/*
- * "$Id: client.c 5200 2006-02-28 00:10:32Z mike $"
+ * "$Id: client.c 5305 2006-03-18 03:05:12Z mike $"
*
* Client routines for the Common UNIX Printing System (CUPS) scheduler.
*
* cupsdAcceptClient() - Accept a new client.
* cupsdCloseAllClients() - Close all remote clients immediately.
* cupsdCloseClient() - Close a remote client.
- * cupsdEncryptClient() - Enable encryption for the client...
- * cupsdIsCGI() - Is the resource a CGI script/program?
* cupsdReadClient() - Read data from a client.
* cupsdSendCommand() - Send output from a command via HTTP.
* cupsdSendError() - Send an error message via HTTP.
- * cupsdSendFile() - Send a file via HTTP.
* cupsdSendHeader() - Send an HTTP request.
* cupsdUpdateCGI() - Read status messages from CGI scripts and programs.
* cupsdWriteClient() - Write data to a client as needed.
* check_if_modified() - Decode an "If-Modified-Since" line.
+ * encrypt_client() - Enable encryption for the client...
* get_cdsa_server_certs() - Convert a keychain name into the CFArrayRef
* required by SSLSetCertificate.
* get_file() - Get a filename and state info.
* install_conf_file() - Install a configuration file.
+ * is_cgi() - Is the resource a CGI script/program?
* is_path_absolute() - Is a path absolute and free of relative elements.
+ * make_certificate() - Make a self-signed SSL/TLS certificate.
* pipe_command() - Pipe the output of a command to the remote client.
+ * send_file() - Send a file via HTTP.
*/
/*
#ifdef HAVE_CDSASSL
# include <Security/Security.h>
#endif /* HAVE_CDSASSL */
+#ifdef HAVE_GNUTLS
+# include <gnutls/x509.h>
+#endif /* HAVE_GNUTLS */
/*
static int check_if_modified(cupsd_client_t *con,
struct stat *filestats);
+static int encrypt_client(cupsd_client_t *con);
#ifdef HAVE_CDSASSL
static CFArrayRef get_cdsa_server_certs(void);
#endif /* HAVE_CDSASSL */
static char *get_file(cupsd_client_t *con, struct stat *filestats,
char *filename, int len);
static http_status_t install_conf_file(cupsd_client_t *con);
+static int is_cgi(cupsd_client_t *con, const char *filename,
+ struct stat *filestats, mime_type_t *type);
static int is_path_absolute(const char *path);
+#ifdef HAVE_GNUTLS
+static void make_certificate(void);
+#endif /* HAVE_GNUTLS */
static int pipe_command(cupsd_client_t *con, int infile, int *outfile,
char *command, char *options, int root);
+static int send_file(cupsd_client_t *con, http_status_t code,
+ char *filename, char *type,
+ struct stat *filestats);
/*
con->http.encryption = HTTP_ENCRYPT_ALWAYS;
- cupsdEncryptClient(con);
+ encrypt_client(con);
}
else
con->auto_ssl = 1;
}
-/*
- * 'cupsdEncryptClient()' - Enable encryption for the client...
- */
-
-int /* O - 1 on success, 0 on error */
-cupsdEncryptClient(cupsd_client_t *con) /* I - Client to encrypt */
-{
-#ifdef HAVE_LIBSSL
- SSL_CTX *context; /* Context for encryption */
- SSL *conn; /* Connection for encryption */
- unsigned long error; /* Error code */
-
-
- /*
- * Create the SSL context and accept the connection...
- */
-
- context = SSL_CTX_new(SSLv23_server_method());
-
- SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); /* Only use SSLv3 or TLS */
- SSL_CTX_use_PrivateKey_file(context, ServerKey, SSL_FILETYPE_PEM);
- SSL_CTX_use_certificate_file(context, ServerCertificate, SSL_FILETYPE_PEM);
-
- conn = SSL_new(context);
-
- SSL_set_fd(conn, con->http.fd);
- if (SSL_accept(conn) != 1)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
-
- while ((error = ERR_get_error()) != 0)
- cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdEncryptClient: %s",
- ERR_error_string(error, NULL));
-
- SSL_CTX_free(context);
- SSL_free(conn);
- return (0);
- }
-
- cupsdLogMessage(CUPSD_LOG_DEBUG,
- "cupsdEncryptClient: %d Connection from %s now encrypted.",
- con->http.fd, con->http.hostname);
-
- con->http.tls = conn;
- return (1);
-
-#elif defined(HAVE_GNUTLS)
- http_tls_t *conn; /* TLS session object */
- int error; /* Error code */
- gnutls_certificate_server_credentials *credentials;
- /* TLS credentials */
-
- /*
- * Create the SSL object and perform the SSL handshake...
