uclient-fetch: load CA certificates
[project/uclient.git] / uclient-fetch.c
index 9672e07..37cc214 100644 (file)
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#define _GNU_SOURCE
 #include <unistd.h>
 #include <stdio.h>
 #include <dlfcn.h>
 #include <getopt.h>
 #include <fcntl.h>
+#include <glob.h>
 
 #include <libubox/blobmsg.h>
 
 #include "uclient.h"
+#include "uclient-utils.h"
 
 #ifdef __APPLE__
 #define LIB_EXT "dylib"
@@ -36,52 +39,42 @@ static struct ustream_ssl_ctx *ssl_ctx;
 static const struct ustream_ssl_ops *ssl_ops;
 static int quiet = false;
 static bool verify = true;
+static bool default_certs = false;
 static const char *output_file;
 static int output_fd = -1;
 static int error_ret;
+static int out_bytes;
+static char *username;
+static char *password;
+static char *auth_str;
 
 static int open_output_file(const char *path, bool create)
 {
-       const char *str;
        char *filename;
-       int len;
        int flags = O_WRONLY;
+       int ret;
 
        if (create)
-               flags |= O_CREAT;
+               flags |= O_CREAT | O_EXCL;
 
        if (output_file) {
                if (!strcmp(output_file, "-"))
                        return STDOUT_FILENO;
 
-               return open(output_file, flags, 0644);
-       }
-
-       /* Don't automatically overwrite files if the name is derived from the URL */
-       if (create)
-               flags |= O_EXCL;
-
-       len = strcspn(path, ";&");
-       while (len > 0 && path[len - 1] == '/')
-               len--;
+               if (!quiet)
+                       fprintf(stderr, "Writing to stdout\n");
 
-       for (str = path + len - 1; str >= path; str--) {
-               if (*str == '/')
-                       break;
+               unlink(output_file);
+               return open(output_file, flags, 0644);
        }
 
-       str++;
-       len -= str - path;
-
-       if (len > 0) {
-               filename = alloca(len + 1);
-               strncpy(filename, str, len);
-               filename[len] = 0;
-       } else {
-               filename = "index.html";
-       }
+       filename = uclient_get_url_filename(path, "index.html");
+       if (!quiet)
+               fprintf(stderr, "Writing to '%s'\n", filename);
+       ret = open(filename, flags, 0644);
+       free(filename);
 
-       return open(filename, flags, 0644);
+       return ret;
 }
 
 static void request_done(struct uclient *cl)
@@ -141,6 +134,7 @@ static void read_data_cb(struct uclient *cl)
                if (!len)
                        return;
 
+               out_bytes += len;
                write(output_fd, buf, len);
        }
 }
@@ -154,19 +148,41 @@ static void msg_connecting(struct uclient *cl)
                return;
 
        uclient_get_addr(addr, &port, &cl->remote_addr);
-       fprintf(stderr, "Connecting to %s %s:%d\n", cl->url->host, addr, port);
+       fprintf(stderr, "Connecting to %s:%d\n", addr, port);
 }
 
-static void init_request(struct uclient *cl)
+static int init_request(struct uclient *cl)
 {
-       uclient_connect(cl);
+       int rc;
+
+       out_bytes = 0;
+
+       rc = uclient_connect(cl);
+       if (rc)
+               return rc;
+
        msg_connecting(cl);
-       uclient_http_set_request_type(cl, "GET");
-       uclient_request(cl);
+
+       rc = uclient_http_set_request_type(cl, "GET");
+       if (rc)
+               return rc;
+
+       rc = uclient_request(cl);
+       if (rc)
+               return rc;
+
+       return 0;
 }
 
 static void eof_cb(struct uclient *cl)
 {
+       if (!cl->data_eof) {
+               if (!quiet)
+                       fprintf(stderr, "Connection reset prematurely\n");
+               error_ret = 4;
+       } else if (!quiet) {
+               fprintf(stderr, "Download completed (%d bytes)\n", out_bytes);
+       }
        request_done(cl);
 }
 
