/*
- * "$Id: client.c 4950 2006-01-19 16:07:57Z mike $"
+ * "$Id: client.c 5630 2006-06-05 18:42:53Z mike $"
*
* Client routines for the Common UNIX Printing System (CUPS) scheduler.
*
* cupsdAcceptClient() - Accept a new client.
* cupsdCloseAllClients() - Close all remote clients immediately.
* cupsdCloseClient() - Close a remote client.
- * cupsdEncryptClient() - Enable encryption for the client...
- * cupsdIsCGI() - Is the resource a CGI script/program?
* cupsdReadClient() - Read data from a client.
* cupsdSendCommand() - Send output from a command via HTTP.
* cupsdSendError() - Send an error message via HTTP.
- * cupsdSendFile() - Send a file via HTTP.
* cupsdSendHeader() - Send an HTTP request.
* cupsdUpdateCGI() - Read status messages from CGI scripts and programs.
* cupsdWriteClient() - Write data to a client as needed.
* check_if_modified() - Decode an "If-Modified-Since" line.
+ * encrypt_client() - Enable encryption for the client...
* get_cdsa_server_certs() - Convert a keychain name into the CFArrayRef
* required by SSLSetCertificate.
* get_file() - Get a filename and state info.
* install_conf_file() - Install a configuration file.
+ * is_cgi() - Is the resource a CGI script/program?
* is_path_absolute() - Is a path absolute and free of relative elements.
+ * make_certificate() - Make a self-signed SSL/TLS certificate.
* pipe_command() - Pipe the output of a command to the remote client.
+ * write_file() - Send a file via HTTP.
*/
/*
#ifdef HAVE_CDSASSL
# include <Security/Security.h>
+# ifdef HAVE_SECBASEPRIV_H
+# include <Security/SecBasePriv.h>
+# else
+ extern const char *cssmErrorString(int error);
+# endif /* HAVE_SECBASEPRIV_H */
#endif /* HAVE_CDSASSL */
+#ifdef HAVE_GNUTLS
+# include <gnutls/x509.h>
+#endif /* HAVE_GNUTLS */
/*
static int check_if_modified(cupsd_client_t *con,
struct stat *filestats);
+#ifdef HAVE_SSL
+static int encrypt_client(cupsd_client_t *con);
+#endif /* HAVE_SSL */
#ifdef HAVE_CDSASSL
static CFArrayRef get_cdsa_server_certs(void);
#endif /* HAVE_CDSASSL */
static char *get_file(cupsd_client_t *con, struct stat *filestats,
char *filename, int len);
static http_status_t install_conf_file(cupsd_client_t *con);
+static int is_cgi(cupsd_client_t *con, const char *filename,
+ struct stat *filestats, mime_type_t *type);
static int is_path_absolute(const char *path);
+#ifdef HAVE_GNUTLS
+static void make_certificate(void);
+#endif /* HAVE_GNUTLS */
static int pipe_command(cupsd_client_t *con, int infile, int *outfile,
char *command, char *options, int root);
+static int write_file(cupsd_client_t *con, http_status_t code,
+ char *filename, char *type,
+ struct stat *filestats);
/*
void
cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */
{
- int i; /* Looping var */
int count; /* Count of connections on a host */
int val; /* Parameter value */
- cupsd_client_t *con; /* New client pointer */
+ cupsd_client_t *con, /* New client pointer */
+ *tempcon; /* Temporary client pointer */
http_addrlist_t *addrlist, /* List of adddresses for host */
*addr; /* Current address */
socklen_t addrlen; /* Length of address */
cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdAcceptClient(lis=%p) %d NumClients = %d",
- lis, lis->fd, NumClients);
+ "cupsdAcceptClient(lis=%p) %d Clients = %d",
+ lis, lis->fd, cupsArrayCount(Clients));
/*
* Make sure we don't have a full set of clients already...
*/
- if (NumClients == MaxClients)
+ if (cupsArrayCount(Clients) == MaxClients)
return;
/*
* Get a pointer to the next available client...
*/
- con = Clients + NumClients;
+ if (!Clients)
+ Clients = cupsArrayNew(NULL, NULL);
+
+ if (!Clients)
+ return;
+
+ con = calloc(1, sizeof(cupsd_client_t));
- memset(con, 0, sizeof(cupsd_client_t));
con->http.activity = time(NULL);
con->file = -1;
con->http.hostaddr = &(con->clientaddr);
{
cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to accept client connection - %s.",
strerror(errno));
+ free(con);
return;
}
* Check the number of clients on the same address...
*/
- for (i = 0, count = 0; i < NumClients; i ++)
- if (httpAddrEqual(Clients[i].http.hostaddr, con->http.hostaddr))
+ for (count = 0, tempcon = (cupsd_client_t *)cupsArrayFirst(Clients);
+ tempcon;
+ tempcon = (cupsd_client_t *)cupsArrayNext(Clients))
+ if (httpAddrEqual(tempcon->http.hostaddr, con->http.hostaddr))
{
count ++;
if (count >= MaxClientsPerHost)
{
last_dos = time(NULL);
cupsdLogMessage(CUPSD_LOG_WARN,
- "Possible DoS attack - more than %d clients connecting from %s!",
- MaxClientsPerHost, Clients[i].http.hostname);
+ "Possible DoS attack - more than %d clients connecting "
+ "from %s!",
+ MaxClientsPerHost, tempcon->http.hostname);
}
#ifdef WIN32
close(con->http.fd);
#endif /* WIN32 */
+ free(con);
return;
}
cupsdLogMessage(CUPSD_LOG_WARN,
"Name lookup failed - connection from %s closed!",
con->http.hostname);
+
+ free(con);
return;
}
cupsdLogMessage(CUPSD_LOG_WARN,
"IP lookup failed - connection from %s closed!",
con->http.hostname);
+ free(con);
return;
}
}
}
}
+ cupsArrayAdd(Clients, con);
+
cupsdLogMessage(CUPSD_LOG_DEBUG2,
"cupsdAcceptClient: %d connected to server on %s:%d",
con->http.fd, con->servername, con->serverport);
con->http.fd);
FD_SET(con->http.fd, InputSet);
- NumClients ++;
-
/*
* Temporarily suspend accept()'s until we lose a client...
*/
- if (NumClients == MaxClients)
+ if (cupsArrayCount(Clients) == MaxClients)
cupsdPauseListening();
#ifdef HAVE_SSL
con->http.encryption = HTTP_ENCRYPT_ALWAYS;
- cupsdEncryptClient(con);
+ encrypt_client(con);
}
else
con->auto_ssl = 1;
void
cupsdCloseAllClients(void)
{
- while (NumClients > 0)
- cupsdCloseClient(Clients);
+ cupsd_client_t *con; /* Current client */
+
+
+ for (con = (cupsd_client_t *)cupsArrayFirst(Clients);
+ con;
+ con = (cupsd_client_t *)cupsArrayNext(Clients))
+ cupsdCloseClient(con);
}
SSL *conn; /* Connection for encryption */
unsigned long error; /* Error code */
#elif defined(HAVE_GNUTLS)
- http_tls_t *conn; /* TLS connection information */
- int error; /* Error code */
+ http_tls_t *conn; /* TLS connection information */
+ int error; /* Error code */
gnutls_certificate_server_credentials *credentials;
/* TLS credentials */
+# elif defined(HAVE_CDSASSL)
+ http_tls_t *conn; /* CDSA connection information */
#endif /* HAVE_LIBSSL */
free(conn);
# elif defined(HAVE_CDSASSL)
- SSLClose((SSLContextRef)con->http.tls);
- SSLDisposeContext((SSLContextRef)con->http.tls);
+ conn = (http_tls_t *)(con->http.tls);
+
+ while (SSLClose(conn->session) == errSSLWouldBlock)
+ usleep(1000);
+
+ SSLDisposeContext(conn->session);
+
+ if (conn->certsArray)
+ CFRelease(conn->certsArray);
+
+ free(conn);
# endif /* HAVE_LIBSSL */
con->http.tls = NULL;
* limit...
*/
- if (NumClients == MaxClients)
+ if (cupsArrayCount(Clients) == MaxClients)
cupsdResumeListening();
/*
* Compact the list of clients as necessary...
*/
- NumClients --;
+ cupsArrayRemove(Clients, con);
- if (con < (Clients + NumClients))
- memmove(con, con + 1, (Clients + NumClients - con) * sizeof(cupsd_client_t));
+ free(con);
}
return (partial);
/*
- * 'cupsdEncryptClient()' - Enable encryption for the client...
+ * 'cupsdReadClient()' - Read data from a client.
*/
int /* O - 1 on success, 0 on error */
-cupsdEncryptClient(cupsd_client_t *con) /* I - Client to encrypt */
+cupsdReadClient(cupsd_client_t *con) /* I - Client to read from */
{
-#ifdef HAVE_LIBSSL
- SSL_CTX *context; /* Context for encryption */
- SSL *conn; /* Connection for encryption */
- unsigned long error; /* Error code */
-
-
- /*
- * Create the SSL context and accept the connection...
