1 #define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
2 
3 #include <string.h>
4 #include <stdlib.h>
5 #include <stdint.h>
6 #include "fuzz_common.h"
7 #include "mbedtls/ssl.h"
8 #if defined(MBEDTLS_SSL_PROTO_DTLS)
9 #include "mbedtls/entropy.h"
10 #include "mbedtls/ctr_drbg.h"
11 #include "mbedtls/timing.h"
12 #include "test/certs.h"
13 
14 #if defined(MBEDTLS_SSL_CLI_C) && \
15     defined(MBEDTLS_ENTROPY_C) && \
16     defined(MBEDTLS_CTR_DRBG_C) && \
17     defined(MBEDTLS_TIMING_C)
18 static int initialized = 0;
19 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
20 static mbedtls_x509_crt cacert;
21 #endif
22 
23 const char *pers = "fuzz_dtlsclient";
24 #endif
25 #endif // MBEDTLS_SSL_PROTO_DTLS
26 
27 
28 
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)29 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
30 {
31 #if defined(MBEDTLS_SSL_PROTO_DTLS) && \
32     defined(MBEDTLS_SSL_CLI_C) && \
33     defined(MBEDTLS_ENTROPY_C) && \
34     defined(MBEDTLS_CTR_DRBG_C) && \
35     defined(MBEDTLS_TIMING_C)
36     int ret;
37     size_t len;
38     mbedtls_ssl_context ssl;
39     mbedtls_ssl_config conf;
40     mbedtls_ctr_drbg_context ctr_drbg;
41     mbedtls_entropy_context entropy;
42     mbedtls_timing_delay_context timer;
43     unsigned char buf[4096];
44     fuzzBufferOffset_t biomemfuzz;
45 
46     if (initialized == 0) {
47 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
48         mbedtls_x509_crt_init(&cacert);
49         if (mbedtls_x509_crt_parse(&cacert, (const unsigned char *) mbedtls_test_cas_pem,
50                                    mbedtls_test_cas_pem_len) != 0) {
51             return 1;
52         }
53 #endif
54         dummy_init();
55 
56         initialized = 1;
57     }
58 
59     mbedtls_ssl_init(&ssl);
60     mbedtls_ssl_config_init(&conf);
61     mbedtls_ctr_drbg_init(&ctr_drbg);
62     mbedtls_entropy_init(&entropy);
63 
64     psa_status_t status = psa_crypto_init();
65     if (status != PSA_SUCCESS) {
66         goto exit;
67     }
68 
69     if (mbedtls_ctr_drbg_seed(&ctr_drbg, dummy_entropy, &entropy,
70                               (const unsigned char *) pers, strlen(pers)) != 0) {
71         goto exit;
72     }
73 
74     if (mbedtls_ssl_config_defaults(&conf,
75                                     MBEDTLS_SSL_IS_CLIENT,
76                                     MBEDTLS_SSL_TRANSPORT_DATAGRAM,
77                                     MBEDTLS_SSL_PRESET_DEFAULT) != 0) {
78         goto exit;
79     }
80 
81 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
82     mbedtls_ssl_conf_ca_chain(&conf, &cacert, NULL);
83 #endif
84     mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_NONE);
85 
86     if (mbedtls_ssl_setup(&ssl, &conf) != 0) {
87         goto exit;
88     }
89 
90     mbedtls_ssl_set_timer_cb(&ssl, &timer, mbedtls_timing_set_delay,
91                              mbedtls_timing_get_delay);
92 
93 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
94     if (mbedtls_ssl_set_hostname(&ssl, "localhost") != 0) {
95         goto exit;
96     }
97 #endif
98 
99     biomemfuzz.Data = Data;
100     biomemfuzz.Size = Size;
101     biomemfuzz.Offset = 0;
102     mbedtls_ssl_set_bio(&ssl, &biomemfuzz, dummy_send, fuzz_recv, fuzz_recv_timeout);
103 
104     ret = mbedtls_ssl_handshake(&ssl);
105     if (ret == 0) {
106         //keep reading data from server until the end
107         do {
108             len = sizeof(buf) - 1;
109             ret = mbedtls_ssl_read(&ssl, buf, len);
110 
111             if (ret == MBEDTLS_ERR_SSL_WANT_READ) {
112                 continue;
113             } else if (ret <= 0) {
114                 //EOF or error
115                 break;
116             }
117         } while (1);
118     }
119 
120 exit:
121     mbedtls_entropy_free(&entropy);
122     mbedtls_ctr_drbg_free(&ctr_drbg);
123     mbedtls_ssl_config_free(&conf);
124     mbedtls_ssl_free(&ssl);
125     mbedtls_psa_crypto_free();
126 
127 #else
128     (void) Data;
129     (void) Size;
130 #endif
131     return 0;
132 }
133