Support site CA cert ("/etc/cups/ssl/site.crt" for Linux, "site" cert on macOS) for...

diff --git a/cups/tls-darwin.c b/cups/tls-darwin.c
index 717471a7b25e84e3fd8b2d10ae3bc9d9f93fa6a5..383a20e9097c50189c83b9958ae4ab03f79916dc 100644 (file)
--- a/cups/tls-darwin.c
+++ b/cups/tls-darwin.c
@@ -690,8 +690,46 @@ httpCredentialsGetTrust(
   }
   else if (!cg->trust_first)
   {
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
-    trust = HTTP_TRUST_INVALID;
+   /*
+    * See if we have a site CA certificate we can compare...
+    */
+
+    if (!httpLoadCredentials(NULL, &tcreds, "site"))
+    {
+      if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
+      {
+       /*
+        * Certificate isn't directly generated from the CA cert...
+       */
+
+        trust = HTTP_TRUST_INVALID;
+      }
+      else
+      {
+       /*
+        * Do a tail comparison of the two certificates...
+       */
+
+        http_credential_t      *a, *b;         /* Certificates */
+
+        for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
+            a && b;
+            a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
+         if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
+           break;
+
+        if (a || b)
+         trust = HTTP_TRUST_INVALID;
+      }
+
+      if (trust != HTTP_TRUST_OK)
+       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
+    }
+    else
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
+      trust = HTTP_TRUST_INVALID;
+    }
   }
 
   if (trust == HTTP_TRUST_OK && !cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent()))

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index cb3865bb5abae4a28d03d801e1ac13cb7fa78545..d5e639ea78026e5985dfb8819c842cf30891aefc 100644 (file)
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -524,8 +524,46 @@ httpCredentialsGetTrust(
   }
   else if (!cg->trust_first)
   {
-    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
-    trust = HTTP_TRUST_INVALID;
+   /*
+    * See if we have a site CA certificate we can compare...
+    */
+
+    if (!httpLoadCredentials(NULL, &tcreds, "site"))
+    {
+      if (cupsArrayCount(credentials) != (cupsArrayCount(tcreds) + 1))
+      {
+       /*
+        * Certificate isn't directly generated from the CA cert...
+       */
+
+        trust = HTTP_TRUST_INVALID;
+      }
+      else
+      {
+       /*
+        * Do a tail comparison of the two certificates...
+       */
+
+        http_credential_t      *a, *b;         /* Certificates */
+
+        for (a = (http_credential_t *)cupsArrayFirst(tcreds), b = (http_credential_t *)cupsArrayIndex(credentials, 1);
+            a && b;
+            a = (http_credential_t *)cupsArrayNext(tcreds), b = (http_credential_t *)cupsArrayNext(credentials))
+         if (a->datalen != b->datalen || memcmp(a->data, b->data, a->datalen))
+           break;
+
+        if (a || b)
+         trust = HTTP_TRUST_INVALID;
+      }
+
+      if (trust != HTTP_TRUST_OK)
+       _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Credentials do not validate against site CA certificate."), 1);
+    }
+    else
+    {
+      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Trust on first use is disabled."), 1);
+      trust = HTTP_TRUST_INVALID;
+    }
   }
 
   if (trust == HTTP_TRUST_OK && !cg->expired_certs)

diff --git a/locale/cups.pot b/locale/cups.pot
index 2f0e471d2e9323ed4009ad4d0e206baa8956142b..00ab1d5105823f94bff275e1e04e24f550f2966e 100644 (file)
--- a/locale/cups.pot
+++ b/locale/cups.pot
@@ -28,7 +28,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -3750,7 +3750,11 @@ msgstr ""
 msgid "Created"
 msgstr ""
 
-#: cups/tls-darwin.c:695 cups/tls-gnutls.c:539
+#: cups/tls-darwin.c:726 cups/tls-gnutls.c:560
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
+#: cups/tls-darwin.c:737 cups/tls-gnutls.c:577
 msgid "Credentials have expired."
 msgstr ""
 
@@ -5155,11 +5159,11 @@ msgstr ""
 msgid "Never"
 msgstr ""
 
-#: cups/tls-darwin.c:664 cups/tls-gnutls.c:502
+#: cups/tls-darwin.c:668 cups/tls-gnutls.c:502
 msgid "New credentials are not valid for name."
 msgstr ""
 
