CMake: Install bash completions via cmake

[apt.git] / methods / https.cc

diff --git a/methods/https.cc b/methods/https.cc
index 16d564b34d79acc9608889cb7206850881bb42b4..283126f6b3e1a01f6fcc4e36edc544bed3fc530f 100644 (file)
--- a/methods/https.cc
+++ b/methods/https.cc
@@ -13,7 +13,6 @@
 #include <config.h>
 
 #include <apt-pkg/fileutl.h>
 #include <config.h>
 
 #include <apt-pkg/fileutl.h>

-#include <apt-pkg/acquire-method.h>

 #include <apt-pkg/error.h>
 #include <apt-pkg/hashes.h>
 #include <apt-pkg/netrc.h>
 #include <apt-pkg/error.h>
 #include <apt-pkg/hashes.h>
 #include <apt-pkg/netrc.h>


@@ -26,25 +25,36 @@
 #include <sys/time.h>
 #include <unistd.h>
 #include <stdio.h>
 #include <sys/time.h>
 #include <unistd.h>
 #include <stdio.h>

-#include <iostream>
-#include <sstream>

 #include <ctype.h>
 #include <stdlib.h>
 
 #include <ctype.h>
 #include <stdlib.h>
 

+#include <array>
+#include <iostream>
+#include <sstream>
+
+

 #include "https.h"
 
 #include <apti18n.h>
                                                                        /*}}}*/
 using namespace std;
 
 #include "https.h"
 
 #include <apti18n.h>
                                                                        /*}}}*/
 using namespace std;
 

+struct APT_HIDDEN CURLUserPointer {
+   HttpsMethod * const https;
+   HttpsMethod::FetchResult * const Res;
+   HttpsMethod::FetchItem const * const Itm;
+   CURLUserPointer(HttpsMethod * const https, HttpsMethod::FetchResult * const Res,
+        HttpsMethod::FetchItem const * const Itm) : https(https), Res(Res), Itm(Itm) {}
+};
+

 size_t
 HttpsMethod::parse_header(void *buffer, size_t size, size_t nmemb, void *userp)
 {
    size_t len = size * nmemb;
 size_t
 HttpsMethod::parse_header(void *buffer, size_t size, size_t nmemb, void *userp)
 {
    size_t len = size * nmemb;

-   HttpsMethod *me = (HttpsMethod *)userp;
+   CURLUserPointer *me = static_cast<CURLUserPointer *>(userp);

    std::string line((char*) buffer, len);
    for (--len; len > 0; --len)
    std::string line((char*) buffer, len);
    for (--len; len > 0; --len)

-      if (isspace(line[len]) == 0)
+      if (isspace_ascii(line[len]) == 0)

       {
         ++len;
         break;
       {
         ++len;
         break;


@@ -53,20 +63,55 @@ HttpsMethod::parse_header(void *buffer, size_t size, size_t nmemb, void *userp)
 
    if (line.empty() == true)
    {
 
    if (line.empty() == true)
    {

-      if (me->Server->Result != 416 && me->Server->StartPos != 0)
+      me->https->Server->JunkSize = 0;
+      if (me->https->Server->Result != 416 && me->https->Server->StartPos != 0)

         ;
         ;

-      else if (me->Server->Result == 416 && me->Server->Size == me->File->FileSize())
+      else if (me->https->Server->Result == 416)

       {
       {

-         me->Server->Result = 200;
-        me->Server->StartPos = me->Server->Size;
+        bool partialHit = false;
+        if (me->Itm->ExpectedHashes.usable() == true)
+        {
+           Hashes resultHashes(me->Itm->ExpectedHashes);
+           FileFd file(me->Itm->DestFile, FileFd::ReadOnly);
+           me->https->Server->TotalFileSize = file.FileSize();
+           me->https->Server->Date = file.ModificationTime();
+           resultHashes.AddFD(file);
+           HashStringList const hashList = resultHashes.GetHashStringList();
+           partialHit = (me->Itm->ExpectedHashes == hashList);
+        }
+        else if (me->https->Server->Result == 416 && me->https->Server->TotalFileSize == me->https->File->FileSize())
+           partialHit = true;
+
+        if (partialHit == true)
+        {
+           me->https->Server->Result = 200;
+           me->https->Server->StartPos = me->https->Server->TotalFileSize;
+           // the actual size is not important for https as curl will deal with it
+           // by itself and e.g. doesn't bother us with transport-encoding…
+           me->https->Server->JunkSize = std::numeric_limits<unsigned long long>::max();
+        }
+        else
+           me->https->Server->StartPos = 0;

