Skip to content

Commit e837392

Browse files
michaelrsweetmichaelrsweet
committed
Add httpGetSecurity API.
1 parent 14da980 commit e837392

7 files changed

Lines changed: 131 additions & 61 deletions

File tree

‎CHANGES.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Changes in CUPS v2.5b1 (YYYY-MM-DD)
99
APIs.
1010
- Added new `cupsRasterInitHeader` API.
1111
- Added `httpConnectURI` API.
12+
- Added `httpGetSecurity` API.
1213
- Added `ippAddCredentialsString`, `ippGetFirstAttribute`,
1314
`ippGetNextAttribute`, `ippRestore`, and `ippSave` APIs.
1415
- Added new DNS-SD APIs.

‎cups/http.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// Hyper-Text Transport Protocol definitions for CUPS.
33
//
4-
// Copyright © 2020-2024 by OpenPrinting.
4+
// Copyright © 2020-2025 by OpenPrinting.
55
// Copyright © 2007-2018 by Apple Inc.
66
// Copyright © 1997-2007 by Easy Software Products, all rights reserved.
77
//
@@ -454,6 +454,7 @@ extern off_t httpGetLength2(http_t *http) _CUPS_PUBLIC;
454454
extern size_t httpGetPending(http_t *http) _CUPS_PUBLIC;
455455
extern size_t httpGetReady(http_t *http) _CUPS_PUBLIC;
456456
extern size_t httpGetRemaining(http_t *http) _CUPS_PUBLIC;
457+
extern const char *httpGetSecurity(http_t *http, char *buffer, size_t bufsize) _CUPS_PUBLIC;
457458
extern http_state_t httpGetState(http_t *http) _CUPS_PUBLIC;
458459
extern http_status_t httpGetStatus(http_t *http) _CUPS_PUBLIC;
459460
extern char *httpGetSubField(http_t *http, http_field_t field, const char *name, char *value) _CUPS_DEPRECATED_MSG("Use httpGetSubField2 instead.");

‎cups/libcups2.def‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -539,6 +539,7 @@ httpGetLength2
539539
httpGetPending
540540
httpGetReady
541541
httpGetRemaining
542+
httpGetSecurity
542543
httpGetState
543544
httpGetStatus
544545
httpGetSubField

‎cups/tls-gnutls.c‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1520,6 +1520,62 @@ _httpFreeCredentials(
15201520
}
15211521

15221522

1523+
//
1524+
// 'httpGetSecurity()' - Get the TLS version and cipher suite used by a connection.
1525+
//
1526+
// This function gets the TLS version and cipher suite being used by a
1527+
// connection, if any. The string is copied to "buffer" and is of the form
1528+
// "TLS/major.minor CipherSuite". If not encrypted, the buffer is cleared to
1529+
// the empty string.
1530+
//
1531+
// @since CUPS 2.5@
1532+
//
1533+
1534+
const char * // O - Security information or `NULL` if not encrypted
1535+
httpGetSecurity(http_t *http, // I - HTTP connection
1536+
char *buffer, // I - String buffer
1537+
size_t bufsize) // I - Size of buffer
1538+
{
1539+
const char *cipherName; // Cipher suite name
1540+
1541+
1542+
// Range check input...
1543+
if (buffer)
1544+
*buffer = '\0';
1545+
1546+
if (!http || !http->tls || !buffer || bufsize < 16)
1547+
return (NULL);
1548+
1549+
// Record the TLS version and cipher suite...
1550+
cipherName = gnutls_session_get_desc(http->tls);
1551+
1552+
switch (gnutls_protocol_get_version(http->tls))
1553+
{
1554+
default :
1555+
snprintf(buffer, bufsize, "TLS/?.? %s", cipherName);
1556+
break;
1557+
1558+
case GNUTLS_TLS1_0 :
1559+
snprintf(buffer, bufsize, "TLS/1.0 %s", cipherName);
1560+
break;
1561+
1562+
case GNUTLS_TLS1_1 :
1563+
snprintf(buffer, bufsize, "TLS/1.1 %s", cipherName);
1564+
break;
1565+
1566+
case GNUTLS_TLS1_2 :
1567+
snprintf(buffer, bufsize, "TLS/1.2 %s", cipherName);
1568+
break;
1569+
1570+
case GNUTLS_TLS1_3 :
1571+
snprintf(buffer, bufsize, "TLS/1.3 %s", cipherName);
1572+
break;
1573+
}
1574+
1575+
return (buffer);
1576+
}
1577+
1578+
15231579
//
15241580
// '_httpTLSInitialize()' - Initialize the TLS stack.
15251581
//

