safing-portmaster/base/updater/fetch.go

package updater

// import (
// 	"bytes"
// 	"context"
// 	"errors"
// 	"fmt"
// 	"hash"
// 	"io"
// 	"net/http"
// 	"net/url"
// 	"os"
// 	"path"
// 	"path/filepath"
// 	"time"

// 	"github.com/safing/jess/filesig"
// 	"github.com/safing/jess/lhash"
// 	"github.com/safing/portmaster/base/log"
// 	"github.com/safing/portmaster/base/utils/renameio"
// )

// func (reg *ResourceRegistry) fetchFile(ctx context.Context, client *http.Client, rv *ResourceVersion, tries int) error {
// 	// backoff when retrying
// 	if tries > 0 {
// 		select {
// 		case <-ctx.Done():
// 			return nil // module is shutting down
// 		case <-time.After(time.Duration(tries*tries) * time.Second):
// 		}
// 	}

// 	// check destination dir
// 	dirPath := filepath.Dir(rv.storagePath())
// 	err := reg.storageDir.EnsureAbsPath(dirPath)
// 	if err != nil {
// 		return fmt.Errorf("could not create updates folder: %s", dirPath)
// 	}

// 	// If verification is enabled, download signature first.
// 	var (
// 		verifiedHash *lhash.LabeledHash
// 		sigFileData  []byte
// 	)
// 	if rv.resource.VerificationOptions != nil {
// 		verifiedHash, sigFileData, err = reg.fetchAndVerifySigFile(
// 			ctx, client,
// 			rv.resource.VerificationOptions,
// 			rv.versionedSigPath(), rv.SigningMetadata(),
// 			tries,
// 		)
// 		if err != nil {
// 			switch rv.resource.VerificationOptions.DownloadPolicy {
// 			case SignaturePolicyRequire:
// 				return fmt.Errorf("signature verification failed: %w", err)
// 			case SignaturePolicyWarn:
// 				log.Warningf("%s: failed to verify downloaded signature of %s: %s", reg.Name, rv.versionedPath(), err)
// 			case SignaturePolicyDisable:
// 				log.Debugf("%s: failed to verify downloaded signature of %s: %s", reg.Name, rv.versionedPath(), err)
// 			}
// 		}
// 	}

// 	// open file for writing
// 	atomicFile, err := renameio.TempFile(reg.tmpDir.Path, rv.storagePath())
// 	if err != nil {
// 		return fmt.Errorf("could not create temp file for download: %w", err)
// 	}
// 	defer atomicFile.Cleanup() //nolint:errcheck // ignore error for now, tmp dir will be cleaned later again anyway

// 	// start file download
// 	resp, downloadURL, err := reg.makeRequest(ctx, client, rv.versionedPath(), tries)
// 	if err != nil {
// 		return err
// 	}
// 	defer func() {
// 		_ = resp.Body.Close()
// 	}()

// 	// Write to the hasher at the same time, if needed.
// 	var hasher hash.Hash
// 	var writeDst io.Writer = atomicFile
// 	if verifiedHash != nil {
// 		hasher = verifiedHash.Algorithm().RawHasher()
// 		writeDst = io.MultiWriter(hasher, atomicFile)
// 	}

// 	// Download and write file.
// 	n, err := io.Copy(writeDst, resp.Body)
// 	if err != nil {
// 		return fmt.Errorf("failed to download %q: %w", downloadURL, err)
// 	}
// 	if resp.ContentLength != n {
// 		return fmt.Errorf("failed to finish download of %q: written %d out of %d bytes", downloadURL, n, resp.ContentLength)
// 	}

// 	// Before file is finalized, check if hash, if available.
// 	if hasher != nil {
// 		downloadDigest := hasher.Sum(nil)
// 		if verifiedHash.EqualRaw(downloadDigest) {
// 			log.Infof("%s: verified signature of %s", reg.Name, downloadURL)
// 		} else {
// 			switch rv.resource.VerificationOptions.DownloadPolicy {
// 			case SignaturePolicyRequire:
// 				return errors.New("file does not match signed checksum")
// 			case SignaturePolicyWarn:
// 				log.Warningf("%s: checksum does not match file from %s", reg.Name, downloadURL)
// 			case SignaturePolicyDisable:
// 				log.Debugf("%s: checksum does not match file from %s", reg.Name, downloadURL)
// 			}

// 			// Reset hasher to signal that the sig should not be written.
// 			hasher = nil
// 		}
// 	}

