You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

250 lines
8.4 KiB

  1. #!/bin/sh
  2. #
  3. # ensure we never fallback from a signed to a unsigned repo
  4. #
  5. # hash checks are done in
  6. #
  7. set -e
  8. simulate_mitm_and_inject_evil_package()
  9. {
  10. redatereleasefiles '+1 hour'
  11. rm -f $APTARCHIVE/dists/unstable/InRelease
  12. rm -f $APTARCHIVE/dists/unstable/Release.gpg
  13. inject_evil_package
  14. }
  15. inject_evil_package()
  16. {
  17. cat > $APTARCHIVE/dists/unstable/main/binary-i386/Packages <<EOF
  18. Package: evil
  19. Installed-Size: 29
  20. Maintainer: Joe Sixpack <joe@example.org>
  21. Architecture: all
  22. Version: 1.0
  23. Filename: pool/evil_1.0_all.deb
  24. Size: 1270
  25. Description: an autogenerated evil package
  26. EOF
  27. # avoid ims hit
  28. touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
  29. compressfile aptarchive/dists/unstable/main/binary-i386/Packages
  30. }
  31. assert_update_is_refused_and_last_good_state_used()
  32. {
  33. testfailuremsg "E: The repository 'file: unstable Release' is no longer signed." aptget update
  34. assert_repo_is_intact
  35. }
  36. assert_repo_is_intact()
  37. {
  38. testsuccessequal "foo/unstable 2.0 all" apt list -q
  39. testsuccess aptget install -y -s foo
  40. testfailure aptget install -y evil
  41. testsuccess aptget source foo --print-uris
  42. LISTDIR=rootdir/var/lib/apt/lists
  43. if ! ( ls $LISTDIR/*InRelease >/dev/null 2>&1 ||
  44. ls $LISTDIR/*Release.gpg >/dev/null 2>&1 ); then
  45. echo "Can not find InRelease/Release.gpg in $(ls $LISTDIR)"
  46. msgfail
  47. fi
  48. }
  49. setupaptarchive_with_lists_clean()
  50. {
  51. setupaptarchive --no-update
  52. rm -rf rootdir/var/lib/apt/lists
  53. }
  54. test_from_inrelease_to_unsigned()
  55. {
  56. # setup archive with InRelease file
  57. setupaptarchive_with_lists_clean
  58. testsuccess aptget update
  59. listcurrentlistsdirectory > lists.before
  60. simulate_mitm_and_inject_evil_package
  61. assert_update_is_refused_and_last_good_state_used
  62. testfileequal lists.before "$(listcurrentlistsdirectory)"
  63. }
  64. test_from_release_gpg_to_unsigned()
  65. {
  66. # setup archive with Release/Release.gpg (but no InRelease)
  67. setupaptarchive_with_lists_clean
  68. rm $APTARCHIVE/dists/unstable/InRelease
  69. testsuccess aptget update
  70. listcurrentlistsdirectory > lists.before
  71. simulate_mitm_and_inject_evil_package
  72. assert_update_is_refused_and_last_good_state_used
  73. testfileequal lists.before "$(listcurrentlistsdirectory)"
  74. }
  75. test_from_inrelease_to_unsigned_with_override()
  76. {
  77. # setup archive with InRelease file
  78. setupaptarchive_with_lists_clean
  79. testsuccess aptget update
  80. # simulate moving to a unsigned but otherwise valid repo
  81. simulate_mitm_and_inject_evil_package
  82. generatereleasefiles '+2 hours'
  83. find $APTARCHIVE -name '*Packages*' -exec touch -d '+2 hours' {} \;
  84. # and ensure we can update to it (with enough force)
  85. testwarning aptget update --allow-insecure-repositories \
  86. -o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
  87. # but that the individual packages are still considered untrusted
  88. testfailureequal "WARNING: The following packages cannot be authenticated!
