mirror of
https://github.com/openssl/openssl.git
synced 2024-12-21 06:09:35 +08:00
9eabb30ab4
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23022)
199 lines
5.2 KiB
C
199 lines
5.2 KiB
C
/*
|
|
* Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
|
|
*
|
|
* Licensed under the Apache License 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
* https://www.openssl.org/source/license.html
|
|
* or in the file LICENSE in the source distribution.
|
|
*/
|
|
|
|
#include <openssl/ssl.h>
|
|
#include <openssl/err.h>
|
|
#include <openssl/bio.h>
|
|
#include "fuzzer.h"
|
|
#include "internal/quic_rcidm.h"
|
|
#include "internal/packet.h"
|
|
|
|
int FuzzerInitialize(int *argc, char ***argv)
|
|
{
|
|
FuzzerSetRand();
|
|
OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL);
|
|
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
|
|
ERR_clear_error();
|
|
return 1;
|
|
}
|
|
|
|
/*
|
|
* Fuzzer input "protocol":
|
|
* Big endian
|
|
* Zero or more of:
|
|
* RESET_WITH_ODCID u8(0x00) u8(cidl):cid
|
|
* RESET_WITHOUT_ODCID u8(0x01)
|
|
* (free and reallocate)
|
|
* ADD_FROM_INITIAL u8(0x02) u8(cidl):cid
|
|
* ADD_FROM_SERVER_RETRY u8(0x03) u8(cidl):cid
|
|
* ADD_FROM_NCID u8(0x04) u64(seq_num)
|
|
* u64(retire_prior_to) u8(cidl):cid
|
|
* ON_HANDSHAKE_COMPLETE u8(0x05)
|
|
* ON_PACKET_SENT u8(0x06) u64(num_pkt)
|
|
* REQUEST_ROLL u8(0x07)
|
|
* POP_RETIRE_SEQ_NUM u8(0x08)
|
|
* PEEK_RETIRE_SEQ_NUM u8(0x09)
|
|
* GET_PREFERRED_TX_DCID u8(0x0A)
|
|
* GET_PREFERRED_TX_DCID_CHANGED u8(0x0B) u8(clear)
|
|
*/
|
|
|
|
enum {
|
|
CMD_RESET_WITH_ODCID,
|
|
CMD_RESET_WITHOUT_ODCID,
|
|
CMD_ADD_FROM_INITIAL,
|
|
CMD_ADD_FROM_SERVER_RETRY,
|
|
CMD_ADD_FROM_NCID,
|
|
CMD_ON_HANDSHAKE_COMPLETE,
|
|
CMD_ON_PACKET_SENT,
|
|
CMD_REQUEST_ROLL,
|
|
CMD_POP_RETIRE_SEQ_NUM,
|
|
CMD_PEEK_RETIRE_SEQ_NUM,
|
|
CMD_GET_PREFERRED_TX_DCID,
|
|
CMD_GET_PREFERRED_TX_DCID_CHANGED
|
|
};
|
|
|
|
static int get_cid(PACKET *pkt, QUIC_CONN_ID *cid)
|
|
{
|
|
unsigned int cidl;
|
|
|
|
if (!PACKET_get_1(pkt, &cidl)
|
|
|| cidl > QUIC_MAX_CONN_ID_LEN
|
|
|| !PACKET_copy_bytes(pkt, cid->id, cidl))
|
|
return 0;
|
|
|
|
cid->id_len = (unsigned char)cidl;
|
|
return 1;
|
|
}
|
|
|
|
int FuzzerTestOneInput(const uint8_t *buf, size_t len)
|
|
{
|
|
int rc = 0;
|
|
QUIC_RCIDM *rcidm = NULL;
|
|
PACKET pkt;
|
|
uint64_t seq_num_out, arg_num_pkt;
|
|
unsigned int cmd, arg_clear;
|
|
QUIC_CONN_ID arg_cid, cid_out;
|
|
