1 /*
2 * Authorization routines for the CUPS scheduler.
3 *
4 * Copyright © 2020-2024 by OpenPrinting.
5 * Copyright © 2007-2019 by Apple Inc.
6 * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
7 *
8 * This file contains Kerberos support code, copyright 2006 by
9 * Jelmer Vernooij.
10 *
11 * Licensed under Apache License v2.0. See the file "LICENSE" for more
12 * information.
13 */
14
15 /*
16 * Include necessary headers...
17 */
18
19 #include "cupsd.h"
20 #include <grp.h>
21 #ifdef HAVE_SHADOW_H
22 # include <shadow.h>
23 #endif /* HAVE_SHADOW_H */
24 #ifdef HAVE_CRYPT_H
25 # include <crypt.h>
26 #endif /* HAVE_CRYPT_H */
27 #if HAVE_LIBPAM
28 # ifdef HAVE_PAM_PAM_APPL_H
29 # include <pam/pam_appl.h>
30 # else
31 # include <security/pam_appl.h>
32 # endif /* HAVE_PAM_PAM_APPL_H */
33 #endif /* HAVE_LIBPAM */
34 #ifdef HAVE_MEMBERSHIP_H
35 # include <membership.h>
36 #endif /* HAVE_MEMBERSHIP_H */
37 #ifdef HAVE_AUTHORIZATION_H
38 # include <Security/AuthorizationTags.h>
39 #endif /* HAVE_AUTHORIZATION_H */
40 #ifdef HAVE_SYS_PARAM_H
41 # include <sys/param.h>
42 #endif /* HAVE_SYS_PARAM_H */
43 #ifdef HAVE_SYS_UCRED_H
44 # include <sys/ucred.h>
45 typedef struct xucred cupsd_ucred_t;
46 # define CUPSD_UCRED_UID(c) (c).cr_uid
47 #else
48 # ifndef __OpenBSD__
49 typedef struct ucred cupsd_ucred_t;
50 # else
51 typedef struct sockpeercred cupsd_ucred_t;
52 # endif
53 # define CUPSD_UCRED_UID(c) (c).uid
54 #endif /* HAVE_SYS_UCRED_H */
55 #ifdef HAVE_LIBAPPARMOR
56 # include <sys/apparmor.h>
57 #endif /* HAVE_LIBAPPARMOR */
58 #ifdef HAVE_LIBSNAPDGLIB
59 # include <glib.h>
60 # include <snapd-glib/snapd-glib.h>
61 #endif /* HAVE_LIBSNAPDGLIB */
62
63
64 /*
65 * Local functions...
66 */
67
68 static int check_admin_access(cupsd_client_t *con);
69 #ifdef HAVE_AUTHORIZATION_H
70 static int check_authref(cupsd_client_t *con, const char *right);
71 #endif /* HAVE_AUTHORIZATION_H */
72 static int compare_locations(cupsd_location_t *a,
73 cupsd_location_t *b);
74 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
75 static void free_authmask(cupsd_authmask_t *am, void *data);
76 #if HAVE_LIBPAM
77 static int pam_func(int, const struct pam_message **,
78 struct pam_response **, void *);
79 #endif /* HAVE_LIBPAM */
80
81
82 /*
83 * Local structures...
84 */
85
86 #if HAVE_LIBPAM
87 typedef struct cupsd_authdata_s /**** Authentication data ****/
88 {
89 char username[HTTP_MAX_VALUE], /* Username string */
90 password[HTTP_MAX_VALUE]; /* Password string */
91 } cupsd_authdata_t;
92 #endif /* HAVE_LIBPAM */
93
94
95 /*
96 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
97 */
98
99 int /* O - 1 on success, 0 on failure */
cupsdAddIPMask(cups_array_t ** masks,const unsigned address[4],const unsigned netmask[4])100 cupsdAddIPMask(
101 cups_array_t **masks, /* IO - Masks array (created as needed) */
102 const unsigned address[4], /* I - IP address */
103 const unsigned netmask[4]) /* I - IP netmask */
104 {
105 cupsd_authmask_t temp; /* New host/domain mask */
106
107
108 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", (void *)masks, (void *)*masks, address[0], address[1], address[2], address[3], netmask[0], netmask[1], netmask[2], netmask[3]);
109
110 temp.type = CUPSD_AUTH_IP;
111 memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
112 memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
113
114 /*
115 * Create the masks array as needed and add...
116 */
117
118 if (!*masks)
119 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
120 (cups_acopy_func_t)copy_authmask,
121 (cups_afree_func_t)free_authmask);
122
123 return (cupsArrayAdd(*masks, &temp));
124 }
125
126
127 /*
128 * 'cupsdAddLocation()' - Add a location for authorization.
129 */
130
131 void
cupsdAddLocation(cupsd_location_t * loc)132 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
133 {
134 /*
135 * Make sure the locations array is created...
136 */
137
138 if (!Locations)
139 Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
140 (cups_ahash_func_t)NULL, 0,
141 (cups_acopy_func_t)NULL,
142 (cups_afree_func_t)cupsdFreeLocation);
143
144 if (Locations)
145 {
146 cupsArrayAdd(Locations, loc);
147
148 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"", loc->location ? loc->location : "(null)");
149 }
150 }
151
152
153 /*
154 * 'cupsdAddName()' - Add a name to a location...
155 */
156
157 void
cupsdAddName(cupsd_location_t * loc,char * name)158 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
159 char *name) /* I - Name to add */
160 {
161 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")", (void *)loc, name);
162
163 if (!loc->names)
164 loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
165 (cups_acopy_func_t)_cupsStrAlloc,
166 (cups_afree_func_t)_cupsStrFree);
167
168 if (!cupsArrayAdd(loc->names, name))
169 {
170 cupsdLogMessage(CUPSD_LOG_ERROR,
171 "Unable to duplicate name for location %s: %s",
172 loc->location ? loc->location : "nil", strerror(errno));
173 return;
174 }
175 }
176
177
178 /*
179 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
180 */
181
182 int /* O - 1 on success, 0 on failure */
cupsdAddNameMask(cups_array_t ** masks,char * name)183 cupsdAddNameMask(cups_array_t **masks, /* IO - Masks array (created as needed) */
184 char *name) /* I - Host or interface name */
185 {
186 cupsd_authmask_t temp; /* New host/domain mask */
187 char ifname[32], /* Interface name */
188 *ifptr; /* Pointer to end of name */
189
190
191 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", (void *)masks, (void *)*masks, name);
192
193 if (!_cups_strcasecmp(name, "@LOCAL"))
194 {
195 /*
196 * Deny *interface*...
197 */
198
199 temp.type = CUPSD_AUTH_INTERFACE;
200 temp.mask.name.name = (char *)"*";
201 }
202 else if (!_cups_strncasecmp(name, "@IF(", 4))
203 {
204 /*
205 * Deny *interface*...
206 */
207
208 strlcpy(ifname, name + 4, sizeof(ifname));
209
210 ifptr = ifname + strlen(ifname) - 1;
211
212 if (ifptr >= ifname && *ifptr == ')')
213 {
214 *ifptr = '\0';
215 }
216
217 temp.type = CUPSD_AUTH_INTERFACE;
218 temp.mask.name.name = ifname;
219 }
220 else
221 {
222 /*
223 * Deny name...
224 */
225
226 if (*name == '*')
227 name ++;
228
229 temp.type = CUPSD_AUTH_NAME;
230 temp.mask.name.name = (char *)name;
231 }
232
233 /*
234 * Set the name length...
235 */
236
237 temp.mask.name.length = strlen(temp.mask.name.name);
238
239 /*
240 * Create the masks array as needed and add...
241 */
242
243 if (!*masks)
244 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
245 (cups_acopy_func_t)copy_authmask,
246 (cups_afree_func_t)free_authmask);
247
248 return (cupsArrayAdd(*masks, &temp));
249 }
250
251
252 /*
253 * 'cupsdAuthorize()' - Validate any authorization credentials.
254 */
255
256 void
cupsdAuthorize(cupsd_client_t * con)257 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
258 {
259 int type; /* Authentication type */
260 const char *authorization; /* Pointer into Authorization string */
261 char *ptr, /* Pointer into string */
262 username[HTTP_MAX_VALUE],
263 /* Username string */
264 password[HTTP_MAX_VALUE];
265 /* Password string */
266 cupsd_cert_t *localuser; /* Certificate username */
267
268
269 /*
270 * Locate the best matching location so we know what kind of
271 * authentication to expect...
