]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge changes from r6781 to r6792 (CUPS 1.3.0)
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 6758 2007-08-02 00:13:44Z mike $"
3 *
4 * Authorization routines for the Common UNIX Printing System (CUPS).
5 *
6 * Copyright 2007 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddLocation() - Add a location for authorization.
21 * cupsdAddName() - Add a name to a location...
22 * cupsdAllowHost() - Add a host name that is allowed to access the
23 * location.
24 * cupsdAllowIP() - Add an IP address or network that is allowed
25 * to access the location.
26 * cupsdAuthorize() - Validate any authorization credentials.
27 * cupsdCheckAuth() - Check authorization masks.
28 * cupsdCheckGroup() - Check for a user's group membership.
29 * cupsdCopyLocation() - Make a copy of a location...
30 * cupsdDeleteAllLocations() - Free all memory used for location
31 * authorization.
32 * cupsdDeleteLocation() - Free all memory used by a location.
33 * cupsdDenyHost() - Add a host name that is not allowed to access
34 * the location.
35 * cupsdDenyIP() - Add an IP address or network that is not
36 * allowed to access the location.
37 * cupsdFindBest() - Find the location entry that best matches the
38 * resource.
39 * cupsdFindLocation() - Find the named location.
40 * cupsdIsAuthorized() - Check to see if the user is authorized...
41 * add_allow() - Add an allow mask to the location.
42 * add_deny() - Add a deny mask to the location.
43 * compare_locations() - Compare two locations.
44 * cups_crypt() - Encrypt the password using the DES or MD5
45 * algorithms, as needed.
46 * get_gss_creds() - Obtain GSS credentials.
47 * get_md5_password() - Get an MD5 password.
48 * pam_func() - PAM conversation function.
49 * to64() - Base64-encode an integer value...
50 * check_authref() - Check an authorization services reference.
51 */
52
53 /*
54 * Include necessary headers...
55 */
56
57 #include "cupsd.h"
58 #include <grp.h>
59 #ifdef HAVE_SHADOW_H
60 # include <shadow.h>
61 #endif /* HAVE_SHADOW_H */
62 #ifdef HAVE_CRYPT_H
63 # include <crypt.h>
64 #endif /* HAVE_CRYPT_H */
65 #if HAVE_LIBPAM
66 # ifdef HAVE_PAM_PAM_APPL_H
67 # include <pam/pam_appl.h>
68 # else
69 # include <security/pam_appl.h>
70 # endif /* HAVE_PAM_PAM_APPL_H */
71 #endif /* HAVE_LIBPAM */
72 #ifdef HAVE_USERSEC_H
73 # include <usersec.h>
74 #endif /* HAVE_USERSEC_H */
75 #ifdef HAVE_MEMBERSHIP_H
76 # include <membership.h>
77 #endif /* HAVE_MEMBERSHIP_H */
78 #ifdef HAVE_AUTHORIZATION_H
79 # include <Security/AuthorizationTags.h>
80 # ifdef HAVE_SECBASEPRIV_H
81 # include <Security/SecBasePriv.h>
82 # else
83 extern const char *cssmErrorString(int error);
84 # endif /* HAVE_SECBASEPRIV_H */
85 #endif /* HAVE_AUTHORIZATION_H */
86 #ifdef HAVE_SYS_UCRED_H
87 # include <sys/ucred.h>
88 typedef struct xucred cupsd_ucred_t;
89 # define CUPSD_UCRED_UID(c) (c).cr_uid
90 #else
91 typedef struct ucred cupsd_ucred_t;
92 # define CUPSD_UCRED_UID(c) (c).uid
93 #endif /* HAVE_SYS_UCRED_H */
94
95
96 /*
97 * Local functions...
98 */
99
100 static cupsd_authmask_t *add_allow(cupsd_location_t *loc);
101 static cupsd_authmask_t *add_deny(cupsd_location_t *loc);
102 #ifdef HAVE_AUTHORIZATION_H
103 static int check_authref(cupsd_client_t *con, const char *right);
104 #endif /* HAVE_AUTHORIZATION_H */
105 static int compare_locations(cupsd_location_t *a,
106 cupsd_location_t *b);
107 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
108 static char *cups_crypt(const char *pw, const char *salt);
109 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
110 #ifdef HAVE_GSSAPI
111 static gss_cred_id_t get_gss_creds(const char *service_name);
112 #endif /* HAVE_GSSAPI */
113 static char *get_md5_password(const char *username,
114 const char *group, char passwd[33]);
115 #if HAVE_LIBPAM
116 static int pam_func(int, const struct pam_message **,
117 struct pam_response **, void *);
118 #elif !defined(HAVE_USERSEC_H)
119 static void to64(char *s, unsigned long v, int n);
120 #endif /* HAVE_LIBPAM */
121
122
123 /*
124 * Local structures...
125 */
126
127 #if HAVE_LIBPAM
128 typedef struct cupsd_authdata_s /**** Authentication data ****/
129 {
130 char username[33], /* Username string */
131 password[33]; /* Password string */
132 } cupsd_authdata_t;
133 #endif /* HAVE_LIBPAM */
134
135
136 /*
137 * Local globals...
138 */
139
140 #if defined(__hpux) && HAVE_LIBPAM
141 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
142 #endif /* __hpux && HAVE_LIBPAM */
143
144
145 /*
146 * 'cupsdAddLocation()' - Add a location for authorization.
147 */
148
149 cupsd_location_t * /* O - Pointer to new location record */
150 cupsdAddLocation(const char *location) /* I - Location path */
151 {
152 cupsd_location_t *temp; /* New location */
153
154
155 /*
156 * Make sure the locations array is created...
157 */
158
159 if (!Locations)
160 Locations = cupsArrayNew((cups_array_func_t)compare_locations, NULL);
161
162 if (!Locations)
163 return (NULL);
164
165 /*
166 * Try to allocate memory for the new location.
167 */
168
169 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
170 return (NULL);
171
172 /*
173 * Initialize the record and copy the name over...
174 */
175
176 temp->location = strdup(location);
177 temp->length = strlen(temp->location);
178
179 cupsArrayAdd(Locations, temp);
180
181 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: added location \'%s\'",
182 location);
183
184 /*
185 * Return the new record...
186 */
187
188 return (temp);
189 }
190
191
192 /*
193 * 'cupsdAddName()' - Add a name to a location...
194 */
195
196 void
197 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
198 char *name) /* I - Name to add */
199 {
200 char **temp; /* Pointer to names array */
201
202
203 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
204 loc, name);
205
206 if (loc->num_names == 0)
207 temp = malloc(sizeof(char *));
208 else
209 temp = realloc(loc->names, (loc->num_names + 1) * sizeof(char *));
210
211 if (temp == NULL)
212 {
213 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to add name to location %s: %s",
214 loc->location ? loc->location : "nil", strerror(errno));
215 return;
216 }
217
218 loc->names = temp;
219
220 if ((temp[loc->num_names] = strdup(name)) == NULL)
221 {
222 cupsdLogMessage(CUPSD_LOG_ERROR,
223 "Unable to duplicate name for location %s: %s",
224 loc->location ? loc->location : "nil", strerror(errno));
225 return;
226 }
227
228 loc->num_names ++;
229 }
230
231
232 /*
233 * 'cupsdAllowHost()' - Add a host name that is allowed to access the location.
234 */
235
236 void
237 cupsdAllowHost(cupsd_location_t *loc, /* I - Location to add to */
238 char *name) /* I - Name of host or domain to add */
239 {
240 cupsd_authmask_t *temp; /* New host/domain mask */
241 char ifname[32], /* Interface name */
242 *ifptr; /* Pointer to end of name */
243
244
245 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAllowHost(loc=%p(%s), name=\"%s\")",
246 loc, loc->location ? loc->location : "nil", name);
247
248 if ((temp = add_allow(loc)) == NULL)
249 return;
250
251 if (!strcasecmp(name, "@LOCAL"))
252 {
253 /*
254 * Allow *interface*...
255 */
256
257 temp->type = AUTH_INTERFACE;
258 temp->mask.name.name = strdup("*");
259 temp->mask.name.length = 1;
260 }
261 else if (!strncasecmp(name, "@IF(", 4))
262 {
263 /*
264 * Allow *interface*...
265 */
266
267 strlcpy(ifname, name + 4, sizeof(ifname));
268
269 ifptr = ifname + strlen(ifname);
270
271 if (ifptr[-1] == ')')
272 {
273 ifptr --;
274 *ifptr = '\0';
275 }
276
277 temp->type = AUTH_INTERFACE;
278 temp->mask.name.name = strdup(ifname);
279 temp->mask.name.length = ifptr - ifname;
280 }
281 else
282 {
283 /*
284 * Allow name...
285 */
286
287 temp->type = AUTH_NAME;
288 temp->mask.name.name = strdup(name);
289 temp->mask.name.length = strlen(name);
290 }
291 }
292
293
294 /*
295 * 'cupsdAllowIP()' - Add an IP address or network that is allowed to access
296 * the location.
297 */
298
299 void
300 cupsdAllowIP(cupsd_location_t *loc, /* I - Location to add to */
301 unsigned address[4], /* I - IP address to add */
302 unsigned netmask[4]) /* I - Netmask of address */
303 {
304 cupsd_authmask_t *temp; /* New host/domain mask */
305
306
307 cupsdLogMessage(CUPSD_LOG_DEBUG2,
308 "cupsdAllowIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
309 loc, loc->location ? loc->location : "nil",
310 address[0], address[1], address[2], address[3],
311 netmask[0], netmask[1], netmask[2], netmask[3]);
312
313 if ((temp = add_allow(loc)) == NULL)
314 return;
315
316 temp->type = AUTH_IP;
317 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
318 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
319 }
320
321
322 /*
323 * 'cupsdAuthorize()' - Validate any authorization credentials.
