]> git.saurik.com Git - apt.git/blame - methods/https.cc
add AI_ADDRCONFIG to ai_flags in connect.cc as suggested by Aurelien Jarno
[apt.git] / methods / https.cc
CommitLineData
b9e9a44b 1//-*- mode: cpp; mode: fold -*-
d546f98d
MV
2// Description /*{{{*/
3// $Id: http.cc,v 1.59 2004/05/08 19:42:35 mdz Exp $
4/* ######################################################################
5
ae58a985 6 HTTPS Acquire Method - This is the HTTPS aquire method for APT.
d546f98d
MV
7
8 It uses libcurl
9
10 ##################################################################### */
11 /*}}}*/
12// Include Files /*{{{*/
13#include <apt-pkg/fileutl.h>
14#include <apt-pkg/acquire-method.h>
15#include <apt-pkg/error.h>
16#include <apt-pkg/hashes.h>
592b7800 17#include <apt-pkg/netrc.h>
d546f98d
MV
18
19#include <sys/stat.h>
20#include <sys/time.h>
21#include <utime.h>
22#include <unistd.h>
23#include <signal.h>
24#include <stdio.h>
25#include <errno.h>
26#include <string.h>
27#include <iostream>
28#include <apti18n.h>
29#include <sstream>
30
31#include "config.h"
32#include "https.h"
33
34 /*}}}*/
35using namespace std;
36
37size_t
38HttpsMethod::write_data(void *buffer, size_t size, size_t nmemb, void *userp)
39{
40 HttpsMethod *me = (HttpsMethod *)userp;
41
42 if(me->File->Write(buffer, size*nmemb) != true)
43 return false;
44
45 return size*nmemb;
46}
47
48int
49HttpsMethod::progress_callback(void *clientp, double dltotal, double dlnow,
50 double ultotal, double ulnow)
51{
52 HttpsMethod *me = (HttpsMethod *)clientp;
53 if(dltotal > 0 && me->Res.Size == 0) {
21fd1746 54 me->Res.Size = (unsigned long)dltotal;
d546f98d
MV
55 me->URIStart(me->Res);
56 }
57 return 0;
58}
59
b9e9a44b
DK
60void HttpsMethod::SetupProxy() { /*{{{*/
61 URI ServerName = Queue->Uri;
62
63 // Determine the proxy setting - try https first, fallback to http and use env at last
64 string UseProxy = _config->Find("Acquire::https::Proxy::" + ServerName.Host,
65 _config->Find("Acquire::http::Proxy::" + ServerName.Host));
66
67 if (UseProxy.empty() == true)
68 UseProxy = _config->Find("Acquire::https::Proxy", _config->Find("Acquire::http::Proxy"));
69
70 // User want to use NO proxy, so nothing to setup
71 if (UseProxy == "DIRECT")
72 return;
73
74 if (UseProxy.empty() == false) {
75 // Parse no_proxy, a comma (,) separated list of domains we don't want to use
76 // a proxy for so we stop right here if it is in the list
77 if (getenv("no_proxy") != 0 && CheckDomainList(ServerName.Host,getenv("no_proxy")) == true)
78 return;
79 } else {
80 const char* result = getenv("http_proxy");
81 UseProxy = result == NULL ? "" : result;
82 }
83
84 // Determine what host and port to use based on the proxy settings
85 if (UseProxy.empty() == false) {
86 Proxy = UseProxy;
87 if (Proxy.Port != 1)
88 curl_easy_setopt(curl, CURLOPT_PROXYPORT, Proxy.Port);
89 curl_easy_setopt(curl, CURLOPT_PROXY, Proxy.Host.c_str());
90 }
91} /*}}}*/
d546f98d
MV
92// HttpsMethod::Fetch - Fetch an item /*{{{*/
93// ---------------------------------------------------------------------
94/* This adds an item to the pipeline. We keep the pipeline at a fixed
95 depth. */
96bool HttpsMethod::Fetch(FetchItem *Itm)
97{
98 stringstream ss;
99 struct stat SBuf;
100 struct curl_slist *headers=NULL;
714ee06c 101 char curl_errorstr[CURL_ERROR_SIZE];
4c499611 102 long curl_responsecode;
c769cd6f
MV
103 URI Uri = Itm->Uri;
104 string remotehost = Uri.Host;
d546f98d
MV
105
106 // TODO:
d546f98d
MV
107 // - http::Pipeline-Depth
108 // - error checking/reporting
109 // - more debug options? (CURLOPT_DEBUGFUNCTION?)
