scheduler/conf.c

   1 /*
   2  * "$Id$"
   3  *
   4  *   Configuration routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 1997-2005 by Easy Software Products, all rights reserved.
   7  *
   8  *   These coded instructions, statements, and computer programs are the
   9  *   property of Easy Software Products and are protected by Federal
  10  *   copyright law.  Distribution and use rights are outlined in the file
  11  *   "LICENSE.txt" which should have been included with this file.  If this
  12  *   file is missing or damaged please contact Easy Software Products
  13  *   at:
  14  *
  15  *       Attn: CUPS Licensing Information
  16  *       Easy Software Products
  17  *       44141 Airport View Drive, Suite 204
  18  *       Hollywood, Maryland 20636 USA
  19  *
  20  *       Voice: (301) 373-9600
  21  *       EMail: cups-info@cups.org
  22  *         WWW: http://www.cups.org
  23  *
  24  * Contents:
  25  *
  26  *   ReadConfiguration()  - Read the cupsd.conf file.
  27  *   read_configuration() - Read a configuration file.
  28  *   read_location()      - Read a <Location path> definition.
  29  *   read_policy()        - Read a <Policy name> definition.
  30  *   get_address()        - Get an address + port number from a line.
  31  *   get_addr_and_mask()  - Get an IP address and netmask.
  32  *   CDSAGetServerCerts() - Convert a keychain name into the CFArrayRef
  33  *                          required by SSLSetCertificate.
  34  */
  35
  36 /*
  37  * Include necessary headers...
  38  */
  39
  40 #include "cupsd.h"
  41 #include <stdarg.h>
  42 #include <pwd.h>
  43 #include <grp.h>
  44 #include <sys/utsname.h>
  45
  46 #ifdef HAVE_DOMAINSOCKETS
  47 #  include <sys/un.h>
  48 #endif /* HAVE_DOMAINSOCKETS */
  49
  50 #ifdef HAVE_CDSASSL
  51 #  include <Security/SecureTransport.h>
  52 #  include <Security/SecIdentitySearch.h>
  53 #endif /* HAVE_CDSASSL */
  54
  55 #ifdef HAVE_VSYSLOG
  56 #  include <syslog.h>
  57 #endif /* HAVE_VSYSLOG */
  58
  59
  60 /*
  61  * Possibly missing network definitions...
  62  */
  63
  64 #ifndef INADDR_NONE
  65 #  define INADDR_NONE   0xffffffff
  66 #endif /* !INADDR_NONE */
  67
  68
  69 /*
  70  * Configuration variable structure...
  71  */
  72
  73 typedef struct
  74 {
  75   char  *name;          /* Name of variable */
  76   void  *ptr;           /* Pointer to variable */
  77   int   type;           /* Type (int, string, address) */
  78 } var_t;
  79
  80 #define VAR_INTEGER     0
  81 #define VAR_STRING      1
  82 #define VAR_BOOLEAN     2
  83
  84
  85 /*
  86  * Local globals...
  87  */
  88
  89 static var_t    variables[] =
  90 {
  91   { "AccessLog",                &AccessLog,             VAR_STRING },
  92   { "AutoPurgeJobs",            &JobAutoPurge,          VAR_BOOLEAN },
  93   { "BrowseInterval",           &BrowseInterval,        VAR_INTEGER },
  94   { "BrowseLocalOptions",       &BrowseLocalOptions,    VAR_STRING },
  95   { "BrowsePort",               &BrowsePort,            VAR_INTEGER },
  96   { "BrowseRemoteOptions",      &BrowseRemoteOptions,   VAR_STRING },
  97   { "BrowseShortNames",         &BrowseShortNames,      VAR_BOOLEAN },
  98   { "BrowseTimeout",            &BrowseTimeout,         VAR_INTEGER },
  99   { "Browsing",                 &Browsing,              VAR_BOOLEAN },
 100   { "Classification",           &Classification,        VAR_STRING },
 101   { "ClassifyOverride",         &ClassifyOverride,      VAR_BOOLEAN },
 102   { "ConfigFilePerm",           &ConfigFilePerm,        VAR_INTEGER },
 103   { "DataDir",                  &DataDir,               VAR_STRING },
 104   { "DefaultCharset",           &DefaultCharset,        VAR_STRING },
 105   { "DefaultLanguage",          &DefaultLanguage,       VAR_STRING },
 106   { "DefaultPolicy",            &DefaultPolicy,         VAR_STRING },
 107   { "DocumentRoot",             &DocumentRoot,          VAR_STRING },
 108   { "ErrorLog",                 &ErrorLog,              VAR_STRING },
 109   { "FaxRetryLimit",            &FaxRetryLimit,         VAR_INTEGER },
 110   { "FaxRetryInterval",         &FaxRetryInterval,      VAR_INTEGER },
 111   { "FileDevice",               &FileDevice,            VAR_BOOLEAN },
 112   { "FilterLimit",              &FilterLimit,           VAR_INTEGER },
 113   { "FilterNice",               &FilterNice,            VAR_INTEGER },
 114   { "FontPath",                 &FontPath,              VAR_STRING },
 115   { "HideImplicitMembers",      &HideImplicitMembers,   VAR_BOOLEAN },
 116   { "ImplicitClasses",          &ImplicitClasses,       VAR_BOOLEAN },
 117   { "ImplicitAnyClasses",       &ImplicitAnyClasses,    VAR_BOOLEAN },
 118   { "KeepAliveTimeout",         &KeepAliveTimeout,      VAR_INTEGER },
 119   { "KeepAlive",                &KeepAlive,             VAR_BOOLEAN },
 120   { "LimitRequestBody",         &MaxRequestSize,        VAR_INTEGER },
 121   { "ListenBackLog",            &ListenBackLog,         VAR_INTEGER },
 122   { "LogFilePerm",              &LogFilePerm,           VAR_INTEGER },
 123   { "MaxActiveJobs",            &MaxActiveJobs,         VAR_INTEGER },
 124   { "MaxClients",               &MaxClients,            VAR_INTEGER },
 125   { "MaxClientsPerHost",        &MaxClientsPerHost,     VAR_INTEGER },
 126   { "MaxCopies",                &MaxCopies,             VAR_INTEGER },
 127   { "MaxJobs",                  &MaxJobs,               VAR_INTEGER },
 128   { "MaxJobsPerPrinter",        &MaxJobsPerPrinter,     VAR_INTEGER },
 129   { "MaxJobsPerUser",           &MaxJobsPerUser,        VAR_INTEGER },
 130   { "MaxLogSize",               &MaxLogSize,            VAR_INTEGER },
 131   { "MaxPrinterHistory",        &MaxPrinterHistory,     VAR_INTEGER },
 132   { "MaxRequestSize",           &MaxRequestSize,        VAR_INTEGER },
 133   { "PageLog",                  &PageLog,               VAR_STRING },
 134   { "PreserveJobFiles",         &JobFiles,              VAR_BOOLEAN },
 135   { "PreserveJobHistory",       &JobHistory,            VAR_BOOLEAN },
 136   { "Printcap",                 &Printcap,              VAR_STRING },
 137   { "PrintcapGUI",              &PrintcapGUI,           VAR_STRING },
 138   { "ReloadTimeout",            &ReloadTimeout,         VAR_INTEGER },
 139   { "RemoteRoot",               &RemoteRoot,            VAR_STRING },
 140   { "RequestRoot",              &RequestRoot,           VAR_STRING },
 141   { "RIPCache",                 &RIPCache,              VAR_STRING },
 142   { "RunAsUser",                &RunAsUser,             VAR_BOOLEAN },
 143   { "RootCertDuration",         &RootCertDuration,      VAR_INTEGER },
 144   { "ServerAdmin",              &ServerAdmin,           VAR_STRING },
 145   { "ServerBin",                &ServerBin,             VAR_STRING },
 146 #ifdef HAVE_SSL
 147   { "ServerCertificate",        &ServerCertificate,     VAR_STRING },
 148 #  if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS)
 149   { "ServerKey",                &ServerKey,             VAR_STRING },
 150 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
 151 #endif /* HAVE_SSL */
 152   { "ServerName",               &ServerName,            VAR_STRING },
 153   { "ServerRoot",               &ServerRoot,            VAR_STRING },
 154   { "StateDir",                 &StateDir,              VAR_STRING },
 155   { "TempDir",                  &TempDir,               VAR_STRING },
 156   { "Timeout",                  &Timeout,               VAR_INTEGER }
 157 };
 158 #define NUM_VARS        (sizeof(variables) / sizeof(variables[0]))
 159
 160
 161 static unsigned         ones[4] =
 162                         {
 163                           0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff
 164                         };
 165 static unsigned         zeros[4] =
 166                         {
 167                           0x00000000, 0x00000000, 0x00000000, 0x00000000
 168                         };
 169
 170 #ifdef HAVE_CDSASSL
 171 static CFArrayRef CDSAGetServerCerts();
 172 #endif /* HAVE_CDSASSL */
 173
 174
 175 /*
 176  * Local functions...
 177  */
 178
 179 static int      read_configuration(cups_file_t *fp);
 180 static int      read_location(cups_file_t *fp, char *name, int linenum);
 181 static int      read_policy(cups_file_t *fp, char *name, int linenum);
 182 static int      get_address(const char *value, unsigned defaddress, int defport,
 183                             int deffamily, http_addr_t *address);
 184 static int      get_addr_and_mask(const char *value, unsigned *ip,
 185                                   unsigned *mask);
 186 static ipp_op_t get_operation(const char *name);
 187
 188
 189 /*
 190  * 'ReadConfiguration()' - Read the cupsd.conf file.
 191  */
 192
 193 int                                     /* O - 1 on success, 0 otherwise */
 194 ReadConfiguration(void)
 195 {
 196   int           i;                      /* Looping var */
 197   cups_file_t   *fp;                    /* Configuration file */
 198   int           status;                 /* Return status */
 199   char          temp[1024],             /* Temporary buffer */
 200                 *slash;                 /* Directory separator */
 201   char          type[MIME_MAX_SUPER + MIME_MAX_TYPE];
 202                                         /* MIME type name */
 203   char          *language;              /* Language string */
 204   struct passwd *user;                  /* Default user */
 205   struct group  *group;                 /* Default group */
 206   char          *old_serverroot,        /* Old ServerRoot */
 207                 *old_requestroot;       /* Old RequestRoot */
 208
 209
 210  /*
 211   * Shutdown the server...
 212   */
 213
 214   StopServer();
 215
 216  /*
 217   * Save the old root paths...
 218   */
 219
 220   old_serverroot = NULL;
 221   SetString(&old_serverroot, ServerRoot);
 222   old_requestroot = NULL;
 223   SetString(&old_requestroot, RequestRoot);
 224
 225  /*
 226   * Reset the server configuration data...
 227   */
 228
 229   DeleteAllLocations();
 230
 231   if (NumBrowsers > 0)
 232   {
 233     free(Browsers);
 234
 235     NumBrowsers = 0;
 236   }
 237
 238   if (NumPolled > 0)
 239   {
 240     free(Polled);
 241
 242     NumPolled = 0;
 243   }
 244
 245   if (NumRelays > 0)
 246   {
 247     for (i = 0; i < NumRelays; i ++)
 248       if (Relays[i].from.type == AUTH_NAME)
 249         free(Relays[i].from.mask.name.name);
 250
 251     free(Relays);
 252
 253     NumRelays = 0;
 254   }
 255
 256   if (NumListeners > 0)
 257   {
 258 #ifdef HAVE_DOMAINSOCKETS
 259     int i;                              /* Looping var */
 260     listener_t  *lis;                   /* Current listening socket */
 261
 262     for (i = NumListeners, lis = Listeners; i > 0; i --, lis ++)
 263       if (lis->address.sin_family == AF_LOCAL)
 264         ClearString((char **)&lis->address.sin_addr);
 265 #endif /* HAVE_DOMAINSOCKETS */
 266
 267     free(Listeners);
 268
 269     NumListeners = 0;
 270   }
 271
 272  /*
 273   * String options...