324 */
325
326 void
327 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
328 {
329 int type; /* Authentication type */
330 const char *authorization; /* Pointer into Authorization string */
331 char *ptr, /* Pointer into string */
332 username[65], /* Username string */
333 password[33]; /* Password string */
334 const char *localuser; /* Certificate username */
335 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
336 md5[33], /* MD5 password */
337 basicmd5[33]; /* MD5 of Basic password */
338 static const char * const states[] = /* HTTP client states... */
339 {
340 "WAITING",
341 "OPTIONS",
342 "GET",
343 "GET",
344 "HEAD",
345 "POST",
346 "POST",
347 "POST",
348 "PUT",
349 "PUT",
350 "DELETE",
351 "TRACE",
352 "CLOSE",
353 "STATUS"
354 };
355
356
357 /*
358 * Locate the best matching location so we know what kind of
359 * authentication to expect...
360 */
361
362 con->best = cupsdFindBest(con->uri, con->http.state);
363
364 cupsdLogMessage(CUPSD_LOG_DEBUG2,
365 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
366 con->uri, con->best, con->best ? con->best->location : "");
367
368 if (con->best && con->best->type != AUTH_NONE)
369 {
370 if (con->best->type == AUTH_DEFAULT)
371 type = DefaultAuthType;
372 else
373 type = con->best->type;
374 }
375 else if (!strncmp(con->uri, "/printers/", 10) ||
376 !strncmp(con->uri, "/classes/", 9))
377 {
378 /*
379 * Lookup the printer or class and see what kind of authentication it
380 * needs...
381 */
382
383 cupsd_printer_t *p; /* Printer or class */
384
385
386 if (!strncmp(con->uri, "/printers/", 10))
387 p = cupsdFindDest(con->uri + 10);
388 else
389 p = cupsdFindDest(con->uri + 9);
390
391 if (p && p->num_auth_info_required > 0 &&
392 !strcmp(p->auth_info_required[0], "negotiate"))
393 type = AUTH_NEGOTIATE;
394 else
395 type = DefaultAuthType;
396 }
397 else
398 type = DefaultAuthType;
399
400 /*
401 * Decode the Authorization string...
402 */
403
404 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
405
406 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
407 authorization);
408
409 username[0] = '\0';
410 password[0] = '\0';
411
412 #ifdef HAVE_AUTHORIZATION_H
413 if (con->authref)
414 {
415 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
416 con->authref = NULL;
417 }
418 #endif /* HAVE_AUTHORIZATION_H */
419
420 if (type == AUTH_NONE)
421 {
422 /*
423 * No authorization required, return early...
424 */
425
426 cupsdLogMessage(CUPSD_LOG_DEBUG,
427 "cupsdAuthorize: No authentication required.");
428 return;
429 }
430 else if (!*authorization)
431 {
432 /*
433 * No authorization data provided, return early...
434 */
435
436 cupsdLogMessage(CUPSD_LOG_DEBUG,
437 "cupsdAuthorize: No authentication data provided.");
438 return;
439 }
440 #ifdef HAVE_AUTHORIZATION_H
441 else if (!strncmp(authorization, "AuthRef", 6) &&
442 !strcasecmp(con->http.hostname, "localhost"))
443 {
444 OSStatus status; /* Status */
445 int authlen; /* Auth string length */
446 AuthorizationItemSet *authinfo; /* Authorization item set */
447
448 /*
449 * Get the Authorization Services data...
450 */
451
452 authorization += 7;
453 while (isspace(*authorization & 255))
454 authorization ++;
455
456 authlen = sizeof(nonce);
457 httpDecode64_2(nonce, &authlen, authorization);
458
459 if (authlen != kAuthorizationExternalFormLength)
460 {
461 cupsdLogMessage(CUPSD_LOG_ERROR,
462 "External Authorization reference size is incorrect!");
463 return;
464 }
465
466 if ((status = AuthorizationCreateFromExternalForm(
467 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
468 {
469 cupsdLogMessage(CUPSD_LOG_ERROR,
470 "AuthorizationCreateFromExternalForm returned %d (%s)",
471 (int)status, cssmErrorString(status));
472 return;
473 }
474
475 if ((status = AuthorizationCopyInfo(con->authref,
476 kAuthorizationEnvironmentUsername,
477 &authinfo)) != 0)
478 {
479 cupsdLogMessage(CUPSD_LOG_ERROR,
480 "AuthorizationCopyInfo returned %d (%s)",
481 (int)status, cssmErrorString(status));
482 return;
483 }
484
485 if (authinfo->count == 1)
486 strlcpy(username, authinfo->items[0].value, sizeof(username));
487
488 cupsdLogMessage(CUPSD_LOG_DEBUG,
489 "cupsdAuthorize: Authorized as %s using AuthRef",
490 username);
491
492 AuthorizationFreeItemSet(authinfo);
493 }
494 #endif /* HAVE_AUTHORIZATION_H */
495 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
496 else if (!strncmp(authorization, "PeerCred ", 9) &&
497 con->http.hostaddr->addr.sa_family == AF_LOCAL)
498 {
499 /*
500 * Use peer credentials from domain socket connection...
501 */
502
503 struct passwd *pwd; /* Password entry for this user */
504 cupsd_ucred_t peercred; /* Peer credentials */
505 socklen_t peersize; /* Size of peer credentials */
506
507
508 if ((pwd = getpwnam(authorization + 9)) == NULL)
509 {
510 cupsdLogMessage(CUPSD_LOG_ERROR, "User \"%s\" does not exist!",
511 authorization + 9);
512 return;
513 }
514
515 peersize = sizeof(peercred);
516
517 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
518 {
519 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
520 strerror(errno));
521 return;
522 }
523
524 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
525 {
526 cupsdLogMessage(CUPSD_LOG_ERROR,
527 "Invalid peer credentials for \"%s\" - got %d, "
528 "expected %d!", authorization + 9,
529 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
530 # ifdef HAVE_SYS_UCRED_H
531 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_version=%d",
532 peercred.cr_version);
533 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_uid=%d",
534 peercred.cr_uid);
535 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_ngroups=%d",
536 peercred.cr_ngroups);
537 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_groups[0]=%d",
538 peercred.cr_groups[0]);
539 # endif /* HAVE_SYS_UCRED_H */
540 return;
541 }
542
543 strlcpy(username, authorization + 9, sizeof(username));
544
545 cupsdLogMessage(CUPSD_LOG_DEBUG,
546 "cupsdAuthorize: Authorized as %s using PeerCred",
547 username);
548 }
549 #endif /* SO_PEERCRED && AF_LOCAL */
550 else if (!strncmp(authorization, "Local", 5) &&
551 !strcasecmp(con->http.hostname, "localhost"))
552 {
553 /*
554 * Get Local certificate authentication data...
555 */
556
557 authorization += 5;
558 while (isspace(*authorization & 255))
559 authorization ++;
560
561 if ((localuser = cupsdFindCert(authorization)) != NULL)
562 {
563 strlcpy(username, localuser, sizeof(username));
564
565 cupsdLogMessage(CUPSD_LOG_DEBUG,
566 "cupsdAuthorize: Authorized as %s using Local",
567 username);
568 }
569 else
570 {
571 cupsdLogMessage(CUPSD_LOG_ERROR,
572 "cupsdAuthorize: Local authentication certificate not "
573 "found!");
574 return;
575 }
576 }
577 else if (!strncmp(authorization, "Basic", 5) &&
578 (type == AUTH_BASIC || type == AUTH_BASICDIGEST))
579 {
580 /*
581 * Get the Basic authentication data...
582 */
583
584 int userlen; /* Username:password length */
585
586
587 authorization += 5;
588 while (isspace(*authorization & 255))
589 authorization ++;
590
591 userlen = sizeof(username);
592 httpDecode64_2(username, &userlen, authorization);
593
594 /*
595 * Pull the username and password out...
596 */
597
598 if ((ptr = strchr(username, ':')) == NULL)
599 {
600 cupsdLogMessage(CUPSD_LOG_ERROR,
601 "cupsdAuthorize: Missing Basic password!");
602 return;
603 }
604
605 *ptr++ = '\0';
606
607 if (!username[0])
608 {
609 /*
610 * Username must not be empty...
611 */
612
613 cupsdLogMessage(CUPSD_LOG_ERROR,
614 "cupsdAuthorize: Empty Basic username!");
615 return;
616 }
617
618 if (!*ptr)
619 {
620 /*
621 * Password must not be empty...
622 */
623
624 cupsdLogMessage(CUPSD_LOG_ERROR,
625 "cupsdAuthorize: Empty Basic password!");
626 return;
627 }
628
629 strlcpy(password, ptr, sizeof(password));
630
631 /*
632 * Validate the username and password...
633 */
634
635 switch (type)
636 {
637 case AUTH_BASIC :
638 {
639 #if HAVE_LIBPAM
640 /*
641 * Only use PAM to do authentication. This supports MD5
642 * passwords, among other things...
643 */
644
645 pam_handle_t *pamh; /* PAM authentication handle */
646 int pamerr; /* PAM error code */
647 struct pam_conv pamdata;/* PAM conversation data */
648 cupsd_authdata_t data; /* Authentication data */
649
650
651 strlcpy(data.username, username, sizeof(data.username));
652 strlcpy(data.password, password, sizeof(data.password));
653
654 # if defined(__sun) || defined(__hpux)
655 pamdata.conv = (int (*)(int, struct pam_message **,
656 struct pam_response **,
657 void *))pam_func;
658 # else
659 pamdata.conv = pam_func;
660 # endif /* __sun || __hpux */
661 pamdata.appdata_ptr = &data;
662
663 # ifdef __hpux
664 /*
665 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
666 * more info...
