Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-28 Thread Dmitry Vyukov
On Fri, Nov 24, 2017 at 5:31 PM, Stephan Mueller wrote: > Am Freitag, 24. November 2017, 17:25:55 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> Eric also pointed me to grep. But I can't say the code is intuitive. >> I've spent way more time than I expected to just get a list of all >> algorithms

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Stephan Mueller
Am Freitag, 24. November 2017, 17:25:55 CET schrieb Dmitry Vyukov: Hi Dmitry, > Eric also pointed me to grep. But I can't say the code is intuitive. > I've spent way more time than I expected to just get a list of all > algorithms with their types. Say, in some cases algorithm descriptions > do n

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Dmitry Vyukov
On Fri, Nov 24, 2017 at 5:19 PM, Stephan Mueller wrote: > Am Freitag, 24. November 2017, 17:10:59 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> That's more-or-less what I did. Here: >> >> var allAlgs = map[int][]algDesc{ >> ALG_AEAD: []algDesc{ >> // templates: >> {"authencesn", []int{A

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Stephan Mueller
Am Freitag, 24. November 2017, 17:18:08 CET schrieb Dmitry Vyukov: Hi Dmitry, > > > {"rfc7539esp", []int{ALG_BLKCIPHER, ALG_HASH}}, > > {"rfc7539", []int{ALG_BLKCIPHER, ALG_HASH}}, > > {"rfc4543", []int{ALG_AEAD}}, > > {"rfc4106", []

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Stephan Mueller
Am Freitag, 24. November 2017, 17:10:59 CET schrieb Dmitry Vyukov: Hi Dmitry, > That's more-or-less what I did. Here: > > var allAlgs = map[int][]algDesc{ > ALG_AEAD: []algDesc{ > // templates: > {"authencesn", []int{ALG_HASH, ALG_BLKCIPHER}}, > {"gcm", []int{ALG_CIPHER}}, > > ALG

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Dmitry Vyukov
On Fri, Nov 24, 2017 at 4:03 PM, Stephan Mueller wrote: > Am Freitag, 24. November 2017, 14:49:49 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> I've cooked syzkaller change that teaches it to generate more >> algorithm names. Probably not idea, but much better than was before: >> https://github.c

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Dmitry Vyukov
On Fri, Nov 24, 2017 at 4:03 PM, Stephan Mueller wrote: > Am Freitag, 24. November 2017, 14:49:49 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> I've cooked syzkaller change that teaches it to generate more >> algorithm names. Probably not idea, but much better than was before: >> https://github.c

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Stephan Mueller
Am Freitag, 24. November 2017, 16:53:26 CET schrieb Dmitry Vyukov: Hi Dmitry, > > You cannot talk to the inner ciphers. You only talk to one cipher that you > > referred to with the name. Remember, the name is ONLY used to tell the > > kernel which parts to put together during allocation. After t

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Dmitry Vyukov
On Fri, Nov 24, 2017 at 4:13 PM, Stephan Mueller wrote: > Am Freitag, 24. November 2017, 15:55:59 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> On Fri, Nov 24, 2017 at 3:36 PM, Stephan Mueller > wrote: >> > Am Freitag, 24. November 2017, 14:49:49 CET schrieb Dmitry Vyukov: >> > >> > Hi Dmitry, >

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Stephan Mueller
Am Freitag, 24. November 2017, 15:55:59 CET schrieb Dmitry Vyukov: Hi Dmitry, > On Fri, Nov 24, 2017 at 3:36 PM, Stephan Mueller wrote: > > Am Freitag, 24. November 2017, 14:49:49 CET schrieb Dmitry Vyukov: > > > > Hi Dmitry, > > > >> On Thu, Nov 23, 2017 at 1:35 PM, Stephan Mueller > > > >

