2 * "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $"
4 * Authorization routines for the CUPS scheduler.
6 * Copyright 2007-2011 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
9 * This file contains Kerberos support code, copyright 2006 by
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
20 * cupsdAddIPMask() - Add an IP address authorization mask.
21 * cupsdAddLocation() - Add a location for authorization.
22 * cupsdAddName() - Add a name to a location...
23 * cupsdAddNameMask() - Add a host or interface name authorization
25 * cupsdAuthorize() - Validate any authorization credentials.
26 * cupsdCheckAccess() - Check whether the given address is allowed to
28 * cupsdCheckAuth() - Check authorization masks.
29 * cupsdCheckGroup() - Check for a user's group membership.
30 * cupsdCopyLocation() - Make a copy of a location...
31 * cupsdDeleteAllLocations() - Free all memory used for location
33 * cupsdFindBest() - Find the location entry that best matches the
35 * cupsdFindLocation() - Find the named location.
36 * cupsdFreeLocation() - Free all memory used by a location.
37 * cupsdIsAuthorized() - Check to see if the user is authorized...
38 * cupsdNewLocation() - Create a new location for authorization.
39 * check_authref() - Check if an authorization services reference
40 * has the supplied right.
41 * compare_locations() - Compare two locations.
42 * copy_authmask() - Copy function for auth masks.
43 * cups_crypt() - Encrypt the password using the DES or MD5
44 * algorithms, as needed.
45 * free_authmask() - Free function for auth masks.
46 * get_md5_password() - Get an MD5 password.
47 * pam_func() - PAM conversation function.
48 * to64() - Base64-encode an integer value...
52 * Include necessary headers...
59 #endif /* HAVE_SHADOW_H */
62 #endif /* HAVE_CRYPT_H */
64 # ifdef HAVE_PAM_PAM_APPL_H
65 # include <pam/pam_appl.h>
67 # include <security/pam_appl.h>
68 # endif /* HAVE_PAM_PAM_APPL_H */
69 #endif /* HAVE_LIBPAM */
72 #endif /* HAVE_USERSEC_H */
73 #ifdef HAVE_MEMBERSHIP_H
74 # include <membership.h>
75 #endif /* HAVE_MEMBERSHIP_H */
76 #ifdef HAVE_AUTHORIZATION_H
77 # include <Security/AuthorizationTags.h>
78 # ifdef HAVE_SECBASEPRIV_H
79 # include <Security/SecBasePriv.h>
81 extern const char *cssmErrorString(int error
);
82 # endif /* HAVE_SECBASEPRIV_H */
83 #endif /* HAVE_AUTHORIZATION_H */
84 #ifdef HAVE_SYS_PARAM_H
85 # include <sys/param.h>
86 #endif /* HAVE_SYS_PARAM_H */
87 #ifdef HAVE_SYS_UCRED_H
88 # include <sys/ucred.h>
89 typedef struct xucred cupsd_ucred_t
;
90 # define CUPSD_UCRED_UID(c) (c).cr_uid
92 typedef struct ucred cupsd_ucred_t
;
93 # define CUPSD_UCRED_UID(c) (c).uid
94 #endif /* HAVE_SYS_UCRED_H */
95 #ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
96 /* Not in public headers... */
97 extern void krb5_ipc_client_set_target_uid(uid_t
);
98 extern void krb5_ipc_client_clear_target(void);
99 #endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
106 #ifdef HAVE_AUTHORIZATION_H
107 static int check_authref(cupsd_client_t
*con
, const char *right
);
108 #endif /* HAVE_AUTHORIZATION_H */
109 static int compare_locations(cupsd_location_t
*a
,
110 cupsd_location_t
*b
);
111 static cupsd_authmask_t
*copy_authmask(cupsd_authmask_t
*am
, void *data
);
112 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
113 static char *cups_crypt(const char *pw
, const char *salt
);
114 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
115 static void free_authmask(cupsd_authmask_t
*am
, void *data
);
116 static char *get_md5_password(const char *username
,
117 const char *group
, char passwd
[33]);
119 static int pam_func(int, const struct pam_message
**,
120 struct pam_response
**, void *);
121 #elif !defined(HAVE_USERSEC_H)
122 static void to64(char *s
, unsigned long v
, int n
);
123 #endif /* HAVE_LIBPAM */
127 * Local structures...
131 typedef struct cupsd_authdata_s
/**** Authentication data ****/
133 char username
[33], /* Username string */
134 password
[33]; /* Password string */
136 #endif /* HAVE_LIBPAM */
143 #if defined(__hpux) && HAVE_LIBPAM
144 static cupsd_authdata_t
*auth_data
; /* Current client being authenticated */
145 #endif /* __hpux && HAVE_LIBPAM */
149 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
152 int /* O - 1 on success, 0 on failure */
154 cups_array_t
**masks
, /* IO - Masks array (created as needed) */
155 const unsigned address
[4], /* I - IP address */
156 const unsigned netmask
[4]) /* I - IP netmask */
158 cupsd_authmask_t temp
; /* New host/domain mask */
161 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
162 "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, "
163 "netmask=%x:%x:%x:%x)",
165 address
[0], address
[1], address
[2], address
[3],
166 netmask
[0], netmask
[1], netmask
[2], netmask
[3]);
168 temp
.type
= CUPSD_AUTH_IP
;
169 memcpy(temp
.mask
.ip
.address
, address
, sizeof(temp
.mask
.ip
.address
));
170 memcpy(temp
.mask
.ip
.netmask
, netmask
, sizeof(temp
.mask
.ip
.netmask
));
173 * Create the masks array as needed and add...
177 *masks
= cupsArrayNew3(NULL
, NULL
, NULL
, 0,
178 (cups_acopy_func_t
)copy_authmask
,
179 (cups_afree_func_t
)free_authmask
);
181 return (cupsArrayAdd(*masks
, &temp
));
186 * 'cupsdAddLocation()' - Add a location for authorization.
190 cupsdAddLocation(cupsd_location_t
*loc
) /* I - Location to add */
193 * Make sure the locations array is created...
197 Locations
= cupsArrayNew3((cups_array_func_t
)compare_locations
, NULL
,
198 (cups_ahash_func_t
)NULL
, 0,
199 (cups_acopy_func_t
)NULL
,
200 (cups_afree_func_t
)cupsdFreeLocation
);
204 cupsArrayAdd(Locations
, loc
);
206 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddLocation: Added location \"%s\"",
207 loc
->location
? loc
->location
: "(null)");
213 * 'cupsdAddName()' - Add a name to a location...
217 cupsdAddName(cupsd_location_t
*loc
, /* I - Location to add to */
218 char *name
) /* I - Name to add */
220 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddName(loc=%p, name=\"%s\")",
224 loc
->names
= cupsArrayNew3(NULL
, NULL
, NULL
, 0,
225 (cups_acopy_func_t
)_cupsStrAlloc
,
226 (cups_afree_func_t
)_cupsStrFree
);
228 if (!cupsArrayAdd(loc
->names
, name
))
230 cupsdLogMessage(CUPSD_LOG_ERROR
,
231 "Unable to duplicate name for location %s: %s",
232 loc
->location
? loc
->location
: "nil", strerror(errno
));
239 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
242 int /* O - 1 on success, 0 on failure */
243 cupsdAddNameMask(cups_array_t
**masks
, /* IO - Masks array (created as needed) */
244 char *name
) /* I - Host or interface name */
246 cupsd_authmask_t temp
; /* New host/domain mask */
247 char ifname
[32], /* Interface name */
248 *ifptr
; /* Pointer to end of name */
251 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
252 "cupsdAddNameMask(masks=%p(%p), name=\"%s\")",
253 masks
, *masks
, name
);
255 if (!strcasecmp(name
, "@LOCAL"))
258 * Deny *interface*...
261 temp
.type
= CUPSD_AUTH_INTERFACE
;
262 temp
.mask
.name
.name
= (char *)"*";
264 else if (!strncasecmp(name
, "@IF(", 4))
267 * Deny *interface*...
