From 93f33052de84e9aeaf19c92291d043dad2665bbd Mon Sep 17 00:00:00 2001 From: Julian Andres Klode Date: Mon, 2 Dec 2019 11:46:49 +0100 Subject: netrc: Restrict auth.conf entries to https by default This avoids downgrade attacks where an attacker could inject Location: http://private.example/ and then (having access to raw data to private.example, for example, by opening a port there, or sniffing network traffic) read the credentials for the private repository. Closes: #945911 --- apt-pkg/contrib/netrc.cc | 22 +++++++++++++++- debian/NEWS | 10 +++++++ doc/apt_auth.conf.5.xml | 14 ++++++---- test/integration/test-authentication-basic | 42 +++++++++++++++++++++++------- 4 files changed, 73 insertions(+), 15 deletions(-) diff --git a/apt-pkg/contrib/netrc.cc b/apt-pkg/contrib/netrc.cc index ee1996f8d..2069a0394 100644 --- a/apt-pkg/contrib/netrc.cc +++ b/apt-pkg/contrib/netrc.cc @@ -72,6 +72,26 @@ bool MaybeAddAuth(FileFd &NetRCFile, URI &Uri) active_token = MACHINE; break; case MACHINE: + // If token contains a protocol: Check it first, and strip it away if + // it matches. If it does not match, ignore this stanza. + // If there is no protocol, only allow https protocols. + if (token.find("://") != std::string::npos) + { + if (not APT::String::Startswith(token, Uri.Access + "://")) + { + active_token = NO; + break; + } + token.erase(0, Uri.Access.length() + 3); + } + else if (Uri.Access != "https" && Uri.Access != "tor+https") + { + if (Debug) + std::clog << "MaybeAddAuth: Rejecting matching host adding '" << Uri.User << "' and '" << Uri.Password << "' for " + << (std::string)Uri << " from " << NetRCFile.Name() << "as the protocol is not https" << std::endl; + active_token = NO; + break; + } if (token.find('/') == std::string::npos) { if (Uri.Port != 0 && Uri.Host == token) @@ -168,7 +188,7 @@ bool IsAuthorized(pkgCache::PkgFileIterator const I, std::vectorIsOpen()) diff --git a/debian/NEWS b/debian/NEWS index e8cb4e279..555791602 100644 --- a/debian/NEWS +++ b/debian/NEWS @@ -1,3 +1,13 @@ +apt (1.9.5) UNRELEASED; urgency=medium + + Credentials in apt_auth.conf(5) now only apply to https and tor+https + sources to avoid them being leaked over plaintext (Closes: #945911). To + opt-in to http, add http:// before the hostname. Note that this will transmit + credentials in plain text, which you do not want on devices that could be + operating in an untrusted network. + + -- Julian Andres Klode Mon, 02 Dec 2019 11:45:52 +0100 + apt (1.8.0~alpha3) unstable; urgency=medium The PATH for running dpkg is now configured by the option DPkg::Path, diff --git a/doc/apt_auth.conf.5.xml b/doc/apt_auth.conf.5.xml index e7961ef81..99394be00 100644 --- a/doc/apt_auth.conf.5.xml +++ b/doc/apt_auth.conf.5.xml @@ -50,7 +50,7 @@ Unknown tokens will be ignored. Tokens may be separated by spaces, tabs or newli -machine hostname[:port][/path] +machine [protocol://]hostname[:port][/path] Entries are looked up by searching for the machine token matching the hostname of the URI apt needs login information for. Extending the netrc-format @@ -60,7 +60,8 @@ different login information reside on the same server. A machine token with a pa matches if the path in the URI starts with the path given in the token. Once a match is made, the subsequent tokens are processed, stopping when the end of file is reached or another machine -token is encountered. +token is encountered. +If protocol is not specified, the entry only matches https and tor+https. @@ -80,9 +81,9 @@ token is encountered. Example Supplying login information for a user named apt with the password debian for the &sources-list; entry -deb http://example.org/debian &debian-stable-codename; main +deb https://example.org/debian &debian-stable-codename; main could be done in the entry directly: -deb http://apt:debian@example.org/debian &debian-stable-codename; main +deb https://apt:debian@example.org/debian &debian-stable-codename; main Alternatively an entry like the following in the auth.conf file could be used: machine example.org login apt @@ -95,7 +96,7 @@ machine example.org/debian login apt password debian machine example.org/debian/ login apt password debian On the other hand neither of the following lines apply: -machine example.org:80 login apt password debian +machine example.org:443 login apt password debian machine example.org/deb/ login apt password debian machine example.org/ubuntu login apt password debian machine example.orga login apt password debian @@ -111,6 +112,9 @@ also the implementation slightly. For maximum backward compatibility you should avoid multiple machine tokens with the same hostname, but if you need multiple they should all have a path specified in the machine token. +Login information in auth.conf are more flexible than those in sources.list. For +example, login information can be specified for parts of a repository only, or if the +sources.list entry redirects elsewhere, login information for the redirect destination can be supplied. diff --git a/test/integration/test-authentication-basic b/test/integration/test-authentication-basic index 211c73e35..5aafaade0 100755 --- a/test/integration/test-authentication-basic +++ b/test/integration/test-authentication-basic @@ -65,35 +65,59 @@ runtest() { authfile '' testauthfailure "$1" + protocol="${1%%://*}" + # good auth - authfile 'machine localhost + authfile "machine ${protocol}://localhost login star@irc -password hunter2' +password hunter2" testauthsuccess "$1" # bad auth - authfile 'machine localhost + authfile "machine ${protocol}://localhost login anonymous -password hunter2' +password hunter2" testauthfailure "$1" # 2 stanzas: unmatching + good auth - authfile 'machine debian.org + authfile "machine ${protocol}://debian.org login debian password jessie -machine localhost +machine ${protocol}://localhost login star@irc -password hunter2' +password hunter2" testauthsuccess "$1" + # no protocol specifier + authfile "machine localhost +login star@irc +password hunter2" + if [ "$protocol" = "https" ]; then + testauthsuccess "$1" + else + testauthfailure "$1" + fi + + # wrong protocol specifier + if [ "$protocol" = "https" ]; then + authfile "machine http://localhost +login star@irc +password hunter2" + else + authfile "machine https://localhost +login star@irc +password hunter2" + fi + testauthfailure "$1" + # delete file, make sure it fails; add auth.conf.d snippet, works again. rm rootdir/etc/apt/auth.conf testauthfailure "$1" - authfile 'machine localhost + authfile "machine ${protocol}://localhost login star@irc -password hunter2' rootdir/etc/apt/auth.conf.d/myauth.conf +password hunter2" rootdir/etc/apt/auth.conf.d/myauth.conf testauthsuccess "$1" rm rootdir/etc/apt/auth.conf.d/myauth.conf } -- cgit v1.2.3