-#: cups/tls-darwin.c:654 cups/tls-gnutls.c:492
+#: cups/tls-darwin.c:658 cups/tls-gnutls.c:492
 msgid "New credentials are older than stored credentials."
 msgstr ""
 
@@ -5208,7 +5212,7 @@ msgstr ""
 msgid "No authentication information provided."
 msgstr ""
 
-#: cups/tls-darwin.c:604 cups/tls-gnutls.c:439
+#: cups/tls-darwin.c:608 cups/tls-gnutls.c:439
 msgid "No common name specified."
 msgstr ""
 
@@ -5285,7 +5289,7 @@ msgstr ""
 msgid "No request-id"
 msgstr ""
 
-#: cups/tls-darwin.c:684 cups/tls-gnutls.c:522
+#: cups/tls-darwin.c:688 cups/tls-gnutls.c:522
 msgid "No stored credentials, not valid for name."
 msgstr ""
 
@@ -5874,7 +5878,7 @@ msgstr ""
 msgid "Roll 9"
 msgstr ""
 
-#: cups/adminutil.c:2083
+#: cups/adminutil.c:2100
 #, c-format
 msgid "Running command: %s %s -N -A %s -c '%s'"
 msgstr ""
@@ -5931,7 +5935,7 @@ msgstr ""
 msgid "Self Adhesive Film"
 msgstr ""
 
-#: cups/tls-darwin.c:701 cups/tls-gnutls.c:546
+#: cups/tls-darwin.c:743 cups/tls-gnutls.c:584
 msgid "Self-signed credentials are blocked."
 msgstr ""
 
@@ -5971,7 +5975,7 @@ msgstr ""
 msgid "Server Stopped"
 msgstr ""
 
-#: cups/tls-darwin.c:1133 cups/tls-gnutls.c:1225
+#: cups/tls-darwin.c:1183 cups/tls-gnutls.c:1263
 msgid "Server credentials not set."
 msgstr ""
 
@@ -6534,8 +6538,8 @@ msgstr ""
 msgid "Triple Wall Cardboard"
 msgstr ""
 
-#: cups/tls-darwin.c:644 cups/tls-darwin.c:689 cups/tls-gnutls.c:482
-#: cups/tls-gnutls.c:527
+#: cups/tls-darwin.c:648 cups/tls-darwin.c:730 cups/tls-gnutls.c:482
+#: cups/tls-gnutls.c:564
 msgid "Trust on first use is disabled."
 msgstr ""
 
@@ -6697,7 +6701,7 @@ msgstr ""
 msgid "Unable to copy Windows 9x printer driver files (%d)."
 msgstr ""
 
-#: cups/tls-darwin.c:610 cups/tls-gnutls.c:445
+#: cups/tls-darwin.c:614 cups/tls-gnutls.c:445
 msgid "Unable to create credentials from array."
 msgstr ""
 
@@ -6709,7 +6713,7 @@ msgstr ""
 msgid "Unable to create printer."
 msgstr ""
 
-#: cups/tls-darwin.c:1394 cups/tls-gnutls.c:1413
+#: cups/tls-darwin.c:1444 cups/tls-gnutls.c:1451
 msgid "Unable to create server credentials."
 msgstr ""
 
@@ -6733,35 +6737,35 @@ msgstr ""
 msgid "Unable to edit cupsd.conf files larger than 1MB"
 msgstr ""
 
-#: cups/tls-darwin.c:1561
+#: cups/tls-darwin.c:1611
 msgid "Unable to establish a secure connection to host (certificate chain invalid)."
 msgstr ""
 
-#: cups/tls-darwin.c:1551
+#: cups/tls-darwin.c:1601
 msgid "Unable to establish a secure connection to host (certificate not yet valid)."
 msgstr ""
 
-#: cups/tls-darwin.c:1546
+#: cups/tls-darwin.c:1596
 msgid "Unable to establish a secure connection to host (expired certificate)."
 msgstr ""
 
-#: cups/tls-darwin.c:1556
+#: cups/tls-darwin.c:1606
 msgid "Unable to establish a secure connection to host (host name mismatch)."
 msgstr ""
 
-#: cups/tls-darwin.c:1566
+#: cups/tls-darwin.c:1616
 msgid "Unable to establish a secure connection to host (peer dropped connection before responding)."
 msgstr ""
 