- */
-
- conn = (http_tls_t *)malloc(sizeof(gnutls_session));
-
- if (conn == NULL)
- return (0);
-
- credentials = (gnutls_certificate_server_credentials *)
- malloc(sizeof(gnutls_certificate_server_credentials));
- if (credentials == NULL)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
- cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdEncryptClient: %s", strerror(errno));
-
- free(conn);
- return (0);
- }
-
- gnutls_certificate_allocate_credentials(credentials);
- gnutls_certificate_set_x509_key_file(*credentials, ServerCertificate,
- ServerKey, GNUTLS_X509_FMT_PEM);
-
- gnutls_init(&(conn->session), GNUTLS_SERVER);
- gnutls_set_default_priority(conn->session);
- gnutls_credentials_set(conn->session, GNUTLS_CRD_CERTIFICATE, *credentials);
- gnutls_transport_set_ptr(conn->session, con->http.fd);
-
- error = gnutls_handshake(conn->session);
-
- if (error != GNUTLS_E_SUCCESS)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
- cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdEncryptClient: %s",
- gnutls_strerror(error));
-
- gnutls_deinit(conn->session);
- gnutls_certificate_free_credentials(*credentials);
- free(conn);
- free(credentials);
- return (0);
- }
-
- cupsdLogMessage(CUPSD_LOG_DEBUG,
- "cupsdEncryptClient: %d Connection from %s now encrypted.",
- con->http.fd, con->http.hostname);
-
- conn->credentials = credentials;
- con->http.tls = conn;
- return (1);
-
-#elif defined(HAVE_CDSASSL)
- OSStatus error; /* Error info */
- SSLContextRef conn; /* New connection */
- CFArrayRef certificatesArray; /* Array containing certificates */
- int allowExpired; /* Allow expired certificates? */
- int allowAnyRoot; /* Allow any root certificate? */
-
-
- conn = NULL;
- error = SSLNewContext(true, &conn);
- allowExpired = 1;
- allowAnyRoot = 1;
-
- certificatesArray = get_cdsa_server_certs();
-
- if (!certificatesArray)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "EncryptClient: Could not find signing key in keychain "
- "\"%s\"", ServerCertificate);
- error = errSSLBadCert; /* errSSLBadConfiguration is a better choice, but not available on 10.2.x */
- }
-
- if (!error)
- error = SSLSetIOFuncs(conn, _httpReadCDSA, _httpWriteCDSA);
-
- if (!error)
- error = SSLSetProtocolVersion(conn, kSSLProtocol3);
-
- if (!error)
- error = SSLSetConnection(conn, (SSLConnectionRef)con->http.fd);
-
- if (!error)
- error = SSLSetPeerDomainName(conn, ServerName, strlen(ServerName) + 1);
-
- /* have to do these options before setting server certs */
- if (!error && allowExpired)
- error = SSLSetAllowsExpiredCerts(conn, true);
-
- if (!error && allowAnyRoot)
- error = SSLSetAllowsAnyRoot(conn, true);
-
- if (!error)
- error = SSLSetCertificate(conn, certificatesArray);
-
- if (certificatesArray)
- {
- CFRelease(certificatesArray);
- certificatesArray = NULL;
- }
-
- if (!error)
- {
- /*
- * Perform SSL/TLS handshake
- */
-
- while ((error = SSLHandshake(conn)) == errSSLWouldBlock)
- usleep(1000);
- }
-
- if (error)
- {
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: Unable to encrypt connection from %s!",
- con->http.hostname);
-
- cupsdLogMessage(CUPSD_LOG_ERROR,
- "cupsdEncryptClient: CDSA error code is %d", (int)error);
-
- con->http.error = error;
- con->http.status = HTTP_ERROR;
-
- if (conn != NULL)
- SSLDisposeContext(conn);
-
- return (0);
- }
-
- cupsdLogMessage(CUPSD_LOG_DEBUG,
- "cupsdEncryptClient: %d Connection from %s now encrypted.",
- con->http.fd, con->http.hostname);
-
- con->http.tls = conn;
- return (1);
-
-#else
- return (0);
-#endif /* HAVE_LIBSSL */
-}
-
-
-/*
- * 'cupsdIsCGI()' - Is the resource a CGI script/program?
- */
-
-int /* O - 1 = CGI, 0 = file */
-cupsdIsCGI(cupsd_client_t *con, /* I - Client connection */
- const char *filename, /* I - Real filename */
- struct stat *filestats, /* I - File information */
- mime_type_t *type) /* I - MIME type */
-{
- const char *options; /* Options on URL */
-
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI(con=%p, filename=\"%s\", filestats=%p, type=%s/%s)\n",
- con, filename, filestats, type ? type->super : "unknown",
- type ? type->type : "unknown");
-
- /*
- * Get the options, if any...
- */
-
- if ((options = strchr(con->uri, '?')) != NULL)
- options ++;
-
- /*
- * Check for known types...
