substitutes: Ignore narinfos that don’t match the request [security fix].

Previously, by serving a valid, signed, and authorized narinfo that does not
match what the client asked for, an attacker could cause users to get the
wrong substitute.

* guix/substitutes.scm (fetch-narinfos)[handle-narinfo-response]: Check
whether the result of ‘read-narinfo’ matches ‘request’ and ignore it if it
doesn’t.
[do-fetch]: Likewise with ‘narinfo-from-file’.
* tests/substitute.scm ("query narinfo that returns different store path")
("substitute, narinfo does not match requested store item"): New tests.

Reported-by: Reepca Russelstein <reepca@russelstein.xyz>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #9665

1 files changed, 35 insertions, 0 deletions

diff --git a/tests/substitute.scm b/tests/substitute.scm
index 8f32bfa7281..b749561347a 100644
--- a/tests/substitute.scm
+++ b/tests/substitute.scm
@@ -357,6 +357,29 @@ Deriver: foo.drv")
              (lambda ()
                (guix-substitute "--query")))))))))
 
+(test-equal "query narinfo that returns different store path"
+  ;; The narinfo is valid and authorized but its 'StorePath' field points to a
+  ;; different store item.
+  ""
+
+  (let ((prefix (string-append "StorePath: " (%store-prefix)
+                               "/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb-BAR
+NarHash: sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+References: bar baz\n")))
+    (with-narinfo (string-append prefix
+                                 "Signature: " (signature-field prefix) "
+URL: example.nar
+Compression: none
+NarSize: 42
+Deriver: foo.drv")
+      (string-trim-both
+       (with-output-to-string
+         (lambda ()
+           (with-input-from-string (string-append "have " (%store-prefix)
+                                                  "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo")
+             (lambda ()
+               (guix-substitute "--query")))))))))
+
 (test-equal "query narinfo signed with authorized key"
   (string-append (%store-prefix) "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo")
 
@@ -893,6 +916,18 @@ System: mips64el-linux\n")))
         (lambda ()
           (false-if-exception (delete-file "substitute-retrieved")))))))
 
+(test-quit "substitute, narinfo does not match requested store item"
+    "no valid substitute"
+  (with-http-server `((200 ,(string-append %narinfo "Signature: "
+                                           (signature-field %narinfo))))
+    (parameterize ((substitute-urls (list (%local-url))))
+      ;; Narinfo is valid, signed, and authorized but requested item is
+      ;; /bbb…-bar and narinfo is for /aaa…-foo.
+      (request-substitution (string-append (%store-prefix)
+                                           "/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb-bar")
+                            "substitute-retrieved")
+      #f)))
+
 (test-end "substitute")
 
 ;;; Local Variables: