]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge changes from CUPS trunk, r6739.
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 6732 2007-07-26 16:50:20Z mike $"
3 *
4 * Authorization routines for the Common UNIX Printing System (CUPS).
5 *
6 * Copyright 2007 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddLocation() - Add a location for authorization.
21 * cupsdAddName() - Add a name to a location...
22 * cupsdAllowHost() - Add a host name that is allowed to access the
23 * location.
24 * cupsdAllowIP() - Add an IP address or network that is allowed
25 * to access the location.
26 * cupsdAuthorize() - Validate any authorization credentials.
27 * cupsdCheckAuth() - Check authorization masks.
28 * cupsdCheckGroup() - Check for a user's group membership.
29 * cupsdCopyLocation() - Make a copy of a location...
30 * cupsdDeleteAllLocations() - Free all memory used for location
31 * authorization.
32 * cupsdDeleteLocation() - Free all memory used by a location.
33 * cupsdDenyHost() - Add a host name that is not allowed to access
34 * the location.
35 * cupsdDenyIP() - Add an IP address or network that is not
36 * allowed to access the location.
37 * cupsdFindBest() - Find the location entry that best matches the
38 * resource.
39 * cupsdFindLocation() - Find the named location.
40 * cupsdIsAuthorized() - Check to see if the user is authorized...
41 * add_allow() - Add an allow mask to the location.
42 * add_deny() - Add a deny mask to the location.
43 * compare_locations() - Compare two locations.
44 * cups_crypt() - Encrypt the password using the DES or MD5
45 * algorithms, as needed.
46 * get_gss_creds() - Obtain GSS credentials.
47 * get_md5_password() - Get an MD5 password.
48 * pam_func() - PAM conversation function.
49 * to64() - Base64-encode an integer value...
50 * check_authref() - Check an authorization services reference.
51 */
52
53 /*
54 * Include necessary headers...
55 */
56
57 #include "cupsd.h"
58 #include <grp.h>
59 #ifdef HAVE_SHADOW_H
60 # include <shadow.h>
61 #endif /* HAVE_SHADOW_H */
62 #ifdef HAVE_CRYPT_H
63 # include <crypt.h>
64 #endif /* HAVE_CRYPT_H */
65 #if HAVE_LIBPAM
66 # ifdef HAVE_PAM_PAM_APPL_H
67 # include <pam/pam_appl.h>
68 # else
69 # include <security/pam_appl.h>
70 # endif /* HAVE_PAM_PAM_APPL_H */
71 #endif /* HAVE_LIBPAM */
72 #ifdef HAVE_USERSEC_H
73 # include <usersec.h>
74 #endif /* HAVE_USERSEC_H */
75 #ifdef HAVE_MEMBERSHIP_H
76 # include <membership.h>
77 #endif /* HAVE_MEMBERSHIP_H */
78 #ifdef HAVE_AUTHORIZATION_H
79 # include <Security/AuthorizationTags.h>
80 # ifdef HAVE_SECBASEPRIV_H
81 # include <Security/SecBasePriv.h>
82 # else
83 extern const char *cssmErrorString(int error);
84 # endif /* HAVE_SECBASEPRIV_H */
85 #endif /* HAVE_AUTHORIZATION_H */
86 #ifdef HAVE_SYS_UCRED_H
87 # include <sys/ucred.h>
88 typedef struct xucred cupsd_ucred_t;
89 # define CUPSD_UCRED_UID(c) (c).cr_uid
90 #else
91 typedef struct ucred cupsd_ucred_t;
92 # define CUPSD_UCRED_UID(c) (c).uid
93 #endif /* HAVE_SYS_UCRED_H */
94
95
96 /*
97 * Local functions...
98 */
99
100 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
101 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
102 #ifdef HAVE_AUTHORIZATION_H
103 static int check_authref(cupsd_client_t *con, const char *right);
104 #endif /* HAVE_AUTHORIZATION_H */
105 static int compare_locations(cupsd_location_t *a,
106 cupsd_location_t *b);
107 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
108 static char *cups_crypt(const char *pw, const char *salt);
109 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
110 #ifdef HAVE_GSSAPI
111 static gss_cred_id_t get_gss_creds(const char *service_name);
112 #endif /* HAVE_GSSAPI */
113 static char *get_md5_password(const char *username,
114 const char *group, char passwd[33]);
115 #if HAVE_LIBPAM
116 static int pam_func(int, const struct pam_message **,
117 struct pam_response **, void *);
118 #elif !defined(HAVE_USERSEC_H)
119 static void to64(char *s, unsigned long v, int n);
120 #endif /* HAVE_LIBPAM */
121
122
123 /*
124 * Local structures...
125 */
126
127 #if HAVE_LIBPAM
128 typedef struct cupsd_authdata_s /**** Authentication data ****/
129 {
130 char username[33], /* Username string */
131 password[33]; /* Password string */
132 } cupsd_authdata_t;
133 #endif /* HAVE_LIBPAM */
134
135
136 /*
137 * Local globals...
138 */
139
140 #if defined(__hpux) && HAVE_LIBPAM
141 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
142 #endif /* __hpux && HAVE_LIBPAM */
143
144
145 /*
146 * 'cupsdAddLocation()' - Add a location for authorization.
147 */
148
149 cupsd_location_t * /* O - Pointer to new location record */
150 cupsdAddLocation(const char *location) /* I - Location path */
151 {
152 cupsd_location_t *temp; /* New location */
153
154
155 /*
156 * Make sure the locations array is created...
157 */
158
159 if (!Locations)
160 Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
161
162 if (!Locations)
163 return (NULL);
164
165 /*
166 * Try to allocate memory for the new location.
167 */
168
169 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
170 return (NULL);
171
172 /*
173 * Initialize the record and copy the name over...
174 */
175
176 temp->location = strdup(location);
177 temp->length = strlen(temp->location);
178
179 cupsArrayAdd(Locations, temp);
180
181 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
182 location);
183
184 /*
185 * Return the new record...
186 */
187
188 return (temp);
189 }
190
191
192 /*
193 * 'cupsdAddName()' - Add a name to a location...
194 */
195
196 void
197 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
198 char *name) /* I - Name to add */
199 {
200 char **temp; /* Pointer to names array */
201
202
203 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
204 loc, name);
205
206 if (loc->num_names == 0)
207 temp = malloc(sizeof(char *));
208 else
209 temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
210
211 if (temp == NULL)
212 {
213 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
214 loc->location ? loc->location : "nil", strerror(errno));
215 return;
216 }
217
218 loc->names = temp;
219
220 if ((temp[loc->num_names] = strdup(name)) == NULL)
221 {
222 cupsdLogMessage(CUPSD_LOG_ERROR,
223 "Unable to duplicate name for location %s: %s",
224 loc->location ? loc->location : "nil", strerror(errno));
225 return;
226 }
227
228 loc->num_names ++;
229 }
230
231
232 /*
233 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
234 */
235
236 void
237 cupsdAllowHost(cupsd_location_t *loc, /* I - Location to add to */
238 char *name) /* I - Name of host or domain to add */
239 {
240 cupsd_authmask_t *temp; /* New host/domain mask */
241 char ifname[32], /* Interface name */
242 *ifptr; /* Pointer to end of name */
243
244
245 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
246 loc, loc->location ? loc->location : "nil", name);
247
248 if ((temp = add_allow(loc)) == NULL)
249 return;
250
251 if (!strcasecmp(name, "@LOCAL"))
252 {
253 /*
254 * Allow *interface*...
255 */
256
257 temp->type = AUTH_INTERFACE;
258 temp->mask.name.name = strdup("*");
259 temp->mask.name.length = 1;
260 }
261 else if (!strncasecmp(name, "@IF(", 4))
262 {
263 /*
264 * Allow *interface*...
265 */
266
267 strlcpy(ifname, name + 4, sizeof(ifname));
268
269 ifptr = ifname + strlen(ifname);
270
271 if (ifptr[-1] == ')')
272 {
273 ifptr --;
274 *ifptr = '\0';
275 }
276
277 temp->type = AUTH_INTERFACE;
278 temp->mask.name.name = strdup(ifname);
279 temp->mask.name.length = ifptr - ifname;
280 }
281 else
282 {
283 /*
284 * Allow name...
285 */
286
287 temp->type = AUTH_NAME;
288 temp->mask.name.name = strdup(name);
289 temp->mask.name.length = strlen(name);
290 }
291 }
292
293
294 /*
295 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
296 * the location.
297 */
298
299 void
300 cupsdAllowIP(cupsd_location_t *loc, /* I - Location to add to */
301 unsigned address[4], /* I - IP address to add */
302 unsigned netmask[4]) /* I - Netmask of address */
303 {
304 cupsd_authmask_t *temp; /* New host/domain mask */
305
306
307 cupsdLogMessage(CUPSD_LOG_DEBUG2,
308 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
309 loc, loc->location ? loc->location : "nil",
310 address[0], address[1], address[2], address[3],
311 netmask[0], netmask[1], netmask[2], netmask[3]);
312
313 if ((temp = add_allow(loc)) == NULL)
314 return;
315
316 temp->type = AUTH_IP;
317 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
318 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
319 }
320
321
322 /*
323 * 'cupsdAuthorize()' - Validate any authorization credentials.
324 */
325
326 void
327 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
328 {
329 int type; /* Authentication type */
330 const char *authorization; /* Pointer into Authorization string */
331 char *ptr, /* Pointer into string */
332 username[65], /* Username string */
333 password[33]; /* Password string */
334 const char *localuser; /* Certificate username */
335 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
336 md5[33], /* MD5 password */
337 basicmd5[33]; /* MD5 of Basic password */
338 static const char * const states[] = /* HTTP client states... */
339 {
340 "WAITING",
341 "OPTIONS",
342 "GET",
343 "GET",
344 "HEAD",
345 "POST",
346 "POST",
347 "POST",
348 "PUT",
349 "PUT",
350 "DELETE",
351 "TRACE",
352 "CLOSE",
353 "STATUS"
354 };
355
356
357 /*
358 * Locate the best matching location so we know what kind of
359 * authentication to expect...
360 */
361
362 con->best = cupsdFindBest(con->uri, con->http.state);
363
364 cupsdLogMessage(CUPSD_LOG_DEBUG2,
365 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
366 con->uri, con->best, con->best ? con->best->location : "");
367
368 if (con->best && con->best->type != AUTH_NONE)
369 type = con->best->type;
370 else
371 type = DefaultAuthType;
372
373 /*
374 * Decode the Authorization string...
375 */
376
377 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
378
379 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
380 authorization);
381
382 username[0] = '\0';
383 password[0] = '\0';
384
385 #ifdef HAVE_AUTHORIZATION_H
386 if (con->authref)
387 {
388 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
389 con->authref = NULL;
390 }
391 #endif /* HAVE_AUTHORIZATION_H */
392
393 if (type == AUTH_NONE)
394 {
395 /*
396 * No authorization required, return early...
397 */
398
399 cupsdLogMessage(CUPSD_LOG_DEBUG,
400 "cupsdAuthorize: No authentication required.");
401 return;
402 }
403 else if (!*authorization)
404 {
405 /*
406 * No authorization data provided, return early...
407 */
408
409 cupsdLogMessage(CUPSD_LOG_DEBUG,
410 "cupsdAuthorize: No authentication data provided.");
411 return;
412 }
413 #ifdef HAVE_AUTHORIZATION_H
414 else if (!strncmp(authorization, "AuthRef", 6) &&
415 !strcasecmp(con->http.hostname, "localhost"))
416 {
417 OSStatus status; /* Status */
418 int authlen; /* Auth string length */
419 AuthorizationItemSet *authinfo; /* Authorization item set */
420
421 /*
422 * Get the Authorization Services data...
423 */
424
425 authorization += 7;
426 while (isspace(*authorization & 255))
427 authorization ++;
428
429 authlen = sizeof(nonce);
430 httpDecode64_2(nonce, &authlen, authorization);
431
432 if (authlen != kAuthorizationExternalFormLength)
433 {
434 cupsdLogMessage(CUPSD_LOG_ERROR,
435 "External Authorization reference size is incorrect!");
436 return;
437 }
438
439 if ((status = AuthorizationCreateFromExternalForm(
440 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
441 {
442 cupsdLogMessage(CUPSD_LOG_ERROR,
443 "AuthorizationCreateFromExternalForm returned %d (%s)",
444 (int)status, cssmErrorString(status));
445 return;
446 }
447
448 if ((status = AuthorizationCopyInfo(con->authref,
449 kAuthorizationEnvironmentUsername,
450 &authinfo)) != 0)
451 {
452 cupsdLogMessage(CUPSD_LOG_ERROR,
453 "AuthorizationCopyInfo returned %d (%s)",
454 (int)status, cssmErrorString(status));
455 return;
456 }
457
458 if (authinfo->count == 1)
459 strlcpy(username, authinfo->items[0].value, sizeof(username));
460
461 cupsdLogMessage(CUPSD_LOG_DEBUG,
462 "cupsdAuthorize: Authorized as %s using AuthRef",
463 username);
464
465 AuthorizationFreeItemSet(authinfo);
466 }
467 #endif /* HAVE_AUTHORIZATION_H */
468 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
469 else if (!strncmp(authorization, "PeerCred ", 9) &&
470 con->http.hostaddr->addr.sa_family == AF_LOCAL)
471 {
472 /*
473 * Use peer credentials from domain socket connection...
474 */
475
476 struct passwd *pwd; /* Password entry for this user */
477 cupsd_ucred_t peercred; /* Peer credentials */
478 socklen_t peersize; /* Size of peer credentials */
479
480
481 if ((pwd = getpwnam(authorization + 9)) == NULL)
482 {
483 cupsdLogMessage(CUPSD_LOG_ERROR, "User \"%s\" does not exist!",
484 authorization + 9);
485 return;
486 }
487
488 peersize = sizeof(peercred);
489
490 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
491 {
492 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
493 strerror(errno));
494 return;
495 }
496
497 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
498 {
499 cupsdLogMessage(CUPSD_LOG_ERROR,
500 "Invalid peer credentials for \"%s\" - got %d, "
501 "expected %d!", authorization + 9,
502 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
503 # ifdef HAVE_SYS_UCRED_H
504 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_version=%d",
505 peercred.cr_version);
506 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_uid=%d",
507 peercred.cr_uid);
508 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_ngroups=%d",
509 peercred.cr_ngroups);
510 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_groups[0]=%d",
511 peercred.cr_groups[0]);
512 # endif /* HAVE_SYS_UCRED_H */
513 return;
514 }
515
516 strlcpy(username, authorization + 9, sizeof(username));
517
518 cupsdLogMessage(CUPSD_LOG_DEBUG,
519 "cupsdAuthorize: Authorized as %s using PeerCred",
520 username);
521 }
522 #endif /* SO_PEERCRED && AF_LOCAL */
523 else if (!strncmp(authorization, "Local", 5) &&
524 !strcasecmp(con->http.hostname, "localhost"))
525 {
526 /*
527 * Get Local certificate authentication data...
528 */
529
530 authorization += 5;
531 while (isspace(*authorization & 255))
532 authorization ++;
533
534 if ((localuser = cupsdFindCert(authorization)) != NULL)
535 {
536 strlcpy(username, localuser, sizeof(username));
537
538 cupsdLogMessage(CUPSD_LOG_DEBUG,
539 "cupsdAuthorize: Authorized as %s using Local",
540 username);
541 }
542 else
543 {
544 cupsdLogMessage(CUPSD_LOG_ERROR,
545 "cupsdAuthorize: Local authentication certificate not "
546 "found!");
547 return;
548 }
549 }
550 else if (!strncmp(authorization, "Basic", 5) &&
551 (type == AUTH_BASIC || type == AUTH_BASICDIGEST))
552 {
553 /*
554 * Get the Basic authentication data...
555 */
556
557 int userlen; /* Username:password length */
558
559
560 authorization += 5;
561 while (isspace(*authorization & 255))
562 authorization ++;
563
564 userlen = sizeof(username);
565 httpDecode64_2(username, &userlen, authorization);
566
567 /*
568 * Pull the username and password out...
569 */
570
571 if ((ptr = strchr(username, ':')) == NULL)
572 {
573 cupsdLogMessage(CUPSD_LOG_ERROR,
574 "cupsdAuthorize: Missing Basic password!");
575 return;
576 }
577
578 *ptr++ = '\0';
579
580 if (!username[0])
581 {
582 /*
583 * Username must not be empty...
584 */
585
586 cupsdLogMessage(CUPSD_LOG_ERROR,
587 "cupsdAuthorize: Empty Basic username!");
588 return;
589 }
590
591 if (!*ptr)
592 {
593 /*
594 * Password must not be empty...
595 */
596
597 cupsdLogMessage(CUPSD_LOG_ERROR,
598 "cupsdAuthorize: Empty Basic password!");
599 return;
600 }
601
602 strlcpy(password, ptr, sizeof(password));
603
604 /*
605 * Validate the username and password...
606 */
607
608 switch (type)
609 {
610 case AUTH_BASIC :
611 {
612 #if HAVE_LIBPAM
613 /*
614 * Only use PAM to do authentication. This supports MD5
615 * passwords, among other things...
616 */
617
618 pam_handle_t *pamh; /* PAM authentication handle */
619 int pamerr; /* PAM error code */
620 struct pam_conv pamdata;/* PAM conversation data */
621 cupsd_authdata_t data; /* Authentication data */
622
623
624 strlcpy(data.username, username, sizeof(data.username));
625 strlcpy(data.password, password, sizeof(data.password));
626
627 # if defined(__sun) || defined(__hpux)
628 pamdata.conv = (int (*)(int, struct pam_message **,
629 struct pam_response **,
630 void *))pam_func;
631 # else
632 pamdata.conv = pam_func;
633 # endif /* __sun || __hpux */
634 pamdata.appdata_ptr = &data;
635
636 # ifdef __hpux
637 /*
638 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
639 * more info...
