From 8e3900d0d7efc11d538b944ed1d9e4e3d5286ff6 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Sat, 18 Feb 2012 19:40:13 +0100 Subject: * apt-pkg/acquire-item.cc: - drop support for i18n/Index file (introduced in 0.8.11) and use the Release file instead to get the Translations (Closes: #649314) * ftparchive/writer.cc: - add 'Translation-*' to the default patterns i18n/Index was never used outside debian - and even here it isn't used consistently as only 'main' has such a file. As the Release file now includes the Translation-* files we therefore drop support for i18n/Index. A version supporting it was never part of a debian release and still supporting it would mean that we get 99% of the time a 404 as response to the request anyway and confuse archive maintainers who want to provide all files APT tries to acquire. --- apt-pkg/acquire-item.cc | 67 +++++++++++++++---------------------------------- 1 file changed, 20 insertions(+), 47 deletions(-) (limited to 'apt-pkg/acquire-item.cc') diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc index f231c42b4..ca40b0bd7 100644 --- a/apt-pkg/acquire-item.cc +++ b/apt-pkg/acquire-item.cc @@ -189,14 +189,14 @@ void pkgAcquire::Item::ReportMirrorFailure(string FailCode) /*}}}*/ // AcqSubIndex::AcqSubIndex - Constructor /*{{{*/ // --------------------------------------------------------------------- -/* Get the Index file first and see if there are languages available - * If so, create a pkgAcqIndexTrans for the found language(s). - */ +/* Get a sub-index file based on checksums from a 'master' file and + possibly query additional files */ pkgAcqSubIndex::pkgAcqSubIndex(pkgAcquire *Owner, string const &URI, string const &URIDesc, string const &ShortDesc, HashString const &ExpectedHash) : Item(Owner), ExpectedHash(ExpectedHash) { + /* XXX: Beware: Currently this class does nothing (of value) anymore ! */ Debug = _config->FindB("Debug::pkgAcquire::SubIndex",false); DestFile = _config->FindDir("Dir::State::lists") + "partial/"; @@ -236,17 +236,7 @@ void pkgAcqSubIndex::Failed(string Message,pkgAcquire::MethodConfig *Cnf) /*{{{* Status = StatDone; Dequeue(); - // No good Index is provided, so try guessing - std::vector langs = APT::Configuration::getLanguages(true); - for (std::vector::const_iterator l = langs.begin(); - l != langs.end(); ++l) - { - if (*l == "none") continue; - string const file = "Translation-" + *l; - new pkgAcqIndexTrans(Owner, Desc.URI.substr(0, Desc.URI.rfind('/')+1).append(file), - Desc.Description.erase(Desc.Description.rfind(' ')+1).append(file), - file); - } + // No good Index is provided } /*}}}*/ void pkgAcqSubIndex::Done(string Message,unsigned long long Size,string Md5Hash, /*{{{*/ @@ -305,38 +295,7 @@ bool pkgAcqSubIndex::ParseIndex(string const &IndexFile) /*{{{*/ indexRecords SubIndexParser; if (FileExists(IndexFile) == false || SubIndexParser.Load(IndexFile) == false) return false; - - std::vector lang = APT::Configuration::getLanguages(true); - for (std::vector::const_iterator l = lang.begin(); - l != lang.end(); ++l) - { - if (*l == "none") - continue; - - string file = "Translation-" + *l; - indexRecords::checkSum const *Record = SubIndexParser.Lookup(file); - HashString expected; - if (Record == NULL) - { - // FIXME: the Index file provided by debian currently only includes bz2 records - Record = SubIndexParser.Lookup(file + ".bz2"); - if (Record == NULL) - continue; - } - else - { - expected = Record->Hash; - if (expected.empty() == true) - continue; - } - - IndexTarget target; - target.Description = Desc.Description.erase(Desc.Description.rfind(' ')+1).append(file); - target.MetaKey = file; - target.ShortDesc = file; - target.URI = Desc.URI.substr(0, Desc.URI.rfind('/')+1).append(file); - new pkgAcqIndexTrans(Owner, &target, expected, &SubIndexParser); - } + // so something with the downloaded index return true; } /*}}}*/ @@ -1385,6 +1344,18 @@ void pkgAcqMetaIndex::QueueIndexes(bool verify) /*{{{*/ return; } #endif + bool transInRelease = false; + { + std::vector const keys = MetaIndexParser->MetaKeys(); + for (std::vector::const_iterator k = keys.begin(); k != keys.end(); ++k) + // FIXME: Feels wrong to check for hardcoded string here, but what should we do else… + if (k->find("Translation-") != std::string::npos) + { + transInRelease = true; + break; + } + } + for (vector ::const_iterator Target = IndexTargets->begin(); Target != IndexTargets->end(); ++Target) @@ -1422,8 +1393,10 @@ void pkgAcqMetaIndex::QueueIndexes(bool verify) /*{{{*/ if ((*Target)->IsSubIndex() == true) new