libopkg/opkg_download.c

   1 /* vi: set noexpandtab sw=4 sts=4: */
   2 /* opkg_download.c - the opkg package management system
   3
   4    Carl D. Worth
   5
   6    Copyright (C) 2001 University of Southern California
   7    Copyright (C) 2008 OpenMoko Inc
   8
   9    This program is free software; you can redistribute it and/or
  10    modify it under the terms of the GNU General Public License as
  11    published by the Free Software Foundation; either version 2, or (at
  12    your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful, but
  15    WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17    General Public License for more details.
  18 */
  19
  20 #include "config.h"
  21
  22 #include <stdio.h>
  23 #include <unistd.h>
  24
  25 #include "opkg_download.h"
  26 #include "opkg_message.h"
  27
  28 #include "sprintf_alloc.h"
  29 #include "xsystem.h"
  30 #include "file_util.h"
  31 #include "opkg_defines.h"
  32 #include "libbb/libbb.h"
  33
  34 #ifdef HAVE_CURL
  35 #include <curl/curl.h>
  36 #endif
  37
  38 #if defined(HAVE_SSLCURL) || defined(HAVE_OPENSSL)
  39 #include <openssl/conf.h>
  40 #include <openssl/evp.h>
  41 #include <openssl/err.h>
  42 #include <openssl/ssl.h>
  43 #endif
  44
  45 #if defined(HAVE_GPGME)
  46 #include <gpgme.h>
  47 #elif defined(HAVE_OPENSSL)
  48 #include <openssl/bio.h>
  49 #include <openssl/objects.h>
  50 #include <openssl/x509.h>
  51 #include <openssl/pem.h>
  52 #include <openssl/hmac.h>
  53 #endif
  54
  55 #ifdef HAVE_PATHFINDER
  56 #include "opkg_pathfinder.h"
  57 #endif
  58
  59 #if defined(HAVE_OPENSSL) || defined(HAVE_SSLCURL)
  60 static void openssl_init(void);
  61 #endif
  62
  63 #ifdef HAVE_OPENSSL
  64 static X509_STORE *setup_verify(char *CAfile, char *CApath);
  65 #endif
  66
  67 #ifdef HAVE_CURL
  68 /*
  69  * Make curl an instance variable so we don't have to instanciate it
  70  * each time
  71  */
  72 static CURL *curl = NULL;
  73 static CURL *opkg_curl_init(curl_progress_func cb, void *data);
  74 #endif
  75
  76 static int
  77 str_starts_with(const char *str, const char *prefix)
  78 {
  79     return (strncmp(str, prefix, strlen(prefix)) == 0);
  80 }
  81
  82 int
  83 opkg_download(const char *src, const char *dest_file_name,
  84         curl_progress_func cb, void *data)
  85 {
  86     int err = 0;
  87
  88     char *src_basec = xstrdup(src);
  89     char *src_base = basename(src_basec);
  90     char *tmp_file_location;
  91
  92     opkg_msg(NOTICE,"Downloading %s.\n", src);
  93
  94     if (str_starts_with(src, "file:")) {
  95         const char *file_src = src + 5;
  96         opkg_msg(INFO, "Copying %s to %s...", file_src, dest_file_name);
  97         err = file_copy(file_src, dest_file_name);
  98         opkg_msg(INFO, "Done.\n");
  99         free(src_basec);
 100         return err;
 101     }
 102
 103     sprintf_alloc(&tmp_file_location, "%s/%s", conf->tmp_dir, src_base);
 104     free(src_basec);
 105     err = unlink(tmp_file_location);
 106     if (err && errno != ENOENT) {
 107         opkg_perror(ERROR, "Failed to unlink %s", tmp_file_location);
 108         free(tmp_file_location);
 109         return -1;
 110     }
 111
 112     if (conf->http_proxy) {
 113         opkg_msg(DEBUG, "Setting environment variable: http_proxy = %s.\n",
 114                 conf->http_proxy);
 115         setenv("http_proxy", conf->http_proxy, 1);
 116     }
 117     if (conf->ftp_proxy) {
 118         opkg_msg(DEBUG, "Setting environment variable: ftp_proxy = %s.\n",
 119                 conf->ftp_proxy);
 120         setenv("ftp_proxy", conf->ftp_proxy, 1);
 121     }
 122     if (conf->no_proxy) {
 123         opkg_msg(DEBUG,"Setting environment variable: no_proxy = %s.\n",
 124                 conf->no_proxy);
 125         setenv("no_proxy", conf->no_proxy, 1);
 126     }
 127
 128 #ifdef HAVE_CURL
 129     CURLcode res;
 130     FILE * file = fopen (tmp_file_location, "w");
 131
 132     curl = opkg_curl_init (cb, data);
 133     if (curl)
 134     {
 135         curl_easy_setopt (curl, CURLOPT_URL, src);