667 */
668
669 auth_data = &data;
670 # endif /* __hpux */
671
672 pamerr = pam_start("cups", username, &pamdata, &pamh);
673 if (pamerr != PAM_SUCCESS)
674 {
675 cupsdLogMessage(CUPSD_LOG_ERROR,
676 "cupsdAuthorize: pam_start() returned %d (%s)!\n",
677 pamerr, pam_strerror(pamh, pamerr));
678 pam_end(pamh, 0);
679 return;
680 }
681
682 pamerr = pam_authenticate(pamh, PAM_SILENT);
683 if (pamerr != PAM_SUCCESS)
684 {
685 cupsdLogMessage(CUPSD_LOG_ERROR,
686 "cupsdAuthorize: pam_authenticate() returned %d "
687 "(%s)!\n",
688 pamerr, pam_strerror(pamh, pamerr));
689 pam_end(pamh, 0);
690 return;
691 }
692
693 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
694 if (pamerr != PAM_SUCCESS)
695 {
696 cupsdLogMessage(CUPSD_LOG_ERROR,
697 "cupsdAuthorize: pam_acct_mgmt() returned %d "
698 "(%s)!\n",
699 pamerr, pam_strerror(pamh, pamerr));
700 pam_end(pamh, 0);
701 return;
702 }
703
704 pam_end(pamh, PAM_SUCCESS);
705
706 #elif defined(HAVE_USERSEC_H)
707 /*
708 * Use AIX authentication interface...
709 */
710
711 char *authmsg; /* Authentication message */
712 int reenter; /* ??? */
713
714
715 cupsdLogMessage(CUPSD_LOG_DEBUG,
716 "cupsdAuthorize: AIX authenticate of username \"%s\"",
717 username);
718
719 reenter = 1;
720 if (authenticate(username, password, &reenter, &authmsg) != 0)
721 {
722 cupsdLogMessage(CUPSD_LOG_DEBUG,
723 "cupsdAuthorize: Unable to authenticate username "
724 "\"%s\": %s",
725 username, strerror(errno));
726 return;
727 }
728
729 #else
730 /*
731 * Use normal UNIX password file-based authentication...
732 */
733
734 char *pass; /* Encrypted password */
735 struct passwd *pw; /* User password data */
736 # ifdef HAVE_SHADOW_H
737 struct spwd *spw; /* Shadow password data */
738 # endif /* HAVE_SHADOW_H */
739
740
741 pw = getpwnam(username); /* Get the current password */
742 endpwent(); /* Close the password file */
743
744 if (!pw)
745 {
746 /*
747 * No such user...
748 */
749
750 cupsdLogMessage(CUPSD_LOG_ERROR,
751 "cupsdAuthorize: Unknown username \"%s\"!",
752 username);
753 return;
754 }
755
756 # ifdef HAVE_SHADOW_H
757 spw = getspnam(username);
758 endspent();
759
760 if (!spw && !strcmp(pw->pw_passwd, "x"))
761 {
762 /*
763 * Don't allow blank passwords!
764 */
765
766 cupsdLogMessage(CUPSD_LOG_ERROR,
767 "cupsdAuthorize: Username \"%s\" has no shadow "
768 "password!", username);
769 return;
770 }
771
772 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
773 # else
774 if (!pw->pw_passwd[0])
775 # endif /* HAVE_SHADOW_H */
776 {
777 /*
778 * Don't allow blank passwords!
779 */
780
781 cupsdLogMessage(CUPSD_LOG_ERROR,
782 "cupsdAuthorize: Username \"%s\" has no password!",
783 username);
784 return;
785 }
786
787 /*
788 * OK, the password isn't blank, so compare with what came from the
789 * client...
790 */
791
792 pass = cups_crypt(password, pw->pw_passwd);
793
794 cupsdLogMessage(CUPSD_LOG_DEBUG2,
795 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
796 pw->pw_passwd, pass);
797
798 if (!pass || strcmp(pw->pw_passwd, pass))
799 {
800 # ifdef HAVE_SHADOW_H
801 if (spw)
802 {
803 pass = cups_crypt(password, spw->sp_pwdp);
804
805 cupsdLogMessage(CUPSD_LOG_DEBUG2,
806 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
807 spw->sp_pwdp, pass);
808
809 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
810 {
811 cupsdLogMessage(CUPSD_LOG_ERROR,
812 "cupsdAuthorize: Authentication failed for "
813 "user \"%s\"!",
814 username);
815 return;
816 }
817 }
818 else
819 # endif /* HAVE_SHADOW_H */
820 {
821 cupsdLogMessage(CUPSD_LOG_ERROR,
822 "cupsdAuthorize: Authentication failed for "
823 "user \"%s\"!",
824 username);
825 return;
826 }
827 }
828 #endif /* HAVE_LIBPAM */
829 }
830
831 cupsdLogMessage(CUPSD_LOG_DEBUG,
832 "cupsdAuthorize: Authorized as %s using Basic",
833 username);
834 break;
835
836 case AUTH_BASICDIGEST :
837 /*
838 * Do Basic authentication with the Digest password file...
839 */
840
841 if (!get_md5_password(username, NULL, md5))
842 {
843 cupsdLogMessage(CUPSD_LOG_ERROR,
844 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
845 username);
846 return;
847 }
848
849 httpMD5(username, "CUPS", password, basicmd5);
850
851 if (strcmp(md5, basicmd5))
852 {
853 cupsdLogMessage(CUPSD_LOG_ERROR,
854 "cupsdAuthorize: Authentication failed for \"%s\"!",
855 username);
856 return;
857 }
858
859 cupsdLogMessage(CUPSD_LOG_DEBUG,
860 "cupsdAuthorize: Authorized as %s using BasicDigest",
861 username);
862 break;
863 }
864 }
865 else if (!strncmp(authorization, "Digest", 6) && type == AUTH_DIGEST)
866 {
867 /*
868 * Get the username, password, and nonce from the Digest attributes...
869 */
870
871 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
872 username, sizeof(username)) || !username[0])
873 {
874 /*
875 * Username must not be empty...
876 */
877
878 cupsdLogMessage(CUPSD_LOG_ERROR,
879 "cupsdAuthorize: Empty or missing Digest username!");
880 return;
881 }
882
883 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
884 password, sizeof(password)) || !password[0])
885 {
886 /*
887 * Password must not be empty...
888 */
889
890 cupsdLogMessage(CUPSD_LOG_ERROR,
891 "cupsdAuthorize: Empty or missing Digest password!");
892 return;
893 }
894
895 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
896 nonce))
897 {
898 cupsdLogMessage(CUPSD_LOG_ERROR,
899 "cupsdAuthorize: No nonce value for Digest "
900 "authentication!");
901 return;
902 }
903
904 if (strcmp(con->http.hostname, nonce))
905 {
906 cupsdLogMessage(CUPSD_LOG_ERROR,
907 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
908 "got \"%s\"!", con->http.hostname, nonce);
909 return;
910 }
911
912 /*
913 * Validate the username and password...
914 */
915
916 if (!get_md5_password(username, NULL, md5))
917 {
918 cupsdLogMessage(CUPSD_LOG_ERROR,
919 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
920 username);
921 return;
922 }
923
924 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
925
926 if (strcmp(md5, password))
927 {
928 cupsdLogMessage(CUPSD_LOG_ERROR,
929 "cupsdAuthorize: Authentication failed for \"%s\"!",
930 username);
931 return;
932 }
933
934 cupsdLogMessage(CUPSD_LOG_DEBUG,
935 "cupsdAuthorize: Authorized as %s using Digest",
936 username);
937 }
938 #ifdef HAVE_GSSAPI
939 else if (!strncmp(authorization, "Negotiate", 9) && type == AUTH_NEGOTIATE)
940 {
941 int len; /* Length of authorization string */
942 gss_cred_id_t server_creds; /* Server credentials */
943 gss_ctx_id_t context; /* Authorization context */
944 OM_uint32 major_status, /* Major status code */
945 minor_status; /* Minor status code */
946 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
947 /* Input token from string */
948 output_token = GSS_C_EMPTY_BUFFER;
949 /* Output token for username */
950 gss_name_t client_name; /* Client name */
951 unsigned int ret_flags; /* Credential flags */
952
953
954 # ifdef __APPLE__
955 /*
956 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
957 * to use it...
958 */
959
960 if (gss_init_sec_context == NULL)
961 {
962 cupsdLogMessage(CUPSD_LOG_WARN,
963 "GSSAPI/Kerberos authentication failed because the "
964 "Kerberos framework is not present.");
965 return;
966 }
967 # endif /* __APPLE__ */
968
969 con->gss_output_token.length = 0;
970
971 /*
972 * Find the start of the Kerberos input token...
973 */
974
975 authorization += 9;
976 while (isspace(*authorization & 255))
977 authorization ++;
978
979 if (!*authorization)
980 {
981 cupsdLogMessage(CUPSD_LOG_DEBUG2,
982 "cupsdAuthorize: No authentication data specified.");
983 return;
984 }
985
986 /*
987 * Get the server credentials...
988 */
989
990 if ((server_creds = get_gss_creds(GSSServiceName)) == NULL)
991 return;
992
993 /*
994 * Decode the authorization string to get the input token...
