Skip to content

Commit

Permalink
fuzzer-pubkey
Browse files Browse the repository at this point in the history
--HG--
branch : fuzz
  • Loading branch information
mkj committed May 23, 2017
1 parent a582c4c commit 0363d3c
Show file tree
Hide file tree
Showing 8 changed files with 75 additions and 7 deletions.
5 changes: 4 additions & 1 deletion Makefile.in
Original file line number Diff line number Diff line change
Expand Up @@ -245,7 +245,7 @@ default_options.h: default_options.h.in
## Fuzzing targets

# list of fuzz targets
FUZZ_TARGETS=fuzzer-preauth
FUZZ_TARGETS=fuzzer-preauth fuzzer-pubkey

list-fuzz-targets:
@echo $(FUZZ_TARGETS)
Expand All @@ -265,6 +265,9 @@ fuzz-targets: $(FUZZ_TARGETS)
fuzzer-preauth: fuzzer-preauth.o $(HEADERS) $(LIBTOM_DEPS) Makefile $(svrfuzzobjs)
$(CXX) $(CXXFLAGS) $@.o $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@

fuzzer-pubkey: fuzzer-pubkey.o $(HEADERS) $(LIBTOM_DEPS) Makefile $(svrfuzzobjs)
$(CXX) $(CXXFLAGS) $@.o $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@

# run this to update hardcoded hostkeys for for fuzzing.
# hostkeys.c is checked in to hg.
fuzz-hostkeys:
Expand Down
2 changes: 1 addition & 1 deletion dbrandom.c
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ static void write_urandom()
}

#ifdef DROPBEAR_FUZZ
void seedfuzz(void) {
void fuzz_seed(void) {
hash_state hs;
sha1_init(&hs);
sha1_process(&hs, "fuzzfuzzfuzz", strlen("fuzzfuzzfuzz"));
Expand Down
3 changes: 0 additions & 3 deletions dbrandom.h
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,5 @@ void seedrandom(void);
void genrandom(unsigned char* buf, unsigned int len);
void addrandom(unsigned char * buf, unsigned int len);
void gen_random_mpint(mp_int *max, mp_int *rand);
#ifdef DROPBEAR_FUZZ
void seedfuzz(void);
#endif

#endif /* DROPBEAR_RANDOM_H_ */
7 changes: 7 additions & 0 deletions dbutil.c
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,13 @@ static void generic_dropbear_exit(int exitcode, const char* format,

_dropbear_log(LOG_INFO, fmtbuf, param);

#ifdef DROPBEAR_FUZZ
// longjmp before cleaning up svr_opts
if (fuzz.fuzzing) {
longjmp(fuzz.jmp, 1);
}
#endif

exit(exitcode);
}

Expand Down
4 changes: 2 additions & 2 deletions fuzz-common.c
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ struct dropbear_fuzz_options fuzz;

static void load_fixed_hostkeys(void);

static void common_setup_fuzzer(void) {
void common_setup_fuzzer(void) {
fuzz.fuzzing = 1;
fuzz.wrapfds = 1;
fuzz.input = m_malloc(sizeof(buffer));
Expand Down Expand Up @@ -47,7 +47,7 @@ int fuzzer_set_input(const uint8_t *Data, size_t Size) {
uint32_t wrapseed = buf_getint(fuzz.input);
wrapfd_setup(wrapseed);

seedfuzz();
fuzz_seed();

return DROPBEAR_SUCCESS;
}
Expand Down
7 changes: 7 additions & 0 deletions fuzz.h
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,19 @@
#include "fuzz-wrapfd.h"

// once per process
void common_setup_fuzzer(void);
void svr_setup_fuzzer(void);

// once per input. returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE
int fuzzer_set_input(const uint8_t *Data, size_t Size);

// fuzzer functions that intrude into general code
void fuzz_kex_fakealgos(void);
int fuzz_checkpubkey_line(buffer* line, int line_num, char* filename,
const char* algo, unsigned int algolen,
const unsigned char* keyblob, unsigned int keybloblen);
extern const char * const * fuzz_signkey_names;
void fuzz_seed(void);

// fake IO wrappers
#ifndef FUZZ_SKIP_WRAP
Expand Down
49 changes: 49 additions & 0 deletions fuzzer-pubkey.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
#include "fuzz.h"
#include "session.h"
#include "fuzz-wrapfd.h"
#include "debug.h"

static void setup_fuzzer(void) {
common_setup_fuzzer();
}

int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
static int once = 0;
if (!once) {
setup_fuzzer();
once = 1;
}

m_malloc_set_epoch(1);

fuzz_seed();
fuzz.input->data = (unsigned char*)Data;
fuzz.input->len = Size;
fuzz.input->size = Size;
fuzz.input->pos = 0;

if (Size < 4) {
return 0;
}

// choose a keytype based on input
uint8_t b = 0;
size_t i;
for (i = 0; i < Size; i++) {
b ^= Data[i];
}
const char* algoname = fuzz_signkey_names[b%DROPBEAR_SIGNKEY_NUM_NAMED];
const char* keyblob = "fakekeyblob";

if (setjmp(fuzz.jmp) == 0) {
fuzz_checkpubkey_line(fuzz.input, 5, "/home/me/authorized_keys",
algoname, strlen(algoname),
keyblob, strlen(keyblob));
} else {
m_malloc_free_epoch(1);
TRACE(("dropbear_exit longjmped"))
// dropbear_exit jumped here
}

return 0;
}
5 changes: 5 additions & 0 deletions signkey.c
Original file line number Diff line number Diff line change
Expand Up @@ -620,3 +620,8 @@ int cmp_base64_key(const unsigned char* keyblob, unsigned int keybloblen,
return ret;
}
#endif

#ifdef DROPBEAR_FUZZ
const char * const * fuzz_signkey_names = signkey_names;

#endif

0 comments on commit 0363d3c

Please sign in to comment.