       }
       else
       }
       else

-        me->Server->StartPos = 0;
+        me->https->Server->StartPos = 0;
+
+      me->Res->LastModified = me->https->Server->Date;
+      me->Res->Size = me->https->Server->TotalFileSize;
+      me->Res->ResumePoint = me->https->Server->StartPos;

 
 

-      me->File->Truncate(me->Server->StartPos);
-      me->File->Seek(me->Server->StartPos);
+      // we expect valid data, so tell our caller we get the file now
+      if (me->https->Server->Result >= 200 && me->https->Server->Result < 300)
+      {
+        if (me->Res->Size != 0 && me->Res->Size > me->Res->ResumePoint)
+           me->https->URIStart(*me->Res);
+        if (me->https->Server->AddPartialFileToHashes(*(me->https->File)) == false)
+           return 0;
+      }
+      else
+        me->https->Server->JunkSize = std::numeric_limits<decltype(me->https->Server->JunkSize)>::max();

    }
    }

-   else if (me->Server->HeaderLine(line) == false)
+   else if (me->https->Server->HeaderLine(line) == false)

       return 0;
 
    return size*nmemb;
       return 0;
 
    return size*nmemb;


@@ -75,42 +120,55 @@ HttpsMethod::parse_header(void *buffer, size_t size, size_t nmemb, void *userp)
 size_t 
 HttpsMethod::write_data(void *buffer, size_t size, size_t nmemb, void *userp)
 {
 size_t 
 HttpsMethod::write_data(void *buffer, size_t size, size_t nmemb, void *userp)
 {

-   HttpsMethod *me = (HttpsMethod *)userp;
-
-   if (me->Res.Size == 0)
-      me->URIStart(me->Res);
-   if(me->File->Write(buffer, size*nmemb) != true)
-      return false;
+   HttpsMethod *me = static_cast<HttpsMethod *>(userp);
+   size_t buffer_size = size * nmemb;
+   // we don't need to count the junk here, just drop anything we get as
+   // we don't always know how long it would be, e.g. in chunked encoding.
+   if (me->Server->JunkSize != 0)
+      return buffer_size;
+
+   if(me->File->Write(buffer, buffer_size) != true)
+      return 0;

 
 

-   if(me->Queue->MaximumSize > 0 && me->File->Tell() > me->Queue->MaximumSize)
+   if(me->Queue->MaximumSize > 0)

    {
    {

-      me->SetFailReason("MaximumSizeExceeded");
-      return _error->Error("Writing more data than expected (%llu > %llu)",
-                           me->TotalWritten, me->Queue->MaximumSize);
+      unsigned long long const TotalWritten = me->File->Tell();
+      if (TotalWritten > me->Queue->MaximumSize)
+      {
+        me->SetFailReason("MaximumSizeExceeded");
+        _error->Error("Writing more data than expected (%llu > %llu)",
+              TotalWritten, me->Queue->MaximumSize);
+        return 0;
+      }

    }
    }

-   return size*nmemb;
-}

 
 

-int
-HttpsMethod::progress_callback(void *clientp, double dltotal, double /*dlnow*/,
-                             double /*ultotal*/, double /*ulnow*/)
-{
-   HttpsMethod *me = (HttpsMethod *)clientp;
-   if(dltotal > 0 && me->Res.Size == 0) {
-      me->Res.Size = (unsigned long long)dltotal;
-   }
-   return 0;
+   if (me->Server->GetHashes()->Add((unsigned char const * const)buffer, buffer_size) == false)
+      return 0;
+
+   return buffer_size;

 }
 
 // HttpsServerState::HttpsServerState - Constructor                    /*{{{*/
 }
 
 // HttpsServerState::HttpsServerState - Constructor                    /*{{{*/

-HttpsServerState::HttpsServerState(URI Srv,HttpsMethod * /*Owner*/) : ServerState(Srv, NULL)
+HttpsServerState::HttpsServerState(URI Srv,HttpsMethod * Owner) : ServerState(Srv, Owner), Hash(NULL)

 {
 {

-   TimeOut = _config->FindI("Acquire::https::Timeout",TimeOut);
+   TimeOut = Owner->ConfigFindI("Timeout", TimeOut);

    Reset();
 }
                                                                        /*}}}*/
    Reset();
 }
                                                                        /*}}}*/

