]>
Commit | Line | Data |
---|---|---|
00ec24d0 JF |
1 | // -*- mode: cpp; mode: fold -*- |
2 | // Description /*{{{*/ | |
3 | // $Id: http.cc,v 1.59 2004/05/08 19:42:35 mdz Exp $ | |
4 | /* ###################################################################### | |
5 | ||
6 | HTTPS Acquire Method - This is the HTTPS aquire method for APT. | |
7 | ||
8 | It uses libcurl | |
9 | ||
10 | ##################################################################### */ | |
11 | /*}}}*/ | |
12 | // Include Files /*{{{*/ | |
13 | #include <apt-pkg/fileutl.h> | |
14 | #include <apt-pkg/acquire-method.h> | |
15 | #include <apt-pkg/error.h> | |
16 | #include <apt-pkg/hashes.h> | |
17 | ||
18 | #include <sys/stat.h> | |
19 | #include <sys/time.h> | |
20 | #include <utime.h> | |
21 | #include <unistd.h> | |
22 | #include <signal.h> | |
23 | #include <stdio.h> | |
24 | #include <errno.h> | |
25 | #include <string.h> | |
26 | #include <iostream> | |
27 | #include <apti18n.h> | |
28 | #include <sstream> | |
29 | ||
30 | #include "config.h" | |
31 | #include "https.h" | |
32 | ||
33 | /*}}}*/ | |
34 | using namespace std; | |
35 | ||
36 | size_t | |
37 | HttpsMethod::write_data(void *buffer, size_t size, size_t nmemb, void *userp) | |
38 | { | |
39 | HttpsMethod *me = (HttpsMethod *)userp; | |
40 | ||
41 | if(me->File->Write(buffer, size*nmemb) != true) | |
42 | return false; | |
43 | ||
44 | return size*nmemb; | |
45 | } | |
46 | ||
47 | int | |
48 | HttpsMethod::progress_callback(void *clientp, double dltotal, double dlnow, | |
49 | double ultotal, double ulnow) | |
50 | { | |
51 | HttpsMethod *me = (HttpsMethod *)clientp; | |
52 | if(dltotal > 0 && me->Res.Size == 0) { | |
53 | me->Res.Size = (unsigned long)dltotal; | |
54 | me->URIStart(me->Res); | |
55 | } | |
56 | return 0; | |
57 | } | |
58 | ||
59 | void HttpsMethod::SetupProxy() | |
60 | { | |
61 | URI ServerName = Queue->Uri; | |
62 | ||
63 | // Determine the proxy setting | |
64 | if (getenv("http_proxy") == 0) | |
65 | { | |
66 | string DefProxy = _config->Find("Acquire::http::Proxy"); | |
67 | string SpecificProxy = _config->Find("Acquire::http::Proxy::" + ServerName.Host); | |
68 | if (SpecificProxy.empty() == false) | |
69 | { | |
70 | if (SpecificProxy == "DIRECT") | |
71 | Proxy = ""; | |
72 | else | |
73 | Proxy = SpecificProxy; | |
74 | } | |
75 | else | |
76 | Proxy = DefProxy; | |
77 | } | |
78 | ||
79 | // Parse no_proxy, a , separated list of domains | |
80 | if (getenv("no_proxy") != 0) | |
81 | { | |
82 | if (CheckDomainList(ServerName.Host,getenv("no_proxy")) == true) | |
83 | Proxy = ""; | |
84 | } | |
85 | ||
86 | // Determine what host and port to use based on the proxy settings | |
87 | string Host; | |
88 | if (Proxy.empty() == true || Proxy.Host.empty() == true) | |
89 | { | |
90 | } | |
91 | else | |
92 | { | |
93 | if (Proxy.Port != 0) | |
94 | curl_easy_setopt(curl, CURLOPT_PROXYPORT, Proxy.Port); | |
95 | curl_easy_setopt(curl, CURLOPT_PROXY, Proxy.Host.c_str()); | |
96 | } | |
97 | } | |
98 | ||
99 | ||
100 | // HttpsMethod::Fetch - Fetch an item /*{{{*/ | |
101 | // --------------------------------------------------------------------- | |
102 | /* This adds an item to the pipeline. We keep the pipeline at a fixed | |
103 | depth. */ | |
104 | bool HttpsMethod::Fetch(FetchItem *Itm) | |
105 | { | |
106 | stringstream ss; | |
107 | struct stat SBuf; | |
108 | struct curl_slist *headers=NULL; | |
109 | char curl_errorstr[CURL_ERROR_SIZE]; | |
110 | long curl_responsecode; | |
111 | URI Uri = Itm->Uri; | |
112 | string remotehost = Uri.Host; | |
113 | ||
114 | // TODO: | |
115 | // - http::Pipeline-Depth | |
116 | // - error checking/reporting | |
117 | // - more debug options? (CURLOPT_DEBUGFUNCTION?) | |
118 | ||
119 | curl_easy_reset(curl); | |
120 | SetupProxy(); | |