// 	// Write signature file, if we have one and if verification succeeded.
// 	if len(sigFileData) > 0 && hasher != nil {
// 		sigFilePath := rv.storagePath() + filesig.Extension
// 		err := os.WriteFile(sigFilePath, sigFileData, 0o0644) //nolint:gosec
// 		if err != nil {
// 			switch rv.resource.VerificationOptions.DownloadPolicy {
// 			case SignaturePolicyRequire:
// 				return fmt.Errorf("failed to write signature file %s: %w", sigFilePath, err)
// 			case SignaturePolicyWarn:
// 				log.Warningf("%s: failed to write signature file %s: %s", reg.Name, sigFilePath, err)
// 			case SignaturePolicyDisable:
// 				log.Debugf("%s: failed to write signature file %s: %s", reg.Name, sigFilePath, err)
// 			}
// 		}
// 	}

// 	// finalize file
// 	err = atomicFile.CloseAtomicallyReplace()
// 	if err != nil {
// 		return fmt.Errorf("%s: failed to finalize file %s: %w", reg.Name, rv.storagePath(), err)
// 	}
// 	// set permissions
// 	if !onWindows {
// 		// TODO: only set executable files to 0755, set other to 0644
// 		err = os.Chmod(rv.storagePath(), 0o0755) //nolint:gosec // See TODO above.
// 		if err != nil {
// 			log.Warningf("%s: failed to set permissions on downloaded file %s: %s", reg.Name, rv.storagePath(), err)
// 		}
// 	}

// 	log.Debugf("%s: fetched %s and stored to %s", reg.Name, downloadURL, rv.storagePath())
// 	return nil
// }

// func (reg *ResourceRegistry) fetchMissingSig(ctx context.Context, client *http.Client, rv *ResourceVersion, tries int) error {
// 	// backoff when retrying
// 	if tries > 0 {
// 		select {
// 		case <-ctx.Done():
// 			return nil // module is shutting down
// 		case <-time.After(time.Duration(tries*tries) * time.Second):
// 		}
// 	}

// 	// Check destination dir.
// 	dirPath := filepath.Dir(rv.storagePath())
// 	err := reg.storageDir.EnsureAbsPath(dirPath)
// 	if err != nil {
// 		return fmt.Errorf("could not create updates folder: %s", dirPath)
// 	}

// 	// Download and verify the missing signature.
// 	verifiedHash, sigFileData, err := reg.fetchAndVerifySigFile(
// 		ctx, client,
// 		rv.resource.VerificationOptions,
// 		rv.versionedSigPath(), rv.SigningMetadata(),
// 		tries,
// 	)
// 	if err != nil {
// 		switch rv.resource.VerificationOptions.DownloadPolicy {
// 		case SignaturePolicyRequire:
// 			return fmt.Errorf("signature verification failed: %w", err)
// 		case SignaturePolicyWarn:
// 			log.Warningf("%s: failed to verify downloaded signature of %s: %s", reg.Name, rv.versionedPath(), err)
// 		case SignaturePolicyDisable:
// 			log.Debugf("%s: failed to verify downloaded signature of %s: %s", reg.Name, rv.versionedPath(), err)
// 		}
// 		return nil
// 	}

// 	// Check if the signature matches the resource file.
// 	ok, err := verifiedHash.MatchesFile(rv.storagePath())
// 	if err != nil {
// 		switch rv.resource.VerificationOptions.DownloadPolicy {
// 		case SignaturePolicyRequire:
// 			return fmt.Errorf("error while verifying resource file: %w", err)
// 		case SignaturePolicyWarn:
// 			log.Warningf("%s: error while verifying resource file %s", reg.Name, rv.storagePath())
// 		case SignaturePolicyDisable:
// 			log.Debugf("%s: error while verifying resource file %s", reg.Name, rv.storagePath())
// 		}
// 		return nil
// 	}
// 	if !ok {
// 		switch rv.resource.VerificationOptions.DownloadPolicy {
// 		case SignaturePolicyRequire:
// 			return errors.New("resource file does not match signed checksum")
// 		case SignaturePolicyWarn:
// 			log.Warningf("%s: checksum does not match resource file from %s", reg.Name, rv.storagePath())
// 		case SignaturePolicyDisable:
// 			log.Debugf("%s: checksum does not match resource file from %s", reg.Name, rv.storagePath())
// 		}
// 		return nil
// 	}

// 	// Write signature file.
// 	err = os.WriteFile(rv.storageSigPath(), sigFileData, 0o0644) //nolint:gosec
// 	if err != nil {
// 		switch rv.resource.VerificationOptions.DownloadPolicy {
// 		case SignaturePolicyRequire:
// 			return fmt.Errorf("failed to write signature file %s: %w", rv.storageSigPath(), err)
// 		case SignaturePolicyWarn:
// 			log.Warningf("%s: failed to write signature file %s: %s", reg.Name, rv.storageSigPath(), err)
// 		case SignaturePolicyDisable:
// 			log.Debugf("%s: failed to write signature file %s: %s", reg.Name, rv.storageSigPath(), err)
// 		}
// 	}

