]>
Commit | Line | Data |
---|---|---|
ca7fd76c MV |
1 | #!/bin/sh |
2 | # | |
3 | # Ensure that a MITM can not stale the Packages/Sources without | |
4 | # raising a error message. Note that the Release file is protected | |
5 | # via the "Valid-Until" header | |
6 | # | |
7 | set -e | |
8 | ||
9 | TESTDIR=$(readlink -f $(dirname $0)) | |
10 | . $TESTDIR/framework | |
11 | ||
12 | setupenvironment | |
13 | configarchitecture "i386" | |
14 | ||
15 | insertpackage 'unstable' 'foo' 'all' '1.0' | |
16 | ||
081c9d44 | 17 | setupaptarchive --no-update |
ca7fd76c | 18 | changetowebserver |
081c9d44 DK |
19 | |
20 | echo "Acquire::Languages \"none\";" > rootdir/etc/apt/apt.conf.d/00nolanguages | |
448c38bd | 21 | testsuccess aptget update -o Debug::pkgAcquire::Worker=1 -o Debug::Acquire::http=1 |
846bc058 | 22 | listcurrentlistsdirectory > lists.before |
ca7fd76c MV |
23 | |
24 | # insert new version | |
25 | mkdir aptarchive/dists/unstable/main/binary-i386/saved | |
26 | cp -p aptarchive/dists/unstable/main/binary-i386/Packages* \ | |
27 | aptarchive/dists/unstable/main/binary-i386/saved | |
28 | insertpackage 'unstable' 'foo' 'all' '2.0' | |
448c38bd | 29 | touch -d '+1 hour' aptarchive/dists/unstable/main/binary-i386/Packages |
846bc058 | 30 | compressfile aptarchive/dists/unstable/main/binary-i386/Packages |
ca7fd76c | 31 | # ensure that we do not get a I-M-S hit for the Release file |
846bc058 DK |
32 | |
33 | generatereleasefiles '+1hour' | |
34 | signreleasefiles | |
ca7fd76c MV |
35 | |
36 | # but now only deliver the previous Packages file instead of the new one | |
37 | # (simulating a stale attack) | |
38 | cp -p aptarchive/dists/unstable/main/binary-i386/saved/Packages* \ | |
39 | aptarchive/dists/unstable/main/binary-i386/ | |
40 | ||
846bc058 | 41 | # ensure this raises an error |
6c0765c0 | 42 | testfailuremsg "W: Failed to fetch copy:$(readlink -f ./rootdir)/var/lib/apt/lists/localhost:${APTHTTPPORT}_dists_unstable_main_binary-i386_Packages Hash Sum mismatch |
448c38bd | 43 | E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -o Debug::pkgAcquire::Worker=1 -o Debug::Acquire::http=1 |
846bc058 | 44 | testfileequal lists.before "$(listcurrentlistsdirectory)" |