025 if (GSS_ERROR(major_status))
1026 {
1027 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1028 "cupsdAuthorize: Error accepting GSSAPI security "
1029 "context");
1030
1031 if (context != GSS_C_NO_CONTEXT)
1032 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1033
1034 gss_release_cred(&minor_status, &server_creds);
1035 return;
1036 }
1037
1038 /*
1039 * Release our credentials...
1040 */
1041
1042 gss_release_cred(&minor_status, &server_creds);
1043
1044 /*
1045 * Get the username associated with the client's credentials...
1046 */
1047
1048 if (!con->gss_delegated_cred)
1049 cupsdLogMessage(CUPSD_LOG_DEBUG,
1050 "cupsdAuthorize: No delegated credentials!");
1051
1052 if (major_status == GSS_S_CONTINUE_NEEDED)
1053 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1054 "cupsdAuthorize: Credentials not complete");
1055 else if (major_status == GSS_S_COMPLETE)
1056 {
1057 major_status = gss_display_name(&minor_status, client_name,
1058 &output_token, NULL);
1059
1060 if (GSS_ERROR(major_status))
1061 {
1062 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1063 "cupsdAuthorize: Error getting username");
1064 gss_release_name(&minor_status, &client_name);
1065 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1066 return;
1067 }
1068
1069 gss_release_name(&minor_status, &client_name);
1070 strlcpy(username, output_token.value, sizeof(username));
1071
1072 cupsdLogMessage(CUPSD_LOG_DEBUG,
1073 "cupsdAuthorize: Authorized as %s using Negotiate",
1074 username);
1075
1076 gss_release_buffer(&minor_status, &output_token);
1077 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1078
1079 con->gss_have_creds = 1;
1080
1081 con->type = CUPSD_AUTH_NEGOTIATE;
1082 }
1083 else
1084 gss_release_name(&minor_status, &client_name);
1085 }
1086 #endif /* HAVE_GSSAPI */
1087 else
1088 {
1089 char scheme[256]; /* Auth scheme... */
1090
1091
1092 if (sscanf(authorization, "%255s", scheme) != 1)
1093 strcpy(scheme, "UNKNOWN");
1094
1095 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\"",
1096 scheme);
1097 return;
1098 }
1099
1100 /*
1101 * If we get here, then we were able to validate the username and
1102 * password - copy the validated username and password to the client
1103 * data and return...
1104 */
1105
1106 strlcpy(con->username, username, sizeof(con->username));
1107 strlcpy(con->password, password, sizeof(con->password));
1108 }
1109
1110
1111 /*
1112 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1113 * access a location.
1114 */
1115
1116 int /* O - 1 if allowed, 0 otherwise */
1117 cupsdCheckAccess(
1118 unsigned ip[4], /* I - Client address */
1119 char *name, /* I - Client hostname */
1120 int namelen, /* I - Length of hostname */
1121 cupsd_location_t *loc) /* I - Location to check */
1122 {
1123 int allow; /* 1 if allowed, 0 otherwise */
1124
1125
1126 if (!strcasecmp(name, "localhost"))
1127 {
1128 /*
1129 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1130 */
1131
1132 return (1);
1133 }
1134 else
1135 {
1136 /*
1137 * Do authorization checks on the domain/address...
1138 */
1139
1140 switch (loc->order_type)
1141 {
1142 default :
1143 allow = 0; /* anti-compiler-warning-code */
1144 break;
1145
1146 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
1147 allow = 1;
1148
1149 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1150 allow = 0;
1151
1152 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1153 allow = 1;
1154 break;
1155
1156 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
1157 allow = 0;
1158
1159 if (cupsdCheckAuth(ip, name, namelen, loc->num_allow, loc->allow))
1160 allow = 1;
1161
1162 if (cupsdCheckAuth(ip, name, namelen, loc->num_deny, loc->deny))
1163 allow = 0;
1164 break;
1165 }
1166 }
1167
1168 return (allow);
1169 }
1170
1171
1172 /*
1173 * 'cupsdCheckAuth()' - Check authorization masks.
1174 */
1175
1176 int /* O - 1 if mask matches, 0 otherwise */
1177 cupsdCheckAuth(
1178 unsigned ip[4], /* I - Client address */
1179 char *name, /* I - Client hostname */
1180 int name_len, /* I - Length of hostname */
1181 int num_masks, /* I - Number of masks */
1182 cupsd_authmask_t *masks) /* I - Masks */
1183 {
1184 int i; /* Looping var */
1185 cupsd_netif_t *iface; /* Network interface */
1186 unsigned netip4; /* IPv4 network address */
1187 #ifdef AF_INET6
1188 unsigned netip6[4]; /* IPv6 network address */
1189 #endif /* AF_INET6 */
1190
1191 while (num_masks > 0)
1192 {
1193 switch (masks->type)
1194 {
1195 case CUPSD_AUTH_INTERFACE :
1196 /*
1197 * Check for a match with a network interface...
1198 */
1199
1200 netip4 = htonl(ip[3]);
1201
1202 #ifdef AF_INET6
1203 netip6[0] = htonl(ip[0]);
1204 netip6[1] = htonl(ip[1]);
1205 netip6[2] = htonl(ip[2]);
1206 netip6[3] = htonl(ip[3]);
1207 #endif /* AF_INET6 */
1208
1209 if (!strcmp(masks->mask.name.name, "*"))
1210 {
1211 /*
1212 * Check against all local interfaces...
1213 */
1214
1215 cupsdNetIFUpdate();
1216
1217 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1218 iface;
1219 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1220 {
1221 /*
1222 * Only check local interfaces...
1223 */
1224
1225 if (!iface->is_local)
1226 continue;
1227
1228 if (iface->address.addr.sa_family == AF_INET)
1229 {
1230 /*
1231 * Check IPv4 address...
