| Summary: | bitbake fetcher does not always check for trusted_network | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] BitBake | Reporter: | JoergS <guru> |
| Component: | bitbake | Assignee: | Markus Lehtonen <markus.lehtonen> |
| Status: | RESOLVED FIXED | QA Contact: | David Lopez Barriba <davidx.lopez.barriba> |
| Severity: | major | ||
| Priority: | Medium+ | CC: | jose.perez.carranza, markus.lehtonen, poky.bs.watcher, poky.watcher, richard.purdie |
| Version: | 1.4.5 | ||
| Target Milestone: | 2.3 M1 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | No (bug/feature does not impact docs) | |
I noticed the optional 'url'-parameter in "check_network_access()" too late,
but a valid 'url' is needed for 'trusted_network()' to work properly
- otherwise a misleading "MalformedURL" exception may be raised!
so, here is a slightly improved check_network_access():
def check_network_access(d, info = "", url = None):
"""
log remote network access, and error if BB_NO_NETWORK is set
+ or url is untrusted
"""
if d.getVar("BB_NO_NETWORK", True) == "1":
raise NetworkAccess(url, info)
+ elif url is None and \
+ (d.getVarFlag('BB_ALLOWED_NETWORKS', d.expand(d.getVar('PN', False))) or \
+ d.getVar('BB_ALLOWED_NETWORKS', True)):
+ raise FetchError("cannot verify allowed hosts without URL")
+ elif not trusted_network(d, url):
+ raise UntrustedUrl(url, info)
+ elif info:
+ logger.debug(1, "Fetcher accessed the network with the command '%s'" % info)
else:
- logger.debug(1, "Fetcher accessed the network with the command %s" % info)
+ logger.debug(1, "Fetcher accessed the network")
p.s.
the logger texts (w/ or w/o 'info') in case of a successful check can most probably
written shorter with some fancy python oneliner-magic, but I am not such pro yet...
I wrote a simple patch that is available here: http://git.openembedded.org/openembedded-core-contrib/log/?h=marquiz/bitbake/fixes-10508 The forces all calls of check_network_access() to check that the URI is trusted (i.e. that it is not banned by BB_ALLOWED_NETWORKS). Basically, I think this would be the right thing to do. However, it causes multiple complications, e.g. git ls-remote may stop to work which badly breaks and "AUTOREV" packages. Similar breakages happens for "ls-remote" of other VCSes, too. Regarding Git update in the case that BB_ALLOWED_NETWORKS bans upstream source, I don't know what would be the right thing to do. The problem is that (AFAIU) bitbake only supports git mirrors through mirror tarballs and is not able to handle real git:// mirrors. Thinking to myself: I think the only thing we could reasonably do is delete/re-download/extract as you suggested. I don't know if Richard has any comments/ideas? (In reply to comment #2) > I don't know if Richard has any comments/ideas? FWIW I think the patch is the right thing to do... Patch sent for review: https://patchwork.openembedded.org/patch/134042/ |
We are using local mirrors on our local network, therefor not disabling global network access via BB_NO_NETWORK, but limiting the network access to our own servers only via BB_ALLOWED_NETWORKS. this does not work in case there is already an extracted git-tarball in the download directory but its content is outdated (e.g. the according tarball on the local mirror was updated). the (in this case git-)fetcher calls "bb.fetch2.check_network_access()" to verify that it is allowed to update the git repo from origin, but the implementation of check_network_access() only checks if BB_NO_NETWORK is not "1", it does not validate the given network address vs. any servers listed in BB_ALLOWED_NETWORKS in case BB_NO_NETWORK is "0"! in my opinion, check_network_access() should be enhanced like this: def check_network_access(d, info = "", url = None): """ log remote network access, and error if BB_NO_NETWORK is set or url is untrusted """ if d.getVar("BB_NO_NETWORK", True) == "1": raise NetworkAccess(url, info) elif not trusted_network(d, url): raise UntrustedUrl(url, info) else: logger.debug(1, "Fetcher accessed the network with the command %s" % info) p.s. this still does not solve the described bug, for this the local git-repo/-tarball should simply be deleted and re-downloaded/-extracted from the local mirror, but at least the build breaks with an "untrusted network" exception and no fetch from an untrusted source is happening!