Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

/admin resource files not served when web interface disabled #4755

Closed
michaelrsweet opened this issue Jan 10, 2016 · 11 comments
Closed

/admin resource files not served when web interface disabled #4755

michaelrsweet opened this issue Jan 10, 2016 · 11 comments
Labels
priority-medium
Milestone
Stable

Comments

@michaelrsweet
Copy link
Collaborator

Version: 2.1-current
CUPS.org User: till.kamppeter

In the auto-shutdown mode ("-l") CUPS only shuts down on idle if the web interface is de-activated ("WebInterface=no" in cupsd.conf). De-activating the web interface does not only de-activates CUPS' built-in printer setup tool and help system but also general download of files from CUPS. The file download is needed by more applications then one thinks of, especially by cupsctl or by apps which download PPD files of print queues via http://:631/printers/.ppd. cupsctl is even worse, as it does not realize that it gets an error message HTML page from CUPS when downloading cupsd.conf and after that writes cupsd.conf back, destroying it.

So my quick-and-dirty approach for my mobile environment is to allow CUPS to auto-shutdown when WebInterface=Yes is set. In my case it will be no problem as I do not install the CGI scripts (/usr/lib/cups/cgi-bin/) on my mobile device.

Generally I suggest to change the meaning of the WebInterface variable in cupsd.conf, so that file download always works and "WebInterface=no" only deactivates the CGI scripts. This way with activated CGI scripts auto-shutdown is prevented so that the web wizards work correctly. With de-activated web interface only the scripts are blocked and file downloads stay working to assure that applications behave correctly.

Even better would be to make the CGI scripts/web wizards robust against auto-shutdown of CUPS, simply continuing correctly when CUPS shuts down and the next submission of a form fires up CUPS again.
@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: mike

Till,

Resource files (PPDs, etc.) are still served when the web interface is deactivated.

The issue you are running into is that the default systemd configuration file does not listen on the loopback interface, so applications that (incorrectly) try to read PPD files, etc. from localhost won't work until cupsd is started.

The CUPS library automatically uses the domain socket for all local accesses. I will look into what is causing cupsAdminGet/SetServerSettings to overwrite the cupsd.conf file, but obviously that should never happen.

In the meantime, I think the simplest "fix" for you is to add localhost listeners to the systemd configuration file (make sure to use numeric addresses unless the systemd folks have fixed things so that "localhost" yields two listeners...)

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: mike

Till, I cannot reproduce the cupsd.conf issue - can you provide a system trace when you run cupsctl?

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: till.kamppeter

I do the following:

Start CUPS daemon, in case of systemd:

$ sudo systemctl start cups

List settings with cupsctl (I am in lpadmin group):

$ cupsctl
_debug_logging=1
_remote_admin=0
_remote_any=0
_share_printers=0
_user_cancel_any=0
BrowseLocalProtocols=dnssd
DefaultAuthType=Basic
JobPrivateAccess=default
JobPrivateValues=default
MaxLogSize=0
PageLogFormat=
SubscriptionPrivateAccess=default
SubscriptionPrivateValues=default
WebInterface=Yes

Turn off WebInterface (this still works as intended):

$ cupsctl WebInterface=No

List options again (now cupsctl does not work any more, seems to receive error message about deactivated web interface instead of cupsd.conf):

$ cupsctl
_debug_logging=0
_remote_admin=0
_remote_any=0
_share_printers=0
_user_cancel_any=1

Change an option, in our case turn web interface back on, with cupsctl (cupsctl gets the error message instead of cupsd.conf again, but this time as we change something, it writes what it has loaded as cupsd.conf back into /etc/cups/cupsd.conf, resulting in cupsd.conf containing the HTML error message and CUPS not being startable):

$ cupsctl WebInterface=yes

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: till.kamppeter

After restoring cupsd.conf and restarting cupsd I repeated the sequence from above but running the cupsctl command which did not work correctly with strace:

trace cupsctl > cupsctl-strace.txt 2>&1

The file upsctl-strace.txt is attached and one can see that it got an HTML error message instead of cupsd.conf.

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: till.kamppeter

Here is the strace for the "cupsctl WebInterface=yes" command which destroys cupsd.conf:

strace cupsctl WebInterface=yes > cupsctl-webinterface-yes-strace.txt 2>&1

cupsctl-webinterface-yes-strace.txt is attached.

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: till.kamppeter

The problem with the overwritten cupsd.conf was also reported to Ubuntu, as

https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1536201

The user here reports that it only happens that a user from the "lpadmin" group runs the cupsctl. If root runs cupsctl (or "sudo" is used), everything works correctly.

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: mike

Investigating, as the /admin/conf/ path is checked before the web interface stuff...

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: mike

Changing title to match the bug being tracked.

I think I have found the problem - the web interface check is mixed with the resource file checks, instead of only for the CGI.

In addition to the fixes in the scheduler, I will update the cupsAdminGetServerSettings API to check for a cupsd.conf file starting with a DOCTYPE declaration and abort the changes accordingly.

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: mike

Fixed in Subversion repository.

Please let me know if you experience any difficulties with the fix.

