tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fuzzer for authorized_keys parsing 

mostly redundant to authopt_fuzz, but it's sensitive code so IMO it
makes sense to test this layer too
This commit is contained in:
Damien Miller 2022-05-27 17:00:43 +10:00
parent c83d8c4d6f
commit 9b3ad432ad
2 changed files with 80 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
regress/misc/fuzz-harness/Makefile
View File

@ -11,7 +11,7 @@ LIBS=-lssh -lopenbsd-compat -lmd -lcrypto -lfido2 -lcbor $(FUZZ_LIBS)
SK_NULL_OBJS=ssh-sk-null.o
COMMON_DEPS=../../../libssh.a
TARGETS=pubkey_fuzz sig_fuzz authopt_fuzz sshsig_fuzz \
TARGETS=pubkey_fuzz sig_fuzz authopt_fuzz authkeys_fuzz sshsig_fuzz \
sshsigopt_fuzz privkey_fuzz kex_fuzz agent_fuzz
all: $(TARGETS)
@ -28,6 +28,9 @@ sig_fuzz: sig_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS)
authopt_fuzz: authopt_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS)
$(CXX) -o $@ authopt_fuzz.o $(SK_NULL_OBJS) ../../../auth-options.o $(LDFLAGS) $(LIBS)
authkeys_fuzz: authkeys_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS)
$(CXX) -o $@ authkeys_fuzz.o $(SK_NULL_OBJS) ../../../auth-options.o ../../../auth2-pubkeyfile.o $(LDFLAGS) $(LIBS)
sshsig_fuzz: sshsig_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS)
$(CXX) -o $@ sshsig_fuzz.o $(SK_NULL_OBJS) ../../../sshsig.o $(LDFLAGS) $(LIBS)

76
regress/misc/fuzz-harness/authkeys_fuzz.cc Normal file
View File

@ -0,0 +1,76 @@
#include <stddef.h>
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <stdlib.h>
#include <pwd.h>
#include <unistd.h>
extern "C" {
#include "hostfile.h"
#include "auth.h"
#include "auth-options.h"
#include "sshkey.h"
// testdata/id_ed25519.pub and testdata/id_ed25519-cert.pub
const char *pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMD";
const char *certtext = "ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIMDQjYH6XRzH3j3MW1DdjCoAfvrHfgjnVGF+sLK0pBfqAAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMDAAAAAAAAA+sAAAABAAAAB3VseXNzZXMAAAAXAAAAB3VseXNzZXMAAAAIb2R5c3NldXMAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgM9BeYRUxUuZ4VHJp8oxVaA8OS/z+5EFPCZwQNq1nMwMAAABTAAAAC3NzaC1lZDI1NTE5AAAAQBj0og+s09/HpwdHZbzN0twooKPDWWrxGfnP1Joy6cDnY2BCSQ7zg9vbq11kLF8H/sKOTZWAQrUZ7LlChOu9Ogw= id_ed25519.pub";
// stubs
void auth_debug_add(const char *fmt,...)
{
}
void
auth_log_authopts(const char *loc, const struct sshauthopt *opts, int do_remote)
{
}
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
char *tmp, *o, *cp = (char *)malloc(size + 1 + strlen(pubkey) + 1);
struct sshauthopt *opts = NULL;
struct passwd *pw = getpwuid(getuid());
static struct sshkey *key, *cert;
if (key == NULL) {
if ((key = sshkey_new(KEY_UNSPEC)) == NULL ||
(cert = sshkey_new(KEY_UNSPEC)) == NULL)
abort();
if ((o = tmp = strdup(pubkey)) == NULL ||
sshkey_read(key, &tmp) != 0)
abort();
free(o);
if ((o = tmp = strdup(certtext)) == NULL ||
sshkey_read(cert, &tmp) != 0)
abort();
free(o);
}
if (cp == NULL || pw == NULL || key == NULL || cert == NULL)
abort();
memcpy(cp, data, size);
cp[size] = ' ';
memcpy(cp + size + 1, key, strlen(pubkey) + 1);
// Try key.
if ((tmp = strdup(cp)) == NULL)
abort();
(void) auth_check_authkey_line(pw, key, tmp, "127.0.0.1", "localhost",
"fuzz", &opts);
free(tmp);
sshauthopt_free(opts);
// Try cert.
if ((tmp = strdup(cp)) == NULL)
abort();
(void) auth_check_authkey_line(pw, cert, tmp, "127.0.0.1", "localhost",
"fuzz", &opts);
free(tmp);
sshauthopt_free(opts);
free(cp);
return 0;
}
} // extern "C"