scheduler/auth.c

   1 ;/*
   2  * "$Id: auth.c 5043 2006-02-01 18:55:16Z mike $"
   3  *
   4  *   Authorization routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
   7  *
   8  *   These coded instructions, statements, and computer programs are the
   9  *   property of Easy Software Products and are protected by Federal
  10  *   copyright law.  Distribution and use rights are outlined in the file
  11  *   "LICENSE.txt" which should have been included with this file.  If this
  12  *   file is missing or damaged please contact Easy Software Products
  13  *   at:
  14  *
  15  *       Attn: CUPS Licensing Information
  16  *       Easy Software Products
  17  *       44141 Airport View Drive, Suite 204
  18  *       Hollywood, Maryland 20636 USA
  19  *
  20  *       Voice: (301) 373-9600
  21  *       EMail: cups-info@cups.org
  22  *         WWW: http://www.cups.org
  23  *
  24  * Contents:
  25  *
  26  *   cupsdAddLocation()        - Add a location for authorization.
  27  *   cupsdAddName()            - Add a name to a location...
  28  *   cupsdAllowHost()          - Add a host name that is allowed to access the
  29  *                               location.
  30  *   cupsdAllowIP()            - Add an IP address or network that is allowed to
  31  *                               access the location.
  32  *   cupsdCheckAuth()          - Check authorization masks.
  33  *   cupsdCheckGroup()         - Check for a user's group membership.
  34  *   cupsdCopyLocation()       - Make a copy of a location...
  35  *   cupsdDeleteAllLocations() - Free all memory used for location authorization.
  36  *   cupsdDeleteLocation()     - Free all memory used by a location.
  37  *   cupsdDenyHost()           - Add a host name that is not allowed to access the
  38  *                               location.
  39  *   cupsdDenyIP()             - Add an IP address or network that is not allowed
  40  *                               to access the location.
  41  *   cupsdFindBest()           - Find the location entry that best matches the
  42  *                               resource.
  43  *   cupsdFindLocation()       - Find the named location.
  44  *   cupsdGetMD5Passwd()       - Get an MD5 password.
  45  *   cupsdIsAuthorized()       - Check to see if the user is authorized...
  46  *   add_allow()               - Add an allow mask to the location.
  47  *   add_deny()                - Add a deny mask to the location.
  48  *   cups_crypt()              - Encrypt the password using the DES or MD5
  49  *                               algorithms, as needed.
  50  *   pam_func()                - PAM conversation function.
  51  *   to64()                    - Base64-encode an integer value...
  52  */
  53
  54 /*
  55  * Include necessary headers...
  56  */
  57
  58 #include "cupsd.h"
  59 #include <grp.h>
  60 #ifdef HAVE_SHADOW_H
  61 #  include <shadow.h>
  62 #endif /* HAVE_SHADOW_H */
  63 #ifdef HAVE_CRYPT_H
  64 #  include <crypt.h>
  65 #endif /* HAVE_CRYPT_H */
  66 #if HAVE_LIBPAM
  67 #  ifdef HAVE_PAM_PAM_APPL_H
  68 #    include <pam/pam_appl.h>
  69 #  else
  70 #    include <security/pam_appl.h>
  71 #  endif /* HAVE_PAM_PAM_APPL_H */
  72 #endif /* HAVE_LIBPAM */
  73 #ifdef HAVE_USERSEC_H
  74 #  include <usersec.h>
  75 #endif /* HAVE_USERSEC_H */
  76
  77
  78 /*
  79  * Local functions...
  80  */
  81
  82 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
  83 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
  84 #if !HAVE_LIBPAM
  85 static char             *cups_crypt(const char *pw, const char *salt);
  86 #endif /* !HAVE_LIBPAM */
  87 #if HAVE_LIBPAM
  88 static int              pam_func(int, const struct pam_message **,
  89                                  struct pam_response **, void *);
  90 #else
  91 static void             to64(char *s, unsigned long v, int n);
  92 #endif /* HAVE_LIBPAM */
  93
  94
  95 /*
  96  * Local structures...
  97  */
  98
  99 #if HAVE_LIBPAM
 100 typedef struct cupsd_authdata_s         /**** Authentication data ****/
 101 {
 102   char  username[33],                   /* Username string */
 103         password[33];                   /* Password string */
 104 } cupsd_authdata_t;
 105 #endif /* HAVE_LIBPAM */
 106
 107
 108 /*
 109  * Local globals...
 110  */
 111
 112 #if defined(__hpux) && defined(HAVE_LIBPAM)
 113 static cupsd_authdata_t *auth_datat;    /* Current client being authenticated */
 114 #endif /* __hpux && HAVE_LIBPAM */
 115
 116
 117 /*
 118  * 'cupsdAddLocation()' - Add a location for authorization.
 119  */
 120
 121 cupsd_location_t *                      /* O - Pointer to new location record */
 122 cupsdAddLocation(const char *location)  /* I - Location path */
 123 {
 124   cupsd_location_t      *temp;          /* New location */
 125
 126
 127  /*
 128   * Try to allocate memory for the new location.
 129   */
 130
 131   if (NumLocations == 0)
 132     temp = malloc(sizeof(cupsd_location_t));
 133   else
 134     temp = realloc(Locations, sizeof(cupsd_location_t) * (NumLocations + 1));
 135
 136   if (temp == NULL)
 137     return (NULL);
 138
 139   Locations = temp;
 140   temp      += NumLocations;
 141   NumLocations ++;
 142
 143  /*
 144   * Initialize the record and copy the name over...
 145   */
 146
 147   memset(temp, 0, sizeof(cupsd_location_t));
 148   strlcpy(temp->location, location, sizeof(temp->location));
 149   temp->length = strlen(temp->location);
 150
 151   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAddLocation: added location \'%s\'",
 152                   location);
 153
 154  /*
 155   * Return the new record...
 156   */
 157
 158   return (temp);
 159 }
 160
 161
 162 /*
 163  * 'cupsdAddName()' - Add a name to a location...
 164  */
 165
 166 void
 167 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 168              char             *name)    /* I - Name to add */
 169 {
 170   char  **temp;                         /* Pointer to names array */
 171
 172
 173   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
 174                   loc, name);
 175
 176   if (loc->num_names == 0)
 177     temp = malloc(sizeof(char *));
 178   else
 179     temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
 180
 181   if (temp == NULL)
 182   {
 183     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
 184                     loc->location, strerror(errno));
 185     return;
 186   }
 187
 188   loc->names = temp;
 189
 190   if ((temp[loc->num_names] = strdup(name)) == NULL)
 191   {
 192     cupsdLogMessage(CUPSD_LOG_ERROR,
 193                     "Unable to duplicate name for location %s: %s",
 194                     loc->location, strerror(errno));
 195     return;
 196   }
 197
 198   loc->num_names ++;
 199 }
 200
 201
 202 /*
 203  * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
 204  */
 205
 206 void
 207 cupsdAllowHost(cupsd_location_t *loc,   /* I - Location to add to */
 208                char             *name)  /* I - Name of host or domain to add */
 209 {
 210   cupsd_authmask_t      *temp;          /* New host/domain mask */
 211   char                  ifname[32],     /* Interface name */
 212                         *ifptr;         /* Pointer to end of name */
 213
 214
 215   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
 216                   loc, loc->location, name);
 217
 218   if ((temp = add_allow(loc)) == NULL)
 219     return;
 220
 221   if (strcasecmp(name, "@LOCAL") == 0)
 222   {
 223    /*
 224     * Allow *interface*...
 225     */
 226
 227     temp->type             = AUTH_INTERFACE;
 228     temp->mask.name.name   = strdup("*");
 229     temp->mask.name.length = 1;
 230   }
 231   else if (strncasecmp(name, "@IF(", 4) == 0)
 232   {
 233    /*
 234     * Allow *interface*...