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Stephan Mueller
Am Freitag, 24. November 2017, 14:49:49 CET schrieb Dmitry Vyukov: Hi Dmitry, > I've cooked syzkaller change that teaches it to generate more > algorithm names. Probably not idea, but much better than was before: > https://github.com/google/syzkaller/blob/ddf7b3e0655cf6dfeacfe509e477c1486d2 > cc7

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Dmitry Vyukov
On Fri, Nov 24, 2017 at 3:36 PM, Stephan Mueller wrote: > Am Freitag, 24. November 2017, 14:49:49 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> On Thu, Nov 23, 2017 at 1:35 PM, Stephan Mueller > wrote: >> > Am Donnerstag, 23. November 2017, 12:34:54 CET schrieb Dmitry Vyukov: >> > >> > Hi Dmitry

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Stephan Mueller
Am Freitag, 24. November 2017, 14:49:49 CET schrieb Dmitry Vyukov: Hi Dmitry, > On Thu, Nov 23, 2017 at 1:35 PM, Stephan Mueller wrote: > > Am Donnerstag, 23. November 2017, 12:34:54 CET schrieb Dmitry Vyukov: > > > > Hi Dmitry, > > > >> Btw, I've started doing some minimal improvements, did

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-24 Thread Dmitry Vyukov
On Thu, Nov 23, 2017 at 1:35 PM, Stephan Mueller wrote: > Am Donnerstag, 23. November 2017, 12:34:54 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> Btw, I've started doing some minimal improvements, did not yet sorted >> out alg types/names, and fuzzer started scratching surface: >> >> WARNING: ke

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Stephan Mueller
Am Donnerstag, 23. November 2017, 12:34:54 CET schrieb Dmitry Vyukov: Hi Dmitry, > Btw, I've started doing some minimal improvements, did not yet sorted > out alg types/names, and fuzzer started scratching surface: > > WARNING: kernel stack regs has bad 'bp' value 77 Nov 23 2017 12:29:36 CET > g

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Stephan Mueller
Am Donnerstag, 23. November 2017, 12:27:30 CET schrieb Dmitry Vyukov: Hi Dmitry, > Hi Stephan, > > Thanks for the explanation! I am starting to digesting it. > > You say that: > > static const struct crypto_type crypto_skcipher_type2 = { > > > > .type = CRYPTO_ALG_TYPE_SKCIPHER, > > w

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Dmitry Vyukov
On Thu, Nov 23, 2017 at 12:27 PM, Dmitry Vyukov wrote: >> >> Hi Dmitry, >> >>> >> I've read the links and starring at the code, but still can't get it. >>> >> The question is about textual type names in sockaddr. >>> >> .cra_flags does not specify textual names. >>> >> [3] again talks about int fl

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Dmitry Vyukov
On Thu, Nov 23, 2017 at 12:10 PM, Stephan Mueller wrote: > Am Donnerstag, 23. November 2017, 10:37:35 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> >> I've read the links and starring at the code, but still can't get it. >> >> The question is about textual type names in sockaddr. >> >> .cra_flags

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Stephan Mueller
Am Donnerstag, 23. November 2017, 10:37:35 CET schrieb Dmitry Vyukov: Hi Dmitry, > >> I've read the links and starring at the code, but still can't get it. > >> The question is about textual type names in sockaddr. > >> .cra_flags does not specify textual names. > >> [3] again talks about int fla

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Dmitry Vyukov
On Thu, Nov 23, 2017 at 10:35 AM, Dmitry Vyukov wrote: > On Thu, Nov 23, 2017 at 10:32 AM, Dmitry Vyukov wrote: >> On Wed, Nov 22, 2017 at 6:08 PM, Stephan Mueller wrote: >>> Am Mittwoch, 22. November 2017, 11:44:51 CET schrieb Dmitry Vyukov: >>> >>> Hi Dmitry, >>> Thanks! I think we c

