]>
git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
2 * "$Id: auth.c 5948 2006-09-12 13:58:39Z mike $"
4 * Authorization routines for the Common UNIX Printing System (CUPS).
6 * Copyright 1997-2006 by Easy Software Products, all rights reserved.
8 * These coded instructions, statements, and computer programs are the
9 * property of Easy Software Products and are protected by Federal
10 * copyright law. Distribution and use rights are outlined in the file
11 * "LICENSE.txt" which should have been included with this file. If this
12 * file is missing or damaged please contact Easy Software Products
15 * Attn: CUPS Licensing Information
16 * Easy Software Products
17 * 44141 Airport View Drive, Suite 204
18 * Hollywood, Maryland 20636 USA
20 * Voice: (301) 373-9600
21 * EMail: cups-info@cups.org
22 * WWW: http://www.cups.org
26 * cupsdAddLocation() - Add a location for authorization.
27 * cupsdAddName() - Add a name to a location...
28 * cupsdAllowHost() - Add a host name that is allowed to access the
30 * cupsdAllowIP() - Add an IP address or network that is allowed
31 * to access the location.
32 * cupsdAuthorize() - Validate any authorization credentials.
33 * cupsdCheckAuth() - Check authorization masks.
34 * cupsdCheckGroup() - Check for a user's group membership.
35 * cupsdCopyLocation() - Make a copy of a location...
36 * cupsdDeleteAllLocations() - Free all memory used for location
38 * cupsdDeleteLocation() - Free all memory used by a location.
39 * cupsdDenyHost() - Add a host name that is not allowed to access
41 * cupsdDenyIP() - Add an IP address or network that is not
42 * allowed to access the location.
43 * cupsdFindBest() - Find the location entry that best matches the
45 * cupsdFindLocation() - Find the named location.
46 * cupsdIsAuthorized() - Check to see if the user is authorized...
47 * add_allow() - Add an allow mask to the location.
48 * add_deny() - Add a deny mask to the location.
49 * compare_locations() - Compare two locations.
50 * cups_crypt() - Encrypt the password using the DES or MD5
51 * algorithms, as needed.
52 * get_md5_password() - Get an MD5 password.
53 * pam_func() - PAM conversation function.
54 * to64() - Base64-encode an integer value...
58 * Include necessary headers...
65 #endif /* HAVE_SHADOW_H */
68 #endif /* HAVE_CRYPT_H */
70 # ifdef HAVE_PAM_PAM_APPL_H
71 # include <pam/pam_appl.h>
73 # include <security/pam_appl.h>
74 # endif /* HAVE_PAM_PAM_APPL_H */
75 #endif /* HAVE_LIBPAM */
78 #endif /* HAVE_USERSEC_H */
79 #ifdef HAVE_MEMBERSHIP_H
80 # include <membership.h>
81 #endif /* HAVE_MEMBERSHIP_H */
88 static cupsd_authmask_t
*add_allow(cupsd_location_t
*loc
);
89 static cupsd_authmask_t
*add_deny(cupsd_location_t
*loc
);
90 static int compare_locations(cupsd_location_t
*a
,
92 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
93 static char *cups_crypt(const char *pw
, const char *salt
);
94 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
95 static char *get_md5_password(const char *username
,
96 const char *group
, char passwd
[33]);
98 static int pam_func(int, const struct pam_message
**,
99 struct pam_response
**, void *);
101 static void to64(char *s
, unsigned long v
, int n
);
102 #endif /* HAVE_LIBPAM */
106 * Local structures...
110 typedef struct cupsd_authdata_s
/**** Authentication data ****/
112 char username
[33], /* Username string */
113 password
[33]; /* Password string */
115 #endif /* HAVE_LIBPAM */
122 #if defined(__hpux) && HAVE_LIBPAM
123 static cupsd_authdata_t
*auth_data
; /* Current client being authenticated */
124 #endif /* __hpux && HAVE_LIBPAM */
128 * 'cupsdAddLocation()' - Add a location for authorization.
131 cupsd_location_t
* /* O - Pointer to new location record */
132 cupsdAddLocation(const char *location
) /* I - Location path */
134 cupsd_location_t
*temp
; /* New location */
138 * Make sure the locations array is created...
142 Locations
= cupsArrayNew((cups_array_func_t
)compare_locations
, NULL
);
148 * Try to allocate memory for the new location.
151 if ((temp
= calloc(1, sizeof(cupsd_location_t
))) == NULL
)
155 * Initialize the record and copy the name over...
158 temp
->location
= strdup(location
);
159 temp
->length
= strlen(temp
->location
);
161 cupsArrayAdd(Locations
, temp
);
163 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddLocation: added location \'%s\'",
167 * Return the new record...
175 * 'cupsdAddName()' - Add a name to a location...
179 cupsdAddName(cupsd_location_t
*loc
, /* I - Location to add to */
180 char *name
) /* I - Name to add */
182 char **temp
; /* Pointer to names array */
185 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAddName(loc=%p, name=\"%s\")",
188 if (loc
->num_names
== 0)
189 temp
= malloc(sizeof(char *));
191 temp
= realloc(loc
->names
, (loc
->num_names
+ 1) * sizeof(char *));
195 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to add name to location %s: %s",
196 loc
->location
? loc
->location
: "nil", strerror(errno
));
202 if ((temp
[loc
->num_names
] = strdup(name
)) == NULL
)
204 cupsdLogMessage(CUPSD_LOG_ERROR
,
205 "Unable to duplicate name for location %s: %s",
206 loc
->location
? loc
->location
: "nil", strerror(errno
));
215 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
219 cupsdAllowHost(cupsd_location_t
*loc
, /* I - Location to add to */
220 char *name
) /* I - Name of host or domain to add */
222 cupsd_authmask_t
*temp
; /* New host/domain mask */
223 char ifname
[32], /* Interface name */
224 *ifptr
; /* Pointer to end of name */
227 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
228 loc
, loc
->location
? loc
->location
: "nil", name
);
230 if ((temp
= add_allow(loc
)) == NULL
)
233 if (!strcasecmp(name
, "@LOCAL"))
236 * Allow *interface*...
239 temp
->type
= AUTH_INTERFACE
;
240 temp
->mask
.name
.name
= strdup("*");
241 temp
->mask
.name
.length
= 1;
243 else if (!strncasecmp(name
, "@IF(", 4))
246 * Allow *interface*...
249 strlcpy(ifname
, name
+ 4, sizeof(ifname
));
251 ifptr
= ifname
+ strlen(ifname
);
253 if (ifptr
[-1] == ')')
259 temp
->type
= AUTH_INTERFACE
;
260 temp
->mask
.name
.name
= strdup(ifname
);
261 temp
->mask
.name
.length
= ifptr
- ifname
;
269 temp
->type
= AUTH_NAME
;
270 temp
->mask
.name
.name
= strdup(name
);
271 temp
->mask
.name
.length
= strlen(name
);
277 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
282 cupsdAllowIP(cupsd_location_t
*loc
, /* I - Location to add to */
283 unsigned address
[4], /* I - IP address to add */
284 unsigned netmask
[4]) /* I - Netmask of address */
286 cupsd_authmask_t
*temp
; /* New host/domain mask */
289 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
290 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
291 loc
, loc
->location
? loc
->location
: "nil",
292 address
[0], address
[1], address
[2], address
[3],
293 netmask
[0], netmask
[1], netmask
[2], netmask
[3]);
295 if ((temp
= add_allow(loc
)) == NULL
)
298 temp
->type
= AUTH_IP
;
299 memcpy(temp
->mask
.ip
.address
, address
, sizeof(temp
->mask
.ip
.address
));
300 memcpy(temp
->mask
.ip
.netmask
, netmask
, sizeof(temp
->mask
.ip
.netmask
));
305 * 'cupsdAuthorize()' - Validate any authorization credentials.
309 cupsdAuthorize(cupsd_client_t
*con
) /* I - Client connection */
311 int type
; /* Authentication type */
312 char *authorization
, /* Pointer into Authorization string */
313 *ptr
, /* Pointer into string */
314 username
[65], /* Username string */
315 password
[33]; /* Password string */
316 const char *localuser
; /* Certificate username */
317 char nonce
[HTTP_MAX_VALUE
], /* Nonce value from client */
318 md5
[33], /* MD5 password */
319 basicmd5
[33]; /* MD5 of Basic password */
320 static const char * const states
[] = /* HTTP client states... */
340 * Locate the best matching location so we know what kind of
341 * authentication to expect...
344 con
->best
= cupsdFindBest(con
->uri
, con
->http
.state
);
346 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
347 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
348 con
->uri
, con
->best
, con
->best
? con
->best
->location
: "");
350 if (con
->best
&& con
->best
->type
!= AUTH_NONE
)
351 type
= con
->best
->type
;
353 type
= DefaultAuthType
;
356 * Decode the Authorization string...
359 authorization
= con
->http
.fields
[HTTP_FIELD_AUTHORIZATION
];
361 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdAuthorize: Authorization=\"%s\"",
367 if (type
== AUTH_NONE
)
370 * No authorization required, return early...
373 cupsdLogMessage(CUPSD_LOG_DEBUG
,
374 "cupsdAuthorize: No authentication required.");
377 else if (!*authorization
)
380 * No authorization data provided, return early...
383 cupsdLogMessage(CUPSD_LOG_DEBUG
,
384 "cupsdAuthorize: No authentication data provided.");
387 else if (!strncmp(authorization
, "Local", 5) &&
388 !strcasecmp(con
->http
.hostname
, "localhost"))
391 * Get Local certificate authentication data...
395 while (isspace(*authorization
& 255))
398 if ((localuser
= cupsdFindCert(authorization
)) != NULL
)
399 strlcpy(username
, localuser
, sizeof(username
));
402 cupsdLogMessage(CUPSD_LOG_ERROR
,
403 "cupsdAuthorize: Local authentication certificate not "
408 else if (!strncmp(authorization
, "Basic", 5) &&
409 (type
== AUTH_BASIC
|| type
== AUTH_BASICDIGEST
))
412 * Get the Basic authentication data...
415 int userlen
; /* Username:password length */
419 while (isspace(*authorization
& 255))
422 userlen
= sizeof(username
);
423 httpDecode64_2(username
, &userlen
, authorization
);
426 * Pull the username and password out...
429 if ((ptr
= strchr(username
, ':')) == NULL
)
431 cupsdLogMessage(CUPSD_LOG_ERROR
,
432 "cupsdAuthorize: Missing Basic password!");
441 * Username must not be empty...
444 cupsdLogMessage(CUPSD_LOG_ERROR
,
445 "cupsdAuthorize: Empty Basic username!");
452 * Password must not be empty...
455 cupsdLogMessage(CUPSD_LOG_ERROR
,
456 "cupsdAuthorize: Empty Basic password!");
460 strlcpy(password
, ptr
, sizeof(password
));
463 * Validate the username and password...
472 * Only use PAM to do authentication. This supports MD5
473 * passwords, among other things...
476 pam_handle_t
*pamh
; /* PAM authentication handle */
477 int pamerr
; /* PAM error code */
478 struct pam_conv pamdata
;/* PAM conversation data */
479 cupsd_authdata_t data
; /* Authentication data */
482 strlcpy(data
.username
, username
, sizeof(data
.username
));
483 strlcpy(data
.password
, password
, sizeof(data
.password
));
485 # if defined(__sun) || defined(__hpux)
486 pamdata
.conv
= (int (*)(int, struct pam_message
**,
487 struct pam_response
**,
490 pamdata
.conv
= pam_func
;
491 # endif /* __sun || __hpux */
492 pamdata
.appdata_ptr
= &data
;
496 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
503 pamerr
= pam_start("cups", username
, &pamdata
, &pamh
);
504 if (pamerr
!= PAM_SUCCESS
)
506 cupsdLogMessage(CUPSD_LOG_ERROR
,
507 "cupsdAuthorize: pam_start() returned %d (%s)!\n",
508 pamerr
, pam_strerror(pamh
, pamerr
));
513 pamerr
= pam_authenticate(pamh
, PAM_SILENT
);
514 if (pamerr
!= PAM_SUCCESS
)
516 cupsdLogMessage(CUPSD_LOG_ERROR
,
517 "cupsdAuthorize: pam_authenticate() returned %d "
519 pamerr
, pam_strerror(pamh
, pamerr
));
524 pamerr
= pam_acct_mgmt(pamh
, PAM_SILENT
);
525 if (pamerr
!= PAM_SUCCESS
)
527 cupsdLogMessage(CUPSD_LOG_ERROR
,
528 "cupsdAuthorize: pam_acct_mgmt() returned %d "
530 pamerr
, pam_strerror(pamh
, pamerr
));
535 pam_end(pamh
, PAM_SUCCESS
);
537 #elif defined(HAVE_USERSEC_H)
539 * Use AIX authentication interface...
542 char *authmsg
; /* Authentication message */
543 int reenter
; /* ??? */
546 cupsdLogMessage(CUPSD_LOG_DEBUG
,
547 "cupsdAuthorize: AIX authenticate of username \"%s\"",
551 if (authenticate(username
, password
, &reenter
, &authmsg
) != 0)
553 cupsdLogMessage(CUPSD_LOG_DEBUG
,
554 "cupsdAuthorize: Unable to authenticate username "
556 username
, strerror(errno
));
562 * Use normal UNIX password file-based authentication...
565 char *pass
; /* Encrypted password */
566 struct passwd
*pw
; /* User password data */
567 # ifdef HAVE_SHADOW_H
568 struct spwd
*spw
; /* Shadow password data */
569 # endif /* HAVE_SHADOW_H */
572 pw
= getpwnam(username
); /* Get the current password */
573 endpwent(); /* Close the password file */
581 cupsdLogMessage(CUPSD_LOG_ERROR
,
582 "cupsdAuthorize: Unknown username \"%s\"!",
587 # ifdef HAVE_SHADOW_H
588 spw
= getspnam(username
);
591 if (!spw
&& !strcmp(pw
->pw_passwd
, "x"))
594 * Don't allow blank passwords!
597 cupsdLogMessage(CUPSD_LOG_ERROR
,
598 "cupsdAuthorize: Username \"%s\" has no shadow "
599 "password!", username
);
603 if (spw
&& !spw
->sp_pwdp
[0] && !pw
->pw_passwd
[0])
605 if (!pw
->pw_passwd
[0])
606 # endif /* HAVE_SHADOW_H */
609 * Don't allow blank passwords!
612 cupsdLogMessage(CUPSD_LOG_ERROR
,
613 "cupsdAuthorize: Username \"%s\" has no password!",
619 * OK, the password isn't blank, so compare with what came from the
623 pass
= cups_crypt(password
, pw
->pw_passwd
);
625 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
626 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
627 pw
->pw_passwd
, pass
);
629 if (!pass
|| strcmp(pw
->pw_passwd
, pass
))
631 # ifdef HAVE_SHADOW_H
634 pass
= cups_crypt(password
, spw
->sp_pwdp
);
636 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
637 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
640 if (pass
== NULL
|| strcmp(spw
->sp_pwdp
, pass
))
642 cupsdLogMessage(CUPSD_LOG_ERROR
,
643 "cupsdAuthorize: Authentication failed for "
650 # endif /* HAVE_SHADOW_H */
652 cupsdLogMessage(CUPSD_LOG_ERROR
,
653 "cupsdAuthorize: Authentication failed for "
659 #endif /* HAVE_LIBPAM */
663 case AUTH_BASICDIGEST
:
665 * Do Basic authentication with the Digest password file...
668 if (!get_md5_password(username
, NULL
, md5
))
670 cupsdLogMessage(CUPSD_LOG_ERROR
,
671 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
676 httpMD5(username
, "CUPS", password
, basicmd5
);
678 if (strcmp(md5
, basicmd5
))
680 cupsdLogMessage(CUPSD_LOG_ERROR
,
681 "cupsdAuthorize: Authentication failed for \"%s\"!",
688 else if (!strncmp(authorization
, "Digest", 6) && type
== AUTH_DIGEST
)
691 * Get the username, password, and nonce from the Digest attributes...
694 if (!httpGetSubField2(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "username",
695 username
, sizeof(username
)) || !username
[0])
698 * Username must not be empty...
701 cupsdLogMessage(CUPSD_LOG_ERROR
,
702 "cupsdAuthorize: Empty or missing Digest username!");
706 if (!httpGetSubField2(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "response",
707 password
, sizeof(password
)) || !password
[0])
710 * Password must not be empty...
713 cupsdLogMessage(CUPSD_LOG_ERROR
,
714 "cupsdAuthorize: Empty or missing Digest password!");
718 if (!httpGetSubField(&(con
->http
), HTTP_FIELD_AUTHORIZATION
, "nonce",
721 cupsdLogMessage(CUPSD_LOG_ERROR
,
722 "cupsdAuthorize: No nonce value for Digest "
727 if (strcmp(con
->http
.hostname
, nonce
))
729 cupsdLogMessage(CUPSD_LOG_ERROR
,
730 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
731 "got \"%s\"!", con
->http
.hostname
, nonce
);
736 * Validate the username and password...
739 if (!get_md5_password(username
, NULL
, md5
))
741 cupsdLogMessage(CUPSD_LOG_ERROR
,
742 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
747 httpMD5Final(nonce
, states
[con
->http
.state
], con
->uri
, md5
);
749 if (strcmp(md5
, password
))
751 cupsdLogMessage(CUPSD_LOG_ERROR
,
752 "cupsdAuthorize: Authentication failed for \"%s\"!",
759 cupsdLogMessage(CUPSD_LOG_DEBUG
,
760 "cupsdAuthorize: Bad authentication data.");
765 * If we get here, then we were able to validate the username and
766 * password - copy the validated username and password to the client
770 strlcpy(con
->username
, username
, sizeof(con
->username
));
771 strlcpy(con
->password
, password
, sizeof(con
->password
));
773 cupsdLogMessage(CUPSD_LOG_DEBUG
, "cupsdAuthorize: username=\"%s\"",
779 * 'cupsdCheckAuth()' - Check authorization masks.
782 int /* O - 1 if mask matches, 0 otherwise */
784 unsigned ip
[4], /* I - Client address */
785 char *name
, /* I - Client hostname */
786 int name_len
, /* I - Length of hostname */
787 int num_masks
, /* I - Number of masks */
788 cupsd_authmask_t
*masks
) /* I - Masks */
790 int i
; /* Looping var */
791 cupsd_netif_t
*iface
; /* Network interface */
792 unsigned netip4
; /* IPv4 network address */
794 unsigned netip6
[4]; /* IPv6 network address */
795 #endif /* AF_INET6 */
797 while (num_masks
> 0)
801 case AUTH_INTERFACE
:
803 * Check for a match with a network interface...
806 netip4
= htonl(ip
[3]);
809 netip6
[0] = htonl(ip
[0]);
810 netip6
[1] = htonl(ip
[1]);
811 netip6
[2] = htonl(ip
[2]);
812 netip6
[3] = htonl(ip
[3]);
813 #endif /* AF_INET6 */
815 if (!strcmp(masks
->mask
.name
.name
, "*"))
818 * Check against all local interfaces...