- */
+ char line[32768], /* Line from client... */
+ operation[64], /* Operation code from socket */
+ version[64], /* HTTP version number string */
+ locale[64], /* Locale */
+ *ptr; /* Pointer into strings */
+ int major, minor; /* HTTP version numbers */
+ http_status_t status; /* Transfer status */
+ ipp_state_t ipp_state; /* State of IPP transfer */
+ int bytes; /* Number of bytes to POST */
+ char *filename; /* Name of file for GET/HEAD */
+ char buf[1024]; /* Buffer for real filename */
+ struct stat filestats; /* File information */
+ mime_type_t *type; /* MIME type of file */
+ cupsd_printer_t *p; /* Printer */
+ static unsigned request_id = 0; /* Request ID for temp files */
- context = SSL_CTX_new(SSLv23_server_method());
- SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); /* Only use SSLv3 or TLS */
- SSL_CTX_use_PrivateKey_file(context, ServerKey, SSL_FILETYPE_PEM);
- SSL_CTX_use_certificate_file(context, ServerCertificate, SSL_FILETYPE_PEM);
+ status = HTTP_CONTINUE;
- conn = SSL_new(context);
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdReadClient: %d, used=%d, file=%d state=%d",
+ con->http.fd, con->http.used, con->file, con->http.state);
- SSL_set_fd(conn, con->http.fd);
- if (SSL_accept(conn) != 1)
+ if (con->http.error)
{
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
-
- while ((error = ERR_get_error()) != 0)
- cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdEncryptClient: %s",
- ERR_error_string(error, NULL));
-
- SSL_CTX_free(context);
- SSL_free(conn);
- return (0);
+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: http error seen...");
+ return (cupsdCloseClient(con));
}
- cupsdLogMessage(CUPSD_LOG_DEBUG,
- "cupsdEncryptClient: %d Connection from %s now encrypted.",
- con->http.fd, con->http.hostname);
+#ifdef HAVE_SSL
+ if (con->auto_ssl)
+ {
+ /*
+ * Automatically check for a SSL/TLS handshake...
+ */
- con->http.tls = conn;
- return (1);
-
-#elif defined(HAVE_GNUTLS)
- http_tls_t *conn; /* TLS session object */
- int error; /* Error code */
- gnutls_certificate_server_credentials *credentials;
- /* TLS credentials */
+ con->auto_ssl = 0;
- /*
- * Create the SSL object and perform the SSL handshake...
- */
+ if (recv(con->http.fd, buf, 1, MSG_PEEK) == 1 &&
+ (!buf[0] || !strchr("DGHOPT", buf[0])))
+ {
+ /*
+ * Encrypt this connection...
+ */
- conn = (http_tls_t *)malloc(sizeof(gnutls_session));
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdReadClient: Saw first byte %02X, auto-negotiating SSL/TLS session...",
+ buf[0] & 255);
- if (conn == NULL)
- return (0);
+ encrypt_client(con);
+ return (1);
+ }
+ }
+#endif /* HAVE_SSL */
- credentials = (gnutls_certificate_server_credentials *)
- malloc(sizeof(gnutls_certificate_server_credentials));
- if (credentials == NULL)
+ switch (con->http.state)
{
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
- cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdEncryptClient: %s", strerror(errno));
-
- free(conn);
- return (0);
- }
+ case HTTP_WAITING :
+ /*
+ * See if we've received a request line...
+ */
- gnutls_certificate_allocate_credentials(credentials);
- gnutls_certificate_set_x509_key_file(*credentials, ServerCertificate,
- ServerKey, GNUTLS_X509_FMT_PEM);
+ if (httpGets(line, sizeof(line) - 1, HTTP(con)) == NULL)
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdReadClient: httpGets returned EOF...");
+ return (cupsdCloseClient(con));
+ }
- gnutls_init(&(conn->session), GNUTLS_SERVER);
- gnutls_set_default_priority(conn->session);
- gnutls_credentials_set(conn->session, GNUTLS_CRD_CERTIFICATE, *credentials);
- gnutls_transport_set_ptr(conn->session, con->http.fd);
+ /*
+ * Ignore blank request lines...
+ */
- error = gnutls_handshake(conn->session);
+ if (line[0] == '\0')
+ break;
- if (error != GNUTLS_E_SUCCESS)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
- cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdEncryptClient: %s",
- gnutls_strerror(error));
+ /*
+ * Clear other state variables...
+ */
- gnutls_deinit(conn->session);
- gnutls_certificate_free_credentials(*credentials);
- free(conn);
- free(credentials);
- return (0);
- }
+ httpClearFields(HTTP(con));
- cupsdLogMessage(CUPSD_LOG_DEBUG,
- "cupsdEncryptClient: %d Connection from %s now encrypted.",
- con->http.fd, con->http.hostname);
+ con->http.activity = time(NULL);
+ con->http.version = HTTP_1_0;
+ con->http.keep_alive = HTTP_KEEPALIVE_OFF;
+ con->http.data_encoding = HTTP_ENCODE_LENGTH;
+ con->http.data_remaining = 0;
+ con->http._data_remaining = 0;
+ con->operation = HTTP_WAITING;
+ con->bytes = 0;
+ con->file = -1;
+ con->file_ready = 0;
+ con->pipe_pid = 0;
+ con->username[0] = '\0';
+ con->password[0] = '\0';
+ con->uri[0] = '\0';
- conn->credentials = credentials;
- con->http.tls = conn;
- return (1);
+ cupsdClearString(&con->command);
+ cupsdClearString(&con->options);
-#elif defined(HAVE_CDSASSL)
- OSStatus error; /* Error info */
- SSLContextRef conn; /* New connection */
- int allowExpired; /* Allow expired certificates? */
- int allowAnyRoot; /* Allow any root certificate? */
+ if (con->language != NULL)
+ {
+ cupsLangFree(con->language);
+ con->language = NULL;
+ }
+ /*
+ * Grab the request line...
+ */
- conn = NULL;
- error = SSLNewContext(true, &conn);
- allowExpired = 1;
- allowAnyRoot = 1;
+ switch (sscanf(line, "%63s%1023s%63s", operation, con->uri, version))
+ {
+ case 1 :
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Bad request line \"%s\" from %s!", line,
+ con->http.hostname);
+ cupsdSendError(con, HTTP_BAD_REQUEST);
+ return (cupsdCloseClient(con));
+ case 2 :
+ con->http.version = HTTP_0_9;
+ break;
+ case 3 :
+ if (sscanf(version, "HTTP/%d.%d", &major, &minor) != 2)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Bad request line \"%s\" from %s!", line,
+ con->http.hostname);
+ cupsdSendError(con, HTTP_BAD_REQUEST);
+ return (cupsdCloseClient(con));
+ }
- if (!ServerCertificatesArray)
- ServerCertificatesArray = get_cdsa_server_certs();
+ if (major < 2)
+ {
+ con->http.version = (http_version_t)(major * 100 + minor);
+ if (con->http.version == HTTP_1_1 && KeepAlive)
+ con->http.keep_alive = HTTP_KEEPALIVE_ON;
+ else
+ con->http.keep_alive = HTTP_KEEPALIVE_OFF;
+ }
+ else
+ {
+ cupsdSendError(con, HTTP_NOT_SUPPORTED);
+ return (cupsdCloseClient(con));
+ }
+ break;
+ }
- if (!ServerCertificatesArray)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "EncryptClient: Could not find signing key in keychain "
- "\"%s\"", ServerCertificate);
- error = errSSLBadConfiguration;
- }
+ /*
+ * Handle full URLs in the request line...
+ */
- if (!error)
- error = SSLSetIOFuncs(conn, _httpReadCDSA, _httpWriteCDSA);
+ if (strcmp(con->uri, "*"))
+ {
+ char method[HTTP_MAX_URI], /* Method/scheme */
+ userpass[HTTP_MAX_URI], /* Username:password */
+ hostname[HTTP_MAX_URI], /* Hostname */
+ resource[HTTP_MAX_URI]; /* Resource path */
+ int port; /* Port number */
- if (!error)
- error = SSLSetProtocolVersion(conn, kSSLProtocol3);
- if (!error)
- error = SSLSetConnection(conn, (SSLConnectionRef)con->http.fd);
+ /*
+ * Separate the URI into its components...
+ */
- if (!error)
- error = SSLSetPeerDomainName(conn, ServerName, strlen(ServerName) + 1);
+ httpSeparateURI(HTTP_URI_CODING_MOST, con->uri,
+ method, sizeof(method),
+ userpass, sizeof(userpass),
+ hostname, sizeof(hostname), &port,
+ resource, sizeof(resource));
- /* have to do these options before setting server certs */
- if (!error && allowExpired)
- error = SSLSetAllowsExpiredCerts(conn, true);
+ /*
+ * Only allow URIs with the servername, localhost, or an IP
+ * address...
+ */
- if (!error && allowAnyRoot)
- error = SSLSetAllowsAnyRoot(conn, true);
+ if (strcmp(method, "file") &&
+ strcasecmp(hostname, ServerName) &&
+ strcasecmp(hostname, "localhost") &&
+ !isdigit(hostname[0]))
+ {
+ /*
+ * Nope, we don't do proxies...
+ */
- if (!error && ServerCertificatesArray)
- {
- error = SSLSetCertificate(conn, ServerCertificatesArray);
-
- /*
- * Perform SSL/TLS handshake
- */
-
- if (!error)
- {
- do
- {
- error = SSLHandshake(conn);
- }
- while (error == errSSLWouldBlock);
- }
- }
-
- if (error)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
-
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: CDSA error code is %d", (int)error);
-
- con->http.error = error;
- con->http.status = HTTP_ERROR;
-
- if (conn != NULL)
- SSLDisposeContext(conn);
-
- return (0);
- }
-
- cupsdLogMessage(CUPSD_LOG_DEBUG,
- "cupsdEncryptClient: %d Connection from %s now encrypted.",
- con->http.fd, con->http.hostname);
-
- con->http.tls = conn;
- return (1);
-
-#else
- return (0);
-#endif /* HAVE_LIBSSL */
-}
-
-
-/*
- * 'cupsdIsCGI()' - Is the resource a CGI script/program?
- */
-
-int /* O - 1 = CGI, 0 = file */
-cupsdIsCGI(cupsd_client_t *con, /* I - Client connection */
- const char *filename, /* I - Real filename */
- struct stat *filestats, /* I - File information */
- mime_type_t *type) /* I - MIME type */
-{
- const char *options; /* Options on URL */
-
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI(con=%p, filename=\"%s\", filestats=%p, type=%s/%s)\n",
- con, filename, filestats, type ? type->super : "unknown",
- type ? type->type : "unknown");
-
- /*
- * Get the options, if any...
