Mercurial > dropbear
annotate fuzz-common.c @ 1360:16f45f2df38f fuzz
ignore wrapfd_close for unknown
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Sun, 21 May 2017 10:48:18 +0800 |
parents | 6b89eb92f872 |
children | ddfcadca3c4c |
rev | line source |
---|---|
1348 | 1 #include "includes.h" |
2 | |
3 #include "includes.h" | |
4 #include "fuzz.h" | |
5 #include "dbutil.h" | |
6 #include "runopts.h" | |
1353 | 7 #include "crypto_desc.h" |
8 #include "session.h" | |
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
9 #include "dbrandom.h" |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
10 #include "fuzz-wrapfd.h" |
1348 | 11 |
12 struct dropbear_fuzz_options fuzz; | |
13 | |
14 static void load_fixed_hostkeys(void); | |
15 | |
16 static void common_setup_fuzzer(void) { | |
17 fuzz.fuzzing = 1; | |
1357 | 18 fuzz.wrapfds = 1; |
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
19 fuzz.input = m_malloc(sizeof(buffer)); |
1350 | 20 crypto_init(); |
1348 | 21 } |
22 | |
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
23 int fuzzer_set_input(const uint8_t *Data, size_t Size) { |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
24 |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
25 fuzz.input->data = (unsigned char*)Data; |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
26 fuzz.input->size = Size; |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
27 fuzz.input->len = Size; |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
28 fuzz.input->pos = 0; |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
29 |
1358
6b89eb92f872
glaring wrapfd problems fixed
Matt Johnston <matt@ucc.asn.au>
parents:
1357
diff
changeset
|
30 memset(&ses, 0x0, sizeof(ses)); |
6b89eb92f872
glaring wrapfd problems fixed
Matt Johnston <matt@ucc.asn.au>
parents:
1357
diff
changeset
|
31 memset(&svr_ses, 0x0, sizeof(svr_ses)); |
6b89eb92f872
glaring wrapfd problems fixed
Matt Johnston <matt@ucc.asn.au>
parents:
1357
diff
changeset
|
32 |
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
33 // get prefix. input format is |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
34 // string prefix |
1357 | 35 // uint32 wrapfd seed |
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
36 // ... to be extended later |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
37 // [bytes] ssh input stream |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
38 |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
39 // be careful to avoid triggering buffer.c assertions |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
40 if (fuzz.input->len < 8) { |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
41 return DROPBEAR_FAILURE; |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
42 } |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
43 size_t prefix_size = buf_getint(fuzz.input); |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
44 if (prefix_size != 4) { |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
45 return DROPBEAR_FAILURE; |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
46 } |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
47 uint32_t wrapseed = buf_getint(fuzz.input); |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
48 wrapfd_setup(wrapseed); |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
49 |
1358
6b89eb92f872
glaring wrapfd problems fixed
Matt Johnston <matt@ucc.asn.au>
parents:
1357
diff
changeset
|
50 seedfuzz(); |
1356
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
51 |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
52 return DROPBEAR_SUCCESS; |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
53 } |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
54 |
3677a510f545
add wrapfd. improve fuzzer in makefile
Matt Johnston <matt@ucc.asn.au>
parents:
1353
diff
changeset
|
55 |
1348 | 56 void svr_setup_fuzzer(void) { |
57 struct passwd *pw; | |
58 | |
59 common_setup_fuzzer(); | |
1353 | 60 |
61 _dropbear_exit = svr_dropbear_exit; | |
62 _dropbear_log = svr_dropbear_log; | |
1348 | 63 |
64 char *argv[] = { | |
65 "-E", | |
66 }; | |
67 | |
68 int argc = sizeof(argv) / sizeof(*argv); | |
69 svr_getopts(argc, argv); | |
70 | |
71 /* user lookups might be slow, cache it */ | |
72 pw = getpwuid(getuid()); | |
73 dropbear_assert(pw); | |
74 fuzz.pw_name = m_strdup(pw->pw_name); | |
75 fuzz.pw_dir = m_strdup(pw->pw_dir); | |
76 fuzz.pw_shell = m_strdup(pw->pw_shell); | |
77 fuzz.pw_passwd = m_strdup("!!zzznope"); | |
78 | |
79 load_fixed_hostkeys(); | |
80 } | |
81 | |
82 static void load_fixed_hostkeys(void) { | |
83 #include "fuzz-hostkeys.c" | |
84 | |
85 buffer *b = buf_new(3000); | |
86 enum signkey_type type; | |
87 | |
88 TRACE(("load fixed hostkeys")) | |
89 | |
90 svr_opts.hostkey = new_sign_key(); | |
91 | |
92 buf_setlen(b, 0); | |
93 buf_putbytes(b, keyr, keyr_len); | |
94 buf_setpos(b, 0); | |
95 type = DROPBEAR_SIGNKEY_RSA; | |
96 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) { | |
97 dropbear_exit("failed fixed rsa hostkey"); | |
98 } | |
99 | |
100 buf_setlen(b, 0); | |
101 buf_putbytes(b, keyd, keyd_len); | |
102 buf_setpos(b, 0); | |
103 type = DROPBEAR_SIGNKEY_DSS; | |
104 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) { | |
105 dropbear_exit("failed fixed dss hostkey"); | |
106 } | |
107 | |
108 buf_setlen(b, 0); | |
109 buf_putbytes(b, keye, keye_len); | |
110 buf_setpos(b, 0); | |
111 type = DROPBEAR_SIGNKEY_ECDSA_NISTP256; | |
112 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) { | |
113 dropbear_exit("failed fixed ecdsa hostkey"); | |
114 } | |
115 | |
116 buf_free(b); | |
117 } | |
118 | |
1357 | 119 void fuzz_kex_fakealgos(void) { |
120 ses.newkeys->recv.crypt_mode = &dropbear_mode_none; | |
121 } |