 136         curl_easy_setopt (curl, CURLOPT_WRITEDATA, file);
 137
 138         res = curl_easy_perform (curl);
 139         fclose (file);
 140         if (res)
 141         {
 142             long error_code;
 143             curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &error_code);
 144             opkg_msg(ERROR, "Failed to download %s: %s.\n",
 145                     src, curl_easy_strerror(res));
 146             free(tmp_file_location);
 147             return -1;
 148         }
 149
 150     }
 151     else
 152     {
 153         free(tmp_file_location);
 154         return -1;
 155     }
 156 #else
 157     {
 158       int res;
 159       const char *argv[8];
 160       int i = 0;
 161
 162       argv[i++] = "wget";
 163       argv[i++] = "-q";
 164       if (conf->http_proxy || conf->ftp_proxy) {
 165         argv[i++] = "-Y";
 166         argv[i++] = "on";
 167       }
 168       argv[i++] = "-O";
 169       argv[i++] = tmp_file_location;
 170       argv[i++] = src;
 171       argv[i++] = NULL;
 172       res = xsystem(argv);
 173
 174       if (res) {
 175         opkg_msg(ERROR, "Failed to download %s, wget returned %d.\n", src, res);
 176         free(tmp_file_location);
 177         return -1;
 178       }
 179     }
 180 #endif
 181
 182     err = file_move(tmp_file_location, dest_file_name);
 183
 184     free(tmp_file_location);
 185
 186     return err;
 187 }
 188
 189 static int
 190 opkg_download_cache(const char *src, const char *dest_file_name,
 191         curl_progress_func cb, void *data)
 192 {
 193     char *cache_name = xstrdup(src);
 194     char *cache_location, *p;
 195     int err = 0;
 196
 197     if (!conf->cache || str_starts_with(src, "file:")) {
 198         err = opkg_download(src, dest_file_name, cb, data);
 199         goto out1;
 200     }
 201
 202     if(!file_is_dir(conf->cache)){
 203             opkg_msg(ERROR, "%s is not a directory.\n",
 204                             conf->cache);
 205             err = 1;
 206             goto out1;
 207     }
 208
 209     for (p = cache_name; *p; p++)
 210         if (*p == '/')
 211             *p = ',';   /* looks nicer than | or # */
 212
 213     sprintf_alloc(&cache_location, "%s/%s", conf->cache, cache_name);
 214     if (file_exists(cache_location))
 215         opkg_msg(NOTICE, "Copying %s.\n", cache_location);
 216     else {
 217         err = opkg_download(src, cache_location, cb, data);
 218         if (err) {
 219             (void) unlink(cache_location);
 220             goto out2;
 221         }
 222     }
 223
 224     err = file_copy(cache_location, dest_file_name);
 225
 226
 227 out2:
 228     free(cache_location);
 229 out1:
 230     free(cache_name);
 231     return err;
 232 }
 233
 234 int
 235 opkg_download_pkg(pkg_t *pkg, const char *dir)
 236 {
 237     int err;
 238     char *url;
 239     char *stripped_filename;
 240
 241     if (pkg->src == NULL) {
 242         opkg_msg(ERROR, "Package %s is not available from any configured src.\n",
 243                 pkg->name);
 244         return -1;
 245     }
 246     if (pkg->filename == NULL) {
 247         opkg_msg(ERROR, "Package %s does not have a valid filename field.\n",
 248                 pkg->name);
 249         return -1;
 250     }
 251
 252     sprintf_alloc(&url, "%s/%s", pkg->src->value, pkg->filename);
 253
 254     /* XXX: BUG: The pkg->filename might be something like
 255        "../../foo.opk". While this is correct, and exactly what we
 256        want to use to construct url above, here we actually need to
 257        use just the filename part, without any directory. */
 258
 259     stripped_filename = strrchr(pkg->filename, '/');
 260     if ( ! stripped_filename )
 261         stripped_filename = pkg->filename;
 262
 263     sprintf_alloc(&pkg->local_filename, "%s/%s", dir, stripped_filename);
 264
 265     err = opkg_download_cache(url, pkg->local_filename, NULL, NULL);
 266     free(url);
 267
 268     return err;
 269 }
 270
 271 /*
 272  * Downloads file from url, installs in package database, return package name.
