]> git.ipfire.org Git - thirdparty/cups.git/blob - scheduler/auth.c
projects / thirdparty / cups.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge changes from CUPS 1.5svn-r9631.
[thirdparty/cups.git] / scheduler / auth.c
1 /*
2 * "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $"
3 *
4 * Authorization routines for the CUPS scheduler.
5 *
6 * Copyright 2007-2011 by Apple Inc.
7 * Copyright 1997-2007 by Easy Software Products, all rights reserved.
8 *
9 * This file contains Kerberos support code, copyright 2006 by
10 * Jelmer Vernooij.
11 *
12 * These coded instructions, statements, and computer programs are the
13 * property of Apple Inc. and are protected by Federal copyright
14 * law. Distribution and use rights are outlined in the file "LICENSE.txt"
15 * which should have been included with this file. If this file is
16 * file is missing or damaged, see the license at "http://www.cups.org/".
17 *
18 * Contents:
19 *
20 * cupsdAddIPMask() - Add an IP address authorization mask.
21 * cupsdAddLocation() - Add a location for authorization.
22 * cupsdAddName() - Add a name to a location...
23 * cupsdAddNameMask() - Add a host or interface name authorization
24 * mask.
25 * cupsdAuthorize() - Validate any authorization credentials.
26 * cupsdCheckAccess() - Check whether the given address is allowed to
27 * access a location.
28 * cupsdCheckAuth() - Check authorization masks.
29 * cupsdCheckGroup() - Check for a user's group membership.
30 * cupsdCopyKrb5Creds() - Get a copy of the Kerberos credentials.
31 * cupsdCopyLocation() - Make a copy of a location...
32 * cupsdDeleteAllLocations() - Free all memory used for location
33 * authorization.
34 * cupsdFindBest() - Find the location entry that best matches the
35 * resource.
36 * cupsdFindLocation() - Find the named location.
37 * cupsdFreeLocation() - Free all memory used by a location.
38 * cupsdIsAuthorized() - Check to see if the user is authorized...
39 * cupsdNewLocation() - Create a new location for authorization.
40 * check_authref() - Check if an authorization services reference
41 * has the supplied right.
42 * compare_locations() - Compare two locations.
43 * copy_authmask() - Copy function for auth masks.
44 * cups_crypt() - Encrypt the password using the DES or MD5
45 * algorithms, as needed.
46 * free_authmask() - Free function for auth masks.
47 * get_md5_password() - Get an MD5 password.
48 * pam_func() - PAM conversation function.
49 * to64() - Base64-encode an integer value...
50 */
51
52 /*
53 * Include necessary headers...
54 */
55
56 #include "cupsd.h"
57 #include <grp.h>
58 #ifdef HAVE_SHADOW_H
59 # include <shadow.h>
60 #endif /* HAVE_SHADOW_H */
61 #ifdef HAVE_CRYPT_H
62 # include <crypt.h>
63 #endif /* HAVE_CRYPT_H */
64 #if HAVE_LIBPAM
65 # ifdef HAVE_PAM_PAM_APPL_H
66 # include <pam/pam_appl.h>
67 # else
68 # include <security/pam_appl.h>
69 # endif /* HAVE_PAM_PAM_APPL_H */
70 #endif /* HAVE_LIBPAM */
71 #ifdef HAVE_USERSEC_H
72 # include <usersec.h>
73 #endif /* HAVE_USERSEC_H */
74 #ifdef HAVE_MEMBERSHIP_H
75 # include <membership.h>
76 #endif /* HAVE_MEMBERSHIP_H */
77 #ifdef HAVE_AUTHORIZATION_H
78 # include <Security/AuthorizationTags.h>
79 # ifdef HAVE_SECBASEPRIV_H
80 # include <Security/SecBasePriv.h>
81 # else
82 extern const char *cssmErrorString(int error);
83 # endif /* HAVE_SECBASEPRIV_H */
84 #endif /* HAVE_AUTHORIZATION_H */
85 #ifdef HAVE_SYS_PARAM_H
86 # include <sys/param.h>
87 #endif /* HAVE_SYS_PARAM_H */
88 #ifdef HAVE_SYS_UCRED_H
89 # include <sys/ucred.h>
90 typedef struct xucred cupsd_ucred_t;
91 # define CUPSD_UCRED_UID(c) (c).cr_uid
92 #else
93 typedef struct ucred cupsd_ucred_t;
94 # define CUPSD_UCRED_UID(c) (c).uid
95 #endif /* HAVE_SYS_UCRED_H */
96 #ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
97 /* Not in public headers... */
98 extern void krb5_ipc_client_set_target_uid(uid_t);
99 extern void krb5_ipc_client_clear_target(void);
100 #endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
101
102
103 /*
104 * Local functions...
105 */
106
107 #ifdef HAVE_AUTHORIZATION_H
108 static int check_authref(cupsd_client_t *con, const char *right);
109 #endif /* HAVE_AUTHORIZATION_H */
110 static int compare_locations(cupsd_location_t *a,
111 cupsd_location_t *b);
112 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
113 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
114 static char *cups_crypt(const char *pw, const char *salt);
115 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
116 static void free_authmask(cupsd_authmask_t *am, void *data);
117 static char *get_md5_password(const char *username,
118 const char *group, char passwd[33]);
119 #if HAVE_LIBPAM
120 static int pam_func(int, const struct pam_message **,
121 struct pam_response **, void *);
122 #elif !defined(HAVE_USERSEC_H)
123 static void to64(char *s, unsigned long v, int n);
124 #endif /* HAVE_LIBPAM */
125
126
127 /*
128 * Local structures...
129 */
130
131 #if HAVE_LIBPAM
132 typedef struct cupsd_authdata_s /**** Authentication data ****/
133 {
134 char username[33], /* Username string */
135 password[33]; /* Password string */
136 } cupsd_authdata_t;
137 #endif /* HAVE_LIBPAM */
138
139
140 /*
141 * Local globals...
142 */
143
144 #if defined(__hpux) && HAVE_LIBPAM
145 static cupsd_authdata_t *auth_data; /* Current client being authenticated */
146 #endif /* __hpux && HAVE_LIBPAM */
147
148
149 /*
150 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
151 */
152
153 int /* O - 1 on success, 0 on failure */
154 cupsdAddIPMask(
155 cups_array_t **masks, /* IO - Masks array (created as needed) */
156 const unsigned address[4], /* I - IP address */
157 const unsigned netmask[4]) /* I - IP netmask */
158 {
159 cupsd_authmask_t temp; /* New host/domain mask */
160
161
162 cupsdLogMessage(CUPSD_LOG_DEBUG2,
163 "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, "
164 "netmask=%x:%x:%x:%x)",
165 masks, *masks,
166 address[0], address[1], address[2], address[3],
167 netmask[0], netmask[1], netmask[2], netmask[3]);
168
169 temp.type = CUPSD_AUTH_IP;
170 memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
171 memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
172
173 /*
174 * Create the masks array as needed and add...
175 */
176
177 if (!*masks)
178 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
179 (cups_acopy_func_t)copy_authmask,
180 (cups_afree_func_t)free_authmask);
181
182 return (cupsArrayAdd(*masks, &temp));
183 }
184
185
186 /*
187 * 'cupsdAddLocation()' - Add a location for authorization.
188 */
189
190 void
191 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
192 {
193 /*
194 * Make sure the locations array is created...
195 */
196
197 if (!Locations)
198 Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
199 (cups_ahash_func_t)NULL, 0,
200 (cups_acopy_func_t)NULL,
201 (cups_afree_func_t)cupsdFreeLocation);
202
203 if (Locations)
204 {
205 cupsArrayAdd(Locations, loc);
206
207 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"",
208 loc->location ? loc->location : "(null)");
209 }
210 }
211
212
213 /*
214 * 'cupsdAddName()' - Add a name to a location...
215 */
216
217 void
218 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
219 char *name) /* I - Name to add */
220 {
221 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")",
222 loc, name);
223
224 if (!loc->names)
225 loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
226 (cups_acopy_func_t)_cupsStrAlloc,
227 (cups_afree_func_t)_cupsStrFree);
228
229 if (!cupsArrayAdd(loc->names, name))
230 {
231 cupsdLogMessage(CUPSD_LOG_ERROR,
232 "Unable to duplicate name for location %s: %s",
233 loc->location ? loc->location : "nil", strerror(errno));
234 return;
235 }
236 }
237
238
239 /*
240 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
241 */
242
243 int /* O - 1 on success, 0 on failure */
244 cupsdAddNameMask(cups_array_t **masks, /* IO - Masks array (created as needed) */
245 char *name) /* I - Host or interface name */
246 {
247 cupsd_authmask_t temp; /* New host/domain mask */
248 char ifname[32], /* Interface name */
249 *ifptr; /* Pointer to end of name */
250
251
252 cupsdLogMessage(CUPSD_LOG_DEBUG2,
253 "cupsdAddNameMask(masks=%p(%p), name=\"%s\")",
254 masks, *masks, name);
255
256 if (!strcasecmp(name, "@LOCAL"))
257 {
258 /*
259 * Deny *interface*...
260 */
261
262 temp.type = CUPSD_AUTH_INTERFACE;
263 temp.mask.name.name = (char *)"*";
264 }
265 else if (!strncasecmp(name, "@IF(", 4))
266 {
267 /*
268 * Deny *interface*...
269 */
270
271 strlcpy(ifname, name + 4, sizeof(ifname));
272
273 ifptr = ifname + strlen(ifname) - 1;
274
275 if (ifptr >= ifname && *ifptr == ')')
276 {
277 ifptr --;
278 *ifptr = '\0';
279 }
280
281 temp.type = CUPSD_AUTH_INTERFACE;
282 temp.mask.name.name = ifname;
283 }
284 else
285 {
286 /*
287 * Deny name...
288 */
289
290 if (*name == '*')
291 name ++;
292
293 temp.type = CUPSD_AUTH_NAME;
294 temp.mask.name.name = (char *)name;
295 }
296
297 /*
298 * Set the name length...
299 */
300
301 temp.mask.name.length = strlen(temp.mask.name.name);
302
303 /*
304 * Create the masks array as needed and add...
305 */
306
307 if (!*masks)
308 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
309 (cups_acopy_func_t)copy_authmask,
310 (cups_afree_func_t)free_authmask);
311
312 return (cupsArrayAdd(*masks, &temp));
313 }
314
315
316 /*
317 * 'cupsdAuthorize()' - Validate any authorization credentials.
