diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:00:48 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:00:48 +0000 |
commit | 851b6a097165af4d51c0db01b5e05256e5006896 (patch) | |
tree | 5f7c388ec894a7806c49a99f3bdb605d0b299a7c /test/integration/test-apt-update-file | |
parent | Initial commit. (diff) | |
download | apt-cb4dc5b0476fd7de536c4f9d803d7409c871dd5a.tar.xz apt-cb4dc5b0476fd7de536c4f9d803d7409c871dd5a.zip |
Adding upstream version 2.6.1.upstream/2.6.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rwxr-xr-x | test/integration/test-apt-update-file | 79 | ||||
-rwxr-xr-x | test/integration/test-apt-update-filesize-mismatch | 54 |
2 files changed, 133 insertions, 0 deletions
diff --git a/test/integration/test-apt-update-file b/test/integration/test-apt-update-file new file mode 100755 index 0000000..8da4ec3 --- /dev/null +++ b/test/integration/test-apt-update-file @@ -0,0 +1,79 @@ +#!/bin/sh +# +# Ensure that we do not modify file:/// uris (regression test for +# CVE-2014-0487 +# +set -e + +TESTDIR="$(readlink -f "$(dirname "$0")")" +. "$TESTDIR/framework" + +setupenvironment +configarchitecture "amd64" +configcompression 'bz2' 'gz' +confighashes 'SHA512' + +insertpackage 'unstable' 'foo' 'all' '1' +insertpackage 'unstable' 'bar' 'amd64' '1' +insertsource 'unstable' 'foo' 'all' '1' + +setupaptarchive --no-update +logcurrentarchivedirectory + +# ensure the archive is not writable +addtrap 'prefix' 'chmod 755 aptarchive/dists/unstable/main/binary-all;' +if [ "$(id -u)" = '0' ]; then + # too deep to notice it, but it also unlikely that files in the same repo have different permissions + chmod 500 aptarchive/dists/unstable/main/binary-all + testfailure aptget update + rm -rf rootdir/var/lib/apt/lists + chmod 755 aptarchive/dists/unstable/main/binary-all + testsuccess aptget update + rm -rf rootdir/var/lib/apt/lists + chmod 511 aptarchive/dists/ + testsuccess aptget update + rm -rf rootdir/var/lib/apt/lists + chmod 510 aptarchive/dists/ + testsuccesswithnotice aptget update + rm -rf rootdir/var/lib/apt/lists + chmod 500 aptarchive/dists/ + testsuccesswithnotice aptget update + chmod 755 aptarchive/dists/ +else + testsuccess aptget update +fi +mv rootdir/var/lib/apt/lists/_* rootdir/var/lib/apt/lists/partial +chmod 555 aptarchive/dists/unstable/main/binary-all +testsuccess aptget update -o Debug::pkgAcquire::Worker=1 +cp -a rootdir/tmp/testsuccess.output rootdir/tmp/update.output +testsuccess grep '%0aAlt-Filename:%20' rootdir/tmp/update.output + +# the release files aren't an IMS-hit, but the indexes are +redatereleasefiles '+1 hour' + +# we don't download the index if it isn't updated +testsuccess aptget update -o Debug::pkgAcquire::Auth=1 +# file:/ isn't shown in the log, so see if it was downloaded anyhow +cp -a rootdir/tmp/testsuccess.output rootdir/tmp/update.output +canary="SHA512:$(bzcat aptarchive/dists/unstable/main/binary-all/Packages.bz2 | sha512sum |cut -f1 -d' ')" +testfailure grep -- "$canary" rootdir/tmp/update.output + +testfoo() { + # foo is still available + testsuccess aptget install -s foo + testsuccess aptcache showsrc foo + testsuccess aptget source foo --print-uris +} +testfoo + +# the release file is new again, the index still isn't, but it is somehow gone now from disk +redatereleasefiles '+2 hour' +find rootdir/var/lib/apt/lists -name '*_Packages*' -delete + +testsuccess aptget update -o Debug::pkgAcquire::Auth=1 +# file:/ isn't shown in the log, so see if it was downloaded anyhow +cp -a rootdir/tmp/testsuccess.output rootdir/tmp/update.output +canary="SHA512:$(bzcat aptarchive/dists/unstable/main/binary-all/Packages.bz2 | sha512sum |cut -f1 -d' ')" +testsuccess grep -- "$canary" rootdir/tmp/update.output + +testfoo diff --git a/test/integration/test-apt-update-filesize-mismatch b/test/integration/test-apt-update-filesize-mismatch new file mode 100755 index 0000000..26b670d --- /dev/null +++ b/test/integration/test-apt-update-filesize-mismatch @@ -0,0 +1,54 @@ +#!/bin/sh +set -e + +TESTDIR="$(readlink -f "$(dirname "$0")")" +. "$TESTDIR/framework" +setupenvironment +configarchitecture 'i386' +configcompression 'gz' + +insertpackage 'testing' 'foo' 'all' '1' +insertpackage 'testing' 'foo2' 'all' '1' +insertsource 'testing' 'foo' 'all' '1' +insertsource 'testing' 'foo2' 'all' '1' + +setupaptarchive --no-update +changetowebserver + +find aptarchive \( -name 'Packages' -o -name 'Sources' -o -name 'Translation-en' \) -delete +for release in $(find aptarchive -name 'Release'); do + cp "$release" "${release}.backup" +done + +testsuccess aptget update +testsuccess aptcache show foo +testsuccess aptget install foo -s + +for get in $(sed -n 's#^GET /\([^ ]\+\.gz\) HTTP.\+$#\1#p' aptarchive/webserver.log.client*.log); do + for ext in '' '.gz'; do + COMPRESSFILE="$get" + get="${get}${ext}" + FILE="$(basename "$get" '.gz')" + msgmsg 'Test filesize mismatch with file' "$FILE" + rm -rf rootdir/var/lib/apt/lists + + for release in $(find aptarchive -name 'Release'); do + SIZE="$(awk "/$FILE\$/ { print \$2; exit }" "${release}.backup")" + sed "s# $SIZE # $(($SIZE + 111)) #" "${release}.backup" > "$release" + done + signreleasefiles + + testfailure aptget update -o Debug::pkgAcquire::Worker=1 + cp rootdir/tmp/testfailure.output rootdir/tmp/update.output + if [ -z "$ext" ]; then + testsuccess grep -E "$(basename "$COMPRESSFILE" '.gz').*Hash Sum mismatch" rootdir/tmp/update.output + else + testsuccess grep -E "$(basename "$COMPRESSFILE" '.gz').*File has unexpected size" rootdir/tmp/update.output + fi + testfailure aptcache show foo + testfailure aptget install foo -s + + testfailure aptcache show bar + testfailure aptget install bar -s + done +done |