scheduler/auth.c

   1 /*
   2  * "$Id: auth.c 5305 2006-03-18 03:05:12Z mike $"
   3  *
   4  *   Authorization routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
   7  *
   8  *   These coded instructions, statements, and computer programs are the
   9  *   property of Easy Software Products and are protected by Federal
  10  *   copyright law.  Distribution and use rights are outlined in the file
  11  *   "LICENSE.txt" which should have been included with this file.  If this
  12  *   file is missing or damaged please contact Easy Software Products
  13  *   at:
  14  *
  15  *       Attn: CUPS Licensing Information
  16  *       Easy Software Products
  17  *       44141 Airport View Drive, Suite 204
  18  *       Hollywood, Maryland 20636 USA
  19  *
  20  *       Voice: (301) 373-9600
  21  *       EMail: cups-info@cups.org
  22  *         WWW: http://www.cups.org
  23  *
  24  * Contents:
  25  *
  26  *   cupsdAddLocation()        - Add a location for authorization.
  27  *   cupsdAddName()            - Add a name to a location...
  28  *   cupsdAllowHost()          - Add a host name that is allowed to access the
  29  *                               location.
  30  *   cupsdAllowIP()            - Add an IP address or network that is allowed to
  31  *                               access the location.
  32  *   cupsdCheckAuth()          - Check authorization masks.
  33  *   cupsdCheckGroup()         - Check for a user's group membership.
  34  *   cupsdCopyLocation()       - Make a copy of a location...
  35  *   cupsdDeleteAllLocations() - Free all memory used for location authorization.
  36  *   cupsdDeleteLocation()     - Free all memory used by a location.
  37  *   cupsdDenyHost()           - Add a host name that is not allowed to access the
  38  *                               location.
  39  *   cupsdDenyIP()             - Add an IP address or network that is not allowed
  40  *                               to access the location.
  41  *   cupsdFindBest()           - Find the location entry that best matches the
  42  *                               resource.
  43  *   cupsdFindLocation()       - Find the named location.
  44  *   cupsdIsAuthorized()       - Check to see if the user is authorized...
  45  *   add_allow()               - Add an allow mask to the location.
  46  *   add_deny()                - Add a deny mask to the location.
  47  *   compare_locations()       - Compare two locations.
  48  *   cups_crypt()              - Encrypt the password using the DES or MD5
  49  *                               algorithms, as needed.
  50  *   get_md5_password()        - Get an MD5 password.
  51  *   pam_func()                - PAM conversation function.
  52  *   to64()                    - Base64-encode an integer value...
  53  */
  54
  55 /*
  56  * Include necessary headers...
  57  */
  58
  59 #include "cupsd.h"
  60 #include <grp.h>
  61 #ifdef HAVE_SHADOW_H
  62 #  include <shadow.h>
  63 #endif /* HAVE_SHADOW_H */
  64 #ifdef HAVE_CRYPT_H
  65 #  include <crypt.h>
  66 #endif /* HAVE_CRYPT_H */
  67 #if HAVE_LIBPAM
  68 #  ifdef HAVE_PAM_PAM_APPL_H
  69 #    include <pam/pam_appl.h>
  70 #  else
  71 #    include <security/pam_appl.h>
  72 #  endif /* HAVE_PAM_PAM_APPL_H */
  73 #endif /* HAVE_LIBPAM */
  74 #ifdef HAVE_USERSEC_H
  75 #  include <usersec.h>
  76 #endif /* HAVE_USERSEC_H */
  77 #ifdef HAVE_MEMBERSHIP_H
  78 #  include <membership.h>
  79 #endif /* HAVE_MEMBERSHIP_H */
  80
  81
  82 /*
  83  * Local functions...
  84  */
  85
  86 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
  87 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
  88 static int              compare_locations(cupsd_location_t *a,
  89                                           cupsd_location_t *b);
  90 #if !HAVE_LIBPAM
  91 static char             *cups_crypt(const char *pw, const char *salt);
  92 #endif /* !HAVE_LIBPAM */
  93 static char             *get_md5_password(const char *username,
  94                                           const char *group, char passwd[33]);
  95 #if HAVE_LIBPAM
  96 static int              pam_func(int, const struct pam_message **,
  97                                  struct pam_response **, void *);
  98 #else
  99 static void             to64(char *s, unsigned long v, int n);
 100 #endif /* HAVE_LIBPAM */
 101
 102
 103 /*
 104  * Local structures...
 105  */
 106
 107 #if HAVE_LIBPAM
 108 typedef struct cupsd_authdata_s         /**** Authentication data ****/
 109 {
 110   char  username[33],                   /* Username string */
 111         password[33];                   /* Password string */
 112 } cupsd_authdata_t;
 113 #endif /* HAVE_LIBPAM */
 114
 115
 116 /*
 117  * Local globals...
 118  */
 119
 120 #if defined(__hpux) && defined(HAVE_LIBPAM)
 121 static cupsd_authdata_t *auth_data;     /* Current client being authenticated */
 122 #endif /* __hpux && HAVE_LIBPAM */
 123
 124
 125 /*
 126  * 'cupsdAddLocation()' - Add a location for authorization.
 127  */
 128
 129 cupsd_location_t *                      /* O - Pointer to new location record */
 130 cupsdAddLocation(const char *location)  /* I - Location path */
 131 {
 132   cupsd_location_t      *temp;          /* New location */
 133
 134
 135  /*
 136   * Make sure the locations array is created...
 137   */
 138
 139   if (!Locations)
 140     Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
 141
 142   if (!Locations)
 143     return (NULL);
 144
 145  /*
 146   * Try to allocate memory for the new location.
 147   */
 148
 149   if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
 150     return (NULL);
 151
 152  /*
 153   * Initialize the record and copy the name over...
 154   */
 155
 156   temp->location = strdup(location);
 157   temp->length   = strlen(temp->location);
 158
 159   cupsArrayAdd(Locations, temp);
 160
 161   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
 162                   location);
 163
 164  /*
 165   * Return the new record...
 166   */
 167
 168   return (temp);
 169 }
 170
 171
 172 /*
 173  * 'cupsdAddName()' - Add a name to a location...
 174  */
 175
 176 void
 177 cupsdAddName(cupsd_location_t *loc,     /* I - Location to add to */
 178              char             *name)    /* I - Name to add */
 179 {
 180   char  **temp;                         /* Pointer to names array */
 181
 182
 183   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
 184                   loc, name);
 185
 186   if (loc->num_names == 0)
 187     temp = malloc(sizeof(char *));
 188   else
 189     temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
 190
 191   if (temp == NULL)
 192   {
 193     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
 194                     loc->location ? loc->location : "nil", strerror(errno));
 195     return;
 196   }
 197
 198   loc->names = temp;
 199
 200   if ((temp[loc->num_names] = strdup(name)) == NULL)
 201   {
 202     cupsdLogMessage(CUPSD_LOG_ERROR,
 203                     "Unable to duplicate name for location %s: %s",
 204                     loc->location ? loc->location : "nil", strerror(errno));
 205     return;
 206   }
 207
 208   loc->num_names ++;
 209 }
 210
 211
 212 /*
 213  * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
 214  */
 215
 216 void
 217 cupsdAllowHost(cupsd_location_t *loc,   /* I - Location to add to */
 218                char             *name)  /* I - Name of host or domain to add */
 219 {
 220   cupsd_authmask_t      *temp;          /* New host/domain mask */
 221   char                  ifname[32],     /* Interface name */
 222                         *ifptr;         /* Pointer to end of name */
 223
 224
 225   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
 226                   loc, loc->location ? loc->location : "nil", name);
 227
 228   if ((temp = add_allow(loc)) == NULL)
 229     return;
 230
 231   if (!strcasecmp(name, "@LOCAL"))
 232   {
 233    /*
 234     * Allow *interface*...