318 */
319
320 void
321 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
322 {
323 int type; /* Authentication type */
324 const char *authorization; /* Pointer into Authorization string */
325 char *ptr, /* Pointer into string */
326 username[256], /* Username string */
327 password[33]; /* Password string */
328 cupsd_cert_t *localuser; /* Certificate username */
329 char nonce[HTTP_MAX_VALUE], /* Nonce value from client */
330 md5[33], /* MD5 password */
331 basicmd5[33]; /* MD5 of Basic password */
332 static const char * const states[] = /* HTTP client states... */
333 {
334 "WAITING",
335 "OPTIONS",
336 "GET",
337 "GET",
338 "HEAD",
339 "POST",
340 "POST",
341 "POST",
342 "PUT",
343 "PUT",
344 "DELETE",
345 "TRACE",
346 "CLOSE",
347 "STATUS"
348 };
349
350
351 /*
352 * Locate the best matching location so we know what kind of
353 * authentication to expect...
354 */
355
356 con->best = cupsdFindBest(con->uri, con->http.state);
357 con->type = CUPSD_AUTH_NONE;
358
359 cupsdLogMessage(CUPSD_LOG_DEBUG2,
360 "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
361 con->uri, con->best, con->best ? con->best->location : "");
362
363 if (con->best && con->best->type != CUPSD_AUTH_NONE)
364 {
365 if (con->best->type == CUPSD_AUTH_DEFAULT)
366 type = DefaultAuthType;
367 else
368 type = con->best->type;
369 }
370 else
371 type = DefaultAuthType;
372
373 /*
374 * Decode the Authorization string...
375 */
376
377 authorization = httpGetField(&con->http, HTTP_FIELD_AUTHORIZATION);
378
379 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAuthorize: Authorization=\"%s\"",
380 authorization);
381
382 username[0] = '\0';
383 password[0] = '\0';
384
385 #ifdef HAVE_AUTHORIZATION_H
386 if (con->authref)
387 {
388 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
389 con->authref = NULL;
390 }
391 #endif /* HAVE_AUTHORIZATION_H */
392
393 if (!*authorization)
394 {
395 /*
396 * No authorization data provided, return early...
397 */
398
399 cupsdLogMessage(CUPSD_LOG_DEBUG,
400 "cupsdAuthorize: No authentication data provided.");
401 return;
402 }
403 #ifdef HAVE_AUTHORIZATION_H
404 else if (!strncmp(authorization, "AuthRef ", 8) &&
405 !strcasecmp(con->http.hostname, "localhost"))
406 {
407 OSStatus status; /* Status */
408 int authlen; /* Auth string length */
409 AuthorizationItemSet *authinfo; /* Authorization item set */
410
411 /*
412 * Get the Authorization Services data...
413 */
414
415 authorization += 8;
416 while (isspace(*authorization & 255))
417 authorization ++;
418
419 authlen = sizeof(nonce);
420 httpDecode64_2(nonce, &authlen, authorization);
421
422 if (authlen != kAuthorizationExternalFormLength)
423 {
424 cupsdLogMessage(CUPSD_LOG_ERROR,
425 "External Authorization reference size is incorrect!");
426 return;
427 }
428
429 if ((status = AuthorizationCreateFromExternalForm(
430 (AuthorizationExternalForm *)nonce, &con->authref)) != 0)
431 {
432 cupsdLogMessage(CUPSD_LOG_ERROR,
433 "AuthorizationCreateFromExternalForm returned %d (%s)",
434 (int)status, cssmErrorString(status));
435 return;
436 }
437
438 username[0] = '\0';
439
440 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
441 &authinfo))
442 {
443 if (authinfo->count == 1 && authinfo->items[0].value &&
444 authinfo->items[0].valueLength >= 2)
445 {
446 strlcpy(username, authinfo->items[0].value, sizeof(username));
447
448 cupsdLogMessage(CUPSD_LOG_DEBUG,
449 "cupsdAuthorize: Authorized as \"%s\" using AuthRef",
450 username);
451 }
452
453 AuthorizationFreeItemSet(authinfo);
454 }
455
456 if (!username[0])
457 {
458 /*
459 * No username in AuthRef, grab username using peer credentials...
460 */
461
462 struct passwd *pwd; /* Password entry for this user */
463 cupsd_ucred_t peercred; /* Peer credentials */
464 socklen_t peersize; /* Size of peer credentials */
465
466 peersize = sizeof(peercred);
467
468 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
469 {
470 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
471 strerror(errno));
472 return;
473 }
474
475 if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
476 {
477 cupsdLogMessage(CUPSD_LOG_ERROR,
478 "Unable to find UID %d for peer credentials.",
479 (int)CUPSD_UCRED_UID(peercred));
480 return;
481 }
482
483 strlcpy(username, pwd->pw_name, sizeof(username));
484
485 cupsdLogMessage(CUPSD_LOG_DEBUG,
486 "cupsdAuthorize: Authorized as \"%s\" using "
487 "AuthRef + PeerCred", username);
488 }
489
490 con->type = CUPSD_AUTH_BASIC;
491 }
492 #endif /* HAVE_AUTHORIZATION_H */
493 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
494 else if (!strncmp(authorization, "PeerCred ", 9) &&
495 con->http.hostaddr->addr.sa_family == AF_LOCAL)
496 {
497 /*
498 * Use peer credentials from domain socket connection...
499 */
500
501 struct passwd *pwd; /* Password entry for this user */
502 cupsd_ucred_t peercred; /* Peer credentials */
503 socklen_t peersize; /* Size of peer credentials */
504 #ifdef HAVE_AUTHORIZATION_H
505 const char *name; /* Authorizing name */
506
507 for (name = (char *)cupsArrayFirst(con->best->names);
508 name;
509 name = (char *)cupsArrayNext(con->best->names))
510 if (!strncasecmp(name, "@AUTHKEY(", 9) || !strcasecmp(name, "@SYSTEM"))
511 {
512 cupsdLogMessage(CUPSD_LOG_ERROR,
513 "PeerCred authentication not allowed for resource.");
514 return;
515 }
516 #endif /* HAVE_AUTHORIZATION_H */
517
518 if ((pwd = getpwnam(authorization + 9)) == NULL)
519 {
520 cupsdLogMessage(CUPSD_LOG_ERROR, "User \"%s\" does not exist.",
521 authorization + 9);
522 return;
523 }
524
525 peersize = sizeof(peercred);
526
527 # ifdef __APPLE__
528 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
529 # else
530 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
531 # endif /* __APPLE__ */
532 {
533 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
534 strerror(errno));
535 return;
536 }
537
538 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
539 {
540 cupsdLogMessage(CUPSD_LOG_ERROR,
541 "Invalid peer credentials for \"%s\" - got %d, "
542 "expected %d!", authorization + 9,
543 CUPSD_UCRED_UID(peercred), pwd->pw_uid);
544 # ifdef HAVE_SYS_UCRED_H
545 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_version=%d",
546 peercred.cr_version);
547 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_uid=%d",
548 peercred.cr_uid);
549 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_ngroups=%d",
550 peercred.cr_ngroups);
551 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAuthorize: cr_groups[0]=%d",
552 peercred.cr_groups[0]);
553 # endif /* HAVE_SYS_UCRED_H */
554 return;
555 }
556
557 strlcpy(username, authorization + 9, sizeof(username));
558
559 cupsdLogMessage(CUPSD_LOG_DEBUG,
560 "cupsdAuthorize: Authorized as %s using PeerCred",
561 username);
562
563 con->type = CUPSD_AUTH_BASIC;
564 }
565 #endif /* SO_PEERCRED && AF_LOCAL */
566 else if (!strncmp(authorization, "Local", 5) &&
567 !strcasecmp(con->http.hostname, "localhost"))
568 {
569 /*
570 * Get Local certificate authentication data...
571 */
572
573 authorization += 5;
574 while (isspace(*authorization & 255))
575 authorization ++;
576
577 if ((localuser = cupsdFindCert(authorization)) != NULL)
578 {
579 strlcpy(username, localuser->username, sizeof(username));
580
581 cupsdLogMessage(CUPSD_LOG_DEBUG,
582 "cupsdAuthorize: Authorized as %s using Local",
583 username);
584 }
585 else
586 {
587 cupsdLogMessage(CUPSD_LOG_ERROR,
588 "cupsdAuthorize: Local authentication certificate not "
589 "found!");
590 return;
591 }
592
593 #ifdef HAVE_GSSAPI
594 if (localuser->ccache)
595 con->type = CUPSD_AUTH_NEGOTIATE;
596 else
597 #endif /* HAVE_GSSAPI */
598 con->type = CUPSD_AUTH_BASIC;
599 }
600 else if (!strncmp(authorization, "Basic", 5))
601 {
602 /*
603 * Get the Basic authentication data...
604 */
605
606 int userlen; /* Username:password length */
607
608
609 authorization += 5;
610 while (isspace(*authorization & 255))
611 authorization ++;
612
613 userlen = sizeof(username);
614 httpDecode64_2(username, &userlen, authorization);
615
616 /*
617 * Pull the username and password out...
618 */
619
620 if ((ptr = strchr(username, ':')) == NULL)
621 {
622 cupsdLogMessage(CUPSD_LOG_ERROR,
623 "cupsdAuthorize: Missing Basic password!");
624 return;
625 }
626
627 *ptr++ = '\0';
628
629 if (!username[0])
630 {
631 /*
632 * Username must not be empty...
633 */
634
635 cupsdLogMessage(CUPSD_LOG_ERROR,
636 "cupsdAuthorize: Empty Basic username!");
637 return;
638 }
639
640 if (!*ptr)
641 {
642 /*
643 * Password must not be empty...
644 */
645
646 cupsdLogMessage(CUPSD_LOG_ERROR,
647 "cupsdAuthorize: Empty Basic password!");
648 return;
649 }
650
651 strlcpy(password, ptr, sizeof(password));
652
653 /*
654 * Validate the username and password...
655 */
656
657 switch (type)
658 {
659 default :
660 case CUPSD_AUTH_BASIC :
661 {
662 #if HAVE_LIBPAM
663 /*
664 * Only use PAM to do authentication. This supports MD5
665 * passwords, among other things...
666 */
667
668 pam_handle_t *pamh; /* PAM authentication handle */
669 int pamerr; /* PAM error code */
670 struct pam_conv pamdata;/* PAM conversation data */
671 cupsd_authdata_t data; /* Authentication data */
672
673
674 strlcpy(data.username, username, sizeof(data.username));
675 strlcpy(data.password, password, sizeof(data.password));
676
677 # if defined(__sun) || defined(__hpux)
678 pamdata.conv = (int (*)(int, struct pam_message **,
679 struct pam_response **,
680 void *))pam_func;
681 # else
682 pamdata.conv = pam_func;
683 # endif /* __sun || __hpux */
684 pamdata.appdata_ptr = &data;
685
686 # ifdef __hpux
687 /*
688 * Workaround for HP-UX bug in pam_unix; see pam_func() below for
689 * more info...
