Client: Freeze attack issue - expiry of metadata may not be detected

[awwad]

TLDR: There's a scenario in which expiration of unchanged metadata files may not be detected.

There's a broken assumption in updater.py:

"Due to the way in which metadata files are updated, it is expected that 'referenced_metadata' is not out of date and trusted."

This is actually not true: It is not guaranteed that 'referenced_metadata' expiration is detected.

Expiration checks are currently conducted (ensure_not_expired) when the metadata file is downloaded. If no new metadata file is downloaded, no expiry check occurs. (Exception: root is checked for expiration at the beginning of each refresh() cycle, and timestamp is always checked because it is always fetched.) Snapshot and targets are never checked if the user does not have evidence that they have changed.

You can play this out in this scenario:

• Malicious Mirror Mal with compromised timestamp key is the first repository in your list of repositories to check.
• Every time you try to update, you get a new timestamp file from Mal, always pointing to an old version of snapshot. (Currently, this can be even be older than the version you currently hold (negative 1, say) due to Issue Client: When repo provides metadata w/ version < what client already has, that is not logged. #316.)
• While you do validate the timestamp signature, you do NOT update snapshot or any of the targets, and you do NOT check any of those metadata files for expiry, and so you do NOT report such expiry to the user.

User never finds out if their snapshot or target* metadata expires (unless they actually fetch an expired version from a server) - only when their root expires (or someone discovers Mal and revokes that timestamp key and they finally move on to a new repository).

To fix this, an expiry check on the metadata you already have should be performed here, when a metadata file is found to not need to be downloaded.

.... As a separate issue, this kinda prompts me in the direction of wanting to fetch more than just the first repository's timestamp. That's a big design thing, though.