270 strlcpy(ifname
, name
+ 4, sizeof(ifname
));
272 ifptr
= ifname
+ strlen(ifname
) - 1;
274 if (ifptr
>= ifname
&& *ifptr
== ')')
280 temp
.type
= CUPSD_AUTH_INTERFACE
;
281 temp
.mask
.name
.name
= ifname
;
292 temp
.type
= CUPSD_AUTH_NAME
;
293 temp
.mask
.name
.name
= (char *)name
;
297 * Set the name length...
300 temp
.mask
.name
.length
= strlen(temp
.mask
.name
.name
);
303 * Create the masks array as needed and add...
307 *masks
= cupsArrayNew3(NULL
, NULL
, NULL
, 0,
308 (cups_acopy_func_t
)copy_authmask
,
309 (cups_afree_func_t
)free_authmask
);
311 return (cupsArrayAdd(*masks
, &temp
));
316 * 'cupsdAuthorize()' - Validate any authorization credentials.
320 cupsdAuthorize(cupsd_client_t
*con
) /* I - Client connection */
322 int type
; /* Authentication type */
323 const char *authorization
; /* Pointer into Authorization string */
324 char *ptr
, /* Pointer into string */
325 username
[256], /* Username string */
326 password
[33]; /* Password string */
327 cupsd_cert_t
*localuser
; /* Certificate username */
328 char nonce
[HTTP_MAX_VALUE
], /* Nonce value from client */
329 md5
[33], /* MD5 password */
330 basicmd5
[33]; /* MD5 of Basic password */
331 static const char * const states
[] = /* HTTP client states... */
351 * Locate the best matching location so we know what kind of
352 * authentication to expect...
355 con
->best
= cupsdFindBest(con
->uri
, con
->http
.state
);
356 con
->type
= CUPSD_AUTH_NONE
;
358 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
359 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
360 con
->uri
, con
->best
, con
->best
? con
->best
->location
: "");
362 if (con
->best
&& con
->best
->type
!= CUPSD_AUTH_NONE
)
364 if (con
->best
->type
== CUPSD_AUTH_DEFAULT
)
365 type
= DefaultAuthType
;
367 type
= con
->best
->type
;
370 type
= DefaultAuthType
;
373 * Decode the Authorization string...
376 authorization
= httpGetField(&con
->http
, HTTP_FIELD_AUTHORIZATION
);
378 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAuthorize: Authorization=\"%s\"",
386 #endif /* HAVE_GSSAPI */
388 #ifdef HAVE_AUTHORIZATION_H
391 AuthorizationFree(con
->authref
, kAuthorizationFlagDefaults
);
394 #endif /* HAVE_AUTHORIZATION_H */
399 * No authorization data provided, return early...
402 cupsdLogMessage(CUPSD_LOG_DEBUG
,
403 "cupsdAuthorize: No authentication data provided.");
406 #ifdef HAVE_AUTHORIZATION_H
407 else if (!strncmp(authorization
, "AuthRef ", 8) &&
408 !strcasecmp(con
->http
.hostname
, "localhost"))
410 OSStatus status
; /* Status */
411 int authlen
; /* Auth string length */
412 AuthorizationItemSet
*authinfo
; /* Authorization item set */
415 * Get the Authorization Services data...
419 while (isspace(*authorization
& 255))
422 authlen
= sizeof(nonce
);
423 httpDecode64_2(nonce
, &authlen
, authorization
);
425 if (authlen
!= kAuthorizationExternalFormLength
)
427 cupsdLogMessage(CUPSD_LOG_ERROR
,
428 "External Authorization reference size is incorrect!");
432 if ((status
= AuthorizationCreateFromExternalForm(
433 (AuthorizationExternalForm
*)nonce
, &con
->authref
)) != 0)
435 cupsdLogMessage(CUPSD_LOG_ERROR
,
436 "AuthorizationCreateFromExternalForm returned %d (%s)",
437 (int)status
, cssmErrorString(status
));
443 if (!AuthorizationCopyInfo(con
->authref
, kAuthorizationEnvironmentUsername
,
446 if (authinfo
->count
== 1 && authinfo
->items
[0].value
&&
447 authinfo
->items
[0].valueLength
>= 2)
449 strlcpy(username
, authinfo
->items
[0].value
, sizeof(username
));
451 cupsdLogMessage(CUPSD_LOG_DEBUG
,
452 "cupsdAuthorize: Authorized as \"%s\" using AuthRef",
456 AuthorizationFreeItemSet(authinfo
);
462 * No username in AuthRef, grab username using peer credentials...
465 struct passwd
*pwd
; /* Password entry for this user */
466 cupsd_ucred_t peercred
; /* Peer credentials */
467 socklen_t peersize
; /* Size of peer credentials */
469 peersize
= sizeof(peercred
);
471 if (getsockopt(con
->http
.fd
, 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
473 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s",
478 if ((pwd
= getpwuid(CUPSD_UCRED_UID(peercred
))) == NULL
)
480 cupsdLogMessage(CUPSD_LOG_ERROR
,
481 "Unable to find UID %d for peer credentials.",
482 (int)CUPSD_UCRED_UID(peercred
));
486 strlcpy(username
, pwd
->pw_name
, sizeof(username
));
488 cupsdLogMessage(CUPSD_LOG_DEBUG
,
489 "cupsdAuthorize: Authorized as \"%s\" using "
490 "AuthRef + PeerCred", username
);
493 con
->type
= CUPSD_AUTH_BASIC
;
495 #endif /* HAVE_AUTHORIZATION_H */
496 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
497 else if (!strncmp(authorization
, "PeerCred ", 9) &&
498 con
->http
.hostaddr
->addr
.sa_family
== AF_LOCAL
)
501 * Use peer credentials from domain socket connection...
504 struct passwd
*pwd
; /* Password entry for this user */
505 cupsd_ucred_t peercred
; /* Peer credentials */
506 socklen_t peersize
; /* Size of peer credentials */
507 #ifdef HAVE_AUTHORIZATION_H
508 const char *name
; /* Authorizing name */
510 for (name
= (char *)cupsArrayFirst(con
->best
->names
);
512 name
= (char *)cupsArrayNext(con
->best
->names
))
513 if (!strncasecmp(name
, "@AUTHKEY(", 9) || !strcasecmp(name
, "@SYSTEM"))
515 cupsdLogMessage(CUPSD_LOG_ERROR
,
516 "PeerCred authentication not allowed for resource.");
519 #endif /* HAVE_AUTHORIZATION_H */
521 if ((pwd
= getpwnam(authorization
+ 9)) == NULL
)
523 cupsdLogMessage(CUPSD_LOG_ERROR
, "User \"%s\" does not exist.",
528 peersize
= sizeof(peercred
);
531 if (getsockopt(con
->http
.fd
, 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
533 if (getsockopt(con
->http
.fd
, SOL_SOCKET
, SO_PEERCRED
, &peercred
, &peersize
))
534 # endif /* __APPLE__ */
536 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s",
541 if (pwd
->pw_uid
!= CUPSD_UCRED_UID(peercred
))
543 cupsdLogMessage(CUPSD_LOG_ERROR
,
544 "Invalid peer credentials for \"%s\" - got %d, "
545 "expected %d!", authorization
+ 9,
546 CUPSD_UCRED_UID(peercred
), pwd
->pw_uid
);
547 # ifdef HAVE_SYS_UCRED_H
548 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_version=%d",
549 peercred
.cr_version
);
550 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_uid=%d",
552 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_ngroups=%d",
553 peercred
.cr_ngroups
);
554 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: cr_groups[0]=%d",
555 peercred
.cr_groups
[0]);
556 # endif /* HAVE_SYS_UCRED_H */
560 strlcpy(username
, authorization
+ 9, sizeof(username
));
563 con
->gss_uid
= CUPSD_UCRED_UID(peercred
);
564 # endif /* HAVE_GSSAPI */
566 cupsdLogMessage(CUPSD_LOG_DEBUG
,
567 "cupsdAuthorize: Authorized as %s using PeerCred",
570 con
->type
= CUPSD_AUTH_BASIC
;
572 #endif /* SO_PEERCRED && AF_LOCAL */
573 else if (!strncmp(authorization
, "Local", 5) &&
574 !strcasecmp(con
->http
.hostname
, "localhost"))
577 * Get Local certificate authentication data...
