scheduler/conf.c

   1 /*
   2  * "$Id$"
   3  *
   4  *   Configuration routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 1997-2005 by Easy Software Products, all rights reserved.
   7  *
   8  *   These coded instructions, statements, and computer programs are the
   9  *   property of Easy Software Products and are protected by Federal
  10  *   copyright law.  Distribution and use rights are outlined in the file
  11  *   "LICENSE.txt" which should have been included with this file.  If this
  12  *   file is missing or damaged please contact Easy Software Products
  13  *   at:
  14  *
  15  *       Attn: CUPS Licensing Information
  16  *       Easy Software Products
  17  *       44141 Airport View Drive, Suite 204
  18  *       Hollywood, Maryland 20636 USA
  19  *
  20  *       Voice: (301) 373-9600
  21  *       EMail: cups-info@cups.org
  22  *         WWW: http://www.cups.org
  23  *
  24  * Contents:
  25  *
  26  *   ReadConfiguration()  - Read the cupsd.conf file.
  27  *   read_configuration() - Read a configuration file.
  28  *   read_location()      - Read a <Location path> definition.
  29  *   read_policy()        - Read a <Policy name> definition.
  30  *   get_address()        - Get an address + port number from a line.
  31  *   get_addr_and_mask()  - Get an IP address and netmask.
  32  *   CDSAGetServerCerts() - Convert a keychain name into the CFArrayRef
  33  *                          required by SSLSetCertificate.
  34  */
  35
  36 /*
  37  * Include necessary headers...
  38  */
  39
  40 #include "cupsd.h"
  41 #include <stdarg.h>
  42 #include <pwd.h>
  43 #include <grp.h>
  44 #include <sys/utsname.h>
  45
  46 #ifdef HAVE_DOMAINSOCKETS
  47 #  include <sys/un.h>
  48 #endif /* HAVE_DOMAINSOCKETS */
  49
  50 #ifdef HAVE_CDSASSL
  51 #  include <Security/SecureTransport.h>
  52 #  include <Security/SecIdentitySearch.h>
  53 #endif /* HAVE_CDSASSL */
  54
  55 #ifdef HAVE_VSYSLOG
  56 #  include <syslog.h>
  57 #endif /* HAVE_VSYSLOG */
  58
  59
  60 /*
  61  * Possibly missing network definitions...
  62  */
  63
  64 #ifndef INADDR_NONE
  65 #  define INADDR_NONE   0xffffffff
  66 #endif /* !INADDR_NONE */
  67
  68
  69 /*
  70  * Configuration variable structure...
  71  */
  72
  73 typedef struct
  74 {
  75   char  *name;          /* Name of variable */
  76   void  *ptr;           /* Pointer to variable */
  77   int   type;           /* Type (int, string, address) */
  78 } var_t;
  79
  80 #define VAR_INTEGER     0
  81 #define VAR_STRING      1
  82 #define VAR_BOOLEAN     2
  83
  84
  85 /*
  86  * Local globals...
  87  */
  88
  89 static var_t    variables[] =
  90 {
  91   { "AccessLog",                &AccessLog,             VAR_STRING },
  92   { "AutoPurgeJobs",            &JobAutoPurge,          VAR_BOOLEAN },
  93   { "BrowseInterval",           &BrowseInterval,        VAR_INTEGER },
  94   { "BrowseLocalOptions",       &BrowseLocalOptions,    VAR_STRING },
  95   { "BrowsePort",               &BrowsePort,            VAR_INTEGER },
  96   { "BrowseRemoteOptions",      &BrowseRemoteOptions,   VAR_STRING },
  97   { "BrowseShortNames",         &BrowseShortNames,      VAR_BOOLEAN },
  98   { "BrowseTimeout",            &BrowseTimeout,         VAR_INTEGER },
  99   { "Browsing",                 &Browsing,              VAR_BOOLEAN },
 100   { "Classification",           &Classification,        VAR_STRING },
 101   { "ClassifyOverride",         &ClassifyOverride,      VAR_BOOLEAN },
 102   { "ConfigFilePerm",           &ConfigFilePerm,        VAR_INTEGER },
 103   { "DataDir",                  &DataDir,               VAR_STRING },
 104   { "DefaultCharset",           &DefaultCharset,        VAR_STRING },
 105   { "DefaultLanguage",          &DefaultLanguage,       VAR_STRING },
 106   { "DefaultPolicy",            &DefaultPolicy,         VAR_STRING },
 107   { "DocumentRoot",             &DocumentRoot,          VAR_STRING },
 108   { "ErrorLog",                 &ErrorLog,              VAR_STRING },
 109   { "FaxRetryLimit",            &FaxRetryLimit,         VAR_INTEGER },
 110   { "FaxRetryInterval",         &FaxRetryInterval,      VAR_INTEGER },
 111   { "FileDevice",               &FileDevice,            VAR_BOOLEAN },
 112   { "FilterLimit",              &FilterLimit,           VAR_INTEGER },
 113   { "FilterNice",               &FilterNice,            VAR_INTEGER },
 114   { "FontPath",                 &FontPath,              VAR_STRING },
 115   { "HideImplicitMembers",      &HideImplicitMembers,   VAR_BOOLEAN },
 116   { "ImplicitClasses",          &ImplicitClasses,       VAR_BOOLEAN },
 117   { "ImplicitAnyClasses",       &ImplicitAnyClasses,    VAR_BOOLEAN },
 118   { "KeepAliveTimeout",         &KeepAliveTimeout,      VAR_INTEGER },
 119   { "KeepAlive",                &KeepAlive,             VAR_BOOLEAN },
 120   { "LimitRequestBody",         &MaxRequestSize,        VAR_INTEGER },
 121   { "ListenBackLog",            &ListenBackLog,         VAR_INTEGER },
 122   { "LogFilePerm",              &LogFilePerm,           VAR_INTEGER },
 123   { "MaxActiveJobs",            &MaxActiveJobs,         VAR_INTEGER },
 124   { "MaxClients",               &MaxClients,            VAR_INTEGER },
 125   { "MaxClientsPerHost",        &MaxClientsPerHost,     VAR_INTEGER },
 126   { "MaxCopies",                &MaxCopies,             VAR_INTEGER },
 127   { "MaxJobs",                  &MaxJobs,               VAR_INTEGER },
 128   { "MaxJobsPerPrinter",        &MaxJobsPerPrinter,     VAR_INTEGER },
 129   { "MaxJobsPerUser",           &MaxJobsPerUser,        VAR_INTEGER },
 130   { "MaxLogSize",               &MaxLogSize,            VAR_INTEGER },
 131   { "MaxPrinterHistory",        &MaxPrinterHistory,     VAR_INTEGER },
 132   { "MaxRequestSize",           &MaxRequestSize,        VAR_INTEGER },
 133   { "PageLog",                  &PageLog,               VAR_STRING },
 134   { "PreserveJobFiles",         &JobFiles,              VAR_BOOLEAN },
 135   { "PreserveJobHistory",       &JobHistory,            VAR_BOOLEAN },
 136   { "Printcap",                 &Printcap,              VAR_STRING },
 137   { "PrintcapGUI",              &PrintcapGUI,           VAR_STRING },
 138   { "ReloadTimeout",            &ReloadTimeout,         VAR_INTEGER },
 139   { "RemoteRoot",               &RemoteRoot,            VAR_STRING },
 140   { "RequestRoot",              &RequestRoot,           VAR_STRING },
 141   { "RIPCache",                 &RIPCache,              VAR_STRING },
 142   { "RunAsUser",                &RunAsUser,             VAR_BOOLEAN },
 143   { "RootCertDuration",         &RootCertDuration,      VAR_INTEGER },
 144   { "ServerAdmin",              &ServerAdmin,           VAR_STRING },
 145   { "ServerBin",                &ServerBin,             VAR_STRING },
 146 #ifdef HAVE_SSL
 147   { "ServerCertificate",        &ServerCertificate,     VAR_STRING },
 148 #  if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS)
 149   { "ServerKey",                &ServerKey,             VAR_STRING },
 150 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
 151 #endif /* HAVE_SSL */
 152   { "ServerName",               &ServerName,            VAR_STRING },
 153   { "ServerRoot",               &ServerRoot,            VAR_STRING },
 154   { "TempDir",                  &TempDir,               VAR_STRING },
 155   { "Timeout",                  &Timeout,               VAR_INTEGER }
 156 };
 157 #define NUM_VARS        (sizeof(variables) / sizeof(variables[0]))
 158
 159
 160 static unsigned         ones[4] =
 161                         {
 162                           0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff
 163                         };
 164 static unsigned         zeros[4] =
 165                         {
 166                           0x00000000, 0x00000000, 0x00000000, 0x00000000
 167                         };
 168
 169 #ifdef HAVE_CDSASSL
 170 static CFArrayRef CDSAGetServerCerts();
 171 #endif /* HAVE_CDSASSL */
 172
 173
 174 /*
 175  * Local functions...
 176  */
 177
 178 static int      read_configuration(cups_file_t *fp);
 179 static int      read_location(cups_file_t *fp, char *name, int linenum);
 180 static int      read_policy(cups_file_t *fp, char *name, int linenum);
 181 static int      get_address(const char *value, unsigned defaddress, int defport,
 182                             int deffamily, http_addr_t *address);
 183 static int      get_addr_and_mask(const char *value, unsigned *ip,
 184                                   unsigned *mask);
 185 static ipp_op_t get_operation(const char *name);
 186
 187
 188 /*
 189  * 'ReadConfiguration()' - Read the cupsd.conf file.
 190  */
 191
 192 int                                     /* O - 1 on success, 0 otherwise */
 193 ReadConfiguration(void)
 194 {
 195   int           i;                      /* Looping var */
 196   cups_file_t   *fp;                    /* Configuration file */
 197   int           status;                 /* Return status */
 198   char          temp[1024],             /* Temporary buffer */
 199                 *slash;                 /* Directory separator */
 200   char          type[MIME_MAX_SUPER + MIME_MAX_TYPE];
 201                                         /* MIME type name */
 202   char          *language;              /* Language string */
 203   struct passwd *user;                  /* Default user */
 204   struct group  *group;                 /* Default group */
 205   char          *old_serverroot,        /* Old ServerRoot */
 206                 *old_requestroot;       /* Old RequestRoot */
 207
 208
 209  /*
 210   * Shutdown the server...
 211   */
 212
 213   StopServer();
 214
 215  /*
 216   * Save the old root paths...
 217   */
 218
 219   old_serverroot = NULL;
 220   SetString(&old_serverroot, ServerRoot);
 221   old_requestroot = NULL;
 222   SetString(&old_requestroot, RequestRoot);
 223
 224  /*
 225   * Reset the server configuration data...
 226   */
 227
 228   DeleteAllLocations();
 229
 230   if (NumBrowsers > 0)
 231   {
 232     free(Browsers);
 233
 234     NumBrowsers = 0;
 235   }
 236
 237   if (NumPolled > 0)
 238   {
 239     free(Polled);
 240
 241     NumPolled = 0;
 242   }
 243
 244   if (NumRelays > 0)
 245   {
 246     for (i = 0; i < NumRelays; i ++)
 247       if (Relays[i].from.type == AUTH_NAME)
 248         free(Relays[i].from.mask.name.name);
 249
 250     free(Relays);
 251
 252     NumRelays = 0;
 253   }
 254
 255   if (NumListeners > 0)
 256   {
 257 #ifdef HAVE_DOMAINSOCKETS
 258     int i;                              /* Looping var */
 259     listener_t  *lis;                   /* Current listening socket */
 260
 261     for (i = NumListeners, lis = Listeners; i > 0; i --, lis ++)
 262       if (lis->address.sin_family == AF_LOCAL)
 263         ClearString((char **)&lis->address.sin_addr);
 264 #endif /* HAVE_DOMAINSOCKETS */
 265
 266     free(Listeners);
 267
 268     NumListeners = 0;
 269   }
 270
 271  /*
 272   * String options...
