tls_client.cc (2628B)
1 /* This Source Code Form is subject to the terms of the Mozilla Public 2 * License, v. 2.0. If a copy of the MPL was not distributed with this 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 4 5 #include <cassert> 6 #include <cstddef> 7 #include <cstdint> 8 #include <iostream> 9 10 #include "blapi.h" 11 #include "seccomon.h" 12 #include "ssl.h" 13 #include "sslimpl.h" 14 15 #include "base/database.h" 16 #include "base/mutate.h" 17 #include "tls/client_config.h" 18 #include "tls/common.h" 19 #include "tls/mutators.h" 20 #include "tls/socket.h" 21 22 #ifdef IS_DTLS_FUZZ 23 #define ImportFD DTLS_ImportFD 24 #else 25 #define ImportFD SSL_ImportFD 26 #endif // IS_DTLS_FUZZ 27 28 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 29 static NSSDatabase db = NSSDatabase(); 30 static PRDescIdentity id = PR_GetUniqueIdentity("fuzz-client"); 31 32 // Create and import dummy socket. 33 TlsSocket::DummyPrSocket socket = TlsSocket::DummyPrSocket(data, size); 34 ScopedPRFileDesc prFd(DummyIOLayerMethods::CreateFD(id, &socket)); 35 PRFileDesc* sslFd = ImportFD(nullptr, prFd.get()); 36 assert(sslFd == prFd.get()); 37 38 // Derive client config from input data. 39 TlsClient::Config config = TlsClient::Config(data, size); 40 41 if (ssl_trace >= 90) { 42 std::cerr << config << "\n"; 43 } 44 45 // Reset the RNG state. 46 assert(RNG_RandomUpdate(NULL, 0) == SECSuccess); 47 assert(SSL_SetURL(sslFd, "fuzz.client") == SECSuccess); 48 49 TlsCommon::EnableAllProtocolVersions(); 50 TlsCommon::EnableAllCipherSuites(sslFd); 51 TlsCommon::FixTime(sslFd); 52 53 // Set socket callbacks & options from client config. 54 config.SetCallbacks(sslFd); 55 config.SetSocketOptions(sslFd); 56 57 // Perform the acutal handshake. 58 TlsCommon::DoHandshake(sslFd, false); 59 60 // Release all SIDs. 61 SSL_ClearSessionCache(); 62 63 return 0; 64 } 65 66 extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* data, size_t size, 67 size_t maxSize, unsigned int seed) { 68 Mutators mutators = {TlsMutators::DropRecord, TlsMutators::ShuffleRecords, 69 TlsMutators::DuplicateRecord, 70 TlsMutators::TruncateRecord, 71 TlsMutators::FragmentRecord}; 72 return CustomMutate(mutators, data, size, maxSize, seed); 73 } 74 75 extern "C" size_t LLVMFuzzerCustomCrossOver(const uint8_t* data1, size_t size1, 76 const uint8_t* data2, size_t size2, 77 uint8_t* out, size_t maxOutSize, 78 unsigned int seed) { 79 return TlsMutators::CrossOver(data1, size1, data2, size2, out, maxOutSize, 80 seed); 81 }