proxy backend truncates system queue names longer than 30 characters (resource[32]): jobs from snap apps are held forever with "No such file or directory"

[prezis]

Summary

The proxy backend reads the target system queue name into char resource[32]. Any system queue name longer than 30 characters gets truncated without an error. The backend then asks the system cupsd for a queue that does not exist, cupsCreateJob() fails, the backend returns CUPS_BACKEND_RETRY, and the job is held and retried forever.

From the user's side, the print dialog of a snap app (e.g. chromium) closes and nothing prints. There is no error.

Long names are common. Network printers get queue names from their DNS-SD service name, e.g. HP Color LaserJet MFP M283fdw (C2312C) → HP_Color_LaserJet_MFP_M283fdw_C2312C (36 characters). With that name, printing from snap apps never works.

Environment

• Ubuntu 24.04.4 LTS
• system CUPS 2.4.7-1.2ubuntu7.14 (deb)
• cups snap 2.4.19-2, rev 1238 (latest/stable), proxy mode (cups-proxyd running)
• chromium snap 152.0.7977.82 (rev 3525), chromium:cups connected to cups:cups

What the snap cupsd logs

The mirrored queue has device-uri proxy://%2Frun%2Fcups%2Fcups.sock/HP_Color_LaserJet_MFP_M283fdw_C2312C, and every attempt produces:

[Job 5] Received job to print on the printer HP_Color_LaserJet_MFP_M283fdw_ on the system's CUPS server (/run/cups/cups.sock).
[Job 5] Creating http connection to the system's CUPS daemon via domain socket: /run/cups/cups.sock
[Job 5] Could not create job on the system's CUPS daemon - No such file or directory
[Job 5] Backend proxy returned status 6 (retry job later)
[Job 5] Job held for 300 seconds since it could not be sent.

The queue name in the first line is cut to 30 characters. The system cupsd's access_log shows no Create-Job from the backend.

Root cause

1. cups-proxyd/proxy.c L53:
   char scheme[64], username[32], system_cups_server[1024], resource[32];
2. httpSeparateURI() copies "/" + queue name into resource. http_copy_decode() stops at dstsize - 1 without reporting an error (cups/http-support.c L2182-L2185). So after system_queue = resource + 1 (L117), at most 30 name characters are left.
3. cupsCreateJob() cannot find that destination and sets strerror(ENOENT) (cups/util.c L181-L186). That is where the misleading "No such file or directory" comes from.

cups-proxyd.c already sizes its own copy of the resource as resource[HTTP_MAX_URI] (L647).

Reproducer (no printer, no paper)

The two system queues below are identical except for name length (18 vs 36 characters). Run as a user in lpadmin, on a system with the cups snap in proxy mode.

lpadmin -p ZZ_PROXYTEST_SHORT -E -v file:///dev/null -m drv:///sample.drv/generic.ppd
lpadmin -p ZZ_PROXYTEST_LONG_NAME_OVER_30_CHARS -E -v file:///dev/null -m drv:///sample.drv/generic.ppd

# wait a few seconds for cups-proxyd to mirror both into the snap, then print THROUGH THE SNAP cupsd
S=/var/snap/cups/common/run/cups.sock
echo test | lp -h $S -d ZZ_PROXYTEST_SHORT
echo test | lp -h $S -d ZZ_PROXYTEST_LONG_NAME_OVER_30_CHARS
sleep 10; lpstat -h $S -l -o

system queue	length	name the backend used	result
ZZ_PROXYTEST_SHORT	18	ZZ_PROXYTEST_SHORT	Job successfully sent to the system's CUPS, completed
ZZ_PROXYTEST_LONG_NAME_OVER_30_CHARS	36	ZZ_PROXYTEST_LONG_NAME_OVER_30	Could not create job ... No such file or directory, held

Suggested fix

-  char scheme[64], username[32], system_cups_server[1024], resource[32];
+  char scheme[64], username[32], system_cups_server[1024], resource[HTTP_MAX_URI];

I have not built or tested this change. It follows the diagnosis above. Checking for truncation, or failing with a clear error when the name does not fit, would also stop the silent retry loop.

Workaround for affected users

Create a permanent queue with a name of at most 30 characters on the system cupsd. cups-proxyd mirrors it into the snap, and printing to it works. Note that a queue created only on the snap's own cupsd is not a durable workaround: cups-proxyd removes snap queues missing from the system on its next start (cups-proxyd.c L993-L1007), e.g. after a snap refresh.