From 2ef8ed9f0df53bddf14bdecc2ea48c2d233213cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= Date: Wed, 24 Jun 2026 11:34:05 +0200 Subject: =?UTF-8?q?substitutes:=20Ignore=20narinfos=20that=20don=E2=80=99t?= =?UTF-8?q?=20match=20the=20request=20[security=20fix].?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, by serving a valid, signed, and authorized narinfo that does not match what the client asked for, an attacker could cause users to get the wrong substitute. * guix/substitutes.scm (fetch-narinfos)[handle-narinfo-response]: Check whether the result of ‘read-narinfo’ matches ‘request’ and ignore it if it doesn’t. [do-fetch]: Likewise with ‘narinfo-from-file’. * tests/substitute.scm ("query narinfo that returns different store path") ("substitute, narinfo does not match requested store item"): New tests. Reported-by: Reepca Russelstein Signed-off-by: Ludovic Courtès Merges: #9665 --- tests/substitute.scm | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) (limited to 'tests') diff --git a/tests/substitute.scm b/tests/substitute.scm index 8f32bfa7281..b749561347a 100644 --- a/tests/substitute.scm +++ b/tests/substitute.scm @@ -357,6 +357,29 @@ Deriver: foo.drv") (lambda () (guix-substitute "--query"))))))))) +(test-equal "query narinfo that returns different store path" + ;; The narinfo is valid and authorized but its 'StorePath' field points to a + ;; different store item. + "" + + (let ((prefix (string-append "StorePath: " (%store-prefix) + "/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb-BAR +NarHash: sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb +References: bar baz\n"))) + (with-narinfo (string-append prefix + "Signature: " (signature-field prefix) " +URL: example.nar +Compression: none +NarSize: 42 +Deriver: foo.drv") + (string-trim-both + (with-output-to-string + (lambda () + (with-input-from-string (string-append "have " (%store-prefix) + "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo") + (lambda () + (guix-substitute "--query"))))))))) + (test-equal "query narinfo signed with authorized key" (string-append (%store-prefix) "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo") @@ -893,6 +916,18 @@ System: mips64el-linux\n"))) (lambda () (false-if-exception (delete-file "substitute-retrieved"))))))) +(test-quit "substitute, narinfo does not match requested store item" + "no valid substitute" + (with-http-server `((200 ,(string-append %narinfo "Signature: " + (signature-field %narinfo)))) + (parameterize ((substitute-urls (list (%local-url)))) + ;; Narinfo is valid, signed, and authorized but requested item is + ;; /bbb…-bar and narinfo is for /aaa…-foo. + (request-substitution (string-append (%store-prefix) + "/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb-bar") + "substitute-retrieved") + #f))) + (test-end "substitute") ;;; Local Variables: -- cgit v1.2.3