640 */
641
642 auth_data = &data;
643 # endif /* __hpux */
644
645 pamerr = pam_start("cups", username, &pamdata, &pamh);
646 if (pamerr != PAM_SUCCESS)
647 {
648 cupsdLogMessage(CUPSD_LOG_ERROR,
649 "cupsdAuthorize: pam_start() returned %d (%s)!\n",
650 pamerr, pam_strerror(pamh, pamerr));
651 pam_end(pamh, 0);
652 return;
653 }
654
655 pamerr = pam_authenticate(pamh, PAM_SILENT);
656 if (pamerr != PAM_SUCCESS)
657 {
658 cupsdLogMessage(CUPSD_LOG_ERROR,
659 "cupsdAuthorize: pam_authenticate() returned %d "
660 "(%s)!\n",
661 pamerr, pam_strerror(pamh, pamerr));
662 pam_end(pamh, 0);
663 return;
664 }
665
666 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
667 if (pamerr != PAM_SUCCESS)
668 {
669 cupsdLogMessage(CUPSD_LOG_ERROR,
670 "cupsdAuthorize: pam_acct_mgmt() returned %d "
671 "(%s)!\n",
672 pamerr, pam_strerror(pamh, pamerr));
673 pam_end(pamh, 0);
674 return;
675 }
676
677 pam_end(pamh, PAM_SUCCESS);
678
679 #elif defined(HAVE_USERSEC_H)
680 /*
681 * Use AIX authentication interface...
682 */
683
684 char *authmsg; /* Authentication message */
685 int reenter; /* ??? */
686
687
688 cupsdLogMessage(CUPSD_LOG_DEBUG,
689 "cupsdAuthorize: AIX authenticate of username \"%s\"",
690 username);
691
692 reenter = 1;
693 if (authenticate(username, password, &reenter, &authmsg) != 0)
694 {
695 cupsdLogMessage(CUPSD_LOG_DEBUG,
696 "cupsdAuthorize: Unable to authenticate username "
697 "\"%s\": %s",
698 username, strerror(errno));
699 return;
700 }
701
702 #else
703 /*
704 * Use normal UNIX password file-based authentication...
705 */
706
707 char *pass; /* Encrypted password */
708 struct passwd *pw; /* User password data */
709 # ifdef HAVE_SHADOW_H
710 struct spwd *spw; /* Shadow password data */
711 # endif /* HAVE_SHADOW_H */
712
713
714 pw = getpwnam(username); /* Get the current password */
715 endpwent(); /* Close the password file */
716
717 if (!pw)
718 {
719 /*
720 * No such user...
721 */
722
723 cupsdLogMessage(CUPSD_LOG_ERROR,
724 "cupsdAuthorize: Unknown username \"%s\"!",
725 username);
726 return;
727 }
728
729 # ifdef HAVE_SHADOW_H
730 spw = getspnam(username);
731 endspent();
732
733 if (!spw && !strcmp(pw->pw_passwd, "x"))
734 {
735 /*
736 * Don't allow blank passwords!
737 */
738
739 cupsdLogMessage(CUPSD_LOG_ERROR,
740 "cupsdAuthorize: Username \"%s\" has no shadow "
741 "password!", username);
742 return;
743 }
744
745 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
746 # else
747 if (!pw->pw_passwd[0])
748 # endif /* HAVE_SHADOW_H */
749 {
750 /*
751 * Don't allow blank passwords!
752 */
753
754 cupsdLogMessage(CUPSD_LOG_ERROR,
755 "cupsdAuthorize: Username \"%s\" has no password!",
756 username);
757 return;
758 }
759
760 /*
761 * OK, the password isn't blank, so compare with what came from the
762 * client...
763 */
764
765 pass = cups_crypt(password, pw->pw_passwd);
766
767 cupsdLogMessage(CUPSD_LOG_DEBUG2,
768 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
769 pw->pw_passwd, pass);
770
771 if (!pass || strcmp(pw->pw_passwd, pass))
772 {
773 # ifdef HAVE_SHADOW_H
774 if (spw)
775 {
776 pass = cups_crypt(password, spw->sp_pwdp);
777
778 cupsdLogMessage(CUPSD_LOG_DEBUG2,
779 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
780 spw->sp_pwdp, pass);
781
782 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
783 {
784 cupsdLogMessage(CUPSD_LOG_ERROR,
785 "cupsdAuthorize: Authentication failed for "
786 "user \"%s\"!",
787 username);
788 return;
789 }
790 }
791 else
792 # endif /* HAVE_SHADOW_H */
793 {
794 cupsdLogMessage(CUPSD_LOG_ERROR,
795 "cupsdAuthorize: Authentication failed for "
796 "user \"%s\"!",
797 username);
798 return;
799 }
800 }
801 #endif /* HAVE_LIBPAM */
802 }
803
804 cupsdLogMessage(CUPSD_LOG_DEBUG,
805 "cupsdAuthorize: Authorized as %s using Basic",
806 username);
807 break;
808
809 case AUTH_BASICDIGEST :
810 /*
811 * Do Basic authentication with the Digest password file...
812 */
813
814 if (!get_md5_password(username, NULL, md5))
815 {
816 cupsdLogMessage(CUPSD_LOG_ERROR,
817 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
818 username);
819 return;
820 }
821
822 httpMD5(username, "CUPS", password, basicmd5);
823
824 if (strcmp(md5, basicmd5))
825 {
826 cupsdLogMessage(CUPSD_LOG_ERROR,
827 "cupsdAuthorize: Authentication failed for \"%s\"!",
828 username);
829 return;
830 }
831
832 cupsdLogMessage(CUPSD_LOG_DEBUG,
833 "cupsdAuthorize: Authorized as %s using BasicDigest",
834 username);
835 break;
836 }
837 }
838 else if (!strncmp(authorization, "Digest", 6) && type == AUTH_DIGEST)
839 {
840 /*
841 * Get the username, password, and nonce from the Digest attributes...
842 */
843
844 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
845 username, sizeof(username)) || !username[0])
846 {
847 /*
848 * Username must not be empty...
849 */
850
851 cupsdLogMessage(CUPSD_LOG_ERROR,
852 "cupsdAuthorize: Empty or missing Digest username!");
853 return;
854 }
855
856 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
857 password, sizeof(password)) || !password[0])
858 {
859 /*
860 * Password must not be empty...
861 */
862
863 cupsdLogMessage(CUPSD_LOG_ERROR,
864 "cupsdAuthorize: Empty or missing Digest password!");
865 return;
866 }
867
868 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
869 nonce))
870 {
871 cupsdLogMessage(CUPSD_LOG_ERROR,
872 "cupsdAuthorize: No nonce value for Digest "
873 "authentication!");
874 return;
875 }
876
877 if (strcmp(con->http.hostname, nonce))
878 {
879 cupsdLogMessage(CUPSD_LOG_ERROR,
880 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
881 "got \"%s\"!", con->http.hostname, nonce);
882 return;
883 }
884
885 /*
886 * Validate the username and password...
887 */
888
889 if (!get_md5_password(username, NULL, md5))
890 {
891 cupsdLogMessage(CUPSD_LOG_ERROR,
892 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
893 username);
894 return;
895 }
896
897 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
898
899 if (strcmp(md5, password))
900 {
901 cupsdLogMessage(CUPSD_LOG_ERROR,
902 "cupsdAuthorize: Authentication failed for \"%s\"!",
903 username);
904 return;
905 }
906
907 cupsdLogMessage(CUPSD_LOG_DEBUG,
908 "cupsdAuthorize: Authorized as %s using Digest",
909 username);
910 }
911 #ifdef HAVE_GSSAPI
912 else if (!strncmp(authorization, "Negotiate", 9) && type == AUTH_NEGOTIATE)
913 {
914 int len; /* Length of authorization string */
915 gss_cred_id_t server_creds; /* Server credentials */
916 gss_ctx_id_t context; /* Authorization context */
917 OM_uint32 major_status, /* Major status code */
918 minor_status; /* Minor status code */
919 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
920 /* Input token from string */
921 output_token = GSS_C_EMPTY_BUFFER;
922 /* Output token for username */
923 gss_name_t client_name; /* Client name */
924
925
926 # ifdef __APPLE__
927 /*
928 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
929 * to use it...
930 */
931
932 if (gss_init_sec_context == NULL)
933 {
934 cupsdLogMessage(CUPSD_LOG_WARN,
935 "GSSAPI/Kerberos authentication failed because the "
936 "Kerberos framework is not present.");
937 return;
938 }
939 # endif /* __APPLE__ */
940
941 con->gss_output_token.length = 0;
942
943 /*
944 * Find the start of the Kerberos input token...
945 */
946
947 authorization += 9;
948 while (isspace(*authorization & 255))
949 authorization ++;
950
951 if (!*authorization)
952 {
953 cupsdLogMessage(CUPSD_LOG_DEBUG2,
954 "cupsdAuthorize: No authentication data specified.");
955 return;
956 }
957
958 /*
959 * Get the server credentials...
960 */
961
962 if ((server_creds = get_gss_creds(GSSServiceName)) == NULL)
963 {
964 con->no_negotiate = 1;
965 return;
966 }
967
968 /*
969 * Decode the authorization string to get the input token...
970 */
971
972 len = strlen(authorization);
973 input_token.value = malloc(len);
974 input_token.value = httpDecode64_2(input_token.value, &len,
975 authorization);
976 input_token.length = len;
977
978 /*
979 * Accept the input token to get the authorization info...
