Import libfetch-2.0, based on the FreeBSD version of today with a number

of smaller changes to not depend on sys/param.h. This library is
intended to replace the tnftp dependency in pkg_install.

18 files changed, 5468 insertions, 0 deletions

diff --git a/net/libfetch/DESCR b/net/libfetch/DESCR
new file mode 100644
index 00000000000..23448bc3c6e
--- /dev/null
+++ b/net/libfetch/DESCR
@@ -0,0 +1,11 @@
+libfetch provides a high-level interface for retreiving and uploading
+files using Uniform Resource Locators (URLs).
+
+The library implements:
+
+    * local file access (file://)
+    * FTP
+    * HTTP
+    * HTTPS (optional, using OpenSSL)
+
+FTP and HTTP proxies can be used.
diff --git a/net/libfetch/Makefile b/net/libfetch/Makefile
new file mode 100644
index 00000000000..3e1220ca633
--- /dev/null
+++ b/net/libfetch/Makefile
@@ -0,0 +1,28 @@
+# $NetBSD: Makefile,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $
+#
+
+DISTNAME=	libfetch-2.0
+CATEGORIES=	net
+MASTER_SITES=	# empty
+DISTFILES=	# empty
+
+NO_CHECKSUM=	yes
+
+MAINTAINER=	joerg@NetBSD.org
+HOMEPAGE=	http://www.FreeBSD.org/
+COMMENT=	Library to access HTTP/FTP server
+#LICENSE=	modified-bsd
+
+PKG_DESTDIR_SUPPORT=	user-destdir
+
+USE_BSD_MAKEFILE=	yes
+
+INSTALLATION_DIRS=	lib ${PKGMANDIR}/cat3 ${PKGMANDIR}/man3
+
+do-extract:
+	${CP} -r ${FILESDIR} ${WRKSRC}
+
+.include "options.mk"
+
+.include "../../security/openssl/buildlink3.mk"
+.include "../../mk/bsd.pkg.mk"
diff --git a/net/libfetch/PLIST b/net/libfetch/PLIST
new file mode 100644
index 00000000000..2fe982147f4
--- /dev/null
+++ b/net/libfetch/PLIST
@@ -0,0 +1,4 @@
+@comment $NetBSD: PLIST,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $
+lib/libfetch.a
+man/cat3/fetch.0
+man/man3/fetch.3
diff --git a/net/libfetch/buildlink3.mk b/net/libfetch/buildlink3.mk
new file mode 100644
index 00000000000..05527697010
--- /dev/null
+++ b/net/libfetch/buildlink3.mk
@@ -0,0 +1,28 @@
+# $NetBSD: buildlink3.mk,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $
+
+BUILDLINK_DEPMETHOD.libfetch?=	build
+
+BUILDLINK_DEPTH:=		${BUILDLINK_DEPTH}+
+LIBFETCH_BUILDLINK3_MK:=	${LIBFETCH_BUILDLINK3_MK}+
+
+.if ${BUILDLINK_DEPTH} == "+"
+BUILDLINK_DEPENDS+=	libfetch
+.endif
+
+BUILDLINK_PACKAGES:=	${BUILDLINK_PACKAGES:Nlibfetch}
+BUILDLINK_PACKAGES+=	libfetch
+BUILDLINK_ORDER:=	${BUILDLINK_ORDER} ${BUILDLINK_DEPTH}libfetch
+
+.if ${LIBFETCH_BUILDLINK3_MK} == "+"
+BUILDLINK_API_DEPENDS.libfetch+=	libfetch>=2.0
+BUILDLINK_PKGSRCDIR.libfetch?=	../../net/libfetch
+.endif	# LIBFETCH_BUILDLINK3_MK
+
+pkgbase := libfetch
+.include "../../mk/pkg-build-options.mk"
+
+.if !empty(PKG_BUILD_OPTIONS.libfetch:Mopenssl)
+.include "../../security/openssl/buildlink3.mk"
+.endif
+
+BUILDLINK_DEPTH:=	${BUILDLINK_DEPTH:S/+$//}
diff --git a/net/libfetch/files/Makefile b/net/libfetch/files/Makefile
new file mode 100644
index 00000000000..5a5dc0a67aa
--- /dev/null
+++ b/net/libfetch/files/Makefile
@@ -0,0 +1,40 @@
+# $NetBSD
+
+LIB=		fetch
+SRCS=		fetch.c common.c ftp.c http.c file.c ftperr.h httperr.h
+INCS=		fetch.h
+MAN=		fetch.3
+CLEANFILES=	ftperr.h httperr.h
+MKLINT=		no
+MKPIC=		no
+MKPROFILE=	no
+
+.include <bsd.own.mk>
+
+CPPFLAGS+=	-I.
+
+FETCH_WITH_INET6?=	no
+FETCH_WITH_OPENSSL?=	no
+
+.if !empty(FETCH_WITH_INET6:M[yY][eE][sS])
+CPPFLAGS+=	-DINET6
+.endif
+
+.if !empty(FETCH_WITH_OPENSSL:M[yY][eE][sS])
+CPPFLAGS+=	-DWITH_SSL
+LDADD=		-lssl -lcrypto
+.endif
+
+CPPFLAGS+=	-DFTP_COMBINE_CWDS
+
+WARNS?=		4
+
+ftperr.h: ${.CURDIR}/ftp.errors ${.CURDIR}/Makefile ${.CURDIR}/errlist.awk
+	awk -v variable=ftp_errlist -v protocol=FTP \
+	    -f ${.CURDIR}/errlist.awk ${.CURDIR}/ftp.errors > ${.TARGET}
+
+httperr.h: ${.CURDIR}/http.errors ${.CURDIR}/Makefile ${.CURDIR}/errlist.awk
+	awk -v variable=http_errlist -v protocol=HTTP \
+	    -f ${.CURDIR}/errlist.awk ${.CURDIR}/http.errors > ${.TARGET}
+
+.include <bsd.lib.mk>
diff --git a/net/libfetch/files/common.c b/net/libfetch/files/common.c
new file mode 100644
index 00000000000..e091b7ddd08
--- /dev/null
+++ b/net/libfetch/files/common.c
@@ -0,0 +1,789 @@
+/*	$NetBSD: common.c,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $	*/
+/*-
+ * Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD: common.c,v 1.53 2007/12/19 00:26:36 des Exp $
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/uio.h>
+
+#include <netinet/in.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <netdb.h>
+#include <pwd.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "fetch.h"
+#include "common.h"
+
+#define DECONST(x,y) ((x)(uintptr_t)(y))
+
+
+/*** Local data **************************************************************/
+
+/*
+ * Error messages for resolver errors
+ */
+static struct fetcherr netdb_errlist[] = {
+#ifdef EAI_NODATA
+	{ EAI_NODATA,	FETCH_RESOLV,	"Host not found" },
+#endif
+	{ EAI_AGAIN,	FETCH_TEMP,	"Transient resolver failure" },
+	{ EAI_FAIL,	FETCH_RESOLV,	"Non-recoverable resolver failure" },
+	{ EAI_NONAME,	FETCH_RESOLV,	"No address record" },
+	{ -1,		FETCH_UNKNOWN,	"Unknown resolver error" }
+};
+
+/* End-of-Line */
+static const char ENDL[2] = "\r\n";
+
+
+/*** Error-reporting functions ***********************************************/
+
+/*
+ * Map error code to string
+ */
+static struct fetcherr *
+fetch_finderr(struct fetcherr *p, int e)
+{
+	while (p->num != -1 && p->num != e)
+		p++;
+	return (p);
+}
+
+/*
+ * Set error code
+ */
+void
+fetch_seterr(struct fetcherr *p, int e)
+{
+	p = fetch_finderr(p, e);
+	fetchLastErrCode = p->cat;
+	snprintf(fetchLastErrString, MAXERRSTRING, "%s", p->string);
+}
+
+/*
+ * Set error code according to errno
+ */
+void
+fetch_syserr(void)
+{
+	switch (errno) {
+	case 0:
+		fetchLastErrCode = FETCH_OK;
+		break;
+	case EPERM:
+	case EACCES:
+	case EROFS:
+	case EAUTH:
+	case ENEEDAUTH:
+		fetchLastErrCode = FETCH_AUTH;
+		break;
+	case ENOENT:
+	case EISDIR: /* XXX */
+		fetchLastErrCode = FETCH_UNAVAIL;
+		break;
+	case ENOMEM:
+		fetchLastErrCode = FETCH_MEMORY;
+		break;
+	case EBUSY:
+	case EAGAIN:
+		fetchLastErrCode = FETCH_TEMP;
+		break;
+	case EEXIST:
+		fetchLastErrCode = FETCH_EXISTS;
+		break;
+	case ENOSPC:
+		fetchLastErrCode = FETCH_FULL;
+		break;
+	case EADDRINUSE:
+	case EADDRNOTAVAIL:
+	case ENETDOWN:
+	case ENETUNREACH:
+	case ENETRESET:
+	case EHOSTUNREACH:
+		fetchLastErrCode = FETCH_NETWORK;
+		break;
+	case ECONNABORTED:
+	case ECONNRESET:
+		fetchLastErrCode = FETCH_ABORT;
+		break;
+	case ETIMEDOUT:
+		fetchLastErrCode = FETCH_TIMEOUT;
+		break;
+	case ECONNREFUSED:
+	case EHOSTDOWN:
+		fetchLastErrCode = FETCH_DOWN;
+		break;
+default:
+		fetchLastErrCode = FETCH_UNKNOWN;
+	}
+	snprintf(fetchLastErrString, MAXERRSTRING, "%s", strerror(errno));
+}
+
+
+/*
+ * Emit status message
+ */
+void
+fetch_info(const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	vfprintf(stderr, fmt, ap);
+	va_end(ap);
+	fputc('\n', stderr);
+}
+
+
+/*** Network-related utility functions ***************************************/
+
+/*
+ * Return the default port for a scheme
+ */
+int
+fetch_default_port(const char *scheme)
+{
+	struct servent *se;
+
+	if ((se = getservbyname(scheme, "tcp")) != NULL)
+		return (ntohs(se->s_port));
+	if (strcasecmp(scheme, SCHEME_FTP) == 0)
+		return (FTP_DEFAULT_PORT);
+	if (strcasecmp(scheme, SCHEME_HTTP) == 0)
+		return (HTTP_DEFAULT_PORT);
+	return (0);
+}
+
+/*
+ * Return the default proxy port for a scheme
+ */
+int
+fetch_default_proxy_port(const char *scheme)
+{
+	if (strcasecmp(scheme, SCHEME_FTP) == 0)
+		return (FTP_DEFAULT_PROXY_PORT);
+	if (strcasecmp(scheme, SCHEME_HTTP) == 0)
+		return (HTTP_DEFAULT_PROXY_PORT);
+	return (0);
+}
+
+
+/*
+ * Create a connection for an existing descriptor.
+ */
+conn_t *
+fetch_reopen(int sd)
+{
+	conn_t *conn;
+
+	/* allocate and fill connection structure */
+	if ((conn = calloc(1, sizeof(*conn))) == NULL)
+		return (NULL);
+	conn->sd = sd;
+	++conn->ref;
+	return (conn);
+}
+
+
+/*
+ * Bump a connection's reference count.
+ */
+conn_t *
+fetch_ref(conn_t *conn)
+{
+
+	++conn->ref;
+	return (conn);
+}
+
+
+/*
+ * Bind a socket to a specific local address
+ */
+int
+fetch_bind(int sd, int af, const char *addr)
+{
+	struct addrinfo hints, *res, *res0;
+	int err;
+
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_family = af;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = 0;
+	if ((err = getaddrinfo(addr, NULL, &hints, &res0)) != 0)
+		return (-1);
+	for (res = res0; res; res = res->ai_next)
+		if (bind(sd, res->ai_addr, res->ai_addrlen) == 0)
+			return (0);
+	return (-1);
+}
+
+
+/*
+ * Establish a TCP connection to the specified port on the specified host.
+ */
+conn_t *
+fetch_connect(const char *host, int port, int af, int verbose)
+{
+	conn_t *conn;
+	char pbuf[10];
+	const char *bindaddr;
+	struct addrinfo hints, *res, *res0;
+	int sd, err;
+
+	DEBUG(fprintf(stderr, "---> %s:%d\n", host, port));
+
+	if (verbose)
+		fetch_info("looking up %s", host);
+
+	/* look up host name and set up socket address structure */
+	snprintf(pbuf, sizeof(pbuf), "%d", port);
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_family = af;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = 0;
+	if ((err = getaddrinfo(host, pbuf, &hints, &res0)) != 0) {
+		netdb_seterr(err);
+		return (NULL);
+	}
+	bindaddr = getenv("FETCH_BIND_ADDRESS");
+
+	if (verbose)
+		fetch_info("connecting to %s:%d", host, port);
+
+	/* try to connect */
+	for (sd = -1, res = res0; res; sd = -1, res = res->ai_next) {
+		if ((sd = socket(res->ai_family, res->ai_socktype,
+			 res->ai_protocol)) == -1)
+			continue;
+		if (bindaddr != NULL && *bindaddr != '\0' &&
+		    fetch_bind(sd, res->ai_family, bindaddr) != 0) {
+			fetch_info("failed to bind to '%s'", bindaddr);
+			close(sd);
+			continue;
+		}
+		if (connect(sd, res->ai_addr, res->ai_addrlen) == 0)
+			break;
+		close(sd);
+	}
+	freeaddrinfo(res0);
+	if (sd == -1) {
+		fetch_syserr();
+		return (NULL);
+	}
+
+	if ((conn = fetch_reopen(sd)) == NULL) {
+		fetch_syserr();
+		close(sd);
+	}
+	return (conn);
+}
+
+
+/*
+ * Enable SSL on a connection.
+ */
+int
+fetch_ssl(conn_t *conn, int verbose)
+{
+
+#ifdef WITH_SSL
+	/* Init the SSL library and context */
+	if (!SSL_library_init()){
+		fprintf(stderr, "SSL library init failed\n");
+		return (-1);
+	}
+
+	SSL_load_error_strings();
+
+	conn->ssl_meth = SSLv23_client_method();
+	conn->ssl_ctx = SSL_CTX_new(conn->ssl_meth);
+	SSL_CTX_set_mode(conn->ssl_ctx, SSL_MODE_AUTO_RETRY);
+
+	conn->ssl = SSL_new(conn->ssl_ctx);
+	if (conn->ssl == NULL){
+		fprintf(stderr, "SSL context creation failed\n");
+		return (-1);
+	}
+	SSL_set_fd(conn->ssl, conn->sd);
+	if (SSL_connect(conn->ssl) == -1){
+		ERR_print_errors_fp(stderr);
+		return (-1);
+	}
+
+	if (verbose) {
+		X509_NAME *name;
+		char *str;
+
+		fprintf(stderr, "SSL connection established using %s\n",
+		    SSL_get_cipher(conn->ssl));
+		conn->ssl_cert = SSL_get_peer_certificate(conn->ssl);
+		name = X509_get_subject_name(conn->ssl_cert);
+		str = X509_NAME_oneline(name, 0, 0);
+		printf("Certificate subject: %s\n", str);
+		free(str);
+		name = X509_get_issuer_name(conn->ssl_cert);
+		str = X509_NAME_oneline(name, 0, 0);
+		printf("Certificate issuer: %s\n", str);
+		free(str);
+	}
+
+	return (0);
+#else
+	(void)conn;
+	(void)verbose;
+	fprintf(stderr, "SSL support disabled\n");
+	return (-1);
+#endif
+}
+
+
+/*
+ * Read a character from a connection w/ timeout
+ */
+ssize_t
+fetch_read(conn_t *conn, char *buf, size_t len)
+{
+	struct timeval now, timeout, wait;
+	fd_set readfds;
+	ssize_t rlen, total;
+	int r;
+
+	if (fetchTimeout) {
+		FD_ZERO(&readfds);
+		gettimeofday(&timeout, NULL);
+		timeout.tv_sec += fetchTimeout;
+	}
+
+	total = 0;
+	while (len > 0) {
+		while (fetchTimeout && !FD_ISSET(conn->sd, &readfds)) {
+			FD_SET(conn->sd, &readfds);
+			gettimeofday(&now, NULL);
+			wait.tv_sec = timeout.tv_sec - now.tv_sec;
+			wait.tv_usec = timeout.tv_usec - now.tv_usec;
+			if (wait.tv_usec < 0) {
+				wait.tv_usec += 1000000;
+				wait.tv_sec--;
+			}
+			if (wait.tv_sec < 0) {
+				errno = ETIMEDOUT;
+				fetch_syserr();
+				return (-1);
+			}
+			errno = 0;
+			r = select(conn->sd + 1, &readfds, NULL, NULL, &wait);
+			if (r == -1) {
+				if (errno == EINTR && fetchRestartCalls)
+					continue;
+				fetch_syserr();
+				return (-1);
+			}
+		}
+#ifdef WITH_SSL
+		if (conn->ssl != NULL)
+			rlen = SSL_read(conn->ssl, buf, len);
+		else
+#endif
+			rlen = read(conn->sd, buf, len);
+		if (rlen == 0)
+			break;
+		if (rlen < 0) {
+			if (errno == EINTR && fetchRestartCalls)
+				continue;
+			return (-1);
+		}
+		len -= rlen;
+		buf += rlen;
+		total += rlen;
+	}
+	return (total);
+}
+
+
+/*
+ * Read a line of text from a connection w/ timeout
+ */
+#define MIN_BUF_SIZE 1024
+
+int
+fetch_getln(conn_t *conn)
+{
+	char *tmp;
+	size_t tmpsize;
+	ssize_t len;
+	char c;
+
+	if (conn->buf == NULL) {
+		if ((conn->buf = malloc(MIN_BUF_SIZE)) == NULL) {
+			errno = ENOMEM;
+			return (-1);
+		}
+		conn->bufsize = MIN_BUF_SIZE;
+	}
+
+	conn->buf[0] = '\0';
+	conn->buflen = 0;
+
+	do {
+		len = fetch_read(conn, &c, 1);
+		if (len == -1)
+			return (-1);
+		if (len == 0)
+			break;
+		conn->buf[conn->buflen++] = c;
+		if (conn->buflen == conn->bufsize) {
+			tmp = conn->buf;
+			tmpsize = conn->bufsize * 2 + 1;
+			if ((tmp = realloc(tmp, tmpsize)) == NULL) {
+				errno = ENOMEM;
+				return (-1);
+			}
+			conn->buf = tmp;
+			conn->bufsize = tmpsize;
+		}
+	} while (c != '\n');
+
+	conn->buf[conn->buflen] = '\0';
+	DEBUG(fprintf(stderr, "<<< %s", conn->buf));
+	return (0);
+}
+
+
+/*
+ * Write to a connection w/ timeout
+ */
+ssize_t
+fetch_write(conn_t *conn, const char *buf, size_t len)
+{
+	struct iovec iov;
+
+	iov.iov_base = DECONST(char *, buf);
+	iov.iov_len = len;
+	return fetch_writev(conn, &iov, 1);
+}
+
+/*
+ * Write a vector to a connection w/ timeout
+ * Note: can modify the iovec.