 274   */
 275
 276   gethostname(temp, sizeof(temp));
 277   SetString(&ServerName, temp);
 278   SetStringf(&ServerAdmin, "root@%s", temp);
 279   SetString(&ServerBin, CUPS_SERVERBIN);
 280   SetString(&RequestRoot, CUPS_REQUESTS);
 281   SetString(&DocumentRoot, CUPS_DOCROOT);
 282   SetString(&DataDir, CUPS_DATADIR);
 283   SetString(&AccessLog, CUPS_LOGDIR "/access_log");
 284   SetString(&ErrorLog, CUPS_LOGDIR "/error_log");
 285   SetString(&PageLog, CUPS_LOGDIR "/page_log");
 286   SetString(&Printcap, "/etc/printcap");
 287   SetString(&PrintcapGUI, "/usr/bin/glpoptions");
 288   SetString(&FontPath, CUPS_FONTPATH);
 289   SetString(&RemoteRoot, "remroot");
 290   SetString(&ServerHeader, "CUPS/1.1");
 291   SetString(&StateDir, CUPS_STATEDIR);
 292
 293   strlcpy(temp, ConfigurationFile, sizeof(temp));
 294   if ((slash = strrchr(temp, '/')) != NULL)
 295     *slash = '\0';
 296
 297   SetString(&ServerRoot, temp);
 298
 299   ClearString(&Classification);
 300   ClassifyOverride  = 0;
 301
 302 #ifdef HAVE_SSL
 303 #  ifdef HAVE_CDSASSL
 304   SetString(&ServerCertificate, "/var/root/Library/Keychains/CUPS");
 305 #  else
 306   SetString(&ServerCertificate, "ssl/server.crt");
 307   SetString(&ServerKey, "ssl/server.key");
 308 #  endif /* HAVE_CDSASSL */
 309 #endif /* HAVE_SSL */
 310
 311   if ((language = DEFAULT_LANGUAGE) == NULL)
 312     language = "en";
 313   else if (strcmp(language, "C") == 0 || strcmp(language, "POSIX") == 0)
 314     language = "en";
 315
 316   SetString(&DefaultLanguage, language);
 317   SetString(&DefaultCharset, DEFAULT_CHARSET);
 318
 319   SetString(&RIPCache, "8m");
 320
 321   if (getenv("TMPDIR") == NULL)
 322     SetString(&TempDir, CUPS_REQUESTS "/tmp");
 323   else
 324     SetString(&TempDir, getenv("TMPDIR"));
 325
 326  /*
 327   * Find the default system group: "sys", "system", or "root"...
 328   */
 329
 330   group = getgrnam(CUPS_DEFAULT_GROUP);
 331   endgrent();
 332
 333   NumSystemGroups = 0;
 334
 335   if (group != NULL)
 336   {
 337     SetString(&SystemGroups[0], CUPS_DEFAULT_GROUP);
 338     Group = group->gr_gid;
 339   }
 340   else
 341   {
 342     group = getgrgid(0);
 343     endgrent();
 344
 345     if (group != NULL)
 346     {
 347       SetString(&SystemGroups[0], group->gr_name);
 348       Group = 0;
 349     }
 350     else
 351     {
 352       SetString(&SystemGroups[0], "unknown");
 353       Group = 0;
 354     }
 355   }
 356
 357  /*
 358   * Find the default user...
 359   */
 360
 361   if ((user = getpwnam(CUPS_DEFAULT_USER)) == NULL)
 362     User = 1;   /* Force to a non-priviledged account */
 363   else
 364     User = user->pw_uid;
 365
 366   endpwent();
 367
 368  /*
 369   * Numeric options...
 370   */
 371
 372   ConfigFilePerm      = 0640;
 373   LogFilePerm         = 0644;
 374
 375   FaxRetryLimit       = 5;
 376   FaxRetryInterval    = 300;
 377   FileDevice          = FALSE;
 378   FilterLevel         = 0;
 379   FilterLimit         = 0;
 380   FilterNice          = 0;
 381   HostNameLookups     = FALSE;
 382   ImplicitClasses     = TRUE;
 383   ImplicitAnyClasses  = FALSE;
 384   HideImplicitMembers = TRUE;
 385   KeepAlive           = TRUE;
 386   KeepAliveTimeout    = DEFAULT_KEEPALIVE;
 387   ListenBackLog       = SOMAXCONN;
 388   LogLevel            = L_ERROR;
 389   MaxClients          = 100;
 390   MaxClientsPerHost   = 0;
 391   MaxLogSize          = 1024 * 1024;
 392   MaxPrinterHistory   = 10;
 393   MaxRequestSize      = 0;
 394   ReloadTimeout       = 60;
 395   RootCertDuration    = 300;
 396   RunAsUser           = FALSE;
 397   Timeout             = DEFAULT_TIMEOUT;
 398
 399   BrowseInterval      = DEFAULT_INTERVAL;
 400   BrowsePort          = ippPort();
 401   BrowseProtocols     = BROWSE_CUPS;
 402   BrowseShortNames    = TRUE;
 403   BrowseTimeout       = DEFAULT_TIMEOUT;
 404   Browsing            = TRUE;
 405
 406   ClearString(&BrowseLocalOptions);
 407   ClearString(&BrowseRemoteOptions);
 408
 409   JobHistory          = DEFAULT_HISTORY;
 410   JobFiles            = DEFAULT_FILES;
 411   JobAutoPurge        = 0;
 412   MaxJobs             = 500;
 413   MaxActiveJobs       = 0;
 414   MaxJobsPerUser      = 0;
 415   MaxJobsPerPrinter   = 0;
 416   MaxCopies           = 100;
 417
 418   ClearString(&DefaultPolicy);
 419
 420  /*
 421   * Read the configuration file...
 422   */
 423
 424   if ((fp = cupsFileOpen(ConfigurationFile, "r")) == NULL)
 425     return (0);
 426
 427   status = read_configuration(fp);
 428
 429   cupsFileClose(fp);
 430
 431   if (!status)
 432     return (0);
 433
 434   if (RunAsUser)
 435     RunUser = User;
 436   else
 437     RunUser = getuid();
 438
 439  /*
 440   * Use the default system group if none was supplied in cupsd.conf...
 441   */
 442
 443   if (NumSystemGroups == 0)
 444     NumSystemGroups ++;
 445
 446  /*
 447   * Get the access control list for browsing...
 448   */
 449
 450   BrowseACL = FindLocation("CUPS_INTERNAL_BROWSE_ACL");
 451
 452  /*
 453   * Open the system log for cupsd if necessary...
 454   */
 455
 456 #ifdef HAVE_VSYSLOG
 457   if (strcmp(AccessLog, "syslog") == 0 ||
 458       strcmp(ErrorLog, "syslog") == 0 ||
 459       strcmp(PageLog, "syslog") == 0)
 460     openlog("cupsd", LOG_PID | LOG_NOWAIT | LOG_NDELAY, LOG_LPR);
 461 #endif /* HAVE_VSYSLOG */
 462
 463  /*
 464   * Log the configuration file that was used...
 465   */
 466
 467   LogMessage(L_INFO, "Loaded configuration file \"%s\"", ConfigurationFile);
 468
 469  /*
 470   * Check that we have at least one listen/port line; if not, report this
 471   * as an error and exit!
 472   */
 473
 474   if (NumListeners == 0)
 475   {
 476    /*
 477     * No listeners!
 478     */
 479
 480     LogMessage(L_EMERG, "No valid Listen or Port lines were found in the configuration file!");
 481
 482    /*
 483     * Commit suicide...
 484     */
 485
 486     cupsdEndProcess(getpid(), 0);
 487   }
 488
 489  /*
 490   * Set the default locale using the language and charset...
 491   */
 492
 493   SetStringf(&DefaultLocale, "%s.%s", DefaultLanguage, DefaultCharset);
 494
 495  /*
 496   * Update all relative filenames to include the full path from ServerRoot...
 497   */
 498
 499   if (DocumentRoot[0] != '/')
 500     SetStringf(&DocumentRoot, "%s/%s", ServerRoot, DocumentRoot);
 501
 502   if (RequestRoot[0] != '/')
 503     SetStringf(&RequestRoot, "%s/%s", ServerRoot, RequestRoot);
 504
 505   if (ServerBin[0] != '/')
 506     SetStringf(&ServerBin, "%s/%s", ServerRoot, ServerBin);
 507
 508 #ifdef HAVE_SSL
 509   if (ServerCertificate[0] != '/')
 510     SetStringf(&ServerCertificate, "%s/%s", ServerRoot, ServerCertificate);
 511
 512 #  if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS)
 513   chown(ServerCertificate, RunUser, Group);
 514   chmod(ServerCertificate, ConfigFilePerm);
 515
 516   if (ServerKey[0] != '/')
 517     SetStringf(&ServerKey, "%s/%s", ServerRoot, ServerKey);
 518
 519   chown(ServerKey, RunUser, Group);
 520   chmod(ServerKey, ConfigFilePerm);
 521 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
 522 #endif /* HAVE_SSL */
 523
 524  /*
 525   * Make sure that directories and config files are owned and
 526   * writable by the user and group in the cupsd.conf file...
 527   */
 528
 529   chown(StateDir, RunUser, Group);
 530   chmod(StateDir, 0775);
 531
 532   snprintf(temp, sizeof(temp), "%s/certs", StateDir);
 533   chown(temp, RunUser, Group);
 534   chmod(temp, 0711);
 535
 536   chown(ServerRoot, RunUser, Group);
 537   chmod(ServerRoot, 0775);
 538
 539   snprintf(temp, sizeof(temp), "%s/ppd", ServerRoot);
 540   chown(temp, RunUser, Group);
 541   chmod(temp, 0755);
 542
 543   snprintf(temp, sizeof(temp), "%s/ssl", ServerRoot);
 544   chown(temp, RunUser, Group);
 545   chmod(temp, 0700);
 546
 547   snprintf(temp, sizeof(temp), "%s/cupsd.conf", ServerRoot);
 548   chown(temp, RunUser, Group);
 549   chmod(temp, ConfigFilePerm);
 550
 551   snprintf(temp, sizeof(temp), "%s/classes.conf", ServerRoot);
 552   chown(temp, RunUser, Group);
 553 #ifdef __APPLE__
 554   chmod(temp, 0600);
 555 #else
 556   chmod(temp, ConfigFilePerm);
 557 #endif /* __APPLE__ */
 558
 559   snprintf(temp, sizeof(temp), "%s/printers.conf", ServerRoot);
 560   chown(temp, RunUser, Group);
 561 #ifdef __APPLE__
 562   chmod(temp, 0600);
 563 #else
 564   chmod(temp, ConfigFilePerm);
 565 #endif /* __APPLE__ */
 566
 567   snprintf(temp, sizeof(temp), "%s/passwd.md5", ServerRoot);
 568   chown(temp, User, Group);
 569   chmod(temp, 0600);
 570
 571  /*
 572   * Make sure the request and temporary directories have the right
 573   * permissions...
 574   */
 575
 576   chown(RequestRoot, RunUser, Group);
 577   chmod(RequestRoot, 0710);
 578
 579   if (strncmp(TempDir, RequestRoot, strlen(RequestRoot)) == 0)
 580   {
 581    /*
 582     * Only update ownership and permissions if the CUPS temp directory
 583     * is under the spool directory...
 584     */
 585
 586     chown(TempDir, RunUser, Group);
 587     chmod(TempDir, 01770);
 588   }
 589
 590  /*
 591   * Check the MaxClients setting, and then allocate memory for it...
 592   */
 593
 594   if (MaxClients > (MaxFDs / 3) || MaxClients <= 0)
 595   {
 596     if (MaxClients > 0)
 597       LogMessage(L_INFO, "MaxClients limited to 1/3 of the file descriptor limit (%d)...",
 598                  MaxFDs);
 599
 600     MaxClients = MaxFDs / 3;
 601   }
 602
 603   if ((Clients = calloc(sizeof(client_t), MaxClients)) == NULL)
 604   {
 605     LogMessage(L_ERROR, "ReadConfiguration: Unable to allocate memory for %d clients: %s",
 606                MaxClients, strerror(errno));
 607     exit(1);
 608   }
 609   else
 610     LogMessage(L_INFO, "Configured for up to %d clients.", MaxClients);
 611
 612  /*
 613   * Check the MaxActiveJobs setting; limit to 1/3 the available
 614   * file descriptors, since we need a pipe for each job...
 615   */
 616
 617   if (MaxActiveJobs > (MaxFDs / 3))
 618     MaxActiveJobs = MaxFDs / 3;
 619
 620   if (Classification && strcasecmp(Classification, "none") == 0)
 621     ClearString(&Classification);
 622
 623   if (Classification)
 624     LogMessage(L_INFO, "Security set to \"%s\"", Classification);
 625
 626  /*
 627   * Update the MaxClientsPerHost value, as needed...
