/* Test rejection of ill-formed password hashes. Copyright (C) 2012-2018 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. The GNU C Library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with the GNU C Library; if not, see . */ #include "crypt-port.h" #undef yescrypt #include #include #include #include #include #include /* If VERBOSE is true, passing testcases will be printed out as well as failing ones. */ static bool verbose = false; /* All hashes are hashes of this passphrase, an infamous error message used for some forgotten can't-happen condition in Unix V6; see . */ static const char phrase[] = "values of β will give rise to dom!"; /* Correct setting strings, from which we derive incorrect ones by replacing one character at a time with a character that cannot appear in a valid passphrase (namely ':') and/or truncating the string. */ struct valid_setting; /* Type of functions to use in is_valid_trunc. */ typedef bool (*valid_trunc_p)(const struct valid_setting *original, const char *truncated); struct valid_setting { /* Human-readable name for this test */ const char *tag; /* The setting string */ const char *setting; /* Length of the actual setting, within the setting string. This is usually equal to strlen(setting), but a couple of the strings are padded on the right for hash-specific reasons. */ size_t setting_len; /* Given a truncation of a valid setting string, decide whether the truncation is also valid. */ valid_trunc_p is_valid_trunc; /* Numeric parameter for is_valid_trunc; usually the length of a subfield of the setting. */ uint16_t is_valid_trunc_param; /* Whether support for this hash was compiled into the library. */ bool enabled; }; /* is_valid_trunc functions -- forward declarations */ static bool vt_never(const struct valid_setting *, const char *); static bool vt_varsuffix(const struct valid_setting *, const char *); static bool vt_sunmd5(const struct valid_setting *, const char *); static bool vt_sha2gnu(const struct valid_setting *, const char *); static bool vt_yescrypt(const struct valid_setting *, const char *); /* shorthands for use in valid_cases */ #define V_( hash, setting, vt, vp) \ { #hash, setting, sizeof setting - 1, vt, vp, INCLUDE_##hash } #define Vp_( hash, setting, vt, vp) \ { #hash, setting, vp, vt, vp, INCLUDE_##hash } #define Vt_( hash, tag, setting, vt, vp) \ { #hash " (" #tag ")", setting, sizeof setting - 1, vt, vp, INCLUDE_##hash } #define Vtp_(hash, tag, setting, vt, vp) \ { #hash " (" #tag ")", setting, vp, vt, vp, INCLUDE_##hash } #define V( hash, setting) V_( hash, setting, vt_never, 0) #define Vn( hash, vt, setting) V_( hash, setting, vt_##vt, 0) #define Vp( hash, sl, setting) Vp_( hash, setting, vt_varsuffix, sl) #define Vv( hash, sl, setting) V_( hash, setting, vt_varsuffix, sl) #define Vt( hash, tag, setting) Vt_( hash, tag, setting, vt_never, 0) #define Vtn(hash, tag, vt, setting) Vt_( hash, tag, setting, vt_##vt, 0) #define Vtp(hash, tag, sl, setting) Vtp_(hash, tag, setting, vt_varsuffix, sl) #define Vtv(hash, tag, sl, setting) Vt_( hash, tag, setting, vt_varsuffix, sl) /* Each of these is a valid setting string for some algorithm, from which we will derive many invalid setting strings. This is an expensive test, so where possible, the number of "rounds" of the hash function has been set abnormally low. */ static const struct valid_setting valid_cases[] = { V (descrypt, "Mp" ), /* bigcrypt is extra special: this salt is a valid descrypt salt when bigcrypt isn't enabled but descrypt is; truncations down to 2 are valid when descrypt is enabled, but if *only* bigcrypt is enabled, then truncations can only go down to 14. */ { INCLUDE_bigcrypt ? "bigcrypt" : "descrypt (padded)", "Mp............", 2, vt_varsuffix, INCLUDE_descrypt ? 