 273   */
 274
 275   gethostname(temp, sizeof(temp));
 276   SetString(&ServerName, temp);
 277   SetStringf(&ServerAdmin, "root@%s", temp);
 278   SetString(&ServerBin, CUPS_SERVERBIN);
 279   SetString(&RequestRoot, CUPS_REQUESTS);
 280   SetString(&DocumentRoot, CUPS_DOCROOT);
 281   SetString(&DataDir, CUPS_DATADIR);
 282   SetString(&AccessLog, CUPS_LOGDIR "/access_log");
 283   SetString(&ErrorLog, CUPS_LOGDIR "/error_log");
 284   SetString(&PageLog, CUPS_LOGDIR "/page_log");
 285   SetString(&Printcap, "/etc/printcap");
 286   SetString(&PrintcapGUI, "/usr/bin/glpoptions");
 287   SetString(&FontPath, CUPS_FONTPATH);
 288   SetString(&RemoteRoot, "remroot");
 289   SetString(&ServerHeader, "CUPS/1.1");
 290
 291   strlcpy(temp, ConfigurationFile, sizeof(temp));
 292   if ((slash = strrchr(temp, '/')) != NULL)
 293     *slash = '\0';
 294
 295   SetString(&ServerRoot, temp);
 296
 297   ClearString(&Classification);
 298   ClassifyOverride  = 0;
 299
 300 #ifdef HAVE_SSL
 301 #  ifdef HAVE_CDSASSL
 302   SetString(&ServerCertificate, "/var/root/Library/Keychains/CUPS");
 303 #  else
 304   SetString(&ServerCertificate, "ssl/server.crt");
 305   SetString(&ServerKey, "ssl/server.key");
 306 #  endif /* HAVE_CDSASSL */
 307 #endif /* HAVE_SSL */
 308
 309   if ((language = DEFAULT_LANGUAGE) == NULL)
 310     language = "en";
 311   else if (strcmp(language, "C") == 0 || strcmp(language, "POSIX") == 0)
 312     language = "en";
 313
 314   SetString(&DefaultLanguage, language);
 315   SetString(&DefaultCharset, DEFAULT_CHARSET);
 316
 317   SetString(&RIPCache, "8m");
 318
 319   if (getenv("TMPDIR") == NULL)
 320     SetString(&TempDir, CUPS_REQUESTS "/tmp");
 321   else
 322     SetString(&TempDir, getenv("TMPDIR"));
 323
 324  /*
 325   * Find the default system group: "sys", "system", or "root"...
 326   */
 327
 328   group = getgrnam(CUPS_DEFAULT_GROUP);
 329   endgrent();
 330
 331   NumSystemGroups = 0;
 332
 333   if (group != NULL)
 334   {
 335     SetString(&SystemGroups[0], CUPS_DEFAULT_GROUP);
 336     Group = group->gr_gid;
 337   }
 338   else
 339   {
 340     group = getgrgid(0);
 341     endgrent();
 342
 343     if (group != NULL)
 344     {
 345       SetString(&SystemGroups[0], group->gr_name);
 346       Group = 0;
 347     }
 348     else
 349     {
 350       SetString(&SystemGroups[0], "unknown");
 351       Group = 0;
 352     }
 353   }
 354
 355  /*
 356   * Find the default user...
 357   */
 358
 359   if ((user = getpwnam(CUPS_DEFAULT_USER)) == NULL)
 360     User = 1;   /* Force to a non-priviledged account */
 361   else
 362     User = user->pw_uid;
 363
 364   endpwent();
 365
 366  /*
 367   * Numeric options...
 368   */
 369
 370   ConfigFilePerm      = 0640;
 371   LogFilePerm         = 0644;
 372
 373   FaxRetryLimit       = 5;
 374   FaxRetryInterval    = 300;
 375   FileDevice          = FALSE;
 376   FilterLevel         = 0;
 377   FilterLimit         = 0;
 378   FilterNice          = 0;
 379   HostNameLookups     = FALSE;
 380   ImplicitClasses     = TRUE;
 381   ImplicitAnyClasses  = FALSE;
 382   HideImplicitMembers = TRUE;
 383   KeepAlive           = TRUE;
 384   KeepAliveTimeout    = DEFAULT_KEEPALIVE;
 385   ListenBackLog       = SOMAXCONN;
 386   LogLevel            = L_ERROR;
 387   MaxClients          = 100;
 388   MaxClientsPerHost   = 0;
 389   MaxLogSize          = 1024 * 1024;
 390   MaxPrinterHistory   = 10;
 391   MaxRequestSize      = 0;
 392   ReloadTimeout       = 60;
 393   RootCertDuration    = 300;
 394   RunAsUser           = FALSE;
 395   Timeout             = DEFAULT_TIMEOUT;
 396
 397   BrowseInterval      = DEFAULT_INTERVAL;
 398   BrowsePort          = ippPort();
 399   BrowseProtocols     = BROWSE_CUPS;
 400   BrowseShortNames    = TRUE;
 401   BrowseTimeout       = DEFAULT_TIMEOUT;
 402   Browsing            = TRUE;
 403
 404   ClearString(&BrowseLocalOptions);
 405   ClearString(&BrowseRemoteOptions);
 406
 407   JobHistory          = DEFAULT_HISTORY;
 408   JobFiles            = DEFAULT_FILES;
 409   JobAutoPurge        = 0;
 410   MaxJobs             = 500;
 411   MaxActiveJobs       = 0;
 412   MaxJobsPerUser      = 0;
 413   MaxJobsPerPrinter   = 0;
 414   MaxCopies           = 100;
 415
 416   ClearString(&DefaultPolicy);
 417
 418  /*
 419   * Read the configuration file...
 420   */
 421
 422   if ((fp = cupsFileOpen(ConfigurationFile, "r")) == NULL)
 423     return (0);
 424
 425   status = read_configuration(fp);
 426
 427   cupsFileClose(fp);
 428
 429   if (!status)
 430     return (0);
 431
 432   if (RunAsUser)
 433     RunUser = User;
 434   else
 435     RunUser = getuid();
 436
 437  /*
 438   * Use the default system group if none was supplied in cupsd.conf...
 439   */
 440
 441   if (NumSystemGroups == 0)
 442     NumSystemGroups ++;
 443
 444  /*
 445   * Get the access control list for browsing...
 446   */
 447
 448   BrowseACL = FindLocation("CUPS_INTERNAL_BROWSE_ACL");
 449
 450  /*
 451   * Open the system log for cupsd if necessary...
 452   */
 453
 454 #ifdef HAVE_VSYSLOG
 455   if (strcmp(AccessLog, "syslog") == 0 ||
 456       strcmp(ErrorLog, "syslog") == 0 ||
 457       strcmp(PageLog, "syslog") == 0)
 458     openlog("cupsd", LOG_PID | LOG_NOWAIT | LOG_NDELAY, LOG_LPR);
 459 #endif /* HAVE_VSYSLOG */
 460
 461  /*
 462   * Log the configuration file that was used...
 463   */
 464
 465   LogMessage(L_INFO, "Loaded configuration file \"%s\"", ConfigurationFile);
 466
 467  /*
 468   * Check that we have at least one listen/port line; if not, report this
 469   * as an error and exit!
 470   */
 471
 472   if (NumListeners == 0)
 473   {
 474    /*
 475     * No listeners!
 476     */
 477
 478     LogMessage(L_EMERG, "No valid Listen or Port lines were found in the configuration file!");
 479
 480    /*
 481     * Commit suicide...
 482     */
 483
 484     kill(getpid(), SIGTERM);
 485   }
 486
 487  /*
 488   * Set the default locale using the language and charset...
 489   */
 490
 491   SetStringf(&DefaultLocale, "%s.%s", DefaultLanguage, DefaultCharset);
 492
 493  /*
 494   * Update all relative filenames to include the full path from ServerRoot...
 495   */
 496
 497   if (DocumentRoot[0] != '/')
 498     SetStringf(&DocumentRoot, "%s/%s", ServerRoot, DocumentRoot);
 499
 500   if (RequestRoot[0] != '/')
 501     SetStringf(&RequestRoot, "%s/%s", ServerRoot, RequestRoot);
 502
 503   if (ServerBin[0] != '/')
 504     SetStringf(&ServerBin, "%s/%s", ServerRoot, ServerBin);
 505
 506 #ifdef HAVE_SSL
 507   if (ServerCertificate[0] != '/')
 508     SetStringf(&ServerCertificate, "%s/%s", ServerRoot, ServerCertificate);
 509
 510 #  if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS)
 511   chown(ServerCertificate, RunUser, Group);
 512   chmod(ServerCertificate, ConfigFilePerm);
 513
 514   if (ServerKey[0] != '/')
 515     SetStringf(&ServerKey, "%s/%s", ServerRoot, ServerKey);
 516
 517   chown(ServerKey, RunUser, Group);
 518   chmod(ServerKey, ConfigFilePerm);
 519 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
 520 #endif /* HAVE_SSL */
 521
 522  /*
 523   * Make sure that ServerRoot and the config files are owned and
 524   * writable by the user and group in the cupsd.conf file...
 525   */
 526
 527   chown(ServerRoot, RunUser, Group);
 528   chmod(ServerRoot, 0775);
 529
 530   snprintf(temp, sizeof(temp), "%s/certs", ServerRoot);
 531   chown(temp, RunUser, Group);
 532   chmod(temp, 0711);
 533
 534   snprintf(temp, sizeof(temp), "%s/ppd", ServerRoot);
 535   chown(temp, RunUser, Group);
 536   chmod(temp, 0755);
 537
 538   snprintf(temp, sizeof(temp), "%s/ssl", ServerRoot);
 539   chown(temp, RunUser, Group);
 540   chmod(temp, 0700);
 541
 542   snprintf(temp, sizeof(temp), "%s/cupsd.conf", ServerRoot);
 543   chown(temp, RunUser, Group);
 544   chmod(temp, ConfigFilePerm);
 545
 546   snprintf(temp, sizeof(temp), "%s/classes.conf", ServerRoot);
 547   chown(temp, RunUser, Group);
 548 #ifdef __APPLE__
 549   chmod(temp, 0600);
 550 #else
 551   chmod(temp, ConfigFilePerm);
 552 #endif /* __APPLE__ */
 553
 554   snprintf(temp, sizeof(temp), "%s/printers.conf", ServerRoot);
 555   chown(temp, RunUser, Group);
 556 #ifdef __APPLE__
 557   chmod(temp, 0600);
 558 #else
 559   chmod(temp, ConfigFilePerm);
 560 #endif /* __APPLE__ */
 561
 562   snprintf(temp, sizeof(temp), "%s/passwd.md5", ServerRoot);
 563   chown(temp, User, Group);
 564   chmod(temp, 0600);
 565
 566  /*
 567   * Make sure the request and temporary directories have the right
 568   * permissions...
 569   */
 570
 571   chown(RequestRoot, RunUser, Group);
 572   chmod(RequestRoot, 0710);
 573
 574   if (strncmp(TempDir, RequestRoot, strlen(RequestRoot)) == 0)
 575   {
 576    /*
 577     * Only update ownership and permissions if the CUPS temp directory
 578     * is under the spool directory...
 579     */
 580
 581     chown(TempDir, RunUser, Group);
 582     chmod(TempDir, 01770);
 583   }
 584
 585  /*
 586   * Check the MaxClients setting, and then allocate memory for it...
 587   */
 588
 589   if (MaxClients > (MaxFDs / 3) || MaxClients <= 0)
 590   {
 591     if (MaxClients > 0)
 592       LogMessage(L_INFO, "MaxClients limited to 1/3 of the file descriptor limit (%d)...",
 593                  MaxFDs);
 594
 595     MaxClients = MaxFDs / 3;
 596   }
 597
 598   if ((Clients = calloc(sizeof(client_t), MaxClients)) == NULL)
 599   {
 600     LogMessage(L_ERROR, "ReadConfiguration: Unable to allocate memory for %d clients: %s",
 601                MaxClients, strerror(errno));
 602     exit(1);
 603   }
 604   else
 605     LogMessage(L_INFO, "Configured for up to %d clients.", MaxClients);
 606
 607  /*
 608   * Check the MaxActiveJobs setting; limit to 1/3 the available
 609   * file descriptors, since we need a pipe for each job...
 610   */
 611
 612   if (MaxActiveJobs > (MaxFDs / 3))
 613     MaxActiveJobs = MaxFDs / 3;
 614
 615   if (Classification && strcasecmp(Classification, "none") == 0)
 616     ClearString(&Classification);
 617
 618   if (Classification)
 619     LogMessage(L_INFO, "Security set to \"%s\"", Classification);
 620
 621  /*
 622   * Update the MaxClientsPerHost value, as needed...
