529 lines
18 KiB
C++
529 lines
18 KiB
C++
|
/*
|
||
|
|
*
|
||
|
|
* @APPLE_LICENSE_HEADER_START@
|
||
|
|
*
|
||
|
|
* Copyright (c) 1999-2008 Apple Inc. All Rights Reserved.
|
||
|
|
*
|
||
|
|
* This file contains Original Code and/or Modifications of Original Code
|
||
|
|
* as defined in and that are subject to the Apple Public Source License
|
||
|
|
* Version 2.0 (the 'License'). You may not use this file except in
|
||
|
|
* compliance with the License. Please obtain a copy of the License at
|
||
|
|
* http://www.opensource.apple.com/apsl/ and read it before using this
|
||
|
|
* file.
|
||
|
|
*
|
||
|
|
* The Original Code and all software distributed under the License are
|
||
|
|
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
|
||
|
|
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
|
||
|
|
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
|
||
|
|
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
|
||
|
|
* Please see the License for the specific language governing rights and
|
||
|
|
* limitations under the License.
|
||
|
|
*
|
||
|
|
* @APPLE_LICENSE_HEADER_END@
|
||
|
|
*
|
||
|
|
*/
|
||
|
|
/*
|
||
|
|
File: QTSSODSAuthModule.cpp
|
||
|
|
|
||
|
|
Contains: Implementation of QTSSDSAuthModule, a modified version of the AuthenticateRequestModule
|
||
|
|
is sample code.
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include "QTSSDSAuthModule.h"
|
||
|
|
|
||
|
|
|
||
|
|
#include "../../defaultPaths.h"
|
||
|
|
#include "DSAccessChecker.h"
|
||
|
|
#include "StrPtrLen.h"
|
||
|
|
#include "QTSSModuleUtils.h"
|
||
|
|
#include "OSArrayObjectDeleter.h"
|
||
|
|
#include "SafeStdLib.h"
|
||
|
|
#include "QTSSMemoryDeleter.h"
|
||
|
|
#include "QTSS_Private.h"
|
||
|
|
#include "OS.h"
|
||
|
|
|
||
|
|
//#define SACL 1
|
||
|
|
#if OSX_SACL
|
||
|
|
extern "C"
|
||
|
|
{
|
||
|
|
#include <membershipPriv.h>
|
||
|
|
}
|
||
|
|
#include <membership.h>
|
||
|
|
#include <errno.h>
|
||
|
|
#endif
|
||
|
|
|
||
|
|
// ATTRIBUTES
|
||
|
|
|
||
|
|
// STATIC DATA
|
||
|
|
|
||
|
|
const UInt32 kBuffLen = 512;
|
||
|
|
#define MODPREFIX_ "modDSAuth_"
|
||
|
|
#define AUTHDEBUG 0
|
||
|
|
#define debug_printf if (AUTHDEBUG) qtss_printf
|
||
|
|
|
||
|
|
|
||
|
|
static QTSS_ModulePrefsObject sPrefs = NULL;
|
||
|
|
static QTSS_PrefsObject sServerPrefs = NULL;
|
||
|
|
static OSMutex* sAuthMutex = NULL;
|
||
|
|
static Bool16 sDefaultAuthenticationEnabled = true;
|
||
|
|
static Bool16 sAuthenticationEnabled = true;
|
||
|
|
static char* sDefaultAccessFileName = "qtaccess";
|
||
|
|
static char* sAccessFileName = NULL;
|
||
|
|
static Bool16 sAllowGuestDefaultEnabled = true;
|
||
|
|
static Bool16 sDefaultGuestEnabled = true;
|
||
|
|
|
||
|
|
|
||
|
|
// FUNCTION PROTOTYPES
|
||
|
|
|
||
|
|
static QTSS_Error QTSSDSAuthModuleDispatch(QTSS_Role inRole, QTSS_RoleParamPtr inParams);
|
||
|
|
static QTSS_Error Register();
|
||
|
|
static QTSS_Error Initialize(QTSS_Initialize_Params* inParams);
|
||
|
|
static QTSS_Error Shutdown();
|
||
|
|
static QTSS_Error RereadPrefs();
|
||
|
|
static QTSS_Error AuthenticateRTSPRequest(QTSS_RTSPAuth_Params* inParams);
|
||
|
|
static QTSS_Error Authorize(QTSS_StandardRTSP_Params* inParams);
|
||
|
|
static Bool16 AuthenticateRequest(QTSS_StandardRTSP_Params* inParams, const char* pathBuff, const char* movieRootDir, StrPtrLen* ioRealmName, Bool16* foundUserPtr);
|
||
|
|
|
||
|
|
|
||
|
|
static int check_sacl(const char *inUser);
|
||
|
|
#define kSACLNotAuthorized 0
|
||
|
|