581 while (isspace(*authorization
& 255))
584 if ((localuser
= cupsdFindCert(authorization
)) != NULL
)
586 strlcpy(username
, localuser
->username
, sizeof(username
));
588 cupsdLogMessage(CUPSD_LOG_DEBUG
,
589 "cupsdAuthorize: Authorized as %s using Local",
594 cupsdLogMessage(CUPSD_LOG_ERROR
,
595 "cupsdAuthorize: Local authentication certificate not "
601 if (localuser
->ccache
)
602 con
->type
= CUPSD_AUTH_NEGOTIATE
;
604 #endif /* HAVE_GSSAPI */
605 con
->type
= CUPSD_AUTH_BASIC
;
607 else if (!strncmp(authorization
, "Basic", 5))
610 * Get the Basic authentication data...
613 int userlen
; /* Username:password length */
617 while (isspace(*authorization
& 255))
620 userlen
= sizeof(username
);
621 httpDecode64_2(username
, &userlen
, authorization
);
624 * Pull the username and password out...
627 if ((ptr
= strchr(username
, ':')) == NULL
)
629 cupsdLogMessage(CUPSD_LOG_ERROR
,
630 "cupsdAuthorize: Missing Basic password!");
639 * Username must not be empty...
642 cupsdLogMessage(CUPSD_LOG_ERROR
,
643 "cupsdAuthorize: Empty Basic username!");
650 * Password must not be empty...
653 cupsdLogMessage(CUPSD_LOG_ERROR
,
654 "cupsdAuthorize: Empty Basic password!");
658 strlcpy(password
, ptr
, sizeof(password
));
661 * Validate the username and password...
667 case CUPSD_AUTH_BASIC
:
671 * Only use PAM to do authentication. This supports MD5
672 * passwords, among other things...
675 pam_handle_t
*pamh
; /* PAM authentication handle */
676 int pamerr
; /* PAM error code */
677 struct pam_conv pamdata
;/* PAM conversation data */
678 cupsd_authdata_t data
; /* Authentication data */
681 strlcpy(data
.username
, username
, sizeof(data
.username
));
682 strlcpy(data
.password
, password
, sizeof(data
.password
));
684 # if defined(__sun) || defined(__hpux)
685 pamdata
.conv
= (int (*)(int, struct pam_message
**,
686 struct pam_response
**,
689 pamdata
.conv
= pam_func
;
690 # endif /* __sun || __hpux */
691 pamdata
.appdata_ptr
= &data
;
695 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
702 pamerr
= pam_start("cups", username
, &pamdata
, &pamh
);
703 if (pamerr
!= PAM_SUCCESS
)
705 cupsdLogMessage(CUPSD_LOG_ERROR
,
706 "cupsdAuthorize: pam_start() returned %d (%s)!",
707 pamerr
, pam_strerror(pamh
, pamerr
));
711 # ifdef HAVE_PAM_SET_ITEM
713 pamerr
= pam_set_item(pamh
, PAM_RHOST
, con
->http
.hostname
);
714 if (pamerr
!= PAM_SUCCESS
)
715 cupsdLogMessage(CUPSD_LOG_WARN
,
716 "cupsdAuthorize: pam_set_item(PAM_RHOST) "
717 "returned %d (%s)!", pamerr
,
718 pam_strerror(pamh
, pamerr
));
719 # endif /* PAM_RHOST */
722 pamerr
= pam_set_item(pamh
, PAM_TTY
, "cups");
723 if (pamerr
!= PAM_SUCCESS
)
724 cupsdLogMessage(CUPSD_LOG_WARN
,
725 "cupsdAuthorize: pam_set_item(PAM_TTY) "
726 "returned %d (%s)!", pamerr
,
727 pam_strerror(pamh
, pamerr
));
728 # endif /* PAM_TTY */
729 # endif /* HAVE_PAM_SET_ITEM */
731 pamerr
= pam_authenticate(pamh
, PAM_SILENT
);
732 if (pamerr
!= PAM_SUCCESS
)
734 cupsdLogMessage(CUPSD_LOG_ERROR
,
735 "cupsdAuthorize: pam_authenticate() returned %d "
737 pamerr
, pam_strerror(pamh
, pamerr
));
742 # ifdef HAVE_PAM_SETCRED
743 pamerr
= pam_setcred(pamh
, PAM_ESTABLISH_CRED
| PAM_SILENT
);
744 if (pamerr
!= PAM_SUCCESS
)
745 cupsdLogMessage(CUPSD_LOG_WARN
,
746 "cupsdAuthorize: pam_setcred() "
747 "returned %d (%s)!", pamerr
,
748 pam_strerror(pamh
, pamerr
));
749 # endif /* HAVE_PAM_SETCRED */
751 pamerr
= pam_acct_mgmt(pamh
, PAM_SILENT
);
752 if (pamerr
!= PAM_SUCCESS
)
754 cupsdLogMessage(CUPSD_LOG_ERROR
,
755 "cupsdAuthorize: pam_acct_mgmt() returned %d "
757 pamerr
, pam_strerror(pamh
, pamerr
));
762 pam_end(pamh
, PAM_SUCCESS
);
764 #elif defined(HAVE_USERSEC_H)
766 * Use AIX authentication interface...
769 char *authmsg
; /* Authentication message */
770 int reenter
; /* ??? */
773 cupsdLogMessage(CUPSD_LOG_DEBUG
,
774 "cupsdAuthorize: AIX authenticate of username "
778 if (authenticate(username
, password
, &reenter
, &authmsg
) != 0)
780 cupsdLogMessage(CUPSD_LOG_DEBUG
,
781 "cupsdAuthorize: Unable to authenticate username "
783 username
, strerror(errno
));
789 * Use normal UNIX password file-based authentication...
792 char *pass
; /* Encrypted password */
793 struct passwd
*pw
; /* User password data */
794 # ifdef HAVE_SHADOW_H
795 struct spwd
*spw
; /* Shadow password data */
796 # endif /* HAVE_SHADOW_H */
799 pw
= getpwnam(username
); /* Get the current password */
800 endpwent(); /* Close the password file */
808 cupsdLogMessage(CUPSD_LOG_ERROR
,
809 "cupsdAuthorize: Unknown username \"%s\"!",
814 # ifdef HAVE_SHADOW_H
815 spw
= getspnam(username
);
818 if (!spw
&& !strcmp(pw
->pw_passwd
, "x"))
821 * Don't allow blank passwords!
824 cupsdLogMessage(CUPSD_LOG_ERROR
,
825 "cupsdAuthorize: Username \"%s\" has no shadow "
826 "password!", username
);
830 if (spw
&& !spw
->sp_pwdp
[0] && !pw
->pw_passwd
[0])
832 if (!pw
->pw_passwd
[0])
833 # endif /* HAVE_SHADOW_H */
836 * Don't allow blank passwords!
839 cupsdLogMessage(CUPSD_LOG_ERROR
,
840 "cupsdAuthorize: Username \"%s\" has no password!",
846 * OK, the password isn't blank, so compare with what came from the
850 pass
= cups_crypt(password
, pw
->pw_passwd
);
852 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
853 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
854 pw
->pw_passwd
, pass
);
856 if (!pass
|| strcmp(pw
->pw_passwd
, pass
))
858 # ifdef HAVE_SHADOW_H
861 pass
= cups_crypt(password
, spw
->sp_pwdp
);
863 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
864 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
867 if (pass
== NULL
|| strcmp(spw
->sp_pwdp
, pass
))
869 cupsdLogMessage(CUPSD_LOG_ERROR
,
870 "cupsdAuthorize: Authentication failed for "
877 # endif /* HAVE_SHADOW_H */
879 cupsdLogMessage(CUPSD_LOG_ERROR
,
880 "cupsdAuthorize: Authentication failed for "
886 #endif /* HAVE_LIBPAM */
889 cupsdLogMessage(CUPSD_LOG_DEBUG
,
890 "cupsdAuthorize: Authorized as %s using Basic",
894 case CUPSD_AUTH_BASICDIGEST
:
896 * Do Basic authentication with the Digest password file...