272 */
273
274 con->best = cupsdFindBest(con->uri, httpGetState(con->http));
275 con->type = CUPSD_AUTH_NONE;
276
277 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "con->uri=\"%s\", con->best=%p(%s)", con->uri, (void *)con->best, con->best ? con->best->location : "");
278
279 if (con->best && con->best->type != CUPSD_AUTH_NONE)
280 {
281 if (con->best->type == CUPSD_AUTH_DEFAULT)
282 type = cupsdDefaultAuthType();
283 else
284 type = con->best->type;
285 }
286 else
287 type = cupsdDefaultAuthType();
288
289 /*
290 * Decode the Authorization string...
291 */
292
293 authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
294
295 username[0] = '\0';
296 password[0] = '\0';
297
298 #ifdef HAVE_GSSAPI
299 con->gss_uid = 0;
300 #endif /* HAVE_GSSAPI */
301
302 #ifdef HAVE_AUTHORIZATION_H
303 if (con->authref)
304 {
305 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
306 con->authref = NULL;
307 }
308 #endif /* HAVE_AUTHORIZATION_H */
309
310 if (!*authorization)
311 {
312 /*
313 * No authorization data provided, return early...
314 */
315
316 cupsdLogClient(con, CUPSD_LOG_DEBUG, "No authentication data provided.");
317 return;
318 }
319 #ifdef HAVE_AUTHORIZATION_H
320 else if (!strncmp(authorization, "AuthRef ", 8) &&
321 httpAddrLocalhost(httpGetAddress(con->http)))
322 {
323 OSStatus status; /* Status */
324 char authdata[HTTP_MAX_VALUE];
325 /* Nonce value from client */
326 int authlen; /* Auth string length */
327 AuthorizationItemSet *authinfo; /* Authorization item set */
328
329 /*
330 * Get the Authorization Services data...
331 */
332
333 authorization += 8;
334 while (isspace(*authorization & 255))
335 authorization ++;
336
337 authlen = sizeof(authdata);
338 httpDecode64_2(authdata, &authlen, authorization);
339
340 if (authlen != kAuthorizationExternalFormLength)
341 {
342 cupsdLogClient(con, CUPSD_LOG_ERROR, "External Authorization reference size is incorrect.");
343 return;
344 }
345
346 if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
347 {
348 cupsdLogClient(con, CUPSD_LOG_ERROR, "AuthorizationCreateFromExternalForm returned %d", (int)status);
349 return;
350 }
351
352 username[0] = '\0';
353
354 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
355 &authinfo))
356 {
357 if (authinfo->count == 1 && authinfo->items[0].value &&
358 authinfo->items[0].valueLength >= 2)
359 {
360 strlcpy(username, authinfo->items[0].value, sizeof(username));
361
362 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef.", username);
363 }
364
365 AuthorizationFreeItemSet(authinfo);
366 }
367
368 if (!username[0])
369 {
370 /*
371 * No username in AuthRef, grab username using peer credentials...
372 */
373
374 struct passwd *pwd; /* Password entry for this user */
375 cupsd_ucred_t peercred; /* Peer credentials */
376 socklen_t peersize; /* Size of peer credentials */
377
378 peersize = sizeof(peercred);
379
380 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
381 {
382 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
383 return;
384 }
385
386 if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
387 {
388 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred));
389 return;
390 }
391
392 strlcpy(username, pwd->pw_name, sizeof(username));
393
394 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef + PeerCred.", username);
395 }
396
397 con->type = CUPSD_AUTH_BASIC;
398 }
399 #endif /* HAVE_AUTHORIZATION_H */
400 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
401 else if (!strncmp(authorization, "PeerCred ", 9) &&
402 con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
403 {
404 /*
405 * Use peer credentials from domain socket connection...
406 */
407
408 struct passwd *pwd; /* Password entry for this user */
409 cupsd_ucred_t peercred; /* Peer credentials */
410 socklen_t peersize; /* Size of peer credentials */
411 #ifdef HAVE_AUTHORIZATION_H
412 const char *name; /* Authorizing name */
413 int no_peer = 0; /* Don't allow peer credentials? */
414
415 /*
416 * See if we should allow peer credentials...
417 */
418
419 for (name = (char *)cupsArrayFirst(con->best->names);
420 name;
421 name = (char *)cupsArrayNext(con->best->names))
422 {
423 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
424 !_cups_strcasecmp(name, "@SYSTEM"))
425 {
426 /* Normally don't want peer credentials if we need an auth key... */
427 no_peer = 1;
428 }
429 else if (!_cups_strcasecmp(name, "@OWNER"))
430 {
431 /* but if @OWNER is present then we allow it... */
432 no_peer = 0;
433 break;
434 }
435 }
436
437 if (no_peer)
438 {
439 cupsdLogClient(con, CUPSD_LOG_ERROR, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
440 return;
441 }
442 #endif /* HAVE_AUTHORIZATION_H */
443
444 if ((pwd = getpwnam(authorization + 9)) == NULL)
445 {
446 cupsdLogClient(con, CUPSD_LOG_ERROR, "User \"%s\" does not exist.", authorization + 9);
447 return;
448 }
449
450 peersize = sizeof(peercred);
451
452 # ifdef __APPLE__
453 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
454 # else
455 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
456 # endif /* __APPLE__ */
457 {
458 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
459 return;
460 }
461
462 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
463 {
464 cupsdLogClient(con, CUPSD_LOG_ERROR, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization + 9, CUPSD_UCRED_UID(peercred), pwd->pw_uid);
465 # ifdef HAVE_SYS_UCRED_H
466 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_version=%d", peercred.cr_version);
467 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_uid=%d", peercred.cr_uid);
468 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_ngroups=%d", peercred.cr_ngroups);
469 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_groups[0]=%d", peercred.cr_groups[0]);
470 # endif /* HAVE_SYS_UCRED_H */
471 return;
472 }
473
474 strlcpy(username, authorization + 9, sizeof(username));
475
476 # ifdef HAVE_GSSAPI
477 con->gss_uid = CUPSD_UCRED_UID(peercred);
478 # endif /* HAVE_GSSAPI */
479
480 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using PeerCred.", username);
481
482 con->type = CUPSD_AUTH_BASIC;
483 }
484 #endif /* SO_PEERCRED && AF_LOCAL */
485 else if (!strncmp(authorization, "Local", 5) &&
486 httpAddrLocalhost(httpGetAddress(con->http)))
487 {
488 /*
489 * Get Local certificate authentication data...
490 */
491
492 authorization += 5;
493 while (isspace(*authorization & 255))
494 authorization ++;
495
496 if ((localuser = cupsdFindCert(authorization)) == NULL)
497 {
498 cupsdLogClient(con, CUPSD_LOG_ERROR, "Local authentication certificate not found.");
499 return;
500 }
501
502 strlcpy(username, localuser->username, sizeof(username));
503 con->type = localuser->type;
504
505 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using Local.", username);
506 }
507 else if (!strncmp(authorization, "Basic", 5))
508 {
509 /*
510 * Get the Basic authentication data...
511 */
512
513 int userlen; /* Username:password length */
514
515
516 authorization += 5;
517 while (isspace(*authorization & 255))
518 authorization ++;
519
520 userlen = sizeof(username);
521 httpDecode64_2(username, &userlen, authorization);
522
523 /*
524 * Pull the username and password out...
525 */
526
527 if ((ptr = strchr(username, ':')) == NULL)
528 {
529 cupsdLogClient(con, CUPSD_LOG_ERROR, "Missing Basic password.");
530 return;
531 }
532
533 *ptr++ = '\0';
534
535 if (!username[0])
536 {
537 /*
538 * Username must not be empty...
539 */
540
541 cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic username.");
542 return;
543 }
544
545 if (!*ptr)
546 {
547 /*
548 * Password must not be empty...
549 */
550
551 cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic password.");
552 return;
553 }
554
555 strlcpy(password, ptr, sizeof(password));
556
557 /*
558 * Validate the username and password...
559 */
560
561 if (type == CUPSD_AUTH_BASIC)
562 {
563 #if HAVE_LIBPAM
564 /*
565 * Only use PAM to do authentication. This supports MD5
566 * passwords, among other things...
