libopkg/opkg_download.c

   1 /* vi: set noexpandtab sw=4 sts=4: */
   2 /* opkg_download.c - the opkg package management system
   3
   4    Carl D. Worth
   5
   6    Copyright (C) 2001 University of Southern California
   7    Copyright (C) 2008 OpenMoko Inc
   8
   9    This program is free software; you can redistribute it and/or
  10    modify it under the terms of the GNU General Public License as
  11    published by the Free Software Foundation; either version 2, or (at
  12    your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful, but
  15    WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17    General Public License for more details.
  18 */
  19
  20 #include <sys/wait.h>
  21 #include <stdio.h>
  22 #include <unistd.h>
  23 #include <libgen.h>
  24
  25 #include "opkg_download.h"
  26 #include "opkg_message.h"
  27
  28 #include "sprintf_alloc.h"
  29 #include "xsystem.h"
  30 #include "file_util.h"
  31 #include "opkg_defines.h"
  32 #include "libbb/libbb.h"
  33
  34 #ifdef HAVE_CURL
  35 #include <curl/curl.h>
  36 #endif
  37
  38 #if defined(HAVE_SSLCURL) || defined(HAVE_OPENSSL)
  39 #include <openssl/conf.h>
  40 #include <openssl/evp.h>
  41 #include <openssl/err.h>
  42 #include <openssl/ssl.h>
  43 #endif
  44
  45 #if defined(HAVE_OPENSSL)
  46 #include <openssl/bio.h>
  47 #include <openssl/objects.h>
  48 #include <openssl/x509.h>
  49 #include <openssl/pem.h>
  50 #include <openssl/hmac.h>
  51 #endif
  52
  53 #if defined(HAVE_OPENSSL) || defined(HAVE_SSLCURL)
  54 static void openssl_init(void);
  55 #endif
  56
  57 #ifdef HAVE_OPENSSL
  58 static X509_STORE *setup_verify(char *CAfile, char *CApath);
  59 #endif
  60
  61 #ifdef HAVE_CURL
  62 /*
  63  * Make curl an instance variable so we don't have to instanciate it
  64  * each time
  65  */
  66 static CURL *curl = NULL;
  67 static CURL *opkg_curl_init(curl_progress_func cb, void *data);
  68 #endif
  69
  70 static int str_starts_with(const char *str, const char *prefix)
  71 {
  72         return (strncmp(str, prefix, strlen(prefix)) == 0);
  73 }
  74
  75 int
  76 opkg_download(const char *src, const char *dest_file_name,
  77               curl_progress_func cb, void *data, const short hide_error)
  78 {
  79         int err = 0;
  80
  81         char *src_basec = xstrdup(src);
  82         char *src_base = basename(src_basec);
  83         char *tmp_file_location;
  84
  85         opkg_msg(NOTICE, "Downloading %s\n", src);
  86
  87         if (str_starts_with(src, "file:")) {
  88                 const char *file_src = src + 5;
  89                 opkg_msg(INFO, "Copying %s to %s...", file_src, dest_file_name);
  90                 err = file_copy(file_src, dest_file_name);
  91                 opkg_msg(INFO, "Done.\n");
  92                 free(src_basec);
  93                 return err;
  94         }
  95
  96         sprintf_alloc(&tmp_file_location, "%s/%s", conf->tmp_dir, src_base);
  97         free(src_basec);
  98         err = unlink(tmp_file_location);
  99         if (err && errno != ENOENT) {
 100                 opkg_perror(ERROR, "Failed to unlink %s", tmp_file_location);
 101                 free(tmp_file_location);
 102                 return -1;
 103         }
 104
 105         if (conf->http_proxy) {
 106                 opkg_msg(DEBUG,
 107                          "Setting environment variable: http_proxy = %s.\n",
 108                          conf->http_proxy);
 109                 setenv("http_proxy", conf->http_proxy, 1);
 110         }
 111         if (conf->ftp_proxy) {
 112                 opkg_msg(DEBUG,
 113                          "Setting environment variable: ftp_proxy = %s.\n",
 114                          conf->ftp_proxy);
 115                 setenv("ftp_proxy", conf->ftp_proxy, 1);
 116         }
 117         if (conf->no_proxy) {
 118                 opkg_msg(DEBUG,
 119                          "Setting environment variable: no_proxy = %s.\n",
 120                          conf->no_proxy);
 121                 setenv("no_proxy", conf->no_proxy, 1);
 122         }
 123 #ifdef HAVE_CURL
 124         CURLcode res;
 125         FILE *file = fopen(tmp_file_location, "w");
 126
 127         curl = opkg_curl_init(cb, data);
 128         if (curl) {
 129                 curl_easy_setopt(curl, CURLOPT_URL, src);
 130                 curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
 131
 132                 res = curl_easy_perform(curl);
 133                 fclose(file);
 134                 if (res) {
