1 /* 2 * Authentication functions for CUPS. 3 * 4 * Copyright 2007-2016 by Apple Inc. 5 * Copyright 1997-2007 by Easy Software Products. 6 * 7 * This file contains Kerberos support code, copyright 2006 by 8 * Jelmer Vernooij. 9 * 10 * These coded instructions, statements, and computer programs are the 11 * property of Apple Inc. and are protected by Federal copyright 12 * law. Distribution and use rights are outlined in the file "LICENSE.txt" 13 * which should have been included with this file. If this file is 14 * missing or damaged, see the license at "http://www.cups.org/". 15 * 16 * This file is subject to the Apple OS-Developed Software exception. 17 */ 18 19 /* 20 * Include necessary headers... 21 */ 22 23 #include "cups-private.h" 24 #include <fcntl.h> 25 #include <sys/stat.h> 26 #if defined(WIN32) || defined(__EMX__) 27 # include <io.h> 28 #else 29 # include <unistd.h> 30 #endif /* WIN32 || __EMX__ */ 31 32 #if HAVE_AUTHORIZATION_H 33 # include <Security/Authorization.h> 34 # ifdef HAVE_SECBASEPRIV_H 35 # include <Security/SecBasePriv.h> 36 # else 37 extern const char *cssmErrorString(int error); 38 # endif /* HAVE_SECBASEPRIV_H */ 39 #endif /* HAVE_AUTHORIZATION_H */ 40 41 #if defined(SO_PEERCRED) && defined(AF_LOCAL) 42 # include <pwd.h> 43 #endif /* SO_PEERCRED && AF_LOCAL */ 44 45 46 /* 47 * Local functions... 48 */ 49 50 #ifdef HAVE_GSSAPI 51 # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F 52 # ifdef HAVE_GSS_GSSAPI_SPI_H 53 # include <GSS/gssapi_spi.h> 54 # else 55 # define GSS_AUTH_IDENTITY_TYPE_1 1 56 # define gss_acquire_cred_ex_f __ApplePrivate_gss_acquire_cred_ex_f 57 typedef struct gss_auth_identity /* @private@ */ 58 { 59 uint32_t type; 60 uint32_t flags; 61 char *username; 62 char *realm; 63 char *password; 64 gss_buffer_t *credentialsRef; 65 } gss_auth_identity_desc; 66 extern OM_uint32 gss_acquire_cred_ex_f(gss_status_id_t, const gss_name_t, 67 OM_uint32, OM_uint32, const gss_OID, 68 gss_cred_usage_t, gss_auth_identity_t, 69 void *, void (*)(void *, OM_uint32, 70 gss_status_id_t, 71 gss_cred_id_t, 72 gss_OID_set, 73 OM_uint32)); 74 # endif /* HAVE_GSS_GSSAPI_SPI_H */ 75 # include <dispatch/dispatch.h> 76 typedef struct _cups_gss_acquire_s /* Acquire callback data */ 77 { 78 dispatch_semaphore_t sem; /* Synchronization semaphore */ 79 OM_uint32 major; /* Returned status code */ 80 gss_cred_id_t creds; /* Returned credentials */ 81 } _cups_gss_acquire_t; 82 83 static void cups_gss_acquire(void *ctx, OM_uint32 major, 84 gss_status_id_t status, 85 gss_cred_id_t creds, gss_OID_set oids, 86 OM_uint32 time_rec); 87 # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ 88 static gss_name_t cups_gss_getname(http_t *http, const char *service_name); 89 # ifdef DEBUG 90 static void cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status, 91 const char *message); 92 # else 93 # define cups_gss_printf(major, minor, message) 94 # endif /* DEBUG */ 95 #endif /* HAVE_GSSAPI */ 96 static int cups_local_auth(http_t *http); 97 98 99 /* 100 * 'cupsDoAuthentication()' - Authenticate a request. 101 * 102 * This function should be called in response to a @code HTTP_STATUS_UNAUTHORIZED@ 103 * status, prior to resubmitting your request. 