- */
-
- if ((options = strchr(con->uri, '?')) != NULL)
- options ++;
-
- /*
- * Check for known types...
- */
-
- if (!type || strcasecmp(type->super, "application"))
- {
- cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsCGI: Returning 0...");
- return (0);
- }
-
- if (!strcasecmp(type->type, "x-httpd-cgi") &&
- (filestats->st_mode & 0111))
- {
- /*
- * "application/x-httpd-cgi" is a CGI script.
- */
-
- cupsdSetString(&con->command, filename);
-
- filename = strrchr(filename, '/') + 1; /* Filename always absolute */
-
- if (options)
- cupsdSetStringf(&con->options, "%s %s", filename, options);
- else
- cupsdSetStringf(&con->options, "%s", filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#ifdef HAVE_JAVA
- else if (!strcasecmp(type->type, "x-httpd-java"))
- {
- /*
- * "application/x-httpd-java" is a Java servlet.
- */
-
- cupsdSetString(&con->command, CUPS_JAVA);
-
- if (options)
- cupsdSetStringf(&con->options, "java %s %s", filename, options);
- else
- cupsdSetStringf(&con->options, "java %s", filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_JAVA */
-#ifdef HAVE_PERL
- else if (!strcasecmp(type->type, "x-httpd-perl"))
- {
- /*
- * "application/x-httpd-perl" is a Perl page.
- */
-
- cupsdSetString(&con->command, CUPS_PERL);
-
- if (options)
- cupsdSetStringf(&con->options, "perl %s %s", filename, options);
- else
- cupsdSetStringf(&con->options, "perl %s", filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_PERL */
-#ifdef HAVE_PHP
- else if (!strcasecmp(type->type, "x-httpd-php"))
- {
- /*
- * "application/x-httpd-php" is a PHP page.
- */
-
- cupsdSetString(&con->command, CUPS_PHP);
-
- if (options)
- cupsdSetStringf(&con->options, "php %s %s", filename, options);
- else
- cupsdSetStringf(&con->options, "php %s", filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_PHP */
-#ifdef HAVE_PYTHON
- else if (!strcasecmp(type->type, "x-httpd-python"))
- {
- /*
- * "application/x-httpd-python" is a Python page.
- */
-
- cupsdSetString(&con->command, CUPS_PYTHON);
-
- if (options)
- cupsdSetStringf(&con->options, "python %s %s", filename, options);
- else
- cupsdSetStringf(&con->options, "python %s", filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_PYTHON */
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsCGI: Returning 0...");
-
- return (0);
-}
-
-
-/*
- * 'cupsdReadClient()' - Read data from a client.
- */
-
-int /* O - 1 on success, 0 on error */
-cupsdReadClient(cupsd_client_t *con) /* I - Client to read from */
-{
- char line[32768], /* Line from client... */
- operation[64], /* Operation code from socket */
- version[64], /* HTTP version number string */
- locale[64], /* Locale */
- *ptr; /* Pointer into strings */
- int major, minor; /* HTTP version numbers */
- http_status_t status; /* Transfer status */
- ipp_state_t ipp_state; /* State of IPP transfer */
- int bytes; /* Number of bytes to POST */
- char *filename; /* Name of file for GET/HEAD */
- char buf[1024]; /* Buffer for real filename */
- struct stat filestats; /* File information */
- mime_type_t *type; /* MIME type of file */
- cupsd_printer_t *p; /* Printer */
- static unsigned request_id = 0; /* Request ID for temp files */
-
-
- status = HTTP_CONTINUE;
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdReadClient: %d, used=%d, file=%d state=%d",
- con->http.fd, con->http.used, con->file, con->http.state);
-
- if (con->http.error)
- {
- cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: http error seen...");
- return (cupsdCloseClient(con));
- }
-
-#ifdef HAVE_SSL
- if (con->auto_ssl)
- {
- /*
- * Automatically check for a SSL/TLS handshake...
- */
-
- con->auto_ssl = 0;
-
- if (recv(con->http.fd, buf, 1, MSG_PEEK) == 1 &&
- (!buf[0] || !strchr("DGHOPT", buf[0])))
- {
- /*
- * Encrypt this connection...
- */
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdReadClient: Saw first byte %02X, auto-negotiating SSL/TLS session...",
- buf[0] & 255);
-
- cupsdEncryptClient(con);
- return (1);
- }
- }
-#endif /* HAVE_SSL */
-
- switch (con->http.state)
- {
- case HTTP_WAITING :
- /*
- * See if we've received a request line...
- */
-
- if (httpGets(line, sizeof(line) - 1, HTTP(con)) == NULL)
- {
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdReadClient: httpGets returned EOF...");
- return (cupsdCloseClient(con));
- }
-
- /*
- * Ignore blank request lines...
- */
-
- if (line[0] == '\0')
- break;
-
- /*
- * Clear other state variables...
- */
-
- httpClearFields(HTTP(con));
-
- con->http.activity = time(NULL);
- con->http.version = HTTP_1_0;
- con->http.keep_alive = HTTP_KEEPALIVE_OFF;
- con->http.data_encoding = HTTP_ENCODE_LENGTH;
- con->http.data_remaining = 0;
- con->http._data_remaining = 0;
- con->operation = HTTP_WAITING;
- con->bytes = 0;
- con->file = -1;
- con->file_ready = 0;
- con->pipe_pid = 0;
- con->username[0] = '\0';
- con->password[0] = '\0';
- con->uri[0] = '\0';
-
- cupsdClearString(&con->command);
- cupsdClearString(&con->options);
-
- if (con->language != NULL)
- {
- cupsLangFree(con->language);
- con->language = NULL;
- }
-
- /*
- * Grab the request line...
- */
-
- switch (sscanf(line, "%63s%1023s%63s", operation, con->uri, version))
- {
- case 1 :
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Bad request line \"%s\" from %s!", line,
- con->http.hostname);
- cupsdSendError(con, HTTP_BAD_REQUEST);
- return (cupsdCloseClient(con));
- case 2 :
- con->http.version = HTTP_0_9;
- break;
- case 3 :
- if (sscanf(version, "HTTP/%d.%d", &major, &minor) != 2)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Bad request line \"%s\" from %s!", line,
- con->http.hostname);
- cupsdSendError(con, HTTP_BAD_REQUEST);
- return (cupsdCloseClient(con));
- }
-
- if (major < 2)
- {
- con->http.version = (http_version_t)(major * 100 + minor);
- if (con->http.version == HTTP_1_1 && KeepAlive)
- con->http.keep_alive = HTTP_KEEPALIVE_ON;
- else
- con->http.keep_alive = HTTP_KEEPALIVE_OFF;
- }
- else
- {
- cupsdSendError(con, HTTP_NOT_SUPPORTED);
- return (cupsdCloseClient(con));
- }
- break;
- }
-
- /*
- * Handle full URLs in the request line...
- */
-
- if (strcmp(con->uri, "*"))
- {
- char method[HTTP_MAX_URI], /* Method/scheme */
- userpass[HTTP_MAX_URI], /* Username:password */
- hostname[HTTP_MAX_URI], /* Hostname */
- resource[HTTP_MAX_URI]; /* Resource path */
- int port; /* Port number */
-
-
- /*
- * Separate the URI into its components...
- */
-
- httpSeparateURI(con->uri, method, sizeof(method),
- userpass, sizeof(userpass),
- hostname, sizeof(hostname), &port,
- resource, sizeof(resource));
-
- /*
- * Only allow URIs with the servername, localhost, or an IP
- * address...
- */
-
- if (strcmp(method, "file") &&
- strcasecmp(hostname, ServerName) &&
- strcasecmp(hostname, "localhost") &&
- !isdigit(hostname[0]))
- {
- /*
- * Nope, we don't do proxies...
- */
-
- cupsdLogMessage(CUPSD_LOG_ERROR, "Bad URI \"%s\" in request!",
- con->uri);
- cupsdSendError(con, HTTP_METHOD_NOT_ALLOWED);
- return (cupsdCloseClient(con));
- }
+ cupsdLogMessage(CUPSD_LOG_ERROR, "Bad URI \"%s\" in request!",
+ con->uri);
+ cupsdSendError(con, HTTP_METHOD_NOT_ALLOWED);
+ return (cupsdCloseClient(con));
+ }
/*
* Copy the resource portion back into the URI; both resource and
con->start = time(NULL);
con->operation = con->http.state;
- cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdReadClient: %d %s %s HTTP/%d.%d", con->http.fd,
- operation, con->uri,
+ cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdReadClient: %d %s %s HTTP/%d.%d",
+ con->http.fd, operation, con->uri,
con->http.version / 100, con->http.version % 100);
con->http.status = HTTP_OK;
else
snprintf(locale, sizeof(locale), "%s.%s",
con->http.fields[HTTP_FIELD_ACCEPT_LANGUAGE], DefaultCharset);
-
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG,
+ "cupsdReadClient: %d Browser asked for language \"%s\"...",
+ con->http.fd, locale);
+
con->language = cupsLangGet(locale);
}
else
httpPrintf(HTTP(con), "Content-Length: 0\r\n");
httpPrintf(HTTP(con), "\r\n");
- cupsdEncryptClient(con);
+ encrypt_client(con);
#else
if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED))
return (cupsdCloseClient(con));
#endif /* HAVE_SSL */
}
- if (con->http.expect)
- {
- /**** TODO: send expected header ****/
- }
-
if (!cupsdSendHeader(con, HTTP_OK, NULL))
return (cupsdCloseClient(con));
httpPrintf(HTTP(con), "Content-Length: 0\r\n");
httpPrintf(HTTP(con), "\r\n");
- cupsdEncryptClient(con);
+ encrypt_client(con);
#else
if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED))
return (cupsdCloseClient(con));
return (cupsdCloseClient(con));
}
- if (con->http.expect)
+ if (con->http.expect &&
+ (con->operation == HTTP_POST || con->operation == HTTP_PUT))
{
- /**** TODO: send expected header ****/
+ if (con->http.expect == HTTP_CONTINUE)
+ {
+ /*
+ * Send 100-continue header...
