summaryrefslogtreecommitdiff
path: root/methods
diff options
context:
space:
mode:
Diffstat (limited to 'methods')
-rw-r--r--methods/cdrom.cc4
-rw-r--r--methods/gpgv.cc102
-rw-r--r--methods/https.cc26
3 files changed, 80 insertions, 52 deletions
diff --git a/methods/cdrom.cc b/methods/cdrom.cc
index 4bbc01c2c..bf4281e40 100644
--- a/methods/cdrom.cc
+++ b/methods/cdrom.cc
@@ -38,7 +38,7 @@ class CDROMMethod : public pkgAcqMethod
pkgUdevCdromDevices UdevCdroms;
bool IsCorrectCD(URI want, string MountPath, string& NewID);
- bool AutoDetectAndMount(URI, string &NewID);
+ bool AutoDetectAndMount(const URI, string &NewID);
virtual bool Fetch(FetchItem *Itm);
string GetID(string Name);
virtual void Exit();
@@ -92,7 +92,7 @@ string CDROMMethod::GetID(string Name)
// CDROMMethod::AutoDetectAndMount /*{{{*/
// ---------------------------------------------------------------------
/* Modifies class varaiable CDROM to the mountpoint */
-bool CDROMMethod::AutoDetectAndMount(URI Get, string &NewID)
+bool CDROMMethod::AutoDetectAndMount(const URI Get, string &NewID)
{
vector<struct CdromDevice> v = UdevCdroms.Scan();
diff --git a/methods/gpgv.cc b/methods/gpgv.cc
index 150c1d315..c58e6cc45 100644
--- a/methods/gpgv.cc
+++ b/methods/gpgv.cc
@@ -1,10 +1,9 @@
#include <apt-pkg/error.h>
#include <apt-pkg/acquire-method.h>
#include <apt-pkg/strutl.h>
+#include <apt-pkg/fileutl.h>
#include <apti18n.h>
-#include <sys/stat.h>
-#include <unistd.h>
#include <utime.h>
#include <stdio.h>
#include <fcntl.h>
@@ -45,42 +44,47 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
vector<string> &WorthlessSigners,
vector<string> &NoPubKeySigners)
{
+ bool const Debug = _config->FindB("Debug::Acquire::gpgv", false);
// setup a (empty) stringstream for formating the return value
std::stringstream ret;
ret.str("");
- if (_config->FindB("Debug::Acquire::gpgv", false))
- {
- std::cerr << "inside VerifyGetSigners" << std::endl;
- }
+ if (Debug == true)
+ std::clog << "inside VerifyGetSigners" << std::endl;
+
pid_t pid;
int fd[2];
FILE *pipein;
int status;
- struct stat buff;
- string gpgvpath = _config->Find("Dir::Bin::gpg", "/usr/bin/gpgv");
- string pubringpath = _config->Find("APT::GPGV::TrustedKeyring", "/etc/apt/trusted.gpg");
- if (_config->FindB("Debug::Acquire::gpgv", false))
+ string const gpgvpath = _config->Find("Dir::Bin::gpg", "/usr/bin/gpgv");
+ // FIXME: remove support for deprecated APT::GPGV setting
+ string const trustedFile = _config->FindFile("Dir::Etc::Trusted",
+ _config->Find("APT::GPGV::TrustedKeyring", "/etc/apt/trusted.gpg").c_str());
+ string const trustedPath = _config->FindDir("Dir::Etc::TrustedParts", "/etc/apt/trusted.gpg.d");
+ if (Debug == true)
{
- std::cerr << "gpgv path: " << gpgvpath << std::endl;
- std::cerr << "Keyring path: " << pubringpath << std::endl;
+ std::clog << "gpgv path: " << gpgvpath << std::endl;
+ std::clog << "Keyring file: " << trustedFile << std::endl;
+ std::clog << "Keyring path: " << trustedPath << std::endl;
}
- if (stat(pubringpath.c_str(), &buff) != 0)
+ vector<string> keyrings = GetListOfFilesInDir(trustedPath, "gpg", false);
+ if (FileExists(trustedFile) == true)
+ keyrings.push_back(trustedFile);
+
+ if (keyrings.empty() == true)
{
- ioprintf(ret, _("Couldn't access keyring: '%s'"), strerror(errno));
+ // TRANSLATOR: %s is the trusted keyring parts directory
+ ioprintf(ret, _("No keyring installed in %s."), trustedPath.c_str());
return ret.str();
}
+
if (pipe(fd) < 0)
- {
return "Couldn't create pipe";
- }
pid = fork();
if (pid < 0)
- {
return string("Couldn't spawn new process") + strerror(errno);
- }
else if (pid == 0)
{
const char *Args[400];
@@ -90,8 +94,17 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
Args[i++] = "--status-fd";
Args[i++] = "3";
Args[i++] = "--ignore-time-conflict";
- Args[i++] = "--keyring";
- Args[i++] = pubringpath.c_str();
+ for (vector<string>::const_iterator K = keyrings.begin();
+ K != keyrings.end(); ++K)
+ {
+ Args[i++] = "--keyring";
+ Args[i++] = K->c_str();
+ // check overflow (minus a bit of extra space at the end)
+ if(i >= sizeof(Args)/sizeof(char*)-5) {
+ std::clog << _("E: Too many keyrings should be passed to gpgv. Exiting.") << std::endl;
+ exit(111);
+ }
+ }
Configuration::Item const *Opts;
Opts = _config->Tree("Acquire::gpgv::Options");
@@ -103,8 +116,9 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
