From 3152f4aa4a97ad06ef1073aabe137f999f787ee1 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Fri, 28 May 2010 23:11:36 +0200 Subject: * apt-pkg/aptconfiguration.cc: - remove duplicate architectures in getArchitectures() --- test/libapt/getarchitectures_test.cc | 61 ++++++++++++++++++++++++++++++++++++ test/libapt/makefile | 5 +++ 2 files changed, 66 insertions(+) create mode 100644 test/libapt/getarchitectures_test.cc (limited to 'test') diff --git a/test/libapt/getarchitectures_test.cc b/test/libapt/getarchitectures_test.cc new file mode 100644 index 000000000..1500caeed --- /dev/null +++ b/test/libapt/getarchitectures_test.cc @@ -0,0 +1,61 @@ +#include +#include + +#include "assert.h" +#include +#include + +#include + +// simple helper to quickly output a vector of strings +void dumpVector(std::vector vec) { + for (std::vector::const_iterator v = vec.begin(); + v != vec.end(); v++) + std::cout << *v << std::endl; +} + +int main(int argc,char *argv[]) +{ + std::vector vec; + + _config->Set("APT::Architectures::1", "i386"); + _config->Set("APT::Architectures::2", "amd64"); + vec = APT::Configuration::getArchitectures(false); + equals(vec.size(), 2); + equals(vec[0], "i386"); + equals(vec[1], "amd64"); + + _config->Set("APT::Architecture", "i386"); + vec = APT::Configuration::getArchitectures(false); + equals(vec.size(), 2); + equals(vec[0], "i386"); + equals(vec[1], "amd64"); + + _config->Set("APT::Architectures::2", ""); + vec = APT::Configuration::getArchitectures(false); + equals(vec.size(), 1); + equals(vec[0], "i386"); + + _config->Set("APT::Architecture", "armel"); + vec = APT::Configuration::getArchitectures(false); + equals(vec.size(), 2); + equals(vec[0], "i386"); + equals(vec[1], "armel"); + + _config->Set("APT::Architectures::2", "amd64"); + _config->Set("APT::Architectures::3", "i386"); + _config->Set("APT::Architectures::4", "armel"); + _config->Set("APT::Architectures::5", "i386"); + _config->Set("APT::Architectures::6", "amd64"); + _config->Set("APT::Architectures::7", "armel"); + _config->Set("APT::Architectures::8", "armel"); + _config->Set("APT::Architectures::9", "amd64"); + _config->Set("APT::Architectures::10", "amd64"); + vec = APT::Configuration::getArchitectures(false); + equals(vec.size(), 3); + equals(vec[0], "i386"); + equals(vec[1], "amd64"); + equals(vec[2], "armel"); + + return 0; +} diff --git a/test/libapt/makefile b/test/libapt/makefile index 98bdb3348..ee3401b35 100644 --- a/test/libapt/makefile +++ b/test/libapt/makefile @@ -12,6 +12,11 @@ SLIBS = -lapt-pkg SOURCE = getlanguages_test.cc include $(PROGRAM_H) +PROGRAM = getArchitectures${BASENAME} +SLIBS = -lapt-pkg +SOURCE = getarchitectures_test.cc +include $(PROGRAM_H) + # Program for testing ParseDepends PROGRAM = ParseDepends${BASENAME} SLIBS = -lapt-pkg -- cgit v1.2.3-70-g09d2 From 8fa7eefb8a320e8fa4a26c4718fa606d4d27a56f Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Fri, 28 May 2010 23:40:08 +0200 Subject: create the bin-test directory automatic in the runner --- test/libapt/run-tests.sh | 1 + 1 file changed, 1 insertion(+) (limited to 'test') diff --git a/test/libapt/run-tests.sh b/test/libapt/run-tests.sh index f9df1af5f..cb7769e4a 100755 --- a/test/libapt/run-tests.sh +++ b/test/libapt/run-tests.sh @@ -2,6 +2,7 @@ set -e echo "Compiling the tests ..." +test -d '../../build/obj/test/libapt/' || mkdir -p '../../build/obj/test/libapt/' make echo "Running all testcases ..." LDPATH=$(pwd)/../../build/bin -- cgit v1.2.3-70-g09d2 From 1ddb859611d2e0f3d9ea12085001810f689e8c99 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Tue, 8 Jun 2010 19:27:49 +0200 Subject: * apt-pkg/indexrecords.cc: - backport forgotten Valid-Until patch from the obsolete experimental branch to prevent replay attacks better, thanks to Thomas Viehmann for the initial patch! (Closes: #499897) --- apt-pkg/acquire-item.cc | 12 ++++++- apt-pkg/indexrecords.cc | 38 ++++++++++++++++++++-- apt-pkg/indexrecords.h | 4 +++ debian/changelog | 4 +++ test/pre-upload-check.py | 14 ++++++++ .../sources.list.all-validuntil-broken | 1 + 6 files changed, 70 insertions(+), 3 deletions(-) create mode 100644 test/testsources.list/sources.list.all-validuntil-broken (limited to 'test') diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc index c035b9163..4a846804e 100644 --- a/apt-pkg/acquire-item.cc +++ b/apt-pkg/acquire-item.cc @@ -33,6 +33,7 @@ #include #include #include +#include /*}}}*/ using namespace std; @@ -1177,6 +1178,15 @@ bool pkgAcqMetaIndex::VerifyVendor(string Message) /*{{{*/ Transformed = ""; } + if (_config->FindB("Acquire::Check-Valid-Until", true)) { + if (MetaIndexParser->GetValidUntil() > 0 && + time(NULL) > MetaIndexParser->GetValidUntil()) { + return _error->Error(_("Release file expired, ignoring %s (valid until %s)"), + RealURI.c_str(), + TimeRFC1123(MetaIndexParser->GetValidUntil()).c_str()); + } + } + if (_config->FindB("Debug::pkgAcquire::Auth", false)) { std::cerr << "Got Codename: " << MetaIndexParser->GetDist() << std::endl; @@ -1194,7 +1204,7 @@ bool pkgAcqMetaIndex::VerifyVendor(string Message) /*{{{*/ // return false; if (!Transformed.empty()) { - _error->Warning("Conflicting distribution: %s (expected %s but got %s)", + _error->Warning(_("Conflicting distribution: %s (expected %s but got %s)"), Desc.Description.c_str(), Transformed.c_str(), MetaIndexParser->GetDist().c_str()); diff --git a/apt-pkg/indexrecords.cc b/apt-pkg/indexrecords.cc index 1fc27b1a1..24ed02ba5 100644 --- a/apt-pkg/indexrecords.cc +++ b/apt-pkg/indexrecords.cc @@ -7,8 +7,11 @@ #include #include #include +#include #include #include +#include + /*}}}*/ string indexRecords::GetDist() const { @@ -26,6 +29,11 @@ string indexRecords::GetExpectedDist() const return this->ExpectedDist; } +time_t indexRecords::GetValidUntil() const +{ + return this->ValidUntil; +} + const indexRecords::checkSum *indexRecords::Lookup(const string MetaKey) { return Entries[MetaKey]; @@ -82,7 +90,33 @@ bool indexRecords::Load(const string Filename) /*{{{*/ return false; } - string Strdate = Section.FindS("Date"); // FIXME: verify this somehow? + string Label = Section.FindS("Label"); + string StrDate = Section.FindS("Date"); + string StrValidUntil = Section.FindS("Valid-Until"); + + // if we have a Valid-Until header, use it + if (!StrValidUntil.empty()) + { + // set ValidUntil based on the information in the Release file + if(!StrToTime(StrValidUntil, ValidUntil)) + { + ErrorText = _(("Invalid 'Valid-Until' entry in Release file " + Filename).c_str()); + return false; + } + } else { + // if we don't have a valid-until string, check if we have a default + if (!Label.empty()) + { + int MaxAge = _config->FindI(string("apt::acquire::max-default-age::"+Label).c_str(),0); + if(MaxAge > 0 && !StrToTime(StrDate, ValidUntil)) + { + ErrorText = _(("Invalid 'Date' entry in Release file " + Filename).c_str()); + return false; + } + ValidUntil += 24*60*60*MaxAge; + } + } + return true; } /*}}}*/ @@ -160,6 +194,6 @@ indexRecords::indexRecords() } indexRecords::indexRecords(const string ExpectedDist) : - ExpectedDist(ExpectedDist) + ExpectedDist(ExpectedDist), ValidUntil(0) { } diff --git a/apt-pkg/indexrecords.h b/apt-pkg/indexrecords.h index 468d2bd0f..500cf23c4 100644 --- a/apt-pkg/indexrecords.h +++ b/apt-pkg/indexrecords.h @@ -12,6 +12,7 @@ #include #include +#include class indexRecords { @@ -25,6 +26,8 @@ class indexRecords string Dist; string Suite; string ExpectedDist; + time_t ValidUntil; + std::map Entries; public: @@ -38,6 +41,7 @@ class indexRecords virtual bool Load(string Filename); string GetDist() const; + time_t GetValidUntil() const; virtual bool CheckDist(const string MaybeDist) const; string GetExpectedDist() const; virtual ~indexRecords(){}; diff --git a/debian/changelog b/debian/changelog index 3771ca415..d8fb57757 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,10 @@ apt (0.7.26~exp5) experimental; urgency=low [ David Kalnischkies ] + * apt-pkg/indexrecords.cc: + - backport forgotten Valid-Until patch from the obsolete experimental + branch to prevent replay attacks better, thanks to Thomas Viehmann + for the initial patch! (Closes: #499897) * cmdline/apt-get.cc: - rerun dpkg-source in source if --fix-broken is given (Closes: #576752) - don't suggest held packages as they are installed (Closes: #578135) diff --git a/test/pre-upload-check.py b/test/pre-upload-check.py index 268b3d672..e2dfecbd3 100755 --- a/test/pre-upload-check.py +++ b/test/pre-upload-check.py @@ -95,6 +95,20 @@ class testAuthentication(unittest.TestCase): self.assert_(len(glob.glob("/var/lib/apt/lists/partial/*")) == 0, "partial/ dir has leftover files: %s" % glob.glob("/var/lib/apt/lists/partial/*")) + def testValid(self): + for f in glob.glob("testsources.list/sources.list*validuntil*"): + self._cleanup() + (prefix, testtype, result) = f.split("-") + expected_res = self._expectedRes(result) + cmd = ["update"] + res = call([self.apt,"-o","Dir::Etc::sourcelist=./%s" % f]+cmd+apt_args, + stdout=stdout, stderr=stderr) + self.assert_(res == expected_res, + "test '%s' failed (got %s expected %s" % (f,res,expected_res)) + if expected_res == 0: + self.assert_(len(glob.glob("/var/lib/apt/lists/partial/*")) == 0, + "partial/ dir has leftover files: %s" % glob.glob("/var/lib/apt/lists/partial/*")) + class testLocalRepositories(unittest.TestCase): " test local repository regressions " diff --git a/test/testsources.list/sources.list.all-validuntil-broken b/test/testsources.list/sources.list.all-validuntil-broken new file mode 100644 index 000000000..bab59bb81 --- /dev/null +++ b/test/testsources.list/sources.list.all-validuntil-broken @@ -0,0 +1 @@ +deb http://people.ubuntu.com/~mvo/apt/auth-test-suit/all-validuntil-broken/ / -- cgit v1.2.3-70-g09d2