scheduler/conf.c

   1 /*
   2  * "$Id: conf.c 9352 2010-11-06 04:55:26Z mike $"
   3  *
   4  *   Configuration routines for the CUPS scheduler.
   5  *
   6  *   Copyright 2007-2012 by Apple Inc.
   7  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
   8  *
   9  *   These coded instructions, statements, and computer programs are the
  10  *   property of Apple Inc. and are protected by Federal copyright
  11  *   law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  12  *   which should have been included with this file.  If this file is
  13  *   file is missing or damaged, see the license at "http://www.cups.org/".
  14  *
  15  * Contents:
  16  *
  17  *   cupsdAddAlias()          - Add a host alias.
  18  *   cupsdCheckPermissions()  - Fix the mode and ownership of a file or
  19  *                              directory.
  20  *   cupsdDefaultAuthType()   - Get the default AuthType.
  21  *   cupsdFreeAliases()       - Free all of the alias entries.
  22  *   cupsdReadConfiguration() - Read the cupsd.conf file.
  23  *   get_address()            - Get an address + port number from a line.
  24  *   get_addr_and_mask()      - Get an IP address and netmask.
  25  *   mime_error_cb()          - Log a MIME error.
  26  *   parse_aaa()              - Parse authentication, authorization, and access
  27  *                              control lines.
  28  *   parse_fatal_errors()     - Parse FatalErrors values in a string.
  29  *   parse_groups()           - Parse system group names in a string.
  30  *   parse_protocols()        - Parse browse protocols in a string.
  31  *   read_configuration()     - Read a configuration file.
  32  *   read_location()          - Read a <Location path> definition.
  33  *   read_policy()            - Read a <Policy name> definition.
  34  *   set_policy_defaults()    - Set default policy values as needed.
  35  */
  36
  37 /*
  38  * Include necessary headers...
  39  */
  40
  41 #include "cupsd.h"
  42 #include <stdarg.h>
  43 #include <grp.h>
  44 #include <sys/utsname.h>
  45 #include <syslog.h>
  46
  47 #ifdef HAVE_LIBPAPER
  48 #  include <paper.h>
  49 #endif /* HAVE_LIBPAPER */
  50
  51
  52 /*
  53  * Possibly missing network definitions...
  54  */
  55
  56 #ifndef INADDR_NONE
  57 #  define INADDR_NONE   0xffffffff
  58 #endif /* !INADDR_NONE */
  59
  60
  61 /*
  62  * Configuration variable structure...
  63  */
  64
  65 typedef enum
  66 {
  67   CUPSD_VARTYPE_INTEGER,                /* Integer option */
  68   CUPSD_VARTYPE_TIME,                   /* Time interval option */
  69   CUPSD_VARTYPE_STRING,                 /* String option */
  70   CUPSD_VARTYPE_BOOLEAN,                /* Boolean option */
  71   CUPSD_VARTYPE_PATHNAME                /* File/directory name option */
  72 } cupsd_vartype_t;
  73
  74 typedef struct
  75 {
  76   const char            *name;          /* Name of variable */
  77   void                  *ptr;           /* Pointer to variable */
  78   cupsd_vartype_t       type;           /* Type (int, string, address) */
  79 } cupsd_var_t;
  80
  81
  82 /*
  83  * Local globals...
  84  */
  85
  86 static int                      default_auth_type       = CUPSD_AUTH_AUTO;
  87                                         /* Default AuthType, if not specified */
  88 static const cupsd_var_t        variables[] =
  89 {
  90   { "AccessLog",                &AccessLog,             CUPSD_VARTYPE_STRING },
  91   { "AutoPurgeJobs",            &JobAutoPurge,          CUPSD_VARTYPE_BOOLEAN },
  92 #ifdef HAVE_DNSSD
  93   { "BrowseDNSSDRegType",       &DNSSDRegType,          CUPSD_VARTYPE_STRING },
  94 #endif /* HAVE_DNSSD */
  95   { "BrowseWebIF",              &BrowseWebIF,           CUPSD_VARTYPE_BOOLEAN },
  96   { "Browsing",                 &Browsing,              CUPSD_VARTYPE_BOOLEAN },
  97   { "CacheDir",                 &CacheDir,              CUPSD_VARTYPE_STRING },
  98   { "Classification",           &Classification,        CUPSD_VARTYPE_STRING },
  99   { "ClassifyOverride",         &ClassifyOverride,      CUPSD_VARTYPE_BOOLEAN },
 100   { "ConfigFilePerm",           &ConfigFilePerm,        CUPSD_VARTYPE_INTEGER },
 101   { "DataDir",                  &DataDir,               CUPSD_VARTYPE_STRING },
 102   { "DefaultLanguage",          &DefaultLanguage,       CUPSD_VARTYPE_STRING },
 103   { "DefaultLeaseDuration",     &DefaultLeaseDuration,  CUPSD_VARTYPE_TIME },
 104   { "DefaultPaperSize",         &DefaultPaperSize,      CUPSD_VARTYPE_STRING },
 105   { "DefaultPolicy",            &DefaultPolicy,         CUPSD_VARTYPE_STRING },
 106   { "DefaultShared",            &DefaultShared,         CUPSD_VARTYPE_BOOLEAN },
 107   { "DirtyCleanInterval",       &DirtyCleanInterval,    CUPSD_VARTYPE_TIME },
 108   { "DocumentRoot",             &DocumentRoot,          CUPSD_VARTYPE_STRING },
 109   { "ErrorLog",                 &ErrorLog,              CUPSD_VARTYPE_STRING },
 110   { "ErrorPolicy",              &ErrorPolicy,           CUPSD_VARTYPE_STRING },
 111   { "FileDevice",               &FileDevice,            CUPSD_VARTYPE_BOOLEAN },
 112   { "FilterLimit",              &FilterLimit,           CUPSD_VARTYPE_INTEGER },
 113   { "FilterNice",               &FilterNice,            CUPSD_VARTYPE_INTEGER },
 114   { "FontPath",                 &FontPath,              CUPSD_VARTYPE_STRING },
 115 #ifdef HAVE_GSSAPI
 116   { "GSSServiceName",           &GSSServiceName,        CUPSD_VARTYPE_STRING },
 117 #endif /* HAVE_GSSAPI */
 118   { "JobKillDelay",             &JobKillDelay,          CUPSD_VARTYPE_TIME },
 119   { "JobRetryLimit",            &JobRetryLimit,         CUPSD_VARTYPE_INTEGER },
 120   { "JobRetryInterval",         &JobRetryInterval,      CUPSD_VARTYPE_TIME },
 121   { "KeepAliveTimeout",         &KeepAliveTimeout,      CUPSD_VARTYPE_TIME },
 122   { "KeepAlive",                &KeepAlive,             CUPSD_VARTYPE_BOOLEAN },
 123 #ifdef HAVE_LAUNCHD
 124   { "LaunchdTimeout",           &LaunchdTimeout,        CUPSD_VARTYPE_TIME },
 125 #endif /* HAVE_LAUNCHD */
 126   { "LimitRequestBody",         &MaxRequestSize,        CUPSD_VARTYPE_INTEGER },
 127   { "ListenBackLog",            &ListenBackLog,         CUPSD_VARTYPE_INTEGER },
 128   { "LogDebugHistory",          &LogDebugHistory,       CUPSD_VARTYPE_INTEGER },
 129   { "LogFilePerm",              &LogFilePerm,           CUPSD_VARTYPE_INTEGER },
 130   { "LPDConfigFile",            &LPDConfigFile,         CUPSD_VARTYPE_STRING },
 131   { "MaxActiveJobs",            &MaxActiveJobs,         CUPSD_VARTYPE_INTEGER },
 132   { "MaxClients",               &MaxClients,            CUPSD_VARTYPE_INTEGER },
 133   { "MaxClientsPerHost",        &MaxClientsPerHost,     CUPSD_VARTYPE_INTEGER },
 134   { "MaxCopies",                &MaxCopies,             CUPSD_VARTYPE_INTEGER },
 135   { "MaxEvents",                &MaxEvents,             CUPSD_VARTYPE_INTEGER },
 136   { "MaxHoldTime",              &MaxHoldTime,           CUPSD_VARTYPE_TIME },
 137   { "MaxJobs",                  &MaxJobs,               CUPSD_VARTYPE_INTEGER },
 138   { "MaxJobsPerPrinter",        &MaxJobsPerPrinter,     CUPSD_VARTYPE_INTEGER },
 139   { "MaxJobsPerUser",           &MaxJobsPerUser,        CUPSD_VARTYPE_INTEGER },
 140   { "MaxJobTime",               &MaxJobTime,            CUPSD_VARTYPE_INTEGER },
 141   { "MaxLeaseDuration",         &MaxLeaseDuration,      CUPSD_VARTYPE_TIME },
 142   { "MaxLogSize",               &MaxLogSize,            CUPSD_VARTYPE_INTEGER },
 143   { "MaxRequestSize",           &MaxRequestSize,        CUPSD_VARTYPE_INTEGER },
 144   { "MaxSubscriptions",         &MaxSubscriptions,      CUPSD_VARTYPE_INTEGER },
 145   { "MaxSubscriptionsPerJob",   &MaxSubscriptionsPerJob,        CUPSD_VARTYPE_INTEGER },
 146   { "MaxSubscriptionsPerPrinter",&MaxSubscriptionsPerPrinter,   CUPSD_VARTYPE_INTEGER },
 147   { "MaxSubscriptionsPerUser",  &MaxSubscriptionsPerUser,       CUPSD_VARTYPE_INTEGER },
 148   { "MultipleOperationTimeout", &MultipleOperationTimeout,      CUPSD_VARTYPE_TIME },
 149   { "PageLog",                  &PageLog,               CUPSD_VARTYPE_STRING },
 150   { "PageLogFormat",            &PageLogFormat,         CUPSD_VARTYPE_STRING },
 151   { "PreserveJobFiles",         &JobFiles,              CUPSD_VARTYPE_TIME },
 152   { "PreserveJobHistory",       &JobHistory,            CUPSD_VARTYPE_TIME },
 153   { "Printcap",                 &Printcap,              CUPSD_VARTYPE_STRING },
 154   { "PrintcapGUI",              &PrintcapGUI,           CUPSD_VARTYPE_STRING },
 155   { "ReloadTimeout",            &ReloadTimeout,         CUPSD_VARTYPE_TIME },
 156   { "RemoteRoot",               &RemoteRoot,            CUPSD_VARTYPE_STRING },
 157   { "RequestRoot",              &RequestRoot,           CUPSD_VARTYPE_STRING },
 158   { "RIPCache",                 &RIPCache,              CUPSD_VARTYPE_STRING },
 159   { "RootCertDuration",         &RootCertDuration,      CUPSD_VARTYPE_TIME },
 160   { "ServerAdmin",              &ServerAdmin,           CUPSD_VARTYPE_STRING },
 161   { "ServerBin",                &ServerBin,             CUPSD_VARTYPE_PATHNAME },
 162 #ifdef HAVE_SSL
 163   { "ServerCertificate",        &ServerCertificate,     CUPSD_VARTYPE_PATHNAME },
 164 #  if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS)
 165   { "ServerKey",                &ServerKey,             CUPSD_VARTYPE_PATHNAME },
 166 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
 167 #endif /* HAVE_SSL */
 168   { "ServerName",               &ServerName,            CUPSD_VARTYPE_STRING },
 169   { "ServerRoot",               &ServerRoot,            CUPSD_VARTYPE_PATHNAME },
 170   { "SMBConfigFile",            &SMBConfigFile,         CUPSD_VARTYPE_STRING },
 171   { "StateDir",                 &StateDir,              CUPSD_VARTYPE_STRING },
 172 #ifdef HAVE_AUTHORIZATION_H
 173   { "SystemGroupAuthKey",       &SystemGroupAuthKey,    CUPSD_VARTYPE_STRING },
 174 #endif /* HAVE_AUTHORIZATION_H */
 175   { "TempDir",                  &TempDir,               CUPSD_VARTYPE_PATHNAME },
 176   { "Timeout",                  &Timeout,               CUPSD_VARTYPE_TIME },
 177   { "WebInterface",             &WebInterface,          CUPSD_VARTYPE_BOOLEAN }
 178 };
 179 #define NUM_VARS        (sizeof(variables) / sizeof(variables[0]))
 180
 181
 182 static const unsigned   ones[4] =
 183                         {
 184                           0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff
 185                         };
 186 static const unsigned   zeros[4] =
 187                         {
 188                           0x00000000, 0x00000000, 0x00000000, 0x00000000
 189                         };
 190
 191
 192 /*
 193  * Local functions...
 194  */
 195
 196 static http_addrlist_t  *get_address(const char *value, int defport);
 197 static int              get_addr_and_mask(const char *value, unsigned *ip,
 198                                           unsigned *mask);
 199 static void             mime_error_cb(void *ctx, const char *message);
 200 static int              parse_aaa(cupsd_location_t *loc, char *line,
 201                                   char *value, int linenum);
 202 static int              parse_fatal_errors(const char *s);
 203 static int              parse_groups(const char *s);
 204 static int              parse_protocols(const char *s);
 205 static int              read_configuration(cups_file_t *fp);
 206 static int              read_location(cups_file_t *fp, char *name, int linenum);
 207 static int              read_policy(cups_file_t *fp, char *name, int linenum);
 208 static void             set_policy_defaults(cupsd_policy_t *pol);
 209
 210
 211 /*
 212  * 'cupsdAddAlias()' - Add a host alias.
 213  */
 214
 215 void
 216 cupsdAddAlias(cups_array_t *aliases,    /* I - Array of aliases */
 217               const char   *name)       /* I - Name to add */
 218 {
 219   cupsd_alias_t *a;                     /*  New alias */
 220   size_t        namelen;                /* Length of name */
 221
 222
 223   namelen = strlen(name);
 224
 225   if ((a = (cupsd_alias_t *)malloc(sizeof(cupsd_alias_t) + namelen)) == NULL)
 226     return;
 227
 228   a->namelen = namelen;
 229   strcpy(a->name, name);                /* OK since a->name is allocated */
 230
 231   cupsArrayAdd(aliases, a);
 232 }
 233
 234
 235 /*
 236  * 'cupsdCheckPermissions()' - Fix the mode and ownership of a file or directory.
 237  */
 238
 239 int                                     /* O - 0 on success, -1 on error, 1 on warning */
 240 cupsdCheckPermissions(
 241     const char *filename,               /* I - File/directory name */
 242     const char *suffix,                 /* I - Additional file/directory name */
 243     int        mode,                    /* I - Permissions */
 244     int        user,                    /* I - Owner */
 245     int        group,                   /* I - Group */
 246     int        is_dir,                  /* I - 1 = directory, 0 = file */
 247     int        create_dir)              /* I - 1 = create directory, -1 = create w/o logging, 0 = not */
 248 {
 249   int           dir_created = 0;        /* Did we create a directory? */
 250   char          pathname[1024];         /* File name with prefix */
 251   struct stat   fileinfo;               /* Stat buffer */
 252   int           is_symlink;             /* Is "filename" a symlink? */
 253
 254
 255  /*
 256   * Prepend the given root to the filename before testing it...
 257   */
 258
 259   if (suffix)
 260   {
 261     snprintf(pathname, sizeof(pathname), "%s/%s", filename, suffix);
 262     filename = pathname;
 263   }
 264
 265  /*
 266   * See if we can stat the file/directory...
 267   */
 268
 269   if (lstat(filename, &fileinfo))
 270   {
 271     if (errno == ENOENT && create_dir)
 272     {
 273       if (create_dir > 0)
 274         cupsdLogMessage(CUPSD_LOG_DEBUG, "Creating missing directory \"%s\"",
 275                         filename);
 276
 277       if (mkdir(filename, mode))
 278       {
 279         if (create_dir > 0)
 280           cupsdLogMessage(CUPSD_LOG_ERROR,
 281                           "Unable to create directory \"%s\" - %s", filename,
 282                           strerror(errno));
 283         else
 284           syslog(LOG_ERR, "Unable to create directory \"%s\" - %s", filename,
 285                  strerror(errno));
 286
 287         return (-1);
 288       }
 289
 290       dir_created      = 1;
 291       fileinfo.st_mode = mode | S_IFDIR;
 292     }
 293     else
 294       return (create_dir ? -1 : 1);
 295   }
 296
 297   if ((is_symlink = S_ISLNK(fileinfo.st_mode)) != 0)
 298   {
 299     if (stat(filename, &fileinfo))
 300     {
 301       cupsdLogMessage(CUPSD_LOG_ERROR, "\"%s\" is a bad symlink - %s",
 302                       filename, strerror(errno));
 303       return (-1);
 304     }
 305   }
 306
 307  /*
 308   * Make sure it's a regular file or a directory as needed...
 309   */
 310
 311   if (!dir_created && !is_dir && !S_ISREG(fileinfo.st_mode))
 312   {
 313     cupsdLogMessage(CUPSD_LOG_ERROR, "\"%s\" is not a regular file.", filename);
 314     return (-1);
 315   }
 316
 317   if (!dir_created && is_dir && !S_ISDIR(fileinfo.st_mode))
 318   {
 319     if (create_dir >= 0)
 320       cupsdLogMessage(CUPSD_LOG_ERROR, "\"%s\" is not a directory.", filename);
 321     else
 322       syslog(LOG_ERR, "\"%s\" is not a directory.", filename);
 323
 324     return (-1);
 325   }
 326
 327  /*
 328   * If the filename is a symlink, do not change permissions (STR #2937)...
 329   */
 330
 331   if (is_symlink)
 332     return (0);
 333
 334  /*
 335   * Fix owner, group, and mode as needed...
 336   */
 337
 338   if (dir_created || fileinfo.st_uid != user || fileinfo.st_gid != group)
 339   {
 340     if (create_dir >= 0)
 341       cupsdLogMessage(CUPSD_LOG_DEBUG, "Repairing ownership of \"%s\"",
 342                       filename);
 343
 344     if (chown(filename, user, group) && !getuid())
 345     {
 346       if (create_dir >= 0)
 347         cupsdLogMessage(CUPSD_LOG_ERROR,
 348                         "Unable to change ownership of \"%s\" - %s", filename,
 349                         strerror(errno));
 350       else
 351         syslog(LOG_ERR, "Unable to change ownership of \"%s\" - %s", filename,
 352                strerror(errno));
 353
 354       return (1);
 355     }
 356   }
 357
 358   if (dir_created || (fileinfo.st_mode & 07777) != mode)
 359   {
 360     if (create_dir >= 0)
 361       cupsdLogMessage(CUPSD_LOG_DEBUG, "Repairing access permissions of \"%s\"",
 362                       filename);
 363
 364     if (chmod(filename, mode))
 365     {
 366       if (create_dir >= 0)
 367         cupsdLogMessage(CUPSD_LOG_ERROR,
 368                         "Unable to change permissions of \"%s\" - %s", filename,
 369                         strerror(errno));
 370       else
 371         syslog(LOG_ERR, "Unable to change permissions of \"%s\" - %s", filename,
 372                strerror(errno));
 373
 374       return (1);
 375     }
 376   }
 377
 378  /*
 379   * Everything is OK...
