libopkg/opkg_download.c

   1 /* vi: set noexpandtab sw=4 sts=4: */
   2 /* opkg_download.c - the opkg package management system
   3
   4    Carl D. Worth
   5
   6    Copyright (C) 2001 University of Southern California
   7    Copyright (C) 2008 OpenMoko Inc
   8
   9    This program is free software; you can redistribute it and/or
  10    modify it under the terms of the GNU General Public License as
  11    published by the Free Software Foundation; either version 2, or (at
  12    your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful, but
  15    WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17    General Public License for more details.
  18 */
  19
  20 #include <sys/wait.h>
  21 #include <stdio.h>
  22 #include <unistd.h>
  23 #include <libgen.h>
  24
  25 #include "opkg_download.h"
  26 #include "opkg_message.h"
  27
  28 #include "sprintf_alloc.h"
  29 #include "xsystem.h"
  30 #include "file_util.h"
  31 #include "opkg_defines.h"
  32 #include "libbb/libbb.h"
  33
  34 #ifdef HAVE_CURL
  35 #include <curl/curl.h>
  36 #endif
  37
  38 #if defined(HAVE_SSLCURL) || defined(HAVE_OPENSSL)
  39 #include <openssl/conf.h>
  40 #include <openssl/evp.h>
  41 #include <openssl/err.h>
  42 #include <openssl/ssl.h>
  43 #endif
  44
  45 #if defined(HAVE_GPGME)
  46 #include <gpgme.h>
  47 #elif defined(HAVE_OPENSSL)
  48 #include <openssl/bio.h>
  49 #include <openssl/objects.h>
  50 #include <openssl/x509.h>
  51 #include <openssl/pem.h>
  52 #include <openssl/hmac.h>
  53 #endif
  54
  55 #if defined(HAVE_OPENSSL) || defined(HAVE_SSLCURL)
  56 static void openssl_init(void);
  57 #endif
  58
  59 #ifdef HAVE_OPENSSL
  60 static X509_STORE *setup_verify(char *CAfile, char *CApath);
  61 #endif
  62
  63 #ifdef HAVE_CURL
  64 /*
  65  * Make curl an instance variable so we don't have to instanciate it
  66  * each time
  67  */
  68 static CURL *curl = NULL;
  69 static CURL *opkg_curl_init(curl_progress_func cb, void *data);
  70 #endif
  71
  72 static int str_starts_with(const char *str, const char *prefix)
  73 {
  74         return (strncmp(str, prefix, strlen(prefix)) == 0);
  75 }
  76
  77 int
  78 opkg_download(const char *src, const char *dest_file_name,
  79               curl_progress_func cb, void *data, const short hide_error)
  80 {
  81         int err = 0;
  82
  83         char *src_basec = xstrdup(src);
  84         char *src_base = basename(src_basec);
  85         char *tmp_file_location;
  86
  87         opkg_msg(NOTICE, "Downloading %s\n", src);
  88
  89         if (str_starts_with(src, "file:")) {
  90                 const char *file_src = src + 5;
  91                 opkg_msg(INFO, "Copying %s to %s...", file_src, dest_file_name);
  92                 err = file_copy(file_src, dest_file_name);
  93                 opkg_msg(INFO, "Done.\n");
  94                 free(src_basec);
  95                 return err;
  96         }
  97
  98         sprintf_alloc(&tmp_file_location, "%s/%s", conf->tmp_dir, src_base);
  99         free(src_basec);
 100         err = unlink(tmp_file_location);
 101         if (err && errno != ENOENT) {
 102                 opkg_perror(ERROR, "Failed to unlink %s", tmp_file_location);
 103                 free(tmp_file_location);
 104                 return -1;
 105         }
 106
 107         if (conf->http_proxy) {
 108                 opkg_msg(DEBUG,
 109                          "Setting environment variable: http_proxy = %s.\n",
 110                          conf->http_proxy);
 111                 setenv("http_proxy", conf->http_proxy, 1);
 112         }
 113         if (conf->ftp_proxy) {
 114                 opkg_msg(DEBUG,
 115                          "Setting environment variable: ftp_proxy = %s.\n",
 116                          conf->ftp_proxy);
 117                 setenv("ftp_proxy", conf->ftp_proxy, 1);
 118         }
 119         if (conf->no_proxy) {
 120                 opkg_msg(DEBUG,
