test/integration/test-apt-update-nofallback

   1 #!/bin/sh
   2 #
   3 # ensure we never fallback from a signed to a unsigned repo
   4 #
   5 # hash checks are done in
   6 #
   7 set -e
   8
   9 simulate_mitm_and_inject_evil_package()
  10 {
  11     rm -f $APTARCHIVE/dists/unstable/InRelease
  12     rm -f $APTARCHIVE/dists/unstable/Release.gpg
  13     inject_evil_package
  14 }
  15
  16 inject_evil_package()
  17 {
  18     cat > $APTARCHIVE/dists/unstable/main/binary-i386/Packages <<EOF
  19 Package: evil
  20 Installed-Size: 29
  21 Maintainer: Joe Sixpack <joe@example.org>
  22 Architecture: all
  23 Version: 1.0
  24 Filename: pool/evil_1.0_all.deb
  25 Size: 1270
  26 Description: an autogenerated evil package
  27 EOF
  28     # avoid ims hit
  29     touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
  30 }
  31
  32 assert_update_is_refused_and_last_good_state_used()
  33 {
  34     testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
  35
  36     assert_repo_is_intact
  37 }
  38
  39 assert_repo_is_intact()
  40 {
  41     testequal "foo/unstable 2.0 all" apt list -q
  42     testsuccess "" aptget install -y -s foo
  43     testfailure "" aptget install -y evil
  44
  45     LISTDIR=rootdir/var/lib/apt/lists
  46     if ! ( ls $LISTDIR/*InRelease >/dev/null 2>&1 ||
  47             ls $LISTDIR/*Release.gpg >/dev/null 2>&1 ); then
  48         echo "Can not find InRelease/Release.gpg in $(ls $LISTDIR)"
  49         msgfail
  50     fi
  51 }
  52
  53 setupaptarchive_with_lists_clean()
  54 {
  55     setupaptarchive --no-update
  56     rm -f rootdir/var/lib/apt/lists/_*
  57     #rm -rf rootdir/var/lib/apt/lists
  58 }
  59
  60 test_from_inrelease_to_unsigned()
  61 {
  62     # setup archive with InRelease file
  63     setupaptarchive_with_lists_clean
  64     testsuccess aptget update
  65
  66     simulate_mitm_and_inject_evil_package
  67     assert_update_is_refused_and_last_good_state_used
  68 }
  69
  70 test_from_release_gpg_to_unsigned()
  71 {
  72     # setup archive with Release/Release.gpg (but no InRelease)
  73     setupaptarchive_with_lists_clean
  74     rm $APTARCHIVE/dists/unstable/InRelease
  75     testsuccess aptget update
  76
  77     simulate_mitm_and_inject_evil_package
  78     assert_update_is_refused_and_last_good_state_used
  79 }
  80
  81 test_from_inrelease_to_unsigned_with_override()
  82 {
  83     # setup archive with InRelease file
  84     setupaptarchive_with_lists_clean
  85     testsuccess aptget update
  86
  87     # simulate moving to a unsigned but otherwise valid repo
  88     simulate_mitm_and_inject_evil_package
  89     generatereleasefiles
  90
  91     # and ensure we can update to it (with enough force)
  92     testsuccess aptget update --allow-insecure-repositories \
  93         -o Acquire::AllowDowngradeToInsecureRepositories=1
  94     # but that the individual packages are still considered untrusted
  95     testequal "WARNING: The following packages cannot be authenticated!