OSSL_QUIC_FRAME_NEW_CONN_ID ncid_frame;
|
|
|
|
if (!PACKET_buf_init(&pkt, buf, len))
|
|
goto err;
|
|
|
|
if ((rcidm = ossl_quic_rcidm_new(NULL)) == NULL)
|
|
goto err;
|
|
|
|
while (PACKET_remaining(&pkt) > 0) {
|
|
if (!PACKET_get_1(&pkt, &cmd))
|
|
goto err;
|
|
|
|
switch (cmd) {
|
|
case CMD_RESET_WITH_ODCID:
|
|
if (!get_cid(&pkt, &arg_cid)) {
|
|
rc = -1;
|
|
goto err;
|
|
}
|
|
|
|
ossl_quic_rcidm_free(rcidm);
|
|
|
|
if ((rcidm = ossl_quic_rcidm_new(&arg_cid)) == NULL)
|
|
goto err;
|
|
|
|
break;
|
|
|
|
case CMD_RESET_WITHOUT_ODCID:
|
|
ossl_quic_rcidm_free(rcidm);
|
|
|
|
if ((rcidm = ossl_quic_rcidm_new(NULL)) == NULL)
|
|
goto err;
|
|
|
|
break;
|
|
|
|
case CMD_ADD_FROM_INITIAL:
|
|
if (!get_cid(&pkt, &arg_cid)) {
|
|
rc = -1;
|
|
goto err;
|
|
}
|
|
|
|
ossl_quic_rcidm_add_from_initial(rcidm, &arg_cid);
|
|
break;
|
|
|
|
case CMD_ADD_FROM_SERVER_RETRY:
|
|
if (!get_cid(&pkt, &arg_cid)) {
|
|
rc = -1;
|
|
goto err;
|
|
}
|
|
|
|
ossl_quic_rcidm_add_from_server_retry(rcidm, &arg_cid);
|
|
break;
|
|
|
|
case CMD_ADD_FROM_NCID:
|
|
if (!PACKET_get_net_8(&pkt, &ncid_frame.seq_num)
|
|
|| !PACKET_get_net_8(&pkt, &ncid_frame.retire_prior_to)
|
|
|| !get_cid(&pkt, &ncid_frame.conn_id)) {
|
|
rc = -1;
|
|
goto err;
|
|
}
|
|
|
|
ossl_quic_rcidm_add_from_ncid(rcidm, &ncid_frame);
|
|
break;
|
|
|
|
case CMD_ON_HANDSHAKE_COMPLETE:
|
|
ossl_quic_rcidm_on_handshake_complete(rcidm);
|
|
break;
|
|
|
|
case CMD_ON_PACKET_SENT:
|
|
if (!PACKET_get_net_8(&pkt, &arg_num_pkt)) {
|
|
rc = -1;
|
|
goto err;
|
|
}
|
|
|
|
ossl_quic_rcidm_on_packet_sent(rcidm, arg_num_pkt);
|
|
break;
|
|
|
|
case CMD_REQUEST_ROLL:
|
|
ossl_quic_rcidm_request_roll(rcidm);
|
|
break;
|
|
|
|
case CMD_POP_RETIRE_SEQ_NUM:
|
|
ossl_quic_rcidm_pop_retire_seq_num(rcidm, &seq_num_out);
|
|
break;
|
|
|
|
case CMD_PEEK_RETIRE_SEQ_NUM:
|
|
ossl_quic_rcidm_peek_retire_seq_num(rcidm, &seq_num_out);
|
|
break;
|
|
|
|
case CMD_GET_PREFERRED_TX_DCID:
|
|
ossl_quic_rcidm_get_preferred_tx_dcid(rcidm, &cid_out);
|
|
break;
|
|
|
|
case CMD_GET_PREFERRED_TX_DCID_CHANGED:
|
|
if (!PACKET_get_1(&pkt, &arg_clear)) {
|
|
rc = -1;
|
|
goto err;
|
|
}
|
|
|
|
ossl_quic_rcidm_get_preferred_tx_dcid_changed(rcidm, arg_clear);
|
|
break;
|
|
|
|
default:
|
|
rc = -1;
|
|
goto err;
|
|
}
|
|
}
|
|
|
|
err:
|
|
ossl_quic_rcidm_free(rcidm);
|
|
return rc;
|
|
}
|
|
|
|
void FuzzerCleanup(void)
|
|
{
|
|
FuzzerClearRand();
|
|
}
|