+ */
+
+ if (!cupsdSendHeader(con, HTTP_CONTINUE, NULL))
+ return (cupsdCloseClient(con));
+ }
+ else
+ {
+ /*
+ * Send 417-expectation-failed header...
+ */
+
+ if (!cupsdSendHeader(con, HTTP_EXPECTATION_FAILED, NULL))
+ return (cupsdCloseClient(con));
+
+ httpPrintf(HTTP(con), "Content-Length: 0\r\n");
+ httpPrintf(HTTP(con), "\r\n");
+ }
}
switch (con->http.state)
cupsdSetStringf(&con->command, "%s/cgi-bin/admin.cgi",
ServerBin);
- if ((ptr = strchr(con->uri + 6, '?')) != NULL)
- cupsdSetStringf(&con->options, "admin%s", ptr);
- else
- cupsdSetString(&con->options, "admin");
+ cupsdSetString(&con->options, strchr(con->uri + 6, '?'));
}
else if (!strncmp(con->uri, "/printers", 9))
{
cupsdSetStringf(&con->command, "%s/cgi-bin/printers.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 9);
+
+ if (con->uri[9] && con->uri[10])
+ cupsdSetString(&con->options, con->uri + 9);
+ else
+ cupsdSetString(&con->options, NULL);
}
else if (!strncmp(con->uri, "/classes", 8))
{
cupsdSetStringf(&con->command, "%s/cgi-bin/classes.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 8);
+
+ if (con->uri[8] && con->uri[9])
+ cupsdSetString(&con->options, con->uri + 8);
+ else
+ cupsdSetString(&con->options, NULL);
}
else if (!strncmp(con->uri, "/jobs", 5))
{
cupsdSetStringf(&con->command, "%s/cgi-bin/jobs.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 5);
+
+ if (con->uri[5] && con->uri[6])
+ cupsdSetString(&con->options, con->uri + 5);
+ else
+ cupsdSetString(&con->options, NULL);
}
else
{
cupsdSetStringf(&con->command, "%s/cgi-bin/help.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 5);
- }
- if (con->options[0] == '/')
- _cups_strcpy(con->options, con->options + 1);
+ if (con->uri[5] && con->uri[6])
+ cupsdSetString(&con->options, con->uri + 5);
+ else
+ cupsdSetString(&con->options, NULL);
+ }
if (!cupsdSendCommand(con, con->command, con->options, 0))
{
break;
}
- type = mimeFileType(MimeDatabase, filename, NULL);
+ type = mimeFileType(MimeDatabase, filename, NULL, NULL);
- if (cupsdIsCGI(con, filename, &filestats, type))
+ if (is_cgi(con, filename, &filestats, type))
{
/*
* Note: con->command and con->options were set by
- * cupsdIsCGI()...
+ * is_cgi()...
*/
if (!cupsdSendCommand(con, con->command, con->options, 0))
else
snprintf(line, sizeof(line), "%s/%s", type->super, type->type);
- if (!cupsdSendFile(con, HTTP_OK, filename, line, &filestats))
+ if (!write_file(con, HTTP_OK, filename, line, &filestats))
return (cupsdCloseClient(con));
}
}
cupsdSetStringf(&con->command, "%s/cgi-bin/admin.cgi",
ServerBin);
- if ((ptr = strchr(con->uri + 6, '?')) != NULL)
- cupsdSetStringf(&con->options, "admin%s", ptr);
- else
- cupsdSetString(&con->options, "admin");
+ cupsdSetString(&con->options, strchr(con->uri + 6, '?'));
}
else if (!strncmp(con->uri, "/printers", 9))
{
cupsdSetStringf(&con->command, "%s/cgi-bin/printers.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 9);
+
+ if (con->uri[9] && con->uri[10])
+ cupsdSetString(&con->options, con->uri + 9);
+ else
+ cupsdSetString(&con->options, NULL);
}
else if (!strncmp(con->uri, "/classes", 8))
{
cupsdSetStringf(&con->command, "%s/cgi-bin/classes.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 8);
+
+ if (con->uri[8] && con->uri[9])
+ cupsdSetString(&con->options, con->uri + 8);
+ else
+ cupsdSetString(&con->options, NULL);
}
else if (!strncmp(con->uri, "/jobs", 5))
{
cupsdSetStringf(&con->command, "%s/cgi-bin/jobs.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 5);
+
+ if (con->uri[5] && con->uri[6])
+ cupsdSetString(&con->options, con->uri + 5);
+ else
+ cupsdSetString(&con->options, NULL);
}
else
{
cupsdSetStringf(&con->command, "%s/cgi-bin/help.cgi",
ServerBin);
- cupsdSetString(&con->options, con->uri + 5);
- }
- if (con->options[0] == '/')
- _cups_strcpy(con->options, con->options + 1);
+ if (con->uri[5] && con->uri[6])
+ cupsdSetString(&con->options, con->uri + 5);
+ else
+ cupsdSetString(&con->options, NULL);
+ }
cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdReadClient: %d command=\"%s\", options = \"%s\"",
- con->http.fd, con->command, con->options);
+ "cupsdReadClient: %d command=\"%s\", "
+ "options = \"%s\"",
+ con->http.fd, con->command,
+ con->options ? con->options : "(null)");
if (con->http.version <= HTTP_1_0)
con->http.keep_alive = HTTP_KEEPALIVE_OFF;
break;
}
- type = mimeFileType(MimeDatabase, filename, NULL);
+ type = mimeFileType(MimeDatabase, filename, NULL, NULL);
- if (!cupsdIsCGI(con, filename, &filestats, type))
+ if (!is_cgi(con, filename, &filestats, type))
{
/*
* Only POST to CGI's...
* Serve a file...
*/
- type = mimeFileType(MimeDatabase, filename, NULL);
+ type = mimeFileType(MimeDatabase, filename, NULL, NULL);
if (type == NULL)
strcpy(line, "text/plain");
else
"CHUNKED" : "LENGTH",
CUPS_LLCAST con->http.data_remaining, con->file);
- if ((bytes = httpRead(HTTP(con), line, sizeof(line))) < 0)
+ if ((bytes = httpRead2(HTTP(con), line, sizeof(line))) < 0)
return (cupsdCloseClient(con));
else if (bytes > 0)
{
if (con->http.state != HTTP_POST_SEND)
{
- if ((bytes = httpRead(HTTP(con), line, sizeof(line))) < 0)
+ if ((bytes = httpRead2(HTTP(con), line, sizeof(line))) < 0)
return (cupsdCloseClient(con));
else if (bytes > 0)
{
if (con->filename)
+ {
fd = open(con->filename, O_RDONLY);
- else
- fd = open("/dev/null", O_RDONLY);
- if (fd < 0)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdSendCommand: %d Unable to open \"%s\" for reading: %s",
- con->http.fd, con->filename ? con->filename : "/dev/null",
- strerror(errno));
- return (0);
- }
+ if (fd < 0)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "cupsdSendCommand: %d Unable to open \"%s\" for reading: %s",
+ con->http.fd, con->filename ? con->filename : "/dev/null",
+ strerror(errno));
+ return (0);
+ }
- fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+ fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+ }
+ else
+ fd = -1;
con->pipe_pid = pipe_command(con, fd, &(con->file), command, options, root);
- close(fd);
+ if (fd >= 0)
+ close(fd);
cupsdLogMessage(CUPSD_LOG_INFO, "Started \"%s\" (pid=%d)", command,
con->pipe_pid);
cupsdSendError(cupsd_client_t *con, /* I - Connection */
http_status_t code) /* I - Error code */
{
+#ifdef HAVE_SSL
+ /*
+ * Force client to upgrade for authentication if that is how the
+ * server is configured...
+ */
+
+ if (code == HTTP_UNAUTHORIZED &&
+ DefaultEncryption == HTTP_ENCRYPT_REQUIRED &&
+ strcasecmp(con->http.hostname, "localhost") &&
+ !con->http.tls)
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdSendError: Encryption before authentication!");
+ code = HTTP_UPGRADE_REQUIRED;
+ }
+#endif /* HAVE_SSL */
+
/*
* Put the request in the access_log file...
*/
* Send a human-readable error message.
*/
- char message[1024]; /* Message for user */
+ char message[4096], /* Message for user */
+ urltext[1024], /* URL redirection text */
+ redirect[1024]; /* Redirection link */
const char *text; /* Status-specific text */
+
+ redirect[0] = '\0';
+
if (code == HTTP_UNAUTHORIZED)
text = _cupsLangString(con->language,
_("Enter your username and password or the "
"root username and password to access this "
"page."));
else if (code == HTTP_UPGRADE_REQUIRED)
- text = _cupsLangString(con->language,
- _("You must use a https: URL to access this "
- "page."));
+ {
+ text = urltext;
+
+ snprintf(urltext, sizeof(urltext),
+ _cupsLangString(con->language,
+ _("You must access this page using the URL "
+ "<A HREF=\"https://%s:%d%s\">"
+ "https://%s:%d%s</A>.")),
+ con->servername, con->serverport, con->uri,
+ con->servername, con->serverport, con->uri);
+
+ snprintf(redirect, sizeof(redirect),
+ "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"3;https://%s:%d%s\">\n",
+ con->servername, con->serverport, con->uri);
+ }
else
text = "";
"\t<TITLE>%d %s</TITLE>\n"
"\t<LINK REL=\"STYLESHEET\" TYPE=\"text/css\" "
"HREF=\"/cups.css\">\n"
+ "%s"
"</HEAD>\n"
"<BODY>\n"
"<H1>%d %s</H1>\n"
"<P>%s</P>\n"
"</BODY>\n"
"</HTML>\n",
- code, httpStatus(code), code, httpStatus(code), text);
+ code, httpStatus(code), redirect, code, httpStatus(code), text);
if (httpPrintf(HTTP(con), "Content-Type: text/html; charset=utf-8\r\n") < 0)
return (0);
}
-/*
- * 'cupsdSendFile()' - Send a file via HTTP.