995 */
996
997 len = strlen(authorization);
998 input_token.value = malloc(len);
999 input_token.value = httpDecode64_2(input_token.value, &len,
1000 authorization);
1001 input_token.length = len;
1002
1003 /*
1004 * Accept the input token to get the authorization info...
1005 */
1006
1007 context = GSS_C_NO_CONTEXT;
1008 client_name = GSS_C_NO_NAME;
1009 major_status = gss_accept_sec_context(&minor_status,
1010 &context,
1011 server_creds,
1012 &input_token,
1013 GSS_C_NO_CHANNEL_BINDINGS,
1014 &client_name,
1015 NULL,
1016 &con->gss_output_token,
1017 &ret_flags,
1018 NULL,
1019 &con->gss_delegated_cred);
1020
1021 if (GSS_ERROR(major_status))
1022 {
1023 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1024 "cupsdAuthorize: Error accepting GSSAPI security "
1025 "context");
1026
1027 if (context != GSS_C_NO_CONTEXT)
1028 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1029
1030 gss_release_cred(&minor_status, &server_creds);
1031 return;
1032 }
1033
1034 /*
1035 * Release our credentials...
1036 */
1037
1038 gss_release_cred(&minor_status, &server_creds);
1039
1040 /*
1041 * Get the username associated with the client's credentials...
1042 */
1043
1044 if (!con->gss_delegated_cred)
1045 cupsdLogMessage(CUPSD_LOG_DEBUG,
1046 "cupsdAuthorize: No delegated credentials!");
1047
1048 if (major_status == GSS_S_CONTINUE_NEEDED)
1049 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1050 "cupsdAuthorize: Credentials not complete");
1051 else if (major_status == GSS_S_COMPLETE)
1052 {
1053 major_status = gss_display_name(&minor_status, client_name,
1054 &output_token, NULL);
1055
1056 if (GSS_ERROR(major_status))
1057 {
1058 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1059 "cupsdAuthorize: Error getting username");
1060 gss_release_name(&minor_status, &client_name);
1061 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1062 return;
1063 }
1064
1065 gss_release_name(&minor_status, &client_name);
1066 strlcpy(username, output_token.value, sizeof(username));
1067 if ((ptr = strchr(username, '@')) != NULL)
1068 *ptr = '\0'; /* Strip @KDC from the username */
1069
1070 cupsdLogMessage(CUPSD_LOG_DEBUG,
1071 "cupsdAuthorize: Authorized as %s using Negotiate",
1072 username);
1073
1074 gss_release_buffer(&minor_status, &output_token);
1075 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1076
1077 con->gss_have_creds = 1;
1078 }
1079 else
1080 gss_release_name(&minor_status, &client_name);
1081 }
1082 #endif /* HAVE_GSSAPI */
1083 else if (type != AUTH_NONE)
1084 {
1085 char scheme[256]; /* Auth scheme... */
1086 static const char * const types[] = /* Auth types */
1087 {
1088 "None",
1089 "Basic",
1090 "Digest",
1091 "BasicDigest",
1092 "Negotiate"
1093 };
1094
1095
1096 if (sscanf(authorization, "%255s", scheme) != 1)
1097 strcpy(scheme, "UNKNOWN");
1098
1099 cupsdLogMessage(CUPSD_LOG_ERROR,
1100 "Bad authentication data \"%s ...\", expected \"%s ...\"",
1101 scheme, types[type]);
1102 return;
1103 }
1104
1105 /*
1106 * If we get here, then we were able to validate the username and
1107 * password - copy the validated username and password to the client
1108 * data and return...
1109 */
1110
1111 strlcpy(con->username, username, sizeof(con->username));
1112 strlcpy(con->password, password, sizeof(con->password));
1113 }
1114
1115
1116 /*
1117 * 'cupsdCheckAuth()' - Check authorization masks.
1118 */
1119
1120 int /* O - 1 if mask matches, 0 otherwise */
1121 cupsdCheckAuth(
1122 unsigned ip[4], /* I - Client address */
1123 char *name, /* I - Client hostname */
1124 int name_len, /* I - Length of hostname */
1125 int num_masks, /* I - Number of masks */
1126 cupsd_authmask_t *masks) /* I - Masks */
1127 {
1128 int i; /* Looping var */
1129 cupsd_netif_t *iface; /* Network interface */
1130 unsigned netip4; /* IPv4 network address */
1131 #ifdef AF_INET6
1132 unsigned netip6[4]; /* IPv6 network address */
1133 #endif /* AF_INET6 */
1134
1135 while (num_masks > 0)
1136 {
1137 switch (masks->type)
1138 {
1139 case AUTH_INTERFACE :
1140 /*
1141 * Check for a match with a network interface...
1142 */
1143
1144 netip4 = htonl(ip[3]);
1145
1146 #ifdef AF_INET6
1147 netip6[0] = htonl(ip[0]);
1148 netip6[1] = htonl(ip[1]);
1149 netip6[2] = htonl(ip[2]);
1150 netip6[3] = htonl(ip[3]);
1151 #endif /* AF_INET6 */
1152
1153 if (!strcmp(masks->mask.name.name, "*"))
1154 {
1155 /*
1156 * Check against all local interfaces...
1157 */
1158
1159 cupsdNetIFUpdate();
1160
1161 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1162 iface;
1163 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1164 {
1165 /*
1166 * Only check local interfaces...
1167 */
1168
1169 if (!iface->is_local)
1170 continue;
1171
1172 if (iface->address.addr.sa_family == AF_INET)
1173 {
1174 /*
1175 * Check IPv4 address...
1176 */
1177
1178 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1179 (iface->address.ipv4.sin_addr.s_addr &
1180 iface->mask.ipv4.sin_addr.s_addr))
1181 return (1);
1182 }
1183 #ifdef AF_INET6
1184 else
1185 {
1186 /*
1187 * Check IPv6 address...
1188 */
1189
1190 for (i = 0; i < 4; i ++)
1191 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1192 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1193 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1194 break;
1195
1196 if (i == 4)
1197 return (1);
1198 }
1199 #endif /* AF_INET6 */
1200 }
1201 }
1202 else
1203 {
1204 /*
1205 * Check the named interface...
1206 */
1207
1208 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1209 iface;
1210 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1211 {
1212 if (strcmp(masks->mask.name.name, iface->name))
1213 continue;
1214
1215 if (iface->address.addr.sa_family == AF_INET)
1216 {
1217 /*
1218 * Check IPv4 address...
1219 */
1220
1221 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1222 (iface->address.ipv4.sin_addr.s_addr &
1223 iface->mask.ipv4.sin_addr.s_addr))
1224 return (1);
1225 }
1226 #ifdef AF_INET6
1227 else
1228 {
1229 /*
1230 * Check IPv6 address...
1231 */
1232
1233 for (i = 0; i < 4; i ++)
1234 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1235 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1236 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1237 break;
1238
1239 if (i == 4)
1240 return (1);
1241 }
1242 #endif /* AF_INET6 */
1243 }
1244 }
1245 break;
1246
1247 case AUTH_NAME :
1248 /*
1249 * Check for exact name match...
1250 */
1251
1252 if (!strcasecmp(name, masks->mask.name.name))
1253 return (1);
1254
1255 /*
1256 * Check for domain match...
1257 */
1258
1259 if (name_len >= masks->mask.name.length &&
1260 masks->mask.name.name[0] == '.' &&
1261 !strcasecmp(name + name_len - masks->mask.name.length,
1262 masks->mask.name.name))
1263 return (1);
1264 break;
1265
1266 case AUTH_IP :
1267 /*
1268 * Check for IP/network address match...
1269 */
1270
1271 for (i = 0; i < 4; i ++)
1272 if ((ip[i] & masks->mask.ip.netmask[i]) !=
1273 masks->mask.ip.address[i])
1274 break;
1275
1276 if (i == 4)
1277 return (1);
1278 break;
1279 }
1280
1281 masks ++;
1282 num_masks --;
1283 }
1284
1285 return (0);
1286 }
1287
1288
1289 /*
1290 * 'cupsdCheckGroup()' - Check for a user's group membership.
1291 */
1292
1293 int /* O - 1 if user is a member, 0 otherwise */
1294 cupsdCheckGroup(
1295 const char *username, /* I - User name */
1296 struct passwd *user, /* I - System user info */
1297 const char *groupname) /* I - Group name */
1298 {
1299 int i; /* Looping var */
1300 struct group *group; /* System group info */
1301 char junk[33]; /* MD5 password (not used) */
1302 #ifdef HAVE_MBR_UID_TO_UUID
1303 uuid_t useruuid, /* UUID for username */
1304 groupuuid; /* UUID for groupname */
1305 int is_member; /* True if user is a member of group */
1306 #endif /* HAVE_MBR_UID_TO_UUID */
1307
1308
1309 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1310 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1311 username, user, groupname);
1312
1313 /*
1314 * Validate input...
1315 */
1316
1317 if (!username || !groupname)
1318 return (0);
1319
1320 /*
1321 * Check to see if the user is a member of the named group...
1322 */
1323
1324 group = getgrnam(groupname);
1325 endgrent();
1326
1327 if (group != NULL)
1328 {
1329 /*
1330 * Group exists, check it...
1331 */
1332
1333 for (i = 0; group->gr_mem[i]; i ++)
1334 if (!strcasecmp(username, group->gr_mem[i]))
1335 return (1);
1336 }
1337
1338 /*
1339 * Group doesn't exist or user not in group list, check the group ID
1340 * against the user's group ID...