 235     */
 236
 237     strlcpy(ifname, name + 4, sizeof(ifname));
 238
 239     ifptr = ifname + strlen(ifname);
 240
 241     if (ifptr[-1] == ')')
 242     {
 243       ifptr --;
 244       *ifptr = '\0';
 245     }
 246
 247     temp->type             = AUTH_INTERFACE;
 248     temp->mask.name.name   = strdup(ifname);
 249     temp->mask.name.length = ifptr - ifname;
 250   }
 251   else
 252   {
 253    /*
 254     * Allow name...
 255     */
 256
 257     temp->type             = AUTH_NAME;
 258     temp->mask.name.name   = strdup(name);
 259     temp->mask.name.length = strlen(name);
 260   }
 261 }
 262
 263
 264 /*
 265  * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
 266  *                    the location.
 267  */
 268
 269 void
 270 cupsdAllowIP(cupsd_location_t *loc,     /* I - Location to add to */
 271              unsigned   address[4],     /* I - IP address to add */
 272              unsigned   netmask[4])     /* I - Netmask of address */
 273 {
 274   cupsd_authmask_t      *temp;          /* New host/domain mask */
 275
 276
 277   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 278                   "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
 279                   loc, loc->location, address[0], address[1], address[2],
 280                   address[3], netmask[0], netmask[1], netmask[2],
 281                   netmask[3]);
 282
 283   if ((temp = add_allow(loc)) == NULL)
 284     return;
 285
 286   temp->type = AUTH_IP;
 287   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
 288   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
 289 }
 290
 291
 292 /*
 293  * 'cupsdAuthorize()' - Validate any authorization credentials.
 294  */
 295
 296 void
 297 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 298 {
 299   int           type;                   /* Authentication type */
 300   char          *authorization,         /* Pointer into Authorization string */
 301                 *ptr,                   /* Pointer into string */
 302                 username[65],           /* Username string */
 303                 password[33];           /* Password string */
 304   const char    *localuser;             /* Certificate username */
 305   char          nonce[HTTP_MAX_VALUE],  /* Nonce value from client */
 306                 md5[33],                /* MD5 password */
 307                 basicmd5[33];           /* MD5 of Basic password */
 308   static const char * const states[] =  /* HTTP client states... */
 309                 {
 310                   "WAITING",
 311                   "OPTIONS",
 312                   "GET",
 313                   "GET",
 314                   "HEAD",
 315                   "POST",
 316                   "POST",
 317                   "POST",
 318                   "PUT",
 319                   "PUT",
 320                   "DELETE",
 321                   "TRACE",
 322                   "CLOSE",
 323                   "STATUS"
 324                 };
 325
 326
 327  /*
 328   * Locate the best matching location so we know what kind of
 329   * authentication to expect...
 330   */
 331
 332   con->best = cupsdFindBest(con->uri, con->http.state);
 333
 334   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 335                   "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
 336                   con->uri, con->best, con->best ? con->best->location : "");
 337
 338   if (con->best && con->best->type != AUTH_NONE)
 339     type = con->best->type;
 340   else
 341     type = DefaultAuthType;
 342
 343  /*
 344   * Decode the Authorization string...
 345   */
 346
 347   authorization = con->http.fields[HTTP_FIELD_AUTHORIZATION];
 348
 349   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
 350                   authorization);
 351
 352   username[0] = '\0';
 353   password[0] = '\0';
 354
 355   if (type == AUTH_NONE)
 356   {
 357    /*
 358     * No authorization required, return early...
 359     */
 360
 361     cupsdLogMessage(CUPSD_LOG_DEBUG,
 362                     "cupsdAuthorize: No authentication required.");
 363     return;
 364   }
 365   else if (!*authorization)
 366   {
 367    /*
 368     * No authorization data provided, return early...
 369     */
 370
 371     cupsdLogMessage(CUPSD_LOG_DEBUG,
 372                     "cupsdAuthorize: No authentication data provided.");
 373     return;
 374   }
 375   else if (!strncmp(authorization, "Local", 5) &&
 376            !strcasecmp(con->http.hostname, "localhost"))
 377   {
 378    /*
 379     * Get Local certificate authentication data...
 380     */
 381
 382     authorization += 5;
 383     while (isspace(*authorization))
 384       authorization ++;
 385
 386     if ((localuser = cupsdFindCert(authorization)) != NULL)
 387       strlcpy(username, localuser, sizeof(username));
 388     else
 389     {
 390       cupsdLogMessage(CUPSD_LOG_ERROR,
 391                       "cupsdAuthorize: Local authentication certificate not "
 392                       "found!");
 393       return;
 394     }
 395   }
 396   else if (!strncmp(authorization, "Basic", 5) &&
 397            (type == AUTH_BASIC || type == AUTH_BASICDIGEST))
 398   {
 399    /*
 400     * Get the Basic authentication data...
 401     */
 402
 403     int userlen;                        /* Username:password length */
 404
 405
 406     authorization += 5;
 407     while (isspace(*authorization))
 408       authorization ++;
 409
 410     userlen = sizeof(username);
 411     httpDecode64_2(username, &userlen, authorization);
 412
 413    /*
 414     * Pull the username and password out...
 415     */
 416
 417     if ((ptr = strchr(username, ':')) == NULL)
 418     {
 419       cupsdLogMessage(CUPSD_LOG_ERROR,
 420                       "cupsdAuthorize: Missing Basic password!");
 421       return;
 422     }
 423
 424     *ptr++ = '\0';
 425
 426     if (!username[0])
 427     {
 428      /*
 429       * Username must not be empty...
 430       */
 431
 432       cupsdLogMessage(CUPSD_LOG_ERROR,
 433                       "cupsdAuthorize: Empty Basic username!");
 434       return;
 435     }
 436
 437     if (!*ptr)
 438     {
 439      /*
 440       * Password must not be empty...
 441       */
 442
 443       cupsdLogMessage(CUPSD_LOG_ERROR,
 444                       "cupsdAuthorize: Empty Basic password!");
 445       return;
 446     }
 447
 448     strlcpy(password, ptr, sizeof(password));
 449
 450    /*
 451     * Validate the username and password...
 452     */
 453
 454     switch (type)
 455     {
 456       case AUTH_BASIC :
 457           {
 458 #if HAVE_LIBPAM
 459            /*
 460             * Only use PAM to do authentication.  This supports MD5
 461             * passwords, among other things...
 462             */
 463
 464             pam_handle_t        *pamh;  /* PAM authentication handle */
 465             int                 pamerr; /* PAM error code */
 466             struct pam_conv     pamdata;/* PAM conversation data */
 467             cupsd_authdata_t    data;   /* Authentication data */
 468
 469
 470             strlcpy(data.username, username, sizeof(data.username));
 471             strlcpy(data.password, password, sizeof(data.password));
 472
 473             pamdata.conv        = pam_func;
 474             pamdata.appdata_ptr = &data;
 475
 476 #  ifdef __hpux
 477            /*
 478             * Workaround for HP-UX bug in pam_unix; see pam_func() below for
 479             * more info...