- */
-
-int /* O - 0 on failure, 1 on success */
-cupsdSendFile(cupsd_client_t *con, /* I - Client connection */
- http_status_t code, /* I - HTTP status */
- char *filename, /* I - Filename */
- char *type, /* I - File type */
- struct stat *filestats)/* O - File information */
-{
- con->file = open(filename, O_RDONLY);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdSendFile: %d file=%d", con->http.fd,
- con->file);
-
- if (con->file < 0)
- return (0);
-
- fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
-
- con->pipe_pid = 0;
-
- if (!cupsdSendHeader(con, code, type))
- return (0);
-
- if (httpPrintf(HTTP(con), "Last-Modified: %s\r\n",
- httpGetDateString(filestats->st_mtime)) < 0)
- return (0);
- if (httpPrintf(HTTP(con), "Content-Length: " CUPS_LLFMT "\r\n",
- CUPS_LLCAST filestats->st_size) < 0)
- return (0);
- if (httpPrintf(HTTP(con), "\r\n") < 0)
- return (0);
-
- con->http.data_encoding = HTTP_ENCODE_LENGTH;
- con->http.data_remaining = filestats->st_size;
-
- if (con->http.data_remaining <= INT_MAX)
- con->http._data_remaining = con->http.data_remaining;
- else
- con->http._data_remaining = INT_MAX;
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdSendFile: Adding fd %d to OutputSet...", con->http.fd);
-
- FD_SET(con->http.fd, OutputSet);
-
- return (1);
-}
-
-
/*
* 'cupsdSendHeader()' - Send an HTTP request.
*/
http_status_t code, /* I - HTTP status code */
char *type) /* I - MIME type of document */
{
+ /*
+ * Send the HTTP status header...
+ */
+
if (httpPrintf(HTTP(con), "HTTP/%d.%d %d %s\r\n", con->http.version / 100,
con->http.version % 100, code, httpStatus(code)) < 0)
return (0);
+
+ if (code == HTTP_CONTINUE)
+ {
+ /*
+ * 100-continue doesn't send any headers...
+ */
+
+ if (httpPrintf(HTTP(con), "\r\n") < 0)
+ return (0);
+ else
+ return (1);
+ }
+
if (httpPrintf(HTTP(con), "Date: %s\r\n", httpGetDateString(time(NULL))) < 0)
return (0);
if (ServerHeader)
}
}
- if (con->language != NULL)
+ if (con->language && strcmp(con->language->language, "C"))
{
if (httpPrintf(HTTP(con), "Content-Language: %s\r\n",
con->language->language) < 0)
return (0);
}
- if (type != NULL)
+ if (type)
{
if (!strcmp(type, "text/html"))
{
*/
if (!strncasecmp(buf, "Location:", 9))
+ {
cupsdSendHeader(con, HTTP_SEE_OTHER, NULL);
+ if (httpPrintf(HTTP(con), "Content-Length: 0\r\n") < 0)
+ return (0);
+ }
else if (!strncasecmp(buf, "Status:", 7))
- cupsdSendHeader(con, atoi(buf + 7), NULL);
+ cupsdSendError(con, atoi(buf + 7));
else
+ {
cupsdSendHeader(con, HTTP_OK, NULL);
- if (con->http.version == HTTP_1_1)
- {
- con->http.data_encoding = HTTP_ENCODE_CHUNKED;
+ if (con->http.version == HTTP_1_1)
+ {
+ con->http.data_encoding = HTTP_ENCODE_CHUNKED;
- if (httpPrintf(HTTP(con), "Transfer-Encoding: chunked\r\n") < 0)
- return (0);
- }
+ if (httpPrintf(HTTP(con), "Transfer-Encoding: chunked\r\n") < 0)
+ return (0);
+ }
+ }
con->sent_header = 1;
}
return (1);
}
else if (bytes == 0)
- {
con->http.activity = time(NULL);
- return (1);
- }
}
- if (httpWrite(HTTP(con), buf, bytes) < 0)
+ if (bytes > 0)
{
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdWriteClient: %d Write of %d bytes failed!",
- con->http.fd, bytes);
+ if (httpWrite2(HTTP(con), buf, bytes) < 0)
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdWriteClient: %d Write of %d bytes failed!",
+ con->http.fd, bytes);
- cupsdCloseClient(con);
- return (0);
- }
+ cupsdCloseClient(con);
+ return (0);
+ }
- con->bytes += bytes;
+ con->bytes += bytes;
- if (con->http.state == HTTP_WAITING)
- bytes = 0;
+ if (con->http.state == HTTP_WAITING)
+ bytes = 0;
+ }
}
if (bytes <= 0)
FD_CLR(con->http.fd, OutputSet);
- if (con->file >= 0)
- {
- if (FD_ISSET(con->file, InputSet))
- {
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdWriteClient: Removing fd %d from InputSet...",
- con->file);
- FD_CLR(con->file, InputSet);
- }
+ if (con->file >= 0)
+ {
+ if (FD_ISSET(con->file, InputSet))
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdWriteClient: Removing fd %d from InputSet...",
+ con->file);
+ FD_CLR(con->file, InputSet);
+ }
+
+ if (con->pipe_pid)
+ cupsdEndProcess(con->pipe_pid, 0);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdWriteClient: %d Closing data file %d.",
+ con->http.fd, con->file);
+
+ close(con->file);
+ con->file = -1;
+ con->pipe_pid = 0;
+ }
+
+ if (con->filename)
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdWriteClient: %d Removing temp file %s",
+ con->http.fd, con->filename);
+ unlink(con->filename);
+ cupsdClearString(&con->filename);
+ }
+
+ if (con->request != NULL)
+ {
+ ippDelete(con->request);
+ con->request = NULL;
+ }
+
+ if (con->response != NULL)
+ {
+ ippDelete(con->response);
+ con->response = NULL;
+ }
+
+ cupsdClearString(&con->command);
+ cupsdClearString(&con->options);
+
+ if (!con->http.keep_alive)
+ {
+ cupsdCloseClient(con);
+ return (0);
+ }
+ }
+ else
+ {
+ con->file_ready = 0;
+
+ if (con->pipe_pid && !FD_ISSET(con->file, InputSet))
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdWriteClient: Adding fd %d to InputSet...",
+ con->file);
+ FD_SET(con->file, InputSet);
+ }
+ }
+
+ con->http.activity = time(NULL);
+
+ return (1);
+}
+
+
+/*
+ * 'check_if_modified()' - Decode an "If-Modified-Since" line.
+ */
+
+static int /* O - 1 if modified since */
+check_if_modified(
+ cupsd_client_t *con, /* I - Client connection */
+ struct stat *filestats) /* I - File information */
+{
+ char *ptr; /* Pointer into field */
+ time_t date; /* Time/date value */
+ off_t size; /* Size/length value */
+
+
+ size = 0;
+ date = 0;
+ ptr = con->http.fields[HTTP_FIELD_IF_MODIFIED_SINCE];
+
+ if (*ptr == '\0')
+ return (1);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "check_if_modified: %d If-Modified-Since=\"%s\"",
+ con->http.fd, ptr);
+
+ while (*ptr != '\0')
+ {
+ while (isspace(*ptr) || *ptr == ';')
+ ptr ++;
+
+ if (strncasecmp(ptr, "length=", 7) == 0)
+ {
+ ptr += 7;
+ size = strtoll(ptr, NULL, 10);
+
+ while (isdigit(*ptr))
+ ptr ++;
+ }
+ else if (isalpha(*ptr))
+ {
+ date = httpGetDateTime(ptr);
+ while (*ptr != '\0' && *ptr != ';')
+ ptr ++;
+ }
+ else
+ ptr ++;
+ }
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "check_if_modified: %d sizes=" CUPS_LLFMT ","
+ CUPS_LLFMT " dates=%d,%d",
+ con->http.fd, CUPS_LLCAST size,
+ CUPS_LLCAST filestats->st_size, (int)date,
+ (int)filestats->st_mtime);
+
+ return ((size != filestats->st_size && size != 0) ||
+ (date < filestats->st_mtime && date != 0) ||
+ (size == 0 && date == 0));
+}
+
+
+#ifdef HAVE_SSL
+/*
+ * 'encrypt_client()' - Enable encryption for the client...
+ */
+
+static int /* O - 1 on success, 0 on error */
+encrypt_client(cupsd_client_t *con) /* I - Client to encrypt */
+{
+# ifdef HAVE_LIBSSL
+ SSL_CTX *context; /* Context for encryption */
+ SSL *conn; /* Connection for encryption */
+ unsigned long error; /* Error code */
+
+
+ /*
+ * Create the SSL context and accept the connection...
