1 /*
2 * Authorization routines for the CUPS scheduler.
3 *
4 * Copyright © 2007-2019 by Apple Inc.
5 * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
6 *
7 * This file contains Kerberos support code, copyright 2006 by
8 * Jelmer Vernooij.
9 *
10 * Licensed under Apache License v2.0. See the file "LICENSE" for more
11 * information.
12 */
13
14 /*
15 * Include necessary headers...
16 */
17
18 #include "cupsd.h"
19 #include <grp.h>
20 #ifdef HAVE_SHADOW_H
21 # include <shadow.h>
22 #endif /* HAVE_SHADOW_H */
23 #ifdef HAVE_CRYPT_H
24 # include <crypt.h>
25 #endif /* HAVE_CRYPT_H */
26 #if HAVE_LIBPAM
27 # ifdef HAVE_PAM_PAM_APPL_H
28 # include <pam/pam_appl.h>
29 # else
30 # include <security/pam_appl.h>
31 # endif /* HAVE_PAM_PAM_APPL_H */
32 #endif /* HAVE_LIBPAM */
33 #ifdef HAVE_MEMBERSHIP_H
34 # include <membership.h>
35 #endif /* HAVE_MEMBERSHIP_H */
36 #ifdef HAVE_AUTHORIZATION_H
37 # include <Security/AuthorizationTags.h>
38 #endif /* HAVE_AUTHORIZATION_H */
39 #ifdef HAVE_SYS_PARAM_H
40 # include <sys/param.h>
41 #endif /* HAVE_SYS_PARAM_H */
42 #ifdef HAVE_SYS_UCRED_H
43 # include <sys/ucred.h>
44 typedef struct xucred cupsd_ucred_t;
45 # define CUPSD_UCRED_UID(c) (c).cr_uid
46 #else
47 # ifndef __OpenBSD__
48 typedef struct ucred cupsd_ucred_t;
49 # else
50 typedef struct sockpeercred cupsd_ucred_t;
51 # endif
52 # define CUPSD_UCRED_UID(c) (c).uid
53 #endif /* HAVE_SYS_UCRED_H */
54
55
56 /*
57 * Local functions...
58 */
59
60 #ifdef HAVE_AUTHORIZATION_H
61 static int check_authref(cupsd_client_t *con, const char *right);
62 #endif /* HAVE_AUTHORIZATION_H */
63 static int compare_locations(cupsd_location_t *a,
64 cupsd_location_t *b);
65 static cupsd_authmask_t *copy_authmask(cupsd_authmask_t *am, void *data);
66 static void free_authmask(cupsd_authmask_t *am, void *data);
67 #if HAVE_LIBPAM
68 static int pam_func(int, const struct pam_message **,
69 struct pam_response **, void *);
70 #endif /* HAVE_LIBPAM */
71
72
73 /*
74 * Local structures...
75 */
76
77 #if HAVE_LIBPAM
78 typedef struct cupsd_authdata_s /**** Authentication data ****/
79 {
80 char username[HTTP_MAX_VALUE], /* Username string */
81 password[HTTP_MAX_VALUE]; /* Password string */
82 } cupsd_authdata_t;
83 #endif /* HAVE_LIBPAM */
84
85
86 /*
87 * 'cupsdAddIPMask()' - Add an IP address authorization mask.
88 */
89
90 int /* O - 1 on success, 0 on failure */
cupsdAddIPMask(cups_array_t ** masks,const unsigned address[4],const unsigned netmask[4])91 cupsdAddIPMask(
92 cups_array_t **masks, /* IO - Masks array (created as needed) */
93 const unsigned address[4], /* I - IP address */
94 const unsigned netmask[4]) /* I - IP netmask */
95 {
96 cupsd_authmask_t temp; /* New host/domain mask */
97
98
99 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddIPMask(masks=%p(%p), address=%x:%x:%x:%x, netmask=%x:%x:%x:%x)", masks, *masks, address[0], address[1], address[2], address[3], netmask[0], netmask[1], netmask[2], netmask[3]);
100
101 temp.type = CUPSD_AUTH_IP;
102 memcpy(temp.mask.ip.address, address, sizeof(temp.mask.ip.address));
103 memcpy(temp.mask.ip.netmask, netmask, sizeof(temp.mask.ip.netmask));
104
105 /*
106 * Create the masks array as needed and add...
107 */
108
109 if (!*masks)
110 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
111 (cups_acopy_func_t)copy_authmask,
112 (cups_afree_func_t)free_authmask);
113
114 return (cupsArrayAdd(*masks, &temp));
115 }
116
117
118 /*
119 * 'cupsdAddLocation()' - Add a location for authorization.
120 */
121
122 void
cupsdAddLocation(cupsd_location_t * loc)123 cupsdAddLocation(cupsd_location_t *loc) /* I - Location to add */
124 {
125 /*
126 * Make sure the locations array is created...
127 */
128
129 if (!Locations)
130 Locations = cupsArrayNew3((cups_array_func_t)compare_locations, NULL,
131 (cups_ahash_func_t)NULL, 0,
132 (cups_acopy_func_t)NULL,
133 (cups_afree_func_t)cupsdFreeLocation);
134
135 if (Locations)
136 {
137 cupsArrayAdd(Locations, loc);
138
139 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddLocation: Added location \"%s\"", loc->location ? loc->location : "(null)");
140 }
141 }
142
143
144 /*
145 * 'cupsdAddName()' - Add a name to a location...
146 */
147
148 void
cupsdAddName(cupsd_location_t * loc,char * name)149 cupsdAddName(cupsd_location_t *loc, /* I - Location to add to */
150 char *name) /* I - Name to add */
151 {
152 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddName(loc=%p, name=\"%s\")", loc, name);
153
154 if (!loc->names)
155 loc->names = cupsArrayNew3(NULL, NULL, NULL, 0,
156 (cups_acopy_func_t)_cupsStrAlloc,
157 (cups_afree_func_t)_cupsStrFree);
158
159 if (!cupsArrayAdd(loc->names, name))
160 {
161 cupsdLogMessage(CUPSD_LOG_ERROR,
162 "Unable to duplicate name for location %s: %s",
163 loc->location ? loc->location : "nil", strerror(errno));
164 return;
165 }
166 }
167
168
169 /*
170 * 'cupsdAddNameMask()' - Add a host or interface name authorization mask.
171 */
172
173 int /* O - 1 on success, 0 on failure */
cupsdAddNameMask(cups_array_t ** masks,char * name)174 cupsdAddNameMask(cups_array_t **masks, /* IO - Masks array (created as needed) */
175 char *name) /* I - Host or interface name */
176 {
177 cupsd_authmask_t temp; /* New host/domain mask */
178 char ifname[32], /* Interface name */
179 *ifptr; /* Pointer to end of name */
180
181
182 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdAddNameMask(masks=%p(%p), name=\"%s\")", masks, *masks, name);
183
184 if (!_cups_strcasecmp(name, "@LOCAL"))
185 {
186 /*
187 * Deny *interface*...
188 */
189
190 temp.type = CUPSD_AUTH_INTERFACE;
191 temp.mask.name.name = (char *)"*";
192 }
193 else if (!_cups_strncasecmp(name, "@IF(", 4))
194 {
195 /*
196 * Deny *interface*...
197 */
198
199 strlcpy(ifname, name + 4, sizeof(ifname));
200
201 ifptr = ifname + strlen(ifname) - 1;
202
203 if (ifptr >= ifname && *ifptr == ')')
204 {
205 ifptr --;
206 *ifptr = '\0';
207 }
208
209 temp.type = CUPSD_AUTH_INTERFACE;
210 temp.mask.name.name = ifname;
211 }
212 else
213 {
214 /*
215 * Deny name...
216 */
217
218 if (*name == '*')
219 name ++;
220
221 temp.type = CUPSD_AUTH_NAME;
222 temp.mask.name.name = (char *)name;
223 }
224
225 /*
226 * Set the name length...
227 */
228
229 temp.mask.name.length = strlen(temp.mask.name.name);
230
231 /*
232 * Create the masks array as needed and add...