104 * 105 * @since CUPS 1.1.20/macOS 10.4@ 106 */ 107 108 int /* O - 0 on success, -1 on error */ 109 cupsDoAuthentication( 110 http_t *http, /* I - Connection to server or @code CUPS_HTTP_DEFAULT@ */ 111 const char *method, /* I - Request method ("GET", "POST", "PUT") */ 112 const char *resource) /* I - Resource path */ 113 { 114 const char *password, /* Password string */ 115 *www_auth; /* WWW-Authenticate header */ 116 char prompt[1024], /* Prompt for user */ 117 realm[HTTP_MAX_VALUE], /* realm="xyz" string */ 118 nonce[HTTP_MAX_VALUE]; /* nonce="xyz" string */ 119 int localauth; /* Local authentication result */ 120 _cups_globals_t *cg; /* Global data */ 121 122 123 DEBUG_printf(("cupsDoAuthentication(http=%p, method=\"%s\", resource=\"%s\")", (void *)http, method, resource)); 124 125 if (!http) 126 http = _cupsConnect(); 127 128 if (!http || !method || !resource) 129 return (-1); 130 131 DEBUG_printf(("2cupsDoAuthentication: digest_tries=%d, userpass=\"%s\"", 132 http->digest_tries, http->userpass)); 133 DEBUG_printf(("2cupsDoAuthentication: WWW-Authenticate=\"%s\"", 134 httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE))); 135 136 /* 137 * Clear the current authentication string... 138 */ 139 140 httpSetAuthString(http, NULL, NULL); 141 142 /* 143 * See if we can do local authentication... 144 */ 145 146 if (http->digest_tries < 3) 147 { 148 if ((localauth = cups_local_auth(http)) == 0) 149 { 150 DEBUG_printf(("2cupsDoAuthentication: authstring=\"%s\"", 151 http->authstring)); 152 153 if (http->status == HTTP_STATUS_UNAUTHORIZED) 154 http->digest_tries ++; 155 156 return (0); 157 } 158 else if (localauth == -1) 159 { 160 http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; 161 return (-1); /* Error or canceled */ 162 } 163 } 164 165 /* 166 * Nope, see if we should retry the current username:password... 167 */ 168 169 www_auth = http->fields[HTTP_FIELD_WWW_AUTHENTICATE]; 170 171 if ((http->digest_tries > 1 || !http->userpass[0]) && 172 (!_cups_strncasecmp(www_auth, "Basic", 5) || 173 !_cups_strncasecmp(www_auth, "Digest", 6))) 174 { 175 /* 176 * Nope - get a new password from the user... 177 */ 178 179 char default_username[HTTP_MAX_VALUE]; 180 /* Default username */ 181 182 cg = _cupsGlobals(); 183 184 if (!cg->lang_default) 185 cg->lang_default = cupsLangDefault(); 186 187 if (httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "username", 188 default_username)) 189 cupsSetUser(default_username); 190 191 snprintf(prompt, sizeof(prompt), 192 _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), 193 cupsUser(), 194 http->hostname[0] == '/' ? "localhost" : http->hostname); 195 196 http->digest_tries = _cups_strncasecmp(www_auth, "Digest", 6) != 0; 197 http->userpass[0] = '\0'; 198 199 if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) 200 { 201 http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; 202 return (-1); 203 } 204 205 snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), 206 password); 207 } 208 else if (http->status == HTTP_STATUS_UNAUTHORIZED) 209 http->digest_tries ++; 210 211 if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3) 212 { 213 DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", 214 http->digest_tries)); 215 216 http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; 217 return (-1); 218 } 219 220 /* 221 * Got a password; encode it for the server... 222 */ 223 224 #ifdef HAVE_GSSAPI 225 if (!_cups_strncasecmp(www_auth, "Negotiate", 9)) 226 { 227 /* 228 * Kerberos authentication... 229 */ 230 231 if (_cupsSetNegotiateAuthString(http, method, resource)) 232 { 233 http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; 234 return (-1); 235 } 236 } 237 else 238 #endif /* HAVE_GSSAPI */ 239 if (!_cups_strncasecmp(www_auth, "Basic", 5)) 240 { 241 /* 242 * Basic authentication... 