You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

275 lines
10 KiB

  1. #!/bin/sh
  2. #
  3. # ensure we never fallback from a signed to a unsigned repo
  4. #
  5. # hash checks are done in
  6. #
  7. set -e
  8. simulate_mitm_and_inject_evil_package()
  9. {
  10. redatereleasefiles '+1 hour'
  11. rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
  12. inject_evil_package
  13. }
  14. inject_evil_package()
  15. {
  16. cat > "$APTARCHIVE/dists/unstable/main/binary-i386/Packages" <<EOF
  17. Package: evil
  18. Installed-Size: 29
  19. Maintainer: Joe Sixpack <joe@example.org>
  20. Architecture: all
  21. Version: 1.0
  22. Filename: pool/evil_1.0_all.deb
  23. Size: 1270
  24. Description: an autogenerated evil package
  25. EOF
  26. # avoid ims hit
  27. touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
  28. compressfile aptarchive/dists/unstable/main/binary-i386/Packages
  29. }
  30. assert_update_is_refused_and_last_good_state_used()
  31. {
  32. testfailuremsg "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed.
  33. N: Updating from such a repository can't be done securely, and is therefore disabled by default.
  34. N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update
  35. assert_repo_is_intact
  36. }
  37. assert_repo_is_intact()
  38. {
  39. testsuccessequal "dpkg/now 1.16.2+fake all [installed,local]
  40. foo/unstable 2.0 all" apt list -qq
  41. testsuccess aptget install -y -s foo
  42. testfailure aptget install -y evil
  43. testsuccess aptget source foo --print-uris
  44. LISTDIR=rootdir/var/lib/apt/lists
  45. testempty find "$LISTDIR" -name 'InRelease' -o -name 'Release.gpg'
  46. }
  47. setupaptarchive_with_lists_clean()
  48. {
  49. setupaptarchive --no-update
  50. rm -rf rootdir/var/lib/apt/lists
  51. }
  52. test_from_inrelease_to_unsigned()
  53. {
  54. export APT_DONT_SIGN='Release.gpg'
  55. setupaptarchive_with_lists_clean
  56. testsuccess aptget update
  57. listcurrentlistsdirectory > lists.before
  58. simulate_mitm_and_inject_evil_package
  59. assert_update_is_refused_and_last_good_state_used
  60. testfileequal lists.before "$(listcurrentlistsdirectory)"
  61. }
  62. test_from_release_gpg_to_unsigned()
  63. {
  64. export APT_DONT_SIGN='InRelease'
  65. setupaptarchive_with_lists_clean
  66. testsuccess aptget update
  67. listcurrentlistsdirectory > lists.before
  68. simulate_mitm_and_inject_evil_package
  69. assert_update_is_refused_and_last_good_state_used
  70. testfileequal lists.before "$(listcurrentlistsdirectory)"
  71. }
  72. test_from_inrelease_to_unsigned_with_override()
  73. {
  74. export APT_DONT_SIGN='Release.gpg'
  75. # setup archive with InRelease file
  76. setupaptarchive_with_lists_clean
  77. testsuccess aptget update
  78. # simulate moving to a unsigned but otherwise valid repo
  79. simulate_mitm_and_inject_evil_package
  80. generatereleasefiles '+2 hours'
  81. find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;
  82. # and ensure we can update to it (with enough force)
  83. testfailure apt update
  84. testfailure aptget update
  85. testfailure aptget update --allow-insecure-repositories
  86. testfailure aptget update --no-allow-insecure-repositories
  87. sed -i 's#^deb\(-src\)\? #deb\1 [allow-downgrade-to-insecure=yes] #' rootdir/etc/apt/sources.list.d/*
  88. testfailure aptget update --no-allow-insecure-repositories
  89. testfailure apt update
  90. testwarning apt update --allow-insecure-repositories \
  91. -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
  92. sed -i 's#^deb\(-src\)\? \[allow-downgrade-to-insecure=yes\] #deb\1 #' rootdir/etc/apt/sources.list.d/*
  93. # but that the individual packages are still considered untrusted
  94. testfailureequal "WARNING: The following packages cannot be authenticated!
  95. evil
  96. E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
  97. }
  98. test_from_inrelease_to_norelease_with_override()
  99. {
  100. # setup archive with InRelease file
  101. setupaptarchive_with_lists_clean
  102. testsuccess aptget update
  103. # simulate moving to a unsigned but otherwise valid repo
  104. simulate_mitm_and_inject_evil_package
  105. find "$APTARCHIVE" -name '*Release*' -delete
  106. find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;
  107. # and ensure we can update to it (with enough force)
  108. testfailure aptget update
  109. testfailure aptget update --allow-insecure-repositories
  110. testwarning aptget update --allow-insecure-repositories \
  111. -o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
  112. # but that the individual packages are still considered untrusted
  113. testfailureequal "WARNING: The following packages cannot be authenticated!