233 */
234
235 if (!*masks)
236 *masks = cupsArrayNew3(NULL, NULL, NULL, 0,
237 (cups_acopy_func_t)copy_authmask,
238 (cups_afree_func_t)free_authmask);
239
240 return (cupsArrayAdd(*masks, &temp));
241 }
242
243
244 /*
245 * 'cupsdAuthorize()' - Validate any authorization credentials.
246 */
247
248 void
cupsdAuthorize(cupsd_client_t * con)249 cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
250 {
251 int type; /* Authentication type */
252 const char *authorization; /* Pointer into Authorization string */
253 char *ptr, /* Pointer into string */
254 username[HTTP_MAX_VALUE],
255 /* Username string */
256 password[HTTP_MAX_VALUE];
257 /* Password string */
258 cupsd_cert_t *localuser; /* Certificate username */
259
260
261 /*
262 * Locate the best matching location so we know what kind of
263 * authentication to expect...
264 */
265
266 con->best = cupsdFindBest(con->uri, httpGetState(con->http));
267 con->type = CUPSD_AUTH_NONE;
268
269 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location : "");
270
271 if (con->best && con->best->type != CUPSD_AUTH_NONE)
272 {
273 if (con->best->type == CUPSD_AUTH_DEFAULT)
274 type = cupsdDefaultAuthType();
275 else
276 type = con->best->type;
277 }
278 else
279 type = cupsdDefaultAuthType();
280
281 /*
282 * Decode the Authorization string...
283 */
284
285 authorization = httpGetField(con->http, HTTP_FIELD_AUTHORIZATION);
286
287 username[0] = '\0';
288 password[0] = '\0';
289
290 #ifdef HAVE_GSSAPI
291 con->gss_uid = 0;
292 #endif /* HAVE_GSSAPI */
293
294 #ifdef HAVE_AUTHORIZATION_H
295 if (con->authref)
296 {
297 AuthorizationFree(con->authref, kAuthorizationFlagDefaults);
298 con->authref = NULL;
299 }
300 #endif /* HAVE_AUTHORIZATION_H */
301
302 if (!*authorization)
303 {
304 /*
305 * No authorization data provided, return early...
306 */
307
308 cupsdLogClient(con, CUPSD_LOG_DEBUG, "No authentication data provided.");
309 return;
310 }
311 #ifdef HAVE_AUTHORIZATION_H
312 else if (!strncmp(authorization, "AuthRef ", 8) &&
313 httpAddrLocalhost(httpGetAddress(con->http)))
314 {
315 OSStatus status; /* Status */
316 char authdata[HTTP_MAX_VALUE];
317 /* Nonce value from client */
318 int authlen; /* Auth string length */
319 AuthorizationItemSet *authinfo; /* Authorization item set */
320
321 /*
322 * Get the Authorization Services data...
323 */
324
325 authorization += 8;
326 while (isspace(*authorization & 255))
327 authorization ++;
328
329 authlen = sizeof(authdata);
330 httpDecode64_2(authdata, &authlen, authorization);
331
332 if (authlen != kAuthorizationExternalFormLength)
333 {
334 cupsdLogClient(con, CUPSD_LOG_ERROR, "External Authorization reference size is incorrect.");
335 return;
336 }
337
338 if ((status = AuthorizationCreateFromExternalForm((AuthorizationExternalForm *)authdata, &con->authref)) != 0)
339 {
340 cupsdLogClient(con, CUPSD_LOG_ERROR, "AuthorizationCreateFromExternalForm returned %d", (int)status);
341 return;
342 }
343
344 username[0] = '\0';
345
346 if (!AuthorizationCopyInfo(con->authref, kAuthorizationEnvironmentUsername,
347 &authinfo))
348 {
349 if (authinfo->count == 1 && authinfo->items[0].value &&
350 authinfo->items[0].valueLength >= 2)
351 {
352 strlcpy(username, authinfo->items[0].value, sizeof(username));
353
354 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef.", username);
355 }
356
357 AuthorizationFreeItemSet(authinfo);
358 }
359
360 if (!username[0])
361 {
362 /*
363 * No username in AuthRef, grab username using peer credentials...
364 */
365
366 struct passwd *pwd; /* Password entry for this user */
367 cupsd_ucred_t peercred; /* Peer credentials */
368 socklen_t peersize; /* Size of peer credentials */
369
370 peersize = sizeof(peercred);
371
372 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
373 {
374 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
375 return;
376 }
377
378 if ((pwd = getpwuid(CUPSD_UCRED_UID(peercred))) == NULL)
379 {
380 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to find UID %d for peer credentials.", (int)CUPSD_UCRED_UID(peercred));
381 return;
382 }
383
384 strlcpy(username, pwd->pw_name, sizeof(username));
385
386 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using AuthRef + PeerCred.", username);
387 }
388
389 con->type = CUPSD_AUTH_BASIC;
390 }
391 #endif /* HAVE_AUTHORIZATION_H */
392 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
393 else if (!strncmp(authorization, "PeerCred ", 9) &&
394 con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
395 {
396 /*
397 * Use peer credentials from domain socket connection...
398 */
399
400 struct passwd *pwd; /* Password entry for this user */
401 cupsd_ucred_t peercred; /* Peer credentials */
402 socklen_t peersize; /* Size of peer credentials */
403 #ifdef HAVE_AUTHORIZATION_H
404 const char *name; /* Authorizing name */
405 int no_peer = 0; /* Don't allow peer credentials? */
406
407 /*
408 * See if we should allow peer credentials...
409 */
410
411 for (name = (char *)cupsArrayFirst(con->best->names);
412 name;
413 name = (char *)cupsArrayNext(con->best->names))
414 {
415 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) ||
416 !_cups_strcasecmp(name, "@SYSTEM"))
417 {
418 /* Normally don't want peer credentials if we need an auth key... */
419 no_peer = 1;
420 }
421 else if (!_cups_strcasecmp(name, "@OWNER"))
422 {
423 /* but if @OWNER is present then we allow it... */
424 no_peer = 0;
425 break;
426 }
427 }
428
429 if (no_peer)
430 {
431 cupsdLogClient(con, CUPSD_LOG_ERROR, "PeerCred authentication not allowed for resource per AUTHKEY policy.");
432 return;
433 }
434 #endif /* HAVE_AUTHORIZATION_H */
435
436 if ((pwd = getpwnam(authorization + 9)) == NULL)
437 {
438 cupsdLogClient(con, CUPSD_LOG_ERROR, "User \"%s\" does not exist.", authorization + 9);
439 return;
440 }
441
442 peersize = sizeof(peercred);
443
444 # ifdef __APPLE__
445 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
446 # else
447 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred, &peersize))
448 # endif /* __APPLE__ */
449 {
450 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
451 return;
452 }
453
454 if (pwd->pw_uid != CUPSD_UCRED_UID(peercred))
455 {
456 cupsdLogClient(con, CUPSD_LOG_ERROR, "Invalid peer credentials for \"%s\" - got %d, expected %d.", authorization + 9, CUPSD_UCRED_UID(peercred), pwd->pw_uid);
457 # ifdef HAVE_SYS_UCRED_H
458 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_version=%d", peercred.cr_version);
459 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_uid=%d", peercred.cr_uid);
460 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_ngroups=%d", peercred.cr_ngroups);
461 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cr_groups[0]=%d", peercred.cr_groups[0]);
462 # endif /* HAVE_SYS_UCRED_H */
463 return;
464 }
465
466 strlcpy(username, authorization + 9, sizeof(username));
467
468 # ifdef HAVE_GSSAPI
469 con->gss_uid = CUPSD_UCRED_UID(peercred);
470 # endif /* HAVE_GSSAPI */
471
472 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using PeerCred.", username);
473
474 con->type = CUPSD_AUTH_BASIC;
475 }
476 #endif /* SO_PEERCRED && AF_LOCAL */
477 else if (!strncmp(authorization, "Local", 5) &&
478 httpAddrLocalhost(httpGetAddress(con->http)))
479 {
480 /*
481 * Get Local certificate authentication data...