- */
-
- if (!type || strcasecmp(type->super, "application"))
- {
- cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsCGI: Returning 0...");
- return (0);
- }
-
- if (!strcasecmp(type->type, "x-httpd-cgi") &&
- (filestats->st_mode & 0111))
- {
- /*
- * "application/x-httpd-cgi" is a CGI script.
- */
-
- cupsdSetString(&con->command, filename);
-
- filename = strrchr(filename, '/') + 1; /* Filename always absolute */
-
- cupsdSetString(&con->options, options);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#ifdef HAVE_JAVA
- else if (!strcasecmp(type->type, "x-httpd-java"))
- {
- /*
- * "application/x-httpd-java" is a Java servlet.
- */
-
- cupsdSetString(&con->command, CUPS_JAVA);
-
- if (options)
- cupsdSetStringf(&con->options, "%s %s", filename, options);
- else
- cupsdSetString(&con->options, filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_JAVA */
-#ifdef HAVE_PERL
- else if (!strcasecmp(type->type, "x-httpd-perl"))
- {
- /*
- * "application/x-httpd-perl" is a Perl page.
- */
-
- cupsdSetString(&con->command, CUPS_PERL);
-
- if (options)
- cupsdSetStringf(&con->options, "%s %s", filename, options);
- else
- cupsdSetString(&con->options, filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_PERL */
-#ifdef HAVE_PHP
- else if (!strcasecmp(type->type, "x-httpd-php"))
- {
- /*
- * "application/x-httpd-php" is a PHP page.
- */
-
- cupsdSetString(&con->command, CUPS_PHP);
-
- if (options)
- cupsdSetStringf(&con->options, "%s %s", filename, options);
- else
- cupsdSetString(&con->options, filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_PHP */
-#ifdef HAVE_PYTHON
- else if (!strcasecmp(type->type, "x-httpd-python"))
- {
- /*
- * "application/x-httpd-python" is a Python page.
- */
-
- cupsdSetString(&con->command, CUPS_PYTHON);
-
- if (options)
- cupsdSetStringf(&con->options, "%s %s", filename, options);
- else
- cupsdSetString(&con->options, filename);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdIsCGI: Returning 1 with command=\"%s\" and options=\"%s\"",
- con->command, con->options);
-
- return (1);
- }
-#endif /* HAVE_PYTHON */
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsCGI: Returning 0...");
-
- return (0);
-}
-
-
/*
* 'cupsdReadClient()' - Read data from a client.
*/
"cupsdReadClient: Saw first byte %02X, auto-negotiating SSL/TLS session...",
buf[0] & 255);
- cupsdEncryptClient(con);
+ encrypt_client(con);
return (1);
}
}
httpPrintf(HTTP(con), "Content-Length: 0\r\n");
httpPrintf(HTTP(con), "\r\n");
- cupsdEncryptClient(con);
+ encrypt_client(con);
#else
if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED))
return (cupsdCloseClient(con));
httpPrintf(HTTP(con), "Content-Length: 0\r\n");
httpPrintf(HTTP(con), "\r\n");
- cupsdEncryptClient(con);
+ encrypt_client(con);
#else
if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED))
return (cupsdCloseClient(con));
type = mimeFileType(MimeDatabase, filename, NULL, NULL);
- if (cupsdIsCGI(con, filename, &filestats, type))
+ if (is_cgi(con, filename, &filestats, type))
{
/*
* Note: con->command and con->options were set by
- * cupsdIsCGI()...
+ * is_cgi()...
*/
if (!cupsdSendCommand(con, con->command, con->options, 0))
else
snprintf(line, sizeof(line), "%s/%s", type->super, type->type);
- if (!cupsdSendFile(con, HTTP_OK, filename, line, &filestats))
+ if (!send_file(con, HTTP_OK, filename, line, &filestats))
return (cupsdCloseClient(con));
}
}
type = mimeFileType(MimeDatabase, filename, NULL, NULL);
- if (!cupsdIsCGI(con, filename, &filestats, type))
+ if (!is_cgi(con, filename, &filestats, type))
{
/*
* Only POST to CGI's...
cupsdSendError(cupsd_client_t *con, /* I - Connection */
http_status_t code) /* I - Error code */
{
+#ifdef HAVE_SSL
+ /*
+ * Force client to upgrade for authentication if that is how the
+ * server is configured...
+ */
+
+ if (code == HTTP_UNAUTHORIZED &&
+ DefaultEncryption == HTTP_ENCRYPT_REQUIRED &&
+ strcasecmp(con->http.hostname, "localhost") &&
+ !con->http.tls)
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdSendError: Encryption before authentication!");
+ code = HTTP_UPGRADE_REQUIRED;
+ }
+#endif /* HAVE_SSL */
+
/*
* Put the request in the access_log file...
