From: msweet Date: Wed, 7 May 2014 23:12:48 +0000 (+0000) Subject: Save work on cert stuff. X-Git-Tag: v2.2b1~648 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=524c65e662f2c36fd6a5321425a30d2cdd2d4ece;p=thirdparty%2Fcups.git Save work on cert stuff. git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@11850 a1ca3aef-8c08-0410-bb20-df032aa958be --- diff --git a/cups/http.h b/cups/http.h index 1e8ed00ea4..2c6bf9bcb8 100644 --- a/cups/http.h +++ b/cups/http.h @@ -342,6 +342,16 @@ typedef enum http_status_e /**** HTTP status codes ****/ # endif /* !_CUPS_NO_DEPRECATED */ } http_status_t; +typedef enum http_trust_e /**** Level of trust for credentials @since CUPS 2.0@ */ +{ + HTTP_TRUST_OK = 0, /* Credentials are OK/trusted */ + HTTP_TRUST_INVALID, /* Credentials are invalid */ + HTTP_TRUST_CHANGED, /* Credentials have changed */ + HTTP_TRUST_EXPIRED, /* Credentials are expired */ + HTTP_TRUST_RENEWED, /* Credentials have been renewed */ + HTTP_TRUST_UNKNOWN, /* Credentials are unknown/new */ +} http_trust_t; + typedef enum http_uri_status_e /**** URI separation status @since CUPS 1.2@ ****/ { HTTP_URI_STATUS_OVERFLOW = -8, /* URI buffer for httpAssembleURI is too small */ @@ -614,9 +624,9 @@ extern http_state_t httpWriteResponse(http_t *http, extern int httpAddrClose(http_addr_t *addr, int fd) _CUPS_API_2_0; extern int httpAddrFamily(http_addr_t *addr) _CUPS_API_2_0; extern int httpCompareCredentials(cups_array_t *cred1, cups_array_t *cred2) _CUPS_API_2_0; -extern int httpCredentialsAreTrusted(cups_array_t *credentials, const char *common_name) _CUPS_API_2_0; +extern int httpCredentialsAreValidForName(cups_array_t *credentials, const char *common_name); extern time_t httpCredentialsGetExpiration(cups_array_t *credentials) _CUPS_API_2_0; -extern int httpCredentialsIsValidName(cups_array_t *credentials, const char *common_name); +extern http_trust_t httpCredentialsGetTrust(cups_array_t *credentials, const char *common_name) _CUPS_API_2_0; extern size_t httpCredentialsString(cups_array_t *credentials, char *buffer, size_t bufsize) _CUPS_API_2_0; extern http_field_t httpFieldValue(const char *name) _CUPS_API_2_0; extern time_t httpGetActivity(http_t *http) _CUPS_API_2_0; diff --git a/cups/testhttp.c b/cups/testhttp.c index 2696f56d6c..00b46de129 100644 --- a/cups/testhttp.c +++ b/cups/testhttp.c @@ -624,22 +624,23 @@ main(int argc, /* I - Number of command-line arguments */ { cups_array_t *creds; char info[1024]; - + static const char *trusts[] = { "OK", "Invalid", "Changed", "Expired", "Renewed", "Unknown" }; if (!httpCopyCredentials(http, &creds)) { - int trusted = httpCredentialsAreTrusted(creds, hostname); + http_trust_t trust = httpCredentialsGetTrust(creds, hostname); httpCredentialsString(creds, info, sizeof(info)); - printf("AreTrusted: %d\n", trusted); + printf("Trust: %s\n", trusts[trust]); printf("Expiration: %s\n", httpGetDateString(httpCredentialsGetExpiration(creds))); - printf("IsValidName: %d\n", httpCredentialsIsValidName(creds, hostname)); + printf("IsValidName: %d\n", httpCredentialsAreValidForName(creds, hostname)); printf("String: \"%s\"\n", info); - if (!trusted) + if (trust != HTTP_TRUST_OK) { printf("SaveCredentials: %d\n", httpSaveCredentials(NULL, creds, hostname)); - printf("New AreTrusted: %d\n", httpCredentialsAreTrusted(creds, hostname)); + trust = httpCredentialsGetTrust(creds, hostname); + printf("New Trust: %s\n", trusts[trust]); } httpFreeCredentials(creds); diff --git a/cups/tls-darwin.c b/cups/tls-darwin.c index 1a9bfefd2b..61b71a7ce2 100644 --- a/cups/tls-darwin.c +++ b/cups/tls-darwin.c @@ -447,29 +447,92 @@ _httpCreateCredentials( /* - * 'httpCredentialsAreTrusted()' - Return whether