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Dmitry Vyukov
On Thu, Nov 23, 2017 at 10:32 AM, Dmitry Vyukov wrote: > On Wed, Nov 22, 2017 at 6:08 PM, Stephan Mueller wrote: >> Am Mittwoch, 22. November 2017, 11:44:51 CET schrieb Dmitry Vyukov: >> >> Hi Dmitry, >> >>> >>> Thanks! I think we can incorporate this into syzkaller. >>> >>> One question: what's

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-23 Thread Dmitry Vyukov
On Wed, Nov 22, 2017 at 6:08 PM, Stephan Mueller wrote: > Am Mittwoch, 22. November 2017, 11:44:51 CET schrieb Dmitry Vyukov: > > Hi Dmitry, > >> >> Thanks! I think we can incorporate this into syzkaller. >> >> One question: what's the relation between alg names and type ("aead", >> "hash", "rng",

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-22 Thread Stephan Mueller
Am Mittwoch, 22. November 2017, 18:03:14 CET schrieb Dmitry Vyukov: Hi Dmitry, > On Wed, Nov 22, 2017 at 5:54 PM, Stephan Mueller wrote: > > Am Dienstag, 21. November 2017, 21:46:28 CET schrieb Eric Biggers: > > > > Hi Eric, > > > >> (There is probably more to improve for AF_ALG besides the a

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-22 Thread Stephan Mueller
Am Mittwoch, 22. November 2017, 11:44:51 CET schrieb Dmitry Vyukov: Hi Dmitry, > > Thanks! I think we can incorporate this into syzkaller. > > One question: what's the relation between alg names and type ("aead", > "hash", "rng", "skcipher")? If you refer to AF_ALG, then the following applies:

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-22 Thread Dmitry Vyukov
On Wed, Nov 22, 2017 at 5:54 PM, Stephan Mueller wrote: > Am Dienstag, 21. November 2017, 21:46:28 CET schrieb Eric Biggers: > > Hi Eric, > >> >> (There is probably more to improve for AF_ALG besides the algorithm names; >> this is just what I happened to notice for now.) > > Just grepping may not

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-22 Thread Stephan Mueller
Am Dienstag, 21. November 2017, 21:46:28 CET schrieb Eric Biggers: Hi Eric, > > (There is probably more to improve for AF_ALG besides the algorithm names; > this is just what I happened to notice for now.) Just grepping may not cover all possibilities. Attached is a script that I use to invoke

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-22 Thread Dmitry Vyukov
On Tue, Nov 21, 2017 at 9:46 PM, Eric Biggers wrote: > On Tue, Nov 21, 2017 at 09:00:26AM +0100, Dmitry Vyukov wrote: >> > >> > Note that separate from asymmetric_keys (which you can think of as being >> > in-between the keyrings subsystem and the crypto subsystem) there is also >> > the >> > use

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-21 Thread Eric Biggers
On Tue, Nov 21, 2017 at 09:00:26AM +0100, Dmitry Vyukov wrote: > > > > Note that separate from asymmetric_keys (which you can think of as being > > in-between the keyrings subsystem and the crypto subsystem) there is also > > the > > userspace interface to cryptographic algorithms, AF_ALG. It mig

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-21 Thread Dmitry Vyukov
On Mon, Nov 20, 2017 at 10:42 PM, Eric Biggers wrote: > +Cc keyri...@vger.kernel.org (for asymmetric_keys) > > First of all, thanks for working on this! A lot of this code really needs to > be > better tested. > > On Mon, Nov 20, 2017 at 03:10:55PM +0100, Alexander Potapenko wrote: >> Hi all, >>

Re: x509 parsing bug + fuzzing crypto in the userspace

2017-11-20 Thread Eric Biggers
+Cc keyri...@vger.kernel.org (for asymmetric_keys) First of all, thanks for working on this! A lot of this code really needs to be better tested. On Mon, Nov 20, 2017 at 03:10:55PM +0100, Alexander Potapenko wrote: > Hi all, > > TL;DR userspace fuzzing may be very effective for finding bugs in