/* bijou HTTP server for plan 9 by sean caron (scaron@umich.edu) */ #include "main.h" /* return codes:  *  * 0 = success  * 1 = http 500 internal server error  * 2 = http 401 authorization required*/ int check_authorization(char *path, char *rpath, struct configuration cfg, struct request req, struct htpasswd *htpass) {    Dir *td;	    char *u, *p, *temp;    int q, j, r;    uchar digest[SHA1dlen];    DigestState *s;    char up[41];     temp = malloc(sizeof(char)*(strlen(path)+1));     if (temp == 0) {        exits("MALLOC");    }     strcpy(temp, path);     if (temp[strlen(temp)-1] != '/') {        for (j = strlen(temp); j > 0; j--) {            if (temp[j] == '/') {                temp[j+1] = '\0';                break;            }        }    }     temp = realloc(temp, sizeof(char)*(strlen(temp)+strlen(cfg.htpassfile)+2));     if (temp == 0) {        exits("REALLOC");    }     strcat(temp, cfg.htpassfile);     while (1) {        // try the path on hand        td = dirstat(temp);         // didnt find htpasswd file, chop the path and keep looking        if (td == nil) {            for (j = strlen(temp); j >= 0; j--) {                if (temp[j] == '/') {                    temp[j] = '\0';                    break;                }            }             // if chopping off the lash slash leaves us with rpath then break out of the loop            if (strcmp(temp, rpath) == 0) {                break;            }             for (j = strlen(temp); j >= 0; j--) {                if (temp[j] == '/') {                    temp[j+1] = '\0';                    break;                }            }             strcat(temp, cfg.htpassfile);        }         // found a htpasswd file, break out of this htpasswd locator loop        else {            break;        }    }     // at this point, we have in temp either equal to rpath, or a path to a htpasswd file if one exists.     // so basically, check to see: if temp is not rpath (contains a path to a htpasswd file)    if (strcmp(temp, rpath) != 0) {        // then read in the htpasswd file        r = read_htpasswd_file(temp, htpass);         // if the function returned with an error code, give the client a HTTP 500 internal server error        if (r != 0) {            free(temp);            return 1;        }         // if we were ok, then:        // split req.authorization into username and password (it should already be decoded)        // username and password are colon delimited         r = 0;         // maybe we should make a copy of req.authorization before strtok'ing it...        u = strtok(req.authorization, ":");         // this sort of error handling is really crude; this should get refactored later.        if (u == 0) {            free(temp);            return 2;        }         p = strtok(0, ":");         if (p == 0) {            free(temp);            return 2;        }         // compare user name and password with entries read in from htpasswd file         r = 0;         for (q = 0; q < htpass->n_users; q++) {            if (strcmp( u, *(htpass->user+q)) == 0) {                s = sha1( (uchar *)p, strlen(p), digest, nil);                 sprintf(up, "%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x%02.x", digest[0], digest[1], digest[2], digest[3], digest[4], digest[5], digest[6], digest[7], digest[8], digest[9], digest[10], digest[11], digest[12], digest[13], digest[14], digest[15], digest[16], digest[17], digest[18], digest[19] );                 if (strcmp(up, *(htpass->pass+q)) == 0) {                    r = 1;                    break;                }            }        }         // if there is no match, give http 401 authorization required error        if (r != 1) {            free(temp);            return 2;        }         // otherwise, success; just pass through, we will return 0 and serve up the page    }     free(temp);     return 0;}