690 */
691
692 auth_data = &data;
693 # endif /* __hpux */
694
695 pamerr = pam_start("cups", username, &pamdata, &pamh);
696 if (pamerr != PAM_SUCCESS)
697 {
698 cupsdLogMessage(CUPSD_LOG_ERROR,
699 "cupsdAuthorize: pam_start() returned %d (%s)!",
700 pamerr, pam_strerror(pamh, pamerr));
701 return;
702 }
703
704 # ifdef HAVE_PAM_SET_ITEM
705 # ifdef PAM_RHOST
706 pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
707 if (pamerr != PAM_SUCCESS)
708 cupsdLogMessage(CUPSD_LOG_WARN,
709 "cupsdAuthorize: pam_set_item(PAM_RHOST) "
710 "returned %d (%s)!", pamerr,
711 pam_strerror(pamh, pamerr));
712 # endif /* PAM_RHOST */
713
714 # ifdef PAM_TTY
715 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
716 if (pamerr != PAM_SUCCESS)
717 cupsdLogMessage(CUPSD_LOG_WARN,
718 "cupsdAuthorize: pam_set_item(PAM_TTY) "
719 "returned %d (%s)!", pamerr,
720 pam_strerror(pamh, pamerr));
721 # endif /* PAM_TTY */
722 # endif /* HAVE_PAM_SET_ITEM */
723
724 pamerr = pam_authenticate(pamh, PAM_SILENT);
725 if (pamerr != PAM_SUCCESS)
726 {
727 cupsdLogMessage(CUPSD_LOG_ERROR,
728 "cupsdAuthorize: pam_authenticate() returned %d "
729 "(%s)!",
730 pamerr, pam_strerror(pamh, pamerr));
731 pam_end(pamh, 0);
732 return;
733 }
734
735 # ifdef HAVE_PAM_SETCRED
736 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
737 if (pamerr != PAM_SUCCESS)
738 cupsdLogMessage(CUPSD_LOG_WARN,
739 "cupsdAuthorize: pam_setcred() "
740 "returned %d (%s)!", pamerr,
741 pam_strerror(pamh, pamerr));
742 # endif /* HAVE_PAM_SETCRED */
743
744 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
745 if (pamerr != PAM_SUCCESS)
746 {
747 cupsdLogMessage(CUPSD_LOG_ERROR,
748 "cupsdAuthorize: pam_acct_mgmt() returned %d "
749 "(%s)!",
750 pamerr, pam_strerror(pamh, pamerr));
751 pam_end(pamh, 0);
752 return;
753 }
754
755 pam_end(pamh, PAM_SUCCESS);
756
757 #elif defined(HAVE_USERSEC_H)
758 /*
759 * Use AIX authentication interface...
760 */
761
762 char *authmsg; /* Authentication message */
763 int reenter; /* ??? */
764
765
766 cupsdLogMessage(CUPSD_LOG_DEBUG,
767 "cupsdAuthorize: AIX authenticate of username "
768 "\"%s\"", username);
769
770 reenter = 1;
771 if (authenticate(username, password, &reenter, &authmsg) != 0)
772 {
773 cupsdLogMessage(CUPSD_LOG_DEBUG,
774 "cupsdAuthorize: Unable to authenticate username "
775 "\"%s\": %s",
776 username, strerror(errno));
777 return;
778 }
779
780 #else
781 /*
782 * Use normal UNIX password file-based authentication...
783 */
784
785 char *pass; /* Encrypted password */
786 struct passwd *pw; /* User password data */
787 # ifdef HAVE_SHADOW_H
788 struct spwd *spw; /* Shadow password data */
789 # endif /* HAVE_SHADOW_H */
790
791
792 pw = getpwnam(username); /* Get the current password */
793 endpwent(); /* Close the password file */
794
795 if (!pw)
796 {
797 /*
798 * No such user...
799 */
800
801 cupsdLogMessage(CUPSD_LOG_ERROR,
802 "cupsdAuthorize: Unknown username \"%s\"!",
803 username);
804 return;
805 }
806
807 # ifdef HAVE_SHADOW_H
808 spw = getspnam(username);
809 endspent();
810
811 if (!spw && !strcmp(pw->pw_passwd, "x"))
812 {
813 /*
814 * Don't allow blank passwords!
815 */
816
817 cupsdLogMessage(CUPSD_LOG_ERROR,
818 "cupsdAuthorize: Username \"%s\" has no shadow "
819 "password!", username);
820 return;
821 }
822
823 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
824 # else
825 if (!pw->pw_passwd[0])
826 # endif /* HAVE_SHADOW_H */
827 {
828 /*
829 * Don't allow blank passwords!
830 */
831
832 cupsdLogMessage(CUPSD_LOG_ERROR,
833 "cupsdAuthorize: Username \"%s\" has no password!",
834 username);
835 return;
836 }
837
838 /*
839 * OK, the password isn't blank, so compare with what came from the
840 * client...
841 */
842
843 pass = cups_crypt(password, pw->pw_passwd);
844
845 cupsdLogMessage(CUPSD_LOG_DEBUG2,
846 "cupsdAuthorize: pw_passwd=\"%s\", crypt=\"%s\"",
847 pw->pw_passwd, pass);
848
849 if (!pass || strcmp(pw->pw_passwd, pass))
850 {
851 # ifdef HAVE_SHADOW_H
852 if (spw)
853 {
854 pass = cups_crypt(password, spw->sp_pwdp);
855
856 cupsdLogMessage(CUPSD_LOG_DEBUG2,
857 "cupsdAuthorize: sp_pwdp=\"%s\", crypt=\"%s\"",
858 spw->sp_pwdp, pass);
859
860 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
861 {
862 cupsdLogMessage(CUPSD_LOG_ERROR,
863 "cupsdAuthorize: Authentication failed for "
864 "user \"%s\"!",
865 username);
866 return;
867 }
868 }
869 else
870 # endif /* HAVE_SHADOW_H */
871 {
872 cupsdLogMessage(CUPSD_LOG_ERROR,
873 "cupsdAuthorize: Authentication failed for "
874 "user \"%s\"!",
875 username);
876 return;
877 }
878 }
879 #endif /* HAVE_LIBPAM */
880 }
881
882 cupsdLogMessage(CUPSD_LOG_DEBUG,
883 "cupsdAuthorize: Authorized as %s using Basic",
884 username);
885 break;
886
887 case CUPSD_AUTH_BASICDIGEST :
888 /*
889 * Do Basic authentication with the Digest password file...
890 */
891
892 if (!get_md5_password(username, NULL, md5))
893 {
894 cupsdLogMessage(CUPSD_LOG_ERROR,
895 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
896 username);
897 return;
898 }
899
900 httpMD5(username, "CUPS", password, basicmd5);
901
902 if (strcmp(md5, basicmd5))
903 {
904 cupsdLogMessage(CUPSD_LOG_ERROR,
905 "cupsdAuthorize: Authentication failed for \"%s\"!",
906 username);
907 return;
908 }
909
910 cupsdLogMessage(CUPSD_LOG_DEBUG,
911 "cupsdAuthorize: Authorized as %s using BasicDigest",
912 username);
913 break;
914 }
915
916 con->type = type;
917 }
918 else if (!strncmp(authorization, "Digest", 6))
919 {
920 /*
921 * Get the username, password, and nonce from the Digest attributes...
922 */
923
924 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "username",
925 username, sizeof(username)) || !username[0])
926 {
927 /*
928 * Username must not be empty...
929 */
930
931 cupsdLogMessage(CUPSD_LOG_ERROR,
932 "cupsdAuthorize: Empty or missing Digest username!");
933 return;
934 }
935
936 if (!httpGetSubField2(&(con->http), HTTP_FIELD_AUTHORIZATION, "response",
937 password, sizeof(password)) || !password[0])
938 {
939 /*
940 * Password must not be empty...
941 */
942
943 cupsdLogMessage(CUPSD_LOG_ERROR,
944 "cupsdAuthorize: Empty or missing Digest password!");
945 return;
946 }
947
948 if (!httpGetSubField(&(con->http), HTTP_FIELD_AUTHORIZATION, "nonce",
949 nonce))
950 {
951 cupsdLogMessage(CUPSD_LOG_ERROR,
952 "cupsdAuthorize: No nonce value for Digest "
953 "authentication!");
954 return;
955 }
956
957 if (strcmp(con->http.hostname, nonce))
958 {
959 cupsdLogMessage(CUPSD_LOG_ERROR,
960 "cupsdAuthorize: Bad nonce value, expected \"%s\", "
961 "got \"%s\"!", con->http.hostname, nonce);
962 return;
963 }
964
965 /*
966 * Validate the username and password...
967 */
968
969 if (!get_md5_password(username, NULL, md5))
970 {
971 cupsdLogMessage(CUPSD_LOG_ERROR,
972 "cupsdAuthorize: Unknown MD5 username \"%s\"!",
973 username);
974 return;
975 }
976
977 httpMD5Final(nonce, states[con->http.state], con->uri, md5);
978
979 if (strcmp(md5, password))
980 {
981 cupsdLogMessage(CUPSD_LOG_ERROR,
982 "cupsdAuthorize: Authentication failed for \"%s\"!",
983 username);
984 return;
985 }
986
987 cupsdLogMessage(CUPSD_LOG_DEBUG,
988 "cupsdAuthorize: Authorized as %s using Digest",
989 username);
990
991 con->type = CUPSD_AUTH_DIGEST;
992 }
993 #ifdef HAVE_GSSAPI
994 # ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
995 else if (con->http.hostaddr->addr.sa_family == AF_LOCAL &&
996 !strncmp(authorization, "Negotiate", 9))
997 {
998 /*
999 * Pull the credentials directly from the user...
1000 */
1001
1002 krb5_error_code error; /* Kerberos error code */
1003 cupsd_ucred_t peercred; /* Peer credentials */
1004 socklen_t peersize; /* Size of peer credentials */
1005 krb5_ccache peerccache; /* Peer Kerberos credentials */
1006 krb5_principal peerprncpl; /* Peer's default principal */
1007 char *peername; /* Peer username */
1008
1009 peersize = sizeof(peercred);
1010
1011 # ifdef __APPLE__
1012 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
1013 # else
1014 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
1015 # endif /* __APPLE__ */
1016 {
1017 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
1018 strerror(errno));
1019 return;
1020 }
1021
1022 cupsdLogMessage(CUPSD_LOG_DEBUG,
1023 "cupsdAuthorize: Copying credentials for UID %d...",
1024 CUPSD_UCRED_UID(peercred));
1025
1026 if (!KerberosInitialized)
1027 {
1028 /*
1029 * Setup a Kerberos context for the scheduler to use...
