/src/nss/fuzz/targets/tls_client.cc
Line | Count | Source |
1 | | /* This Source Code Form is subject to the terms of the Mozilla Public |
2 | | * License, v. 2.0. If a copy of the MPL was not distributed with this |
3 | | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
4 | | |
5 | | #include <cassert> |
6 | | #include <cstddef> |
7 | | #include <cstdint> |
8 | | #include <iostream> |
9 | | |
10 | | #include "blapi.h" |
11 | | #include "seccomon.h" |
12 | | #include "ssl.h" |
13 | | #include "sslimpl.h" |
14 | | |
15 | | #include "base/database.h" |
16 | | #include "tls/config.h" |
17 | | #include "tls/common.h" |
18 | | #include "tls/mutators.h" |
19 | | #include "tls/socket.h" |
20 | | |
21 | | #ifdef IS_DTLS_FUZZ |
22 | 31.2k | #define ImportFD DTLS_ImportFD |
23 | | #else |
24 | | #define ImportFD SSL_ImportFD |
25 | | #endif // IS_DTLS_FUZZ |
26 | | |
27 | 31.2k | extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
28 | 31.2k | static NSSDatabase db = NSSDatabase(); |
29 | 31.2k | static PRDescIdentity id = PR_GetUniqueIdentity("fuzz-client"); |
30 | | |
31 | | // Create and import dummy socket. |
32 | 31.2k | TlsSocket::DummyPrSocket socket = TlsSocket::DummyPrSocket(data, size); |
33 | 31.2k | ScopedPRFileDesc prFd(DummyIOLayerMethods::CreateFD(id, &socket)); |
34 | 31.2k | PRFileDesc* sslFd = ImportFD(nullptr, prFd.get()); |
35 | 31.2k | assert(sslFd == prFd.get()); |
36 | | |
37 | | // Derive client config from input data. |
38 | 31.2k | TlsConfig::Client config = TlsConfig::Client(data, size); |
39 | | |
40 | 31.2k | if (ssl_trace >= 90) { |
41 | 0 | std::cerr << config << "\n"; |
42 | 0 | } |
43 | | |
44 | | // Reset the RNG state. |
45 | 31.2k | assert(RNG_RandomUpdate(NULL, 0) == SECSuccess); |
46 | 31.2k | assert(SSL_SetURL(sslFd, "fuzz.client") == SECSuccess); |
47 | | |
48 | 31.2k | TlsCommon::EnableAllProtocolVersions(); |
49 | 31.2k | TlsCommon::EnableAllCipherSuites(sslFd); |
50 | 31.2k | TlsCommon::FixTime(sslFd); |
51 | | |
52 | | // Set socket callbacks & options from client config. |
53 | 31.2k | config.SetCallbacks(sslFd); |
54 | 31.2k | config.SetSocketOptions(sslFd); |
55 | | |
56 | | // Perform the acutal handshake. |
57 | 31.2k | TlsCommon::DoHandshake(sslFd, false); |
58 | | |
59 | | // Release all SIDs. |
60 | 31.2k | SSL_ClearSessionCache(); |
61 | | |
62 | 31.2k | return 0; |
63 | 31.2k | } |
64 | | |
65 | | extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* data, size_t size, |
66 | 0 | size_t maxSize, unsigned int seed) { |
67 | 0 | return TlsMutators::CustomMutator(data, size, maxSize, seed); |
68 | 0 | } |
69 | | |
70 | | extern "C" size_t LLVMFuzzerCustomCrossOver(const uint8_t* data1, size_t size1, |
71 | | const uint8_t* data2, size_t size2, |
72 | | uint8_t* out, size_t maxOutSize, |
73 | 0 | unsigned int seed) { |
74 | 0 | return TlsMutators::CustomCrossOver(data1, size1, data2, size2, out, |
75 | 0 | maxOutSize, seed); |
76 | 0 | } |