Merge lp:~cyphermox/software-properties/lp1036839 into lp:software-properties

[Mathieu Trudel-Lapierre]

[lp:~cyphermox/software-properties/lp1036839]

788. By Mathieu Trudel-Lapierre on 2012-08-16

ppa: Update comment for LAUNCHPAD_PPA_CERT; we don't want people to ever set it
to None; which would mean "don't check certs".

[Marc Deslauriers (mdeslaur)]

Looks good, thanks! ACK

review: Approve

=== modified file 'add-apt-repository'
--- add-apt-repository	2012-07-10 08:55:00 +0000
+++ add-apt-repository	2012-08-16 18:51:31 +0000
@@ -17,7 +17,8 @@
 try:
     from urllib.error import HTTPError, URLError
 except ImportError:
-    from urllib2 import HTTPError, URLError
+    import pycurl
+    HTTPError = pycurl.error
 
 def _maybe_suggest_ppa_name_based_on_user(user):
     try:
@@ -109,7 +110,7 @@
 
     # display PPA info (if needed)
     if line.startswith("ppa:") and not options.assume_yes:
-        from softwareproperties.ppa import get_ppa_info_from_lp, LAUNCHPAD_PPA_API
+        from softwareproperties.ppa import PPAException, get_ppa_info_from_lp, LAUNCHPAD_PPA_API
         user, sep, ppa_name = line.split(":")[1].partition("/")
         ppa_name = ppa_name or "ppa"
         try:
@@ -123,7 +124,7 @@
             # exists. If it exists, list down the PPAs
             _maybe_suggest_ppa_name_based_on_user(user)
             sys.exit(1)
-        except (ValueError, URLError):
+        except (ValueError, PPAException):
             print(_("Cannot access PPA (%s) to get PPA information, "
                     "please check your internet connection.") % \
                 (LAUNCHPAD_PPA_API % (user, ppa_name)))

=== modified file 'debian/changelog'
--- debian/changelog	2012-08-15 07:11:41 +0000
+++ debian/changelog	2012-08-16 18:51:31 +0000
@@ -5,7 +5,14 @@
     - Fixed the source code checkbox and the submit statistics 
       checkbox labels to be left-aligned instead of centered.
 
- -- Michael Vogt <[e-mail]>  Wed, 15 Aug 2012 09:10:56 +0200
+  [ Mathieu Trudel-Lapierre ]
+  * Reinstate pycurl to use for getting PPA information from Launchpad, since
+    it can actually verify SSL certificates with python2. Also set
+    LAUNCHPAD_PPA_CERT so that it's a valid path to the system CA certificates
+    bundle to use for urllib and pycurl. (LP: #1036839)
+    - CVE-2012-0955
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Wed, 15 Aug 2012 13:18:05 -0400
 
 software-properties (0.91) quantal; urgency=low
 

=== modified file 'softwareproperties/ppa.py'
--- softwareproperties/ppa.py	2012-07-05 13:32:44 +0000
+++ softwareproperties/ppa.py	2012-08-16 18:51:31 +0000
@@ -28,18 +28,31 @@
 from threading import Thread
 
 try:
-  import urllib.request as urllib2
+  import urllib.request
   from urllib.error import URLError
   import urllib.parse
 except ImportError:
-  import urllib2
+  import pycurl
 
 DEFAULT_KEYSERVER = "hkp://keyserver.ubuntu.com:80/"
 # maintained until 2015
 LAUNCHPAD_PPA_API = 'https://launchpad.net/api/1.0/~%s/+archive/%s'
-# None means use the system default SSL store.
-# Otherwise a path to a file is expected (as a bundle of certs)
-LAUNCHPAD_PPA_CERT = None
+# Specify to use the system default SSL store; change to a different path
+# to test with custom certificates.
+LAUNCHPAD_PPA_CERT = "/etc/ssl/certs/ca-certificates.crt"
+
+class CurlCallback:
+    def __init__(self):
+        self.contents = ''
+
+    def body_callback(self, buf):
+        self.contents = self.contents + buf
+
+class PPAException(Exception):
+    def __init__(self, value):
+        self.value = value
+    def __str__(self):
+        return repr(self.value)
 
 def encode(s):
     return re.sub("[^a-zA-Z0-9_-]","_", s)
@@ -70,12 +83,32 @@
     # we ask for a JSON structure from lp_page, we could use
     # simplejson, but the format is simple enough for the regexp
     # only useful for testing
-    request = urllib2.Request(str(lp_url), headers={"Accept":" application/json"})
     try:
-        lp_page = urllib2.urlopen(request, cafile=LAUNCHPAD_PPA_CERT)
-    except TypeError:
-        lp_page = urllib2.urlopen(request)
-    return json.loads(lp_page.read().decode("utf-8", "strict"))
+        try:
+            request = urllib.request.Request(str(lp_url), headers={"Accept":" application/json"})
+            lp_page = urllib.request.urlopen(request, cafile=LAUNCHPAD_PPA_CERT)
+            json_data = lp_page.read().decode("utf-8", "strict")
+        except URLError as e:
+            raise PPAException("Error reading %s: %s" % (lp_url, e.reason))
+    except PPAException:
+        raise
+    except:
+        try:
+            callback = CurlCallback()
+            curl = pycurl.Curl()
+            curl.setopt(pycurl.SSL_VERIFYPEER, 1)
+            curl.setopt(pycurl.SSL_VERIFYHOST, 2)
+            curl.setopt(pycurl.WRITEFUNCTION, callback.body_callback)
+            if LAUNCHPAD_PPA_CERT:
+                curl.setopt(pycurl.CAINFO, LAUNCHPAD_PPA_CERT)
+            curl.setopt(pycurl.URL, str(lp_url))
+            curl.setopt(pycurl.HTTPHEADER, ["Accept: application/json"])
+            curl.perform()
+            curl.close()
+            json_data = callback.contents
+        except pycurl.error as e:
+            raise PPAException("Error reading %s: %s" % (lp_url, e[1]))
+    return json.loads(json_data)
 
 class AddPPASigningKeyThread(Thread):
     " thread class for adding the signing key in the background "
@@ -98,8 +131,8 @@
         owner_name, ppa_name, distro = ppa_path[1:].split('/')
         try:
             ppa_info = get_ppa_info_from_lp(owner_name, ppa_name)
-        except URLError as e:
-            print("Error reading %s: %s" % (lp_url, e.strerror))
+        except PPAException as e:
+            print(e.value)
             return False
         try:
             signing_key_fingerprint = ppa_info["signing_key_fingerprint"]