  96   evil
  97 E: There are problems and -y was used without --force-yes" aptget install -qq -y evil
  98 }
  99
 100 test_cve_2012_0214()
 101 {
 102     # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
 103     #
 104     # it was possible to MITM the download so that InRelease/Release.gpg
 105     # are not delivered (404) and a altered Release file was send
 106     #
 107     # apt left the old InRelease file in /var/lib/apt/lists and downloaded
 108     # the unauthenticated Release file too giving the false impression that
 109     # Release was authenticated
 110     #
 111     # Note that this is pretty much impossible nowdays because:
 112     # a) InRelease is left as is, not split to InRelease/Release as it was
 113     #    in the old days
 114     # b) we refuse to go from signed->unsigned
 115     #
 116     # Still worth having a regression test the simulates the condition
 117
 118     # setup archive with InRelease
 119     setupaptarchive_with_lists_clean
 120     testsuccess aptget update
 121
 122     # do what CVE-2012-0214 did
 123     rm $APTARCHIVE/dists/unstable/InRelease
 124     rm $APTARCHIVE/dists/unstable/Release.gpg
 125     inject_evil_package
 126     # build valid Release file
 127     aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
 128
 129     assert_update_is_refused_and_last_good_state_used
 130
 131     # ensure there is no _Release file downloaded
 132     testfailure ls rootdir/var/lib/apt/lists/*_Release
 133 }
 134
 135 test_subvert_inrelease()
 136 {
 137     # setup archive with InRelease
 138     setupaptarchive_with_lists_clean
 139     testsuccess aptget update
 140
 141     # replace InRelease with something else
 142     mv $APTARCHIVE/dists/unstable/Release $APTARCHIVE/dists/unstable/InRelease
 143
 144     testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  Does not start with a cleartext signature
 145
 146 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 147
 148     # ensure we keep the repo
 149     assert_repo_is_intact
 150 }
 151
 152 test_inrelease_to_invalid_inrelease()
 153 {
 154     # setup archive with InRelease
 155     setupaptarchive_with_lists_clean
 156     testsuccess aptget update
 157
 158     # now remove InRelease and subvert Release do no longer verify
 159     sed -i 's/Codename.*/Codename: evil!'/ $APTARCHIVE/dists/unstable/InRelease
 160     inject_evil_package
 161
 162     testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 163
 164 W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 165
 166 W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 167
 168     # ensure we keep the repo
 169     assert_repo_is_intact
 170     testfailure grep "evil" rootdir/var/lib/apt/lists/*InRelease
 171 }
 172
 173 test_release_gpg_to_invalid_release_release_gpg()
 174 {
 175     # setup archive with InRelease
 176     setupaptarchive_with_lists_clean
 177     rm $APTARCHIVE/dists/unstable/InRelease
 178     testsuccess aptget update
 179
 180     # now subvert Release do no longer verify
 181     echo "Some evil data" >>  $APTARCHIVE/dists/unstable/Release
 182     inject_evil_package
 183
 184     testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable Release.gpg: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 185
 186 W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg
 187
 188 W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 189
 190     assert_repo_is_intact
 191     testfailure grep "evil" rootdir/var/lib/apt/lists/*Release
 192 }
 193
 194
 195 TESTDIR=$(readlink -f $(dirname $0))
 196 . $TESTDIR/framework
 197
 198 setupenvironment
 199 configarchitecture "i386"
 200
 201 # a "normal" package with source and binary
 202 buildsimplenativepackage 'foo' 'all' '2.0'
 203
 204 # setup the archive and ensure we have a single package that installs fine
 205 setupaptarchive
 206 APTARCHIVE=$(readlink -f ./aptarchive)
 207 assert_repo_is_intact
 208
 209 # test the various cases where a repo may go from signed->unsigned
 210 msgmsg "test_from_inrelease_to_unsigned"
 211 test_from_inrelease_to_unsigned
 212
 213 msgmsg "test_from_release_gpg_to_unsigned"
 214 test_from_release_gpg_to_unsigned
 215
 216 # ensure we do not regress on CVE-2012-0214
 217 msgmsg "test_cve_2012_0214"
 218 test_cve_2012_0214
 219
 220 # ensure InRelase can not be subverted
 221 msgmsg "test_subvert_inrelease"
 222 test_subvert_inrelease
 223
 224 # ensure we revert to last good state if InRelease does not verify
 225 msgmsg "test_inrelease_to_invalid_inrelease"
 226 test_inrelease_to_invalid_inrelease
 227
 228 # ensure we revert to last good state if Release/Release.gpg does not verify
 229 msgmsg "test_release_gpg_to_invalid_release_release_gpg"
 230 test_release_gpg_to_invalid_release_release_gpg
 231
 232 # ensure we can ovveride the downgrade error
 233 msgmsg "test_from_inrelease_to_unsigned"
 234 test_from_inrelease_to_unsigned_with_override