]> git.ipfire.org Git - thirdparty/cups.git/blobdiff - cups/http.c
Update "since CUPS 2.0" into to mention OS X 10.10.
[thirdparty/cups.git] / cups / http.c
index 1881d50270814efd44277be0ea69d21cfbf104ea..1d6e4f75c5a336cfe4447d9d5c66670c0c47e8cf 100644 (file)
@@ -3,7 +3,7 @@
  *
  * HTTP routines for CUPS.
  *
- * Copyright 2007-2013 by Apple Inc.
+ * Copyright 2007-2014 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * This file contains Kerberos support code, copyright 2006 by
@@ -68,22 +68,7 @@ static void          http_set_timeout(int fd, double timeout);
 static void            http_set_wait(http_t *http);
 
 #ifdef HAVE_SSL
-static size_t          http_tls_pending(http_t *http);
-static int             http_tls_read(http_t *http, char *buf, int len);
-static int             http_tls_set_credentials(http_t *http);
-static int             http_tls_start(http_t *http);
-static void            http_tls_stop(http_t *http);
 static int             http_tls_upgrade(http_t *http);
-static int             http_tls_write(http_t *http, const char *buf, int len);
-#  ifdef HAVE_LIBSSL
-#    include "tls-openssl.c"
-#  elif defined(HAVE_GNUTLS)
-#    include "tls-gnutls.c"
-#  elif defined(HAVE_CDSASSL)
-#    include "tls-darwin.c"
-#  else
-#    include "tls-sspi.c"
-#  endif /* HAVE_LIBSSL */
 #endif /* HAVE_SSL */
 
 
@@ -405,6 +390,30 @@ httpClose(http_t *http)                    /* I - HTTP connection */
 }
 
 
+/*
+ * 'httpCompareCredentials()' - Compare two sets of X.509 credentials.
+ *
+ * @since CUPS 2.0/OS 10.10@
+ */
+
+int                                    /* O - 1 if they match, 0 if they do not */
+httpCompareCredentials(
+    cups_array_t *cred1,               /* I - First set of X.509 credentials */
+    cups_array_t *cred2)               /* I - Second set of X.509 credentials */
+{
+  http_credential_t    *temp1, *temp2; /* Temporary credentials */
+
+
+  for (temp1 = (http_credential_t *)cupsArrayFirst(cred1), temp2 = (http_credential_t *)cupsArrayFirst(cred2); temp1 && temp2; temp1 = (http_credential_t *)cupsArrayNext(cred1), temp2 = (http_credential_t *)cupsArrayNext(cred2))
+    if (temp1->datalen != temp2->datalen)
+      return (0);
+    else if (memcmp(temp1->data, temp2->data, temp1->datalen))
+      return (0);
+
+  return (temp1 == temp2);
+}
+
+
 /*
  * 'httpConnect()' - Connect to a HTTP server.
  *
@@ -515,7 +524,7 @@ _httpDisconnect(http_t *http)               /* I - HTTP connection */
 {
 #ifdef HAVE_SSL
   if (http->tls)
-    http_tls_stop(http);
+    _httpTLSStop(http);
 #endif /* HAVE_SSL */
 
   httpAddrClose(NULL, http->fd);
@@ -557,7 +566,7 @@ httpEncryption(http_t            *http,     /* I - HTTP connection */
 
     http->encryption = e;
     if (e != HTTP_ENCRYPTION_IF_REQUESTED && !http->tls)
-      return (http_tls_start(http));
+      return (_httpTLSStart(http));
     else
       return (0);
   }
@@ -664,7 +673,7 @@ httpFlush(http_t *http)                     /* I - HTTP connection */
 
 #ifdef HAVE_SSL
     if (http->tls)
-      http_tls_stop(http);
+      _httpTLSStop(http);
 #endif /* HAVE_SSL */
 
     httpAddrClose(NULL, http->fd);
@@ -683,11 +692,11 @@ httpFlush(http_t *http)                   /* I - HTTP connection */
 int                                    /* O - Bytes written or -1 on error */
 httpFlushWrite(http_t *http)           /* I - HTTP connection */
 {
-  int  bytes;                          /* Bytes written */
+  ssize_t      bytes;                  /* Bytes written */
 
 
   DEBUG_printf(("httpFlushWrite(http=%p) data_encoding=%d", http,
-                http ? http->data_encoding : -1));
+                http ? http->data_encoding : 100));
 
   if (!http || !http->wused)
   {
@@ -697,15 +706,15 @@ httpFlushWrite(http_t *http)              /* I - HTTP connection */
   }
 
   if (http->data_encoding == HTTP_ENCODING_CHUNKED)
-    bytes = http_write_chunk(http, http->wbuffer, http->wused);
+    bytes = http_write_chunk(http, http->wbuffer, (size_t)http->wused);
   else
-    bytes = http_write(http, http->wbuffer, http->wused);
+    bytes = http_write(http, http->wbuffer, (size_t)http->wused);
 
   http->wused = 0;
 
