1*e7be843bSPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
3*e7be843bSPierre Pronchery *
4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License");
5*e7be843bSPierre Pronchery * you may not use this file except in compliance with the License.
6*e7be843bSPierre Pronchery * You may obtain a copy of the License at
7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html
8*e7be843bSPierre Pronchery * or in the file LICENSE in the source distribution.
9*e7be843bSPierre Pronchery */
10*e7be843bSPierre Pronchery
11*e7be843bSPierre Pronchery #include <openssl/ssl.h>
12*e7be843bSPierre Pronchery #include <openssl/err.h>
13*e7be843bSPierre Pronchery #include <openssl/bio.h>
14*e7be843bSPierre Pronchery #include "fuzzer.h"
15*e7be843bSPierre Pronchery #include "internal/quic_srtm.h"
16*e7be843bSPierre Pronchery
FuzzerInitialize(int * argc,char *** argv)17*e7be843bSPierre Pronchery int FuzzerInitialize(int *argc, char ***argv)
18*e7be843bSPierre Pronchery {
19*e7be843bSPierre Pronchery FuzzerSetRand();
20*e7be843bSPierre Pronchery OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL);
21*e7be843bSPierre Pronchery OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
22*e7be843bSPierre Pronchery ERR_clear_error();
23*e7be843bSPierre Pronchery return 1;
24*e7be843bSPierre Pronchery }
25*e7be843bSPierre Pronchery
26*e7be843bSPierre Pronchery /*
27*e7be843bSPierre Pronchery * Fuzzer input "protocol":
28*e7be843bSPierre Pronchery * Big endian
29*e7be843bSPierre Pronchery * Zero or more of:
30*e7be843bSPierre Pronchery * ADD - u8(0x00) u64(opaque) u64(seq_num) u128(token)
31*e7be843bSPierre Pronchery * REMOVE - u8(0x01) u64(opaque) u64(seq_num)
32*e7be843bSPierre Pronchery * CULL - u8(0x02) u64(opaque)
33*e7be843bSPierre Pronchery * LOOKUP - u8(0x03) u128(token) u64(idx)
34*e7be843bSPierre Pronchery */
35*e7be843bSPierre Pronchery enum {
36*e7be843bSPierre Pronchery CMD_ADD,
37*e7be843bSPierre Pronchery CMD_REMOVE,
38*e7be843bSPierre Pronchery CMD_CULL,
39*e7be843bSPierre Pronchery CMD_LOOKUP,
40*e7be843bSPierre Pronchery CMD_MAX
41*e7be843bSPierre Pronchery };
42*e7be843bSPierre Pronchery
43*e7be843bSPierre Pronchery #define MAX_CMDS 10000
44*e7be843bSPierre Pronchery
FuzzerTestOneInput(const uint8_t * buf,size_t len)45*e7be843bSPierre Pronchery int FuzzerTestOneInput(const uint8_t *buf, size_t len)
46*e7be843bSPierre Pronchery {
47*e7be843bSPierre Pronchery int rc = 0;
48*e7be843bSPierre Pronchery QUIC_SRTM *srtm = NULL;
49*e7be843bSPierre Pronchery PACKET pkt;
50*e7be843bSPierre Pronchery unsigned int cmd;
51*e7be843bSPierre Pronchery uint64_t arg_opaque, arg_seq_num, arg_idx;
52*e7be843bSPierre Pronchery QUIC_STATELESS_RESET_TOKEN arg_token;
53*e7be843bSPierre Pronchery size_t limit = 0;
54*e7be843bSPierre Pronchery
55*e7be843bSPierre Pronchery if ((srtm = ossl_quic_srtm_new(NULL, NULL)) == NULL) {
56*e7be843bSPierre Pronchery rc = -1;
57*e7be843bSPierre Pronchery goto err;
58*e7be843bSPierre Pronchery }
59*e7be843bSPierre Pronchery
60*e7be843bSPierre Pronchery if (!PACKET_buf_init(&pkt, buf, len))
61*e7be843bSPierre Pronchery goto err;
62*e7be843bSPierre Pronchery
63*e7be843bSPierre Pronchery while (PACKET_remaining(&pkt) > 0) {