899 if (!get_md5_password(username
, NULL
, md5
))
901 cupsdLogMessage(CUPSD_LOG_ERROR
,
902 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
907 httpMD5(username
, "CUPS", password
, basicmd5
);
909 if (strcmp(md5
, basicmd5
))
911 cupsdLogMessage(CUPSD_LOG_ERROR
,
912 "cupsdAuthorize: Authentication failed for \"%s\"!",
917 cupsdLogMessage(CUPSD_LOG_DEBUG
,
918 "cupsdAuthorize: Authorized as %s using BasicDigest",
925 else if (!strncmp(authorization
, "Digest", 6))
928 * Get the username, password, and nonce from the Digest attributes...
931 if (!httpGetSubField2(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "username",
932 username
, sizeof(username
)) || !username
[0])
935 * Username must not be empty...
938 cupsdLogMessage(CUPSD_LOG_ERROR
,
939 "cupsdAuthorize: Empty or missing Digest username!");
943 if (!httpGetSubField2(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "response",
944 password
, sizeof(password
)) || !password
[0])
947 * Password must not be empty...
950 cupsdLogMessage(CUPSD_LOG_ERROR
,
951 "cupsdAuthorize: Empty or missing Digest password!");
955 if (!httpGetSubField(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "nonce",
958 cupsdLogMessage(CUPSD_LOG_ERROR
,
959 "cupsdAuthorize: No nonce value for Digest "
964 if (strcmp(con
->http
.hostname
, nonce
))
966 cupsdLogMessage(CUPSD_LOG_ERROR
,
967 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
968 "got \"%s\"!", con
->http
.hostname
, nonce
);
973 * Validate the username and password...
976 if (!get_md5_password(username
, NULL
, md5
))
978 cupsdLogMessage(CUPSD_LOG_ERROR
,
979 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
984 httpMD5Final(nonce
, states
[con
->http
.state
], con
->uri
, md5
);
986 if (strcmp(md5
, password
))
988 cupsdLogMessage(CUPSD_LOG_ERROR
,
989 "cupsdAuthorize: Authentication failed for \"%s\"!",
994 cupsdLogMessage(CUPSD_LOG_DEBUG
,
995 "cupsdAuthorize: Authorized as %s using Digest",
998 con
->type
= CUPSD_AUTH_DIGEST
;
1001 else if (!strncmp(authorization
, "Negotiate", 9))
1003 int len
; /* Length of authorization string */
1004 gss_ctx_id_t context
; /* Authorization context */
1005 OM_uint32 major_status
, /* Major status code */
1006 minor_status
; /* Minor status code */
1007 gss_buffer_desc input_token
= GSS_C_EMPTY_BUFFER
,
1008 /* Input token from string */
1009 output_token
= GSS_C_EMPTY_BUFFER
;
1010 /* Output token for username */
1011 gss_name_t client_name
; /* Client name */
1016 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
1020 if (gss_init_sec_context
== NULL
)
1022 cupsdLogMessage(CUPSD_LOG_WARN
,
1023 "GSSAPI/Kerberos authentication failed because the "
1024 "Kerberos framework is not present.");
1027 # endif /* __APPLE__ */
1030 * Find the start of the Kerberos input token...
1034 while (isspace(*authorization
& 255))
1037 if (!*authorization
)
1039 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1040 "cupsdAuthorize: No authentication data specified.");
1045 * Decode the authorization string to get the input token...
1048 len
= strlen(authorization
);
1049 input_token
.value
= malloc(len
);
1050 input_token
.value
= httpDecode64_2(input_token
.value
, &len
,
1052 input_token
.length
= len
;
1055 * Accept the input token to get the authorization info...
1058 context
= GSS_C_NO_CONTEXT
;
1059 client_name
= GSS_C_NO_NAME
;
1060 major_status
= gss_accept_sec_context(&minor_status
,
1062 GSS_C_NO_CREDENTIAL
,
1064 GSS_C_NO_CHANNEL_BINDINGS
,
1072 if (output_token
.length
> 0)
1073 gss_release_buffer(&minor_status
, &output_token
);
1075 if (GSS_ERROR(major_status
))
1077 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
,
1078 "cupsdAuthorize: Error accepting GSSAPI security "
1081 if (context
!= GSS_C_NO_CONTEXT
)
1082 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
1089 * Get the username associated with the client's credentials...
1092 if (major_status
== GSS_S_CONTINUE_NEEDED
)
1093 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
,
1094 "cupsdAuthorize: Credentials not complete");
1095 else if (major_status
== GSS_S_COMPLETE
)
1097 major_status
= gss_display_name(&minor_status
, client_name
,
1098 &output_token
, NULL
);
1100 if (GSS_ERROR(major_status
))
1102 cupsdLogGSSMessage(CUPSD_LOG_DEBUG
, major_status
, minor_status
,
1103 "cupsdAuthorize: Error getting username");
1104 gss_release_name(&minor_status
, &client_name
);
1105 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
1109 strlcpy(username
, output_token
.value
, sizeof(username
));
1111 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1112 "cupsdAuthorize: Authorized as %s using Negotiate",
1115 gss_release_name(&minor_status
, &client_name
);
1116 gss_release_buffer(&minor_status
, &output_token
);
1118 con
->type
= CUPSD_AUTH_NEGOTIATE
;
1121 gss_delete_sec_context(&minor_status
, &context
, GSS_C_NO_BUFFER
);
1123 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
1125 * Get the client's UID if we are printing locally - that allows a backend
1126 * to run as the correct user to get Kerberos credentials of its own.
1129 if (_httpAddrFamily(con
->http
.hostaddr
) == AF_LOCAL
)
1131 cupsd_ucred_t peercred
; /* Peer credentials */
1132 socklen_t peersize
; /* Size of peer credentials */
1134 peersize
= sizeof(peercred
);
1137 if (getsockopt(con
->http
.fd
, 0, LOCAL_PEERCRED
, &peercred
, &peersize
))
1139 if (getsockopt(con
->http
.fd
, SOL_SOCKET
, SO_PEERCRED
, &peercred
,
1141 # endif /* __APPLE__ */
1143 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to get peer credentials - %s",
1148 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1149 "cupsdAuthorize: Using credentials for UID %d...",
1150 CUPSD_UCRED_UID(peercred
));
1151 con
->gss_uid
= CUPSD_UCRED_UID(peercred
);
1154 # endif /* SO_PEERCRED && AF_LOCAL */
1156 #endif /* HAVE_GSSAPI */
1159 char scheme
[256]; /* Auth scheme... */
1162 if (sscanf(authorization
, "%255s", scheme
) != 1)
1163 strcpy(scheme
, "UNKNOWN");
1165 cupsdLogMessage(CUPSD_LOG_ERROR
, "Bad authentication data \"%s ...\"",
1171 * If we get here, then we were able to validate the username and
1172 * password - copy the validated username and password to the client
1173 * data and return...
1176 strlcpy(con
->username
, username
, sizeof(con
->username
));
1177 strlcpy(con
->password
, password
, sizeof(con
->password
));
1182 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1183 * access a location.
1186 int /* O - 1 if allowed, 0 otherwise */
1188 unsigned ip
[4], /* I - Client address */
1189 char *name
, /* I - Client hostname */
1190 int namelen
, /* I - Length of hostname */
1191 cupsd_location_t
*loc
) /* I - Location to check */
1193 int allow
; /* 1 if allowed, 0 otherwise */
1196 if (!strcasecmp(name
, "localhost"))
1199 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1207 * Do authorization checks on the domain/address...