-  DEBUG_printf(("1httpFlushWrite: Returning %d, errno=%d.", bytes, errno));
+  DEBUG_printf(("1httpFlushWrite: Returning %d, errno=%d.", (int)bytes, errno));
 
-  return (bytes);
+  return ((int)bytes);
 }
 
 
@@ -750,7 +759,7 @@ httpGet(http_t     *http,           /* I - HTTP connection */
  *
  * The return value is the UNIX time of the last read or write.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 time_t                                 /* O - Time of last read or write */
@@ -902,7 +911,7 @@ httpGetCookie(http_t *http)         /* I - HTTP connecion */
  * @link httpIsEncrypted@ function to determine whether a TLS session has
  * been established.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 http_encryption_t                      /* O - Current encryption mode */
@@ -986,7 +995,7 @@ httpGetField(http_t       *http,    /* I - HTTP connection */
 /*
  * 'httpGetKeepAlive()' - Get the current Keep-Alive state of the connection.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 http_keepalive_t                       /* O - Keep-Alive state */
@@ -1095,20 +1104,20 @@ httpGetLength2(http_t *http)            /* I - HTTP connection */
 /*
  * 'httpGetPending()' - Get the number of bytes that are buffered for writing.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 size_t                                 /* O - Number of bytes buffered */
 httpGetPending(http_t *http)           /* I - HTTP connection */
 {
-  return (http ? http->wused : 0);
+  return (http ? (size_t)http->wused : 0);
 }
 
 
 /*
  * 'httpGetReady()' - Get the number of bytes that can be read without blocking.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 size_t                                 /* O - Number of bytes available */
@@ -1117,23 +1126,10 @@ httpGetReady(http_t *http)              /* I - HTTP connection */
   if (!http)
     return (0);
   else if (http->used > 0)
-    return (http->used);
+    return ((size_t)http->used);
 #ifdef HAVE_SSL
   else if (http->tls)
-  {
-    size_t     ready;                  /* Ready bytes */
-
-#  ifdef HAVE_LIBSSL
-    if ((ready = SSL_pending((SSL *)(http->tls))) > 0)
-      return (ready);
-#  elif defined(HAVE_GNUTLS)
-    if ((ready = gnutls_record_check_pending(http->tls)) > 0)
-      return (ready);
-#  elif defined(HAVE_CDSASSL)
-    if (!SSLGetBufferedReadSize(http->tls, &ready) && ready > 0)
-      return (ready);
-#  endif /* HAVE_LIBSSL */
-  }
+    return (_httpTLSPending(http));
 #endif /* HAVE_SSL */
 
   return (0);
@@ -1147,13 +1143,13 @@ httpGetReady(http_t *http)              /* I - HTTP connection */
  * The @link httpIsChunked@ function can be used to determine whether the
  * message body is chunked or fixed-length.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 size_t                                 /* O - Remaining bytes */
 httpGetRemaining(http_t *http)         /* I - HTTP connection */
 {
-  return (http ? http->data_remaining : 0);
+  return (http ? (size_t)http->data_remaining : 0);
 }
 
 
@@ -1166,12 +1162,12 @@ httpGets(char   *line,                  /* I - Line to read into */
          int    length,                        /* I - Max length of buffer */
         http_t *http)                  /* I - HTTP connection */
 {
-  char *lineptr,                       /* Pointer into line */
-       *lineend,                       /* End of line */
-       *bufptr,                        /* Pointer into input buffer */
-       *bufend;                        /* Pointer to end of buffer */
-  int  bytes,                          /* Number of bytes read */
-       eol;                            /* End-of-line? */
+  char         *lineptr,               /* Pointer into line */
+               *lineend,               /* End of line */
+               *bufptr,                /* Pointer into input buffer */
+               *bufend;                /* Pointer to end of buffer */
+  ssize_t      bytes;                  /* Number of bytes read */
+  int          eol;                    /* End-of-line? */
 
 
   DEBUG_printf(("2httpGets(line=%p, length=%d, http=%p)", line, length, http));
@@ -1220,10 +1216,9 @@ httpGets(char   *line,                   /* I - Line to read into */
         return (NULL);
       }
 
-      bytes = http_read(http, http->buffer + http->used,
-                        HTTP_MAX_BUFFER - http->used);
+      bytes = http_read(http, http->buffer + http->used, (size_t)(HTTP_MAX_BUFFER - http->used));
 
-      DEBUG_printf(("4httpGets: read %d bytes.", bytes));
+      DEBUG_printf(("4httpGets: read " CUPS_LLFMT " bytes.", CUPS_LLCAST bytes));
 
       if (bytes < 0)
       {
@@ -1283,7 +1278,7 @@ httpGets(char   *line,                    /* I - Line to read into */
       * Yup, update the amount used...
       */
 