 628   */
 629
 630   if (MaxClientsPerHost <= 0)
 631     MaxClientsPerHost = MaxClients;
 632
 633   if (MaxClientsPerHost > MaxClients)
 634     MaxClientsPerHost = MaxClients;
 635
 636   LogMessage(L_INFO, "Allowing up to %d client connections per host.",
 637              MaxClientsPerHost);
 638
 639  /*
 640   * Update the default policy, as needed...
 641   */
 642
 643   if (DefaultPolicy)
 644     DefaultPolicyPtr = FindPolicy(DefaultPolicy);
 645   else
 646     DefaultPolicyPtr = NULL;
 647
 648   if (!DefaultPolicyPtr)
 649   {
 650     policy_t    *p;                     /* New policy */
 651     policyop_t  *po;                    /* New policy operation */
 652     char        groupname[255];         /* Group name */
 653
 654
 655     if (DefaultPolicy)
 656       LogMessage(L_ERROR, "Default policy \"%s\" not found!", DefaultPolicy);
 657
 658     if ((DefaultPolicyPtr = FindPolicy("default")) != NULL)
 659       LogMessage(L_INFO, "Using policy \"default\" as the default!");
 660     else
 661     {
 662       LogMessage(L_INFO, "Creating CUPS default administrative policy:");
 663
 664       DefaultPolicyPtr = p = AddPolicy("default");
 665
 666       LogMessage(L_INFO, "<Policy default>");
 667       LogMessage(L_INFO, "<Limit Send-Document Send-URI Cancel-Job Hold-Job "
 668                          "Release-Job Restart-Job Purge-Jobs "
 669                          "Set-Job-Attributes Create-Job-Subscription "
 670                          "Renew-Subscription Cancel-Subscription "
 671                          "Get-Notifications Reprocess-Job Cancel-Current-Job "
 672                          "Suspend-Current-Job Resume-Job CUPS-Move-Job>");
 673       LogMessage(L_INFO, "Order Allow,Deny");
 674       LogMessage(L_INFO, "Allow @OWNER");
 675
 676       po = AddPolicyOp(p, NULL, IPP_SEND_DOCUMENT);
 677       po->order_type = POLICY_DENY;
 678
 679       AddPolicyOpName(po, POLICY_ALLOW, "@OWNER");
 680
 681       for (i = 0; i < NumSystemGroups; i ++)
 682       {
 683         snprintf(groupname, sizeof(groupname), "@%s", SystemGroups[i]);
 684         AddPolicyOpName(po, POLICY_ALLOW, groupname);
 685         LogMessage(L_INFO, "Allow @%s", groupname);
 686       }
 687
 688       AddPolicyOp(p, po, IPP_SEND_URI);
 689       AddPolicyOp(p, po, IPP_CANCEL_JOB);
 690       AddPolicyOp(p, po, IPP_HOLD_JOB);
 691       AddPolicyOp(p, po, IPP_RELEASE_JOB);
 692       AddPolicyOp(p, po, IPP_RESTART_JOB);
 693       AddPolicyOp(p, po, IPP_PURGE_JOBS);
 694       AddPolicyOp(p, po, IPP_SET_JOB_ATTRIBUTES);
 695       AddPolicyOp(p, po, IPP_CREATE_JOB_SUBSCRIPTION);
 696       AddPolicyOp(p, po, IPP_RENEW_SUBSCRIPTION);
 697       AddPolicyOp(p, po, IPP_CANCEL_SUBSCRIPTION);
 698       AddPolicyOp(p, po, IPP_GET_NOTIFICATIONS);
 699       AddPolicyOp(p, po, IPP_REPROCESS_JOB);
 700       AddPolicyOp(p, po, IPP_CANCEL_CURRENT_JOB);
 701       AddPolicyOp(p, po, IPP_SUSPEND_CURRENT_JOB);
 702       AddPolicyOp(p, po, IPP_RESUME_JOB);
 703       AddPolicyOp(p, po, CUPS_MOVE_JOB);
 704
 705       LogMessage(L_INFO, "</Limit>");
 706
 707       LogMessage(L_INFO, "<Limit Pause-Printer Resume-Printer "
 708                          "Set-Printer-Attributes Enable-Printer "
 709                          "Disable-Printer Pause-Printer-After-Current-Job "
 710                          "Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer "
 711                          "Activate-Printer Restart-Printer Shutdown-Printer "
 712                          "Startup-Printer Promote-Job Schedule-Job-After "
 713                          "CUPS-Add-Printer CUPS-Delete-Printer "
 714                          "CUPS-Add-Class CUPS-Delete-Class "
 715                          "CUPS-Accept-Jobs CUPS-Reject-Jobs "
 716                          "CUPS-Set-Default CUPS-Add-Device CUPS-Delete-Device>");
 717       LogMessage(L_INFO, "Order Allow,Deny");
 718       LogMessage(L_INFO, "Authenticate yes");
 719
 720       po = AddPolicyOp(p, NULL, IPP_PAUSE_PRINTER);
 721       po->order_type   = POLICY_DENY;
 722       po->authenticate = 1;
 723
 724       for (i = 0; i < NumSystemGroups; i ++)
 725       {
 726         snprintf(groupname, sizeof(groupname), "@%s", SystemGroups[i]);
 727         AddPolicyOpName(po, POLICY_ALLOW, groupname);
 728         LogMessage(L_INFO, "Allow @%s", groupname);
 729       }
 730
 731       AddPolicyOp(p, po, IPP_RESUME_PRINTER);
 732       AddPolicyOp(p, po, IPP_SET_PRINTER_ATTRIBUTES);
 733       AddPolicyOp(p, po, IPP_ENABLE_PRINTER);
 734       AddPolicyOp(p, po, IPP_DISABLE_PRINTER);
 735       AddPolicyOp(p, po, IPP_PAUSE_PRINTER_AFTER_CURRENT_JOB);
 736       AddPolicyOp(p, po, IPP_HOLD_NEW_JOBS);
 737       AddPolicyOp(p, po, IPP_RELEASE_HELD_NEW_JOBS);
 738       AddPolicyOp(p, po, IPP_DEACTIVATE_PRINTER);
 739       AddPolicyOp(p, po, IPP_ACTIVATE_PRINTER);
 740       AddPolicyOp(p, po, IPP_RESTART_PRINTER);
 741       AddPolicyOp(p, po, IPP_SHUTDOWN_PRINTER);
 742       AddPolicyOp(p, po, IPP_STARTUP_PRINTER);
 743       AddPolicyOp(p, po, IPP_PROMOTE_JOB);
 744       AddPolicyOp(p, po, IPP_SCHEDULE_JOB_AFTER);
 745       AddPolicyOp(p, po, CUPS_ADD_PRINTER);
 746       AddPolicyOp(p, po, CUPS_DELETE_PRINTER);
 747       AddPolicyOp(p, po, CUPS_ADD_CLASS);
 748       AddPolicyOp(p, po, CUPS_DELETE_CLASS);
 749       AddPolicyOp(p, po, CUPS_ACCEPT_JOBS);
 750       AddPolicyOp(p, po, CUPS_REJECT_JOBS);
 751       AddPolicyOp(p, po, CUPS_SET_DEFAULT);
 752       AddPolicyOp(p, po, CUPS_ADD_DEVICE);
 753       AddPolicyOp(p, po, CUPS_DELETE_DEVICE);
 754
 755       LogMessage(L_INFO, "</Limit>");
 756
 757       LogMessage(L_INFO, "<Limit All>");
 758       LogMessage(L_INFO, "Order Deny,Allow");
 759
 760       po = AddPolicyOp(p, NULL, IPP_ANY_OPERATION);
 761       po->order_type = POLICY_ALLOW;
 762
 763       LogMessage(L_INFO, "</Limit>");
 764       LogMessage(L_INFO, "</Policy>");
 765     }
 766   }
 767
 768  /*
 769   * If we are doing a full reload or the server root has changed, flush
 770   * the jobs, printers, etc. and start from scratch...
 771   */
 772
 773   if (NeedReload == RELOAD_ALL ||
 774       !old_serverroot || !ServerRoot || strcmp(old_serverroot, ServerRoot) ||
 775       !old_requestroot || !RequestRoot || strcmp(old_requestroot, RequestRoot))
 776   {
 777     LogMessage(L_INFO, "Full reload is required.");
 778
 779    /*
 780     * Free all memory...
 781     */
 782
 783     FreeAllJobs();
 784     DeleteAllClasses();
 785     DeleteAllPrinters();
 786
 787     DefaultPrinter = NULL;
 788
 789     if (PPDs)
 790     {
 791       ippDelete(PPDs);
 792       PPDs = NULL;
 793     }
 794
 795     if (MimeDatabase != NULL)
 796       mimeDelete(MimeDatabase);
 797
 798     if (NumMimeTypes)
 799     {
 800       for (i = 0; i < NumMimeTypes; i ++)
 801         free((void *)MimeTypes[i]);
 802
 803       free(MimeTypes);
 804     }
 805
 806    /*
 807     * Read the MIME type and conversion database...
 808     */
 809
 810     snprintf(temp, sizeof(temp), "%s/filter", ServerBin);
 811
 812     MimeDatabase = mimeLoad(ServerRoot, temp);
 813
 814     LogMessage(L_INFO, "Loaded MIME database from \'%s\': %d types, %d filters...",
 815                ServerRoot, MimeDatabase->num_types, MimeDatabase->num_filters);
 816
 817    /*
 818     * Create a list of MIME types for the document-format-supported
 819     * attribute...
 820     */
 821
 822     NumMimeTypes = MimeDatabase->num_types;
 823     if (!mimeType(MimeDatabase, "application", "octet-stream"))
 824       NumMimeTypes ++;
 825
 826     MimeTypes = calloc(NumMimeTypes, sizeof(const char *));
 827
 828     for (i = 0; i < MimeDatabase->num_types; i ++)
 829     {
 830       snprintf(type, sizeof(type), "%s/%s", MimeDatabase->types[i]->super,
 831                MimeDatabase->types[i]->type);
 832
 833       MimeTypes[i] = strdup(type);
 834     }
 835
 836     if (i < NumMimeTypes)
 837       MimeTypes[i] = strdup("application/octet-stream");
 838
 839    /*
 840     * Load banners...
 841     */
 842
 843     snprintf(temp, sizeof(temp), "%s/banners", DataDir);
 844     LoadBanners(temp);
 845
 846    /*
 847     * Load printers and classes...
 848     */
 849
 850     LoadAllPrinters();
 851     LoadAllClasses();
 852
 853     CreateCommonData();
 854
 855    /*
 856     * Load devices and PPDs...
 857     */
 858
 859     snprintf(temp, sizeof(temp), "%s/model", DataDir);
 860     LoadPPDs(temp);
 861
 862    /*
 863     * Load queued jobs...
 864     */
 865
 866     LoadAllJobs();
 867
 868     LogMessage(L_INFO, "Full reload complete.");
 869   }
 870   else
 871   {
 872     CreateCommonData();
 873
 874     LogMessage(L_INFO, "Partial reload complete.");
 875   }
 876
 877  /*
 878   * Reset the reload state...
 879   */
 880
 881   NeedReload = RELOAD_NONE;
 882
 883   ClearString(&old_serverroot);
 884   ClearString(&old_requestroot);
 885
 886  /*
 887   * Startup the server and return...
 888   */
 889
 890   StartServer();
 891
 892   return (1);
 893 }
 894
 895
 896 /*
 897  * 'read_configuration()' - Read a configuration file.
 898  */
 899
 900 static int                              /* O - 1 on success, 0 on failure */
 901 read_configuration(cups_file_t *fp)     /* I - File to read from */
 902 {
 903   int           i;                      /* Looping var */
 904   int           linenum;                /* Current line number */
 905   char          line[HTTP_MAX_BUFFER],  /* Line from file */
 906                 temp[HTTP_MAX_BUFFER],  /* Temporary buffer for value */
 907                 temp2[HTTP_MAX_BUFFER], /* Temporary buffer 2 for value */
 908                 *ptr,                   /* Pointer into line/temp */
 909                 *value;                 /* Pointer to value */
 910   int           valuelen;               /* Length of value */
 911   var_t         *var;                   /* Current variable */
 912   unsigned      ip[4],                  /* Address value */
 913                 mask[4];                /* Netmask value */
 914   dirsvc_relay_t *relay;                /* Relay data */
 915   dirsvc_poll_t *poll;                  /* Polling data */
 916   http_addr_t   polladdr;               /* Polling address */
 917   location_t    *location;              /* Browse location */
 918   cups_file_t   *incfile;               /* Include file */
 919   char          incname[1024];          /* Include filename */
 920
 921
 922  /*
 923   * Loop through each line in the file...
