*
* HTTP routines for CUPS.
*
- * Copyright 2007-2013 by Apple Inc.
+ * Copyright 2007-2014 by Apple Inc.
* Copyright 1997-2007 by Easy Software Products, all rights reserved.
*
* This file contains Kerberos support code, copyright 2006 by
static void http_debug_hex(const char *prefix, const char *buffer,
int bytes);
#endif /* DEBUG */
-static http_field_t http_field(const char *name);
static ssize_t http_read(http_t *http, char *buffer, size_t length);
static ssize_t http_read_buffered(http_t *http, char *buffer, size_t length);
static ssize_t http_read_chunk(http_t *http, char *buffer, size_t length);
size_t length);
static ssize_t http_write_chunk(http_t *http, const char *buffer,
size_t length);
-#ifdef HAVE_SSL
-static int http_read_ssl(http_t *http, char *buf, int len);
-# ifdef HAVE_CDSASSL
-static int http_set_credentials(http_t *http);
-# endif /* HAVE_CDSASSL */
-#endif /* HAVE_SSL */
static off_t http_set_length(http_t *http);
static void http_set_timeout(int fd, double timeout);
static void http_set_wait(http_t *http);
-#ifdef DEBUG
-static const char *http_state_string(http_state_t state);
-#endif /* DEBUG */
+
#ifdef HAVE_SSL
-static int http_setup_ssl(http_t *http);
-static void http_shutdown_ssl(http_t *http);
-static int http_upgrade(http_t *http);
-static int http_write_ssl(http_t *http, const char *buf, int len);
+static size_t http_tls_pending(http_t *http);
+static int http_tls_read(http_t *http, char *buf, int len);
+static int http_tls_set_credentials(http_t *http);
+static int http_tls_start(http_t *http);
+static void http_tls_stop(http_t *http);
+static int http_tls_upgrade(http_t *http);
+static int http_tls_write(http_t *http, const char *buf, int len);
+# ifdef HAVE_GNUTLS
+# include "tls-gnutls.c"
+# elif defined(HAVE_CDSASSL)
+# include "tls-darwin.c"
+# else
+# include "tls-sspi.c"
+# endif /* HAVE_GNUTLS */
#endif /* HAVE_SSL */
};
-#if defined(HAVE_SSL) && defined(HAVE_LIBSSL)
-/*
- * BIO methods for OpenSSL...
- */
-
-static int http_bio_write(BIO *h, const char *buf, int num);
-static int http_bio_read(BIO *h, char *buf, int size);
-static int http_bio_puts(BIO *h, const char *str);
-static long http_bio_ctrl(BIO *h, int cmd, long arg1, void *arg2);
-static int http_bio_new(BIO *h);
-static int http_bio_free(BIO *data);
-
-static BIO_METHOD http_bio_methods =
- {
- BIO_TYPE_SOCKET,
- "http",
- http_bio_write,
- http_bio_read,
- http_bio_puts,
- NULL, /* http_bio_gets, */
- http_bio_ctrl,
- http_bio_new,
- http_bio_free,
- NULL,
- };
-#endif /* HAVE_SSL && HAVE_LIBSSL */
-
-
/*
* 'httpAcceptConnection()' - Accept a new HTTP client connection from the
* specified listening socket.
}
-#if defined(HAVE_SSL) && defined(HAVE_LIBSSL)
-/*
- * '_httpBIOMethods()' - Get the OpenSSL BIO methods for HTTP connections.
- */
-
-BIO_METHOD * /* O - BIO methods for OpenSSL */
-_httpBIOMethods(void)
-{
- return (&http_bio_methods);
-}
-#endif /* HAVE_SSL && HAVE_LIBSSL */
-
-
/*
* 'httpBlocking()' - Set blocking/non-blocking behavior on a connection.
*/
}
+/*
+ * 'httpCompareCredentials()' - Compare two sets of X.509 credentials.
+ *
+ * @since CUPS 2.0@
+ */
+
+int /* O - 1 if they match, 0 if they do not */
+httpCompareCredentials(
+ cups_array_t *cred1, /* I - First set of X.509 credentials */
+ cups_array_t *cred2) /* I - Second set of X.509 credentials */
+{
+ http_credential_t *temp1, *temp2; /* Temporary credentials */
+
+
+ for (temp1 = (http_credential_t *)cupsArrayFirst(cred1), temp2 = (http_credential_t *)cupsArrayFirst(cred2); temp1 && temp2; temp1 = (http_credential_t *)cupsArrayNext(cred1), temp2 = (http_credential_t *)cupsArrayNext(cred2))
+ if (temp1->datalen != temp2->datalen)
+ return (0);
+ else if (memcmp(temp1->data, temp2->data, temp1->datalen))
+ return (0);
+
+ return (temp1 == temp2);
+}
+
+
/*
* 'httpConnect()' - Connect to a HTTP server.
*
httpConnect(const char *host, /* I - Host to connect to */
int port) /* I - Port number */
{
- return (httpConnect2(host, port, NULL, AF_UNSPEC, HTTP_ENCRYPTION_IF_REQUESTED,
- 1, 30000, NULL));
+ return (httpConnect2(host, port, NULL, AF_UNSPEC,
+ HTTP_ENCRYPTION_IF_REQUESTED, 1, 30000, NULL));
}
}
-/*
- * 'httpCopyCredentials()' - Copy the credentials associated with an encrypted
- * connection.
- *
- * @since CUPS 1.5/OS X 10.7@
- */
-
-int /* O - Status of call (0 = success) */
-httpCopyCredentials(
- http_t *http, /* I - HTTP connection */
- cups_array_t **credentials) /* O - Array of credentials */
-{
-# ifdef HAVE_LIBSSL
-# elif defined(HAVE_GNUTLS)
-# elif defined(HAVE_CDSASSL)
- OSStatus error; /* Error code */
- SecTrustRef peerTrust; /* Peer trust reference */
- CFIndex count; /* Number of credentials */
- SecCertificateRef secCert; /* Certificate reference */
- CFDataRef data; /* Certificate data */
- int i; /* Looping var */
-# elif defined(HAVE_SSPISSL)
-# endif /* HAVE_LIBSSL */
-
-
- if (credentials)
- *credentials = NULL;
-
- if (!http || !http->tls || !credentials)
- return (-1);
-
-# ifdef HAVE_LIBSSL
- return (-1);
-
-# elif defined(HAVE_GNUTLS)
- return (-1);
-
-# elif defined(HAVE_CDSASSL)
- if (!(error = SSLCopyPeerTrust(http->tls, &peerTrust)) && peerTrust)
- {
- if ((*credentials = cupsArrayNew(NULL, NULL)) != NULL)
- {
- count = SecTrustGetCertificateCount(peerTrust);
-
- for (i = 0; i < count; i ++)
- {
- secCert = SecTrustGetCertificateAtIndex(peerTrust, i);
- if ((data = SecCertificateCopyData(secCert)))
- {
- httpAddCredential(*credentials, CFDataGetBytePtr(data),
- CFDataGetLength(data));
- CFRelease(data);
- }
- }
- }
-
- CFRelease(peerTrust);
- }
-
- return (error);
-
-# elif defined(HAVE_SSPISSL)
- return (-1);
-
-# else
- return (-1);
-# endif /* HAVE_LIBSSL */
-}
-
-
-/*
- * '_httpCreateCredentials()' - Create credentials in the internal format.
- */
-
-http_tls_credentials_t /* O - Internal credentials */
-_httpCreateCredentials(
- cups_array_t *credentials) /* I - Array of credentials */
-{
- if (!credentials)
- return (NULL);
-
-# ifdef HAVE_LIBSSL
- return (NULL);
-
-# elif defined(HAVE_GNUTLS)
- return (NULL);
-
-# elif defined(HAVE_CDSASSL)
- CFMutableArrayRef peerCerts; /* Peer credentials reference */
- SecCertificateRef secCert; /* Certificate reference */
- CFDataRef data; /* Credential data reference */
- http_credential_t *credential; /* Credential data */
-
-
- if ((peerCerts = CFArrayCreateMutable(kCFAllocatorDefault,
- cupsArrayCount(credentials),
- &kCFTypeArrayCallBacks)) == NULL)
- return (NULL);
-
- for (credential = (http_credential_t *)cupsArrayFirst(credentials);
- credential;
- credential = (http_credential_t *)cupsArrayNext(credentials))
- {
- if ((data = CFDataCreate(kCFAllocatorDefault, credential->data,
- credential->datalen)))
- {
- if ((secCert = SecCertificateCreateWithData(kCFAllocatorDefault, data))
- != NULL)
- {
- CFArrayAppendValue(peerCerts, secCert);
- CFRelease(secCert);
- }
-
- CFRelease(data);
- }
- }
-
- return (peerCerts);
-
-# elif defined(HAVE_SSPISSL)
- return (NULL);
-
-# else
- return (NULL);
-# endif /* HAVE_LIBSSL */
-}
-
-
/*
* 'httpDelete()' - Send a DELETE request to the server.