64*e7be843bSPierre Pronchery if (!PACKET_get_1(&pkt, &cmd))
65*e7be843bSPierre Pronchery goto err;
66*e7be843bSPierre Pronchery
67*e7be843bSPierre Pronchery if (++limit > MAX_CMDS) {
68*e7be843bSPierre Pronchery rc = 0;
69*e7be843bSPierre Pronchery goto err;
70*e7be843bSPierre Pronchery }
71*e7be843bSPierre Pronchery
72*e7be843bSPierre Pronchery switch (cmd % CMD_MAX) {
73*e7be843bSPierre Pronchery case CMD_ADD:
74*e7be843bSPierre Pronchery if (!PACKET_get_net_8(&pkt, &arg_opaque)
75*e7be843bSPierre Pronchery || !PACKET_get_net_8(&pkt, &arg_seq_num)
76*e7be843bSPierre Pronchery || !PACKET_copy_bytes(&pkt, arg_token.token,
77*e7be843bSPierre Pronchery sizeof(arg_token.token)))
78*e7be843bSPierre Pronchery continue; /* just stop */
79*e7be843bSPierre Pronchery
80*e7be843bSPierre Pronchery ossl_quic_srtm_add(srtm, (void *)(uintptr_t)arg_opaque,
81*e7be843bSPierre Pronchery arg_seq_num, &arg_token);
82*e7be843bSPierre Pronchery ossl_quic_srtm_check(srtm);
83*e7be843bSPierre Pronchery break;
84*e7be843bSPierre Pronchery
85*e7be843bSPierre Pronchery case CMD_REMOVE:
86*e7be843bSPierre Pronchery if (!PACKET_get_net_8(&pkt, &arg_opaque)
87*e7be843bSPierre Pronchery || !PACKET_get_net_8(&pkt, &arg_seq_num))
88*e7be843bSPierre Pronchery continue; /* just stop */
89*e7be843bSPierre Pronchery
90*e7be843bSPierre Pronchery ossl_quic_srtm_remove(srtm, (void *)(uintptr_t)arg_opaque,
91*e7be843bSPierre Pronchery arg_seq_num);
92*e7be843bSPierre Pronchery ossl_quic_srtm_check(srtm);
93*e7be843bSPierre Pronchery break;
94*e7be843bSPierre Pronchery
95*e7be843bSPierre Pronchery case CMD_CULL:
96*e7be843bSPierre Pronchery if (!PACKET_get_net_8(&pkt, &arg_opaque))
97*e7be843bSPierre Pronchery continue; /* just stop */
98*e7be843bSPierre Pronchery
99*e7be843bSPierre Pronchery ossl_quic_srtm_cull(srtm, (void *)(uintptr_t)arg_opaque);
100*e7be843bSPierre Pronchery ossl_quic_srtm_check(srtm);
101*e7be843bSPierre Pronchery break;
102*e7be843bSPierre Pronchery
103*e7be843bSPierre Pronchery case CMD_LOOKUP:
104*e7be843bSPierre Pronchery if (!PACKET_copy_bytes(&pkt, arg_token.token,
105*e7be843bSPierre Pronchery sizeof(arg_token.token))
106*e7be843bSPierre Pronchery || !PACKET_get_net_8(&pkt, &arg_idx))
107*e7be843bSPierre Pronchery continue; /* just stop */
108*e7be843bSPierre Pronchery
109*e7be843bSPierre Pronchery ossl_quic_srtm_lookup(srtm, &arg_token, (size_t)arg_idx,
110*e7be843bSPierre Pronchery NULL, NULL);
111*e7be843bSPierre Pronchery ossl_quic_srtm_check(srtm);
112*e7be843bSPierre Pronchery break;
113*e7be843bSPierre Pronchery
114*e7be843bSPierre Pronchery default:
115*e7be843bSPierre Pronchery /* Other bytes are treated as no-ops */
116*e7be843bSPierre Pronchery continue;
117*e7be843bSPierre Pronchery }
118*e7be843bSPierre Pronchery }
119*e7be843bSPierre Pronchery
120*e7be843bSPierre Pronchery rc = 0;
121*e7be843bSPierre Pronchery err:
122*e7be843bSPierre Pronchery ossl_quic_srtm_free(srtm);
123*e7be843bSPierre Pronchery return rc;
124*e7be843bSPierre Pronchery }
125*e7be843bSPierre Pronchery
FuzzerCleanup(void)126*e7be843bSPierre Pronchery void FuzzerCleanup(void)
127*e7be843bSPierre Pronchery {
128*e7be843bSPierre Pronchery FuzzerClearRand();
129*e7be843bSPierre Pronchery }
130