+ */
+ssize_t
+fetch_writev(conn_t *conn, struct iovec *iov, int iovcnt)
+{
+	struct timeval now, timeout, wait;
+	fd_set writefds;
+	ssize_t wlen, total;
+	int r;
+
+	if (fetchTimeout) {
+		FD_ZERO(&writefds);
+		gettimeofday(&timeout, NULL);
+		timeout.tv_sec += fetchTimeout;
+	}
+
+	total = 0;
+	while (iovcnt > 0) {
+		while (fetchTimeout && !FD_ISSET(conn->sd, &writefds)) {
+			FD_SET(conn->sd, &writefds);
+			gettimeofday(&now, NULL);
+			wait.tv_sec = timeout.tv_sec - now.tv_sec;
+			wait.tv_usec = timeout.tv_usec - now.tv_usec;
+			if (wait.tv_usec < 0) {
+				wait.tv_usec += 1000000;
+				wait.tv_sec--;
+			}
+			if (wait.tv_sec < 0) {
+				errno = ETIMEDOUT;
+				fetch_syserr();
+				return (-1);
+			}
+			errno = 0;
+			r = select(conn->sd + 1, NULL, &writefds, NULL, &wait);
+			if (r == -1) {
+				if (errno == EINTR && fetchRestartCalls)
+					continue;
+				return (-1);
+			}
+		}
+		errno = 0;
+#ifdef WITH_SSL
+		if (conn->ssl != NULL)
+			wlen = SSL_write(conn->ssl,
+			    iov->iov_base, iov->iov_len);
+		else
+#endif
+			wlen = writev(conn->sd, iov, iovcnt);
+		if (wlen == 0) {
+			/* we consider a short write a failure */
+			errno = EPIPE;
+			fetch_syserr();
+			return (-1);
+		}
+		if (wlen < 0) {
+			if (errno == EINTR && fetchRestartCalls)
+				continue;
+			return (-1);
+		}
+		total += wlen;
+		while (iovcnt > 0 && wlen >= (ssize_t)iov->iov_len) {
+			wlen -= iov->iov_len;
+			iov++;
+			iovcnt--;
+		}
+		if (iovcnt > 0) {
+			iov->iov_len -= wlen;
+			iov->iov_base = DECONST(char *, iov->iov_base) + wlen;
+		}
+	}
+	return (total);
+}
+
+
+/*
+ * Write a line of text to a connection w/ timeout
+ */
+int
+fetch_putln(conn_t *conn, const char *str, size_t len)
+{
+	struct iovec iov[2];
+	int ret;
+
+	DEBUG(fprintf(stderr, ">>> %s\n", str));
+	iov[0].iov_base = DECONST(char *, str);
+	iov[0].iov_len = len;
+	iov[1].iov_base = DECONST(char *, ENDL);
+	iov[1].iov_len = sizeof(ENDL);
+	if (len == 0)
+		ret = fetch_writev(conn, &iov[1], 1);
+	else
+		ret = fetch_writev(conn, iov, 2);
+	if (ret == -1)
+		return (-1);
+	return (0);
+}
+
+
+/*
+ * Close connection
+ */
+int
+fetch_close(conn_t *conn)
+{
+	int ret;
+
+	if (--conn->ref > 0)
+		return (0);
+	ret = close(conn->sd);
+	free(conn->buf);
+	free(conn);
+	return (ret);
+}
+
+
+/*** Directory-related utility functions *************************************/
+
+int
+fetch_add_entry(struct url_ent **p, int *size, int *len,
+    const char *name, struct url_stat *us)
+{
+	struct url_ent *tmp;
+
+	if (*p == NULL) {
+		*size = 0;
+		*len = 0;
+	}
+
+	if (*len >= *size - 1) {
+		tmp = realloc(*p, (*size * 2 + 1) * sizeof(**p));
+		if (tmp == NULL) {
+			errno = ENOMEM;
+			fetch_syserr();
+			return (-1);
+		}
+		*size = (*size * 2 + 1);
+		*p = tmp;
+	}
+
+	tmp = *p + *len;
+	snprintf(tmp->name, PATH_MAX, "%s", name);
+	bcopy(us, &tmp->stat, sizeof(*us));
+
+	(*len)++;
+	(++tmp)->name[0] = 0;
+
+	return (0);
+}
+
+
+/*** Authentication-related utility functions ********************************/
+
+static const char *
+fetch_read_word(FILE *f)
+{
+	static char word[1024];
+
+	if (fscanf(f, " %1024s ", word) != 1)
+		return (NULL);
+	return (word);
+}
+
+/*
+ * Get authentication data for a URL from .netrc
+ */
+int
+fetch_netrc_auth(struct url *url)
+{
+	char fn[PATH_MAX];
+	const char *word;
+	char *p;
+	FILE *f;
+
+	if ((p = getenv("NETRC")) != NULL) {
+		if (snprintf(fn, sizeof(fn), "%s", p) >= (int)sizeof(fn)) {
+			fetch_info("$NETRC specifies a file name "
+			    "longer than PATH_MAX");
+			return (-1);
+		}
+	} else {
+		if ((p = getenv("HOME")) != NULL) {
+			struct passwd *pwd;
+
+			if ((pwd = getpwuid(getuid())) == NULL ||
+			    (p = pwd->pw_dir) == NULL)
+				return (-1);
+		}
+		if (snprintf(fn, sizeof(fn), "%s/.netrc", p) >= (int)sizeof(fn))
+			return (-1);
+	}
+
+	if ((f = fopen(fn, "r")) == NULL)
+		return (-1);
+	while ((word = fetch_read_word(f)) != NULL) {
+		if (strcmp(word, "default") == 0) {
+			DEBUG(fetch_info("Using default .netrc settings"));
+			break;
+		}
+		if (strcmp(word, "machine") == 0 &&
+		    (word = fetch_read_word(f)) != NULL &&
+		    strcasecmp(word, url->host) == 0) {
+			DEBUG(fetch_info("Using .netrc settings for %s", word));
+			break;
+		}
+	}
+	if (word == NULL)
+		goto ferr;
+	while ((word = fetch_read_word(f)) != NULL) {
+		if (strcmp(word, "login") == 0) {
+			if ((word = fetch_read_word(f)) == NULL)
+				goto ferr;
+			if (snprintf(url->user, sizeof(url->user),
+				"%s", word) > (int)sizeof(url->user)) {
+				fetch_info("login name in .netrc is too long");
+				url->user[0] = '\0';
+			}
+		} else if (strcmp(word, "password") == 0) {
+			if ((word = fetch_read_word(f)) == NULL)
+				goto ferr;
+			if (snprintf(url->pwd, sizeof(url->pwd),
+				"%s", word) > (int)sizeof(url->pwd)) {
+				fetch_info("password in .netrc is too long");
+				url->pwd[0] = '\0';
+			}
+		} else if (strcmp(word, "account") == 0) {
+			if ((word = fetch_read_word(f)) == NULL)
+				goto ferr;
+			/* XXX not supported! */
+		} else {
+			break;
+		}
+	}
+	fclose(f);
+	return (0);
+ ferr:
+	fclose(f);
+	return (-1);
+}
+
+/*
+ * The no_proxy environment variable specifies a set of domains for
+ * which the proxy should not be consulted; the contents is a comma-,
+ * or space-separated list of domain names.  A single asterisk will
+ * override all proxy variables and no transactions will be proxied
+ * (for compatability with lynx and curl, see the discussion at
+ * <http://curl.haxx.se/mail/archive_pre_oct_99/0009.html>).
+ */
+int
+fetch_no_proxy_match(const char *host)
+{
+	const char *no_proxy, *p, *q;
+	size_t h_len, d_len;
+
+	if ((no_proxy = getenv("NO_PROXY")) == NULL &&
+	    (no_proxy = getenv("no_proxy")) == NULL)
+		return (0);
+
+	/* asterisk matches any hostname */
+	if (strcmp(no_proxy, "*") == 0)
+		return (1);
+
+	h_len = strlen(host);
+	p = no_proxy;
+	do {
+		/* position p at the beginning of a domain suffix */
+		while (*p == ',' || isspace((unsigned char)*p))
+			p++;
+
+		/* position q at the first separator character */
+		for (q = p; *q; ++q)
+			if (*q == ',' || isspace((unsigned char)*q))
+				break;
+
+		d_len = q - p;
+		if (d_len > 0 && h_len > d_len &&
+		    strncasecmp(host + h_len - d_len,
+			p, d_len) == 0) {
+			/* domain name matches */
+			return (1);
+		}
+
+		p = q + 1;
+	} while (*q);
+
+	return (0);
+}
diff --git a/net/libfetch/files/common.h b/net/libfetch/files/common.h
new file mode 100644
index 00000000000..e2a114aea30
--- /dev/null
+++ b/net/libfetch/files/common.h
@@ -0,0 +1,126 @@
+/*	$NetBSD: common.h,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $	*/
+/*-
+ * Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD: common.h,v 1.30 2007/12/18 11:03:07 des Exp $
+ */
+
+#ifndef _COMMON_H_INCLUDED
+#define _COMMON_H_INCLUDED
+
+#define FTP_DEFAULT_PORT	21
+#define HTTP_DEFAULT_PORT	80
+#define FTP_DEFAULT_PROXY_PORT	21
+#define HTTP_DEFAULT_PROXY_PORT	3128
+
+#ifdef WITH_SSL
+#include <openssl/crypto.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#endif
+
+/* Connection */
+typedef struct fetchconn conn_t;
+struct fetchconn {
+	int		 sd;		/* socket descriptor */
+	char		*buf;		/* buffer */
+	size_t		 bufsize;	/* buffer size */
+	size_t		 buflen;	/* length of buffer contents */
+	int		 err;		/* last protocol reply code */
+#ifdef WITH_SSL
+	SSL		*ssl;		/* SSL handle */
+	SSL_CTX		*ssl_ctx;	/* SSL context */
+	X509		*ssl_cert;	/* server certificate */
+	SSL_METHOD	*ssl_meth;	/* SSL method */
+#endif
+	int		 ref;		/* reference count */
+};
+
+/* Structure used for error message lists */
+struct fetcherr {
+	const int	 num;
+	const int	 cat;
+	const char	*string;
+};
+
+/* for fetch_writev */
+struct iovec;
+
+void		 fetch_seterr(struct fetcherr *, int);
+void		 fetch_syserr(void);
+void		 fetch_info(const char *, ...);
+int		 fetch_default_port(const char *);
+int		 fetch_default_proxy_port(const char *);
+int		 fetch_bind(int, int, const char *);
+conn_t		*fetch_connect(const char *, int, int, int);
+conn_t		*fetch_reopen(int);
+conn_t		*fetch_ref(conn_t *);
+int		 fetch_ssl(conn_t *, int);
+ssize_t		 fetch_read(conn_t *, char *, size_t);
+int		 fetch_getln(conn_t *);
+ssize_t		 fetch_write(conn_t *, const char *, size_t);
+ssize_t		 fetch_writev(conn_t *, struct iovec *, int);
+int		 fetch_putln(conn_t *, const char *, size_t);
+int		 fetch_close(conn_t *);
+int		 fetch_add_entry(struct url_ent **, int *, int *,
+		     const char *, struct url_stat *);
+int		 fetch_netrc_auth(struct url *url);
+int		 fetch_no_proxy_match(const char *);
+
+#define ftp_seterr(n)	 fetch_seterr(ftp_errlist, n)
+#define http_seterr(n)	 fetch_seterr(http_errlist, n)
+#define netdb_seterr(n)	 fetch_seterr(netdb_errlist, n)
+#define url_seterr(n)	 fetch_seterr(url_errlist, n)
+
+#ifndef NDEBUG
+#define DEBUG(x) do { if (fetchDebug) { x; } } while (0)
+#else
+#define DEBUG(x) do { } while (0)
+#endif
+
+/*
+ * I don't really like exporting http_request() and ftp_request(),
+ * but the HTTP and FTP code occasionally needs to cross-call
+ * eachother, and this saves me from adding a lot of special-case code
+ * to handle those cases.
+ *
+ * Note that _*_request() free purl, which is way ugly but saves us a
+ * whole lot of trouble.
+ */
+FILE		*http_request(struct url *, const char *,
+		     struct url_stat *, struct url *, const char *);
+FILE		*ftp_request(struct url *, const char *,
+		     struct url_stat *, struct url *, const char *);
+
+/*
+ * Check whether a particular flag is set
+ */
+#define CHECK_FLAG(x)	(flags && strchr(flags, (x)))
+
+#endif
diff --git a/net/libfetch/files/errlist.awk b/net/libfetch/files/errlist.awk
new file mode 100644
index 00000000000..720705cc397
--- /dev/null
+++ b/net/libfetch/files/errlist.awk
@@ -0,0 +1,12 @@
+BEGIN {
+	printf "static struct fetcherr %s[] = {\n", variable
+}
+
+/^#/	{ next }
+
+{	printf "\t{ %d, FETCH_%s, \"%s\" },\n", $1, $2, $3 }
+
+END {
+	printf "\t{ -1, FETCH_UNKNOWN, \"Unknown %s error\" }\n", protocol
+	printf "};\n"
+}
diff --git a/net/libfetch/files/fetch.3 b/net/libfetch/files/fetch.3
new file mode 100644
index 00000000000..17f467e6dcd
--- /dev/null
+++ b/net/libfetch/files/fetch.3
@@ -0,0 +1,685 @@
+.\"-
+.\" Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD: fetch.3,v 1.64 2007/12/18 11:03:26 des Exp $
+.\" $NetBSD: fetch.3,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $
+.\"
+.Dd December 18, 2007
+.Dt FETCH 3
+.Os
+.Sh NAME
+.Nm fetchMakeURL ,
+.Nm fetchParseURL ,
+.Nm fetchFreeURL ,
+.Nm fetchXGetURL ,
+.Nm fetchGetURL ,
+.Nm fetchPutURL ,
+.Nm fetchStatURL ,
+.Nm fetchListURL ,
+.Nm fetchXGet ,
+.Nm fetchGet ,
+.Nm fetchPut ,
+.Nm fetchStat ,
+.Nm fetchList ,
+.Nm fetchXGetFile ,
+.Nm fetchGetFile ,
+.Nm fetchPutFile ,
+.Nm fetchStatFile ,
+.Nm fetchListFile ,
+.Nm fetchXGetHTTP ,
+.Nm fetchGetHTTP ,
+.Nm fetchPutHTTP ,
+.Nm fetchStatHTTP ,
+.Nm fetchListHTTP ,
+.Nm fetchXGetFTP ,
+.Nm fetchGetFTP ,
+.Nm fetchPutFTP ,
+.Nm fetchStatFTP ,
+.Nm fetchListFTP
+.Nd file transfer functions
+.Sh LIBRARY
+.Lb libfetch
+.Sh SYNOPSIS
+.In stdio.h
+.In fetch.h
+.Ft struct url *
+.Fn fetchMakeURL "const char *scheme" "const char *host" "int port" "const char *doc" "const char *user" "const char *pwd"
+.Ft struct url *
+.Fn fetchParseURL "const char *URL"
+.Ft void
+.Fn fetchFreeURL "struct url *u"
+.Ft FILE *
+.Fn fetchXGetURL "const char *URL" "struct url_stat *us" "const char *flags"
+.Ft FILE *
+.Fn fetchGetURL "const char *URL" "const char *flags"
+.Ft FILE *
+.Fn fetchPutURL "const char *URL" "const char *flags"
+.Ft int
+.Fn fetchStatURL "const char *URL" "struct url_stat *us" "const char *flags"
+.Ft struct url_ent *
+.Fn fetchListURL "const char *URL" "const char *flags"
+.Ft FILE *
+.Fn fetchXGet "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft FILE *
+.Fn fetchGet "struct url *u" "const char *flags"
+.Ft FILE *
+.Fn fetchPut "struct url *u" "const char *flags"
+.Ft int
+.Fn fetchStat "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft struct url_ent *
+.Fn fetchList "struct url *u" "const char *flags"
+.Ft FILE *
+.Fn fetchXGetFile "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft FILE *
+.Fn fetchGetFile "struct url *u" "const char *flags"
+.Ft FILE *
+.Fn fetchPutFile "struct url *u" "const char *flags"
+.Ft int
+.Fn fetchStatFile "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft struct url_ent *
+.Fn fetchListFile "struct url *u" "const char *flags"
+.Ft FILE *
+.Fn fetchXGetHTTP "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft FILE *
+.Fn fetchGetHTTP "struct url *u" "const char *flags"
+.Ft FILE *
+.Fn fetchPutHTTP "struct url *u" "const char *flags"
+.Ft int
+.Fn fetchStatHTTP "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft struct url_ent *
+.Fn fetchListHTTP "struct url *u" "const char *flags"
+.Ft FILE *
+.Fn fetchXGetFTP "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft FILE *
+.Fn fetchGetFTP "struct url *u" "const char *flags"
+.Ft FILE *
+.Fn fetchPutFTP "struct url *u" "const char *flags"
+.Ft int
+.Fn fetchStatFTP "struct url *u" "struct url_stat *us" "const char *flags"
+.Ft struct url_ent *
+.Fn fetchListFTP "struct url *u" "const char *flags"
+.Sh DESCRIPTION
+These functions implement a high-level library for retrieving and
+uploading files using Uniform Resource Locators (URLs).
+.Pp
+.Fn fetchParseURL
+takes a URL in the form of a null-terminated string and splits it into
+its components function according to the Common Internet Scheme Syntax
+detailed in RFC1738.
+A regular expression which produces this syntax is:
+.Bd -literal
+    <scheme>:(//(<user>(:<pwd>)?@)?<host>(:<port>)?)?/(<document>)?
+.Ed
+.Pp
+If the URL does not seem to begin with a scheme name, the following
+syntax is assumed:
+.Bd -literal
+    ((<user>(:<pwd>)?@)?<host>(:<port>)?)?/(<document>)?
+.Ed
+.Pp
+Note that some components of the URL are not necessarily relevant to
+all URL schemes.
+For instance, the file scheme only needs the <scheme> and <document>
+components.
+.Pp
+.Fn fetchMakeURL
+and
+.Fn fetchParseURL
+return a pointer to a
+.Vt url
+structure, which is defined as follows in
+.In fetch.h :
+.Bd -literal
+#define URL_SCHEMELEN 16
+#define URL_USERLEN 256
+#define URL_PWDLEN 256
+#define URL_HOSTLEN 255
+
+struct url {
+    char	 scheme[URL_SCHEMELEN + 1];
+    char	 user[URL_USERLEN + 1];
+    char	 pwd[URL_PWDLEN + 1];
+    char	 host[URL_HOSTLEN + 1];
+    int		 port;
+    char	*doc;
+    off_t	 offset;
+    size_t	 length;
+};
+.Ed
+.Pp
+The pointer returned by
+.Fn fetchMakeURL
+or
+.Fn fetchParseURL
+should be freed using
+.Fn fetchFreeURL .
+.Pp
+.Fn fetchXGetURL ,
+.Fn fetchGetURL ,
+and
+.Fn fetchPutURL
+constitute the recommended interface to the
+.Nm fetch
+library.
+They examine the URL passed to them to determine the transfer
+method, and call the appropriate lower-level functions to perform the
+actual transfer.
+.Fn fetchXGetURL
+also returns the remote document's metadata in the
+.Vt url_stat
+structure pointed to by the
+.Fa us
+argument.
+.Pp
+The
+.Fa flags
+argument is a string of characters which specify transfer options.
+The
+meaning of the individual flags is scheme-dependent, and is detailed
+in the appropriate section below.
+.Pp
+.Fn fetchStatURL
+attempts to obtain the requested document's metadata and fill in the
+structure pointed to by its second argument.
+The
+.Vt url_stat
+structure is defined as follows in
+.In fetch.h :
+.Bd -literal
+struct url_stat {
+    off_t	 size;
+    time_t	 atime;
+    time_t	 mtime;
+};
+.Ed
+.Pp
+If the size could not be obtained from the server, the
+.Fa size
+field is set to -1.
+If the modification time could not be obtained from the server, the
+.Fa mtime
+field is set to the epoch.
+If the access time could not be obtained from the server, the
+.Fa atime
+field is set to the modification time.
+.Pp
+.Fn fetchListURL
+attempts to list the contents of the directory pointed to by the URL
+provided.
+If successful, it returns a malloced array of
+.Vt url_ent
+structures.
+The
+.Vt url_ent
+structure is defined as follows in
+.In fetch.h :
+.Bd -literal
+struct url_ent {
+    char         name[MAXPATHLEN];
+    struct url_stat stat;
+};
+.Ed
+.Pp
+The list is terminated by an entry with an empty name.
+.Pp
+The pointer returned by
+.Fn fetchListURL
+should be freed using
+.Fn free .
+.Pp
+.Fn fetchXGet ,
+.Fn fetchGet ,
+.Fn fetchPut
+and
+.Fn fetchStat
+are similar to
+.Fn fetchXGetURL ,
+.Fn fetchGetURL ,
+.Fn fetchPutURL
+and
+.Fn fetchStatURL ,
+except that they expect a pre-parsed URL in the form of a pointer to
+a
+.Vt struct url
+rather than a string.
+.Pp
+All of the
+.Fn fetchXGetXXX ,
+.Fn fetchGetXXX
+and
+.Fn fetchPutXXX
+functions return a pointer to a stream which can be used to read or
+write data from or to the requested document, respectively.
+Note that
+although the implementation details of the individual access methods
+vary, it can generally be assumed that a stream returned by one of the
+.Fn fetchXGetXXX
+or
+.Fn fetchGetXXX
+functions is read-only, and that a stream returned by one of the
+.Fn fetchPutXXX
+functions is write-only.
+.Sh FILE SCHEME
+.Fn fetchXGetFile ,
+.Fn fetchGetFile
+and
+.Fn fetchPutFile
+provide access to documents which are files in a locally mounted file
+system.
+Only the <document> component of the URL is used.
+.Pp
+.Fn fetchXGetFile
+and
+.Fn fetchGetFile
+do not accept any flags.
+.Pp
+.Fn fetchPutFile
+accepts the
+.Ql a
+(append to file) flag.
+If that flag is specified, the data written to
+the stream returned by
+.Fn fetchPutFile
+will be appended to the previous contents of the file, instead of
+replacing them.
+.Sh FTP SCHEME
+.Fn fetchXGetFTP ,
+.Fn fetchGetFTP
+and
+.Fn fetchPutFTP
+implement the FTP protocol as described in RFC959.
+.Pp
+If the
+.Ql p
+(passive) flag is specified, a passive (rather than active) connection
+will be attempted.
+.Pp
+If the
+.Ql l
+(low) flag is specified, data sockets will be allocated in the low (or
+default) port range instead of the high port range (see
+.Xr ip 4 ) .
+.Pp
+If the
+.Ql d
+(direct) flag is specified,
+.Fn fetchXGetFTP ,
+.Fn fetchGetFTP
+and
+.Fn fetchPutFTP
+will use a direct connection even if a proxy server is defined.
+.Pp
+If no user name or password is given, the
+.Nm fetch
+library will attempt an anonymous login, with user name "anonymous"
+and password "anonymous@<hostname>".
+.Sh HTTP SCHEME
+The
+.Fn fetchXGetHTTP ,
+.Fn fetchGetHTTP
+and
+.Fn fetchPutHTTP
+functions implement the HTTP/1.1 protocol.
+With a little luck, there is
+even a chance that they comply with RFC2616 and RFC2617.
+.Pp
+If the
+.Ql d
+(direct) flag is specified,
+.Fn fetchXGetHTTP ,
+.Fn fetchGetHTTP
+and
+.Fn fetchPutHTTP
+will use a direct connection even if a proxy server is defined.
+.Pp
+Since there seems to be no good way of implementing the HTTP PUT
+method in a manner consistent with the rest of the
+.Nm fetch
+library,
+.Fn fetchPutHTTP
+is currently unimplemented.
+.Sh AUTHENTICATION
+Apart from setting the appropriate environment variables and
+specifying the user name and password in the URL or the
+.Vt struct url ,
+the calling program has the option of defining an authentication
+function with the following prototype:
+.Pp
+.Ft int
+.Fn myAuthMethod "struct url *u"
+.Pp
+The callback function should fill in the
+.Fa user
+and
+.Fa pwd
+fields in the provided
+.Vt struct url
+and return 0 on success, or any other value to indicate failure.
+.Pp
+To register the authentication callback, simply set
+.Va fetchAuthMethod
+to point at it.
