aboutsummaryrefslogtreecommitdiff
path: root/fuzz/server.cc
AgeCommit message (Collapse)AuthorFilesLines
2017-09-07Add DTLS fuzzers.David Benjamin1-1/+1
Bug: 124 Change-Id: Iff02be9df2806572e6d3f860b448f598f85778c3 Reviewed-on: https://boringssl-review.googlesource.com/20107 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-09-07Share all of fuzz/{client,server}.cc into fuzzer.h.David Benjamin1-120/+2
There's a lot of duplicated code between the two. This is in preparation for adding two more of these fuzzers, this time for DTLS. Bug: 124 Change-Id: I8ca2a02d599e2c88e30838d04b7cf07d4221aa76 Reviewed-on: https://boringssl-review.googlesource.com/20106 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18Remove internal uses of SSLv23_*.David Benjamin1-1/+1
Change-Id: I69157b5e2527a2f92fc7b4b924a36e3399d043db Reviewed-on: https://boringssl-review.googlesource.com/19444 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-07-05Restore SSLv3 fuzzer coverage.David Benjamin1-0/+1
So long as the code is there, it should be fuzzed. Bug: 104 Change-Id: Iffaa832cc50c2d3c064eb511ba3a133d7f5758f2 Reviewed-on: https://boringssl-review.googlesource.com/17533 Reviewed-by: David Benjamin <davidben@google.com>
2017-07-05Update TLS fuzzer format with prepended settings.David Benjamin1-188/+33
This allows us to fill in holes in our fuzzer coverage, notably client resumption (and thus early data) and server client certificates. The corpora are not refreshed yet. This will be done in upcoming changes. Also add an option for debugging fuzzers. It's very useful to test it on transcripts and make sure that fuzzer mode successfully makes things compatible. Bug: 104 Change-Id: I02f0be4045d1baf68efc9a4157f573df1429575d Reviewed-on: https://boringssl-review.googlesource.com/17531 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-05-10Fix fuzzer build.David Benjamin1-1/+1
I'm going to work on adding these to CI, since we keep breaking it on accident. Change-Id: I9acd4d3fa7b00c4f0cb0f187dae6bb9c51997515 Reviewed-on: https://boringssl-review.googlesource.com/16125 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-11Really remove DHE ciphersuites from TLS.Matthew Braithwaite1-5/+0
This follows up on cedc6f18 by removing support for the -DBORINGSSL_ENABLE_DHE_TLS compile flag, and the code needed to support it. Change-Id: I53b6aa7a0eddd23ace8b770edb2a31b18ba2ce26 Reviewed-on: https://boringssl-review.googlesource.com/14886 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-29Use an actual SCT for fuzzing.David Benjamin1-3/+6
SSL_CTX_set_signed_cert_timestamp_list fails now if its input is not well-formed. Change-Id: I84a4034f66868da11f98bf33e5b7f5c9fc958933 Reviewed-on: https://boringssl-review.googlesource.com/14484 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-29Adding server fuzzer for early data.Steven Valdez1-0/+1
Since any ALPN mismatch and other cause for early data rejection will cause the server to revert to the non-early data path, this is safe to flip on for all the fuzzers. BUG=76 Change-Id: I573740ef8f455915820943d82247fb6bfc37ae41 Reviewed-on: https://boringssl-review.googlesource.com/14465 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-02Remove experimental TLS 1.3 short record header extension.Steven Valdez1-2/+0
Due to middlebox and ecosystem intolerance, short record headers are going to be unsustainable to deploy. BUG=119 Change-Id: I20fee79dd85bff229eafc6aeb72e4f33cac96d82 Reviewed-on: https://boringssl-review.googlesource.com/14044 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-02-22Add new cipherlist-setting APIs that reject nonsense.Matthew Braithwaite1-1/+1
The new APIs are SSL_CTX_set_strict_cipher_list() and SSL_set_strict_cipher_list(). They have two motivations: First, typos in cipher lists can go undetected for a long time, and can have surprising consequences when silently ignored. Second, there is a tendency to use superstition in the construction of cipher lists, for example by "turning off" things that do not actually exist. This leads to the corrosive belief that DEFAULT and ALL ought not to be trusted. This belief is false. Change-Id: I42909b69186e0b4cf45457e5c0bc968f6bbf231a Reviewed-on: https://boringssl-review.googlesource.com/13925 Commit-Queue: Matt Braithwaite <mab@google.com> Reviewed-by: Matt Braithwaite <mab@google.com>
