From 1ddb859611d2e0f3d9ea12085001810f689e8c99 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Tue, 8 Jun 2010 19:27:49 +0200 Subject: * apt-pkg/indexrecords.cc: - backport forgotten Valid-Until patch from the obsolete experimental branch to prevent replay attacks better, thanks to Thomas Viehmann for the initial patch! (Closes: #499897) --- debian/changelog | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'debian/changelog') diff --git a/debian/changelog b/debian/changelog index 3771ca415..d8fb57757 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,10 @@ apt (0.7.26~exp5) experimental; urgency=low [ David Kalnischkies ] + * apt-pkg/indexrecords.cc: + - backport forgotten Valid-Until patch from the obsolete experimental + branch to prevent replay attacks better, thanks to Thomas Viehmann + for the initial patch! (Closes: #499897) * cmdline/apt-get.cc: - rerun dpkg-source in source if --fix-broken is given (Closes: #576752) - don't suggest held packages as they are installed (Closes: #578135) -- cgit v1.2.3-70-g09d2 From cd8cf88f0e64e222e9fdcbf86e6cbbe09306040e Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Tue, 8 Jun 2010 22:46:42 +0200 Subject: * apt-pkg/contrib/strutl.cc: - split StrToTime() into HTTP1.1 and FTP date parser methods and use strptime() instead of some selfmade scanf mangling --- apt-pkg/contrib/strutl.cc | 36 ++++++++++++++++++++++++++++++++++++ apt-pkg/contrib/strutl.h | 4 +++- debian/changelog | 3 +++ 3 files changed, 42 insertions(+), 1 deletion(-) (limited to 'debian/changelog') diff --git a/apt-pkg/contrib/strutl.cc b/apt-pkg/contrib/strutl.cc index c7d63ce8a..96e8143ec 100644 --- a/apt-pkg/contrib/strutl.cc +++ b/apt-pkg/contrib/strutl.cc @@ -855,6 +855,42 @@ static time_t timegm(struct tm *t) } #endif /*}}}*/ +// FullDateToTime - Converts a HTTP1.1 full date strings into a time_t /*{{{*/ +// --------------------------------------------------------------------- +/* tries to parses a full date as specified in RFC2616 Section 3.3.1 + with one exception: All timezones (%Z) are accepted but the protocol + says that it MUST be GMT, but this one is equal to UTC which we will + encounter from time to time (e.g. in Release files) so we accept all + here and just assume it is GMT (or UTC) later on */ +bool RFC1123StrToTime(const char* const str,time_t &time) +{ + struct tm Tm; + // Sun, 06 Nov 1994 08:49:37 GMT ; RFC 822, updated by RFC 1123 + if (strptime(str, "%a, %d %b %Y %H:%M:%S %Z", &Tm) == NULL && + // Sunday, 06-Nov-94 08:49:37 GMT ; RFC 850, obsoleted by RFC 1036 + strptime(str, "%A, %d-%b-%y %H:%M:%S %Z", &Tm) == NULL && + // Sun Nov 6 08:49:37 1994 ; ANSI C's asctime() format + strptime(str, "%a %b %d %H:%M:%S %Y", &Tm) == NULL) + return false; + + time = timegm(&Tm); + return true; +} + /*}}}*/ +// FTPMDTMStrToTime - Converts a ftp modification date into a time_t /*{{{*/ +// --------------------------------------------------------------------- +/* */ +bool FTPMDTMStrToTime(const char* const str,time_t &time) +{ + struct tm Tm; + // MDTM includes no whitespaces but recommend and ignored by strptime + if (strptime(str, "%Y %m %d %H %M %S", &Tm) == NULL) + return false; + + time = timegm(&Tm); + return true; +} + /*}}}*/ // StrToTime - Converts a string into a time_t /*{{{*/ // --------------------------------------------------------------------- /* This handles all 3 populare time formats including RFC 1123, RFC 1036 diff --git a/apt-pkg/contrib/strutl.h b/apt-pkg/contrib/strutl.h index e509145f9..b5de0802e 100644 --- a/apt-pkg/contrib/strutl.h +++ b/apt-pkg/contrib/strutl.h @@ -45,7 +45,9 @@ string Base64Encode(const string &Str); string