482 */
483
484 authorization += 5;
485 while (isspace(*authorization & 255))
486 authorization ++;
487
488 if ((localuser = cupsdFindCert(authorization)) == NULL)
489 {
490 cupsdLogClient(con, CUPSD_LOG_ERROR, "Local authentication certificate not found.");
491 return;
492 }
493
494 strlcpy(username, localuser->username, sizeof(username));
495 con->type = localuser->type;
496
497 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as %s using Local.", username);
498 }
499 else if (!strncmp(authorization, "Basic", 5))
500 {
501 /*
502 * Get the Basic authentication data...
503 */
504
505 int userlen; /* Username:password length */
506
507
508 authorization += 5;
509 while (isspace(*authorization & 255))
510 authorization ++;
511
512 userlen = sizeof(username);
513 httpDecode64_2(username, &userlen, authorization);
514
515 /*
516 * Pull the username and password out...
517 */
518
519 if ((ptr = strchr(username, ':')) == NULL)
520 {
521 cupsdLogClient(con, CUPSD_LOG_ERROR, "Missing Basic password.");
522 return;
523 }
524
525 *ptr++ = '\0';
526
527 if (!username[0])
528 {
529 /*
530 * Username must not be empty...
531 */
532
533 cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic username.");
534 return;
535 }
536
537 if (!*ptr)
538 {
539 /*
540 * Password must not be empty...
541 */
542
543 cupsdLogClient(con, CUPSD_LOG_ERROR, "Empty Basic password.");
544 return;
545 }
546
547 strlcpy(password, ptr, sizeof(password));
548
549 /*
550 * Validate the username and password...
551 */
552
553 switch (type)
554 {
555 default :
556 case CUPSD_AUTH_BASIC :
557 {
558 #if HAVE_LIBPAM
559 /*
560 * Only use PAM to do authentication. This supports MD5
561 * passwords, among other things...
562 */
563
564 pam_handle_t *pamh; /* PAM authentication handle */
565 int pamerr; /* PAM error code */
566 struct pam_conv pamdata;/* PAM conversation data */
567 cupsd_authdata_t data; /* Authentication data */
568
569
570 strlcpy(data.username, username, sizeof(data.username));
571 strlcpy(data.password, password, sizeof(data.password));
572
573 # ifdef __sun
574 pamdata.conv = (int (*)(int, struct pam_message **,
575 struct pam_response **,
576 void *))pam_func;
577 # else
578 pamdata.conv = pam_func;
579 # endif /* __sun */
580 pamdata.appdata_ptr = &data;
581
582 pamerr = pam_start("cups", username, &pamdata, &pamh);
583 if (pamerr != PAM_SUCCESS)
584 {
585 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_start() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
586 return;
587 }
588
589 # ifdef HAVE_PAM_SET_ITEM
590 # ifdef PAM_RHOST
591 pamerr = pam_set_item(pamh, PAM_RHOST, con->http->hostname);
592 if (pamerr != PAM_SUCCESS)
593 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_RHOST) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
594 # endif /* PAM_RHOST */
595
596 # ifdef PAM_TTY
597 pamerr = pam_set_item(pamh, PAM_TTY, "cups");
598 if (pamerr != PAM_SUCCESS)
599 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_set_item(PAM_TTY) returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
600 # endif /* PAM_TTY */
601 # endif /* HAVE_PAM_SET_ITEM */
602
603 pamerr = pam_authenticate(pamh, PAM_SILENT);
604 if (pamerr != PAM_SUCCESS)
605 {
606 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_authenticate() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
607 pam_end(pamh, 0);
608 return;
609 }
610
611 # ifdef HAVE_PAM_SETCRED
612 pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
613 if (pamerr != PAM_SUCCESS)
614 cupsdLogClient(con, CUPSD_LOG_WARN, "pam_setcred() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
615 # endif /* HAVE_PAM_SETCRED */
616
617 pamerr = pam_acct_mgmt(pamh, PAM_SILENT);
618 if (pamerr != PAM_SUCCESS)
619 {
620 cupsdLogClient(con, CUPSD_LOG_ERROR, "pam_acct_mgmt() returned %d (%s)", pamerr, pam_strerror(pamh, pamerr));
621 pam_end(pamh, 0);
622 return;
623 }
624
625 pam_end(pamh, PAM_SUCCESS);
626
627 #else
628 /*
629 * Use normal UNIX password file-based authentication...
630 */
631
632 char *pass; /* Encrypted password */
633 struct passwd *pw; /* User password data */
634 # ifdef HAVE_SHADOW_H
635 struct spwd *spw; /* Shadow password data */
636 # endif /* HAVE_SHADOW_H */
637
638
639 pw = getpwnam(username); /* Get the current password */
640 endpwent(); /* Close the password file */
641
642 if (!pw)
643 {
644 /*
645 * No such user...
646 */
647
648 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unknown username \"%s\".", username);
649 return;
650 }
651
652 # ifdef HAVE_SHADOW_H
653 spw = getspnam(username);
654 endspent();
655
656 if (!spw && !strcmp(pw->pw_passwd, "x"))
657 {
658 /*
659 * Don't allow blank passwords!
660 */
661
662 cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no shadow password.", username);
663 return;
664 }
665
666 if (spw && !spw->sp_pwdp[0] && !pw->pw_passwd[0])
667 # else
668 if (!pw->pw_passwd[0])
669 # endif /* HAVE_SHADOW_H */
670 {
671 /*
672 * Don't allow blank passwords!
673 */
674
675 cupsdLogClient(con, CUPSD_LOG_ERROR, "Username \"%s\" has no password.", username);
676 return;
677 }
678
679 /*
680 * OK, the password isn't blank, so compare with what came from the
681 * client...
682 */
683
684 pass = crypt(password, pw->pw_passwd);
685
686 if (!pass || strcmp(pw->pw_passwd, pass))
687 {
688 # ifdef HAVE_SHADOW_H
689 if (spw)
690 {
691 pass = crypt(password, spw->sp_pwdp);
692
693 if (pass == NULL || strcmp(spw->sp_pwdp, pass))
694 {
695 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
696 return;
697 }
698 }
699 else
700 # endif /* HAVE_SHADOW_H */
701 {
702 cupsdLogClient(con, CUPSD_LOG_ERROR, "Authentication failed for user \"%s\".", username);
703 return;
704 }
705 }
706 #endif /* HAVE_LIBPAM */
707 }
708
709 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
710 break;
711 }
712
713 con->type = type;
714 }
715 #ifdef HAVE_GSSAPI
716 else if (!strncmp(authorization, "Negotiate", 9))
717 {
718 int len; /* Length of authorization string */
719 gss_ctx_id_t context; /* Authorization context */
720 OM_uint32 major_status, /* Major status code */
721 minor_status; /* Minor status code */
722 gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER,
723 /* Input token from string */
724 output_token = GSS_C_EMPTY_BUFFER;
725 /* Output token for username */
726 gss_name_t client_name; /* Client name */
727
728
729 # ifdef __APPLE__
730 /*
731 * If the weak-linked GSSAPI/Kerberos library is not present, don't try
732 * to use it...
733 */
734
735 if (&gss_init_sec_context == NULL)
736 {
737 cupsdLogClient(con, CUPSD_LOG_WARN, "GSSAPI/Kerberos authentication failed because the Kerberos framework is not present.");
738 return;
739 }
740 # endif /* __APPLE__ */
741
742 /*
743 * Find the start of the Kerberos input token...
744 */
745
746 authorization += 9;
747 while (isspace(*authorization & 255))
748 authorization ++;
749
750 if (!*authorization)
751 {
752 cupsdLogClient(con, CUPSD_LOG_DEBUG2, "No authentication data specified.");
753 return;
754 }
755
756 /*
757 * Decode the authorization string to get the input token...
758 */
759
760 len = (int)strlen(authorization) + 0;
761 input_token.value = malloc((size_t)len);
762 input_token.value = httpDecode64_2(input_token.value, &len,
763 authorization);
764 input_token.length = (size_t)len;
765
766 /*
767 * Accept the input token to get the authorization info...
