Mercurial > dropbear
annotate fuzzer-verify.c @ 1529:66a1a2547133 fuzz
The fuzzer has managed to generated DSS key/signature pairs that
verify. Avoid false positives from bogus keys that wouldn't be used
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Wed, 21 Feb 2018 21:49:24 +0800 |
| parents | a90fdd2d2ed8 |
| children | 92c93b4a3646 |
| rev | line source |
|---|---|
| 1380 | 1 #include "fuzz.h" |
| 2 #include "session.h" | |
| 3 #include "fuzz-wrapfd.h" | |
| 4 #include "debug.h" | |
| 5 | |
| 6 static void setup_fuzzer(void) { | |
|
1456
a90fdd2d2ed8
add fuzzer-preauth_nomaths
Matt Johnston <matt@ucc.asn.au>
parents:
1380
diff
changeset
|
7 fuzz_common_setup(); |
| 1380 | 8 } |
| 9 | |
| 10 static buffer *verifydata; | |
| 11 | |
| 12 /* Tests reading a public key and verifying a signature */ | |
| 13 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { | |
| 14 static int once = 0; | |
| 15 if (!once) { | |
| 16 setup_fuzzer(); | |
| 17 verifydata = buf_new(30); | |
| 18 buf_putstring(verifydata, "x", 1); | |
| 19 once = 1; | |
| 20 } | |
| 21 | |
|
1456
a90fdd2d2ed8
add fuzzer-preauth_nomaths
Matt Johnston <matt@ucc.asn.au>
parents:
1380
diff
changeset
|
22 if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { |
| 1380 | 23 return 0; |
| 24 } | |
| 25 | |
| 26 m_malloc_set_epoch(1); | |
| 27 | |
| 28 if (setjmp(fuzz.jmp) == 0) { | |
| 29 sign_key *key = new_sign_key(); | |
| 30 enum signkey_type type = DROPBEAR_SIGNKEY_ANY; | |
| 31 if (buf_get_pub_key(fuzz.input, key, &type) == DROPBEAR_SUCCESS) { | |
|
1529
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
32 if (buf_verify(fuzz.input, key, verifydata) == DROPBEAR_SUCCESS) { |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
33 /* The fuzzer is capable of generating keys with a signature to match. |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
34 We don't want false positives if the key is bogus, since a client/server |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
35 wouldn't be trusting a bogus key anyway */ |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
36 int boguskey = 0; |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
37 |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
38 if (type == DROPBEAR_SIGNKEY_DSS) { |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
39 /* So far have seen dss keys with bad p/q/g domain parameters */ |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
40 int pprime, qprime; |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
41 assert(mp_prime_is_prime(key->dsskey->p, 5, &pprime) == MP_OKAY); |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
42 assert(mp_prime_is_prime(key->dsskey->q, 18, &qprime) == MP_OKAY); |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
43 boguskey = !(pprime && qprime); |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
44 /* Could also check g**q mod p == 1 */ |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
45 } |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
46 |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
47 if (!boguskey) { |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
48 printf("Random key/signature managed to verify!\n"); |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
49 abort(); |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
50 } |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
51 |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
52 |
|
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
53 } |
| 1380 | 54 } |
| 55 sign_key_free(key); | |
| 56 m_malloc_free_epoch(1, 0); | |
| 57 } else { | |
| 58 m_malloc_free_epoch(1, 1); | |
| 59 TRACE(("dropbear_exit longjmped")) | |
| 60 // dropbear_exit jumped here | |
| 61 } | |
| 62 | |
| 63 return 0; | |
| 64 } |