OutputInDepth(const unsigned long Depth, const char* Separator=" "); string URItoFileName(const string &URI); string TimeRFC1123(time_t Date); -bool StrToTime(const string &Val,time_t &Result); +bool RFC1123StrToTime(const char* const str,time_t &time) __attrib_const; +bool FTPMDTMStrToTime(const char* const str,time_t &time) __attrib_const; +__deprecated bool StrToTime(const string &Val,time_t &Result); string LookupTag(const string &Message,const char *Tag,const char *Default = 0); int StringToBool(const string &Text,int Default = -1); bool ReadMessages(int Fd, vector &List); diff --git a/debian/changelog b/debian/changelog index d8fb57757..2a40d084e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -44,6 +44,9 @@ apt (0.7.26~exp5) experimental; urgency=low - add 'disappear' to the known processing states, thanks Jonathan Nieder * apt-pkg/packagemanager.h: - export info about disappeared packages with GetDisappearedPackages() + * apt-pkg/contrib/strutl.cc: + - split StrToTime() into HTTP1.1 and FTP date parser methods and + use strptime() instead of some selfmade scanf mangling [ Michael Vogt ] * methods/http.{cc,h}: -- cgit v1.2.3-70-g09d2 From c99e48ec26e693d9aa4a2a9f868284f7aa49784d Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Wed, 9 Jun 2010 00:12:14 +0200 Subject: * ftparchive/writer.cc: - add ValidTime option to generate a Valid-Until header in Release file --- debian/changelog | 2 ++ doc/apt-ftparchive.1.xml | 3 ++- ftparchive/writer.cc | 10 ++++++++++ 3 files changed, 14 insertions(+), 1 deletion(-) (limited to 'debian/changelog') diff --git a/debian/changelog b/debian/changelog index 2a40d084e..fa0e667e7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -47,6 +47,8 @@ apt (0.7.26~exp5) experimental; urgency=low * apt-pkg/contrib/strutl.cc: - split StrToTime() into HTTP1.1 and FTP date parser methods and use strptime() instead of some selfmade scanf mangling + * ftparchive/writer.cc: + - add ValidTime option to generate a Valid-Until header in Release file [ Michael Vogt ] * methods/http.{cc,h}: diff --git a/doc/apt-ftparchive.1.xml b/doc/apt-ftparchive.1.xml index a3ac45bd3..549aa6a34 100644 --- a/doc/apt-ftparchive.1.xml +++ b/doc/apt-ftparchive.1.xml @@ -122,7 +122,8 @@ e.g. APT::FTPArchive::Release::Origin. The supported fields are: Origin, Label, Suite, Version, Codename, Date, - Architectures, Components, Description. + Valid-Until, Architectures, + Components, Description. diff --git a/ftparchive/writer.cc b/ftparchive/writer.cc index 6cda29b21..650eec57c 100644 --- a/ftparchive/writer.cc +++ b/ftparchive/writer.cc @@ -924,6 +924,15 @@ ReleaseWriter::ReleaseWriter(string const &DB) datestr[0] = '\0'; } + time_t const validuntil = now + _config->FindI("APT::FTPArchive::Release::ValidTime", 0); + char validstr[128]; + if (now == validuntil || + strftime(validstr, sizeof(validstr), "%a, %d %b %Y %H:%M:%S UTC", + gmtime(&validuntil)) == 0) + { + datestr[0] = '\0'; + } + map Fields; Fields["Origin"] = ""; Fields["Label"] = ""; @@ -931,6 +940,7 @@ ReleaseWriter::ReleaseWriter(string const &DB) Fields["Version"] = ""; Fields["Codename"] = ""; Fields["Date"] = datestr; + Fields["Valid-Until"] = validstr; Fields["Architectures"] = ""; Fields["Components"] = ""; Fields["Description"] = ""; -- cgit v1.2.3-70-g09d2 From 550891457ff63db01b57d9057a5fe447a165e10c Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Wed, 9 Jun 2010 00:27:22 +0200 Subject: use the portable timegm shown in his manpage instead of a strange looking code copycat from wget --- apt-pkg/contrib/strutl.cc | 36 ++++++++++++++++-------------------- debian/changelog | 2 ++ 2 files changed, 18 insertions(+), 