 273  */
 274 int
 275 opkg_prepare_url_for_install(const char *url, char **namep)
 276 {
 277      int err = 0;
 278      pkg_t *pkg;
 279
 280      pkg = pkg_new();
 281
 282      if (str_starts_with(url, "http://")
 283          || str_starts_with(url, "ftp://")) {
 284           char *tmp_file;
 285           char *file_basec = xstrdup(url);
 286           char *file_base = basename(file_basec);
 287
 288           sprintf_alloc(&tmp_file, "%s/%s", conf->tmp_dir, file_base);
 289           err = opkg_download(url, tmp_file, NULL, NULL);
 290           if (err)
 291                return err;
 292
 293           err = pkg_init_from_file(pkg, tmp_file);
 294           if (err)
 295                return err;
 296
 297           free(tmp_file);
 298           free(file_basec);
 299
 300      } else if (strcmp(&url[strlen(url) - 4], OPKG_PKG_EXTENSION) == 0
 301                 || strcmp(&url[strlen(url) - 4], IPKG_PKG_EXTENSION) == 0
 302                 || strcmp(&url[strlen(url) - 4], DPKG_PKG_EXTENSION) == 0) {
 303
 304           err = pkg_init_from_file(pkg, url);
 305           if (err)
 306                return err;
 307           opkg_msg(DEBUG2, "Package %s provided by hand (%s).\n",
 308                   pkg->name, pkg->local_filename);
 309           pkg->provided_by_hand = 1;
 310
 311      } else {
 312        pkg_deinit(pkg);
 313        free(pkg);
 314        return 0;
 315      }
 316
 317      pkg->dest = conf->default_dest;
 318      pkg->state_want = SW_INSTALL;
 319      pkg->state_flag |= SF_PREFER;
 320      hash_insert_pkg(pkg, 1);
 321
 322      if (namep) {
 323           *namep = pkg->name;
 324      }
 325      return 0;
 326 }
 327
 328 int
 329 opkg_verify_file (char *text_file, char *sig_file)
 330 {
 331 #if defined HAVE_GPGME
 332     if (conf->check_signature == 0 )
 333         return 0;
 334     int status = -1;
 335     gpgme_ctx_t ctx;
 336     gpgme_data_t sig, text, key;
 337     gpgme_error_t err;
 338     gpgme_verify_result_t result;
 339     gpgme_signature_t s;
 340     char *trusted_path = NULL;
 341
 342     err = gpgme_new (&ctx);
 343
 344     if (err)
 345         return -1;
 346
 347     sprintf_alloc(&trusted_path, "%s/%s", conf->offline_root, "/etc/opkg/trusted.gpg");
 348     err = gpgme_data_new_from_file (&key, trusted_path, 1);
 349     free (trusted_path);
 350     if (err)
 351     {
 352       return -1;
 353     }
 354     err = gpgme_op_import (ctx, key);
 355     if (err)
 356     {
 357       gpgme_data_release (key);
 358       return -1;
 359     }
 360     gpgme_data_release (key);
 361
 362     err = gpgme_data_new_from_file (&sig, sig_file, 1);
 363     if (err)
 364     {
 365         gpgme_release (ctx);
 366         return -1;
 367     }
 368
 369     err = gpgme_data_new_from_file (&text, text_file, 1);
 370     if (err)
 371     {
 372         gpgme_data_release (sig);
 373         gpgme_release (ctx);
 374         return -1;
 375     }
 376
 377     err = gpgme_op_verify (ctx, sig, text, NULL);
 378
 379     result = gpgme_op_verify_result (ctx);
 380     if (!result)
 381         return -1;
 382
 383     /* see if any of the signitures matched */
 384     s = result->signatures;
 385     while (s)
 386     {
 387         status = gpg_err_code (s->status);
 388         if (status == GPG_ERR_NO_ERROR)
 389             break;
 390         s = s->next;
 391     }
 392
 393
 394     gpgme_data_release (sig);
 395     gpgme_data_release (text);
 396     gpgme_release (ctx);
 397
 398     return status;
 399 #elif defined HAVE_OPENSSL
 400     X509_STORE *store = NULL;
 401     PKCS7 *p7 = NULL;
 402     BIO *in = NULL, *indata = NULL;
 403
 404     // Sig check failed by default !
