From 8974120c998704ebe180105e764e9aa12600ea91 Mon Sep 17 00:00:00 2001 From: Sebastião Guerra Date: Mon, 14 Sep 2026 06:53:20 -0300 Subject: tdeprint: modernize cupsdconf CUPS communication MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the deprecated CUPS HTTP connection and reconnect APIs with httpConnect2() and httpReconnect2(). Use the CUPS authentication API instead of maintaining local Basic, Digest and certificate authentication handling. Handle HTTP_UPGRADE_REQUIRED through the public CUPS encryption API independently of tdelibs OpenSSL support, and check the result of httpEncryption(). Signed-off-by: Sebastião Guerra --- tdeprint/cups/cupsdconf2/cups-util.c | 247 ++++------------------------------- 1 file changed, 24 insertions(+), 223 deletions(-) diff --git a/tdeprint/cups/cupsdconf2/cups-util.c b/tdeprint/cups/cupsdconf2/cups-util.c index 97c34715d..af67a51de 100644 --- a/tdeprint/cups/cupsdconf2/cups-util.c +++ b/tdeprint/cups/cupsdconf2/cups-util.c @@ -2,17 +2,11 @@ #include #include #include -#include #include -#include #include -#define CUPS_SERVERROOT "/etc/cups" static http_t *cups_server; static ipp_status_t last_error; -static char authstring[HTTP_MAX_VALUE]; -static char pwdstring[33]; -static int cups_local_auth(http_t *http); const char* cupsGetConf( void ); int cupsPutConf( const char* ); @@ -24,24 +18,16 @@ cupsGetConf(void) int bytes; /* Number of bytes read */ char buffer[8192]; /* Buffer for file */ char resource[HTTP_MAX_URI]; /* Resource name */ - const char *password; /* Password string */ - char realm[HTTP_MAX_VALUE], /* realm="xyz" string */ - nonce[HTTP_MAX_VALUE], /* nonce="xyz" string */ - plain[255], /* Plaintext username:password */ - encode[512]; /* Encoded username:password */ http_status_t status; /* HTTP status from server */ - char prompt[1024]; /* Prompt string */ - int digest_tries; /* Number of tries with Digest */ static char filename[HTTP_MAX_URI]; /* Local filename */ - char fqdn[ HTTP_MAX_URI ]; /* Server name buffer */ /* * Connect to the correct server as needed... */ - if ((cups_server = httpConnectEncrypt(cupsServer(), ippPort(), - cupsEncryption())) == NULL) + if ((cups_server = httpConnect2(cupsServer(), ippPort(), NULL, AF_UNSPEC, + cupsEncryption(), 1, 30000, NULL)) == NULL) { last_error = IPP_SERVICE_UNAVAILABLE; return (NULL); @@ -69,17 +55,16 @@ cupsGetConf(void) snprintf(resource, sizeof(resource), "/admin/conf/cupsd.conf"); - digest_tries = 0; do { httpClearFields(cups_server); httpSetField(cups_server, HTTP_FIELD_HOST, cupsServer()); - httpSetField(cups_server, HTTP_FIELD_AUTHORIZATION, authstring); + httpSetField(cups_server, HTTP_FIELD_AUTHORIZATION, httpGetAuthString(cups_server)); if (httpGet(cups_server, resource)) { - if (httpReconnect(cups_server)) + if (httpReconnect2(cups_server, 30000, NULL)) { status = HTTP_ERROR; break; @@ -95,7 +80,6 @@ cupsGetConf(void) if (status == HTTP_UNAUTHORIZED) { - const char *www_authenticate; fprintf(stderr,"cupsGetConf: unauthorized...\n"); /* @@ -104,75 +88,14 @@ cupsGetConf(void) httpFlush(cups_server); - /* - * See if we can do local authentication... - */ - - if (cups_local_auth(cups_server)) - continue; - - /* - * See if we should retry the current digest password... - */ - - www_authenticate = httpGetField( cups_server, HTTP_FIELD_WWW_AUTHENTICATE ); - if (strncmp(www_authenticate, "Basic", 5) == 0 || - digest_tries > 1 || !pwdstring[0]) - { - /* - * Nope - get a password from the user... - */ - httpGetHostname( cups_server, fqdn, sizeof( fqdn ) ); - - snprintf(prompt, sizeof(prompt), "Password for %s on %s? ", cupsUser(), fqdn ); - - if ((password = cupsGetPassword(prompt)) == NULL) - break; - if (!password[0]) - break; - - strncpy(pwdstring, password, sizeof(pwdstring) - 1); - pwdstring[sizeof(pwdstring) - 1] = '\0'; - - digest_tries = 0; - } - else - digest_tries ++; - - /* - * Got a password; encode it for the server... - */ - - www_authenticate = httpGetField( cups_server, HTTP_FIELD_WWW_AUTHENTICATE ); - if (strncmp(www_authenticate, "Basic", 5) == 0) - { - /* - * Basic authentication... - */ - - snprintf(plain, sizeof(plain), "%s:%s", cupsUser(), pwdstring); - httpEncode64_2(encode, sizeof(encode), plain, sizeof(plain)); - snprintf(authstring, sizeof(authstring), "Basic %s", encode); - } - else + if (cupsDoAuthentication(cups_server, "GET", resource)) { - /* - * Digest authentication... - */ - - httpGetSubField(cups_server, HTTP_FIELD_WWW_AUTHENTICATE, "realm", realm); - httpGetSubField(cups_server, HTTP_FIELD_WWW_AUTHENTICATE, "nonce", nonce); - - httpMD5(cupsUser(), realm, pwdstring, encode); - httpMD5Final(nonce, "GET", resource, encode); - snprintf(authstring, sizeof(authstring), - "Digest username=\"%s\", realm=\"%s\", nonce=\"%s\", " - "response=\"%s\"", cupsUser(), realm, nonce, encode); + status = HTTP_ERROR; + break; } continue; } -#ifdef HAVE_LIBSSL else if (status == HTTP_UPGRADE_REQUIRED) { /* @@ -185,7 +108,11 @@ cupsGetConf(void) * Upgrade with encryption... */ - httpEncryption(cups_server, HTTP_ENCRYPT_REQUIRED); + if (httpEncryption(cups_server, HTTP_ENCRYPT_REQUIRED)) + { + status = HTTP_ERROR; + break; + } /* * Try again, this time with encryption enabled... @@ -193,7 +120,6 @@ cupsGetConf(void) continue; } -#endif /* HAVE_LIBSSL */ } while (status == HTTP_UNAUTHORIZED || status == HTTP_UPGRADE_REQUIRED); @@ -232,15 +158,7 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ int bytes; /* Number of bytes read */ char buffer[8192]; /* Buffer for file */ char resource[HTTP_MAX_URI]; /* Resource name */ - const char *password; /* Password string */ - char realm[HTTP_MAX_VALUE], /* realm="xyz" string */ - nonce[HTTP_MAX_VALUE], /* nonce="xyz" string */ - plain[255], /* Plaintext username:password */ - encode[512]; /* Encoded username:password */ http_status_t status; /* HTTP status from server */ - char prompt[1024]; /* Prompt string */ - int digest_tries; /* Number of tries with Digest */ - char fqdn[ HTTP_MAX_URI ]; /* Server name buffer */ if (name == NULL) return 0; @@ -249,8 +167,8 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ * Connect to the correct server as needed... */ - if ((cups_server = httpConnectEncrypt(cupsServer(), ippPort(), - cupsEncryption())) == NULL) + if ((cups_server = httpConnect2(cupsServer(), ippPort(), NULL, AF_UNSPEC, + cupsEncryption(), 1, 30000, NULL)) == NULL) { last_error = IPP_SERVICE_UNAVAILABLE; return 0; @@ -278,18 +196,16 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ strncpy(resource, "/admin/conf/cupsd.conf", sizeof(resource)); - digest_tries = 0; - do { httpClearFields(cups_server); httpSetField(cups_server, HTTP_FIELD_HOST, cupsServer()); - httpSetField(cups_server, HTTP_FIELD_AUTHORIZATION, authstring); + httpSetField(cups_server, HTTP_FIELD_AUTHORIZATION, httpGetAuthString(cups_server)); httpSetField(cups_server, HTTP_FIELD_TRANSFER_ENCODING, "chunked"); if (httpPut(cups_server, resource)) { - if (httpReconnect(cups_server)) + if (httpReconnect2(cups_server, 30000, NULL)) { status = HTTP_ERROR; break; @@ -324,7 +240,6 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ if (status == HTTP_UNAUTHORIZED) { - const char *www_authenticate; fprintf(stderr,"cupsPutConf: unauthorized..."); /* @@ -333,76 +248,14 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ httpFlush(cups_server); - /* - * See if we can do