 121                          "Setting environment variable: no_proxy = %s.\n",
 122                          conf->no_proxy);
 123                 setenv("no_proxy", conf->no_proxy, 1);
 124         }
 125 #ifdef HAVE_CURL
 126         CURLcode res;
 127         FILE *file = fopen(tmp_file_location, "w");
 128
 129         curl = opkg_curl_init(cb, data);
 130         if (curl) {
 131                 curl_easy_setopt(curl, CURLOPT_URL, src);
 132                 curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
 133
 134                 res = curl_easy_perform(curl);
 135                 fclose(file);
 136                 if (res) {
 137                         long error_code;
 138                         curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE,
 139                                           &error_code);
 140                         opkg_msg(hide_error ? DEBUG2 : ERROR,
 141                                  "Failed to download %s: %s.\n", src,
 142                                  curl_easy_strerror(res));
 143                         free(tmp_file_location);
 144                         return -1;
 145                 }
 146
 147         } else {
 148                 free(tmp_file_location);
 149                 return -1;
 150         }
 151 #else
 152         {
 153                 int res;
 154                 const char *argv[8];
 155                 int i = 0;
 156
 157                 argv[i++] = "wget";
 158                 argv[i++] = "-q";
 159                 if (conf->http_proxy || conf->ftp_proxy) {
 160                         argv[i++] = "-Y";
 161                         argv[i++] = "on";
 162                 }
 163                 argv[i++] = "-O";
 164                 argv[i++] = tmp_file_location;
 165                 argv[i++] = src;
 166                 argv[i++] = NULL;
 167                 res = xsystem(argv);
 168
 169                 if (res) {
 170                         opkg_msg(ERROR,
 171                                  "Failed to download %s, wget returned %d.\n",
 172                                  src, res);
 173                         if (res == 4)
 174                                 opkg_msg(ERROR,
 175                                          "Check your network settings and connectivity.\n\n");
 176                         free(tmp_file_location);
 177                         return -1;
 178                 }
 179         }
 180 #endif
 181
 182         err = file_move(tmp_file_location, dest_file_name);
 183
 184         free(tmp_file_location);
 185
 186         return err;
 187 }
 188
 189 static int
 190 opkg_download_cache(const char *src, const char *dest_file_name,
 191                     curl_progress_func cb, void *data)
 192 {
 193         char *cache_name = xstrdup(src);
 194         char *cache_location, *p;
 195         int err = 0;
 196
 197         if (!conf->cache || str_starts_with(src, "file:")) {
 198                 err = opkg_download(src, dest_file_name, cb, data, 0);
 199                 goto out1;
 200         }
 201
 202         if (!file_is_dir(conf->cache)) {
 203                 opkg_msg(ERROR, "%s is not a directory.\n", conf->cache);
 204                 err = 1;
 205                 goto out1;
 206         }
 207
 208         for (p = cache_name; *p; p++)
 209                 if (*p == '/')
 210                         *p = ',';       /* looks nicer than | or # */
 211
 212         sprintf_alloc(&cache_location, "%s/%s", conf->cache, cache_name);
 213         if (file_exists(cache_location))
 214                 opkg_msg(NOTICE, "Copying %s.\n", cache_location);
 215         else {
 216                 /* cache file with funky name not found, try simple name */
 217                 free(cache_name);
 218                 char *filename = strrchr(dest_file_name, '/');
 219                 if (filename)
 220                         cache_name = xstrdup(filename + 1);     // strip leading '/'
 221                 else