+The callback will be used whenever a site requires authentication and
+the appropriate environment variables are not set.
+.Pp
+This interface is experimental and may be subject to change.
+.Sh RETURN VALUES
+.Fn fetchParseURL
+returns a pointer to a
+.Vt struct url
+containing the individual components of the URL.
+If it is
+unable to allocate memory, or the URL is syntactically incorrect,
+.Fn fetchParseURL
+returns a NULL pointer.
+.Pp
+The
+.Fn fetchStat
+functions return 0 on success and -1 on failure.
+.Pp
+All other functions return a stream pointer which may be used to
+access the requested document, or NULL if an error occurred.
+.Pp
+The following error codes are defined in
+.In fetch.h :
+.Bl -tag -width 18n
+.It Bq Er FETCH_ABORT
+Operation aborted
+.It Bq Er FETCH_AUTH
+Authentication failed
+.It Bq Er FETCH_DOWN
+Service unavailable
+.It Bq Er FETCH_EXISTS
+File exists
+.It Bq Er FETCH_FULL
+File system full
+.It Bq Er FETCH_INFO
+Informational response
+.It Bq Er FETCH_MEMORY
+Insufficient memory
+.It Bq Er FETCH_MOVED
+File has moved
+.It Bq Er FETCH_NETWORK
+Network error
+.It Bq Er FETCH_OK
+No error
+.It Bq Er FETCH_PROTO
+Protocol error
+.It Bq Er FETCH_RESOLV
+Resolver error
+.It Bq Er FETCH_SERVER
+Server error
+.It Bq Er FETCH_TEMP
+Temporary error
+.It Bq Er FETCH_TIMEOUT
+Operation timed out
+.It Bq Er FETCH_UNAVAIL
+File is not available
+.It Bq Er FETCH_UNKNOWN
+Unknown error
+.It Bq Er FETCH_URL
+Invalid URL
+.El
+.Pp
+The accompanying error message includes a protocol-specific error code
+and message, e.g.\& "File is not available (404 Not Found)"
+.Sh ENVIRONMENT
+.Bl -tag -width ".Ev FETCH_BIND_ADDRESS"
+.It Ev FETCH_BIND_ADDRESS
+Specifies a hostname or IP address to which sockets used for outgoing
+connections will be bound.
+.It Ev FTP_LOGIN
+Default FTP login if none was provided in the URL.
+.It Ev FTP_PASSIVE_MODE
+If set to anything but
+.Ql no ,
+forces the FTP code to use passive mode.
+.It Ev FTP_PASSWORD
+Default FTP password if the remote server requests one and none was
+provided in the URL.
+.It Ev FTP_PROXY
+URL of the proxy to use for FTP requests.
+The document part is ignored.
+FTP and HTTP proxies are supported; if no scheme is specified, FTP is
+assumed.
+If the proxy is an FTP proxy,
+.Nm libfetch
+will send
+.Ql user@host
+as user name to the proxy, where
+.Ql user
+is the real user name, and
+.Ql host
+is the name of the FTP server.
+.Pp
+If this variable is set to an empty string, no proxy will be used for
+FTP requests, even if the
+.Ev HTTP_PROXY
+variable is set.
+.It Ev ftp_proxy
+Same as
+.Ev FTP_PROXY ,
+for compatibility.
+.It Ev HTTP_AUTH
+Specifies HTTP authorization parameters as a colon-separated list of
+items.
+The first and second item are the authorization scheme and realm
+respectively; further items are scheme-dependent.
+Currently, only basic authorization is supported.
+.Pp
+Basic authorization requires two parameters: the user name and
+password, in that order.
+.Pp
+This variable is only used if the server requires authorization and
+no user name or password was specified in the URL.
+.It Ev HTTP_PROXY
+URL of the proxy to use for HTTP requests.
+The document part is ignored.
+Only HTTP proxies are supported for HTTP requests.
+If no port number is specified, the default is 3128.
+.Pp
+Note that this proxy will also be used for FTP documents, unless the
+.Ev FTP_PROXY
+variable is set.
+.It Ev http_proxy
+Same as
+.Ev HTTP_PROXY ,
+for compatibility.
+.It Ev HTTP_PROXY_AUTH
+Specifies authorization parameters for the HTTP proxy in the same
+format as the
+.Ev HTTP_AUTH
+variable.
+.Pp
+This variable is used if and only if connected to an HTTP proxy, and
+is ignored if a user and/or a password were specified in the proxy
+URL.
+.It Ev HTTP_REFERER
+Specifies the referrer URL to use for HTTP requests.
+If set to
+.Dq auto ,
+the document URL will be used as referrer URL.
+.It Ev HTTP_USER_AGENT
+Specifies the User-Agent string to use for HTTP requests.
+This can be useful when working with HTTP origin or proxy servers that
+differentiate between user agents.
+.It Ev NETRC
+Specifies a file to use instead of
+.Pa ~/.netrc
+to look up login names and passwords for FTP sites.
+See
+.Xr ftp 1
+for a description of the file format.
+This feature is experimental.
+.It Ev NO_PROXY
+Either a single asterisk, which disables the use of proxies
+altogether, or a comma- or whitespace-separated list of hosts for
+which proxies should not be used.
+.It Ev no_proxy
+Same as
+.Ev NO_PROXY ,
+for compatibility.
+.El
+.Sh EXAMPLES
+To access a proxy server on
+.Pa proxy.example.com
+port 8080, set the
+.Ev HTTP_PROXY
+environment variable in a manner similar to this:
+.Pp
+.Dl HTTP_PROXY=http://proxy.example.com:8080
+.Pp
+If the proxy server requires authentication, there are
+two options available for passing the authentication data.
+The first method is by using the proxy URL:
+.Pp
+.Dl HTTP_PROXY=http://<user>:<pwd>@proxy.example.com:8080
+.Pp
+The second method is by using the
+.Ev HTTP_PROXY_AUTH
+environment variable:
+.Bd -literal -offset indent
+HTTP_PROXY=http://proxy.example.com:8080
+HTTP_PROXY_AUTH=basic:*:<user>:<pwd>
+.Ed
+.Pp
+To disable the use of a proxy for an HTTP server running on the local
+host, define
+.Ev NO_PROXY
+as follows:
+.Bd -literal -offset indent
+NO_PROXY=localhost,127.0.0.1
+.Ed
+.Sh SEE ALSO
+.Xr fetch 1 ,
+.Xr ftpio 3 ,
+.Xr ip 4
+.Rs
+.%A J. Postel
+.%A J. K. Reynolds
+.%D October 1985
+.%B File Transfer Protocol
+.%O RFC959
+.Re
+.Rs
+.%A P. Deutsch
+.%A A. Emtage
+.%A A. Marine.
+.%D May 1994
+.%T How to Use Anonymous FTP
+.%O RFC1635
+.Re
+.Rs
+.%A T. Berners-Lee
+.%A L. Masinter
+.%A M. McCahill
+.%D December 1994
+.%T Uniform Resource Locators (URL)
+.%O RFC1738
+.Re
+.Rs
+.%A R. Fielding
+.%A J. Gettys
+.%A J. Mogul
+.%A H. Frystyk
+.%A L. Masinter
+.%A P. Leach
+.%A T. Berners-Lee
+.%D January 1999
+.%B Hypertext Transfer Protocol -- HTTP/1.1
+.%O RFC2616
+.Re
+.Rs
+.%A J. Franks
+.%A P. Hallam-Baker
+.%A J. Hostetler
+.%A S. Lawrence
+.%A P. Leach
+.%A A. Luotonen
+.%A L. Stewart
+.%D June 1999
+.%B HTTP Authentication: Basic and Digest Access Authentication
+.%O RFC2617
+.Re
+.Sh HISTORY
+The
+.Nm fetch
+library first appeared in
+.Fx 3.0 .
+.Sh AUTHORS
+.An -nosplit
+The
+.Nm fetch
+library was mostly written by
+.An Dag-Erling Sm\(/orgrav Aq des@FreeBSD.org
+with numerous suggestions from
+.An Jordan K. Hubbard Aq jkh@FreeBSD.org ,
+.An Eugene Skepner Aq eu@qub.com
+and other
+.Fx
+developers.
+It replaces the older
+.Nm ftpio
+library written by
+.An Poul-Henning Kamp Aq phk@FreeBSD.org
+and
+.An Jordan K. Hubbard Aq jkh@FreeBSD.org .
+.Pp
+This manual page was written by
+.An Dag-Erling Sm\(/orgrav Aq des@FreeBSD.org .
+.Sh BUGS
+Some parts of the library are not yet implemented.
+The most notable
+examples of this are
+.Fn fetchPutHTTP ,
+.Fn fetchListHTTP ,
+.Fn fetchListFTP
+and FTP proxy support.
+.Pp
+There is no way to select a proxy at run-time other than setting the
+.Ev HTTP_PROXY
+or
+.Ev FTP_PROXY
+environment variables as appropriate.
+.Pp
+.Nm libfetch
+does not understand or obey 305 (Use Proxy) replies.
+.Pp
+Error numbers are unique only within a certain context; the error
+codes used for FTP and HTTP overlap, as do those used for resolver and
+system errors.
+For instance, error code 202 means "Command not
+implemented, superfluous at this site" in an FTP context and
+"Accepted" in an HTTP context.
+.Pp
+.Fn fetchStatFTP
+does not check that the result of an MDTM command is a valid date.
+.Pp
+The man page is incomplete, poorly written and produces badly
+formatted text.
+.Pp
+The error reporting mechanism is unsatisfactory.
+.Pp
+Some parts of the code are not fully reentrant.
diff --git a/net/libfetch/files/fetch.c b/net/libfetch/files/fetch.c
new file mode 100644
index 00000000000..95f4cadc529
--- /dev/null
+++ b/net/libfetch/files/fetch.c
@@ -0,0 +1,436 @@
+/*	$NetBSD: fetch.c,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $	*/
+/*-
+ * Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD: fetch.c,v 1.41 2007/12/19 00:26:36 des Exp $
+ */
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "fetch.h"
+#include "common.h"
+
+auth_t	 fetchAuthMethod;
+int	 fetchLastErrCode;
+char	 fetchLastErrString[MAXERRSTRING];
+int	 fetchTimeout;
+int	 fetchRestartCalls = 1;
+int	 fetchDebug;
+
+
+/*** Local data **************************************************************/
+
+/*
+ * Error messages for parser errors
+ */
+#define URL_MALFORMED		1
+#define URL_BAD_SCHEME		2
+#define URL_BAD_PORT		3
+static struct fetcherr url_errlist[] = {
+	{ URL_MALFORMED,	FETCH_URL,	"Malformed URL" },
+	{ URL_BAD_SCHEME,	FETCH_URL,	"Invalid URL scheme" },
+	{ URL_BAD_PORT,		FETCH_URL,	"Invalid server port" },
+	{ -1,			FETCH_UNKNOWN,	"Unknown parser error" }
+};
+
+
+/*** Public API **************************************************************/
+
+/*
+ * Select the appropriate protocol for the URL scheme, and return a
+ * read-only stream connected to the document referenced by the URL.
+ * Also fill out the struct url_stat.
+ */
+FILE *
+fetchXGet(struct url *URL, struct url_stat *us, const char *flags)
+{
+	int direct;
+
+	direct = CHECK_FLAG('d');
+	if (us != NULL) {
+		us->size = -1;
+		us->atime = us->mtime = 0;
+	}
+	if (strcasecmp(URL->scheme, SCHEME_FILE) == 0)
+		return (fetchXGetFile(URL, us, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_FTP) == 0)
+		return (fetchXGetFTP(URL, us, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTP) == 0)
+		return (fetchXGetHTTP(URL, us, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTPS) == 0)
+		return (fetchXGetHTTP(URL, us, flags));
+	url_seterr(URL_BAD_SCHEME);
+	return (NULL);
+}
+
+/*
+ * Select the appropriate protocol for the URL scheme, and return a
+ * read-only stream connected to the document referenced by the URL.
+ */
+FILE *
+fetchGet(struct url *URL, const char *flags)
+{
+	return (fetchXGet(URL, NULL, flags));
+}
+
+/*
+ * Select the appropriate protocol for the URL scheme, and return a
+ * write-only stream connected to the document referenced by the URL.
+ */
+FILE *
+fetchPut(struct url *URL, const char *flags)
+{
+	int direct;
+
+	direct = CHECK_FLAG('d');
+	if (strcasecmp(URL->scheme, SCHEME_FILE) == 0)
+		return (fetchPutFile(URL, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_FTP) == 0)
+		return (fetchPutFTP(URL, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTP) == 0)
+		return (fetchPutHTTP(URL, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTPS) == 0)
+		return (fetchPutHTTP(URL, flags));
+	url_seterr(URL_BAD_SCHEME);
+	return (NULL);
+}
+
+/*
+ * Select the appropriate protocol for the URL scheme, and return the
+ * size of the document referenced by the URL if it exists.
+ */
+int
+fetchStat(struct url *URL, struct url_stat *us, const char *flags)
+{
+	int direct;
+
+	direct = CHECK_FLAG('d');
+	if (us != NULL) {
+		us->size = -1;
+		us->atime = us->mtime = 0;
+	}
+	if (strcasecmp(URL->scheme, SCHEME_FILE) == 0)
+		return (fetchStatFile(URL, us, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_FTP) == 0)
+		return (fetchStatFTP(URL, us, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTP) == 0)
+		return (fetchStatHTTP(URL, us, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTPS) == 0)
+		return (fetchStatHTTP(URL, us, flags));
+	url_seterr(URL_BAD_SCHEME);
+	return (-1);
+}
+
+/*
+ * Select the appropriate protocol for the URL scheme, and return a
+ * list of files in the directory pointed to by the URL.
+ */
+struct url_ent *
+fetchList(struct url *URL, const char *flags)
+{
+	int direct;
+
+	direct = CHECK_FLAG('d');
+	if (strcasecmp(URL->scheme, SCHEME_FILE) == 0)
+		return (fetchListFile(URL, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_FTP) == 0)
+		return (fetchListFTP(URL, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTP) == 0)
+		return (fetchListHTTP(URL, flags));
+	else if (strcasecmp(URL->scheme, SCHEME_HTTPS) == 0)
+		return (fetchListHTTP(URL, flags));
+	url_seterr(URL_BAD_SCHEME);
+	return (NULL);
+}
+
+/*
+ * Attempt to parse the given URL; if successful, call fetchXGet().
+ */
+FILE *
+fetchXGetURL(const char *URL, struct url_stat *us, const char *flags)
+{
+	struct url *u;
+	FILE *f;
+
+	if ((u = fetchParseURL(URL)) == NULL)
+		return (NULL);
+
+	f = fetchXGet(u, us, flags);
+
+	fetchFreeURL(u);
+	return (f);
+}
+
+/*
+ * Attempt to parse the given URL; if successful, call fetchGet().
+ */
+FILE *
+fetchGetURL(const char *URL, const char *flags)
+{
+	return (fetchXGetURL(URL, NULL, flags));
+}
+
+/*
+ * Attempt to parse the given URL; if successful, call fetchPut().
+ */
+FILE *
+fetchPutURL(const char *URL, const char *flags)
+{
+	struct url *u;
+	FILE *f;
+
+	if ((u = fetchParseURL(URL)) == NULL)
+		return (NULL);
+
+	f = fetchPut(u, flags);
+
+	fetchFreeURL(u);
+	return (f);
+}
+
+/*
+ * Attempt to parse the given URL; if successful, call fetchStat().
+ */
+int
+fetchStatURL(const char *URL, struct url_stat *us, const char *flags)
+{
+	struct url *u;
+	int s;
+
+	if ((u = fetchParseURL(URL)) == NULL)
+		return (-1);
+
+	s = fetchStat(u, us, flags);
+
+	fetchFreeURL(u);
+	return (s);
+}
+
+/*
+ * Attempt to parse the given URL; if successful, call fetchList().
+ */
+struct url_ent *
+fetchListURL(const char *URL, const char *flags)
+{
+	struct url *u;
+	struct url_ent *ue;
+
+	if ((u = fetchParseURL(URL)) == NULL)
+		return (NULL);
+
+	ue = fetchList(u, flags);
+
+	fetchFreeURL(u);
+	return (ue);
+}
+
+/*
+ * Make a URL
+ */
+struct url *
+fetchMakeURL(const char *scheme, const char *host, int port, const char *doc,
+    const char *user, const char *pwd)
+{
+	struct url *u;
+
+	if (!scheme || (!host && !doc)) {
+		url_seterr(URL_MALFORMED);
+		return (NULL);
+	}
+
+	if (port < 0 || port > 65535) {
+		url_seterr(URL_BAD_PORT);
+		return (NULL);
+	}
+
+	/* allocate struct url */
+	if ((u = calloc(1, sizeof(*u))) == NULL) {
+		fetch_syserr();
+		return (NULL);
+	}
+
+	if ((u->doc = strdup(doc ? doc : "/")) == NULL) {
+		fetch_syserr();
+		free(u);
+		return (NULL);
+	}
+
+#define seturl(x) snprintf(u->x, sizeof(u->x), "%s", x)
+	seturl(scheme);
+	seturl(host);
+	seturl(user);
+	seturl(pwd);
+#undef seturl
+	u->port = port;
+
+	return (u);
+}
+
+/*
+ * Split an URL into components. URL syntax is:
+ * [method:/][/[user[:pwd]@]host[:port]/][document]
+ * This almost, but not quite, RFC1738 URL syntax.