-      http->used += bytes;
+      http->used += (int)bytes;
     }
 
    /*
@@ -1307,7 +1302,7 @@ httpGets(char   *line,                    /* I - Line to read into */
 
     http->used -= (int)(bufptr - http->buffer);
     if (http->used > 0)
-      memmove(http->buffer, bufptr, http->used);
+      memmove(http->buffer, bufptr, (size_t)http->used);
 
     if (eol)
     {
@@ -1539,10 +1534,6 @@ httpInitialize(void)
 #ifdef WIN32
   WSADATA      winsockdata;            /* WinSock data */
 #endif /* WIN32 */
-#ifdef HAVE_LIBSSL
-  int          i;                      /* Looping var */
-  unsigned char        data[1024];             /* Seed data */
-#endif /* HAVE_LIBSSL */
 
 
   _cupsGlobalLock();
@@ -1577,7 +1568,7 @@ httpInitialize(void)
 #endif /* WIN32 */
 
 #  ifdef HAVE_SSL
-  http_tls_initialize();
+  _httpTLSInitialize();
 #  endif /* HAVE_SSL */
 
   initialized = 1;
@@ -1591,7 +1582,7 @@ httpInitialize(void)
  * This function returns non-zero if the message body is composed of
  * variable-length chunks.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 int                                    /* O - 1 if chunked, 0 if not */
@@ -1606,7 +1597,7 @@ httpIsChunked(http_t *http)               /* I - HTTP connection */
  *
  * This function returns non-zero if the connection is currently encrypted.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 int                                    /* O - 1 if encrypted, 0 if not */
@@ -1702,7 +1693,7 @@ httpPeek(http_t *http,                    /* I - HTTP connection */
     */
 
 #ifdef HAVE_LIBZ
-    if (http->coding)
+    if (http->coding >= _HTTP_CODING_GUNZIP)
       http_content_coding_finish(http);
 #endif /* HAVE_LIBZ */
 
@@ -1730,7 +1721,8 @@ httpPeek(http_t *http,                    /* I - HTTP connection */
 
 #ifdef HAVE_LIBZ
   if (http->used == 0 &&
-      (http->coding == _HTTP_CODING_IDENTITY || http->stream.avail_in == 0))
+      (http->coding == _HTTP_CODING_IDENTITY ||
+       (http->coding >= _HTTP_CODING_GUNZIP && http->stream.avail_in == 0)))
 #else
   if (http->used == 0)
 #endif /* HAVE_LIBZ */
@@ -1752,13 +1744,13 @@ httpPeek(http_t *http,                  /* I - HTTP connection */
       }
     }
 
-    if (http->data_remaining > sizeof(http->buffer))
+    if ((size_t)http->data_remaining > sizeof(http->buffer))
       buflen = sizeof(http->buffer);
     else
-      buflen = http->data_remaining;
+      buflen = (ssize_t)http->data_remaining;
 
     DEBUG_printf(("2httpPeek: Reading %d bytes into buffer.", (int)buflen));
-    bytes = http_read(http, http->buffer, buflen);
+    bytes = http_read(http, http->buffer, (size_t)buflen);
 
     DEBUG_printf(("2httpPeek: Read " CUPS_LLFMT " bytes into buffer.",
                   CUPS_LLCAST bytes));
@@ -1768,12 +1760,12 @@ httpPeek(http_t *http,                  /* I - HTTP connection */
       http_debug_hex("httpPeek", http->buffer, (int)bytes);
 #endif /* DEBUG */
 
-      http->used = bytes;
+      http->used = (int)bytes;
     }
   }
 
 #ifdef HAVE_LIBZ
-  if (http->coding)
+  if (http->coding >= _HTTP_CODING_GUNZIP)
   {
 #  ifdef HAVE_INFLATECOPY
     int                zerr;                   /* Decompressor error */
@@ -1785,27 +1777,27 @@ httpPeek(http_t *http,                  /* I - HTTP connection */
                                        /* Number of bytes to copy */
 
       if (http->stream.avail_in > 0 &&
-         http->stream.next_in > http->dbuffer)
-        memmove(http->dbuffer, http->stream.next_in, http->stream.avail_in);
+         http->stream.next_in > http->sbuffer)
+        memmove(http->sbuffer, http->stream.next_in, http->stream.avail_in);
 
-      http->stream.next_in = http->dbuffer;
+      http->stream.next_in = http->sbuffer;
 
-      if (buflen > http->data_remaining)
-        buflen = http->data_remaining;
+      if (buflen > (size_t)http->data_remaining)
+        buflen = (size_t)http->data_remaining;
 
-      if (buflen > http->used)
-        buflen = http->used;
+      if (buflen > (size_t)http->used)
+        buflen = (size_t)http->used;
 
       DEBUG_printf(("1httpPeek: Copying %d more bytes of data into "
                    "decompression buffer.", (int)buflen));
 