 222                         cache_name = xstrdup(dest_file_name);
 223                 free(cache_location);
 224                 sprintf_alloc(&cache_location, "%s/%s", conf->cache,
 225                               cache_name);
 226                 if (file_exists(cache_location))
 227                         opkg_msg(NOTICE, "Copying %s.\n", cache_location);
 228                 else {
 229                         err = opkg_download(src, cache_location, cb, data, 0);
 230                         if (err) {
 231                                 (void)unlink(cache_location);
 232                                 goto out2;
 233                         }
 234                 }
 235         }
 236
 237         err = file_copy(cache_location, dest_file_name);
 238
 239 out2:
 240         free(cache_location);
 241 out1:
 242         free(cache_name);
 243         return err;
 244 }
 245
 246 int opkg_download_pkg(pkg_t * pkg, const char *dir)
 247 {
 248         int err;
 249         char *url;
 250         char *local_filename;
 251         char *stripped_filename;
 252         char *filename;
 253
 254         if (pkg->src == NULL) {
 255                 opkg_msg(ERROR,
 256                          "Package %s is not available from any configured src.\n",
 257                          pkg->name);
 258                 return -1;
 259         }
 260
 261         filename = pkg_get_string(pkg, PKG_FILENAME);
 262
 263         if (filename == NULL) {
 264                 opkg_msg(ERROR,
 265                          "Package %s does not have a valid filename field.\n",
 266                          pkg->name);
 267                 return -1;
 268         }
 269
 270         sprintf_alloc(&url, "%s/%s", pkg->src->value, filename);
 271
 272         /* The filename might be something like
 273            "../../foo.opk". While this is correct, and exactly what we
 274            want to use to construct url above, here we actually need to
 275            use just the filename part, without any directory. */
 276
 277         stripped_filename = strrchr(filename, '/');
 278         if (!stripped_filename)
 279                 stripped_filename = filename;
 280
 281         sprintf_alloc(&local_filename, "%s/%s", dir, stripped_filename);
 282         pkg_set_string(pkg, PKG_LOCAL_FILENAME, local_filename);
 283
 284         err = opkg_download_cache(url, local_filename, NULL, NULL);
 285         free(url);
 286
 287         return err;
 288 }
 289
 290 /*
 291  * Downloads file from url, installs in package database, return package name.
 292  */
 293 int opkg_prepare_url_for_install(const char *url, char **namep)
 294 {
 295         int err = 0;
 296         pkg_t *pkg;
 297         abstract_pkg_t *ab_pkg;
 298
 299         pkg = pkg_new();
 300
 301         if (str_starts_with(url, "http://")
 302             || str_starts_with(url, "ftp://")) {
 303                 char *tmp_file;
 304                 char *file_basec = xstrdup(url);
 305                 char *file_base = basename(file_basec);
 306
 307                 sprintf_alloc(&tmp_file, "%s/%s", conf->tmp_dir, file_base);
 308                 err = opkg_download(url, tmp_file, NULL, NULL, 0);
 309                 if (err)
 310                         return err;
 311
 312                 err = pkg_init_from_file(pkg, tmp_file);
 313                 if (err)
 314                         return err;
 315
 316                 free(tmp_file);
 317                 free(file_basec);
 318
 319         } else if (strcmp(&url[strlen(url) - 4], OPKG_PKG_EXTENSION) == 0
 320                    || strcmp(&url[strlen(url) - 4], IPKG_PKG_EXTENSION) == 0
 321                    || strcmp(&url[strlen(url) - 4], DPKG_PKG_EXTENSION) == 0) {
 322
 323                 err = pkg_init_from_file(pkg, url);
 324                 if (err)
 325                         return err;
 326                 opkg_msg(DEBUG2, "Package %s provided by hand (%s).\n",