+ */
+struct url *
+fetchParseURL(const char *URL)
+{
+	char *doc;
+	const char *p, *q;
+	struct url *u;
+	int i;
+
+	/* allocate struct url */
+	if ((u = calloc(1, sizeof(*u))) == NULL) {
+		fetch_syserr();
+		return (NULL);
+	}
+
+	/* scheme name */
+	if ((p = strstr(URL, ":/"))) {
+		snprintf(u->scheme, URL_SCHEMELEN+1,
+		    "%.*s", (int)(p - URL), URL);
+		URL = ++p;
+		/*
+		 * Only one slash: no host, leave slash as part of document
+		 * Two slashes: host follows, strip slashes
+		 */
+		if (URL[1] == '/')
+			URL = (p += 2);
+	} else {
+		p = URL;
+	}
+	if (!*URL || *URL == '/' || *URL == '.' ||
+	    (u->scheme[0] == '\0' &&
+		strchr(URL, '/') == NULL && strchr(URL, ':') == NULL))
+		goto nohost;
+
+	p = strpbrk(URL, "/@");
+	if (p && *p == '@') {
+		/* username */
+		for (q = URL, i = 0; (*q != ':') && (*q != '@'); q++)
+			if (i < URL_USERLEN)
+				u->user[i++] = *q;
+
+		/* password */
+		if (*q == ':')
+			for (q++, i = 0; (*q != ':') && (*q != '@'); q++)
+				if (i < URL_PWDLEN)
+					u->pwd[i++] = *q;
+
+		p++;
+	} else {
+		p = URL;
+	}
+
+	/* hostname */
+#ifdef INET6
+	if (*p == '[' && (q = strchr(p + 1, ']')) != NULL &&
+	    (*++q == '\0' || *q == '/' || *q == ':')) {
+		if ((i = q - p - 2) > URL_HOSTLEN)
+			i = URL_HOSTLEN;
+		strncpy(u->host, ++p, i);
+		p = q;
+	} else
+#endif
+		for (i = 0; *p && (*p != '/') && (*p != ':'); p++)
+			if (i < URL_HOSTLEN)
+				u->host[i++] = *p;
+
+	/* port */
+	if (*p == ':') {
+		for (q = ++p; *q && (*q != '/'); q++)
+			if (isdigit((unsigned char)*q))
+				u->port = u->port * 10 + (*q - '0');
+			else {
+				/* invalid port */
+				url_seterr(URL_BAD_PORT);
+				goto ouch;
+			}
+		p = q;
+	}
+
+nohost:
+	/* document */
+	if (!*p)
+		p = "/";
+
+	if (strcasecmp(u->scheme, SCHEME_HTTP) == 0 ||
+	    strcasecmp(u->scheme, SCHEME_HTTPS) == 0) {
+		const char hexnums[] = "0123456789abcdef";
+
+		/* percent-escape whitespace. */
+		if ((doc = malloc(strlen(p) * 3 + 1)) == NULL) {
+			fetch_syserr();
+			goto ouch;
+		}
+		u->doc = doc;
+		while (*p != '\0') {
+			if (!isspace((unsigned char)*p)) {
+				*doc++ = *p++;
+			} else {
+				*doc++ = '%';
+				*doc++ = hexnums[((unsigned int)*p) >> 4];
+				*doc++ = hexnums[((unsigned int)*p) & 0xf];
+				p++;
+			}
+		}
+		*doc = '\0';
+	} else if ((u->doc = strdup(p)) == NULL) {
+		fetch_syserr();
+		goto ouch;
+	}
+
+	DEBUG(fprintf(stderr,
+		  "scheme:   [%s]\n"
+		  "user:     [%s]\n"
+		  "password: [%s]\n"
+		  "host:     [%s]\n"
+		  "port:     [%d]\n"
+		  "document: [%s]\n",
+		  u->scheme, u->user, u->pwd,
+		  u->host, u->port, u->doc));
+
+	return (u);
+
+ouch:
+	free(u);
+	return (NULL);
+}
+
+/*
+ * Free a URL
+ */
+void
+fetchFreeURL(struct url *u)
+{
+	free(u->doc);
+	free(u);
+}
diff --git a/net/libfetch/files/fetch.cat3 b/net/libfetch/files/fetch.cat3
new file mode 100644
index 00000000000..2e069ffa202
--- /dev/null
+++ b/net/libfetch/files/fetch.cat3
@@ -0,0 +1,468 @@
+FETCH(3)                NetBSD Library Functions Manual               FETCH(3)
+
+NNAAMMEE
+     ffeettcchhMMaakkeeUURRLL, ffeettcchhPPaarrsseeUURRLL, ffeettcchhFFrreeeeUURRLL, ffeettcchhXXGGeettUURRLL, ffeettcchhGGeettUURRLL,
+     ffeettcchhPPuuttUURRLL, ffeettcchhSSttaattUURRLL, ffeettcchhLLiissttUURRLL, ffeettcchhXXGGeett, ffeettcchhGGeett, ffeettcchhPPuutt,
+     ffeettcchhSSttaatt, ffeettcchhLLiisstt, ffeettcchhXXGGeettFFiillee, ffeettcchhGGeettFFiillee, ffeettcchhPPuuttFFiillee,
+     ffeettcchhSSttaattFFiillee, ffeettcchhLLiissttFFiillee, ffeettcchhXXGGeettHHTTTTPP, ffeettcchhGGeettHHTTTTPP, ffeettcchhPPuuttHHTTTTPP,
+     ffeettcchhSSttaattHHTTTTPP, ffeettcchhLLiissttHHTTTTPP, ffeettcchhXXGGeettFFTTPP, ffeettcchhGGeettFFTTPP, ffeettcchhPPuuttFFTTPP,
+     ffeettcchhSSttaattFFTTPP, ffeettcchhLLiissttFFTTPP -- file transfer functions
+
+LLIIBBRRAARRYY
+     library ``libfetch''
+
+SSYYNNOOPPSSIISS
+     ##iinncclluuddee <<ssttddiioo..hh>>
+     ##iinncclluuddee <<ffeettcchh..hh>>
+
+     _s_t_r_u_c_t _u_r_l _*
+     ffeettcchhMMaakkeeUURRLL(_c_o_n_s_t _c_h_a_r _*_s_c_h_e_m_e, _c_o_n_s_t _c_h_a_r _*_h_o_s_t, _i_n_t _p_o_r_t,
+         _c_o_n_s_t _c_h_a_r _*_d_o_c, _c_o_n_s_t _c_h_a_r _*_u_s_e_r, _c_o_n_s_t _c_h_a_r _*_p_w_d);
+
+     _s_t_r_u_c_t _u_r_l _*
+     ffeettcchhPPaarrsseeUURRLL(_c_o_n_s_t _c_h_a_r _*_U_R_L);
+
+     _v_o_i_d
+     ffeettcchhFFrreeeeUURRLL(_s_t_r_u_c_t _u_r_l _*_u);
+
+     _F_I_L_E _*
+     ffeettcchhXXGGeettUURRLL(_c_o_n_s_t _c_h_a_r _*_U_R_L, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhGGeettUURRLL(_c_o_n_s_t _c_h_a_r _*_U_R_L, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhPPuuttUURRLL(_c_o_n_s_t _c_h_a_r _*_U_R_L, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _i_n_t
+     ffeettcchhSSttaattUURRLL(_c_o_n_s_t _c_h_a_r _*_U_R_L, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _s_t_r_u_c_t _u_r_l___e_n_t _*
+     ffeettcchhLLiissttUURRLL(_c_o_n_s_t _c_h_a_r _*_U_R_L, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhXXGGeett(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhGGeett(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhPPuutt(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _i_n_t
+     ffeettcchhSSttaatt(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _s_t_r_u_c_t _u_r_l___e_n_t _*
+     ffeettcchhLLiisstt(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhXXGGeettFFiillee(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhGGeettFFiillee(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhPPuuttFFiillee(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _i_n_t
+     ffeettcchhSSttaattFFiillee(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _s_t_r_u_c_t _u_r_l___e_n_t _*
+     ffeettcchhLLiissttFFiillee(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhXXGGeettHHTTTTPP(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhGGeettHHTTTTPP(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhPPuuttHHTTTTPP(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _i_n_t
+     ffeettcchhSSttaattHHTTTTPP(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _s_t_r_u_c_t _u_r_l___e_n_t _*
+     ffeettcchhLLiissttHHTTTTPP(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhXXGGeettFFTTPP(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhGGeettFFTTPP(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _F_I_L_E _*
+     ffeettcchhPPuuttFFTTPP(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _i_n_t
+     ffeettcchhSSttaattFFTTPP(_s_t_r_u_c_t _u_r_l _*_u, _s_t_r_u_c_t _u_r_l___s_t_a_t _*_u_s, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+     _s_t_r_u_c_t _u_r_l___e_n_t _*
+     ffeettcchhLLiissttFFTTPP(_s_t_r_u_c_t _u_r_l _*_u, _c_o_n_s_t _c_h_a_r _*_f_l_a_g_s);
+
+DDEESSCCRRIIPPTTIIOONN
+     These functions implement a high-level library for retrieving and upload-
+     ing files using Uniform Resource Locators (URLs).
+
+     ffeettcchhPPaarrsseeUURRLL() takes a URL in the form of a null-terminated string and
+     splits it into its components function according to the Common Internet
+     Scheme Syntax detailed in RFC1738.  A regular expression which produces
+     this syntax is:
+
+         <scheme>:(//(<user>(:<pwd>)?@)?<host>(:<port>)?)?/(<document>)?
+
+     If the URL does not seem to begin with a scheme name, the following syn-
+     tax is assumed:
+
+         ((<user>(:<pwd>)?@)?<host>(:<port>)?)?/(<document>)?
+
+     Note that some components of the URL are not necessarily relevant to all
+     URL schemes.  For instance, the file scheme only needs the <scheme> and
+     <document> components.
+
+     ffeettcchhMMaakkeeUURRLL() and ffeettcchhPPaarrsseeUURRLL() return a pointer to a _u_r_l structure,
+     which is defined as follows in <_f_e_t_c_h_._h>:
+
+     #define URL_SCHEMELEN 16
+     #define URL_USERLEN 256
+     #define URL_PWDLEN 256
+     #define URL_HOSTLEN 255
+
+     struct url {
+         char         scheme[URL_SCHEMELEN + 1];
+         char         user[URL_USERLEN + 1];
+         char         pwd[URL_PWDLEN + 1];
+         char         host[URL_HOSTLEN + 1];
+         int          port;
+         char        *doc;
+         off_t        offset;
+         size_t       length;
+     };
+
+     The pointer returned by ffeettcchhMMaakkeeUURRLL() or ffeettcchhPPaarrsseeUURRLL() should be freed
+     using ffeettcchhFFrreeeeUURRLL().
+
+     ffeettcchhXXGGeettUURRLL(), ffeettcchhGGeettUURRLL(), and ffeettcchhPPuuttUURRLL() constitute the recom-
+     mended interface to the ffeettcchh library.  They examine the URL passed to
+     them to determine the transfer method, and call the appropriate lower-
+     level functions to perform the actual transfer.  ffeettcchhXXGGeettUURRLL() also
+     returns the remote document's metadata in the _u_r_l___s_t_a_t structure pointed
+     to by the _u_s argument.
+
+     The _f_l_a_g_s argument is a string of characters which specify transfer
+     options.  The meaning of the individual flags is scheme-dependent, and is
+     detailed in the appropriate section below.
+
+     ffeettcchhSSttaattUURRLL() attempts to obtain the requested document's metadata and
+     fill in the structure pointed to by its second argument.  The _u_r_l___s_t_a_t
+     structure is defined as follows in <_f_e_t_c_h_._h>:
+
+     struct url_stat {
+         off_t        size;
+         time_t       atime;
+         time_t       mtime;
+     };
+
+     If the size could not be obtained from the server, the _s_i_z_e field is set
+     to -1.  If the modification time could not be obtained from the server,
+     the _m_t_i_m_e field is set to the epoch.  If the access time could not be
+     obtained from the server, the _a_t_i_m_e field is set to the modification
+     time.
+
+     ffeettcchhLLiissttUURRLL() attempts to list the contents of the directory pointed to
+     by the URL provided.  If successful, it returns a malloced array of
+     _u_r_l___e_n_t structures.  The _u_r_l___e_n_t structure is defined as follows in
+     <_f_e_t_c_h_._h>:
+
+     struct url_ent {
+         char         name[MAXPATHLEN];
+         struct url_stat stat;
+     };
+
+     The list is terminated by an entry with an empty name.
+
+     The pointer returned by ffeettcchhLLiissttUURRLL() should be freed using ffrreeee().
+
+     ffeettcchhXXGGeett(), ffeettcchhGGeett(), ffeettcchhPPuutt() and ffeettcchhSSttaatt() are similar to
+     ffeettcchhXXGGeettUURRLL(), ffeettcchhGGeettUURRLL(), ffeettcchhPPuuttUURRLL() and ffeettcchhSSttaattUURRLL(), except
+     that they expect a pre-parsed URL in the form of a pointer to a _s_t_r_u_c_t
+     _u_r_l rather than a string.
+
+     All of the ffeettcchhXXGGeettXXXXXX(), ffeettcchhGGeettXXXXXX() and ffeettcchhPPuuttXXXXXX() functions
+     return a pointer to a stream which can be used to read or write data from
+     or to the requested document, respectively.  Note that although the
+     implementation details of the individual access methods vary, it can gen-
+     erally be assumed that a stream returned by one of the ffeettcchhXXGGeettXXXXXX() or
+     ffeettcchhGGeettXXXXXX() functions is read-only, and that a stream returned by one
+     of the ffeettcchhPPuuttXXXXXX() functions is write-only.
+
+FFIILLEE SSCCHHEEMMEE
+     ffeettcchhXXGGeettFFiillee(), ffeettcchhGGeettFFiillee() and ffeettcchhPPuuttFFiillee() provide access to doc-
+     uments which are files in a locally mounted file system.  Only the <docu-
+     ment> component of the URL is used.
+
+     ffeettcchhXXGGeettFFiillee() and ffeettcchhGGeettFFiillee() do not accept any flags.
+
+     ffeettcchhPPuuttFFiillee() accepts the `a' (append to file) flag.  If that flag is
+     specified, the data written to the stream returned by ffeettcchhPPuuttFFiillee() will
+     be appended to the previous contents of the file, instead of replacing
+     them.
+
+FFTTPP SSCCHHEEMMEE
+     ffeettcchhXXGGeettFFTTPP(), ffeettcchhGGeettFFTTPP() and ffeettcchhPPuuttFFTTPP() implement the FTP proto-
+     col as described in RFC959.
+
+     If the `p' (passive) flag is specified, a passive (rather than active)
+     connection will be attempted.
+
+     If the `l' (low) flag is specified, data sockets will be allocated in the
+     low (or default) port range instead of the high port range (see ip(4)).
+
+     If the `d' (direct) flag is specified, ffeettcchhXXGGeettFFTTPP(), ffeettcchhGGeettFFTTPP() and
+     ffeettcchhPPuuttFFTTPP() will use a direct connection even if a proxy server is
+     defined.
+
+     If no user name or password is given, the ffeettcchh library will attempt an
+     anonymous login, with user name "anonymous" and password "anony-
+     mous@<hostname>".
+
+HHTTTTPP SSCCHHEEMMEE
+     The ffeettcchhXXGGeettHHTTTTPP(), ffeettcchhGGeettHHTTTTPP() and ffeettcchhPPuuttHHTTTTPP() functions imple-
+     ment the HTTP/1.1 protocol.  With a little luck, there is even a chance
+     that they comply with RFC2616 and RFC2617.
+
+     If the `d' (direct) flag is specified, ffeettcchhXXGGeettHHTTTTPP(), ffeettcchhGGeettHHTTTTPP()
+     and ffeettcchhPPuuttHHTTTTPP() will use a direct connection even if a proxy server is
+     defined.
+
+     Since there seems to be no good way of implementing the HTTP PUT method
+     in a manner consistent with the rest of the ffeettcchh library, ffeettcchhPPuuttHHTTTTPP()
+     is currently unimplemented.
+
+AAUUTTHHEENNTTIICCAATTIIOONN
+     Apart from setting the appropriate environment variables and specifying
+     the user name and password in the URL or the _s_t_r_u_c_t _u_r_l, the calling pro-
+     gram has the option of defining an authentication function with the fol-
+     lowing prototype:
+
+     _i_n_t mmyyAAuutthhMMeetthhoodd(_s_t_r_u_c_t _u_r_l _*_u)
+
+     The callback function should fill in the _u_s_e_r and _p_w_d fields in the pro-
+     vided _s_t_r_u_c_t _u_r_l and return 0 on success, or any other value to indicate
+     failure.
+
+     To register the authentication callback, simply set _f_e_t_c_h_A_u_t_h_M_e_t_h_o_d to
+     point at it.  The callback will be used whenever a site requires authen-
+     tication and the appropriate environment variables are not set.
+
+     This interface is experimental and may be subject to change.
+
+RREETTUURRNN VVAALLUUEESS
+     ffeettcchhPPaarrsseeUURRLL() returns a pointer to a _s_t_r_u_c_t _u_r_l containing the individ-
+     ual components of the URL.  If it is unable to allocate memory, or the
+     URL is syntactically incorrect, ffeettcchhPPaarrsseeUURRLL() returns a NULL pointer.
+
+     The ffeettcchhSSttaatt() functions return 0 on success and -1 on failure.
+
+     All other functions return a stream pointer which may be used to access
+     the requested document, or NULL if an error occurred.
+
+     The following error codes are defined in <_f_e_t_c_h_._h>:
+
+     [FETCH_ABORT]       Operation aborted
+
+     [FETCH_AUTH]        Authentication failed
+
+     [FETCH_DOWN]        Service unavailable
+
+     [FETCH_EXISTS]      File exists
+
+     [FETCH_FULL]        File system full
+
+     [FETCH_INFO]        Informational response
+
+     [FETCH_MEMORY]      Insufficient memory
+
+     [FETCH_MOVED]       File has moved
+
+     [FETCH_NETWORK]     Network error
+
+     [FETCH_OK]          No error
+
+     [FETCH_PROTO]       Protocol error
+
+     [FETCH_RESOLV]      Resolver error
+
+     [FETCH_SERVER]      Server error
+
+     [FETCH_TEMP]        Temporary error
+
+     [FETCH_TIMEOUT]     Operation timed out
+
+     [FETCH_UNAVAIL]     File is not available
+
+     [FETCH_UNKNOWN]     Unknown error
+
+     [FETCH_URL]         Invalid URL
+
+     The accompanying error message includes a protocol-specific error code
+     and message, e.g. "File is not available (404 Not Found)"
+
+EENNVVIIRROONNMMEENNTT
+     FETCH_BIND_ADDRESS  Specifies a hostname or IP address to which sockets
+                         used for outgoing connections will be bound.
+
+     FTP_LOGIN           Default FTP login if none was provided in the URL.
+
+     FTP_PASSIVE_MODE    If set to anything but `no', forces the FTP code to
+                         use passive mode.
+
+     FTP_PASSWORD        Default FTP password if the remote server requests
+                         one and none was provided in the URL.
+
+     FTP_PROXY           URL of the proxy to use for FTP requests.  The docu-
+                         ment part is ignored.  FTP and HTTP proxies are sup-
+                         ported; if no scheme is specified, FTP is assumed.
+                         If the proxy is an FTP proxy, lliibbffeettcchh will send
+                         `user@host' as user name to the proxy, where `user'
+                         is the real user name, and `host' is the name of the
+                         FTP server.
+
+                         If this variable is set to an empty string, no proxy
+                         will be used for FTP requests, even if the HTTP_PROXY
+                         variable is set.
+
+     ftp_proxy           Same as FTP_PROXY, for compatibility.
+
+     HTTP_AUTH           Specifies HTTP authorization parameters as a colon-
+                         separated list of items.  The first and second item
+                         are the authorization scheme and realm respectively;
+                         further items are scheme-dependent.  Currently, only
+                         basic authorization is supported.
+
+                         Basic authorization requires two parameters: the user
+                         name and password, in that order.
+
+                         This variable is only used if the server requires
+                         authorization and no user name or password was speci-
+                         fied in the URL.
+
+     HTTP_PROXY          URL of the proxy to use for HTTP requests.  The docu-
+                         ment part is ignored.  Only HTTP proxies are sup-
+                         ported for HTTP requests.  If no port number is spec-
+                         ified, the default is 3128.
+
+                         Note that this proxy will also be used for FTP docu-
+                         ments, unless the FTP_PROXY variable is set.
+
+     http_proxy          Same as HTTP_PROXY, for compatibility.
+
+     HTTP_PROXY_AUTH     Specifies authorization parameters for the HTTP proxy
+                         in the same format as the HTTP_AUTH variable.
+
+                         This variable is used if and only if connected to an
+                         HTTP proxy, and is ignored if a user and/or a pass-
+                         word were specified in the proxy URL.
+
+     HTTP_REFERER        Specifies the referrer URL to use for HTTP requests.
+                         If set to ``auto'', the document URL will be used as
+                         referrer URL.
+
+     HTTP_USER_AGENT     Specifies the User-Agent string to use for HTTP
+                         requests.  This can be useful when working with HTTP
+                         origin or proxy servers that differentiate between
+                         user agents.
+
+     NETRC               Specifies a file to use instead of _~_/_._n_e_t_r_c to look
+                         up login names and passwords for FTP sites.  See
+                         ftp(1) for a description of the file format.  This
+                         feature is experimental.
+
+     NO_PROXY            Either a single asterisk, which disables the use of
+                         proxies altogether, or a comma- or whitespace-sepa-
+                         rated list of hosts for which proxies should not be
+                         used.
+
+     no_proxy            Same as NO_PROXY, for compatibility.
+
+EEXXAAMMPPLLEESS
+     To access a proxy server on _p_r_o_x_y_._e_x_a_m_p_l_e_._c_o_m port 8080, set the
+     HTTP_PROXY environment variable in a manner similar to this:
+
+           HTTP_PROXY=http://proxy.example.com:8080
+
+     If the proxy server requires authentication, there are two options avail-
+     able for passing the authentication data.  The first method is by using
+     the proxy URL:
+
+           HTTP_PROXY=http://<user>:<pwd>@proxy.example.com:8080
+
+     The second method is by using the HTTP_PROXY_AUTH environment variable:
+
+           HTTP_PROXY=http://proxy.example.com:8080
+           HTTP_PROXY_AUTH=basic:*:<user>:<pwd>
+
+     To disable the use of a proxy for an HTTP server running on the local
+     host, define NO_PROXY as follows:
+
+           NO_PROXY=localhost,127.0.0.1
+
+SSEEEE AALLSSOO
+     fetch(1), ftpio(3), ip(4)
+
+     J. Postel and J. K. Reynolds, _F_i_l_e _T_r_a_n_s_f_e_r _P_r_o_t_o_c_o_l, October 1985,
+     RFC959.
+
+     P. Deutsch, A. Emtage, and A. Marine., _H_o_w _t_o _U_s_e _A_n_o_n_y_m_o_u_s _F_T_P, May
+     1994, RFC1635.
+
+     T. Berners-Lee, L. Masinter, and M. McCahill, _U_n_i_f_o_r_m _R_e_s_o_u_r_c_e _L_o_c_a_t_o_r_s
+     _(_U_R_L_), December 1994, RFC1738.
+
+     R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and
+     T. Berners-Lee, _H_y_p_e_r_t_e_x_t _T_r_a_n_s_f_e_r _P_r_o_t_o_c_o_l _-_- _H_T_T_P_/_1_._1, January 1999,
+     RFC2616.
+
+     J. Franks, P. Hallam-Baker, J. Hostetler, S. Lawrence, P. Leach, A.
+     Luotonen, and L. Stewart, _H_T_T_P _A_u_t_h_e_n_t_i_c_a_t_i_o_n_: _B_a_s_i_c _a_n_d _D_i_g_e_s_t _A_c_c_e_s_s
+     _A_u_t_h_e_n_t_i_c_a_t_i_o_n, June 1999, RFC2617.
+
+HHIISSTTOORRYY
+     The ffeettcchh library first appeared in FreeBSD 3.0.
+
+AAUUTTHHOORRSS
+     The ffeettcchh library was mostly written by Dag-Erling Sm/orgrav
+     <des@FreeBSD.org> with numerous suggestions from Jordan K. Hubbard
+     <jkh@FreeBSD.org>, Eugene Skepner <eu@qub.com> and other FreeBSD develop-
+     ers.  It replaces the older ffttppiioo library written by Poul-Henning Kamp
+     <phk@FreeBSD.org> and Jordan K. Hubbard <jkh@FreeBSD.org>.
+
+     This manual page was written by Dag-Erling Sm/orgrav <des@FreeBSD.org>.
+
+BBUUGGSS
+     Some parts of the library are not yet implemented.  The most notable
+     examples of this are ffeettcchhPPuuttHHTTTTPP(), ffeettcchhLLiissttHHTTTTPP(), ffeettcchhLLiissttFFTTPP() and
+     FTP proxy support.
+
+     There is no way to select a proxy at run-time other than setting the
+     HTTP_PROXY or FTP_PROXY environment variables as appropriate.
+
+     lliibbffeettcchh does not understand or obey 305 (Use Proxy) replies.
+
+     Error numbers are unique only within a certain context; the error codes
+     used for FTP and HTTP overlap, as do those used for resolver and system
+     errors.  For instance, error code 202 means "Command not implemented,
+     superfluous at this site" in an FTP context and "Accepted" in an HTTP
+     context.
+
+     ffeettcchhSSttaattFFTTPP() does not check that the result of an MDTM command is a
+     valid date.
+
+     The man page is incomplete, poorly written and produces badly formatted
+     text.
+
+     The error reporting mechanism is unsatisfactory.
+
+     Some parts of the code are not fully reentrant.