 480             */
 481
 482             auth_data = &data;
 483 #  endif /* __hpux */
 484
 485             pamerr = pam_start("cups", username, &pamdata, &pamh);
 486             if (pamerr != PAM_SUCCESS)
 487             {
 488               cupsdLogMessage(CUPSD_LOG_ERROR,
 489                               "cupsdAuthorize: pam_start() returned %d (%s)!\n",
 490                               pamerr, pam_strerror(pamh, pamerr));
 491               pam_end(pamh, 0);
 492               return;
 493             }
 494
 495             pamerr = pam_authenticate(pamh, PAM_SILENT);
 496             if (pamerr != PAM_SUCCESS)
 497             {
 498               cupsdLogMessage(CUPSD_LOG_ERROR,
 499                               "cupsdAuthorize: pam_authenticate() returned %d "
 500                               "(%s)!\n",
 501                               pamerr, pam_strerror(pamh, pamerr));
 502               pam_end(pamh, 0);
 503               return;
 504             }
 505
 506             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 507             if (pamerr != PAM_SUCCESS)
 508             {
 509               cupsdLogMessage(CUPSD_LOG_ERROR,
 510                               "cupsdAuthorize: pam_acct_mgmt() returned %d "
 511                               "(%s)!\n",
 512                               pamerr, pam_strerror(pamh, pamerr));
 513               pam_end(pamh, 0);
 514               return;
 515             }
 516
 517             pam_end(pamh, PAM_SUCCESS);
 518
 519 #elif defined(HAVE_USERSEC_H)
 520            /*
 521             * Use AIX authentication interface...
 522             */
 523
 524             char        *authmsg;       /* Authentication message */
 525             char        *loginmsg;      /* Login message */
 526             int         reenter;        /* ??? */
 527
 528
 529             cupsdLogMessage(CUPSD_LOG_DEBUG,
 530                             "cupsdAuthorize: AIX authenticate of username \"%s\"",
 531                             username);
 532
 533             reenter = 1;
 534             if (authenticate(username, password, &reenter, &authmsg) != 0)
 535             {
 536               cupsdLogMessage(CUPSD_LOG_DEBUG,
 537                               "cupsdAuthorize: Unable to authenticate username "
 538                               "\"%s\": %s",
 539                               username, strerror(errno));
 540               return;
 541             }
 542
 543 #else
 544            /*
 545             * Use normal UNIX password file-based authentication...
 546             */
 547
 548             char                *pass;  /* Encrypted password */
 549             struct passwd       *pw;    /* User password data */
 550 #  ifdef HAVE_SHADOW_H
 551             struct spwd         *spw;   /* Shadow password data */
 552 #  endif /* HAVE_SHADOW_H */
 553
 554
 555             pw = getpwnam(username);    /* Get the current password */
 556             endpwent();                 /* Close the password file */
 557
 558             if (!pw)
 559             {
 560              /*
 561               * No such user...
 562               */
 563
 564               cupsdLogMessage(CUPSD_LOG_ERROR,
 565                               "cupsdAuthorize: Unknown username \"%s\"!",
 566                               username);
 567               return (HTTP_UNAUTHORIZED);
 568             }
 569
 570 #  ifdef HAVE_SHADOW_H
 571             spw = getspnam(username);
 572             endspent();
 573
 574             if (!spw && !strcmp(pw->pw_passwd, "x"))
 575             {
 576              /*
 577               * Don't allow blank passwords!
 578               */
 579
 580               cupsdLogMessage(CUPSD_LOG_ERROR,
 581                               "cupsdAuthorize: Username \"%s\" has no shadow "
 582                               "password!", username);
 583               return;
 584             }
 585
 586             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 587 #  else
 588             if (!pw->pw_passwd[0])
 589 #  endif /* HAVE_SHADOW_H */
 590             {
 591              /*
 592               * Don't allow blank passwords!
 593               */
 594
 595               cupsdLogMessage(CUPSD_LOG_ERROR,
 596                               "cupsdAuthorize: Username \"%s\" has no password!",
 597                               username);
 598               return;
 599             }
 600
 601            /*
 602             * OK, the password isn't blank, so compare with what came from the
 603             * client...
 604             */
 605
 606             pass = cups_crypt(password, pw->pw_passwd);
 607
 608             cupsdLogMessage(CUPSD_LOG_DEBUG2,
 609                             "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
 610                             pw->pw_passwd, pass);
 611
 612             if (!pass || strcmp(pw->pw_passwd, pass))
 613             {
 614 #  ifdef HAVE_SHADOW_H
 615               if (spw)
 616               {
 617                 pass = cups_crypt(password, spw->sp_pwdp);
 618
 619                 cupsdLogMessage(CUPSD_LOG_DEBUG2,
 620                                 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
 621                                 spw->sp_pwdp, pass);
 622
 623                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 624                 {
 625                   cupsdLogMessage(CUPSD_LOG_ERROR,
 626                                   "cupsdAuthorize: Authentication failed for "
 627                                   "user \"%s\"!",
 628                                   username);
 629                   return;
 630                 }
 631               }
 632               else
 633 #  endif /* HAVE_SHADOW_H */
 634               {
 635                 cupsdLogMessage(CUPSD_LOG_ERROR,
 636                                 "cupsdAuthorize: Authentication failed for "
 637                                 "user \"%s\"!",
 638                                 username);
 639                 return;
 640               }
 641             }
 642 #endif /* HAVE_LIBPAM */
 643           }
 644           break;
 645
 646       case AUTH_BASICDIGEST :
 647          /*
 648           * Do Basic authentication with the Digest password file...
 649           */
 650
 651           if (!cupsdGetMD5Passwd(username, NULL, md5))
 652           {
 653             cupsdLogMessage(CUPSD_LOG_ERROR,
 654                             "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 655                             username);
 656             return;
 657           }
 658
 659           httpMD5(username, "CUPS", password, basicmd5);
 660
 661           if (strcmp(md5, basicmd5))
 662           {
 663             cupsdLogMessage(CUPSD_LOG_ERROR,
 664                             "cupsdAuthorize: Authentication failed for \"%s\"!",
 665                             username);
 666             return;
 667           }
 668           break;
 669     }
 670   }
 671   else if (!strncmp(authorization, "Digest", 6) && type == AUTH_DIGEST)
 672   {
 673    /*
 674     * Get the username, password, and nonce from the Digest attributes...
 675     */
 676
 677     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
 678                           username, sizeof(username)) || !username[0])
 679     {
 680      /*
 681       * Username must not be empty...
 682       */
 683
 684       cupsdLogMessage(CUPSD_LOG_ERROR,
 685                       "cupsdAuthorize: Empty or missing Digest username!");
 686       return;
 687     }
 688
 689     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
 690                           password, sizeof(password)) || !password[0])
 691     {
 692      /*
 693       * Password must not be empty...
 694       */
 695
 696       cupsdLogMessage(CUPSD_LOG_ERROR,
 697                       "cupsdAuthorize: Empty or missing Digest password!");
 698       return;
 699     }
 700
 701     if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
 702                          nonce))
 703     {
 704       cupsdLogMessage(CUPSD_LOG_ERROR,
 705                       "cupsdAuthorize: No nonce value for Digest "
 706                       "authentication!");
 707       return;
 708     }
 709
 710     if (strcmp(con->http.hostname, nonce))
 711     {
 712       cupsdLogMessage(CUPSD_LOG_ERROR,
 713                       "cupsdAuthorize: Bad nonce value, expected \"%s\", "
 714                       "got \"%s\"!", con->http.hostname, nonce);
 715       return;
 716     }
 717
 718    /*
 719     * Validate the username and password...
 720     */
 721
 722     if (!cupsdGetMD5Passwd(username, NULL, md5))
 723     {
 724       cupsdLogMessage(CUPSD_LOG_ERROR,
 725                       "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 726                       username);
 727       return;
 728     }
 729
 730     httpMD5Final(nonce, states[con->http.state], con->uri, md5);
 731
 732     if (strcmp(md5, password))
 733     {
 734       cupsdLogMessage(CUPSD_LOG_ERROR,
 735                       "cupsdAuthorize: Authentication failed for \"%s\"!",
 736                       username);
 737       return;
 738     }
 739   }
 740   else
 741   {
 742     cupsdLogMessage(CUPSD_LOG_DEBUG,
 743                     "cupsdAuthorize: Bad authentication data.");
 744     return;
 745   }
 746
 747  /*
 748   * If we get here, then we were able to validate the username and
 749   * password - copy the validated username and password to the client
 750   * data and return...