*/
"<P>%s</P>\n"
"</BODY>\n"
"</HTML>\n",
- code, httpStatus(code), code, httpStatus(code), text);
-
- if (httpPrintf(HTTP(con), "Content-Type: text/html; charset=utf-8\r\n") < 0)
- return (0);
- if (httpPrintf(HTTP(con), "Content-Length: %d\r\n",
- (int)strlen(message)) < 0)
- return (0);
- if (httpPrintf(HTTP(con), "\r\n") < 0)
- return (0);
- if (httpPrintf(HTTP(con), "%s", message) < 0)
- return (0);
- }
- else if (httpPrintf(HTTP(con), "\r\n") < 0)
- return (0);
-
- con->http.state = HTTP_WAITING;
-
- return (1);
-}
-
-
-/*
- * 'cupsdSendFile()' - Send a file via HTTP.
- */
-
-int /* O - 0 on failure, 1 on success */
-cupsdSendFile(cupsd_client_t *con, /* I - Client connection */
- http_status_t code, /* I - HTTP status */
- char *filename, /* I - Filename */
- char *type, /* I - File type */
- struct stat *filestats)/* O - File information */
-{
- con->file = open(filename, O_RDONLY);
-
- cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdSendFile: %d file=%d", con->http.fd,
- con->file);
-
- if (con->file < 0)
- return (0);
-
- fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
-
- con->pipe_pid = 0;
-
- if (!cupsdSendHeader(con, code, type))
- return (0);
+ code, httpStatus(code), code, httpStatus(code), text);
- if (httpPrintf(HTTP(con), "Last-Modified: %s\r\n",
- httpGetDateString(filestats->st_mtime)) < 0)
- return (0);
- if (httpPrintf(HTTP(con), "Content-Length: " CUPS_LLFMT "\r\n",
- CUPS_LLCAST filestats->st_size) < 0)
- return (0);
- if (httpPrintf(HTTP(con), "\r\n") < 0)
+ if (httpPrintf(HTTP(con), "Content-Type: text/html; charset=utf-8\r\n") < 0)
+ return (0);
+ if (httpPrintf(HTTP(con), "Content-Length: %d\r\n",
+ (int)strlen(message)) < 0)
+ return (0);
+ if (httpPrintf(HTTP(con), "\r\n") < 0)
+ return (0);
+ if (httpPrintf(HTTP(con), "%s", message) < 0)
+ return (0);
+ }
+ else if (httpPrintf(HTTP(con), "\r\n") < 0)
return (0);
- con->http.data_encoding = HTTP_ENCODE_LENGTH;
- con->http.data_remaining = filestats->st_size;
-
- if (con->http.data_remaining <= INT_MAX)
- con->http._data_remaining = con->http.data_remaining;
- else
- con->http._data_remaining = INT_MAX;
-
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdSendFile: Adding fd %d to OutputSet...", con->http.fd);
-
- FD_SET(con->http.fd, OutputSet);
+ con->http.state = HTTP_WAITING;
return (1);
}
http_status_t code, /* I - HTTP status code */
char *type) /* I - MIME type of document */
{
+ /*
+ * Send the HTTP status header...
+ */
+
if (httpPrintf(HTTP(con), "HTTP/%d.%d %d %s\r\n", con->http.version / 100,
con->http.version % 100, code, httpStatus(code)) < 0)
return (0);
if (code == HTTP_CONTINUE)
{
+ /*
+ * 100-continue doesn't send any headers...