1030 */
1031
1032 KerberosInitialized = 1;
1033
1034 if (krb5_init_context(&KerberosContext))
1035 {
1036 KerberosContext = NULL;
1037
1038 cupsdLogMessage(CUPSD_LOG_ERROR,
1039 "Unable to initialize Kerberos context");
1040 return;
1041 }
1042 }
1043
1044 krb5_ipc_client_set_target_uid(CUPSD_UCRED_UID(peercred));
1045
1046 if ((error = krb5_cc_default(KerberosContext, &peerccache)) != 0)
1047 {
1048 cupsdLogMessage(CUPSD_LOG_ERROR,
1049 "Unable to get credentials cache for UID %d (%d/%s)",
1050 (int)CUPSD_UCRED_UID(peercred), error, strerror(errno));
1051 krb5_ipc_client_clear_target();
1052 return;
1053 }
1054
1055 if (krb5_cc_get_principal(KerberosContext, peerccache, &peerprncpl))
1056 {
1057 cupsdLogMessage(CUPSD_LOG_ERROR,
1058 "Unable to get Kerberos principal for UID %d",
1059 (int)CUPSD_UCRED_UID(peercred));
1060 krb5_cc_close(KerberosContext, peerccache);
1061 krb5_ipc_client_clear_target();
1062 return;
1063 }
1064
1065 if (krb5_unparse_name(KerberosContext, peerprncpl, &peername))
1066 {
1067 cupsdLogMessage(CUPSD_LOG_ERROR,
1068 "Unable to get Kerberos name for UID %d",
1069 (int)CUPSD_UCRED_UID(peercred));
1070 krb5_cc_close(KerberosContext, peerccache);
1071 krb5_ipc_client_clear_target();
1072 return;
1073 }
1074
1075 strlcpy(username, peername, sizeof(username));
1076
1077 con->have_gss = 1;
1078 con->type = CUPSD_AUTH_NEGOTIATE;
1079
1080 free(peername);
1081
1082 cupsdLogMessage(CUPSD_LOG_DEBUG,
1083 "cupsdAuthorize: Authorized as %s using Negotiate",
1084 username);
1085
1086 krb5_cc_close(KerberosContext, peerccache);
1087 krb5_ipc_client_clear_target();
1088 }
1089 # endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
1090 else if (!strncmp(authorization, "Negotiate", 9))
1091 {
1092 int len; /* Length of authorization string */
1093 gss_ctx_id_t context; /* Authorization context */
1094 OM_uint32 major_status, /* Major status code */
1095 minor_status; /* Minor status code */
1096 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
1097 /* Input token from string */
1098 output_token = GSS_C_EMPTY_BUFFER;
1099 /* Output token for username */
1100 gss_name_t client_name; /* Client name */
1101
1102
1103 # ifdef __APPLE__
1104 /*
1105 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
1106 * to use it...
1107 */
1108
1109 if (gss_init_sec_context == NULL)
1110 {
1111 cupsdLogMessage(CUPSD_LOG_WARN,
1112 "GSSAPI/Kerberos authentication failed because the "
1113 "Kerberos framework is not present.");
1114 return;
1115 }
1116 # endif /* __APPLE__ */
1117
1118 con->gss_output_token.length = 0;
1119
1120 /*
1121 * Find the start of the Kerberos input token...
1122 */
1123
1124 authorization += 9;
1125 while (isspace(*authorization & 255))
1126 authorization ++;
1127
1128 if (!*authorization)
1129 {
1130 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1131 "cupsdAuthorize: No authentication data specified.");
1132 return;
1133 }
1134
1135 /*
1136 * Decode the authorization string to get the input token...
1137 */
1138
1139 len = strlen(authorization);
1140 input_token.value = malloc(len);
1141 input_token.value = httpDecode64_2(input_token.value, &len,
1142 authorization);
1143 input_token.length = len;
1144
1145 /*
1146 * Accept the input token to get the authorization info...
1147 */
1148
1149 context = GSS_C_NO_CONTEXT;
1150 client_name = GSS_C_NO_NAME;
1151 major_status = gss_accept_sec_context(&minor_status,
1152 &context,
1153 GSS_C_NO_CREDENTIAL,
1154 &input_token,
1155 GSS_C_NO_CHANNEL_BINDINGS,
1156 &client_name,
1157 NULL,
1158 &con->gss_output_token,
1159 &con->gss_flags,
1160 NULL,
1161 &con->gss_creds);
1162
1163 if (GSS_ERROR(major_status))
1164 {
1165 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1166 "cupsdAuthorize: Error accepting GSSAPI security "
1167 "context");
1168
1169 if (context != GSS_C_NO_CONTEXT)
1170 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1171 return;
1172 }
1173
1174 con->have_gss = 1;
1175
1176 /*
1177 * Get the username associated with the client's credentials...
1178 */
1179
1180 if (!con->gss_creds)
1181 cupsdLogMessage(CUPSD_LOG_DEBUG,
1182 "cupsdAuthorize: No delegated credentials!");
1183
1184 if (major_status == GSS_S_CONTINUE_NEEDED)
1185 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1186 "cupsdAuthorize: Credentials not complete");
1187 else if (major_status == GSS_S_COMPLETE)
1188 {
1189 major_status = gss_display_name(&minor_status, client_name,
1190 &output_token, NULL);
1191
1192 if (GSS_ERROR(major_status))
1193 {
1194 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
1195 "cupsdAuthorize: Error getting username");
1196 gss_release_cred(&minor_status, &con->gss_creds);
1197 gss_release_name(&minor_status, &client_name);
1198 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1199 return;
1200 }
1201
1202 strlcpy(username, output_token.value, sizeof(username));
1203
1204 cupsdLogMessage(CUPSD_LOG_DEBUG,
1205 "cupsdAuthorize: Authorized as %s using Negotiate",
1206 username);
1207
1208 gss_release_name(&minor_status, &client_name);
1209 gss_release_buffer(&minor_status, &output_token);
1210
1211 con->type = CUPSD_AUTH_NEGOTIATE;
1212 }
1213 else
1214 gss_release_cred(&minor_status, &con->gss_creds);
1215
1216 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
1217 }
1218 #endif /* HAVE_GSSAPI */
1219 else
1220 {
1221 char scheme[256]; /* Auth scheme... */
1222
1223
1224 if (sscanf(authorization, "%255s", scheme) != 1)
1225 strcpy(scheme, "UNKNOWN");
1226
1227 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\"",
1228 scheme);
1229 return;
1230 }
1231
1232 /*
1233 * If we get here, then we were able to validate the username and
1234 * password - copy the validated username and password to the client
1235 * data and return...
1236 */
1237
1238 strlcpy(con->username, username, sizeof(con->username));
1239 strlcpy(con->password, password, sizeof(con->password));
1240 }
1241
1242
1243 /*
1244 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
1245 * access a location.
1246 */
1247
1248 int /* O - 1 if allowed, 0 otherwise */
1249 cupsdCheckAccess(
1250 unsigned ip[4], /* I - Client address */
1251 char *name, /* I - Client hostname */
1252 int namelen, /* I - Length of hostname */
1253 cupsd_location_t *loc) /* I - Location to check */
1254 {
1255 int allow; /* 1 if allowed, 0 otherwise */
1256
1257
1258 if (!strcasecmp(name, "localhost"))
1259 {
1260 /*
1261 * Access from localhost (127.0.0.1 or ::1) is always allowed...
1262 */
1263
1264 return (1);
1265 }
1266 else
1267 {
1268 /*
1269 * Do authorization checks on the domain/address...
1270 */
1271
1272 switch (loc->order_type)
1273 {
1274 default :
1275 allow = 0; /* anti-compiler-warning-code */
1276 break;
1277
1278 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
1279 allow = 1;
1280
1281 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1282 allow = 0;
1283
1284 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1285 allow = 1;
1286 break;
1287
1288 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
1289 allow = 0;
1290
1291 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
1292 allow = 1;
1293
1294 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
1295 allow = 0;
1296 break;
1297 }
1298 }
1299
1300 return (allow);
1301 }
1302
1303
1304 /*
1305 * 'cupsdCheckAuth()' - Check authorization masks.
1306 */
1307
1308 int /* O - 1 if mask matches, 0 otherwise */
1309 cupsdCheckAuth(unsigned ip[4], /* I - Client address */
1310 char *name, /* I - Client hostname */
1311 int name_len, /* I - Length of hostname */
1312 cups_array_t *masks) /* I - Masks */
1313 {
1314 int i; /* Looping var */
1315 cupsd_authmask_t *mask; /* Current mask */
1316 cupsd_netif_t *iface; /* Network interface */
1317 unsigned netip4; /* IPv4 network address */
1318 #ifdef AF_INET6
1319 unsigned netip6[4]; /* IPv6 network address */
1320 #endif /* AF_INET6 */
1321
1322
1323 for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
1324 mask;
1325 mask = (cupsd_authmask_t *)cupsArrayNext(masks))
1326 {
1327 switch (mask->type)
1328 {
1329 case CUPSD_AUTH_INTERFACE :
1330 /*
1331 * Check for a match with a network interface...
1332 */
1333
1334 netip4 = htonl(ip[3]);
1335
1336 #ifdef AF_INET6
1337 netip6[0] = htonl(ip[0]);
1338 netip6[1] = htonl(ip[1]);
1339 netip6[2] = htonl(ip[2]);
1340 netip6[3] = htonl(ip[3]);
1341 #endif /* AF_INET6 */
1342
1343 if (!strcmp(mask->mask.name.name, "*"))
1344 {
1345 #ifdef __APPLE__
1346 /*
1347 * Allow Back-to-My-Mac addresses...
1348 */
1349
1350 if ((ip[0] & 0xff000000) == 0xfd000000)
1351 return (1);
1352 #endif /* __APPLE__ */
1353
1354 /*
1355 * Check against all local interfaces...
1356 */
1357
1358 cupsdNetIFUpdate();
1359
1360 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1361 iface;
1362 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1363 {
1364 /*
1365 * Only check local interfaces...
1366 */
1367
1368 if (!iface->is_local)
1369 continue;
1370
1371 if (iface->address.addr.sa_family == AF_INET)
1372 {
1373 /*
1374 * Check IPv4 address...
1375 */
1376
1377 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1378 (iface->address.ipv4.sin_addr.s_addr &
1379 iface->mask.ipv4.sin_addr.s_addr))
1380 return (1);
1381 }
1382 #ifdef AF_INET6
1383 else
1384 {
1385 /*
1386 * Check IPv6 address...