 623   */
 624
 625   if (MaxClientsPerHost <= 0)
 626     MaxClientsPerHost = MaxClients;
 627
 628   if (MaxClientsPerHost > MaxClients)
 629     MaxClientsPerHost = MaxClients;
 630
 631   LogMessage(L_INFO, "Allowing up to %d client connections per host.",
 632              MaxClientsPerHost);
 633
 634  /*
 635   * Update the default policy, as needed...
 636   */
 637
 638   if (DefaultPolicy)
 639     DefaultPolicyPtr = FindPolicy(DefaultPolicy);
 640   else
 641     DefaultPolicyPtr = NULL;
 642
 643   if (!DefaultPolicyPtr)
 644   {
 645     policy_t    *p;                     /* New policy */
 646     policyop_t  *po;                    /* New policy operation */
 647     char        groupname[255];         /* Group name */
 648
 649
 650     if (DefaultPolicy)
 651       LogMessage(L_ERROR, "Default policy \"%s\" not found!", DefaultPolicy);
 652
 653     if ((DefaultPolicyPtr = FindPolicy("default")) != NULL)
 654       LogMessage(L_INFO, "Using policy \"default\" as the default!");
 655     else
 656     {
 657       LogMessage(L_INFO, "Creating CUPS default administrative policy:");
 658
 659       DefaultPolicyPtr = p = AddPolicy("default");
 660
 661       LogMessage(L_INFO, "<Policy default>");
 662       LogMessage(L_INFO, "<Limit Send-Document Send-URI Cancel-Job Hold-Job "
 663                          "Release-Job Restart-Job Purge-Jobs "
 664                          "Set-Job-Attributes Create-Job-Subscription "
 665                          "Renew-Subscription Cancel-Subscription "
 666                          "Get-Notifications Reprocess-Job Cancel-Current-Job "
 667                          "Suspend-Current-Job Resume-Job CUPS-Move-Job>");
 668       LogMessage(L_INFO, "Order Allow,Deny");
 669       LogMessage(L_INFO, "Allow @OWNER");
 670
 671       po = AddPolicyOp(p, NULL, IPP_SEND_DOCUMENT);
 672       po->order_type = POLICY_DENY;
 673
 674       AddPolicyOpName(po, POLICY_ALLOW, "@OWNER");
 675
 676       for (i = 0; i < NumSystemGroups; i ++)
 677       {
 678         snprintf(groupname, sizeof(groupname), "@%s", SystemGroups[i]);
 679         AddPolicyOpName(po, POLICY_ALLOW, groupname);
 680         LogMessage(L_INFO, "Allow %s", groupname);
 681       }
 682
 683       AddPolicyOp(p, po, IPP_SEND_URI);
 684       AddPolicyOp(p, po, IPP_CANCEL_JOB);
 685       AddPolicyOp(p, po, IPP_HOLD_JOB);
 686       AddPolicyOp(p, po, IPP_RELEASE_JOB);
 687       AddPolicyOp(p, po, IPP_RESTART_JOB);
 688       AddPolicyOp(p, po, IPP_PURGE_JOBS);
 689       AddPolicyOp(p, po, IPP_SET_JOB_ATTRIBUTES);
 690       AddPolicyOp(p, po, IPP_CREATE_JOB_SUBSCRIPTION);
 691       AddPolicyOp(p, po, IPP_RENEW_SUBSCRIPTION);
 692       AddPolicyOp(p, po, IPP_CANCEL_SUBSCRIPTION);
 693       AddPolicyOp(p, po, IPP_GET_NOTIFICATIONS);
 694       AddPolicyOp(p, po, IPP_REPROCESS_JOB);
 695       AddPolicyOp(p, po, IPP_CANCEL_CURRENT_JOB);
 696       AddPolicyOp(p, po, IPP_SUSPEND_CURRENT_JOB);
 697       AddPolicyOp(p, po, IPP_RESUME_JOB);
 698       AddPolicyOp(p, po, CUPS_MOVE_JOB);
 699
 700       LogMessage(L_INFO, "</Limit>");
 701
 702       LogMessage(L_INFO, "<Limit Pause-Printer Resume-Printer "
 703                          "Set-Printer-Attributes Enable-Printer "
 704                          "Disable-Printer Pause-Printer-After-Current-Job "
 705                          "Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer "
 706                          "Activate-Printer Restart-Printer Shutdown-Printer "
 707                          "Startup-Printer Promote-Job Schedule-Job-After "
 708                          "CUPS-Add-Printer CUPS-Delete-Printer "
 709                          "CUPS-Add-Class CUPS-Delete-Class "
 710                          "CUPS-Accept-Jobs CUPS-Reject-Jobs "
 711                          "CUPS-Set-Default CUPS-Add-Device CUPS-Delete-Device>");
 712       LogMessage(L_INFO, "Order Allow,Deny");
 713       LogMessage(L_INFO, "Authenticate yes");
 714
 715       po = AddPolicyOp(p, NULL, IPP_PAUSE_PRINTER);
 716       po->order_type   = POLICY_DENY;
 717       po->authenticate = 1;
 718
 719       for (i = 0; i < NumSystemGroups; i ++)
 720       {
 721         snprintf(groupname, sizeof(groupname), "@%s", SystemGroups[i]);
 722         AddPolicyOpName(po, POLICY_ALLOW, groupname);
 723         LogMessage(L_INFO, "Allow %s", groupname);
 724       }
 725
 726       AddPolicyOp(p, po, IPP_RESUME_PRINTER);
 727       AddPolicyOp(p, po, IPP_SET_PRINTER_ATTRIBUTES);
 728       AddPolicyOp(p, po, IPP_ENABLE_PRINTER);
 729       AddPolicyOp(p, po, IPP_DISABLE_PRINTER);
 730       AddPolicyOp(p, po, IPP_PAUSE_PRINTER_AFTER_CURRENT_JOB);
 731       AddPolicyOp(p, po, IPP_HOLD_NEW_JOBS);
 732       AddPolicyOp(p, po, IPP_RELEASE_HELD_NEW_JOBS);
 733       AddPolicyOp(p, po, IPP_DEACTIVATE_PRINTER);
 734       AddPolicyOp(p, po, IPP_ACTIVATE_PRINTER);
 735       AddPolicyOp(p, po, IPP_RESTART_PRINTER);
 736       AddPolicyOp(p, po, IPP_SHUTDOWN_PRINTER);
 737       AddPolicyOp(p, po, IPP_STARTUP_PRINTER);
 738       AddPolicyOp(p, po, IPP_PROMOTE_JOB);
 739       AddPolicyOp(p, po, IPP_SCHEDULE_JOB_AFTER);
 740       AddPolicyOp(p, po, CUPS_ADD_PRINTER);
 741       AddPolicyOp(p, po, CUPS_DELETE_PRINTER);
 742       AddPolicyOp(p, po, CUPS_ADD_CLASS);
 743       AddPolicyOp(p, po, CUPS_DELETE_CLASS);
 744       AddPolicyOp(p, po, CUPS_ACCEPT_JOBS);
 745       AddPolicyOp(p, po, CUPS_REJECT_JOBS);
 746       AddPolicyOp(p, po, CUPS_SET_DEFAULT);
 747       AddPolicyOp(p, po, CUPS_ADD_DEVICE);
 748       AddPolicyOp(p, po, CUPS_DELETE_DEVICE);
 749
 750       LogMessage(L_INFO, "</Limit>");
 751
 752       LogMessage(L_INFO, "<Limit All>");
 753       LogMessage(L_INFO, "Order Deny,Allow");
 754
 755       po = AddPolicyOp(p, NULL, IPP_ANY_OPERATION);
 756       po->order_type = POLICY_ALLOW;
 757
 758       LogMessage(L_INFO, "</Limit>");
 759       LogMessage(L_INFO, "</Policy>");
 760     }
 761   }
 762
 763  /*
 764   * If we are doing a full reload or the server root has changed, flush
 765   * the jobs, printers, etc. and start from scratch...
 766   */
 767
 768   if (NeedReload == RELOAD_ALL ||
 769       !old_serverroot || !ServerRoot || strcmp(old_serverroot, ServerRoot) ||
 770       !old_requestroot || !RequestRoot || strcmp(old_requestroot, RequestRoot))
 771   {
 772     LogMessage(L_INFO, "Full reload is required.");
 773
 774    /*
 775     * Free all memory...
 776     */
 777
 778     FreeAllJobs();
 779     DeleteAllClasses();
 780     DeleteAllPrinters();
 781
 782     DefaultPrinter = NULL;
 783
 784     if (Devices)
 785     {
 786       ippDelete(Devices);
 787       Devices = NULL;
 788     }
 789
 790     if (PPDs)
 791     {
 792       ippDelete(PPDs);
 793       PPDs = NULL;
 794     }
 795
 796     if (MimeDatabase != NULL)
 797       mimeDelete(MimeDatabase);
 798
 799     if (NumMimeTypes)
 800     {
 801       for (i = 0; i < NumMimeTypes; i ++)
 802         free((void *)MimeTypes[i]);
 803
 804       free(MimeTypes);
 805     }
 806
 807    /*
 808     * Read the MIME type and conversion database...
 809     */
 810
 811     snprintf(temp, sizeof(temp), "%s/filter", ServerBin);
 812
 813     MimeDatabase = mimeLoad(ServerRoot, temp);
 814
 815     LogMessage(L_INFO, "Loaded MIME database from \'%s\': %d types, %d filters...",
 816                ServerRoot, MimeDatabase->num_types, MimeDatabase->num_filters);
 817
 818    /*
 819     * Create a list of MIME types for the document-format-supported
 820     * attribute...
 821     */
 822
 823     NumMimeTypes = MimeDatabase->num_types;
 824     if (!mimeType(MimeDatabase, "application", "octet-stream"))
 825       NumMimeTypes ++;
 826
 827     MimeTypes = calloc(NumMimeTypes, sizeof(const char *));
 828
 829     for (i = 0; i < MimeDatabase->num_types; i ++)
 830     {
 831       snprintf(type, sizeof(type), "%s/%s", MimeDatabase->types[i]->super,
 832                MimeDatabase->types[i]->type);
 833
 834       MimeTypes[i] = strdup(type);
 835     }
 836
 837     if (i < NumMimeTypes)
 838       MimeTypes[i] = strdup("application/octet-stream");
 839
 840    /*
 841     * Load banners...
 842     */
 843
 844     snprintf(temp, sizeof(temp), "%s/banners", DataDir);
 845     LoadBanners(temp);
 846
 847    /*
 848     * Load printers and classes...
 849     */
 850
 851     LoadAllPrinters();
 852     LoadAllClasses();
 853
 854     CreateCommonData();
 855
 856    /*
 857     * Load devices and PPDs...
 858     */
 859
 860     snprintf(temp, sizeof(temp), "%s/backend", ServerBin);
 861     LoadDevices(temp);
 862
 863     snprintf(temp, sizeof(temp), "%s/model", DataDir);
 864     LoadPPDs(temp);
 865
 866    /*
 867     * Load queued jobs...
 868     */
 869
 870     LoadAllJobs();
 871
 872     LogMessage(L_INFO, "Full reload complete.");
 873   }
 874   else
 875   {
 876     CreateCommonData();
 877
 878     LogMessage(L_INFO, "Partial reload complete.");
 879   }
 880
 881  /*
 882   * Reset the reload state...
 883   */
 884
 885   NeedReload = RELOAD_NONE;
 886
 887   ClearString(&old_serverroot);
 888   ClearString(&old_requestroot);
 889
 890  /*
 891   * Startup the server and return...
 892   */
 893
 894   StartServer();
 895
 896   return (1);
 897 }
 898
 899
 900 /*
 901  * 'read_configuration()' - Read a configuration file.
 902  */
 903
 904 static int                              /* O - 1 on success, 0 on failure */
 905 read_configuration(cups_file_t *fp)     /* I - File to read from */
 906 {
 907   int           i;                      /* Looping var */
 908   int           linenum;                /* Current line number */
 909   char          line[HTTP_MAX_BUFFER],  /* Line from file */
 910                 temp[HTTP_MAX_BUFFER],  /* Temporary buffer for value */
 911                 temp2[HTTP_MAX_BUFFER], /* Temporary buffer 2 for value */
 912                 *ptr,                   /* Pointer into line/temp */
 913                 *value;                 /* Pointer to value */
 914   int           valuelen;               /* Length of value */
 915   var_t         *var;                   /* Current variable */
 916   unsigned      ip[4],                  /* Address value */
 917                 mask[4];                /* Netmask value */
 918   dirsvc_relay_t *relay;                /* Relay data */
 919   dirsvc_poll_t *poll;                  /* Polling data */
 920   http_addr_t   polladdr;               /* Polling address */
 921   location_t    *location;              /* Browse location */
 922   cups_file_t   *incfile;               /* Include file */
 923   char          incname[1024];          /* Include filename */
 924
 925
 926  /*
 927   * Loop through each line in the file...