*/
{
#ifdef HAVE_SSL
if (http->tls)
- http_shutdown_ssl(http);
+ http_tls_stop(http);
#endif /* HAVE_SSL */
-#ifdef WIN32
- closesocket(http->fd);
-#else
- close(http->fd);
-#endif /* WIN32 */
+ httpAddrClose(NULL, http->fd);
http->fd = -1;
}
if (!http)
return (0);
- http->encryption = e;
+ if (http->mode == _HTTP_MODE_CLIENT)
+ {
+ http->encryption = e;
- if ((http->encryption == HTTP_ENCRYPTION_ALWAYS && !http->tls) ||
- (http->encryption == HTTP_ENCRYPTION_NEVER && http->tls))
- return (httpReconnect2(http, 30000, NULL));
- else if (http->encryption == HTTP_ENCRYPTION_REQUIRED && !http->tls)
- return (http_upgrade(http));
+ if ((http->encryption == HTTP_ENCRYPTION_ALWAYS && !http->tls) ||
+ (http->encryption == HTTP_ENCRYPTION_NEVER && http->tls))
+ return (httpReconnect2(http, 30000, NULL));
+ else if (http->encryption == HTTP_ENCRYPTION_REQUIRED && !http->tls)
+ return (http_tls_upgrade(http));
+ else
+ return (0);
+ }
else
- return (0);
+ {
+ if (e == HTTP_ENCRYPTION_NEVER && http->tls)
+ return (-1);
+
+ http->encryption = e;
+ if (e != HTTP_ENCRYPTION_IF_REQUESTED && !http->tls)
+ return (http_tls_start(http));
+ else
+ return (0);
+ }
#else
if (e == HTTP_ENCRYPTION_ALWAYS || e == HTTP_ENCRYPTION_REQUIRED)
return (-1);
}
+/*
+ * 'httpFieldValue()' - Return the HTTP field enumeration value for a field
+ * name.
+ */
+
+http_field_t /* O - Field index */
+httpFieldValue(const char *name) /* I - String name */
+{
+ int i; /* Looping var */
+
+
+ for (i = 0; i < HTTP_FIELD_MAX; i ++)
+ if (!_cups_strcasecmp(name, http_fields[i]))
+ return ((http_field_t)i);
+
+ return (HTTP_FIELD_UNKNOWN);
+}
+
+
/*
* 'httpFlush()' - Flush data from a HTTP connection.
*/
DEBUG_printf(("httpFlush(http=%p), state=%s", http,
- http_state_string(http->state)));
+ httpStateString(http->state)));
/*
* Nothing to do if we are in the "waiting" state...
#ifdef HAVE_SSL
if (http->tls)
- http_shutdown_ssl(http);
+ http_tls_stop(http);
#endif /* HAVE_SSL */
-#ifdef WIN32
- closesocket(http->fd);
-#else
- close(http->fd);
-#endif /* WIN32 */
+ httpAddrClose(NULL, http->fd);
http->fd = -1;
}
int /* O - Bytes written or -1 on error */
httpFlushWrite(http_t *http) /* I - HTTP connection */
{
- int bytes; /* Bytes written */
+ ssize_t bytes; /* Bytes written */
DEBUG_printf(("httpFlushWrite(http=%p) data_encoding=%d", http,
- http ? http->data_encoding : -1));
+ http ? http->data_encoding : 100));
if (!http || !http->wused)
{
}
if (http->data_encoding == HTTP_ENCODING_CHUNKED)
- bytes = http_write_chunk(http, http->wbuffer, http->wused);
+ bytes = http_write_chunk(http, http->wbuffer, (size_t)http->wused);
else
- bytes = http_write(http, http->wbuffer, http->wused);
+ bytes = http_write(http, http->wbuffer, (size_t)http->wused);
http->wused = 0;
- DEBUG_printf(("1httpFlushWrite: Returning %d, errno=%d.", bytes, errno));
-
- return (bytes);
-}
-
-
-/*
- * '_httpFreeCredentials()' - Free internal credentials.
- */
-
-void
-_httpFreeCredentials(
- http_tls_credentials_t credentials) /* I - Internal credentials */
-{
- if (!credentials)
- return;
-
-#ifdef HAVE_LIBSSL
- (void)credentials;
-
-#elif defined(HAVE_GNUTLS)
- (void)credentials;
-
-#elif defined(HAVE_CDSASSL)
- CFRelease(credentials);
-
-#elif defined(HAVE_SSPISSL)
- (void)credentials;
+ DEBUG_printf(("1httpFlushWrite: Returning %d, errno=%d.", (int)bytes, errno));
-#endif /* HAVE_LIBSSL */
+ return ((int)bytes);
}
const char * /* O - Content-Coding value or
@code NULL@ for the identity
coding. */
-httpGetContentEncoding(http_t *http) /* I - Connection to client/server */
+httpGetContentEncoding(http_t *http) /* I - HTTP connection */
{
#ifdef HAVE_LIBZ
if (http && http->accept_encoding)
*/
http_status_t /* O - Expect: status, if any */
-httpGetExpect(http_t *http) /* I - Connection to client */
+httpGetExpect(http_t *http) /* I - HTTP connection */
{
if (!http)
return (HTTP_STATUS_ERROR);
DEBUG_printf(("2httpGetLength2(http=%p), state=%s", http,
- http_state_string(http->state)));
+ httpStateString(http->state)));
if (!http)
return (-1);
}
+/*
+ * 'httpGetPending()' - Get the number of bytes that are buffered for writing.
+ *
+ * @since CUPS 2.0@
+ */
+
+size_t /* O - Number of bytes buffered */
+httpGetPending(http_t *http) /* I - HTTP connection */
+{
+ return (http ? (size_t)http->wused : 0);
+}
+
+
/*
* 'httpGetReady()' - Get the number of bytes that can be read without blocking.
*
if (!http)
return (0);
else if (http->used > 0)
- return (http->used);
+ return ((size_t)http->used);
#ifdef HAVE_SSL
else if (http->tls)
- {
- size_t ready; /* Ready bytes */
-
-# ifdef HAVE_LIBSSL
- if ((ready = SSL_pending((SSL *)(http->tls))) > 0)
- return (ready);
-# elif defined(HAVE_GNUTLS)
- if ((ready = gnutls_record_check_pending(http->tls)) > 0)
- return (ready);
-# elif defined(HAVE_CDSASSL)
- if (!SSLGetBufferedReadSize(http->tls, &ready) && ready > 0)
- return (ready);
-# endif /* HAVE_LIBSSL */
- }
+ return (http_tls_pending(http));
#endif /* HAVE_SSL */
return (0);
size_t /* O - Remaining bytes */
httpGetRemaining(http_t *http) /* I - HTTP connection */
{
- return (http ? http->data_remaining : 0);
+ return (http ? (size_t)http->data_remaining : 0);
}
int length, /* I - Max length of buffer */
http_t *http) /* I - HTTP connection */
{
- char *lineptr, /* Pointer into line */
- *lineend, /* End of line */
- *bufptr, /* Pointer into input buffer */
- *bufend; /* Pointer to end of buffer */
- int bytes, /* Number of bytes read */
- eol; /* End-of-line? */
+ char *lineptr, /* Pointer into line */
+ *lineend, /* End of line */
+ *bufptr, /* Pointer into input buffer */
+ *bufend; /* Pointer to end of buffer */
+ ssize_t bytes; /* Number of bytes read */
+ int eol; /* End-of-line? */
DEBUG_printf(("2httpGets(line=%p, length=%d, http=%p)", line, length, http));
return (NULL);
}
- bytes = http_read(http, http->buffer + http->used,
- HTTP_MAX_BUFFER - http->used);
+ bytes = http_read(http, http->buffer + http->used, (size_t)(HTTP_MAX_BUFFER - http->used));
- DEBUG_printf(("4httpGets: read %d bytes.", bytes));
+ DEBUG_printf(("4httpGets: read " CUPS_LLFMT " bytes.", CUPS_LLCAST bytes));
if (bytes < 0)
{
* Yup, update the amount used...
*/
- http->used += bytes;
+ http->used += (int)bytes;
}
/*
http->used -= (int)(bufptr - http->buffer);
if (http->used > 0)
- memmove(http->buffer, bufptr, http->used);
+ memmove(http->buffer, bufptr, (size_t)http->used);
if (eol)
{
#ifdef WIN32
WSADATA winsockdata; /* WinSock data */
#endif /* WIN32 */
-#ifdef HAVE_LIBSSL
- int i; /* Looping var */
- unsigned char data[1024]; /* Seed data */
-#endif /* HAVE_LIBSSL */
_cupsGlobalLock();
# endif /* !SO_NOSIGPIPE */
#endif /* WIN32 */
-#ifdef HAVE_GNUTLS
- /*
- * Initialize GNU TLS...