+bool HttpsServerState::InitHashes(HashStringList const &ExpectedHashes)        /*{{{*/
+{
+   delete Hash;
+   Hash = new Hashes(ExpectedHashes);
+   return true;
+}
+                                                                       /*}}}*/
+APT_PURE Hashes * HttpsServerState::GetHashes()                                /*{{{*/
+{
+   return Hash;
+}
+                                                                       /*}}}*/

 
 

-void HttpsMethod::SetupProxy()                                         /*{{{*/
+bool HttpsMethod::SetupProxy()                                         /*{{{*/

 {
    URI ServerName = Queue->Uri;
 
 {
    URI ServerName = Queue->Uri;
 


@@ -124,38 +182,52 @@ void HttpsMethod::SetupProxy()                                    /*{{{*/
    curl_easy_setopt(curl, CURLOPT_PROXY, "");
 
    // Determine the proxy setting - try https first, fallback to http and use env at last
    curl_easy_setopt(curl, CURLOPT_PROXY, "");
 
    // Determine the proxy setting - try https first, fallback to http and use env at last

-   string UseProxy = _config->Find("Acquire::https::Proxy::" + ServerName.Host,
-                                  _config->Find("Acquire::http::Proxy::" + ServerName.Host).c_str());
-
+   string UseProxy = ConfigFind("Proxy::" + ServerName.Host, "");

    if (UseProxy.empty() == true)
    if (UseProxy.empty() == true)

-      UseProxy = _config->Find("Acquire::https::Proxy", _config->Find("Acquire::http::Proxy").c_str());
-
-   // User want to use NO proxy, so nothing to setup
+      UseProxy = ConfigFind("Proxy", "");
+   // User wants to use NO proxy, so nothing to setup

    if (UseProxy == "DIRECT")
    if (UseProxy == "DIRECT")

-      return;
+      return true;

 
 

-   if (UseProxy.empty() == false) 
+   // Parse no_proxy, a comma (,) separated list of domains we don't want to use
+   // a proxy for so we stop right here if it is in the list
+   if (getenv("no_proxy") != 0 && CheckDomainList(ServerName.Host,getenv("no_proxy")) == true)
+      return true;
+
+   if (UseProxy.empty() == true)

    {
    {

-      // Parse no_proxy, a comma (,) separated list of domains we don't want to use
-      // a proxy for so we stop right here if it is in the list
-      if (getenv("no_proxy") != 0 && CheckDomainList(ServerName.Host,getenv("no_proxy")) == true)
-        return;
-   } else {
-      const char* result = getenv("https_proxy");
+      const char* result = nullptr;
+      if (std::find(methodNames.begin(), methodNames.end(), "https") != methodNames.end())
+        result = getenv("https_proxy");

       // FIXME: Fall back to http_proxy is to remain compatible with
       // existing setups and behaviour of apt.conf.  This should be
       // deprecated in the future (including apt.conf).  Most other
       // programs do not fall back to http proxy settings and neither
       // should Apt.
       // FIXME: Fall back to http_proxy is to remain compatible with
       // existing setups and behaviour of apt.conf.  This should be
       // deprecated in the future (including apt.conf).  Most other
       // programs do not fall back to http proxy settings and neither
       // should Apt.

-      if (result == NULL)
-         result = getenv("http_proxy");
-      UseProxy = result == NULL ? "" : result;
+      if (result == nullptr && std::find(methodNames.begin(), methodNames.end(), "http") != methodNames.end())
+        result = getenv("http_proxy");
+      UseProxy = result == nullptr ? "" : result;

    }
 
    // Determine what host and port to use based on the proxy settings
    }
 
    // Determine what host and port to use based on the proxy settings

-   if (UseProxy.empty() == false) 
+   if (UseProxy.empty() == false)

    {
       Proxy = UseProxy;
    {
       Proxy = UseProxy;

+      AddProxyAuth(Proxy, ServerName);
+
+      if (Proxy.Access == "socks5h")
+        curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5_HOSTNAME);
+      else if (Proxy.Access == "socks5")
+        curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
+      else if (Proxy.Access == "socks4a")
+        curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS4A);
+      else if (Proxy.Access == "socks")
+        curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS4);
+      else if (Proxy.Access == "http" || Proxy.Access == "https")
+        curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTP);
+      else
+        return false;
+

       if (Proxy.Port != 1)
         curl_easy_setopt(curl, CURLOPT_PROXYPORT, Proxy.Port);
       curl_easy_setopt(curl, CURLOPT_PROXY, Proxy.Host.c_str());
       if (Proxy.Port != 1)
         curl_easy_setopt(curl, CURLOPT_PROXYPORT, Proxy.Port);
       curl_easy_setopt(curl, CURLOPT_PROXY, Proxy.Host.c_str());