 380   */
 381
 382   return (0);
 383 }
 384
 385
 386 /*
 387  * 'cupsdDefaultAuthType()' - Get the default AuthType.
 388  *
 389  * When the default_auth_type is "auto", this function tries to get the GSS
 390  * credentials for the server.  If that succeeds we use Kerberos authentication,
 391  * otherwise we do a fallback to Basic authentication against the local user
 392  * accounts.
 393  */
 394
 395 int                                     /* O - Default AuthType value */
 396 cupsdDefaultAuthType(void)
 397 {
 398 #ifdef HAVE_GSSAPI
 399   OM_uint32     major_status,           /* Major status code */
 400                 minor_status;           /* Minor status code */
 401   gss_name_t    server_name;            /* Server name */
 402   gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
 403                                         /* Service name token */
 404   char          buf[1024];              /* Service name buffer */
 405 #endif /* HAVE_GSSAPI */
 406
 407
 408  /*
 409   * If we have already determined the correct default AuthType, use it...
 410   */
 411
 412   if (default_auth_type != CUPSD_AUTH_AUTO)
 413     return (default_auth_type);
 414
 415 #ifdef HAVE_GSSAPI
 416 #  ifdef __APPLE__
 417  /*
 418   * If the weak-linked GSSAPI/Kerberos library is not present, don't try
 419   * to use it...
 420   */
 421
 422   if (gss_init_sec_context == NULL)
 423     return (default_auth_type = CUPSD_AUTH_BASIC);
 424 #  endif /* __APPLE__ */
 425
 426  /*
 427   * Try to obtain the server's GSS credentials (GSSServiceName@servername).  If
 428   * that fails we must use Basic...
 429   */
 430
 431   snprintf(buf, sizeof(buf), "%s@%s", GSSServiceName, ServerName);
 432
 433   token.value  = buf;
 434   token.length = strlen(buf);
 435   server_name  = GSS_C_NO_NAME;
 436   major_status = gss_import_name(&minor_status, &token,
 437                                  GSS_C_NT_HOSTBASED_SERVICE,
 438                                  &server_name);
 439
 440   memset(&token, 0, sizeof(token));
 441
 442   if (GSS_ERROR(major_status))
 443   {
 444     cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
 445                        "cupsdDefaultAuthType: gss_import_name(%s) failed", buf);
 446     return (default_auth_type = CUPSD_AUTH_BASIC);
 447   }
 448
 449   major_status = gss_display_name(&minor_status, server_name, &token, NULL);
 450
 451   if (GSS_ERROR(major_status))
 452   {
 453     cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
 454                        "cupsdDefaultAuthType: gss_display_name(%s) failed",
 455                        buf);
 456     return (default_auth_type = CUPSD_AUTH_BASIC);
 457   }
 458
 459   cupsdLogMessage(CUPSD_LOG_DEBUG,
 460                   "cupsdDefaultAuthType: Attempting to acquire Kerberos "
 461                   "credentials for %s...", (char *)token.value);
 462
 463   ServerCreds  = GSS_C_NO_CREDENTIAL;
 464   major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE,
 465                                   GSS_C_NO_OID_SET, GSS_C_ACCEPT,
 466                                   &ServerCreds, NULL, NULL);
 467   if (GSS_ERROR(major_status))
 468   {
 469     cupsdLogGSSMessage(CUPSD_LOG_DEBUG, major_status, minor_status,
 470                        "cupsdDefaultAuthType: gss_acquire_cred(%s) failed",
 471                        (char *)token.value);
 472     gss_release_name(&minor_status, &server_name);
 473     gss_release_buffer(&minor_status, &token);
 474     return (default_auth_type = CUPSD_AUTH_BASIC);
 475   }
 476
 477   cupsdLogMessage(CUPSD_LOG_DEBUG,
 478                   "cupsdDefaultAuthType: Kerberos credentials acquired "
 479                   "successfully for %s.", (char *)token.value);
 480
 481   gss_release_name(&minor_status, &server_name);
 482   gss_release_buffer(&minor_status, &token);
 483
 484   HaveServerCreds = 1;
 485
 486   return (default_auth_type = CUPSD_AUTH_NEGOTIATE);
 487
 488 #else
 489  /*
 490   * No Kerberos support compiled in so just use Basic all the time...
 491   */
 492
 493   return (default_auth_type = CUPSD_AUTH_BASIC);
 494 #endif /* HAVE_GSSAPI */
 495 }
 496
 497
 498 /*
 499  * 'cupsdFreeAliases()' - Free all of the alias entries.
 500  */
 501
 502 void
 503 cupsdFreeAliases(cups_array_t *aliases) /* I - Array of aliases */
 504 {
 505   cupsd_alias_t *a;                     /* Current alias */
 506
 507
 508   for (a = (cupsd_alias_t *)cupsArrayFirst(aliases);
 509        a;
 510        a = (cupsd_alias_t *)cupsArrayNext(aliases))
 511     free(a);
 512
 513   cupsArrayDelete(aliases);
 514 }
 515
 516
 517 /*
 518  * 'cupsdReadConfiguration()' - Read the cupsd.conf file.
 519  */
 520
 521 int                                     /* O - 1 on success, 0 otherwise */
 522 cupsdReadConfiguration(void)
 523 {
 524   int           i;                      /* Looping var */
 525   cups_file_t   *fp;                    /* Configuration file */
 526   int           status;                 /* Return status */
 527   char          temp[1024],             /* Temporary buffer */
 528                 mimedir[1024],          /* MIME directory */
 529                 *slash;                 /* Directory separator */
 530   cups_lang_t   *language;              /* Language */
 531   struct passwd *user;                  /* Default user */
 532   struct group  *group;                 /* Default group */
 533   char          *old_serverroot,        /* Old ServerRoot */
 534                 *old_requestroot;       /* Old RequestRoot */
 535   int           old_remote_port;        /* Old RemotePort */
 536   const char    *tmpdir;                /* TMPDIR environment variable */
 537   struct stat   tmpinfo;                /* Temporary directory info */
 538   cupsd_policy_t *p;                    /* Policy */
 539
 540
 541  /*
 542   * Save the old root paths...
 543   */
 544
 545   old_serverroot = NULL;
 546   cupsdSetString(&old_serverroot, ServerRoot);
 547   old_requestroot = NULL;
 548   cupsdSetString(&old_requestroot, RequestRoot);
 549
 550  /*
 551   * Reset the server configuration data...
 552   */
 553
 554   cupsdDeleteAllLocations();
 555
 556   cupsdDeleteAllListeners();
 557
 558   old_remote_port = RemotePort;
 559   RemotePort      = 0;
 560
 561  /*
 562   * String options...
 563   */
 564
 565   cupsdFreeAliases(ServerAlias);
 566   ServerAlias = NULL;
 567
 568   cupsdClearString(&ServerName);
 569   cupsdClearString(&ServerAdmin);
 570   cupsdSetString(&ServerBin, CUPS_SERVERBIN);
 571   cupsdSetString(&RequestRoot, CUPS_REQUESTS);
 572   cupsdSetString(&CacheDir, CUPS_CACHEDIR);
 573   cupsdSetString(&DataDir, CUPS_DATADIR);
 574   cupsdSetString(&DocumentRoot, CUPS_DOCROOT);
 575   cupsdSetString(&AccessLog, CUPS_LOGDIR "/access_log");
 576   cupsdClearString(&ErrorLog);
 577   cupsdSetString(&PageLog, CUPS_LOGDIR "/page_log");
 578   cupsdSetString(&PageLogFormat,
 579                  "%p %u %j %T %P %C %{job-billing} "
 580                  "%{job-originating-host-name} %{job-name} %{media} %{sides}");
 581   cupsdSetString(&Printcap, CUPS_DEFAULT_PRINTCAP);
 582   cupsdSetString(&PrintcapGUI, "/usr/bin/glpoptions");
 583   cupsdSetString(&FontPath, CUPS_FONTPATH);
 584   cupsdSetString(&RemoteRoot, "remroot");
 585   cupsdSetStringf(&ServerHeader, "CUPS/%d.%d", CUPS_VERSION_MAJOR,
 586                   CUPS_VERSION_MINOR);
 587   cupsdSetString(&StateDir, CUPS_STATEDIR);
 588
 589   if (!strcmp(CUPS_DEFAULT_PRINTCAP, "/etc/printers.conf"))
 590     PrintcapFormat = PRINTCAP_SOLARIS;
 591   else if (!strcmp(CUPS_DEFAULT_PRINTCAP,
 592                    "/Library/Preferences/org.cups.printers.plist"))
 593     PrintcapFormat = PRINTCAP_PLIST;
 594   else
 595     PrintcapFormat = PRINTCAP_BSD;
 596
 597   strlcpy(temp, ConfigurationFile, sizeof(temp));
 598   if ((slash = strrchr(temp, '/')) != NULL)
 599     *slash = '\0';
 600
 601   cupsdSetString(&ServerRoot, temp);
 602
 603   cupsdClearString(&Classification);
 604   ClassifyOverride  = 0;
 605
 606 #ifdef HAVE_SSL
 607 #  ifdef HAVE_CDSASSL
 608   cupsdSetString(&ServerCertificate, "/Library/Keychains/System.keychain");
 609 #  else
 610   cupsdSetString(&ServerCertificate, "ssl/server.crt");
 611   cupsdSetString(&ServerKey, "ssl/server.key");
 612 #  endif /* HAVE_CDSASSL */
 613 #endif /* HAVE_SSL */
 614
 615   language = cupsLangDefault();
 616
 617   if (!strcmp(language->language, "C") || !strcmp(language->language, "POSIX"))
 618     cupsdSetString(&DefaultLanguage, "en");
 619   else
 620     cupsdSetString(&DefaultLanguage, language->language);
 621
 622   cupsdClearString(&DefaultPaperSize);
 623
 624   cupsdSetString(&RIPCache, "128m");
 625
 626   cupsdSetString(&TempDir, NULL);
 627
 628 #ifdef HAVE_GSSAPI
 629   cupsdSetString(&GSSServiceName, CUPS_DEFAULT_GSSSERVICENAME);
 630
 631   if (HaveServerCreds)
 632   {
 633     OM_uint32   minor_status;           /* Minor status code */
 634
 635     gss_release_cred(&minor_status, &ServerCreds);
 636
 637     HaveServerCreds = 0;
 638   }
 639
 640   ServerCreds = GSS_C_NO_CREDENTIAL;
 641 #endif /* HAVE_GSSAPI */
 642
 643  /*
 644   * Find the default user...
 645   */
 646
 647   if ((user = getpwnam(CUPS_DEFAULT_USER)) != NULL)
 648     User = user->pw_uid;
 649   else
 650   {
 651    /*
 652     * Use the (historical) NFS nobody user ID (-2 as a 16-bit twos-
 653     * complement number...)
 654     */
 655
 656     User = 65534;
 657   }
 658
 659   endpwent();
 660
 661  /*
 662   * Find the default group...
 663   */
 664
 665   group = getgrnam(CUPS_DEFAULT_GROUP);
 666   endgrent();
 667
 668   if (group)
 669     Group = group->gr_gid;
 670   else
 671   {
 672    /*
 673     * Fallback to group "nobody"...
 674     */
 675
 676     group = getgrnam("nobody");
 677     endgrent();
 678
 679     if (group)
 680       Group = group->gr_gid;
 681     else
 682     {
 683      /*
 684       * Use the (historical) NFS nobody group ID (-2 as a 16-bit twos-
 685       * complement number...)
 686       */
 687
 688       Group = 65534;
 689     }
 690   }
 691
 692  /*
 693   * Numeric options...
 694   */
 695
 696   AccessLogLevel           = CUPSD_ACCESSLOG_ACTIONS;
 697   ConfigFilePerm           = CUPS_DEFAULT_CONFIG_FILE_PERM;
 698   FatalErrors              = parse_fatal_errors(CUPS_DEFAULT_FATAL_ERRORS);
 699   default_auth_type          = CUPSD_AUTH_BASIC;
 700 #ifdef HAVE_SSL
 701   DefaultEncryption        = HTTP_ENCRYPT_REQUIRED;
 702   SSLOptions               = CUPSD_SSL_NONE;
 703 #endif /* HAVE_SSL */
 704   DirtyCleanInterval       = DEFAULT_KEEPALIVE;
 705   JobKillDelay             = DEFAULT_TIMEOUT;
 706   JobRetryLimit            = 5;
 707   JobRetryInterval         = 300;
 708   FileDevice               = FALSE;
 709   FilterLevel              = 0;
 710   FilterLimit              = 0;
 711   FilterNice               = 0;
 712   HostNameLookups          = FALSE;
 713   KeepAlive                = TRUE;
 714   KeepAliveTimeout         = DEFAULT_KEEPALIVE;
 715   ListenBackLog            = SOMAXCONN;
 716   LogDebugHistory          = 200;
 717   LogFilePerm              = CUPS_DEFAULT_LOG_FILE_PERM;
 718   LogLevel                 = CUPSD_LOG_WARN;
 719   LogTimeFormat            = CUPSD_TIME_STANDARD;
 720   MaxClients               = 100;
 721   MaxClientsPerHost        = 0;
 722   MaxLogSize               = 1024 * 1024;
 723   MaxRequestSize           = 0;
 724   MultipleOperationTimeout = DEFAULT_TIMEOUT;
 725   ReloadTimeout            = DEFAULT_KEEPALIVE;
 726   RootCertDuration         = 300;
 727   Timeout                  = DEFAULT_TIMEOUT;
 728   NumSystemGroups          = 0;
 729   WebInterface             = CUPS_DEFAULT_WEBIF;
 730
 731   BrowseLocalProtocols     = parse_protocols(CUPS_DEFAULT_BROWSE_LOCAL_PROTOCOLS);
 732   BrowseWebIF              = FALSE;
 733   Browsing                 = CUPS_DEFAULT_BROWSING;
 734   DefaultShared            = CUPS_DEFAULT_DEFAULT_SHARED;
 735
 736 #ifdef HAVE_DNSSD
 737   cupsdSetString(&DNSSDRegType, "_ipp._tcp,_cups");
 738 #endif /* HAVE_DNSSD */
 739
 740   cupsdSetString(&LPDConfigFile, CUPS_DEFAULT_LPD_CONFIG_FILE);
 741   cupsdSetString(&SMBConfigFile, CUPS_DEFAULT_SMB_CONFIG_FILE);
 742
 743   cupsdSetString(&ErrorPolicy, "stop-printer");
 744
 745   JobHistory          = DEFAULT_HISTORY;
 746   JobFiles            = DEFAULT_FILES;
 747   JobAutoPurge        = 0;
 748   MaxHoldTime         = 0;
 749   MaxJobs             = 500;
 750   MaxActiveJobs       = 0;
 751   MaxJobsPerUser      = 0;
 752   MaxJobsPerPrinter   = 0;
 753   MaxJobTime          = 3 * 60 * 60;    /* 3 hours */
 754   MaxCopies           = CUPS_DEFAULT_MAX_COPIES;
 755
 756   cupsdDeleteAllPolicies();
 757   cupsdClearString(&DefaultPolicy);
 758
 759 #ifdef HAVE_AUTHORIZATION_H
 760   cupsdClearString(&SystemGroupAuthKey);
 761 #endif /* HAVE_AUTHORIZATION_H */
 762
 763   MaxSubscriptions           = 100;
 764   MaxSubscriptionsPerJob     = 0;
 765   MaxSubscriptionsPerPrinter = 0;
 766   MaxSubscriptionsPerUser    = 0;
 767   DefaultLeaseDuration       = 86400;
 768   MaxLeaseDuration           = 0;
 769
 770 #ifdef HAVE_LAUNCHD
 771   LaunchdTimeout = 10;
 772 #endif /* HAVE_LAUNCHD */
 773
 774  /*
 775   * Setup environment variables...
 776   */
 777
 778   cupsdInitEnv();
 779
 780  /*
 781   * Read the configuration file...
 782   */
 783
 784   if ((fp = cupsFileOpen(ConfigurationFile, "r")) == NULL)
 785     return (0);
 786
 787   status = read_configuration(fp);
 788
 789   cupsFileClose(fp);
 790
 791   if (!status)
 792     return (0);
 793
 794   if (!ErrorLog)
 795     cupsdSetString(&ErrorLog, CUPS_LOGDIR "/error_log");
 796
 797   RunUser = getuid();
 798
 799   cupsdLogMessage(CUPSD_LOG_INFO, "Remote access is %s.",
 800                   RemotePort ? "enabled" : "disabled");
 801
 802   if (!RemotePort)
 803     BrowseLocalProtocols = 0;           /* Disable sharing - no remote access */
 804
 805  /*
 806   * See if the ServerName is an IP address...
 807   */
 808
 809   if (ServerName)
 810   {
 811     if (!ServerAlias)
 812       ServerAlias = cupsArrayNew(NULL, NULL);
 813
 814     cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", ServerName);
 815   }
 816   else
 817   {
 818     if (gethostname(temp, sizeof(temp)))
 819     {
 820       cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get hostname: %s",
 821                       strerror(errno));
 822       strlcpy(temp, "localhost", sizeof(temp));
 823     }
 824
 825     cupsdSetString(&ServerName, temp);
 826
 827     if (!ServerAlias)
 828       ServerAlias = cupsArrayNew(NULL, NULL);
 829
 830     cupsdAddAlias(ServerAlias, temp);
 831     cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", temp);
 832
 833     if (HostNameLookups || RemotePort)
 834     {
 835       struct hostent    *host;          /* Host entry to get FQDN */
 836
 837       if ((host = gethostbyname(temp)) != NULL)
 838       {
 839         if (_cups_strcasecmp(temp, host->h_name))
 840         {
 841           cupsdSetString(&ServerName, host->h_name);
 842           cupsdAddAlias(ServerAlias, host->h_name);
 843           cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s",
 844                           host->h_name);
 845         }
 846
 847         if (host->h_aliases)
 848         {
 849           for (i = 0; host->h_aliases[i]; i ++)
 850             if (_cups_strcasecmp(temp, host->h_aliases[i]))
 851             {
 852               cupsdAddAlias(ServerAlias, host->h_aliases[i]);
 853               cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s",
 854                               host->h_aliases[i]);
 855             }
 856         }
 857       }
 858     }
 859
 860    /*
 861     * Make sure we have the base hostname added as an alias, too!