if (Opts->Value.empty() == true)
continue;
Args[i++] = Opts->Value.c_str();
- if(i >= 395) {
- std::cerr << _("E: Argument list from Acquire::gpgv::Options too long. Exiting.") << std::endl;
+ // check overflow (minus a bit of extra space at the end)
+ if(i >= sizeof(Args)/sizeof(char*)-5) {
+ std::clog << _("E: Argument list from Acquire::gpgv::Options too long. Exiting.") << std::endl;
exit(111);
}
}
@@ -113,14 +127,14 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
Args[i++] = outfile;
Args[i++] = NULL;
- if (_config->FindB("Debug::Acquire::gpgv", false))
+ if (Debug == true)
{
- std::cerr << "Preparing to exec: " << gpgvpath;
+ std::clog << "Preparing to exec: " << gpgvpath;
for(unsigned int j=0;Args[j] != NULL; j++)
- std::cerr << " " << Args[j];
- std::cerr << std::endl;
+ std::clog << " " << Args[j];
+ std::clog << std::endl;
}
- int nullfd = open("/dev/null", O_RDONLY);
+ int const nullfd = open("/dev/null", O_RDONLY);
close(fd[0]);
// Redirect output to /dev/null; we read from the status fd
dup2(nullfd, STDOUT_FILENO);
@@ -159,8 +173,8 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
break;
*(buffer+bufferoff) = '\0';
bufferoff = 0;
- if (_config->FindB("Debug::Acquire::gpgv", false))
- std::cerr << "Read: " << buffer << std::endl;
+ if (Debug == true)
+ std::clog << "Read: " << buffer << std::endl;
// Push the data into three separate vectors, which
// we later concatenate. They're kept separate so
@@ -168,33 +182,33 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
// it will be better.
if (strncmp(buffer, GNUPGBADSIG, sizeof(GNUPGBADSIG)-1) == 0)
{
- if (_config->FindB("Debug::Acquire::gpgv", false))
- std::cerr << "Got BADSIG! " << std::endl;
+ if (Debug == true)
+ std::clog << "Got BADSIG! " << std::endl;
BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
}
if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0)
{
- if (_config->FindB("Debug::Acquire::gpgv", false))
- std::cerr << "Got NO_PUBKEY " << std::endl;
+ if (Debug == true)
+ std::clog << "Got NO_PUBKEY " << std::endl;
NoPubKeySigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
}
if (strncmp(buffer, GNUPGNODATA, sizeof(GNUPGBADSIG)-1) == 0)
{
- if (_config->FindB("Debug::Acquire::gpgv", false))
- std::cerr << "Got NODATA! " << std::endl;
+ if (Debug == true)
+ std::clog << "Got NODATA! " << std::endl;
BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
}
if (strncmp(buffer, GNUPGKEYEXPIRED, sizeof(GNUPGKEYEXPIRED)-1) == 0)
{
- if (_config->FindB("Debug::Acquire::gpgv", false))
- std::cerr << "Got KEYEXPIRED! " << std::endl;
+ if (Debug == true)
+ std::clog << "Got KEYEXPIRED! " << std::endl;
WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
}
if (strncmp(buffer, GNUPGREVKEYSIG, sizeof(GNUPGREVKEYSIG)-1) == 0)
{
- if (_config->FindB("Debug::Acquire::gpgv", false))
- std::cerr << "Got REVKEYSIG! " << std::endl;
+ if (Debug == true)
+ std::clog << "Got REVKEYSIG! " << std::endl;
WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
}
if (strncmp(buffer, GNUPGGOODSIG, sizeof(GNUPGGOODSIG)-1) == 0)
@@ -204,17 +218,17 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
while (*p && isxdigit(*p))
p++;
*p = 0;
- if (_config->FindB("Debug::Acquire::gpgv", false))
- std::cerr << "Got GOODSIG, key ID:" << sig << std::endl;
+ if (Debug == true)
+ std::clog << "Got GOODSIG, key ID:" << sig << std::endl;
GoodSigners.push_back(string(sig));
}
}
fclose(pipein);
waitpid(pid, &status, 0);
- if (_config->FindB("Debug::Acquire::gpgv", false))
+ if (Debug == true)
{
- std::cerr << "gpgv exited\n";
+ std::clog << "gpgv exited\n";
}
if (WEXITSTATUS(status) == 0)
@@ -305,7 +319,7 @@ bool GPGVMethod::Fetch(FetchItem *Itm)
if (_config->FindB("Debug::Acquire::gpgv", false))
{
- std::cerr << "gpgv succeeded\n";
+ std::clog << "gpgv succeeded\n";
}
return true;
diff --git a/methods/https.cc b/methods/https.cc
index 5d8e63f47..aa6786aa8 100644
--- a/methods/https.cc
+++ b/methods/https.cc
@@ -133,7 +133,7 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
string cainfo = _config->Find("Acquire::https::CaInfo","");
string knob = "Acquire::https::"+remotehost+"::CaInfo";
cainfo = _config->Find(knob.c_str(),cainfo.c_str());
- if(cainfo != "")
+ if(cainfo.empty() == false)
curl_easy_setopt(curl, CURLOPT_CAINFO,cainfo.c_str());
// Check server certificate against previous CA list ...