1341 */
1342
1343 if (user && group && group->gr_gid == user->pw_gid)
1344 return (1);
1345
1346 #ifdef HAVE_MBR_UID_TO_UUID
1347 /*
1348 * Check group membership through MacOS X membership API...
1349 */
1350
1351 if (user && group)
1352 if (!mbr_uid_to_uuid(user->pw_uid, useruuid))
1353 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1354 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1355 if (is_member)
1356 return (1);
1357 #endif /* HAVE_MBR_UID_TO_UUID */
1358
1359 /*
1360 * Username not found, group not found, or user is not part of the
1361 * system group... Check for a user and group in the MD5 password
1362 * file...
1363 */
1364
1365 if (get_md5_password(username, groupname, junk) != NULL)
1366 return (1);
1367
1368 /*
1369 * If we get this far, then the user isn't part of the named group...
1370 */
1371
1372 return (0);
1373 }
1374
1375
1376 /*
1377 * 'cupsdCopyLocation()' - Make a copy of a location...
1378 */
1379
1380 cupsd_location_t * /* O - New location */
1381 cupsdCopyLocation(
1382 cupsd_location_t **loc) /* IO - Original location */
1383 {
1384 int i; /* Looping var */
1385 cupsd_location_t *temp; /* New location */
1386 char location[HTTP_MAX_URI];
1387 /* Location of resource */
1388
1389
1390 /*
1391 * Use a local copy of location because cupsdAddLocation may cause
1392 * this memory to be moved...
1393 */
1394
1395 strlcpy(location, (*loc)->location, sizeof(location));
1396
1397 if ((temp = cupsdAddLocation(location)) == NULL)
1398 return (NULL);
1399
1400 /*
1401 * Copy the information from the original location to the new one.
1402 */
1403
1404 temp->limit = (*loc)->limit;
1405 temp->order_type = (*loc)->order_type;
1406 temp->type = (*loc)->type;
1407 temp->level = (*loc)->level;
1408 temp->satisfy = (*loc)->satisfy;
1409 temp->encryption = (*loc)->encryption;
1410
1411 if ((temp->num_names = (*loc)->num_names) > 0)
1412 {
1413 /*
1414 * Copy the names array...
1415 */
1416
1417 if ((temp->names = calloc(temp->num_names, sizeof(char *))) == NULL)
1418 {
1419 cupsdLogMessage(CUPSD_LOG_ERROR,
1420 "cupsdCopyLocation: Unable to allocate memory for %d names: %s",
1421 temp->num_names, strerror(errno));
1422
1423 cupsdDeleteLocation(temp);
1424 return (NULL);
1425 }
1426
1427 for (i = 0; i < temp->num_names; i ++)
1428 if ((temp->names[i] = strdup((*loc)->names[i])) == NULL)
1429 {
1430 cupsdLogMessage(CUPSD_LOG_ERROR,
1431 "cupsdCopyLocation: Unable to copy name \"%s\": %s",
1432 (*loc)->names[i], strerror(errno));
1433
1434 cupsdDeleteLocation(temp);
1435 return (NULL);
1436 }
1437 }
1438
1439 if ((temp->num_allow = (*loc)->num_allow) > 0)
1440 {
1441 /*
1442 * Copy allow rules...
1443 */
1444
1445 if ((temp->allow = calloc(temp->num_allow, sizeof(cupsd_authmask_t))) == NULL)
1446 {
1447 cupsdLogMessage(CUPSD_LOG_ERROR,
1448 "cupsdCopyLocation: Unable to allocate memory for %d allow rules: %s",
1449 temp->num_allow, strerror(errno));
1450 cupsdDeleteLocation(temp);
1451 return (NULL);
1452 }
1453
1454 for (i = 0; i < temp->num_allow; i ++)
1455 switch (temp->allow[i].type = (*loc)->allow[i].type)
1456 {
1457 case AUTH_NAME :
1458 temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
1459 temp->allow[i].mask.name.name = strdup((*loc)->allow[i].mask.name.name);
1460
1461 if (temp->allow[i].mask.name.name == NULL)
1462 {
1463 cupsdLogMessage(CUPSD_LOG_ERROR,
1464 "cupsdCopyLocation: Unable to copy allow name \"%s\": %s",
1465 (*loc)->allow[i].mask.name.name, strerror(errno));
1466 cupsdDeleteLocation(temp);
1467 return (NULL);
1468 }
1469 break;
1470 case AUTH_IP :
1471 memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
1472 sizeof(cupsd_ipmask_t));
1473 break;
1474 }
1475 }
1476
1477 if ((temp->num_deny = (*loc)->num_deny) > 0)
1478 {
1479 /*
1480 * Copy deny rules...
1481 */
1482
1483 if ((temp->deny = calloc(temp->num_deny, sizeof(cupsd_authmask_t))) == NULL)
1484 {
1485 cupsdLogMessage(CUPSD_LOG_ERROR,
1486 "cupsdCopyLocation: Unable to allocate memory for %d deny rules: %s",
1487 temp->num_deny, strerror(errno));
1488 cupsdDeleteLocation(temp);
1489 return (NULL);
1490 }
1491
1492 for (i = 0; i < temp->num_deny; i ++)
1493 switch (temp->deny[i].type = (*loc)->deny[i].type)
1494 {
1495 case AUTH_NAME :
1496 temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
1497 temp->deny[i].mask.name.name = strdup((*loc)->deny[i].mask.name.name);
1498
1499 if (temp->deny[i].mask.name.name == NULL)
1500 {
1501 cupsdLogMessage(CUPSD_LOG_ERROR,
1502 "cupsdCopyLocation: Unable to copy deny name \"%s\": %s",
1503 (*loc)->deny[i].mask.name.name, strerror(errno));
1504 cupsdDeleteLocation(temp);
1505 return (NULL);
1506 }
1507 break;
1508 case AUTH_IP :
1509 memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
1510 sizeof(cupsd_ipmask_t));
1511 break;
1512 }
1513 }
1514
1515 return (temp);
1516 }
1517
1518
1519 /*
1520 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1521 */
1522
1523 void
1524 cupsdDeleteAllLocations(void)
1525 {
1526 cupsd_location_t *loc; /* Current location */
1527
1528
1529 /*
1530 * Free all of the allow/deny records first...
1531 */
1532
1533 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1534 loc;
1535 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1536 cupsdDeleteLocation(loc);
1537
1538 /*
1539 * Then free the location array...
1540 */
1541
1542 cupsArrayDelete(Locations);
1543 Locations = NULL;
1544 }
1545
1546
1547 /*
1548 * 'cupsdDeleteLocation()' - Free all memory used by a location.
1549 */
1550
1551 void
1552 cupsdDeleteLocation(
1553 cupsd_location_t *loc) /* I - Location to delete */
1554 {
1555 int i; /* Looping var */
1556 cupsd_authmask_t *mask; /* Current mask */
1557
1558
1559 cupsArrayRemove(Locations, loc);
1560
1561 for (i = loc->num_names - 1; i >= 0; i --)
1562 free(loc->names[i]);
1563
1564 if (loc->num_names > 0)
1565 free(loc->names);
1566
1567 for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
1568 if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1569 free(mask->mask.name.name);
1570
1571 if (loc->num_allow > 0)
1572 free(loc->allow);
1573
1574 for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
1575 if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
1576 free(mask->mask.name.name);
1577
1578 if (loc->num_deny > 0)
1579 free(loc->deny);
1580
1581 free(loc->location);
1582 free(loc);
1583 }
1584
1585
1586 /*
1587 * 'cupsdDenyHost()' - Add a host name that is not allowed to access the
1588 * location.
1589 */
1590
1591 void
1592 cupsdDenyHost(cupsd_location_t *loc, /* I - Location to add to */
1593 char *name) /* I - Name of host or domain to add */
1594 {
1595 cupsd_authmask_t *temp; /* New host/domain mask */
1596 char ifname[32], /* Interface name */
1597 *ifptr; /* Pointer to end of name */
1598
1599
1600 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDenyHost(loc=%p(%s), name=\"%s\")",
1601 loc, loc->location ? loc->location : "nil", name);
1602
1603 if ((temp = add_deny(loc)) == NULL)
1604 return;
1605
1606 if (!strcasecmp(name, "@LOCAL"))
1607 {
1608 /*
1609 * Deny *interface*...
1610 */
1611
1612 temp->type = AUTH_INTERFACE;
1613 temp->mask.name.name = strdup("*");
1614 temp->mask.name.length = 1;
1615 }
1616 else if (!strncasecmp(name, "@IF(", 4))
1617 {
1618 /*
1619 * Deny *interface*...
1620 */
1621
1622 strlcpy(ifname, name + 4, sizeof(ifname));
1623
1624 ifptr = ifname + strlen(ifname);
1625
1626 if (ifptr[-1] == ')')
1627 {
1628 ifptr --;
1629 *ifptr = '\0';
1630 }
1631
1632 temp->type = AUTH_INTERFACE;
1633 temp->mask.name.name = strdup(ifname);
1634 temp->mask.name.length = ifptr - ifname;
1635 }
1636 else
1637 {
1638 /*
1639 * Deny name...
1640 */
1641
1642 temp->type = AUTH_NAME;
1643 temp->mask.name.name = strdup(name);
1644 temp->mask.name.length = strlen(name);
1645 }
1646 }
1647
1648
1649 /*
1650 * 'cupsdDenyIP()' - Add an IP address or network that is not allowed to
1651 * access the location.