 135                         long error_code;
 136                         curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE,
 137                                           &error_code);
 138                         opkg_msg(hide_error ? DEBUG2 : ERROR,
 139                                  "Failed to download %s: %s.\n", src,
 140                                  curl_easy_strerror(res));
 141                         free(tmp_file_location);
 142                         return -1;
 143                 }
 144
 145         } else {
 146                 free(tmp_file_location);
 147                 return -1;
 148         }
 149 #else
 150         {
 151                 int res;
 152                 const char *argv[8];
 153                 int i = 0;
 154
 155                 argv[i++] = "wget";
 156                 argv[i++] = "-q";
 157                 if (conf->http_proxy || conf->ftp_proxy) {
 158                         argv[i++] = "-Y";
 159                         argv[i++] = "on";
 160                 }
 161                 argv[i++] = "-O";
 162                 argv[i++] = tmp_file_location;
 163                 argv[i++] = src;
 164                 argv[i++] = NULL;
 165                 res = xsystem(argv);
 166
 167                 if (res) {
 168                         opkg_msg(ERROR,
 169                                  "Failed to download %s, wget returned %d.\n",
 170                                  src, res);
 171                         if (res == 4)
 172                                 opkg_msg(ERROR,
 173                                          "Check your network settings and connectivity.\n\n");
 174                         free(tmp_file_location);
 175                         return -1;
 176                 }
 177         }
 178 #endif
 179
 180         err = file_move(tmp_file_location, dest_file_name);
 181
 182         free(tmp_file_location);
 183
 184         return err;
 185 }
 186
 187 static int
 188 opkg_download_cache(const char *src, const char *dest_file_name,
 189                     curl_progress_func cb, void *data)
 190 {
 191         char *cache_name = xstrdup(src);
 192         char *cache_location, *p;
 193         int err = 0;
 194
 195         if (!conf->cache || str_starts_with(src, "file:")) {
 196                 err = opkg_download(src, dest_file_name, cb, data, 0);
 197                 goto out1;
 198         }
 199
 200         if (!file_is_dir(conf->cache)) {
 201                 opkg_msg(ERROR, "%s is not a directory.\n", conf->cache);
 202                 err = 1;
 203                 goto out1;
 204         }
 205
 206         for (p = cache_name; *p; p++)
 207                 if (*p == '/')
 208                         *p = ',';       /* looks nicer than | or # */
 209
 210         sprintf_alloc(&cache_location, "%s/%s", conf->cache, cache_name);
 211         if (file_exists(cache_location))
 212                 opkg_msg(NOTICE, "Copying %s.\n", cache_location);
 213         else {
 214                 /* cache file with funky name not found, try simple name */
 215                 free(cache_name);
 216                 char *filename = strrchr(dest_file_name, '/');
 217                 if (filename)
 218                         cache_name = xstrdup(filename + 1);     // strip leading '/'
 219                 else
 220                         cache_name = xstrdup(dest_file_name);
 221                 free(cache_location);
 222                 sprintf_alloc(&cache_location, "%s/%s", conf->cache,
 223                               cache_name);
 224                 if (file_exists(cache_location))
 225                         opkg_msg(NOTICE, "Copying %s.\n", cache_location);
 226                 else {
 227                         err = opkg_download(src, cache_location, cb, data, 0);
 228                         if (err) {
 229                                 (void)unlink(cache_location);
 230                                 goto out2;
 231                         }
 232                 }
 233         }
 234
 235         err = file_copy(cache_location, dest_file_name);
 236
 237 out2:
 238         free(cache_location);
 239 out1:
 240         free(cache_name);
 241         return err;
 242 }
 243
 244 int opkg_download_pkg(pkg_t * pkg, const char *dir)
 245 {
 246         int err;
 247         char *url;
 248         char *local_filename;
 249         char *stripped_filename;
 250         char *filename;
 251
 252         if (pkg->src == NULL) {
 253                 opkg_msg(ERROR,