the credentials are trusted. + * 'httpCredentialsAreValidForName()' - Return whether the credentials are valid for the given name. * * @since CUPS 2.0@ */ -int /* O - 1 if trusted, 0 if not/unknown */ -httpCredentialsAreTrusted( +int /* O - 1 if valid, 0 otherwise */ +httpCredentialsAreValidForName( + cups_array_t *credentials, /* I - Credentials */ + const char *common_name) /* I - Name to check */ +{ + SecCertificateRef secCert; /* Certificate reference */ + CFStringRef cfcert_name = NULL; + /* Certificate's common name (CF string) */ + char cert_name[256]; /* Certificate's common name (C string) */ + int valid = 1; /* Valid name? */ + + + if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL) + return (0); + + /* + * Compare the common names... + */ + + if ((cfcert_name = SecCertificateCopySubjectSummary(secCert)) == NULL) + { + /* + * Can't get common name, cannot be valid... + */ + + valid = 0; + } + else if (CFStringGetCString(cfcert_name, cert_name, sizeof(cert_name), kCFStringEncodingUTF8) && + _cups_strcasecmp(common_name, cert_name)) + { + /* + * Not an exact match for the common name, check for wildcard certs... + */ + + const char *domain = strchr(common_name, '.'); + /* Domain in common name */ + + if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1)) + { + /* + * Not a wildcard match. + */ + + /* TODO: Check subject alternate names */ + valid = 0; + } + } + + if (cfcert_name) + CFRelease(cfcert_name); + + CFRelease(secCert); + + return (valid); +} + + +/* + * 'httpCredentialsGetTrust()' - Return the trust of credentials. + * + * @since CUPS 2.0@ + */ + +http_trust_t /* O - Level of trust */ +httpCredentialsGetTrust( cups_array_t *credentials, /* I - Credentials */ const char *common_name) /* I - Common name for trust lookup */ { SecCertificateRef secCert; /* Certificate reference */ - int trusted = 1; /* Trusted? */ - int save = 0; /* Save credentials? */ + http_trust_t trust = HTTP_TRUST_OK; + /* Trusted? */ cups_array_t *tcreds = NULL; /* Trusted credentials */ _cups_globals_t *cg = _cupsGlobals(); /* Per-thread globals */ if (!common_name) - return (0); + return (HTTP_TRUST_UNKNOWN); if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL) - return (0); + return (HTTP_TRUST_UNKNOWN); /* * Look this common name up in the default keychains... @@ -493,43 +556,40 @@ httpCredentialsAreTrusted( */ if (httpCredentialsGetExpiration(credentials) <= httpCredentialsGetExpiration(tcreds) || - !httpCredentialsIsValidName(credentials, common_name)) + !httpCredentialsAreValidForName(credentials, common_name)) { /* * Either the new credentials are not newly issued, or the common name * does not match the issued certificate... */ - trusted = 0; + trust = HTTP_TRUST_INVALID; } - else + else if (httpCredentialsGetExpiration(tcreds) < time(NULL)) { /* - * Flag that we should save the new credentials... + * Save the renewed credentials... */ - save = 1; + trust = HTTP_TRUST_RENEWED; + + httpSaveCredentials(NULL, credentials, common_name); } } httpFreeCredentials(tcreds); } - else if (!httpCredentialsIsValidName(credentials, common_name)) - trusted = 0; - else - save = 1; + else if (!httpCredentialsAreValidForName(credentials, common_name)) + trust = HTTP_TRUST_INVALID; if (!cg->expired_certs && !SecCertificateIsValid(secCert, CFAbsoluteTimeGetCurrent())) - trusted = 0; + trust = HTTP_TRUST_EXPIRED; else if (!cg->any_root && cupsArrayCount(credentials) == 1) - trusted = 0; - - if (trusted && save) - httpSaveCredentials(NULL, credentials, common_name); + trust = HTTP_TRUST_INVALID; CFRelease(secCert); - return (trusted); + return (trust); } @@ -558,69 +618,6 @@ httpCredentialsGetExpiration( } -/* - * 