From 1a76517470ebc2dd3f96e39ebe6f3706d6dd78da Mon Sep 17 00:00:00 2001
From: Julian Andres Klode <jak@debian.org>
Date: Sat, 21 Oct 2017 15:44:43 +0200
Subject: Run Proxy-Auto-Detect script from main process

This avoids running the Proxy-Auto-Detect script inside the
untrusted (well, less trusted for now) sandbox. This will allow
us to restrict the http method from fork()ing or exec()ing via
seccomp.
---
 apt-pkg/acquire-method.cc | 24 ++++++++++++++++++++----
 apt-pkg/acquire-method.h  |  8 ++++++--
 apt-pkg/acquire-worker.cc | 12 ++++++++++++
 3 files changed, 38 insertions(+), 6 deletions(-)

(limited to 'apt-pkg')

diff --git a/apt-pkg/acquire-method.cc b/apt-pkg/acquire-method.cc
index 5b31559f3..309b5dcf9 100644
--- a/apt-pkg/acquire-method.cc
+++ b/apt-pkg/acquire-method.cc
@@ -372,6 +372,7 @@ int pkgAcqMethod::Run(bool Single)
 	    FetchItem *Tmp = new FetchItem;
 	    
 	    Tmp->Uri = LookupTag(Message,"URI");
+	    Tmp->Proxy(LookupTag(Message, "Proxy"));
 	    Tmp->DestFile = LookupTag(Message,"FileName");
 	    if (RFC1123StrToTime(LookupTag(Message,"Last-Modified").c_str(),Tmp->LastModified) == false)
 	       Tmp->LastModified = 0;
@@ -491,10 +492,25 @@ void pkgAcqMethod::Dequeue() {						/*{{{*/
 									/*}}}*/
 pkgAcqMethod::~pkgAcqMethod() {}
 
-pkgAcqMethod::FetchItem::FetchItem() :
-   Next(nullptr), DestFileFd(-1), LastModified(0), IndexFile(false),
-   FailIgnore(false), MaximumSize(0), d(nullptr)
+struct pkgAcqMethod::FetchItem::Private
+{
+   std::string Proxy;
+};
+
+pkgAcqMethod::FetchItem::FetchItem() : Next(nullptr), DestFileFd(-1), LastModified(0), IndexFile(false),
+				       FailIgnore(false), MaximumSize(0), d(new Private)
 {}
-pkgAcqMethod::FetchItem::~FetchItem() {}
+
+std::string pkgAcqMethod::FetchItem::Proxy()
+{
+   return d->Proxy;
+}
+
+void pkgAcqMethod::FetchItem::Proxy(std::string const &Proxy)
+{
+   d->Proxy = Proxy;
+}
+
+pkgAcqMethod::FetchItem::~FetchItem() { delete d; }
 
 pkgAcqMethod::FetchResult::~FetchResult() {}
diff --git a/apt-pkg/acquire-method.h b/apt-pkg/acquire-method.h
index cab2bda40..2de9cf5c2 100644
--- a/apt-pkg/acquire-method.h
+++ b/apt-pkg/acquire-method.h
@@ -55,10 +55,14 @@ class pkgAcqMethod
 
       FetchItem();
       virtual ~FetchItem();
+      std::string Proxy(); // For internal use only.
+      void Proxy(std::string const &Proxy) APT_HIDDEN;
+
       private:
-      void * const d;
+      struct Private;
+      Private *const d;
    };
-   
+
    struct FetchResult
    {
       HashStringList Hashes;
diff --git a/apt-pkg/acquire-worker.cc b/apt-pkg/acquire-worker.cc
index 4aa55a743..49d67e370 100644
--- a/apt-pkg/acquire-worker.cc
+++ b/apt-pkg/acquire-worker.cc
@@ -21,6 +21,7 @@
 #include <apt-pkg/error.h>
 #include <apt-pkg/fileutl.h>
 #include <apt-pkg/hashes.h>
+#include <apt-pkg/proxy.h>
 #include <apt-pkg/strutl.h>
 
 #include <algorithm>
@@ -671,6 +672,17 @@ bool pkgAcquire::Worker::QueueItem(pkgAcquire::Queue::QItem *Item)
    Message += "URI: " + Item->URI;
    Message += "\nFilename: " + Item->Owner->DestFile;
 
+   URI URL = Item->URI;
+   // FIXME: We should not hard code proxy protocols here.
+   if (URL.Access == "http" || URL.Access == "https")
+   {
+      AutoDetectProxy(URL);
+      if (_config->Exists("Acquire::" + URL.Access + "::proxy::" + URL.Host))
+      {
+	 Message += "\nProxy: " + _config->Find("Acquire::" + URL.Access + "::proxy::" + URL.Host);
+      }
+   }
+
    HashStringList const hsl = Item->GetExpectedHashes();
    for (HashStringList::const_iterator hs = hsl.begin(); hs != hsl.end(); ++hs)
       Message += "\nExpected-" + hs->HashType() + ": " + hs->HashValue();
-- 
cgit v1.2.3-70-g09d2