+
+NetBSD 4.0                     December 18, 2007                    NetBSD 4.0
diff --git a/net/libfetch/files/fetch.h b/net/libfetch/files/fetch.h
new file mode 100644
index 00000000000..f993abfa8ee
--- /dev/null
+++ b/net/libfetch/files/fetch.h
@@ -0,0 +1,154 @@
+/*	$NetBSD: fetch.h,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $	*/
+/*-
+ * Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD: fetch.h,v 1.26 2004/09/21 18:35:20 des Exp $
+ */
+
+#ifndef _FETCH_H_INCLUDED
+#define _FETCH_H_INCLUDED
+
+#include <limits.h>
+
+#define _LIBFETCH_VER "libfetch/2.0"
+
+#define URL_HOSTLEN 255
+#define URL_SCHEMELEN 16
+#define URL_USERLEN 256
+#define URL_PWDLEN 256
+
+struct url {
+	char		 scheme[URL_SCHEMELEN + 1];
+	char		 user[URL_USERLEN + 1];
+	char		 pwd[URL_PWDLEN + 1];
+	char		 host[URL_HOSTLEN + 1];
+	int		 port;
+	char		*doc;
+	off_t		 offset;
+	size_t		 length;
+};
+
+struct url_stat {
+	off_t		 size;
+	time_t		 atime;
+	time_t		 mtime;
+};
+
+struct url_ent {
+	char		 name[PATH_MAX];
+	struct url_stat	 stat;
+};
+
+/* Recognized schemes */
+#define SCHEME_FTP	"ftp"
+#define SCHEME_HTTP	"http"
+#define SCHEME_HTTPS	"https"
+#define SCHEME_FILE	"file"
+
+/* Error codes */
+#define	FETCH_ABORT	 1
+#define	FETCH_AUTH	 2
+#define	FETCH_DOWN	 3
+#define	FETCH_EXISTS	 4
+#define	FETCH_FULL	 5
+#define	FETCH_INFO	 6
+#define	FETCH_MEMORY	 7
+#define	FETCH_MOVED	 8
+#define	FETCH_NETWORK	 9
+#define	FETCH_OK	10
+#define	FETCH_PROTO	11
+#define	FETCH_RESOLV	12
+#define	FETCH_SERVER	13
+#define	FETCH_TEMP	14
+#define	FETCH_TIMEOUT	15
+#define	FETCH_UNAVAIL	16
+#define	FETCH_UNKNOWN	17
+#define	FETCH_URL	18
+#define	FETCH_VERBOSE	19
+
+__BEGIN_DECLS
+
+/* FILE-specific functions */
+FILE		*fetchXGetFile(struct url *, struct url_stat *, const char *);
+FILE		*fetchGetFile(struct url *, const char *);
+FILE		*fetchPutFile(struct url *, const char *);
+int		 fetchStatFile(struct url *, struct url_stat *, const char *);
+struct url_ent	*fetchListFile(struct url *, const char *);
+
+/* HTTP-specific functions */
+FILE		*fetchXGetHTTP(struct url *, struct url_stat *, const char *);
+FILE		*fetchGetHTTP(struct url *, const char *);
+FILE		*fetchPutHTTP(struct url *, const char *);
+int		 fetchStatHTTP(struct url *, struct url_stat *, const char *);
+struct url_ent	*fetchListHTTP(struct url *, const char *);
+
+/* FTP-specific functions */
+FILE		*fetchXGetFTP(struct url *, struct url_stat *, const char *);
+FILE		*fetchGetFTP(struct url *, const char *);
+FILE		*fetchPutFTP(struct url *, const char *);
+int		 fetchStatFTP(struct url *, struct url_stat *, const char *);
+struct url_ent	*fetchListFTP(struct url *, const char *);
+
+/* Generic functions */
+FILE		*fetchXGetURL(const char *, struct url_stat *, const char *);
+FILE		*fetchGetURL(const char *, const char *);
+FILE		*fetchPutURL(const char *, const char *);
+int		 fetchStatURL(const char *, struct url_stat *, const char *);
+struct url_ent	*fetchListURL(const char *, const char *);
+FILE		*fetchXGet(struct url *, struct url_stat *, const char *);
+FILE		*fetchGet(struct url *, const char *);
+FILE		*fetchPut(struct url *, const char *);
+int		 fetchStat(struct url *, struct url_stat *, const char *);
+struct url_ent	*fetchList(struct url *, const char *);
+
+/* URL parsing */
+struct url	*fetchMakeURL(const char *, const char *, int,
+		     const char *, const char *, const char *);
+struct url	*fetchParseURL(const char *);
+void		 fetchFreeURL(struct url *);
+
+__END_DECLS
+
+/* Authentication */
+typedef int (*auth_t)(struct url *);
+extern auth_t		 fetchAuthMethod;
+
+/* Last error code */
+extern int		 fetchLastErrCode;
+#define MAXERRSTRING 256
+extern char		 fetchLastErrString[MAXERRSTRING];
+
+/* I/O timeout */
+extern int		 fetchTimeout;
+
+/* Restart interrupted syscalls */
+extern int		 fetchRestartCalls;
+
+/* Extra verbosity */
+extern int		 fetchDebug;
+
+#endif
diff --git a/net/libfetch/files/file.c b/net/libfetch/files/file.c
new file mode 100644
index 00000000000..4ef4186743e
--- /dev/null
+++ b/net/libfetch/files/file.c
@@ -0,0 +1,145 @@
+/*	$NetBSD: file.c,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $	*/
+/*-
+ * Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD: file.c,v 1.18 2007/12/14 10:26:58 des Exp $
+ */
+
+#include <sys/stat.h>
+
+#include <dirent.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "fetch.h"
+#include "common.h"
+
+FILE *
+fetchXGetFile(struct url *u, struct url_stat *us, const char *flags)
+{
+	FILE *f;
+
+	if (us && fetchStatFile(u, us, flags) == -1)
+		return (NULL);
+
+	f = fopen(u->doc, "r");
+
+	if (f == NULL)
+		fetch_syserr();
+
+	if (u->offset && fseeko(f, u->offset, SEEK_SET) == -1) {
+		fclose(f);
+		fetch_syserr();
+	}
+
+	return (f);
+}
+
+FILE *
+fetchGetFile(struct url *u, const char *flags)
+{
+	return (fetchXGetFile(u, NULL, flags));
+}
+
+FILE *
+fetchPutFile(struct url *u, const char *flags)
+{
+	FILE *f;
+
+	if (CHECK_FLAG('a'))
+		f = fopen(u->doc, "a");
+	else
+		f = fopen(u->doc, "w+");
+
+	if (f == NULL)
+		fetch_syserr();
+
+	if (u->offset && fseeko(f, u->offset, SEEK_SET) == -1) {
+		fclose(f);
+		fetch_syserr();
+	}
+
+	return (f);
+}
+
+static int
+fetch_stat_file(const char *fn, struct url_stat *us)
+{
+	struct stat sb;
+
+	us->size = -1;
+	us->atime = us->mtime = 0;
+	if (stat(fn, &sb) == -1) {
+		fetch_syserr();
+		return (-1);
+	}
+	us->size = sb.st_size;
+	us->atime = sb.st_atime;
+	us->mtime = sb.st_mtime;
+	return (0);
+}
+
+int
+fetchStatFile(struct url *u, struct url_stat *us, const char *flags __unused)
+{
+	return (fetch_stat_file(u->doc, us));
+}
+
+struct url_ent *
+fetchListFile(struct url *u, const char *flags __unused)
+{
+	struct dirent *de;
+	struct url_stat us;
+	struct url_ent *ue;
+	int size, len;
+	char fn[PATH_MAX], *p;
+	DIR *dir;
+	int l;
+
+	if ((dir = opendir(u->doc)) == NULL) {
+		fetch_syserr();
+		return (NULL);
+	}
+
+	ue = NULL;
+	strncpy(fn, u->doc, sizeof(fn) - 2);
+	fn[sizeof(fn) - 2] = 0;
+	strcat(fn, "/");
+	p = strchr(fn, 0);
+	l = sizeof(fn) - strlen(fn) - 1;
+
+	while ((de = readdir(dir)) != NULL) {
+		strncpy(p, de->d_name, l - 1);
+		p[l - 1] = 0;
+		if (fetch_stat_file(fn, &us) == -1)
+			/* should I return a partial result, or abort? */
+			break;
+		fetch_add_entry(&ue, &size, &len, de->d_name, &us);
+	}
+
+	return (ue);
+}
diff --git a/net/libfetch/files/ftp.c b/net/libfetch/files/ftp.c
new file mode 100644
index 00000000000..5970fd4b090
--- /dev/null
+++ b/net/libfetch/files/ftp.c
@@ -0,0 +1,1202 @@
+/*	$NetBSD: ftp.c,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $	*/
+/*-
+ * Copyright (c) 1998-2004 Dag-Erling Coïdan Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD: ftp.c,v 1.101 2008/01/23 20:57:59 des Exp $
+ */
+
+/*
+ * Portions of this code were taken from or based on ftpio.c:
+ *
+ * ----------------------------------------------------------------------------
+ * "THE BEER-WARE LICENSE" (Revision 42):
+ * <phk@FreeBSD.org> wrote this file.  As long as you retain this notice you
+ * can do whatever you want with this stuff. If we meet some day, and you think
+ * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
+ * ----------------------------------------------------------------------------
+ *
+ * Major Changelog:
+ *
+ * Dag-Erling Coïdan Smørgrav
+ * 9 Jun 1998
+ *
+ * Incorporated into libfetch
+ *
+ * Jordan K. Hubbard
+ * 17 Jan 1996
+ *
+ * Turned inside out. Now returns xfers as new file ids, not as a special
+ * `state' of FTP_t
+ *
+ * $ftpioId: ftpio.c,v 1.30 1998/04/11 07:28:53 phk Exp $
+ *
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+#include <ctype.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include "fetch.h"
+#include "common.h"
+#include "ftperr.h"
+
+#define FTP_ANONYMOUS_USER	"anonymous"
+
+#define FTP_CONNECTION_ALREADY_OPEN	125
+#define FTP_OPEN_DATA_CONNECTION	150
+#define FTP_OK				200
+#define FTP_FILE_STATUS			213
+#define FTP_SERVICE_READY		220
+#define FTP_TRANSFER_COMPLETE		226
+#define FTP_PASSIVE_MODE		227
+#define FTP_LPASSIVE_MODE		228
+#define FTP_EPASSIVE_MODE		229
+#define FTP_LOGGED_IN			230
+#define FTP_FILE_ACTION_OK		250
+#define FTP_DIRECTORY_CREATED		257 /* multiple meanings */
+#define FTP_FILE_CREATED		257 /* multiple meanings */
+#define FTP_WORKING_DIRECTORY		257 /* multiple meanings */
+#define FTP_NEED_PASSWORD		331
+#define FTP_NEED_ACCOUNT		332
+#define FTP_FILE_OK			350
+#define FTP_SYNTAX_ERROR		500
+#define FTP_PROTOCOL_ERROR		999
+
+static struct url cached_host;
+static conn_t	*cached_connection;
+
+#define isftpreply(foo)				\
+	(isdigit((unsigned char)foo[0]) &&	\
+	    isdigit((unsigned char)foo[1]) &&	\
+	    isdigit((unsigned char)foo[2]) &&	\
+	    (foo[3] == ' ' || foo[3] == '\0'))
+#define isftpinfo(foo) \
+	(isdigit((unsigned char)foo[0]) &&	\
+	    isdigit((unsigned char)foo[1]) &&	\
+	    isdigit((unsigned char)foo[2]) &&	\
+	    foo[3] == '-')
+
+/*
+ * Translate IPv4 mapped IPv6 address to IPv4 address
+ */
+static void
+unmappedaddr(struct sockaddr_in6 *sin6)
+{
+	struct sockaddr_in *sin4;
+	u_int32_t addr;
+	int port;
+
+	if (sin6->sin6_family != AF_INET6 ||
+	    !IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
+		return;
+	sin4 = (struct sockaddr_in *)sin6;
+	addr = *(u_int32_t *)&sin6->sin6_addr.s6_addr[12];
+	port = sin6->sin6_port;
+	memset(sin4, 0, sizeof(struct sockaddr_in));
+	sin4->sin_addr.s_addr = addr;
+	sin4->sin_port = port;
+	sin4->sin_family = AF_INET;
+	sin4->sin_len = sizeof(struct sockaddr_in);
+}
+
+/*
+ * Get server response
+ */
+static int
+ftp_chkerr(conn_t *conn)
+{
+	if (fetch_getln(conn) == -1) {
+		fetch_syserr();
+		return (-1);
+	}
+	if (isftpinfo(conn->buf)) {
+		while (conn->buflen && !isftpreply(conn->buf)) {
+			if (fetch_getln(conn) == -1) {
+				fetch_syserr();
+				return (-1);
+			}
+		}
+	}
+
+	while (conn->buflen &&
+	    isspace((unsigned char)conn->buf[conn->buflen - 1]))
+		conn->buflen--;
+	conn->buf[conn->buflen] = '\0';
+
+	if (!isftpreply(conn->buf)) {
+		ftp_seterr(FTP_PROTOCOL_ERROR);
+		return (-1);
+	}
+
+	conn->err = (conn->buf[0] - '0') * 100
+	    + (conn->buf[1] - '0') * 10
+	    + (conn->buf[2] - '0');
+
+	return (conn->err);
+}
+
+/*
+ * Send a command and check reply
+ */
+static int
+ftp_cmd(conn_t *conn, const char *fmt, ...)
+{
+	va_list ap;
+	size_t len;
+	char *msg;
+	int r;
+
+	va_start(ap, fmt);
+	len = vasprintf(&msg, fmt, ap);
+	va_end(ap);
+
+	if (msg == NULL) {
+		errno = ENOMEM;
+		fetch_syserr();
+		return (-1);
+	}
+
+	r = fetch_putln(conn, msg, len);
+	free(msg);
+
+	if (r == -1) {
+		fetch_syserr();
+		return (-1);
+	}
+
+	return (ftp_chkerr(conn));
+}
+
+/*
+ * Return a pointer to the filename part of a path
+ */
+static const char *
+ftp_filename(const char *file, int *len, int *type)
+{
+	const char *s;
+
+	if ((s = strrchr(file, '/')) == NULL)
+		s = file;
+	else
+		s = s + 1;
+	*len = strlen(s);
+	if (*len > 7 && strncmp(s + *len - 7, ";type=", 6) == 0) {
+		*type = s[*len - 1];
+		*len -= 7;
+	} else {
+		*type = '\0';
+	}
+	return (s);
+}
+
+/*
+ * Get current working directory from the reply to a CWD, PWD or CDUP
+ * command.
+ */
+static int
+ftp_pwd(conn_t *conn, char *pwd, size_t pwdlen)
+{
+	char *src, *dst, *end;
+	int q;
+
+	if (conn->err != FTP_WORKING_DIRECTORY &&
+	    conn->err != FTP_FILE_ACTION_OK)
+		return (FTP_PROTOCOL_ERROR);
+	end = conn->buf + conn->buflen;
+	src = conn->buf + 4;
+	if (src >= end || *src++ != '"')
+		return (FTP_PROTOCOL_ERROR);
+	for (q = 0, dst = pwd; src < end && pwdlen--; ++src) {
+		if (!q && *src == '"')
+			q = 1;
+		else if (q && *src != '"')
+			break;
+		else if (q)
+			*dst++ = '"', q = 0;
+		else
+			*dst++ = *src;
+	}
+	if (!pwdlen)
+		return (FTP_PROTOCOL_ERROR);
+	*dst = '\0';
+#if 0
+	DEBUG(fprintf(stderr, "pwd: [%s]\n", pwd));
+#endif
+	return (FTP_OK);
+}
+
+/*
+ * Change working directory to the directory that contains the specified
+ * file.
+ */
+static int
+ftp_cwd(conn_t *conn, const char *file)
+{
+	const char *beg, *end;
+	char pwd[PATH_MAX];
+	int e, i, len;
+
+	/* If no slashes in name, no need to change dirs. */
+	if ((end = strrchr(file, '/')) == NULL)
+		return (0);
+	if ((e = ftp_cmd(conn, "PWD")) != FTP_WORKING_DIRECTORY ||
+	    (e = ftp_pwd(conn, pwd, sizeof(pwd))) != FTP_OK) {
+		ftp_seterr(e);
+		return (-1);
+	}
+	for (;;) {
+		len = strlen(pwd);
+
+		/* Look for a common prefix between PWD and dir to fetch. */
+		for (i = 0; i <= len && i <= end - file; ++i)
+			if (pwd[i] != file[i])
+				break;
+#if 0
+		DEBUG(fprintf(stderr, "have: [%.*s|%s]\n", i, pwd, pwd + i));
+		DEBUG(fprintf(stderr, "want: [%.*s|%s]\n", i, file, file + i));
+#endif
+		/* Keep going up a dir until we have a matching prefix. */
+		if (pwd[i] == '\0' && (file[i - 1] == '/' || file[i] == '/'))
+			break;
+		if ((e = ftp_cmd(conn, "CDUP")) != FTP_FILE_ACTION_OK ||
+		    (e = ftp_cmd(conn, "PWD")) != FTP_WORKING_DIRECTORY ||
+		    (e = ftp_pwd(conn, pwd, sizeof(pwd))) != FTP_OK) {
+			ftp_seterr(e);
+			return (-1);
+		}
+	}
+
+#ifdef FTP_COMBINE_CWDS
+	/* Skip leading slashes, even "////". */
+	for (beg = file + i; beg < end && *beg == '/'; ++beg, ++i)
+		/* nothing */ ;
+
+	/* If there is no trailing dir, we're already there. */
+	if (beg >= end)
+		return (0);
+
+	/* Change to the directory all in one chunk (e.g., foo/bar/baz). */
+	e = ftp_cmd(conn, "CWD %.*s", (int)(end - beg), beg);
+	if (e == FTP_FILE_ACTION_OK)
+		return (0);
+#endif /* FTP_COMBINE_CWDS */
+
+	/* That didn't work so go back to legacy behavior (multiple CWDs). */
+	for (beg = file + i; beg < end; beg = file + i + 1) {
+		while (*beg == '/')
+			++beg, ++i;
+		for (++i; file + i < end && file[i] != '/'; ++i)
+			/* nothing */ ;
+		e = ftp_cmd(conn, "CWD %.*s", file + i - beg, beg);
+		if (e != FTP_FILE_ACTION_OK) {
+			ftp_seterr(e);
+			return (-1);
+		}
+	}
+	return (0);
+}
+
+/*
+ * Set transfer mode and data type
+ */
+static int
+ftp_mode_type(conn_t *conn, int mode, int type)
+{
+	int e;
+
+	switch (mode) {
+	case 0:
+	case 's':
+		mode = 'S';
+	case 'S':
+		break;
+	default:
+		return (FTP_PROTOCOL_ERROR);
+	}
+	if ((e = ftp_cmd(conn, "MODE %c", mode)) != FTP_OK) {
+		if (mode == 'S') {
+			/*
+			 * Stream mode is supposed to be the default - so
+			 * much so that some servers not only do not
+			 * support any other mode, but do not support the
+			 * MODE command at all.
+			 *
+			 * If "MODE S" fails, it is unlikely that we
+			 * previously succeeded in setting a different
+			 * mode.  Therefore, we simply hope that the
+			 * server is already in the correct mode, and
+			 * silently ignore the failure.