 235     */
 236
 237     temp->type             = AUTH_INTERFACE;
 238     temp->mask.name.name   = strdup("*");
 239     temp->mask.name.length = 1;
 240   }
 241   else if (!strncasecmp(name, "@IF(", 4))
 242   {
 243    /*
 244     * Allow *interface*...
 245     */
 246
 247     strlcpy(ifname, name + 4, sizeof(ifname));
 248
 249     ifptr = ifname + strlen(ifname);
 250
 251     if (ifptr[-1] == ')')
 252     {
 253       ifptr --;
 254       *ifptr = '\0';
 255     }
 256
 257     temp->type             = AUTH_INTERFACE;
 258     temp->mask.name.name   = strdup(ifname);
 259     temp->mask.name.length = ifptr - ifname;
 260   }
 261   else
 262   {
 263    /*
 264     * Allow name...
 265     */
 266
 267     temp->type             = AUTH_NAME;
 268     temp->mask.name.name   = strdup(name);
 269     temp->mask.name.length = strlen(name);
 270   }
 271 }
 272
 273
 274 /*
 275  * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
 276  *                    the location.
 277  */
 278
 279 void
 280 cupsdAllowIP(cupsd_location_t *loc,     /* I - Location to add to */
 281              unsigned   address[4],     /* I - IP address to add */
 282              unsigned   netmask[4])     /* I - Netmask of address */
 283 {
 284   cupsd_authmask_t      *temp;          /* New host/domain mask */
 285
 286
 287   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 288                   "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
 289                   loc, loc->location ? loc->location : "nil",
 290                   address[0], address[1], address[2], address[3],
 291                   netmask[0], netmask[1], netmask[2], netmask[3]);
 292
 293   if ((temp = add_allow(loc)) == NULL)
 294     return;
 295
 296   temp->type = AUTH_IP;
 297   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
 298   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
 299 }
 300
 301
 302 /*
 303  * 'cupsdAuthorize()' - Validate any authorization credentials.
 304  */
 305
 306 void
 307 cupsdAuthorize(cupsd_client_t *con)     /* I - Client connection */
 308 {
 309   int           type;                   /* Authentication type */
 310   char          *authorization,         /* Pointer into Authorization string */
 311                 *ptr,                   /* Pointer into string */
 312                 username[65],           /* Username string */
 313                 password[33];           /* Password string */
 314   const char    *localuser;             /* Certificate username */
 315   char          nonce[HTTP_MAX_VALUE],  /* Nonce value from client */
 316                 md5[33],                /* MD5 password */
 317                 basicmd5[33];           /* MD5 of Basic password */
 318   static const char * const states[] =  /* HTTP client states... */
 319                 {
 320                   "WAITING",
 321                   "OPTIONS",
 322                   "GET",
 323                   "GET",
 324                   "HEAD",
 325                   "POST",
 326                   "POST",
 327                   "POST",
 328                   "PUT",
 329                   "PUT",
 330                   "DELETE",
 331                   "TRACE",
 332                   "CLOSE",
 333                   "STATUS"
 334                 };
 335
 336
 337  /*
 338   * Locate the best matching location so we know what kind of
 339   * authentication to expect...
 340   */
 341
 342   con->best = cupsdFindBest(con->uri, con->http.state);
 343
 344   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 345                   "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
 346                   con->uri, con->best, con->best ? con->best->location : "");
 347
 348   if (con->best && con->best->type != AUTH_NONE)
 349     type = con->best->type;
 350   else
 351     type = DefaultAuthType;
 352
 353  /*
 354   * Decode the Authorization string...
 355   */
 356
 357   authorization = con->http.fields[HTTP_FIELD_AUTHORIZATION];
 358
 359   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
 360                   authorization);
 361
 362   username[0] = '\0';
 363   password[0] = '\0';
 364
 365   if (type == AUTH_NONE)
 366   {
 367    /*
 368     * No authorization required, return early...
 369     */
 370
 371     cupsdLogMessage(CUPSD_LOG_DEBUG,
 372                     "cupsdAuthorize: No authentication required.");
 373     return;
 374   }
 375   else if (!*authorization)
 376   {
 377    /*
 378     * No authorization data provided, return early...
 379     */
 380
 381     cupsdLogMessage(CUPSD_LOG_DEBUG,
 382                     "cupsdAuthorize: No authentication data provided.");
 383     return;
 384   }
 385   else if (!strncmp(authorization, "Local", 5) &&
 386            !strcasecmp(con->http.hostname, "localhost"))
 387   {
 388    /*
 389     * Get Local certificate authentication data...
 390     */
 391
 392     authorization += 5;
 393     while (isspace(*authorization))
 394       authorization ++;
 395
 396     if ((localuser = cupsdFindCert(authorization)) != NULL)
 397       strlcpy(username, localuser, sizeof(username));
 398     else
 399     {
 400       cupsdLogMessage(CUPSD_LOG_ERROR,
 401                       "cupsdAuthorize: Local authentication certificate not "
 402                       "found!");
 403       return;
 404     }
 405   }
 406   else if (!strncmp(authorization, "Basic", 5) &&
 407            (type == AUTH_BASIC || type == AUTH_BASICDIGEST))
 408   {
 409    /*
 410     * Get the Basic authentication data...
 411     */
 412
 413     int userlen;                        /* Username:password length */
 414
 415
 416     authorization += 5;
 417     while (isspace(*authorization))
 418       authorization ++;
 419
 420     userlen = sizeof(username);
 421     httpDecode64_2(username, &userlen, authorization);
 422
 423    /*
 424     * Pull the username and password out...
 425     */
 426
 427     if ((ptr = strchr(username, ':')) == NULL)
 428     {
 429       cupsdLogMessage(CUPSD_LOG_ERROR,
 430                       "cupsdAuthorize: Missing Basic password!");
 431       return;
 432     }
 433
 434     *ptr++ = '\0';
 435
 436     if (!username[0])
 437     {
 438      /*
 439       * Username must not be empty...
 440       */
 441
 442       cupsdLogMessage(CUPSD_LOG_ERROR,
 443                       "cupsdAuthorize: Empty Basic username!");
 444       return;
 445     }
 446
 447     if (!*ptr)
 448     {
 449      /*
 450       * Password must not be empty...
 451       */
 452
 453       cupsdLogMessage(CUPSD_LOG_ERROR,
 454                       "cupsdAuthorize: Empty Basic password!");
 455       return;
 456     }
 457
 458     strlcpy(password, ptr, sizeof(password));
 459
 460    /*
 461     * Validate the username and password...
 462     */
 463
 464     switch (type)
 465     {
 466       case AUTH_BASIC :
 467           {
 468 #if HAVE_LIBPAM
 469            /*
 470             * Only use PAM to do authentication.  This supports MD5
 471             * passwords, among other things...
 472             */
 473
 474             pam_handle_t        *pamh;  /* PAM authentication handle */
 475             int                 pamerr; /* PAM error code */
 476             struct pam_conv     pamdata;/* PAM conversation data */
 477             cupsd_authdata_t    data;   /* Authentication data */
 478
 479
 480             strlcpy(data.username, username, sizeof(data.username));
 481             strlcpy(data.password, password, sizeof(data.password));
 482
 483 #  ifdef __sun
 484             pamdata.conv        = (int (*)(int, struct pam_message **,
 485                                            struct pam_response **,
 486                                            void *))pam_func;
 487 #  else
 488             pamdata.conv        = pam_func;
 489 #  endif /* __sun */
 490             pamdata.appdata_ptr = &data;
 491
 492 #  ifdef __hpux
 493            /*
 494             * Workaround for HP-UX bug in pam_unix; see pam_func() below for
 495             * more info...
