summaryrefslogtreecommitdiff
path: root/fuzz/fuzz_assert.c
diff options
context:
space:
mode:
authornicoo <nicoo@debian.org>2020-02-12 13:42:22 +0100
committerNicolas Braud-Santoni <nicolas@braud-santoni.eu>2020-02-12 13:42:22 +0100
commitc79050aa44b8836d836c5dd22a383a073c28b74b (patch)
tree7bcca9fabd7718bf87ca600a6594f57b76d8de7d /fuzz/fuzz_assert.c
Import upstream release 1.3.0
Closes: #951184
Diffstat (limited to 'fuzz/fuzz_assert.c')
-rw-r--r--fuzz/fuzz_assert.c664
1 files changed, 664 insertions, 0 deletions
diff --git a/fuzz/fuzz_assert.c b/fuzz/fuzz_assert.c
new file mode 100644
index 0000000..0395345
--- /dev/null
+++ b/fuzz/fuzz_assert.c
@@ -0,0 +1,664 @@
1/*
2 * Copyright (c) 2019 Yubico AB. All rights reserved.
3 * Use of this source code is governed by a BSD-style
4 * license that can be found in the LICENSE file.
5 */
6
7#include <assert.h>
8#include <stdbool.h>
9#include <stdint.h>
10#include <stdlib.h>
11#include <string.h>
12#include <stdio.h>
13
14#include "mutator_aux.h"
15#include "fido.h"
16#include "fido/es256.h"
17#include "fido/rs256.h"
18#include "fido/eddsa.h"
19
20#include "../openbsd-compat/openbsd-compat.h"
21
22#define TAG_U2F 0x01
23#define TAG_TYPE 0x02
24#define TAG_CDH 0x03
25#define TAG_RP_ID 0x04
26#define TAG_EXT 0x05
27#define TAG_SEED 0x06
28#define TAG_UP 0x07
29#define TAG_UV 0x08
30#define TAG_WIRE_DATA 0x09
31#define TAG_CRED_COUNT 0x0a
32#define TAG_CRED 0x0b
33#define TAG_ES256 0x0c
34#define TAG_RS256 0x0d
35#define TAG_PIN 0x0e
36#define TAG_EDDSA 0x0f
37
38/* Parameter set defining a FIDO2 get assertion operation. */
39struct param {
40 char pin[MAXSTR];
41 char rp_id[MAXSTR];
42 int ext;
43 int seed;
44 struct blob cdh;
45 struct blob cred;
46 struct blob es256;
47 struct blob rs256;
48 struct blob eddsa;
49 struct blob wire_data;
50 uint8_t cred_count;
51 uint8_t type;
52 uint8_t u2f;
53 uint8_t up;
54 uint8_t uv;
55};
56
57/* Example parameters. */
58static const char dummy_rp_id[] = "localhost";
59static const char dummy_pin[] = "9}4gT:8d=A37Dh}U";
60
61static const uint8_t dummy_cdh[] = {
62 0xec, 0x8d, 0x8f, 0x78, 0x42, 0x4a, 0x2b, 0xb7,
63 0x82, 0x34, 0xaa, 0xca, 0x07, 0xa1, 0xf6, 0x56,
64 0x42, 0x1c, 0xb6, 0xf6, 0xb3, 0x00, 0x86, 0x52,
65 0x35, 0x2d, 0xa2, 0x62, 0x4a, 0xbe, 0x89, 0x76,
66};
67
68static const uint8_t dummy_es256[] = {
69 0xcc, 0x1b, 0x50, 0xac, 0xc4, 0x19, 0xf8, 0x3a,
70 0xee, 0x0a, 0x77, 0xd6, 0xf3, 0x53, 0xdb, 0xef,
