URL:
https://github.com/SSSD/sssd/pull/826
Title: #826: util/crypto/libcrypto: changed sss_hmac_sha1()
mzidek-rh commented:
"""
I just tried to do the following as part of testing.
I am already tired so, maybe I am just not seeing something, but I think the cypto-tests
in the unit tests suite are not working. I made these changes that should probably break
the function:
```
diff --git a/src/util/crypto/libcrypto/crypto_hmac_sha1.c
b/src/util/crypto/libcrypto/crypto_hmac_sha1.c
index 1499ace1b..ab26926a4 100644
--- a/src/util/crypto/libcrypto/crypto_hmac_sha1.c
+++ b/src/util/crypto/libcrypto/crypto_hmac_sha1.c
@@ -46,7 +46,7 @@ int sss_hmac_sha1(const unsigned char *key,
return ENOMEM;
}
- if (key_len > HMAC_SHA1_BLOCKSIZE) {
+ if (key_len < HMAC_SHA1_BLOCKSIZE) {
/* keys longer than blocksize are shortened */
if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) {
ret = EIO;
@@ -60,14 +60,14 @@ int sss_hmac_sha1(const unsigned char *key,
/* keys shorter than blocksize are zero-padded */
memcpy(ikey, key, key_len);
if (key_len < HMAC_SHA1_BLOCKSIZE) {
- memset(ikey + key_len, 0, HMAC_SHA1_BLOCKSIZE - key_len);
+ memset(ikey + key_len, 1, HMAC_SHA1_BLOCKSIZE - key_len);
}
}
/* HMAC(key, msg) = HASH(key XOR opad, HASH(key XOR ipad, msg)) */
- for (i = 0; i < HMAC_SHA1_BLOCKSIZE; i++) {
- okey[i] = ikey[i] ^ 0x5c;
- ikey[i] ^= 0x36;
+ for (i = 0; i > HMAC_SHA1_BLOCKSIZE; i++) {
+ okey[0] = ikey[i] ^ 0x5c;
+ ikey[0] ^= 0x36;
}
if (!EVP_DigestInit_ex(ctx, EVP_sha1(), NULL)) {
```
Just added a bunch of random "bugs".
But the tests still pass :/
My plan was to:
1. check if we have tests that use sss_hmac_sha1 function
2. break the function to see the tests fail (just checking if the tests are testing
something)
3. apply this PR and see if the tests pass
But it looks like the test is unbreakable for me :/
That being said, it says nothing about changes in this PR, and they are probably good.
Just wanted to note this.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/826#issuecomment-501837341