crypto_sign_ed25519_keypair: 47| 1|{ 48| 1| EVP_PKEY_CTX *ctx = NULL; 49| 1| EVP_PKEY *pkey = NULL; 50| 1| size_t pklen, sklen; 51| 1| int ret = -1; 52| | 53| 1| if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_ED25519, NULL)) == NULL) { ------------------ | Branch (53:6): [True: 0, False: 1] ------------------ 54| 0| debug3_f("EVP_PKEY_CTX_new_id failed"); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 55| 0| goto out; 56| 0| } 57| 1| if (EVP_PKEY_keygen_init(ctx) <= 0) { ------------------ | Branch (57:6): [True: 0, False: 1] ------------------ 58| 0| debug3_f("EVP_PKEY_keygen_init failed"); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 59| 0| goto out; 60| 0| } 61| 1| if (EVP_PKEY_keygen(ctx, &pkey) <= 0) { ------------------ | Branch (61:6): [True: 0, False: 1] ------------------ 62| 0| debug3_f("EVP_PKEY_keygen failed"); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 63| 0| goto out; 64| 0| } 65| | 66| | /* Extract public key */ 67| 1| pklen = crypto_sign_ed25519_PUBLICKEYBYTES; ------------------ | | 60| 1|#define crypto_sign_ed25519_PUBLICKEYBYTES 32U ------------------ 68| 1| if (!EVP_PKEY_get_raw_public_key(pkey, pk, &pklen)) { ------------------ | Branch (68:6): [True: 0, False: 1] ------------------ 69| 0| debug3_f("EVP_PKEY_get_raw_public_key failed"); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 70| 0| goto out; 71| 0| } 72| 1| if (pklen != crypto_sign_ed25519_PUBLICKEYBYTES) { ------------------ | | 60| 1|#define crypto_sign_ed25519_PUBLICKEYBYTES 32U ------------------ | Branch (72:6): [True: 0, False: 1] ------------------ 73| 0| debug3_f("public key length mismatch: %zu", pklen); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 74| 0| goto out; 75| 0| } 76| | 77| 1| sklen = SSH_ED25519_RAW_SECRET_KEY_LEN; ------------------ | | 43| 1| (crypto_sign_ed25519_SECRETKEYBYTES - crypto_sign_ed25519_PUBLICKEYBYTES) | | ------------------ | | | | 59| 1|#define crypto_sign_ed25519_SECRETKEYBYTES 64U | | ------------------ | | (crypto_sign_ed25519_SECRETKEYBYTES - crypto_sign_ed25519_PUBLICKEYBYTES) | | ------------------ | | | | 60| 1|#define crypto_sign_ed25519_PUBLICKEYBYTES 32U | | ------------------ ------------------ 78| | /* Extract private key (32 bytes seed) */ 79| 1| if (!EVP_PKEY_get_raw_private_key(pkey, sk, &sklen)) { ------------------ | Branch (79:6): [True: 0, False: 1] ------------------ 80| 0| debug3_f("EVP_PKEY_get_raw_private_key failed"); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 81| 0| goto out; 82| 0| } 83| 1| if (sklen != SSH_ED25519_RAW_SECRET_KEY_LEN) { ------------------ | | 43| 1| (crypto_sign_ed25519_SECRETKEYBYTES - crypto_sign_ed25519_PUBLICKEYBYTES) | | ------------------ | | | | 59| 1|#define crypto_sign_ed25519_SECRETKEYBYTES 64U | | ------------------ | | (crypto_sign_ed25519_SECRETKEYBYTES - crypto_sign_ed25519_PUBLICKEYBYTES) | | ------------------ | | | | 60| 1|#define crypto_sign_ed25519_PUBLICKEYBYTES 32U | | ------------------ ------------------ | Branch (83:6): [True: 0, False: 1] ------------------ 84| 0| debug3_f("private key length mismatch: %zu", sklen); ------------------ | | 120| 0|#define debug3_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, NULL, __VA_ARGS__) ------------------ 85| 0| goto out; 86| 0| } 87| | 88| | /* Append public key to secret key (SUPERCOP format compatibility) */ 89| 1| memcpy(sk + sklen, pk, crypto_sign_ed25519_PUBLICKEYBYTES); ------------------ | | 60| 1|#define crypto_sign_ed25519_PUBLICKEYBYTES 32U ------------------ 90| | 91| 1| ret = 0; 92| 1|out: 93| 1| EVP_PKEY_free(pkey); 94| 1| EVP_PKEY_CTX_free(ctx); 95| 1| return ret; 96| 1|} ssh_krl_from_blob: 1046| 64|{ 1047| 64| struct sshbuf *copy = NULL, *sect = NULL; 1048| 64| struct ssh_krl *krl = NULL; 1049| 64| char