@@ -165,6 +237,7 @@ void HttpsMethod::SetupProxy()                                      /*{{{*/
          curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, Proxy.Password.c_str());
       }
    }
          curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, Proxy.Password.c_str());
       }
    }

+   return true;

 }                                                                      /*}}}*/
 // HttpsMethod::Fetch - Fetch an item                                  /*{{{*/
 // ---------------------------------------------------------------------
 }                                                                      /*}}}*/
 // HttpsMethod::Fetch - Fetch an item                                  /*{{{*/
 // ---------------------------------------------------------------------


@@ -173,146 +246,123 @@ void HttpsMethod::SetupProxy()                                          /*{{{*/
 bool HttpsMethod::Fetch(FetchItem *Itm)
 {
    struct stat SBuf;
 bool HttpsMethod::Fetch(FetchItem *Itm)
 {
    struct stat SBuf;

-   struct curl_slist *headers=NULL;  
+   struct curl_slist *headers=NULL;

    char curl_errorstr[CURL_ERROR_SIZE];
    URI Uri = Itm->Uri;
    char curl_errorstr[CURL_ERROR_SIZE];
    URI Uri = Itm->Uri;

-   string remotehost = Uri.Host;
+   setPostfixForMethodNames(Uri.Host.c_str());
+   AllowRedirect = ConfigFindB("AllowRedirect", true);
+   Debug = DebugEnabled();

 
    // TODO:
    //       - http::Pipeline-Depth
    //       - error checking/reporting
    //       - more debug options? (CURLOPT_DEBUGFUNCTION?)
 
    // TODO:
    //       - http::Pipeline-Depth
    //       - error checking/reporting
    //       - more debug options? (CURLOPT_DEBUGFUNCTION?)

+   {
+      auto const plus = Binary.find('+');
+      if (plus != std::string::npos)
+        Uri.Access = Binary.substr(plus + 1);
+   }

 
    curl_easy_reset(curl);
 
    curl_easy_reset(curl);

-   SetupProxy();
+   if (SetupProxy() == false)
+      return _error->Error("Unsupported proxy configured: %s", URI::SiteOnly(Proxy).c_str());

 
    maybe_add_auth (Uri, _config->FindFile("Dir::Etc::netrc"));
 
 
    maybe_add_auth (Uri, _config->FindFile("Dir::Etc::netrc"));
 

+   FetchResult Res;
+   CURLUserPointer userp(this, &Res, Itm);

    // callbacks
    curl_easy_setopt(curl, CURLOPT_URL, static_cast<string>(Uri).c_str());
    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, parse_header);
    // callbacks
    curl_easy_setopt(curl, CURLOPT_URL, static_cast<string>(Uri).c_str());
    curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, parse_header);

-   curl_easy_setopt(curl, CURLOPT_WRITEHEADER, this);
+   curl_easy_setopt(curl, CURLOPT_WRITEHEADER, &userp);

    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, this);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, this);

-   curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);
-   curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, this);

    // options
    // options

-   curl_easy_setopt(curl, CURLOPT_NOPROGRESS, false);
+   curl_easy_setopt(curl, CURLOPT_NOPROGRESS, true);

    curl_easy_setopt(curl, CURLOPT_FILETIME, true);
    curl_easy_setopt(curl, CURLOPT_FILETIME, true);