+			 */
+		} else {
+			return (e);
+		}
+	}
+
+	switch (type) {
+	case 0:
+	case 'i':
+		type = 'I';
+	case 'I':
+		break;
+	case 'a':
+		type = 'A';
+	case 'A':
+		break;
+	case 'd':
+		type = 'D';
+	case 'D':
+		/* can't handle yet */
+	default:
+		return (FTP_PROTOCOL_ERROR);
+	}
+	if ((e = ftp_cmd(conn, "TYPE %c", type)) != FTP_OK)
+		return (e);
+
+	return (FTP_OK);
+}
+
+/*
+ * Request and parse file stats
+ */
+static int
+ftp_stat(conn_t *conn, const char *file, struct url_stat *us)
+{
+	char *ln;
+	const char *filename;
+	int filenamelen, type;
+	struct tm tm;
+	time_t t;
+	int e;
+
+	us->size = -1;
+	us->atime = us->mtime = 0;
+
+	filename = ftp_filename(file, &filenamelen, &type);
+
+	if ((e = ftp_mode_type(conn, 0, type)) != FTP_OK) {
+		ftp_seterr(e);
+		return (-1);
+	}
+
+	e = ftp_cmd(conn, "SIZE %.*s", filenamelen, filename);
+	if (e != FTP_FILE_STATUS) {
+		ftp_seterr(e);
+		return (-1);
+	}
+	for (ln = conn->buf + 4; *ln && isspace((unsigned char)*ln); ln++)
+		/* nothing */ ;
+	for (us->size = 0; *ln && isdigit((unsigned char)*ln); ln++)
+		us->size = us->size * 10 + *ln - '0';
+	if (*ln && !isspace((unsigned char)*ln)) {
+		ftp_seterr(FTP_PROTOCOL_ERROR);
+		us->size = -1;
+		return (-1);
+	}
+	if (us->size == 0)
+		us->size = -1;
+	DEBUG(fprintf(stderr, "size: [%lld]\n", (long long)us->size));
+
+	e = ftp_cmd(conn, "MDTM %.*s", filenamelen, filename);
+	if (e != FTP_FILE_STATUS) {
+		ftp_seterr(e);
+		return (-1);
+	}
+	for (ln = conn->buf + 4; *ln && isspace((unsigned char)*ln); ln++)
+		/* nothing */ ;
+	switch (strspn(ln, "0123456789")) {
+	case 14:
+		break;
+	case 15:
+		ln++;
+		ln[0] = '2';
+		ln[1] = '0';
+		break;
+	default:
+		ftp_seterr(FTP_PROTOCOL_ERROR);
+		return (-1);
+	}
+	if (sscanf(ln, "%04d%02d%02d%02d%02d%02d",
+	    &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
+	    &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
+		ftp_seterr(FTP_PROTOCOL_ERROR);
+		return (-1);
+	}
+	tm.tm_mon--;
+	tm.tm_year -= 1900;
+	tm.tm_isdst = -1;
+	t = timegm(&tm);
+	if (t == (time_t)-1)
+		t = time(NULL);
+	us->mtime = t;
+	us->atime = t;
+	DEBUG(fprintf(stderr,
+	    "last modified: [%04d-%02d-%02d %02d:%02d:%02d]\n",
+	    tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+	    tm.tm_hour, tm.tm_min, tm.tm_sec));
+	return (0);
+}
+
+/*
+ * I/O functions for FTP
+ */
+struct ftpio {
+	conn_t	*cconn;		/* Control connection */
+	conn_t	*dconn;		/* Data connection */
+	int	 dir;		/* Direction */
+	int	 eof;		/* EOF reached */
+	int	 err;		/* Error code */
+};
+
+static int	 ftp_readfn(void *, char *, int);
+static int	 ftp_writefn(void *, const char *, int);
+static fpos_t	 ftp_seekfn(void *, fpos_t, int);
+static int	 ftp_closefn(void *);
+
+static int
+ftp_readfn(void *v, char *buf, int len)
+{
+	struct ftpio *io;
+	int r;
+
+	io = (struct ftpio *)v;
+	if (io == NULL) {
+		errno = EBADF;
+		return (-1);
+	}
+	if (io->cconn == NULL || io->dconn == NULL || io->dir == O_WRONLY) {
+		errno = EBADF;
+		return (-1);
+	}
+	if (io->err) {
+		errno = io->err;
+		return (-1);
+	}
+	if (io->eof)
+		return (0);
+	r = fetch_read(io->dconn, buf, len);
+	if (r > 0)
+		return (r);
+	if (r == 0) {
+		io->eof = 1;
+		return (0);
+	}
+	if (errno != EINTR)
+		io->err = errno;
+	return (-1);
+}
+
+static int
+ftp_writefn(void *v, const char *buf, int len)
+{
+	struct ftpio *io;
+	int w;
+
+	io = (struct ftpio *)v;
+	if (io == NULL) {
+		errno = EBADF;
+		return (-1);
+	}
+	if (io->cconn == NULL || io->dconn == NULL || io->dir == O_RDONLY) {
+		errno = EBADF;
+		return (-1);
+	}
+	if (io->err) {
+		errno = io->err;
+		return (-1);
+	}
+	w = fetch_write(io->dconn, buf, len);
+	if (w >= 0)
+		return (w);
+	if (errno != EINTR)
+		io->err = errno;
+	return (-1);
+}
+
+static fpos_t
+ftp_seekfn(void *v, fpos_t pos __unused, int whence __unused)
+{
+	struct ftpio *io;
+
+	io = (struct ftpio *)v;
+	if (io == NULL) {
+		errno = EBADF;
+		return (-1);
+	}
+	errno = ESPIPE;
+	return (-1);
+}
+
+static int
+ftp_closefn(void *v)
+{
+	struct ftpio *io;
+	int r;
+
+	io = (struct ftpio *)v;
+	if (io == NULL) {
+		errno = EBADF;
+		return (-1);
+	}
+	if (io->dir == -1)
+		return (0);
+	if (io->cconn == NULL || io->dconn == NULL) {
+		errno = EBADF;
+		return (-1);
+	}
+	fetch_close(io->dconn);
+	io->dir = -1;
+	io->dconn = NULL;
+	DEBUG(fprintf(stderr, "Waiting for final status\n"));
+	r = ftp_chkerr(io->cconn);
+	if (io->cconn == cached_connection && io->cconn->ref == 1)
+		cached_connection = NULL;
+	fetch_close(io->cconn);
+	free(io);
+	return (r == FTP_TRANSFER_COMPLETE) ? 0 : -1;
+}
+
+static FILE *
+ftp_setup(conn_t *cconn, conn_t *dconn, int mode)
+{
+	struct ftpio *io;
+	FILE *f;
+
+	if (cconn == NULL || dconn == NULL)
+		return (NULL);
+	if ((io = malloc(sizeof(*io))) == NULL)
+		return (NULL);
+	io->cconn = cconn;
+	io->dconn = dconn;
+	io->dir = mode;
+	io->eof = io->err = 0;
+	f = funopen(io, ftp_readfn, ftp_writefn, ftp_seekfn, ftp_closefn);
+	if (f == NULL)
+		free(io);
+	return (f);
+}
+
+/*
+ * Transfer file
+ */
+static FILE *
+ftp_transfer(conn_t *conn, const char *oper, const char *file,
+    int mode, off_t offset, const char *flags)
+{
+	struct sockaddr_storage sa;
+	struct sockaddr_in6 *sin6;
+	struct sockaddr_in *sin4;
+	const char *bindaddr;
+	const char *filename;
+	int filenamelen, type;
+	int low, pasv, verbose;
+	int e, sd = -1;
+	socklen_t l;
+	char *s;
+	FILE *df;
+
+	/* check flags */
+	low = CHECK_FLAG('l');
+	pasv = CHECK_FLAG('p');
+	verbose = CHECK_FLAG('v');
+
+	/* passive mode */
+	if (!pasv)
+		pasv = ((s = getenv("FTP_PASSIVE_MODE")) != NULL &&
+		    strncasecmp(s, "no", 2) != 0);
+
+	/* isolate filename */
+	filename = ftp_filename(file, &filenamelen, &type);
+
+	/* set transfer mode and data type */
+	if ((e = ftp_mode_type(conn, 0, type)) != FTP_OK)
+		goto ouch;
+
+	/* find our own address, bind, and listen */
+	l = sizeof(sa);
+	if (getsockname(conn->sd, (struct sockaddr *)&sa, &l) == -1)
+		goto sysouch;
+	if (sa.ss_family == AF_INET6)
+		unmappedaddr((struct sockaddr_in6 *)&sa);
+
+	/* open data socket */
+	if ((sd = socket(sa.ss_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
+		fetch_syserr();
+		return (NULL);
+	}
+
+	if (pasv) {
+		u_char addr[64];
+		char *ln, *p;
+		unsigned int i;
+		int port;
+
+		/* send PASV command */
+		if (verbose)
+			fetch_info("setting passive mode");
+		switch (sa.ss_family) {
+		case AF_INET:
+			if ((e = ftp_cmd(conn, "PASV")) != FTP_PASSIVE_MODE)
+				goto ouch;
+			break;
+		case AF_INET6:
+			if ((e = ftp_cmd(conn, "EPSV")) != FTP_EPASSIVE_MODE) {
+				if (e == -1)
+					goto ouch;
+				if ((e = ftp_cmd(conn, "LPSV")) !=
+				    FTP_LPASSIVE_MODE)
+					goto ouch;
+			}
+			break;
+		default:
+			e = FTP_PROTOCOL_ERROR; /* XXX: error code should be prepared */
+			goto ouch;
+		}
+
+		/*
+		 * Find address and port number. The reply to the PASV command
+		 * is IMHO the one and only weak point in the FTP protocol.
+		 */
+		ln = conn->buf;
+		switch (e) {
+		case FTP_PASSIVE_MODE:
+		case FTP_LPASSIVE_MODE:
+			for (p = ln + 3; *p && !isdigit((unsigned char)*p); p++)
+				/* nothing */ ;
+			if (!*p) {
+				e = FTP_PROTOCOL_ERROR;
+				goto ouch;
+			}
+			l = (e == FTP_PASSIVE_MODE ? 6 : 21);
+			for (i = 0; *p && i < l; i++, p++)
+				addr[i] = strtol(p, &p, 10);
+			if (i < l) {
+				e = FTP_PROTOCOL_ERROR;
+				goto ouch;
+			}
+			break;
+		case FTP_EPASSIVE_MODE:
+			for (p = ln + 3; *p && *p != '('; p++)
+				/* nothing */ ;
+			if (!*p) {
+				e = FTP_PROTOCOL_ERROR;
+				goto ouch;
+			}
+			++p;
+			if (sscanf(p, "%c%c%c%d%c", &addr[0], &addr[1], &addr[2],
+				&port, &addr[3]) != 5 ||
+			    addr[0] != addr[1] ||
+			    addr[0] != addr[2] || addr[0] != addr[3]) {
+				e = FTP_PROTOCOL_ERROR;
+				goto ouch;
+			}
+			break;
+		}
+
+		/* seek to required offset */
+		if (offset)
+			if (ftp_cmd(conn, "REST %lu", (u_long)offset) != FTP_FILE_OK)
+				goto sysouch;
+
+		/* construct sockaddr for data socket */
+		l = sizeof(sa);
+		if (getpeername(conn->sd, (struct sockaddr *)&sa, &l) == -1)
+			goto sysouch;
+		if (sa.ss_family == AF_INET6)
+			unmappedaddr((struct sockaddr_in6 *)&sa);
+		switch (sa.ss_family) {
+		case AF_INET6:
+			sin6 = (struct sockaddr_in6 *)&sa;
+			if (e == FTP_EPASSIVE_MODE)
+				sin6->sin6_port = htons(port);
+			else {
+				bcopy(addr + 2, (char *)&sin6->sin6_addr, 16);
+				bcopy(addr + 19, (char *)&sin6->sin6_port, 2);
+			}
+			break;
+		case AF_INET:
+			sin4 = (struct sockaddr_in *)&sa;
+			if (e == FTP_EPASSIVE_MODE)
+				sin4->sin_port = htons(port);
+			else {
+				bcopy(addr, (char *)&sin4->sin_addr, 4);
+				bcopy(addr + 4, (char *)&sin4->sin_port, 2);
+			}
+			break;
+		default:
+			e = FTP_PROTOCOL_ERROR; /* XXX: error code should be prepared */
+			break;
+		}
+
+		/* connect to data port */
+		if (verbose)
+			fetch_info("opening data connection");
+		bindaddr = getenv("FETCH_BIND_ADDRESS");
+		if (bindaddr != NULL && *bindaddr != '\0' &&
+		    fetch_bind(sd, sa.ss_family, bindaddr) != 0)
+			goto sysouch;
+		if (connect(sd, (struct sockaddr *)&sa, sa.ss_len) == -1)
+			goto sysouch;
+
+		/* make the server initiate the transfer */
+		if (verbose)
+			fetch_info("initiating transfer");
+		e = ftp_cmd(conn, "%s %.*s", oper, filenamelen, filename);
+		if (e != FTP_CONNECTION_ALREADY_OPEN && e != FTP_OPEN_DATA_CONNECTION)
+			goto ouch;
+
+	} else {
+		u_int32_t a;
+		u_short p;
+		int arg, d;
+		char *ap;
+		char hname[INET6_ADDRSTRLEN];
+
+		switch (sa.ss_family) {
+		case AF_INET6:
+			((struct sockaddr_in6 *)&sa)->sin6_port = 0;
+#ifdef IPV6_PORTRANGE
+			arg = low ? IPV6_PORTRANGE_DEFAULT : IPV6_PORTRANGE_HIGH;
+			if (setsockopt(sd, IPPROTO_IPV6, IPV6_PORTRANGE,
+				(char *)&arg, sizeof(arg)) == -1)
+				goto sysouch;
+#endif
+			break;
+		case AF_INET:
+			((struct sockaddr_in *)&sa)->sin_port = 0;
+			arg = low ? IP_PORTRANGE_DEFAULT : IP_PORTRANGE_HIGH;
+			if (setsockopt(sd, IPPROTO_IP, IP_PORTRANGE,
+				(char *)&arg, sizeof(arg)) == -1)
+				goto sysouch;
+			break;
+		}
+		if (verbose)
+			fetch_info("binding data socket");
+		if (bind(sd, (struct sockaddr *)&sa, sa.ss_len) == -1)
+			goto sysouch;
+		if (listen(sd, 1) == -1)
+			goto sysouch;
+
+		/* find what port we're on and tell the server */
+		if (getsockname(sd, (struct sockaddr *)&sa, &l) == -1)
+			goto sysouch;
+		switch (sa.ss_family) {
+		case AF_INET:
+			sin4 = (struct sockaddr_in *)&sa;
+			a = ntohl(sin4->sin_addr.s_addr);
+			p = ntohs(sin4->sin_port);
+			e = ftp_cmd(conn, "PORT %d,%d,%d,%d,%d,%d",
+			    (a >> 24) & 0xff, (a >> 16) & 0xff,
+			    (a >> 8) & 0xff, a & 0xff,
+			    (p >> 8) & 0xff, p & 0xff);
+			break;
+		case AF_INET6:
+#define UC(b)	(((int)b)&0xff)
+			e = -1;
+			sin6 = (struct sockaddr_in6 *)&sa;
+			sin6->sin6_scope_id = 0;
+			if (getnameinfo((struct sockaddr *)&sa, sa.ss_len,
+				hname, sizeof(hname),
+				NULL, 0, NI_NUMERICHOST) == 0) {
+				e = ftp_cmd(conn, "EPRT |%d|%s|%d|", 2, hname,
+				    htons(sin6->sin6_port));
+				if (e == -1)
+					goto ouch;
+			}
+			if (e != FTP_OK) {
+				ap = (char *)&sin6->sin6_addr;
+				e = ftp_cmd(conn,
+				    "LPRT %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d",
+				    6, 16,
+				    UC(ap[0]), UC(ap[1]), UC(ap[2]), UC(ap[3]),
+				    UC(ap[4]), UC(ap[5]), UC(ap[6]), UC(ap[7]),
+				    UC(ap[8]), UC(ap[9]), UC(ap[10]), UC(ap[11]),
+				    UC(ap[12]), UC(ap[13]), UC(ap[14]), UC(ap[15]),
+				    2,
+				    (ntohs(sin6->sin6_port) >> 8) & 0xff,
+				    ntohs(sin6->sin6_port)        & 0xff);
+			}
+			break;
+		default:
+			e = FTP_PROTOCOL_ERROR; /* XXX: error code should be prepared */
+			goto ouch;
+		}
+		if (e != FTP_OK)
+			goto ouch;
+
+		/* seek to required offset */
+		if (offset)
+			if (ftp_cmd(conn, "REST %ju", (uintmax_t)offset) != FTP_FILE_OK)
+				goto sysouch;
+
+		/* make the server initiate the transfer */
+		if (verbose)
+			fetch_info("initiating transfer");
+		e = ftp_cmd(conn, "%s %.*s", oper, filenamelen, filename);
+		if (e != FTP_CONNECTION_ALREADY_OPEN && e != FTP_OPEN_DATA_CONNECTION)
+			goto ouch;
+
+		/* accept the incoming connection and go to town */
+		if ((d = accept(sd, NULL, NULL)) == -1)
+			goto sysouch;
+		close(sd);
+		sd = d;
+	}
+
+	if ((df = ftp_setup(conn, fetch_reopen(sd), mode)) == NULL)
+		goto sysouch;
+	return (df);
+
+sysouch:
+	fetch_syserr();
+	if (sd >= 0)
+		close(sd);
+	return (NULL);
+
+ouch:
+	if (e != -1)
+		ftp_seterr(e);
+	if (sd >= 0)
+		close(sd);
+	return (NULL);
+}
+
+/*
+ * Authenticate
+ */
+static int
+ftp_authenticate(conn_t *conn, struct url *url, struct url *purl)
+{
+	const char *user, *pwd, *logname;
+	char pbuf[URL_USERLEN + 1 + URL_HOSTLEN + 1];
+	int e, len;
+
+	/* XXX FTP_AUTH, and maybe .netrc */
+
+	/* send user name and password */
+	if (url->user[0] == '\0')
+		fetch_netrc_auth(url);
+	user = url->user;
+	if (*user == '\0')
+		user = getenv("FTP_LOGIN");
+	if (user == NULL || *user == '\0')
+		user = FTP_ANONYMOUS_USER;
+	if (purl && url->port == fetch_default_port(url->scheme))
+		e = ftp_cmd(conn, "USER %s@%s", user, url->host);
+	else if (purl)
+		e = ftp_cmd(conn, "USER %s@%s@%d", user, url->host, url->port);
+	else
+		e = ftp_cmd(conn, "USER %s", user);
+
+	/* did the server request a password? */
+	if (e == FTP_NEED_PASSWORD) {
+		pwd = url->pwd;
+		if (*pwd == '\0')
+			pwd = getenv("FTP_PASSWORD");
+		if (pwd == NULL || *pwd == '\0') {
+			if ((logname = getlogin()) == 0)
+				logname = FTP_ANONYMOUS_USER;
+			if ((len = snprintf(pbuf, URL_USERLEN + 2, "%s@", logname)) < 0)
+				len = 0;
+			else if (len > URL_USERLEN + 1)
+				len = URL_USERLEN + 1;
+			gethostname(pbuf + len, sizeof(pbuf) - len);
+			/* MAXHOSTNAMELEN can differ from URL_HOSTLEN + 1 */
+			pbuf[sizeof(pbuf) - 1] = '\0';
+			pwd = pbuf;
+		}
+		e = ftp_cmd(conn, "PASS %s", pwd);
+	}
+
+	return (e);
+}
+
+/*
+ * Log on to FTP server
+ */
+static conn_t *
+ftp_connect(struct url *url, struct url *purl, const char *flags)
+{
+	conn_t *conn;
+	int e, direct, verbose;
+#ifdef INET6
+	int af = AF_UNSPEC;
+#else
+	int af = AF_INET;
+#endif
+
+	direct = CHECK_FLAG('d');
+	verbose = CHECK_FLAG('v');
+	if (CHECK_FLAG('4'))
+		af = AF_INET;
+	else if (CHECK_FLAG('6'))
+		af = AF_INET6;
+
+	if (direct)
+		purl = NULL;
+
+	/* check for proxy */
+	if (purl) {
+		/* XXX proxy authentication! */
+		conn = fetch_connect(purl->host, purl->port, af, verbose);
+	} else {
+		/* no proxy, go straight to target */
+		conn = fetch_connect(url->host, url->port, af, verbose);
+		purl = NULL;
+	}
+
+	/* check connection */
+	if (conn == NULL)
+		/* fetch_connect() has already set an error code */
+		return (NULL);
+
+	/* expect welcome message */
+	if ((e = ftp_chkerr(conn)) != FTP_SERVICE_READY)
+		goto fouch;
+
+	/* authenticate */
+	if ((e = ftp_authenticate(conn, url, purl)) != FTP_LOGGED_IN)
+		goto fouch;
+
+	/* TODO: Request extended features supported, if any (RFC 3659). */
+
+	/* done */
+	return (conn);
+
+fouch:
+	if (e != -1)
+		ftp_seterr(e);
+	fetch_close(conn);
+	return (NULL);
+}
+
+/*
+ * Disconnect from server
+ */
+static void
+ftp_disconnect(conn_t *conn)
+{
+	(void)ftp_cmd(conn, "QUIT");
+	if (conn == cached_connection && conn->ref == 1)
+		cached_connection = NULL;
+	fetch_close(conn);
+}
+
+/*
+ * Check if we're already connected
+ */
+static int
+ftp_isconnected(struct url *url)
+{
+	return (cached_connection
+	    && (strcmp(url->host, cached_host.host) == 0)
+	    && (strcmp(url->user, cached_host.user) == 0)
+	    && (strcmp(url->pwd, cached_host.pwd) == 0)
+	    && (url->port == cached_host.port));
+}
+
+/*
+ * Check the cache, reconnect if no luck
+ */
+static conn_t *
+ftp_cached_connect(struct url *url, struct url *purl, const char *flags)
+{
+	conn_t *conn;
+	int e;
+
+	/* set default port */
+	if (!url->port)
+		url->port = fetch_default_port(url->scheme);
+
+	/* try to use previously cached connection */
+	if (ftp_isconnected(url)) {
+		e = ftp_cmd(cached_connection, "NOOP");
+		if (e == FTP_OK || e == FTP_SYNTAX_ERROR)
+			return (fetch_ref(cached_connection));
+	}
+
+	/* connect to server */
+	if ((conn = ftp_connect(url, purl, flags)) == NULL)
+		return (NULL);
+	if (cached_connection)
+		ftp_disconnect(cached_connection);
+	cached_connection = fetch_ref(conn);
+	memcpy(&cached_host, url, sizeof(*url));
+	return (conn);
+}
+
+/*
+ * Check the proxy settings
+ */
+static struct url *
+ftp_get_proxy(struct url * url, const char *flags)
+{
+	struct url *purl;
+	char *p;
+
+	if (flags != NULL && strchr(flags, 'd') != NULL)
+		return (NULL);
+	if (fetch_no_proxy_match(url->host))
+		return (NULL);
+	if (((p = getenv("FTP_PROXY")) || (p = getenv("ftp_proxy")) ||
+		(p = getenv("HTTP_PROXY")) || (p = getenv("http_proxy"))) &&
+	    *p && (purl = fetchParseURL(p)) != NULL) {
+		if (!*purl->scheme) {
+			if (getenv("FTP_PROXY") || getenv("ftp_proxy"))
+				strcpy(purl->scheme, SCHEME_FTP);
+			else
+				strcpy(purl->scheme, SCHEME_HTTP);
+		}
+		if (!purl->port)
+			purl->port = fetch_default_proxy_port(purl->scheme);
+		if (strcasecmp(purl->scheme, SCHEME_FTP) == 0 ||
+		    strcasecmp(purl->scheme, SCHEME_HTTP) == 0)
+			return (purl);
+		fetchFreeURL(purl);
+	}
+	return (NULL);
+}
+
+/*
+ * Process an FTP request
+ */
+FILE *
+ftp_request(struct url *url, const char *op, struct url_stat *us,
+    struct url *purl, const char *flags)
+{
+	conn_t *conn;
+	int oflag;
+
+	/* check if we should use HTTP instead */
+	if (purl && strcasecmp(purl->scheme, SCHEME_HTTP) == 0) {
+		if (strcmp(op, "STAT") == 0)
+			return (http_request(url, "HEAD", us, purl, flags));
+		else if (strcmp(op, "RETR") == 0)
+			return (http_request(url, "GET", us, purl, flags));
+		/*
+		 * Our HTTP code doesn't support PUT requests yet, so try
+		 * a direct connection.