- */
-
- gnutls_global_init();
-
-#elif defined(HAVE_LIBSSL)
- /*
- * Initialize OpenSSL...
- */
-
- SSL_load_error_strings();
- SSL_library_init();
-
- /*
- * Using the current time is a dubious random seed, but on some systems
- * it is the best we can do (on others, this seed isn't even used...)
- */
-
- CUPS_SRAND(time(NULL));
-
- for (i = 0; i < sizeof(data); i ++)
- data[i] = CUPS_RAND();
-
- RAND_seed(data, sizeof(data));
-#endif /* HAVE_GNUTLS */
+# ifdef HAVE_SSL
+ http_tls_initialize();
+# endif /* HAVE_SSL */
initialized = 1;
_cupsGlobalUnlock();
http->state = HTTP_STATE_STATUS;
DEBUG_printf(("1httpPeek: 0-length chunk, set state to %s.",
- http_state_string(http->state)));
+ httpStateString(http->state)));
/*
* Prevent future reads for this request...
}
}
- if (http->data_remaining > sizeof(http->buffer))
+ if ((size_t)http->data_remaining > sizeof(http->buffer))
buflen = sizeof(http->buffer);
else
- buflen = http->data_remaining;
+ buflen = (ssize_t)http->data_remaining;
DEBUG_printf(("2httpPeek: Reading %d bytes into buffer.", (int)buflen));
- bytes = http_read(http, http->buffer, buflen);
+ bytes = http_read(http, http->buffer, (size_t)buflen);
DEBUG_printf(("2httpPeek: Read " CUPS_LLFMT " bytes into buffer.",
CUPS_LLCAST bytes));
http_debug_hex("httpPeek", http->buffer, (int)bytes);
#endif /* DEBUG */
- http->used = bytes;
+ http->used = (int)bytes;
}
}
http->stream.next_in = http->dbuffer;
- if (buflen > http->data_remaining)
- buflen = http->data_remaining;
+ if (buflen > (size_t)http->data_remaining)
+ buflen = (size_t)http->data_remaining;
- if (buflen > http->used)
- buflen = http->used;
+ if (buflen > (size_t)http->used)
+ buflen = (size_t)http->used;
DEBUG_printf(("1httpPeek: Copying %d more bytes of data into "
"decompression buffer.", (int)buflen));
http->data_remaining -= buflen;
if (http->used > 0)
- memmove(http->buffer, http->buffer + buflen, http->used);
+ memmove(http->buffer, http->buffer + buflen, (size_t)http->used);
}
DEBUG_printf(("2httpPeek: length=%d, avail_in=%d", (int)length,
}
stream.next_out = (Bytef *)buffer;
- stream.avail_out = length;
+ stream.avail_out = (uInt)length;
zerr = inflate(&stream, Z_SYNC_FLUSH);
inflateEnd(&stream);
{
DEBUG_printf(("2httpPeek: zerr=%d", zerr));
#ifdef DEBUG
- http_debug_hex("2httpPeek", (char *)http->dbuffer,
- http->stream.avail_in);
+ http_debug_hex("2httpPeek", (char *)http->dbuffer, (int)http->stream.avail_in);
#endif /* DEBUG */
http->error = EIO;
return (-1);
}
- bytes = length - http->stream.avail_out;
+ bytes = (ssize_t)(length - http->stream.avail_out);
# else
DEBUG_puts("2httpPeek: No inflateCopy on this platform, httpPeek does not "
return (bytes);
}
-/* For OS X 10.8 and earlier */
-ssize_t _httpPeek(http_t *http, char *buffer, size_t length)
-{ return (httpPeek(http, buffer, length)); }
-
/*
* 'httpPost()' - Send a POST request to the server.
const char *format, /* I - printf-style format string */
...) /* I - Additional args as needed */
{
- int bytes; /* Number of bytes to write */
+ ssize_t bytes; /* Number of bytes to write */
char buf[16384]; /* Buffer for formatted string */
va_list ap; /* Variable argument pointer */
bytes = vsnprintf(buf, sizeof(buf), format, ap);
va_end(ap);
- DEBUG_printf(("3httpPrintf: (%d bytes) %s", bytes, buf));
+ DEBUG_printf(("3httpPrintf: (" CUPS_LLFMT " bytes) %s", CUPS_LLCAST bytes, buf));
if (http->data_encoding == HTTP_ENCODING_FIELDS)
- return (httpWrite2(http, buf, bytes));
+ return ((int)httpWrite2(http, buf, (size_t)bytes));
else
{
if (http->wused)
return (-1);
}
- return (http_write(http, buf, bytes));
+ return ((int)http_write(http, buf, (size_t)bytes));
}
}
char *buffer, /* I - Buffer for data */
int length) /* I - Maximum number of bytes */
{
- return ((int)httpRead2(http, buffer, length));
+ return ((int)httpRead2(http, buffer, (size_t)length));
}
(int)http->stream.avail_in, (int)length));
http->stream.next_out = (Bytef *)buffer;
- http->stream.avail_out = length;
+ http->stream.avail_out = (uInt)length;
if ((zerr = inflate(&(http->stream), Z_SYNC_FLUSH)) < Z_OK)
{
DEBUG_printf(("2httpRead2: zerr=%d", zerr));
#ifdef DEBUG
- http_debug_hex("2httpRead2", (char *)http->dbuffer,
- http->stream.avail_in);
+ http_debug_hex("2httpRead2", (char *)http->dbuffer, (int)http->stream.avail_in);
#endif /* DEBUG */
http->error = EIO;
return (-1);
}
- bytes = length - http->stream.avail_out;
+ bytes = (ssize_t)(length - http->stream.avail_out);
DEBUG_printf(("2httpRead2: avail_in=%d, avail_out=%d, bytes=%d",
http->stream.avail_in, http->stream.avail_out,
if (bytes == 0)
{
- ssize_t buflen = HTTP_MAX_BUFFER - http->stream.avail_in;
+ ssize_t buflen = HTTP_MAX_BUFFER - (ssize_t)http->stream.avail_in;
/* Additional bytes for buffer */
if (buflen > 0)
if (http->data_remaining > 0)
{
if (buflen > http->data_remaining)
- buflen = http->data_remaining;
+ buflen = (ssize_t)http->data_remaining;
- bytes = http_read_buffered(http,
- (char *)http->dbuffer +
- http->stream.avail_in, buflen);
+ bytes = http_read_buffered(http, (char *)http->dbuffer + http->stream.avail_in, (size_t)buflen);
}
else if (http->data_encoding == HTTP_ENCODING_CHUNKED)
- bytes = http_read_chunk(http,
- (char *)http->dbuffer +
- http->stream.avail_in, buflen);
+ bytes = http_read_chunk(http, (char *)http->dbuffer + http->stream.avail_in, (size_t)buflen);
else
bytes = 0;
"decompression buffer.", CUPS_LLCAST bytes));
http->data_remaining -= bytes;
- http->stream.avail_in += bytes;
+ http->stream.avail_in += (uInt)bytes;
if (http->data_remaining <= 0 &&
http->data_encoding == HTTP_ENCODING_CHUNKED)
http->state = HTTP_STATE_STATUS;
DEBUG_printf(("1httpRead2: End of content, set state to %s.",
- http_state_string(http->state)));
- }
-
- return (bytes);
-}
-
-
-#if defined(HAVE_SSL) && defined(HAVE_CDSASSL)
-/*
- * '_httpReadCDSA()' - Read function for the CDSA library.
- */
-
-OSStatus /* O - -1 on error, 0 on success */
-_httpReadCDSA(
- SSLConnectionRef connection, /* I - SSL/TLS connection */
- void *data, /* I - Data buffer */
- size_t *dataLength) /* IO - Number of bytes */
-{
- OSStatus result; /* Return value */
- ssize_t bytes; /* Number of bytes read */
- http_t *http; /* HTTP connection */
-
-
- http = (http_t *)connection;
-
- if (!http->blocking)
- {
- /*
- * Make sure we have data before we read...
- */
-
- while (!_httpWait(http, http->wait_value, 0))
- {
- if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
- continue;
-
- http->error = ETIMEDOUT;
- return (-1);
- }
- }
-
- do
- {
- bytes = recv(http->fd, data, *dataLength, 0);
- }
- while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
-
- if (bytes == *dataLength)
- {
- result = 0;
- }
- else if (bytes > 0)
- {
- *dataLength = bytes;
- result = errSSLWouldBlock;
- }
- else
- {
- *dataLength = 0;
-
- if (bytes == 0)
- result = errSSLClosedGraceful;
- else if (errno == EAGAIN)
- result = errSSLWouldBlock;
- else
- result = errSSLClosedAbort;
- }
-
- return (result);
-}
-#endif /* HAVE_SSL && HAVE_CDSASSL */
-
-
-#if defined(HAVE_SSL) && defined(HAVE_GNUTLS)
-/*
- * '_httpReadGNUTLS()' - Read function for the GNU TLS library.
