1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
/*
* (C) 2015,2016 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#include "fuzzers.h"
#include <botan/tls_client.h>
class Fuzzer_TLS_Client_Creds : public Botan::Credentials_Manager
{
public:
std::string psk_identity_hint(const std::string&, const std::string&) override { return "psk_hint"; }
std::string psk_identity(const std::string&, const std::string&, const std::string&) override { return "psk_id"; }
Botan::SymmetricKey psk(const std::string&, const std::string&, const std::string&) override
{
return Botan::SymmetricKey("AABBCCDDEEFF00112233445566778899");
}
};
class Fuzzer_TLS_Policy : public Botan::TLS::Policy
{
public:
std::vector<uint16_t> ciphersuite_list(Botan::TLS::Protocol_Version version,
bool have_srp) const
{
std::vector<uint16_t> ciphersuites;
for(auto&& suite : Botan::TLS::Ciphersuite::all_known_ciphersuites())
{
if(suite.valid() == false)
continue;
// Are we doing SRP?
if(!have_srp && suite.kex_method() == Botan::TLS::Kex_Algo::SRP_SHA)
continue;
if(!version.supports_aead_modes())
{
// Are we doing AEAD in a non-AEAD version?
if(suite.mac_algo() == "AEAD")
continue;
// Older (v1.0/v1.1) versions also do not support any hash but SHA-1
if(suite.mac_algo() != "SHA-1")
continue;
}
ciphersuites.push_back(suite.ciphersuite_code());
}
return ciphersuites;
}
};
class Fuzzer_TLS_Client_Callbacks : public Botan::TLS::Callbacks
{
public:
void tls_emit_data(const uint8_t[], size_t) override
{
// discard
}
void tls_record_received(uint64_t, const uint8_t[], size_t) override
{
// ignore peer data
}
void tls_alert(Botan::TLS::Alert) override
{
// ignore alert
}
bool tls_session_established(const Botan::TLS::Session&) override
{
return true; // cache it
}
void tls_verify_cert_chain(
const std::vector<Botan::X509_Certificate>& cert_chain,
const std::vector<std::shared_ptr<const Botan::OCSP::Response>>& ocsp_responses,
const std::vector<Botan::Certificate_Store*>& trusted_roots,
Botan::Usage_Type usage,
const std::string& hostname,
const Botan::TLS::Policy& policy) override
{
try
{
// try to validate to exercise those code paths
Botan::TLS::Callbacks::tls_verify_cert_chain(cert_chain, ocsp_responses,
trusted_roots, usage, hostname, policy);
}
catch(...)
{
// ignore validation result
}
}
};
void fuzz(const uint8_t in[], size_t len)
{
if(len == 0)
return;
Botan::TLS::Session_Manager_Noop session_manager;
Fuzzer_TLS_Policy policy;
Botan::TLS::Protocol_Version client_offer = Botan::TLS::Protocol_Version::TLS_V12;
Botan::TLS::Server_Information info("server.name", 443);
Fuzzer_TLS_Client_Callbacks callbacks;
Fuzzer_TLS_Client_Creds creds;
Botan::TLS::Client client(callbacks,
session_manager,
creds,
policy,
fuzzer_rng(),
info,
client_offer);
try
{
client.received_data(in, len);
}
catch(std::exception& e)
{
}
}
|