‎cups/tls-openssl.c‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1534,6 +1534,64 @@ _httpFreeCredentials(
15341534
}
15351535

15361536

1537+
//
1538+
// 'httpGetSecurity()' - Get the TLS version and cipher suite used by a connection.
1539+
//
1540+
// This function gets the TLS version and cipher suite being used by a
1541+
// connection, if any. The string is copied to "buffer" and is of the form
1542+
// "TLS/major.minor CipherSuite". If not encrypted, the buffer is cleared to
1543+
// the empty string.
1544+
//
1545+
// @since CUPS 2.5@
1546+
//
1547+
1548+
const char * // O - Security information or `NULL` if not encrypted
1549+
httpGetSecurity(http_t *http, // I - HTTP connection
1550+
char *buffer, // I - String buffer
1551+
size_t bufsize) // I - Size of buffer
1552+
{
1553+
const char *cipherName; // Cipher suite name
1554+
1555+
1556+
// Range check input...
1557+
if (buffer)
1558+
*buffer = '\0';
1559+
1560+
if (!http || !http->tls || !buffer || bufsize < 16)
1561+
return (NULL);
1562+
1563+
// Record the TLS version and cipher suite...
1564+
cipherName = SSL_get_cipher_name(http->tls);
1565+
1566+
switch (SSL_version(http->tls))
1567+
{
1568+
default :
1569+
snprintf(buffer, bufsize, "TLS/?.? %s", cipherName);
1570+
break;
1571+
1572+
case TLS1_VERSION :
1573+
snprintf(buffer, bufsize, "TLS/1.0 %s", cipherName);
1574+
break;
1575+
1576+
case TLS1_1_VERSION :
1577+
snprintf(buffer, bufsize, "TLS/1.1 %s", cipherName);
1578+
break;
1579+
1580+
case TLS1_2_VERSION :
1581+
snprintf(buffer, bufsize, "TLS/1.2 %s", cipherName);
1582+
break;
1583+
1584+
# ifdef TLS1_3_VERSION
1585+
case TLS1_3_VERSION :
1586+
snprintf(buffer, bufsize, "TLS/1.3 %s", cipherName);
1587+
break;
1588+
# endif // TLS1_3_VERSION
1589+
}
1590+
1591+
return (buffer);
1592+
}
1593+
1594+
15371595
//
15381596
// '_httpTLSInitialize()' - Initialize the TLS stack.
15391597
//

‎cups/tlscheck.c‎

Lines changed: 6 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// TLS check program for CUPS.
33
//
4-
// Copyright © 2020-2024 by OpenPrinting.
4+
// Copyright © 2020-2025 by OpenPrinting.
55
// Copyright © 2007-2017 by Apple Inc.
66
// Copyright © 1997-2006 by Easy Software Products.
77
//
@@ -31,11 +31,10 @@ main(int argc, // I - Number of command-line arguments
3131
http_t *http = NULL; // HTTP connection
3232
const char *server = NULL; // Hostname from command-line
3333
int port = 0; // Port number
34-
char *creds; // Server credentials
35-
char creds_str[2048]; // Credentials string
36-
const char *cipherName; // Cipher suite name
37-
int tlsVersion = 0; // TLS version number
38-
char uri[1024], // Printer URI
34+
char *creds, // Server credentials
35+
creds_str[2048], // Credentials string
36+
security[256], // Security string
37+
uri[1024], // Printer URI
3938
scheme[32], // URI scheme
4039
host[256], // Hostname
4140
userpass[256], // Username/password
@@ -184,57 +183,7 @@ main(int argc, // I - Number of command-line arguments
184183
free(creds);
185184
}
186185