 496             */
 497
 498             auth_data = &data;
 499 #  endif /* __hpux */
 500
 501             pamerr = pam_start("cups", username, &pamdata, &pamh);
 502             if (pamerr != PAM_SUCCESS)
 503             {
 504               cupsdLogMessage(CUPSD_LOG_ERROR,
 505                               "cupsdAuthorize: pam_start() returned %d (%s)!\n",
 506                               pamerr, pam_strerror(pamh, pamerr));
 507               pam_end(pamh, 0);
 508               return;
 509             }
 510
 511             pamerr = pam_authenticate(pamh, PAM_SILENT);
 512             if (pamerr != PAM_SUCCESS)
 513             {
 514               cupsdLogMessage(CUPSD_LOG_ERROR,
 515                               "cupsdAuthorize: pam_authenticate() returned %d "
 516                               "(%s)!\n",
 517                               pamerr, pam_strerror(pamh, pamerr));
 518               pam_end(pamh, 0);
 519               return;
 520             }
 521
 522             pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
 523             if (pamerr != PAM_SUCCESS)
 524             {
 525               cupsdLogMessage(CUPSD_LOG_ERROR,
 526                               "cupsdAuthorize: pam_acct_mgmt() returned %d "
 527                               "(%s)!\n",
 528                               pamerr, pam_strerror(pamh, pamerr));
 529               pam_end(pamh, 0);
 530               return;
 531             }
 532
 533             pam_end(pamh, PAM_SUCCESS);
 534
 535 #elif defined(HAVE_USERSEC_H)
 536            /*
 537             * Use AIX authentication interface...
 538             */
 539
 540             char        *authmsg;       /* Authentication message */
 541             char        *loginmsg;      /* Login message */
 542             int         reenter;        /* ??? */
 543
 544
 545             cupsdLogMessage(CUPSD_LOG_DEBUG,
 546                             "cupsdAuthorize: AIX authenticate of username \"%s\"",
 547                             username);
 548
 549             reenter = 1;
 550             if (authenticate(username, password, &reenter, &authmsg) != 0)
 551             {
 552               cupsdLogMessage(CUPSD_LOG_DEBUG,
 553                               "cupsdAuthorize: Unable to authenticate username "
 554                               "\"%s\": %s",
 555                               username, strerror(errno));
 556               return;
 557             }
 558
 559 #else
 560            /*
 561             * Use normal UNIX password file-based authentication...
 562             */
 563
 564             char                *pass;  /* Encrypted password */
 565             struct passwd       *pw;    /* User password data */
 566 #  ifdef HAVE_SHADOW_H
 567             struct spwd         *spw;   /* Shadow password data */
 568 #  endif /* HAVE_SHADOW_H */
 569
 570
 571             pw = getpwnam(username);    /* Get the current password */
 572             endpwent();                 /* Close the password file */
 573
 574             if (!pw)
 575             {
 576              /*
 577               * No such user...
 578               */
 579
 580               cupsdLogMessage(CUPSD_LOG_ERROR,
 581                               "cupsdAuthorize: Unknown username \"%s\"!",
 582                               username);
 583               return (HTTP_UNAUTHORIZED);
 584             }
 585
 586 #  ifdef HAVE_SHADOW_H
 587             spw = getspnam(username);
 588             endspent();
 589
 590             if (!spw && !strcmp(pw->pw_passwd, "x"))
 591             {
 592              /*
 593               * Don't allow blank passwords!
 594               */
 595
 596               cupsdLogMessage(CUPSD_LOG_ERROR,
 597                               "cupsdAuthorize: Username \"%s\" has no shadow "
 598                               "password!", username);
 599               return;
 600             }
 601
 602             if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
 603 #  else
 604             if (!pw->pw_passwd[0])
 605 #  endif /* HAVE_SHADOW_H */
 606             {
 607              /*
 608               * Don't allow blank passwords!
 609               */
 610
 611               cupsdLogMessage(CUPSD_LOG_ERROR,
 612                               "cupsdAuthorize: Username \"%s\" has no password!",
 613                               username);
 614               return;
 615             }
 616
 617            /*
 618             * OK, the password isn't blank, so compare with what came from the
 619             * client...
 620             */
 621
 622             pass = cups_crypt(password, pw->pw_passwd);
 623
 624             cupsdLogMessage(CUPSD_LOG_DEBUG2,
 625                             "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
 626                             pw->pw_passwd, pass);
 627
 628             if (!pass || strcmp(pw->pw_passwd, pass))
 629             {
 630 #  ifdef HAVE_SHADOW_H
 631               if (spw)
 632               {
 633                 pass = cups_crypt(password, spw->sp_pwdp);
 634
 635                 cupsdLogMessage(CUPSD_LOG_DEBUG2,
 636                                 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
 637                                 spw->sp_pwdp, pass);
 638
 639                 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
 640                 {
 641                   cupsdLogMessage(CUPSD_LOG_ERROR,
 642                                   "cupsdAuthorize: Authentication failed for "
 643                                   "user \"%s\"!",
 644                                   username);
 645                   return;
 646                 }
 647               }
 648               else
 649 #  endif /* HAVE_SHADOW_H */
 650               {
 651                 cupsdLogMessage(CUPSD_LOG_ERROR,
 652                                 "cupsdAuthorize: Authentication failed for "
 653                                 "user \"%s\"!",
 654                                 username);
 655                 return;
 656               }
 657             }
 658 #endif /* HAVE_LIBPAM */
 659           }
 660           break;
 661
 662       case AUTH_BASICDIGEST :
 663          /*
 664           * Do Basic authentication with the Digest password file...
 665           */
 666
 667           if (!get_md5_password(username, NULL, md5))
 668           {
 669             cupsdLogMessage(CUPSD_LOG_ERROR,
 670                             "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 671                             username);
 672             return;
 673           }
 674
 675           httpMD5(username, "CUPS", password, basicmd5);
 676
 677           if (strcmp(md5, basicmd5))
 678           {
 679             cupsdLogMessage(CUPSD_LOG_ERROR,
 680                             "cupsdAuthorize: Authentication failed for \"%s\"!",
 681                             username);
 682             return;
 683           }
 684           break;
 685     }
 686   }
 687   else if (!strncmp(authorization, "Digest", 6) && type == AUTH_DIGEST)
 688   {
 689    /*
 690     * Get the username, password, and nonce from the Digest attributes...
 691     */
 692
 693     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
 694                           username, sizeof(username)) || !username[0])
 695     {
 696      /*
 697       * Username must not be empty...
 698       */
 699
 700       cupsdLogMessage(CUPSD_LOG_ERROR,
 701                       "cupsdAuthorize: Empty or missing Digest username!");
 702       return;
 703     }
 704
 705     if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
 706                           password, sizeof(password)) || !password[0])
 707     {
 708      /*
 709       * Password must not be empty...
 710       */
 711
 712       cupsdLogMessage(CUPSD_LOG_ERROR,
 713                       "cupsdAuthorize: Empty or missing Digest password!");
 714       return;
 715     }
 716
 717     if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
 718                          nonce))
 719     {
 720       cupsdLogMessage(CUPSD_LOG_ERROR,
 721                       "cupsdAuthorize: No nonce value for Digest "
 722                       "authentication!");
 723       return;
 724     }
 725
 726     if (strcmp(con->http.hostname, nonce))
 727     {
 728       cupsdLogMessage(CUPSD_LOG_ERROR,
 729                       "cupsdAuthorize: Bad nonce value, expected \"%s\", "
 730                       "got \"%s\"!", con->http.hostname, nonce);
 731       return;
 732     }
 733
 734    /*
 735     * Validate the username and password...
 736     */
 737
 738     if (!get_md5_password(username, NULL, md5))
 739     {
 740       cupsdLogMessage(CUPSD_LOG_ERROR,
 741                       "cupsdAuthorize: Unknown MD5 username \"%s\"!",
 742                       username);
 743       return;
 744     }
 745
 746     httpMD5Final(nonce, states[con->http.state], con->uri, md5);
 747
 748     if (strcmp(md5, password))
 749     {
 750       cupsdLogMessage(CUPSD_LOG_ERROR,
 751                       "cupsdAuthorize: Authentication failed for \"%s\"!",
 752                       username);
 753       return;
 754     }
 755   }
 756   else
 757   {
 758     cupsdLogMessage(CUPSD_LOG_DEBUG,
 759                     "cupsdAuthorize: Bad authentication data.");
 760     return;
 761   }
 762
 763  /*
 764   * If we get here, then we were able to validate the username and
 765   * password - copy the validated username and password to the client
 766   * data and return...