 862     */
 863
 864     if ((slash = strchr(temp, '.')) != NULL)
 865     {
 866       *slash = '\0';
 867       cupsdAddAlias(ServerAlias, temp);
 868       cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", temp);
 869     }
 870   }
 871
 872   for (slash = ServerName; isdigit(*slash & 255) || *slash == '.'; slash ++);
 873
 874   ServerNameIsIP = !*slash;
 875
 876  /*
 877   * Make sure ServerAdmin is initialized...
 878   */
 879
 880   if (!ServerAdmin)
 881     cupsdSetStringf(&ServerAdmin, "root@%s", ServerName);
 882
 883  /*
 884   * Use the default system group if none was supplied in cupsd.conf...
 885   */
 886
 887   if (NumSystemGroups == 0)
 888   {
 889     if (!parse_groups(CUPS_DEFAULT_SYSTEM_GROUPS))
 890     {
 891      /*
 892       * Find the group associated with GID 0...
 893       */
 894
 895       group = getgrgid(0);
 896       endgrent();
 897
 898       if (group != NULL)
 899         cupsdSetString(&SystemGroups[0], group->gr_name);
 900       else
 901         cupsdSetString(&SystemGroups[0], "unknown");
 902
 903       SystemGroupIDs[0] = 0;
 904       NumSystemGroups   = 1;
 905     }
 906   }
 907
 908  /*
 909   * Open the system log for cupsd if necessary...
 910   */
 911
 912 #ifdef HAVE_VSYSLOG
 913   if (!strcmp(AccessLog, "syslog") ||
 914       !strcmp(ErrorLog, "syslog") ||
 915       !strcmp(PageLog, "syslog"))
 916     openlog("cupsd", LOG_PID | LOG_NOWAIT | LOG_NDELAY, LOG_LPR);
 917 #endif /* HAVE_VSYSLOG */
 918
 919  /*
 920   * Make sure each of the log files exists and gets rotated as necessary...
 921   */
 922
 923   if (strcmp(AccessLog, "syslog"))
 924     cupsdCheckLogFile(&AccessFile, AccessLog);
 925
 926   if (strcmp(ErrorLog, "syslog"))
 927     cupsdCheckLogFile(&ErrorFile, ErrorLog);
 928
 929   if (strcmp(PageLog, "syslog"))
 930     cupsdCheckLogFile(&PageFile, PageLog);
 931
 932  /*
 933   * Log the configuration file that was used...
 934   */
 935
 936   cupsdLogMessage(CUPSD_LOG_INFO, "Loaded configuration file \"%s\"",
 937                   ConfigurationFile);
 938
 939  /*
 940   * Validate the Group and SystemGroup settings - they cannot be the same,
 941   * otherwise the CGI programs will be able to authenticate as root without
 942   * a password!
 943   */
 944
 945   if (!RunUser)
 946   {
 947     for (i = 0; i < NumSystemGroups; i ++)
 948       if (Group == SystemGroupIDs[i])
 949         break;
 950
 951     if (i < NumSystemGroups)
 952     {
 953      /*
 954       * Log the error and reset the group to a safe value...
 955       */
 956
 957       cupsdLogMessage(CUPSD_LOG_NOTICE,
 958                       "Group and SystemGroup cannot use the same groups.");
 959       cupsdLogMessage(CUPSD_LOG_INFO, "Resetting Group to \"nobody\"...");
 960
 961       group = getgrnam("nobody");
 962       endgrent();
 963
 964       if (group != NULL)
 965         Group = group->gr_gid;
 966       else
 967       {
 968        /*
 969         * Use the (historical) NFS nobody group ID (-2 as a 16-bit twos-
 970         * complement number...)
 971         */
 972
 973         Group = 65534;
 974       }
 975     }
 976   }
 977
 978  /*
 979   * Check that we have at least one listen/port line; if not, report this
 980   * as an error and exit!
 981   */
 982
 983   if (cupsArrayCount(Listeners) == 0)
 984   {
 985    /*
 986     * No listeners!
 987     */
 988
 989     cupsdLogMessage(CUPSD_LOG_EMERG,
 990                     "No valid Listen or Port lines were found in the "
 991                     "configuration file.");
 992
 993    /*
 994     * Commit suicide...
 995     */
 996
 997     cupsdEndProcess(getpid(), 0);
 998   }
 999
1000  /*
1001   * Set the default locale using the language and charset...
1002   */
1003
1004   cupsdSetStringf(&DefaultLocale, "%s.UTF-8", DefaultLanguage);
1005
1006  /*
1007   * Update all relative filenames to include the full path from ServerRoot...
1008   */
1009
1010   if (DocumentRoot[0] != '/')
1011     cupsdSetStringf(&DocumentRoot, "%s/%s", ServerRoot, DocumentRoot);
1012
1013   if (RequestRoot[0] != '/')
1014     cupsdSetStringf(&RequestRoot, "%s/%s", ServerRoot, RequestRoot);
1015
1016   if (ServerBin[0] != '/')
1017     cupsdSetStringf(&ServerBin, "%s/%s", ServerRoot, ServerBin);
1018
1019   if (StateDir[0] != '/')
1020     cupsdSetStringf(&StateDir, "%s/%s", ServerRoot, StateDir);
1021
1022   if (CacheDir[0] != '/')
1023     cupsdSetStringf(&CacheDir, "%s/%s", ServerRoot, CacheDir);
1024
1025 #ifdef HAVE_SSL
1026   if (ServerCertificate[0] != '/')
1027     cupsdSetStringf(&ServerCertificate, "%s/%s", ServerRoot, ServerCertificate);
1028
1029   if (!strncmp(ServerRoot, ServerCertificate, strlen(ServerRoot)) &&
1030       cupsdCheckPermissions(ServerCertificate, NULL, 0600, RunUser, Group,
1031                             0, 0) < 0 &&
1032       (FatalErrors & CUPSD_FATAL_PERMISSIONS))
1033     return (0);
1034
1035 #  if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS)
1036   if (ServerKey[0] != '/')
1037     cupsdSetStringf(&ServerKey, "%s/%s", ServerRoot, ServerKey);
1038
1039   if (!strncmp(ServerRoot, ServerKey, strlen(ServerRoot)) &&
1040       cupsdCheckPermissions(ServerKey, NULL, 0600, RunUser, Group, 0, 0) < 0 &&
1041       (FatalErrors & CUPSD_FATAL_PERMISSIONS))
1042     return (0);
1043 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
1044 #endif /* HAVE_SSL */
1045
1046  /*
1047   * Make sure that directories and config files are owned and
1048   * writable by the user and group in the cupsd.conf file...
1049   */
1050
1051   snprintf(temp, sizeof(temp), "%s/rss", CacheDir);
1052
1053   if ((cupsdCheckPermissions(RequestRoot, NULL, 0710, RunUser,
1054                              Group, 1, 1) < 0 ||
1055        cupsdCheckPermissions(CacheDir, NULL, 0775, RunUser,
1056                              Group, 1, 1) < 0 ||
1057        cupsdCheckPermissions(temp, NULL, 0775, RunUser,
1058                              Group, 1, 1) < 0 ||
1059        cupsdCheckPermissions(StateDir, NULL, 0755, RunUser,
1060                              Group, 1, 1) < 0 ||
1061        cupsdCheckPermissions(StateDir, "certs", RunUser ? 0711 : 0511, User,
1062                              SystemGroupIDs[0], 1, 1) < 0 ||
1063        cupsdCheckPermissions(ServerRoot, NULL, 0755, RunUser,
1064                              Group, 1, 0) < 0 ||
1065        cupsdCheckPermissions(ServerRoot, "ppd", 0755, RunUser,
1066                              Group, 1, 1) < 0 ||
1067        cupsdCheckPermissions(ServerRoot, "ssl", 0700, RunUser,
1068                              Group, 1, 0) < 0 ||
1069        cupsdCheckPermissions(ServerRoot, "cupsd.conf", ConfigFilePerm, RunUser,
1070                              Group, 0, 0) < 0 ||
1071        cupsdCheckPermissions(ServerRoot, "classes.conf", 0600, RunUser,
1072                              Group, 0, 0) < 0 ||
1073        cupsdCheckPermissions(ServerRoot, "printers.conf", 0600, RunUser,
1074                              Group, 0, 0) < 0 ||
1075        cupsdCheckPermissions(ServerRoot, "passwd.md5", 0600, User,
1076                              Group, 0, 0) < 0) &&
1077       (FatalErrors & CUPSD_FATAL_PERMISSIONS))
1078     return (0);
1079
1080  /*
1081   * Update TempDir to the default if it hasn't been set already...
1082   */
1083
1084   if (!TempDir)
1085   {
1086 #ifdef __APPLE__
1087     if ((tmpdir = getenv("TMPDIR")) != NULL &&
1088         strncmp(tmpdir, "/private/tmp", 12))
1089 #else
1090     if ((tmpdir = getenv("TMPDIR")) != NULL)
1091 #endif /* __APPLE__ */
1092     {
1093      /*
1094       * TMPDIR is defined, see if it is OK for us to use...
1095       */
1096
1097       if (stat(tmpdir, &tmpinfo))
1098         cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to access TMPDIR (%s): %s",
1099                         tmpdir, strerror(errno));
1100       else if (!S_ISDIR(tmpinfo.st_mode))
1101         cupsdLogMessage(CUPSD_LOG_ERROR, "TMPDIR (%s) is not a directory.",
1102                         tmpdir);
1103       else if ((tmpinfo.st_uid != User || !(tmpinfo.st_mode & S_IWUSR)) &&
1104                (tmpinfo.st_gid != Group || !(tmpinfo.st_mode & S_IWGRP)) &&
1105                !(tmpinfo.st_mode & S_IWOTH))
1106         cupsdLogMessage(CUPSD_LOG_ERROR,
1107                         "TMPDIR (%s) has the wrong permissions.", tmpdir);
1108       else
1109         cupsdSetString(&TempDir, tmpdir);
1110     }
1111
1112     if (!TempDir)
1113     {
1114       cupsdLogMessage(CUPSD_LOG_INFO, "Using default TempDir of %s/tmp...",
1115                       RequestRoot);
1116       cupsdSetStringf(&TempDir, "%s/tmp", RequestRoot);
1117     }
1118   }
1119
1120  /*
1121   * Make sure the temporary directory has the right permissions...
1122   */
1123
1124   if (!strncmp(TempDir, RequestRoot, strlen(RequestRoot)) ||
1125       access(TempDir, 0))
1126   {
1127    /*
1128     * Update ownership and permissions if the CUPS temp directory
1129     * is under the spool directory or does not exist...
1130     */
1131
1132     if (cupsdCheckPermissions(TempDir, NULL, 01770, RunUser, Group, 1, 1) < 0 &&
1133         (FatalErrors & CUPSD_FATAL_PERMISSIONS))
1134       return (0);
1135   }
1136
1137  /*
1138   * Update environment variables...
1139   */
1140
1141   cupsdUpdateEnv();
1142
1143  /*
1144   * Update default paper size setting as needed...
1145   */
1146
1147   if (!DefaultPaperSize)
1148   {
1149 #ifdef HAVE_LIBPAPER
1150     char        *paper_result;          /* Paper size name from libpaper */
1151
1152     if ((paper_result = systempapername()) != NULL)
1153       cupsdSetString(&DefaultPaperSize, paper_result);
1154     else
1155 #endif /* HAVE_LIBPAPER */
1156     if (!DefaultLanguage ||
1157         !_cups_strcasecmp(DefaultLanguage, "C") ||
1158         !_cups_strcasecmp(DefaultLanguage, "POSIX") ||
1159         !_cups_strcasecmp(DefaultLanguage, "en") ||
1160         !_cups_strncasecmp(DefaultLanguage, "en.", 3) ||
1161         !_cups_strncasecmp(DefaultLanguage, "en_US", 5) ||
1162         !_cups_strncasecmp(DefaultLanguage, "en_CA", 5) ||
1163         !_cups_strncasecmp(DefaultLanguage, "fr_CA", 5))
1164     {
1165      /*
1166       * These are the only locales that will default to "letter" size...
1167       */
1168
1169       cupsdSetString(&DefaultPaperSize, "Letter");
1170     }
1171     else
1172       cupsdSetString(&DefaultPaperSize, "A4");
1173   }
1174
1175  /*
1176   * Update classification setting as needed...
1177   */
1178
1179   if (Classification && !_cups_strcasecmp(Classification, "none"))
1180     cupsdClearString(&Classification);
1181
1182   if (Classification)
1183     cupsdLogMessage(CUPSD_LOG_INFO, "Security set to \"%s\"", Classification);
1184
1185  /*
1186   * Check the MaxClients setting, and then allocate memory for it...
1187   */
1188
1189   if (MaxClients > (MaxFDs / 3) || MaxClients <= 0)
1190   {
1191     if (MaxClients > 0)
1192       cupsdLogMessage(CUPSD_LOG_INFO,
1193                       "MaxClients limited to 1/3 (%d) of the file descriptor "
1194                       "limit (%d)...",
1195                       MaxFDs / 3, MaxFDs);
1196
1197     MaxClients = MaxFDs / 3;
1198   }
1199
1200   cupsdLogMessage(CUPSD_LOG_INFO, "Configured for up to %d clients.",
1201                   MaxClients);
1202
1203  /*
1204   * Check the MaxActiveJobs setting; limit to 1/3 the available
1205   * file descriptors, since we need a pipe for each job...
1206   */
1207
1208   if (MaxActiveJobs > (MaxFDs / 3))
1209     MaxActiveJobs = MaxFDs / 3;
1210
1211  /*
1212   * Update the MaxClientsPerHost value, as needed...
1213   */
1214
1215   if (MaxClientsPerHost <= 0)
1216     MaxClientsPerHost = MaxClients;
1217
1218   if (MaxClientsPerHost > MaxClients)
1219     MaxClientsPerHost = MaxClients;
1220
1221   cupsdLogMessage(CUPSD_LOG_INFO,
1222                   "Allowing up to %d client connections per host.",
1223                   MaxClientsPerHost);
1224
1225  /*
1226   * Update the default policy, as needed...