1210 switch (loc
->order_type
)
1213 allow
= 0; /* anti-compiler-warning-code */
1216 case CUPSD_AUTH_ALLOW
: /* Order Deny,Allow */
1219 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->deny
))
1222 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->allow
))
1226 case CUPSD_AUTH_DENY
: /* Order Allow,Deny */
1229 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->allow
))
1232 if (cupsdCheckAuth(ip
, name
, namelen
, loc
->deny
))
1243 * 'cupsdCheckAuth()' - Check authorization masks.
1246 int /* O - 1 if mask matches, 0 otherwise */
1247 cupsdCheckAuth(unsigned ip
[4], /* I - Client address */
1248 char *name
, /* I - Client hostname */
1249 int name_len
, /* I - Length of hostname */
1250 cups_array_t
*masks
) /* I - Masks */
1252 int i
; /* Looping var */
1253 cupsd_authmask_t
*mask
; /* Current mask */
1254 cupsd_netif_t
*iface
; /* Network interface */
1255 unsigned netip4
; /* IPv4 network address */
1257 unsigned netip6
[4]; /* IPv6 network address */
1258 #endif /* AF_INET6 */
1261 for (mask
= (cupsd_authmask_t
*)cupsArrayFirst(masks
);
1263 mask
= (cupsd_authmask_t
*)cupsArrayNext(masks
))
1267 case CUPSD_AUTH_INTERFACE
:
1269 * Check for a match with a network interface...
1272 netip4
= htonl(ip
[3]);
1275 netip6
[0] = htonl(ip
[0]);
1276 netip6
[1] = htonl(ip
[1]);
1277 netip6
[2] = htonl(ip
[2]);
1278 netip6
[3] = htonl(ip
[3]);
1279 #endif /* AF_INET6 */
1281 if (!strcmp(mask
->mask
.name
.name
, "*"))
1285 * Allow Back-to-My-Mac addresses...
1288 if ((ip
[0] & 0xff000000) == 0xfd000000)
1290 #endif /* __APPLE__ */
1293 * Check against all local interfaces...
1298 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
1300 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
1303 * Only check local interfaces...
1306 if (!iface
->is_local
)
1309 if (iface
->address
.addr
.sa_family
== AF_INET
)
1312 * Check IPv4 address...
1315 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
1316 (iface
->address
.ipv4
.sin_addr
.s_addr
&
1317 iface
->mask
.ipv4
.sin_addr
.s_addr
))
1324 * Check IPv6 address...
1327 for (i
= 0; i
< 4; i
++)
1328 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
1329 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
1330 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
1336 #endif /* AF_INET6 */
1342 * Check the named interface...
1345 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
1347 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
1349 if (strcmp(mask
->mask
.name
.name
, iface
->name
))
1352 if (iface
->address
.addr
.sa_family
== AF_INET
)
1355 * Check IPv4 address...
1358 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
1359 (iface
->address
.ipv4
.sin_addr
.s_addr
&
1360 iface
->mask
.ipv4
.sin_addr
.s_addr
))
1367 * Check IPv6 address...
1370 for (i
= 0; i
< 4; i
++)
1371 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
1372 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
1373 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
1379 #endif /* AF_INET6 */
1384 case CUPSD_AUTH_NAME
:
1386 * Check for exact name match...
1389 if (!strcasecmp(name
, mask
->mask
.name
.name
))
1393 * Check for domain match...
1396 if (name_len
>= mask
->mask
.name
.length
&&
1397 mask
->mask
.name
.name
[0] == '.' &&
1398 !strcasecmp(name
+ name_len
- mask
->mask
.name
.length
,
1399 mask
->mask
.name
.name
))
1403 case CUPSD_AUTH_IP
:
1405 * Check for IP/network address match...
1408 for (i
= 0; i
< 4; i
++)
1409 if ((ip
[i
] & mask
->mask
.ip
.netmask
[i
]) !=
1410 mask
->mask
.ip
.address
[i
])
1424 * 'cupsdCheckGroup()' - Check for a user's group membership.
1427 int /* O - 1 if user is a member, 0 otherwise */
1429 const char *username
, /* I - User name */
1430 struct passwd
*user
, /* I - System user info */
1431 const char *groupname
) /* I - Group name */
1433 int i
; /* Looping var */
1434 struct group
*group
; /* System group info */
1435 char junk
[33]; /* MD5 password (not used) */
1436 #ifdef HAVE_MBR_UID_TO_UUID
1437 uuid_t useruuid
, /* UUID for username */
1438 groupuuid
; /* UUID for groupname */
1439 int is_member
; /* True if user is a member of group */
1440 #endif /* HAVE_MBR_UID_TO_UUID */
1443 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1444 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1445 username
, user
, groupname
);
1451 if (!username
|| !groupname
)
1455 * Check to see if the user is a member of the named group...
1458 group
= getgrnam(groupname
);
1464 * Group exists, check it...
1467 for (i
= 0; group
->gr_mem
[i
]; i
++)
1468 if (!strcasecmp(username
, group
->gr_mem
[i
]))
1473 * Group doesn't exist or user not in group list, check the group ID
1474 * against the user's group ID...
1477 if (user
&& group
&& group
->gr_gid
== user
->pw_gid
)
1480 #ifdef HAVE_MBR_UID_TO_UUID
1482 * Check group membership through MacOS X membership API...
1485 if (user
&& !mbr_uid_to_uuid(user
->pw_uid
, useruuid
))
1490 * Map group name to UUID and check membership...
1493 if (!mbr_gid_to_uuid(group
->gr_gid
, groupuuid
))
1494 if (!mbr_check_membership(useruuid
, groupuuid
, &is_member
))
1498 else if (groupname
[0] == '#')
1501 * Use UUID directly and check for equality (user UUID) and
1502 * membership (group UUID)...
1505 if (!uuid_parse((char *)groupname
+ 1, groupuuid
))
1507 if (!uuid_compare(useruuid
, groupuuid
))
1509 else if (!mbr_check_membership(useruuid
, groupuuid
, &is_member
))
1517 else if (groupname
[0] == '#')
1519 #endif /* HAVE_MBR_UID_TO_UUID */
1522 * Username not found, group not found, or user is not part of the
1523 * system group... Check for a user and group in the MD5 password
1527 if (get_md5_password(username
, groupname
, junk
) != NULL
)
1531 * If we get this far, then the user isn't part of the named group...
1539 * 'cupsdCopyLocation()' - Make a copy of a location...
1542 cupsd_location_t
* /* O - New location */
1544 cupsd_location_t
*loc
) /* I - Original location */
1546 cupsd_location_t
*temp
; /* New location */
1550 * Make a copy of the original location...
1553 if ((temp
= calloc(1, sizeof(cupsd_location_t
))) == NULL
)
1557 * Copy the information from the original location to the new one.
1564 temp
->location
= _cupsStrAlloc(loc
->location
);
1566 temp
->limit
= loc
->limit
;
1567 temp
->order_type
= loc
->order_type
;
1568 temp
->type
= loc
->type
;
1569 temp
->level
= loc
->level
;
1570 temp
->satisfy
= loc
->satisfy
;
1571 temp
->encryption
= loc
->encryption
;
1575 if ((temp
->names
= cupsArrayDup(loc
->names
)) == NULL
)
1577 cupsdLogMessage(CUPSD_LOG_ERROR
,
1578 "Unable to allocate memory for %d names: %s",
1579 cupsArrayCount(loc
->names
), strerror(errno
));
1581 cupsdFreeLocation(temp
);
1589 * Copy allow rules...
1592 if ((temp
->allow
= cupsArrayDup(loc
->allow
)) == NULL
)
1594 cupsdLogMessage(CUPSD_LOG_ERROR
,
1595 "Unable to allocate memory for %d allow rules: %s",
1596 cupsArrayCount(loc
->allow
), strerror(errno
));
1597 cupsdFreeLocation(temp
);
1605 * Copy deny rules...