121 | ||
122 | // callbacks | |
123 | curl_easy_setopt(curl, CURLOPT_URL, Itm->Uri.c_str()); | |
124 | curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data); | |
125 | curl_easy_setopt(curl, CURLOPT_WRITEDATA, this); | |
126 | curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback); | |
127 | curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, this); | |
128 | curl_easy_setopt(curl, CURLOPT_NOPROGRESS, false); | |
129 | curl_easy_setopt(curl, CURLOPT_FAILONERROR, true); | |
130 | curl_easy_setopt(curl, CURLOPT_FILETIME, true); | |
131 | ||
132 | // SSL parameters are set by default to the common (non mirror-specific) value | |
133 | // if available (or a default one) and gets overload by mirror-specific ones. | |
134 | ||
135 | // File containing the list of trusted CA. | |
136 | string cainfo = _config->Find("Acquire::https::CaInfo",""); | |
137 | string knob = "Acquire::https::"+remotehost+"::CaInfo"; | |
138 | cainfo = _config->Find(knob.c_str(),cainfo.c_str()); | |
139 | if(cainfo != "") | |
140 | curl_easy_setopt(curl, CURLOPT_CAINFO,cainfo.c_str()); | |
141 | ||
142 | // Check server certificate against previous CA list ... | |
143 | bool peer_verify = _config->FindB("Acquire::https::Verify-Peer",true); | |
144 | knob = "Acquire::https::" + remotehost + "::Verify-Peer"; | |
145 | peer_verify = _config->FindB(knob.c_str(), peer_verify); | |
146 | curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, peer_verify); | |
147 | ||
148 | // ... and hostname against cert CN or subjectAltName | |
149 | int default_verify = 2; | |
150 | bool verify = _config->FindB("Acquire::https::Verify-Host",true); | |
151 | knob = "Acquire::https::"+remotehost+"::Verify-Host"; | |
152 | verify = _config->FindB(knob.c_str(),verify); | |
153 | if (!verify) | |
154 | default_verify = 0; | |
155 | curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, verify); | |
156 | ||
157 | // For client authentication, certificate file ... | |
158 | string pem = _config->Find("Acquire::https::SslCert",""); | |
159 | knob = "Acquire::https::"+remotehost+"::SslCert"; | |
160 | pem = _config->Find(knob.c_str(),pem.c_str()); | |
161 | if(pem != "") | |
162 | curl_easy_setopt(curl, CURLOPT_SSLCERT, pem.c_str()); | |
163 | ||
164 | // ... and associated key. | |
165 | string key = _config->Find("Acquire::https::SslKey",""); | |
166 | knob = "Acquire::https::"+remotehost+"::SslKey"; | |
167 | key = _config->Find(knob.c_str(),key.c_str()); | |
168 | if(key != "") | |
169 | curl_easy_setopt(curl, CURLOPT_SSLKEY, key.c_str()); | |
170 | ||
171 | // Allow forcing SSL version to SSLv3 or TLSv1 (SSLv2 is not | |
172 | // supported by GnuTLS). | |
173 | long final_version = CURL_SSLVERSION_DEFAULT; | |
174 | string sslversion = _config->Find("Acquire::https::SslForceVersion",""); | |
175 | knob = "Acquire::https::"+remotehost+"::SslForceVersion"; | |
176 | sslversion = _config->Find(knob.c_str(),sslversion.c_str()); | |
177 | if(sslversion == "TLSv1") | |
178 | final_version = CURL_SSLVERSION_TLSv1; | |
179 | else if(sslversion == "SSLv3") | |
180 | final_version = CURL_SSLVERSION_SSLv3; | |
181 | curl_easy_setopt(curl, CURLOPT_SSLVERSION, final_version); | |
182 | ||
183 | // cache-control | |
184 | if(_config->FindB("Acquire::http::No-Cache",false) == false) | |
185 | { | |
186 | // cache enabled | |
187 | if (_config->FindB("Acquire::http::No-Store",false) == true) | |
188 | headers = curl_slist_append(headers,"Cache-Control: no-store"); | |
189 | ioprintf(ss, "Cache-Control: max-age=%u", _config->FindI("Acquire::http::Max-Age",0)); | |
190 | headers = curl_slist_append(headers, ss.str().c_str()); | |
191 | } else { | |
192 | // cache disabled by user | |
193 | headers = curl_slist_append(headers, "Cache-Control: no-cache"); | |