#define kSACLAuthorized 1
|
||
|
|
#define kSACLUnknownUser 2
|
||
|
|
#define kSACLAnyUser 3
|
||
|
|
|
||
|
|
// FUNCTION IMPLEMENTATIONS
|
||
|
|
|
||
|
|
|
||
|
|
QTSS_Error QTSSDSAuthModule_Main(void* inPrivateArgs)
|
||
|
|
{
|
||
|
|
printf("QTSSDSAuthModule_Main\n");
|
||
|
|
#if OSX_SACL
|
||
|
|
printf("QTSSDSAuthModule_Main OSX_SACL\n");
|
||
|
|
#endif
|
||
|
|
#if OSX_OD_API
|
||
|
|
printf("QTSSDSAuthModule_Main OSX_OD_API\n");
|
||
|
|
#endif
|
||
|
|
|
||
|
|
return _stublibrary_main(inPrivateArgs, QTSSDSAuthModuleDispatch);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
QTSS_Error QTSSDSAuthModuleDispatch(QTSS_Role inRole, QTSS_RoleParamPtr inParams)
|
||
|
|
{
|
||
|
|
switch (inRole)
|
||
|
|
{
|
||
|
|
case QTSS_Register_Role:
|
||
|
|
return Register();
|
||
|
|
case QTSS_Initialize_Role:
|
||
|
|
return Initialize(&inParams->initParams);
|
||
|
|
case QTSS_RereadPrefs_Role:
|
||
|
|
return RereadPrefs();
|
||
|
|
case QTSS_RTSPAuthenticate_Role:
|
||
|
|
if (sAuthenticationEnabled)
|
||
|
|
return AuthenticateRTSPRequest(&inParams->rtspAthnParams);
|
||
|
|
case QTSS_RTSPAuthorize_Role:
|
||
|
|
if (sAuthenticationEnabled)
|
||
|
|
return Authorize(&inParams->rtspRequestParams);
|
||
|
|
case QTSS_Shutdown_Role:
|
||
|
|
return Shutdown();
|
||
|
|
}
|
||
|
|
return QTSS_NoErr;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
QTSS_Error Register()
|
||
|
|
{
|
||
|
|
// Do role & attribute setup
|
||
|
|
(void)QTSS_AddRole(QTSS_Initialize_Role);
|
||
|
|
(void)QTSS_AddRole(QTSS_RereadPrefs_Role);
|
||
|
|
(void)QTSS_AddRole(QTSS_RTSPAuthenticate_Role);
|
||
|
|
(void)QTSS_AddRole(QTSS_RTSPAuthorize_Role);
|
||
|
|
|
||
|
|
return QTSS_NoErr;
|
||
|
|
}
|
||
|
|
|
||
|
|
QTSS_Error Initialize(QTSS_Initialize_Params* inParams)
|
||
|
|
{
|
||
|
|
// Setup module utils
|
||
|
|
QTSSModuleUtils::Initialize(inParams->inMessages, inParams->inServer, inParams->inErrorLogStream);
|
||
|
|
sPrefs = QTSSModuleUtils::GetModulePrefsObject(inParams->inModule);
|
||
|
|
sServerPrefs = inParams->inPrefs;
|
||
|
|
sAuthMutex = new OSMutex();
|
||
|
|
|
||
|
|
RereadPrefs();
|
||
|
|
return QTSS_NoErr;
|
||
|
|
}
|
||
|
|
|
||
|
|
QTSS_Error Shutdown()
|
||
|
|
{
|
||
|
|
return QTSS_NoErr;
|
||
|
|
}
|
||
|
|
|
||
|
|
char* GetCheckedFileName()
|
||
|
|
{
|
||
|
|
char *result = NULL;
|
||
|
|
static char *badChars = "/'\"";
|
||
|
|
char theBadCharMessage[] = "' '";
|
||
|
|
char *theBadChar = NULL;
|
||
|
|
result = QTSSModuleUtils::GetStringAttribute(sPrefs, MODPREFIX_"dsaccessfilename", sDefaultAccessFileName);
|
||
|
|
StrPtrLen searchStr(result);
|
||
|
|
|
||
|
|
theBadChar = strpbrk(searchStr.Ptr, badChars);
|
||
|
|
if ( theBadChar!= NULL)
|
||
|
|
{
|
||
|
|
theBadCharMessage[1] = theBadChar[0];
|
||
|
|
QTSSModuleUtils::LogErrorStr(qtssWarningVerbosity,MODPREFIX_"found invalid DS access file name in prefs");
|
||
|
|
|
||
|
|
delete[] result;
|
||
|
|
result = new char[::strlen(sDefaultAccessFileName) + 2];
|
||
|
|
::strcpy(result, sDefaultAccessFileName);
|
||
|
|
}
|
||
|
|
return result;
|
||
|
|
}
|
||
|
|
|
||
|
|
QTSS_Error RereadPrefs()
|
||
|
|
{
|
||
|
|
OSMutexLocker locker(sAuthMutex);
|
||
|
|
QTSSModuleUtils::GetAttribute(sPrefs, MODPREFIX_"enabled", qtssAttrDataTypeBool16,
|
||
|
|
&sAuthenticationEnabled, &sDefaultAuthenticationEnabled, sizeof(sAuthenticationEnabled));
|
||
|
|
|
||
|
|
QTSSModuleUtils::GetAttribute(sServerPrefs,"enable_allow_guest_default", qtssAttrDataTypeBool16,
|
||
|
|