pkgAcqSubIndex(Owner, (*Target)->URI, (*Target)->Description, (*Target)->ShortDesc, ExpectedIndexHash); - else + else if (transInRelease == false || MetaIndexParser->Exists((*Target)->MetaKey) == true) + { new pkgAcqIndexTrans(Owner, *Target, ExpectedIndexHash, MetaIndexParser); + } continue; } -- cgit v1.2.3 From f55602cb0cd7403206752479b2ec11c6367e2f6d Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Sat, 18 Feb 2012 19:48:04 +0100 Subject: use pdiff for Translation-* files if available (Closes: #657902) Beware: pdiffs for Translation-* are only acquired if their availability is advertised in the Release file. --- apt-pkg/acquire-item.cc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'apt-pkg/acquire-item.cc') diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc index ca40b0bd7..4e6fb7ff9 100644 --- a/apt-pkg/acquire-item.cc +++ b/apt-pkg/acquire-item.cc @@ -1395,7 +1395,12 @@ void pkgAcqMetaIndex::QueueIndexes(bool verify) /*{{{*/ (*Target)->ShortDesc, ExpectedIndexHash); else if (transInRelease == false || MetaIndexParser->Exists((*Target)->MetaKey) == true) { - new pkgAcqIndexTrans(Owner, *Target, ExpectedIndexHash, MetaIndexParser); + if (_config->FindB("Acquire::PDiffs",true) == true && transInRelease == true && + MetaIndexParser->Exists(string((*Target)->MetaKey).append(".diff/Index")) == true) + new pkgAcqDiffIndex(Owner, (*Target)->URI, (*Target)->Description, + (*Target)->ShortDesc, ExpectedIndexHash); + else + new pkgAcqIndexTrans(Owner, *Target, ExpectedIndexHash, MetaIndexParser); } continue; } -- cgit v1.2.3 From de498a528cd6fc36c4bb22bf8dec6558e21cc9b6 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Sun, 4 Mar 2012 22:50:21 +0100 Subject: * apt-pkg/acquire-item.cc: - remove 'old' InRelease file if we can't get a new one before proceeding with Release.gpg to avoid the false impression of a still trusted repository by a (still present) old InRelease file. Thanks to Simon Ruderich for reporting this issue! (CVE-2012-0214) Effected are all versions >= 0.8.11 Possible attack summary: - Attacker needs to find a user which has run at least one successful 'apt-get update' against an archive providing InRelease files. - Create a Packages file with his preferred content. - Attacker then prevents the download of InRelease, Release and Release.gpg (alternatively he creates a valid Release file and sends this, the other two files need to be missing either way). - User updates against this, getting the modified Packages file without any indication of being unsigned (beside the "Ign InRelease" and "Ign Release.gpg" in the output of 'apt-get update'). => deb files from this source are considered 'trusted' (and therefore the user isn't asked for an additional confirmation before install) --- apt-pkg/acquire-item.cc | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'apt-pkg/acquire-item.cc') diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc index 4e6fb7ff9..545a57d37 100644 --- a/apt-pkg/acquire-item.cc +++ b/apt-pkg/acquire-item.cc @@ -1598,6 +1598,13 @@ void pkgAcqMetaClearSig::Failed(string Message,pkgAcquire::MethodConfig *Cnf) /* { if (AuthPass == false) { + // Remove the 'old' InRelease file if we try Release.gpg now as otherwise + // the file will stay around and gives a false-auth impression (CVE-2012-0214) + string FinalFile = _config->FindDir("Dir::State::lists"); + FinalFile.append(URItoFileName(RealURI)); + if (FileExists(FinalFile)) + unlink(FinalFile.c_str()); + new pkgAcqMetaSig(Owner, MetaSigURI, MetaSigURIDesc, MetaSigShortDesc, MetaIndexURI, MetaIndexURIDesc, MetaIndexShortDesc, -- cgit v1.2.3 From de31189fca11b7de937a64de90bcc050b76f9181 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Tue, 6 Mar 2012 17:58:16 +0100 Subject: add Debug::pkgAcqArchive::NoQueue to disable package downloading --- apt-pkg/acquire-item.cc | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'apt-pkg/acquire-item.cc') diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc index 545a57d37..a30e98858 100644 --- a/apt-pkg/acquire-item.cc +++ b/apt-pkg/acquire-item.cc @@ -1810,7 +1810,18 @@ bool pkgAcqArchive::QueueNext() else PartialSize = Buf.st_size; } - + + // Disables download of archives - useful if no real installation follows, + // e.g. if we are just interested in proposed installation order + if (_config->FindB("Debug::pkgAcqArchive::NoQueue", false) == true) + { + Complete = true; + Local = true; + Status = StatDone; + StoreFilename = DestFile = FinalFile; + return true; + } + // Create the item Local = false; Desc.URI = Index->ArchiveURI(PkgFile); -- cgit v1.2.3