-#: cups/tls-darwin.c:1541
+#: cups/tls-darwin.c:1591
 msgid "Unable to establish a secure connection to host (self-signed certificate)."
 msgstr ""
 
-#: cups/tls-darwin.c:1536
+#: cups/tls-darwin.c:1586
 msgid "Unable to establish a secure connection to host (untrusted certificate)."
 msgstr ""
 
-#: cups/tls-darwin.c:1593 cups/tls-sspi.c:1277 cups/tls-sspi.c:1294
+#: cups/tls-darwin.c:1643 cups/tls-sspi.c:1277 cups/tls-sspi.c:1294
 msgid "Unable to establish a secure connection to host."
 msgstr ""
 
@@ -6773,7 +6777,7 @@ msgstr ""
 msgid "Unable to find printer."
 msgstr ""
 
-#: cups/tls-darwin.c:1407
+#: cups/tls-darwin.c:1457
 msgid "Unable to find server credentials."
 msgstr ""
 
@@ -6898,7 +6902,7 @@ msgstr ""
 msgid "Unable to resolve printer-uri."
 msgstr ""
 
-#: cups/adminutil.c:2119
+#: cups/adminutil.c:2136
 #, c-format
 msgid "Unable to run \"%s\": %s"
 msgstr ""
@@ -7026,7 +7030,7 @@ msgstr ""
 msgid "Unknown scheme in URI"
 msgstr ""
 
-#: cups/http-addrlist.c:781
+#: cups/http-addrlist.c:783
 msgid "Unknown service name."
 msgstr ""
 
@@ -8327,7 +8331,7 @@ msgstr ""
 msgid "scheduler is running"
 msgstr ""
 
-#: cups/adminutil.c:2190
+#: cups/adminutil.c:2207
 #, c-format
 msgid "stat of %s failed: %s"
 msgstr ""

diff --git a/locale/cups.strings b/locale/cups.strings
index 61f2a939974414f8fc809b475688f7bd341378db..14c15d4062c11c7ec3f7a0d10c28934c6a325b9a 100644 (file)
--- a/locale/cups.strings
+++ b/locale/cups.strings
@@ -808,6 +808,7 @@
 "Cotton Envelope" = "Cotton Envelope";
 "Cover" = "Cover";
 "Created" = "Created";
+"Credentials do not validate against site CA certificate." = "Credentials do not validate against site CA certificate.";
 "Credentials have expired." = "Credentials have expired.";
 "Custom" = "Custom";
 "CustominCutInterval" = "CustominCutInterval";

