aboutsummaryrefslogtreecommitdiff
path: root/fuzz
AgeCommit message (Collapse)AuthorFilesLines
2023-12-11Fuzz more extension parsers in the cert parserDavid Benjamin1-9/+41
If we're going to rewrite the parsers later, let's cover them more thoroughly. Change-Id: Iab4bbb886da5e42caf4a6eff77cfedca8a33f085 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64629 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com> Auto-Submit: David Benjamin <davidben@google.com>
2023-11-30Merge <openssl/x509v3.h> into <openssl/x509.h>David Benjamin1-1/+0
Change-Id: I53147d1f96d1f99909f5c8bda00cefb088677a0e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64138 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2023-11-30Merge crypto/x509v3 into crypto/x509David Benjamin1-1/+1
The public headers are not yet merged. That will be doen in the subsequent CL. This required teaching make_errors.go that x509v3 are found elsewhere, also to skip irrelevant OPENSSL_DECLARE_ERROR_REASON calls. Change-Id: Ic40de51f9a5325acd60262c614924dc3407b800c Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64137 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com>
2023-11-21Remove the _BORINGSSL_LIBPKI_ definesDavid Benjamin1-2/+1
Now that this is the source of truth, this isn't really doing anything. Update-Note: _BORINGSSL_LIBPKI_ in build files can be removed. Bug: 658 Change-Id: I6daacf692bf4bf51d9822d1b91237625b83d7849 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64027 Auto-Submit: David Benjamin <davidben@google.com> Commit-Queue: Bob Beck <bbe@google.com> Reviewed-by: Bob Beck <bbe@google.com>
2023-09-08Sync pki to chromium ce4bc9571462aa298d79b591df9d997323cf5157Bob Beck4-0/+29
Bug: chromium:1322914 Change-Id: Ic5a1349013bcfb279e5fee9f9838c63558d663b7 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/63025 Auto-Submit: Bob Beck <bbe@google.com> Commit-Queue: Bob Beck <bbe@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2023-08-17Sync pki to chromium d740199e083b70d13506973c6f479f0b01165a05Bob Beck1-2/+3
This also removes fillins/check.h which is no longer needed. Crbug: 1322914 Change-Id: If5e8355700472bf6703c80809ea276c4c07ddc52 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/62485 Auto-Submit: Bob Beck <bbe@google.com> Commit-Queue: Bob Beck <bbe@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2023-08-17Move the fuzzers into the fuzz directory and make them build.Bob Beck165-1/+349
Change-Id: I9346a4bf48d756da254dc27842cd645a3a69f847 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/62045 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2023-07-25Restore fuzz/session_corpusDavid Benjamin20-0/+0
https://boringssl-review.googlesource.com/c/boringssl/+/61765 seems to have emptied the directory altogether. I'm not sure what happened there, but put it back to unbreak the Chromium roll. Change-Id: Ic9980cfe7e417a0955826f96470f2cc335b3dff3 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/61985 Auto-Submit: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: Bob Beck <bbe@google.com>
2023-07-20Make the parse_certificate_fuzzer from libpki work inside boring.Bob Beck2576-5422/+52
Seed the corpus from cert_corpus. As part of that, check in the result of minimizing all the corpora. Note this is just making one of the fuzzers build, I'll adapt the others and follow on by updating the IMPORT process to do it in a follow on cl. Bug: chromium:1322914 Change-Id: Iea1b89f8fee938fa99c0a4d8134bcd0e7023d149 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/61765 Commit-Queue: Bob Beck <bbe@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2023-05-31Align NIDs vs group IDs in TLS group APIsDavid Benjamin1-0/+7
Right now we use NIDs to configure the group list, but group IDs (the TLS codepoints) to return the negotiated group. The NIDs come from OpenSSL, while the group ID was original our API. OpenSSL has since added SSL_get_negotiated_group, but we don't implement it. To add Kyber to QUIC, we'll need to add an API for configuring groups to QUICHE. Carrying over our inconsistency into QUICHE's public API would be unfortunate, so let's use this as the time to align things. We could either align with OpenSSL and say NIDs are now the group representation at the public API, or we could add a parallel group ID API. (Or we could make a whole new SSL_NAMED_GROUP object to pattern after SSL_CIPHER, which isn't wrong, but is even more new APIs.) Aligning with OpenSSL would be fewer APIs, but NIDs aren't