823 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
825 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
828 * Only check local interfaces...
831 if (!iface
->is_local
)
834 if (iface
->address
.addr
.sa_family
== AF_INET
)
837 * Check IPv4 address...
840 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
841 (iface
->address
.ipv4
.sin_addr
.s_addr
&
842 iface
->mask
.ipv4
.sin_addr
.s_addr
))
849 * Check IPv6 address...
852 for (i
= 0; i
< 4; i
++)
853 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
854 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
855 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
861 #endif /* AF_INET6 */
867 * Check the named interface...
870 for (iface
= (cupsd_netif_t
*)cupsArrayFirst(NetIFList
);
872 iface
= (cupsd_netif_t
*)cupsArrayNext(NetIFList
))
874 if (strcmp(masks
->mask
.name
.name
, iface
->name
))
877 if (iface
->address
.addr
.sa_family
== AF_INET
)
880 * Check IPv4 address...
883 if ((netip4
& iface
->mask
.ipv4
.sin_addr
.s_addr
) ==
884 (iface
->address
.ipv4
.sin_addr
.s_addr
&
885 iface
->mask
.ipv4
.sin_addr
.s_addr
))
892 * Check IPv6 address...
895 for (i
= 0; i
< 4; i
++)
896 if ((netip6
[i
] & iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]) !=
897 (iface
->address
.ipv6
.sin6_addr
.s6_addr32
[i
] &
898 iface
->mask
.ipv6
.sin6_addr
.s6_addr32
[i
]))
904 #endif /* AF_INET6 */
911 * Check for exact name match...
914 if (!strcasecmp(name
, masks
->mask
.name
.name
))
918 * Check for domain match...
921 if (name_len
>= masks
->mask
.name
.length
&&
922 masks
->mask
.name
.name
[0] == '.' &&
923 !strcasecmp(name
+ name_len
- masks
->mask
.name
.length
,
924 masks
->mask
.name
.name
))
930 * Check for IP/network address match...
933 for (i
= 0; i
< 4; i
++)
934 if ((ip
[i
] & masks
->mask
.ip
.netmask
[i
]) !=
935 masks
->mask
.ip
.address
[i
])
952 * 'cupsdCheckGroup()' - Check for a user's group membership.
955 int /* O - 1 if user is a member, 0 otherwise */
957 const char *username
, /* I - User name */
958 struct passwd
*user
, /* I - System user info */
959 const char *groupname
) /* I - Group name */
961 int i
; /* Looping var */
962 struct group
*group
; /* System group info */
963 char junk
[33]; /* MD5 password (not used) */
964 #ifdef HAVE_MBR_UID_TO_UUID
965 uuid_t useruuid
, /* UUID for username */
966 groupuuid
; /* UUID for groupname */
967 int is_member
; /* True if user is a member of group */
968 #endif /* HAVE_MBR_UID_TO_UUID */
971 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
972 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
973 username
, user
, groupname
);
979 if (!username
|| !groupname
)
983 * Check to see if the user is a member of the named group...
986 group
= getgrnam(groupname
);
992 * Group exists, check it...
995 for (i
= 0; group
->gr_mem
[i
]; i
++)
996 if (!strcasecmp(username
, group
->gr_mem
[i
]))
1001 * Group doesn't exist or user not in group list, check the group ID
1002 * against the user's group ID...
1005 if (user
&& group
&& group
->gr_gid
== user
->pw_gid
)
1008 #ifdef HAVE_MBR_UID_TO_UUID
1010 * Check group membership through MacOS X membership API...
1014 if (!mbr_uid_to_uuid(user
->pw_uid
, useruuid
))
1015 if (!mbr_gid_to_uuid(group
->gr_gid
, groupuuid
))
1016 if (!mbr_check_membership(useruuid
, groupuuid
, &is_member
))
1019 #endif /* HAVE_MBR_UID_TO_UUID */
1022 * Username not found, group not found, or user is not part of the
1023 * system group... Check for a user and group in the MD5 password
1027 if (get_md5_password(username
, groupname
, junk
) != NULL
)
1031 * If we get this far, then the user isn't part of the named group...
1039 * 'cupsdCopyLocation()' - Make a copy of a location...
1042 cupsd_location_t
* /* O - New location */
1044 cupsd_location_t
**loc
) /* IO - Original location */
1046 int i
; /* Looping var */
1047 cupsd_location_t
*temp
; /* New location */
1048 char location
[HTTP_MAX_URI
];
1049 /* Location of resource */
1053 * Use a local copy of location because cupsdAddLocation may cause
1054 * this memory to be moved...
1057 strlcpy(location
, (*loc
)->location
, sizeof(location
));
1059 if ((temp
= cupsdAddLocation(location
)) == NULL
)
1063 * Copy the information from the original location to the new one.
1066 temp
->limit
= (*loc
)->limit
;
1067 temp
->order_type
= (*loc
)->order_type
;
1068 temp
->type
= (*loc
)->type
;
1069 temp
->level
= (*loc
)->level
;
1070 temp
->satisfy
= (*loc
)->satisfy
;
1071 temp
->encryption
= (*loc
)->encryption
;
1073 if ((temp
->num_names
= (*loc
)->num_names
) > 0)
1076 * Copy the names array...
1079 if ((temp
->names
= calloc(temp
->num_names
, sizeof(char *))) == NULL
)
1081 cupsdLogMessage(CUPSD_LOG_ERROR
,
1082 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1083 temp
->num_names
, strerror(errno
));
1085 cupsdDeleteLocation(temp
);
1089 for (i
= 0; i
< temp
->num_names
; i
++)
1090 if ((temp
->names
[i
] = strdup((*loc
)->names
[i
])) == NULL
)
1092 cupsdLogMessage(CUPSD_LOG_ERROR
,
1093 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1094 (*loc
)->names
[i
], strerror(errno
));
1096 cupsdDeleteLocation(temp
);
1101 if ((temp
->num_allow
= (*loc
)->num_allow
) > 0)
1104 * Copy allow rules...
