Bump version numbers.

- Lots of usage of localtime and gmtime (use _r/_s versions instead -
  Issue #5685)
- Some unnecessary comparisons
- Suppress checks that are not useful (header guards, short global names, and
  the integer overflow checks which don't reflect the actual range of values)

.gitignore

@@ -1,12 +1,7 @@
 *.a
 *.bck
-*.cgi
-*.dylib
 *.gz
 *.o
-*.so
-*.so.*
-*.tokens
 .buildrev
 autom4te.cache
 config.h
@@ -29,7 +24,11 @@ berkeley/lpc
 berkeley/lpq
 berkeley/lpr
 berkeley/lprm
-cgi-bin/makedocset
+cgi-bin/admin.cgi
+cgi-bin/classes.cgi
+cgi-bin/help.cgi
+cgi-bin/jobs.cgi
+cgi-bin/printers.cgi
 cgi-bin/testcgi
 cgi-bin/testhi
 cgi-bin/testhi.index
@@ -39,6 +38,10 @@ conf/cupsd.conf
 conf/mime.convs
 conf/pam.std
 conf/snmp.conf
+cups/libcups.2.dylib
+cups/libcups.dylib
+cups/libcups.so
+cups/libcups.so.2
 cups/locale/
 cups/test.pwg
 cups/testadmin
@@ -64,6 +67,10 @@ doc/index.html
 doc/*/index.html
 filter/commandtops
 filter/gziptoany
+filter/libcupsimage.2.dylib
+filter/libcupsimage.dylib
+filter/libcupsimage.so
+filter/libcupsimage.so.2
 filter/pstops
 filter/rasterbench
 filter/rastertoepson
@@ -153,6 +160,8 @@ test/ippserver
 test/ippserver-shared
 test/ipptool
 test/ipptool-static
+vcnet/.vs
+vcnet/packages
+vcnet/x64
 xcode/CUPS.xcodeproj/project.xcworkspace/
 xcode/CUPS.xcodeproj/xcuserdata/
-

CHANGES.md

@@ -1,5 +1,257 @@
-CHANGES - 2.2.6 - 2017-11-01
-============================
+CHANGES - 2.2.13 - 2019-12-13
+=============================
+
+
+Changes in CUPS v2.2.13
+-----------------------
+
+- CVE-2019-2228: The `ippSetValuetag` function did not validate the default
+  language value.
+- Added a workaround for the scheduler's systemd support (Issue #5640)
+- Fixed spelling of "fold-accordion".
+- Fixed the default common name for TLS certificates used by `ippserver`.
+- The libusb-based USB backend now reports an error when the distribution
+  permissions are wrong (Issue #5658)
+- Default printers set with `lpoptions` did not work in all cases (Issue #5681,
+  Issue #5683, Issue #5684)
+- Fixed an off-by-one error in `ippEnumString` (Issue #5695)
+- Fixed some new compiler warnings (Issue #5700)
+- Fixed a few issues with the Apple Raster support (rdar://55301114)
+- The IPP backend did not detect all cases where a job should be retried using
+  a raster format (rdar://56021091)
+
+
+Changes in CUPS v2.2.12
+-----------------------
+
+- CVE-2019-8696 and CVE-2019-8675: Fixed SNMP buffer overflows (rdar://51685251)
+- The `cupsctl` command now prevents setting "cups-files.conf" directives
+  (Issue #5530)
+- Updated the systemd service file for cupsd (Issue #5551)
+- The `cupsCheckDestSupported` function did not check octetString values
+  correctly (Issue #5557)
+- The scheduler did not encode octetString values like "job-password" correctly
+  for the print filters (Issue #5558)
+- Restored minimal support for the `Emulators` keyword in PPD files to allow
+  old Samsung printer drivers to continue to work (Issue #5562)
+- Timed out job submission now yields an error (Issue #5570)
+- The footer in the web interface covered some content on small displays
+  (Issue #5574)
+- The libusb-based USB backend now enforces read limits, improving print speed
+  in many cases (Issue #5583)
+- Fixed some compatibility issues with old releases of CUPS (Issue #5587)
+- Fixed a bug in the scheduler job cleanup code (Issue #5588)
+- "make" failed with GZIP options (Issue #5595)
+- Added FIPS-140 workarounds for GNU TLS (Issue #5601, Issue #5622)
+- The scheduler no longer provides a default value for the description
+  (Issue #5603)
+- The `lpadmin` command did not always update the PPD file for changes to the
+  `cupsIPPSupplies` and `cupsSNMPSupplies` keywords (Issue #5610)
+- The scheduler now uses both the group's membership list as well as the
+  various OS-specific membership functions to determine whether a user belongs
+  to a named group (Issue #5613)
+- Added USB quirks rule for HP LaserJet 1015 (Issue #5617)
+- Fixed some PPD parser issues (Issue #5623, Issue #5624)
+- The IPP parser no longer allows invalid member attributes in collections
+  (Issue #5630)
+- Fixed IPP buffer overflow (rdar://50035411)
+- Fixed memory disclosure issue in the scheduler (rdar://51373853)
+- Fixed DoS issues in the scheduler (rdar://51373929)
+- The scheduler would restart continuously when idle and printers were not
+  shared (rdar://52561199)
+- Fixed a command ordering issue in the Zebra ZPL driver.
+- Fixed a memory leak in `ppdOpen`.
+
+
+Changes in CUPS v2.2.11
+-----------------------
+
+- Running ppdmerge with the same input and output filenames did not work as
+  advertised (Issue #5455)
+- Fixed a potential memory leak when reading at the end of a file (Issue #5473)
+- Fixed potential unaligned accesses in the string pool (Issue #5474)
+- Fixed a potential memory leak when loading a PPD file (Issue #5475)
+- Added a USB quirks rule for the Lexmark E120n (Issue #5478)
+- Updated the USB quirks rule for Zebra label printers (Issue #5395)
+- Fixed a compile error on Linux (Issue #5483)
+- The lpadmin command, web interface, and scheduler all queried an IPP
+  Everywhere printer differently, resulting in different PPDs for the same
+  printer (Issue #5484)
+- Fixed an issue with the self-signed certificates generated by GNU TLS
+  (Issue #5506)
+- The `ippValidateAttribute` function did not catch all instances of invalid
+  UTF-8 strings (Issue #5509)
+- Non-Kerberized printing to Windows via IPP was broken (Issue #5515)
+- The scheduler no longer stops a printer if an error occurs when a job is
+  canceled or aborted (Issue #5517)
+- Added a USB quirks rule for the DYMO 450 Turbo (Issue #5521)
+- Added a USB quirks rule for Xerox printers (Issue #5523)
+- The scheduler's self-signed certificate did not include all of the alternate
+  names for the server when using GNU TLS (Issue #5525)
+- Fixed compiler warnings with newer versions of GCC (Issue #5532, Issue #5533)
+- Fixed some PPD caching and IPP Everywhere PPD accounting/password bugs
+  (Issue #5535)
+- Fixed `PreserveJobHistory` bug with time values (Issue #5538)
+- Media size matching now uses a tolerance of 0.5mm (rdar://33822024)
+- The lpadmin command would hang with a bad PPD file (rdar://41495016)
+- Fixed a potential crash bug in cups-driverd (rdar://46625579)
+- Fixed a performance regression with large PPDs (rdar://47040759)
+- The scheduler did not always idle exit as quickly as it could.
+
+
+Changes in CUPS v2.2.10
+-----------------------
+
+- CVE-2018-4300: Linux session cookies used a predictable random number seed.
+- The `lpoptions` command now works with IPP Everywhere printers that have not
+  yet been added as local queues (Issue #5045)
+- Added USB quirk rules (Issue #5395, Issue #5443)
+- The generated PPD files for IPP Everywhere printers did not contain the
+  cupsManualCopies keyword (Issue #5433)
+- Kerberos credentials might be truncated (Issue #5435)
+- The handling of `MaxJobTime 0` did not match the documentation (Issue #5438)
+- Incorporated the page accounting changes from CUPS 2.3 (Issue #5439)
+- Fixed a bug adding a queue with the `-E` option (Issue #5440)
+- Fixed a crash bug when mapping PPD duplex options to IPP attributes
+  (rdar://46183976)
+
+
+Changes in CUPS v2.2.9
+----------------------
+
+- Localization changes (Issue #5348, Issue #5362, Issue #5408)
+- Documentation updates (Issue #5369)
+- The lpadmin command would create a non-working printer in some error cases
+  (Issue #5305)
+- The scheduler would crash if an empty `AccessLog` directive was specified
+  (Issue #5309)
+- Fixed a regression in the changes to ippValidateAttribute (Issue #5322,
+  Issue #5330)
+- Fixed a crash bug in the Epson dot matrix driver (Issue #5323)
+- Automatic debug logging of job errors did not work with systemd (Issue #5337)
+- The web interface did not list the IPP Everywhere "driver" (Issue #5338)
+- The IPP Everywhere "driver" now properly supports face-up printers
+  (Issue #5345)
+- Fixed some typos in the label printer drivers (Issue #5350)
+- Multi-file jobs could get stuck if the backend failed (Issue #5359,
+  Issue #5413)
+- The IPP Everywhere "driver" no longer does local filtering when printing to
+  a shared CUPS printer (Issue #5361)
+- The lpadmin command now correctly reports IPP errors when configuring an
+  IPP Everywhere printer (Issue #5370)
+- Fixed some memory leaks discovered by Coverity (Issue #5375)
+- The PPD compiler incorrectly terminated JCL options (Issue #5379)
+- The cupstestppd utility did not generate errors for missing/mismatched
+  CloseUI/JCLCloseUI keywords (Issue #5381)
+- The scheduler now reports the actual location of the log file (Issue #5398)
+- Added a USB quirk rule (Issue #5420)
+- The scheduler was being backgrounded on macOS, causing applications to spin
+  (rdar://40436080)
+- The scheduler did not validate that required initial request attributes were
+  in the operation group (rdar://41098178)
+- Authentication in the web interface did not work on macOS (rdar://41444473)
+- Fixed an issue with HTTP Digest authentication (rdar://41709086)
+- The scheduler could crash when job history was purged (rdar://42198057)
+- Dropped non-working RSS subscriptions UI from web interface templates.
+- Fixed a memory leak for some IPP (extension) syntaxes.
+
+
+Changes in CUPS v2.2.8
+----------------------
+
+- Additional changes for the scheduler to substitute default values for invalid
+  job attributes when running in "relaxed conformance" mode (Issue #5229)
+- The `ipptool` program no longer checks for duplicate attributes when running
+  in list or CSV mode (Issue #5278)
+- Fixed builds without PAM (Issue #5283)
+- Fixed `lpoptions` man page (Issue #5286)
+- The `cupsCreateJob`, `cupsPrintFile2`, and `cupsPrintFiles2` APIs did not use
+  the supplied HTTP connection (Issue #5288)
+- Fixed another crash in the scheduler when adding an IPP Everywhere printer
+  (Issue #5290)
+- Added a workaround for certain web browsers that do not support multiple
+  authentication schemes in a single response header (Issue #5289)
+- Fixed policy limits containing the `All` operation (Issue #5296)
+- The scheduler was always restarted after idle-exit with systemd (Issue #5297)
+- Added a USB quirks rule for the HP LaserJet P1102 (Issue #5310)
+- The mailto notifier did not wait for the welcome message (Issue #5312)
+- Fixed a parsing bug in the pstops filter (Issue #5321)
+- Documentation updates (Issue #5299, Issue #5301, Issue #5306)
+- Localization updates (Issue #5317)
+- The scheduler allowed environment variables to be specified in the
+  `cupsd.conf` file (rdar://37836779, rdar://37836995, rdar://37837252,
+  rdar://37837581)
+- Fax queues did not support pause (p) or wait-for-dialtone (w) characters
+  (rdar://39212256)
+- The scheduler did not validate notify-recipient-uri values properly
+  (rdar://40068936)
+- The IPP parser allowed invalid group tags (rdar://40442124)
+- Fixed a parsing bug in the new authentication code.
+
+
+Changes in CUPS v2.2.7
+----------------------
+
+- NOTICE: Raw print queues are now deprecated (Issue #5269)
+- Fixed an Avahi crash bug in the scheduler (Issue #5268)
+- The IPP Everywhere PPD generator did not include the `cupsJobPassword`
+  keyword, when supported (Issue #5265)
+- Systemd did not restart cupsd when configuration changes were made that
+  required a restart (Issue #5263)
+- The Lexmark Optra E310 printer needs the "no-reattach" USB quirk rule
+  (Issue #5259)
+- The scheduler could crash while adding an IPP Everywhere printer (Issue #5258)
+- Label printers supported by the rastertolabel driver don't support SNMP, so
+  don't delay printing to test it (Issue #5256)
+- Fixed a compile issue when PAM is not available (Issue #5253)
+- Documentation fixes (Issue #5252)
+- Star Micronics printers need the "unidir" USB quirk rule (Issue #5251)
+- The scheduler now supports using temporary print queues for older IPP/1.1
+  print queues like those shared by CUPS 1.3 and earlier (Issue #5241)
+- Fixed printing to some IPP Everywhere printers (Issue #5238)
+- Kerberized printing to another CUPS server did not work correctly
+  (Issue #5233)
+- The `cupsRasterWritePixels` function did not correctly swap bytes for some
+  formats (Issue #5225)
+- Added a USB quirk rule for Canon MP280 series printers (Issue #5221)
+- The `ppdInstallableConflict` tested too many constraints (Issue #5213)
+- More fixes for printing to old CUPS servers (Issue #5211)
+- The `cupsCopyDest` function now correctly copies the `is_default` value
+  (Issue #5208)
+- The scheduler did not work with older versions of uClibc (Issue #5188)
+- The scheduler now substitutes default values for invalid job attributes when
+  running in "relaxed conformance" mode (Issue #5186)
+- Fixed PAM module detection and added support for the common PAM definitions
+  (Issue #5185)
+- Fixed a journald support bug in the scheduler (Issue #5181)
+- The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop
+  was seen (Issue #5170)
+- Fixed group validation on OpenBSD (Issue #5166)
+- Fixed the `ippserver` sample code when threading is disabled or unavailable
+  (Issue #5154)
+- The `cupsEnumDests` function did not include options from the lpoptions files
+  (Issue #5144)
+- The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to
+  control the minimum and maximum TLS versions that will be allowed,
+  respectively (Issue #5119)
+- The scheduler did not write out dirty configuration and state files if there
+  were open client connections (Issue #5118)
+- The `lpadmin` command now provides a better error message when an unsupported
+  System V interface script is used (Issue #5111)
+- The `lp` and `lpr` commands now provide better error messages when the default
+  printer cannot be found (Issue #5096)
+- No longer support backslash, question mark, or quotes in printer names
+  (Issue #4966)
+- The CUPS library now supports the latest HTTP Digest authentication
+  specification including support for SHA-256 (Issue #4862)
+- The `lpstat` command now reports when new jobs are being held (Issue #4761)
+- The `lpoptions` command incorrectly saved default options (Issue #4717)
+- The `ppdLocalizeIPPReason` function incorrectly returned a localized version
+  of "none" (rdar://36566269)
+- TLS connections now properly timeout (rdar://34938533)
+- The IPP backend did not properly detect failed PDF prints (rdar://34055474)
+- Temporary files are now placed in the correct directory for sandboxed
+  applications on macOS (rdar://problem/37789645)
 
 
 Changes in CUPS v2.2.6

INSTALL.md

@@ -1,5 +1,5 @@
-INSTALL - CUPS v2.2.6 - 2017-11-01
-==================================
+INSTALL - CUPS v2.2.13 - 2019-12-13
+===================================
 
 This file describes how to compile and install CUPS from source code. For more
 information on CUPS see the file called "README.md".  A complete change log can
@@ -21,7 +21,7 @@ does not endorse or support third-party support software for CUPS.
 > c. software updates will often replace parts of your local installation,
 >    potentially rendering your system unusable.
 >
-> Apple only supports using the Clang supplied with Xcode to build CUPS on
+> Apple only supports using the compiler supplied with Xcode to build CUPS on
 > macOS.
 
 

Makedefs.in

@@ -1,7 +1,7 @@
 #
 # Common makefile definitions for CUPS.
 #
-# Copyright 2007-2017 by Apple Inc.
+# Copyright 2007-2019 by Apple Inc.
 # Copyright 1997-2007 by Easy Software Products, all rights reserved.
 #
 # These coded instructions, statements, and computer programs are the
@@ -29,7 +29,7 @@ CHMOD		=	@CHMOD@
 CXX		=	@LIBTOOL_CXX@ @CXX@
 DSO		=	@DSO@
 DSOXX		=	@DSOXX@
-GZIP		=	@GZIP@
+GZIPPROG	=	@GZIPPROG@
 INSTALL		=	@INSTALL@
 LD		=	@LD@
 LD_CC		=	@LD_CC@
@@ -95,10 +95,7 @@ LOCALTARGET     =       @LOCALTARGET@
 #
 
 LIBCUPS		=	@LIBCUPS@
-LIBCUPSCGI	=	@LIBCUPSCGI@
 LIBCUPSIMAGE	=	@LIBCUPSIMAGE@
-LIBCUPSMIME	=	@LIBCUPSMIME@
-LIBCUPSPPDC	=	@LIBCUPSPPDC@
 LIBCUPSSTATIC	=	@LIBCUPSSTATIC@
 LIBGSSAPI	=	@LIBGSSAPI@
 LIBMALLOC	=	@LIBMALLOC@
@@ -126,6 +123,13 @@ IPPALIASES	=	@IPPALIASES@
 
 INSTALLXPC	=	@INSTALLXPC@
 
+#
+# Code signing...
+#
+
+CODE_SIGN	=	@CODE_SIGN@
+CODE_SIGN_IDENTITY = -
+
 #
 # Program options...
 #

Makefile

@@ -1,7 +1,7 @@
 #
 # Top-level Makefile for CUPS.
 #
-# Copyright 2007-2016 by Apple Inc.
+# Copyright 2007-2018 by Apple Inc.
 # Copyright 1997-2007 by Easy Software Products, all rights reserved.
 #
 # These coded instructions, statements, and computer programs are the
@@ -272,32 +272,6 @@ apihelp:
 	done
 
 
-#
-# Create an Xcode docset using Mini-XML's mxmldoc (http://www.msweet.org/)...
-#
-
-docset:	apihelp
-	echo Generating docset directory tree...
-	$(RM) -r org.cups.docset
-	mkdir -p org.cups.docset/Contents/Resources/Documentation/help
-	mkdir -p org.cups.docset/Contents/Resources/Documentation/images
-	cd man; $(MAKE) $(MFLAGS) html
-	cd doc; $(MAKE) $(MFLAGS) docset
-	cd cgi-bin; $(MAKE) $(MFLAGS) makedocset
-	cgi-bin/makedocset org.cups.docset \
-		`svnversion . | sed -e '1,$$s/[a-zA-Z]//g'` \
-		doc/help/api-*.tokens
-	$(RM) doc/help/api-*.tokens
-	echo Indexing docset...
-	/Applications/Xcode.app/Contents/Developer/usr/bin/docsetutil index org.cups.docset
-	echo Generating docset archive and feed...
-	$(RM) org.cups.docset.atom
-	/Applications/Xcode.app/Contents/Developer/usr/bin/docsetutil package --output org.cups.docset.xar \
-		--atom org.cups.docset.atom \
-		--download-url http://www.cups.org/org.cups.docset.xar \
-		org.cups.docset
-
-
 #
 # Lines of code computation...
 #

README.md

@@ -1,5 +1,5 @@
-README - CUPS v2.2.6 - 2017-11-01
-=================================
+README - CUPS v2.2.13 - 2019-12-13
+==================================
 
 Looking for compile instructions?  Read the file `INSTALL.md` instead...
 
@@ -22,8 +22,9 @@ included with CUPS to support many Dymo, EPSON, HP, Intellitech, OKIDATA, and
 Zebra printers.  Many more drivers are available online and (in some cases) on
 the driver CD-ROM that came with your printer.
 
-CUPS is licensed under the GNU General Public License and GNU Library General
-Public License versions 2.  See the file "LICENSE.txt" for more information.
+CUPS 2.2.x is licensed under the GNU General Public License and GNU Library
+General Public License versions 2.  See the file "LICENSE.txt" for more
+information.
 
 
 READING THE DOCUMENTATION
@@ -148,7 +149,7 @@ This will prevent the filters from misinterpreting your print file.
 LEGAL STUFF
 -----------
 
-CUPS is copyright © 2007-2017 by Apple Inc.  CUPS and the CUPS logo are
+CUPS is copyright © 2007-2019 by Apple Inc.  CUPS and the CUPS logo are
 trademarks of Apple Inc.
 
 The MD5 Digest code is Copyright 1999 Aladdin Enterprises.

backend/Makefile

@@ -250,6 +250,7 @@ libbackend.a:	$(LIBOBJS)
 dnssd:	dnssd.o ../cups/$(LIBCUPS) libbackend.a
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o dnssd dnssd.o libbackend.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	if test `uname` = Darwin; then \
 		$(RM) mdns; \
 		$(LN) dnssd mdns; \
@@ -263,6 +264,7 @@ dnssd:	dnssd.o ../cups/$(LIBCUPS) libbackend.a
 ipp:	ipp.o ../cups/$(LIBCUPS) libbackend.a
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o ipp ipp.o libbackend.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	$(RM) http
 	$(LN) ipp http
 
@@ -274,6 +276,7 @@ ipp:	ipp.o ../cups/$(LIBCUPS) libbackend.a
 lpd:	lpd.o ../cups/$(LIBCUPS) libbackend.a
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o lpd lpd.o libbackend.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -283,6 +286,7 @@ lpd:	lpd.o ../cups/$(LIBCUPS) libbackend.a
 snmp:	snmp.o ../cups/$(LIBCUPS) libbackend.a
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o snmp snmp.o libbackend.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -292,12 +296,14 @@ snmp:	snmp.o ../cups/$(LIBCUPS) libbackend.a
 socket:	socket.o ../cups/$(LIBCUPS) libbackend.a
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o socket socket.o libbackend.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 socket-static:	socket.o  ../cups/$(LIBCUPSSTATIC) libbackend.a
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o socket-static socket.o libbackend.a \
 		../cups/$(LIBCUPSSTATIC) $(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) \
 		$(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -308,6 +314,7 @@ usb:	usb.o ../cups/$(LIBCUPS) libbackend.a
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o usb usb.o libbackend.a $(LIBUSB) \
 		$(BACKLIBS) $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 usb.o:	usb.c usb-darwin.c usb-libusb.c usb-unix.c
 
 

backend/dnssd.c

@@ -1,7 +1,7 @@
 /*
  * DNS-SD discovery backend for CUPS.
  *
- * Copyright 2008-2017 by Apple Inc.
+ * Copyright 2008-2018 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -94,7 +94,7 @@ static void		browse_callback(DNSServiceRef sdRef,
 				        const char *serviceName,
 				        const char *regtype,
 				        const char *replyDomain, void *context)
-					__attribute__((nonnull(1,5,6,7,8)));
+					_CUPS_NONNULL((1,5,6,7,8));
 static void		browse_local_callback(DNSServiceRef sdRef,
 					      DNSServiceFlags flags,
 					      uint32_t interfaceIndex,
@@ -103,7 +103,7 @@ static void		browse_local_callback(DNSServiceRef sdRef,
 					      const char *regtype,
 					      const char *replyDomain,
 					      void *context)
-					      __attribute__((nonnull(1,5,6,7,8)));
+					      _CUPS_NONNULL((1,5,6,7,8));
 #endif /* HAVE_DNSSD */
 #ifdef HAVE_AVAHI
 static void		browse_callback(AvahiServiceBrowser *browser,
@@ -121,12 +121,12 @@ static void		client_callback(AvahiClient *client,
 #endif /* HAVE_AVAHI */
 
 static int		compare_devices(cups_device_t *a, cups_device_t *b);
-static void		exec_backend(char **argv) __attribute__((noreturn));
+static void		exec_backend(char **argv) _CUPS_NORETURN;
 static cups_device_t	*get_device(cups_array_t *devices,
 			            const char *serviceName,
 			            const char *regtype,
 				    const char *replyDomain)
-				    __attribute__((nonnull(1,2,3,4)));
+				    _CUPS_NONNULL((1,2,3,4));
 #ifdef HAVE_DNSSD
 static void		query_callback(DNSServiceRef sdRef,
 			               DNSServiceFlags flags,
@@ -136,7 +136,7 @@ static void		query_callback(DNSServiceRef sdRef,
 				       uint16_t rrclass, uint16_t rdlen,
 				       const void *rdata, uint32_t ttl,
 				       void *context)
-				       __attribute__((nonnull(1,5,9,11)));
+				       _CUPS_NONNULL((1,5,9,11));
 #elif defined(HAVE_AVAHI)
 static int		poll_callback(struct pollfd *pollfds,
 			              unsigned int num_pollfds, int timeout,
@@ -153,7 +153,7 @@ static void		query_callback(AvahiRecordBrowser *browser,
 #endif /* HAVE_DNSSD */
 static void		sigterm_handler(int sig);
 static void		unquote(char *dst, const char *src, size_t dstsize)
-			    __attribute__((nonnull(1,2)));
+			    _CUPS_NONNULL((1,2));
 
 
 /*
@@ -1257,6 +1257,13 @@ query_callback(
     strlcat(make_and_model, " ", sizeof(make_and_model));
     strlcat(make_and_model, model, sizeof(make_and_model));
 
+    if (!_cups_strncasecmp(make_and_model, "EPSON EPSON ", 12))
+      _cups_strcpy(make_and_model, make_and_model + 6);
+    else if (!_cups_strncasecmp(make_and_model, "HP HP ", 6))
+      _cups_strcpy(make_and_model, make_and_model + 3);
+    else if (!_cups_strncasecmp(make_and_model, "Lexmark International Lexmark ", 30))
+      _cups_strcpy(make_and_model, make_and_model + 22);
+
     device->make_and_model = strdup(make_and_model);
   }
   else

backend/ipp.c

@@ -1,7 +1,7 @@
 /*
  * IPP backend for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2019 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -47,6 +47,8 @@ extern void	xpc_connection_set_target_uid(xpc_connection_t connection,
 #define _CUPS_JSR_ACCOUNT_LIMIT_REACHED		0x08
 #define _CUPS_JSR_JOB_PASSWORD_WAIT		0x10
 #define _CUPS_JSR_JOB_RELEASE_WAIT		0x20
+#define _CUPS_JSR_DOCUMENT_FORMAT_ERROR		0x40
+#define _CUPS_JSR_DOCUMENT_UNPRINTABLE		0x80
 
 
 /*
@@ -69,6 +71,7 @@ typedef struct _cups_monitor_s		/**** Monitoring data ****/
   http_encryption_t	encryption;	/* Use encryption? */
   ipp_jstate_t		job_state;	/* Current job state */
   ipp_pstate_t		printer_state;	/* Current printer state */
+  int			retryable;	/* Is this a job that should be retried? */
 } _cups_monitor_t;
 
 
@@ -357,8 +360,7 @@ main(int  argc,				/* I - Number of command-line args */
   * that way.
   */
 
-  if (!getuid() && (value = getenv("AUTH_UID")) != NULL &&
-      !getenv("AUTH_PASSWORD"))
+  if (!getuid() && (value = getenv("AUTH_UID")) != NULL)
   {
     uid_t	uid = (uid_t)atoi(value);
 					/* User ID */
@@ -392,7 +394,7 @@ main(int  argc,				/* I - Number of command-line args */
 
 #  else /* No XPC, just try to run as the user ID */
     if (uid > 0)
-      seteuid(uid);
+      setuid(uid);
 #  endif /* HAVE_XPC */
   }
 #endif /* HAVE_GSSAPI */
@@ -424,9 +426,9 @@ main(int  argc,				/* I - Number of command-line args */
     port = IPP_PORT;			/* Default to port 631 */
 
   if (!strcmp(scheme, "https") || !strcmp(scheme, "ipps"))
-    cupsSetEncryption(HTTP_ENCRYPT_ALWAYS);
+    cupsSetEncryption(HTTP_ENCRYPTION_ALWAYS);
   else
-    cupsSetEncryption(HTTP_ENCRYPT_IF_REQUESTED);
+    cupsSetEncryption(HTTP_ENCRYPTION_IF_REQUESTED);
 
  /*
   * See if there are any options...
@@ -513,13 +515,13 @@ main(int  argc,				/* I - Number of command-line args */
 	*/
 
         if (!_cups_strcasecmp(value, "always"))
-	  cupsSetEncryption(HTTP_ENCRYPT_ALWAYS);
+	  cupsSetEncryption(HTTP_ENCRYPTION_ALWAYS);
         else if (!_cups_strcasecmp(value, "required"))
-	  cupsSetEncryption(HTTP_ENCRYPT_REQUIRED);
+	  cupsSetEncryption(HTTP_ENCRYPTION_REQUIRED);
         else if (!_cups_strcasecmp(value, "never"))
-	  cupsSetEncryption(HTTP_ENCRYPT_NEVER);
+	  cupsSetEncryption(HTTP_ENCRYPTION_NEVER);
         else if (!_cups_strcasecmp(value, "ifrequested"))
-	  cupsSetEncryption(HTTP_ENCRYPT_IF_REQUESTED);
+	  cupsSetEncryption(HTTP_ENCRYPTION_IF_REQUESTED);
 	else
 	{
 	  _cupsLangPrintFilter(stderr, "ERROR",
@@ -707,11 +709,11 @@ main(int  argc,				/* I - Number of command-line args */
     fprintf(stderr, "DEBUG: Connecting to %s:%d\n", hostname, port);
     _cupsLangPrintFilter(stderr, "INFO", _("Connecting to printer."));
 
-    if (httpReconnect(http))
+    if (httpReconnect2(http, 30000, NULL))
     {
       int error = errno;		/* Connection error */
 
-      if (http->status == HTTP_PKI_ERROR)
+      if (http->status == HTTP_STATUS_CUPS_PKI_ERROR)
 	update_reasons(NULL, "+cups-certificate-error");
 
       if (job_canceled)
@@ -914,7 +916,7 @@ main(int  argc,				/* I - Number of command-line args */
     * Build the IPP request...
     */
 
-    request = ippNewRequest(IPP_GET_PRINTER_ATTRIBUTES);
+    request = ippNewRequest(IPP_OP_GET_PRINTER_ATTRIBUTES);
     ippSetVersion(request, version / 10, version % 10);
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
         	 NULL, uri);
@@ -929,7 +931,7 @@ main(int  argc,				/* I - Number of command-line args */
 
     fputs("DEBUG: Getting supported attributes...\n", stderr);
 
-    if (http->version < HTTP_1_1)
+    if (http->version < HTTP_VERSION_1_1)
     {
       fprintf(stderr, "DEBUG: Printer responded with HTTP version %d.%d.\n",
               http->version / 100, http->version % 100);
@@ -943,15 +945,15 @@ main(int  argc,				/* I - Number of command-line args */
     fprintf(stderr, "DEBUG: Get-Printer-Attributes: %s (%s)\n",
             ippErrorString(ipp_status), cupsLastErrorString());
 
-    if (ipp_status <= IPP_OK_CONFLICT)
+    if (ipp_status <= IPP_STATUS_OK_CONFLICTING)
       password_tries = 0;
     else
     {
       fprintf(stderr, "DEBUG: Get-Printer-Attributes returned %s.\n",
               ippErrorString(ipp_status));
 
-      if (ipp_status == IPP_PRINTER_BUSY ||
-	  ipp_status == IPP_SERVICE_UNAVAILABLE)
+      if (ipp_status == IPP_STATUS_ERROR_BUSY ||
+	  ipp_status == IPP_STATUS_ERROR_SERVICE_UNAVAILABLE)
       {
         if (contimeout && (time(NULL) - start_time) > contimeout)
 	{
@@ -968,8 +970,8 @@ main(int  argc,				/* I - Number of command-line args */
 
         delay = _cupsNextDelay(delay, &prev_delay);
       }
-      else if ((ipp_status == IPP_BAD_REQUEST ||
-	        ipp_status == IPP_VERSION_NOT_SUPPORTED) && version > 10)
+      else if ((ipp_status == IPP_STATUS_ERROR_BAD_REQUEST ||
+	        ipp_status == IPP_STATUS_ERROR_VERSION_NOT_SUPPORTED) && version > 10)
       {
        /*
 	* Switch to IPP/1.1 or IPP/1.0...
@@ -992,9 +994,9 @@ main(int  argc,				/* I - Number of command-line args */
 	  version = 10;
         }
 
-	httpReconnect(http);
+	httpReconnect2(http, 30000, NULL);
       }
-      else if (ipp_status == IPP_NOT_FOUND)
+      else if (ipp_status == IPP_STATUS_ERROR_NOT_FOUND)
       {
         _cupsLangPrintFilter(stderr, "ERROR",
 			     _("The printer configuration is incorrect or the "
@@ -1004,8 +1006,8 @@ main(int  argc,				/* I - Number of command-line args */
 
 	return (CUPS_BACKEND_STOP);
       }
-      else if (ipp_status == IPP_FORBIDDEN ||
-               ipp_status == IPP_AUTHENTICATION_CANCELED)
+      else if (ipp_status == IPP_STATUS_ERROR_FORBIDDEN ||
+               ipp_status == IPP_STATUS_ERROR_CUPS_AUTHENTICATION_CANCELED)
       {
         const char *www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE);
         				/* WWW-Authenticate field value */
@@ -1018,13 +1020,13 @@ main(int  argc,				/* I - Number of command-line args */
 	fprintf(stderr, "ATTR: auth-info-required=%s\n", auth_info_required);
 	return (CUPS_BACKEND_AUTH_REQUIRED);
       }
-      else if (ipp_status != IPP_NOT_AUTHORIZED)
+      else if (ipp_status != IPP_STATUS_ERROR_NOT_AUTHORIZED)
       {
 	_cupsLangPrintFilter(stderr, "ERROR",
 	                     _("Unable to get printer status."));
         sleep(10);
 
-	httpReconnect(http);
+	httpReconnect2(http, 30000, NULL);
       }
 
       ippDelete(supported);
@@ -1138,7 +1140,14 @@ main(int  argc,				/* I - Number of command-line args */
 	copies_sup = NULL; /* No */
     }
 
-    cups_version = ippFindAttribute(supported, "cups-version", IPP_TAG_TEXT);
+    if ((cups_version = ippFindAttribute(supported, "cups-version", IPP_TAG_TEXT)) != NULL)
+    {
+      const char *version = ippGetString(cups_version, 0, NULL);
+
+      fprintf(stderr, "DEBUG: cups-version = \"%s\"\n", version);
+      if (!strcmp(version, "cups-version"))
+        cups_version = NULL;		/* Bogus cups-version value returned by buggy printers! */
+    }
 
     encryption_sup = ippFindAttribute(supported, "job-password-encryption-supported", IPP_TAG_KEYWORD);
 
@@ -1174,7 +1183,7 @@ main(int  argc,				/* I - Number of command-line args */
                 ippOpString(operations_sup->values[i].integer));
 
       for (i = 0; i < operations_sup->num_values; i ++)
-        if (operations_sup->values[i].integer == IPP_PRINT_JOB)
+        if (operations_sup->values[i].integer == IPP_OP_PRINT_JOB)
 	  break;
 
       if (i >= operations_sup->num_values)
@@ -1182,7 +1191,7 @@ main(int  argc,				/* I - Number of command-line args */
 			     "cups-ipp-missing-print-job");
 
       for (i = 0; i < operations_sup->num_values; i ++)
-        if (operations_sup->values[i].integer == IPP_CANCEL_JOB)
+        if (operations_sup->values[i].integer == IPP_OP_CANCEL_JOB)
 	  break;
 
       if (i >= operations_sup->num_values)
@@ -1190,7 +1199,7 @@ main(int  argc,				/* I - Number of command-line args */
 			     "cups-ipp-missing-cancel-job");
 
       for (i = 0; i < operations_sup->num_values; i ++)
-        if (operations_sup->values[i].integer == IPP_GET_JOB_ATTRIBUTES)
+        if (operations_sup->values[i].integer == IPP_OP_GET_JOB_ATTRIBUTES)
 	  break;
 
       if (i >= operations_sup->num_values)
@@ -1198,7 +1207,7 @@ main(int  argc,				/* I - Number of command-line args */
                              "cups-ipp-missing-get-job-attributes");
 
       for (i = 0; i < operations_sup->num_values; i ++)
-        if (operations_sup->values[i].integer == IPP_GET_PRINTER_ATTRIBUTES)
+        if (operations_sup->values[i].integer == IPP_OP_GET_PRINTER_ATTRIBUTES)
 	  break;
 
       if (i >= operations_sup->num_values)
@@ -1207,13 +1216,13 @@ main(int  argc,				/* I - Number of command-line args */
 
       for (i = 0; i < operations_sup->num_values; i ++)
       {
-        if (operations_sup->values[i].integer == IPP_VALIDATE_JOB)
+        if (operations_sup->values[i].integer == IPP_OP_VALIDATE_JOB)
 	  validate_job = 1;
-        else if (operations_sup->values[i].integer == IPP_CREATE_JOB)
+        else if (operations_sup->values[i].integer == IPP_OP_CREATE_JOB)
 	  create_job = 1;
-        else if (operations_sup->values[i].integer == IPP_SEND_DOCUMENT)
+        else if (operations_sup->values[i].integer == IPP_OP_SEND_DOCUMENT)
 	  send_document = 1;
-        else if (operations_sup->values[i].integer == IPP_GET_JOB_ATTRIBUTES)
+        else if (operations_sup->values[i].integer == IPP_OP_GET_JOB_ATTRIBUTES)
 	  get_job_attrs = 1;
       }
 
@@ -1241,7 +1250,7 @@ main(int  argc,				/* I - Number of command-line args */
 
     report_printer_state(supported);
   }
-  while (!job_canceled && ipp_status > IPP_OK_CONFLICT);
+  while (!job_canceled && ipp_status > IPP_STATUS_OK_CONFLICTING);
 
   if (job_canceled)
     return (CUPS_BACKEND_OK);
@@ -1259,7 +1268,7 @@ main(int  argc,				/* I - Number of command-line args */
                                 	 IPP_TAG_BOOLEAN);
 
     if (printer_state == NULL ||
-	(printer_state->values[0].integer > IPP_PRINTER_PROCESSING &&
+	(printer_state->values[0].integer > IPP_PSTATE_PROCESSING &&
 	 waitprinter) ||
 	printer_accepting == NULL ||
 	!printer_accepting->values[0].boolean)
@@ -1385,7 +1394,7 @@ main(int  argc,				/* I - Number of command-line args */
   * (I hate compatibility hacks!)
   */
 
-  if (http->version < HTTP_1_1 && num_files == 0)
+  if (http->version < HTTP_VERSION_1_1 && num_files == 0)
   {
     if ((fd = cupsTempFd(tmpfilename, sizeof(tmpfilename))) < 0)
     {
@@ -1413,7 +1422,7 @@ main(int  argc,				/* I - Number of command-line args */
     files      = &compatfile;
     num_files  = 1;
   }
-  else if (http->version < HTTP_1_1 && num_files == 1)
+  else if (http->version < HTTP_VERSION_1_1 && num_files == 1)
   {
     struct stat	fileinfo;		/* File information */
 
@@ -1446,8 +1455,11 @@ main(int  argc,				/* I - Number of command-line args */
   monitor.create_job    = create_job;
   monitor.get_job_attrs = get_job_attrs;
   monitor.encryption    = cupsEncryption();
-  monitor.job_state     = IPP_JOB_PENDING;
-  monitor.printer_state = IPP_PRINTER_IDLE;
+  monitor.job_state     = IPP_JSTATE_PENDING;
+  monitor.printer_state = IPP_PSTATE_IDLE;
+  monitor.retryable     = argc == 6 && document_format && strcmp(document_format, "image/pwg-raster") && strcmp(document_format, "image/urf");
+
+  fprintf(stderr, "DEBUG: retryable=%d\n", monitor.retryable);
 
   if (create_job)
   {
@@ -1529,10 +1541,10 @@ main(int  argc,				/* I - Number of command-line args */
 			   "cups-ipp-missing-validate-job");
       break;
     }
-    else if (ipp_status < IPP_REDIRECTION_OTHER_SITE ||
-             ipp_status == IPP_BAD_REQUEST)
+    else if (ipp_status < IPP_STATUS_REDIRECTION_OTHER_SITE ||
+             ipp_status == IPP_STATUS_ERROR_BAD_REQUEST)
       break;
-    else if (job_auth == NULL && ipp_status > IPP_BAD_REQUEST)
+    else if (job_auth == NULL && ipp_status > IPP_STATUS_ERROR_BAD_REQUEST)
       goto cleanup;
   }
 
@@ -1557,8 +1569,8 @@ main(int  argc,				/* I - Number of command-line args */
     if (job_canceled)
       break;
 
-    request = new_request((num_files > 1 || create_job) ? IPP_CREATE_JOB :
-                                                          IPP_PRINT_JOB,
+    request = new_request((num_files > 1 || create_job) ? IPP_OP_CREATE_JOB :
+                                                          IPP_OP_PRINT_JOB,
 			  version, uri, argv[2], monitor.job_name, num_options,
 			  options, compression, copies_sup ? copies : 1,
 			  document_format, pc, ppd, media_col_sup,
@@ -1583,7 +1595,7 @@ main(int  argc,				/* I - Number of command-line args */
         fputs("DEBUG: Sending file using HTTP/1.1 chunking...\n", stderr);
 
       http_status = cupsSendRequest(http, request, resource, length);
-      if (http_status == HTTP_CONTINUE && request->state == IPP_DATA)
+      if (http_status == HTTP_STATUS_CONTINUE && request->state == IPP_STATE_DATA)
       {
 	if (compression && strcmp(compression, "none"))
 	  httpSetField(http, HTTP_FIELD_CONTENT_ENCODING, compression);
@@ -1602,7 +1614,7 @@ main(int  argc,				/* I - Number of command-line args */
 	  http_status = cupsWriteRequestData(http, buffer, (size_t)bytes);
         }
 
-        while (http_status == HTTP_CONTINUE &&
+        while (http_status == HTTP_STATUS_CONTINUE &&
                (!job_canceled || compatsize > 0))
 	{
 	 /*
@@ -1627,7 +1639,7 @@ main(int  argc,				/* I - Number of command-line args */
 	      fprintf(stderr, "DEBUG: Read %d bytes...\n", (int)bytes);
 
 	      if ((http_status = cupsWriteRequestData(http, buffer, (size_t)bytes))
-	              != HTTP_CONTINUE)
+	              != HTTP_STATUS_CONTINUE)
 		break;
 	    }
 	    else if (bytes == 0 || (errno != EINTR && errno != EAGAIN))
@@ -1635,7 +1647,7 @@ main(int  argc,				/* I - Number of command-line args */
 	  }
 	}
 
-	if (http_status == HTTP_ERROR)
+	if (http_status == HTTP_STATUS_ERROR)
 	  fprintf(stderr, "DEBUG: Error writing document data for "
 			  "Print-Job: %s\n", strerror(httpError(http)));
 
@@ -1654,7 +1666,7 @@ main(int  argc,				/* I - Number of command-line args */
             ippErrorString(ipp_status), cupsLastErrorString());
     debug_attributes(response);
 
-    if (ipp_status > IPP_OK_CONFLICT)
+    if (ipp_status > IPP_STATUS_OK_CONFLICTING)
     {
       job_id = 0;
 
@@ -1706,7 +1718,7 @@ main(int  argc,				/* I - Number of command-line args */
 	  else if (www_auth[0])
 	    auth_info_required = "username,password";
 	}
-	else if (ipp_status == IPP_REQUEST_VALUE)
+	else if (ipp_status == IPP_STATUS_ERROR_REQUEST_VALUE)
 	{
 	 /*
 	  * Print file is too large, abort this job...
@@ -1762,7 +1774,7 @@ main(int  argc,				/* I - Number of command-line args */
         * Send the next file in the job...
 	*/
 
-	request = ippNewRequest(IPP_SEND_DOCUMENT);
+	request = ippNewRequest(IPP_OP_SEND_DOCUMENT);
 	ippSetVersion(request, version / 10, version % 10);
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
@@ -1791,7 +1803,7 @@ main(int  argc,				/* I - Number of command-line args */
 	debug_attributes(request);
 
 	http_status = cupsSendRequest(http, request, resource, 0);
-	if (http_status == HTTP_CONTINUE && request->state == IPP_DATA)
+	if (http_status == HTTP_STATUS_CONTINUE && request->state == IPP_STATE_DATA)
 	{
 	  if (compression && strcmp(compression, "none"))
 	    httpSetField(http, HTTP_FIELD_CONTENT_ENCODING, compression);
@@ -1815,11 +1827,11 @@ main(int  argc,				/* I - Number of command-line args */
 
 	if (fd >= 0)
 	{
-	  while (!job_canceled && http_status == HTTP_CONTINUE &&
+	  while (!job_canceled && http_status == HTTP_STATUS_CONTINUE &&
 	         (bytes = read(fd, buffer, sizeof(buffer))) > 0)
 	  {
 	    if ((http_status = cupsWriteRequestData(http, buffer, (size_t)bytes))
-	            != HTTP_CONTINUE)
+	            != HTTP_STATUS_CONTINUE)
 	      break;
 	    else
 	    {
@@ -1835,28 +1847,36 @@ main(int  argc,				/* I - Number of command-line args */
 	    close(fd);
 	}
 
-        if (http_status == HTTP_ERROR)
+        if (http_status == HTTP_STATUS_ERROR)
           fprintf(stderr, "DEBUG: Error writing document data for "
                           "Send-Document: %s\n", strerror(httpError(http)));
 
 	response = cupsGetResponse(http, resource);
 	ippDelete(request);
 
-	fprintf(stderr, "DEBUG: Send-Document: %s (%s)\n",
-		ippErrorString(cupsLastError()), cupsLastErrorString());
+	fprintf(stderr, "DEBUG: Send-Document: %s (%s)\n", ippErrorString(cupsLastError()), cupsLastErrorString());
         debug_attributes(response);
-        ippDelete(response);
 
-	if (cupsLastError() > IPP_OK_CONFLICT && !job_canceled)
+	if (cupsLastError() > IPP_STATUS_OK_CONFLICTING && !job_canceled)
 	{
+	  ipp_attribute_t *reasons = ippFindAttribute(response, "job-state-reasons", IPP_TAG_KEYWORD);
+					/* job-state-reasons values */
+
 	  ipp_status = cupsLastError();
 
-	  _cupsLangPrintFilter(stderr, "ERROR",
-			       _("Unable to add document to print job."));
+          if (ippContainsString(reasons, "document-format-error"))
+            ipp_status = IPP_STATUS_ERROR_DOCUMENT_FORMAT_ERROR;
+          else if (ippContainsString(reasons, "document-unprintable"))
+            ipp_status = IPP_STATUS_ERROR_DOCUMENT_UNPRINTABLE;
+
+	  ippDelete(response);
+	  _cupsLangPrintFilter(stderr, "ERROR", _("Unable to add document to print job."));
 	  break;
 	}
 	else
 	{
+	  ippDelete(response);
+
 	  password_tries = 0;
 
 	  if (num_files == 0 || fd < 0)
@@ -1868,12 +1888,12 @@ main(int  argc,				/* I - Number of command-line args */
     if (job_canceled)
       break;
 
-    if (ipp_status <= IPP_OK_CONFLICT && argc > 6)
+    if (ipp_status <= IPP_STATUS_OK_CONFLICTING && argc > 6)
     {
       fprintf(stderr, "PAGE: 1 %d\n", copies_sup ? atoi(argv[4]) : 1);
       copies_remaining --;
     }
-    else if ((ipp_status == IPP_STATUS_ERROR_DOCUMENT_FORMAT_ERROR || ipp_status == IPP_STATUS_ERROR_DOCUMENT_UNPRINTABLE) &&
+    else if ((ipp_status == IPP_STATUS_ERROR_DOCUMENT_FORMAT_NOT_SUPPORTED || ipp_status == IPP_STATUS_ERROR_DOCUMENT_FORMAT_ERROR || ipp_status == IPP_STATUS_ERROR_DOCUMENT_UNPRINTABLE) &&
              argc == 6 &&
              document_format && strcmp(document_format, "image/pwg-raster") && strcmp(document_format, "image/urf"))
     {
@@ -1887,9 +1907,9 @@ main(int  argc,				/* I - Number of command-line args */
 
       goto cleanup;
     }
-    else if (ipp_status == IPP_SERVICE_UNAVAILABLE ||
-             ipp_status == IPP_NOT_POSSIBLE ||
-	     ipp_status == IPP_PRINTER_BUSY)
+    else if (ipp_status == IPP_STATUS_ERROR_SERVICE_UNAVAILABLE ||
+             ipp_status == IPP_STATUS_ERROR_NOT_POSSIBLE ||
+	     ipp_status == IPP_STATUS_ERROR_BUSY)
     {
       if (argc == 6)
       {
@@ -1905,14 +1925,14 @@ main(int  argc,				/* I - Number of command-line args */
       }
       continue;
     }
-    else if (ipp_status == IPP_REQUEST_VALUE ||
-             ipp_status == IPP_ERROR_JOB_CANCELED ||
-             ipp_status == IPP_NOT_AUTHORIZED ||
+    else if (ipp_status == IPP_STATUS_ERROR_REQUEST_VALUE ||
+             ipp_status == IPP_STATUS_ERROR_JOB_CANCELED ||
+             ipp_status == IPP_STATUS_ERROR_NOT_AUTHORIZED ||
              ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_INFO_NEEDED ||
              ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_CLOSED ||
              ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_LIMIT_REACHED ||
              ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_AUTHORIZATION_FAILED ||
-             ipp_status == IPP_INTERNAL_ERROR)
+             ipp_status == IPP_STATUS_ERROR_INTERNAL)
     {
      /*
       * Print file is too large, job was canceled, we need new
@@ -1942,7 +1962,7 @@ main(int  argc,				/* I - Number of command-line args */
 
       goto cleanup;
     }
-    else if (ipp_status == IPP_NOT_FOUND)
+    else if (ipp_status == IPP_STATUS_ERROR_NOT_FOUND)
     {
      /*
       * Printer does not actually implement support for Create-Job/
@@ -1956,7 +1976,7 @@ main(int  argc,				/* I - Number of command-line args */
       update_reasons(NULL, "+cups-ipp-conformance-failure-report,"
 			   "cups-ipp-missing-send-document");
 
-      ipp_status = IPP_INTERNAL_ERROR;	/* Force queue to stop */
+      ipp_status = IPP_STATUS_ERROR_INTERNAL;	/* Force queue to stop */
 
       goto cleanup;
     }
@@ -1988,14 +2008,14 @@ main(int  argc,				/* I - Number of command-line args */
 
       check_printer_state(http, uri, resource, argv[2], version);
 
-      if (cupsLastError() <= IPP_OK_CONFLICT)
+      if (cupsLastError() <= IPP_STATUS_OK_CONFLICTING)
         password_tries = 0;
 
      /*
-      * Build an IPP_GET_JOB_ATTRIBUTES request...
+      * Build an IPP_OP_GET_JOB_ATTRIBUTES request...
       */
 
-      request = ippNewRequest(IPP_GET_JOB_ATTRIBUTES);
+      request = ippNewRequest(IPP_OP_GET_JOB_ATTRIBUTES);
       ippSetVersion(request, version / 10, version % 10);
 
       ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
@@ -2019,11 +2039,11 @@ main(int  argc,				/* I - Number of command-line args */
       * Do the request...
       */
 
-      httpReconnect(http);
+      httpReconnect2(http, 30000, NULL);
       response   = cupsDoRequest(http, request, resource);
       ipp_status = cupsLastError();
 
-      if (ipp_status == IPP_NOT_FOUND || ipp_status == IPP_NOT_POSSIBLE)
+      if (ipp_status == IPP_STATUS_ERROR_NOT_FOUND || ipp_status == IPP_STATUS_ERROR_NOT_POSSIBLE)
       {
        /*
         * Job has gone away and/or the server has no job history...
@@ -2033,7 +2053,7 @@ main(int  argc,				/* I - Number of command-line args */
 			     "cups-ipp-missing-job-history");
         ippDelete(response);
 
-	ipp_status = IPP_OK;
+	ipp_status = IPP_STATUS_OK;
         break;
       }
 
@@ -2041,25 +2061,25 @@ main(int  argc,				/* I - Number of command-line args */
 	      ippErrorString(ipp_status), cupsLastErrorString());
       debug_attributes(response);
 
-      if (ipp_status <= IPP_OK_CONFLICT)
+      if (ipp_status <= IPP_STATUS_OK_CONFLICTING)
 	password_tries = 0;
       else
       {
-	if (ipp_status != IPP_SERVICE_UNAVAILABLE &&
-	    ipp_status != IPP_PRINTER_BUSY)
+	if (ipp_status != IPP_STATUS_ERROR_SERVICE_UNAVAILABLE &&
+	    ipp_status != IPP_STATUS_ERROR_BUSY)
 	{
 	  ippDelete(response);
-          ipp_status = IPP_OK;
+          ipp_status = IPP_STATUS_OK;
           break;
 	}
-	else if (ipp_status == IPP_INTERNAL_ERROR)
+	else if (ipp_status == IPP_STATUS_ERROR_INTERNAL)
 	{
 	  waitjob_tries ++;
 
 	  if (waitjob_tries > 4)
 	  {
 	    ippDelete(response);
-	    ipp_status = IPP_OK;
+	    ipp_status = IPP_STATUS_OK;
 	    break;
 	  }
 	}
@@ -2075,11 +2095,11 @@ main(int  argc,				/* I - Number of command-line args */
 	  */
 
 	  if (cups_version &&
-	      job_state->values[0].integer >= IPP_JOB_PENDING &&
-	      job_state->values[0].integer <= IPP_JOB_COMPLETED)
+	      job_state->values[0].integer >= IPP_JSTATE_PENDING &&
+	      job_state->values[0].integer <= IPP_JSTATE_COMPLETED)
 	    update_reasons(NULL,
 	                   remote_job_states[job_state->values[0].integer -
-			                     IPP_JOB_PENDING]);
+			                     IPP_JSTATE_PENDING]);
 
 	  if ((job_sheets = ippFindAttribute(response, "job-impressions-completed", IPP_TAG_INTEGER)) == NULL)
 	    job_sheets = ippFindAttribute(response, "job-media-sheets-completed", IPP_TAG_INTEGER);
@@ -2099,9 +2119,9 @@ main(int  argc,				/* I - Number of command-line args */
 	    break;
 	  }
 	}
-	else if (ipp_status != IPP_SERVICE_UNAVAILABLE &&
-		 ipp_status != IPP_NOT_POSSIBLE &&
-		 ipp_status != IPP_PRINTER_BUSY)
+	else if (ipp_status != IPP_STATUS_ERROR_SERVICE_UNAVAILABLE &&
+		 ipp_status != IPP_STATUS_ERROR_NOT_POSSIBLE &&
+		 ipp_status != IPP_STATUS_ERROR_BUSY)
 	{
 	 /*
 	  * If the printer does not return a job-state attribute, it does not
@@ -2111,7 +2131,7 @@ main(int  argc,				/* I - Number of command-line args */
 
 	  update_reasons(NULL, "+cups-ipp-conformance-failure-report,"
 			       "cups-ipp-missing-job-state");
-	  ipp_status = IPP_INTERNAL_ERROR;
+	  ipp_status = IPP_STATUS_ERROR_INTERNAL;
 	  break;
 	}
       }
@@ -2136,7 +2156,7 @@ main(int  argc,				/* I - Number of command-line args */
   {
     cancel_job(http, uri, job_id, resource, argv[2], version);
 
-    if (cupsLastError() > IPP_OK_CONFLICT)
+    if (cupsLastError() > IPP_STATUS_OK_CONFLICTING)
       _cupsLangPrintFilter(stderr, "ERROR", _("Unable to cancel print job."));
   }
 
@@ -2146,7 +2166,7 @@ main(int  argc,				/* I - Number of command-line args */
 
   check_printer_state(http, uri, resource, argv[2], version);
 
-  if (cupsLastError() <= IPP_OK_CONFLICT)
+  if (cupsLastError() <= IPP_STATUS_OK_CONFLICTING)
     password_tries = 0;
 
  /*
@@ -2193,9 +2213,9 @@ main(int  argc,				/* I - Number of command-line args */
   * Return the queue status...
   */
 
-  if (ipp_status == IPP_NOT_AUTHORIZED || ipp_status == IPP_FORBIDDEN ||
-      ipp_status == IPP_AUTHENTICATION_CANCELED ||
-      ipp_status <= IPP_OK_CONFLICT)
+  if (ipp_status == IPP_STATUS_ERROR_NOT_AUTHORIZED || ipp_status == IPP_STATUS_ERROR_FORBIDDEN ||
+      ipp_status == IPP_STATUS_ERROR_CUPS_AUTHENTICATION_CANCELED ||
+      ipp_status <= IPP_STATUS_OK_CONFLICTING)
     fprintf(stderr, "ATTR: auth-info-required=%s\n", auth_info_required);
 
   if (ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_INFO_NEEDED)
@@ -2207,25 +2227,26 @@ main(int  argc,				/* I - Number of command-line args */
   else if (ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_AUTHORIZATION_FAILED)
     fputs("JOBSTATE: account-authorization-failed\n", stderr);
 
-  if (ipp_status == IPP_NOT_AUTHORIZED || ipp_status == IPP_FORBIDDEN ||
-      ipp_status == IPP_AUTHENTICATION_CANCELED)
+  if (job_canceled)
+    return (CUPS_BACKEND_OK);
+  else if (ipp_status == IPP_STATUS_ERROR_NOT_AUTHORIZED || ipp_status == IPP_STATUS_ERROR_FORBIDDEN || ipp_status == IPP_STATUS_ERROR_CUPS_AUTHENTICATION_CANCELED)
     return (CUPS_BACKEND_AUTH_REQUIRED);
   else if (ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_LIMIT_REACHED ||
 	   ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_INFO_NEEDED ||
 	   ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_CLOSED ||
 	   ipp_status == IPP_STATUS_ERROR_CUPS_ACCOUNT_AUTHORIZATION_FAILED)
     return (CUPS_BACKEND_HOLD);
-  else if (ipp_status == IPP_INTERNAL_ERROR)
+  else if (ipp_status == IPP_STATUS_ERROR_INTERNAL)
     return (CUPS_BACKEND_STOP);
-  else if (ipp_status == IPP_CONFLICT || ipp_status == IPP_STATUS_ERROR_REQUEST_ENTITY || ipp_status == IPP_STATUS_ERROR_REQUEST_VALUE)
+  else if (ipp_status == IPP_STATUS_ERROR_CONFLICTING || ipp_status == IPP_STATUS_ERROR_REQUEST_ENTITY || ipp_status == IPP_STATUS_ERROR_REQUEST_VALUE)
     return (CUPS_BACKEND_FAILED);
-  else if (ipp_status == IPP_REQUEST_VALUE ||
+  else if (ipp_status == IPP_STATUS_ERROR_REQUEST_VALUE ||
 	   ipp_status == IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES ||
-           ipp_status == IPP_DOCUMENT_FORMAT || job_canceled < 0)
+           ipp_status == IPP_STATUS_ERROR_DOCUMENT_FORMAT_NOT_SUPPORTED || job_canceled < 0)
   {
-    if (ipp_status == IPP_REQUEST_VALUE)
+    if (ipp_status == IPP_STATUS_ERROR_REQUEST_VALUE)
       _cupsLangPrintFilter(stderr, "ERROR", _("Print job too large."));
-    else if (ipp_status == IPP_DOCUMENT_FORMAT)
+    else if (ipp_status == IPP_STATUS_ERROR_DOCUMENT_FORMAT_NOT_SUPPORTED)
       _cupsLangPrintFilter(stderr, "ERROR",
                            _("Printer cannot print supplied content."));
     else if (ipp_status == IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES)
@@ -2236,7 +2257,7 @@ main(int  argc,				/* I - Number of command-line args */
 
     return (CUPS_BACKEND_CANCEL);
   }
-  else if (ipp_status > IPP_OK_CONFLICT && ipp_status != IPP_ERROR_JOB_CANCELED)
+  else if (ipp_status > IPP_STATUS_OK_CONFLICTING && ipp_status != IPP_STATUS_ERROR_JOB_CANCELED)
     return (CUPS_BACKEND_RETRY_CURRENT);
   else
     return (CUPS_BACKEND_OK);
@@ -2260,7 +2281,7 @@ cancel_job(http_t     *http,		/* I - HTTP connection */
 
   _cupsLangPrintFilter(stderr, "INFO", _("Canceling print job."));
 
-  request = ippNewRequest(IPP_CANCEL_JOB);
+  request = ippNewRequest(IPP_OP_CANCEL_JOB);
   ippSetVersion(request, version / 10, version % 10);
 
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
@@ -2294,7 +2315,7 @@ check_printer_state(
   ipp_t		*request,		/* IPP request */
 		*response;		/* IPP response */
   ipp_attribute_t *attr;		/* Attribute in response */
-  ipp_pstate_t	printer_state = IPP_PRINTER_STOPPED;
+  ipp_pstate_t	printer_state = IPP_PSTATE_STOPPED;
 					/* Current printer-state */
 
 
@@ -2302,7 +2323,7 @@ check_printer_state(
   * Send a Get-Printer-Attributes request and log the results...
   */
 
-  request = ippNewRequest(IPP_GET_PRINTER_ATTRIBUTES);
+  request = ippNewRequest(IPP_OP_GET_PRINTER_ATTRIBUTES);
   ippSetVersion(request, version / 10, version % 10);
 
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
@@ -2428,14 +2449,14 @@ monitor_printer(
 
   monitor->job_reasons = 0;
 
-  while (monitor->job_state < IPP_JOB_CANCELED && !job_canceled)
+  while (monitor->job_state < IPP_JSTATE_CANCELED && !job_canceled)
   {
    /*
     * Reconnect to the printer as needed...
     */
 
     if (httpGetFd(http) < 0)
-      httpReconnect(http);
+      httpReconnect2(http, 30000, NULL);
 
     if (httpGetFd(http) >= 0)
     {
@@ -2447,7 +2468,7 @@ monitor_printer(
                                                    monitor->resource,
 						   monitor->user,
 						   monitor->version);
-      if (cupsLastError() <= IPP_OK_CONFLICT)
+      if (cupsLastError() <= IPP_STATUS_OK_CONFLICTING)
         password_tries = 0;
 
       if (monitor->job_id == 0 && monitor->create_job)
@@ -2464,13 +2485,13 @@ monitor_printer(
       */
 
       job_op  = (monitor->job_id > 0 && monitor->get_job_attrs) ?
-                    IPP_GET_JOB_ATTRIBUTES : IPP_GET_JOBS;
+                    IPP_OP_GET_JOB_ATTRIBUTES : IPP_OP_GET_JOBS;
       request = ippNewRequest(job_op);
       ippSetVersion(request, monitor->version / 10, monitor->version % 10);
 
       ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
 		   NULL, monitor->uri);
-      if (job_op == IPP_GET_JOB_ATTRIBUTES)
+      if (job_op == IPP_OP_GET_JOB_ATTRIBUTES)
 	ippAddInteger(request, IPP_TAG_OPERATION, IPP_TAG_INTEGER, "job-id",
 		      monitor->job_id);
 
@@ -2491,16 +2512,16 @@ monitor_printer(
       fprintf(stderr, "DEBUG: (monitor) %s: %s (%s)\n", ippOpString(job_op),
 	      ippErrorString(cupsLastError()), cupsLastErrorString());
 
-      if (cupsLastError() <= IPP_OK_CONFLICT)
+      if (cupsLastError() <= IPP_STATUS_OK_CONFLICTING)
         password_tries = 0;
 
-      if (job_op == IPP_GET_JOB_ATTRIBUTES)
+      if (job_op == IPP_OP_GET_JOB_ATTRIBUTES)
       {
 	if ((attr = ippFindAttribute(response, "job-state",
 				     IPP_TAG_ENUM)) != NULL)
 	  monitor->job_state = (ipp_jstate_t)attr->values[0].integer;
 	else
-	  monitor->job_state = IPP_JOB_COMPLETED;
+	  monitor->job_state = IPP_JSTATE_COMPLETED;
       }
       else if (response)
       {
@@ -2508,7 +2529,7 @@ monitor_printer(
         {
           job_id    = 0;
           job_name  = NULL;
-          job_state = IPP_JOB_PENDING;
+          job_state = IPP_JSTATE_PENDING;
           job_user  = NULL;
 
           while (attr && attr->group_tag != IPP_TAG_JOB)
@@ -2551,11 +2572,11 @@ monitor_printer(
       }
 
       fprintf(stderr, "DEBUG: (monitor) job-state = %s\n",
-              ippEnumString("job-state", monitor->job_state));
+              ippEnumString("job-state", (int)monitor->job_state));
 
       if (!job_canceled &&
-          (monitor->job_state == IPP_JOB_CANCELED ||
-	   monitor->job_state == IPP_JOB_ABORTED))
+          (monitor->job_state == IPP_JSTATE_CANCELED ||
+	   monitor->job_state == IPP_JSTATE_ABORTED))
       {
 	job_canceled = -1;
 	fprintf(stderr, "DEBUG: (monitor) job_canceled = -1\n");
@@ -2568,22 +2589,24 @@ monitor_printer(
 
         for (i = 0; i < attr->num_values; i ++)
         {
-          if (!strcmp(attr->values[i].string.text,
-                      "account-authorization-failed"))
+          if (!strcmp(attr->values[i].string.text, "account-authorization-failed"))
             new_reasons |= _CUPS_JSR_ACCOUNT_AUTHORIZATION_FAILED;
           else if (!strcmp(attr->values[i].string.text, "account-closed"))
             new_reasons |= _CUPS_JSR_ACCOUNT_CLOSED;
           else if (!strcmp(attr->values[i].string.text, "account-info-needed"))
             new_reasons |= _CUPS_JSR_ACCOUNT_INFO_NEEDED;
-          else if (!strcmp(attr->values[i].string.text,
-                           "account-limit-reached"))
+          else if (!strcmp(attr->values[i].string.text, "account-limit-reached"))
             new_reasons |= _CUPS_JSR_ACCOUNT_LIMIT_REACHED;
           else if (!strcmp(attr->values[i].string.text, "job-password-wait"))
             new_reasons |= _CUPS_JSR_JOB_PASSWORD_WAIT;
           else if (!strcmp(attr->values[i].string.text, "job-release-wait"))
             new_reasons |= _CUPS_JSR_JOB_RELEASE_WAIT;
-	  if (!job_canceled &&
-	      (!strncmp(attr->values[i].string.text, "job-canceled-", 13) || !strcmp(attr->values[i].string.text, "aborted-by-system")))
+          else if (!strcmp(attr->values[i].string.text, "document-format-error"))
+            new_reasons |= _CUPS_JSR_DOCUMENT_FORMAT_ERROR;
+          else if (!strcmp(attr->values[i].string.text, "document-unprintable"))
+            new_reasons |= _CUPS_JSR_DOCUMENT_UNPRINTABLE;
+
+	  if (!job_canceled && (!strncmp(attr->values[i].string.text, "job-canceled-", 13) || !strcmp(attr->values[i].string.text, "aborted-by-system")))
             job_canceled = 1;
         }
 
@@ -2601,6 +2624,26 @@ monitor_printer(
 	    fputs("JOBSTATE: job-password-wait\n", stderr);
 	  else if (new_reasons & _CUPS_JSR_JOB_RELEASE_WAIT)
 	    fputs("JOBSTATE: job-release-wait\n", stderr);
+          else if (new_reasons & (_CUPS_JSR_DOCUMENT_FORMAT_ERROR | _CUPS_JSR_DOCUMENT_UNPRINTABLE))
+          {
+            if (monitor->retryable)
+            {
+             /*
+              * Can't print this, so retry as raster...
+              */
+
+              job_canceled = 1;
+              fputs("JOBSTATE: cups-retry-as-raster\n", stderr);
+	    }
+	    else if (new_reasons & _CUPS_JSR_DOCUMENT_FORMAT_ERROR)
+	    {
+	      fputs("JOBSTATE: document-format-error\n", stderr);
+	    }
+	    else
+	    {
+	      fputs("JOBSTATE: document-unprintable\n", stderr);
+	    }
+          }
 	  else
 	    fputs("JOBSTATE: job-printing\n", stderr);
 
@@ -2611,11 +2654,11 @@ monitor_printer(
       ippDelete(response);
 
       fprintf(stderr, "DEBUG: (monitor) job-state = %s\n",
-              ippEnumString("job-state", monitor->job_state));
+              ippEnumString("job-state", (int)monitor->job_state));
 
       if (!job_canceled &&
-          (monitor->job_state == IPP_JOB_CANCELED ||
-	   monitor->job_state == IPP_JOB_ABORTED))
+          (monitor->job_state == IPP_JSTATE_CANCELED ||
+	   monitor->job_state == IPP_JSTATE_ABORTED))
 	job_canceled = -1;
     }
 
@@ -2637,14 +2680,14 @@ monitor_printer(
   if (job_canceled > 0 && monitor->job_id > 0)
   {
     if (httpGetFd(http) < 0)
-      httpReconnect(http);
+      httpReconnect2(http, 30000, NULL);
 
     if (httpGetFd(http) >= 0)
     {
       cancel_job(http, monitor->uri, monitor->job_id, monitor->resource,
                  monitor->user, monitor->version);
 
-      if (cupsLastError() > IPP_OK_CONFLICT)
+      if (cupsLastError() > IPP_STATUS_OK_CONFLICTING)
       {
 	fprintf(stderr, "DEBUG: (monitor) cancel_job() = %s\n", cupsLastErrorString());
 	_cupsLangPrintFilter(stderr, "ERROR", _("Unable to cancel print job."));
@@ -2720,7 +2763,7 @@ new_request(
     fprintf(stderr, "DEBUG: job-name=\"%s\"\n", title);
   }
 
-  if (format && op != IPP_CREATE_JOB)
+  if (format && op != IPP_OP_CREATE_JOB)
   {
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_MIMETYPE, "document-format", NULL, format);
     fprintf(stderr, "DEBUG: document-format=\"%s\"\n", format);
@@ -2760,7 +2803,7 @@ new_request(
 	char	phone[1024],		/* Phone number string */
 		*ptr,			/* Pointer into string */
 		tel_uri[1024];		/* tel: URI */
-        static const char * const allowed = "0123456789#*-+.()";
+        static const char * const allowed = "0123456789#*-+.()pw";
 					/* Allowed characters */
 
         destination = ippNew();
@@ -2773,7 +2816,9 @@ new_request(
         _httpDecodeURI(phone, keyword, sizeof(phone));
         for (ptr = phone; *ptr;)
 	{
-	  if (!strchr(allowed, *ptr))
+	  if (*ptr == ',')
+	    *ptr = 'p';
+	  else if (!strchr(allowed, *ptr))
 	    _cups_strcpy(ptr, ptr + 1);
 	  else
 	    ptr ++;
@@ -3559,6 +3604,8 @@ update_reasons(ipp_attribute_t *attr,	/* I - printer-state-reasons or NULL */
     }
   }
 
+  cupsArrayDelete(new_reasons);
+
   _cupsMutexUnlock(&report_mutex);
 
  /*

backend/lpd.c

@@ -24,14 +24,14 @@
 #include <sys/stat.h>
 #include <stdio.h>
 
-#ifdef WIN32
+#ifdef _WIN32
 #  include <winsock.h>
 #else
 #  include <sys/socket.h>
 #  include <netinet/in.h>
 #  include <arpa/inet.h>
 #  include <netdb.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 #ifdef __APPLE__
 #  include <CoreFoundation/CFNumber.h>
 #  include <CoreFoundation/CFPreferences.h>
@@ -76,7 +76,11 @@ static int	abort_job = 0;		/* Non-zero if we get SIGTERM */
  */
 
 static int	cups_rresvport(int *port, int family);
-static int	lpd_command(int lpd_fd, char *format, ...);
+static int	lpd_command(int lpd_fd, char *format, ...)
+#    ifdef __GNUC__
+__attribute__ ((__format__ (__printf__, 2, 3)))
+#    endif /* __GNUC__ */
+;
 static int	lpd_queue(const char *hostname, http_addrlist_t *addrlist,
 			  const char *printer, int print_fd, int snmp_fd,
 			  int mode, const char *user, const char *title,
@@ -623,11 +627,11 @@ cups_rresvport(int *port,		/* IO - Port number to bind to */
   * -1...
   */
 
-#ifdef WIN32
+#ifdef _WIN32
   closesocket(fd);
 #else
   close(fd);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
   return (-1);
 }
@@ -735,11 +739,11 @@ lpd_queue(const char      *hostname,	/* I - Host to connect to */
   ssize_t		nbytes;		/* Number of bytes written */
   off_t			tbytes;		/* Total bytes written */
   char			buffer[32768];	/* Output buffer */
-#ifdef WIN32
+#ifdef _WIN32
   DWORD			tv;		/* Timeout in milliseconds */
 #else
   struct timeval	tv;		/* Timeout in secs and usecs */
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
  /*
@@ -922,7 +926,7 @@ lpd_queue(const char      *hostname,	/* I - Host to connect to */
     * Set the timeout...
     */
 
-#ifdef WIN32
+#ifdef _WIN32
     tv = (DWORD)(timeout * 1000);
 
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tv, sizeof(tv));
@@ -933,7 +937,7 @@ lpd_queue(const char      *hostname,	/* I - Host to connect to */
 
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
     setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
     fputs("STATE: -connecting-to-device\n", stderr);
     _cupsLangPrintFilter(stderr, "INFO", _("Connected to printer."));
@@ -1052,7 +1056,7 @@ lpd_queue(const char      *hostname,	/* I - Host to connect to */
       * Send the control file...
       */
 
-      if (lpd_command(fd, "\002%d cfA%03.3d%.15s\n", strlen(control),
+      if (lpd_command(fd, "\002%d cfA%03d%.15s\n", (int)strlen(control),
                       (int)getpid() % 1000, localhost))
       {
 	close(fd);
@@ -1102,7 +1106,7 @@ lpd_queue(const char      *hostname,	/* I - Host to connect to */
       * Send the print file...
       */
 
-      if (lpd_command(fd, "\003" CUPS_LLFMT " dfA%03.3d%.15s\n",
+      if (lpd_command(fd, "\003" CUPS_LLFMT " dfA%03d%.15s\n",
                       CUPS_LLCAST filestats.st_size, (int)getpid() % 1000,
 		      localhost))
       {
@@ -1185,7 +1189,7 @@ lpd_queue(const char      *hostname,	/* I - Host to connect to */
       * Send control file...
       */
 
-      if (lpd_command(fd, "\002%d cfA%03.3d%.15s\n", strlen(control),
+      if (lpd_command(fd, "\002%d cfA%03d%.15s\n", (int)strlen(control),
                       (int)getpid() % 1000, localhost))
       {
 	close(fd);

backend/org.cups.usb-quirks

@@ -8,10 +8,17 @@
 #   delay-close   Delay close/reset of selected interface
 #   no-reattach   Do no re-attach usblp kernel module after printing.
 #   soft-reset    Do a soft reset after printing for cleanup.
-#   unidir        Only supported unidirectional I/O
+#   unidir        Only supports unidirectional I/O
 #   usb-init      Needs vendor USB initialization string.
 #   vendor-class  Uses vendor-specific class or subclass.
 #   whitelist     The printer is functional with the USB backend.
+#
+# To get the USB vendor and product IDs for a given printer, run the "lsusb"
+# command, which will show something like the following:
+#
+#   Bus 002 Device 003: ID ab21:34dc Acme Example Printer
+#
+# The "ab21:34dc" is the vendor and product ID, separated by a colon.
 
