| 3656 | */ |
| 3657 | |
| 3658 | static int /* O - 1 if valid, 0 if not */ |
| 3659 | valid_host(cupsd_client_t *con) /* I - Client connection */ |
| 3660 | { |
| 3661 | cupsd_alias_t *a; /* Current alias */ |
| 3662 | cupsd_netif_t *netif; /* Current network interface */ |
| 3663 | const char *end; /* End character */ |
| 3664 | char *ptr; /* Pointer into host value */ |
| 3665 | |
| 3666 | |
| 3667 | /* |
| 3668 | * Copy the Host: header for later use... |
| 3669 | */ |
| 3670 | |
| 3671 | strlcpy(con->clientname, httpGetField(con->http, HTTP_FIELD_HOST), |
| 3672 | sizeof(con->clientname)); |
| 3673 | if ((ptr = strrchr(con->clientname, ':')) != NULL && !strchr(ptr, ']')) |
| 3674 | { |
| 3675 | *ptr++ = '\0'; |
| 3676 | con->clientport = atoi(ptr); |
| 3677 | } |
| 3678 | else |
| 3679 | con->clientport = con->serverport; |
| 3680 | |
| 3681 | /* |
| 3682 | * Then validate... |
| 3683 | */ |
| 3684 | |
| 3685 | if (httpAddrLocalhost(httpGetAddress(con->http))) |
| 3686 | { |
| 3687 | /* |
| 3688 | * Only allow "localhost" or the equivalent IPv4 or IPv6 numerical |
| 3689 | * addresses when accessing CUPS via the loopback interface... |
| 3690 | */ |
| 3691 | |
| 3692 | return (!_cups_strcasecmp(con->clientname, "localhost") || |
| 3693 | !_cups_strcasecmp(con->clientname, "localhost.") || |
| 3694 | !strcmp(con->clientname, "127.0.0.1") || |
| 3695 | !strcmp(con->clientname, "[::1]")); |
| 3696 | } |
| 3697 | |
| 3698 | #ifdef HAVE_DNSSD |
| 3699 | /* |
| 3700 | * Check if the hostname is something.local (Bonjour); if so, allow it. |
| 3701 | */ |
| 3702 | |
| 3703 | if ((end = strrchr(con->clientname, '.')) != NULL && end > con->clientname && |
| 3704 | !end[1]) |
| 3705 | { |
| 3706 | /* |
| 3707 | * "." on end, work back to second-to-last "."... |
| 3708 | */ |
| 3709 | |
| 3710 | for (end --; end > con->clientname && *end != '.'; end --); |
| 3711 | } |
| 3712 | |
| 3713 | if (end && (!_cups_strcasecmp(end, ".local") || |
| 3714 | !_cups_strcasecmp(end, ".local."))) |
| 3715 | return (1); |
no test coverage detected