zeroinstall/injector/_download_child.py

   1 # Copyright (C) 2011, Thomas Leonard
   2 # See the README file for details, or visit http://0install.net.
   3
   4 import sys, os, socket, ssl
   5
   6 from zeroinstall import _
   7 from zeroinstall.injector import download
   8 from zeroinstall.support import ssl_match_hostname
   9
  10 import urllib2, httplib
  11
  12 # Note: on MacOS X at least, it will also look in the system keychain provided that you supply *some* CAs.
  13 # (if you don't specify any trusted CAs, Python trusts everything!)
  14 # So, the "fallback" option doesn't necessarily mean that other sites won't work.
  15 for ca_bundle in [
  16                 "/etc/ssl/certs/ca-certificates.crt",   # Debian/Ubuntu/Arch Linux
  17                 "/etc/pki/tls/certs/ca-bundle.crt",     # Fedora/RHEL
  18                 "/etc/ssl/ca-bundle.pem",               # openSUSE/SLE (claimed)
  19                 "/var/lib/ca-certificates/ca-bundle.pem.new", # openSUSE (actual)
  20                 os.path.join(os.path.dirname(__file__), "EquifaxSecureCA.crt"), # Fallback (last known signer of keylookup)
  21                 ]:
  22         if os.path.exists(ca_bundle):
  23                 class ValidatingHTTPSConnection(httplib.HTTPSConnection):
  24                         def connect(self):
  25                                 sock = socket.create_connection((self.host, self.port), self.timeout)
  26                                 if self._tunnel_host:
  27                                         self.sock = sock
  28                                         self._tunnel()
  29                                 sock = ssl.wrap_socket(sock, cert_reqs = ssl.CERT_REQUIRED, ca_certs = ca_bundle)
  30                                 ssl_match_hostname.match_hostname(sock.getpeercert(), self.host)
  31                                 self.sock = sock
  32
  33                 class ValidatingHTTPSHandler(urllib2.HTTPSHandler):
  34                         def https_open(self, req):
  35                                 return self.do_open(self.getConnection, req)
  36
  37                         def getConnection(self, host, timeout=300):
  38                                 return ValidatingHTTPSConnection(host)
  39                 MyHTTPSHandler = ValidatingHTTPSHandler
  40                 break
  41 else:
  42         raise Exception("No root CA's found (not even the built-in one!); security of HTTPS connections cannot be verified")
  43
  44 class Redirect(Exception):
  45         def __init__(self, req):
  46                 Exception.__init__(self, "Redirect")
  47                 self.req = req
  48
  49 class MyRedirectHandler(urllib2.HTTPRedirectHandler):
  50         """Throw an exception on redirects instead of continuing. The redirect will be handled in the main thread
  51         so it can work with connection pooling."""
  52         def redirect_request(self, req, fp, code, msg, headers, newurl):
  53                 new_req = urllib2.HTTPRedirectHandler.redirect_request(self, req, fp, code, msg, headers, newurl)
  54                 if new_req:
  55                         raise Redirect(new_req)
  56
  57 # Our handler differs from the Python default in that:
  58 # - we don't support file:// URLs
  59 # - we don't follow HTTP redirects
  60 _my_urlopen = urllib2.OpenerDirector()
  61 for klass in [urllib2.ProxyHandler, urllib2.UnknownHandler, urllib2.HTTPHandler,
  62                        urllib2.HTTPDefaultErrorHandler, MyRedirectHandler,
  63                        urllib2.FTPHandler, urllib2.HTTPErrorProcessor, MyHTTPSHandler]:
  64         _my_urlopen.add_handler(klass())
  65
  66 def download_in_thread(url, target_file, if_modified_since, notify_done):
  67         try:
  68                 #print "Child downloading", url
  69                 if url.startswith('http:') or url.startswith('https:') or url.startswith('ftp:'):
  70                         req = urllib2.Request(url)
  71                         if url.startswith('http:') and if_modified_since:
  72                                 req.add_header('If-Modified-Since', if_modified_since)
  73                         src = _my_urlopen.open(req)
  74                 else:
  75                         raise Exception(_('Unsupported URL protocol in: %s') % url)
  76
  77                 try:
  78                         sock = src.fp._sock
  79                 except AttributeError:
  80                         sock = src.fp.fp._sock  # Python 2.5 on FreeBSD
  81                 while True:
  82                         data = sock.recv(256)
  83                         if not data: break
  84                         target_file.write(data)
  85                         target_file.flush()
  86
  87                 notify_done(download.RESULT_OK)
  88         except (urllib2.HTTPError, urllib2.URLError, httplib.HTTPException, socket.error) as ex:
  89                 if isinstance(ex, urllib2.HTTPError) and ex.code == 304: # Not modified
  90                         notify_done(download.RESULT_NOT_MODIFIED)
  91                 else:
  92                         #print >>sys.stderr, "Error downloading '" + url + "': " + (str(ex) or str(ex.__class__.__name__))
  93                         __, ex, tb = sys.exc_info()
  94                         notify_done(download.RESULT_FAILED, (download.DownloadError(_('Error downloading {url}: {ex}').format(url = url, ex = ex)), tb))
  95         except Redirect as ex:
  96                 notify_done(download.RESULT_REDIRECT, redirect = ex.req.get_full_url())
  97         except Exception as ex:
  98                 __, ex, tb = sys.exc_info()
  99                 notify_done(download.RESULT_FAILED, (ex, tb))