20 deletions(-) (limited to 'debian/changelog') diff --git a/apt-pkg/contrib/strutl.cc b/apt-pkg/contrib/strutl.cc index 96e8143ec..160450366 100644 --- a/apt-pkg/contrib/strutl.cc +++ b/apt-pkg/contrib/strutl.cc @@ -827,31 +827,27 @@ static int MonthConv(char *Month) } } /*}}}*/ -// timegm - Internal timegm function if gnu is not available /*{{{*/ +// timegm - Internal timegm if the gnu version is not available /*{{{*/ // --------------------------------------------------------------------- -/* Ripped this evil little function from wget - I prefer the use of - GNU timegm if possible as this technique will have interesting problems - with leap seconds, timezones and other. - - Converts struct tm to time_t, assuming the data in tm is UTC rather +/* Converts struct tm to time_t, assuming the data in tm is UTC rather than local timezone (mktime assumes the latter). - - Contributed by Roger Beeman , with the help of - Mark Baushke and the rest of the Gurus at CISCO. */ - -/* Turned it into an autoconf check, because GNU is not the only thing which - can provide timegm. -- 2002-09-22, Joel Baker */ -#ifndef HAVE_TIMEGM // Now with autoconf! + This function is a nonstandard GNU extension that is also present on + the BSDs and maybe other systems. For others we follow the advice of + the manpage of timegm and use his portable replacement. */ +#ifndef HAVE_TIMEGM static time_t timegm(struct tm *t) { - time_t tl, tb; - - tl = mktime (t); - if (tl == -1) - return -1; - tb = mktime (gmtime (&tl)); - return (tl <= tb ? (tl + (tl - tb)) : (tl - (tb - tl))); + char *tz = getenv("TZ"); + setenv("TZ", "", 1); + tzset(); + time_t ret = mktime(t); + if (tz) + setenv("TZ", tz, 1); + else + unsetenv("TZ"); + tzset(); + return ret; } #endif /*}}}*/ diff --git a/debian/changelog b/debian/changelog index fa0e667e7..049999230 100644 --- a/debian/changelog +++ b/debian/changelog @@ -47,6 +47,8 @@ apt (0.7.26~exp5) experimental; urgency=low * apt-pkg/contrib/strutl.cc: - split StrToTime() into HTTP1.1 and FTP date parser methods and use strptime() instead of some selfmade scanf mangling + - use the portable timegm shown in his manpage instead of a strange + looking code copycat from wget * ftparchive/writer.cc: - add ValidTime option to generate a Valid-Until header in Release file -- cgit v1.2.3-70-g09d2 From b02fffa64833e1f8e2617669d89de0a6d0882747 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Wed, 9 Jun 2010 10:46:35 +0200 Subject: rename the options, document them and reorder the changelog a bit --- apt-pkg/indexrecords.cc | 4 ++-- debian/changelog | 24 ++++++++++++++++-------- doc/apt.conf.5.xml | 24 ++++++++++++++++++++++++ doc/examples/configure-index | 4 ++++ 4 files changed, 46 insertions(+), 10 deletions(-) (limited to 'debian/changelog') diff --git a/apt-pkg/indexrecords.cc b/apt-pkg/indexrecords.cc index cdc2897bf..3bde7437d 100644 --- a/apt-pkg/indexrecords.cc +++ b/apt-pkg/indexrecords.cc @@ -104,9 +104,9 @@ bool indexRecords::Load(const string Filename) /*{{{*/ } } // get the user settings for this archive and use what expires earlier - int MaxAge = _config->FindI("APT::Acquire::Max-Default-Age", 0); + int MaxAge = _config->FindI("Acquire::Max-ValidTime", 0); if (Label.empty() == true) - MaxAge = _config->FindI(string("APT::Acquire::Max-Default-Age::" + Label).c_str(), MaxAge); + MaxAge = _config->FindI(string("Acquire::Max-ValidTime::" + Label).c_str(), MaxAge); if(MaxAge == 0) // No user settings, use the one from the Release file return true; diff --git a/debian/changelog b/debian/changelog index 049999230..c3f7a3e25 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,10 +1,25 @@ -apt (0.7.26~exp5) experimental; urgency=low +apt (0.7.26~exp6) UNRELEASED; urgency=low [ David Kalnischkies ] + * doc/apt.conf.5.xml: + - document the new Valid-Until related options * apt-pkg/indexrecords.cc: - backport forgotten Valid-Until patch from the obsolete experimental branch to prevent replay attacks better, thanks to Thomas Viehmann for the initial patch! (Closes: #499897) + * apt-pkg/contrib/strutl.cc: + - split StrToTime() into HTTP1.1 and FTP date parser methods and + use strptime() instead of some self-made scanf mangling + - use the portable timegm shown in his manpage instead of a strange + looking code copycat from wget + * ftparchive/writer.cc: + - add ValidTime option to generate a Valid-Until header in Release file + + -- David Kalnischkies Wed, 09 Jun 2010 10:43:58 +0200 + +apt (0.7.26~exp5) experimental; urgency=low + + [ David Kalnischkies ] * cmdline/apt-get.cc: - rerun dpkg-source in source if --fix-broken is given (Closes: #576752) - don't suggest held packages as they are installed (Closes: #578135) @@ -44,13 +59,6 @@ apt (0.7.26~exp5) experimental; urgency=low - add 'disappear' to the known processing states, thanks Jonathan Nieder * apt-pkg/packagemanager.h: - export info about disappeared packages with GetDisappearedPackages() - * apt-pkg/contrib/strutl.cc: - - split StrToTime() into HTTP1.1 and FTP date parser methods and - use strptime() instead of some selfmade scanf mangling - - use the portable timegm shown in his manpage instead of a strange - looking code copycat from wget - * ftparchive/writer.cc: - - add ValidTime option to generate a Valid-Until header in Release file [ Michael Vogt ] * methods/http.{cc,h}: diff --git a/doc/apt.conf.5.xml b/doc/apt.conf.5.xml index fe005e0f1..0cf4bb663 100644 --- a/doc/apt.conf.5.xml +++ b/doc/apt.conf.5.xml @@ -230,6 +230,30 @@ DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; and the URI handlers. + Check-Valid-Until + Security related option defaulting to true as an + expiring validation for a Release file prevents longtime replay attacks + and can e.g. also help users to identify no longer updated mirrors - + but the feature depends on the correctness of the time on the user system. + Archive maintainers are encouraged to create Release files with the + Valid-Until header, but if they don't or a stricter value + is volitional the following Max-ValidTime option can be used. + + + + Max-ValidTime + Seconds the Release file should be considered valid after + it was created. The default is "for ever" (0) if the Release file of the + archive doesn't include a Valid-Until header. + If it does then this date is the default. The date from the Release file or + the date specified by the creation time of the Release file + (Date header) plus the seconds specified with this + options are used to check if the validation of a file has expired by using + the earlier date of the two. Archive specific settings can be made by + appending the label of the archive to the option name. + + + PDiffs Try to download deltas called PDiffs for Packages or Sources files instead of downloading whole ones. True diff --git a/doc/examples/configure-index b/doc/examples/configure-index index d168417d8..127feb9e9 100644 --- a/doc/examples/configure-index +++ b/doc/examples/configure-index @@ -176,6 +176,10 @@ Acquire PDiffs::SizeLimit "50"; // don't use diffs if size of all patches excess // 50% of the size of the original file + Check-Valid-Until "true"; + Max-ValidTime "864000"; // 10 days + Max-ValidTime::Debian-Security "604800"; // 7 days, label specific configuration + // HTTP method configuration http { -- cgit v1.2.3-70-g09d2