243 */ 244 245 char encode[256]; /* Base64 buffer */ 246 247 248 httpEncode64_2(encode, sizeof(encode), http->userpass, 249 (int)strlen(http->userpass)); 250 httpSetAuthString(http, "Basic", encode); 251 } 252 else if (!_cups_strncasecmp(www_auth, "Digest", 6)) 253 { 254 /* 255 * Digest authentication... 256 */ 257 258 char encode[33], /* MD5 buffer */ 259 digest[1024]; /* Digest auth data */ 260 261 httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "realm", realm); 262 httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "nonce", nonce); 263 264 httpMD5(cupsUser(), realm, strchr(http->userpass, ':') + 1, encode); 265 httpMD5Final(nonce, method, resource, encode); 266 snprintf(digest, sizeof(digest), 267 "username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", " 268 "response=\"%s\"", cupsUser(), realm, nonce, resource, encode); 269 httpSetAuthString(http, "Digest", digest); 270 } 271 else 272 { 273 DEBUG_printf(("1cupsDoAuthentication: Unknown auth type: \"%s\"", 274 www_auth)); 275 http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED; 276 return (-1); 277 } 278 279 DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\"", http->authstring)); 280 281 return (0); 282 } 283 284 285 #ifdef HAVE_GSSAPI 286 /* 287 * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string. 288 */ 289 290 int /* O - 0 on success, -1 on error */ 291 _cupsSetNegotiateAuthString( 292 http_t *http, /* I - Connection to server */ 293 const char *method, /* I - Request method ("GET", "POST", "PUT") */ 294 const char *resource) /* I - Resource path */ 295 { 296 OM_uint32 minor_status, /* Minor status code */ 297 major_status; /* Major status code */ 298 gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; 299 /* Output token */ 300 301 302 (void)method; 303 (void)resource; 304 305 # ifdef __APPLE__ 306 /* 307 * If the weak-linked GSSAPI/Kerberos library is not present, don't try 308 * to use it... 309 */ 310 311 if (&gss_init_sec_context == NULL) 312 { 313 DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos " 314 "framework is not present"); 315 return (-1); 316 } 317 # endif /* __APPLE__ */ 318 319 if (http->gssname == GSS_C_NO_NAME) 320 { 321 http->gssname = cups_gss_getname(http, _cupsGSSServiceName()); 322 } 323 324 if (http->gssctx != GSS_C_NO_CONTEXT) 325 { 326 gss_delete_sec_context(&minor_status, &http->gssctx, GSS_C_NO_BUFFER); 327 http->gssctx = GSS_C_NO_CONTEXT; 328 } 329 330 major_status = gss_init_sec_context(&minor_status, GSS_C_NO_CREDENTIAL, 331 &http->gssctx, 332 http->gssname, http->gssmech, 333 GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, 334 GSS_C_INDEFINITE, 335 GSS_C_NO_CHANNEL_BINDINGS, 336 GSS_C_NO_BUFFER, &http->gssmech, 337 &output_token, NULL, NULL); 338 339 #ifdef HAVE_GSS_ACQUIRE_CRED_EX_F 340 if (major_status == GSS_S_NO_CRED) 341 { 342 /* 343 * Ask the user for credentials... 344 */ 345 346 char prompt[1024], /* Prompt for user */ 347 userbuf[256]; /* Kerberos username */ 348 const char *username, /* Username string */ 349 *password; /* Password string */ 350 _cups_gss_acquire_t data; /* Callback data */ 351 gss_auth_identity_desc identity; /* Kerberos user identity */ 352 _cups_globals_t *cg = _cupsGlobals(); 353 /* Per-thread global data */ 354 355 if (!cg->lang_default) 356 cg->lang_default = cupsLangDefault(); 357 358 snprintf(prompt, sizeof(prompt), 359 _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), 360 cupsUser(), http->gsshost); 361 362 if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL) 363 return (-1); 364 365 /* 366 * Try to acquire credentials... 