+		 */
+	}
+
+	/* connect to server */
+	conn = ftp_cached_connect(url, purl, flags);
+	if (purl)
+		fetchFreeURL(purl);
+	if (conn == NULL)
+		return (NULL);
+
+	/* change directory */
+	if (ftp_cwd(conn, url->doc) == -1)
+		return (NULL);
+
+	/* stat file */
+	if (us && ftp_stat(conn, url->doc, us) == -1
+	    && fetchLastErrCode != FETCH_PROTO
+	    && fetchLastErrCode != FETCH_UNAVAIL)
+		return (NULL);
+
+	/* just a stat */
+	if (strcmp(op, "STAT") == 0)
+		return (FILE *)1; /* bogus return value */
+	if (strcmp(op, "STOR") == 0 || strcmp(op, "APPE") == 0)
+		oflag = O_WRONLY;
+	else
+		oflag = O_RDONLY;
+
+	/* initiate the transfer */
+	return (ftp_transfer(conn, op, url->doc, oflag, url->offset, flags));
+}
+
+/*
+ * Get and stat file
+ */
+FILE *
+fetchXGetFTP(struct url *url, struct url_stat *us, const char *flags)
+{
+	return (ftp_request(url, "RETR", us, ftp_get_proxy(url, flags), flags));
+}
+
+/*
+ * Get file
+ */
+FILE *
+fetchGetFTP(struct url *url, const char *flags)
+{
+	return (fetchXGetFTP(url, NULL, flags));
+}
+
+/*
+ * Put file
+ */
+FILE *
+fetchPutFTP(struct url *url, const char *flags)
+{
+	return (ftp_request(url, CHECK_FLAG('a') ? "APPE" : "STOR", NULL,
+	    ftp_get_proxy(url, flags), flags));
+}
+
+/*
+ * Get file stats
+ */
+int
+fetchStatFTP(struct url *url, struct url_stat *us, const char *flags)
+{
+	FILE *f;
+
+	f = ftp_request(url, "STAT", us, ftp_get_proxy(url, flags), flags);
+	if (f == NULL)
+		return (-1);
+	/*
+	 * When op is "STAT", ftp_request() will return either NULL or
+	 * (FILE *)1, never a valid FILE *, so we mustn't fclose(f) before
+	 * returning, as it would cause a segfault.
+	 */
+	return (0);
+}
+
+/*
+ * List a directory
+ */
+struct url_ent *
+fetchListFTP(struct url *url __unused, const char *flags __unused)
+{
+	warnx("fetchListFTP(): not implemented");
+	return (NULL);
+}
diff --git a/net/libfetch/files/ftp.errors b/net/libfetch/files/ftp.errors
new file mode 100644
index 00000000000..368a8e596ab
--- /dev/null
+++ b/net/libfetch/files/ftp.errors
@@ -0,0 +1,48 @@
+# $NetBSD: ftp.errors,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $
+# $FreeBSD: ftp.errors,v 1.6 2002/10/30 06:06:16 des Exp $
+#
+# This list is taken from RFC 959.
+# It probably needs a going over.
+#
+110 OK		Restart marker reply
+120 TEMP	Service ready in a few minutes
+125 OK		Data connection already open; transfer starting
+150 OK		File status okay; about to open data connection
+200 OK		Command okay
+202 PROTO	Command not implemented, superfluous at this site
+211 INFO	System status, or system help reply
+212 INFO	Directory status
+213 INFO	File status
+214 INFO	Help message
+215 INFO	Set system type
+220 OK		Service ready for new user
+221 OK		Service closing control connection
+225 OK		Data connection open; no transfer in progress
+226 OK		Requested file action successful
+227 OK		Entering Passive Mode
+229 OK		Entering Extended Passive Mode
+230 OK		User logged in, proceed
+250 OK		Requested file action okay, completed
+257 OK		File/directory created
+331 AUTH	User name okay, need password
+332 AUTH	Need account for login
+350 OK		Requested file action pending further information
+421 DOWN	Service not available, closing control connection
+425 NETWORK	Can't open data connection
+426 ABORT	Connection closed; transfer aborted
+450 UNAVAIL	File unavailable (e.g., file busy)
+451 SERVER	Requested action aborted: local error in processing
+452 FULL	Insufficient storage space in system
+500 PROTO	Syntax error, command unrecognized
+501 PROTO	Syntax error in parameters or arguments
+502 PROTO	Command not implemented
+503 PROTO	Bad sequence of commands
+504 PROTO	Command not implemented for that parameter
+530 AUTH	Not logged in
+532 AUTH	Need account for storing files
+535 PROTO	Bug in MediaHawk Video Kernel FTP server
+550 UNAVAIL	File unavailable (e.g., file not found, no access)
+551 PROTO	Requested action aborted. Page type unknown
+552 FULL	Exceeded storage allocation
+553 EXISTS	File name not allowed
+999 PROTO	Protocol error
diff --git a/net/libfetch/files/http.c b/net/libfetch/files/http.c
new file mode 100644
index 00000000000..ee91ca52ea1
--- /dev/null
+++ b/net/libfetch/files/http.c
@@ -0,0 +1,1227 @@
+/*	$NetBSD: http.c,v 1.1.1.1 2008/02/07 01:48:23 joerg Exp $	*/
+/*-
+ * Copyright (c) 2000-2004 Dag-Erling Coïdan Smørgrav
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in this position and unchanged.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD: http.c,v 1.83 2008/02/06 11:39:55 des Exp $
+ */
+
+/*
+ * The following copyright applies to the base64 code:
+ *
+ *-
+ * Copyright 1997 Massachusetts Institute of Technology
+ *
+ * Permission to use, copy, modify, and distribute this software and
+ * its documentation for any purpose and without fee is hereby
+ * granted, provided that both the above copyright notice and this
+ * permission notice appear in all copies, that both the above
+ * copyright notice and this permission notice appear in all
+ * supporting documentation, and that the name of M.I.T. not be used
+ * in advertising or publicity pertaining to distribution of the
+ * software without specific, written prior permission.  M.I.T. makes
+ * no representations about the suitability of this software for any
+ * purpose.  It is provided "as is" without express or implied
+ * warranty.
+ *
+ * THIS SOFTWARE IS PROVIDED BY M.I.T. ``AS IS''.  M.I.T. DISCLAIMS
+ * ALL EXPRESS OR IMPLIED WARRANTIES WITH REGARD TO THIS SOFTWARE,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
+ * SHALL M.I.T. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <ctype.h>
+#include <err.h>
+#include <errno.h>
+#include <locale.h>
+#include <netdb.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+
+#include "fetch.h"
+#include "common.h"
+#include "httperr.h"
+
+/* Maximum number of redirects to follow */
+#define MAX_REDIRECT 5
+
+/* Symbolic names for reply codes we care about */
+#define HTTP_OK			200
+#define HTTP_PARTIAL		206
+#define HTTP_MOVED_PERM		301
+#define HTTP_MOVED_TEMP		302
+#define HTTP_SEE_OTHER		303
+#define HTTP_TEMP_REDIRECT	307
+#define HTTP_NEED_AUTH		401
+#define HTTP_NEED_PROXY_AUTH	407
+#define HTTP_BAD_RANGE		416
+#define HTTP_PROTOCOL_ERROR	999
+
+#define HTTP_REDIRECT(xyz) ((xyz) == HTTP_MOVED_PERM \
+			    || (xyz) == HTTP_MOVED_TEMP \
+			    || (xyz) == HTTP_TEMP_REDIRECT \
+			    || (xyz) == HTTP_SEE_OTHER)
+
+#define HTTP_ERROR(xyz) ((xyz) > 400 && (xyz) < 599)
+
+
+/*****************************************************************************
+ * I/O functions for decoding chunked streams
+ */
+
+struct httpio
+{
+	conn_t		*conn;		/* connection */
+	int		 chunked;	/* chunked mode */
+	char		*buf;		/* chunk buffer */
+	size_t		 bufsize;	/* size of chunk buffer */
+	ssize_t		 buflen;	/* amount of data currently in buffer */
+	int		 bufpos;	/* current read offset in buffer */
+	int		 eof;		/* end-of-file flag */
+	int		 error;		/* error flag */
+	size_t		 chunksize;	/* remaining size of current chunk */
+#ifndef NDEBUG
+	size_t		 total;
+#endif
+};
+
+/*
+ * Get next chunk header
+ */
+static int
+http_new_chunk(struct httpio *io)
+{
+	char *p;
+
+	if (fetch_getln(io->conn) == -1)
+		return (-1);
+
+	if (io->conn->buflen < 2 || !isxdigit((unsigned char)*io->conn->buf))
+		return (-1);
+
+	for (p = io->conn->buf; *p && !isspace((unsigned char)*p); ++p) {
+		if (*p == ';')
+			break;
+		if (!isxdigit((unsigned char)*p))
+			return (-1);
+		if (isdigit((unsigned char)*p)) {
+			io->chunksize = io->chunksize * 16 +
+			    *p - '0';
+		} else {
+			io->chunksize = io->chunksize * 16 +
+			    10 + tolower((unsigned char)*p) - 'a';
+		}
+	}
+
+#ifndef NDEBUG
+	if (fetchDebug) {
+		io->total += io->chunksize;
+		if (io->chunksize == 0)
+			fprintf(stderr, "%s(): end of last chunk\n", __func__);
+		else
+			fprintf(stderr, "%s(): new chunk: %lu (%lu)\n",
+			    __func__, (unsigned long)io->chunksize,
+			    (unsigned long)io->total);
+	}
+#endif
+
+	return (io->chunksize);
+}
+
+/*
+ * Grow the input buffer to at least len bytes
+ */
+static inline int
+http_growbuf(struct httpio *io, size_t len)
+{
+	char *tmp;
+
+	if (io->bufsize >= len)
+		return (0);
+
+	if ((tmp = realloc(io->buf, len)) == NULL)
+		return (-1);
+	io->buf = tmp;
+	io->bufsize = len;
+	return (0);
+}
+
+/*
+ * Fill the input buffer, do chunk decoding on the fly
+ */
+static int
+http_fillbuf(struct httpio *io, size_t len)
+{
+	if (io->error)
+		return (-1);
+	if (io->eof)
+		return (0);
+
+	if (io->chunked == 0) {
+		if (http_growbuf(io, len) == -1)
+			return (-1);
+		if ((io->buflen = fetch_read(io->conn, io->buf, len)) == -1) {
+			io->error = 1;
+			return (-1);
+		}
+		io->bufpos = 0;
+		return (io->buflen);
+	}
+
+	if (io->chunksize == 0) {
+		switch (http_new_chunk(io)) {
+		case -1:
+			io->error = 1;
+			return (-1);
+		case 0:
+			io->eof = 1;
+			return (0);
+		}
+	}
+
+	if (len > io->chunksize)
+		len = io->chunksize;
+	if (http_growbuf(io, len) == -1)
+		return (-1);
+	if ((io->buflen = fetch_read(io->conn, io->buf, len)) == -1) {
+		io->error = 1;
+		return (-1);
+	}
+	io->chunksize -= io->buflen;
+
+	if (io->chunksize == 0) {
+		char endl[2];
+
+		if (fetch_read(io->conn, endl, 2) != 2 ||
+		    endl[0] != '\r' || endl[1] != '\n')
+			return (-1);
+	}
+
+	io->bufpos = 0;
+
+	return (io->buflen);
+}
+
+/*
+ * Read function
+ */
+static int
+http_readfn(void *v, char *buf, int len)
+{
+	struct httpio *io = (struct httpio *)v;
+	int l, pos;
+
+	if (io->error)
+		return (-1);
+	if (io->eof)
+		return (0);
+
+	for (pos = 0; len > 0; pos += l, len -= l) {
+		/* empty buffer */
+		if (!io->buf || io->bufpos == io->buflen)
+			if (http_fillbuf(io, len) < 1)
+				break;
+		l = io->buflen - io->bufpos;
+		if (len < l)
+			l = len;
+		bcopy(io->buf + io->bufpos, buf + pos, l);
+		io->bufpos += l;
+	}
+
+	if (!pos && io->error)
+		return (-1);
+	return (pos);
+}
+
+/*
+ * Write function
+ */
+static int
+http_writefn(void *v, const char *buf, int len)
+{
+	struct httpio *io = (struct httpio *)v;
+
+	return (fetch_write(io->conn, buf, len));
+}
+
+/*
+ * Close function
+ */
+static int
+http_closefn(void *v)
+{
+	struct httpio *io = (struct httpio *)v;
+	int r;
+
+	r = fetch_close(io->conn);
+	if (io->buf)
+		free(io->buf);
+	free(io);
+	return (r);
+}
+
+/*
+ * Wrap a file descriptor up
+ */
+static FILE *
+http_funopen(conn_t *conn, int chunked)
+{
+	struct httpio *io;
+	FILE *f;
+
+	if ((io = calloc(1, sizeof(*io))) == NULL) {
+		fetch_syserr();
+		return (NULL);
+	}
+	io->conn = conn;
+	io->chunked = chunked;
+	f = funopen(io, http_readfn, http_writefn, NULL, http_closefn);
+	if (f == NULL) {
+		fetch_syserr();
+		free(io);
+		return (NULL);
+	}
+	return (f);
+}
+
+
+/*****************************************************************************
+ * Helper functions for talking to the server and parsing its replies
+ */
+
+/* Header types */
+typedef enum {
+	hdr_syserror = -2,
+	hdr_error = -1,
+	hdr_end = 0,
+	hdr_unknown = 1,
+	hdr_content_length,
+	hdr_content_range,
+	hdr_last_modified,
+	hdr_location,
+	hdr_transfer_encoding,
+	hdr_www_authenticate
+} hdr_t;
+
+/* Names of interesting headers */
+static struct {
+	hdr_t		 num;
+	const char	*name;
+} hdr_names[] = {
+	{ hdr_content_length,		"Content-Length" },
+	{ hdr_content_range,		"Content-Range" },
+	{ hdr_last_modified,		"Last-Modified" },
+	{ hdr_location,			"Location" },
+	{ hdr_transfer_encoding,	"Transfer-Encoding" },
+	{ hdr_www_authenticate,		"WWW-Authenticate" },
+	{ hdr_unknown,			NULL },
+};
+
+/*
+ * Send a formatted line; optionally echo to terminal
+ */
+static int
+http_cmd(conn_t *conn, const char *fmt, ...)
+{
+	va_list ap;
+	size_t len;
+	char *msg;
+	int r;
+
+	va_start(ap, fmt);
+	len = vasprintf(&msg, fmt, ap);
+	va_end(ap);
+
+	if (msg == NULL) {
+		errno = ENOMEM;
+		fetch_syserr();
+		return (-1);
+	}
+
+	r = fetch_putln(conn, msg, len);
+	free(msg);
+
+	if (r == -1) {
+		fetch_syserr();
+		return (-1);
+	}
+
+	return (0);
+}
+
+/*
+ * Get and parse status line
+ */
+static int
+http_get_reply(conn_t *conn)
+{
+	char *p;
+
+	if (fetch_getln(conn) == -1)
+		return (-1);
+	/*
+	 * A valid status line looks like "HTTP/m.n xyz reason" where m
+	 * and n are the major and minor protocol version numbers and xyz
+	 * is the reply code.
+	 * Unfortunately, there are servers out there (NCSA 1.5.1, to name
+	 * just one) that do not send a version number, so we can't rely
+	 * on finding one, but if we do, insist on it being 1.0 or 1.1.
+	 * We don't care about the reason phrase.
+	 */
+	if (strncmp(conn->buf, "HTTP", 4) != 0)
+		return (HTTP_PROTOCOL_ERROR);
+	p = conn->buf + 4;
+	if (*p == '/') {
+		if (p[1] != '1' || p[2] != '.' || (p[3] != '0' && p[3] != '1'))
+			return (HTTP_PROTOCOL_ERROR);
+		p += 4;
+	}
+	if (*p != ' ' ||
+	    !isdigit((unsigned char)p[1]) ||
+	    !isdigit((unsigned char)p[2]) ||
+	    !isdigit((unsigned char)p[3]))
+		return (HTTP_PROTOCOL_ERROR);
+
+	conn->err = (p[1] - '0') * 100 + (p[2] - '0') * 10 + (p[3] - '0');
+	return (conn->err);
+}
+
+/*
+ * Check a header; if the type matches the given string, return a pointer
+ * to the beginning of the value.
+ */
+static const char *
+http_match(const char *str, const char *hdr)
+{
+	while (*str && *hdr &&
+	    tolower((unsigned char)*str++) == tolower((unsigned char)*hdr++))
+		/* nothing */;
+	if (*str || *hdr != ':')
+		return (NULL);
+	while (*hdr && isspace((unsigned char)*++hdr))
+		/* nothing */;
+	return (hdr);
+}
+
+/*
+ * Get the next header and return the appropriate symbolic code.
+ */
+static hdr_t
+http_next_header(conn_t *conn, const char **p)
+{
+	int i;
+
+	if (fetch_getln(conn) == -1)
+		return (hdr_syserror);
+	while (conn->buflen && isspace((unsigned char)conn->buf[conn->buflen - 1]))
+		conn->buflen--;
+	conn->buf[conn->buflen] = '\0';
+	if (conn->buflen == 0)
+		return (hdr_end);
+	/*
+	 * We could check for malformed headers but we don't really care.
+	 * A valid header starts with a token immediately followed by a
+	 * colon; a token is any sequence of non-control, non-whitespace
+	 * characters except "()<>@,;:\\\"{}".
+	 */
+	for (i = 0; hdr_names[i].num != hdr_unknown; i++)
+		if ((*p = http_match(hdr_names[i].name, conn->buf)) != NULL)
+			return (hdr_names[i].num);
+	return (hdr_unknown);
+}
+
+/*
+ * Parse a last-modified header
+ */
+static int
+http_parse_mtime(const char *p, time_t *mtime)
+{
+	char locale[64], *r;
+	struct tm tm;
+
+	strncpy(locale, setlocale(LC_TIME, NULL), sizeof(locale));
+	setlocale(LC_TIME, "C");
+	r = strptime(p, "%a, %d %b %Y %H:%M:%S GMT", &tm);
+	/* XXX should add support for date-2 and date-3 */
+	setlocale(LC_TIME, locale);
+	if (r == NULL)
+		return (-1);
+	DEBUG(fprintf(stderr, "last modified: [%04d-%02d-%02d "
+		  "%02d:%02d:%02d]\n",
+		  tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+		  tm.tm_hour, tm.tm_min, tm.tm_sec));
+	*mtime = timegm(&tm);
+	return (0);
+}
+
+/*
+ * Parse a content-length header
+ */
+static int
+http_parse_length(const char *p, off_t *length)
+{
+	off_t len;
+
+	for (len = 0; *p && isdigit((unsigned char)*p); ++p)
+		len = len * 10 + (*p - '0');
+	if (*p)
+		return (-1);
+	DEBUG(fprintf(stderr, "content length: [%lld]\n",
+	    (long long)len));
+	*length = len;
+	return (0);
+}
+
+/*
+ * Parse a content-range header
+ */
+static int
+http_parse_range(const char *p, off_t *offset, off_t *length, off_t *size)
+{
+	off_t first, last, len;
+
+	if (strncasecmp(p, "bytes ", 6) != 0)
+		return (-1);
+	p += 6;
+	if (*p == '*') {
+		first = last = -1;
+		++p;
+	} else {
+		for (first = 0; *p && isdigit((unsigned char)*p); ++p)
+			first = first * 10 + *p - '0';
+		if (*p != '-')
+			return (-1);
+		for (last = 0, ++p; *p && isdigit((unsigned char)*p); ++p)
+			last = last * 10 + *p - '0';
+	}
+	if (first > last || *p != '/')
+		return (-1);
+	for (len = 0, ++p; *p && isdigit((unsigned char)*p); ++p)
+		len = len * 10 + *p - '0';
+	if (*p || len < last - first + 1)
+		return (-1);
+	if (first == -1) {
+		DEBUG(fprintf(stderr, "content range: [*/%lld]\n",
+		    (long long)len));
+		*length = 0;
+	} else {
+		DEBUG(fprintf(stderr, "content range: [%lld-%lld/%lld]\n",
+		    (long long)first, (long long)last, (long long)len));
+		*length = last - first + 1;
+	}
+	*offset = first;
+	*size = len;
+	return (0);
+}
+
+
+/*****************************************************************************
+ * Helper functions for authorization
+ */
+
+/*
+ * Base64 encoding
+ */
+static char *
+http_base64(const char *src)
+{
+	static const char base64[] =
+	    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+	    "abcdefghijklmnopqrstuvwxyz"
+	    "0123456789+/";
+	char *str, *dst;
+	size_t l;
+	int t, r;
+
+	l = strlen(src);
+	if ((str = malloc(((l + 2) / 3) * 4 + 1)) == NULL)
+		return (NULL);
+	dst = str;
+	r = 0;
+
+	while (l >= 3) {
+		t = (src[0] << 16) | (src[1] << 8) | src[2];
+		dst[0] = base64[(t >> 18) & 0x3f];
+		dst[1] = base64[(t >> 12) & 0x3f];
+		dst[2] = base64[(t >> 6) & 0x3f];
+		dst[3] = base64[(t >> 0) & 0x3f];
+		src += 3; l -= 3;
+		dst += 4; r += 4;
+	}
+
+	switch (l) {
+	case 2:
+		t = (src[0] << 16) | (src[1] << 8);
+		dst[0] = base64[(t >> 18) & 0x3f];
+		dst[1] = base64[(t >> 12) & 0x3f];
+		dst[2] = base64[(t >> 6) & 0x3f];
+		dst[3] = '=';
+		dst += 4;
+		r += 4;
+		break;
+	case 1:
+		t = src[0] << 16;
+		dst[0] = base64[(t >> 18) & 0x3f];
+		dst[1] = base64[(t >> 12) & 0x3f];
+		dst[2] = dst[3] = '=';
+		dst += 4;
+		r += 4;
+		break;
+	case 0:
+		break;
+	}
+
+	*dst = 0;
+	return (str);
+}
+
+/*
+ * Encode username and password
+ */
+static int
+http_basic_auth(conn_t *conn, const char *hdr, const char *usr, const char *pwd)
+{
+	char *upw, *auth;
+	int r;
+
+	DEBUG(fprintf(stderr, "usr: [%s]\n", usr));
+	DEBUG(fprintf(stderr, "pwd: [%s]\n", pwd));
+	if (asprintf(&upw, "%s:%s", usr, pwd) == -1)
+		return (-1);
+	auth = http_base64(upw);
+	free(upw);
+	if (auth == NULL)
+		return (-1);
+	r = http_cmd(conn, "%s: Basic %s", hdr, auth);
+	free(auth);
+	return (r);
+}
+
+/*
+ * Send an authorization header
+ */
+static int
+http_authorize(conn_t *conn, const char *hdr, const char *p)
+{
+	/* basic authorization */
+	if (strncasecmp(p, "basic:", 6) == 0) {
+		char *user, *pwd, *str;
+		int r;
+
+		/* skip realm */
+		for (p += 6; *p && *p != ':'; ++p)
+			/* nothing */ ;
+		if (!*p || strchr(++p, ':') == NULL)
+			return (-1);
+		if ((str = strdup(p)) == NULL)
+			return (-1); /* XXX */
+		user = str;
+		pwd = strchr(str, ':');
+		*pwd++ = '\0';
+		r = http_basic_auth(conn, hdr, user, pwd);
+		free(str);
+		return (r);
+	}
+	return (-1);
+}
+
+
+/*****************************************************************************
+ * Helper functions for connecting to a server or proxy
+ */
+
+/*
+ * Connect to the correct HTTP server or proxy.