194 | headers = curl_slist_append(headers, "Pragma: no-cache"); | |
195 | } | |
196 | curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); | |
197 | ||
198 | // speed limit | |
199 | int dlLimit = _config->FindI("Acquire::http::Dl-Limit",0)*1024; | |
200 | if (dlLimit > 0) | |
201 | curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, dlLimit); | |
202 | ||
203 | // set header | |
204 | curl_easy_setopt(curl, CURLOPT_USERAGENT,"Debian APT-CURL/1.0 ("VERSION")"); | |
205 | ||
206 | // set timeout | |
207 | int timeout = _config->FindI("Acquire::http::Timeout",120); | |
208 | curl_easy_setopt(curl, CURLOPT_TIMEOUT, timeout); | |
209 | curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, timeout); | |
210 | ||
211 | // debug | |
212 | if(_config->FindB("Debug::Acquire::https", false)) | |
213 | curl_easy_setopt(curl, CURLOPT_VERBOSE, true); | |
214 | ||
215 | // error handling | |
216 | curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curl_errorstr); | |
217 | ||
218 | // if we have the file send an if-range query with a range header | |
219 | if (stat(Itm->DestFile.c_str(),&SBuf) >= 0 && SBuf.st_size > 0) | |
220 | { | |
221 | char Buf[1000]; | |
222 | sprintf(Buf,"Range: bytes=%li-\r\nIf-Range: %s\r\n", | |
223 | (long)SBuf.st_size - 1, | |
224 | TimeRFC1123(SBuf.st_mtime).c_str()); | |
225 | headers = curl_slist_append(headers, Buf); | |
226 | } | |
227 | else if(Itm->LastModified > 0) | |
228 | { | |
229 | curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE); | |
230 | curl_easy_setopt(curl, CURLOPT_TIMEVALUE, Itm->LastModified); | |
231 | } | |
232 | ||
233 | // go for it - if the file exists, append on it | |
234 | File = new FileFd(Itm->DestFile, FileFd::WriteAny); | |
235 | if (File->Size() > 0) | |
236 | File->Seek(File->Size() - 1); | |
237 | ||
238 | // keep apt updated | |
239 | Res.Filename = Itm->DestFile; | |
240 | ||
241 | // get it! | |
242 | CURLcode success = curl_easy_perform(curl); | |
243 | curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &curl_responsecode); | |
244 | ||
245 | long curl_servdate; | |
246 | curl_easy_getinfo(curl, CURLINFO_FILETIME, &curl_servdate); | |
247 | ||
248 | // cleanup | |
249 | if(success != 0) | |
250 | { | |
251 | unlink(File->Name().c_str()); | |
252 | _error->Error("%s", curl_errorstr); | |
253 | Fail(); | |
254 | return true; | |
255 | } | |
256 | File->Close(); | |
257 | ||
258 | // Timestamp | |
259 | struct utimbuf UBuf; | |
260 | if (curl_servdate != -1) { | |
261 | UBuf.actime = curl_servdate; | |
262 | UBuf.modtime = curl_servdate; | |
263 | utime(File->Name().c_str(),&UBuf); | |
264 | } | |
265 | ||
266 | // check the downloaded result | |
267 | struct stat Buf; | |
268 | if (stat(File->Name().c_str(),&Buf) == 0) | |
269 | { | |
270 | Res.Filename = File->Name(); | |
271 | Res.LastModified = Buf.st_mtime; | |
272 | Res.IMSHit = false; | |
273 | if (curl_responsecode == 304) | |
274 | { | |
275 | unlink(File->Name().c_str()); | |
276 | Res.IMSHit = true; | |
277 | Res.LastModified = Itm->LastModified; | |
278 | Res.Size = 0; | |
279 | URIDone(Res); | |
280 | return true; | |
281 | } | |
282 | Res.Size = Buf.st_size; | |
283 | } | |
284 | ||
285 | // take hashes | |
286 | Hashes Hash; | |
287 | FileFd Fd(Res.Filename, FileFd::ReadOnly); | |
288 | Hash.AddFD(Fd.Fd(), Fd.Size()); | |
289 | Res.TakeHashes(Hash); | |
290 | ||
291 | // keep apt updated | |
292 | URIDone(Res); | |
293 | ||
294 | // cleanup | |
295 | Res.Size = 0; | |
296 | delete File; | |
297 | curl_slist_free_all(headers); | |
298 | ||
299 | return true; | |
300 | }; | |
301 | ||
302 | int main() | |
303 | { | |
304 | setlocale(LC_ALL, ""); | |
305 | ||
306 | HttpsMethod Mth; | |
307 | curl_global_init(CURL_GLOBAL_SSL) ; | |
308 | ||
309 | return Mth.Run(); | |
310 | } | |
311 | ||
312 |