Mercurial > dropbear

annotate fuzz/fuzzer-pubkey.c @ 1840:5c13e765ddbd

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Only redirect stderr after the session login. That lets errors get recorded on the server parent side, rather than being sent over a SSH connection.
author Matt Johnston <matt@ucc.asn.au>
date Mon, 18 Oct 2021 23:20:08 +0800
parents 97ad26e397a5
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1369
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 #include "fuzz.h"
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 #include "session.h"
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 #include "fuzz-wrapfd.h"
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 #include "debug.h"
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 static void setup_fuzzer(void) {
1456
a90fdd2d2ed8 add fuzzer-preauth_nomaths
Matt Johnston <matt@ucc.asn.au>
parents: 1383
diff changeset
7 fuzz_common_setup();
1369
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8 }
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11 static int once = 0;
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12 if (!once) {
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13 setup_fuzzer();
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 once = 1;
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15 }
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16
1456
a90fdd2d2ed8 add fuzzer-preauth_nomaths
Matt Johnston <matt@ucc.asn.au>
parents: 1383
diff changeset
17 if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
1377
d4cc85e6c569 rearrange, all fuzzers now call fuzzer_set_input()
Matt Johnston <matt@ucc.asn.au>
parents: 1369
diff changeset
18 return 0;
d4cc85e6c569 rearrange, all fuzzers now call fuzzer_set_input()
Matt Johnston <matt@ucc.asn.au>
parents: 1369
diff changeset
19 }
d4cc85e6c569 rearrange, all fuzzers now call fuzzer_set_input()
Matt Johnston <matt@ucc.asn.au>
parents: 1369
diff changeset
20
1369
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
21 m_malloc_set_epoch(1);
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
22
1584
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
23 if (setjmp(fuzz.jmp) == 0) {
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
24 buffer *line = buf_getstringbuf(fuzz.input);
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
25 buffer *keyblob = buf_getstringbuf(fuzz.input);
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
26
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
27 unsigned int algolen;
1586
e6a5e51a29c9 - fuzzer-pubkey needs to free algoname, fix build
Matt Johnston <matt@ucc.asn.au>
parents: 1584
diff changeset
28 char* algoname = buf_getstring(keyblob, &algolen);
1369
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29
1777
97ad26e397a5 Add server postauth fuzzer, wrap connect_remote()
Matt Johnston <matt@ucc.asn.au>
parents: 1756
diff changeset
30 if (signature_type_from_name(algoname, algolen) == DROPBEAR_SIGNATURE_NONE) {
1584
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
31 dropbear_exit("fuzzer imagined a bogus algorithm");
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
32 }
1598
252b406d0e9a avoid leak of pubkey_options
Matt Johnston <matt@ucc.asn.au>
parents: 1586
diff changeset
33
252b406d0e9a avoid leak of pubkey_options
Matt Johnston <matt@ucc.asn.au>
parents: 1586
diff changeset
34 int ret = fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys",
1584
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
35 algoname, algolen,
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
36 keyblob->data, keyblob->len);
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
37
1598
252b406d0e9a avoid leak of pubkey_options
Matt Johnston <matt@ucc.asn.au>
parents: 1586
diff changeset
38 if (ret == DROPBEAR_SUCCESS) {
252b406d0e9a avoid leak of pubkey_options
Matt Johnston <matt@ucc.asn.au>
parents: 1586
diff changeset
39 /* fuzz_checkpubkey_line() should have cleaned up for failure */
252b406d0e9a avoid leak of pubkey_options
Matt Johnston <matt@ucc.asn.au>
parents: 1586
diff changeset
40 svr_pubkey_options_cleanup();
252b406d0e9a avoid leak of pubkey_options
Matt Johnston <matt@ucc.asn.au>
parents: 1586
diff changeset
41 }
252b406d0e9a avoid leak of pubkey_options
Matt Johnston <matt@ucc.asn.au>
parents: 1586
diff changeset
42
1584
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
43 buf_free(line);
cdfab509c392 use random keyblob from the fuzzer instead
Matt Johnston <matt@ucc.asn.au>
parents: 1559
diff changeset
44 buf_free(keyblob);
1586
e6a5e51a29c9 - fuzzer-pubkey needs to free algoname, fix build
Matt Johnston <matt@ucc.asn.au>
parents: 1584
diff changeset
45 m_free(algoname);
1383
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority()
Matt Johnston <matt@ucc.asn.au>
parents: 1378
diff changeset
46 m_malloc_free_epoch(1, 0);
1369
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
47 } else {
1378
7209a6e30932 linked list dbmalloc now
Matt Johnston <matt@ucc.asn.au>
parents: 1377
diff changeset
48 m_malloc_free_epoch(1, 1);
1369
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
49 TRACE(("dropbear_exit longjmped"))
1559
92c93b4a3646 Fix to be able to compile normal(ish) binaries with --enable-fuzz
Matt Johnston <matt@ucc.asn.au>
parents: 1456
diff changeset
50 /* dropbear_exit jumped here */
1369
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
51 }
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
52
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
53 return 0;
ddfcadca3c4c fuzzer-pubkey
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
54 }