timestamp[64]; 1050| 64| int r = SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 64|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 1051| 64| u_char type; 1052| 64| u_int format_version; 1053| | 1054| 64| *krlp = NULL; 1055| | 1056| | /* KRL must begin with magic string */ 1057| 64| if ((r = sshbuf_cmp(buf, 0, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0) { ------------------ | | 24| 64|#define KRL_MAGIC "SSHKRL\n\0" ------------------ if ((r = sshbuf_cmp(buf, 0, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0) { ------------------ | | 24| 64|#define KRL_MAGIC "SSHKRL\n\0" ------------------ | Branch (1057:6): [True: 64, False: 0] ------------------ 1058| 64| debug2_f("bad KRL magic header"); ------------------ | | 121| 64|#define debug2_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG2, NULL, __VA_ARGS__) ------------------ 1059| 64| return SSH_ERR_KRL_BAD_MAGIC; ------------------ | | 74| 64|#define SSH_ERR_KRL_BAD_MAGIC -50 ------------------ 1060| 64| } 1061| | 1062| 0| if ((krl = ssh_krl_init()) == NULL) { ------------------ | Branch (1062:6): [True: 0, False: 0] ------------------ 1063| 0| r = SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 1064| 0| error_f("alloc failed"); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1065| 0| goto out; 1066| 0| } 1067| | /* Don't modify buffer */ 1068| 0| if ((copy = sshbuf_fromb(buf)) == NULL) { ------------------ | Branch (1068:6): [True: 0, False: 0] ------------------ 1069| 0| r = SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 1070| 0| goto out; 1071| 0| } 1072| 0| if ((r = sshbuf_consume(copy, sizeof(KRL_MAGIC) - 1)) != 0 || ------------------ | | 24| 0|#define KRL_MAGIC "SSHKRL\n\0" ------------------ | Branch (1072:6): [True: 0, False: 0] ------------------ 1073| 0| (r = sshbuf_get_u32(copy, &format_version)) != 0) ------------------ | Branch (1073:6): [True: 0, False: 0] ------------------ 1074| 0| goto out; 1075| 0| if (format_version != KRL_FORMAT_VERSION) { ------------------ | | 25| 0|#define KRL_FORMAT_VERSION 1 ------------------ | Branch (1075:6): [True: 0, False: 0] ------------------ 1076| 0| error_f("unsupported KRL format version %u", format_version); ------------------ | | 125| 0|#define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1077| 0| r = SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 0|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 1078| 0| goto out; 1079| 0| } 1080| 0| if ((r = sshbuf_get_u64(copy, &krl->krl_version)) != 0 || ------------------ | Branch (1080:6): [True: 0, False: 0] ------------------ 1081| 0| (r = sshbuf_get_u64(copy, &krl->generated_date)) != 0 || ------------------ | Branch (1081:6): [True: 0, False: 0] ------------------ 1082| 0| (r = sshbuf_get_u64(copy, &krl->flags)) != 0 || ------------------ | Branch (1082:6): [True: 0, False: 0] ------------------ 1083| 0| (r = sshbuf_skip_string(copy)) != 0 || ------------------ | | 232| 0|#define sshbuf_skip_string(buf) sshbuf_get_string_direct(buf, NULL, NULL) ------------------ | Branch (1083:6): [True: 0, False: 0] ------------------ 1084| 0| (r = sshbuf_get_cstring(copy, &krl->comment, NULL)) != 0) { ------------------ | Branch (1084:6): [True: 0, False: 0] ------------------ 1085| 0| error_fr(r, "parse KRL header"); ------------------ | | 145| 0|#define error_fr(r, ...