1232 */
1233
1234 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1235 (iface->address.ipv4.sin_addr.s_addr &
1236 iface->mask.ipv4.sin_addr.s_addr))
1237 return (1);
1238 }
1239 #ifdef AF_INET6
1240 else
1241 {
1242 /*
1243 * Check IPv6 address...
1244 */
1245
1246 for (i = 0; i < 4; i ++)
1247 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1248 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1249 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1250 break;
1251
1252 if (i == 4)
1253 return (1);
1254 }
1255 #endif /* AF_INET6 */
1256 }
1257 }
1258 else
1259 {
1260 /*
1261 * Check the named interface...
1262 */
1263
1264 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1265 iface;
1266 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1267 {
1268 if (strcmp(masks->mask.name.name, iface->name))
1269 continue;
1270
1271 if (iface->address.addr.sa_family == AF_INET)
1272 {
1273 /*
1274 * Check IPv4 address...
1275 */
1276
1277 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1278 (iface->address.ipv4.sin_addr.s_addr &
1279 iface->mask.ipv4.sin_addr.s_addr))
1280 return (1);
1281 }
1282 #ifdef AF_INET6
1283 else
1284 {
1285 /*
1286 * Check IPv6 address...
1287 */
1288
1289 for (i = 0; i < 4; i ++)
1290 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1291 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1292 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1293 break;
1294
1295 if (i == 4)
1296 return (1);
1297 }
1298 #endif /* AF_INET6 */
1299 }
1300 }
1301 break;
1302
1303 case CUPSD_AUTH_NAME :
1304 /*
1305 * Check for exact name match...
1306 */
1307
1308 if (!strcasecmp(name, masks->mask.name.name))
1309 return (1);
1310
1311 /*
1312 * Check for domain match...
1313 */
1314
1315 if (name_len >= masks->mask.name.length &&
1316 masks->mask.name.name[0] == '.' &&
1317 !strcasecmp(name + name_len - masks->mask.name.length,
1318 masks->mask.name.name))
1319 return (1);
1320 break;
1321
1322 case CUPSD_AUTH_IP :
1323 /*
1324 * Check for IP/network address match...
1325 */
1326
1327 for (i = 0; i < 4; i ++)
1328 if ((ip[i] & masks->mask.ip.netmask[i]) !=
1329 masks->mask.ip.address[i])
1330 break;
1331
1332 if (i == 4)
1333 return (1);
1334 break;
1335 }
1336
1337 masks ++;
1338 num_masks --;
1339 }
1340
1341 return (0);
1342 }
1343
1344
1345 /*
1346 * 'cupsdCheckGroup()' - Check for a user's group membership.
1347 */
1348
1349 int /* O - 1 if user is a member, 0 otherwise */
1350 cupsdCheckGroup(
1351 const char *username, /* I - User name */
1352 struct passwd *user, /* I - System user info */
1353 const char *groupname) /* I - Group name */
1354 {
1355 int i; /* Looping var */
1356 struct group *group; /* System group info */
1357 char junk[33]; /* MD5 password (not used) */
1358 #ifdef HAVE_MBR_UID_TO_UUID
1359 uuid_t useruuid, /* UUID for username */
1360 groupuuid; /* UUID for groupname */
1361 int is_member; /* True if user is a member of group */
1362 #endif /* HAVE_MBR_UID_TO_UUID */
1363
1364
1365 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1366 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1367 username, user, groupname);
1368
1369 /*
1370 * Validate input...
1371 */
1372
1373 if (!username || !groupname)
1374 return (0);
1375
1376 /*
1377 * Check to see if the user is a member of the named group...
1378 */
1379
1380 group = getgrnam(groupname);
1381 endgrent();
1382
1383 if (group != NULL)
1384 {
1385 /*
1386 * Group exists, check it...
1387 */
1388
1389 for (i = 0; group->gr_mem[i]; i ++)
1390 if (!strcasecmp(username, group->gr_mem[i]))
1391 return (1);
1392 }
1393
1394 /*
1395 * Group doesn't exist or user not in group list, check the group ID
1396 * against the user's group ID...
1397 */
1398
1399 if (user && group && group->gr_gid == user->pw_gid)
1400 return (1);
1401
1402 #ifdef HAVE_MBR_UID_TO_UUID
1403 /*
1404 * Check group membership through MacOS X membership API...
1405 */
1406
1407 if (user && group)
1408 if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1409 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1410 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1411 if (is_member)
1412 return (1);
1413 #endif /* HAVE_MBR_UID_TO_UUID */
1414
1415 /*
1416 * Username not found, group not found, or user is not part of the
1417 * system group... Check for a user and group in the MD5 password
1418 * file...
1419 */
1420
1421 if (get_md5_password(username, groupname, junk) != NULL)
1422 return (1);
1423
1424 /*
1425 * If we get this far, then the user isn't part of the named group...
1426 */
1427
1428 return (0);
1429 }
1430
1431
1432 /*
1433 * 'cupsdCopyLocation()' - Make a copy of a location...
1434 */
1435
1436 cupsd_location_t * /* O - New location */
1437 cupsdCopyLocation(
1438 cupsd_location_t **loc) /* IO - Original location */
1439 {
1440 int i; /* Looping var */
1441 cupsd_location_t *temp; /* New location */
1442 char location[HTTP_MAX_URI];
1443 /* Location of resource */
1444
1445
1446 /*
1447 * Use a local copy of location because cupsdAddLocation may cause
1448 * this memory to be moved...
1449 */
1450
1451 strlcpy(location, (*loc)->location, sizeof(location));
1452
1453 if ((temp = cupsdAddLocation(location)) == NULL)
1454 return (NULL);
1455
1456 /*
1457 * Copy the information from the original location to the new one.