1107 if ((temp
->allow
= calloc(temp
->num_allow
, sizeof(cupsd_authmask_t
))) == NULL
)
1109 cupsdLogMessage(CUPSD_LOG_ERROR
,
1110 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1111 temp
->num_allow
, strerror(errno
));
1112 cupsdDeleteLocation(temp
);
1116 for (i
= 0; i
< temp
->num_allow
; i
++)
1117 switch (temp
->allow
[i
].type
= (*loc
)->allow
[i
].type
)
1120 temp
->allow
[i
].mask
.name
.length
= (*loc
)->allow
[i
].mask
.name
.length
;
1121 temp
->allow
[i
].mask
.name
.name
= strdup((*loc
)->allow
[i
].mask
.name
.name
);
1123 if (temp
->allow
[i
].mask
.name
.name
== NULL
)
1125 cupsdLogMessage(CUPSD_LOG_ERROR
,
1126 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1127 (*loc
)->allow
[i
].mask
.name
.name
, strerror(errno
));
1128 cupsdDeleteLocation(temp
);
1133 memcpy(&(temp
->allow
[i
].mask
.ip
), &((*loc
)->allow
[i
].mask
.ip
),
1134 sizeof(cupsd_ipmask_t
));
1139 if ((temp
->num_deny
= (*loc
)->num_deny
) > 0)
1142 * Copy deny rules...
1145 if ((temp
->deny
= calloc(temp
->num_deny
, sizeof(cupsd_authmask_t
))) == NULL
)
1147 cupsdLogMessage(CUPSD_LOG_ERROR
,
1148 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1149 temp
->num_deny
, strerror(errno
));
1150 cupsdDeleteLocation(temp
);
1154 for (i
= 0; i
< temp
->num_deny
; i
++)
1155 switch (temp
->deny
[i
].type
= (*loc
)->deny
[i
].type
)
1158 temp
->deny
[i
].mask
.name
.length
= (*loc
)->deny
[i
].mask
.name
.length
;
1159 temp
->deny
[i
].mask
.name
.name
= strdup((*loc
)->deny
[i
].mask
.name
.name
);
1161 if (temp
->deny
[i
].mask
.name
.name
== NULL
)
1163 cupsdLogMessage(CUPSD_LOG_ERROR
,
1164 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1165 (*loc
)->deny
[i
].mask
.name
.name
, strerror(errno
));
1166 cupsdDeleteLocation(temp
);
1171 memcpy(&(temp
->deny
[i
].mask
.ip
), &((*loc
)->deny
[i
].mask
.ip
),
1172 sizeof(cupsd_ipmask_t
));
1182 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1186 cupsdDeleteAllLocations(void)
1188 cupsd_location_t
*loc
; /* Current location */
1192 * Free all of the allow/deny records first...
1195 for (loc
= (cupsd_location_t
*)cupsArrayFirst(Locations
);
1197 loc
= (cupsd_location_t
*)cupsArrayNext(Locations
))
1198 cupsdDeleteLocation(loc
);
1201 * Then free the location array...
1204 cupsArrayDelete(Locations
);
1210 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1214 cupsdDeleteLocation(
1215 cupsd_location_t
*loc
) /* I - Location to delete */
1217 int i
; /* Looping var */
1218 cupsd_authmask_t
*mask
; /* Current mask */
1221 cupsArrayRemove(Locations
, loc
);
1223 for (i
= loc
->num_names
- 1; i
>= 0; i
--)
1224 free(loc
->names
[i
]);
1226 if (loc
->num_names
> 0)
1229 for (i
= loc
->num_allow
, mask
= loc
->allow
; i
> 0; i
--, mask
++)
1230 if (mask
->type
== AUTH_NAME
|| mask
->type
== AUTH_INTERFACE
)
1231 free(mask
->mask
.name
.name
);
1233 if (loc
->num_allow
> 0)
1236 for (i
= loc
->num_deny
, mask
= loc
->deny
; i
> 0; i
--, mask
++)
1237 if (mask
->type
== AUTH_NAME
|| mask
->type
== AUTH_INTERFACE
)
1238 free(mask
->mask
.name
.name
);
1240 if (loc
->num_deny
> 0)
1243 free(loc
->location
);
1249 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1254 cupsdDenyHost(cupsd_location_t
*loc
, /* I - Location to add to */
1255 char *name
) /* I - Name of host or domain to add */
1257 cupsd_authmask_t
*temp
; /* New host/domain mask */
1258 char ifname
[32], /* Interface name */
1259 *ifptr
; /* Pointer to end of name */
1262 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1263 loc
, loc
->location
? loc
->location
: "nil", name
);
1265 if ((temp
= add_deny(loc
)) == NULL
)
1268 if (!strcasecmp(name
, "@LOCAL"))
1271 * Deny *interface*...
1274 temp
->type
= AUTH_INTERFACE
;
1275 temp
->mask
.name
.name
= strdup("*");
1276 temp
->mask
.name
.length
= 1;
1278 else if (!strncasecmp(name
, "@IF(", 4))
1281 * Deny *interface*...
1284 strlcpy(ifname
, name
+ 4, sizeof(ifname
));
1286 ifptr
= ifname
+ strlen(ifname
);
1288 if (ifptr
[-1] == ')')
1294 temp
->type
= AUTH_INTERFACE
;
1295 temp
->mask
.name
.name
= strdup(ifname
);
1296 temp
->mask
.name
.length
= ifptr
- ifname
;
1304 temp
->type
= AUTH_NAME
;
1305 temp
->mask
.name
.name
= strdup(name
);
1306 temp
->mask
.name
.length
= strlen(name
);
1312 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1313 * access the location.
1317 cupsdDenyIP(cupsd_location_t
*loc
, /* I - Location to add to */
1318 unsigned address
[4],/* I - IP address to add */
1319 unsigned netmask
[4])/* I - Netmask of address */
1321 cupsd_authmask_t
*temp
; /* New host/domain mask */
1324 cupsdLogMessage(CUPSD_LOG_DEBUG
,
1325 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1326 loc
, loc
->location
? loc
->location
: "nil",
1327 address
[0], address
[1], address
[2], address
[3],
1328 netmask
[0], netmask
[1], netmask
[2], netmask
[3]);
1330 if ((temp
= add_deny(loc
)) == NULL
)
1333 temp
->type
= AUTH_IP
;
1334 memcpy(temp
->mask
.ip
.address
, address
, sizeof(temp
->mask
.ip
.address
));
1335 memcpy(temp
->mask
.ip
.netmask
, netmask
, sizeof(temp
->mask
.ip
.netmask
));
1340 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1343 cupsd_location_t
* /* O - Location that matches */
1344 cupsdFindBest(const char *path
, /* I - Resource path */
1345 http_state_t state
) /* I - HTTP state/request */
1347 char uri
[HTTP_MAX_URI
],
1348 /* URI in request... */
1349 *uriptr
; /* Pointer into URI */
1350 cupsd_location_t
*loc
, /* Current location */
1351 *best
; /* Best match for location so far */
1352 int bestlen
; /* Length of best match */
1353 int limit
; /* Limit field */
1354 static const int limits
[] = /* Map http_status_t to AUTH_LIMIT_xyz */
1374 * First copy the connection URI to a local string so we have drop
1375 * any .ppd extension from the pathname in /printers or /classes
1379 strlcpy(uri
, path
, sizeof(uri
));
1381 if (!strncmp(uri
, "/printers/", 10) ||
1382 !strncmp(uri
, "/classes/", 9))
1385 * Check if the URI has .ppd on the end...