768 */
769
770 context = GSS_C_NO_CONTEXT;
771 client_name = GSS_C_NO_NAME;
772 major_status = gss_accept_sec_context(&minor_status,
773 &context,
774 ServerCreds,
775 &input_token,
776 GSS_C_NO_CHANNEL_BINDINGS,
777 &client_name,
778 NULL,
779 &output_token,
780 NULL,
781 NULL,
782 NULL);
783
784 if (output_token.length > 0)
785 gss_release_buffer(&minor_status, &output_token);
786
787 if (GSS_ERROR(major_status))
788 {
789 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error accepting GSSAPI security context.", con->number);
790
791 if (context != GSS_C_NO_CONTEXT)
792 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
793 return;
794 }
795
796 con->have_gss = 1;
797
798 /*
799 * Get the username associated with the client's credentials...
800 */
801
802 if (major_status == GSS_S_CONTINUE_NEEDED)
803 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Credentials not complete.", con->number);
804 else if (major_status == GSS_S_COMPLETE)
805 {
806 major_status = gss_display_name(&minor_status, client_name,
807 &output_token, NULL);
808
809 if (GSS_ERROR(major_status))
810 {
811 cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status, "[Client %d] Error getting username.", con->number);
812 gss_release_name(&minor_status, &client_name);
813 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
814 return;
815 }
816
817 strlcpy(username, output_token.value, sizeof(username));
818
819 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Negotiate.", username);
820
821 gss_release_name(&minor_status, &client_name);
822 gss_release_buffer(&minor_status, &output_token);
823
824 con->type = CUPSD_AUTH_NEGOTIATE;
825 }
826
827 gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER);
828
829 # if defined(SO_PEERCRED) && defined(AF_LOCAL)
830 /*
831 * Get the client's UID if we are printing locally - that allows a backend
832 * to run as the correct user to get Kerberos credentials of its own.
833 */
834
835 if (httpAddrFamily(con->http->hostaddr) == AF_LOCAL)
836 {
837 cupsd_ucred_t peercred; /* Peer credentials */
838 socklen_t peersize; /* Size of peer credentials */
839
840 peersize = sizeof(peercred);
841
842 # ifdef __APPLE__
843 if (getsockopt(httpGetFd(con->http), 0, LOCAL_PEERCRED, &peercred, &peersize))
844 # else
845 if (getsockopt(httpGetFd(con->http), SOL_SOCKET, SO_PEERCRED, &peercred,
846 &peersize))
847 # endif /* __APPLE__ */
848 {
849 cupsdLogClient(con, CUPSD_LOG_ERROR, "Unable to get peer credentials - %s", strerror(errno));
850 }
851 else
852 {
853 cupsdLogClient(con, CUPSD_LOG_DEBUG, "Using credentials for UID %d.", CUPSD_UCRED_UID(peercred));
854 con->gss_uid = CUPSD_UCRED_UID(peercred);
855 }
856 }
857 # endif /* SO_PEERCRED && AF_LOCAL */
858 }
859 #endif /* HAVE_GSSAPI */
860 else
861 {
862 char scheme[256]; /* Auth scheme... */
863
864
865 if (sscanf(authorization, "%255s", scheme) != 1)
866 strlcpy(scheme, "UNKNOWN", sizeof(scheme));
867
868 cupsdLogClient(con, CUPSD_LOG_ERROR, "Bad authentication data \"%s ...\".", scheme);
869 return;
870 }
871
872 /*
873 * If we get here, then we were able to validate the username and
874 * password - copy the validated username and password to the client
875 * data and return...
876 */
877
878 strlcpy(con->username, username, sizeof(con->username));
879 strlcpy(con->password, password, sizeof(con->password));
880 }
881
882
883 /*
884 * 'cupsdCheckAccess()' - Check whether the given address is allowed to
885 * access a location.
886 */
887
888 int /* O - 1 if allowed, 0 otherwise */
cupsdCheckAccess(unsigned ip[4],const char * name,size_t namelen,cupsd_location_t * loc)889 cupsdCheckAccess(
890 unsigned ip[4], /* I - Client address */
891 const char *name, /* I - Client hostname */
892 size_t namelen, /* I - Length of hostname */
893 cupsd_location_t *loc) /* I - Location to check */
894 {
895 int allow; /* 1 if allowed, 0 otherwise */
896
897
898 if (!_cups_strcasecmp(name, "localhost"))
899 {
900 /*
901 * Access from localhost (127.0.0.1 or ::1) is always allowed...
902 */
903
904 return (1);
905 }
906 else
907 {
908 /*
909 * Do authorization checks on the domain/address...
910 */
911
912 switch (loc->order_type)
913 {
914 default :
915 allow = 0; /* anti-compiler-warning-code */
916 break;
917
918 case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
919 allow = 1;
920
921 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
922 allow = 0;
923
924 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
925 allow = 1;
926 break;
927
928 case CUPSD_AUTH_DENY : /* Order Allow,Deny */
929 allow = 0;
930
931 if (cupsdCheckAuth(ip, name, namelen, loc->allow))
932 allow = 1;
933
934 if (cupsdCheckAuth(ip, name, namelen, loc->deny))
935 allow = 0;
936 break;
937 }
938 }
939
940 return (allow);
941 }
942
943
944 /*
945 * 'cupsdCheckAuth()' - Check authorization masks.
946 */
947
948 int /* O - 1 if mask matches, 0 otherwise */
cupsdCheckAuth(unsigned ip[4],const char * name,size_t name_len,cups_array_t * masks)949 cupsdCheckAuth(unsigned ip[4], /* I - Client address */
950 const char *name, /* I - Client hostname */
951 size_t name_len, /* I - Length of hostname */
952 cups_array_t *masks) /* I - Masks */
953 {
954 int i; /* Looping var */
955 cupsd_authmask_t *mask; /* Current mask */
956 cupsd_netif_t *iface; /* Network interface */
957 unsigned netip4; /* IPv4 network address */
958 #ifdef AF_INET6
959 unsigned netip6[4]; /* IPv6 network address */
960 #endif /* AF_INET6 */
961
962
963 for (mask = (cupsd_authmask_t *)cupsArrayFirst(masks);
964 mask;
965 mask = (cupsd_authmask_t *)cupsArrayNext(masks))
966 {
967 switch (mask->type)
968 {
969 case CUPSD_AUTH_INTERFACE :
970 /*
971 * Check for a match with a network interface...
972 */
973
974 netip4 = htonl(ip[3]);
975
976 #ifdef AF_INET6
977 netip6[0] = htonl(ip[0]);
978 netip6[1] = htonl(ip[1]);
979 netip6[2] = htonl(ip[2]);
980 netip6[3] = htonl(ip[3]);
981 #endif /* AF_INET6 */
982
983 cupsdNetIFUpdate();
984
985 if (!strcmp(mask->mask.name.name, "*"))
986 {
987 #ifdef __APPLE__
988 /*
989 * Allow Back-to-My-Mac addresses...
990 */
991
992 if ((ip[0] & 0xff000000) == 0xfd000000)
993 return (1);
994 #endif /* __APPLE__ */
995
996 /*
997 * Check against all local interfaces...
998 */
999
1000 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1001 iface;
1002 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1003 {
1004 /*
1005 * Only check local interfaces...
1006 */
1007
1008 if (!iface->is_local)
1009 continue;
1010
1011 if (iface->address.addr.sa_family == AF_INET)
1012 {
1013 /*
1014 * Check IPv4 address...
1015 */
1016
1017 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1018 (iface->address.ipv4.sin_addr.s_addr &
1019 iface->mask.ipv4.sin_addr.s_addr))
1020 return (1);
1021 }
1022 #ifdef AF_INET6
1023 else
1024 {
1025 /*
1026 * Check IPv6 address...
1027 */
1028
1029 for (i = 0; i < 4; i ++)
1030 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1031 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1032 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1033 break;
1034
1035 if (i == 4)
1036 return (1);
1037 }
1038 #endif /* AF_INET6 */
1039 }
1040 }
1041 else
1042 {
1043 /*
1044 * Check the named interface...
1045 */
1046
1047 for (iface = (cupsd_netif_t *)cupsArrayFirst(NetIFList);
1048 iface;
1049 iface = (cupsd_netif_t *)cupsArrayNext(NetIFList))
1050 {
1051 if (strcmp(mask->mask.name.name, iface->name))
1052 continue;
1053
1054 if (iface->address.addr.sa_family == AF_INET)
1055 {
1056 /*
1057 * Check IPv4 address...
