diff --git a/tests/test_indefinite_freeze_attack.py b/tests/test_indefinite_freeze_attack.py index 0e5bbde1..1dbda04a 100755 --- a/tests/test_indefinite_freeze_attack.py +++ b/tests/test_indefinite_freeze_attack.py @@ -236,8 +236,12 @@ def test_with_tuf(self): # continue the update process. Sleep for at least 2 seconds to ensure # 'repository.timestamp.expiration' is reached. time.sleep(2) - self.assertRaises(tuf.ExpiredMetadataError, - self.repository_updater.refresh) + try: + self.repository_updater.refresh() + + except tuf.NoWorkingMirrorError as e: + for mirror_url, mirror_error in e.mirror_errors.iteritems(): + self.assertTrue(isinstance(mirror_error, tuf.ExpiredMetadataError)) if __name__ == '__main__': diff --git a/tests/test_updater.py b/tests/test_updater.py index a3e4d91d..ba5093cb 100755 --- a/tests/test_updater.py +++ b/tests/test_updater.py @@ -461,20 +461,21 @@ def test_2__delete_metadata(self): def test_2__ensure_not_expired(self): # This test condition will verify that nothing is raised when a metadata # file has a future expiration date. - self.repository_updater._ensure_not_expired('root') + root_metadata = self.repository_updater.metadata['current']['root'] + self.repository_updater._ensure_not_expired(root_metadata, 'root') # 'tuf.ExpiredMetadataError' should be raised in this next test condition, # because the expiration_date has expired by 10 seconds. expires = tuf.formats.unix_timestamp_to_datetime(int(time.time() - 10)) expires = expires.isoformat() + 'Z' - self.repository_updater.metadata['current']['root']['expires'] = expires + root_metadata['expires'] = expires # Ensure the 'expires' value of the root file is valid by checking the # the formats of the 'root.json' object. - root_object = self.repository_updater.metadata['current']['root'] - self.assertTrue(tuf.formats.ROOT_SCHEMA.matches(root_object)) + self.assertTrue(tuf.formats.ROOT_SCHEMA.matches(root_metadata)) self.assertRaises(tuf.ExpiredMetadataError, - self.repository_updater._ensure_not_expired, 'root') + self.repository_updater._ensure_not_expired, + root_metadata, 'root') @@ -658,6 +659,12 @@ def test_4_refresh(self): # This unit test is based on adding an extra target file to the # server and rebuilding all server-side metadata. All top-level metadata # should be updated when the client calls refresh(). + + # First verify that an expired root metadata is updated. + expired_date = '1960-01-01T12:00:00Z' + self.repository_updater.metadata['current']['root']['expires'] = expired_date + self.repository_updater.refresh() + repository = repo_tool.load_repository(self.repository_directory) target3 = os.path.join(self.repository_directory, 'targets', 'file3.txt') diff --git a/tuf/__init__.py b/tuf/__init__.py index 158cf7be..3437ab4b 100755 --- a/tuf/__init__.py +++ b/tuf/__init__.py @@ -20,8 +20,12 @@ provide that reason in those cases. """ +import logging + +import tuf.log import tuf._vendor.six as six +logging = logging.getLogger('tuf.__init__') # Import 'tuf.formats' if a module tries to import the # entire tuf package (i.e., from tuf import *). diff --git a/tuf/client/updater.py b/tuf/client/updater.py index 35a089a9..4e581dbe 100755 --- a/tuf/client/updater.py +++ b/tuf/client/updater.py @@ -608,6 +608,31 @@ def refresh(self, unsafely_update_root_if_necessary=True): # is insufficient trusted signatures for the specified metadata. # Raise 'tuf.NoWorkingMirrorError' if an update fails. + # Is the Root role expired? When the top-level roles are initially loaded + # from disk, their expiration is not checked to allow their updating when + # requested (and give the updater the chance to continue, rather than always + # failing with an expired metadata error.) If + # 'unsafely_update_root_if_necessary' is True, update an expired Root role + # now. Updating the other top-level roles, regardless of their validity, + # should only occur if the root of trust is up-to-date. + root_metadata = self.metadata['current']['root'] + try: + self._ensure_not_expired(root_metadata, 'root') + + except tuf.ExpiredMetadataError as e: + # Raise 'tuf.NoWorkingMirrorError' if a valid (not expired, properly + # signed, and valid metadata) 'root' cannot be installed. + if unsafely_update_root_if_necessary: + message = \ + 'Expired Root metadata was loaded from disk. Try to update it now.' + logger.info(message) + self._update_metadata('root', DEFAULT_ROOT_FILEINFO) + + # The caller explicitly requested not to unsafely fetch an expired Root. + else: + logger.info('An expired Root metadata was loaded and must be updated.') + raise + # Use default but sane information for timestamp metadata, and do not # require strict checks on its required length. try: @@ -629,13 +654,6 @@ def refresh(self, unsafely_update_root_if_necessary=True): else: raise - else: - # Updated the top-level metadata (which all had valid