 # HP DeskJet 895C
 0x03f0 0x0004 unidir
@@ -133,8 +140,8 @@
 # Samsung ML-2160 Series (https://bugzilla.redhat.com/show_bug.cgi?id=873123)
 0x04e8 0x330f unidir
 
-# All Zebra devices (https://bugs.launchpad.net/bugs/1001028)
-0x0a5f unidir
+# All Zebra devices (https://bugs.launchpad.net/bugs/1001028) (Issue #5395)
+0x0a5f unidir no-reattach
 
 # Canon CP-10
 0x04a9 0x304a blacklist
@@ -235,6 +242,9 @@
 # All Intermec devices (Issue #4553)
 0x067e no-reattach
 
+# HP LaserJet 1015 (Issue #5617)
+0x03f0 0x0e17 delay-close
+
 # HP LaserJet 1150 (Issue #4549)
 0x03f0 0x0f17 delay-close
 
@@ -265,3 +275,30 @@
 
 # HP LaserJet 1160 (Issue #5121)
 0x03f0 0x1e17 delay-close
+
+# Canon, Inc. MP280 series (Issue #5221)
+0x04a9 0x1746 unidir
+
+# Star Micronics printers (Issue #5251)
+0x0519 unidir
+
+# Lexmark Optra E310 (Issue #5259)
+0x043d 0x000c no-reattach
+
+# HP LaserJet P1102 (Issue #5310)
+0x03F0 0x002A no-reattach
+
+# Lexmark MS317dn
+0x043d 0x0226 no-reattach
+
+# Star TSP743 (Issue #5443)
+0x0519 0x0001 delay-close
+
+# Lexmark E120n (Issue #5478)
+0x043d 0x00cc no-reattach
+
+# All Xerox printers (Issue #5523)
+0x0924 no-reattach
+
+# Dymo 450 Turbo (Issue #5521)
+0x0922 0x0021 unidir

backend/socket.c

@@ -1,7 +1,7 @@
 /*
  * AppSocket backend for CUPS.
  *
- * Copyright 2007-2016 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -23,7 +23,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#ifdef WIN32
+#ifdef _WIN32
 #  include <winsock.h>
 #else
 #  include <unistd.h>
@@ -32,7 +32,7 @@
 #  include <netinet/in.h>
 #  include <arpa/inet.h>
 #  include <netdb.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -402,8 +402,10 @@ main(int  argc,				/* I - Number of command-line arguments (6 or 7) */
       lseek(print_fd, 0, SEEK_SET);
     }
 
-    tbytes = backendRunLoop(print_fd, device_fd, snmp_fd, &(addrlist->addr), 1,
-                            0, backendNetworkSideCB);
+    if ((bytes = backendRunLoop(print_fd, device_fd, snmp_fd, &(addrlist->addr), 1, 0, backendNetworkSideCB)) < 0)
+      tbytes = -1;
+    else
+      tbytes = bytes;
 
     if (print_fd != 0 && tbytes >= 0)
       _cupsLangPrintFilter(stderr, "INFO", _("Print file sent."));
@@ -411,7 +413,7 @@ main(int  argc,				/* I - Number of command-line arguments (6 or 7) */
 
   fputs("STATE: +cups-waiting-for-job-completed\n", stderr);
 
-  if (waiteof)
+  if (waiteof && tbytes >= 0)
   {
    /*
     * Shutdown the socket and wait for the other end to finish...
@@ -448,7 +450,7 @@ main(int  argc,				/* I - Number of command-line arguments (6 or 7) */
   if (print_fd != 0)
     close(print_fd);
 
-  return (CUPS_BACKEND_OK);
+  return (tbytes >= 0 ? CUPS_BACKEND_OK : CUPS_BACKEND_FAILED);
 }
 
 

backend/test1284.c

@@ -18,12 +18,12 @@
  */
 
 #include <cups/string-private.h>
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #else
 #  include <unistd.h>
 #  include <fcntl.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 #include "ieee1284.c"
 

backend/testbackend.c

@@ -1,7 +1,7 @@
 /*
  * Backend test program for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2005 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -38,7 +38,7 @@ static int	job_canceled = 0;
  */
 
 static void	sigterm_handler(int sig);
-static void	usage(void) __attribute__((noreturn));
+static void	usage(void) _CUPS_NORETURN;
 static void	walk_cb(const char *oid, const char *data, int datalen,
 		        void *context);
 

backend/usb-darwin.c

@@ -290,10 +290,10 @@ static void status_timer_cb(CFRunLoopTimerRef timer, void *info);
 
 #if defined(__i386__) || defined(__x86_64__)
 static pid_t	child_pid;		/* Child PID */
-static void run_legacy_backend(int argc, char *argv[], int fd) __attribute__((noreturn));	/* Starts child backend process running as a ppc executable */
+static void run_legacy_backend(int argc, char *argv[], int fd) _CUPS_NORETURN;	/* Starts child backend process running as a ppc executable */
 #endif /* __i386__ || __x86_64__ */
 static void sigterm_handler(int sig);	/* SIGTERM handler */
-static void sigquit_handler(int sig, siginfo_t *si, void *unused) __attribute__((noreturn));
+static void sigquit_handler(int sig, siginfo_t *si, void *unused) _CUPS_NORETURN;
 
 #ifdef PARSE_PS_ERRORS
 static const char *next_line (const char *buffer);

backend/usb-libusb.c

@@ -1,7 +1,7 @@
 /*
  * LIBUSB interface code for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2019 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -829,8 +829,7 @@ find_device(usb_cb_t   cb,		/* I - Callback function */
   err = libusb_init(NULL);
   if (err)
   {
-    fprintf(stderr, "DEBUG: Unable to initialize USB access via libusb, "
-                    "libusb error %i\n", (int)err);
+    fprintf(stderr, "ERROR: Unable to initialize USB access via libusb, libusb error %i (%s)\n", (int)err, libusb_strerror((int)err));
     return (NULL);
   }
 
@@ -882,7 +881,7 @@ find_device(usb_cb_t   cb,		/* I - Callback function */
           protocol   = 0;
 
 	  for (altset = 0, altptr = ifaceptr->altsetting;
-	       altset < ifaceptr->num_altsetting;
+	       altset < (uint8_t)ifaceptr->num_altsetting;
 	       altset ++, altptr ++)
           {
 	   /*
@@ -1746,8 +1745,7 @@ static void *read_thread(void *reference)
     * Make sure this loop executes no more than once every 250 miliseconds...
     */
 
-    if ((readstatus != LIBUSB_SUCCESS || rbytes == 0) &&
-        (g.wait_eof || !g.read_thread_stop))
+    if ((g.wait_eof || !g.read_thread_stop))
     {
       gettimeofday(&now, NULL);
       if (timercmp(&now, &end, <))

backend/usb.c

@@ -24,13 +24,13 @@
 
 #include "backend-private.h"
 
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #else
 #  include <unistd.h>
 #  include <fcntl.h>
 #  include <termios.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*

berkeley/Makefile

@@ -125,6 +125,7 @@ uninstall:
 lpc:	lpc.o ../cups/$(LIBCUPS)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o lpc lpc.o $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -134,6 +135,7 @@ lpc:	lpc.o ../cups/$(LIBCUPS)
 lpq:	lpq.o ../cups/$(LIBCUPS)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o lpq lpq.o $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -143,6 +145,7 @@ lpq:	lpq.o ../cups/$(LIBCUPS)
 lpr:	lpr.o ../cups/$(LIBCUPS)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o lpr lpr.o $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -152,6 +155,7 @@ lpr:	lpr.o ../cups/$(LIBCUPS)
 lprm:	lprm.o ../cups/$(LIBCUPS)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o lprm lprm.o $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #

berkeley/lpq.c

@@ -1,7 +1,7 @@
 /*
  * "lpq" command for CUPS.
  *
- * Copyright 2007-2016 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -26,7 +26,7 @@ static http_t	*connect_server(const char *, http_t *);
 static int	show_jobs(const char *, http_t *, const char *,
 		          const char *, const int, const int);
 static void	show_printer(const char *, http_t *, const char *);
-static void	usage(void) __attribute__((noreturn));
+static void	usage(void) _CUPS_NORETURN;
 
 
 /*

berkeley/lpr.c

@@ -32,8 +32,7 @@ main(int  argc,				/* I - Number of command-line arguments */
   char		*printer,		/* Destination printer or class */
 		*instance,		/* Instance */
 		*opt;			/* Option pointer */
-  const char	*title,			/* Job title */
-		*val;			/* Environment variable name */
+  const char	*title;			/* Job title */
   int		num_copies;		/* Number of copies per file */
   int		num_files;		/* Number of files to print */
   const char	*files[1000];		/* Files to print */
@@ -345,33 +344,10 @@ main(int  argc,				/* I - Number of command-line arguments */
 
   if (printer == NULL)
   {
-    val = NULL;
-
-    if ((printer = getenv("LPDEST")) == NULL)
-    {
-      if ((printer = getenv("PRINTER")) != NULL)
-      {
-        if (!strcmp(printer, "lp"))
-          printer = NULL;
-	else
-	  val = "PRINTER";
-      }
-    }
+    if (!cupsGetNamedDest(NULL, NULL, NULL) && cupsLastError() == IPP_STATUS_ERROR_NOT_FOUND)
+      _cupsLangPrintf(stderr, _("%s: Error - %s"), argv[0], cupsLastErrorString());
     else
-      val = "LPDEST";
-
-    if (printer && !cupsGetNamedDest(NULL, printer, NULL))
-      _cupsLangPrintf(stderr,
-                      _("%s: Error - %s environment variable names "
-		        "non-existent destination \"%s\"."), argv[0], val,
-		      printer);
-    else if (cupsLastError() == IPP_NOT_FOUND)
-      _cupsLangPrintf(stderr,
-                      _("%s: Error - no default destination available."),
-		      argv[0]);
-    else
-      _cupsLangPrintf(stderr, _("%s: Error - scheduler not responding."),
-		      argv[0]);
+      _cupsLangPrintf(stderr, _("%s: Error - scheduler not responding."), argv[0]);
 
     return (1);
   }

cgi-bin/Makefile

@@ -1,7 +1,7 @@
 #
 # CGI makefile for CUPS.
 #
-# Copyright 2007-2017 by Apple Inc.
+# Copyright 2007-2018 by Apple Inc.
 # Copyright 1997-2006 by Easy Software Products.
 #
 # These coded instructions, statements, and computer programs are the
@@ -26,7 +26,6 @@ OBJS	=	\
 		classes.o \
 		help.o \
 		jobs.o \
-		makedocset.o \
 		printers.o \
 		testcgi.o \
 		testhi.o \
@@ -38,8 +37,7 @@ CGIS	=	\
 		jobs.cgi \
 		printers.cgi
 LIBTARGETS =	\
-		libcupscgi.a \
-		$(LIBCUPSCGI)
+		libcupscgi.a
 
 UNITTARGETS =	\
 		testcgi \
@@ -77,8 +75,7 @@ unittests:	$(UNITTARGETS)
 #
 
 clean:
-	$(RM) $(OBJS) $(TARGETS) $(UNITTARGETS) makedocset
-	$(RM) libcupscgi.so libcupscgi.dylib
+	$(RM) $(OBJS) $(TARGETS) $(UNITTARGETS)
 
 
 #
@@ -126,42 +123,13 @@ install-exec:
 #
 
 install-headers:
-	if test "x$(privateinclude)" != x; then \
-		echo Installing private header files into $(PRIVATEINCLUDE)...; \
-		$(INSTALL_DIR) -m 755 $(PRIVATEINCLUDE); \
-		for file in cgi.h help-index.h; do \
-			$(INSTALL_DATA) $$file $(PRIVATEINCLUDE); \
-		done; \
-	fi
 
 
 #
 # Install libraries...
 #
 
-install-libs: $(INSTALLSTATIC)
-	echo Installing libraries in $(LIBDIR)...
-	$(INSTALL_DIR) -m 755 $(LIBDIR)
-	$(INSTALL_LIB) $(LIBCUPSCGI) $(LIBDIR)
-	if test $(LIBCUPSCGI) = "libcupscgi.so.1"; then \
-		$(RM) $(LIBDIR)/`basename $(LIBCUPSCGI) .1`; \
-		$(LN) $(LIBCUPSCGI) $(LIBDIR)/`basename $(LIBCUPSCGI) .1`; \
-	fi
-	if test $(LIBCUPSCGI) = "libcupscgi.1.dylib"; then \
-		$(RM) $(LIBDIR)/libcupscgi.dylib; \
-		$(LN) $(LIBCUPSCGI) $(LIBDIR)/libcupscgi.dylib; \
-	fi
-	if test "x$(SYMROOT)" != "x"; then \
-		$(INSTALL_DIR) $(SYMROOT); \
-		cp $(LIBCUPSCGI) $(SYMROOT); \
-		dsymutil $(SYMROOT)/$(LIBCUPSCGI); \
-	fi
-
-installstatic:
-	$(INSTALL_DIR) -m 755 $(LIBDIR)
-	$(INSTALL_LIB) -m 755 libcupscgi.a $(LIBDIR)
-	$(RANLIB) $(LIBDIR)/libcupscgi.a
-	$(CHMOD) 555 $(LIBDIR)/libcupscgi.a
+install-libs:
 
 
 #
@@ -173,54 +141,6 @@ uninstall:
 		$(RM) $(SERVERBIN)/cgi-bin/$$file; \
 	done
 	-$(RMDIR) $(SERVERBIN)/cgi-bin
-	$(RM) $(LIBDIR)/libcupscgi.1.dylib
-	$(RM) $(LIBDIR)/libcupscgi.a
-	$(RM) $(LIBDIR)/libcupscgi.dylib
-	$(RM) $(LIBDIR)/libcupscgi.so
-	$(RM) $(LIBDIR)/libcupscgi.so.1
-	-$(RMDIR) $(LIBDIR)
-	-if test "x$(privateinclude)" != x; then \
-		$(RM) $(PRIVATEINCLUDE)/cgi.h; \
-		$(RM) $(PRIVATEINCLUDE)/help-index.h; \
-		$(RMDIR) $(PRIVATEINCLUDE); \
-	fi
-
-
-#
-# libcupscgi.so.1
-#
-
-libcupscgi.so.1:	$(LIBOBJS)
-	echo Linking $@...
-	$(DSO) $(ARCHFLAGS) $(DSOFLAGS) -o $@ $(LIBOBJS) $(LIBS)
-	$(RM) `basename $@ .1`
-	$(LN) $@ `basename $@ .1`
-
-
-#
-# libcupscgi.1.dylib
-#
-
-libcupscgi.1.dylib:	$(LIBOBJS) libcupscgi.exp
-	echo Linking $@...
-	$(DSO) $(ARCHFLAGS) $(DSOFLAGS) -o $@ \
-		-install_name $(libdir)/$@ \
-		-current_version 1.0.0 \
-		-compatibility_version 1.0.0 \
-		-exported_symbols_list libcupscgi.exp \
-		$(LIBOBJS) $(LIBS)
-	$(RM) libcupscgi.dylib
-	$(LN) $@ libcupscgi.dylib
-
-
-#
-# libcupscgi.la
-#
-
-libcupscgi.la:    $(LIBOBJS)
-	echo Linking $@...
-	$(LD_CC) $(ARCHFLAGS) $(DSOFLAGS) -o $@ $(LIBOBJS:.o=.lo) -rpath $(LIBDIR) \
-		-version-info 1:0 $(LIBS)
 
 
 #
@@ -238,56 +158,50 @@ libcupscgi.a:	$(LIBOBJS)
 # admin.cgi
 #
 
-admin.cgi:	admin.o ../Makedefs ../cups/$(LIBCUPS) $(LIBCUPSCGI)
+admin.cgi:	admin.o ../Makedefs ../cups/$(LIBCUPS) libcupscgi.a
 	echo Linking $@...
-	$(LD_CC) $(LDFLAGS) -o $@ admin.o -lcupscgi $(LIBS)
+	$(LD_CC) $(LDFLAGS) -o $@ admin.o libcupscgi.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
 # classes.cgi
 #
 
-classes.cgi:	classes.o ../Makedefs ../cups/$(LIBCUPS) $(LIBCUPSCGI)
+classes.cgi:	classes.o ../Makedefs ../cups/$(LIBCUPS) libcupscgi.a
 	echo Linking $@...
-	$(LD_CC) $(LDFLAGS) -o $@ classes.o -lcupscgi $(LIBS)
+	$(LD_CC) $(LDFLAGS) -o $@ classes.o libcupscgi.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
 # help.cgi
 #
 
-help.cgi:	help.o ../Makedefs ../cups/$(LIBCUPS) $(LIBCUPSCGI)
+help.cgi:	help.o ../Makedefs ../cups/$(LIBCUPS) libcupscgi.a
 	echo Linking $@...
-	$(LD_CC) $(LDFLAGS) -o $@ help.o -lcupscgi $(LIBS)
+	$(LD_CC) $(LDFLAGS) -o $@ help.o libcupscgi.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
 # jobs.cgi
 #
 
-jobs.cgi:	jobs.o ../Makedefs ../cups/$(LIBCUPS) $(LIBCUPSCGI)
+jobs.cgi:	jobs.o ../Makedefs ../cups/$(LIBCUPS) libcupscgi.a
 	echo Linking $@...
-	$(LD_CC) $(LDFLAGS) -o $@ jobs.o -lcupscgi $(LIBS)
-
-
-#
-# makedocset
-#
-
-makedocset:	makedocset.o ../Makedefs libcupscgi.a ../cups/$(LIBCUPSSTATIC)
-	echo Linking $@...
-	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ makedocset.o libcupscgi.a \
-		../cups/$(LIBCUPSSTATIC) $(COMMONLIBS) $(SSLLIBS) $(DNSSDLIBS) \
-		$(LIBZ) $(LIBGSSAPI)
+	$(LD_CC) $(LDFLAGS) -o $@ jobs.o libcupscgi.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
 # printers.cgi
 #
 
-printers.cgi:	printers.o ../Makedefs ../cups/$(LIBCUPS) $(LIBCUPSCGI)
+printers.cgi:	printers.o ../Makedefs ../cups/$(LIBCUPS) libcupscgi.a
 	echo Linking $@...
-	$(LD_CC) $(LDFLAGS) -o $@ printers.o -L. -lcupscgi $(LIBS)
+	$(LD_CC) $(LDFLAGS) -o $@ printers.o -L. libcupscgi.a $(LIBS)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -299,6 +213,7 @@ testcgi:	testcgi.o ../Makedefs libcupscgi.a ../cups/$(LIBCUPSSTATIC)
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testcgi.o libcupscgi.a \
 		../cups/$(LIBCUPSSTATIC) $(COMMONLIBS) $(SSLLIBS) $(DNSSDLIBS) \
 		$(LIBZ) $(LIBGSSAPI)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Testing CGI API...
 	./testcgi
 
@@ -312,6 +227,7 @@ testhi:	testhi.o ../Makedefs libcupscgi.a ../cups/$(LIBCUPSSTATIC)
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testhi.o libcupscgi.a \
 		../cups/$(LIBCUPSSTATIC) $(COMMONLIBS) $(SSLLIBS) $(DNSSDLIBS) \
 		$(LIBZ) $(LIBGSSAPI)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Testing help index API...
 	./testhi
 
@@ -324,6 +240,7 @@ testtemplate:	testtemplate.o ../Makedefs libcupscgi.a ../cups/$(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testtemplate.o libcupscgi.a ../cups/$(LIBCUPSSTATIC) \
 		$(COMMONLIBS) $(SSLLIBS) $(DNSSDLIBS) $(LIBZ) $(LIBGSSAPI)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #

cgi-bin/admin.c

@@ -1,8 +1,8 @@
 /*
  * Administration CGI for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -767,7 +767,7 @@ do_am_class(http_t *http,		/* I - HTTP connection */
     attr = ippAddStrings(request, IPP_TAG_PRINTER, IPP_TAG_URI, "member-uris",
                          num_printers, NULL, NULL);
     for (i = 0; i < num_printers; i ++)
-      attr->values[i].string.text = _cupsStrAlloc(cgiGetArray("MEMBER_URIS", i));
+      ippSetString(request, &attr, i, cgiGetArray("MEMBER_URIS", i));
   }
 
  /*
@@ -1137,6 +1137,8 @@ do_am_printer(http_t *http,		/* I - HTTP connection */
   else if (!file &&
            (!cgiGetVariable("PPD_NAME") || cgiGetVariable("SELECT_MAKE")))
   {
+    int ipp_everywhere = !strncmp(var, "ipp://", 6) || !strncmp(var, "ipps://", 7) || (!strncmp(var, "dnssd://", 8) && (strstr(var, "_ipp._tcp") || strstr(var, "_ipps._tcp")));
+
     if (modify && !cgiGetVariable("SELECT_MAKE"))
     {
      /*
@@ -1282,9 +1284,8 @@ do_am_printer(http_t *http,		/* I - HTTP connection */
         cgiStartHTML(title);
 	if (!cgiGetVariable("PPD_MAKE"))
 	  cgiSetVariable("PPD_MAKE", cgiGetVariable("CURRENT_MAKE"));
-	if (!modify)
-	  cgiSetVariable("CURRENT_MAKE_AND_MODEL",
-	                 cgiGetArray("PPD_MAKE_AND_MODEL", 0));
+        if (ipp_everywhere)
+	  cgiSetVariable("SHOW_IPP_EVERYWHERE", "1");
 	cgiCopyTemplateLang("choose-model.tmpl");
         cgiEndHTML();
       }
@@ -2412,7 +2413,7 @@ do_list_printers(http_t *http)		/* I - HTTP connection */
          attr;
 	 attr = ippFindNextAttribute(response, "device-uri", IPP_TAG_URI))
     {
-      cupsArrayAdd(printer_devices, _cupsStrAlloc(attr->values[0].string.text));
+      cupsArrayAdd(printer_devices, strdup(attr->values[0].string.text));
     }
 
    /*
@@ -2550,7 +2551,7 @@ do_list_printers(http_t *http)		/* I - HTTP connection */
       for (printer_device = (char *)cupsArrayFirst(printer_devices);
            printer_device;
 	   printer_device = (char *)cupsArrayNext(printer_devices))
-        _cupsStrFree(printer_device);
+        free(printer_device);
 
       cupsArrayDelete(printer_devices);
     }
@@ -2947,7 +2948,7 @@ do_set_allowed_users(http_t *http)	/* I - HTTP connection */
         * Add the name...
 	*/
 
-        attr->values[i].string.text = _cupsStrAlloc(ptr);
+        ippSetString(request, &attr, i, ptr);
 
        /*
         * Advance to the next name...
@@ -3409,6 +3410,9 @@ do_set_options(http_t *http,		/* I - HTTP connection */
 
 	      switch (cparam->type)
 	      {
+	        case PPD_CUSTOM_UNKNOWN :
+	            break;
+
 		case PPD_CUSTOM_POINTS :
 		    if (!_cups_strncasecmp(option->defchoice, "Custom.", 7))
 		    {
@@ -3756,8 +3760,8 @@ do_set_options(http_t *http,		/* I - HTTP connection */
 
     attr = ippAddStrings(request, IPP_TAG_PRINTER, IPP_TAG_NAME,
                          "job-sheets-default", 2, NULL, NULL);
-    attr->values[0].string.text = _cupsStrAlloc(cgiGetVariable("job_sheets_start"));
-    attr->values[1].string.text = _cupsStrAlloc(cgiGetVariable("job_sheets_end"));
+    ippSetString(request, &attr, 0, cgiGetVariable("job_sheets_start"));
+    ippSetString(request, &attr, 1, cgiGetVariable("job_sheets_end"));
 
     if ((var = cgiGetVariable("printer_error_policy")) != NULL)
       ippAddString(request, IPP_TAG_PRINTER, IPP_TAG_NAME,
@@ -4008,6 +4012,9 @@ get_option_value(
 
     switch (cparam->type)
     {
+      case PPD_CUSTOM_UNKNOWN :
+          break;
+
       case PPD_CUSTOM_CURVE :
       case PPD_CUSTOM_INVCURVE :
       case PPD_CUSTOM_REAL :
@@ -4086,6 +4093,9 @@ get_option_value(
 
       switch (cparam->type)
       {
+        case PPD_CUSTOM_UNKNOWN :
+            break;
+
 	case PPD_CUSTOM_CURVE :
 	case PPD_CUSTOM_INVCURVE :
 	case PPD_CUSTOM_REAL :
@@ -4219,6 +4229,11 @@ get_printer_ppd(const char *uri,	/* I - Printer URI */
 		host[256],		/* Hostname */
 		resource[256];		/* Resource path */
   int		port;			/* Port number */
+  static const char * const pattrs[] =	/* Printer attributes we need */
+  {
+    "all",
+    "media-col-database"
+  };
 
 
  /*
@@ -4259,6 +4274,7 @@ get_printer_ppd(const char *uri,	/* I - Printer URI */
 
   request = ippNewRequest(IPP_OP_GET_PRINTER_ATTRIBUTES);
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri);
+  ippAddStrings(request, IPP_TAG_OPERATION, IPP_TAG_KEYWORD, "requested-attributes",  (int)(sizeof(pattrs) / sizeof(pattrs[0])), NULL, pattrs);
   response = cupsDoRequest(http, request, resource);
 
   if (!_ppdCreateFromIPP(buffer, bufsize, response))

cgi-bin/cgi.h

@@ -19,12 +19,12 @@
 #  include <time.h>
 #  include <sys/stat.h>
 
-#  ifdef WIN32
+#  ifdef _WIN32
 #    include <direct.h>
 #    include <io.h>
 #  else
 #    include <unistd.h>
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
 #  include <cups/cups.h>
 #  include <cups/array.h>

cgi-bin/help-index.c

@@ -1,7 +1,7 @@
 /*
  * Online help index routines for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -138,11 +138,7 @@ static int		help_load_file(help_index_t *hi,
 			               const char *filename,
 				       const char *relative,
 				       time_t     mtime);
-static help_node_t	*help_new_node(const char *filename, const char *anchor,
-			               const char *section, const char *text,
-				       time_t mtime, off_t offset,
-				       size_t length)
-				       __attribute__((nonnull(1,3,4)));
+static help_node_t	*help_new_node(const char *filename, const char *anchor, const char *section, const char *text, time_t mtime, off_t offset, size_t length) _CUPS_NONNULL((1, 3, 4));
 static int		help_sort_by_name(help_node_t *p1, help_node_t *p2);
 static int		help_sort_by_score(help_node_t *p1, help_node_t *p2);
 static int		help_sort_words(help_word_t *w1, help_word_t *w2);

cgi-bin/makedocset.c

@@ -1,469 +0,0 @@
-/*
- * Xcode documentation set generator.
- *
- * Copyright 2007-2012 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products.
- *
- * These coded instructions, statements, and computer programs are the
- * property of Apple Inc. and are protected by Federal copyright
- * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
- * which should have been included with this file.  If this file is
- * missing or damaged, see the license at "http://www.cups.org/".
- *
- * Usage:
- *
- *   makedocset directory *.tokens
- */
-
-/*
- * Include necessary headers...
- */
-
-#include "cgi-private.h"
-#include <errno.h>
-
-
-/*
- * Local structures...
- */
-
-typedef struct _cups_html_s		/**** Help file ****/
-{
-  char		*path;			/* Path to help file */
-  char		*title;			/* Title of help file */
-} _cups_html_t;
-
-typedef struct _cups_section_s		/**** Help section ****/
-{
-  char		*name;			/* Section name */
-  cups_array_t	*files;			/* Files in this section */
-} _cups_section_t;
-
-
-/*
- * Local functions...
- */
-
-static int	compare_html(_cups_html_t *a, _cups_html_t *b);
-static int	compare_sections(_cups_section_t *a, _cups_section_t *b);
-static int	compare_sections_files(_cups_section_t *a, _cups_section_t *b);
-static void	write_index(const char *path, help_index_t *hi);
-static void	write_info(const char *path, const char *revision);
-static void	write_nodes(const char *path, help_index_t *hi);
-
-
-/*
- * 'main()' - Test the help index code.
- */
-
-int					/* O - Exit status */
-main(int  argc,				/* I - Number of command-line args */
-     char *argv[])			/* I - Command-line arguments */
-{
-  int		i;			/* Looping var */
-  char		path[1024],		/* Path to documentation */
-		line[1024];		/* Line from file */
-  help_index_t	*hi;			/* Help index */
-  cups_file_t	*tokens,		/* Tokens.xml file */
-		*fp;			/* Current file */
-
-
-  if (argc < 4)
-  {
-    puts("Usage: makedocset directory revision *.tokens");
-    return (1);
-  }
-
- /*
-  * Index the help documents...
-  */
-
-  snprintf(path, sizeof(path), "%s/Contents/Resources/Documentation", argv[1]);
-  if ((hi = helpLoadIndex(NULL, path)) == NULL)
-  {
-    fputs("makedocset: Unable to index help files!\n", stderr);
-    return (1);
-  }
-
-  snprintf(path, sizeof(path), "%s/Contents/Resources/Documentation/index.html",
-           argv[1]);
-  write_index(path, hi);
-
-  snprintf(path, sizeof(path), "%s/Contents/Resources/Nodes.xml", argv[1]);
-  write_nodes(path, hi);
-
- /*
-  * Write the Info.plist file...
-  */
-
-  snprintf(path, sizeof(path), "%s/Contents/Info.plist", argv[1]);
-  write_info(path, argv[2]);
-
- /*
-  * Merge the Tokens.xml files...
-  */
-
-  snprintf(path, sizeof(path), "%s/Contents/Resources/Tokens.xml", argv[1]);
-  if ((tokens = cupsFileOpen(path, "w")) == NULL)
-  {
-    fprintf(stderr, "makedocset: Unable to create \"%s\": %s\n", path,
-	    strerror(errno));
-    return (1);
-  }
-
-  cupsFilePuts(tokens, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
-  cupsFilePuts(tokens, "<Tokens version=\"1.0\">\n");
-
-  for (i = 3; i < argc; i ++)
-  {
-    if ((fp = cupsFileOpen(argv[i], "r")) == NULL)
-    {
-      fprintf(stderr, "makedocset: Unable to open \"%s\": %s\n", argv[i],
-	      strerror(errno));
-      return (1);
-    }
-
-    if (!cupsFileGets(fp, line, sizeof(line)) || strncmp(line, "<?xml ", 6) ||
-        !cupsFileGets(fp, line, sizeof(line)) || strncmp(line, "<Tokens ", 8))
-    {
-      fprintf(stderr, "makedocset: Bad Tokens.xml file \"%s\"!\n", argv[i]);
-      return (1);
-    }
-
-    while (cupsFileGets(fp, line, sizeof(line)))
-    {
-      if (strcmp(line, "</Tokens>"))
-        cupsFilePrintf(tokens, "%s\n", line);
-    }
-
-    cupsFileClose(fp);
-  }
-
-  cupsFilePuts(tokens, "</Tokens>\n");
-
-  cupsFileClose(tokens);
-
- /*
-  * Return with no errors...
-  */
-
-  return (0);
-}
-
-
-/*
- * 'compare_html()' - Compare the titles of two HTML files.
- */
-
-static int				/* O - Result of comparison */
-compare_html(_cups_html_t *a,		/* I - First file */
-             _cups_html_t *b)		/* I - Second file */
-{
-  return (_cups_strcasecmp(a->title, b->title));
-}
-
-
-/*
- * 'compare_sections()' - Compare the names of two help sections.
- */
-
-static int				/* O - Result of comparison */
-compare_sections(_cups_section_t *a,	/* I - First section */
-                 _cups_section_t *b)	/* I - Second section */
-{
-  return (_cups_strcasecmp(a->name, b->name));
-}
-
-
-/*
- * 'compare_sections_files()' - Compare the number of files and section names.
- */
-
-static int				/* O - Result of comparison */
-compare_sections_files(
-    _cups_section_t *a,			/* I - First section */
-    _cups_section_t *b)			/* I - Second section */
-{
-  int	ret = cupsArrayCount(b->files) - cupsArrayCount(a->files);
-
-  if (ret)
-    return (ret);
-  else
-    return (_cups_strcasecmp(a->name, b->name));
-}
-
-
-/*
- * 'write_index()' - Write an index file for the CUPS help.
- */
-
-static void
-write_index(const char   *path,		/* I - File to write */
-            help_index_t *hi)		/* I - Index of files */
-{
-  cups_file_t		*fp;		/* Output file */
-  help_node_t		*node;		/* Current help node */
-  _cups_section_t	*section,	/* Current section */
-			key;		/* Section search key */
-  _cups_html_t		*html;		/* Current HTML file */
-  cups_array_t		*sections,	/* Sections in index */
-			*sections_files,/* Sections sorted by size */
-			*columns[3];	/* Columns in final HTML file */
-  int			column,		/* Current column */
-			lines[3],	/* Number of lines in each column */
-			min_column,	/* Smallest column */
-			min_lines;	/* Smallest number of lines */
-
-
- /*
-  * Build an array of sections and their files.
-  */
-
-  sections = cupsArrayNew((cups_array_func_t)compare_sections, NULL);
-
-  for (node = (help_node_t *)cupsArrayFirst(hi->nodes);
-       node;
-       node = (help_node_t *)cupsArrayNext(hi->nodes))
-  {
-    if (node->anchor)
-      continue;
-
-    key.name = node->section ? node->section : "Miscellaneous";
-    if ((section = (_cups_section_t *)cupsArrayFind(sections, &key)) == NULL)
-    {
-      section        = (_cups_section_t *)calloc(1, sizeof(_cups_section_t));
-      section->name  = key.name;
-      section->files = cupsArrayNew((cups_array_func_t)compare_html, NULL);
-
-      cupsArrayAdd(sections, section);
-    }
-
-    html = (_cups_html_t *)calloc(1, sizeof(_cups_html_t));
-    html->path  = node->filename;
-    html->title = node->text;
-
-    cupsArrayAdd(section->files, html);
-  }
-
- /*
-  * Build a sorted list of sections based on the number of files in each section
-  * and the section name...
-  */
-
-  sections_files = cupsArrayNew((cups_array_func_t)compare_sections_files,
-                                NULL);
-  for (section = (_cups_section_t *)cupsArrayFirst(sections);
-       section;
-       section = (_cups_section_t *)cupsArrayNext(sections))
-    cupsArrayAdd(sections_files, section);
-
- /*
-  * Then build three columns to hold everything, trying to balance the number of
-  * lines in each column...
-  */
-
-  for (column = 0; column < 3; column ++)
-  {
-    columns[column] = cupsArrayNew((cups_array_func_t)compare_sections, NULL);
-    lines[column]   = 0;
-  }
-
-  for (section = (_cups_section_t *)cupsArrayFirst(sections_files);
-       section;
-       section = (_cups_section_t *)cupsArrayNext(sections_files))
-  {
-    for (min_column = 0, min_lines = lines[0], column = 1;
-         column < 3;
-	 column ++)
-    {
-      if (lines[column] < min_lines)
-      {
-        min_column = column;
-        min_lines  = lines[column];
-      }
-    }
-
-    cupsArrayAdd(columns[min_column], section);
-    lines[min_column] += cupsArrayCount(section->files) + 2;
-  }
-
- /*
-  * Write the HTML file...
-  */
-
-  if ((fp = cupsFileOpen(path, "w")) == NULL)
-  {
-    fprintf(stderr, "makedocset: Unable to create %s: %s\n", path,
-            strerror(errno));
-    exit(1);
-  }
-
-  cupsFilePuts(fp, "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 "
-                   "Transitional//EN\" "
-		   "\"http://www.w3.org/TR/html4/loose.dtd\">\n"
-		   "<html>\n"
-		   "<head>\n"
-		   "<title>CUPS Documentation</title>\n"
-		   "<link rel='stylesheet' type='text/css' "
-		   "href='cups-printable.css'>\n"
-		   "</head>\n"
-		   "<body>\n"
-		   "<h1 class='title'>CUPS Documentation</h1>\n"
-		   "<table width='100%' summary=''>\n"
-		   "<tr>\n");
-
-  for (column = 0; column < 3; column ++)
-  {
-    if (column)
-      cupsFilePuts(fp, "<td>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>\n");
-
-    cupsFilePuts(fp, "<td valign='top' width='33%'>");
-    for (section = (_cups_section_t *)cupsArrayFirst(columns[column]);
-         section;
-	 section = (_cups_section_t *)cupsArrayNext(columns[column]))
-    {
-      cupsFilePrintf(fp, "<h2 class='title'>%s</h2>\n", section->name);
-      for (html = (_cups_html_t *)cupsArrayFirst(section->files);
-           html;
-	   html = (_cups_html_t *)cupsArrayNext(section->files))
-	cupsFilePrintf(fp, "<p class='compact'><a href='%s'>%s</a></p>\n",
-	               html->path, html->title);
-    }
-    cupsFilePuts(fp, "</td>\n");
-  }
-  cupsFilePuts(fp, "</tr>\n"
-                   "</table>\n"
-		   "</body>\n"
-		   "</html>\n");
-  cupsFileClose(fp);
-}
-
-
-/*
- * 'write_info()' - Write the Info.plist file.
- */
-
-static void
-write_info(const char *path,		/* I - File to write */
-           const char *revision)	/* I - Subversion revision number */
-{
-  cups_file_t	*fp;			/* File */
-
-
-  if ((fp = cupsFileOpen(path, "w")) == NULL)
-  {
-    fprintf(stderr, "makedocset: Unable to create %s: %s\n", path,
-            strerror(errno));
-    exit(1);
-  }
-
-  cupsFilePrintf(fp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
-		     "<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" "
-		     "\"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n"
-		     "<plist version=\"1.0\">\n"
-		     "<dict>\n"
-		     "\t<key>CFBundleIdentifier</key>\n"
-		     "\t<string>org.cups.docset</string>\n"
-		     "\t<key>CFBundleName</key>\n"
-		     "\t<string>CUPS Documentation</string>\n"
-		     "\t<key>CFBundleVersion</key>\n"
-		     "\t<string>%d.%d.%s</string>\n"
-		     "\t<key>CFBundleShortVersionString</key>\n"
-		     "\t<string>%d.%d.%d</string>\n"
-		     "\t<key>DocSetFeedName</key>\n"
-		     "\t<string>cups.org</string>\n"
-		     "\t<key>DocSetFeedURL</key>\n"
-		     "\t<string>http://www.cups.org/org.cups.docset.atom"
-		     "</string>\n"
-		     "\t<key>DocSetPublisherIdentifier</key>\n"
-		     "\t<string>org.cups</string>\n"
-		     "\t<key>DocSetPublisherName</key>\n"
-		     "\t<string>CUPS</string>\n"
-		     "</dict>\n"
-		     "</plist>\n",
-		     CUPS_VERSION_MAJOR, CUPS_VERSION_MINOR, revision,
-		     CUPS_VERSION_MAJOR, CUPS_VERSION_MINOR, CUPS_VERSION_PATCH);
-
-  cupsFileClose(fp);
-}
-
-
-/*
- * 'write_nodes()' - Write the Nodes.xml file.
- */
-
-static void
-write_nodes(const char   *path,		/* I - File to write */
-            help_index_t *hi)		/* I - Index of files */
-{
-  cups_file_t	*fp;			/* Output file */
-  int		id;			/* Current node ID */
-  help_node_t	*node;			/* Current help node */
-  int		subnodes;		/* Currently in Subnodes for file? */
-  int		needclose;		/* Need to close the current node? */
-
-
-  if ((fp = cupsFileOpen(path, "w")) == NULL)
-  {
-    fprintf(stderr, "makedocset: Unable to create %s: %s\n", path,
-            strerror(errno));
-    exit(1);
-  }
-
-  cupsFilePuts(fp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
-		   "<DocSetNodes version=\"1.0\">\n"
-		   "<TOC>\n"
-		   "<Node id=\"0\">\n"
-		   "<Name>CUPS Documentation</Name>\n"
-		   "<Path>Documentation/index.html</Path>\n"
-		   "</Node>\n");
-
-  for (node = (help_node_t *)cupsArrayFirst(hi->nodes), id = 1, subnodes = 0,
-           needclose = 0;
-       node;
-       node = (help_node_t *)cupsArrayNext(hi->nodes), id ++)
-  {
-    if (node->anchor)
-    {
-      if (!subnodes)
-      {
-        cupsFilePuts(fp, "<Subnodes>\n");
-	subnodes = 1;
-      }
-
-      cupsFilePrintf(fp, "<Node id=\"%d\">\n"
-                         "<Path>Documentation/%s</Path>\n"
-			 "<Anchor>%s</Anchor>\n"
-			 "<Name>%s</Name>\n"
-			 "</Node>\n", id, node->filename, node->anchor,
-		     node->text);
-    }
-    else
-    {
-      if (subnodes)
-      {
-        cupsFilePuts(fp, "</Subnodes>\n");
-	subnodes = 0;
-      }
-
-      if (needclose)
-        cupsFilePuts(fp, "</Node>\n");
-
-      cupsFilePrintf(fp, "<Node id=\"%d\">\n"
-                         "<Path>Documentation/%s</Path>\n"
-			 "<Name>%s</Name>\n", id, node->filename, node->text);
-      needclose = 1;
-    }
-  }
-
-  if (subnodes)
-    cupsFilePuts(fp, "</Subnodes>\n");
-
-  if (needclose)
-    cupsFilePuts(fp, "</Node>\n");
-
-  cupsFilePuts(fp, "</TOC>\n"
-		   "</DocSetNodes>\n");
-
-  cupsFileClose(fp);
-}

cgi-bin/search.c

@@ -1,7 +1,7 @@
 /*
  * Search routines for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -365,4 +365,5 @@ void
 cgiFreeSearch(void *search)		/* I - Search context */
 {
   regfree((regex_t *)search);
+  free(search);
 }

cgi-bin/var.c

@@ -1,8 +1,8 @@
 /*
  * CGI form variable and array functions for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
- * Copyright 1997-2005 by Easy Software Products.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2005 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -18,7 +18,6 @@
 /*#define DEBUG*/
 #include "cgi-private.h"
 #include <cups/http.h>
-#include <cups/md5-private.h>
 
 
 /*
@@ -34,10 +33,10 @@
 
 typedef struct				/**** Form variable structure ****/
 {
-  const char	*name;			/* Name of variable */
+  char		*name;			/* Name of variable */
   int		nvalues,		/* Number of values */
 		avalues;		/* Number of values allocated */
-  const char	**values;		/* Value(s) of variable */
+  char		**values;		/* Value(s) of variable */
 } _cgi_var_t;
 
 
@@ -140,10 +139,10 @@ cgiClearVariables(void)
 
   for (v = form_vars, i = form_count; i > 0; v ++, i --)
   {
-    _cupsStrFree(v->name);
+    free(v->name);
     for (j = 0; j < v->nvalues; j ++)
       if (v->values[j])
-        _cupsStrFree(v->values[j]);
+        free(v->values[j]);
   }
 
   form_count = 0;
@@ -169,7 +168,7 @@ cgiGetArray(const char *name,		/* I - Name of array variable */
   if (element < 0 || element >= var->nvalues)
     return (NULL);
 
-  return (_cupsStrRetain(var->values[element]));
+  return (strdup(var->values[element]));
 }
 
 
@@ -235,7 +234,7 @@ cgiGetVariable(const char *name)	/* I - Name of variable */
 		  var->values[var->nvalues - 1]));
 #endif /* DEBUG */
 
-  return ((var == NULL) ? NULL : _cupsStrRetain(var->values[var->nvalues - 1]));
+  return ((var == NULL) ? NULL : strdup(var->values[var->nvalues - 1]));
 }
 
 
@@ -383,10 +382,9 @@ cgiSetArray(const char *name,		/* I - Name of variable */
   {
     if (element >= var->avalues)
     {
-      const char **temp;		/* Temporary pointer */
+      char **temp;			/* Temporary pointer */
 
-      temp = (const char **)realloc((void *)(var->values),
-                                    sizeof(char *) * (size_t)(element + 16));
+      temp = (char **)realloc((void *)(var->values), sizeof(char *) * (size_t)(element + 16));
       if (!temp)
         return;
 
@@ -402,9 +400,9 @@ cgiSetArray(const char *name,		/* I - Name of variable */
       var->nvalues = element + 1;
     }
     else if (var->values[element])
-      _cupsStrFree((char *)var->values[element]);
+      free((char *)var->values[element]);
 
-    var->values[element] = _cupsStrAlloc(value);
+    var->values[element] = strdup(value);
   }
 }
 
@@ -461,10 +459,9 @@ cgiSetSize(const char *name,		/* I - Name of variable */
 
   if (size >= var->avalues)
   {
-    const char **temp;			/* Temporary pointer */
+    char **temp;			/* Temporary pointer */
 
-    temp = (const char **)realloc((void *)(var->values),
-				  sizeof(char *) * (size_t)(size + 16));
+    temp = (char **)realloc((void *)(var->values), sizeof(char *) * (size_t)(size + 16));
     if (!temp)
       return;
 
@@ -481,7 +478,7 @@ cgiSetSize(const char *name,		/* I - Name of variable */
   {
     for (i = size; i < var->nvalues; i ++)
       if (var->values[i])
-        _cupsStrFree((void *)(var->values[i]));
+        free((void *)(var->values[i]));
   }
 
   var->nvalues = size;
@@ -516,9 +513,9 @@ cgiSetVariable(const char *name,	/* I - Name of variable */
   {
     for (i = 0; i < var->nvalues; i ++)
       if (var->values[i])
-        _cupsStrFree((char *)var->values[i]);
+        free((char *)var->values[i]);
 
-    var->values[0] = _cupsStrAlloc(value);
+    var->values[0] = strdup(value);
     var->nvalues   = 1;
   }
 }
@@ -564,10 +561,10 @@ cgi_add_variable(const char *name,	/* I - Variable name */
   if ((var->values = calloc((size_t)element + 1, sizeof(char *))) == NULL)
     return;
 
-  var->name            = _cupsStrAlloc(name);
+  var->name            = strdup(name);
   var->nvalues         = element + 1;
   var->avalues         = element + 1;
-  var->values[element] = _cupsStrAlloc(value);
+  var->values[element] = strdup(value);
 
   form_count ++;
 }
@@ -599,7 +596,7 @@ cgi_find_variable(const char *name)	/* I - Name of variable */
   if (form_count < 1 || name == NULL)
     return (NULL);
 
-  key.name = name;
+  key.name = (char *)name;
 
   return ((_cgi_var_t *)bsearch(&key, form_vars, (size_t)form_count, sizeof(_cgi_var_t),
                            (int (*)(const void *, const void *))cgi_compare_variables));
@@ -990,7 +987,7 @@ cgi_initialize_post(void)
   */
 
   length = (size_t)strtol(content_length, NULL, 10);
-  data   = malloc(length + 1);
+  data   = malloc(length + 1); /* lgtm [cpp/uncontrolled-allocation-size] */
 
   if (data == NULL)
     return (0);
@@ -1204,11 +1201,11 @@ cgi_set_sid(void)
 {
   char			buffer[512],	/* SID data */
 			sid[33];	/* SID string */
-  _cups_md5_state_t	md5;		/* MD5 state */
   unsigned char		sum[16];	/* MD5 sum */
   const char		*remote_addr,	/* REMOTE_ADDR */
 			*server_name,	/* SERVER_NAME */
 			*server_port;	/* SERVER_PORT */
+  struct timeval	curtime;	/* Current time */
 
 
   if ((remote_addr = getenv("REMOTE_ADDR")) == NULL)
@@ -1218,18 +1215,17 @@ cgi_set_sid(void)
   if ((server_port = getenv("SERVER_PORT")) == NULL)
     server_port = "SERVER_PORT";
 
-  CUPS_SRAND(time(NULL));
+  gettimeofday(&curtime, NULL);
+  CUPS_SRAND(curtime.tv_sec + curtime.tv_usec);
   snprintf(buffer, sizeof(buffer), "%s:%s:%s:%02X%02X%02X%02X%02X%02X%02X%02X",
            remote_addr, server_name, server_port,
 	   (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
 	   (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
 	   (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
 	   (unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255);
-  _cupsMD5Init(&md5);
-  _cupsMD5Append(&md5, (unsigned char *)buffer, (int)strlen(buffer));
-  _cupsMD5Finish(&md5, sum);
+  cupsHashData("md5", (unsigned char *)buffer, strlen(buffer), sum, sizeof(sum));
 
-  cgiSetCookie(CUPS_SID, httpMD5String(sum, sid), "/", NULL, 0, 0);
+  cgiSetCookie(CUPS_SID, cupsHashString(sum, sizeof(sum), sid, sizeof(sid)), "/", NULL, 0, 0);
 
   return (cupsGetOption(CUPS_SID, num_cookies, cookies));
 }

config-scripts/cups-common.m4

@@ -1,7 +1,7 @@
 dnl
 dnl Common configuration stuff for CUPS.
 dnl
-dnl Copyright 2007-2017 by Apple Inc.
+dnl Copyright 2007-2019 by Apple Inc.
 dnl Copyright 1997-2007 by Easy Software Products, all rights reserved.
 dnl
 dnl These coded instructions, statements, and computer programs are the
@@ -42,7 +42,11 @@ AC_PROG_CXX(clang++ c++ g++)
 AC_PROG_RANLIB
 AC_PATH_PROG(AR,ar)
 AC_PATH_PROG(CHMOD,chmod)
-AC_PATH_PROG(GZIP,gzip)
+AC_PATH_PROG(GZIPPROG,gzip)
+AC_MSG_CHECKING(for install-sh script)
+INSTALL="`pwd`/install-sh"
+AC_SUBST(INSTALL)
+AC_MSG_RESULT(using $INSTALL)
 AC_PATH_PROG(LD,ld)
 AC_PATH_PROG(LN,ln)
 AC_PATH_PROG(MKDIR,mkdir)
@@ -51,6 +55,7 @@ AC_PATH_PROG(RM,rm)
 AC_PATH_PROG(RMDIR,rmdir)
 AC_PATH_PROG(SED,sed)
 AC_PATH_PROG(XDGOPEN,xdg-open)
+
 if test "x$XDGOPEN" = x; then
 	CUPS_HTMLVIEW="htmlview"
 else
@@ -58,11 +63,6 @@ else
 fi
 AC_SUBST(CUPS_HTMLVIEW)
 
-AC_MSG_CHECKING(for install-sh script)
-INSTALL="`pwd`/install-sh"
-AC_SUBST(INSTALL)
-AC_MSG_RESULT(using $INSTALL)
-
 if test "x$AR" = x; then
 	AC_MSG_ERROR([Unable to find required library archive command.])
 fi
@@ -266,14 +266,14 @@ dnl ZLIB
 INSTALL_GZIP=""
 LIBZ=""
 AC_CHECK_HEADER(zlib.h,
-    AC_CHECK_LIB(z, gzgets,
+    AC_CHECK_LIB(z, gzgets,[
 	AC_DEFINE(HAVE_LIBZ)
 	LIBZ="-lz"
 	LIBS="$LIBS -lz"
 	AC_CHECK_LIB(z, inflateCopy, AC_DEFINE(HAVE_INFLATECOPY))
-	if test "x$GZIP" != z; then
+	if test "x$GZIPPROG" != x; then
 		INSTALL_GZIP="-z"
-	fi))
+	fi]))
 AC_SUBST(INSTALL_GZIP)
 AC_SUBST(LIBZ)
 

config-scripts/cups-compiler.m4

@@ -1,7 +1,7 @@
 dnl
 dnl Compiler stuff for CUPS.
 dnl
-dnl Copyright 2007-2017 by Apple Inc.
+dnl Copyright 2007-2018 by Apple Inc.
 dnl Copyright 1997-2007 by Easy Software Products, all rights reserved.
 dnl
 dnl These coded instructions, statements, and computer programs are the
@@ -156,46 +156,19 @@ if test -n "$GCC"; then
 
 	if test "x$with_optim" = x; then
 		# Add useful warning options for tracking down problems...
-		OPTIM="-Wall -Wno-format-y2k -Wunused $OPTIM"
+		OPTIM="-Wall -Wno-format-y2k -Wunused -Wno-unused-result -Wsign-conversion $OPTIM"
 
-		AC_MSG_CHECKING(whether compiler supports -Wno-unused-result)
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wno-unused-result"
-		AC_TRY_COMPILE(,,
-			[OPTIM="$OPTIM -Wno-unused-result"
-			AC_MSG_RESULT(yes)],
-			AC_MSG_RESULT(no))
-		CFLAGS="$OLDCFLAGS"
-
-		AC_MSG_CHECKING(whether compiler supports -Wsign-conversion)
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wsign-conversion"
-		AC_TRY_COMPILE(,,
-			[OPTIM="$OPTIM -Wsign-conversion"
-			AC_MSG_RESULT(yes)],
-			AC_MSG_RESULT(no))
-		CFLAGS="$OLDCFLAGS"
-
-		AC_MSG_CHECKING(whether compiler supports -Wno-tautological-compare)
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wno-tautological-compare"
-		AC_TRY_COMPILE(,,
-			[OPTIM="$OPTIM -Wno-tautological-compare"
-			AC_MSG_RESULT(yes)],
-			AC_MSG_RESULT(no))
-		CFLAGS="$OLDCFLAGS"
-
-		AC_MSG_CHECKING(whether compiler supports -Wno-format-truncation)
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wno-format-truncation"
-		AC_TRY_COMPILE(,,
-			[OPTIM="$OPTIM -Wno-format-truncation"
-			AC_MSG_RESULT(yes)],
-			AC_MSG_RESULT(no))
-		CFLAGS="$OLDCFLAGS"
+		# Test GCC version for certain warning flags since -Werror
+		# doesn't trigger...
+		gccversion=`$CC --version | head -1 | awk '{print $NF}'`
+		case "$gccversion" in
+			7.* | 8.*)
+				OPTIM="$OPTIM -Wno-format-truncation -Wno-tautological-compare"
+				;;
+		esac
 
 		# Additional warning options for development testing...
-		if test -d .svn; then
+		if test -d .git; then
 			OPTIM="-Werror $OPTIM"
 		fi
 	fi

config-scripts/cups-opsys.m4

@@ -1,7 +1,7 @@
 dnl
 dnl Operating system stuff for CUPS.
 dnl
-dnl Copyright 2007-2017 by Apple Inc.
+dnl Copyright 2007-2018 by Apple Inc.
 dnl Copyright 1997-2006 by Easy Software Products, all rights reserved.
 dnl
 dnl These coded instructions, statements, and computer programs are the
@@ -35,3 +35,5 @@ else
 	LOCALTARGET=""
 fi
 AC_SUBST(LOCALTARGET)
+
+AC_PATH_PROGS(CODE_SIGN, codesign true)

config-scripts/cups-sharedlibs.m4

@@ -1,7 +1,7 @@
 dnl
 dnl Shared library support for CUPS.
 dnl
-dnl Copyright 2007-2017 by Apple Inc.
+dnl Copyright 2007-2018 by Apple Inc.
 dnl Copyright 1997-2005 by Easy Software Products, all rights reserved.
 dnl
 dnl These coded instructions, statements, and computer programs are the
@@ -24,30 +24,21 @@ if test x$enable_shared != xno; then
 	case "$host_os_name" in
 		sunos*)
 			LIBCUPS="lib$cupsbase.so.2"
-			LIBCUPSCGI="libcupscgi.so.1"
 			LIBCUPSIMAGE="libcupsimage.so.2"
-			LIBCUPSMIME="libcupsmime.so.1"
-			LIBCUPSPPDC="libcupsppdc.so.1"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -Wl,-h\`basename \$@\` -G \$(OPTIM)"
 			;;
 		linux* | gnu* | *bsd*)
 			LIBCUPS="lib$cupsbase.so.2"
-			LIBCUPSCGI="libcupscgi.so.1"
 			LIBCUPSIMAGE="libcupsimage.so.2"
-			LIBCUPSMIME="libcupsmime.so.1"
-			LIBCUPSPPDC="libcupsppdc.so.1"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -Wl,-soname,\`basename \$@\` -shared \$(OPTIM)"
 			;;
 		darwin*)
 			LIBCUPS="lib$cupsbase.2.dylib"
-			LIBCUPSCGI="libcupscgi.1.dylib"
 			LIBCUPSIMAGE="libcupsimage.2.dylib"
-			LIBCUPSMIME="libcupsmime.1.dylib"
-			LIBCUPSPPDC="libcupsppdc.1.dylib"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -dynamiclib -single_module -lc"
@@ -56,10 +47,7 @@ if test x$enable_shared != xno; then
 			echo "Warning: shared libraries may not be supported.  Trying -shared"
 			echo "         option with compiler."
 			LIBCUPS="lib$cupsbase.so.2"
-			LIBCUPSCGI="libcupscgi.so.1"
 			LIBCUPSIMAGE="libcupsimage.so.2"
-			LIBCUPSMIME="libcupsmime.so.1"
-			LIBCUPSPPDC="libcupsppdc.so.1"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -Wl,-soname,\`basename \$@\` -shared \$(OPTIM)"
@@ -68,10 +56,7 @@ if test x$enable_shared != xno; then
 else
 	PICFLAG=0
 	LIBCUPS="lib$cupsbase.a"
-	LIBCUPSCGI="libcupscgi.a"
 	LIBCUPSIMAGE="libcupsimage.a"
-	LIBCUPSMIME="libcupsmime.a"
-	LIBCUPSPPDC="libcupsppdc.a"
 	DSO=":"
 	DSOXX=":"
 fi
@@ -81,10 +66,7 @@ AC_SUBST(DSOXX)
 AC_SUBST(DSOFLAGS)
 AC_SUBST(LIBCUPS)
 AC_SUBST(LIBCUPSBASE)
-AC_SUBST(LIBCUPSCGI)
 AC_SUBST(LIBCUPSIMAGE)
-AC_SUBST(LIBCUPSMIME)
-AC_SUBST(LIBCUPSPPDC)
 AC_SUBST(LIBCUPSSTATIC)
 
 if test x$enable_shared = xno; then

config-scripts/cups-ssl.m4

@@ -80,6 +80,7 @@ if test x$enable_ssl != xno; then
 
 	    SAVELIBS="$LIBS"
 	    LIBS="$LIBS $SSLLIBS"
+	    AC_CHECK_FUNC(gnutls_fips140_set_mode, AC_DEFINE(HAVE_GNUTLS_FIPS140_SET_MODE))
 	    AC_CHECK_FUNC(gnutls_transport_set_pull_timeout_function, AC_DEFINE(HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION))
 	    AC_CHECK_FUNC(gnutls_priority_set_direct, AC_DEFINE(HAVE_GNUTLS_PRIORITY_SET_DIRECT))
 	    LIBS="$SAVELIBS"

config.h.in

@@ -303,6 +303,13 @@
 #undef HAVE_SSL
 
 
+/*
+ * Do we have the gnutls_fips140_set_mode function?
+ */
+
+#undef HAVE_GNUTLS_FIPS140_SET_MODE
+
+
 /*
  * Do we have the gnutls_transport_set_pull_timeout_function function?
  */

