cups/http-private.h

   1 /*
   2  * Private HTTP definitions for CUPS.
   3  *
   4  * Copyright 2007-2018 by Apple Inc.
   5  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
   6  *
   7  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
   8  * information.
   9  */
  10
  11 #ifndef _CUPS_HTTP_PRIVATE_H_
  12 #  define _CUPS_HTTP_PRIVATE_H_
  13
  14 /*
  15  * Include necessary headers...
  16  */
  17
  18 #  include "config.h"
  19 #  include <cups/language.h>
  20 #  include <stddef.h>
  21 #  include <stdlib.h>
  22
  23 #  ifdef __sun
  24 #    include <sys/select.h>
  25 #  endif /* __sun */
  26
  27 #  include <limits.h>
  28 #  ifdef _WIN32
  29 #    define _WINSOCK_DEPRECATED_NO_WARNINGS 1
  30 #    include <io.h>
  31 #    include <winsock2.h>
  32 #    define CUPS_SOCAST (const char *)
  33 #  else
  34 #    include <unistd.h>
  35 #    include <fcntl.h>
  36 #    include <sys/socket.h>
  37 #    define CUPS_SOCAST
  38 #  endif /* _WIN32 */
  39
  40 #  ifdef HAVE_GSSAPI
  41 #    ifdef HAVE_GSS_GSSAPI_H
  42 #      include <GSS/gssapi.h>
  43 #    elif defined(HAVE_GSSAPI_GSSAPI_H)
  44 #      include <gssapi/gssapi.h>
  45 #    elif defined(HAVE_GSSAPI_H)
  46 #      include <gssapi.h>
  47 #    endif /* HAVE_GSS_GSSAPI_H */
  48 #    ifndef HAVE_GSS_C_NT_HOSTBASED_SERVICE
  49 #      define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
  50 #    endif /* !HAVE_GSS_C_NT_HOSTBASED_SERVICE */
  51 #  endif /* HAVE_GSSAPI */
  52
  53 #  ifdef HAVE_AUTHORIZATION_H
  54 #    include <Security/Authorization.h>
  55 #  endif /* HAVE_AUTHORIZATION_H */
  56
  57 #  if defined(__APPLE__) && !defined(_SOCKLEN_T)
  58 /*
  59  * macOS 10.2.x does not define socklen_t, and in fact uses an int instead of
  60  * unsigned type for length values...
  61  */
  62
  63 typedef int socklen_t;
  64 #  endif /* __APPLE__ && !_SOCKLEN_T */
  65
  66 #  include <cups/http.h>
  67 #  include "ipp-private.h"
  68
  69 #  ifdef HAVE_GNUTLS
  70 #    include <gnutls/gnutls.h>
  71 #    include <gnutls/x509.h>
  72 #  elif defined(HAVE_CDSASSL)
  73 #    include <CoreFoundation/CoreFoundation.h>
  74 #    include <Security/Security.h>
  75 #    include <Security/SecureTransport.h>
  76 #    ifdef HAVE_SECITEM_H
  77 #      include <Security/SecItem.h>
  78 #    endif /* HAVE_SECITEM_H */
  79 #    ifdef HAVE_SECCERTIFICATE_H
  80 #      include <Security/SecCertificate.h>
  81 #      include <Security/SecIdentity.h>
  82 #    endif /* HAVE_SECCERTIFICATE_H */
  83 #  elif defined(HAVE_SSPISSL)
  84 #    include <wincrypt.h>
  85 #    include <wintrust.h>
  86 #    include <schannel.h>
  87 #    define SECURITY_WIN32
  88 #    include <security.h>
  89 #    include <sspi.h>
  90 #  endif /* HAVE_GNUTLS */
  91
  92 #  ifndef _WIN32
  93 #    include <net/if.h>
  94 #    include <resolv.h>
  95 #    ifdef HAVE_GETIFADDRS
  96 #      include <ifaddrs.h>
  97 #    else
  98 #      include <sys/ioctl.h>
  99 #      ifdef HAVE_SYS_SOCKIO_H
 100 #        include <sys/sockio.h>
 101 #      endif /* HAVE_SYS_SOCKIO_H */
 102 #    endif /* HAVE_GETIFADDRS */
 103 #  endif /* !_WIN32 */
 104
 105
 106 /*
 107  * C++ magic...
 108  */
 109
 110 #  ifdef __cplusplus
 111 extern "C" {
 112 #  endif /* __cplusplus */
 113
 114
 115 /*
 116  * Constants...