71 0xf2, 0xb9, 0x5c, 0x2d, 0x8b, 0x1e, 0x52, 0x58,
72 0x88, 0xf4, 0x0b, 0x85, 0x1f, 0x40, 0x6d, 0x18,
73 0x15, 0xb3, 0xcc, 0x25, 0x7c, 0x38, 0x3d, 0xec,
74 0xdf, 0xad, 0xbd, 0x46, 0x91, 0xc3, 0xac, 0x30,
75 0x94, 0x2a, 0xf7, 0x78, 0x35, 0x70, 0x59, 0x6f,
76 0x28, 0xcb, 0x8e, 0x07, 0x85, 0xb5, 0x91, 0x96,
77};
78
79static const uint8_t dummy_rs256[] = {
80 0xd2, 0xa8, 0xc0, 0x11, 0x82, 0x9e, 0x57, 0x2e,
81 0x60, 0xae, 0x8c, 0xb0, 0x09, 0xe1, 0x58, 0x2b,
82 0x99, 0xec, 0xc3, 0x11, 0x1b, 0xef, 0x81, 0x49,
83 0x34, 0x53, 0x6a, 0x01, 0x65, 0x2c, 0x24, 0x09,
84 0x30, 0x87, 0x98, 0x51, 0x6e, 0x30, 0x4f, 0x60,
85 0xbd, 0x54, 0xd2, 0x54, 0xbd, 0x94, 0x42, 0xdd,
86 0x63, 0xe5, 0x2c, 0xc6, 0x04, 0x32, 0xc0, 0x8f,
87 0x72, 0xd5, 0xb4, 0xf0, 0x4f, 0x42, 0xe5, 0xb0,
88 0xa2, 0x95, 0x11, 0xfe, 0xd8, 0xb0, 0x65, 0x34,
89 0xff, 0xfb, 0x44, 0x97, 0x52, 0xfc, 0x67, 0x23,
90 0x0b, 0xad, 0xf3, 0x3a, 0x82, 0xd4, 0x96, 0x10,
91 0x87, 0x6b, 0xfa, 0xd6, 0x51, 0x60, 0x3e, 0x1c,
92 0xae, 0x19, 0xb8, 0xce, 0x08, 0xae, 0x9a, 0xee,
93 0x78, 0x16, 0x22, 0xcc, 0x92, 0xcb, 0xa8, 0x95,
94 0x34, 0xe5, 0xb9, 0x42, 0x6a, 0xf0, 0x2e, 0x82,
95 0x1f, 0x4c, 0x7d, 0x84, 0x94, 0x68, 0x7b, 0x97,
96 0x2b, 0xf7, 0x7d, 0x67, 0x83, 0xbb, 0xc7, 0x8a,
97 0x31, 0x5a, 0xf3, 0x2a, 0x95, 0xdf, 0x63, 0xe7,
98 0x4e, 0xee, 0x26, 0xda, 0x87, 0x00, 0xe2, 0x23,
99 0x4a, 0x33, 0x9a, 0xa0, 0x1b, 0xce, 0x60, 0x1f,
100 0x98, 0xa1, 0xb0, 0xdb, 0xbf, 0x20, 0x59, 0x27,
101 0xf2, 0x06, 0xd9, 0xbe, 0x37, 0xa4, 0x03, 0x6b,
102 0x6a, 0x4e, 0xaf, 0x22, 0x68, 0xf3, 0xff, 0x28,
103 0x59, 0x05, 0xc9, 0xf1, 0x28, 0xf4, 0xbb, 0x35,
104 0xe0, 0xc2, 0x68, 0xc2, 0xaa, 0x54, 0xac, 0x8c,
105 0xc1, 0x69, 0x9e, 0x4b, 0x32, 0xfc, 0x53, 0x58,
106 0x85, 0x7d, 0x3f, 0x51, 0xd1, 0xc9, 0x03, 0x02,
107 0x13, 0x61, 0x62, 0xda, 0xf8, 0xfe, 0x3e, 0xc8,
108 0x95, 0x12, 0xfb, 0x0c, 0xdf, 0x06, 0x65, 0x6f,
109 0x23, 0xc7, 0x83, 0x7c, 0x50, 0x2d, 0x27, 0x25,
110 0x4d, 0xbf, 0x94, 0xf0, 0x89, 0x04, 0xb9, 0x2d,
111 0xc4, 0xa5, 0x32, 0xa9, 0x25, 0x0a, 0x99, 0x59,
112 0x01, 0x00, 0x01,
113};
114
115static const uint8_t dummy_eddsa[] = {
116 0xfe, 0x8b, 0x61, 0x50, 0x31, 0x7a, 0xe6, 0xdf,
117 0xb1, 0x04, 0x9d, 0x4d, 0xb5, 0x7a, 0x5e, 0x96,
118 0x4c, 0xb2, 0xf9, 0x5f, 0x72, 0x47, 0xb5, 0x18,
119 0xe2, 0x39, 0xdf, 0x2f, 0x87, 0x19, 0xb3, 0x02,
120};
121
122/*
123 * Collection of HID reports from an authenticator issued with a FIDO2
124 * get assertion using the example parameters above.
