ltp: AF_ALG test helpers and a few regression tests

Hello,

This series adds helper functions for testing AF_ALG (the userspace interface to algorithms in the Linux kernel's crypto API) to the Linux Test Project. It then adds a few sample regression tests.

I've had these patches sitting around for a while with the goal of also writing some "real" tests that test for more than these specific bugs, but haven't gotten around to it yet. And I now consider further improving the in-kernel crypto self-tests to be a higher priority. But I figured I'd send this out as-is in case people are interested in having this merged, e.g. maybe other people want to add AF_ALG tests to LTP too and the 'tst_af_alg' lib would be a good starting point.

Changed since v1:

- Define 'AF_ALG' in include/lapi/socket.h if undefined. Also move 'SOL_ALG' definition to there.

- Add all new tests to runtest/crypto.

- In af_alg01, use .test() and .tcnt rather than a 'for' loop.

- Consistently use 'algfd' rather than 'alg_fd', and similarly for reqfd.

- Make two error messages in tst_af_alg.c clearer.

- Add SPDX license identifier to include/lapi/if_alg.h.

Eric Biggers (6):
lib: add tst_af_alg lib
crypto/af_alg01: new regression test for hmac nesting bug crypto/af_alg02: new regression test for salsa20 empty message bug crypto/af_alg03: new regression test for rfc7539 hash alg validation crypto/af_alg04: new regression test for vmac race conditions crypto/af_alg05: new regression test for skcipher_walk error bug

 configure.ac                       |   1 +
 include/lapi/if_alg.h              |  38 ++++++++
 include/lapi/socket.h              |   8 ++
 include/tst_af_alg.h               | 136 ++++++++++++++++++++++++++
 lib/tst_af_alg.c                   | 147 +++++++++++++++++++++++++++++
 runtest/crypto                     |   5 +
 runtest/cve                        |   2 +
 testcases/kernel/crypto/.gitignore |   5 +
 testcases/kernel/crypto/af_alg01.c |  78 +++++++++++++++
 testcases/kernel/crypto/af_alg02.c |  29 ++++++
 testcases/kernel/crypto/af_alg03.c |  31 ++++++
 testcases/kernel/crypto/af_alg04.c |  56 +++++++++++
 testcases/kernel/crypto/af_alg05.c |  43 +++++++++
 13 files changed, 579 insertions(+)
 create mode 100644 include/lapi/if_alg.h
 create mode 100644 include/tst_af_alg.h
 create mode 100644 lib/tst_af_alg.c
 create mode 100644 testcases/kernel/crypto/af_alg01.c
 create mode 100644 testcases/kernel/crypto/af_alg02.c
 create mode 100644 testcases/kernel/crypto/af_alg03.c
 create mode 100644 testcases/kernel/crypto/af_alg04.c
 create mode 100644 testcases/kernel/crypto/af_alg05.c

2.21.0.225.g810b269d1ac-goog

From: Eric Biggers <[email protected]>

Add helper functions for creating and using AF_ALG sockets. AF_ALG is the userspace interface to algorithms in the Linux kernel's crypto API. See https://www.kernel.org/doc/html/latest/crypto/userspace-if.html for more information about this interface.

---
 configure.ac          |   1 +
 include/lapi/if_alg.h |  38 +++++++++++
 include/lapi/socket.h |   8 +++
 include/tst_af_alg.h  | 136 ++++++++++++++++++++++++++++++++++++++
 lib/tst_af_alg.c      | 147 ++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 330 insertions(+)
 create mode 100644 include/lapi/if_alg.h
 create mode 100644 include/tst_af_alg.h
 create mode 100644 lib/tst_af_alg.c

index e73f7d92e..e002c248e 100644
@@ -40,6 +40,7 @@ AC_CHECK_HEADERS([ \
     linux/cryptouser.h \
     linux/genetlink.h \
     linux/keyctl.h \
+    linux/if_alg.h \
     linux/if_packet.h \
     linux/if_ether.h \
     linux/mempolicy.h \

new file mode 100644
index 000000000..5a74df99b
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright 2019 Google LLC
+ */
+
+#ifndef IF_ALG_H__
+#define IF_ALG_H__
+
+#ifdef HAVE_LINUX_IF_ALG_H
+#  include <linux/if_alg.h>
+#else
+#  include <stdint.h>
+
+struct sockaddr_alg {
+	uint16_t	salg_family;
+	uint8_t		salg_type[14];
+	uint32_t	salg_feat;
+	uint32_t	salg_mask;
+	uint8_t		salg_name[64];
+};
+
+struct af_alg_iv {
+	uint32_t	ivlen;
+	uint8_t		iv[0];
+};
+
+#define ALG_SET_KEY		1
+#define ALG_SET_IV		2
+#define ALG_SET_OP		3
+#define ALG_SET_AEAD_ASSOCLEN	4
+#define ALG_SET_AEAD_AUTHSIZE	5
+
+#define ALG_OP_DECRYPT		0
+#define ALG_OP_ENCRYPT		1
+
+#endif /* !HAVE_LINUX_IF_ALG_H */
+
+#endif /* IF_ALG_H__ */