1652 */
1653
1654 void
1655 cupsdDenyIP(cupsd_location_t *loc, /* I - Location to add to */
1656 unsigned address[4],/* I - IP address to add */
1657 unsigned netmask[4])/* I - Netmask of address */
1658 {
1659 cupsd_authmask_t *temp; /* New host/domain mask */
1660
1661
1662 cupsdLogMessage(CUPSD_LOG_DEBUG,
1663 "cupsdDenyIP(loc=%p(%s), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)",
1664 loc, loc->location ? loc->location : "nil",
1665 address[0], address[1], address[2], address[3],
1666 netmask[0], netmask[1], netmask[2], netmask[3]);
1667
1668 if ((temp = add_deny(loc)) == NULL)
1669 return;
1670
1671 temp->type = AUTH_IP;
1672 memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
1673 memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
1674 }
1675
1676
1677 /*
1678 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1679 */
1680
1681 cupsd_location_t * /* O - Location that matches */
1682 cupsdFindBest(const char *path, /* I - Resource path */
1683 http_state_t state) /* I - HTTP state/request */
1684 {
1685 char uri[HTTP_MAX_URI],
1686 /* URI in request... */
1687 *uriptr; /* Pointer into URI */
1688 cupsd_location_t *loc, /* Current location */
1689 *best; /* Best match for location so far */
1690 int bestlen; /* Length of best match */
1691 int limit; /* Limit field */
1692 static const int limits[] = /* Map http_status_t to AUTH_LIMIT_xyz */
1693 {
1694 AUTH_LIMIT_ALL,
1695 AUTH_LIMIT_OPTIONS,
1696 AUTH_LIMIT_GET,
1697 AUTH_LIMIT_GET,
1698 AUTH_LIMIT_HEAD,
1699 AUTH_LIMIT_POST,
1700 AUTH_LIMIT_POST,
1701 AUTH_LIMIT_POST,
1702 AUTH_LIMIT_PUT,
1703 AUTH_LIMIT_PUT,
1704 AUTH_LIMIT_DELETE,
1705 AUTH_LIMIT_TRACE,
1706 AUTH_LIMIT_ALL,
1707 AUTH_LIMIT_ALL
1708 };
1709
1710
1711 /*
1712 * First copy the connection URI to a local string so we have drop
1713 * any .ppd extension from the pathname in /printers or /classes
1714 * URIs...
1715 */
1716
1717 strlcpy(uri, path, sizeof(uri));
1718
1719 if (!strncmp(uri, "/printers/", 10) ||
1720 !strncmp(uri, "/classes/", 9))
1721 {
1722 /*
1723 * Check if the URI has .ppd on the end...
1724 */
1725
1726 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1727
1728 if (!strcmp(uriptr, ".ppd"))
1729 *uriptr = '\0';
1730 }
1731
1732 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1733
1734 /*
1735 * Loop through the list of locations to find a match...
1736 */
1737
1738 limit = limits[state];
1739 best = NULL;
1740 bestlen = 0;
1741
1742 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1743 loc;
1744 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1745 {
1746 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1747 loc->location ? loc->location : "nil", loc->limit);
1748
1749 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1750 {
1751 /*
1752 * Use case-insensitive comparison for queue names...
1753 */
1754
1755 if (loc->length > bestlen && loc->location &&
1756 !strncasecmp(uri, loc->location, loc->length) &&
1757 loc->location[0] == '/' &&
1758 (limit & loc->limit) != 0)
1759 {
1760 best = loc;
1761 bestlen = loc->length;
1762 }
1763 }
1764 else
1765 {
1766 /*
1767 * Use case-sensitive comparison for other URIs...
1768 */
1769
1770 if (loc->length > bestlen && loc->location &&
1771 !strncmp(uri, loc->location, loc->length) &&
1772 loc->location[0] == '/' &&
1773 (limit & loc->limit) != 0)
1774 {
1775 best = loc;
1776 bestlen = loc->length;
1777 }
1778 }
1779 }
1780
1781 /*
1782 * Return the match, if any...
1783 */
1784
1785 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1786 best ? best->location : "NONE");
1787
1788 return (best);
1789 }
1790
1791
1792 /*
1793 * 'cupsdFindLocation()' - Find the named location.
1794 */
1795
1796 cupsd_location_t * /* O - Location that matches */
1797 cupsdFindLocation(const char *location) /* I - Connection */
1798 {
1799 cupsd_location_t key; /* Search key */
1800
1801
1802 key.location = (char *)location;
1803
1804 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1805 }
1806
1807
1808 /*
1809 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1810 */
1811
1812 http_status_t /* O - HTTP_OK if authorized or error code */
1813 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1814 const char *owner)/* I - Owner of object */
1815 {
1816 int i, j, /* Looping vars */
1817 auth; /* Authorization status */
1818 unsigned address[4]; /* Authorization address */
1819 cupsd_location_t *best; /* Best match for location so far */
1820 int hostlen; /* Length of hostname */
1821 const char *username; /* Username to authorize */
1822 struct passwd *pw; /* User password data */
1823 static const char * const levels[] = /* Auth levels */
1824 {
1825 "ANON",
1826 "USER",
1827 "GROUP"
1828 };
1829 static const char * const types[] = /* Auth types */
1830 {
1831 "NONE",
1832 "BASIC",
1833 "DIGEST",
1834 "BASICDIGEST",
1835 "KERBEROS"
1836 };
1837
1838
1839 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1840 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
1841 con->uri, con->best, con->best ? con->best->location ?
1842 con->best->location : "(null)" : "");
1843 if (owner)
1844 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1845 "cupsdIsAuthorized: owner=\"%s\"", owner);
1846
1847 /*
1848 * If there is no "best" authentication rule for this request, then
1849 * access is allowed from the local system and denied from other
1850 * addresses...
1851 */
1852
1853 if (!con->best)
1854 {
1855 if (!strcmp(con->http.hostname, "localhost") ||
1856 !strcmp(con->http.hostname, ServerName))
1857 return (HTTP_OK);
1858 else
1859 return (HTTP_FORBIDDEN);
1860 }
1861
1862 best = con->best;
1863
1864 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1865 "cupsdIsAuthorized: level=AUTH_%s, type=AUTH_%s, "
1866 "satisfy=AUTH_SATISFY_%s, num_names=%d",
1867 levels[best->level], types[best->type],
1868 best->satisfy ? "ANY" : "ALL", best->num_names);
1869
1870 if (best->limit == AUTH_LIMIT_IPP)
1871 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
1872 best->op, ippOpString(best->op));
1873
1874 /*
1875 * Check host/ip-based accesses...
1876 */
1877
1878 #ifdef AF_INET6
1879 if (con->http.hostaddr->addr.sa_family == AF_INET6)
1880 {
1881 /*
1882 * Copy IPv6 address...
1883 */
1884
1885 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1886 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1887 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1888 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1889 }
1890 else
1891 #endif /* AF_INET6 */
1892 if (con->http.hostaddr->addr.sa_family == AF_INET)
1893 {
1894 /*
1895 * Copy IPv4 address...
1896 */
1897
1898 address[0] = 0;
1899 address[1] = 0;
1900 address[2] = 0;
1901 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
1902 }
1903 else
1904 memset(address, 0, sizeof(address));
1905
1906 hostlen = strlen(con->http.hostname);
1907
1908 if (!strcasecmp(con->http.hostname, "localhost"))
1909 {
1910 /*
1911 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1912 */
1913
1914 auth = AUTH_ALLOW;
1915 }
1916 else
1917 {
1918 /*
1919 * Do authorization checks on the domain/address...
1920 */
1921
1922 switch (best->order_type)
1923 {
1924 default :
1925 auth = AUTH_DENY; /* anti-compiler-warning-code */
1926 break;
1927
1928 case AUTH_ALLOW : /* Order Deny,Allow */
1929 auth = AUTH_ALLOW;
1930
1931 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1932 best->num_deny, best->deny))
1933 auth = AUTH_DENY;
1934
1935 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1936 best->num_allow, best->allow))
1937 auth = AUTH_ALLOW;
1938 break;
1939
1940 case AUTH_DENY : /* Order Allow,Deny */
1941 auth = AUTH_DENY;
1942
1943 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1944 best->num_allow, best->allow))
1945 auth = AUTH_ALLOW;
1946
1947 if (cupsdCheckAuth(address, con->http.hostname, hostlen,
1948 best->num_deny, best->deny))
1949 auth = AUTH_DENY;
1950 break;
1951 }
1952 }
1953
1954 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
1955 auth ? "DENY" : "ALLOW");
1956
1957 if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
1958 return (HTTP_FORBIDDEN);
1959
1960 #ifdef HAVE_SSL
1961 /*
1962 * See if encryption is required...
1963 */
1964
1965 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
1966 strcasecmp(con->http.hostname, "localhost") &&
1967 best->satisfy == AUTH_SATISFY_ALL) &&
1968 !(best->type == AUTH_NEGOTIATE ||
1969 (best->type == AUTH_NONE && DefaultAuthType == AUTH_NEGOTIATE)))
1970 {
1971 cupsdLogMessage(CUPSD_LOG_DEBUG,
1972 "cupsdIsAuthorized: Need upgrade to TLS...");
1973 return (HTTP_UPGRADE_REQUIRED);
1974 }
1975 #endif /* HAVE_SSL */
1976
1977 /*
1978 * Now see what access level is required...
1979 */
1980
1981 if (best->level == AUTH_ANON || /* Anonymous access - allow it */
1982 (best->type == AUTH_NONE && best->num_names == 0))
1983 return (HTTP_OK);
1984
1985 if (!con->username[0] && best->type == AUTH_NONE &&
1986 best->limit == AUTH_LIMIT_IPP)
1987 {
1988 /*
1989 * Check for unauthenticated username...
