scheduler/auth.c

   1 /*
   2  * "$Id: auth.c 181 2006-06-22 20:01:18Z jlovell $"
   3  *
   4  *   Authorization routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
   7  *
   8  *   These coded instructions, statements, and computer programs are the
   9  *   property of Easy Software Products and are protected by Federal
  10  *   copyright law.  Distribution and use rights are outlined in the file
  11  *   "LICENSE.txt" which should have been included with this file.  If this
  12  *   file is missing or damaged please contact Easy Software Products
  13  *   at:
  14  *
  15  *       Attn: CUPS Licensing Information
  16  *       Easy Software Products
  17  *       44141 Airport View Drive, Suite 204
  18  *       Hollywood, Maryland 20636 USA
  19  *
  20  *       Voice: (301) 373-9600
  21  *       EMail: cups-info@cups.org
  22  *         WWW: http://www.cups.org
  23  *
  24  * Contents:
  25  *
  26  *   cupsdAddLocation()        - Add a location for authorization.
  27  *   cupsdAddName()            - Add a name to a location...
  28  *   cupsdAllowHost()          - Add a host name that is allowed to access the
  29  *                               location.
  30  *   cupsdAllowIP()            - Add an IP address or network that is allowed
  31  *                               to access the location.
  32  *   cupsdAuthorize()          - Validate any authorization credentials.
  33  *   cupsdCheckAuth()          - Check authorization masks.
  34  *   cupsdCheckGroup()         - Check for a user's group membership.
  35  *   cupsdCopyLocation()       - Make a copy of a location...
  36  *   cupsdDeleteAllLocations() - Free all memory used for location
  37  *                               authorization.
  38  *   cupsdDeleteLocation()     - Free all memory used by a location.
  39  *   cupsdDenyHost()           - Add a host name that is not allowed to access
  40  *                               the location.
  41  *   cupsdDenyIP()             - Add an IP address or network that is not
  42  *                               allowed to access the location.
  43  *   cupsdFindBest()           - Find the location entry that best matches the
  44  *                               resource.
  45  *   cupsdFindLocation()       - Find the named location.
  46  *   cupsdIsAuthorized()       - Check to see if the user is authorized...
  47  *   add_allow()               - Add an allow mask to the location.
  48  *   add_deny()                - Add a deny mask to the location.
  49  *   compare_locations()       - Compare two locations.
  50  *   cups_crypt()              - Encrypt the password using the DES or MD5
  51  *                               algorithms, as needed.
  52  *   get_md5_password()        - Get an MD5 password.
  53  *   pam_func()                - PAM conversation function.
  54  *   to64()                    - Base64-encode an integer value...
  55  */
  56
  57 /*
  58  * Include necessary headers...
  59  */
  60
  61 #include "cupsd.h"
  62 #include <grp.h>
  63 #ifdef HAVE_SHADOW_H
  64 #  include <shadow.h>
  65 #endif /* HAVE_SHADOW_H */
  66 #ifdef HAVE_CRYPT_H
  67 #  include <crypt.h>
  68 #endif /* HAVE_CRYPT_H */
  69 #if HAVE_LIBPAM
  70 #  ifdef HAVE_PAM_PAM_APPL_H
  71 #    include <pam/pam_appl.h>
  72 #  else
  73 #    include <security/pam_appl.h>
  74 #  endif /* HAVE_PAM_PAM_APPL_H */
  75 #endif /* HAVE_LIBPAM */
  76 #ifdef HAVE_USERSEC_H
  77 #  include <usersec.h>
  78 #endif /* HAVE_USERSEC_H */
  79 #ifdef HAVE_MEMBERSHIP_H
  80 #  include <membership.h>
  81 #endif /* HAVE_MEMBERSHIP_H */
  82
  83
  84 /*
  85  * Local functions...
  86  */
  87
  88 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
  89 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
  90 static int              compare_locations(cupsd_location_t *a,
  91                                           cupsd_location_t *b);
  92 #if !HAVE_LIBPAM
  93 static char             *cups_crypt(const char *pw, const char *salt);
  94 #endif /* !HAVE_LIBPAM */
  95 static char             *get_md5_password(const char *username,
  96                                           const char *group, char passwd[33]);
  97 #if HAVE_LIBPAM
  98 static int              pam_func(int, const struct pam_message **,
  99                                  struct pam_response **, void *);
 100 #else
 101 static void             to64(char *s, unsigned long v, int n);
 102 #endif /* HAVE_LIBPAM */
 103
 104
 105 /*
 106  * Local structures...
 107  */
 108
 109 #if HAVE_LIBPAM
 110 typedef struct cupsd_authdata_s         /**** Authentication data ****/
 111 {
 112   char  username[33],                   /* Username string */
 113         password[33];                   /* Password string */
 114 } cupsd_authdata_t;
 115 #endif /* HAVE_LIBPAM */
 116
 117
 118 /*
 119  * Local globals...
 120  */
 121
 122 #if defined(__hpux) && HAVE_LIBPAM
 123 static cupsd_authdata_t *auth_data;     /* Current client being authenticated */
 124 #endif /* __hpux && HAVE_LIBPAM */
 125
 126
 127 /*
 128  * 'cupsdAddLocation()' - Add a location for authorization.
 129  */
 130
 131 cupsd_location_t *                      /* O - Pointer to new location record */
 132 cupsdAddLocation(const char *location)  /* I - Location path */
 133 {
 134   cupsd_location_t      *temp;          /* New location */
 135
 136
 137  /*
 138   * Make sure the locations array is created...
 139   */
 140
 141   if (!Locations)
 142     Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
 143
 144   if (!Locations)
 145     return (NULL);
 146
 147  /*
 148   * Try to allocate memory for the new location.
 149   */
 150
 151   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
 152     return (NULL);
 153
 154  /*
 155   * Initialize the record and copy the name over...
 156   */
 157
 158   temp->location = strdup(location);
 159   temp->length   = strlen(temp->location);
 160
 161   cupsArrayAdd(Locations, temp);
 162
 163   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
 164                   location);
 165
 166  /*
 167   * Return the new record...
 168   */
 169
 170   return (temp);
 171 }
 172
 173
 174 /*
 175  * 'cupsdAddName()' - Add a name to a location...
 176  */
 177
 178 void
 179 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 180              char             *name)    /* I - Name to add */
 181 {
 182   char  **temp;                         /* Pointer to names array */
 183
 184
 185   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
 186                   loc, name);
 187
 188   if (loc->num_names == 0)
 189     temp = malloc(sizeof(char *));
 190   else
 191     temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
 192
 193   if (temp == NULL)
 194   {
 195     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
 196                     loc->location ? loc->location : "nil", strerror(errno));
 197     return;
 198   }
 199
 200   loc->names = temp;
 201
 202   if ((temp[loc->num_names] = strdup(name)) == NULL)
 203   {
 204     cupsdLogMessage(CUPSD_LOG_ERROR,
 205                     "Unable to duplicate name for location %s: %s",
 206                     loc->location ? loc->location : "nil", strerror(errno));
 207     return;
 208   }
 209
 210   loc->num_names ++;
 211 }
 212
 213
 214 /*
 215  * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
 216  */
 217
 218 void
 219 cupsdAllowHost(cupsd_location_t *loc,   /* I - Location to add to */
 220                char             *name)  /* I - Name of host or domain to add */
 221 {
 222   cupsd_authmask_t      *temp;          /* New host/domain mask */
 223   char                  ifname[32],     /* Interface name */
 224                         *ifptr;         /* Pointer to end of name */
 225
 226
 227   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
 228                   loc, loc->location ? loc->location : "nil", name);
 229
 230   if ((temp = add_allow(loc)) == NULL)
 231     return;
 232
 233   if (!strcasecmp(name, "@LOCAL"))
 234   {
 235    /*
 236     * Allow *interface*...