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, ssh_err(r), __VA_ARGS__) ------------------ 1086| 0| goto out; 1087| 0| } 1088| 0| format_timestamp(krl->generated_date, timestamp, sizeof(timestamp)); 1089| 0| debug("KRL version %llu generated at %s%s%s", ------------------ | | 111| 0|#define debug(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_DEBUG1, NULL, __VA_ARGS__) | | ------------------ | | | Branch (111:88): [True: 0, False: 0] | | ------------------ ------------------ 1090| 0| (long long unsigned)krl->krl_version, timestamp, 1091| 0| *krl->comment ? ": " : "", krl->comment); 1092| | 1093| | /* Parse and load the KRL sections. */ 1094| 0| while (sshbuf_len(copy) > 0) { ------------------ | Branch (1094:9): [True: 0, False: 0] ------------------ 1095| 0| sshbuf_free(sect); 1096| 0| sect = NULL; 1097| 0| if ((r = sshbuf_get_u8(copy, &type)) != 0 || ------------------ | Branch (1097:7): [True: 0, False: 0] ------------------ 1098| 0| (r = sshbuf_froms(copy, §)) != 0) ------------------ | Branch (1098:7): [True: 0, False: 0] ------------------ 1099| 0| goto out; 1100| 0| KRL_DBG(("section 0x%02x", type)); 1101| | 1102| 0| switch (type) { 1103| 0| case KRL_SECTION_CERTIFICATES: ------------------ | | 28| 0|#define KRL_SECTION_CERTIFICATES 1 ------------------ | Branch (1103:3): [True: 0, False: 0] ------------------ 1104| 0| if ((r = parse_revoked_certs(sect, krl)) != 0) ------------------ | Branch (1104:8): [True: 0, False: 0] ------------------ 1105| 0| goto out; 1106| 0| break; 1107| 0| case KRL_SECTION_EXPLICIT_KEY: ------------------ | | 29| 0|#define KRL_SECTION_EXPLICIT_KEY 2 ------------------ | Branch (1107:3): [True: 0, False: 0] ------------------ 1108| 0| if ((r = blob_section(sect, ------------------ | Branch (1108:8): [True: 0, False: 0] ------------------ 1109| 0| &krl->revoked_keys, 0)) != 0) 1110| 0| goto out; 1111| 0| break; 1112| 0| case KRL_SECTION_FINGERPRINT_SHA1: ------------------ | | 30| 0|#define KRL_SECTION_FINGERPRINT_SHA1 3 ------------------ | Branch (1112:3): [True: 0, False: 0] ------------------ 1113| 0| if ((r = blob_section(sect, ------------------ | Branch (1113:8): [True: 0, False: 0] ------------------ 1114| 0| &krl->revoked_sha1s, 20)) != 0) 1115| 0| goto out; 1116| 0| break; 1117| 0| case KRL_SECTION_FINGERPRINT_SHA256: ------------------ | | 32| 0|#define KRL_SECTION_FINGERPRINT_SHA256 5 ------------------ | Branch (1117:3): [True: 0, False: 0] ------------------ 1118| 0| if ((r = blob_section(sect, ------------------ | Branch (1118:8): [True: 0, False: 0] ------------------ 1119| 0| &krl->revoked_sha256s, 32)) != 0) 1120| 0| goto out; 1121| 0| break; 1122| 0| case KRL_SECTION_EXTENSION: ------------------ | | 33| 0|#define KRL_SECTION_EXTENSION 255 ------------------ | Branch (1122:3): [True: 0, False: 0] ------------------ 1123| 0| if ((r = extension_section(sect, krl)) != 0) ------------------ | Branch (1123:8): [True: 0, False: 0] ------------------ 1124| 0| goto out; 1125| 0| break; 1126| 0| case KRL_SECTION_SIGNATURE: ------------------ | | 31| 0|#define KRL_SECTION_SIGNATURE 4 ------------------ | Branch (1126:3): [True: 0, False: 0] ------------------ 1127| | /* Handled above, but still need to stay in synch */ 1128| 0| sshbuf_free(sect); 1129| 0| sect = NULL; 1130| 0| if ((r = sshbuf_skip_string(copy)) != 0) ------------------ | | 232| 0|#define sshbuf_skip_string(buf) sshbuf_get_string_direct(buf, NULL, NULL) ------------------ | Branch (1130:8): [True: 0, False: 0] ------------------ 1131| 0| goto out; 1132| 0| break; 1133| 0| default: ------------------ | Branch (1133:3): [True: 0, False: 0] ------------------ 1134| 0| error("Unsupported KRL section %u", type); ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1135| 0| r = SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 0|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 1136| 0| goto out; 1137| 0| } 1138| 0| if (sect != NULL && sshbuf_len(sect) > 0) { ------------------ | Branch (1138:7): [True: 0, False: 0] | Branch (1138:23): [True: 0, False: 0] ------------------ 1139| 0| error("KRL section contains unparsed data"); ------------------ | | 114| 0|#define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) ------------------ 