1458 */
1459
1460 temp->limit = (*loc)->limit;
1461 temp->order_type = (*loc)->order_type;
1462 temp->type = (*loc)->type;
1463 temp->level = (*loc)->level;
1464 temp->satisfy = (*loc)->satisfy;
1465 temp->encryption = (*loc)->encryption;
1466
1467 if ((temp->num_names = (*loc)->num_names) > 0)
1468 {
1469 /*
1470 * Copy the names array...
1471 */
1472
1473 if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1474 {
1475 cupsdLogMessage(CUPSD_LOG_ERROR,
1476 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1477 temp->num_names, strerror(errno));
1478
1479 cupsdDeleteLocation(temp);
1480 return (NULL);
1481 }
1482
1483 for (i = 0; i < temp->num_names; i ++)
1484 if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1485 {
1486 cupsdLogMessage(CUPSD_LOG_ERROR,
1487 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1488 (*loc)->names[i], strerror(errno));
1489
1490 cupsdDeleteLocation(temp);
1491 return (NULL);
1492 }
1493 }
1494
1495 if ((temp->num_allow = (*loc)->num_allow) > 0)
1496 {
1497 /*
1498 * Copy allow rules...
1499 */
1500
1501 if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1502 {
1503 cupsdLogMessage(CUPSD_LOG_ERROR,
1504 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1505 temp->num_allow, strerror(errno));
1506 cupsdDeleteLocation(temp);
1507 return (NULL);
1508 }
1509
1510 for (i = 0; i < temp->num_allow; i ++)
1511 switch (temp->allow[i].type = (*loc)->allow[i].type)
1512 {
1513 case CUPSD_AUTH_NAME :
1514 temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1515 temp->allow[i].mask.name.name = strdup((*loc)->allow[i].mask.name.name);
1516
1517 if (temp->allow[i].mask.name.name == NULL)
1518 {
1519 cupsdLogMessage(CUPSD_LOG_ERROR,
1520 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1521 (*loc)->allow[i].mask.name.name, strerror(errno));
1522 cupsdDeleteLocation(temp);
1523 return (NULL);
1524 }
1525 break;
1526 case CUPSD_AUTH_IP :
1527 memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1528 sizeof(cupsd_ipmask_t));
1529 break;
1530 }
1531 }
1532
1533 if ((temp->num_deny = (*loc)->num_deny) > 0)
1534 {
1535 /*
1536 * Copy deny rules...
1537 */
1538
1539 if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1540 {
1541 cupsdLogMessage(CUPSD_LOG_ERROR,
1542 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1543 temp->num_deny, strerror(errno));
1544 cupsdDeleteLocation(temp);
1545 return (NULL);
1546 }
1547
1548 for (i = 0; i < temp->num_deny; i ++)
1549 switch (temp->deny[i].type = (*loc)->deny[i].type)
1550 {
1551 case CUPSD_AUTH_NAME :
1552 temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1553 temp->deny[i].mask.name.name = strdup((*loc)->deny[i].mask.name.name);
1554
1555 if (temp->deny[i].mask.name.name == NULL)
1556 {
1557 cupsdLogMessage(CUPSD_LOG_ERROR,
1558 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1559 (*loc)->deny[i].mask.name.name, strerror(errno));
1560 cupsdDeleteLocation(temp);
1561 return (NULL);
1562 }
1563 break;
1564 case CUPSD_AUTH_IP :
1565 memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1566 sizeof(cupsd_ipmask_t));
1567 break;
1568 }
1569 }
1570
1571 return (temp);
1572 }
1573
1574
1575 /*
1576 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1577 */
1578
1579 void
1580 cupsdDeleteAllLocations(void)
1581 {
1582 cupsd_location_t *loc; /* Current location */
1583
1584
1585 /*
1586 * Free all of the allow/deny records first...
1587 */
1588
1589 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1590 loc;
1591 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1592 cupsdDeleteLocation(loc);
1593
1594 /*
1595 * Then free the location array...
1596 */
1597
1598 cupsArrayDelete(Locations);
1599 Locations = NULL;
1600 }
1601
1602
1603 /*
1604 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1605 */
1606
1607 void
1608 cupsdDeleteLocation(
1609 cupsd_location_t *loc) /* I - Location to delete */
1610 {
1611 int i; /* Looping var */
1612 cupsd_authmask_t *mask; /* Current mask */
1613
1614
1615 cupsArrayRemove(Locations, loc);
1616
1617 for (i = loc->num_names - 1; i >= 0; i --)
1618 free(loc->names[i]);
1619
1620 if (loc->num_names > 0)
1621 free(loc->names);
1622
1623 for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1624 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
1625 free(mask->mask.name.name);
1626
1627 if (loc->num_allow > 0)
1628 free(loc->allow);
1629
1630 for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1631 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
1632 free(mask->mask.name.name);
1633
1634 if (loc->num_deny > 0)
1635 free(loc->deny);
1636
1637 free(loc->location);
1638 free(loc);
1639 }
1640
1641
1642 /*
1643 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1644 * location.
1645 */
1646
1647 void
1648 cupsdDenyHost(cupsd_location_t *loc, /* I - Location to add to */
1649 char *name) /* I - Name of host or domain to add */
1650 {
1651 cupsd_authmask_t *temp; /* New host/domain mask */
1652 char ifname[32], /* Interface name */
1653 *ifptr; /* Pointer to end of name */
1654
1655
1656 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1657 loc, loc->location ? loc->location : "nil", name);
1658
1659 if ((temp = add_deny(loc)) == NULL)
1660 return;
1661
1662 if (!strcasecmp(name, "@LOCAL"))
1663 {
1664 /*
1665 * Deny *interface*...
1666 */
1667
1668 temp->type = CUPSD_AUTH_INTERFACE;
1669 temp->mask.name.name = strdup("*");
1670 temp->mask.name.length = 1;
1671 }
1672 else if (!strncasecmp(name, "@IF(", 4))
1673 {
1674 /*
1675 * Deny *interface*...
