1 #define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
2
3 #include <string.h>
4 #include <stdlib.h>
5 #include <stdint.h>
6 #include "fuzz_common.h"
7 #include "mbedtls/ssl.h"
8 #if defined(MBEDTLS_SSL_PROTO_DTLS)
9 #include "mbedtls/entropy.h"
10 #include "mbedtls/ctr_drbg.h"
11 #include "mbedtls/timing.h"
12 #include "test/certs.h"
13
14 #if defined(MBEDTLS_SSL_CLI_C) && \
15 defined(MBEDTLS_ENTROPY_C) && \
16 defined(MBEDTLS_CTR_DRBG_C) && \
17 defined(MBEDTLS_TIMING_C)
18 static int initialized = 0;
19 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
20 static mbedtls_x509_crt cacert;
21 #endif
22
23 const char *pers = "fuzz_dtlsclient";
24 #endif
25 #endif // MBEDTLS_SSL_PROTO_DTLS
26
27
28
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)29 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
30 {
31 #if defined(MBEDTLS_SSL_PROTO_DTLS) && \
32 defined(MBEDTLS_SSL_CLI_C) && \
33 defined(MBEDTLS_ENTROPY_C) && \
34 defined(MBEDTLS_CTR_DRBG_C) && \
35 defined(MBEDTLS_TIMING_C)
36 int ret;
37 size_t len;
38 mbedtls_ssl_context ssl;
39 mbedtls_ssl_config conf;
40 mbedtls_ctr_drbg_context ctr_drbg;
41 mbedtls_entropy_context entropy;
42 mbedtls_timing_delay_context timer;
43 unsigned char buf[4096];
44 fuzzBufferOffset_t biomemfuzz;
45
46 if (initialized == 0) {
47 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
48 mbedtls_x509_crt_init(&cacert);
49 if (mbedtls_x509_crt_parse(&cacert, (const unsigned char *) mbedtls_test_cas_pem,
50 mbedtls_test_cas_pem_len) != 0) {
51 return 1;
52 }
53 #endif
54 dummy_init();
55
56 initialized = 1;
57 }
58
59 mbedtls_ssl_init(&ssl);
60 mbedtls_ssl_config_init(&conf);
61 mbedtls_ctr_drbg_init(&ctr_drbg);
62 mbedtls_entropy_init(&entropy);
63
64 psa_status_t status = psa_crypto_init();
65 if (status != PSA_SUCCESS) {
66 goto exit;
67 }
68
69 if (mbedtls_ctr_drbg_seed(&ctr_drbg, dummy_entropy, &entropy,
70 (const unsigned char *) pers, strlen(pers)) != 0) {
71 goto exit;
72 }
73
74 if (mbedtls_ssl_config_defaults(&conf,
75 MBEDTLS_SSL_IS_CLIENT,
76 MBEDTLS_SSL_TRANSPORT_DATAGRAM,
77 MBEDTLS_SSL_PRESET_DEFAULT) != 0) {
78 goto exit;
79 }
80
81 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
82 mbedtls_ssl_conf_ca_chain(&conf, &cacert, NULL);
83 #endif
84 mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_NONE);
85
86 if (mbedtls_ssl_setup(&ssl, &conf) != 0) {
87 goto exit;
88 }
89
90 mbedtls_ssl_set_timer_cb(&ssl, &timer, mbedtls_timing_set_delay,
91 mbedtls_timing_get_delay);
92
93 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
94 if (mbedtls_ssl_set_hostname(&ssl, "localhost") != 0) {
95 goto exit;
96 }
97 #endif
98
99 biomemfuzz.Data = Data;
100 biomemfuzz.Size = Size;
101 biomemfuzz.Offset = 0;
102 mbedtls_ssl_set_bio(&ssl, &biomemfuzz, dummy_send, fuzz_recv, fuzz_recv_timeout);
103
104 ret = mbedtls_ssl_handshake(&ssl);
105 if (ret == 0) {
106 //keep reading data from server until the end
107 do {
108 len = sizeof(buf) - 1;
109 ret = mbedtls_ssl_read(&ssl, buf, len);
110
111 if (ret == MBEDTLS_ERR_SSL_WANT_READ) {
112 continue;
113 } else if (ret <= 0) {
114 //EOF or error
115 break;
116 }
117 } while (1);
118 }
119
120 exit:
121 mbedtls_entropy_free(&entropy);
122 mbedtls_ctr_drbg_free(&ctr_drbg);
123 mbedtls_ssl_config_free(&conf);
124 mbedtls_ssl_free(&ssl);
125 mbedtls_psa_crypto_free();
126
127 #else
128 (void) Data;
129 (void) Size;
130 #endif
131 return 0;
132 }
133