1388 uriptr
= uri
+ strlen(uri
) - 4; /* len > 4 if we get here... */
1390 if (!strcmp(uriptr
, ".ppd"))
1394 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: uri = \"%s\"...", uri
);
1397 * Loop through the list of locations to find a match...
1400 limit
= limits
[state
];
1404 for (loc
= (cupsd_location_t
*)cupsArrayFirst(Locations
);
1406 loc
= (cupsd_location_t
*)cupsArrayNext(Locations
))
1408 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: Location %s Limit %x",
1409 loc
->location
? loc
->location
: "nil", loc
->limit
);
1411 if (!strncmp(uri
, "/printers/", 10) || !strncmp(uri
, "/classes/", 9))
1414 * Use case-insensitive comparison for queue names...
1417 if (loc
->length
> bestlen
&& loc
->location
&&
1418 !strncasecmp(uri
, loc
->location
, loc
->length
) &&
1419 loc
->location
[0] == '/' &&
1420 (limit
& loc
->limit
) != 0)
1423 bestlen
= loc
->length
;
1429 * Use case-sensitive comparison for other URIs...
1432 if (loc
->length
> bestlen
&& loc
->location
&&
1433 !strncmp(uri
, loc
->location
, loc
->length
) &&
1434 loc
->location
[0] == '/' &&
1435 (limit
& loc
->limit
) != 0)
1438 bestlen
= loc
->length
;
1444 * Return the match, if any...
1447 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdFindBest: best = %s",
1448 best
? best
->location
: "NONE");
1455 * 'cupsdFindLocation()' - Find the named location.
1458 cupsd_location_t
* /* O - Location that matches */
1459 cupsdFindLocation(const char *location
) /* I - Connection */
1461 cupsd_location_t key
; /* Search key */
1464 key
.location
= (char *)location
;
1466 return ((cupsd_location_t
*)cupsArrayFind(Locations
, &key
));
1471 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1474 http_status_t
/* O - HTTP_OK if authorized or error code */
1475 cupsdIsAuthorized(cupsd_client_t
*con
, /* I - Connection */
1476 const char *owner
)/* I - Owner of object */
1478 int i
, j
, /* Looping vars */
1479 auth
; /* Authorization status */
1480 unsigned address
[4]; /* Authorization address */
1481 cupsd_location_t
*best
; /* Best match for location so far */
1482 int hostlen
; /* Length of hostname */
1483 const char *username
; /* Username to authorize */
1484 struct passwd
*pw
; /* User password data */
1485 static const char * const levels
[] = /* Auth levels */
1491 static const char * const types
[] = /* Auth types */
1500 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1501 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1502 con
->uri
, con
->best
, con
->best
? con
->best
->location
?
1503 con
->best
->location
: "(null)" : "");
1505 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1506 "cupsdIsAuthorized: owner=\"%s\"", owner
);
1509 * If there is no "best" authentication rule for this request, then
1510 * access is allowed from the local system and denied from other
1516 if (!strcmp(con
->http
.hostname
, "localhost") ||
1517 !strcmp(con
->http
.hostname
, ServerName
))
1520 return (HTTP_FORBIDDEN
);
1525 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1526 "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, "
1527 "satisfy=AUTH_SATISFY_%s, num_names=%d",
1528 levels
[best
->level
], types
[best
->type
],
1529 best
->satisfy
? "ANY" : "ALL", best
->num_names
);
1531 if (best
->limit
== AUTH_LIMIT_IPP
)
1532 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: op=%x(%s)",
1533 best
->op
, ippOpString(best
->op
));
1536 * Check host/ip-based accesses...
1540 if (con
->http
.hostaddr
->addr
.sa_family
== AF_INET6
)
1543 * Copy IPv6 address...
1546 address
[0] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[0]);
1547 address
[1] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[1]);
1548 address
[2] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[2]);
1549 address
[3] = ntohl(con
->http
.hostaddr
->ipv6
.sin6_addr
.s6_addr32
[3]);
1552 #endif /* AF_INET6 */
1553 if (con
->http
.hostaddr
->addr
.sa_family
== AF_INET
)
1556 * Copy IPv4 address...
1562 address
[3] = ntohl(con
->http
.hostaddr
->ipv4
.sin_addr
.s_addr
);
1565 memset(address
, 0, sizeof(address
));
1567 hostlen
= strlen(con
->http
.hostname
);
1569 if (!strcasecmp(con
->http
.hostname
, "localhost"))
1572 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1580 * Do authorization checks on the domain/address...
1583 switch (best
->order_type
)
1586 auth
= AUTH_DENY
; /* anti-compiler-warning-code */
1589 case AUTH_ALLOW
: /* Order Deny,Allow */
1592 if (cupsdCheckAuth(address
, con
->http
.hostname
, hostlen
,
1593 best
->num_deny
, best
->deny
))
1596 if (cupsdCheckAuth(address
, con
->http
.hostname
, hostlen
,
1597 best
->num_allow
, best
->allow
))
1601 case AUTH_DENY
: /* Order Allow,Deny */
1604 if (cupsdCheckAuth(address
, con
->http
.hostname
, hostlen
,
1605 best
->num_allow
, best
->allow
))
1608 if (cupsdCheckAuth(address
, con
->http
.hostname
, hostlen
,
1609 best
->num_deny
, best
->deny
))
1615 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: auth=AUTH_%s...",
1616 auth
? "DENY" : "ALLOW");
1618 if (auth
== AUTH_DENY
&& best
->satisfy
== AUTH_SATISFY_ALL
)
1619 return (HTTP_FORBIDDEN
);
1623 * See if encryption is required...