125 */
126static const uint8_t dummy_wire_data_fido[] = {
127 0xff, 0xff, 0xff, 0xff, 0x86, 0x00, 0x11, 0xf7,
128 0x6f, 0xda, 0x52, 0xfd, 0xcb, 0xb6, 0x24, 0x00,
129 0x92, 0x00, 0x0e, 0x02, 0x05, 0x00, 0x02, 0x05,
130 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
131 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
132 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
133 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
134 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
135 0x00, 0x92, 0x00, 0x0e, 0x90, 0x00, 0x51, 0x00,
136 0xa1, 0x01, 0xa5, 0x01, 0x02, 0x03, 0x38, 0x18,
137 0x20, 0x01, 0x21, 0x58, 0x20, 0xe9, 0x1d, 0x9b,
138 0xac, 0x14, 0x25, 0x5f, 0xda, 0x1e, 0x11, 0xdb,
139 0xae, 0xc2, 0x90, 0x22, 0xca, 0x32, 0xec, 0x32,
140 0xe6, 0x05, 0x15, 0x44, 0xe5, 0xe8, 0xbc, 0x4f,
141 0x0a, 0xb6, 0x1a, 0xeb, 0x11, 0x22, 0x58, 0x20,
142 0xcc, 0x72, 0xf0, 0x22, 0xe8, 0x28, 0x82, 0xc5,
143 0x00, 0x92, 0x00, 0x0e, 0x00, 0xa6, 0x65, 0x6e,
144 0xff, 0x1e, 0xe3, 0x7f, 0x27, 0x44, 0x2d, 0xfb,
145 0x8d, 0x41, 0xfa, 0x85, 0x0e, 0xcb, 0xda, 0x95,
146 0x64, 0x64, 0x9b, 0x1f, 0x34, 0x00, 0x00, 0x00,
147 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
148 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
149 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
150 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
151 0x00, 0x92, 0x00, 0x0e, 0x90, 0x00, 0x14, 0x00,
152 0xa1, 0x02, 0x50, 0xee, 0x40, 0x4c, 0x85, 0xd7,
153 0xa1, 0x2f, 0x56, 0xc4, 0x4e, 0xc5, 0x93, 0x41,
154 0xd0, 0x3b, 0x23, 0x00, 0x00, 0x00, 0x00, 0x00,
155 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
156 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
157 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
158 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
159 0x00, 0x92, 0x00, 0x0e, 0x90, 0x00, 0xcb, 0x00,
160 0xa3, 0x01, 0xa2, 0x62, 0x69, 0x64, 0x58, 0x40,
161 0x4a, 0x4c, 0x9e, 0xcc, 0x81, 0x7d, 0x42, 0x03,
162 0x2b, 0x41, 0xd1, 0x38, 0xd3, 0x49, 0xb4, 0xfc,
163 0xfb, 0xe4, 0x4e, 0xe4, 0xff, 0x76, 0x34, 0x16,
164 0x68, 0x06, 0x9d, 0xa6, 0x01, 0x32, 0xb9, 0xff,
165 0xc2, 0x35, 0x0d, 0x89, 0x43, 0x66, 0x12, 0xf8,
166 0x8e, 0x5b, 0xde, 0xf4, 0xcc, 0xec, 0x9d, 0x03,
167 0x00, 0x92, 0x00, 0x0e, 0x00, 0x85, 0xc2, 0xf5,
168 0xe6, 0x8e, 0xeb, 0x3f, 0x3a, 0xec, 0xc3, 0x1d,
169 0x04, 0x6e, 0xf3, 0x5b, 0x88, 0x64, 0x74, 0x79,
170 0x70, 0x65, 0x6a, 0x70, 0x75, 0x62, 0x6c, 0x69,
171 0x63, 0x2d, 0x6b, 0x65, 0x79, 0x02, 0x58, 0x25,
172 0x49, 0x96, 0x0d, 0xe5, 0x88, 0x0e, 0x8c, 0x68,
173 0x74, 0x34, 0x17, 0x0f, 0x64, 0x76, 0x60, 0x5b,
174 0x8f, 0xe4, 0xae, 0xb9, 0xa2, 0x86, 0x32, 0xc7,
175 0x00, 0x92, 0x00, 0x0e, 0x01, 0x99, 0x5c, 0xf3,
176 0xba, 0x83, 0x1d, 0x97, 0x63, 0x04, 0x00, 0x00,
177 0x00, 0x09, 0x03, 0x58, 0x47, 0x30, 0x45, 0x02,
178 0x21, 0x00, 0xcf, 0x3f, 0x36, 0x0e, 0x1f, 0x6f,
179 0xd6, 0xa0, 0x9d, 0x13, 0xcf, 0x55, 0xf7, 0x49,
180 0x8f, 0xc8, 0xc9, 0x03, 0x12, 0x76, 0x41, 0x75,
181 0x7b, 0xb5, 0x0a, 0x90, 0xa5, 0x82, 0x26, 0xf1,
182 0x6b, 0x80, 0x02, 0x20, 0x34, 0x9b, 0x7a, 0x82,
183 0x00, 0x92, 0x00, 0x0e, 0x02, 0xd3, 0xe1, 0x79,
184 0x49, 0x55, 0x41, 0x9f, 0xa4, 0x06, 0x06, 0xbd,
185 0xc8, 0xb9, 0x2b, 0x5f, 0xe1, 0xa7, 0x99, 0x1c,
186 0xa1, 0xfc, 0x7e, 0x3e, 0xd5, 0x85, 0x2e, 0x11,
187 0x75, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
188 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
189 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
190 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
191};
192
193/*