-      memcpy(http->dbuffer + http->stream.avail_in, http->buffer, buflen);
+      memcpy(http->sbuffer + http->stream.avail_in, http->buffer, buflen);
       http->stream.avail_in += buflen;
       http->used            -= buflen;
       http->data_remaining  -= buflen;
 
       if (http->used > 0)
-        memmove(http->buffer, http->buffer + buflen, http->used);
+        memmove(http->buffer, http->buffer + buflen, (size_t)http->used);
     }
 
     DEBUG_printf(("2httpPeek: length=%d, avail_in=%d", (int)length,
@@ -1819,7 +1811,7 @@ httpPeek(http_t *http,                    /* I - HTTP connection */
     }
 
     stream.next_out  = (Bytef *)buffer;
-    stream.avail_out = length;
+    stream.avail_out = (uInt)length;
 
     zerr = inflate(&stream, Z_SYNC_FLUSH);
     inflateEnd(&stream);
@@ -1828,15 +1820,14 @@ httpPeek(http_t *http,                  /* I - HTTP connection */
     {
       DEBUG_printf(("2httpPeek: zerr=%d", zerr));
 #ifdef DEBUG
-      http_debug_hex("2httpPeek", (char *)http->dbuffer,
-                    http->stream.avail_in);
+      http_debug_hex("2httpPeek", (char *)http->sbuffer, (int)http->stream.avail_in);
 #endif /* DEBUG */
 
       http->error = EIO;
       return (-1);
     }
 
-    bytes = length - http->stream.avail_out;
+    bytes = (ssize_t)(length - http->stream.avail_out);
 
 #  else
     DEBUG_puts("2httpPeek: No inflateCopy on this platform, httpPeek does not "
@@ -1908,7 +1899,7 @@ httpPrintf(http_t     *http,              /* I - HTTP connection */
            const char *format,         /* I - printf-style format string */
           ...)                         /* I - Additional args as needed */
 {
-  int          bytes;                  /* Number of bytes to write */
+  ssize_t      bytes;                  /* Number of bytes to write */
   char         buf[16384];             /* Buffer for formatted string */
   va_list      ap;                     /* Variable argument pointer */
 
@@ -1919,10 +1910,10 @@ httpPrintf(http_t     *http,            /* I - HTTP connection */
   bytes = vsnprintf(buf, sizeof(buf), format, ap);
   va_end(ap);
 
-  DEBUG_printf(("3httpPrintf: (%d bytes) %s", bytes, buf));
+  DEBUG_printf(("3httpPrintf: (" CUPS_LLFMT " bytes) %s", CUPS_LLCAST bytes, buf));
 
   if (http->data_encoding == HTTP_ENCODING_FIELDS)
-    return (httpWrite2(http, buf, bytes));
+    return ((int)httpWrite2(http, buf, (size_t)bytes));
   else
   {
     if (http->wused)
@@ -1933,7 +1924,7 @@ httpPrintf(http_t     *http,              /* I - HTTP connection */
        return (-1);
     }
 
-    return (http_write(http, buf, bytes));
+    return ((int)http_write(http, buf, (size_t)bytes));
   }
 }
 
@@ -1965,7 +1956,7 @@ httpRead(http_t *http,                    /* I - HTTP connection */
          char   *buffer,               /* I - Buffer for data */
         int    length)                 /* I - Maximum number of bytes */
 {
-  return ((int)httpRead2(http, buffer, length));
+  return ((int)httpRead2(http, buffer, (size_t)length));
 }
 
 
@@ -2006,7 +1997,7 @@ httpRead2(http_t *http,                   /* I - HTTP connection */
     return (0);
 
 #ifdef HAVE_LIBZ
-  if (http->coding)
+  if (http->coding >= _HTTP_CODING_GUNZIP)
   {
     do
     {
@@ -2018,21 +2009,20 @@ httpRead2(http_t *http,                 /* I - HTTP connection */
                      (int)http->stream.avail_in, (int)length));
 
        http->stream.next_out  = (Bytef *)buffer;
-       http->stream.avail_out = length;
+       http->stream.avail_out = (uInt)length;
 
        if ((zerr = inflate(&(http->stream), Z_SYNC_FLUSH)) < Z_OK)
        {
          DEBUG_printf(("2httpRead2: zerr=%d", zerr));
 #ifdef DEBUG
-          http_debug_hex("2httpRead2", (char *)http->dbuffer,
-                         http->stream.avail_in);
+          http_debug_hex("2httpRead2", (char *)http->sbuffer, (int)http->stream.avail_in);
 #endif /* DEBUG */
 
          http->error = EIO;
          return (-1);
        }
 
-       bytes = length - http->stream.avail_out;
+       bytes = (ssize_t)(length - http->stream.avail_out);
 