1626 if (best
->encryption
>= HTTP_ENCRYPT_REQUIRED
&& !con
->http
.tls
&&
1627 strcasecmp(con
->http
.hostname
, "localhost") &&
1628 best
->satisfy
== AUTH_SATISFY_ALL
)
1630 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1631 "cupsdIsAuthorized: Need upgrade to TLS...");
1632 return (HTTP_UPGRADE_REQUIRED
);
1634 #endif /* HAVE_SSL */
1637 * Now see what access level is required...
1640 if (best
->level
== AUTH_ANON
|| /* Anonymous access - allow it */
1641 (best
->type
== AUTH_NONE
&& best
->num_names
== 0))
1644 if (!con
->username
[0] && best
->type
== AUTH_NONE
&&
1645 best
->limit
== AUTH_LIMIT_IPP
)
1648 * Check for unauthenticated username...
1651 ipp_attribute_t
*attr
; /* requesting-user-name attribute */
1654 attr
= ippFindAttribute(con
->request
, "requesting-user-name", IPP_TAG_NAME
);
1657 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1658 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1659 attr
->values
[0].string
.text
);
1660 username
= attr
->values
[0].string
.text
;
1662 else if (best
->satisfy
== AUTH_SATISFY_ALL
|| auth
== AUTH_DENY
)
1663 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
1665 return (HTTP_OK
); /* unless overridden with Satisfy */
1669 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "cupsdIsAuthorized: username=\"%s\"",
1672 if (!con
->username
[0])
1674 if (best
->satisfy
== AUTH_SATISFY_ALL
|| auth
== AUTH_DENY
)
1675 return (HTTP_UNAUTHORIZED
); /* Non-anonymous needs user/pass */
1677 return (HTTP_OK
); /* unless overridden with Satisfy */
1680 username
= con
->username
;
1684 * OK, got a username. See if we need normal user access, or group
1685 * access... (root always matches)
1688 if (!strcmp(username
, "root"))
1692 * Get the user info...
1695 pw
= getpwnam(username
);
1698 if (best
->level
== AUTH_USER
)
1701 * If there are no names associated with this location, then
1702 * any valid user is OK...
1705 if (best
->num_names
== 0)
1709 * Otherwise check the user list and return OK if this user is
1713 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1714 "cupsdIsAuthorized: Checking user membership...");
1716 for (i
= 0; i
< best
->num_names
; i
++)
1718 if (!strcasecmp(best
->names
[i
], "@OWNER") && owner
&&
1719 !strcasecmp(username
, owner
))
1721 else if (!strcasecmp(best
->names
[i
], "@SYSTEM"))
1723 for (j
= 0; j
< NumSystemGroups
; j
++)
1724 if (cupsdCheckGroup(username
, pw
, SystemGroups
[j
]))
1727 else if (best
->names
[i
][0] == '@')
1729 if (cupsdCheckGroup(username
, pw
, best
->names
[i
] + 1))
1732 else if (!strcasecmp(username
, best
->names
[i
]))
1736 return (HTTP_UNAUTHORIZED
);
1740 * Check to see if this user is in any of the named groups...
1743 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1744 "cupsdIsAuthorized: Checking group membership...");
1747 * Check to see if this user is in any of the named groups...
1750 for (i
= 0; i
< best
->num_names
; i
++)
1752 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1753 "cupsdIsAuthorized: Checking group \"%s\" membership...",
1756 if (!strcasecmp(best
->names
[i
], "@SYSTEM"))
1758 for (j
= 0; j
< NumSystemGroups
; j
++)
1759 if (cupsdCheckGroup(username
, pw
, SystemGroups
[j
]))
1762 else if (cupsdCheckGroup(username
, pw
, best
->names
[i
]))
1767 * The user isn't part of the specified group, so deny access...
1770 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
1771 "cupsdIsAuthorized: User not in group(s)!");
1773 return (HTTP_UNAUTHORIZED
);
1778 * 'add_allow()' - Add an allow mask to the location.
1781 static cupsd_authmask_t
* /* O - New mask record */
1782 add_allow(cupsd_location_t
*loc
) /* I - Location to add to */
1784 cupsd_authmask_t
*temp
; /* New mask record */
1795 * Try to allocate memory for the record...
1798 if (loc
->num_allow
== 0)
1799 temp
= malloc(sizeof(cupsd_authmask_t
));
1801 temp
= realloc(loc
->allow
, sizeof(cupsd_authmask_t
) * (loc
->num_allow
+ 1));
1807 temp
+= loc
->num_allow
;
1811 * Clear the mask record and return...
1814 memset(temp
, 0, sizeof(cupsd_authmask_t
));
1820 * 'add_deny()' - Add a deny mask to the location.
1823 static cupsd_authmask_t
* /* O - New mask record */
1824 add_deny(cupsd_location_t
*loc
) /* I - Location to add to */
1826 cupsd_authmask_t
*temp
; /* New mask record */
1837 * Try to allocate memory for the record...
1840 if (loc
->num_deny
== 0)
1841 temp
= malloc(sizeof(cupsd_authmask_t
));
1843 temp
= realloc(loc
->deny
, sizeof(cupsd_authmask_t
) * (loc
->num_deny
+ 1));
1849 temp
+= loc
->num_deny
;
1853 * Clear the mask record and return...
1856 memset(temp
, 0, sizeof(cupsd_authmask_t
));
1862 * 'compare_locations()' - Compare two locations.
1865 static int /* O - Result of comparison */
1866 compare_locations(cupsd_location_t
*a
, /* I - First location */
1867 cupsd_location_t
*b
) /* I - Second location */
1869 return (strcmp(b
->location
, a
->location
));
1873 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
1875 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
1879 static char * /* O - Encrypted password */
1880 cups_crypt(const char *pw
, /* I - Password string */
1881 const char *salt
) /* I - Salt (key) string */
1883 if (!strncmp(salt
, "$1$", 3))
1886 * Use MD5 passwords without the benefit of PAM; this is for
1887 * Slackware Linux, and the algorithm was taken from the
1888 * old shadow-19990827/lib/md5crypt.c source code... :(
1891 int i
; /* Looping var */
1892 unsigned long n
; /* Output number */
1893 int pwlen
; /* Length of password string */
1894 const char *salt_end
; /* End of "salt" data for MD5 */
1895 char *ptr
; /* Pointer into result string */
1896 _cups_md5_state_t state
; /* Primary MD5 state info */
1897 _cups_md5_state_t state2
; /* Secondary MD5 state info */
1898 unsigned char digest
[16]; /* MD5 digest result */
1899 static char result
[120]; /* Final password string */
1903 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
1904 * Get a maximum of 8 characters of salt data after $1$...