'httpCredentialsIsValidName()' - Return whether the credentials are valid for the given name. - * - * @since CUPS 2.0@ - */ - -int /* O - 1 if valid, 0 otherwise */ -httpCredentialsIsValidName( - cups_array_t *credentials, /* I - Credentials */ - const char *common_name) /* I - Name to check */ -{ - SecCertificateRef secCert; /* Certificate reference */ - CFStringRef cfcert_name = NULL; - /* Certificate's common name (CF string) */ - char cert_name[256]; /* Certificate's common name (C string) */ - int valid = 1; /* Valid name? */ - - - if ((secCert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL) - return (0); - - /* - * Compare the common names... - */ - - if ((cfcert_name = SecCertificateCopySubjectSummary(secCert)) == NULL) - { - /* - * Can't get common name, cannot be valid... - */ - - valid = 0; - } - else if (CFStringGetCString(cfcert_name, cert_name, sizeof(cert_name), kCFStringEncodingUTF8) && - _cups_strcasecmp(common_name, cert_name)) - { - /* - * Not an exact match for the common name, check for wildcard certs... - */ - - const char *domain = strchr(common_name, '.'); - /* Domain in common name */ - - if (strncmp(cert_name, "*.", 2) || !domain || _cups_strcasecmp(domain, cert_name + 1)) - { - /* - * Not a wildcard match. - */ - - /* TODO: Check subject alternate names */ - valid = 0; - } - } - - if (cfcert_name) - CFRelease(cfcert_name); - - CFRelease(secCert); - - return (valid); -} - - /* * 'httpCredentialsString()' - Return a string representing the credentials. * @@ -806,6 +803,7 @@ httpLoadCredentials( (void)path; (void)credentials; (void)common_name; + (void)alt_name; return (-1); #endif /* HAVE_SECKEYCHAINOPEN */ @@ -831,8 +829,6 @@ httpSaveCredentials( SecKeychainRef keychain = NULL;/* Keychain reference */ SecIdentitySearchRef search = NULL; /* Search reference */ SecCertificateRef cert = NULL; /* Certificate */ - CFStringRef cfcommon_name = NULL; - /* Server name */ CFMutableDictionaryRef attrs = NULL; /* Attributes for add */ CFArrayRef list = NULL; /* Keychain list */ @@ -841,6 +837,12 @@ httpSaveCredentials( if (!credentials) goto cleanup; + if (!httpCredentialsAreValidForName(credentials, common_name)) + { + DEBUG_puts("1httpSaveCredentials: Common name does not match."); + return (-1); + } + if ((cert = http_cdsa_create_credential((http_credential_t *)cupsArrayFirst(credentials))) == NULL) { DEBUG_puts("1httpSaveCredentials: Unable to create certificate."); @@ -873,12 +875,6 @@ httpSaveCredentials( goto cleanup; } - if ((cfcommon_name = CFStringCreateWithCString(kCFAllocatorDefault, common_name, kCFStringEncodingUTF8)) == NULL) - { - DEBUG_puts("1httpSaveCredentials: Unable to create common name string."); - goto cleanup; - } - if ((attrs = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks)) == NULL) { DEBUG_puts("1httpSaveCredentials: Unable to create dictionary."); @@ -886,21 +882,15 @@ httpSaveCredentials( } CFDictionaryAddValue(attrs, kSecClass, kSecClassCertificate); - CFDictionaryAddValue(attrs, kSecAttrLabel, cfcommon_name); - CFDictionaryAddValue(attrs, kSecAttrSubject, cfcommon_name); CFDictionaryAddValue(attrs, kSecValueRef, cert); CFDictionaryAddValue(attrs, kSecMatchSearchList, list); /* Note: SecItemAdd consumes "attrs"... */ - if ((err = SecItemAdd(attrs, NULL)) == noErr) - ret = 0; - + err = SecItemAdd(attrs, NULL); DEBUG_printf(("1httpSaveCredentials: SecItemAdd returned %d.", (int)err)); cleanup : - if (cfcommon_name) - CFRelease(cfcommon_name); if (list) CFRelease(list); if (keychain) diff --git a/doc/help/man-client.conf.html b/doc/help/man-client.conf.html index a24cafdbbd..ec11b96f5b 100644 --- a/doc/help/man-client.conf.html +++ b/doc/help/man-client.conf.html @@ -8,46 +8,46 @@

