1 #include <stddef.h>
2 #include <stdio.h>
3 #include <stdint.h>
4 #include <string.h>
5 #include <stdlib.h>
6 #include <pwd.h>
7 #include <unistd.h>
8
9 extern "C" {
10
11 #include "hostfile.h"
12 #include "auth.h"
13 #include "auth-options.h"
14 #include "sshkey.h"
15
16 // testdata/id_ed25519.pub and testdata/id_ed25519-cert.pub
17 const char *pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMD";
18 const char *certtext = "ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIMDQjYH6XRzH3j3MW1DdjCoAfvrHfgjnVGF+sLK0pBfqAAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMDAAAAAAAAA+sAAAABAAAAB3VseXNzZXMAAAAXAAAAB3VseXNzZXMAAAAIb2R5c3NldXMAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgM9BeYRUxUuZ4VHJp8oxVaA8OS/z+5EFPCZwQNq1nMwMAAABTAAAAC3NzaC1lZDI1NTE5AAAAQBj0og+s09/HpwdHZbzN0twooKPDWWrxGfnP1Joy6cDnY2BCSQ7zg9vbq11kLF8H/sKOTZWAQrUZ7LlChOu9Ogw= id_ed25519.pub";
19
20 // stubs
auth_debug_add(const char * fmt,...)21 void auth_debug_add(const char *fmt,...)
22 {
23 }
24
25 void
auth_log_authopts(const char * loc,const struct sshauthopt * opts,int do_remote)26 auth_log_authopts(const char *loc, const struct sshauthopt *opts, int do_remote)
27 {
28 }
29
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)30 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
31 {
32 char *tmp, *o, *cp = (char *)malloc(size + 1 + strlen(pubkey) + 1);
33 struct sshauthopt *opts = NULL;
34 struct passwd *pw = getpwuid(getuid());
35 static struct sshkey *key, *cert;
36
37 if (key == NULL) {
38 if ((key = sshkey_new(KEY_UNSPEC)) == NULL ||
39 (cert = sshkey_new(KEY_UNSPEC)) == NULL)
40 abort();
41 if ((o = tmp = strdup(pubkey)) == NULL ||
42 sshkey_read(key, &tmp) != 0)
43 abort();
44 free(o);
45 if ((o = tmp = strdup(certtext)) == NULL ||
46 sshkey_read(cert, &tmp) != 0)
47 abort();
48 free(o);
49 }
50 if (cp == NULL || pw == NULL || key == NULL || cert == NULL)
51 abort();
52
53 // Cleanup whitespace at input EOL.
54 for (; size > 0 && strchr(" \t\r\n", data[size - 1]) != NULL; size--) ;
55
56 // Append a pubkey that will match.
57 memcpy(cp, data, size);
58 cp[size] = ' ';
59 memcpy(cp + size + 1, pubkey, strlen(pubkey) + 1);
60
61 // Try key.
62 if ((tmp = strdup(cp)) == NULL)
63 abort();
64 (void) auth_check_authkey_line(pw, key, tmp, "127.0.0.1", "localhost",
65 "fuzz", &opts);
66 free(tmp);
67 sshauthopt_free(opts);
68
69 // Try cert.
70 if ((tmp = strdup(cp)) == NULL)
71 abort();
72 (void) auth_check_authkey_line(pw, cert, tmp, "127.0.0.1", "localhost",
73 "fuzz", &opts);
74 free(tmp);
75 sshauthopt_free(opts);
76
77 free(cp);
78 return 0;
79 }
80
81 } // extern "C"
82