 117  */
 118
 119 #  define _HTTP_MAX_SBUFFER     65536   /* Size of (de)compression buffer */
 120 #  define _HTTP_RESOLVE_DEFAULT 0       /* Just resolve with default options */
 121 #  define _HTTP_RESOLVE_STDERR  1       /* Log resolve progress to stderr */
 122 #  define _HTTP_RESOLVE_FQDN    2       /* Resolve to a FQDN */
 123 #  define _HTTP_RESOLVE_FAXOUT  4       /* Resolve FaxOut service? */
 124
 125 #  define _HTTP_TLS_NONE        0       /* No TLS options */
 126 #  define _HTTP_TLS_ALLOW_RC4   1       /* Allow RC4 cipher suites */
 127 #  define _HTTP_TLS_ALLOW_DH    2       /* Allow DH/DHE key negotiation */
 128 #  define _HTTP_TLS_DENY_CBC    4       /* Deny CBC cipher suites */
 129 #  define _HTTP_TLS_SET_DEFAULT 128     /* Setting the default TLS options */
 130
 131 #  define _HTTP_TLS_SSL3        0       /* Min/max version is SSL/3.0 */
 132 #  define _HTTP_TLS_1_0         1       /* Min/max version is TLS/1.0 */
 133 #  define _HTTP_TLS_1_1         2       /* Min/max version is TLS/1.1 */
 134 #  define _HTTP_TLS_1_2         3       /* Min/max version is TLS/1.2 */
 135 #  define _HTTP_TLS_1_3         4       /* Min/max version is TLS/1.3 */
 136 #  define _HTTP_TLS_MAX         5       /* Highest known TLS version */
 137
 138
 139 /*
 140  * Types and functions for SSL support...
 141  */
 142
 143 #  ifdef HAVE_GNUTLS
 144 /*
 145  * The GNU TLS library is more of a "bare metal" SSL/TLS library...
 146  */
 147
 148 typedef gnutls_session_t http_tls_t;
 149 typedef gnutls_certificate_credentials_t *http_tls_credentials_t;
 150
 151 #  elif defined(HAVE_CDSASSL)
 152 /*
 153  * Darwin's Security framework provides its own SSL/TLS context structure
 154  * for its IO and protocol management...
 155  */
 156
 157 #    if !defined(HAVE_SECIDENTITYSEARCHPRIV_H) && defined(HAVE_SECIDENTITYSEARCHCREATEWITHPOLICY) /* Declare prototype for function in that header... */
 158 extern OSStatus SecIdentitySearchCreateWithPolicy(SecPolicyRef policy,
 159                                 CFStringRef idString, CSSM_KEYUSE keyUsage,
 160                                 CFTypeRef keychainOrArray,
 161                                 Boolean returnOnlyValidIdentities,
 162                                 SecIdentitySearchRef* searchRef);
 163 #    endif /* !HAVE_SECIDENTITYSEARCHPRIV_H && HAVE_SECIDENTITYSEARCHCREATEWITHPOLICY */
 164 #    if !defined(HAVE_SECPOLICYPRIV_H) && defined(HAVE_SECPOLICYSETVALUE) /* Declare prototype for function in that header... */
 165 extern OSStatus SecPolicySetValue(SecPolicyRef policyRef,
 166                                   const CSSM_DATA *value);
 167 #    endif /* !HAVE_SECPOLICYPRIV_H && HAVE_SECPOLICYSETVALUE */
 168
 169 typedef SSLContextRef   http_tls_t;
 170 typedef CFArrayRef      http_tls_credentials_t;
 171
 172 #  elif defined(HAVE_SSPISSL)
 173 /*
 174  * Windows' SSPI library gets a CUPS wrapper...
 175  */
 176
 177 typedef struct _http_sspi_s             /**** SSPI/SSL data structure ****/
 178 {
 179   CredHandle    creds;                  /* Credentials */
 180   CtxtHandle    context;                /* SSL context */
 181   BOOL          contextInitialized;     /* Is context init'd? */
 182   SecPkgContext_StreamSizes streamSizes;/* SSL data stream sizes */
 183   BYTE          *decryptBuffer;         /* Data pre-decryption*/
 184   size_t        decryptBufferLength;    /* Length of decrypt buffer */
 185   size_t        decryptBufferUsed;      /* Bytes used in buffer */
 186   BYTE          *readBuffer;            /* Data post-decryption */
 187   int           readBufferLength;       /* Length of read buffer */
 188   int           readBufferUsed;         /* Bytes used in buffer */
 189   BYTE          *writeBuffer;           /* Data pre-encryption */
 190   int           writeBufferLength;      /* Length of write buffer */
 191   PCCERT_CONTEXT localCert,             /* Local certificate */
 192                 remoteCert;             /* Remote (peer's) certificate */
 193   char          error[256];             /* Most recent error message */
 194 } _http_sspi_t;
 195 typedef _http_sspi_t *http_tls_t;
 196 typedef PCCERT_CONTEXT http_tls_credentials_t;
 197
 198 #  else
 199 /*
 200  * Otherwise define stub types since we have no SSL support...