 327                          pkg->name, pkg_get_string(pkg, PKG_LOCAL_FILENAME));
 328                 pkg->provided_by_hand = 1;
 329
 330         } else {
 331                 ab_pkg = ensure_abstract_pkg_by_name(url);
 332
 333                 if (!(ab_pkg->state_flag & SF_NEED_DETAIL)) {
 334                         opkg_msg(DEBUG, "applying abpkg flag to %s\n", ab_pkg->name);
 335                         ab_pkg->state_flag |= SF_NEED_DETAIL;
 336                 }
 337
 338                 pkg_deinit(pkg);
 339                 free(pkg);
 340                 return 0;
 341         }
 342
 343         pkg->dest = conf->default_dest;
 344         pkg->state_want = SW_INSTALL;
 345         pkg->state_flag |= SF_PREFER;
 346         hash_insert_pkg(pkg, 1);
 347
 348         if (namep) {
 349                 *namep = xstrdup(pkg->name);
 350         }
 351         return 0;
 352 }
 353
 354 int opkg_verify_file(char *text_file, char *sig_file)
 355 {
 356 #if defined HAVE_USIGN
 357         int status = -1;
 358         int pid;
 359
 360         if (conf->check_signature == 0)
 361                 return 0;
 362
 363         pid = fork();
 364         if (pid < 0)
 365                 return -1;
 366
 367         if (!pid) {
 368                 execl("/usr/sbin/opkg-key", "opkg-key", "verify", sig_file,
 369                       text_file, NULL);
 370                 exit(255);
 371         }
 372
 373         waitpid(pid, &status, 0);
 374         if (!WIFEXITED(status) || WEXITSTATUS(status))
 375                 return -1;
 376
 377         return 0;
 378 #elif defined HAVE_GPGME
 379         if (conf->check_signature == 0)
 380                 return 0;
 381         int status = -1;
 382         gpgme_ctx_t ctx;
 383         gpgme_data_t sig, text, key;
 384         gpgme_error_t err;
 385         gpgme_verify_result_t result;
 386         gpgme_signature_t s;
 387         char *trusted_path = NULL;
 388
 389         gpgme_check_version(NULL);
 390
 391         err = gpgme_new(&ctx);
 392
 393         if (err)
 394                 return -1;
 395
 396         sprintf_alloc(&trusted_path, "%s/%s", conf->offline_root,
 397                       "/etc/opkg/trusted.gpg");
 398         err = gpgme_data_new_from_file(&key, trusted_path, 1);
 399         free(trusted_path);
 400         if (err) {
 401                 return -1;
 402         }
 403         err = gpgme_op_import(ctx, key);
 404         if (err) {
 405                 gpgme_data_release(key);
 406                 return -1;
 407         }
 408         gpgme_data_release(key);
 409
 410         err = gpgme_data_new_from_file(&sig, sig_file, 1);
 411         if (err) {
 412                 gpgme_release(ctx);
 413                 return -1;
 414         }
 415
 416         err = gpgme_data_new_from_file(&text, text_file, 1);
 417         if (err) {
 418                 gpgme_data_release(sig);
 419                 gpgme_release(ctx);
 420                 return -1;
 421         }
 422
 423         err = gpgme_op_verify(ctx, sig, text, NULL);
 424
 425         result = gpgme_op_verify_result(ctx);
 426         if (!result)
 427                 return -1;
 428
 429         /* see if any of the signitures matched */
 430         s = result->signatures;
 431         while (s) {
 432                 status = gpg_err_code(s->status);
 433                 if (status == GPG_ERR_NO_ERROR)
 434                         break;
 435                 s = s->next;
 436         }
 437
 438         gpgme_data_release(sig);
 439         gpgme_data_release(text);
 440         gpgme_release(ctx);
 441
 442         return status;
 443 #elif defined HAVE_OPENSSL
 444         X509_STORE *store = NULL;
 445         PKCS7 *p7 = NULL;
 446         BIO *in = NULL, *indata = NULL;
 447
 448         // Sig check failed by default !
 449         int status = -1;
 450
 451         openssl_init();
 452
 453         // Set-up the key store
 454         if (!