 237     */
 238
 239     temp->type             = AUTH_INTERFACE;
 240     temp->mask.name.name   = strdup("*");
 241     temp->mask.name.length = 1;
 242   }
 243   else if (!strncasecmp(name, "@IF(", 4))
 244   {
 245    /*
 246     * Allow *interface*...
 247     */
 248
 249     strlcpy(ifname, name + 4, sizeof(ifname));
 250
 251     ifptr = ifname + strlen(ifname);
 252
 253     if (ifptr[-1] == ')')
 254     {
 255       ifptr --;
 256       *ifptr = '\0';
 257     }
 258
 259     temp->type             = AUTH_INTERFACE;
 260     temp->mask.name.name   = strdup(ifname);
 261     temp->mask.name.length = ifptr - ifname;
 262   }
 263   else
 264   {
 265    /*
 266     * Allow name...
 267     */
 268
 269     temp->type             = AUTH_NAME;
 270     temp->mask.name.name   = strdup(name);
 271     temp->mask.name.length = strlen(name);
 272   }
 273 }
 274
 275
 276 /*
 277  * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
 278  *                    the location.
 279  */
 280
 281 void
 282 cupsdAllowIP(cupsd_location_t *loc,     /* I - Location to add to */
 283              unsigned   address[4],     /* I - IP address to add */
 284              unsigned   netmask[4])     /* I - Netmask of address */
 285 {
 286   cupsd_authmask_t      *temp;          /* New host/domain mask */
 287
 288
 289   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 290                   "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
 291                   loc, loc->location ? loc->location : "nil",
 292                   address[0], address[1], address[2], address[3],
 293                   netmask[0], netmask[1], netmask[2], netmask[3]);
 294
 295   if ((temp = add_allow(loc)) == NULL)
 296     return;
 297
 298   temp->type = AUTH_IP;
 299   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
 300   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
 301 }
 302
 303
 304 /*
 305  * 'cupsdAuthorize()' - Validate any authorization credentials.
 306  */
 307
 308 void
 309 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 310 {
 311   int           type;                   /* Authentication type */
 312   char          *authorization,         /* Pointer into Authorization string */
 313                 *ptr,                   /* Pointer into string */
 314                 username[65],           /* Username string */
 315                 password[33];           /* Password string */
 316   const char    *localuser;             /* Certificate username */
 317   char          nonce[HTTP_MAX_VALUE],  /* Nonce value from client */
 318                 md5[33],                /* MD5 password */
 319                 basicmd5[33];           /* MD5 of Basic password */
 320   static const char * const states[] =  /* HTTP client states... */
 321                 {
 322                   "WAITING",
 323                   "OPTIONS",
 324                   "GET",
 325                   "GET",
 326                   "HEAD",
 327                   "POST",
 328                   "POST",
 329                   "POST",
 330                   "PUT",
 331                   "PUT",
 332                   "DELETE",
 333                   "TRACE",
 334                   "CLOSE",
 335                   "STATUS"
 336                 };
 337
 338
 339  /*
 340   * Locate the best matching location so we know what kind of
 341   * authentication to expect...
 342   */
 343
 344   con->best = cupsdFindBest(con->uri, con->http.state);
 345
 346   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 347                   "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
 348                   con->uri, con->best, con->best ? con->best->location : "");
 349
 350   if (con->best && con->best->type != AUTH_NONE)
 351     type = con->best->type;
 352   else
 353     type = DefaultAuthType;
 354
 355  /*
 356   * Decode the Authorization string...
 357   */
 358
 359   authorization = con->http.fields[HTTP_FIELD_AUTHORIZATION];
 360
 361   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
 362                   authorization);
 363
 364   username[0] = '\0';
 365   password[0] = '\0';
 366
 367   if (type == AUTH_NONE)
 368   {
 369    /*
 370     * No authorization required, return early...
 371     */
 372
 373     cupsdLogMessage(CUPSD_LOG_DEBUG,
 374                     "cupsdAuthorize: No authentication required.");
 375     return;
 376   }
 377   else if (!*authorization)
 378   {
 379    /*
 380     * No authorization data provided, return early...
 381     */
 382
 383     cupsdLogMessage(CUPSD_LOG_DEBUG,
 384                     "cupsdAuthorize: No authentication data provided.");
 385     return;
 386   }
 387   else if (!strncmp(authorization, "Local", 5) &&
 388            !strcasecmp(con->http.hostname, "localhost"))
 389   {
 390    /*
 391     * Get Local certificate authentication data...
 392     */
 393
 394     authorization += 5;
 395     while (isspace(*authorization & 255))
 396       authorization ++;
 397
 398     if ((localuser = cupsdFindCert(authorization)) != NULL)
 399       strlcpy(username, localuser, sizeof(username));
 400     else
 401     {
 402       cupsdLogMessage(CUPSD_LOG_ERROR,
 403                       "cupsdAuthorize: Local authentication certificate not "
 404                       "found!");
 405       return;
 406     }
 407   }
 408   else if (!strncmp(authorization, "Basic", 5) &&
 409            (type == AUTH_BASIC || type == AUTH_BASICDIGEST))
 410   {
 411    /*
 412     * Get the Basic authentication data...
 413     */
 414
 415     int userlen;                        /* Username:password length */
 416
 417
 418     authorization += 5;
 419     while (isspace(*authorization & 255))
 420       authorization ++;
 421
 422     userlen = sizeof(username);
 423     httpDecode64_2(username, &userlen, authorization);
 424
 425    /*
 426     * Pull the username and password out...
 427     */
 428
 429     if ((ptr = strchr(username, ':')) == NULL)
 430     {
 431       cupsdLogMessage(CUPSD_LOG_ERROR,
 432                       "cupsdAuthorize: Missing Basic password!");
 433       return;
 434     }
 435
 436     *ptr++ = '\0';
 437
 438     if (!username[0])
 439     {
 440      /*
 441       * Username must not be empty...
 442       */
 443
 444       cupsdLogMessage(CUPSD_LOG_ERROR,
 445                       "cupsdAuthorize: Empty Basic username!");
 446       return;
 447     }
 448
 449     if (!*ptr)
 450     {
 451      /*
 452       * Password must not be empty...
 453       */
 454
 455       cupsdLogMessage(CUPSD_LOG_ERROR,
 456                       "cupsdAuthorize: Empty Basic password!");
 457       return;
 458     }
 459
 460     strlcpy(password, ptr, sizeof(password));
 461
 462    /*
 463     * Validate the username and password...
 464     */
 465
 466     switch (type)
 467     {
 468       case AUTH_BASIC :
 469           {
 470 #if HAVE_LIBPAM
 471            /*
 472             * Only use PAM to do authentication.  This supports MD5
 473             * passwords, among other things...
 474             */
 475
 476             pam_handle_t        *pamh;  /* PAM authentication handle */
 477             int                 pamerr; /* PAM error code */
 478             struct pam_conv     pamdata;/* PAM conversation data */
 479             cupsd_authdata_t    data;   /* Authentication data */
 480
 481
 482             strlcpy(data.username, username, sizeof(data.username));
 483             strlcpy(data.password, password, sizeof(data.password));
 484
 485 #  ifdef __sun
 486             pamdata.conv        = (int (*)(int, struct pam_message **,
 487                                            struct pam_response **,
 488                                            void *))pam_func;
 489 #  else
 490             pamdata.conv        = pam_func;
 491 #  endif /* __sun */
 492             pamdata.appdata_ptr = &data;
 493
 494 #  ifdef __hpux
 495            /*
 496             * Workaround for HP-UX bug in pam_unix; see pam_func() below for
 497             * more info...
