1 #define MBEDTLS_ALLOW_PRIVATE_ACCESS
2
3 #include <string.h>
4 #include <stdlib.h>
5 #include <stdint.h>
6 #include "common.h"
7 #include "mbedtls/ssl.h"
8 #include "test/certs.h"
9 #if defined(MBEDTLS_SSL_PROTO_DTLS)
10 #include "mbedtls/entropy.h"
11 #include "mbedtls/ctr_drbg.h"
12 #include "mbedtls/timing.h"
13 #include "mbedtls/ssl_cookie.h"
14 #include "mbedtls/legacy_or_psa.h"
15
16 #if defined(MBEDTLS_SSL_SRV_C) && \
17 defined(MBEDTLS_ENTROPY_C) && \
18 defined(MBEDTLS_CTR_DRBG_C) && \
19 defined(MBEDTLS_TIMING_C) && \
20 (defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) || \
21 defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA))
22 const char *pers = "fuzz_dtlsserver";
23 const unsigned char client_ip[4] = { 0x7F, 0, 0, 1 };
24 static int initialized = 0;
25 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
26 static mbedtls_x509_crt srvcert;
27 static mbedtls_pk_context pkey;
28 #endif
29 #endif
30 #endif // MBEDTLS_SSL_PROTO_DTLS
31
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)32 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
33 {
34 #if defined(MBEDTLS_SSL_PROTO_DTLS) && \
35 defined(MBEDTLS_SSL_SRV_C) && \
36 defined(MBEDTLS_ENTROPY_C) && \
37 defined(MBEDTLS_CTR_DRBG_C) && \
38 defined(MBEDTLS_TIMING_C) && \
39 (defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) || \
40 defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA))
41 int ret;
42 size_t len;
43 mbedtls_ssl_context ssl;
44 mbedtls_ssl_config conf;
45 mbedtls_ctr_drbg_context ctr_drbg;
46 mbedtls_entropy_context entropy;
47 mbedtls_timing_delay_context timer;
48 mbedtls_ssl_cookie_ctx cookie_ctx;
49 unsigned char buf[4096];
50 fuzzBufferOffset_t biomemfuzz;
51
52 mbedtls_ctr_drbg_init(&ctr_drbg);
53 mbedtls_entropy_init(&entropy);
54
55 if (mbedtls_ctr_drbg_seed(&ctr_drbg, dummy_entropy, &entropy,
56 (const unsigned char *) pers, strlen(pers)) != 0) {
57 goto exit;
58 }
59
60 if (initialized == 0) {
61 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
62 mbedtls_x509_crt_init(&srvcert);
63 mbedtls_pk_init(&pkey);
64 if (mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_srv_crt,
65 mbedtls_test_srv_crt_len) != 0) {
66 return 1;
67 }
68 if (mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_cas_pem,
69 mbedtls_test_cas_pem_len) != 0) {
70 return 1;
71 }
72 if (mbedtls_pk_parse_key(&pkey, (const unsigned char *) mbedtls_test_srv_key,
73 mbedtls_test_srv_key_len, NULL, 0,
74 dummy_random, &ctr_drbg) != 0) {
75 return 1;
76 }
77 #endif
78 dummy_init();
79
80 initialized = 1;
81 }
82 mbedtls_ssl_init(&ssl);
83 mbedtls_ssl_config_init(&conf);
84 mbedtls_ssl_cookie_init(&cookie_ctx);
85
86 if (mbedtls_ssl_config_defaults(&conf,
87 MBEDTLS_SSL_IS_SERVER,
88 MBEDTLS_SSL_TRANSPORT_DATAGRAM,
89 MBEDTLS_SSL_PRESET_DEFAULT) != 0) {
90 goto exit;
91 }
92
93
94 srand(1);
95 mbedtls_ssl_conf_rng(&conf, dummy_random, &ctr_drbg);
96
97 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
98 mbedtls_ssl_conf_ca_chain(&conf, srvcert.next, NULL);
99 if (mbedtls_ssl_conf_own_cert(&conf, &srvcert, &pkey) != 0) {
100 goto exit;
101 }
102 #endif
103
104 if (mbedtls_ssl_cookie_setup(&cookie_ctx, dummy_random, &ctr_drbg) != 0) {
105 goto exit;
106 }
107
108 mbedtls_ssl_conf_dtls_cookies(&conf,
109 mbedtls_ssl_cookie_write,
110 mbedtls_ssl_cookie_check,
111 &cookie_ctx);
112
113 if (mbedtls_ssl_setup(&ssl, &conf) != 0) {
114 goto exit;
115 }
116
117 mbedtls_ssl_set_timer_cb(&ssl, &timer, mbedtls_timing_set_delay,
118 mbedtls_timing_get_delay);
119
120 biomemfuzz.Data = Data;
121 biomemfuzz.Size = Size;
122 biomemfuzz.Offset = 0;
123 mbedtls_ssl_set_bio(&ssl, &biomemfuzz, dummy_send, fuzz_recv, fuzz_recv_timeout);
124 if (mbedtls_ssl_set_client_transport_id(&ssl, client_ip, sizeof(client_ip)) != 0) {
125 goto exit;
126 }
127
128 ret = mbedtls_ssl_handshake(&ssl);
129
130 if (ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED) {
131 biomemfuzz.Offset = ssl.next_record_offset;
132 mbedtls_ssl_session_reset(&ssl);
133 mbedtls_ssl_set_bio(&ssl, &biomemfuzz, dummy_send, fuzz_recv, fuzz_recv_timeout);
134 if (mbedtls_ssl_set_client_transport_id(&ssl, client_ip, sizeof(client_ip)) != 0) {
135 goto exit;
136 }
137
138 ret = mbedtls_ssl_handshake(&ssl);
139
140 if (ret == 0) {
141 //keep reading data from server until the end
142 do {
143 len = sizeof(buf) - 1;
144 ret = mbedtls_ssl_read(&ssl, buf, len);
145 if (ret == MBEDTLS_ERR_SSL_WANT_READ) {
146 continue;
147 } else if (ret <= 0) {
148 //EOF or error
149 break;
150 }
151 } while (1);
152 }
153 }
154
155 exit:
156 mbedtls_ssl_cookie_free(&cookie_ctx);
157 mbedtls_entropy_free(&entropy);
158 mbedtls_ctr_drbg_free(&ctr_drbg);
159 mbedtls_ssl_config_free(&conf);
160 mbedtls_ssl_free(&ssl);
161
162 #else
163 (void) Data;
164 (void) Size;
165 #endif
166 return 0;
167 }
168