1*4724848cSchristos /*
2*4724848cSchristos * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
3*4724848cSchristos *
4*4724848cSchristos * Licensed under the OpenSSL licenses, (the "License");
5*4724848cSchristos * you may not use this file except in compliance with the License.
6*4724848cSchristos * You may obtain a copy of the License at
7*4724848cSchristos * https://www.openssl.org/source/license.html
8*4724848cSchristos * or in the file LICENSE in the source distribution.
9*4724848cSchristos */
10*4724848cSchristos
11*4724848cSchristos #include <time.h>
12*4724848cSchristos #include <openssl/rand.h>
13*4724848cSchristos #include <openssl/ssl.h>
14*4724848cSchristos #include <openssl/rsa.h>
15*4724848cSchristos #include <openssl/dsa.h>
16*4724848cSchristos #include <openssl/ec.h>
17*4724848cSchristos #include <openssl/dh.h>
18*4724848cSchristos #include <openssl/err.h>
19*4724848cSchristos #include "fuzzer.h"
20*4724848cSchristos
21*4724848cSchristos #include "rand.inc"
22*4724848cSchristos
23*4724848cSchristos /* unused, to avoid warning. */
24*4724848cSchristos static int idx;
25*4724848cSchristos
26*4724848cSchristos #define FUZZTIME 1485898104
27*4724848cSchristos
28*4724848cSchristos #define TIME_IMPL(t) { if (t != NULL) *t = FUZZTIME; return FUZZTIME; }
29*4724848cSchristos
30*4724848cSchristos /*
31*4724848cSchristos * This might not work in all cases (and definitely not on Windows
32*4724848cSchristos * because of the way linkers are) and callees can still get the
33*4724848cSchristos * current time instead of the fixed time. This will just result
34*4724848cSchristos * in things not being fully reproducible and have a slightly
35*4724848cSchristos * different coverage.
36*4724848cSchristos */
37*4724848cSchristos #if !defined(_WIN32)
time(time_t * t)38*4724848cSchristos time_t time(time_t *t) TIME_IMPL(t)
39*4724848cSchristos #endif
40*4724848cSchristos
41*4724848cSchristos int FuzzerInitialize(int *argc, char ***argv)
42*4724848cSchristos {
43*4724848cSchristos STACK_OF(SSL_COMP) *comp_methods;
44*4724848cSchristos
45*4724848cSchristos OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL);
46*4724848cSchristos OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
47*4724848cSchristos ERR_get_state();
48*4724848cSchristos CRYPTO_free_ex_index(0, -1);
49*4724848cSchristos idx = SSL_get_ex_data_X509_STORE_CTX_idx();
50*4724848cSchristos FuzzerSetRand();
51*4724848cSchristos comp_methods = SSL_COMP_get_compression_methods();
52*4724848cSchristos if (comp_methods != NULL)
53*4724848cSchristos sk_SSL_COMP_sort(comp_methods);
54*4724848cSchristos
55*4724848cSchristos return 1;
56*4724848cSchristos }
57*4724848cSchristos
FuzzerTestOneInput(const uint8_t * buf,size_t len)58*4724848cSchristos int FuzzerTestOneInput(const uint8_t *buf, size_t len)
59*4724848cSchristos {
60*4724848cSchristos SSL *client;
61*4724848cSchristos BIO *in;
62*4724848cSchristos BIO *out;
63*4724848cSchristos SSL_CTX *ctx;
64*4724848cSchristos
65*4724848cSchristos if (len == 0)
66*4724848cSchristos return 0;
67*4724848cSchristos
68*4724848cSchristos /*
69*4724848cSchristos * TODO: use the ossltest engine (optionally?) to disable crypto checks.
70*4724848cSchristos */
71*4724848cSchristos
72*4724848cSchristos /* This only fuzzes the initial flow from the client so far. */
73*4724848cSchristos ctx = SSL_CTX_new(SSLv23_method());
74*4724848cSchristos
75*4724848cSchristos client = SSL_new(ctx);
76*4724848cSchristos OPENSSL_assert(SSL_set_min_proto_version(client, 0) == 1);
77*4724848cSchristos OPENSSL_assert(SSL_set_cipher_list(client, "ALL:eNULL:@SECLEVEL=0") == 1);
78*4724848cSchristos SSL_set_tlsext_host_name(client, "localhost");
79*4724848cSchristos in = BIO_new(BIO_s_mem());
80*4724848cSchristos out = BIO_new(BIO_s_mem());
81*4724848cSchristos SSL_set_bio(client, in, out);
82*4724848cSchristos SSL_set_connect_state(client);
83*4724848cSchristos OPENSSL_assert((size_t)BIO_write(in, buf, len) == len);
84*4724848cSchristos if (SSL_do_handshake(client) == 1) {
85*4724848cSchristos /* Keep reading application data until error or EOF. */
86*4724848cSchristos uint8_t tmp[1024];
87*4724848cSchristos for (;;) {
88*4724848cSchristos if (SSL_read(client, tmp, sizeof(tmp)) <= 0) {
89*4724848cSchristos break;
90*4724848cSchristos }
91*4724848cSchristos }
92*4724848cSchristos }
93*4724848cSchristos SSL_free(client);
94*4724848cSchristos ERR_clear_error();
95*4724848cSchristos SSL_CTX_free(ctx);
96*4724848cSchristos
97*4724848cSchristos return 0;
98*4724848cSchristos }
99*4724848cSchristos
FuzzerCleanup(void)100*4724848cSchristos void FuzzerCleanup(void)
101*4724848cSchristos {
102*4724848cSchristos }
103