2016-12-22Enable short header negotiation in fuzzers.David Benjamin1-0/+2
Change-Id: Ib777dcc80c7acd6dc1eda1c211b91e5428b83df1 Reviewed-on: https://boringssl-review.googlesource.com/12971 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <alangley@gmail.com>
2016-12-09Remove CECPQ1 (experimental post-quantum key agreement).Matthew Braithwaite1-1/+1
Change-Id: Ie947ab176d10feb709c6e135d5241c6cf605b8e8 Reviewed-on: https://boringssl-review.googlesource.com/12700 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07Add SSL_(CTX_)set_tls_channel_id_enabled.David Benjamin1-1/+1
This allows a consumer to disable Channel ID (for instance, it may be enabled on the SSL_CTX and later disabled on the SSL) without reaching into the SSL struct directly. Deprecate the old APIs in favor of these. BUG=6 Change-Id: I193bf94bc1f537e1a81602a39fc2b9a73f44c73b Reviewed-on: https://boringssl-review.googlesource.com/12623 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-13ERR_clear_error at the end of each fuzzer.David Benjamin1-0/+2
Data allocated in one fuzzer iteration and then freed in the next complicates the leak checker. Avoid this by dropping hidden global state at the end of each run. Change-Id: Ice79704f2754a6b1f40e288df9b97ddd5b3b97d5 Reviewed-on: https://boringssl-review.googlesource.com/11600 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-10-12Fix fuzzer signatures.David Benjamin1-1/+1
They take a const pointer. See http://llvm.org/docs/LibFuzzer.html#building BUG=chromium:655016 Change-Id: Id6c7584c7a875e822b1fbff72163c888d02a9f44 Reviewed-on: https://boringssl-review.googlesource.com/11580 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-22Enable more features in the fuzzers.David Benjamin1-0/+49
Also IWYU the headers. BUG=79 Change-Id: Iafee0444c9979496166885db6ba5009cb597cb4d Reviewed-on: https://boringssl-review.googlesource.com/11225 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-21Start fuzzing the TLS 1.3 code.David Benjamin1-0/+1
Corpus recorded from runner and merged into existing corpus with libFuzzer's -merge flag. BUG=79 Change-Id: I986a50976ffef141b63e31de3a81fdb4ed5c1348 Reviewed-on: https://boringssl-review.googlesource.com/11130 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-04-25Add licenses to fuzz tests.Adam Langley1-0/+14
These source files previously didn't have the ISC license on them. Change-Id: Ic0a2047d23b28d9d7f0a85b2fedb67574bdcab25 Reviewed-on: https://boringssl-review.googlesource.com/7735 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-31Remove inaccurate comments in fuzz/{client,server}.cc.David Benjamin1-1/+0
They now fuzz a lot more than just the initial flow. Change-Id: Ib0b7eb66969442e539a937d7d87f5ba031fcbef3 Reviewed-on: https://boringssl-review.googlesource.com/7610 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-04Enable renegotiation in the client fuzzer and read app data.David Benjamin1-1/+9
As long as the HTTP/1.1 client auth hack forces use to support renego, having it on seems much more useful than having it off for fuzzing purposes. Also read app data to exercise that code and, on the client, trigger renegotiations as needed. Change-Id: I1941ded6ec9bd764abd199d1518420a1075ed1b2 Reviewed-on: https://boringssl-review.googlesource.com/7291 Reviewed-by: Adam Langley <agl@google.com>
2016-03-03Add a deterministic PRNG for fuzzing.David Benjamin1-0/+3
If running the stack through a fuzzer, we would like execution to be completely deterministic. This is gated on a BORINGSSL_UNSAFE_FUZZER_MODE #ifdef. For now, this just uses the zero ChaCha20 key and a global counter. As needed, we can extend this to a thread-local counter and a separate ChaCha20 stream and counter per input length. Change-Id: Ic6c9d8a25e70d68e5dc6804e2c234faf48e51395 Reviewed-on: https://boringssl-review.googlesource.com/7286 Reviewed-by: Adam Langley <agl@google.com>
2015-11-10Add four, basic fuzz tests.Adam Langley1-0/+219
This change adds fuzzing tests for: ∙ Certificate parsing ∙ Private key parsing ∙ ClientHello parsing ∙ Server first flow (ServerHello, Certificate, etc) parsing. Change-Id: I5f53282263eaaff69b1a03c819cca73750433653 Reviewed-on: https://boringssl-review.googlesource.com/6460 Reviewed-by: Adam Langley <agl@google.com>
generated by cgit v1.1 at 2024-09-09 20:27:35 +0000