1608 if ((temp
->deny
= cupsArrayDup(loc
->deny
)) == NULL
)
1610 cupsdLogMessage(CUPSD_LOG_ERROR
,
1611 "Unable to allocate memory for %d deny rules: %s",
1612 cupsArrayCount(loc
->deny
), strerror(errno
));
1613 cupsdFreeLocation(temp
);
1623 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1627 cupsdDeleteAllLocations(void)
1630 * Free the location array, which will free all of the locations...
1633 cupsArrayDelete(Locations
);
1639 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1642 cupsd_location_t
* /* O - Location that matches */
1643 cupsdFindBest(const char *path
, /* I - Resource path */
1644 http_state_t state
) /* I - HTTP state/request */
1646 char uri
[HTTP_MAX_URI
],
1647 /* URI in request... */
1648 *uriptr
; /* Pointer into URI */
1649 cupsd_location_t
*loc
, /* Current location */
1650 *best
; /* Best match for location so far */
1651 int bestlen
; /* Length of best match */
1652 int limit
; /* Limit field */
1653 static const int limits
[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1655 CUPSD_AUTH_LIMIT_ALL
,
1656 CUPSD_AUTH_LIMIT_OPTIONS
,
1657 CUPSD_AUTH_LIMIT_GET
,
1658 CUPSD_AUTH_LIMIT_GET
,
1659 CUPSD_AUTH_LIMIT_HEAD
,
1660 CUPSD_AUTH_LIMIT_POST
,
1661 CUPSD_AUTH_LIMIT_POST
,
1662 CUPSD_AUTH_LIMIT_POST
,
1663 CUPSD_AUTH_LIMIT_PUT
,
1664 CUPSD_AUTH_LIMIT_PUT
,
1665 CUPSD_AUTH_LIMIT_DELETE
,
1666 CUPSD_AUTH_LIMIT_TRACE
,
1667 CUPSD_AUTH_LIMIT_ALL
,
1668 CUPSD_AUTH_LIMIT_ALL
1673 * First copy the connection URI to a local string so we have drop
1674 * any .ppd extension from the pathname in /printers or /classes
1678 strlcpy(uri
, path
, sizeof(uri
));
1680 if (!strncmp(uri
, "/printers/", 10) ||
1681 !strncmp(uri
, "/classes/", 9))
1684 * Check if the URI has .ppd on the end...
1687 uriptr
= uri
+ strlen(uri
) - 4; /* len > 4 if we get here... */
1689 if (!strcmp(uriptr
, ".ppd"))
1693 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: uri = \"%s\"...", uri
);
1696 * Loop through the list of locations to find a match...
1699 limit
= limits
[state
];
1703 for (loc
= (cupsd_location_t
*)cupsArrayFirst(Locations
);
1705 loc
= (cupsd_location_t
*)cupsArrayNext(Locations
))
1707 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: Location %s Limit %x",
1708 loc
->location
? loc
->location
: "nil", loc
->limit
);
1710 if (!strncmp(uri
, "/printers/", 10) || !strncmp(uri
, "/classes/", 9))
1713 * Use case-insensitive comparison for queue names...
1716 if (loc
->length
> bestlen
&& loc
->location
&&
1717 !strncasecmp(uri
, loc
->location
, loc
->length
) &&
1718 loc
->location
[0] == '/' &&
1719 (limit
& loc
->limit
) != 0)
1722 bestlen
= loc
->length
;
1728 * Use case-sensitive comparison for other URIs...
1731 if (loc
->length
> bestlen
&& loc
->location
&&
1732 !strncmp(uri
, loc
->location
, loc
->length
) &&
1733 loc
->location
[0] == '/' &&
1734 (limit
& loc
->limit
) != 0)
1737 bestlen
= loc
->length
;
1743 * Return the match, if any...
1746 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: best = %s",
1747 best
? best
->location
: "NONE");
1754 * 'cupsdFindLocation()' - Find the named location.
1757 cupsd_location_t
* /* O - Location that matches */
1758 cupsdFindLocation(const char *location
) /* I - Connection */
1760 cupsd_location_t key
; /* Search key */
1763 key
.location
= (char *)location
;
1765 return ((cupsd_location_t
*)cupsArrayFind(Locations
, &key
));
1770 * 'cupsdFreeLocation()' - Free all memory used by a location.
1774 cupsdFreeLocation(cupsd_location_t
*loc
)/* I - Location to free */
1776 cupsArrayDelete(loc
->names
);
1777 cupsArrayDelete(loc
->allow
);
1778 cupsArrayDelete(loc
->deny
);
1780 _cupsStrFree(loc
->location
);
1786 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1789 http_status_t
/* O - HTTP_OK if authorized or error code */
1790 cupsdIsAuthorized(cupsd_client_t
*con
, /* I - Connection */
1791 const char *owner
)/* I - Owner of object */
1793 int i
, /* Looping vars */
1794 auth
, /* Authorization status */
1795 type
; /* Type of authentication */
1796 unsigned address
[4]; /* Authorization address */
1797 cupsd_location_t
*best
; /* Best match for location so far */
1798 int hostlen
; /* Length of hostname */
1799 char *name
, /* Current username */
1800 username
[256], /* Username to authorize */
1801 ownername
[256], /* Owner name to authorize */
1802 *ptr
; /* Pointer into username */
1803 struct passwd
*pw
; /* User password data */
1804 static const char * const levels
[] = /* Auth levels */
1810 static const char * const types
[] = /* Auth types */
1820 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1821 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1822 con
->uri
, con
->best
, con
->best
? con
->best
->location
?
1823 con
->best
->location
: "(null)" : "");
1825 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1826 "cupsdIsAuthorized: owner=\"%s\"", owner
);
1829 * If there is no "best" authentication rule for this request, then
1830 * access is allowed from the local system and denied from other
1836 if (!strcmp(con
->http
.hostname
, "localhost") ||
1837 !strcmp(con
->http
.hostname
, ServerName
))
1840 return (HTTP_FORBIDDEN
);
1845 if ((type
= best
->type
) == CUPSD_AUTH_DEFAULT
)
1846 type
= DefaultAuthType
;
1848 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1849 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
1850 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
1851 levels
[best
->level
], types
[type
],
1852 best
->satisfy
? "ANY" : "ALL", cupsArrayCount(best
->names
));
1854 if (best
->limit
== CUPSD_AUTH_LIMIT_IPP
)
1855 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: op=%x(%s)",
1856 best
->op
, ippOpString(best
->op
));
1859 * Check host/ip-based accesses...
1863 if (con
->http
.hostaddr
->addr
.sa_family
== AF_INET6
)
1866 * Copy IPv6 address...
1869 address
[0] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[0]);
1870 address
[1] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[1]);
1871 address
[2] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[2]);
1872 address
[3] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[3]);
1875 #endif /* AF_INET6 */
1876 if (con
->http
.hostaddr
->addr
.sa_family
== AF_INET
)
1879 * Copy IPv4 address...
1885 address
[3] = ntohl(con
->http
.hostaddr
->ipv4
.sin_addr
.s_addr
);
1888 memset(address
, 0, sizeof(address
));
1890 hostlen
= strlen(con
->http
.hostname
);
1892 auth
= cupsdCheckAccess(address
, con
->http
.hostname
, hostlen
, best
)
1893 ? CUPSD_AUTH_ALLOW
: CUPSD_AUTH_DENY
;
1895 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
1896 auth
? "DENY" : "ALLOW");
1898 if (auth
== CUPSD_AUTH_DENY
&& best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
)
1899 return (HTTP_FORBIDDEN
);
1903 * See if encryption is required...
