]>
Commit | Line | Data |
---|---|---|
b9e9a44b | 1 | //-*- mode: cpp; mode: fold -*- |
d546f98d MV |
2 | // Description /*{{{*/ |
3 | // $Id: http.cc,v 1.59 2004/05/08 19:42:35 mdz Exp $ | |
4 | /* ###################################################################### | |
5 | ||
ae58a985 | 6 | HTTPS Acquire Method - This is the HTTPS aquire method for APT. |
d546f98d MV |
7 | |
8 | It uses libcurl | |
9 | ||
10 | ##################################################################### */ | |
11 | /*}}}*/ | |
12 | // Include Files /*{{{*/ | |
ea542140 DK |
13 | #include <config.h> |
14 | ||
d546f98d MV |
15 | #include <apt-pkg/fileutl.h> |
16 | #include <apt-pkg/acquire-method.h> | |
17 | #include <apt-pkg/error.h> | |
18 | #include <apt-pkg/hashes.h> | |
592b7800 | 19 | #include <apt-pkg/netrc.h> |
472ff00e | 20 | #include <apt-pkg/configuration.h> |
d546f98d MV |
21 | |
22 | #include <sys/stat.h> | |
23 | #include <sys/time.h> | |
24 | #include <utime.h> | |
25 | #include <unistd.h> | |
26 | #include <signal.h> | |
27 | #include <stdio.h> | |
28 | #include <errno.h> | |
29 | #include <string.h> | |
30 | #include <iostream> | |
d546f98d MV |
31 | #include <sstream> |
32 | ||
33 | #include "config.h" | |
34 | #include "https.h" | |
ea542140 | 35 | #include <apti18n.h> |
d546f98d MV |
36 | /*}}}*/ |
37 | using namespace std; | |
38 | ||
39 | size_t | |
40 | HttpsMethod::write_data(void *buffer, size_t size, size_t nmemb, void *userp) | |
41 | { | |
42 | HttpsMethod *me = (HttpsMethod *)userp; | |
43 | ||
44 | if(me->File->Write(buffer, size*nmemb) != true) | |
45 | return false; | |
46 | ||
47 | return size*nmemb; | |
48 | } | |
49 | ||
50 | int | |
51 | HttpsMethod::progress_callback(void *clientp, double dltotal, double dlnow, | |
52 | double ultotal, double ulnow) | |
53 | { | |
54 | HttpsMethod *me = (HttpsMethod *)clientp; | |
55 | if(dltotal > 0 && me->Res.Size == 0) { | |
650faab0 | 56 | me->Res.Size = (unsigned long long)dltotal; |
d546f98d MV |
57 | me->URIStart(me->Res); |
58 | } | |
59 | return 0; | |
60 | } | |
61 | ||
4407a02f | 62 | void HttpsMethod::SetupProxy() /*{{{*/ |
d546f98d MV |
63 | { |
64 | URI ServerName = Queue->Uri; | |
65 | ||
4407a02f MV |
66 | // Determine the proxy setting - try https first, fallback to http and use env at last |
67 | string UseProxy = _config->Find("Acquire::https::Proxy::" + ServerName.Host, | |
68 | _config->Find("Acquire::http::Proxy::" + ServerName.Host).c_str()); | |
69 | ||
70 | if (UseProxy.empty() == true) | |
71 | UseProxy = _config->Find("Acquire::https::Proxy", _config->Find("Acquire::http::Proxy").c_str()); | |
72 | ||
73 | // User want to use NO proxy, so nothing to setup | |
74 | if (UseProxy == "DIRECT") | |
75 | return; | |
76 | ||
77 | if (UseProxy.empty() == false) | |
d546f98d | 78 | { |
4407a02f MV |
79 | // Parse no_proxy, a comma (,) separated list of domains we don't want to use |
80 | // a proxy for so we stop right here if it is in the list | |
81 | if (getenv("no_proxy") != 0 && CheckDomainList(ServerName.Host,getenv("no_proxy")) == true) | |
82 | return; | |
83 | } else { | |
84 | const char* result = getenv("http_proxy"); | |