 924   */
 925
 926   linenum = 0;
 927
 928   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
 929   {
 930    /*
 931     * Decode the directive...
 932     */
 933
 934     if (!strcasecmp(line, "Include"))
 935     {
 936      /*
 937       * Include filename
 938       */
 939
 940       if (value[0] == '/')
 941         strlcpy(incname, value, sizeof(incname));
 942       else
 943         snprintf(incname, sizeof(incname), "%s/%s", ServerRoot, value);
 944
 945       if ((incfile = cupsFileOpen(incname, "rb")) == NULL)
 946         LogMessage(L_ERROR, "Unable to include config file \"%s\" - %s",
 947                    incname, strerror(errno));
 948       else
 949       {
 950         read_configuration(incfile);
 951         cupsFileClose(incfile);
 952       }
 953     }
 954     else if (!strcasecmp(line, "<Location"))
 955     {
 956      /*
 957       * <Location path>
 958       */
 959
 960       if (value)
 961       {
 962         linenum = read_location(fp, value, linenum);
 963         if (linenum == 0)
 964           return (0);
 965       }
 966       else
 967       {
 968         LogMessage(L_ERROR, "Syntax error on line %d.",
 969                    linenum);
 970         return (0);
 971       }
 972     }
 973     else if (!strcasecmp(line, "<Policy"))
 974     {
 975      /*
 976       * <Policy name>
 977       */
 978
 979       if (value)
 980       {
 981         linenum = read_policy(fp, value, linenum);
 982         if (linenum == 0)
 983           return (0);
 984       }
 985       else
 986       {
 987         LogMessage(L_ERROR, "Syntax error on line %d.",
 988                    linenum);
 989         return (0);
 990       }
 991     }
 992     else if (!strcasecmp(line, "Port") || !strcasecmp(line, "Listen"))
 993     {
 994      /*
 995       * Add a listening address to the list...
 996       */
 997
 998       listener_t        *lis;           /* New listeners array */
 999
1000
1001       if (NumListeners == 0)
1002         lis = malloc(sizeof(listener_t));
1003       else
1004         lis = realloc(Listeners, (NumListeners + 1) * sizeof(listener_t));
1005
1006       if (!lis)
1007       {
1008         LogMessage(L_ERROR, "Unable to allocate %s at line %d - %s.",
1009                    line, linenum, strerror(errno));
1010         continue;
1011       }
1012
1013       Listeners = lis;
1014       lis      += NumListeners;
1015
1016       memset(lis, 0, sizeof(listener_t));
1017
1018       if (get_address(value, INADDR_ANY, IPP_PORT, AF_INET, &(lis->address)))
1019       {
1020         httpAddrString(&(lis->address), temp, sizeof(temp));
1021
1022 #ifdef AF_INET6
1023         if (lis->address.addr.sa_family == AF_INET6)
1024           LogMessage(L_INFO, "Listening to %s:%d (IPv6)", temp,
1025                      ntohs(lis->address.ipv6.sin6_port));
1026         else
1027 #endif /* AF_INET6 */
1028         LogMessage(L_INFO, "Listening to %s:%d", temp,
1029                    ntohs(lis->address.ipv4.sin_port));
1030         NumListeners ++;
1031       }
1032       else
1033         LogMessage(L_ERROR, "Bad %s address %s at line %d.", line,
1034                    value, linenum);
1035     }
1036 #ifdef HAVE_SSL
1037     else if (!strcasecmp(line, "SSLPort") || !strcasecmp(line, "SSLListen"))
1038     {
1039      /*
1040       * Add a listening address to the list...
1041       */
1042
1043       listener_t        *lis;           /* New listeners array */
1044
1045
1046       if (NumListeners == 0)
1047         lis = malloc(sizeof(listener_t));
1048       else
1049         lis = realloc(Listeners, (NumListeners + 1) * sizeof(listener_t));
1050
1051       if (!lis)
1052       {
1053         LogMessage(L_ERROR, "Unable to allocate %s at line %d - %s.",
1054                    line, linenum, strerror(errno));
1055         continue;
1056       }
1057
1058       Listeners = lis;
1059       lis      += NumListeners;
1060
1061       if (get_address(value, INADDR_ANY, IPP_PORT, AF_INET, &(lis->address)))
1062       {
1063         httpAddrString(&(lis->address), temp, sizeof(temp));
1064
1065 #ifdef AF_INET6
1066         if (lis->address.addr.sa_family == AF_INET6)
1067           LogMessage(L_INFO, "Listening to %s:%d (IPv6)", temp,
1068                      ntohs(lis->address.ipv6.sin6_port));
1069         else
1070 #endif /* AF_INET6 */
1071         LogMessage(L_INFO, "Listening to %s:%d", temp,
1072                    ntohs(lis->address.ipv4.sin_port));
1073         lis->encryption = HTTP_ENCRYPT_ALWAYS;
1074         NumListeners ++;
1075       }
1076       else
1077         LogMessage(L_ERROR, "Bad %s address %s at line %d.", line,
1078                    value, linenum);
1079     }
1080 #endif /* HAVE_SSL */
1081     else if (!strcasecmp(line, "BrowseAddress"))
1082     {
1083      /*
1084       * Add a browse address to the list...
1085       */
1086
1087       dirsvc_addr_t     *dira;          /* New browse address array */
1088
1089
1090       if (NumBrowsers == 0)
1091         dira = malloc(sizeof(dirsvc_addr_t));
1092       else
1093         dira = realloc(Browsers, (NumBrowsers + 1) * sizeof(dirsvc_addr_t));
1094
1095       if (!dira)
1096       {
1097         LogMessage(L_ERROR, "Unable to allocate BrowseAddress at line %d - %s.",
1098                    linenum, strerror(errno));
1099         continue;
1100       }
1101
1102       Browsers = dira;
1103       dira     += NumBrowsers;
1104
1105       memset(dira, 0, sizeof(dirsvc_addr_t));
1106
1107       if (!strcasecmp(value, "@LOCAL"))
1108       {
1109        /*
1110         * Send browse data to all local interfaces...
1111         */
1112
1113         strcpy(dira->iface, "*");
1114         NumBrowsers ++;
1115       }
1116       else if (!strncasecmp(value, "@IF(", 4))
1117       {
1118        /*
1119         * Send browse data to the named interface...
1120         */
1121
1122         strlcpy(dira->iface, value + 4, sizeof(Browsers[0].iface));
1123
1124         ptr = dira->iface + strlen(dira->iface) - 1;
1125         if (*ptr == ')')
1126           *ptr = '\0';
1127
1128         NumBrowsers ++;
1129       }
1130       else if (get_address(value, INADDR_NONE, BrowsePort, AF_INET, &(dira->to)))
1131       {
1132         httpAddrString(&(dira->to), temp, sizeof(temp));
1133
1134 #ifdef AF_INET6
1135         if (dira->to.addr.sa_family == AF_INET6)
1136           LogMessage(L_INFO, "Sending browsing info to %s:%d (IPv6)", temp,
1137                      ntohs(dira->to.ipv6.sin6_port));
1138         else
1139 #endif /* AF_INET6 */
1140         LogMessage(L_INFO, "Sending browsing info to %s:%d", temp,
1141                    ntohs(dira->to.ipv4.sin_port));
1142
1143         NumBrowsers ++;
1144       }
1145       else
1146         LogMessage(L_ERROR, "Bad BrowseAddress %s at line %d.", value,
1147                    linenum);
1148     }
1149     else if (!strcasecmp(line, "BrowseOrder"))
1150     {
1151      /*
1152       * "BrowseOrder Deny,Allow" or "BrowseOrder Allow,Deny"...
1153       */
1154
1155       if ((location = FindLocation("CUPS_INTERNAL_BROWSE_ACL")) == NULL)
1156         location = AddLocation("CUPS_INTERNAL_BROWSE_ACL");
1157
1158       if (location == NULL)
1159         LogMessage(L_ERROR, "Unable to initialize browse access control list!");
1160       else if (!strncasecmp(value, "deny", 4))
1161         location->order_type = AUTH_ALLOW;
1162       else if (!strncasecmp(value, "allow", 5))
1163         location->order_type = AUTH_DENY;
1164       else
1165         LogMessage(L_ERROR, "Unknown BrowseOrder value %s on line %d.",
1166                    value, linenum);
1167     }
1168     else if (!strcasecmp(line, "BrowseProtocols"))
1169     {
1170      /*
1171       * "BrowseProtocol name [... name]"
1172       */
1173
1174       BrowseProtocols = 0;
1175
1176       for (; *value;)
1177       {
1178         for (valuelen = 0; value[valuelen]; valuelen ++)
1179           if (isspace(value[valuelen]) || value[valuelen] == ',')
1180             break;
1181
1182         if (value[valuelen])
1183         {
1184           value[valuelen] = '\0';
1185           valuelen ++;
1186         }
1187
1188         if (!strcasecmp(value, "cups"))
1189           BrowseProtocols |= BROWSE_CUPS;
1190         else if (!strcasecmp(value, "slp"))
1191           BrowseProtocols |= BROWSE_SLP;
1192         else if (!strcasecmp(value, "ldap"))
1193           BrowseProtocols |= BROWSE_LDAP;
1194         else if (!strcasecmp(value, "all"))
1195           BrowseProtocols |= BROWSE_ALL;
1196         else
1197         {
1198           LogMessage(L_ERROR, "Unknown browse protocol \"%s\" on line %d.",
1199                      value, linenum);
1200           break;
1201         }
1202
1203         for (value += valuelen; *value; value ++)
1204           if (!isspace(*value) || *value != ',')
1205             break;
1206       }
1207     }
1208     else if (!strcasecmp(line, "BrowseAllow") ||
1209              !strcasecmp(line, "BrowseDeny"))
1210     {
1211      /*
1212       * BrowseAllow [From] host/ip...
1213       * BrowseDeny [From] host/ip...
1214       */
1215
1216       if ((location = FindLocation("CUPS_INTERNAL_BROWSE_ACL")) == NULL)
1217         location = AddLocation("CUPS_INTERNAL_BROWSE_ACL");
1218
1219       if (location == NULL)
1220         LogMessage(L_ERROR, "Unable to initialize browse access control list!");
1221       else
1222       {
1223         if (!strncasecmp(value, "from ", 5))
1224         {
1225          /*
1226           * Strip leading "from"...
1227           */
1228
1229           value += 5;
1230
1231           while (isspace(*value))
1232             value ++;
1233         }
1234
1235        /*
1236         * Figure out what form the allow/deny address takes:
1237         *
1238         *    All
1239         *    None
1240         *    *.domain.com
1241         *    .domain.com
1242         *    host.domain.com
1243         *    nnn.*
1244         *    nnn.nnn.*
1245         *    nnn.nnn.nnn.*
1246         *    nnn.nnn.nnn.nnn
1247         *    nnn.nnn.nnn.nnn/mm
1248         *    nnn.nnn.nnn.nnn/mmm.mmm.mmm.mmm
1249         */
1250
1251         if (!strcasecmp(value, "all"))
1252         {
1253          /*
1254           * All hosts...
1255           */
1256
1257           if (!strcasecmp(line, "BrowseAllow"))
1258             AllowIP(location, zeros, zeros);
1259           else
1260             DenyIP(location, zeros, zeros);
1261         }
1262         else if (!strcasecmp(value, "none"))
1263         {
1264          /*
1265           * No hosts...
1266           */
1267
1268           if (!strcasecmp(line, "BrowseAllow"))
1269             AllowIP(location, ones, zeros);
1270           else
1271             DenyIP(location, ones, zeros);
1272         }
1273         else if (value[0] == '*' || value[0] == '.' || !isdigit(value[0]))
1274         {
1275          /*
1276           * Host or domain name...
1277           */
1278
1279           if (value[0] == '*')
1280             value ++;
1281
1282           if (!strcasecmp(line, "BrowseAllow"))
1283             AllowHost(location, value);
1284           else
1285             DenyHost(location, value);
1286         }
1287         else
1288         {
1289          /*
1290           * One of many IP address forms...