 767   */
 768
 769   strlcpy(con->username, username, sizeof(con->username));
 770   strlcpy(con->password, password, sizeof(con->password));
 771
 772   cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: username=\"%s\"",
 773                   con->username);
 774 }
 775
 776
 777 /*
 778  * 'cupsdCheckAuth()' - Check authorization masks.
 779  */
 780
 781 int                                     /* O - 1 if mask matches, 0 otherwise */
 782 cupsdCheckAuth(
 783     unsigned         ip[4],             /* I - Client address */
 784     char             *name,             /* I - Client hostname */
 785     int              name_len,          /* I - Length of hostname */
 786     int              num_masks,         /* I - Number of masks */
 787     cupsd_authmask_t *masks)            /* I - Masks */
 788 {
 789   int           i;                      /* Looping var */
 790   cupsd_netif_t *iface;                 /* Network interface */
 791   unsigned      netip4;                 /* IPv4 network address */
 792 #ifdef AF_INET6
 793   unsigned      netip6[4];              /* IPv6 network address */
 794 #endif /* AF_INET6 */
 795
 796   while (num_masks > 0)
 797   {
 798     switch (masks->type)
 799     {
 800       case AUTH_INTERFACE :
 801          /*
 802           * Check for a match with a network interface...
 803           */
 804
 805           netip4 = htonl(ip[3]);
 806
 807 #ifdef AF_INET6
 808           netip6[0] = htonl(ip[0]);
 809           netip6[1] = htonl(ip[1]);
 810           netip6[2] = htonl(ip[2]);
 811           netip6[3] = htonl(ip[3]);
 812 #endif /* AF_INET6 */
 813
 814           if (!strcmp(masks->mask.name.name, "*"))
 815           {
 816            /*
 817             * Check against all local interfaces...
 818             */
 819
 820             cupsdNetIFUpdate();
 821
 822             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 823                  iface;
 824                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 825             {
 826              /*
 827               * Only check local interfaces...
 828               */
 829
 830               if (!iface->is_local)
 831                 continue;
 832
 833               if (iface->address.addr.sa_family == AF_INET)
 834               {
 835                /*
 836                 * Check IPv4 address...
 837                 */
 838
 839                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 840                     (iface->address.ipv4.sin_addr.s_addr &
 841                      iface->mask.ipv4.sin_addr.s_addr))
 842                   return (1);
 843               }
 844 #ifdef AF_INET6
 845               else
 846               {
 847                /*
 848                 * Check IPv6 address...
 849                 */
 850
 851                 for (i = 0; i < 4; i ++)
 852                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 853                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 854                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 855                     break;
 856
 857                 if (i == 4)
 858                   return (1);
 859               }
 860 #endif /* AF_INET6 */
 861             }
 862           }
 863           else
 864           {
 865            /*
 866             * Check the named interface...
 867             */
 868
 869             for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
 870                  iface && !strcmp(masks->mask.name.name, iface->name);
 871                  iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
 872             {
 873               if (iface->address.addr.sa_family == AF_INET)
 874               {
 875                /*
 876                 * Check IPv4 address...
 877                 */
 878
 879                 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
 880                     (iface->address.ipv4.sin_addr.s_addr &
 881                      iface->mask.ipv4.sin_addr.s_addr))
 882                   return (1);
 883               }
 884 #ifdef AF_INET6
 885               else
 886               {
 887                /*
 888                 * Check IPv6 address...
 889                 */
 890
 891                 for (i = 0; i < 4; i ++)
 892                   if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
 893                       (iface->address.ipv6.sin6_addr.s6_addr32[i] &
 894                        iface->mask.ipv6.sin6_addr.s6_addr32[i]))
 895                     break;
 896
 897                 if (i == 4)
 898                   return (1);
 899               }
 900 #endif /* AF_INET6 */
 901             }
 902           }
 903           break;
 904
 905       case AUTH_NAME :
 906          /*
 907           * Check for exact name match...
 908           */
 909
 910           if (!strcasecmp(name, masks->mask.name.name))
 911             return (1);
 912
 913          /*
 914           * Check for domain match...
 915           */
 916
 917           if (name_len >= masks->mask.name.length &&
 918               masks->mask.name.name[0] == '.' &&
 919               !strcasecmp(name + name_len - masks->mask.name.length,
 920                           masks->mask.name.name))
 921             return (1);
 922           break;
 923
 924       case AUTH_IP :
 925          /*
 926           * Check for IP/network address match...
 927           */
 928
 929           for (i = 0; i < 4; i ++)
 930             if ((ip[i] & masks->mask.ip.netmask[i]) !=
 931                     masks->mask.ip.address[i])
 932               break;
 933
 934           if (i == 4)
 935             return (1);
 936           break;
 937     }
 938
 939     masks ++;
 940     num_masks --;
 941   }
 942
 943   return (0);
 944 }
 945
 946
 947 /*
 948  * 'cupsdCheckGroup()' - Check for a user's group membership.
 949  */
 950
 951 int                                     /* O - 1 if user is a member, 0 otherwise */
 952 cupsdCheckGroup(
 953     const char    *username,            /* I - User name */
 954     struct passwd *user,                /* I - System user info */
 955     const char    *groupname)           /* I - Group name */
 956 {
 957   int                   i;              /* Looping var */
 958   struct group          *group;         /* System group info */
 959   char                  junk[33];       /* MD5 password (not used) */
 960 #ifdef HAVE_MBR_UID_TO_UUID
 961   uuid_t                useruuid,       /* UUID for username */
 962                         groupuuid;      /* UUID for groupname */
 963   int                   is_member;      /* True if user is a member of group */
 964 #endif /* HAVE_MBR_UID_TO_UUID */
 965
 966
 967   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 968                   "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
 969                   username, user, groupname);
 970
 971  /*
 972   * Validate input...
 973   */
 974
 975   if (!username || !groupname)
 976     return (0);
 977
 978  /*
 979   * Check to see if the user is a member of the named group...
 980   */
 981
 982   group = getgrnam(groupname);
 983   endgrent();
 984
 985   if (group != NULL)
 986   {
 987    /*
 988     * Group exists, check it...
 989     */
 990
 991     for (i = 0; group->gr_mem[i]; i ++)
 992       if (!strcasecmp(username, group->gr_mem[i]))
 993         return (1);
 994   }
 995
 996  /*
 997   * Group doesn't exist or user not in group list, check the group ID
 998   * against the user's group ID...
 999   */
1000
1001   if (user && group && group->gr_gid == user->pw_gid)
1002     return (1);
1003
1004 #ifdef HAVE_MBR_UID_TO_UUID
1005  /*
1006   * Check group membership through MacOS X membership API...
1007   */
1008
1009   if (user && group)
1010     if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1011       if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1012         if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1013           if (is_member)
1014             return (1);
1015 #endif /* HAVE_MBR_UID_TO_UUID */
1016
1017  /*
1018   * Username not found, group not found, or user is not part of the
1019   * system group...  Check for a user and group in the MD5 password
1020   * file...
1021   */
1022
1023   if (get_md5_password(username, groupname, junk) != NULL)
1024     return (1);
1025
1026  /*
1027   * If we get this far, then the user isn't part of the named group...
1028   */
1029
1030   return (0);
1031 }
1032
1033
1034 /*
1035  * 'cupsdCopyLocation()' - Make a copy of a location...
