LLVMFuzzerTestOneInput: 22| 187|extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {//ntpsec/tests/ntpd/nts_extens.c 23| | 24| 187| if (Size < kMinInputLength || Size > kMaxInputLength){ ------------------ | | 19| 374|#define kMinInputLength 20 ------------------ if (Size < kMinInputLength || Size > kMaxInputLength){ ------------------ | | 20| 179|#define kMaxInputLength 1024 ------------------ | Branch (24:6): [True: 8, False: 179] | Branch (24:32): [True: 24, False: 155] ------------------ 25| 32| return 0; 26| 32| } 27| | 28| 155| struct ntspacket_t ntspkt; 29| 155| memset(&ntspkt, 0, sizeof(ntspkt)); 30| | 31| 155| return extens_server_recv(&ntspkt,(uint8_t*)Data, Size); 32| 187|} ex_next_record: 485| 810|uint16_t ex_next_record(BufCtl* buf, int *length) { 486| 810| uint16_t *ptr = (uint16_t *)buf->next; 487| 810| uint16_t type = ntohs(*ptr++); 488| 810| *length = ntohs(*ptr++)-NTS_KE_HDR_LNG; ------------------ | | 71| 810|#define NTS_KE_HDR_LNG 4 ------------------ 489| 810| buf->next += NTS_KE_HDR_LNG; ------------------ | | 71| 810|#define NTS_KE_HDR_LNG 4 ------------------ 490| 810| buf->left -= NTS_KE_HDR_LNG; ------------------ | | 71| 810|#define NTS_KE_HDR_LNG 4 ------------------ 491| 810| return type; 492| 810|} next_bytes: 504| 202|uint16_t next_bytes(BufCtl* buf, uint8_t *data, int length) { 505| 202| memcpy(data, buf->next, length); 506| 202| buf->next += length; 507| 202| buf->left -= length; 508| 202| return length; 509| 202|} nts_unpack_cookie: 362| 2| uint8_t *c2s, uint8_t *s2c, int *keylen) { 363| 2| uint8_t *finger; 364| 2| uint8_t plaintext[NTS_MAX_COOKIELEN]; 365| 2| uint8_t *nonce; 366| 2| uint32_t temp; 367| 2| size_t plainlength; 368| 2| int cipherlength; 369| 2| bool ok; 370| 2| struct NTS_Key *key; 371| 2| int i; 372| | 373| 2| if (NULL == cookie_ctx) ------------------ | Branch (373:13): [True: 2, False: 0] ------------------ 374| 2| return false; // We aren't initialized yet. 375| | 376| 0| if (0 == nts_nKeys) { ------------------ | Branch (376:13): [True: 0, False: 0] ------------------ 377| 0| nts_cnt.cookie_not_server++; 378| 0| return false; // We are not a NTS enabled server. 379| 0| } 380| | 381| | // We may get garbage from the net 382| 0| if (cookielen > NTS_MAX_COOKIELEN) ------------------ | | 97| 0|#define NTS_MAX_COOKIELEN 192 // see nts_cookie.c ------------------ | Branch (382:13): [True: 0, False: 0] ------------------ 383| 0| return false; 384| | 385| 0| finger = cookie; 386| 0| key = NULL; // squash uninitialized warning 387| 0| for (i=0; iI, sizeof(key->I))) { ------------------ | Branch (389:15): [True: 0, False: 0] ------------------ 390| 0| break; 391| 0| } 392| 0| } 393| 0| nts_cnt.cookie_decode_total++; // total attempts, includes too old 394| 0| if (nts_nKeys == i) { ------------------ | Branch (394:13): [True: 0, False: 0] ------------------ 395| 0| nts_cnt.cookie_decode_too_old++; 396| 0| return false; 397| 0| } 398| 0| if (0 == i) { ------------------ | Branch (398:13): [True: 0, False: 0] ------------------ 399| 0| nts_cnt.cookie_decode_current++; 400| 0| } else if (1 == i) { ------------------ | Branch (400:20): [True: 0, False: 0] ------------------ 401| 0| nts_cnt.cookie_decode_old++; 402| 0| } else if (2 == i) { ------------------ | Branch (402:20): [True: 0, False: 0] ------------------ 403| 0| nts_cnt.cookie_decode_old2++; 404| 0| } else { 405| 0| nts_cnt.cookie_decode_older++; 406| 0| } 407| |#if 0 408| | if (1I); 416| 0| nonce = finger; 417| 0| finger += NONCE_LENGTH; ------------------ | | 168| 0|#define NONCE_LENGTH 16 ------------------ 418| | 419| | // require(AD_LENGTH==finger-cookie); 420| | 421| 0| cipherlength = cookielen - AD_LENGTH; ------------------ | | 109| 0|#define AD_LENGTH 20 ------------------ 422| 0| plainlength = NTS_MAX_COOKIELEN; ------------------ | | 97| 0|#define NTS_MAX_COOKIELEN 192 // see nts_cookie.c ------------------ 423| | 424| 0| nts_lock_cookielock(); 425| | 426| 0| ok = AES_SIV_Decrypt(cookie_ctx, 427| 0| plaintext, &plainlength, 