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for CUPS 2.2.6.
+# Generated by GNU Autoconf 2.69 for CUPS 2.2.13.
 #
 # Report bugs to <https://github.com/apple/cups/issues>.
 #
@@ -580,8 +580,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='CUPS'
 PACKAGE_TARNAME='cups'
-PACKAGE_VERSION='2.2.6'
-PACKAGE_STRING='CUPS 2.2.6'
+PACKAGE_VERSION='2.2.13'
+PACKAGE_STRING='CUPS 2.2.13'
 PACKAGE_BUGREPORT='https://github.com/apple/cups/issues'
 PACKAGE_URL='https://www.cups.org/'
 
@@ -712,10 +712,7 @@ LINKCUPS
 EXTLINKCUPSIMAGE
 EXTLINKCUPS
 LIBCUPSSTATIC
-LIBCUPSPPDC
-LIBCUPSMIME
 LIBCUPSIMAGE
-LIBCUPSCGI
 LIBCUPSBASE
 LIBCUPS
 DSOFLAGS
@@ -765,7 +762,6 @@ LIBPAPER
 LIBMALLOC
 PKGCONFIG
 INSTALLSTATIC
-INSTALL
 CUPS_HTMLVIEW
 XDGOPEN
 SED
@@ -775,7 +771,8 @@ MV
 MKDIR
 LN
 LD
-GZIP
+INSTALL
+GZIPPROG
 CHMOD
 AR
 RANLIB
@@ -794,6 +791,7 @@ AWK
 CUPS_BUILD
 CUPS_REVISION
 CUPS_VERSION
+CODE_SIGN
 LOCALTARGET
 host_os
 host_vendor
@@ -1482,7 +1480,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures CUPS 2.2.6 to adapt to many kinds of systems.
+\`configure' configures CUPS 2.2.13 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1547,7 +1545,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of CUPS 2.2.6:";;
+     short | recursive ) echo "Configuration of CUPS 2.2.13:";;
    esac
   cat <<\_ACEOF
 
@@ -1728,7 +1726,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-CUPS configure 2.2.6
+CUPS configure 2.2.13
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2192,7 +2190,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by CUPS $as_me 2.2.6, which was
+It was created by CUPS $as_me 2.2.13, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2663,11 +2661,57 @@ else
 fi
 
 
+for ac_prog in codesign true
+do
+  # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_path_CODE_SIGN+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  case $CODE_SIGN in
+  [\\/]* | ?:[\\/]*)
+  ac_cv_path_CODE_SIGN="$CODE_SIGN" # Let the user override the test with a path.
+  ;;
+  *)
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_path_CODE_SIGN="$as_dir/$ac_word$ac_exec_ext"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+  ;;
+esac
+fi
+CODE_SIGN=$ac_cv_path_CODE_SIGN
+if test -n "$CODE_SIGN"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CODE_SIGN" >&5
+$as_echo "$CODE_SIGN" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+  test -n "$CODE_SIGN" && break
+done
+
+
 
 ac_config_headers="$ac_config_headers config.h"
 
 
-CUPS_VERSION="2.2.6"
+CUPS_VERSION="2.2.13"
 CUPS_REVISION=""
 CUPS_BUILD="cups-$CUPS_VERSION"
 
@@ -3904,12 +3948,12 @@ fi
 set dummy gzip; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
 $as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_GZIP+:} false; then :
+if ${ac_cv_path_GZIPPROG+:} false; then :
   $as_echo_n "(cached) " >&6
 else
-  case $GZIP in
+  case $GZIPPROG in
   [\\/]* | ?:[\\/]*)
-  ac_cv_path_GZIP="$GZIP" # Let the user override the test with a path.
+  ac_cv_path_GZIPPROG="$GZIPPROG" # Let the user override the test with a path.
   ;;
   *)
   as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
@@ -3919,7 +3963,7 @@ do
   test -z "$as_dir" && as_dir=.
     for ac_exec_ext in '' $ac_executable_extensions; do
   if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_GZIP="$as_dir/$ac_word$ac_exec_ext"
+    ac_cv_path_GZIPPROG="$as_dir/$ac_word$ac_exec_ext"
     $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
     break 2
   fi
@@ -3930,16 +3974,22 @@ IFS=$as_save_IFS
   ;;
 esac
 fi
-GZIP=$ac_cv_path_GZIP
-if test -n "$GZIP"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $GZIP" >&5
-$as_echo "$GZIP" >&6; }
+GZIPPROG=$ac_cv_path_GZIPPROG
+if test -n "$GZIPPROG"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $GZIPPROG" >&5
+$as_echo "$GZIPPROG" >&6; }
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 fi
 
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for install-sh script" >&5
+$as_echo_n "checking for install-sh script... " >&6; }
+INSTALL="`pwd`/install-sh"
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: using $INSTALL" >&5
+$as_echo "using $INSTALL" >&6; }
 # Extract the first word of "ld", so it can be a program name with args.
 set dummy ld; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
@@ -4260,6 +4310,7 @@ $as_echo "no" >&6; }
 fi
 
 
+
 if test "x$XDGOPEN" = x; then
 	CUPS_HTMLVIEW="htmlview"
 else
@@ -4267,13 +4318,6 @@ else
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for install-sh script" >&5
-$as_echo_n "checking for install-sh script... " >&6; }
-INSTALL="`pwd`/install-sh"
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: using $INSTALL" >&5
-$as_echo "using $INSTALL" >&6; }
-
 if test "x$AR" = x; then
 	as_fn_error $? "Unable to find required library archive command." "$LINENO" 5
 fi
@@ -5674,7 +5718,8 @@ fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_z_gzgets" >&5
 $as_echo "$ac_cv_lib_z_gzgets" >&6; }
 if test "x$ac_cv_lib_z_gzgets" = xyes; then :
-  $as_echo "#define HAVE_LIBZ 1" >>confdefs.h
+
+	$as_echo "#define HAVE_LIBZ 1" >>confdefs.h
 
 	LIBZ="-lz"
 	LIBS="$LIBS -lz"
@@ -5719,7 +5764,7 @@ if test "x$ac_cv_lib_z_inflateCopy" = xyes; then :
 
 fi
 
-	if test "x$GZIP" != z; then
+	if test "x$GZIPPROG" != x; then
 		INSTALL_GZIP="-z"
 	fi
 fi
@@ -6579,30 +6624,21 @@ if test x$enable_shared != xno; then
 	case "$host_os_name" in
 		sunos*)
 			LIBCUPS="lib$cupsbase.so.2"
-			LIBCUPSCGI="libcupscgi.so.1"
 			LIBCUPSIMAGE="libcupsimage.so.2"
-			LIBCUPSMIME="libcupsmime.so.1"
-			LIBCUPSPPDC="libcupsppdc.so.1"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -Wl,-h\`basename \$@\` -G \$(OPTIM)"
 			;;
 		linux* | gnu* | *bsd*)
 			LIBCUPS="lib$cupsbase.so.2"
-			LIBCUPSCGI="libcupscgi.so.1"
 			LIBCUPSIMAGE="libcupsimage.so.2"
-			LIBCUPSMIME="libcupsmime.so.1"
-			LIBCUPSPPDC="libcupsppdc.so.1"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -Wl,-soname,\`basename \$@\` -shared \$(OPTIM)"
 			;;
 		darwin*)
 			LIBCUPS="lib$cupsbase.2.dylib"
-			LIBCUPSCGI="libcupscgi.1.dylib"
 			LIBCUPSIMAGE="libcupsimage.2.dylib"
-			LIBCUPSMIME="libcupsmime.1.dylib"
-			LIBCUPSPPDC="libcupsppdc.1.dylib"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -dynamiclib -single_module -lc"
@@ -6611,10 +6647,7 @@ if test x$enable_shared != xno; then
 			echo "Warning: shared libraries may not be supported.  Trying -shared"
 			echo "         option with compiler."
 			LIBCUPS="lib$cupsbase.so.2"
-			LIBCUPSCGI="libcupscgi.so.1"
 			LIBCUPSIMAGE="libcupsimage.so.2"
-			LIBCUPSMIME="libcupsmime.so.1"
-			LIBCUPSPPDC="libcupsppdc.so.1"
 			DSO="\$(CC)"
 			DSOXX="\$(CXX)"
 			DSOFLAGS="$DSOFLAGS -Wl,-soname,\`basename \$@\` -shared \$(OPTIM)"
@@ -6623,10 +6656,7 @@ if test x$enable_shared != xno; then
 else
 	PICFLAG=0
 	LIBCUPS="lib$cupsbase.a"
-	LIBCUPSCGI="libcupscgi.a"
 	LIBCUPSIMAGE="libcupsimage.a"
-	LIBCUPSMIME="libcupsmime.a"
-	LIBCUPSPPDC="libcupsppdc.a"
 	DSO=":"
 	DSOXX=":"
 fi
@@ -6639,9 +6669,6 @@ fi
 
 
 
-
-
-
 if test x$enable_shared = xno; then
 	LINKCUPS="../cups/lib$cupsbase.a"
 	LINKCUPSIMAGE="../filter/libcupsimage.a"
@@ -6988,114 +7015,19 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
 	if test "x$with_optim" = x; then
 		# Add useful warning options for tracking down problems...
-		OPTIM="-Wall -Wno-format-y2k -Wunused $OPTIM"
+		OPTIM="-Wall -Wno-format-y2k -Wunused -Wno-unused-result -Wsign-conversion $OPTIM"
 
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether compiler supports -Wno-unused-result" >&5
-$as_echo_n "checking whether compiler supports -Wno-unused-result... " >&6; }
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wno-unused-result"
-		cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  OPTIM="$OPTIM -Wno-unused-result"
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-		CFLAGS="$OLDCFLAGS"
-
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether compiler supports -Wsign-conversion" >&5
-$as_echo_n "checking whether compiler supports -Wsign-conversion... " >&6; }
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wsign-conversion"
-		cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  OPTIM="$OPTIM -Wsign-conversion"
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-		CFLAGS="$OLDCFLAGS"
-
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether compiler supports -Wno-tautological-compare" >&5
-$as_echo_n "checking whether compiler supports -Wno-tautological-compare... " >&6; }
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wno-tautological-compare"
-		cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  OPTIM="$OPTIM -Wno-tautological-compare"
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-		CFLAGS="$OLDCFLAGS"
-
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether compiler supports -Wno-format-truncation" >&5
-$as_echo_n "checking whether compiler supports -Wno-format-truncation... " >&6; }
-		OLDCFLAGS="$CFLAGS"
-		CFLAGS="$CFLAGS -Werror -Wno-format-truncation"
-		cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-int
-main ()
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-  OPTIM="$OPTIM -Wno-format-truncation"
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-		CFLAGS="$OLDCFLAGS"
+		# Test GCC version for certain warning flags since -Werror
+		# doesn't trigger...
+		gccversion=`$CC --version | head -1 | awk '{print $NF}'`
+		case "$gccversion" in
+			7.* | 8.*)
+				OPTIM="$OPTIM -Wno-format-truncation -Wno-tautological-compare"
+				;;
+		esac
 
 		# Additional warning options for development testing...
-		if test -d .svn; then
+		if test -d .git; then
 			OPTIM="-Werror $OPTIM"
 		fi
 	fi
@@ -8548,6 +8480,12 @@ fi
 
 	    SAVELIBS="$LIBS"
 	    LIBS="$LIBS $SSLLIBS"
+	    ac_fn_c_check_func "$LINENO" "gnutls_fips140_set_mode" "ac_cv_func_gnutls_fips140_set_mode"
+if test "x$ac_cv_func_gnutls_fips140_set_mode" = xyes; then :
+  $as_echo "#define HAVE_GNUTLS_FIPS140_SET_MODE 1" >>confdefs.h
+
+fi
+
 	    ac_fn_c_check_func "$LINENO" "gnutls_transport_set_pull_timeout_function" "ac_cv_func_gnutls_transport_set_pull_timeout_function"
 if test "x$ac_cv_func_gnutls_transport_set_pull_timeout_function" = xyes; then :
   $as_echo "#define HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION 1" >>confdefs.h
@@ -10901,7 +10839,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by CUPS $as_me 2.2.6, which was
+This file was extended by CUPS $as_me 2.2.13, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -10964,7 +10902,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-CUPS config.status 2.2.6
+CUPS config.status 2.2.13
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -1,7 +1,7 @@
 dnl
 dnl Configuration script for CUPS.
 dnl
-dnl Copyright 2007-2017 by Apple Inc.
+dnl Copyright 2007-2019 by Apple Inc.
 dnl Copyright 1997-2007 by Easy Software Products, all rights reserved.
 dnl
 dnl These coded instructions, statements, and computer programs are the
@@ -15,7 +15,7 @@ dnl We need at least autoconf 2.60...
 AC_PREREQ(2.60)
 
 dnl Package name and version...
-AC_INIT([CUPS], [2.2.6], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
+AC_INIT([CUPS], [2.2.13], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
 
 sinclude(config-scripts/cups-opsys.m4)
 sinclude(config-scripts/cups-common.m4)

cups/Makefile

@@ -1,8 +1,8 @@
 #
 # Library Makefile for CUPS.
 #
-# Copyright 2007-2017 by Apple Inc.
-# Copyright 1997-2006 by Easy Software Products, all rights reserved.
+# Copyright © 2007-2018 by Apple Inc.
+# Copyright © 1997-2006 by Easy Software Products, all rights reserved.
 #
 # These coded instructions, statements, and computer programs are the
 # property of Apple Inc. and are protected by Federal copyright
@@ -312,8 +312,9 @@ uninstall:
 
 libcups.so.2:	$(LIBOBJS)
 	echo Linking $@...
-	$(DSO) $(ARCHFLAGS) $(DSOFLAGS) -o $@ $(LIBOBJS) $(LIBGSSAPI) \
+	$(DSO) $(ARCHFLAGS) $(LDFLAGS) $(DSOFLAGS) -o $@ $(LIBOBJS) $(LIBGSSAPI) \
 		$(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	$(RM) `basename $@ .2`
 	$(LN) $@ `basename $@ .2`
 
@@ -329,13 +330,14 @@ libcups.2.dylib:	$(LIBOBJS) $(LIBCUPSORDER)
 		grep -v -E -e '^(_cupsConnect|_cupsCharset|_cupsEncodingName|_cupsSetDefaults|_cupsSetHTTPError|_cupsUserDefault)$$' | \
 		sort >t.exp
 	echo Linking $@...
-	$(DSO) $(ARCHFLAGS) $(DSOFLAGS) -o $@ \
+	$(DSO) $(ARCHFLAGS) $(LDFLAGS) $(DSOFLAGS) -o $@ \
 		-install_name $(libdir)/$@ \
-		-current_version 2.12.0 \
+		-current_version 2.13.0 \
 		-compatibility_version 2.0.0 \
 		-exported_symbols_list t.exp \
 		$(LIBOBJS) $(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) \
 		$(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	$(RM) libcups.dylib t.exp
 	$(LN) $@ libcups.dylib
 
@@ -346,8 +348,8 @@ libcups.2.dylib:	$(LIBOBJS) $(LIBCUPSORDER)
 
 libcups.la:    $(LIBOBJS)
 	echo Linking $@...
-	$(LD_CC) $(ARCHFLAGS) $(DSOFLAGS) -o $@ $(LIBOBJS:.o=.lo) \
-		-rpath $(LIBDIR) -version-info 2:12 $(LIBGSSAPI) $(SSLLIBS) \
+	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) $(DSOFLAGS) -o $@ $(LIBOBJS:.o=.lo) \
+		-rpath $(LIBDIR) -version-info 2:13 $(LIBGSSAPI) $(SSLLIBS) \
 		$(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
 
 
@@ -369,12 +371,12 @@ libcups.a:	$(LIBOBJS)
 libcups2.def: $(LIBOBJS) Makefile
 	echo Generating $@...
 	echo "LIBRARY libcups2" >libcups2.def
-	echo "VERSION 2.12" >>libcups2.def
+	echo "VERSION 2.13" >>libcups2.def
 	echo "EXPORTS" >>libcups2.def
 	(nm $(LIBOBJS) 2>/dev/null | grep "T _" | awk '{print $$3}'; \
 	 echo __cups_strcpy; echo __cups_strlcat; echo __cups_strlcpy) | \
 		grep -v -E \
-		    -e 'cups_debug|Apple|BackChannel|Backend|FileCheck|Filter|GSSService|SetNegotiate|SideChannel' \
+		    -e 'cups_debug|Apple|BackChannel|Backend|FileCheck|Filter|GSSService|SetNegotiate|SideChannel|SNMP' \
 		    -e 'Block$$' | \
 		sed -e '1,$$s/^_//' | sort >>libcups2.def
 
@@ -387,6 +389,7 @@ testadmin:	testadmin.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testadmin.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -397,6 +400,7 @@ testarray:	testarray.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testarray.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running array API tests...
 	./testarray
 
@@ -409,6 +413,7 @@ testcache:	testcache.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testcache.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -419,6 +424,7 @@ testconflicts:	testconflicts.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testconflicts.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -429,6 +435,7 @@ testcreds:	testcreds.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testcreds.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -439,6 +446,7 @@ testcups:	testcups.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testcups.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -449,6 +457,7 @@ testdest:	testdest.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testdest.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -459,6 +468,7 @@ testfile:	testfile.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testfile.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running file API tests...
 	./testfile
 
@@ -471,6 +481,7 @@ testgetdests:	testgetdests.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testgetdests.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -481,6 +492,7 @@ testhttp:	testhttp.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testhttp.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running HTTP API tests...
 	./testhttp
 
@@ -493,6 +505,7 @@ testipp:	testipp.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testipp.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running IPP API tests...
 	./testipp
 
@@ -505,6 +518,7 @@ testi18n:	testi18n.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testi18n.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running internationalization API tests...
 	./testi18n
 
@@ -517,6 +531,7 @@ testlang:	testlang.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testlang.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Creating locale directory structure...
 	$(RM) -r locale
 	$(MKDIR) locale/en
@@ -541,6 +556,7 @@ testoptions:	testoptions.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testoptions.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running option API tests...
 	./testoptions
 
@@ -553,6 +569,7 @@ testppd:	testppd.o $(LIBCUPSSTATIC) test.ppd test2.ppd
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testppd.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running PPD API tests...
 	./testppd
 
@@ -565,6 +582,7 @@ testpwg:	testpwg.o $(LIBCUPSSTATIC) test.ppd
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ testpwg.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 	echo Running PWG API tests...
 	./testpwg test.ppd
 
@@ -577,6 +595,7 @@ testsnmp:	testsnmp.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(LDFLAGS) -o $@ testsnmp.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #
@@ -587,6 +606,7 @@ tlscheck:	tlscheck.o $(LIBCUPSSTATIC)
 	echo Linking $@...
 	$(LD_CC) $(ARCHFLAGS) $(LDFLAGS) -o $@ tlscheck.o $(LIBCUPSSTATIC) \
 		$(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(COMMONLIBS) $(LIBZ)
+	$(CODE_SIGN) -s "$(CODE_SIGN_IDENTITY)" $@
 
 
 #

cups/adminutil.c

@@ -22,11 +22,11 @@
 #include "adminutil.h"
 #include <fcntl.h>
 #include <sys/stat.h>
-#ifdef WIN32
+#ifdef _WIN32
 #else
 #  include <unistd.h>
 #  include <sys/wait.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -2087,7 +2087,7 @@ do_samba_command(const char *command,	/* I - Command to run */
 		 const char *authfile,	/* I - Samba authentication file */
 		 FILE *logfile)		/* I - Optional log file */
 {
-#ifdef WIN32
+#ifdef _WIN32
   return (1);				/* Always fail on Windows... */
 
 #else
@@ -2154,7 +2154,7 @@ do_samba_command(const char *command,	/* I - Command to run */
     return (WEXITSTATUS(status));
   else
     return (-WTERMSIG(status));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -2172,9 +2172,9 @@ get_cupsd_conf(
     int             *remote)		/* O - Remote file? */
 {
   int		fd;			/* Temporary file descriptor */
-#ifndef WIN32
+#ifndef _WIN32
   struct stat	info;			/* cupsd.conf file information */
-#endif /* WIN32 */
+#endif /* _WIN32 */
   http_status_t	status;			/* Status of getting cupsd.conf */
   char		host[HTTP_MAX_HOST];	/* Hostname for connection */
 
@@ -2191,7 +2191,7 @@ get_cupsd_conf(
   snprintf(name, namesize, "%s/cupsd.conf", cg->cups_serverroot);
   *remote = 0;
 
-#ifndef WIN32
+#ifndef _WIN32
   if (!_cups_strcasecmp(host, "localhost") && !access(name, R_OK))
   {
    /*
@@ -2218,7 +2218,7 @@ get_cupsd_conf(
       status = HTTP_STATUS_OK;
   }
   else
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
   {
    /*
     * Read cupsd.conf via a HTTP GET request...

cups/api-ppd.shtml

@@ -1,7 +1,7 @@
 <!--
   PPD API introduction for CUPS.
 
-  Copyright 2007-2012 by Apple Inc.
+  Copyright 2007-2018 by Apple Inc.
   Copyright 1997-2006 by Easy Software Products, all rights reserved.
 
   These coded instructions, statements, and computer programs are the
@@ -13,7 +13,7 @@
 
 <h2 class='title'><a name='OVERVIEW'>Overview</a></h2>
 
-<blockquote>The PPD API is deprecated starting in CUPS 1.6/macOS 10.8. Please use the new Job Ticket APIs in the <a href="api-cups.html">CUPS API</a> documentation. These functions will be removed in a future release of CUPS.</blockquote>
+<blockquote>The PPD API is deprecated starting in CUPS 1.6/macOS 10.8. Please use the new Job Ticket APIs in the <a href="cupspm.html">CUPS API</a> documentation. These functions will be removed in a future release of CUPS.</blockquote>
 
 <p>The CUPS PPD API provides read-only access the data in PostScript Printer
 Description ("PPD") files which are used for all printers with a driver. With

cups/auth.c

@@ -1,8 +1,8 @@
 /*
  * Authentication functions for CUPS.
  *
- * Copyright 2007-2016 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products.
  *
  * This file contains Kerberos support code, copyright 2006 by
  * Jelmer Vernooij.
@@ -23,11 +23,11 @@
 #include "cups-private.h"
 #include <fcntl.h>
 #include <sys/stat.h>
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 || __EMX__ */
+#endif /* _WIN32 || __EMX__ */
 
 #if HAVE_AUTHORIZATION_H
 #  include <Security/Authorization.h>
@@ -47,7 +47,14 @@ extern const char *cssmErrorString(int error);
  * Local functions...
  */
 
+static const char	*cups_auth_find(const char *www_authenticate, const char *scheme);
+static const char	*cups_auth_param(const char *scheme, const char *name, char *value, size_t valsize);
+static const char	*cups_auth_scheme(const char *www_authenticate, char *scheme, size_t schemesize);
+
 #ifdef HAVE_GSSAPI
+#  define CUPS_GSS_OK	0		/* Successfully set credentials */
+#  define CUPS_GSS_NONE	-1		/* No credentials */
+#  define CUPS_GSS_FAIL	-2		/* Failed credentials/authentication */
 #  ifdef HAVE_GSS_ACQUIRE_CRED_EX_F
 #    ifdef HAVE_GSS_GSSAPI_SPI_H
 #      include <GSS/gssapi_spi.h>
@@ -112,10 +119,10 @@ cupsDoAuthentication(
     const char *resource)		/* I - Resource path */
 {
   const char	*password,		/* Password string */
-		*www_auth;		/* WWW-Authenticate header */
-  char		prompt[1024],		/* Prompt for user */
-		realm[HTTP_MAX_VALUE],	/* realm="xyz" string */
-		nonce[HTTP_MAX_VALUE];	/* nonce="xyz" string */
+		*www_auth,		/* WWW-Authenticate header */
+		*schemedata;		/* Scheme-specific data */
+  char		scheme[256],		/* Scheme name */
+		prompt[1024];		/* Prompt for user */
   int		localauth;		/* Local authentication result */
   _cups_globals_t *cg;			/* Global data */
 
@@ -163,122 +170,154 @@ cupsDoAuthentication(
   }
 
  /*
-  * Nope, see if we should retry the current username:password...
+  * Nope, loop through the authentication schemes to find the first we support.
   */
 
-  www_auth = http->fields[HTTP_FIELD_WWW_AUTHENTICATE];
+  www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE);
 
-  if ((http->digest_tries > 1 || !http->userpass[0]) &&
-      (!_cups_strncasecmp(www_auth, "Basic", 5) ||
-       !_cups_strncasecmp(www_auth, "Digest", 6)))
+  for (schemedata = cups_auth_scheme(www_auth, scheme, sizeof(scheme)); schemedata; schemedata = cups_auth_scheme(schemedata + strlen(scheme), scheme, sizeof(scheme)))
   {
    /*
-    * Nope - get a new password from the user...
+    * Check the scheme name...
     */
 
-    char default_username[HTTP_MAX_VALUE];
-					/* Default username */
-
-    cg = _cupsGlobals();
-
-    if (!cg->lang_default)
-      cg->lang_default = cupsLangDefault();
-
-    if (httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "username",
-                        default_username))
-      cupsSetUser(default_username);
-
-    snprintf(prompt, sizeof(prompt),
-             _cupsLangString(cg->lang_default, _("Password for %s on %s? ")),
-	     cupsUser(),
-	     http->hostname[0] == '/' ? "localhost" : http->hostname);
-
-    http->digest_tries  = _cups_strncasecmp(www_auth, "Digest", 6) != 0;
-    http->userpass[0]   = '\0';
-
-    if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL)
-    {
-      http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
-      return (-1);
-    }
-
-    snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(),
-             password);
-  }
-  else if (http->status == HTTP_STATUS_UNAUTHORIZED)
-    http->digest_tries ++;
-
-  if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3)
-  {
-    DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)",
-		  http->digest_tries));
-
-    http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
-    return (-1);
-  }
-
- /*
-  * Got a password; encode it for the server...
-  */
+    DEBUG_printf(("2cupsDoAuthentication: Trying scheme \"%s\"...", scheme));
 
 #ifdef HAVE_GSSAPI
-  if (!_cups_strncasecmp(www_auth, "Negotiate", 9))
-  {
+    if (!_cups_strcasecmp(scheme, "Negotiate"))
+    {
+     /*
+      * Kerberos authentication...
+      */
+
+      int gss_status;			/* Auth status */
+
+      if ((gss_status = _cupsSetNegotiateAuthString(http, method, resource)) == CUPS_GSS_FAIL)
+      {
+        DEBUG_puts("1cupsDoAuthentication: Negotiate failed.");
+	http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
+	return (-1);
+      }
+      else if (gss_status == CUPS_GSS_NONE)
+      {
+        DEBUG_puts("2cupsDoAuthentication: No credentials for Negotiate.");
+        continue;
+      }
+      else
+      {
+        DEBUG_puts("2cupsDoAuthentication: Using Negotiate.");
+        break;
+      }
+    }
+    else
+#endif /* HAVE_GSSAPI */
+    if (_cups_strcasecmp(scheme, "Basic") && _cups_strcasecmp(scheme, "Digest"))
+    {
+     /*
+      * Other schemes not yet supported...
+      */
+
+      DEBUG_printf(("2cupsDoAuthentication: Scheme \"%s\" not yet supported.", scheme));
+      continue;
+    }
+
    /*
-    * Kerberos authentication...
+    * See if we should retry the current username:password...
     */
 
-    if (_cupsSetNegotiateAuthString(http, method, resource))
+    if ((http->digest_tries > 1 || !http->userpass[0]) && (!_cups_strcasecmp(scheme, "Basic") || (!_cups_strcasecmp(scheme, "Digest"))))
     {
+     /*
+      * Nope - get a new password from the user...
+      */
+
+      char default_username[HTTP_MAX_VALUE];
+					/* Default username */
+
+      cg = _cupsGlobals();
+
+      if (!cg->lang_default)
+	cg->lang_default = cupsLangDefault();
+
+      if (cups_auth_param(schemedata, "username", default_username, sizeof(default_username)))
+	cupsSetUser(default_username);
+
+      snprintf(prompt, sizeof(prompt), _cupsLangString(cg->lang_default, _("Password for %s on %s? ")), cupsUser(), http->hostname[0] == '/' ? "localhost" : http->hostname);
+
+      http->digest_tries  = _cups_strncasecmp(scheme, "Digest", 6) != 0;
+      http->userpass[0]   = '\0';
+
+      if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL)
+      {
+        DEBUG_puts("1cupsDoAuthentication: User canceled password request.");
+	http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
+	return (-1);
+      }
+
+      snprintf(http->userpass, sizeof(http->userpass), "%s:%s", cupsUser(), password);
+    }
+    else if (http->status == HTTP_STATUS_UNAUTHORIZED)
+      http->digest_tries ++;
+
+    if (http->status == HTTP_STATUS_UNAUTHORIZED && http->digest_tries >= 3)
+    {
+      DEBUG_printf(("1cupsDoAuthentication: Too many authentication tries (%d)", http->digest_tries));
+
       http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
       return (-1);
     }
-  }
-  else
-#endif /* HAVE_GSSAPI */
-  if (!_cups_strncasecmp(www_auth, "Basic", 5))
-  {
+
    /*
-    * Basic authentication...
+    * Got a password; encode it for the server...
     */
 
-    char	encode[256];		/* Base64 buffer */
+    if (!_cups_strcasecmp(scheme, "Basic"))
+    {
+     /*
+      * Basic authentication...
+      */
 
+      char	encode[256];		/* Base64 buffer */
 
-    httpEncode64_2(encode, sizeof(encode), http->userpass,
-                   (int)strlen(http->userpass));
-    httpSetAuthString(http, "Basic", encode);
+      DEBUG_puts("2cupsDoAuthentication: Using Basic.");
+      httpEncode64_2(encode, sizeof(encode), http->userpass, (int)strlen(http->userpass));
+      httpSetAuthString(http, "Basic", encode);
+      break;
+    }
+    else if (!_cups_strcasecmp(scheme, "Digest"))
+    {
+     /*
+      * Digest authentication...
+      */
+
+      char nonce[HTTP_MAX_VALUE];	/* nonce="xyz" string */
+
+      cups_auth_param(schemedata, "algorithm", http->algorithm, sizeof(http->algorithm));
+      cups_auth_param(schemedata, "opaque", http->opaque, sizeof(http->opaque));
+      cups_auth_param(schemedata, "nonce", nonce, sizeof(nonce));
+      cups_auth_param(schemedata, "realm", http->realm, sizeof(http->realm));
+
+      if (_httpSetDigestAuthString(http, nonce, method, resource))
+      {
+	DEBUG_puts("2cupsDoAuthentication: Using Basic.");
+        break;
+      }
+    }
   }
-  else if (!_cups_strncasecmp(www_auth, "Digest", 6))
+
+  if (http->authstring)
   {
-   /*
-    * Digest authentication...
-    */
+    DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\".", http->authstring));
 
-    char	encode[33],		/* MD5 buffer */
-		digest[1024];		/* Digest auth data */
-
-    httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "realm", realm);
-    httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "nonce", nonce);
-
-    httpMD5(cupsUser(), realm, strchr(http->userpass, ':') + 1, encode);
-    httpMD5Final(nonce, method, resource, encode);
-    snprintf(digest, sizeof(digest),
-	     "username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", "
-	     "response=\"%s\"", cupsUser(), realm, nonce, resource, encode);
-    httpSetAuthString(http, "Digest", digest);
+    return (0);
   }
   else
   {
-    DEBUG_printf(("1cupsDoAuthentication: Unknown auth type: \"%s\"",
-                  www_auth));
+    DEBUG_puts("1cupsDoAuthentication: No supported schemes.");
     http->status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
+
     return (-1);
   }
-
-  DEBUG_printf(("1cupsDoAuthentication: authstring=\"%s\"", http->authstring));
-
-  return (0);
 }
 
 
@@ -287,7 +326,7 @@ cupsDoAuthentication(
  * '_cupsSetNegotiateAuthString()' - Set the Kerberos authentication string.
  */
 
-int					/* O - 0 on success, -1 on error */
+int					/* O - 0 on success, negative on error */
 _cupsSetNegotiateAuthString(
     http_t     *http,			/* I - Connection to server */
     const char *method,			/* I - Request method ("GET", "POST", "PUT") */
@@ -312,10 +351,16 @@ _cupsSetNegotiateAuthString(
   {
     DEBUG_puts("1_cupsSetNegotiateAuthString: Weak-linked GSSAPI/Kerberos "
                "framework is not present");
-    return (-1);
+    return (CUPS_GSS_NONE);
   }
 #  endif /* __APPLE__ */
 
+  if (!strcmp(http->hostname, "localhost") || http->hostname[0] == '/' || isdigit(http->hostname[0] & 255) || !strchr(http->hostname, '.'))
+  {
+    DEBUG_printf(("1_cupsSetNegotiateAuthString: Kerberos not available for host \"%s\".", http->hostname));
+    return (CUPS_GSS_NONE);
+  }
+
   if (http->gssname == GSS_C_NO_NAME)
   {
     http->gssname = cups_gss_getname(http, _cupsGSSServiceName());
@@ -336,7 +381,7 @@ _cupsSetNegotiateAuthString(
 				      GSS_C_NO_BUFFER, &http->gssmech,
 				      &output_token, NULL, NULL);
 
-#ifdef HAVE_GSS_ACQUIRE_CRED_EX_F
+#  ifdef HAVE_GSS_ACQUIRE_CRED_EX_F
   if (major_status == GSS_S_NO_CRED)
   {
    /*
@@ -360,7 +405,7 @@ _cupsSetNegotiateAuthString(
 	     cupsUser(), http->gsshost);
 
     if ((password = cupsGetPassword2(prompt, http, method, resource)) == NULL)
-      return (-1);
+      return (CUPS_GSS_FAIL);
 
    /*
     * Try to acquire credentials...
@@ -412,21 +457,23 @@ _cupsSetNegotiateAuthString(
       }
     }
   }
-#endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */
+#  endif /* HAVE_GSS_ACQUIRED_CRED_EX_F */
 
-  if (GSS_ERROR(major_status))
+  if (major_status == GSS_S_NO_CRED)
   {
-    cups_gss_printf(major_status, minor_status,
-		    "_cupsSetNegotiateAuthString: Unable to initialize "
-		    "security context");
-    return (-1);
+    cups_gss_printf(major_status, minor_status, "_cupsSetNegotiateAuthString: No credentials");
+    return (CUPS_GSS_NONE);
+  }
+  else if (GSS_ERROR(major_status))
+  {
+    cups_gss_printf(major_status, minor_status, "_cupsSetNegotiateAuthString: Unable to initialize security context");
+    return (CUPS_GSS_FAIL);
   }
 
-#ifdef DEBUG
+#  ifdef DEBUG
   else if (major_status == GSS_S_CONTINUE_NEEDED)
-    cups_gss_printf(major_status, minor_status,
-		    "_cupsSetNegotiateAuthString: Continuation needed!");
-#endif /* DEBUG */
+    cups_gss_printf(major_status, minor_status, "_cupsSetNegotiateAuthString: Continuation needed");
+#  endif /* DEBUG */
 
   if (output_token.length > 0 && output_token.length <= 65536)
   {
@@ -436,7 +483,7 @@ _cupsSetNegotiateAuthString(
     */
 
     int authsize = 10 +			/* "Negotiate " */
-		   (int)output_token.length * 4 / 3 + 1 + 1;
+		   (((int)output_token.length * 4 / 3 + 3) & ~3) + 1;
 		   			/* Base64 + nul */
 
     httpSetAuthString(http, NULL, NULL);
@@ -459,13 +506,264 @@ _cupsSetNegotiateAuthString(
                   "large - %d bytes!", (int)output_token.length));
     gss_release_buffer(&minor_status, &output_token);
 
-    return (-1);
+    return (CUPS_GSS_FAIL);
   }
 
-  return (0);
+  return (CUPS_GSS_OK);
+}
+#endif /* HAVE_GSSAPI */
+
+
+/*
+ * 'cups_auth_find()' - Find the named WWW-Authenticate scheme.
+ *
+ * The "www_authenticate" parameter points to the current position in the header.
+ *
+ * Returns @code NULL@ if the auth scheme is not present.
+ */
+
+static const char *				/* O - Start of matching scheme or @code NULL@ if not found */
+cups_auth_find(const char *www_authenticate,	/* I - Pointer into WWW-Authenticate header */
+               const char *scheme)		/* I - Authentication scheme */
+{
+  size_t	schemelen = strlen(scheme);	/* Length of scheme */
+
+
+  DEBUG_printf(("8cups_auth_find(www_authenticate=\"%s\", scheme=\"%s\"(%d))", www_authenticate, scheme, (int)schemelen));
+
+  while (*www_authenticate)
+  {
+   /*
+    * Skip leading whitespace and commas...
+    */
+
+    DEBUG_printf(("9cups_auth_find: Before whitespace: \"%s\"", www_authenticate));
+    while (isspace(*www_authenticate & 255) || *www_authenticate == ',')
+      www_authenticate ++;
+    DEBUG_printf(("9cups_auth_find: After whitespace: \"%s\"", www_authenticate));
+
+   /*
+    * See if this is "Scheme" followed by whitespace or the end of the string.
+    */
+
+    if (!strncmp(www_authenticate, scheme, schemelen) && (isspace(www_authenticate[schemelen] & 255) || www_authenticate[schemelen] == ',' || !www_authenticate[schemelen]))
+    {
+     /*
+      * Yes, this is the start of the scheme-specific information...
+      */
+
+      DEBUG_printf(("9cups_auth_find: Returning \"%s\".", www_authenticate));
+
+      return (www_authenticate);
+    }
+
+   /*
+    * Skip the scheme name or param="value" string...
+    */
+
+    while (!isspace(*www_authenticate & 255) && *www_authenticate)
+    {
+      if (*www_authenticate == '\"')
+      {
+       /*
+        * Skip quoted value...
+        */
+
+        www_authenticate ++;
+        while (*www_authenticate && *www_authenticate != '\"')
+          www_authenticate ++;
+
+        DEBUG_printf(("9cups_auth_find: After quoted: \"%s\"", www_authenticate));
+      }
+
+      www_authenticate ++;
+    }
+
+    DEBUG_printf(("9cups_auth_find: After skip: \"%s\"", www_authenticate));
+  }
+
+  DEBUG_puts("9cups_auth_find: Returning NULL.");
+
+  return (NULL);
 }
 
 
+/*
+ * 'cups_auth_param()' - Copy the value for the named authentication parameter,
+ *                       if present.
+ */
+
+static const char *				/* O - Parameter value or @code NULL@ if not present */
+cups_auth_param(const char *scheme,		/* I - Pointer to auth data */
+                const char *name,		/* I - Name of parameter */
+                char       *value,		/* I - Value buffer */
+                size_t     valsize)		/* I - Size of value buffer */
+{
+  char		*valptr = value,		/* Pointer into value buffer */
+		*valend = value + valsize - 1;	/* Pointer to end of buffer */
+  size_t	namelen = strlen(name);		/* Name length */
+  int		param;				/* Is this a parameter? */
+
+
+  DEBUG_printf(("8cups_auth_param(scheme=\"%s\", name=\"%s\", value=%p, valsize=%d)", scheme, name, (void *)value, (int)valsize));
+
+  while (!isspace(*scheme & 255) && *scheme)
+    scheme ++;
+
+  while (*scheme)
+  {
+    while (isspace(*scheme & 255) || *scheme == ',')
+      scheme ++;
+
+    if (!strncmp(scheme, name, namelen) && scheme[namelen] == '=')
+    {
+     /*
+      * Found the parameter, copy the value...
+      */
+
+      scheme += namelen + 1;
+      if (*scheme == '\"')
+      {
+        scheme ++;
+
+	while (*scheme && *scheme != '\"')
+	{
+	  if (valptr < valend)
+	    *valptr++ = *scheme;
+
+	  scheme ++;
+	}
+      }
+      else
+      {
+	while (*scheme && strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~+/=", *scheme))
+	{
+	  if (valptr < valend)
+	    *valptr++ = *scheme;
+
+	  scheme ++;
+	}
+      }
+
+      *valptr = '\0';
+
+      DEBUG_printf(("9cups_auth_param: Returning \"%s\".", value));
+
+      return (value);
+    }
+
+   /*
+    * Skip the param=value string...
+    */
+
+    param = 0;
+
+    while (!isspace(*scheme & 255) && *scheme)
+    {
+      if (*scheme == '=')
+        param = 1;
+      else if (*scheme == '\"')
+      {
+       /*
+        * Skip quoted value...
+        */
+
+        scheme ++;
+        while (*scheme && *scheme != '\"')
+          scheme ++;
+      }
+
+      scheme ++;
+    }
+
+   /*
+    * If this wasn't a parameter, we are at the end of this scheme's
+    * parameters...
+    */
+
+    if (!param)
+      break;
+  }
+
+  *value = '\0';
+
+  DEBUG_puts("9cups_auth_param: Returning NULL.");
+
+  return (NULL);
+}
+
+
+/*
+ * 'cups_auth_scheme()' - Get the (next) WWW-Authenticate scheme.
+ *
+ * The "www_authenticate" parameter points to the current position in the header.
+ *
+ * Returns @code NULL@ if there are no (more) auth schemes present.
+ */
+
+static const char *				/* O - Start of scheme or @code NULL@ if not found */
+cups_auth_scheme(const char *www_authenticate,	/* I - Pointer into WWW-Authenticate header */
+		 char       *scheme,		/* I - Scheme name buffer */
+		 size_t     schemesize)		/* I - Size of buffer */
+{
+  const char	*start;				/* Start of scheme data */
+  char		*sptr = scheme,			/* Pointer into scheme buffer */
+		*send = scheme + schemesize - 1;/* End of scheme buffer */
+  int		param;				/* Is this a parameter? */
+
+
+  DEBUG_printf(("8cups_auth_scheme(www_authenticate=\"%s\", scheme=%p, schemesize=%d)", www_authenticate, (void *)scheme, (int)schemesize));
+
+  while (*www_authenticate)
+  {
+   /*
+    * Skip leading whitespace and commas...
+    */
+
+    while (isspace(*www_authenticate & 255) || *www_authenticate == ',')
+      www_authenticate ++;
+
+   /*
+    * Parse the scheme name or param="value" string...
+    */
+
+    for (sptr = scheme, start = www_authenticate, param = 0; *www_authenticate && *www_authenticate != ',' && !isspace(*www_authenticate & 255); www_authenticate ++)
+    {
+      if (*www_authenticate == '=')
+        param = 1;
+      else if (!param && sptr < send)
+        *sptr++ = *www_authenticate;
+      else if (*www_authenticate == '\"')
+      {
+       /*
+        * Skip quoted value...
+        */
+
+        www_authenticate ++;
+        while (*www_authenticate && *www_authenticate != '\"')
+          www_authenticate ++;
+      }
+    }
+
+    if (sptr > scheme && !param)
+    {
+      *sptr = '\0';
+
+      DEBUG_printf(("9cups_auth_scheme: Returning \"%s\".", start));
+
+      return (start);
+    }
+  }
+
+  *scheme = '\0';
+
+  DEBUG_puts("9cups_auth_scheme: Returning NULL.");
+
+  return (NULL);
+}
+
+
+#ifdef HAVE_GSSAPI
 #  ifdef HAVE_GSS_ACQUIRE_CRED_EX_F
 /*
  * 'cups_gss_acquire()' - Kerberos credentials callback.
@@ -639,9 +937,9 @@ static int				/* O - 0 if available */
 					/*    -1 error */
 cups_local_auth(http_t *http)		/* I - HTTP connection to server */
 {
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
  /*
-  * Currently WIN32 and OS-2 do not support the CUPS server...
+  * Currently _WIN32 and OS-2 do not support the CUPS server...
   */
 
   return (1);
@@ -650,6 +948,8 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
   FILE			*fp;		/* Certificate file */
   char			trc[16],	/* Try Root Certificate parameter */
 			filename[1024];	/* Certificate filename */
+  const char		*www_auth,	/* WWW-Authenticate header */
+			*schemedata;	/* Data for the named auth scheme */
   _cups_globals_t *cg = _cupsGlobals();	/* Global data */
 #  if defined(HAVE_AUTHORIZATION_H)
   OSStatus		status;		/* Status */
@@ -668,13 +968,14 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
   * See if we are accessing localhost...
   */
 
-  if (!httpAddrLocalhost(http->hostaddr) &&
-      _cups_strcasecmp(http->hostname, "localhost") != 0)
+  if (!httpAddrLocalhost(http->hostaddr) && _cups_strcasecmp(http->hostname, "localhost") != 0)
   {
     DEBUG_puts("8cups_local_auth: Not a local connection!");
     return (1);
   }
 
+  www_auth = httpGetField(http, HTTP_FIELD_WWW_AUTHENTICATE);
+
 #  if defined(HAVE_AUTHORIZATION_H)
  /*
   * Delete any previous authorization reference...
@@ -686,12 +987,9 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
     http->auth_ref = NULL;
   }
 
-  if (!getenv("GATEWAY_INTERFACE") &&
-      httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey",
-		       auth_key, sizeof(auth_key)))
+  if (!getenv("GATEWAY_INTERFACE") && (schemedata = cups_auth_find(www_auth, "AuthRef")) != NULL && cups_auth_param(schemedata, "key", auth_key, sizeof(auth_key)))
   {
-    status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment,
-				 kAuthorizationFlagDefaults, &http->auth_ref);
+    status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &http->auth_ref);
     if (status != errAuthorizationSuccess)
     {
       DEBUG_printf(("8cups_local_auth: AuthorizationCreate() returned %d (%s)",
@@ -745,6 +1043,11 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
   }
 #  endif /* HAVE_AUTHORIZATION_H */
 
+#  ifdef HAVE_GSSAPI
+  if (cups_auth_find(www_auth, "Negotiate"))
+    return (1);
+#  endif /* HAVE_GSSAPI */
+
 #  if defined(SO_PEERCRED) && defined(AF_LOCAL)
  /*
   * See if we can authenticate using the peer credentials provided over a
@@ -752,16 +1055,9 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
   * information...
   */
 
-  if (
-#    ifdef HAVE_GSSAPI
-      _cups_strncasecmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9) &&
-#    endif /* HAVE_GSSAPI */
-#    ifdef HAVE_AUTHORIZATION_H
-      !httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey",
-		        auth_key, sizeof(auth_key)) &&
-#    endif /* HAVE_AUTHORIZATION_H */
-      http->hostaddr->addr.sa_family == AF_LOCAL &&
-      !getenv("GATEWAY_INTERFACE"))	/* Not via CGI programs... */
+  if (http->hostaddr->addr.sa_family == AF_LOCAL &&
+      !getenv("GATEWAY_INTERFACE") &&	/* Not via CGI programs... */
+      cups_auth_find(www_auth, "PeerCred"))
   {
    /*
     * Verify that the current cupsUser() matches the current UID...
@@ -784,6 +1080,9 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
   }
 #  endif /* SO_PEERCRED && AF_LOCAL */
 
+  if ((schemedata = cups_auth_find(www_auth, "Local")) == NULL)
+    return (1);
+
  /*
   * Try opening a certificate file for this PID.  If that fails,
   * try the root certificate...
@@ -797,33 +1096,9 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
     * No certificate for this PID; see if we can get the root certificate...
     */
 
-    DEBUG_printf(("9cups_local_auth: Unable to open file %s: %s",
-                  filename, strerror(errno)));
+    DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno)));
 
-#  ifdef HAVE_GSSAPI
-    if (!_cups_strncasecmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Negotiate", 9))
-    {
-     /*
-      * Kerberos required, don't try the root certificate...
-      */
-
-      return (1);
-    }
-#  endif /* HAVE_GSSAPI */
-
-#  ifdef HAVE_AUTHORIZATION_H
-    if (httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "authkey",
-		         auth_key, sizeof(auth_key)))
-    {
-     /*
-      * Don't use the root certificate as a replacement for an authkey...
-      */
-
-      return (1);
-    }
-#  endif /* HAVE_AUTHORIZATION_H */
-    if (!httpGetSubField2(http, HTTP_FIELD_WWW_AUTHENTICATE, "trc", trc,
-	                  sizeof(trc)))
+    if (!cups_auth_param(schemedata, "trc", trc, sizeof(trc)))
     {
      /*
       * Scheduler doesn't want us to use the root certificate...
@@ -833,7 +1108,8 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
     }
 
     snprintf(filename, sizeof(filename), "%s/certs/0", cg->cups_statedir);
-    fp = fopen(filename, "r");
+    if ((fp = fopen(filename, "r")) == NULL)
+      DEBUG_printf(("9cups_local_auth: Unable to open file \"%s\": %s", filename, strerror(errno)));
   }
 
   if (fp)
@@ -864,5 +1140,5 @@ cups_local_auth(http_t *http)		/* I - HTTP connection to server */
   }
 
   return (1);
-#endif /* WIN32 || __EMX__ */
+#endif /* _WIN32 || __EMX__ */
 }

cups/backchannel.c

@@ -19,12 +19,12 @@
 
 #include "cups.h"
 #include <errno.h>
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #  include <fcntl.h>
 #else
 #  include <sys/time.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -77,11 +77,11 @@ cupsBackChannelRead(char   *buffer,	/* I - Buffer to read into */
   * Read bytes from the pipe...
   */
 
-#ifdef WIN32
+#ifdef _WIN32
   return ((ssize_t)_read(3, buffer, (unsigned)bytes));
 #else
   return (read(3, buffer, bytes));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -139,11 +139,11 @@ cupsBackChannelWrite(
     * Write bytes to the pipe...
     */
 
-#ifdef WIN32
+#ifdef _WIN32
     count = (ssize_t)_write(3, buffer, (unsigned)(bytes - total));
 #else
     count = write(3, buffer, bytes - total);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
     if (count < 0)
     {

cups/cups-private.h

@@ -239,8 +239,7 @@ extern http_t		*_cupsConnect(void);
 extern char		*_cupsCreateDest(const char *name, const char *info, const char *device_id, const char *device_uri, char *uri, size_t urisize);
 extern int		_cupsGet1284Values(const char *device_id,
 			                   cups_option_t **values);
-extern const char	*_cupsGetDestResource(cups_dest_t *dest, char *resource,
-			                      size_t resourcesize);
+extern const char	*_cupsGetDestResource(cups_dest_t *dest, unsigned flags, char *resource, size_t resourcesize);
 extern int		_cupsGetDests(http_t *http, ipp_op_t op,
 			              const char *name, cups_dest_t **dests,
 			              cups_ptype_t type, cups_ptype_t mask);

cups/cups.h

@@ -1,7 +1,7 @@
 /*
  * API definitions for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2019 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -21,12 +21,12 @@
  */
 
 #  include <sys/types.h>
-#  if defined(WIN32) && !defined(__CUPS_SSIZE_T_DEFINED)
+#  if defined(_WIN32) && !defined(__CUPS_SSIZE_T_DEFINED)
 #    define __CUPS_SSIZE_T_DEFINED
 #    include <stddef.h>
 /* Windows does not support the ssize_t type, so map it to long... */
 typedef long ssize_t;			/* @private@ */
-#  endif /* WIN32 && !__CUPS_SSIZE_T_DEFINED */
+#  endif /* _WIN32 && !__CUPS_SSIZE_T_DEFINED */
 
 #  include "file.h"
 #  include "ipp.h"
@@ -47,10 +47,10 @@ extern "C" {
  * Constants...
  */
 
-#  define CUPS_VERSION			2.0206
+#  define CUPS_VERSION			2.0213
 #  define CUPS_VERSION_MAJOR		2
 #  define CUPS_VERSION_MINOR		2
-#  define CUPS_VERSION_PATCH		6
+#  define CUPS_VERSION_PATCH		13
 
 #  define CUPS_BC_FD			3
 					/* Back-channel file descriptor for
@@ -606,6 +606,9 @@ extern ssize_t		cupsHashData(const char *algorithm, const void *data, size_t dat
 extern int		cupsAddIntegerOption(const char *name, int value, int num_options, cups_option_t **options) _CUPS_API_2_2_4;
 extern int		cupsGetIntegerOption(const char *name, int num_options, cups_option_t *options) _CUPS_API_2_2_4;
 
+/* New in CUPS 2.2.7 */
+extern const char	*cupsHashString(const unsigned char *hash, size_t hashsize, char *buffer, size_t bufsize) _CUPS_API_2_2_7;
+
 #  ifdef __cplusplus
 }
 #  endif /* __cplusplus */

cups/debug-private.h

@@ -1,7 +1,7 @@
 /*
  * Private debugging macros for CUPS.
  *
- * Copyright 2007-2012 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2005 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -67,20 +67,10 @@ extern "C" {
  */
 
 #  ifdef DEBUG
-#    ifdef WIN32
-#      ifdef LIBCUPS2_EXPORTS
-#        define DLLExport __declspec(dllexport)
-#      else
-#        define DLLExport
-#      endif /* LIBCUPS2_EXPORTS */
-#    else
-#      define DLLExport
-#    endif /* WIN32 */
 #    define DEBUG_puts(x) _cups_debug_puts(x)
 #    define DEBUG_printf(x) _cups_debug_printf x
 #    define DEBUG_set(logfile,level,filter) _cups_debug_set(logfile,level,filter,1)
 #  else
-#    define DLLExport
 #    define DEBUG_puts(x)
 #    define DEBUG_printf(x)
 #    define DEBUG_set(logfile,level,filter)
@@ -93,16 +83,13 @@ extern "C" {
 
 extern int	_cups_debug_fd;
 extern int	_cups_debug_level;
-extern void	DLLExport _cups_debug_printf(const char *format, ...)
-		__attribute__ ((__format__ (__printf__, 1, 2)));
-extern void	DLLExport _cups_debug_puts(const char *s);
-extern void	DLLExport _cups_debug_set(const char *logfile,
-					  const char *level, const char *filter,
-					  int force);
-#  ifdef WIN32
-extern int	_cups_gettimeofday(struct timeval *tv, void *tz);
+extern void	_cups_debug_printf(const char *format, ...) _CUPS_FORMAT(1, 2);
+extern void	_cups_debug_puts(const char *s);
+extern void	_cups_debug_set(const char *logfile, const char *level, const char *filter, int force) _CUPS_PRIVATE;
+#  ifdef _WIN32
+extern int	_cups_gettimeofday(struct timeval *tv, void *tz) _CUPS_PRIVATE;
 #    define gettimeofday(a,b) _cups_gettimeofday(a, b)
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
 #  ifdef __cplusplus
 }

cups/debug.c

@@ -18,7 +18,7 @@
 
 #include "cups-private.h"
 #include "thread-private.h"
-#ifdef WIN32
+#ifdef _WIN32
 #  include <sys/timeb.h>
 #  include <time.h>
 #  include <io.h>
@@ -36,7 +36,7 @@ _cups_gettimeofday(struct timeval *tv,	/* I  - Timeval struct */
 #else
 #  include <sys/time.h>
 #  include <unistd.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 #include <regex.h>
 #include <fcntl.h>
 
@@ -83,7 +83,7 @@ debug_thread_id(void)
  * '_cups_debug_printf()' - Write a formatted line to the log.
  */
 
-void DLLExport
+void
 _cups_debug_printf(const char *format,	/* I - Printf-style format string */
                    ...)			/* I - Additional arguments as needed */
 {
@@ -168,7 +168,7 @@ _cups_debug_printf(const char *format,	/* I - Printf-style format string */
  * '_cups_debug_puts()' - Write a single line to the log.
  */
 
-void DLLExport
+void
 _cups_debug_puts(const char *s)		/* I - String to output */
 {
   struct timeval	curtime;	/* Current time */
@@ -248,7 +248,7 @@ _cups_debug_puts(const char *s)		/* I - String to output */
  * '_cups_debug_set()' - Enable or disable debug logging.
  */
 
-void DLLExport
+void
 _cups_debug_set(const char *logfile,	/* I - Log file or NULL */
                 const char *level,	/* I - Log level or NULL */
 		const char *filter,	/* I - Filter string or NULL */

cups/dest-options.c

@@ -1,7 +1,7 @@
 /*
  * Destination option/media support for CUPS.
  *
- * Copyright 2012-2017 by Apple Inc.
+ * Copyright 2012-2019 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -83,6 +83,7 @@ cupsCheckDestSupported(
   ipp_res_t		units_value;	/* Resolution units */
   ipp_attribute_t	*attr;		/* Attribute */
   _ipp_value_t		*attrval;	/* Current attribute value */
+  _ipp_option_t		*map;		/* Option mapping information */
 
 
  /*
@@ -128,10 +129,10 @@ cupsCheckDestSupported(
     */
 
     pwg_media_t	*pwg;		/* Current PWG media size info */
-    int			min_width,	/* Minimum width */
-			min_length,	/* Minimum length */
-			max_width,	/* Maximum width */
-			max_length;	/* Maximum length */
+    int		min_width,	/* Minimum width */
+		min_length,	/* Minimum length */
+		max_width,	/* Maximum width */
+		max_length;	/* Maximum length */
 
    /*
     * Get the minimum and maximum size...
@@ -174,9 +175,14 @@ cupsCheckDestSupported(
     * Check literal values...
     */
 
+    map = _ippFindOption(option);
+
     switch (attr->value_tag)
     {
       case IPP_TAG_INTEGER :
+          if (map && map->value_tag == IPP_TAG_STRING)
+            return (strlen(value) <= (size_t)attr->values[0].integer);
+
       case IPP_TAG_ENUM :
           int_value = atoi(value);
 
@@ -189,7 +195,10 @@ cupsCheckDestSupported(
           return (attr->values[0].boolean);
 
       case IPP_TAG_RANGE :
-          int_value = atoi(value);
+          if (map && map->value_tag == IPP_TAG_STRING)
+            int_value = (int)strlen(value);
+          else
+            int_value = atoi(value);
 
           for (i = 0; i < attr->num_values; i ++)
             if (int_value >= attr->values[i].range.lower &&
@@ -572,6 +581,7 @@ cupsCopyDestInfo(
     cups_dest_t *dest)			/* I - Destination */
 {
   cups_dinfo_t	*dinfo;			/* Destination information */
+  unsigned	dflags;			/* Destination flags */
   ipp_t		*request,		/* Get-Printer-Attributes request */
 		*response;		/* Supported attributes */
   int		tries,			/* Number of tries so far */
@@ -581,6 +591,7 @@ cupsCopyDestInfo(
   char		resource[1024];		/* Resource path */
   int		version;		/* IPP version */
   ipp_status_t	status;			/* Status of request */
+  _cups_globals_t *cg = _cupsGlobals();	/* Pointer to library globals */
   static const char * const requested_attrs[] =
   {					/* Requested attributes */
     "job-template",
@@ -589,14 +600,35 @@ cupsCopyDestInfo(
   };
 
 
-  DEBUG_printf(("cupsCopyDestSupported(http=%p, dest=%p(%s))", (void *)http, (void *)dest, dest ? dest->name : ""));
+  DEBUG_printf(("cupsCopyDestInfo(http=%p, dest=%p(%s))", (void *)http, (void *)dest, dest ? dest->name : ""));
 
  /*
   * Get the default connection as needed...
   */
 
   if (!http)
-    http = _cupsConnect();
+  {
+    DEBUG_puts("1cupsCopyDestInfo: Default server connection.");
+    http   = _cupsConnect();
+    dflags = CUPS_DEST_FLAGS_NONE;
+  }
+#ifdef AF_LOCAL
+  else if (httpAddrFamily(http->hostaddr) == AF_LOCAL)
+  {
+    DEBUG_puts("1cupsCopyDestInfo: Connection to server (domain socket).");
+    dflags = CUPS_DEST_FLAGS_NONE;
+  }
+#endif /* AF_LOCAL */
+  else if ((strcmp(http->hostname, cg->server) && cg->server[0] != '/') || cg->ipp_port != httpAddrPort(http->hostaddr))
+  {
+    DEBUG_printf(("1cupsCopyDestInfo: Connection to device (%s).", http->hostname));
+    dflags = CUPS_DEST_FLAGS_DEVICE;
+  }
+  else
+  {
+    DEBUG_printf(("1cupsCopyDestInfo: Connection to server (%s).", http->hostname));
+    dflags = CUPS_DEST_FLAGS_NONE;
+  }
 
  /*
   * Range check input...
@@ -609,8 +641,11 @@ cupsCopyDestInfo(
   * Get the printer URI and resource path...
   */
 
-  if ((uri = _cupsGetDestResource(dest, resource, sizeof(resource))) == NULL)
+  if ((uri = _cupsGetDestResource(dest, dflags, resource, sizeof(resource))) == NULL)
+  {
+    DEBUG_puts("1cupsCopyDestInfo: Unable to get resource.");
     return (NULL);
+  }
 
  /*
   * Get the supported attributes...
@@ -628,28 +663,25 @@ cupsCopyDestInfo(
     */
 
     request = ippNewRequest(IPP_OP_GET_PRINTER_ATTRIBUTES);
-    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL,
-		 uri);
-    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME,
-                 "requesting-user-name", NULL, cupsUser());
-    ippAddStrings(request, IPP_TAG_OPERATION, IPP_TAG_KEYWORD,
-		  "requested-attributes",
-		  (int)(sizeof(requested_attrs) / sizeof(requested_attrs[0])),
-		  NULL, requested_attrs);
+
+    ippSetVersion(request, version / 10, version % 10);
+    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri);
+    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name", NULL, cupsUser());
+    ippAddStrings(request, IPP_TAG_OPERATION, IPP_TAG_KEYWORD, "requested-attributes", (int)(sizeof(requested_attrs) / sizeof(requested_attrs[0])), NULL, requested_attrs);
     response = cupsDoRequest(http, request, resource);
     status   = cupsLastError();
 
     if (status > IPP_STATUS_OK_IGNORED_OR_SUBSTITUTED)
     {
-      DEBUG_printf(("cupsCopyDestSupported: Get-Printer-Attributes for '%s' "
-		    "returned %s (%s)", dest->name, ippErrorString(status),
-		    cupsLastErrorString()));
+      DEBUG_printf(("1cupsCopyDestInfo: Get-Printer-Attributes for '%s' returned %s (%s)", dest->name, ippErrorString(status), cupsLastErrorString()));
 
       ippDelete(response);
       response = NULL;
 
-      if (status == IPP_STATUS_ERROR_VERSION_NOT_SUPPORTED && version > 11)
+      if ((status == IPP_STATUS_ERROR_BAD_REQUEST || status == IPP_STATUS_ERROR_VERSION_NOT_SUPPORTED) && version > 11)
+      {
         version = 11;
+      }
       else if (status == IPP_STATUS_ERROR_BUSY)
       {
         sleep((unsigned)delay);
@@ -665,7 +697,10 @@ cupsCopyDestInfo(
   while (!response && tries < 10);
 
   if (!response)
+  {
+    DEBUG_puts("1cupsCopyDestInfo: Unable to get printer attributes.");
     return (NULL);
+  }
 
  /*
   * Allocate a cups_dinfo_t structure and return it...
@@ -678,6 +713,8 @@ cupsCopyDestInfo(
     return (NULL);
   }
 
+  DEBUG_printf(("1cupsCopyDestInfo: version=%d, uri=\"%s\", resource=\"%s\".", version, uri, resource));
+
   dinfo->version  = version;
   dinfo->uri      = uri;
   dinfo->resource = _cupsStrAlloc(resource);
@@ -938,10 +975,10 @@ cupsGetDestMediaByIndex(
     return (0);
   }
 
-  if (nsize->size_name)
-    strlcpy(size->media, nsize->size_name, sizeof(size->media));
-  else if (nsize->key)
+  if (nsize->key)
     strlcpy(size->media, nsize->key, sizeof(size->media));
+  else if (nsize->size_name)
+    strlcpy(size->media, nsize->size_name, sizeof(size->media));
   else if ((pwg = pwgMediaForSize(nsize->width, nsize->length)) != NULL)
     strlcpy(size->media, pwg->pwg, sizeof(size->media));
   else
@@ -1202,25 +1239,19 @@ cupsGetDestMediaDefault(
   * Get the default media size, if any...
   */
 
-  if ((media = cupsGetOption("media", dest->num_options,
-                             dest->options)) == NULL)
+  if ((media = cupsGetOption("media", dest->num_options, dest->options)) == NULL)
     media = "na_letter_8.5x11in";
 
   if (cupsGetDestMediaByName(http, dest, dinfo, media, flags, size))
     return (1);
 
-  if (strcmp(media, "na_letter_8.5x11in") &&
-      cupsGetDestMediaByName(http, dest, dinfo, "iso_a4_210x297mm", flags,
-                             size))
+  if (strcmp(media, "na_letter_8.5x11in") && cupsGetDestMediaByName(http, dest, dinfo, "iso_a4_210x297mm", flags, size))
     return (1);
 
-  if (strcmp(media, "iso_a4_210x297mm") &&
-      cupsGetDestMediaByName(http, dest, dinfo, "na_letter_8.5x11in", flags,
-                             size))
+  if (strcmp(media, "iso_a4_210x297mm") && cupsGetDestMediaByName(http, dest, dinfo, "na_letter_8.5x11in", flags, size))
     return (1);
 
-  if ((flags & CUPS_MEDIA_FLAGS_BORDERLESS) &&
-      cupsGetDestMediaByName(http, dest, dinfo, "na_index_4x6in", flags, size))
+  if ((flags & CUPS_MEDIA_FLAGS_BORDERLESS) && cupsGetDestMediaByName(http, dest, dinfo, "na_index_4x6in", flags, size))
     return (1);
 