-   // only allow curl to handle https, not the other stuff it supports
-   curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
-   curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS);
-
-   // SSL parameters are set by default to the common (non mirror-specific) value
-   // if available (or a default one) and gets overload by mirror-specific ones.
-
-   // File containing the list of trusted CA.
-   string cainfo = _config->Find("Acquire::https::CaInfo","");
-   string knob = "Acquire::https::"+remotehost+"::CaInfo";
-   cainfo = _config->Find(knob.c_str(),cainfo.c_str());
-   if(cainfo.empty() == false)
-      curl_easy_setopt(curl, CURLOPT_CAINFO,cainfo.c_str());
-
-   // Check server certificate against previous CA list ...
-   bool peer_verify = _config->FindB("Acquire::https::Verify-Peer",true);
-   knob = "Acquire::https::" + remotehost + "::Verify-Peer";
-   peer_verify = _config->FindB(knob.c_str(), peer_verify);
-   curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, peer_verify);
-
-   // ... and hostname against cert CN or subjectAltName
-   bool verify = _config->FindB("Acquire::https::Verify-Host",true);
-   knob = "Acquire::https::"+remotehost+"::Verify-Host";
-   verify = _config->FindB(knob.c_str(),verify);
-   int const default_verify = (verify == true) ? 2 : 0;
-   curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, default_verify);
-
-   // Also enforce issuer of server certificate using its cert
-   string issuercert = _config->Find("Acquire::https::IssuerCert","");
-   knob = "Acquire::https::"+remotehost+"::IssuerCert";
-   issuercert = _config->Find(knob.c_str(),issuercert.c_str());
-   if(issuercert.empty() == false)
-      curl_easy_setopt(curl, CURLOPT_ISSUERCERT,issuercert.c_str());
-
-   // For client authentication, certificate file ...
-   string pem = _config->Find("Acquire::https::SslCert","");
-   knob = "Acquire::https::"+remotehost+"::SslCert";
-   pem = _config->Find(knob.c_str(),pem.c_str());
-   if(pem.empty() == false)
-      curl_easy_setopt(curl, CURLOPT_SSLCERT, pem.c_str());
-
-   // ... and associated key.
-   string key = _config->Find("Acquire::https::SslKey","");
-   knob = "Acquire::https::"+remotehost+"::SslKey";
-   key = _config->Find(knob.c_str(),key.c_str());
-   if(key.empty() == false)
-      curl_easy_setopt(curl, CURLOPT_SSLKEY, key.c_str());
-
-   // Allow forcing SSL version to SSLv3 or TLSv1 (SSLv2 is not
-   // supported by GnuTLS).
-   long final_version = CURL_SSLVERSION_DEFAULT;
-   string sslversion = _config->Find("Acquire::https::SslForceVersion","");
-   knob = "Acquire::https::"+remotehost+"::SslForceVersion";
-   sslversion = _config->Find(knob.c_str(),sslversion.c_str());
-   if(sslversion == "TLSv1")
-     final_version = CURL_SSLVERSION_TLSv1;
-   else if(sslversion == "SSLv3")
-     final_version = CURL_SSLVERSION_SSLv3;
-   curl_easy_setopt(curl, CURLOPT_SSLVERSION, final_version);
-
-   // CRL file
-   string crlfile = _config->Find("Acquire::https::CrlFile","");
-   knob = "Acquire::https::"+remotehost+"::CrlFile";
-   crlfile = _config->Find(knob.c_str(),crlfile.c_str());
-   if(crlfile.empty() == false)
-      curl_easy_setopt(curl, CURLOPT_CRLFILE, crlfile.c_str());
+   curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 0);

 
 

+   if (std::find(methodNames.begin(), methodNames.end(), "https") != methodNames.end())
+   {
+      curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
+      curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS);
+
+      // File containing the list of trusted CA.
+      std::string const cainfo = ConfigFind("CaInfo", "");
+      if(cainfo.empty() == false)
+        curl_easy_setopt(curl, CURLOPT_CAINFO, cainfo.c_str());
+      // Check server certificate against previous CA list ...
+      curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, ConfigFindB("Verify-Peer", true) ? 1 : 0);
+      // ... and hostname against cert CN or subjectAltName
+      curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, ConfigFindB("Verify-Host", true) ? 2 : 0);
+      // Also enforce issuer of server certificate using its cert
+      std::string const issuercert = ConfigFind("IssuerCert", "");
+      if(issuercert.empty() == false)
+        curl_easy_setopt(curl, CURLOPT_ISSUERCERT, issuercert.c_str());
+      // For client authentication, certificate file ...
+      std::string const pem = ConfigFind("SslCert", "");
+      if(pem.empty() == false)
+        curl_easy_setopt(curl, CURLOPT_SSLCERT, pem.c_str());
+      // ... and associated key.
+      std::string const key = ConfigFind("SslKey", "");
+      if(key.empty() == false)
+        curl_easy_setopt(curl, CURLOPT_SSLKEY, key.c_str());
+      // Allow forcing SSL version to SSLv3 or TLSv1
+      long final_version = CURL_SSLVERSION_DEFAULT;
+      std::string const sslversion = ConfigFind("SslForceVersion", "");
+      if(sslversion == "TLSv1")
+        final_version = CURL_SSLVERSION_TLSv1;
+      else if(sslversion == "TLSv1.0")
+        final_version = CURL_SSLVERSION_TLSv1_0;
+      else if(sslversion == "TLSv1.1")
+        final_version = CURL_SSLVERSION_TLSv1_1;
+      else if(sslversion == "TLSv1.2")
+        final_version = CURL_SSLVERSION_TLSv1_2;
+      else if(sslversion == "SSLv3")
+        final_version = CURL_SSLVERSION_SSLv3;
+      curl_easy_setopt(curl, CURLOPT_SSLVERSION, final_version);
+      // CRL file
+      std::string const crlfile = ConfigFind("CrlFile", "");
+      if(crlfile.empty() == false)
+        curl_easy_setopt(curl, CURLOPT_CRLFILE, crlfile.c_str());
+   }
+   else
+   {
+      curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTP);
+      curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP);
+   }

