add a testcase to check for forbidden https→http downgrades

[apt.git] / methods / https.cc

diff --git a/methods/https.cc b/methods/https.cc
index 2a562434b42dab471ae732be2e045a607a6b1957..e713be19fdc5b5c8bb68003df7d1ee2d8b86175b 100644 (file)
--- a/methods/https.cc
+++ b/methods/https.cc
@@ -21,7 +21,6 @@
 
 #include <sys/stat.h>
 #include <sys/time.h>
-#include <utime.h>
 #include <unistd.h>
 #include <signal.h>
 #include <stdio.h>
@@ -76,6 +75,8 @@ HttpsMethod::write_data(void *buffer, size_t size, size_t nmemb, void *userp)
 {
    HttpsMethod *me = (HttpsMethod *)userp;
 
+   if (me->Res.Size == 0)
+      me->URIStart(me->Res);
    if(me->File->Write(buffer, size*nmemb) != true)
       return false;
 
@@ -89,7 +90,6 @@ HttpsMethod::progress_callback(void *clientp, double dltotal, double dlnow,
    HttpsMethod *me = (HttpsMethod *)clientp;
    if(dltotal > 0 && me->Res.Size == 0) {
       me->Res.Size = (unsigned long long)dltotal;
-      me->URIStart(me->Res);
    }
    return 0;
 }
@@ -185,8 +185,12 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, this);
    curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, this);
+   // options
    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, false);
    curl_easy_setopt(curl, CURLOPT_FILETIME, true);
+   // only allow curl to handle https, not the other stuff it supports
+   curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
+   curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS);
 
    // SSL parameters are set by default to the common (non mirror-specific) value
    // if available (or a default one) and gets overload by mirror-specific ones.
@@ -405,10 +409,11 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
    curl_easy_getinfo(curl, CURLINFO_FILETIME, &Res.LastModified);
    if (Res.LastModified != -1)
    {
-      struct utimbuf UBuf;
-      UBuf.actime = Res.LastModified;
-      UBuf.modtime = Res.LastModified;
-      utime(File->Name().c_str(),&UBuf);
+      struct timeval times[2];
+      times[0].tv_sec = Res.LastModified;
+      times[1].tv_sec = Res.LastModified;
+      times[0].tv_usec = times[1].tv_usec = 0;
+      utimes(File->Name().c_str(), times);
    }
    else
       Res.LastModified = resultStat.st_mtime;