]> git.saurik.com Git - apt.git/blame - test/integration/test-apt-update-nofallback
apt-key: warn instead of fail on unreadable keyrings
[apt.git] / test / integration / test-apt-update-nofallback
CommitLineData
631a7dc7
MV
1#!/bin/sh
2#
3# ensure we never fallback from a signed to a unsigned repo
4#
5# hash checks are done in
6#
7set -e
8
9simulate_mitm_and_inject_evil_package()
10{
6bf93605 11 redatereleasefiles '+1 hour'
761a5ad2 12 rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
631a7dc7
MV
13 inject_evil_package
14}
15
16inject_evil_package()
17{
63c71412 18 cat > "$APTARCHIVE/dists/unstable/main/binary-i386/Packages" <<EOF
631a7dc7
MV
19Package: evil
20Installed-Size: 29
21Maintainer: Joe Sixpack <joe@example.org>
22Architecture: all
23Version: 1.0
24Filename: pool/evil_1.0_all.deb
25Size: 1270
26Description: an autogenerated evil package
27EOF
28 # avoid ims hit
29 touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
448c38bd 30 compressfile aptarchive/dists/unstable/main/binary-i386/Packages
631a7dc7
MV
31}
32
33assert_update_is_refused_and_last_good_state_used()
34{
002b1bc4 35 testfailuremsg "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed.
83960341 36N: Updating from such a repository can't be done securely, and is therefore disabled by default.
87d6947d 37N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update
631a7dc7
MV
38
39 assert_repo_is_intact
40}
41
42assert_repo_is_intact()
43{
2b0660b5 44 testsuccessequal "foo/unstable 2.0 all" apt list -qq
846bc058
DK
45 testsuccess aptget install -y -s foo
46 testfailure aptget install -y evil
47 testsuccess aptget source foo --print-uris
631a7dc7
MV
48
49 LISTDIR=rootdir/var/lib/apt/lists
63c71412 50 testempty find "$LISTDIR" -name 'InRelease' -o -name 'Release.gpg'
631a7dc7
MV
51}
52
53setupaptarchive_with_lists_clean()
54{
55 setupaptarchive --no-update
4fa34122 56 rm -rf rootdir/var/lib/apt/lists
631a7dc7
MV
57}
58
59test_from_inrelease_to_unsigned()
60{
5a23c56d 61 export APT_DONT_SIGN='Release.gpg'
631a7dc7
MV
62 setupaptarchive_with_lists_clean
63 testsuccess aptget update
846bc058 64 listcurrentlistsdirectory > lists.before
631a7dc7
MV
65
66 simulate_mitm_and_inject_evil_package
67 assert_update_is_refused_and_last_good_state_used
846bc058 68 testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7
MV
69}
70
71test_from_release_gpg_to_unsigned()
72{
5a23c56d 73 export APT_DONT_SIGN='InRelease'
631a7dc7 74 setupaptarchive_with_lists_clean
631a7dc7 75 testsuccess aptget update
846bc058 76 listcurrentlistsdirectory > lists.before
631a7dc7
MV
77
78 simulate_mitm_and_inject_evil_package
79 assert_update_is_refused_and_last_good_state_used
846bc058 80 testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7
MV
81}
82
c99fe2e1
MV
83test_from_inrelease_to_unsigned_with_override()
84{
5a23c56d 85 export APT_DONT_SIGN='Release.gpg'
c99fe2e1
MV
86 # setup archive with InRelease file
87 setupaptarchive_with_lists_clean
448c38bd 88 testsuccess aptget update
c99fe2e1
MV
89
90 # simulate moving to a unsigned but otherwise valid repo
91 simulate_mitm_and_inject_evil_package
448c38bd 92 generatereleasefiles '+2 hours'
63c71412 93 find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;
c99fe2e1
MV
94
95 # and ensure we can update to it (with enough force)
d03b947b 96 testfailure apt update
b1bdfe68
DK
97 testfailure aptget update
98 testfailure aptget update --allow-insecure-repositories
d03b947b
DK
99 testfailure aptget update --no-allow-insecure-repositories
100 sed -i 's#^deb\(-src\)\? #deb\1 [allow-downgrade-to-insecure=yes] #' rootdir/etc/apt/sources.list.d/*
101 testfailure aptget update --no-allow-insecure-repositories
102 testfailure apt update
103 testwarning apt update --allow-insecure-repositories \
104 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
105 sed -i 's#^deb\(-src\)\? \[allow-downgrade-to-insecure=yes\] #deb\1 #' rootdir/etc/apt/sources.list.d/*
b1bdfe68
DK
106 # but that the individual packages are still considered untrusted
107 testfailureequal "WARNING: The following packages cannot be authenticated!
108 evil
109E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
110}
111
112test_from_inrelease_to_norelease_with_override()
113{
114 # setup archive with InRelease file
115 setupaptarchive_with_lists_clean
116 testsuccess aptget update
117
118 # simulate moving to a unsigned but otherwise valid repo
119 simulate_mitm_and_inject_evil_package
120 find "$APTARCHIVE" -name '*Release*' -delete
121 find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;
122
123 # and ensure we can update to it (with enough force)
124 testfailure aptget update
125 testfailure aptget update --allow-insecure-repositories
4fa34122 126 testwarning aptget update --allow-insecure-repositories \
448c38bd 127 -o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
c99fe2e1 128 # but that the individual packages are still considered untrusted
25b86db1 129 testfailureequal "WARNING: The following packages cannot be authenticated!
