Line | Count | Source (jump to first uncovered line) |
1 | | /* Copyright 2021 Google LLC |
2 | | Licensed under the Apache License, Version 2.0 (the "License"); |
3 | | you may not use this file except in compliance with the License. |
4 | | You may obtain a copy of the License at |
5 | | http://www.apache.org/licenses/LICENSE-2.0 |
6 | | Unless required by applicable law or agreed to in writing, software |
7 | | distributed under the License is distributed on an "AS IS" BASIS, |
8 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
9 | | See the License for the specific language governing permissions and |
10 | | limitations under the License. |
11 | | */ |
12 | | |
13 | | #include "config.h" |
14 | | #include <sys/time.h> |
15 | | #include "syshead.h" |
16 | | #include "interval.h" |
17 | | #include "proxy.h" |
18 | | #include <openssl/err.h> |
19 | | #include <openssl/ssl.h> |
20 | | |
21 | | #include "fuzz_randomizer.h" |
22 | | |
23 | | int LLVMFuzzerInitialize(int *argc, char ***argv) |
24 | 4 | { |
25 | 4 | OPENSSL_malloc_init(); |
26 | 4 | SSL_library_init(); |
27 | 4 | ERR_load_crypto_strings(); |
28 | | |
29 | 4 | OpenSSL_add_all_algorithms(); |
30 | 4 | OpenSSL_add_ssl_algorithms(); |
31 | 4 | OpenSSL_add_all_digests(); |
32 | | |
33 | 4 | SSL_load_error_strings(); |
34 | 4 | return 1; |
35 | 4 | } |
36 | | |
37 | | |
38 | 127 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
39 | | |
40 | 127 | char *tmp = NULL; |
41 | 127 | char *tmp2 = NULL; |
42 | | |
43 | 127 | if (size < 500) { |
44 | 17 | return 0; |
45 | 17 | } |
46 | 110 | fuzz_random_init(data, size); |
47 | | |
48 | 110 | struct gc_arena gc = gc_new(); |
49 | 110 | struct http_proxy_info pi; |
50 | 110 | ssize_t generic_ssizet; |
51 | 110 | int signal_received = 0; |
52 | 110 | struct buffer lookahead = alloc_buf(1024); |
53 | 110 | struct event_timeout evt; |
54 | | |
55 | 110 | memset(&evt, 0, sizeof(struct event_timeout)); |
56 | 110 | memset(&pi, 0, sizeof(struct http_proxy_info)); |
57 | 110 | memset(&pi, 0, sizeof(pi)); |
58 | | |
59 | 110 | generic_ssizet = 0; |
60 | 110 | char *fuzz_usrnm = fuzz_random_get_string_max_length(USER_PASS_LEN); |
61 | 110 | strcpy(pi.up.username, fuzz_usrnm); |
62 | 110 | if (strlen(pi.up.username) == 0) { |
63 | 40 | gc_free(&gc); |
64 | 40 | free_buf(&lookahead); |
65 | 40 | free(fuzz_usrnm); |
66 | 40 | fuzz_random_destroy(); |
67 | 40 | return 0; |
68 | 40 | } |
69 | | |
70 | 70 | char *pswd = fuzz_random_get_string_max_length(USER_PASS_LEN); |
71 | 70 | strcpy(pi.up.password, pswd); |
72 | 70 | if (strlen(pi.up.password) == 0) { |
73 | 12 | gc_free(&gc); |
74 | 12 | free_buf(&lookahead); |
75 | | |
76 | 12 | free(pswd); |
77 | 12 | free(fuzz_usrnm); |
78 | 12 | fuzz_random_destroy(); |
79 | 12 | return 0; |
80 | 12 | } |
81 | | |
82 | 58 | generic_ssizet = fuzz_randomizer_get_int(0, 4); |
83 | 58 | switch (generic_ssizet) { |
84 | 40 | case 0: |
85 | 40 | pi.auth_method = HTTP_AUTH_NONE; |
86 | 40 | break; |
87 | 0 | case 1: |
88 | 0 | pi.auth_method = HTTP_AUTH_BASIC; |
89 | 0 | break; |
90 | 0 | case 2: |
91 | 0 | pi.auth_method = HTTP_AUTH_DIGEST; |
92 | 0 | break; |
93 | 0 | case 3: |
94 | 0 | pi.auth_method = HTTP_AUTH_NTLM; |
95 | 0 | break; |
96 | 18 | case 4: |
97 | 18 | pi.auth_method = HTTP_AUTH_NTLM2; |
98 | 18 | break; |
99 | 58 | } |
100 | 58 | pi.options.http_version = "1.1"; |
101 | | |
102 | 58 | generic_ssizet = fuzz_randomizer_get_int(0, 4); |
103 | 58 | switch (generic_ssizet) { |
104 | 5 | case 0: |
105 | 5 | pi.options.auth_retry = PAR_NO; |
106 | 5 | break; |
107 | 9 | case 1: |
108 | 9 | pi.options.auth_retry = PAR_ALL; |
109 | 9 | break; |
110 | 8 | case 2: |
111 | 8 | pi.options.auth_retry = PAR_NCT; |
112 | 8 | break; |
113 | 58 | } |
114 | | |
115 | 58 | char *tmp_authenticate = get_random_string(); |
116 | 58 | pi.proxy_authenticate = tmp_authenticate; |
117 | | |
118 | | //if (provider.ConsumeProbability<double>() < 0.5) { |
119 | | //tmp = get_modifiable_string(provider); |
120 | 58 | tmp = get_random_string(); |
121 | 58 | pi.options.custom_headers[0].name = tmp; |
122 | | //if (provider.ConsumeProbability<double>() < 0.5) { |
123 | | //tmp2 = get_modifiable_string(provider); |
124 | 58 | tmp2 = get_random_string(); |
125 | 58 | pi.options.custom_headers[0].content = tmp2; |
126 | | //} |
127 | | //} |
128 | | |
129 | 58 | establish_http_proxy_passthru(&pi, 0, "1.2.3.4", "777", &evt, &lookahead, |
130 | 58 | &signal_received); |
131 | 58 | free(pi.proxy_authenticate); |
132 | 58 | gc_free(&gc); |
133 | 58 | free_buf(&lookahead); |
134 | | |
135 | 58 | if (tmp != NULL) free(tmp); |
136 | 58 | if (tmp2 != NULL) free(tmp2); |
137 | | |
138 | 58 | free(pswd); |
139 | 58 | free(fuzz_usrnm); |
140 | 58 | fuzz_random_destroy(); |
141 | | |
142 | | |
143 | 58 | return 0; |
144 | 58 | } |