1676 */
1677
1678 strlcpy(ifname, name + 4, sizeof(ifname));
1679
1680 ifptr = ifname + strlen(ifname);
1681
1682 if (ifptr[-1] == ')')
1683 {
1684 ifptr --;
1685 *ifptr = '\0';
1686 }
1687
1688 temp->type = CUPSD_AUTH_INTERFACE;
1689 temp->mask.name.name = strdup(ifname);
1690 temp->mask.name.length = ifptr - ifname;
1691 }
1692 else
1693 {
1694 /*
1695 * Deny name...
1696 */
1697
1698 temp->type = CUPSD_AUTH_NAME;
1699 temp->mask.name.name = strdup(name);
1700 temp->mask.name.length = strlen(name);
1701 }
1702 }
1703
1704
1705 /*
1706 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1707 * access the location.
1708 */
1709
1710 void
1711 cupsdDenyIP(cupsd_location_t *loc, /* I - Location to add to */
1712 const unsigned address[4],/* I - IP address to add */
1713 const unsigned netmask[4])/* I - Netmask of address */
1714 {
1715 cupsd_authmask_t *temp; /* New host/domain mask */
1716
1717
1718 cupsdLogMessage(CUPSD_LOG_DEBUG,
1719 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1720 loc, loc->location ? loc->location : "nil",
1721 address[0], address[1], address[2], address[3],
1722 netmask[0], netmask[1], netmask[2], netmask[3]);
1723
1724 if ((temp = add_deny(loc)) == NULL)
1725 return;
1726
1727 temp->type = CUPSD_AUTH_IP;
1728 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1729 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1730 }
1731
1732
1733 /*
1734 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1735 */
1736
1737 cupsd_location_t * /* O - Location that matches */
1738 cupsdFindBest(const char *path, /* I - Resource path */
1739 http_state_t state) /* I - HTTP state/request */
1740 {
1741 char uri[HTTP_MAX_URI],
1742 /* URI in request... */
1743 *uriptr; /* Pointer into URI */
1744 cupsd_location_t *loc, /* Current location */
1745 *best; /* Best match for location so far */
1746 int bestlen; /* Length of best match */
1747 int limit; /* Limit field */
1748 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1749 {
1750 CUPSD_AUTH_LIMIT_ALL,
1751 CUPSD_AUTH_LIMIT_OPTIONS,
1752 CUPSD_AUTH_LIMIT_GET,
1753 CUPSD_AUTH_LIMIT_GET,
1754 CUPSD_AUTH_LIMIT_HEAD,
1755 CUPSD_AUTH_LIMIT_POST,
1756 CUPSD_AUTH_LIMIT_POST,
1757 CUPSD_AUTH_LIMIT_POST,
1758 CUPSD_AUTH_LIMIT_PUT,
1759 CUPSD_AUTH_LIMIT_PUT,
1760 CUPSD_AUTH_LIMIT_DELETE,
1761 CUPSD_AUTH_LIMIT_TRACE,
1762 CUPSD_AUTH_LIMIT_ALL,
1763 CUPSD_AUTH_LIMIT_ALL
1764 };
1765
1766
1767 /*
1768 * First copy the connection URI to a local string so we have drop
1769 * any .ppd extension from the pathname in /printers or /classes
1770 * URIs...
1771 */
1772
1773 strlcpy(uri, path, sizeof(uri));
1774
1775 if (!strncmp(uri, "/printers/", 10) ||
1776 !strncmp(uri, "/classes/", 9))
1777 {
1778 /*
1779 * Check if the URI has .ppd on the end...
1780 */
1781
1782 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1783
1784 if (!strcmp(uriptr, ".ppd"))
1785 *uriptr = '\0';
1786 }
1787
1788 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1789
1790 /*
1791 * Loop through the list of locations to find a match...
1792 */
1793
1794 limit = limits[state];
1795 best = NULL;
1796 bestlen = 0;
1797
1798 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1799 loc;
1800 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1801 {
1802 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1803 loc->location ? loc->location : "nil", loc->limit);
1804
1805 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1806 {
1807 /*
1808 * Use case-insensitive comparison for queue names...
1809 */
1810
1811 if (loc->length > bestlen && loc->location &&
1812 !strncasecmp(uri, loc->location, loc->length) &&
1813 loc->location[0] == '/' &&
1814 (limit & loc->limit) != 0)
1815 {
1816 best = loc;
1817 bestlen = loc->length;
1818 }
1819 }
1820 else
1821 {
1822 /*
1823 * Use case-sensitive comparison for other URIs...
1824 */
1825
1826 if (loc->length > bestlen && loc->location &&
1827 !strncmp(uri, loc->location, loc->length) &&
1828 loc->location[0] == '/' &&
1829 (limit & loc->limit) != 0)
1830 {
1831 best = loc;
1832 bestlen = loc->length;
1833 }
1834 }
1835 }
1836
1837 /*
1838 * Return the match, if any...
1839 */
1840
1841 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1842 best ? best->location : "NONE");
1843
1844 return (best);
1845 }
1846
1847
1848 /*
1849 * 'cupsdFindLocation()' - Find the named location.
1850 */
1851
1852 cupsd_location_t * /* O - Location that matches */
1853 cupsdFindLocation(const char *location) /* I - Connection */
1854 {
1855 cupsd_location_t key; /* Search key */
1856
1857
1858 key.location = (char *)location;
1859
1860 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1861 }
1862
1863
1864 /*
1865 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1866 */
1867
1868 http_status_t /* O - HTTP_OK if authorized or error code */
1869 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1870 const char *owner)/* I - Owner of object */
1871 {
1872 int i, j, /* Looping vars */
1873 auth, /* Authorization status */
1874 type; /* Type of authentication */
1875 unsigned address[4]; /* Authorization address */
1876 cupsd_location_t *best; /* Best match for location so far */
1877 int hostlen; /* Length of hostname */
1878 char username[256], /* Username to authorize */
1879 ownername[256], /* Owner name to authorize */
1880 *ptr; /* Pointer into username */
1881 struct passwd *pw; /* User password data */
1882 static const char * const levels[] = /* Auth levels */
1883 {
1884 "ANON",
1885 "USER",
1886 "GROUP"
1887 };
1888 static const char * const types[] = /* Auth types */
1889 {
1890 "None",
1891 "Basic",
1892 "Digest",
1893 "BasicDigest",
1894 "Negotiate"
1895 };
1896
1897
1898 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1899 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1900 con->uri, con->best, con->best ? con->best->location ?