367 */ 368 369 username = cupsUser(); 370 if (!strchr(username, '@')) 371 { 372 snprintf(userbuf, sizeof(userbuf), "%s@%s", username, http->gsshost); 373 username = userbuf; 374 } 375 376 identity.type = GSS_AUTH_IDENTITY_TYPE_1; 377 identity.flags = 0; 378 identity.username = (char *)username; 379 identity.realm = (char *)""; 380 identity.password = (char *)password; 381 identity.credentialsRef = NULL; 382 383 data.sem = dispatch_semaphore_create(0); 384 data.major = 0; 385 data.creds = NULL; 386 387 if (data.sem) 388 { 389 major_status = gss_acquire_cred_ex_f(NULL, GSS_C_NO_NAME, 0, GSS_C_INDEFINITE, GSS_KRB5_MECHANISM, GSS_C_INITIATE, (gss_auth_identity_t)&identity, &data, cups_gss_acquire); 390 391 if (major_status == GSS_S_COMPLETE) 392 { 393 dispatch_semaphore_wait(data.sem, DISPATCH_TIME_FOREVER); 394 major_status = data.major; 395 } 396 397 dispatch_release(data.sem); 398 399 if (major_status == GSS_S_COMPLETE) 400 { 401 OM_uint32 release_minor; /* Minor status from releasing creds */ 402 403 major_status = gss_init_sec_context(&minor_status, data.creds, 404 &http->gssctx, 405 http->gssname, http->gssmech, 406 GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG, 407 GSS_C_INDEFINITE, 408 GSS_C_NO_CHANNEL_BINDINGS, 409 GSS_C_NO_BUFFER, &http->gssmech, 410 &output_token, NULL, NULL); 411 gss_release_cred(&release_minor, &data.creds); 412 } 413 } 414 } 415 #endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */ 416 417 if (GSS_ERROR(major_status)) 418 { 419 cups_gss_printf(major_status, minor_status, 420 "_cupsSetNegotiateAuthString: Unable to initialize " 421 "security context"); 422 return (-1); 423 } 424 425 #ifdef DEBUG 426 else if (major_status == GSS_S_CONTINUE_NEEDED) 427 cups_gss_printf(major_status, minor_status, 428 "_cupsSetNegotiateAuthString: Continuation needed!"); 429 #endif /* DEBUG */ 430 431 if (output_token.length > 0 && output_token.length <= 65536) 432 { 433 /* 434 * Allocate the authorization string since Windows KDCs can have 435 * arbitrarily large credentials... 436 */ 437 438 int authsize = 10 + /* "Negotiate " */ 439 (int)output_token.length * 4 / 3 + 1 + 1; 440 /* Base64 + nul */ 441 442 httpSetAuthString(http, NULL, NULL); 443 444 if ((http->authstring = malloc((size_t)authsize)) == NULL) 445 { 446 http->authstring = http->_authstring; 447 authsize = sizeof(http->_authstring); 448 } 449 450 strlcpy(http->authstring, "Negotiate ", (size_t)authsize); 451 httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value, 452 (int)output_token.length); 453 454 gss_release_buffer(&minor_status, &output_token); 455 } 456 else 457 { 458 DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos credentials too " 459 "large - %d bytes!", (int)output_token.length)); 460 gss_release_buffer(&minor_status, &output_token); 461 462 return (-1); 463 } 464 465 return (0); 466 } 467 468 469 # ifdef HAVE_GSS_ACQUIRE_CRED_EX_F 470 /* 471 * 'cups_gss_acquire()' - Kerberos credentials callback. 472 */ 473 static void 474 cups_gss_acquire( 475 void *ctx, /* I - Caller context */ 476 OM_uint32 major, /* I - Major error code */ 477 gss_status_id_t status, /* I - Status (unused) */ 478 gss_cred_id_t creds, /* I - Credentials (if any) */ 479 gss_OID_set oids, /* I - Mechanism OIDs (unused) */ 480 OM_uint32 time_rec) /* I - Timestamp (unused) */ 481 { 482 uint32_t min; /* Minor error code */ 483 _cups_gss_acquire_t *data; /* Callback data */ 484 485 486 (void)status; 487 (void)time_rec; 488 489 data = (_cups_gss_acquire_t *)ctx; 490 data->major = major; 491 data->creds = creds; 492 493 gss_release_oid_set(&min, &oids); 494 dispatch_semaphore_signal(data->sem); 495 } 496 # endif /* HAVE_GSS_ACQUIRE_CRED_EX_F */ 497 498 499 /* 500 * 'cups_gss_getname()' - Get CUPS service credentials for authentication. 