1227   */
1228
1229   if (DefaultPolicy)
1230     DefaultPolicyPtr = cupsdFindPolicy(DefaultPolicy);
1231   else
1232     DefaultPolicyPtr = NULL;
1233
1234   if (!DefaultPolicyPtr)
1235   {
1236     cupsd_location_t    *po;            /* New policy operation */
1237
1238
1239     if (DefaultPolicy)
1240       cupsdLogMessage(CUPSD_LOG_ERROR, "Default policy \"%s\" not found.",
1241                       DefaultPolicy);
1242
1243     cupsdSetString(&DefaultPolicy, "default");
1244
1245     if ((DefaultPolicyPtr = cupsdFindPolicy("default")) != NULL)
1246       cupsdLogMessage(CUPSD_LOG_INFO,
1247                       "Using policy \"default\" as the default.");
1248     else
1249     {
1250       cupsdLogMessage(CUPSD_LOG_INFO,
1251                       "Creating CUPS default administrative policy:");
1252
1253       DefaultPolicyPtr = p = cupsdAddPolicy("default");
1254
1255       cupsdLogMessage(CUPSD_LOG_INFO, "<Policy default>");
1256
1257       cupsdLogMessage(CUPSD_LOG_INFO, "JobPrivateAccess default");
1258       cupsdAddString(&(p->job_access), "@OWNER");
1259       cupsdAddString(&(p->job_access), "@SYSTEM");
1260
1261       cupsdLogMessage(CUPSD_LOG_INFO, "JobPrivateValues default");
1262       cupsdAddString(&(p->job_attrs), "job-name");
1263       cupsdAddString(&(p->job_attrs), "job-originating-host-name");
1264       cupsdAddString(&(p->job_attrs), "job-originating-user-name");
1265
1266       cupsdLogMessage(CUPSD_LOG_INFO, "SubscriptionPrivateAccess default");
1267       cupsdAddString(&(p->sub_access), "@OWNER");
1268       cupsdAddString(&(p->sub_access), "@SYSTEM");
1269
1270       cupsdLogMessage(CUPSD_LOG_INFO, "SubscriptionPrivateValues default");
1271       cupsdAddString(&(p->job_attrs), "notify-events");
1272       cupsdAddString(&(p->job_attrs), "notify-pull-method");
1273       cupsdAddString(&(p->job_attrs), "notify-recipient-uri");
1274       cupsdAddString(&(p->job_attrs), "notify-subscriber-user-name");
1275       cupsdAddString(&(p->job_attrs), "notify-user-data");
1276
1277       cupsdLogMessage(CUPSD_LOG_INFO,
1278                       "<Limit Create-Job Print-Job Print-URI Validate-Job>");
1279       cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
1280
1281       po = cupsdAddPolicyOp(p, NULL, IPP_CREATE_JOB);
1282       po->order_type = CUPSD_AUTH_ALLOW;
1283
1284       cupsdAddPolicyOp(p, po, IPP_PRINT_JOB);
1285       cupsdAddPolicyOp(p, po, IPP_PRINT_URI);
1286       cupsdAddPolicyOp(p, po, IPP_VALIDATE_JOB);
1287
1288       cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
1289
1290       cupsdLogMessage(CUPSD_LOG_INFO,
1291                       "<Limit Send-Document Send-URI Cancel-Job Hold-Job "
1292                       "Release-Job Restart-Job Purge-Jobs "
1293                       "Set-Job-Attributes Create-Job-Subscription "
1294                       "Renew-Subscription Cancel-Subscription "
1295                       "Get-Notifications Reprocess-Job Cancel-Current-Job "
1296                       "Suspend-Current-Job Resume-Job "
1297                       "Cancel-My-Jobs Close-Job CUPS-Move-Job "
1298                       "CUPS-Authenticate-Job CUPS-Get-Document>");
1299       cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
1300
1301       po = cupsdAddPolicyOp(p, NULL, IPP_SEND_DOCUMENT);
1302       po->order_type = CUPSD_AUTH_ALLOW;
1303       po->level      = CUPSD_AUTH_USER;
1304
1305       cupsdAddName(po, "@OWNER");
1306       cupsdAddName(po, "@SYSTEM");
1307       cupsdLogMessage(CUPSD_LOG_INFO, "Require user @OWNER @SYSTEM");
1308
1309       cupsdAddPolicyOp(p, po, IPP_SEND_URI);
1310       cupsdAddPolicyOp(p, po, IPP_CANCEL_JOB);
1311       cupsdAddPolicyOp(p, po, IPP_HOLD_JOB);
1312       cupsdAddPolicyOp(p, po, IPP_RELEASE_JOB);
1313       cupsdAddPolicyOp(p, po, IPP_RESTART_JOB);
1314       cupsdAddPolicyOp(p, po, IPP_PURGE_JOBS);
1315       cupsdAddPolicyOp(p, po, IPP_SET_JOB_ATTRIBUTES);
1316       cupsdAddPolicyOp(p, po, IPP_CREATE_JOB_SUBSCRIPTION);
1317       cupsdAddPolicyOp(p, po, IPP_RENEW_SUBSCRIPTION);
1318       cupsdAddPolicyOp(p, po, IPP_CANCEL_SUBSCRIPTION);
1319       cupsdAddPolicyOp(p, po, IPP_GET_NOTIFICATIONS);
1320       cupsdAddPolicyOp(p, po, IPP_REPROCESS_JOB);
1321       cupsdAddPolicyOp(p, po, IPP_CANCEL_CURRENT_JOB);
1322       cupsdAddPolicyOp(p, po, IPP_SUSPEND_CURRENT_JOB);
1323       cupsdAddPolicyOp(p, po, IPP_RESUME_JOB);
1324       cupsdAddPolicyOp(p, po, IPP_CANCEL_MY_JOBS);
1325       cupsdAddPolicyOp(p, po, IPP_CLOSE_JOB);
1326       cupsdAddPolicyOp(p, po, CUPS_MOVE_JOB);
1327       cupsdAddPolicyOp(p, po, CUPS_AUTHENTICATE_JOB);
1328       cupsdAddPolicyOp(p, po, CUPS_GET_DOCUMENT);
1329
1330       cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
1331
1332       cupsdLogMessage(CUPSD_LOG_INFO,
1333                       "<Limit Pause-Printer Resume-Printer "
1334                       "Set-Printer-Attributes Enable-Printer "
1335                       "Disable-Printer Pause-Printer-After-Current-Job "
1336                       "Hold-New-Jobs Release-Held-New-Jobs "
1337                       "Deactivate-Printer Activate-Printer Restart-Printer "
1338                       "Shutdown-Printer Startup-Printer Promote-Job "
1339                       "Schedule-Job-After Cancel-Jobs CUPS-Add-Printer "
1340                       "CUPS-Delete-Printer CUPS-Add-Class CUPS-Delete-Class "
1341                       "CUPS-Accept-Jobs CUPS-Reject-Jobs CUPS-Set-Default>");
1342       cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
1343       cupsdLogMessage(CUPSD_LOG_INFO, "AuthType Default");
1344
1345       po = cupsdAddPolicyOp(p, NULL, IPP_PAUSE_PRINTER);
1346       po->order_type = CUPSD_AUTH_ALLOW;
1347       po->type       = CUPSD_AUTH_DEFAULT;
1348       po->level      = CUPSD_AUTH_USER;
1349
1350       cupsdAddName(po, "@SYSTEM");
1351       cupsdLogMessage(CUPSD_LOG_INFO, "Require user @SYSTEM");
1352
1353       cupsdAddPolicyOp(p, po, IPP_RESUME_PRINTER);
1354       cupsdAddPolicyOp(p, po, IPP_SET_PRINTER_ATTRIBUTES);
1355       cupsdAddPolicyOp(p, po, IPP_ENABLE_PRINTER);
1356       cupsdAddPolicyOp(p, po, IPP_DISABLE_PRINTER);
1357       cupsdAddPolicyOp(p, po, IPP_PAUSE_PRINTER_AFTER_CURRENT_JOB);
1358       cupsdAddPolicyOp(p, po, IPP_HOLD_NEW_JOBS);
1359       cupsdAddPolicyOp(p, po, IPP_RELEASE_HELD_NEW_JOBS);
1360       cupsdAddPolicyOp(p, po, IPP_DEACTIVATE_PRINTER);
1361       cupsdAddPolicyOp(p, po, IPP_ACTIVATE_PRINTER);
1362       cupsdAddPolicyOp(p, po, IPP_RESTART_PRINTER);
1363       cupsdAddPolicyOp(p, po, IPP_SHUTDOWN_PRINTER);
1364       cupsdAddPolicyOp(p, po, IPP_STARTUP_PRINTER);
1365       cupsdAddPolicyOp(p, po, IPP_PROMOTE_JOB);
1366       cupsdAddPolicyOp(p, po, IPP_SCHEDULE_JOB_AFTER);
1367       cupsdAddPolicyOp(p, po, IPP_CANCEL_JOBS);
1368       cupsdAddPolicyOp(p, po, CUPS_ADD_PRINTER);
1369       cupsdAddPolicyOp(p, po, CUPS_DELETE_PRINTER);
1370       cupsdAddPolicyOp(p, po, CUPS_ADD_CLASS);
1371       cupsdAddPolicyOp(p, po, CUPS_DELETE_CLASS);
1372       cupsdAddPolicyOp(p, po, CUPS_ACCEPT_JOBS);
1373       cupsdAddPolicyOp(p, po, CUPS_REJECT_JOBS);
1374       cupsdAddPolicyOp(p, po, CUPS_SET_DEFAULT);
1375
1376       cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
1377
1378       cupsdLogMessage(CUPSD_LOG_INFO, "<Limit All>");
1379       cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
1380
1381       po = cupsdAddPolicyOp(p, NULL, IPP_ANY_OPERATION);
1382       po->order_type = CUPSD_AUTH_ALLOW;
1383
1384       cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
1385       cupsdLogMessage(CUPSD_LOG_INFO, "</Policy>");
1386     }
1387   }
1388
1389   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadConfiguration: NumPolicies=%d",
1390                   cupsArrayCount(Policies));
1391   for (i = 0, p = (cupsd_policy_t *)cupsArrayFirst(Policies);
1392        p;
1393        i ++, p = (cupsd_policy_t *)cupsArrayNext(Policies))
1394     cupsdLogMessage(CUPSD_LOG_DEBUG2,
1395                     "cupsdReadConfiguration: Policies[%d]=\"%s\"", i, p->name);
1396
1397  /*
1398   * If we are doing a full reload or the server root has changed, flush
1399   * the jobs, printers, etc. and start from scratch...
1400   */
1401
1402   if (NeedReload == RELOAD_ALL ||
1403       old_remote_port != RemotePort ||
1404       !old_serverroot || !ServerRoot || strcmp(old_serverroot, ServerRoot) ||
1405       !old_requestroot || !RequestRoot || strcmp(old_requestroot, RequestRoot))
1406   {
1407     mime_type_t *type;                  /* Current type */
1408     char        mimetype[MIME_MAX_SUPER + MIME_MAX_TYPE];
1409                                         /* MIME type name */
1410
1411
1412     cupsdLogMessage(CUPSD_LOG_INFO, "Full reload is required.");
1413
1414    /*
1415     * Free all memory...
1416     */
1417
1418     cupsdDeleteAllSubscriptions();
1419     cupsdFreeAllJobs();
1420     cupsdDeleteAllPrinters();
1421
1422     DefaultPrinter = NULL;
1423
1424     if (MimeDatabase != NULL)
1425       mimeDelete(MimeDatabase);
1426
1427     if (NumMimeTypes)
1428     {
1429       for (i = 0; i < NumMimeTypes; i ++)
1430         _cupsStrFree(MimeTypes[i]);
1431
1432       free(MimeTypes);
1433     }
1434
1435    /*
1436     * Read the MIME type and conversion database...
1437     */
1438
1439     snprintf(temp, sizeof(temp), "%s/filter", ServerBin);
1440     snprintf(mimedir, sizeof(mimedir), "%s/mime", DataDir);
1441
1442     MimeDatabase = mimeNew();
1443     mimeSetErrorCallback(MimeDatabase, mime_error_cb, NULL);
1444
1445     MimeDatabase = mimeLoadTypes(MimeDatabase, mimedir);
1446     MimeDatabase = mimeLoadTypes(MimeDatabase, ServerRoot);
1447     MimeDatabase = mimeLoadFilters(MimeDatabase, mimedir, temp);
1448     MimeDatabase = mimeLoadFilters(MimeDatabase, ServerRoot, temp);
1449
1450     if (!MimeDatabase)
1451     {
1452       cupsdLogMessage(CUPSD_LOG_EMERG,
1453                       "Unable to load MIME database from \"%s\" or \"%s\".",
1454                       mimedir, ServerRoot);
1455       if (FatalErrors & CUPSD_FATAL_CONFIG)
1456         return (0);
1457     }
1458
1459     cupsdLogMessage(CUPSD_LOG_INFO,
1460                     "Loaded MIME database from \"%s\" and \"%s\": %d types, "
1461                     "%d filters...", mimedir, ServerRoot,
1462                     mimeNumTypes(MimeDatabase), mimeNumFilters(MimeDatabase));
1463
1464    /*
1465     * Create a list of MIME types for the document-format-supported
1466     * attribute...
1467     */
1468
1469     NumMimeTypes = mimeNumTypes(MimeDatabase);
1470     if (!mimeType(MimeDatabase, "application", "octet-stream"))
1471       NumMimeTypes ++;
1472
1473     if ((MimeTypes = calloc(NumMimeTypes, sizeof(const char *))) == NULL)
1474     {
1475       cupsdLogMessage(CUPSD_LOG_ERROR,
1476                       "Unable to allocate memory for %d MIME types.",
1477                       NumMimeTypes);
1478       NumMimeTypes = 0;
1479     }
1480     else
1481     {
1482       for (i = 0, type = mimeFirstType(MimeDatabase);
1483            type;
1484            i ++, type = mimeNextType(MimeDatabase))
1485       {
1486         snprintf(mimetype, sizeof(mimetype), "%s/%s", type->super, type->type);
1487
1488         MimeTypes[i] = _cupsStrAlloc(mimetype);
1489       }
1490
1491       if (i < NumMimeTypes)
1492         MimeTypes[i] = _cupsStrAlloc("application/octet-stream");
1493     }
1494
1495     if (LogLevel == CUPSD_LOG_DEBUG2)
1496     {
1497       mime_filter_t     *filter;        /* Current filter */
1498
1499
1500       for (type = mimeFirstType(MimeDatabase);
1501            type;
1502            type = mimeNextType(MimeDatabase))
1503         cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadConfiguration: type %s/%s",
1504                         type->super, type->type);
1505
1506       for (filter = mimeFirstFilter(MimeDatabase);
1507            filter;
1508            filter = mimeNextFilter(MimeDatabase))
1509         cupsdLogMessage(CUPSD_LOG_DEBUG2,
1510                         "cupsdReadConfiguration: filter %s/%s to %s/%s %d %s",
1511                         filter->src->super, filter->src->type,
1512                         filter->dst->super, filter->dst->type,
1513                         filter->cost, filter->filter);
1514     }
1515
1516    /*
1517     * Load banners...
1518     */
1519
1520     snprintf(temp, sizeof(temp), "%s/banners", DataDir);
1521     cupsdLoadBanners(temp);
1522
1523    /*
1524     * Load printers and classes...
1525     */
1526
1527     cupsdLoadAllPrinters();
1528     cupsdLoadAllClasses();
1529
1530     cupsdCreateCommonData();
1531
1532    /*
1533     * Update the printcap file as needed...
1534     */
1535
1536     if (Printcap && *Printcap && access(Printcap, 0))
1537       cupsdWritePrintcap();
1538
1539    /*
1540     * Load queued jobs...
1541     */
1542
1543     cupsdLoadAllJobs();
1544
1545    /*
1546     * Load subscriptions...
1547     */
1548
1549     cupsdLoadAllSubscriptions();
1550
1551     cupsdLogMessage(CUPSD_LOG_INFO, "Full reload complete.");
1552   }
1553   else
1554   {
1555    /*
1556     * Not a full reload, so recreate the common printer attributes...
1557     */
1558
1559     cupsdCreateCommonData();
1560
1561    /*
1562     * Update all jobs as needed...
1563     */
1564
1565     cupsdUpdateJobs();
1566
1567    /*
1568     * Update all printers as needed...
1569     */
1570
1571     cupsdUpdatePrinters();
1572     cupsdMarkDirty(CUPSD_DIRTY_PRINTCAP);
1573
1574     cupsdLogMessage(CUPSD_LOG_INFO, "Partial reload complete.");
1575   }
1576
1577  /*
1578   * Reset the reload state...
1579   */
1580
1581   NeedReload = RELOAD_NONE;
1582
1583   cupsdClearString(&old_serverroot);
1584   cupsdClearString(&old_requestroot);
1585
1586   return (1);
1587 }
1588
1589
1590 /*
1591  * 'get_address()' - Get an address + port number from a line.
1592  */
1593
1594 static http_addrlist_t *                /* O - Pointer to list if address good, NULL if bad */
1595 get_address(const char  *value,         /* I - Value string */
1596             int         defport)        /* I - Default port */
1597 {
1598   char                  buffer[1024],   /* Hostname + port number buffer */
1599                         defpname[255],  /* Default port name */
1600                         *hostname,      /* Hostname or IP */
1601                         *portname;      /* Port number or name */
1602   http_addrlist_t       *addrlist;      /* Address list */
1603
1604
1605  /*
1606   * Check for an empty value...
1607   */
1608
1609   if (!*value)
1610   {
1611     cupsdLogMessage(CUPSD_LOG_ERROR, "Bad (empty) address.");
1612     return (NULL);
1613   }
1614
1615  /*
1616   * Grab a hostname and port number; if there is no colon and the port name
1617   * is only digits, then we have a port number by itself...
1618   */
1619
1620   strlcpy(buffer, value, sizeof(buffer));
1621
1622   if ((portname = strrchr(buffer, ':')) != NULL && !strchr(portname, ']'))
1623   {
1624     *portname++ = '\0';
1625     hostname = buffer;
1626   }
1627   else
1628   {
1629     for (portname = buffer; isdigit(*portname & 255); portname ++);
1630
1631     if (*portname)
1632     {
1633      /*
1634       * Use the default port...
1635       */
1636
1637       sprintf(defpname, "%d", defport);
1638       portname = defpname;
1639       hostname = buffer;
1640     }
1641     else
1642     {
1643      /*
1644       * The buffer contains just a port number...
1645       */
1646
1647       portname = buffer;
1648       hostname = NULL;
1649     }
1650   }
1651
1652   if (hostname && !strcmp(hostname, "*"))
1653     hostname = NULL;
1654
1655  /*
1656   * Now lookup the address using httpAddrGetList()...
1657   */
1658
1659   if ((addrlist = httpAddrGetList(hostname, AF_UNSPEC, portname)) == NULL)
1660     cupsdLogMessage(CUPSD_LOG_ERROR, "Hostname lookup for \"%s\" failed.",
1661                     hostname ? hostname : "(nil)");
1662
1663   return (addrlist);
1664 }
1665
1666
1667 /*
1668  * 'get_addr_and_mask()' - Get an IP address and netmask.
1669  */
1670
1671 static int                              /* O - 1 on success, 0 on failure */
1672 get_addr_and_mask(const char *value,    /* I - String from config file */
1673                   unsigned   *ip,       /* O - Address value */
1674                   unsigned   *mask)     /* O - Mask value */
1675 {
1676   int           i, j,                   /* Looping vars */
1677                 family,                 /* Address family */
1678                 ipcount;                /* Count of fields in address */
1679   unsigned      ipval;                  /* Value */
1680   const char    *maskval,               /* Pointer to start of mask value */
1681                 *ptr,                   /* Pointer into value */
1682                 *ptr2;                  /* ... */
1683
1684
1685  /*
1686   * Get the address...
1687   */
1688
1689   ip[0]   = ip[1]   = ip[2]   = ip[3]   = 0x00000000;
1690   mask[0] = mask[1] = mask[2] = mask[3] = 0xffffffff;
1691
1692   if ((maskval = strchr(value, '/')) != NULL)
1693     maskval ++;
1694   else
1695     maskval = value + strlen(value);
1696
1697 #ifdef AF_INET6
1698  /*
1699   * Check for an IPv6 address...
1700   */
1701
1702   if (*value == '[')
1703   {
1704    /*
1705     * Parse hexadecimal IPv6/IPv4 address...
1706     */
1707
1708     family  = AF_INET6;
1709
1710     for (i = 0, ptr = value + 1; *ptr && i < 8; i ++)
1711     {
1712       if (*ptr == ']')
1713         break;
1714       else if (!strncmp(ptr, "::", 2))
1715       {
1716         for (ptr2 = strchr(ptr + 2, ':'), j = 0;
1717              ptr2;
1718              ptr2 = strchr(ptr2 + 1, ':'), j ++);
1719
1720         i = 6 - j;
1721         ptr += 2;
1722       }
1723       else if (isdigit(*ptr & 255) && strchr(ptr + 1, '.') && i >= 6)
1724       {
1725        /*
1726         * Read IPv4 dotted quad...
1727         */
1728
1729         unsigned val[4] = { 0, 0, 0, 0 };
1730                                         /* IPv4 address values */
1731
1732         ipcount = sscanf(ptr, "%u.%u.%u.%u", val + 0, val + 1, val + 2,
1733                          val + 3);
1734
1735        /*
1736         * Range check the IP numbers...
1737         */
1738
1739         for (i = 0; i < ipcount; i ++)
1740           if (val[i] > 255)
1741             return (0);
1742
1743        /*
1744         * Merge everything into a 32-bit IPv4 address in ip[3]...
1745         */
1746
1747         ip[3] = (((((val[0] << 8) | val[1]) << 8) | val[2]) << 8) | val[3];
1748
1749         if (ipcount < 4)
1750           mask[3] = (0xffffffff << (32 - 8 * ipcount)) & 0xffffffff;
1751
1752        /*
1753         * If the leading words are all 0's then this is an IPv4 address...
1754         */
1755
1756         if (!val[0] && !val[1] && !val[2])
1757           family  = AF_INET;
1758
1759         while (isdigit(*ptr & 255) || *ptr == '.')
1760           ptr ++;
1761         break;
1762       }
1763       else if (isxdigit(*ptr & 255))
1764       {
1765         ipval = strtoul(ptr, (char **)&ptr, 16);
1766
1767         if (*ptr == ':' && ptr[1] != ':')
1768           ptr ++;
1769
1770         if (ipval > 0xffff)
1771           return (0);
1772
1773         if (i & 1)
1774           ip[i / 2] |= ipval;
1775         else
1776           ip[i / 2] |= ipval << 16;
1777       }
1778       else
1779         return (0);
1780     }
1781
1782     if (*ptr != ']')
1783       return (0);
1784
1785     ptr ++;
1786
1787     if (*ptr && *ptr != '/')
1788       return (0);
1789   }
1790   else
1791 #endif /* AF_INET6 */
1792   {
1793    /*
1794     * Parse dotted-decimal IPv4 address...