 254                          "Package %s is not available from any configured src.\n",
 255                          pkg->name);
 256                 return -1;
 257         }
 258
 259         filename = pkg_get_string(pkg, PKG_FILENAME);
 260
 261         if (filename == NULL) {
 262                 opkg_msg(ERROR,
 263                          "Package %s does not have a valid filename field.\n",
 264                          pkg->name);
 265                 return -1;
 266         }
 267
 268         sprintf_alloc(&url, "%s/%s", pkg->src->value, filename);
 269
 270         /* The filename might be something like
 271            "../../foo.opk". While this is correct, and exactly what we
 272            want to use to construct url above, here we actually need to
 273            use just the filename part, without any directory. */
 274
 275         stripped_filename = strrchr(filename, '/');
 276         if (!stripped_filename)
 277                 stripped_filename = filename;
 278
 279         sprintf_alloc(&local_filename, "%s/%s", dir, stripped_filename);
 280         pkg_set_string(pkg, PKG_LOCAL_FILENAME, local_filename);
 281
 282         err = opkg_download_cache(url, local_filename, NULL, NULL);
 283         free(url);
 284
 285         return err;
 286 }
 287
 288 /*
 289  * Downloads file from url, installs in package database, return package name.
 290  */
 291 int opkg_prepare_url_for_install(const char *url, char **namep)
 292 {
 293         int err = 0;
 294         pkg_t *pkg;
 295         abstract_pkg_t *ab_pkg;
 296
 297         pkg = pkg_new();
 298
 299         if (str_starts_with(url, "http://")
 300             || str_starts_with(url, "ftp://")) {
 301                 char *tmp_file;
 302                 char *file_basec = xstrdup(url);
 303                 char *file_base = basename(file_basec);
 304
 305                 sprintf_alloc(&tmp_file, "%s/%s", conf->tmp_dir, file_base);
 306                 err = opkg_download(url, tmp_file, NULL, NULL, 0);
 307                 if (err)
 308                         return err;
 309
 310                 err = pkg_init_from_file(pkg, tmp_file);
 311                 if (err)
 312                         return err;
 313
 314                 free(tmp_file);
 315                 free(file_basec);
 316
 317         } else if (strcmp(&url[strlen(url) - 4], OPKG_PKG_EXTENSION) == 0
 318                    || strcmp(&url[strlen(url) - 4], IPKG_PKG_EXTENSION) == 0
 319                    || strcmp(&url[strlen(url) - 4], DPKG_PKG_EXTENSION) == 0) {
 320
 321                 err = pkg_init_from_file(pkg, url);
 322                 if (err)
 323                         return err;
 324                 opkg_msg(DEBUG2, "Package %s provided by hand (%s).\n",
 325                          pkg->name, pkg_get_string(pkg, PKG_LOCAL_FILENAME));
 326                 pkg->provided_by_hand = 1;
 327
 328         } else {
 329                 ab_pkg = ensure_abstract_pkg_by_name(url);
 330
 331                 if (!(ab_pkg->state_flag & SF_NEED_DETAIL)) {
 332                         opkg_msg(DEBUG, "applying abpkg flag to %s\n", ab_pkg->name);
 333                         ab_pkg->state_flag |= SF_NEED_DETAIL;
 334                 }
 335
 336                 pkg_deinit(pkg);
 337                 free(pkg);
 338                 return 0;
 339         }
 340
 341         pkg->dest = conf->default_dest;
 342         pkg->state_want = SW_INSTALL;
 343         pkg->state_flag |= SF_PREFER;
 344         hash_insert_pkg(pkg, 1);
 345
 346         if (namep) {
 347                 *namep = xstrdup(pkg->name);
 348         }
 349         return 0;
 350 }
 351
 352 int opkg_verify_file(char *text_file, char *sig_file)
 353 {
 354 #if defined HAVE_USIGN
 355         int status = -1;
 356         int pid;
 357
 358         if (conf->check_signature == 0)
 359                 return 0;
 360
 361         pid = fork();
 362         if (pid < 0)
 363                 return -1;
 364
 365         if (!pid) {
 366                 execl("/usr/sbin/opkg-key", "opkg-key", "verify", sig_file,
 367                       text_file, NULL);
 368                 exit(255);
 369         }
 370
 371         waitpid(pid, &status, 0);
 372         if (!WIFEXITED(status) || WEXITSTATUS(status))
 373                 return -1;
 374
 375         return 0;
 376 #elif defined HAVE_OPENSSL
 377         X509_STORE *store = NULL;
 378         PKCS7 *p7 = NULL;
 379         BIO *in = NULL, *indata = NULL;
 380
 381         // Sig check failed by default !