1906 if ((best
->encryption
>= HTTP_ENCRYPT_REQUIRED
&& !con
->http
.tls
&&
1907 strcasecmp(con
->http
.hostname
, "localhost") &&
1908 best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
) &&
1909 !(type
== CUPSD_AUTH_NEGOTIATE
||
1910 (type
== CUPSD_AUTH_NONE
&& DefaultAuthType
== CUPSD_AUTH_NEGOTIATE
)))
1912 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1913 "cupsdIsAuthorized: Need upgrade to TLS...");
1914 return (HTTP_UPGRADE_REQUIRED
);
1916 #endif /* HAVE_SSL */
1919 * Now see what access level is required...
1922 if (best
->level
== CUPSD_AUTH_ANON
|| /* Anonymous access - allow it */
1923 (type
== CUPSD_AUTH_NONE
&& cupsArrayCount(best
->names
) == 0))
1926 if (!con
->username
[0] && type
== CUPSD_AUTH_NONE
&&
1927 best
->limit
== CUPSD_AUTH_LIMIT_IPP
)
1930 * Check for unauthenticated username...
1933 ipp_attribute_t
*attr
; /* requesting-user-name attribute */
1936 attr
= ippFindAttribute(con
->request
, "requesting-user-name", IPP_TAG_NAME
);
1939 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1940 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1941 attr
->values
[0].string
.text
);
1942 strlcpy(username
, attr
->values
[0].string
.text
, sizeof(username
));
1944 else if (best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
|| auth
== CUPSD_AUTH_DENY
)
1945 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
1947 return (HTTP_OK
); /* unless overridden with Satisfy */
1951 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdIsAuthorized: username=\"%s\"",
1954 #ifdef HAVE_AUTHORIZATION_H
1955 if (!con
->username
[0] && !con
->authref
)
1957 if (!con
->username
[0])
1958 #endif /* HAVE_AUTHORIZATION_H */
1960 if (best
->satisfy
== CUPSD_AUTH_SATISFY_ALL
|| auth
== CUPSD_AUTH_DENY
)
1961 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
1963 return (HTTP_OK
); /* unless overridden with Satisfy */
1967 if (con
->type
!= type
&& type
!= CUPSD_AUTH_NONE
&&
1969 (type
!= CUPSD_AUTH_NEGOTIATE
|| con
->gss_uid
<= 0) &&
1970 #endif /* HAVE_GSSAPI */
1971 (con
->type
!= CUPSD_AUTH_BASIC
|| type
!= CUPSD_AUTH_BASICDIGEST
))
1973 cupsdLogMessage(CUPSD_LOG_ERROR
, "Authorized using %s, expected %s!",
1974 types
[con
->type
], types
[type
]);
1976 return (HTTP_UNAUTHORIZED
);
1979 strlcpy(username
, con
->username
, sizeof(username
));
1983 * OK, got a username. See if we need normal user access, or group
1984 * access... (root always matches)
1987 if (!strcmp(username
, "root"))
1991 * Strip any @domain or @KDC from the username and owner...
1994 if ((ptr
= strchr(username
, '@')) != NULL
)
1999 strlcpy(ownername
, owner
, sizeof(ownername
));
2001 if ((ptr
= strchr(ownername
, '@')) != NULL
)
2005 ownername
[0] = '\0';
2008 * Get the user info...
2013 pw
= getpwnam(username
);
2019 if (best
->level
== CUPSD_AUTH_USER
)
2022 * If there are no names associated with this location, then
2023 * any valid user is OK...
2026 if (cupsArrayCount(best
->names
) == 0)
2030 * Otherwise check the user list and return OK if this user is
2034 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2035 "cupsdIsAuthorized: Checking user membership...");
2037 #ifdef HAVE_AUTHORIZATION_H
2039 * If an authorization reference was supplied it must match a right name...
2044 for (name
= (char *)cupsArrayFirst(best
->names
);
2046 name
= (char *)cupsArrayNext(best
->names
))
2048 if (!strncasecmp(name
, "@AUTHKEY(", 9) && check_authref(con
, name
+ 9))
2050 else if (!strcasecmp(name
, "@SYSTEM") && SystemGroupAuthKey
&&
2051 check_authref(con
, SystemGroupAuthKey
))
2055 return (HTTP_FORBIDDEN
);
2057 #endif /* HAVE_AUTHORIZATION_H */
2059 for (name
= (char *)cupsArrayFirst(best
->names
);
2061 name
= (char *)cupsArrayNext(best
->names
))
2063 if (!strcasecmp(name
, "@OWNER") && owner
&&
2064 !strcasecmp(username
, ownername
))
2066 else if (!strcasecmp(name
, "@SYSTEM"))
2068 for (i
= 0; i
< NumSystemGroups
; i
++)
2069 if (cupsdCheckGroup(username
, pw
, SystemGroups
[i
]))
2072 else if (name
[0] == '@')
2074 if (cupsdCheckGroup(username
, pw
, name
+ 1))
2077 else if (!strcasecmp(username
, name
))
2081 return (HTTP_FORBIDDEN
);
2085 * Check to see if this user is in any of the named groups...
2088 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2089 "cupsdIsAuthorized: Checking group membership...");
2092 * Check to see if this user is in any of the named groups...
2095 for (name
= (char *)cupsArrayFirst(best
->names
);
2097 name
= (char *)cupsArrayNext(best
->names
))
2099 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2100 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2103 if (!strcasecmp(name
, "@SYSTEM"))
2105 for (i
= 0; i
< NumSystemGroups
; i
++)
2106 if (cupsdCheckGroup(username
, pw
, SystemGroups
[i
]))
2109 else if (cupsdCheckGroup(username
, pw
, name
))
2114 * The user isn't part of the specified group, so deny access...
2117 cupsdLogMessage(CUPSD_LOG_DEBUG
,
2118 "cupsdIsAuthorized: User not in group(s)!");
2120 return (HTTP_FORBIDDEN
);
2125 * 'cupsdNewLocation()' - Create a new location for authorization.
2127 * Note: Still need to call cupsdAddLocation() to add it to the list of global
2131 cupsd_location_t
* /* O - Pointer to new location record */
2132 cupsdNewLocation(const char *location
) /* I - Location path */
2134 cupsd_location_t
*temp
; /* New location */
2138 * Try to allocate memory for the new location.
2141 if ((temp
= calloc(1, sizeof(cupsd_location_t
))) == NULL
)
2145 * Initialize the record and copy the name over...
2148 if ((temp
->location
= _cupsStrAlloc(location
)) == NULL
)
2154 temp
->length
= strlen(temp
->location
);
2157 * Return the new record...
2164 #ifdef HAVE_AUTHORIZATION_H
2166 * 'check_authref()' - Check if an authorization services reference has the
2170 static int /* O - 1 if right is valid, 0 otherwise */
2171 check_authref(cupsd_client_t
*con
, /* I - Connection */
2172 const char *right
) /* I - Right name */
2174 OSStatus status
; /* OS Status */
2175 AuthorizationItem authright
; /* Authorization right */
2176 AuthorizationRights authrights
; /* Authorization rights */
2177 AuthorizationFlags authflags
; /* Authorization flags */
2181 * Check to see if the user is allowed to perform the task...
2187 authright
.name
= right
;
2188 authright
.valueLength
= 0;
2189 authright
.value
= NULL
;
2190 authright
.flags
= 0;
2192 authrights
.count
= 1;
2193 authrights
.items
= &authright
;
2195 authflags
= kAuthorizationFlagDefaults
|
2196 kAuthorizationFlagExtendRights
;
2198 if ((status
= AuthorizationCopyRights(con
->authref
, &authrights
,
2199 kAuthorizationEmptyEnvironment
,
2200 authflags
, NULL
)) != 0)
2202 cupsdLogMessage(CUPSD_LOG_ERROR
,
2203 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2204 authright
.name
, (int)status
, cssmErrorString(status
));
2208 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2209 "AuthorizationCopyRights(\"%s\") succeeded!",
2214 #endif /* HAVE_AUTHORIZATION_H */
2218 * 'compare_locations()' - Compare two locations.
