ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-04-28 01:41:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Move fuzzer-kex initialisation into a constructor function

Browse Source 
Hopefully this can avoid hitting AFL timeouts
https://github.com/google/oss-fuzz/pull/2474
This commit is contained in:
Matt Johnston 2020-10-29 23:00:52 +08:00
parent 6aa065b1b4
commit b8352f8164
3 changed files with 65 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
fuzz/fuzzer-kexcurve25519.c
View File

@ -6,33 +6,30 @@
#include "algo.h" #include "algo.h"
#include "bignum.h" #include "bignum.h"
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { static struct key_context* keep_newkeys = NULL;
static int once = 0; /* An arbitrary limit */
static struct key_context* keep_newkeys = NULL; #define NUM_PARAMS 80
/* number of generated parameters is limited by the timeout for the first run. static struct kex_curve25519_param *curve25519_params[NUM_PARAMS];
TODO move this to the libfuzzer initialiser function instead if the timeout
doesn't apply there */
#define NUM_PARAMS 20
static struct kex_curve25519_param *curve25519_params[NUM_PARAMS];
if (!once) { static void setup() __attribute__((constructor));
fuzz_common_setup(); // Perform initial setup here to avoid hitting timeouts on first run
fuzz_svr_setup(); static void setup() {
fuzz_common_setup();
fuzz_svr_setup();
keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context)); keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "curve25519-sha256"); keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "curve25519-sha256");
keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ED25519; keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ED25519;
ses.newkeys = keep_newkeys; ses.newkeys = keep_newkeys;
/* Pre-generate parameters */ /* Pre-generate parameters */
int i; int i;
for (i = 0; i < NUM_PARAMS; i++) { for (i = 0; i < NUM_PARAMS; i++) {
curve25519_params[i] = gen_kexcurve25519_param(); curve25519_params[i] = gen_kexcurve25519_param();
}
once = 1;
} }
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
return 0; return 0;
} }

40
fuzz/fuzzer-kexdh.c
View File

@ -6,33 +6,29 @@
#include "algo.h" #include "algo.h"
#include "bignum.h" #include "bignum.h"
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { static struct key_context* keep_newkeys = NULL;
static int once = 0; #define NUM_PARAMS 80
static struct key_context* keep_newkeys = NULL; static struct kex_dh_param *dh_params[NUM_PARAMS];
/* number of generated parameters is limited by the timeout for the first run.
TODO move this to the libfuzzer initialiser function instead if the timeout
doesn't apply there */
#define NUM_PARAMS 20
static struct kex_dh_param *dh_params[NUM_PARAMS];
if (!once) { static void setup() __attribute__((constructor));
fuzz_common_setup(); // Perform initial setup here to avoid hitting timeouts on first run
fuzz_svr_setup(); static void setup() {
fuzz_common_setup();
fuzz_svr_setup();
keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context)); keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "diffie-hellman-group14-sha256"); keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "diffie-hellman-group14-sha256");
keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256; keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256;
ses.newkeys = keep_newkeys; ses.newkeys = keep_newkeys;
/* Pre-generate parameters */ /* Pre-generate parameters */
int i; int i;
for (i = 0; i < NUM_PARAMS; i++) { for (i = 0; i < NUM_PARAMS; i++) {
dh_params[i] = gen_kexdh_param(); dh_params[i] = gen_kexdh_param();
}
once = 1;
} }
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
return 0; return 0;
} }

56
fuzz/fuzzer-kexecdh.c
View File

@ -6,38 +6,38 @@
#include "algo.h" #include "algo.h"
#include "bignum.h" #include "bignum.h"
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { static const struct dropbear_kex *ecdh[3]; /* 256, 384, 521 */
static int once = 0; static struct key_context* keep_newkeys = NULL;
static const struct dropbear_kex *ecdh[3]; /* 256, 384, 521 */ /* number of generated parameters. An arbitrary limit, but will delay startup */
static struct key_context* keep_newkeys = NULL; #define NUM_PARAMS 80
/* number of generated parameters is limited by the timeout for the first run */ static struct kex_ecdh_param *ecdh_params[NUM_PARAMS];
#define NUM_PARAMS 80
static struct kex_ecdh_param *ecdh_params[NUM_PARAMS];
if (!once) { static void setup() __attribute__((constructor));
fuzz_common_setup(); // Perform initial setup here to avoid hitting timeouts on first run
fuzz_svr_setup(); static void setup() {
fuzz_common_setup();
fuzz_svr_setup();
/* ses gets zeroed by fuzz_set_input */ /* ses gets zeroed by fuzz_set_input */
keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context)); keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
ecdh[0] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp256"); ecdh[0] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp256");
ecdh[1] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp384"); ecdh[1] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp384");
ecdh[2] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp521"); ecdh[2] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp521");
assert(ecdh[0]); assert(ecdh[0]);
assert(ecdh[1]); assert(ecdh[1]);
assert(ecdh[2]); assert(ecdh[2]);
keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256; keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256;
ses.newkeys = keep_newkeys; ses.newkeys = keep_newkeys;
/* Pre-generate parameters */ /* Pre-generate parameters */
int i; int i;
for (i = 0; i < NUM_PARAMS; i++) { for (i = 0; i < NUM_PARAMS; i++) {
ses.newkeys->algo_kex = ecdh[i % 3]; ses.newkeys->algo_kex = ecdh[i % 3];
ecdh_params[i] = gen_kexecdh_param(); ecdh_params[i] = gen_kexecdh_param();
}
once = 1;
} }
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
return 0; return 0;