428| 0| key->K, K_length, 429| 0| nonce, NONCE_LENGTH, ------------------ | | 168| 0|#define NONCE_LENGTH 16 ------------------ 430| 0| finger, cipherlength, 431| 0| cookie, AD_LENGTH); ------------------ | | 109| 0|#define AD_LENGTH 20 ------------------ 432| | 433| 0| nts_unlock_cookielock(); 434| | 435| 0| if (!ok) { ------------------ | Branch (435:13): [True: 0, False: 0] ------------------ 436| 0| nts_cnt.cookie_decode_error++; 437| 0| return false; 438| 0| } 439| | 440| 0| *keylen = (plainlength-AEAD_LENGTH)/2; ------------------ | | 110| 0|#define AEAD_LENGTH 4 ------------------ 441| 0| finger = plaintext; 442| 0| memcpy(&temp, finger, AEAD_LENGTH); ------------------ | | 110| 0|#define AEAD_LENGTH 4 ------------------ 443| 0| *aead = temp; 444| 0| finger += AEAD_LENGTH; ------------------ | | 110| 0|#define AEAD_LENGTH 4 ------------------ 445| 0| memcpy(c2s, finger, *keylen); 446| 0| finger += *keylen; 447| 0| memcpy(s2c, finger, *keylen); 448| 0| finger += *keylen; 449| | 450| | return true; 451| 0|} extens_server_recv: 120| 155|bool extens_server_recv(struct ntspacket_t *ntspacket, uint8_t *pkt, int lng) { 121| 155| struct BufCtl_t buf; 122| 155| uint16_t aead; 123| 155| int noncelen, cmaclen; 124| 155| bool sawcookie, sawAEEF; 125| 155| int cookielen; /* cookie and placeholder(s) */ 126| | 127| 155| nts_cnt.server_recv_bad++; /* assume bad, undo if OK */ 128| | 129| 155| buf.next = pkt+LEN_PKT_NOMAC; ------------------ | | 375| 155|#define LEN_PKT_NOMAC 48 /* min header length */ ------------------ 130| 155| buf.left = lng-LEN_PKT_NOMAC; ------------------ | | 375| 155|#define LEN_PKT_NOMAC 48 /* min header length */ ------------------ 131| | 132| 155| sawcookie = sawAEEF = false; 133| 155| cookielen = 0; 134| 155| ntspacket->uidlen = 0; 135| 155| ntspacket->needed = 0; 136| | 137| 865| while (buf.left >= NTS_KE_HDR_LNG) { ------------------ | | 71| 865|#define NTS_KE_HDR_LNG 4 ------------------ | Branch (137:9): [True: 810, False: 55] ------------------ 138| 810| uint16_t type; 139| 810| int length, adlength; 140| 810| size_t outlen; 141| 810| uint8_t *nonce, *cmac; 142| 810| bool ok; 143| | 144| 810| type = ex_next_record(&buf, &length); /* length excludes header */ 145| 810| if (length&3 || length > buf.left || length < 0) { ------------------ | Branch (145:7): [True: 9, False: 801] | Branch (145:19): [True: 33, False: 768] | Branch (145:40): [True: 12, False: 756] ------------------ 146| 54| return false; 147| 54| } 148| 756| switch (type) { 149| 208| case Unique_Identifier: ------------------ | Branch (149:7): [True: 208, False: 548] ------------------ 150| 208| if (length > NTS_UID_MAX_LENGTH) { ------------------ | | 100| 208|#define NTS_UID_MAX_LENGTH 64 ------------------ | Branch (150:8): [True: 6, False: 202] ------------------ 151| 6| return false; 152| 6| } 153| 202| ntspacket->uidlen = length; 154| 202| next_bytes(&buf, ntspacket->UID, length); 155| 202| break; 156| 22| case NTS_Cookie: ------------------ | Branch (156:7): [True: 22, False: 734] ------------------ 157| | /* cookies and placeholders must be the same length 158| | * in order to avoid amplification attacks. 159| | */ 160| 22| if (sawcookie) { ------------------ | Branch (160:8): [True: 0, False: 22] ------------------ 161| 0| return false; /* second cookie */ 162| 0| } 163| 22| if (0 == cookielen) { ------------------ | Branch (163:8): [True: 1, False: 21] ------------------ 164| 1| cookielen = length; 165| 1| } 166| 21| else if (length != cookielen) { ------------------ | Branch (166:13): [True: 20, False: 1] ------------------ 167| 20| return false; 168| 20| } 169| 2| ok = nts_unpack_cookie(buf.next, length, &aead, ntspacket->c2s, 170| 2| ntspacket->s2c, &ntspacket->keylen); 171| 2| if (!ok) { ------------------ | Branch (171:8): [True: 2, False: 0] ------------------ 172| 2| return false; 173| 2| } 174| 0| buf.next += length; 175| 0| buf.left -= length; 176| 0| sawcookie = true; 177| 0| ntspacket->needed++; 178| 0| ntspacket->aead = aead; 179| 