Merge branch 'master' of https://github.com/apple/cups

diff --git a/CHANGES.md b/CHANGES.md
index 6cb8ef768b0f8e4ed0c20f7ae047fe178477285b..2fdf93e3247d1cff5817ec5ca2456d896a36bcd5 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,7 +1,15 @@
-CHANGES - 2.2.5 - 2017-10-12
+CHANGES - 2.2.6 - 2017-10-19
 ============================
 
-CHANGES IN CUPS V2.2.5
+
+Changes in CUPS v2.2.6
+----------------------
+
+- Added USB quirks rules for Canon MP540 and Samsung ML-2160 (Issue #5148)
+- Fixed TLS cipher suite selection with GNU TLS (Issue #5145)
+
+
+Changes in CUPS v2.2.5
 ----------------------
 
 - The scheduler's `-t` option did not force all errors to the standard error
@@ -73,7 +81,7 @@ CHANGES IN CUPS V2.2.5
   WITH-SCHEME predicates.
 
 
-CHANGES IN CUPS V2.2.4
+Changes in CUPS v2.2.4
 ----------------------
 
 - The scheduler did not remove old job files (Issue #4987)
@@ -111,7 +119,7 @@ CHANGES IN CUPS V2.2.4
   `DenyCBC` and `DenyTLS1.0` options (Issue #5037)
 
 
-CHANGES IN CUPS V2.2.3
+Changes in CUPS v2.2.3
 ----------------------
 
 - The IPP backend could get into an infinite loop for certain errors, causing a
@@ -139,7 +147,7 @@ CHANGES IN CUPS V2.2.3
 - Fixed some localization issues on macOS (<rdar://problem/27245567>)
 
 
-CHANGES IN CUPS V2.2.2
+Changes in CUPS v2.2.2
 ----------------------
 
 - Fixed some issues with the Zebra ZPL printer driver (Issue #4898)
@@ -169,7 +177,7 @@ CHANGES IN CUPS V2.2.2
 - Updated packaging files (Issue #4940)
 
 
-CHANGES IN CUPS V2.2.1
+Changes in CUPS v2.2.1
 ----------------------
 
 - Added "CreateSelfSignedCerts" directive for cups-files.conf to control whether
@@ -183,7 +191,7 @@ CHANGES IN CUPS V2.2.1
 - Updated localizations (PR #4877, PR #4886)
 
 
-CHANGES IN CUPS V2.2.0
+Changes in CUPS v2.2.0
 ----------------------
 
 - Normalized the TLS certificate validation code and added additional error
@@ -194,7 +202,7 @@ CHANGES IN CUPS V2.2.0
 - http*Connect did not return early when all addresses failed (Issue #4870)
 
 
-CHANGES IN CUPS V2.2rc1
+Changes in CUPS v2.2rc1
 -----------------------
 
 - Updated the list of supported IPP Everywhere media types.
@@ -207,14 +215,14 @@ CHANGES IN CUPS V2.2rc1
 - Updated localizations (Issue #4846, PR #4858)
 
 
-CHANGES IN CUPS V2.2b2
+Changes in CUPS v2.2b2
 ----------------------
 
 - Added Upstart support (PR #4825)
 - CUPS now supports Let's Encrypt certificates on Linux.
 
 
-CHANGES IN CUPS V2.2b1
+Changes in CUPS v2.2b1
 ----------------------
 
 - All CUPS commands now support POSIX options (Issue #4813)

diff --git a/backend/org.cups.usb-quirks b/backend/org.cups.usb-quirks
index fe3f6220029f27948336a640de1d27b76ab77078..bb2172fc2d6d6f2751b6256b937f7db13e682345 100644 (file)
--- a/backend/org.cups.usb-quirks
+++ b/backend/org.cups.usb-quirks
@@ -76,6 +76,9 @@
 # Canon, Inc. MP510 Printer (https://bugs.launchpad.net/bugs/1050009)
 0x04a9 0x1717 unidir
 
+# Canon, Inc. MP540 Printer, https://bugzilla.redhat.com/967873
+0x04a9 0x1730 unidir
+
 # Canon, Inc. MP550 Printer (Issue #4155)
 0x04a9 0x173d unidir
 