980 */
981
982 context = GSS_C_NO_CONTEXT;
983 client_name = GSS_C_NO_NAME;
984 major_status = gss_accept_sec_context(&minor_status,
985 &context,
986 server_creds,
987 &input_token,
988 GSS_C_NO_CHANNEL_BINDINGS,
989 &client_name,
990 NULL,
991 &con->gss_output_token,
992 NULL,
993 NULL,
994 &con->gss_delegated_cred);
995
996 if (GSS_ERROR(major_status))
997 {
998 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
999 "cupsdAuthorize: Error accepting GSSAPI security "
1000 "context");
1001
1002 if (context != GSS_C_NO_CONTEXT)
1003 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1004
1005 con->no_negotiate = 1;
1006 return;
1007 }
1008
1009 /*
1010 * Get the username associated with the credentials...
1011 */
1012
1013 if (!con->gss_delegated_cred)
1014 cupsdLogMessage(CUPSD_LOG_DEBUG,
1015 "cupsdAuthorize: No delegated credentials!");
1016
1017 if (major_status == GSS_S_CONTINUE_NEEDED)
1018 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1019 "cupsdAuthorize: Credentials not complete");
1020 else if (major_status == GSS_S_COMPLETE)
1021 {
1022 major_status = gss_display_name(&minor_status, client_name,
1023 &output_token, NULL);
1024
1025 if (GSS_ERROR(major_status))
1026 {
1027 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1028 "cupsdAuthorize: Error getting username");
1029 gss_release_name(&minor_status, &client_name);
1030 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1031 con->no_negotiate = 1;
1032 return;
1033 }
1034
1035 gss_release_name(&minor_status, &client_name);
1036 strlcpy(username, output_token.value, sizeof(username));
1037 if ((ptr = strchr(username, '@')) != NULL)
1038 *ptr = '\0'; /* Strip @KDC from the username */
1039
1040 cupsdLogMessage(CUPSD_LOG_DEBUG,
1041 "cupsdAuthorize: Authorized as %s using Negotiate",
1042 username);
1043
1044 gss_release_buffer(&minor_status, &output_token);
1045 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1046
1047 con->gss_have_creds = 1;
1048 }
1049 else
1050 gss_release_name(&minor_status, &client_name);
1051 }
1052 #endif /* HAVE_GSSAPI */
1053 else if (type != AUTH_NONE)
1054 {
1055 char scheme[256]; /* Auth scheme... */
1056 static const char * const types[] = /* Auth types */
1057 {
1058 "None",
1059 "Basic",
1060 "Digest",
1061 "BasicDigest",
1062 "Negotiate"
1063 };
1064
1065
1066 if (sscanf(authorization, "%255s", scheme) != 1)
1067 strcpy(scheme, "UNKNOWN");
1068
1069 cupsdLogMessage(CUPSD_LOG_ERROR,
1070 "Bad authentication data \"%s ...\", expected \"%s ...\"",
1071 scheme, types[type]);
1072 return;
1073 }
1074
1075 /*
1076 * If we get here, then we were able to validate the username and
1077 * password - copy the validated username and password to the client
1078 * data and return...
1079 */
1080
1081 strlcpy(con->username, username, sizeof(con->username));
1082 strlcpy(con->password, password, sizeof(con->password));
1083 }
1084
1085
1086 /*
1087 * 'cupsdCheckAuth()' - Check authorization masks.
1088 */
1089
1090 int /* O - 1 if mask matches, 0 otherwise */
1091 cupsdCheckAuth(
1092 unsigned ip[4], /* I - Client address */
1093 char *name, /* I - Client hostname */
1094 int name_len, /* I - Length of hostname */
1095 int num_masks, /* I - Number of masks */
1096 cupsd_authmask_t *masks) /* I - Masks */
1097 {
1098 int i; /* Looping var */
1099 cupsd_netif_t *iface; /* Network interface */
1100 unsigned netip4; /* IPv4 network address */
1101 #ifdef AF_INET6
1102 unsigned netip6[4]; /* IPv6 network address */
1103 #endif /* AF_INET6 */
1104
1105 while (num_masks > 0)
1106 {
1107 switch (masks->type)
1108 {
1109 case AUTH_INTERFACE :
1110 /*
1111 * Check for a match with a network interface...
1112 */
1113
1114 netip4 = htonl(ip[3]);
1115
1116 #ifdef AF_INET6
1117 netip6[0] = htonl(ip[0]);
1118 netip6[1] = htonl(ip[1]);
1119 netip6[2] = htonl(ip[2]);
1120 netip6[3] = htonl(ip[3]);
1121 #endif /* AF_INET6 */
1122
1123 if (!strcmp(masks->mask.name.name, "*"))
1124 {
1125 /*
1126 * Check against all local interfaces...
1127 */
1128
1129 cupsdNetIFUpdate();
1130
1131 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1132 iface;
1133 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1134 {
1135 /*
1136 * Only check local interfaces...
1137 */
1138
1139 if (!iface->is_local)
1140 continue;
1141
1142 if (iface->address.addr.sa_family == AF_INET)
1143 {
1144 /*
1145 * Check IPv4 address...
1146 */
1147
1148 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1149 (iface->address.ipv4.sin_addr.s_addr &
1150 iface->mask.ipv4.sin_addr.s_addr))
1151 return (1);
1152 }
1153 #ifdef AF_INET6
1154 else
1155 {
1156 /*
1157 * Check IPv6 address...
1158 */
1159
1160 for (i = 0; i < 4; i ++)
1161 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1162 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1163 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1164 break;
1165
1166 if (i == 4)
1167 return (1);
1168 }
1169 #endif /* AF_INET6 */
1170 }
1171 }
1172 else
1173 {
1174 /*
1175 * Check the named interface...
1176 */
1177
1178 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1179 iface;
1180 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1181 {
1182 if (strcmp(masks->mask.name.name, iface->name))
1183 continue;
1184
1185 if (iface->address.addr.sa_family == AF_INET)
1186 {
1187 /*
1188 * Check IPv4 address...
1189 */
1190
1191 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1192 (iface->address.ipv4.sin_addr.s_addr &
1193 iface->mask.ipv4.sin_addr.s_addr))
1194 return (1);
1195 }
1196 #ifdef AF_INET6
1197 else
1198 {
1199 /*
1200 * Check IPv6 address...
1201 */
1202
1203 for (i = 0; i < 4; i ++)
1204 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1205 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1206 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1207 break;
1208
1209 if (i == 4)
1210 return (1);
1211 }
1212 #endif /* AF_INET6 */
1213 }
1214 }
1215 break;
1216
1217 case AUTH_NAME :
1218 /*
1219 * Check for exact name match...
1220 */
1221
1222 if (!strcasecmp(name, masks->mask.name.name))
1223 return (1);
1224
1225 /*
1226 * Check for domain match...
1227 */
1228
1229 if (name_len >= masks->mask.name.length &&
1230 masks->mask.name.name[0] == '.' &&
1231 !strcasecmp(name + name_len - masks->mask.name.length,
1232 masks->mask.name.name))
1233 return (1);
1234 break;
1235
1236 case AUTH_IP :
1237 /*
1238 * Check for IP/network address match...
1239 */
1240
1241 for (i = 0; i < 4; i ++)
1242 if ((ip[i] & masks->mask.ip.netmask[i]) !=
1243 masks->mask.ip.address[i])
1244 break;
1245
1246 if (i == 4)
1247 return (1);
1248 break;
1249 }
1250
1251 masks ++;
1252 num_masks --;
1253 }
1254
1255 return (0);
1256 }
1257
1258
1259 /*
1260 * 'cupsdCheckGroup()' - Check for a user's group membership.
1261 */
1262
1263 int /* O - 1 if user is a member, 0 otherwise */
1264 cupsdCheckGroup(
1265 const char *username, /* I - User name */
1266 struct passwd *user, /* I - System user info */
1267 const char *groupname) /* I - Group name */
1268 {
1269 int i; /* Looping var */
1270 struct group *group; /* System group info */
1271 char junk[33]; /* MD5 password (not used) */
1272 #ifdef HAVE_MBR_UID_TO_UUID
1273 uuid_t useruuid, /* UUID for username */
1274 groupuuid; /* UUID for groupname */
1275 int is_member; /* True if user is a member of group */
1276 #endif /* HAVE_MBR_UID_TO_UUID */
1277
1278
1279 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1280 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1281 username, user, groupname);
1282
1283 /*
1284 * Validate input...
1285 */
1286
1287 if (!username || !groupname)
1288 return (0);
1289
1290 /*
1291 * Check to see if the user is a member of the named group...
1292 */
1293
1294 group = getgrnam(groupname);
1295 endgrent();
1296
1297 if (group != NULL)
1298 {
1299 /*
1300 * Group exists, check it...
1301 */
1302
1303 for (i = 0; group->gr_mem[i]; i ++)
1304 if (!strcasecmp(username, group->gr_mem[i]))
1305 return (1);
1306 }
1307
1308 /*
1309 * Group doesn't exist or user not in group list, check the group ID
1310 * against the user's group ID...
