Merge easysw-1.4svn-r7834

git-svn-id: svn+ssh://src.apple.com/svn/cups/easysw/current@905 a1ca3aef-8c08-0410-bb20-df032aa958be

8 files changed, 101 insertions, 20 deletions

diff --git a/scheduler/auth.c b/scheduler/auth.c
index d0d5641bc..2391b78ee 100644
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -671,13 +671,34 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
 	      return;
 	    }
 
-#  if defined(HAVE_PAM_SET_ITEM) && defined(PAM_RHOST)
+#  ifdef HAVE_PAM_SET_ITEM
+#    ifdef PAM_RHOST
 	    pamerr = pam_set_item(pamh, PAM_RHOST, con->http.hostname);
 	    if (pamerr != PAM_SUCCESS)
 	      cupsdLogMessage(CUPSD_LOG_WARN,
-	                      "cupsdAuthorize: pam_set_item() returned %d "
-			      "(%s)!", pamerr, pam_strerror(pamh, pamerr));
-#  endif /* HAVE_PAM_SET_ITEM && PAM_RHOST */
+	                      "cupsdAuthorize: pam_set_item(PAM_RHOST) "
+			      "returned %d (%s)!", pamerr,
+			      pam_strerror(pamh, pamerr));
+#    endif /* PAM_RHOST */
+
+#    ifdef PAM_TTY
+	    pamerr = pam_set_item(pamh, PAM_TTY, "cups");
+	    if (pamerr != PAM_SUCCESS)
+	      cupsdLogMessage(CUPSD_LOG_WARN,
+	                      "cupsdAuthorize: pam_set_item(PAM_TTY) "
+			      "returned %d (%s)!", pamerr,
+			      pam_strerror(pamh, pamerr));
+#    endif /* PAM_TTY */
+#  endif /* HAVE_PAM_SET_ITEM */
+
+#  ifdef HAVE_PAM_SETCRED
+            pamerr = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
+	    if (pamerr != PAM_SUCCESS)
+	      cupsdLogMessage(CUPSD_LOG_WARN,
+	                      "cupsdAuthorize: pam_setcred() "
+			      "returned %d (%s)!", pamerr,
+			      pam_strerror(pamh, pamerr));
+#  endif /* HAVE_PAM_SETCRED */
 
 	    pamerr = pam_authenticate(pamh, PAM_SILENT);
 	    if (pamerr != PAM_SUCCESS)
@@ -2154,7 +2175,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/* I - Connection */
 	  return (HTTP_OK);
       }
 
-      return (HTTP_UNAUTHORIZED);
+      return (HTTP_FORBIDDEN);
     }
 #endif /* HAVE_AUTHORIZATION_H */
 
@@ -2178,7 +2199,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/* I - Connection */
         return (HTTP_OK);
     }
 
-    return (HTTP_UNAUTHORIZED);
+    return (HTTP_FORBIDDEN);
   }
 
  /*
@@ -2215,7 +2236,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/* I - Connection */
   cupsdLogMessage(CUPSD_LOG_DEBUG,
                   "cupsdIsAuthorized: User not in group(s)!");
 
-  return (HTTP_UNAUTHORIZED);
+  return (HTTP_FORBIDDEN);
 }
 
 
diff --git a/scheduler/client.c b/scheduler/client.c
index ac52bd99e..b9e525c9f 100644
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -29,6 +29,7 @@
  *   cupsdWriteClient()      - Write data to a client as needed.
  *   check_if_modified()     - Decode an "If-Modified-Since" line.
  *   compare_clients()       - Compare two client connections.
+ *   data_ready()            - Check whether data is available from a client.
  *   encrypt_client()        - Enable encryption for the client...
  *   get_cdsa_certificate()  - Convert a keychain name into the CFArrayRef
  *			       required by SSLSetCertificate.
@@ -89,6 +90,7 @@ static int		check_if_modified(cupsd_client_t *con,
 			                  struct stat *filestats);
 static int		compare_clients(cupsd_client_t *a, cupsd_client_t *b,
 			                void *data);
+static int		data_ready(cupsd_client_t *con);
 #ifdef HAVE_SSL
 static int		encrypt_client(cupsd_client_t *con);
 #endif /* HAVE_SSL */
@@ -1046,8 +1048,7 @@ cupsdReadClient(cupsd_client_t *con)	/* I - Client to read from */
 	*/
 