1036  */
1037
1038 cupsd_location_t *                      /* O - New location */
1039 cupsdCopyLocation(
1040     cupsd_location_t **loc)             /* IO - Original location */
1041 {
1042   int                   i;              /* Looping var */
1043   cupsd_location_t      *temp;          /* New location */
1044   char                  location[HTTP_MAX_URI];
1045                                         /* Location of resource */
1046
1047
1048  /*
1049   * Use a local copy of location because cupsdAddLocation may cause
1050   * this memory to be moved...
1051   */
1052
1053   strlcpy(location, (*loc)->location, sizeof(location));
1054
1055   if ((temp = cupsdAddLocation(location)) == NULL)
1056     return (NULL);
1057
1058  /*
1059   * Copy the information from the original location to the new one.
1060   */
1061
1062   temp->limit      = (*loc)->limit;
1063   temp->order_type = (*loc)->order_type;
1064   temp->type       = (*loc)->type;
1065   temp->level      = (*loc)->level;
1066   temp->satisfy    = (*loc)->satisfy;
1067   temp->encryption = (*loc)->encryption;
1068
1069   if ((temp->num_names  = (*loc)->num_names) > 0)
1070   {
1071    /*
1072     * Copy the names array...
1073     */
1074
1075     if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1076     {
1077       cupsdLogMessage(CUPSD_LOG_ERROR,
1078                       "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1079                       temp->num_names, strerror(errno));
1080
1081       cupsdDeleteLocation(temp);
1082       return (NULL);
1083     }
1084
1085     for (i = 0; i < temp->num_names; i ++)
1086       if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1087       {
1088         cupsdLogMessage(CUPSD_LOG_ERROR,
1089                         "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1090                         (*loc)->names[i], strerror(errno));
1091
1092         cupsdDeleteLocation(temp);
1093         return (NULL);
1094       }
1095   }
1096
1097   if ((temp->num_allow  = (*loc)->num_allow) > 0)
1098   {
1099    /*
1100     * Copy allow rules...
1101     */
1102
1103     if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1104     {
1105       cupsdLogMessage(CUPSD_LOG_ERROR,
1106                       "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1107                       temp->num_allow, strerror(errno));
1108       cupsdDeleteLocation(temp);
1109       return (NULL);
1110     }
1111
1112     for (i = 0; i < temp->num_allow; i ++)
1113       switch (temp->allow[i].type = (*loc)->allow[i].type)
1114       {
1115         case AUTH_NAME :
1116             temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1117             temp->allow[i].mask.name.name   = strdup((*loc)->allow[i].mask.name.name);
1118
1119             if (temp->allow[i].mask.name.name == NULL)
1120             {
1121               cupsdLogMessage(CUPSD_LOG_ERROR,
1122                               "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1123                               (*loc)->allow[i].mask.name.name, strerror(errno));
1124               cupsdDeleteLocation(temp);
1125               return (NULL);
1126             }
1127             break;
1128         case AUTH_IP :
1129             memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1130                    sizeof(cupsd_ipmask_t));
1131             break;
1132       }
1133   }
1134
1135   if ((temp->num_deny  = (*loc)->num_deny) > 0)
1136   {
1137    /*
1138     * Copy deny rules...
1139     */
1140
1141     if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1142     {
1143       cupsdLogMessage(CUPSD_LOG_ERROR,
1144                       "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1145                       temp->num_deny, strerror(errno));
1146       cupsdDeleteLocation(temp);
1147       return (NULL);
1148     }
1149
1150     for (i = 0; i < temp->num_deny; i ++)
1151       switch (temp->deny[i].type = (*loc)->deny[i].type)
1152       {
1153         case AUTH_NAME :
1154             temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1155             temp->deny[i].mask.name.name   = strdup((*loc)->deny[i].mask.name.name);
1156
1157             if (temp->deny[i].mask.name.name == NULL)
1158             {
1159               cupsdLogMessage(CUPSD_LOG_ERROR,
1160                               "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1161                               (*loc)->deny[i].mask.name.name, strerror(errno));
1162               cupsdDeleteLocation(temp);
1163               return (NULL);
1164             }
1165             break;
1166         case AUTH_IP :
1167             memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1168                    sizeof(cupsd_ipmask_t));
1169             break;
1170       }
1171   }
1172
1173   return (temp);
1174 }
1175
1176
1177 /*
1178  * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1179  */
1180
1181 void
1182 cupsdDeleteAllLocations(void)
1183 {
1184   cupsd_location_t      *loc;           /* Current location */
1185
1186
1187  /*
1188   * Free all of the allow/deny records first...
1189   */
1190
1191   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1192        loc;
1193        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1194     cupsdDeleteLocation(loc);
1195
1196  /*
1197   * Then free the location array...
1198   */
1199
1200   cupsArrayDelete(Locations);
1201   Locations = NULL;
1202 }
1203
1204
1205 /*
1206  * 'cupsdDeleteLocation()' - Free all memory used by a location.
1207  */
1208
1209 void
1210 cupsdDeleteLocation(
1211     cupsd_location_t *loc)              /* I - Location to delete */
1212 {
1213   int                   i;              /* Looping var */
1214   cupsd_authmask_t      *mask;          /* Current mask */
1215
1216
1217   cupsArrayRemove(Locations, loc);
1218
1219   for (i = loc->num_names - 1; i >= 0; i --)
1220     free(loc->names[i]);
1221
1222   if (loc->num_names > 0)
1223     free(loc->names);
1224
1225   for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1226     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1227       free(mask->mask.name.name);
1228
1229   if (loc->num_allow > 0)
1230     free(loc->allow);
1231
1232   for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1233     if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1234       free(mask->mask.name.name);
1235
1236   if (loc->num_deny > 0)
1237     free(loc->deny);
1238
1239   free(loc->location);
1240   free(loc);
1241 }
1242
1243
1244 /*
1245  * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1246  *                     location.
1247  */
1248
1249 void
1250 cupsdDenyHost(cupsd_location_t *loc,    /* I - Location to add to */
1251               char             *name)   /* I - Name of host or domain to add */
1252 {
1253   cupsd_authmask_t      *temp;          /* New host/domain mask */
1254   char                  ifname[32],     /* Interface name */
1255                         *ifptr;         /* Pointer to end of name */
1256
1257
1258   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1259                   loc, loc->location ? loc->location : "nil", name);
1260
1261   if ((temp = add_deny(loc)) == NULL)
1262     return;
1263
1264   if (!strcasecmp(name, "@LOCAL"))
1265   {
1266    /*
1267     * Deny *interface*...
1268     */
1269
1270     temp->type             = AUTH_INTERFACE;
1271     temp->mask.name.name   = strdup("*");
1272     temp->mask.name.length = 1;
1273   }
1274   else if (!strncasecmp(name, "@IF(", 4))
1275   {
1276    /*
1277     * Deny *interface*...
1278     */
1279
1280     strlcpy(ifname, name + 4, sizeof(ifname));
1281
1282     ifptr = ifname + strlen(ifname);
1283
1284     if (ifptr[-1] == ')')
1285     {
1286       ifptr --;
1287       *ifptr = '\0';
1288     }
1289
1290     temp->type             = AUTH_INTERFACE;
1291     temp->mask.name.name   = strdup(ifname);
1292     temp->mask.name.length = ifptr - ifname;
1293   }
1294   else
1295   {
1296    /*
1297     * Deny name...
1298     */
1299
1300     temp->type             = AUTH_NAME;
1301     temp->mask.name.name   = strdup(name);
1302     temp->mask.name.length = strlen(name);
1303   }
1304 }
1305
1306
1307 /*
1308  * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1309  *                   access the location.
