X-Git-Url: https://git.saurik.com/apt.git/blobdiff_plain/73ee6a4a17288656be679e84d0de28bbbc67c96e..7cafe70555740bd0acbf0b8d2193b95423e7436b:/methods/connect.cc diff --git a/methods/connect.cc b/methods/connect.cc index 2f6b4833e..f6fb14769 100644 --- a/methods/connect.cc +++ b/methods/connect.cc @@ -11,14 +11,20 @@ ##################################################################### */ /*}}}*/ // Include Files /*{{{*/ -#include "connect.h" +#include + #include #include +#include +#include +#include +#include #include #include #include - +#include +#include #include #include @@ -28,17 +34,20 @@ #include #include +#include "connect.h" #include "rfc2553emu.h" #include /*}}}*/ -static string LastHost; +static std::string LastHost; static int LastPort = 0; static struct addrinfo *LastHostAddr = 0; static struct addrinfo *LastUsed = 0; +static std::vector SrvRecords; + // Set of IP/hostnames that we timed out before or couldn't resolve -static std::set bad_addr; +static std::set bad_addr; // RotateDNS - Select a new server from a DNS rotation /*{{{*/ // --------------------------------------------------------------------- @@ -52,10 +61,25 @@ void RotateDNS() LastUsed = LastHostAddr; } /*}}}*/ +static bool ConnectionAllowed(char const * const Service, std::string const &Host)/*{{{*/ +{ + if (unlikely(Host.empty())) // the only legal empty host (RFC2782 '.' target) is detected by caller + return false; + if (APT::String::Endswith(Host, ".onion") && _config->FindB("Acquire::BlockDotOnion", true)) + { + // TRANSLATOR: %s is e.g. Tor's ".onion" which would likely fail or leak info (RFC7686) + _error->Error(_("Direct connection to %s domains is blocked by default."), ".onion"); + if (strcmp(Service, "http") == 0) + _error->Error(_("If you meant to use Tor remember to use %s instead of %s."), "tor+http", "http"); + return false; + } + return true; +} + /*}}}*/ // DoConnect - Attempt a connect operation /*{{{*/ // --------------------------------------------------------------------- /* This helper function attempts a connection to a single address. */ -static bool DoConnect(struct addrinfo *Addr,string Host, +static bool DoConnect(struct addrinfo *Addr,std::string const &Host, unsigned long TimeOut,int &Fd,pkgAcqMethod *Owner) { // Show a status indicator @@ -70,19 +94,17 @@ static bool DoConnect(struct addrinfo *Addr,string Host, Owner->Status(_("Connecting to %s (%s)"),Host.c_str(),Name); // if that addr did timeout before, we do not try it again - if(bad_addr.find(string(Name)) != bad_addr.end()) + if(bad_addr.find(std::string(Name)) != bad_addr.end()) return false; /* If this is an IP rotation store the IP we are using.. If something goes wrong this will get tacked onto the end of the error message */ if (LastHostAddr->ai_next != 0) { - char Name2[NI_MAXHOST + NI_MAXSERV + 10]; - snprintf(Name2,sizeof(Name2),_("[IP: %s %s]"),Name,Service); - Owner->SetFailExtraMsg(string(Name2)); - } - else - Owner->SetFailExtraMsg(""); + std::stringstream ss; + ioprintf(ss, _("[IP: %s %s]"),Name,Service); + Owner->SetIP(ss.str()); + } // Get a socket if ((Fd = socket(Addr->ai_family,Addr->ai_socktype, @@ -99,8 +121,8 @@ static bool DoConnect(struct addrinfo *Addr,string Host, /* This implements a timeout for connect by opening the connection nonblocking */ if (WaitFd(Fd,true,TimeOut) == false) { - bad_addr.insert(bad_addr.begin(), string(Name)); - Owner->SetFailExtraMsg("\nFailReason: Timeout"); + bad_addr.insert(bad_addr.begin(), std::string(Name)); + Owner->SetFailReason("Timeout"); return _error->Error(_("Could not connect to %s:%s (%s), " "connection timed out"),Host.c_str(),Service,Name); } @@ -115,10 +137,10 @@ static bool DoConnect(struct addrinfo *Addr,string Host, { errno = Err; if(errno == ECONNREFUSED) - Owner->SetFailExtraMsg("\nFailReason: ConnectionRefused"); + Owner->SetFailReason("ConnectionRefused"); else if (errno == ETIMEDOUT) - Owner->SetFailExtraMsg("\nFailReason: ConnectionTimedOut"); - bad_addr.insert(bad_addr.begin(), string(Name)); + Owner->SetFailReason("ConnectionTimedOut"); + bad_addr.insert(bad_addr.begin(), std::string(Name)); return _error->Errno("connect",_("Could not connect to %s:%s (%s)."),Host.c_str(), Service,Name); } @@ -126,21 +148,19 @@ static bool DoConnect(struct addrinfo *Addr,string Host, return true; } /*}}}*/ -// Connect - Connect to a server /*{{{*/ -// --------------------------------------------------------------------- -/* Performs a connection to the server */ -bool Connect(string Host,int Port,const char *Service,int DefPort,int &Fd, - unsigned long TimeOut,pkgAcqMethod *Owner) +// Connect to a given Hostname /*{{{*/ +static bool ConnectToHostname(std::string const &Host, int const Port, + const char * const Service, int DefPort, int &Fd, + unsigned long const TimeOut, pkgAcqMethod * const Owner) { - if (_error->PendingError() == true) + if (ConnectionAllowed(Service, Host) == false) return false; - // Convert the port name/number char ServStr[300]; if (Port != 0) - snprintf(ServStr,sizeof(ServStr),"%u",Port); + snprintf(ServStr,sizeof(ServStr),"%i", Port); else - snprintf(ServStr,sizeof(ServStr),"%s",Service); + snprintf(ServStr,sizeof(ServStr),"%s", Service); /* We used a cached address record.. Yes this is against the spec but the way we have setup our rotating dns suggests that this is more @@ -161,9 +181,25 @@ bool Connect(string Host,int Port,const char *Service,int DefPort,int &Fd, struct addrinfo Hints; memset(&Hints,0,sizeof(Hints)); Hints.ai_socktype = SOCK_STREAM; - Hints.ai_flags = AI_ADDRCONFIG; + Hints.ai_flags = 0; +#ifdef AI_IDN + if (_config->FindB("Acquire::Connect::IDN", true) == true) + Hints.ai_flags |= AI_IDN; +#endif + // see getaddrinfo(3): only return address if system has such a address configured + // useful if system is ipv4 only, to not get ipv6, but that fails if the system has + // no address configured: e.g. offline and trying to connect to localhost. + if (_config->FindB("Acquire::Connect::AddrConfig", true) == true) + Hints.ai_flags |= AI_ADDRCONFIG; Hints.ai_protocol = 0; + if(_config->FindB("Acquire::ForceIPv4", false) == true) + Hints.ai_family = AF_INET; + else if(_config->FindB("Acquire::ForceIPv6", false) == true) + Hints.ai_family = AF_INET6; + else + Hints.ai_family = AF_UNSPEC; + // if we couldn't resolve the host before, we don't try now if(bad_addr.find(Host) != bad_addr.end()) return _error->Error(_("Could not resolve '%s'"),Host.c_str()); @@ -179,21 +215,24 @@ bool Connect(string Host,int Port,const char *Service,int DefPort,int &Fd, { if (DefPort != 0) { - snprintf(ServStr,sizeof(ServStr),"%u",DefPort); + snprintf(ServStr, sizeof(ServStr), "%i", DefPort); DefPort = 0; continue; } bad_addr.insert(bad_addr.begin(), Host); - Owner->SetFailExtraMsg("\nFailReason: ResolveFailure"); + Owner->SetFailReason("ResolveFailure"); return _error->Error(_("Could not resolve '%s'"),Host.c_str()); } if (Res == EAI_AGAIN) { - Owner->SetFailExtraMsg("\nFailReason: TmpResolveFailure"); + Owner->SetFailReason("TmpResolveFailure"); return _error->Error(_("Temporary failure resolving '%s'"), Host.c_str()); } + if (Res == EAI_SYSTEM) + return _error->Errno("getaddrinfo", _("System error resolving '%s:%s'"), + Host.c_str(),ServStr); return _error->Error(_("Something wicked happened resolving '%s:%s' (%i - %s)"), Host.c_str(),ServStr,Res,gai_strerror(Res)); } @@ -244,3 +283,60 @@ bool Connect(string Host,int Port,const char *Service,int DefPort,int &Fd, return _error->Error(_("Unable to connect to %s:%s:"),Host.c_str(),ServStr); } /*}}}*/ +// Connect - Connect to a server /*{{{*/ +// --------------------------------------------------------------------- +/* Performs a connection to the server (including SRV record lookup) */ +bool Connect(std::string Host,int Port,const char *Service, + int DefPort,int &Fd, + unsigned long TimeOut,pkgAcqMethod *Owner) +{ + if (_error->PendingError() == true) + return false; + + if (ConnectionAllowed(Service, Host) == false) + return false; + + if(LastHost != Host || LastPort != Port) + { + SrvRecords.clear(); + if (_config->FindB("Acquire::EnableSrvRecords", true) == true) + { + GetSrvRecords(Host, DefPort, SrvRecords); + // RFC2782 defines that a lonely '.' target is an abort reason + if (SrvRecords.size() == 1 && SrvRecords[0].target.empty()) + return _error->Error("SRV records for %s indicate that " + "%s service is not available at this domain", Host.c_str(), Service); + } + } + + size_t stackSize = 0; + // try to connect in the priority order of the srv records + std::string initialHost{std::move(Host)}; + while(SrvRecords.empty() == false) + { + _error->PushToStack(); + ++stackSize; + // PopFromSrvRecs will also remove the server + Host = PopFromSrvRecs(SrvRecords).target; + auto const ret = ConnectToHostname(Host, Port, Service, DefPort, Fd, TimeOut, Owner); + if (ret) + { + while(stackSize--) + _error->RevertToStack(); + return true; + } + } + Host = std::move(initialHost); + + // we have no (good) SrvRecords for this host, connect right away + _error->PushToStack(); + ++stackSize; + auto const ret = ConnectToHostname(Host, Port, Service, DefPort, Fd, + TimeOut, Owner); + while(stackSize--) + if (ret) + _error->RevertToStack(); + else + _error->MergeWithStack(); + return ret; +}