    // cache-control
    // cache-control

-   if(_config->FindB("Acquire::https::No-Cache",
-       _config->FindB("Acquire::http::No-Cache",false)) == false)
+   if(ConfigFindB("No-Cache", false) == false)

    {
       // cache enabled
    {
       // cache enabled

-      if (_config->FindB("Acquire::https::No-Store",
-               _config->FindB("Acquire::http::No-Store",false)) == true)
+      if (ConfigFindB("No-Store", false) == true)

         headers = curl_slist_append(headers,"Cache-Control: no-store");
         headers = curl_slist_append(headers,"Cache-Control: no-store");

-      stringstream ss;
-      ioprintf(ss, "Cache-Control: max-age=%u", _config->FindI("Acquire::https::Max-Age",
-               _config->FindI("Acquire::http::Max-Age",0)));
-      headers = curl_slist_append(headers, ss.str().c_str());
+      std::string ss;
+      strprintf(ss, "Cache-Control: max-age=%u", ConfigFindI("Max-Age", 0));
+      headers = curl_slist_append(headers, ss.c_str());

    } else {
       // cache disabled by user
       headers = curl_slist_append(headers, "Cache-Control: no-cache");
       headers = curl_slist_append(headers, "Pragma: no-cache");
    }
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
    } else {
       // cache disabled by user
       headers = curl_slist_append(headers, "Cache-Control: no-cache");
       headers = curl_slist_append(headers, "Pragma: no-cache");
    }
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);

-

    // speed limit
    // speed limit

-   int const dlLimit = _config->FindI("Acquire::https::Dl-Limit",
-               _config->FindI("Acquire::http::Dl-Limit",0))*1024;
+   int const dlLimit = ConfigFindI("Dl-Limit", 0) * 1024;

    if (dlLimit > 0)
       curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, dlLimit);
 
    // set header
    if (dlLimit > 0)
       curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, dlLimit);
 
    // set header

-   curl_easy_setopt(curl, CURLOPT_USERAGENT,
-       _config->Find("Acquire::https::User-Agent",
-               _config->Find("Acquire::http::User-Agent",
-                       "Debian APT-CURL/1.0 (" PACKAGE_VERSION ")").c_str()).c_str());
+   curl_easy_setopt(curl, CURLOPT_USERAGENT, ConfigFind("User-Agent", "Debian APT-CURL/1.0 (" PACKAGE_VERSION ")").c_str());

 
    // set timeout
 
    // set timeout

-   int const timeout = _config->FindI("Acquire::https::Timeout",
-               _config->FindI("Acquire::http::Timeout",120));
+   int const timeout = ConfigFindI("Timeout", 120);

    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, timeout);
    //set really low lowspeed timeout (see #497983)
    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, DL_MIN_SPEED);
    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, timeout);
 
    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, timeout);
    //set really low lowspeed timeout (see #497983)
    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, DL_MIN_SPEED);
    curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, timeout);
 

-   // set redirect options and default to 10 redirects
-   bool const AllowRedirect = _config->FindB("Acquire::https::AllowRedirect",
-       _config->FindB("Acquire::http::AllowRedirect",true));
-   curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, AllowRedirect);
-   curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 10);
-

    // debug
    // debug

-   if(_config->FindB("Debug::Acquire::https", false))
+   if (Debug == true)

       curl_easy_setopt(curl, CURLOPT_VERBOSE, true);
 
    // error handling
       curl_easy_setopt(curl, CURLOPT_VERBOSE, true);
 
    // error handling


@@ -324,7 +374,7 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
    // see 657029, 657560 and co, so if we have no extension on the request
    // ask for text only. As a sidenote: If there is nothing to negotate servers
    // seem to be nice and ignore it.
    // see 657029, 657560 and co, so if we have no extension on the request
    // ask for text only. As a sidenote: If there is nothing to negotate servers
    // seem to be nice and ignore it.