&sAllowGuestDefaultEnabled,(void *)&sDefaultGuestEnabled, sizeof(sAllowGuestDefaultEnabled));
|
||
|
|
|
||
|
|
delete [] sAccessFileName;
|
||
|
|
sAccessFileName = GetCheckedFileName();
|
||
|
|
return QTSS_NoErr;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
Bool16 AuthenticateRequest(QTSS_StandardRTSP_Params* inParams,
|
||
|
|
const char* pathBuff,
|
||
|
|
const char* movieRootDir,
|
||
|
|
StrPtrLen* ioRealmName,
|
||
|
|
Bool16* foundUserPtr)
|
||
|
|
{
|
||
|
|
if (foundUserPtr)
|
||
|
|
*foundUserPtr = false;
|
||
|
|
|
||
|
|
if (ioRealmName) //Set Value to Empty for now use whatever is set by access file or the default
|
||
|
|
{
|
||
|
|
ioRealmName->Ptr[0] = '\0';
|
||
|
|
ioRealmName->Len = 0;
|
||
|
|
}
|
||
|
|
QTSS_Error theErr = QTSS_NoErr;
|
||
|
|
|
||
|
|
char passwordBuff[kBuffLen];
|
||
|
|
StrPtrLen passwordStr(passwordBuff, kBuffLen -1);
|
||
|
|
|
||
|
|
char nameBuff[kBuffLen];
|
||
|
|
StrPtrLen nameStr(nameBuff, kBuffLen -1);
|
||
|
|
|
||
|
|
theErr = QTSS_GetValue (inParams->inRTSPRequest,qtssRTSPReqUserName,0, (void *) nameStr.Ptr, &nameStr.Len);
|
||
|
|
if ( (QTSS_NoErr != theErr) || (nameStr.Len >= kBuffLen) )
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRequest() Username Error - %"_S32BITARG_"\n", theErr);
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
theErr = QTSS_GetValue (inParams->inRTSPRequest,qtssRTSPReqUserPassword,0, (void *) passwordStr.Ptr, &passwordStr.Len);
|
||
|
|
if ( (QTSS_NoErr != theErr) || (passwordStr.Len >= kBuffLen) )
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRequest() Password Error - %"_S32BITARG_"\n", theErr);
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
nameBuff[nameStr.Len] = '\0';
|
||
|
|
passwordBuff[passwordStr.Len] = '\0';
|
||
|
|
|
||
|
|
//
|
||
|
|
// Use the name and password to check access
|
||
|
|
DSAccessChecker accessChecker;
|
||
|
|
if ( !accessChecker.CheckPassword( nameBuff, passwordBuff) )
|
||
|
|
{
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (foundUserPtr)
|
||
|
|
*foundUserPtr = true;
|
||
|
|
|
||
|
|
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
QTSS_Error AuthenticateRTSPRequest(QTSS_RTSPAuth_Params* inParams)
|
||
|
|
{
|
||
|
|
OSMutexLocker locker(sAuthMutex);
|
||
|
|
|
||
|
|
QTSS_RTSPRequestObject theRTSPRequest = inParams->inRTSPRequest;
|
||
|
|
QTSS_AuthScheme authScheme = qtssAuthNone;
|
||
|
|
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest start\n");
|
||
|
|
|
||
|
|
if ( (NULL == inParams) || (NULL == inParams->inRTSPRequest) )
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest inParams NULL\n");
|
||
|
|
return QTSS_RequestFailed;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
// Get the user profile object from the request object
|
||
|
|
QTSS_UserProfileObject theUserProfile = NULL;
|
||
|
|
UInt32 len = sizeof(QTSS_UserProfileObject);
|
||
|
|
QTSS_Error theErr = QTSS_GetValue(theRTSPRequest, qtssRTSPReqUserProfile, 0, (void*)&theUserProfile, &len);
|
||
|
|
Assert(len == sizeof(QTSS_UserProfileObject));
|
||
|
|
if (theErr != QTSS_NoErr)
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - username error is %"_S32BITARG_"\n", theErr);
|
||
|
|
return theErr;
|
||
|
|
}
|
||
|
|
char* nameBuff = NULL;
|
||
|
|
theErr = QTSS_GetValueAsString(theUserProfile, qtssUserName, 0, &nameBuff);
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - username is %s\n", nameBuff);
|
||
|
|
OSCharArrayDeleter usernameBufDeleter(nameBuff);
|
||
|
|
if (theErr != QTSS_NoErr)