+ */
+
if (httpPrintf(HTTP(con), "\r\n") < 0)
return (0);
else
}
}
- if (con->language != NULL)
+ if (con->language && strcmp(con->language->language, "C"))
{
if (httpPrintf(HTTP(con), "Content-Language: %s\r\n",
con->language->language) < 0)
return (0);
}
- if (type != NULL)
+ if (type)
{
if (!strcmp(type, "text/html"))
{
if (!strncasecmp(buf, "Location:", 9))
cupsdSendHeader(con, HTTP_SEE_OTHER, NULL);
else if (!strncasecmp(buf, "Status:", 7))
- cupsdSendHeader(con, atoi(buf + 7), NULL);
+ cupsdSendError(con, atoi(buf + 7));
else
+ {
cupsdSendHeader(con, HTTP_OK, NULL);
- if (con->http.version == HTTP_1_1)
- {
- con->http.data_encoding = HTTP_ENCODE_CHUNKED;
+ if (con->http.version == HTTP_1_1)
+ {
+ con->http.data_encoding = HTTP_ENCODE_CHUNKED;
- if (httpPrintf(HTTP(con), "Transfer-Encoding: chunked\r\n") < 0)
- return (0);
- }
+ if (httpPrintf(HTTP(con), "Transfer-Encoding: chunked\r\n") < 0)
+ return (0);
+ }
+ }
con->sent_header = 1;
}
return (1);
}
else if (bytes == 0)
- {
con->http.activity = time(NULL);
- return (1);
- }
}
- if (httpWrite2(HTTP(con), buf, bytes) < 0)
+ if (bytes > 0)
{
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "cupsdWriteClient: %d Write of %d bytes failed!",
- con->http.fd, bytes);
+ if (httpWrite2(HTTP(con), buf, bytes) < 0)
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "cupsdWriteClient: %d Write of %d bytes failed!",
+ con->http.fd, bytes);
- cupsdCloseClient(con);
- return (0);
- }
+ cupsdCloseClient(con);
+ return (0);
+ }
- con->bytes += bytes;
+ con->bytes += bytes;
- if (con->http.state == HTTP_WAITING)
- bytes = 0;
+ if (con->http.state == HTTP_WAITING)
+ bytes = 0;
+ }
}
if (bytes <= 0)
ptr += 7;
size = strtoll(ptr, NULL, 10);
- while (isdigit(*ptr))
- ptr ++;
- }
- else if (isalpha(*ptr))
- {
- date = httpGetDateTime(ptr);
- while (*ptr != '\0' && *ptr != ';')
- ptr ++;
- }
+ while (isdigit(*ptr))
+ ptr ++;
+ }
+ else if (isalpha(*ptr))
+ {
+ date = httpGetDateTime(ptr);
+ while (*ptr != '\0' && *ptr != ';')
+ ptr ++;
+ }
+ }
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "check_if_modified: %d sizes=" CUPS_LLFMT ","
+ CUPS_LLFMT " dates=%d,%d",
+ con->http.fd, CUPS_LLCAST size,
+ CUPS_LLCAST filestats->st_size, (int)date,
+ (int)filestats->st_mtime);
+
+ return ((size != filestats->st_size && size != 0) ||
+ (date < filestats->st_mtime && date != 0) ||
+ (size == 0 && date == 0));
+}
+
+
+/*
+ * 'encrypt_client()' - Enable encryption for the client...
+ */
+
+static int /* O - 1 on success, 0 on error */
+encrypt_client(cupsd_client_t *con) /* I - Client to encrypt */
+{
+#ifdef HAVE_LIBSSL
+ SSL_CTX *context; /* Context for encryption */
+ SSL *conn; /* Connection for encryption */
+ unsigned long error; /* Error code */
+
+
+ /*
+ * Create the SSL context and accept the connection...
+ */
+
+ context = SSL_CTX_new(SSLv23_server_method());
+
+ SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); /* Only use SSLv3 or TLS */
+ SSL_CTX_use_PrivateKey_file(context, ServerKey, SSL_FILETYPE_PEM);
+ SSL_CTX_use_certificate_file(context, ServerCertificate, SSL_FILETYPE_PEM);
+
+ conn = SSL_new(context);
+
+ SSL_set_fd(conn, con->http.fd);
+ if (SSL_accept(conn) != 1)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
+
+ while ((error = ERR_get_error()) != 0)
+ cupsdLogMessage(CUPSD_LOG_ERROR, "encrypt_client: %s",
+ ERR_error_string(error, NULL));
+
+ SSL_CTX_free(context);
+ SSL_free(conn);
+ return (0);
+ }
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG,
+ "encrypt_client: %d Connection from %s now encrypted.",
+ con->http.fd, con->http.hostname);
+
+ con->http.tls = conn;
+ return (1);
+
+#elif defined(HAVE_GNUTLS)
+ http_tls_t *conn; /* TLS session object */
+ int error; /* Error code */
+ gnutls_certificate_server_credentials *credentials;
+ /* TLS credentials */
+
+
+ /*
+ * Verify that we have a certificate...
+ */
+
+ if (access(ServerKey, 0) || access(ServerCertificate, 0))
+ {
+ /*
+ * Nope, make a self-signed certificate...
+ */
+
+ make_certificate();
+ }
+
+ /*
+ * Create the SSL object and perform the SSL handshake...