1387 */
1388
1389 for (i = 0; i < 4; i ++)
1390 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1391 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1392 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1393 break;
1394
1395 if (i == 4)
1396 return (1);
1397 }
1398 #endif /* AF_INET6 */
1399 }
1400 }
1401 else
1402 {
1403 /*
1404 * Check the named interface...
1405 */
1406
1407 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1408 iface;
1409 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1410 {
1411 if (strcmp(mask->mask.name.name, iface->name))
1412 continue;
1413
1414 if (iface->address.addr.sa_family == AF_INET)
1415 {
1416 /*
1417 * Check IPv4 address...
1418 */
1419
1420 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1421 (iface->address.ipv4.sin_addr.s_addr &
1422 iface->mask.ipv4.sin_addr.s_addr))
1423 return (1);
1424 }
1425 #ifdef AF_INET6
1426 else
1427 {
1428 /*
1429 * Check IPv6 address...
1430 */
1431
1432 for (i = 0; i < 4; i ++)
1433 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1434 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1435 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1436 break;
1437
1438 if (i == 4)
1439 return (1);
1440 }
1441 #endif /* AF_INET6 */
1442 }
1443 }
1444 break;
1445
1446 case CUPSD_AUTH_NAME :
1447 /*
1448 * Check for exact name match...
1449 */
1450
1451 if (!strcasecmp(name, mask->mask.name.name))
1452 return (1);
1453
1454 /*
1455 * Check for domain match...
1456 */
1457
1458 if (name_len >= mask->mask.name.length &&
1459 mask->mask.name.name[0] == '.' &&
1460 !strcasecmp(name + name_len - mask->mask.name.length,
1461 mask->mask.name.name))
1462 return (1);
1463 break;
1464
1465 case CUPSD_AUTH_IP :
1466 /*
1467 * Check for IP/network address match...
1468 */
1469
1470 for (i = 0; i < 4; i ++)
1471 if ((ip[i] & mask->mask.ip.netmask[i]) !=
1472 mask->mask.ip.address[i])
1473 break;
1474
1475 if (i == 4)
1476 return (1);
1477 break;
1478 }
1479 }
1480
1481 return (0);
1482 }
1483
1484
1485 /*
1486 * 'cupsdCheckGroup()' - Check for a user's group membership.
1487 */
1488
1489 int /* O - 1 if user is a member, 0 otherwise */
1490 cupsdCheckGroup(
1491 const char *username, /* I - User name */
1492 struct passwd *user, /* I - System user info */
1493 const char *groupname) /* I - Group name */
1494 {
1495 int i; /* Looping var */
1496 struct group *group; /* System group info */
1497 char junk[33]; /* MD5 password (not used) */
1498 #ifdef HAVE_MBR_UID_TO_UUID
1499 uuid_t useruuid, /* UUID for username */
1500 groupuuid; /* UUID for groupname */
1501 int is_member; /* True if user is a member of group */
1502 #endif /* HAVE_MBR_UID_TO_UUID */
1503
1504
1505 cupsdLogMessage(CUPSD_LOG_DEBUG2,
1506 "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")",
1507 username, user, groupname);
1508
1509 /*
1510 * Validate input...
1511 */
1512
1513 if (!username || !groupname)
1514 return (0);
1515
1516 /*
1517 * Check to see if the user is a member of the named group...
1518 */
1519
1520 group = getgrnam(groupname);
1521 endgrent();
1522
1523 if (group != NULL)
1524 {
1525 /*
1526 * Group exists, check it...
1527 */
1528
1529 for (i = 0; group->gr_mem[i]; i ++)
1530 if (!strcasecmp(username, group->gr_mem[i]))
1531 return (1);
1532 }
1533
1534 /*
1535 * Group doesn't exist or user not in group list, check the group ID
1536 * against the user's group ID...
1537 */
1538
1539 if (user && group && group->gr_gid == user->pw_gid)
1540 return (1);
1541
1542 #ifdef HAVE_MBR_UID_TO_UUID
1543 /*
1544 * Check group membership through MacOS X membership API...
1545 */
1546
1547 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1548 {
1549 if (group)
1550 {
1551 /*
1552 * Map group name to UUID and check membership...
1553 */
1554
1555 if (!mbr_gid_to_uuid(group->gr_gid, groupuuid))
1556 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1557 if (is_member)
1558 return (1);
1559 }
1560 else if (groupname[0] == '#')
1561 {
1562 /*
1563 * Use UUID directly and check for equality (user UUID) and
1564 * membership (group UUID)...
1565 */
1566
1567 if (!uuid_parse((char *)groupname + 1, groupuuid))
1568 {
1569 if (!uuid_compare(useruuid, groupuuid))
1570 return (1);
1571 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1572 if (is_member)
1573 return (1);
1574 }
1575
1576 return (0);
1577 }
1578 }
1579 else if (groupname[0] == '#')
1580 return (0);
1581 #endif /* HAVE_MBR_UID_TO_UUID */
1582
1583 /*
1584 * Username not found, group not found, or user is not part of the
1585 * system group... Check for a user and group in the MD5 password
1586 * file...
1587 */
1588
1589 if (get_md5_password(username, groupname, junk) != NULL)
1590 return (1);
1591
1592 /*
1593 * If we get this far, then the user isn't part of the named group...
1594 */
1595
1596 return (0);
1597 }
1598
1599
1600 #ifdef HAVE_GSSAPI
1601 /*
1602 * 'cupsdCopyKrb5Creds()' - Get a copy of the Kerberos credentials.
1603 */
1604
1605 krb5_ccache /* O - Credentials or NULL */
1606 cupsdCopyKrb5Creds(cupsd_client_t *con) /* I - Client connection */
1607 {
1608 # if !defined(HAVE_KRB5_CC_NEW_UNIQUE) && !defined(HAVE_HEIMDAL)
1609 cupsdLogMessage(CUPSD_LOG_INFO,
1610 "Sorry, your version of Kerberos does not support delegated "
1611 "credentials!");
1612 return (NULL);
1613
1614 # else
1615 krb5_ccache ccache = NULL; /* Credentials */
1616 krb5_error_code error; /* Kerberos error code */
1617 OM_uint32 major_status, /* Major status code */
1618 minor_status; /* Minor status code */
1619 krb5_principal principal; /* Kerberos principal */
1620
1621
1622 # ifdef __APPLE__
1623 /*
1624 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
1625 * to use it...
1626 */
1627
1628 if (krb5_init_context == NULL)
1629 return (NULL);
1630 # endif /* __APPLE__ */
1631
1632 if (!KerberosInitialized)
1633 {
1634 /*
1635 * Setup a Kerberos context for the scheduler to use...
1636 */
1637
1638 KerberosInitialized = 1;
1639
1640 if (krb5_init_context(&KerberosContext))
1641 {
1642 KerberosContext = NULL;
1643
1644 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to initialize Kerberos context");
1645 return (NULL);
1646 }
1647 }
1648
1649 /*
1650 * We MUST create a file-based cache because memory-based caches are
1651 * only valid for the current process/address space.
1652 *
1653 * Due to various bugs/features in different versions of Kerberos, we
1654 * need either the krb5_cc_new_unique() function or Heimdal's version
1655 * of krb5_cc_gen_new() to create a new FILE: credential cache that
1656 * can be passed to the backend. These functions create a temporary
1657 * file (typically in /tmp) containing the cached credentials, which
1658 * are removed when we have successfully printed a job.
1659 */
1660
1661 # ifdef HAVE_KRB5_CC_NEW_UNIQUE
1662 if ((error = krb5_cc_new_unique(KerberosContext, "FILE", NULL, &ccache)) != 0)
1663 # else /* HAVE_HEIMDAL */
1664 if ((error = krb5_cc_gen_new(KerberosContext, &krb5_fcc_ops, &ccache)) != 0)
1665 # endif /* HAVE_KRB5_CC_NEW_UNIQUE */
1666 {
1667 cupsdLogMessage(CUPSD_LOG_ERROR,
1668 "Unable to create new credentials cache (%d/%s)",
1669 error, strerror(errno));
1670 return (NULL);
1671 }
1672
1673 if ((error = krb5_parse_name(KerberosContext, con->username, &principal)) != 0)
1674 {
1675 cupsdLogMessage(CUPSD_LOG_ERROR,
1676 "Unable to parse kerberos username (%d/%s)", error,
1677 strerror(errno));
1678 krb5_cc_destroy(KerberosContext, ccache);
1679 return (NULL);
1680 }
1681
1682 if ((error = krb5_cc_initialize(KerberosContext, ccache, principal)))
1683 {
1684 cupsdLogMessage(CUPSD_LOG_ERROR,
1685 "Unable to initialize credentials cache (%d/%s)", error,
1686 strerror(errno));
1687 krb5_cc_destroy(KerberosContext, ccache);
1688 krb5_free_principal(KerberosContext, principal);
1689 return (NULL);
1690 }
1691
1692 krb5_free_principal(KerberosContext, principal);
1693
1694 /*
1695 * Copy the user's credentials to the new cache file...
1696 */
1697
1698 # ifdef HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID
1699 if (con->http.hostaddr->addr.sa_family == AF_LOCAL &&
1700 !(con->gss_flags & GSS_C_DELEG_FLAG))
1701 {
1702 /*
1703 * Pull the credentials directly from the user...
1704 */
1705
1706 cupsd_ucred_t peercred; /* Peer credentials */
1707 socklen_t peersize; /* Size of peer credentials */
1708 krb5_ccache peerccache; /* Peer Kerberos credentials */
1709
1710 peersize = sizeof(peercred);
1711
1712 # ifdef __APPLE__
1713 if (getsockopt(con->http.fd, 0, LOCAL_PEERCRED, &peercred, &peersize))
1714 # else
1715 if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
1716 # endif /* __APPLE__ */
1717 {
1718 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get peer credentials - %s",
1719 strerror(errno));
1720 krb5_cc_destroy(KerberosContext, ccache);
1721 return (NULL);
1722 }
1723
1724 cupsdLogMessage(CUPSD_LOG_DEBUG,
1725 "cupsdCopyKrb5Creds: Copying credentials for UID %d...",
1726 CUPSD_UCRED_UID(peercred));
1727
1728 krb5_ipc_client_set_target_uid(CUPSD_UCRED_UID(peercred));
1729
1730 if ((error = krb5_cc_default(KerberosContext, &peerccache)) != 0)
1731 {
1732 cupsdLogMessage(CUPSD_LOG_ERROR,
1733 "Unable to get credentials cache for UID %d (%d/%s)",
1734 (int)CUPSD_UCRED_UID(peercred), error, strerror(errno));
1735 krb5_cc_destroy(KerberosContext, ccache);
1736 return (NULL);
1737 }
1738
1739 error = krb5_cc_copy_creds(KerberosContext, peerccache, ccache);
1740 krb5_cc_close(KerberosContext, peerccache);
1741 krb5_ipc_client_clear_target();
1742
1743 if (error)
1744 {
1745 cupsdLogMessage(CUPSD_LOG_ERROR,
1746 "Unable to copy credentials cache for UID %d (%d/%s)",
1747 (int)CUPSD_UCRED_UID(peercred), error, strerror(errno));
1748 krb5_cc_destroy(KerberosContext, ccache);
1749 return (NULL);
1750 }
1751 }
1752 else
1753 # endif /* HAVE_KRB5_IPC_CLIENT_SET_TARGET_UID */
1754 {
1755 major_status = gss_krb5_copy_ccache(&minor_status, con->gss_creds, ccache);
1756
1757 if (GSS_ERROR(major_status))
1758 {
1759 cupsdLogGSSMessage(CUPSD_LOG_ERROR, major_status, minor_status,
1760 "Unable to copy client credentials cache");
1761 krb5_cc_destroy(KerberosContext, ccache);
1762 return (NULL);
1763 }
1764 }
1765
1766 return (ccache);
1767 # endif /* !HAVE_KRB5_CC_NEW_UNIQUE && !HAVE_HEIMDAL */
1768 }
1769 #endif /* HAVE_GSSAPI */
1770
1771
1772 /*
1773 * 'cupsdCopyLocation()' - Make a copy of a location...