client.conf(5)

Name

-client.conf - client configuration file for cups (deprecated) +client.conf - client configuration file for cups

Description

-The client.conf file configures the CUPS client and is normally located in the /etc/cups and/or ~/.cups directories. -Each line in the file can be a configuration directive, a blank line, or a comment. Comment lines start with the # character. -

Note: Starting with OS X 10.7, this file is only used by command-line and X11 applications. -The ServerName directive is not supported on OS X at all. -

Directives

-The following directives are understood by the client. Consult the online help for detailed descriptions: +The client.conf file configures the CUPS client and is +normally located in the /etc/cups or ~/.cups +directory. Each line in the file can be a configuration +directive, a blank line, or a comment. Comment lines start with +the # character. +

Directives

+The following directives are understood by the client. Consult the +on-line help for detailed descriptions:
-
AllowAnyRoot Y -
AllowAnyRoot N -
Specifies whether to allow TLS with certificates that have not been signed by a trusted Certificate Authority. -The default is "Y". -
AllowExpiredCerts Y -
AllowExpiredCerts N -
Specifies whether to allow TLS with expired certificates. -The default is "Y". -
Encryption IfRequested -
Encryption Never -
Encryption Required -
Specifies the level of encryption that should be used. -
GSSServiceName name -
Specifies the Kerberos service name that is used for authentication, typically "host", "http", or "ipp". -CUPS adds the remote hostname ("name@server.example.com") for you. The default name is "http". -
ServerName hostname-or-ip-address[:port] -
ServerName /domain/socket -
Specifies the address and optionally the port to use when connecting to the server. -Note: This directive it not supported on OS X 10.7 or later. -
ServerName hostname-or-ip-address[:port]/version=1.1 -
Specifies the address and optionally the port to use when connecting to a server running CUPS 1.3.12 and earlier. -
User name -
Specifies the default user name to use for requests. +
Encryption IfRequested +
Encryption Never +
Encryption Required +

+Specifies the level of encryption that is required for a particular +location. +
GSSServiceName name +
Specifies the Kerberos service name that is used for authentication, typically +"host", "http", or "ipp". CUPS adds the remote hostname +("name@server.example.com") for you. The default name is +"http". +
ServerName hostname-or-ip-address[:port] +
ServerName /domain/socket +

+Specifies the address and optionally the port to use when connecting to the +server. Note: Not supported on OS X 10.7 or later. +
ServerName hostname-or-ip-address[:port]/version=1.1 +

+Specifies the address and optionally the port to use when connecting to a +server running CUPS 1.3.12 and earlier. Note: Not supported on OS X 10.7 or +later. +
User name +

+Specifies the default user name to use for requests.
-

Notes

-The client.conf file is deprecated and will no longer be supported in a future version of CUPS.