+ */
+
+ context = SSL_CTX_new(SSLv23_server_method());
+
+ SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); /* Only use SSLv3 or TLS */
+ SSL_CTX_use_PrivateKey_file(context, ServerKey, SSL_FILETYPE_PEM);
+ SSL_CTX_use_certificate_file(context, ServerCertificate, SSL_FILETYPE_PEM);
+
+ conn = SSL_new(context);
+
+ SSL_set_fd(conn, con->http.fd);
+ if (SSL_accept(conn) != 1)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
+
+ while ((error = ERR_get_error()) != 0)
+ cupsdLogMessage(CUPSD_LOG_ERROR, "encrypt_client: %s",
+ ERR_error_string(error, NULL));
+
+ SSL_CTX_free(context);
+ SSL_free(conn);
+ return (0);
+ }
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG,
+ "encrypt_client: %d Connection from %s now encrypted.",
+ con->http.fd, con->http.hostname);
+
+ con->http.tls = conn;
+ return (1);
+
+# elif defined(HAVE_GNUTLS)
+ http_tls_t *conn; /* TLS session object */
+ int error; /* Error code */
+ gnutls_certificate_server_credentials *credentials;
+ /* TLS credentials */
+
+
+ /*
+ * Verify that we have a certificate...
+ */
+
+ if (access(ServerKey, 0) || access(ServerCertificate, 0))
+ {
+ /*
+ * Nope, make a self-signed certificate...
+ */
+
+ make_certificate();
+ }
+
+ /*
+ * Create the SSL object and perform the SSL handshake...
+ */
+
+ conn = (http_tls_t *)malloc(sizeof(http_tls_t));
+
+ if (conn == NULL)
+ return (0);
+
+ credentials = (gnutls_certificate_server_credentials *)
+ malloc(sizeof(gnutls_certificate_server_credentials));
+ if (credentials == NULL)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
+ cupsdLogMessage(CUPSD_LOG_ERROR, "encrypt_client: %s", strerror(errno));
+
+ free(conn);
+ return (0);
+ }
+
+ gnutls_certificate_allocate_credentials(credentials);
+ gnutls_certificate_set_x509_key_file(*credentials, ServerCertificate,
+ ServerKey, GNUTLS_X509_FMT_PEM);
+
+ gnutls_init(&(conn->session), GNUTLS_SERVER);
+ gnutls_set_default_priority(conn->session);
+ gnutls_credentials_set(conn->session, GNUTLS_CRD_CERTIFICATE, *credentials);
+ gnutls_transport_set_ptr(conn->session,
+ (gnutls_transport_ptr)((long)con->http.fd));
+
+ error = gnutls_handshake(conn->session);
+
+ if (error != GNUTLS_E_SUCCESS)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
+ cupsdLogMessage(CUPSD_LOG_ERROR, "encrypt_client: %s",
+ gnutls_strerror(error));
+
+ gnutls_deinit(conn->session);
+ gnutls_certificate_free_credentials(*credentials);
+ free(conn);
+ free(credentials);
+ return (0);
+ }
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG,
+ "encrypt_client: %d Connection from %s now encrypted.",
+ con->http.fd, con->http.hostname);
+
+ conn->credentials = credentials;
+ con->http.tls = conn;
+ return (1);
+
+# elif defined(HAVE_CDSASSL)
+ OSStatus error; /* Error code */
+ http_tls_t *conn; /* CDSA connection information */
+ cdsa_conn_ref_t u; /* Connection reference union */
- if (con->pipe_pid)
- cupsdEndProcess(con->pipe_pid, 0);
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdWriteClient: %d Closing data file %d.",
- con->http.fd, con->file);
+ if ((conn = (http_tls_t *)malloc(sizeof(http_tls_t))) == NULL)
+ return (0);
- close(con->file);
- con->file = -1;
- con->pipe_pid = 0;
- }
+ error = 0;
+ conn->session = NULL;
+ conn->certsArray = get_cdsa_server_certs();
- if (con->filename)
- {
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdWriteClient: %d Removing temp file %s",
- con->http.fd, con->filename);
- unlink(con->filename);
- cupsdClearString(&con->filename);
- }
+ if (!conn->certsArray)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "EncryptClient: Could not find signing key in keychain "
+ "\"%s\"", ServerCertificate);
+ error = errSSLBadCert; /* errSSLBadConfiguration is a better choice, but not available on 10.2.x */
+ }
- if (con->request != NULL)
- {
- ippDelete(con->request);
- con->request = NULL;
- }
+ if (!error)
+ error = SSLNewContext(true, &conn->session);
- if (con->response != NULL)
- {
- ippDelete(con->response);
- con->response = NULL;
- }
+ if (!error)
+ error = SSLSetIOFuncs(conn->session, _httpReadCDSA, _httpWriteCDSA);
- cupsdClearString(&con->command);
- cupsdClearString(&con->options);
+ if (!error)
+ error = SSLSetProtocolVersionEnabled(conn->session, kSSLProtocol2, false);
- if (!con->http.keep_alive)
- {
- cupsdCloseClient(con);
- return (0);
- }
- }
- else
+ if (!error)
{
- con->file_ready = 0;
+ /*
+ * Use a union to resolve warnings about int/pointer size mismatches...
+ */
- if (con->pipe_pid && !FD_ISSET(con->file, InputSet))
- {
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdWriteClient: Adding fd %d to InputSet...",
- con->file);
- FD_SET(con->file, InputSet);
- }
+ u.connection = NULL;
+ u.sock = con->http.fd;
+ error = SSLSetConnection(conn->session, u.connection);
}
- con->http.activity = time(NULL);
+ if (!error)
+ error = SSLSetAllowsExpiredCerts(conn->session, true);
- return (1);
-}
+ if (!error)
+ error = SSLSetAllowsAnyRoot(conn->session, true);
+ if (!error)
+ error = SSLSetCertificate(conn->session, conn->certsArray);
-/*
- * 'check_if_modified()' - Decode an "If-Modified-Since" line.
- */
+ if (!error)
+ {
+ /*
+ * Perform SSL/TLS handshake
+ */
-static int /* O - 1 if modified since */
-check_if_modified(
- cupsd_client_t *con, /* I - Client connection */
- struct stat *filestats) /* I - File information */
-{
- char *ptr; /* Pointer into field */
- time_t date; /* Time/date value */
- off_t size; /* Size/length value */
+ while ((error = SSLHandshake(conn->session)) == errSSLWouldBlock)
+ usleep(1000);
+ }
+ if (error)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
- size = 0;
- date = 0;
- ptr = con->http.fields[HTTP_FIELD_IF_MODIFIED_SINCE];
+ cupsdLogMessage(CUPSD_LOG_ERROR, "encrypt_client: %s (%d)",
+ cssmErrorString(error), (int)error);
- if (*ptr == '\0')
- return (1);
+ con->http.error = error;
+ con->http.status = HTTP_ERROR;
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "check_if_modified: %d If-Modified-Since=\"%s\"",
- con->http.fd, ptr);
+ if (conn->session)
+ SSLDisposeContext(conn->session);
- while (*ptr != '\0')
- {
- while (isspace(*ptr) || *ptr == ';')
- ptr ++;
+ if (conn->certsArray)
+ CFRelease(conn->certsArray);
- if (strncasecmp(ptr, "length=", 7) == 0)
- {
- ptr += 7;
- size = strtoll(ptr, NULL, 10);
+ free(conn);
- while (isdigit(*ptr))
- ptr ++;
- }
- else if (isalpha(*ptr))
- {
- date = httpGetDateTime(ptr);
- while (*ptr != '\0' && *ptr != ';')
- ptr ++;
- }
+ return (0);
}
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "check_if_modified: %d sizes=" CUPS_LLFMT ","
- CUPS_LLFMT " dates=%d,%d",
- con->http.fd, CUPS_LLCAST size,
- CUPS_LLCAST filestats->st_size, (int)date,
- (int)filestats->st_mtime);
+ cupsdLogMessage(CUPSD_LOG_DEBUG,
+ "encrypt_client: %d Connection from %s now encrypted.",
+ con->http.fd, con->http.hostname);
- return ((size != filestats->st_size && size != 0) ||
- (date < filestats->st_mtime && date != 0) ||
- (size == 0 && date == 0));
+ con->http.tls = conn;
+ return (1);
+
+# endif /* HAVE_LIBSSL */
}
+#endif /* HAVE_SSL */
#ifdef HAVE_CDSASSL
* To create a self-signed certificate for testing use the certtool.
* Executing the following as root will do it:
*
- * certtool c c v k=CUPS
+ * certtool c k=/Library/Keychains/System.keychain
*/
static CFArrayRef /* O - Array of certificates */
* to array as well.
*/
- ca = CFArrayCreate(NULL, (const void **)&identity, 1, NULL);
+ ca = CFArrayCreate(NULL, (const void **)&identity, 1, &kCFTypeArrayCallBacks);
if (ca == nil)
cupsdLogMessage(CUPSD_LOG_ERROR, "CFArrayCreate error");
}
- /*CFRelease(identity);*/
+ CFRelease(identity);
}
- /*CFRelease(srchRef);*/
+ CFRelease(srchRef);
}
- /*CFRelease(kcRef);*/
+ CFRelease(kcRef);
}
return (ca);
else
return (NULL);
}
- else if (con->language != NULL)
+ else if (con->language)
snprintf(filename, len, "%s/%s%s", DocumentRoot, con->language->language,
- con->uri);
+ con->uri);
else
snprintf(filename, len, "%s%s", DocumentRoot, con->uri);
* then fallback to the default one...
*/
- if ((status = stat(filename, filestats)) != 0 && con->language != NULL)
+ if ((status = stat(filename, filestats)) != 0 && con->language &&
+ strncmp(con->uri, "/ppd/", 5) &&
+ strncmp(con->uri, "/admin/conf/", 12) &&
+ strncmp(con->uri, "/admin/log/", 11))
{
/*
- * Drop the language prefix and try the current directory...
+ * Drop the country code...