1774 */
1775
1776 cupsd_location_t * /* O - New location */
1777 cupsdCopyLocation(
1778 cupsd_location_t *loc) /* I - Original location */
1779 {
1780 cupsd_location_t *temp; /* New location */
1781
1782
1783 /*
1784 * Make a copy of the original location...
1785 */
1786
1787 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1788 return (NULL);
1789
1790 /*
1791 * Copy the information from the original location to the new one.
1792 */
1793
1794 if (!loc)
1795 return (temp);
1796
1797 if (loc->location)
1798 temp->location = _cupsStrAlloc(loc->location);
1799
1800 temp->limit = loc->limit;
1801 temp->order_type = loc->order_type;
1802 temp->type = loc->type;
1803 temp->level = loc->level;
1804 temp->satisfy = loc->satisfy;
1805 temp->encryption = loc->encryption;
1806
1807 if (loc->names)
1808 {
1809 if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1810 {
1811 cupsdLogMessage(CUPSD_LOG_ERROR,
1812 "Unable to allocate memory for %d names: %s",
1813 cupsArrayCount(loc->names), strerror(errno));
1814
1815 cupsdFreeLocation(temp);
1816 return (NULL);
1817 }
1818 }
1819
1820 if (loc->allow)
1821 {
1822 /*
1823 * Copy allow rules...
1824 */
1825
1826 if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1827 {
1828 cupsdLogMessage(CUPSD_LOG_ERROR,
1829 "Unable to allocate memory for %d allow rules: %s",
1830 cupsArrayCount(loc->allow), strerror(errno));
1831 cupsdFreeLocation(temp);
1832 return (NULL);
1833 }
1834 }
1835
1836 if (loc->deny)
1837 {
1838 /*
1839 * Copy deny rules...
1840 */
1841
1842 if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1843 {
1844 cupsdLogMessage(CUPSD_LOG_ERROR,
1845 "Unable to allocate memory for %d deny rules: %s",
1846 cupsArrayCount(loc->deny), strerror(errno));
1847 cupsdFreeLocation(temp);
1848 return (NULL);
1849 }
1850 }
1851
1852 return (temp);
1853 }
1854
1855
1856 /*
1857 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1858 */
1859
1860 void
1861 cupsdDeleteAllLocations(void)
1862 {
1863 /*
1864 * Free the location array, which will free all of the locations...
1865 */
1866
1867 cupsArrayDelete(Locations);
1868 Locations = NULL;
1869 }
1870
1871
1872 /*
1873 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1874 */
1875
1876 cupsd_location_t * /* O - Location that matches */
1877 cupsdFindBest(const char *path, /* I - Resource path */
1878 http_state_t state) /* I - HTTP state/request */
1879 {
1880 char uri[HTTP_MAX_URI],
1881 /* URI in request... */
1882 *uriptr; /* Pointer into URI */
1883 cupsd_location_t *loc, /* Current location */
1884 *best; /* Best match for location so far */
1885 int bestlen; /* Length of best match */
1886 int limit; /* Limit field */
1887 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1888 {
1889 CUPSD_AUTH_LIMIT_ALL,
1890 CUPSD_AUTH_LIMIT_OPTIONS,
1891 CUPSD_AUTH_LIMIT_GET,
1892 CUPSD_AUTH_LIMIT_GET,
1893 CUPSD_AUTH_LIMIT_HEAD,
1894 CUPSD_AUTH_LIMIT_POST,
1895 CUPSD_AUTH_LIMIT_POST,
1896 CUPSD_AUTH_LIMIT_POST,
1897 CUPSD_AUTH_LIMIT_PUT,
1898 CUPSD_AUTH_LIMIT_PUT,
1899 CUPSD_AUTH_LIMIT_DELETE,
1900 CUPSD_AUTH_LIMIT_TRACE,
1901 CUPSD_AUTH_LIMIT_ALL,
1902 CUPSD_AUTH_LIMIT_ALL
1903 };
1904
1905
1906 /*
1907 * First copy the connection URI to a local string so we have drop
1908 * any .ppd extension from the pathname in /printers or /classes
1909 * URIs...
1910 */
1911
1912 strlcpy(uri, path, sizeof(uri));
1913
1914 if (!strncmp(uri, "/printers/", 10) ||
1915 !strncmp(uri, "/classes/", 9))
1916 {
1917 /*
1918 * Check if the URI has .ppd on the end...
1919 */
1920
1921 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1922
1923 if (!strcmp(uriptr, ".ppd"))
1924 *uriptr = '\0';
1925 }
1926
1927 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri = \"%s\"...", uri);
1928
1929 /*
1930 * Loop through the list of locations to find a match...
1931 */
1932
1933 limit = limits[state];
1934 best = NULL;
1935 bestlen = 0;
1936
1937 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1938 loc;
1939 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1940 {
1941 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s Limit %x",
1942 loc->location ? loc->location : "nil", loc->limit);
1943
1944 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1945 {
1946 /*
1947 * Use case-insensitive comparison for queue names...
1948 */
1949
1950 if (loc->length > bestlen && loc->location &&
1951 !strncasecmp(uri, loc->location, loc->length) &&
1952 loc->location[0] == '/' &&
1953 (limit & loc->limit) != 0)
1954 {
1955 best = loc;
1956 bestlen = loc->length;
1957 }
1958 }
1959 else
1960 {
1961 /*
1962 * Use case-sensitive comparison for other URIs...
1963 */
1964
1965 if (loc->length > bestlen && loc->location &&
1966 !strncmp(uri, loc->location, loc->length) &&
1967 loc->location[0] == '/' &&
1968 (limit & loc->limit) != 0)
1969 {
1970 best = loc;
1971 bestlen = loc->length;
1972 }
1973 }
1974 }
1975
1976 /*
1977 * Return the match, if any...
1978 */
1979
1980 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best = %s",
1981 best ? best->location : "NONE");
1982
1983 return (best);
1984 }
1985
1986
1987 /*
1988 * 'cupsdFindLocation()' - Find the named location.
1989 */
1990
1991 cupsd_location_t * /* O - Location that matches */
1992 cupsdFindLocation(const char *location) /* I - Connection */
1993 {
1994 cupsd_location_t key; /* Search key */
1995
1996
1997 key.location = (char *)location;
1998
1999 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
2000 }
2001
2002
2003 /*
2004 * 'cupsdFreeLocation()' - Free all memory used by a location.
2005 */
2006
2007 void
2008 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
2009 {
2010 cupsArrayDelete(loc->names);
2011 cupsArrayDelete(loc->allow);
2012 cupsArrayDelete(loc->deny);
2013
2014 _cupsStrFree(loc->location);
2015 free(loc);
2016 }
2017
2018
2019 /*
2020 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
2021 */
2022
2023 http_status_t /* O - HTTP_OK if authorized or error code */
2024 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
2025 const char *owner)/* I - Owner of object */
2026 {
2027 int i, /* Looping vars */
2028 auth, /* Authorization status */
2029 type; /* Type of authentication */
2030 unsigned address[4]; /* Authorization address */
2031 cupsd_location_t *best; /* Best match for location so far */
2032 int hostlen; /* Length of hostname */
2033 char *name, /* Current username */
2034 username[256], /* Username to authorize */
2035 ownername[256], /* Owner name to authorize */
2036 *ptr; /* Pointer into username */
2037 struct passwd *pw; /* User password data */
2038 static const char * const levels[] = /* Auth levels */
2039 {
2040 "ANON",
2041 "USER",
2042 "GROUP"
2043 };
2044 static const char * const types[] = /* Auth types */
2045 {
2046 "None",
2047 "Basic",
2048 "Digest",
2049 "BasicDigest",
2050 "Negotiate"
2051 };
2052
2053
2054 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2055 "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)",
2056 con->uri, con->best, con->best ? con->best->location ?
2057 con->best->location : "(null)" : "");
2058 if (owner)
2059 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2060 "cupsdIsAuthorized: owner=\"%s\"", owner);
2061
2062 /*
2063 * If there is no "best" authentication rule for this request, then
2064 * access is allowed from the local system and denied from other
2065 * addresses...
2066 */
2067
2068 if (!con->best)
2069 {
2070 if (!strcmp(con->http.hostname, "localhost") ||
2071 !strcmp(con->http.hostname, ServerName))
2072 return (HTTP_OK);
2073 else
2074 return (HTTP_FORBIDDEN);
2075 }
2076
2077 best = con->best;
2078
2079 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
2080 type = DefaultAuthType;
2081
2082 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2083 "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
2084 "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
2085 levels[best->level], types[type],
2086 best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
2087
2088 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
2089 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
2090 best->op, ippOpString(best->op));
2091
2092 /*
2093 * Check host/ip-based accesses...
2094 */
2095
2096 #ifdef AF_INET6
2097 if (con->http.hostaddr->addr.sa_family == AF_INET6)
2098 {
2099 /*
2100 * Copy IPv6 address...
2101 */
2102
2103 address[0] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[0]);
2104 address[1] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[1]);
2105 address[2] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[2]);
2106 address[3] = ntohl(con->http.hostaddr->ipv6.sin6_addr.s6_addr32[3]);
2107 }
2108 else
2109 #endif /* AF_INET6 */
2110 if (con->http.hostaddr->addr.sa_family == AF_INET)
2111 {
2112 /*
2113 * Copy IPv4 address...
