blob: 0c88767cfd089d38f3c5e79ce5441dd50eee1c8c [file] [log] [blame]
Mateusz Starzyk6c2e9b62021-05-19 17:54:54 +02001
Philippe Antoine72333522018-05-03 16:40:24 +02002#include "mbedtls/ssl.h"
3#include "mbedtls/entropy.h"
4#include "mbedtls/ctr_drbg.h"
Philippe Antoine72333522018-05-03 16:40:24 +02005#include "mbedtls/ssl_ticket.h"
Mateusz Starzyk1aec6462021-02-08 15:34:42 +01006#include "test/certs.h"
Philippe Antoine08633822019-06-04 14:03:06 +02007#include "common.h"
Philippe Antoine72333522018-05-03 16:40:24 +02008#include <string.h>
9#include <stdlib.h>
Philippe Antoine72333522018-05-03 16:40:24 +020010#include <stdint.h>
11
12
Manuel Pégourié-Gonnarda89040c2020-05-20 10:35:01 +020013#if defined(MBEDTLS_SSL_SRV_C) && \
14 defined(MBEDTLS_ENTROPY_C) && \
15 defined(MBEDTLS_CTR_DRBG_C)
Philippe Antoine72333522018-05-03 16:40:24 +020016const char *pers = "fuzz_server";
Philippe Antoine42a2ce82019-07-10 14:26:31 +020017static int initialized = 0;
Philippe Antoinedaab28a2019-06-28 12:31:23 +020018#if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
Philippe Antoine72333522018-05-03 16:40:24 +020019static mbedtls_x509_crt srvcert;
20static mbedtls_pk_context pkey;
21#endif
22const char *alpn_list[3];
23
Gilles Peskineeccd8882020-03-10 12:19:08 +010024#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Philippe Antoine72333522018-05-03 16:40:24 +020025const unsigned char psk[] = {
26 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
27 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
28};
29const char psk_id[] = "Client_identity";
30#endif
Manuel Pégourié-Gonnarda89040c2020-05-20 10:35:01 +020031#endif // MBEDTLS_SSL_SRV_C && MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C
Philippe Antoine72333522018-05-03 16:40:24 +020032
33
Gilles Peskine449bd832023-01-11 14:50:10 +010034int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
35{
Manuel Pégourié-Gonnarda89040c2020-05-20 10:35:01 +020036#if defined(MBEDTLS_SSL_SRV_C) && \
37 defined(MBEDTLS_ENTROPY_C) && \
38 defined(MBEDTLS_CTR_DRBG_C)
Philippe Antoine72333522018-05-03 16:40:24 +020039 int ret;
40 size_t len;
41 mbedtls_ssl_context ssl;
42 mbedtls_ssl_config conf;
43 mbedtls_ctr_drbg_context ctr_drbg;
44 mbedtls_entropy_context entropy;
Przemek Stekiel68a01a62022-10-10 11:31:58 +020045#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_TICKET_C)
Philippe Antoine72333522018-05-03 16:40:24 +020046 mbedtls_ssl_ticket_context ticket_ctx;
47#endif
48 unsigned char buf[4096];
49 fuzzBufferOffset_t biomemfuzz;
50 uint8_t options;
51
52 //we take 1 byte as options input
53 if (Size < 1) {
54 return 0;
55 }
56 options = Data[Size - 1];
57
Gilles Peskine449bd832023-01-11 14:50:10 +010058 mbedtls_ctr_drbg_init(&ctr_drbg);
59 mbedtls_entropy_init(&entropy);
Przemek Stekiel774f9de2023-04-19 11:47:01 +020060#if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
61 mbedtls_x509_crt_init(&srvcert);
62 mbedtls_pk_init(&pkey);
63#endif
64 mbedtls_ssl_init(&ssl);
65 mbedtls_ssl_config_init(&conf);
66#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_TICKET_C)
67 mbedtls_ssl_ticket_init(&ticket_ctx);
68#endif
69#if defined(MBEDTLS_USE_PSA_CRYPTO)
70 psa_status_t status = psa_crypto_init();
71 if (status != PSA_SUCCESS) {
72 goto exit;
73 }
74#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard7f93da12021-06-16 10:20:30 +020075
Gilles Peskine449bd832023-01-11 14:50:10 +010076 if (mbedtls_ctr_drbg_seed(&ctr_drbg, dummy_entropy, &entropy,
77 (const unsigned char *) pers, strlen(pers)) != 0) {
Paul Elliott00738bf2022-02-10 18:15:42 +000078 return 1;
Gilles Peskine449bd832023-01-11 14:50:10 +010079 }
Paul Elliott00738bf2022-02-10 18:15:42 +000080
81 if (initialized == 0) {
Manuel Pégourié-Gonnard7f93da12021-06-16 10:20:30 +020082