@@ -180,6 +196,10 @@ static void handle_uclient_error(struct uclient *cl, int code)
                type = "Connection failed";
                error_ret = 4;
                break;
+       case UCLIENT_ERROR_TIMEDOUT:
+               type = "Connection timed out";
+               error_ret = 4;
+               break;
        case UCLIENT_ERROR_SSL_INVALID_CERT:
                type = "Invalid SSL certificate";
                ignore = !verify;
@@ -226,6 +246,15 @@ static int usage(const char *progname)
        return 1;
 }
 
+static void init_ca_cert(void)
+{
+       glob_t gl;
+       int i;
+
+       glob("/etc/ssl/certs/*.crt", 0, NULL, &gl);
+       for (i = 0; i < gl.gl_pathc; i++)
+               ssl_ops->context_add_ca_crt_file(ssl_ctx, gl.gl_pathv[i]);
+}
 
 static void init_ustream_ssl(void)
 {
@@ -251,11 +280,15 @@ static int no_ssl(const char *progname)
 enum {
        L_NO_CHECK_CERTIFICATE,
        L_CA_CERTIFICATE,
+       L_USER,
+       L_PASSWORD,
 };
 
 static const struct option longopts[] = {
        [L_NO_CHECK_CERTIFICATE] = { "no-check-certificate", no_argument },
        [L_CA_CERTIFICATE] = { "ca-certificate", required_argument },
+       [L_USER] = { "user", required_argument },
+       [L_PASSWORD] = { "password", required_argument },
        {}
 };
 
@@ -265,6 +298,8 @@ int main(int argc, char **argv)
        struct uclient *cl;
        int ch;
        int longopt_idx = 0;
+       bool has_cert = false;
+       int rc;
 
        init_ustream_ssl();
 
@@ -276,9 +311,22 @@ int main(int argc, char **argv)
                                verify = false;
                                break;
                        case L_CA_CERTIFICATE:
+                               has_cert = true;
                                if (ssl_ctx)
                                        ssl_ops->context_add_ca_crt_file(ssl_ctx, optarg);
                                break;
+                       case L_USER:
+                               if (!strlen(optarg))
+                                       break;
+                               username = strdup(optarg);
+                               memset(optarg, '*', strlen(optarg));
+                               break;
+                       case L_PASSWORD:
+                               if (!strlen(optarg))
+                                       break;
+                               password = strdup(optarg);
+                               memset(optarg, '*', strlen(optarg));
+                               break;
                        default:
                                return usage(progname);
                        }
@@ -297,6 +345,9 @@ int main(int argc, char **argv)
        argv += optind;
        argc -= optind;
 
+       if (verify && !has_cert)
+               default_certs = true;
+
        if (argc != 1)
                return usage(progname);
 
@@ -305,17 +356,36 @@ int main(int argc, char **argv)
 
        uloop_init();
 
-       cl = uclient_new(argv[0], NULL, &cb);
+       if (username) {
+               if (password)
+                       asprintf(&auth_str, "%s:%s", username, password);
+               else
+                       auth_str = username;
+       }
+
+       if (!quiet)
+               fprintf(stderr, "Downloading '%s'\n", argv[0]);
+
+       cl = uclient_new(argv[0], auth_str, &cb);
        if (!cl) {
                fprintf(stderr, "Failed to allocate uclient context\n");
                return 1;
        }
 
-       if (ssl_ctx)
+       if (ssl_ctx) {
+               init_ca_cert();
                uclient_http_set_ssl_ctx(cl, ssl_ops, ssl_ctx, verify);
+       }
+
+       rc = init_request(cl);
+       if (!rc) {
+               /* no error received, we can enter main loop */
+               uloop_run();
+       } else {
+               fprintf(stderr, "Failed to establish connection\n");
+               error_ret = 4;
+       }
 
-       init_request(cl);
-       uloop_run();
        uloop_done();
 
        uclient_free(cl);