1901 con->best->location : "(null)" : "");
1902 if (owner)
1903 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1904 "cupsdIsAuthorized: owner=\"%s\"", owner);
1905
1906 /*
1907 * If there is no "best" authentication rule for this request, then
1908 * access is allowed from the local system and denied from other
1909 * addresses...
1910 */
1911
1912 if (!con->best)
1913 {
1914 if (!strcmp(con->http.hostname, "localhost") ||
1915 !strcmp(con->http.hostname, ServerName))
1916 return (HTTP_OK);
1917 else
1918 return (HTTP_FORBIDDEN);
1919 }
1920
1921 best = con->best;
1922
1923 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1924 type = DefaultAuthType;
1925
1926 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1927 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
1928 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
1929 levels[best->level], types[type],
1930 best->satisfy ? "ANY" : "ALL", best->num_names);
1931
1932 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1933 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1934 best->op, ippOpString(best->op));
1935
1936 /*
1937 * Check host/ip-based accesses...
1938 */
1939
1940 #ifdef AF_INET6
1941 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1942 {
1943 /*
1944 * Copy IPv6 address...
1945 */
1946
1947 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1948 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1949 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1950 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1951 }
1952 else
1953 #endif /* AF_INET6 */
1954 if (con->http.hostaddr->addr.sa_family == AF_INET)
1955 {
1956 /*
1957 * Copy IPv4 address...
1958 */
1959
1960 address[0] = 0;
1961 address[1] = 0;
1962 address[2] = 0;
1963 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1964 }
1965 else
1966 memset(address, 0, sizeof(address));
1967
1968 hostlen = strlen(con->http.hostname);
1969
1970 auth = cupsdCheckAccess(address, con->http.hostname, hostlen, best)
1971 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1972
1973 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
1974 auth ? "DENY" : "ALLOW");
1975
1976 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1977 return (HTTP_FORBIDDEN);
1978
1979 #ifdef HAVE_SSL
1980 /*
1981 * See if encryption is required...
1982 */
1983
1984 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1985 strcasecmp(con->http.hostname, "localhost") &&
1986 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1987 !(type == CUPSD_AUTH_NEGOTIATE ||
1988 (type == CUPSD_AUTH_NONE && DefaultAuthType == CUPSD_AUTH_NEGOTIATE)))
1989 {
1990 cupsdLogMessage(CUPSD_LOG_DEBUG,
1991 "cupsdIsAuthorized: Need upgrade to TLS...");
1992 return (HTTP_UPGRADE_REQUIRED);
1993 }
1994 #endif /* HAVE_SSL */
1995
1996 /*
1997 * Now see what access level is required...
1998 */
1999
2000 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
2001 (type == CUPSD_AUTH_NONE && best->num_names == 0))
2002 return (HTTP_OK);
2003
2004 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
2005 best->limit == CUPSD_AUTH_LIMIT_IPP)
2006 {
2007 /*
2008 * Check for unauthenticated username...
2009 */
2010
2011 ipp_attribute_t *attr; /* requesting-user-name attribute */
2012
2013
2014 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
2015 if (attr)
2016 {
2017 cupsdLogMessage(CUPSD_LOG_DEBUG,
2018 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
2019 attr->values[0].string.text);
2020 strlcpy(username, attr->values[0].string.text, sizeof(username));
2021 }
2022 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2023 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2024 else
2025 return (HTTP_OK); /* unless overridden with Satisfy */
2026 }
2027 else
2028 {
2029 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
2030 con->username);
2031
2032 #ifdef HAVE_AUTHORIZATION_H
2033 if (!con->username[0] && !con->authref)
2034 #else
2035 if (!con->username[0])
2036 #endif /* HAVE_AUTHORIZATION_H */
2037 {
2038 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2039 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2040 else
2041 return (HTTP_OK); /* unless overridden with Satisfy */
2042 }
2043
2044 if (con->type != type && type != CUPSD_AUTH_NONE &&
2045 (con->type != CUPSD_AUTH_BASIC || type != CUPSD_AUTH_BASICDIGEST))
2046 {
2047 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
2048 types[con->type], types[type]);
2049
2050 return (HTTP_UNAUTHORIZED);
2051 }
2052
2053 strlcpy(username, con->username, sizeof(username));
2054 }
2055
2056 /*
2057 * OK, got a username. See if we need normal user access, or group
2058 * access... (root always matches)
2059 */
2060
2061 if (!strcmp(username, "root"))
2062 return (HTTP_OK);
2063
2064 /*
2065 * Strip any @domain or @KDC from the username and owner...
2066 */
2067
2068 if ((ptr = strchr(username, '@')) != NULL)
2069 *ptr = '\0';
2070
2071 if (owner)
2072 {
2073 strlcpy(ownername, owner, sizeof(ownername));
2074
2075 if ((ptr = strchr(ownername, '@')) != NULL)
2076 *ptr = '\0';
2077 }
2078 else
2079 ownername[0] = '\0';
2080
2081 /*
2082 * Get the user info...
2083 */
2084
2085 if (username[0])
2086 {
2087 pw = getpwnam(username);
2088 endpwent();
2089 }
2090 else
2091 pw = NULL;
2092
2093 if (best->level == CUPSD_AUTH_USER)
2094 {
2095 /*
2096 * If there are no names associated with this location, then
2097 * any valid user is OK...
