Mercurial > dropbear
annotate fuzz-common.c @ 1357:08f4fa4dc6a0 fuzz
closer to working
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Sat, 20 May 2017 13:23:16 +0800 |
| parents | 3677a510f545 |
| children | 6b89eb92f872 |
| rev | line source |
|---|---|
| 1348 | 1 #include "includes.h" |
| 2 | |
| 3 #include "includes.h" | |
| 4 #include "fuzz.h" | |
| 5 #include "dbutil.h" | |
| 6 #include "runopts.h" | |
| 1353 | 7 #include "crypto_desc.h" |
| 8 #include "session.h" | |
|
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
9 #include "dbrandom.h" |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
10 #include "fuzz-wrapfd.h" |
| 1348 | 11 |
| 12 struct dropbear_fuzz_options fuzz; | |
| 13 | |
| 14 static void load_fixed_hostkeys(void); | |
| 15 | |
| 16 static void common_setup_fuzzer(void) { | |
| 17 fuzz.fuzzing = 1; | |
| 1357 | 18 fuzz.wrapfds = 1; |
|
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
19 fuzz.input = m_malloc(sizeof(buffer)); |
| 1350 | 20 crypto_init(); |
| 1348 | 21 } |
| 22 | |
|
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
23 int fuzzer_set_input(const uint8_t *Data, size_t Size) { |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
24 |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
25 fuzz.input->data = (unsigned char*)Data; |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
26 fuzz.input->size = Size; |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
27 fuzz.input->len = Size; |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
28 fuzz.input->pos = 0; |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
29 |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
30 // get prefix. input format is |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
31 // string prefix |
| 1357 | 32 // uint32 wrapfd seed |
|
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
33 // ... to be extended later |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
34 // [bytes] ssh input stream |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
35 |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
36 // be careful to avoid triggering buffer.c assertions |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
37 if (fuzz.input->len < 8) { |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
38 return DROPBEAR_FAILURE; |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
39 } |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
40 size_t prefix_size = buf_getint(fuzz.input); |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
41 if (prefix_size != 4) { |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
42 return DROPBEAR_FAILURE; |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
43 } |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
44 uint32_t wrapseed = buf_getint(fuzz.input); |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
45 wrapfd_setup(wrapseed); |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
46 |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
47 seedrandom(); |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
48 |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
49 return DROPBEAR_SUCCESS; |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
50 } |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
51 |
|
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
52 |
| 1348 | 53 void svr_setup_fuzzer(void) { |
| 54 struct passwd *pw; | |
| 55 | |
| 56 common_setup_fuzzer(); | |
| 1353 | 57 |
| 58 _dropbear_exit = svr_dropbear_exit; | |
| 59 _dropbear_log = svr_dropbear_log; | |
| 1348 | 60 |
| 61 char *argv[] = { | |
| 62 "-E", | |
| 63 }; | |
| 64 | |
| 65 int argc = sizeof(argv) / sizeof(*argv); | |
| 66 svr_getopts(argc, argv); | |
| 67 | |
| 68 /* user lookups might be slow, cache it */ | |
| 69 pw = getpwuid(getuid()); | |
| 70 dropbear_assert(pw); | |
| 71 fuzz.pw_name = m_strdup(pw->pw_name); | |
| 72 fuzz.pw_dir = m_strdup(pw->pw_dir); | |
| 73 fuzz.pw_shell = m_strdup(pw->pw_shell); | |
| 74 fuzz.pw_passwd = m_strdup("!!zzznope"); | |
| 75 | |
| 76 load_fixed_hostkeys(); | |
| 77 } | |
| 78 | |
| 79 static void load_fixed_hostkeys(void) { | |
| 80 #include "fuzz-hostkeys.c" | |
| 81 | |
| 82 buffer *b = buf_new(3000); | |
| 83 enum signkey_type type; | |
| 84 | |
| 85 TRACE(("load fixed hostkeys")) | |
| 86 | |
| 87 svr_opts.hostkey = new_sign_key(); | |
| 88 | |
| 89 buf_setlen(b, 0); | |
| 90 buf_putbytes(b, keyr, keyr_len); | |
| 91 buf_setpos(b, 0); | |
| 92 type = DROPBEAR_SIGNKEY_RSA; | |
| 93 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) { | |
| 94 dropbear_exit("failed fixed rsa hostkey"); | |
| 95 } | |
| 96 | |
| 97 buf_setlen(b, 0); | |
| 98 buf_putbytes(b, keyd, keyd_len); | |
| 99 buf_setpos(b, 0); | |
| 100 type = DROPBEAR_SIGNKEY_DSS; | |
| 101 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) { | |
| 102 dropbear_exit("failed fixed dss hostkey"); | |
| 103 } | |
| 104 | |
| 105 buf_setlen(b, 0); | |
| 106 buf_putbytes(b, keye, keye_len); | |
| 107 buf_setpos(b, 0); | |
| 108 type = DROPBEAR_SIGNKEY_ECDSA_NISTP256; | |
| 109 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) { | |
| 110 dropbear_exit("failed fixed ecdsa hostkey"); | |
| 111 } | |
| 112 | |
| 113 buf_free(b); | |
| 114 } | |
| 115 | |
| 1357 | 116 void fuzz_kex_fakealgos(void) { |
| 117 ses.newkeys->recv.crypt_mode = &dropbear_mode_none; | |
| 118 } |