From: "Liam R. Howlett" <Liam.Howlett@windriver.com>
To: <bitbake-devel@lists.openembedded.org>
Subject: [PATCH v2] fetch2: Add BB_TRUSTED_NETWORK support
Date: Wed, 15 Apr 2015 14:17:04 -0400 [thread overview]
Message-ID: <1429121824-31200-2-git-send-email-Liam.Howlett@WindRiver.com> (raw)
In-Reply-To: <1429121824-31200-1-git-send-email-Liam.Howlett@WindRiver.com>
BB_TRUSTED_NETWORK is a list of hosts that the fetcher will be allowed
to use when BB_NO_NETWORK is not set.
If BB_NO_NETWORK is set, then networking is still disabled.
If BB_TRUSTED_NETWORK is not set, the behaviour remains the same as
today.
If BB_NO_NETWORK is NOT set, and BB_TRUSTED_NETWORK is configured, then
only the hosts in the list are usable by the fetcher.
eg:
BB_TRUSTED_NETWORK="yoctoproject.org git.gnu.org"
The fetcher will be able to download from yoctoproject.org, git.gnu.org,
but not ftp.gnu.org or any other hostname that is not in the list.
There is also limited support for wildcards on the beginning of the
hosts, so BB_TRUSTED_NETWORK="*.gnu.org" with match git.gnu.org and
ftp.gnu.org as well as foo.git.gnu.org
Signed-off-by: Liam R. Howlett <Liam.Howlett@WindRiver.com>
---
lib/bb/fetch2/__init__.py | 53 +++++++++++++++++++++++++++++++++++++++++++++++
lib/bb/tests/fetch.py | 37 +++++++++++++++++++++++++++++++++
2 files changed, 90 insertions(+)
diff --git a/lib/bb/fetch2/__init__.py b/lib/bb/fetch2/__init__.py
index b004dae..f34b74a 100644
--- a/lib/bb/fetch2/__init__.py
+++ b/lib/bb/fetch2/__init__.py
@@ -61,6 +61,17 @@ class BBFetchException(Exception):
def __str__(self):
return self.msg
+class UntrustedUrl(BBFetchException):
+ """Exception raised when encountering a host not listed in BB_TRUSTED_NETWORK"""
+ def __init__(self, url, message=''):
+ if message:
+ msg = message
+ else:
+ msg = "The URL: '%s' is not trusted and cannot be used" % url
+ self.url = url
+ BBFetchException.__init__(self, msg)
+ self.args = (url,)
+
class MalformedUrl(BBFetchException):
"""Exception raised when encountering an invalid url"""
def __init__(self, url, message=''):
@@ -851,6 +862,11 @@ def build_mirroruris(origud, mirrors, ld):
newuri = uri_replace(ud, find, replace, replacements, ld)
if not newuri or newuri in uris or newuri == origud.url:
continue
+
+ if not trusted_network(ld, newuri):
+ logger.debug(1, "Mirror %s not in the list of trusted networks, skipping" % (newuri))
+ continue
+
try:
newud = FetchData(newuri, ld)
newud.setup_localpath(ld)
@@ -971,6 +987,41 @@ def try_mirrors(d, origud, mirrors, check = False):
return ret
return None
+def trusted_network(d, url):
+ """
+ Use a trusted url during download if networking is enabled and
+ BB_TRUSTED_NETWORK is set globally or for a specific recipe.
+ Note: modifies SRC_URI & mirrors.
+ """
+ if d.getVar('BB_NO_NETWORK', True) == "1":
+ return True
+
+ pkgname = d.expand(d.getVar('PN'))
+ trusted_hosts = d.getVarFlag('BB_TRUSTED_NETWORK', pkgname)
+
+ if not trusted_hosts:
+ trusted_hosts = d.getVar('BB_TRUSTED_NETWORK', True)
+
+ # Not enabled.
+ if not trusted_hosts:
+ return True
+
+ scheme, network, path, user, passwd, param = decodeurl(url)
+
+ if not network:
+ return True
+
+ network = network.lower()
+
+ for host in trusted_hosts.split(" "):
+ host = host.lower()
+ if host.startswith("*.") and ("." + network).endswith(host[1:]):
+ return True
+ if host == network:
+ return True
+
+ return False
+
def srcrev_internal_helper(ud, d, name):
"""
Return:
@@ -1529,6 +1580,8 @@ class Fetch(object):
firsterr = None
if not localpath and ((not verify_donestamp(ud, self.d)) or m.need_update(ud, self.d)):
try:
+ if not trusted_network(self.d, ud.url):
+ raise UntrustedUrl(ud.url)
logger.debug(1, "Trying Upstream")
m.download(ud, self.d)
if hasattr(m, "build_mirror_data"):
diff --git a/lib/bb/tests/fetch.py b/lib/bb/tests/fetch.py
index d56ef49..06726f2 100644
--- a/lib/bb/tests/fetch.py
+++ b/lib/bb/tests/fetch.py
@@ -547,6 +547,43 @@ class FetcherNetworkTest(FetcherTest):
os.chdir(os.path.dirname(self.unpackdir))
fetcher.unpack(self.unpackdir)
+ def test_trusted_network(self):
+ # Ensure trusted_network returns False when the host IS in the list.