1907 for (salt_end
= salt
+ 3; *salt_end
&& (salt_end
- salt
) < 11; salt_end
++)
1908 if (*salt_end
== '$')
1912 * Compute the MD5 sum we need...
1917 _cupsMD5Init(&state
);
1918 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
1919 _cupsMD5Append(&state
, (unsigned char *)salt
, salt_end
- salt
);
1921 _cupsMD5Init(&state2
);
1922 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
1923 _cupsMD5Append(&state2
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
1924 _cupsMD5Append(&state2
, (unsigned char *)pw
, pwlen
);
1925 _cupsMD5Finish(&state2
, digest
);
1927 for (i
= pwlen
; i
> 0; i
-= 16)
1928 _cupsMD5Append(&state
, digest
, i
> 16 ? 16 : i
);
1930 for (i
= pwlen
; i
> 0; i
>>= 1)
1931 _cupsMD5Append(&state
, (unsigned char *)((i
& 1) ? "" : pw
), 1);
1933 _cupsMD5Finish(&state
, digest
);
1935 for (i
= 0; i
< 1000; i
++)
1937 _cupsMD5Init(&state
);
1940 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
1942 _cupsMD5Append(&state
, digest
, 16);
1945 _cupsMD5Append(&state
, (unsigned char *)salt
+ 3, salt_end
- salt
- 3);
1948 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
1951 _cupsMD5Append(&state
, digest
, 16);
1953 _cupsMD5Append(&state
, (unsigned char *)pw
, pwlen
);
1955 _cupsMD5Finish(&state
, digest
);
1959 * Copy the final sum to the result string and return...
1962 memcpy(result
, salt
, salt_end
- salt
);
1963 ptr
= result
+ (salt_end
- salt
);
1966 for (i
= 0; i
< 5; i
++, ptr
+= 4)
1968 n
= (((digest
[i
] << 8) | digest
[i
+ 6]) << 8);
1971 n
|= digest
[i
+ 12];
1978 to64(ptr
, digest
[11], 2);
1987 * Use the standard crypt() function...
1990 return (crypt(pw
, salt
));
1993 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
1997 * 'get_md5_password()' - Get an MD5 password.
2000 static char * /* O - MD5 password string */
2001 get_md5_password(const char *username
, /* I - Username */
2002 const char *group
, /* I - Group */
2003 char passwd
[33]) /* O - MD5 password string */
2005 cups_file_t
*fp
; /* passwd.md5 file */
2006 char filename
[1024], /* passwd.md5 filename */
2007 line
[256], /* Line from file */
2008 tempuser
[33], /* User from file */
2009 tempgroup
[33]; /* Group from file */
2012 cupsdLogMessage(CUPSD_LOG_DEBUG2
,
2013 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2014 username
, group
? group
: "(null)", passwd
);
2016 snprintf(filename
, sizeof(filename
), "%s/passwd.md5", ServerRoot
);
2017 if ((fp
= cupsFileOpen(filename
, "r")) == NULL
)
2019 if (errno
!= ENOENT
)
2020 cupsdLogMessage(CUPSD_LOG_ERROR
, "Unable to open %s - %s", filename
,
2026 while (cupsFileGets(fp
, line
, sizeof(line
)) != NULL
)
2028 if (sscanf(line
, "%32[^:]:%32[^:]:%32s", tempuser
, tempgroup
, passwd
) != 3)
2030 cupsdLogMessage(CUPSD_LOG_ERROR
, "Bad MD5 password line: %s", line
);
2034 if (!strcmp(username
, tempuser
) &&
2035 (group
== NULL
|| !strcmp(group
, tempgroup
)))
2038 * Found the password entry!
2041 cupsdLogMessage(CUPSD_LOG_DEBUG2
, "Found MD5 user %s, group %s...",
2042 username
, tempgroup
);
2050 * Didn't find a password entry - return NULL!
2060 * 'pam_func()' - PAM conversation function.
2063 static int /* O - Success or failure */
2065 int num_msg
, /* I - Number of messages */
2066 const struct pam_message
**msg
, /* I - Messages */
2067 struct pam_response
**resp
, /* O - Responses */
2069 /* I - Pointer to connection */
2071 int i
; /* Looping var */
2072 struct pam_response
*replies
; /* Replies */
2073 cupsd_authdata_t
*data
; /* Pointer to auth data */
2077 * Allocate memory for the responses...
2080 if ((replies
= malloc(sizeof(struct pam_response
) * num_msg
)) == NULL
)
2081 return (PAM_CONV_ERR
);
2084 * Answer all of the messages...
2087 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr
));
2091 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2092 * module. This is a workaround...
2098 data
= (cupsd_authdata_t
*)appdata_ptr
;
2101 for (i
= 0; i
< num_msg
; i
++)
2103 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg
[i
]->msg
));
2105 switch (msg
[i
]->msg_style
)
2107 case PAM_PROMPT_ECHO_ON
:
2108 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2110 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2111 replies
[i
].resp
= strdup(data
->username
);
2114 case PAM_PROMPT_ECHO_OFF
:
2115 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2117 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2118 replies
[i
].resp
= strdup(data
->password
);
2122 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2123 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2124 replies
[i
].resp
= NULL
;
2128 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2129 replies
[i
].resp_retcode
= PAM_SUCCESS
;
2130 replies
[i
].resp
= NULL
;
2134 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2135 msg
[i
]->msg_style
));
2137 return (PAM_CONV_ERR
);
2142 * Return the responses back to PAM...
2147 return (PAM_SUCCESS
);
2153 * 'to64()' - Base64-encode an integer value...
2157 to64(char *s
, /* O - Output string */
2158 unsigned long v
, /* I - Value to encode */
2159 int n
) /* I - Number of digits */
2161 const char *itoa64
= "./0123456789"
2162 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2163 "abcdefghijklmnopqrstuvwxyz";
2166 for (; n
> 0; n
--, v
>>= 6)
2167 *s
++ = itoa64
[v
& 0x3f];
2169 #endif /* HAVE_LIBPAM */
2173 * End of "$Id: auth.c 5948 2006-09-12 13:58:39Z mike $".