/src/openssh/regress/misc/fuzz-harness/authkeys_fuzz.cc
Line | Count | Source |
1 | | #include <stddef.h> |
2 | | #include <stdio.h> |
3 | | #include <stdint.h> |
4 | | #include <string.h> |
5 | | #include <stdlib.h> |
6 | | #include <pwd.h> |
7 | | #include <unistd.h> |
8 | | |
9 | | extern "C" { |
10 | | |
11 | | #include "hostfile.h" |
12 | | #include "auth.h" |
13 | | #include "auth-options.h" |
14 | | #include "sshkey.h" |
15 | | |
16 | | // testdata/id_ed25519.pub and testdata/id_ed25519-cert.pub |
17 | | const char *pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMD"; |
18 | | const char *certtext = "ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIMDQjYH6XRzH3j3MW1DdjCoAfvrHfgjnVGF+sLK0pBfqAAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMDAAAAAAAAA+sAAAABAAAAB3VseXNzZXMAAAAXAAAAB3VseXNzZXMAAAAIb2R5c3NldXMAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgM9BeYRUxUuZ4VHJp8oxVaA8OS/z+5EFPCZwQNq1nMwMAAABTAAAAC3NzaC1lZDI1NTE5AAAAQBj0og+s09/HpwdHZbzN0twooKPDWWrxGfnP1Joy6cDnY2BCSQ7zg9vbq11kLF8H/sKOTZWAQrUZ7LlChOu9Ogw= id_ed25519.pub"; |
19 | | |
20 | | // stubs |
21 | | void auth_debug_add(const char *fmt,...) |
22 | 4.32k | { |
23 | 4.32k | } |
24 | | |
25 | | void |
26 | | auth_log_authopts(const char *loc, const struct sshauthopt *opts, int do_remote) |
27 | 1.24k | { |
28 | 1.24k | } |
29 | | |
30 | | int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) |
31 | 3.24k | { |
32 | 3.24k | char *tmp, *o, *cp = (char *)malloc(size + 1 + strlen(pubkey) + 1); |
33 | 3.24k | struct sshauthopt *opts = NULL; |
34 | 3.24k | struct passwd *pw = getpwuid(getuid()); |
35 | 3.24k | static struct sshkey *key, *cert; |
36 | | |
37 | 3.24k | if (key == NULL) { |
38 | 1 | if ((key = sshkey_new(KEY_UNSPEC)) == NULL || |
39 | 1 | (cert = sshkey_new(KEY_UNSPEC)) == NULL) |
40 | 0 | abort(); |
41 | 1 | if ((o = tmp = strdup(pubkey)) == NULL || |
42 | 1 | sshkey_read(key, &tmp) != 0) |
43 | 0 | abort(); |
44 | 1 | free(o); |
45 | 1 | if ((o = tmp = strdup(certtext)) == NULL || |
46 | 1 | sshkey_read(cert, &tmp) != 0) |
47 | 0 | abort(); |
48 | 1 | free(o); |
49 | 1 | } |
50 | 3.24k | if (cp == NULL || pw == NULL || key == NULL || cert == NULL) |
51 | 0 | abort(); |
52 | | |
53 | | // Cleanup whitespace at input EOL. |
54 | 1.70M | for (; size > 0 && strchr(" \t\r\n", data[size - 1]) != NULL; size--) ; |
55 | | |
56 | | // Append a pubkey that will match. |
57 | 3.24k | memcpy(cp, data, size); |
58 | 3.24k | cp[size] = ' '; |
59 | 3.24k | memcpy(cp + size + 1, pubkey, strlen(pubkey) + 1); |
60 | | |
61 | | // Try key. |
62 | 3.24k | if ((tmp = strdup(cp)) == NULL) |
63 | 0 | abort(); |
64 | 3.24k | (void) auth_check_authkey_line(pw, key, tmp, "127.0.0.1", "localhost", |
65 | 3.24k | "fuzz", &opts); |
66 | 3.24k | free(tmp); |
67 | 3.24k | sshauthopt_free(opts); |
68 | | |
69 | | // Try cert. |
70 | 3.24k | if ((tmp = strdup(cp)) == NULL) |
71 | 0 | abort(); |
72 | 3.24k | (void) auth_check_authkey_line(pw, cert, tmp, "127.0.0.1", "localhost", |
73 | 3.24k | "fuzz", &opts); |
74 | 3.24k | free(tmp); |
75 | 3.24k | sshauthopt_free(opts); |
76 | | |
77 | 3.24k | free(cp); |
78 | 3.24k | return 0; |
79 | 3.24k | } |
80 | | |
81 | | } // extern "C" |