501 */ 502 503 static gss_name_t /* O - Server name */ 504 cups_gss_getname( 505 http_t *http, /* I - Connection to server */ 506 const char *service_name) /* I - Service name */ 507 { 508 gss_buffer_desc token = GSS_C_EMPTY_BUFFER; 509 /* Service token */ 510 OM_uint32 major_status, /* Major status code */ 511 minor_status; /* Minor status code */ 512 gss_name_t server_name; /* Server name */ 513 char buf[1024]; /* Name buffer */ 514 515 516 DEBUG_printf(("7cups_gss_getname(http=%p, service_name=\"%s\")", http, 517 service_name)); 518 519 520 /* 521 * Get the hostname... 522 */ 523 524 if (!http->gsshost[0]) 525 { 526 httpGetHostname(http, http->gsshost, sizeof(http->gsshost)); 527 528 if (!strcmp(http->gsshost, "localhost")) 529 { 530 if (gethostname(http->gsshost, sizeof(http->gsshost)) < 0) 531 { 532 DEBUG_printf(("1cups_gss_getname: gethostname() failed: %s", 533 strerror(errno))); 534 http->gsshost[0] = '\0'; 535 return (NULL); 536 } 537 538 if (!strchr(http->gsshost, '.')) 539 { 540 /* 541 * The hostname is not a FQDN, so look it up... 542 */ 543 544 struct hostent *host; /* Host entry to get FQDN */ 545 546 if ((host = gethostbyname(http->gsshost)) != NULL && host->h_name) 547 { 548 /* 549 * Use the resolved hostname... 550 */ 551 552 strlcpy(http->gsshost, host->h_name, sizeof(http->gsshost)); 553 } 554 else 555 { 556 DEBUG_printf(("1cups_gss_getname: gethostbyname(\"%s\") failed.", 557 http->gsshost)); 558 http->gsshost[0] = '\0'; 559 return (NULL); 560 } 561 } 562 } 563 } 564 565 /* 566 * Get a service name we can use for authentication purposes... 567 */ 568 569 snprintf(buf, sizeof(buf), "%s@%s", service_name, http->gsshost); 570 571 DEBUG_printf(("8cups_gss_getname: Looking up \"%s\".", buf)); 572 573 token.value = buf; 574 token.length = strlen(buf); 575 server_name = GSS_C_NO_NAME; 576 major_status = gss_import_name(&minor_status, &token, 577 GSS_C_NT_HOSTBASED_SERVICE, 578 &server_name); 579 580 if (GSS_ERROR(major_status)) 581 { 582 cups_gss_printf(major_status, minor_status, 583 "cups_gss_getname: gss_import_name() failed"); 584 return (NULL); 585 } 586 587 return (server_name); 588 } 589 590 591 # ifdef DEBUG 592 /* 593 * 'cups_gss_printf()' - Show debug error messages from GSSAPI. 594 */ 595 596 static void 597 cups_gss_printf(OM_uint32 major_status,/* I - Major status code */ 598 OM_uint32 minor_status,/* I - Minor status code */ 599 const char *message) /* I - Prefix for error message */ 600 { 601 OM_uint32 err_major_status, /* Major status code for display */ 602 err_minor_status; /* Minor status code for display */ 603 OM_uint32 msg_ctx; /* Message context */ 604 gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER, 605 /* Major status message */ 606 minor_status_string = GSS_C_EMPTY_BUFFER; 607 /* Minor status message */ 608 609 610 msg_ctx = 0; 611 err_major_status = gss_display_status(&err_minor_status, 612 major_status, 613 GSS_C_GSS_CODE, 614 GSS_C_NO_OID, 615 &msg_ctx, 616 &major_status_string); 617 618 if (!GSS_ERROR(err_major_status)) 619 gss_display_status(&err_minor_status, minor_status, GSS_C_MECH_CODE, 620 GSS_C_NULL_OID, &msg_ctx, &minor_status_string); 621 622 DEBUG_printf(("1%s: %s, %s", message, (char *)major_status_string.value, 623 (char *)minor_status_string.value)); 624 625 gss_release_buffer(&err_minor_status, &major_status_string); 626 gss_release_buffer(&err_minor_status, &minor_status_string); 627 } 628 # endif /* DEBUG */ 629 #endif /* HAVE_GSSAPI */ 630 631 632 /* 633 * 'cups_local_auth()' - Get the local authorization certificate if 634 * available/applicable. 