1140| 0| r = SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 0|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 1141| 0| goto out; 1142| 0| } 1143| 0| } 1144| | 1145| | /* Success */ 1146| 0| *krlp = krl; 1147| 0| r = 0; 1148| 0| out: 1149| 0| if (r != 0) ------------------ | Branch (1149:6): [True: 0, False: 0] ------------------ 1150| 0| ssh_krl_free(krl); 1151| 0| sshbuf_free(copy); 1152| 0| sshbuf_free(sect); 1153| 0| return r; 1154| 0|} log_init: 196| 1|{ 197| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 198| | struct syslog_data sdata = SYSLOG_DATA_INIT; 199| |#endif 200| | 201| 1| argv0 = av0; 202| | 203| 1| if (log_change_level(level) != 0) { ------------------ | Branch (203:6): [True: 0, False: 1] ------------------ 204| 0| fprintf(stderr, "Unrecognized internal syslog level code %d\n", 205| 0| (int) level); 206| 0| exit(1); 207| 0| } 208| | 209| 1| log_handler = NULL; 210| 1| log_handler_ctx = NULL; 211| | 212| 1| log_on_stderr = on_stderr; 213| 1| if (on_stderr) ------------------ | Branch (213:6): [True: 0, False: 1] ------------------ 214| 0| return; 215| | 216| 1| switch (facility) { 217| 0| case SYSLOG_FACILITY_DAEMON: ------------------ | Branch (217:2): [True: 0, False: 1] ------------------ 218| 0| log_facility = LOG_DAEMON; 219| 0| break; 220| 0| case SYSLOG_FACILITY_USER: ------------------ | Branch (220:2): [True: 0, False: 1] ------------------ 221| 0| log_facility = LOG_USER; 222| 0| break; 223| 1| case SYSLOG_FACILITY_AUTH: ------------------ | Branch (223:2): [True: 1, False: 0] ------------------ 224| 1| log_facility = LOG_AUTH; 225| 1| break; 226| 0|#ifdef LOG_AUTHPRIV 227| 0| case SYSLOG_FACILITY_AUTHPRIV: ------------------ | Branch (227:2): [True: 0, False: 1] ------------------ 228| 0| log_facility = LOG_AUTHPRIV; 229| 0| break; 230| 0|#endif 231| 0| case SYSLOG_FACILITY_LOCAL0: ------------------ | Branch (231:2): [True: 0, False: 1] ------------------ 232| 0| log_facility = LOG_LOCAL0; 233| 0| break; 234| 0| case SYSLOG_FACILITY_LOCAL1: ------------------ | Branch (234:2): [True: 0, False: 1] ------------------ 235| 0| log_facility = LOG_LOCAL1; 236| 0| break; 237| 0| case SYSLOG_FACILITY_LOCAL2: ------------------ | Branch (237:2): [True: 0, False: 1] ------------------ 238| 0| log_facility = LOG_LOCAL2; 239| 0| break; 240| 0| case SYSLOG_FACILITY_LOCAL3: ------------------ | Branch (240:2): [True: 0, False: 1] ------------------ 241| 0| log_facility = LOG_LOCAL3; 242| 0| break; 243| 0| case SYSLOG_FACILITY_LOCAL4: ------------------ | Branch (243:2): [True: 0, False: 1] ------------------ 244| 0| log_facility = LOG_LOCAL4; 245| 0| break; 246| 0| case SYSLOG_FACILITY_LOCAL5: ------------------ | Branch (246:2): [True: 0, False: 1] ------------------ 247| 0| log_facility = LOG_LOCAL5; 248| 0| break; 249| 0| case SYSLOG_FACILITY_LOCAL6: ------------------ | Branch (249:2): [True: 0, False: 1] ------------------ 250| 0| log_facility = LOG_LOCAL6; 251| 0| break; 252| 0| case SYSLOG_FACILITY_LOCAL7: ------------------ | Branch (252:2): [True: 0, False: 1] ------------------ 253| 0| log_facility = LOG_LOCAL7; 254| 0| break; 255| 0| default: ------------------ | Branch (255:2): [True: 0, False: 1] ------------------ 256| 0| fprintf(stderr, 257| 0| "Unrecognized internal syslog facility code %d\n", 258| 0| (int) facility); 259| 0| exit(1); 260| 1| } 261| | 262| | /* 263| | * If an external library (eg libwrap) attempts to use syslog 264| | * immediately after reexec, syslog may be pointing to the wrong 265| | * facility, so we force an open/close of syslog here. 266| | */ 267| |#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 268| | openlog_r(argv0 ? argv0 : __progname, LOG_PID, log_facility, &sdata); 269| | closelog_r(&sdata); 