You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

243 lines
8.6 KiB

  1. #!/bin/sh
  2. #
  3. # ensure we never fallback from a signed to a unsigned repo
  4. #
  5. # hash checks are done in
  6. #
  7. set -e
  8. simulate_mitm_and_inject_evil_package()
  9. {
  10. redatereleasefiles '+1 hour'
  11. rm -f "$APTARCHIVE/dists/unstable/InRelease"
  12. rm -f "$APTARCHIVE/dists/unstable/Release.gpg"
  13. inject_evil_package
  14. }
  15. inject_evil_package()
  16. {
  17. cat > "$APTARCHIVE/dists/unstable/main/binary-i386/Packages" <<EOF
  18. Package: evil
  19. Installed-Size: 29
  20. Maintainer: Joe Sixpack <joe@example.org>
  21. Architecture: all
  22. Version: 1.0
  23. Filename: pool/evil_1.0_all.deb
  24. Size: 1270
  25. Description: an autogenerated evil package
  26. EOF
  27. # avoid ims hit
  28. touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
  29. compressfile aptarchive/dists/unstable/main/binary-i386/Packages
  30. }
  31. assert_update_is_refused_and_last_good_state_used()
  32. {
  33. testfailuremsg "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed.
  34. N: Updating from such a repository can't be done securely, and is therefore disabled by default.
  35. N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update
  36. assert_repo_is_intact
  37. }
  38. assert_repo_is_intact()
  39. {
  40. testsuccessequal "foo/unstable 2.0 all" apt list -qq
  41. testsuccess aptget install -y -s foo
  42. testfailure aptget install -y evil
  43. testsuccess aptget source foo --print-uris
  44. LISTDIR=rootdir/var/lib/apt/lists
  45. testempty find "$LISTDIR" -name 'InRelease' -o -name 'Release.gpg'
  46. }
  47. setupaptarchive_with_lists_clean()
  48. {
  49. setupaptarchive --no-update
  50. rm -rf rootdir/var/lib/apt/lists
  51. }
  52. test_from_inrelease_to_unsigned()
  53. {
  54. # setup archive with InRelease file
  55. setupaptarchive_with_lists_clean
  56. testsuccess aptget update
  57. listcurrentlistsdirectory > lists.before
  58. simulate_mitm_and_inject_evil_package
  59. assert_update_is_refused_and_last_good_state_used
  60. testfileequal lists.before "$(listcurrentlistsdirectory)"
  61. }
  62. test_from_release_gpg_to_unsigned()
  63. {
  64. # setup archive with Release/Release.gpg (but no InRelease)
  65. setupaptarchive_with_lists_clean
  66. rm "$APTARCHIVE/dists/unstable/InRelease"
  67. testsuccess aptget update
  68. listcurrentlistsdirectory > lists.before
  69. simulate_mitm_and_inject_evil_package
  70. assert_update_is_refused_and_last_good_state_used
  71. testfileequal lists.before "$(listcurrentlistsdirectory)"
  72. }
  73. test_from_inrelease_to_unsigned_with_override()
  74. {
  75. # setup archive with InRelease file
  76. setupaptarchive_with_lists_clean
  77. testsuccess aptget update
  78. # simulate moving to a unsigned but otherwise valid repo
  79. simulate_mitm_and_inject_evil_package
  80. generatereleasefiles '+2 hours'
  81. find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;
  82. # and ensure we can update to it (with enough force)
  83. testwarning aptget update --allow-insecure-repositories \
  84. -o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
  85. # but that the individual packages are still considered untrusted
  86. testfailureequal "WARNING: The following packages cannot be authenticated!
