zeroinstall/injector/_download_child.py

   1 # Copyright (C) 2011, Thomas Leonard
   2 # See the README file for details, or visit http://0install.net.
   3
   4 import sys, os, socket, ssl
   5
   6 from zeroinstall import _
   7 from zeroinstall.injector import download
   8 from zeroinstall.support import ssl_match_hostname
   9
  10 import urllib2, httplib
  11
  12 try:
  13         # http://pypi.python.org/pypi/certifi
  14         import certifi
  15         _fallback_ca_bundle = certifi.where()
  16 except:
  17         # Final fallback (last known signer of keylookup)
  18         _fallback_ca_bundle = os.path.join(os.path.dirname(__file__), "EquifaxSecureCA.crt")
  19
  20 # Note: on MacOS X at least, it will also look in the system keychain provided that you supply *some* CAs.
  21 # (if you don't specify any trusted CAs, Python trusts everything!)
  22 # So, the "fallback" option doesn't necessarily mean that other sites won't work.
  23 for ca_bundle in [
  24                 "/etc/ssl/certs/ca-certificates.crt",   # Debian/Ubuntu/Arch Linux
  25                 "/etc/pki/tls/certs/ca-bundle.crt",     # Fedora/RHEL
  26                 "/etc/ssl/ca-bundle.pem",               # openSUSE/SLE (claimed)
  27                 "/var/lib/ca-certificates/ca-bundle.pem.new", # openSUSE (actual)
  28                 _fallback_ca_bundle]:
  29         if os.path.exists(ca_bundle):
  30                 class ValidatingHTTPSConnection(httplib.HTTPSConnection):
  31                         def connect(self):
  32                                 sock = socket.create_connection((self.host, self.port), self.timeout)
  33                                 if hasattr(self, '_tunnel_host') and self._tunnel_host:
  34                                         self.sock = sock
  35                                         self._tunnel()
  36                                 sock = ssl.wrap_socket(sock, cert_reqs = ssl.CERT_REQUIRED, ca_certs = ca_bundle)
  37                                 ssl_match_hostname.match_hostname(sock.getpeercert(), self.host)
  38                                 self.sock = sock
  39
  40                 class ValidatingHTTPSHandler(urllib2.HTTPSHandler):
  41                         def https_open(self, req):
  42                                 return self.do_open(self.getConnection, req)
  43
  44                         def getConnection(self, host, timeout=300):
  45                                 return ValidatingHTTPSConnection(host)
  46                 MyHTTPSHandler = ValidatingHTTPSHandler
  47                 break
  48 else:
  49         raise Exception("No root CA's found (not even the built-in one!); security of HTTPS connections cannot be verified")
  50
  51 class Redirect(Exception):
  52         def __init__(self, req):
  53                 Exception.__init__(self, "Redirect")
  54                 self.req = req
  55
  56 class MyRedirectHandler(urllib2.HTTPRedirectHandler):
  57         """Throw an exception on redirects instead of continuing. The redirect will be handled in the main thread
  58         so it can work with connection pooling."""
  59         def redirect_request(self, req, fp, code, msg, headers, newurl):
  60                 new_req = urllib2.HTTPRedirectHandler.redirect_request(self, req, fp, code, msg, headers, newurl)
  61                 if new_req:
  62                         raise Redirect(new_req)
  63
  64 # Our handler differs from the Python default in that:
  65 # - we don't support file:// URLs
  66 # - we don't follow HTTP redirects
  67 _my_urlopen = urllib2.OpenerDirector()
  68 for klass in [urllib2.ProxyHandler, urllib2.UnknownHandler, urllib2.HTTPHandler,
  69                        urllib2.HTTPDefaultErrorHandler, MyRedirectHandler,
  70                        urllib2.FTPHandler, urllib2.HTTPErrorProcessor, MyHTTPSHandler]:
  71         _my_urlopen.add_handler(klass())
  72
  73 def download_in_thread(url, target_file, if_modified_since, notify_done):
  74         try:
  75                 #print "Child downloading", url
  76                 if url.startswith('http:') or url.startswith('https:') or url.startswith('ftp:'):
  77                         req = urllib2.Request(url)
  78                         if url.startswith('http:') and if_modified_since:
  79                                 req.add_header('If-Modified-Since', if_modified_since)
  80                         src = _my_urlopen.open(req)
  81                 else:
  82                         raise Exception(_('Unsupported URL protocol in: %s') % url)
  83
  84                 try:
  85                         sock = src.fp._sock
  86                 except AttributeError:
  87                         sock = src.fp.fp._sock  # Python 2.5 on FreeBSD
  88                 while True:
  89                         data = sock.recv(256)
  90                         if not data: break
  91                         target_file.write(data)
  92                         target_file.flush()
  93
  94                 notify_done(download.RESULT_OK)
  95         except (urllib2.HTTPError, urllib2.URLError, httplib.HTTPException, socket.error) as ex:
  96                 if isinstance(ex, urllib2.HTTPError) and ex.code == 304: # Not modified
  97                         notify_done(download.RESULT_NOT_MODIFIED)
  98                 else:
  99                         #print >>sys.stderr, "Error downloading '" + url + "': " + (str(ex) or str(ex.__class__.__name__))
 100                         __, ex, tb = sys.exc_info()
 101                         notify_done(download.RESULT_FAILED, (download.DownloadError(_('Error downloading {url}: {ex}').format(url = url, ex = ex)), tb))
 102         except Redirect as ex:
 103                 notify_done(download.RESULT_REDIRECT, redirect = ex.req.get_full_url())
 104         except Exception as ex:
 105                 __, ex, tb = sys.exc_info()
 106                 notify_done(download.RESULT_FAILED, (ex, tb))