+ */
+
+ conn = (http_tls_t *)malloc(sizeof(gnutls_session));
+
+ if (conn == NULL)
+ return (0);
+
+ credentials = (gnutls_certificate_server_credentials *)
+ malloc(sizeof(gnutls_certificate_server_credentials));
+ if (credentials == NULL)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
+ cupsdLogMessage(CUPSD_LOG_ERROR, "encrypt_client: %s", strerror(errno));
+
+ free(conn);
+ return (0);
+ }
+
+ gnutls_certificate_allocate_credentials(credentials);
+ gnutls_certificate_set_x509_key_file(*credentials, ServerCertificate,
+ ServerKey, GNUTLS_X509_FMT_PEM);
+
+ gnutls_init(&(conn->session), GNUTLS_SERVER);
+ gnutls_set_default_priority(conn->session);
+ gnutls_credentials_set(conn->session, GNUTLS_CRD_CERTIFICATE, *credentials);
+ gnutls_transport_set_ptr(conn->session,
+ (gnutls_transport_ptr)((long)con->http.fd));
+
+ error = gnutls_handshake(conn->session);
+
+ if (error != GNUTLS_E_SUCCESS)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
+ cupsdLogMessage(CUPSD_LOG_ERROR, "encrypt_client: %s",
+ gnutls_strerror(error));
+
+ gnutls_deinit(conn->session);
+ gnutls_certificate_free_credentials(*credentials);
+ free(conn);
+ free(credentials);
+ return (0);
+ }
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG,
+ "encrypt_client: %d Connection from %s now encrypted.",
+ con->http.fd, con->http.hostname);
+
+ conn->credentials = credentials;
+ con->http.tls = conn;
+ return (1);
+
+#elif defined(HAVE_CDSASSL)
+ OSStatus error; /* Error info */
+ SSLContextRef conn; /* New connection */
+ CFArrayRef certificatesArray; /* Array containing certificates */
+ int allowExpired; /* Allow expired certificates? */
+ int allowAnyRoot; /* Allow any root certificate? */
+
+
+ conn = NULL;
+ error = SSLNewContext(true, &conn);
+ allowExpired = 1;
+ allowAnyRoot = 1;
+
+ certificatesArray = get_cdsa_server_certs();
+
+ if (!certificatesArray)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "EncryptClient: Could not find signing key in keychain "
+ "\"%s\"", ServerCertificate);
+ error = errSSLBadCert; /* errSSLBadConfiguration is a better choice, but not available on 10.2.x */
+ }
+
+ if (!error)
+ error = SSLSetIOFuncs(conn, _httpReadCDSA, _httpWriteCDSA);
+
+ if (!error)
+ error = SSLSetProtocolVersion(conn, kSSLProtocol3);
+
+ if (!error)
+ error = SSLSetConnection(conn, (SSLConnectionRef)con->http.fd);
+
+ if (!error)
+ error = SSLSetPeerDomainName(conn, ServerName, strlen(ServerName) + 1);
+
+ /* have to do these options before setting server certs */
+ if (!error && allowExpired)
+ error = SSLSetAllowsExpiredCerts(conn, true);
+
+ if (!error && allowAnyRoot)
+ error = SSLSetAllowsAnyRoot(conn, true);
+
+ if (!error)
+ error = SSLSetCertificate(conn, certificatesArray);
+
+ if (certificatesArray)
+ {
+ CFRelease(certificatesArray);
+ certificatesArray = NULL;
+ }
+
+ if (!error)
+ {
+ /*
+ * Perform SSL/TLS handshake
+ */
+
+ while ((error = SSLHandshake(conn)) == errSSLWouldBlock)
+ usleep(1000);
+ }
+
+ if (error)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: Unable to encrypt connection from %s!",
+ con->http.hostname);
+
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "encrypt_client: CDSA error code is %d", (int)error);
+
+ con->http.error = error;
+ con->http.status = HTTP_ERROR;
+
+ if (conn != NULL)
+ SSLDisposeContext(conn);
+
+ return (0);
}
- cupsdLogMessage(CUPSD_LOG_DEBUG2,
- "check_if_modified: %d sizes=" CUPS_LLFMT ","
- CUPS_LLFMT " dates=%d,%d",
- con->http.fd, CUPS_LLCAST size,
- CUPS_LLCAST filestats->st_size, (int)date,
- (int)filestats->st_mtime);
+ cupsdLogMessage(CUPSD_LOG_DEBUG,
+ "encrypt_client: %d Connection from %s now encrypted.",
+ con->http.fd, con->http.hostname);
- return ((size != filestats->st_size && size != 0) ||
- (date < filestats->st_mtime && date != 0) ||
- (size == 0 && date == 0));
+ con->http.tls = conn;
+ return (1);
+
+#else
+ return (0);
+#endif /* HAVE_LIBSSL */
}
}
+/*
+ * 'is_cgi()' - Is the resource a CGI script/program?
+ */
+
+static int /* O - 1 = CGI, 0 = file */
+is_cgi(cupsd_client_t *con, /* I - Client connection */
+ const char *filename, /* I - Real filename */
+ struct stat *filestats, /* I - File information */
+ mime_type_t *type) /* I - MIME type */
+{
+ const char *options; /* Options on URL */
+
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi(con=%p, filename=\"%s\", filestats=%p, type=%s/%s)\n",
+ con, filename, filestats, type ? type->super : "unknown",
+ type ? type->type : "unknown");
+
+ /*
+ * Get the options, if any...
+ */
+
+ if ((options = strchr(con->uri, '?')) != NULL)
+ options ++;
+
+ /*
+ * Check for known types...
