1 /*
2 * Copyright (c) 2020-2021 Yubico AB. All rights reserved.
3 * Use of this source code is governed by a BSD-style
4 * license that can be found in the LICENSE file.
5 * SPDX-License-Identifier: BSD-2-Clause
6 */
7
8 #include <assert.h>
9 #include <stdint.h>
10 #include <stdlib.h>
11 #include <string.h>
12 #include <stdio.h>
13
14 #include "../openbsd-compat/openbsd-compat.h"
15 #include "mutator_aux.h"
16 #include "dummy.h"
17
18 extern int fido_hid_get_usage(const uint8_t *, size_t, uint32_t *);
19 extern int fido_hid_get_report_len(const uint8_t *, size_t, size_t *, size_t *);
20 extern void set_udev_parameters(const char *, const struct blob *);
21
22 struct param {
23 int seed;
24 char uevent[MAXSTR];
25 struct blob report_descriptor;
26 struct blob netlink_wiredata;
27 };
28
29 /*
30 * Sample HID report descriptor from the FIDO HID interface of a YubiKey 5.
31 */
32 static const uint8_t dummy_report_descriptor[] = {
33 0x06, 0xd0, 0xf1, 0x09, 0x01, 0xa1, 0x01, 0x09,
34 0x20, 0x15, 0x00, 0x26, 0xff, 0x00, 0x75, 0x08,
35 0x95, 0x40, 0x81, 0x02, 0x09, 0x21, 0x15, 0x00,
36 0x26, 0xff, 0x00, 0x75, 0x08, 0x95, 0x40, 0x91,
37 0x02, 0xc0
38 };
39
40 /*
41 * Sample uevent file from a Yubico Security Key.
42 */
43 static const char dummy_uevent[] =
44 "DRIVER=hid-generic\n"
45 "HID_ID=0003:00001050:00000120\n"
46 "HID_NAME=Yubico Security Key by Yubico\n"
47 "HID_PHYS=usb-0000:00:14.0-3/input0\n"
48 "HID_UNIQ=\n"
49 "MODALIAS=hid:b0003g0001v00001050p00000120\n";
50
51 struct param *
unpack(const uint8_t * ptr,size_t len)52 unpack(const uint8_t *ptr, size_t len)
53 {
54 cbor_item_t *item = NULL, **v;
55 struct cbor_load_result cbor;
56 struct param *p;
57 int ok = -1;
58
59 if ((p = calloc(1, sizeof(*p))) == NULL ||
60 (item = cbor_load(ptr, len, &cbor)) == NULL ||
61 cbor.read != len ||
62 cbor_isa_array(item) == false ||
63 cbor_array_is_definite(item) == false ||
64 cbor_array_size(item) != 4 ||
65 (v = cbor_array_handle(item)) == NULL)
66 goto fail;
67
68 if (unpack_int(v[0], &p->seed) < 0 ||
69 unpack_string(v[1], p->uevent) < 0 ||
70 unpack_blob(v[2], &p->report_descriptor) < 0 ||
71 unpack_blob(v[3], &p->netlink_wiredata) < 0)
72 goto fail;
73
74 ok = 0;
75 fail:
76 if (ok < 0) {
77 free(p);
78 p = NULL;
79 }
80
81 if (item)
82 cbor_decref(&item);
83
84 return p;
85 }
86
87 size_t
pack(uint8_t * ptr,size_t len,const struct param * p)88 pack(uint8_t *ptr, size_t len, const struct param *p)
89 {
90 cbor_item_t *argv[4], *array = NULL;
91 size_t cbor_alloc_len, cbor_len = 0;
92 unsigned char *cbor = NULL;
93
94 memset(argv, 0, sizeof(argv));
95
96 if ((array = cbor_new_definite_array(4)) == NULL ||
97 (argv[0] = pack_int(p->seed)) == NULL ||
98 (argv[1] = pack_string(p->uevent)) == NULL ||
99 (argv[2] = pack_blob(&p->report_descriptor)) == NULL ||
100 (argv[3] = pack_blob(&p->netlink_wiredata)) == NULL)
101 goto fail;
102
103 for (size_t i = 0; i < 4; i++)
104 if (cbor_array_push(array, argv[i]) == false)
105 goto fail;
106
107 if ((cbor_len = cbor_serialize_alloc(array, &cbor,
108 &cbor_alloc_len)) == 0 || cbor_len > len) {
109 cbor_len = 0;
110 goto fail;
111 }
112
113 memcpy(ptr, cbor, cbor_len);
114 fail:
115 for (size_t i = 0; i < 4; i++)
116 if (argv[i])
117 cbor_decref(&argv[i]);
118
119 if (array)
120 cbor_decref(&array);
121
122 free(cbor);
123
124 return cbor_len;
125 }
126
127 size_t
pack_dummy(uint8_t * ptr,size_t len)128 pack_dummy(uint8_t *ptr, size_t len)
129 {
130 struct param dummy;