1311 */
1312
1313 if (user && group && group->gr_gid == user->pw_gid)
1314 return (1);
1315
1316 #ifdef HAVE_MBR_UID_TO_UUID
1317 /*
1318 * Check group membership through MacOS X membership API...
1319 */
1320
1321 if (user && group)
1322 if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1323 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1324 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1325 if (is_member)
1326 return (1);
1327 #endif /* HAVE_MBR_UID_TO_UUID */
1328
1329 /*
1330 * Username not found, group not found, or user is not part of the
1331 * system group... Check for a user and group in the MD5 password
1332 * file...
1333 */
1334
1335 if (get_md5_password(username, groupname, junk) != NULL)
1336 return (1);
1337
1338 /*
1339 * If we get this far, then the user isn't part of the named group...
1340 */
1341
1342 return (0);
1343 }
1344
1345
1346 /*
1347 * 'cupsdCopyLocation()' - Make a copy of a location...
1348 */
1349
1350 cupsd_location_t * /* O - New location */
1351 cupsdCopyLocation(
1352 cupsd_location_t **loc) /* IO - Original location */
1353 {
1354 int i; /* Looping var */
1355 cupsd_location_t *temp; /* New location */
1356 char location[HTTP_MAX_URI];
1357 /* Location of resource */
1358
1359
1360 /*
1361 * Use a local copy of location because cupsdAddLocation may cause
1362 * this memory to be moved...
1363 */
1364
1365 strlcpy(location, (*loc)->location, sizeof(location));
1366
1367 if ((temp = cupsdAddLocation(location)) == NULL)
1368 return (NULL);
1369
1370 /*
1371 * Copy the information from the original location to the new one.
1372 */
1373
1374 temp->limit = (*loc)->limit;
1375 temp->order_type = (*loc)->order_type;
1376 temp->type = (*loc)->type;
1377 temp->level = (*loc)->level;
1378 temp->satisfy = (*loc)->satisfy;
1379 temp->encryption = (*loc)->encryption;
1380
1381 if ((temp->num_names = (*loc)->num_names) > 0)
1382 {
1383 /*
1384 * Copy the names array...
1385 */
1386
1387 if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1388 {
1389 cupsdLogMessage(CUPSD_LOG_ERROR,
1390 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1391 temp->num_names, strerror(errno));
1392
1393 cupsdDeleteLocation(temp);
1394 return (NULL);
1395 }
1396
1397 for (i = 0; i < temp->num_names; i ++)
1398 if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1399 {
1400 cupsdLogMessage(CUPSD_LOG_ERROR,
1401 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1402 (*loc)->names[i], strerror(errno));
1403
1404 cupsdDeleteLocation(temp);
1405 return (NULL);
1406 }
1407 }
1408
1409 if ((temp->num_allow = (*loc)->num_allow) > 0)
1410 {
1411 /*
1412 * Copy allow rules...
1413 */
1414
1415 if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1416 {
1417 cupsdLogMessage(CUPSD_LOG_ERROR,
1418 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1419 temp->num_allow, strerror(errno));
1420 cupsdDeleteLocation(temp);
1421 return (NULL);
1422 }
1423
1424 for (i = 0; i < temp->num_allow; i ++)
1425 switch (temp->allow[i].type = (*loc)->allow[i].type)
1426 {
1427 case AUTH_NAME :
1428 temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1429 temp->allow[i].mask.name.name = strdup((*loc)->allow[i].mask.name.name);
1430
1431 if (temp->allow[i].mask.name.name == NULL)
1432 {
1433 cupsdLogMessage(CUPSD_LOG_ERROR,
1434 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1435 (*loc)->allow[i].mask.name.name, strerror(errno));
1436 cupsdDeleteLocation(temp);
1437 return (NULL);
1438 }
1439 break;
1440 case AUTH_IP :
1441 memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1442 sizeof(cupsd_ipmask_t));
1443 break;
1444 }
1445 }
1446
1447 if ((temp->num_deny = (*loc)->num_deny) > 0)
1448 {
1449 /*
1450 * Copy deny rules...
1451 */
1452
1453 if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1454 {
1455 cupsdLogMessage(CUPSD_LOG_ERROR,
1456 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1457 temp->num_deny, strerror(errno));
1458 cupsdDeleteLocation(temp);
1459 return (NULL);
1460 }
1461
1462 for (i = 0; i < temp->num_deny; i ++)
1463 switch (temp->deny[i].type = (*loc)->deny[i].type)
1464 {
1465 case AUTH_NAME :
1466 temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1467 temp->deny[i].mask.name.name = strdup((*loc)->deny[i].mask.name.name);
1468
1469 if (temp->deny[i].mask.name.name == NULL)
1470 {
1471 cupsdLogMessage(CUPSD_LOG_ERROR,
1472 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1473 (*loc)->deny[i].mask.name.name, strerror(errno));
1474 cupsdDeleteLocation(temp);
1475 return (NULL);
1476 }
1477 break;
1478 case AUTH_IP :
1479 memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1480 sizeof(cupsd_ipmask_t));
1481 break;
1482 }
1483 }
1484
1485 return (temp);
1486 }
1487
1488
1489 /*
1490 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1491 */
1492
1493 void
1494 cupsdDeleteAllLocations(void)
1495 {
1496 cupsd_location_t *loc; /* Current location */
1497
1498
1499 /*
1500 * Free all of the allow/deny records first...
1501 */
1502
1503 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1504 loc;
1505 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1506 cupsdDeleteLocation(loc);
1507
1508 /*
1509 * Then free the location array...
1510 */
1511
1512 cupsArrayDelete(Locations);
1513 Locations = NULL;
1514 }
1515
1516
1517 /*
1518 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1519 */
1520
1521 void
1522 cupsdDeleteLocation(
1523 cupsd_location_t *loc) /* I - Location to delete */
1524 {
1525 int i; /* Looping var */
1526 cupsd_authmask_t *mask; /* Current mask */
1527
1528
1529 cupsArrayRemove(Locations, loc);
1530
1531 for (i = loc->num_names - 1; i >= 0; i --)
1532 free(loc->names[i]);
1533
1534 if (loc->num_names > 0)
1535 free(loc->names);
1536
1537 for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1538 if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1539 free(mask->mask.name.name);
1540
1541 if (loc->num_allow > 0)
1542 free(loc->allow);
1543
1544 for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1545 if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1546 free(mask->mask.name.name);
1547
1548 if (loc->num_deny > 0)
1549 free(loc->deny);
1550
1551 free(loc->location);
1552 free(loc);
1553 }
1554
1555
1556 /*
1557 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1558 * location.
1559 */
1560
1561 void
1562 cupsdDenyHost(cupsd_location_t *loc, /* I - Location to add to */
1563 char *name) /* I - Name of host or domain to add */
1564 {
1565 cupsd_authmask_t *temp; /* New host/domain mask */
1566 char ifname[32], /* Interface name */
1567 *ifptr; /* Pointer to end of name */
1568
1569
1570 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1571 loc, loc->location ? loc->location : "nil", name);
1572
1573 if ((temp = add_deny(loc)) == NULL)
1574 return;
1575
1576 if (!strcasecmp(name, "@LOCAL"))
1577 {
1578 /*
1579 * Deny *interface*...
1580 */
1581
1582 temp->type = AUTH_INTERFACE;
1583 temp->mask.name.name = strdup("*");
1584 temp->mask.name.length = 1;
1585 }
1586 else if (!strncasecmp(name, "@IF(", 4))
1587 {
1588 /*
1589 * Deny *interface*...
1590 */
1591
1592 strlcpy(ifname, name + 4, sizeof(ifname));
1593
1594 ifptr = ifname + strlen(ifname);
1595
1596 if (ifptr[-1] == ')')
1597 {
1598 ifptr --;
1599 *ifptr = '\0';
1600 }
1601
1602 temp->type = AUTH_INTERFACE;
1603 temp->mask.name.name = strdup(ifname);
1604 temp->mask.name.length = ifptr - ifname;
1605 }
1606 else
1607 {
1608 /*
1609 * Deny name...
1610 */
1611
1612 temp->type = AUTH_NAME;
1613 temp->mask.name.name = strdup(name);
1614 temp->mask.name.length = strlen(name);
1615 }
1616 }
1617
1618
1619 /*
1620 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1621 * access the location.