- */
-
-ssize_t /* O - Number of bytes read or -1 on error */
-_httpReadGNUTLS(
- gnutls_transport_ptr ptr, /* I - HTTP connection */
- void *data, /* I - Buffer */
- size_t length) /* I - Number of bytes to read */
-{
- http_t *http; /* HTTP connection */
- ssize_t bytes; /* Bytes read */
-
-
- DEBUG_printf(("6_httpReadGNUTLS(ptr=%p, data=%p, length=%d)", ptr, data, (int)length));
-
- http = (http_t *)ptr;
-
- if (!http->blocking)
- {
- /*
- * Make sure we have data before we read...
- */
-
- while (!_httpWait(http, http->wait_value, 0))
- {
- if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
- continue;
-
- http->error = ETIMEDOUT;
- return (-1);
- }
+ httpStateString(http->state)));
}
- bytes = recv(http->fd, data, length, 0);
- DEBUG_printf(("6_httpReadGNUTLS: bytes=%d", (int)bytes));
return (bytes);
}
-#endif /* HAVE_SSL && HAVE_GNUTLS */
/*
else if (http->state != HTTP_STATE_WAITING)
{
DEBUG_printf(("1httpReadRequest: Bad state %s, returning HTTP_STATE_ERROR.",
- http_state_string(http->state)));
+ httpStateString(http->state)));
return (HTTP_STATE_ERROR);
}
if (!*req_uri)
{
DEBUG_puts("1httpReadRequest: No request URI.");
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No request URI."), 1);
return (HTTP_STATE_ERROR);
}
if (!*req_version)
{
DEBUG_puts("1httpReadRequest: No request protocol version.");
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("No request protocol version."), 1);
return (HTTP_STATE_ERROR);
}
else
{
DEBUG_printf(("1httpReadRequest: Unknown method \"%s\".", req_method));
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unknown request method."), 1);
return (HTTP_STATE_UNKNOWN_METHOD);
}
DEBUG_printf(("1httpReadRequest: Set state to %s.",
- http_state_string(http->state)));
+ httpStateString(http->state)));
if (!strcmp(req_version, "HTTP/1.0"))
{
else
{
DEBUG_printf(("1httpReadRequest: Unknown version \"%s\".", req_version));
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unknown request version."), 1);
return (HTTP_STATE_UNKNOWN_VERSION);
}
if (http->tls)
{
DEBUG_puts("2httpReconnect2: Shutting down SSL/TLS...");
- http_shutdown_ssl(http);
+ http_tls_stop(http);
}
#endif /* HAVE_SSL */
{
DEBUG_printf(("2httpReconnect2: Closing socket %d...", http->fd));
-#ifdef WIN32
- closesocket(http->fd);
-#else
- close(http->fd);
-#endif /* WIN32 */
+ httpAddrClose(NULL, http->fd);
http->fd = -1;
}
* Always do encryption via SSL.
*/
- if (http_setup_ssl(http) != 0)
+ if (http_tls_start(http) != 0)
{
-# ifdef WIN32
- closesocket(http->fd);
-# else
- close(http->fd);
-# endif /* WIN32 */
+ httpAddrClose(NULL, http->fd);
return (-1);
}
}
else if (http->encryption == HTTP_ENCRYPTION_REQUIRED && !http->tls_upgrade)
- return (http_upgrade(http));
+ return (http_tls_upgrade(http));
#endif /* HAVE_SSL */
DEBUG_printf(("1httpReconnect2: Connected to %s:%d...",
* Set the current authorization string...
*/
- int len = (int)strlen(scheme) + (data ? (int)strlen(data) + 1 : 0) + 1;
+ size_t len = strlen(scheme) + (data ? strlen(data) + 1 : 0) + 1;
char *temp;
- if (len > (int)sizeof(http->_authstring))
+ if (len > sizeof(http->_authstring))
{
if ((temp = malloc(len)) == NULL)
len = sizeof(http->_authstring);
return;
if (http->tls)
- http_shutdown_ssl(http);
+ http_tls_stop(http);
shutdown(http->fd, SHUT_RD);
}
DEBUG_printf(("_httpUpdate(http=%p, status=%p), state=%s", http, status,
- http_state_string(http->state)));
+ httpStateString(http->state)));
/*
* Grab a single line from the connection...
#ifdef HAVE_SSL
if (http->status == HTTP_STATUS_SWITCHING_PROTOCOLS && !http->tls)
{
- if (http_setup_ssl(http) != 0)
+ if (http_tls_start(http) != 0)
{
-# ifdef WIN32
- closesocket(http->fd);
-# else
- close(http->fd);
-# endif /* WIN32 */
+ httpAddrClose(NULL, http->fd);
*status = http->status = HTTP_STATUS_ERROR;
return (0);
http->state ++;
DEBUG_printf(("1_httpUpdate: Set state to %s.",
- http_state_string(http->state)));
+ httpStateString(http->state)));
case HTTP_STATE_POST_SEND :
case HTTP_STATE_HEAD :
httpSetCookie(http, value);
}
- else if ((field = http_field(line)) != HTTP_FIELD_UNKNOWN)
+ else if ((field = httpFieldValue(line)) != HTTP_FIELD_UNKNOWN)
httpSetField(http, field, value);
#ifdef DEBUG
else
DEBUG_printf(("httpUpdate(http=%p), state=%s", http,
- http_state_string(http->state)));
+ httpStateString(http->state)));
/*
* Flush pending data, if any...
*/
#ifdef HAVE_SSL
- if (http->tls && usessl)
+ if (http->tls && http_tls_pending(http))
{
-# ifdef HAVE_LIBSSL
- if (SSL_pending(http->tls))
- {
- DEBUG_puts("5_httpWait: Return 1 since there is pending SSL data.");
- return (1);
- }
-
-# elif defined(HAVE_GNUTLS)
- if (gnutls_record_check_pending(http->tls))
- {
- DEBUG_puts("5_httpWait: Return 1 since there is pending SSL data.");
- return (1);
- }
-
-# elif defined(HAVE_CDSASSL)
- size_t bytes; /* Bytes that are available */
-
- if (!SSLGetBufferedReadSize(http->tls, &bytes) &&
- bytes > 0)
- {
- DEBUG_puts("5_httpWait: Return 1 since there is pending SSL data.");
- return (1);
- }
-# endif /* HAVE_LIBSSL */
+ DEBUG_puts("5_httpWait: Return 1 since there is pending TLS data.");
+ return (1);
}
#endif /* HAVE_SSL */
const char *buffer, /* I - Buffer for data */
int length) /* I - Number of bytes to write */
{
- return ((int)httpWrite2(http, buffer, length));
+ return ((int)httpWrite2(http, buffer, (size_t)length));
}
else
{
http->stream.next_in = (Bytef *)buffer;
- http->stream.avail_in = length;
+ http->stream.avail_in = (uInt)length;
http->stream.next_out = (Bytef *)http->wbuffer + http->wused;
- http->stream.avail_out = sizeof(http->wbuffer) - http->wused;
+ http->stream.avail_out = (uInt)(sizeof(http->wbuffer) - (size_t)http->wused);
while (deflate(&(http->stream), Z_NO_FLUSH) == Z_OK)
{
- http->wused = sizeof(http->wbuffer) - http->stream.avail_out;
+ http->wused = (int)(sizeof(http->wbuffer) - (size_t)http->stream.avail_out);
if (http->stream.avail_out == 0)
{
}
}
- http->wused = sizeof(http->wbuffer) - http->stream.avail_out;
- bytes = length;
+ http->wused = (int)(sizeof(http->wbuffer) - (size_t)http->stream.avail_out);
+ bytes = (ssize_t)length;
}
}
else
#endif /* HAVE_LIBZ */
if (length > 0)
{
- if (http->wused && (length + http->wused) > sizeof(http->wbuffer))
+ if (http->wused && (length + (size_t)http->wused) > sizeof(http->wbuffer))
{
DEBUG_printf(("2httpWrite2: Flushing buffer (wused=%d, length="
CUPS_LLFMT ")", http->wused, CUPS_LLCAST length));
httpFlushWrite(http);
}
- if ((length + http->wused) <= sizeof(http->wbuffer) &&
- length < sizeof(http->wbuffer))
+ if ((length + (size_t)http->wused) <= sizeof(http->wbuffer) && length < sizeof(http->wbuffer))
{
/*
* Write to buffer...