1795     */
1796
1797     unsigned val[4] = { 0, 0, 0, 0 };   /* IPv4 address values */
1798
1799
1800     family  = AF_INET;
1801     ipcount = sscanf(value, "%u.%u.%u.%u", val + 0, val + 1, val + 2, val + 3);
1802
1803    /*
1804     * Range check the IP numbers...
1805     */
1806
1807     for (i = 0; i < ipcount; i ++)
1808       if (val[i] > 255)
1809         return (0);
1810
1811    /*
1812     * Merge everything into a 32-bit IPv4 address in ip[3]...
1813     */
1814
1815     ip[3] = (((((val[0] << 8) | val[1]) << 8) | val[2]) << 8) | val[3];
1816
1817     if (ipcount < 4)
1818       mask[3] = (0xffffffff << (32 - 8 * ipcount)) & 0xffffffff;
1819   }
1820
1821   if (*maskval)
1822   {
1823    /*
1824     * Get the netmask value(s)...
1825     */
1826
1827     memset(mask, 0, sizeof(unsigned) * 4);
1828
1829     if (strchr(maskval, '.'))
1830     {
1831      /*
1832       * Get dotted-decimal mask...
1833       */
1834
1835       if (family != AF_INET)
1836         return (0);
1837
1838       if (sscanf(maskval, "%u.%u.%u.%u", mask + 0, mask + 1, mask + 2,
1839                  mask + 3) != 4)
1840         return (0);
1841
1842       mask[3] |= ((((mask[0] << 8) | mask[1]) << 8) | mask[2]) << 8;
1843       mask[0] = mask[1] = mask[2] = 0;
1844     }
1845     else
1846     {
1847      /*
1848       * Get address/bits format...
1849       */
1850
1851       i = atoi(maskval);
1852
1853 #ifdef AF_INET6
1854       if (family == AF_INET6)
1855       {
1856         if (i > 128)
1857           return (0);
1858
1859         i = 128 - i;
1860
1861         if (i <= 96)
1862           mask[0] = 0xffffffff;
1863         else
1864           mask[0] = (0xffffffff << (i - 96)) & 0xffffffff;
1865
1866         if (i <= 64)
1867           mask[1] = 0xffffffff;
1868         else if (i >= 96)
1869           mask[1] = 0;
1870         else
1871           mask[1] = (0xffffffff << (i - 64)) & 0xffffffff;
1872
1873         if (i <= 32)
1874           mask[2] = 0xffffffff;
1875         else if (i >= 64)
1876           mask[2] = 0;
1877         else
1878           mask[2] = (0xffffffff << (i - 32)) & 0xffffffff;
1879
1880         if (i == 0)
1881           mask[3] = 0xffffffff;
1882         else if (i >= 32)
1883           mask[3] = 0;
1884         else
1885           mask[3] = (0xffffffff << i) & 0xffffffff;
1886       }
1887       else
1888 #endif /* AF_INET6 */
1889       {
1890         if (i > 32)
1891           return (0);
1892
1893         mask[0] = 0xffffffff;
1894         mask[1] = 0xffffffff;
1895         mask[2] = 0xffffffff;
1896
1897         if (i < 32)
1898           mask[3] = (0xffffffff << (32 - i)) & 0xffffffff;
1899         else
1900           mask[3] = 0xffffffff;
1901       }
1902     }
1903   }
1904
1905   cupsdLogMessage(CUPSD_LOG_DEBUG2,
1906                   "get_addr_and_mask(value=\"%s\", "
1907                   "ip=[%08x:%08x:%08x:%08x], mask=[%08x:%08x:%08x:%08x])",
1908              value, ip[0], ip[1], ip[2], ip[3], mask[0], mask[1], mask[2],
1909              mask[3]);
1910
1911  /*
1912   * Check for a valid netmask; no fallback like in CUPS 1.1.x!
1913   */
1914
1915   if ((ip[0] & ~mask[0]) != 0 ||
1916       (ip[1] & ~mask[1]) != 0 ||
1917       (ip[2] & ~mask[2]) != 0 ||
1918       (ip[3] & ~mask[3]) != 0)
1919     return (0);
1920
1921   return (1);
1922 }
1923
1924
1925 /*
1926  * 'mime_error_cb()' - Log a MIME error.
1927  */
1928
1929 static void
1930 mime_error_cb(void       *ctx,          /* I - Context pointer (unused) */
1931               const char *message)      /* I - Message */
1932 {
1933   (void)ctx;
1934
1935   cupsdLogMessage(CUPSD_LOG_ERROR, "%s", message);
1936 }
1937
1938
1939 /*
1940  * 'parse_aaa()' - Parse authentication, authorization, and access control lines.
1941  */
1942
1943 static int                              /* O - 1 on success, 0 on failure */
1944 parse_aaa(cupsd_location_t *loc,        /* I - Location */
1945           char             *line,       /* I - Line from file */
1946           char             *value,      /* I - Start of value data */
1947           int              linenum)     /* I - Current line number */
1948 {
1949   char          *valptr;                /* Pointer into value */
1950   unsigned      ip[4],                  /* IP address components */
1951                 mask[4];                /* IP netmask components */
1952
1953
1954   if (!_cups_strcasecmp(line, "Encryption"))
1955   {
1956    /*
1957     * "Encryption xxx" - set required encryption level...
1958     */
1959
1960     if (!_cups_strcasecmp(value, "never"))
1961       loc->encryption = HTTP_ENCRYPT_NEVER;
1962     else if (!_cups_strcasecmp(value, "always"))
1963     {
1964       cupsdLogMessage(CUPSD_LOG_ERROR,
1965                       "Encryption value \"%s\" on line %d is invalid in this "
1966                       "context. Using \"required\" instead.", value, linenum);
1967
1968       loc->encryption = HTTP_ENCRYPT_REQUIRED;
1969     }
1970     else if (!_cups_strcasecmp(value, "required"))
1971       loc->encryption = HTTP_ENCRYPT_REQUIRED;
1972     else if (!_cups_strcasecmp(value, "ifrequested"))
1973       loc->encryption = HTTP_ENCRYPT_IF_REQUESTED;
1974     else
1975     {
1976       cupsdLogMessage(CUPSD_LOG_ERROR,
1977                       "Unknown Encryption value %s on line %d.", value, linenum);
1978       return (0);
1979     }
1980   }
1981   else if (!_cups_strcasecmp(line, "Order"))
1982   {
1983    /*
1984     * "Order Deny,Allow" or "Order Allow,Deny"...
1985     */
1986
1987     if (!_cups_strncasecmp(value, "deny", 4))
1988       loc->order_type = CUPSD_AUTH_ALLOW;
1989     else if (!_cups_strncasecmp(value, "allow", 5))
1990       loc->order_type = CUPSD_AUTH_DENY;
1991     else
1992     {
1993       cupsdLogMessage(CUPSD_LOG_ERROR, "Unknown Order value %s on line %d.",
1994                       value, linenum);
1995       return (0);
1996     }
1997   }
1998   else if (!_cups_strcasecmp(line, "Allow") || !_cups_strcasecmp(line, "Deny"))
1999   {
2000    /*
2001     * Allow [From] host/ip...
2002     * Deny [From] host/ip...
2003     */
2004
2005     while (*value)
2006     {
2007       if (!_cups_strncasecmp(value, "from", 4))
2008       {
2009        /*
2010         * Strip leading "from"...
2011         */
2012
2013         value += 4;
2014
2015         while (_cups_isspace(*value))
2016           value ++;
2017
2018         if (!*value)
2019           break;
2020       }
2021
2022      /*
2023       * Find the end of the value...
2024       */
2025
2026       for (valptr = value; *valptr && !_cups_isspace(*valptr); valptr ++);
2027
2028       while (_cups_isspace(*valptr))
2029         *valptr++ = '\0';
2030
2031      /*
2032       * Figure out what form the allow/deny address takes:
2033       *
2034       *    All
2035       *    None
2036       *    *.domain.com
2037       *    .domain.com
2038       *    host.domain.com
2039       *    nnn.*
2040       *    nnn.nnn.*
2041       *    nnn.nnn.nnn.*
2042       *    nnn.nnn.nnn.nnn
2043       *    nnn.nnn.nnn.nnn/mm
2044       *    nnn.nnn.nnn.nnn/mmm.mmm.mmm.mmm
2045       */
2046
2047       if (!_cups_strcasecmp(value, "all"))
2048       {
2049        /*
2050         * All hosts...
2051         */
2052
2053         if (!_cups_strcasecmp(line, "Allow"))
2054           cupsdAddIPMask(&(loc->allow), zeros, zeros);
2055         else
2056           cupsdAddIPMask(&(loc->deny), zeros, zeros);
2057       }
2058       else if (!_cups_strcasecmp(value, "none"))
2059       {
2060        /*
2061         * No hosts...
2062         */
2063
2064         if (!_cups_strcasecmp(line, "Allow"))
2065           cupsdAddIPMask(&(loc->allow), ones, zeros);
2066         else
2067           cupsdAddIPMask(&(loc->deny), ones, zeros);
2068       }
2069 #ifdef AF_INET6
2070       else if (value[0] == '*' || value[0] == '.' ||
2071                (!isdigit(value[0] & 255) && value[0] != '['))
2072 #else
2073       else if (value[0] == '*' || value[0] == '.' || !isdigit(value[0] & 255))
2074 #endif /* AF_INET6 */
2075       {
2076        /*
2077         * Host or domain name...
2078         */
2079
2080         if (value[0] == '*')
2081           value ++;
2082
2083         if (!_cups_strcasecmp(line, "Allow"))
2084           cupsdAddNameMask(&(loc->allow), value);
2085         else
2086           cupsdAddNameMask(&(loc->deny), value);
2087       }
2088       else
2089       {
2090        /*
2091         * One of many IP address forms...
2092         */
2093
2094         if (!get_addr_and_mask(value, ip, mask))
2095         {
2096           cupsdLogMessage(CUPSD_LOG_ERROR, "Bad netmask value %s on line %d.",
2097                           value, linenum);
2098           return (0);
2099         }
2100
2101         if (!_cups_strcasecmp(line, "Allow"))
2102           cupsdAddIPMask(&(loc->allow), ip, mask);
2103         else
2104           cupsdAddIPMask(&(loc->deny), ip, mask);
2105       }
2106
2107      /*
2108       * Advance to next value...
2109       */
2110
2111       value = valptr;
2112     }
2113   }
2114   else if (!_cups_strcasecmp(line, "AuthType"))
2115   {
2116    /*
2117     * AuthType {none,basic,digest,basicdigest,negotiate,default}
2118     */
2119
2120     if (!_cups_strcasecmp(value, "none"))
2121     {
2122       loc->type  = CUPSD_AUTH_NONE;
2123       loc->level = CUPSD_AUTH_ANON;
2124     }
2125     else if (!_cups_strcasecmp(value, "basic"))
2126     {
2127       loc->type = CUPSD_AUTH_BASIC;
2128
2129       if (loc->level == CUPSD_AUTH_ANON)
2130         loc->level = CUPSD_AUTH_USER;
2131     }
2132     else if (!_cups_strcasecmp(value, "digest"))
2133     {
2134       loc->type = CUPSD_AUTH_DIGEST;
2135
2136       if (loc->level == CUPSD_AUTH_ANON)
2137         loc->level = CUPSD_AUTH_USER;
2138     }
2139     else if (!_cups_strcasecmp(value, "basicdigest"))
2140     {
2141       loc->type = CUPSD_AUTH_BASICDIGEST;
2142
2143       if (loc->level == CUPSD_AUTH_ANON)
2144         loc->level = CUPSD_AUTH_USER;
2145     }
2146     else if (!_cups_strcasecmp(value, "default"))
2147     {
2148       loc->type = CUPSD_AUTH_DEFAULT;
2149
2150       if (loc->level == CUPSD_AUTH_ANON)
2151         loc->level = CUPSD_AUTH_USER;
2152     }
2153 #ifdef HAVE_GSSAPI
2154     else if (!_cups_strcasecmp(value, "negotiate"))
2155     {
2156       loc->type = CUPSD_AUTH_NEGOTIATE;
2157
2158       if (loc->level == CUPSD_AUTH_ANON)
2159         loc->level = CUPSD_AUTH_USER;
2160     }
2161 #endif /* HAVE_GSSAPI */
2162     else
2163     {
2164       cupsdLogMessage(CUPSD_LOG_WARN,
2165                       "Unknown authorization type %s on line %d.",
2166                       value, linenum);
2167       return (0);
2168     }
2169   }
2170   else if (!_cups_strcasecmp(line, "AuthClass"))
2171   {
2172    /*
2173     * AuthClass anonymous, user, system, group
2174     */
2175
2176     if (!_cups_strcasecmp(value, "anonymous"))
2177     {
2178       loc->type  = CUPSD_AUTH_NONE;
2179       loc->level = CUPSD_AUTH_ANON;
2180
2181       cupsdLogMessage(CUPSD_LOG_WARN,
2182                       "\"AuthClass %s\" is deprecated; consider removing "
2183                       "it from line %d.",
2184                       value, linenum);
2185     }
2186     else if (!_cups_strcasecmp(value, "user"))
2187     {
2188       loc->level = CUPSD_AUTH_USER;
2189
2190       cupsdLogMessage(CUPSD_LOG_WARN,
2191                       "\"AuthClass %s\" is deprecated; consider using "
2192                       "\"Require valid-user\" on line %d.",
2193                       value, linenum);
2194     }
2195     else if (!_cups_strcasecmp(value, "group"))
2196     {
2197       loc->level = CUPSD_AUTH_GROUP;
2198
2199       cupsdLogMessage(CUPSD_LOG_WARN,
2200                       "\"AuthClass %s\" is deprecated; consider using "
2201                       "\"Require user @groupname\" on line %d.",
2202                       value, linenum);
2203     }
2204     else if (!_cups_strcasecmp(value, "system"))
2205     {
2206       loc->level = CUPSD_AUTH_GROUP;
2207
2208       cupsdAddName(loc, "@SYSTEM");
2209
2210       cupsdLogMessage(CUPSD_LOG_WARN,
2211                       "\"AuthClass %s\" is deprecated; consider using "
2212                       "\"Require user @SYSTEM\" on line %d.",
2213                       value, linenum);
2214     }
2215     else
2216     {
2217       cupsdLogMessage(CUPSD_LOG_WARN,
2218                       "Unknown authorization class %s on line %d.",
2219                       value, linenum);
2220       return (0);
2221     }
2222   }
2223   else if (!_cups_strcasecmp(line, "AuthGroupName"))
2224   {
2225     cupsdAddName(loc, value);
2226
2227     cupsdLogMessage(CUPSD_LOG_WARN,
2228                     "\"AuthGroupName %s\" directive is deprecated; consider "
2229                     "using \"Require user @%s\" on line %d.",
2230                     value, value, linenum);
2231   }
2232   else if (!_cups_strcasecmp(line, "Require"))
2233   {
2234    /*
2235     * Apache synonym for AuthClass and AuthGroupName...
2236     *
2237     * Get initial word:
2238     *
2239     *     Require valid-user
2240     *     Require group names
2241     *     Require user names
2242     */
2243
2244     for (valptr = value; !_cups_isspace(*valptr) && *valptr; valptr ++);
2245
2246     if (*valptr)
2247       *valptr++ = '\0';
2248
2249     if (!_cups_strcasecmp(value, "valid-user") ||
2250         !_cups_strcasecmp(value, "user"))
2251       loc->level = CUPSD_AUTH_USER;
2252     else if (!_cups_strcasecmp(value, "group"))
2253       loc->level = CUPSD_AUTH_GROUP;
2254     else
2255     {
2256       cupsdLogMessage(CUPSD_LOG_WARN, "Unknown Require type %s on line %d.",
2257                       value, linenum);
2258       return (0);
2259     }
2260
2261    /*
2262     * Get the list of names from the line...
2263     */
2264
2265     for (value = valptr; *value;)
2266     {
2267       while (_cups_isspace(*value))
2268         value ++;
2269
2270 #ifdef HAVE_AUTHORIZATION_H
2271       if (!strncmp(value, "@AUTHKEY(", 9))
2272       {
2273        /*
2274         * Grab "@AUTHKEY(name)" value...
2275         */
2276
2277         for (valptr = value + 9; *valptr != ')' && *valptr; valptr ++);
2278
2279         if (*valptr)
2280           *valptr++ = '\0';
2281       }
2282       else
2283 #endif /* HAVE_AUTHORIZATION_H */
2284       if (*value == '\"' || *value == '\'')
2285       {
2286        /*
2287         * Grab quoted name...
2288         */
2289
2290         for (valptr = value + 1; *valptr != *value && *valptr; valptr ++);
2291
2292         value ++;
2293       }
2294       else
2295       {
2296        /*
2297         * Grab literal name.
2298         */
2299
2300         for (valptr = value; !_cups_isspace(*valptr) && *valptr; valptr ++);
2301       }
2302
2303       if (*valptr)
2304         *valptr++ = '\0';
2305
2306       cupsdAddName(loc, value);
2307
2308       for (value = valptr; _cups_isspace(*value); value ++);
2309     }
2310   }
2311   else if (!_cups_strcasecmp(line, "Satisfy"))
2312   {
2313     if (!_cups_strcasecmp(value, "all"))
2314       loc->satisfy = CUPSD_AUTH_SATISFY_ALL;
2315     else if (!_cups_strcasecmp(value, "any"))
2316       loc->satisfy = CUPSD_AUTH_SATISFY_ANY;
2317     else
2318     {
2319       cupsdLogMessage(CUPSD_LOG_WARN, "Unknown Satisfy value %s on line %d.",
2320                       value, linenum);
2321       return (0);
2322     }
2323   }
2324   else
2325     return (0);
2326
2327   return (1);
2328 }
2329
2330
2331 /*
2332  * 'parse_fatal_errors()' - Parse FatalErrors values in a string.
2333  */
2334
2335 static int                              /* O - FatalErrors bits */
2336 parse_fatal_errors(const char *s)       /* I - FatalErrors string */
2337 {
2338   int   fatal;                          /* FatalErrors bits */
2339   char  value[1024],                    /* Value string */
2340         *valstart,                      /* Pointer into value */
2341         *valend;                        /* End of value */
2342
2343
2344  /*
2345   * Empty FatalErrors line yields NULL pointer...
2346   */
2347
2348   if (!s)
2349     return (CUPSD_FATAL_NONE);
2350
2351  /*
2352   * Loop through the value string,...