1058 */
1059
1060 if ((netip4 & iface->mask.ipv4.sin_addr.s_addr) ==
1061 (iface->address.ipv4.sin_addr.s_addr &
1062 iface->mask.ipv4.sin_addr.s_addr))
1063 return (1);
1064 }
1065 #ifdef AF_INET6
1066 else
1067 {
1068 /*
1069 * Check IPv6 address...
1070 */
1071
1072 for (i = 0; i < 4; i ++)
1073 if ((netip6[i] & iface->mask.ipv6.sin6_addr.s6_addr32[i]) !=
1074 (iface->address.ipv6.sin6_addr.s6_addr32[i] &
1075 iface->mask.ipv6.sin6_addr.s6_addr32[i]))
1076 break;
1077
1078 if (i == 4)
1079 return (1);
1080 }
1081 #endif /* AF_INET6 */
1082 }
1083 }
1084 break;
1085
1086 case CUPSD_AUTH_NAME :
1087 /*
1088 * Check for exact name match...
1089 */
1090
1091 if (!_cups_strcasecmp(name, mask->mask.name.name))
1092 return (1);
1093
1094 /*
1095 * Check for domain match...
1096 */
1097
1098 if (name_len >= mask->mask.name.length &&
1099 mask->mask.name.name[0] == '.' &&
1100 !_cups_strcasecmp(name + name_len - mask->mask.name.length,
1101 mask->mask.name.name))
1102 return (1);
1103 break;
1104
1105 case CUPSD_AUTH_IP :
1106 /*
1107 * Check for IP/network address match...
1108 */
1109
1110 for (i = 0; i < 4; i ++)
1111 if ((ip[i] & mask->mask.ip.netmask[i]) !=
1112 mask->mask.ip.address[i])
1113 break;
1114
1115 if (i == 4)
1116 return (1);
1117 break;
1118 }
1119 }
1120
1121 return (0);
1122 }
1123
1124
1125 /*
1126 * 'cupsdCheckGroup()' - Check for a user's group membership.
1127 */
1128
1129 int /* O - 1 if user is a member, 0 otherwise */
cupsdCheckGroup(const char * username,struct passwd * user,const char * groupname)1130 cupsdCheckGroup(
1131 const char *username, /* I - User name */
1132 struct passwd *user, /* I - System user info */
1133 const char *groupname) /* I - Group name */
1134 {
1135 int i; /* Looping var */
1136 struct group *group; /* Group info */
1137 gid_t groupid; /* ID of named group */
1138 #ifdef HAVE_MBR_UID_TO_UUID
1139 uuid_t useruuid, /* UUID for username */
1140 groupuuid; /* UUID for groupname */
1141 int is_member; /* True if user is a member of group */
1142 #endif /* HAVE_MBR_UID_TO_UUID */
1143
1144
1145 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCheckGroup(username=\"%s\", user=%p, groupname=\"%s\")", username, user, groupname);
1146
1147 /*
1148 * Validate input...
1149 */
1150
1151 if (!username || !groupname)
1152 return (0);
1153
1154 /*
1155 * Check to see if the user is a member of the named group...
1156 */
1157
1158 group = getgrnam(groupname);
1159 endgrent();
1160
1161 if (group != NULL)
1162 {
1163 /*
1164 * Group exists, check it...
1165 */
1166
1167 groupid = group->gr_gid;
1168
1169 for (i = 0; group->gr_mem[i]; i ++)
1170 {
1171 /*
1172 * User appears in the group membership...
1173 */
1174
1175 if (!_cups_strcasecmp(username, group->gr_mem[i]))
1176 return (1);
1177 }
1178
1179 #ifdef HAVE_GETGROUPLIST
1180 /*
1181 * If the user isn't in the group membership list, try the results from
1182 * getgrouplist() which is supposed to return the full list of groups a user
1183 * belongs to...
1184 */
1185
1186 if (user)
1187 {
1188 int ngroups; /* Number of groups */
1189 # ifdef __APPLE__
1190 int groups[2048]; /* Groups that user belongs to */
1191 # else
1192 gid_t groups[2048]; /* Groups that user belongs to */
1193 # endif /* __APPLE__ */
1194
1195 ngroups = (int)(sizeof(groups) / sizeof(groups[0]));
1196 # ifdef __APPLE__
1197 getgrouplist(username, (int)user->pw_gid, groups, &ngroups);
1198 # else
1199 getgrouplist(username, user->pw_gid, groups, &ngroups);
1200 #endif /* __APPLE__ */
1201
1202 for (i = 0; i < ngroups; i ++)
1203 if ((int)groupid == (int)groups[i])
1204 return (1);
1205 }
1206 #endif /* HAVE_GETGROUPLIST */
1207 }
1208 else
1209 groupid = (gid_t)-1;
1210
1211 /*
1212 * Group doesn't exist or user not in group list, check the group ID
1213 * against the user's group ID...
1214 */
1215
1216 if (user && groupid == user->pw_gid)
1217 return (1);
1218
1219 #ifdef HAVE_MBR_UID_TO_UUID
1220 /*
1221 * Check group membership through macOS membership API...
1222 */
1223
1224 if (user && !mbr_uid_to_uuid(user->pw_uid, useruuid))
1225 {
1226 if (groupid != (gid_t)-1)
1227 {
1228 /*
1229 * Map group name to UUID and check membership...
1230 */
1231
1232 if (!mbr_gid_to_uuid(groupid, groupuuid))
1233 if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1234 if (is_member)
1235 return (1);
1236 }
1237 else if (groupname[0] == '#')
1238 {
1239 /*
1240 * Use UUID directly and check for equality (user UUID) and
1241 * membership (group UUID)...
1242 */
1243
1244 if (!uuid_parse((char *)groupname + 1, groupuuid))
1245 {
1246 if (!uuid_compare(useruuid, groupuuid))
1247 return (1);
1248 else if (!mbr_check_membership(useruuid, groupuuid, &is_member))
1249 if (is_member)
1250 return (1);
1251 }
1252
1253 return (0);
1254 }
1255 }
1256 else if (groupname[0] == '#')
1257 return (0);
1258 #endif /* HAVE_MBR_UID_TO_UUID */
1259
1260 /*
1261 * If we get this far, then the user isn't part of the named group...
1262 */
1263
1264 return (0);
1265 }
1266
1267
1268 /*
1269 * 'cupsdCopyLocation()' - Make a copy of a location...
1270 */
1271
1272 cupsd_location_t * /* O - New location */
cupsdCopyLocation(cupsd_location_t * loc)1273 cupsdCopyLocation(
1274 cupsd_location_t *loc) /* I - Original location */
1275 {
1276 cupsd_location_t *temp; /* New location */
1277
1278
1279 /*
1280 * Make a copy of the original location...
1281 */
1282
1283 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1284 return (NULL);
1285
1286 /*
1287 * Copy the information from the original location to the new one.
1288 */
1289
1290 if (!loc)
1291 return (temp);
1292
1293 if (loc->location)
1294 temp->location = _cupsStrAlloc(loc->location);
1295
1296 temp->length = loc->length;
1297 temp->limit = loc->limit;
1298 temp->order_type = loc->order_type;
1299 temp->type = loc->type;
1300 temp->level = loc->level;
1301 temp->satisfy = loc->satisfy;
1302 temp->encryption = loc->encryption;
1303
1304 if (loc->names)
1305 {
1306 if ((temp->names = cupsArrayDup(loc->names)) == NULL)
1307 {
1308 cupsdLogMessage(CUPSD_LOG_ERROR,
1309 "Unable to allocate memory for %d names: %s",
1310 cupsArrayCount(loc->names), strerror(errno));
1311
1312 cupsdFreeLocation(temp);
1313 return (NULL);
1314 }
1315 }
1316
1317 if (loc->allow)
1318 {
1319 /*
1320 * Copy allow rules...
1321 */
1322
1323 if ((temp->allow = cupsArrayDup(loc->allow)) == NULL)
1324 {
1325 cupsdLogMessage(CUPSD_LOG_ERROR,
1326 "Unable to allocate memory for %d allow rules: %s",
1327 cupsArrayCount(loc->allow), strerror(errno));
1328 cupsdFreeLocation(temp);
1329 return (NULL);
1330 }
1331 }
1332
1333 if (loc->deny)
1334 {
1335 /*
1336 * Copy deny rules...
