denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fuzz: Create fuzzers with default and custom crypto plugins

Browse Source 
The pa_tnc fuzzer does not rely on any plugins and the pb_tnc fuzzer is
a bit special in that it does use code from the tnccs-20 plugin, but that
doesn't actually have to be loaded as such. The fuzzer directly calls
statically linked code from the plugin.
This commit is contained in:
Tobias Brunner
2026-04-08 15:56:42 +02:00
parent 521c6e05c5
commit 444a1dc0e3
6 changed files with 83 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fuzz/.gitignore
+8 -4
View File
@@ -1,8 +1,12 @@
fuzz_certs
fuzz_crls
fuzz_certs_cus
fuzz_certs_def
fuzz_crls_cus
fuzz_crls_def
fuzz_ids
fuzz_ike
fuzz_ocsp_req
fuzz_ocsp_rsp
fuzz_ocsp_req_cus
fuzz_ocsp_req_def
fuzz_ocsp_rsp_cus
fuzz_ocsp_rsp_def
fuzz_pa_tnc
fuzz_pb_tnc
fuzz/Makefile.am
+54 -18
View File
@@ -8,14 +8,26 @@ AM_CPPFLAGS = @CPPFLAGS@ \
-I$(top_srcdir)/src/libtnccs \
-I$(top_srcdir)/src/libtnccs/plugins/tnccs_20 \
-I$(top_srcdir)/src/libradius \
-DPLUGINDIR=\""$(abs_top_builddir)/src/libstrongswan/plugins\"" \
-DPLUGINS="\"${fuzz_plugins}\""
-DPLUGINDIR=\""$(abs_top_builddir)/src/libstrongswan/plugins\""
fuzz_cppflags_def = ${AM_CPPFLAGS} \
-DPLUGINS="\"${fd_plugins}\""
fuzz_cppflags_cus = ${AM_CPPFLAGS} \
-DPLUGINS="\"${fc_plugins}\""
fuzz_ldflags = ${libfuzzer} \
$(top_builddir)/src/libstrongswan/.libs/libstrongswan.a \
-Wl,-Bstatic -lcrypto -Wl,-Bdynamic \
@FUZZING_LDFLAGS@
if USE_OPENSSL
fuzz_ldflags += -Wl,-Bstatic -lcrypto -Wl,-Bdynamic
endif
if USE_GMP
fuzz_ldflags += -Wl,-Bstatic -lgmp -Wl,-Bdynamic
endif
pa_tnc_ldflags = \
$(top_builddir)/src/libimcv/.libs/libimcv.a \
$(top_builddir)/src/libtncif/.libs/libtncif.a \
@@ -32,27 +44,45 @@ ike_ldflags = \
$(top_builddir)/src/libradius/.libs/libradius.a \
$(fuzz_ldflags)
FUZZ_TARGETS=fuzz_certs fuzz_crls fuzz_ocsp_req fuzz_ocsp_rsp \
fuzz_ids fuzz_pa_tnc fuzz_pb_tnc fuzz_ike
# fuzzers that use crypto plugins in a significant way
fuzzers_with_plugins = \
fuzz_certs fuzz_crls fuzz_ocsp_req fuzz_ocsp_rsp
all-local: $(FUZZ_TARGETS)
fuzzers_with_def = $(fuzzers_with_plugins:%=%_def)
fuzzers_with_cus = $(fuzzers_with_plugins:%=%_cus)
CLEANFILES=$(FUZZ_TARGETS)
fuzzers_no_plugins = \
fuzz_ids fuzz_ike fuzz_pa_tnc fuzz_pb_tnc
fuzz_certs: fuzz_certs.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
ALL_FUZZERS=$(fuzzers_with_def) $(fuzzers_with_cus) $(fuzzers_no_plugins)
fuzz_crls: fuzz_crls.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
all-local: $(ALL_FUZZERS)
fuzz_ocsp_req: fuzz_ocsp_req.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
CLEANFILES=$(ALL_FUZZERS)
fuzz_ocsp_rsp: fuzz_ocsp_rsp.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_certs_def: fuzz_certs.c ${libfuzzer}
$(CC) $(fuzz_cppflags_def) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ids: fuzz_ids.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_certs_cus: fuzz_certs.c ${libfuzzer}
$(CC) $(fuzz_cppflags_cus) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_crls_def: fuzz_crls.c ${libfuzzer}
$(CC) $(fuzz_cppflags_def) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_crls_cus: fuzz_crls.c ${libfuzzer}
$(CC) $(fuzz_cppflags_cus) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ocsp_req_def: fuzz_ocsp_req.c ${libfuzzer}
$(CC) $(fuzz_cppflags_def) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ocsp_req_cus: fuzz_ocsp_req.c ${libfuzzer}
$(CC) $(fuzz_cppflags_cus) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ocsp_rsp_def: fuzz_ocsp_rsp.c ${libfuzzer}
$(CC) $(fuzz_cppflags_def) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ocsp_rsp_cus: fuzz_ocsp_rsp.c ${libfuzzer}
$(CC) $(fuzz_cppflags_cus) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_pa_tnc: fuzz_pa_tnc.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(pa_tnc_ldflags)
@@ -60,6 +90,9 @@ fuzz_pa_tnc: fuzz_pa_tnc.c ${libfuzzer}
fuzz_pb_tnc: fuzz_pb_tnc.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(pb_tnc_ldflags)
fuzz_ids: fuzz_ids.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ike: fuzz_ike.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(ike_ldflags)
@@ -68,8 +101,11 @@ libFuzzerLocal_a_SOURCES = libFuzzerLocal.c
libFuzzerLocal_a_LIBADD = $(top_builddir)/src/libstrongswan/libstrongswan.la
check: all
for f in $(FUZZ_TARGETS); do \
$(TESTS_ENVIRONMENT) \
for f in $(ALL_FUZZERS); do \
corpus=$${f#fuzz_}; \
corpus=$${corpus%_def}; \
corpus=$${corpus%_cus}; \
initial=$(FUZZING_CORPORA)/$${corpus}; \
crashes=$${initial}-crash; \
test ! -d $${initial} || ./$$f $${initial}/* || exit 1; \
fuzz/fuzz_pa_tnc.c
+1 -6
View File
@@ -31,12 +31,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
dbg_default_set_level(-1);
library_init(NULL, "fuzz_pa_tnc");
plugin_loader_add_plugindirs(PLUGINDIR, PLUGINS);
if (!lib->plugins->load(lib->plugins, PLUGINS))
{
return 1;
}
libimcv_init(FALSE);
chunk = chunk_create((u_char*)buf, len);
/* Parse incoming PA-TNC message */
@@ -68,7 +64,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
msg->destroy(msg);
libimcv_deinit();
lib->plugins->unload(lib->plugins);
library_deinit();
return 0;
}
fuzz/fuzz_pb_tnc.c
+1 -7
View File
@@ -20,7 +20,6 @@
#include <state_machine/pb_tnc_state_machine.h>
#include <utils/debug.h>
int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
{
pb_tnc_batch_t *batch;
@@ -33,11 +32,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
dbg_default_set_level(-1);
library_init(NULL, "fuzz_pb_tnc");
plugin_loader_add_plugindirs(PLUGINDIR, PLUGINS);
if (!lib->plugins->load(lib->plugins, PLUGINS))
{
return 1;
}
chunk = chunk_create((u_char*)buf, len);
INIT(state,
@@ -73,7 +68,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
batch->destroy(batch);
free(state);
lib->plugins->unload(lib->plugins);
library_deinit();
return 0;
}