270| |#else 271| 1| openlog(argv0 ? argv0 : __progname, LOG_PID, log_facility); ------------------ | Branch (271:10): [True: 1, False: 0] ------------------ 272| 1| closelog(); 273| 1|#endif 274| 1|} log_change_level: 278| 1|{ 279| | /* no-op if log_init has not been called */ 280| 1| if (argv0 == NULL) ------------------ | Branch (280:6): [True: 0, False: 1] ------------------ 281| 0| return 0; 282| | 283| 1| switch (new_log_level) { 284| 0| case SYSLOG_LEVEL_QUIET: ------------------ | Branch (284:2): [True: 0, False: 1] ------------------ 285| 0| case SYSLOG_LEVEL_FATAL: ------------------ | Branch (285:2): [True: 0, False: 1] ------------------ 286| 1| case SYSLOG_LEVEL_ERROR: ------------------ | Branch (286:2): [True: 1, False: 0] ------------------ 287| 1| case SYSLOG_LEVEL_INFO: ------------------ | Branch (287:2): [True: 0, False: 1] ------------------ 288| 1| case SYSLOG_LEVEL_VERBOSE: ------------------ | Branch (288:2): [True: 0, False: 1] ------------------ 289| 1| case SYSLOG_LEVEL_DEBUG1: ------------------ | Branch (289:2): [True: 0, False: 1] ------------------ 290| 1| case SYSLOG_LEVEL_DEBUG2: ------------------ | Branch (290:2): [True: 0, False: 1] ------------------ 291| 1| case SYSLOG_LEVEL_DEBUG3: ------------------ | Branch (291:2): [True: 0, False: 1] ------------------ 292| 1| log_level = new_log_level; 293| 1| return 0; 294| 0| default: ------------------ | Branch (294:2): [True: 0, False: 1] ------------------ 295| 0| return -1; 296| 1| } 297| 1|} sshlog: 430| 64|{ 431| 64| va_list args; 432| | 433| 64| va_start(args, fmt); 434| 64| sshlogv(file, func, line, showfunc, level, suffix, fmt, args); 435| | va_end(args); 436| 64|} sshlogv: 454| 64|{ 455| 64| char tag[128], fmt2[MSGBUFSIZ + 128]; 456| 64| int forced = 0; 457| 64| const char *cp; 458| 64| size_t i; 459| | 460| | /* short circuit processing early if we're not going to log anything */ 461| 64| if (nlog_verbose == 0 && level > log_level) ------------------ | Branch (461:6): [True: 64, False: 0] | Branch (461:27): [True: 64, False: 0] ------------------ 462| 64| return; 463| | 464| 0| snprintf(tag, sizeof(tag), "%.48s:%.48s():%d (bin=%s, pid=%ld)", 465| 0| (cp = strrchr(file, '/')) == NULL ? file : cp + 1, func, line, ------------------ | Branch (465:6): [True: 0, False: 0] ------------------ 466| 0| argv0 == NULL ? "UNKNOWN" : argv0, (long)getpid()); ------------------ | Branch (466:6): [True: 0, False: 0] ------------------ 467| 0| for (i = 0; i < nlog_verbose; i++) { ------------------ | Branch (467:14): [True: 0, False: 0] ------------------ 468| 0| if (match_pattern_list(tag, log_verbose[i], 0) == 1) { ------------------ | Branch (468:7): [True: 0, False: 0] ------------------ 469| 0| forced = 1; 470| 0| break; 471| 0| } 472| 0| } 473| | 474| 0| if (forced) ------------------ | Branch (474:6): [True: 0, False: 0] ------------------ 475| 0| snprintf(fmt2, sizeof(fmt2), "%s: %s", tag, fmt); 476| 0| else if (showfunc) ------------------ | Branch (476:11): [True: 0, False: 0] ------------------ 477| 0| snprintf(fmt2, sizeof(fmt2), "%s: %s", func, fmt); 478| 0| else 479| 0| strlcpy(fmt2, fmt, sizeof(fmt2)); 480| | 481| 0| do_log(level, forced, suffix, fmt2, args); 482| 0|} freezero: 26| 64|{ 27| 64| if (ptr == NULL) ------------------ | Branch (27:6): [True: 0, False: 64] ------------------ 28| 0| return; 29| 64| explicit_bzero(ptr, sz); 30| 64| free(ptr); 31| 64|} timingsafe_bcmp: 25| 61|{ 26| 61| const unsigned char *p1 = b1, *p2 = b2; 27| 61| int ret = 0; 28| | 29| 549| for (; n > 0; n--) ------------------ | Branch (29:9): [True: 488, False: 61] ------------------ 30| 488| ret |= *p1++ ^ *p2++; 31| 61| return (ret != 0); 32| 61|} LLVMFuzzerTestOneInput: 23| 67|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 