Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[TLS 1.3] Fuzz Target for Handshake Message Parsing #2977

Closed
wants to merge 1 commit into from
+40 −0
Closed

[TLS 1.3] Fuzz Target for Handshake Message Parsing #2977

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions src/fuzzer/tls_13_handshake_layer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
/*
* (C) 2022 Jack Lloyd
* (C) 2002 René Meusel - neXenio GmbH
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include "fuzzers.h"
#include <botan/internal/tls_handshake_layer_13.h>
#include <botan/internal/tls_transcript_hash_13.h>


namespace {

Botan::TLS::Handshake_Layer prepare(const std::vector<uint8_t>& data)
{
Botan::TLS::Handshake_Layer hl(Botan::TLS::Connection_Side::CLIENT);
hl.copy_data(data);
return hl;
}

} // namespace;


void fuzz(const uint8_t in[], size_t len)
{
static Botan::TLS::Default_Policy policy;

try
{
std::vector<uint8_t> v(in, in + len);
Comment on lines +15 to +31
Copy link
Contributor

@lz101010 lz101010 Jul 25, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@reneme I'm unable to push the following change (403) to the vector's type:

Suggested change
Botan::TLS::Handshake_Layer prepare(const std::vector<uint8_t>& data)
{
Botan::TLS::Handshake_Layer hl(Botan::TLS::Connection_Side::CLIENT);
hl.copy_data(data);
return hl;
}
} // namespace;
void fuzz(const uint8_t in[], size_t len)
{
static Botan::TLS::Default_Policy policy;
try
{
std::vector<uint8_t> v(in, in + len);
Botan::TLS::Handshake_Layer prepare(const Botan::secure_vector<uint8_t>& data)
{
Botan::TLS::Handshake_Layer hl(Botan::TLS::Connection_Side::CLIENT);
hl.copy_data(data);
return hl;
}
} // namespace;
void fuzz(const uint8_t in[], size_t len)
{
static Botan::TLS::Default_Policy policy;
try
{
Botan::secure_vector<uint8_t> v(in, in + len);

Can you approve the suggestion so the build can hopefully pass? Alternately I can open a separate PR, but that feels overkill.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I decided to open a new PR anyway, the fuzzer now works as intended: #3013

I suggest closing this PR (I apparently can't do this myself) in favor of the other one, because (a) the other one is ready to merge (b) I can rebase the other PR if something else changes in the meantime.

auto hl1 = prepare(v);
Botan::TLS::Transcript_Hash_State ths("SHA-256");
while (hl1.next_message(policy, ths).has_value()) {};

auto hl2 = prepare(v);
while (hl2.next_post_handshake_message(policy).has_value()) {};
}
catch(Botan::Exception& e) {}
}