signatures), - # however, have they expired? Raise 'tuf.ExpiredMetadataError' if any of - # the metadata has expired. - for metadata_role in ['timestamp', 'root', 'snapshot', 'targets']: - self._ensure_not_expired(metadata_role) - @@ -892,6 +910,9 @@ def _verify_uncompressed_metadata_file(self, metadata_file_object, # 'tuf.FormatError' if not. tuf.formats.check_signable_object_format(metadata_signable) + # Is 'metadata_signable' expired? + self._ensure_not_expired(metadata_signable['signed'], metadata_role) + # Is 'metadata_signable' newer than the currently installed # version? current_metadata_role = self.metadata['current'].get(metadata_role) @@ -992,7 +1013,7 @@ def unsafely_verify_uncompressed_metadata_file(metadata_file_object): self._check_hashes(metadata_file_object, uncompressed_file_hashes) self._verify_uncompressed_metadata_file(metadata_file_object, metadata_role) - + def unsafely_verify_compressed_metadata_file(metadata_file_object): self._hard_check_file_length(metadata_file_object, compressed_file_length) self._check_hashes(metadata_file_object, compressed_file_hashes) @@ -1071,7 +1092,7 @@ def safely_verify_uncompressed_metadata_file(metadata_file_object): uncompressed_file_length) self._check_hashes(metadata_file_object, uncompressed_file_hashes) self._verify_uncompressed_metadata_file(metadata_file_object, - metadata_role) + metadata_role) def safely_verify_compressed_metadata_file(metadata_file_object): self._hard_check_file_length(metadata_file_object, compressed_file_length) @@ -1356,7 +1377,7 @@ def _update_metadata(self, metadata_role, uncompressed_fileinfo, logger.debug('Updated '+repr(current_filepath)+'.') self.metadata['previous'][metadata_role] = current_metadata_object self.metadata['current'][metadata_role] = updated_metadata_object - self._update_fileinfo(metadata_filename) + self._update_fileinfo(uncompressed_metadata_filename) # Ensure the role and key information of the top-level roles is also updated # according to the newly-installed Root metadata. @@ -1726,20 +1747,24 @@ def _delete_metadata(self, metadata_role): - def _ensure_not_expired(self, metadata_role): + def _ensure_not_expired(self, metadata_object, metadata_rolename): """ Non-public method that raises an exception if the current specified metadata has expired. - metadata_role: + metadata_object: + The metadata that should be expired, a 'tuf.formats.ANYROLE_SCHEMA' + object. + + metadata_rolename: The name of the metadata. This is a role name and should not end in '.json'. Examples: 'root', 'targets', 'targets/linux/x86'. tuf.ExpiredMetadataError: - If 'metadata_role' has expired. + If 'metadata_rolename' has expired. None. @@ -1747,17 +1772,9 @@ def _ensure_not_expired(self, metadata_role): None. """ - - # Construct the full metadata filename and the location of its - # current path. The current path of 'metadata_role' is needed - # to log the exact filename of the expired metadata. - metadata_filename = metadata_role + '.json' - rolepath = os.path.join(self.metadata_directory['current'], - metadata_filename) - rolepath = os.path.abspath(rolepath) - + # Extract the expiration time. - expires = self.metadata['current'][metadata_role]['expires'] + expires = metadata_object['expires'] # If the current time has surpassed the expiration date, raise # an exception. 'expires' is in 'tuf.formats.ISO8601_DATETIME_SCHEMA' @@ -1772,7 +1789,7 @@ def _ensure_not_expired(self, metadata_role): expires_timestamp = tuf.formats.datetime_to_unix_timestamp(expires_datetime) if expires_timestamp < current_time: - message = 'Metadata '+repr(rolepath)+' expired on ' + \ + message = 'Metadata '+repr(metadata_rolename)+' expired on ' + \ expires_datetime.ctime() + ' (UTC).' logger.error(message) @@ -1910,13 +1927,6 @@ def _refresh_targets_metadata(self, rolename='targets', include_delegations=Fals self._update_metadata_if_changed(rolename) - # Remove the role if it has expired. - try: - self._ensure_not_expired(rolename) - - except tuf.ExpiredMetadataError: - tuf.roledb.remove_role(rolename) - @@ -2035,13 +2045,6 @@ def refresh_targets_metadata_chain(self, rolename): self._update_metadata_if_changed(rolename) - # Remove the role if it has expired. - try: - self._ensure_not_expired(rolename) - refreshed_chain.append(rolename) - except tuf.ExpiredMetadataError: - tuf.roledb.remove_role(rolename) - return refreshed_chain diff --git a/tuf/download.py b/tuf/download.py index dab2a505..394a12a8 100755 --- a/tuf/download.py +++ b/tuf/download.py @@ -502,10 +502,13 @@ def _download_fixed_amount_of_data(connection, temp_file, required_length): # Data successfully read from the connection. Store it. temp_file.write(data) total_downloaded = total_downloaded + len(data) + except: raise + else: return total_downloaded + finally: # Whatever happens, make sure that we always close the connection. connection.close()