Do some cleanup of the SSL/TLS support code so that we properly report errors.

Also report connection errors using cupsLastErrorString() in ipptool.

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@9907 7a7537e8-13f0-0310-91df-b6672ffda945

diff --git a/cups/http.c b/cups/http.c
index 41617586f82ce4b6eeefb1f738b58726c581d0f2..1daec0d38488bb5004bd0dc038a3f285188ea08c 100644 (file)
--- a/cups/http.c
+++ b/cups/http.c
@@ -3760,7 +3760,7 @@ http_set_credentials(http_t *http)        /* I - Connection to server */
  * 'http_setup_ssl()' - Set up SSL/TLS support on a connection.
  */
 
-static int                             /* O - Status of connection */
+static int                             /* O - 0 on success, -1 on failure */
 http_setup_ssl(http_t *http)           /* I - Connection to server */
 {
   _cups_globals_t      *cg = _cupsGlobals();
@@ -3768,29 +3768,30 @@ http_setup_ssl(http_t *http)            /* I - Connection to server */
   int                  any_root;       /* Allow any root */
 
 #  ifdef HAVE_LIBSSL
-  SSL_CTX      *context;               /* Context for encryption */
-  BIO          *bio;                   /* BIO data */
+  SSL_CTX              *context;       /* Context for encryption */
+  BIO                  *bio;           /* BIO data */
+  const char           *message = NULL;/* Error message */
 #  elif defined(HAVE_GNUTLS)
+  int                  status;         /* Status of handshake */
   gnutls_certificate_client_credentials *credentials;
                                        /* TLS credentials */
 #  elif defined(HAVE_CDSASSL)
-  OSStatus     error;                  /* Error code */
-  const char   *message = NULL;        /* Error message */
-  char         *hostname;              /* Hostname */
+  OSStatus             error;          /* Error code */
+  char                 *hostname;      /* Hostname */
+  const char           *message = NULL;/* Error message */
 #    ifdef HAVE_SECCERTIFICATECOPYDATA
-  cups_array_t *credentials;           /* Credentials array */
-  cups_array_t *names;                 /* CUPS distinguished names */
-  CFArrayRef   dn_array;               /* CF distinguished names array */
-  CFIndex      count;                  /* Number of credentials */
-  CFDataRef    data;                   /* Certificate data */
-  int          i;                      /* Looping var */
-  http_credential_t
-               *credential;            /* Credential data */
+  cups_array_t         *credentials;   /* Credentials array */
+  cups_array_t         *names;         /* CUPS distinguished names */
+  CFArrayRef           dn_array;       /* CF distinguished names array */
+  CFIndex              count;          /* Number of credentials */
+  CFDataRef            data;           /* Certificate data */
+  int                  i;              /* Looping var */
+  http_credential_t    *credential;    /* Credential data */
 #    endif /* HAVE_SECCERTIFICATECOPYDATA */
 #  elif defined(HAVE_SSPISSL)
-  TCHAR                username[256];          /* Username returned from GetUserName() */
-  TCHAR                commonName[256];        /* Common name for certificate */
-  DWORD                dwSize;                 /* 32 bit size */
+  TCHAR                        username[256];  /* Username returned from GetUserName() */
+  TCHAR                        commonName[256];/* Common name for certificate */
+  DWORD                        dwSize;         /* 32 bit size */
 #  endif /* HAVE_LIBSSL */
 
 
@@ -3818,12 +3819,13 @@ http_setup_ssl(http_t *http)            /* I - Connection to server */
 
   if (SSL_connect(http->tls) != 1)
   {
-#    ifdef DEBUG
     unsigned long      error;  /* Error code */
 
     while ((error = ERR_get_error()) != 0)
-      DEBUG_printf(("8http_setup_ssl: %s", ERR_error_string(error, NULL)));
-#    endif /* DEBUG */
+    {
+      message = ERR_error_string(error, NULL);
+      DEBUG_printf(("8http_setup_ssl: %s", message));
+    }
 
     SSL_CTX_free(context);
     SSL_free(http->tls);
@@ -3836,7 +3838,12 @@ http_setup_ssl(http_t *http)             /* I - Connection to server */
 #    endif /* WIN32 */
     http->status = HTTP_ERROR;
 
-    return (HTTP_ERROR);
+    if (!message)
+      message = _("Unable to establish a secure connection to host.");
+
+    _cupsSetError(IPP_PKI_ERROR, message, 1);
+
+    return (-1);
   }
 
 #  elif defined(HAVE_GNUTLS)
@@ -3844,8 +3851,11 @@ http_setup_ssl(http_t *http)             /* I - Connection to server */
                     malloc(sizeof(gnutls_certificate_client_credentials));
   if (credentials == NULL)
   {
-    http->error = errno;
+    DEBUG_printf(("8http_setup_ssl: Unable to allocate credentials: %s",
+                  strerror(errno)));
+    http->error  = errno;
     http->status = HTTP_ERROR;
+    _cupsSetHTTPError(HTTP_ERROR);
 
     return (-1);
   }
@@ -3859,17 +3869,25 @@ http_setup_ssl(http_t *http)            /* I - Connection to server */
   gnutls_transport_set_pull_function(http->tls, _httpReadGNUTLS);
   gnutls_transport_set_push_function(http->tls, _httpWriteGNUTLS);
 