24| | // single initialisation 25| 67| if (!initialised) { ------------------ | Branch (25:9): [True: 1, False: 66] ------------------ 26| 1| log_init("krl_fuzz", SYSLOG_LEVEL_ERROR, SYSLOG_FACILITY_AUTH, 0); 27| | 28| 1| if ((null_file = fopen("/dev/null", "w")) == NULL) return 0; ------------------ | Branch (28:13): [True: 0, False: 1] ------------------ 29| | 30| 1| if (sshkey_generate(KEY_ED25519, 0, &key) != 0) return 0; ------------------ | Branch (30:13): [True: 0, False: 1] ------------------ 31| | 32| 1| initialised = 1; 33| 1| } 34| | 35| | // Reject empty corpus 36| 67| if (size < 4) return 0; ------------------ | Branch (36:9): [True: 3, False: 64] ------------------ 37| | 38| | // Convert fuzzer data to ssh buffer 39| 64| struct sshbuf *buf = sshbuf_from(data, size); 40| 64| if (!buf) return 0; ------------------ | Branch (40:9): [True: 0, False: 64] ------------------ 41| | 42| | // Parse the ssh buffer as krl, early exit if failed 43| 64| struct ssh_krl *krl = NULL; 44| 64| int ret = ssh_krl_from_blob(buf, &krl); 45| 64| sshbuf_free(buf); 46| 64| if (ret != 0) return 0; ------------------ | Branch (46:9): [True: 64, False: 0] ------------------ 47| | 48| | // Fuzz serailisation roundtrip 49| 0| struct sshbuf *output = sshbuf_new(); 50| 0| struct ssh_krl *krl2 = NULL; 51| 0| ssh_krl_to_blob(krl, output); 52| 0| ssh_krl_from_blob(output, &krl2); 53| 0| ssh_krl_free(krl2); 54| 0| sshbuf_free(output); 55| | 56| | // Fuzz krl_dump 57| 0| krl_dump(krl, null_file); 58| | 59| | // Fuzz ssh_krl_check_key 60| 0| ssh_krl_check_key(krl, key); 61| | 62| 0| ssh_krl_free(krl); 63| 0| return 0; 64| 64|} ssh-ed25519.c:ssh_ed25519_generate: 82| 1|{ 83| 1| if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || ------------------ | | 141| 1|#define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES | | ------------------ | | | | 60| 1|#define crypto_sign_ed25519_PUBLICKEYBYTES 32U | | ------------------ ------------------ | Branch (83:6): [True: 0, False: 1] ------------------ 84| 1| (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) ------------------ | | 140| 1|#define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES | | ------------------ | | | | 59| 1|#define crypto_sign_ed25519_SECRETKEYBYTES 64U | | ------------------ ------------------ | Branch (84:6): [True: 0, False: 1] ------------------ 85| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 86| 1| if (crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk) != 0) ------------------ | Branch (86:6): [True: 0, False: 1] ------------------ 87| 0| return SSH_ERR_CRYPTO_ERROR; ------------------ | | 85| 0|#define SSH_ERR_CRYPTO_ERROR -61 ------------------ 88| 1| return 0; 89| 1|} sshbuf_cmp: 277| 64|{ 278| 64| if (sshbuf_ptr(b) == NULL) ------------------ | Branch (278:6): [True: 0, False: 64] ------------------ 279| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 280| 64| if (offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0) ------------------ | | 39| 128|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ if (offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0) ------------------ | | 39| 128|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (280:6): [True: 0, False: 64] | Branch (280:34): [True: 0, False: 64] | Branch (280:59): [True: 0, False: 64] ------------------ 281| 0| return SSH_ERR_INVALID_ARGUMENT; ------------------ | | 34| 0|#define SSH_ERR_INVALID_ARGUMENT -10 ------------------ 282| 64| if (offset + len > sshbuf_len(b)) ------------------ | Branch (282:6): [True: 3, False: 61] ------------------ 283| 3| return SSH_ERR_MESSAGE_INCOMPLETE; ------------------ | | 27| 3|#define SSH_ERR_MESSAGE_INCOMPLETE -3 ------------------ 284| 61| if (timingsafe_bcmp(sshbuf_ptr(b) + offset, s, len) != 