1337 */
1338
1339 if ((temp->deny = cupsArrayDup(loc->deny)) == NULL)
1340 {
1341 cupsdLogMessage(CUPSD_LOG_ERROR,
1342 "Unable to allocate memory for %d deny rules: %s",
1343 cupsArrayCount(loc->deny), strerror(errno));
1344 cupsdFreeLocation(temp);
1345 return (NULL);
1346 }
1347 }
1348
1349 return (temp);
1350 }
1351
1352
1353 /*
1354 * 'cupsdDeleteAllLocations()' - Free all memory used for location authorization.
1355 */
1356
1357 void
cupsdDeleteAllLocations(void)1358 cupsdDeleteAllLocations(void)
1359 {
1360 /*
1361 * Free the location array, which will free all of the locations...
1362 */
1363
1364 cupsArrayDelete(Locations);
1365 Locations = NULL;
1366 }
1367
1368
1369 /*
1370 * 'cupsdFindBest()' - Find the location entry that best matches the resource.
1371 */
1372
1373 cupsd_location_t * /* O - Location that matches */
cupsdFindBest(const char * path,http_state_t state)1374 cupsdFindBest(const char *path, /* I - Resource path */
1375 http_state_t state) /* I - HTTP state/request */
1376 {
1377 char uri[HTTP_MAX_URI],
1378 /* URI in request... */
1379 *uriptr; /* Pointer into URI */
1380 cupsd_location_t *loc, /* Current location */
1381 *best; /* Best match for location so far */
1382 size_t bestlen; /* Length of best match */
1383 int limit; /* Limit field */
1384 static const int limits[] = /* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
1385 {
1386 CUPSD_AUTH_LIMIT_ALL,
1387 CUPSD_AUTH_LIMIT_OPTIONS,
1388 CUPSD_AUTH_LIMIT_GET,
1389 CUPSD_AUTH_LIMIT_GET,
1390 CUPSD_AUTH_LIMIT_HEAD,
1391 CUPSD_AUTH_LIMIT_POST,
1392 CUPSD_AUTH_LIMIT_POST,
1393 CUPSD_AUTH_LIMIT_POST,
1394 CUPSD_AUTH_LIMIT_PUT,
1395 CUPSD_AUTH_LIMIT_PUT,
1396 CUPSD_AUTH_LIMIT_DELETE,
1397 CUPSD_AUTH_LIMIT_TRACE,
1398 CUPSD_AUTH_LIMIT_ALL,
1399 CUPSD_AUTH_LIMIT_ALL,
1400 CUPSD_AUTH_LIMIT_ALL,
1401 CUPSD_AUTH_LIMIT_ALL
1402 };
1403
1404
1405 /*
1406 * First copy the connection URI to a local string so we have drop
1407 * any .ppd extension from the pathname in /printers or /classes
1408 * URIs...
1409 */
1410
1411 strlcpy(uri, path, sizeof(uri));
1412
1413 if ((uriptr = strchr(uri, '?')) != NULL)
1414 *uriptr = '\0'; /* Drop trailing query string */
1415
1416 if ((uriptr = uri + strlen(uri) - 1) > uri && *uriptr == '/')
1417 *uriptr = '\0'; /* Remove trailing '/' */
1418
1419 if (!strncmp(uri, "/printers/", 10) ||
1420 !strncmp(uri, "/classes/", 9))
1421 {
1422 /*
1423 * Check if the URI has .ppd on the end...
1424 */
1425
1426 uriptr = uri + strlen(uri) - 4; /* len > 4 if we get here... */
1427
1428 if (!strcmp(uriptr, ".ppd"))
1429 *uriptr = '\0';
1430 }
1431
1432 /*
1433 * Loop through the list of locations to find a match...
1434 */
1435
1436 limit = limits[state];
1437 best = NULL;
1438 bestlen = 0;
1439
1440 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: uri=\"%s\", limit=%x...", uri, limit);
1441
1442
1443 for (loc = (cupsd_location_t *)cupsArrayFirst(Locations);
1444 loc;
1445 loc = (cupsd_location_t *)cupsArrayNext(Locations))
1446 {
1447 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: Location %s(%d) Limit %x", loc->location ? loc->location : "(null)", (int)loc->length, loc->limit);
1448
1449 if (!strncmp(uri, "/printers/", 10) || !strncmp(uri, "/classes/", 9))
1450 {
1451 /*
1452 * Use case-insensitive comparison for queue names...
1453 */
1454
1455 if (loc->length > bestlen && loc->location &&
1456 !_cups_strncasecmp(uri, loc->location, loc->length) &&
1457 loc->location[0] == '/' &&
1458 (limit & loc->limit) != 0)
1459 {
1460 best = loc;
1461 bestlen = loc->length;
1462 }
1463 }
1464 else
1465 {
1466 /*
1467 * Use case-sensitive comparison for other URIs...
1468 */
1469
1470 if (loc->length > bestlen && loc->location &&
1471 !strncmp(uri, loc->location, loc->length) &&
1472 loc->location[0] == '/' &&
1473 (limit & loc->limit) != 0)
1474 {
1475 best = loc;
1476 bestlen = loc->length;
1477 }
1478 }
1479 }
1480
1481 /*
1482 * Return the match, if any...
1483 */
1484
1485 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdFindBest: best=%s", best ? best->location : "NONE");
1486
1487 return (best);
1488 }
1489
1490
1491 /*
1492 * 'cupsdFindLocation()' - Find the named location.
1493 */
1494
1495 cupsd_location_t * /* O - Location that matches */
cupsdFindLocation(const char * location)1496 cupsdFindLocation(const char *location) /* I - Connection */
1497 {
1498 cupsd_location_t key; /* Search key */
1499
1500
1501 key.location = (char *)location;
1502
1503 return ((cupsd_location_t *)cupsArrayFind(Locations, &key));
1504 }
1505
1506
1507 /*
1508 * 'cupsdFreeLocation()' - Free all memory used by a location.
1509 */
1510
1511 void
cupsdFreeLocation(cupsd_location_t * loc)1512 cupsdFreeLocation(cupsd_location_t *loc)/* I - Location to free */
1513 {
1514 cupsArrayDelete(loc->names);
1515 cupsArrayDelete(loc->allow);
1516 cupsArrayDelete(loc->deny);
1517
1518 _cupsStrFree(loc->location);
1519 free(loc);
1520 }
1521
1522
1523 /*
1524 * 'cupsdIsAuthorized()' - Check to see if the user is authorized...
1525 */
1526
1527 http_status_t /* O - HTTP_OK if authorized or error code */
cupsdIsAuthorized(cupsd_client_t * con,const char * owner)1528 cupsdIsAuthorized(cupsd_client_t *con, /* I - Connection */
1529 const char *owner)/* I - Owner of object */
1530 {
1531 int i, /* Looping vars */
1532 auth, /* Authorization status */
1533 type; /* Type of authentication */
1534 http_addr_t *hostaddr = httpGetAddress(con->http);
1535 /* Client address */
1536 const char *hostname = httpGetHostname(con->http, NULL, 0);
1537 /* Client hostname */
1538 unsigned address[4]; /* Authorization address */
1539 cupsd_location_t *best; /* Best match for location so far */
1540 size_t hostlen; /* Length of hostname */
1541 char *name, /* Current username */
1542 username[256], /* Username to authorize */
1543 ownername[256], /* Owner name to authorize */
1544 *ptr; /* Pointer into username */
1545 struct passwd *pw; /* User password data */
1546 static const char * const levels[] = /* Auth levels */
1547 {
1548 "ANON",
1549 "USER",
1550 "GROUP"
1551 };
1552 static const char * const types[] = /* Auth types */
1553 {
1554 "None",
1555 "Basic",
1556 "Negotiate"
1557 };
1558
1559
1560 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: con->uri=\"%s\", con->best=%p(%s)", con->uri, con->best, con->best ? con->best->location ? con->best->location : "(null)" : "");
1561 if (owner)
1562 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: owner=\"%s\"", owner);
1563
1564 /*
1565 * If there is no "best" authentication rule for this request, then
1566 * access is allowed from the local system and denied from other
1567 * addresses...