  89. evil
  90. E: There are problems and -y was used without --force-yes" aptget install -qq -y evil
  91. }
  92. test_cve_2012_0214()
  93. {
  94. # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
  95. #
  96. # it was possible to MITM the download so that InRelease/Release.gpg
  97. # are not delivered (404) and a altered Release file was send
  98. #
  99. # apt left the old InRelease file in /var/lib/apt/lists and downloaded
  100. # the unauthenticated Release file too giving the false impression that
  101. # Release was authenticated
  102. #
  103. # Note that this is pretty much impossible nowdays because:
  104. # a) InRelease is left as is, not split to InRelease/Release as it was
  105. # in the old days
  106. # b) we refuse to go from signed->unsigned
  107. #
  108. # Still worth having a regression test the simulates the condition
  109. # setup archive with InRelease
  110. setupaptarchive_with_lists_clean
  111. testsuccess aptget update
  112. listcurrentlistsdirectory > lists.before
  113. # do what CVE-2012-0214 did
  114. rm $APTARCHIVE/dists/unstable/InRelease
  115. rm $APTARCHIVE/dists/unstable/Release.gpg
  116. inject_evil_package
  117. # build valid Release file
  118. aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
  119. assert_update_is_refused_and_last_good_state_used
  120. testfileequal lists.before "$(listcurrentlistsdirectory)"
  121. # ensure there is no _Release file downloaded
  122. testfailure ls rootdir/var/lib/apt/lists/*_Release
  123. }
  124. test_subvert_inrelease()
  125. {
  126. # setup archive with InRelease
  127. setupaptarchive_with_lists_clean
  128. testsuccess aptget update
  129. listcurrentlistsdirectory > lists.before
  130. # replace InRelease with something else
  131. mv $APTARCHIVE/dists/unstable/Release $APTARCHIVE/dists/unstable/InRelease
  132. testfailureequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease Does not start with a cleartext signature
  133. E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  134. # ensure we keep the repo
  135. testfileequal lists.before "$(listcurrentlistsdirectory)"
  136. assert_repo_is_intact
  137. }
  138. test_inrelease_to_invalid_inrelease()
  139. {
  140. # setup archive with InRelease
  141. setupaptarchive_with_lists_clean
  142. testsuccess aptget update
  143. listcurrentlistsdirectory > lists.before
  144. # now remove InRelease and subvert Release do no longer verify
  145. sed -i 's/^Codename:.*/Codename: evil!/' $APTARCHIVE/dists/unstable/InRelease
  146. inject_evil_package
  147. testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  148. W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  149. W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  150. # ensure we keep the repo
  151. testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
  152. testfileequal lists.before "$(listcurrentlistsdirectory)"
  153. assert_repo_is_intact
  154. }
  155. test_release_gpg_to_invalid_release_release_gpg()
  156. {
  157. # setup archive with InRelease
  158. setupaptarchive_with_lists_clean
  159. rm $APTARCHIVE/dists/unstable/InRelease
  160. testsuccess aptget update
  161. listcurrentlistsdirectory > lists.before
  162. # now subvert Release do no longer verify
  163. echo "Some evil data" >> $APTARCHIVE/dists/unstable/Release
  164. inject_evil_package
  165. testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  166. W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
  167. W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  168. testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
  169. testfileequal lists.before "$(listcurrentlistsdirectory)"
  170. assert_repo_is_intact
  171. }
  172. TESTDIR=$(readlink -f $(dirname $0))
  173. . $TESTDIR/framework
  174. setupenvironment
  175. configarchitecture "i386"
  176. # a "normal" package with source and binary
  177. buildsimplenativepackage 'foo' 'all' '2.0'
  178. # setup the archive and ensure we have a single package that installs fine
  179. setupaptarchive
  180. APTARCHIVE=$(readlink -f ./aptarchive)
  181. assert_repo_is_intact
  182. # test the various cases where a repo may go from signed->unsigned
  183. msgmsg "test_from_inrelease_to_unsigned"
  184. test_from_inrelease_to_unsigned
  185. msgmsg "test_from_release_gpg_to_unsigned"
  186. test_from_release_gpg_to_unsigned
  187. # ensure we do not regress on CVE-2012-0214
  188. msgmsg "test_cve_2012_0214"
  189. test_cve_2012_0214
  190. # ensure InRelase can not be subverted
  191. msgmsg "test_subvert_inrelease"
  192. test_subvert_inrelease
  193. # ensure we revert to last good state if InRelease does not verify
  194. msgmsg "test_inrelease_to_invalid_inrelease"
  195. test_inrelease_to_invalid_inrelease
  196. # ensure we revert to last good state if Release/Release.gpg does not verify
  197. msgmsg "test_release_gpg_to_invalid_release_release_gpg"
  198. test_release_gpg_to_invalid_release_release_gpg
  199. # ensure we can override the downgrade error
  200. msgmsg "test_from_inrelease_to_unsigned_with_override"
  201. test_from_inrelease_to_unsigned_with_override