0) ------------------ | Branch (284:6): [True: 61, False: 0] ------------------ 285| 61| return SSH_ERR_INVALID_FORMAT; ------------------ | | 28| 61|#define SSH_ERR_INVALID_FORMAT -4 ------------------ 286| 0| return 0; 287| 61|} sshbuf_from: 113| 64|{ 114| 64| struct sshbuf *ret; 115| | 116| 64| if (blob == NULL || len > SSHBUF_SIZE_MAX || ------------------ | | 39| 128|#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */ ------------------ | Branch (116:6): [True: 0, False: 64] | Branch (116:22): [True: 0, False: 64] ------------------ 117| 64| (ret = calloc(1, sizeof(*ret))) == NULL) ------------------ | Branch (117:6): [True: 0, False: 64] ------------------ 118| 0| return NULL; 119| 64| ret->alloc = ret->size = ret->max_size = len; 120| 64| ret->readonly = 1; 121| 64| ret->refcount = 1; 122| 64| ret->parent = NULL; 123| 64| ret->cd = blob; 124| | ret->d = NULL; 125| 64| return ret; 126| 64|} sshbuf_free: 162| 128|{ 163| 128| if (buf == NULL) ------------------ | Branch (163:6): [True: 64, False: 64] ------------------ 164| 64| return; 165| | /* 166| | * The following will leak on insane buffers, but this is the safest 167| | * course of action - an invalid pointer or already-freed pointer may 168| | * have been passed to us and continuing to scribble over memory would 169| | * be bad. 170| | */ 171| 64| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (171:6): [True: 0, False: 64] ------------------ 172| 0| return; 173| | 174| | /* 175| | * If we are a parent with still-extant children, then don't free just 176| | * yet. The last child's call to sshbuf_free should decrement our 177| | * refcount to 0 and trigger the actual free. 178| | */ 179| 64| buf->refcount--; 180| 64| if (buf->refcount > 0) ------------------ | Branch (180:6): [True: 0, False: 64] ------------------ 181| 0| return; 182| | 183| | /* 184| | * If we are a child, then free our parent to decrement its reference 185| | * count and possibly free it. 186| | */ 187| 64| sshbuf_free(buf->parent); 188| 64| buf->parent = NULL; 189| | 190| 64| if (!buf->readonly) ------------------ | Branch (190:6): [True: 0, False: 64] ------------------ 191| 0| freezero(buf->d, buf->alloc); 192| 64| freezero(buf, sizeof(*buf)); 193| 64|} sshbuf_len: 282| 64|{ 283| 64| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (283:6): [True: 0, False: 64] ------------------ 284| 0| return 0; 285| 64| return buf->size - buf->off; 286| 64|} sshbuf_ptr: 298| 125|{ 299| 125| if (sshbuf_check_sanity(buf) != 0) ------------------ | Branch (299:6): [True: 0, False: 125] ------------------ 300| 0| return NULL; 301| 125| return buf->cd + buf->off; 302| 125|} sshbuf.c:sshbuf_check_sanity: 56| 253|{ 57| 253| SSHBUF_TELL("sanity"); 58| 253| if (__predict_false(buf == NULL || ------------------ | | 986| 4.80k|# define __predict_false(exp) __builtin_expect(((exp) != 0), 0) | | ------------------ | | | Branch (986:35): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 0] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | | Branch (986:54): [True: 0, False: 253] | | ------------------ ------------------ 59| 253| (!buf->readonly && buf->d != buf->cd) || 60| 253| buf->parent == buf || 61| 253| buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX || 62| 253| buf->cd == NULL || 63| 253| buf->max_size > SSHBUF_SIZE_MAX || 64| 253| buf->alloc > buf->max_size || 65| 253| buf->size > buf->alloc || 66| 253| buf->off > buf->size)) { 67| | /* Do not try to recover from corrupted buffer internals */ 68| 0| SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR")); 69| 0| ssh_signal(SIGSEGV, SIG_DFL); 70| 0| raise(SIGSEGV); 71| 0| return SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 0|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 72| 0| } 73| 253| return 