CUPS_LLCAST length));
if (http->data_encoding == HTTP_ENCODING_CHUNKED)
- bytes = (ssize_t)http_write_chunk(http, buffer, (int)length);
+ bytes = (ssize_t)http_write_chunk(http, buffer, length);
else
- bytes = (ssize_t)http_write(http, buffer, (int)length);
+ bytes = (ssize_t)http_write(http, buffer, length);
DEBUG_printf(("2httpWrite2: Wrote " CUPS_LLFMT " bytes...",
CUPS_LLCAST bytes));
if (http->state == HTTP_STATE_POST_RECV)
http->state ++;
- else if (http->state == HTTP_STATE_POST_SEND)
+ else if (http->state == HTTP_STATE_POST_SEND ||
+ http->state == HTTP_STATE_GET_SEND)
http->state = HTTP_STATE_WAITING;
else
http->state = HTTP_STATE_STATUS;
DEBUG_printf(("2httpWrite2: Changed state to %s.",
- http_state_string(http->state)));
+ httpStateString(http->state)));
}
DEBUG_printf(("1httpWrite2: Returning " CUPS_LLFMT ".", CUPS_LLCAST bytes));
}
-#if defined(HAVE_SSL) && defined(HAVE_CDSASSL)
-/*
- * '_httpWriteCDSA()' - Write function for the CDSA library.
- */
-
-OSStatus /* O - -1 on error, 0 on success */
-_httpWriteCDSA(
- SSLConnectionRef connection, /* I - SSL/TLS connection */
- const void *data, /* I - Data buffer */
- size_t *dataLength) /* IO - Number of bytes */
-{
- OSStatus result; /* Return value */
- ssize_t bytes; /* Number of bytes read */
- http_t *http; /* HTTP connection */
-
-
- http = (http_t *)connection;
-
- do
- {
- bytes = write(http->fd, data, *dataLength);
- }
- while (bytes == -1 && (errno == EINTR || errno == EAGAIN));
-
- if (bytes == *dataLength)
- {
- result = 0;
- }
- else if (bytes >= 0)
- {
- *dataLength = bytes;
- result = errSSLWouldBlock;
- }
- else
- {
- *dataLength = 0;
-
- if (errno == EAGAIN)
- result = errSSLWouldBlock;
- else
- result = errSSLClosedAbort;
- }
-
- return (result);
-}
-#endif /* HAVE_SSL && HAVE_CDSASSL */
-
-
-#if defined(HAVE_SSL) && defined(HAVE_GNUTLS)
-/*
- * '_httpWriteGNUTLS()' - Write function for the GNU TLS library.
- */
-
-ssize_t /* O - Number of bytes written or -1 on error */
-_httpWriteGNUTLS(
- gnutls_transport_ptr ptr, /* I - HTTP connection */
- const void *data, /* I - Data buffer */
- size_t length) /* I - Number of bytes to write */
-{
- ssize_t bytes; /* Bytes written */
-
-
- DEBUG_printf(("6_httpWriteGNUTLS(ptr=%p, data=%p, length=%d)", ptr, data,
- (int)length));
-#ifdef DEBUG
- http_debug_hex("_httpWriteGNUTLS", data, (int)length);
-#endif /* DEBUG */
-
- bytes = send(((http_t *)ptr)->fd, data, length, 0);
- DEBUG_printf(("_httpWriteGNUTLS: bytes=%d", (int)bytes));
-
- return (bytes);
-}
-#endif /* HAVE_SSL && HAVE_GNUTLS */
-
-
/*
* 'httpWriteResponse()' - Write a HTTP response to a client connection.
*
}
#ifdef HAVE_SSL
- if (status == HTTP_STATUS_UPGRADE_REQUIRED)
+ if (status == HTTP_STATUS_UPGRADE_REQUIRED ||
+ status == HTTP_STATUS_SWITCHING_PROTOCOLS)
{
if (!http->fields[HTTP_FIELD_CONNECTION][0])
httpSetField(http, HTTP_FIELD_CONNECTION, "Upgrade");
if (!http->fields[HTTP_FIELD_UPGRADE][0])
httpSetField(http, HTTP_FIELD_UPGRADE, "TLS/1.2,TLS/1.1,TLS/1.0");
+
+ if (!http->fields[HTTP_FIELD_CONTENT_LENGTH][0])
+ httpSetField(http, HTTP_FIELD_CONTENT_LENGTH, "0");
}
#endif /* HAVE_SSL */
if (http->cookie)
{
- if (httpPrintf(http, "Set-Cookie: %s path=/%s\r\n", http->cookie,
- http->tls ? " secure" : "") < 1)
+ if (httpPrintf(http, "Set-Cookie: %s path=/ httponly%s\r\n",
+ http->cookie, http->tls ? " secure" : "") < 1)
{
http->status = HTTP_STATUS_ERROR;
return (-1);
return (-1);
}
- if (status == HTTP_STATUS_CONTINUE)
+ if (status == HTTP_STATUS_CONTINUE ||
+ status == HTTP_STATUS_SWITCHING_PROTOCOLS)
{
/*
* Restore the old data_encoding and data_length values...
http->state == HTTP_STATE_STATUS)
{
DEBUG_printf(("1httpWriteResponse: Resetting state to HTTP_STATE_WAITING, "
- "was %s.", http_state_string(http->state)));
+ "was %s.", httpStateString(http->state)));
http->state = HTTP_STATE_WAITING;
}
else
http_set_length(http);
+ if (http->data_encoding == HTTP_ENCODING_LENGTH && http->data_remaining == 0)
+ {
+ DEBUG_printf(("1httpWriteResponse: Resetting state to HTTP_STATE_WAITING, "
+ "was %s.", httpStateString(http->state)));
+ http->state = HTTP_STATE_WAITING;
+ return (0);
+ }
+
#ifdef HAVE_LIBZ
/*
* Then start any content encoding...
http_content_coding_start(http,
httpGetField(http, HTTP_FIELD_CONTENT_ENCODING));
#endif /* HAVE_LIBZ */
- }
-
- return (0);
-}
-
-
-#if defined(HAVE_SSL) && defined(HAVE_LIBSSL)
-/*
- * 'http_bio_ctrl()' - Control the HTTP connection.
- */
-
-static long /* O - Result/data */
-http_bio_ctrl(BIO *h, /* I - BIO data */
- int cmd, /* I - Control command */
- long arg1, /* I - First argument */
- void *arg2) /* I - Second argument */
-{
- switch (cmd)
- {
- default :
- return (0);
-
- case BIO_CTRL_RESET :
- h->ptr = NULL;
- return (0);
-
- case BIO_C_SET_FILE_PTR :
- h->ptr = arg2;
- h->init = 1;
- return (1);
-
- case BIO_C_GET_FILE_PTR :
- if (arg2)
- {
- *((void **)arg2) = h->ptr;
- return (1);
- }
- else
- return (0);
-
- case BIO_CTRL_DUP :
- case BIO_CTRL_FLUSH :
- return (1);
- }
-}
-
-
-/*
- * 'http_bio_free()' - Free OpenSSL data.
- */
-
-static int /* O - 1 on success, 0 on failure */
-http_bio_free(BIO *h) /* I - BIO data */
-{
- if (!h)
- return (0);
-
- if (h->shutdown)
- {
- h->init = 0;
- h->flags = 0;
- }
-
- return (1);
-}
-
-
-/*
- * 'http_bio_new()' - Initialize an OpenSSL BIO structure.
- */
-
-static int /* O - 1 on success, 0 on failure */
-http_bio_new(BIO *h) /* I - BIO data */
-{
- if (!h)
- return (0);
-
- h->init = 0;
- h->num = 0;
- h->ptr = NULL;
- h->flags = 0;
-
- return (1);
-}
-
-
-/*
- * 'http_bio_puts()' - Send a string for OpenSSL.
- */
-
-static int /* O - Bytes written */
-http_bio_puts(BIO *h, /* I - BIO data */
- const char *str) /* I - String to write */
-{
-#ifdef WIN32
- return (send(((http_t *)h->ptr)->fd, str, (int)strlen(str), 0));
-#else
- return (send(((http_t *)h->ptr)->fd, str, strlen(str), 0));
-#endif /* WIN32 */
-}
-
-/*
- * 'http_bio_read()' - Read data for OpenSSL.
- */
-
-static int /* O - Bytes read */
-http_bio_read(BIO *h, /* I - BIO data */
- char *buf, /* I - Buffer */
- int size) /* I - Number of bytes to read */
-{
- http_t *http; /* HTTP connection */
-
-
- http = (http_t *)h->ptr;
-
- if (!http->blocking)
- {
- /*
- * Make sure we have data before we read...
- */
-
- while (!_httpWait(http, http->wait_value, 0))
- {
- if (http->timeout_cb && (*http->timeout_cb)(http, http->timeout_data))
- continue;
-
-#ifdef WIN32
- http->error = WSAETIMEDOUT;
-#else
- http->error = ETIMEDOUT;
-#endif /* WIN32 */
-
- return (-1);
- }
}
- return (recv(http->fd, buf, size, 0));
-}
-
-
-/*
- * 'http_bio_write()' - Write data for OpenSSL.