 751   */
 752
 753   strlcpy(con->username, username, sizeof(con->username));
 754   strlcpy(con->password, password, sizeof(con->password));
 755
 756   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: username=\"%s\"",
 757                   con->username);
 758 }
 759
 760
 761 /*
 762  * 'cupsdCheckAuth()' - Check authorization masks.
 763  */
 764
 765 int                                     /* O - 1 if mask matches, 0 otherwise */
 766 cupsdCheckAuth(
 767     unsigned         ip[4],             /* I - Client address */
 768     char             *name,             /* I - Client hostname */
 769     int              name_len,          /* I - Length of hostname */
 770     int              num_masks,         /* I - Number of masks */
 771     cupsd_authmask_t *masks)            /* I - Masks */
 772 {
 773   int           i;                      /* Looping var */
 774   cupsd_netif_t *iface;                 /* Network interface */
 775   unsigned      netip4;                 /* IPv4 network address */
 776 #ifdef AF_INET6
 777   unsigned      netip6[4];              /* IPv6 network address */
 778 #endif /* AF_INET6 */
 779
 780   while (num_masks > 0)
 781   {
 782     switch (masks->type)
 783     {
 784       case AUTH_INTERFACE :
 785          /*
 786           * Check for a match with a network interface...
 787           */
 788
 789           netip4 = htonl(ip[3]);
 790
 791 #ifdef AF_INET6
 792           netip6[0] = htonl(ip[0]);
 793           netip6[1] = htonl(ip[1]);
 794           netip6[2] = htonl(ip[2]);
 795           netip6[3] = htonl(ip[3]);
 796 #endif /* AF_INET6 */
 797
 798           if (!strcmp(masks->mask.name.name, "*"))
 799           {
 800            /*
 801             * Check against all local interfaces...
 802             */
 803
 804             cupsdNetIFUpdate();
 805
 806             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 807                  iface;
 808                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 809             {
 810              /*
 811               * Only check local interfaces...
 812               */
 813
 814               if (!iface->is_local)
 815                 continue;
 816
 817               if (iface->address.addr.sa_family == AF_INET)
 818               {
 819                /*
 820                 * Check IPv4 address...
 821                 */
 822
 823                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 824                     (iface->address.ipv4.sin_addr.s_addr &
 825                      iface->mask.ipv4.sin_addr.s_addr))
 826                   return (1);
 827               }
 828 #ifdef AF_INET6
 829               else
 830               {
 831                /*
 832                 * Check IPv6 address...
 833                 */
 834
 835                 for (i = 0; i < 4; i ++)
 836                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 837                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 838                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 839                     break;
 840
 841                 if (i == 4)
 842                   return (1);
 843               }
 844 #endif /* AF_INET6 */
 845             }
 846           }
 847           else
 848           {
 849            /*
 850             * Check the named interface...
 851             */
 852
 853             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 854                  iface && !strcmp(masks->mask.name.name, iface->name);
 855                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 856             {
 857               if (iface->address.addr.sa_family == AF_INET)
 858               {
 859                /*
 860                 * Check IPv4 address...
 861                 */
 862
 863                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 864                     (iface->address.ipv4.sin_addr.s_addr &
 865                      iface->mask.ipv4.sin_addr.s_addr))
 866                   return (1);
 867               }
 868 #ifdef AF_INET6
 869               else
 870               {
 871                /*
 872                 * Check IPv6 address...
 873                 */
 874
 875                 for (i = 0; i < 4; i ++)
 876                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 877                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 878                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 879                     break;
 880
 881                 if (i == 4)
 882                   return (1);
 883               }
 884 #endif /* AF_INET6 */
 885             }
 886           }
 887           break;
 888
 889       case AUTH_NAME :
 890          /*
 891           * Check for exact name match...
 892           */
 893
 894           if (!strcasecmp(name, masks->mask.name.name))
 895             return (1);
 896
 897          /*
 898           * Check for domain match...
 899           */
 900
 901           if (name_len >= masks->mask.name.length &&
 902               masks->mask.name.name[0] == '.' &&
 903               strcasecmp(name + name_len - masks->mask.name.length,
 904                          masks->mask.name.name) == 0)
 905             return (1);
 906           break;
 907
 908       case AUTH_IP :
 909          /*
 910           * Check for IP/network address match...
 911           */
 912
 913           for (i = 0; i < 4; i ++)
 914             if ((ip[i] & masks->mask.ip.netmask[i]) !=
 915                     masks->mask.ip.address[i])
 916               break;
 917
 918           if (i == 4)
 919             return (1);
 920           break;
 921     }
 922
 923     masks ++;
 924     num_masks --;
 925   }
 926
 927   return (0);
 928 }
 929
 930
 931 /*
 932  * 'cupsdCheckGroup()' - Check for a user's group membership.
 933  */
 934
 935 int                                     /* O - 1 if user is a member, 0 otherwise */
 936 cupsdCheckGroup(
 937     const char    *username,            /* I - User name */
 938     struct passwd *user,                /* I - System user info */
 939     const char    *groupname)           /* I - Group name */
 940 {
 941   int                   i;              /* Looping var */
 942   struct group          *group;         /* System group info */
 943   char                  junk[33];       /* MD5 password (not used) */
 944
 945
 946   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 947                   "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
 948                   username, user, groupname);
 949
 950  /*
 951   * Validate input...
 952   */
 953
 954   if (!username || !groupname)
 955     return (0);
 956
 957  /*
 958   * Check to see if the user is a member of the named group...
 959   */
 960
 961   group = getgrnam(groupname);
 962   endgrent();
 963
 964   if (group != NULL)
 965   {
 966    /*
 967     * Group exists, check it...
 968     */
 969
 970     for (i = 0; group->gr_mem[i]; i ++)
 971       if (!strcasecmp(username, group->gr_mem[i]))
 972         return (1);
 973   }
 974
 975  /*
 976   * Group doesn't exist or user not in group list, check the group ID
 977   * against the user's group ID...
 978   */
 979
 980   if (user && group && group->gr_gid == user->pw_gid)
 981     return (1);
 982
 983  /*
 984   * Username not found, group not found, or user is not part of the
 985   * system group...  Check for a user and group in the MD5 password
 986   * file...
 987   */
 988
 989   if (cupsdGetMD5Passwd(username, groupname, junk) != NULL)
 990     return (1);
 991
 992  /*
 993   * If we get this far, then the user isn't part of the named group...
 994   */
 995
 996   return (0);
 997 }
 998
 999
1000 /*
1001  * 'cupsdCopyLocation()' - Make a copy of a location...
1002  */
1003
1004 cupsd_location_t *                      /* O - New location */
1005 cupsdCopyLocation(
1006     cupsd_location_t **loc)             /* IO - Original location */
1007 {
1008   int                   i;              /* Looping var */
1009   int                   locindex;       /* Index into Locations array */
1010   cupsd_location_t      *temp;          /* New location */
1011   char                  location[HTTP_MAX_URI];
1012                                         /* Location of resource */
1013
1014
1015  /*
1016   * Add the new location, updating the original location
1017   * pointer as needed...
1018   */
1019
1020   locindex = *loc - Locations;
1021
1022  /*
1023   * Use a local copy of location because cupsdAddLocation may cause
1024   * this memory to be moved...
1025   */
1026
1027   strlcpy(location, (*loc)->location, sizeof(location));
1028
1029   if ((temp = cupsdAddLocation(location)) == NULL)
1030     return (NULL);
1031
1032   *loc = Locations + locindex;
1033
1034  /*
1035   * Copy the information from the original location to the new one.