diff --git a/locale/cups_ca.po b/locale/cups_ca.po
index 0c43c9e1f74fda56cc4464eaa8f4f54e5fea4929..4d5d18bde45f43dcc5921f2ca6d5d905b42230d3 100644 (file)
--- a/locale/cups_ca.po
+++ b/locale/cups_ca.po
@@ -32,7 +32,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.4.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2012-09-29 11:21+0200\n"
 "Last-Translator: Àngel Mompó <mecatxis@gmail.com>\n"
 "Language-Team: Catalan <ca@dodds.net>\n"
@@ -3086,6 +3086,9 @@ msgstr ""
 msgid "Created"
 msgstr "Creat"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_cs.po b/locale/cups_cs.po
index 3709c7e778b85b2f964a5fbde703aae4cdd8da18..889c3d59f680f1e5214b23c191e8f6811ee66126 100644 (file)
--- a/locale/cups_cs.po
+++ b/locale/cups_cs.po
@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2012-09-14 10:26+0100\n"
 "Last-Translator: Jan Bartos <jan.bartos@madeta.cz>\n"
 "Language-Team: Czech\n"
@@ -2890,6 +2890,9 @@ msgstr ""
 msgid "Created"
 msgstr "Vytvořeno"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_de.po b/locale/cups_de.po
index 83c6011929c5ca95ab70bbd0a315caf1d8323592..928f8f967fe676d4a81393afa361bf6ce0654f98 100644 (file)
--- a/locale/cups_de.po
+++ b/locale/cups_de.po
@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.0\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2016-04-22 12:25+0100\n"
 "Last-Translator: Joachim Schwender <joachim.schwender@web.de>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -2957,6 +2957,9 @@ msgstr ""
 msgid "Created"
 msgstr "Erstellt"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_es.po b/locale/cups_es.po
index 205b6535aed53a4c4b2b4fadf45eff99f5cdc362..44ffaf201660d3e4a8e6df179d26772f1d9899c6 100644 (file)
--- a/locale/cups_es.po
+++ b/locale/cups_es.po
@@ -16,7 +16,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.2\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2016-06-26 21:17+0100\n"
 "Last-Translator: Juan Pablo González Riopedre <jpgriopedre@yahoo.es>\n"
 "Language-Team: Spanish\n"
@@ -3161,6 +3161,9 @@ msgstr "Carátula"
 msgid "Created"
 msgstr "Creado"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_fr.po b/locale/cups_fr.po
index 568e892435956ab195b5c2b7ae7d8704a4d57b56..40ac9eb27c7d6b3b0e3785672675ab41364decdc 100644 (file)
--- a/locale/cups_fr.po
+++ b/locale/cups_fr.po
@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2012-12-12 11:12+0100\n"
 "Last-Translator: denis meramdjougoma <dcmeram@libertysurf.fr>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -2890,6 +2890,9 @@ msgstr ""
 msgid "Created"
 msgstr "Créé"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_it.po b/locale/cups_it.po
index 244208c20b9a36640818e736dee1e3460b4f4b91..5f055b1834c62fa1e695975f9f300cb9c2e2fb2f 100644 (file)
--- a/locale/cups_it.po
+++ b/locale/cups_it.po
@@ -29,7 +29,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 1.6\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2013-07-14 12:00+0200\n"
 "Last-Translator: Giovanni Scafora <giovanni@archlinux.org>\n"
 "Language-Team: Arch Linux Italian Team <giovanni@archlinux.org>\n"
@@ -3160,6 +3160,9 @@ msgstr ""
 msgid "Created"
 msgstr "Creato"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_ja.po b/locale/cups_ja.po
index 7ee964a319bde33d111c4630246a8a741a27e302..1ae7aed9463ae40b7568e2fbd7a37eaca51d8a8c 100644 (file)
--- a/locale/cups_ja.po
+++ b/locale/cups_ja.po
@@ -28,7 +28,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.0\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2014-11-15 19:27+0900\n"
 "Last-Translator: OPFC TRANSCUPS <opfc-transcups@sourceforge.jp>\n"
 "Language-Team: OPFC TRANSCUPS <opfc-transcups@sourceforge.jp>\n"
@@ -3119,6 +3119,9 @@ msgstr ""
 msgid "Created"
 msgstr "ジョブ作成"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_pt_BR.po b/locale/cups_pt_BR.po
index 4e9e5ec1c05f2490cab1a8efd617d64b1746f7f8..bfd303018f96532921391786226bcbb21d131bd4 100644 (file)
--- a/locale/cups_pt_BR.po
+++ b/locale/cups_pt_BR.po
@@ -40,7 +40,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.1.2\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2016-01-31 16:45-0200\n"
 "Last-Translator: Rafael Fontenelle <rffontenelle@gmail.com>\n"
 "Language-Team: Brazilian Portuguese <traducao-cups-pt-br@googlegroups.com>\n"
@@ -3161,6 +3161,9 @@ msgstr ""
 msgid "Created"
 msgstr "Criada"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""
 

diff --git a/locale/cups_ru.po b/locale/cups_ru.po
index e0de8bfadc4649de4e451f465bea88b0a4368309..130945f5051d740b5194219ec80ba12ed84077df 100644 (file)
--- a/locale/cups_ru.po
+++ b/locale/cups_ru.po
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: CUPS 2.0\n"
 "Report-Msgid-Bugs-To: http://www.cups.org/str.php\n"
-"POT-Creation-Date: 2016-08-25 09:50-0400\n"
+"POT-Creation-Date: 2016-08-30 16:00-0400\n"
 "PO-Revision-Date: 2015-01-28 12:00-0800\n"
 "Last-Translator: Aleksandr Proklov\n"
 "Language-Team: PuppyRus Linux Team\n"
@@ -3093,6 +3093,9 @@ msgstr ""
 msgid "Created"
 msgstr "Создано"
 
+msgid "Credentials do not validate against site CA certificate."
+msgstr ""
+
 msgid "Credentials have expired."
 msgstr ""