@@ -151,18 +151,25 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
default_verify = 0;
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, verify);
+ // Also enforce issuer of server certificate using its cert
+ string issuercert = _config->Find("Acquire::https::IssuerCert","");
+ knob = "Acquire::https::"+remotehost+"::IssuerCert";
+ issuercert = _config->Find(knob.c_str(),issuercert.c_str());
+ if(issuercert.empty() == false)
+ curl_easy_setopt(curl, CURLOPT_ISSUERCERT,issuercert.c_str());
+
// For client authentication, certificate file ...
string pem = _config->Find("Acquire::https::SslCert","");
knob = "Acquire::https::"+remotehost+"::SslCert";
pem = _config->Find(knob.c_str(),pem.c_str());
- if(pem != "")
+ if(pem.empty() == false)
curl_easy_setopt(curl, CURLOPT_SSLCERT, pem.c_str());
// ... and associated key.
string key = _config->Find("Acquire::https::SslKey","");
knob = "Acquire::https::"+remotehost+"::SslKey";
key = _config->Find(knob.c_str(),key.c_str());
- if(key != "")
+ if(key.empty() == false)
curl_easy_setopt(curl, CURLOPT_SSLKEY, key.c_str());
// Allow forcing SSL version to SSLv3 or TLSv1 (SSLv2 is not
@@ -177,6 +184,13 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
final_version = CURL_SSLVERSION_SSLv3;
curl_easy_setopt(curl, CURLOPT_SSLVERSION, final_version);
+ // CRL file
+ string crlfile = _config->Find("Acquire::https::CrlFile","");
+ knob = "Acquire::https::"+remotehost+"::CrlFile";
+ crlfile = _config->Find(knob.c_str(),crlfile.c_str());
+ if(crlfile.empty() == false)
+ curl_easy_setopt(curl, CURLOPT_CRLFILE, crlfile.c_str());
+
// cache-control
if(_config->FindB("Acquire::https::No-Cache",
_config->FindB("Acquire::http::No-Cache",false)) == false)
@@ -196,7 +210,7 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
// speed limit
- int dlLimit = _config->FindI("Acquire::https::Dl-Limit",
+ int const dlLimit = _config->FindI("Acquire::https::Dl-Limit",
_config->FindI("Acquire::http::Dl-Limit",0))*1024;
if (dlLimit > 0)
curl_easy_setopt(curl, CURLOPT_MAX_RECV_SPEED_LARGE, dlLimit);
@@ -208,7 +222,7 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
"Debian APT-CURL/1.0 ("VERSION")").c_str()).c_str());
// set timeout
- int timeout = _config->FindI("Acquire::https::Timeout",
+ int const timeout = _config->FindI("Acquire::https::Timeout",
_config->FindI("Acquire::http::Timeout",120));
curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, timeout);
//set really low lowspeed timeout (see #497983)
@@ -216,7 +230,7 @@ bool HttpsMethod::Fetch(FetchItem *Itm)
curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, timeout);
// set redirect options and default to 10 redirects
- bool AllowRedirect = _config->FindB("Acquire::https::AllowRedirect",
+ bool const AllowRedirect = _config->FindB("Acquire::https::AllowRedirect",
_config->FindB("Acquire::http::AllowRedirect",true));
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, AllowRedirect);
curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 10);
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-05 22:03:49 +0000