/*  * This file is part of the UCB release of Plan 9. It is subject to the license * terms in the LICENSE file found in the top-level directory of this * distribution and at http://akaros.cs.berkeley.edu/files/Plan9License. No * part of the UCB release of Plan 9, including this file, may be copied, * modified, propagated, or distributed except according to the terms contained * in the LICENSE file. */ #include <u.h>#include <libc.h>#include <auth.h>#include "httpd.h"#include "httpsrv.h" static char*	readfile(char*); /* * these should be done better; see the response codes in /lib/rfc/rfc2616 for * more info on what should be included. */#define UNAUTHED	"You are not authorized to see this area.\n" /* * check for authorization for some parts of the server tree. * the user name supplied with the authorization request is ignored; * instead, we authenticate as the realm's user. * * authorization should be done before opening any files so that * unauthorized users don't get to validate file names. * * returns 1 if authorized, 0 if unauthorized, -1 for io failure. */intauthorize(HConnect *c, char *file){	char *p, *p0;	Hio *hout;	char *buf;	int i, n;	char *t[257]; 	p0 = halloc(c, strlen(file)+STRLEN("/.httplogin")+1);	strcpy(p0, file);	for(;;){		p = strrchr(p0, '/');		if(p == nil)			return hfail(c, HInternal);		if(*(p+1) != 0)			break; 		/* ignore trailing '/'s */		*p = 0;	}	strcpy(p, "/.httplogin"); 	buf = readfile(p0);	if(buf == nil){		return 1;	}	n = tokenize(buf, t, nelem(t));		if(c->head.authuser != nil && c->head.authpass != 0){		for(i = 1; i+1 < n; i += 2){			if(strcmp(t[i], c->head.authuser) == 0			&& strcmp(t[i+1], c->head.authpass) == 0){				free(buf);				return 1;			}		}	} 	hout = &c->hout;	hprint(hout, "%s 401 Unauthorized\r\n", hversion);	hprint(hout, "Server: Plan9\r\n");	hprint(hout, "Date: %D\r\n", time(nil));	hprint(hout, "WWW-Authenticate: Basic realm=\"%s\"\r\n", t[0]);	hprint(hout, "Content-Type: text/html\r\n");	hprint(hout, "Content-Length: %d\r\n", STRLEN(UNAUTHED));	if(c->head.closeit)		hprint(hout, "Connection: close\r\n");	else if(!http11(c))		hprint(hout, "Connection: Keep-Alive\r\n");	hprint(hout, "\r\n");	if(strcmp(c->req.meth, "HEAD") != 0)		hprint(hout, "%s", UNAUTHED);	writelog(c, "Reply: 401 Unauthorized\n");	free(buf);	return hflush(hout);} static char*readfile(char *file){	Dir *d;	int fd;	char *buf;	int n, len; 	fd = open(file, OREAD);	if(fd < 0)		return nil;	d = dirfstat(fd);	if(d == nil){		/* shouldn't happen */		close(fd);		return nil;	}	len = d->length;	free(d); 	buf = malloc(len+1);	if(buf == 0){		close(fd);		return nil;	} 	n = readn(fd, buf, len);	close(fd);	if(n <= 0){		free(buf);		return nil;	}	buf[n] = '\0';	return buf;}