85 | UseProxy = result == NULL ? "" : result; | |
d546f98d | 86 | } |
4407a02f | 87 | |
d546f98d | 88 | // Determine what host and port to use based on the proxy settings |
4407a02f | 89 | if (UseProxy.empty() == false) |
d546f98d | 90 | { |
4407a02f MV |
91 | Proxy = UseProxy; |
92 | if (Proxy.Port != 1) | |
d546f98d MV |
93 | curl_easy_setopt(curl, CURLOPT_PROXYPORT, Proxy.Port); |
94 | curl_easy_setopt(curl, CURLOPT_PROXY, Proxy.Host.c_str()); | |
95 | } | |
b9e9a44b | 96 | } /*}}}*/ |
d546f98d MV |
97 | // HttpsMethod::Fetch - Fetch an item /*{{{*/ |
98 | // --------------------------------------------------------------------- | |
99 | /* This adds an item to the pipeline. We keep the pipeline at a fixed | |
100 | depth. */ | |
101 | bool HttpsMethod::Fetch(FetchItem *Itm) | |
102 | { | |
d546f98d MV |
103 | struct stat SBuf; |
104 | struct curl_slist *headers=NULL; | |
714ee06c | 105 | char curl_errorstr[CURL_ERROR_SIZE]; |
4c499611 | 106 | long curl_responsecode; |
c769cd6f MV |
107 | URI Uri = Itm->Uri; |
108 | string remotehost = Uri.Host; | |
d546f98d MV |
109 | |
110 | // TODO: | |
d546f98d MV |
111 | // - http::Pipeline-Depth |
112 | // - error checking/reporting | |
113 | // - more debug options? (CURLOPT_DEBUGFUNCTION?) | |
114 | ||
5820530d | 115 | curl_easy_reset(curl); |
d546f98d MV |
116 | SetupProxy(); |
117 | ||
1de1f703 | 118 | maybe_add_auth (Uri, _config->FindFile("Dir::Etc::netrc")); |
592b7800 | 119 | |
d546f98d | 120 | // callbacks |
01fc8930 | 121 | curl_easy_setopt(curl, CURLOPT_URL, static_cast<string>(Uri).c_str()); |
d546f98d MV |
122 | curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data); |
123 | curl_easy_setopt(curl, CURLOPT_WRITEDATA, this); | |
124 | curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback); | |
125 | curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, this); | |
126 | curl_easy_setopt(curl, CURLOPT_NOPROGRESS, false); | |
5820530d | 127 | curl_easy_setopt(curl, CURLOPT_FILETIME, true); |
d546f98d | 128 | |
c769cd6f MV |
129 | // SSL parameters are set by default to the common (non mirror-specific) value |
130 | // if available (or a default one) and gets overload by mirror-specific ones. | |
131 | ||
132 | // File containing the list of trusted CA. | |
133 | string cainfo = _config->Find("Acquire::https::CaInfo",""); | |
134 | string knob = "Acquire::https::"+remotehost+"::CaInfo"; | |
135 | cainfo = _config->Find(knob.c_str(),cainfo.c_str()); | |
46e39c8e | 136 | if(cainfo.empty() == false) |
c769cd6f MV |
137 | curl_easy_setopt(curl, CURLOPT_CAINFO,cainfo.c_str()); |
138 | ||
139 | // Check server certificate against previous CA list ... | |
140 | bool peer_verify = _config->FindB("Acquire::https::Verify-Peer",true); | |
141 | knob = "Acquire::https::" + remotehost + "::Verify-Peer"; | |
142 | peer_verify = _config->FindB(knob.c_str(), peer_verify); | |
714ee06c MV |
143 | curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, peer_verify); |
144 | ||
c769cd6f | 145 | // ... and hostname against cert CN or subjectAltName |
c769cd6f MV |
146 | bool verify = _config->FindB("Acquire::https::Verify-Host",true); |
147 | knob = "Acquire::https::"+remotehost+"::Verify-Host"; | |
