aheinecke@10: #include "downloader.h"
aheinecke@10: 
aheinecke@10: #ifndef DOWNLOAD_SERVER
aheinecke@10: #define DOWNLOAD_SERVER "https://www.intevation.de"
aheinecke@10: #endif
aheinecke@10: 
aheinecke@10: #include <QFile>
aheinecke@15: #include <QDir>
aheinecke@10: #include <QDebug>
aheinecke@15: #include <QStandardPaths>
andre@27: #include <QUuid>
andre@27: #include <QApplication>
andre@27: 
andre@27: #include <polarssl/net.h>
andre@27: #include <polarssl/ssl.h>
andre@27: #include <polarssl/entropy.h>
andre@27: #include <polarssl/ctr_drbg.h>
andre@27: #include <polarssl/error.h>
andre@27: #include <polarssl/certs.h>
andre@27: 
andre@27: #define MAX_SW_SIZE 10485760
andre@27: #define MAX_LIST_SIZE 1048576
andre@27: 
andre@27: QString getErrorMsg(int ret)
andre@27: {
andre@27:     char errbuf[255];
andre@27:     polarssl_strerror(ret, errbuf, 255);
andre@27:     errbuf[254] = '\0'; /* Just to be sure */
andre@27:     return QString::fromLatin1(errbuf);
andre@27: }
aheinecke@10: 
aheinecke@15: Downloader::Downloader(QObject* parent, const QString& url,
aheinecke@15:                        const QByteArray& certificate,
aheinecke@15:                        const QDateTime& newestSW,
aheinecke@15:                        const QDateTime& newestList):
aheinecke@12:     QThread(parent),
aheinecke@15:     mUrl(url),
andre@27:     mPinnedCert(certificate),
aheinecke@15:     mLastModSW(newestSW),
andre@27:     mLastModList(newestList),
andre@27:     mErrorState(NoError),
andre@27:     mInitialized(false),
andre@27:     mServerFD(-1)
aheinecke@10: {
andre@27:     int ret = -1;
andre@27: 
andre@27:     memset(&mSSL, 0, sizeof(ssl_context));
andre@27: 
aheinecke@15:     if (certificate.isEmpty()) {
aheinecke@18:         QFile certResource(":certs/kolab.org");
aheinecke@15:         certResource.open(QFile::ReadOnly);
andre@27:         mPinnedCert = certResource.readAll();
aheinecke@15:         certResource.close();
aheinecke@15:     }
andre@27: 
andre@27:     ret = init();
andre@27:     if (ret == 0) {
andre@27:         mInitialized = true;
andre@27:     } else {
andre@27:         qDebug() << "Initialization error: " + getErrorMsg(ret);
andre@27:     }
andre@27: }
andre@27: 
andre@27: int Downloader::init()
andre@27: {
andre@27:     int ret = -1;
andre@27:     QUuid uuid = QUuid::createUuid();
andre@27:     QString personalString = QApplication::applicationName() + uuid.toString();
andre@27:     QByteArray personalBa = personalString.toLocal8Bit();
andre@27: 
andre@27:     x509_crt_init(&mX509PinnedCert);
andre@27:     entropy_init(&mEntropy);
andre@27: 
andre@27:     ret = ssl_init(&mSSL);
andre@27:     if (ret != 0) {
andre@27:         /* The only documented error is malloc failed */
andre@27:         mErrorState = ErrUnknown;
andre@27:         return ret;
andre@27:     }
andre@27: 
andre@27:     /*
andre@27:      * Initialize random generator.
andre@27:      * Personalisation string, does not need to be random but
andre@27:      * should be unique according to documentation.
andre@27:      *
andre@27:      * the ctr_drbg structure does not need to be freed explicitly.
andre@27:      */
andre@27:     ret = ctr_drbg_init(&mCtr_drbg, entropy_func, &mEntropy,
andre@27:                         (const unsigned char*) personalBa.constData(),
andre@27:                         personalBa.size());
andre@27:     if (ret != 0) {
andre@27:         ssl_free(&mSSL);
andre@27:         mErrorState = ErrUnknown;
andre@27:         return ret;
andre@27:     }
andre@27: 
andre@27:     ret = x509_crt_parse(&mX509PinnedCert,
andre@27:                          (const unsigned char*) mPinnedCert.constData(),
andre@27:                          mPinnedCert.size());
andre@27:     if (ret != 0){
andre@27:         ssl_free(&mSSL);
andre@27:         mErrorState = InvalidPinnedCertificate;
andre@27:         return ret;
andre@27:     }
andre@27: 
andre@27:     ssl_set_endpoint(&mSSL, SSL_IS_CLIENT);
andre@27:     ssl_set_authmode(&mSSL, SSL_VERIFY_OPTIONAL);
andre@27:     ssl_set_ca_chain(&mSSL, &mX509PinnedCert, NULL, NULL);
andre@27:     ssl_set_renegotiation(&mSSL, SSL_RENEGOTIATION_DISABLED);
andre@27:     ssl_set_rng(&mSSL, ctr_drbg_random, &mCtr_drbg);
andre@27: 
andre@27:     return 0;
andre@27: }
andre@27: 
andre@27: Downloader::~Downloader() {
andre@27:     x509_crt_free(&mX509PinnedCert);
andre@27:     entropy_free(&mEntropy);
andre@27:     if (mInitialized) {
andre@27:         ssl_free(&mSSL);
andre@27:     }
aheinecke@10: }
aheinecke@10: 
aheinecke@15: QString Downloader::getDataDirectory()
aheinecke@10: {
aheinecke@15:     QString candidate =
aheinecke@15:         QStandardPaths::writableLocation(QStandardPaths::DataLocation);
aheinecke@12: 