        DEBUG_printf(("2httpRead2: avail_in=%d, avail_out=%d, bytes=%d",
                      http->stream.avail_in, http->stream.avail_out,
@@ -2043,16 +2033,16 @@ httpRead2(http_t *http,                 /* I - HTTP connection */
 
       if (bytes == 0)
       {
-        ssize_t buflen = HTTP_MAX_BUFFER - http->stream.avail_in;
+        ssize_t buflen = HTTP_MAX_BUFFER - (ssize_t)http->stream.avail_in;
                                        /* Additional bytes for buffer */
 
         if (buflen > 0)
         {
           if (http->stream.avail_in > 0 &&
-              http->stream.next_in > http->dbuffer)
-            memmove(http->dbuffer, http->stream.next_in, http->stream.avail_in);
+              http->stream.next_in > http->sbuffer)
+            memmove(http->sbuffer, http->stream.next_in, http->stream.avail_in);
 
-         http->stream.next_in = http->dbuffer;
+         http->stream.next_in = http->sbuffer;
 
           DEBUG_printf(("1httpRead2: Reading up to %d more bytes of data into "
                         "decompression buffer.", (int)buflen));
@@ -2060,16 +2050,12 @@ httpRead2(http_t *http,                 /* I - HTTP connection */
           if (http->data_remaining > 0)
           {
            if (buflen > http->data_remaining)
-             buflen = http->data_remaining;
+             buflen = (ssize_t)http->data_remaining;
 
-           bytes = http_read_buffered(http,
-                                      (char *)http->dbuffer +
-                                              http->stream.avail_in, buflen);
+           bytes = http_read_buffered(http, (char *)http->sbuffer + http->stream.avail_in, (size_t)buflen);
           }
           else if (http->data_encoding == HTTP_ENCODING_CHUNKED)
-            bytes = http_read_chunk(http,
-                                   (char *)http->dbuffer +
-                                       http->stream.avail_in, buflen);
+            bytes = http_read_chunk(http, (char *)http->sbuffer + http->stream.avail_in, (size_t)buflen);
           else
             bytes = 0;
 
@@ -2082,7 +2068,7 @@ httpRead2(http_t *http,                   /* I - HTTP connection */
                         "decompression buffer.", CUPS_LLCAST bytes));
 
           http->data_remaining  -= bytes;
-          http->stream.avail_in += bytes;
+          http->stream.avail_in += (uInt)bytes;
 
          if (http->data_remaining <= 0 &&
              http->data_encoding == HTTP_ENCODING_CHUNKED)
@@ -2160,14 +2146,15 @@ httpRead2(http_t *http,                 /* I - HTTP connection */
 
   if (
 #ifdef HAVE_LIBZ
-      (http->coding == _HTTP_CODING_IDENTITY || http->stream.avail_in == 0) &&
+      (http->coding == _HTTP_CODING_IDENTITY ||
+       (http->coding >= _HTTP_CODING_GUNZIP && http->stream.avail_in == 0)) &&
 #endif /* HAVE_LIBZ */
       ((http->data_remaining <= 0 &&
         http->data_encoding == HTTP_ENCODING_LENGTH) ||
        (http->data_encoding == HTTP_ENCODING_CHUNKED && bytes == 0)))
   {
 #ifdef HAVE_LIBZ
-    if (http->coding)
+    if (http->coding >= _HTTP_CODING_GUNZIP)
       http_content_coding_finish(http);
 #endif /* HAVE_LIBZ */
 
@@ -2398,7 +2385,7 @@ httpReconnect2(http_t *http,              /* I - HTTP connection */
   if (http->tls)
   {
     DEBUG_puts("2httpReconnect2: Shutting down SSL/TLS...");
-    http_tls_stop(http);
+    _httpTLSStop(http);
   }
 #endif /* HAVE_SSL */
 
@@ -2476,7 +2463,7 @@ httpReconnect2(http_t *http,              /* I - HTTP connection */
     * Always do encryption via SSL.
     */
 
-    if (http_tls_start(http) != 0)
+    if (_httpTLSStart(http) != 0)
     {
       httpAddrClose(NULL, http->fd);
 
@@ -2529,10 +2516,10 @@ httpSetAuthString(http_t     *http,     /* I - HTTP connection */
     * Set the current authorization string...
     */
 
-    int len = (int)strlen(scheme) + (data ? (int)strlen(data) + 1 : 0) + 1;
+    size_t len = strlen(scheme) + (data ? strlen(data) + 1 : 0) + 1;
     char *temp;
 
-    if (len > (int)sizeof(http->_authstring))
+    if (len > sizeof(http->_authstring))
     {
       if ((temp = malloc(len)) == NULL)
         len = sizeof(http->_authstring);
@@ -2782,7 +2769,7 @@ httpSetField(http_t       *http,  /* I - HTTP connection */
 /*
  * 'httpSetKeepAlive()' - Set the current Keep-Alive state of a connection.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 void
@@ -2860,7 +2847,7 @@ httpSetTimeout(
 /*
  * 'httpShutdown()' - Shutdown one side of an HTTP connection.
  *
- * @since CUPS 2.0@
+ * @since CUPS 2.0/OS 10.10@
  */
 
 void
@@ -2870,9 +2857,13 @@ httpShutdown(http_t *http)               /* I - HTTP connection */
     return;
 
   if (http->tls)
-    http_tls_stop(http);
+    _httpTLSStop(http);
 