         while ((status = httpUpdate(HTTP(con))) == HTTP_CONTINUE)
-	  if (con->http.used == 0 ||
-	      !memchr(con->http.buffer, '\n', con->http.used))
+	  if (!data_ready(con))
 	    break;
 
 	if (status != HTTP_OK && status != HTTP_CONTINUE)
@@ -1946,7 +1947,7 @@ cupsdReadClient(cupsd_client_t *con)	/* I - Client to read from */
 	    }
 	  }
         }
-	while (con->http.state == HTTP_PUT_RECV && con->http.used > 0);
+	while (con->http.state == HTTP_PUT_RECV && data_ready(con));
 
         if (con->http.state == HTTP_WAITING)
 	{
@@ -2121,7 +2122,7 @@ cupsdReadClient(cupsd_client_t *con)	/* I - Client to read from */
 	    }
 	  }
         }
-	while (con->http.state == HTTP_POST_RECV && con->http.used > 0);
+	while (con->http.state == HTTP_POST_RECV && data_ready(con));
 
 	if (con->http.state == HTTP_POST_SEND)
 	{
@@ -3006,6 +3007,38 @@ compare_clients(cupsd_client_t *a,	/* I - First client */
 }
 
 
+/*
+ * 'data_ready()' - Check whether data is available from a client.
+ */
+
+static int				/* O - 1 if data is ready, 0 otherwise */
+data_ready(cupsd_client_t *con)		/* I - Client */
+{
+  if (con->http.used > 0)
+    return (1);
+#ifdef HAVE_SSL
+  else if (con->http.tls)
+  {
+#  ifdef HAVE_LIBSSL
+    if (SSL_pending((SSL *)(con->http.tls)))
+      return (1);
+#  elif defined(HAVE_GNUTLS)
+    if (gnutls_record_check_pending(((http_tls_t *)(con->http.tls))->session))
+      return (1);
+#  elif defined(HAVE_CDSASSL)
+    size_t bytes;			/* Bytes that are available */
+
+    if (!SSLGetBufferedReadSize(((http_tls_t *)(con->http.tls))->session,
+                                &bytes) && bytes > 0)
+      return (1);
+#  endif /* HAVE_LIBSSL */
+  }
+#endif /* HAVE_SSL */
+
+  return (0);
+}
+
+
 #ifdef HAVE_SSL
 /*
  * 'encrypt_client()' - Enable encryption for the client...
@@ -3043,7 +3076,8 @@ encrypt_client(cupsd_client_t *con)	/* I - Client to encrypt */
 
   SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); /* Only use SSLv3 or TLS */
   SSL_CTX_use_PrivateKey_file(context, ServerKey, SSL_FILETYPE_PEM);
-  SSL_CTX_use_certificate_file(context, ServerCertificate, SSL_FILETYPE_PEM);
+  SSL_CTX_use_certificate_chain_file(context, ServerCertificate,
+                                     SSL_FILETYPE_PEM);
 
   bio = BIO_new(_httpBIOMethods());
   BIO_ctrl(bio, BIO_C_SET_FILE_PTR, 0, (char *)HTTP(con));
diff --git a/scheduler/cups-lpd.c b/scheduler/cups-lpd.c
index 55ac71b68..450c93f02 100644
--- a/scheduler/cups-lpd.c
+++ b/scheduler/cups-lpd.c
@@ -148,6 +148,19 @@ main(int  argc,				/* I - Number of command-line arguments */
     {
       switch (argv[i][1])
       {
+        case 'h' : /* -h hostname[:port] */
+            if (argv[i][2])
+	      cupsSetServer(argv[i] + 2);
+	    else
+	    {
+	      i ++;
+	      if (i < argc)
+	        cupsSetServer(argv[i]);
+	      else
+	        syslog(LOG_WARNING, "Expected hostname string after -h option!");
+	    }
+	    break;
+
 	case 'o' : /* Option */
 	    if (argv[i][2])
 	      num_defaults = cupsParseOptions(argv[i] + 2, num_defaults,
diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index b8fbeaa5c..23d15ad8b 100644
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -678,10 +678,12 @@ cupsdProcessIPPRequest(
     * Sending data from the scheduler...
     */
 