@@ -127,6 +130,9 @@
 # All Samsung devices (https://bugs.launchpad.net/bugs/1032456)
 0x04e8 soft-reset
 
+# Samsung ML-2160 Series (https://bugzilla.redhat.com/show_bug.cgi?id=873123)
+0x04e8 0x330f unidir
+
 # All Zebra devices (https://bugs.launchpad.net/bugs/1001028)
 0x0a5f unidir
 

diff --git a/configure b/configure
index 0328227a26c1a7315c49c0b42e2bea30b3de0007..c8b573f2eed5ab9f194608cc7eb2be72269e53e1 100755 (executable)
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for CUPS 2.2.5.
+# Generated by GNU Autoconf 2.69 for CUPS 2.2.6.
 #
 # Report bugs to <https://github.com/apple/cups/issues>.
 #
@@ -580,8 +580,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='CUPS'
 PACKAGE_TARNAME='cups'
-PACKAGE_VERSION='2.2.5'
-PACKAGE_STRING='CUPS 2.2.5'
+PACKAGE_VERSION='2.2.6'
+PACKAGE_STRING='CUPS 2.2.6'
 PACKAGE_BUGREPORT='https://github.com/apple/cups/issues'
 PACKAGE_URL='https://www.cups.org/'
 
@@ -1482,7 +1482,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures CUPS 2.2.5 to adapt to many kinds of systems.
+\`configure' configures CUPS 2.2.6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1547,7 +1547,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of CUPS 2.2.5:";;
+     short | recursive ) echo "Configuration of CUPS 2.2.6:";;
    esac
   cat <<\_ACEOF
 
@@ -1728,7 +1728,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-CUPS configure 2.2.5
+CUPS configure 2.2.6
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2192,7 +2192,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by CUPS $as_me 2.2.5, which was
+It was created by CUPS $as_me 2.2.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2667,7 +2667,7 @@ fi
 ac_config_headers="$ac_config_headers config.h"
 
 
-CUPS_VERSION="2.2.5"
+CUPS_VERSION="2.2.6"
 CUPS_REVISION=""
 CUPS_BUILD="cups-$CUPS_VERSION"
 
@@ -10901,7 +10901,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by CUPS $as_me 2.2.5, which was
+This file was extended by CUPS $as_me 2.2.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -10964,7 +10964,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-CUPS config.status 2.2.5
+CUPS config.status 2.2.6
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

diff --git a/configure.ac b/configure.ac
index 9b2177e12de7d0c876489bc911b844df8fa60044..ac78c48ad6d1ecf8a83b4c5a65e9ded16119d31e 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -15,7 +15,7 @@ dnl We need at least autoconf 2.60...
 AC_PREREQ(2.60)
 
 dnl Package name and version...
-AC_INIT([CUPS], [2.2.5], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
+AC_INIT([CUPS], [2.2.6], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
 
 sinclude(config-scripts/cups-opsys.m4)
 sinclude(config-scripts/cups-common.m4)

diff --git a/cups/cups.h b/cups/cups.h
index 9525ffe9945568d5e2a5f3accfe91b3a5dbdee36..8f5c818f563aa3a0f621db16b92c235b47ed839f 100644 (file)
--- a/cups/cups.h
+++ b/cups/cups.h
@@ -47,10 +47,10 @@ extern "C" {
  * Constants...
  */
 
-#  define CUPS_VERSION                 2.0205
+#  define CUPS_VERSION                 2.0206
 #  define CUPS_VERSION_MAJOR           2
 #  define CUPS_VERSION_MINOR           2
-#  define CUPS_VERSION_PATCH           5
+#  define CUPS_VERSION_PATCH           6
 
 #  define CUPS_BC_FD                   3
                                        /* Back-channel file descriptor for

diff --git a/cups/http-private.h b/cups/http-private.h
index 00afed0df123382687ff4076eb8068514d19d1af..f71e564b259881cc4d6fcb0e182e584e32a5622b 100644 (file)
--- a/cups/http-private.h
+++ b/cups/http-private.h
@@ -172,20 +172,20 @@ extern "C" {
  * Constants...
  */
 