1990 */
1991
1992 ipp_attribute_t *attr; /* requesting-user-name attribute */
1993
1994
1995 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1996 if (attr)
1997 {
1998 cupsdLogMessage(CUPSD_LOG_DEBUG,
1999 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
2000 attr->values[0].string.text);
2001 username = attr->values[0].string.text;
2002 }
2003 else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
2004 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2005 else
2006 return (HTTP_OK); /* unless overridden with Satisfy */
2007 }
2008 else
2009 {
2010 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
2011 con->username);
2012
2013 #ifdef HAVE_AUTHORIZATION_H
2014 if (!con->username[0] && !con->authref)
2015 #else
2016 if (!con->username[0])
2017 #endif /* HAVE_AUTHORIZATION_H */
2018 {
2019 if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
2020 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2021 else
2022 return (HTTP_OK); /* unless overridden with Satisfy */
2023 }
2024
2025 username = con->username;
2026 }
2027
2028 /*
2029 * OK, got a username. See if we need normal user access, or group
2030 * access... (root always matches)
2031 */
2032
2033 if (!strcmp(username, "root"))
2034 return (HTTP_OK);
2035
2036 /*
2037 * Get the user info...
2038 */
2039
2040 if (username[0])
2041 {
2042 pw = getpwnam(username);
2043 endpwent();
2044 }
2045 else
2046 pw = NULL;
2047
2048 if (best->level == AUTH_USER)
2049 {
2050 /*
2051 * If there are no names associated with this location, then
2052 * any valid user is OK...
2053 */
2054
2055 if (best->num_names == 0)
2056 return (HTTP_OK);
2057
2058 /*
2059 * Otherwise check the user list and return OK if this user is
2060 * allowed...
2061 */
2062
2063 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2064 "cupsdIsAuthorized: Checking user membership...");
2065
2066 #ifdef HAVE_AUTHORIZATION_H
2067 /*
2068 * If an authorization reference was supplied it must match a right name...
2069 */
2070
2071 if (con->authref)
2072 {
2073 for (i = 0; i < best->num_names; i ++)
2074 {
2075 if (!strncasecmp(best->names[i], "@AUTHKEY(", 9) &&
2076 check_authref(con, best->names[i] + 9))
2077 return (HTTP_OK);
2078 else if (!strcasecmp(best->names[i], "@SYSTEM") &&
2079 SystemGroupAuthKey &&
2080 check_authref(con, SystemGroupAuthKey))
2081 return (HTTP_OK);
2082 }
2083
2084 return (HTTP_UNAUTHORIZED);
2085 }
2086 #endif /* HAVE_AUTHORIZATION_H */
2087
2088 for (i = 0; i < best->num_names; i ++)
2089 {
2090 if (!strcasecmp(best->names[i], "@OWNER") && owner &&
2091 !strcasecmp(username, owner))
2092 return (HTTP_OK);
2093 else if (!strcasecmp(best->names[i], "@SYSTEM"))
2094 {
2095 for (j = 0; j < NumSystemGroups; j ++)
2096 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2097 return (HTTP_OK);
2098 }
2099 else if (best->names[i][0] == '@')
2100 {
2101 if (cupsdCheckGroup(username, pw, best->names[i] + 1))
2102 return (HTTP_OK);
2103 }
2104 else if (!strcasecmp(username, best->names[i]))
2105 return (HTTP_OK);
2106 }
2107
2108 return (HTTP_UNAUTHORIZED);
2109 }
2110
2111 /*
2112 * Check to see if this user is in any of the named groups...
2113 */
2114
2115 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2116 "cupsdIsAuthorized: Checking group membership...");
2117
2118 /*
2119 * Check to see if this user is in any of the named groups...
2120 */
2121
2122 for (i = 0; i < best->num_names; i ++)
2123 {
2124 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2125 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2126 best->names[i]);
2127
2128 if (!strcasecmp(best->names[i], "@SYSTEM"))
2129 {
2130 for (j = 0; j < NumSystemGroups; j ++)
2131 if (cupsdCheckGroup(username, pw, SystemGroups[j]))
2132 return (HTTP_OK);
2133 }
2134 else if (cupsdCheckGroup(username, pw, best->names[i]))
2135 return (HTTP_OK);
2136 }
2137
2138 /*
2139 * The user isn't part of the specified group, so deny access...
2140 */
2141
2142 cupsdLogMessage(CUPSD_LOG_DEBUG,
2143 "cupsdIsAuthorized: User not in group(s)!");
2144
2145 return (HTTP_UNAUTHORIZED);
2146 }
2147
2148
2149 /*
2150 * 'add_allow()' - Add an allow mask to the location.
2151 */
2152
2153 static cupsd_authmask_t * /* O - New mask record */
2154 add_allow(cupsd_location_t *loc) /* I - Location to add to */
2155 {
2156 cupsd_authmask_t *temp; /* New mask record */
2157
2158
2159 /*
2160 * Range-check...
2161 */
2162
2163 if (loc == NULL)
2164 return (NULL);
2165
2166 /*
2167 * Try to allocate memory for the record...
2168 */
2169
2170 if (loc->num_allow == 0)
2171 temp = malloc(sizeof(cupsd_authmask_t));
2172 else
2173 temp = realloc(loc->allow, sizeof(cupsd_authmask_t) * (loc->num_allow + 1));
2174
2175 if (temp == NULL)
2176 return (NULL);
2177
2178 loc->allow = temp;
2179 temp += loc->num_allow;
2180 loc->num_allow ++;
2181
2182 /*
2183 * Clear the mask record and return...
2184 */
2185
2186 memset(temp, 0, sizeof(cupsd_authmask_t));
2187 return (temp);
2188 }
2189
2190
2191 /*
2192 * 'add_deny()' - Add a deny mask to the location.
2193 */
2194
2195 static cupsd_authmask_t * /* O - New mask record */
2196 add_deny(cupsd_location_t *loc) /* I - Location to add to */
2197 {
2198 cupsd_authmask_t *temp; /* New mask record */
2199
2200
2201 /*
2202 * Range-check...
2203 */
2204
2205 if (loc == NULL)
2206 return (NULL);
2207
2208 /*
2209 * Try to allocate memory for the record...
2210 */
2211
2212 if (loc->num_deny == 0)
2213 temp = malloc(sizeof(cupsd_authmask_t));
2214 else
2215 temp = realloc(loc->deny, sizeof(cupsd_authmask_t) * (loc->num_deny + 1));
2216
2217 if (temp == NULL)
2218 return (NULL);
2219
2220 loc->deny = temp;
2221 temp += loc->num_deny;
2222 loc->num_deny ++;
2223
2224 /*
2225 * Clear the mask record and return...
2226 */
2227
2228 memset(temp, 0, sizeof(cupsd_authmask_t));
2229 return (temp);
2230 }
2231
2232
2233 #ifdef HAVE_AUTHORIZATION_H
2234 /*
2235 * 'check_authref()' - Check if an authorization services reference has the
2236 * supplied right.
2237 */
2238
2239 static int /* O - 1 if right is valid, 0 otherwise */
2240 check_authref(cupsd_client_t *con, /* I - Connection */
2241 const char *right) /* I - Right name */
2242 {
2243 OSStatus status; /* OS Status */
2244 AuthorizationItem authright; /* Authorization right */
2245 AuthorizationRights authrights; /* Authorization rights */
2246 AuthorizationFlags authflags; /* Authorization flags */
2247
2248
2249 /*
2250 * Check to see if the user is allowed to perform the task...
2251 */
2252
2253 if (!con->authref)
2254 return (0);
2255
2256 authright.name = right;
2257 authright.valueLength = 0;
2258 authright.value = NULL;
2259 authright.flags = 0;
2260
2261 authrights.count = 1;
2262 authrights.items = &authright;
2263
2264 authflags = kAuthorizationFlagDefaults |
2265 kAuthorizationFlagExtendRights;
2266
2267 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2268 kAuthorizationEmptyEnvironment,
2269 authflags, NULL)) != 0)
2270 {
2271 cupsdLogMessage(CUPSD_LOG_ERROR,
2272 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2273 authright.name, (int)status, cssmErrorString(status));
2274 return (0);
2275 }
2276
2277 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2278 "AuthorizationCopyRights(\"%s\") succeeded!",
2279 authright.name);
2280
2281 return (1);
2282 }
2283 #endif /* HAVE_AUTHORIZATION_H */
2284
2285
2286 /*
2287 * 'compare_locations()' - Compare two locations.
2288 */
2289
2290 static int /* O - Result of comparison */
2291 compare_locations(cupsd_location_t *a, /* I - First location */
2292 cupsd_location_t *b) /* I - Second location */
2293 {
2294 return (strcmp(b->location, a->location));
2295 }
2296
2297
2298 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2299 /*
2300 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2301 * as needed.
2302 */
2303
2304 static char * /* O - Encrypted password */
2305 cups_crypt(const char *pw, /* I - Password string */
2306 const char *salt) /* I - Salt (key) string */
2307 {
2308 if (!strncmp(salt, "$1$", 3))
2309 {
2310 /*
2311 * Use MD5 passwords without the benefit of PAM; this is for
2312 * Slackware Linux, and the algorithm was taken from the
2313 * old shadow-19990827/lib/md5crypt.c source code... :(
2314 */
2315
2316 int i; /* Looping var */
2317 unsigned long n; /* Output number */
2318 int pwlen; /* Length of password string */
2319 const char *salt_end; /* End of "salt" data for MD5 */
2320 char *ptr; /* Pointer into result string */
2321 _cups_md5_state_t state; /* Primary MD5 state info */
2322 _cups_md5_state_t state2; /* Secondary MD5 state info */
2323 unsigned char digest[16]; /* MD5 digest result */
2324 static char result[120]; /* Final password string */
2325
2326
2327 /*
2328 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2329 * Get a maximum of 8 characters of salt data after $1$...