-   if (_config->FindB("Acquire::https::SendAccept", _config->FindB("Acquire::http::SendAccept", true)) == true)
+   if (ConfigFindB("SendAccept", true))

    {
       size_t const filepos = Itm->Uri.find_last_of('/');
       string const file = Itm->Uri.substr(filepos + 1);
    {
       size_t const filepos = Itm->Uri.find_last_of('/');
       string const file = Itm->Uri.substr(filepos + 1);


@@ -338,7 +388,7 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
       std::string Buf;
       strprintf(Buf, "Range: bytes=%lli-", (long long) SBuf.st_size);
       headers = curl_slist_append(headers, Buf.c_str());
       std::string Buf;
       strprintf(Buf, "Range: bytes=%lli-", (long long) SBuf.st_size);
       headers = curl_slist_append(headers, Buf.c_str());

-      strprintf(Buf, "If-Range: %s", TimeRFC1123(SBuf.st_mtime).c_str());
+      strprintf(Buf, "If-Range: %s", TimeRFC1123(SBuf.st_mtime, false).c_str());

       headers = curl_slist_append(headers, Buf.c_str());
    }
    else if(Itm->LastModified > 0)
       headers = curl_slist_append(headers, Buf.c_str());
    }
    else if(Itm->LastModified > 0)


@@ -349,7 +399,9 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
 
    // go for it - if the file exists, append on it
    File = new FileFd(Itm->DestFile, FileFd::WriteAny);
 
    // go for it - if the file exists, append on it
    File = new FileFd(Itm->DestFile, FileFd::WriteAny);

-   Server = new HttpsServerState(Itm->Uri, this);
+   Server = CreateServerState(Itm->Uri);
+   if (Server->InitHashes(Itm->ExpectedHashes) == false)
+      return false;

 
    // keep apt updated
    Res.Filename = Itm->DestFile;
 
    // keep apt updated
    Res.Filename = Itm->DestFile;


@@ -361,99 +413,125 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
    // met, CURLINFO_CONDITION_UNMET will be set to 1
    long curl_condition_unmet = 0;
    curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &curl_condition_unmet);
    // met, CURLINFO_CONDITION_UNMET will be set to 1
    long curl_condition_unmet = 0;
    curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &curl_condition_unmet);

+   if (curl_condition_unmet == 1)
+      Server->Result = 304;

 
    File->Close();
    curl_slist_free_all(headers);
 
    // cleanup
 
    File->Close();
    curl_slist_free_all(headers);
 
    // cleanup

-   if (success != 0)
+   if (success != CURLE_OK)

    {
    {

-      _error->Error("%s", curl_errorstr);
-      unlink(File->Name().c_str());
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch"
+      switch (success)
+      {
+        case CURLE_COULDNT_RESOLVE_PROXY:
+        case CURLE_COULDNT_RESOLVE_HOST:
+           SetFailReason("ResolveFailure");
+           break;
+        case CURLE_COULDNT_CONNECT:
+           SetFailReason("ConnectionRefused");
+           break;
+        case CURLE_OPERATION_TIMEDOUT:
+           SetFailReason("Timeout");
+           break;
+      }
+#pragma GCC diagnostic pop
+      // only take curls technical errors if we haven't our own
+      // (e.g. for the maximum size limit we have and curls can be confusing)
+      if (_error->PendingError() == false)
+        _error->Error("%s", curl_errorstr);
+      else
+        _error->Warning("curl: %s", curl_errorstr);

       return false;
    }
 
       return false;
    }
 

-   // server says file not modified
-   if (Server->Result == 304 || curl_condition_unmet == 1)
+   switch (DealWithHeaders(Res))

    {
    {

-      unlink(File->Name().c_str());
-      Res.IMSHit = true;
-      Res.LastModified = Itm->LastModified;
-      Res.Size = 0;
-      URIDone(Res);
-      return true;
-   }
-   Res.IMSHit = false;
+      case ServerMethod::IMS_HIT:
+        URIDone(Res);
+        break;

 
 

-   if (Server->Result != 200 && // OK
-        Server->Result != 206 && // Partial
-        Server->Result != 416) // invalid Range
-   {
-      char err[255];
-      snprintf(err, sizeof(err) - 1, "HttpError%i", Server->Result);
-      SetFailReason(err);
-      _error->Error("%s", err);
-      // unlink, no need keep 401/404 page content in partial/
-      unlink(File->Name().c_str());
-      return false;
-   }
+      case ServerMethod::ERROR_WITH_CONTENT_PAGE:
+        // unlink, no need keep 401/404 page content in partial/
+        RemoveFile(Binary.c_str(), File->Name());
+      case ServerMethod::ERROR_UNRECOVERABLE:
+      case ServerMethod::ERROR_NOT_FROM_SERVER:
+        return false;