567 */
568
569 pam_handle_t *pamh; /* PAM authentication handle */
570 int pamerr; /* PAM error code */
571 struct pam_conv pamdata; /* PAM conversation data */
572 cupsd_authdata_t data; /* Authentication data */
573
574
575 strlcpy(data.username, username, sizeof(data.username));
576 strlcpy(data.password, password, sizeof(data.password));
577
578 # ifdef __sun
579 pamdata.conv = (int (*)(int, struct pam_message **,
580 struct pam_response **,
581 void *))pam_func;
582 # else
583 pamdata.conv = pam_func;
584 # endif /* __sun */
585 pamdata.appdata_ptr = &data;
586
587 pamerr = pam_start("cups", username, &pamdata, &pamh);
588 if (pamerr != PAM_SUCCESS)
589 {
590 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_start() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
591 return;
592 }
593
594 # ifdef HAVE_PAM_SET_ITEM
595 # ifdef PAM_RHOST
596 pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
597 if (pamerr != PAM_SUCCESS)
598 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
599 # endif /* PAM_RHOST */
600
601 # ifdef PAM_TTY
602 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
603 if (pamerr != PAM_SUCCESS)
604 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
605 # endif /* PAM_TTY */
606 # endif /* HAVE_PAM_SET_ITEM */
607
608 pamerr = pam_authenticate(pamh, PAM_SILENT);
609 if (pamerr != PAM_SUCCESS)
610 {
611 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_authenticate() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
612 pam_end(pamh, 0);
613 return;
614 }
615
616 # ifdef HAVE_PAM_SETCRED
617 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
618 if (pamerr != PAM_SUCCESS)
619 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_setcred() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
620 # endif /* HAVE_PAM_SETCRED */
621
622 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
623 if (pamerr != PAM_SUCCESS)
624 {
625 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_acct_mgmt() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
626 pam_end(pamh, 0);
627 return;
628 }
629
630 pam_end(pamh, PAM_SUCCESS);
631
632 #else
633 /*
634 * Use normal UNIX password file-based authentication...
635 */
636
637 char *pass; /* Encrypted password */
638 struct passwd *pw; /* User password data */
639 # ifdef HAVE_SHADOW_H
640 struct spwd *spw; /* Shadow password data */
641 # endif /* HAVE_SHADOW_H */
642
643
644 pw = getpwnam(username); /* Get the current password */
645 endpwent(); /* Close the password file */
646
647 if (!pw)
648 {
649 /*
650 * No such user...
651 */
652
653 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unknown username \"%s\".", username);
654 return;
655 }
656
657 # ifdef HAVE_SHADOW_H
658 spw = getspnam(username);
659 endspent();
660
661 if (!spw && !strcmp(pw->pw_passwd, "x"))
662 {
663 /*
664 * Don't allow blank passwords!
665 */
666
667 cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no shadow password.", username);
668 return;
669 }
670
671 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
672 # else
673 if (!pw->pw_passwd[0])
674 # endif /* HAVE_SHADOW_H */
675 {
676 /*
677 * Don't allow blank passwords!
678 */
679
680 cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no password.", username);
681 return;
682 }
683
684 /*
685 * OK, the password isn't blank, so compare with what came from the
686 * client...
687 */
688
689 pass = crypt(password, pw->pw_passwd);
690
691 if (!pass || strcmp(pw->pw_passwd, pass))
692 {
693 # ifdef HAVE_SHADOW_H
694 if (spw)
695 {
696 pass = crypt(password, spw->sp_pwdp);
697
698 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
699 {
700 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
701 return;
702 }
703 }
704 else
705 # endif /* HAVE_SHADOW_H */
706 {
707 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
708 return;
709 }
710 }
711 #endif /* HAVE_LIBPAM */
712 }
713
714 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
715 con->type = type;
716 }
717 #ifdef HAVE_GSSAPI
718 else if (!strncmp(authorization, "Negotiate", 9))
719 {
720 int len; /* Length of authorization string */
721 gss_ctx_id_t context; /* Authorization context */
722 OM_uint32 major_status, /* Major status code */
723 minor_status; /* Minor status code */
724 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
725 /* Input token from string */
726 output_token = GSS_C_EMPTY_BUFFER;
727 /* Output token for username */
728 gss_name_t client_name; /* Client name */
729
730 # ifdef __APPLE__
731 /*
732 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
733 * to use it...
734 */
735
736 if (&gss_init_sec_context == NULL)
737 {
738 cupsdLogClient(con, CUPSD_LOG_WARN, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
739 return;
740 }
741 # endif /* __APPLE__ */
742
743 /*
744 * Find the start of the Kerberos input token...
745 */
746
747 authorization += 9;
748 while (isspace(*authorization & 255))
749 authorization ++;
750
751 if (!*authorization)
752 {
753 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "No authentication data specified.");
754 return;
755 }
756
757 /*
758 * Decode the authorization string to get the input token...
759 */
760
761 len = (int)strlen(authorization) + 0;
762 input_token.value = malloc((size_t)len);
763 input_token.value = httpDecode64_2(input_token.value, &len,
764 authorization);
765 input_token.length = (size_t)len;
766
767 /*
768 * Accept the input token to get the authorization info...
769 */
770
771 context = GSS_C_NO_CONTEXT;
772 client_name = GSS_C_NO_NAME;
773 major_status = gss_accept_sec_context(&minor_status,
774 &context,
775 ServerCreds,
776 &input_token,
777 GSS_C_NO_CHANNEL_BINDINGS,
778 &client_name,
779 NULL,
780 &output_token,
781 NULL,
782 NULL,
783 NULL);
784
785 if (output_token.length > 0)
786 gss_release_buffer(&minor_status, &output_token);
787
788 if (GSS_ERROR(major_status))
789 {
790 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error accepting GSSAPI security context.", con->number);
791
792 if (context != GSS_C_NO_CONTEXT)
793 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
794 return;
795 }
796
797 con->have_gss = 1;
798
799 /*
800 * Get the username associated with the client's credentials...
801 */
802
803 if (major_status == GSS_S_CONTINUE_NEEDED)
804 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Credentials not complete.", con->number);
805 else if (major_status == GSS_S_COMPLETE)
806 {
807 major_status = gss_display_name(&minor_status, client_name,
808 &output_token, NULL);
809
810 if (GSS_ERROR(major_status))
811 {
812 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error getting username.", con->number);
813 gss_release_name(&minor_status, &client_name);
814 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
815 return;
816 }
817
818 strlcpy(username, output_token.value, sizeof(username));
819
820 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Negotiate.", username);
821
822 gss_release_name(&minor_status, &client_name);
823 gss_release_buffer(&minor_status, &output_token);
824
825 con->type = CUPSD_AUTH_NEGOTIATE;
826 }
827
828 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
829
830 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
831 /*
832 * Get the client's UID if we are printing locally - that allows a backend
833 * to run as the correct user to get Kerberos credentials of its own.
834 */
835
836 if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
837 {
838 cupsd_ucred_t peercred; /* Peer credentials */
839 socklen_t peersize; /* Size of peer credentials */
840
841 peersize = sizeof(peercred);
842
843 # ifdef __APPLE__
844 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
845 # else
846 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
847 &peersize))
848 # endif /* __APPLE__ */
849 {
850 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
851 }
852 else
853 {
854 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred));
855 con->gss_uid = CUPSD_UCRED_UID(peercred);
856 }
857 }
858 # endif /* SO_PEERCRED && AF_LOCAL */
859 }
860 #endif /* HAVE_GSSAPI */
861 else
862 {
863 char scheme[256]; /* Auth scheme... */
864
865
866 if (sscanf(authorization, "%255s", scheme) != 1)
867 strlcpy(scheme, "UNKNOWN", sizeof(scheme));
868
869 cupsdLogClient(con, CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\".", scheme);
870 return;
871 }
872
873 /*
874 * If we get here, then we were able to validate the username and
875 * password - copy the validated username and password to the client
876 * data and return...
877 */
878
879 strlcpy(con->username, username, sizeof(con->username));
880 strlcpy(con->password, password, sizeof(con->password));
881 }
882
883
884 /*
885 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
886 * access a location.
887 */
888
889 int /* O - 1 if allowed, 0 otherwise */
cupsdCheckAccess(unsigned ip[4],const char * name,size_t namelen,cupsd_location_t * loc)890 cupsdCheckAccess(
891 unsigned ip[4], /* I - Client address */
892 const char *name, /* I - Client hostname */
893 size_t namelen, /* I - Length of hostname */
894 cupsd_location_t *loc) /* I - Location to check */
895 {
896 int allow; /* 1 if allowed, 0 otherwise */
897
898
899 if (!_cups_strcasecmp(name, "localhost"))
900 {
901 /*
902 * Access from localhost (127.0.0.1 or ::1) is always allowed...