 498             */
 499
 500             auth_data = &data;
 501 #  endif /* __hpux */
 502
 503             pamerr = pam_start("cups", username, &pamdata, &pamh);
 504             if (pamerr != PAM_SUCCESS)
 505             {
 506               cupsdLogMessage(CUPSD_LOG_ERROR,
 507                               "cupsdAuthorize: pam_start() returned %d (%s)!\n",
 508                               pamerr, pam_strerror(pamh, pamerr));
 509               pam_end(pamh, 0);
 510               return;
 511             }
 512
 513             pamerr = pam_authenticate(pamh, PAM_SILENT);
 514             if (pamerr != PAM_SUCCESS)
 515             {
 516               cupsdLogMessage(CUPSD_LOG_ERROR,
 517                               "cupsdAuthorize: pam_authenticate() returned %d "
 518                               "(%s)!\n",
 519                               pamerr, pam_strerror(pamh, pamerr));
 520               pam_end(pamh, 0);
 521               return;
 522             }
 523
 524             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 525             if (pamerr != PAM_SUCCESS)
 526             {
 527               cupsdLogMessage(CUPSD_LOG_ERROR,
 528                               "cupsdAuthorize: pam_acct_mgmt() returned %d "
 529                               "(%s)!\n",
 530                               pamerr, pam_strerror(pamh, pamerr));
 531               pam_end(pamh, 0);
 532               return;
 533             }
 534
 535             pam_end(pamh, PAM_SUCCESS);
 536
 537 #elif defined(HAVE_USERSEC_H)
 538            /*
 539             * Use AIX authentication interface...
 540             */
 541
 542             char        *authmsg;       /* Authentication message */
 543             char        *loginmsg;      /* Login message */
 544             int         reenter;        /* ??? */
 545
 546
 547             cupsdLogMessage(CUPSD_LOG_DEBUG,
 548                             "cupsdAuthorize: AIX authenticate of username \"%s\"",
 549                             username);
 550
 551             reenter = 1;
 552             if (authenticate(username, password, &reenter, &authmsg) != 0)
 553             {
 554               cupsdLogMessage(CUPSD_LOG_DEBUG,
 555                               "cupsdAuthorize: Unable to authenticate username "
 556                               "\"%s\": %s",
 557                               username, strerror(errno));
 558               return;
 559             }
 560
 561 #else
 562            /*
 563             * Use normal UNIX password file-based authentication...
 564             */
 565
 566             char                *pass;  /* Encrypted password */
 567             struct passwd       *pw;    /* User password data */
 568 #  ifdef HAVE_SHADOW_H
 569             struct spwd         *spw;   /* Shadow password data */
 570 #  endif /* HAVE_SHADOW_H */
 571
 572
 573             pw = getpwnam(username);    /* Get the current password */
 574             endpwent();                 /* Close the password file */
 575
 576             if (!pw)
 577             {
 578              /*
 579               * No such user...
 580               */
 581
 582               cupsdLogMessage(CUPSD_LOG_ERROR,
 583                               "cupsdAuthorize: Unknown username \"%s\"!",
 584                               username);
 585               return;
 586             }
 587
 588 #  ifdef HAVE_SHADOW_H
 589             spw = getspnam(username);
 590             endspent();
 591
 592             if (!spw && !strcmp(pw->pw_passwd, "x"))
 593             {
 594              /*
 595               * Don't allow blank passwords!
 596               */
 597
 598               cupsdLogMessage(CUPSD_LOG_ERROR,
 599                               "cupsdAuthorize: Username \"%s\" has no shadow "
 600                               "password!", username);
 601               return;
 602             }
 603
 604             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 605 #  else
 606             if (!pw->pw_passwd[0])
 607 #  endif /* HAVE_SHADOW_H */
 608             {
 609              /*
 610               * Don't allow blank passwords!
 611               */
 612
 613               cupsdLogMessage(CUPSD_LOG_ERROR,
 614                               "cupsdAuthorize: Username \"%s\" has no password!",
 615                               username);
 616               return;
 617             }
 618
 619            /*
 620             * OK, the password isn't blank, so compare with what came from the
 621             * client...
 622             */
 623
 624             pass = cups_crypt(password, pw->pw_passwd);
 625
 626             cupsdLogMessage(CUPSD_LOG_DEBUG2,
 627                             "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
 628                             pw->pw_passwd, pass);
 629
 630             if (!pass || strcmp(pw->pw_passwd, pass))
 631             {
 632 #  ifdef HAVE_SHADOW_H
 633               if (spw)
 634               {
 635                 pass = cups_crypt(password, spw->sp_pwdp);
 636
 637                 cupsdLogMessage(CUPSD_LOG_DEBUG2,
 638                                 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
 639                                 spw->sp_pwdp, pass);
 640
 641                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 642                 {
 643                   cupsdLogMessage(CUPSD_LOG_ERROR,
 644                                   "cupsdAuthorize: Authentication failed for "
 645                                   "user \"%s\"!",
 646                                   username);
 647                   return;
 648                 }
 649               }
 650               else
 651 #  endif /* HAVE_SHADOW_H */
 652               {
 653                 cupsdLogMessage(CUPSD_LOG_ERROR,
 654                                 "cupsdAuthorize: Authentication failed for "
 655                                 "user \"%s\"!",
 656                                 username);
 657                 return;
 658               }
 659             }
 660 #endif /* HAVE_LIBPAM */
 661           }
 662           break;
 663
 664       case AUTH_BASICDIGEST :
 665          /*
 666           * Do Basic authentication with the Digest password file...
 667           */
 668
 669           if (!get_md5_password(username, NULL, md5))
 670           {
 671             cupsdLogMessage(CUPSD_LOG_ERROR,
 672                             "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 673                             username);
 674             return;
 675           }
 676
 677           httpMD5(username, "CUPS", password, basicmd5);
 678
 679           if (strcmp(md5, basicmd5))
 680           {
 681             cupsdLogMessage(CUPSD_LOG_ERROR,
 682                             "cupsdAuthorize: Authentication failed for \"%s\"!",
 683                             username);
 684             return;
 685           }
 686           break;
 687     }
 688   }
 689   else if (!strncmp(authorization, "Digest", 6) && type == AUTH_DIGEST)
 690   {
 691    /*
 692     * Get the username, password, and nonce from the Digest attributes...
 693     */
 694
 695     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
 696                           username, sizeof(username)) || !username[0])
 697     {
 698      /*
 699       * Username must not be empty...
 700       */
 701
 702       cupsdLogMessage(CUPSD_LOG_ERROR,
 703                       "cupsdAuthorize: Empty or missing Digest username!");
 704       return;
 705     }
 706
 707     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
 708                           password, sizeof(password)) || !password[0])
 709     {
 710      /*
 711       * Password must not be empty...
 712       */
 713
 714       cupsdLogMessage(CUPSD_LOG_ERROR,
 715                       "cupsdAuthorize: Empty or missing Digest password!");
 716       return;
 717     }
 718
 719     if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
 720                          nonce))
 721     {
 722       cupsdLogMessage(CUPSD_LOG_ERROR,
 723                       "cupsdAuthorize: No nonce value for Digest "
 724                       "authentication!");
 725       return;
 726     }
 727
 728     if (strcmp(con->http.hostname, nonce))
 729     {
 730       cupsdLogMessage(CUPSD_LOG_ERROR,
 731                       "cupsdAuthorize: Bad nonce value, expected \"%s\", "
 732                       "got \"%s\"!", con->http.hostname, nonce);
 733       return;
 734     }
 735
 736    /*
 737     * Validate the username and password...
 738     */
 739
 740     if (!get_md5_password(username, NULL, md5))
 741     {
 742       cupsdLogMessage(CUPSD_LOG_ERROR,
 743                       "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 744                       username);
 745       return;
 746     }
 747
 748     httpMD5Final(nonce, states[con->http.state], con->uri, md5);
 749
 750     if (strcmp(md5, password))
 751     {
 752       cupsdLogMessage(CUPSD_LOG_ERROR,
 753                       "cupsdAuthorize: Authentication failed for \"%s\"!",
 754                       username);
 755       return;
 756     }
 757   }
 758   else
 759   {
 760     cupsdLogMessage(CUPSD_LOG_DEBUG,
 761                     "cupsdAuthorize: Bad authentication data.");
 762     return;
 763   }
 764
 765  /*
 766   * If we get here, then we were able to validate the username and
 767   * password - copy the validated username and password to the client
 768   * data and return...