2098 */
2099
2100 if (best->num_names == 0)
2101 return (HTTP_OK);
2102
2103 /*
2104 * Otherwise check the user list and return OK if this user is
2105 * allowed...
2106 */
2107
2108 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2109 "cupsdIsAuthorized: Checking user membership...");
2110
2111 #ifdef HAVE_AUTHORIZATION_H
2112 /*
2113 * If an authorization reference was supplied it must match a right name...
2114 */
2115
2116 if (con->authref)
2117 {
2118 for (i = 0; i < best->num_names; i ++)
2119 {
2120 if (!strncasecmp(best->names[i], "@AUTHKEY(", 9) &&
2121 check_authref(con, best->names[i] + 9))
2122 return (HTTP_OK);
2123 else if (!strcasecmp(best->names[i], "@SYSTEM") &&
2124 SystemGroupAuthKey &&
2125 check_authref(con, SystemGroupAuthKey))
2126 return (HTTP_OK);
2127 }
2128
2129 return (HTTP_UNAUTHORIZED);
2130 }
2131 #endif /* HAVE_AUTHORIZATION_H */
2132
2133 for (i = 0; i < best->num_names; i ++)
2134 {
2135 if (!strcasecmp(best->names[i], "@OWNER") && owner &&
2136 !strcasecmp(username, ownername))
2137 return (HTTP_OK);
2138 else if (!strcasecmp(best->names[i], "@SYSTEM"))
2139 {
2140 for (j = 0; j < NumSystemGroups; j ++)
2141 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2142 return (HTTP_OK);
2143 }
2144 else if (best->names[i][0] == '@')
2145 {
2146 if (cupsdCheckGroup(username, pw, best->names[i] + 1))
2147 return (HTTP_OK);
2148 }
2149 else if (!strcasecmp(username, best->names[i]))
2150 return (HTTP_OK);
2151 }
2152
2153 return (HTTP_UNAUTHORIZED);
2154 }
2155
2156 /*
2157 * Check to see if this user is in any of the named groups...
2158 */
2159
2160 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2161 "cupsdIsAuthorized: Checking group membership...");
2162
2163 /*
2164 * Check to see if this user is in any of the named groups...
2165 */
2166
2167 for (i = 0; i < best->num_names; i ++)
2168 {
2169 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2170 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2171 best->names[i]);
2172
2173 if (!strcasecmp(best->names[i], "@SYSTEM"))
2174 {
2175 for (j = 0; j < NumSystemGroups; j ++)
2176 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2177 return (HTTP_OK);
2178 }
2179 else if (cupsdCheckGroup(username, pw, best->names[i]))
2180 return (HTTP_OK);
2181 }
2182
2183 /*
2184 * The user isn't part of the specified group, so deny access...
2185 */
2186
2187 cupsdLogMessage(CUPSD_LOG_DEBUG,
2188 "cupsdIsAuthorized: User not in group(s)!");
2189
2190 return (HTTP_UNAUTHORIZED);
2191 }
2192
2193
2194 /*
2195 * 'add_allow()' - Add an allow mask to the location.
2196 */
2197
2198 static cupsd_authmask_t * /* O - New mask record */
2199 add_allow(cupsd_location_t *loc) /* I - Location to add to */
2200 {
2201 cupsd_authmask_t *temp; /* New mask record */
2202
2203
2204 /*
2205 * Range-check...
2206 */
2207
2208 if (loc == NULL)
2209 return (NULL);
2210
2211 /*
2212 * Try to allocate memory for the record...
2213 */
2214
2215 if (loc->num_allow == 0)
2216 temp = malloc(sizeof(cupsd_authmask_t));
2217 else
2218 temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
2219
2220 if (temp == NULL)
2221 return (NULL);
2222
2223 loc->allow = temp;
2224 temp += loc->num_allow;
2225 loc->num_allow ++;
2226
2227 /*
2228 * Clear the mask record and return...
2229 */
2230
2231 memset(temp, 0, sizeof(cupsd_authmask_t));
2232 return (temp);
2233 }
2234
2235
2236 /*
2237 * 'add_deny()' - Add a deny mask to the location.
2238 */
2239
2240 static cupsd_authmask_t * /* O - New mask record */
2241 add_deny(cupsd_location_t *loc) /* I - Location to add to */
2242 {
2243 cupsd_authmask_t *temp; /* New mask record */
2244
2245
2246 /*
2247 * Range-check...
2248 */
2249
2250 if (loc == NULL)
2251 return (NULL);
2252
2253 /*
2254 * Try to allocate memory for the record...
2255 */
2256
2257 if (loc->num_deny == 0)
2258 temp = malloc(sizeof(cupsd_authmask_t));
2259 else
2260 temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
2261
2262 if (temp == NULL)
2263 return (NULL);
2264
2265 loc->deny = temp;
2266 temp += loc->num_deny;
2267 loc->num_deny ++;
2268
2269 /*
2270 * Clear the mask record and return...
2271 */
2272
2273 memset(temp, 0, sizeof(cupsd_authmask_t));
2274 return (temp);
2275 }
2276
2277
2278 #ifdef HAVE_AUTHORIZATION_H
2279 /*
2280 * 'check_authref()' - Check if an authorization services reference has the
2281 * supplied right.
2282 */
2283
2284 static int /* O - 1 if right is valid, 0 otherwise */
2285 check_authref(cupsd_client_t *con, /* I - Connection */
2286 const char *right) /* I - Right name */
2287 {
2288 OSStatus status; /* OS Status */
2289 AuthorizationItem authright; /* Authorization right */
2290 AuthorizationRights authrights; /* Authorization rights */
2291 AuthorizationFlags authflags; /* Authorization flags */
2292
2293
2294 /*
2295 * Check to see if the user is allowed to perform the task...