903 */
904
905 return (1);
906 }
907 else
908 {
909 /*
910 * Do authorization checks on the domain/address...
911 */
912
913 switch (loc->order_type)
914 {
915 default :
916 allow = 0; /* anti-compiler-warning-code */
917 break;
918
919 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
920 allow = 1;
921
922 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
923 allow = 0;
924
925 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
926 allow = 1;
927 break;
928
929 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
930 allow = 0;
931
932 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
933 allow = 1;
934
935 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
936 allow = 0;
937 break;
938 }
939 }
940
941 return (allow);
942 }
943
944
945 /*
946 * 'cupsdCheckAuth()' - Check authorization masks.
947 */
948
949 int /* O - 1 if mask matches, 0 otherwise */
cupsdCheckAuth(unsigned ip[4],const char * name,size_t name_len,cups_array_t * masks)950 cupsdCheckAuth(unsigned ip[4], /* I - Client address */
951 const char *name, /* I - Client hostname */
952 size_t name_len, /* I - Length of hostname */
953 cups_array_t *masks) /* I - Masks */
954 {
955 int i; /* Looping var */
956 cupsd_authmask_t *mask; /* Current mask */
957 cupsd_netif_t *iface; /* Network interface */
958 unsigned netip4; /* IPv4 network address */
959 #ifdef AF_INET6
960 unsigned netip6[4]; /* IPv6 network address */
961 #endif /* AF_INET6 */
962
963
964 for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
965 mask;
966 mask = (cupsd_authmask_t *)cupsArrayNext(masks))
967 {
968 switch (mask->type)
969 {
970 case CUPSD_AUTH_INTERFACE :
971 /*
972 * Check for a match with a network interface...
973 */
974
975 netip4 = htonl(ip[3]);
976
977 #ifdef AF_INET6
978 netip6[0] = htonl(ip[0]);
979 netip6[1] = htonl(ip[1]);
980 netip6[2] = htonl(ip[2]);
981 netip6[3] = htonl(ip[3]);
982 #endif /* AF_INET6 */
983
984 cupsdNetIFUpdate();
985
986 if (!strcmp(mask->mask.name.name, "*"))
987 {
988 #ifdef __APPLE__
989 /*
990 * Allow Back-to-My-Mac addresses...
991 */
992
993 if ((ip[0] & 0xff000000) == 0xfd000000)
994 return (1);
995 #endif /* __APPLE__ */
996
997 /*
998 * Check against all local interfaces...
999 */
1000
1001 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1002 iface;
1003 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1004 {
1005 /*
1006 * Only check local interfaces...
1007 */
1008
1009 if (!iface->is_local)
1010 continue;
1011
1012 if (iface->address.addr.sa_family == AF_INET)
1013 {
1014 /*
1015 * Check IPv4 address...
1016 */
1017
1018 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1019 (iface->address.ipv4.sin_addr.s_addr &
1020 iface->mask.ipv4.sin_addr.s_addr))
1021 return (1);
1022 }
1023 #ifdef AF_INET6
1024 else
1025 {
1026 /*
1027 * Check IPv6 address...
1028 */
1029
1030 for (i = 0; i < 4; i ++)
1031 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1032 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1033 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1034 break;
1035
1036 if (i == 4)
1037 return (1);
1038 }
1039 #endif /* AF_INET6 */
1040 }
1041 }
1042 else
1043 {
1044 /*
1045 * Check the named interface...
1046 */
1047
1048 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1049 iface;
1050 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1051 {
1052 if (strcmp(mask->mask.name.name, iface->name))
1053 continue;
1054
1055 if (iface->address.addr.sa_family == AF_INET)
1056 {
1057 /*
1058 * Check IPv4 address...
1059 */
1060
1061 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1062 (iface->address.ipv4.sin_addr.s_addr &
1063 iface->mask.ipv4.sin_addr.s_addr))
1064 return (1);
1065 }
1066 #ifdef AF_INET6
1067 else
1068 {
1069 /*
1070 * Check IPv6 address...
1071 */
1072
1073 for (i = 0; i < 4; i ++)
1074 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1075 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1076 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1077 break;
1078
1079 if (i == 4)
1080 return (1);
1081 }
1082 #endif /* AF_INET6 */
1083 }
1084 }
1085 break;
1086
1087 case CUPSD_AUTH_NAME :
1088 /*
1089 * Check for exact name match...
1090 */
1091
1092 if (!_cups_strcasecmp(name, mask->mask.name.name))
1093 return (1);
1094
1095 /*
1096 * Check for domain match...
1097 */
1098
1099 if (name_len >= mask->mask.name.length &&
1100 mask->mask.name.name[0] == '.' &&
1101 !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1102 mask->mask.name.name))
1103 return (1);
1104 break;
1105
1106 case CUPSD_AUTH_IP :
1107 /*
1108 * Check for IP/network address match...
1109 */
1110
1111 for (i = 0; i < 4; i ++)
1112 if ((ip[i] & mask->mask.ip.netmask[i]) !=
1113 mask->mask.ip.address[i])
1114 break;
1115
1116 if (i == 4)
1117 return (1);
1118 break;
1119 }
1120 }
1121
1122 return (0);
1123 }
1124
1125
1126 /*
1127 * 'cupsdCheckGroup()' - Check for a user's group membership.
1128 */
1129
1130 int /* O - 1 if user is a member, 0 otherwise */
cupsdCheckGroup(const char * username,struct passwd * user,const char * groupname)1131 cupsdCheckGroup(
1132 const char *username, /* I - User name */
1133 struct passwd *user, /* I - System user info */
1134 const char *groupname) /* I - Group name */
1135 {
1136 int i; /* Looping var */
1137 struct group *group; /* Group info */
1138 gid_t groupid; /* ID of named group */
1139 #ifdef HAVE_MBR_UID_TO_UUID
1140 uuid_t useruuid, /* UUID for username */
1141 groupuuid; /* UUID for groupname */
1142 int is_member; /* True if user is a member of group */
1143 #endif /* HAVE_MBR_UID_TO_UUID */
1144
1145
1146 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username, (void *)user, groupname);
1147
1148 /*
1149 * Validate input...
1150 */
1151
1152 if (!username || !groupname)
1153 return (0);
1154
1155 /*
1156 * Check to see if the user is a member of the named group...
1157 */
1158
1159 group = getgrnam(groupname);
1160 endgrent();
1161
1162 if (group != NULL)
1163 {
1164 /*
1165 * Group exists, check it...
1166 */
1167
1168 groupid = group->gr_gid;
1169
1170 for (i = 0; group->gr_mem[i]; i ++)
1171 {
1172 /*
1173 * User appears in the group membership...
1174 */
1175
1176 if (!_cups_strcasecmp(username, group->gr_mem[i]))
1177 return (1);
1178 }
1179
1180 #ifdef HAVE_GETGROUPLIST
1181 /*
1182 * If the user isn't in the group membership list, try the results from
1183 * getgrouplist() which is supposed to return the full list of groups a user
1184 * belongs to...
1185 */
1186
1187 if (user)
1188 {
1189 int ngroups; /* Number of groups */
1190 # ifdef __APPLE__
1191 int groups[2048]; /* Groups that user belongs to */
1192 # else
1193 gid_t groups[2048]; /* Groups that user belongs to */
1194 # endif /* __APPLE__ */
1195
1196 ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
1197 # ifdef __APPLE__
1198 getgrouplist(username, (int)user->pw_gid, groups, &ngroups);
1199 # else
1200 getgrouplist(username, user->pw_gid, groups, &ngroups);
1201 #endif /* __APPLE__ */
1202
1203 for (i = 0; i < ngroups; i ++)
1204 if ((int)groupid == (int)groups[i])
1205 return (1);
1206 }
1207 #endif /* HAVE_GETGROUPLIST */
1208 }
1209 else
1210 groupid = (gid_t)-1;
1211
1212 /*
1213 * Group doesn't exist or user not in group list, check the group ID
1214 * against the user's group ID...
1215 */
1216
1217 if (user && groupid == user->pw_gid)
1218 return (1);
1219
1220 #ifdef HAVE_MBR_UID_TO_UUID
1221 /*
1222 * Check group membership through macOS membership API...