 928   */
 929
 930   linenum = 0;
 931
 932   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
 933   {
 934    /*
 935     * Decode the directive...
 936     */
 937
 938     if (!strcasecmp(line, "Include"))
 939     {
 940      /*
 941       * Include filename
 942       */
 943
 944       if (value[0] == '/')
 945         strlcpy(incname, value, sizeof(incname));
 946       else
 947         snprintf(incname, sizeof(incname), "%s/%s", ServerRoot, value);
 948
 949       if ((incfile = cupsFileOpen(incname, "rb")) == NULL)
 950         LogMessage(L_ERROR, "Unable to include config file \"%s\" - %s",
 951                    incname, strerror(errno));
 952       else
 953       {
 954         read_configuration(incfile);
 955         cupsFileClose(incfile);
 956       }
 957     }
 958     else if (!strcasecmp(line, "<Location"))
 959     {
 960      /*
 961       * <Location path>
 962       */
 963
 964       if (value)
 965       {
 966         linenum = read_location(fp, value, linenum);
 967         if (linenum == 0)
 968           return (0);
 969       }
 970       else
 971       {
 972         LogMessage(L_ERROR, "Syntax error on line %d.",
 973                    linenum);
 974         return (0);
 975       }
 976     }
 977     else if (!strcasecmp(line, "<Policy"))
 978     {
 979      /*
 980       * <Policy name>
 981       */
 982
 983       if (value)
 984       {
 985         linenum = read_policy(fp, value, linenum);
 986         if (linenum == 0)
 987           return (0);
 988       }
 989       else
 990       {
 991         LogMessage(L_ERROR, "Syntax error on line %d.",
 992                    linenum);
 993         return (0);
 994       }
 995     }
 996     else if (!strcasecmp(line, "Port") || !strcasecmp(line, "Listen"))
 997     {
 998      /*
 999       * Add a listening address to the list...
1000       */
1001
1002       listener_t        *lis;           /* New listeners array */
1003
1004
1005       if (NumListeners == 0)
1006         lis = malloc(sizeof(listener_t));
1007       else
1008         lis = realloc(Listeners, (NumListeners + 1) * sizeof(listener_t));
1009
1010       if (!lis)
1011       {
1012         LogMessage(L_ERROR, "Unable to allocate %s at line %d - %s.",
1013                    line, linenum, strerror(errno));
1014         continue;
1015       }
1016
1017       Listeners = lis;
1018       lis      += NumListeners;
1019
1020       memset(lis, 0, sizeof(listener_t));
1021
1022       if (get_address(value, INADDR_ANY, IPP_PORT, AF_INET, &(lis->address)))
1023       {
1024         httpAddrString(&(lis->address), temp, sizeof(temp));
1025
1026 #ifdef AF_INET6
1027         if (lis->address.addr.sa_family == AF_INET6)
1028           LogMessage(L_INFO, "Listening to %s:%d (IPv6)", temp,
1029                      ntohs(lis->address.ipv6.sin6_port));
1030         else
1031 #endif /* AF_INET6 */
1032         LogMessage(L_INFO, "Listening to %s:%d", temp,
1033                    ntohs(lis->address.ipv4.sin_port));
1034         NumListeners ++;
1035       }
1036       else
1037         LogMessage(L_ERROR, "Bad %s address %s at line %d.", line,
1038                    value, linenum);
1039     }
1040 #ifdef HAVE_SSL
1041     else if (!strcasecmp(line, "SSLPort") || !strcasecmp(line, "SSLListen"))
1042     {
1043      /*
1044       * Add a listening address to the list...
1045       */
1046
1047       listener_t        *lis;           /* New listeners array */
1048
1049
1050       if (NumListeners == 0)
1051         lis = malloc(sizeof(listener_t));
1052       else
1053         lis = realloc(Listeners, (NumListeners + 1) * sizeof(listener_t));
1054
1055       if (!lis)
1056       {
1057         LogMessage(L_ERROR, "Unable to allocate %s at line %d - %s.",
1058                    line, linenum, strerror(errno));
1059         continue;
1060       }
1061
1062       Listeners = lis;
1063       lis      += NumListeners;
1064
1065       if (get_address(value, INADDR_ANY, IPP_PORT, AF_INET, &(lis->address)))
1066       {
1067         httpAddrString(&(lis->address), temp, sizeof(temp));
1068
1069 #ifdef AF_INET6
1070         if (lis->address.addr.sa_family == AF_INET6)
1071           LogMessage(L_INFO, "Listening to %s:%d (IPv6)", temp,
1072                      ntohs(lis->address.ipv6.sin6_port));
1073         else
1074 #endif /* AF_INET6 */
1075         LogMessage(L_INFO, "Listening to %s:%d", temp,
1076                    ntohs(lis->address.ipv4.sin_port));
1077         lis->encryption = HTTP_ENCRYPT_ALWAYS;
1078         NumListeners ++;
1079       }
1080       else
1081         LogMessage(L_ERROR, "Bad %s address %s at line %d.", line,
1082                    value, linenum);
1083     }
1084 #endif /* HAVE_SSL */
1085     else if (!strcasecmp(line, "BrowseAddress"))
1086     {
1087      /*
1088       * Add a browse address to the list...
1089       */
1090
1091       dirsvc_addr_t     *dira;          /* New browse address array */
1092
1093
1094       if (NumBrowsers == 0)
1095         dira = malloc(sizeof(dirsvc_addr_t));
1096       else
1097         dira = realloc(Browsers, (NumBrowsers + 1) * sizeof(dirsvc_addr_t));
1098
1099       if (!dira)
1100       {
1101         LogMessage(L_ERROR, "Unable to allocate BrowseAddress at line %d - %s.",
1102                    linenum, strerror(errno));
1103         continue;
1104       }
1105
1106       Browsers = dira;
1107       dira     += NumBrowsers;
1108
1109       memset(dira, 0, sizeof(dirsvc_addr_t));
1110
1111       if (!strcasecmp(value, "@LOCAL"))
1112       {
1113        /*
1114         * Send browse data to all local interfaces...
1115         */
1116
1117         strcpy(dira->iface, "*");
1118         NumBrowsers ++;
1119       }
1120       else if (!strncasecmp(value, "@IF(", 4))
1121       {
1122        /*
1123         * Send browse data to the named interface...
1124         */
1125
1126         strlcpy(dira->iface, value + 4, sizeof(Browsers[0].iface));
1127
1128         ptr = dira->iface + strlen(dira->iface) - 1;
1129         if (*ptr == ')')
1130           *ptr = '\0';
1131
1132         NumBrowsers ++;
1133       }
1134       else if (get_address(value, INADDR_NONE, BrowsePort, AF_INET, &(dira->to)))
1135       {
1136         httpAddrString(&(dira->to), temp, sizeof(temp));
1137
1138 #ifdef AF_INET6
1139         if (dira->to.addr.sa_family == AF_INET6)
1140           LogMessage(L_INFO, "Sending browsing info to %s:%d (IPv6)", temp,
1141                      ntohs(dira->to.ipv6.sin6_port));
1142         else
1143 #endif /* AF_INET6 */
1144         LogMessage(L_INFO, "Sending browsing info to %s:%d", temp,
1145                    ntohs(dira->to.ipv4.sin_port));
1146
1147         NumBrowsers ++;
1148       }
1149       else
1150         LogMessage(L_ERROR, "Bad BrowseAddress %s at line %d.", value,
1151                    linenum);
1152     }
1153     else if (!strcasecmp(line, "BrowseOrder"))
1154     {
1155      /*
1156       * "BrowseOrder Deny,Allow" or "BrowseOrder Allow,Deny"...
1157       */
1158
1159       if ((location = FindLocation("CUPS_INTERNAL_BROWSE_ACL")) == NULL)
1160         location = AddLocation("CUPS_INTERNAL_BROWSE_ACL");
1161
1162       if (location == NULL)
1163         LogMessage(L_ERROR, "Unable to initialize browse access control list!");
1164       else if (!strncasecmp(value, "deny", 4))
1165         location->order_type = AUTH_ALLOW;
1166       else if (!strncasecmp(value, "allow", 5))
1167         location->order_type = AUTH_DENY;
1168       else
1169         LogMessage(L_ERROR, "Unknown BrowseOrder value %s on line %d.",
1170                    value, linenum);
1171     }
1172     else if (!strcasecmp(line, "BrowseProtocols"))
1173     {
1174      /*
1175       * "BrowseProtocol name [... name]"
1176       */
1177
1178       BrowseProtocols = 0;
1179
1180       for (; *value;)
1181       {
1182         for (valuelen = 0; value[valuelen]; valuelen ++)
1183           if (isspace(value[valuelen]) || value[valuelen] == ',')
1184             break;
1185
1186         if (value[valuelen])
1187         {
1188           value[valuelen] = '\0';
1189           valuelen ++;
1190         }
1191
1192         if (!strcasecmp(value, "cups"))
1193           BrowseProtocols |= BROWSE_CUPS;
1194         else if (!strcasecmp(value, "slp"))
1195           BrowseProtocols |= BROWSE_SLP;
1196         else if (!strcasecmp(value, "ldap"))
1197           BrowseProtocols |= BROWSE_LDAP;
1198         else if (!strcasecmp(value, "all"))
1199           BrowseProtocols |= BROWSE_ALL;
1200         else
1201         {
1202           LogMessage(L_ERROR, "Unknown browse protocol \"%s\" on line %d.",
1203                      value, linenum);
1204           break;
1205         }
1206
1207         for (value += valuelen; *value; value ++)
1208           if (!isspace(*value) || *value != ',')
1209             break;
1210       }
1211     }
1212     else if (!strcasecmp(line, "BrowseAllow") ||
1213              !strcasecmp(line, "BrowseDeny"))
1214     {
1215      /*
1216       * BrowseAllow [From] host/ip...
1217       * BrowseDeny [From] host/ip...
1218       */
1219
1220       if ((location = FindLocation("CUPS_INTERNAL_BROWSE_ACL")) == NULL)
1221         location = AddLocation("CUPS_INTERNAL_BROWSE_ACL");
1222
1223       if (location == NULL)
1224         LogMessage(L_ERROR, "Unable to initialize browse access control list!");
1225       else
1226       {
1227         if (!strncasecmp(value, "from ", 5))
1228         {
1229          /*
1230           * Strip leading "from"...
1231           */
1232
1233           value += 5;
1234
1235           while (isspace(*value))
1236             value ++;
1237         }
1238
1239        /*
1240         * Figure out what form the allow/deny address takes:
1241         *
1242         *    All
1243         *    None
1244         *    *.domain.com
1245         *    .domain.com
1246         *    host.domain.com
1247         *    nnn.*
1248         *    nnn.nnn.*
1249         *    nnn.nnn.nnn.*
1250         *    nnn.nnn.nnn.nnn
1251         *    nnn.nnn.nnn.nnn/mm
1252         *    nnn.nnn.nnn.nnn/mmm.mmm.mmm.mmm
1253         */
1254
1255         if (!strcasecmp(value, "all"))
1256         {
1257          /*
1258           * All hosts...
1259           */
1260
1261           if (!strcasecmp(line, "BrowseAllow"))
1262             AllowIP(location, zeros, zeros);
1263           else
1264             DenyIP(location, zeros, zeros);
1265         }
1266         else if (!strcasecmp(value, "none"))
1267         {
1268          /*
1269           * No hosts...
1270           */
1271
1272           if (!strcasecmp(line, "BrowseAllow"))
1273             AllowIP(location, ones, zeros);
1274           else
1275             DenyIP(location, ones, zeros);
1276         }
1277         else if (value[0] == '*' || value[0] == '.' || !isdigit(value[0]))
1278         {
1279          /*
1280           * Host or domain name...
1281           */
1282
1283           if (value[0] == '*')
1284             value ++;
1285
1286           if (!strcasecmp(line, "BrowseAllow"))
1287             AllowHost(location, value);
1288           else
1289             DenyHost(location, value);
1290         }
1291         else
1292         {
1293          /*
1294           * One of many IP address forms...