2353   */
2354
2355   strlcpy(value, s, sizeof(value));
2356
2357   fatal = CUPSD_FATAL_NONE;
2358
2359   for (valstart = value; *valstart;)
2360   {
2361    /*
2362     * Get the current space/comma-delimited kind name...
2363     */
2364
2365     for (valend = valstart; *valend; valend ++)
2366       if (_cups_isspace(*valend) || *valend == ',')
2367         break;
2368
2369     if (*valend)
2370       *valend++ = '\0';
2371
2372    /*
2373     * Add the error to the bitmask...
2374     */
2375
2376     if (!_cups_strcasecmp(valstart, "all"))
2377       fatal = CUPSD_FATAL_ALL;
2378     else if (!_cups_strcasecmp(valstart, "browse"))
2379       fatal |= CUPSD_FATAL_BROWSE;
2380     else if (!_cups_strcasecmp(valstart, "-browse"))
2381       fatal &= ~CUPSD_FATAL_BROWSE;
2382     else if (!_cups_strcasecmp(valstart, "config"))
2383       fatal |= CUPSD_FATAL_CONFIG;
2384     else if (!_cups_strcasecmp(valstart, "-config"))
2385       fatal &= ~CUPSD_FATAL_CONFIG;
2386     else if (!_cups_strcasecmp(valstart, "listen"))
2387       fatal |= CUPSD_FATAL_LISTEN;
2388     else if (!_cups_strcasecmp(valstart, "-listen"))
2389       fatal &= ~CUPSD_FATAL_LISTEN;
2390     else if (!_cups_strcasecmp(valstart, "log"))
2391       fatal |= CUPSD_FATAL_LOG;
2392     else if (!_cups_strcasecmp(valstart, "-log"))
2393       fatal &= ~CUPSD_FATAL_LOG;
2394     else if (!_cups_strcasecmp(valstart, "permissions"))
2395       fatal |= CUPSD_FATAL_PERMISSIONS;
2396     else if (!_cups_strcasecmp(valstart, "-permissions"))
2397       fatal &= ~CUPSD_FATAL_PERMISSIONS;
2398     else if (_cups_strcasecmp(valstart, "none"))
2399       cupsdLogMessage(CUPSD_LOG_ERROR,
2400                       "Unknown FatalErrors kind \"%s\" ignored.", valstart);
2401
2402     for (valstart = valend; *valstart; valstart ++)
2403       if (!_cups_isspace(*valstart) || *valstart != ',')
2404         break;
2405   }
2406
2407   return (fatal);
2408 }
2409
2410
2411 /*
2412  * 'parse_groups()' - Parse system group names in a string.
2413  */
2414
2415 static int                              /* O - 1 on success, 0 on failure */
2416 parse_groups(const char *s)             /* I - Space-delimited groups */
2417 {
2418   int           status;                 /* Return status */
2419   char          value[1024],            /* Value string */
2420                 *valstart,              /* Pointer into value */
2421                 *valend,                /* End of value */
2422                 quote;                  /* Quote character */
2423   struct group  *group;                 /* Group */
2424
2425
2426  /*
2427   * Make a copy of the string and parse out the groups...
2428   */
2429
2430   strlcpy(value, s, sizeof(value));
2431
2432   status   = 1;
2433   valstart = value;
2434
2435   while (*valstart && NumSystemGroups < MAX_SYSTEM_GROUPS)
2436   {
2437     if (*valstart == '\'' || *valstart == '\"')
2438     {
2439      /*
2440       * Scan quoted name...
2441       */
2442
2443       quote = *valstart++;
2444
2445       for (valend = valstart; *valend; valend ++)
2446         if (*valend == quote)
2447           break;
2448     }
2449     else
2450     {
2451      /*
2452       * Scan space or comma-delimited name...
2453       */
2454
2455       for (valend = valstart; *valend; valend ++)
2456         if (_cups_isspace(*valend) || *valend == ',')
2457           break;
2458     }
2459
2460     if (*valend)
2461       *valend++ = '\0';
2462
2463     group = getgrnam(valstart);
2464     if (group)
2465     {
2466       cupsdSetString(SystemGroups + NumSystemGroups, valstart);
2467       SystemGroupIDs[NumSystemGroups] = group->gr_gid;
2468
2469       NumSystemGroups ++;
2470     }
2471     else
2472       status = 0;
2473
2474     endgrent();
2475
2476     valstart = valend;
2477
2478     while (*valstart == ',' || _cups_isspace(*valstart))
2479       valstart ++;
2480   }
2481
2482   return (status);
2483 }
2484
2485
2486 /*
2487  * 'parse_protocols()' - Parse browse protocols in a string.
2488  */
2489
2490 static int                              /* O - Browse protocol bits */
2491 parse_protocols(const char *s)          /* I - Space-delimited protocols */
2492 {
2493   int   protocols;                      /* Browse protocol bits */
2494   char  value[1024],                    /* Value string */
2495         *valstart,                      /* Pointer into value */
2496         *valend;                        /* End of value */
2497
2498
2499  /*
2500   * Empty protocol line yields NULL pointer...
2501   */
2502
2503   if (!s)
2504     return (0);
2505
2506  /*
2507   * Loop through the value string,...
2508   */
2509
2510   strlcpy(value, s, sizeof(value));
2511
2512   protocols = 0;
2513
2514   for (valstart = value; *valstart;)
2515   {
2516    /*
2517     * Get the current space/comma-delimited protocol name...
2518     */
2519
2520     for (valend = valstart; *valend; valend ++)
2521       if (_cups_isspace(*valend) || *valend == ',')
2522         break;
2523
2524     if (*valend)
2525       *valend++ = '\0';
2526
2527    /*
2528     * Add the protocol to the bitmask...
2529     */
2530
2531     if (!_cups_strcasecmp(valstart, "dnssd") ||
2532         !_cups_strcasecmp(valstart, "dns-sd") ||
2533         !_cups_strcasecmp(valstart, "bonjour"))
2534       protocols |= BROWSE_DNSSD;
2535     else if (!_cups_strcasecmp(valstart, "all"))
2536       protocols |= BROWSE_ALL;
2537     else if (_cups_strcasecmp(valstart, "none"))
2538       cupsdLogMessage(CUPSD_LOG_ERROR,
2539                       "Unknown browse protocol \"%s\" ignored.", valstart);
2540
2541     for (valstart = valend; *valstart; valstart ++)
2542       if (!_cups_isspace(*valstart) || *valstart != ',')
2543         break;
2544   }
2545
2546   return (protocols);
2547 }
2548
2549
2550 /*
2551  * 'read_configuration()' - Read a configuration file.
2552  */
2553
2554 static int                              /* O - 1 on success, 0 on failure */
2555 read_configuration(cups_file_t *fp)     /* I - File to read from */
2556 {
2557   int                   i;              /* Looping var */
2558   int                   linenum;        /* Current line number */
2559   char                  line[HTTP_MAX_BUFFER],
2560                                         /* Line from file */
2561                         temp[HTTP_MAX_BUFFER],
2562                                         /* Temporary buffer for value */
2563                         *value,         /* Pointer to value */
2564                         *valueptr;      /* Pointer into value */
2565   int                   valuelen;       /* Length of value */
2566   cupsd_var_t const     *var;           /* Current variable */
2567   http_addrlist_t       *addrlist,      /* Address list */
2568                         *addr;          /* Current address */
2569   cups_file_t           *incfile;       /* Include file */
2570   char                  incname[1024];  /* Include filename */
2571   struct group          *group;         /* Group */
2572
2573
2574  /*
2575   * Loop through each line in the file...
2576   */
2577
2578   linenum = 0;
2579
2580   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
2581   {
2582    /*
2583     * Decode the directive...
2584     */
2585
2586     if (!_cups_strcasecmp(line, "Include") && value)
2587     {
2588      /*
2589       * Include filename
2590       */
2591
2592       if (value[0] == '/')
2593         strlcpy(incname, value, sizeof(incname));
2594       else
2595         snprintf(incname, sizeof(incname), "%s/%s", ServerRoot, value);
2596
2597       if ((incfile = cupsFileOpen(incname, "rb")) == NULL)
2598         cupsdLogMessage(CUPSD_LOG_ERROR,
2599                         "Unable to include config file \"%s\" - %s",
2600                         incname, strerror(errno));
2601       else
2602       {
2603         read_configuration(incfile);
2604         cupsFileClose(incfile);
2605       }
2606     }
2607     else if (!_cups_strcasecmp(line, "<Location") && value)
2608     {
2609      /*
2610       * <Location path>
2611       */
2612
2613       linenum = read_location(fp, value, linenum);
2614       if (linenum == 0)
2615         return (0);
2616     }
2617     else if (!_cups_strcasecmp(line, "<Policy") && value)
2618     {
2619      /*
2620       * <Policy name>
2621       */
2622
2623       linenum = read_policy(fp, value, linenum);
2624       if (linenum == 0)
2625         return (0);
2626     }
2627     else if (!_cups_strcasecmp(line, "FatalErrors"))
2628       FatalErrors = parse_fatal_errors(value);
2629     else if (!_cups_strcasecmp(line, "FaxRetryInterval") && value)
2630     {
2631       JobRetryInterval = atoi(value);
2632       cupsdLogMessage(CUPSD_LOG_WARN,
2633                       "FaxRetryInterval is deprecated; use "
2634                       "JobRetryInterval on line %d.", linenum);
2635     }
2636     else if (!_cups_strcasecmp(line, "FaxRetryLimit") && value)
2637     {
2638       JobRetryLimit = atoi(value);
2639       cupsdLogMessage(CUPSD_LOG_WARN,
2640                       "FaxRetryLimit is deprecated; use "
2641                       "JobRetryLimit on line %d.", linenum);
2642     }
2643     else if ((!_cups_strcasecmp(line, "Port") || !_cups_strcasecmp(line, "Listen")
2644 #ifdef HAVE_SSL
2645              || !_cups_strcasecmp(line, "SSLPort") || !_cups_strcasecmp(line, "SSLListen")
2646 #endif /* HAVE_SSL */
2647              ) && value)
2648     {
2649      /*
2650       * Add listening address(es) to the list...
2651       */
2652
2653       cupsd_listener_t  *lis;           /* New listeners array */
2654
2655
2656      /*
2657       * Get the address list...
2658       */
2659
2660       addrlist = get_address(value, IPP_PORT);
2661
2662       if (!addrlist)
2663       {
2664         cupsdLogMessage(CUPSD_LOG_ERROR, "Bad %s address %s at line %d.", line,
2665                         value, linenum);
2666         continue;
2667       }
2668
2669      /*
2670       * Add each address...
2671       */
2672
2673       for (addr = addrlist; addr; addr = addr->next)
2674       {
2675        /*
2676         * See if this address is already present...
2677         */
2678
2679         for (lis = (cupsd_listener_t *)cupsArrayFirst(Listeners);
2680              lis;
2681              lis = (cupsd_listener_t *)cupsArrayNext(Listeners))
2682           if (httpAddrEqual(&(addr->addr), &(lis->address)) &&
2683               _httpAddrPort(&(addr->addr)) == _httpAddrPort(&(lis->address)))
2684             break;
2685
2686         if (lis)
2687         {
2688           httpAddrString(&lis->address, temp, sizeof(temp));
2689           cupsdLogMessage(CUPSD_LOG_WARN,
2690                           "Duplicate listen address \"%s\" ignored.", temp);
2691           continue;
2692         }
2693
2694        /*
2695         * Allocate another listener...
2696         */
2697
2698         if (!Listeners)
2699           Listeners = cupsArrayNew(NULL, NULL);
2700
2701         if (!Listeners)
2702         {
2703           cupsdLogMessage(CUPSD_LOG_ERROR,
2704                           "Unable to allocate %s at line %d - %s.",
2705                           line, linenum, strerror(errno));
2706           break;
2707         }
2708
2709         if ((lis = calloc(1, sizeof(cupsd_listener_t))) == NULL)
2710         {
2711           cupsdLogMessage(CUPSD_LOG_ERROR,
2712                           "Unable to allocate %s at line %d - %s.",
2713                           line, linenum, strerror(errno));
2714           break;
2715         }
2716
2717         cupsArrayAdd(Listeners, lis);
2718
2719        /*
2720         * Copy the current address and log it...
2721         */
2722
2723         memcpy(&(lis->address), &(addr->addr), sizeof(lis->address));
2724         lis->fd = -1;
2725
2726 #ifdef HAVE_SSL
2727         if (!_cups_strcasecmp(line, "SSLPort") || !_cups_strcasecmp(line, "SSLListen"))
2728           lis->encryption = HTTP_ENCRYPT_ALWAYS;
2729 #endif /* HAVE_SSL */
2730
2731         httpAddrString(&lis->address, temp, sizeof(temp));
2732
2733 #ifdef AF_LOCAL
2734         if (lis->address.addr.sa_family == AF_LOCAL)
2735           cupsdLogMessage(CUPSD_LOG_INFO, "Listening to %s (Domain)", temp);
2736         else
2737 #endif /* AF_LOCAL */
2738         cupsdLogMessage(CUPSD_LOG_INFO, "Listening to %s:%d (IPv%d)", temp,
2739                         _httpAddrPort(&(lis->address)),
2740                         _httpAddrFamily(&(lis->address)) == AF_INET ? 4 : 6);
2741
2742         if (!httpAddrLocalhost(&(lis->address)))
2743           RemotePort = _httpAddrPort(&(lis->address));
2744       }
2745
2746      /*
2747       * Free the list...
2748       */
2749
2750       httpAddrFreeList(addrlist);
2751     }
2752     else if (!_cups_strcasecmp(line, "BrowseProtocols") ||
2753              !_cups_strcasecmp(line, "BrowseLocalProtocols"))
2754     {
2755      /*
2756       * "BrowseProtocols name [... name]"
2757       * "BrowseLocalProtocols name [... name]"
2758       */
2759
2760       int protocols = parse_protocols(value);
2761
2762       if (protocols < 0)
2763       {
2764         cupsdLogMessage(CUPSD_LOG_ERROR,
2765                         "Unknown browse protocol \"%s\" on line %d.",
2766                         value, linenum);
2767         break;
2768       }
2769
2770       BrowseLocalProtocols = protocols;
2771     }
2772     else if (!_cups_strcasecmp(line, "default_auth_type") && value)
2773     {
2774      /*
2775       * default_auth_type {basic,digest,basicdigest,negotiate}
2776       */
2777
2778       if (!_cups_strcasecmp(value, "none"))
2779         default_auth_type = CUPSD_AUTH_NONE;
2780       else if (!_cups_strcasecmp(value, "basic"))
2781         default_auth_type = CUPSD_AUTH_BASIC;
2782       else if (!_cups_strcasecmp(value, "digest"))
2783         default_auth_type = CUPSD_AUTH_DIGEST;
2784       else if (!_cups_strcasecmp(value, "basicdigest"))
2785         default_auth_type = CUPSD_AUTH_BASICDIGEST;
2786 #ifdef HAVE_GSSAPI
2787       else if (!_cups_strcasecmp(value, "negotiate"))
2788         default_auth_type = CUPSD_AUTH_NEGOTIATE;
2789 #endif /* HAVE_GSSAPI */
2790       else if (!_cups_strcasecmp(value, "auto"))
2791         default_auth_type = CUPSD_AUTH_AUTO;
2792       else
2793       {
2794         cupsdLogMessage(CUPSD_LOG_WARN,
2795                         "Unknown default authorization type %s on line %d.",
2796                         value, linenum);
2797         if (FatalErrors & CUPSD_FATAL_CONFIG)
2798           return (0);
2799       }
2800     }
2801 #ifdef HAVE_SSL
2802     else if (!_cups_strcasecmp(line, "DefaultEncryption"))
2803     {
2804      /*
2805       * DefaultEncryption {Never,IfRequested,Required}
2806       */
2807
2808       if (!value || !_cups_strcasecmp(value, "never"))
2809         DefaultEncryption = HTTP_ENCRYPT_NEVER;
2810       else if (!_cups_strcasecmp(value, "required"))
2811         DefaultEncryption = HTTP_ENCRYPT_REQUIRED;
2812       else if (!_cups_strcasecmp(value, "ifrequested"))
2813         DefaultEncryption = HTTP_ENCRYPT_IF_REQUESTED;
2814       else
2815       {
2816         cupsdLogMessage(CUPSD_LOG_WARN,
2817                         "Unknown default encryption %s on line %d.",
2818                         value, linenum);
2819         if (FatalErrors & CUPSD_FATAL_CONFIG)
2820           return (0);
2821       }
2822     }
2823 #endif /* HAVE_SSL */
2824     else if (!_cups_strcasecmp(line, "User") && value)
2825     {
2826      /*
2827       * User ID to run as...
2828       */
2829
2830       if (isdigit(value[0] & 255))
2831       {
2832         int uid = atoi(value);
2833
2834         if (!uid)
2835           cupsdLogMessage(CUPSD_LOG_ERROR,
2836                           "Will not use User 0 as specified on line %d "
2837                           "for security reasons.  You must use a non-"
2838                           "privileged account instead.",
2839                           linenum);
2840         else
2841           User = atoi(value);
2842       }
2843       else
2844       {
2845         struct passwd *p;       /* Password information */
2846
2847         endpwent();
2848         p = getpwnam(value);
2849
2850         if (p)
2851         {
2852           if (!p->pw_uid)
2853             cupsdLogMessage(CUPSD_LOG_ERROR,
2854                             "Will not use User %s (UID=0) as specified on line "
2855                             "%d for security reasons.  You must use a non-"
2856                             "privileged account instead.",
2857                             value, linenum);
2858           else
2859             User = p->pw_uid;
2860         }
2861         else
2862           cupsdLogMessage(CUPSD_LOG_ERROR,
2863                           "Unknown User \"%s\" on line %d, ignoring.",
2864                           value, linenum);
2865       }
2866     }
2867     else if (!_cups_strcasecmp(line, "Group") && value)
2868     {
2869      /*
2870       * Group ID to run as...
2871       */
2872
2873       if (isdigit(value[0]))
2874         Group = atoi(value);
2875       else
2876       {
2877         endgrent();
2878         group = getgrnam(value);
2879
2880         if (group != NULL)
2881           Group = group->gr_gid;
2882         else
2883           cupsdLogMessage(CUPSD_LOG_ERROR,
2884                           "Unknown Group \"%s\" on line %d, ignoring.",
2885                           value, linenum);
2886       }
2887     }
2888     else if (!_cups_strcasecmp(line, "SystemGroup") && value)
2889     {
2890      /*
2891       * SystemGroup (admin) group(s)...