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - theUserProfile nameBuff error is %"_S32BITARG_"\n", theErr);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
len = sizeof(authScheme);
|
||
|
|
theErr = QTSS_GetValue(theRTSPRequest, qtssRTSPReqAuthScheme, 0, (void*)&authScheme, &len);
|
||
|
|
|
||
|
|
if (theErr != QTSS_NoErr)
|
||
|
|
return theErr;
|
||
|
|
|
||
|
|
DSAccessChecker accessChecker;
|
||
|
|
Bool16 allowed = true;
|
||
|
|
Bool16 foundUser = true;
|
||
|
|
Bool16 authHandled = true;
|
||
|
|
|
||
|
|
if ( authScheme == qtssAuthDigest)
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - authScheme = qtssAuthDigest\n");
|
||
|
|
|
||
|
|
char* challengeBuff = NULL;
|
||
|
|
(void) QTSS_GetValueAsString(theRTSPRequest, qtssRTSPReqDigestChallenge, 0, &challengeBuff);
|
||
|
|
OSCharArrayDeleter challengeDeleter(challengeBuff);
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - Server Challenge =%s\n",challengeBuff);
|
||
|
|
|
||
|
|
char* responseBuff = NULL;
|
||
|
|
(void) QTSS_GetValueAsString(theRTSPRequest, qtssRTSPReqDigestResponse, 0, &responseBuff);
|
||
|
|
OSCharArrayDeleter responseDeleter(responseBuff);
|
||
|
|
|
||
|
|
char* methodBuff = NULL;
|
||
|
|
(void) QTSS_GetValueAsString(theRTSPRequest, qtssRTSPReqMethodStr, 0, &methodBuff);
|
||
|
|
OSCharArrayDeleter methodDeleter(methodBuff);
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - Server Method =%s\n",methodBuff);
|
||
|
|
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - username is %s challenge=%s response=%s method=%s\n", nameBuff, challengeBuff, responseBuff, methodBuff);
|
||
|
|
if ( false == accessChecker.CheckDigest(nameBuff, challengeBuff, responseBuff, methodBuff) )
|
||
|
|
{ debug_printf("QTSSDSAuthModule CheckDigest returned false\n");
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{ debug_printf("QTSSDSAuthModule CheckDigest returned true\n");
|
||
|
|
(void) QTSSModuleUtils::AuthorizeRequest(theRTSPRequest,&allowed,&foundUser,&authHandled);
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|
||
|
|
if ( authScheme == qtssAuthBasic)
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - authScheme = qtssAuthBasic\n");
|
||
|
|
|
||
|
|
|
||
|
|
char passwordBuff[kBuffLen];
|
||
|
|
StrPtrLen passwordStr(passwordBuff, kBuffLen -1);
|
||
|
|
|
||
|
|
char nameBuff[kBuffLen];
|
||
|
|
StrPtrLen nameStr(nameBuff, kBuffLen -1);
|
||
|
|
|
||
|
|
theErr = QTSS_GetValue (inParams->inRTSPRequest,qtssRTSPReqUserName,0, (void *) nameStr.Ptr, &nameStr.Len);
|
||
|
|
if ( (QTSS_NoErr != theErr) || (nameStr.Len >= kBuffLen) )
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRequest() Username Error - %"_S32BITARG_"\n", theErr);
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
theErr = QTSS_GetValue (inParams->inRTSPRequest,qtssRTSPReqUserPassword,0, (void *) passwordStr.Ptr, &passwordStr.Len);
|
||
|
|
if ( (QTSS_NoErr != theErr) || (passwordStr.Len >= kBuffLen) )
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRequest() Password Error - %"_S32BITARG_"\n", theErr);
|
||
|
|
}
|
||
|
|
nameBuff[nameStr.Len] = '\0';
|
||
|
|
passwordBuff[passwordStr.Len] = '\0';
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - username is %s\n", nameBuff);
|
||
|
|
debug_printf("QTSSDSAuthModule:AuthenticateRTSPRequest - password is %s\n", passwordBuff);
|
||
|
|
if ( !accessChecker.CheckPassword(nameBuff, passwordBuff) )
|
||
|
|
{ debug_printf("QTSSDSAuthModule CheckPassword returned false\n");
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule CheckPassword returned true\n");