See Also

-cups(1), -CUPS Online Help (http://localhost:631/help) +http://localhost:631/help

Copyright

-Copyright © 2007-2014 by Apple Inc. +Copyright 2007-2013 by Apple Inc. diff --git a/doc/help/man-cups-files.conf.html b/doc/help/man-cups-files.conf.html index b4778bfdb2..f23cbdbd08 100644 --- a/doc/help/man-cups-files.conf.html +++ b/doc/help/man-cups-files.conf.html @@ -10,138 +10,109 @@

Name

cups-files.conf - file and directory configuration file for cups

Description

-The cups-files.conf file configures the files and directories used by the CUPS scheduler, -cupsd(8). -It is normally located in the /etc/cups directory. -

Each line in the file can be a configuration directive, a blank line, or a comment. -Comment lines start with the # character. -

Directives

-The following directives are understood by -cupsd(8): +The cups-files.conf file configures the files and directories used by the +CUPS scheduler, cupsd(8). It is normally located in the +/etc/cups directory. +

Each line in the file can be a configuration directive, a blank line, +or a comment. Comment lines start with the # character. +

Directives

+The following directives are understood by cupsd(8). Consult the +on-line help for detailed descriptions:
-
AccessLog filename -
AccessLog [ filename ] -
AccessLog syslog -
Defines the access log filename. -The value "syslog" causes log entries to be sent to the system log daemon. -Specifying a blank filename disables access log generation. -The server name may be included in filenames using the string "%s", for example: -
-
-    AccessLog /var/log/cups/%s-access_log
-
-
-
ConfigFilePerm mode -
Specifies the permissions for all configuration files that the scheduler writes. -The default is 0644 on OS X and 0640 on all other operating systems. -Note: The permissions for the printers.conf file are currently masked to only allow access from the scheduler user (typically root). -This is done because printer device URIs sometimes contain sensitive authentication information that should not be generally known on the system. -There is no way to disable this security feature. -
DataDir path -
Specifies the directory where data files can be found. The default is usually /usr/share/cups. -
DocumentRoot directory -
Specifies the root directory for the CUPS web interface content. The default is usually /usr/share/doc/cups. -
ErrorLog [ filename ] -
ErrorLog syslog -
Defines the error log filename. -The value "syslog" causes log entries to be sent to the system log daemon. -Specifying a blank filename disables error log generation. -The server name may be included in filenames using the string "%s", for example: -
-
-    ErrorLog /var/log/cups/%s-error_log
-
-
-
FatalErrors none -
FatalErrors all -kind [ ... -kind ] -
FatalErrors kind [ ... kind ] -
Specifies which errors are fatal, causing the scheduler to exit. -The default setting is "config". -The kind strings are: -
-
-
none -
No errors are fatal. -
all -
All of the errors below are fatal. -
browse -
Browsing initialization errors are fatal, for example failed connections to the DNS-SD daemon. -
config -
Configuration file syntax errors are fatal. -
listen -
Listen or Port errors are fatal, except for IPv6 failures on the loopback or "any" addresses. -
log -
Log file creation or write errors are fatal. -
permissions -
Bad startup file permissions are fatal, for example shared TLS certificate and key files with world-read permissions. -
-
FileDevice Yes -
FileDevice No -
Specifies whether the file pseudo-device can be used for new printer queues. -The URI "file:///dev/null" is always allowed. -
FontPath directory[:...:directory] -
Specifies the search path for fonts. -This directive is deprecated and will no longer be supported in a future release of CUPS. -
Group group-name-or-number -
Specifies the group name or ID that will be used when executing external programs. -The default group is operating system specific but is usually lp or nobody. -
LogFilePerm mode -
Specifies the permissions of all log files that the scheduler writes. The default is 0644. -
PageLog [ filename ] -
PageLog syslog -
Defines the page log filename. -The value "syslog" causes log entries to be sent to the system log daemon. -Specifying a blank filename disables page log generation. -The server name may be included in filenames using the string "%s", for example: -
-
-    PageLog /var/log/cups/%s-page_log
-
-
-
Printcap [ filename ] -
Defines the printcap filename that the scheduler automatically updates with the current list of available printers, which is sometimes used by legacy applications. -Specifying a blank filename disables printcap generation. -This directive is deprecated and will no longer be supported in a future release of CUPS. -
RemoteRoot username -
Specifies the username that is associated with unauthenticated accesses by clients claiming to be the root user. -
RequestRoot directory -
Specifies the directory that contains print jobs and other HTTP request data. -
Sandboxing off -
Sandboxing relaxed -
Sandboxing strict -
Specifies the level of security sandboxing that is applied to print filters, backends, and other child processes of the scheduler. -The default is "strict". -This directive is currently only used on OS X. -
ServerBin directory -
Specifies the directory containing the backends, CGI programs, filters, helper programs, notifiers, and port monitors. -
ServerKeychain path -
Specifies the location of TLS certificates and private keys. -
ServerRoot directory -
Specifies the directory containing the server configuration files. -
SyncOnClose Yes -
SyncOnClose No -
Specifies whether the scheduler calls -fsync(2) -after writing configuration or state files. The default is No. -
SystemGroup group-name [ ... group-name ] -
Specifies the group(s) to use for @SYSTEM group authentication. -
TempDir directory -
Specifies the directory where temporary files are stored. -
User username -
Specifies the user name or ID that is used when running external programs. +
AccessLog filename +
AccessLog syslog +

