10afa8e06SEd Maste /* 2*f540a430SEd Maste * Copyright (c) 2019-2021 Yubico AB. All rights reserved. 30afa8e06SEd Maste * Use of this source code is governed by a BSD-style 40afa8e06SEd Maste * license that can be found in the LICENSE file. 50afa8e06SEd Maste */ 60afa8e06SEd Maste 70afa8e06SEd Maste #ifndef _MUTATOR_AUX_H 80afa8e06SEd Maste #define _MUTATOR_AUX_H 90afa8e06SEd Maste 100afa8e06SEd Maste #include <stddef.h> 110afa8e06SEd Maste #include <stdint.h> 120afa8e06SEd Maste #include <cbor.h> 130afa8e06SEd Maste 140afa8e06SEd Maste #include "../src/fido.h" 150afa8e06SEd Maste #include "../src/fido/bio.h" 160afa8e06SEd Maste #include "../src/fido/config.h" 170afa8e06SEd Maste #include "../src/fido/credman.h" 180afa8e06SEd Maste #include "../src/fido/eddsa.h" 190afa8e06SEd Maste #include "../src/fido/es256.h" 200afa8e06SEd Maste #include "../src/fido/es256.h" 210afa8e06SEd Maste #include "../src/fido/rs256.h" 220afa8e06SEd Maste #include "../src/netlink.h" 230afa8e06SEd Maste 240afa8e06SEd Maste /* 250afa8e06SEd Maste * As of LLVM 10.0.0, MSAN support in libFuzzer was still experimental. 260afa8e06SEd Maste * We therefore have to be careful when using our custom mutator, or 270afa8e06SEd Maste * MSAN will flag uninitialised reads on memory populated by libFuzzer. 280afa8e06SEd Maste * Since there is no way to suppress MSAN without regenerating object 290afa8e06SEd Maste * code (in which case you might as well rebuild libFuzzer with MSAN), 300afa8e06SEd Maste * we adjust our mutator to make it less accurate while allowing 310afa8e06SEd Maste * fuzzing to proceed. 320afa8e06SEd Maste */ 330afa8e06SEd Maste 340afa8e06SEd Maste #if defined(__has_feature) 350afa8e06SEd Maste # if __has_feature(memory_sanitizer) 360afa8e06SEd Maste # include <sanitizer/msan_interface.h> 370afa8e06SEd Maste # define NO_MSAN __attribute__((no_sanitize("memory"))) 380afa8e06SEd Maste # define WITH_MSAN 1 390afa8e06SEd Maste # endif 400afa8e06SEd Maste #endif 410afa8e06SEd Maste 420afa8e06SEd Maste #if !defined(WITH_MSAN) 430afa8e06SEd Maste # define NO_MSAN 440afa8e06SEd Maste #endif 450afa8e06SEd Maste 460afa8e06SEd Maste #define MUTATE_SEED 0x01 470afa8e06SEd Maste #define MUTATE_PARAM 0x02 480afa8e06SEd Maste #define MUTATE_WIREDATA 0x04 490afa8e06SEd Maste #define MUTATE_ALL (MUTATE_SEED | MUTATE_PARAM | MUTATE_WIREDATA) 500afa8e06SEd Maste 510afa8e06SEd Maste #define MAXSTR 1024 52*f540a430SEd Maste #define MAXBLOB 3600 530afa8e06SEd Maste 540afa8e06SEd Maste struct blob { 550afa8e06SEd Maste uint8_t body[MAXBLOB]; 560afa8e06SEd Maste size_t len; 570afa8e06SEd Maste }; 580afa8e06SEd Maste 590afa8e06SEd Maste struct param; 600afa8e06SEd Maste 610afa8e06SEd Maste struct param *unpack(const uint8_t *, size_t); 620afa8e06SEd Maste size_t pack(uint8_t *, size_t, const struct param *); 630afa8e06SEd Maste size_t pack_dummy(uint8_t *, size_t); 640afa8e06SEd Maste void mutate(struct param *, unsigned int, unsigned int); 650afa8e06SEd Maste void test(const struct param *); 660afa8e06SEd Maste 670afa8e06SEd Maste void consume(const void *, size_t); 680afa8e06SEd Maste void consume_str(const char *); 690afa8e06SEd Maste 700afa8e06SEd Maste int unpack_blob(cbor_item_t *, struct blob *); 710afa8e06SEd Maste int unpack_byte(cbor_item_t *, uint8_t *); 720afa8e06SEd Maste int unpack_int(cbor_item_t *, int *); 730afa8e06SEd Maste int unpack_string(cbor_item_t *, char *); 740afa8e06SEd Maste 750afa8e06SEd Maste cbor_item_t *pack_blob(const struct blob *); 760afa8e06SEd Maste cbor_item_t *pack_byte(uint8_t); 770afa8e06SEd Maste cbor_item_t *pack_int(int); 780afa8e06SEd Maste cbor_item_t *pack_string(const char *); 790afa8e06SEd Maste 800afa8e06SEd Maste void mutate_byte(uint8_t *); 810afa8e06SEd Maste void mutate_int(int *); 820afa8e06SEd Maste void mutate_blob(struct blob *); 830afa8e06SEd Maste void mutate_string(char *); 840afa8e06SEd Maste 850afa8e06SEd Maste ssize_t fd_read(int, void *, size_t); 860afa8e06SEd Maste ssize_t fd_write(int, const void *, size_t); 870afa8e06SEd Maste 880afa8e06SEd Maste fido_dev_t *open_dev(int); 890afa8e06SEd Maste void set_wire_data(const uint8_t *, size_t); 900afa8e06SEd Maste 91*f540a430SEd Maste void fuzz_clock_reset(void); 920afa8e06SEd Maste void prng_init(unsigned long); 930afa8e06SEd Maste unsigned long prng_uint32(void); 940afa8e06SEd Maste 950afa8e06SEd Maste uint32_t uniform_random(uint32_t); 960afa8e06SEd Maste 970afa8e06SEd Maste #endif /* !_MUTATOR_AUX_H */ 98