  /*
@@ -1513,6 +1544,7 @@ cups_create_media_db(
   pwg_media_t		*pwg;		/* PWG media info */
   cups_array_t		*db;		/* New media database array */
   _cups_media_db_t	mdb;		/* Media entry */
+  char			media_key[256];	/* Synthesized media-key value */
 
 
   db = cupsArrayNew3((cups_array_func_t)cups_compare_media_db,
@@ -1613,61 +1645,92 @@ cups_create_media_db(
 	}
       }
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-color",
-                                         IPP_TAG_ZERO)) != NULL &&
-          (media_attr->value_tag == IPP_TAG_NAME ||
-           media_attr->value_tag == IPP_TAG_NAMELANG ||
-           media_attr->value_tag == IPP_TAG_KEYWORD))
+      if ((media_attr = ippFindAttribute(val->collection, "media-color", IPP_TAG_ZERO)) != NULL && (media_attr->value_tag == IPP_TAG_NAME || media_attr->value_tag == IPP_TAG_NAMELANG || media_attr->value_tag == IPP_TAG_KEYWORD))
         mdb.color = media_attr->values[0].string.text;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-info",
-                                         IPP_TAG_TEXT)) != NULL)
+      if ((media_attr = ippFindAttribute(val->collection, "media-info", IPP_TAG_TEXT)) != NULL)
         mdb.info = media_attr->values[0].string.text;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-key",
-                                         IPP_TAG_ZERO)) != NULL &&
-          (media_attr->value_tag == IPP_TAG_NAME ||
-           media_attr->value_tag == IPP_TAG_NAMELANG ||
-           media_attr->value_tag == IPP_TAG_KEYWORD))
+      if ((media_attr = ippFindAttribute(val->collection, "media-key", IPP_TAG_ZERO)) != NULL && (media_attr->value_tag == IPP_TAG_NAME || media_attr->value_tag == IPP_TAG_NAMELANG || media_attr->value_tag == IPP_TAG_KEYWORD))
         mdb.key = media_attr->values[0].string.text;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-size-name",
-                                         IPP_TAG_ZERO)) != NULL &&
-          (media_attr->value_tag == IPP_TAG_NAME ||
-           media_attr->value_tag == IPP_TAG_NAMELANG ||
-           media_attr->value_tag == IPP_TAG_KEYWORD))
+      if ((media_attr = ippFindAttribute(val->collection, "media-size-name", IPP_TAG_ZERO)) != NULL && (media_attr->value_tag == IPP_TAG_NAME || media_attr->value_tag == IPP_TAG_NAMELANG || media_attr->value_tag == IPP_TAG_KEYWORD))
         mdb.size_name = media_attr->values[0].string.text;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-source",
-                                         IPP_TAG_ZERO)) != NULL &&
-          (media_attr->value_tag == IPP_TAG_NAME ||
-           media_attr->value_tag == IPP_TAG_NAMELANG ||
-           media_attr->value_tag == IPP_TAG_KEYWORD))
+      if ((media_attr = ippFindAttribute(val->collection, "media-source", IPP_TAG_ZERO)) != NULL && (media_attr->value_tag == IPP_TAG_NAME || media_attr->value_tag == IPP_TAG_NAMELANG || media_attr->value_tag == IPP_TAG_KEYWORD))
         mdb.source = media_attr->values[0].string.text;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-type",
-                                         IPP_TAG_ZERO)) != NULL &&
-          (media_attr->value_tag == IPP_TAG_NAME ||
-           media_attr->value_tag == IPP_TAG_NAMELANG ||
-           media_attr->value_tag == IPP_TAG_KEYWORD))
+      if ((media_attr = ippFindAttribute(val->collection, "media-type", IPP_TAG_ZERO)) != NULL && (media_attr->value_tag == IPP_TAG_NAME || media_attr->value_tag == IPP_TAG_NAMELANG || media_attr->value_tag == IPP_TAG_KEYWORD))
         mdb.type = media_attr->values[0].string.text;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-bottom-margin",
-                                         IPP_TAG_INTEGER)) != NULL)
+      if ((media_attr = ippFindAttribute(val->collection, "media-bottom-margin", IPP_TAG_INTEGER)) != NULL)
         mdb.bottom = media_attr->values[0].integer;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-left-margin",
-                                         IPP_TAG_INTEGER)) != NULL)
+      if ((media_attr = ippFindAttribute(val->collection, "media-left-margin", IPP_TAG_INTEGER)) != NULL)
         mdb.left = media_attr->values[0].integer;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-right-margin",
-                                         IPP_TAG_INTEGER)) != NULL)
+      if ((media_attr = ippFindAttribute(val->collection, "media-right-margin", IPP_TAG_INTEGER)) != NULL)
         mdb.right = media_attr->values[0].integer;
 
-      if ((media_attr = ippFindAttribute(val->collection, "media-top-margin",
-                                         IPP_TAG_INTEGER)) != NULL)
+      if ((media_attr = ippFindAttribute(val->collection, "media-top-margin", IPP_TAG_INTEGER)) != NULL)
         mdb.top = media_attr->values[0].integer;
 
+      if (!mdb.key)
+      {
+        if (!mdb.size_name && (pwg = pwgMediaForSize(mdb.width, mdb.length)) != NULL)
+	  mdb.size_name = (char *)pwg->pwg;
+
+        if (!mdb.size_name)
+        {
+         /*
+          * Use a CUPS-specific identifier if we don't have a size name...
+          */
+
+	  if (flags & CUPS_MEDIA_FLAGS_READY)
+	    snprintf(media_key, sizeof(media_key), "cups-media-ready-%d", i + 1);
+	  else
+	    snprintf(media_key, sizeof(media_key), "cups-media-%d", i + 1);
+        }
+        else if (mdb.source)
+        {
+         /*
+          * Generate key using size name, source, and type (if set)...
+          */
+
+          if (mdb.type)
+            snprintf(media_key, sizeof(media_key), "%s_%s_%s", mdb.size_name, mdb.source, mdb.type);
+	  else
+            snprintf(media_key, sizeof(media_key), "%s_%s", mdb.size_name, mdb.source);
+        }
+        else if (mdb.type)
+        {
+         /*
+          * Generate key using size name and type...
+          */
+
+	  snprintf(media_key, sizeof(media_key), "%s_%s", mdb.size_name, mdb.type);
+        }
+        else
+        {
+         /*
+          * Key is just the size name...
+          */
+
+          strlcpy(media_key, mdb.size_name, sizeof(media_key));
+        }
+
+       /*
+        * Append "_borderless" for borderless media...
+        */
+
+        if (!mdb.bottom && !mdb.left && !mdb.right && !mdb.top)
+          strlcat(media_key, "_borderless", sizeof(media_key));
+
+        mdb.key = media_key;
+      }
+
+      DEBUG_printf(("1cups_create_media_db: Adding media: key=\"%s\", width=%d, length=%d, source=\"%s\", type=\"%s\".", mdb.key, mdb.width, mdb.length, mdb.source, mdb.type));
+
       cupsArrayAdd(db, &mdb);
     }
 
@@ -2027,12 +2090,14 @@ cups_get_media_db(http_t       *http,	/* I - Connection to destination */
     * Return the matching size...
     */
 
-    if (best->size_name)
-      strlcpy(size->media, best->size_name, sizeof(size->media));
-    else if (best->key)
+    if (best->key)
       strlcpy(size->media, best->key, sizeof(size->media));
-    else
+    else if (best->size_name)
+      strlcpy(size->media, best->size_name, sizeof(size->media));
+    else if (pwg && pwg->pwg)
       strlcpy(size->media, pwg->pwg, sizeof(size->media));
+    else
+      strlcpy(size->media, "unknown", sizeof(size->media));
 
     size->width  = best->width;
     size->length = best->length;

cups/dir.c

@@ -26,7 +26,7 @@
  * Windows implementation...
  */
 
-#ifdef WIN32
+#ifdef _WIN32
 #  include <windows.h>
 
 /*
@@ -145,7 +145,7 @@ cupsDirOpen(const char *directory)	/* I - Directory name */
 cups_dentry_t *				/* O - Directory entry or @code NULL@ if there are no more */
 cupsDirRead(cups_dir_t *dp)		/* I - Directory pointer */
 {
-  WIN32_FIND_DATA	entry;		/* Directory entry data */
+  WIN32_FIND_DATAA	entry;		/* Directory entry data */
 
 
  /*
@@ -165,11 +165,11 @@ cupsDirRead(cups_dir_t *dp)		/* I - Directory pointer */
     * No, find the first file...
     */
 
-    dp->dir = FindFirstFile(dp->directory, &entry);
+    dp->dir = FindFirstFileA(dp->directory, &entry);
     if (dp->dir == INVALID_HANDLE_VALUE)
       return (NULL);
   }
-  else if (!FindNextFile(dp->dir, &entry))
+  else if (!FindNextFileA(dp->dir, &entry))
     return (NULL);
 
  /*
@@ -422,4 +422,4 @@ cupsDirRewind(cups_dir_t *dp)		/* I - Directory pointer */
 
   rewinddir(dp->dir);
 }
-#endif /* WIN32 */
+#endif /* _WIN32 */

cups/file-private.h

@@ -6,7 +6,7 @@
  * our own file functions allows us to provide transparent support of
  * different line endings, gzip'd print files, PPD files, etc.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -31,13 +31,10 @@
 #  include <stdarg.h>
 #  include <fcntl.h>
 
-#  ifdef HAVE_LIBZ
-#    include <zlib.h>
-#  endif /* HAVE_LIBZ */
-#  ifdef WIN32
+#  ifdef _WIN32
 #    include <io.h>
 #    include <sys/locking.h>
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
 
 /*
@@ -88,30 +85,6 @@ typedef enum				/**** _cupsFileCheck file type values ****/
 typedef void (*_cups_fc_func_t)(void *context, _cups_fc_result_t result,
 				const char *message);
 
-struct _cups_file_s			/**** CUPS file structure... ****/
-
-{
-  int		fd;			/* File descriptor */
-  char		mode,			/* Mode ('r' or 'w') */
-		compressed,		/* Compression used? */
-		is_stdio,		/* stdin/out/err? */
-		eof,			/* End of file? */
-		buf[4096],		/* Buffer */
-		*ptr,			/* Pointer into buffer */
-		*end;			/* End of buffer data */
-  off_t		pos,			/* Position in file */
-		bufpos;			/* File position for start of buffer */
-
-#ifdef HAVE_LIBZ
-  z_stream	stream;			/* (De)compression stream */
-  Bytef		cbuf[4096];		/* (De)compression buffer */
-  uLong		crc;			/* (De)compression CRC */
-#endif /* HAVE_LIBZ */
-
-  char		*printf_buffer;		/* cupsFilePrintf buffer */
-  size_t	printf_size;		/* Size of cupsFilePrintf buffer */
-};
-
 
 /*
  * Prototypes...
@@ -125,6 +98,7 @@ extern _cups_fc_result_t	_cupsFileCheck(const char *filename,
 extern void			_cupsFileCheckFilter(void *context,
 						     _cups_fc_result_t result,
 						     const char *message);
+extern int			_cupsFilePeekAhead(cups_file_t *fp, int ch);
 
 #  ifdef __cplusplus
 }

cups/file.c

@@ -6,7 +6,7 @@
  * our own file functions allows us to provide transparent support of
  * different line endings, gzip'd print files, PPD files, etc.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -26,6 +26,39 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
+#  ifdef HAVE_LIBZ
+#    include <zlib.h>
+#  endif /* HAVE_LIBZ */
+
+
+/*
+ * Internal structures...
+ */
+
+struct _cups_file_s			/**** CUPS file structure... ****/
+
+{
+  int		fd;			/* File descriptor */
+  char		mode,			/* Mode ('r' or 'w') */
+		compressed,		/* Compression used? */
+		is_stdio,		/* stdin/out/err? */
+		eof,			/* End of file? */
+		buf[4096],		/* Buffer */
+		*ptr,			/* Pointer into buffer */
+		*end;			/* End of buffer data */
+  off_t		pos,			/* Position in file */
+		bufpos;			/* File position for start of buffer */
+
+#ifdef HAVE_LIBZ
+  z_stream	stream;			/* (De)compression stream */
+  Bytef		cbuf[4096];		/* (De)compression buffer */
+  uLong		crc;			/* (De)compression CRC */
+#endif /* HAVE_LIBZ */
+
+  char		*printf_buffer;		/* cupsFilePrintf buffer */
+  size_t	printf_size;		/* Size of cupsFilePrintf buffer */
+};
+
 
 /*
  * Local functions...
@@ -40,7 +73,7 @@ static ssize_t	cups_read(cups_file_t *fp, char *buf, size_t bytes);
 static ssize_t	cups_write(cups_file_t *fp, const char *buf, size_t bytes);
 
 
-#ifndef WIN32
+#ifndef _WIN32
 /*
  * '_cupsFileCheck()' - Check the permissions of the given filename.
  */
@@ -306,7 +339,7 @@ _cupsFileCheckFilter(
 
   fprintf(stderr, "%s: %s\n", prefix, message);
 }
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
 
 /*
@@ -526,22 +559,22 @@ cupsFileFind(const char *filename,	/* I - File to find */
 
   while (*path)
   {
-#ifdef WIN32
+#ifdef _WIN32
     if (*path == ';' || (*path == ':' && ((bufptr - buffer) > 1 || !isalpha(buffer[0] & 255))))
 #else
     if (*path == ';' || *path == ':')
-#endif /* WIN32 */
+#endif /* _WIN32 */
     {
       if (bufptr > buffer && bufptr[-1] != '/' && bufptr < bufend)
         *bufptr++ = '/';
 
       strlcpy(bufptr, filename, (size_t)(bufend - bufptr));
 
-#ifdef WIN32
+#ifdef _WIN32
       if (!access(buffer, 0))
 #else
       if (!access(buffer, executable ? X_OK : 0))
-#endif /* WIN32 */
+#endif /* _WIN32 */
       {
         DEBUG_printf(("1cupsFileFind: Returning \"%s\"", buffer));
         return (buffer);
@@ -646,6 +679,12 @@ cupsFileGetChar(cups_file_t *fp)	/* I - CUPS file */
     return (-1);
   }
 
+  if (fp->eof)
+  {
+    DEBUG_puts("5cupsFileGetChar: End-of-file!");
+    return (-1);
+  }
+
  /*
   * If the input buffer is empty, try to read more data...
   */
@@ -992,11 +1031,11 @@ cupsFileLock(cups_file_t *fp,		/* I - CUPS file */
   * Try the lock...
   */
 
-#ifdef WIN32
+#ifdef _WIN32
   return (_locking(fp->fd, block ? _LK_LOCK : _LK_NBLCK, 0));
 #else
   return (lockf(fp->fd, block ? F_LOCK : F_TLOCK, 0));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -1084,11 +1123,11 @@ cupsFileOpen(const char *filename,	/* I - Name of file */
 	}
 
 	if (fd >= 0)
-#ifdef WIN32
+#ifdef _WIN32
 	  _chsize(fd, 0);
 #else
 	  ftruncate(fd, 0);
-#endif /* WIN32 */
+#endif /* _WIN32 */
         break;
 
     case 's' : /* Read/write socket */
@@ -1255,14 +1294,26 @@ cupsFileOpenFd(int        fd,		/* I - File descriptor */
   * Don't pass this file to child processes...
   */
 
-#ifndef WIN32
+#ifndef _WIN32
   fcntl(fp->fd, F_SETFD, fcntl(fp->fd, F_GETFD) | FD_CLOEXEC);
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
   return (fp);
 }
 
 
+/*
+ * '_cupsFilePeekAhead()' - See if the requested character is buffered up.
+ */
+
+int					/* O - 1 if present, 0 otherwise */
+_cupsFilePeekAhead(cups_file_t *fp,	/* I - CUPS file */
+                   int         ch)	/* I - Character */
+{
+  return (fp && fp->ptr && memchr(fp->ptr, ch, (size_t)(fp->end - fp->ptr)));
+}
+
+
 /*
  * 'cupsFilePeekChar()' - Peek at the next character from a file.
  *
@@ -1606,6 +1657,12 @@ cupsFileRead(cups_file_t *fp,		/* I - CUPS file */
   if (bytes == 0)
     return (0);
 
+  if (fp->eof)
+  {
+    DEBUG_puts("5cupsFileRead: End-of-file!");
+    return (-1);
+  }
+
  /*
   * Loop until all bytes are read...
   */
@@ -2019,11 +2076,11 @@ cupsFileUnlock(cups_file_t *fp)		/* I - CUPS file */
   * Unlock...
   */
 
-#ifdef WIN32
+#ifdef _WIN32
   return (_locking(fp->fd, _LK_UNLCK, 0));
 #else
   return (lockf(fp->fd, F_ULOCK, 0));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -2553,9 +2610,9 @@ cups_open(const char *filename,		/* I - Filename */
 {
   int		fd;			/* File descriptor */
   struct stat	fileinfo;		/* File information */
-#ifndef WIN32
+#ifndef _WIN32
   struct stat	linkinfo;		/* Link information */
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
 
  /*
@@ -2583,18 +2640,18 @@ cups_open(const char *filename,		/* I - Filename */
     return (-1);
   }
 
-#ifdef WIN32
+#ifdef _WIN32
   if (fileinfo.st_mode & _S_IFDIR)
 #else
   if (S_ISDIR(fileinfo.st_mode))
-#endif /* WIN32 */
+#endif /* _WIN32 */
   {
     close(fd);
     errno = EISDIR;
     return (-1);
   }
 
-#ifndef WIN32
+#ifndef _WIN32
  /*
   * Then use lstat to determine whether the filename is a symlink...
   */
@@ -2622,7 +2679,7 @@ cups_open(const char *filename,		/* I - Filename */
     errno = EPERM;
     return (-1);
   }
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
   return (fd);
 }
@@ -2648,7 +2705,7 @@ cups_read(cups_file_t *fp,		/* I - CUPS file */
 
   for (;;)
   {
-#ifdef WIN32
+#ifdef _WIN32
     if (fp->mode == 's')
       total = (ssize_t)recv(fp->fd, buf, (unsigned)bytes, 0);
     else
@@ -2658,7 +2715,7 @@ cups_read(cups_file_t *fp,		/* I - CUPS file */
       total = recv(fp->fd, buf, bytes, 0);
     else
       total = read(fp->fd, buf, bytes);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
     DEBUG_printf(("9cups_read: total=" CUPS_LLFMT, CUPS_LLCAST total));
 
@@ -2705,7 +2762,7 @@ cups_write(cups_file_t *fp,		/* I - CUPS file */
   total = 0;
   while (bytes > 0)
   {
-#ifdef WIN32
+#ifdef _WIN32
     if (fp->mode == 's')
       count = (ssize_t)send(fp->fd, buf, (unsigned)bytes, 0);
     else
@@ -2715,7 +2772,7 @@ cups_write(cups_file_t *fp,		/* I - CUPS file */
       count = send(fp->fd, buf, bytes, 0);
     else
       count = write(fp->fd, buf, bytes);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
     DEBUG_printf(("9cups_write: count=" CUPS_LLFMT, CUPS_LLCAST count));
 

cups/file.h

@@ -6,7 +6,7 @@
  * our own file functions allows us to provide transparent support of
  * different line endings, gzip'd print files, PPD files, etc.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -29,11 +29,11 @@
 #  include "versioning.h"
 #  include <stddef.h>
 #  include <sys/types.h>
-#  if defined(WIN32) && !defined(__CUPS_SSIZE_T_DEFINED)
+#  if defined(_WIN32) && !defined(__CUPS_SSIZE_T_DEFINED)
 #    define __CUPS_SSIZE_T_DEFINED
 /* Windows does not support the ssize_t type, so map it to off_t... */
 typedef off_t ssize_t;			/* @private@ */
-#  endif /* WIN32 && !__CUPS_SSIZE_T_DEFINED */
+#  endif /* _WIN32 && !__CUPS_SSIZE_T_DEFINED */
 
 
 /*
@@ -85,9 +85,7 @@ extern cups_file_t	*cupsFileOpen(const char *filename, const char *mode)
 			_CUPS_API_1_2;
 extern cups_file_t	*cupsFileOpenFd(int fd, const char *mode) _CUPS_API_1_2;
 extern int		cupsFilePeekChar(cups_file_t *fp) _CUPS_API_1_2;
-extern int		cupsFilePrintf(cups_file_t *fp, const char *format, ...)
-			__attribute__((__format__ (__printf__, 2, 3)))
-			_CUPS_API_1_2;
+extern int		cupsFilePrintf(cups_file_t *fp, const char *format, ...) _CUPS_FORMAT(2, 3) _CUPS_API_1_2;
 extern int		cupsFilePutChar(cups_file_t *fp, int c) _CUPS_API_1_2;
 extern ssize_t		cupsFilePutConf(cups_file_t *fp, const char *directive,
 			                const char *value) _CUPS_API_1_4;

cups/getputfile.c

@@ -1,7 +1,7 @@
 /*
  * Get/put file functions for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -20,11 +20,11 @@
 #include "cups-private.h"
 #include <fcntl.h>
 #include <sys/stat.h>
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 || __EMX__ */
+#endif /* _WIN32 || __EMX__ */
 
 
 /*
@@ -45,6 +45,8 @@ cupsGetFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
   http_status_t	status;			/* HTTP status from server */
   char		if_modified_since[HTTP_MAX_VALUE];
 					/* If-Modified-Since header */
+  int		new_auth = 0;		/* Using new auth information? */
+  int		digest;			/* Are we using Digest authentication? */
 
 
  /*
@@ -85,9 +87,33 @@ cupsGetFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
     }
 
     httpClearFields(http);
-    httpSetField(http, HTTP_FIELD_AUTHORIZATION, http->authstring);
     httpSetField(http, HTTP_FIELD_IF_MODIFIED_SINCE, if_modified_since);
 
+    digest = http->authstring && !strncmp(http->authstring, "Digest ", 7);
+
+    if (digest && !new_auth)
+    {
+     /*
+      * Update the Digest authentication string...
+      */
+
+      _httpSetDigestAuthString(http, http->nextnonce, "GET", resource);
+    }
+
+#ifdef HAVE_GSSAPI
+    if (http->authstring && !strncmp(http->authstring, "Negotiate", 9) && !new_auth)
+    {
+     /*
+      * Do not use cached Kerberos credentials since they will look like a
+      * "replay" attack...
+      */
+
+      _cupsSetNegotiateAuthString(http, "GET", resource);
+    }
+#endif /* HAVE_GSSAPI */
+
+    httpSetField(http, HTTP_FIELD_AUTHORIZATION, http->authstring);
+
     if (httpGet(http, resource))
     {
       if (httpReconnect2(http, 30000, NULL))
@@ -102,6 +128,8 @@ cupsGetFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
       }
     }
 
+    new_auth = 0;
+
     while ((status = httpUpdate(http)) == HTTP_STATUS_CONTINUE);
 
     if (status == HTTP_STATUS_UNAUTHORIZED)
@@ -116,6 +144,8 @@ cupsGetFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
       * See if we can do authentication...
       */
 
+      new_auth = 1;
+
       if (cupsDoAuthentication(http, "GET", resource))
       {
         status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
@@ -267,6 +297,8 @@ cupsPutFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
   int		retries;		/* Number of retries */
   char		buffer[8192];		/* Buffer for file */
   http_status_t	status;			/* HTTP status from server */
+  int		new_auth = 0;		/* Using new auth information? */
+  int		digest;			/* Are we using Digest authentication? */
 
 
  /*
@@ -309,10 +341,34 @@ cupsPutFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
                   http->authstring));
 
     httpClearFields(http);
-    httpSetField(http, HTTP_FIELD_AUTHORIZATION, http->authstring);
     httpSetField(http, HTTP_FIELD_TRANSFER_ENCODING, "chunked");
     httpSetExpect(http, HTTP_STATUS_CONTINUE);
 
+    digest = http->authstring && !strncmp(http->authstring, "Digest ", 7);
+
+    if (digest && !new_auth)
+    {
+     /*
+      * Update the Digest authentication string...
+      */
+
+      _httpSetDigestAuthString(http, http->nextnonce, "PUT", resource);
+    }
+
+#ifdef HAVE_GSSAPI
+    if (http->authstring && !strncmp(http->authstring, "Negotiate", 9) && !new_auth)
+    {
+     /*
+      * Do not use cached Kerberos credentials since they will look like a
+      * "replay" attack...
+      */
+
+      _cupsSetNegotiateAuthString(http, "PUT", resource);
+    }
+#endif /* HAVE_GSSAPI */
+
+    httpSetField(http, HTTP_FIELD_AUTHORIZATION, http->authstring);
+
     if (httpPut(http, resource))
     {
       if (httpReconnect2(http, 30000, NULL))
@@ -383,6 +439,8 @@ cupsPutFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
 
     DEBUG_printf(("2cupsPutFd: status=%d", status));
 
+    new_auth = 0;
+
     if (status == HTTP_STATUS_UNAUTHORIZED)
     {
      /*
@@ -395,6 +453,8 @@ cupsPutFd(http_t     *http,		/* I - Connection to server or @code CUPS_HTTP_DEFA
       * See if we can do authentication...
       */
 
+      new_auth = 1;
+
       if (cupsDoAuthentication(http, "PUT", resource))
       {
         status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;

cups/globals.c

@@ -34,23 +34,23 @@ static _cups_threadkey_t cups_globals_key = _CUPS_THREADKEY_INITIALIZER;
 static pthread_once_t	cups_globals_key_once = PTHREAD_ONCE_INIT;
 					/* One-time initialization object */
 #endif /* HAVE_PTHREAD_H */
-#if defined(HAVE_PTHREAD_H) || defined(WIN32)
+#if defined(HAVE_PTHREAD_H) || defined(_WIN32)
 static _cups_mutex_t	cups_global_mutex = _CUPS_MUTEX_INITIALIZER;
 					/* Global critical section */
-#endif /* HAVE_PTHREAD_H || WIN32 */
+#endif /* HAVE_PTHREAD_H || _WIN32 */
 
 
 /*
  * Local functions...
  */
 
-#ifdef WIN32
+#ifdef _WIN32
 static void		cups_fix_path(char *path);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 static _cups_globals_t	*cups_globals_alloc(void);
-#if defined(HAVE_PTHREAD_H) || defined(WIN32)
+#if defined(HAVE_PTHREAD_H) || defined(_WIN32)
 static void		cups_globals_free(_cups_globals_t *g);
-#endif /* HAVE_PTHREAD_H || WIN32 */
+#endif /* HAVE_PTHREAD_H || _WIN32 */
 #ifdef HAVE_PTHREAD_H
 static void		cups_globals_init(void);
 #endif /* HAVE_PTHREAD_H */
@@ -65,7 +65,7 @@ _cupsGlobalLock(void)
 {
 #ifdef HAVE_PTHREAD_H
   pthread_mutex_lock(&cups_global_mutex);
-#elif defined(WIN32)
+#elif defined(_WIN32)
   EnterCriticalSection(&cups_global_mutex.m_criticalSection);
 #endif /* HAVE_PTHREAD_H */
 }
@@ -120,13 +120,13 @@ _cupsGlobalUnlock(void)
 {
 #ifdef HAVE_PTHREAD_H
   pthread_mutex_unlock(&cups_global_mutex);
-#elif defined(WIN32)
+#elif defined(_WIN32)
   LeaveCriticalSection(&cups_global_mutex.m_criticalSection);
 #endif /* HAVE_PTHREAD_H */
 }
 
 
-#ifdef WIN32
+#ifdef _WIN32
 /*
  * 'DllMain()' - Main entry for library.
  */
@@ -170,7 +170,7 @@ DllMain(HINSTANCE hinst,		/* I - DLL module handle */
 
   return (TRUE);
 }
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -182,13 +182,13 @@ cups_globals_alloc(void)
 {
   _cups_globals_t *cg = malloc(sizeof(_cups_globals_t));
 					/* Pointer to global data */
-#ifdef WIN32
+#ifdef _WIN32
   HKEY		key;			/* Registry key */
   DWORD		size;			/* Size of string */
   static char	installdir[1024] = "",	/* Install directory */
 		confdir[1024] = "",	/* Server root directory */
 		localedir[1024] = "";	/* Locale directory */
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
   if (!cg)
@@ -219,7 +219,7 @@ cups_globals_alloc(void)
   * Then set directories as appropriate...
   */
 
-#ifdef WIN32
+#ifdef _WIN32
   if (!installdir[0])
   {
    /*
@@ -315,7 +315,7 @@ cups_globals_alloc(void)
     if ((cg->localedir = getenv("LOCALEDIR")) == NULL)
       cg->localedir = CUPS_LOCALEDIR;
   }
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
   return (cg);
 }
@@ -325,7 +325,7 @@ cups_globals_alloc(void)
  * 'cups_globals_free()' - Free global data.
  */
 
-#if defined(HAVE_PTHREAD_H) || defined(WIN32)
+#if defined(HAVE_PTHREAD_H) || defined(_WIN32)
 static void
 cups_globals_free(_cups_globals_t *cg)	/* I - Pointer to global data */
 {
@@ -360,7 +360,7 @@ cups_globals_free(_cups_globals_t *cg)	/* I - Pointer to global data */
 
   free(cg);
 }
-#endif /* HAVE_PTHREAD_H || WIN32 */
+#endif /* HAVE_PTHREAD_H || _WIN32 */
 
 
 #ifdef HAVE_PTHREAD_H

cups/hash.c

@@ -1,7 +1,7 @@
 /*
  * Hashing function for CUPS.
  *
- * Copyright 2015-2016 by Apple Inc.
+ * Copyright © 2015-2019 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -21,6 +21,8 @@
 #  include <CommonCrypto/CommonDigest.h>
 #elif defined(HAVE_GNUTLS)
 #  include <gnutls/crypto.h>
+#else
+#  include "md5-private.h"
 #endif /* __APPLE__ */
 
 
@@ -53,7 +55,24 @@ cupsHashData(const char    *algorithm,	/* I - Algorithm name */
   }
 
 #ifdef __APPLE__
-  if (!strcmp(algorithm, "sha"))
+  if (!strcmp(algorithm, "md5"))
+  {
+   /*
+    * MD5 (deprecated but widely used...)
+    */
+
+    CC_MD5_CTX	ctx;			/* MD5 context */
+
+    if (hashsize < CC_MD5_DIGEST_LENGTH)
+      goto too_small;
+
+    CC_MD5_Init(&ctx);
+    CC_MD5_Update(&ctx, data, (CC_LONG)datalen);
+    CC_MD5_Final(hash, &ctx);
+
+    return (CC_MD5_DIGEST_LENGTH);
+  }
+  else if (!strcmp(algorithm, "sha"))
   {
    /*
     * SHA-1...
@@ -171,7 +190,16 @@ cupsHashData(const char    *algorithm,	/* I - Algorithm name */
   unsigned char	temp[64];		/* Temporary hash buffer */
   size_t	tempsize = 0;		/* Truncate to this size? */
 
-  if (!strcmp(algorithm, "sha"))
+
+#  ifdef HAVE_GNUTLS_FIPS140_SET_MODE
+  unsigned oldmode = gnutls_fips140_mode_enabled();
+
+  gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD);
+#  endif /* HAVE_GNUTLS_FIPS140_SET_MODE */
+
+  if (!strcmp(algorithm, "md5"))
+    alg = GNUTLS_DIG_MD5;
+  else if (!strcmp(algorithm, "sha"))
     alg = GNUTLS_DIG_SHA1;
   else if (!strcmp(algorithm, "sha2-224"))
     alg = GNUTLS_DIG_SHA224;
@@ -206,6 +234,10 @@ cupsHashData(const char    *algorithm,	/* I - Algorithm name */
       gnutls_hash_fast(alg, data, datalen, temp);
       memcpy(hash, temp, tempsize);
 
+#  ifdef HAVE_GNUTLS_FIPS140_SET_MODE
+      gnutls_fips140_set_mode(oldmode, GNUTLS_FIPS140_SET_MODE_THREAD);
+#  endif /* HAVE_GNUTLS_FIPS140_SET_MODE */
+
       return ((ssize_t)tempsize);
     }
 
@@ -214,15 +246,33 @@ cupsHashData(const char    *algorithm,	/* I - Algorithm name */
 
     gnutls_hash_fast(alg, data, datalen, hash);
 
-    return (gnutls_hash_get_len(alg));
+#  ifdef HAVE_GNUTLS_FIPS140_SET_MODE
+    gnutls_fips140_set_mode(oldmode, GNUTLS_FIPS140_SET_MODE_THREAD);
+#  endif /* HAVE_GNUTLS_FIPS140_SET_MODE */
+
+    return ((ssize_t)gnutls_hash_get_len(alg));
   }
 
+#  ifdef HAVE_GNUTLS_FIPS140_SET_MODE
+  gnutls_fips140_set_mode(oldmode, GNUTLS_FIPS140_SET_MODE_THREAD);
+#  endif /* HAVE_GNUTLS_FIPS140_SET_MODE */
+
 #else
  /*
-  * No hash support without CommonCrypto or GNU TLS...
+  * No hash support beyond MD5 without CommonCrypto or GNU TLS...
   */
 
-  if (hashsize < 64)
+  if (!strcmp(algorithm, "md5"))
+  {
+    _cups_md5_state_t	state;		/* MD5 state info */
+
+    _cupsMD5Init(&state);
+    _cupsMD5Append(&state, data, datalen);
+    _cupsMD5Finish(&state, hash);
+
+    return (16);
+  }
+  else if (hashsize < 64)
     goto too_small;
 #endif /* __APPLE__ */
 
@@ -240,6 +290,60 @@ cupsHashData(const char    *algorithm,	/* I - Algorithm name */
 
   too_small:
 
+#ifdef HAVE_GNUTLS_FIPS140_SET_MODE
+  gnutls_fips140_set_mode(oldmode, GNUTLS_FIPS140_SET_MODE_THREAD);
+#endif /* HAVE_GNUTLS_FIPS140_SET_MODE */
+
   _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Hash buffer too small."), 1);
   return (-1);
 }
+
+
+/*
+ * 'cupsHashString()' - Format a hash value as a hexadecimal string.
+ *
+ * The passed buffer must be at least 2 * hashsize + 1 characters in length.
+ *
+ * @since CUPS 2.2.7@
+ */
+
+const char *				/* O - Formatted string */
+cupsHashString(
+    const unsigned char *hash,		/* I - Hash */
+    size_t              hashsize,	/* I - Size of hash */
+    char                *buffer,	/* I - String buffer */
+    size_t		bufsize)	/* I - Size of string buffer */
+{
+  char		*bufptr = buffer;	/* Pointer into buffer */
+  static const char *hex = "0123456789abcdef";
+					/* Hex characters (lowercase!) */
+
+
+ /*
+  * Range check input...
+  */
+
+  if (!hash || hashsize < 1 || !buffer || bufsize < (2 * hashsize + 1))
+  {
+    if (buffer)
+      *buffer = '\0';
+    return (NULL);
+  }
+
+ /*
+  * Loop until we've converted the whole hash...
+  */
+
+  while (hashsize > 0)
+  {
+    *bufptr++ = hex[*hash >> 4];
+    *bufptr++ = hex[*hash & 15];
+
+    hash ++;
+    hashsize --;
+  }
+
+  *bufptr = '\0';
+
+  return (buffer);
+}

cups/http-addr.c

@@ -69,11 +69,11 @@ int						/* O - 0 on success, -1 on failure */
 httpAddrClose(http_addr_t *addr,		/* I - Listen address or @code NULL@ */
               int         fd)			/* I - Socket file descriptor */
 {
-#ifdef WIN32
+#ifdef _WIN32
   if (closesocket(fd))
 #else
   if (close(fd))
-#endif /* WIN32 */
+#endif /* _WIN32 */
     return (-1);
 
 #ifdef AF_LOCAL
@@ -258,9 +258,9 @@ httpAddrListen(http_addr_t *addr,	/* I - Address to bind to */
   * Close on exec...
   */
 
-#ifndef WIN32
+#ifndef _WIN32
   fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
 #ifdef SO_NOSIGPIPE
  /*

cups/http-addrlist.c

@@ -1,7 +1,7 @@
 /*
  * HTTP address list routines for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -24,9 +24,9 @@
 #ifdef HAVE_POLL
 #  include <poll.h>
 #endif /* HAVE_POLL */
-#ifndef WIN32
+#ifndef _WIN32
 #  include <fcntl.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -61,14 +61,14 @@ httpAddrConnect2(
     int             *cancel)		/* I - Pointer to "cancel" variable */
 {
   int			val;		/* Socket option value */
-#ifndef WIN32
-  int			flags;		/* Socket flags */
-#endif /* !WIN32 */
-  int			remaining;	/* Remaining timeout */
+#ifndef _WIN32
   int			i, j,		/* Looping vars */
-			nfds,		/* Number of file descriptors */
-			fds[100],	/* Socket file descriptors */
+			flags,		/* Socket flags */
 			result;		/* Result from select() or poll() */
+#endif /* !_WIN32 */
+  int			remaining;	/* Remaining timeout */
+  int			nfds,		/* Number of file descriptors */
+			fds[100];	/* Socket file descriptors */
   http_addrlist_t	*addrs[100];	/* Addresses */
 #ifndef HAVE_POLL
   int			max_fd = -1;	/* Highest file descriptor */
@@ -84,8 +84,10 @@ httpAddrConnect2(
 #  endif /* HAVE_POLL */
 #endif /* O_NONBLOCK */
 #ifdef DEBUG
+#  ifndef _WIN32
   socklen_t		len;		/* Length of value */
   http_addr_t		peer;		/* Peer address */
+#  endif /* !_WIN32 */
   char			temp[256];	/* Temporary address string */
 #endif /* DEBUG */
 
@@ -213,11 +215,11 @@ httpAddrConnect2(
 	return (addrlist);
       }
 
-#ifdef WIN32
+#ifdef _WIN32
       if (WSAGetLastError() != WSAEINPROGRESS && WSAGetLastError() != WSAEWOULDBLOCK)
 #else
       if (errno != EINPROGRESS && errno != EWOULDBLOCK)
-#endif /* WIN32 */
+#endif /* _WIN32 */
       {
 	DEBUG_printf(("1httpAddrConnect2: Unable to connect to %s:%d: %s", httpAddrString(&(addrlist->addr), temp, sizeof(temp)), httpAddrPort(&(addrlist->addr)), strerror(errno)));
 	httpAddrClose(NULL, fds[nfds]);
@@ -225,9 +227,9 @@ httpAddrConnect2(
 	continue;
       }
 
-#ifndef WIN32
+#ifndef _WIN32
       fcntl(fds[nfds], F_SETFL, flags);
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
 #ifndef HAVE_POLL
       if (fds[nfds] > max_fd)
@@ -296,11 +298,11 @@ httpAddrConnect2(
       DEBUG_printf(("1httpAddrConnect2: select() returned %d (%d)", result, errno));
 #  endif /* HAVE_POLL */
     }
-#  ifdef WIN32
+#  ifdef _WIN32
     while (result < 0 && (WSAGetLastError() == WSAEINTR || WSAGetLastError() == WSAEWOULDBLOCK));
 #  else
     while (result < 0 && (errno == EINTR || errno == EAGAIN));
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
     if (result > 0)
     {
@@ -377,11 +379,11 @@ httpAddrConnect2(
     httpAddrClose(NULL, fds[nfds]);
   }
 
-#ifdef WIN32
+#ifdef _WIN32
   _cupsSetError(IPP_STATUS_ERROR_SERVICE_UNAVAILABLE, "Connection failed", 0);
 #else
   _cupsSetError(IPP_STATUS_ERROR_SERVICE_UNAVAILABLE, strerror(errno), 0);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
   return (NULL);
 }
@@ -618,6 +620,7 @@ httpAddrGetList(const char *hostname,	/* I - Hostname, IP address, or NULL for p
 	  if (!temp)
 	  {
 	    httpAddrFreeList(first);
+	    freeaddrinfo(results);
 	    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
 	    return (NULL);
 	  }
@@ -848,11 +851,11 @@ httpAddrGetList(const char *hostname,	/* I - Hostname, IP address, or NULL for p
 
         temp->addr.ipv6.sin6_family            = AF_INET6;
 	temp->addr.ipv6.sin6_port              = htons(portnum);
-#  ifdef WIN32
+#  ifdef _WIN32
 	temp->addr.ipv6.sin6_addr.u.Byte[15]   = 1;
 #  else
 	temp->addr.ipv6.sin6_addr.s6_addr32[3] = htonl(1);
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
         if (!first)
           first = temp;

cups/http-private.h

@@ -1,7 +1,7 @@
 /*
  * Private HTTP definitions for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -30,7 +30,7 @@
 #  endif /* __sun */
 
 #  include <limits.h>
-#  ifdef WIN32
+#  ifdef _WIN32
 #    include <io.h>
 #    include <winsock2.h>
 #    define CUPS_SOCAST (const char *)
@@ -39,7 +39,7 @@
 #    include <fcntl.h>
 #    include <sys/socket.h>
 #    define CUPS_SOCAST
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
 #  ifdef HAVE_GSSAPI
 #    ifdef HAVE_GSS_GSSAPI_H
@@ -68,7 +68,6 @@ typedef int socklen_t;
 #  endif /* __APPLE__ && !_SOCKLEN_T */
 
 #  include <cups/http.h>
-#  include "md5-private.h"
 #  include "ipp-private.h"
 
 #  ifdef HAVE_GNUTLS
@@ -141,7 +140,7 @@ extern SecIdentityRef SecIdentityCreate(CFAllocatorRef allocator, SecCertificate
 #    include <sspi.h>
 #  endif /* HAVE_GNUTLS */
 
-#  ifndef WIN32
+#  ifndef _WIN32
 #    include <net/if.h>
 #    include <resolv.h>
 #    ifdef HAVE_GETIFADDRS
@@ -152,11 +151,7 @@ extern SecIdentityRef SecIdentityCreate(CFAllocatorRef allocator, SecCertificate
 #        include <sys/sockio.h>
 #      endif /* HAVE_SYS_SOCKIO_H */
 #    endif /* HAVE_GETIFADDRS */
-#  endif /* !WIN32 */
-
-#  ifdef HAVE_LIBZ
-#    include <zlib.h>
-#  endif /* HAVE_LIBZ */
+#  endif /* !_WIN32 */
 
 
 /*
@@ -180,13 +175,17 @@ extern "C" {
 
 #  define _HTTP_TLS_NONE	0	/* No TLS options */
 #  define _HTTP_TLS_ALLOW_RC4	1	/* Allow RC4 cipher suites */
-#  define _HTTP_TLS_ALLOW_SSL3	2	/* Allow SSL 3.0 */
-#  define _HTTP_TLS_ALLOW_DH	4	/* Allow DH/DHE key negotiation */
-#  define _HTTP_TLS_DENY_TLS10	16	/* Deny TLS 1.0 */
-#  define _HTTP_TLS_DENY_CBC	32	/* Deny CBC cipher suites */
-#  define _HTTP_TLS_ONLY_TLS10  64      /* Only use TLS 1.0 */
+#  define _HTTP_TLS_ALLOW_DH	2	/* Allow DH/DHE key negotiation */
+#  define _HTTP_TLS_DENY_CBC	4	/* Deny CBC cipher suites */
 #  define _HTTP_TLS_SET_DEFAULT 128     /* Setting the default TLS options */
 
+#  define _HTTP_TLS_SSL3	0	/* Min/max version is SSL/3.0 */
+#  define _HTTP_TLS_1_0		1	/* Min/max version is TLS/1.0 */
+#  define _HTTP_TLS_1_1		2	/* Min/max version is TLS/1.1 */
+#  define _HTTP_TLS_1_2		3	/* Min/max version is TLS/1.2 */
+#  define _HTTP_TLS_1_3		4	/* Min/max version is TLS/1.3 */
+#  define _HTTP_TLS_MAX		5	/* Highest known TLS version */
+
 
 /*
  * Types and functions for SSL support...
@@ -297,10 +296,10 @@ struct _http_s				/**** HTTP connection structure ****/
   char			buffer[HTTP_MAX_BUFFER];
 					/* Buffer for incoming data */
   int			_auth_type;	/* Authentication in use (deprecated) */
-  _cups_md5_state_t	md5_state;	/* MD5 state */
+  unsigned char		_md5_state[88];	/* MD5 state (deprecated) */
   char			nonce[HTTP_MAX_VALUE];
 					/* Nonce value */
-  int			nonce_count;	/* Nonce count */
+  unsigned		nonce_count;	/* Nonce count */
   http_tls_t		tls;		/* TLS state information */
   http_encryption_t	encryption;	/* Encryption requirements */
 
@@ -361,9 +360,20 @@ struct _http_s				/**** HTTP connection structure ****/
 					/* Default field values */
 #  ifdef HAVE_LIBZ
   _http_coding_t	coding;		/* _HTTP_CODING_xxx */
-  z_stream		stream;		/* (De)compression stream */
-  Bytef			*sbuffer;	/* (De)compression buffer */
+  void			*stream;	/* (De)compression stream */
+  unsigned char		*sbuffer;	/* (De)compression buffer */
 #  endif /* HAVE_LIBZ */
+
+  /**** New in CUPS 2.2.9 ****/
+  char			*authentication_info,
+					/* Authentication-Info header */
+			algorithm[65],	/* Algorithm from WWW-Authenticate */
+			nextnonce[HTTP_MAX_VALUE],
+					/* Next nonce value from Authentication-Info */
+			opaque[HTTP_MAX_VALUE],
+					/* Opaque value from WWW-Authenticate */
+			realm[HTTP_MAX_VALUE];
+					/* Realm from WWW-Authenticate */
 };
 #  endif /* !_HTTP_NO_PRIVATE */
 
@@ -382,7 +392,7 @@ extern const char *_cups_hstrerror(int error);
  * Some OS's don't have getifaddrs() and freeifaddrs()...
  */
 
-#  if !defined(WIN32) && !defined(HAVE_GETIFADDRS)
+#  if !defined(_WIN32) && !defined(HAVE_GETIFADDRS)
 #    ifdef ifa_dstaddr
 #      undef ifa_dstaddr
 #    endif /* ifa_dstaddr */
@@ -417,7 +427,7 @@ extern int	_cups_getifaddrs(struct ifaddrs **addrs);
 #    define getifaddrs _cups_getifaddrs
 extern void	_cups_freeifaddrs(struct ifaddrs *addrs);
 #    define freeifaddrs _cups_freeifaddrs
-#  endif /* !WIN32 && !HAVE_GETIFADDRS */
+#  endif /* !_WIN32 && !HAVE_GETIFADDRS */
 
 
 /*
@@ -437,12 +447,13 @@ extern const char	*_httpResolveURI(const char *uri, char *resolved_uri,
 			                 size_t resolved_size, int options,
 					 int (*cb)(void *context),
 					 void *context);
+extern int		_httpSetDigestAuthString(http_t *http, const char *nonce, const char *method, const char *resource);
 extern const char	*_httpStatus(cups_lang_t *lang, http_status_t status);
 extern void		_httpTLSInitialize(void);
 extern size_t		_httpTLSPending(http_t *http);
 extern int		_httpTLSRead(http_t *http, char *buf, int len);
 extern int		_httpTLSSetCredentials(http_t *http);
-extern void		_httpTLSSetOptions(int options);
+extern void		_httpTLSSetOptions(int options, int min_version, int max_version);
 extern int		_httpTLSStart(http_t *http);
 extern void		_httpTLSStop(http_t *http);
 extern int		_httpTLSWrite(http_t *http, const char *buf, int len);

cups/http-support.c

@@ -1,7 +1,7 @@
 /*
  * HTTP support routines for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -20,13 +20,13 @@
 #include "cups-private.h"
 #ifdef HAVE_DNSSD
 #  include <dns_sd.h>
-#  ifdef WIN32
+#  ifdef _WIN32
 #    include <io.h>
 #  elif defined(HAVE_POLL)
 #    include <poll.h>
 #  else
 #    include <sys/select.h>
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 #elif defined(HAVE_AVAHI)
 #  include <avahi-client/client.h>
 #  include <avahi-client/lookup.h>
@@ -502,7 +502,6 @@ httpAssembleUUID(const char *server,	/* I - Server name */
 		 size_t     bufsize)	/* I - Size of buffer */
 {
   char			data[1024];	/* Source string for MD5 */
-  _cups_md5_state_t	md5state;	/* MD5 state */
   unsigned char		md5sum[16];	/* MD5 digest/sum */
 
 
@@ -517,9 +516,7 @@ httpAssembleUUID(const char *server,	/* I - Server name */
            port, name ? name : server, number,
 	   (unsigned)CUPS_RAND() & 0xffff, (unsigned)CUPS_RAND() & 0xffff);
 
-  _cupsMD5Init(&md5state);
-  _cupsMD5Append(&md5state, (unsigned char *)data, (int)strlen(data));
-  _cupsMD5Finish(&md5state, md5sum);
+  cupsHashData("md5", (unsigned char *)data, strlen(data), md5sum, sizeof(md5sum));
 
  /*
   * Generate the UUID from the MD5...
@@ -806,14 +803,12 @@ httpGetDateString2(time_t t,		/* I - Time in seconds */
                    char   *s,		/* I - String buffer */
 		   int    slen)		/* I - Size of string buffer */
 {
-  struct tm	*tdate;			/* UNIX date/time data */
+  struct tm	tdate;			/* UNIX date/time data */
 
 
-  tdate = gmtime(&t);
-  if (tdate)
-    snprintf(s, (size_t)slen, "%s, %02d %s %d %02d:%02d:%02d GMT", http_days[tdate->tm_wday], tdate->tm_mday, http_months[tdate->tm_mon], tdate->tm_year + 1900, tdate->tm_hour, tdate->tm_min, tdate->tm_sec);
-  else
-    s[0] = '\0';
+  gmtime_r(&t, &tdate);
+
+  snprintf(s, (size_t)slen, "%s, %02d %s %d %02d:%02d:%02d GMT", http_days[tdate.tm_wday], tdate.tm_mday, http_months[tdate.tm_mon], tdate.tm_year + 1900, tdate.tm_hour, tdate.tm_min, tdate.tm_sec);
 
   return (s);
 }
@@ -1035,7 +1030,7 @@ httpSeparateURI(
 
     *ptr = '\0';
 
-    if (*uri != ':')
+    if (*uri != ':' || *scheme == '.' || !*scheme)
     {
       *scheme = '\0';
       return (HTTP_URI_STATUS_BAD_SCHEME);
@@ -1305,6 +1300,152 @@ httpSeparateURI(
 }
 
 
+/*
+ * '_httpSetDigestAuthString()' - Calculate a Digest authentication response
+ *                                using the appropriate RFC 2068/2617/7616
+ *                                algorithm.
+ */
+
+int					/* O - 1 on success, 0 on failure */
+_httpSetDigestAuthString(
+    http_t     *http,			/* I - HTTP connection */
+    const char *nonce,			/* I - Nonce value */
+    const char *method,			/* I - HTTP method */
+    const char *resource)		/* I - HTTP resource path */
+{
+  char		kd[65],			/* Final MD5/SHA-256 digest */
+		ha1[65],		/* Hash of username:realm:password */
+		ha2[65],		/* Hash of method:request-uri */
+		username[HTTP_MAX_VALUE],
+					/* username:password */
+		*password,		/* Pointer to password */
+		temp[1024],		/* Temporary string */
+		digest[1024];		/* Digest auth data */
+  unsigned char	hash[32];		/* Hash buffer */
+  size_t	hashsize;		/* Size of hash */
+
+
+  DEBUG_printf(("2_httpSetDigestAuthString(http=%p, nonce=\"%s\", method=\"%s\", resource=\"%s\")", http, nonce, method, resource));
+
+  if (nonce && *nonce && strcmp(nonce, http->nonce))
+  {
+    strlcpy(http->nonce, nonce, sizeof(http->nonce));
+
+    if (nonce == http->nextnonce)
+      http->nextnonce[0] = '\0';
+
+    http->nonce_count = 1;
+  }
+  else
+    http->nonce_count ++;
+
+  strlcpy(username, http->userpass, sizeof(username));
+  if ((password = strchr(username, ':')) != NULL)
+    *password++ = '\0';
+  else
+    return (0);
+
+  if (http->algorithm[0])
+  {
+   /*
+    * Follow RFC 2617/7616...
+    */
+
+    int		i;			/* Looping var */
+    char	cnonce[65];		/* cnonce value */
+    const char	*hashalg;		/* Hashing algorithm */
+
+    for (i = 0; i < 64; i ++)
+      cnonce[i] = "0123456789ABCDEF"[CUPS_RAND() & 15];
+    cnonce[64] = '\0';
+
+    if (!_cups_strcasecmp(http->algorithm, "MD5"))
+    {
+     /*
+      * RFC 2617 Digest with MD5
+      */
+
+      hashalg = "md5";
+    }
+    else if (!_cups_strcasecmp(http->algorithm, "SHA-256"))
+    {
+     /*
+      * RFC 7616 Digest with SHA-256
+      */
+
+      hashalg = "sha2-256";
+    }
+    else
+    {
+     /*
+      * Some other algorithm we don't support, skip this one...
+      */
+
+      return (0);
+    }
+
+   /*
+    * Calculate digest value...
+    */
+
+    /* H(A1) = H(username:realm:password) */
+    snprintf(temp, sizeof(temp), "%s:%s:%s", username, http->realm, password);
+    hashsize = (size_t)cupsHashData(hashalg, (unsigned char *)temp, strlen(temp), hash, sizeof(hash));
+    cupsHashString(hash, hashsize, ha1, sizeof(ha1));
+
+    /* H(A2) = H(method:uri) */
+    snprintf(temp, sizeof(temp), "%s:%s", method, resource);
+    hashsize = (size_t)cupsHashData(hashalg, (unsigned char *)temp, strlen(temp), hash, sizeof(hash));
+    cupsHashString(hash, hashsize, ha2, sizeof(ha2));
+
+    /* KD = H(H(A1):nonce:nc:cnonce:qop:H(A2)) */
+    snprintf(temp, sizeof(temp), "%s:%s:%08x:%s:%s:%s", ha1, http->nonce, http->nonce_count, cnonce, "auth", ha2);
+    hashsize = (size_t)cupsHashData(hashalg, (unsigned char *)temp, strlen(temp), hash, sizeof(hash));
+    cupsHashString(hash, hashsize, kd, sizeof(kd));
+
+   /*
+    * Pass the RFC 2617/7616 WWW-Authenticate header...
+    */
+
+    if (http->opaque[0])
+      snprintf(digest, sizeof(digest), "username=\"%s\", realm=\"%s\", nonce=\"%s\", algorithm=%s, qop=auth, opaque=\"%s\", cnonce=\"%s\", nc=%08x, uri=\"%s\", response=\"%s\"", cupsUser(), http->realm, http->nonce, http->algorithm, http->opaque, cnonce, http->nonce_count, resource, kd);
+    else
+      snprintf(digest, sizeof(digest), "username=\"%s\", realm=\"%s\", nonce=\"%s\", algorithm=%s, qop=auth, cnonce=\"%s\", nc=%08x, uri=\"%s\", response=\"%s\"", username, http->realm, http->nonce, http->algorithm, cnonce, http->nonce_count, resource, kd);
+  }
+  else
+  {
+   /*
+    * Use old RFC 2069 Digest method...
+    */
+
+    /* H(A1) = H(username:realm:password) */
+    snprintf(temp, sizeof(temp), "%s:%s:%s", username, http->realm, password);
+    hashsize = (size_t)cupsHashData("md5", (unsigned char *)temp, strlen(temp), hash, sizeof(hash));
+    cupsHashString(hash, hashsize, ha1, sizeof(ha1));
+
+    /* H(A2) = H(method:uri) */
+    snprintf(temp, sizeof(temp), "%s:%s", method, resource);
+    hashsize = (size_t)cupsHashData("md5", (unsigned char *)temp, strlen(temp), hash, sizeof(hash));
+    cupsHashString(hash, hashsize, ha2, sizeof(ha2));
+
+    /* KD = H(H(A1):nonce:H(A2)) */
+    snprintf(temp, sizeof(temp), "%s:%s:%s", ha1, http->nonce, ha2);
+    hashsize = (size_t)cupsHashData("md5", (unsigned char *)temp, strlen(temp), hash, sizeof(hash));
+    cupsHashString(hash, hashsize, kd, sizeof(kd));
+
+   /*
+    * Pass the old RFC 2069 WWW-Authenticate header...
+    */
+
+    snprintf(digest, sizeof(digest), "username=\"%s\", realm=\"%s\", nonce=\"%s\", uri=\"%s\", response=\"%s\"", username, http->realm, http->nonce, resource, kd);
+  }
+
+  httpSetAuthString(http, "Digest", digest);
+
+  return (1);
+}
+
+
 /*
  * 'httpStateString()' - Return the string describing a HTTP state value.
  *
@@ -1360,6 +1501,9 @@ _httpStatus(cups_lang_t   *lang,	/* I - Language */
     case HTTP_STATUS_MOVED_PERMANENTLY :
         s = _("Moved Permanently");
 	break;
+    case HTTP_STATUS_FOUND :
+        s = _("Found");
+	break;
     case HTTP_STATUS_SEE_OTHER :
         s = _("See Other");
 	break;
@@ -1622,9 +1766,6 @@ _httpResolveURI(
     _http_uribuf_t	uribuf;		/* URI buffer */
     int			offline = 0;	/* offline-report state set? */
 #  ifdef HAVE_DNSSD
-#    ifdef WIN32
-#      pragma comment(lib, "dnssd.lib")
-#    endif /* WIN32 */
     DNSServiceRef	ref,		/* DNS-SD master service reference */
 			domainref = NULL,/* DNS-SD service reference for domain */
 			ippref = NULL,	/* DNS-SD service reference for network IPP */
@@ -1753,11 +1894,11 @@ _httpResolveURI(
 	  FD_ZERO(&input_set);
 	  FD_SET(DNSServiceRefSockFD(ref), &input_set);
 
-#      ifdef WIN32
+#      ifdef _WIN32
 	  stimeout.tv_sec  = (long)timeout;
 #      else
 	  stimeout.tv_sec  = timeout;
-#      endif /* WIN32 */
+#      endif /* _WIN32 */
 	  stimeout.tv_usec = 0;
 
 	  fds = select(DNSServiceRefSockFD(ref)+1, &input_set, NULL, NULL,

cups/http.c

@@ -1,7 +1,7 @@
 /*
  * HTTP routines for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * This file contains Kerberos support code, copyright 2006 by
@@ -23,22 +23,26 @@
 #include "cups-private.h"
 #include <fcntl.h>
 #include <math.h>
-#ifdef WIN32
+#ifdef _WIN32
 #  include <tchar.h>
 #else
 #  include <signal.h>
 #  include <sys/time.h>
 #  include <sys/resource.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 #ifdef HAVE_POLL
 #  include <poll.h>
 #endif /* HAVE_POLL */
+#  ifdef HAVE_LIBZ
+#    include <zlib.h>
+#  endif /* HAVE_LIBZ */
 
 
 /*
  * Local functions...
  */
 
+static void		http_add_field(http_t *http, http_field_t field, const char *value, int append);
 #ifdef HAVE_LIBZ
 static void		http_content_coding_finish(http_t *http);
 static void		http_content_coding_start(http_t *http,
@@ -105,7 +109,8 @@ static const char * const http_fields[] =
 			  "WWW-Authenticate",
 			  "Accept-Encoding",
 			  "Allow",
-			  "Server"
+			  "Server",
+			  "Authentication-Info"
 			};
 
 
@@ -325,6 +330,12 @@ httpClearFields(http_t *http)		/* I - HTTP connection */
       http->server = NULL;
     }
 
+    if (http->authentication_info)
+    {
+      _cupsStrFree(http->authentication_info);
+      http->authentication_info = NULL;
+    }
+
     http->expect = (http_status_t)0;
   }
 }
@@ -969,11 +980,14 @@ httpGetField(http_t       *http,	/* I - HTTP connection */
     case HTTP_FIELD_SERVER :
         return (http->server);
 
+    case HTTP_FIELD_AUTHENTICATION_INFO :
+        return (http->authentication_info);
+
     case HTTP_FIELD_AUTHORIZATION :
         if (http->field_authorization)
 	{
 	 /*
-	  * Special case for WWW-Authenticate: as its contents can be
+	  * Special case for Authorization: as its contents can be
 	  * longer than HTTP_MAX_VALUE...
 	  */
 
@@ -1183,11 +1197,11 @@ httpGets(char   *line,			/* I - Line to read into */
     * Pre-load the buffer as needed...
     */
 
-#ifdef WIN32
+#ifdef _WIN32
     WSASetLastError(0);
 #else
     errno = 0;
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
     while (http->used == 0)
     {
@@ -1201,11 +1215,11 @@ httpGets(char   *line,			/* I - Line to read into */
 	  continue;
 
         DEBUG_puts("3httpGets: Timed out!");
-#ifdef WIN32
+#ifdef _WIN32
         http->error = WSAETIMEDOUT;
 #else
         http->error = ETIMEDOUT;
-#endif /* WIN32 */
+#endif /* _WIN32 */
         return (NULL);
       }
 
@@ -1219,7 +1233,7 @@ httpGets(char   *line,			/* I - Line to read into */
 	* Nope, can't get a line this time...
 	*/
 
-#ifdef WIN32
+#ifdef _WIN32
         DEBUG_printf(("3httpGets: recv() error %d!", WSAGetLastError()));
 
         if (WSAGetLastError() == WSAEINTR)
@@ -1256,7 +1270,7 @@ httpGets(char   *line,			/* I - Line to read into */
 	  http->error = errno;
 	  continue;
 	}
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
         return (NULL);
       }
@@ -1523,9 +1537,9 @@ void
 httpInitialize(void)
 {
   static int	initialized = 0;	/* Have we been called before? */
-#ifdef WIN32
+#ifdef _WIN32
   WSADATA	winsockdata;		/* WinSock data */
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
   _cupsGlobalLock();
@@ -1535,7 +1549,7 @@ httpInitialize(void)
     return;
   }
 
-#ifdef WIN32
+#ifdef _WIN32
   WSAStartup(MAKEWORD(2,2), &winsockdata);
 
 #elif !defined(SO_NOSIGPIPE)
@@ -1557,7 +1571,7 @@ httpInitialize(void)
 #  else
   signal(SIGPIPE, SIG_IGN);
 #  endif /* !SO_NOSIGPIPE */
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 #  ifdef HAVE_SSL
   _httpTLSInitialize();
@@ -1713,7 +1727,7 @@ httpPeek(http_t *http,			/* I - HTTP connection */
 #ifdef HAVE_LIBZ
   if (http->used == 0 &&
       (http->coding == _HTTP_CODING_IDENTITY ||
-       (http->coding >= _HTTP_CODING_GUNZIP && http->stream.avail_in == 0)))
+       (http->coding >= _HTTP_CODING_GUNZIP && ((z_stream *)http->stream)->avail_in == 0)))
 #else
   if (http->used == 0)
 #endif /* HAVE_LIBZ */
@@ -1762,16 +1776,16 @@ httpPeek(http_t *http,			/* I - HTTP connection */
     int		zerr;			/* Decompressor error */
     z_stream	stream;			/* Copy of decompressor stream */
 
-    if (http->used > 0 && http->stream.avail_in < HTTP_MAX_BUFFER)
+    if (http->used > 0 && ((z_stream *)http->stream)->avail_in < HTTP_MAX_BUFFER)
     {
-      size_t buflen = buflen = HTTP_MAX_BUFFER - http->stream.avail_in;
+      size_t buflen = HTTP_MAX_BUFFER - ((z_stream *)http->stream)->avail_in;
 					/* Number of bytes to copy */
 
-      if (http->stream.avail_in > 0 &&
-	  http->stream.next_in > http->sbuffer)
-        memmove(http->sbuffer, http->stream.next_in, http->stream.avail_in);
+      if (((z_stream *)http->stream)->avail_in > 0 &&
+	  ((z_stream *)http->stream)->next_in > http->sbuffer)
+        memmove(http->sbuffer, ((z_stream *)http->stream)->next_in, ((z_stream *)http->stream)->avail_in);
 
-      http->stream.next_in = http->sbuffer;
+      ((z_stream *)http->stream)->next_in = http->sbuffer;
 
       if (buflen > (size_t)http->data_remaining)
         buflen = (size_t)http->data_remaining;
@@ -1782,8 +1796,8 @@ httpPeek(http_t *http,			/* I - HTTP connection */
       DEBUG_printf(("1httpPeek: Copying %d more bytes of data into "
 		    "decompression buffer.", (int)buflen));
 
-      memcpy(http->sbuffer + http->stream.avail_in, http->buffer, buflen);
-      http->stream.avail_in += buflen;
+      memcpy(http->sbuffer + ((z_stream *)http->stream)->avail_in, http->buffer, buflen);
+      ((z_stream *)http->stream)->avail_in += buflen;
       http->used            -= (int)buflen;
       http->data_remaining  -= (off_t)buflen;
 
@@ -1792,9 +1806,9 @@ httpPeek(http_t *http,			/* I - HTTP connection */
     }
 
     DEBUG_printf(("2httpPeek: length=%d, avail_in=%d", (int)length,
-                  (int)http->stream.avail_in));
+                  (int)((z_stream *)http->stream)->avail_in));
 
-    if (inflateCopy(&stream, &(http->stream)) != Z_OK)
+    if (inflateCopy(&stream, (z_stream *)http->stream) != Z_OK)
     {
       DEBUG_puts("2httpPeek: Unable to copy decompressor stream.");
       http->error = ENOMEM;
@@ -1811,14 +1825,14 @@ httpPeek(http_t *http,			/* I - HTTP connection */
     {
       DEBUG_printf(("2httpPeek: zerr=%d", zerr));
 #ifdef DEBUG
-      http_debug_hex("2httpPeek", (char *)http->sbuffer, (int)http->stream.avail_in);
+      http_debug_hex("2httpPeek", (char *)http->sbuffer, (int)((z_stream *)http->stream)->avail_in);
 #endif /* DEBUG */
 
       http->error = EIO;
       return (-1);
     }
 
-    bytes = (ssize_t)(length - http->stream.avail_out);
+    bytes = (ssize_t)(length - ((z_stream *)http->stream)->avail_out);
 
 #  else
     DEBUG_puts("2httpPeek: No inflateCopy on this platform, httpPeek does not "
@@ -1845,7 +1859,7 @@ httpPeek(http_t *http,			/* I - HTTP connection */
 
   if (bytes < 0)
   {
-#ifdef WIN32
+#ifdef _WIN32
     if (WSAGetLastError() == WSAEINTR || WSAGetLastError() == WSAEWOULDBLOCK)
       bytes = 0;
     else
@@ -1855,7 +1869,7 @@ httpPeek(http_t *http,			/* I - HTTP connection */
       bytes = 0;
     else
       http->error = errno;
-#endif /* WIN32 */
+#endif /* _WIN32 */
   }
   else if (bytes == 0)
   {
@@ -1891,7 +1905,7 @@ httpPrintf(http_t     *http,		/* I - HTTP connection */
 	   ...)				/* I - Additional args as needed */
 {
   ssize_t	bytes;			/* Number of bytes to write */
-  char		buf[16384];		/* Buffer for formatted string */
+  char		buf[65536];		/* Buffer for formatted string */
   va_list	ap;			/* Variable argument pointer */
 
 
@@ -1903,7 +1917,12 @@ httpPrintf(http_t     *http,		/* I - HTTP connection */
 
   DEBUG_printf(("3httpPrintf: (" CUPS_LLFMT " bytes) %s", CUPS_LLCAST bytes, buf));
 