+Defines the access log filename. +
ConfigFilePerm mode +

+Specifies the permissions for all configuration files that the scheduler +writes. +
DataDir path +

+Specified the directory where data files can be found. +
DocumentRoot directory +

+Specifies the root directory for the internal web server documents. +
ErrorLog filename +
ErrorLog syslog +

+Specifies the error log filename. +
FatalErrors none +
FatalErrors all -kind [... -kind] +
FatalErrors kind [... kind] +

+Specifies which errors are fatal, causing the scheduler to exit. "Kind" is +"browse", "config", "listen", "log", or "permissions". +
FileDevice Yes +
FileDevice No +

+Specifies whether the file pseudo-device can be used for new +printer queues. +
FontPath directory[:directory:...] +

+Specifies the search path for fonts. +
Group group-name-or-number +

+Specifies the group name or ID that will be used when executing +external programs. +
LogFilePerm mode +

+Specifies the permissions for all log files that the scheduler writes. +
PageLog filename +
PageLog syslog +

+Specifies the page log filename. +
Printcap +
Printcap filename +

+Specifies the filename for a printcap file that is updated +automatically with a list of available printers (needed for +legacy applications); specifying Printcap with no filename +disables printcap generation. +
RemoteRoot user-name +

+Specifies the username that is associated with unauthenticated root +accesses. +
RequestRoot directory +

+Specifies the directory to store print jobs and other HTTP request +data. +
Sandboxing off +
Sandboxing relaxed +
Sandboxing strict +
Specifies the level of security sandboxing that is applied to print filters, backends, and other child processes of the scheduler. The default is "strict". (OS X only) +
ServerBin directory +

+Specifies the directory where backends, CGIs, daemons, and filters may +be found. +
ServerKeychain path +

+Specifies the location of TLS certificates and private keys. +
ServerRoot directory +

+Specifies the directory where the server configuration files can be found. +
SyncOnClose Yes +
SyncOnClose No +
Specifies whether the scheduler calls fsync(2) after writing configuration +or state files. The default is No. +
SystemGroup group-name [group-name ...] +

+Specifies the group(s) to use for System class authentication. +
TempDir directory +

+Specifies the directory where temporary files are stored. +
User user-name +

+Specifies the user name or ID that is used when running external programs.

See Also

-classes.conf(5), -cups(1), -cupsd(8), -cupsd.conf(5), -mime.convs(5), -mime.types(5), -printers.conf(5), -subscriptions.conf(5), -CUPS Online Help (http://localhost:631/help) +classes.conf(5), cupsd(8), cupsd.conf(5), mime.convs(5), +mime.types(5), printers.conf(5), +subscriptions.conf(5), +
+http://localhost:631/help

Copyright

-Copyright © 2007-2014 by Apple Inc. +Copyright 2007-2014 by Apple Inc. diff --git a/doc/help/man-cupsd.conf.html b/doc/help/man-cupsd.conf.html index c6c71fe626..bdc544a129 100644 --- a/doc/help/man-cupsd.conf.html +++ b/doc/help/man-cupsd.conf.html @@ -14,9 +14,7 @@ The cupsd.conf file configures the CUPS scheduler, cupsd(8). -It is normally located in the -/etc/cups -directory. Note: File, directory, and user configuration directives that used to be allowed in the cupsd.conf file are now stored in the cups-files.conf(5) instead in order to prevent certain types of privilege escalation attacks. +It is normally located in the /etc/cups directory. Note: File, directory, and user configuration directives that used to be allowed in the cupsd.conf file are now stored in the cups-files.conf(5) instead in order to prevent certain types of privilege escalation attacks.