187-
#ifdef HAVE_OPENSSL
188-
switch (SSL_version(http->tls))
189-
{
190-
default :
191-
tlsVersion = 0;
192-
break;
193-
194-
case TLS1_VERSION :
195-
tlsVersion = 10;
196-
break;
197-
198-
case TLS1_1_VERSION :
199-
tlsVersion = 11;
200-
break;
201-
202-
case TLS1_2_VERSION :
203-
tlsVersion = 12;
204-
break;
205-
206-
# ifdef TLS1_3_VERSION
207-
case TLS1_3_VERSION :
208-
tlsVersion = 13;
209-
break;
210-
# endif // TLS1_3_VERSION
211-
}
212-
213-
cipherName = SSL_get_cipher_name(http->tls);
214-
215-
#else // HAVE_GNUTLS
216-
switch (gnutls_protocol_get_version(http->tls))
217-
{
218-
default :
219-
tlsVersion = 0;
220-
break;
221-
case GNUTLS_TLS1_0 :
222-
tlsVersion = 10;
223-
break;
224-
case GNUTLS_TLS1_1 :
225-
tlsVersion = 11;
226-
break;
227-
case GNUTLS_TLS1_2 :
228-
tlsVersion = 12;
229-
break;
230-
case GNUTLS_TLS1_3 :
231-
tlsVersion = 13;
232-
break;
233-
}
234-
cipherName = gnutls_session_get_desc(http->tls);
235-
#endif // HAVE_OPENSSL
236-
237-
printf("%s: OK (TLS: %d.%d, %s)\n", server, tlsVersion / 10, tlsVersion % 10, cipherName);
186+
printf("%s: OK (%s)\n", server, httpGetSecurity(http, security, sizeof(security)));
238187
printf(" %s\n", creds_str);
239188

240189
if (verbose)

‎tools/ippeveprinter.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// IPP Everywhere printer application for CUPS.
33
//
4-
// Copyright © 2020-2024 by OpenPrinting.
4+
// Copyright © 2020-2025 by OpenPrinting.
55
// Copyright © 2020 by the IEEE-ISTO Printer Working Group.
66
// Copyright © 2010-2021 by Apple Inc.
77
//
@@ -4708,6 +4708,8 @@ process_client(ippeve_client_t *client) // I - Client
47084708

47094709
if (recv(httpGetFd(client->http), buf, 1, MSG_PEEK) == 1 && (!buf[0] || !strchr("DGHOPT", buf[0])))
47104710
{
4711+
char security[256]; // Security description
4712+
47114713
fprintf(stderr, "%s Starting HTTPS session.\n", client->hostname);
47124714

47134715
if (!httpSetEncryption(client->http, HTTP_ENCRYPTION_ALWAYS))
@@ -4716,7 +4718,7 @@ process_client(ippeve_client_t *client) // I - Client
47164718
break;
47174719
}
47184720

4719-
fprintf(stderr, "%s Connection now encrypted.\n", client->hostname);
4721+
fprintf(stderr, "%s Connection now encrypted (%s).\n", client->hostname, httpGetSecurity(client->http, security, sizeof(security)));
47204722
}
47214723

47224724
first_time = false;
@@ -4853,6 +4855,8 @@ process_http(ippeve_client_t *client) // I - Client connection
48534855
{
48544856
if (strstr(httpGetField(client->http, HTTP_FIELD_UPGRADE), "TLS/") != NULL && !httpIsEncrypted(client->http))
48554857
{
4858+
char security[256]; // Security description
4859+
48564860
if (!respond_http(client, HTTP_STATUS_SWITCHING_PROTOCOLS, NULL, NULL, 0))
48574861
return (0);
48584862

@@ -4864,7 +4868,7 @@ process_http(ippeve_client_t *client) // I - Client connection
48644868
return (0);
48654869
}
48664870

4867-
fprintf(stderr, "%s Connection now encrypted.\n", client->hostname);
4871+
fprintf(stderr, "%s Connection now encrypted (%s).\n", client->hostname, httpGetSecurity(client->http, security, sizeof(security)));
48684872
}
48694873
else if (!respond_http(client, HTTP_STATUS_NOT_IMPLEMENTED, NULL, NULL, 0))
48704874
return (0);

0 commit comments

Comments
 (0)