+ */
+static conn_t *
+http_connect(struct url *URL, struct url *purl, const char *flags)
+{
+	conn_t *conn;
+	int af, verbose;
+#ifdef TCP_NOPUSH
+	int val;
+#endif
+
+#ifdef INET6
+	af = AF_UNSPEC;
+#else
+	af = AF_INET;
+#endif
+
+	verbose = CHECK_FLAG('v');
+	if (CHECK_FLAG('4'))
+		af = AF_INET;
+#ifdef INET6
+	else if (CHECK_FLAG('6'))
+		af = AF_INET6;
+#endif
+
+	if (purl && strcasecmp(URL->scheme, SCHEME_HTTPS) != 0) {
+		URL = purl;
+	} else if (strcasecmp(URL->scheme, SCHEME_FTP) == 0) {
+		/* can't talk http to an ftp server */
+		/* XXX should set an error code */
+		return (NULL);
+	}
+
+	if ((conn = fetch_connect(URL->host, URL->port, af, verbose)) == NULL)
+		/* fetch_connect() has already set an error code */
+		return (NULL);
+	if (strcasecmp(URL->scheme, SCHEME_HTTPS) == 0 &&
+	    fetch_ssl(conn, verbose) == -1) {
+		fetch_close(conn);
+		/* grrr */
+		errno = EAUTH;
+		fetch_syserr();
+		return (NULL);
+	}
+
+#ifdef TCP_NOPUSH
+	val = 1;
+	setsockopt(conn->sd, IPPROTO_TCP, TCP_NOPUSH, &val, sizeof(val));
+#endif
+
+	return (conn);
+}
+
+static struct url *
+http_get_proxy(struct url * url, const char *flags)
+{
+	struct url *purl;
+	char *p;
+
+	if (flags != NULL && strchr(flags, 'd') != NULL)
+		return (NULL);
+	if (fetch_no_proxy_match(url->host))
+		return (NULL);
+	if (((p = getenv("HTTP_PROXY")) || (p = getenv("http_proxy"))) &&
+	    *p && (purl = fetchParseURL(p))) {
+		if (!*purl->scheme)
+			strcpy(purl->scheme, SCHEME_HTTP);
+		if (!purl->port)
+			purl->port = fetch_default_proxy_port(purl->scheme);
+		if (strcasecmp(purl->scheme, SCHEME_HTTP) == 0)
+			return (purl);
+		fetchFreeURL(purl);
+	}
+	return (NULL);
+}
+
+static void
+http_print_html(FILE *out, FILE *in)
+{
+	size_t len;
+	char *line, *p, *q;
+	int comment, tag;
+
+	comment = tag = 0;
+	while ((line = fgetln(in, &len)) != NULL) {
+		while (len && isspace((unsigned char)line[len - 1]))
+			--len;
+		for (p = q = line; q < line + len; ++q) {
+			if (comment && *q == '-') {
+				if (q + 2 < line + len &&
+				    strcmp(q, "-->") == 0) {
+					tag = comment = 0;
+					q += 2;
+				}
+			} else if (tag && !comment && *q == '>') {
+				p = q + 1;
+				tag = 0;
+			} else if (!tag && *q == '<') {
+				if (q > p)
+					fwrite(p, q - p, 1, out);
+				tag = 1;
+				if (q + 3 < line + len &&
+				    strcmp(q, "<!--") == 0) {
+					comment = 1;
+					q += 3;
+				}
+			}
+		}
+		if (!tag && q > p)
+			fwrite(p, q - p, 1, out);
+		fputc('\n', out);
+	}
+}
+
+
+/*****************************************************************************
+ * Core
+ */
+
+/*
+ * Send a request and process the reply
+ *
+ * XXX This function is way too long, the do..while loop should be split
+ * XXX off into a separate function.
+ */
+FILE *
+http_request(struct url *URL, const char *op, struct url_stat *us,
+    struct url *purl, const char *flags)
+{
+	conn_t *conn;
+	struct url *url, *new;
+	int chunked, direct, need_auth, noredirect, verbose;
+	int e, i, n, val;
+	off_t offset, clength, length, size;
+	time_t mtime;
+	const char *p;
+	FILE *f;
+	hdr_t h;
+	char hbuf[URL_HOSTLEN + 7], *host;
+
+	direct = CHECK_FLAG('d');
+	noredirect = CHECK_FLAG('A');
+	verbose = CHECK_FLAG('v');
+
+	if (direct && purl) {
+		fetchFreeURL(purl);
+		purl = NULL;
+	}
+
+	/* try the provided URL first */
+	url = URL;
+
+	/* if the A flag is set, we only get one try */
+	n = noredirect ? 1 : MAX_REDIRECT;
+	i = 0;
+
+	e = HTTP_PROTOCOL_ERROR;
+	need_auth = 0;
+	do {
+		new = NULL;
+		chunked = 0;
+		offset = 0;
+		clength = -1;
+		length = -1;
+		size = -1;
+		mtime = 0;
+
+		/* check port */
+		if (!url->port)
+			url->port = fetch_default_port(url->scheme);
+
+		/* were we redirected to an FTP URL? */
+		if (purl == NULL && strcmp(url->scheme, SCHEME_FTP) == 0) {
+			if (strcmp(op, "GET") == 0)
+				return (ftp_request(url, "RETR", us, purl, flags));
+			else if (strcmp(op, "HEAD") == 0)
+				return (ftp_request(url, "STAT", us, purl, flags));
+		}
+
+		/* connect to server or proxy */
+		if ((conn = http_connect(url, purl, flags)) == NULL)
+			goto ouch;
+
+		host = url->host;
+#ifdef INET6
+		if (strchr(url->host, ':')) {
+			snprintf(hbuf, sizeof(hbuf), "[%s]", url->host);
+			host = hbuf;
+		}
+#endif
+		if (url->port != fetch_default_port(url->scheme)) {
+			if (host != hbuf) {
+				strcpy(hbuf, host);
+				host = hbuf;
+			}
+			snprintf(hbuf + strlen(hbuf),
+			    sizeof(hbuf) - strlen(hbuf), ":%d", url->port);
+		}
+
+		/* send request */
+		if (verbose)
+			fetch_info("requesting %s://%s%s",
+			    url->scheme, host, url->doc);
+		if (purl) {
+			http_cmd(conn, "%s %s://%s%s HTTP/1.1",
+			    op, url->scheme, host, url->doc);
+		} else {
+			http_cmd(conn, "%s %s HTTP/1.1",
+			    op, url->doc);
+		}
+
+		/* virtual host */
+		http_cmd(conn, "Host: %s", host);
+
+		/* proxy authorization */
+		if (purl) {
+			if (*purl->user || *purl->pwd)
+				http_basic_auth(conn, "Proxy-Authorization",
+				    purl->user, purl->pwd);
+			else if ((p = getenv("HTTP_PROXY_AUTH")) != NULL && *p != '\0')
+				http_authorize(conn, "Proxy-Authorization", p);
+		}
+
+		/* server authorization */
+		if (need_auth || *url->user || *url->pwd) {
+			if (*url->user || *url->pwd)
+				http_basic_auth(conn, "Authorization", url->user, url->pwd);
+			else if ((p = getenv("HTTP_AUTH")) != NULL && *p != '\0')
+				http_authorize(conn, "Authorization", p);
+			else if (fetchAuthMethod && fetchAuthMethod(url) == 0) {
+				http_basic_auth(conn, "Authorization", url->user, url->pwd);
+			} else {
+				http_seterr(HTTP_NEED_AUTH);
+				goto ouch;
+			}
+		}
+
+		/* other headers */
+		if ((p = getenv("HTTP_REFERER")) != NULL && *p != '\0') {
+			if (strcasecmp(p, "auto") == 0)
+				http_cmd(conn, "Referer: %s://%s%s",
+				    url->scheme, host, url->doc);
+			else
+				http_cmd(conn, "Referer: %s", p);
+		}
+		if ((p = getenv("HTTP_USER_AGENT")) != NULL && *p != '\0')
+			http_cmd(conn, "User-Agent: %s", p);
+		else
+			http_cmd(conn, "User-Agent: %s " _LIBFETCH_VER, getprogname());
+		if (url->offset > 0)
+			http_cmd(conn, "Range: bytes=%lld-", (long long)url->offset);
+		http_cmd(conn, "Connection: close");
+		http_cmd(conn, "");
+
+		/*
+		 * Force the queued request to be dispatched.  Normally, one
+		 * would do this with shutdown(2) but squid proxies can be
+		 * configured to disallow such half-closed connections.  To
+		 * be compatible with such configurations, fiddle with socket
+		 * options to force the pending data to be written.
+		 */
+#ifdef TCP_NOPUSH
+		val = 0;
+		setsockopt(conn->sd, IPPROTO_TCP, TCP_NOPUSH, &val,
+			   sizeof(val));
+#endif
+		val = 1;
+		setsockopt(conn->sd, IPPROTO_TCP, TCP_NODELAY, &val,
+			   sizeof(val));
+
+		/* get reply */
+		switch (http_get_reply(conn)) {
+		case HTTP_OK:
+		case HTTP_PARTIAL:
+			/* fine */
+			break;
+		case HTTP_MOVED_PERM:
+		case HTTP_MOVED_TEMP:
+		case HTTP_SEE_OTHER:
+			/*
+			 * Not so fine, but we still have to read the
+			 * headers to get the new location.
+			 */
+			break;
+		case HTTP_NEED_AUTH:
+			if (need_auth) {
+				/*
+				 * We already sent out authorization code,
+				 * so there's nothing more we can do.
+				 */
+				http_seterr(conn->err);
+				goto ouch;
+			}
+			/* try again, but send the password this time */
+			if (verbose)
+				fetch_info("server requires authorization");
+			break;
+		case HTTP_NEED_PROXY_AUTH:
+			/*
+			 * If we're talking to a proxy, we already sent
+			 * our proxy authorization code, so there's
+			 * nothing more we can do.
+			 */
+			http_seterr(conn->err);
+			goto ouch;
+		case HTTP_BAD_RANGE:
+			/*
+			 * This can happen if we ask for 0 bytes because
+			 * we already have the whole file.  Consider this
+			 * a success for now, and check sizes later.
+			 */
+			break;
+		case HTTP_PROTOCOL_ERROR:
+			/* fall through */
+		case -1:
+			fetch_syserr();
+			goto ouch;
+		default:
+			http_seterr(conn->err);
+			if (!verbose)
+				goto ouch;
+			/* fall through so we can get the full error message */
+		}
+
+		/* get headers */
+		do {
+			switch ((h = http_next_header(conn, &p))) {
+			case hdr_syserror:
+				fetch_syserr();
+				goto ouch;
+			case hdr_error:
+				http_seterr(HTTP_PROTOCOL_ERROR);
+				goto ouch;
+			case hdr_content_length:
+				http_parse_length(p, &clength);
+				break;
+			case hdr_content_range:
+				http_parse_range(p, &offset, &length, &size);
+				break;
+			case hdr_last_modified:
+				http_parse_mtime(p, &mtime);
+				break;
+			case hdr_location:
+				if (!HTTP_REDIRECT(conn->err))
+					break;
+				if (new)
+					free(new);
+				if (verbose)
+					fetch_info("%d redirect to %s", conn->err, p);
+				if (*p == '/')
+					/* absolute path */
+					new = fetchMakeURL(url->scheme, url->host, url->port, p,
+					    url->user, url->pwd);
+				else
+					new = fetchParseURL(p);
+				if (new == NULL) {
+					/* XXX should set an error code */
+					DEBUG(fprintf(stderr, "failed to parse new URL\n"));
+					goto ouch;
+				}
+				if (!*new->user && !*new->pwd) {
+					strcpy(new->user, url->user);
+					strcpy(new->pwd, url->pwd);
+				}
+				new->offset = url->offset;
+				new->length = url->length;
+				break;
+			case hdr_transfer_encoding:
+				/* XXX weak test*/
+				chunked = (strcasecmp(p, "chunked") == 0);
+				break;
+			case hdr_www_authenticate:
+				if (conn->err != HTTP_NEED_AUTH)
+					break;
+				/* if we were smarter, we'd check the method and realm */
+				break;
+			case hdr_end:
+				/* fall through */
+			case hdr_unknown:
+				/* ignore */
+				break;
+			}
+		} while (h > hdr_end);
+
+		/* we need to provide authentication */
+		if (conn->err == HTTP_NEED_AUTH) {
+			e = conn->err;
+			need_auth = 1;
+			fetch_close(conn);
+			conn = NULL;
+			continue;
+		}
+
+		/* requested range not satisfiable */
+		if (conn->err == HTTP_BAD_RANGE) {
+			if (url->offset == size && url->length == 0) {
+				/* asked for 0 bytes; fake it */
+				offset = url->offset;
+				conn->err = HTTP_OK;
+				break;
+			} else {
+				http_seterr(conn->err);
+				goto ouch;
+			}
+		}
+
+		/* we have a hit or an error */
+		if (conn->err == HTTP_OK || conn->err == HTTP_PARTIAL || HTTP_ERROR(conn->err))
+			break;
+
+		/* all other cases: we got a redirect */
+		e = conn->err;
+		need_auth = 0;
+		fetch_close(conn);
+		conn = NULL;
+		if (!new) {
+			DEBUG(fprintf(stderr, "redirect with no new location\n"));
+			break;
+		}
+		if (url != URL)
+			fetchFreeURL(url);
+		url = new;
+	} while (++i < n);
+
+	/* we failed, or ran out of retries */
+	if (conn == NULL) {
+		http_seterr(e);
+		goto ouch;
+	}
+
+	DEBUG(fprintf(stderr, "offset %lld, length %lld,"
+		  " size %lld, clength %lld\n",
+		  (long long)offset, (long long)length,
+		  (long long)size, (long long)clength));
+
+	/* check for inconsistencies */
+	if (clength != -1 && length != -1 && clength != length) {
+		http_seterr(HTTP_PROTOCOL_ERROR);
+		goto ouch;
+	}
+	if (clength == -1)
+		clength = length;
+	if (clength != -1)
+		length = offset + clength;
+	if (length != -1 && size != -1 && length != size) {
+		http_seterr(HTTP_PROTOCOL_ERROR);
+		goto ouch;
+	}
+	if (size == -1)
+		size = length;
+
+	/* fill in stats */
+	if (us) {
+		us->size = size;
+		us->atime = us->mtime = mtime;
+	}
+
+	/* too far? */
+	if (URL->offset > 0 && offset > URL->offset) {
+		http_seterr(HTTP_PROTOCOL_ERROR);
+		goto ouch;
+	}
+
+	/* report back real offset and size */
+	URL->offset = offset;
+	URL->length = clength;
+
+	/* wrap it up in a FILE */
+	if ((f = http_funopen(conn, chunked)) == NULL) {
+		fetch_syserr();
+		goto ouch;
+	}
+
+	if (url != URL)
+		fetchFreeURL(url);
+	if (purl)
+		fetchFreeURL(purl);
+
+	if (HTTP_ERROR(conn->err)) {
+		http_print_html(stderr, f);
+		fclose(f);
+		f = NULL;
+	}
+
+	return (f);
+
+ouch:
+	if (url != URL)
+		fetchFreeURL(url);
+	if (purl)
+		fetchFreeURL(purl);
+	if (conn != NULL)
+		fetch_close(conn);
+	return (NULL);
+}
+
+
+/*****************************************************************************
+ * Entry points
+ */
+
+/*
+ * Retrieve and stat a file by HTTP
+ */
+FILE *
+fetchXGetHTTP(struct url *URL, struct url_stat *us, const char *flags)
+{
+	return (http_request(URL, "GET", us, http_get_proxy(URL, flags), flags));
+}
+
+/*
+ * Retrieve a file by HTTP
+ */
+FILE *
+fetchGetHTTP(struct url *URL, const char *flags)
+{
+	return (fetchXGetHTTP(URL, NULL, flags));
+}
+
+/*
+ * Store a file by HTTP
+ */
+FILE *
+fetchPutHTTP(struct url *URL __unused, const char *flags __unused)
+{
+	warnx("fetchPutHTTP(): not implemented");
+	return (NULL);
+}
+
+/*
+ * Get an HTTP document's metadata
+ */
+int
+fetchStatHTTP(struct url *URL, struct url_stat *us, const char *flags)
+{
+	FILE *f;
+
+	f = http_request(URL, "HEAD", us, http_get_proxy(URL, flags), flags);
+	if (f == NULL)
+		return (-1);
+	fclose(f);
+	return (0);
+}
+
+/*
+ * List a directory
+ */
+struct url_ent *
+fetchListHTTP(struct url *url __unused, const char *flags __unused)
+{
+	warnx("fetchListHTTP(): not implemented");
+	return (NULL);
+}
diff --git a/net/libfetch/files/http.errors b/net/libfetch/files/http.errors
new file mode 100644
index 00000000000..f5487774066
--- /dev/null
+++ b/net/libfetch/files/http.errors
@@ -0,0 +1,46 @@
+# $FreeBSD: http.errors,v 1.5 2001/05/23 18:52:02 des Exp $
+# $NetBSD: http.errors,v 1.1.1.1 2008/02/07 01:48:23 joerg Exp $
+#
+# This list is taken from RFC 2068.
+#
+100 OK		Continue
+101 OK		Switching Protocols
+200 OK		OK
+201 OK		Created
+202 OK		Accepted
+203 INFO	Non-Authoritative Information
+204 OK		No Content
+205 OK		Reset Content
+206 OK		Partial Content
+300 MOVED	Multiple Choices
+301 MOVED	Moved Permanently
+302 MOVED	Moved Temporarily
+303 MOVED	See Other
+304 OK		Not Modified
+305 INFO	Use Proxy
+307 MOVED	Temporary Redirect
+400 PROTO	Bad Request
+401 AUTH	Unauthorized
+402 AUTH	Payment Required
+403 AUTH	Forbidden
+404 UNAVAIL	Not Found
+405 PROTO	Method Not Allowed
+406 PROTO	Not Acceptable
+407 AUTH	Proxy Authentication Required
+408 TIMEOUT	Request Time-out
+409 EXISTS	Conflict
+410 UNAVAIL	Gone
+411 PROTO	Length Required
+412 SERVER	Precondition Failed
+413 PROTO	Request Entity Too Large
+414 PROTO	Request-URI Too Large
+415 PROTO	Unsupported Media Type
+416 UNAVAIL	Requested Range Not Satisfiable
+417 SERVER	Expectation Failed
+500 SERVER	Internal Server Error
+501 PROTO	Not Implemented
+502 SERVER	Bad Gateway
+503 TEMP	Service Unavailable
+504 TIMEOUT	Gateway Time-out
+505 PROTO	HTTP Version not supported
+999 PROTO	Protocol error
diff --git a/net/libfetch/options.mk b/net/libfetch/options.mk
new file mode 100644
index 00000000000..c663d30f837
--- /dev/null
+++ b/net/libfetch/options.mk
@@ -0,0 +1,19 @@
+# $NetBSD: options.mk,v 1.1.1.1 2008/02/07 01:48:22 joerg Exp $
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.libfetch
+PKG_SUPPORTED_OPTIONS=	inet6 openssl
+PKG_SUGGESTED_OPTIONS=	inet6 openssl
+
+.include "../../mk/bsd.options.mk"
+
+.if !empty(PKG_OPTIONS:Minet6)
+MAKE_ENV+=		FETCH_WITH_INET6=yes
+.else
+MAKE_ENV+=		FETCH_WITH_INET6=no
+.endif
+
+.if !empty(PKG_OPTIONS:Mopenssl)
+MAKE_ENV+=		FETCH_WITH_OPENSSL=yes
+.else
+MAKE_ENV+=		FETCH_WITH_OPENSSL=no
+.endif