0| break; 180| 327| case NTS_Cookie_Placeholder: ------------------ | Branch (180:7): [True: 327, False: 429] ------------------ 181| 327| if (0 == cookielen) { ------------------ | Branch (181:8): [True: 242, False: 85] ------------------ 182| 242| cookielen = length; 183| 242| } 184| 85| else if (length != cookielen) { ------------------ | Branch (184:13): [True: 17, False: 68] ------------------ 185| 17| return false; 186| 17| } 187| 310| ntspacket->needed++; 188| 310| buf.next += length; 189| 310| buf.left -= length; 190| 310| break; 191| 1| case NTS_AEEF: ------------------ | Branch (191:7): [True: 1, False: 755] ------------------ 192| 1| if (!sawcookie) { ------------------ | Branch (192:8): [True: 1, False: 0] ------------------ 193| 1| return false; /* no cookie yet, no c2s */ 194| 1| } 195| 0| if (length != NTP_EX_HDR_LNG+NONCE_LENGTH+CMAC_LENGTH) { ------------------ | | 32| 0|#define NTP_EX_HDR_LNG 4 ------------------ if (length != NTP_EX_HDR_LNG+NONCE_LENGTH+CMAC_LENGTH) { ------------------ | | 29| 0|#define NONCE_LENGTH 16 ------------------ if (length != NTP_EX_HDR_LNG+NONCE_LENGTH+CMAC_LENGTH) { ------------------ | | 30| 0|#define CMAC_LENGTH 16 ------------------ | Branch (195:8): [True: 0, False: 0] ------------------ 196| 0| return false; 197| 0| } 198| | /* Additional data is up to this exten. */ 199| | /* backup over header */ 200| 0| adlength = buf.next-NTP_EX_HDR_LNG-pkt; ------------------ | | 32| 0|#define NTP_EX_HDR_LNG 4 ------------------ 201| 0| noncelen = next_uint16(&buf); 202| 0| cmaclen = next_uint16(&buf); 203| 0| if (noncelen & 3) { ------------------ | Branch (203:8): [True: 0, False: 0] ------------------ 204| 0| return false; /* would require padding */ 205| 0| } 206| 0| if (CMAC_LENGTH != cmaclen) { ------------------ | | 30| 0|#define CMAC_LENGTH 16 ------------------ | Branch (206:8): [True: 0, False: 0] ------------------ 207| 0| return false; 208| 0| } 209| 0| nonce = buf.next; 210| 0| cmac = nonce+NONCE_LENGTH; ------------------ | | 29| 0|#define NONCE_LENGTH 16 ------------------ 211| 0| outlen = 6; 212| 0| ok = AES_SIV_Decrypt(wire_ctx, 213| 0| NULL, &outlen, 214| 0| ntspacket->c2s, ntspacket->keylen, 215| 0| nonce, noncelen, 216| 0| cmac, CMAC_LENGTH, ------------------ | | 30| 0|#define CMAC_LENGTH 16 ------------------ 217| 0| pkt, adlength); 218| 0| if (!ok) { ------------------ | Branch (218:8): [True: 0, False: 0] ------------------ 219| 0| return false; 220| 0| } 221| 0| if (0 != outlen) { ------------------ | Branch (221:8): [True: 0, False: 0] ------------------ 222| 0| return false; 223| 0| } 224| | /* we already used 2 length slots way above*/ 225| 0| length -= (NTP_EX_U16_LNG+NTP_EX_U16_LNG); ------------------ | | 33| 0|#define NTP_EX_U16_LNG 2 ------------------ length -= (NTP_EX_U16_LNG+NTP_EX_U16_LNG); ------------------ | | 33| 0|#define NTP_EX_U16_LNG 2 ------------------ 226| 0| buf.next += length; 227| 0| buf.left -= length; 228| 0| if (0 != buf.left) { ------------------ | Branch (228:8): [True: 0, False: 0] ------------------ 229| 0| return false; /* Reject extens after AEEF block */ 230| 0| } 231| 0| sawAEEF = true; 232| 0| break; 233| 198| default: ------------------ | Branch (233:7): [True: 198, False: 558] ------------------ 234| | /* Non NTS extensions on requests at server. 235| | * Call out when we get some that we want. 236| | * Until then, just ignore it */ 237| 198| buf.next += length; 238| 198| buf.left -= length; 239| 198| break; 240| 756| } 241| 756| } 242| | 243| 55| if (!sawAEEF) { ------------------ | Branch (243:6): [True: 55, False: 0] ------------------ 244| 55| return false; 245| 55| } 246| 0| if (buf.left > 0) ------------------ | Branch (246:6): [True: 0, False: 0] ------------------ 247| 0| return false; 248| | 249| | // printf("ESRx: %d, %d, %d\n", 250| | // lng-LEN_PKT_NOMAC, ntspacket->needed, ntspacket->keylen); 251| 0| ntspacket->valid = true; 252| 0| nts_cnt.server_recv_good++; 253| 0| nts_cnt.server_recv_bad--; 254| | return true; 255| 0|}