+#ifdef WIN32
+  shutdown(http->fd, SD_RECEIVE);      /* Microsoft-ism... */
+#else
   shutdown(http->fd, SHUT_RD);
+#endif /* WIN32 */
 }
 
 
@@ -2943,7 +2934,7 @@ _httpUpdate(http_t        *http,  /* I - HTTP connection */
 #ifdef HAVE_SSL
     if (http->status == HTTP_STATUS_SWITCHING_PROTOCOLS && !http->tls)
     {
-      if (http_tls_start(http) != 0)
+      if (_httpTLSStart(http) != 0)
       {
         httpAddrClose(NULL, http->fd);
 
@@ -3160,7 +3151,7 @@ _httpWait(http_t *http,                   /* I - HTTP connection */
   */
 
 #ifdef HAVE_SSL
-  if (http_tls_pending(http))
+  if (http->tls && _httpTLSPending(http))
   {
     DEBUG_puts("5_httpWait: Return 1 since there is pending TLS data.");
     return (1);
@@ -3283,7 +3274,7 @@ httpWrite(http_t     *http,               /* I - HTTP connection */
           const char *buffer,          /* I - Buffer for data */
          int        length)            /* I - Number of bytes to write */
 {
-  return ((int)httpWrite2(http, buffer, length));
+  return ((int)httpWrite2(http, buffer, (size_t)length));
 }
 
 
@@ -3325,7 +3316,7 @@ httpWrite2(http_t     *http,              /* I - HTTP connection */
   */
 
 #ifdef HAVE_LIBZ
-  if (http->coding)
+  if (http->coding == _HTTP_CODING_GZIP || http->coding == _HTTP_CODING_DEFLATE)
   {
     DEBUG_printf(("1httpWrite2: http->coding=%d", http->coding));
 
@@ -3336,37 +3327,48 @@ httpWrite2(http_t     *http,            /* I - HTTP connection */
     }
     else
     {
+      size_t   slen;                   /* Bytes to write */
+      ssize_t  sret;                   /* Bytes written */
+
       http->stream.next_in   = (Bytef *)buffer;
-      http->stream.avail_in  = length;
-      http->stream.next_out  = (Bytef *)http->wbuffer + http->wused;
-      http->stream.avail_out = sizeof(http->wbuffer) - http->wused;
+      http->stream.avail_in  = (uInt)length;
 
       while (deflate(&(http->stream), Z_NO_FLUSH) == Z_OK)
       {
-       http->wused = sizeof(http->wbuffer) - http->stream.avail_out;
+        DEBUG_printf(("1httpWrite2: avail_out=%d", http->stream.avail_out));
 
-        if (http->stream.avail_out == 0)
-        {
-         if (httpFlushWrite(http) < 0)
-         {
-           DEBUG_puts("1httpWrite2: Unable to flush, returning -1.");
-           return (-1);
-         }
+        if (http->stream.avail_out > 0)
+         continue;
+
+       slen = _HTTP_MAX_SBUFFER - http->stream.avail_out;
 
-         http->stream.next_out  = (Bytef *)http->wbuffer;
-         http->stream.avail_out = sizeof(http->wbuffer);
+        DEBUG_printf(("1httpWrite2: Writing intermediate chunk, len=%d", (int)slen));
+
+       if (slen > 0 && http->data_encoding == HTTP_ENCODING_CHUNKED)
+         sret = http_write_chunk(http, (char *)http->sbuffer, slen);
+       else if (slen > 0)
+         sret = http_write(http, (char *)http->sbuffer, slen);
+       else
+         sret = 0;
+
+        if (sret < 0)
+       {
+         DEBUG_puts("1httpWrite2: Unable to write, returning -1.");
+         return (-1);
        }
+
+       http->stream.next_out  = (Bytef *)http->sbuffer;
+       http->stream.avail_out = (uInt)_HTTP_MAX_SBUFFER;
       }
 
-      http->wused = sizeof(http->wbuffer) - http->stream.avail_out;
-      bytes       = length;
+      bytes = (ssize_t)length;
     }
   }
   else
 #endif /* HAVE_LIBZ */
   if (length > 0)
   {
-    if (http->wused && (length + http->wused) > sizeof(http->wbuffer))
+    if (http->wused && (length + (size_t)http->wused) > sizeof(http->wbuffer))
     {
       DEBUG_printf(("2httpWrite2: Flushing buffer (wused=%d, length="
                     CUPS_LLFMT ")", http->wused, CUPS_LLCAST length));
@@ -3374,8 +3376,7 @@ httpWrite2(http_t     *http,              /* I - HTTP connection */
       httpFlushWrite(http);
     }
 