2221 static int /* O - Result of comparison */
2222 compare_locations(cupsd_location_t
*a
, /* I - First location */
2223 cupsd_location_t
*b
) /* I - Second location */
2225 return (strcmp(b
->location
, a
->location
));
2230 * 'copy_authmask()' - Copy function for auth masks.
2233 static cupsd_authmask_t
* /* O - New auth mask */
2234 copy_authmask(cupsd_authmask_t
*mask
, /* I - Existing auth mask */
2235 void *data
) /* I - User data (unused) */
2237 cupsd_authmask_t
*temp
; /* New auth mask */
2242 if ((temp
= malloc(sizeof(cupsd_authmask_t
))) != NULL
)
2244 memcpy(temp
, mask
, sizeof(cupsd_authmask_t
));
2246 if (temp
->type
== CUPSD_AUTH_NAME
|| temp
->type
== CUPSD_AUTH_INTERFACE
)
2249 * Make a copy of the name...
2252 if ((temp
->mask
.name
.name
= _cupsStrAlloc(temp
->mask
.name
.name
)) == NULL
)
2255 * Failed to make copy...
2268 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2270 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2274 static char * /* O - Encrypted password */
2275 cups_crypt(const char *pw
, /* I - Password string */
2276 const char *salt
) /* I - Salt (key) string */
2278 if (!strncmp(salt
, "$1$", 3))
2281 * Use MD5 passwords without the benefit of PAM; this is for
2282 * Slackware Linux, and the algorithm was taken from the
2283 * old shadow-19990827/lib/md5crypt.c source code... :(
2286 int i
; /* Looping var */
2287 unsigned long n
; /* Output number */
2288 int pwlen
; /* Length of password string */
2289 const char *salt_end
; /* End of "salt" data for MD5 */
2290 char *ptr
; /* Pointer into result string */
2291 _cups_md5_state_t state
; /* Primary MD5 state info */
2292 _cups_md5_state_t state2
; /* Secondary MD5 state info */
2293 unsigned char digest
[16]; /* MD5 digest result */
2294 static char result
[120]; /* Final password string */
2298 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2299 * Get a maximum of 8 characters of salt data after $1$...
2302 for (salt_end
= salt
+ 3; *salt_end
&& (salt_end
- salt
) < 11; salt_end
++)
2303 if (*salt_end
== '$')
2307 * Compute the MD5 sum we need...
2312 _cupsMD5Init(&state
);
2313 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2314 _cupsMD5Append(&state
, (unsigned char *)salt
, salt_end
- salt
);
2316 _cupsMD5Init(&state2
);
2317 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
2318 _cupsMD5Append(&state2
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
2319 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
2320 _cupsMD5Finish(&state2
, digest
);
2322 for (i
= pwlen
; i
> 0; i
-= 16)
2323 _cupsMD5Append(&state
, digest
, i
> 16 ? 16 : i
);
2325 for (i
= pwlen
; i
> 0; i
>>= 1)
2326 _cupsMD5Append(&state
, (unsigned char *)((i
& 1) ? "" : pw
), 1);
2328 _cupsMD5Finish(&state
, digest
);
2330 for (i
= 0; i
< 1000; i
++)
2332 _cupsMD5Init(&state
);
2335 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2337 _cupsMD5Append(&state
, digest
, 16);
2340 _cupsMD5Append(&state
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
2343 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2346 _cupsMD5Append(&state
, digest
, 16);
2348 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
2350 _cupsMD5Finish(&state
, digest
);
2354 * Copy the final sum to the result string and return...
2357 memcpy(result
, salt
, salt_end
- salt
);
2358 ptr
= result
+ (salt_end
- salt
);
2361 for (i
= 0; i
< 5; i
++, ptr
+= 4)
2363 n
= (((digest
[i
] << 8) | digest
[i
+ 6]) << 8);
2366 n
|= digest
[i
+ 12];
2373 to64(ptr
, digest
[11], 2);
2382 * Use the standard crypt() function...
2385 return (crypt(pw
, salt
));
2388 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2392 * 'free_authmask()' - Free function for auth masks.
2396 free_authmask(cupsd_authmask_t
*mask
, /* I - Auth mask to free */
2397 void *data
) /* I - User data (unused) */
2401 if (mask
->type
== CUPSD_AUTH_NAME
|| mask
->type
== CUPSD_AUTH_INTERFACE
)
2402 _cupsStrFree(mask
->mask
.name
.name
);
2409 * 'get_md5_password()' - Get an MD5 password.
2412 static char * /* O - MD5 password string */
2413 get_md5_password(const char *username
, /* I - Username */
2414 const char *group
, /* I - Group */
2415 char passwd
[33]) /* O - MD5 password string */
2417 cups_file_t
*fp
; /* passwd.md5 file */
2418 char filename
[1024], /* passwd.md5 filename */
2419 line
[256], /* Line from file */
2420 tempuser
[33], /* User from file */
2421 tempgroup
[33]; /* Group from file */
2424 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2425 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2426 username
, group
? group
: "(null)", passwd
);
2428 snprintf(filename
, sizeof(filename
), "%s/passwd.md5", ServerRoot
);
2429 if ((fp
= cupsFileOpen(filename
, "r")) == NULL
)
2431 if (errno
!= ENOENT
)
2432 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to open %s - %s", filename
,
2438 while (cupsFileGets(fp
, line
, sizeof(line
)) != NULL
)
2440 if (sscanf(line
, "%32[^:]:%32[^:]:%32s", tempuser
, tempgroup
, passwd
) != 3)
2442 cupsdLogMessage(CUPSD_LOG_ERROR
, "Bad MD5 password line: %s", line
);
2446 if (!strcmp(username
, tempuser
) &&
2447 (group
== NULL
|| !strcmp(group
, tempgroup
)))
2450 * Found the password entry!
2453 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "Found MD5 user %s, group %s...",
2454 username
, tempgroup
);
2462 * Didn't find a password entry - return NULL!
2472 * 'pam_func()' - PAM conversation function.
2475 static int /* O - Success or failure */
2477 int num_msg
, /* I - Number of messages */
2478 const struct pam_message
**msg
, /* I - Messages */
2479 struct pam_response
**resp
, /* O - Responses */
2481 /* I - Pointer to connection */
2483 int i
; /* Looping var */
2484 struct pam_response
*replies
; /* Replies */
2485 cupsd_authdata_t
*data
; /* Pointer to auth data */
2489 * Allocate memory for the responses...
2492 if ((replies
= malloc(sizeof(struct pam_response
) * num_msg
)) == NULL
)
2493 return (PAM_CONV_ERR
);
2496 * Answer all of the messages...
2499 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr
));
2503 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2504 * module. This is a workaround...
2510 data
= (cupsd_authdata_t
*)appdata_ptr
;
2513 for (i
= 0; i
< num_msg
; i
++)
2515 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg
[i
]->msg
));
2517 switch (msg
[i
]->msg_style
)
2519 case PAM_PROMPT_ECHO_ON
:
2520 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2522 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2523 replies
[i
].resp
= strdup(data
->username
);
2526 case PAM_PROMPT_ECHO_OFF
:
2527 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2529 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2530 replies
[i
].resp
= strdup(data
->password
);
2534 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2535 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2536 replies
[i
].resp
= NULL
;
2540 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2541 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2542 replies
[i
].resp
= NULL
;
2546 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2547 msg
[i
]->msg_style
));
2549 return (PAM_CONV_ERR
);
2554 * Return the responses back to PAM...
2559 return (PAM_SUCCESS
);
2561 #elif !defined(HAVE_USERSEC_H)
2565 * 'to64()' - Base64-encode an integer value...
2569 to64(char *s
, /* O - Output string */
2570 unsigned long v
, /* I - Value to encode */
2571 int n
) /* I - Number of digits */
2573 const char *itoa64
= "./0123456789"
2574 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2575 "abcdefghijklmnopqrstuvwxyz";
2578 for (; n
> 0; n
--, v
>>= 6)
2579 *s
++ = itoa64
[v
& 0x3f];
2581 #endif /* HAVE_LIBPAM */
2585 * End of "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $".