Fix crash in unit tests.

Fix mapping of HTTP_STATUS_NOT_MODIFIED to IPP_STATUS_OK_EVENTS_COMPLETE.

Only test pinning for self-signed certs.

Fix sanity check for cupsSaveCredentials (copy/paste error)

diff --git a/cups/request.c b/cups/request.c
index c7a15f35d61f62cac091db66ffd9d815bb1a146f..0312aebe8578e71d61ade487b9edad55ba14a788 100644 (file)
--- a/cups/request.c
+++ b/cups/request.c
@@ -1156,6 +1156,10 @@ _cupsSetHTTPError(http_t *http,  /* I - HTTP connection */
 {
   switch (status)
   {
+    case HTTP_STATUS_NOT_MODIFIED :
+        _cupsSetError(IPP_STATUS_OK_EVENTS_COMPLETE, httpStatus(status), 0);
+        break;
+
     case HTTP_STATUS_NOT_FOUND :
        _cupsSetError(IPP_STATUS_ERROR_NOT_FOUND, httpStatus(status), 0);
        break;

diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index a27a51ee3806df93068ae85c97bc27b0372ca62d..74c3859ac4e4677a14f18c75e997270820021884 100644 (file)
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -829,7 +829,7 @@ cupsGetCredentialsTrust(
   }
 
   // Look this common name up in the default keychains...
-  if ((tcreds = cupsCopyCredentials(path, common_name)) != NULL)
+  if (num_certs == 1 && (tcreds = cupsCopyCredentials(path, common_name)) != NULL)
   {
     char       credentials_str[1024],  // String for incoming credentials
                tcreds_str[1024];       // String for saved credentials

diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 26884c89df2cc78a95d26dd796268d9403b1997c..b4652ca36ff30bfdbafd1211e08d4aa7014077cd 100644 (file)
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -777,6 +777,8 @@ cupsGetCredentialsTrust(
   _cups_globals_t *cg = _cupsGlobals();        // Per-thread globals
 
 
+  DEBUG_printf("cupsGetCredentialsTrust(path=\"%s\", common_name=\"%s\", credentials=\"%lu bytes\", require_ca=%s)", path, common_name, (unsigned long)(credentials ? strlen(credentials) : 0), require_ca ? "true" : "false");
+
   // Range check input...
   if (!path)
     path = http_default_path(defpath, sizeof(defpath));
@@ -796,6 +798,8 @@ cupsGetCredentialsTrust(
 
   cert = sk_X509_value(certs, 0);
 
+  DEBUG_printf("1cupsGetCredentialsGetTrust: certs=%p, sk_X509_num(certs)=%d", (void *)certs, sk_X509_num(certs));
+
   if (cg->any_root < 0)
   {
     _cupsSetDefaults();
@@ -803,7 +807,7 @@ cupsGetCredentialsTrust(
   }
 
   // Look this common name up in the default keychains...
-  if ((tcreds = cupsCopyCredentials(path, common_name)) != NULL)
+  if (sk_X509_num(certs) == 1 && (tcreds = cupsCopyCredentials(path, common_name)) != NULL)
   {
     char       credentials_str[1024],  // String for incoming credentials
                tcreds_str[1024];       // String for saved credentials

diff --git a/cups/tls.c b/cups/tls.c
index 6f2d1aef7eb7659a291919371dd42af5ef6f3215..5ae71bf0f712cfc9825704a5d9a2bcf6d04482c2 100644 (file)
--- a/cups/tls.c
+++ b/cups/tls.c
@@ -140,7 +140,7 @@ cupsSaveCredentials(
   if (credentials)
   {
     // Make sure it looks like a PEM-encoded cert...
-    if (strncmp(credentials, "-----BEGIN CERTIFICATE-----", 27) || strstr(key, "-----END CERTIFICATE-----") == NULL)
+    if (strncmp(credentials, "-----BEGIN CERTIFICATE-----", 27) || strstr(credentials, "-----END CERTIFICATE-----") == NULL)
       return (false);
   }
 
@@ -266,6 +266,8 @@ http_check_roots(const char *creds) // I - Credentials
   bool         ret = false;            // Return value
 
 
+  DEBUG_printf("3http_check_roots(creds=\"%s\")", creds);
+
 #ifdef __APPLE__
   // Apple hides all of the keychain stuff (all deprecated) so the best we can
   // do is use the SecTrust API to evaluate the certificate...
@@ -327,11 +329,19 @@ http_check_roots(const char *creds)       // I - Credentials
   // Test the certificate list against the macOS/iOS trust store...
   if ((policy = SecPolicyCreateBasicX509()) != NULL)
   {
+    DEBUG_puts("4http_check_roots: SecPolicyCreateBasicX509 succeeded.");
+
     if (SecTrustCreateWithCertificates(certs, policy, &trust) == noErr)
     {
       ret = SecTrustEvaluateWithError(trust, NULL);
       CFRelease(trust);
+
+      DEBUG_printf("4http_check_roots: SecTrustEvaluateWithError returned %d.", ret);
     }
+#ifdef DEBUG
+    else
+      DEBUG_printf("4http_check_roots: SecTrustCreateWithCertificates returned %d.", SecTrustCreateWithCertificates(certs, policy, &trust));
+#endif // DEBUG
 
     CFRelease(policy);
   }