 769   */
 770
 771   strlcpy(con->username, username, sizeof(con->username));
 772   strlcpy(con->password, password, sizeof(con->password));
 773
 774   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: username=\"%s\"",
 775                   con->username);
 776 }
 777
 778
 779 /*
 780  * 'cupsdCheckAuth()' - Check authorization masks.
 781  */
 782
 783 int                                     /* O - 1 if mask matches, 0 otherwise */
 784 cupsdCheckAuth(
 785     unsigned         ip[4],             /* I - Client address */
 786     char             *name,             /* I - Client hostname */
 787     int              name_len,          /* I - Length of hostname */
 788     int              num_masks,         /* I - Number of masks */
 789     cupsd_authmask_t *masks)            /* I - Masks */
 790 {
 791   int           i;                      /* Looping var */
 792   cupsd_netif_t *iface;                 /* Network interface */
 793   unsigned      netip4;                 /* IPv4 network address */
 794 #ifdef AF_INET6
 795   unsigned      netip6[4];              /* IPv6 network address */
 796 #endif /* AF_INET6 */
 797
 798   while (num_masks > 0)
 799   {
 800     switch (masks->type)
 801     {
 802       case AUTH_INTERFACE :
 803          /*
 804           * Check for a match with a network interface...
 805           */
 806
 807           netip4 = htonl(ip[3]);
 808
 809 #ifdef AF_INET6
 810           netip6[0] = htonl(ip[0]);
 811           netip6[1] = htonl(ip[1]);
 812           netip6[2] = htonl(ip[2]);
 813           netip6[3] = htonl(ip[3]);
 814 #endif /* AF_INET6 */
 815
 816           if (!strcmp(masks->mask.name.name, "*"))
 817           {
 818            /*
 819             * Check against all local interfaces...
 820             */
 821
 822             cupsdNetIFUpdate();
 823
 824             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 825                  iface;
 826                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 827             {
 828              /*
 829               * Only check local interfaces...
 830               */
 831
 832               if (!iface->is_local)
 833                 continue;
 834
 835               if (iface->address.addr.sa_family == AF_INET)
 836               {
 837                /*
 838                 * Check IPv4 address...
 839                 */
 840
 841                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 842                     (iface->address.ipv4.sin_addr.s_addr &
 843                      iface->mask.ipv4.sin_addr.s_addr))
 844                   return (1);
 845               }
 846 #ifdef AF_INET6
 847               else
 848               {
 849                /*
 850                 * Check IPv6 address...
 851                 */
 852
 853                 for (i = 0; i < 4; i ++)
 854                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 855                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 856                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 857                     break;
 858
 859                 if (i == 4)
 860                   return (1);
 861               }
 862 #endif /* AF_INET6 */
 863             }
 864           }
 865           else
 866           {
 867            /*
 868             * Check the named interface...
 869             */
 870
 871             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 872                  iface;
 873                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 874             {
 875               if (strcmp(masks->mask.name.name, iface->name))
 876                 continue;
 877
 878               if (iface->address.addr.sa_family == AF_INET)
 879               {
 880                /*
 881                 * Check IPv4 address...
 882                 */
 883
 884                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 885                     (iface->address.ipv4.sin_addr.s_addr &
 886                      iface->mask.ipv4.sin_addr.s_addr))
 887                   return (1);
 888               }
 889 #ifdef AF_INET6
 890               else
 891               {
 892                /*
 893                 * Check IPv6 address...
 894                 */
 895
 896                 for (i = 0; i < 4; i ++)
 897                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 898                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 899                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 900                     break;
 901
 902                 if (i == 4)
 903                   return (1);
 904               }
 905 #endif /* AF_INET6 */
 906             }
 907           }
 908           break;
 909
 910       case AUTH_NAME :
 911          /*
 912           * Check for exact name match...
 913           */
 914
 915           if (!strcasecmp(name, masks->mask.name.name))
 916             return (1);
 917
 918          /*
 919           * Check for domain match...
 920           */
 921
 922           if (name_len >= masks->mask.name.length &&
 923               masks->mask.name.name[0] == '.' &&
 924               !strcasecmp(name + name_len - masks->mask.name.length,
 925                           masks->mask.name.name))
 926             return (1);
 927           break;
 928
 929       case AUTH_IP :
 930          /*
 931           * Check for IP/network address match...
 932           */
 933
 934           for (i = 0; i < 4; i ++)
 935             if ((ip[i] & masks->mask.ip.netmask[i]) !=
 936                     masks->mask.ip.address[i])
 937               break;
 938
 939           if (i == 4)
 940             return (1);
 941           break;
 942     }
 943
 944     masks ++;
 945     num_masks --;
 946   }
 947
 948   return (0);
 949 }
 950
 951
 952 /*
 953  * 'cupsdCheckGroup()' - Check for a user's group membership.
 954  */
 955
 956 int                                     /* O - 1 if user is a member, 0 otherwise */
 957 cupsdCheckGroup(
 958     const char    *username,            /* I - User name */
 959     struct passwd *user,                /* I - System user info */
 960     const char    *groupname)           /* I - Group name */
 961 {
 962   int                   i;              /* Looping var */
 963   struct group          *group;         /* System group info */
 964   char                  junk[33];       /* MD5 password (not used) */
 965 #ifdef HAVE_MBR_UID_TO_UUID
 966   uuid_t                useruuid,       /* UUID for username */
 967                         groupuuid;      /* UUID for groupname */
 968   int                   is_member;      /* True if user is a member of group */
 969 #endif /* HAVE_MBR_UID_TO_UUID */
 970
 971
 972   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 973                   "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
 974                   username, user, groupname);
 975
 976  /*
 977   * Validate input...
 978   */
 979
 980   if (!username || !groupname)
 981     return (0);
 982
 983  /*
 984   * Check to see if the user is a member of the named group...
 985   */
 986
 987   group = getgrnam(groupname);
 988   endgrent();
 989
 990   if (group != NULL)
 991   {
 992    /*
 993     * Group exists, check it...
 994     */
 995
 996     for (i = 0; group->gr_mem[i]; i ++)
 997       if (!strcasecmp(username, group->gr_mem[i]))
 998         return (1);
 999   }
1000
1001  /*
1002   * Group doesn't exist or user not in group list, check the group ID
1003   * against the user's group ID...
1004   */
1005
1006   if (user && group && group->gr_gid == user->pw_gid)
1007     return (1);
1008
1009 #ifdef HAVE_MBR_UID_TO_UUID
1010  /*
1011   * Check group membership through MacOS X membership API...
1012   */
1013
1014   if (user && group)
1015     if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1016       if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1017         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1018           if (is_member)
1019             return (1);
1020 #endif /* HAVE_MBR_UID_TO_UUID */
1021
1022  /*
1023   * Username not found, group not found, or user is not part of the
1024   * system group...  Check for a user and group in the MD5 password
1025   * file...
1026   */
1027
1028   if (get_md5_password(username, groupname, junk) != NULL)
1029     return (1);
1030
1031  /*
1032   * If we get this far, then the user isn't part of the named group...
1033   */
1034
1035   return (0);
1036 }
1037
1038
1039 /*
1040  * 'cupsdCopyLocation()' - Make a copy of a location...