-  if (http->data_encoding == HTTP_ENCODING_FIELDS)
+  if (bytes > (ssize_t)(sizeof(buf) - 1))
+  {
+    http->error = ENOMEM;
+    return (-1);
+  }
+  else if (http->data_encoding == HTTP_ENCODING_FIELDS)
     return ((int)httpWrite2(http, buf, (size_t)bytes));
   else
   {
@@ -1985,31 +2004,31 @@ httpRead2(http_t *http,			/* I - HTTP connection */
   {
     do
     {
-      if (http->stream.avail_in > 0)
+      if (((z_stream *)http->stream)->avail_in > 0)
       {
 	int	zerr;			/* Decompressor error */
 
 	DEBUG_printf(("2httpRead2: avail_in=%d, avail_out=%d",
-	              (int)http->stream.avail_in, (int)length));
+	              (int)((z_stream *)http->stream)->avail_in, (int)length));
 
-	http->stream.next_out  = (Bytef *)buffer;
-	http->stream.avail_out = (uInt)length;
+	((z_stream *)http->stream)->next_out  = (Bytef *)buffer;
+	((z_stream *)http->stream)->avail_out = (uInt)length;
 
-	if ((zerr = inflate(&(http->stream), Z_SYNC_FLUSH)) < Z_OK)
+	if ((zerr = inflate((z_stream *)http->stream, Z_SYNC_FLUSH)) < Z_OK)
 	{
 	  DEBUG_printf(("2httpRead2: zerr=%d", zerr));
 #ifdef DEBUG
-          http_debug_hex("2httpRead2", (char *)http->sbuffer, (int)http->stream.avail_in);
+          http_debug_hex("2httpRead2", (char *)http->sbuffer, (int)((z_stream *)http->stream)->avail_in);
 #endif /* DEBUG */
 
 	  http->error = EIO;
 	  return (-1);
 	}
 
-	bytes = (ssize_t)(length - http->stream.avail_out);
+	bytes = (ssize_t)(length - ((z_stream *)http->stream)->avail_out);
 
 	DEBUG_printf(("2httpRead2: avail_in=%d, avail_out=%d, bytes=%d",
-		      http->stream.avail_in, http->stream.avail_out,
+		      ((z_stream *)http->stream)->avail_in, ((z_stream *)http->stream)->avail_out,
 		      (int)bytes));
       }
       else
@@ -2017,16 +2036,16 @@ httpRead2(http_t *http,			/* I - HTTP connection */
 
       if (bytes == 0)
       {
-        ssize_t buflen = HTTP_MAX_BUFFER - (ssize_t)http->stream.avail_in;
+        ssize_t buflen = HTTP_MAX_BUFFER - (ssize_t)((z_stream *)http->stream)->avail_in;
 					/* Additional bytes for buffer */
 
         if (buflen > 0)
         {
-          if (http->stream.avail_in > 0 &&
-              http->stream.next_in > http->sbuffer)
-            memmove(http->sbuffer, http->stream.next_in, http->stream.avail_in);
+          if (((z_stream *)http->stream)->avail_in > 0 &&
+              ((z_stream *)http->stream)->next_in > http->sbuffer)
+            memmove(http->sbuffer, ((z_stream *)http->stream)->next_in, ((z_stream *)http->stream)->avail_in);
 
-	  http->stream.next_in = http->sbuffer;
+	  ((z_stream *)http->stream)->next_in = http->sbuffer;
 
           DEBUG_printf(("1httpRead2: Reading up to %d more bytes of data into "
                         "decompression buffer.", (int)buflen));
@@ -2036,10 +2055,10 @@ httpRead2(http_t *http,			/* I - HTTP connection */
 	    if (buflen > http->data_remaining)
 	      buflen = (ssize_t)http->data_remaining;
 
-	    bytes = http_read_buffered(http, (char *)http->sbuffer + http->stream.avail_in, (size_t)buflen);
+	    bytes = http_read_buffered(http, (char *)http->sbuffer + ((z_stream *)http->stream)->avail_in, (size_t)buflen);
           }
           else if (http->data_encoding == HTTP_ENCODING_CHUNKED)
-            bytes = http_read_chunk(http, (char *)http->sbuffer + http->stream.avail_in, (size_t)buflen);
+            bytes = http_read_chunk(http, (char *)http->sbuffer + ((z_stream *)http->stream)->avail_in, (size_t)buflen);
           else
             bytes = 0;
 
@@ -2052,7 +2071,7 @@ httpRead2(http_t *http,			/* I - HTTP connection */
                         "decompression buffer.", CUPS_LLCAST bytes));
 
           http->data_remaining  -= bytes;
-          http->stream.avail_in += (uInt)bytes;
+          ((z_stream *)http->stream)->avail_in += (uInt)bytes;
 
 	  if (http->data_remaining <= 0 &&
 	      http->data_encoding == HTTP_ENCODING_CHUNKED)
@@ -2131,7 +2150,7 @@ httpRead2(http_t *http,			/* I - HTTP connection */
   if (
 #ifdef HAVE_LIBZ
       (http->coding == _HTTP_CODING_IDENTITY ||
-       (http->coding >= _HTTP_CODING_GUNZIP && http->stream.avail_in == 0)) &&
+       (http->coding >= _HTTP_CODING_GUNZIP && ((z_stream *)http->stream)->avail_in == 0)) &&
 #endif /* HAVE_LIBZ */
       ((http->data_remaining <= 0 &&
         http->data_encoding == HTTP_ENCODING_LENGTH) ||
@@ -2416,11 +2435,11 @@ httpReconnect2(http_t *http,		/* I - HTTP connection */
     * Unable to connect...
     */
 
-#ifdef WIN32
+#ifdef _WIN32
     http->error  = WSAGetLastError();
 #else
     http->error  = errno;
-#endif /* WIN32 */
+#endif /* _WIN32 */
     http->status = HTTP_STATUS_ERROR;
 
     DEBUG_printf(("1httpReconnect2: httpAddrConnect failed: %s",
@@ -2659,105 +2678,7 @@ httpSetField(http_t       *http,	/* I - HTTP connection */
       value == NULL)
     return;
 
-  switch (field)
-  {
-    case HTTP_FIELD_ACCEPT_ENCODING :
-        if (http->accept_encoding)
-          _cupsStrFree(http->accept_encoding);
-
-        http->accept_encoding = _cupsStrAlloc(value);
-        break;
-
-    case HTTP_FIELD_ALLOW :
-        if (http->allow)
-          _cupsStrFree(http->allow);
-
-        http->allow = _cupsStrAlloc(value);
-        break;
-
-    case HTTP_FIELD_SERVER :
-        if (http->server)
-          _cupsStrFree(http->server);
-
-        http->server = _cupsStrAlloc(value);
-        break;
-
-    case HTTP_FIELD_WWW_AUTHENTICATE :
-       /* CUPS STR #4503 - don't override WWW-Authenticate for unknown auth schemes */
-        if (http->fields[HTTP_FIELD_WWW_AUTHENTICATE][0] &&
-	    _cups_strncasecmp(value, "Basic ", 6) &&
-	    _cups_strncasecmp(value, "Digest ", 7) &&
-	    _cups_strncasecmp(value, "Negotiate ", 10))
-	{
-	  DEBUG_printf(("1httpSetField: Ignoring unknown auth scheme in \"%s\".", value));
-          return;
-	}
-
-	/* Fall through to copy */
-
-    default :
-	strlcpy(http->fields[field], value, HTTP_MAX_VALUE);
-	break;
-  }
-
-  if (field == HTTP_FIELD_AUTHORIZATION)
-  {
-   /*
-    * Special case for Authorization: as its contents can be
-    * longer than HTTP_MAX_VALUE
-    */
-
-    if (http->field_authorization)
-      free(http->field_authorization);
-
-    http->field_authorization = strdup(value);
-  }
-  else if (field == HTTP_FIELD_HOST)
-  {
-   /*
-    * Special-case for Host: as we don't want a trailing "." on the hostname and
-    * need to bracket IPv6 numeric addresses.
-    */
-
-    char *ptr = strchr(value, ':');
-
-    if (value[0] != '[' && ptr && strchr(ptr + 1, ':'))
-    {
-     /*
-      * Bracket IPv6 numeric addresses...
-      *
-      * This is slightly inefficient (basically copying twice), but is an edge
-      * case and not worth optimizing...
-      */
-
-      snprintf(http->fields[HTTP_FIELD_HOST],
-               sizeof(http->fields[HTTP_FIELD_HOST]), "[%s]", value);
-    }
-    else
-    {
-     /*
-      * Check for a trailing dot on the hostname...
-      */
-
-      ptr = http->fields[HTTP_FIELD_HOST];
-
-      if (*ptr)
-      {
-	ptr += strlen(ptr) - 1;
-
-	if (*ptr == '.')
-	  *ptr = '\0';
-      }
-    }
-  }
-#ifdef HAVE_LIBZ
-  else if (field == HTTP_FIELD_CONTENT_ENCODING &&
-           http->data_encoding != HTTP_ENCODING_FIELDS)
-  {
-    DEBUG_puts("1httpSetField: Calling http_content_coding_start.");
-    http_content_coding_start(http, value);
-  }
-#endif /* HAVE_LIBZ */
+  http_add_field(http, field, value, 0);
 }
 
 
@@ -2855,11 +2776,11 @@ httpShutdown(http_t *http)		/* I - HTTP connection */
     _httpTLSStop(http);
 #endif /* HAVE_SSL */
 
-#ifdef WIN32
+#ifdef _WIN32
   shutdown(http->fd, SD_RECEIVE);	/* Microsoft-ism... */
 #else
   shutdown(http->fd, SHUT_RD);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -3035,7 +2956,12 @@ _httpUpdate(http_t        *http,	/* I - HTTP connection */
       httpSetCookie(http, value);
     }
     else if ((field = httpFieldValue(line)) != HTTP_FIELD_UNKNOWN)
-      httpSetField(http, field, value);
+    {
+      http_add_field(http, field, value, 1);
+
+      if (field == HTTP_FIELD_AUTHENTICATION_INFO)
+        httpGetSubField2(http, HTTP_FIELD_AUTHENTICATION_INFO, "nextnonce", http->nextnonce, (int)sizeof(http->nextnonce));
+    }
 #ifdef DEBUG
     else
       DEBUG_printf(("1_httpUpdate: unknown field %s seen!", line));
@@ -3188,12 +3114,12 @@ _httpWait(http_t *http,			/* I - HTTP connection */
 
     DEBUG_printf(("6_httpWait: select() returned %d...", nfds));
   }
-#  ifdef WIN32
+#  ifdef _WIN32
   while (nfds < 0 && (WSAGetLastError() == WSAEINTR ||
                       WSAGetLastError() == WSAEWOULDBLOCK));
 #  else
   while (nfds < 0 && (errno == EINTR || errno == EAGAIN));
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 #endif /* HAVE_POLL */
 
   DEBUG_printf(("5_httpWait: returning with nfds=%d, errno=%d...", nfds,
@@ -3229,7 +3155,7 @@ httpWait(http_t *http,			/* I - HTTP connection */
   }
 
 #ifdef HAVE_LIBZ
-  if (http->coding >= _HTTP_CODING_GUNZIP && http->stream.avail_in > 0)
+  if (http->coding >= _HTTP_CODING_GUNZIP && ((z_stream *)http->stream)->avail_in > 0)
   {
     DEBUG_puts("3httpWait: Returning 1 since there is buffered data ready.");
     return (1);
@@ -3325,17 +3251,17 @@ httpWrite2(http_t     *http,		/* I - HTTP connection */
       size_t	slen;			/* Bytes to write */
       ssize_t	sret;			/* Bytes written */
 
-      http->stream.next_in   = (Bytef *)buffer;
-      http->stream.avail_in  = (uInt)length;
+      ((z_stream *)http->stream)->next_in   = (Bytef *)buffer;
+      ((z_stream *)http->stream)->avail_in  = (uInt)length;
 
-      while (deflate(&(http->stream), Z_NO_FLUSH) == Z_OK)
+      while (deflate((z_stream *)http->stream, Z_NO_FLUSH) == Z_OK)
       {
-        DEBUG_printf(("1httpWrite2: avail_out=%d", http->stream.avail_out));
+        DEBUG_printf(("1httpWrite2: avail_out=%d", ((z_stream *)http->stream)->avail_out));
 
-        if (http->stream.avail_out > 0)
+        if (((z_stream *)http->stream)->avail_out > 0)
 	  continue;
 
-	slen = _HTTP_MAX_SBUFFER - http->stream.avail_out;
+	slen = _HTTP_MAX_SBUFFER - ((z_stream *)http->stream)->avail_out;
 
         DEBUG_printf(("1httpWrite2: Writing intermediate chunk, len=%d", (int)slen));
 
@@ -3352,8 +3278,8 @@ httpWrite2(http_t     *http,		/* I - HTTP connection */
 	  return (-1);
 	}
 
-	http->stream.next_out  = (Bytef *)http->sbuffer;
-	http->stream.avail_out = (uInt)_HTTP_MAX_SBUFFER;
+	((z_stream *)http->stream)->next_out  = (Bytef *)http->sbuffer;
+	((z_stream *)http->stream)->avail_out = (uInt)_HTTP_MAX_SBUFFER;
       }
 
       bytes = (ssize_t)length;
@@ -3689,6 +3615,125 @@ httpWriteResponse(http_t        *http,	/* I - HTTP connection */
 }
 
 
+/*
+ * 'http_add_field()' - Add a value for a HTTP field, appending if needed.
+ */
+
+static void
+http_add_field(http_t       *http,	/* I - HTTP connection */
+               http_field_t field,	/* I - HTTP field */
+               const char   *value,	/* I - Value string */
+               int          append)	/* I - Append value? */
+{
+  char		newvalue[1024];		/* New value string */
+  const char 	*oldvalue;		/* Old field value */
+
+
+
+ /*
+  * Optionally append the new value to the existing one...
+  */
+
+  if (append && field != HTTP_FIELD_ACCEPT_ENCODING && field != HTTP_FIELD_ACCEPT_LANGUAGE && field != HTTP_FIELD_ACCEPT_RANGES && field != HTTP_FIELD_ALLOW && field != HTTP_FIELD_LINK && field != HTTP_FIELD_TRANSFER_ENCODING && field != HTTP_FIELD_UPGRADE && field != HTTP_FIELD_WWW_AUTHENTICATE)
+    append = 0;
+
+  if (field == HTTP_FIELD_HOST)
+  {
+   /*
+    * Special-case for Host: as we don't want a trailing "." on the hostname and
+    * need to bracket IPv6 numeric addresses.
+    */
+
+    char *ptr = strchr(value, ':');
+
+    if (value[0] != '[' && ptr && strchr(ptr + 1, ':'))
+    {
+     /*
+      * Bracket IPv6 numeric addresses...
+      */
+
+      snprintf(newvalue, sizeof(newvalue), "[%s]", value);
+      value = newvalue;
+    }
+    else if (*value && value[strlen(value) - 1] == '.')
+    {
+     /*
+      * Strip the trailing dot on the hostname...
+      */
+
+      strlcpy(newvalue, value, sizeof(newvalue));
+      newvalue[strlen(newvalue) - 1] = '\0';
+      value = newvalue;
+    }
+  }
+  else if (append && *value && (oldvalue = httpGetField(http, field)) != NULL && *oldvalue)
+  {
+    snprintf(newvalue, sizeof(newvalue), "%s, %s", oldvalue, value);
+    value = newvalue;
+  }
+
+ /*
+  * Save the new value...
+  */
+
+  switch (field)
+  {
+    case HTTP_FIELD_ACCEPT_ENCODING :
+        if (http->accept_encoding)
+          _cupsStrFree(http->accept_encoding);
+
+        http->accept_encoding = _cupsStrAlloc(value);
+        break;
+
+    case HTTP_FIELD_ALLOW :
+        if (http->allow)
+          _cupsStrFree(http->allow);
+
+        http->allow = _cupsStrAlloc(value);
+        break;
+
+    case HTTP_FIELD_SERVER :
+        if (http->server)
+          _cupsStrFree(http->server);
+
+        http->server = _cupsStrAlloc(value);
+        break;
+
+    case HTTP_FIELD_AUTHENTICATION_INFO :
+        if (http->authentication_info)
+          _cupsStrFree(http->authentication_info);
+
+        http->authentication_info = _cupsStrAlloc(value);
+        break;
+
+    default :
+	strlcpy(http->fields[field], value, HTTP_MAX_VALUE);
+	break;
+  }
+
+  if (field == HTTP_FIELD_AUTHORIZATION)
+  {
+   /*
+    * Special case for Authorization: as its contents can be
+    * longer than HTTP_MAX_VALUE
+    */
+
+    if (http->field_authorization)
+      free(http->field_authorization);
+
+    http->field_authorization = strdup(value);
+  }
+#ifdef HAVE_LIBZ
+  else if (field == HTTP_FIELD_CONTENT_ENCODING &&
+           http->data_encoding != HTTP_ENCODING_FIELDS)
+  {
+    DEBUG_puts("1http_add_field: Calling http_content_coding_start.");
+    http_content_coding_start(http, value);
+  }
+#endif /* HAVE_LIBZ */
+}
+
+
 #ifdef HAVE_LIBZ
 /*
  * 'http_content_coding_finish()' - Finish doing any content encoding.
@@ -3710,13 +3755,13 @@ http_content_coding_finish(
   {
     case _HTTP_CODING_DEFLATE :
     case _HTTP_CODING_GZIP :
-        http->stream.next_in  = dummy;
-        http->stream.avail_in = 0;
+        ((z_stream *)http->stream)->next_in  = dummy;
+        ((z_stream *)http->stream)->avail_in = 0;
 
         do
         {
-          zerr  = deflate(&(http->stream), Z_FINISH);
-	  bytes = _HTTP_MAX_SBUFFER - http->stream.avail_out;
+          zerr  = deflate((z_stream *)http->stream, Z_FINISH);
+	  bytes = _HTTP_MAX_SBUFFER - ((z_stream *)http->stream)->avail_out;
 
           if (bytes > 0)
 	  {
@@ -3728,15 +3773,18 @@ http_content_coding_finish(
 	      http_write(http, (char *)http->sbuffer, bytes);
           }
 
-          http->stream.next_out  = (Bytef *)http->sbuffer;
-          http->stream.avail_out = (uInt)_HTTP_MAX_SBUFFER;
+          ((z_stream *)http->stream)->next_out  = (Bytef *)http->sbuffer;
+          ((z_stream *)http->stream)->avail_out = (uInt)_HTTP_MAX_SBUFFER;
 	}
         while (zerr == Z_OK);
 
-        deflateEnd(&(http->stream));
+        deflateEnd((z_stream *)http->stream);
 
         free(http->sbuffer);
+        free(http->stream);
+
         http->sbuffer = NULL;
+        http->stream  = NULL;
 
         if (http->wused)
           httpFlushWrite(http);
@@ -3744,9 +3792,13 @@ http_content_coding_finish(
 
     case _HTTP_CODING_INFLATE :
     case _HTTP_CODING_GUNZIP :
-        inflateEnd(&(http->stream));
+        inflateEnd((z_stream *)http->stream);
+
         free(http->sbuffer);
+        free(http->stream);
+
         http->sbuffer = NULL;
+        http->stream  = NULL;
         break;
 
     default :
@@ -3816,8 +3868,6 @@ http_content_coding_start(
     return;
   }
 
-  memset(&(http->stream), 0, sizeof(http->stream));
-
   switch (coding)
   {
     case _HTTP_CODING_DEFLATE :
@@ -3838,18 +3888,30 @@ http_content_coding_start(
         * documentation.
         */
 
-        if ((zerr = deflateInit2(&(http->stream), Z_DEFAULT_COMPRESSION,
-                                 Z_DEFLATED,
-				 coding == _HTTP_CODING_DEFLATE ? -11 : 27, 7,
-				 Z_DEFAULT_STRATEGY)) < Z_OK)
+	if ((http->stream = calloc(1, sizeof(z_stream))) == NULL)
+	{
+          free(http->sbuffer);
+
+          http->sbuffer = NULL;
+          http->status  = HTTP_STATUS_ERROR;
+          http->error   = errno;
+          return;
+	}
+
+        if ((zerr = deflateInit2((z_stream *)http->stream, Z_DEFAULT_COMPRESSION, Z_DEFLATED, coding == _HTTP_CODING_DEFLATE ? -11 : 27, 7, Z_DEFAULT_STRATEGY)) < Z_OK)
         {
-          http->status = HTTP_STATUS_ERROR;
-          http->error  = zerr == Z_MEM_ERROR ? ENOMEM : EINVAL;
+          free(http->sbuffer);
+          free(http->stream);
+
+          http->sbuffer = NULL;
+          http->stream  = NULL;
+          http->status  = HTTP_STATUS_ERROR;
+          http->error   = zerr == Z_MEM_ERROR ? ENOMEM : EINVAL;
           return;
         }
 
-	http->stream.next_out  = (Bytef *)http->sbuffer;
-	http->stream.avail_out = (uInt)_HTTP_MAX_SBUFFER;
+	((z_stream *)http->stream)->next_out  = (Bytef *)http->sbuffer;
+	((z_stream *)http->stream)->avail_out = (uInt)_HTTP_MAX_SBUFFER;
         break;
 
     case _HTTP_CODING_INFLATE :
@@ -3866,19 +3928,30 @@ http_content_coding_start(
         * -15 is raw inflate, 31 is gunzip, per ZLIB documentation.
         */
 
-        if ((zerr = inflateInit2(&(http->stream),
-                                 coding == _HTTP_CODING_INFLATE ? -15 : 31))
-		< Z_OK)
+	if ((http->stream = calloc(1, sizeof(z_stream))) == NULL)
+	{
+          free(http->sbuffer);
+
+          http->sbuffer = NULL;
+          http->status  = HTTP_STATUS_ERROR;
+          http->error   = errno;
+          return;
+	}
+
+        if ((zerr = inflateInit2((z_stream *)http->stream, coding == _HTTP_CODING_INFLATE ? -15 : 31)) < Z_OK)
         {
           free(http->sbuffer);
+          free(http->stream);
+
           http->sbuffer = NULL;
+          http->stream  = NULL;
           http->status  = HTTP_STATUS_ERROR;
           http->error   = zerr == Z_MEM_ERROR ? ENOMEM : EINVAL;
           return;
         }
 
-        http->stream.avail_in = 0;
-        http->stream.next_in  = http->sbuffer;
+        ((z_stream *)http->stream)->avail_in = 0;
+        ((z_stream *)http->stream)->next_in  = http->sbuffer;
         break;
 
     default :
@@ -3944,7 +4017,7 @@ http_create(
   if ((http = calloc(sizeof(http_t), 1)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
-    httpAddrFreeList(addrlist);
+    httpAddrFreeList(myaddrlist);
     return (NULL);
   }
 
@@ -4056,7 +4129,7 @@ http_read(http_t *http,			/* I - HTTP connection */
 
   DEBUG_printf(("http_read(http=%p, buffer=%p, length=" CUPS_LLFMT ")", (void *)http, (void *)buffer, CUPS_LLCAST length));
 
-  if (!http->blocking)
+  if (!http->blocking || http->timeout_value > 0.0)
   {
     while (!httpWait(http, http->wait_value))
     {
@@ -4081,7 +4154,7 @@ http_read(http_t *http,			/* I - HTTP connection */
 
     if (bytes < 0)
     {
-#ifdef WIN32
+#ifdef _WIN32
       if (WSAGetLastError() != WSAEINTR)
       {
 	http->error = WSAGetLastError();
@@ -4117,7 +4190,7 @@ http_read(http_t *http,			/* I - HTTP connection */
 	http->error = errno;
 	return (-1);
       }
-#endif /* WIN32 */
+#endif /* _WIN32 */
     }
   }
   while (bytes < 0);
@@ -4131,7 +4204,7 @@ http_read(http_t *http,			/* I - HTTP connection */
 
   if (bytes < 0)
   {
-#ifdef WIN32
+#ifdef _WIN32
     if (WSAGetLastError() == WSAEINTR)
       bytes = 0;
     else
@@ -4141,7 +4214,7 @@ http_read(http_t *http,			/* I - HTTP connection */
       bytes = 0;
     else
       http->error = errno;
-#endif /* WIN32 */
+#endif /* _WIN32 */
   }
   else if (bytes == 0)
   {
@@ -4505,7 +4578,7 @@ static void
 http_set_timeout(int    fd,		/* I - File descriptor */
                  double timeout)	/* I - Timeout in seconds */
 {
-#ifdef WIN32
+#ifdef _WIN32
   DWORD tv = (DWORD)(timeout * 1000);
 				      /* Timeout in milliseconds */
 
@@ -4520,7 +4593,7 @@ http_set_timeout(int    fd,		/* I - File descriptor */
 
   setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, CUPS_SOCAST &tv, sizeof(tv));
   setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, CUPS_SOCAST &tv, sizeof(tv));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -4651,7 +4724,7 @@ http_write(http_t     *http,		/* I - HTTP connection */
   {
     DEBUG_printf(("3http_write: About to write %d bytes.", (int)length));
 
-    if (http->timeout_cb)
+    if (http->timeout_value > 0.0)
     {
 #ifdef HAVE_POLL
       struct pollfd	pfd;		/* Polled file descriptor */
@@ -4682,12 +4755,12 @@ http_write(http_t     *http,		/* I - HTTP connection */
 
 	  nfds = select(http->fd + 1, NULL, &output_set, NULL, &timeout);
 	}
-#  ifdef WIN32
+#  ifdef _WIN32
 	while (nfds < 0 && (WSAGetLastError() == WSAEINTR ||
 			    WSAGetLastError() == WSAEWOULDBLOCK));
 #  else
 	while (nfds < 0 && (errno == EINTR || errno == EAGAIN));
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 #endif /* HAVE_POLL */
 
         if (nfds < 0)
@@ -4695,13 +4768,13 @@ http_write(http_t     *http,		/* I - HTTP connection */
 	  http->error = errno;
 	  return (-1);
 	}
-	else if (nfds == 0 && !(*http->timeout_cb)(http, http->timeout_data))
+	else if (nfds == 0 && (!http->timeout_cb || !(*http->timeout_cb)(http, http->timeout_data)))
 	{
-#ifdef WIN32
+#ifdef _WIN32
 	  http->error = WSAEWOULDBLOCK;
 #else
 	  http->error = EWOULDBLOCK;
-#endif /* WIN32 */
+#endif /* _WIN32 */
 	  return (-1);
 	}
       }
@@ -4720,7 +4793,7 @@ http_write(http_t     *http,		/* I - HTTP connection */
 
     if (bytes < 0)
     {
-#ifdef WIN32
+#ifdef _WIN32
       if (WSAGetLastError() == WSAEINTR)
         continue;
       else if (WSAGetLastError() == WSAEWOULDBLOCK)
@@ -4754,7 +4827,7 @@ http_write(http_t     *http,		/* I - HTTP connection */
         http->error = errno;
 	continue;
       }
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
       DEBUG_printf(("3http_write: error writing data (%s).",
                     strerror(http->error)));

cups/http.h

@@ -1,7 +1,7 @@
 /*
  * Hyper-Text Transport Protocol definitions for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -25,7 +25,7 @@
 #  include <string.h>
 #  include <time.h>
 #  include <sys/types.h>
-#  ifdef WIN32
+#  ifdef _WIN32
 #    ifndef __CUPS_SSIZE_T_DEFINED
 #      define __CUPS_SSIZE_T_DEFINED
 /* Windows does not support the ssize_t type, so map it to off_t... */
@@ -54,7 +54,7 @@ typedef off_t ssize_t;			/* @private@ */
 #    if defined(LOCAL_PEERCRED) && !defined(SO_PEERCRED)
 #      define SO_PEERCRED LOCAL_PEERCRED
 #    endif /* LOCAL_PEERCRED && !SO_PEERCRED */
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
 
 /*
@@ -85,7 +85,7 @@ extern "C" {
 #    define s6_addr32	_S6_un._S6_u32
 #  elif defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__APPLE__)|| defined(__DragonFly__)
 #    define s6_addr32	__u6_addr.__u6_addr32
-#  elif defined(WIN32)
+#  elif defined(_WIN32)
 /*
  * Windows only defines byte and 16-bit word members of the union and
  * requires special casing of all raw address code...
@@ -181,6 +181,7 @@ typedef enum http_field_e		/**** HTTP field names ****/
   HTTP_FIELD_ACCEPT_ENCODING,		/* Accepting-Encoding field @since CUPS 1.7/macOS 10.9@ */
   HTTP_FIELD_ALLOW,			/* Allow field @since CUPS 1.7/macOS 10.9@ */
   HTTP_FIELD_SERVER,			/* Server field @since CUPS 1.7/macOS 10.9@ */
+  HTTP_FIELD_AUTHENTICATION_INFO,	/* Authentication-Info field (@since CUPS 2.2.9) */
   HTTP_FIELD_MAX			/* Maximum field index */
 } http_field_t;
 
@@ -248,10 +249,11 @@ typedef enum http_status_e		/**** HTTP status codes ****/
 
   HTTP_STATUS_MULTIPLE_CHOICES = 300,	/* Multiple files match request */
   HTTP_STATUS_MOVED_PERMANENTLY,	/* Document has moved permanently */
-  HTTP_STATUS_MOVED_TEMPORARILY,	/* Document has moved temporarily */
-  HTTP_STATUS_SEE_OTHER,		/* See this other link... */
+  HTTP_STATUS_FOUND,			/* Document was found at a different URI */
+  HTTP_STATUS_SEE_OTHER,		/* See this other link */
   HTTP_STATUS_NOT_MODIFIED,		/* File not modified */
   HTTP_STATUS_USE_PROXY,		/* Must use a proxy to access this URI */
+  HTTP_STATUS_TEMPORARY_REDIRECT = 307,	/* Temporary redirection */
 
   HTTP_STATUS_BAD_REQUEST = 400,	/* Bad request */
   HTTP_STATUS_UNAUTHORIZED,		/* Unauthorized to access host */
@@ -285,6 +287,8 @@ typedef enum http_status_e		/**** HTTP status codes ****/
   HTTP_STATUS_CUPS_PKI_ERROR,		/* Error negotiating a secure connection @since CUPS 1.5/macOS 10.7@ */
   HTTP_STATUS_CUPS_WEBIF_DISABLED	/* Web interface is disabled @private@ */
 
+#  define HTTP_STATUS_MOVED_TEMPORARILY HTTP_STATUS_FOUND /* Renamed in RFC 7231 */
+
 #  ifndef _CUPS_NO_DEPRECATED
 /* Old names for this enumeration */
 #    define HTTP_ERROR			HTTP_STATUS_ERROR
@@ -476,8 +480,7 @@ extern int		httpHead(http_t *http, const char *uri);
 extern void		httpInitialize(void);
 extern int		httpOptions(http_t *http, const char *uri);
 extern int		httpPost(http_t *http, const char *uri);
-extern int		httpPrintf(http_t *http, const char *format, ...)
-			__attribute__ ((__format__ (__printf__, 2, 3)));
+extern int		httpPrintf(http_t *http, const char *format, ...) _CUPS_FORMAT(2, 3);
 extern int		httpPut(http_t *http, const char *uri);
 extern int		httpRead(http_t *http, char *buffer, int length) _CUPS_DEPRECATED_MSG("Use httpRead2 instead.");
 extern int		httpReconnect(http_t *http) _CUPS_DEPRECATED_1_6_MSG("Use httpReconnect2 instead.");

cups/ipp-support.c

@@ -1,8 +1,8 @@
 /*
  * Internet Printing Protocol support functions for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -433,7 +433,7 @@ static const char * const ipp_document_states[] =
 		  "punch-multiple-top",	/* Finishings 2.1/Canon */
 		  "punch-multiple-right",/* Finishings 2.1/Canon */
 		  "punch-multiple-bottom",/* Finishings 2.1/Canon */
-		  "fold-accordian",	/* Finishings 2.0 */
+		  "fold-accordion",	/* Finishings 2.0 */
 		  "fold-double-gate",	/* Finishings 2.0 */
 		  "fold-gate",		/* Finishings 2.0 */
 		  "fold-half",		/* Finishings 2.0 */
@@ -544,7 +544,7 @@ static const char * const ipp_document_states[] =
 		  "0x40000057",
 		  "0x40000058",
 		  "0x40000059",
-		  "cups-fold-accordian",
+		  "cups-fold-accordion",
 		  "cups-fold-double-gate",
 		  "cups-fold-gate",
 		  "cups-fold-half",
@@ -960,9 +960,12 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "feed-orientation-supported",
     "finishings",
     "finishings-col",
+    "finishings-col-database",
     "finishings-col-default",
+    "finishings-col-ready",
     "finishings-col-supported",
     "finishings-default",
+    "finishings-ready",
     "finishings-supported",
     "font-name-requested",
     "font-name-requested-default",
@@ -1001,6 +1004,7 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "media-bottom-margin-supported",
     "media-col",
     "media-col-default",
+    "media-col-ready",
     "media-col-supported",
     "media-color-supported",
     "media-default",
@@ -1015,6 +1019,7 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "media-left-margin-supported",
     "media-order-count-supported",
     "media-pre-printed-supported",
+    "media-ready",
     "media-recycled-supported",
     "media-right-margin-supported",
     "media-size-supported",
@@ -1277,9 +1282,12 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "feed-orientation-supported",
     "finishings",
     "finishings-col",
+    "finishings-col-database",
     "finishings-col-default",
+    "finishings-col-ready",
     "finishings-col-supported",
     "finishings-default",
+    "finishings-ready",
     "finishings-supported",
     "font-name-requested",
     "font-name-requested-default",
@@ -1383,6 +1391,7 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "media-bottom-margin-supported",
     "media-col",
     "media-col-default",
+    "media-col-ready",
     "media-col-supported",
     "media-color-supported",
     "media-default",
@@ -1397,6 +1406,7 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "media-left-margin-supported",
     "media-order-count-supported",
     "media-pre-printed-supported",
+    "media-ready",
     "media-recycled-supported",
     "media-right-margin-supported",
     "media-size-supported",
@@ -1582,10 +1592,12 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "job-page-limit",			/* CUPS extension */
     "job-password-encryption-supported",
     "job-password-supported",
+    "job-presets-supported",		/* IPP Presets */
     "job-quota-period",			/* CUPS extension */
     "job-resolvers-supported",
     "job-settable-attributes-supported",
     "job-spooling-supported",
+    "job-triggers-supported",		/* IPP Presets */
     "jpeg-k-octets-supported",		/* CUPS extension */
     "jpeg-x-dimension-supported",	/* CUPS extension */
     "jpeg-y-dimension-supported",	/* CUPS extension */
@@ -1599,8 +1611,6 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "marker-message",			/* CUPS extension */
     "marker-names",			/* CUPS extension */
     "marker-types",			/* CUPS extension */
-    "media-col-ready",
-    "media-ready",
     "member-names",			/* CUPS extension */
     "member-uris",			/* CUPS extension */
     "multiple-destination-uris-supported",/* IPP FaxOut */
@@ -1623,6 +1633,8 @@ ippCreateRequestedArray(ipp_t *request)	/* I - IPP request */
     "printer-charge-info",
     "printer-charge-info-uri",
     "printer-commands",			/* CUPS extension */
+    "printer-config-change-date-time",
+    "printer-config-change-time",
     "printer-current-time",
     "printer-detailed-status-messages",
     "printer-device-id",
@@ -1887,7 +1899,7 @@ ippEnumString(const char *attrname,	/* I - Attribute name */
 			       sizeof(ipp_finishings[0]))))
       return (ipp_finishings[enumvalue - 3]);
     else if (enumvalue >= 0x40000000 &&
-             enumvalue <= (0x40000000 + (int)(sizeof(ipp_finishings_vendor) /
+             enumvalue < (0x40000000 + (int)(sizeof(ipp_finishings_vendor) /
                                               sizeof(ipp_finishings_vendor[0]))))
       return (ipp_finishings_vendor[enumvalue - 0x40000000]);
   }

cups/ipp.c

@@ -1,8 +1,8 @@
 /*
  * Internet Printing Protocol functions for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -19,9 +19,9 @@
 
 #include "cups-private.h"
 #include <regex.h>
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -33,12 +33,8 @@ static ipp_attribute_t	*ipp_add_attr(ipp_t *ipp, const char *name,
 			              int num_values);
 static void		ipp_free_values(ipp_attribute_t *attr, int element,
 			                int count);
-static char		*ipp_get_code(const char *locale, char *buffer,
-			              size_t bufsize)
-			              __attribute__((nonnull(1,2)));
-static char		*ipp_lang_code(const char *locale, char *buffer,
-			               size_t bufsize)
-			               __attribute__((nonnull(1,2)));
+static char		*ipp_get_code(const char *locale, char *buffer, size_t bufsize) _CUPS_NONNULL((1, 2));
+static char		*ipp_lang_code(const char *locale, char *buffer, size_t bufsize) _CUPS_NONNULL((1, 2));
 static size_t		ipp_length(ipp_t *ipp, int collection);
 static ssize_t		ipp_read_http(http_t *http, ipp_uchar_t *buffer,
 			              size_t length);
@@ -1483,6 +1479,7 @@ ippCopyAttribute(
     int             quickcopy)		/* I - 1 for a referenced copy, 0 for normal */
 {
   int			i;		/* Looping var */
+  ipp_tag_t		srctag;		/* Source value tag */
   ipp_attribute_t	*dstattr;	/* Destination attribute */
   _ipp_value_t		*srcval,	/* Source value */
 			*dstval;	/* Destination value */
@@ -1501,9 +1498,10 @@ ippCopyAttribute(
   * Copy it...
   */
 
-  quickcopy = quickcopy ? IPP_TAG_CUPS_CONST : 0;
+  quickcopy = (quickcopy && (srcattr->value_tag & IPP_TAG_CUPS_CONST)) ? IPP_TAG_CUPS_CONST : 0;
+  srctag    = srcattr->value_tag & IPP_TAG_CUPS_MASK;
 
-  switch (srcattr->value_tag & ~IPP_TAG_CUPS_CONST)
+  switch (srctag)
   {
     case IPP_TAG_ZERO :
         dstattr = ippAddSeparator(dst);
@@ -1516,139 +1514,70 @@ ippCopyAttribute(
     case IPP_TAG_NOTSETTABLE :
     case IPP_TAG_DELETEATTR :
     case IPP_TAG_ADMINDEFINE :
-        dstattr = ippAddOutOfBand(dst, srcattr->group_tag, srcattr->value_tag & ~IPP_TAG_CUPS_CONST, srcattr->name);
+        dstattr = ippAddOutOfBand(dst, srcattr->group_tag, srctag, srcattr->name);
         break;
 
     case IPP_TAG_INTEGER :
     case IPP_TAG_ENUM :
-        dstattr = ippAddIntegers(dst, srcattr->group_tag, srcattr->value_tag,
-	                         srcattr->name, srcattr->num_values, NULL);
-        if (!dstattr)
-          break;
-
-        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values;
-             i > 0;
-             i --, srcval ++, dstval ++)
-	  dstval->integer = srcval->integer;
-        break;
-
     case IPP_TAG_BOOLEAN :
-        dstattr = ippAddBooleans(dst, srcattr->group_tag, srcattr->name,
-	                        srcattr->num_values, NULL);
-        if (!dstattr)
-          break;
-
-        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values;
-             i > 0;
-             i --, srcval ++, dstval ++)
-	  dstval->boolean = srcval->boolean;
+    case IPP_TAG_DATE :
+    case IPP_TAG_RESOLUTION :
+    case IPP_TAG_RANGE :
+        if ((dstattr = ipp_add_attr(dst, srcattr->name, srcattr->group_tag, srctag, srcattr->num_values)) != NULL)
+	  memcpy(dstattr->values, srcattr->values, (size_t)srcattr->num_values * sizeof(_ipp_value_t));
         break;
 
     case IPP_TAG_TEXT :
     case IPP_TAG_NAME :
+    case IPP_TAG_RESERVED_STRING :
     case IPP_TAG_KEYWORD :
     case IPP_TAG_URI :
     case IPP_TAG_URISCHEME :
     case IPP_TAG_CHARSET :
     case IPP_TAG_LANGUAGE :
     case IPP_TAG_MIMETYPE :
-        dstattr = ippAddStrings(dst, srcattr->group_tag,
-	                        (ipp_tag_t)(srcattr->value_tag | quickcopy),
-	                        srcattr->name, srcattr->num_values, NULL, NULL);
-        if (!dstattr)
+        if ((dstattr = ippAddStrings(dst, srcattr->group_tag, (ipp_tag_t)(srctag | quickcopy), srcattr->name, srcattr->num_values, NULL, NULL)) == NULL)
           break;
 
         if (quickcopy)
 	{
-	  for (i = srcattr->num_values, srcval = srcattr->values,
-	           dstval = dstattr->values;
-	       i > 0;
-	       i --, srcval ++, dstval ++)
-	    dstval->string.text = srcval->string.text;
+	 /*
+	  * Can safely quick-copy these string values...
+	  */
+
+	  memcpy(dstattr->values, srcattr->values, (size_t)srcattr->num_values * sizeof(_ipp_value_t));
         }
-	else if (srcattr->value_tag & IPP_TAG_CUPS_CONST)
-	{
-	  for (i = srcattr->num_values, srcval = srcattr->values,
-	           dstval = dstattr->values;
-	       i > 0;
-	       i --, srcval ++, dstval ++)
-	    dstval->string.text = _cupsStrAlloc(srcval->string.text);
-	}
 	else
 	{
-	  for (i = srcattr->num_values, srcval = srcattr->values,
-	           dstval = dstattr->values;
-	       i > 0;
-	       i --, srcval ++, dstval ++)
-	    dstval->string.text = _cupsStrRetain(srcval->string.text);
-	}
-        break;
+	 /*
+	  * Otherwise do a normal reference counted copy...
+	  */
 
-    case IPP_TAG_DATE :
-        if (srcattr->num_values != 1)
-          return (NULL);
-
-        dstattr = ippAddDate(dst, srcattr->group_tag, srcattr->name,
-	                     srcattr->values[0].date);
-        break;
-
-    case IPP_TAG_RESOLUTION :
-        dstattr = ippAddResolutions(dst, srcattr->group_tag, srcattr->name,
-	                            srcattr->num_values, IPP_RES_PER_INCH,
-				    NULL, NULL);
-        if (!dstattr)
-          break;
-
-        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values;
-             i > 0;
-             i --, srcval ++, dstval ++)
-	{
-	  dstval->resolution.xres  = srcval->resolution.xres;
-	  dstval->resolution.yres  = srcval->resolution.yres;
-	  dstval->resolution.units = srcval->resolution.units;
-	}
-        break;
-
-    case IPP_TAG_RANGE :
-        dstattr = ippAddRanges(dst, srcattr->group_tag, srcattr->name,
-	                       srcattr->num_values, NULL, NULL);
-        if (!dstattr)
-          break;
-
-        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values;
-             i > 0;
-             i --, srcval ++, dstval ++)
-	{
-	  dstval->range.lower = srcval->range.lower;
-	  dstval->range.upper = srcval->range.upper;
+	  for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values; i > 0; i --, srcval ++, dstval ++)
+	    dstval->string.text = _cupsStrAlloc(srcval->string.text);
 	}
         break;
 
     case IPP_TAG_TEXTLANG :
     case IPP_TAG_NAMELANG :
-        dstattr = ippAddStrings(dst, srcattr->group_tag,
-	                        (ipp_tag_t)(srcattr->value_tag | quickcopy),
-	                        srcattr->name, srcattr->num_values, NULL, NULL);
-        if (!dstattr)
+        if ((dstattr = ippAddStrings(dst, srcattr->group_tag, (ipp_tag_t)(srctag | quickcopy), srcattr->name, srcattr->num_values, NULL, NULL)) == NULL)
           break;
 
         if (quickcopy)
 	{
-	  for (i = srcattr->num_values, srcval = srcattr->values,
-	           dstval = dstattr->values;
-	       i > 0;
-	       i --, srcval ++, dstval ++)
-	  {
-            dstval->string.language = srcval->string.language;
-	    dstval->string.text     = srcval->string.text;
-          }
+	 /*
+	  * Can safely quick-copy these string values...
+	  */
+
+	  memcpy(dstattr->values, srcattr->values, (size_t)srcattr->num_values * sizeof(_ipp_value_t));
         }
 	else if (srcattr->value_tag & IPP_TAG_CUPS_CONST)
 	{
-	  for (i = srcattr->num_values, srcval = srcattr->values,
-	           dstval = dstattr->values;
-	       i > 0;
-	       i --, srcval ++, dstval ++)
+	 /*
+	  * Otherwise do a normal reference counted copy...
+	  */
+
+	  for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values; i > 0; i --, srcval ++, dstval ++)
 	  {
 	    if (srcval == srcattr->values)
               dstval->string.language = _cupsStrAlloc(srcval->string.language);
@@ -1658,32 +1587,13 @@ ippCopyAttribute(
 	    dstval->string.text = _cupsStrAlloc(srcval->string.text);
           }
         }
-	else
-	{
-	  for (i = srcattr->num_values, srcval = srcattr->values,
-	           dstval = dstattr->values;
-	       i > 0;
-	       i --, srcval ++, dstval ++)
-	  {
-	    if (srcval == srcattr->values)
-              dstval->string.language = _cupsStrRetain(srcval->string.language);
-	    else
-              dstval->string.language = dstattr->values[0].string.language;
-
-	    dstval->string.text = _cupsStrRetain(srcval->string.text);
-          }
-        }
         break;
 
     case IPP_TAG_BEGIN_COLLECTION :
-        dstattr = ippAddCollections(dst, srcattr->group_tag, srcattr->name,
-	                            srcattr->num_values, NULL);
-        if (!dstattr)
+        if ((dstattr = ippAddCollections(dst, srcattr->group_tag, srcattr->name, srcattr->num_values, NULL)) == NULL)
           break;
 
-        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values;
-             i > 0;
-             i --, srcval ++, dstval ++)
+        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values; i > 0; i --, srcval ++, dstval ++)
 	{
 	  dstval->collection = srcval->collection;
 	  srcval->collection->use ++;
@@ -1692,15 +1602,10 @@ ippCopyAttribute(
 
     case IPP_TAG_STRING :
     default :
-        /* TODO: Implement quick copy for unknown/octetString values */
-        dstattr = ippAddIntegers(dst, srcattr->group_tag, srcattr->value_tag,
-	                         srcattr->name, srcattr->num_values, NULL);
-        if (!dstattr)
+        if ((dstattr = ipp_add_attr(dst, srcattr->name, srcattr->group_tag, srctag, srcattr->num_values)) == NULL)
           break;
 
-        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values;
-             i > 0;
-             i --, srcval ++, dstval ++)
+        for (i = srcattr->num_values, srcval = srcattr->values, dstval = dstattr->values; i > 0; i --, srcval ++, dstval ++)
 	{
 	  dstval->unknown.length = srcval->unknown.length;
 
@@ -3089,6 +2994,13 @@ ippReadIO(void       *src,		/* I - Data source */
 	    ipp->state = IPP_STATE_DATA;
 	    break;
 	  }
+	  else if (tag == IPP_TAG_ZERO || (tag == IPP_TAG_OPERATION && ipp->curtag != IPP_TAG_ZERO))
+	  {
+	    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Invalid group tag."), 1);
+	    DEBUG_printf(("1ippReadIO: bad tag 0x%02x.", tag));
+	    _cupsBufferRelease((char *)buffer);
+	    return (IPP_STATE_ERROR);
+	  }
           else if (tag < IPP_TAG_UNSUPPORTED_VALUE)
 	  {
 	   /*
@@ -3132,8 +3044,13 @@ ippReadIO(void       *src,		/* I - Data source */
 
           DEBUG_printf(("2ippReadIO: name length=%d", n));
 
-          if (n == 0 && tag != IPP_TAG_MEMBERNAME &&
-	      tag != IPP_TAG_END_COLLECTION)
+          if (n && parent)
+          {
+            _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Invalid named IPP attribute in collection."), 1);
+            DEBUG_puts("1ippReadIO: bad attribute name in collection.");
+            return (IPP_STATE_ERROR);
+          }
+          else if (n == 0 && tag != IPP_TAG_MEMBERNAME && tag != IPP_TAG_END_COLLECTION)
 	  {
 	   /*
 	    * More values for current attribute...
@@ -3386,7 +3303,10 @@ ippReadIO(void       *src,		/* I - Data source */
                 value->boolean = (char)buffer[0];
 	        break;
 
-            case IPP_TAG_NOVALUE :
+	    case IPP_TAG_UNSUPPORTED_VALUE :
+	    case IPP_TAG_DEFAULT :
+	    case IPP_TAG_UNKNOWN :
+	    case IPP_TAG_NOVALUE :
 	    case IPP_TAG_NOTSETTABLE :
 	    case IPP_TAG_DELETEATTR :
 	    case IPP_TAG_ADMINDEFINE :
@@ -3406,6 +3326,7 @@ ippReadIO(void       *src,		/* I - Data source */
 
 	    case IPP_TAG_TEXT :
 	    case IPP_TAG_NAME :
+	    case IPP_TAG_RESERVED_STRING :
 	    case IPP_TAG_KEYWORD :
 	    case IPP_TAG_URI :
 	    case IPP_TAG_URISCHEME :
@@ -3836,8 +3757,7 @@ ippSetDate(ipp_t             *ipp,	/* I  - IPP message */
   * Range check input...
   */
 
-  if (!ipp || !attr || !*attr || (*attr)->value_tag != IPP_TAG_DATE ||
-      element < 0 || element > (*attr)->num_values || !datevalue)
+  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_DATE && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN) || element < 0 || element > (*attr)->num_values || !datevalue)
     return (0);
 
  /*
@@ -3920,9 +3840,7 @@ ippSetInteger(ipp_t           *ipp,	/* I  - IPP message */
   * Range check input...
   */
 
-  if (!ipp || !attr || !*attr ||
-      ((*attr)->value_tag != IPP_TAG_INTEGER && (*attr)->value_tag != IPP_TAG_ENUM) ||
-      element < 0 || element > (*attr)->num_values)
+  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_INTEGER && (*attr)->value_tag != IPP_TAG_ENUM && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN) || element < 0 || element > (*attr)->num_values)
     return (0);
 
  /*
@@ -3930,7 +3848,12 @@ ippSetInteger(ipp_t           *ipp,	/* I  - IPP message */
   */
 
   if ((value = ipp_set_value(ipp, attr, element)) != NULL)
+  {
+    if ((*attr)->value_tag != IPP_TAG_ENUM)
+      (*attr)->value_tag = IPP_TAG_INTEGER;
+
     value->integer = intvalue;
+  }
 
   return (value != NULL);
 }
@@ -4007,9 +3930,7 @@ ippSetOctetString(
   * Range check input...
   */
 
-  if (!ipp || !attr || !*attr || (*attr)->value_tag != IPP_TAG_STRING ||
-      element < 0 || element > (*attr)->num_values ||
-      datalen < 0 || datalen > IPP_MAX_LENGTH)
+  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_STRING && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN) || element < 0 || element > (*attr)->num_values || datalen < 0 || datalen > IPP_MAX_LENGTH)
     return (0);
 
  /*
@@ -4033,6 +3954,8 @@ ippSetOctetString(
       * Copy the data...
       */
 
+      (*attr)->value_tag = IPP_TAG_STRING;
+
       if (value->unknown.data)
       {
        /*
@@ -4124,8 +4047,7 @@ ippSetRange(ipp_t           *ipp,	/* I  - IPP message */
   * Range check input...
   */
 
-  if (!ipp || !attr || !*attr || (*attr)->value_tag != IPP_TAG_RANGE ||
-      element < 0 || element > (*attr)->num_values || lowervalue > uppervalue)
+  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_RANGE && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN) || element < 0 || element > (*attr)->num_values || lowervalue > uppervalue)
     return (0);
 
  /*
@@ -4134,6 +4056,7 @@ ippSetRange(ipp_t           *ipp,	/* I  - IPP message */
 
   if ((value = ipp_set_value(ipp, attr, element)) != NULL)
   {
+    (*attr)->value_tag = IPP_TAG_RANGE;
     value->range.lower = lowervalue;
     value->range.upper = uppervalue;
   }
@@ -4206,9 +4129,7 @@ ippSetResolution(
   * Range check input...
   */
 
-  if (!ipp || !attr || !*attr || (*attr)->value_tag != IPP_TAG_RESOLUTION ||
-      element < 0 || element > (*attr)->num_values || xresvalue <= 0 || yresvalue <= 0 ||
-      unitsvalue < IPP_RES_PER_INCH || unitsvalue > IPP_RES_PER_CM)
+  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_RESOLUTION && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN) || element < 0 || element > (*attr)->num_values || xresvalue <= 0 || yresvalue <= 0 || unitsvalue < IPP_RES_PER_INCH || unitsvalue > IPP_RES_PER_CM)
     return (0);
 
  /*
@@ -4217,6 +4138,7 @@ ippSetResolution(
 
   if ((value = ipp_set_value(ipp, attr, element)) != NULL)
   {
+    (*attr)->value_tag      = IPP_TAG_RESOLUTION;
     value->resolution.units = unitsvalue;
     value->resolution.xres  = xresvalue;
     value->resolution.yres  = yresvalue;
@@ -4306,18 +4228,19 @@ ippSetString(ipp_t           *ipp,	/* I  - IPP message */
 {
   char		*temp;			/* Temporary string */
   _ipp_value_t	*value;			/* Current value */
+  ipp_tag_t	value_tag;		/* Value tag */
 
 
  /*
   * Range check input...
   */
 
-  if (!ipp || !attr || !*attr ||
-      ((*attr)->value_tag != IPP_TAG_TEXTLANG &&
-      (*attr)->value_tag != IPP_TAG_NAMELANG &&
-       ((*attr)->value_tag < IPP_TAG_TEXT ||
-        (*attr)->value_tag > IPP_TAG_MIMETYPE)) ||
-      element < 0 || element > (*attr)->num_values || !strvalue)
+  if (attr && *attr)
+    value_tag = (*attr)->value_tag & IPP_TAG_CUPS_MASK;
+  else
+    value_tag = IPP_TAG_ZERO;
+
+  if (!ipp || !attr || !*attr || (value_tag < IPP_TAG_TEXT && value_tag != IPP_TAG_TEXTLANG && value_tag != IPP_TAG_NAMELANG && value_tag != IPP_TAG_NOVALUE && value_tag != IPP_TAG_UNKNOWN) || value_tag > IPP_TAG_MIMETYPE || element < 0 || element > (*attr)->num_values || !strvalue)
     return (0);
 
  /*
@@ -4326,6 +4249,9 @@ ippSetString(ipp_t           *ipp,	/* I  - IPP message */
 
   if ((value = ipp_set_value(ipp, attr, element)) != NULL)
   {
+    if (value_tag == IPP_TAG_NOVALUE || value_tag == IPP_TAG_UNKNOWN)
+      (*attr)->value_tag = IPP_TAG_KEYWORD;
+
     if (element > 0)
       value->string.language = (*attr)->values[0].string.language;
 
@@ -4426,10 +4352,7 @@ ippSetStringfv(ipp_t           *ipp,	/* I  - IPP message */
   else
     value_tag = IPP_TAG_ZERO;
 
-  if (!ipp || !attr || !*attr ||
-      (value_tag < IPP_TAG_TEXT && value_tag != IPP_TAG_TEXTLANG &&
-       value_tag != IPP_TAG_NAMELANG) || value_tag > IPP_TAG_MIMETYPE ||
-      !format)
+  if (!ipp || !attr || !*attr || (value_tag < IPP_TAG_TEXT && value_tag != IPP_TAG_TEXTLANG && value_tag != IPP_TAG_NAMELANG && value_tag != IPP_TAG_NOVALUE && value_tag != IPP_TAG_UNKNOWN) || value_tag > IPP_TAG_MIMETYPE || !format)
     return (0);
 
  /*
@@ -4481,6 +4404,8 @@ ippSetStringfv(ipp_t           *ipp,	/* I  - IPP message */
         max_bytes = IPP_MAX_CHARSET;
         break;
 
+    case IPP_TAG_NOVALUE :
+    case IPP_TAG_UNKNOWN :
     case IPP_TAG_KEYWORD :
         max_bytes = IPP_MAX_KEYWORD;
         break;
@@ -4628,9 +4553,7 @@ ippSetValueTag(
         break;
 
     case IPP_TAG_NAME :
-        if (temp_tag != IPP_TAG_KEYWORD && temp_tag != IPP_TAG_URI &&
-            temp_tag != IPP_TAG_URISCHEME && temp_tag != IPP_TAG_LANGUAGE &&
-            temp_tag != IPP_TAG_MIMETYPE)
+        if (temp_tag != IPP_TAG_KEYWORD)
           return (0);
 
         (*attr)->value_tag = (ipp_tag_t)(IPP_TAG_NAME | ((*attr)->value_tag & IPP_TAG_CUPS_CONST));
@@ -4638,17 +4561,14 @@ ippSetValueTag(
 
     case IPP_TAG_NAMELANG :
     case IPP_TAG_TEXTLANG :
-        if (value_tag == IPP_TAG_NAMELANG &&
-            (temp_tag != IPP_TAG_NAME && temp_tag != IPP_TAG_KEYWORD &&
-             temp_tag != IPP_TAG_URI && temp_tag != IPP_TAG_URISCHEME &&
-             temp_tag != IPP_TAG_LANGUAGE && temp_tag != IPP_TAG_MIMETYPE))
+        if (value_tag == IPP_TAG_NAMELANG && (temp_tag != IPP_TAG_NAME && temp_tag != IPP_TAG_KEYWORD))
           return (0);
 
         if (value_tag == IPP_TAG_TEXTLANG && temp_tag != IPP_TAG_TEXT)
           return (0);
 
         if (ipp->attrs && ipp->attrs->next && ipp->attrs->next->name &&
-            !strcmp(ipp->attrs->next->name, "attributes-natural-language"))
+            !strcmp(ipp->attrs->next->name, "attributes-natural-language") && (ipp->attrs->next->value_tag & IPP_TAG_CUPS_MASK) == IPP_TAG_LANGUAGE)
         {
          /*
           * Use the language code from the IPP message...
@@ -4742,7 +4662,7 @@ ippSetVersion(ipp_t *ipp,		/* I - IPP message */
 const ipp_uchar_t *			/* O - RFC-2579 date/time data */
 ippTimeToDate(time_t t)			/* I - Time in seconds */
 {
-  struct tm	*unixdate;		/* UNIX unixdate/time info */
+  struct tm	unixdate;		/* UNIX unixdate/time info */
   ipp_uchar_t	*date = _cupsGlobals()->ipp_date;
 					/* RFC-2579 date/time data */
 
@@ -4764,16 +4684,16 @@ ippTimeToDate(time_t t)			/* I - Time in seconds */
   *    10       UTC minutes (0 to 59)
   */
 
-  unixdate = gmtime(&t);
-  unixdate->tm_year += 1900;
+  gmtime_r(&t, &unixdate);
+  unixdate.tm_year += 1900;
 
-  date[0]  = (ipp_uchar_t)(unixdate->tm_year >> 8);
-  date[1]  = (ipp_uchar_t)(unixdate->tm_year);
-  date[2]  = (ipp_uchar_t)(unixdate->tm_mon + 1);
-  date[3]  = (ipp_uchar_t)unixdate->tm_mday;
-  date[4]  = (ipp_uchar_t)unixdate->tm_hour;
-  date[5]  = (ipp_uchar_t)unixdate->tm_min;
-  date[6]  = (ipp_uchar_t)unixdate->tm_sec;
+  date[0]  = (ipp_uchar_t)(unixdate.tm_year >> 8);
+  date[1]  = (ipp_uchar_t)(unixdate.tm_year);
+  date[2]  = (ipp_uchar_t)(unixdate.tm_mon + 1);
+  date[3]  = (ipp_uchar_t)unixdate.tm_mday;
+  date[4]  = (ipp_uchar_t)unixdate.tm_hour;
+  date[5]  = (ipp_uchar_t)unixdate.tm_min;
+  date[6]  = (ipp_uchar_t)unixdate.tm_sec;
   date[7]  = 0;
   date[8]  = '+';
   date[9]  = 0;
@@ -4808,21 +4728,6 @@ ippValidateAttribute(
   ipp_attribute_t *colattr;		/* Collection attribute */
   regex_t	re;			/* Regular expression */
   ipp_uchar_t	*date;			/* Current date value */
-  static const char * const uri_status_strings[] =
-  {					/* URI status strings */
-    "URI too large",
-    "Bad arguments to function",
-    "Bad resource in URI",
-    "Bad port number in URI",
-    "Bad hostname/address in URI",
-    "Bad username in URI",
-    "Bad scheme in URI",
-    "Bad/empty URI",
-    "OK",
-    "Missing scheme in URI",
-    "Unknown scheme in URI",
-    "Missing resource in URI"
-  };
 
 
  /*
@@ -5070,43 +4975,44 @@ ippValidateAttribute(
 	  {
 	    if ((*ptr & 0xe0) == 0xc0)
 	    {
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
+	      if ((ptr[1] & 0xc0) != 0x80)
 	        break;
+
+	      ptr ++;
 	    }
 	    else if ((*ptr & 0xf0) == 0xe0)
 	    {
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
-	        break;
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
+	      if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80)
 	        break;
+
+	      ptr += 2;
 	    }
 	    else if ((*ptr & 0xf8) == 0xf0)
 	    {
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
-	        break;
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
-	        break;
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
+	      if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80 || (ptr[3] & 0xc0) != 0x80)
 	        break;
+
+	      ptr += 3;
 	    }
 	    else if (*ptr & 0x80)
 	      break;
+	    else if ((*ptr < ' ' && *ptr != '\n' && *ptr != '\r' && *ptr != '\t') || *ptr == 0x7f)
+	      break;
 	  }
 
-	  if (*ptr)
-	  {
-	    ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST,
-			  _("\"%s\": Bad text value \"%s\" - bad UTF-8 "
-			    "sequence (RFC 8011 section 5.1.2)."), attr->name,
-			  attr->values[i].string.text);
-	    return (0);
-	  }
+          if (*ptr)
+          {
+	    if (*ptr < ' ' || *ptr == 0x7f)
+	    {
+	      ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST, _("\"%s\": Bad text value \"%s\" - bad control character (PWG 5100.14 section 8.3)."), attr->name, attr->values[i].string.text);
+	      return (0);
+	    }
+	    else
+	    {
+	      ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST, _("\"%s\": Bad text value \"%s\" - bad UTF-8 sequence (RFC 8011 section 5.1.2)."), attr->name, attr->values[i].string.text);
+	      return (0);
+	    }
+          }
 
 	  if ((ptr - attr->values[i].string.text) > (IPP_MAX_TEXT - 1))
 	  {
@@ -5128,43 +5034,44 @@ ippValidateAttribute(
 	  {
 	    if ((*ptr & 0xe0) == 0xc0)
 	    {
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
+	      if ((ptr[1] & 0xc0) != 0x80)
 	        break;
+
+	      ptr ++;
 	    }
 	    else if ((*ptr & 0xf0) == 0xe0)
 	    {
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
-	        break;
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
+	      if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80)
 	        break;
+
+	      ptr += 2;
 	    }
 	    else if ((*ptr & 0xf8) == 0xf0)
 	    {
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
-	        break;
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
-	        break;
-	      ptr ++;
-	      if ((*ptr & 0xc0) != 0x80)
+	      if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80 || (ptr[3] & 0xc0) != 0x80)
 	        break;
+
+	      ptr += 3;
 	    }
 	    else if (*ptr & 0x80)
 	      break;
+	    else if (*ptr < ' ' || *ptr == 0x7f)
+	      break;
 	  }
 
 	  if (*ptr)
 	  {
-	    ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST,
-			  _("\"%s\": Bad name value \"%s\" - bad UTF-8 "
-			    "sequence (RFC 8011 section 5.1.3)."), attr->name,
-			  attr->values[i].string.text);
-	    return (0);
-	  }
+	    if (*ptr < ' ' || *ptr == 0x7f)
+	    {
+	      ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST, _("\"%s\": Bad name value \"%s\" - bad control character (PWG 5100.14 section 8.1)."), attr->name, attr->values[i].string.text);
+	      return (0);
+	    }
+	    else
+	    {
+	      ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST, _("\"%s\": Bad name value \"%s\" - bad UTF-8 sequence (RFC 8011 section 5.1.3)."), attr->name, attr->values[i].string.text);
+	      return (0);
+	    }
+          }
 
 	  if ((ptr - attr->values[i].string.text) > (IPP_MAX_NAME - 1))
 	  {
@@ -5219,12 +5126,7 @@ ippValidateAttribute(
 
 	  if (uri_status < HTTP_URI_STATUS_OK)
 	  {
-	    ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST,
-			  _("\"%s\": Bad URI value \"%s\" - %s "
-			    "(RFC 8011 section 5.1.6)."), attr->name,
-			  attr->values[i].string.text,
-			  uri_status_strings[uri_status -
-					     HTTP_URI_STATUS_OVERFLOW]);
+	    ipp_set_error(IPP_STATUS_ERROR_BAD_REQUEST, _("\"%s\": Bad URI value \"%s\" - %s (RFC 8011 section 5.1.6)."), attr->name, attr->values[i].string.text, httpURIStatusString(uri_status));
 	    return (0);
 	  }
 
@@ -6502,6 +6404,7 @@ ipp_free_values(ipp_attribute_t *attr,	/* I - Attribute to free values from */
 	  }
 	  break;
 
+      case IPP_TAG_UNSUPPORTED_VALUE :
       case IPP_TAG_DEFAULT :
       case IPP_TAG_UNKNOWN :
       case IPP_TAG_NOVALUE :
@@ -6843,14 +6746,14 @@ ipp_read_http(http_t      *http,	/* I - Client connection */
 
     if ((bytes = httpRead2(http, (char *)buffer, length - (size_t)tbytes)) < 0)
     {
-#ifdef WIN32
+#ifdef _WIN32
       break;
 #else
       if (errno != EAGAIN && errno != EINTR)
 	break;
 
       bytes = 0;
-#endif /* WIN32 */
+#endif /* _WIN32 */
     }
     else if (bytes == 0)
       break;
@@ -6878,11 +6781,11 @@ ipp_read_file(int         *fd,		/* I - File descriptor */
               ipp_uchar_t *buffer,	/* O - Read buffer */
 	      size_t      length)	/* I - Number of bytes to read */
 {
-#ifdef WIN32
+#ifdef _WIN32
   return ((ssize_t)read(*fd, buffer, (unsigned)length));
 #else
   return (read(*fd, buffer, length));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -7050,9 +6953,9 @@ ipp_write_file(int         *fd,		/* I - File descriptor */
                ipp_uchar_t *buffer,	/* I - Data to write */
                size_t      length)	/* I - Number of bytes to write */
 {
-#ifdef WIN32
+#ifdef _WIN32
   return ((ssize_t)write(*fd, buffer, (unsigned)length));
 #else
   return (write(*fd, buffer, length));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }

cups/ipp.h

@@ -1,7 +1,7 @@
 /*
  * Internet Printing Protocol definitions for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2019 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -79,11 +79,11 @@ extern "C" {
 
 typedef enum ipp_dstate_e		/**** Document states @exclude all@ ****/
 {
-  IPP_DOCUMENT_PENDING = 3,		/* Document is pending */
-  IPP_DOCUMENT_PROCESSING = 5,		/* Document is processing */
-  IPP_DOCUMENT_CANCELED = 7,		/* Document is canceled */
-  IPP_DOCUMENT_ABORTED,			/* Document is aborted */
-  IPP_DOCUMENT_COMPLETED		/* Document is completed */
+  IPP_DSTATE_PENDING = 3,		/* Document is pending */
+  IPP_DSTATE_PROCESSING = 5,		/* Document is processing */
+  IPP_DSTATE_CANCELED = 7,		/* Document is canceled */
+  IPP_DSTATE_ABORTED,			/* Document is aborted */
+  IPP_DSTATE_COMPLETED			/* Document is completed */
 
