1 //-*- mode: cpp; mode: fold -*-
3 // $Id: http.cc,v 1.59 2004/05/08 19:42:35 mdz Exp $
4 /* ######################################################################
6 HTTPS Acquire Method - This is the HTTPS aquire method for APT.
10 ##################################################################### */
12 // Include Files /*{{{*/
15 #include <apt-pkg/fileutl.h>
16 #include <apt-pkg/acquire-method.h>
17 #include <apt-pkg/error.h>
18 #include <apt-pkg/hashes.h>
19 #include <apt-pkg/netrc.h>
20 #include <apt-pkg/configuration.h>
40 HttpsMethod::write_data(void *buffer
, size_t size
, size_t nmemb
, void *userp
)
42 HttpsMethod
*me
= (HttpsMethod
*)userp
;
44 if(me
->File
->Write(buffer
, size
*nmemb
) != true)
51 HttpsMethod::progress_callback(void *clientp
, double dltotal
, double dlnow
,
52 double ultotal
, double ulnow
)
54 HttpsMethod
*me
= (HttpsMethod
*)clientp
;
55 if(dltotal
> 0 && me
->Res
.Size
== 0) {
56 me
->Res
.Size
= (unsigned long long)dltotal
;
57 me
->URIStart(me
->Res
);
62 void HttpsMethod::SetupProxy() /*{{{*/
64 URI ServerName
= Queue
->Uri
;
66 // Curl should never read proxy settings from the environment, as
67 // we determine which proxy to use. Do this for consistency among
68 // methods and prevent an environment variable overriding a
69 // no-proxy ("DIRECT") setting in apt.conf.
70 curl_easy_setopt(curl
, CURLOPT_PROXY
, "");
72 // Determine the proxy setting - try https first, fallback to http and use env at last
73 string UseProxy
= _config
->Find("Acquire::https::Proxy::" + ServerName
.Host
,
74 _config
->Find("Acquire::http::Proxy::" + ServerName
.Host
).c_str());
76 if (UseProxy
.empty() == true)
77 UseProxy
= _config
->Find("Acquire::https::Proxy", _config
->Find("Acquire::http::Proxy").c_str());
79 // User want to use NO proxy, so nothing to setup
80 if (UseProxy
== "DIRECT")
83 if (UseProxy
.empty() == false)
85 // Parse no_proxy, a comma (,) separated list of domains we don't want to use
86 // a proxy for so we stop right here if it is in the list
87 if (getenv("no_proxy") != 0 && CheckDomainList(ServerName
.Host
,getenv("no_proxy")) == true)
90 const char* result
= getenv("https_proxy");
91 // FIXME: Fall back to http_proxy is to remain compatible with
92 // existing setups and behaviour of apt.conf. This should be
93 // deprecated in the future (including apt.conf). Most other
94 // programs do not fall back to http proxy settings and neither
97 result
= getenv("http_proxy");
98 UseProxy
= result
== NULL
? "" : result
;
101 // Determine what host and port to use based on the proxy settings
102 if (UseProxy
.empty() == false)
106 curl_easy_setopt(curl
, CURLOPT_PROXYPORT
, Proxy
.Port
);
107 curl_easy_setopt(curl
, CURLOPT_PROXY
, Proxy
.Host
.c_str());
108 if (Proxy
.User
.empty() == false || Proxy
.Password
.empty() == false)
110 curl_easy_setopt(curl
, CURLOPT_PROXYUSERNAME
, Proxy
.User
.c_str());
111 curl_easy_setopt(curl
, CURLOPT_PROXYPASSWORD
, Proxy
.Password
.c_str());
115 // HttpsMethod::Fetch - Fetch an item /*{{{*/
116 // ---------------------------------------------------------------------
117 /* This adds an item to the pipeline. We keep the pipeline at a fixed
119 bool HttpsMethod::Fetch(FetchItem
*Itm
)
122 struct curl_slist
*headers
=NULL
;
123 char curl_errorstr
[CURL_ERROR_SIZE
];
124 long curl_responsecode
;
126 string remotehost
= Uri
.Host
;
129 // - http::Pipeline-Depth
130 // - error checking/reporting
131 // - more debug options? (CURLOPT_DEBUGFUNCTION?)
133 curl_easy_reset(curl
);
136 maybe_add_auth (Uri
, _config
->FindFile("Dir::Etc::netrc"));
139 curl_easy_setopt(curl
, CURLOPT_URL
, static_cast<string
>(Uri
).c_str());
140 curl_easy_setopt(curl
, CURLOPT_WRITEFUNCTION
, write_data
);
141 curl_easy_setopt(curl
, CURLOPT_WRITEDATA
, this);
142 curl_easy_setopt(curl
, CURLOPT_PROGRESSFUNCTION
, progress_callback
);
143 curl_easy_setopt(curl
, CURLOPT_PROGRESSDATA
, this);
144 curl_easy_setopt(curl
, CURLOPT_NOPROGRESS
, false);
145 curl_easy_setopt(curl
, CURLOPT_FILETIME
, true);
147 // SSL parameters are set by default to the common (non mirror-specific) value
148 // if available (or a default one) and gets overload by mirror-specific ones.