1295           */
1296
1297           if (!get_addr_and_mask(value, ip, mask))
1298           {
1299             LogMessage(L_ERROR, "Bad netmask value %s on line %d.",
1300                        value, linenum);
1301             break;
1302           }
1303
1304           if (!strcasecmp(line, "BrowseAllow"))
1305             AllowIP(location, ip, mask);
1306           else
1307             DenyIP(location, ip, mask);
1308         }
1309       }
1310     }
1311     else if (!strcasecmp(line, "BrowseRelay"))
1312     {
1313      /*
1314       * BrowseRelay [from] source [to] destination
1315       */
1316
1317       if (NumRelays == 0)
1318         relay = malloc(sizeof(dirsvc_relay_t));
1319       else
1320         relay = realloc(Relays, (NumRelays + 1) * sizeof(dirsvc_relay_t));
1321
1322       if (!relay)
1323       {
1324         LogMessage(L_ERROR, "Unable to allocate BrowseRelay at line %d - %s.",
1325                    linenum, strerror(errno));
1326         continue;
1327       }
1328
1329       Relays = relay;
1330       relay  += NumRelays;
1331
1332       memset(relay, 0, sizeof(dirsvc_relay_t));
1333
1334       if (!strncasecmp(value, "from ", 5))
1335       {
1336        /*
1337         * Strip leading "from"...
1338         */
1339
1340         value += 5;
1341
1342         while (isspace(*value))
1343           value ++;
1344       }
1345
1346      /*
1347       * Figure out what form the from address takes:
1348       *
1349       *    *.domain.com
1350       *    .domain.com
1351       *    host.domain.com
1352       *    nnn.*
1353       *    nnn.nnn.*
1354       *    nnn.nnn.nnn.*
1355       *    nnn.nnn.nnn.nnn
1356       *    nnn.nnn.nnn.nnn/mm
1357       *    nnn.nnn.nnn.nnn/mmm.mmm.mmm.mmm
1358       */
1359
1360       if (value[0] == '*' || value[0] == '.' || !isdigit(value[0]))
1361       {
1362        /*
1363         * Host or domain name...
1364         */
1365
1366         if (value[0] == '*')
1367           value ++;
1368
1369         strlcpy(temp, value, sizeof(temp));
1370         if ((ptr = strchr(temp, ' ')) != NULL)
1371           *ptr = '\0';
1372
1373         relay->from.type             = AUTH_NAME;
1374         relay->from.mask.name.name   = strdup(temp);
1375         relay->from.mask.name.length = strlen(temp);
1376       }
1377       else
1378       {
1379        /*
1380         * One of many IP address forms...
1381         */
1382
1383         if (!get_addr_and_mask(value, ip, mask))
1384         {
1385           LogMessage(L_ERROR, "Bad netmask value %s on line %d.",
1386                      value, linenum);
1387           break;
1388         }
1389
1390         relay->from.type = AUTH_IP;
1391         memcpy(relay->from.mask.ip.address, ip,
1392                sizeof(relay->from.mask.ip.address));
1393         memcpy(relay->from.mask.ip.netmask, mask,
1394                sizeof(relay->from.mask.ip.netmask));
1395       }
1396
1397      /*
1398       * Skip value and trailing whitespace...
1399       */
1400
1401       for (; *value; value ++)
1402         if (isspace(*value))
1403           break;
1404
1405       while (isspace(*value))
1406         value ++;
1407
1408       if (!strncasecmp(value, "to ", 3))
1409       {
1410        /*
1411         * Strip leading "to"...
1412         */
1413
1414         value += 3;
1415
1416         while (isspace(*value))
1417           value ++;
1418       }
1419
1420      /*
1421       * Get "to" address and port...
1422       */
1423
1424       if (get_address(value, INADDR_BROADCAST, BrowsePort, AF_INET, &(relay->to)))
1425       {
1426         httpAddrString(&(relay->to), temp, sizeof(temp));
1427
1428         if (relay->from.type == AUTH_IP)
1429           snprintf(temp2, sizeof(temp2), "%u.%u.%u.%u/%u.%u.%u.%u",
1430                    relay->from.mask.ip.address[0],
1431                    relay->from.mask.ip.address[1],
1432                    relay->from.mask.ip.address[2],
1433                    relay->from.mask.ip.address[3],
1434                    relay->from.mask.ip.netmask[0],
1435                    relay->from.mask.ip.netmask[1],
1436                    relay->from.mask.ip.netmask[2],
1437                    relay->from.mask.ip.netmask[3]);
1438         else
1439           strlcpy(temp2, relay->from.mask.name.name, sizeof(temp2));
1440
1441 #ifdef AF_INET6
1442         if (relay->to.addr.sa_family == AF_INET6)
1443           LogMessage(L_INFO, "Relaying from %s to %s:%d", temp, temp2,
1444                      ntohs(relay->to.ipv6.sin6_port));
1445         else
1446 #endif /* AF_INET6 */
1447         LogMessage(L_INFO, "Relaying from %s to %s:%d", temp, temp2,
1448                    ntohs(relay->to.ipv4.sin_port));
1449
1450         NumRelays ++;
1451       }
1452       else
1453       {
1454         if (relay->from.type == AUTH_NAME)
1455           free(relay->from.mask.name.name);
1456
1457         LogMessage(L_ERROR, "Bad relay address %s at line %d.", value, linenum);
1458       }
1459     }
1460     else if (!strcasecmp(line, "BrowsePoll"))
1461     {
1462      /*
1463       * BrowsePoll address[:port]
1464       */
1465
1466       if (NumPolled == 0)
1467         poll = malloc(sizeof(dirsvc_poll_t));
1468       else
1469         poll = realloc(Polled, (NumPolled + 1) * sizeof(dirsvc_poll_t));
1470
1471       if (!poll)
1472       {
1473         LogMessage(L_ERROR, "Unable to allocate BrowsePoll at line %d - %s.",
1474                    linenum, strerror(errno));
1475         continue;
1476       }
1477
1478       Polled = poll;
1479       poll   += NumPolled;
1480
1481      /*
1482       * Get poll address and port...
1483       */
1484
1485       if (get_address(value, INADDR_NONE, ippPort(), AF_INET, &polladdr))
1486       {
1487         NumPolled ++;
1488         memset(poll, 0, sizeof(dirsvc_poll_t));
1489
1490         httpAddrString(&polladdr, poll->hostname, sizeof(poll->hostname));
1491
1492 #ifdef AF_INET6
1493         if (polladdr.addr.sa_family == AF_INET6)
1494           poll->port = ntohs(polladdr.ipv6.sin6_port);
1495         else
1496 #endif /* AF_INET6 */
1497         poll->port = ntohs(polladdr.ipv4.sin_port);
1498
1499         LogMessage(L_INFO, "Polling %s:%d", poll->hostname, poll->port);
1500       }
1501       else
1502         LogMessage(L_ERROR, "Bad poll address %s at line %d.", value, linenum);
1503     }
1504     else if (!strcasecmp(line, "User"))
1505     {
1506      /*
1507       * User ID to run as...
1508       */
1509
1510       if (isdigit(value[0]))
1511         User = atoi(value);
1512       else
1513       {
1514         struct passwd *p;       /* Password information */
1515
1516         endpwent();
1517         p = getpwnam(value);
1518
1519         if (p != NULL)
1520           User = p->pw_uid;
1521         else
1522           LogMessage(L_WARN, "Unknown username \"%s\"", value);
1523       }
1524     }
1525     else if (!strcasecmp(line, "Group"))
1526     {
1527      /*
1528       * Group ID to run as...
1529       */
1530
1531       if (isdigit(value[0]))
1532         Group = atoi(value);
1533       else
1534       {
1535         struct group *g;        /* Group information */
1536
1537         endgrent();
1538         g = getgrnam(value);
1539
1540         if (g != NULL)
1541           Group = g->gr_gid;
1542         else
1543           LogMessage(L_WARN, "Unknown groupname \"%s\"", value);
1544       }
1545     }
1546     else if (!strcasecmp(line, "SystemGroup"))
1547     {
1548      /*
1549       * System (admin) group(s)...
1550       */
1551
1552       char      *valueptr,      /* Pointer into value */
1553                 quote;          /* Quote character */
1554
1555
1556       for (i = NumSystemGroups; *value && i < MAX_SYSTEM_GROUPS; i ++)
1557       {
1558         if (*value == '\'' || *value == '\"')
1559         {
1560          /*
1561           * Scan quoted name...
1562           */
1563
1564           quote = *value++;
1565
1566           for (valueptr = value; *valueptr; valueptr ++)
1567             if (*valueptr == quote)
1568               break;
1569         }
1570         else
1571         {
1572          /*
1573           * Scan space or comma-delimited name...
1574           */
1575
1576           for (valueptr = value; *valueptr; valueptr ++)
1577             if (isspace(*valueptr) || *valueptr == ',')
1578               break;
1579         }
1580
1581         if (*valueptr)
1582           *valueptr++ = '\0';
1583
1584         SetString(SystemGroups + i, value);
1585
1586         value = valueptr;
1587
1588         while (*value == ',' || isspace(*value))
1589           value ++;
1590       }
1591
1592       if (i)
1593         NumSystemGroups = i;
1594     }
1595     else if (!strcasecmp(line, "HostNameLookups"))
1596     {
1597      /*
1598       * Do hostname lookups?
1599       */
1600
1601       if (!strcasecmp(value, "off"))
1602         HostNameLookups = 0;
1603       else if (!strcasecmp(value, "on"))
1604         HostNameLookups = 1;
1605       else if (!strcasecmp(value, "double"))
1606         HostNameLookups = 2;
1607       else
1608         LogMessage(L_WARN, "Unknown HostNameLookups %s on line %d.",
1609                    value, linenum);
1610     }
1611     else if (!strcasecmp(line, "LogLevel"))
1612     {
1613      /*
1614       * Amount of logging to do...
1615       */
1616
1617       if (!strcasecmp(value, "debug2"))
1618         LogLevel = L_DEBUG2;
1619       else if (!strcasecmp(value, "debug"))
1620         LogLevel = L_DEBUG;
1621       else if (!strcasecmp(value, "info"))
1622         LogLevel = L_INFO;
1623       else if (!strcasecmp(value, "notice"))
1624         LogLevel = L_NOTICE;
1625       else if (!strcasecmp(value, "warn"))
1626         LogLevel = L_WARN;
1627       else if (!strcasecmp(value, "error"))
1628         LogLevel = L_ERROR;
1629       else if (!strcasecmp(value, "crit"))
1630         LogLevel = L_CRIT;
1631       else if (!strcasecmp(value, "alert"))
1632         LogLevel = L_ALERT;
1633       else if (!strcasecmp(value, "emerg"))
1634         LogLevel = L_EMERG;
1635       else if (!strcasecmp(value, "none"))
1636         LogLevel = L_NONE;
1637       else
1638         LogMessage(L_WARN, "Unknown LogLevel %s on line %d.", value, linenum);
1639     }
1640     else if (!strcasecmp(line, "PrintcapFormat"))
1641     {
1642      /*
1643       * Format of printcap file?
1644       */
1645
1646       if (!strcasecmp(value, "bsd"))
1647         PrintcapFormat = PRINTCAP_BSD;
1648       else if (!strcasecmp(value, "solaris"))
1649         PrintcapFormat = PRINTCAP_SOLARIS;
1650       else
1651         LogMessage(L_WARN, "Unknown PrintcapFormat %s on line %d.",
1652                    value, linenum);
1653     }
1654     else if (!strcasecmp(line, "ServerTokens"))
1655     {
1656      /*
1657       * Set the string used for the Server header...
1658       */
1659
1660       struct utsname plat;            /* Platform info */
1661
1662
1663       uname(&plat);
1664
1665       if (!strcasecmp(value, "ProductOnly"))
1666         SetString(&ServerHeader, "CUPS");
1667       else if (!strcasecmp(value, "Major"))
1668         SetString(&ServerHeader, "CUPS/1");
1669       else if (!strcasecmp(value, "Minor"))
1670         SetString(&ServerHeader, "CUPS/1.1");
1671       else if (!strcasecmp(value, "Minimal"))
1672         SetString(&ServerHeader, CUPS_MINIMAL);
1673       else if (!strcasecmp(value, "OS"))
1674         SetStringf(&ServerHeader, CUPS_MINIMAL " (%s)", plat.sysname);
1675       else if (!strcasecmp(value, "Full"))
1676         SetStringf(&ServerHeader, CUPS_MINIMAL " (%s) IPP/1.1", plat.sysname);
1677       else if (!strcasecmp(value, "None"))
1678         ClearString(&ServerHeader);
1679       else
1680         LogMessage(L_WARN, "Unknown ServerTokens %s on line %d.", value, linenum);
1681     }
1682     else
1683     {
1684      /*
1685       * Find a simple variable in the list...