1223 */
1224
1225 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1226 {
1227 if (groupid != (gid_t)-1)
1228 {
1229 /*
1230 * Map group name to UUID and check membership...
1231 */
1232
1233 if (!mbr_gid_to_uuid(groupid, groupuuid))
1234 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1235 if (is_member)
1236 return (1);
1237 }
1238 else if (groupname[0] == '#')
1239 {
1240 /*
1241 * Use UUID directly and check for equality (user UUID) and
1242 * membership (group UUID)...
1243 */
1244
1245 if (!uuid_parse((char *)groupname + 1, groupuuid))
1246 {
1247 if (!uuid_compare(useruuid, groupuuid))
1248 return (1);
1249 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1250 if (is_member)
1251 return (1);
1252 }
1253
1254 return (0);
1255 }
1256 }
1257 else if (groupname[0] == '#')
1258 return (0);
1259 #endif /* HAVE_MBR_UID_TO_UUID */
1260
1261 /*
1262 * If we get this far, then the user isn't part of the named group...
1263 */
1264
1265 return (0);
1266 }
1267
1268
1269 /*
1270 * 'cupsdCopyLocation()' - Make a copy of a location...
1271 */
1272
1273 cupsd_location_t * /* O - New location */
cupsdCopyLocation(cupsd_location_t * loc)1274 cupsdCopyLocation(
1275 cupsd_location_t *loc) /* I - Original location */
1276 {
1277 cupsd_location_t *temp; /* New location */
1278
1279
1280 /*
1281 * Make a copy of the original location...
1282 */
1283
1284 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1285 return (NULL);
1286
1287 /*
1288 * Copy the information from the original location to the new one.
1289 */
1290
1291 if (!loc)
1292 return (temp);
1293
1294 if (loc->location)
1295 temp->location = _cupsStrAlloc(loc->location);
1296
1297 temp->length = loc->length;
1298 temp->limit = loc->limit;
1299 temp->order_type = loc->order_type;
1300 temp->type = loc->type;
1301 temp->level = loc->level;
1302 temp->satisfy = loc->satisfy;
1303 temp->encryption = loc->encryption;
1304
1305 if (loc->names)
1306 {
1307 if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1308 {
1309 cupsdLogMessage(CUPSD_LOG_ERROR,
1310 "Unable to allocate memory for %d names: %s",
1311 cupsArrayCount(loc->names), strerror(errno));
1312
1313 cupsdFreeLocation(temp);
1314 return (NULL);
1315 }
1316 }
1317
1318 if (loc->allow)
1319 {
1320 /*
1321 * Copy allow rules...
1322 */
1323
1324 if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1325 {
1326 cupsdLogMessage(CUPSD_LOG_ERROR,
1327 "Unable to allocate memory for %d allow rules: %s",
1328 cupsArrayCount(loc->allow), strerror(errno));
1329 cupsdFreeLocation(temp);
1330 return (NULL);
1331 }
1332 }
1333
1334 if (loc->deny)
1335 {
1336 /*
1337 * Copy deny rules...
1338 */
1339
1340 if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1341 {
1342 cupsdLogMessage(CUPSD_LOG_ERROR,
1343 "Unable to allocate memory for %d deny rules: %s",
1344 cupsArrayCount(loc->deny), strerror(errno));
1345 cupsdFreeLocation(temp);
1346 return (NULL);
1347 }
1348 }
1349
1350 return (temp);
1351 }
1352
1353
1354 /*
1355 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1356 */
1357
1358 void
cupsdDeleteAllLocations(void)1359 cupsdDeleteAllLocations(void)
1360 {
1361 /*
1362 * Free the location array, which will free all of the locations...
1363 */
1364
1365 cupsArrayDelete(Locations);
1366 Locations = NULL;
1367 }
1368
1369
1370 /*
1371 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1372 */
1373
1374 cupsd_location_t * /* O - Location that matches */
cupsdFindBest(const char * path,http_state_t state)1375 cupsdFindBest(const char *path, /* I - Resource path */
1376 http_state_t state) /* I - HTTP state/request */
1377 {
1378 char uri[HTTP_MAX_URI],
1379 /* URI in request... */
1380 *uriptr; /* Pointer into URI */
1381 cupsd_location_t *loc, /* Current location */
1382 *best; /* Best match for location so far */
1383 size_t bestlen; /* Length of best match */
1384 int limit; /* Limit field */
1385 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1386 {
1387 CUPSD_AUTH_LIMIT_ALL,
1388 CUPSD_AUTH_LIMIT_OPTIONS,
1389 CUPSD_AUTH_LIMIT_GET,
1390 CUPSD_AUTH_LIMIT_GET,
1391 CUPSD_AUTH_LIMIT_HEAD,
1392 CUPSD_AUTH_LIMIT_POST,
1393 CUPSD_AUTH_LIMIT_POST,
1394 CUPSD_AUTH_LIMIT_POST,
1395 CUPSD_AUTH_LIMIT_PUT,
1396 CUPSD_AUTH_LIMIT_PUT,
1397 CUPSD_AUTH_LIMIT_DELETE,
1398 CUPSD_AUTH_LIMIT_TRACE,
1399 CUPSD_AUTH_LIMIT_ALL,
1400 CUPSD_AUTH_LIMIT_ALL,
1401 CUPSD_AUTH_LIMIT_ALL,
1402 CUPSD_AUTH_LIMIT_ALL
1403 };
1404
1405
1406 /*
1407 * First copy the connection URI to a local string so we have drop
1408 * any .ppd extension from the pathname in /printers or /classes
1409 * URIs...
1410 */
1411
1412 strlcpy(uri, path, sizeof(uri));
1413
1414 if ((uriptr = strchr(uri, '?')) != NULL)
1415 *uriptr = '\0'; /* Drop trailing query string */
1416
1417 if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1418 *uriptr = '\0'; /* Remove trailing '/' */
1419
1420 if (!strncmp(uri, "/printers/", 10) ||
1421 !strncmp(uri, "/classes/", 9))
1422 {
1423 /*
1424 * Check if the URI has .ppd on the end...
1425 */
1426
1427 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1428
1429 if (!strcmp(uriptr, ".ppd"))
1430 *uriptr = '\0';
1431 }
1432
1433 /*
1434 * Loop through the list of locations to find a match...
1435 */
1436
1437 limit = limits[state];
1438 best = NULL;
1439 bestlen = 0;
1440
1441 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri=\"%s\", limit=%x...", uri, limit);
1442
1443
1444 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1445 loc;
1446 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1447 {
1448 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1449
1450 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1451 {
1452 /*
1453 * Use case-insensitive comparison for queue names...
1454 */
1455
1456 if (loc->length > bestlen && loc->location &&
1457 !_cups_strncasecmp(uri, loc->location, loc->length) &&
1458 loc->location[0] == '/' &&
1459 (limit & loc->limit) != 0)
1460 {
1461 best = loc;
1462 bestlen = loc->length;
1463 }
1464 }
1465 else
1466 {
1467 /*
1468 * Use case-sensitive comparison for other URIs...
1469 */
1470
1471 if (loc->length > bestlen && loc->location &&
1472 !strncmp(uri, loc->location, loc->length) &&
1473 loc->location[0] == '/' &&
1474 (limit & loc->limit) != 0)
1475 {
1476 best = loc;
1477 bestlen = loc->length;
1478 }
1479 }
1480 }
1481
1482 /*
1483 * Return the match, if any...
1484 */
1485
1486 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best=%s", best ? best->location : "NONE");
1487
1488 return (best);
1489 }
1490
1491
1492 /*
1493 * 'cupsdFindLocation()' - Find the named location.
1494 */
1495
1496 cupsd_location_t * /* O - Location that matches */
cupsdFindLocation(const char * location)1497 cupsdFindLocation(const char *location) /* I - Connection */
1498 {
1499 cupsd_location_t key; /* Search key */
1500
1501
1502 key.location = (char *)location;
1503
1504 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1505 }
1506
1507
1508 /*
1509 * 'cupsdFreeLocation()' - Free all memory used by a location.