2296 */
2297
2298 if (!con->authref)
2299 return (0);
2300
2301 authright.name = right;
2302 authright.valueLength = 0;
2303 authright.value = NULL;
2304 authright.flags = 0;
2305
2306 authrights.count = 1;
2307 authrights.items = &authright;
2308
2309 authflags = kAuthorizationFlagDefaults |
2310 kAuthorizationFlagExtendRights;
2311
2312 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2313 kAuthorizationEmptyEnvironment,
2314 authflags, NULL)) != 0)
2315 {
2316 cupsdLogMessage(CUPSD_LOG_ERROR,
2317 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2318 authright.name, (int)status, cssmErrorString(status));
2319 return (0);
2320 }
2321
2322 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2323 "AuthorizationCopyRights(\"%s\") succeeded!",
2324 authright.name);
2325
2326 return (1);
2327 }
2328 #endif /* HAVE_AUTHORIZATION_H */
2329
2330
2331 /*
2332 * 'compare_locations()' - Compare two locations.
2333 */
2334
2335 static int /* O - Result of comparison */
2336 compare_locations(cupsd_location_t *a, /* I - First location */
2337 cupsd_location_t *b) /* I - Second location */
2338 {
2339 return (strcmp(b->location, a->location));
2340 }
2341
2342
2343 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2344 /*
2345 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2346 * as needed.
2347 */
2348
2349 static char * /* O - Encrypted password */
2350 cups_crypt(const char *pw, /* I - Password string */
2351 const char *salt) /* I - Salt (key) string */
2352 {
2353 if (!strncmp(salt, "$1$", 3))
2354 {
2355 /*
2356 * Use MD5 passwords without the benefit of PAM; this is for
2357 * Slackware Linux, and the algorithm was taken from the
2358 * old shadow-19990827/lib/md5crypt.c source code... :(
2359 */
2360
2361 int i; /* Looping var */
2362 unsigned long n; /* Output number */
2363 int pwlen; /* Length of password string */
2364 const char *salt_end; /* End of "salt" data for MD5 */
2365 char *ptr; /* Pointer into result string */
2366 _cups_md5_state_t state; /* Primary MD5 state info */
2367 _cups_md5_state_t state2; /* Secondary MD5 state info */
2368 unsigned char digest[16]; /* MD5 digest result */
2369 static char result[120]; /* Final password string */
2370
2371
2372 /*
2373 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2374 * Get a maximum of 8 characters of salt data after $1$...
2375 */
2376
2377 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2378 if (*salt_end == '$')
2379 break;
2380
2381 /*
2382 * Compute the MD5 sum we need...
2383 */
2384
2385 pwlen = strlen(pw);
2386
2387 _cupsMD5Init(&state);
2388 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2389 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2390
2391 _cupsMD5Init(&state2);
2392 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2393 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2394 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2395 _cupsMD5Finish(&state2, digest);
2396
2397 for (i = pwlen; i > 0; i -= 16)
2398 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2399
2400 for (i = pwlen; i > 0; i >>= 1)
2401 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2402
2403 _cupsMD5Finish(&state, digest);
2404
2405 for (i = 0; i < 1000; i ++)
2406 {
2407 _cupsMD5Init(&state);
2408
2409 if (i & 1)
2410 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2411 else
2412 _cupsMD5Append(&state, digest, 16);
2413
2414 if (i % 3)
2415 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2416
2417 if (i % 7)
2418 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2419
2420 if (i & 1)
2421 _cupsMD5Append(&state, digest, 16);
2422 else
2423 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2424
2425 _cupsMD5Finish(&state, digest);
2426 }
2427
2428 /*
2429 * Copy the final sum to the result string and return...
2430 */
2431
2432 memcpy(result, salt, salt_end - salt);
2433 ptr = result + (salt_end - salt);
2434 *ptr++ = '$';
2435
2436 for (i = 0; i < 5; i ++, ptr += 4)
2437 {
2438 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2439
2440 if (i < 4)
2441 n |= digest[i + 12];
2442 else
2443 n |= digest[5];
2444
2445 to64(ptr, n, 4);
2446 }
2447
2448 to64(ptr, digest[11], 2);
2449 ptr += 2;
2450 *ptr = '\0';
2451
2452 return (result);
2453 }
2454 else
2455 {
2456 /*
2457 * Use the standard crypt() function...
2458 */
2459
2460 return (crypt(pw, salt));
2461 }
2462 }
2463 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2464
2465
2466 #ifdef HAVE_GSSAPI
2467 /*
2468 * 'get_gss_creds()' - Obtain GSS credentials.
2469 */
2470
2471 static gss_cred_id_t /* O - Server credentials */
2472 get_gss_creds(
2473 const char *service_name, /* I - Service name */
2474 const char *con_server_name) /* I - Hostname of server */
2475 {
2476 OM_uint32 major_status, /* Major status code */
2477 minor_status; /* Minor status code */
2478 gss_name_t server_name; /* Server name */
2479 gss_cred_id_t server_creds; /* Server credentials */
2480 gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
2481 /* Service name token */
2482 char buf[1024]; /* Service name buffer */
2483
2484
2485 snprintf(buf, sizeof(buf), "%s@%s", service_name, con_server_name);
2486
2487 token.value = buf;
2488 token.length = strlen(buf);
2489 server_name = GSS_C_NO_NAME;
2490 major_status = gss_import_name(&minor_status, &token,
2491 GSS_C_NT_HOSTBASED_SERVICE,
2492 &server_name);
2493
2494 memset(&token, 0, sizeof(token));
2495
2496 if (GSS_ERROR(major_status))
2497 {
2498 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2499 "gss_import_name() failed");
2500 return (NULL);
2501 }
2502
2503 major_status = gss_display_name(&minor_status, server_name, &token, NULL);
2504
2505 if (GSS_ERROR(major_status))
2506 {
2507 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2508 "gss_display_name() failed");
2509 return (NULL);
2510 }
2511
2512 cupsdLogMessage(CUPSD_LOG_DEBUG,
2513 "get_gss_creds: Attempting to acquire credentials for %s...",
2514 (char *)token.value);
2515
2516 server_creds = GSS_C_NO_CREDENTIAL;
2517 major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
2518 GSS_C_NO_OID_SET, GSS_C_ACCEPT,
2519 &server_creds, NULL, NULL);
2520 if (GSS_ERROR(major_status))
2521 {
2522 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2523 "gss_acquire_cred() failed");
2524 gss_release_name(&minor_status, &server_name);
2525 gss_release_buffer(&minor_status, &token);
2526 return (NULL);
2527 }
2528
2529 cupsdLogMessage(CUPSD_LOG_DEBUG,
2530 "get_gss_creds: Credentials acquired successfully for %s.",
2531 (char *)token.value);
2532
2533 gss_release_name(&minor_status, &server_name);
2534 gss_release_buffer(&minor_status, &token);
2535
2536 return (server_creds);
2537 }
2538 #endif /* HAVE_GSSAPI */
2539
2540
2541 /*
2542 * 'get_md5_password()' - Get an MD5 password.