Philippe Antoinedaab28a2019-06-28 12:31:23 +020083#if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +010084 if (mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_srv_crt,
85 mbedtls_test_srv_crt_len) != 0) {
Philippe Antoine72333522018-05-03 16:40:24 +020086 return 1;
Gilles Peskine449bd832023-01-11 14:50:10 +010087 }
88 if (mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_cas_pem,
89 mbedtls_test_cas_pem_len) != 0) {
Philippe Antoine72333522018-05-03 16:40:24 +020090 return 1;
Gilles Peskine449bd832023-01-11 14:50:10 +010091 }
92 if (mbedtls_pk_parse_key(&pkey, (const unsigned char *) mbedtls_test_srv_key,
Manuel Pégourié-Gonnard84dea012021-06-15 11:29:26 +020093 mbedtls_test_srv_key_len, NULL, 0,
Gilles Peskine449bd832023-01-11 14:50:10 +010094 dummy_random, &ctr_drbg) != 0) {
Philippe Antoine72333522018-05-03 16:40:24 +020095 return 1;
Gilles Peskine449bd832023-01-11 14:50:10 +010096 }
Philippe Antoine72333522018-05-03 16:40:24 +020097#endif
98
99 alpn_list[0] = "HTTP";
100 alpn_list[1] = "fuzzalpn";
101 alpn_list[2] = NULL;
102
Philippe Antoine08633822019-06-04 14:03:06 +0200103 dummy_init();
104
Philippe Antoine72333522018-05-03 16:40:24 +0200105 initialized = 1;
106 }
Philippe Antoine72333522018-05-03 16:40:24 +0200107
Gilles Peskine449bd832023-01-11 14:50:10 +0100108 if (mbedtls_ssl_config_defaults(&conf,
Philippe Antoine72333522018-05-03 16:40:24 +0200109 MBEDTLS_SSL_IS_SERVER,
110 MBEDTLS_SSL_TRANSPORT_STREAM,
Gilles Peskine449bd832023-01-11 14:50:10 +0100111 MBEDTLS_SSL_PRESET_DEFAULT) != 0) {
Philippe Antoine72333522018-05-03 16:40:24 +0200112 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100113 }
Philippe Antoine72333522018-05-03 16:40:24 +0200114
Philippe Antoine2b7c9a22019-06-04 12:05:36 +0200115 srand(1);
Gilles Peskine449bd832023-01-11 14:50:10 +0100116 mbedtls_ssl_conf_rng(&conf, dummy_random, &ctr_drbg);
Philippe Antoine72333522018-05-03 16:40:24 +0200117
Philippe Antoinedaab28a2019-06-28 12:31:23 +0200118#if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100119 mbedtls_ssl_conf_ca_chain(&conf, srvcert.next, NULL);
120 if (mbedtls_ssl_conf_own_cert(&conf, &srvcert, &pkey) != 0) {
Philippe Antoine72333522018-05-03 16:40:24 +0200121 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100122 }
Philippe Antoine72333522018-05-03 16:40:24 +0200123#endif
124
Gilles Peskine449bd832023-01-11 14:50:10 +0100125 mbedtls_ssl_conf_cert_req_ca_list(&conf,
126 (options &
127 0x1) ? MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED : MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED);
Philippe Antoine72333522018-05-03 16:40:24 +0200128#if defined(MBEDTLS_SSL_ALPN)
129 if (options & 0x2) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100130 mbedtls_ssl_conf_alpn_protocols(&conf, alpn_list);
Philippe Antoine72333522018-05-03 16:40:24 +0200131 }
132#endif
Przemek Stekiel68a01a62022-10-10 11:31:58 +0200133#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_TICKET_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100134 if (options & 0x4) {
135 if (mbedtls_ssl_ticket_setup(&ticket_ctx,
Philippe Antoine72333522018-05-03 16:40:24 +0200136 dummy_random, &ctr_drbg,
137 MBEDTLS_CIPHER_AES_256_GCM,
Gilles Peskine449bd832023-01-11 14:50:10 +0100138 86400) != 0) {
Philippe Antoine72333522018-05-03 16:40:24 +0200139 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100140 }
Philippe Antoine72333522018-05-03 16:40:24 +0200141
Gilles Peskine449bd832023-01-11 14:50:10 +0100142 mbedtls_ssl_conf_session_tickets_cb(&conf,
Philippe Antoine72333522018-05-03 16:40:24 +0200143 mbedtls_ssl_ticket_write,
144 mbedtls_ssl_ticket_parse,
Gilles Peskine449bd832023-01-11 14:50:10 +0100145 &ticket_ctx);
Philippe Antoine72333522018-05-03 16:40:24 +0200146 }
147#endif