2892       */
2893
2894       if (!parse_groups(value))
2895         cupsdLogMessage(CUPSD_LOG_ERROR,
2896                         "Unknown SystemGroup \"%s\" on line %d, ignoring.",
2897                         value, linenum);
2898     }
2899     else if (!_cups_strcasecmp(line, "HostNameLookups") && value)
2900     {
2901      /*
2902       * Do hostname lookups?
2903       */
2904
2905       if (!_cups_strcasecmp(value, "off") || !_cups_strcasecmp(value, "no") ||
2906           !_cups_strcasecmp(value, "false"))
2907         HostNameLookups = 0;
2908       else if (!_cups_strcasecmp(value, "on") || !_cups_strcasecmp(value, "yes") ||
2909           !_cups_strcasecmp(value, "true"))
2910         HostNameLookups = 1;
2911       else if (!_cups_strcasecmp(value, "double"))
2912         HostNameLookups = 2;
2913       else
2914         cupsdLogMessage(CUPSD_LOG_WARN, "Unknown HostNameLookups %s on line %d.",
2915                         value, linenum);
2916     }
2917     else if (!_cups_strcasecmp(line, "AccessLogLevel") && value)
2918     {
2919      /*
2920       * Amount of logging to do to access log...
2921       */
2922
2923       if (!_cups_strcasecmp(value, "all"))
2924         AccessLogLevel = CUPSD_ACCESSLOG_ALL;
2925       else if (!_cups_strcasecmp(value, "actions"))
2926         AccessLogLevel = CUPSD_ACCESSLOG_ACTIONS;
2927       else if (!_cups_strcasecmp(value, "config"))
2928         AccessLogLevel = CUPSD_ACCESSLOG_CONFIG;
2929       else
2930         cupsdLogMessage(CUPSD_LOG_WARN, "Unknown AccessLogLevel %s on line %d.",
2931                         value, linenum);
2932     }
2933     else if (!_cups_strcasecmp(line, "LogLevel") && value)
2934     {
2935      /*
2936       * Amount of logging to do to error log...
2937       */
2938
2939       if (!_cups_strcasecmp(value, "debug2"))
2940         LogLevel = CUPSD_LOG_DEBUG2;
2941       else if (!_cups_strcasecmp(value, "debug"))
2942         LogLevel = CUPSD_LOG_DEBUG;
2943       else if (!_cups_strcasecmp(value, "info"))
2944         LogLevel = CUPSD_LOG_INFO;
2945       else if (!_cups_strcasecmp(value, "notice"))
2946         LogLevel = CUPSD_LOG_NOTICE;
2947       else if (!_cups_strcasecmp(value, "warn"))
2948         LogLevel = CUPSD_LOG_WARN;
2949       else if (!_cups_strcasecmp(value, "error"))
2950         LogLevel = CUPSD_LOG_ERROR;
2951       else if (!_cups_strcasecmp(value, "crit"))
2952         LogLevel = CUPSD_LOG_CRIT;
2953       else if (!_cups_strcasecmp(value, "alert"))
2954         LogLevel = CUPSD_LOG_ALERT;
2955       else if (!_cups_strcasecmp(value, "emerg"))
2956         LogLevel = CUPSD_LOG_EMERG;
2957       else if (!_cups_strcasecmp(value, "none"))
2958         LogLevel = CUPSD_LOG_NONE;
2959       else
2960         cupsdLogMessage(CUPSD_LOG_WARN, "Unknown LogLevel %s on line %d.",
2961                         value, linenum);
2962     }
2963     else if (!_cups_strcasecmp(line, "LogTimeFormat") && value)
2964     {
2965      /*
2966       * Amount of logging to do to error log...
2967       */
2968
2969       if (!_cups_strcasecmp(value, "standard"))
2970         LogTimeFormat = CUPSD_TIME_STANDARD;
2971       else if (!_cups_strcasecmp(value, "usecs"))
2972         LogTimeFormat = CUPSD_TIME_USECS;
2973       else
2974         cupsdLogMessage(CUPSD_LOG_WARN, "Unknown LogTimeFormat %s on line %d.",
2975                         value, linenum);
2976     }
2977     else if (!_cups_strcasecmp(line, "PrintcapFormat") && value)
2978     {
2979      /*
2980       * Format of printcap file?
2981       */
2982
2983       if (!_cups_strcasecmp(value, "bsd"))
2984         PrintcapFormat = PRINTCAP_BSD;
2985       else if (!_cups_strcasecmp(value, "plist"))
2986         PrintcapFormat = PRINTCAP_PLIST;
2987       else if (!_cups_strcasecmp(value, "solaris"))
2988         PrintcapFormat = PRINTCAP_SOLARIS;
2989       else
2990         cupsdLogMessage(CUPSD_LOG_WARN, "Unknown PrintcapFormat %s on line %d.",
2991                         value, linenum);
2992     }
2993     else if (!_cups_strcasecmp(line, "ServerTokens") && value)
2994     {
2995      /*
2996       * Set the string used for the Server header...
2997       */
2998
2999       struct utsname plat;              /* Platform info */
3000
3001
3002       uname(&plat);
3003
3004       if (!_cups_strcasecmp(value, "ProductOnly"))
3005         cupsdSetString(&ServerHeader, "CUPS");
3006       else if (!_cups_strcasecmp(value, "Major"))
3007         cupsdSetStringf(&ServerHeader, "CUPS/%d", CUPS_VERSION_MAJOR);
3008       else if (!_cups_strcasecmp(value, "Minor"))
3009         cupsdSetStringf(&ServerHeader, "CUPS/%d.%d", CUPS_VERSION_MAJOR,
3010                         CUPS_VERSION_MINOR);
3011       else if (!_cups_strcasecmp(value, "Minimal"))
3012         cupsdSetString(&ServerHeader, CUPS_MINIMAL);
3013       else if (!_cups_strcasecmp(value, "OS"))
3014         cupsdSetStringf(&ServerHeader, CUPS_MINIMAL " (%s)", plat.sysname);
3015       else if (!_cups_strcasecmp(value, "Full"))
3016         cupsdSetStringf(&ServerHeader, CUPS_MINIMAL " (%s) IPP/2.1",
3017                         plat.sysname);
3018       else if (!_cups_strcasecmp(value, "None"))
3019         cupsdClearString(&ServerHeader);
3020       else
3021         cupsdLogMessage(CUPSD_LOG_WARN, "Unknown ServerTokens %s on line %d.",
3022                         value, linenum);
3023     }
3024     else if (!_cups_strcasecmp(line, "PassEnv") && value)
3025     {
3026      /*
3027       * PassEnv variable [... variable]
3028       */
3029
3030       for (; *value;)
3031       {
3032         for (valuelen = 0; value[valuelen]; valuelen ++)
3033           if (_cups_isspace(value[valuelen]) || value[valuelen] == ',')
3034             break;
3035
3036         if (value[valuelen])
3037         {
3038           value[valuelen] = '\0';
3039           valuelen ++;
3040         }
3041
3042         cupsdSetEnv(value, NULL);
3043
3044         for (value += valuelen; *value; value ++)
3045           if (!_cups_isspace(*value) || *value != ',')
3046             break;
3047       }
3048     }
3049     else if (!_cups_strcasecmp(line, "ServerAlias") && value)
3050     {
3051      /*
3052       * ServerAlias name [... name]
3053       */
3054
3055       if (!ServerAlias)
3056         ServerAlias = cupsArrayNew(NULL, NULL);
3057
3058       for (; *value;)
3059       {
3060         for (valuelen = 0; value[valuelen]; valuelen ++)
3061           if (_cups_isspace(value[valuelen]) || value[valuelen] == ',')
3062             break;
3063
3064         if (value[valuelen])
3065         {
3066           value[valuelen] = '\0';
3067           valuelen ++;
3068         }
3069
3070         cupsdAddAlias(ServerAlias, value);
3071
3072         for (value += valuelen; *value; value ++)
3073           if (!_cups_isspace(*value) || *value != ',')
3074             break;
3075       }
3076     }
3077     else if (!_cups_strcasecmp(line, "SetEnv") && value)
3078     {
3079      /*
3080       * SetEnv variable value
3081       */
3082
3083       for (valueptr = value; *valueptr && !isspace(*valueptr & 255); valueptr ++);
3084
3085       if (*valueptr)
3086       {
3087        /*
3088         * Found a value...
3089         */
3090
3091         while (isspace(*valueptr & 255))
3092           *valueptr++ = '\0';
3093
3094         cupsdSetEnv(value, valueptr);
3095       }
3096       else
3097         cupsdLogMessage(CUPSD_LOG_ERROR,
3098                         "Missing value for SetEnv directive on line %d.",
3099                         linenum);
3100     }
3101 #ifdef HAVE_SSL
3102     else if (!_cups_strcasecmp(line, "SSLOptions"))
3103     {
3104      /*
3105       * SSLOptions options
3106       */
3107
3108       if (!value || !_cups_strcasecmp(value, "none"))
3109         SSLOptions = CUPSD_SSL_NONE;
3110       else if (!_cups_strcasecmp(value, "noemptyfragments"))
3111         SSLOptions = CUPSD_SSL_NOEMPTY;
3112       else
3113         cupsdLogMessage(CUPSD_LOG_ERROR,
3114                         "Unknown value \"%s\" for SSLOptions directive on "
3115                         "line %d.", value, linenum);
3116     }
3117 #endif /* HAVE_SSL */
3118     else
3119     {
3120      /*
3121       * Find a simple variable in the list...
3122       */
3123
3124       for (i = NUM_VARS, var = variables; i > 0; i --, var ++)
3125         if (!_cups_strcasecmp(line, var->name))
3126           break;
3127
3128       if (i == 0)
3129       {
3130        /*
3131         * Unknown directive!  Output an error message and continue...
3132         */
3133
3134         if (!value)
3135           cupsdLogMessage(CUPSD_LOG_ERROR, "Missing value for %s on line %d.",
3136                           line, linenum);
3137         else
3138           cupsdLogMessage(CUPSD_LOG_ERROR, "Unknown directive %s on line %d.",
3139                           line, linenum);
3140         continue;
3141       }
3142
3143       switch (var->type)
3144       {
3145         case CUPSD_VARTYPE_INTEGER :
3146             if (!value)
3147               cupsdLogMessage(CUPSD_LOG_ERROR,
3148                               "Missing integer value for %s on line %d.",
3149                               line, linenum);
3150             else if (!isdigit(*value & 255))
3151               cupsdLogMessage(CUPSD_LOG_ERROR,
3152                               "Bad integer value for %s on line %d.",
3153                               line, linenum);
3154             else
3155             {
3156               int       n;              /* Number */
3157               char      *units;         /* Units */
3158
3159               n = strtol(value, &units, 0);
3160
3161               if (units && *units)
3162               {
3163                 if (tolower(units[0] & 255) == 'g')
3164                   n *= 1024 * 1024 * 1024;
3165                 else if (tolower(units[0] & 255) == 'm')
3166                   n *= 1024 * 1024;
3167                 else if (tolower(units[0] & 255) == 'k')
3168                   n *= 1024;
3169                 else if (tolower(units[0] & 255) == 't')
3170                   n *= 262144;
3171                 else
3172                 {
3173                   cupsdLogMessage(CUPSD_LOG_ERROR,
3174                                   "Unknown integer value for %s on line %d.",
3175                                   line, linenum);
3176                   break;
3177                 }
3178               }
3179
3180               if (n < 0)
3181                 cupsdLogMessage(CUPSD_LOG_ERROR,
3182                                 "Bad negative integer value for %s on line %d.",
3183                                 line, linenum);
3184               else
3185                 *((int *)var->ptr) = n;
3186             }
3187             break;
3188
3189         case CUPSD_VARTYPE_TIME :
3190             if (!value)
3191               cupsdLogMessage(CUPSD_LOG_ERROR,
3192                               "Missing time interval value for %s on line %d.",
3193                               line, linenum);
3194             else if (!_cups_strncasecmp(line, "PreserveJob", 11) &&
3195                      (!_cups_strcasecmp(value, "true") ||
3196                       !_cups_strcasecmp(value, "on") ||
3197                       !_cups_strcasecmp(value, "enabled") ||
3198                       !_cups_strcasecmp(value, "yes")))
3199               *((int *)var->ptr) = INT_MAX;
3200             else if (!_cups_strcasecmp(value, "false") ||
3201                      !_cups_strcasecmp(value, "off") ||
3202                      !_cups_strcasecmp(value, "disabled") ||
3203                      !_cups_strcasecmp(value, "no"))
3204               *((int *)var->ptr) = 0;
3205             else if (!isdigit(*value & 255))
3206               cupsdLogMessage(CUPSD_LOG_ERROR,
3207                               "Unknown time interval value for %s on line %d.",
3208                               line, linenum);
3209             else
3210             {
3211               double    n;              /* Number */
3212               char      *units;         /* Units */
3213
3214               n = strtod(value, &units);
3215
3216               if (units && *units)
3217               {
3218                 if (tolower(units[0] & 255) == 'w')
3219                   n *= 7 * 24 * 60 * 60;
3220                 else if (tolower(units[0] & 255) == 'd')
3221                   n *= 24 * 60 * 60;
3222                 else if (tolower(units[0] & 255) == 'h')
3223                   n *= 60 * 60;
3224                 else if (tolower(units[0] & 255) == 'm')
3225                   n *= 60;
3226                 else
3227                 {
3228                   cupsdLogMessage(CUPSD_LOG_ERROR,
3229                                   "Unknown time interval value for %s on line "
3230                                   "%d.", line, linenum);
3231                   break;
3232                 }
3233               }
3234
3235               if (n < 0.0 || n > INT_MAX)
3236                 cupsdLogMessage(CUPSD_LOG_ERROR,
3237                                 "Bad time value for %s on line %d.",
3238                                 line, linenum);
3239               else
3240                 *((int *)var->ptr) = (int)n;
3241             }
3242             break;
3243
3244         case CUPSD_VARTYPE_BOOLEAN :
3245             if (!value)
3246               cupsdLogMessage(CUPSD_LOG_ERROR,
3247                               "Missing boolean value for %s on line %d.",
3248                               line, linenum);
3249             else if (!_cups_strcasecmp(value, "true") ||
3250                      !_cups_strcasecmp(value, "on") ||
3251                      !_cups_strcasecmp(value, "enabled") ||
3252                      !_cups_strcasecmp(value, "yes") ||
3253                      atoi(value) != 0)
3254               *((int *)var->ptr) = TRUE;
3255             else if (!_cups_strcasecmp(value, "false") ||
3256                      !_cups_strcasecmp(value, "off") ||
3257                      !_cups_strcasecmp(value, "disabled") ||
3258                      !_cups_strcasecmp(value, "no") ||
3259                      !_cups_strcasecmp(value, "0"))
3260               *((int *)var->ptr) = FALSE;
3261             else
3262               cupsdLogMessage(CUPSD_LOG_ERROR,
3263                               "Unknown boolean value %s on line %d.",
3264                               value, linenum);
3265             break;
3266
3267         case CUPSD_VARTYPE_PATHNAME :
3268             if (!value)
3269             {
3270               cupsdLogMessage(CUPSD_LOG_ERROR,
3271                               "Missing pathname value for %s on line %d.",
3272                               line, linenum);
3273               break;
3274             }
3275
3276             if (value[0] == '/')
3277               strlcpy(temp, value, sizeof(temp));
3278             else
3279               snprintf(temp, sizeof(temp), "%s/%s", ServerRoot, value);
3280
3281             if (access(temp, 0))
3282             {
3283               cupsdLogMessage(CUPSD_LOG_ERROR,
3284                               "File or directory for \"%s %s\" on line %d "
3285                               "does not exist.", line, value, linenum);
3286               break;
3287             }
3288
3289         case CUPSD_VARTYPE_STRING :
3290             cupsdSetString((char **)var->ptr, value);
3291             break;
3292       }
3293     }
3294   }
3295
3296   return (1);
3297 }
3298
3299
3300 /*
3301  * 'read_location()' - Read a <Location path> definition.
3302  */
3303
3304 static int                              /* O - New line number or 0 on error */
3305 read_location(cups_file_t *fp,          /* I - Configuration file */
3306               char        *location,    /* I - Location name/path */
3307               int         linenum)      /* I - Current line number */
3308 {
3309   cupsd_location_t      *loc,           /* New location */
3310                         *parent;        /* Parent location */
3311   char                  line[HTTP_MAX_BUFFER],
3312                                         /* Line buffer */
3313                         *value,         /* Value for directive */
3314                         *valptr;        /* Pointer into value */
3315
3316
3317   if ((parent = cupsdFindLocation(location)) != NULL)
3318     cupsdLogMessage(CUPSD_LOG_WARN, "Duplicate <Location %s> on line %d.",
3319                     location, linenum);
3320   else if ((parent = cupsdNewLocation(location)) == NULL)
3321     return (0);
3322   else
3323   {
3324     cupsdAddLocation(parent);
3325
3326     parent->limit = CUPSD_AUTH_LIMIT_ALL;
3327   }
3328
3329   loc = parent;
3330
3331   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
3332   {
3333    /*
3334     * Decode the directive...