// 	log.Debugf("%s: fetched %s and stored to %s", reg.Name, rv.versionedSigPath(), rv.storageSigPath())
// 	return nil
// }

// func (reg *ResourceRegistry) fetchAndVerifySigFile(ctx context.Context, client *http.Client, verifOpts *VerificationOptions, sigFilePath string, requiredMetadata map[string]string, tries int) (*lhash.LabeledHash, []byte, error) {
// 	// Download signature file.
// 	resp, _, err := reg.makeRequest(ctx, client, sigFilePath, tries)
// 	if err != nil {
// 		return nil, nil, err
// 	}
// 	defer func() {
// 		_ = resp.Body.Close()
// 	}()
// 	sigFileData, err := io.ReadAll(resp.Body)
// 	if err != nil {
// 		return nil, nil, err
// 	}

// 	// Extract all signatures.
// 	sigs, err := filesig.ParseSigFile(sigFileData)
// 	switch {
// 	case len(sigs) == 0 && err != nil:
// 		return nil, nil, fmt.Errorf("failed to parse signature file: %w", err)
// 	case len(sigs) == 0:
// 		return nil, nil, errors.New("no signatures found in signature file")
// 	case err != nil:
// 		return nil, nil, fmt.Errorf("failed to parse signature file: %w", err)
// 	}

// 	// Verify all signatures.
// 	var verifiedHash *lhash.LabeledHash
// 	for _, sig := range sigs {
// 		fd, err := filesig.VerifyFileData(
// 			sig,
// 			requiredMetadata,
// 			verifOpts.TrustStore,
// 		)
// 		if err != nil {
// 			return nil, sigFileData, err
// 		}

// 		// Save or check verified hash.
// 		if verifiedHash == nil {
// 			verifiedHash = fd.FileHash()
// 		} else if !fd.FileHash().Equal(verifiedHash) {
// 			// Return an error if two valid hashes mismatch.
// 			// For simplicity, all hash algorithms must be the same for now.
// 			return nil, sigFileData, errors.New("file hashes from different signatures do not match")
// 		}
// 	}

// 	return verifiedHash, sigFileData, nil
// }

// func (reg *ResourceRegistry) fetchData(ctx context.Context, client *http.Client, downloadPath string, tries int) (fileData []byte, downloadedFrom string, err error) {
// 	// backoff when retrying
// 	if tries > 0 {
// 		select {
// 		case <-ctx.Done():
// 			return nil, "", nil // module is shutting down
// 		case <-time.After(time.Duration(tries*tries) * time.Second):
// 		}
// 	}

// 	// start file download
// 	resp, downloadURL, err := reg.makeRequest(ctx, client, downloadPath, tries)
// 	if err != nil {
// 		return nil, downloadURL, err
// 	}
// 	defer func() {
// 		_ = resp.Body.Close()
// 	}()

// 	// download and write file
// 	buf := bytes.NewBuffer(make([]byte, 0, resp.ContentLength))
// 	n, err := io.Copy(buf, resp.Body)
// 	if err != nil {
// 		return nil, downloadURL, fmt.Errorf("failed to download %q: %w", downloadURL, err)
// 	}
// 	if resp.ContentLength != n {
// 		return nil, downloadURL, fmt.Errorf("failed to finish download of %q: written %d out of %d bytes", downloadURL, n, resp.ContentLength)
// 	}

// 	return buf.Bytes(), downloadURL, nil
// }

// func (reg *ResourceRegistry) makeRequest(ctx context.Context, client *http.Client, downloadPath string, tries int) (resp *http.Response, downloadURL string, err error) {
// 	// parse update URL
// 	updateBaseURL := reg.UpdateURLs[tries%len(reg.UpdateURLs)]
// 	u, err := url.Parse(updateBaseURL)
// 	if err != nil {
// 		return nil, "", fmt.Errorf("failed to parse update URL %q: %w", updateBaseURL, err)
// 	}
// 	// add download path
// 	u.Path = path.Join(u.Path, downloadPath)
// 	// compile URL
// 	downloadURL = u.String()

// 	// create request
// 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, http.NoBody)
// 	if err != nil {
// 		return nil, "", fmt.Errorf("failed to create request for %q: %w", downloadURL, err)
// 	}

// 	// set user agent
// 	if reg.UserAgent != "" {
// 		req.Header.Set("User-Agent", reg.UserAgent)
// 	}

// 	// start request
// 	resp, err = client.Do(req)
// 	if err != nil {
// 		return nil, "", fmt.Errorf("failed to make request to %q: %w", downloadURL, err)
// 	}

// 	// check return code
// 	if resp.StatusCode != http.StatusOK {
// 		_ = resp.Body.Close()
// 		return nil, "", fmt.Errorf("failed to fetch %q: %d %s", downloadURL, resp.StatusCode, resp.Status)
// 	}

// 	return resp, downloadURL, err
// }