 #  ifndef _CUPS_NO_DEPRECATED
 #    define IPP_DOCUMENT_PENDING	IPP_DSTATE_PENDING
@@ -150,11 +150,11 @@ typedef enum ipp_finishings_e		/**** Finishings values ****/
   IPP_FINISHINGS_PUNCH_QUAD_TOP,	/* Punch 4 holes top edge */
   IPP_FINISHINGS_PUNCH_QUAD_RIGHT,	/* Punch 4 holes right side */
   IPP_FINISHINGS_PUNCH_QUAD_BOTTOM,	/* Punch 4 holes bottom edge */
-  IPP_FINISHINGS_PUNCH_MULTIPLE_LEFT,	/* Pucnh multiple holes left side */
-  IPP_FINISHINGS_PUNCH_MULTIPLE_TOP,	/* Pucnh multiple holes top edge */
-  IPP_FINISHINGS_PUNCH_MULTIPLE_RIGHT,	/* Pucnh multiple holes right side */
-  IPP_FINISHINGS_PUNCH_MULTIPLE_BOTTOM,	/* Pucnh multiple holes bottom edge */
-  IPP_FINISHINGS_FOLD_ACCORDIAN = 90,	/* Accordian-fold the paper vertically into four sections */
+  IPP_FINISHINGS_PUNCH_MULTIPLE_LEFT,	/* Punch multiple holes left side */
+  IPP_FINISHINGS_PUNCH_MULTIPLE_TOP,	/* Punch multiple holes top edge */
+  IPP_FINISHINGS_PUNCH_MULTIPLE_RIGHT,	/* Punch multiple holes right side */
+  IPP_FINISHINGS_PUNCH_MULTIPLE_BOTTOM,	/* Punch multiple holes bottom edge */
+  IPP_FINISHINGS_FOLD_ACCORDION = 90,	/* Accordion-fold the paper vertically into four sections */
   IPP_FINISHINGS_FOLD_DOUBLE_GATE,	/* Fold the top and bottom quarters of the paper towards the midline, then fold in half vertically */
   IPP_FINISHINGS_FOLD_GATE,		/* Fold the top and bottom quarters of the paper towards the midline */
   IPP_FINISHINGS_FOLD_HALF,		/* Fold the paper in half vertically */
@@ -189,8 +189,8 @@ typedef enum ipp_finishings_e		/**** Finishings values ****/
   IPP_FINISHINGS_CUPS_PUNCH_QUAD_RIGHT,	/* Punch 4 holes right side @exclude all@ */
   IPP_FINISHINGS_CUPS_PUNCH_QUAD_BOTTOM,/* Punch 4 holes bottom edge @exclude all@ */
 
-  IPP_FINISHINGS_CUPS_FOLD_ACCORDIAN = 0x4000005A,
-					/* Accordian-fold the paper vertically into four sections @exclude all@ */
+  IPP_FINISHINGS_CUPS_FOLD_ACCORDION = 0x4000005A,
+					/* Accordion-fold the paper vertically into four sections @exclude all@ */
   IPP_FINISHINGS_CUPS_FOLD_DOUBLE_GATE,	/* Fold the top and bottom quarters of the paper towards the midline, then fold in half vertically @exclude all@ */
   IPP_FINISHINGS_CUPS_FOLD_GATE,	/* Fold the top and bottom quarters of the paper towards the midline @exclude all@ */
   IPP_FINISHINGS_CUPS_FOLD_HALF,	/* Fold the paper in half vertically @exclude all@ */
@@ -203,8 +203,10 @@ typedef enum ipp_finishings_e		/**** Finishings values ****/
   IPP_FINISHINGS_CUPS_FOLD_Z		/* Fold the paper vertically into three sections, forming a Z @exclude all@ */
 } ipp_finishings_t;
 #  ifndef _CUPS_NO_DEPRECATED
+#    define IPP_FINISHINGS_CUPS_FOLD_ACCORDIAN IPP_FINISHINGS_CUPS_FOLD_ACCORDION
+#    define IPP_FINISHINGS_FOLD_ACCORDIAN IPP_FINISHINGS_FOLD_ACCORDION
 #    define IPP_FINISHINGS_JOB_OFFSET	IPP_FINISHINGS_JOG_OFFSET
-					/* Long-time misspelling... */
+					/* Long-time misspellings... */
 typedef enum ipp_finishings_e ipp_finish_t;
 #  endif /* !_CUPS_NO_DEPRECATED */
 

cups/language-private.h

@@ -1,7 +1,7 @@
 /*
  * Private localization support for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -20,6 +20,7 @@
  * Include necessary headers...
  */
 
+#  include "config.h"
 #  include <stdio.h>
 #  include <cups/transcode.h>
 #  ifdef __APPLE__
@@ -59,16 +60,11 @@ extern const char	*_cupsAppleLocale(CFStringRef languageName, char *locale, size
 #  endif /* __APPLE__ */
 extern void		_cupsCharmapFlush(void);
 extern const char	*_cupsEncodingName(cups_encoding_t encoding);
-extern void		_cupsLangPrintError(const char *prefix,
-			                    const char *message);
-extern int		_cupsLangPrintFilter(FILE *fp, const char *prefix,
-			                     const char *message, ...)
-			__attribute__ ((__format__ (__printf__, 3, 4)));
-extern int		_cupsLangPrintf(FILE *fp, const char *message, ...)
-			__attribute__ ((__format__ (__printf__, 2, 3)));
+extern void		_cupsLangPrintError(const char *prefix, const char *message);
+extern int		_cupsLangPrintFilter(FILE *fp, const char *prefix, const char *message, ...) _CUPS_FORMAT(3, 4);
+extern int		_cupsLangPrintf(FILE *fp, const char *message, ...) _CUPS_FORMAT(2, 3);
 extern int		_cupsLangPuts(FILE *fp, const char *message);
-extern const char	*_cupsLangString(cups_lang_t *lang,
-			                 const char *message);
+extern const char	*_cupsLangString(cups_lang_t *lang, const char *message);
 extern void		_cupsMessageFree(cups_array_t *a);
 extern cups_array_t	*_cupsMessageLoad(const char *filename, int unquote);
 extern const char	*_cupsMessageLookup(cups_array_t *a, const char *m);

cups/language.c

@@ -21,11 +21,11 @@
 #ifdef HAVE_LANGINFO_H
 #  include <langinfo.h>
 #endif /* HAVE_LANGINFO_H */
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 #ifdef HAVE_COREFOUNDATION_H
 #  include <CoreFoundation/CoreFoundation.h>
 #endif /* HAVE_COREFOUNDATION_H */

cups/libcups2.def

@@ -1,5 +1,5 @@
 LIBRARY libcups2
-VERSION 2.12
+VERSION 2.13
 EXPORTS
 _cupsArrayAddStrings
 _cupsArrayNewStrings
@@ -13,6 +13,7 @@ _cupsConnect
 _cupsConvertOptions
 _cupsCreateDest
 _cupsEncodingName
+_cupsFilePeekAhead
 _cupsGet1284Values
 _cupsGetDestResource
 _cupsGetDests
@@ -24,9 +25,6 @@ _cupsLangPrintError
 _cupsLangPrintf
 _cupsLangPuts
 _cupsLangString
-_cupsMD5Append
-_cupsMD5Finish
-_cupsMD5Init
 _cupsMessageFree
 _cupsMessageLoad
 _cupsMessageLookup
@@ -39,18 +37,6 @@ _cupsRWInit
 _cupsRWLockRead
 _cupsRWLockWrite
 _cupsRWUnlock
-_cupsSNMPClose
-_cupsSNMPCopyOID
-_cupsSNMPDefaultCommunity
-_cupsSNMPIsOID
-_cupsSNMPIsOIDPrefixed
-_cupsSNMPOIDToString
-_cupsSNMPOpen
-_cupsSNMPRead
-_cupsSNMPSetDebug
-_cupsSNMPStringToOID
-_cupsSNMPWalk
-_cupsSNMPWrite
 _cupsSetDefaults
 _cupsSetError
 _cupsSetHTTPError
@@ -65,6 +51,7 @@ _cupsStrScand
 _cupsStrStatistics
 _cupsThreadCancel
 _cupsThreadCreate
+_cupsThreadDetach
 _cupsThreadWait
 _cupsUserDefault
 _cups_safe_vsnprintf
@@ -81,6 +68,7 @@ _httpDisconnect
 _httpEncodeURI
 _httpFreeCredentials
 _httpResolveURI
+_httpSetDigestAuthString
 _httpStatus
 _httpTLSInitialize
 _httpTLSPending
@@ -124,6 +112,7 @@ _pwgMediaTable
 _pwgMediaTypeForType
 _pwgPageSizeForMedia
 cupsAddDest
+cupsAddIntegerOption
 cupsAddOption
 cupsAdminCreateWindowsPPD
 cupsAdminExportSamba
@@ -227,6 +216,7 @@ cupsGetDests2
 cupsGetDevices
 cupsGetFd
 cupsGetFile
+cupsGetIntegerOption
 cupsGetJobs
 cupsGetJobs2
 cupsGetNamedDest
@@ -240,6 +230,7 @@ cupsGetPrinters
 cupsGetResponse
 cupsGetServerPPD
 cupsHashData
+cupsHashString
 cupsLangDefault
 cupsLangEncoding
 cupsLangFlush

cups/md5.c

@@ -1,7 +1,7 @@
 /*
  * Private MD5 implementation for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2017 by Apple Inc.
  * Copyright 2005 by Easy Software Products
  * Copyright (C) 1999 Aladdin Enterprises.  All rights reserved.
  *
@@ -43,70 +43,71 @@
 #include "md5-private.h"
 #include "string-private.h"
 
-#define T1 0xd76aa478
-#define T2 0xe8c7b756
-#define T3 0x242070db
-#define T4 0xc1bdceee
-#define T5 0xf57c0faf
-#define T6 0x4787c62a
-#define T7 0xa8304613
-#define T8 0xfd469501
-#define T9 0x698098d8
-#define T10 0x8b44f7af
-#define T11 0xffff5bb1
-#define T12 0x895cd7be
-#define T13 0x6b901122
-#define T14 0xfd987193
-#define T15 0xa679438e
-#define T16 0x49b40821
-#define T17 0xf61e2562
-#define T18 0xc040b340
-#define T19 0x265e5a51
-#define T20 0xe9b6c7aa
-#define T21 0xd62f105d
-#define T22 0x02441453
-#define T23 0xd8a1e681
-#define T24 0xe7d3fbc8
-#define T25 0x21e1cde6
-#define T26 0xc33707d6
-#define T27 0xf4d50d87
-#define T28 0x455a14ed
-#define T29 0xa9e3e905
-#define T30 0xfcefa3f8
-#define T31 0x676f02d9
-#define T32 0x8d2a4c8a
-#define T33 0xfffa3942
-#define T34 0x8771f681
-#define T35 0x6d9d6122
-#define T36 0xfde5380c
-#define T37 0xa4beea44
-#define T38 0x4bdecfa9
-#define T39 0xf6bb4b60
-#define T40 0xbebfbc70
-#define T41 0x289b7ec6
-#define T42 0xeaa127fa
-#define T43 0xd4ef3085
-#define T44 0x04881d05
-#define T45 0xd9d4d039
-#define T46 0xe6db99e5
-#define T47 0x1fa27cf8
-#define T48 0xc4ac5665
-#define T49 0xf4292244
-#define T50 0x432aff97
-#define T51 0xab9423a7
-#define T52 0xfc93a039
-#define T53 0x655b59c3
-#define T54 0x8f0ccc92
-#define T55 0xffeff47d
-#define T56 0x85845dd1
-#define T57 0x6fa87e4f
-#define T58 0xfe2ce6e0
-#define T59 0xa3014314
-#define T60 0x4e0811a1
-#define T61 0xf7537e82
-#define T62 0xbd3af235
-#define T63 0x2ad7d2bb
-#define T64 0xeb86d391
+#if !defined(__APPLE__) && !defined(HAVE_GNUTLS)
+#  define T1 0xd76aa478
+#  define T2 0xe8c7b756
+#  define T3 0x242070db
+#  define T4 0xc1bdceee
+#  define T5 0xf57c0faf
+#  define T6 0x4787c62a
+#  define T7 0xa8304613
+#  define T8 0xfd469501
+#  define T9 0x698098d8
+#  define T10 0x8b44f7af
+#  define T11 0xffff5bb1
+#  define T12 0x895cd7be
+#  define T13 0x6b901122
+#  define T14 0xfd987193
+#  define T15 0xa679438e
+#  define T16 0x49b40821
+#  define T17 0xf61e2562
+#  define T18 0xc040b340
+#  define T19 0x265e5a51
+#  define T20 0xe9b6c7aa
+#  define T21 0xd62f105d
+#  define T22 0x02441453
+#  define T23 0xd8a1e681
+#  define T24 0xe7d3fbc8
+#  define T25 0x21e1cde6
+#  define T26 0xc33707d6
+#  define T27 0xf4d50d87
+#  define T28 0x455a14ed
+#  define T29 0xa9e3e905
+#  define T30 0xfcefa3f8
+#  define T31 0x676f02d9
+#  define T32 0x8d2a4c8a
+#  define T33 0xfffa3942
+#  define T34 0x8771f681
+#  define T35 0x6d9d6122
+#  define T36 0xfde5380c
+#  define T37 0xa4beea44
+#  define T38 0x4bdecfa9
+#  define T39 0xf6bb4b60
+#  define T40 0xbebfbc70
+#  define T41 0x289b7ec6
+#  define T42 0xeaa127fa
+#  define T43 0xd4ef3085
+#  define T44 0x04881d05
+#  define T45 0xd9d4d039
+#  define T46 0xe6db99e5
+#  define T47 0x1fa27cf8
+#  define T48 0xc4ac5665
+#  define T49 0xf4292244
+#  define T50 0x432aff97
+#  define T51 0xab9423a7
+#  define T52 0xfc93a039
+#  define T53 0x655b59c3
+#  define T54 0x8f0ccc92
+#  define T55 0xffeff47d
+#  define T56 0x85845dd1
+#  define T57 0x6fa87e4f
+#  define T58 0xfe2ce6e0
+#  define T59 0xa3014314
+#  define T60 0x4e0811a1
+#  define T61 0xf7537e82
+#  define T62 0xbd3af235
+#  define T63 0x2ad7d2bb
+#  define T64 0xeb86d391
 
 static void
 _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
@@ -116,10 +117,10 @@ _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
 	c = pms->abcd[2], d = pms->abcd[3];
     unsigned int t;
 
-#ifndef ARCH_IS_BIG_ENDIAN
-# define ARCH_IS_BIG_ENDIAN 1	/* slower, default implementation */
-#endif
-#if ARCH_IS_BIG_ENDIAN
+#  ifndef ARCH_IS_BIG_ENDIAN
+#    define ARCH_IS_BIG_ENDIAN 1	/* slower, default implementation */
+#  endif
+#  if ARCH_IS_BIG_ENDIAN
 
     /*
      * On big-endian machines, we must arrange the bytes in the right
@@ -133,7 +134,7 @@ _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
 	X[i] = (unsigned)xp[0] + ((unsigned)xp[1] << 8) +
 	       ((unsigned)xp[2] << 16) + ((unsigned)xp[3] << 24);
 
-#else  /* !ARCH_IS_BIG_ENDIAN */
+#  else  /* !ARCH_IS_BIG_ENDIAN */
 
     /*
      * On little-endian machines, we can process properly aligned data
@@ -150,15 +151,15 @@ _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
 	memcpy(xbuf, data, 64);
 	X = xbuf;
     }
-#endif
+#  endif
 
-#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
+#  define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
 
     /* Round 1. */
     /* Let [abcd k s i] denote the operation
        a = b + ((a + F(b,c,d) + X[k] + T[i]) <<< s). */
-#define F(x, y, z) (((x) & (y)) | (~(x) & (z)))
-#define SET(a, b, c, d, k, s, Ti)\
+#  define F(x, y, z) (((x) & (y)) | (~(x) & (z)))
+#  define SET(a, b, c, d, k, s, Ti)\
   t = a + F(b,c,d) + X[k] + Ti;\
   a = ROTATE_LEFT(t, s) + b
     /* Do the following 16 operations. */
@@ -178,13 +179,13 @@ _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
     SET(d, a, b, c, 13, 12, T14);
     SET(c, d, a, b, 14, 17, T15);
     SET(b, c, d, a, 15, 22, T16);
-#undef SET
+#  undef SET
 
      /* Round 2. */
      /* Let [abcd k s i] denote the operation
           a = b + ((a + G(b,c,d) + X[k] + T[i]) <<< s). */
-#define G(x, y, z) (((x) & (z)) | ((y) & ~(z)))
-#define SET(a, b, c, d, k, s, Ti)\
+#  define G(x, y, z) (((x) & (z)) | ((y) & ~(z)))
+#  define SET(a, b, c, d, k, s, Ti)\
   t = a + G(b,c,d) + X[k] + Ti;\
   a = ROTATE_LEFT(t, s) + b
      /* Do the following 16 operations. */
@@ -204,13 +205,13 @@ _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
     SET(d, a, b, c,  2,  9, T30);
     SET(c, d, a, b,  7, 14, T31);
     SET(b, c, d, a, 12, 20, T32);
-#undef SET
+#  undef SET
 
      /* Round 3. */
      /* Let [abcd k s t] denote the operation
           a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s). */
-#define H(x, y, z) ((x) ^ (y) ^ (z))
-#define SET(a, b, c, d, k, s, Ti)\
+#  define H(x, y, z) ((x) ^ (y) ^ (z))
+#  define SET(a, b, c, d, k, s, Ti)\
   t = a + H(b,c,d) + X[k] + Ti;\
   a = ROTATE_LEFT(t, s) + b
      /* Do the following 16 operations. */
@@ -230,13 +231,13 @@ _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
     SET(d, a, b, c, 12, 11, T46);
     SET(c, d, a, b, 15, 16, T47);
     SET(b, c, d, a,  2, 23, T48);
-#undef SET
+#  undef SET
 
      /* Round 4. */
      /* Let [abcd k s t] denote the operation
           a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s). */
-#define I(x, y, z) ((y) ^ ((x) | ~(z)))
-#define SET(a, b, c, d, k, s, Ti)\
+#  define I(x, y, z) ((y) ^ ((x) | ~(z)))
+#  define SET(a, b, c, d, k, s, Ti)\
   t = a + I(b,c,d) + X[k] + Ti;\
   a = ROTATE_LEFT(t, s) + b
      /* Do the following 16 operations. */
@@ -256,7 +257,7 @@ _cups_md5_process(_cups_md5_state_t *pms, const unsigned char *data /*[64]*/)
     SET(d, a, b, c, 11, 10, T62);
     SET(c, d, a, b,  2, 15, T63);
     SET(b, c, d, a,  9, 21, T64);
-#undef SET
+#  undef SET
 
      /* Then perform the following additions. (That is increment each
         of the four registers by the value it had before this block
@@ -337,3 +338,4 @@ _cupsMD5Finish(_cups_md5_state_t *pms, unsigned char digest[16])
     for (i = 0; i < 16; ++i)
 	digest[i] = (unsigned char)(pms->abcd[i >> 2] >> ((i & 3) << 3));
 }
+#endif /* !__APPLE__ && !HAVE_GNUTLS */

cups/md5passwd.c

@@ -1,7 +1,7 @@
 /*
- * MD5 password support for CUPS.
+ * MD5 password support for CUPS (deprecated).
  *
- * Copyright 2007-2010 by Apple Inc.
+ * Copyright 2007-2017 by Apple Inc.
  * Copyright 1997-2005 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -17,12 +17,15 @@
  * Include necessary headers...
  */
 
+#include <cups/cups.h>
 #include "http-private.h"
 #include "string-private.h"
 
 
 /*
  * 'httpMD5()' - Compute the MD5 sum of the username:group:password.
+ *
+ * @deprecated@
  */
 
 char *					/* O - MD5 sum */
@@ -31,7 +34,6 @@ httpMD5(const char *username,		/* I - User name */
         const char *passwd,		/* I - Password string */
 	char       md5[33])		/* O - MD5 string */
 {
-  _cups_md5_state_t	state;		/* MD5 state info */
   unsigned char		sum[16];	/* Sum data */
   char			line[256];	/* Line to sum */
 
@@ -41,15 +43,13 @@ httpMD5(const char *username,		/* I - User name */
   */
 
   snprintf(line, sizeof(line), "%s:%s:%s", username, realm, passwd);
-  _cupsMD5Init(&state);
-  _cupsMD5Append(&state, (unsigned char *)line, (int)strlen(line));
-  _cupsMD5Finish(&state, sum);
+  cupsHashData("md5", (unsigned char *)line, strlen(line), sum, sizeof(sum));
 
  /*
   * Return the sum...
   */
 
-  return (httpMD5String(sum, md5));
+  return ((char *)cupsHashString(sum, sizeof(sum), md5, 33));
 }
 
 
@@ -57,6 +57,8 @@ httpMD5(const char *username,		/* I - User name */
  * 'httpMD5Final()' - Combine the MD5 sum of the username, group, and password
  *                    with the server-supplied nonce value, method, and
  *                    request-uri.
+ *
+ * @deprecated@
  */
 
 char *					/* O - New sum */
@@ -65,7 +67,6 @@ httpMD5Final(const char *nonce,		/* I - Server nonce value */
 	     const char *resource,	/* I - Resource path */
              char       md5[33])	/* IO - MD5 sum */
 {
-  _cups_md5_state_t	state;		/* MD5 state info */
   unsigned char		sum[16];	/* Sum data */
   char			line[1024];	/* Line of data */
   char			a2[33];		/* Hash of method and resource */
@@ -76,10 +77,8 @@ httpMD5Final(const char *nonce,		/* I - Server nonce value */
   */
 
   snprintf(line, sizeof(line), "%s:%s", method, resource);
-  _cupsMD5Init(&state);
-  _cupsMD5Append(&state, (unsigned char *)line, (int)strlen(line));
-  _cupsMD5Finish(&state, sum);
-  httpMD5String(sum, a2);
+  cupsHashData("md5", (unsigned char *)line, strlen(line), sum, sizeof(sum));
+  cupsHashString(sum, sizeof(sum), a2, sizeof(a2));
 
  /*
   * Then combine A1 (MD5 of username, realm, and password) with the nonce
@@ -88,17 +87,16 @@ httpMD5Final(const char *nonce,		/* I - Server nonce value */
   */
 
   snprintf(line, sizeof(line), "%s:%s:%s", md5, nonce, a2);
+  cupsHashData("md5", (unsigned char *)line, strlen(line), sum, sizeof(sum));
 
-  _cupsMD5Init(&state);
-  _cupsMD5Append(&state, (unsigned char *)line, (int)strlen(line));
-  _cupsMD5Finish(&state, sum);
-
-  return (httpMD5String(sum, md5));
+  return ((char *)cupsHashString(sum, sizeof(sum), md5, 33));
 }
 
 
 /*
  * 'httpMD5String()' - Convert an MD5 sum to a character string.
+ *
+ * @deprecated@
  */
 
 char *					/* O - MD5 sum in hex */
@@ -106,23 +104,5 @@ httpMD5String(const unsigned char *sum,	/* I - MD5 sum data */
               char                md5[33])
 					/* O - MD5 sum in hex */
 {
-  int		i;			/* Looping var */
-  char		*md5ptr;		/* Pointer into MD5 string */
-  static const char hex[] = "0123456789abcdef";
-					/* Hex digits */
-
-
- /*
-  * Convert the MD5 sum to hexadecimal...
-  */
-
-  for (i = 16, md5ptr = md5; i > 0; i --, sum ++)
-  {
-    *md5ptr++ = hex[*sum >> 4];
-    *md5ptr++ = hex[*sum & 15];
-  }
-
-  *md5ptr = '\0';
-
-  return (md5);
+  return ((char *)cupsHashString(sum, 16, md5, 33));
 }

cups/ppd-cache.c

@@ -1,7 +1,7 @@
 /*
  * PPD cache implementation for CUPS.
  *
- * Copyright 2010-2017 by Apple Inc.
+ * Copyright © 2010-2019 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -290,11 +290,11 @@ _cupsConvertOptions(
     ippAddString(request, IPP_TAG_JOB, IPP_TAG_KEYWORD, "sides", NULL, keyword);
   else if (pc->sides_option && (choice = ppdFindMarkedChoice(ppd, pc->sides_option)) != NULL)
   {
-    if (!_cups_strcasecmp(choice->choice, pc->sides_1sided))
+    if (pc->sides_1sided && !_cups_strcasecmp(choice->choice, pc->sides_1sided))
       ippAddString(request, IPP_TAG_JOB, IPP_TAG_KEYWORD, "sides", NULL, "one-sided");
-    else if (!_cups_strcasecmp(choice->choice, pc->sides_2sided_long))
+    else if (pc->sides_2sided_long && !_cups_strcasecmp(choice->choice, pc->sides_2sided_long))
       ippAddString(request, IPP_TAG_JOB, IPP_TAG_KEYWORD, "sides", NULL, "two-sided-long-edge");
-    if (!_cups_strcasecmp(choice->choice, pc->sides_2sided_short))
+    else if (pc->sides_2sided_short && !_cups_strcasecmp(choice->choice, pc->sides_2sided_short))
       ippAddString(request, IPP_TAG_JOB, IPP_TAG_KEYWORD, "sides", NULL, "two-sided-short-edge");
   }
 
@@ -508,24 +508,20 @@ _ppdCacheCreateWithFile(
     else if (!_cups_strcasecmp(line, "Filter"))
     {
       if (!pc->filters)
-        pc->filters = cupsArrayNew3(NULL, NULL, NULL, 0,
-	                            (cups_acopy_func_t)_cupsStrAlloc,
-				    (cups_afree_func_t)_cupsStrFree);
+        pc->filters = cupsArrayNew3(NULL, NULL, NULL, 0, (cups_acopy_func_t)strdup, (cups_afree_func_t)free);
 
       cupsArrayAdd(pc->filters, value);
     }
     else if (!_cups_strcasecmp(line, "PreFilter"))
     {
       if (!pc->prefilters)
-        pc->prefilters = cupsArrayNew3(NULL, NULL, NULL, 0,
-	                               (cups_acopy_func_t)_cupsStrAlloc,
-				       (cups_afree_func_t)_cupsStrFree);
+        pc->prefilters = cupsArrayNew3(NULL, NULL, NULL, 0, (cups_acopy_func_t)strdup, (cups_afree_func_t)free);
 
       cupsArrayAdd(pc->prefilters, value);
     }
     else if (!_cups_strcasecmp(line, "Product"))
     {
-      pc->product = _cupsStrAlloc(value);
+      pc->product = strdup(value);
     }
     else if (!_cups_strcasecmp(line, "SingleFile"))
     {
@@ -625,8 +621,8 @@ _ppdCacheCreateWithFile(
       }
 
       map      = pc->bins + pc->num_bins;
-      map->pwg = _cupsStrAlloc(pwg_keyword);
-      map->ppd = _cupsStrAlloc(ppd_keyword);
+      map->pwg = strdup(pwg_keyword);
+      map->ppd = strdup(ppd_keyword);
 
       pc->num_bins ++;
     }
@@ -680,8 +676,8 @@ _ppdCacheCreateWithFile(
 	goto create_error;
       }
 
-      size->map.pwg = _cupsStrAlloc(pwg_keyword);
-      size->map.ppd = _cupsStrAlloc(ppd_keyword);
+      size->map.pwg = strdup(pwg_keyword);
+      size->map.ppd = strdup(ppd_keyword);
 
       pc->num_sizes ++;
     }
@@ -709,15 +705,15 @@ _ppdCacheCreateWithFile(
 
       pwgFormatSizeName(pwg_keyword, sizeof(pwg_keyword), "custom", "max",
 		        pc->custom_max_width, pc->custom_max_length, NULL);
-      pc->custom_max_keyword = _cupsStrAlloc(pwg_keyword);
+      pc->custom_max_keyword = strdup(pwg_keyword);
 
       pwgFormatSizeName(pwg_keyword, sizeof(pwg_keyword), "custom", "min",
 		        pc->custom_min_width, pc->custom_min_length, NULL);
-      pc->custom_min_keyword = _cupsStrAlloc(pwg_keyword);
+      pc->custom_min_keyword = strdup(pwg_keyword);
     }
     else if (!_cups_strcasecmp(line, "SourceOption"))
     {
-      pc->source_option = _cupsStrAlloc(value);
+      pc->source_option = strdup(value);
     }
     else if (!_cups_strcasecmp(line, "NumSources"))
     {
@@ -764,8 +760,8 @@ _ppdCacheCreateWithFile(
       }
 
       map      = pc->sources + pc->num_sources;
-      map->pwg = _cupsStrAlloc(pwg_keyword);
-      map->ppd = _cupsStrAlloc(ppd_keyword);
+      map->pwg = strdup(pwg_keyword);
+      map->ppd = strdup(ppd_keyword);
 
       pc->num_sources ++;
     }
@@ -813,8 +809,8 @@ _ppdCacheCreateWithFile(
       }
 
       map      = pc->types + pc->num_types;
-      map->pwg = _cupsStrAlloc(pwg_keyword);
-      map->ppd = _cupsStrAlloc(ppd_keyword);
+      map->pwg = strdup(pwg_keyword);
+      map->ppd = strdup(ppd_keyword);
 
       pc->num_types ++;
     }
@@ -844,13 +840,13 @@ _ppdCacheCreateWithFile(
 	                   pc->presets[print_color_mode] + print_quality);
     }
     else if (!_cups_strcasecmp(line, "SidesOption"))
-      pc->sides_option = _cupsStrAlloc(value);
+      pc->sides_option = strdup(value);
     else if (!_cups_strcasecmp(line, "Sides1Sided"))
-      pc->sides_1sided = _cupsStrAlloc(value);
+      pc->sides_1sided = strdup(value);
     else if (!_cups_strcasecmp(line, "Sides2SidedLong"))
-      pc->sides_2sided_long = _cupsStrAlloc(value);
+      pc->sides_2sided_long = strdup(value);
     else if (!_cups_strcasecmp(line, "Sides2SidedShort"))
-      pc->sides_2sided_short = _cupsStrAlloc(value);
+      pc->sides_2sided_short = strdup(value);
     else if (!_cups_strcasecmp(line, "Finishings"))
     {
       if (!pc->finishings)
@@ -871,13 +867,13 @@ _ppdCacheCreateWithFile(
     else if (!_cups_strcasecmp(line, "MaxCopies"))
       pc->max_copies = atoi(value);
     else if (!_cups_strcasecmp(line, "ChargeInfoURI"))
-      pc->charge_info_uri = _cupsStrAlloc(value);
+      pc->charge_info_uri = strdup(value);
     else if (!_cups_strcasecmp(line, "JobAccountId"))
       pc->account_id = !_cups_strcasecmp(value, "true");
     else if (!_cups_strcasecmp(line, "JobAccountingUserId"))
       pc->accounting_user_id = !_cups_strcasecmp(value, "true");
     else if (!_cups_strcasecmp(line, "JobPassword"))
-      pc->password = _cupsStrAlloc(value);
+      pc->password = strdup(value);
     else if (!_cups_strcasecmp(line, "Mandatory"))
     {
       if (pc->mandatory)
@@ -888,9 +884,7 @@ _ppdCacheCreateWithFile(
     else if (!_cups_strcasecmp(line, "SupportFile"))
     {
       if (!pc->support_files)
-        pc->support_files = cupsArrayNew3(NULL, NULL, NULL, 0,
-                                          (cups_acopy_func_t)_cupsStrAlloc,
-                                          (cups_afree_func_t)_cupsStrFree);
+        pc->support_files = cupsArrayNew3(NULL, NULL, NULL, 0, (cups_acopy_func_t)strdup, (cups_afree_func_t)free);
 
       cupsArrayAdd(pc->support_files, value);
     }
@@ -1130,8 +1124,8 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
 	  */
 
 	  new_size = old_size;
-	  _cupsStrFree(old_size->map.ppd);
-	  _cupsStrFree(old_size->map.pwg);
+	  free(old_size->map.ppd);
+	  free(old_size->map.pwg);
 	}
       }
 
@@ -1152,8 +1146,8 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
 	* Save this size...
 	*/
 
-	new_size->map.ppd = _cupsStrAlloc(ppd_size->name);
-	new_size->map.pwg = _cupsStrAlloc(pwg_name);
+	new_size->map.ppd = strdup(ppd_size->name);
+	new_size->map.pwg = strdup(pwg_name);
 	new_size->width   = new_width;
 	new_size->length  = new_length;
 	new_size->left    = new_left;
@@ -1173,14 +1167,14 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
     pwgFormatSizeName(pwg_keyword, sizeof(pwg_keyword), "custom", "max",
 		      PWG_FROM_POINTS(ppd->custom_max[0]),
 		      PWG_FROM_POINTS(ppd->custom_max[1]), NULL);
-    pc->custom_max_keyword = _cupsStrAlloc(pwg_keyword);
+    pc->custom_max_keyword = strdup(pwg_keyword);
     pc->custom_max_width   = PWG_FROM_POINTS(ppd->custom_max[0]);
     pc->custom_max_length  = PWG_FROM_POINTS(ppd->custom_max[1]);
 
     pwgFormatSizeName(pwg_keyword, sizeof(pwg_keyword), "custom", "min",
 		      PWG_FROM_POINTS(ppd->custom_min[0]),
 		      PWG_FROM_POINTS(ppd->custom_min[1]), NULL);
-    pc->custom_min_keyword = _cupsStrAlloc(pwg_keyword);
+    pc->custom_min_keyword = strdup(pwg_keyword);
     pc->custom_min_width   = PWG_FROM_POINTS(ppd->custom_min[0]);
     pc->custom_min_length  = PWG_FROM_POINTS(ppd->custom_min[1]);
 
@@ -1199,7 +1193,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
 
   if (input_slot)
   {
-    pc->source_option = _cupsStrAlloc(input_slot->keyword);
+    pc->source_option = strdup(input_slot->keyword);
 
     if ((pc->sources = calloc((size_t)input_slot->num_choices, sizeof(pwg_map_t))) == NULL)
     {
@@ -1251,8 +1245,8 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
 	                  "_");
       }
 
-      map->pwg = _cupsStrAlloc(pwg_name);
-      map->ppd = _cupsStrAlloc(choice->choice);
+      map->pwg = strdup(pwg_name);
+      map->ppd = strdup(choice->choice);
     }
   }
 
@@ -1315,8 +1309,8 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
 	                  "_");
       }
 
-      map->pwg = _cupsStrAlloc(pwg_name);
-      map->ppd = _cupsStrAlloc(choice->choice);
+      map->pwg = strdup(pwg_name);
+      map->ppd = strdup(choice->choice);
     }
   }
 
@@ -1342,8 +1336,8 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
     {
       pwg_unppdize_name(choice->choice, pwg_keyword, sizeof(pwg_keyword), "_");
 
-      map->pwg = _cupsStrAlloc(pwg_keyword);
-      map->ppd = _cupsStrAlloc(choice->choice);
+      map->pwg = strdup(pwg_keyword);
+      map->ppd = strdup(choice->choice);
     }
   }
 
@@ -1558,7 +1552,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
 
   if (duplex)
   {
-    pc->sides_option = _cupsStrAlloc(duplex->keyword);
+    pc->sides_option = strdup(duplex->keyword);
 
     for (i = duplex->num_choices, choice = duplex->choices;
          i > 0;
@@ -1566,16 +1560,16 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
     {
       if ((!_cups_strcasecmp(choice->choice, "None") ||
 	   !_cups_strcasecmp(choice->choice, "False")) && !pc->sides_1sided)
-        pc->sides_1sided = _cupsStrAlloc(choice->choice);
+        pc->sides_1sided = strdup(choice->choice);
       else if ((!_cups_strcasecmp(choice->choice, "DuplexNoTumble") ||
 	        !_cups_strcasecmp(choice->choice, "LongEdge") ||
 	        !_cups_strcasecmp(choice->choice, "Top")) && !pc->sides_2sided_long)
-        pc->sides_2sided_long = _cupsStrAlloc(choice->choice);
+        pc->sides_2sided_long = strdup(choice->choice);
       else if ((!_cups_strcasecmp(choice->choice, "DuplexTumble") ||
 	        !_cups_strcasecmp(choice->choice, "ShortEdge") ||
 	        !_cups_strcasecmp(choice->choice, "Bottom")) &&
 	       !pc->sides_2sided_short)
-        pc->sides_2sided_short = _cupsStrAlloc(choice->choice);
+        pc->sides_2sided_short = strdup(choice->choice);
     }
   }
 
@@ -1583,9 +1577,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
   * Copy filters and pre-filters...
   */
 
-  pc->filters = cupsArrayNew3(NULL, NULL, NULL, 0,
-			      (cups_acopy_func_t)_cupsStrAlloc,
-			      (cups_afree_func_t)_cupsStrFree);
+  pc->filters = cupsArrayNew3(NULL, NULL, NULL, 0, (cups_acopy_func_t)strdup, (cups_afree_func_t)free);
 
   cupsArrayAdd(pc->filters,
                "application/vnd.cups-raw application/octet-stream 0 -");
@@ -1642,9 +1634,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
 
   if ((ppd_attr = ppdFindAttr(ppd, "cupsPreFilter", NULL)) != NULL)
   {
-    pc->prefilters = cupsArrayNew3(NULL, NULL, NULL, 0,
-				   (cups_acopy_func_t)_cupsStrAlloc,
-				   (cups_afree_func_t)_cupsStrFree);
+    pc->prefilters = cupsArrayNew3(NULL, NULL, NULL, 0, (cups_acopy_func_t)strdup, (cups_afree_func_t)free);
 
     do
     {
@@ -1661,7 +1651,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
   */
 
   if (ppd->product)
-    pc->product = _cupsStrAlloc(ppd->product);
+    pc->product = strdup(ppd->product);
 
  /*
   * Copy finishings mapping data...
@@ -1818,7 +1808,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
   */
 
   if ((ppd_attr = ppdFindAttr(ppd, "cupsChargeInfoURI", NULL)) != NULL)
-    pc->charge_info_uri = _cupsStrAlloc(ppd_attr->value);
+    pc->charge_info_uri = strdup(ppd_attr->value);
 
   if ((ppd_attr = ppdFindAttr(ppd, "cupsJobAccountId", NULL)) != NULL)
     pc->account_id = !_cups_strcasecmp(ppd_attr->value, "true");
@@ -1827,7 +1817,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
     pc->accounting_user_id = !_cups_strcasecmp(ppd_attr->value, "true");
 
   if ((ppd_attr = ppdFindAttr(ppd, "cupsJobPassword", NULL)) != NULL)
-    pc->password = _cupsStrAlloc(ppd_attr->value);
+    pc->password = strdup(ppd_attr->value);
 
   if ((ppd_attr = ppdFindAttr(ppd, "cupsMandatory", NULL)) != NULL)
     pc->mandatory = _cupsArrayNewStrings(ppd_attr->value, ' ');
@@ -1836,9 +1826,7 @@ _ppdCacheCreateWithPPD(ppd_file_t *ppd)	/* I - PPD file */
   * Support files...
   */
 
-  pc->support_files = cupsArrayNew3(NULL, NULL, NULL, 0,
-				    (cups_acopy_func_t)_cupsStrAlloc,
-				    (cups_afree_func_t)_cupsStrFree);
+  pc->support_files = cupsArrayNew3(NULL, NULL, NULL, 0, (cups_acopy_func_t)strdup, (cups_afree_func_t)free);
 
   for (ppd_attr = ppdFindAttr(ppd, "cupsICCProfile", NULL);
        ppd_attr;
@@ -1894,8 +1882,8 @@ _ppdCacheDestroy(_ppd_cache_t *pc)	/* I - PPD cache and mapping data */
   {
     for (i = pc->num_bins, map = pc->bins; i > 0; i --, map ++)
     {
-      _cupsStrFree(map->pwg);
-      _cupsStrFree(map->ppd);
+      free(map->pwg);
+      free(map->ppd);
     }
 
     free(pc->bins);
@@ -1905,22 +1893,21 @@ _ppdCacheDestroy(_ppd_cache_t *pc)	/* I - PPD cache and mapping data */
   {
     for (i = pc->num_sizes, size = pc->sizes; i > 0; i --, size ++)
     {
-      _cupsStrFree(size->map.pwg);
-      _cupsStrFree(size->map.ppd);
+      free(size->map.pwg);
+      free(size->map.ppd);
     }
 
     free(pc->sizes);
   }
 
-  if (pc->source_option)
-    _cupsStrFree(pc->source_option);
+  free(pc->source_option);
 
   if (pc->sources)
   {
     for (i = pc->num_sources, map = pc->sources; i > 0; i --, map ++)
     {
-      _cupsStrFree(map->pwg);
-      _cupsStrFree(map->ppd);
+      free(map->pwg);
+      free(map->ppd);
     }
 
     free(pc->sources);
@@ -1930,26 +1917,23 @@ _ppdCacheDestroy(_ppd_cache_t *pc)	/* I - PPD cache and mapping data */
   {
     for (i = pc->num_types, map = pc->types; i > 0; i --, map ++)
     {
-      _cupsStrFree(map->pwg);
-      _cupsStrFree(map->ppd);
+      free(map->pwg);
+      free(map->ppd);
     }
 
     free(pc->types);
   }
 
-  if (pc->custom_max_keyword)
-    _cupsStrFree(pc->custom_max_keyword);
+  free(pc->custom_max_keyword);
+  free(pc->custom_min_keyword);
 
-  if (pc->custom_min_keyword)
-    _cupsStrFree(pc->custom_min_keyword);
-
-  _cupsStrFree(pc->product);
+  free(pc->product);
   cupsArrayDelete(pc->filters);
   cupsArrayDelete(pc->prefilters);
   cupsArrayDelete(pc->finishings);
 
-  _cupsStrFree(pc->charge_info_uri);
-  _cupsStrFree(pc->password);
+  free(pc->charge_info_uri);
+  free(pc->password);
 
   cupsArrayDelete(pc->mandatory);
 
@@ -2105,7 +2089,7 @@ _ppdCacheGetFinishingValues(
        f;
        f = (_pwg_finishings_t *)cupsArrayNext(pc->finishings))
   {
-    DEBUG_printf(("_ppdCacheGetFinishingValues: Checking %d (%s)", f->value, ippEnumString("finishings", f->value)));
+    DEBUG_printf(("_ppdCacheGetFinishingValues: Checking %d (%s)", (int)f->value, ippEnumString("finishings", (int)f->value)));
 
     for (i = f->num_options, option = f->options; i > 0; i --, option ++)
     {
@@ -2121,9 +2105,9 @@ _ppdCacheGetFinishingValues(
 
     if (i == 0)
     {
-      DEBUG_printf(("_ppdCacheGetFinishingValues: Adding %d (%s)", f->value, ippEnumString("finishings", f->value)));
+      DEBUG_printf(("_ppdCacheGetFinishingValues: Adding %d (%s)", (int)f->value, ippEnumString("finishings", (int)f->value)));
 
-      values[num_values ++] = f->value;
+      values[num_values ++] = (int)f->value;
 
       if (num_values >= max_values)
         break;
@@ -2887,12 +2871,12 @@ _ppdCacheWriteFile(
   if (pc->charge_info_uri)
     cupsFilePutConf(fp, "ChargeInfoURI", pc->charge_info_uri);
 
-  cupsFilePrintf(fp, "AccountId %s\n", pc->account_id ? "true" : "false");
-  cupsFilePrintf(fp, "AccountingUserId %s\n",
+  cupsFilePrintf(fp, "JobAccountId %s\n", pc->account_id ? "true" : "false");
+  cupsFilePrintf(fp, "JobAccountingUserId %s\n",
                  pc->accounting_user_id ? "true" : "false");
 
   if (pc->password)
-    cupsFilePutConf(fp, "Password", pc->password);
+    cupsFilePutConf(fp, "JobPassword", pc->password);
 
   for (value = (char *)cupsArrayFirst(pc->mandatory);
        value;
@@ -3105,8 +3089,8 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
   cupsFilePrintf(fp, "*Manufacturer: \"%s\"\n", make);
   cupsFilePrintf(fp, "*ModelName: \"%s\"\n", model);
   cupsFilePrintf(fp, "*Product: \"(%s)\"\n", model);
-  cupsFilePrintf(fp, "*NickName: \"%s\"\n", model);
-  cupsFilePrintf(fp, "*ShortNickName: \"%s\"\n", model);
+  cupsFilePrintf(fp, "*NickName: \"%s - IPP Everywhere\"\n", model);
+  cupsFilePrintf(fp, "*ShortNickName: \"%s - IPP Everywhere\"\n", model);
 
   if ((attr = ippFindAttribute(response, "color-supported", IPP_TAG_BOOLEAN)) != NULL && ippGetBoolean(attr, 0))
     cupsFilePuts(fp, "*ColorDevice: True\n");
@@ -3117,6 +3101,57 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
   cupsFilePuts(fp, "*cupsSNMPSupplies: False\n");
   cupsFilePuts(fp, "*cupsLanguages: \"en\"\n");
 
+  if ((attr = ippFindAttribute(response, "printer-more-info", IPP_TAG_URI)) != NULL)
+    cupsFilePrintf(fp, "*APSupplies: \"%s\"\n", ippGetString(attr, 0, NULL));
+
+  if ((attr = ippFindAttribute(response, "printer-charge-info-uri", IPP_TAG_URI)) != NULL)
+    cupsFilePrintf(fp, "*cupsChargeInfoURI: \"%s\"\n", ippGetString(attr, 0, NULL));
+
+ /*
+  * Accounting...
+  */
+
+  if (ippGetBoolean(ippFindAttribute(response, "job-account-id-supported", IPP_TAG_BOOLEAN), 0))
+    cupsFilePuts(fp, "*cupsJobAccountId: True\n");
+
+  if (ippGetBoolean(ippFindAttribute(response, "job-accounting-user-id-supported", IPP_TAG_BOOLEAN), 0))
+    cupsFilePuts(fp, "*cupsJobAccountingUserId: True\n");
+
+ /*
+  * Password/PIN printing...
+  */
+
+  if ((attr = ippFindAttribute(response, "job-password-supported", IPP_TAG_INTEGER)) != NULL)
+  {
+    char	pattern[33];		/* Password pattern */
+    int		maxlen = ippGetInteger(attr, 0);
+					/* Maximum length */
+    const char	*repertoire = ippGetString(ippFindAttribute(response, "job-password-repertoire-configured", IPP_TAG_KEYWORD), 0, NULL);
+					/* Type of password */
+
+    if (maxlen > (int)(sizeof(pattern) - 1))
+      maxlen = (int)sizeof(pattern) - 1;
+
+    if (!repertoire || !strcmp(repertoire, "iana_us-ascii_digits"))
+      memset(pattern, '1', (size_t)maxlen);
+    else if (!strcmp(repertoire, "iana_us-ascii_letters"))
+      memset(pattern, 'A', (size_t)maxlen);
+    else if (!strcmp(repertoire, "iana_us-ascii_complex"))
+      memset(pattern, 'C', (size_t)maxlen);
+    else if (!strcmp(repertoire, "iana_us-ascii_any"))
+      memset(pattern, '.', (size_t)maxlen);
+    else if (!strcmp(repertoire, "iana_utf-8_digits"))
+      memset(pattern, 'N', (size_t)maxlen);
+    else if (!strcmp(repertoire, "iana_utf-8_letters"))
+      memset(pattern, 'U', (size_t)maxlen);
+    else
+      memset(pattern, '*', (size_t)maxlen);
+
+    pattern[maxlen] = '\0';
+
+    cupsFilePrintf(fp, "*cupsJobPassword: \"%s\"\n", pattern);
+  }
+
  /*
   * Filters...
   */
@@ -3125,24 +3160,30 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
   {
     is_apple = ippContainsString(attr, "image/urf");
     is_pdf   = ippContainsString(attr, "application/pdf");
-    is_pwg   = ippContainsString(attr, "image/pwg-raster");
+    is_pwg   = ippContainsString(attr, "image/pwg-raster") && !is_apple;
 
-    for (i = 0, count = ippGetCount(attr); i < count; i ++)
+    if (ippContainsString(attr, "image/jpeg"))
+      cupsFilePuts(fp, "*cupsFilter2: \"image/jpeg image/jpeg 0 -\"\n");
+    if (ippContainsString(attr, "image/png"))
+      cupsFilePuts(fp, "*cupsFilter2: \"image/png image/png 0 -\"\n");
+    if (is_pdf)
     {
-      const char *format = ippGetString(attr, i, NULL);
-					/* PDL */
-
      /*
-      * Write cupsFilter2 lines for supported formats...
+      * Don't locally filter PDF content when printing to a CUPS shared
+      * printer, otherwise the options will be applied twice...
       */
 
-      if (!_cups_strcasecmp(format, "application/pdf"))
+      if (ippContainsString(attr, "application/vnd.cups-pdf"))
+        cupsFilePuts(fp, "*cupsFilter2: \"application/pdf application/pdf 0 -\"\n");
+      else
         cupsFilePuts(fp, "*cupsFilter2: \"application/vnd.cups-pdf application/pdf 10 -\"\n");
-      else if (!_cups_strcasecmp(format, "image/jpeg") || !_cups_strcasecmp(format, "image/png"))
-        cupsFilePrintf(fp, "*cupsFilter2: \"%s %s 0 -\"\n", format, format);
-      else if (!_cups_strcasecmp(format, "image/pwg-raster") || !_cups_strcasecmp(format, "image/urf"))
-        cupsFilePrintf(fp, "*cupsFilter2: \"%s %s 100 -\"\n", format, format);
     }
+    else
+      cupsFilePuts(fp, "*cupsManualCopies: true\n");
+    if (is_apple)
+      cupsFilePuts(fp, "*cupsFilter2: \"image/urf image/urf 100 -\"\n");
+    if (is_pwg)
+      cupsFilePuts(fp, "*cupsFilter2: \"image/pwg-raster image/pwg-raster 100 -\"\n");
   }
 
   if (!is_apple && !is_pdf && !is_pwg)
@@ -3414,7 +3455,8 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
       for (j = 0; j < (int)(sizeof(sources) / sizeof(sources[0])); j ++)
         if (!strcmp(sources[j][0], ppdname))
 	{
-	  cupsFilePrintf(fp, "*InputSlot %s/%s: \"<</MediaPosition %d>>setpagedevice\"\n", ppdname, _cupsLangString(lang, sources[j][1]), j);
+	  cupsFilePrintf(fp, "*InputSlot %s: \"<</MediaPosition %d>>setpagedevice\"\n", ppdname, j);
+	  cupsFilePrintf(fp, "*%s.InputSlot %s/%s: \"\"\n", lang->language, ppdname, _cupsLangString(lang, sources[j][1]));
 	  break;
 	}
     }
@@ -3590,9 +3632,14 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
           break;
 
       if (j < (int)(sizeof(media_types) / sizeof(media_types[0])))
-        cupsFilePrintf(fp, "*MediaType %s/%s: \"<</MediaType(%s)>>setpagedevice\"\n", ppdname, _cupsLangString(lang, media_types[j][1]), ppdname);
+      {
+        cupsFilePrintf(fp, "*MediaType %s: \"<</MediaType(%s)>>setpagedevice\"\n", ppdname, ppdname);
+        cupsFilePrintf(fp, "*%s.MediaType %s/%s: \"\"\n", lang->language, ppdname, _cupsLangString(lang, media_types[j][1]));
+      }
       else
+      {
         cupsFilePrintf(fp, "*MediaType %s/%s: \"<</MediaType(%s)>>setpagedevice\"\n", ppdname, keyword, ppdname);
+      }
     }
     cupsFilePuts(fp, "*CloseUI: *MediaType\n");
   }
@@ -3618,10 +3665,11 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
       if (!strcasecmp(keyword, "black_1") || !strcmp(keyword, "bi-level") || !strcmp(keyword, "process-bi-level"))
       {
         if (!default_color)
-	  cupsFilePrintf(fp, "*OpenUI *ColorModel/%s: PickOne\n"
-			     "*OrderDependency: 10 AnySetup *ColorModel\n", _cupsLangString(lang, _("Color Mode")));
+	  cupsFilePrintf(fp, "*OpenUI *ColorModel: PickOne\n"
+			     "*OrderDependency: 10 AnySetup *ColorModel\n"
+			     "*%s.Translation ColorModel/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Color Mode")));
 
-        cupsFilePrintf(fp, "*ColorModel FastGray/%s: \"<</cupsColorSpace 3/cupsBitsPerColor 1/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n", _cupsLangString(lang, _("Fast Grayscale")));
+        cupsFilePrintf(fp, "*ColorModel FastGray: \"<</cupsColorSpace 3/cupsBitsPerColor 1/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n*%s.ColorModel FastGray/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Fast Grayscale")));
 
         if (!default_color)
 	  default_color = "FastGray";
@@ -3629,10 +3677,11 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
       else if (!strcasecmp(keyword, "sgray_8") || !strcmp(keyword, "W8") || !strcmp(keyword, "monochrome") || !strcmp(keyword, "process-monochrome"))
       {
         if (!default_color)
-	  cupsFilePrintf(fp, "*OpenUI *ColorModel/%s: PickOne\n"
-			     "*OrderDependency: 10 AnySetup *ColorModel\n", _cupsLangString(lang, _("Color Mode")));
+	  cupsFilePrintf(fp, "*OpenUI *ColorModel: PickOne\n"
+			     "*OrderDependency: 10 AnySetup *ColorModel\n"
+			     "*%s.Translation ColorModel/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Color Mode")));
 
-        cupsFilePrintf(fp, "*ColorModel Gray/%s: \"<</cupsColorSpace 18/cupsBitsPerColor 8/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n", _cupsLangString(lang, _("Grayscale")));
+        cupsFilePrintf(fp, "*ColorModel Gray: \"<</cupsColorSpace 18/cupsBitsPerColor 8/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n*%s.ColorModel Gray/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Grayscale")));
 
         if (!default_color || !strcmp(default_color, "FastGray"))
 	  default_color = "Gray";
@@ -3640,20 +3689,22 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
       else if (!strcasecmp(keyword, "srgb_8") || !strcmp(keyword, "SRGB24") || !strcmp(keyword, "color"))
       {
         if (!default_color)
-	  cupsFilePrintf(fp, "*OpenUI *ColorModel/%s: PickOne\n"
-			     "*OrderDependency: 10 AnySetup *ColorModel\n", _cupsLangString(lang, _("Color Mode")));
+	  cupsFilePrintf(fp, "*OpenUI *ColorModel: PickOne\n"
+			     "*OrderDependency: 10 AnySetup *ColorModel\n"
+			     "*%s.Translation ColorModel/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Color Mode")));
 
-        cupsFilePrintf(fp, "*ColorModel RGB/%s: \"<</cupsColorSpace 19/cupsBitsPerColor 8/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n", _cupsLangString(lang, _("Color")));
+        cupsFilePrintf(fp, "*ColorModel RGB: \"<</cupsColorSpace 19/cupsBitsPerColor 8/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n*%s.ColorModel RGB/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Color")));
 
 	default_color = "RGB";
       }
       else if (!strcasecmp(keyword, "adobe-rgb_16") || !strcmp(keyword, "ADOBERGB48"))
       {
         if (!default_color)
-	  cupsFilePrintf(fp, "*OpenUI *ColorModel/%s: PickOne\n"
-			     "*OrderDependency: 10 AnySetup *ColorModel\n", _cupsLangString(lang, _("Color Mode")));
+	  cupsFilePrintf(fp, "*OpenUI *ColorModel: PickOne\n"
+			     "*OrderDependency: 10 AnySetup *ColorModel\n"
+			     "*%s.Translation ColorModel/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Color Mode")));
 
-        cupsFilePrintf(fp, "*ColorModel AdobeRGB/%s: \"<</cupsColorSpace 20/cupsBitsPerColor 16/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n", _cupsLangString(lang, _("Deep Color")));
+        cupsFilePrintf(fp, "*ColorModel AdobeRGB: \"<</cupsColorSpace 20/cupsBitsPerColor 16/cupsColorOrder 0/cupsCompression 0>>setpagedevice\"\n*%s.ColorModel AdobeRGB/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Deep Color")));
 
         if (!default_color)
 	  default_color = "AdobeRGB";
@@ -3673,13 +3724,17 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
   if ((attr = ippFindAttribute(response, "sides-supported", IPP_TAG_KEYWORD)) != NULL && ippContainsString(attr, "two-sided-long-edge"))
   {
-    cupsFilePrintf(fp, "*OpenUI *Duplex/%s: PickOne\n"
+    cupsFilePrintf(fp, "*OpenUI *Duplex: PickOne\n"
 		       "*OrderDependency: 10 AnySetup *Duplex\n"
+		       "*%s.Translation Duplex/%s: \"\"\n"
 		       "*DefaultDuplex: None\n"
-		       "*Duplex None/%s: \"<</Duplex false>>setpagedevice\"\n"
-		       "*Duplex DuplexNoTumble/%s: \"<</Duplex true/Tumble false>>setpagedevice\"\n"
-		       "*Duplex DuplexTumble/%s: \"<</Duplex true/Tumble true>>setpagedevice\"\n"
-		       "*CloseUI: *Duplex\n", _cupsLangString(lang, _("2-Sided Printing")), _cupsLangString(lang, _("Off (1-Sided)")), _cupsLangString(lang, _("Long-Edge (Portrait)")), _cupsLangString(lang, _("Short-Edge (Landscape)")));
+		       "*Duplex None: \"<</Duplex false>>setpagedevice\"\n"
+		       "*%s.Duplex None/%s: \"\"\n"
+		       "*Duplex DuplexNoTumble: \"<</Duplex true/Tumble false>>setpagedevice\"\n"
+		       "*%s.Duplex DuplexNoTumble/%s: \"\"\n"
+		       "*Duplex DuplexTumble: \"<</Duplex true/Tumble true>>setpagedevice\"\n"
+		       "*%s.Duplex DuplexTumble/%s: \"\"\n"
+		       "*CloseUI: *Duplex\n", lang->language, _cupsLangString(lang, _("2-Sided Printing")), lang->language, _cupsLangString(lang, _("Off (1-Sided)")), lang->language, _cupsLangString(lang, _("Long-Edge (Portrait)")), lang->language, _cupsLangString(lang, _("Short-Edge (Landscape)")));
 
     if ((attr = ippFindAttribute(response, "urf-supported", IPP_TAG_KEYWORD)) != NULL)
     {
@@ -3737,6 +3792,12 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
   if ((attr = ippFindAttribute(response, "output-bin-supported", IPP_TAG_ZERO)) != NULL && (count = ippGetCount(attr)) > 1)
   {
+    ipp_attribute_t	*trays = ippFindAttribute(response, "printer-output-tray", IPP_TAG_STRING);
+					/* printer-output-tray attribute, if any */
+    const char		*tray_ptr;	/* printer-output-tray value */
+    int			tray_len;	/* Len of printer-output-tray value */
+    char		tray[IPP_MAX_OCTETSTRING];
+					/* printer-output-tray string value */
     static const char * const output_bins[][2] =
     {					/* "output-bin" strings */
       { "auto", _("Automatic") },
@@ -3787,6 +3848,11 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
     cupsFilePrintf(fp, "*OpenUI *OutputBin: PickOne\n"
                        "*OrderDependency: 10 AnySetup *OutputBin\n"
                        "*DefaultOutputBin: %s\n", ppdname);
+    if (!strcmp(ppdname, "FaceUp"))
+      cupsFilePuts(fp, "*DefaultOutputOrder: Reverse\n");
+    else
+      cupsFilePuts(fp, "*DefaultOutputOrder: Normal\n");
+
     for (i = 0; i < (int)(sizeof(output_bins) / sizeof(output_bins[0])); i ++)
     {
       if (!ippContainsString(attr, output_bins[i][0]))
@@ -3794,7 +3860,26 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
       pwg_ppdize_name(output_bins[i][0], ppdname, sizeof(ppdname));
 
-      cupsFilePrintf(fp, "*OutputBin %s/%s: \"\"\n", ppdname, _cupsLangString(lang, output_bins[i][1]));
+      cupsFilePrintf(fp, "*OutputBin %s: \"\"\n", ppdname);
+      cupsFilePrintf(fp, "*%s.OutputBin %s/%s: \"\"\n", lang->language, ppdname, _cupsLangString(lang, output_bins[i][1]));
+
+      if ((tray_ptr = ippGetOctetString(trays, i, &tray_len)) != NULL)
+      {
+        if (tray_len >= (int)sizeof(tray))
+          tray_len = (int)sizeof(tray) - 1;
+
+        memcpy(tray, tray_ptr, (size_t)tray_len);
+        tray[tray_len] = '\0';
+
+        if (strstr(tray, "stackingorder=lastToFirst;"))
+          cupsFilePrintf(fp, "*PageStackOrder %s: Reverse\n", ppdname);
+        else
+          cupsFilePrintf(fp, "*PageStackOrder %s: Normal\n", ppdname);
+      }
+      else if (!strcmp(ppdname, "FaceUp"))
+	cupsFilePrintf(fp, "*PageStackOrder %s: Reverse\n", ppdname);
+      else
+	cupsFilePrintf(fp, "*PageStackOrder %s: Normal\n", ppdname);
     }
     cupsFilePuts(fp, "*CloseUI: *OutputBin\n");
   }
@@ -3832,10 +3917,12 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
     if (i < count)
     {
-      cupsFilePrintf(fp, "*OpenUI *StapleLocation/%s: PickOne\n", _cupsLangString(lang, _("Staple")));
+      cupsFilePuts(fp, "*OpenUI *StapleLocation: PickOne\n");
       cupsFilePuts(fp, "*OrderDependency: 10 AnySetup *StapleLocation\n");
+      cupsFilePrintf(fp, "*%s.Translation StapleLocation/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Staple")));
       cupsFilePuts(fp, "*DefaultStapleLocation: None\n");
-      cupsFilePrintf(fp, "*StapleLocation None/%s: \"\"\n", _cupsLangString(lang, _("None")));
+      cupsFilePuts(fp, "*StapleLocation None: \"\"\n");
+      cupsFilePrintf(fp, "*%s.StapleLocation None/%s: \"\"\n", lang->language, _cupsLangString(lang, _("None")));
 
       for (; i < count; i ++)
       {
@@ -3854,7 +3941,8 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
         {
           if (!strcmp(finishings[j][0], name))
           {
-            cupsFilePrintf(fp, "*StapleLocation %s/%s: \"\"\n", name, _cupsLangString(lang, finishings[j][1]));
+            cupsFilePrintf(fp, "*StapleLocation %s: \"\"\n", name);
+            cupsFilePrintf(fp, "*%s.StapleLocation %s/%s: \"\"\n", lang->language, name, _cupsLangString(lang, finishings[j][1]));
             cupsFilePrintf(fp, "*cupsIPPFinishings %d/%s: \"*StapleLocation %s\"\n", value, name, name);
             break;
           }
@@ -3879,10 +3967,12 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
     if (i < count)
     {
-      cupsFilePrintf(fp, "*OpenUI *FoldType/%s: PickOne\n", _cupsLangString(lang, _("Fold")));
+      cupsFilePuts(fp, "*OpenUI *FoldType: PickOne\n");
       cupsFilePuts(fp, "*OrderDependency: 10 AnySetup *FoldType\n");
+      cupsFilePrintf(fp, "*%s.Translation FoldType/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Fold")));
       cupsFilePuts(fp, "*DefaultFoldType: None\n");
-      cupsFilePrintf(fp, "*FoldType None/%s: \"\"\n", _cupsLangString(lang, _("None")));
+      cupsFilePuts(fp, "*FoldType None: \"\"\n");
+      cupsFilePrintf(fp, "*%s.FoldType None/%s: \"\"\n", lang->language, _cupsLangString(lang, _("None")));
 
       for (; i < count; i ++)
       {
@@ -3901,7 +3991,8 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
         {
           if (!strcmp(finishings[j][0], name))
           {
-            cupsFilePrintf(fp, "*FoldType %s/%s: \"\"\n", name, _cupsLangString(lang, finishings[j][1]));
+            cupsFilePrintf(fp, "*FoldType %s: \"\"\n", name);
+            cupsFilePrintf(fp, "*%s.FoldType %s/%s: \"\"\n", lang->language, name, _cupsLangString(lang, finishings[j][1]));
             cupsFilePrintf(fp, "*cupsIPPFinishings %d/%s: \"*FoldType %s\"\n", value, name, name);
             break;
           }
@@ -3926,10 +4017,12 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
     if (i < count)
     {
-      cupsFilePrintf(fp, "*OpenUI *PunchMedia/%s: PickOne\n", _cupsLangString(lang, _("Punch")));
+      cupsFilePuts(fp, "*OpenUI *PunchMedia: PickOne\n");
       cupsFilePuts(fp, "*OrderDependency: 10 AnySetup *PunchMedia\n");
+      cupsFilePrintf(fp, "*%s.Translation PunchMedia/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Punch")));
       cupsFilePuts(fp, "*DefaultPunchMedia: None\n");
-      cupsFilePrintf(fp, "*PunchMedia None/%s: \"\"\n", _cupsLangString(lang, _("None")));
+      cupsFilePuts(fp, "*PunchMedia None: \"\"\n");
+      cupsFilePrintf(fp, "*%s.PunchMedia None/%s: \"\"\n", lang->language, _cupsLangString(lang, _("None")));
 
       for (i = 0; i < count; i ++)
       {
@@ -3948,7 +4041,8 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
         {
           if (!strcmp(finishings[j][0], name))
           {
-            cupsFilePrintf(fp, "*PunchMedia %s/%s: \"\"\n", name, _cupsLangString(lang, finishings[j][1]));
+            cupsFilePrintf(fp, "*PunchMedia %s: \"\"\n", name);
+            cupsFilePrintf(fp, "*%s.PunchMedia %s/%s: \"\"\n", lang->language, name, _cupsLangString(lang, finishings[j][1]));
             cupsFilePrintf(fp, "*cupsIPPFinishings %d/%s: \"*PunchMedia %s\"\n", value, name, name);
             break;
           }
@@ -3964,8 +4058,9 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
     if (ippContainsInteger(attr, IPP_FINISHINGS_BOOKLET_MAKER))
     {
-      cupsFilePrintf(fp, "*OpenUI *Booklet/%s: Boolean\n", _cupsLangString(lang, _("Booklet")));
+      cupsFilePuts(fp, "*OpenUI *Booklet: Boolean\n");
       cupsFilePuts(fp, "*OrderDependency: 10 AnySetup *Booklet\n");
+      cupsFilePrintf(fp, "*%s.Translation Booklet/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Booklet")));
       cupsFilePuts(fp, "*DefaultBooklet: False\n");
       cupsFilePuts(fp, "*Booklet False: \"\"\n");
       cupsFilePuts(fp, "*Booklet True: \"\"\n");
@@ -4018,16 +4113,19 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
       cupsFilePrintf(fp, "*DefaultResolution: %ddpi\n", lowdpi);
 