+ */
+
+ if (!type || strcasecmp(type->super, "application"))
+ {
+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "is_cgi: Returning 0...");
+ return (0);
+ }
+
+ if (!strcasecmp(type->type, "x-httpd-cgi") &&
+ (filestats->st_mode & 0111))
+ {
+ /*
+ * "application/x-httpd-cgi" is a CGI script.
+ */
+
+ cupsdSetString(&con->command, filename);
+
+ filename = strrchr(filename, '/') + 1; /* Filename always absolute */
+
+ cupsdSetString(&con->options, options);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
+
+ return (1);
+ }
+#ifdef HAVE_JAVA
+ else if (!strcasecmp(type->type, "x-httpd-java"))
+ {
+ /*
+ * "application/x-httpd-java" is a Java servlet.
+ */
+
+ cupsdSetString(&con->command, CUPS_JAVA);
+
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
+
+ return (1);
+ }
+#endif /* HAVE_JAVA */
+#ifdef HAVE_PERL
+ else if (!strcasecmp(type->type, "x-httpd-perl"))
+ {
+ /*
+ * "application/x-httpd-perl" is a Perl page.
+ */
+
+ cupsdSetString(&con->command, CUPS_PERL);
+
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
+
+ return (1);
+ }
+#endif /* HAVE_PERL */
+#ifdef HAVE_PHP
+ else if (!strcasecmp(type->type, "x-httpd-php"))
+ {
+ /*
+ * "application/x-httpd-php" is a PHP page.
+ */
+
+ cupsdSetString(&con->command, CUPS_PHP);
+
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
+
+ return (1);
+ }
+#endif /* HAVE_PHP */
+#ifdef HAVE_PYTHON
+ else if (!strcasecmp(type->type, "x-httpd-python"))
+ {
+ /*
+ * "application/x-httpd-python" is a Python page.
+ */
+
+ cupsdSetString(&con->command, CUPS_PYTHON);
+
+ if (options)
+ cupsdSetStringf(&con->options, "%s %s", filename, options);
+ else
+ cupsdSetString(&con->options, filename);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "is_cgi: Returning 1 with command=\"%s\" and options=\"%s\"",
+ con->command, con->options);
+
+ return (1);
+ }
+#endif /* HAVE_PYTHON */
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "is_cgi: Returning 0...");
+
+ return (0);
+}
+
+
/*
* 'is_path_absolute()' - Is a path absolute and free of relative elements (i.e. "..").
*/
}
+#ifdef HAVE_GNUTLS
+/*
+ * 'make_certificate()' - Make a self-signed SSL/TLS certificate.
+ */
+
+static void
+make_certificate(void)
+{
+ gnutls_x509_crt crt; /* Self-signed certificate */
+ gnutls_x509_privkey key; /* Encryption key */
+ cups_lang_t *language; /* Default language info */
+ cups_file_t *fp; /* Key/cert file */
+ unsigned char buffer[8192]; /* Buffer for x509 data */
+ size_t bytes; /* Number of bytes of data */
+ unsigned char serial[4]; /* Serial number buffer */
+ time_t curtime; /* Current time */
+ int result; /* Result of GNU TLS calls */
+
+
+ /*
+ * Create the encryption key...
+ */
+
+ cupsdLogMessage(CUPSD_LOG_INFO, "Generating server key...");
+
+ gnutls_x509_privkey_init(&key);
+ gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 2048, 0);
+
+ /*
+ * Save it...
+ */
+
+ bytes = sizeof(buffer);
+
+ if ((result = gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM,
+ buffer, &bytes)) < 0)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to export server key - %s",
+ gnutls_strerror(result));
+ gnutls_x509_privkey_deinit(key);
+ return;
+ }
+ else if ((fp = cupsFileOpen(ServerKey, "w")) != NULL)
+ {
+ cupsFileWrite(fp, (char *)buffer, bytes);
+ cupsFileClose(fp);
+
+ cupsdLogMessage(CUPSD_LOG_INFO, "Created server key file \"%s\"...",
+ ServerKey);
+ }
+ else
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to create server key file \"%s\" - %s",
+ ServerKey, strerror(errno));
+ gnutls_x509_privkey_deinit(key);
+ return;
+ }
+
+ /*
+ * Create the self-signed certificate...