 405     int status = -1;
 406
 407     openssl_init();
 408
 409     // Set-up the key store
 410     if(!(store = setup_verify(conf->signature_ca_file, conf->signature_ca_path))){
 411         opkg_msg(ERROR, "Can't open CA certificates.\n");
 412         goto verify_file_end;
 413     }
 414
 415     // Open a BIO to read the sig file
 416     if (!(in = BIO_new_file(sig_file, "rb"))){
 417         opkg_msg(ERROR, "Can't open signature file %s.\n", sig_file);
 418         goto verify_file_end;
 419     }
 420
 421     // Read the PKCS7 block contained in the sig file
 422     p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL);
 423     if(!p7){
 424         opkg_msg(ERROR, "Can't read signature file %s (Corrupted ?).\n",
 425                 sig_file);
 426         goto verify_file_end;
 427     }
 428 #if defined(HAVE_PATHFINDER)
 429     if(conf->check_x509_path){
 430         if(!pkcs7_pathfinder_verify_signers(p7)){
 431             opkg_msg(ERROR, "pkcs7_pathfinder_verify_signers: "
 432                     "Path verification failed.\n");
 433             goto verify_file_end;
 434         }
 435     }
 436 #endif
 437
 438     // Open the Package file to authenticate
 439     if (!(indata = BIO_new_file(text_file, "rb"))){
 440         opkg_msg(ERROR, "Can't open file %s.\n", text_file);
 441         goto verify_file_end;
 442     }
 443
 444     // Let's verify the autenticity !
 445     if (PKCS7_verify(p7, NULL, store, indata, NULL, PKCS7_BINARY) != 1){
 446         // Get Off My Lawn!
 447         opkg_msg(ERROR, "Verification failure.\n");
 448     }else{
 449         // Victory !
 450         status = 0;
 451     }
 452
 453 verify_file_end:
 454     BIO_free(in);
 455     BIO_free(indata);
 456     PKCS7_free(p7);
 457     X509_STORE_free(store);
 458
 459     return status;
 460 #else
 461     /* mute `unused variable' warnings. */
 462     (void) sig_file;
 463     (void) text_file;
 464     (void) conf;
 465     return 0;
 466 #endif
 467 }
 468
 469
 470 #if defined(HAVE_OPENSSL) || defined(HAVE_SSLCURL)
 471 static void openssl_init(void){
 472     static int init = 0;
 473
 474     if(!init){
 475         OPENSSL_config(NULL);
 476         OpenSSL_add_all_algorithms();
 477         ERR_load_crypto_strings();
 478         init = 1;
 479     }
 480 }
 481
 482 #endif
 483
 484
 485 #if defined HAVE_OPENSSL
 486 static X509_STORE *
 487 setup_verify(char *CAfile, char *CApath)
 488 {
 489     X509_STORE *store = NULL;
 490     X509_LOOKUP *lookup = NULL;
 491
 492     if(!(store = X509_STORE_new())){
 493         // Something bad is happening...
 494         goto end;
 495     }
 496
 497     // adds the X509 file lookup method
 498     lookup = X509_STORE_add_lookup(store,X509_LOOKUP_file());
 499     if (lookup == NULL){
 500         goto end;
 501     }
 502
 503     // Autenticating against one CA file
 504     if (CAfile) {
 505         if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) {
 506             // Invalid CA => Bye bye
 507             opkg_msg(ERROR, "Error loading file %s.\n", CAfile);
 508             goto end;
 509         }
 510     } else {
 511         X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
 512     }
 513
 514     // Now look into CApath directory if supplied
 515     lookup = X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
 516     if (lookup == NULL){
 517         goto end;
 518     }
 519
 520     if (CApath) {
 521         if(!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) {
 522             opkg_msg(ERROR, "Error loading directory %s.\n", CApath);
 523             goto end;
 524         }
 525     } else {
 526         X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
 527     }
 528
 529     // All right !