1310  */
1311
1312 void
1313 cupsdDenyIP(cupsd_location_t *loc,      /* I - Location to add to */
1314             unsigned         address[4],/* I - IP address to add */
1315             unsigned         netmask[4])/* I - Netmask of address */
1316 {
1317   cupsd_authmask_t      *temp;          /* New host/domain mask */
1318
1319
1320   cupsdLogMessage(CUPSD_LOG_DEBUG,
1321                   "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1322                   loc, loc->location ? loc->location : "nil",
1323                   address[0], address[1], address[2], address[3],
1324                   netmask[0], netmask[1], netmask[2], netmask[3]);
1325
1326   if ((temp = add_deny(loc)) == NULL)
1327     return;
1328
1329   temp->type = AUTH_IP;
1330   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1331   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1332 }
1333
1334
1335 /*
1336  * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1337  */
1338
1339 cupsd_location_t *                      /* O - Location that matches */
1340 cupsdFindBest(const char   *path,       /* I - Resource path */
1341               http_state_t state)       /* I - HTTP state/request */
1342 {
1343   char                  uri[HTTP_MAX_URI],
1344                                         /* URI in request... */
1345                         *uriptr;        /* Pointer into URI */
1346   cupsd_location_t      *loc,           /* Current location */
1347                         *best;          /* Best match for location so far */
1348   int                   bestlen;        /* Length of best match */
1349   int                   limit;          /* Limit field */
1350   static const int      limits[] =      /* Map http_status_t to AUTH_LIMIT_xyz */
1351                 {
1352                   AUTH_LIMIT_ALL,
1353                   AUTH_LIMIT_OPTIONS,
1354                   AUTH_LIMIT_GET,
1355                   AUTH_LIMIT_GET,
1356                   AUTH_LIMIT_HEAD,
1357                   AUTH_LIMIT_POST,
1358                   AUTH_LIMIT_POST,
1359                   AUTH_LIMIT_POST,
1360                   AUTH_LIMIT_PUT,
1361                   AUTH_LIMIT_PUT,
1362                   AUTH_LIMIT_DELETE,
1363                   AUTH_LIMIT_TRACE,
1364                   AUTH_LIMIT_ALL,
1365                   AUTH_LIMIT_ALL
1366                 };
1367
1368
1369  /*
1370   * First copy the connection URI to a local string so we have drop
1371   * any .ppd extension from the pathname in /printers or /classes
1372   * URIs...
1373   */
1374
1375   strlcpy(uri, path, sizeof(uri));
1376
1377   if (!strncmp(uri, "/printers/", 10) ||
1378       !strncmp(uri, "/classes/", 9))
1379   {
1380    /*
1381     * Check if the URI has .ppd on the end...
1382     */
1383
1384     uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1385
1386     if (!strcmp(uriptr, ".ppd"))
1387       *uriptr = '\0';
1388   }
1389
1390   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1391
1392  /*
1393   * Loop through the list of locations to find a match...
1394   */
1395
1396   limit   = limits[state];
1397   best    = NULL;
1398   bestlen = 0;
1399
1400   for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1401        loc;
1402        loc = (cupsd_location_t *)cupsArrayNext(Locations))
1403   {
1404     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1405                     loc->location ? loc->location : "nil", loc->limit);
1406
1407     if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1408     {
1409      /*
1410       * Use case-insensitive comparison for queue names...
1411       */
1412
1413       if (loc->length > bestlen && loc->location &&
1414           !strncasecmp(uri, loc->location, loc->length) &&
1415           loc->location[0] == '/' &&
1416           (limit & loc->limit) != 0)
1417       {
1418         best    = loc;
1419         bestlen = loc->length;
1420       }
1421     }
1422     else
1423     {
1424      /*
1425       * Use case-sensitive comparison for other URIs...
1426       */
1427
1428       if (loc->length > bestlen && loc->location &&
1429           !strncmp(uri, loc->location, loc->length) &&
1430           loc->location[0] == '/' &&
1431           (limit & loc->limit) != 0)
1432       {
1433         best    = loc;
1434         bestlen = loc->length;
1435       }
1436     }
1437   }
1438
1439  /*
1440   * Return the match, if any...
1441   */
1442
1443   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1444                   best ? best->location : "NONE");
1445
1446   return (best);
1447 }
1448
1449
1450 /*
1451  * 'cupsdFindLocation()' - Find the named location.
1452  */
1453
1454 cupsd_location_t *                      /* O - Location that matches */
1455 cupsdFindLocation(const char *location) /* I - Connection */
1456 {
1457   cupsd_location_t      key;            /* Search key */
1458
1459
1460   key.location = (char *)location;
1461
1462   return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1463 }
1464
1465
1466 /*
1467  * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1468  */
1469
1470 http_status_t                           /* O - HTTP_OK if authorized or error code */
1471 cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
1472                   const char     *owner)/* I - Owner of object */
1473 {
1474   int                   i, j,           /* Looping vars */
1475                         auth;           /* Authorization status */
1476   unsigned              address[4];     /* Authorization address */
1477   cupsd_location_t      *best;          /* Best match for location so far */
1478   int                   hostlen;        /* Length of hostname */
1479   const char            *username;      /* Username to authorize */
1480   struct passwd         *pw;            /* User password data */
1481   static const char * const levels[] =  /* Auth levels */
1482                 {
1483                   "ANON",
1484                   "USER",
1485                   "GROUP"
1486                 };
1487   static const char * const types[] =   /* Auth types */
1488                 {
1489                   "NONE",
1490                   "BASIC",
1491                   "DIGEST",
1492                   "BASICDIGEST"
1493                 };
1494
1495
1496   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1497                   "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1498                   con->uri, con->best, con->best ? con->best->location : "");
1499   if (owner)
1500     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1501                     "cupsdIsAuthorized: owner=\"%s\"", owner);
1502
1503  /*
1504   * If there is no "best" authentication rule for this request, then
1505   * access is allowed from the local system and denied from other
1506   * addresses...
1507   */
1508
1509   if (!con->best)
1510   {
1511     if (!strcmp(con->http.hostname, "localhost") ||
1512         !strcmp(con->http.hostname, ServerName))
1513       return (HTTP_OK);
1514     else
1515       return (HTTP_FORBIDDEN);
1516   }
1517
1518   best = con->best;
1519
1520   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1521                   "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, "
1522                   "satisfy=AUTH_SATISFY_%s, num_names=%d",
1523                   levels[best->level], types[best->type],
1524                   best->satisfy ? "ANY" : "ALL", best->num_names);
1525
1526   if (best->limit == AUTH_LIMIT_IPP)
1527     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1528                     best->op, ippOpString(best->op));
1529
1530  /*
1531   * Check host/ip-based accesses...
1532   */
1533
1534 #ifdef AF_INET6
1535   if (con->http.hostaddr->addr.sa_family == AF_INET6)
1536   {
1537    /*
1538     * Copy IPv6 address...
1539     */
1540
1541     address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1542     address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1543     address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1544     address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1545   }
1546   else
1547 #endif /* AF_INET6 */
1548   if (con->http.hostaddr->addr.sa_family == AF_INET)
1549   {
1550    /*
1551     * Copy IPv4 address...
1552     */
1553
1554     address[0] = 0;
1555     address[1] = 0;
1556     address[2] = 0;
1557     address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1558   }
1559   else
1560     memset(address, 0, sizeof(address));
1561
1562   hostlen = strlen(con->http.hostname);
1563
1564   if (!strcasecmp(con->http.hostname, "localhost"))
1565   {
1566    /*
1567     * Access from localhost (127.0.0.1 or ::1) is always allowed...
1568     */
1569
1570     auth = AUTH_ALLOW;
1571   }
1572   else
1573   {
1574    /*
1575     * Do authorization checks on the domain/address...
1576     */
1577
1578     switch (best->order_type)
1579     {
1580       default :
1581           auth = AUTH_DENY;     /* anti-compiler-warning-code */
1582           break;
1583
1584       case AUTH_ALLOW : /* Order Deny,Allow */
1585           auth = AUTH_ALLOW;
1586
1587           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1588                         best->num_deny, best->deny))
1589             auth = AUTH_DENY;
1590
1591           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1592                         best->num_allow, best->allow))
1593             auth = AUTH_ALLOW;
1594           break;
1595
1596       case AUTH_DENY : /* Order Allow,Deny */
1597           auth = AUTH_DENY;
1598
1599           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1600                         best->num_allow, best->allow))
1601             auth = AUTH_ALLOW;
1602
1603           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1604                         best->num_deny, best->deny))
1605             auth = AUTH_DENY;
1606           break;
1607     }
1608   }
1609
1610   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1611                   auth ? "DENY" : "ALLOW");
1612
1613   if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1614     return (HTTP_FORBIDDEN);
1615
1616 #ifdef HAVE_SSL
1617  /*
1618   * See if encryption is required...