2 : 14, INCLUDE_descrypt || INCLUDE_bigcrypt }, V (bsdicrypt, "_J9..MJHn" ), Vv (md5crypt, 3, "$1$MJHnaAke$" ), Vtn(sunmd5, plain, sunmd5, "$md5$1xMeE.at$" ), Vtn(sunmd5, rounds, sunmd5, "$md5,rounds=123$1xMeE.at$" ), Vt (nt, plain, "$3$" ), Vtp(nt, fake salt, 3, "$3$__not_used__c809a450df09a3" ), Vv (sha1crypt, 11, "$sha1$123$GGXpNqoJvglVTkGU$" ), Vtn(sha256crypt, plain, sha2gnu, "$5$MJHnaAkegEVYHsFK$" ), Vtn(sha256crypt, rounds, sha2gnu, "$5$rounds=1000$MJHnaAkegEVYHsFK$" ), Vtn(sha512crypt, plain, sha2gnu, "$6$MJHnaAkegEVYHsFK$" ), Vtn(sha512crypt, rounds, sha2gnu, "$6$rounds=1000$MJHnaAkegEVYHsFK$" ), V (bcrypt, "$2b$04$UBVLHeMpJ/QQCv3XqJx8zO" ), V (bcrypt_a, "$2a$04$UBVLHeMpJ/QQCv3XqJx8zO" ), V (bcrypt_x, "$2x$04$UBVLHeMpJ/QQCv3XqJx8zO" ), V (bcrypt_y, "$2y$04$UBVLHeMpJ/QQCv3XqJx8zO" ), Vv (scrypt, 14, "$7$C6..../....SodiumChloride$" ), Vn (yescrypt, yescrypt, "$y$j9T$PKXc3hCOSyMqdaEQArI62/$" ), Vn (gost_yescrypt, yescrypt, "$gy$j9T$PKXc3hCOSyMqdaEQArI62/$" ), }; #undef V_ #undef Vp_ #undef Vt_ #undef Vtp_ #undef V #undef Vn #undef Vp #undef Vv #undef Vt #undef Vtn #undef Vtp #undef Vtv /* Additional tests of manually constructed, invalid setting strings. */ struct invalid_setting { const char *tag; const char *setting; }; static const struct invalid_setting invalid_cases[] = { /* These strings are invalid regardless of the algorithm. */ { "too short 1", "/" }, { "too short 2", "M" }, { "too short 3", "$" }, { "too short 4", "_" }, { "too short 5", "." }, { "invalid char :", ":" }, { "invalid char ;", ";" }, { "invalid char *", "*" }, { "invalid char !", "!" }, { "invalid char \\", "\\" }, { "invalid char SPC", " " }, { "invalid char TAB", "\t" }, { "invalid char ^M", "\r" }, { "invalid char ^J", "\n" }, { "invalid char ^L", "\f" }, { "invalid char ^A", "\001" }, { "invalid char DEL", "\177" }, { "failure token 1", "*0" }, { "failure token 2", "*1" }, { "unsupported algorithm", "$un$upp0rt3d$" }, { "empty string", "" }, /* These strings are invalid for specific algorithms, in ways that the generic error generator cannot produce. */ { "sunmd5 absent rounds", "$md5,rounds=$1xMeE.at$" }, { "sunmd5 low rounds", "$md5,rounds=0$1xMeE.at$" }, { "sunmd5 octal rounds", "$md5,rounds=012$1xMeE.at$" }, { "sunmd5 high rounds", "$md5,rounds=4294967296$1xMeE.at$" }, { "sha256 absent rounds", "$5$rounds=$MJHnaAkegEVYHsFK$" }, { "sha256 low rounds", "$5$rounds=0$MJHnaAkegEVYHsFK$" }, { "sha256 octal rounds", "$5$rounds=0100$MJHnaAkegEVYHsFK$" }, { "sha256 high rounds", "$5$rounds=4294967295$MJHnaAkegEVYHsFK$" }, { "sha512 absent rounds", "$6$rounds=$MJHnaAkegEVYHsFK$" }, { "sha512 low rounds", "$6$rounds=0$MJHnaAkegEVYHsFK$" }, { "sha512 octal rounds", "$6$rounds=0100$MJHnaAkegEVYHsFK$" }, { "sha512 high rounds", "$6$rounds=4294967295$MJHnaAkegEVYHsFK$" }, { "bcrypt no subtype", "$2$04$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_b low rounds", "$2b$03$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_b high rounds", "$2b$32$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_a low rounds", "$2a$03$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_a high rounds", "$2a$32$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_x low rounds", "$2x$03$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_x high rounds", "$2x$32$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_y low rounds", "$2y$03$UBVLHeMpJ/QQCv3XqJx8zO" }, { "bcrypt_y low rounds", "$2y$32$UBVLHeMpJ/QQCv3XqJx8zO" }, { "yescrypt short params", "$y$j9$PKXc3hCOSyMqdaEQArI62/$" }, { "gost-yescrypt short params", "$gy$j9$PKXc3hCOSyMqdaEQArI62/$" }, }; /* is_valid_trunc functions -- definitions. Note: these only need to be correct for the patterns we actually test. */ /* All truncations of this setting string are invalid. */ static bool vt_never(const struct valid_setting * ARG_UNUSED(original), const char * ARG_UNUSED(truncated)) { return false; } /* This setting string has a variable-length suffix; truncations are valid as long as the result has at least `is_valid_trunc_param' characters. */ static bool vt_varsuffix(const struct valid_setting *original, const char *truncated) { return strlen(truncated) >= original->is_valid_trunc_param; } /* Special