/src/openssl32/fuzz/client.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"); |
5 | | * you may not use this file except in compliance with the License. |
6 | | * You may obtain a copy of the License at |
7 | | * https://www.openssl.org/source/license.html |
8 | | * or in the file LICENSE in the source distribution. |
9 | | */ |
10 | | |
11 | | #include <time.h> |
12 | | #include <openssl/rand.h> |
13 | | #include <openssl/ssl.h> |
14 | | #include <openssl/rsa.h> |
15 | | #include <openssl/dsa.h> |
16 | | #include <openssl/ec.h> |
17 | | #include <openssl/dh.h> |
18 | | #include <openssl/err.h> |
19 | | #include "fuzzer.h" |
20 | | |
21 | | /* unused, to avoid warning. */ |
22 | | static int idx; |
23 | | |
24 | 24.8k | #define FUZZTIME 1485898104 |
25 | | |
26 | 24.0k | #define TIME_IMPL(t) { if (t != NULL) *t = FUZZTIME; return FUZZTIME; } |
27 | | |
28 | | /* |
29 | | * This might not work in all cases (and definitely not on Windows |
30 | | * because of the way linkers are) and callees can still get the |
31 | | * current time instead of the fixed time. This will just result |
32 | | * in things not being fully reproducible and have a slightly |
33 | | * different coverage. |
34 | | */ |
35 | | #if !defined(_WIN32) |
36 | | time_t time(time_t *t) TIME_IMPL(t) |
37 | | #endif |
38 | | |
39 | | int FuzzerInitialize(int *argc, char ***argv) |
40 | 26 | { |
41 | 26 | STACK_OF(SSL_COMP) *comp_methods; |
42 | | |
43 | 26 | FuzzerSetRand(); |
44 | 26 | OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL); |
45 | 26 | OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL); |
46 | 26 | ERR_clear_error(); |
47 | 26 | CRYPTO_free_ex_index(0, -1); |
48 | 26 | idx = SSL_get_ex_data_X509_STORE_CTX_idx(); |
49 | 26 | comp_methods = SSL_COMP_get_compression_methods(); |
50 | 26 | if (comp_methods != NULL) |
51 | 26 | sk_SSL_COMP_sort(comp_methods); |
52 | | |
53 | 26 | return 1; |
54 | 26 | } |
55 | | |
56 | | int FuzzerTestOneInput(const uint8_t *buf, size_t len) |
57 | 31.7k | { |
58 | 31.7k | SSL *client = NULL; |
59 | 31.7k | BIO *in; |
60 | 31.7k | BIO *out; |
61 | 31.7k | SSL_CTX *ctx; |
62 | | |
63 | 31.7k | if (len == 0) |
64 | 0 | return 0; |
65 | | |
66 | | /* This only fuzzes the initial flow from the client so far. */ |
67 | 31.7k | ctx = SSL_CTX_new(SSLv23_method()); |
68 | 31.7k | if (ctx == NULL) |
69 | 0 | goto end; |
70 | | |
71 | 31.7k | client = SSL_new(ctx); |
72 | 31.7k | if (client == NULL) |
73 | 0 | goto end; |
74 | 31.7k | OPENSSL_assert(SSL_set_min_proto_version(client, 0) == 1); |
75 | 31.7k | OPENSSL_assert(SSL_set_cipher_list(client, "ALL:eNULL:@SECLEVEL=0") == 1); |
76 | 31.7k | SSL_set_tlsext_host_name(client, "localhost"); |
77 | 31.7k | in = BIO_new(BIO_s_mem()); |
78 | 31.7k | if (in == NULL) |
79 | 0 | goto end; |
80 | 31.7k | out = BIO_new(BIO_s_mem()); |
81 | 31.7k | if (out == NULL) { |
82 | 0 | BIO_free(in); |
83 | 0 | goto end; |
84 | 0 | } |
85 | 31.7k | SSL_set_bio(client, in, out); |
86 | 31.7k | SSL_set_connect_state(client); |
87 | 31.7k | OPENSSL_assert((size_t)BIO_write(in, buf, len) == len); |
88 | 31.7k | if (SSL_do_handshake(client) == 1) { |
89 | | /* Keep reading application data until error or EOF. */ |
90 | 723 | uint8_t tmp[1024]; |
91 | 22.1k | for (;;) { |
92 | 22.1k | if (SSL_read(client, tmp, sizeof(tmp)) <= 0) { |
93 | 723 | break; |
94 | 723 | } |
95 | 22.1k | } |
96 | 723 | } |
97 | 31.7k | end: |
98 | 31.7k | SSL_free(client); |
99 | 31.7k | ERR_clear_error(); |
100 | 31.7k | SSL_CTX_free(ctx); |
101 | | |
102 | 31.7k | return 0; |
103 | 31.7k | } |
104 | | |
105 | | void FuzzerCleanup(void) |
106 | 0 | { |
107 | 0 | FuzzerClearRand(); |
108 | 0 | } |