1510 */
1511
1512 void
cupsdFreeLocation(cupsd_location_t * loc)1513 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1514 {
1515 cupsArrayDelete(loc->names);
1516 cupsArrayDelete(loc->allow);
1517 cupsArrayDelete(loc->deny);
1518
1519 _cupsStrFree(loc->location);
1520 free(loc);
1521 }
1522
1523
1524 /*
1525 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1526 */
1527
1528 http_status_t /* O - HTTP_OK if authorized or error code */
cupsdIsAuthorized(cupsd_client_t * con,const char * owner)1529 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1530 const char *owner)/* I - Owner of object */
1531 {
1532 int i, /* Looping vars */
1533 auth, /* Authorization status */
1534 type; /* Type of authentication */
1535 http_addr_t *hostaddr = httpGetAddress(con->http);
1536 /* Client address */
1537 const char *hostname = httpGetHostname(con->http, NULL, 0);
1538 /* Client hostname */
1539 unsigned address[4]; /* Authorization address */
1540 cupsd_location_t *best; /* Best match for location so far */
1541 size_t hostlen; /* Length of hostname */
1542 char *name, /* Current username */
1543 username[256], /* Username to authorize */
1544 ownername[256], /* Owner name to authorize */
1545 *ptr; /* Pointer into username */
1546 struct passwd *pw; /* User password data */
1547 static const char * const levels[] = /* Auth levels */
1548 {
1549 "ANON",
1550 "USER",
1551 "GROUP"
1552 };
1553 static const char * const types[] = /* Auth types */
1554 {
1555 "None",
1556 "Basic",
1557 "Negotiate"
1558 };
1559
1560
1561 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con->uri, (void *)con->best, con->best ? con->best->location ? con->best->location : "(null)" : "");
1562 if (owner)
1563 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: owner=\"%s\"", owner);
1564
1565 /*
1566 * If there is no "best" authentication rule for this request, then
1567 * access is allowed from the local system and denied from other
1568 * addresses...
1569 */
1570
1571 if (!con->best)
1572 {
1573 if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1574 !strcmp(hostname, ServerName) ||
1575 cupsArrayFind(ServerAlias, (void *)hostname))
1576 return (HTTP_OK);
1577 else
1578 return (HTTP_FORBIDDEN);
1579 }
1580
1581 best = con->best;
1582
1583 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1584 type = cupsdDefaultAuthType();
1585
1586 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels[best->level], types[type], best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1587
1588 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1589 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)", best->op, ippOpString(best->op));
1590
1591 /*
1592 * Check host/ip-based accesses...
1593 */
1594
1595 #ifdef AF_INET6
1596 if (httpAddrFamily(hostaddr) == AF_INET6)
1597 {
1598 /*
1599 * Copy IPv6 address...
1600 */
1601
1602 address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1603 address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1604 address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1605 address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1606 }
1607 else
1608 #endif /* AF_INET6 */
1609 if (con->http->hostaddr->addr.sa_family == AF_INET)
1610 {
1611 /*
1612 * Copy IPv4 address...
1613 */
1614
1615 address[0] = 0;
1616 address[1] = 0;
1617 address[2] = 0;
1618 address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1619 }
1620 else
1621 memset(address, 0, sizeof(address));
1622
1623 hostlen = strlen(hostname);
1624
1625 auth = cupsdCheckAccess(address, hostname, hostlen, best)
1626 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1627
1628 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth ? "DENY" : "ALLOW");
1629
1630 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1631 return (HTTP_FORBIDDEN);
1632
1633 #ifdef HAVE_TLS
1634 /*
1635 * See if encryption is required...
1636 */
1637
1638 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1639 _cups_strcasecmp(hostname, "localhost") &&
1640 !httpAddrLocalhost(hostaddr) &&
1641 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1642 !(type == CUPSD_AUTH_NEGOTIATE ||
1643 (type == CUPSD_AUTH_NONE &&
1644 cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1645 {
1646 cupsdLogMessage(CUPSD_LOG_DEBUG,
1647 "cupsdIsAuthorized: Need upgrade to TLS...");
1648 return (HTTP_UPGRADE_REQUIRED);
1649 }
1650 #endif /* HAVE_TLS */
1651
1652 /*
1653 * Now see what access level is required...
1654 */
1655
1656 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1657 (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1658 return (HTTP_OK);
1659
1660 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1661 best->limit == CUPSD_AUTH_LIMIT_IPP)
1662 {
1663 /*
1664 * Check for unauthenticated username...
1665 */
1666
1667 ipp_attribute_t *attr; /* requesting-user-name attribute */
1668
1669
1670 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1671 if (attr)
1672 {
1673 cupsdLogMessage(CUPSD_LOG_DEBUG,
1674 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1675 attr->values[0].string.text);
1676 strlcpy(username, attr->values[0].string.text, sizeof(username));
1677 }
1678 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1679 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1680 else
1681 return (HTTP_OK); /* unless overridden with Satisfy */
1682 }
1683 else
1684 {
1685 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1686 con->username);
1687
1688 #ifdef HAVE_AUTHORIZATION_H
1689 if (!con->username[0] && !con->authref)
1690 #else
1691 if (!con->username[0])
1692 #endif /* HAVE_AUTHORIZATION_H */
1693 {
1694 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1695 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1696 else
1697 return (HTTP_OK); /* unless overridden with Satisfy */
1698 }
1699
1700
1701 if (con->type != type && type != CUPSD_AUTH_NONE &&
1702 #ifdef HAVE_GSSAPI
1703 (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1704 #endif /* HAVE_GSSAPI */
1705 con->type != CUPSD_AUTH_BASIC)
1706 {
1707 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1708 types[con->type], types[type]);
1709
1710 return (HTTP_UNAUTHORIZED);
1711 }
1712
1713 strlcpy(username, con->username, sizeof(username));
1714 }
1715
1716 /*
1717 * OK, got a username. See if we need normal user access, or group
1718 * access...
1719 */
1720
1721 /*
1722 * Strip any @domain or @KDC from the username and owner...
1723 */
1724
1725 if (StripUserDomain && (ptr = strchr(username, '@')) != NULL)
1726 *ptr = '\0';
1727
1728 if (owner)
1729 {
1730 strlcpy(ownername, owner, sizeof(ownername));
1731
1732 if (StripUserDomain && (ptr = strchr(ownername, '@')) != NULL)
1733 *ptr = '\0';
1734 }
1735 else
1736 ownername[0] = '\0';
1737
1738 /*
1739 * Get the user info...
1740 */
1741
1742 if (username[0])
1743 {
1744 pw = getpwnam(username);
1745 endpwent();
1746 }
1747 else
1748 pw = NULL;
1749
1750 /*
1751 * For matching user and group memberships below we will first go
1752 * through all names except @SYSTEM to authorize the task as
1753 * non-administrative, like printing or deleting one's own job, if this
1754 * fails we will check whether we can authorize via the special name
1755 * @SYSTEM, as an administrative task, like creating a print queue or
1756 * deleting someone else's job.
1757 * Note that tasks are considered as administrative by the policies
1758 * in cupsd.conf, when they require the user or group @SYSTEM.
1759 * We do this separation because if the client is a Snap connecting via
1760 * domain socket, we need to additionally check whether it plugs to us
1761 * through the "cups-control" interface which allows administration and
1762 * not through the "cups" interface which allows only printing.
1763 */
1764
1765 if (best->level == CUPSD_AUTH_USER)
1766 {
1767 /*
1768 * If there are no names associated with this location, then
1769 * any valid user is OK...
1770 */
1771
1772 if (cupsArrayCount(best->names) == 0)
1773 return (HTTP_OK);
1774
1775 /*
1776 * Otherwise check the user list and return OK if this user is
1777 * allowed...
1778 */
1779
1780 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking user membership...");
1781
1782 #ifdef HAVE_AUTHORIZATION_H
1783 /*
1784 * If an authorization reference was supplied it must match a right name...
