commit 278b76eb1680e5e96119c216b260d50be5002216
author Glade Diviney <mopriadevteam@gmail.com> Fri Apr 10 16:35:10 2020 -0700
committer Philip P. Moltmann <moltmann@google.com> Tue Apr 14 15:58:46 2020 -0700
tree cd8bb7c9dd49ef1423cafd90ed19622e226119c4
parent 2365ed85561b11d74efa45f517958dd34669a009

Restore MITM functionality

Prior change 1158463 did not handle a fallthough case, breaking
MITM detection. With this change:

* MITM detection notification is restored instead of failing
  the print job
* IPPS is preferred if only IPP is found during capability check

Test: Print to a printer, change its certificate, print again
Fixes: 154046844
Change-Id: If51aafb1276c45855c613549b240dadd08fdf611
Signed-off-by: Glade Diviney <mopriadevteam@gmail.com>

jni/ipphelper/ipphelper.c

diff --git a/jni/ipphelper/ipphelper.c b/jni/ipphelper/ipphelper.c
index d9803e7..8b7f00d 100644
--- a/jni/ipphelper/ipphelper.c
+++ b/jni/ipphelper/ipphelper.c
@@ -1091,18 +1091,7 @@
         }
     }
 
-    // If security or authentication is required (non-"none") at any URI, mark it invalid
-
-    if ((attrptr = ippFindAttribute(response, "uri-security-supported", IPP_TAG_KEYWORD)) != NULL) {
-        for (i = 0; i < MIN(ippGetCount(attrptr), MAX_URIS); i++) {
-            if (strcmp("none", ippGetString(attrptr, i, NULL)) != 0) {
-                LOGD("parse_printerUris %s invalid because sec=%s", uris[i].uri,
-                        ippGetString(attrptr, i, NULL));
-                uris[i].valid = false;
-            }
-        }
-    }
-
+    // If authentication is required by any URI, mark it invalid
     if ((attrptr = ippFindAttribute(response, "uri-authentication-supported", IPP_TAG_KEYWORD))
             != NULL) {
         for (i = 0; i < MIN(ippGetCount(attrptr), MAX_URIS); i++) {
@@ -1118,10 +1107,10 @@
 
     // Find a valid URI and copy it into place.
     for (i = 0; i < MAX_URIS; i++) {
-        if (uris[i].valid) {
+        // Copy if the URI is valid and we haven't yet discovered ipps
+        if (uris[i].valid && strncmp(capabilities->printerUri, "ipps://", 7) != 0) {
             LOGD("parse_printerUris found %s", uris[i].uri);
             strlcpy(capabilities->printerUri, uris[i].uri, sizeof(capabilities->printerUri));
-            break;
         }
     }
 }

jni/lib/lib_wprint.c

diff --git a/jni/lib/lib_wprint.c b/jni/lib/lib_wprint.c
index a30d74c..8053247 100644
--- a/jni/lib/lib_wprint.c
+++ b/jni/lib/lib_wprint.c
@@ -847,7 +847,7 @@
                             && printer_state.printer_reasons[0] == PRINT_STATUS_UNKNOWN) {
                         // no status available, break out and hope for the best
                         printer_state.printer_status = PRINT_STATUS_IDLE;
-                    } else if (status == PRINT_STATUS_SVC_REQUEST
+                    } else if ((status == PRINT_STATUS_UNKNOWN || status == PRINT_STATUS_SVC_REQUEST)
                             && ((printer_state.printer_reasons[0] == PRINT_STATUS_UNABLE_TO_CONNECT)
                                 || (printer_state.printer_reasons[0] == PRINT_STATUS_OFFLINE))) {
                         if (_is_certificate_allowed(jq)) {

src/com/android/bips/LocalPrintJob.java

diff --git a/src/com/android/bips/LocalPrintJob.java b/src/com/android/bips/LocalPrintJob.java
index adadd14..25cdd5d 100644
--- a/src/com/android/bips/LocalPrintJob.java
+++ b/src/com/android/bips/LocalPrintJob.java
@@ -43,6 +43,7 @@
         CapabilitiesCache.OnLocalPrinterCapabilities {
     private static final String TAG = LocalPrintJob.class.getSimpleName();
     private static final boolean DEBUG = false;
+    private static final String IPP_SCHEME = "ipp";
     private static final String IPPS_SCHEME = "ipps";
 
     /** Maximum time to wait to find a printer before failing the job */
@@ -245,6 +246,15 @@
     }
 
     private void deliver() {
+        // Upgrade to IPPS if necessary
+        Uri newUri = Uri.parse(mCapabilities.path);
+        if (IPPS_SCHEME.equals(newUri.getScheme()) && newUri.getPort() > 0 &&
+            IPP_SCHEME.equals(mPath.getScheme())) {
+            mPath = mPath.buildUpon().scheme(IPPS_SCHEME).encodedAuthority(mPath.getHost() +
+                ":" + newUri.getPort()).build();
+        }
+
+        if (DEBUG) Log.d(TAG, "deliver() to " + mPath);
         if (mCapabilities.certificate != null && !IPPS_SCHEME.equals(mPath.getScheme())) {
             mState = STATE_SECURITY;
             mPrintJob.block(mPrintService.getString(R.string.printer_not_encrypted));