1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright 2019 Google LLC
4 * Copyright (c) Linux Test Project, 2019-2021
5 */
6
7 /*
8 * Regression test for commit af3ff8045bbf ("crypto: hmac - require that the
9 * underlying hash algorithm is unkeyed"), or CVE-2017-17806. This test
10 * verifies that the hmac template cannot be nested inside itself.
11 */
12
13 #include <errno.h>
14 #include <stdio.h>
15
16 #include "tst_test.h"
17 #include "tst_af_alg.h"
18 #include "lapi/socket.h"
19
test_with_hash_alg(const char * hash_algname)20 static void test_with_hash_alg(const char *hash_algname)
21 {
22 char hmac_algname[64];
23 char key[4096] = { 0 };
24
25 if (!tst_have_alg("hash", hash_algname))
26 return;
27
28 sprintf(hmac_algname, "hmac(%s)", hash_algname);
29 if (!tst_have_alg("hash", hmac_algname))
30 return;
31
32 sprintf(hmac_algname, "hmac(hmac(%s))", hash_algname);
33 if (tst_try_alg("hash", hmac_algname) != ENOENT) {
34 int algfd;
35
36 tst_res(TFAIL, "instantiated nested hmac algorithm ('%s')!",
37 hmac_algname);
38
39 /*
40 * Be extra annoying; with the bug, setting a key on
41 * "hmac(hmac(sha3-256-generic))" crashed the kernel.
42 */
43 algfd = tst_alg_setup("hash", hmac_algname, NULL, 0);
44 if (setsockopt(algfd, SOL_ALG, ALG_SET_KEY,
45 key, sizeof(key)) == 0) {
46 tst_res(TFAIL,
47 "set key on nested hmac algorithm ('%s')!",
48 hmac_algname);
49 }
50 } else {
51 tst_res(TPASS,
52 "couldn't instantiate nested hmac algorithm ('%s')",
53 hmac_algname);
54 }
55 }
56
57 /* try several different unkeyed hash algorithms */
58 static const char * const hash_algs[] = {
59 "md5", "md5-generic",
60 "sha1", "sha1-generic",
61 "sha224", "sha224-generic",
62 "sha256", "sha256-generic",
63 "sha3-256", "sha3-256-generic",
64 "sha3-512", "sha3-512-generic",
65 "sm3", "sm3-generic",
66 };
67
do_test(unsigned int i)68 static void do_test(unsigned int i)
69 {
70 test_with_hash_alg(hash_algs[i]);
71 }
72
73 static struct tst_test test = {
74 .test = do_test,
75 .tcnt = ARRAY_SIZE(hash_algs),
76 .tags = (const struct tst_tag[]) {
77 {"linux-git", "af3ff8045bbf"},
78 {"CVE", "2017-17806"},
79 {}
80 }
81 };
82