148 | verify = _config->FindB(knob.c_str(),verify); | |
52b22cea DK |
149 | int const default_verify = (verify == true) ? 2 : 0; |
150 | curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, default_verify); | |
c769cd6f | 151 | |
46e39c8e MV |
152 | // Also enforce issuer of server certificate using its cert |
153 | string issuercert = _config->Find("Acquire::https::IssuerCert",""); | |
154 | knob = "Acquire::https::"+remotehost+"::IssuerCert"; | |
155 | issuercert = _config->Find(knob.c_str(),issuercert.c_str()); | |
156 | if(issuercert.empty() == false) | |
157 | curl_easy_setopt(curl, CURLOPT_ISSUERCERT,issuercert.c_str()); | |
158 | ||
c769cd6f | 159 | // For client authentication, certificate file ... |
714ee06c | 160 | string pem = _config->Find("Acquire::https::SslCert",""); |
c769cd6f MV |
161 | knob = "Acquire::https::"+remotehost+"::SslCert"; |
162 | pem = _config->Find(knob.c_str(),pem.c_str()); | |
46e39c8e | 163 | if(pem.empty() == false) |
714ee06c | 164 | curl_easy_setopt(curl, CURLOPT_SSLCERT, pem.c_str()); |
c769cd6f MV |
165 | |
166 | // ... and associated key. | |
167 | string key = _config->Find("Acquire::https::SslKey",""); | |
168 | knob = "Acquire::https::"+remotehost+"::SslKey"; | |
169 | key = _config->Find(knob.c_str(),key.c_str()); | |
46e39c8e | 170 | if(key.empty() == false) |
c769cd6f MV |
171 | curl_easy_setopt(curl, CURLOPT_SSLKEY, key.c_str()); |
172 | ||
173 | // Allow forcing SSL version to SSLv3 or TLSv1 (SSLv2 is not | |
174 | // supported by GnuTLS). | |
175 | long final_version = CURL_SSLVERSION_DEFAULT; | |
176 | string sslversion = _config->Find("Acquire::https::SslForceVersion",""); | |
177 | knob = "Acquire::https::"+remotehost+"::SslForceVersion"; | |
178 | sslversion = _config->Find(knob.c_str(),sslversion.c_str()); | |
179 | if(sslversion == "TLSv1") | |
180 | final_version = CURL_SSLVERSION_TLSv1; | |
181 | else if(sslversion == "SSLv3") | |
182 | final_version = CURL_SSLVERSION_SSLv3; | |
183 | curl_easy_setopt(curl, CURLOPT_SSLVERSION, final_version); | |
d546f98d | 184 | |
46e39c8e MV |
185 | // CRL file |
186 | string crlfile = _config->Find("Acquire::https::CrlFile",""); | |
187 | knob = "Acquire::https::"+remotehost+"::CrlFile"; | |
188 | crlfile = _config->Find(knob.c_str(),crlfile.c_str()); | |
189 | if(crlfile.empty() == false) | |
190 | curl_easy_setopt(curl, CURLOPT_CRLFILE, crlfile.c_str()); | |
191 | ||
d546f98d | 192 | // cache-control |
b9e9a44b DK |
193 | if(_config->FindB("Acquire::https::No-Cache", |
194 | _config->FindB("Acquire::http::No-Cache",false)) == false) | |
d546f98d MV |
195 | { |
196 | // cache enabled | |
b9e9a44b DK |
197 | if (_config->FindB("Acquire::https::No-Store", |
198 | _config->FindB("Acquire::http::No-Store",false)) == true) | |
d546f98d | 199 | headers = curl_slist_append(headers,"Cache-Control: no-store"); |
8654fae9 | 200 | stringstream ss; |
b9e9a44b DK |
201 | ioprintf(ss, "Cache-Control: max-age=%u", _config->FindI("Acquire::https::Max-Age", |
202 | _config->FindI("Acquire::http::Max-Age",0))); | |
d546f98d MV |
203 | headers = curl_slist_append(headers, ss.str().c_str()); |