1036   */
1037
1038   temp->limit      = (*loc)->limit;
1039   temp->order_type = (*loc)->order_type;
1040   temp->type       = (*loc)->type;
1041   temp->level      = (*loc)->level;
1042   temp->satisfy    = (*loc)->satisfy;
1043   temp->encryption = (*loc)->encryption;
1044
1045   if ((temp->num_names  = (*loc)->num_names) > 0)
1046   {
1047    /*
1048     * Copy the names array...
1049     */
1050
1051     if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1052     {
1053       cupsdLogMessage(CUPSD_LOG_ERROR,
1054                       "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1055                       temp->num_names, strerror(errno));
1056       NumLocations --;
1057       return (NULL);
1058     }
1059
1060     for (i = 0; i < temp->num_names; i ++)
1061       if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1062       {
1063         cupsdLogMessage(CUPSD_LOG_ERROR,
1064                         "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1065                         (*loc)->names[i], strerror(errno));
1066
1067         NumLocations --;
1068         return (NULL);
1069       }
1070   }
1071
1072   if ((temp->num_allow  = (*loc)->num_allow) > 0)
1073   {
1074    /*
1075     * Copy allow rules...
1076     */
1077
1078     if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1079     {
1080       cupsdLogMessage(CUPSD_LOG_ERROR,
1081                       "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1082                       temp->num_allow, strerror(errno));
1083       NumLocations --;
1084       return (NULL);
1085     }
1086
1087     for (i = 0; i < temp->num_allow; i ++)
1088       switch (temp->allow[i].type = (*loc)->allow[i].type)
1089       {
1090         case AUTH_NAME :
1091             temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1092             temp->allow[i].mask.name.name   = strdup((*loc)->allow[i].mask.name.name);
1093
1094             if (temp->allow[i].mask.name.name == NULL)
1095             {
1096               cupsdLogMessage(CUPSD_LOG_ERROR,
1097                               "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1098                               (*loc)->allow[i].mask.name.name, strerror(errno));
1099               NumLocations --;
1100               return (NULL);
1101             }
1102             break;
1103         case AUTH_IP :
1104             memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1105                    sizeof(cupsd_ipmask_t));
1106             break;
1107       }
1108   }
1109
1110   if ((temp->num_deny  = (*loc)->num_deny) > 0)
1111   {
1112    /*
1113     * Copy deny rules...
1114     */
1115
1116     if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1117     {
1118       cupsdLogMessage(CUPSD_LOG_ERROR,
1119                       "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1120                       temp->num_deny, strerror(errno));
1121       NumLocations --;
1122       return (NULL);
1123     }
1124
1125     for (i = 0; i < temp->num_deny; i ++)
1126       switch (temp->deny[i].type = (*loc)->deny[i].type)
1127       {
1128         case AUTH_NAME :
1129             temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1130             temp->deny[i].mask.name.name   = strdup((*loc)->deny[i].mask.name.name);
1131
1132             if (temp->deny[i].mask.name.name == NULL)
1133             {
1134               cupsdLogMessage(CUPSD_LOG_ERROR,
1135                               "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1136                               (*loc)->deny[i].mask.name.name, strerror(errno));
1137               NumLocations --;
1138               return (NULL);
1139             }
1140             break;
1141         case AUTH_IP :
1142             memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1143                    sizeof(cupsd_ipmask_t));
1144             break;
1145       }
1146   }
1147
1148   return (temp);
1149 }
1150
1151
1152 /*
1153  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1154  */
1155
1156 void
1157 cupsdDeleteAllLocations(void)
1158 {
1159   int                   i;              /* Looping var */
1160   cupsd_location_t      *loc;           /* Current location */
1161
1162
1163  /*
1164   * Free all of the allow/deny records first...
1165   */
1166
1167   for (i = NumLocations, loc = Locations; i > 0; i --, loc ++)
1168     cupsdDeleteLocation(loc);
1169
1170  /*
1171   * Then free the location array...
1172   */
1173
1174   if (NumLocations > 0)
1175     free(Locations);
1176
1177   Locations    = NULL;
1178   NumLocations = 0;
1179 }
1180
1181
1182 /*
1183  * 'cupsdDeleteLocation()' - Free all memory used by a location.
1184  */
1185
1186 void
1187 cupsdDeleteLocation(
1188     cupsd_location_t *loc)              /* I - Location to delete */
1189 {
1190   int                   i;              /* Looping var */
1191   cupsd_authmask_t      *mask;          /* Current mask */
1192
1193
1194   for (i = loc->num_names - 1; i >= 0; i --)
1195     free(loc->names[i]);
1196
1197   if (loc->num_names > 0)
1198     free(loc->names);
1199
1200   for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1201     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1202       free(mask->mask.name.name);
1203
1204   if (loc->num_allow > 0)
1205     free(loc->allow);
1206
1207   for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1208     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1209       free(mask->mask.name.name);
1210
1211   if (loc->num_deny > 0)
1212     free(loc->deny);
1213 }
1214
1215
1216 /*
1217  * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1218  *                     location.
1219  */
1220
1221 void
1222 cupsdDenyHost(cupsd_location_t *loc,    /* I - Location to add to */
1223               char             *name)   /* I - Name of host or domain to add */
1224 {
1225   cupsd_authmask_t      *temp;          /* New host/domain mask */
1226   char                  ifname[32],     /* Interface name */
1227                         *ifptr;         /* Pointer to end of name */
1228
1229
1230   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1231                   loc, loc->location, name);
1232
1233   if ((temp = add_deny(loc)) == NULL)
1234     return;
1235
1236   if (strcasecmp(name, "@LOCAL") == 0)
1237   {
1238    /*
1239     * Deny *interface*...
1240     */
1241
1242     temp->type             = AUTH_INTERFACE;
1243     temp->mask.name.name   = strdup("*");
1244     temp->mask.name.length = 1;
1245   }
1246   else if (strncasecmp(name, "@IF(", 4) == 0)
1247   {
1248    /*
1249     * Deny *interface*...
1250     */
1251
1252     strlcpy(ifname, name + 4, sizeof(ifname));
1253
1254     ifptr = ifname + strlen(ifname);
1255
1256     if (ifptr[-1] == ')')
1257     {
1258       ifptr --;
1259       *ifptr = '\0';
1260     }
1261
1262     temp->type             = AUTH_INTERFACE;
1263     temp->mask.name.name   = strdup(ifname);
1264     temp->mask.name.length = ifptr - ifname;
1265   }
1266   else
1267   {
1268    /*
1269     * Deny name...
1270     */
1271
1272     temp->type             = AUTH_NAME;
1273     temp->mask.name.name   = strdup(name);
1274     temp->mask.name.length = strlen(name);
1275   }
1276 }
1277
1278
1279 /*
1280  * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1281  *                   access the location.