+ */
+
+ cupsdLogMessage(CUPSD_LOG_INFO, "Generating self-signed certificate...");
+
+ language = cupsLangDefault();
+ curtime = time(NULL);
+ serial[0] = curtime >> 24;
+ serial[1] = curtime >> 16;
+ serial[2] = curtime >> 8;
+ serial[3] = curtime;
+
+ gnutls_x509_crt_init(&crt);
+ if (strlen(language->language) == 5)
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
+ language->language + 3, 2);
+ else
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
+ "US", 2);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0,
+ ServerName, strlen(ServerName));
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATION_NAME, 0,
+ ServerName, strlen(ServerName));
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME,
+ 0, "Unknown", 7);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0,
+ "Unknown", 7);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_LOCALITY_NAME, 0,
+ "Unknown", 7);
+ gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_PKCS9_EMAIL, 0,
+ ServerAdmin, strlen(ServerAdmin));
+ gnutls_x509_crt_set_key(crt, key);
+ gnutls_x509_crt_set_serial(crt, serial, sizeof(serial));
+ gnutls_x509_crt_set_activation_time(crt, curtime);
+ gnutls_x509_crt_set_expiration_time(crt, curtime + 10 * 365 * 86400);
+ gnutls_x509_crt_set_ca_status(crt, 0);
+ gnutls_x509_crt_set_subject_alternative_name(crt, GNUTLS_SAN_DNSNAME,
+ ServerName);
+ gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
+ gnutls_x509_crt_set_key_usage(crt, GNUTLS_KEY_KEY_ENCIPHERMENT);
+ gnutls_x509_crt_set_version(crt, 3);
+
+ bytes = sizeof(buffer);
+ if (gnutls_x509_crt_get_key_id(crt, 0, buffer, &bytes) >= 0)
+ gnutls_x509_crt_set_subject_key_id(crt, buffer, bytes);
+
+ gnutls_x509_crt_sign(crt, crt, key);
+
+ /*
+ * Save it...
+ */
+
+ bytes = sizeof(buffer);
+ if ((result = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM,
+ buffer, &bytes)) < 0)
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to export server certificate - %s",
+ gnutls_strerror(result));
+ else if ((fp = cupsFileOpen(ServerCertificate, "w")) != NULL)
+ {
+ cupsFileWrite(fp, (char *)buffer, bytes);
+ cupsFileClose(fp);
+
+ cupsdLogMessage(CUPSD_LOG_INFO,
+ "Created 10-year server certificate file \"%s\"...",
+ ServerCertificate);
+ }
+ else
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to create server certificate file \"%s\" - %s",
+ ServerCertificate, strerror(errno));
+
+ /*
+ * Cleanup...
+ */
+
+ gnutls_x509_crt_deinit(crt);
+ gnutls_x509_privkey_deinit(key);
+}
+#endif /* HAVE_GNUTLS */
+
+
/*
* 'pipe_command()' - Pipe the output of a command to the remote client.
*/
}
else
{
- sprintf(content_length, "CONTENT_LENGTH=" CUPS_LLFMT, con->bytes);
+ sprintf(content_length, "CONTENT_LENGTH=" CUPS_LLFMT,
+ CUPS_LLCAST con->bytes);
snprintf(content_type, sizeof(content_type), "CONTENT_TYPE=%s",
con->http.fields[HTTP_FIELD_CONTENT_TYPE]);
/*
- * End of "$Id: client.c 5200 2006-02-28 00:10:32Z mike $".
+ * 'send_file()' - Send a file via HTTP.
+ */
+
+static int /* O - 0 on failure, 1 on success */
+send_file(cupsd_client_t *con, /* I - Client connection */
+ http_status_t code, /* I - HTTP status */
+ char *filename, /* I - Filename */
+ char *type, /* I - File type */
+ struct stat *filestats) /* O - File information */
+{
+ con->file = open(filename, O_RDONLY);
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG, "send_file: %d file=%d", con->http.fd,
+ con->file);
+
+ if (con->file < 0)
+ return (0);
+
+ fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
+
+ con->pipe_pid = 0;
+
+ if (!cupsdSendHeader(con, code, type))
+ return (0);
+
+ if (httpPrintf(HTTP(con), "Last-Modified: %s\r\n",
+ httpGetDateString(filestats->st_mtime)) < 0)
+ return (0);
+ if (httpPrintf(HTTP(con), "Content-Length: " CUPS_LLFMT "\r\n",
+ CUPS_LLCAST filestats->st_size) < 0)
+ return (0);
+ if (httpPrintf(HTTP(con), "\r\n") < 0)
+ return (0);
+
+ con->http.data_encoding = HTTP_ENCODE_LENGTH;
+ con->http.data_remaining = filestats->st_size;
+
+ if (con->http.data_remaining <= INT_MAX)
+ con->http._data_remaining = con->http.data_remaining;
+ else
+ con->http._data_remaining = INT_MAX;
+
+ cupsdLogMessage(CUPSD_LOG_DEBUG2,
+ "send_file: Adding fd %d to OutputSet...", con->http.fd);
+
+ FD_SET(con->http.fd, OutputSet);
+
+ return (1);
+}
+
+
+/*
+ * End of "$Id: client.c 5305 2006-03-18 03:05:12Z mike $".
*/
projects / thirdparty / cups.git / blobdiff