1622 */
1623
1624 void
1625 cupsdDenyIP(cupsd_location_t *loc, /* I - Location to add to */
1626 unsigned address[4],/* I - IP address to add */
1627 unsigned netmask[4])/* I - Netmask of address */
1628 {
1629 cupsd_authmask_t *temp; /* New host/domain mask */
1630
1631
1632 cupsdLogMessage(CUPSD_LOG_DEBUG,
1633 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1634 loc, loc->location ? loc->location : "nil",
1635 address[0], address[1], address[2], address[3],
1636 netmask[0], netmask[1], netmask[2], netmask[3]);
1637
1638 if ((temp = add_deny(loc)) == NULL)
1639 return;
1640
1641 temp->type = AUTH_IP;
1642 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1643 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1644 }
1645
1646
1647 /*
1648 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1649 */
1650
1651 cupsd_location_t * /* O - Location that matches */
1652 cupsdFindBest(const char *path, /* I - Resource path */
1653 http_state_t state) /* I - HTTP state/request */
1654 {
1655 char uri[HTTP_MAX_URI],
1656 /* URI in request... */
1657 *uriptr; /* Pointer into URI */
1658 cupsd_location_t *loc, /* Current location */
1659 *best; /* Best match for location so far */
1660 int bestlen; /* Length of best match */
1661 int limit; /* Limit field */
1662 static const int limits[] = /* Map http_status_t to AUTH_LIMIT_xyz */
1663 {
1664 AUTH_LIMIT_ALL,
1665 AUTH_LIMIT_OPTIONS,
1666 AUTH_LIMIT_GET,
1667 AUTH_LIMIT_GET,
1668 AUTH_LIMIT_HEAD,
1669 AUTH_LIMIT_POST,
1670 AUTH_LIMIT_POST,
1671 AUTH_LIMIT_POST,
1672 AUTH_LIMIT_PUT,
1673 AUTH_LIMIT_PUT,
1674 AUTH_LIMIT_DELETE,
1675 AUTH_LIMIT_TRACE,
1676 AUTH_LIMIT_ALL,
1677 AUTH_LIMIT_ALL
1678 };
1679
1680
1681 /*
1682 * First copy the connection URI to a local string so we have drop
1683 * any .ppd extension from the pathname in /printers or /classes
1684 * URIs...
1685 */
1686
1687 strlcpy(uri, path, sizeof(uri));
1688
1689 if (!strncmp(uri, "/printers/", 10) ||
1690 !strncmp(uri, "/classes/", 9))
1691 {
1692 /*
1693 * Check if the URI has .ppd on the end...
1694 */
1695
1696 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1697
1698 if (!strcmp(uriptr, ".ppd"))
1699 *uriptr = '\0';
1700 }
1701
1702 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1703
1704 /*
1705 * Loop through the list of locations to find a match...
1706 */
1707
1708 limit = limits[state];
1709 best = NULL;
1710 bestlen = 0;
1711
1712 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1713 loc;
1714 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1715 {
1716 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1717 loc->location ? loc->location : "nil", loc->limit);
1718
1719 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1720 {
1721 /*
1722 * Use case-insensitive comparison for queue names...
1723 */
1724
1725 if (loc->length > bestlen && loc->location &&
1726 !strncasecmp(uri, loc->location, loc->length) &&
1727 loc->location[0] == '/' &&
1728 (limit & loc->limit) != 0)
1729 {
1730 best = loc;
1731 bestlen = loc->length;
1732 }
1733 }
1734 else
1735 {
1736 /*
1737 * Use case-sensitive comparison for other URIs...
1738 */
1739
1740 if (loc->length > bestlen && loc->location &&
1741 !strncmp(uri, loc->location, loc->length) &&
1742 loc->location[0] == '/' &&
1743 (limit & loc->limit) != 0)
1744 {
1745 best = loc;
1746 bestlen = loc->length;
1747 }
1748 }
1749 }
1750
1751 /*
1752 * Return the match, if any...
1753 */
1754
1755 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1756 best ? best->location : "NONE");
1757
1758 return (best);
1759 }
1760
1761
1762 /*
1763 * 'cupsdFindLocation()' - Find the named location.
1764 */
1765
1766 cupsd_location_t * /* O - Location that matches */
1767 cupsdFindLocation(const char *location) /* I - Connection */
1768 {
1769 cupsd_location_t key; /* Search key */
1770
1771
1772 key.location = (char *)location;
1773
1774 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1775 }
1776
1777
1778 /*
1779 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1780 */
1781
1782 http_status_t /* O - HTTP_OK if authorized or error code */
1783 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1784 const char *owner)/* I - Owner of object */
1785 {
1786 int i, j, /* Looping vars */
1787 auth; /* Authorization status */
1788 unsigned address[4]; /* Authorization address */
1789 cupsd_location_t *best; /* Best match for location so far */
1790 int hostlen; /* Length of hostname */
1791 const char *username; /* Username to authorize */
1792 struct passwd *pw; /* User password data */
1793 static const char * const levels[] = /* Auth levels */
1794 {
1795 "ANON",
1796 "USER",
1797 "GROUP"
1798 };
1799 static const char * const types[] = /* Auth types */
1800 {
1801 "NONE",
1802 "BASIC",
1803 "DIGEST",
1804 "BASICDIGEST",
1805 "KERBEROS"
1806 };
1807
1808
1809 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1810 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1811 con->uri, con->best, con->best ? con->best->location ?
1812 con->best->location : "(null)" : "");
1813 if (owner)
1814 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1815 "cupsdIsAuthorized: owner=\"%s\"", owner);
1816
1817 /*
1818 * If there is no "best" authentication rule for this request, then
1819 * access is allowed from the local system and denied from other
1820 * addresses...
1821 */
1822
1823 if (!con->best)
1824 {
1825 if (!strcmp(con->http.hostname, "localhost") ||
1826 !strcmp(con->http.hostname, ServerName))
1827 return (HTTP_OK);
1828 else
1829 return (HTTP_FORBIDDEN);
1830 }
1831
1832 best = con->best;
1833
1834 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1835 "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, "
1836 "satisfy=AUTH_SATISFY_%s, num_names=%d",
1837 levels[best->level], types[best->type],
1838 best->satisfy ? "ANY" : "ALL", best->num_names);
1839
1840 if (best->limit == AUTH_LIMIT_IPP)
1841 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1842 best->op, ippOpString(best->op));
1843
1844 /*
1845 * Check host/ip-based accesses...
1846 */
1847
1848 #ifdef AF_INET6
1849 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1850 {
1851 /*
1852 * Copy IPv6 address...
1853 */
1854
1855 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1856 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1857 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1858 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1859 }
1860 else
1861 #endif /* AF_INET6 */
1862 if (con->http.hostaddr->addr.sa_family == AF_INET)
1863 {
1864 /*
1865 * Copy IPv4 address...
1866 */
1867
1868 address[0] = 0;
1869 address[1] = 0;
1870 address[2] = 0;
1871 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1872 }
1873 else
1874 memset(address, 0, sizeof(address));
1875
1876 hostlen = strlen(con->http.hostname);
1877
1878 if (!strcasecmp(con->http.hostname, "localhost"))
1879 {
1880 /*
1881 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1882 */
1883
1884 auth = AUTH_ALLOW;
1885 }
1886 else
1887 {
1888 /*
1889 * Do authorization checks on the domain/address...
1890 */
1891
1892 switch (best->order_type)
1893 {
1894 default :
1895 auth = AUTH_DENY; /* anti-compiler-warning-code */
1896 break;
1897
1898 case AUTH_ALLOW : /* Order Deny,Allow */
1899 auth = AUTH_ALLOW;
1900
1901 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1902 best->num_deny, best->deny))
1903 auth = AUTH_DENY;
1904
1905 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1906 best->num_allow, best->allow))
1907 auth = AUTH_ALLOW;
1908 break;
1909
1910 case AUTH_DENY : /* Order Allow,Deny */
1911 auth = AUTH_DENY;
1912
1913 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1914 best->num_allow, best->allow))
1915 auth = AUTH_ALLOW;
1916
1917 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1918 best->num_deny, best->deny))
1919 auth = AUTH_DENY;
1920 break;
1921 }
1922 }
1923
1924 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1925 auth ? "DENY" : "ALLOW");
1926
1927 if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1928 return (HTTP_FORBIDDEN);
1929
1930 #ifdef HAVE_SSL
1931 /*
1932 * See if encryption is required...
1933 */
1934
1935 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1936 strcasecmp(con->http.hostname, "localhost") &&
1937 best->satisfy == AUTH_SATISFY_ALL) &&
1938 !(best->type == AUTH_NEGOTIATE ||
1939 (best->type == AUTH_NONE && DefaultAuthType == AUTH_NEGOTIATE)))
1940 {
1941 cupsdLogMessage(CUPSD_LOG_DEBUG,
1942 "cupsdIsAuthorized: Need upgrade to TLS...");
1943 return (HTTP_UPGRADE_REQUIRED);
1944 }
1945 #endif /* HAVE_SSL */
1946
1947 /*
1948 * Now see what access level is required...
1949 */
1950
1951 if (best->level == AUTH_ANON || /* Anonymous access - allow it */
1952 (best->type == AUTH_NONE && best->num_names == 0))
1953 return (HTTP_OK);
1954
1955 if (!con->username[0] && best->type == AUTH_NONE &&
1956 best->limit == AUTH_LIMIT_IPP)
1957 {
1958 /*
1959 * Check for unauthenticated username...