194 * Collection of HID reports from an authenticator issued with a U2F
195 * authentication using the example parameters above.
196 */
197static const uint8_t dummy_wire_data_u2f[] = {
198 0xff, 0xff, 0xff, 0xff, 0x86, 0x00, 0x11, 0x0f,
199 0x26, 0x9c, 0xd3, 0x87, 0x0d, 0x7b, 0xf6, 0x00,
200 0x00, 0x99, 0x01, 0x02, 0x01, 0x01, 0x00, 0x01,
201 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
202 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
203 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
204 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
205 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
206 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
207 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
208 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
209 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
210 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
211 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
212 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
213 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
214 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
215 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
216 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
217 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
218 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
219 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
220 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
221 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
222 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
223 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
224 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
225 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
226 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
227 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
228 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
229 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
230 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
231 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
232 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
233 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
234 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
235 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
236 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
237 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
238 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
239 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
240 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
241 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
242 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
243 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
244 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
245 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
246 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
247 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
248 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
249 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
250 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
251 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
252 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
253 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
254 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
255 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
256 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
257 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
258 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
259 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
260 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
261 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
262 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
263 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
264 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
265 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
266 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
267 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
268 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
269 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
270 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x02, 0x69,
271 0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
272 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
273 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
274 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
275 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
276 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
277 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
278 0x00, 0x00, 0x99, 0x01, 0x83, 0x00, 0x4e, 0x01,
279 0x00, 0x00, 0x00, 0x2c, 0x30, 0x45, 0x02, 0x20,
280 0x1c, 0xf5, 0x7c, 0xf6, 0xde, 0xbe, 0xe9, 0x86,
281 0xee, 0x97, 0xb7, 0x64, 0xa3, 0x4e, 0x7a, 0x70,
282 0x85, 0xd0, 0x66, 0xf9, 0xf0, 0xcd, 0x04, 0x5d,
283 0x97, 0xf2, 0x3c, 0x22, 0xe3, 0x0e, 0x61, 0xc8,
284 0x02, 0x21, 0x00, 0x97, 0xef, 0xae, 0x36, 0xe6,
285 0x17, 0x9f, 0x5e, 0x2d, 0xd7, 0x8c, 0x34, 0xa7,
286 0x00, 0x00, 0x99, 0x01, 0x00, 0xa1, 0xe9, 0xfb,
287 0x8f, 0x86, 0x8c, 0xe3, 0x1e, 0xde, 0x3f, 0x4e,
288 0x1b, 0xe1, 0x2f, 0x8f, 0x2f, 0xca, 0x42, 0x26,
289 0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
290 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
291 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
292 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
293 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
294};
295
296int LLVMFuzzerTestOneInput(const uint8_t *, size_t);
297size_t LLVMFuzzerCustomMutator(uint8_t *, size_t, size_t, unsigned int);
298
299static int
300unpack(const uint8_t *ptr, size_t len, struct param *p) NO_MSAN
301{
302 uint8_t **pp = (void *)&ptr;
303
304 if (unpack_byte(TAG_UV, pp, &len, &p->uv) < 0 ||
305 unpack_byte(TAG_UP, pp, &len, &p->up) < 0 ||
306 unpack_byte(TAG_U2F, pp, &len, &p->u2f) < 0 ||
307 unpack_byte(TAG_TYPE, pp, &len, &p->type) < 0 ||
308 unpack_byte(TAG_CRED_COUNT, pp, &len, &p->cred_count) < 0 ||
309 unpack_int(TAG_EXT, pp, &len, &p->ext) < 0 ||
310 unpack_int(TAG_SEED, pp, &len, &p->seed) < 0 ||
311 unpack_string(TAG_RP_ID, pp, &len, p->rp_id) < 0 ||
312 unpack_string(TAG_PIN, pp, &len, p->pin) < 0 ||
313 unpack_blob(TAG_WIRE_DATA, pp, &len, &p->wire_data) < 0 ||
314 unpack_blob(TAG_RS256, pp, &len, &p->rs256) < 0 ||
315 unpack_blob(TAG_ES256, pp, &len, &p->es256) < 0 ||
316 unpack_blob(TAG_EDDSA, pp, &len, &p->eddsa) < 0 ||
317 unpack_blob(TAG_CRED, pp, &len, &p->cred) < 0 ||
318 unpack_blob(TAG_CDH, pp, &len, &p->cdh) < 0)
319 return (-1);
320
321 return (0);
322}
323
324static size_t
325pack(uint8_t *ptr, size_t len, const struct param *p)
326{
327 const size_t max = len;
328
329 if (pack_byte(TAG_UV, &ptr, &len, p->uv) < 0 ||
330 pack_byte(TAG_UP, &ptr, &len, p->up) < 0 ||
331 pack_byte(TAG_U2F, &ptr, &len, p->u2f) < 0 ||
332 pack_byte(TAG_TYPE, &ptr, &len, p->type) < 0 ||