  114. evil
  115. E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
  116. }
  117. test_cve_2012_0214()
  118. {
  119. # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
  120. #
  121. # it was possible to MITM the download so that InRelease/Release.gpg
  122. # are not delivered (404) and a altered Release file was send
  123. #
  124. # apt left the old InRelease file in /var/lib/apt/lists and downloaded
  125. # the unauthenticated Release file too giving the false impression that
  126. # Release was authenticated
  127. #
  128. # Note that this is pretty much impossible nowadays because:
  129. # a) InRelease is left as is, not split to InRelease/Release as it was
  130. # in the old days
  131. # b) we refuse to go from signed->unsigned
  132. #
  133. # Still worth having a regression test the simulates the condition
  134. export APT_DONT_SIGN='Release.gpg'
  135. setupaptarchive_with_lists_clean
  136. testsuccess aptget update
  137. listcurrentlistsdirectory > lists.before
  138. # do what CVE-2012-0214 did
  139. rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
  140. inject_evil_package
  141. # build valid Release file
  142. aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
  143. assert_update_is_refused_and_last_good_state_used
  144. testfileequal lists.before "$(listcurrentlistsdirectory)"
  145. # ensure there is no _Release file downloaded
  146. testfailure ls rootdir/var/lib/apt/lists/*_Release
  147. }
  148. test_subvert_inrelease()
  149. {
  150. export APT_DONT_SIGN='Release.gpg'
  151. setupaptarchive_with_lists_clean
  152. testsuccess aptget update
  153. listcurrentlistsdirectory > lists.before
  154. # replace InRelease with something else
  155. mv "$APTARCHIVE/dists/unstable/Release" "$APTARCHIVE/dists/unstable/InRelease"
  156. testfailuremsg "E: Failed to fetch file://${APTARCHIVE}/dists/unstable/InRelease Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
  157. E: The repository 'file:${APTARCHIVE} unstable InRelease' is no longer signed.
  158. N: Updating from such a repository can't be done securely, and is therefore disabled by default.
  159. N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update
  160. # ensure we keep the repo
  161. testfileequal lists.before "$(listcurrentlistsdirectory)"
  162. assert_repo_is_intact
  163. }
  164. test_inrelease_to_invalid_inrelease()
  165. {
  166. export APT_DONT_SIGN='Release.gpg'
  167. setupaptarchive_with_lists_clean
  168. testsuccess aptget update
  169. listcurrentlistsdirectory > lists.before
  170. # now remove InRelease and subvert Release do no longer verify
  171. sed -i 's/^Codename:.*/Codename: evil!/' "$APTARCHIVE/dists/unstable/InRelease"
  172. inject_evil_package
  173. testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  174. W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  175. W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  176. # ensure we keep the repo
  177. testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
  178. testfileequal lists.before "$(listcurrentlistsdirectory)"
  179. assert_repo_is_intact
  180. }
  181. test_release_gpg_to_invalid_release_release_gpg()
  182. {
  183. export APT_DONT_SIGN='InRelease'
  184. setupaptarchive_with_lists_clean
  185. testsuccess aptget update
  186. listcurrentlistsdirectory > lists.before
  187. # now subvert Release do no longer verify
  188. echo "Some evil data" >> "$APTARCHIVE/dists/unstable/Release"
  189. inject_evil_package
  190. testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  191. W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  192. W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  193. testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
  194. testfileequal lists.before "$(listcurrentlistsdirectory)"
  195. assert_repo_is_intact
  196. }
  197. TESTDIR="$(readlink -f "$(dirname "$0")")"
  198. . "$TESTDIR/framework"
  199. setupenvironment
  200. configarchitecture "i386"
  201. # a "normal" package with source and binary
  202. buildsimplenativepackage 'foo' 'all' '2.0'
  203. # setup the archive and ensure we have a single package that installs fine
  204. setupaptarchive
  205. APTARCHIVE="$(readlink -f ./aptarchive)"
  206. assert_repo_is_intact
  207. # test the various cases where a repo may go from signed->unsigned
  208. msgmsg "test_from_inrelease_to_unsigned"
  209. test_from_inrelease_to_unsigned
  210. msgmsg "test_from_release_gpg_to_unsigned"
  211. test_from_release_gpg_to_unsigned
  212. # ensure we do not regress on CVE-2012-0214
  213. msgmsg "test_cve_2012_0214"
  214. test_cve_2012_0214
  215. # ensure InRelease can not be subverted
  216. msgmsg "test_subvert_inrelease"
  217. test_subvert_inrelease
  218. # ensure we revert to last good state if InRelease does not verify
  219. msgmsg "test_inrelease_to_invalid_inrelease"
  220. test_inrelease_to_invalid_inrelease
  221. # ensure we revert to last good state if Release/Release.gpg does not verify
  222. msgmsg "test_release_gpg_to_invalid_release_release_gpg"
  223. test_release_gpg_to_invalid_release_release_gpg
  224. # ensure we can override the downgrade error
  225. msgmsg "test_from_inrelease_to_unsigned_with_override"
  226. test_from_inrelease_to_unsigned_with_override
  227. msgmsg "test_from_inrelease_to_norelease_with_override"
  228. test_from_inrelease_to_norelease_with_override