110
5820530d 111 curl_easy_reset(curl);
d546f98d
MV
112 SetupProxy();
113
1de1f703 114 maybe_add_auth (Uri, _config->FindFile("Dir::Etc::netrc"));
592b7800 115
d546f98d 116 // callbacks
01fc8930 117 curl_easy_setopt(curl, CURLOPT_URL, static_cast<string>(Uri).c_str());
d546f98d
MV
118 curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data);
119 curl_easy_setopt(curl, CURLOPT_WRITEDATA, this);
120 curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
121 curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, this);
122 curl_easy_setopt(curl, CURLOPT_NOPROGRESS, false);
123 curl_easy_setopt(curl, CURLOPT_FAILONERROR, true);
5820530d 124 curl_easy_setopt(curl, CURLOPT_FILETIME, true);
d546f98d 125
c769cd6f
MV
126 // SSL parameters are set by default to the common (non mirror-specific) value
127 // if available (or a default one) and gets overload by mirror-specific ones.
128
129 // File containing the list of trusted CA.
130 string cainfo = _config->Find("Acquire::https::CaInfo","");
131 string knob = "Acquire::https::"+remotehost+"::CaInfo";
132 cainfo = _config->Find(knob.c_str(),cainfo.c_str());
133 if(cainfo != "")
134 curl_easy_setopt(curl, CURLOPT_CAINFO,cainfo.c_str());
135
136 // Check server certificate against previous CA list ...
137 bool peer_verify = _config->FindB("Acquire::https::Verify-Peer",true);
138 knob = "Acquire::https::" + remotehost + "::Verify-Peer";
139 peer_verify = _config->FindB(knob.c_str(), peer_verify);
714ee06c
MV
140 curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, peer_verify);
141
c769cd6f
MV
142 // ... and hostname against cert CN or subjectAltName
143 int default_verify = 2;
144 bool verify = _config->FindB("Acquire::https::Verify-Host",true);
145 knob = "Acquire::https::"+remotehost+"::Verify-Host";
146 verify = _config->FindB(knob.c_str(),verify);
147 if (!verify)
148 default_verify = 0;
149 curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, verify);
150
151 // For client authentication, certificate file ...
714ee06c 152 string pem = _config->Find("Acquire::https::SslCert","");
c769cd6f
MV
153 knob = "Acquire::https::"+remotehost+"::SslCert";
154 pem = _config->Find(knob.c_str(),pem.c_str());
714ee06c
MV
155 if(pem != "")
156 curl_easy_setopt(curl, CURLOPT_SSLCERT, pem.c_str());
c769cd6f
MV
157
158 // ... and associated key.
159 string key = _config->Find("Acquire::https::SslKey","");
160 knob = "Acquire::https::"+remotehost+"::SslKey";
161 key = _config->Find(knob.c_str(),key.c_str());
162 if(key != "")
163 curl_easy_setopt(curl, CURLOPT_SSLKEY, key.c_str());
164
165 // Allow forcing SSL version to SSLv3 or TLSv1 (SSLv2 is not
166 // supported by GnuTLS).
167 long final_version = CURL_SSLVERSION_DEFAULT;
168 string sslversion = _config->Find("Acquire::https::SslForceVersion","");
169 knob = "Acquire::https::"+remotehost+"::SslForceVersion";
170 sslversion = _config->Find(knob.c_str(),sslversion.c_str());
171 if(sslversion == "TLSv1")
172 final_version = CURL_SSLVERSION_TLSv1;
173 else if(sslversion == "SSLv3")
174 final_version = CURL_SSLVERSION_SSLv3;
175 curl_easy_setopt(curl, CURLOPT_SSLVERSION, final_version);
d546f98d
MV
176
177 // cache-control
b9e9a44b
DK
178 if(_config->FindB("Acquire::https::No-Cache",
179 _config->FindB("Acquire::http::No-Cache",false)) == false)
d546f98d
MV
180 {
181 // cache enabled
b9e9a44b
DK
182 if (_config->FindB("Acquire::https::No-Store",
183 _config->FindB("Acquire::http::No-Store",false)) == true)
d546f98d 184 headers = curl_slist_append(headers,"Cache-Control: no-store");
b9e9a44b
DK
185 ioprintf(ss, "Cache-Control: max-age=%u", _config->FindI("Acquire::https::Max-Age",
186 _config->FindI("Acquire::http::Max-Age",0)));
d546f98d
MV
187 headers = curl_slist_append(headers, ss.str().c_str());
188 } else {
189 // cache disabled by user
190 headers = curl_slist_append(headers, "Cache-Control: no-cache");
191 headers = curl_slist_append(headers, "Pragma: no-cache");
192 }
193 curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
194
d546f98d 195 // speed limit
b9e9a44b
DK