1041  */
1042
1043 cupsd_location_t *                      /* O - New location */
1044 cupsdCopyLocation(
1045     cupsd_location_t **loc)             /* IO - Original location */
1046 {
1047   int                   i;              /* Looping var */
1048   cupsd_location_t      *temp;          /* New location */
1049   char                  location[HTTP_MAX_URI];
1050                                         /* Location of resource */
1051
1052
1053  /*
1054   * Use a local copy of location because cupsdAddLocation may cause
1055   * this memory to be moved...
1056   */
1057
1058   strlcpy(location, (*loc)->location, sizeof(location));
1059
1060   if ((temp = cupsdAddLocation(location)) == NULL)
1061     return (NULL);
1062
1063  /*
1064   * Copy the information from the original location to the new one.
1065   */
1066
1067   temp->limit      = (*loc)->limit;
1068   temp->order_type = (*loc)->order_type;
1069   temp->type       = (*loc)->type;
1070   temp->level      = (*loc)->level;
1071   temp->satisfy    = (*loc)->satisfy;
1072   temp->encryption = (*loc)->encryption;
1073
1074   if ((temp->num_names  = (*loc)->num_names) > 0)
1075   {
1076    /*
1077     * Copy the names array...
1078     */
1079
1080     if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1081     {
1082       cupsdLogMessage(CUPSD_LOG_ERROR,
1083                       "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1084                       temp->num_names, strerror(errno));
1085
1086       cupsdDeleteLocation(temp);
1087       return (NULL);
1088     }
1089
1090     for (i = 0; i < temp->num_names; i ++)
1091       if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1092       {
1093         cupsdLogMessage(CUPSD_LOG_ERROR,
1094                         "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1095                         (*loc)->names[i], strerror(errno));
1096
1097         cupsdDeleteLocation(temp);
1098         return (NULL);
1099       }
1100   }
1101
1102   if ((temp->num_allow  = (*loc)->num_allow) > 0)
1103   {
1104    /*
1105     * Copy allow rules...
1106     */
1107
1108     if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1109     {
1110       cupsdLogMessage(CUPSD_LOG_ERROR,
1111                       "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1112                       temp->num_allow, strerror(errno));
1113       cupsdDeleteLocation(temp);
1114       return (NULL);
1115     }
1116
1117     for (i = 0; i < temp->num_allow; i ++)
1118       switch (temp->allow[i].type = (*loc)->allow[i].type)
1119       {
1120         case AUTH_NAME :
1121             temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1122             temp->allow[i].mask.name.name   = strdup((*loc)->allow[i].mask.name.name);
1123
1124             if (temp->allow[i].mask.name.name == NULL)
1125             {
1126               cupsdLogMessage(CUPSD_LOG_ERROR,
1127                               "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1128                               (*loc)->allow[i].mask.name.name, strerror(errno));
1129               cupsdDeleteLocation(temp);
1130               return (NULL);
1131             }
1132             break;
1133         case AUTH_IP :
1134             memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1135                    sizeof(cupsd_ipmask_t));
1136             break;
1137       }
1138   }
1139
1140   if ((temp->num_deny  = (*loc)->num_deny) > 0)
1141   {
1142    /*
1143     * Copy deny rules...
1144     */
1145
1146     if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1147     {
1148       cupsdLogMessage(CUPSD_LOG_ERROR,
1149                       "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1150                       temp->num_deny, strerror(errno));
1151       cupsdDeleteLocation(temp);
1152       return (NULL);
1153     }
1154
1155     for (i = 0; i < temp->num_deny; i ++)
1156       switch (temp->deny[i].type = (*loc)->deny[i].type)
1157       {
1158         case AUTH_NAME :
1159             temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1160             temp->deny[i].mask.name.name   = strdup((*loc)->deny[i].mask.name.name);
1161
1162             if (temp->deny[i].mask.name.name == NULL)
1163             {
1164               cupsdLogMessage(CUPSD_LOG_ERROR,
1165                               "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1166                               (*loc)->deny[i].mask.name.name, strerror(errno));
1167               cupsdDeleteLocation(temp);
1168               return (NULL);
1169             }
1170             break;
1171         case AUTH_IP :
1172             memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1173                    sizeof(cupsd_ipmask_t));
1174             break;
1175       }
1176   }
1177
1178   return (temp);
1179 }
1180
1181
1182 /*
1183  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1184  */
1185
1186 void
1187 cupsdDeleteAllLocations(void)
1188 {
1189   cupsd_location_t      *loc;           /* Current location */
1190
1191
1192  /*
1193   * Free all of the allow/deny records first...
1194   */
1195
1196   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1197        loc;
1198        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1199     cupsdDeleteLocation(loc);
1200
1201  /*
1202   * Then free the location array...
1203   */
1204
1205   cupsArrayDelete(Locations);
1206   Locations = NULL;
1207 }
1208
1209
1210 /*
1211  * 'cupsdDeleteLocation()' - Free all memory used by a location.
1212  */
1213
1214 void
1215 cupsdDeleteLocation(
1216     cupsd_location_t *loc)              /* I - Location to delete */
1217 {
1218   int                   i;              /* Looping var */
1219   cupsd_authmask_t      *mask;          /* Current mask */
1220
1221
1222   cupsArrayRemove(Locations, loc);
1223
1224   for (i = loc->num_names - 1; i >= 0; i --)
1225     free(loc->names[i]);
1226
1227   if (loc->num_names > 0)
1228     free(loc->names);
1229
1230   for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1231     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1232       free(mask->mask.name.name);
1233
1234   if (loc->num_allow > 0)
1235     free(loc->allow);
1236
1237   for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1238     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1239       free(mask->mask.name.name);
1240
1241   if (loc->num_deny > 0)
1242     free(loc->deny);
1243
1244   free(loc->location);
1245   free(loc);
1246 }
1247
1248
1249 /*
1250  * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1251  *                     location.
1252  */
1253
1254 void
1255 cupsdDenyHost(cupsd_location_t *loc,    /* I - Location to add to */
1256               char             *name)   /* I - Name of host or domain to add */
1257 {
1258   cupsd_authmask_t      *temp;          /* New host/domain mask */
1259   char                  ifname[32],     /* Interface name */
1260                         *ifptr;         /* Pointer to end of name */
1261
1262
1263   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1264                   loc, loc->location ? loc->location : "nil", name);
1265
1266   if ((temp = add_deny(loc)) == NULL)
1267     return;
1268
1269   if (!strcasecmp(name, "@LOCAL"))
1270   {
1271    /*
1272     * Deny *interface*...
1273     */
1274
1275     temp->type             = AUTH_INTERFACE;
1276     temp->mask.name.name   = strdup("*");
1277     temp->mask.name.length = 1;
1278   }
1279   else if (!strncasecmp(name, "@IF(", 4))
1280   {
1281    /*
1282     * Deny *interface*...
1283     */
1284
1285     strlcpy(ifname, name + 4, sizeof(ifname));
1286
1287     ifptr = ifname + strlen(ifname);
1288
1289     if (ifptr[-1] == ')')
1290     {
1291       ifptr --;
1292       *ifptr = '\0';
1293     }
1294
1295     temp->type             = AUTH_INTERFACE;
1296     temp->mask.name.name   = strdup(ifname);
1297     temp->mask.name.length = ifptr - ifname;
1298   }
1299   else
1300   {
1301    /*
1302     * Deny name...
1303     */
1304
1305     temp->type             = AUTH_NAME;
1306     temp->mask.name.name   = strdup(name);
1307     temp->mask.name.length = strlen(name);
1308   }
1309 }
1310
1311
1312 /*
1313  * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1314  *                   access the location.