+ url = "git://Someserver.org/foo;rev=1"
+ self.d.setVar("BB_TRUSTED_NETWORK", "server1.org someserver.org server2.org server3.org")
+ self.assertTrue(bb.fetch.trusted_network(self.d, url))
+
+ def test_wild_trusted_network(self):
+ # Ensure trusted_network returns true when the *.host IS in the list.
+ url = "git://Someserver.org/foo;rev=1"
+ self.d.setVar("BB_TRUSTED_NETWORK", "server1.org *.someserver.org server2.org server3.org")
+ self.assertTrue(bb.fetch.trusted_network(self.d, url))
+
+ def test_prefix_wild_trusted_network(self):
+ # Ensure trusted_network returns true when the prefix matches *.host.
+ url = "git://git.Someserver.org/foo;rev=1"
+ self.d.setVar("BB_TRUSTED_NETWORK", "server1.org *.someserver.org server2.org server3.org")
+ self.assertTrue(bb.fetch.trusted_network(self.d, url))
+
+ def test_two_prefix_wild_trusted_network(self):
+ # Ensure trusted_network returns true when the prefix matches *.host.
+ url = "git://something.git.Someserver.org/foo;rev=1"
+ self.d.setVar("BB_TRUSTED_NETWORK", "server1.org *.someserver.org server2.org server3.org")
+ self.assertTrue(bb.fetch.trusted_network(self.d, url))
+
+ def test_untrusted_network(self):
+ # Ensure trusted_network returns False when the host is NOT in the list.
+ url = "git://someserver.org/foo;rev=1"
+ self.d.setVar("BB_TRUSTED_NETWORK", "server1.org server2.org server3.org")
+ self.assertFalse(bb.fetch.trusted_network(self.d, url))
+
+ def test_wild_untrusted_network(self):
+ # Ensure trusted_network returns False when the host is NOT in the list.
+ url = "git://*.someserver.org/foo;rev=1"
+ self.d.setVar("BB_TRUSTED_NETWORK", "server1.org server2.org server3.org")
+ self.assertFalse(bb.fetch.trusted_network(self.d, url))
+
+
class URLHandle(unittest.TestCase):
datatable = {
--
2.1.1
next prev parent reply other threads:[~2015-04-15 18:17 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-31 18:39 [PATCH] fetch2: Add BB_TRUSTED_NETWORK support Liam R. Howlett
2015-03-31 18:39 ` Liam R. Howlett
2015-04-15 18:17 ` [PATCH v2] " Liam R. Howlett
2015-04-15 18:17 ` Liam R. Howlett [this message]
2015-04-16 17:06 ` [PATCH v3] fetch2: Add BB_ALLOWED_NETWORKS support Liam R. Howlett
2015-04-16 17:23 ` Liam R. Howlett
2015-05-12 11:17 ` Richard Purdie
2015-05-12 14:28 ` Liam R. Howlett
2015-06-15 13:28 ` Paul Eggleton
2015-06-15 13:30 ` Rifenbark, Scott M
2015-06-15 13:38 ` Gary Thomas
2015-06-15 14:03 ` Rifenbark, Scott M
2015-06-15 21:47 ` Bernhard Reutner-Fischer
2015-06-16 8:40 ` Paul Eggleton
2015-06-16 13:42 ` Liam R. Howlett
2015-06-16 15:25 ` Rifenbark, Scott M
2015-06-16 19:24 ` Liam R. Howlett
2015-06-16 19:25 ` Rifenbark, Scott M
2015-06-16 22:16 ` Rifenbark, Scott M
2015-04-15 19:37 ` [PATCH] fetch2: Add BB_TRUSTED_NETWORK support Christopher Larson
2015-04-15 19:42 ` Bernhard Reutner-Fischer
2015-04-16 14:16 ` Liam R. Howlett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1429121824-31200-2-git-send-email-Liam.Howlett@WindRiver.com \
--to=liam.howlett@windriver.com \
--cc=bitbake-devel@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.