1785 */
1786
1787 if (con->authref)
1788 {
1789 for (name = (char *)cupsArrayFirst(best->names);
1790 name;
1791 name = (char *)cupsArrayNext(best->names))
1792 {
1793 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1794 return (HTTP_OK);
1795 }
1796
1797 for (name = (char *)cupsArrayFirst(best->names);
1798 name;
1799 name = (char *)cupsArrayNext(best->names))
1800 {
1801 if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1802 check_authref(con, SystemGroupAuthKey))
1803 return (HTTP_OK);
1804 }
1805
1806 return (HTTP_FORBIDDEN);
1807 }
1808 #endif /* HAVE_AUTHORIZATION_H */
1809
1810 for (name = (char *)cupsArrayFirst(best->names);
1811 name;
1812 name = (char *)cupsArrayNext(best->names))
1813 {
1814 if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1815 !_cups_strcasecmp(username, ownername))
1816 return (HTTP_OK);
1817 else if (!_cups_strcasecmp(name, "@SYSTEM"))
1818 {
1819 /* Do @SYSTEM later, when every other entry fails */
1820 continue;
1821 }
1822 else if (name[0] == '@')
1823 {
1824 if (cupsdCheckGroup(username, pw, name + 1))
1825 return (HTTP_OK);
1826 }
1827 else if (!_cups_strcasecmp(username, name))
1828 return (HTTP_OK);
1829 }
1830
1831 for (name = (char *)cupsArrayFirst(best->names);
1832 name;
1833 name = (char *)cupsArrayNext(best->names))
1834 {
1835 if (!_cups_strcasecmp(name, "@SYSTEM"))
1836 {
1837 for (i = 0; i < NumSystemGroups; i ++)
1838 if (cupsdCheckGroup(username, pw, SystemGroups[i]) && check_admin_access(con))
1839 return (HTTP_OK);
1840 }
1841 }
1842
1843 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1844 }
1845
1846 /*
1847 * Check to see if this user is in any of the named groups...
1848 */
1849
1850 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group membership...");
1851
1852 /*
1853 * Check to see if this user is in any of the named groups...
1854 */
1855
1856 for (name = (char *)cupsArrayFirst(best->names);
1857 name;
1858 name = (char *)cupsArrayNext(best->names))
1859 {
1860 if (!_cups_strcasecmp(name, "@SYSTEM"))
1861 {
1862 /* Do @SYSTEM later, when every other entry fails */
1863 continue;
1864 }
1865
1866 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1867
1868 if (cupsdCheckGroup(username, pw, name))
1869 return (HTTP_OK);
1870 }
1871
1872 for (name = (char *)cupsArrayFirst(best->names);
1873 name;
1874 name = (char *)cupsArrayNext(best->names))
1875 {
1876 if (!_cups_strcasecmp(name, "@SYSTEM"))
1877 {
1878 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1879
1880 for (i = 0; i < NumSystemGroups; i ++)
1881 if (cupsdCheckGroup(username, pw, SystemGroups[i]) && check_admin_access(con))
1882 return (HTTP_OK);
1883 }
1884 }
1885
1886 /*
1887 * The user isn't part of the specified group, so deny access...
1888 */
1889
1890 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: User not in group(s).");
1891
1892 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1893 }
1894
1895
1896 /*
1897 * 'cupsdNewLocation()' - Create a new location for authorization.
1898 *
1899 * Note: Still need to call cupsdAddLocation() to add it to the list of global
1900 * locations.
1901 */
1902
1903 cupsd_location_t * /* O - Pointer to new location record */
cupsdNewLocation(const char * location)1904 cupsdNewLocation(const char *location) /* I - Location path */
1905 {
1906 cupsd_location_t *temp; /* New location */
1907
1908
1909 /*
1910 * Try to allocate memory for the new location.
1911 */
1912
1913 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1914 return (NULL);
1915
1916 /*
1917 * Initialize the record and copy the name over...
1918 */
1919
1920 if ((temp->location = _cupsStrAlloc(location)) == NULL)
1921 {
1922 free(temp);
1923 return (NULL);
1924 }
1925
1926 temp->length = strlen(temp->location);
1927
1928 /*
1929 * Return the new record...
1930 */
1931
1932 return (temp);
1933 }
1934
1935
1936 /*
1937 * 'check_admin_access()' - Verify that the client has administrative access.
1938 */
1939
1940 static int // O - 1 if authorized, 0 otherwise
check_admin_access(cupsd_client_t * con)1941 check_admin_access(cupsd_client_t *con) // I - Client connection
1942 {
1943 #if defined(HAVE_LIBAPPARMOR) && defined(HAVE_LIBSNAPDGLIB)
1944 /*
1945 * If the client accesses locally via domain socket, find out whether it
1946 * is a Snap. Grant access if it is not a Snap, if it is a classic Snap
1947 * or if it is a confined Snap which plugs "cups-control". Otherwise deny
1948 * access.
1949 */
1950
1951 int fd = httpGetFd(con->http);
1952 // Client socket file descriptor
1953 char *context = NULL; // AppArmor profile name of client
1954 SnapdClient *client = NULL; // Data structure of snapd access
1955 GError *error = NULL; // Glib error
1956 int ret = 1; // Return value
1957 # if !CUPS_SNAP
1958 SnapdSnap *snap = NULL; // Data structure of client Snap
1959 # endif // !CUPS_SNAP
1960
1961
1962 # ifdef AF_LOCAL
1963 // Only check domain sockets...
1964 if (httpAddrFamily(con->http->hostaddr) != AF_LOCAL)
1965 return (1);
1966 # endif // AF_LOCAL
1967
1968 # if !CUPS_SNAP
1969 // If AppArmor is not enabled, then we can't identify the client...
1970 if (!aa_is_enabled())
1971 {
1972 cupsdLogClient(con, CUPSD_LOG_DEBUG, "AppArmor not in use.");
1973 return (1);
1974 }
1975 # endif /* !CUPS_SNAP */
1976
1977 // Get the client's AppArmor context using the socket...
1978 if (aa_getpeercon(fd, &context, NULL) < 0)
1979 {
1980 cupsdLogClient(con, CUPSD_LOG_DEBUG, "AppArmor profile could not be retrieved: %s", strerror(errno));
1981 return (1);
1982 }
1983 else
1984 {
1985 cupsdLogClient(con, CUPSD_LOG_DEBUG, "AppArmor profile is '%s'.", context);
1986 }
1987
1988 // Allow access from "cups" snap...
1989 if (!strncmp(context, "snap.cups.", 10))
1990 {
1991 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Client from the CUPS Snap itself - allowed.");
1992 goto done;
1993 }
1994
1995 # if CUPS_SNAP && defined(HAVE_SNAPD_CLIENT_RUN_SNAPCTL2_SYNC)
1996 /*
1997 * CUPS is snapped, so check whether the client is also snapped. If so,
1998 * determine whether the client snap has a "cups-control" plug which allows
1999 * the application to perform CUPS administrative tasks.
2000 */
2001
2002 const char *cookie; // snapd access cookie
2003 int status = 65535; // Status of client Snap context check
2004 const char *args[] = // snapctl arguments
2005 {
2006 "is-connected",
2007 "--apparmor-label",
2008 NULL,
2009 "cups-control",
2010 NULL
2011 };
2012
2013 // Connect to snapd
2014 if ((client = snapd_client_new()) == NULL)
2015 {
2016 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to connect to snapd.");
2017 ret = 0;
2018 goto done;
2019 }
2020
2021 // snapctl commands are sent over a domain socket
2022 snapd_client_set_socket_path(client, "/run/snapd-snap.socket");
2023
2024 // Take cookie from the environment if available
2025 if ((cookie = g_getenv("SNAP_COOKIE")) == NULL)
2026 {
2027 cookie = "";
2028 cupsdLogClient(con, CUPSD_LOG_WARN, "No SNAP_COOKIE set in the Snap environment.");
2029 }
2030
2031 // Do the client Snap context check...
2032 args[2] = context;
2033
2034 if (!snapd_client_run_snapctl2_sync(client, cookie, (char **)args, NULL, NULL, &status, NULL, &error))
2035 {
2036 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to check snap context: %s", error->message);
2037 ret = 0;
2038 goto done;
2039 }
2040
2041 switch (status)
2042 {
2043 case 0 : // The client is a confined Snap and plugs cups-control
2044 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Snap with cups-control plug - allowed.");
2045 break;
2046 case 1 : // The client is a confined Snap and does not plug cups-control
2047 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Snap without cups-control plug - denied.");
2048 ret = 0;
2049 break;
2050 case 10 : // The client is a classic Snap
2051 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Classic snap - allowed.");
2052 break;
2053 case 11 : // The client is not a Snap
2054 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Not a snap - allowed.");
2055 break;
2056 default : // Unexpected status...
2057 cupsdLogClient(con, CUPSD_LOG_ERROR, "Snap check returned unexpected status %d - denied.", status);
2058 ret = 0;
2059 break;
2060 }
2061
2062 # elif !CUPS_SNAP
2063 /*
2064 * If CUPS is not snapped, check whether the client is snapped and if it has
2065 * the "cups-control" plug.
2066 */
2067
2068 // Is the client a snapped application?