-
-#define _HTTP_MAX_SBUFFER      65536   /* Size of (de)compression buffer */
-#define _HTTP_RESOLVE_DEFAULT  0       /* Just resolve with default options */
-#define _HTTP_RESOLVE_STDERR   1       /* Log resolve progress to stderr */
-#define _HTTP_RESOLVE_FQDN     2       /* Resolve to a FQDN */
-#define _HTTP_RESOLVE_FAXOUT   4       /* Resolve FaxOut service? */
-
-#define _HTTP_TLS_NONE         0       /* No TLS options */
-#define _HTTP_TLS_ALLOW_RC4    1       /* Allow RC4 cipher suites */
-#define _HTTP_TLS_ALLOW_SSL3   2       /* Allow SSL 3.0 */
-#define _HTTP_TLS_ALLOW_DH     4       /* Allow DH/DHE key negotiation */
-#define _HTTP_TLS_DENY_TLS10   16      /* Deny TLS 1.0 */
-#define _HTTP_TLS_DENY_CBC     32      /* Deny CBC cipher suites */
-#define _HTTP_TLS_ONLY_TLS10    64      /* Only use TLS 1.0 */
+#  define _HTTP_MAX_SBUFFER    65536   /* Size of (de)compression buffer */
+#  define _HTTP_RESOLVE_DEFAULT        0       /* Just resolve with default options */
+#  define _HTTP_RESOLVE_STDERR 1       /* Log resolve progress to stderr */
+#  define _HTTP_RESOLVE_FQDN   2       /* Resolve to a FQDN */
+#  define _HTTP_RESOLVE_FAXOUT 4       /* Resolve FaxOut service? */
+
+#  define _HTTP_TLS_NONE       0       /* No TLS options */
+#  define _HTTP_TLS_ALLOW_RC4  1       /* Allow RC4 cipher suites */
+#  define _HTTP_TLS_ALLOW_SSL3 2       /* Allow SSL 3.0 */
+#  define _HTTP_TLS_ALLOW_DH   4       /* Allow DH/DHE key negotiation */
+#  define _HTTP_TLS_DENY_TLS10 16      /* Deny TLS 1.0 */
+#  define _HTTP_TLS_DENY_CBC   32      /* Deny CBC cipher suites */
+#  define _HTTP_TLS_ONLY_TLS10  64      /* Only use TLS 1.0 */
+#  define _HTTP_TLS_SET_DEFAULT 128     /* Setting the default TLS options */
 
 
 /*

diff --git a/cups/request.c b/cups/request.c
index 322ca660eae4e1b98a395dfd95335ed64ea2fdb7..7bee0a85b56ff8fd673f194bd580b55aded9dc1b 100644 (file)
--- a/cups/request.c
+++ b/cups/request.c
@@ -131,13 +131,12 @@ cupsDoIORequest(http_t     *http, /* I - Connection to server or @code CUPS_HTTP
   * Get the default connection as needed...
   */
 
-  if (!http)
-    if ((http = _cupsConnect()) == NULL)
-    {
-      ippDelete(request);
+  if (!http && (http = _cupsConnect()) == NULL)
+  {
+    ippDelete(request);
 
-      return (NULL);
-    }
+    return (NULL);
+  }
 
  /*
   * See if we have a file to send...
@@ -578,9 +577,8 @@ cupsSendRequest(http_t     *http,   /* I - Connection to server or @code CUPS_HTTP
   * Get the default connection as needed...
   */
 
-  if (!http)
-    if ((http = _cupsConnect()) == NULL)
-      return (HTTP_STATUS_SERVICE_UNAVAILABLE);
+  if (!http && (http = _cupsConnect()) == NULL)
+    return (HTTP_STATUS_SERVICE_UNAVAILABLE);
 
  /*
   * If the prior request was not flushed out, do so now...

diff --git a/cups/tls-darwin.c b/cups/tls-darwin.c
index d2d3687a1134998afcb2b2419ecd8efd684598a7..92430aca0f7f8cc5303260b1fb5a2af7bac00d83 100644 (file)
--- a/cups/tls-darwin.c
+++ b/cups/tls-darwin.c
@@ -1141,7 +1141,8 @@ _httpTLSRead(http_t *http,                /* I - HTTP connection */
 void
 _httpTLSSetOptions(int options)                /* I - Options */
 {
-  tls_options = options;
+  if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
+    tls_options = options;
 }
 
 

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index 3f13760b2b0c3b40d3dd6e947331dda57ca6321f..4c92b68506f8298b58b6a3d3e91bd70bda847fab 100644 (file)
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -1226,7 +1226,8 @@ _httpTLSSetCredentials(http_t *http)      /* I - Connection to server */
 void
 _httpTLSSetOptions(int options)                /* I - Options */
 {
-  tls_options = options;
+  if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
+    tls_options = options;
 }
 
 
@@ -1517,10 +1518,9 @@ _httpTLSStart(http_t *http)              /* I - Connection to server */
   if (!(tls_options & _HTTP_TLS_ALLOW_RC4))
     strlcat(priority_string, ":-ARCFOUR-128", sizeof(priority_string));
 
-  if (!(tls_options & _HTTP_TLS_ALLOW_DH))
-    strlcat(priority_string, ":!ANON-DH", sizeof(priority_string));
+  strlcat(priority_string, ":!ANON-DH", sizeof(priority_string));
 
-  if (!(tls_options & _HTTP_TLS_DENY_CBC))
+  if (tls_options & _HTTP_TLS_DENY_CBC)
     strlcat(priority_string, ":!AES-128-CBC:!AES-256-CBC:!CAMELLIA-128-CBC:!CAMELLIA-256-CBC:!3DES-CBC", sizeof(priority_string));
 
 #ifdef HAVE_GNUTLS_PRIORITY_SET_DIRECT

diff --git a/cups/tls-sspi.c b/cups/tls-sspi.c
index 77b883b2297622eb03ffebccf5fac6fee1642b1b..6eaec4c83acfc6a0d0f298910ce020b7466f3ac4 100644 (file)
--- a/cups/tls-sspi.c
+++ b/cups/tls-sspi.c
@@ -2,7 +2,7 @@
  * TLS support for CUPS on Windows using the Security Support Provider
  * Interface (SSPI).
  *
- * Copyright 2010-2015 by Apple Inc.
+ * Copyright 2010-2017 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -913,7 +913,8 @@ _httpTLSRead(http_t *http,          /* I - HTTP connection */
 void
 _httpTLSSetOptions(int options)                /* I - Options */
 {
-  tls_options = options;
+  if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
+    tls_options = options;
 }
 
 

diff --git a/cups/usersys.c b/cups/usersys.c
index 026b4a7cc493760193de0b93d989b4784b6066f8..2a004b540217ee1c6aa9a016c7a87854bb312784 100644 (file)
--- a/cups/usersys.c
+++ b/cups/usersys.c
@@ -957,7 +957,7 @@ _cupsSetDefaults(void)
     cg->validate_certs = cc.validate_certs;
 
 #ifdef HAVE_SSL
-  _httpTLSSetOptions(cc.ssl_options);
+  _httpTLSSetOptions(cc.ssl_options | _HTTP_TLS_SET_DEFAULT);
 #endif /* HAVE_SSL */
 }
 

diff --git a/man/client.conf.man.in b/man/client.conf.man.in
index fba9fe97776a18cd3741d7f79c86f7d377d576ec..c9fb91da28538e04124ec4f04f3bcc9f2e3994da 100644 (file)
--- a/man/client.conf.man.in
+++ b/man/client.conf.man.in
@@ -10,7 +10,7 @@
 .\" which should have been included with this file.  If this file is
 .\" file is missing or damaged, see the license at "http://www.cups.org/".
 .\"
-.TH client.conf 5 "CUPS" "26 June 2017" "Apple Inc."
+.TH client.conf 5 "CUPS" "19 October 2017" "Apple Inc."
 .SH NAME
 client.conf \- client configuration file for cups
 .SH DESCRIPTION
@@ -61,8 +61,10 @@ Specifies the address and optionally the port to use when connecting to a server
 \fBSSLOptions None\fR
 Sets encryption options (only in /etc/cups/client.conf).
 By default, CUPS only supports encryption using TLS v1.0 or higher using known secure cipher suites.
-The \fIAllowDH\fR option enables cipher suites using plain Diffie-Hellman key negotiation.
-The \fIAllowRC4\fR option enables the 128-bit RC4 cipher suites, which are required for some older clients that do not implement newer ones.
+Security is reduced when \fIAllow\fR options are used.
+Security is enhanced when \fIDeny\fR options are used.
+The \fIAllowDH\fR option enables cipher suites using plain Diffie-Hellman key negotiation (not supported on systems using GNU TLS).
+The \fIAllowRC4\fR option enables the 128-bit RC4 cipher suites, which are required for some older clients.
 The \fIAllowSSL3\fR option enables SSL v3.0, which is required for some older clients that do not support TLS v1.0.
 The \fIDenyCBC\fR option disables all CBC cipher suites.
 The \fIDenyTLS1.0\fR option disables TLS v1.0 support - this sets the minimum protocol version to TLS v1.1.

