From: Kurt Roeckx Date: Wed, 7 Dec 2016 22:12:04 +0000 (+0100) Subject: And client fuzzer X-Git-Tag: OpenSSL_1_1_1-pre1~2873 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=4410f9d786da11a47fba9f345ae0642ff95972e0;p=oweals%2Fopenssl.git And client fuzzer Reviewed-by: Rich Salz GH: #2041 --- diff --git a/fuzz/build.info b/fuzz/build.info index eade218937..a5cc6f44b9 100644 --- a/fuzz/build.info +++ b/fuzz/build.info @@ -9,7 +9,7 @@ -} IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}] - PROGRAMS_NO_INST=asn1 asn1parse bignum bndiv conf crl server x509 + PROGRAMS_NO_INST=asn1 asn1parse bignum bndiv client conf crl server x509 IF[{- !$disabled{"cms"} -}] PROGRAMS_NO_INST=cms @@ -35,6 +35,10 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}] INCLUDE[bndiv]=../include {- $ex_inc -} DEPEND[bndiv]=../libcrypto {- $ex_lib -} + SOURCE[client]=client.c driver.c + INCLUDE[client]=../include {- $ex_inc -} + DEPEND[client]=../libcrypto ../libssl {- $ex_lib -} + SOURCE[cms]=cms.c driver.c INCLUDE[cms]=../include {- $ex_inc -} DEPEND[cms]=../libcrypto {- $ex_lib -} @@ -61,7 +65,7 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}] ENDIF IF[{- !$disabled{tests} -}] - PROGRAMS_NO_INST=asn1-test asn1parse-test bignum-test bndiv-test conf-test crl-test server-test x509-test + PROGRAMS_NO_INST=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test x509-test IF[{- !$disabled{"cms"} -}] PROGRAMS_NO_INST=cms-test @@ -87,6 +91,10 @@ IF[{- !$disabled{tests} -}] INCLUDE[bndiv-test]=../include DEPEND[bndiv-test]=../libcrypto + SOURCE[client-test]=client.c test-corpus.c + INCLUDE[client-test]=../include + DEPEND[client-test]=../libcrypto ../libssl + SOURCE[cms-test]=cms.c test-corpus.c INCLUDE[cms-test]=../include DEPEND[cms-test]=../libcrypto diff --git a/fuzz/client.c b/fuzz/client.c new file mode 100644 index 0000000000..391e0cce9f --- /dev/null +++ b/fuzz/client.c @@ -0,0 +1,89 @@ +/* + * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL licenses, (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * https://www.openssl.org/source/license.html + * or in the file LICENSE in the source distribution. + */ + +#include +#include +#include +#include +#include "fuzzer.h" + +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION +extern int rand_predictable; +#endif +#define ENTROPY_NEEDED 32 + +/* unused, to avoid warning. */ +static int idx; + +int FuzzerInitialize(int *argc, char ***argv) +{ + STACK_OF(SSL_COMP) *comp_methods; + + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL); + OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL); + ERR_get_state(); + CRYPTO_free_ex_index(0, -1); + idx = SSL_get_ex_data_X509_STORE_CTX_idx(); + RAND_add("", 1, ENTROPY_NEEDED); + RAND_status(); + RSA_get_default_method(); + comp_methods = SSL_COMP_get_compression_methods(); + OPENSSL_sk_sort((OPENSSL_STACK *)comp_methods); + + +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + rand_predictable = 1; +#endif + + return 1; +} + +int FuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + SSL *client; + BIO *in; + BIO *out; + SSL_CTX *ctx; + + if (len == 0) + return 0; + + /* + * TODO: use the ossltest engine (optionally?) to disable crypto checks. + */ + + /* This only fuzzes the initial flow from the client so far. */ + ctx = SSL_CTX_new(SSLv23_method()); + + client = SSL_new(ctx); + in = BIO_new(BIO_s_mem()); + out = BIO_new(BIO_s_mem()); + SSL_set_bio(client, in, out); + SSL_set_connect_state(client); + OPENSSL_assert((size_t)BIO_write(in, buf, len) == len); + if (SSL_do_handshake(client) == 1) { + /* Keep reading application data until error or EOF. */ + uint8_t tmp[1024]; + for (;;) { + if (SSL_read(client, tmp, sizeof(tmp)) <= 0) { + break; + } + } + } + SSL_free(client); + ERR_clear_error(); + SSL_CTX_free(ctx); + + return 0; +} + +void FuzzerCleanup(void) +{ +} diff --git a/test/recipes/90-test_fuzz.t b/test/recipes/90-test_fuzz.t index d152925733..75248ef70d 100755 --- a/test/recipes/90-test_fuzz.t +++ b/test/recipes/90-test_fuzz.t @@ -15,7 +15,7 @@ use OpenSSL::Test::Utils; setup("test_fuzz"); -my @fuzzers = ('asn1', 'asn1parse', 'bignum', 'bndiv', 'conf', 'crl', 'server', 'x509'); +my @fuzzers = ('asn1', 'asn1parse', 'bignum', 'bndiv', 'client', 'conf', 'crl', 'server', 'x509'); if (!disabled("cms")) { push @fuzzers, 'cms'; }