-    if ((length + http->wused) <= sizeof(http->wbuffer) &&
-        length < sizeof(http->wbuffer))
+    if ((length + (size_t)http->wused) <= sizeof(http->wbuffer) && length < sizeof(http->wbuffer))
     {
      /*
       * Write to buffer...
@@ -3398,9 +3399,9 @@ httpWrite2(http_t     *http,              /* I - HTTP connection */
                     CUPS_LLCAST length));
 
       if (http->data_encoding == HTTP_ENCODING_CHUNKED)
-       bytes = (ssize_t)http_write_chunk(http, buffer, (int)length);
+       bytes = (ssize_t)http_write_chunk(http, buffer, length);
       else
-       bytes = (ssize_t)http_write(http, buffer, (int)length);
+       bytes = (ssize_t)http_write(http, buffer, length);
 
       DEBUG_printf(("2httpWrite2: Wrote " CUPS_LLFMT " bytes...",
                     CUPS_LLCAST bytes));
@@ -3425,7 +3426,7 @@ httpWrite2(http_t     *http,              /* I - HTTP connection */
     */
 
 #ifdef HAVE_LIBZ
-    if (http->coding)
+    if (http->coding == _HTTP_CODING_GZIP || http->coding == _HTTP_CODING_DEFLATE)
       http_content_coding_finish(http);
 #endif /* HAVE_LIBZ */
 
@@ -3592,8 +3593,15 @@ httpWriteResponse(http_t        *http,   /* I - HTTP connection */
 
     if (http->cookie)
     {
-      if (httpPrintf(http, "Set-Cookie: %s path=/ httponly%s\r\n",
-                    http->cookie, http->tls ? " secure" : "") < 1)
+      if (strchr(http->cookie, ';'))
+      {
+        if (httpPrintf(http, "Set-Cookie: %s\r\n", http->cookie) < 1)
+       {
+         http->status = HTTP_STATUS_ERROR;
+         return (-1);
+       }
+      }
+      else if (httpPrintf(http, "Set-Cookie: %s; path=/; httponly;%s\r\n", http->cookie, http->tls ? " secure;" : "") < 1)
       {
        http->status = HTTP_STATUS_ERROR;
        return (-1);
@@ -3681,28 +3689,46 @@ static void
 http_content_coding_finish(
     http_t *http)                      /* I - HTTP connection */
 {
-  int  zerr;                           /* Compression status */
+  int          zerr;                   /* Compression status */
+  Byte         dummy[1];               /* Dummy read buffer */
+  size_t       bytes;                  /* Number of bytes to write */
+
 
+  DEBUG_printf(("http_content_coding_finish(http=%p)", http));
+  DEBUG_printf(("1http_content_coding_finishing: http->coding=%d", http->coding));
 
   switch (http->coding)
   {
     case _HTTP_CODING_DEFLATE :
     case _HTTP_CODING_GZIP :
+        http->stream.next_in  = dummy;
+        http->stream.avail_in = 0;
+
         do
         {
-          http->stream.next_out  = (Bytef *)http->wbuffer + http->wused;
-          http->stream.avail_out = sizeof(http->wbuffer) - http->wused;
+          zerr  = deflate(&(http->stream), Z_FINISH);
+         bytes = _HTTP_MAX_SBUFFER - http->stream.avail_out;
 
-          zerr = deflate(&(http->stream), Z_FINISH);
+          if (bytes > 0)
+         {
+           DEBUG_printf(("1http_content_coding_finish: Writing trailing chunk, len=%d", (int)bytes));
 
-          http->wused = sizeof(http->wbuffer) - http->stream.avail_out;
-          if (http->wused == sizeof(http->wbuffer))
-            httpFlushWrite(http);
-        }
+           if (http->data_encoding == HTTP_ENCODING_CHUNKED)
+             http_write_chunk(http, (char *)http->sbuffer, bytes);
+           else
+             http_write(http, (char *)http->sbuffer, bytes);
+          }
+
+          http->stream.next_out  = (Bytef *)http->sbuffer;
+          http->stream.avail_out = (uInt)_HTTP_MAX_SBUFFER;
+       }
         while (zerr == Z_OK);
 
         deflateEnd(&(http->stream));
 
+        free(http->sbuffer);
+        http->sbuffer = NULL;
+
         if (http->wused)
           httpFlushWrite(http);
         break;
@@ -3710,8 +3736,8 @@ http_content_coding_finish(
     case _HTTP_CODING_INFLATE :
     case _HTTP_CODING_GUNZIP :
         inflateEnd(&(http->stream));
-        free(http->dbuffer);
-        http->dbuffer = NULL;
+        free(http->sbuffer);
+        http->sbuffer = NULL;
         break;
 
     default :
@@ -3791,6 +3817,13 @@ http_content_coding_start(
         if (http->wused)
           httpFlushWrite(http);
 