-  if ((gnutls_handshake(http->tls)) != GNUTLS_E_SUCCESS)
+  while ((status = gnutls_handshake(http->tls)) != GNUTLS_E_SUCCESS)
   {
-    http->error  = errno;
-    http->status = HTTP_ERROR;
+    DEBUG_printf(("8http_setup_ssl: gnutls_handshake returned %d (%s)",
+                  status, gnutls_strerror(status)));
 
-    gnutls_deinit(http->tls);
-    gnutls_certificate_free_credentials(*credentials);
-    free(credentials);
-    http->tls = NULL;
+    if (gnutls_error_is_fatal(status))
+    {
+      http->error  = EIO;
+      http->status = HTTP_ERROR;
 
-    return (-1);
+      _cupsSetError(IPP_PKI_ERROR, gnutls_strerror(status), 0);
+
+      gnutls_deinit(http->tls);
+      gnutls_certificate_free_credentials(*credentials);
+      free(credentials);
+      http->tls = NULL;
+
+      return (-1);
+    }
   }
 
   http->tls_credentials = credentials;
@@ -3877,8 +3895,9 @@ http_setup_ssl(http_t *http)              /* I - Connection to server */
 #  elif defined(HAVE_CDSASSL)
   if ((error = SSLNewContext(false, &http->tls)))
   {
-    http->error  = error;
+    http->error  = errno;
     http->status = HTTP_ERROR;
+    _cupsSetHTTPError(HTTP_ERROR);
 
     return (-1);
   }
@@ -4123,6 +4142,7 @@ http_setup_ssl(http_t *http)              /* I - Connection to server */
   http->tls = _sspiAlloc();
 
   if (!http->tls)
+  {
     return (-1);
 
   http->tls->sock = http->fd;
@@ -4136,6 +4156,13 @@ http_setup_ssl(http_t *http)             /* I - Connection to server */
   {
     _sspiFree(http->tls_credentials);
     http->tls_credentials = NULL;
+
+    http->error  = EIO;
+    http->status = HTTP_ERROR;
+
+    _cupsSetError(IPP_PKI_ERROR,
+                  _("Unable to establish a secure connection to host."), 1);
+
     return (-1);
   }
 
@@ -4146,6 +4173,13 @@ http_setup_ssl(http_t *http)             /* I - Connection to server */
   {
     _sspiFree(http->tls_credentials);
     http->tls_credentials = NULL;
+
+    http->error  = EIO;
+    http->status = HTTP_ERROR;
+
+    _cupsSetError(IPP_PKI_ERROR,
+                  _("Unable to establish a secure connection to host."), 1);
+
     return (-1);
   }
 #  endif /* HAVE_CDSASSL */

diff --git a/scheduler/client.c b/scheduler/client.c
index d854d4b169ccf9f3c3ee5b1c41be468bd81c77f2..d5a51114dfadbbb8d48f919bb3b7c13d4527903e 100644 (file)
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -3227,19 +3227,20 @@ encrypt_client(cupsd_client_t *con)     /* I - Client to encrypt */
   gnutls_transport_set_pull_function(con->http.tls, _httpReadGNUTLS);
   gnutls_transport_set_push_function(con->http.tls, _httpWriteGNUTLS);
 
-  error = gnutls_handshake(con->http.tls);
-
-  if (error != GNUTLS_E_SUCCESS)
+  while ((error = gnutls_handshake(con->http.tls)) != GNUTLS_E_SUCCESS)
   {
-    cupsdLogMessage(CUPSD_LOG_ERROR,
-                    "Unable to encrypt connection from %s - %s",
-                    con->http.hostname, gnutls_strerror(error));
+    if (gnutls_error_is_fatal(error))
+    {
+      cupsdLogMessage(CUPSD_LOG_ERROR,
+                      "Unable to encrypt connection from %s - %s",
+                      con->http.hostname, gnutls_strerror(error));
 
-    gnutls_deinit(con->http.tls);
-    gnutls_certificate_free_credentials(*credentials);
-    con->http.tls = NULL;
-    free(credentials);
-    return (0);
+      gnutls_deinit(con->http.tls);
+      gnutls_certificate_free_credentials(*credentials);
+      con->http.tls = NULL;
+      free(credentials);
+      return (0);
+    }
   }
 
   cupsdLogMessage(CUPSD_LOG_DEBUG, "Connection from %s now encrypted.",

diff --git a/test/ipptool.c b/test/ipptool.c
index 9f1685c089fec8b6ccb5fcc2269af330e6584b41..5fdcd09a7ada6a773ae212f65ec2a8b1adb3907f 100644 (file)
--- a/test/ipptool.c
+++ b/test/ipptool.c
@@ -660,7 +660,7 @@ do_tests(_cups_vars_t *vars,                /* I - Variables */
                          vars->family)) == NULL)
   {
     print_fatal_error("Unable to connect to %s on port %d - %s", vars->hostname,
-                      vars->port, strerror(errno));
+                      vars->port, cupsLastErrorString());
     pass = 0;
     goto test_exit;
   }
@@ -668,7 +668,7 @@ do_tests(_cups_vars_t *vars,                /* I - Variables */
   if (httpReconnect(http))
   {
     print_fatal_error("Unable to connect to %s on port %d - %s", vars->hostname,
-                      vars->port, strerror(errno));
+                      vars->port, cupsLastErrorString());
     pass = 0;
     goto test_exit;
   }