1282  */
1283
1284 void
1285 cupsdDenyIP(cupsd_location_t *loc,      /* I - Location to add to */
1286             unsigned         address[4],/* I - IP address to add */
1287             unsigned         netmask[4])/* I - Netmask of address */
1288 {
1289   cupsd_authmask_t      *temp;          /* New host/domain mask */
1290
1291
1292   cupsdLogMessage(CUPSD_LOG_DEBUG,
1293                   "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1294                   loc, loc->location, address[0], address[1], address[2],
1295                   address[3], netmask[0], netmask[1], netmask[2],
1296                   netmask[3]);
1297
1298   if ((temp = add_deny(loc)) == NULL)
1299     return;
1300
1301   temp->type = AUTH_IP;
1302   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1303   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1304 }
1305
1306
1307 /*
1308  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1309  */
1310
1311 cupsd_location_t *                      /* O - Location that matches */
1312 cupsdFindBest(const char   *path,       /* I - Resource path */
1313               http_state_t state)       /* I - HTTP state/request */
1314 {
1315   int                   i;              /* Looping var */
1316   char                  uri[HTTP_MAX_URI],
1317                                         /* URI in request... */
1318                         *uriptr;        /* Pointer into URI */
1319   cupsd_location_t      *loc,           /* Current location */
1320                         *best;          /* Best match for location so far */
1321   int                   bestlen;        /* Length of best match */
1322   int                   limit;          /* Limit field */
1323   static const int      limits[] =      /* Map http_status_t to AUTH_LIMIT_xyz */
1324                 {
1325                   AUTH_LIMIT_ALL,
1326                   AUTH_LIMIT_OPTIONS,
1327                   AUTH_LIMIT_GET,
1328                   AUTH_LIMIT_GET,
1329                   AUTH_LIMIT_HEAD,
1330                   AUTH_LIMIT_POST,
1331                   AUTH_LIMIT_POST,
1332                   AUTH_LIMIT_POST,
1333                   AUTH_LIMIT_PUT,
1334                   AUTH_LIMIT_PUT,
1335                   AUTH_LIMIT_DELETE,
1336                   AUTH_LIMIT_TRACE,
1337                   AUTH_LIMIT_ALL,
1338                   AUTH_LIMIT_ALL
1339                 };
1340
1341
1342  /*
1343   * First copy the connection URI to a local string so we have drop
1344   * any .ppd extension from the pathname in /printers or /classes
1345   * URIs...
1346   */
1347
1348   strlcpy(uri, path, sizeof(uri));
1349
1350   if (!strncmp(uri, "/printers/", 10) ||
1351       !strncmp(uri, "/classes/", 9))
1352   {
1353    /*
1354     * Check if the URI has .ppd on the end...
1355     */
1356
1357     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1358
1359     if (!strcmp(uriptr, ".ppd"))
1360       *uriptr = '\0';
1361   }
1362
1363   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1364
1365  /*
1366   * Loop through the list of locations to find a match...
1367   */
1368
1369   limit   = limits[state];
1370   best    = NULL;
1371   bestlen = 0;
1372
1373   for (i = NumLocations, loc = Locations; i > 0; i --, loc ++)
1374   {
1375     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1376                     loc->location, loc->limit);
1377
1378     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1379     {
1380      /*
1381       * Use case-insensitive comparison for queue names...
1382       */
1383
1384       if (loc->length > bestlen &&
1385           strncasecmp(uri, loc->location, loc->length) == 0 &&
1386           loc->location[0] == '/' &&
1387           (limit & loc->limit) != 0)
1388       {
1389         best    = loc;
1390         bestlen = loc->length;
1391       }
1392     }
1393     else
1394     {
1395      /*
1396       * Use case-sensitive comparison for other URIs...
1397       */
1398
1399       if (loc->length > bestlen &&
1400           !strncmp(uri, loc->location, loc->length) &&
1401           loc->location[0] == '/' &&
1402           (limit & loc->limit) != 0)
1403       {
1404         best    = loc;
1405         bestlen = loc->length;
1406       }
1407     }
1408   }
1409
1410  /*
1411   * Return the match, if any...
1412   */
1413
1414   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1415                   best ? best->location : "NONE");
1416
1417   return (best);
1418 }
1419
1420
1421 /*
1422  * 'cupsdFindLocation()' - Find the named location.
1423  */
1424
1425 cupsd_location_t *                      /* O - Location that matches */
1426 cupsdFindLocation(const char *location) /* I - Connection */
1427 {
1428   int           i;                      /* Looping var */
1429
1430
1431  /*
1432   * Loop through the list of locations to find a match...
1433   */
1434
1435   for (i = 0; i < NumLocations; i ++)
1436     if (!strcasecmp(Locations[i].location, location))
1437       return (Locations + i);
1438
1439   return (NULL);
1440 }
1441
1442
1443 /*
1444  * 'cupsdGetMD5Passwd()' - Get an MD5 password.
1445  */
1446
1447 char *                                  /* O - MD5 password string */
1448 cupsdGetMD5Passwd(const char *username, /* I - Username */
1449                   const char *group,    /* I - Group */
1450                   char       passwd[33])/* O - MD5 password string */
1451 {
1452   cups_file_t   *fp;                    /* passwd.md5 file */
1453   char          filename[1024],         /* passwd.md5 filename */
1454                 line[256],              /* Line from file */
1455                 tempuser[33],           /* User from file */
1456                 tempgroup[33];          /* Group from file */
1457
1458
1459   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1460                   "cupsdGetMD5Passwd(username=\"%s\", group=\"%s\", passwd=%p)",
1461                   username, group ? group : "(null)", passwd);
1462
1463   snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
1464   if ((fp = cupsFileOpen(filename, "r")) == NULL)
1465   {
1466     if (errno != ENOENT)
1467       cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
1468                       strerror(errno));
1469
1470     return (NULL);
1471   }
1472
1473   while (cupsFileGets(fp, line, sizeof(line)) != NULL)
1474   {
1475     if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
1476     {
1477       cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
1478       continue;
1479     }
1480
1481     if (strcmp(username, tempuser) == 0 &&
1482         (group == NULL || strcmp(group, tempgroup) == 0))
1483     {
1484      /*
1485       * Found the password entry!
1486       */
1487
1488       cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
1489                       username, tempgroup);
1490
1491       cupsFileClose(fp);
1492       return (passwd);
1493     }
1494   }
1495
1496  /*
1497   * Didn't find a password entry - return NULL!
1498   */
1499
1500   cupsFileClose(fp);
1501   return (NULL);
1502 }
1503
1504
1505 /*
1506  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1507  */
1508
1509 http_status_t                           /* O - HTTP_OK if authorized or error code */
1510 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1511                   const char     *owner)/* I - Owner of object */
1512 {
1513   int                   i, j,           /* Looping vars */
1514                         auth;           /* Authorization status */
1515   unsigned              address[4];     /* Authorization address */
1516   cupsd_location_t      *best;          /* Best match for location so far */
1517   int                   hostlen;        /* Length of hostname */
1518   const char            *username;      /* Username to authorize */
1519   struct passwd         *pw;            /* User password data */
1520   static const char * const levels[] =  /* Auth levels */
1521                 {
1522                   "ANON",
1523                   "USER",
1524                   "GROUP"
1525                 };
1526   static const char * const types[] =   /* Auth types */
1527                 {
1528                   "NONE",
1529                   "BASIC",
1530                   "DIGEST",
1531                   "BASICDIGEST"
1532                 };
1533
1534
1535   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1536                   "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1537                   con->uri, con->best, con->best ? con->best->location : "");
1538   if (owner)
1539     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1540                     "cupsdIsAuthorized: owner=\"%s\"", owner);
1541
1542  /*
1543   * If there is no "best" authentication rule for this request, then
1544   * access is allowed from the local system and denied from other
1545   * addresses...
1546   */
1547
1548   if (!con->best)
1549   {
1550     if (!strcmp(con->http.hostname, "localhost") ||
1551         !strcmp(con->http.hostname, ServerName))
1552       return (HTTP_OK);
1553     else
1554       return (HTTP_FORBIDDEN);
1555   }
1556
1557   best = con->best;
1558
1559   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1560                   "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, satisfy=AUTH_SATISFY_%s, num_names=%d",
1561                   levels[best->level], types[best->type],
1562                   best->satisfy ? "ANY" : "ALL", best->num_names);
1563
1564   if (best->limit == AUTH_LIMIT_IPP)
1565     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1566                     best->op, ippOpString(best->op));
1567
1568  /*
1569   * Check host/ip-based accesses...
1570   */
1571
1572 #ifdef AF_INET6
1573   if (con->http.hostaddr->addr.sa_family == AF_INET6)
1574   {
1575    /*
1576     * Copy IPv6 address...
