From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 869B5C433E0 for ; Wed, 20 Jan 2021 03:50:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4153D22B42 for ; Wed, 20 Jan 2021 03:50:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728441AbhATDrJ (ORCPT ); Tue, 19 Jan 2021 22:47:09 -0500 Received: from mail.kernel.org ([198.145.29.99]:43752 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730603AbhATDoj (ORCPT ); Tue, 19 Jan 2021 22:44:39 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7FD7222573; Wed, 20 Jan 2021 03:43:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1611114238; bh=My3l9mdP5r74fya1/xnAAZLXmhSUL7ojLeSVLOTNDog=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DbaWzIoJzMhGisRPoUJyWfFtTpRHz3vN/9bm/lTku5twZIjB9Tm0kXHc/F+wN7Pvm whx4u6pCfuZkWKtYE+hmDf6AMiqYY5urEf9BgJItbyq7fwDm6DRCrZN0cOxEL2wHoe Pq8KSbQyrbDcIz+EP6UHY4R6Yp+z+KIFJ3n9YH624NHgQ/cH+jPk0FTwCgdVZgS+K4 DrMT0njz10faxAl1TJbxUMpOdsWPQMAGKp/XxpxGRigcidC0222FYZPkESndHKywln QzPVp4UtuhQNrzGWmtnH2PIJaQTxInxuN4GHbve1/Mpbb1VpWaYFGUlzw7IIoiMOml EUser7o/Fa7Ug== Date: Wed, 20 Jan 2021 05:43:52 +0200 From: Jarkko Sakkinen To: =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= Cc: David Howells , David Woodhouse , "David S . Miller" , Herbert Xu , James Morris , =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= , Mimi Zohar , "Serge E . Hallyn" , keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Ben Boeckel Subject: Re: [PATCH v3 02/10] certs: Fix blacklisted hexadecimal hash string check Message-ID: References: <20210114151909.2344974-1-mic@digikod.net> <20210114151909.2344974-3-mic@digikod.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20210114151909.2344974-3-mic@digikod.net> Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org On Thu, Jan 14, 2021 at 04:19:01PM +0100, Mickaël Salaün wrote: > From: Mickaël Salaün > > When looking for a blacklisted hash, bin2hex() is used to transform a > binary hash to an ascii (lowercase) hexadecimal string. This string is > then search for in the description of the keys from the blacklist > keyring. When adding a key to the blacklist keyring, > blacklist_vet_description() checks the hash prefix and the hexadecimal > string, but not that this string is lowercase. It is then valid to set > hashes with uppercase hexadecimal, which will be silently ignored by the > kernel. > > Add an additional check to blacklist_vet_description() to check that > hexadecimal strings are in lowercase. > > Cc: David Woodhouse > Signed-off-by: Mickaël Salaün > Signed-off-by: David Howells > Reviewed-by: Ben Boeckel > --- > > Changes since v2: > * Cherry-pick v1 patch from > https://lore.kernel.org/lkml/2659836.1607940186@warthog.procyon.org.uk/ > to rebase on v5.11-rc3. > * Rearrange Cc order. > --- > certs/blacklist.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/certs/blacklist.c b/certs/blacklist.c > index 2719fb2fbc1c..a888b934a1cd 100644 > --- a/certs/blacklist.c > +++ b/certs/blacklist.c > @@ -37,7 +37,7 @@ static int blacklist_vet_description(const char *desc) > found_colon: > desc++; > for (; *desc; desc++) { > - if (!isxdigit(*desc)) > + if (!isxdigit(*desc) || isupper(*desc)) > return -EINVAL; > n++; > } > -- > 2.30.0 > Shouldn't this rather convert the upper case to lower case? I don't like the ABI break that this causes. /Jarkko