validity rule for sunmd5, sha256crypt, and sha512crypt: ... */ static bool vt_roundseq(const char *truncated, size_t minlen, size_t roundslen, const char *roundstag1, const char *roundstag2) { /* ... the setting cannot be valid if it's shorter than 'minlen' characters ... */ if (strlen(truncated) < minlen) return false; /* ... if it begins with roundstag1 or roundstag2 then a sequence of digits must follow, then a dollar sign; roundstag2 may be null; ... */ if (!strncmp(truncated, roundstag1, roundslen) || (roundstag2 && !strncmp(truncated, roundstag2, roundslen))) { size_t i = roundslen; while (truncated[i] >= '0' && truncated[i] <= '9') i++; if (truncated[i] != '$') return false; } /* ... otherwise it's ok. */ return true; } /* Special validity rule for sunmd5. */ static bool vt_sunmd5(const struct valid_setting *ARG_UNUSED(original), const char *truncated) { return vt_roundseq(truncated, strlen("$md5$"), strlen("$md5,rounds="), "$md5,rounds=", 0); } /* Special validity rule for sha256crypt and sha512crypt. */ static bool vt_sha2gnu(const struct valid_setting *ARG_UNUSED(original), const char *truncated) { return vt_roundseq(truncated, strlen("$5$"), strlen("$5$rounds="), "$5$rounds=", "$6$rounds="); } /* Special validity rule for yescrypt and gost_yescrypt: ... */ static bool vt_yescrypt(const struct valid_setting *ARG_UNUSED(original), const char *truncated) { /* ... the setting string must begin with "$y$j9T$" or "$gy$j9T$" (other introductory sequences are possible but those are the only ones we use); ... */ size_t y_intro_len = strlen("$y$j9T$"); size_t gy_intro_len = strlen("$gy$j9T$"); size_t intro_len; if (!strncmp(truncated, "$y$j9T$", y_intro_len)) intro_len = y_intro_len; else if (!strncmp(truncated, "$gy$j9T$", gy_intro_len)) intro_len = gy_intro_len; else return false; /* ... and the remainder must be one of these lengths. (I do not see a pattern.) */ switch (strlen(truncated) - intro_len) { case 0: case 4: case 7: case 8: case 12: case 16: case 20: case 22: case 23: return true; default: return false; } } /* Some of the test setting strings contain unprintable characters, which we print as hex escapes. For readability, whenever we print out a setting string we pad it on the right with spaces to the length of the longest setting string we have. (There is always something after that on the line.) */ static size_t longest_setting; static void print_setting (const char *setting, bool pad) { size_t n = 0; for (; *setting; setting++) { unsigned int c = (unsigned int)(unsigned char) *setting; if (0x20 <= c && c <= 0x7e) { putchar ((int)c); n += 1; } else { printf ("\\x%02x", c); n += 4; } } if (!pad) return; while (n < longest_setting) { putchar (' '); n += 1; } } static size_t measure_setting (const char *setting) { size_t n = 0; for (; *setting; setting++) { unsigned int c = (unsigned int)(unsigned char) *setting; if (0x20 <= c && c <= 0x7e) n += 1; else n += 4; } return n; } static void measure_settings (void) { size_t ls = 0; for (size_t i = 0; i < ARRAY_SIZE (valid_cases); i++) ls = MAX (ls, measure_setting(valid_cases[i].setting)); for (size_t i = 0; i < ARRAY_SIZE (invalid_cases); i++) ls = MAX (ls, measure_setting(invalid_cases[i].setting)); longest_setting = ls; } static void print_result (const char *result, const char *setting, const char *tag, bool expected_valid) { printf ("%s: ", result); print_setting (setting, true); printf (" (%s, %s)", tag, expected_valid ? "valid" : "invalid"); } /* Part of what we're testing, is whether any of the hashing methods can read past the end of a properly terminated C string that happens to contain an invalid setting. We do this by placing the invalid setting right next to a page of inaccessible memory and trapping the fault. */ static volatile sig_atomic_t signal_loop = 0; static sigjmp_buf env; static void segv_handler (int sig) { if (signal_loop == 0) { signal_loop = 1; siglongjmp (env, sig); } else { signal (sig, SIG_DFL); raise (sig); } } /* We use only crypt_rn in this test, because it only exercises the error handling logic within the hashing methods, not the higher-level error handling logic that varies slightly among the entry points (that's all taken care of in crypt-badargs.c). We use crypt_rn instead of crypt_r so that this test does not need to vary any of its logic based on --enable-failure-tokens. */ static bool test_one_setting (const char *setting, size_t l_setting, const char *tag, bool expected_valid, struct crypt_data *cd) { volatile bool fail = false; signal_loop = 0; int sig = sigsetjmp (env, 1); if (!sig) { char *retval = crypt_rn (phrase, setting, cd, (int) sizeof *cd); if (expected_valid) { if (!retval) { fail = true; print_result ("FAIL", setting, tag, expected_valid); puts(": returned NULL"); } else if (retval != cd->output) { fail = true; print_result ("FAIL", setting, tag, expected_valid); printf(": returned %p, should be %p\n", (const void *)retval, (const void *)cd->output); } else if (strncmp (retval, setting, l_setting)) { fail = true; print_result("FAIL", setting, tag, expected_valid); fputs(": got non-matching ", stdout); print_setting(retval, false); putchar('\n'); } } else { if (retval) { fail = true; print_result ("FAIL", setting, tag, expected_valid); fputs(": expected NULL, got ", stdout); print_setting (retval, false); putchar('\n'); } } } else { fail = true; print_result("FAIL", setting, tag, expected_valid); printf(": %s\n", strsignal (sig)); } if (verbose && !fail) { print_result("PASS", setting, tag, expected_valid); putchar('\n'); } return fail; } static bool test_one_valid(const struct valid_setting *tc, char *page, size_t pagesize, struct crypt_data *cd) { /* Caution: tc->setting_len is _not_ always equal to strlen(tc->setting). Sometimes it is smaller. */ size_t l_setting = strlen(tc->setting) + 1; char *setting = page + pagesize - l_setting; memcpy(setting, tc->setting, l_setting); /* crypt_rn() using this setting, unmodified, is expected to succeed, unless the hash function is disabled. */ if (test_one_setting (setting, tc->setting_len, tc->tag, tc->enabled, cd)) return true; /* Rechecking the hash with the full output should also succeed. In this subtest we expect to get the same _complete hash_ back out, not just the same setting. */ if (tc->enabled) { size_t l_hash = strlen (cd->output); char *p = page + pagesize - (l_hash + 1); assert (l_hash + 1 <= CRYPT_OUTPUT_SIZE); memcpy (p, cd->output, l_hash + 1); if (test_one_setting (p, l_hash, tc->tag, true, cd)) return true; /* When crypt() is called with a complete hashed passphrase as the setting string, the hashing method must not look at the hash component of the setting _at all_. We test this by supplying a string with one extra character, an A, which _could_ be part of the hash component for all supported methods, but which is much too short by itself. This should produce the same complete hash as the previous test. (It has to be a character which _could_ appear, because the generic crypt() machinery rejects setting strings containing invalid characters in any position.) Super special case: Don't do this subtest for sunmd5, because, due to a bug in its original implementation, the first character after the end of the salt _does_ affect the hash output. We have to preserve this bug for compatibility with existing sunmd5 hashed passphrases. */ if (!INCLUDE_sunmd5 || strncmp(tc->setting, "$md5", 4)) { p = page + pagesize - (l_hash + 1 + l_setting + 1); memcpy (p, cd->output, l_hash + 1); char *settingA = page + pagesize - (l_setting + 1); memcpy(settingA, tc->setting, l_setting - 1); settingA[l_setting - 1] = 'A'; settingA[l_setting - 0] = '\0'; if (test_one_setting (settingA, tc->setting_len, tc->tag, true, cd)) return true; if (strcmp (cd->output, p)) { print_result ("FAIL", settingA, tc->tag, true); /* Since cd->output and p are both hashed passphrases, not handcrafted invalid setting strings, we can safely print them with %s. */ printf (": expected %s, got %s\n", p, cd->output); return true; } else if (verbose) { print_result ("PASS", settingA, tc->tag, true); printf (": got %s, as expected\n", cd->output); } } /* Restore the original data at 'setting', as expected by code below. */ memcpy(setting, tc->setting, l_setting); } /* The rest of the subtests in this function are logically independent. */ bool failed = false; /* Replacing any one character of this setting with a ':', leaving the rest of the string intact, should cause crypt_rn to fail. */ for (size_t i = 0; i < l_setting - 1; i++) { char saved = setting[i]; setting[i] = ':'; failed |= test_one_setting(setting, tc->setting_len, tc->tag, false, cd); setting[i] = saved; } /* Chop off the last character of the setting string and test that. Then, replace the new last character of the setting string with a colon, and test that. (This is different from the earlier test where we replaced each character in turn with a colon but kept the rest of the string intact, because the hashing method might be calling strlen() on the setting string.) Repeat these two steps until we have just one character left, then stop. For instance, if the original setting string is $1$MJHnaAke$ then we test $1$MJHnaAke $1$MJHnaAk: $1$MJHnaAk $1$MJHnaA: $1$MJHnaA ... $1 $: ($1$MJHnaAke: would have been tested by the loop above. All the single-character strings that can be a prefix of a setting string from valid_cases---"$", "_", "M"---are tested by invalid_cases, is ":".) Up till this point l_setting has been _one more than_ strlen(setting), but in this loop it is more convenient to have it be equal to strlen(setting). */ l_setting -= 1; while (l_setting > 2) { memmove(setting + 1, setting, l_setting - 1); setting += 1; l_setting -= 1; failed |= test_one_setting(setting, MIN (l_setting, tc->setting_len), tc->tag, tc->enabled && tc->is_valid_trunc(tc, setting), cd); page[pagesize - 2] = ':'; failed |= test_one_setting(setting, l_setting, tc->tag, false, cd); } return failed; } static bool test_one_invalid(const struct invalid_setting *tc, char *page, size_t pagesize, struct crypt_data *cd) { size_t l_setting = strlen(tc->setting) + 1; char *setting = page + pagesize - l_setting; memcpy(setting, tc->setting, l_setting); return test_one_setting(setting, l_setting - 1, tc->tag, false, cd); } static bool do_tests(char *page, size_t pagesize) { bool failed = false; struct crypt_data cd; memset (&cd, 0, sizeof cd); for (size_t i = 0; i < ARRAY_SIZE (valid_cases); i++) failed |= test_one_valid (&valid_cases[i], page, pagesize, &cd); for (size_t i = 0; i < ARRAY_SIZE (invalid_cases); i++) failed |= test_one_invalid (&invalid_cases[i], page, pagesize, &cd); return failed; } int main (int argc, char **argv) { if (argc <= 1) ; else if (argc == 2 && (!strcmp(argv[1], "-v") || !strcmp(argv[1], "--verbose"))) verbose = true; else { fprintf(stderr, "usage: %s [-v | --verbose]\n", argv[0]); return 99; } if (setvbuf(stdout, 0, _IOLBF, 0) || setvbuf(stderr, 0, _IOLBF, 0)) { perror ("setvbuf"); return 99; } /* Set up a two-page region whose first page is read-write and whose second page is inaccessible. */ long pagesize_l = sysconf (_SC_PAGESIZE); if (pagesize_l < (long) CRYPT_OUTPUT_SIZE) { printf ("ERROR: pagesize of %ld is too small\n", pagesize_l); return 99; } size_t pagesize = (size_t) pagesize_l; char *page = mmap (0, pagesize * 2, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0); if (page == MAP_FAILED) { perror ("mmap"); return 99; } memset (page, 'x', pagesize * 2); if (mprotect (page + pagesize, pagesize, PROT_NONE)) { perror ("mprotect"); return 99; } struct sigaction sa, os, ob; sigfillset (&sa.sa_mask); sa.sa_flags = SA_RESTART; sa.sa_handler = segv_handler; if (sigaction (SIGBUS, &sa, &ob) || sigaction (SIGSEGV, &sa, &os)) { perror ("sigaction"); return 1; } measure_settings(); bool failed = do_tests (page, pagesize); sigaction (SIGBUS, &ob, 0); sigaction (SIGSEGV, &os, 0); return failed; }