1291           */
1292
1293           if (!get_addr_and_mask(value, ip, mask))
1294           {
1295             LogMessage(L_ERROR, "Bad netmask value %s on line %d.",
1296                        value, linenum);
1297             break;
1298           }
1299
1300           if (!strcasecmp(line, "BrowseAllow"))
1301             AllowIP(location, ip, mask);
1302           else
1303             DenyIP(location, ip, mask);
1304         }
1305       }
1306     }
1307     else if (!strcasecmp(line, "BrowseRelay"))
1308     {
1309      /*
1310       * BrowseRelay [from] source [to] destination
1311       */
1312
1313       if (NumRelays == 0)
1314         relay = malloc(sizeof(dirsvc_relay_t));
1315       else
1316         relay = realloc(Relays, (NumRelays + 1) * sizeof(dirsvc_relay_t));
1317
1318       if (!relay)
1319       {
1320         LogMessage(L_ERROR, "Unable to allocate BrowseRelay at line %d - %s.",
1321                    linenum, strerror(errno));
1322         continue;
1323       }
1324
1325       Relays = relay;
1326       relay  += NumRelays;
1327
1328       memset(relay, 0, sizeof(dirsvc_relay_t));
1329
1330       if (!strncasecmp(value, "from ", 5))
1331       {
1332        /*
1333         * Strip leading "from"...
1334         */
1335
1336         value += 5;
1337
1338         while (isspace(*value))
1339           value ++;
1340       }
1341
1342      /*
1343       * Figure out what form the from address takes:
1344       *
1345       *    *.domain.com
1346       *    .domain.com
1347       *    host.domain.com
1348       *    nnn.*
1349       *    nnn.nnn.*
1350       *    nnn.nnn.nnn.*
1351       *    nnn.nnn.nnn.nnn
1352       *    nnn.nnn.nnn.nnn/mm
1353       *    nnn.nnn.nnn.nnn/mmm.mmm.mmm.mmm
1354       */
1355
1356       if (value[0] == '*' || value[0] == '.' || !isdigit(value[0]))
1357       {
1358        /*
1359         * Host or domain name...
1360         */
1361
1362         if (value[0] == '*')
1363           value ++;
1364
1365         strlcpy(temp, value, sizeof(temp));
1366         if ((ptr = strchr(temp, ' ')) != NULL)
1367           *ptr = '\0';
1368
1369         relay->from.type             = AUTH_NAME;
1370         relay->from.mask.name.name   = strdup(temp);
1371         relay->from.mask.name.length = strlen(temp);
1372       }
1373       else
1374       {
1375        /*
1376         * One of many IP address forms...
1377         */
1378
1379         if (!get_addr_and_mask(value, ip, mask))
1380         {
1381           LogMessage(L_ERROR, "Bad netmask value %s on line %d.",
1382                      value, linenum);
1383           break;
1384         }
1385
1386         relay->from.type = AUTH_IP;
1387         memcpy(relay->from.mask.ip.address, ip,
1388                sizeof(relay->from.mask.ip.address));
1389         memcpy(relay->from.mask.ip.netmask, mask,
1390                sizeof(relay->from.mask.ip.netmask));
1391       }
1392
1393      /*
1394       * Skip value and trailing whitespace...
1395       */
1396
1397       for (; *value; value ++)
1398         if (isspace(*value))
1399           break;
1400
1401       while (isspace(*value))
1402         value ++;
1403
1404       if (!strncasecmp(value, "to ", 3))
1405       {
1406        /*
1407         * Strip leading "to"...
1408         */
1409
1410         value += 3;
1411
1412         while (isspace(*value))
1413           value ++;
1414       }
1415
1416      /*
1417       * Get "to" address and port...
1418       */
1419
1420       if (get_address(value, INADDR_BROADCAST, BrowsePort, AF_INET, &(relay->to)))
1421       {
1422         httpAddrString(&(relay->to), temp, sizeof(temp));
1423
1424         if (relay->from.type == AUTH_IP)
1425           snprintf(temp2, sizeof(temp2), "%u.%u.%u.%u/%u.%u.%u.%u",
1426                    relay->from.mask.ip.address[0],
1427                    relay->from.mask.ip.address[1],
1428                    relay->from.mask.ip.address[2],
1429                    relay->from.mask.ip.address[3],
1430                    relay->from.mask.ip.netmask[0],
1431                    relay->from.mask.ip.netmask[1],
1432                    relay->from.mask.ip.netmask[2],
1433                    relay->from.mask.ip.netmask[3]);
1434         else
1435           strlcpy(temp2, relay->from.mask.name.name, sizeof(temp2));
1436
1437 #ifdef AF_INET6
1438         if (relay->to.addr.sa_family == AF_INET6)
1439           LogMessage(L_INFO, "Relaying from %s to %s:%d", temp, temp2,
1440                      ntohs(relay->to.ipv6.sin6_port));
1441         else
1442 #endif /* AF_INET6 */
1443         LogMessage(L_INFO, "Relaying from %s to %s:%d", temp, temp2,
1444                    ntohs(relay->to.ipv4.sin_port));
1445
1446         NumRelays ++;
1447       }
1448       else
1449       {
1450         if (relay->from.type == AUTH_NAME)
1451           free(relay->from.mask.name.name);
1452
1453         LogMessage(L_ERROR, "Bad relay address %s at line %d.", value, linenum);
1454       }
1455     }
1456     else if (!strcasecmp(line, "BrowsePoll"))
1457     {
1458      /*
1459       * BrowsePoll address[:port]
1460       */
1461
1462       if (NumPolled == 0)
1463         poll = malloc(sizeof(dirsvc_poll_t));
1464       else
1465         poll = realloc(Polled, (NumPolled + 1) * sizeof(dirsvc_poll_t));
1466
1467       if (!poll)
1468       {
1469         LogMessage(L_ERROR, "Unable to allocate BrowsePoll at line %d - %s.",
1470                    linenum, strerror(errno));
1471         continue;
1472       }
1473
1474       Polled = poll;
1475       poll   += NumPolled;
1476
1477      /*
1478       * Get poll address and port...
1479       */
1480
1481       if (get_address(value, INADDR_NONE, ippPort(), AF_INET, &polladdr))
1482       {
1483         NumPolled ++;
1484         memset(poll, 0, sizeof(dirsvc_poll_t));
1485
1486         httpAddrString(&polladdr, poll->hostname, sizeof(poll->hostname));
1487
1488 #ifdef AF_INET6
1489         if (polladdr.addr.sa_family == AF_INET6)
1490           poll->port = ntohs(polladdr.ipv6.sin6_port);
1491         else
1492 #endif /* AF_INET6 */
1493         poll->port = ntohs(polladdr.ipv4.sin_port);
1494
1495         LogMessage(L_INFO, "Polling %s:%d", poll->hostname, poll->port);
1496       }
1497       else
1498         LogMessage(L_ERROR, "Bad poll address %s at line %d.", value, linenum);
1499     }
1500     else if (!strcasecmp(line, "User"))
1501     {
1502      /*
1503       * User ID to run as...
1504       */
1505
1506       if (isdigit(value[0]))
1507         User = atoi(value);
1508       else
1509       {
1510         struct passwd *p;       /* Password information */
1511
1512         endpwent();
1513         p = getpwnam(value);
1514
1515         if (p != NULL)
1516           User = p->pw_uid;
1517         else
1518           LogMessage(L_WARN, "Unknown username \"%s\"", value);
1519       }
1520     }
1521     else if (!strcasecmp(line, "Group"))
1522     {
1523      /*
1524       * Group ID to run as...
1525       */
1526
1527       if (isdigit(value[0]))
1528         Group = atoi(value);
1529       else
1530       {
1531         struct group *g;        /* Group information */
1532
1533         endgrent();
1534         g = getgrnam(value);
1535
1536         if (g != NULL)
1537           Group = g->gr_gid;
1538         else
1539           LogMessage(L_WARN, "Unknown groupname \"%s\"", value);
1540       }
1541     }
1542     else if (!strcasecmp(line, "SystemGroup"))
1543     {
1544      /*
1545       * System (admin) group(s)...
1546       */
1547
1548       char      *valueptr,      /* Pointer into value */
1549                 quote;          /* Quote character */
1550
1551
1552       for (i = NumSystemGroups; *value && i < MAX_SYSTEM_GROUPS; i ++)
1553       {
1554         if (*value == '\'' || *value == '\"')
1555         {
1556          /*
1557           * Scan quoted name...
1558           */
1559
1560           quote = *value++;
1561
1562           for (valueptr = value; *valueptr; valueptr ++)
1563             if (*valueptr == quote)
1564               break;
1565         }
1566         else
1567         {
1568          /*
1569           * Scan space or comma-delimited name...
1570           */
1571
1572           for (valueptr = value; *valueptr; valueptr ++)
1573             if (isspace(*valueptr) || *valueptr == ',')
1574               break;
1575         }
1576
1577         if (*valueptr)
1578           *valueptr++ = '\0';
1579
1580         SetString(SystemGroups + i, value);
1581
1582         value = valueptr;
1583
1584         while (*value == ',' || isspace(*value))
1585           value ++;
1586       }
1587
1588       if (i)
1589         NumSystemGroups = i;
1590     }
1591     else if (!strcasecmp(line, "HostNameLookups"))
1592     {
1593      /*
1594       * Do hostname lookups?
1595       */
1596
1597       if (!strcasecmp(value, "off"))
1598         HostNameLookups = 0;
1599       else if (!strcasecmp(value, "on"))
1600         HostNameLookups = 1;
1601       else if (!strcasecmp(value, "double"))
1602         HostNameLookups = 2;
1603       else
1604         LogMessage(L_WARN, "Unknown HostNameLookups %s on line %d.",
1605                    value, linenum);
1606     }
1607     else if (!strcasecmp(line, "LogLevel"))
1608     {
1609      /*
1610       * Amount of logging to do...
1611       */
1612
1613       if (!strcasecmp(value, "debug2"))
1614         LogLevel = L_DEBUG2;
1615       else if (!strcasecmp(value, "debug"))
1616         LogLevel = L_DEBUG;
1617       else if (!strcasecmp(value, "info"))
1618         LogLevel = L_INFO;
1619       else if (!strcasecmp(value, "notice"))
1620         LogLevel = L_NOTICE;
1621       else if (!strcasecmp(value, "warn"))
1622         LogLevel = L_WARN;
1623       else if (!strcasecmp(value, "error"))
1624         LogLevel = L_ERROR;
1625       else if (!strcasecmp(value, "crit"))
1626         LogLevel = L_CRIT;
1627       else if (!strcasecmp(value, "alert"))
1628         LogLevel = L_ALERT;
1629       else if (!strcasecmp(value, "emerg"))
1630         LogLevel = L_EMERG;
1631       else if (!strcasecmp(value, "none"))
1632         LogLevel = L_NONE;
1633       else
1634         LogMessage(L_WARN, "Unknown LogLevel %s on line %d.", value, linenum);
1635     }
1636     else if (!strcasecmp(line, "PrintcapFormat"))
1637     {
1638      /*
1639       * Format of printcap file?
1640       */
1641
1642       if (!strcasecmp(value, "bsd"))
1643         PrintcapFormat = PRINTCAP_BSD;
1644       else if (!strcasecmp(value, "solaris"))
1645         PrintcapFormat = PRINTCAP_SOLARIS;
1646       else
1647         LogMessage(L_WARN, "Unknown PrintcapFormat %s on line %d.",
1648                    value, linenum);
1649     }
1650     else if (!strcasecmp(line, "ServerTokens"))
1651     {
1652      /*
1653       * Set the string used for the Server header...
1654       */
1655
1656       struct utsname plat;            /* Platform info */
1657
1658
1659       uname(&plat);
1660
1661       if (!strcasecmp(value, "ProductOnly"))
1662         SetString(&ServerHeader, "CUPS");
1663       else if (!strcasecmp(value, "Major"))
1664         SetString(&ServerHeader, "CUPS/1");
1665       else if (!strcasecmp(value, "Minor"))
1666         SetString(&ServerHeader, "CUPS/1.1");
1667       else if (!strcasecmp(value, "Minimal"))
1668         SetString(&ServerHeader, CUPS_MINIMAL);
1669       else if (!strcasecmp(value, "OS"))
1670         SetStringf(&ServerHeader, CUPS_MINIMAL " (%s)", plat.sysname);
1671       else if (!strcasecmp(value, "Full"))
1672         SetStringf(&ServerHeader, CUPS_MINIMAL " (%s) IPP/1.1", plat.sysname);
1673       else if (!strcasecmp(value, "None"))
1674         ClearString(&ServerHeader);
1675       else
1676         LogMessage(L_WARN, "Unknown ServerTokens %s on line %d.", value, linenum);
1677     }
1678     else
1679     {
1680      /*
1681       * Find a simple variable in the list...