1686       */
1687
1688       for (i = NUM_VARS, var = variables; i > 0; i --, var ++)
1689         if (!strcasecmp(line, var->name))
1690           break;
1691
1692       if (i == 0)
1693       {
1694        /*
1695         * Unknown directive!  Output an error message and continue...
1696         */
1697
1698         LogMessage(L_ERROR, "Unknown directive %s on line %d.", line,
1699                    linenum);
1700         continue;
1701       }
1702
1703       switch (var->type)
1704       {
1705         case VAR_INTEGER :
1706             {
1707               int       n;      /* Number */
1708               char      *units; /* Units */
1709
1710
1711               n = strtol(value, &units, 0);
1712
1713               if (units && *units)
1714               {
1715                 if (tolower(units[0] & 255) == 'g')
1716                   n *= 1024 * 1024 * 1024;
1717                 else if (tolower(units[0] & 255) == 'm')
1718                   n *= 1024 * 1024;
1719                 else if (tolower(units[0] & 255) == 'k')
1720                   n *= 1024;
1721                 else if (tolower(units[0] & 255) == 't')
1722                   n *= 262144;
1723               }
1724
1725               *((int *)var->ptr) = n;
1726             }
1727             break;
1728
1729         case VAR_BOOLEAN :
1730             if (!strcasecmp(value, "true") ||
1731                 !strcasecmp(value, "on") ||
1732                 !strcasecmp(value, "enabled") ||
1733                 !strcasecmp(value, "yes") ||
1734                 atoi(value) != 0)
1735               *((int *)var->ptr) = TRUE;
1736             else if (!strcasecmp(value, "false") ||
1737                      !strcasecmp(value, "off") ||
1738                      !strcasecmp(value, "disabled") ||
1739                      !strcasecmp(value, "no") ||
1740                      !strcasecmp(value, "0"))
1741               *((int *)var->ptr) = FALSE;
1742             else
1743               LogMessage(L_ERROR, "Unknown boolean value %s on line %d.",
1744                          value, linenum);
1745             break;
1746
1747         case VAR_STRING :
1748             SetString((char **)var->ptr, value);
1749             break;
1750       }
1751     }
1752   }
1753
1754   return (1);
1755 }
1756
1757
1758 /*
1759  * 'read_location()' - Read a <Location path> definition.
1760  */
1761
1762 static int                              /* O - New line number or 0 on error */
1763 read_location(cups_file_t *fp,          /* I - Configuration file */
1764               char        *location,    /* I - Location name/path */
1765               int         linenum)      /* I - Current line number */
1766 {
1767   int           i;                      /* Looping var */
1768   location_t    *loc,                   /* New location */
1769                 *parent;                /* Parent location */
1770   char          line[HTTP_MAX_BUFFER],  /* Line buffer */
1771                 *value,                 /* Value for directive */
1772                 *valptr;                /* Pointer into value */
1773   unsigned      ip[4],                  /* IP address components */
1774                 mask[4];                /* IP netmask components */
1775
1776
1777   if ((parent = AddLocation(location)) == NULL)
1778     return (0);
1779
1780   parent->limit = AUTH_LIMIT_ALL;
1781   loc           = parent;
1782
1783   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
1784   {
1785    /*
1786     * Decode the directive...
1787     */
1788
1789     if (!strcasecmp(line, "</Location>"))
1790       return (linenum);
1791     else if (!strcasecmp(line, "<Limit") ||
1792              !strcasecmp(line, "<LimitExcept"))
1793     {
1794       if (!value)
1795       {
1796         LogMessage(L_ERROR, "Syntax error on line %d.", linenum);
1797         return (0);
1798       }
1799
1800       if ((loc = CopyLocation(&parent)) == NULL)
1801         return (0);
1802
1803       loc->limit = 0;
1804       while (*value)
1805       {
1806         for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
1807
1808         if (*valptr)
1809           *valptr++ = '\0';
1810
1811         if (!strcmp(value, "ALL"))
1812           loc->limit = AUTH_LIMIT_ALL;
1813         else if (!strcmp(value, "GET"))
1814           loc->limit |= AUTH_LIMIT_GET;
1815         else if (!strcmp(value, "HEAD"))
1816           loc->limit |= AUTH_LIMIT_HEAD;
1817         else if (!strcmp(value, "OPTIONS"))
1818           loc->limit |= AUTH_LIMIT_OPTIONS;
1819         else if (!strcmp(value, "POST"))
1820           loc->limit |= AUTH_LIMIT_POST;
1821         else if (!strcmp(value, "PUT"))
1822           loc->limit |= AUTH_LIMIT_PUT;
1823         else if (!strcmp(value, "TRACE"))
1824           loc->limit |= AUTH_LIMIT_TRACE;
1825         else
1826           LogMessage(L_WARN, "Unknown request type %s on line %d!", value,
1827                      linenum);
1828
1829         for (value = valptr; isspace(*value & 255); value ++);
1830       }
1831
1832       if (!strcasecmp(line, "<LimitExcept"))
1833         loc->limit = AUTH_LIMIT_ALL ^ loc->limit;
1834
1835       parent->limit &= ~loc->limit;
1836     }
1837     else if (!strcasecmp(line, "</Limit>"))
1838       loc = parent;
1839     else if (!strcasecmp(line, "Encryption"))
1840     {
1841      /*
1842       * "Encryption xxx" - set required encryption level...
1843       */
1844
1845       if (!strcasecmp(value, "never"))
1846         loc->encryption = HTTP_ENCRYPT_NEVER;
1847       else if (!strcasecmp(value, "always"))
1848       {
1849         LogMessage(L_ERROR, "Encryption value \"%s\" on line %d is invalid in this context. "
1850                             "Using \"required\" instead.", value, linenum);
1851
1852         loc->encryption = HTTP_ENCRYPT_REQUIRED;
1853       }
1854       else if (!strcasecmp(value, "required"))
1855         loc->encryption = HTTP_ENCRYPT_REQUIRED;
1856       else if (!strcasecmp(value, "ifrequested"))
1857         loc->encryption = HTTP_ENCRYPT_IF_REQUESTED;
1858       else
1859         LogMessage(L_ERROR, "Unknown Encryption value %s on line %d.",
1860                    value, linenum);
1861     }
1862     else if (!strcasecmp(line, "Order"))
1863     {
1864      /*
1865       * "Order Deny,Allow" or "Order Allow,Deny"...
1866       */
1867
1868       if (!strncasecmp(value, "deny", 4))
1869         loc->order_type = AUTH_ALLOW;
1870       else if (!strncasecmp(value, "allow", 5))
1871         loc->order_type = AUTH_DENY;
1872       else
1873         LogMessage(L_ERROR, "Unknown Order value %s on line %d.",
1874                    value, linenum);
1875     }
1876     else if (!strcasecmp(line, "Allow") || !strcasecmp(line, "Deny"))
1877     {
1878      /*
1879       * Allow [From] host/ip...
1880       * Deny [From] host/ip...
1881       */
1882
1883       if (!strncasecmp(value, "from", 4))
1884       {
1885        /*
1886         * Strip leading "from"...
1887         */
1888
1889         value += 4;
1890
1891         while (isspace(*value & 255))
1892           value ++;
1893       }
1894
1895      /*
1896       * Figure out what form the allow/deny address takes:
1897       *
1898       *    All
1899       *    None
1900       *    *.domain.com
1901       *    .domain.com
1902       *    host.domain.com
1903       *    nnn.*
1904       *    nnn.nnn.*
1905       *    nnn.nnn.nnn.*
1906       *    nnn.nnn.nnn.nnn
1907       *    nnn.nnn.nnn.nnn/mm
1908       *    nnn.nnn.nnn.nnn/mmm.mmm.mmm.mmm
1909       */
1910
1911       if (!strcasecmp(value, "all"))
1912       {
1913        /*
1914         * All hosts...
1915         */
1916
1917         if (!strcasecmp(line, "Allow"))
1918           AllowIP(loc, zeros, zeros);
1919         else
1920           DenyIP(loc, zeros, zeros);
1921       }
1922       else if (!strcasecmp(value, "none"))
1923       {
1924        /*
1925         * No hosts...
1926         */
1927
1928         if (!strcasecmp(line, "Allow"))
1929           AllowIP(loc, ones, zeros);
1930         else
1931           DenyIP(loc, ones, zeros);
1932       }
1933       else if (value[0] == '*' || value[0] == '.' || !isdigit(value[0] & 255))
1934       {
1935        /*
1936         * Host or domain name...
1937         */
1938
1939         if (value[0] == '*')
1940           value ++;
1941
1942         if (!strcasecmp(line, "Allow"))
1943           AllowHost(loc, value);
1944         else
1945           DenyHost(loc, value);
1946       }
1947       else
1948       {
1949        /*
1950         * One of many IP address forms...
1951         */
1952
1953         if (!get_addr_and_mask(value, ip, mask))
1954         {
1955           LogMessage(L_ERROR, "Bad netmask value %s on line %d.",
1956                      value, linenum);
1957           break;
1958         }
1959
1960         if (!strcasecmp(line, "Allow"))
1961           AllowIP(loc, ip, mask);
1962         else
1963           DenyIP(loc, ip, mask);
1964       }
1965     }
1966     else if (!strcasecmp(line, "AuthType"))
1967     {
1968      /*
1969       * AuthType {none,basic,digest,basicdigest}
1970       */
1971
1972       if (!strcasecmp(value, "none"))
1973       {
1974         loc->type  = AUTH_NONE;
1975         loc->level = AUTH_ANON;
1976       }
1977       else if (!strcasecmp(value, "basic"))
1978       {
1979         loc->type = AUTH_BASIC;
1980
1981         if (loc->level == AUTH_ANON)
1982           loc->level = AUTH_USER;
1983       }
1984       else if (!strcasecmp(value, "digest"))
1985       {
1986         loc->type = AUTH_DIGEST;
1987
1988         if (loc->level == AUTH_ANON)
1989           loc->level = AUTH_USER;
1990       }
1991       else if (!strcasecmp(value, "basicdigest"))
1992       {
1993         loc->type = AUTH_BASICDIGEST;
1994
1995         if (loc->level == AUTH_ANON)
1996           loc->level = AUTH_USER;
1997       }
1998       else
1999         LogMessage(L_WARN, "Unknown authorization type %s on line %d.",
2000                    value, linenum);
2001     }
2002     else if (!strcasecmp(line, "AuthClass"))
2003     {
2004      /*
2005       * AuthClass anonymous, user, system, group
2006       */
2007
2008       if (!strcasecmp(value, "anonymous"))
2009       {
2010         loc->type  = AUTH_NONE;
2011         loc->level = AUTH_ANON;
2012       }
2013       else if (!strcasecmp(value, "user"))
2014         loc->level = AUTH_USER;
2015       else if (!strcasecmp(value, "group"))
2016         loc->level = AUTH_GROUP;
2017       else if (!strcasecmp(value, "system"))
2018       {
2019         loc->level = AUTH_GROUP;
2020
2021        /*
2022         * Use the default system group if none is defined so far...
2023         */
2024
2025         if (NumSystemGroups)
2026           NumSystemGroups = 1;
2027
2028         for (i = 0; i < NumSystemGroups; i ++)
2029           AddName(loc, SystemGroups[i]);
2030       }
2031       else
2032         LogMessage(L_WARN, "Unknown authorization class %s on line %d.",
2033                    value, linenum);
2034     }
2035     else if (!strcasecmp(line, "AuthGroupName"))
2036       AddName(loc, value);
2037     else if (!strcasecmp(line, "Require"))
2038     {
2039      /*
2040       * Apache synonym for AuthClass and AuthGroupName...
2041       *
2042       * Get initial word:
2043       *
2044       *     Require valid-user
2045       *     Require group names
2046       *     Require user names
2047       */
2048
2049       for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2050
2051       if (*valptr)
2052         *valptr++ = '\0';
2053
2054       if (!strcasecmp(value, "valid-user") ||
2055           !strcasecmp(value, "user"))
2056         loc->level = AUTH_USER;
2057       else if (!strcasecmp(value, "group"))
2058         loc->level = AUTH_GROUP;
2059       else
2060       {
2061         LogMessage(L_WARN, "Unknown Require type %s on line %d.",
2062                    value, linenum);
2063         continue;
2064       }
2065
2066      /*
2067       * Get the list of names from the line...