2330 */
2331
2332 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2333 if (*salt_end == '$')
2334 break;
2335
2336 /*
2337 * Compute the MD5 sum we need...
2338 */
2339
2340 pwlen = strlen(pw);
2341
2342 _cupsMD5Init(&state);
2343 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2344 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2345
2346 _cupsMD5Init(&state2);
2347 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2348 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2349 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2350 _cupsMD5Finish(&state2, digest);
2351
2352 for (i = pwlen; i > 0; i -= 16)
2353 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2354
2355 for (i = pwlen; i > 0; i >>= 1)
2356 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2357
2358 _cupsMD5Finish(&state, digest);
2359
2360 for (i = 0; i < 1000; i ++)
2361 {
2362 _cupsMD5Init(&state);
2363
2364 if (i & 1)
2365 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2366 else
2367 _cupsMD5Append(&state, digest, 16);
2368
2369 if (i % 3)
2370 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2371
2372 if (i % 7)
2373 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2374
2375 if (i & 1)
2376 _cupsMD5Append(&state, digest, 16);
2377 else
2378 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2379
2380 _cupsMD5Finish(&state, digest);
2381 }
2382
2383 /*
2384 * Copy the final sum to the result string and return...
2385 */
2386
2387 memcpy(result, salt, salt_end - salt);
2388 ptr = result + (salt_end - salt);
2389 *ptr++ = '$';
2390
2391 for (i = 0; i < 5; i ++, ptr += 4)
2392 {
2393 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2394
2395 if (i < 4)
2396 n |= digest[i + 12];
2397 else
2398 n |= digest[5];
2399
2400 to64(ptr, n, 4);
2401 }
2402
2403 to64(ptr, digest[11], 2);
2404 ptr += 2;
2405 *ptr = '\0';
2406
2407 return (result);
2408 }
2409 else
2410 {
2411 /*
2412 * Use the standard crypt() function...
2413 */
2414
2415 return (crypt(pw, salt));
2416 }
2417 }
2418 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2419
2420
2421 #ifdef HAVE_GSSAPI
2422 /*
2423 * 'get_gss_creds()' - Obtain GSS credentials.
2424 */
2425
2426 static gss_cred_id_t /* O - Server credentials */
2427 get_gss_creds(const char *service_name) /* I - Service name */
2428 {
2429 OM_uint32 major_status, /* Major status code */
2430 minor_status; /* Minor status code */
2431 gss_name_t server_name; /* Server name */
2432 gss_cred_id_t server_creds; /* Server credentials */
2433 gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
2434 /* Service name token */
2435 char buf[1024], /* Service name buffer */
2436 fqdn[HTTP_MAX_URI]; /* Hostname of server */
2437
2438
2439 snprintf(buf, sizeof(buf), "%s@%s", service_name,
2440 httpGetHostname(NULL, fqdn, sizeof(fqdn)));
2441
2442 token.value = buf;
2443 token.length = strlen(buf);
2444 server_name = GSS_C_NO_NAME;
2445 major_status = gss_import_name(&minor_status, &token,
2446 GSS_C_NT_HOSTBASED_SERVICE,
2447 &server_name);
2448
2449 memset(&token, 0, sizeof(token));
2450
2451 if (GSS_ERROR(major_status))
2452 {
2453 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2454 "gss_import_name() failed");
2455 return (NULL);
2456 }
2457
2458 major_status = gss_display_name(&minor_status, server_name, &token, NULL);
2459
2460 if (GSS_ERROR(major_status))
2461 {
2462 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2463 "gss_display_name() failed");
2464 return (NULL);
2465 }
2466
2467 cupsdLogMessage(CUPSD_LOG_DEBUG,
2468 "get_gss_creds: Attempting to acquire credentials for %s...",
2469 (char *)token.value);
2470
2471 server_creds = GSS_C_NO_CREDENTIAL;
2472 major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
2473 GSS_C_NO_OID_SET, GSS_C_ACCEPT,
2474 &server_creds, NULL, NULL);
2475 if (GSS_ERROR(major_status))
2476 {
2477 cupsdLogGSSMessage(CUPSD_LOG_WARN, major_status, minor_status,
2478 "gss_acquire_cred() failed");
2479 gss_release_name(&minor_status, &server_name);
2480 gss_release_buffer(&minor_status, &token);
2481 return (NULL);
2482 }
2483
2484 cupsdLogMessage(CUPSD_LOG_DEBUG,
2485 "get_gss_creds: Credentials acquired successfully for %s.",
2486 (char *)token.value);
2487
2488 gss_release_name(&minor_status, &server_name);
2489 gss_release_buffer(&minor_status, &token);
2490
2491 return (server_creds);
2492 }
2493 #endif /* HAVE_GSSAPI */
2494
2495
2496 /*
2497 * 'get_md5_password()' - Get an MD5 password.
2498 */
2499
2500 static char * /* O - MD5 password string */
2501 get_md5_password(const char *username, /* I - Username */
2502 const char *group, /* I - Group */
2503 char passwd[33]) /* O - MD5 password string */
2504 {
2505 cups_file_t *fp; /* passwd.md5 file */
2506 char filename[1024], /* passwd.md5 filename */
2507 line[256], /* Line from file */
2508 tempuser[33], /* User from file */
2509 tempgroup[33]; /* Group from file */
2510
2511
2512 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2513 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2514 username, group ? group : "(null)", passwd);
2515
2516 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2517 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2518 {
2519 if (errno != ENOENT)
2520 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2521 strerror(errno));
2522
2523 return (NULL);
2524 }
2525
2526 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2527 {
2528 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2529 {
2530 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2531 continue;
2532 }
2533
2534 if (!strcmp(username, tempuser) &&
2535 (group == NULL || !strcmp(group, tempgroup)))
2536 {
2537 /*
2538 * Found the password entry!
2539 */
2540
2541 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2542 username, tempgroup);
2543
2544 cupsFileClose(fp);
2545 return (passwd);
2546 }
2547 }
2548
2549 /*
2550 * Didn't find a password entry - return NULL!
2551 */
2552
2553 cupsFileClose(fp);
2554 return (NULL);
2555 }
2556
2557
2558 #if HAVE_LIBPAM
2559 /*
2560 * 'pam_func()' - PAM conversation function.
2561 */
2562
2563 static int /* O - Success or failure */
2564 pam_func(
2565 int num_msg, /* I - Number of messages */
2566 const struct pam_message **msg, /* I - Messages */
2567 struct pam_response **resp, /* O - Responses */
2568 void *appdata_ptr)
2569 /* I - Pointer to connection */
2570 {
2571 int i; /* Looping var */
2572 struct pam_response *replies; /* Replies */
2573 cupsd_authdata_t *data; /* Pointer to auth data */
2574
2575
2576 /*
2577 * Allocate memory for the responses...
2578 */
2579
2580 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2581 return (PAM_CONV_ERR);
2582
2583 /*
2584 * Answer all of the messages...
2585 */
2586
2587 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2588
2589 #ifdef __hpux
2590 /*
2591 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2592 * module. This is a workaround...
2593 */
2594
2595 data = auth_data;
2596 (void)appdata_ptr;
2597 #else
2598 data = (cupsd_authdata_t *)appdata_ptr;
2599 #endif /* __hpux */
2600
2601 for (i = 0; i < num_msg; i ++)
2602 {
2603 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2604
2605 switch (msg[i]->msg_style)
2606 {
2607 case PAM_PROMPT_ECHO_ON:
2608 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2609 data->username));
2610 replies[i].resp_retcode = PAM_SUCCESS;
2611 replies[i].resp = strdup(data->username);
2612 break;
2613
2614 case PAM_PROMPT_ECHO_OFF:
2615 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2616 data->password));
2617 replies[i].resp_retcode = PAM_SUCCESS;
2618 replies[i].resp = strdup(data->password);
2619 break;
2620
2621 case PAM_TEXT_INFO:
2622 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2623 replies[i].resp_retcode = PAM_SUCCESS;
2624 replies[i].resp = NULL;
2625 break;
2626
2627 case PAM_ERROR_MSG:
2628 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2629 replies[i].resp_retcode = PAM_SUCCESS;
2630 replies[i].resp = NULL;
2631 break;
2632
2633 default:
2634 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2635 msg[i]->msg_style));
2636 free(replies);
2637 return (PAM_CONV_ERR);
2638 }
2639 }
2640
2641 /*
2642 * Return the responses back to PAM...
2643 */
2644
2645 *resp = replies;
2646
2647 return (PAM_SUCCESS);
2648 }
2649 #elif !defined(HAVE_USERSEC_H)
2650
2651
2652 /*
2653 * 'to64()' - Base64-encode an integer value...
2654 */
2655
2656 static void
2657 to64(char *s, /* O - Output string */
2658 unsigned long v, /* I - Value to encode */
2659 int n) /* I - Number of digits */
2660 {
2661 const char *itoa64 = "./0123456789"
2662 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2663 "abcdefghijklmnopqrstuvwxyz";
2664
2665
2666 for (; n > 0; n --, v >>= 6)
2667 *s++ = itoa64[v & 0x3f];
2668 }
2669 #endif /* HAVE_LIBPAM */
2670
2671
2672 /*
2673 * End of "$Id: auth.c 6758 2007-08-02 00:13:44Z mike $".
2674 */
Unnamed repository; edit this file 'description' to name the repository.