  87. evil
  88. E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
  89. }
  90. test_cve_2012_0214()
  91. {
  92. # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
  93. #
  94. # it was possible to MITM the download so that InRelease/Release.gpg
  95. # are not delivered (404) and a altered Release file was send
  96. #
  97. # apt left the old InRelease file in /var/lib/apt/lists and downloaded
  98. # the unauthenticated Release file too giving the false impression that
  99. # Release was authenticated
  100. #
  101. # Note that this is pretty much impossible nowadays because:
  102. # a) InRelease is left as is, not split to InRelease/Release as it was
  103. # in the old days
  104. # b) we refuse to go from signed->unsigned
  105. #
  106. # Still worth having a regression test the simulates the condition
  107. # setup archive with InRelease
  108. setupaptarchive_with_lists_clean
  109. testsuccess aptget update
  110. listcurrentlistsdirectory > lists.before
  111. # do what CVE-2012-0214 did
  112. rm "$APTARCHIVE/dists/unstable/InRelease"
  113. rm "$APTARCHIVE/dists/unstable/Release.gpg"
  114. inject_evil_package
  115. # build valid Release file
  116. aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
  117. assert_update_is_refused_and_last_good_state_used
  118. testfileequal lists.before "$(listcurrentlistsdirectory)"
  119. # ensure there is no _Release file downloaded
  120. testfailure ls rootdir/var/lib/apt/lists/*_Release
  121. }
  122. test_subvert_inrelease()
  123. {
  124. # setup archive with InRelease
  125. setupaptarchive_with_lists_clean
  126. testsuccess aptget update
  127. listcurrentlistsdirectory > lists.before
  128. # replace InRelease with something else
  129. mv "$APTARCHIVE/dists/unstable/Release" "$APTARCHIVE/dists/unstable/InRelease"
  130. testfailuremsg "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
  131. E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update
  132. # ensure we keep the repo
  133. testfileequal lists.before "$(listcurrentlistsdirectory)"
  134. assert_repo_is_intact
  135. }
  136. test_inrelease_to_invalid_inrelease()
  137. {
  138. # setup archive with InRelease
  139. setupaptarchive_with_lists_clean
  140. testsuccess aptget update
  141. listcurrentlistsdirectory > lists.before
  142. # now remove InRelease and subvert Release do no longer verify
  143. sed -i 's/^Codename:.*/Codename: evil!/' "$APTARCHIVE/dists/unstable/InRelease"
  144. inject_evil_package
  145. testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  146. W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  147. W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  148. # ensure we keep the repo
  149. testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
  150. testfileequal lists.before "$(listcurrentlistsdirectory)"
  151. assert_repo_is_intact
  152. }
  153. test_release_gpg_to_invalid_release_release_gpg()
  154. {
  155. # setup archive with InRelease
  156. setupaptarchive_with_lists_clean
  157. rm "$APTARCHIVE/dists/unstable/InRelease"
  158. testsuccess aptget update
  159. listcurrentlistsdirectory > lists.before
  160. # now subvert Release do no longer verify
  161. echo "Some evil data" >> "$APTARCHIVE/dists/unstable/Release"
  162. inject_evil_package
  163. testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  164. W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  165. W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  166. testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
  167. testfileequal lists.before "$(listcurrentlistsdirectory)"
  168. assert_repo_is_intact
  169. }
  170. TESTDIR="$(readlink -f "$(dirname "$0")")"
  171. . "$TESTDIR/framework"
  172. setupenvironment
  173. configarchitecture "i386"
  174. # a "normal" package with source and binary
  175. buildsimplenativepackage 'foo' 'all' '2.0'
  176. # setup the archive and ensure we have a single package that installs fine
  177. setupaptarchive
  178. APTARCHIVE="$(readlink -f ./aptarchive)"
  179. assert_repo_is_intact
  180. # test the various cases where a repo may go from signed->unsigned
  181. msgmsg "test_from_inrelease_to_unsigned"
  182. test_from_inrelease_to_unsigned
  183. msgmsg "test_from_release_gpg_to_unsigned"
  184. test_from_release_gpg_to_unsigned
  185. # ensure we do not regress on CVE-2012-0214
  186. msgmsg "test_cve_2012_0214"
  187. test_cve_2012_0214
  188. # ensure InRelase can not be subverted
  189. msgmsg "test_subvert_inrelease"
  190. test_subvert_inrelease
  191. # ensure we revert to last good state if InRelease does not verify
  192. msgmsg "test_inrelease_to_invalid_inrelease"
  193. test_inrelease_to_invalid_inrelease
  194. # ensure we revert to last good state if Release/Release.gpg does not verify
  195. msgmsg "test_release_gpg_to_invalid_release_release_gpg"
  196. test_release_gpg_to_invalid_release_release_gpg
  197. # ensure we can override the downgrade error
  198. msgmsg "test_from_inrelease_to_unsigned_with_override"
  199. test_from_inrelease_to_unsigned_with_override