 455             (store =
 456              setup_verify(conf->signature_ca_file, conf->signature_ca_path))) {
 457                 opkg_msg(ERROR, "Can't open CA certificates.\n");
 458                 goto verify_file_end;
 459         }
 460         // Open a BIO to read the sig file
 461         if (!(in = BIO_new_file(sig_file, "rb"))) {
 462                 opkg_msg(ERROR, "Can't open signature file %s.\n", sig_file);
 463                 goto verify_file_end;
 464         }
 465         // Read the PKCS7 block contained in the sig file
 466         p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL);
 467         if (!p7) {
 468                 opkg_msg(ERROR, "Can't read signature file %s (Corrupted ?).\n",
 469                          sig_file);
 470                 goto verify_file_end;
 471         }
 472
 473         // Open the Package file to authenticate
 474         if (!(indata = BIO_new_file(text_file, "rb"))) {
 475                 opkg_msg(ERROR, "Can't open file %s.\n", text_file);
 476                 goto verify_file_end;
 477         }
 478         // Let's verify the autenticity !
 479         if (PKCS7_verify(p7, NULL, store, indata, NULL, PKCS7_BINARY) != 1) {
 480                 // Get Off My Lawn!
 481                 opkg_msg(ERROR, "Verification failure.\n");
 482         } else {
 483                 // Victory !
 484                 status = 0;
 485         }
 486
 487 verify_file_end:
 488         BIO_free(in);
 489         BIO_free(indata);
 490         PKCS7_free(p7);
 491         X509_STORE_free(store);
 492
 493         return status;
 494 #else
 495         /* mute `unused variable' warnings. */
 496         (void)sig_file;
 497         (void)text_file;
 498         (void)conf;
 499         return 0;
 500 #endif
 501 }
 502
 503 #if defined(HAVE_OPENSSL) || defined(HAVE_SSLCURL)
 504 static void openssl_init(void)
 505 {
 506         static int init = 0;
 507
 508         if (!init) {
 509                 OPENSSL_config(NULL);
 510                 OpenSSL_add_all_algorithms();
 511                 ERR_load_crypto_strings();
 512                 init = 1;
 513         }
 514 }
 515
 516 #endif
 517
 518 #if defined HAVE_OPENSSL
 519 static X509_STORE *setup_verify(char *CAfile, char *CApath)
 520 {
 521         X509_STORE *store = NULL;
 522         X509_LOOKUP *lookup = NULL;
 523
 524         if (!(store = X509_STORE_new())) {
 525                 // Something bad is happening...
 526                 goto end;
 527         }
 528         // adds the X509 file lookup method
 529         lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
 530         if (lookup == NULL) {
 531                 goto end;
 532         }
 533         // Autenticating against one CA file
 534         if (CAfile) {
 535                 if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) {
 536                         // Invalid CA => Bye bye
 537                         opkg_msg(ERROR, "Error loading file %s.\n", CAfile);
 538                         goto end;
 539                 }
 540         } else {
 541                 X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
 542         }
 543
 544         // Now look into CApath directory if supplied
 545         lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
 546         if (lookup == NULL) {
 547                 goto end;
 548         }
 549
 550         if (CApath) {
 551                 if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM)) {
 552                         opkg_msg(ERROR, "Error loading directory %s.\n",
 553                                  CApath);
 554                         goto end;
 555                 }
 556         } else {
 557                 X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
 558         }
 559
 560         // All right !