Philippe Antoine72333522018-05-03 16:40:24 +0200148#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Gilles Peskine449bd832023-01-11 14:50:10 +0100149 mbedtls_ssl_conf_extended_master_secret(&conf,
150 (options &
151 0x10) ? MBEDTLS_SSL_EXTENDED_MS_DISABLED : MBEDTLS_SSL_EXTENDED_MS_ENABLED);
Philippe Antoine72333522018-05-03 16:40:24 +0200152#endif
153#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +0100154 mbedtls_ssl_conf_encrypt_then_mac(&conf,
155 (options &
156 0x20) ? MBEDTLS_SSL_ETM_ENABLED : MBEDTLS_SSL_ETM_DISABLED);
Philippe Antoine72333522018-05-03 16:40:24 +0200157#endif
Gilles Peskineeccd8882020-03-10 12:19:08 +0100158#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Philippe Antoine72333522018-05-03 16:40:24 +0200159 if (options & 0x40) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100160 mbedtls_ssl_conf_psk(&conf, psk, sizeof(psk),
161 (const unsigned char *) psk_id, sizeof(psk_id) - 1);
Philippe Antoine72333522018-05-03 16:40:24 +0200162 }
163#endif
164#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +0100165 mbedtls_ssl_conf_renegotiation(&conf,
166 (options &
167 0x80) ? MBEDTLS_SSL_RENEGOTIATION_ENABLED : MBEDTLS_SSL_RENEGOTIATION_DISABLED);
Philippe Antoine72333522018-05-03 16:40:24 +0200168#endif
169
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 if (mbedtls_ssl_setup(&ssl, &conf) != 0) {
Philippe Antoine72333522018-05-03 16:40:24 +0200171 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100172 }
Philippe Antoine72333522018-05-03 16:40:24 +0200173
174 biomemfuzz.Data = Data;
175 biomemfuzz.Size = Size-1;
176 biomemfuzz.Offset = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100177 mbedtls_ssl_set_bio(&ssl, &biomemfuzz, dummy_send, fuzz_recv, NULL);
Philippe Antoine72333522018-05-03 16:40:24 +0200178
Gilles Peskine449bd832023-01-11 14:50:10 +0100179 mbedtls_ssl_session_reset(&ssl);
180 ret = mbedtls_ssl_handshake(&ssl);
181 if (ret == 0) {
Philippe Antoine72333522018-05-03 16:40:24 +0200182 //keep reading data from server until the end
Gilles Peskine449bd832023-01-11 14:50:10 +0100183 do {
184 len = sizeof(buf) - 1;
185 ret = mbedtls_ssl_read(&ssl, buf, len);
Philippe Antoine72333522018-05-03 16:40:24 +0200186
Gilles Peskine449bd832023-01-11 14:50:10 +0100187 if (ret == MBEDTLS_ERR_SSL_WANT_READ) {
Philippe Antoine72333522018-05-03 16:40:24 +0200188 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100189 } else if (ret <= 0) {
Philippe Antoine72333522018-05-03 16:40:24 +0200190 //EOF or error
191 break;
Gilles Peskine449bd832023-01-11 14:50:10 +0100192 }
193 } while (1);
Philippe Antoine72333522018-05-03 16:40:24 +0200194 }
195
196exit:
Przemek Stekiel68a01a62022-10-10 11:31:58 +0200197#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_TICKET_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100198 mbedtls_ssl_ticket_free(&ticket_ctx);
Philippe Antoine72333522018-05-03 16:40:24 +0200199#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100200 mbedtls_entropy_free(&entropy);
201 mbedtls_ctr_drbg_free(&ctr_drbg);
202 mbedtls_ssl_config_free(&conf);
Przemek Stekiel774f9de2023-04-19 11:47:01 +0200203#if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
204 mbedtls_x509_crt_free(&srvcert);
205 mbedtls_pk_free(&pkey);
206#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100207 mbedtls_ssl_free(&ssl);
Przemek Stekiel774f9de2023-04-19 11:47:01 +0200208#if defined(MBEDTLS_USE_PSA_CRYPTO)
209 mbedtls_psa_crypto_free();
210#endif
Philippe Antoinec32fd242019-06-06 09:12:53 +0200211#else
212 (void) Data;
213 (void) Size;
Manuel Pégourié-Gonnarda89040c2020-05-20 10:35:01 +0200214#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C */
Philippe Antoinec32fd242019-06-06 09:12:53 +0200215
Philippe Antoine72333522018-05-03 16:40:24 +0200216 return 0;
217}