0; 74| 253|} sshkey_type_is_cert: 209| 2|{ 210| 2| const struct sshkey_impl *impl; 211| | 212| 2| if ((impl = sshkey_impl_from_type(type)) == NULL) ------------------ | Branch (212:6): [True: 1, False: 1] ------------------ 213| 1| return 0; 214| 1| return impl->cert; 215| 2|} sshkey_is_cert: 411| 1|{ 412| 1| if (k == NULL) ------------------ | Branch (412:6): [True: 0, False: 1] ------------------ 413| 0| return 0; 414| 1| return sshkey_type_is_cert(k->type); 415| 1|} sshkey_new: 686| 1|{ 687| 1| struct sshkey *k; 688| 1| const struct sshkey_impl *impl = NULL; 689| | 690| 1| if (type != KEY_UNSPEC && ------------------ | Branch (690:6): [True: 0, False: 1] ------------------ 691| 0| (impl = sshkey_impl_from_type(type)) == NULL) ------------------ | Branch (691:6): [True: 0, False: 0] ------------------ 692| 0| return NULL; 693| | 694| | /* All non-certificate types may act as CAs */ 695| 1| if ((k = calloc(1, sizeof(*k))) == NULL) ------------------ | Branch (695:6): [True: 0, False: 1] ------------------ 696| 0| return NULL; 697| 1| k->type = type; 698| 1| k->ecdsa_nid = -1; 699| 1| if (impl != NULL && impl->funcs->alloc != NULL) { ------------------ | Branch (699:6): [True: 0, False: 1] | Branch (699:22): [True: 0, False: 0] ------------------ 700| 0| if (impl->funcs->alloc(k) != 0) { ------------------ | Branch (700:7): [True: 0, False: 0] ------------------ 701| 0| free(k); 702| 0| return NULL; 703| 0| } 704| 0| } 705| 1| if (sshkey_is_cert(k)) { ------------------ | Branch (705:6): [True: 0, False: 1] ------------------ 706| 0| if ((k->cert = cert_new()) == NULL) { ------------------ | Branch (706:7): [True: 0, False: 0] ------------------ 707| 0| sshkey_free(k); 708| 0| return NULL; 709| 0| } 710| 0| } 711| | 712| 1| return k; 713| 1|} sshkey_generate: 1494| 1|{ 1495| 1| struct sshkey *k; 1496| 1| int ret = SSH_ERR_INTERNAL_ERROR; ------------------ | | 25| 1|#define SSH_ERR_INTERNAL_ERROR -1 ------------------ 1497| 1| const struct sshkey_impl *impl; 1498| | 1499| 1| if (keyp == NULL || sshkey_type_is_cert(type)) ------------------ | Branch (1499:6): [True: 0, False: 1] | Branch (1499:22): [True: 0, False: 1] ------------------ 1500| 0| return SSH_ERR_INVALID_ARGUMENT; ------------------ | | 34| 0|#define SSH_ERR_INVALID_ARGUMENT -10 ------------------ 1501| 1| *keyp = NULL; 1502| 1| if ((impl = sshkey_impl_from_type(type)) == NULL) ------------------ | Branch (1502:6): [True: 0, False: 1] ------------------ 1503| 0| return SSH_ERR_KEY_TYPE_UNKNOWN; ------------------ | | 38| 0|#define SSH_ERR_KEY_TYPE_UNKNOWN -14 /* XXX UNSUPPORTED? */ ------------------ 1504| 1| if (impl->funcs->generate == NULL) ------------------ | Branch (1504:6): [True: 0, False: 1] ------------------ 1505| 0| return SSH_ERR_FEATURE_UNSUPPORTED; ------------------ | | 83| 0|#define SSH_ERR_FEATURE_UNSUPPORTED -59 ------------------ 1506| 1| if ((k = sshkey_new(KEY_UNSPEC)) == NULL) ------------------ | Branch (1506:6): [True: 0, False: 1] ------------------ 1507| 0| return SSH_ERR_ALLOC_FAIL; ------------------ | | 26| 0|#define SSH_ERR_ALLOC_FAIL -2 ------------------ 1508| 1| k->type = type; 1509| 1| if ((ret = impl->funcs->generate(k, bits)) != 0) { ------------------ | Branch (1509:6): [True: 0, False: 1] ------------------ 1510| 0| sshkey_free(k); 1511| 0| return ret; 1512| 0| } 1513| | /* success */ 1514| 1| *keyp = k; 1515| 1| return 0; 1516| 1|} sshkey.c:sshkey_impl_from_type: 156| 3|{ 157| 3| int i; 158| | 159| 25| for (i = 0; keyimpls[i] != NULL; i++) { ------------------ | Branch (159:14): [True: 24, False: 1] ------------------ 160| 24| if (keyimpls[i]->type == type) ------------------ | Branch (160:7): [True: 2, False: 22] ------------------ 161| 2| return keyimpls[i]; 162| 24| } 163| 1| return NULL; 164| 3|}