 561         ERR_clear_error();
 562         return store;
 563
 564 end:
 565
 566         X509_STORE_free(store);
 567         return NULL;
 568
 569 }
 570
 571 #endif
 572
 573 #ifdef HAVE_CURL
 574 void opkg_curl_cleanup(void)
 575 {
 576         if (curl != NULL) {
 577                 curl_easy_cleanup(curl);
 578                 curl = NULL;
 579         }
 580 }
 581
 582 static CURL *opkg_curl_init(curl_progress_func cb, void *data)
 583 {
 584
 585         if (curl == NULL) {
 586                 curl = curl_easy_init();
 587
 588 #ifdef HAVE_SSLCURL
 589                 openssl_init();
 590
 591                 if (conf->ssl_engine) {
 592
 593                         /* use crypto engine */
 594                         if (curl_easy_setopt
 595                             (curl, CURLOPT_SSLENGINE,
 596                              conf->ssl_engine) != CURLE_OK) {
 597                                 opkg_msg(ERROR,
 598                                          "Can't set crypto engine '%s'.\n",
 599                                          conf->ssl_engine);
 600
 601                                 opkg_curl_cleanup();
 602                                 return NULL;
 603                         }
 604                         /* set the crypto engine as default */
 605                         if (curl_easy_setopt
 606                             (curl, CURLOPT_SSLENGINE_DEFAULT, 1L) != CURLE_OK) {
 607                                 opkg_msg(ERROR,
 608                                          "Can't set crypto engine '%s' as default.\n",
 609                                          conf->ssl_engine);
 610
 611                                 opkg_curl_cleanup();
 612                                 return NULL;
 613                         }
 614                 }
 615
 616                 /* cert & key can only be in PEM case in the same file */
 617                 if (conf->ssl_key_passwd) {
 618                         if (curl_easy_setopt
 619                             (curl, CURLOPT_SSLKEYPASSWD,
 620                              conf->ssl_key_passwd) != CURLE_OK) {
 621                                 opkg_msg(DEBUG,
 622                                          "Failed to set key password.\n");
 623                         }
 624                 }
 625
 626                 /* sets the client certificate and its type */
 627                 if (conf->ssl_cert_type) {
 628                         if (curl_easy_setopt
 629                             (curl, CURLOPT_SSLCERTTYPE,
 630                              conf->ssl_cert_type) != CURLE_OK) {
 631                                 opkg_msg(DEBUG,
 632                                          "Failed to set certificate format.\n");
 633                         }
 634                 }
 635                 /* SSL cert name isn't mandatory */
 636                 if (conf->ssl_cert) {
 637                         curl_easy_setopt(curl, CURLOPT_SSLCERT, conf->ssl_cert);
 638                 }
 639
 640                 /* sets the client key and its type */
 641                 if (conf->ssl_key_type) {
 642                         if (curl_easy_setopt
 643                             (curl, CURLOPT_SSLKEYTYPE,
 644                              conf->ssl_key_type) != CURLE_OK) {
 645                                 opkg_msg(DEBUG, "Failed to set key format.\n");
 646                         }
 647                 }
 648                 if (conf->ssl_key) {
 649                         if (curl_easy_setopt
 650                             (curl, CURLOPT_SSLKEY, conf->ssl_key) != CURLE_OK) {
 651                                 opkg_msg(DEBUG, "Failed to set key.\n");
 652                         }
 653                 }
 654
 655                 /* Should we verify the peer certificate ? */
 656                 if (conf->ssl_dont_verify_peer) {
 657                         /*
 658                          * CURLOPT_SSL_VERIFYPEER default is nonzero (curl => 7.10)
 659                          */
 660                         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0);
 661                 }
 662
 663                 /* certification authority file and/or path */
 664                 if (conf->ssl_ca_file) {
 665                         curl_easy_setopt(curl, CURLOPT_CAINFO,
 666                                          conf->ssl_ca_file);
 667                 }
 668                 if (conf->ssl_ca_path) {
 669                         curl_easy_setopt(curl, CURLOPT_CAPATH,
 670                                          conf->ssl_ca_path);
 671                 }
 672 #endif
 673
 674                 curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
 675                 curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1);
 676                 if (conf->http_proxy || conf->ftp_proxy) {
 677                         char *userpwd;
 678                         sprintf_alloc(&userpwd, "%s:%s", conf->proxy_user,
 679                                       conf->proxy_passwd);
 680                         curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
 681                         free(userpwd);
 682                 }
 683         }
 684
 685         curl_easy_setopt(curl, CURLOPT_NOPROGRESS, (cb == NULL));
 686         if (cb) {
 687                 curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, data);
 688                 curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, cb);
 689         }
 690
 691         return curl;
 692
 693 }
 694 #endif