333 pack_byte(TAG_CRED_COUNT, &ptr, &len, p->cred_count) < 0 ||
334 pack_int(TAG_EXT, &ptr, &len, p->ext) < 0 ||
335 pack_int(TAG_SEED, &ptr, &len, p->seed) < 0 ||
336 pack_string(TAG_RP_ID, &ptr, &len, p->rp_id) < 0 ||
337 pack_string(TAG_PIN, &ptr, &len, p->pin) < 0 ||
338 pack_blob(TAG_WIRE_DATA, &ptr, &len, &p->wire_data) < 0 ||
339 pack_blob(TAG_RS256, &ptr, &len, &p->rs256) < 0 ||
340 pack_blob(TAG_ES256, &ptr, &len, &p->es256) < 0 ||
341 pack_blob(TAG_EDDSA, &ptr, &len, &p->eddsa) < 0 ||
342 pack_blob(TAG_CRED, &ptr, &len, &p->cred) < 0 ||
343 pack_blob(TAG_CDH, &ptr, &len, &p->cdh) < 0)
344 return (0);
345
346 return (max - len);
347}
348
349static void
350get_assert(fido_assert_t *assert, uint8_t u2f, const struct blob *cdh,
351 const char *rp_id, int ext, uint8_t up, uint8_t uv, const char *pin,
352 uint8_t cred_count, struct blob *cred)
353{
354 fido_dev_t *dev;
355 fido_dev_io_t io;
356
357 io.open = dev_open;
358 io.close = dev_close;
359 io.read = dev_read;
360 io.write = dev_write;
361
362 if ((dev = fido_dev_new()) == NULL || fido_dev_set_io_functions(dev,
363 &io) != FIDO_OK || fido_dev_open(dev, "nodev") != FIDO_OK) {
364 fido_dev_free(&dev);
365 return;
366 }
367
368 if (u2f & 1)
369 fido_dev_force_u2f(dev);
370
371 for (uint8_t i = 0; i < cred_count; i++)
372 fido_assert_allow_cred(assert, cred->body, cred->len);
373
374 fido_assert_set_clientdata_hash(assert, cdh->body, cdh->len);
375 fido_assert_set_rp(assert, rp_id);
376 if (ext & 1)
377 fido_assert_set_extensions(assert, FIDO_EXT_HMAC_SECRET);
378 if (up & 1)
379 fido_assert_set_up(assert, FIDO_OPT_TRUE);
380 if (uv & 1)
381 fido_assert_set_uv(assert, FIDO_OPT_TRUE);
382 /* XXX reuse cred as hmac salt to keep struct param small */
383 fido_assert_set_hmac_salt(assert, cred->body, cred->len);
384
385 fido_dev_get_assert(dev, assert, u2f & 1 ? NULL : pin);
386
387 fido_dev_cancel(dev);
388 fido_dev_close(dev);
389 fido_dev_free(&dev);
390}
391
392static void
393verify_assert(int type, const unsigned char *cdh_ptr, size_t cdh_len,
394 const char *rp_id, const unsigned char *authdata_ptr, size_t authdata_len,
395 const unsigned char *sig_ptr, size_t sig_len, uint8_t up, uint8_t uv,
396 int ext, void *pk)
397{
398 fido_assert_t *assert = NULL;
399
400 if ((assert = fido_assert_new()) == NULL)
401 return;
402
403 fido_assert_set_clientdata_hash(assert, cdh_ptr, cdh_len);
404 fido_assert_set_rp(assert, rp_id);
405 fido_assert_set_count(assert, 1);
406 if (fido_assert_set_authdata(assert, 0, authdata_ptr,
407 authdata_len) != FIDO_OK) {
408 fido_assert_set_authdata_raw(assert, 0, authdata_ptr,
409 authdata_len);
410 }
411 fido_assert_set_extensions(assert, ext);
412 if (up & 1) fido_assert_set_up(assert, FIDO_OPT_TRUE);
413 if (uv & 1) fido_assert_set_uv(assert, FIDO_OPT_TRUE);
414 fido_assert_set_sig(assert, 0, sig_ptr, sig_len);
415 fido_assert_verify(assert, 0, type, pk);
416
417 fido_assert_free(&assert);
418}
419
420/*
421 * Do a dummy conversion to exercise rs256_pk_from_RSA().
422 */
423static void
424rs256_convert(const rs256_pk_t *k)
425{
426 EVP_PKEY *pkey = NULL;
427 rs256_pk_t *pk = NULL;
428 RSA *rsa = NULL;
429 volatile int r;
430
431 if ((pkey = rs256_pk_to_EVP_PKEY(k)) == NULL ||
432 (pk = rs256_pk_new()) == NULL ||
433 (rsa = EVP_PKEY_get0_RSA(pkey)) == NULL)
434 goto out;
435
436 r = rs256_pk_from_RSA(pk, rsa);
437out:
438 if (pk)
439 rs256_pk_free(&pk);
440 if (pkey)
441 EVP_PKEY_free(pkey);
442}
443
444/*
445 * Do a dummy conversion to exercise eddsa_pk_from_EVP_PKEY().