1577     */
1578
1579     address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1580     address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1581     address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1582     address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1583   }
1584   else
1585 #endif /* AF_INET6 */
1586   if (con->http.hostaddr->addr.sa_family == AF_INET)
1587   {
1588    /*
1589     * Copy IPv4 address...
1590     */
1591
1592     address[0] = 0;
1593     address[1] = 0;
1594     address[2] = 0;
1595     address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1596   }
1597   else
1598     memset(address, 0, sizeof(address));
1599
1600   hostlen = strlen(con->http.hostname);
1601
1602   if (!strcasecmp(con->http.hostname, "localhost"))
1603   {
1604    /*
1605     * Access from localhost (127.0.0.1 or :::1) is always allowed...
1606     */
1607
1608     auth = AUTH_ALLOW;
1609   }
1610   else
1611   {
1612    /*
1613     * Do authorization checks on the domain/address...
1614     */
1615
1616     switch (best->order_type)
1617     {
1618       default :
1619           auth = AUTH_DENY;     /* anti-compiler-warning-code */
1620           break;
1621
1622       case AUTH_ALLOW : /* Order Deny,Allow */
1623           auth = AUTH_ALLOW;
1624
1625           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1626                         best->num_deny, best->deny))
1627             auth = AUTH_DENY;
1628
1629           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1630                         best->num_allow, best->allow))
1631             auth = AUTH_ALLOW;
1632           break;
1633
1634       case AUTH_DENY : /* Order Allow,Deny */
1635           auth = AUTH_DENY;
1636
1637           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1638                         best->num_allow, best->allow))
1639             auth = AUTH_ALLOW;
1640
1641           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1642                         best->num_deny, best->deny))
1643             auth = AUTH_DENY;
1644           break;
1645     }
1646   }
1647
1648   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1649                   auth ? "DENY" : "ALLOW");
1650
1651   if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1652     return (HTTP_FORBIDDEN);
1653
1654 #ifdef HAVE_SSL
1655  /*
1656   * See if encryption is required...
1657   */
1658
1659   if (best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls)
1660   {
1661     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1662                     "cupsdIsAuthorized: Need upgrade to TLS...");
1663     return (HTTP_UPGRADE_REQUIRED);
1664   }
1665 #endif /* HAVE_SSL */
1666
1667  /*
1668   * Now see what access level is required...
1669   */
1670
1671   if (best->level == AUTH_ANON ||       /* Anonymous access - allow it */
1672       (best->type == AUTH_NONE && best->num_names == 0))
1673     return (HTTP_OK);
1674
1675   if (!con->username[0] && best->type == AUTH_NONE &&
1676       best->limit == AUTH_LIMIT_IPP)
1677   {
1678    /*
1679     * Check for unauthenticated username...
1680     */
1681
1682     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1683
1684
1685     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1686     if (attr)
1687     {
1688       cupsdLogMessage(CUPSD_LOG_DEBUG2,
1689                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1690                       attr->values[0].string.text);
1691       username = attr->values[0].string.text;
1692     }
1693     else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1694       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1695     else
1696       return (HTTP_OK);                 /* unless overridden with Satisfy */
1697   }
1698   else
1699   {
1700     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: username=\"%s\"",
1701                     con->username);
1702
1703     if (!con->username[0])
1704     {
1705       if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1706         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1707       else
1708         return (HTTP_OK);               /* unless overridden with Satisfy */
1709     }
1710
1711     username = con->username;
1712   }
1713
1714  /*
1715   * OK, got a username.  See if we need normal user access, or group
1716   * access... (root always matches)
1717   */
1718
1719   if (!strcmp(username, "root"))
1720     return (HTTP_OK);
1721
1722  /*
1723   * Get the user info...
1724   */
1725
1726   pw = getpwnam(username);
1727   endpwent();
1728
1729   if (best->level == AUTH_USER)
1730   {
1731    /*
1732     * If there are no names associated with this location, then
1733     * any valid user is OK...
1734     */
1735
1736     if (best->num_names == 0)
1737       return (HTTP_OK);
1738
1739    /*
1740     * Otherwise check the user list and return OK if this user is
1741     * allowed...
1742     */
1743
1744     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1745                     "cupsdIsAuthorized: Checking user membership...");
1746
1747     for (i = 0; i < best->num_names; i ++)
1748     {
1749       if (!strcasecmp(best->names[i], "@OWNER") && owner &&
1750           !strcasecmp(username, owner))
1751         return (HTTP_OK);
1752       else if (!strcasecmp(best->names[i], "@SYSTEM"))
1753       {
1754         for (j = 0; j < NumSystemGroups; j ++)
1755           if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1756             return (HTTP_OK);
1757       }
1758       else if (best->names[i][0] == '@')
1759       {
1760         if (cupsdCheckGroup(username, pw, best->names[i] + 1))
1761           return (HTTP_OK);
1762       }
1763       else if (!strcasecmp(username, best->names[i]))
1764         return (HTTP_OK);
1765     }
1766
1767     return (HTTP_UNAUTHORIZED);
1768   }
1769
1770  /*
1771   * Check to see if this user is in any of the named groups...
1772   */
1773
1774   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1775                   "cupsdIsAuthorized: Checking group membership...");
1776
1777  /*
1778   * Check to see if this user is in any of the named groups...
1779   */
1780
1781   for (i = 0; i < best->num_names; i ++)
1782   {
1783     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1784                     "cupsdIsAuthorized: Checking group \"%s\" membership...",
1785                     best->names[i]);
1786
1787     if (!strcasecmp(best->names[i], "@SYSTEM"))
1788     {
1789       for (j = 0; j < NumSystemGroups; j ++)
1790         if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1791           return (HTTP_OK);
1792     }
1793     else if (cupsdCheckGroup(username, pw, best->names[i]))
1794       return (HTTP_OK);
1795   }
1796
1797  /*
1798   * The user isn't part of the specified group, so deny access...
1799   */
1800
1801   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1802                   "cupsdIsAuthorized: User not in group(s)!");
1803
1804   return (HTTP_UNAUTHORIZED);
1805 }
1806
1807
1808 /*
1809  * 'add_allow()' - Add an allow mask to the location.
1810  */
1811
1812 static cupsd_authmask_t *               /* O - New mask record */
1813 add_allow(cupsd_location_t *loc)        /* I - Location to add to */
1814 {
1815   cupsd_authmask_t      *temp;          /* New mask record */
1816
1817
1818  /*
1819   * Range-check...
1820   */
1821
1822   if (loc == NULL)
1823     return (NULL);
1824
1825  /*
1826   * Try to allocate memory for the record...
1827   */
1828
1829   if (loc->num_allow == 0)
1830     temp = malloc(sizeof(cupsd_authmask_t));
1831   else
1832     temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
1833
1834   if (temp == NULL)
1835     return (NULL);
1836
1837   loc->allow = temp;
1838   temp       += loc->num_allow;
1839   loc->num_allow ++;
1840
1841  /*
1842   * Clear the mask record and return...
1843   */
1844
1845   memset(temp, 0, sizeof(cupsd_authmask_t));
1846   return (temp);
1847 }
1848
1849
1850 /*
1851  * 'add_deny()' - Add a deny mask to the location.
1852  */
1853
1854 static cupsd_authmask_t *               /* O - New mask record */
1855 add_deny(cupsd_location_t *loc)         /* I - Location to add to */
1856 {
1857   cupsd_authmask_t      *temp;          /* New mask record */
1858
1859
1860  /*
1861   * Range-check...
1862   */
1863
1864   if (loc == NULL)
1865     return (NULL);
1866
1867  /*
1868   * Try to allocate memory for the record...