+        if ((http->sbuffer = malloc(_HTTP_MAX_SBUFFER)) == NULL)
+        {
+          http->status = HTTP_STATUS_ERROR;
+          http->error  = errno;
+          return;
+        }
+
        /*
         * Window size for compression is 11 bits - optimal based on PWG Raster
         * sample files on pwg.org.  -11 is raw deflate, 27 is gzip, per ZLIB
@@ -3806,11 +3839,14 @@ http_content_coding_start(
           http->error  = zerr == Z_MEM_ERROR ? ENOMEM : EINVAL;
           return;
         }
+
+       http->stream.next_out  = (Bytef *)http->sbuffer;
+       http->stream.avail_out = (uInt)_HTTP_MAX_SBUFFER;
         break;
 
     case _HTTP_CODING_INFLATE :
     case _HTTP_CODING_GUNZIP :
-        if ((http->dbuffer = malloc(HTTP_MAX_BUFFER)) == NULL)
+        if ((http->sbuffer = malloc(_HTTP_MAX_SBUFFER)) == NULL)
         {
           http->status = HTTP_STATUS_ERROR;
           http->error  = errno;
@@ -3826,15 +3862,15 @@ http_content_coding_start(
                                  coding == _HTTP_CODING_INFLATE ? -15 : 31))
                < Z_OK)
         {
-          free(http->dbuffer);
-          http->dbuffer = NULL;
+          free(http->sbuffer);
+          http->sbuffer = NULL;
           http->status  = HTTP_STATUS_ERROR;
           http->error   = zerr == Z_MEM_ERROR ? ENOMEM : EINVAL;
           return;
         }
 
         http->stream.avail_in = 0;
-        http->stream.next_in  = http->dbuffer;
+        http->stream.next_in  = http->sbuffer;
         break;
 
     default :
@@ -3987,7 +4023,7 @@ http_debug_hex(const char *prefix,        /* I - Prefix for line */
       if (ch < ' ' || ch >= 127)
        ch = '.';
 
-      *ptr++ = ch;
+      *ptr++ = (char)ch;
     }
 
     *ptr = '\0';
@@ -4033,7 +4069,7 @@ http_read(http_t *http,                   /* I - HTTP connection */
   {
 #ifdef HAVE_SSL
     if (http->tls)
-      bytes = http_tls_read(http, buffer, length);
+      bytes = _httpTLSRead(http, buffer, (int)length);
     else
 #endif /* HAVE_SSL */
     bytes = recv(http->fd, buffer, length, 0);
@@ -4133,18 +4169,18 @@ http_read_buffered(http_t *http,        /* I - HTTP connection */
   if (http->used > 0)
   {
     if (length > (size_t)http->used)
-      bytes = (size_t)http->used;
+      bytes = (ssize_t)http->used;
     else
-      bytes = length;
+      bytes = (ssize_t)length;
 
     DEBUG_printf(("2http_read: Grabbing %d bytes from input buffer.",
                   (int)bytes));
 
-    memcpy(buffer, http->buffer, bytes);
+    memcpy(buffer, http->buffer, (size_t)bytes);
     http->used -= (int)bytes;
 
     if (http->used > 0)
-      memmove(http->buffer, http->buffer + bytes, http->used);
+      memmove(http->buffer, http->buffer + bytes, (size_t)http->used);
   }
   else
     bytes = http_read(http, buffer, length);
@@ -4453,7 +4489,7 @@ http_set_length(http_t *http)             /* I - Connection */
     http->data_remaining = remaining;
 
     if (remaining <= INT_MAX)
-      http->_data_remaining = remaining;
+      http->_data_remaining = (int)remaining;
     else
       http->_data_remaining = INT_MAX;
   }
@@ -4581,6 +4617,7 @@ http_tls_upgrade(http_t *http)            /* I - HTTP connection */
 
     DEBUG_puts("8http_tls_upgrade: Server does not support HTTP upgrade!");
 
+    _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, _("Encryption is not supported."), 1);
     httpAddrClose(NULL, http->fd);
 
     http->fd = -1;
@@ -4674,7 +4711,7 @@ http_write(http_t     *http,              /* I - HTTP connection */
 
 #ifdef HAVE_SSL
     if (http->tls)
-      bytes = http_tls_write(http, buffer, length);
+      bytes = _httpTLSWrite(http, buffer, (int)length);
     else
 #endif /* HAVE_SSL */
     bytes = send(http->fd, buffer, length, 0);
@@ -4728,11 +4765,11 @@ http_write(http_t     *http,            /* I - HTTP connection */
 
     buffer += bytes;
     tbytes += bytes;
-    length -= bytes;
+    length -= (size_t)bytes;
   }
 
 #ifdef DEBUG
-  http_debug_hex("http_write", buffer - tbytes, tbytes);
+  http_debug_hex("http_write", buffer - tbytes, (int)tbytes);
 #endif /* DEBUG */
 
   DEBUG_printf(("3http_write: Returning " CUPS_LLFMT ".", CUPS_LLCAST tbytes));