index 4e856dfb3..2605443e8 100644
@@ -49,6 +49,10 @@
 # define SOCK_CLOEXEC 02000000
 #endif
 
+#ifndef AF_ALG
+# define AF_ALG		38
+#endif
+
 #ifndef SOL_SCTP
 # define SOL_SCTP	132
 #endif

@@ -61,4 +65,8 @@
 # define SOL_DCCP		269
 #endif
 
+#ifndef SOL_ALG
+# define SOL_ALG		279
+#endif
+
 #endif /* __LAPI_SOCKET_H__ */

2.21.0.225.g810b269d1ac-goog

From: Eric Biggers <[email protected]>

---
 runtest/crypto                     |  1 +
 runtest/cve                        |  1 +
 testcases/kernel/crypto/.gitignore |  1 +
 testcases/kernel/crypto/af_alg01.c | 78 ++++++++++++++++++++++++++++++
 4 files changed, 81 insertions(+)
 create mode 100644 testcases/kernel/crypto/af_alg01.c

index cdbc44cc8..45c8cdd2d 100644
@@ -1,2 +1,3 @@
+af_alg01 af_alg01
 pcrypt_aead01 pcrypt_aead01
 crypto_user01 crypto_user01

index 8f38045e9..f46c400cc 100644
@@ -27,6 +27,7 @@ cve-2017-15299 request_key03 -b cve-2017-15299
 cve-2017-15537 ptrace07
 cve-2017-15649 fanout01
 cve-2017-15951 request_key03 -b cve-2017-15951
+cve-2017-17806 af_alg01
 cve-2017-17807 request_key04
 cve-2017-1000364 stack_clash
 cve-2017-5754 meltdown

index 759592fbd..998af1728 100644
@@ -1,2 +1,3 @@
+af_alg01
 pcrypt_aead01
 crypto_user01

2.21.0.225.g810b269d1ac-goog

From: Eric Biggers <[email protected]>

---
 runtest/crypto                     |  1 +
 runtest/cve                        |  1 +
 testcases/kernel/crypto/.gitignore |  1 +
 testcases/kernel/crypto/af_alg02.c | 29 +++++++++++++++++++++++++++++
 4 files changed, 32 insertions(+)
 create mode 100644 testcases/kernel/crypto/af_alg02.c

index 45c8cdd2d..758586c19 100644
@@ -1,3 +1,4 @@
 af_alg01 af_alg01
+af_alg02 af_alg02
 pcrypt_aead01 pcrypt_aead01
 crypto_user01 crypto_user01

index f46c400cc..031bcdc2a 100644
@@ -27,6 +27,7 @@ cve-2017-15299 request_key03 -b cve-2017-15299
 cve-2017-15537 ptrace07
 cve-2017-15649 fanout01
 cve-2017-15951 request_key03 -b cve-2017-15951
+cve-2017-17805 af_alg02
 cve-2017-17806 af_alg01
 cve-2017-17807 request_key04
 cve-2017-1000364 stack_clash

index 998af1728..dc79f3275 100644
@@ -1,3 +1,4 @@
 af_alg01
+af_alg02
 pcrypt_aead01
 crypto_user01

new file mode 100644
index 000000000..a9e820423
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright 2019 Google LLC
+ */
+
+/*
+ * Regression test for commit ecaaab564978 ("crypto: salsa20 - fix
+ * blkcipher_walk API usage"), or CVE-2017-17805.  This test verifies that an
+ * empty message can be encrypted with Salsa20 without crashing the kernel.
+ */
+
+#include "tst_test.h"
+#include "tst_af_alg.h"
+
+static void run(void)
+{
+	char buf[16];
+	int reqfd = tst_alg_setup_reqfd("skcipher", "salsa20", NULL, 16);
+
+	/* With the bug the kernel crashed here */
+	if (read(reqfd, buf, 16) == 0)
+		tst_res(TPASS, "Successfully \"encrypted\" an empty message");
+	else
+		tst_res(TBROK, "read() didn't return 0");
+}
+
+static struct tst_test test = {
+	.test_all = run,
+};