Each line in the file can be a configuration directive, a blank line, or a comment. Comment lines start with the # character. The configuration directives are intentionally similar to those used by the popular Apache web server software and are described below.

Top-level Directives

The following directives are understood by diff --git a/doc/help/man-cupsd.html b/doc/help/man-cupsd.html index 1050d3a525..7f8242408b 100644 --- a/doc/help/man-cupsd.html +++ b/doc/help/man-cupsd.html @@ -11,20 +11,9 @@ cupsd - cups scheduler

Synopsis

cupsd -[ --c +[ -c config-file -] [ --f -] [ --F -] [ --h -] [ --l -] [ --t -] +] [ -f ] [ -F ] [ -h ] [ -l ] [ -t ]

Description

cupsd is the scheduler for CUPS. It implements a printing system based upon the Internet Printing Protocol, version 2.1. If no options are specified on the command-line then the default configuration file @@ -32,83 +21,33 @@ is the scheduler for CUPS. It implements a printing system based upon the Intern will be used.

Options

-
-c config-file +
-c config-file
Uses the named configuration file. -
-f +
-f
Run cupsd in the foreground; the default is to run in the background as a "daemon". -
-F +
-F
Run cupsd in the foreground but detach the process from the controlling terminal and current directory. This is useful for running -cupsd -from -init(8). -
-h +cupsdfrominit(8). +
-h
Shows the program usage. -
-l +
-l
This option is passed to cupsd when it is run from -launchd(8) -or -systemd(8). -
-t +launchd(8). +
-t
Test the configuration file for syntax errors.
-

Files

-
-/etc/cups/classes.conf
-/etc/cups/cups-files.conf
-/etc/cups/cupsd.conf
-/usr/share/cups/mime/mime.convs
-/usr/share/cups/mime/mime.types
-/etc/cups/printers.conf
-
-

Conforming To

-cupsd -implements all of the required IPP/2.1 attributes and operations. It also implements several CUPS-specific administrative operations. -

Examples

-Run -cupsd -in the background with the default configuration file: -
-
-    cupsd
-
-
-Test a configuration file called -test.conf: -
-
-    cupsd -t -c test.conf
-
-
-Run +

Compatibility

cupsd -in the foreground with a test configuration file called -test.conf: -
-
-    cupsd -f -c test.conf
-
-
+implements all of the required IPP/2.1 attributes and operations. It also implements several CUPS-specific administration operations.

See Also

-backend(7), -classes.conf(5), -cups(1), -cups-deviced(8), -cups-driverd(8), -cups-lpd(8), -cupsd.conf(5), -filter(7), -launchd(8), -mime.convs(5), -mime.types(5), -printers.conf(5), -systemd(8), -CUPS Online Help (http://localhost:631/help) +backend(7),classes.conf(5),cups-deviced(8),cups-driverd(8),cups-lpd(8),cupsd.conf(5),filter(7),launchd(8),mime.convs(5),mime.types(5),printers.conf(5), +http://localhost:631/help