 382         int status = -1;
 383
 384         openssl_init();
 385
 386         // Set-up the key store
 387         if (!
 388             (store =
 389              setup_verify(conf->signature_ca_file, conf->signature_ca_path))) {
 390                 opkg_msg(ERROR, "Can't open CA certificates.\n");
 391                 goto verify_file_end;
 392         }
 393         // Open a BIO to read the sig file
 394         if (!(in = BIO_new_file(sig_file, "rb"))) {
 395                 opkg_msg(ERROR, "Can't open signature file %s.\n", sig_file);
 396                 goto verify_file_end;
 397         }
 398         // Read the PKCS7 block contained in the sig file
 399         p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL);
 400         if (!p7) {
 401                 opkg_msg(ERROR, "Can't read signature file %s (Corrupted ?).\n",
 402                          sig_file);
 403                 goto verify_file_end;
 404         }
 405
 406         // Open the Package file to authenticate
 407         if (!(indata = BIO_new_file(text_file, "rb"))) {
 408                 opkg_msg(ERROR, "Can't open file %s.\n", text_file);
 409                 goto verify_file_end;
 410         }
 411         // Let's verify the autenticity !
 412         if (PKCS7_verify(p7, NULL, store, indata, NULL, PKCS7_BINARY) != 1) {
 413                 // Get Off My Lawn!
 414                 opkg_msg(ERROR, "Verification failure.\n");
 415         } else {
 416                 // Victory !
 417                 status = 0;
 418         }
 419
 420 verify_file_end:
 421         BIO_free(in);
 422         BIO_free(indata);
 423         PKCS7_free(p7);
 424         X509_STORE_free(store);
 425
 426         return status;
 427 #else
 428         /* mute `unused variable' warnings. */
 429         (void)sig_file;
 430         (void)text_file;
 431         (void)conf;
 432         return 0;
 433 #endif
 434 }
 435
 436 #if defined(HAVE_OPENSSL) || defined(HAVE_SSLCURL)
 437 static void openssl_init(void)
 438 {
 439         static int init = 0;
 440
 441         if (!init) {
 442                 OPENSSL_config(NULL);
 443                 OpenSSL_add_all_algorithms();
 444                 ERR_load_crypto_strings();
 445                 init = 1;
 446         }
 447 }
 448
 449 #endif
 450
 451 #if defined HAVE_OPENSSL
 452 static X509_STORE *setup_verify(char *CAfile, char *CApath)
 453 {
 454         X509_STORE *store = NULL;
 455         X509_LOOKUP *lookup = NULL;
 456
 457         if (!(store = X509_STORE_new())) {
 458                 // Something bad is happening...
 459                 goto end;
 460         }
 461         // adds the X509 file lookup method
 462         lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
 463         if (lookup == NULL) {
 464                 goto end;
 465         }
 466         // Autenticating against one CA file
 467         if (CAfile) {
 468                 if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) {
 469                         // Invalid CA => Bye bye
 470                         opkg_msg(ERROR, "Error loading file %s.\n", CAfile);
 471                         goto end;
 472                 }
 473         } else {
 474                 X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
 475         }
 476
 477         // Now look into CApath directory if supplied
 478         lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
 479         if (lookup == NULL) {
 480                 goto end;
 481         }
 482
 483         if (CApath) {
 484                 if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM)) {
 485                         opkg_msg(ERROR, "Error loading directory %s.\n",
 486                                  CApath);
 487                         goto end;
 488                 }
 489         } else {
 490                 X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
 491         }
 492
 493         // All right !