446 */
447static void
448eddsa_convert(const eddsa_pk_t *k)
449{
450 EVP_PKEY *pkey = NULL;
451 eddsa_pk_t *pk = NULL;
452 volatile int r;
453
454 if ((pkey = eddsa_pk_to_EVP_PKEY(k)) == NULL ||
455 (pk = eddsa_pk_new()) == NULL)
456 goto out;
457
458 r = eddsa_pk_from_EVP_PKEY(pk, pkey);
459out:
460 if (pk)
461 eddsa_pk_free(&pk);
462 if (pkey)
463 EVP_PKEY_free(pkey);
464}
465
466int
467LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
468{
469 struct param p;
470 fido_assert_t *assert = NULL;
471 es256_pk_t *es256_pk = NULL;
472 rs256_pk_t *rs256_pk = NULL;
473 eddsa_pk_t *eddsa_pk = NULL;
474 uint8_t flags;
475 uint32_t sigcount;
476 int cose_alg = 0;
477 void *pk;
478
479 memset(&p, 0, sizeof(p));
480
481 if (unpack(data, size, &p) < 0)
482 return (0);
483
484 srandom((unsigned int)p.seed);
485
486 fido_init(0);
487
488 switch (p.type & 3) {
489 case 0:
490 cose_alg = COSE_ES256;
491
492 if ((es256_pk = es256_pk_new()) == NULL)
493 return (0);
494
495 es256_pk_from_ptr(es256_pk, p.es256.body, p.es256.len);
496 pk = es256_pk;
497
498 break;
499 case 1:
500 cose_alg = COSE_RS256;
501
502 if ((rs256_pk = rs256_pk_new()) == NULL)
503 return (0);
504
505 rs256_pk_from_ptr(rs256_pk, p.rs256.body, p.rs256.len);
506 pk = rs256_pk;
507
508 rs256_convert(pk);
509
510 break;
511 default:
512 cose_alg = COSE_EDDSA;
513
514 if ((eddsa_pk = eddsa_pk_new()) == NULL)
515 return (0);
516
517 eddsa_pk_from_ptr(eddsa_pk, p.eddsa.body, p.eddsa.len);
518 pk = eddsa_pk;
519
520 eddsa_convert(pk);
521
522 break;
523 }
524
525 if ((assert = fido_assert_new()) == NULL)
526 goto out;
527
528 set_wire_data(p.wire_data.body, p.wire_data.len);
529
530 get_assert(assert, p.u2f, &p.cdh, p.rp_id, p.ext, p.up, p.uv, p.pin,
531 p.cred_count, &p.cred);
532
533 /* XXX +1 on purpose */
534 for (size_t i = 0; i <= fido_assert_count(assert); i++) {
535 verify_assert(cose_alg,
536 fido_assert_clientdata_hash_ptr(assert),
537 fido_assert_clientdata_hash_len(assert),
538 fido_assert_rp_id(assert),
539 fido_assert_authdata_ptr(assert, i),
540 fido_assert_authdata_len(assert, i),
541 fido_assert_sig_ptr(assert, i),
542 fido_assert_sig_len(assert, i), p.up, p.uv, p.ext, pk);
543 consume(fido_assert_id_ptr(assert, i),
544 fido_assert_id_len(assert, i));
545 consume(fido_assert_user_id_ptr(assert, i),
546 fido_assert_user_id_len(assert, i));
547 consume(fido_assert_hmac_secret_ptr(assert, i),
548 fido_assert_hmac_secret_len(assert, i));
549 consume(fido_assert_user_icon(assert, i),
550 xstrlen(fido_assert_user_icon(assert, i)));
551 consume(fido_assert_user_name(assert, i),
552 xstrlen(fido_assert_user_name(assert, i)));
553 consume(fido_assert_user_display_name(assert, i),
554 xstrlen(fido_assert_user_display_name(assert, i)));