1619   */
1620
1621   if (best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1622       best->satisfy == AUTH_SATISFY_ALL)
1623   {
1624     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1625                     "cupsdIsAuthorized: Need upgrade to TLS...");
1626     return (HTTP_UPGRADE_REQUIRED);
1627   }
1628 #endif /* HAVE_SSL */
1629
1630  /*
1631   * Now see what access level is required...
1632   */
1633
1634   if (best->level == AUTH_ANON ||       /* Anonymous access - allow it */
1635       (best->type == AUTH_NONE && best->num_names == 0))
1636     return (HTTP_OK);
1637
1638   if (!con->username[0] && best->type == AUTH_NONE &&
1639       best->limit == AUTH_LIMIT_IPP)
1640   {
1641    /*
1642     * Check for unauthenticated username...
1643     */
1644
1645     ipp_attribute_t     *attr;          /* requesting-user-name attribute */
1646
1647
1648     attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1649     if (attr)
1650     {
1651       cupsdLogMessage(CUPSD_LOG_DEBUG2,
1652                       "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1653                       attr->values[0].string.text);
1654       username = attr->values[0].string.text;
1655     }
1656     else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1657       return (HTTP_UNAUTHORIZED);       /* Non-anonymous needs user/pass */
1658     else
1659       return (HTTP_OK);                 /* unless overridden with Satisfy */
1660   }
1661   else
1662   {
1663     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: username=\"%s\"",
1664                     con->username);
1665
1666     if (!con->username[0])
1667     {
1668       if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1669         return (HTTP_UNAUTHORIZED);     /* Non-anonymous needs user/pass */
1670       else
1671         return (HTTP_OK);               /* unless overridden with Satisfy */
1672     }
1673
1674     username = con->username;
1675   }
1676
1677  /*
1678   * OK, got a username.  See if we need normal user access, or group
1679   * access... (root always matches)
1680   */
1681
1682   if (!strcmp(username, "root"))
1683     return (HTTP_OK);
1684
1685  /*
1686   * Get the user info...
1687   */
1688
1689   pw = getpwnam(username);
1690   endpwent();
1691
1692   if (best->level == AUTH_USER)
1693   {
1694    /*
1695     * If there are no names associated with this location, then
1696     * any valid user is OK...
1697     */
1698
1699     if (best->num_names == 0)
1700       return (HTTP_OK);
1701
1702    /*
1703     * Otherwise check the user list and return OK if this user is
1704     * allowed...
1705     */
1706
1707     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1708                     "cupsdIsAuthorized: Checking user membership...");
1709
1710     for (i = 0; i < best->num_names; i ++)
1711     {
1712       if (!strcasecmp(best->names[i], "@OWNER") && owner &&
1713           !strcasecmp(username, owner))
1714         return (HTTP_OK);
1715       else if (!strcasecmp(best->names[i], "@SYSTEM"))
1716       {
1717         for (j = 0; j < NumSystemGroups; j ++)
1718           if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1719             return (HTTP_OK);
1720       }
1721       else if (best->names[i][0] == '@')
1722       {
1723         if (cupsdCheckGroup(username, pw, best->names[i] + 1))
1724           return (HTTP_OK);
1725       }
1726       else if (!strcasecmp(username, best->names[i]))
1727         return (HTTP_OK);
1728     }
1729
1730     return (HTTP_UNAUTHORIZED);
1731   }
1732
1733  /*
1734   * Check to see if this user is in any of the named groups...
1735   */
1736
1737   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1738                   "cupsdIsAuthorized: Checking group membership...");
1739
1740  /*
1741   * Check to see if this user is in any of the named groups...
1742   */
1743
1744   for (i = 0; i < best->num_names; i ++)
1745   {
1746     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1747                     "cupsdIsAuthorized: Checking group \"%s\" membership...",
1748                     best->names[i]);
1749
1750     if (!strcasecmp(best->names[i], "@SYSTEM"))
1751     {
1752       for (j = 0; j < NumSystemGroups; j ++)
1753         if (cupsdCheckGroup(username, pw, SystemGroups[j]))
1754           return (HTTP_OK);
1755     }
1756     else if (cupsdCheckGroup(username, pw, best->names[i]))
1757       return (HTTP_OK);
1758   }
1759
1760  /*
1761   * The user isn't part of the specified group, so deny access...
1762   */
1763
1764   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1765                   "cupsdIsAuthorized: User not in group(s)!");
1766
1767   return (HTTP_UNAUTHORIZED);
1768 }
1769
1770
1771 /*
1772  * 'add_allow()' - Add an allow mask to the location.
1773  */
1774
1775 static cupsd_authmask_t *               /* O - New mask record */
1776 add_allow(cupsd_location_t *loc)        /* I - Location to add to */
1777 {
1778   cupsd_authmask_t      *temp;          /* New mask record */
1779
1780
1781  /*
1782   * Range-check...
1783   */
1784
1785   if (loc == NULL)
1786     return (NULL);
1787
1788  /*
1789   * Try to allocate memory for the record...
1790   */
1791
1792   if (loc->num_allow == 0)
1793     temp = malloc(sizeof(cupsd_authmask_t));
1794   else
1795     temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
1796
1797   if (temp == NULL)
1798     return (NULL);
1799
1800   loc->allow = temp;
1801   temp       += loc->num_allow;
1802   loc->num_allow ++;
1803
1804  /*
1805   * Clear the mask record and return...
1806   */
1807
1808   memset(temp, 0, sizeof(cupsd_authmask_t));
1809   return (temp);
1810 }
1811
1812
1813 /*
1814  * 'add_deny()' - Add a deny mask to the location.
1815  */
1816
1817 static cupsd_authmask_t *               /* O - New mask record */
1818 add_deny(cupsd_location_t *loc)         /* I - Location to add to */
1819 {
1820   cupsd_authmask_t      *temp;          /* New mask record */
1821
1822
1823  /*
1824   * Range-check...
1825   */
1826
1827   if (loc == NULL)
1828     return (NULL);
1829
1830  /*
1831   * Try to allocate memory for the record...
1832   */
1833
1834   if (loc->num_deny == 0)
1835     temp = malloc(sizeof(cupsd_authmask_t));
1836   else
1837     temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
1838
1839   if (temp == NULL)
1840     return (NULL);
1841
1842   loc->deny = temp;
1843   temp      += loc->num_deny;
1844   loc->num_deny ++;
1845
1846  /*
1847   * Clear the mask record and return...
1848   */
1849
1850   memset(temp, 0, sizeof(cupsd_authmask_t));
1851   return (temp);
1852 }
1853
1854
1855 /*
1856  * 'compare_locations()' - Compare two locations.
1857  */
1858
1859 static int                              /* O - Result of comparison */
1860 compare_locations(cupsd_location_t *a,  /* I - First location */
1861                   cupsd_location_t *b)  /* I - Second location */
1862 {
1863   return (strcmp(b->location, a->location));
1864 }
1865
1866
1867 #if !HAVE_LIBPAM
1868 /*
1869  * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1870  *                  as needed.