196 int dlLimit = _config->FindI("Acquire::https::Dl-Limit",
197 _config->FindI("Acquire::http::Dl-Limit",0))*1024;
d546f98d
MV
198 if (dlLimit > 0)
199 curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, dlLimit);
200
201 // set header
9f542bae
DK
202 curl_easy_setopt(curl, CURLOPT_USERAGENT,
203 _config->Find("Acquire::https::User-Agent",
204 _config->Find("Acquire::http::User-Agent",
205 "Debian APT-CURL/1.0 ("VERSION")")));
d546f98d 206
cc615257 207 // set timeout
b9e9a44b
DK
208 int timeout = _config->FindI("Acquire::https::Timeout",
209 _config->FindI("Acquire::http::Timeout",120));
cc615257 210 curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, timeout);
43cf55db 211 //set really low lowspeed timeout (see #497983)
5085e660 212 curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, DL_MIN_SPEED);
43cf55db 213 curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, timeout);
cc615257 214
668ce84d 215 // set redirect options and default to 10 redirects
b9e9a44b
DK
216 bool AllowRedirect = _config->FindB("Acquire::https::AllowRedirect",
217 _config->FindB("Acquire::http::AllowRedirect",true));
668ce84d
MV
218 curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, AllowRedirect);
219 curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 10);
220
d546f98d 221 // debug
714ee06c 222 if(_config->FindB("Debug::Acquire::https", false))
d546f98d
MV
223 curl_easy_setopt(curl, CURLOPT_VERBOSE, true);
224
714ee06c
MV
225 // error handling
226 curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curl_errorstr);
227
d6039f9e 228 // if we have the file send an if-range query with a range header
4c499611
MV
229 if (stat(Itm->DestFile.c_str(),&SBuf) >= 0 && SBuf.st_size > 0)
230 {
231 char Buf[1000];
232 sprintf(Buf,"Range: bytes=%li-\r\nIf-Range: %s\r\n",
233 (long)SBuf.st_size - 1,
234 TimeRFC1123(SBuf.st_mtime).c_str());
235 headers = curl_slist_append(headers, Buf);
d6039f9e
MV
236 }
237 else if(Itm->LastModified > 0)
238 {
239 curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
240 curl_easy_setopt(curl, CURLOPT_TIMEVALUE, Itm->LastModified);
4c499611 241 }
d546f98d
MV
242
243 // go for it - if the file exists, append on it
244 File = new FileFd(Itm->DestFile, FileFd::WriteAny);
d6039f9e
MV
245 if (File->Size() > 0)
246 File->Seek(File->Size() - 1);
d546f98d
MV
247
248 // keep apt updated
249 Res.Filename = Itm->DestFile;
250
251 // get it!
252 CURLcode success = curl_easy_perform(curl);
4c499611 253 curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &curl_responsecode);
d546f98d 254
5820530d
OS
255 long curl_servdate;
256 curl_easy_getinfo(curl, CURLINFO_FILETIME, &curl_servdate);
257
d546f98d 258 // cleanup
4c499611
MV
259 if(success != 0)
260 {
9b5d79ec 261 _error->Error("%s", curl_errorstr);
d546f98d
MV
262 Fail();
263 return true;
264 }
4c499611 265 File->Close();
d546f98d 266
5820530d
OS
267 // Timestamp
268 struct utimbuf UBuf;
269 if (curl_servdate != -1) {
270 UBuf.actime = curl_servdate;
271 UBuf.modtime = curl_servdate;
272 utime(File->Name().c_str(),&UBuf);
273 }
274
d546f98d
MV
275 // check the downloaded result
276 struct stat Buf;
277 if (stat(File->Name().c_str(),&Buf) == 0)
278 {
d546f98d
MV
279 Res.Filename = File->Name();
280 Res.LastModified = Buf.st_mtime;
281 Res.IMSHit = false;
4c499611 282 if (curl_responsecode == 304)
714ee06c 283 {
d6039f9e 284 unlink(File->Name().c_str());
d546f98d 285 Res.IMSHit = true;
714ee06c 286 Res.LastModified = Itm->LastModified;
d6039f9e
MV
287 Res.Size = 0;
288 URIDone(Res);
289 return true;
714ee06c 290 }
d6039f9e 291 Res.Size = Buf.st_size;
d546f98d
MV
292 }
293
294 // take hashes
295 Hashes Hash;
296 FileFd Fd(Res.Filename, FileFd::ReadOnly);
297 Hash.AddFD(Fd.Fd(), Fd.Size());
298 Res.TakeHashes(Hash);
299
300 // keep apt updated
301 URIDone(Res);
302
303 // cleanup
d546f98d
MV
304 Res.Size = 0;
305 delete File;
306 curl_slist_free_all(headers);
307
308 return true;
309};
310
311int main()
312{
313 setlocale(LC_ALL, "");
314
315 HttpsMethod Mth;
316 curl_global_init(CURL_GLOBAL_SSL) ;
317
318 return Mth.Run();
319}
320
321