1960 */
1961
1962 ipp_attribute_t *attr; /* requesting-user-name attribute */
1963
1964
1965 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1966 if (attr)
1967 {
1968 cupsdLogMessage(CUPSD_LOG_DEBUG,
1969 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1970 attr->values[0].string.text);
1971 username = attr->values[0].string.text;
1972 }
1973 else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1974 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1975 else
1976 return (HTTP_OK); /* unless overridden with Satisfy */
1977 }
1978 else
1979 {
1980 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1981 con->username);
1982
1983 #ifdef HAVE_AUTHORIZATION_H
1984 if (!con->username[0] && !con->authref)
1985 #else
1986 if (!con->username[0])
1987 #endif /* HAVE_AUTHORIZATION_H */
1988 {
1989 if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
1990 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1991 else
1992 return (HTTP_OK); /* unless overridden with Satisfy */
1993 }
1994
1995 username = con->username;
1996 }
1997
1998 /*
1999 * OK, got a username. See if we need normal user access, or group
2000 * access... (root always matches)
2001 */
2002
2003 if (!strcmp(username, "root"))
2004 return (HTTP_OK);
2005
2006 /*
2007 * Get the user info...
2008 */
2009
2010 if (username[0])
2011 {
2012 pw = getpwnam(username);
2013 endpwent();
2014 }
2015 else
2016 pw = NULL;
2017
2018 if (best->level == AUTH_USER)
2019 {
2020 /*
2021 * If there are no names associated with this location, then
2022 * any valid user is OK...
2023 */
2024
2025 if (best->num_names == 0)
2026 return (HTTP_OK);
2027
2028 /*
2029 * Otherwise check the user list and return OK if this user is
2030 * allowed...
2031 */
2032
2033 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2034 "cupsdIsAuthorized: Checking user membership...");
2035
2036 #ifdef HAVE_AUTHORIZATION_H
2037 /*
2038 * If an authorization reference was supplied it must match a right name...
2039 */
2040
2041 if (con->authref)
2042 {
2043 for (i = 0; i < best->num_names; i ++)
2044 {
2045 if (!strncasecmp(best->names[i], "@AUTHKEY(", 9) &&
2046 check_authref(con, best->names[i] + 9))
2047 return (HTTP_OK);
2048 else if (!strcasecmp(best->names[i], "@SYSTEM") &&
2049 SystemGroupAuthKey &&
2050 check_authref(con, SystemGroupAuthKey))
2051 return (HTTP_OK);
2052 }
2053
2054 return (HTTP_UNAUTHORIZED);
2055 }
2056 #endif /* HAVE_AUTHORIZATION_H */
2057
2058 for (i = 0; i < best->num_names; i ++)
2059 {
2060 if (!strcasecmp(best->names[i], "@OWNER") && owner &&
2061 !strcasecmp(username, owner))
2062 return (HTTP_OK);
2063 else if (!strcasecmp(best->names[i], "@SYSTEM"))
2064 {
2065 for (j = 0; j < NumSystemGroups; j ++)
2066 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2067 return (HTTP_OK);
2068 }
2069 else if (best->names[i][0] == '@')
2070 {
2071 if (cupsdCheckGroup(username, pw, best->names[i] + 1))
2072 return (HTTP_OK);
2073 }
2074 else if (!strcasecmp(username, best->names[i]))
2075 return (HTTP_OK);
2076 }
2077
2078 return (HTTP_UNAUTHORIZED);
2079 }
2080
2081 /*
2082 * Check to see if this user is in any of the named groups...
2083 */
2084
2085 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2086 "cupsdIsAuthorized: Checking group membership...");
2087
2088 /*
2089 * Check to see if this user is in any of the named groups...
2090 */
2091
2092 for (i = 0; i < best->num_names; i ++)
2093 {
2094 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2095 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2096 best->names[i]);
2097
2098 if (!strcasecmp(best->names[i], "@SYSTEM"))
2099 {
2100 for (j = 0; j < NumSystemGroups; j ++)
2101 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2102 return (HTTP_OK);
2103 }
2104 else if (cupsdCheckGroup(username, pw, best->names[i]))
2105 return (HTTP_OK);
2106 }
2107
2108 /*
2109 * The user isn't part of the specified group, so deny access...
2110 */
2111
2112 cupsdLogMessage(CUPSD_LOG_DEBUG,
2113 "cupsdIsAuthorized: User not in group(s)!");
2114
2115 return (HTTP_UNAUTHORIZED);
2116 }
2117
2118
2119 /*
2120 * 'add_allow()' - Add an allow mask to the location.
2121 */
2122
2123 static cupsd_authmask_t * /* O - New mask record */
2124 add_allow(cupsd_location_t *loc) /* I - Location to add to */
2125 {
2126 cupsd_authmask_t *temp; /* New mask record */
2127
2128
2129 /*
2130 * Range-check...
2131 */
2132
2133 if (loc == NULL)
2134 return (NULL);
2135
2136 /*
2137 * Try to allocate memory for the record...
2138 */
2139
2140 if (loc->num_allow == 0)
2141 temp = malloc(sizeof(cupsd_authmask_t));
2142 else
2143 temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
2144
2145 if (temp == NULL)
2146 return (NULL);
2147
2148 loc->allow = temp;
2149 temp += loc->num_allow;
2150 loc->num_allow ++;
2151
2152 /*
2153 * Clear the mask record and return...
2154 */
2155
2156 memset(temp, 0, sizeof(cupsd_authmask_t));
2157 return (temp);
2158 }
2159
2160
2161 /*
2162 * 'add_deny()' - Add a deny mask to the location.
2163 */
2164
2165 static cupsd_authmask_t * /* O - New mask record */
2166 add_deny(cupsd_location_t *loc) /* I - Location to add to */
2167 {
2168 cupsd_authmask_t *temp; /* New mask record */
2169
2170
2171 /*
2172 * Range-check...
2173 */
2174
2175 if (loc == NULL)
2176 return (NULL);
2177
2178 /*
2179 * Try to allocate memory for the record...
2180 */
2181
2182 if (loc->num_deny == 0)
2183 temp = malloc(sizeof(cupsd_authmask_t));
2184 else
2185 temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
2186
2187 if (temp == NULL)
2188 return (NULL);
2189
2190 loc->deny = temp;
2191 temp += loc->num_deny;
2192 loc->num_deny ++;
2193
2194 /*
2195 * Clear the mask record and return...
2196 */
2197
2198 memset(temp, 0, sizeof(cupsd_authmask_t));
2199 return (temp);
2200 }
2201
2202
2203 #ifdef HAVE_AUTHORIZATION_H
2204 /*
2205 * 'check_authref()' - Check if an authorization services reference has the
2206 * supplied right.
2207 */
2208
2209 static int /* O - 1 if right is valid, 0 otherwise */
2210 check_authref(cupsd_client_t *con, /* I - Connection */
2211 const char *right) /* I - Right name */
2212 {
2213 OSStatus status; /* OS Status */
2214 AuthorizationItem authright; /* Authorization right */
2215 AuthorizationRights authrights; /* Authorization rights */
2216 AuthorizationFlags authflags; /* Authorization flags */
2217
2218
2219 /*
2220 * Check to see if the user is allowed to perform the task...
2221 */
2222
2223 if (!con->authref)
2224 return (0);
2225
2226 authright.name = right;
2227 authright.valueLength = 0;
2228 authright.value = NULL;
2229 authright.flags = 0;
2230
2231 authrights.count = 1;
2232 authrights.items = &authright;
2233
2234 authflags = kAuthorizationFlagDefaults |
2235 kAuthorizationFlagExtendRights;
2236
2237 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2238 kAuthorizationEmptyEnvironment,
2239 authflags, NULL)) != 0)
2240 {
2241 cupsdLogMessage(CUPSD_LOG_ERROR,
2242 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2243 authright.name, (int)status, cssmErrorString(status));
2244 return (0);
2245 }
2246
2247 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2248 "AuthorizationCopyRights(\"%s\") succeeded!",
2249 authright.name);
2250
2251 return (1);
2252 }
2253 #endif /* HAVE_AUTHORIZATION_H */
2254
2255
2256 /*
2257 * 'compare_locations()' - Compare two locations.
2258 */
2259
2260 static int /* O - Result of comparison */
2261 compare_locations(cupsd_location_t *a, /* I - First location */
2262 cupsd_location_t *b) /* I - Second location */
2263 {
2264 return (strcmp(b->location, a->location));
2265 }
2266
2267
2268 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2269 /*
2270 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2271 * as needed.
2272 */
2273
2274 static char * /* O - Encrypted password */
2275 cups_crypt(const char *pw, /* I - Password string */
2276 const char *salt) /* I - Salt (key) string */
2277 {
2278 if (!strncmp(salt, "$1$", 3))
2279 {
2280 /*
2281 * Use MD5 passwords without the benefit of PAM; this is for
2282 * Slackware Linux, and the algorithm was taken from the
2283 * old shadow-19990827/lib/md5crypt.c source code... :(
2284 */
2285
2286 int i; /* Looping var */
2287 unsigned long n; /* Output number */
2288 int pwlen; /* Length of password string */
2289 const char *salt_end; /* End of "salt" data for MD5 */
2290 char *ptr; /* Pointer into result string */
2291 _cups_md5_state_t state; /* Primary MD5 state info */
2292 _cups_md5_state_t state2; /* Secondary MD5 state info */
2293 unsigned char digest[16]; /* MD5 digest result */
2294 static char result[120]; /* Final password string */
2295
2296
2297 /*
2298 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2299 * Get a maximum of 8 characters of salt data after $1$...