- */
-
-static int /* O - Bytes written */
-http_bio_write(BIO *h, /* I - BIO data */
- const char *buf, /* I - Buffer to write */
- int num) /* I - Number of bytes to write */
-{
- return (send(((http_t *)h->ptr)->fd, buf, num, 0));
+ return (0);
}
-#endif /* HAVE_SSL && HAVE_LIBSSL */
#ifdef HAVE_LIBZ
http_t *http) /* I - HTTP connection */
{
int zerr; /* Compression status */
+ Byte dummy[1]; /* Dummy read buffer */
switch (http->coding)
{
case _HTTP_CODING_DEFLATE :
case _HTTP_CODING_GZIP :
+ http->stream.next_in = dummy;
+ http->stream.avail_in = 0;
+
do
{
http->stream.next_out = (Bytef *)http->wbuffer + http->wused;
- http->stream.avail_out = sizeof(http->wbuffer) - http->wused;
+ http->stream.avail_out = (uInt)(sizeof(http->wbuffer) - (size_t)http->wused);
zerr = deflate(&(http->stream), Z_FINISH);
- http->wused = sizeof(http->wbuffer) - http->stream.avail_out;
+ http->wused = (int)(sizeof(http->wbuffer) - (size_t)http->stream.avail_out);
if (http->wused == sizeof(http->wbuffer))
httpFlushWrite(http);
}
return (http);
}
-/* For OS X 10.8 and earlier */
-http_t *_httpCreate(const char *host, int port, http_addrlist_t *addrlist,
- http_encryption_t encryption, int family)
-{ return (http_create(host, port, addrlist, family, encryption, 1,
- _HTTP_MODE_CLIENT)); }
-
#ifdef DEBUG
/*
if (ch < ' ' || ch >= 127)
ch = '.';
- *ptr++ = ch;
+ *ptr++ = (char)ch;
}
*ptr = '\0';
#endif /* DEBUG */
-/*
- * 'http_field()' - Return the field index for a field name.
- */
-
-static http_field_t /* O - Field index */
-http_field(const char *name) /* I - String name */
-{
- int i; /* Looping var */
-
-
- for (i = 0; i < HTTP_FIELD_MAX; i ++)
- if (_cups_strcasecmp(name, http_fields[i]) == 0)
- return ((http_field_t)i);
-
- return (HTTP_FIELD_UNKNOWN);
-}
-
-
/*
* 'http_read()' - Read a buffer from a HTTP connection.
*
{
#ifdef HAVE_SSL
if (http->tls)
- bytes = http_read_ssl(http, buffer, length);
+ bytes = http_tls_read(http, buffer, (int)length);
else
#endif /* HAVE_SSL */
bytes = recv(http->fd, buffer, length, 0);
if (http->used > 0)
{
if (length > (size_t)http->used)
- bytes = (size_t)http->used;
+ bytes = (ssize_t)http->used;
else
- bytes = length;
+ bytes = (ssize_t)length;
DEBUG_printf(("2http_read: Grabbing %d bytes from input buffer.",
(int)bytes));
- memcpy(buffer, http->buffer, bytes);
+ memcpy(buffer, http->buffer, (size_t)bytes);
http->used -= (int)bytes;
if (http->used > 0)
- memmove(http->buffer, http->buffer + bytes, http->used);
+ memmove(http->buffer, http->buffer + bytes, (size_t)http->used);
}
else
bytes = http_read(http, buffer, length);
}
-#ifdef HAVE_SSL
-/*
- * 'http_read_ssl()' - Read from a SSL/TLS connection.
- */
-
-static int /* O - Bytes read */
-http_read_ssl(http_t *http, /* I - HTTP connection */
- char *buf, /* I - Buffer to store data */
- int len) /* I - Length of buffer */
-{
-# if defined(HAVE_LIBSSL)
- return (SSL_read((SSL *)(http->tls), buf, len));
-
-# elif defined(HAVE_GNUTLS)
- ssize_t result; /* Return value */
-
-
- result = gnutls_record_recv(http->tls, buf, len);
-
- if (result < 0 && !errno)
- {
- /*
- * Convert GNU TLS error to errno value...
- */
-
- switch (result)
- {
- case GNUTLS_E_INTERRUPTED :
- errno = EINTR;
- break;
-
- case GNUTLS_E_AGAIN :
- errno = EAGAIN;
- break;
-
- default :
- errno = EPIPE;
- break;
- }
-
- result = -1;
- }
-
- return ((int)result);
-
-# elif defined(HAVE_CDSASSL)
- int result; /* Return value */
- OSStatus error; /* Error info */
- size_t processed; /* Number of bytes processed */
-
-
- error = SSLRead(http->tls, buf, len, &processed);
- DEBUG_printf(("6http_read_ssl: error=%d, processed=%d", (int)error,
- (int)processed));
- switch (error)
- {
- case 0 :
- result = (int)processed;
- break;
-
- case errSSLWouldBlock :
- if (processed)
- result = (int)processed;
- else
- {
- result = -1;
- errno = EINTR;
- }
- break;
-
- case errSSLClosedGraceful :
- default :
- if (processed)
- result = (int)processed;
- else
- {
- result = -1;
- errno = EPIPE;
- }
- break;
- }
-
- return (result);
-
-# elif defined(HAVE_SSPISSL)
- return _sspiRead((_sspi_struct_t*) http->tls, buf, len);
-# endif /* HAVE_LIBSSL */
-}
-#endif /* HAVE_SSL */
-
-
/*
* 'http_send()' - Send a request with all fields and the trailing blank line.
*/
}
-#ifdef HAVE_SSL
-# if defined(HAVE_CDSASSL)
-/*
- * 'http_set_credentials()' - Set the SSL/TLS credentials.
- */
-
-static int /* O - Status of connection */
-http_set_credentials(http_t *http) /* I - HTTP connection */
-{
- _cups_globals_t *cg = _cupsGlobals(); /* Pointer to library globals */
- OSStatus error = 0; /* Error code */
- http_tls_credentials_t credentials = NULL;
- /* TLS credentials */
-
-
- DEBUG_printf(("7http_set_credentials(%p)", http));
-
- /*
- * Prefer connection specific credentials...
- */
-
- if ((credentials = http->tls_credentials) == NULL)
- credentials = cg->tls_credentials;
-
- if (credentials)
- {
- error = SSLSetCertificate(http->tls, credentials);
- DEBUG_printf(("4http_set_credentials: SSLSetCertificate, error=%d",
- (int)error));
- }
- else
- DEBUG_puts("4http_set_credentials: No credentials to set.");
-
- return (error);
-}
-# endif /* HAVE_CDSASSL */
-#endif /* HAVE_SSL */
-
-
/*
* 'http_set_length()' - Set the data_encoding and data_remaining values.
*/
DEBUG_printf(("http_set_length(http=%p) mode=%d state=%s", http, http->mode,
- http_state_string(http->state)));
+ httpStateString(http->state)));
if ((remaining = httpGetLength2(http)) >= 0)
{
http->data_remaining = remaining;
if (remaining <= INT_MAX)
- http->_data_remaining = remaining;
+ http->_data_remaining = (int)remaining;
else
http->_data_remaining = INT_MAX;
}
#ifdef HAVE_SSL
/*
- * 'http_setup_ssl()' - Set up SSL/TLS support on a connection.
- */
-
-static int /* O - 0 on success, -1 on failure */
-http_setup_ssl(http_t *http) /* I - HTTP connection */
-{
- char hostname[256], /* Hostname */
- *hostptr; /* Pointer into hostname */
-
-# ifdef HAVE_LIBSSL
- SSL_CTX *context; /* Context for encryption */
- BIO *bio; /* BIO data */
- const char *message = NULL;/* Error message */
-# elif defined(HAVE_GNUTLS)
- int status; /* Status of handshake */
- gnutls_certificate_client_credentials *credentials;
- /* TLS credentials */
-# elif defined(HAVE_CDSASSL)
- _cups_globals_t *cg = _cupsGlobals();
- /* Pointer to library globals */
- OSStatus error; /* Error code */
- const char *message = NULL;/* Error message */
- cups_array_t *credentials; /* Credentials array */
- cups_array_t *names; /* CUPS distinguished names */
- CFArrayRef dn_array; /* CF distinguished names array */
- CFIndex count; /* Number of credentials */
- CFDataRef data; /* Certificate data */
- int i; /* Looping var */
- http_credential_t *credential; /* Credential data */
-# elif defined(HAVE_SSPISSL)
- TCHAR username[256]; /* Username returned from GetUserName() */
- TCHAR commonName[256];/* Common name for certificate */
- DWORD dwSize; /* 32 bit size */
-# endif /* HAVE_LIBSSL */
-
-
- DEBUG_printf(("7http_setup_ssl(http=%p)", http));
-
- /*
- * Get the hostname to use for SSL...