204 | } else { | |
205 | // cache disabled by user | |
206 | headers = curl_slist_append(headers, "Cache-Control: no-cache"); | |
207 | headers = curl_slist_append(headers, "Pragma: no-cache"); | |
208 | } | |
209 | curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); | |
210 | ||
d546f98d | 211 | // speed limit |
46e39c8e | 212 | int const dlLimit = _config->FindI("Acquire::https::Dl-Limit", |
b9e9a44b | 213 | _config->FindI("Acquire::http::Dl-Limit",0))*1024; |
d546f98d MV |
214 | if (dlLimit > 0) |
215 | curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, dlLimit); | |
216 | ||
217 | // set header | |
9f542bae DK |
218 | curl_easy_setopt(curl, CURLOPT_USERAGENT, |
219 | _config->Find("Acquire::https::User-Agent", | |
220 | _config->Find("Acquire::http::User-Agent", | |
335e2c82 | 221 | "Debian APT-CURL/1.0 (" PACKAGE_VERSION ")").c_str()).c_str()); |
d546f98d | 222 | |
cc615257 | 223 | // set timeout |
46e39c8e | 224 | int const timeout = _config->FindI("Acquire::https::Timeout", |
b9e9a44b | 225 | _config->FindI("Acquire::http::Timeout",120)); |
cc615257 | 226 | curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, timeout); |
43cf55db | 227 | //set really low lowspeed timeout (see #497983) |
5085e660 | 228 | curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, DL_MIN_SPEED); |
43cf55db | 229 | curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, timeout); |
cc615257 | 230 | |
668ce84d | 231 | // set redirect options and default to 10 redirects |
46e39c8e | 232 | bool const AllowRedirect = _config->FindB("Acquire::https::AllowRedirect", |
b9e9a44b | 233 | _config->FindB("Acquire::http::AllowRedirect",true)); |
668ce84d MV |
234 | curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, AllowRedirect); |
235 | curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 10); | |
236 | ||
d546f98d | 237 | // debug |
714ee06c | 238 | if(_config->FindB("Debug::Acquire::https", false)) |
d546f98d MV |
239 | curl_easy_setopt(curl, CURLOPT_VERBOSE, true); |
240 | ||
714ee06c | 241 | // error handling |
cc418115 | 242 | curl_errorstr[0] = '\0'; |
714ee06c MV |
243 | curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curl_errorstr); |
244 | ||
6f4501f9 DK |
245 | // If we ask for uncompressed files servers might respond with content- |
246 | // negotation which lets us end up with compressed files we do not support, | |
247 | // see 657029, 657560 and co, so if we have no extension on the request | |
248 | // ask for text only. As a sidenote: If there is nothing to negotate servers | |
249 | // seem to be nice and ignore it. | |
250 | if (_config->FindB("Acquire::https::SendAccept", _config->FindB("Acquire::http::SendAccept", true)) == true) | |
251 | { | |
252 | size_t const filepos = Itm->Uri.find_last_of('/'); | |
253 | string const file = Itm->Uri.substr(filepos + 1); | |
254 | if (flExtension(file) == file) | |
255 | headers = curl_slist_append(headers, "Accept: text/*"); | |
256 | } | |
257 | ||
d6039f9e | 258 | // if we have the file send an if-range query with a range header |
4c499611 MV |
259 | if (stat(Itm->DestFile.c_str(),&SBuf) >= 0 && SBuf.st_size > 0) |
260 | { | |