*/
- if (strncmp(con->uri, "/ppd/", 5) &&
- strncmp(con->uri, "/admin/conf/", 12) &&
- strncmp(con->uri, "/admin/log/", 11))
+ char ll[3]; /* Short language name */
+
+
+ strlcpy(ll, con->language->language, sizeof(ll));
+ snprintf(filename, len, "%s/%s%s", DocumentRoot, ll, con->uri);
+
+ if ((ptr = strchr(filename, '?')) != NULL)
+ *ptr = '\0';
+
+ if ((status = stat(filename, filestats)) != 0)
{
+ /*
+ * Drop the language prefix and try the root directory...
+ */
+
snprintf(filename, len, "%s%s", DocumentRoot, con->uri);
if ((ptr = strchr(filename, '?')) != NULL)
unlink(newfile);
- return (HTTP_SERVER_ERROR);
+ return (HTTP_SERVER_ERROR);
+ }
+
+ /*
+ * Remove the request file...
+ */
+
+ unlink(con->filename);
+ cupsdClearString(&con->filename);
+
+ /*
+ * Unlink the old backup, rename the current config file to the backup
+ * filename, and rename the new config file to the config file name...
+ */
+
+ if (unlink(oldfile))
+ if (errno != ENOENT)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to remove backup config file \"%s\" - %s",
+ oldfile, strerror(errno));
+
+ unlink(newfile);
+
+ return (HTTP_SERVER_ERROR);
+ }
+
+ if (rename(conffile, oldfile))
+ if (errno != ENOENT)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to rename old config file \"%s\" - %s",
+ conffile, strerror(errno));
+
+ unlink(newfile);
+
+ return (HTTP_SERVER_ERROR);
+ }
+
+ if (rename(newfile, conffile))
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to rename new config file \"%s\" - %s",
+ newfile, strerror(errno));
+
+ rename(oldfile, conffile);
+ unlink(newfile);
+
+ return (HTTP_SERVER_ERROR);
+ }
+
+ /*
+ * If the cupsd.conf file was updated, set the NeedReload flag...
+ */
+
+ if (!strcmp(con->uri, "/admin/conf/cupsd.conf"))
+ NeedReload = RELOAD_CUPSD;
+ else
+ NeedReload = RELOAD_ALL;
+
+ ReloadTime = time(NULL);
+
+ /*
+ * Return that the file was created successfully...
+ */
+
+ return (HTTP_CREATED);
+}
+
+
+/*
+ * 'is_cgi()' - Is the resource a CGI script/program?
+ */
+
+static int /* O - 1 = CGI, 0 = file */
+is_cgi(cupsd_client_t *con, /* I - Client connection */
+ const char *filename, /* I - Real filename */
+ struct stat *filestats, /* I - File information */
+ mime_type_t *type) /* I - MIME type */
+{
+ const char *options; /* Options on URL */
+
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi(con=%p, filename=\"%s\", filestats=%p, type=%s/%s)\n",
+ con, filename, filestats, type ? type->super : "unknown",
+ type ? type->type : "unknown");
+
+ /*
+ * Get the options, if any...
+ */
+
+ if ((options = strchr(con->uri, '?')) != NULL)
+ options ++;
+
+ /*
+ * Check for known types...
+ */
+
+ if (!type || strcasecmp(type->super, "application"))
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "is_cgi: Returning 0...");
+ return (0);
+ }
+
+ if (!strcasecmp(type->type, "x-httpd-cgi") &&
+ (filestats->st_mode & 0111))
+ {
+ /*
+ * "application/x-httpd-cgi" is a CGI script.
+ */
+
+ cupsdSetString(&con->command, filename);
+
+ filename = strrchr(filename, '/') + 1; /* Filename always absolute */
+
+ cupsdSetString(&con->options, options);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
+
+ return (1);
}
+#ifdef HAVE_JAVA
+ else if (!strcasecmp(type->type, "x-httpd-java"))
+ {
+ /*
+ * "application/x-httpd-java" is a Java servlet.
+ */
- /*
- * Remove the request file...
- */
+ cupsdSetString(&con->command, CUPS_JAVA);
- unlink(con->filename);
- cupsdClearString(&con->filename);
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
- /*
- * Unlink the old backup, rename the current config file to the backup
- * filename, and rename the new config file to the config file name...
- */
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
- if (unlink(oldfile))
- if (errno != ENOENT)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to remove backup config file \"%s\" - %s",
- oldfile, strerror(errno));
+ return (1);
+ }
+#endif /* HAVE_JAVA */
+#ifdef HAVE_PERL
+ else if (!strcasecmp(type->type, "x-httpd-perl"))
+ {
+ /*
+ * "application/x-httpd-perl" is a Perl page.
+ */
- unlink(newfile);
+ cupsdSetString(&con->command, CUPS_PERL);
- return (HTTP_SERVER_ERROR);
- }
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
- if (rename(conffile, oldfile))
- if (errno != ENOENT)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to rename old config file \"%s\" - %s",
- conffile, strerror(errno));
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
- unlink(newfile);
+ return (1);
+ }
+#endif /* HAVE_PERL */
+#ifdef HAVE_PHP
+ else if (!strcasecmp(type->type, "x-httpd-php"))
+ {
+ /*
+ * "application/x-httpd-php" is a PHP page.
+ */
- return (HTTP_SERVER_ERROR);
- }
+ cupsdSetString(&con->command, CUPS_PHP);
- if (rename(newfile, conffile))
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "Unable to rename new config file \"%s\" - %s",
- newfile, strerror(errno));
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
- rename(oldfile, conffile);
- unlink(newfile);
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
- return (HTTP_SERVER_ERROR);
+ return (1);
}
+#endif /* HAVE_PHP */
+#ifdef HAVE_PYTHON
+ else if (!strcasecmp(type->type, "x-httpd-python"))
+ {
+ /*
+ * "application/x-httpd-python" is a Python page.
+ */
- /*
- * If the cupsd.conf file was updated, set the NeedReload flag...
- */
+ cupsdSetString(&con->command, CUPS_PYTHON);
- if (!strcmp(con->uri, "/admin/conf/cupsd.conf"))
- NeedReload = RELOAD_CUPSD;
- else
- NeedReload = RELOAD_ALL;
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
- ReloadTime = time(NULL);
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
- /*
- * Return that the file was created successfully...
- */
+ return (1);
+ }
+#endif /* HAVE_PYTHON */
- return (HTTP_CREATED);
+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "is_cgi: Returning 0...");
+
+ return (0);
}
}
+#ifdef HAVE_GNUTLS
+/*
+ * 'make_certificate()' - Make a self-signed SSL/TLS certificate.
+ */
+
+static void
+make_certificate(void)
+{
+ gnutls_x509_crt crt; /* Self-signed certificate */
+ gnutls_x509_privkey key; /* Encryption key */
+ cups_lang_t *language; /* Default language info */
+ cups_file_t *fp; /* Key/cert file */
+ unsigned char buffer[8192]; /* Buffer for x509 data */
+ size_t bytes; /* Number of bytes of data */
+ unsigned char serial[4]; /* Serial number buffer */
+ time_t curtime; /* Current time */
+ int result; /* Result of GNU TLS calls */
+
+
+ /*
+ * Create the encryption key...
+ */
+
+ cupsdLogMessage(CUPSD_LOG_INFO, "Generating server key...");
+
+ gnutls_x509_privkey_init(&key);
+ gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 2048, 0);
+
+ /*
+ * Save it...
+ */
+
+ bytes = sizeof(buffer);
+
+ if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM,
+ buffer, &bytes)) < 0)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to export server key - %s",
+ gnutls_strerror(result));
+ gnutls_x509_privkey_deinit(key);
+ return;
+ }
+ else if ((fp = cupsFileOpen(ServerKey, "w")) != NULL)
+ {
+ cupsFileWrite(fp, (char *)buffer, bytes);
+ cupsFileClose(fp);
+
+ cupsdLogMessage(CUPSD_LOG_INFO, "Created server key file \"%s\"...",
+ ServerKey);
+ }
+ else
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to create server key file \"%s\" - %s",
+ ServerKey, strerror(errno));
+ gnutls_x509_privkey_deinit(key);
+ return;
+ }
+
+ /*
+ * Create the self-signed certificate...
+ */
+
+ cupsdLogMessage(CUPSD_LOG_INFO, "Generating self-signed certificate...");
+
+ language = cupsLangDefault();
+ curtime = time(NULL);
+ serial[0] = curtime >> 24;
+ serial[1] = curtime >> 16;
+ serial[2] = curtime >> 8;
+ serial[3] = curtime;
+
+ gnutls_x509_crt_init(&crt);
+ if (strlen(language->language) == 5)
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
+ language->language + 3, 2);
+ else
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
+ "US", 2);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0,
+ ServerName, strlen(ServerName));
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATION_NAME, 0,
+ ServerName, strlen(ServerName));
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME,
+ 0, "Unknown", 7);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0,
+ "Unknown", 7);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0,
+ "Unknown", 7);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_PKCS9_EMAIL, 0,
+ ServerAdmin, strlen(ServerAdmin));
+ gnutls_x509_crt_set_key(crt, key);
+ gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
+ gnutls_x509_crt_set_activation_time(crt, curtime);
+ gnutls_x509_crt_set_expiration_time(crt, curtime + 10 * 365 * 86400);
+ gnutls_x509_crt_set_ca_status(crt, 0);
+ gnutls_x509_crt_set_subject_alternative_name(crt, GNUTLS_SAN_DNSNAME,
+ ServerName);
+ gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
+ gnutls_x509_crt_set_key_usage(crt, GNUTLS_KEY_KEY_ENCIPHERMENT);
+ gnutls_x509_crt_set_version(crt, 3);
+
+ bytes = sizeof(buffer);
+ if (gnutls_x509_crt_get_key_id(crt, 0, buffer, &bytes) >= 0)
+ gnutls_x509_crt_set_subject_key_id(crt, buffer, bytes);
+
+ gnutls_x509_crt_sign(crt, crt, key);
+
+ /*
+ * Save it...
