IPP over HTTP: getting 400 bad request as a response

Question

I'm on iOS and I'm trying to send a HTTP POST request to create a print job on a printer through a Mac which acts as a IPP server. I can correctly print using airprint, I'm trying now to go low-level because I need to send raw data to the printer.

Something about my code:

Everything is hardcoded. I'm still trying to figure out where I go wrong, so I'm just in a development/testing phase. The first part is about the definition of the binary structure of an IPP print-job request (and it should be right, according to the RFC 2910 specification).

char data[239] = {0x01, 0x01, // IPP version
    0x00, 0x04, // Print-job request
    0x00, 0x00, 0x00, 0x50, // Arbitrary request ID
    0x01, // Attribute group
    // ATT 1
    0x47, // charset value-tag
    0x00, 0x12, // name-length
    'a','t','t','r','i','b','u','t','e','s','-','c','h','a','r','s','e','t', // name
    0x00, 0x05, // value-length
    'u','t','f','-','8', // value
    // ATT 2
    0x48, // natural-language value-tag
    0x00, 0x1B, // name-length
    'a','t','t','r','i','b','u','t','e','s','-','n','a','t','u','r','a','l','-','l','a','n','g','u','a','g','e', // name                       
    0x00, 0x05, // value-length
    'e','n','-','u','s', // value
    // ATT 3
    0x45, // uri type value-tag
    0x00, 0x0B, // name-length
    'p','r','i','n','t','e','r','-','u','r','i', // name
    0x00, 0x47, // value-length
    'i','p','p',':','/','/','A','n','d','r','e','a','s','-','M','a','c','B','o','o','k','-','P','r','o','-','2','.','l','o','c','a','l','.',':','6','3','1','/','p','r','i','n','t','e','r','s','/','H','P','_','D','e','s','k','j','e','t','_','F','4','5','0','0','_','s','e','r','i','e','s', // value
    // ATT 4
    0x42, // requesting user id value-tag
    0x00, 0x14, // name-length
    'r','e','q','u','e','s','t','i','n','g','-','u','s','e','r','-','n','a','m','e', // name
    0x00, 0x05, // value-length
    'g','u','e','s','t', // value
    // ATT 5
    0x49, // document format value-tag
    0x00, 0x0f, // document format
    'd','o','c','u','m','e','n','t','-','f','o','r','m','a','t',
    0x18, // TODO
    'a','p','p','l','i','c','a','t','i','o','n','/','o','c','t','e','t','-','s','t','r','e','a','m',
    0x03, // end of attributes
    't','e','s','t'}; // data

NSMutableData *printJob = [NSMutableData data];
[printJob appendBytes:data length:sizeof(data)];
NSString* requestDataLengthString = [[NSString alloc] initWithFormat:@"%d", [printJob length]];

NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:[NSURL URLWithString:@"http://192.168.1.23:631/printers/HP_Deskjet_F4500_series"]];
[request setHTTPMethod:@"POST"];
[request setValue:requestDataLengthString forHTTPHeaderField:@"Content-Length"];
[request setValue:@"application/ipp" forHTTPHeaderField:@"Content-Type"];
[request setValue:@"Andreas-MacBook-Pro-2.local" forHTTPHeaderField:@"Host"];
[request setValue:@"CUPS/1.5.0" forHTTPHeaderField:@"User-Agent"];
[request setValue:@"100-continue" forHTTPHeaderField:@"Expect"];
[request setHTTPBody:printJob];

[[NSURLConnection connectionWithRequest:request delegate:self] start];

Whenever I run this code, after 10 seconds I get a HTTP 400 bad request response.

The strange thing is that the HTTP request seems perfectly the same as the one I can capture with a packet analyzer whenever the airprint printing sends a print-job to the ipp server (and it works).

Answer 1

The following prints for me. My printer accepts IPP on port 80 as well as 631.