- */
-
- if (httpAddrLocalhost(http->hostaddr))
- {
- strlcpy(hostname, "localhost", sizeof(hostname));
- }
- else
- {
- /*
- * Otherwise make sure the hostname we have does not end in a trailing dot.
- */
-
- strlcpy(hostname, http->hostname, sizeof(hostname));
- if ((hostptr = hostname + strlen(hostname) - 1) >= hostname &&
- *hostptr == '.')
- *hostptr = '\0';
- }
-
-# ifdef HAVE_LIBSSL
- context = SSL_CTX_new(SSLv23_client_method());
-
- SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); /* Only use SSLv3 or TLS */
-
- bio = BIO_new(_httpBIOMethods());
- BIO_ctrl(bio, BIO_C_SET_FILE_PTR, 0, (char *)http);
-
- http->tls = SSL_new(context);
- SSL_set_bio(http->tls, bio, bio);
-
-# ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
- SSL_set_tlsext_host_name(http->tls, hostname);
-# endif /* HAVE_SSL_SET_TLSEXT_HOST_NAME */
-
- if (SSL_connect(http->tls) != 1)
- {
- unsigned long error; /* Error code */
-
- while ((error = ERR_get_error()) != 0)
- {
- message = ERR_error_string(error, NULL);
- DEBUG_printf(("8http_setup_ssl: %s", message));
- }
-
- SSL_CTX_free(context);
- SSL_free(http->tls);
- http->tls = NULL;
-
-# ifdef WIN32
- http->error = WSAGetLastError();
-# else
- http->error = errno;
-# endif /* WIN32 */
- http->status = HTTP_STATUS_ERROR;
-
- if (!message)
- message = _("Unable to establish a secure connection to host.");
-
- _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, message, 1);
-
- return (-1);
- }
-
-# elif defined(HAVE_GNUTLS)
- credentials = (gnutls_certificate_client_credentials *)
- malloc(sizeof(gnutls_certificate_client_credentials));
- if (credentials == NULL)
- {
- DEBUG_printf(("8http_setup_ssl: Unable to allocate credentials: %s",
- strerror(errno)));
- http->error = errno;
- http->status = HTTP_STATUS_ERROR;
- _cupsSetHTTPError(HTTP_STATUS_ERROR);
-
- return (-1);
- }
-
- gnutls_certificate_allocate_credentials(credentials);
-
- gnutls_init(&http->tls, GNUTLS_CLIENT);
- gnutls_set_default_priority(http->tls);
- gnutls_server_name_set(http->tls, GNUTLS_NAME_DNS, hostname,
- strlen(hostname));
- gnutls_credentials_set(http->tls, GNUTLS_CRD_CERTIFICATE, *credentials);
- gnutls_transport_set_ptr(http->tls, (gnutls_transport_ptr)http);
- gnutls_transport_set_pull_function(http->tls, _httpReadGNUTLS);
- gnutls_transport_set_push_function(http->tls, _httpWriteGNUTLS);
-
- while ((status = gnutls_handshake(http->tls)) != GNUTLS_E_SUCCESS)
- {
- DEBUG_printf(("8http_setup_ssl: gnutls_handshake returned %d (%s)",
- status, gnutls_strerror(status)));
-
- if (gnutls_error_is_fatal(status))
- {
- http->error = EIO;
- http->status = HTTP_STATUS_ERROR;
-
- _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, gnutls_strerror(status), 0);
-
- gnutls_deinit(http->tls);
- gnutls_certificate_free_credentials(*credentials);
- free(credentials);
- http->tls = NULL;
-
- return (-1);
- }
- }
-
- http->tls_credentials = credentials;
-
-# elif defined(HAVE_CDSASSL)
- if ((http->tls = SSLCreateContext(kCFAllocatorDefault, kSSLClientSide,
- kSSLStreamType)) == NULL)
- {
- DEBUG_puts("4http_setup_ssl: SSLCreateContext failed.");
- http->error = errno = ENOMEM;
- http->status = HTTP_STATUS_ERROR;
- _cupsSetHTTPError(HTTP_STATUS_ERROR);
-
- return (-1);
- }
-
- error = SSLSetConnection(http->tls, http);
- DEBUG_printf(("4http_setup_ssl: SSLSetConnection, error=%d", (int)error));
-
- if (!error)
- {
- error = SSLSetIOFuncs(http->tls, _httpReadCDSA, _httpWriteCDSA);
- DEBUG_printf(("4http_setup_ssl: SSLSetIOFuncs, error=%d", (int)error));
- }
-
- if (!error)
- {
- error = SSLSetSessionOption(http->tls, kSSLSessionOptionBreakOnServerAuth,
- true);
- DEBUG_printf(("4http_setup_ssl: SSLSetSessionOption, error=%d",
- (int)error));
- }
-
- if (!error)
- {
- if (cg->client_cert_cb)
- {
- error = SSLSetSessionOption(http->tls,
- kSSLSessionOptionBreakOnCertRequested, true);
- DEBUG_printf(("4http_setup_ssl: kSSLSessionOptionBreakOnCertRequested, "
- "error=%d", (int)error));
- }
- else
- {
- error = http_set_credentials(http);
- DEBUG_printf(("4http_setup_ssl: http_set_credentials, error=%d",
- (int)error));
- }
- }
-
- /*
- * Let the server know which hostname/domain we are trying to connect to
- * in case it wants to serve up a certificate with a matching common name.
- */
-
- if (!error)
- {
- error = SSLSetPeerDomainName(http->tls, hostname, strlen(hostname));
-
- DEBUG_printf(("4http_setup_ssl: SSLSetPeerDomainName, error=%d",
- (int)error));
- }
-
- if (!error)
- {
- int done = 0; /* Are we done yet? */
-
- while (!error && !done)
- {
- error = SSLHandshake(http->tls);
-
- DEBUG_printf(("4http_setup_ssl: SSLHandshake returned %d.", (int)error));
-
- switch (error)
- {
- case noErr :
- done = 1;
- break;
-
- case errSSLWouldBlock :
- error = noErr; /* Force a retry */
- usleep(1000); /* in 1 millisecond */
- break;
-
- case errSSLServerAuthCompleted :
- error = 0;
- if (cg->server_cert_cb)
- {
- error = httpCopyCredentials(http, &credentials);
- if (!error)
- {
- error = (cg->server_cert_cb)(http, http->tls, credentials,
- cg->server_cert_data);
- httpFreeCredentials(credentials);
- }
-
- DEBUG_printf(("4http_setup_ssl: Server certificate callback "
- "returned %d.", (int)error));
- }
- break;
-
- case errSSLClientCertRequested :
- error = 0;
-
- if (cg->client_cert_cb)
- {
- names = NULL;
- if (!(error = SSLCopyDistinguishedNames(http->tls, &dn_array)) &&
- dn_array)
- {
- if ((names = cupsArrayNew(NULL, NULL)) != NULL)
- {
- for (i = 0, count = CFArrayGetCount(dn_array); i < count; i++)
- {
- data = (CFDataRef)CFArrayGetValueAtIndex(dn_array, i);
-
- if ((credential = malloc(sizeof(*credential))) != NULL)
- {
- credential->datalen = CFDataGetLength(data);
- if ((credential->data = malloc(credential->datalen)))
- {
- memcpy((void *)credential->data, CFDataGetBytePtr(data),
- credential->datalen);
- cupsArrayAdd(names, credential);
- }
- else
- free(credential);
- }
- }
- }
-
- CFRelease(dn_array);
- }
-
- if (!error)
- {
- error = (cg->client_cert_cb)(http, http->tls, names,
- cg->client_cert_data);
-
- DEBUG_printf(("4http_setup_ssl: Client certificate callback "
- "returned %d.", (int)error));
- }
-
- httpFreeCredentials(names);
- }
- break;
-
- case errSSLUnknownRootCert :
- message = _("Unable to establish a secure connection to host "
- "(untrusted certificate).");
- break;
-
- case errSSLNoRootCert :
- message = _("Unable to establish a secure connection to host "
- "(self-signed certificate).");
- break;
-
- case errSSLCertExpired :
- message = _("Unable to establish a secure connection to host "
- "(expired certificate).");
- break;
-
- case errSSLCertNotYetValid :
- message = _("Unable to establish a secure connection to host "
- "(certificate not yet valid).");
- break;
-
- case errSSLHostNameMismatch :
- message = _("Unable to establish a secure connection to host "
- "(host name mismatch).");
- break;
-
- case errSSLXCertChainInvalid :
- message = _("Unable to establish a secure connection to host "
- "(certificate chain invalid).");
- break;
-
- case errSSLConnectionRefused :
- message = _("Unable to establish a secure connection to host "
- "(peer dropped connection before responding).");
- break;
-
- default :
- break;
- }
- }
- }
-
- if (error)
- {
- http->error = error;
- http->status = HTTP_STATUS_ERROR;
- errno = ECONNREFUSED;
-
- CFRelease(http->tls);
- http->tls = NULL;
-
- /*
- * If an error string wasn't set by the callbacks use a generic one...