2300 */
2301
2302 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2303 if (*salt_end == '$')
2304 break;
2305
2306 /*
2307 * Compute the MD5 sum we need...
2308 */
2309
2310 pwlen = strlen(pw);
2311
2312 _cupsMD5Init(&state);
2313 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2314 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2315
2316 _cupsMD5Init(&state2);
2317 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2318 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2319 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2320 _cupsMD5Finish(&state2, digest);
2321
2322 for (i = pwlen; i > 0; i -= 16)
2323 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2324
2325 for (i = pwlen; i > 0; i >>= 1)
2326 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2327
2328 _cupsMD5Finish(&state, digest);
2329
2330 for (i = 0; i < 1000; i ++)
2331 {
2332 _cupsMD5Init(&state);
2333
2334 if (i & 1)
2335 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2336 else
2337 _cupsMD5Append(&state, digest, 16);
2338
2339 if (i % 3)
2340 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2341
2342 if (i % 7)
2343 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2344
2345 if (i & 1)
2346 _cupsMD5Append(&state, digest, 16);
2347 else
2348 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2349
2350 _cupsMD5Finish(&state, digest);
2351 }
2352
2353 /*
2354 * Copy the final sum to the result string and return...
2355 */
2356
2357 memcpy(result, salt, salt_end - salt);
2358 ptr = result + (salt_end - salt);
2359 *ptr++ = '$';
2360
2361 for (i = 0; i < 5; i ++, ptr += 4)
2362 {
2363 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2364
2365 if (i < 4)
2366 n |= digest[i + 12];
2367 else
2368 n |= digest[5];
2369
2370 to64(ptr, n, 4);
2371 }
2372
2373 to64(ptr, digest[11], 2);
2374 ptr += 2;
2375 *ptr = '\0';
2376
2377 return (result);
2378 }
2379 else
2380 {
2381 /*
2382 * Use the standard crypt() function...
2383 */
2384
2385 return (crypt(pw, salt));
2386 }
2387 }
2388 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2389
2390
2391 #ifdef HAVE_GSSAPI
2392 /*
2393 * 'get_gss_creds()' - Obtain GSS credentials.
2394 */
2395
2396 static gss_cred_id_t /* O - Server credentials */
2397 get_gss_creds(const char *service_name) /* I - Service name */
2398 {
2399 OM_uint32 major_status, /* Major status code */
2400 minor_status; /* Minor status code */
2401 gss_name_t server_name; /* Server name */
2402 gss_cred_id_t server_creds; /* Server credentials */
2403 gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
2404 /* Service name token */
2405 char buf[1024], /* Service name buffer */
2406 fqdn[HTTP_MAX_URI]; /* Hostname of server */
2407
2408
2409 snprintf(buf, sizeof(buf), "%s@%s", service_name,
2410 httpGetHostname(NULL, fqdn, sizeof(fqdn)));
2411
2412 token.value = buf;
2413 token.length = strlen(buf);
2414 server_name = GSS_C_NO_NAME;
2415 major_status = gss_import_name(&minor_status, &token,
2416 GSS_C_NT_HOSTBASED_SERVICE,
2417 &server_name);
2418
2419 memset(&token, 0, sizeof(token));
2420
2421 if (GSS_ERROR(major_status))
2422 {
2423 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2424 "gss_import_name() failed");
2425 return (NULL);
2426 }
2427
2428 major_status = gss_display_name(&minor_status, server_name, &token, NULL);
2429
2430 if (GSS_ERROR(major_status))
2431 {
2432 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2433 "gss_display_name() failed");
2434 return (NULL);
2435 }
2436
2437 cupsdLogMessage(CUPSD_LOG_INFO, "Attempting to acquire credentials for %s...",
2438 (char *)token.value);
2439
2440 server_creds = GSS_C_NO_CREDENTIAL;
2441 major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
2442 GSS_C_NO_OID_SET, GSS_C_ACCEPT,
2443 &server_creds, NULL, NULL);
2444 if (GSS_ERROR(major_status))
2445 {
2446 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2447 "gss_acquire_cred() failed");
2448 gss_release_name(&minor_status, &server_name);
2449 gss_release_buffer(&minor_status, &token);
2450 return (NULL);
2451 }
2452
2453 cupsdLogMessage(CUPSD_LOG_INFO, "Credentials acquired successfully for %s.",
2454 (char *)token.value);
2455
2456 gss_release_name(&minor_status, &server_name);
2457 gss_release_buffer(&minor_status, &token);
2458
2459 return (server_creds);
2460 }
2461 #endif /* HAVE_GSSAPI */
2462
2463
2464 /*
2465 * 'get_md5_password()' - Get an MD5 password.
2466 */
2467
2468 static char * /* O - MD5 password string */
2469 get_md5_password(const char *username, /* I - Username */
2470 const char *group, /* I - Group */
2471 char passwd[33]) /* O - MD5 password string */
2472 {
2473 cups_file_t *fp; /* passwd.md5 file */
2474 char filename[1024], /* passwd.md5 filename */
2475 line[256], /* Line from file */
2476 tempuser[33], /* User from file */
2477 tempgroup[33]; /* Group from file */
2478
2479
2480 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2481 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2482 username, group ? group : "(null)", passwd);
2483
2484 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2485 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2486 {
2487 if (errno != ENOENT)
2488 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2489 strerror(errno));
2490
2491 return (NULL);
2492 }
2493
2494 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2495 {
2496 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2497 {
2498 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2499 continue;
2500 }
2501
2502 if (!strcmp(username, tempuser) &&
2503 (group == NULL || !strcmp(group, tempgroup)))
2504 {
2505 /*
2506 * Found the password entry!
2507 */
2508
2509 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2510 username, tempgroup);
2511
2512 cupsFileClose(fp);
2513 return (passwd);
2514 }
2515 }
2516
2517 /*
2518 * Didn't find a password entry - return NULL!
2519 */
2520
2521 cupsFileClose(fp);
2522 return (NULL);
2523 }
2524
2525
2526 #if HAVE_LIBPAM
2527 /*
2528 * 'pam_func()' - PAM conversation function.
2529 */
2530
2531 static int /* O - Success or failure */
2532 pam_func(
2533 int num_msg, /* I - Number of messages */
2534 const struct pam_message **msg, /* I - Messages */
2535 struct pam_response **resp, /* O - Responses */
2536 void *appdata_ptr)
2537 /* I - Pointer to connection */
2538 {
2539 int i; /* Looping var */
2540 struct pam_response *replies; /* Replies */
2541 cupsd_authdata_t *data; /* Pointer to auth data */
2542
2543
2544 /*
2545 * Allocate memory for the responses...
2546 */
2547
2548 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2549 return (PAM_CONV_ERR);
2550
2551 /*
2552 * Answer all of the messages...
2553 */
2554
2555 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2556
2557 #ifdef __hpux
2558 /*
2559 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2560 * module. This is a workaround...
2561 */
2562
2563 data = auth_data;
2564 (void)appdata_ptr;
2565 #else
2566 data = (cupsd_authdata_t *)appdata_ptr;
2567 #endif /* __hpux */
2568
2569 for (i = 0; i < num_msg; i ++)
2570 {
2571 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2572
2573 switch (msg[i]->msg_style)
2574 {
2575 case PAM_PROMPT_ECHO_ON:
2576 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2577 data->username));
2578 replies[i].resp_retcode = PAM_SUCCESS;
2579 replies[i].resp = strdup(data->username);
2580 break;
2581
2582 case PAM_PROMPT_ECHO_OFF:
2583 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2584 data->password));
2585 replies[i].resp_retcode = PAM_SUCCESS;
2586 replies[i].resp = strdup(data->password);
2587 break;
2588
2589 case PAM_TEXT_INFO:
2590 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2591 replies[i].resp_retcode = PAM_SUCCESS;
2592 replies[i].resp = NULL;
2593 break;
2594
2595 case PAM_ERROR_MSG:
2596 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2597 replies[i].resp_retcode = PAM_SUCCESS;
2598 replies[i].resp = NULL;
2599 break;
2600
2601 default:
2602 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2603 msg[i]->msg_style));
2604 free(replies);
2605 return (PAM_CONV_ERR);
2606 }
2607 }
2608
2609 /*
2610 * Return the responses back to PAM...
2611 */
2612
2613 *resp = replies;
2614
2615 return (PAM_SUCCESS);
2616 }
2617 #elif !defined(HAVE_USERSEC_H)
2618
2619
2620 /*
2621 * 'to64()' - Base64-encode an integer value...
2622 */
2623
2624 static void
2625 to64(char *s, /* O - Output string */
2626 unsigned long v, /* I - Value to encode */
2627 int n) /* I - Number of digits */
2628 {
2629 const char *itoa64 = "./0123456789"
2630 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2631 "abcdefghijklmnopqrstuvwxyz";
2632
2633
2634 for (; n > 0; n --, v >>= 6)
2635 *s++ = itoa64[v & 0x3f];
2636 }
2637 #endif /* HAVE_LIBPAM */
2638
2639
2640 /*
2641 * End of "$Id: auth.c 6732 2007-07-26 16:50:20Z mike $".
2642 */
Unnamed repository; edit this file 'description' to name the repository.