1682       */
1683
1684       for (i = NUM_VARS, var = variables; i > 0; i --, var ++)
1685         if (!strcasecmp(line, var->name))
1686           break;
1687
1688       if (i == 0)
1689       {
1690        /*
1691         * Unknown directive!  Output an error message and continue...
1692         */
1693
1694         LogMessage(L_ERROR, "Unknown directive %s on line %d.", line,
1695                    linenum);
1696         continue;
1697       }
1698
1699       switch (var->type)
1700       {
1701         case VAR_INTEGER :
1702             {
1703               int       n;      /* Number */
1704               char      *units; /* Units */
1705
1706
1707               n = strtol(value, &units, 0);
1708
1709               if (units && *units)
1710               {
1711                 if (tolower(units[0] & 255) == 'g')
1712                   n *= 1024 * 1024 * 1024;
1713                 else if (tolower(units[0] & 255) == 'm')
1714                   n *= 1024 * 1024;
1715                 else if (tolower(units[0] & 255) == 'k')
1716                   n *= 1024;
1717                 else if (tolower(units[0] & 255) == 't')
1718                   n *= 262144;
1719               }
1720
1721               *((int *)var->ptr) = n;
1722             }
1723             break;
1724
1725         case VAR_BOOLEAN :
1726             if (!strcasecmp(value, "true") ||
1727                 !strcasecmp(value, "on") ||
1728                 !strcasecmp(value, "enabled") ||
1729                 !strcasecmp(value, "yes") ||
1730                 atoi(value) != 0)
1731               *((int *)var->ptr) = TRUE;
1732             else if (!strcasecmp(value, "false") ||
1733                      !strcasecmp(value, "off") ||
1734                      !strcasecmp(value, "disabled") ||
1735                      !strcasecmp(value, "no") ||
1736                      !strcasecmp(value, "0"))
1737               *((int *)var->ptr) = FALSE;
1738             else
1739               LogMessage(L_ERROR, "Unknown boolean value %s on line %d.",
1740                          value, linenum);
1741             break;
1742
1743         case VAR_STRING :
1744             SetString((char **)var->ptr, value);
1745             break;
1746       }
1747     }
1748   }
1749
1750   return (1);
1751 }
1752
1753
1754 /*
1755  * 'read_location()' - Read a <Location path> definition.
1756  */
1757
1758 static int                              /* O - New line number or 0 on error */
1759 read_location(cups_file_t *fp,          /* I - Configuration file */
1760               char        *location,    /* I - Location name/path */
1761               int         linenum)      /* I - Current line number */
1762 {
1763   int           i;                      /* Looping var */
1764   location_t    *loc,                   /* New location */
1765                 *parent;                /* Parent location */
1766   char          line[HTTP_MAX_BUFFER],  /* Line buffer */
1767                 *value,                 /* Value for directive */
1768                 *valptr;                /* Pointer into value */
1769   unsigned      ip[4],                  /* IP address components */
1770                 mask[4];                /* IP netmask components */
1771
1772
1773   if ((parent = AddLocation(location)) == NULL)
1774     return (0);
1775
1776   parent->limit = AUTH_LIMIT_ALL;
1777   loc           = parent;
1778
1779   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
1780   {
1781    /*
1782     * Decode the directive...
1783     */
1784
1785     if (!strcasecmp(line, "</Location>"))
1786       return (linenum);
1787     else if (!strcasecmp(line, "<Limit") ||
1788              !strcasecmp(line, "<LimitExcept"))
1789     {
1790       if (!value)
1791       {
1792         LogMessage(L_ERROR, "Syntax error on line %d.", linenum);
1793         return (0);
1794       }
1795
1796       if ((loc = CopyLocation(&parent)) == NULL)
1797         return (0);
1798
1799       loc->limit = 0;
1800       while (*value)
1801       {
1802         for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
1803
1804         if (*valptr)
1805           *valptr++ = '\0';
1806
1807         if (!strcmp(value, "ALL"))
1808           loc->limit = AUTH_LIMIT_ALL;
1809         else if (!strcmp(value, "GET"))
1810           loc->limit |= AUTH_LIMIT_GET;
1811         else if (!strcmp(value, "HEAD"))
1812           loc->limit |= AUTH_LIMIT_HEAD;
1813         else if (!strcmp(value, "OPTIONS"))
1814           loc->limit |= AUTH_LIMIT_OPTIONS;
1815         else if (!strcmp(value, "POST"))
1816           loc->limit |= AUTH_LIMIT_POST;
1817         else if (!strcmp(value, "PUT"))
1818           loc->limit |= AUTH_LIMIT_PUT;
1819         else if (!strcmp(value, "TRACE"))
1820           loc->limit |= AUTH_LIMIT_TRACE;
1821         else
1822           LogMessage(L_WARN, "Unknown request type %s on line %d!", value,
1823                      linenum);
1824
1825         for (value = valptr; isspace(*value & 255); value ++);
1826       }
1827
1828       if (!strcasecmp(line, "<LimitExcept"))
1829         loc->limit = AUTH_LIMIT_ALL ^ loc->limit;
1830
1831       parent->limit &= ~loc->limit;
1832     }
1833     else if (!strcasecmp(line, "</Limit>"))
1834       loc = parent;
1835     else if (!strcasecmp(line, "Encryption"))
1836     {
1837      /*
1838       * "Encryption xxx" - set required encryption level...
1839       */
1840
1841       if (!strcasecmp(value, "never"))
1842         loc->encryption = HTTP_ENCRYPT_NEVER;
1843       else if (!strcasecmp(value, "always"))
1844       {
1845         LogMessage(L_ERROR, "Encryption value \"%s\" on line %d is invalid in this context. "
1846                             "Using \"required\" instead.", value, linenum);
1847
1848         loc->encryption = HTTP_ENCRYPT_REQUIRED;
1849       }
1850       else if (!strcasecmp(value, "required"))
1851         loc->encryption = HTTP_ENCRYPT_REQUIRED;
1852       else if (!strcasecmp(value, "ifrequested"))
1853         loc->encryption = HTTP_ENCRYPT_IF_REQUESTED;
1854       else
1855         LogMessage(L_ERROR, "Unknown Encryption value %s on line %d.",
1856                    value, linenum);
1857     }
1858     else if (!strcasecmp(line, "Order"))
1859     {
1860      /*
1861       * "Order Deny,Allow" or "Order Allow,Deny"...
1862       */
1863
1864       if (!strncasecmp(value, "deny", 4))
1865         loc->order_type = AUTH_ALLOW;
1866       else if (!strncasecmp(value, "allow", 5))
1867         loc->order_type = AUTH_DENY;
1868       else
1869         LogMessage(L_ERROR, "Unknown Order value %s on line %d.",
1870                    value, linenum);
1871     }
1872     else if (!strcasecmp(line, "Allow") || !strcasecmp(line, "Deny"))
1873     {
1874      /*
1875       * Allow [From] host/ip...
1876       * Deny [From] host/ip...
1877       */
1878
1879       if (!strncasecmp(value, "from", 4))
1880       {
1881        /*
1882         * Strip leading "from"...
1883         */
1884
1885         value += 4;
1886
1887         while (isspace(*value & 255))
1888           value ++;
1889       }
1890
1891      /*
1892       * Figure out what form the allow/deny address takes:
1893       *
1894       *    All
1895       *    None
1896       *    *.domain.com
1897       *    .domain.com
1898       *    host.domain.com
1899       *    nnn.*
1900       *    nnn.nnn.*
1901       *    nnn.nnn.nnn.*
1902       *    nnn.nnn.nnn.nnn
1903       *    nnn.nnn.nnn.nnn/mm
1904       *    nnn.nnn.nnn.nnn/mmm.mmm.mmm.mmm
1905       */
1906
1907       if (!strcasecmp(value, "all"))
1908       {
1909        /*
1910         * All hosts...
1911         */
1912
1913         if (!strcasecmp(line, "Allow"))
1914           AllowIP(loc, zeros, zeros);
1915         else
1916           DenyIP(loc, zeros, zeros);
1917       }
1918       else if (!strcasecmp(value, "none"))
1919       {
1920        /*
1921         * No hosts...
1922         */
1923
1924         if (!strcasecmp(line, "Allow"))
1925           AllowIP(loc, ones, zeros);
1926         else
1927           DenyIP(loc, ones, zeros);
1928       }
1929       else if (value[0] == '*' || value[0] == '.' || !isdigit(value[0] & 255))
1930       {
1931        /*
1932         * Host or domain name...
1933         */
1934
1935         if (value[0] == '*')
1936           value ++;
1937
1938         if (!strcasecmp(line, "Allow"))
1939           AllowHost(loc, value);
1940         else
1941           DenyHost(loc, value);
1942       }
1943       else
1944       {
1945        /*
1946         * One of many IP address forms...
1947         */
1948
1949         if (!get_addr_and_mask(value, ip, mask))
1950         {
1951           LogMessage(L_ERROR, "Bad netmask value %s on line %d.",
1952                      value, linenum);
1953           break;
1954         }
1955
1956         if (!strcasecmp(line, "Allow"))
1957           AllowIP(loc, ip, mask);
1958         else
1959           DenyIP(loc, ip, mask);
1960       }
1961     }
1962     else if (!strcasecmp(line, "AuthType"))
1963     {
1964      /*
1965       * AuthType {none,basic,digest,basicdigest}
1966       */
1967
1968       if (!strcasecmp(value, "none"))
1969       {
1970         loc->type  = AUTH_NONE;
1971         loc->level = AUTH_ANON;
1972       }
1973       else if (!strcasecmp(value, "basic"))
1974       {
1975         loc->type = AUTH_BASIC;
1976
1977         if (loc->level == AUTH_ANON)
1978           loc->level = AUTH_USER;
1979       }
1980       else if (!strcasecmp(value, "digest"))
1981       {
1982         loc->type = AUTH_DIGEST;
1983
1984         if (loc->level == AUTH_ANON)
1985           loc->level = AUTH_USER;
1986       }
1987       else if (!strcasecmp(value, "basicdigest"))
1988       {
1989         loc->type = AUTH_BASICDIGEST;
1990
1991         if (loc->level == AUTH_ANON)
1992           loc->level = AUTH_USER;
1993       }
1994       else
1995         LogMessage(L_WARN, "Unknown authorization type %s on line %d.",
1996                    value, linenum);
1997     }
1998     else if (!strcasecmp(line, "AuthClass"))
1999     {
2000      /*
2001       * AuthClass anonymous, user, system, group
2002       */
2003
2004       if (!strcasecmp(value, "anonymous"))
2005       {
2006         loc->type  = AUTH_NONE;
2007         loc->level = AUTH_ANON;
2008       }
2009       else if (!strcasecmp(value, "user"))
2010         loc->level = AUTH_USER;
2011       else if (!strcasecmp(value, "group"))
2012         loc->level = AUTH_GROUP;
2013       else if (!strcasecmp(value, "system"))
2014       {
2015         loc->level = AUTH_GROUP;
2016
2017        /*
2018         * Use the default system group if none is defined so far...
2019         */
2020
2021         if (NumSystemGroups)
2022           NumSystemGroups = 1;
2023
2024         for (i = 0; i < NumSystemGroups; i ++)
2025           AddName(loc, SystemGroups[i]);
2026       }
2027       else
2028         LogMessage(L_WARN, "Unknown authorization class %s on line %d.",
2029                    value, linenum);
2030     }
2031     else if (!strcasecmp(line, "AuthGroupName"))
2032       AddName(loc, value);
2033     else if (!strcasecmp(line, "Require"))
2034     {
2035      /*
2036       * Apache synonym for AuthClass and AuthGroupName...
2037       *
2038       * Get initial word:
2039       *
2040       *     Require valid-user
2041       *     Require group names
2042       *     Require user names
2043       */
2044
2045       for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2046
2047       if (*valptr)
2048         *valptr++ = '\0';
2049
2050       if (!strcasecmp(value, "valid-user") ||
2051           !strcasecmp(value, "user"))
2052         loc->level = AUTH_USER;
2053       else if (!strcasecmp(value, "group"))
2054         loc->level = AUTH_GROUP;
2055       else
2056       {
2057         LogMessage(L_WARN, "Unknown Require type %s on line %d.",
2058                    value, linenum);
2059         continue;
2060       }
2061
2062      /*
2063       * Get the list of names from the line...