1568 */
1569
1570 if (!con->best)
1571 {
1572 if (httpAddrLocalhost(httpGetAddress(con->http)) ||
1573 !strcmp(hostname, ServerName) ||
1574 cupsArrayFind(ServerAlias, (void *)hostname))
1575 return (HTTP_OK);
1576 else
1577 return (HTTP_FORBIDDEN);
1578 }
1579
1580 best = con->best;
1581
1582 if ((type = best->type) == CUPSD_AUTH_DEFAULT)
1583 type = cupsdDefaultAuthType();
1584
1585 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d", levels[best->level], types[type], best->satisfy ? "ANY" : "ALL", cupsArrayCount(best->names));
1586
1587 if (best->limit == CUPSD_AUTH_LIMIT_IPP)
1588 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)", best->op, ippOpString(best->op));
1589
1590 /*
1591 * Check host/ip-based accesses...
1592 */
1593
1594 #ifdef AF_INET6
1595 if (httpAddrFamily(hostaddr) == AF_INET6)
1596 {
1597 /*
1598 * Copy IPv6 address...
1599 */
1600
1601 address[0] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[0]);
1602 address[1] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[1]);
1603 address[2] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[2]);
1604 address[3] = ntohl(hostaddr->ipv6.sin6_addr.s6_addr32[3]);
1605 }
1606 else
1607 #endif /* AF_INET6 */
1608 if (con->http->hostaddr->addr.sa_family == AF_INET)
1609 {
1610 /*
1611 * Copy IPv4 address...
1612 */
1613
1614 address[0] = 0;
1615 address[1] = 0;
1616 address[2] = 0;
1617 address[3] = ntohl(hostaddr->ipv4.sin_addr.s_addr);
1618 }
1619 else
1620 memset(address, 0, sizeof(address));
1621
1622 hostlen = strlen(hostname);
1623
1624 auth = cupsdCheckAccess(address, hostname, hostlen, best)
1625 ? CUPSD_AUTH_ALLOW : CUPSD_AUTH_DENY;
1626
1627 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...", auth ? "DENY" : "ALLOW");
1628
1629 if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
1630 return (HTTP_FORBIDDEN);
1631
1632 #ifdef HAVE_SSL
1633 /*
1634 * See if encryption is required...
1635 */
1636
1637 if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http->tls &&
1638 _cups_strcasecmp(hostname, "localhost") &&
1639 !httpAddrLocalhost(hostaddr) &&
1640 best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
1641 !(type == CUPSD_AUTH_NEGOTIATE ||
1642 (type == CUPSD_AUTH_NONE &&
1643 cupsdDefaultAuthType() == CUPSD_AUTH_NEGOTIATE)))
1644 {
1645 cupsdLogMessage(CUPSD_LOG_DEBUG,
1646 "cupsdIsAuthorized: Need upgrade to TLS...");
1647 return (HTTP_UPGRADE_REQUIRED);
1648 }
1649 #endif /* HAVE_SSL */
1650
1651 /*
1652 * Now see what access level is required...
1653 */
1654
1655 if (best->level == CUPSD_AUTH_ANON || /* Anonymous access - allow it */
1656 (type == CUPSD_AUTH_NONE && cupsArrayCount(best->names) == 0))
1657 return (HTTP_OK);
1658
1659 if (!con->username[0] && type == CUPSD_AUTH_NONE &&
1660 best->limit == CUPSD_AUTH_LIMIT_IPP)
1661 {
1662 /*
1663 * Check for unauthenticated username...
1664 */
1665
1666 ipp_attribute_t *attr; /* requesting-user-name attribute */
1667
1668
1669 attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);
1670 if (attr)
1671 {
1672 cupsdLogMessage(CUPSD_LOG_DEBUG,
1673 "cupsdIsAuthorized: requesting-user-name=\"%s\"",
1674 attr->values[0].string.text);
1675 strlcpy(username, attr->values[0].string.text, sizeof(username));
1676 }
1677 else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1678 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1679 else
1680 return (HTTP_OK); /* unless overridden with Satisfy */
1681 }
1682 else
1683 {
1684 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: username=\"%s\"",
1685 con->username);
1686
1687 #ifdef HAVE_AUTHORIZATION_H
1688 if (!con->username[0] && !con->authref)
1689 #else
1690 if (!con->username[0])
1691 #endif /* HAVE_AUTHORIZATION_H */
1692 {
1693 if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
1694 return (HTTP_UNAUTHORIZED); /* Non-anonymous needs user/pass */
1695 else
1696 return (HTTP_OK); /* unless overridden with Satisfy */
1697 }
1698
1699
1700 if (con->type != type && type != CUPSD_AUTH_NONE &&
1701 #ifdef HAVE_GSSAPI
1702 (type != CUPSD_AUTH_NEGOTIATE || con->gss_uid <= 0) &&
1703 #endif /* HAVE_GSSAPI */
1704 con->type != CUPSD_AUTH_BASIC)
1705 {
1706 cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s.",
1707 types[con->type], types[type]);
1708
1709 return (HTTP_UNAUTHORIZED);
1710 }
1711
1712 strlcpy(username, con->username, sizeof(username));
1713 }
1714
1715 /*
1716 * OK, got a username. See if we need normal user access, or group
1717 * access... (root always matches)
1718 */
1719
1720 if (!strcmp(username, "root"))
1721 return (HTTP_OK);
1722
1723 /*
1724 * Strip any @domain or @KDC from the username and owner...
1725 */
1726
1727 if ((ptr = strchr(username, '@')) != NULL)
1728 *ptr = '\0';
1729
1730 if (owner)
1731 {
1732 strlcpy(ownername, owner, sizeof(ownername));
1733
1734 if ((ptr = strchr(ownername, '@')) != NULL)
1735 *ptr = '\0';
1736 }
1737 else
1738 ownername[0] = '\0';
1739
1740 /*
1741 * Get the user info...
1742 */
1743
1744 if (username[0])
1745 {
1746 pw = getpwnam(username);
1747 endpwent();
1748 }
1749 else
1750 pw = NULL;
1751
1752 if (best->level == CUPSD_AUTH_USER)
1753 {
1754 /*
1755 * If there are no names associated with this location, then
1756 * any valid user is OK...
1757 */
1758
1759 if (cupsArrayCount(best->names) == 0)
1760 return (HTTP_OK);
1761
1762 /*
1763 * Otherwise check the user list and return OK if this user is
1764 * allowed...
1765 */
1766
1767 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking user membership...");
1768
1769 #ifdef HAVE_AUTHORIZATION_H
1770 /*
1771 * If an authorization reference was supplied it must match a right name...
1772 */
1773
1774 if (con->authref)
1775 {
1776 for (name = (char *)cupsArrayFirst(best->names);
1777 name;
1778 name = (char *)cupsArrayNext(best->names))
1779 {
1780 if (!_cups_strncasecmp(name, "@AUTHKEY(", 9) && check_authref(con, name + 9))
1781 return (HTTP_OK);
1782 else if (!_cups_strcasecmp(name, "@SYSTEM") && SystemGroupAuthKey &&
1783 check_authref(con, SystemGroupAuthKey))
1784 return (HTTP_OK);
1785 }
1786
1787 return (HTTP_FORBIDDEN);
1788 }
1789 #endif /* HAVE_AUTHORIZATION_H */
1790
1791 for (name = (char *)cupsArrayFirst(best->names);
1792 name;
1793 name = (char *)cupsArrayNext(best->names))
1794 {
1795 if (!_cups_strcasecmp(name, "@OWNER") && owner &&
1796 !_cups_strcasecmp(username, ownername))
1797 return (HTTP_OK);
1798 else if (!_cups_strcasecmp(name, "@SYSTEM"))
1799 {
1800 for (i = 0; i < NumSystemGroups; i ++)
1801 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1802 return (HTTP_OK);
1803 }
1804 else if (name[0] == '@')
1805 {
1806 if (cupsdCheckGroup(username, pw, name + 1))
1807 return (HTTP_OK);
1808 }
1809 else if (!_cups_strcasecmp(username, name))
1810 return (HTTP_OK);
1811 }
1812
1813 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1814 }
1815
1816 /*
1817 * Check to see if this user is in any of the named groups...