3335     */
3336
3337     if (!_cups_strcasecmp(line, "</Location>"))
3338       return (linenum);
3339     else if (!_cups_strcasecmp(line, "<Limit") ||
3340              !_cups_strcasecmp(line, "<LimitExcept"))
3341     {
3342       if (!value)
3343       {
3344         cupsdLogMessage(CUPSD_LOG_ERROR, "Syntax error on line %d.", linenum);
3345         if (FatalErrors & CUPSD_FATAL_CONFIG)
3346           return (0);
3347         else
3348           continue;
3349       }
3350
3351       if ((loc = cupsdCopyLocation(parent)) == NULL)
3352         return (0);
3353
3354       cupsdAddLocation(loc);
3355
3356       loc->limit = 0;
3357       while (*value)
3358       {
3359         for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
3360
3361         if (*valptr)
3362           *valptr++ = '\0';
3363
3364         if (!strcmp(value, "ALL"))
3365           loc->limit = CUPSD_AUTH_LIMIT_ALL;
3366         else if (!strcmp(value, "GET"))
3367           loc->limit |= CUPSD_AUTH_LIMIT_GET;
3368         else if (!strcmp(value, "HEAD"))
3369           loc->limit |= CUPSD_AUTH_LIMIT_HEAD;
3370         else if (!strcmp(value, "OPTIONS"))
3371           loc->limit |= CUPSD_AUTH_LIMIT_OPTIONS;
3372         else if (!strcmp(value, "POST"))
3373           loc->limit |= CUPSD_AUTH_LIMIT_POST;
3374         else if (!strcmp(value, "PUT"))
3375           loc->limit |= CUPSD_AUTH_LIMIT_PUT;
3376         else if (!strcmp(value, "TRACE"))
3377           loc->limit |= CUPSD_AUTH_LIMIT_TRACE;
3378         else
3379           cupsdLogMessage(CUPSD_LOG_WARN, "Unknown request type %s on line %d.",
3380                           value, linenum);
3381
3382         for (value = valptr; isspace(*value & 255); value ++);
3383       }
3384
3385       if (!_cups_strcasecmp(line, "<LimitExcept"))
3386         loc->limit = CUPSD_AUTH_LIMIT_ALL ^ loc->limit;
3387
3388       parent->limit &= ~loc->limit;
3389     }
3390     else if (!_cups_strcasecmp(line, "</Limit>") ||
3391              !_cups_strcasecmp(line, "</LimitExcept>"))
3392       loc = parent;
3393     else if (!value)
3394     {
3395       cupsdLogMessage(CUPSD_LOG_ERROR, "Missing value on line %d.", linenum);
3396       if (FatalErrors & CUPSD_FATAL_CONFIG)
3397         return (0);
3398     }
3399     else if (!parse_aaa(loc, line, value, linenum))
3400     {
3401       cupsdLogMessage(CUPSD_LOG_ERROR,
3402                       "Unknown Location directive %s on line %d.",
3403                       line, linenum);
3404       if (FatalErrors & CUPSD_FATAL_CONFIG)
3405         return (0);
3406     }
3407   }
3408
3409   cupsdLogMessage(CUPSD_LOG_ERROR,
3410                   "Unexpected end-of-file at line %d while reading location.",
3411                   linenum);
3412
3413   return ((FatalErrors & CUPSD_FATAL_CONFIG) ? 0 : linenum);
3414 }
3415
3416
3417 /*
3418  * 'read_policy()' - Read a <Policy name> definition.
3419  */
3420
3421 static int                              /* O - New line number or 0 on error */
3422 read_policy(cups_file_t *fp,            /* I - Configuration file */
3423             char        *policy,        /* I - Location name/path */
3424             int         linenum)        /* I - Current line number */
3425 {
3426   int                   i;              /* Looping var */
3427   cupsd_policy_t        *pol;           /* Policy */
3428   cupsd_location_t      *op;            /* Policy operation */
3429   int                   num_ops;        /* Number of IPP operations */
3430   ipp_op_t              ops[100];       /* Operations */
3431   char                  line[HTTP_MAX_BUFFER],
3432                                         /* Line buffer */
3433                         *value,         /* Value for directive */
3434                         *valptr;        /* Pointer into value */
3435
3436
3437  /*
3438   * Create the policy...
3439   */
3440
3441   if ((pol = cupsdFindPolicy(policy)) != NULL)
3442     cupsdLogMessage(CUPSD_LOG_WARN, "Duplicate <Policy %s> on line %d.",
3443                     policy, linenum);
3444   else if ((pol = cupsdAddPolicy(policy)) == NULL)
3445     return (0);
3446
3447  /*
3448   * Read from the file...
3449   */
3450
3451   op      = NULL;
3452   num_ops = 0;
3453
3454   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
3455   {
3456    /*
3457     * Decode the directive...
3458     */
3459
3460     if (!_cups_strcasecmp(line, "</Policy>"))
3461     {
3462       if (op)
3463         cupsdLogMessage(CUPSD_LOG_WARN,
3464                         "Missing </Limit> before </Policy> on line %d.",
3465                         linenum);
3466
3467       set_policy_defaults(pol);
3468
3469       return (linenum);
3470     }
3471     else if (!_cups_strcasecmp(line, "<Limit") && !op)
3472     {
3473       if (!value)
3474       {
3475         cupsdLogMessage(CUPSD_LOG_ERROR, "Syntax error on line %d.", linenum);
3476         if (FatalErrors & CUPSD_FATAL_CONFIG)
3477           return (0);
3478         else
3479           continue;
3480       }
3481
3482      /*
3483       * Scan for IPP operation names...
3484       */
3485
3486       num_ops = 0;
3487
3488       while (*value)
3489       {
3490         for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
3491
3492         if (*valptr)
3493           *valptr++ = '\0';
3494
3495         if (num_ops < (int)(sizeof(ops) / sizeof(ops[0])))
3496         {
3497           if (!_cups_strcasecmp(value, "All"))
3498             ops[num_ops] = IPP_ANY_OPERATION;
3499           else if ((ops[num_ops] = ippOpValue(value)) == IPP_BAD_OPERATION)
3500             cupsdLogMessage(CUPSD_LOG_ERROR,
3501                             "Bad IPP operation name \"%s\" on line %d.",
3502                             value, linenum);
3503           else
3504             num_ops ++;
3505         }
3506         else
3507           cupsdLogMessage(CUPSD_LOG_ERROR,
3508                           "Too many operations listed on line %d.",
3509                           linenum);
3510
3511         for (value = valptr; isspace(*value & 255); value ++);
3512       }
3513
3514      /*
3515       * If none are specified, apply the policy to all operations...
3516       */
3517
3518       if (num_ops == 0)
3519       {
3520         ops[0]  = IPP_ANY_OPERATION;
3521         num_ops = 1;
3522       }
3523
3524      /*
3525       * Add a new policy for the first operation...
3526       */
3527
3528       op = cupsdAddPolicyOp(pol, NULL, ops[0]);
3529     }
3530     else if (!_cups_strcasecmp(line, "</Limit>") && op)
3531     {
3532      /*
3533       * Finish the current operation limit...
3534       */
3535
3536       if (num_ops > 1)
3537       {
3538        /*
3539         * Copy the policy to the other operations...
3540         */
3541
3542         for (i = 1; i < num_ops; i ++)
3543           cupsdAddPolicyOp(pol, op, ops[i]);
3544       }
3545
3546       op = NULL;
3547     }
3548     else if (!value)
3549     {
3550       cupsdLogMessage(CUPSD_LOG_ERROR, "Missing value on line %d.", linenum);
3551       if (FatalErrors & CUPSD_FATAL_CONFIG)
3552         return (0);
3553     }
3554     else if (!_cups_strcasecmp(line, "JobPrivateAccess") ||
3555              !_cups_strcasecmp(line, "JobPrivateValues") ||
3556              !_cups_strcasecmp(line, "SubscriptionPrivateAccess") ||
3557              !_cups_strcasecmp(line, "SubscriptionPrivateValues"))
3558     {
3559       if (op)
3560       {
3561         cupsdLogMessage(CUPSD_LOG_ERROR,
3562                         "%s directive must appear outside <Limit>...</Limit> "
3563                         "on line %d.", line, linenum);
3564         if (FatalErrors & CUPSD_FATAL_CONFIG)
3565           return (0);
3566       }
3567       else
3568       {
3569        /*
3570         * Pull out whitespace-delimited values...
3571         */
3572
3573         while (*value)
3574         {
3575          /*
3576           * Find the end of the current value...
3577           */
3578
3579           for (valptr = value; !isspace(*valptr & 255) && *valptr; valptr ++);
3580
3581           if (*valptr)
3582             *valptr++ = '\0';
3583
3584          /*
3585           * Save it appropriately...
3586           */
3587
3588           if (!_cups_strcasecmp(line, "JobPrivateAccess"))
3589           {
3590            /*
3591             * JobPrivateAccess {all|default|user/group list|@@ACL}
3592             */
3593
3594             if (!_cups_strcasecmp(value, "default"))
3595             {
3596               cupsdAddString(&(pol->job_access), "@OWNER");
3597               cupsdAddString(&(pol->job_access), "@SYSTEM");
3598             }
3599             else
3600               cupsdAddString(&(pol->job_access), value);
3601           }
3602           else if (!_cups_strcasecmp(line, "JobPrivateValues"))
3603           {
3604            /*
3605             * JobPrivateValues {all|none|default|attribute list}
3606             */
3607
3608             if (!_cups_strcasecmp(value, "default"))
3609             {
3610               cupsdAddString(&(pol->job_attrs), "job-name");
3611               cupsdAddString(&(pol->job_attrs), "job-originating-host-name");
3612               cupsdAddString(&(pol->job_attrs), "job-originating-user-name");
3613               cupsdAddString(&(pol->job_attrs), "phone");
3614             }
3615             else
3616               cupsdAddString(&(pol->job_attrs), value);
3617           }
3618           else if (!_cups_strcasecmp(line, "SubscriptionPrivateAccess"))
3619           {
3620            /*
3621             * SubscriptionPrivateAccess {all|default|user/group list|@@ACL}
3622             */
3623
3624             if (!_cups_strcasecmp(value, "default"))
3625             {
3626               cupsdAddString(&(pol->sub_access), "@OWNER");
3627               cupsdAddString(&(pol->sub_access), "@SYSTEM");
3628             }
3629             else
3630               cupsdAddString(&(pol->sub_access), value);
3631           }
3632           else /* if (!_cups_strcasecmp(line, "SubscriptionPrivateValues")) */
3633           {
3634            /*
3635             * SubscriptionPrivateValues {all|none|default|attribute list}
3636             */
3637
3638             if (!_cups_strcasecmp(value, "default"))
3639             {
3640               cupsdAddString(&(pol->sub_attrs), "notify-events");
3641               cupsdAddString(&(pol->sub_attrs), "notify-pull-method");
3642               cupsdAddString(&(pol->sub_attrs), "notify-recipient-uri");
3643               cupsdAddString(&(pol->sub_attrs), "notify-subscriber-user-name");
3644               cupsdAddString(&(pol->sub_attrs), "notify-user-data");
3645             }
3646             else
3647               cupsdAddString(&(pol->sub_attrs), value);
3648           }
3649
3650          /*
3651           * Find the next string on the line...
3652           */
3653
3654           for (value = valptr; isspace(*value & 255); value ++);
3655         }
3656       }
3657     }
3658     else if (!op)
3659     {
3660       cupsdLogMessage(CUPSD_LOG_ERROR,
3661                       "Missing <Limit ops> directive before %s on line %d.",
3662                       line, linenum);
3663       if (FatalErrors & CUPSD_FATAL_CONFIG)
3664         return (0);
3665     }
3666     else if (!parse_aaa(op, line, value, linenum))
3667     {
3668       cupsdLogMessage(CUPSD_LOG_ERROR,
3669                       "Unknown Policy Limit directive %s on line %d.",
3670                       line, linenum);
3671
3672       if (FatalErrors & CUPSD_FATAL_CONFIG)
3673         return (0);
3674     }
3675   }
3676
3677   cupsdLogMessage(CUPSD_LOG_ERROR,
3678                   "Unexpected end-of-file at line %d while reading policy "
3679                   "\"%s\".", linenum, policy);
3680
3681   return ((FatalErrors & CUPSD_FATAL_CONFIG) ? 0 : linenum);
3682 }
3683
3684
3685 /*
3686  * 'set_policy_defaults()' - Set default policy values as needed.
3687  */
3688
3689 static void
3690 set_policy_defaults(cupsd_policy_t *pol)/* I - Policy */
3691 {
3692   cupsd_location_t      *op;            /* Policy operation */
3693
3694
3695  /*
3696   * Verify that we have an explicit policy for Validate-Job, Cancel-Jobs,
3697   * Cancel-My-Jobs, Close-Job, and CUPS-Get-Document, which ensures that
3698   * upgrades do not introduce new security issues...
3699   */
3700
3701   if ((op = cupsdFindPolicyOp(pol, IPP_VALIDATE_JOB)) == NULL ||
3702       op->op == IPP_ANY_OPERATION)
3703   {
3704     if ((op = cupsdFindPolicyOp(pol, IPP_PRINT_JOB)) != NULL &&
3705         op->op != IPP_ANY_OPERATION)
3706     {
3707      /*
3708       * Add a new limit for Validate-Job using the Print-Job limit as a
3709       * template...
3710       */
3711
3712       cupsdLogMessage(CUPSD_LOG_WARN,
3713                       "No limit for Validate-Job defined in policy %s "
3714                       "- using Print-Job's policy.", pol->name);
3715
3716       cupsdAddPolicyOp(pol, op, IPP_VALIDATE_JOB);
3717     }
3718     else
3719       cupsdLogMessage(CUPSD_LOG_WARN,
3720                       "No limit for Validate-Job defined in policy %s "
3721                       "and no suitable template found.", pol->name);
3722   }
3723
3724   if ((op = cupsdFindPolicyOp(pol, IPP_CANCEL_JOBS)) == NULL ||
3725       op->op == IPP_ANY_OPERATION)
3726   {
3727     if ((op = cupsdFindPolicyOp(pol, IPP_PAUSE_PRINTER)) != NULL &&
3728         op->op != IPP_ANY_OPERATION)
3729     {
3730      /*
3731       * Add a new limit for Cancel-Jobs using the Pause-Printer limit as a
3732       * template...
3733       */
3734
3735       cupsdLogMessage(CUPSD_LOG_WARN,
3736                       "No limit for Cancel-Jobs defined in policy %s "
3737                       "- using Pause-Printer's policy.", pol->name);
3738
3739       cupsdAddPolicyOp(pol, op, IPP_CANCEL_JOBS);
3740     }
3741     else
3742       cupsdLogMessage(CUPSD_LOG_WARN,
3743                       "No limit for Cancel-Jobs defined in policy %s "
3744                       "and no suitable template found.", pol->name);
3745   }
3746
3747   if ((op = cupsdFindPolicyOp(pol, IPP_CANCEL_MY_JOBS)) == NULL ||
3748       op->op == IPP_ANY_OPERATION)
3749   {
3750     if ((op = cupsdFindPolicyOp(pol, IPP_SEND_DOCUMENT)) != NULL &&
3751         op->op != IPP_ANY_OPERATION)
3752     {
3753      /*
3754       * Add a new limit for Cancel-My-Jobs using the Send-Document limit as
3755       * a template...
3756       */
3757
3758       cupsdLogMessage(CUPSD_LOG_WARN,
3759                       "No limit for Cancel-My-Jobs defined in policy %s "
3760                       "- using Send-Document's policy.", pol->name);
3761
3762       cupsdAddPolicyOp(pol, op, IPP_CANCEL_MY_JOBS);
3763     }
3764     else
3765       cupsdLogMessage(CUPSD_LOG_WARN,
3766                       "No limit for Cancel-My-Jobs defined in policy %s "
3767                       "and no suitable template found.", pol->name);
3768   }
3769
3770   if ((op = cupsdFindPolicyOp(pol, IPP_CLOSE_JOB)) == NULL ||
3771       op->op == IPP_ANY_OPERATION)
3772   {
3773     if ((op = cupsdFindPolicyOp(pol, IPP_SEND_DOCUMENT)) != NULL &&
3774         op->op != IPP_ANY_OPERATION)
3775     {
3776      /*
3777       * Add a new limit for Close-Job using the Send-Document limit as a
3778       * template...
3779       */
3780
3781       cupsdLogMessage(CUPSD_LOG_WARN,
3782                       "No limit for Close-Job defined in policy %s "
3783                       "- using Send-Document's policy.", pol->name);
3784
3785       cupsdAddPolicyOp(pol, op, IPP_CLOSE_JOB);
3786     }
3787     else
3788       cupsdLogMessage(CUPSD_LOG_WARN,
3789                       "No limit for Close-Job defined in policy %s "
3790                       "and no suitable template found.", pol->name);
3791   }
3792
3793   if ((op = cupsdFindPolicyOp(pol, CUPS_GET_DOCUMENT)) == NULL ||
3794       op->op == IPP_ANY_OPERATION)
3795   {
3796     if ((op = cupsdFindPolicyOp(pol, IPP_SEND_DOCUMENT)) != NULL &&
3797         op->op != IPP_ANY_OPERATION)
3798     {
3799      /*
3800       * Add a new limit for CUPS-Get-Document using the Send-Document
3801       * limit as a template...
3802       */
3803
3804       cupsdLogMessage(CUPSD_LOG_WARN,
3805                       "No limit for CUPS-Get-Document defined in policy %s "
3806                       "- using Send-Document's policy.", pol->name);
3807
3808       cupsdAddPolicyOp(pol, op, CUPS_GET_DOCUMENT);
3809     }
3810     else
3811       cupsdLogMessage(CUPSD_LOG_WARN,
3812                       "No limit for CUPS-Get-Document defined in policy %s "
3813                       "and no suitable template found.", pol->name);
3814   }
3815
3816  /*
3817   * Verify we have JobPrivateAccess, JobPrivateValues,
3818   * SubscriptionPrivateAccess, and SubscriptionPrivateValues in the policy.
3819   */
3820
3821   if (!pol->job_access)
3822   {
3823     cupsdLogMessage(CUPSD_LOG_WARN,
3824                     "No JobPrivateAccess defined in policy %s "
3825                     "- using defaults.", pol->name);
3826     cupsdAddString(&(pol->job_access), "@OWNER");
3827     cupsdAddString(&(pol->job_access), "@SYSTEM");
3828   }
3829
3830   if (!pol->job_attrs)
3831   {
3832     cupsdLogMessage(CUPSD_LOG_WARN,
3833                     "No JobPrivateValues defined in policy %s "
3834                     "- using defaults.", pol->name);
3835     cupsdAddString(&(pol->job_attrs), "job-name");
3836     cupsdAddString(&(pol->job_attrs), "job-originating-host-name");
3837     cupsdAddString(&(pol->job_attrs), "job-originating-user-name");
3838     cupsdAddString(&(pol->job_attrs), "phone");
3839   }
3840
3841   if (!pol->sub_access)
3842   {
3843     cupsdLogMessage(CUPSD_LOG_WARN,
3844                     "No SubscriptionPrivateAccess defined in policy %s "
3845                     "- using defaults.", pol->name);
3846     cupsdAddString(&(pol->sub_access), "@OWNER");
3847     cupsdAddString(&(pol->sub_access), "@SYSTEM");
3848   }
3849
3850   if (!pol->sub_attrs)
3851   {
3852     cupsdLogMessage(CUPSD_LOG_WARN,
3853                     "No SubscriptionPrivateValues defined in policy %s "
3854                     "- using defaults.", pol->name);
3855     cupsdAddString(&(pol->sub_attrs), "notify-events");
3856     cupsdAddString(&(pol->sub_attrs), "notify-pull-method");
3857     cupsdAddString(&(pol->sub_attrs), "notify-recipient-uri");
3858     cupsdAddString(&(pol->sub_attrs), "notify-subscriber-user-name");
3859     cupsdAddString(&(pol->sub_attrs), "notify-user-data");
3860   }
3861 }
3862
3863
3864 /*
3865  * End of "$Id: conf.c 9352 2010-11-06 04:55:26Z mike $".
3866  */