635 */ 636 637 static int /* O - 0 if available */ 638 /* 1 if not available */ 639 /* -1 error */ 640 cups_local_auth(http_t *http) /* I - HTTP connection to server */ 641 { 642 #if defined(WIN32) || defined(__EMX__) 643 /* 644 * Currently WIN32 and OS-2 do not support the CUPS server... 645 */ 646 647 return (1); 648 #else 649 int pid; /* Current process ID */ 650 FILE *fp; /* Certificate file */ 651 char trc[16], /* Try Root Certificate parameter */ 652 filename[1024]; /* Certificate filename */ 653 _cups_globals_t *cg = _cupsGlobals(); /* Global data */ 654 # if defined(HAVE_AUTHORIZATION_H) 655 OSStatus status; /* Status */ 656 AuthorizationItem auth_right; /* Authorization right */ 657 AuthorizationRights auth_rights; /* Authorization rights */ 658 AuthorizationFlags auth_flags; /* Authorization flags */ 659 AuthorizationExternalForm auth_extrn; /* Authorization ref external */ 660 char auth_key[1024]; /* Buffer */ 661 char buffer[1024]; /* Buffer */ 662 # endif /* HAVE_AUTHORIZATION_H */ 663 664 665 DEBUG_printf(("7cups_local_auth(http=%p) hostaddr=%s, hostname=\"%s\"", (void *)http, httpAddrString(http->hostaddr, filename, sizeof(filename)), http->hostname)); 666 667 /* 668 * See if we are accessing localhost... 669 */ 670 671 if (!httpAddrLocalhost(http->hostaddr) && 672 _cups_strcasecmp(http->hostname, "localhost") != 0) 673 { 674 DEBUG_puts("8cups_local_auth: Not a local connection!"); 675 return (1); 676 } 677 678 # if defined(HAVE_AUTHORIZATION_H) 679 /* 680 * Delete any previous authorization reference... 681 */ 682 683 if (http->auth_ref) 684 { 685 AuthorizationFree(http->auth_ref, kAuthorizationFlagDefaults); 686 http->auth_ref = NULL; 687 } 688 689 if (!getenv("GATEWAY_INTERFACE") && 690 httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", 691 auth_key, sizeof(auth_key))) 692 { 693 status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, 694 kAuthorizationFlagDefaults, &http->auth_ref); 695 if (status != errAuthorizationSuccess) 696 { 697 DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d (%s)", 698 (int)status, cssmErrorString(status))); 699 return (-1); 700 } 701 702 auth_right.name = auth_key; 703 auth_right.valueLength = 0; 704 auth_right.value = NULL; 705 auth_right.flags = 0; 706 707 auth_rights.count = 1; 708 auth_rights.items = &auth_right; 709 710 auth_flags = kAuthorizationFlagDefaults | 711 kAuthorizationFlagPreAuthorize | 712 kAuthorizationFlagInteractionAllowed | 713 kAuthorizationFlagExtendRights; 714 715 status = AuthorizationCopyRights(http->auth_ref, &auth_rights, 716 kAuthorizationEmptyEnvironment, 717 auth_flags, NULL); 718 if (status == errAuthorizationSuccess) 719 status = AuthorizationMakeExternalForm(http->auth_ref, &auth_extrn); 720 721 if (status == errAuthorizationSuccess) 722 { 723 /* 724 * Set the authorization string and return... 