131 uint8_t blob[MAXCORPUS];
132 size_t blob_len;
133
134 memset(&dummy, 0, sizeof(dummy));
135
136 dummy.report_descriptor.len = sizeof(dummy_report_descriptor);
137 strlcpy(dummy.uevent, dummy_uevent, sizeof(dummy.uevent));
138 memcpy(&dummy.report_descriptor.body, &dummy_report_descriptor,
139 dummy.report_descriptor.len);
140 dummy.netlink_wiredata.len = sizeof(dummy_netlink_wiredata);
141 memcpy(&dummy.netlink_wiredata.body, &dummy_netlink_wiredata,
142 dummy.netlink_wiredata.len);
143
144 assert((blob_len = pack(blob, sizeof(blob), &dummy)) != 0);
145 if (blob_len > len)
146 blob_len = len;
147
148 memcpy(ptr, blob, blob_len);
149
150 return blob_len;
151 }
152
153 static void
get_usage(const struct param * p)154 get_usage(const struct param *p)
155 {
156 uint32_t usage_page = 0;
157
158 fido_hid_get_usage(p->report_descriptor.body, p->report_descriptor.len,
159 &usage_page);
160 consume(&usage_page, sizeof(usage_page));
161 }
162
163 static void
get_report_len(const struct param * p)164 get_report_len(const struct param *p)
165 {
166 size_t report_in_len = 0;
167 size_t report_out_len = 0;
168
169 fido_hid_get_report_len(p->report_descriptor.body,
170 p->report_descriptor.len, &report_in_len, &report_out_len);
171 consume(&report_in_len, sizeof(report_in_len));
172 consume(&report_out_len, sizeof(report_out_len));
173 }
174
175 static void
manifest(const struct param * p)176 manifest(const struct param *p)
177 {
178 size_t ndevs, nfound;
179 fido_dev_info_t *devlist = NULL, *devlist_set = NULL;
180 int16_t vendor_id, product_id;
181 fido_dev_io_t io;
182 fido_dev_transport_t t;
183
184 memset(&io, 0, sizeof(io));
185 memset(&t, 0, sizeof(t));
186 set_netlink_io_functions(fd_read, fd_write);
187 set_wire_data(p->netlink_wiredata.body, p->netlink_wiredata.len);
188 set_udev_parameters(p->uevent, &p->report_descriptor);
189
190 ndevs = uniform_random(64);
191 if ((devlist = fido_dev_info_new(ndevs)) == NULL ||
192 (devlist_set = fido_dev_info_new(1)) == NULL ||
193 fido_dev_info_manifest(devlist, ndevs, &nfound) != FIDO_OK)
194 goto out;
195 for (size_t i = 0; i < nfound; i++) {
196 const fido_dev_info_t *di = fido_dev_info_ptr(devlist, i);
197 consume_str(fido_dev_info_path(di));
198 consume_str(fido_dev_info_manufacturer_string(di));
199 consume_str(fido_dev_info_product_string(di));
200 vendor_id = fido_dev_info_vendor(di);
201 product_id = fido_dev_info_product(di);
202 consume(&vendor_id, sizeof(vendor_id));
203 consume(&product_id, sizeof(product_id));
204 fido_dev_info_set(devlist_set, 0, fido_dev_info_path(di),
205 fido_dev_info_manufacturer_string(di),
206 fido_dev_info_product_string(di), &io, &t);
207 }
208 out:
209 fido_dev_info_free(&devlist, ndevs);
210 fido_dev_info_free(&devlist_set, 1);
211 }
212
213 void
test(const struct param * p)214 test(const struct param *p)
215 {
216 prng_init((unsigned int)p->seed);
217 fuzz_clock_reset();
218 fido_init(FIDO_DEBUG);
219 fido_set_log_handler(consume_str);
220
221 get_usage(p);
222 get_report_len(p);
223 manifest(p);
224 }
225
226 void
mutate(struct param * p,unsigned int seed,unsigned int flags)227 mutate(struct param *p, unsigned int seed, unsigned int flags) NO_MSAN
228 {
229 if (flags & MUTATE_SEED)
230 p->seed = (int)seed;
231
232 if (flags & MUTATE_PARAM) {
233 mutate_blob(&p->report_descriptor);
234 mutate_string(p->uevent);
235 }
236
237 if (flags & MUTATE_WIREDATA)
238 mutate_blob(&p->netlink_wiredata);
239 }
240