+ */
+
+ bytes = sizeof(buffer);
+ if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM,
+ buffer, &bytes)) < 0)
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to export server certificate - %s",
+ gnutls_strerror(result));
+ else if ((fp = cupsFileOpen(ServerCertificate, "w")) != NULL)
+ {
+ cupsFileWrite(fp, (char *)buffer, bytes);
+ cupsFileClose(fp);
+
+ cupsdLogMessage(CUPSD_LOG_INFO,
+ "Created 10-year server certificate file \"%s\"...",
+ ServerCertificate);
+ }
+ else
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to create server certificate file \"%s\" - %s",
+ ServerCertificate, strerror(errno));
+
+ /*
+ * Cleanup...
+ */
+
+ gnutls_x509_crt_deinit(crt);
+ gnutls_x509_privkey_deinit(key);
+}
+#endif /* HAVE_GNUTLS */
+
+
/*
* 'pipe_command()' - Pipe the output of a command to the remote client.
*/
{
int i; /* Looping var */
int pid; /* Process ID */
- char *commptr; /* Command string pointer */
+ char *commptr, /* Command string pointer */
+ commch; /* Command string character */
char *uriptr; /* URI string pointer */
int fds[2]; /* Pipe FDs */
int argc; /* Number of arguments */
int envc; /* Number of environment variables */
char argbuf[10240], /* Argument buffer */
*argv[100], /* Argument strings */
- *envp[100]; /* Environment variables */
+ *envp[MAX_ENV + 17]; /* Environment variables */
char content_length[1024], /* CONTENT_LENGTH environment variable */
content_type[1024], /* CONTENT_TYPE environment variable */
http_cookie[32768], /* HTTP_COOKIE environment variable */
http_user_agent[1024], /* HTTP_USER_AGENT environment variable */
lang[1024], /* LANG environment variable */
+ path_info[1024], /* PATH_INFO environment variable */
*query_string, /* QUERY_STRING env variable */
remote_addr[1024], /* REMOTE_ADDR environment variable */
remote_host[1024], /* REMOTE_HOST environment variable */
/*
* Parse a copy of the options string, which is of the form:
*
- * name argument+argument+argument
- * name?argument+argument+argument
- * name param=value¶m=value
- * name?param=value¶m=value
+ * argument+argument+argument
+ * ?argument+argument+argument
+ * param=value¶m=value
+ * ?param=value¶m=value
+ * /name?argument+argument+argument
+ * /name?param=value¶m=value
*
* If the string contains an "=" character after the initial name,
* then we treat it as a HTTP GET form request and make a copy of
cupsdLogMessage(CUPSD_LOG_DEBUG2,
"pipe_command: command=\"%s\", options=\"%s\"",
- command, options);
+ command, options ? options : "(null)");
- strlcpy(argbuf, options, sizeof(argbuf));
-
- argv[0] = argbuf;
+ argv[0] = command;
query_string = NULL;
- for (commptr = argbuf, argc = 1; *commptr != '\0' && argc < 99; commptr ++)
+ if (options)
+ strlcpy(argbuf, options, sizeof(argbuf));
+ else
+ argbuf[0] = '\0';
+
+ if (argbuf[0] == '/')
{
/*
- * Break arguments whenever we see a + or space...
+ * Found some trailing path information, set PATH_INFO...
*/
- if (*commptr == ' ' || *commptr == '+' || (*commptr == '?' && argc == 1))
- {
- /*
- * Terminate the current string and skip trailing whitespace...
- */
+ if ((commptr = strchr(argbuf, '?')) == NULL)
+ commptr = argbuf + strlen(argbuf);
- *commptr++ = '\0';
+ commch = *commptr;
+ *commptr = '\0';
+ snprintf(path_info, sizeof(path_info), "PATH_INFO=%s", argbuf);
+ *commptr = commch;
+ }
+ else
+ {
+ commptr = argbuf;
+ path_info[0] = '\0';
+ }
- while (*commptr == ' ')
- commptr ++;
+ if (*commptr == '?' && con->operation == HTTP_GET)
+ {
+ commptr ++;
+ cupsdSetStringf(&query_string, "QUERY_STRING=%s", commptr);
+ }
- /*
- * If we don't have a blank string, save it as another argument...
- */
+ argc = 1;
- if (*commptr)
- {
- argv[argc] = commptr;
- argc ++;
- }
- else
- break;
+ if (*commptr)
+ {
+ argv[argc ++] = commptr;
+ for (; *commptr && argc < 99; commptr ++)
+ {
/*
- * If we see an "=" in the remaining string, make a copy of it since
- * it will be query data...
+ * Break arguments whenever we see a + or space...
*/
- if (argc == 2 && strchr(commptr, '=') && con->operation == HTTP_GET)
- cupsdSetStringf(&query_string, "QUERY_STRING=%s", commptr);
+ if (*commptr == ' ' || *commptr == '+')
+ {
+ while (*commptr == ' ' || *commptr == '+')
+ *commptr++ = '\0';
- /*
- * Don't skip the first non-blank character...
- */
+ /*
+ * If we don't have a blank string, save it as another argument...
+ */
- commptr --;
- }
- else if (*commptr == '%' && isxdigit(commptr[1] & 255) &&
- isxdigit(commptr[2] & 255))
- {
- /*
- * Convert the %xx notation to the individual character.
- */
+ if (*commptr)
+ {
+ argv[argc] = commptr;
+ argc ++;
+ }
+ else
+ break;
+ }
+ else if (*commptr == '%' && isxdigit(commptr[1] & 255) &&
+ isxdigit(commptr[2] & 255))
+ {
+ /*
+ * Convert the %xx notation to the individual character.
+ */
- if (commptr[1] >= '0' && commptr[1] <= '9')
- *commptr = (commptr[1] - '0') << 4;
- else
- *commptr = (tolower(commptr[1]) - 'a' + 10) << 4;
+ if (commptr[1] >= '0' && commptr[1] <= '9')
+ *commptr = (commptr[1] - '0') << 4;
+ else
+ *commptr = (tolower(commptr[1]) - 'a' + 10) << 4;
- if (commptr[2] >= '0' && commptr[2] <= '9')
- *commptr |= commptr[2] - '0';
- else
- *commptr |= tolower(commptr[2]) - 'a' + 10;
+ if (commptr[2] >= '0' && commptr[2] <= '9')
+ *commptr |= commptr[2] - '0';
+ else
+ *commptr |= tolower(commptr[2]) - 'a' + 10;
- _cups_strcpy(commptr + 1, commptr + 3);
+ _cups_strcpy(commptr + 1, commptr + 3);
- /*
- * Check for a %00 and break if that is the case...
- */
+ /*
+ * Check for a %00 and break if that is the case...
+ */
- if (!*commptr)
- break;
+ if (!*commptr)
+ break;
+ }
}
}
argv[argc] = NULL;
- if (argv[0][0] == '\0')
- argv[0] = strrchr(command, '/') + 1;
-
/*
* Setup the environment variables as needed...
*/
envp[envc ++] = remote_host;
envp[envc ++] = script_name;
+ if (path_info[0])
+ envp[envc ++] = path_info;
+
if (con->username[0])
{
snprintf(remote_user, sizeof(remote_user), "REMOTE_USER=%s", con->username);
}
else
{
- sprintf(content_length, "CONTENT_LENGTH=" CUPS_LLFMT, con->bytes);
+ sprintf(content_length, "CONTENT_LENGTH=" CUPS_LLFMT,
+ CUPS_LLCAST con->bytes);
snprintf(content_type, sizeof(content_type), "CONTENT_TYPE=%s",
con->http.fields[HTTP_FIELD_CONTENT_TYPE]);
* Tell the CGI if we are using encryption...
*/
- if (con->http.encryption == HTTP_ENCRYPT_ALWAYS)
+ if (con->http.tls)
envp[envc ++] = "HTTPS=ON";
/*
/*
- * End of "$Id: client.c 4950 2006-01-19 16:07:57Z mike $".
+ * 'write_file()' - Send a file via HTTP.
+ */
+
+static int /* O - 0 on failure, 1 on success */
+write_file(cupsd_client_t *con, /* I - Client connection */
+ http_status_t code, /* I - HTTP status */
+ char *filename, /* I - Filename */
+ char *type, /* I - File type */
+ struct stat *filestats) /* O - File information */
+{
+ con->file = open(filename, O_RDONLY);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG, "write_file: %d file=%d", con->http.fd,
+ con->file);
+
+ if (con->file < 0)
+ return (0);
+
+ fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
+
+ con->pipe_pid = 0;
+
+ if (!cupsdSendHeader(con, code, type))
+ return (0);
+
+ if (httpPrintf(HTTP(con), "Last-Modified: %s\r\n",
+ httpGetDateString(filestats->st_mtime)) < 0)
+ return (0);
+ if (httpPrintf(HTTP(con), "Content-Length: " CUPS_LLFMT "\r\n",
+ CUPS_LLCAST filestats->st_size) < 0)
+ return (0);
+ if (httpPrintf(HTTP(con), "\r\n") < 0)
+ return (0);
+
+ con->http.data_encoding = HTTP_ENCODE_LENGTH;
+ con->http.data_remaining = filestats->st_size;
+
+ if (con->http.data_remaining <= INT_MAX)
+ con->http._data_remaining = con->http.data_remaining;
+ else
+ con->http._data_remaining = INT_MAX;
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "write_file: Adding fd %d to OutputSet...", con->http.fd);
+
+ FD_SET(con->http.fd, OutputSet);
+
+ return (1);
+}
+
+
+/*
+ * End of "$Id: client.c 5630 2006-06-05 18:42:53Z mike $".
*/
projects / thirdparty / cups.git / blobdiff