Coverage Report

Created: 2025-08-26 06:33

/src/openssh/regress/misc/fuzz-harness/agent_fuzz_helper.c
Line
Count
Source (jump to first uncovered line)
1
#include "fixed-keys.h"
2
#include <assert.h>
3
4
#define main(ac, av) xxxmain(ac, av)
5
#include "../../../ssh-agent.c"
6
7
void test_one(const uint8_t* s, size_t slen);
8
9
static int
10
devnull_or_die(void)
11
1
{
12
1
  int fd;
13
14
1
  if ((fd = open("/dev/null", O_RDWR)) == -1) {
15
0
    error_f("open /dev/null: %s", strerror(errno));
16
0
    abort();
17
0
  }
18
1
  return fd;
19
1
}
20
21
static struct sshkey *
22
pubkey_or_die(const char *s)
23
4.37k
{
24
4.37k
  char *tmp, *cp;
25
4.37k
  struct sshkey *pubkey;
26
4.37k
  int r;
27
28
4.37k
  tmp = cp = xstrdup(s);
29
4.37k
  if ((pubkey = sshkey_new(KEY_UNSPEC)) == NULL)
30
0
    abort();
31
4.37k
  if ((r = sshkey_read(pubkey, &cp)) != 0) {
32
0
    error_fr(r, "parse");
33
0
    abort();
34
0
  }
35
4.37k
  free(tmp);
36
4.37k
  return pubkey;
37
4.37k
}
38
39
static struct sshkey *
40
privkey_or_die(const char *s)
41
8.74k
{
42
8.74k
  int r;
43
8.74k
  struct sshbuf *b;
44
8.74k
  struct sshkey *privkey;
45
46
8.74k
  if ((b = sshbuf_from(s, strlen(s))) == NULL) {
47
0
    error_f("sshbuf_from failed");
48
0
    abort();
49
0
  }
50
8.74k
  if ((r = sshkey_parse_private_fileblob(b, "", &privkey, NULL)) != 0) {
51
0
    error_fr(r, "parse");
52
0
    abort();
53
0
  }
54
8.74k
  sshbuf_free(b);
55
8.74k
  return privkey;
56
8.74k
}
57
58
static void
59
add_key(const char *privkey, const char *certpath)
60
4.37k
{
61
4.37k
  Identity *id;
62
4.37k
  int r;
63
4.37k
  struct sshkey *cert;
64
65
4.37k
  id = xcalloc(1, sizeof(Identity));
66
4.37k
  TAILQ_INSERT_TAIL(&idtab->idlist, id, next);
67
4.37k
  idtab->nentries++;
68
4.37k
  id->key = privkey_or_die(privkey);
69
4.37k
  id->comment = xstrdup("rhododaktulos Eos");
70
4.37k
  if (sshkey_is_sk(id->key))
71
1.74k
    id->sk_provider = xstrdup("internal");
72
73
  /* Now the cert too */
74
4.37k
  id = xcalloc(1, sizeof(Identity));
75
4.37k
  TAILQ_INSERT_TAIL(&idtab->idlist, id, next);
76
4.37k
  idtab->nentries++;
77
4.37k
  id->key = privkey_or_die(privkey);
78
4.37k
  cert = pubkey_or_die(certpath);
79
4.37k
  if ((r = sshkey_to_certified(id->key)) != 0) {
80
0
    error_fr(r, "sshkey_to_certified");
81
0
    abort();
82
0
  }
83
4.37k
  if ((r = sshkey_cert_copy(cert, id->key)) != 0) {
84
0
    error_fr(r, "sshkey_cert_copy");
85
0
    abort();
86
0
  }
87
4.37k
  sshkey_free(cert);
88
4.37k
  id->comment = xstrdup("outis");
89
4.37k
  if (sshkey_is_sk(id->key))
90
1.74k
    id->sk_provider = xstrdup("internal");
91
4.37k
}
92
93
static void
94
cleanup_idtab(void)
95
1.74k
{
96
1.74k
  Identity *id;
97
98
1.74k
  if (idtab == NULL) return;
99
9.59k
  for (id = TAILQ_FIRST(&idtab->idlist); id;
100
8.72k
      id = TAILQ_FIRST(&idtab->idlist)) {
101
8.72k
    TAILQ_REMOVE(&idtab->idlist, id, next);
102
8.72k
    free_identity(id);
103
8.72k
  }
104
874
  free(idtab);
105
874
  idtab = NULL;
106
874
}
107
108
static void
109
reset_idtab(void)
110
874
{
111
874
  cleanup_idtab();
112
874
  idtab_init();
113
  // Load keys.
114
874
  add_key(PRIV_RSA, CERT_RSA);
115
874
  add_key(PRIV_ECDSA, CERT_ECDSA);
116
874
  add_key(PRIV_ED25519, CERT_ED25519);
117
874
  add_key(PRIV_ECDSA_SK, CERT_ECDSA_SK);
118
874
  add_key(PRIV_ED25519_SK, CERT_ED25519_SK);
119
874
}
120
121
static void
122
cleanup_sockettab(void)
123
1.74k
{
124
1.74k
  u_int i;
125
10.4k
  for (i = 0; i < sockets_alloc; i++) {
126
8.74k
    if (sockets[i].type != AUTH_UNUSED)
127
874
      close_socket(sockets + i);
128
8.74k
  }
129
1.74k
  free(sockets);
130
1.74k
  sockets = NULL;
131
1.74k
  sockets_alloc = 0;
132
1.74k
}
133
134
static void
135
reset_sockettab(int devnull)
136
874
{
137
874
  int fd;
138
139
874
  cleanup_sockettab();
140
874
  if ((fd = dup(devnull)) == -1) {
141
0
    error_f("dup: %s", strerror(errno));
142
0
    abort();
143
0
  }
144
874
  new_socket(AUTH_CONNECTION, fd);
145
874
  assert(sockets[0].type == AUTH_CONNECTION);
146
874
  assert(sockets[0].fd == fd);
147
874
}
148
149
45.5k
#define MAX_MESSAGES 256
150
void
151
test_one(const uint8_t* s, size_t slen)
152
874
{
153
874
  static int devnull = -1;
154
874
  size_t i, olen, nlen;
155
156
874
  if (devnull == -1) {
157
1
    log_init(__progname, SYSLOG_LEVEL_DEBUG3,
158
1
        SYSLOG_FACILITY_AUTH, 1);
159
1
    devnull = devnull_or_die();
160
1
    allowed_providers = xstrdup("");
161
1
    websafe_allowlist = xstrdup("*");
162
1
    setenv("DISPLAY", "", 1); /* ban askpass */
163
1
  }
164
165
874
  reset_idtab();
166
874
  reset_sockettab(devnull);
167
874
  (void)sshbuf_put(sockets[0].input, s, slen);
168
45.5k
  for (i = 0; i < MAX_MESSAGES; i++) {
169
45.4k
    olen = sshbuf_len(sockets[0].input);
170
45.4k
    process_message(0);
171
45.4k
    nlen = sshbuf_len(sockets[0].input);
172
45.4k
    if (nlen == 0 || nlen == olen)
173
852
      break;
174
45.4k
  }
175
874
  cleanup_idtab();
176
874
  cleanup_sockettab();
177
874
}