 494         ERR_clear_error();
 495         return store;
 496
 497 end:
 498
 499         X509_STORE_free(store);
 500         return NULL;
 501
 502 }
 503
 504 #endif
 505
 506 #ifdef HAVE_CURL
 507 void opkg_curl_cleanup(void)
 508 {
 509         if (curl != NULL) {
 510                 curl_easy_cleanup(curl);
 511                 curl = NULL;
 512         }
 513 }
 514
 515 static CURL *opkg_curl_init(curl_progress_func cb, void *data)
 516 {
 517
 518         if (curl == NULL) {
 519                 curl = curl_easy_init();
 520
 521 #ifdef HAVE_SSLCURL
 522                 openssl_init();
 523
 524                 if (conf->ssl_engine) {
 525
 526                         /* use crypto engine */
 527                         if (curl_easy_setopt
 528                             (curl, CURLOPT_SSLENGINE,
 529                              conf->ssl_engine) != CURLE_OK) {
 530                                 opkg_msg(ERROR,
 531                                          "Can't set crypto engine '%s'.\n",
 532                                          conf->ssl_engine);
 533
 534                                 opkg_curl_cleanup();
 535                                 return NULL;
 536                         }
 537                         /* set the crypto engine as default */
 538                         if (curl_easy_setopt
 539                             (curl, CURLOPT_SSLENGINE_DEFAULT, 1L) != CURLE_OK) {
 540                                 opkg_msg(ERROR,
 541                                          "Can't set crypto engine '%s' as default.\n",
 542                                          conf->ssl_engine);
 543
 544                                 opkg_curl_cleanup();
 545                                 return NULL;
 546                         }
 547                 }
 548
 549                 /* cert & key can only be in PEM case in the same file */
 550                 if (conf->ssl_key_passwd) {
 551                         if (curl_easy_setopt
 552                             (curl, CURLOPT_SSLKEYPASSWD,
 553                              conf->ssl_key_passwd) != CURLE_OK) {
 554                                 opkg_msg(DEBUG,
 555                                          "Failed to set key password.\n");
 556                         }
 557                 }
 558
 559                 /* sets the client certificate and its type */
 560                 if (conf->ssl_cert_type) {
 561                         if (curl_easy_setopt
 562                             (curl, CURLOPT_SSLCERTTYPE,
 563                              conf->ssl_cert_type) != CURLE_OK) {
 564                                 opkg_msg(DEBUG,
 565                                          "Failed to set certificate format.\n");
 566                         }
 567                 }
 568                 /* SSL cert name isn't mandatory */
 569                 if (conf->ssl_cert) {
 570                         curl_easy_setopt(curl, CURLOPT_SSLCERT, conf->ssl_cert);
 571                 }
 572
 573                 /* sets the client key and its type */
 574                 if (conf->ssl_key_type) {
 575                         if (curl_easy_setopt
 576                             (curl, CURLOPT_SSLKEYTYPE,
 577                              conf->ssl_key_type) != CURLE_OK) {
 578                                 opkg_msg(DEBUG, "Failed to set key format.\n");
 579                         }
 580                 }
 581                 if (conf->ssl_key) {
 582                         if (curl_easy_setopt
 583                             (curl, CURLOPT_SSLKEY, conf->ssl_key) != CURLE_OK) {
 584                                 opkg_msg(DEBUG, "Failed to set key.\n");
 585                         }
 586                 }
 587
 588                 /* Should we verify the peer certificate ? */
 589                 if (conf->ssl_dont_verify_peer) {
 590                         /*
 591                          * CURLOPT_SSL_VERIFYPEER default is nonzero (curl => 7.10)
 592                          */
 593                         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0);
 594                 }
 595
 596                 /* certification authority file and/or path */
 597                 if (conf->ssl_ca_file) {
 598                         curl_easy_setopt(curl, CURLOPT_CAINFO,
 599                                          conf->ssl_ca_file);
 600                 }
 601                 if (conf->ssl_ca_path) {
 602                         curl_easy_setopt(curl, CURLOPT_CAPATH,
 603                                          conf->ssl_ca_path);
 604                 }
 605 #endif
 606
 607                 curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
 608                 curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1);
 609                 if (conf->http_proxy || conf->ftp_proxy) {
 610                         char *userpwd;
 611                         sprintf_alloc(&userpwd, "%s:%s", conf->proxy_user,
 612                                       conf->proxy_passwd);
 613                         curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
 614                         free(userpwd);
 615                 }
 616         }
 617
 618         curl_easy_setopt(curl, CURLOPT_NOPROGRESS, (cb == NULL));
 619         if (cb) {
 620                 curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, data);
 621                 curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, cb);
 622         }
 623
 624         return curl;
 625
 626 }
 627 #endif