c99fe2e1 130 evil
b381a482 131E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
c99fe2e1
MV
132}
133
631a7dc7
MV
134test_cve_2012_0214()
135{
136 # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
137 #
138 # it was possible to MITM the download so that InRelease/Release.gpg
139 # are not delivered (404) and a altered Release file was send
140 #
141 # apt left the old InRelease file in /var/lib/apt/lists and downloaded
142 # the unauthenticated Release file too giving the false impression that
143 # Release was authenticated
144 #
3a8776a3 145 # Note that this is pretty much impossible nowadays because:
631a7dc7
MV
146 # a) InRelease is left as is, not split to InRelease/Release as it was
147 # in the old days
148 # b) we refuse to go from signed->unsigned
149 #
150 # Still worth having a regression test the simulates the condition
151
5a23c56d 152 export APT_DONT_SIGN='Release.gpg'
631a7dc7
MV
153 setupaptarchive_with_lists_clean
154 testsuccess aptget update
846bc058 155 listcurrentlistsdirectory > lists.before
631a7dc7
MV
156
157 # do what CVE-2012-0214 did
5a23c56d 158 rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
631a7dc7
MV
159 inject_evil_package
160 # build valid Release file
761a5ad2 161 aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
631a7dc7
MV
162
163 assert_update_is_refused_and_last_good_state_used
846bc058 164 testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7
MV
165
166 # ensure there is no _Release file downloaded
167 testfailure ls rootdir/var/lib/apt/lists/*_Release
168}
169
170test_subvert_inrelease()
171{
5a23c56d 172 export APT_DONT_SIGN='Release.gpg'
631a7dc7
MV
173 setupaptarchive_with_lists_clean
174 testsuccess aptget update
846bc058 175 listcurrentlistsdirectory > lists.before
631a7dc7
MV
176
177 # replace InRelease with something else
63c71412 178 mv "$APTARCHIVE/dists/unstable/Release" "$APTARCHIVE/dists/unstable/InRelease"
631a7dc7 179
f695e761 180 testfailuremsg "E: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
dd676dc7 181E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update
631a7dc7
MV
182
183 # ensure we keep the repo
846bc058 184 testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7
MV
185 assert_repo_is_intact
186}
187
188test_inrelease_to_invalid_inrelease()
189{
5a23c56d 190 export APT_DONT_SIGN='Release.gpg'
631a7dc7
MV
191 setupaptarchive_with_lists_clean
192 testsuccess aptget update
846bc058 193 listcurrentlistsdirectory > lists.before
631a7dc7
MV
194
195 # now remove InRelease and subvert Release do no longer verify
63c71412 196 sed -i 's/^Codename:.*/Codename: evil!/' "$APTARCHIVE/dists/unstable/InRelease"
631a7dc7
MV
197 inject_evil_package
198
1da3b7b8 199 testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
4dbfe436 200W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
631a7dc7
MV
201W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
202
203 # ensure we keep the repo
846bc058
DK
204 testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
205 testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 206 assert_repo_is_intact
631a7dc7
MV
207}
208
209test_release_gpg_to_invalid_release_release_gpg()
210{
5a23c56d 211 export APT_DONT_SIGN='InRelease'
631a7dc7 212 setupaptarchive_with_lists_clean
631a7dc7 213 testsuccess aptget update
846bc058 214 listcurrentlistsdirectory > lists.before
631a7dc7
MV
215
216 # now subvert Release do no longer verify
63c71412 217 echo "Some evil data" >> "$APTARCHIVE/dists/unstable/Release"
631a7dc7
MV
218 inject_evil_package
219
1da3b7b8 220 testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
03aa0847 221W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
8beef749 222W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
631a7dc7 223
846bc058
DK
224 testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
225 testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 226 assert_repo_is_intact
631a7dc7
MV
227}
228
229
3abb6a6a
DK
230TESTDIR="$(readlink -f "$(dirname "$0")")"
231. "$TESTDIR/framework"
631a7dc7
MV
232
233setupenvironment
234configarchitecture "i386"
235
236# a "normal" package with source and binary
237buildsimplenativepackage 'foo' 'all' '2.0'
238
239# setup the archive and ensure we have a single package that installs fine
240setupaptarchive
63c71412 241APTARCHIVE="$(readlink -f ./aptarchive)"
631a7dc7
MV
242assert_repo_is_intact
243
244# test the various cases where a repo may go from signed->unsigned
245msgmsg "test_from_inrelease_to_unsigned"
246test_from_inrelease_to_unsigned
247
248msgmsg "test_from_release_gpg_to_unsigned"
249test_from_release_gpg_to_unsigned
250
251# ensure we do not regress on CVE-2012-0214
252msgmsg "test_cve_2012_0214"
253test_cve_2012_0214
254
8d89cda7 255# ensure InRelease can not be subverted
631a7dc7
MV
256msgmsg "test_subvert_inrelease"
257test_subvert_inrelease
258
259# ensure we revert to last good state if InRelease does not verify
260msgmsg "test_inrelease_to_invalid_inrelease"
261test_inrelease_to_invalid_inrelease
262
263# ensure we revert to last good state if Release/Release.gpg does not verify
264msgmsg "test_release_gpg_to_invalid_release_release_gpg"
265test_release_gpg_to_invalid_release_release_gpg
c99fe2e1 266
846bc058
DK
267# ensure we can override the downgrade error
268msgmsg "test_from_inrelease_to_unsigned_with_override"
c99fe2e1 269test_from_inrelease_to_unsigned_with_override
b1bdfe68
DK
270msgmsg "test_from_inrelease_to_norelease_with_override"
271test_from_inrelease_to_norelease_with_override