diff --git a/dom0/aux-tools/qubes-receive-updates b/dom0/aux-tools/qubes-receive-updates index af386090..366066cc 100755 --- a/dom0/aux-tools/qubes-receive-updates +++ b/dom0/aux-tools/qubes-receive-updates @@ -20,6 +20,7 @@ # # import os +import os.path import re import sys import subprocess @@ -33,6 +34,7 @@ updates_rpm_dir = updates_dir + "/rpm" updates_repodata_dir = updates_dir + "/repodata" package_regex = re.compile(r"^[abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789._+-]{1,128}.rpm$") +gpg_ok_regex = re.compile(r"pgp md5 OK$") def dom0updates_fatal(msg): print >> sys.stderr, msg @@ -56,13 +58,16 @@ def handle_dom0updates(updatevm): subprocess.check_call(["/usr/lib/qubes/qfile-dom0-unpacker", str(os.getuid()), updates_rpm_dir]) # Verify received files for f in os.listdir(updates_rpm_dir): + full_path = updates_rpm_dir + "/" + f if package_regex.match(f): - p = subprocess.Popen (["/bin/rpm", "-K", updates_rpm_dir + "/" + f], + if os.path.islink(full_path) or not os.path.isfile(full_path): + dom0updates_fatal('Domain ' + source + ' sent not regular file') + p = subprocess.Popen (["/bin/rpm", "-K", full_path], stdout=subprocess.PIPE) output = p.communicate()[0] if p.returncode != 0: dom0updates_fatal('Error while verifing %s signature: %s' % (f, output)) - if output.find("pgp") < 0: + if not gpg_ok_regex.search(output.strip()): dom0updates_fatal('Domain ' + source + ' sent not signed rpm: ' + f) else: dom0updates_fatal('Domain ' + source + ' sent unexpected file: ' + f) diff --git a/dom0/qvm-core/qubes.py b/dom0/qvm-core/qubes.py index 62760803..4a9bb2cd 100755 --- a/dom0/qvm-core/qubes.py +++ b/dom0/qvm-core/qubes.py @@ -1452,8 +1452,7 @@ class QubesNetVm(QubesVm): "/local/domain/{0}/qubes_netvm_external_ip".format(xid) ] - command.append("r{0}".format(xid,xid)) - command.append("w{0}".format(xid,xid)) + command.append("n{0}".format(xid)) for id in self.__external_ip_allowed_xids: command.append("r{0}".format(id)) diff --git a/version_dom0 b/version_dom0 index 14781be7..e0380928 100644 --- a/version_dom0 +++ b/version_dom0 @@ -1 +1 @@ -1.6.30 +1.6.32