/src/picotls/fuzz/fuzz-client-hello.c
Line | Count | Source (jump to first uncovered line) |
1 | | #include <assert.h> |
2 | | #include <getopt.h> |
3 | | #include <inttypes.h> |
4 | | #include <stdio.h> |
5 | | #include <string.h> |
6 | | #include <strings.h> |
7 | | #include <sys/select.h> |
8 | | #include <sys/socket.h> |
9 | | #include <sys/stat.h> |
10 | | #include <sys/time.h> |
11 | | #include <sys/types.h> |
12 | | #include <unistd.h> |
13 | | |
14 | | #include <openssl/err.h> |
15 | | #include <openssl/evp.h> |
16 | | #include <openssl/engine.h> |
17 | | #include <openssl/pem.h> |
18 | | |
19 | | #include "picotls.h" |
20 | | #include "picotls/openssl.h" |
21 | | #include "util.h" |
22 | | |
23 | | void deterministic_random_bytes(void *buf, size_t len) |
24 | 6.77k | { |
25 | 99.6k | for (int i = 0; i < len; i++) { |
26 | 92.8k | ((uint8_t *)buf)[i] = 0; |
27 | 92.8k | } |
28 | 6.77k | } |
29 | | |
30 | | uint8_t fake_ticket[] = {0x00, 0x4d, 0x70, 0x74, 0x6c, 0x73, 0x30, 0x30, 0x30, 0x31, 0x00, 0x00, 0x01, 0x67, 0x7b, 0xce, |
31 | | 0xa7, 0x55, 0x00, 0x30, 0x45, 0xc2, 0x95, 0x37, 0x16, 0x9e, 0x79, 0x8c, 0x0c, 0x53, 0x14, 0x3f, |
32 | | 0x15, 0x4c, 0x93, 0x8f, 0x74, 0x65, 0x76, 0x7a, 0x76, 0x1e, 0x4f, 0x90, 0xbf, 0xa1, 0xb9, 0x54, |
33 | | 0xfd, 0x4e, 0x06, 0x4a, 0xd4, 0xb2, 0x84, 0xad, 0x12, 0xc9, 0xf1, 0x1e, 0x1a, 0x95, 0x85, 0xc5, |
34 | | 0x19, 0xc1, 0x69, 0x5f, 0x00, 0x17, 0x13, 0x02, 0xed, 0xec, 0xfb, 0xd7, 0x00, 0x00, 0x00}; |
35 | | |
36 | | static int encrypt_ticket_cb_fake(ptls_encrypt_ticket_t *_self, ptls_t *tls, int is_encrypt, ptls_buffer_t *dst, ptls_iovec_t src) |
37 | 293 | { |
38 | 293 | (void)_self; |
39 | 293 | int ret; |
40 | | |
41 | 293 | if (is_encrypt) { |
42 | 137 | if ((ret = ptls_buffer_reserve(dst, 32)) != 0) |
43 | 0 | return ret; |
44 | 137 | memcpy(dst->base + dst->off, fake_ticket, 32); |
45 | 137 | dst->off += 32; |
46 | 156 | } else { |
47 | 156 | if ((ret = ptls_buffer_reserve(dst, sizeof(fake_ticket))) != 0) |
48 | 0 | return ret; |
49 | 156 | memcpy(dst->base + dst->off, fake_ticket, sizeof(fake_ticket)); |
50 | 156 | dst->off += sizeof(fake_ticket); |
51 | 156 | } |
52 | | |
53 | 293 | return 0; |
54 | 293 | } |
55 | | |
56 | | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
57 | 4.29k | { |
58 | | // key exchanges |
59 | 4.29k | ptls_key_exchange_algorithm_t *key_exchanges[128] = {NULL}; |
60 | 4.29k | key_exchanges[0] = &ptls_openssl_secp256r1; |
61 | | // the second cipher suite is used for the PSK ticket |
62 | 4.29k | ptls_cipher_suite_t *cipher_suites[] = {&ptls_openssl_aes128gcmsha256, &ptls_openssl_aes256gcmsha384, NULL}; |
63 | | |
64 | | // create ptls_context_t |
65 | 4.29k | ptls_context_t ctx_server = {deterministic_random_bytes, &ptls_get_time, key_exchanges, cipher_suites}; |
66 | 4.29k | ctx_server.verify_certificate = NULL; |
67 | | |
68 | | // setup server fake cache |
69 | 4.29k | struct st_util_session_cache_t sc; |
70 | 4.29k | sc.super.cb = encrypt_ticket_cb_fake; |
71 | 4.29k | ctx_server.ticket_lifetime = UINT_MAX; |
72 | 4.29k | ctx_server.max_early_data_size = 8192; |
73 | 4.29k | ctx_server.encrypt_ticket = &sc.super; |
74 | | |
75 | | // create pls_t |
76 | 4.29k | ptls_t *tls_server = ptls_new(&ctx_server, 1); // 1: server |
77 | | |
78 | | // empty hsprop |
79 | 4.29k | ptls_handshake_properties_t hsprop = {{{{NULL}}}}; |
80 | | |
81 | | // buffers |
82 | 4.29k | ptls_buffer_t server_response; |
83 | 4.29k | ptls_buffer_init(&server_response, "", 0); |
84 | | |
85 | | // accept client_hello |
86 | 4.29k | size_t consumed = size; |
87 | 4.29k | int ret = ptls_handshake(tls_server, &server_response, data, &consumed, &hsprop); |
88 | | |
89 | | // more messages to parse? |
90 | 4.29k | if (ret == 0 && size - consumed > 0) { |
91 | 227 | size = size - consumed; |
92 | | // reset buffer |
93 | 227 | ptls_buffer_dispose(&server_response); |
94 | 227 | ptls_buffer_init(&server_response, "", 0); |
95 | | // receive messages |
96 | 227 | ptls_receive(tls_server, &server_response, data + consumed, &size); |
97 | 227 | } |
98 | | |
99 | | // clean |
100 | 4.29k | ptls_buffer_dispose(&server_response); |
101 | 4.29k | ptls_free(tls_server); |
102 | | |
103 | | // |
104 | 4.29k | return 0; |
105 | 4.29k | } |