diff --git a/man/cupsd.conf.man.in b/man/cupsd.conf.man.in
index 918bbee7aa1333a47f98b765dcda9a125f71f74f..ab89e156a7b761b88a7902137011d7337f5598c7 100644 (file)
--- a/man/cupsd.conf.man.in
+++ b/man/cupsd.conf.man.in
@@ -10,7 +10,7 @@
 .\" which should have been included with this file.  If this file is
 .\" file is missing or damaged, see the license at "http://www.cups.org/".
 .\"
-.TH cupsd.conf 5 "CUPS" "28 August 2017" "Apple Inc."
+.TH cupsd.conf 5 "CUPS" "19 October 2017" "Apple Inc."
 .SH NAME
 cupsd.conf \- server configuration file for cups
 .SH DESCRIPTION
@@ -445,8 +445,10 @@ Listens on the specified address and port for encrypted connections.
 \fBSSLOptions None\fR
 Sets encryption options.
 By default, CUPS only supports encryption using TLS v1.0 or higher using known secure cipher suites.
-The \fIAllowDH\fR option enables cipher suites using plain Diffie-Hellman key negotiation.
-The \fIAllowRC4\fR option enables the 128-bit RC4 cipher suites, which are required for some older clients that do not implement newer ones.
+Security is reduced when \fIAllow\fR options are used.
+Security is enhanced when \fIDeny\fR options are used.
+The \fIAllowDH\fR option enables cipher suites using plain Diffie-Hellman key negotiation (not supported on systems using GNU TLS).
+The \fIAllowRC4\fR option enables the 128-bit RC4 cipher suites, which are required for some older clients.
 The \fIAllowSSL3\fR option enables SSL v3.0, which is required for some older clients that do not support TLS v1.0.
 The \fIDenyCBC\fR option disables all CBC cipher suites.
 The \fIDenyTLS1.0\fR option disables TLS v1.0 support - this sets the minimum protocol version to TLS v1.1.

diff --git a/vcnet/config.h b/vcnet/config.h
index ef4258533e3ce3437001e495e24e243b5a8eda31..96ec5fafa7ecfd0f489381e8af52af0f6ec25a6f 100644 (file)
--- a/vcnet/config.h
+++ b/vcnet/config.h
@@ -94,8 +94,8 @@ typedef unsigned long useconds_t;
  * Version of software...
  */
 
-#define CUPS_SVERSION "CUPS v2.2.4"
-#define CUPS_MINIMAL "CUPS/2.2.4"
+#define CUPS_SVERSION "CUPS v2.2.6"
+#define CUPS_MINIMAL "CUPS/2.2.6"
 
 
 /*

diff --git a/xcode/config.h b/xcode/config.h
index 6e28efd98453beeb18516221d5d0f23ffadede78..76d521c2caff8a33b92541ac4ee36661da95c85c 100644 (file)
--- a/xcode/config.h
+++ b/xcode/config.h
@@ -22,8 +22,8 @@
  * Version of software...
  */
 
-#define CUPS_SVERSION "CUPS v2.2.5"
-#define CUPS_MINIMAL "CUPS/2.2.5"
+#define CUPS_SVERSION "CUPS v2.2.6"
+#define CUPS_MINIMAL "CUPS/2.2.6"
 
 
 /*