Copyright

Copyright © 2007-2014 by Apple Inc. diff --git a/xcode/CUPS.xcodeproj/project.pbxproj b/xcode/CUPS.xcodeproj/project.pbxproj index 786e240fd2..c198e99830 100644 --- a/xcode/CUPS.xcodeproj/project.pbxproj +++ b/xcode/CUPS.xcodeproj/project.pbxproj @@ -339,6 +339,21 @@ 728FB7EE15361642005426E1 /* SystemConfiguration.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E8136B64B000836530 /* SystemConfiguration.framework */; }; 728FB7F11536167A005426E1 /* libiconv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7EF1536167A005426E1 /* libiconv.dylib */; }; 728FB7F21536167A005426E1 /* libresolv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7F01536167A005426E1 /* libresolv.dylib */; }; + 72BFD5FB191AF0A30005DA37 /* libcups_static.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 72A4332F155844CF002E172D /* libcups_static.a */; }; + 72BFD5FC191AF0A30005DA37 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E5136B64AF00836530 /* CoreFoundation.framework */; }; + 72BFD5FD191AF0A30005DA37 /* Kerberos.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E6136B64B000836530 /* Kerberos.framework */; }; + 72BFD5FE191AF0A30005DA37 /* libiconv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7EF1536167A005426E1 /* libiconv.dylib */; }; + 72BFD5FF191AF0A30005DA37 /* libresolv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7F01536167A005426E1 /* libresolv.dylib */; }; + 72BFD600191AF0A30005DA37 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7EC1536161C005426E1 /* libz.dylib */; }; + 72BFD601191AF0A30005DA37 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E7136B64B000836530 /* Security.framework */; }; + 72BFD602191AF1270005DA37 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E5136B64AF00836530 /* CoreFoundation.framework */; }; + 72BFD603191AF1270005DA37 /* GSS.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 72D53A2915B49110003F877F /* GSS.framework */; }; + 72BFD604191AF1270005DA37 /* Kerberos.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E6136B64B000836530 /* Kerberos.framework */; }; + 72BFD605191AF1270005DA37 /* libiconv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7EF1536167A005426E1 /* libiconv.dylib */; }; + 72BFD606191AF1270005DA37 /* libresolv.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7F01536167A005426E1 /* libresolv.dylib */; }; + 72BFD607191AF1270005DA37 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 728FB7EC1536161C005426E1 /* libz.dylib */; }; + 72BFD608191AF1270005DA37 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E7136B64B000836530 /* Security.framework */; }; + 72BFD609191AF14C0005DA37 /* SystemConfiguration.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 278C58E8136B64B000836530 /* SystemConfiguration.framework */; }; 72C16CB9137B195D007E4BF4 /* file.c in Sources */ = {isa = PBXBuildFile; fileRef = 72C16CB8137B195D007E4BF4 /* file.c */; }; 72CEF95618A966E000FA9B81 /* libcups.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 72220EAE1333047D00FCA411 /* libcups.dylib */; }; 72CF95E318A13543000FCAE4 /* dest-job.c in Sources */ = {isa = PBXBuildFile; fileRef = 72CF95E018A13543000FCAE4 /* dest-job.c */; }; @@ -1501,6 +1516,14 @@ isa = PBXFrameworksBuildPhase; buildActionMask = 2147483647; files = ( + 72BFD609191AF14C0005DA37 /* SystemConfiguration.framework in Frameworks */, + 72BFD602191AF1270005DA37 /* CoreFoundation.framework in Frameworks */, + 72BFD603191AF1270005DA37 /* GSS.framework in Frameworks */, + 72BFD604191AF1270005DA37 /* Kerberos.framework in Frameworks */, + 72BFD605191AF1270005DA37 /* libiconv.dylib in Frameworks */, + 72BFD606191AF1270005DA37 /* libresolv.dylib in Frameworks */, + 72BFD607191AF1270005DA37 /* libz.dylib in Frameworks */, + 72BFD608191AF1270005DA37 /* Security.framework in Frameworks */, ); runOnlyForDeploymentPostprocessing = 0; }; @@ -1577,6 +1600,13 @@ isa = PBXFrameworksBuildPhase; buildActionMask = 2147483647; files = ( + 72BFD5FB191AF0A30005DA37 /* libcups_static.a in Frameworks */, + 72BFD5FC191AF0A30005DA37 /* CoreFoundation.framework in Frameworks */, + 72BFD5FD191AF0A30005DA37 /* Kerberos.framework in Frameworks */, + 72BFD5FE191AF0A30005DA37 /* libiconv.dylib in Frameworks */, + 72BFD5FF191AF0A30005DA37 /* libresolv.dylib in Frameworks */, + 72BFD600191AF0A30005DA37 /* libz.dylib in Frameworks */, + 72BFD601191AF0A30005DA37 /* Security.framework in Frameworks */, ); runOnlyForDeploymentPostprocessing = 0; };