261 | char Buf[1000]; | |
8654fae9 | 262 | sprintf(Buf, "Range: bytes=%li-", (long) SBuf.st_size - 1); |
4c499611 | 263 | headers = curl_slist_append(headers, Buf); |
8654fae9 DK |
264 | sprintf(Buf, "If-Range: %s", TimeRFC1123(SBuf.st_mtime).c_str()); |
265 | headers = curl_slist_append(headers, Buf); | |
266 | } | |
d6039f9e MV |
267 | else if(Itm->LastModified > 0) |
268 | { | |
269 | curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE); | |
270 | curl_easy_setopt(curl, CURLOPT_TIMEVALUE, Itm->LastModified); | |
4c499611 | 271 | } |
d546f98d MV |
272 | |
273 | // go for it - if the file exists, append on it | |
274 | File = new FileFd(Itm->DestFile, FileFd::WriteAny); | |
d6039f9e MV |
275 | if (File->Size() > 0) |
276 | File->Seek(File->Size() - 1); | |
d546f98d MV |
277 | |
278 | // keep apt updated | |
279 | Res.Filename = Itm->DestFile; | |
280 | ||
281 | // get it! | |
282 | CURLcode success = curl_easy_perform(curl); | |
4c499611 | 283 | curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &curl_responsecode); |
d546f98d | 284 | |
5820530d OS |
285 | long curl_servdate; |
286 | curl_easy_getinfo(curl, CURLINFO_FILETIME, &curl_servdate); | |
287 | ||
db1f1469 MV |
288 | File->Close(); |
289 | ||
d546f98d | 290 | // cleanup |
cc418115 | 291 | if(success != 0 || (curl_responsecode != 200 && curl_responsecode != 304)) |
4c499611 | 292 | { |
9b5d79ec | 293 | _error->Error("%s", curl_errorstr); |
db1f1469 MV |
294 | // unlink, no need keep 401/404 page content in partial/ |
295 | unlink(File->Name().c_str()); | |
d546f98d MV |
296 | Fail(); |
297 | return true; | |
298 | } | |
299 | ||
5820530d OS |
300 | // Timestamp |
301 | struct utimbuf UBuf; | |
302 | if (curl_servdate != -1) { | |
303 | UBuf.actime = curl_servdate; | |
304 | UBuf.modtime = curl_servdate; | |
305 | utime(File->Name().c_str(),&UBuf); | |
306 | } | |
307 | ||
d546f98d MV |
308 | // check the downloaded result |
309 | struct stat Buf; | |
310 | if (stat(File->Name().c_str(),&Buf) == 0) | |
311 | { | |
d546f98d MV |
312 | Res.Filename = File->Name(); |
313 | Res.LastModified = Buf.st_mtime; | |
314 | Res.IMSHit = false; | |
4c499611 | 315 | if (curl_responsecode == 304) |
714ee06c | 316 | { |
d6039f9e | 317 | unlink(File->Name().c_str()); |
d546f98d | 318 | Res.IMSHit = true; |
714ee06c | 319 | Res.LastModified = Itm->LastModified; |
d6039f9e MV |
320 | Res.Size = 0; |
321 | URIDone(Res); | |
322 | return true; | |
714ee06c | 323 | } |
d6039f9e | 324 | Res.Size = Buf.st_size; |
d546f98d MV |
325 | } |
326 | ||
327 | // take hashes | |
328 | Hashes Hash; | |
329 | FileFd Fd(Res.Filename, FileFd::ReadOnly); | |
109eb151 | 330 | Hash.AddFD(Fd); |
d546f98d MV |
331 | Res.TakeHashes(Hash); |
332 | ||
333 | // keep apt updated | |
334 | URIDone(Res); | |
335 | ||
336 | // cleanup | |
d546f98d MV |
337 | Res.Size = 0; |
338 | delete File; | |
339 | curl_slist_free_all(headers); | |
340 | ||
341 | return true; | |
342 | }; | |
343 | ||
344 | int main() | |
345 | { | |
346 | setlocale(LC_ALL, ""); | |
347 | ||
348 | HttpsMethod Mth; | |
349 | curl_global_init(CURL_GLOBAL_SSL) ; | |
350 | ||
351 | return Mth.Run(); | |
352 | } | |
353 | ||
354 |