1315  */
1316
1317 void
1318 cupsdDenyIP(cupsd_location_t *loc,      /* I - Location to add to */
1319             unsigned         address[4],/* I - IP address to add */
1320             unsigned         netmask[4])/* I - Netmask of address */
1321 {
1322   cupsd_authmask_t      *temp;          /* New host/domain mask */
1323
1324
1325   cupsdLogMessage(CUPSD_LOG_DEBUG,
1326                   "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1327                   loc, loc->location ? loc->location : "nil",
1328                   address[0], address[1], address[2], address[3],
1329                   netmask[0], netmask[1], netmask[2], netmask[3]);
1330
1331   if ((temp = add_deny(loc)) == NULL)
1332     return;
1333
1334   temp->type = AUTH_IP;
1335   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1336   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1337 }
1338
1339
1340 /*
1341  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1342  */
1343
1344 cupsd_location_t *                      /* O - Location that matches */
1345 cupsdFindBest(const char   *path,       /* I - Resource path */
1346               http_state_t state)       /* I - HTTP state/request */
1347 {
1348   char                  uri[HTTP_MAX_URI],
1349                                         /* URI in request... */
1350                         *uriptr;        /* Pointer into URI */
1351   cupsd_location_t      *loc,           /* Current location */
1352                         *best;          /* Best match for location so far */
1353   int                   bestlen;        /* Length of best match */
1354   int                   limit;          /* Limit field */
1355   static const int      limits[] =      /* Map http_status_t to AUTH_LIMIT_xyz */
1356                 {
1357                   AUTH_LIMIT_ALL,
1358                   AUTH_LIMIT_OPTIONS,
1359                   AUTH_LIMIT_GET,
1360                   AUTH_LIMIT_GET,
1361                   AUTH_LIMIT_HEAD,
1362                   AUTH_LIMIT_POST,
1363                   AUTH_LIMIT_POST,
1364                   AUTH_LIMIT_POST,
1365                   AUTH_LIMIT_PUT,
1366                   AUTH_LIMIT_PUT,
1367                   AUTH_LIMIT_DELETE,
1368                   AUTH_LIMIT_TRACE,
1369                   AUTH_LIMIT_ALL,
1370                   AUTH_LIMIT_ALL
1371                 };
1372
1373
1374  /*
1375   * First copy the connection URI to a local string so we have drop
1376   * any .ppd extension from the pathname in /printers or /classes
1377   * URIs...
1378   */
1379
1380   strlcpy(uri, path, sizeof(uri));
1381
1382   if (!strncmp(uri, "/printers/", 10) ||
1383       !strncmp(uri, "/classes/", 9))
1384   {
1385    /*
1386     * Check if the URI has .ppd on the end...
1387     */
1388
1389     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1390
1391     if (!strcmp(uriptr, ".ppd"))
1392       *uriptr = '\0';
1393   }
1394
1395   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1396
1397  /*
1398   * Loop through the list of locations to find a match...
1399   */
1400
1401   limit   = limits[state];
1402   best    = NULL;
1403   bestlen = 0;
1404
1405   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1406        loc;
1407        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1408   {
1409     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1410                     loc->location ? loc->location : "nil", loc->limit);
1411
1412     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1413     {
1414      /*
1415       * Use case-insensitive comparison for queue names...
1416       */
1417
1418       if (loc->length > bestlen && loc->location &&
1419           !strncasecmp(uri, loc->location, loc->length) &&
1420           loc->location[0] == '/' &&
1421           (limit & loc->limit) != 0)
1422       {
1423         best    = loc;
1424         bestlen = loc->length;
1425       }
1426     }
1427     else
1428     {
1429      /*
1430       * Use case-sensitive comparison for other URIs...
1431       */
1432
1433       if (loc->length > bestlen && loc->location &&
1434           !strncmp(uri, loc->location, loc->length) &&
1435           loc->location[0] == '/' &&
1436           (limit & loc->limit) != 0)
1437       {
1438         best    = loc;
1439         bestlen = loc->length;
1440       }
1441     }
1442   }
1443
1444  /*
1445   * Return the match, if any...
1446   */
1447
1448   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1449                   best ? best->location : "NONE");
1450
1451   return (best);
1452 }
1453
1454
1455 /*
1456  * 'cupsdFindLocation()' - Find the named location.
1457  */
1458
1459 cupsd_location_t *                      /* O - Location that matches */
1460 cupsdFindLocation(const char *location) /* I - Connection */
1461 {
1462   cupsd_location_t      key;            /* Search key */
1463
1464
1465   key.location = (char *)location;
1466
1467   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1468 }
1469
1470
1471 /*
1472  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1473  */
1474
1475 http_status_t                           /* O - HTTP_OK if authorized or error code */
1476 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1477                   const char     *owner)/* I - Owner of object */
1478 {
1479   int                   i, j,           /* Looping vars */
1480                         auth;           /* Authorization status */
1481   unsigned              address[4];     /* Authorization address */
1482   cupsd_location_t      *best;          /* Best match for location so far */
1483   int                   hostlen;        /* Length of hostname */
1484   const char            *username;      /* Username to authorize */
1485   struct passwd         *pw;            /* User password data */
1486   static const char * const levels[] =  /* Auth levels */
1487                 {
1488                   "ANON",
1489                   "USER",
1490                   "GROUP"
1491                 };
1492   static const char * const types[] =   /* Auth types */
1493                 {
1494                   "NONE",
1495                   "BASIC",
1496                   "DIGEST",
1497                   "BASICDIGEST"
1498                 };
1499
1500
1501   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1502                   "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1503                   con->uri, con->best, con->best ? con->best->location ?
1504                                            con->best->location : "(null)" : "");
1505   if (owner)
1506     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1507                     "cupsdIsAuthorized: owner=\"%s\"", owner);
1508
1509  /*
1510   * If there is no "best" authentication rule for this request, then
1511   * access is allowed from the local system and denied from other
1512   * addresses...
1513   */
1514
1515   if (!con->best)
1516   {
1517     if (!strcmp(con->http.hostname, "localhost") ||
1518         !strcmp(con->http.hostname, ServerName))
1519       return (HTTP_OK);
1520     else
1521       return (HTTP_FORBIDDEN);
1522   }
1523
1524   best = con->best;
1525
1526   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1527                   "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, "
1528                   "satisfy=AUTH_SATISFY_%s, num_names=%d",
1529                   levels[best->level], types[best->type],
1530                   best->satisfy ? "ANY" : "ALL", best->num_names);
1531
1532   if (best->limit == AUTH_LIMIT_IPP)
1533     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1534                     best->op, ippOpString(best->op));
1535
1536  /*
1537   * Check host/ip-based accesses...
1538   */
1539
1540 #ifdef AF_INET6
1541   if (con->http.hostaddr->addr.sa_family == AF_INET6)
1542   {
1543    /*
1544     * Copy IPv6 address...
1545     */
1546
1547     address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1548     address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1549     address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1550     address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1551   }
1552   else
1553 #endif /* AF_INET6 */
1554   if (con->http.hostaddr->addr.sa_family == AF_INET)
1555   {
1556    /*
1557     * Copy IPv4 address...
1558     */
1559
1560     address[0] = 0;
1561     address[1] = 0;
1562     address[2] = 0;
1563     address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1564   }
1565   else
1566     memset(address, 0, sizeof(address));
1567
1568   hostlen = strlen(con->http.hostname);
1569
1570   if (!strcasecmp(con->http.hostname, "localhost"))
1571   {
1572    /*
1573     * Access from localhost (127.0.0.1 or ::1) is always allowed...
1574     */
1575
1576     auth = AUTH_ALLOW;
1577   }
1578   else
1579   {
1580    /*
1581     * Do authorization checks on the domain/address...