-      cupsFilePrintf(fp, "*OpenUI *cupsPrintQuality/%s: PickOne\n"
-       "*OrderDependency: 10 AnySetup *cupsPrintQuality\n"
-       "*DefaultcupsPrintQuality: Normal\n", _cupsLangString(lang, _("Print Quality")));
+      cupsFilePrintf(fp, "*OpenUI *cupsPrintQuality: PickOne\n"
+			 "*OrderDependency: 10 AnySetup *cupsPrintQuality\n"
+			 "*%s.Translation cupsPrintQuality/%s: \"\"\n"
+			 "*DefaultcupsPrintQuality: Normal\n", lang->language, _cupsLangString(lang, _("Print Quality")));
       if ((lowdpi & 1) == 0)
-  cupsFilePrintf(fp, "*cupsPrintQuality Draft/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("Draft")), lowdpi, lowdpi / 2);
+	cupsFilePrintf(fp, "*cupsPrintQuality Draft: \"<</HWResolution[%d %d]>>setpagedevice\"\n*%s.cupsPrintQuality Draft/%s: \"\"\n", lowdpi, lowdpi / 2, lang->language, _cupsLangString(lang, _("Draft")));
       else if (ippContainsInteger(quality, IPP_QUALITY_DRAFT))
-  cupsFilePrintf(fp, "*cupsPrintQuality Draft/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("Draft")), lowdpi, lowdpi);
-      cupsFilePrintf(fp, "*cupsPrintQuality Normal/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("Normal")), lowdpi, lowdpi);
+	cupsFilePrintf(fp, "*cupsPrintQuality Draft: \"<</HWResolution[%d %d]>>setpagedevice\"\n*%s.cupsPrintQuality Draft/%s: \"\"\n", lowdpi, lowdpi, lang->language, _cupsLangString(lang, _("Draft")));
+
+      cupsFilePrintf(fp, "*cupsPrintQuality Normal: \"<</HWResolution[%d %d]>>setpagedevice\"\n*%s.cupsPrintQuality Normal/%s: \"\"\n", lowdpi, lowdpi, lang->language, _cupsLangString(lang, _("Normal")));
+
       if (hidpi > lowdpi || ippContainsInteger(quality, IPP_QUALITY_HIGH))
-  cupsFilePrintf(fp, "*cupsPrintQuality High/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("High")), hidpi, hidpi);
+  cupsFilePrintf(fp, "*cupsPrintQuality High: \"<</HWResolution[%d %d]>>setpagedevice\"\n*%s.cupsPrintQuality High/%s: \"\"\n", hidpi, hidpi, lang->language, _cupsLangString(lang, _("High")));
       cupsFilePuts(fp, "*CloseUI: *cupsPrintQuality\n");
     }
   }
@@ -4041,7 +4139,8 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
     if (count > (int)(sizeof(resolutions) / sizeof(resolutions[0])))
       count = (int)(sizeof(resolutions) / sizeof(resolutions[0]));
 
-    for (i = 0; i < count; i ++)
+    resolutions[0] = 0; /* Not in loop to silence Clang static analyzer... */
+    for (i = 1; i < count; i ++)
       resolutions[i] = i;
 
     for (i = 0; i < (count - 1); i ++)
@@ -4076,20 +4175,26 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
     pwg_ppdize_resolution(attr, resolutions[count / 2], &xres, &yres, ppdname, sizeof(ppdname));
     cupsFilePrintf(fp, "*DefaultResolution: %s\n", ppdname);
 
-    cupsFilePrintf(fp, "*OpenUI *cupsPrintQuality/%s: PickOne\n"
-           "*OrderDependency: 10 AnySetup *cupsPrintQuality\n"
-           "*DefaultcupsPrintQuality: Normal\n", _cupsLangString(lang, _("Print Quality")));
+    cupsFilePrintf(fp, "*OpenUI *cupsPrintQuality: PickOne\n"
+		       "*OrderDependency: 10 AnySetup *cupsPrintQuality\n"
+		       "*%s.Translation cupsPrintQuality/%s: \"\"\n"
+		       "*DefaultcupsPrintQuality: Normal\n", lang->language, _cupsLangString(lang, _("Print Quality")));
     if (count > 2 || ippContainsInteger(quality, IPP_QUALITY_DRAFT))
     {
       pwg_ppdize_resolution(attr, resolutions[0], &xres, &yres, NULL, 0);
-      cupsFilePrintf(fp, "*cupsPrintQuality Draft/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("Draft")), xres, yres);
+      cupsFilePrintf(fp, "*cupsPrintQuality Draft: \"<</HWResolution[%d %d]>>setpagedevice\"\n", xres, yres);
+      cupsFilePrintf(fp, "*%s.cupsPrintQuality Draft/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Draft")));
     }
+
     pwg_ppdize_resolution(attr, resolutions[count / 2], &xres, &yres, NULL, 0);
-    cupsFilePrintf(fp, "*cupsPrintQuality Normal/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("Normal")), xres, yres);
+    cupsFilePrintf(fp, "*cupsPrintQuality Normal: \"<</HWResolution[%d %d]>>setpagedevice\"\n", xres, yres);
+    cupsFilePrintf(fp, "*%s.cupsPrintQuality Normal/%s: \"\"\n", lang->language, _cupsLangString(lang, _("Normal")));
+
     if (count > 1 || ippContainsInteger(quality, IPP_QUALITY_HIGH))
     {
       pwg_ppdize_resolution(attr, resolutions[count - 1], &xres, &yres, NULL, 0);
-      cupsFilePrintf(fp, "*cupsPrintQuality High/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("High")), xres, yres);
+      cupsFilePrintf(fp, "*cupsPrintQuality High: \"<</HWResolution[%d %d]>>setpagedevice\"\n", xres, yres);
+      cupsFilePrintf(fp, "*%s.cupsPrintQuality High/%s: \"\"\n", lang->language, _cupsLangString(lang, _("High")));
     }
 
     cupsFilePuts(fp, "*CloseUI: *cupsPrintQuality\n");
@@ -4110,14 +4215,17 @@ _ppdCreateFromIPP(char   *buffer,	/* I - Filename buffer */
 
     cupsFilePrintf(fp, "*DefaultResolution: %s\n", ppdname);
 
-    cupsFilePrintf(fp, "*OpenUI *cupsPrintQuality/%s: PickOne\n"
+    cupsFilePrintf(fp, "*OpenUI *cupsPrintQuality: PickOne\n"
                        "*OrderDependency: 10 AnySetup *cupsPrintQuality\n"
-                       "*DefaultcupsPrintQuality: Normal\n", _cupsLangString(lang, _("Print Quality")));
+                       "*%s.Translation cupsPrintQuality/%s: \"\"\n"
+                       "*DefaultcupsPrintQuality: Normal\n", lang->language, _cupsLangString(lang, _("Print Quality")));
     if (ippContainsInteger(quality, IPP_QUALITY_DRAFT))
-      cupsFilePrintf(fp, "*cupsPrintQuality Draft/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("Draft")), xres, yres);
-    cupsFilePrintf(fp, "*cupsPrintQuality Normal/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("Normal")), xres, yres);
+      cupsFilePrintf(fp, "*cupsPrintQuality Draft: \"<</HWResolution[%d %d]>>setpagedevice\"\n*%s.cupsPrintQuality Draft/%s: \"\"\n", xres, yres, lang->language, _cupsLangString(lang, _("Draft")));
+
+    cupsFilePrintf(fp, "*cupsPrintQuality Normal: \"<</HWResolution[%d %d]>>setpagedevice\"\n*%s.cupsPrintQuality Normal/%s: \"\"\n", xres, yres, lang->language, _cupsLangString(lang, _("Normal")));
+
     if (ippContainsInteger(quality, IPP_QUALITY_HIGH))
-      cupsFilePrintf(fp, "*cupsPrintQuality High/%s: \"<</HWResolution[%d %d]>>setpagedevice\"\n", _cupsLangString(lang, _("High")), xres, yres);
+      cupsFilePrintf(fp, "*cupsPrintQuality High: \"<</HWResolution[%d %d]>>setpagedevice\"\n*%s.cupsPrintQuality High/%s: \"\"\n", xres, yres, lang->language, _cupsLangString(lang, _("High")));
     cupsFilePuts(fp, "*CloseUI: *cupsPrintQuality\n");
   }
 

cups/ppd-conflicts.c

@@ -1,7 +1,7 @@
 /*
  * Option conflict management routines for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -29,7 +29,6 @@
 
 enum
 {
-  _PPD_NORMAL_CONSTRAINTS,
   _PPD_OPTION_CONSTRAINTS,
   _PPD_INSTALLABLE_CONSTRAINTS,
   _PPD_ALL_CONSTRAINTS
@@ -998,7 +997,7 @@ ppd_test_constraints(
     if (!consts->installable && which == _PPD_INSTALLABLE_CONSTRAINTS)
       continue;				/* Skip non-installable option constraint */
 
-    if (which == _PPD_OPTION_CONSTRAINTS && option)
+    if ((which == _PPD_OPTION_CONSTRAINTS || which == _PPD_INSTALLABLE_CONSTRAINTS) && option)
     {
      /*
       * Skip constraints that do not involve the current option...

cups/ppd-emit.c

@@ -21,11 +21,11 @@
 
 #include "cups-private.h"
 #include "ppd.h"
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 || __EMX__ */
+#endif /* _WIN32 || __EMX__ */
 
 
 /*
@@ -328,11 +328,11 @@ ppdEmitFd(ppd_file_t    *ppd,		/* I - PPD file record */
 
     while (buflength > 0)
     {
-#ifdef WIN32
+#ifdef _WIN32
       if ((bytes = (ssize_t)write(fd, bufptr, (unsigned)buflength)) < 0)
 #else
       if ((bytes = write(fd, bufptr, buflength)) < 0)
-#endif /* WIN32 */
+#endif /* _WIN32 */
       {
         if (errno == EAGAIN || errno == EINTR)
 	  continue;
@@ -662,6 +662,9 @@ ppdEmitString(ppd_file_t    *ppd,	/* I - PPD file record */
 	{
           switch (cparam->type)
 	  {
+	    case PPD_CUSTOM_UNKNOWN :
+	        break;
+
 	    case PPD_CUSTOM_CURVE :
 	    case PPD_CUSTOM_INVCURVE :
 	    case PPD_CUSTOM_POINTS :
@@ -708,6 +711,9 @@ ppdEmitString(ppd_file_t    *ppd,	/* I - PPD file record */
 	{
           switch (cparam->type)
 	  {
+	    case PPD_CUSTOM_UNKNOWN :
+	        break;
+
 	    case PPD_CUSTOM_CURVE :
 	    case PPD_CUSTOM_INVCURVE :
 	    case PPD_CUSTOM_POINTS :
@@ -803,6 +809,9 @@ ppdEmitString(ppd_file_t    *ppd,	/* I - PPD file record */
 	      {
 	        switch (cparam->type)
 		{
+		  case PPD_CUSTOM_UNKNOWN :
+		      break;
+
 		  case PPD_CUSTOM_CURVE :
 		  case PPD_CUSTOM_INVCURVE :
 		  case PPD_CUSTOM_POINTS :
@@ -1005,6 +1014,9 @@ ppdEmitString(ppd_file_t    *ppd,	/* I - PPD file record */
 	{
           switch (cparam->type)
 	  {
+	    case PPD_CUSTOM_UNKNOWN :
+	        break;
+
 	    case PPD_CUSTOM_CURVE :
 	    case PPD_CUSTOM_INVCURVE :
 	    case PPD_CUSTOM_POINTS :

cups/ppd-localize.c

@@ -1,7 +1,7 @@
 /*
  * PPD localization routines for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -277,7 +277,7 @@ ppdLocalizeIPPReason(
 
   if (!locattr)
   {
-    if (lang && (!scheme || !strcmp(scheme, "text")))
+    if (lang && (!scheme || !strcmp(scheme, "text")) && strcmp(reason, "none"))
     {
      /*
       * Try to localize a standard printer-state-reason keyword...

cups/ppd-mark.c

@@ -1,8 +1,8 @@
 /*
  * Option marking routines for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -855,6 +855,9 @@ ppd_mark_option(ppd_file_t *ppd,	/* I - PPD file */
 
         switch (cparam->type)
 	{
+	  case PPD_CUSTOM_UNKNOWN :
+	      break;
+
 	  case PPD_CUSTOM_CURVE :
 	  case PPD_CUSTOM_INVCURVE :
 	  case PPD_CUSTOM_REAL :
@@ -890,9 +893,9 @@ ppd_mark_option(ppd_file_t *ppd,	/* I - PPD file */
 	  case PPD_CUSTOM_PASSWORD :
 	  case PPD_CUSTOM_STRING :
 	      if (cparam->current.custom_string)
-	        _cupsStrFree(cparam->current.custom_string);
+	        free(cparam->current.custom_string);
 
-	      cparam->current.custom_string = _cupsStrAlloc(choice + 7);
+	      cparam->current.custom_string = strdup(choice + 7);
 	      break;
 	}
       }
@@ -932,6 +935,9 @@ ppd_mark_option(ppd_file_t *ppd,	/* I - PPD file */
 
 	switch (cparam->type)
 	{
+	  case PPD_CUSTOM_UNKNOWN :
+	      break;
+
 	  case PPD_CUSTOM_CURVE :
 	  case PPD_CUSTOM_INVCURVE :
 	  case PPD_CUSTOM_REAL :
@@ -967,9 +973,9 @@ ppd_mark_option(ppd_file_t *ppd,	/* I - PPD file */
 	  case PPD_CUSTOM_PASSWORD :
 	  case PPD_CUSTOM_STRING :
 	      if (cparam->current.custom_string)
-		_cupsStrFree(cparam->current.custom_string);
+		free(cparam->current.custom_string);
 
-	      cparam->current.custom_string = _cupsStrRetain(val->value);
+	      cparam->current.custom_string = strdup(val->value);
 	      break;
 	}
       }

cups/ppd-util.c

@@ -1,8 +1,8 @@
 /*
  * PPD utilities for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
- * Copyright 1997-2006 by Easy Software Products.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -21,11 +21,11 @@
 #include "ppd-private.h"
 #include <fcntl.h>
 #include <sys/stat.h>
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 || __EMX__ */
+#endif /* _WIN32 || __EMX__ */
 
 
 /*
@@ -171,7 +171,7 @@ cupsGetPPD3(http_t     *http,		/* I  - HTTP connection or @code CUPS_HTTP_DEFAUL
     return (HTTP_STATUS_NOT_ACCEPTABLE);
   }
 
-#ifndef WIN32
+#ifndef _WIN32
  /*
   * See if the PPD file is available locally...
   */
@@ -216,6 +216,27 @@ cupsGetPPD3(http_t     *http,		/* I  - HTTP connection or @code CUPS_HTTP_DEFAUL
         const char	*tmpdir;	/* TMPDIR environment variable */
 	struct timeval	curtime;	/* Current time */
 
+#ifdef __APPLE__
+       /*
+	* On macOS and iOS, the TMPDIR environment variable is not always the
+	* best location to place temporary files due to sandboxing.  Instead,
+	* the confstr function should be called to get the proper per-user,
+	* per-process TMPDIR value.
+	*/
+
+        char		tmppath[1024];	/* Temporary directory */
+
+	if ((tmpdir = getenv("TMPDIR")) != NULL && access(tmpdir, W_OK))
+	  tmpdir = NULL;
+
+	if (!tmpdir)
+	{
+	  if (confstr(_CS_DARWIN_USER_TEMP_DIR, tmppath, sizeof(tmppath)))
+	    tmpdir = tmppath;
+	  else
+	    tmpdir = "/private/tmp";		/* This should never happen */
+	}
+#else
        /*
 	* Previously we put root temporary files in the default CUPS temporary
 	* directory under /var/spool/cups.  However, since the scheduler cleans
@@ -224,11 +245,8 @@ cupsGetPPD3(http_t     *http,		/* I  - HTTP connection or @code CUPS_HTTP_DEFAUL
 	*/
 
 	if ((tmpdir = getenv("TMPDIR")) == NULL)
-#  ifdef __APPLE__
-	  tmpdir = "/private/tmp";	/* /tmp is a symlink to /private/tmp */
-#  else
-          tmpdir = "/tmp";
-#  endif /* __APPLE__ */
+	  tmpdir = "/tmp";
+#endif /* __APPLE__ */
 
        /*
 	* Make the temporary name using the specified directory...
@@ -280,7 +298,7 @@ cupsGetPPD3(http_t     *http,		/* I  - HTTP connection or @code CUPS_HTTP_DEFAUL
       }
     }
   }
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
  /*
   * Try finding a printer URI for this printer...
@@ -511,23 +529,16 @@ cups_get_printer_uri(
     int        depth)			/* I - Depth of query */
 {
   int		i;			/* Looping var */
-  int		http_port;		/* Port number */
-  http_t	*http2;			/* Alternate HTTP connection */
   ipp_t		*request,		/* IPP request */
 		*response;		/* IPP response */
   ipp_attribute_t *attr;		/* Current attribute */
   char		uri[HTTP_MAX_URI],	/* printer-uri attribute */
 		scheme[HTTP_MAX_URI],	/* Scheme name */
-		username[HTTP_MAX_URI],	/* Username:password */
-		classname[255],		/* Temporary class name */
-		http_hostname[HTTP_MAX_HOST];
-					/* Hostname associated with connection */
+		username[HTTP_MAX_URI];	/* Username:password */
   static const char * const requested_attrs[] =
 		{			/* Requested attributes */
-		  "device-uri",
 		  "member-uris",
-		  "printer-uri-supported",
-		  "printer-type"
+		  "printer-uri-supported"
 		};
 
 
@@ -549,15 +560,6 @@ cups_get_printer_uri(
 
   DEBUG_printf(("5cups_get_printer_uri: printer-uri=\"%s\"", uri));
 
- /*
-  * Get the hostname and port number we are connected to...
-  */
-
-  httpGetHostname(http, http_hostname, sizeof(http_hostname));
-  http_port = httpAddrPort(http->hostaddr);
-
-  DEBUG_printf(("5cups_get_printer_uri: http_hostname=\"%s\"", http_hostname));
-
  /*
   * Build an IPP_GET_PRINTER_ATTRIBUTES request, which requires the following
   * attributes:
@@ -582,31 +584,7 @@ cups_get_printer_uri(
 
   if ((response = cupsDoRequest(http, request, resource)) != NULL)
   {
-    const char *device_uri = NULL;	/* device-uri value */
-
-    if ((attr = ippFindAttribute(response, "device-uri", IPP_TAG_URI)) != NULL)
-    {
-      device_uri = attr->values[0].string.text;
-      DEBUG_printf(("5cups_get_printer_uri: device-uri=\"%s\"", device_uri));
-    }
-
-    if (device_uri &&
-        (((!strncmp(device_uri, "ipp://", 6) || !strncmp(device_uri, "ipps://", 7)) &&
-	  (strstr(device_uri, "/printers/") != NULL || strstr(device_uri, "/classes/") != NULL)) ||
-         ((strstr(device_uri, "._ipp.") != NULL || strstr(device_uri, "._ipps.") != NULL) &&
-          !strcmp(device_uri + strlen(device_uri) - 5, "/cups"))))
-    {
-     /*
-      * Statically-configured shared printer.
-      */
-
-      httpSeparateURI(HTTP_URI_CODING_ALL, _httpResolveURI(device_uri, uri, sizeof(uri), _HTTP_RESOLVE_DEFAULT, NULL, NULL), scheme, sizeof(scheme), username, sizeof(username), host, hostsize, port, resource, resourcesize);
-      ippDelete(response);
-
-      DEBUG_printf(("5cups_get_printer_uri: Resolved to host=\"%s\", port=%d, resource=\"%s\"", host, *port, resource));
-      return (1);
-    }
-    else if ((attr = ippFindAttribute(response, "member-uris", IPP_TAG_URI)) != NULL)
+    if ((attr = ippFindAttribute(response, "member-uris", IPP_TAG_URI)) != NULL)
     {
      /*
       * Get the first actual printer name in the class...
@@ -631,55 +609,6 @@ cups_get_printer_uri(
 	  return (1);
 	}
       }
-
-     /*
-      * No printers in this class - try recursively looking for a printer,
-      * but not more than 3 levels deep...
-      */
-
-      if (depth < 3)
-      {
-	for (i = 0; i < attr->num_values; i ++)
-	{
-	  httpSeparateURI(HTTP_URI_CODING_ALL, attr->values[i].string.text,
-	                  scheme, sizeof(scheme), username, sizeof(username),
-			  host, hostsize, port, resource, resourcesize);
-	  if (!strncmp(resource, "/classes/", 9))
-	  {
-	   /*
-	    * Found a class!  Connect to the right server...
-	    */
-
-	    if (!_cups_strcasecmp(http_hostname, host) && *port == http_port)
-	      http2 = http;
-	    else if ((http2 = httpConnect2(host, *port, NULL, AF_UNSPEC, cupsEncryption(), 1, 30000, NULL)) == NULL)
-	    {
-	      DEBUG_puts("8cups_get_printer_uri: Unable to connect to server");
-
-	      continue;
-	    }
-
-           /*
-	    * Look up printers on that server...
-	    */
-
-            strlcpy(classname, resource + 9, sizeof(classname));
-
-            cups_get_printer_uri(http2, classname, host, hostsize, port,
-	                         resource, resourcesize, depth + 1);
-
-           /*
-	    * Close the connection as needed...
-	    */
-
-	    if (http2 != http)
-	      httpClose(http2);
-
-            if (*host)
-	      return (1);
-	  }
-	}
-      }
     }
     else if ((attr = ippFindAttribute(response, "printer-uri-supported", IPP_TAG_URI)) != NULL)
     {

cups/ppd.c

@@ -1,8 +1,8 @@
 /*
  * PPD file routines for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -34,8 +34,6 @@
  * Definitions...
  */
 
-#define ppd_free(p)	if (p) free(p)	/* Safe free macro */
-
 #define PPD_KEYWORD	1		/* Line contained a keyword */
 #define PPD_OPTION	2		/* Line contained an option name */
 #define PPD_TEXT	4		/* Line contained human-readable text */
@@ -94,9 +92,9 @@ static ppd_group_t	*ppd_get_group(ppd_file_t *ppd, const char *name,
 				       cups_encoding_t encoding);
 static ppd_option_t	*ppd_get_option(ppd_group_t *group, const char *name);
 static _ppd_globals_t	*ppd_globals_alloc(void);
-#if defined(HAVE_PTHREAD_H) || defined(WIN32)
+#if defined(HAVE_PTHREAD_H) || defined(_WIN32)
 static void		ppd_globals_free(_ppd_globals_t *g);
-#endif /* HAVE_PTHREAD_H || WIN32 */
+#endif /* HAVE_PTHREAD_H || _WIN32 */
 #ifdef HAVE_PTHREAD_H
 static void		ppd_globals_init(void);
 #endif /* HAVE_PTHREAD_H */
@@ -117,7 +115,6 @@ void
 ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
 {
   int			i;		/* Looping var */
-  ppd_emul_t		*emul;		/* Current emulation */
   ppd_group_t		*group;		/* Current group */
   char			**font;		/* Current font */
   ppd_attr_t		**attr;		/* Current attribute */
@@ -136,28 +133,12 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
   * Free all strings at the top level...
   */
 
-  _cupsStrFree(ppd->lang_encoding);
-  _cupsStrFree(ppd->nickname);
-  if (ppd->patches)
-    free(ppd->patches);
-  _cupsStrFree(ppd->jcl_begin);
-  _cupsStrFree(ppd->jcl_end);
-  _cupsStrFree(ppd->jcl_ps);
-
- /*
-  * Free any emulations...
-  */
-
-  if (ppd->num_emulations > 0)
-  {
-    for (i = ppd->num_emulations, emul = ppd->emulations; i > 0; i --, emul ++)
-    {
-      _cupsStrFree(emul->start);
-      _cupsStrFree(emul->stop);
-    }
-
-    ppd_free(ppd->emulations);
-  }
+  free(ppd->lang_encoding);
+  free(ppd->nickname);
+  free(ppd->patches);
+  free(ppd->jcl_begin);
+  free(ppd->jcl_end);
+  free(ppd->jcl_ps);
 
  /*
   * Free any UI groups, subgroups, and options...
@@ -168,7 +149,7 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
     for (i = ppd->num_groups, group = ppd->groups; i > 0; i --, group ++)
       ppd_free_group(group);
 
-    ppd_free(ppd->groups);
+    free(ppd->groups);
   }
 
   cupsArrayDelete(ppd->options);
@@ -179,14 +160,14 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
   */
 
   if (ppd->num_sizes > 0)
-    ppd_free(ppd->sizes);
+    free(ppd->sizes);
 
  /*
   * Free any constraints...
   */
 
   if (ppd->num_consts > 0)
-    ppd_free(ppd->consts);
+    free(ppd->consts);
 
  /*
   * Free any filters...
@@ -201,9 +182,9 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
   if (ppd->num_fonts > 0)
   {
     for (i = ppd->num_fonts, font = ppd->fonts; i > 0; i --, font ++)
-      _cupsStrFree(*font);
+      free(*font);
 
-    ppd_free(ppd->fonts);
+    free(ppd->fonts);
   }
 
  /*
@@ -211,7 +192,7 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
   */
 
   if (ppd->num_profiles > 0)
-    ppd_free(ppd->profiles);
+    free(ppd->profiles);
 
  /*
   * Free any attributes...
@@ -221,11 +202,11 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
   {
     for (i = ppd->num_attrs, attr = ppd->attrs; i > 0; i --, attr ++)
     {
-      _cupsStrFree((*attr)->value);
-      ppd_free(*attr);
+      free((*attr)->value);
+      free(*attr);
     }
 
-    ppd_free(ppd->attrs);
+    free(ppd->attrs);
   }
 
   cupsArrayDelete(ppd->sorted_attrs);
@@ -247,7 +228,7 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
         case PPD_CUSTOM_PASSCODE :
         case PPD_CUSTOM_PASSWORD :
         case PPD_CUSTOM_STRING :
-            _cupsStrFree(cparam->current.custom_string);
+            free(cparam->current.custom_string);
 	    break;
 
 	default :
@@ -295,7 +276,7 @@ ppdClose(ppd_file_t *ppd)		/* I - PPD file record */
   * Free the whole record...
   */
 
-  ppd_free(ppd);
+  free(ppd);
 }
 
 
@@ -333,7 +314,9 @@ ppdErrorString(ppd_status_t status)	/* I - PPD status */
 		  _("Bad custom parameter"),
 		  _("Missing option keyword"),
 		  _("Bad value string"),
-		  _("Missing CloseGroup")
+		  _("Missing CloseGroup"),
+		  _("Bad CloseUI/JCLCloseUI"),
+		  _("Missing CloseUI/JCLCloseUI")
 		};
 
 
@@ -441,7 +424,6 @@ _ppdOpen(
     _ppd_localization_t	localization)	/* I - Localization to load */
 {
   int			i, j, k;	/* Looping vars */
-  int			count;		/* Temporary count */
   _ppd_line_t		line;		/* Line buffer */
   ppd_file_t		*ppd;		/* PPD file record */
   ppd_group_t		*group,		/* Current group */
@@ -459,7 +441,6 @@ _ppdOpen(
 					/* Human-readable text from file */
 			*string,	/* Code/text from file */
 			*sptr,		/* Pointer into string */
-			*nameptr,	/* Pointer into name */
 			*temp,		/* Temporary string pointer */
 			**tempfonts;	/* Temporary fonts pointer */
   float			order;		/* Order dependency number */
@@ -633,15 +614,15 @@ _ppdOpen(
     if (pg->ppd_status == PPD_OK)
       pg->ppd_status = PPD_MISSING_PPDADOBE4;
 
-    _cupsStrFree(string);
-    ppd_free(line.buffer);
+    free(string);
+    free(line.buffer);
 
     return (NULL);
   }
 
   DEBUG_printf(("2_ppdOpen: keyword=%s, string=%p", keyword, string));
 
-  _cupsStrFree(string);
+  free(string);
 
  /*
   * Allocate memory for the PPD file record...
@@ -651,8 +632,8 @@ _ppdOpen(
   {
     pg->ppd_status = PPD_ALLOC_ERROR;
 
-    _cupsStrFree(string);
-    ppd_free(line.buffer);
+    free(string);
+    free(line.buffer);
 
     return (NULL);
   }
@@ -735,6 +716,8 @@ _ppdOpen(
 	   strncmp(ll, keyword, ll_len)))
       {
 	DEBUG_printf(("2_ppdOpen: Ignoring localization: \"%s\"\n", keyword));
+	free(string);
+	string = NULL;
 	continue;
       }
       else if (localization == _PPD_LOCALIZATION_ICC_PROFILES)
@@ -754,6 +737,8 @@ _ppdOpen(
 	if (i >= (int)(sizeof(color_keywords) / sizeof(color_keywords[0])))
 	{
 	  DEBUG_printf(("2_ppdOpen: Ignoring localization: \"%s\"\n", keyword));
+	  free(string);
+	  string = NULL;
 	  continue;
 	}
       }
@@ -849,7 +834,7 @@ _ppdOpen(
       * Say all PPD files are UTF-8, since we convert to UTF-8...
       */
 
-      ppd->lang_encoding = _cupsStrAlloc("UTF-8");
+      ppd->lang_encoding = strdup("UTF-8");
       encoding           = _ppdGetEncoding(string);
     }
     else if (!strcmp(keyword, "LanguageVersion"))
@@ -870,10 +855,10 @@ _ppdOpen(
 
 
         cupsCharsetToUTF8(utf8, string, sizeof(utf8), encoding);
-	ppd->nickname = _cupsStrAlloc((char *)utf8);
+	ppd->nickname = strdup((char *)utf8);
       }
       else
-        ppd->nickname = _cupsStrAlloc(string);
+        ppd->nickname = strdup(string);
     }
     else if (!strcmp(keyword, "Product"))
       ppd->product = string;
@@ -883,17 +868,17 @@ _ppdOpen(
       ppd->ttrasterizer = string;
     else if (!strcmp(keyword, "JCLBegin"))
     {
-      ppd->jcl_begin = _cupsStrAlloc(string);
+      ppd->jcl_begin = strdup(string);
       ppd_decode(ppd->jcl_begin);	/* Decode quoted string */
     }
     else if (!strcmp(keyword, "JCLEnd"))
     {
-      ppd->jcl_end = _cupsStrAlloc(string);
+      ppd->jcl_end = strdup(string);
       ppd_decode(ppd->jcl_end);		/* Decode quoted string */
     }
     else if (!strcmp(keyword, "JCLToPSInterpreter"))
     {
-      ppd->jcl_ps = _cupsStrAlloc(string);
+      ppd->jcl_ps = strdup(string);
       ppd_decode(ppd->jcl_ps);		/* Decode quoted string */
     }
     else if (!strcmp(keyword, "AccurateScreensSupport"))
@@ -961,10 +946,10 @@ _ppdOpen(
       ppd->num_filters ++;
 
      /*
-      * Retain a copy of the filter string...
+      * Make a copy of the filter string...
       */
 
-      *filter = _cupsStrRetain(string);
+      *filter = strdup(string);
     }
     else if (!strcmp(keyword, "Throughput"))
       ppd->throughput = atoi(string);
@@ -987,7 +972,7 @@ _ppdOpen(
       }
 
       ppd->fonts                 = tempfonts;
-      ppd->fonts[ppd->num_fonts] = _cupsStrAlloc(name);
+      ppd->fonts[ppd->num_fonts] = strdup(name);
       ppd->num_fonts ++;
     }
     else if (!strncmp(keyword, "ParamCustom", 11))
@@ -1018,6 +1003,13 @@ _ppdOpen(
 	goto error;
       }
 
+      if (cparam->type != PPD_CUSTOM_UNKNOWN)
+      {
+        pg->ppd_status = PPD_BAD_CUSTOM_PARAM;
+
+        goto error;
+      }
+
      /*
       * Get the parameter data...
       */
@@ -1152,7 +1144,7 @@ _ppdOpen(
 	strlcpy(choice->text, text[0] ? text : _("Custom"),
 		sizeof(choice->text));
 
-	choice->code = _cupsStrAlloc(string);
+	choice->code = strdup(string);
 
 	if (custom_option->section == PPD_ORDER_JCL)
 	  ppd_decode(choice->code);
@@ -1201,59 +1193,23 @@ _ppdOpen(
       else if (!strcmp(string, "Plus90"))
         ppd->landscape = 90;
     }
-    else if (!strcmp(keyword, "Emulators") && string)
+    else if (!strcmp(keyword, "Emulators") && string && ppd->num_emulations == 0)
     {
-      for (count = 1, sptr = string; sptr != NULL;)
-        if ((sptr = strchr(sptr, ' ')) != NULL)
-	{
-	  count ++;
-	  while (*sptr == ' ')
-	    sptr ++;
-	}
+     /*
+      * Issue #5562: Samsung printer drivers incorrectly use Emulators keyword
+      *              to configure themselves
+      *
+      * The Emulators keyword was loaded but never used by anything in CUPS,
+      * and has no valid purpose in CUPS.  The old code was removed due to a
+      * memory leak (Issue #5475), so the following (new) code supports a single
+      * name for the Emulators keyword, allowing these drivers to work until we
+      * remove PPD and driver support entirely in a future version of CUPS.
+      */
 
-      ppd->num_emulations = count;
-      if ((ppd->emulations = calloc((size_t)count, sizeof(ppd_emul_t))) == NULL)
-      {
-        pg->ppd_status = PPD_ALLOC_ERROR;
+      ppd->num_emulations = 1;
+      ppd->emulations     = calloc(1, sizeof(ppd_emul_t));
 
-	goto error;
-      }
-
-      for (i = 0, sptr = string; i < count; i ++)
-      {
-        for (nameptr = ppd->emulations[i].name;
-	     *sptr != '\0' && *sptr != ' ';
-	     sptr ++)
-	  if (nameptr < (ppd->emulations[i].name + sizeof(ppd->emulations[i].name) - 1))
-	    *nameptr++ = *sptr;
-
-	*nameptr = '\0';
-
-	while (*sptr == ' ')
-	  sptr ++;
-      }
-    }
-    else if (!strncmp(keyword, "StartEmulator_", 14))
-    {
-      ppd_decode(string);
-
-      for (i = 0; i < ppd->num_emulations; i ++)
-        if (!strcmp(keyword + 14, ppd->emulations[i].name))
-	{
-	  ppd->emulations[i].start = string;
-	  string = NULL;
-	}
-    }
-    else if (!strncmp(keyword, "StopEmulator_", 13))
-    {
-      ppd_decode(string);
-
-      for (i = 0; i < ppd->num_emulations; i ++)
-        if (!strcmp(keyword + 13, ppd->emulations[i].name))
-	{
-	  ppd->emulations[i].stop = string;
-	  string = NULL;
-	}
+      strlcpy(ppd->emulations[0].name, string, sizeof(ppd->emulations[0].name));
     }
     else if (!strcmp(keyword, "JobPatchFile"))
     {
@@ -1408,7 +1364,7 @@ _ppdOpen(
 
       option->section = PPD_ORDER_ANY;
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
 
      /*
@@ -1436,7 +1392,7 @@ _ppdOpen(
 	strlcpy(choice->text,
 	        custom_attr->text[0] ? custom_attr->text : _("Custom"),
 		sizeof(choice->text));
-        choice->code = _cupsStrRetain(custom_attr->value);
+        choice->code = strdup(custom_attr->value);
       }
     }
     else if (!strcmp(keyword, "JCLOpenUI"))
@@ -1515,7 +1471,7 @@ _ppdOpen(
       option->section = PPD_ORDER_JCL;
       group = NULL;
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
 
      /*
@@ -1539,14 +1495,35 @@ _ppdOpen(
 	strlcpy(choice->text,
 	        custom_attr->text[0] ? custom_attr->text : _("Custom"),
 		sizeof(choice->text));
-        choice->code = _cupsStrRetain(custom_attr->value);
+        choice->code = strdup(custom_attr->value);
       }
     }
-    else if (!strcmp(keyword, "CloseUI") || !strcmp(keyword, "JCLCloseUI"))
+    else if (!strcmp(keyword, "CloseUI"))
     {
+      if ((!option || option->section == PPD_ORDER_JCL) && pg->ppd_conform == PPD_CONFORM_STRICT)
+      {
+        pg->ppd_status = PPD_BAD_CLOSE_UI;
+
+	goto error;
+      }
+
       option = NULL;
 
-      _cupsStrFree(string);
+      free(string);
+      string = NULL;
+    }
+    else if (!strcmp(keyword, "JCLCloseUI"))
+    {
+      if ((!option || option->section != PPD_ORDER_JCL) && pg->ppd_conform == PPD_CONFORM_STRICT)
+      {
+        pg->ppd_status = PPD_BAD_CLOSE_UI;
+
+	goto error;
+      }
+
+      option = NULL;
+
+      free(string);
       string = NULL;
     }
     else if (!strcmp(keyword, "OpenGroup"))
@@ -1593,14 +1570,14 @@ _ppdOpen(
       if (group == NULL)
 	goto error;
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
     }
     else if (!strcmp(keyword, "CloseGroup"))
     {
       group = NULL;
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
     }
     else if (!strcmp(keyword, "OrderDependency"))
@@ -1658,7 +1635,7 @@ _ppdOpen(
 	option->order   = order;
       }
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
     }
     else if (!strncmp(keyword, "Default", 7))
@@ -1901,11 +1878,18 @@ _ppdOpen(
       * Don't add this one as an attribute...
       */
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
     }
     else if (!strcmp(keyword, "PaperDimension"))
     {
+      if (!_cups_strcasecmp(name, "custom") || !_cups_strncasecmp(name, "custom.", 7))
+      {
+        pg->ppd_status = PPD_ILLEGAL_OPTION_KEYWORD;
+
+        goto error;
+      }
+
       if ((size = ppdPageSize(ppd, name)) == NULL)
 	size = ppd_add_size(ppd, name);
 
@@ -1923,11 +1907,18 @@ _ppdOpen(
       size->width  = (float)_cupsStrScand(string, &sptr, loc);
       size->length = (float)_cupsStrScand(sptr, NULL, loc);
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
     }
     else if (!strcmp(keyword, "ImageableArea"))
     {
+      if (!_cups_strcasecmp(name, "custom") || !_cups_strncasecmp(name, "custom.", 7))
+      {
+        pg->ppd_status = PPD_ILLEGAL_OPTION_KEYWORD;
+
+        goto error;
+      }
+
       if ((size = ppdPageSize(ppd, name)) == NULL)
 	size = ppd_add_size(ppd, name);
 
@@ -1947,7 +1938,7 @@ _ppdOpen(
       size->right  = (float)_cupsStrScand(sptr, &sptr, loc);
       size->top    = (float)_cupsStrScand(sptr, NULL, loc);
 
-      _cupsStrFree(string);
+      free(string);
       string = NULL;
     }
     else if (option != NULL &&
@@ -1957,6 +1948,13 @@ _ppdOpen(
     {
       DEBUG_printf(("2_ppdOpen: group=%p, subgroup=%p", group, subgroup));
 
+      if (!_cups_strcasecmp(name, "custom") || !_cups_strncasecmp(name, "custom.", 7))
+      {
+        pg->ppd_status = PPD_ILLEGAL_OPTION_KEYWORD;
+
+        goto error;
+      }
+
       if (!strcmp(keyword, "PageSize"))
       {
        /*
@@ -2003,7 +2001,17 @@ _ppdOpen(
         (mask & (PPD_KEYWORD | PPD_STRING)) == (PPD_KEYWORD | PPD_STRING))
       ppd_add_attr(ppd, keyword, name, text, string);
     else
-      _cupsStrFree(string);
+      free(string);
+  }
+
+ /*
+  * Check for a missing CloseUI/JCLCloseUI...
+  */
+
+  if (option && pg->ppd_conform == PPD_CONFORM_STRICT)
+  {
+    pg->ppd_status = PPD_MISSING_CLOSE_UI;
+    goto error;
   }
 
  /*
@@ -2016,7 +2024,7 @@ _ppdOpen(
     goto error;
   }
 
-  ppd_free(line.buffer);
+  free(line.buffer);
 
  /*
   * Reset language preferences...
@@ -2098,8 +2106,8 @@ _ppdOpen(
 
   error:
 
-  _cupsStrFree(string);
-  ppd_free(line.buffer);
+  free(string);
+  free(line.buffer);
 
   ppdClose(ppd);
 
@@ -2537,9 +2545,9 @@ ppd_free_filters(ppd_file_t *ppd)	/* I - PPD file */
   if (ppd->num_filters > 0)
   {
     for (i = ppd->num_filters, filter = ppd->filters; i > 0; i --, filter ++)
-      _cupsStrFree(*filter);
+      free(*filter);
 
-    ppd_free(ppd->filters);
+    free(ppd->filters);
 
     ppd->num_filters = 0;
     ppd->filters     = NULL;
@@ -2566,7 +2574,7 @@ ppd_free_group(ppd_group_t *group)	/* I - Group to free */
 	 i --, option ++)
       ppd_free_option(option);
 
-    ppd_free(group->options);
+    free(group->options);
   }
 
   if (group->num_subgroups > 0)
@@ -2576,7 +2584,7 @@ ppd_free_group(ppd_group_t *group)	/* I - Group to free */
 	 i --, subgroup ++)
       ppd_free_group(subgroup);
 
-    ppd_free(group->subgroups);
+    free(group->subgroups);
   }
 }
 
@@ -2598,10 +2606,10 @@ ppd_free_option(ppd_option_t *option)	/* I - Option to free */
          i > 0;
          i --, choice ++)
     {
-      _cupsStrFree(choice->code);
+      free(choice->code);
     }
 
-    ppd_free(option->choices);
+    free(option->choices);
   }
 }
 
@@ -2671,6 +2679,7 @@ ppd_get_cparam(ppd_coption_t *opt,	/* I - PPD file */
   if ((cparam = calloc(1, sizeof(ppd_cparam_t))) == NULL)
     return (NULL);
 
+  cparam->type = PPD_CUSTOM_UNKNOWN;
   strlcpy(cparam->name, param, sizeof(cparam->name));
   strlcpy(cparam->text, text[0] ? text : param, sizeof(cparam->text));
 
@@ -2804,13 +2813,13 @@ ppd_globals_alloc(void)
  * 'ppd_globals_free()' - Free global data.
  */
 
-#if defined(HAVE_PTHREAD_H) || defined(WIN32)
+#if defined(HAVE_PTHREAD_H) || defined(_WIN32)
 static void
 ppd_globals_free(_ppd_globals_t *pg)	/* I - Pointer to global data */
 {
   free(pg);
 }
-#endif /* HAVE_PTHREAD_H || WIN32 */
+#endif /* HAVE_PTHREAD_H || _WIN32 */
 
 
 #ifdef HAVE_PTHREAD_H
@@ -3338,7 +3347,7 @@ ppd_read(cups_file_t    *fp,		/* I - File to read from */
 	lineptr ++;
       }
 
-      *string = _cupsStrAlloc(lineptr);
+      *string = strdup(lineptr);
 
       mask |= PPD_STRING;
     }
@@ -3460,7 +3469,7 @@ ppd_update_filters(ppd_file_t     *ppd,	/* I - PPD file */
     filter           += ppd->num_filters;
     ppd->num_filters ++;
 
-    *filter = _cupsStrAlloc(buffer);
+    *filter = strdup(buffer);
   }
   while ((attr = ppdFindNextAttr(ppd, "cupsFilter2", NULL)) != NULL);
 

cups/ppd.h

@@ -5,8 +5,8 @@
  * -D_PPD_DEPRECATED="" TO YOUR COMPILE OPTIONS.  THIS HEADER AND THESE
  * FUNCTIONS WILL BE REMOVED IN A FUTURE RELEASE OF CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -132,6 +132,8 @@ typedef enum ppd_status_e		/**** Status Codes @since CUPS 1.1.19/macOS 10.3@ ***
   PPD_MISSING_OPTION_KEYWORD,		/* Missing option keyword */
   PPD_BAD_VALUE,			/* Bad value string */
   PPD_MISSING_CLOSE_GROUP,		/* Missing CloseGroup */
+  PPD_BAD_CLOSE_UI,			/* Bad CloseUI/JCLCloseUI */
+  PPD_MISSING_CLOSE_UI,			/* Missing CloseUI/JCLCloseUI */
   PPD_MAX_STATUS			/* @private@ */
 } ppd_status_t;
 
@@ -233,6 +235,7 @@ typedef struct ppd_profile_s		/**** sRGB Color Profiles ****/
 /**** New in CUPS 1.2/macOS 10.5 ****/
 typedef enum ppd_cptype_e		/**** Custom Parameter Type @since CUPS 1.2/macOS 10.5@ ****/
 {
+  PPD_CUSTOM_UNKNOWN = -1,		/* Unknown type (error) */
   PPD_CUSTOM_CURVE,			/* Curve value for f(x) = x^value */
   PPD_CUSTOM_INT,			/* Integer number value */
   PPD_CUSTOM_INVCURVE,			/* Curve value for f(x) = x^(1/value) */
@@ -302,8 +305,8 @@ typedef struct ppd_file_s		/**** PPD File ****/
   int		throughput;		/* Pages per minute */
   ppd_cs_t	colorspace;		/* Default colorspace */
   char		*patches;		/* Patch commands to be sent to printer */
-  int		num_emulations;		/* Number of emulations supported */
-  ppd_emul_t	*emulations;		/* Emulations and the code to invoke them */
+  int		num_emulations;		/* Number of emulations supported (no longer supported) @private@ */
+  ppd_emul_t	*emulations;		/* Emulations and the code to invoke them (no longer supported) @private@ */
   char		*jcl_begin;		/* Start JCL commands */
   char		*jcl_ps;		/* Enter PostScript interpreter */
   char		*jcl_end;		/* End JCL commands */

cups/pwg-media.c

@@ -1,7 +1,7 @@
 /*
  * PWG media name API implementation for CUPS.
  *
- * Copyright 2009-2017 by Apple Inc.
+ * Copyright 2009-2019 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -26,6 +26,7 @@
 
 #define _PWG_MEDIA_IN(p,l,a,x,y) {p, l, a, (int)(x * 2540), (int)(y * 2540)}
 #define _PWG_MEDIA_MM(p,l,a,x,y) {p, l, a, (int)(x * 100), (int)(y * 100)}
+#define _PWG_EPSILON	50		/* Matching tolerance */
 
 
 /*
@@ -912,10 +913,11 @@ pwgMediaForSize(int width,		/* I - Width in hundredths of millimeters */
 {
  /*
   * Adobe uses a size matching algorithm with an epsilon of 5 points, which
-  * is just about 176/2540ths...
+  * is just about 176/2540ths...  But a lot of international media sizes are
+  * very close so use 0.5mm (50/2540ths) as the maximum delta.
   */
 
-  return (_pwgMediaNearSize(width, length, 176));
+  return (_pwgMediaNearSize(width, length, _PWG_EPSILON));
 }
 
 

cups/raster-private.h

@@ -1,7 +1,7 @@
 /*
  * Private image library definitions for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1993-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -24,13 +24,13 @@
 #  include <cups/cups.h>
 #  include <cups/debug-private.h>
 #  include <cups/string-private.h>
-#  ifdef WIN32
+#  ifdef _WIN32
 #    include <io.h>
 #    include <winsock2.h>		/* for htonl() definition */
 #  else
 #    include <unistd.h>
 #    include <fcntl.h>
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 
 
 /*
@@ -49,12 +49,8 @@
  * Prototypes...
  */
 
-extern int		_cupsRasterExecPS(cups_page_header2_t *h,
-			                  int *preferred_bits,
-			                  const char *code)
-			                  __attribute__((nonnull(3)));
-extern void		_cupsRasterAddError(const char *f, ...)
-			__attribute__((__format__(__printf__, 1, 2)));
+extern int		_cupsRasterExecPS(cups_page_header2_t *h, int *preferred_bits, const char *code) _CUPS_NONNULL((3));
+extern void		_cupsRasterAddError(const char *f, ...) _CUPS_FORMAT(1,2);
 extern void		_cupsRasterClearError(void);
 
 #endif /* !_CUPS_RASTER_PRIVATE_H_ */

cups/request.c

@@ -20,11 +20,11 @@
 #include "cups-private.h"
 #include <fcntl.h>
 #include <sys/stat.h>
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 || __EMX__ */
+#endif /* _WIN32 || __EMX__ */
 #ifndef O_BINARY
 #  define O_BINARY 0
 #endif /* O_BINARY */
@@ -156,11 +156,11 @@ cupsDoIORequest(http_t     *http,	/* I - Connection to server or @code CUPS_HTTP
       return (NULL);
     }
 
-#ifdef WIN32
+#ifdef _WIN32
     if (fileinfo.st_mode & _S_IFDIR)
 #else
     if (S_ISDIR(fileinfo.st_mode))
-#endif /* WIN32 */
+#endif /* _WIN32 */
     {
      /*
       * Can't send a directory...
@@ -172,11 +172,11 @@ cupsDoIORequest(http_t     *http,	/* I - Connection to server or @code CUPS_HTTP
       return (NULL);
     }
 
-#ifndef WIN32
+#ifndef _WIN32
     if (!S_ISREG(fileinfo.st_mode))
       length = 0;			/* Chunk when piping */
     else
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
     length = ippLength(request) + (size_t)fileinfo.st_size;
   }
   else
@@ -215,9 +215,9 @@ cupsDoIORequest(http_t     *http,	/* I - Connection to server or @code CUPS_HTTP
       * Send the file with the request...
       */
 
-#ifndef WIN32
+#ifndef _WIN32
       if (S_ISREG(fileinfo.st_mode))
-#endif /* WIN32 */
+#endif /* _WIN32 */
       lseek(infile, 0, SEEK_SET);
 
       while ((bytes = read(infile, buffer, sizeof(buffer))) > 0)
@@ -591,7 +591,8 @@ cupsSendRequest(http_t     *http,	/* I - Connection to server or @code CUPS_HTTP
   int			got_status;	/* Did we get the status? */
   ipp_state_t		state;		/* State of IPP processing */
   http_status_t		expect;		/* Expect: header to use */
-  char                  date[256];      /* Date: header value */
+  char			date[256];	/* Date: header value */
+  int			digest;		/* Are we using Digest authentication? */
 
 
   DEBUG_printf(("cupsSendRequest(http=%p, request=%p(%s), resource=\"%s\", length=" CUPS_LLFMT ")", (void *)http, (void *)request, request ? ippOpString(request->request.op.operation_id) : "?", resource, CUPS_LLCAST length));
@@ -683,6 +684,17 @@ cupsSendRequest(http_t     *http,	/* I - Connection to server or @code CUPS_HTTP
     httpSetField(http, HTTP_FIELD_DATE, httpGetDateString2(time(NULL), date, (int)sizeof(date)));
     httpSetLength(http, length);
 
+    digest = http->authstring && !strncmp(http->authstring, "Digest ", 7);
+
+    if (digest)
+    {
+     /*
+      * Update the Digest authentication string...
+      */
+
+      _httpSetDigestAuthString(http, http->nextnonce, "POST", resource);
+    }
+
 #ifdef HAVE_GSSAPI
     if (http->authstring && !strncmp(http->authstring, "Negotiate", 9))
     {
@@ -767,9 +779,9 @@ cupsSendRequest(http_t     *http,	/* I - Connection to server or @code CUPS_HTTP
     * Wait up to 1 second to get the 100-continue response as needed...
     */
 
-    if (!got_status)
+    if (!got_status || (digest && status == HTTP_STATUS_CONTINUE))
     {
-      if (expect == HTTP_STATUS_CONTINUE)
+      if (expect == HTTP_STATUS_CONTINUE || digest)
       {
 	DEBUG_puts("2cupsSendRequest: Waiting for 100-continue...");
 
@@ -1016,13 +1028,13 @@ _cupsConnect(void)
       char	ch;			/* Connection check byte */
       ssize_t	n;			/* Number of bytes */
 
-#ifdef WIN32
+#ifdef _WIN32
       if ((n = recv(cg->http->fd, &ch, 1, MSG_PEEK)) == 0 ||
           (n < 0 && WSAGetLastError() != WSAEWOULDBLOCK))
 #else
       if ((n = recv(cg->http->fd, &ch, 1, MSG_PEEK | MSG_DONTWAIT)) == 0 ||
           (n < 0 && errno != EWOULDBLOCK))
-#endif /* WIN32 */
+#endif /* _WIN32 */
       {
        /*
         * Nope, close the connection...

cups/sidechannel.c

@@ -19,15 +19,15 @@
 
 #include "sidechannel.h"
 #include "cups-private.h"
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 */
-#ifndef WIN32
+#endif /* _WIN32 */
+#ifndef _WIN32
 #  include <sys/select.h>
 #  include <sys/time.h>
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 #ifdef HAVE_POLL
 #  include <poll.h>
 #endif /* HAVE_POLL */

cups/snmp.c

@@ -395,11 +395,11 @@ _cupsSNMPRead(int         fd,		/* I - SNMP socket file descriptor */
 
       ready = select(fd + 1, &input_set, NULL, NULL, &stimeout);
     }
-#  ifdef WIN32
+#  ifdef _WIN32
     while (ready < 0 && WSAGetLastError() == WSAEINTR);
 #  else
     while (ready < 0 && (errno == EINTR || errno == EAGAIN));
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 #endif /* HAVE_POLL */
 
    /*
@@ -1233,6 +1233,9 @@ asn1_get_integer(
   int	value;				/* Integer value */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   if (length > sizeof(int))
   {
     (*buffer) += length;
@@ -1259,6 +1262,9 @@ asn1_get_length(unsigned char **buffer,	/* IO - Pointer in buffer */
   unsigned	length;			/* Length */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   length = **buffer;
   (*buffer) ++;
 
@@ -1301,6 +1307,9 @@ asn1_get_oid(
   int		number;			/* OID number */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   valend = *buffer + length;
   oidptr = oid;
   oidend = oid + oidsize - 1;
@@ -1349,9 +1358,12 @@ asn1_get_packed(
   int	value;				/* Value */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   value = 0;
 
-  while ((**buffer & 128) && *buffer < bufend)
+  while (*buffer < bufend && (**buffer & 128))
   {
     value = (value << 7) | (**buffer & 127);
     (*buffer) ++;
@@ -1379,6 +1391,9 @@ asn1_get_string(
     char          *string,		/* I  - String buffer */
     size_t        strsize)		/* I  - String buffer size */
 {
+  if (*buffer >= bufend)
+    return (NULL);
+
   if (length > (unsigned)(bufend - *buffer))
     length = (unsigned)(bufend - *buffer);
 
@@ -1421,6 +1436,9 @@ asn1_get_type(unsigned char **buffer,	/* IO - Pointer in buffer */
   int	type;				/* Type */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   type = **buffer;
   (*buffer) ++;
 

cups/snprintf.c

@@ -1,8 +1,8 @@
 /*
  * snprintf functions for CUPS.
  *
- * Copyright 2007-2013 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -177,7 +177,7 @@ _cups_vsnprintf(char       *buffer,	/* O - Output buffer */
 	      break;
 
 	    sprintf(temp, tformat, va_arg(ap, double));
-	    templen = strlen(temp):
+	    templen = strlen(temp);
 
             bytes += (int)templen;
 
@@ -208,7 +208,7 @@ _cups_vsnprintf(char       *buffer,	/* O - Output buffer */
 	      break;
 
 	    sprintf(temp, tformat, va_arg(ap, int));
-	    templen = strlen(temp):
+	    templen = strlen(temp);
 
             bytes += (int)templen;
 
@@ -232,7 +232,7 @@ _cups_vsnprintf(char       *buffer,	/* O - Output buffer */
 	      break;
 
 	    sprintf(temp, tformat, va_arg(ap, void *));
-	    templen = strlen(temp):
+	    templen = strlen(temp);
 
             bytes += (int)templen;
 

cups/string-private.h

@@ -1,7 +1,7 @@
 /*
  * Private string definitions for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -42,12 +42,12 @@
 #    include <bstring.h>
 #  endif /* HAVE_BSTRING_H */
 
-#  if defined(WIN32) && !defined(__CUPS_SSIZE_T_DEFINED)
+#  if defined(_WIN32) && !defined(__CUPS_SSIZE_T_DEFINED)
 #    define __CUPS_SSIZE_T_DEFINED
 #    include <stddef.h>
 /* Windows does not support the ssize_t type, so map it to long... */
 typedef long ssize_t;			/* @private@ */
-#  endif /* WIN32 && !__CUPS_SSIZE_T_DEFINED */
+#  endif /* _WIN32 && !__CUPS_SSIZE_T_DEFINED */
 
 
 /*
@@ -175,8 +175,7 @@ extern size_t _cups_strlcpy(char *, const char *, size_t);
 #  endif /* !HAVE_STRLCPY */
 
 #  ifndef HAVE_SNPRINTF
-extern int	_cups_snprintf(char *, size_t, const char *, ...)
-		__attribute__ ((__format__ (__printf__, 3, 4)));
+extern int	_cups_snprintf(char *, size_t, const char *, ...) _CUPS_FORMAT(3, 4);
 #    define snprintf _cups_snprintf
 #  endif /* !HAVE_SNPRINTF */
 

cups/string.c

@@ -1,8 +1,8 @@
 /*
  * String functions for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -150,7 +150,7 @@ _cupsStrDate(char   *buf,		/* I - Buffer */
              size_t bufsize,		/* I - Size of buffer */
 	     time_t timeval)		/* I - Time value */
 {
-  struct tm	*dateval;		/* Local date/time */
+  struct tm	date;			/* Local date/time */
   char		temp[1024];		/* Temporary buffer */
   _cups_globals_t *cg = _cupsGlobals();	/* Per-thread globals */
 
@@ -158,15 +158,15 @@ _cupsStrDate(char   *buf,		/* I - Buffer */
   if (!cg->lang_default)
     cg->lang_default = cupsLangDefault();
 
-  dateval = localtime(&timeval);
+  localtime_r(&timeval, &date);
 
   if (cg->lang_default->encoding != CUPS_UTF8)
   {
-    strftime(temp, sizeof(temp), "%c", dateval);
+    strftime(temp, sizeof(temp), "%c", &date);
     cupsCharsetToUTF8((cups_utf8_t *)buf, temp, (int)bufsize, cg->lang_default->encoding);
   }
   else
-    strftime(buf, bufsize, "%c", dateval);
+    strftime(buf, bufsize, "%c", &date);
 
   return (buf);
 }
@@ -316,15 +316,6 @@ _cupsStrFree(const char *s)		/* I - String to free */
 
   key = (_cups_sp_item_t *)(s - offsetof(_cups_sp_item_t, str));
 
-#ifdef DEBUG_GUARDS
-  if (key->guard != _CUPS_STR_GUARD)
-  {
-    DEBUG_printf(("5_cupsStrFree: Freeing string %p(%s), guard=%08x, "
-                  "ref_count=%d", key, key->str, key->guard, key->ref_count));
-    abort();
-  }
-#endif /* DEBUG_GUARDS */
-
   if ((item = (_cups_sp_item_t *)cupsArrayFind(stringpool, key)) != NULL &&
       item == key)
   {
@@ -332,6 +323,14 @@ _cupsStrFree(const char *s)		/* I - String to free */
     * Found it, dereference...
     */
 
+#ifdef DEBUG_GUARDS
+    if (key->guard != _CUPS_STR_GUARD)
+    {
+      DEBUG_printf(("5_cupsStrFree: Freeing string %p(%s), guard=%08x, ref_count=%d", key, key->str, key->guard, key->ref_count));
+      abort();
+    }
+#endif /* DEBUG_GUARDS */
+
     item->ref_count --;
 
     if (!item->ref_count)

cups/tempfile.c

@@ -1,8 +1,8 @@
 /*
  * Temp file utilities for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
- * Copyright 1997-2006 by Easy Software Products.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -21,11 +21,11 @@
 #include <stdlib.h>
 #include <fcntl.h>
 #include <sys/stat.h>
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 || __EMX__ */
+#endif /* _WIN32 || __EMX__ */
 
 
 /*
@@ -42,24 +42,46 @@ cupsTempFd(char *filename,		/* I - Pointer to buffer */
   int		fd;			/* File descriptor for temp file */
   int		tries;			/* Number of tries */
   const char	*tmpdir;		/* TMPDIR environment var */
-#ifdef WIN32
-  char		tmppath[1024];		/* Windows temporary directory */
+#if defined(__APPLE__) || defined(_WIN32)
+  char		tmppath[1024];		/* Temporary directory */
+#endif /* __APPLE__ || _WIN32 */
+#ifdef _WIN32
   DWORD		curtime;		/* Current time */
 #else
   struct timeval curtime;		/* Current time */
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
  /*
   * See if TMPDIR is defined...
   */
 
-#ifdef WIN32
+#ifdef _WIN32
   if ((tmpdir = getenv("TEMP")) == NULL)
   {
     GetTempPath(sizeof(tmppath), tmppath);
     tmpdir = tmppath;
   }
+
+#elif defined(__APPLE__)
+ /*
+  * On macOS and iOS, the TMPDIR environment variable is not always the best
+  * location to place temporary files due to sandboxing.  Instead, the confstr
+  * function should be called to get the proper per-user, per-process TMPDIR
+  * value.
+  */
+
+  if ((tmpdir = getenv("TMPDIR")) != NULL && access(tmpdir, W_OK))
+    tmpdir = NULL;
+
+  if (!tmpdir)
+  {
+    if (confstr(_CS_DARWIN_USER_TEMP_DIR, tmppath, sizeof(tmppath)))
+      tmpdir = tmppath;
+    else
+      tmpdir = "/private/tmp";		/* This should never happen */
+  }
+
 #else
  /*
   * Previously we put root temporary files in the default CUPS temporary
@@ -69,12 +91,8 @@ cupsTempFd(char *filename,		/* I - Pointer to buffer */
   */
 
   if ((tmpdir = getenv("TMPDIR")) == NULL)
-#  if defined(__APPLE__) && !TARGET_OS_IOS
-    tmpdir = "/private/tmp";		/* /tmp is a symlink to /private/tmp */
-#  else
     tmpdir = "/tmp";
-#  endif /* __APPLE__  && !TARGET_OS_IOS */
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
  /*
   * Make the temporary name using the specified directory...
@@ -84,7 +102,7 @@ cupsTempFd(char *filename,		/* I - Pointer to buffer */
 
   do
   {
-#ifdef WIN32
+#ifdef _WIN32
    /*
     * Get the current time of day...
     */
@@ -108,21 +126,21 @@ cupsTempFd(char *filename,		/* I - Pointer to buffer */
     */
 
     snprintf(filename, (size_t)len - 1, "%s/%05x%08x", tmpdir, (unsigned)getpid(), (unsigned)(curtime.tv_sec + curtime.tv_usec + tries));
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
    /*
     * Open the file in "exclusive" mode, making sure that we don't
     * stomp on an existing file or someone's symlink crack...
     */
 
-#ifdef WIN32
+#ifdef _WIN32
     fd = open(filename, _O_CREAT | _O_RDWR | _O_TRUNC | _O_BINARY,
               _S_IREAD | _S_IWRITE);
 #elif defined(O_NOFOLLOW)
     fd = open(filename, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, 0600);
 #else
     fd = open(filename, O_RDWR | O_CREAT | O_EXCL, 0600);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
     if (fd < 0 && errno != EEXIST)
       break;

cups/testarray.c

@@ -494,7 +494,7 @@ main(void)
  * 'get_seconds()' - Get the current time in seconds...
  */
 
-#ifdef WIN32
+#ifdef _WIN32
 #  include <windows.h>
 
 
@@ -515,7 +515,7 @@ get_seconds(void)
   gettimeofday(&curtime, NULL);
   return (curtime.tv_sec + 0.000001 * curtime.tv_usec);
 }
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*

cups/testdest.c

@@ -1,15 +1,9 @@
 /*
  * CUPS destination API test program for CUPS.
  *
- * Copyright 2012-2017 by Apple Inc.
+ * Copyright © 2012-2018 by Apple Inc.
  *
- * These coded instructions, statements, and computer programs are the
- * property of Apple Inc. and are protected by Federal copyright
- * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
- * which should have been included with this file.  If this file is
- * missing or damaged, see the license at "http://www.cups.org/".
- *
- * This file is subject to the Apple OS-Developed Software exception.
+ * Licensed under Apache License v2.0.  See the file "LICENSE" for more information.
  */
 
 /*
@@ -32,7 +26,7 @@ static void	show_conflicts(http_t *http, cups_dest_t *dest, cups_dinfo_t *dinfo,
 static void	show_default(http_t *http, cups_dest_t *dest, cups_dinfo_t *dinfo, const char *option);
 static void	show_media(http_t *http, cups_dest_t *dest, cups_dinfo_t *dinfo, unsigned flags, const char *name);
 static void	show_supported(http_t *http, cups_dest_t *dest, cups_dinfo_t *dinfo, const char *option, const char *value);
-static void	usage(const char *arg) __attribute__((noreturn));
+static void	usage(const char *arg) _CUPS_NORETURN;
 
 
 /*
@@ -43,17 +37,31 @@ int					/* O - Exit status */
 main(int  argc,				/* I - Number of command-line arguments */
      char *argv[])			/* I - Command-line arguments */
 {
+  int		i;			/* Looping var */
   http_t	*http;			/* Connection to destination */
   cups_dest_t	*dest = NULL;		/* Destination */
   cups_dinfo_t	*dinfo;			/* Destination info */
+  unsigned	dflags = CUPS_DEST_FLAGS_NONE;
+					/* Destination flags */
 
 
   if (argc < 2)
-    usage(NULL);
+    return (0);
 
-  if (!strcmp(argv[1], "--enum"))
+  if (!strcmp(argv[1], "--get"))
+  {
+    cups_dest_t	*dests;			/* Destinations */
+    int		num_dests = cupsGetDests2(CUPS_HTTP_DEFAULT, &dests);
+					/* Number of destinations */
+
+    for (i = 0; i < num_dests; i ++)
+      enum_cb(NULL, 0, dests + i);
+
+    cupsFreeDests(num_dests, dests);
+    return (0);
+  }
+  else if (!strcmp(argv[1], "--enum"))
   {
-    int			i;		/* Looping var */
     cups_ptype_t	type = 0,	/* Printer type filter */
 			mask = 0;	/* Printer type mask */
 