 201  */
 202
 203 typedef void *http_tls_t;
 204 typedef void *http_tls_credentials_t;
 205 #  endif /* HAVE_GNUTLS */
 206
 207 typedef enum _http_coding_e             /**** HTTP content coding enumeration ****/
 208 {
 209   _HTTP_CODING_IDENTITY,                /* No content coding */
 210   _HTTP_CODING_GZIP,                    /* LZ77+gzip decompression */
 211   _HTTP_CODING_DEFLATE,                 /* LZ77+zlib compression */
 212   _HTTP_CODING_GUNZIP,                  /* LZ77+gzip decompression */
 213   _HTTP_CODING_INFLATE                  /* LZ77+zlib decompression */
 214 } _http_coding_t;
 215
 216 typedef enum _http_mode_e               /**** HTTP mode enumeration ****/
 217 {
 218   _HTTP_MODE_CLIENT,                    /* Client connected to server */
 219   _HTTP_MODE_SERVER                     /* Server connected (accepted) from client */
 220 } _http_mode_t;
 221
 222 #  ifndef _HTTP_NO_PRIVATE
 223 struct _http_s                          /**** HTTP connection structure ****/
 224 {
 225   int                   fd;             /* File descriptor for this socket */
 226   int                   blocking;       /* To block or not to block */
 227   int                   error;          /* Last error on read */
 228   time_t                activity;       /* Time since last read/write */
 229   http_state_t          state;          /* State of client */
 230   http_status_t         status;         /* Status of last request */
 231   http_version_t        version;        /* Protocol version */
 232   http_keepalive_t      keep_alive;     /* Keep-alive supported? */
 233   struct sockaddr_in    _hostaddr;      /* Address of connected host (deprecated) */
 234   char                  hostname[HTTP_MAX_HOST],
 235                                         /* Name of connected host */
 236                         _fields[HTTP_FIELD_ACCEPT_ENCODING][HTTP_MAX_VALUE];
 237                                         /* Field values up to Accept-Encoding (deprecated) */
 238   char                  *data;          /* Pointer to data buffer */
 239   http_encoding_t       data_encoding;  /* Chunked or not */
 240   int                   _data_remaining;/* Number of bytes left (deprecated) */
 241   int                   used;           /* Number of bytes used in buffer */
 242   char                  buffer[HTTP_MAX_BUFFER];
 243                                         /* Buffer for incoming data */
 244   int                   _auth_type;     /* Authentication in use (deprecated) */
 245   unsigned char         _md5_state[88]; /* MD5 state (deprecated) */
 246   char                  nonce[HTTP_MAX_VALUE];
 247                                         /* Nonce value */
 248   unsigned              nonce_count;    /* Nonce count */
 249   http_tls_t            tls;            /* TLS state information */
 250   http_encryption_t     encryption;     /* Encryption requirements */
 251
 252   /**** New in CUPS 1.1.19 ****/
 253   fd_set                *input_set;     /* select() set for httpWait() (deprecated) */
 254   http_status_t         expect;         /* Expect: header */
 255   char                  *cookie;        /* Cookie value(s) */
 256
 257   /**** New in CUPS 1.1.20 ****/
 258   char                  _authstring[HTTP_MAX_VALUE],
 259                                         /* Current Authorization value (deprecated) */
 260                         userpass[HTTP_MAX_VALUE];
 261                                         /* Username:password string */
 262   int                   digest_tries;   /* Number of tries for digest auth */
 263
 264   /**** New in CUPS 1.2 ****/
 265   off_t                 data_remaining; /* Number of bytes left */
 266   http_addr_t           *hostaddr;      /* Current host address and port */
 267   http_addrlist_t       *addrlist;      /* List of valid addresses */
 268   char                  wbuffer[HTTP_MAX_BUFFER];
 269                                         /* Buffer for outgoing data */
 270   int                   wused;          /* Write buffer bytes used */
 271
 272   /**** New in CUPS 1.3 ****/
 273   char                  *authstring;    /* Current Authorization field */
 274 #  ifdef HAVE_GSSAPI
 275   gss_OID               gssmech;        /* Authentication mechanism */
 276   gss_ctx_id_t          gssctx;         /* Authentication context */
 277   gss_name_t            gssname;        /* Authentication server name */
 278 #  endif /* HAVE_GSSAPI */
 279 #  ifdef HAVE_AUTHORIZATION_H
 280   AuthorizationRef      auth_ref;       /* Authorization ref */
 281 #  endif /* HAVE_AUTHORIZATION_H */
 282
 283   /**** New in CUPS 1.5 ****/
 284   http_tls_credentials_t tls_credentials;
 285                                         /* TLS credentials */
 286   http_timeout_cb_t     timeout_cb;     /* Timeout callback */
 287   void                  *timeout_data;  /* User data pointer */
 288   double                timeout_value;  /* Timeout in seconds */
 289   int                   wait_value;     /* httpWait value for timeout */
 290 #  ifdef HAVE_GSSAPI
 291   char                  gsshost[256];   /* Hostname for Kerberos */
 292 #  endif /* HAVE_GSSAPI */
 293
 294   /**** New in CUPS 1.7 ****/
 295   int                   tls_upgrade;    /* Non-zero if we are doing an upgrade */
 296   _http_mode_t          mode;           /* _HTTP_MODE_CLIENT or _HTTP_MODE_SERVER */
 297 #  ifdef HAVE_LIBZ
 298   _http_coding_t        coding;         /* _HTTP_CODING_xxx */
 299   void                  *stream;        /* (De)compression stream */
 300   unsigned char         *sbuffer;       /* (De)compression buffer */
 301 #  endif /* HAVE_LIBZ */
 302
 303   /**** New in CUPS 2.2.9 ****/
 304   char                  algorithm[65],  /* Algorithm from WWW-Authenticate */
 305                         nextnonce[HTTP_MAX_VALUE],
 306                                         /* Next nonce value from Authentication-Info */
 307                         opaque[HTTP_MAX_VALUE],
 308                                         /* Opaque value from WWW-Authenticate */
 309                         realm[HTTP_MAX_VALUE];
 310                                         /* Realm from WWW-Authenticate */
 311
 312   /**** New in CUPS 2.3 ****/
 313   char                  *fields[HTTP_FIELD_MAX],
 314                                         /* Allocated field values */
 315                         *default_fields[HTTP_FIELD_MAX];
 316                                         /* Default field values, if any */
 317 };
 318 #  endif /* !_HTTP_NO_PRIVATE */
 319
 320
 321 /*
 322  * Some OS's don't have hstrerror(), most notably Solaris...
 323  */
 324
 325 #  ifndef HAVE_HSTRERROR
 326 extern const char *_cups_hstrerror(int error);
 327 #    define hstrerror _cups_hstrerror
 328 #  endif /* !HAVE_HSTRERROR */
 329
 330
 331 /*
 332  * Prototypes...
 333  */
 334
 335 extern void             _httpAddrSetPort(http_addr_t *addr, int port) _CUPS_PRIVATE;
 336 extern http_tls_credentials_t
 337                         _httpCreateCredentials(cups_array_t *credentials) _CUPS_PRIVATE;
 338 extern char             *_httpDecodeURI(char *dst, const char *src,
 339                                         size_t dstsize) _CUPS_PRIVATE;
 340 extern void             _httpDisconnect(http_t *http) _CUPS_PRIVATE;
 341 extern char             *_httpEncodeURI(char *dst, const char *src,
 342                                         size_t dstsize) _CUPS_PRIVATE;
 343 extern void             _httpFreeCredentials(http_tls_credentials_t credentials) _CUPS_PRIVATE;
 344 extern const char       *_httpResolveURI(const char *uri, char *resolved_uri,
 345                                          size_t resolved_size, int options,
 346                                          int (*cb)(void *context),
 347                                          void *context) _CUPS_PRIVATE;
 348 extern int              _httpSetDigestAuthString(http_t *http, const char *nonce, const char *method, const char *resource) _CUPS_PRIVATE;
 349 extern const char       *_httpStatus(cups_lang_t *lang, http_status_t status) _CUPS_PRIVATE;
 350 extern void             _httpTLSInitialize(void) _CUPS_PRIVATE;
 351 extern size_t           _httpTLSPending(http_t *http) _CUPS_PRIVATE;
 352 extern int              _httpTLSRead(http_t *http, char *buf, int len) _CUPS_PRIVATE;
 353 extern void             _httpTLSSetOptions(int options, int min_version, int max_version) _CUPS_PRIVATE;
 354 extern int              _httpTLSStart(http_t *http) _CUPS_PRIVATE;
 355 extern void             _httpTLSStop(http_t *http) _CUPS_PRIVATE;
 356 extern int              _httpTLSWrite(http_t *http, const char *buf, int len) _CUPS_PRIVATE;
 357 extern int              _httpUpdate(http_t *http, http_status_t *status) _CUPS_PRIVATE;
 358 extern int              _httpWait(http_t *http, int msec, int usessl) _CUPS_PRIVATE;
 359
 360
 361 /*
 362  * C++ magic...
 363  */
 364
 365 #  ifdef __cplusplus
 366 }
 367 #  endif /* __cplusplus */
 368
 369 #endif /* !_CUPS_HTTP_PRIVATE_H_ */