2069 if (strncmp(context, "snap.", 5))
2070 {
2071 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Not a snap - allowed.");
2072 goto done;
2073 }
2074
2075 // Extract the snap name from the context (snap.name.instance)
2076 char *snap_name = strdup(context + 5);// Snap name follows "snap."
2077 char *ptr = strchr(snap_name, '.'); // instance follows the name...
2078 if (!ptr)
2079 {
2080 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Malformed snapd AppArmor profile name '%s' - denied.", context);
2081 free(snap_name);
2082 ret = 0;
2083 goto done;
2084 }
2085
2086 *ptr = '\0';
2087 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Client snap is '%s'.", snap_name);
2088
2089 // Connect to snapd
2090 if ((client = snapd_client_new()) == NULL)
2091 {
2092 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to connect to snapd.");
2093 free(snap_name);
2094 ret = 0;
2095 goto done;
2096 }
2097
2098 // Check whether the client Snap is under classic confinement
2099 GPtrArray *plugs = NULL; // List of plugs for snap
2100
2101 if ((snap = snapd_client_get_snap_sync(client, snap_name, NULL, &error)) == NULL)
2102 {
2103 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Unable to get client Snap data: %s", error->message);
2104 ret = 0;
2105 }
2106 // Snaps using classic confinement are granted access
2107 else if (snapd_snap_get_confinement(snap) == SNAPD_CONFINEMENT_CLASSIC)
2108 {
2109 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Classic snap - allowed.");
2110 }
2111 // Check whether the client Snap has the cups-control plug
2112 else if (!snapd_client_get_connections2_sync(client, SNAPD_GET_CONNECTIONS_FLAGS_NONE, snap_name, "cups-control", NULL, NULL, &plugs, NULL, NULL, &error))
2113 {
2114 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Unable to get client Snap plugs: %s", error->message);
2115 ret = 0;
2116 }
2117 else if (!plugs || plugs->len <= 0)
2118 {
2119 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Snap without cups-control plug - denied.");
2120 ret = 0;
2121 }
2122 else
2123 {
2124 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Snap with cups-control plug - allowed.");
2125 }
2126
2127 if (plugs)
2128 g_ptr_array_unref(plugs);
2129
2130 free(snap_name);
2131 g_clear_object(&snap);
2132 # endif // CUPS_SNAP
2133
2134 done:
2135
2136 free(context);
2137 g_clear_object(&client);
2138
2139 return (ret);
2140
2141 #else
2142 (void)con;
2143
2144 // No AppArmor/snapd to deal with...
2145 return (1);
2146 #endif // HAVE_LIBAPPARMOR && HAVE_LIBSNAPDGLIB
2147 }
2148
2149
2150 #ifdef HAVE_AUTHORIZATION_H
2151 /*
2152 * 'check_authref()' - Check if an authorization services reference has the
2153 * supplied right.
2154 */
2155
2156 static int /* O - 1 if right is valid, 0 otherwise */
check_authref(cupsd_client_t * con,const char * right)2157 check_authref(cupsd_client_t *con, /* I - Connection */
2158 const char *right) /* I - Right name */
2159 {
2160 OSStatus status; /* OS Status */
2161 AuthorizationItem authright; /* Authorization right */
2162 AuthorizationRights authrights; /* Authorization rights */
2163 AuthorizationFlags authflags; /* Authorization flags */
2164
2165
2166 /*
2167 * Check to see if the user is allowed to perform the task...
2168 */
2169
2170 if (!con->authref)
2171 return (0);
2172
2173 authright.name = right;
2174 authright.valueLength = 0;
2175 authright.value = NULL;
2176 authright.flags = 0;
2177
2178 authrights.count = 1;
2179 authrights.items = &authright;
2180
2181 authflags = kAuthorizationFlagDefaults |
2182 kAuthorizationFlagExtendRights;
2183
2184 if ((status = AuthorizationCopyRights(con->authref, &authrights,
2185 kAuthorizationEmptyEnvironment,
2186 authflags, NULL)) != 0)
2187 {
2188 cupsdLogMessage(CUPSD_LOG_ERROR, "AuthorizationCopyRights(\"%s\") returned %d", authright.name, (int)status);
2189 return (0);
2190 }
2191
2192 cupsdLogMessage(CUPSD_LOG_DEBUG2, "AuthorizationCopyRights(\"%s\") succeeded.", authright.name);
2193
2194 return (1);
2195 }
2196 #endif /* HAVE_AUTHORIZATION_H */
2197
2198
2199 /*
2200 * 'compare_locations()' - Compare two locations.
2201 */
2202
2203 static int /* O - Result of comparison */
compare_locations(cupsd_location_t * a,cupsd_location_t * b)2204 compare_locations(cupsd_location_t *a, /* I - First location */
2205 cupsd_location_t *b) /* I - Second location */
2206 {
2207 return (strcmp(b->location, a->location));
2208 }
2209
2210
2211 /*
2212 * 'copy_authmask()' - Copy function for auth masks.
2213 */
2214
2215 static cupsd_authmask_t * /* O - New auth mask */
copy_authmask(cupsd_authmask_t * mask,void * data)2216 copy_authmask(cupsd_authmask_t *mask, /* I - Existing auth mask */
2217 void *data) /* I - User data (unused) */
2218 {
2219 cupsd_authmask_t *temp; /* New auth mask */
2220
2221
2222 (void)data;
2223
2224 if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
2225 {
2226 memcpy(temp, mask, sizeof(cupsd_authmask_t));
2227
2228 if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
2229 {
2230 /*
2231 * Make a copy of the name...
2232 */
2233
2234 if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
2235 {
2236 /*
2237 * Failed to make copy...
2238 */
2239
2240 free(temp);
2241 temp = NULL;
2242 }
2243 }
2244 }
2245
2246 return (temp);
2247 }
2248
2249
2250 /*
2251 * 'free_authmask()' - Free function for auth masks.
2252 */
2253
2254 static void
free_authmask(cupsd_authmask_t * mask,void * data)2255 free_authmask(cupsd_authmask_t *mask, /* I - Auth mask to free */
2256 void *data) /* I - User data (unused) */
2257 {
2258 (void)data;
2259
2260 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2261 _cupsStrFree(mask->mask.name.name);
2262
2263 free(mask);
2264 }
2265
2266
2267 #if HAVE_LIBPAM
2268 /*
2269 * 'pam_func()' - PAM conversation function.
2270 */
2271
2272 static int /* O - Success or failure */
pam_func(int num_msg,const struct pam_message ** msg,struct pam_response ** resp,void * appdata_ptr)2273 pam_func(
2274 int num_msg, /* I - Number of messages */
2275 const struct pam_message **msg, /* I - Messages */
2276 struct pam_response **resp, /* O - Responses */
2277 void *appdata_ptr)
2278 /* I - Pointer to connection */
2279 {
2280 int i; /* Looping var */
2281 struct pam_response *replies; /* Replies */
2282 cupsd_authdata_t *data; /* Pointer to auth data */
2283
2284
2285 /*
2286 * Allocate memory for the responses...
2287 */
2288
2289 if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2290 return (PAM_CONV_ERR);
2291
2292 /*
2293 * Answer all of the messages...
2294 */
2295
2296 data = (cupsd_authdata_t *)appdata_ptr;
2297
2298 for (i = 0; i < num_msg; i ++)
2299 {
2300 switch (msg[i]->msg_style)
2301 {
2302 case PAM_PROMPT_ECHO_ON:
2303 replies[i].resp_retcode = PAM_SUCCESS;
2304 replies[i].resp = strdup(data->username);
2305 break;
2306
2307 case PAM_PROMPT_ECHO_OFF:
2308 replies[i].resp_retcode = PAM_SUCCESS;
2309 replies[i].resp = strdup(data->password);
2310 break;
2311
2312 case PAM_TEXT_INFO:
2313 replies[i].resp_retcode = PAM_SUCCESS;
2314 replies[i].resp = NULL;
2315 break;
2316
2317 case PAM_ERROR_MSG:
2318 replies[i].resp_retcode = PAM_SUCCESS;
2319 replies[i].resp = NULL;
2320 break;
2321
2322 default:
2323 free(replies);
2324 return (PAM_CONV_ERR);
2325 }
2326 }
2327
2328 /*
2329 * Return the responses back to PAM...
2330 */
2331
2332 *resp = replies;
2333
2334 return (PAM_SUCCESS);
2335 }
2336 #endif /* HAVE_LIBPAM */
2337