/src/strongswan/fuzz/fuzz_pb_tnc.c
Line | Count | Source |
1 | | /* |
2 | | * Copyright (C) 2018 Andreas Steffen |
3 | | * |
4 | | * Copyright (C) secunet Security Networks AG |
5 | | * |
6 | | * This program is free software; you can redistribute it and/or modify it |
7 | | * under the terms of the GNU General Public License as published by the |
8 | | * Free Software Foundation; either version 2 of the License, or (at your |
9 | | * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. |
10 | | * |
11 | | * This program is distributed in the hope that it will be useful, but |
12 | | * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY |
13 | | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
14 | | * for more details. |
15 | | */ |
16 | | |
17 | | #include <library.h> |
18 | | #include <batch/pb_tnc_batch.h> |
19 | | #include <messages/ietf/pb_error_msg.h> |
20 | | #include <state_machine/pb_tnc_state_machine.h> |
21 | | #include <utils/debug.h> |
22 | | |
23 | | int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) |
24 | 1.70k | { |
25 | 1.70k | pb_tnc_batch_t *batch; |
26 | 1.70k | pb_tnc_state_machine_t *state; |
27 | 1.70k | pb_tnc_msg_t *msg; |
28 | 1.70k | pb_error_msg_t *error; |
29 | 1.70k | enumerator_t *enumerator; |
30 | 1.70k | bool from_server; |
31 | 1.70k | chunk_t chunk; |
32 | | |
33 | 1.70k | dbg_default_set_level(-1); |
34 | 1.70k | library_init(NULL, "fuzz_pb_tnc"); |
35 | | |
36 | 1.70k | chunk = chunk_create((u_char*)buf, len); |
37 | | |
38 | 1.70k | INIT(state, |
39 | 1.70k | .receive_batch = (void*)return_true, |
40 | 1.70k | .set_empty_cdata = (void*)nop, |
41 | 1.70k | ); |
42 | | |
43 | | /* parse incoming PB-TNC batch */ |
44 | 1.70k | batch = pb_tnc_batch_create_from_data(chunk); |
45 | 1.70k | if (batch->process_header(batch, TRUE, FALSE, &from_server) == SUCCESS || |
46 | 1.15k | batch->process_header(batch, TRUE, TRUE, &from_server) == SUCCESS) |
47 | 1.59k | { |
48 | 1.59k | batch->process(batch, state); |
49 | 1.59k | } |
50 | | |
51 | | /* enumerate correctly decoded PB-TNC messages */ |
52 | 1.70k | enumerator = batch->create_msg_enumerator(batch); |
53 | 85.9k | while (enumerator->enumerate(enumerator, &msg)) |
54 | 84.2k | { |
55 | 84.2k | msg->get_type(msg); |
56 | 84.2k | } |
57 | 1.70k | enumerator->destroy(enumerator); |
58 | | |
59 | | /* enumerate errors detected while parsing PB-TNC batch and messages */ |
60 | 1.70k | enumerator = batch->create_error_enumerator(batch); |
61 | 4.08k | while (enumerator->enumerate(enumerator, &msg)) |
62 | 2.37k | { |
63 | 2.37k | error = (pb_error_msg_t*)msg; |
64 | 2.37k | error->get_error_code(error); |
65 | 2.37k | } |
66 | 1.70k | enumerator->destroy(enumerator); |
67 | | |
68 | 1.70k | batch->destroy(batch); |
69 | | |
70 | 1.70k | free(state); |
71 | 1.70k | library_deinit(); |
72 | 1.70k | return 0; |
73 | 1.70k | } |