aheinecke@15:     if (candidate.isEmpty()) {
aheinecke@15:         qDebug() << "Could not find writeable locaction for me";
aheinecke@15:         return QString();
aheinecke@15:     }
aheinecke@15: 
aheinecke@15:     QDir cDir(candidate);
aheinecke@15: 
aheinecke@15:     if (!cDir.exists()) {
aheinecke@15:         if (!cDir.mkpath(candidate)) {
aheinecke@15:             qDebug() << "Could not create path to: " << candidate;
aheinecke@15:             return QString();
aheinecke@15:         }
aheinecke@15:     }
aheinecke@15:     return cDir.absolutePath();
aheinecke@10: }
andre@27: 
andre@27: int Downloader::establishSSLConnection() {
andre@27:     int ret = -1;
andre@27:     const x509_crt *peerCert;
andre@27: 
andre@27:     mErrorState = ErrUnknown;
andre@27: 
andre@27:     if (mServerFD == -1) {
andre@27:         return -1;
andre@27:     }
andre@27: 
andre@27:     ssl_set_bio(&mSSL, net_recv, &mServerFD,
andre@27:                        net_send, &mServerFD);
andre@27: 
andre@27:     while ((ret = ssl_handshake(&mSSL)) != 0) {
andre@27:         if (ret != POLARSSL_ERR_NET_WANT_READ &&
andre@27:                 ret != POLARSSL_ERR_NET_WANT_WRITE) {
andre@27:             qDebug() << "SSL Handshake failed: "
andre@27:                  << getErrorMsg(ret);
andre@27:             return ret;
andre@27:         }
andre@27:     }
andre@27: 
andre@27:     ret = ssl_get_verify_result(&mSSL);
andre@27: 
andre@27:     if (ret != 0 ) {
andre@27: 
andre@27:         if( ( ret & BADCERT_EXPIRED ) != 0 )
andre@27:             qDebug() << "server certificate has expired";
andre@27: 
andre@27:         if( ( ret & BADCERT_REVOKED ) != 0 )
andre@27:             qDebug() << "server certificate has been revoked";
andre@27: 
andre@27:         if( ( ret & BADCERT_CN_MISMATCH ) != 0 )
andre@27:             qDebug() << "CN mismatch";
andre@27: 
andre@27:         if( ( ret & BADCERT_NOT_TRUSTED ) != 0 )
andre@27:             qDebug() << "self-signed or not signed by a trusted CA";
andre@27: 
andre@27: #ifdef RELEASE_BUILD
andre@27:         return -1;
andre@27: #endif
andre@27:     }
andre@27: 
andre@27:     peerCert = ssl_get_peer_cert(&mSSL);
andre@27: 
andre@27:     if (!peerCert) {
andre@27:         mErrorState = InvalidCertificate;
andre@27:         qDebug() << "Failed to get peer cert";
andre@27:         return -1;
andre@27:     }
andre@27: 
andre@27:     if (peerCert->raw.len == 0 ||
andre@27:         peerCert->raw.len != mX509PinnedCert.raw.len) {
andre@27:         mErrorState = InvalidCertificate;
andre@27:         qDebug() << "Certificate length mismatch";
andre@27:         return -1;
andre@27:     }
andre@27: 
andre@27:     /* You can never be sure what those c++ operators do..
andre@27:     if (mPinnedCert != QByteArray::fromRawData(
andre@27:                 (const char*) peerCert->raw.p,
andre@27:             peerCert->raw.len)) {
andre@27:         qDebug() << "Certificate content mismatch";
andre@27:     }
andre@27:     */
andre@27: 
andre@27:     for (unsigned int i = 0; i < peerCert->raw.len; i++) {
andre@27:         if (peerCert->raw.p[i] != mX509PinnedCert.raw.p[i]) {
andre@27:             qDebug() << "Certificate content mismatch";
andre@27:             mErrorState = InvalidCertificate;
andre@27:             return -1;
andre@27:         }
andre@27:     }
andre@27:     mErrorState = NoError;
andre@27:     return 0;
andre@27: }
andre@27: 
andre@27: 
andre@27: void Downloader::run() {
andre@27:     int ret;
andre@27: 
andre@27:     if (!mInitialized) {
andre@27:         emit error(tr("Failed to initialize SSL Module."), ErrUnknown);
andre@27:         return;
andre@27:     }
andre@27: 
andre@27:     ret = net_connect(&mServerFD, mUrl.host().toLatin1().constData(),
andre@27:             mUrl.port(443));
andre@27:     if (ret != 0) {
andre@27:         mErrorState = NoConnection;
andre@27:         emit error(tr("Failed to connect to %1.").arg(mUrl.host()),
andre@27:                 mErrorState);
andre@27:         return;
andre@27:     }
andre@27: 
andre@27:     emit progress(tr("Connected"), 1, -1);
andre@27: 
andre@27:     ret = establishSSLConnection();
andre@27:     if (ret != 0) {
andre@27:         qDebug() << "SSL conncetion failed: " << getErrorMsg(ret);
andre@27:         emit error(tr("Failed to connect to %1.").arg(mUrl.host()),
andre@27:                 mErrorState);
andre@27:         return;
andre@27:     }
andre@27: 
andre@27:     qDebug() << "Connected to: " << mUrl.host();
andre@27:     // TODO
andre@27: 
andre@27:     emit progress(tr("Closing"), 1, -1);
andre@27:     ssl_close_notify (&mSSL);
andre@27: 
andre@27:     if (mServerFD != -1) {
andre@27:         net_close(mServerFD);
andre@27:         mServerFD = -1;
andre@27:     }
andre@27: }