local authentication... - */ - - if (cups_local_auth(cups_server)) - continue; - - /* - * See if we should retry the current digest password... - */ - - www_authenticate = httpGetField( cups_server, HTTP_FIELD_WWW_AUTHENTICATE ); - if (strncmp(www_authenticate, "Basic", 5) == 0 || - digest_tries > 1 || !pwdstring[0]) + if (cupsDoAuthentication(cups_server, "PUT", resource)) { - /* - * Nope - get a password from the user... - */ - - - httpGetHostname( cups_server, fqdn, sizeof( fqdn ) ); - snprintf(prompt, sizeof(prompt), "Password for %s on %s? ", cupsUser(), fqdn ); - - if ((password = cupsGetPassword(prompt)) == NULL) - break; - if (!password[0]) - break; - - strncpy(pwdstring, password, sizeof(pwdstring) - 1); - pwdstring[sizeof(pwdstring) - 1] = '\0'; - - digest_tries = 0; - } - else - digest_tries ++; - - /* - * Got a password; encode it for the server... - */ - - www_authenticate = httpGetField( cups_server, HTTP_FIELD_WWW_AUTHENTICATE ); - if (strncmp(www_authenticate, "Basic", 5) == 0) - { - /* - * Basic authentication... - */ - - snprintf(plain, sizeof(plain), "%s:%s", cupsUser(), pwdstring); - httpEncode64_2(encode, sizeof(encode), plain, sizeof(plain)); - snprintf(authstring, sizeof(authstring), "Basic %s", encode); - } - else - { - /* - * Digest authentication... - */ - - httpGetSubField(cups_server, HTTP_FIELD_WWW_AUTHENTICATE, "realm", realm); - httpGetSubField(cups_server, HTTP_FIELD_WWW_AUTHENTICATE, "nonce", nonce); - - httpMD5(cupsUser(), realm, pwdstring, encode); - httpMD5Final(nonce, "GET", resource, encode); - snprintf(authstring, sizeof(authstring), - "Digest username=\"%s\", realm=\"%s\", nonce=\"%s\", " - "response=\"%s\"", cupsUser(), realm, nonce, encode); + status = HTTP_ERROR; + break; } continue; } -#ifdef HAVE_LIBSSL else if (status == HTTP_UPGRADE_REQUIRED) { /* @@ -415,7 +268,11 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ * Upgrade with encryption... */ - httpEncryption(cups_server, HTTP_ENCRYPT_REQUIRED); + if (httpEncryption(cups_server, HTTP_ENCRYPT_REQUIRED)) + { + status = HTTP_ERROR; + break; + } /* * Try again, this time with encryption enabled... @@ -423,7 +280,6 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ continue; } -#endif /* HAVE_LIBSSL */ } while (status == HTTP_UNAUTHORIZED || status == HTTP_UPGRADE_REQUIRED); @@ -444,58 +300,3 @@ cupsPutConf(const char *name) /* I - Name of the config file to send */ return 1; } - -static int /* O - 1 if available, 0 if not */ -cups_local_auth(http_t *http) /* I - Connection */ -{ - int pid; /* Current process ID */ - FILE *fp; /* Certificate file */ - char filename[1024], /* Certificate filename */ - certificate[33];/* Certificate string */ - const char *root; /* Server root directory */ - - - /* - * See if we are accessing localhost... - the struct has changed in newer versions - PiggZ (adam@piggz.co.uk) - */ - if (!httpAddrLocalhost(httpGetAddress(http))) - { - return (0); - } - - /* - * Try opening a certificate file for this PID. If that fails, - * try the root certificate... - */ - - if ((root = getenv("CUPS_SERVERROOT")) == NULL) - root = CUPS_SERVERROOT; - - pid = getpid(); - snprintf(filename, sizeof(filename), "%s/certs/%d", root, pid); - if ((fp = fopen(filename, "r")) == NULL && pid > 0) - { - snprintf(filename, sizeof(filename), "%s/certs/0", root); - fp = fopen(filename, "r"); - } - - if (fp == NULL) - return (0); - - /* - * Read the certificate from the file... - */ - - fgets(certificate, sizeof(certificate), fp); - fclose(fp); - - /* - * Set the authorization string and return... - */ - - snprintf(authstring, sizeof(authstring), "Local %s", certificate); - - return (1); -} - -- cgit v1.2.3