1582     */
1583
1584     switch (best->order_type)
1585     {
1586       default :
1587           auth = AUTH_DENY;     /* anti-compiler-warning-code */
1588           break;
1589
1590       case AUTH_ALLOW : /* Order Deny,Allow */
1591           auth = AUTH_ALLOW;
1592
1593           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1594                         best->num_deny, best->deny))
1595             auth = AUTH_DENY;
1596
1597           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1598                         best->num_allow, best->allow))
1599             auth = AUTH_ALLOW;
1600           break;
1601
1602       case AUTH_DENY : /* Order Allow,Deny */
1603           auth = AUTH_DENY;
1604
1605           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1606                         best->num_allow, best->allow))
1607             auth = AUTH_ALLOW;
1608
1609           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1610                         best->num_deny, best->deny))
1611             auth = AUTH_DENY;
1612           break;
1613     }
1614   }
1615
1616   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1617                   auth ? "DENY" : "ALLOW");
1618
1619   if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1620     return (HTTP_FORBIDDEN);
1621
1622 #ifdef HAVE_SSL
1623  /*
1624   * See if encryption is required...
1625   */
1626
1627   if (best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1628       strcasecmp(con->http.hostname, "localhost") &&
1629       best->satisfy == AUTH_SATISFY_ALL)
1630   {
1631     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1632                     "cupsdIsAuthorized: Need upgrade to TLS...");
1633     return (HTTP_UPGRADE_REQUIRED);
1634   }
1635 #endif /* HAVE_SSL */
1636
1637  /*
1638   * Now see what access level is required...
1639   */
1640
1641   if (best->level == AUTH_ANON ||       /* Anonymous access - allow it */
1642       (best->type == AUTH_NONE && best->num_names == 0))
1643     return (HTTP_OK);
1644
1645   if (!con->username[0] && best->type == AUTH_NONE &&
1646       best->limit == AUTH_LIMIT_IPP)
1647   {
1648    /*
1649     * Check for unauthenticated username...
1650     */
1651
1652     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1653
1654
1655     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1656     if (attr)
1657     {
1658       cupsdLogMessage(CUPSD_LOG_DEBUG2,
1659                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1660                       attr->values[0].string.text);
1661       username = attr->values[0].string.text;
1662     }
1663     else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1664       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1665     else
1666       return (HTTP_OK);                 /* unless overridden with Satisfy */
1667   }
1668   else
1669   {
1670     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: username=\"%s\"",
1671                     con->username);
1672
1673     if (!con->username[0])
1674     {
1675       if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1676         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1677       else
1678         return (HTTP_OK);               /* unless overridden with Satisfy */
1679     }
1680
1681     username = con->username;
1682   }
1683
1684  /*
1685   * OK, got a username.  See if we need normal user access, or group
1686   * access... (root always matches)
1687   */
1688
1689   if (!strcmp(username, "root"))
1690     return (HTTP_OK);
1691
1692  /*
1693   * Get the user info...
1694   */
1695
1696   pw = getpwnam(username);
1697   endpwent();
1698
1699   if (best->level == AUTH_USER)
1700   {
1701    /*
1702     * If there are no names associated with this location, then
1703     * any valid user is OK...
1704     */
1705
1706     if (best->num_names == 0)
1707       return (HTTP_OK);
1708
1709    /*
1710     * Otherwise check the user list and return OK if this user is
1711     * allowed...
1712     */
1713
1714     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1715                     "cupsdIsAuthorized: Checking user membership...");
1716
1717     for (i = 0; i < best->num_names; i ++)
1718     {
1719       if (!strcasecmp(best->names[i], "@OWNER") && owner &&
1720           !strcasecmp(username, owner))
1721         return (HTTP_OK);
1722       else if (!strcasecmp(best->names[i], "@SYSTEM"))
1723       {
1724         for (j = 0; j < NumSystemGroups; j ++)
1725           if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1726             return (HTTP_OK);
1727       }
1728       else if (best->names[i][0] == '@')
1729       {
1730         if (cupsdCheckGroup(username, pw, best->names[i] + 1))
1731           return (HTTP_OK);
1732       }
1733       else if (!strcasecmp(username, best->names[i]))
1734         return (HTTP_OK);
1735     }
1736
1737     return (HTTP_UNAUTHORIZED);
1738   }
1739
1740  /*
1741   * Check to see if this user is in any of the named groups...
1742   */
1743
1744   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1745                   "cupsdIsAuthorized: Checking group membership...");
1746
1747  /*
1748   * Check to see if this user is in any of the named groups...
1749   */
1750
1751   for (i = 0; i < best->num_names; i ++)
1752   {
1753     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1754                     "cupsdIsAuthorized: Checking group \"%s\" membership...",
1755                     best->names[i]);
1756
1757     if (!strcasecmp(best->names[i], "@SYSTEM"))
1758     {
1759       for (j = 0; j < NumSystemGroups; j ++)
1760         if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1761           return (HTTP_OK);
1762     }
1763     else if (cupsdCheckGroup(username, pw, best->names[i]))
1764       return (HTTP_OK);
1765   }
1766
1767  /*
1768   * The user isn't part of the specified group, so deny access...
1769   */
1770
1771   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1772                   "cupsdIsAuthorized: User not in group(s)!");
1773
1774   return (HTTP_UNAUTHORIZED);
1775 }
1776
1777
1778 /*
1779  * 'add_allow()' - Add an allow mask to the location.
1780  */
1781
1782 static cupsd_authmask_t *               /* O - New mask record */
1783 add_allow(cupsd_location_t *loc)        /* I - Location to add to */
1784 {
1785   cupsd_authmask_t      *temp;          /* New mask record */
1786
1787
1788  /*
1789   * Range-check...
1790   */
1791
1792   if (loc == NULL)
1793     return (NULL);
1794
1795  /*
1796   * Try to allocate memory for the record...
1797   */
1798
1799   if (loc->num_allow == 0)
1800     temp = malloc(sizeof(cupsd_authmask_t));
1801   else
1802     temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
1803
1804   if (temp == NULL)
1805     return (NULL);
1806
1807   loc->allow = temp;
1808   temp       += loc->num_allow;
1809   loc->num_allow ++;
1810
1811  /*
1812   * Clear the mask record and return...
1813   */
1814
1815   memset(temp, 0, sizeof(cupsd_authmask_t));
1816   return (temp);
1817 }
1818
1819
1820 /*
1821  * 'add_deny()' - Add a deny mask to the location.
1822  */
1823
1824 static cupsd_authmask_t *               /* O - New mask record */
1825 add_deny(cupsd_location_t *loc)         /* I - Location to add to */
1826 {
1827   cupsd_authmask_t      *temp;          /* New mask record */
1828
1829
1830  /*
1831   * Range-check...
1832   */
1833
1834   if (loc == NULL)
1835     return (NULL);
1836
1837  /*
1838   * Try to allocate memory for the record...
1839   */
1840
1841   if (loc->num_deny == 0)
1842     temp = malloc(sizeof(cupsd_authmask_t));
1843   else
1844     temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
1845
1846   if (temp == NULL)
1847     return (NULL);
1848
1849   loc->deny = temp;
1850   temp      += loc->num_deny;
1851   loc->num_deny ++;
1852
1853  /*
1854   * Clear the mask record and return...
1855   */
1856
1857   memset(temp, 0, sizeof(cupsd_authmask_t));
1858   return (temp);
1859 }
1860
1861
1862 /*
1863  * 'compare_locations()' - Compare two locations.
1864  */
1865
1866 static int                              /* O - Result of comparison */
1867 compare_locations(cupsd_location_t *a,  /* I - First location */
1868                   cupsd_location_t *b)  /* I - Second location */
1869 {
1870   return (strcmp(b->location, a->location));
1871 }
1872
1873
1874 #if !HAVE_LIBPAM
1875 /*
1876  * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1877  *                  as needed.