150 // File containing the list of trusted CA.
151 string cainfo
= _config
->Find("Acquire::https::CaInfo","");
152 string knob
= "Acquire::https::"+remotehost
+"::CaInfo";
153 cainfo
= _config
->Find(knob
.c_str(),cainfo
.c_str());
154 if(cainfo
.empty() == false)
155 curl_easy_setopt(curl
, CURLOPT_CAINFO
,cainfo
.c_str());
157 // Check server certificate against previous CA list ...
158 bool peer_verify
= _config
->FindB("Acquire::https::Verify-Peer",true);
159 knob
= "Acquire::https::" + remotehost
+ "::Verify-Peer";
160 peer_verify
= _config
->FindB(knob
.c_str(), peer_verify
);
161 curl_easy_setopt(curl
, CURLOPT_SSL_VERIFYPEER
, peer_verify
);
163 // ... and hostname against cert CN or subjectAltName
164 bool verify
= _config
->FindB("Acquire::https::Verify-Host",true);
165 knob
= "Acquire::https::"+remotehost
+"::Verify-Host";
166 verify
= _config
->FindB(knob
.c_str(),verify
);
167 int const default_verify
= (verify
== true) ? 2 : 0;
168 curl_easy_setopt(curl
, CURLOPT_SSL_VERIFYHOST
, default_verify
);
170 // Also enforce issuer of server certificate using its cert
171 string issuercert
= _config
->Find("Acquire::https::IssuerCert","");
172 knob
= "Acquire::https::"+remotehost
+"::IssuerCert";
173 issuercert
= _config
->Find(knob
.c_str(),issuercert
.c_str());
174 if(issuercert
.empty() == false)
175 curl_easy_setopt(curl
, CURLOPT_ISSUERCERT
,issuercert
.c_str());
177 // For client authentication, certificate file ...
178 string pem
= _config
->Find("Acquire::https::SslCert","");
179 knob
= "Acquire::https::"+remotehost
+"::SslCert";
180 pem
= _config
->Find(knob
.c_str(),pem
.c_str());
181 if(pem
.empty() == false)
182 curl_easy_setopt(curl
, CURLOPT_SSLCERT
, pem
.c_str());
184 // ... and associated key.
185 string key
= _config
->Find("Acquire::https::SslKey","");
186 knob
= "Acquire::https::"+remotehost
+"::SslKey";
187 key
= _config
->Find(knob
.c_str(),key
.c_str());
188 if(key
.empty() == false)
189 curl_easy_setopt(curl
, CURLOPT_SSLKEY
, key
.c_str());
191 // Allow forcing SSL version to SSLv3 or TLSv1 (SSLv2 is not
192 // supported by GnuTLS).
193 long final_version
= CURL_SSLVERSION_DEFAULT
;
194 string sslversion
= _config
->Find("Acquire::https::SslForceVersion","");
195 knob
= "Acquire::https::"+remotehost
+"::SslForceVersion";
196 sslversion
= _config
->Find(knob
.c_str(),sslversion
.c_str());
197 if(sslversion
== "TLSv1")
198 final_version
= CURL_SSLVERSION_TLSv1
;
199 else if(sslversion
== "SSLv3")
200 final_version
= CURL_SSLVERSION_SSLv3
;
201 curl_easy_setopt(curl
, CURLOPT_SSLVERSION
, final_version
);
204 string crlfile
= _config
->Find("Acquire::https::CrlFile","");
205 knob
= "Acquire::https::"+remotehost
+"::CrlFile";
206 crlfile
= _config
->Find(knob
.c_str(),crlfile
.c_str());
207 if(crlfile
.empty() == false)
208 curl_easy_setopt(curl
, CURLOPT_CRLFILE
, crlfile
.c_str());
211 if(_config
->FindB("Acquire::https::No-Cache",
212 _config
->FindB("Acquire::http::No-Cache",false)) == false)
215 if (_config
->FindB("Acquire::https::No-Store",
216 _config
->FindB("Acquire::http::No-Store",false)) == true)
217 headers
= curl_slist_append(headers
,"Cache-Control: no-store");
219 ioprintf(ss
, "Cache-Control: max-age=%u", _config
->FindI("Acquire::https::Max-Age",
220 _config
->FindI("Acquire::http::Max-Age",0)));
221 headers
= curl_slist_append(headers
, ss
.str().c_str());
223 // cache disabled by user
224 headers
= curl_slist_append(headers
, "Cache-Control: no-cache");
225 headers
= curl_slist_append(headers
, "Pragma: no-cache");
227 curl_easy_setopt(curl
, CURLOPT_HTTPHEADER
, headers
);
230 int const dlLimit
= _config
->FindI("Acquire::https::Dl-Limit",
231 _config
->FindI("Acquire::http::Dl-Limit",0))*1024;
233 curl_easy_setopt(curl
, CURLOPT_MAX_RECV_SPEED_LARGE
, dlLimit
);
236 curl_easy_setopt(curl
, CURLOPT_USERAGENT