2064       */
2065
2066       for (value = valptr; *value;)
2067       {
2068         while (isspace(*value & 255))
2069           value ++;
2070
2071         if (*value == '\"' || *value == '\'')
2072         {
2073          /*
2074           * Grab quoted name...
2075           */
2076
2077           for (valptr = value + 1; *valptr != *value && *valptr; valptr ++);
2078
2079           value ++;
2080         }
2081         else
2082         {
2083          /*
2084           * Grab literal name.
2085           */
2086
2087           for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2088         }
2089
2090         if (*valptr)
2091           *valptr++ = '\0';
2092
2093         AddName(loc, value);
2094
2095         for (value = valptr; isspace(*value & 255); value ++);
2096       }
2097     }
2098     else if (!strcasecmp(line, "Satisfy"))
2099     {
2100       if (!strcasecmp(value, "all"))
2101         loc->satisfy = AUTH_SATISFY_ALL;
2102       else if (!strcasecmp(value, "any"))
2103         loc->satisfy = AUTH_SATISFY_ANY;
2104       else
2105         LogMessage(L_WARN, "Unknown Satisfy value %s on line %d.", value,
2106                    linenum);
2107     }
2108     else
2109       LogMessage(L_ERROR, "Unknown Location directive %s on line %d.",
2110                  line, linenum);
2111   }
2112
2113   LogMessage(L_ERROR, "Unexpected end-of-file at line %d while reading location!",
2114              linenum);
2115
2116   return (0);
2117 }
2118
2119
2120 /*
2121  * 'read_policy()' - Read a <Policy name> definition.
2122  */
2123
2124 static int                              /* O - New line number or 0 on error */
2125 read_policy(cups_file_t *fp,            /* I - Configuration file */
2126             char        *policy,        /* I - Location name/path */
2127             int         linenum)        /* I - Current line number */
2128 {
2129   int           i;                      /* Looping var */
2130   policy_t      *pol;                   /* Policy */
2131   policyop_t    *op;                    /* Policy operation */
2132   int           num_ops;                /* Number of IPP operations */
2133   ipp_op_t      ops[100];               /* Operations */
2134   char          line[HTTP_MAX_BUFFER],  /* Line buffer */
2135                 *value,                 /* Value for directive */
2136                 *valptr;                /* Pointer into value */
2137
2138
2139  /*
2140   * Create the policy...
2141   */
2142
2143   if ((pol = AddPolicy(policy)) == NULL)
2144     return (0);
2145
2146  /*
2147   * Read from the file...
2148   */
2149
2150   op      = NULL;
2151   num_ops = 0;
2152
2153   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
2154   {
2155    /*
2156     * Decode the directive...
2157     */
2158
2159     if (!strcasecmp(line, "</Policy>"))
2160     {
2161       if (op)
2162         LogMessage(L_WARN, "Missing </Limit> before </Policy> on line %d!",
2163                    linenum);
2164
2165       return (linenum);
2166     }
2167     else if (!strcasecmp(line, "<Limit") && !op)
2168     {
2169       if (!value)
2170       {
2171         LogMessage(L_ERROR, "Syntax error on line %d.", linenum);
2172         return (0);
2173       }
2174
2175      /*
2176       * Scan for IPP operation names...
2177       */
2178
2179       num_ops = 0;
2180
2181       while (*value)
2182       {
2183         for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2184
2185         if (*valptr)
2186           *valptr++ = '\0';
2187
2188         if (num_ops < (int)(sizeof(ops) / sizeof(ops[0])))
2189         {
2190           if ((ops[num_ops] = get_operation(value)) == IPP_BAD_OPERATION)
2191             LogMessage(L_ERROR, "Bad IPP operation name \"%s\" on line %d!",
2192                        value, linenum);
2193           else
2194             num_ops ++;
2195         }
2196         else
2197           LogMessage(L_ERROR, "Too many operations listed on line %d!",
2198                      linenum);
2199
2200         for (value = valptr; isspace(*value & 255); value ++);
2201       }
2202
2203      /*
2204       * If none are specified, apply the policy to all operations...
2205       */
2206
2207       if (num_ops == 0)
2208       {
2209         ops[0]  = IPP_ANY_OPERATION;
2210         num_ops = 1;
2211       }
2212
2213      /*
2214       * Add a new policy for the first operation...
2215       */
2216
2217       op = AddPolicyOp(pol, NULL, ops[0]);
2218     }
2219     else if (!strcasecmp(line, "</Limit>") && op)
2220     {
2221      /*
2222       * Finish the current operation limit...
2223       */
2224
2225       if (num_ops > 1)
2226       {
2227        /*
2228         * Copy the policy to the other operations...
2229         */
2230
2231         for (i = 1; i < num_ops; i ++)
2232           AddPolicyOp(pol, op, ops[i]);
2233       }
2234
2235       op = NULL;
2236     }
2237     else if (!strcasecmp(line, "Authenticate") && op)
2238     {
2239      /*
2240       * Authenticate boolean
2241       */
2242
2243       if (!strcasecmp(value, "on") ||
2244           !strcasecmp(value, "yes") ||
2245           !strcasecmp(value, "true"))
2246         op->authenticate = 1;
2247       else if (!strcasecmp(value, "off") ||
2248                !strcasecmp(value, "no") ||
2249                !strcasecmp(value, "false"))
2250         op->authenticate = 0;
2251       else
2252         LogMessage(L_ERROR, "Invalid Authenticate value \"%s\" on line %d!\n",
2253                    value, linenum);
2254     }
2255     else if (!strcasecmp(line, "Order") && op)
2256     {
2257      /*
2258       * "Order Deny,Allow" or "Order Allow,Deny"...
2259       */
2260
2261       if (!strncasecmp(value, "deny", 4))
2262         op->order_type = POLICY_ALLOW;
2263       else if (!strncasecmp(value, "allow", 5))
2264         op->order_type = POLICY_DENY;
2265       else
2266         LogMessage(L_ERROR, "Unknown Order value %s on line %d.",
2267                    value, linenum);
2268     }
2269     else if ((!strcasecmp(line, "Allow") || !strcasecmp(line, "Deny")) && op)
2270     {
2271      /*
2272       * Allow line, @group, @OWNER
2273       * Deny line, @group, @OWNER
2274       */
2275
2276       while (*value)
2277       {
2278         while (isspace(*value & 255))
2279           value ++;
2280
2281         if (*value == '\"' || *value == '\'')
2282         {
2283          /*
2284           * Grab quoted name...
2285           */
2286
2287           for (valptr = value + 1; *valptr != *value && *valptr; valptr ++);
2288
2289           value ++;
2290         }
2291         else
2292         {
2293          /*
2294           * Grab literal name.
2295           */
2296
2297           for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2298         }
2299
2300         if (*valptr)
2301           *valptr++ = '\0';
2302
2303         if (!strcasecmp(line, "Allow"))
2304           AddPolicyOpName(op, POLICY_ALLOW, value);
2305         else
2306           AddPolicyOpName(op, POLICY_DENY, value);
2307
2308         for (value = valptr; isspace(*value & 255); value ++);
2309       }
2310     }
2311     else if (op)
2312       LogMessage(L_ERROR, "Unknown Policy Limit directive %s on line %d.",
2313                  line, linenum);
2314     else
2315       LogMessage(L_ERROR, "Unknown Policy directive %s on line %d.",
2316                  line, linenum);
2317   }
2318
2319   LogMessage(L_ERROR, "Unexpected end-of-file at line %d while reading policy \"%s\"!",
2320              linenum, policy);
2321
2322   return (0);
2323 }
2324
2325
2326 /*
2327  * 'get_address()' - Get an address + port number from a line.
2328  */
2329
2330 static int                              /* O - 1 if address good, 0 if bad */
2331 get_address(const char  *value,         /* I - Value string */
2332             unsigned    defaddress,     /* I - Default address */
2333             int         defport,        /* I - Default port */
2334             int         deffamily,      /* I - Default family */
2335             http_addr_t *address)       /* O - Socket address */
2336 {
2337   char                  hostname[256],  /* Hostname or IP */
2338                         portname[256];  /* Port number or name */
2339   struct hostent        *host;          /* Host address */
2340   struct servent        *port;          /* Port number */
2341
2342
2343  /*
2344   * Initialize the socket address to the defaults...
2345   */
2346
2347   memset(address, 0, sizeof(http_addr_t));
2348
2349 #ifdef AF_INET6
2350   if (deffamily == AF_INET6)
2351   {
2352     address->ipv6.sin6_family            = AF_INET6;
2353     address->ipv6.sin6_addr.s6_addr32[0] = htonl(defaddress);
2354     address->ipv6.sin6_addr.s6_addr32[1] = htonl(defaddress);
2355     address->ipv6.sin6_addr.s6_addr32[2] = htonl(defaddress);
2356     address->ipv6.sin6_addr.s6_addr32[3] = htonl(defaddress);
2357     address->ipv6.sin6_port              = htons(defport);
2358   }
2359   else
2360 #endif /* AF_INET6 */
2361   {
2362     address->ipv4.sin_family      = AF_INET;
2363     address->ipv4.sin_addr.s_addr = htonl(defaddress);
2364     address->ipv4.sin_port        = htons(defport);
2365   }
2366
2367 #ifdef AF_LOCAL
2368  /*
2369   * If the address starts with a "/", it is a domain socket...
2370   */
2371
2372   if (*value == '/')
2373   {
2374     if (strlen(value) >= sizeof(address->un.sun_path))
2375     {
2376       LogMessage(L_ERROR, "Domain socket name \"%s\" too long!", value);
2377       return (0);
2378     }
2379
2380     address->un.sun_family = AF_LOCAL;
2381     strcpy(address->un.sun_path, value);
2382
2383     return (1);
2384   }
2385 #endif /* AF_LOCAL */
2386
2387  /*
2388   * Try to grab a hostname and port number...
2389   */
2390
2391   switch (sscanf(value, "%255[^:]:%255s", hostname, portname))
2392   {
2393     case 1 :
2394         if (strchr(hostname, '.') == NULL && defaddress == INADDR_ANY)
2395         {
2396          /*
2397           * Hostname is a port number...
2398           */
2399
2400           strlcpy(portname, hostname, sizeof(portname));
2401           hostname[0] = '\0';
2402         }
2403         else
2404           portname[0] = '\0';
2405         break;
2406
2407     case 2 :
2408         break;
2409
2410     default :
2411         LogMessage(L_ERROR, "Unable to decode address \"%s\"!", value);
2412         return (0);
2413   }
2414
2415  /*
2416   * Decode the hostname and port number as needed...
2417   */
2418
2419   if (hostname[0] && strcmp(hostname, "*"))
2420   {
2421     if ((host = httpGetHostByName(hostname)) == NULL)
2422     {
2423       LogMessage(L_ERROR, "httpGetHostByName(\"%s\") failed - %s!", hostname,
2424                  hstrerror(h_errno));
2425       return (0);
2426     }
2427
2428     httpAddrLoad(host, defport, 0, address);
2429   }
2430
2431   if (portname[0] != '\0')
2432   {
2433     if (isdigit(portname[0] & 255))
2434     {
2435 #ifdef AF_INET6
2436       if (address->addr.sa_family == AF_INET6)
2437         address->ipv6.sin6_port = htons(atoi(portname));
2438       else
2439 #endif /* AF_INET6 */
2440       address->ipv4.sin_port = htons(atoi(portname));
2441     }
2442     else
2443     {
2444       if ((port = getservbyname(portname, NULL)) == NULL)
2445       {
2446         LogMessage(L_ERROR, "getservbyname(\"%s\") failed - %s!", portname,
2447                    strerror(errno));
2448         return (0);
2449       }
2450       else
2451       {
2452 #ifdef AF_INET6
2453         if (address->addr.sa_family == AF_INET6)
2454           address->ipv6.sin6_port = htons(port->s_port);
2455         else
2456 #endif /* AF_INET6 */
2457         address->ipv4.sin_port = htons(port->s_port);
2458       }
2459     }
2460   }
2461
2462   return (1);
2463 }
2464
2465
2466 /*
2467  * 'get_addr_and_mask()' - Get an IP address and netmask.