2543 */
2544
2545 static char * /* O - MD5 password string */
2546 get_md5_password(const char *username, /* I - Username */
2547 const char *group, /* I - Group */
2548 char passwd[33]) /* O - MD5 password string */
2549 {
2550 cups_file_t *fp; /* passwd.md5 file */
2551 char filename[1024], /* passwd.md5 filename */
2552 line[256], /* Line from file */
2553 tempuser[33], /* User from file */
2554 tempgroup[33]; /* Group from file */
2555
2556
2557 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2558 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2559 username, group ? group : "(null)", passwd);
2560
2561 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2562 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2563 {
2564 if (errno != ENOENT)
2565 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2566 strerror(errno));
2567
2568 return (NULL);
2569 }
2570
2571 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2572 {
2573 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2574 {
2575 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2576 continue;
2577 }
2578
2579 if (!strcmp(username, tempuser) &&
2580 (group == NULL || !strcmp(group, tempgroup)))
2581 {
2582 /*
2583 * Found the password entry!
2584 */
2585
2586 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2587 username, tempgroup);
2588
2589 cupsFileClose(fp);
2590 return (passwd);
2591 }
2592 }
2593
2594 /*
2595 * Didn't find a password entry - return NULL!
2596 */
2597
2598 cupsFileClose(fp);
2599 return (NULL);
2600 }
2601
2602
2603 #if HAVE_LIBPAM
2604 /*
2605 * 'pam_func()' - PAM conversation function.
2606 */
2607
2608 static int /* O - Success or failure */
2609 pam_func(
2610 int num_msg, /* I - Number of messages */
2611 const struct pam_message **msg, /* I - Messages */
2612 struct pam_response **resp, /* O - Responses */
2613 void *appdata_ptr)
2614 /* I - Pointer to connection */
2615 {
2616 int i; /* Looping var */
2617 struct pam_response *replies; /* Replies */
2618 cupsd_authdata_t *data; /* Pointer to auth data */
2619
2620
2621 /*
2622 * Allocate memory for the responses...
2623 */
2624
2625 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2626 return (PAM_CONV_ERR);
2627
2628 /*
2629 * Answer all of the messages...
2630 */
2631
2632 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2633
2634 #ifdef __hpux
2635 /*
2636 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2637 * module. This is a workaround...
2638 */
2639
2640 data = auth_data;
2641 (void)appdata_ptr;
2642 #else
2643 data = (cupsd_authdata_t *)appdata_ptr;
2644 #endif /* __hpux */
2645
2646 for (i = 0; i < num_msg; i ++)
2647 {
2648 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2649
2650 switch (msg[i]->msg_style)
2651 {
2652 case PAM_PROMPT_ECHO_ON:
2653 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2654 data->username));
2655 replies[i].resp_retcode = PAM_SUCCESS;
2656 replies[i].resp = strdup(data->username);
2657 break;
2658
2659 case PAM_PROMPT_ECHO_OFF:
2660 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2661 data->password));
2662 replies[i].resp_retcode = PAM_SUCCESS;
2663 replies[i].resp = strdup(data->password);
2664 break;
2665
2666 case PAM_TEXT_INFO:
2667 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2668 replies[i].resp_retcode = PAM_SUCCESS;
2669 replies[i].resp = NULL;
2670 break;
2671
2672 case PAM_ERROR_MSG:
2673 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2674 replies[i].resp_retcode = PAM_SUCCESS;
2675 replies[i].resp = NULL;
2676 break;
2677
2678 default:
2679 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2680 msg[i]->msg_style));
2681 free(replies);
2682 return (PAM_CONV_ERR);
2683 }
2684 }
2685
2686 /*
2687 * Return the responses back to PAM...
2688 */
2689
2690 *resp = replies;
2691
2692 return (PAM_SUCCESS);
2693 }
2694 #elif !defined(HAVE_USERSEC_H)
2695
2696
2697 /*
2698 * 'to64()' - Base64-encode an integer value...
2699 */
2700
2701 static void
2702 to64(char *s, /* O - Output string */
2703 unsigned long v, /* I - Value to encode */
2704 int n) /* I - Number of digits */
2705 {
2706 const char *itoa64 = "./0123456789"
2707 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2708 "abcdefghijklmnopqrstuvwxyz";
2709
2710
2711 for (; n > 0; n --, v >>= 6)
2712 *s++ = itoa64[v & 0x3f];
2713 }
2714 #endif /* HAVE_LIBPAM */
2715
2716
2717 /*
2718 * End of "$Id: auth.c 6947 2007-09-12 21:09:49Z mike $".
2719 */
Unnamed repository; edit this file 'description' to name the repository.