725 */ 726 727 httpEncode64_2(buffer, sizeof(buffer), (void *)&auth_extrn, 728 sizeof(auth_extrn)); 729 730 httpSetAuthString(http, "AuthRef", buffer); 731 732 DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", 733 http->authstring)); 734 return (0); 735 } 736 else if (status == errAuthorizationCanceled) 737 return (-1); 738 739 DEBUG_printf(("9cups_local_auth: AuthorizationCopyRights() returned %d (%s)", 740 (int)status, cssmErrorString(status))); 741 742 /* 743 * Fall through to try certificates... 744 */ 745 } 746 # endif /* HAVE_AUTHORIZATION_H */ 747 748 # if defined(SO_PEERCRED) && defined(AF_LOCAL) 749 /* 750 * See if we can authenticate using the peer credentials provided over a 751 * domain socket; if so, specify "PeerCred username" as the authentication 752 * information... 753 */ 754 755 if ( 756 # ifdef HAVE_GSSAPI 757 _cups_strncasecmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9) && 758 # endif /* HAVE_GSSAPI */ 759 # ifdef HAVE_AUTHORIZATION_H 760 !httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", 761 auth_key, sizeof(auth_key)) && 762 # endif /* HAVE_AUTHORIZATION_H */ 763 http->hostaddr->addr.sa_family == AF_LOCAL && 764 !getenv("GATEWAY_INTERFACE")) /* Not via CGI programs... */ 765 { 766 /* 767 * Verify that the current cupsUser() matches the current UID... 768 */ 769 770 struct passwd *pwd; /* Password information */ 771 const char *username; /* Current username */ 772 773 username = cupsUser(); 774 775 if ((pwd = getpwnam(username)) != NULL && pwd->pw_uid == getuid()) 776 { 777 httpSetAuthString(http, "PeerCred", username); 778 779 DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", 780 http->authstring)); 781 782 return (0); 783 } 784 } 785 # endif /* SO_PEERCRED && AF_LOCAL */ 786 787 /* 788 * Try opening a certificate file for this PID. If that fails, 789 * try the root certificate... 790 */ 791 792 pid = getpid(); 793 snprintf(filename, sizeof(filename), "%s/certs/%d", cg->cups_statedir, pid); 794 if ((fp = fopen(filename, "r")) == NULL && pid > 0) 795 { 796 /* 797 * No certificate for this PID; see if we can get the root certificate... 798 */ 799 800 DEBUG_printf(("9cups_local_auth: Unable to open file %s: %s", 801 filename, strerror(errno))); 802 803 # ifdef HAVE_GSSAPI 804 if (!_cups_strncasecmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9)) 805 { 806 /* 807 * Kerberos required, don't try the root certificate... 808 */ 809 810 return (1); 811 } 812 # endif /* HAVE_GSSAPI */ 813 814 # ifdef HAVE_AUTHORIZATION_H 815 if (httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey", 816 auth_key, sizeof(auth_key))) 817 { 818 /* 819 * Don't use the root certificate as a replacement for an authkey... 820 */ 821 822 return (1); 823 } 824 # endif /* HAVE_AUTHORIZATION_H */ 825 if (!httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "trc", trc, 826 sizeof(trc))) 827 { 828 /* 829 * Scheduler doesn't want us to use the root certificate... 830 */ 831 832 return (1); 833 } 834 835 snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir); 836 fp = fopen(filename, "r"); 837 } 838 839 if (fp) 840 { 841 /* 842 * Read the certificate from the file... 843 */ 844 845 char certificate[33], /* Certificate string */ 846 *certptr; /* Pointer to certificate string */ 847 848 certptr = fgets(certificate, sizeof(certificate), fp); 849 fclose(fp); 850 851 if (certptr) 852 { 853 /* 854 * Set the authorization string and return... 855 */ 856 857 httpSetAuthString(http, "Local", certificate); 858 859 DEBUG_printf(("8cups_local_auth: Returning authstring=\"%s\"", 860 http->authstring)); 861 862 return (0); 863 } 864 } 865 866 return (1); 867 #endif /* WIN32 || __EMX__ */ 868 } 869