|
||
|
|
(void) QTSSModuleUtils::AuthorizeRequest(theRTSPRequest,&allowed,&foundUser,&authHandled);
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
return QTSS_NoErr;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
int check_sacl(const char *inUser)
|
||
|
|
{
|
||
|
|
|
||
|
|
#if OSX_SACL
|
||
|
|
int mbrErr = ENOENT;
|
||
|
|
int isMember = 0;
|
||
|
|
uuid_t user_uuid;
|
||
|
|
|
||
|
|
uuid_t uu;
|
||
|
|
mbrErr = mbr_uid_to_uuid(geteuid(), uu);
|
||
|
|
if (0 == mbrErr)
|
||
|
|
{
|
||
|
|
mbrErr = mbr_check_service_membership(uu, "qtss", &isMember);
|
||
|
|
if (ENOENT == mbrErr) //no acl exists so allow any user.
|
||
|
|
return kSACLAnyUser;
|
||
|
|
}
|
||
|
|
|
||
|
|
if( (mbrErr = mbr_user_name_to_uuid(inUser, user_uuid)) != 0)
|
||
|
|
{
|
||
|
|
return kSACLUnknownUser;
|
||
|
|
}
|
||
|
|
|
||
|
|
if((mbrErr = mbr_check_service_membership(user_uuid, "qtss", &isMember)) != 0)
|
||
|
|
{
|
||
|
|
if(mbrErr == ENOENT){ // no ACL exists
|
||
|
|
return kSACLAuthorized;
|
||
|
|
} else {
|
||
|
|
return kSACLNotAuthorized;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if(isMember == kSACLAuthorized)
|
||
|
|
{
|
||
|
|
return kSACLAuthorized;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
return kSACLNotAuthorized;
|
||
|
|
#else
|
||
|
|
return kSACLAuthorized;
|
||
|
|
#endif
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
QTSS_Error Authorize(QTSS_StandardRTSP_Params* inParams)
|
||
|
|
{
|
||
|
|
|
||
|
|
OSMutexLocker locker(sAuthMutex);
|
||
|
|
|
||
|
|
|
||
|
|
QTSS_RTSPRequestObject theRTSPRequest = inParams->inRTSPRequest;
|
||
|
|
|
||
|
|
if ( (NULL == inParams) || (NULL == inParams->inRTSPRequest) )
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule - Authorize inParams: Error");
|
||
|
|
return QTSS_RequestFailed;
|
||
|
|
}
|
||
|
|
|
||
|
|
//get the local file path
|
||
|
|
char* pathBuffStr = NULL;
|
||
|
|
QTSS_Error theErr = QTSS_GetValueAsString(theRTSPRequest, qtssRTSPReqLocalPath, 0, &pathBuffStr);
|
||
|
|
QTSSCharArrayDeleter pathBuffDeleter(pathBuffStr);
|
||
|
|
if (theErr != QTSS_NoErr)
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule - Authorize [QTSS_GetValueAsString]: Error %"_S32BITARG_"", theErr);
|
||
|
|
return QTSS_RequestFailed;
|
||
|
|
}
|
||
|
|
//get the root movie directory
|
||
|
|
char* movieRootDirStr = NULL;
|
||
|
|
theErr = QTSS_GetValueAsString(theRTSPRequest,qtssRTSPReqRootDir, 0, &movieRootDirStr);
|
||
|
|
OSCharArrayDeleter movieRootDeleter(movieRootDirStr);
|
||
|
|
if (theErr != QTSS_NoErr)
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule - Authorize[QTSS_GetValueAsString]: Error %"_S32BITARG_"", theErr);
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
//check if this user is allowed to see this movie
|
||
|
|
|
||
|
|
DSAccessFile accessFile;
|
||
|
|
Bool16 allowNoAccessFiles = sAllowGuestDefaultEnabled; //no access files allowed means allowing guest access (unknown users)
|
||
|
|
Bool16 allowAnyUser = false;
|
||
|
|
QTSS_ActionFlags noAction = ~qtssActionFlagsRead; //only handle read
|
||
|
|
QTSS_ActionFlags authorizeAction = QTSSModuleUtils::GetRequestActions(theRTSPRequest);
|
||
|
|
Bool16 authorized =false;
|
||
|
|
Bool16 saclUser = false;
|
||
|
|
|
||
|
|
char *name = NULL;
|
||
|
|
(void) QTSS_GetValueAsString (theRTSPRequest,qtssRTSPReqUserName,0, &name);
|
||
|
|
OSCharArrayDeleter nameDeleter(name);
|
||
|
|
if (sAllowGuestDefaultEnabled) // if guest access is on, sacls are ignored.