// See Print-Job Request sample on page 32 
//   in Appendix A: Protocol Examples 
//   of RFC 2910 IPP/1.1 Encoding and Transport
//     https://tools.ietf.org/html/rfc2910

    char data[239] = {0x01, 0x01, // IPP version
    0x00, 0x02, // Print-job request
    0x00, 0x00, 0x00, 0x50, // Arbitrary request ID
    0x01, // Attribute group
    // ATT 1
    0x47, // charset value-tag
    0x00, 0x12, // name-length
    'a','t','t','r','i','b','u','t','e','s','-','c','h','a','r','s','e','t', // name
    0x00, 0x05, // value-length
    'u','t','f','-','8', // value
    // ATT 2
    0x48, // natural-language value-tag
    0x00, 0x1B, // name-length
    'a','t','t','r','i','b','u','t','e','s','-','n','a','t','u','r','a','l','-','l','a','n','g','u','a','g','e', // name
    0x00, 0x02, // value-length
    'e','n', // value
    // ATT 3
    0x45, // uri type value-tag
    0x00, 0x0B, // name-length
    'p','r','i','n','t','e','r','-','u','r','i', // name
    0x00, 0x1A, // value-length
    'i','p','p',':','/','/','1','7','2','.','0','2','0','.','0','1','0','.','0','0','8',':','0','8','0','/', // value
    // ATT 4
    0x42, // requesting user id value-tag
    0x00, 0x14, // name-length
    'r','e','q','u','e','s','t','i','n','g','-','u','s','e','r','-','n','a','m','e', // name
    0x00, 0x09, // value-length
    'a','s','s','o','c','i','a','t','e', // value
    // ATT 5
    0x49, // document format value-tag
    0x00, 0x0f, // document format
    'd','o','c','u','m','e','n','t','-','f','o','r','m','a','t',
    0x00, 0x0f, // value-length
    'a','p','p','l','i','c','a','t','i','o','n','/','p','d','f',
    0x02, // start job-attributes tag
    0x21, // integer type value-tag
    0x00, 0x06, // name-length
    'c','o','p','i','e','s',
    0x00, 0x04, // value-length
    0x00, 0x00, 0x00, 0x01, // 1 copy
    // could add 'sides' with 'two-sided-long-edge' for double sided prints (see RFC)
    0x03 // end of attributes
    }; // follow with pdf file data

NSMutableData *printJob = [NSMutableData dataWithBytes:data length:sizeof(data)];

NSString *pdfFilePath = [[NSBundle mainBundle] pathForResource:@"sample" ofType:@"pdf"];
NSData* pdfData = [NSData dataWithContentsOfFile:pdfFilePath options:NSDataReadingUncached error:NULL];

[printJob appendData:pdfData];

NSString* requestDataLengthString = [[NSString alloc] initWithFormat:@"%ld", [printJob length]];

NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:[NSURL URLWithString:@"http://172.020.010.008:080/"]];
[request setHTTPMethod:@"POST"];
[request setValue:requestDataLengthString forHTTPHeaderField:@"Content-Length"];
[request setValue:@"application/ipp" forHTTPHeaderField:@"Content-Type"];
[request setHTTPBody:printJob];

NSError *error;
NSURLResponse *response;
NSData *responseData = [NSURLConnection sendSynchronousRequest:request
                                             returningResponse:&response
                                                         error:&error];

Something I suggest if you need help seeing working examples of any IPP call formatting is to use ipptool to generate the request and capture it to file. I could not get Burp proxy to intercept it (even with the http_proxy environment variable), but this node script did the trick:

const http = require('http');
const fs = require('fs');

http.createServer(function (req, res) {

    console.log('Request Received');

    var body = '';

    res.writeHead(200, {
        'Context-Type': 'text/plain',
        'Access-Control-Allow-Origin': '*'
    });

    req.on('data', function (chunk) {
        body += chunk;
    });

    req.on('end', function() {
        fs.writeFileSync('file.txt', body, 'utf8');
        res.end('{"msg": "OK"}');
    })

}).listen(8080, '127.0.0.1'); 
console.log('Server running at http://127.0.0.1:8080/')

Then you can call your node server:

ipptool -vt -f sample.pdf ipp://127.0.0.1:8080/ print-job.test

and inspect the request:

hexdump -C -n256 file.txt

Answer 2

You have to use the correct ipp operation code for Print-Job:

• incorrect: 0x00, 0x04, // =Validate-job request
• correct : 0x00, 0x02, // Print-job request

You should use document-format text/plain instead of octet-stream. Also make sure the printer supports the data-format or at least make sure CUPS is configured with appropriate converters (It looks like you speak to the HP-printer via CUPS).

Don't worry about the user-agent, it doesn't matter. Instead take care about your http-protocol-handling! By sending Expect: 100-continue you make CUPS expect chunked http. Don't send the Expect-Header and all should be fine.

Make sure the length of the ipp-request plus data-length is correctly computed and put into the content-length-header.

NB: I have implemented a print request in Kotlin. Porting to Objective-C or Swift should be possible if you find a replacement for DataInputStream, DataOutputStream and know how to POST http requests. I'd be happy to assist you.