2068       */
2069
2070       for (value = valptr; *value;)
2071       {
2072         while (isspace(*value & 255))
2073           value ++;
2074
2075         if (*value == '\"' || *value == '\'')
2076         {
2077          /*
2078           * Grab quoted name...
2079           */
2080
2081           for (valptr = value + 1; *valptr != *value && *valptr; valptr ++);
2082
2083           value ++;
2084         }
2085         else
2086         {
2087          /*
2088           * Grab literal name.
2089           */
2090
2091           for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2092         }
2093
2094         if (*valptr)
2095           *valptr++ = '\0';
2096
2097         AddName(loc, value);
2098
2099         for (value = valptr; isspace(*value & 255); value ++);
2100       }
2101     }
2102     else if (!strcasecmp(line, "Satisfy"))
2103     {
2104       if (!strcasecmp(value, "all"))
2105         loc->satisfy = AUTH_SATISFY_ALL;
2106       else if (!strcasecmp(value, "any"))
2107         loc->satisfy = AUTH_SATISFY_ANY;
2108       else
2109         LogMessage(L_WARN, "Unknown Satisfy value %s on line %d.", value,
2110                    linenum);
2111     }
2112     else
2113       LogMessage(L_ERROR, "Unknown Location directive %s on line %d.",
2114                  line, linenum);
2115   }
2116
2117   LogMessage(L_ERROR, "Unexpected end-of-file at line %d while reading location!",
2118              linenum);
2119
2120   return (0);
2121 }
2122
2123
2124 /*
2125  * 'read_policy()' - Read a <Policy name> definition.
2126  */
2127
2128 static int                              /* O - New line number or 0 on error */
2129 read_policy(cups_file_t *fp,            /* I - Configuration file */
2130             char        *policy,        /* I - Location name/path */
2131             int         linenum)        /* I - Current line number */
2132 {
2133   int           i;                      /* Looping var */
2134   policy_t      *pol;                   /* Policy */
2135   policyop_t    *op;                    /* Policy operation */
2136   int           num_ops;                /* Number of IPP operations */
2137   ipp_op_t      ops[100];               /* Operations */
2138   char          line[HTTP_MAX_BUFFER],  /* Line buffer */
2139                 *value,                 /* Value for directive */
2140                 *valptr;                /* Pointer into value */
2141
2142
2143  /*
2144   * Create the policy...
2145   */
2146
2147   if ((pol = AddPolicy(policy)) == NULL)
2148     return (0);
2149
2150  /*
2151   * Read from the file...
2152   */
2153
2154   op      = NULL;
2155   num_ops = 0;
2156
2157   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
2158   {
2159    /*
2160     * Decode the directive...
2161     */
2162
2163     if (!strcasecmp(line, "</Policy>"))
2164     {
2165       if (op)
2166         LogMessage(L_WARN, "Missing </Limit> before </Policy> on line %d!",
2167                    linenum);
2168
2169       return (linenum);
2170     }
2171     else if (!strcasecmp(line, "<Limit") && !op)
2172     {
2173       if (!value)
2174       {
2175         LogMessage(L_ERROR, "Syntax error on line %d.", linenum);
2176         return (0);
2177       }
2178
2179      /*
2180       * Scan for IPP operation names...
2181       */
2182
2183       num_ops = 0;
2184
2185       while (*value)
2186       {
2187         for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2188
2189         if (*valptr)
2190           *valptr++ = '\0';
2191
2192         if (num_ops < (int)(sizeof(ops) / sizeof(ops[0])))
2193         {
2194           if ((ops[num_ops] = get_operation(value)) == IPP_BAD_OPERATION)
2195             LogMessage(L_ERROR, "Bad IPP operation name \"%s\" on line %d!",
2196                        value, linenum);
2197           else
2198             num_ops ++;
2199         }
2200         else
2201           LogMessage(L_ERROR, "Too many operations listed on line %d!",
2202                      linenum);
2203
2204         for (value = valptr; isspace(*value & 255); value ++);
2205       }
2206
2207      /*
2208       * If none are specified, apply the policy to all operations...
2209       */
2210
2211       if (num_ops == 0)
2212       {
2213         ops[0]  = IPP_ANY_OPERATION;
2214         num_ops = 1;
2215       }
2216
2217      /*
2218       * Add a new policy for the first operation...
2219       */
2220
2221       op = AddPolicyOp(pol, NULL, ops[0]);
2222     }
2223     else if (!strcasecmp(line, "</Limit>") && op)
2224     {
2225      /*
2226       * Finish the current operation limit...
2227       */
2228
2229       if (num_ops > 1)
2230       {
2231        /*
2232         * Copy the policy to the other operations...
2233         */
2234
2235         for (i = 1; i < num_ops; i ++)
2236           AddPolicyOp(pol, op, ops[i]);
2237       }
2238
2239       op = NULL;
2240     }
2241     else if (!strcasecmp(line, "Authenticate") && op)
2242     {
2243      /*
2244       * Authenticate boolean
2245       */
2246
2247       if (!strcasecmp(value, "on") ||
2248           !strcasecmp(value, "yes") ||
2249           !strcasecmp(value, "true"))
2250         op->authenticate = 1;
2251       else if (!strcasecmp(value, "off") ||
2252                !strcasecmp(value, "no") ||
2253                !strcasecmp(value, "false"))
2254         op->authenticate = 0;
2255       else
2256         LogMessage(L_ERROR, "Invalid Authenticate value \"%s\" on line %d!\n",
2257                    value, linenum);
2258     }
2259     else if (!strcasecmp(line, "Order") && op)
2260     {
2261      /*
2262       * "Order Deny,Allow" or "Order Allow,Deny"...
2263       */
2264
2265       if (!strncasecmp(value, "deny", 4))
2266         op->order_type = POLICY_ALLOW;
2267       else if (!strncasecmp(value, "allow", 5))
2268         op->order_type = POLICY_DENY;
2269       else
2270         LogMessage(L_ERROR, "Unknown Order value %s on line %d.",
2271                    value, linenum);
2272     }
2273     else if ((!strcasecmp(line, "Allow") || !strcasecmp(line, "Deny")) && op)
2274     {
2275      /*
2276       * Allow line, @group, @OWNER
2277       * Deny line, @group, @OWNER
2278       */
2279
2280       for (value = valptr; *value;)
2281       {
2282         while (isspace(*value & 255))
2283           value ++;
2284
2285         if (*value == '\"' || *value == '\'')
2286         {
2287          /*
2288           * Grab quoted name...
2289           */
2290
2291           for (valptr = value + 1; *valptr != *value && *valptr; valptr ++);
2292
2293           value ++;
2294         }
2295         else
2296         {
2297          /*
2298           * Grab literal name.
2299           */
2300
2301           for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
2302         }
2303
2304         if (*valptr)
2305           *valptr++ = '\0';
2306
2307         if (!strcasecmp(line, "Allow"))
2308           AddPolicyOpName(op, POLICY_ALLOW, value);
2309         else
2310           AddPolicyOpName(op, POLICY_DENY, value);
2311
2312         for (value = valptr; isspace(*value & 255); value ++);
2313       }
2314     }
2315     else if (op)
2316       LogMessage(L_ERROR, "Unknown Policy Limit directive %s on line %d.",
2317                  line, linenum);
2318     else
2319       LogMessage(L_ERROR, "Unknown Policy directive %s on line %d.",
2320                  line, linenum);
2321   }
2322
2323   LogMessage(L_ERROR, "Unexpected end-of-file at line %d while reading policy \"%s\"!",
2324              linenum, policy);
2325
2326   return (0);
2327 }
2328
2329
2330 /*
2331  * 'get_address()' - Get an address + port number from a line.
2332  */
2333
2334 static int                              /* O - 1 if address good, 0 if bad */
2335 get_address(const char  *value,         /* I - Value string */
2336             unsigned    defaddress,     /* I - Default address */
2337             int         defport,        /* I - Default port */
2338             int         deffamily,      /* I - Default family */
2339             http_addr_t *address)       /* O - Socket address */
2340 {
2341   char                  hostname[256],  /* Hostname or IP */
2342                         portname[256];  /* Port number or name */
2343   struct hostent        *host;          /* Host address */
2344   struct servent        *port;          /* Port number */
2345
2346
2347  /*
2348   * Initialize the socket address to the defaults...
2349   */
2350
2351   memset(address, 0, sizeof(http_addr_t));
2352
2353 #ifdef AF_INET6
2354   if (deffamily == AF_INET6)
2355   {
2356     address->ipv6.sin6_family            = AF_INET6;
2357     address->ipv6.sin6_addr.s6_addr32[0] = htonl(defaddress);
2358     address->ipv6.sin6_addr.s6_addr32[1] = htonl(defaddress);
2359     address->ipv6.sin6_addr.s6_addr32[2] = htonl(defaddress);
2360     address->ipv6.sin6_addr.s6_addr32[3] = htonl(defaddress);
2361     address->ipv6.sin6_port              = htons(defport);
2362   }
2363   else
2364 #endif /* AF_INET6 */
2365   {
2366     address->ipv4.sin_family      = AF_INET;
2367     address->ipv4.sin_addr.s_addr = htonl(defaddress);
2368     address->ipv4.sin_port        = htons(defport);
2369   }
2370
2371 #ifdef AF_LOCAL
2372  /*
2373   * If the address starts with a "/", it is a domain socket...
2374   */
2375
2376   if (*value == '/')
2377   {
2378     if (strlen(value) >= sizeof(address->un.sun_path))
2379     {
2380       LogMessage(L_ERROR, "Domain socket name \"%s\" too long!", value);
2381       return (0);
2382     }
2383
2384     address->un.sun_family = AF_LOCAL;
2385     strcpy(address->un.sun_path, value);
2386
2387     return (1);
2388   }
2389 #endif /* AF_LOCAL */
2390
2391  /*
2392   * Try to grab a hostname and port number...
2393   */
2394
2395   switch (sscanf(value, "%255[^:]:%255s", hostname, portname))
2396   {
2397     case 1 :
2398         if (strchr(hostname, '.') == NULL && defaddress == INADDR_ANY)
2399         {
2400          /*
2401           * Hostname is a port number...
2402           */
2403
2404           strlcpy(portname, hostname, sizeof(portname));
2405           hostname[0] = '\0';
2406         }
2407         else
2408           portname[0] = '\0';
2409         break;
2410
2411     case 2 :
2412         break;
2413
2414     default :
2415         LogMessage(L_ERROR, "Unable to decode address \"%s\"!", value);
2416         return (0);
2417   }
2418
2419  /*
2420   * Decode the hostname and port number as needed...
2421   */
2422
2423   if (hostname[0] && strcmp(hostname, "*"))
2424   {
2425     if ((host = httpGetHostByName(hostname)) == NULL)
2426     {
2427       LogMessage(L_ERROR, "httpGetHostByName(\"%s\") failed - %s!", hostname,
2428                  hstrerror(h_errno));
2429       return (0);
2430     }
2431
2432     httpAddrLoad(host, defport, 0, address);
2433   }
2434
2435   if (portname[0] != '\0')
2436   {
2437     if (isdigit(portname[0] & 255))
2438     {
2439 #ifdef AF_INET6
2440       if (address->addr.sa_family == AF_INET6)
2441         address->ipv6.sin6_port = htons(atoi(portname));
2442       else
2443 #endif /* AF_INET6 */
2444       address->ipv4.sin_port = htons(atoi(portname));
2445     }
2446     else
2447     {
2448       if ((port = getservbyname(portname, NULL)) == NULL)
2449       {
2450         LogMessage(L_ERROR, "getservbyname(\"%s\") failed - %s!", portname,
2451                    strerror(errno));
2452         return (0);
2453       }
2454       else
2455       {
2456 #ifdef AF_INET6
2457         if (address->addr.sa_family == AF_INET6)
2458           address->ipv6.sin6_port = htons(port->s_port);
2459         else
2460 #endif /* AF_INET6 */
2461         address->ipv4.sin_port = htons(port->s_port);
2462       }
2463     }
2464   }
2465
2466   return (1);
2467 }
2468
2469
2470 /*
2471  * 'get_addr_and_mask()' - Get an IP address and netmask.