2.21.0.225.g810b269d1ac-goog

From: Eric Biggers <[email protected]>

---
 runtest/crypto                     |  1 +
 testcases/kernel/crypto/.gitignore |  1 +
 testcases/kernel/crypto/af_alg03.c | 31 ++++++++++++++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100644 testcases/kernel/crypto/af_alg03.c

index 758586c19..03a49df3a 100644
@@ -1,4 +1,5 @@
 af_alg01 af_alg01
 af_alg02 af_alg02
+af_alg03 af_alg03
 pcrypt_aead01 pcrypt_aead01
 crypto_user01 crypto_user01

index dc79f3275..3e7936fc9 100644
@@ -1,4 +1,5 @@
 af_alg01
 af_alg02
+af_alg03
 pcrypt_aead01
 crypto_user01

new file mode 100644
index 000000000..240c52835
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright 2019 Google LLC
+ */
+
+/*
+ * Regression test for commit e57121d08c38 ("crypto: chacha20poly1305 - validate
+ * the digest size").  This test verifies that the rfc7539 template can't be
+ * instantiated with a hash algorithm whose digest size is not 16 bytes.
+ */
+
+#include "tst_test.h"
+#include "tst_af_alg.h"
+
+static void run(void)
+{
+	tst_require_alg("aead", "rfc7539(chacha20,poly1305)");
+	tst_require_alg("hash", "sha256");
+
+	if (tst_have_alg("aead", "rfc7539(chacha20,sha256)")) {
+		tst_res(TFAIL,
+			"instantiated rfc7539 template with wrong digest size");
+	} else {
+		tst_res(TPASS,
+			"couldn't instantiate rfc7539 template with wrong digest size");
+	}
+}
+
+static struct tst_test test = {
+	.test_all = run,
+};

2.21.0.225.g810b269d1ac-goog

From: Eric Biggers <[email protected]>

---
 runtest/crypto                     |  1 +
 testcases/kernel/crypto/.gitignore |  1 +
 testcases/kernel/crypto/af_alg04.c | 56 ++++++++++++++++++++++++++++++
 3 files changed, 58 insertions(+)
 create mode 100644 testcases/kernel/crypto/af_alg04.c

index 03a49df3a..b6180c417 100644
@@ -1,5 +1,6 @@
 af_alg01 af_alg01
 af_alg02 af_alg02
 af_alg03 af_alg03
+af_alg04 af_alg04
 pcrypt_aead01 pcrypt_aead01
 crypto_user01 crypto_user01

index 3e7936fc9..df6b7e73c 100644
@@ -1,5 +1,6 @@
 af_alg01
 af_alg02
 af_alg03
+af_alg04
 pcrypt_aead01
 crypto_user01

2.21.0.225.g810b269d1ac-goog

From: Eric Biggers <[email protected]>

---
 runtest/crypto                     |  1 +
 testcases/kernel/crypto/.gitignore |  1 +
 testcases/kernel/crypto/af_alg05.c | 43 ++++++++++++++++++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 testcases/kernel/crypto/af_alg05.c

index b6180c417..41ea7b81c 100644
@@ -2,5 +2,6 @@ af_alg01 af_alg01
 af_alg02 af_alg02
 af_alg03 af_alg03
 af_alg04 af_alg04
+af_alg05 af_alg05
 pcrypt_aead01 pcrypt_aead01
 crypto_user01 crypto_user01

index df6b7e73c..17faf3eef 100644
@@ -2,5 +2,6 @@ af_alg01
 af_alg02
 af_alg03
 af_alg04
+af_alg05
 pcrypt_aead01
 crypto_user01

2.21.0.225.g810b269d1ac-goog

Hi Eric,

The only minor issue is with missing SOL_ALG on older distros.

Going to push it with this fix including lapi/socket.h on lib/tst_af_alg.c and testcases/kernel/crypto/af_alg01.c.

Kind regards,
Petr

index 5cae85721..9ce1ca471 100644
@@ -9,6 +9,7 @@
 #define TST_NO_DEFAULT_MAIN
 #include "tst_test.h"
 #include "tst_af_alg.h"
+#include "lapi/socket.h"
 
 int tst_alg_create(void)
 {

index 1ce0e2508..bb6e01738 100644
@@ -14,6 +14,7 @@
 
 #include "tst_test.h"
 #include "tst_af_alg.h"
+#include "lapi/socket.h"
 
 static void test_with_hash_alg(const char *hash_algname)
 {

Hi Eric,

Merged with this small fix.

Kind regards,
Petr