2468  */
2469
2470 static int                              /* O - 1 on success, 0 on failure */
2471 get_addr_and_mask(const char *value,    /* I - String from config file */
2472                   unsigned   *ip,       /* O - Address value */
2473                   unsigned   *mask)     /* O - Mask value */
2474 {
2475   int           i,                      /* Looping var */
2476                 family,                 /* Address family */
2477                 ipcount;                /* Count of fields in address */
2478   static unsigned netmasks[4][4] =      /* Standard netmasks... */
2479   {
2480     { 0xffffffff, 0x00000000, 0x00000000, 0x00000000 },
2481     { 0xffffffff, 0xffffffff, 0x00000000, 0x00000000 },
2482     { 0xffffffff, 0xffffffff, 0xffffffff, 0x00000000 },
2483     { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
2484   };
2485
2486
2487  /*
2488   * Get the address...
2489   */
2490
2491   memset(ip, 0, sizeof(unsigned) * 4);
2492   family  = AF_INET;
2493   ipcount = sscanf(value, "%u.%u.%u.%u", ip + 0, ip + 1, ip + 2, ip + 3);
2494
2495 #ifdef AF_INET6
2496  /*
2497   * See if we have any values > 255; if so, this is an IPv6 address only.
2498   */
2499
2500   for (i = 0; i < ipcount; i ++)
2501     if (ip[0] > 255)
2502     {
2503       family = AF_INET6;
2504       break;
2505     }
2506 #endif /* AF_INET6 */
2507
2508   if ((value = strchr(value, '/')) != NULL)
2509   {
2510    /*
2511     * Get the netmask value(s)...
2512     */
2513
2514     value ++;
2515     memset(mask, 0, sizeof(unsigned) * 4);
2516     switch (sscanf(value, "%u.%u.%u.%u", mask + 0, mask + 1,
2517                    mask + 2, mask + 3))
2518     {
2519       case 1 :
2520 #ifdef AF_INET6
2521           if (mask[0] >= 32)
2522             family = AF_INET6;
2523
2524           if (family == AF_INET6)
2525           {
2526             i = 128 - mask[0];
2527
2528             if (i <= 96)
2529               mask[0] = 0xffffffff;
2530             else
2531               mask[0] = (0xffffffff << (128 - mask[0])) & 0xffffffff;
2532
2533             if (i <= 64)
2534               mask[1] = 0xffffffff;
2535             else if (i >= 96)
2536               mask[1] = 0;
2537             else
2538               mask[1] = (0xffffffff << (96 - mask[0])) & 0xffffffff;
2539
2540             if (i <= 32)
2541               mask[1] = 0xffffffff;
2542             else if (i >= 64)
2543               mask[1] = 0;
2544             else
2545               mask[1] = (0xffffffff << (64 - mask[0])) & 0xffffffff;
2546
2547             if (i >= 32)
2548               mask[1] = 0;
2549             else
2550               mask[1] = (0xffffffff << (32 - mask[0])) & 0xffffffff;
2551           }
2552           else
2553 #endif /* AF_INET6 */
2554           {
2555             i = 32 - mask[0];
2556
2557             if (i <= 24)
2558               mask[0] = 0xffffffff;
2559             else
2560               mask[0] = (0xffffffff << (32 - mask[0])) & 0xffffffff;
2561
2562             if (i <= 16)
2563               mask[1] = 0xffffffff;
2564             else if (i >= 24)
2565               mask[1] = 0;
2566             else
2567               mask[1] = (0xffffffff << (24 - mask[0])) & 0xffffffff;
2568
2569             if (i <= 8)
2570               mask[1] = 0xffffffff;
2571             else if (i >= 16)
2572               mask[1] = 0;
2573             else
2574               mask[1] = (0xffffffff << (16 - mask[0])) & 0xffffffff;
2575
2576             if (i >= 8)
2577               mask[1] = 0;
2578             else
2579               mask[1] = (0xffffffff << (8 - mask[0])) & 0xffffffff;
2580           }
2581
2582       case 4 :
2583           break;
2584
2585       default :
2586           return (0);
2587     }
2588   }
2589   else
2590     memcpy(mask, netmasks[ipcount - 1], sizeof(unsigned) * 4);
2591
2592  /*
2593   * Check for a valid netmask; no fallback like in CUPS 1.1.x!
2594   */
2595
2596   if ((ip[0] & ~mask[0]) != 0 ||
2597       (ip[1] & ~mask[1]) != 0 ||
2598       (ip[2] & ~mask[2]) != 0 ||
2599       (ip[3] & ~mask[3]) != 0)
2600     return (0);
2601
2602   return (1);
2603 }
2604
2605
2606 /*
2607  * 'get_operation()' - Get an IPP opcode from an operation name...
2608  */
2609
2610 static ipp_op_t                         /* O - Operation code or -1 on error */
2611 get_operation(const char *name)         /* I - Operating name */
2612 {
2613   int           i;                      /* Looping var */
2614   static const char * const ipp_ops[] = /* List of standard operations */
2615                 {
2616                   /* 0x0000 */ "all",
2617                   /* 0x0001 */ "",
2618                   /* 0x0002 */ "print-job",
2619                   /* 0x0003 */ "print-uri",
2620                   /* 0x0004 */ "validate-job",
2621                   /* 0x0005 */ "create-job",
2622                   /* 0x0006 */ "send-document",
2623                   /* 0x0007 */ "send-uri",
2624                   /* 0x0008 */ "cancel-job",
2625                   /* 0x0009 */ "get-job-attributes",
2626                   /* 0x000a */ "get-jobs",
2627                   /* 0x000b */ "get-printer-attributes",
2628                   /* 0x000c */ "hold-job",
2629                   /* 0x000d */ "release-job",
2630                   /* 0x000e */ "restart-job",
2631                   /* 0x000f */ "",
2632                   /* 0x0010 */ "pause-printer",
2633                   /* 0x0011 */ "resume-printer",
2634                   /* 0x0012 */ "purge-jobs",
2635                   /* 0x0013 */ "set-printer-attributes",
2636                   /* 0x0014 */ "set-job-attributes",
2637                   /* 0x0015 */ "get-printer-supported-values",
2638                   /* 0x0016 */ "create-printer-subscription",
2639                   /* 0x0017 */ "create-job-subscription",
2640                   /* 0x0018 */ "get-subscription-attributes",
2641                   /* 0x0019 */ "get-subscriptions",
2642                   /* 0x001a */ "renew-subscription",
2643                   /* 0x001b */ "cancel-subscription",
2644                   /* 0x001c */ "get-notifications",
2645                   /* 0x001d */ "send-notifications",
2646                   /* 0x001e */ "",
2647                   /* 0x001f */ "",
2648                   /* 0x0020 */ "",
2649                   /* 0x0021 */ "get-print-support-files",
2650                   /* 0x0022 */ "enable-printer",
2651                   /* 0x0023 */ "disable-printer",
2652                   /* 0x0024 */ "pause-printer-after-current-job",
2653                   /* 0x0025 */ "hold-new-jobs",
2654                   /* 0x0026 */ "release-held-new-jobs",
2655                   /* 0x0027 */ "deactivate-printer",
2656                   /* 0x0028 */ "activate-printer",
2657                   /* 0x0029 */ "restart-printer",
2658                   /* 0x002a */ "shutdown-printer",
2659                   /* 0x002b */ "startup-printer",
2660                   /* 0x002c */ "reprocess-job",
2661                   /* 0x002d */ "cancel-current-job",
2662                   /* 0x002e */ "suspend-current-job",
2663                   /* 0x002f */ "resume-job",
2664                   /* 0x0030 */ "promote-job",
2665                   /* 0x0031 */ "schedule-job-after"
2666                 },
2667                 *cups_ops[] =           /* List of CUPS operations */
2668                 {
2669                   /* 0x4001 */ "cups-get-default",
2670                   /* 0x4002 */ "cups-get-printers",
2671                   /* 0x4003 */ "cups-add-printer",
2672                   /* 0x4004 */ "cups-delete-printer",
2673                   /* 0x4005 */ "cups-get-classes",
2674                   /* 0x4006 */ "cups-add-class",
2675                   /* 0x4007 */ "cups-delete-class",
2676                   /* 0x4008 */ "cups-accept-jobs",
2677                   /* 0x4009 */ "cups-reject-jobs",
2678                   /* 0x400a */ "cups-set-default",
2679                   /* 0x400b */ "cups-get-devices",
2680                   /* 0x400c */ "cups-get-ppds",
2681                   /* 0x400d */ "cups-move-job",
2682                   /* 0x400e */ "cups-add-device",
2683                   /* 0x400f */ "cups-delete-device"
2684                 };
2685
2686
2687   for (i = 0; i < (int)(sizeof(ipp_ops) / sizeof(ipp_ops[0])); i ++)
2688     if (!strcasecmp(name, ipp_ops[i]))
2689       return ((ipp_op_t)i);
2690
2691   for (i = 0; i < (int)(sizeof(cups_ops) / sizeof(cups_ops[0])); i ++)
2692     if (!strcasecmp(name, cups_ops[i]))
2693       return ((ipp_op_t)(i + 0x4001));
2694
2695   return ((ipp_op_t)-1);
2696 }
2697
2698
2699 #ifdef HAVE_CDSASSL
2700 /*
2701  * 'CDSAGetServerCerts()' - Convert a keychain name into the CFArrayRef
2702  *                          required by SSLSetCertificate.
2703  *
2704  * For now we assumes that there is exactly one SecIdentity in the
2705  * keychain - i.e. there is exactly one matching cert/private key pair.
2706  * In the future we will search a keychain for a SecIdentity matching a
2707  * specific criteria.  We also skip the operation of adding additional
2708  * non-signing certs from the keychain to the CFArrayRef.
2709  *
2710  * To create a self-signed certificate for testing use the certtool.
2711  * Executing the following as root will do it:
2712  *
2713  *     certtool c c v k=CUPS
2714  */
2715
2716 static CFArrayRef
2717 CDSAGetServerCerts(void)
2718 {
2719   OSStatus              err;            /* Error info */
2720   SecKeychainRef        kcRef;          /* Keychain reference */
2721   SecIdentitySearchRef  srchRef;        /* Search reference */
2722   SecIdentityRef        identity;       /* Identity */
2723   CFArrayRef            ca;             /* Certificate array */
2724
2725
2726   kcRef    = NULL;
2727   srchRef  = NULL;
2728   identity = NULL;
2729   ca       = NULL;
2730   err      = SecKeychainOpen(ServerCertificate, &kcRef);
2731
2732   if (err)
2733     LogMessage(L_ERROR, "Cannot open keychain \"%s\", error %d.",
2734                ServerCertificate, err);
2735   else
2736   {
2737    /*
2738     * Search for "any" identity matching specified key use;
2739     * in this app, we expect there to be exactly one.
2740     */
2741
2742     err = SecIdentitySearchCreate(kcRef, CSSM_KEYUSE_SIGN, &srchRef);
2743
2744     if (err)
2745       LogMessage(L_ERROR,
2746                  "Cannot find signing key in keychain \"%s\", error %d",
2747                  ServerCertificate, err);
2748     else
2749     {
2750       err = SecIdentitySearchCopyNext(srchRef, &identity);
2751
2752       if (err)
2753         LogMessage(L_ERROR,
2754                    "Cannot find signing key in keychain \"%s\", error %d",
2755                    ServerCertificate, err);
2756       else
2757       {
2758         if (CFGetTypeID(identity) != SecIdentityGetTypeID())
2759           LogMessage(L_ERROR, "SecIdentitySearchCopyNext CFTypeID failure!");
2760         else
2761         {
2762          /*
2763           * Found one. Place it in a CFArray.
2764           * TBD: snag other (non-identity) certs from keychain and add them
2765           * to array as well.
2766           */
2767
2768           ca = CFArrayCreate(NULL, (const void **)&identity, 1, NULL);
2769
2770           if (ca == nil)
2771             LogMessage(L_ERROR, "CFArrayCreate error");
2772         }
2773
2774         /*CFRelease(identity);*/
2775       }
2776
2777       /*CFRelease(srchRef);*/
2778     }
2779
2780     /*CFRelease(kcRef);*/
2781   }
2782
2783   return ca;
2784 }
2785 #endif /* HAVE_CDSASSL */
2786
2787
2788 /*
2789  * End of "$Id$".
2790  */