1878  */
1879
1880 static char *                           /* O - Encrypted password */
1881 cups_crypt(const char *pw,              /* I - Password string */
1882            const char *salt)            /* I - Salt (key) string */
1883 {
1884   if (!strncmp(salt, "$1$", 3))
1885   {
1886    /*
1887     * Use MD5 passwords without the benefit of PAM; this is for
1888     * Slackware Linux, and the algorithm was taken from the
1889     * old shadow-19990827/lib/md5crypt.c source code... :(
1890     */
1891
1892     int                 i;              /* Looping var */
1893     unsigned long       n;              /* Output number */
1894     int                 pwlen;          /* Length of password string */
1895     const char          *salt_end;      /* End of "salt" data for MD5 */
1896     char                *ptr;           /* Pointer into result string */
1897     _cups_md5_state_t   state;          /* Primary MD5 state info */
1898     _cups_md5_state_t   state2;         /* Secondary MD5 state info */
1899     unsigned char       digest[16];     /* MD5 digest result */
1900     static char         result[120];    /* Final password string */
1901
1902
1903    /*
1904     * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
1905     * Get a maximum of 8 characters of salt data after $1$...
1906     */
1907
1908     for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
1909       if (*salt_end == '$')
1910         break;
1911
1912    /*
1913     * Compute the MD5 sum we need...
1914     */
1915
1916     pwlen = strlen(pw);
1917
1918     _cupsMD5Init(&state);
1919     _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1920     _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
1921
1922     _cupsMD5Init(&state2);
1923     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
1924     _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
1925     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
1926     _cupsMD5Finish(&state2, digest);
1927
1928     for (i = pwlen; i > 0; i -= 16)
1929       _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
1930
1931     for (i = pwlen; i > 0; i >>= 1)
1932       _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
1933
1934     _cupsMD5Finish(&state, digest);
1935
1936     for (i = 0; i < 1000; i ++)
1937     {
1938       _cupsMD5Init(&state);
1939
1940       if (i & 1)
1941         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1942       else
1943         _cupsMD5Append(&state, digest, 16);
1944
1945       if (i % 3)
1946         _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
1947
1948       if (i % 7)
1949         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1950
1951       if (i & 1)
1952         _cupsMD5Append(&state, digest, 16);
1953       else
1954         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1955
1956       _cupsMD5Finish(&state, digest);
1957     }
1958
1959    /*
1960     * Copy the final sum to the result string and return...
1961     */
1962
1963     memcpy(result, salt, salt_end - salt);
1964     ptr = result + (salt_end - salt);
1965     *ptr++ = '$';
1966
1967     for (i = 0; i < 5; i ++, ptr += 4)
1968     {
1969       n = (((digest[i] << 8) | digest[i + 6]) << 8);
1970
1971       if (i < 4)
1972         n |= digest[i + 12];
1973       else
1974         n |= digest[5];
1975
1976       to64(ptr, n, 4);
1977     }
1978
1979     to64(ptr, digest[11], 2);
1980     ptr += 2;
1981     *ptr = '\0';
1982
1983     return (result);
1984   }
1985   else
1986   {
1987    /*
1988     * Use the standard crypt() function...
1989     */
1990
1991     return (crypt(pw, salt));
1992   }
1993 }
1994 #endif /* !HAVE_LIBPAM */
1995
1996
1997 /*
1998  * 'get_md5_password()' - Get an MD5 password.
1999  */
2000
2001 static char *                           /* O - MD5 password string */
2002 get_md5_password(const char *username,  /* I - Username */
2003                  const char *group,     /* I - Group */
2004                  char       passwd[33]) /* O - MD5 password string */
2005 {
2006   cups_file_t   *fp;                    /* passwd.md5 file */
2007   char          filename[1024],         /* passwd.md5 filename */
2008                 line[256],              /* Line from file */
2009                 tempuser[33],           /* User from file */
2010                 tempgroup[33];          /* Group from file */
2011
2012
2013   cupsdLogMessage(CUPSD_LOG_DEBUG2,
2014                   "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2015                   username, group ? group : "(null)", passwd);
2016
2017   snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2018   if ((fp = cupsFileOpen(filename, "r")) == NULL)
2019   {
2020     if (errno != ENOENT)
2021       cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2022                       strerror(errno));
2023
2024     return (NULL);
2025   }
2026
2027   while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2028   {
2029     if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2030     {
2031       cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2032       continue;
2033     }
2034
2035     if (!strcmp(username, tempuser) &&
2036         (group == NULL || !strcmp(group, tempgroup)))
2037     {
2038      /*
2039       * Found the password entry!
2040       */
2041
2042       cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2043                       username, tempgroup);
2044
2045       cupsFileClose(fp);
2046       return (passwd);
2047     }
2048   }
2049
2050  /*
2051   * Didn't find a password entry - return NULL!
2052   */
2053
2054   cupsFileClose(fp);
2055   return (NULL);
2056 }
2057
2058
2059 #if HAVE_LIBPAM
2060 /*
2061  * 'pam_func()' - PAM conversation function.
2062  */
2063
2064 static int                              /* O - Success or failure */
2065 pam_func(
2066     int                      num_msg,   /* I - Number of messages */
2067     const struct pam_message **msg,     /* I - Messages */
2068     struct pam_response      **resp,    /* O - Responses */
2069     void                     *appdata_ptr)
2070                                         /* I - Pointer to connection */
2071 {
2072   int                   i;              /* Looping var */
2073   struct pam_response   *replies;       /* Replies */
2074   cupsd_authdata_t      *data;          /* Pointer to auth data */
2075
2076
2077  /*
2078   * Allocate memory for the responses...
2079   */
2080
2081   if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2082     return (PAM_CONV_ERR);
2083
2084  /*
2085   * Answer all of the messages...
2086   */
2087
2088   DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2089
2090 #ifdef __hpux
2091  /*
2092   * Apparently some versions of HP-UX 11 have a broken pam_unix security
2093   * module.  This is a workaround...
2094   */
2095
2096   data = auth_data;
2097   (void)appdata_ptr;
2098 #else
2099   data = (cupsd_authdata_t *)appdata_ptr;
2100 #endif /* __hpux */
2101
2102   for (i = 0; i < num_msg; i ++)
2103   {
2104     DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2105
2106     switch (msg[i]->msg_style)
2107     {
2108       case PAM_PROMPT_ECHO_ON:
2109           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2110                         data->username));
2111           replies[i].resp_retcode = PAM_SUCCESS;
2112           replies[i].resp         = strdup(data->username);
2113           break;
2114
2115       case PAM_PROMPT_ECHO_OFF:
2116           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2117                         data->password));
2118           replies[i].resp_retcode = PAM_SUCCESS;
2119           replies[i].resp         = strdup(data->password);
2120           break;
2121
2122       case PAM_TEXT_INFO:
2123           DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2124           replies[i].resp_retcode = PAM_SUCCESS;
2125           replies[i].resp         = NULL;
2126           break;
2127
2128       case PAM_ERROR_MSG:
2129           DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2130           replies[i].resp_retcode = PAM_SUCCESS;
2131           replies[i].resp         = NULL;
2132           break;
2133
2134       default:
2135           DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2136                         msg[i]->msg_style));
2137           free(replies);
2138           return (PAM_CONV_ERR);
2139     }
2140   }
2141
2142  /*
2143   * Return the responses back to PAM...
2144   */
2145
2146   *resp = replies;
2147
2148   return (PAM_SUCCESS);
2149 }
2150 #else
2151
2152
2153 /*
2154  * 'to64()' - Base64-encode an integer value...
2155  */
2156
2157 static void
2158 to64(char          *s,                  /* O - Output string */
2159      unsigned long v,                   /* I - Value to encode */
2160      int           n)                   /* I - Number of digits */
2161 {
2162   const char    *itoa64 = "./0123456789"
2163                           "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2164                           "abcdefghijklmnopqrstuvwxyz";
2165
2166
2167   for (; n > 0; n --, v >>= 6)
2168     *s++ = itoa64[v & 0x3f];
2169 }
2170 #endif /* HAVE_LIBPAM */
2171
2172
2173 /*
2174  * End of "$Id: auth.c 181 2006-06-22 20:01:18Z jlovell $".
2175  */