2
0

quic-lcidm.c 4.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180
  1. /*
  2. * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License");
  5. * you may not use this file except in compliance with the License.
  6. * You may obtain a copy of the License at
  7. * https://www.openssl.org/source/license.html
  8. * or in the file LICENSE in the source distribution.
  9. */
  10. #include <openssl/ssl.h>
  11. #include <openssl/err.h>
  12. #include <openssl/bio.h>
  13. #include "fuzzer.h"
  14. #include "internal/quic_lcidm.h"
  15. #include "internal/packet.h"
  16. int FuzzerInitialize(int *argc, char ***argv)
  17. {
  18. FuzzerSetRand();
  19. OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL);
  20. OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
  21. ERR_clear_error();
  22. return 1;
  23. }
  24. /*
  25. * Fuzzer input "protocol":
  26. * Big endian
  27. * u8(LCID length)
  28. * Zero or more of:
  29. * ENROL_ODCID u0(0x00) u64(opaque) u8(cidl):cid
  30. * RETIRE_ODCID u8(0x01) u64(opaque)
  31. * GENERATE_INITIAL u8(0x02) u64(opaque)
  32. * GENERATE u8(0x03) u64(opaque)
  33. * RETIRE u8(0x04) u64(opaque) u64(retire_prior_to)
  34. * CULL u8(0x05) u64(opaque)
  35. * LOOKUP u8(0x06) u8(cidl):cid
  36. */
  37. enum {
  38. CMD_ENROL_ODCID,
  39. CMD_RETIRE_ODCID,
  40. CMD_GENERATE_INITIAL,
  41. CMD_GENERATE,
  42. CMD_RETIRE,
  43. CMD_CULL,
  44. CMD_LOOKUP
  45. };
  46. static int get_cid(PACKET *pkt, QUIC_CONN_ID *cid)
  47. {
  48. unsigned int cidl;
  49. if (!PACKET_get_1(pkt, &cidl)
  50. || cidl > QUIC_MAX_CONN_ID_LEN
  51. || !PACKET_copy_bytes(pkt, cid->id, cidl))
  52. return 0;
  53. cid->id_len = (unsigned char)cidl;
  54. return 1;
  55. }
  56. int FuzzerTestOneInput(const uint8_t *buf, size_t len)
  57. {
  58. int rc = 0;
  59. QUIC_LCIDM *lcidm = NULL;
  60. PACKET pkt;
  61. uint64_t arg_opaque, arg_retire_prior_to, seq_num_out;
  62. unsigned int cmd, lcidl;
  63. QUIC_CONN_ID arg_cid, cid_out;
  64. OSSL_QUIC_FRAME_NEW_CONN_ID ncid_frame;
  65. int did_retire;
  66. void *opaque_out;
  67. if (!PACKET_buf_init(&pkt, buf, len))
  68. goto err;
  69. if (!PACKET_get_1(&pkt, &lcidl)
  70. || lcidl > QUIC_MAX_CONN_ID_LEN) {
  71. rc = -1;
  72. goto err;
  73. }
  74. if ((lcidm = ossl_quic_lcidm_new(NULL, lcidl)) == NULL) {
  75. rc = -1;
  76. goto err;
  77. }
  78. while (PACKET_remaining(&pkt) > 0) {
  79. if (!PACKET_get_1(&pkt, &cmd))
  80. goto err;
  81. switch (cmd) {
  82. case CMD_ENROL_ODCID:
  83. if (!PACKET_get_net_8(&pkt, &arg_opaque)
  84. || !get_cid(&pkt, &arg_cid)) {
  85. rc = -1;
  86. goto err;
  87. }
  88. ossl_quic_lcidm_enrol_odcid(lcidm, (void *)(uintptr_t)arg_opaque,
  89. &arg_cid);
  90. break;
  91. case CMD_RETIRE_ODCID:
  92. if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
  93. rc = -1;
  94. goto err;
  95. }
  96. ossl_quic_lcidm_retire_odcid(lcidm, (void *)(uintptr_t)arg_opaque);
  97. break;
  98. case CMD_GENERATE_INITIAL:
  99. if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
  100. rc = -1;
  101. goto err;
  102. }
  103. ossl_quic_lcidm_generate_initial(lcidm, (void *)(uintptr_t)arg_opaque,
  104. &cid_out);
  105. break;
  106. case CMD_GENERATE:
  107. if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
  108. rc = -1;
  109. goto err;
  110. }
  111. ossl_quic_lcidm_generate(lcidm, (void *)(uintptr_t)arg_opaque,
  112. &ncid_frame);
  113. break;
  114. case CMD_RETIRE:
  115. if (!PACKET_get_net_8(&pkt, &arg_opaque)
  116. || !PACKET_get_net_8(&pkt, &arg_retire_prior_to)) {
  117. rc = -1;
  118. goto err;
  119. }
  120. ossl_quic_lcidm_retire(lcidm, (void *)(uintptr_t)arg_opaque,
  121. arg_retire_prior_to,
  122. NULL, &cid_out,
  123. &seq_num_out, &did_retire);
  124. break;
  125. case CMD_CULL:
  126. if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
  127. rc = -1;
  128. goto err;
  129. }
  130. ossl_quic_lcidm_cull(lcidm, (void *)(uintptr_t)arg_opaque);
  131. break;
  132. case CMD_LOOKUP:
  133. if (!get_cid(&pkt, &arg_cid)) {
  134. rc = -1;
  135. goto err;
  136. }
  137. ossl_quic_lcidm_lookup(lcidm, &arg_cid, &seq_num_out, &opaque_out);
  138. break;
  139. default:
  140. rc = -1;
  141. goto err;
  142. }
  143. }
  144. err:
  145. ossl_quic_lcidm_free(lcidm);
  146. return rc;
  147. }
  148. void FuzzerCleanup(void)
  149. {
  150. FuzzerClearRand();
  151. }