 530     ERR_clear_error();
 531     return store;
 532
 533 end:
 534
 535     X509_STORE_free(store);
 536     return NULL;
 537
 538 }
 539
 540 #endif
 541
 542 #ifdef HAVE_CURL
 543 void opkg_curl_cleanup(void){
 544     if(curl != NULL){
 545         curl_easy_cleanup (curl);
 546         curl = NULL;
 547     }
 548 }
 549
 550 static CURL *
 551 opkg_curl_init(curl_progress_func cb, void *data)
 552 {
 553
 554     if(curl == NULL){
 555         curl = curl_easy_init();
 556
 557 #ifdef HAVE_SSLCURL
 558         openssl_init();
 559
 560         if (conf->ssl_engine) {
 561
 562             /* use crypto engine */
 563             if (curl_easy_setopt(curl, CURLOPT_SSLENGINE, conf->ssl_engine) != CURLE_OK){
 564                 opkg_msg(ERROR, "Can't set crypto engine '%s'.\n",
 565                         conf->ssl_engine);
 566
 567                 opkg_curl_cleanup();
 568                 return NULL;
 569             }
 570             /* set the crypto engine as default */
 571             if (curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L) != CURLE_OK){
 572                 opkg_msg(ERROR, "Can't set crypto engine '%s' as default.\n",
 573                         conf->ssl_engine);
 574
 575                 opkg_curl_cleanup();
 576                 return NULL;
 577             }
 578         }
 579
 580         /* cert & key can only be in PEM case in the same file */
 581         if(conf->ssl_key_passwd){
 582             if (curl_easy_setopt(curl, CURLOPT_SSLKEYPASSWD, conf->ssl_key_passwd) != CURLE_OK)
 583             {
 584                 opkg_msg(DEBUG, "Failed to set key password.\n");
 585             }
 586         }
 587
 588         /* sets the client certificate and its type */
 589         if(conf->ssl_cert_type){
 590             if (curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, conf->ssl_cert_type) != CURLE_OK)
 591             {
 592                 opkg_msg(DEBUG, "Failed to set certificate format.\n");
 593             }
 594         }
 595         /* SSL cert name isn't mandatory */
 596         if(conf->ssl_cert){
 597                 curl_easy_setopt(curl, CURLOPT_SSLCERT, conf->ssl_cert);
 598         }
 599
 600         /* sets the client key and its type */
 601         if(conf->ssl_key_type){
 602             if (curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, conf->ssl_key_type) != CURLE_OK)
 603             {
 604                 opkg_msg(DEBUG, "Failed to set key format.\n");
 605             }
 606         }
 607         if(conf->ssl_key){
 608             if (curl_easy_setopt(curl, CURLOPT_SSLKEY, conf->ssl_key) != CURLE_OK)
 609             {
 610                 opkg_msg(DEBUG, "Failed to set key.\n");
 611             }
 612         }
 613
 614         /* Should we verify the peer certificate ? */
 615         if(conf->ssl_dont_verify_peer){
 616             /*
 617              * CURLOPT_SSL_VERIFYPEER default is nonzero (curl => 7.10)
 618              */
 619             curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0);
 620         }else{
 621 #ifdef HAVE_PATHFINDER
 622             if(conf->check_x509_path){
 623                 if (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, curl_ssl_ctx_function) != CURLE_OK){
 624                     opkg_msg(DEBUG, "Failed to set ssl path verification callback.\n");
 625                 }else{
 626                     curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, NULL);
 627                 }
 628             }
 629 #endif
 630         }
 631
 632         /* certification authority file and/or path */
 633         if(conf->ssl_ca_file){
 634             curl_easy_setopt(curl, CURLOPT_CAINFO, conf->ssl_ca_file);
 635         }
 636         if(conf->ssl_ca_path){
 637             curl_easy_setopt(curl, CURLOPT_CAPATH, conf->ssl_ca_path);
 638         }
 639 #endif
 640
 641         curl_easy_setopt (curl, CURLOPT_FOLLOWLOCATION, 1);
 642         curl_easy_setopt (curl, CURLOPT_FAILONERROR, 1);
 643         if (conf->http_proxy || conf->ftp_proxy)
 644         {
 645             char *userpwd;
 646             sprintf_alloc (&userpwd, "%s:%s", conf->proxy_user,
 647                     conf->proxy_passwd);
 648             curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
 649             free (userpwd);
 650         }
 651     }
 652
 653     curl_easy_setopt (curl, CURLOPT_NOPROGRESS, (cb == NULL));
 654     if (cb)
 655     {
 656         curl_easy_setopt (curl, CURLOPT_PROGRESSDATA, data);
 657         curl_easy_setopt (curl, CURLOPT_PROGRESSFUNCTION, cb);
 658     }
 659
 660     return curl;
 661
 662 }
 663 #endif