blob: 4e8ea99166e0dc31f569d22fc1fae7da63db8ca9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
#!/bin/sh
#
# ensure we never fallback from a signed to a unsigned repo
#
# hash checks are done in
#
set -e
simulate_mitm_and_inject_evil_package()
{
rm -f $APTARCHIVE/dists/unstable/InRelease
rm -f $APTARCHIVE/dists/unstable/Release.gpg
inject_evil_package
}
inject_evil_package()
{
cat > $APTARCHIVE/dists/unstable/main/binary-i386/Packages <<EOF
Package: evil
Installed-Size: 29
Maintainer: Joe Sixpack <joe@example.org>
Architecture: all
Version: 1.0
Filename: pool/evil_1.0_all.deb
Size: 1270
Description: an autogenerated evil package
EOF
# avoid ims hit
touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
}
assert_update_is_refused_and_last_good_state_used()
{
testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
assert_repo_is_intact
}
assert_repo_is_intact()
{
testequal "foo/unstable 2.0 all" apt list -q
testsuccess "" aptget install -y -s foo
testfailure "" aptget install -y evil
LISTDIR=rootdir/var/lib/apt/lists
if ! ( ls $LISTDIR/*InRelease >/dev/null 2>&1 ||
ls $LISTDIR/*Release.gpg >/dev/null 2>&1 ); then
echo "Can not find InRelease/Release.gpg in $(ls $LISTDIR)"
msgfail
fi
}
setupaptarchive_with_lists_clean()
{
setupaptarchive --no-update
rm -f rootdir/var/lib/apt/lists/_*
#rm -rf rootdir/var/lib/apt/lists
}
test_from_inrelease_to_unsigned()
{
# setup archive with InRelease file
setupaptarchive_with_lists_clean
testsuccess aptget update
simulate_mitm_and_inject_evil_package
assert_update_is_refused_and_last_good_state_used
}
test_from_release_gpg_to_unsigned()
{
# setup archive with Release/Release.gpg (but no InRelease)
setupaptarchive_with_lists_clean
rm $APTARCHIVE/dists/unstable/InRelease
testsuccess aptget update
simulate_mitm_and_inject_evil_package
assert_update_is_refused_and_last_good_state_used
}
test_cve_2012_0214()
{
# see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
#
# it was possible to MITM the download so that InRelease/Release.gpg
# are not delivered (404) and a altered Release file was send
#
# apt left the old InRelease file in /var/lib/apt/lists and downloaded
# the unauthenticated Release file too giving the false impression that
# Release was authenticated
#
# Note that this is pretty much impossible nowdays because:
# a) InRelease is left as is, not split to InRelease/Release as it was
# in the old days
# b) we refuse to go from signed->unsigned
#
# Still worth having a regression test the simulates the condition
# setup archive with InRelease
setupaptarchive_with_lists_clean
testsuccess aptget update
# do what CVE-2012-0214 did
rm $APTARCHIVE/dists/unstable/InRelease
rm $APTARCHIVE/dists/unstable/Release.gpg
inject_evil_package
# build valid Release file
aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
assert_update_is_refused_and_last_good_state_used
# ensure there is no _Release file downloaded
testfailure ls rootdir/var/lib/apt/lists/*_Release
}
test_subvert_inrelease()
{
# setup archive with InRelease
setupaptarchive_with_lists_clean
testsuccess aptget update
# replace InRelease with something else
mv $APTARCHIVE/dists/unstable/Release $APTARCHIVE/dists/unstable/InRelease
testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease Does not start with a cleartext signature
E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
# ensure we keep the repo
assert_repo_is_intact
}
test_inrelease_to_invalid_inrelease()
{
# setup archive with InRelease
setupaptarchive_with_lists_clean
testsuccess aptget update
# now remove InRelease and subvert Release do no longer verify
sed -i 's/Codename.*/Codename: evil!'/ $APTARCHIVE/dists/unstable/InRelease
inject_evil_package
testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease
W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
# ensure we keep the repo
assert_repo_is_intact
testfailure grep "evil" rootdir/var/lib/apt/lists/*InRelease
}
test_release_gpg_to_invalid_release_release_gpg()
{
# setup archive with InRelease
setupaptarchive_with_lists_clean
rm $APTARCHIVE/dists/unstable/InRelease
testsuccess aptget update
# now subvert Release do no longer verify
echo "Some evil data" >> $APTARCHIVE/dists/unstable/Release
inject_evil_package
testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
assert_repo_is_intact
testfailure grep "evil" rootdir/var/lib/apt/lists/*Release
}
TESTDIR=$(readlink -f $(dirname $0))
. $TESTDIR/framework
setupenvironment
configarchitecture "i386"
# a "normal" package with source and binary
buildsimplenativepackage 'foo' 'all' '2.0'
# setup the archive and ensure we have a single package that installs fine
setupaptarchive
APTARCHIVE=$(readlink -f ./aptarchive)
assert_repo_is_intact
# test the various cases where a repo may go from signed->unsigned
msgmsg "test_from_inrelease_to_unsigned"
test_from_inrelease_to_unsigned
msgmsg "test_from_release_gpg_to_unsigned"
test_from_release_gpg_to_unsigned
# ensure we do not regress on CVE-2012-0214
msgmsg "test_cve_2012_0214"
test_cve_2012_0214
# ensure InRelase can not be subverted
msgmsg "test_subvert_inrelease"
test_subvert_inrelease
# ensure we revert to last good state if InRelease does not verify
msgmsg "test_inrelease_to_invalid_inrelease"
test_inrelease_to_invalid_inrelease
# ensure we revert to last good state if Release/Release.gpg does not verify
msgmsg "test_release_gpg_to_invalid_release_release_gpg"
test_release_gpg_to_invalid_release_release_gpg
|