|
||
|
|
{
|
||
|
|
authorized = true;
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{ int result = check_sacl(name);
|
||
|
|
|
||
|
|
switch (result)
|
||
|
|
{
|
||
|
|
case kSACLAuthorized: authorized = true;
|
||
|
|
break;
|
||
|
|
|
||
|
|
case kSACLUnknownUser: authorized = false; //set this to true to allow file based and other non-directory service users access, when SACLs are enabled in the system for QTSS.
|
||
|
|
break;
|
||
|
|
|
||
|
|
case kSACLNotAuthorized: authorized = false;
|
||
|
|
break;
|
||
|
|
|
||
|
|
case kSACLAnyUser: authorized = true;
|
||
|
|
break;
|
||
|
|
|
||
|
|
default: authorized = false;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize sacl_check result=%d for %s authorized = %d\n",result, name, authorized);
|
||
|
|
if (false == authorized)
|
||
|
|
saclUser = true;
|
||
|
|
}
|
||
|
|
|
||
|
|
Bool16 foundUser = false;
|
||
|
|
Bool16 passwordOK = false; //::AuthenticateRequest(inParams, pathBuffStr, movieRootDirStr, &sRealmNameStr, &foundUser);
|
||
|
|
if (authorized) //have to be authorized by sacls or guest first before qtaccess file checks can allow or disallow.
|
||
|
|
{
|
||
|
|
theErr = accessFile.AuthorizeRequest(inParams,allowNoAccessFiles, noAction, authorizeAction,&authorized, &allowAnyUser);
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize AuthorizeRequest() returned authorized=%d allowAnyUser=%d\n", authorized, allowAnyUser);
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize AuthenticateRequest() returned passwordOK=%d foundUser=%d authorized=%d allowAnyUser=%d\n", passwordOK ,foundUser, authorized,allowAnyUser);
|
||
|
|
|
||
|
|
Bool16 allowRequest = authorized;
|
||
|
|
Bool16 authHandled = true;
|
||
|
|
|
||
|
|
if(!(authorizeAction & qtssActionFlagsRead)) //not for us
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize(qtssActionFlagsRead) not handled do nothing.\n");
|
||
|
|
}
|
||
|
|
else if (allowRequest)
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize() succeeded.\n");
|
||
|
|
theErr = QTSSModuleUtils::AuthorizeRequest(theRTSPRequest, &allowRequest, &foundUser, &authHandled);
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize allowRequest=%d founduser=%d authHandled=%d\n", allowRequest, foundUser, authHandled);
|
||
|
|
}
|
||
|
|
else //request denied
|
||
|
|
{
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize() failed.\n");
|
||
|
|
foundUser = saclUser;
|
||
|
|
authHandled = true;
|
||
|
|
theErr = QTSSModuleUtils::AuthorizeRequest(theRTSPRequest, &allowRequest, &foundUser, &authHandled);
|
||
|
|
debug_printf("QTSSDSAuthModule:Authorize allowRequest=%d founduser=%d authHandled=%d saclUser=%d\n", allowRequest, foundUser, authHandled,saclUser);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
return theErr;
|
||
|
|
}
|