-    cupsdLogMessage(CUPSD_LOG_DEBUG,
-                    "cupsdProcessIPPRequest: %d status_code=%x (%s)",
-                    con->http.fd, con->response->request.status.status_code,
-	            ippErrorString(con->response->request.status.status_code));
+    cupsdLogMessage(con->response->request.status.status_code
+                        >= IPP_BAD_REQUEST ? CUPSD_LOG_ERROR : CUPSD_LOG_DEBUG,
+                    "Returning %s for %s from %s",
+	            ippErrorString(con->response->request.status.status_code),
+		    ippOpString(con->request->request.op.operation_id),
+		    con->http.hostname);
 
     if (cupsdSendHeader(con, HTTP_OK, "application/ipp", CUPSD_AUTH_NONE))
     {
@@ -10474,6 +10476,7 @@ set_printer_defaults(
         continue;
 
       if (strcmp(attr->values[0].string.text, "abort-job") &&
+          strcmp(attr->values[0].string.text, "retry-current-job") &&
           strcmp(attr->values[0].string.text, "retry-job") &&
           strcmp(attr->values[0].string.text, "stop-printer"))
       {
diff --git a/scheduler/job.c b/scheduler/job.c
index e0bd77534..e2d74c632 100644
--- a/scheduler/job.c
+++ b/scheduler/job.c
@@ -659,11 +659,13 @@ cupsdFinishJob(cupsd_job_t *job)	/* I - Job */
 	  cupsdMarkDirty(CUPSD_DIRTY_JOBS);
 
 	 /*
-	  * If the job was queued to a class, try requeuing it...  For
-	  * faxes and retry-job queues, hold the current job for 5 minutes.
+	  * If the job was queued to a class or the error policy is
+	  * "retry-current-job", try requeuing it...  For faxes and retry-job
+	  * queues, hold the current job for 5 minutes.
 	  */
 
-	  if (job->dtype & (CUPS_PRINTER_CLASS | CUPS_PRINTER_IMPLICIT))
+	  if ((job->dtype & (CUPS_PRINTER_CLASS | CUPS_PRINTER_IMPLICIT)) ||
+	      !strcmp(printer->error_policy, "retry-current-job"))
 	    cupsdCheckJobs();
 	  else if ((printer->type & CUPS_PRINTER_FAX) ||
         	   !strcmp(printer->error_policy, "retry-job"))
diff --git a/scheduler/printers.c b/scheduler/printers.c
index df8f7f24c..eeed48f66 100644
--- a/scheduler/printers.c
+++ b/scheduler/printers.c
@@ -349,6 +349,7 @@ cupsdCreateCommonData(void)
   static const char * const errors[] =	/* printer-error-policy-supported values */
 		{
 		  "abort-job",
+		  "retry-current-job",
 		  "retry-job",
 		  "stop-printer"
 		};
diff --git a/scheduler/subscriptions.c b/scheduler/subscriptions.c
index 4f92f873b..a0e2dc602 100644
--- a/scheduler/subscriptions.c
+++ b/scheduler/subscriptions.c
@@ -389,6 +389,13 @@ cupsdAddSubscription(
 
   cupsArrayAdd(Subscriptions, temp);
 
+ /*
+  * For RSS subscriptions, run the notifier immediately...
+  */
+
+  if (uri && !strncmp(uri, "rss:", 4))
+    cupsd_start_notifier(temp);
+
   return (temp);
 }
 
diff --git a/scheduler/subscriptions.h b/scheduler/subscriptions.h
index ab0154b71..15e11a445 100644
--- a/scheduler/subscriptions.h
+++ b/scheduler/subscriptions.h
@@ -3,7 +3,7 @@
  *
  *   Subscription definitions for the Common UNIX Printing System (CUPS) scheduler.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the