1869   */
1870
1871   if (loc->num_deny == 0)
1872     temp = malloc(sizeof(cupsd_authmask_t));
1873   else
1874     temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
1875
1876   if (temp == NULL)
1877     return (NULL);
1878
1879   loc->deny = temp;
1880   temp      += loc->num_deny;
1881   loc->num_deny ++;
1882
1883  /*
1884   * Clear the mask record and return...
1885   */
1886
1887   memset(temp, 0, sizeof(cupsd_authmask_t));
1888   return (temp);
1889 }
1890
1891
1892 #if !HAVE_LIBPAM
1893 /*
1894  * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1895  *                  as needed.
1896  */
1897
1898 static char *                           /* O - Encrypted password */
1899 cups_crypt(const char *pw,              /* I - Password string */
1900            const char *salt)            /* I - Salt (key) string */
1901 {
1902   if (strncmp(salt, "$1$", 3) == 0)
1903   {
1904    /*
1905     * Use MD5 passwords without the benefit of PAM; this is for
1906     * Slackware Linux, and the algorithm was taken from the
1907     * old shadow-19990827/lib/md5crypt.c source code... :(
1908     */
1909
1910     int                 i;              /* Looping var */
1911     unsigned long       n;              /* Output number */
1912     int                 pwlen;          /* Length of password string */
1913     const char          *salt_end;      /* End of "salt" data for MD5 */
1914     char                *ptr;           /* Pointer into result string */
1915     _cups_md5_state_t   state;          /* Primary MD5 state info */
1916     _cups_md5_state_t   state2;         /* Secondary MD5 state info */
1917     unsigned char       digest[16];     /* MD5 digest result */
1918     static char         result[120];    /* Final password string */
1919
1920
1921    /*
1922     * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
1923     * Get a maximum of 8 characters of salt data after $1$...
1924     */
1925
1926     for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
1927       if (*salt_end == '$')
1928         break;
1929
1930    /*
1931     * Compute the MD5 sum we need...
1932     */
1933
1934     pwlen = strlen(pw);
1935
1936     _cups_md5_init(&state);
1937     _cups_md5_append(&state, (unsigned char *)pw, pwlen);
1938     _cups_md5_append(&state, (unsigned char *)salt, salt_end - salt);
1939
1940     _cups_md5_init(&state2);
1941     _cups_md5_append(&state2, (unsigned char *)pw, pwlen);
1942     _cups_md5_append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
1943     _cups_md5_append(&state2, (unsigned char *)pw, pwlen);
1944     _cups_md5_finish(&state2, digest);
1945
1946     for (i = pwlen; i > 0; i -= 16)
1947       _cups_md5_append(&state, digest, i > 16 ? 16 : i);
1948
1949     for (i = pwlen; i > 0; i >>= 1)
1950       _cups_md5_append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
1951
1952     _cups_md5_finish(&state, digest);
1953
1954     for (i = 0; i < 1000; i ++)
1955     {
1956       _cups_md5_init(&state);
1957
1958       if (i & 1)
1959         _cups_md5_append(&state, (unsigned char *)pw, pwlen);
1960       else
1961         _cups_md5_append(&state, digest, 16);
1962
1963       if (i % 3)
1964         _cups_md5_append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
1965
1966       if (i % 7)
1967         _cups_md5_append(&state, (unsigned char *)pw, pwlen);
1968
1969       if (i & 1)
1970         _cups_md5_append(&state, digest, 16);
1971       else
1972         _cups_md5_append(&state, (unsigned char *)pw, pwlen);
1973
1974       _cups_md5_finish(&state, digest);
1975     }
1976
1977    /*
1978     * Copy the final sum to the result string and return...
1979     */
1980
1981     memcpy(result, salt, salt_end - salt);
1982     ptr = result + (salt_end - salt);
1983     *ptr++ = '$';
1984
1985     for (i = 0; i < 5; i ++, ptr += 4)
1986     {
1987       n = (((digest[i] << 8) | digest[i + 6]) << 8);
1988
1989       if (i < 4)
1990         n |= digest[i + 12];
1991       else
1992         n |= digest[5];
1993
1994       to64(ptr, n, 4);
1995     }
1996
1997     to64(ptr, digest[11], 2);
1998     ptr += 2;
1999     *ptr = '\0';
2000
2001     return (result);
2002   }
2003   else
2004   {
2005    /*
2006     * Use the standard crypt() function...
2007     */
2008
2009     return (crypt(pw, salt));
2010   }
2011 }
2012 #endif /* !HAVE_LIBPAM */
2013
2014
2015 #if HAVE_LIBPAM
2016 /*
2017  * 'pam_func()' - PAM conversation function.
2018  */
2019
2020 static int                              /* O - Success or failure */
2021 pam_func(
2022     int                      num_msg,   /* I - Number of messages */
2023     const struct pam_message **msg,     /* I - Messages */
2024     struct pam_response      **resp,    /* O - Responses */
2025     void                     *appdata_ptr)
2026                                         /* I - Pointer to connection */
2027 {
2028   int                   i;              /* Looping var */
2029   struct pam_response   *replies;       /* Replies */
2030   cupsd_authdata_t      *data;          /* Pointer to auth data */
2031
2032
2033  /*
2034   * Allocate memory for the responses...
2035   */
2036
2037   if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2038     return (PAM_CONV_ERR);
2039
2040  /*
2041   * Answer all of the messages...
2042   */
2043
2044   DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2045
2046 #ifdef __hpux
2047  /*
2048   * Apparently some versions of HP-UX 11 have a broken pam_unix security
2049   * module.  This is a workaround...
2050   */
2051
2052   data = auth_data;
2053   (void)appdata_ptr;
2054 #else
2055   data = (cupsd_authdata_t *)appdata_ptr;
2056 #endif /* __hpux */
2057
2058   for (i = 0; i < num_msg; i ++)
2059   {
2060     DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2061
2062     switch (msg[i]->msg_style)
2063     {
2064       case PAM_PROMPT_ECHO_ON:
2065           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2066                         data->username));
2067           replies[i].resp_retcode = PAM_SUCCESS;
2068           replies[i].resp         = strdup(data->username);
2069           break;
2070
2071       case PAM_PROMPT_ECHO_OFF:
2072           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2073                         data->password));
2074           replies[i].resp_retcode = PAM_SUCCESS;
2075           replies[i].resp         = strdup(data->password);
2076           break;
2077
2078       case PAM_TEXT_INFO:
2079           DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2080           replies[i].resp_retcode = PAM_SUCCESS;
2081           replies[i].resp         = NULL;
2082           break;
2083
2084       case PAM_ERROR_MSG:
2085           DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2086           replies[i].resp_retcode = PAM_SUCCESS;
2087           replies[i].resp         = NULL;
2088           break;
2089
2090       default:
2091           DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2092                         msg[i]->msg_style));
2093           free(replies);
2094           return (PAM_CONV_ERR);
2095     }
2096   }
2097
2098  /*
2099   * Return the responses back to PAM...
2100   */
2101
2102   *resp = replies;
2103
2104   return (PAM_SUCCESS);
2105 }
2106 #else
2107
2108
2109 /*
2110  * 'to64()' - Base64-encode an integer value...
2111  */
2112
2113 static void
2114 to64(char          *s,                  /* O - Output string */
2115      unsigned long v,                   /* I - Value to encode */
2116      int           n)                   /* I - Number of digits */
2117 {
2118   const char    *itoa64 = "./0123456789"
2119                           "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2120                           "abcdefghijklmnopqrstuvwxyz";
2121
2122
2123   for (; n > 0; n --, v >>= 6)
2124     *s++ = itoa64[v & 0x3f];
2125 }
2126 #endif /* HAVE_LIBPAM */
2127
2128
2129 /*
2130  * End of "$Id: auth.c 5043 2006-02-01 18:55:16Z mike $".
2131  */