1818 */
1819
1820 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group membership...");
1821
1822 /*
1823 * Check to see if this user is in any of the named groups...
1824 */
1825
1826 for (name = (char *)cupsArrayFirst(best->names);
1827 name;
1828 name = (char *)cupsArrayNext(best->names))
1829 {
1830 cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: Checking group \"%s\" membership...", name);
1831
1832 if (!_cups_strcasecmp(name, "@SYSTEM"))
1833 {
1834 for (i = 0; i < NumSystemGroups; i ++)
1835 if (cupsdCheckGroup(username, pw, SystemGroups[i]))
1836 return (HTTP_OK);
1837 }
1838 else if (cupsdCheckGroup(username, pw, name))
1839 return (HTTP_OK);
1840 }
1841
1842 /*
1843 * The user isn't part of the specified group, so deny access...
1844 */
1845
1846 cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdIsAuthorized: User not in group(s).");
1847
1848 return (con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED);
1849 }
1850
1851
1852 /*
1853 * 'cupsdNewLocation()' - Create a new location for authorization.
1854 *
1855 * Note: Still need to call cupsdAddLocation() to add it to the list of global
1856 * locations.
1857 */
1858
1859 cupsd_location_t * /* O - Pointer to new location record */
cupsdNewLocation(const char * location)1860 cupsdNewLocation(const char *location) /* I - Location path */
1861 {
1862 cupsd_location_t *temp; /* New location */
1863
1864
1865 /*
1866 * Try to allocate memory for the new location.
1867 */
1868
1869 if ((temp = calloc(1, sizeof(cupsd_location_t))) == NULL)
1870 return (NULL);
1871
1872 /*
1873 * Initialize the record and copy the name over...
1874 */
1875
1876 if ((temp->location = _cupsStrAlloc(location)) == NULL)
1877 {
1878 free(temp);
1879 return (NULL);
1880 }
1881
1882 temp->length = strlen(temp->location);
1883
1884 /*
1885 * Return the new record...
1886 */
1887
1888 return (temp);
1889 }
1890
1891
1892 #ifdef HAVE_AUTHORIZATION_H
1893 /*
1894 * 'check_authref()' - Check if an authorization services reference has the
1895 * supplied right.
1896 */
1897
1898 static int /* O - 1 if right is valid, 0 otherwise */
check_authref(cupsd_client_t * con,const char * right)1899 check_authref(cupsd_client_t *con, /* I - Connection */
1900 const char *right) /* I - Right name */
1901 {
1902 OSStatus status; /* OS Status */
1903 AuthorizationItem authright; /* Authorization right */
1904 AuthorizationRights authrights; /* Authorization rights */
1905 AuthorizationFlags authflags; /* Authorization flags */
1906
1907
1908 /*
1909 * Check to see if the user is allowed to perform the task...
1910 */
1911
1912 if (!con->authref)
1913 return (0);
1914
1915 authright.name = right;
1916 authright.valueLength = 0;
1917 authright.value = NULL;
1918 authright.flags = 0;
1919
1920 authrights.count = 1;
1921 authrights.items = &authright;
1922
1923 authflags = kAuthorizationFlagDefaults |
1924 kAuthorizationFlagExtendRights;
1925
1926 if ((status = AuthorizationCopyRights(con->authref, &authrights,
1927 kAuthorizationEmptyEnvironment,
1928 authflags, NULL)) != 0)
1929 {
1930 cupsdLogMessage(CUPSD_LOG_ERROR, "AuthorizationCopyRights(\"%s\") returned %d", authright.name, (int)status);
1931 return (0);
1932 }
1933
1934 cupsdLogMessage(CUPSD_LOG_DEBUG2, "AuthorizationCopyRights(\"%s\") succeeded.", authright.name);
1935
1936 return (1);
1937 }
1938 #endif /* HAVE_AUTHORIZATION_H */
1939
1940
1941 /*
1942 * 'compare_locations()' - Compare two locations.
1943 */
1944
1945 static int /* O - Result of comparison */
compare_locations(cupsd_location_t * a,cupsd_location_t * b)1946 compare_locations(cupsd_location_t *a, /* I - First location */
1947 cupsd_location_t *b) /* I - Second location */
1948 {
1949 return (strcmp(b->location, a->location));
1950 }
1951
1952
1953 /*
1954 * 'copy_authmask()' - Copy function for auth masks.
1955 */
1956
1957 static cupsd_authmask_t * /* O - New auth mask */
copy_authmask(cupsd_authmask_t * mask,void * data)1958 copy_authmask(cupsd_authmask_t *mask, /* I - Existing auth mask */
1959 void *data) /* I - User data (unused) */
1960 {
1961 cupsd_authmask_t *temp; /* New auth mask */
1962
1963
1964 (void)data;
1965
1966 if ((temp = malloc(sizeof(cupsd_authmask_t))) != NULL)
1967 {
1968 memcpy(temp, mask, sizeof(cupsd_authmask_t));
1969
1970 if (temp->type == CUPSD_AUTH_NAME || temp->type == CUPSD_AUTH_INTERFACE)
1971 {
1972 /*
1973 * Make a copy of the name...
1974 */
1975
1976 if ((temp->mask.name.name = _cupsStrAlloc(temp->mask.name.name)) == NULL)
1977 {
1978 /*
1979 * Failed to make copy...
1980 */
1981
1982 free(temp);
1983 temp = NULL;
1984 }
1985 }
1986 }
1987
1988 return (temp);
1989 }
1990
1991
1992 /*
1993 * 'free_authmask()' - Free function for auth masks.
1994 */
1995
1996 static void
free_authmask(cupsd_authmask_t * mask,void * data)1997 free_authmask(cupsd_authmask_t *mask, /* I - Auth mask to free */
1998 void *data) /* I - User data (unused) */
1999 {
2000 (void)data;
2001
2002 if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
2003 _cupsStrFree(mask->mask.name.name);
2004
2005 free(mask);
2006 }
2007
2008
2009 #if HAVE_LIBPAM
2010 /*
2011 * 'pam_func()' - PAM conversation function.
2012 */
2013
2014 static int /* O - Success or failure */
pam_func(int num_msg,const struct pam_message ** msg,struct pam_response ** resp,void * appdata_ptr)2015 pam_func(
2016 int num_msg, /* I - Number of messages */
2017 const struct pam_message **msg, /* I - Messages */
2018 struct pam_response **resp, /* O - Responses */
2019 void *appdata_ptr)
2020 /* I - Pointer to connection */
2021 {
2022 int i; /* Looping var */
2023 struct pam_response *replies; /* Replies */
2024 cupsd_authdata_t *data; /* Pointer to auth data */
2025
2026
2027 /*
2028 * Allocate memory for the responses...
2029 */
2030
2031 if ((replies = malloc(sizeof(struct pam_response) * (size_t)num_msg)) == NULL)
2032 return (PAM_CONV_ERR);
2033
2034 /*
2035 * Answer all of the messages...
2036 */
2037
2038 data = (cupsd_authdata_t *)appdata_ptr;
2039
2040 for (i = 0; i < num_msg; i ++)
2041 {
2042 switch (msg[i]->msg_style)
2043 {
2044 case PAM_PROMPT_ECHO_ON:
2045 replies[i].resp_retcode = PAM_SUCCESS;
2046 replies[i].resp = strdup(data->username);
2047 break;
2048
2049 case PAM_PROMPT_ECHO_OFF:
2050 replies[i].resp_retcode = PAM_SUCCESS;
2051 replies[i].resp = strdup(data->password);
2052 break;
2053
2054 case PAM_TEXT_INFO:
2055 replies[i].resp_retcode = PAM_SUCCESS;
2056 replies[i].resp = NULL;
2057 break;
2058
2059 case PAM_ERROR_MSG:
2060 replies[i].resp_retcode = PAM_SUCCESS;
2061 replies[i].resp = NULL;
2062 break;
2063
2064 default:
2065 free(replies);
2066 return (PAM_CONV_ERR);
2067 }
2068 }
2069
2070 /*
2071 * Return the responses back to PAM...
2072 */
2073
2074 *resp = replies;
2075
2076 return (PAM_SUCCESS);
2077 }
2078 #endif /* HAVE_LIBPAM */
2079