- */
-
- if (!message)
-#ifdef HAVE_CSSMERRORSTRING
- message = cssmErrorString(error);
-#else
- message = _("Unable to establish a secure connection to host.");
-#endif /* HAVE_CSSMERRORSTRING */
-
- _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, message, 1);
-
- return (-1);
- }
-
-# elif defined(HAVE_SSPISSL)
- http->tls = _sspiAlloc();
-
- if (!http->tls)
- {
- _cupsSetHTTPError(HTTP_STATUS_ERROR);
- return (-1);
- }
-
- http->tls->sock = http->fd;
- dwSize = sizeof(username) / sizeof(TCHAR);
- GetUserName(username, &dwSize);
- _sntprintf_s(commonName, sizeof(commonName) / sizeof(TCHAR),
- sizeof(commonName) / sizeof(TCHAR), TEXT("CN=%s"), username);
-
- if (!_sspiGetCredentials(http->tls_credentials, L"ClientContainer",
- commonName, FALSE))
- {
- _sspiFree(http->tls_credentials);
- http->tls_credentials = NULL;
-
- http->error = EIO;
- http->status = HTTP_STATUS_ERROR;
-
- _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI,
- _("Unable to establish a secure connection to host."), 1);
-
- return (-1);
- }
-
- _sspiSetAllowsAnyRoot(http->tls_credentials, TRUE);
- _sspiSetAllowsExpiredCerts(http->tls_credentials, TRUE);
-
- if (!_sspiConnect(http->tls_credentials, hostname))
- {
- _sspiFree(http->tls_credentials);
- http->tls_credentials = NULL;
-
- http->error = EIO;
- http->status = HTTP_STATUS_ERROR;
-
- _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI,
- _("Unable to establish a secure connection to host."), 1);
-
- return (-1);
- }
-# endif /* HAVE_CDSASSL */
-
- return (0);
-}
-
-
-/*
- * 'http_shutdown_ssl()' - Shut down SSL/TLS on a connection.
- */
-
-static void
-http_shutdown_ssl(http_t *http) /* I - HTTP connection */
-{
-# ifdef HAVE_LIBSSL
- SSL_CTX *context; /* Context for encryption */
-
- context = SSL_get_SSL_CTX(http->tls);
-
- SSL_shutdown(http->tls);
- SSL_CTX_free(context);
- SSL_free(http->tls);
-
-# elif defined(HAVE_GNUTLS)
- gnutls_certificate_client_credentials *credentials;
- /* TLS credentials */
-
- credentials = (gnutls_certificate_client_credentials *)(http->tls_credentials);
-
- gnutls_bye(http->tls, GNUTLS_SHUT_RDWR);
- gnutls_deinit(http->tls);
- gnutls_certificate_free_credentials(*credentials);
- free(credentials);
-
-# elif defined(HAVE_CDSASSL)
- while (SSLClose(http->tls) == errSSLWouldBlock)
- usleep(1000);
-
- CFRelease(http->tls);
-
- if (http->tls_credentials)
- CFRelease(http->tls_credentials);
-
-# elif defined(HAVE_SSPISSL)
- _sspiFree(http->tls_credentials);
-# endif /* HAVE_LIBSSL */
-
- http->tls = NULL;
- http->tls_credentials = NULL;
-}
-#endif /* HAVE_SSL */
-
-
-#ifdef DEBUG
-/*
- * 'http_state_string()' - Return the string associated with a given HTTP state.
- */
-
-static const char * /* O - State string */
-http_state_string(http_state_t state) /* I - HTTP state */
-{
- static char buffer[255]; /* Unknown value buffer */
- static const char * const states[] = /* State strings */
- {
- "HTTP_STATE_ERROR",
- "HTTP_STATE_WAITING",
- "HTTP_STATE_OPTIONS",
- "HTTP_STATE_GET",
- "HTTP_STATE_GET_SEND",
- "HTTP_STATE_HEAD",
- "HTTP_STATE_POST",
- "HTTP_STATE_POST_RECV",
- "HTTP_STATE_POST_SEND",
- "HTTP_STATE_PUT",
- "HTTP_STATE_PUT_RECV",
- "HTTP_STATE_DELETE",
- "HTTP_STATE_TRACE",
- "HTTP_STATE_CONNECT",
- "HTTP_STATE_STATUS",
- "HTTP_STATE_UNKNOWN_METHOD",
- "HTTP_STATE_UNKNOWN_VERSION"
- };
-
- if (state >= HTTP_STATE_ERROR && state <= HTTP_STATE_UNKNOWN_VERSION)
- return (states[state - HTTP_STATE_ERROR]);
-
- snprintf(buffer, sizeof(buffer), "??? %d ???", (int)state);
- return (buffer);
-}
-#endif /* DEBUG */
-
-
-#ifdef HAVE_SSL
-/*
- * 'http_upgrade()' - Force upgrade to TLS encryption.
+ * 'http_tls_upgrade()' - Force upgrade to TLS encryption.
*/
static int /* O - Status of connection */
-http_upgrade(http_t *http) /* I - HTTP connection */
+http_tls_upgrade(http_t *http) /* I - HTTP connection */
{
int ret; /* Return value */
http_t myhttp; /* Local copy of HTTP data */
- DEBUG_printf(("7http_upgrade(%p)", http));
+ DEBUG_printf(("7http_tls_upgrade(%p)", http));
/*
* Flush the connection to make sure any previous "Upgrade" message
* Server does not support HTTP upgrade...
*/
- DEBUG_puts("8http_upgrade: Server does not support HTTP upgrade!");
+ DEBUG_puts("8http_tls_upgrade: Server does not support HTTP upgrade!");
-# ifdef WIN32
- closesocket(http->fd);
-# else
- close(http->fd);
-# endif
+ httpAddrClose(NULL, http->fd);
http->fd = -1;
#ifdef HAVE_SSL
if (http->tls)
- bytes = http_write_ssl(http, buffer, length);
+ bytes = http_tls_write(http, buffer, (int)length);
else
#endif /* HAVE_SSL */
bytes = send(http->fd, buffer, length, 0);
buffer += bytes;
tbytes += bytes;
- length -= bytes;
+ length -= (size_t)bytes;
}
#ifdef DEBUG
- http_debug_hex("http_write", buffer - tbytes, tbytes);
+ http_debug_hex("http_write", buffer - tbytes, (int)tbytes);
#endif /* DEBUG */
DEBUG_printf(("3http_write: Returning " CUPS_LLFMT ".", CUPS_LLCAST tbytes));
}
-#ifdef HAVE_SSL
-/*
- * 'http_write_ssl()' - Write to a SSL/TLS connection.
- */
-
-static int /* O - Bytes written */
-http_write_ssl(http_t *http, /* I - HTTP connection */
- const char *buf, /* I - Buffer holding data */
- int len) /* I - Length of buffer */
-{
- ssize_t result; /* Return value */
-
-
- DEBUG_printf(("2http_write_ssl(http=%p, buf=%p, len=%d)", http, buf, len));
-
-# if defined(HAVE_LIBSSL)
- result = SSL_write((SSL *)(http->tls), buf, len);
-
-# elif defined(HAVE_GNUTLS)
- result = gnutls_record_send(http->tls, buf, len);
-
- if (result < 0 && !errno)
- {
- /*
- * Convert GNU TLS error to errno value...
- */
-
- switch (result)
- {
- case GNUTLS_E_INTERRUPTED :
- errno = EINTR;
- break;
-
- case GNUTLS_E_AGAIN :
- errno = EAGAIN;
- break;
-
- default :
- errno = EPIPE;
- break;
- }
-
- result = -1;
- }
-
-# elif defined(HAVE_CDSASSL)
- OSStatus error; /* Error info */
- size_t processed; /* Number of bytes processed */
-
-
- error = SSLWrite(http->tls, buf, len, &processed);
-
- switch (error)
- {
- case 0 :
- result = (int)processed;
- break;
-
- case errSSLWouldBlock :
- if (processed)
- result = (int)processed;
- else
- {
- result = -1;
- errno = EINTR;
- }
- break;
-
- case errSSLClosedGraceful :
- default :
- if (processed)
- result = (int)processed;
- else
- {
- result = -1;
- errno = EPIPE;
- }
- break;
- }
-# elif defined(HAVE_SSPISSL)
- return _sspiWrite((_sspi_struct_t *)http->tls, (void *)buf, len);
-# endif /* HAVE_LIBSSL */
-
- DEBUG_printf(("3http_write_ssl: Returning %d.", (int)result));
-
- return ((int)result);
-}
-#endif /* HAVE_SSL */
-
-
/*
* End of "$Id$".
*/
projects / thirdparty / cups.git / blobdiff