555 flags = fido_assert_flags(assert, i);
556 consume(&flags, sizeof(flags));
557 sigcount = fido_assert_sigcount(assert, i);
558 consume(&sigcount, sizeof(sigcount));
559 }
560
561out:
562 es256_pk_free(&es256_pk);
563 rs256_pk_free(&rs256_pk);
564 eddsa_pk_free(&eddsa_pk);
565
566 fido_assert_free(&assert);
567
568 return (0);
569}
570
571static size_t
572pack_dummy(uint8_t *ptr, size_t len)
573{
574 struct param dummy;
575 uint8_t blob[16384];
576 size_t blob_len;
577
578 memset(&dummy, 0, sizeof(dummy));
579
580 dummy.type = 1;
581 dummy.ext = FIDO_EXT_HMAC_SECRET;
582
583 strlcpy(dummy.pin, dummy_pin, sizeof(dummy.pin));
584 strlcpy(dummy.rp_id, dummy_rp_id, sizeof(dummy.rp_id));
585
586 dummy.cdh.len = sizeof(dummy_cdh);
587 dummy.es256.len = sizeof(dummy_es256);
588 dummy.rs256.len = sizeof(dummy_rs256);
589 dummy.eddsa.len = sizeof(dummy_eddsa);
590 dummy.wire_data.len = sizeof(dummy_wire_data_fido);
591
592 memcpy(&dummy.cdh.body, &dummy_cdh, dummy.cdh.len);
593 memcpy(&dummy.wire_data.body, &dummy_wire_data_fido,
594 dummy.wire_data.len);
595 memcpy(&dummy.es256.body, &dummy_es256, dummy.es256.len);
596 memcpy(&dummy.rs256.body, &dummy_rs256, dummy.rs256.len);
597 memcpy(&dummy.eddsa.body, &dummy_eddsa, dummy.eddsa.len);
598
599 blob_len = pack(blob, sizeof(blob), &dummy);
600 assert(blob_len != 0);
601
602 if (blob_len > len) {
603 memcpy(ptr, blob, len);
604 return (len);
605 }
606
607 memcpy(ptr, blob, blob_len);
608
609 return (blob_len);
610}
611
612size_t
613LLVMFuzzerCustomMutator(uint8_t *data, size_t size, size_t maxsize,
614 unsigned int seed) NO_MSAN
615{
616 struct param p;
617 uint8_t blob[16384];
618 size_t blob_len;
619
620 (void)seed;
621
622 memset(&p, 0, sizeof(p));
623
624 if (unpack(data, size, &p) < 0)
625 return (pack_dummy(data, maxsize));
626
627 mutate_byte(&p.uv);
628 mutate_byte(&p.up);
629 mutate_byte(&p.u2f);
630 mutate_byte(&p.type);
631 mutate_byte(&p.cred_count);
632
633 mutate_int(&p.ext);
634 p.seed = (int)seed;
635
636 if (p.u2f & 1) {
637 p.wire_data.len = sizeof(dummy_wire_data_u2f);
638 memcpy(&p.wire_data.body, &dummy_wire_data_u2f,
639 p.wire_data.len);
640 } else {
641 p.wire_data.len = sizeof(dummy_wire_data_fido);
642 memcpy(&p.wire_data.body, &dummy_wire_data_fido,
643 p.wire_data.len);
644 }
645
646 mutate_blob(&p.wire_data);
647 mutate_blob(&p.rs256);
648 mutate_blob(&p.es256);
649 mutate_blob(&p.eddsa);
650 mutate_blob(&p.cred);
651 mutate_blob(&p.cdh);
652
653 mutate_string(p.rp_id);
654 mutate_string(p.pin);
655
656 blob_len = pack(blob, sizeof(blob), &p);
657
658 if (blob_len == 0 || blob_len > maxsize)
659 return (0);
660
661 memcpy(data, blob, blob_len);
662
663 return (blob_len);
664}
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-29 16:14:35 +0000