,
237 _config
->Find("Acquire::https::User-Agent",
238 _config
->Find("Acquire::http::User-Agent",
239 "Debian APT-CURL/1.0 (" PACKAGE_VERSION
")").c_str()).c_str());
242 int const timeout
= _config
->FindI("Acquire::https::Timeout",
243 _config
->FindI("Acquire::http::Timeout",120));
244 curl_easy_setopt(curl
, CURLOPT_CONNECTTIMEOUT
, timeout
);
245 //set really low lowspeed timeout (see #497983)
246 curl_easy_setopt(curl
, CURLOPT_LOW_SPEED_LIMIT
, DL_MIN_SPEED
);
247 curl_easy_setopt(curl
, CURLOPT_LOW_SPEED_TIME
, timeout
);
249 // set redirect options and default to 10 redirects
250 bool const AllowRedirect
= _config
->FindB("Acquire::https::AllowRedirect",
251 _config
->FindB("Acquire::http::AllowRedirect",true));
252 curl_easy_setopt(curl
, CURLOPT_FOLLOWLOCATION
, AllowRedirect
);
253 curl_easy_setopt(curl
, CURLOPT_MAXREDIRS
, 10);
256 if(_config
->FindB("Debug::Acquire::https", false))
257 curl_easy_setopt(curl
, CURLOPT_VERBOSE
, true);
260 curl_errorstr
[0] = '\0';
261 curl_easy_setopt(curl
, CURLOPT_ERRORBUFFER
, curl_errorstr
);
263 // If we ask for uncompressed files servers might respond with content-
264 // negotation which lets us end up with compressed files we do not support,
265 // see 657029, 657560 and co, so if we have no extension on the request
266 // ask for text only. As a sidenote: If there is nothing to negotate servers
267 // seem to be nice and ignore it.
268 if (_config
->FindB("Acquire::https::SendAccept", _config
->FindB("Acquire::http::SendAccept", true)) == true)
270 size_t const filepos
= Itm
->Uri
.find_last_of('/');
271 string
const file
= Itm
->Uri
.substr(filepos
+ 1);
272 if (flExtension(file
) == file
)
273 headers
= curl_slist_append(headers
, "Accept: text/*");
276 // if we have the file send an if-range query with a range header
277 if (stat(Itm
->DestFile
.c_str(),&SBuf
) >= 0 && SBuf
.st_size
> 0)
280 sprintf(Buf
, "Range: bytes=%li-", (long) SBuf
.st_size
- 1);
281 headers
= curl_slist_append(headers
, Buf
);
282 sprintf(Buf
, "If-Range: %s", TimeRFC1123(SBuf
.st_mtime
).c_str());
283 headers
= curl_slist_append(headers
, Buf
);
285 else if(Itm
->LastModified
> 0)
287 curl_easy_setopt(curl
, CURLOPT_TIMECONDITION
, CURL_TIMECOND_IFMODSINCE
);
288 curl_easy_setopt(curl
, CURLOPT_TIMEVALUE
, Itm
->LastModified
);
291 // go for it - if the file exists, append on it
292 File
= new FileFd(Itm
->DestFile
, FileFd::WriteAny
);
293 if (File
->Size() > 0)
294 File
->Seek(File
->Size() - 1);
297 Res
.Filename
= Itm
->DestFile
;
300 CURLcode success
= curl_easy_perform(curl
);
301 curl_easy_getinfo(curl
, CURLINFO_RESPONSE_CODE
, &curl_responsecode
);
304 curl_easy_getinfo(curl
, CURLINFO_FILETIME
, &curl_servdate
);
306 // If the server returns 200 OK but the If-Modified-Since condition is not
307 // met, CURLINFO_CONDITION_UNMET will be set to 1
308 long curl_condition_unmet
= 0;
309 curl_easy_getinfo(curl
, CURLINFO_CONDITION_UNMET
, &curl_condition_unmet
);
314 if(success
!= 0 || (curl_responsecode
!= 200 && curl_responsecode
!= 304))
316 _error
->Error("%s", curl_errorstr
);
317 // unlink, no need keep 401/404 page content in partial/
318 unlink(File
->Name().c_str());
325 if (curl_servdate
!= -1) {
326 UBuf
.actime
= curl_servdate
;
327 UBuf
.modtime
= curl_servdate
;
328 utime(File
->Name().c_str(),&UBuf
);
331 // check the downloaded result
333 if (stat(File
->Name().c_str(),&Buf
) == 0)
335 Res
.Filename
= File
->Name();
336 Res
.LastModified
= Buf
.st_mtime
;
338 if (curl_responsecode
== 304 || curl_condition_unmet
)
340 unlink(File
->Name().c_str());
342 Res
.LastModified
= Itm
->LastModified
;
347 Res
.Size
= Buf
.st_size
;
352 FileFd
Fd(Res
.Filename
, FileFd::ReadOnly
);
354 Res
.TakeHashes(Hash
);
362 curl_slist_free_all(headers
);
369 setlocale(LC_ALL
, "");
372 curl_global_init(CURL_GLOBAL_SSL
) ;