@@ -103,78 +111,91 @@ main(int  argc,				/* I - Number of command-line arguments */
 
     return (0);
   }
-  else if (!strncmp(argv[1], "ipp://", 6) || !strncmp(argv[1], "ipps://", 7))
-    dest = cupsGetDestWithURI(NULL, argv[1]);
-  else if (!strcmp(argv[1], "default"))
+
+  i = 1;
+  if (!strcmp(argv[i], "--device"))
+  {
+    dflags = CUPS_DEST_FLAGS_DEVICE;
+    i ++;
+  }
+
+  if (!strncmp(argv[i], "ipp://", 6) || !strncmp(argv[i], "ipps://", 7))
+    dest = cupsGetDestWithURI(NULL, argv[i]);
+  else if (!strcmp(argv[i], "default"))
   {
     dest = cupsGetNamedDest(CUPS_HTTP_DEFAULT, NULL, NULL);
     if (dest && dest->instance)
       printf("default is \"%s/%s\".\n", dest->name, dest->instance);
-    else
+    else if (dest)
       printf("default is \"%s\".\n", dest->name);
+    else
+      puts("no default destination.");
   }
   else
-    dest = cupsGetNamedDest(CUPS_HTTP_DEFAULT, argv[1], NULL);
+    dest = cupsGetNamedDest(CUPS_HTTP_DEFAULT, argv[i], NULL);
 
   if (!dest)
   {
-    printf("testdest: Unable to get destination \"%s\": %s\n", argv[1], cupsLastErrorString());
+    printf("testdest: Unable to get destination \"%s\": %s\n", argv[i], cupsLastErrorString());
     return (1);
   }
 
-  if ((http = cupsConnectDest(dest, CUPS_DEST_FLAGS_NONE, 30000, NULL, NULL, 0, NULL, NULL)) == NULL)
+  i ++;
+
+  if ((http = cupsConnectDest(dest, dflags, 30000, NULL, NULL, 0, NULL, NULL)) == NULL)
   {
-    printf("testdest: Unable to connect to destination \"%s\": %s\n", argv[1], cupsLastErrorString());
+    printf("testdest: Unable to connect to destination \"%s\": %s\n", dest->name, cupsLastErrorString());
     return (1);
   }
 
   if ((dinfo = cupsCopyDestInfo(http, dest)) == NULL)
   {
-    printf("testdest: Unable to get information for destination \"%s\": %s\n", argv[1], cupsLastErrorString());
+    printf("testdest: Unable to get information for destination \"%s\": %s\n", dest->name, cupsLastErrorString());
     return (1);
   }
 
-  if (argc == 2 || (!strcmp(argv[2], "supported") && argc < 6))
+  if (i == argc || !strcmp(argv[i], "supported"))
   {
-    if (argc > 3)
-      show_supported(http, dest, dinfo, argv[3], argv[4]);
+    i ++;
+
+    if ((i + 1) < argc)
+      show_supported(http, dest, dinfo, argv[i], argv[i + 1]);
     else if (argc > 2)
-      show_supported(http, dest, dinfo, argv[3], NULL);
+      show_supported(http, dest, dinfo, argv[i], NULL);
     else
       show_supported(http, dest, dinfo, NULL, NULL);
   }
-  else if (!strcmp(argv[2], "conflicts") && argc > 3)
+  else if (!strcmp(argv[i], "conflicts") && (i + 1) < argc)
   {
-    int			i,		/* Looping var */
-			num_options = 0;/* Number of options */
+    int			num_options = 0;/* Number of options */
     cups_option_t	*options = NULL;/* Options */
 
-    for (i = 3; i < argc; i ++)
+    for (i ++; i < argc; i ++)
       num_options = cupsParseOptions(argv[i], num_options, &options);
 
     show_conflicts(http, dest, dinfo, num_options, options);
   }
-  else if (!strcmp(argv[2], "default") && argc == 4)
+  else if (!strcmp(argv[i], "default") && (i + 1) < argc)
   {
-    show_default(http, dest, dinfo, argv[3]);
+    show_default(http, dest, dinfo, argv[i + 1]);
   }
-  else if (!strcmp(argv[2], "localize") && argc < 6)
+  else if (!strcmp(argv[i], "localize"))
   {
-    if (argc > 3)
-      localize(http, dest, dinfo, argv[3], argv[4]);
+    i ++;
+    if ((i + 1) < argc)
+      localize(http, dest, dinfo, argv[i], argv[i + 1]);
     else if (argc > 2)
-      localize(http, dest, dinfo, argv[3], NULL);
+      localize(http, dest, dinfo, argv[i], NULL);
     else
       localize(http, dest, dinfo, NULL, NULL);
   }
-  else if (!strcmp(argv[2], "media"))
+  else if (!strcmp(argv[i], "media"))
   {
-    int		i;			/* Looping var */
     const char	*name = NULL;		/* Media name, if any */
     unsigned	flags = CUPS_MEDIA_FLAGS_DEFAULT;
 					/* Media selection flags */
 
-    for (i = 3; i < argc; i ++)
+    for (i ++; i < argc; i ++)
     {
       if (!strcmp(argv[i], "borderless"))
 	flags = CUPS_MEDIA_FLAGS_BORDERLESS;
@@ -192,19 +213,19 @@ main(int  argc,				/* I - Number of command-line arguments */
 
     show_media(http, dest, dinfo, flags, name);
   }
-  else if (!strcmp(argv[2], "print") && argc > 3)
+  else if (!strcmp(argv[i], "print") && (i + 1) < argc)
   {
-    int			i,		/* Looping var */
-			num_options = 0;/* Number of options */
+    int			num_options = 0;/* Number of options */
     cups_option_t	*options = NULL;/* Options */
+    const char		*filename = argv[i + 1];
 
-    for (i = 4; i < argc; i ++)
+    for (i += 2; i < argc; i ++)
       num_options = cupsParseOptions(argv[i], num_options, &options);
 
-    print_file(http, dest, dinfo, argv[3], num_options, options);
+    print_file(http, dest, dinfo, filename, num_options, options);
   }
   else
-    usage(argv[2]);
+    usage(argv[i]);
 
   return (0);
 }
@@ -226,13 +247,15 @@ enum_cb(void        *user_data,		/* I - User data (unused) */
   (void)flags;
 
   if (dest->instance)
-    printf("%s%s/%s:\n", (flags & CUPS_DEST_FLAGS_REMOVED) ? "REMOVE " : "", dest->name, dest->instance);
+    printf("%s%s/%s%s:\n", (flags & CUPS_DEST_FLAGS_REMOVED) ? "REMOVE " : "", dest->name, dest->instance, dest->is_default ? " (Default)" : "");
   else
-    printf("%s%s:\n", (flags & CUPS_DEST_FLAGS_REMOVED) ? "REMOVE " : "", dest->name);
+    printf("%s%s%s:\n", (flags & CUPS_DEST_FLAGS_REMOVED) ? "REMOVE " : "", dest->name, dest->is_default ? " (Default)" : "");
 
   for (i = 0; i < dest->num_options; i ++)
     printf("    %s=\"%s\"\n", dest->options[i].name, dest->options[i].value);
 
+  puts("");
+
   return (1);
 }
 
@@ -740,9 +763,10 @@ usage(const char *arg)			/* I - Argument for usage message */
     printf("testdest: Unknown option \"%s\".\n", arg);
 
   puts("Usage:");
-  puts("  ./testdest name [operation ...]");
-  puts("  ./testdest ipp://... [operation ...]");
-  puts("  ./testdest ipps://... [operation ...]");
+  puts("  ./testdest [--device] name [operation ...]");
+  puts("  ./testdest [--device] ipp://... [operation ...]");
+  puts("  ./testdest [--device] ipps://... [operation ...]");
+  puts("  ./testdest --get");
   puts("  ./testdest --enum [grayscale] [color] [duplex] [staple] [small]\n"
        "                    [medium] [large]");
   puts("");

cups/testfile.c

@@ -1,7 +1,7 @@
 /*
  * File test program for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -22,14 +22,11 @@
 #include "file.h"
 #include <stdlib.h>
 #include <time.h>
-#ifdef HAVE_LIBZ
-#  include <zlib.h>
-#endif /* HAVE_LIBZ */
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 #include <fcntl.h>
 
 
@@ -53,10 +50,10 @@ main(int  argc,				/* I - Number of command-line arguments */
   int		status;			/* Exit status */
   char		filename[1024];		/* Filename buffer */
   cups_file_t	*fp;			/* File pointer */
-#ifndef WIN32
+#ifndef _WIN32
   int		fds[2];			/* Open file descriptors */
   cups_file_t	*fdfile;		/* File opened with cupsFileOpenFd() */
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
   int		count;			/* Number of lines in file */
 
 
@@ -84,7 +81,7 @@ main(int  argc,				/* I - Number of command-line arguments */
 
     status += random_tests();
 
-#ifndef WIN32
+#ifndef _WIN32
    /*
     * Test fdopen and close without reading...
     */
@@ -118,7 +115,7 @@ main(int  argc,				/* I - Number of command-line arguments */
 
       puts("PASS");
     }
-#endif /* !WIN32 */
+#endif /* !_WIN32 */
 
    /*
     * Count lines in psglyphs, rewind, then count again.
@@ -174,13 +171,13 @@ main(int  argc,				/* I - Number of command-line arguments */
     */
 
     fputs("\ncupsFileFind: ", stdout);
-#ifdef WIN32
+#ifdef _WIN32
     if (cupsFileFind("notepad.exe", "C:/WINDOWS", 1, filename, sizeof(filename)) &&
 	cupsFileFind("notepad.exe", "C:/WINDOWS;C:/WINDOWS/SYSTEM32", 1, filename, sizeof(filename)))
 #else
     if (cupsFileFind("cat", "/bin", 1, filename, sizeof(filename)) &&
 	cupsFileFind("cat", "/bin:/usr/bin", 1, filename, sizeof(filename)))
-#endif /* WIN32 */
+#endif /* _WIN32 */
       printf("PASS (%s)\n", filename);
     else
     {

cups/testhttp.c

@@ -1,8 +1,8 @@
 /*
  * HTTP test program for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
- * Copyright 1997-2006 by Easy Software Products.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -120,6 +120,9 @@ static uri_test_t	uri_tests[] =	/* URI test data */
 			  { HTTP_URI_STATUS_OK, "ipp://%22%23%2F%3A%3C%3E%3F%40%5B%5C%5D%5E%60%7B%7C%7D/",
 			    "ipp", "", "\"#/:<>?@[\\]^`{|}", "/", 631, 0,
 			    HTTP_URI_CODING_MOST  },
+			  { HTTP_URI_STATUS_UNKNOWN_SCHEME, "smb://server/Some%20Printer",
+			    "smb", "", "server", "/Some Printer", 0, 0,
+			    HTTP_URI_CODING_ALL },
 
 			  /* Missing scheme */
 			  { HTTP_URI_STATUS_MISSING_SCHEME, "/path/to/file/index.html",
@@ -148,6 +151,9 @@ static uri_test_t	uri_tests[] =	/* URI test data */
 			    HTTP_URI_CODING_MOST  },
 
 			  /* Bad scheme */
+			  { HTTP_URI_STATUS_BAD_SCHEME, "://server/ipp",
+			    "", "", "", "", 0, 0,
+			    HTTP_URI_CODING_MOST  },
 			  { HTTP_URI_STATUS_BAD_SCHEME, "bad_scheme://server/resource",
 			    "", "", "", "", 0, 0,
 			    HTTP_URI_CODING_MOST  },
@@ -180,6 +186,9 @@ static uri_test_t	uri_tests[] =	/* URI test data */
 			    HTTP_URI_CODING_MOST  },
 
 			  /* Bad resource */
+			  { HTTP_URI_STATUS_BAD_RESOURCE, "mailto:\r\nbla",
+			    "mailto", "", "", "", 0, 0,
+			    HTTP_URI_CODING_MOST  },
 			  { HTTP_URI_STATUS_BAD_RESOURCE, "http://server/index.html%",
 			    "http", "", "server", "", 80, 0,
 			    HTTP_URI_CODING_MOST  },
@@ -332,6 +341,40 @@ main(int  argc,				/* I - Number of command-line arguments */
     if (!j)
       puts("PASS");
 
+#if 0
+   /*
+    * _httpDigest()
+    */
+
+    fputs("_httpDigest(MD5): ", stdout);
+    if (!_httpDigest(buffer, sizeof(buffer), "MD5", "Mufasa", "http-auth@example.org", "Circle of Life", "7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v", 1, "f2/wE4q74E6zIJEtWaHKaf5wv/H5QzzpXusqGemxURZJ", "auth", "GET", "/dir/index.html"))
+    {
+      failures ++;
+      puts("FAIL (unable to calculate hash)");
+    }
+    else if (strcmp(buffer, "8ca523f5e9506fed4657c9700eebdbec"))
+    {
+      failures ++;
+      printf("FAIL (got \"%s\", expected \"8ca523f5e9506fed4657c9700eebdbec\")\n", buffer);
+    }
+    else
+      puts("PASS");
+
+    fputs("_httpDigest(SHA-256): ", stdout);
+    if (!_httpDigest(buffer, sizeof(buffer), "SHA-256", "Mufasa", "http-auth@example.org", "Circle of Life", "7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v", 1, "f2/wE4q74E6zIJEtWaHKaf5wv/H5QzzpXusqGemxURZJ", "auth", "GET", "/dir/index.html"))
+    {
+      failures ++;
+      puts("FAIL (unable to calculate hash)");
+    }
+    else if (strcmp(buffer, "753927fa0e85d155564e2e272a28d1802ca10daf4496794697cf8db5856cb6c1"))
+    {
+      failures ++;
+      printf("FAIL (got \"%s\", expected \"753927fa0e85d155564e2e272a28d1802ca10daf4496794697cf8db5856cb6c1\")\n", buffer);
+    }
+    else
+      puts("PASS");
+#endif /* 0 */
+
    /*
     * httpGetHostname()
     */
@@ -590,6 +633,8 @@ main(int  argc,				/* I - Number of command-line arguments */
 
   for (i = 1; i < argc; i ++)
   {
+    int new_auth;
+
     if (!strcmp(argv[i], "-o"))
     {
       i ++;
@@ -673,6 +718,8 @@ main(int  argc,				/* I - Number of command-line arguments */
 
     printf("Checking file \"%s\"...\n", resource);
 
+    new_auth = 0;
+
     do
     {
       if (!_cups_strcasecmp(httpGetField(http, HTTP_FIELD_CONNECTION), "close"))
@@ -685,9 +732,13 @@ main(int  argc,				/* I - Number of command-line arguments */
 	}
       }
 
+      if (http->authstring && !strncmp(http->authstring, "Digest ", 7) && !new_auth)
+        _httpSetDigestAuthString(http, http->nextnonce, "HEAD", resource);
+
       httpClearFields(http);
       httpSetField(http, HTTP_FIELD_AUTHORIZATION, httpGetAuthString(http));
       httpSetField(http, HTTP_FIELD_ACCEPT_LANGUAGE, "en");
+
       if (httpHead(http, resource))
       {
         if (httpReconnect2(http, 30000, NULL))
@@ -704,6 +755,8 @@ main(int  argc,				/* I - Number of command-line arguments */
 
       while ((status = httpUpdate(http)) == HTTP_STATUS_CONTINUE);
 
+      new_auth = 0;
+
       if (status == HTTP_STATUS_UNAUTHORIZED)
       {
        /*
@@ -716,7 +769,9 @@ main(int  argc,				/* I - Number of command-line arguments */
 	* See if we can do authentication...
 	*/
 
-	if (cupsDoAuthentication(http, "GET", resource))
+        new_auth = 1;
+
+	if (cupsDoAuthentication(http, "HEAD", resource))
 	{
 	  status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;
 	  break;
@@ -764,6 +819,8 @@ main(int  argc,				/* I - Number of command-line arguments */
     printf("Requesting file \"%s\" (Accept-Encoding: %s)...\n", resource,
            encoding ? encoding : "identity");
 
+    new_auth = 0;
+
     do
     {
       if (!_cups_strcasecmp(httpGetField(http, HTTP_FIELD_CONNECTION), "close"))
@@ -776,6 +833,9 @@ main(int  argc,				/* I - Number of command-line arguments */
 	}
       }
 
+      if (http->authstring && !strncmp(http->authstring, "Digest ", 7) && !new_auth)
+        _httpSetDigestAuthString(http, http->nextnonce, "GET", resource);
+
       httpClearFields(http);
       httpSetField(http, HTTP_FIELD_AUTHORIZATION, httpGetAuthString(http));
       httpSetField(http, HTTP_FIELD_ACCEPT_LANGUAGE, "en");
@@ -797,6 +857,8 @@ main(int  argc,				/* I - Number of command-line arguments */
 
       while ((status = httpUpdate(http)) == HTTP_STATUS_CONTINUE);
 
+      new_auth = 0;
+
       if (status == HTTP_STATUS_UNAUTHORIZED)
       {
        /*
@@ -809,6 +871,8 @@ main(int  argc,				/* I - Number of command-line arguments */
 	* See if we can do authentication...
 	*/
 
+        new_auth = 1;
+
 	if (cupsDoAuthentication(http, "GET", resource))
 	{
 	  status = HTTP_STATUS_CUPS_AUTHORIZATION_CANCELED;

cups/testipp.c

@@ -1,7 +1,7 @@
 /*
  * IPP test program for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
+ * Copyright 2007-2019 by Apple Inc.
  * Copyright 1997-2005 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -20,12 +20,12 @@
 #include "file.h"
 #include "string-private.h"
 #include "ipp-private.h"
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #else
 #  include <unistd.h>
 #  include <fcntl.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -50,7 +50,7 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		  0x01, 0x01,		/* IPP version */
 		  0x00, 0x02,		/* Print-Job operation */
 		  0x00, 0x00, 0x00, 0x01,
-		  			/* Request ID */
+					/* Request ID */
 
 		  IPP_TAG_OPERATION,
 
@@ -80,7 +80,7 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		  IPP_TAG_JOB,		/* job group tag */
 
 		  IPP_TAG_BEGIN_COLLECTION,
-		  			/* begCollection tag */
+					/* begCollection tag */
 		  0x00, 0x09,		/* Name length + name */
 		  'm', 'e', 'd', 'i', 'a', '-', 'c', 'o', 'l',
 		  0x00, 0x00,		/* No value */
@@ -89,11 +89,11 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		    0x00, 0x0a,		/* Value length + value */
 		    'm', 'e', 'd', 'i', 'a', '-', 's', 'i', 'z', 'e',
 		    IPP_TAG_BEGIN_COLLECTION,
-		    			/* begCollection tag */
+					/* begCollection tag */
 		    0x00, 0x00,		/* Name length + name */
 		    0x00, 0x00,		/* No value */
 		      IPP_TAG_MEMBERNAME,
-		      			/* memberAttrName tag */
+					/* memberAttrName tag */
 		      0x00, 0x00,	/* No name */
 		      0x00, 0x0b,	/* Value length + value */
 		      'x', '-', 'd', 'i', 'm', 'e', 'n', 's', 'i', 'o', 'n',
@@ -102,7 +102,7 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		      0x00, 0x04,	/* Value length + value */
 		      0x00, 0x00, 0x54, 0x56,
 		      IPP_TAG_MEMBERNAME,
-		      			/* memberAttrName tag */
+					/* memberAttrName tag */
 		      0x00, 0x00,	/* No name */
 		      0x00, 0x0b,	/* Value length + value */
 		      'y', '-', 'd', 'i', 'm', 'e', 'n', 's', 'i', 'o', 'n',
@@ -111,7 +111,7 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		      0x00, 0x04,	/* Value length + value */
 		      0x00, 0x00, 0x6d, 0x24,
 		    IPP_TAG_END_COLLECTION,
-		    			/* endCollection tag */
+					/* endCollection tag */
 		    0x00, 0x00,		/* No name */
 		    0x00, 0x00,		/* No value */
 		    IPP_TAG_MEMBERNAME,	/* memberAttrName tag */
@@ -132,12 +132,12 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		    0x00, 0x05,		/* Value length + value */
 		    'p', 'l', 'a', 'i', 'n',
 		  IPP_TAG_END_COLLECTION,
-		  			/* endCollection tag */
+					/* endCollection tag */
 		  0x00, 0x00,		/* No name */
 		  0x00, 0x00,		/* No value */
 
 		  IPP_TAG_BEGIN_COLLECTION,
-		  			/* begCollection tag */
+					/* begCollection tag */
 		  0x00, 0x00,		/* No name */
 		  0x00, 0x00,		/* No value */
 		    IPP_TAG_MEMBERNAME,	/* memberAttrName tag */
@@ -145,11 +145,11 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		    0x00, 0x0a,		/* Value length + value */
 		    'm', 'e', 'd', 'i', 'a', '-', 's', 'i', 'z', 'e',
 		    IPP_TAG_BEGIN_COLLECTION,
-		    			/* begCollection tag */
+					/* begCollection tag */
 		    0x00, 0x00,		/* Name length + name */
 		    0x00, 0x00,		/* No value */
 		      IPP_TAG_MEMBERNAME,
-		      			/* memberAttrName tag */
+					/* memberAttrName tag */
 		      0x00, 0x00,	/* No name */
 		      0x00, 0x0b,	/* Value length + value */
 		      'x', '-', 'd', 'i', 'm', 'e', 'n', 's', 'i', 'o', 'n',
@@ -158,7 +158,7 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		      0x00, 0x04,	/* Value length + value */
 		      0x00, 0x00, 0x52, 0x08,
 		      IPP_TAG_MEMBERNAME,
-		      			/* memberAttrName tag */
+					/* memberAttrName tag */
 		      0x00, 0x00,	/* No name */
 		      0x00, 0x0b,	/* Value length + value */
 		      'y', '-', 'd', 'i', 'm', 'e', 'n', 's', 'i', 'o', 'n',
@@ -167,7 +167,7 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		      0x00, 0x04,	/* Value length + value */
 		      0x00, 0x00, 0x74, 0x04,
 		    IPP_TAG_END_COLLECTION,
-		    			/* endCollection tag */
+					/* endCollection tag */
 		    0x00, 0x00,		/* No name */
 		    0x00, 0x00,		/* No value */
 		    IPP_TAG_MEMBERNAME,	/* memberAttrName tag */
@@ -188,7 +188,72 @@ static ipp_uchar_t collection[] =	/* Collection buffer */
 		    0x00, 0x06,		/* Value length + value */
 		    'g', 'l', 'o', 's', 's', 'y',
 		  IPP_TAG_END_COLLECTION,
-		  			/* endCollection tag */
+					/* endCollection tag */
+		  0x00, 0x00,		/* No name */
+		  0x00, 0x00,		/* No value */
+
+		  IPP_TAG_END		/* end tag */
+		};
+static ipp_uchar_t bad_collection[] =	/* Collection buffer (bad encoding) */
+		{
+		  0x01, 0x01,		/* IPP version */
+		  0x00, 0x02,		/* Print-Job operation */
+		  0x00, 0x00, 0x00, 0x01,
+					/* Request ID */
+
+		  IPP_TAG_OPERATION,
+
+		  IPP_TAG_CHARSET,
+		  0x00, 0x12,		/* Name length + name */
+		  'a','t','t','r','i','b','u','t','e','s','-',
+		  'c','h','a','r','s','e','t',
+		  0x00, 0x05,		/* Value length + value */
+		  'u','t','f','-','8',
+
+		  IPP_TAG_LANGUAGE,
+		  0x00, 0x1b,		/* Name length + name */
+		  'a','t','t','r','i','b','u','t','e','s','-',
+		  'n','a','t','u','r','a','l','-','l','a','n',
+		  'g','u','a','g','e',
+		  0x00, 0x02,		/* Value length + value */
+		  'e','n',
+
+		  IPP_TAG_URI,
+		  0x00, 0x0b,		/* Name length + name */
+		  'p','r','i','n','t','e','r','-','u','r','i',
+		  0x00, 0x1c,			/* Value length + value */
+		  'i','p','p',':','/','/','l','o','c','a','l',
+		  'h','o','s','t','/','p','r','i','n','t','e',
+		  'r','s','/','f','o','o',
+
+		  IPP_TAG_JOB,		/* job group tag */
+
+		  IPP_TAG_BEGIN_COLLECTION,
+					/* begCollection tag */
+		  0x00, 0x09,		/* Name length + name */
+		  'm', 'e', 'd', 'i', 'a', '-', 'c', 'o', 'l',
+		  0x00, 0x00,		/* No value */
+		    IPP_TAG_BEGIN_COLLECTION,
+					/* begCollection tag */
+		    0x00, 0x0a,		/* Name length + name */
+		    'm', 'e', 'd', 'i', 'a', '-', 's', 'i', 'z', 'e',
+		    0x00, 0x00,		/* No value */
+		      IPP_TAG_INTEGER,	/* integer tag */
+		      0x00, 0x0b,	/* Name length + name */
+		      'x', '-', 'd', 'i', 'm', 'e', 'n', 's', 'i', 'o', 'n',
+		      0x00, 0x04,	/* Value length + value */
+		      0x00, 0x00, 0x54, 0x56,
+		      IPP_TAG_INTEGER,	/* integer tag */
+		      0x00, 0x0b,	/* Name length + name */
+		      'y', '-', 'd', 'i', 'm', 'e', 'n', 's', 'i', 'o', 'n',
+		      0x00, 0x04,	/* Value length + value */
+		      0x00, 0x00, 0x6d, 0x24,
+		    IPP_TAG_END_COLLECTION,
+					/* endCollection tag */
+		    0x00, 0x00,		/* No name */
+		    0x00, 0x00,		/* No value */
+		  IPP_TAG_END_COLLECTION,
+					/* endCollection tag */
 		  0x00, 0x00,		/* No name */
 		  0x00, 0x00,		/* No value */
 
@@ -200,7 +265,7 @@ static ipp_uchar_t mixed[] =		/* Mixed value buffer */
 		  0x01, 0x01,		/* IPP version */
 		  0x00, 0x02,		/* Print-Job operation */
 		  0x00, 0x00, 0x00, 0x01,
-		  			/* Request ID */
+					/* Request ID */
 
 		  IPP_TAG_OPERATION,
 
@@ -589,12 +654,33 @@ main(int  argc,			/* I - Number of command-line arguments */
 
     ippDelete(request);
 
+   /*
+    * Read the bad collection data and confirm we get an error...
+    */
+
+    fputs("Read Bad Collection from Memory: ", stdout);
+
+    request = ippNew();
+    data.rpos    = 0;
+    data.wused   = sizeof(bad_collection);
+    data.wsize   = sizeof(bad_collection);
+    data.wbuffer = bad_collection;
+
+    while ((state = ippReadIO(&data, (ipp_iocb_t)read_cb, 1, NULL, request)) != IPP_STATE_DATA)
+      if (state == IPP_STATE_ERROR)
+	break;
+
+    if (state != IPP_STATE_ERROR)
+      puts("FAIL (read successful)");
+    else
+      puts("PASS");
+
    /*
     * Read the mixed data and confirm we converted everything to rangeOfInteger
     * values...
     */
 
-    printf("Read Mixed integer/rangeOfInteger from Memory: ");
+    fputs("Read Mixed integer/rangeOfInteger from Memory: ", stdout);
 
     request = ippNew();
     data.rpos    = 0;

cups/testppd.c

@@ -21,12 +21,12 @@
 #include "cups-private.h"
 #include "ppd-private.h"
 #include <sys/stat.h>
-#ifdef WIN32
+#ifdef _WIN32
 #  include <io.h>
 #else
 #  include <unistd.h>
 #  include <fcntl.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 #include <math.h>
 
 
@@ -876,6 +876,13 @@ main(int  argc,				/* I - Number of command-line arguments */
 		host[256],		/* Hostname */
 		resource[256];		/* Resource path */
     int		port;			/* Port number */
+    static const char * const pattrs[] =/* Requested printer attributes */
+    {
+      "job-template",
+      "printer-defaults",
+      "printer-description",
+      "media-col-database"
+    };
 
     if (httpSeparateURI(HTTP_URI_CODING_ALL, argv[1], scheme, sizeof(scheme), userpass, sizeof(userpass), host, sizeof(host), &port, resource, sizeof(resource)) < HTTP_URI_STATUS_OK)
     {
@@ -892,6 +899,7 @@ main(int  argc,				/* I - Number of command-line arguments */
 
     request = ippNewRequest(IPP_OP_GET_PRINTER_ATTRIBUTES);
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, argv[1]);
+    ippAddStrings(request, IPP_TAG_OPERATION, IPP_TAG_KEYWORD, "requested-attributes", sizeof(pattrs) / sizeof(pattrs[0]), NULL, pattrs);
     response = cupsDoRequest(http, request, resource);
 
     if (_ppdCreateFromIPP(buffer, sizeof(buffer), response))
@@ -1046,6 +1054,10 @@ main(int  argc,				/* I - Number of command-line arguments */
             {
 	      switch (cparam->type)
 	      {
+	        case PPD_CUSTOM_UNKNOWN :
+		    printf("              %s(%s): PPD_CUSTOM_UNKNOWN (error)\n", cparam->name, cparam->text);
+	            break;
+
 	        case PPD_CUSTOM_CURVE :
 		    printf("              %s(%s): PPD_CUSTOM_CURVE (%g to %g)\n",
 		           cparam->name, cparam->text,

cups/testsnmp.c

@@ -1,7 +1,7 @@
 /*
  * SNMP test program for CUPS.
  *
- * Copyright 2008-2014 by Apple Inc.
+ * Copyright 2008-2018 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -27,7 +27,7 @@
 static void	print_packet(cups_snmp_t *packet, void *data);
 static int	show_oid(int fd, const char *community,
 		         http_addr_t *addr, const char *s, int walk);
-static void	usage(void) __attribute__((noreturn));
+static void	usage(void) _CUPS_NORETURN;
 
 
 /*

cups/thread-private.h

@@ -46,7 +46,7 @@ typedef pthread_key_t	_cups_threadkey_t;
 #    define _cupsThreadGetData(k) pthread_getspecific(k)
 #    define _cupsThreadSetData(k,p) pthread_setspecific(k,p)
 
-#  elif defined(WIN32)			/* Windows threading */
+#  elif defined(_WIN32)			/* Windows threading */
 #    include <winsock2.h>
 #    include <windows.h>
 typedef void *(__stdcall *_cups_thread_func_t)(void *arg);

cups/thread.c

@@ -1,7 +1,7 @@
 /*
  * Threading primitives for CUPS.
  *
- * Copyright 2009-2017 by Apple Inc.
+ * Copyright © 2009-2018 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -56,8 +56,16 @@ _cupsCondWait(_cups_cond_t  *cond,	/* I - Condition */
   {
     struct timespec abstime;		/* Timeout */
 
-    abstime.tv_sec  = (long)timeout;
-    abstime.tv_nsec = (long)(1000000000 * (timeout - (long)timeout));
+    clock_gettime(CLOCK_REALTIME, &abstime);
+
+    abstime.tv_sec  += (long)timeout;
+    abstime.tv_nsec += (long)(1000000000 * (timeout - (long)timeout));
+
+    while (abstime.tv_nsec >= 1000000000)
+    {
+      abstime.tv_nsec -= 1000000000;
+      abstime.tv_sec ++;
+    };
 
     pthread_cond_timedwait(cond, mutex, &abstime);
   }
@@ -200,7 +208,7 @@ _cupsThreadWait(_cups_thread_t thread)	/* I - Thread ID */
 }
 
 
-#elif defined(WIN32)
+#elif defined(_WIN32)
 #  include <process.h>
 
 
@@ -513,8 +521,7 @@ _cupsThreadCreate(
     _cups_thread_func_t func,		/* I - Entry point */
     void                *arg)		/* I - Entry point context */
 {
-  fputs("DEBUG: CUPS was compiled without threading support, no thread "
-        "created.\n", stderr);
+  fputs("DEBUG: CUPS was compiled without threading support, no thread created.\n", stderr);
 
   (void)func;
   (void)arg;
@@ -523,6 +530,17 @@ _cupsThreadCreate(
 }
 
 
+/*
+ * '_cupsThreadDetach()' - Tell the OS that the thread is running independently.
+ */
+
+void
+_cupsThreadDetach(_cups_thread_t thread)/* I - Thread ID */
+{
+  (void)thread;
+}
+
+
 /*
  * '_cupsThreadWait()' - Wait for a thread to exit.
  */

cups/tls-darwin.c

@@ -1,8 +1,8 @@
 /*
  * TLS support code for CUPS on macOS.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -53,7 +53,9 @@ static char		*tls_keypath = NULL;
 					/* Server cert keychain path */
 static _cups_mutex_t	tls_mutex = _CUPS_MUTEX_INITIALIZER;
 					/* Mutex for keychain/certs */
-static int		tls_options = -1;/* Options for TLS connections */
+static int		tls_options = -1,/* Options for TLS connections */
+			tls_min_version = _HTTP_TLS_1_0,
+			tls_max_version = _HTTP_TLS_MAX;
 
 
 /*
@@ -807,7 +809,6 @@ httpCredentialsString(
     CFStringRef		cf_name;	/* CF common name string */
     char		name[256];	/* Common name associated with cert */
     time_t		expiration;	/* Expiration date of cert */
-    _cups_md5_state_t	md5_state;	/* MD5 state */
     unsigned char	md5_digest[16];	/* MD5 result */
 
     if ((cf_name = SecCertificateCopySubjectSummary(secCert)) != NULL)
@@ -820,9 +821,7 @@ httpCredentialsString(
 
     expiration = (time_t)(SecCertificateNotValidAfter(secCert) + kCFAbsoluteTimeIntervalSince1970);
 
-    _cupsMD5Init(&md5_state);
-    _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
-    _cupsMD5Finish(&md5_state, md5_digest);
+    cupsHashData("md5", first->data, first->datalen, md5_digest, sizeof(md5_digest));
 
     snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
 
@@ -1139,10 +1138,16 @@ _httpTLSRead(http_t *http,		/* I - HTTP connection */
  */
 
 void
-_httpTLSSetOptions(int options)		/* I - Options */
+_httpTLSSetOptions(int options,		/* I - Options */
+                   int min_version,	/* I - Minimum TLS version */
+                   int max_version)	/* I - Maximum TLS version */
 {
   if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
-    tls_options = options;
+  {
+    tls_options     = options;
+    tls_min_version = min_version;
+    tls_max_version = max_version;
+  }
 }
 
 
@@ -1174,7 +1179,7 @@ _httpTLSStart(http_t *http)		/* I - HTTP connection */
   {
     DEBUG_puts("4_httpTLSStart: Setting defaults.");
     _cupsSetDefaults();
-    DEBUG_printf(("4_httpTLSStart: tls_options=%x", tls_options));
+    DEBUG_printf(("4_httpTLSStart: tls_options=%x, tls_min_version=%d, tls_max_version=%d", tls_options, tls_min_version, tls_max_version));
   }
 
 #ifdef HAVE_SECKEYCHAINOPEN
@@ -1217,22 +1222,25 @@ _httpTLSStart(http_t *http)		/* I - HTTP connection */
 
   if (!error)
   {
-    SSLProtocol minProtocol;
-
-    if (tls_options & _HTTP_TLS_DENY_TLS10)
-      minProtocol = kTLSProtocol11;
-    else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
-      minProtocol = kSSLProtocol3;
-    else
-      minProtocol = kTLSProtocol1;
-
-    error = SSLSetProtocolVersionMin(http->tls, minProtocol);
-    DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", minProtocol, (int)error));
-
-    if (!error && (tls_options & _HTTP_TLS_ONLY_TLS10))
+    static const SSLProtocol protocols[] =	/* Min/max protocol versions */
     {
-      error = SSLSetProtocolVersionMax(http->tls, kTLSProtocol1);
-      DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(kTLSProtocol1), error=%d", (int)error));
+      kSSLProtocol3,
+      kTLSProtocol1,
+      kTLSProtocol11,
+      kTLSProtocol12,
+      kTLSProtocol13
+    };
+
+    if (tls_min_version < _HTTP_TLS_MAX)
+    {
+      error = SSLSetProtocolVersionMin(http->tls, protocols[tls_min_version]);
+      DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", protocols[tls_min_version], (int)error));
+    }
+
+    if (!error && tls_max_version < _HTTP_TLS_MAX)
+    {
+      error = SSLSetProtocolVersionMax(http->tls, protocols[tls_max_version]);
+      DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(%d), error=%d", protocols[tls_max_version], (int)error));
     }
   }
 
@@ -1532,7 +1540,28 @@ _httpTLSStart(http_t *http)		/* I - HTTP connection */
 
   if (!error)
   {
-    int done = 0;			/* Are we done yet? */
+    int			done = 0;	/* Are we done yet? */
+    double		old_timeout;	/* Old timeout value */
+    http_timeout_cb_t	old_cb;		/* Old timeout callback */
+    void		*old_data;	/* Old timeout data */
+
+   /*
+    * Enforce a minimum timeout of 10 seconds for the TLS handshake...
+    */
+
+    old_timeout  = http->timeout_value;
+    old_cb       = http->timeout_cb;
+    old_data     = http->timeout_data;
+
+    if (!old_cb || old_timeout < 10.0)
+    {
+      DEBUG_puts("4_httpTLSStart: Setting timeout to 10 seconds.");
+      httpSetTimeout(http, 10.0, NULL, NULL);
+    }
+
+   /*
+    * Do the TLS handshake...
+    */
 
     while (!error && !done)
     {
@@ -1653,6 +1682,12 @@ _httpTLSStart(http_t *http)		/* I - HTTP connection */
 	    break;
       }
     }
+
+   /*
+    * Restore the previous timeout settings...
+    */
+
+    httpSetTimeout(http, old_timeout, old_cb, old_data);
   }
 
   if (error)
@@ -1864,7 +1899,9 @@ http_cdsa_copy_server(
   DEBUG_printf(("4http_cdsa_copy_server: Returning %p.", (void *)certificates));
 
   return (certificates);
+
 #else
+  (void)common_name;
 
   if (!tls_selfsigned)
     return (NULL);
@@ -2085,7 +2122,7 @@ http_cdsa_read(
 
   http = (http_t *)connection;
 
-  if (!http->blocking)
+  if (!http->blocking || http->timeout_value > 0.0)
   {
    /*
     * Make sure we have data before we read...

cups/tls-gnutls.c

@@ -1,8 +1,8 @@
 /*
  * TLS support code for CUPS using GNU TLS.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -35,7 +35,9 @@ static char		*tls_keypath = NULL;
 					/* Server cert keychain path */
 static _cups_mutex_t	tls_mutex = _CUPS_MUTEX_INITIALIZER;
 					/* Mutex for keychain/certs */
-static int		tls_options = -1;/* Options for TLS connections */
+static int		tls_options = -1,/* Options for TLS connections */
+			tls_min_version = _HTTP_TLS_1_0,
+			tls_max_version = _HTTP_TLS_MAX;
 
 
 /*
@@ -171,10 +173,33 @@ cupsMakeServerCredentials(
   gnutls_x509_crt_set_activation_time(crt, curtime);
   gnutls_x509_crt_set_expiration_time(crt, curtime + 10 * 365 * 86400);
   gnutls_x509_crt_set_ca_status(crt, 0);
+  gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, common_name, (unsigned)strlen(common_name), GNUTLS_FSAN_SET);
+  if (!strchr(common_name, '.'))
+  {
+   /*
+    * Add common_name.local to the list, too...
+    */
+
+    char localname[256];                /* hostname.local */
+
+    snprintf(localname, sizeof(localname), "%s.local", common_name);
+    gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, localname, (unsigned)strlen(localname), GNUTLS_FSAN_APPEND);
+  }
+  gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, "localhost", 9, GNUTLS_FSAN_APPEND);
   if (num_alt_names > 0)
-    gnutls_x509_crt_set_subject_alternative_name(crt, GNUTLS_SAN_DNSNAME, alt_names[0]);
+  {
+    int i;                              /* Looping var */
+
+    for (i = 0; i < num_alt_names; i ++)
+    {
+      if (strcmp(alt_names[i], "localhost"))
+      {
+        gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME, alt_names[i], (unsigned)strlen(alt_names[i]), GNUTLS_FSAN_APPEND);
+      }
+    }
+  }
   gnutls_x509_crt_set_key_purpose_oid(crt, GNUTLS_KP_TLS_WWW_SERVER, 0);
-  gnutls_x509_crt_set_key_usage(crt, GNUTLS_KEY_KEY_ENCIPHERMENT);
+  gnutls_x509_crt_set_key_usage(crt, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT);
   gnutls_x509_crt_set_version(crt, 3);
 
   bytes = sizeof(buffer);
@@ -378,8 +403,8 @@ httpCredentialsAreValidForName(
 
     if (result)
     {
-      int		i,		/* Looping var */
-			count;		/* Number of revoked certificates */
+      gnutls_x509_crl_iter_t iter = NULL;
+					/* Iterator */
       unsigned char	cserial[1024],	/* Certificate serial number */
 			rserial[1024];	/* Revoked serial number */
       size_t		cserial_size,	/* Size of cert serial number */
@@ -387,22 +412,24 @@ httpCredentialsAreValidForName(
 
       _cupsMutexLock(&tls_mutex);
 
-      count = gnutls_x509_crl_get_crt_count(tls_crl);
-
-      if (count > 0)
+      if (gnutls_x509_crl_get_crt_count(tls_crl) > 0)
       {
         cserial_size = sizeof(cserial);
         gnutls_x509_crt_get_serial(cert, cserial, &cserial_size);
 
-        for (i = 0; i < count; i ++)
-	{
-	  rserial_size = sizeof(rserial);
-          if (!gnutls_x509_crl_get_crt_serial(tls_crl, (unsigned)i, rserial, &rserial_size, NULL) && cserial_size == rserial_size && !memcmp(cserial, rserial, rserial_size))
+	rserial_size = sizeof(rserial);
+
+        while (!gnutls_x509_crl_iter_crt_serial(tls_crl, &iter, rserial, &rserial_size, NULL))
+        {
+          if (cserial_size == rserial_size && !memcmp(cserial, rserial, rserial_size))
 	  {
 	    result = 0;
 	    break;
 	  }
+
+	  rserial_size = sizeof(rserial);
 	}
+	gnutls_x509_crl_iter_deinit(iter);
       }
 
       _cupsMutexUnlock(&tls_mutex);
@@ -646,7 +673,6 @@ httpCredentialsString(
     char		name[256];	/* Common name associated with cert */
     size_t		namelen;	/* Length of name */
     time_t		expiration;	/* Expiration date of cert */
-    _cups_md5_state_t	md5_state;	/* MD5 state */
     unsigned char	md5_digest[16];	/* MD5 result */
 
     namelen = sizeof(name) - 1;
@@ -657,9 +683,7 @@ httpCredentialsString(
 
     expiration = gnutls_x509_crt_get_expiration_time(cert);
 
-    _cupsMD5Init(&md5_state);
-    _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
-    _cupsMD5Finish(&md5_state, md5_digest);
+    cupsHashData("md5", first->data, first->datalen, md5_digest, sizeof(md5_digest));
 
     snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
 
@@ -1094,7 +1118,7 @@ http_gnutls_read(
 
   http = (http_t *)ptr;
 
-  if (!http->blocking)
+  if (!http->blocking || http->timeout_value > 0.0)
   {
    /*
     * Make sure we have data before we read...
@@ -1224,10 +1248,16 @@ _httpTLSSetCredentials(http_t *http)	/* I - Connection to server */
  */
 
 void
-_httpTLSSetOptions(int options)		/* I - Options */
+_httpTLSSetOptions(int options,		/* I - Options */
+                   int min_version,	/* I - Minimum TLS version */
+                   int max_version)	/* I - Maximum TLS version */
 {
   if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
-    tls_options = options;
+  {
+    tls_options     = options;
+    tls_min_version = min_version;
+    tls_max_version = max_version;
+  }
 }
 
 
@@ -1245,6 +1275,19 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 					/* TLS credentials */
   char			priority_string[2048];
 					/* Priority string */
+  int			version;	/* Current version */
+  double		old_timeout;	/* Old timeout value */
+  http_timeout_cb_t	old_cb;		/* Old timeout callback */
+  void			*old_data;	/* Old timeout data */
+  static const char * const versions[] =/* SSL/TLS versions */
+  {
+    "VERS-SSL3.0",
+    "VERS-TLS1.0",
+    "VERS-TLS1.1",
+    "VERS-TLS1.2",
+    "VERS-TLS1.3",
+    "VERS-TLS-ALL"
+  };
 
 
   DEBUG_printf(("3_httpTLSStart(http=%p)", http));
@@ -1506,14 +1549,40 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 
   strlcpy(priority_string, "NORMAL", sizeof(priority_string));
 
-  if (tls_options & _HTTP_TLS_DENY_TLS10)
-    strlcat(priority_string, ":+VERS-TLS-ALL:-VERS-TLS1.0:-VERS-SSL3.0", sizeof(priority_string));
-  else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+  if (tls_max_version < _HTTP_TLS_MAX)
+  {
+   /*
+    * Require specific TLS versions...
+    */
+
+    strlcat(priority_string, ":-VERS-TLS-ALL", sizeof(priority_string));
+    for (version = tls_min_version; version <= tls_max_version; version ++)
+    {
+      strlcat(priority_string, ":+", sizeof(priority_string));
+      strlcat(priority_string, versions[version], sizeof(priority_string));
+    }
+  }
+  else if (tls_min_version == _HTTP_TLS_SSL3)
+  {
+   /*
+    * Allow all versions of TLS and SSL/3.0...
+    */
+
     strlcat(priority_string, ":+VERS-TLS-ALL:+VERS-SSL3.0", sizeof(priority_string));
-  else if (tls_options & _HTTP_TLS_ONLY_TLS10)
-    strlcat(priority_string, ":-VERS-TLS-ALL:-VERS-SSL3.0:+VERS-TLS1.0", sizeof(priority_string));
+  }
   else
-    strlcat(priority_string, ":+VERS-TLS-ALL:-VERS-SSL3.0", sizeof(priority_string));
+  {
+   /*
+    * Require a minimum version...
+    */
+
+    strlcat(priority_string, ":+VERS-TLS-ALL", sizeof(priority_string));
+    for (version = 0; version < tls_min_version; version ++)
+    {
+      strlcat(priority_string, ":-", sizeof(priority_string));
+      strlcat(priority_string, versions[version], sizeof(priority_string));
+    }
+  }
 
   if (tls_options & _HTTP_TLS_ALLOW_RC4)
     strlcat(priority_string, ":+ARCFOUR-128", sizeof(priority_string));
@@ -1543,6 +1612,24 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
 #endif /* HAVE_GNUTLS_TRANSPORT_SET_PULL_TIMEOUT_FUNCTION */
   gnutls_transport_set_push_function(http->tls, http_gnutls_write);
 
+ /*
+  * Enforce a minimum timeout of 10 seconds for the TLS handshake...
+  */
+
+  old_timeout  = http->timeout_value;
+  old_cb       = http->timeout_cb;
+  old_data     = http->timeout_data;
+
+  if (!old_cb || old_timeout < 10.0)
+  {
+    DEBUG_puts("4_httpTLSStart: Setting timeout to 10 seconds.");
+    httpSetTimeout(http, 10.0, NULL, NULL);
+  }
+
+ /*
+  * Do the TLS handshake...
+  */
+
   while ((status = gnutls_handshake(http->tls)) != GNUTLS_E_SUCCESS)
   {
     DEBUG_printf(("5_httpStartTLS: gnutls_handshake returned %d (%s)",
@@ -1560,10 +1647,18 @@ _httpTLSStart(http_t *http)		/* I - Connection to server */
       free(credentials);
       http->tls = NULL;
 
+      httpSetTimeout(http, old_timeout, old_cb, old_data);
+
       return (-1);
     }
   }
 
+ /*
+  * Restore the previous timeout settings...
+  */
+
+  httpSetTimeout(http, old_timeout, old_cb, old_data);
+
   http->tls_credentials = credentials;
 
   return (0);

cups/tls-sspi.c

@@ -2,7 +2,7 @@
  * TLS support for CUPS on Windows using the Security Support Provider
  * Interface (SSPI).
  *
- * Copyright 2010-2017 by Apple Inc.
+ * Copyright 2010-2018 by Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -52,7 +52,9 @@
  * Local globals...
  */
 
-static int		tls_options = -1;/* Options for TLS connections */
+static int		tls_options = -1,/* Options for TLS connections */
+			tls_min_version = _HTTP_TLS_1_0,
+			tls_max_version = _HTTP_TLS_MAX;
 
 
 /*
@@ -351,7 +353,6 @@ httpCredentialsString(
     SYSTEMTIME		systime;	/* System time */
     struct tm		tm;		/* UNIX date/time */
     time_t		expiration;	/* Expiration date of cert */
-    _cups_md5_state_t	md5_state;	/* MD5 state */
     unsigned char	md5_digest[16];	/* MD5 result */
 
     FileTimeToSystemTime(&(cert->pCertInfo->NotAfter), &systime);
@@ -378,9 +379,7 @@ httpCredentialsString(
     else
       strlcpy(cert_name, "unknown", sizeof(cert_name));
 
-    _cupsMD5Init(&md5_state);
-    _cupsMD5Append(&md5_state, first->data, (int)first->datalen);
-    _cupsMD5Finish(&md5_state, md5_digest);
+    cupsHashData("md5", first->data, first->datalen, md5_digest, sizeof(md5_digest));
 
     snprintf(buffer, bufsize, "%s / %s / %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", cert_name, httpGetDateString(expiration), md5_digest[0], md5_digest[1], md5_digest[2], md5_digest[3], md5_digest[4], md5_digest[5], md5_digest[6], md5_digest[7], md5_digest[8], md5_digest[9], md5_digest[10], md5_digest[11], md5_digest[12], md5_digest[13], md5_digest[14], md5_digest[15]);
 
@@ -911,10 +910,16 @@ _httpTLSRead(http_t *http,		/* I - HTTP connection */
  */
 
 void
-_httpTLSSetOptions(int options)		/* I - Options */
+_httpTLSSetOptions(int options,		/* I - Options */
+                   int min_version,	/* I - Minimum TLS version */
+                   int max_version)	/* I - Maximum TLS version */
 {
   if (!(options & _HTTP_TLS_SET_DEFAULT) || tls_options < 0)
-    tls_options = options;
+  {
+    tls_options     = options;
+    tls_min_version = min_version;
+    tls_max_version = max_version;
+  }
 }
 
 
@@ -1762,34 +1767,38 @@ http_sspi_find_credentials(
 #ifdef SP_PROT_TLS1_2_SERVER
   if (http->mode == _HTTP_MODE_SERVER)
   {
-    if (tls_options & _HTTP_TLS_DENY_TLS10)
-      SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER;
-    else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+    if (tls_min_version == _HTTP_TLS_SSL3)
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_0_SERVER | SP_PROT_SSL3_SERVER;
-    else
+    else if (tls_min_version == _HTTP_TLS_1_0)
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_0_SERVER;
+    else if (tls_min_version == _HTTP_TLS_1_1)
+      SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_1_SERVER;
+    else
+      SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_SERVER;
   }
   else
   {
-    if (tls_options & _HTTP_TLS_DENY_TLS10)
-      SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT;
-    else if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+    if (tls_min_version == _HTTP_TLS_SSL3)
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_0_CLIENT | SP_PROT_SSL3_CLIENT;
-    else
+    else if (tls_min_version == _HTTP_TLS_1_0)
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_0_CLIENT;
+    else if (tls_min_version == _HTTP_TLS_1_1)
+      SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_1_CLIENT;
+    else
+      SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT;
   }
 
 #else
   if (http->mode == _HTTP_MODE_SERVER)
   {
-    if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+    if (tls_min_version == _HTTP_TLS_SSL3)
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_SERVER | SP_PROT_SSL3_SERVER;
     else
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_SERVER;
   }
   else
   {
-    if (tls_options & _HTTP_TLS_ALLOW_SSL3)
+    if (tls_min_version == _HTTP_TLS_SSL3)
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT | SP_PROT_SSL3_CLIENT;
     else
       SchannelCred.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT;

cups/tls.c

@@ -23,20 +23,20 @@
 #include "cups-private.h"
 #include <fcntl.h>
 #include <math.h>
-#ifdef WIN32
+#ifdef _WIN32
 #  include <tchar.h>
 #else
 #  include <signal.h>
 #  include <sys/time.h>
 #  include <sys/resource.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 #ifdef HAVE_POLL
 #  include <poll.h>
 #endif /* HAVE_POLL */
 
 
 /*
- * Local functions...
+ * Include platform-specific TLS code...
  */
 
 #ifdef HAVE_SSL

cups/tlscheck.c

@@ -54,6 +54,8 @@ main(int  argc,				/* I - Number of command-line arguments */
   int		af = AF_UNSPEC,		/* Address family */
 		tls_options = _HTTP_TLS_NONE,
 					/* TLS options */
+		tls_min_version = _HTTP_TLS_1_0,
+		tls_max_version = _HTTP_TLS_MAX,
 		verbose = 0;		/* Verbosity */
   ipp_t		*request,		/* IPP Get-Printer-Attributes request */
 		*response;		/* IPP Get-Printer-Attributes response */
@@ -88,11 +90,27 @@ main(int  argc,				/* I - Number of command-line arguments */
     }
     else if (!strcmp(argv[i], "--no-tls10"))
     {
-      tls_options |= _HTTP_TLS_DENY_TLS10;
+      tls_min_version = _HTTP_TLS_1_1;
     }
     else if (!strcmp(argv[i], "--tls10"))
     {
-      tls_options |= _HTTP_TLS_ONLY_TLS10;
+      tls_min_version = _HTTP_TLS_1_0;
+      tls_max_version = _HTTP_TLS_1_0;
+    }
+    else if (!strcmp(argv[i], "--tls11"))
+    {
+      tls_min_version = _HTTP_TLS_1_1;
+      tls_max_version = _HTTP_TLS_1_1;
+    }
+    else if (!strcmp(argv[i], "--tls12"))
+    {
+      tls_min_version = _HTTP_TLS_1_2;
+      tls_max_version = _HTTP_TLS_1_2;
+    }
+    else if (!strcmp(argv[i], "--tls13"))
+    {
+      tls_min_version = _HTTP_TLS_1_3;
+      tls_max_version = _HTTP_TLS_1_3;
     }
     else if (!strcmp(argv[i], "--rc4"))
     {
@@ -148,7 +166,7 @@ main(int  argc,				/* I - Number of command-line arguments */
   if (!port)
     port = 631;
 
-  _httpTLSSetOptions(tls_options);
+  _httpTLSSetOptions(tls_options, tls_min_version, tls_max_version);
 
   http = httpConnect2(server, port, NULL, af, HTTP_ENCRYPTION_ALWAYS, 1, 30000, NULL);
   if (!http)
@@ -741,6 +759,9 @@ usage(void)
   puts("  --no-tls10  Disable TLS/1.0");
   puts("  --rc4       Allow RC4 encryption");
   puts("  --tls10     Only use TLS/1.0");
+  puts("  --tls11     Only use TLS/1.1");
+  puts("  --tls12     Only use TLS/1.2");
+  puts("  --tls13     Only use TLS/1.3");
   puts("  --verbose   Be verbose");
   puts("  -4          Connect using IPv4 addresses only");
   puts("  -6          Connect using IPv6 addresses only");

cups/usersys.c

@@ -20,13 +20,13 @@
 #include "cups-private.h"
 #include <stdlib.h>
 #include <sys/stat.h>
-#ifdef WIN32
+#ifdef _WIN32
 #  include <windows.h>
 #else
 #  include <pwd.h>
 #  include <termios.h>
 #  include <sys/utsname.h>
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
 /*
@@ -54,7 +54,9 @@
 typedef struct _cups_client_conf_s	/**** client.conf config data ****/
 {
 #ifdef HAVE_SSL
-  int			ssl_options;	/* SSLOptions values */
+  int			ssl_options,	/* SSLOptions values */
+			ssl_min_version,/* Minimum SSL/TLS version */
+			ssl_max_version;/* Maximum SSL/TLS version */
 #endif /* HAVE_SSL */
   int			trust_first,	/* Trust on first use? */
 			any_root,	/* Allow any (e.g., self-signed) root */
@@ -488,12 +490,12 @@ cupsSetUserAgent(const char *user_agent)/* I - User-Agent string or @code NULL@
 {
   _cups_globals_t	*cg = _cupsGlobals();
 					/* Thread globals */
-#ifdef WIN32
+#ifdef _WIN32
   SYSTEM_INFO		sysinfo;	/* System information */
   OSVERSIONINFO		version;	/* OS version info */
 #else
   struct utsname	name;		/* uname info */
-#endif /* WIN32 */
+#endif /* _WIN32 */
 
 
   if (user_agent)
@@ -502,7 +504,7 @@ cupsSetUserAgent(const char *user_agent)/* I - User-Agent string or @code NULL@
     return;
   }
 
-#ifdef WIN32
+#ifdef _WIN32
   version.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
   GetVersionEx(&version);
   GetNativeSystemInfo(&sysinfo);
@@ -526,7 +528,7 @@ cupsSetUserAgent(const char *user_agent)/* I - User-Agent string or @code NULL@
   snprintf(cg->user_agent, sizeof(cg->user_agent),
            CUPS_MINIMAL " (%s %s; %s) IPP/2.0",
 	   name.sysname, name.release, name.machine);
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -578,7 +580,7 @@ cupsUserAgent(void)
 const char *				/* O - Password or @code NULL@ if none */
 _cupsGetPassword(const char *prompt)	/* I - Prompt string */
 {
-#ifdef WIN32
+#ifdef _WIN32
   HANDLE		tty;		/* Console handle */
   DWORD			mode;		/* Console mode */
   char			passch,		/* Current key press */
@@ -844,7 +846,7 @@ _cupsGetPassword(const char *prompt)	/* I - Prompt string */
     memset(cg->password, 0, sizeof(cg->password));
     return (NULL);
   }
-#endif /* WIN32 */
+#endif /* _WIN32 */
 }
 
 
@@ -903,7 +905,7 @@ _cupsSetDefaults(void)
 
 #  ifdef HAVE_GETEUID
   if ((geteuid() == getuid() || !getuid()) && getegid() == getgid() && (home = getenv("HOME")) != NULL)
-#  elif !defined(WIN32)
+#  elif !defined(_WIN32)
   if (getuid() && (home = getenv("HOME")) != NULL)
 #  else
   if ((home = getenv("HOME")) != NULL)
@@ -957,7 +959,7 @@ _cupsSetDefaults(void)
     cg->validate_certs = cc.validate_certs;
 
 #ifdef HAVE_SSL
-  _httpTLSSetOptions(cc.ssl_options | _HTTP_TLS_SET_DEFAULT);
+  _httpTLSSetOptions(cc.ssl_options | _HTTP_TLS_SET_DEFAULT, cc.ssl_min_version, cc.ssl_max_version);
 #endif /* HAVE_SSL */
 }
 
@@ -1099,7 +1101,7 @@ cups_finalize_client_conf(
 
   if (!cc->user[0])
   {
-#ifdef WIN32
+#ifdef _WIN32
    /*
     * Get the current user name from the OS...
     */
@@ -1135,7 +1137,7 @@ cups_finalize_client_conf(
     if (pw)
       strlcpy(cc->user, pw->pw_name, sizeof(cc->user));
     else
-#endif /* WIN32 */
+#endif /* _WIN32 */
     {
      /*
       * Use the default "unknown" user name...
@@ -1164,11 +1166,15 @@ cups_init_client_conf(
 
   memset(cc, 0, sizeof(_cups_client_conf_t));
 
-  cc->encryption     = (http_encryption_t)-1;
-  cc->trust_first    = -1;
-  cc->any_root       = -1;
-  cc->expired_certs  = -1;
-  cc->validate_certs = -1;
+#ifdef HAVE_SSL
+  cc->ssl_min_version = _HTTP_TLS_1_0;
+  cc->ssl_max_version = _HTTP_TLS_MAX;
+#endif /* HAVE_SSL */
+  cc->encryption      = (http_encryption_t)-1;
+  cc->trust_first     = -1;
+  cc->any_root        = -1;
+  cc->expired_certs   = -1;
+  cc->validate_certs  = -1;
 
  /*
   * Load settings from the org.cups.PrintingPrefs plist (which trump
@@ -1336,7 +1342,9 @@ cups_set_ssl_options(
   * SSLOptions [AllowRC4] [AllowSSL3] [AllowDH] [DenyTLS1.0] [None]
   */
 
-  int	options = _HTTP_TLS_NONE;	/* SSL/TLS options */
+  int	options = _HTTP_TLS_NONE,	/* SSL/TLS options */
+	min_version = _HTTP_TLS_1_0,	/* Minimum SSL/TLS version */
+	max_version = _HTTP_TLS_MAX;	/* Maximum SSL/TLS version */
   char	temp[256],			/* Copy of value */
 	*start,				/* Start of option */
 	*end;				/* End of option */
@@ -1364,20 +1372,38 @@ cups_set_ssl_options(
     if (!_cups_strcasecmp(start, "AllowRC4"))
       options |= _HTTP_TLS_ALLOW_RC4;
     else if (!_cups_strcasecmp(start, "AllowSSL3"))
-      options |= _HTTP_TLS_ALLOW_SSL3;
+      min_version = _HTTP_TLS_SSL3;
     else if (!_cups_strcasecmp(start, "AllowDH"))
       options |= _HTTP_TLS_ALLOW_DH;
     else if (!_cups_strcasecmp(start, "DenyCBC"))
       options |= _HTTP_TLS_DENY_CBC;
     else if (!_cups_strcasecmp(start, "DenyTLS1.0"))
-      options |= _HTTP_TLS_DENY_TLS10;
+      min_version = _HTTP_TLS_1_1;
+    else if (!_cups_strcasecmp(start, "MaxTLS1.0"))
+      max_version = _HTTP_TLS_1_0;
+    else if (!_cups_strcasecmp(start, "MaxTLS1.1"))
+      max_version = _HTTP_TLS_1_1;
+    else if (!_cups_strcasecmp(start, "MaxTLS1.2"))
+      max_version = _HTTP_TLS_1_2;
+    else if (!_cups_strcasecmp(start, "MaxTLS1.3"))
+      max_version = _HTTP_TLS_1_3;
+    else if (!_cups_strcasecmp(start, "MinTLS1.0"))
+      min_version = _HTTP_TLS_1_0;
+    else if (!_cups_strcasecmp(start, "MinTLS1.1"))
+      min_version = _HTTP_TLS_1_1;
+    else if (!_cups_strcasecmp(start, "MinTLS1.2"))
+      min_version = _HTTP_TLS_1_2;
+    else if (!_cups_strcasecmp(start, "MinTLS1.3"))
+      min_version = _HTTP_TLS_1_3;
     else if (!_cups_strcasecmp(start, "None"))
       options = _HTTP_TLS_NONE;
   }
 
-  cc->ssl_options = options;
+  cc->ssl_options     = options;
+  cc->ssl_max_version = max_version;
+  cc->ssl_min_version = min_version;
 
-  DEBUG_printf(("4cups_set_ssl_options(cc=%p, value=\"%s\") options=%x", (void *)cc, value, options));
+  DEBUG_printf(("4cups_set_ssl_options(cc=%p, value=\"%s\") options=%x, min_version=%d, max_version=%d", (void *)cc, value, options, min_version, max_version));
 }
 #endif /* HAVE_SSL */
 

cups/util.c

@@ -1,8 +1,8 @@
 /*
  * Printing utilities for CUPS.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2006 by Easy Software Products.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2006 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright
@@ -20,24 +20,11 @@
 #include "cups-private.h"
 #include <fcntl.h>
 #include <sys/stat.h>
-#if defined(WIN32) || defined(__EMX__)
+#if defined(_WIN32) || defined(__EMX__)
 #  include <io.h>
 #else
 #  include <unistd.h>
-#endif /* WIN32 || __EMX__ */
-
-
-/*
- * Enumeration data and callback...
- */
-
-typedef struct _cups_createdata_s
-{
-  const char  *name;                    /* Destination name */
-  cups_dest_t *dest;                    /* Matching destination */
-} _cups_createdata_t;
-
-static int  cups_create_cb(_cups_createdata_t *data, unsigned flags, cups_dest_t *dest);
+#endif /* _WIN32 || __EMX__ */
 
 
 /*
@@ -174,7 +161,7 @@ cupsCreateJob(
 {
   int		job_id = 0;		/* job-id value */
   ipp_status_t  status;                 /* Create-Job status */
-  _cups_createdata_t data;              /* Enumeration data */
+  cups_dest_t	*dest;			/* Destination */
   cups_dinfo_t  *info;                  /* Destination information */
 
 
@@ -194,12 +181,7 @@ cupsCreateJob(
   * Lookup the destination...
   */
 
-  data.name = name;
-  data.dest = NULL;
-
-  cupsEnumDests(0, 1000, NULL, 0, 0, (cups_dest_cb_t)cups_create_cb, &data);
-
-  if (!data.dest)
+  if ((dest = cupsGetNamedDest(http, name, NULL)) == NULL)
   {
     DEBUG_puts("1cupsCreateJob: Destination not found.");
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(ENOENT), 0);
@@ -211,18 +193,18 @@ cupsCreateJob(
   */
 
   DEBUG_puts("1cupsCreateJob: Querying destination info.");
-  if ((info = cupsCopyDestInfo(http, data.dest)) == NULL)
+  if ((info = cupsCopyDestInfo(http, dest)) == NULL)
   {
     DEBUG_puts("1cupsCreateJob: Query failed.");
-    cupsFreeDests(1, data.dest);
+    cupsFreeDests(1, dest);
     return (0);
   }
 
-  status = cupsCreateDestJob(http, data.dest, info, &job_id, title, num_options, options);
+  status = cupsCreateDestJob(http, dest, info, &job_id, title, num_options, options);
   DEBUG_printf(("1cupsCreateJob: cupsCreateDestJob returned %04x (%s)", status, ippErrorString(status)));
 
   cupsFreeDestInfo(info);
-  cupsFreeDests(1, data.dest);
+  cupsFreeDests(1, dest);
 
  /*
   * Return the job...
@@ -974,25 +956,3 @@ cupsStartDocument(
   return (status);
 }
 
-
-/*
- * 'cups_create_cb()' - Find the destination for printing.
- */
-
-static int                              /* O - 0 on match */
-cups_create_cb(
-    _cups_createdata_t *data,           /* I - Data from cupsCreateJob call */
-    unsigned           flags,           /* I - Enumeration flags */
-    cups_dest_t        *dest)           /* I - Destination */
-{
-  DEBUG_printf(("2cups_create_cb(data=%p(%s), flags=%08x, dest=%p(%s))", (void *)data, data->name, flags, (void *)dest, dest->name));
-
-  (void)flags;
-
-  if (dest->instance || strcasecmp(data->name, dest->name))
-    return (1);
-
-  cupsCopyDest(dest, 0, &data->dest);
-
-  return (0);
-}