1871  */
1872
1873 static char *                           /* O - Encrypted password */
1874 cups_crypt(const char *pw,              /* I - Password string */
1875            const char *salt)            /* I - Salt (key) string */
1876 {
1877   if (!strncmp(salt, "$1$", 3))
1878   {
1879    /*
1880     * Use MD5 passwords without the benefit of PAM; this is for
1881     * Slackware Linux, and the algorithm was taken from the
1882     * old shadow-19990827/lib/md5crypt.c source code... :(
1883     */
1884
1885     int                 i;              /* Looping var */
1886     unsigned long       n;              /* Output number */
1887     int                 pwlen;          /* Length of password string */
1888     const char          *salt_end;      /* End of "salt" data for MD5 */
1889     char                *ptr;           /* Pointer into result string */
1890     _cups_md5_state_t   state;          /* Primary MD5 state info */
1891     _cups_md5_state_t   state2;         /* Secondary MD5 state info */
1892     unsigned char       digest[16];     /* MD5 digest result */
1893     static char         result[120];    /* Final password string */
1894
1895
1896    /*
1897     * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
1898     * Get a maximum of 8 characters of salt data after $1$...
1899     */
1900
1901     for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
1902       if (*salt_end == '$')
1903         break;
1904
1905    /*
1906     * Compute the MD5 sum we need...
1907     */
1908
1909     pwlen = strlen(pw);
1910
1911     _cupsMD5Init(&state);
1912     _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1913     _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
1914
1915     _cupsMD5Init(&state2);
1916     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
1917     _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
1918     _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
1919     _cupsMD5Finish(&state2, digest);
1920
1921     for (i = pwlen; i > 0; i -= 16)
1922       _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
1923
1924     for (i = pwlen; i > 0; i >>= 1)
1925       _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
1926
1927     _cupsMD5Finish(&state, digest);
1928
1929     for (i = 0; i < 1000; i ++)
1930     {
1931       _cupsMD5Init(&state);
1932
1933       if (i & 1)
1934         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1935       else
1936         _cupsMD5Append(&state, digest, 16);
1937
1938       if (i % 3)
1939         _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
1940
1941       if (i % 7)
1942         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1943
1944       if (i & 1)
1945         _cupsMD5Append(&state, digest, 16);
1946       else
1947         _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
1948
1949       _cupsMD5Finish(&state, digest);
1950     }
1951
1952    /*
1953     * Copy the final sum to the result string and return...
1954     */
1955
1956     memcpy(result, salt, salt_end - salt);
1957     ptr = result + (salt_end - salt);
1958     *ptr++ = '$';
1959
1960     for (i = 0; i < 5; i ++, ptr += 4)
1961     {
1962       n = (((digest[i] << 8) | digest[i + 6]) << 8);
1963
1964       if (i < 4)
1965         n |= digest[i + 12];
1966       else
1967         n |= digest[5];
1968
1969       to64(ptr, n, 4);
1970     }
1971
1972     to64(ptr, digest[11], 2);
1973     ptr += 2;
1974     *ptr = '\0';
1975
1976     return (result);
1977   }
1978   else
1979   {
1980    /*
1981     * Use the standard crypt() function...
1982     */
1983
1984     return (crypt(pw, salt));
1985   }
1986 }
1987 #endif /* !HAVE_LIBPAM */
1988
1989
1990 /*
1991  * 'get_md5_password()' - Get an MD5 password.
1992  */
1993
1994 static char *                           /* O - MD5 password string */
1995 get_md5_password(const char *username,  /* I - Username */
1996                  const char *group,     /* I - Group */
1997                  char       passwd[33]) /* O - MD5 password string */
1998 {
1999   cups_file_t   *fp;                    /* passwd.md5 file */
2000   char          filename[1024],         /* passwd.md5 filename */
2001                 line[256],              /* Line from file */
2002                 tempuser[33],           /* User from file */
2003                 tempgroup[33];          /* Group from file */
2004
2005
2006   cupsdLogMessage(CUPSD_LOG_DEBUG2,
2007                   "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2008                   username, group ? group : "(null)", passwd);
2009
2010   snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2011   if ((fp = cupsFileOpen(filename, "r")) == NULL)
2012   {
2013     if (errno != ENOENT)
2014       cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2015                       strerror(errno));
2016
2017     return (NULL);
2018   }
2019
2020   while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2021   {
2022     if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2023     {
2024       cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2025       continue;
2026     }
2027
2028     if (!strcmp(username, tempuser) &&
2029         (group == NULL || !strcmp(group, tempgroup)))
2030     {
2031      /*
2032       * Found the password entry!
2033       */
2034
2035       cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2036                       username, tempgroup);
2037
2038       cupsFileClose(fp);
2039       return (passwd);
2040     }
2041   }
2042
2043  /*
2044   * Didn't find a password entry - return NULL!
2045   */
2046
2047   cupsFileClose(fp);
2048   return (NULL);
2049 }
2050
2051
2052 #if HAVE_LIBPAM
2053 /*
2054  * 'pam_func()' - PAM conversation function.
2055  */
2056
2057 static int                              /* O - Success or failure */
2058 pam_func(
2059     int                      num_msg,   /* I - Number of messages */
2060     const struct pam_message **msg,     /* I - Messages */
2061     struct pam_response      **resp,    /* O - Responses */
2062     void                     *appdata_ptr)
2063                                         /* I - Pointer to connection */
2064 {
2065   int                   i;              /* Looping var */
2066   struct pam_response   *replies;       /* Replies */
2067   cupsd_authdata_t      *data;          /* Pointer to auth data */
2068
2069
2070  /*
2071   * Allocate memory for the responses...
2072   */
2073
2074   if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2075     return (PAM_CONV_ERR);
2076
2077  /*
2078   * Answer all of the messages...
2079   */
2080
2081   DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2082
2083 #ifdef __hpux
2084  /*
2085   * Apparently some versions of HP-UX 11 have a broken pam_unix security
2086   * module.  This is a workaround...
2087   */
2088
2089   data = auth_data;
2090   (void)appdata_ptr;
2091 #else
2092   data = (cupsd_authdata_t *)appdata_ptr;
2093 #endif /* __hpux */
2094
2095   for (i = 0; i < num_msg; i ++)
2096   {
2097     DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2098
2099     switch (msg[i]->msg_style)
2100     {
2101       case PAM_PROMPT_ECHO_ON:
2102           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2103                         data->username));
2104           replies[i].resp_retcode = PAM_SUCCESS;
2105           replies[i].resp         = strdup(data->username);
2106           break;
2107
2108       case PAM_PROMPT_ECHO_OFF:
2109           DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2110                         data->password));
2111           replies[i].resp_retcode = PAM_SUCCESS;
2112           replies[i].resp         = strdup(data->password);
2113           break;
2114
2115       case PAM_TEXT_INFO:
2116           DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2117           replies[i].resp_retcode = PAM_SUCCESS;
2118           replies[i].resp         = NULL;
2119           break;
2120
2121       case PAM_ERROR_MSG:
2122           DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2123           replies[i].resp_retcode = PAM_SUCCESS;
2124           replies[i].resp         = NULL;
2125           break;
2126
2127       default:
2128           DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2129                         msg[i]->msg_style));
2130           free(replies);
2131           return (PAM_CONV_ERR);
2132     }
2133   }
2134
2135  /*
2136   * Return the responses back to PAM...
2137   */
2138
2139   *resp = replies;
2140
2141   return (PAM_SUCCESS);
2142 }
2143 #else
2144
2145
2146 /*
2147  * 'to64()' - Base64-encode an integer value...
2148  */
2149
2150 static void
2151 to64(char          *s,                  /* O - Output string */
2152      unsigned long v,                   /* I - Value to encode */
2153      int           n)                   /* I - Number of digits */
2154 {
2155   const char    *itoa64 = "./0123456789"
2156                           "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2157                           "abcdefghijklmnopqrstuvwxyz";
2158
2159
2160   for (; n > 0; n --, v >>= 6)
2161     *s++ = itoa64[v & 0x3f];
2162 }
2163 #endif /* HAVE_LIBPAM */
2164
2165
2166 /*
2167  * End of "$Id: auth.c 5305 2006-03-18 03:05:12Z mike $".
2168  */