 
 

-   struct stat resultStat;
-   if (unlikely(stat(File->Name().c_str(), &resultStat) != 0))
-   {
-      _error->Errno("stat", "Unable to access file %s", File->Name().c_str());
-      return false;
-   }
-   Res.Size = resultStat.st_size;
+      case ServerMethod::TRY_AGAIN_OR_REDIRECT:
+        Redirect(NextURI);
+        break;

 
 

-   // invalid range-request
-   if (Server->Result == 416)
-   {
-      unlink(File->Name().c_str());
-      Res.Size = 0;
-      delete File;
-      Redirect(Itm->Uri);
-      return true;
+      case ServerMethod::FILE_IS_OPEN:
+        struct stat resultStat;
+        if (unlikely(stat(File->Name().c_str(), &resultStat) != 0))
+        {
+           _error->Errno("stat", "Unable to access file %s", File->Name().c_str());
+           return false;
+        }
+        Res.Size = resultStat.st_size;
+
+        // Timestamp
+        curl_easy_getinfo(curl, CURLINFO_FILETIME, &Res.LastModified);
+        if (Res.LastModified != -1)
+        {
+           struct timeval times[2];
+           times[0].tv_sec = Res.LastModified;
+           times[1].tv_sec = Res.LastModified;
+           times[0].tv_usec = times[1].tv_usec = 0;
+           utimes(File->Name().c_str(), times);
+        }
+        else
+           Res.LastModified = resultStat.st_mtime;
+
+        // take hashes
+        Res.TakeHashes(*(Server->GetHashes()));
+
+        // keep apt updated
+        URIDone(Res);
+        break;

    }
 
    }
 

-   // Timestamp
-   curl_easy_getinfo(curl, CURLINFO_FILETIME, &Res.LastModified);
-   if (Res.LastModified != -1)
+   delete File;
+   return true;
+}
+                                                                       /*}}}*/
+std::unique_ptr<ServerState> HttpsMethod::CreateServerState(URI const &uri)/*{{{*/
+{
+   return std::unique_ptr<ServerState>(new HttpsServerState(uri, this));
+}
+                                                                       /*}}}*/
+HttpsMethod::HttpsMethod(std::string &&pProg) : ServerMethod(std::move(pProg),"1.2",Pipeline | SendConfig)/*{{{*/
+{
+   auto addName = std::inserter(methodNames, methodNames.begin());
+   addName = "http";
+   auto const plus = Binary.find('+');
+   if (plus != std::string::npos)

    {
    {

-      struct timeval times[2];
-      times[0].tv_sec = Res.LastModified;
-      times[1].tv_sec = Res.LastModified;
-      times[0].tv_usec = times[1].tv_usec = 0;
-      utimes(File->Name().c_str(), times);
+      addName = Binary.substr(plus + 1);
+      auto base = Binary.substr(0, plus);
+      if (base != "https")
+        addName = base;

    }
    }

+   if (std::find(methodNames.begin(), methodNames.end(), "https") != methodNames.end())
+      curl_global_init(CURL_GLOBAL_SSL);

    else
    else

-      Res.LastModified = resultStat.st_mtime;
-
-   // take hashes
-   Hashes Hash;
-   FileFd Fd(Res.Filename, FileFd::ReadOnly);
-   Hash.AddFD(Fd);
-   Res.TakeHashes(Hash);
-
-   // keep apt updated
-   URIDone(Res);
-
-   // cleanup
-   Res.Size = 0;
-   delete File;
-
-   return true;
+      curl_global_init(CURL_GLOBAL_NOTHING);
+   curl = curl_easy_init();

 }
 }

-
-int main()
+                                                                       /*}}}*/
+HttpsMethod::~HttpsMethod()                                            /*{{{*/

 {
 {

-   setlocale(LC_ALL, "");
-
-   HttpsMethod Mth;
-   curl_global_init(CURL_GLOBAL_SSL) ;
-
-   Mth.DropPrivsOrDie();
-
-   return Mth.Run();
+   curl_easy_cleanup(curl);

 }
 }

-
+                                                                       /*}}}*/
+int main(int, const char *argv[])                                      /*{{{*/
+{
+   std::string Binary = flNotDir(argv[0]);
+   if (Binary.find('+') == std::string::npos && Binary != "https")
+      Binary.append("+https");
+   return HttpsMethod(std::move(Binary)).Run();
+}
+                                                                       /*}}}*/