2114 */
2115
2116 address[0] = 0;
2117 address[1] = 0;
2118 address[2] = 0;
2119 address[3] = ntohl(con->http.hostaddr->ipv4.sin_addr.s_addr);
2120 }
2121 else
2122 memset(address, 0, sizeof(address));
2123
2124 hostlen = strlen(con->http.hostname);
2125
2126 auth = cupsdCheckAccess(address, con->http.hostname, hostlen, best)
2127 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
2128
2129 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
2130 auth ? "DENY" : "ALLOW");
2131
2132 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
2133 return (HTTP_FORBIDDEN);
2134
2135 #ifdef HAVE_SSL
2136 /*
2137 * See if encryption is required...
2138 */
2139
2140 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
2141 strcasecmp(con->http.hostname, "localhost") &&
2142 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
2143 !(type == CUPSD_AUTH_NEGOTIATE ||
2144 (type == CUPSD_AUTH_NONE && DefaultAuthType == CUPSD_AUTH_NEGOTIATE)))
2145 {
2146 cupsdLogMessage(CUPSD_LOG_DEBUG,
2147 "cupsdIsAuthorized: Need upgrade to TLS...");
2148 return (HTTP_UPGRADE_REQUIRED);
2149 }
2150 #endif /* HAVE_SSL */
2151
2152 /*
2153 * Now see what access level is required...
2154 */
2155
2156 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
2157 (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
2158 return (HTTP_OK);
2159
2160 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
2161 best->limit == CUPSD_AUTH_LIMIT_IPP)
2162 {
2163 /*
2164 * Check for unauthenticated username...
2165 */
2166
2167 ipp_attribute_t *attr; /* requesting-user-name attribute */
2168
2169
2170 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
2171 if (attr)
2172 {
2173 cupsdLogMessage(CUPSD_LOG_DEBUG,
2174 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
2175 attr->values[0].string.text);
2176 strlcpy(username, attr->values[0].string.text, sizeof(username));
2177 }
2178 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2179 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2180 else
2181 return (HTTP_OK); /* unless overridden with Satisfy */
2182 }
2183 else
2184 {
2185 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
2186 con->username);
2187
2188 #ifdef HAVE_AUTHORIZATION_H
2189 if (!con->username[0] && !con->authref)
2190 #else
2191 if (!con->username[0])
2192 #endif /* HAVE_AUTHORIZATION_H */
2193 {
2194 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
2195 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
2196 else
2197 return (HTTP_OK); /* unless overridden with Satisfy */
2198 }
2199
2200 if (con->type != type && type != CUPSD_AUTH_NONE &&
2201 (con->type != CUPSD_AUTH_BASIC || type != CUPSD_AUTH_BASICDIGEST))
2202 {
2203 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
2204 types[con->type], types[type]);
2205
2206 return (HTTP_UNAUTHORIZED);
2207 }
2208
2209 strlcpy(username, con->username, sizeof(username));
2210 }
2211
2212 /*
2213 * OK, got a username. See if we need normal user access, or group
2214 * access... (root always matches)
2215 */
2216
2217 if (!strcmp(username, "root"))
2218 return (HTTP_OK);
2219
2220 /*
2221 * Strip any @domain or @KDC from the username and owner...
2222 */
2223
2224 if ((ptr = strchr(username, '@')) != NULL)
2225 *ptr = '\0';
2226
2227 if (owner)
2228 {
2229 strlcpy(ownername, owner, sizeof(ownername));
2230
2231 if ((ptr = strchr(ownername, '@')) != NULL)
2232 *ptr = '\0';
2233 }
2234 else
2235 ownername[0] = '\0';
2236
2237 /*
2238 * Get the user info...
2239 */
2240
2241 if (username[0])
2242 {
2243 pw = getpwnam(username);
2244 endpwent();
2245 }
2246 else
2247 pw = NULL;
2248
2249 if (best->level == CUPSD_AUTH_USER)
2250 {
2251 /*
2252 * If there are no names associated with this location, then
2253 * any valid user is OK...
2254 */
2255
2256 if (cupsArrayCount(best->names) == 0)
2257 return (HTTP_OK);
2258
2259 /*
2260 * Otherwise check the user list and return OK if this user is
2261 * allowed...
2262 */
2263
2264 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2265 "cupsdIsAuthorized: Checking user membership...");
2266
2267 #ifdef HAVE_AUTHORIZATION_H
2268 /*
2269 * If an authorization reference was supplied it must match a right name...
2270 */
2271
2272 if (con->authref)
2273 {
2274 for (name = (char *)cupsArrayFirst(best->names);
2275 name;
2276 name = (char *)cupsArrayNext(best->names))
2277 {
2278 if (!strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
2279 return (HTTP_OK);
2280 else if (!strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
2281 check_authref(con, SystemGroupAuthKey))
2282 return (HTTP_OK);
2283 }
2284
2285 return (HTTP_FORBIDDEN);
2286 }
2287 #endif /* HAVE_AUTHORIZATION_H */
2288
2289 for (name = (char *)cupsArrayFirst(best->names);
2290 name;
2291 name = (char *)cupsArrayNext(best->names))
2292 {
2293 if (!strcasecmp(name, "@OWNER") && owner &&
2294 !strcasecmp(username, ownername))
2295 return (HTTP_OK);
2296 else if (!strcasecmp(name, "@SYSTEM"))
2297 {
2298 for (i = 0; i < NumSystemGroups; i ++)
2299 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
2300 return (HTTP_OK);
2301 }
2302 else if (name[0] == '@')
2303 {
2304 if (cupsdCheckGroup(username, pw, name + 1))
2305 return (HTTP_OK);
2306 }
2307 else if (!strcasecmp(username, name))
2308 return (HTTP_OK);
2309 }
2310
2311 return (HTTP_FORBIDDEN);
2312 }
2313
2314 /*
2315 * Check to see if this user is in any of the named groups...
2316 */
2317
2318 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2319 "cupsdIsAuthorized: Checking group membership...");
2320
2321 /*
2322 * Check to see if this user is in any of the named groups...
2323 */
2324
2325 for (name = (char *)cupsArrayFirst(best->names);
2326 name;
2327 name = (char *)cupsArrayNext(best->names))
2328 {
2329 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2330 "cupsdIsAuthorized: Checking group \"%s\" membership...",
2331 name);
2332
2333 if (!strcasecmp(name, "@SYSTEM"))
2334 {
2335 for (i = 0; i < NumSystemGroups; i ++)
2336 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
2337 return (HTTP_OK);
2338 }
2339 else if (cupsdCheckGroup(username, pw, name))
2340 return (HTTP_OK);
2341 }
2342
2343 /*
2344 * The user isn't part of the specified group, so deny access...
2345 */
2346
2347 cupsdLogMessage(CUPSD_LOG_DEBUG,
2348 "cupsdIsAuthorized: User not in group(s)!");
2349
2350 return (HTTP_FORBIDDEN);
2351 }
2352
2353
2354 /*
2355 * 'cupsdNewLocation()' - Create a new location for authorization.
2356 *
2357 * Note: Still need to call cupsdAddLocation() to add it to the list of global
2358 * locations.
2359 */
2360
2361 cupsd_location_t * /* O - Pointer to new location record */
2362 cupsdNewLocation(const char *location) /* I - Location path */
2363 {
2364 cupsd_location_t *temp; /* New location */
2365
2366
2367 /*
2368 * Try to allocate memory for the new location.
2369 */
2370
2371 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
2372 return (NULL);
2373
2374 /*
2375 * Initialize the record and copy the name over...
2376 */
2377
2378 if ((temp->location = _cupsStrAlloc(location)) == NULL)
2379 {
2380 free(temp);
2381 return (NULL);
2382 }
2383
2384 temp->length = strlen(temp->location);
2385
2386 /*
2387 * Return the new record...
2388 */
2389
2390 return (temp);
2391 }
2392
2393
2394 #ifdef HAVE_AUTHORIZATION_H
2395 /*
2396 * 'check_authref()' - Check if an authorization services reference has the
2397 * supplied right.
2398 */
2399
2400 static int /* O - 1 if right is valid, 0 otherwise */
2401 check_authref(cupsd_client_t *con, /* I - Connection */
2402 const char *right) /* I - Right name */
2403 {
2404 OSStatus status; /* OS Status */
2405 AuthorizationItem authright; /* Authorization right */
2406 AuthorizationRights authrights; /* Authorization rights */
2407 AuthorizationFlags authflags; /* Authorization flags */
2408
2409
2410 /*
2411 * Check to see if the user is allowed to perform the task...
2412 */
2413
2414 if (!con->authref)
2415 return (0);
2416
2417 authright.name = right;
2418 authright.valueLength = 0;
2419 authright.value = NULL;
2420 authright.flags = 0;
2421
2422 authrights.count = 1;
2423 authrights.items = &authright;
2424
2425 authflags = kAuthorizationFlagDefaults |
2426 kAuthorizationFlagExtendRights;
2427
2428 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2429 kAuthorizationEmptyEnvironment,
2430 authflags, NULL)) != 0)
2431 {
2432 cupsdLogMessage(CUPSD_LOG_ERROR,
2433 "AuthorizationCopyRights(\"%s\") returned %d (%s)",
2434 authright.name, (int)status, cssmErrorString(status));
2435 return (0);
2436 }
2437
2438 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2439 "AuthorizationCopyRights(\"%s\") succeeded!",
2440 authright.name);
2441
2442 return (1);
2443 }
2444 #endif /* HAVE_AUTHORIZATION_H */
2445
2446
2447 /*
2448 * 'compare_locations()' - Compare two locations.
2449 */
2450
2451 static int /* O - Result of comparison */
2452 compare_locations(cupsd_location_t *a, /* I - First location */
2453 cupsd_location_t *b) /* I - Second location */
2454 {
2455 return (strcmp(b->location, a->location));
2456 }
2457
2458
2459 /*
2460 * 'copy_authmask()' - Copy function for auth masks.
2461 */
2462
2463 static cupsd_authmask_t * /* O - New auth mask */
2464 copy_authmask(cupsd_authmask_t *mask, /* I - Existing auth mask */
2465 void *data) /* I - User data (unused) */
2466 {
2467 cupsd_authmask_t *temp; /* New auth mask */
2468
2469
2470 (void)data;
2471
2472 if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
2473 {
2474 memcpy(temp, mask, sizeof(cupsd_authmask_t));
2475
2476 if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
2477 {
2478 /*
2479 * Make a copy of the name...
2480 */
2481
2482 if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
2483 {
2484 /*
2485 * Failed to make copy...