@michaelrsweet
Copy link
Collaborator Author

"str4755.patch":

Index: scheduler/client.c

--- scheduler/client.c (revision 13059)
+++ scheduler/client.c (working copy)
@@ -1156,29 +1156,28 @@
break;
}
}

  •   else if (!WebInterface)

  •   {

  •    /*

  •     \* Web interface is disabled. Show an appropriate message...

  •     */

  •     if (!cupsdSendError(con, HTTP_STATUS_CUPS_WEBIF_DISABLED, CUPSD_AUTH_NONE))

  •     {

  •   cupsdCloseClient(con);

  •   return;

- }

  •     break;

- }

  •   if ((!strncmp(con->uri, "/admin", 6) &&

  •     strncmp(con->uri, "/admin/conf/", 12) &&

  •     strncmp(con->uri, "/admin/log/", 11)) ||

  •   if ((!strncmp(con->uri, "/admin", 6) && strcmp(con->uri, "/admin/conf/cupsd.conf") && strncmp(con->uri, "/admin/log/", 11)) ||
 !strncmp(con->uri, "/printers", 9) ||
 !strncmp(con->uri, "/classes", 8) ||
 !strncmp(con->uri, "/help", 5) ||
 !strncmp(con->uri, "/jobs", 5))
{

  •     if (!WebInterface)

  •     {

  •      /*

  •   \* Web interface is disabled. Show an appropriate message...

  •   */

  •   if (!cupsdSendError(con, HTTP_STATUS_CUPS_WEBIF_DISABLED, CUPSD_AUTH_NONE))

  •   {

  •     cupsdCloseClient(con);

  •     return;

  •   }

  •   break;

  •     }
    • /*
      * Send CGI output...
      */
      @@ -1245,20 +1244,14 @@
      if (httpGetVersion(con->http) <= HTTP_VERSION_1_0)
      httpSetKeepAlive(con->http, HTTP_KEEPALIVE_OFF);
      }
  •        else if ((!strncmp(con->uri, "/admin/conf/", 12) &&

  •             (strchr(con->uri + 12, '/') ||

  •          strlen(con->uri) == 12)) ||

  •        (!strncmp(con->uri, "/admin/log/", 11) &&

  •             (strchr(con->uri + 11, '/') ||

  •          strlen(con->uri) == 11)))

  •        else if (!strncmp(con->uri, "/admin/log/", 11) && (strchr(con->uri + 11, '/') || strlen(con->uri) == 11))
{
 /*
  * GET can only be done to configuration files directly under
  * /admin/conf...
  */

  •     cupsdLogClient(con, CUPSD_LOG_ERROR,

  •             "Request for subdirectory \"%s\"!", con->uri);

  •     cupsdLogClient(con, CUPSD_LOG_ERROR, "Request for subdirectory \"%s\".", con->uri);

  if (!cupsdSendError(con, HTTP_STATUS_FORBIDDEN, CUPSD_AUTH_NONE))
  {

    @@ -1396,9 +1389,7 @@

      break;
}

  •   else if ((!strncmp(con->uri, "/admin", 6) &&

  •             strncmp(con->uri, "/admin/conf/", 12) &&

  •             strncmp(con->uri, "/admin/log/", 11)) ||

  •   else if ((!strncmp(con->uri, "/admin", 6) && strncmp(con->uri, "/admin/log/", 11)) ||
         !strncmp(con->uri, "/printers", 9) ||
         !strncmp(con->uri, "/classes", 8) ||
         !strncmp(con->uri, "/help", 5) ||

    @@ -1648,9 +1639,7 @@
    break;
    }

  •   if ((!strncmp(con->uri, "/admin", 6) &&

  •        strncmp(con->uri, "/admin/conf/", 12) &&

  •        strncmp(con->uri, "/admin/log/", 11)) ||

  •   if ((!strncmp(con->uri, "/admin", 6) && strcmp(con->uri, "/admin/conf/cupsd.conf") && strncmp(con->uri, "/admin/log/", 11)) ||
!strncmp(con->uri, "/printers", 9) ||
!strncmp(con->uri, "/classes", 8) ||
!strncmp(con->uri, "/help", 5) ||

    @@ -1670,12 +1659,7 @@

           cupsdLogRequest(con, HTTP_STATUS_OK);
}

  •        else if ((!strncmp(con->uri, "/admin/conf/", 12) &&

  •             (strchr(con->uri + 12, '/') ||

  •          strlen(con->uri) == 12)) ||

  •        (!strncmp(con->uri, "/admin/log/", 11) &&

  •             (strchr(con->uri + 11, '/') ||

  •          strlen(con->uri) == 11)))

  •        else if (!strncmp(con->uri, "/admin/log/", 11) && (strchr(con->uri + 11, '/') || strlen(con->uri) == 11))
{
 /*
  \* HEAD can only be done to configuration files under

@michaelrsweet
Copy link
Collaborator Author

CUPS.org User: till.kamppeter

I have applied your patch to the current Ubuntu package (CUPS 2.1.2) and now the sequence of "cupsctl WebInterface=No; cupsctl WebInterface=Yes" and the web interface is turned on and turned off correctly, no loss of cupsd.conf any more and correct display of the settings with the simple "cupsctl" command. So the bug seems to be fixed.

@michaelrsweet michaelrsweet added this to the Stable milestone Mar 17, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
priority-medium
Projects
None yet
Milestone
Stable
Development

No branches or pull requests
1 participant
@michaelrsweet