2472  */
2473
2474 static int                              /* O - 1 on success, 0 on failure */
2475 get_addr_and_mask(const char *value,    /* I - String from config file */
2476                   unsigned   *ip,       /* O - Address value */
2477                   unsigned   *mask)     /* O - Mask value */
2478 {
2479   int           i,                      /* Looping var */
2480                 family,                 /* Address family */
2481                 ipcount;                /* Count of fields in address */
2482   static unsigned netmasks[4][4] =      /* Standard netmasks... */
2483   {
2484     { 0xffffffff, 0x00000000, 0x00000000, 0x00000000 },
2485     { 0xffffffff, 0xffffffff, 0x00000000, 0x00000000 },
2486     { 0xffffffff, 0xffffffff, 0xffffffff, 0x00000000 },
2487     { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
2488   };
2489
2490
2491  /*
2492   * Get the address...
2493   */
2494
2495   memset(ip, 0, sizeof(unsigned) * 4);
2496   family  = AF_INET;
2497   ipcount = sscanf(value, "%u.%u.%u.%u", ip + 0, ip + 1, ip + 2, ip + 3);
2498
2499 #ifdef AF_INET6
2500  /*
2501   * See if we have any values > 255; if so, this is an IPv6 address only.
2502   */
2503
2504   for (i = 0; i < ipcount; i ++)
2505     if (ip[0] > 255)
2506     {
2507       family = AF_INET6;
2508       break;
2509     }
2510 #endif /* AF_INET6 */
2511
2512   if ((value = strchr(value, '/')) != NULL)
2513   {
2514    /*
2515     * Get the netmask value(s)...
2516     */
2517
2518     value ++;
2519     memset(mask, 0, sizeof(unsigned) * 4);
2520     switch (sscanf(value, "%u.%u.%u.%u", mask + 0, mask + 1,
2521                    mask + 2, mask + 3))
2522     {
2523       case 1 :
2524 #ifdef AF_INET6
2525           if (mask[0] >= 32)
2526             family = AF_INET6;
2527
2528           if (family == AF_INET6)
2529           {
2530             i = 128 - mask[0];
2531
2532             if (i <= 96)
2533               mask[0] = 0xffffffff;
2534             else
2535               mask[0] = (0xffffffff << (128 - mask[0])) & 0xffffffff;
2536
2537             if (i <= 64)
2538               mask[1] = 0xffffffff;
2539             else if (i >= 96)
2540               mask[1] = 0;
2541             else
2542               mask[1] = (0xffffffff << (96 - mask[0])) & 0xffffffff;
2543
2544             if (i <= 32)
2545               mask[1] = 0xffffffff;
2546             else if (i >= 64)
2547               mask[1] = 0;
2548             else
2549               mask[1] = (0xffffffff << (64 - mask[0])) & 0xffffffff;
2550
2551             if (i >= 32)
2552               mask[1] = 0;
2553             else
2554               mask[1] = (0xffffffff << (32 - mask[0])) & 0xffffffff;
2555           }
2556           else
2557 #endif /* AF_INET6 */
2558           {
2559             i = 32 - mask[0];
2560
2561             if (i <= 24)
2562               mask[0] = 0xffffffff;
2563             else
2564               mask[0] = (0xffffffff << (32 - mask[0])) & 0xffffffff;
2565
2566             if (i <= 16)
2567               mask[1] = 0xffffffff;
2568             else if (i >= 24)
2569               mask[1] = 0;
2570             else
2571               mask[1] = (0xffffffff << (24 - mask[0])) & 0xffffffff;
2572
2573             if (i <= 8)
2574               mask[1] = 0xffffffff;
2575             else if (i >= 16)
2576               mask[1] = 0;
2577             else
2578               mask[1] = (0xffffffff << (16 - mask[0])) & 0xffffffff;
2579
2580             if (i >= 8)
2581               mask[1] = 0;
2582             else
2583               mask[1] = (0xffffffff << (8 - mask[0])) & 0xffffffff;
2584           }
2585
2586       case 4 :
2587           break;
2588
2589       default :
2590           return (0);
2591     }
2592   }
2593   else
2594     memcpy(mask, netmasks[ipcount - 1], sizeof(unsigned) * 4);
2595
2596  /*
2597   * Check for a valid netmask; no fallback like in CUPS 1.1.x!
2598   */
2599
2600   if ((ip[0] & ~mask[0]) != 0 ||
2601       (ip[1] & ~mask[1]) != 0 ||
2602       (ip[2] & ~mask[2]) != 0 ||
2603       (ip[3] & ~mask[3]) != 0)
2604     return (0);
2605
2606   return (1);
2607 }
2608
2609
2610 /*
2611  * 'get_operation()' - Get an IPP opcode from an operation name...
2612  */
2613
2614 static ipp_op_t                         /* O - Operation code or -1 on error */
2615 get_operation(const char *name)         /* I - Operating name */
2616 {
2617   int           i;                      /* Looping var */
2618   static const char * const ipp_ops[] = /* List of standard operations */
2619                 {
2620                   /* 0x0000 */ "all",
2621                   /* 0x0001 */ "",
2622                   /* 0x0002 */ "print-job",
2623                   /* 0x0003 */ "print-uri",
2624                   /* 0x0004 */ "validate-job",
2625                   /* 0x0005 */ "create-job",
2626                   /* 0x0006 */ "send-document",
2627                   /* 0x0007 */ "send-uri",
2628                   /* 0x0008 */ "cancel-job",
2629                   /* 0x0009 */ "get-job-attributes",
2630                   /* 0x000a */ "get-jobs",
2631                   /* 0x000b */ "get-printer-attributes",
2632                   /* 0x000c */ "hold-job",
2633                   /* 0x000d */ "release-job",
2634                   /* 0x000e */ "restart-job",
2635                   /* 0x000f */ "",
2636                   /* 0x0010 */ "pause-printer",
2637                   /* 0x0011 */ "resume-printer",
2638                   /* 0x0012 */ "purge-jobs",
2639                   /* 0x0013 */ "set-printer-attributes",
2640                   /* 0x0014 */ "set-job-attributes",
2641                   /* 0x0015 */ "get-printer-supported-values",
2642                   /* 0x0016 */ "create-printer-subscription",
2643                   /* 0x0017 */ "create-job-subscription",
2644                   /* 0x0018 */ "get-subscription-attributes",
2645                   /* 0x0019 */ "get-subscriptions",
2646                   /* 0x001a */ "renew-subscription",
2647                   /* 0x001b */ "cancel-subscription",
2648                   /* 0x001c */ "get-notifications",
2649                   /* 0x001d */ "send-notifications",
2650                   /* 0x001e */ "",
2651                   /* 0x001f */ "",
2652                   /* 0x0020 */ "",
2653                   /* 0x0021 */ "get-print-support-files",
2654                   /* 0x0022 */ "enable-printer",
2655                   /* 0x0023 */ "disable-printer",
2656                   /* 0x0024 */ "pause-printer-after-current-job",
2657                   /* 0x0025 */ "hold-new-jobs",
2658                   /* 0x0026 */ "release-held-new-jobs",
2659                   /* 0x0027 */ "deactivate-printer",
2660                   /* 0x0028 */ "activate-printer",
2661                   /* 0x0029 */ "restart-printer",
2662                   /* 0x002a */ "shutdown-printer",
2663                   /* 0x002b */ "startup-printer",
2664                   /* 0x002c */ "reprocess-job",
2665                   /* 0x002d */ "cancel-current-job",
2666                   /* 0x002e */ "suspend-current-job",
2667                   /* 0x002f */ "resume-job",
2668                   /* 0x0030 */ "promote-job",
2669                   /* 0x0031 */ "schedule-job-after"
2670                 },
2671                 *cups_ops[] =           /* List of CUPS operations */
2672                 {
2673                   /* 0x4001 */ "cups-get-default",
2674                   /* 0x4002 */ "cups-get-printers",
2675                   /* 0x4003 */ "cups-add-printer",
2676                   /* 0x4004 */ "cups-delete-printer",
2677                   /* 0x4005 */ "cups-get-classes",
2678                   /* 0x4006 */ "cups-add-class",
2679                   /* 0x4007 */ "cups-delete-class",
2680                   /* 0x4008 */ "cups-accept-jobs",
2681                   /* 0x4009 */ "cups-reject-jobs",
2682                   /* 0x400a */ "cups-set-default",
2683                   /* 0x400b */ "cups-get-devices",
2684                   /* 0x400c */ "cups-get-ppds",
2685                   /* 0x400d */ "cups-move-job",
2686                   /* 0x400e */ "cups-add-device",
2687                   /* 0x400f */ "cups-delete-device"
2688                 };
2689
2690
2691   for (i = 0; i < (int)(sizeof(ipp_ops) / sizeof(ipp_ops[0])); i ++)
2692     if (!strcasecmp(name, ipp_ops[i]))
2693       return ((ipp_op_t)i);
2694
2695   for (i = 0; i < (int)(sizeof(cups_ops) / sizeof(cups_ops[0])); i ++)
2696     if (!strcasecmp(name, cups_ops[i]))
2697       return ((ipp_op_t)(i + 0x4001));
2698
2699   return ((ipp_op_t)-1);
2700 }
2701
2702
2703 #ifdef HAVE_CDSASSL
2704 /*
2705  * 'CDSAGetServerCerts()' - Convert a keychain name into the CFArrayRef
2706  *                          required by SSLSetCertificate.
2707  *
2708  * For now we assumes that there is exactly one SecIdentity in the
2709  * keychain - i.e. there is exactly one matching cert/private key pair.
2710  * In the future we will search a keychain for a SecIdentity matching a
2711  * specific criteria.  We also skip the operation of adding additional
2712  * non-signing certs from the keychain to the CFArrayRef.
2713  *
2714  * To create a self-signed certificate for testing use the certtool.
2715  * Executing the following as root will do it:
2716  *
2717  *     certtool c c v k=CUPS
2718  */
2719
2720 static CFArrayRef
2721 CDSAGetServerCerts(void)
2722 {
2723   OSStatus              err;            /* Error info */
2724   SecKeychainRef        kcRef;          /* Keychain reference */
2725   SecIdentitySearchRef  srchRef;        /* Search reference */
2726   SecIdentityRef        identity;       /* Identity */
2727   CFArrayRef            ca;             /* Certificate array */
2728
2729
2730   kcRef    = NULL;
2731   srchRef  = NULL;
2732   identity = NULL;
2733   ca       = NULL;
2734   err      = SecKeychainOpen(ServerCertificate, &kcRef);
2735
2736   if (err)
2737     LogMessage(L_ERROR, "Cannot open keychain \"%s\", error %d.",
2738                ServerCertificate, err);
2739   else
2740   {
2741    /*
2742     * Search for "any" identity matching specified key use;
2743     * in this app, we expect there to be exactly one.
2744     */
2745
2746     err = SecIdentitySearchCreate(kcRef, CSSM_KEYUSE_SIGN, &srchRef);
2747
2748     if (err)
2749       LogMessage(L_ERROR,
2750                  "Cannot find signing key in keychain \"%s\", error %d",
2751                  ServerCertificate, err);
2752     else
2753     {
2754       err = SecIdentitySearchCopyNext(srchRef, &identity);
2755
2756       if (err)
2757         LogMessage(L_ERROR,
2758                    "Cannot find signing key in keychain \"%s\", error %d",
2759                    ServerCertificate, err);
2760       else
2761       {
2762         if (CFGetTypeID(identity) != SecIdentityGetTypeID())
2763           LogMessage(L_ERROR, "SecIdentitySearchCopyNext CFTypeID failure!");
2764         else
2765         {
2766          /*
2767           * Found one. Place it in a CFArray.
2768           * TBD: snag other (non-identity) certs from keychain and add them
2769           * to array as well.
2770           */
2771
2772           ca = CFArrayCreate(NULL, (const void **)&identity, 1, NULL);
2773
2774           if (ca == nil)
2775             LogMessage(L_ERROR, "CFArrayCreate error");
2776         }
2777
2778         /*CFRelease(identity);*/
2779       }
2780
2781       /*CFRelease(srchRef);*/
2782     }
2783
2784     /*CFRelease(kcRef);*/
2785   }
2786
2787   return ca;
2788 }
2789 #endif /* HAVE_CDSASSL */
2790
2791
2792 /*
2793  * End of "$Id$".
2794  */