2486 */
2487
2488 free(temp);
2489 temp = NULL;
2490 }
2491 }
2492 }
2493
2494 return (temp);
2495 }
2496
2497
2498 #if !HAVE_LIBPAM && !defined(HAVE_USERSEC_H)
2499 /*
2500 * 'cups_crypt()' - Encrypt the password using the DES or MD5 algorithms,
2501 * as needed.
2502 */
2503
2504 static char * /* O - Encrypted password */
2505 cups_crypt(const char *pw, /* I - Password string */
2506 const char *salt) /* I - Salt (key) string */
2507 {
2508 if (!strncmp(salt, "$1$", 3))
2509 {
2510 /*
2511 * Use MD5 passwords without the benefit of PAM; this is for
2512 * Slackware Linux, and the algorithm was taken from the
2513 * old shadow-19990827/lib/md5crypt.c source code... :(
2514 */
2515
2516 int i; /* Looping var */
2517 unsigned long n; /* Output number */
2518 int pwlen; /* Length of password string */
2519 const char *salt_end; /* End of "salt" data for MD5 */
2520 char *ptr; /* Pointer into result string */
2521 _cups_md5_state_t state; /* Primary MD5 state info */
2522 _cups_md5_state_t state2; /* Secondary MD5 state info */
2523 unsigned char digest[16]; /* MD5 digest result */
2524 static char result[120]; /* Final password string */
2525
2526
2527 /*
2528 * Get the salt data between dollar signs, e.g. $1$saltdata$md5.
2529 * Get a maximum of 8 characters of salt data after $1$...
2530 */
2531
2532 for (salt_end = salt + 3; *salt_end && (salt_end - salt) < 11; salt_end ++)
2533 if (*salt_end == '$')
2534 break;
2535
2536 /*
2537 * Compute the MD5 sum we need...
2538 */
2539
2540 pwlen = strlen(pw);
2541
2542 _cupsMD5Init(&state);
2543 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2544 _cupsMD5Append(&state, (unsigned char *)salt, salt_end - salt);
2545
2546 _cupsMD5Init(&state2);
2547 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2548 _cupsMD5Append(&state2, (unsigned char *)salt + 3, salt_end - salt - 3);
2549 _cupsMD5Append(&state2, (unsigned char *)pw, pwlen);
2550 _cupsMD5Finish(&state2, digest);
2551
2552 for (i = pwlen; i > 0; i -= 16)
2553 _cupsMD5Append(&state, digest, i > 16 ? 16 : i);
2554
2555 for (i = pwlen; i > 0; i >>= 1)
2556 _cupsMD5Append(&state, (unsigned char *)((i & 1) ? "" : pw), 1);
2557
2558 _cupsMD5Finish(&state, digest);
2559
2560 for (i = 0; i < 1000; i ++)
2561 {
2562 _cupsMD5Init(&state);
2563
2564 if (i & 1)
2565 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2566 else
2567 _cupsMD5Append(&state, digest, 16);
2568
2569 if (i % 3)
2570 _cupsMD5Append(&state, (unsigned char *)salt + 3, salt_end - salt - 3);
2571
2572 if (i % 7)
2573 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2574
2575 if (i & 1)
2576 _cupsMD5Append(&state, digest, 16);
2577 else
2578 _cupsMD5Append(&state, (unsigned char *)pw, pwlen);
2579
2580 _cupsMD5Finish(&state, digest);
2581 }
2582
2583 /*
2584 * Copy the final sum to the result string and return...
2585 */
2586
2587 memcpy(result, salt, salt_end - salt);
2588 ptr = result + (salt_end - salt);
2589 *ptr++ = '$';
2590
2591 for (i = 0; i < 5; i ++, ptr += 4)
2592 {
2593 n = (((digest[i] << 8) | digest[i + 6]) << 8);
2594
2595 if (i < 4)
2596 n |= digest[i + 12];
2597 else
2598 n |= digest[5];
2599
2600 to64(ptr, n, 4);
2601 }
2602
2603 to64(ptr, digest[11], 2);
2604 ptr += 2;
2605 *ptr = '\0';
2606
2607 return (result);
2608 }
2609 else
2610 {
2611 /*
2612 * Use the standard crypt() function...
2613 */
2614
2615 return (crypt(pw, salt));
2616 }
2617 }
2618 #endif /* !HAVE_LIBPAM && !HAVE_USERSEC_H */
2619
2620
2621 /*
2622 * 'free_authmask()' - Free function for auth masks.
2623 */
2624
2625 static void
2626 free_authmask(cupsd_authmask_t *mask, /* I - Auth mask to free */
2627 void *data) /* I - User data (unused) */
2628 {
2629 (void)data;
2630
2631 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2632 _cupsStrFree(mask->mask.name.name);
2633
2634 free(mask);
2635 }
2636
2637
2638 /*
2639 * 'get_md5_password()' - Get an MD5 password.
2640 */
2641
2642 static char * /* O - MD5 password string */
2643 get_md5_password(const char *username, /* I - Username */
2644 const char *group, /* I - Group */
2645 char passwd[33]) /* O - MD5 password string */
2646 {
2647 cups_file_t *fp; /* passwd.md5 file */
2648 char filename[1024], /* passwd.md5 filename */
2649 line[256], /* Line from file */
2650 tempuser[33], /* User from file */
2651 tempgroup[33]; /* Group from file */
2652
2653
2654 cupsdLogMessage(CUPSD_LOG_DEBUG2,
2655 "get_md5_password(username=\"%s\", group=\"%s\", passwd=%p)",
2656 username, group ? group : "(null)", passwd);
2657
2658 snprintf(filename, sizeof(filename), "%s/passwd.md5", ServerRoot);
2659 if ((fp = cupsFileOpen(filename, "r")) == NULL)
2660 {
2661 if (errno != ENOENT)
2662 cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to open %s - %s", filename,
2663 strerror(errno));
2664
2665 return (NULL);
2666 }
2667
2668 while (cupsFileGets(fp, line, sizeof(line)) != NULL)
2669 {
2670 if (sscanf(line, "%32[^:]:%32[^:]:%32s", tempuser, tempgroup, passwd) != 3)
2671 {
2672 cupsdLogMessage(CUPSD_LOG_ERROR, "Bad MD5 password line: %s", line);
2673 continue;
2674 }
2675
2676 if (!strcmp(username, tempuser) &&
2677 (group == NULL || !strcmp(group, tempgroup)))
2678 {
2679 /*
2680 * Found the password entry!
2681 */
2682
2683 cupsdLogMessage(CUPSD_LOG_DEBUG2, "Found MD5 user %s, group %s...",
2684 username, tempgroup);
2685
2686 cupsFileClose(fp);
2687 return (passwd);
2688 }
2689 }
2690
2691 /*
2692 * Didn't find a password entry - return NULL!
2693 */
2694
2695 cupsFileClose(fp);
2696 return (NULL);
2697 }
2698
2699
2700 #if HAVE_LIBPAM
2701 /*
2702 * 'pam_func()' - PAM conversation function.
2703 */
2704
2705 static int /* O - Success or failure */
2706 pam_func(
2707 int num_msg, /* I - Number of messages */
2708 const struct pam_message **msg, /* I - Messages */
2709 struct pam_response **resp, /* O - Responses */
2710 void *appdata_ptr)
2711 /* I - Pointer to connection */
2712 {
2713 int i; /* Looping var */
2714 struct pam_response *replies; /* Replies */
2715 cupsd_authdata_t *data; /* Pointer to auth data */
2716
2717
2718 /*
2719 * Allocate memory for the responses...
2720 */
2721
2722 if ((replies = malloc(sizeof(struct pam_response) * num_msg)) == NULL)
2723 return (PAM_CONV_ERR);
2724
2725 /*
2726 * Answer all of the messages...
2727 */
2728
2729 DEBUG_printf(("pam_func: appdata_ptr = %p\n", appdata_ptr));
2730
2731 #ifdef __hpux
2732 /*
2733 * Apparently some versions of HP-UX 11 have a broken pam_unix security
2734 * module. This is a workaround...
2735 */
2736
2737 data = auth_data;
2738 (void)appdata_ptr;
2739 #else
2740 data = (cupsd_authdata_t *)appdata_ptr;
2741 #endif /* __hpux */
2742
2743 for (i = 0; i < num_msg; i ++)
2744 {
2745 DEBUG_printf(("pam_func: Message = \"%s\"\n", msg[i]->msg));
2746
2747 switch (msg[i]->msg_style)
2748 {
2749 case PAM_PROMPT_ECHO_ON:
2750 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_ON, returning \"%s\"...\n",
2751 data->username));
2752 replies[i].resp_retcode = PAM_SUCCESS;
2753 replies[i].resp = strdup(data->username);
2754 break;
2755
2756 case PAM_PROMPT_ECHO_OFF:
2757 DEBUG_printf(("pam_func: PAM_PROMPT_ECHO_OFF, returning \"%s\"...\n",
2758 data->password));
2759 replies[i].resp_retcode = PAM_SUCCESS;
2760 replies[i].resp = strdup(data->password);
2761 break;
2762
2763 case PAM_TEXT_INFO:
2764 DEBUG_puts("pam_func: PAM_TEXT_INFO...");
2765 replies[i].resp_retcode = PAM_SUCCESS;
2766 replies[i].resp = NULL;
2767 break;
2768
2769 case PAM_ERROR_MSG:
2770 DEBUG_puts("pam_func: PAM_ERROR_MSG...");
2771 replies[i].resp_retcode = PAM_SUCCESS;
2772 replies[i].resp = NULL;
2773 break;
2774
2775 default:
2776 DEBUG_printf(("pam_func: Unknown PAM message %d...\n",
2777 msg[i]->msg_style));
2778 free(replies);
2779 return (PAM_CONV_ERR);
2780 }
2781 }
2782
2783 /*
2784 * Return the responses back to PAM...
2785 */
2786
2787 *resp = replies;
2788
2789 return (PAM_SUCCESS);
2790 }
2791 #elif !defined(HAVE_USERSEC_H)
2792
2793
2794 /*
2795 * 'to64()' - Base64-encode an integer value...
2796 */
2797
2798 static void
2799 to64(char *s, /* O - Output string */
2800 unsigned long v, /* I - Value to encode */
2801 int n) /* I - Number of digits */
2802 {
2803 const char *itoa64 = "./0123456789"
2804 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
2805 "abcdefghijklmnopqrstuvwxyz";
2806
2807
2808 for (; n > 0; n --, v >>= 6)
2809 *s++ = itoa64[v & 0x3f];
2810 }
2811 #endif /* HAVE_LIBPAM */
2812
2813
2814 /*
2815 * End of "$Id: auth.c 7830 2008-08-04 20:38:50Z mike $".
2816 */
Unnamed repository; edit this file 'description' to name the repository.