diff options
| -rwxr-xr-x | configure.py | 13 | ||||
| -rw-r--r-- | src/lib/tls/msg_cert_verify.cpp | 9 | ||||
| -rw-r--r-- | src/lib/tls/msg_finished.cpp | 9 | ||||
| -rw-r--r-- | src/lib/tls/msg_server_kex.cpp | 8 |
4 files changed, 31 insertions, 8 deletions
diff --git a/configure.py b/configure.py index 8aa054c16..d690f4b98 100755 --- a/configure.py +++ b/configure.py @@ -278,10 +278,10 @@ def process_command_line(args): help='enable ASan/UBSan checks') build_group.add_option('--with-coverage', action='store_true', default=False, dest='with_coverage', - help='enable coverage checking and disable opts') + help='add coverage info and disable opts') build_group.add_option('--with-coverage-info', action='store_true', default=False, dest='with_coverage_info', - help='enable coverage checking') + help='add coverage info') build_group.add_option('--enable-shared-library', dest='build_shared_lib', action='store_true', default=True, @@ -383,6 +383,9 @@ def process_command_line(args): build_group.add_option('--with-bakefile', action='store_true', default=False, help='Generate bakefile which can be used to create Visual Studio or Xcode project files') + build_group.add_option('--unsafe-fuzzer-mode', action='store_true', default=False, + help='disable essential checks for testing') + mods_group = optparse.OptionGroup(parser, 'Module selection') mods_group.add_option('--module-policy', dest='module_policy', @@ -403,9 +406,6 @@ def process_command_line(args): mods_group.add_option('--minimized-build', action='store_true', dest='no_autoload', help='minimize build') - mods_group.add_option('--unsafe-fuzzer-mode', action='store_true', - help='disable checks for fuzz testing') - # Should be derived from info.txt but this runs too early third_party = ['boost', 'bzip2', 'lzma', 'openssl', 'sqlite3', 'zlib', 'tpm', 'pkcs11'] @@ -2337,6 +2337,9 @@ def main(argv = None): build_config.version_release_type, release_date(build_config.version_datestamp))) + if options.unsafe_fuzzer_mode: + logging.warning("The fuzzer mode flag is labeled unsafe for a reason, this version is for testing only") + if __name__ == '__main__': try: main() diff --git a/src/lib/tls/msg_cert_verify.cpp b/src/lib/tls/msg_cert_verify.cpp index ac8fa97fd..2f8e8230e 100644 --- a/src/lib/tls/msg_cert_verify.cpp +++ b/src/lib/tls/msg_cert_verify.cpp @@ -90,7 +90,14 @@ bool Certificate_Verify::verify(const X509_Certificate& cert, PK_Verifier verifier(*key, format.first, format.second); - return verifier.verify_message(state.hash().get_contents(), m_signature); + const bool signature_valid = + verifier.verify_message(state.hash().get_contents(), m_signature); + +#if defined(BOTAN_UNSAFE_FUZZER_MODE) + return true; +#else + return signature_valid; +#endif } } diff --git a/src/lib/tls/msg_finished.cpp b/src/lib/tls/msg_finished.cpp index 3a2c88fb1..7d5eea77a 100644 --- a/src/lib/tls/msg_finished.cpp +++ b/src/lib/tls/msg_finished.cpp @@ -74,7 +74,14 @@ Finished::Finished(const std::vector<byte>& buf) : m_verification_data(buf) bool Finished::verify(const Handshake_State& state, Connection_Side side) const { - return (m_verification_data == finished_compute_verify(state, side)); + std::vector<byte> computed_verify = finished_compute_verify(state, side); + +#if defined(BOTAN_UNSAFE_FUZZER_MODE) + return true; +#else + return (m_verification_data.size() == computed_verify.size()) && + same_mem(m_verification_data.data(), computed_verify.data(), computed_verify.size()); +#endif } } diff --git a/src/lib/tls/msg_server_kex.cpp b/src/lib/tls/msg_server_kex.cpp index 521ef4e20..72b90a31c 100644 --- a/src/lib/tls/msg_server_kex.cpp +++ b/src/lib/tls/msg_server_kex.cpp @@ -287,7 +287,13 @@ bool Server_Key_Exchange::verify(const Public_Key& server_key, verifier.update(state.server_hello()->random()); verifier.update(params()); - return verifier.check_signature(m_signature); + const bool signature_valid = verifier.check_signature(m_signature); + +#if defined(BOTAN_UNSAFE_FUZZER_MODE) + return true; +#else + return signature_valid; +#endif } const Private_Key& Server_Key_Exchange::server_kex_key() const |