a great representation. The numbers are ad-hoc and even diverge a bit between OpenSSL and BoringSSL. The TLS codepoints are better to export out to callers. Also QUICHE has exported the negotiated group using the codepoints, so the natural solution would be to use codepoints on input too. Thus, this CL adds SSL_CTX_set1_group_ids and SSL_set1_group_ids. It also rearranges the API docs slightly to put the group ID ones first, and leaves a little note about the NID representation before introducing those. While I'm here, I've added SSL_get_negotiated_group. NGINX seems to use it when available, so we may as well fill in that unnecessary compatibility hole. Bug: chromium:1442377 Change-Id: I47ca8ae52c274133f28da9893aed7fc70f942bf8 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/60208 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2023-05-31Align on using the "group" over "curve" for ECDH in TLSDavid Benjamin1-6/+6
We're this awkward mix of "group" and "curve" right now. On the spec side, this is because they used to be "curves", but then RFC 7919 renamed to "group" in an attempt to generalize FFDH and ECDH. The negotiated FFDH stuff never really went anywhere (the way it used cipher suite values in TLS 1.2 made it unusable), but the name change stuck. In our implementation and API, we originally called it "curve". In preparation for TLS 1.3, we renamed the internals to "group" to match the spec in https://boringssl-review.googlesource.com/c/boringssl/+/7955, but the public API was still "curve". Then we exported a few more things in https://boringssl-review.googlesource.com/c/boringssl/+/8565, but I left it at "curve" to keep the public API self-consistent. Then we added OpenSSL's new "group" APIs in https://boringssl-review.googlesource.com/c/boringssl/+/54306, but didn't go as far to deprecate the old ones yet. Now I'd like to add new APIs to clear up the weird mix of TLS codepoints and NIDs that appear in our APIs. But our naming is a mess, so either choice of "group" or "curve" for the new API looks weird. In hindsight, we probably should have left it at "curve". Both terms are equally useless for the future post-quantum KEMs, but at least "curve" is more unique of a name than "group". But at this point, I think we're too far through the "group" rename to really backtrack: - Chromium says "group" in its internals - QUICHE says "group" in its internals and public API - Our internals say "group" - OpenSSL has switched to "group" and deprecated "curve", so new APIs will be based on "group" So align with all this and say "group". This CL handles set1_curves and set1_curves_list APIs, which already have "group" replacements from OpenSSL. A follow-up CL will handle our APIs. This is a soft deprecation because I don't think updating things is particularly worth the churn, but get the old names out of the way, so new code can have a simpler API to target. Also rewrite the documentation for that section accordingly. I don't think we need to talk about how it's always enabled now. That's a reference to some very, very old OpenSSL behavior where ECDH negotiation needed to be separately enabled. Change-Id: I7a356793d36419fc668364c912ca7b4f5c6c23a2 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/60206 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: Bob Beck <bbe@google.com>
2023-05-12Cap the input size to the conf fuzzerDavid Benjamin1-0/+7
Trying to fix all the places where these formats go quadratic isn't a good use of time. We've already documented that they're not safe for use with untrusted inputs. Even without such DoS issues, they cannot be safely used anyway. (E.g. RUSTSEC-2023-0023.) Just cap the fuzzer input. It'd be nice if we could avoid this more systematically in the function, but they're not structured to make this easy to do, and anyone concerned about DoS in this function has worse problems. Bug: chromium:1444420, oss-fuzz:56048, 611 Change-Id: I53eeb346f59278ec2db3aac4a92573b927ed8003 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/59785 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com> Auto-Submit: David Benjamin <davidben@google.com>
2023-02-23Require getauxval on 32-bit Arm LinuxDavid Benjamin1-1/+0
We used to have a tower of fallbacks to support older Androids that were missing getauxval. The comments say getauxval is available in Android API level 20 or higher, but this wasn't right. It's actually API level 18 or higher per the NDK headers and https://developer.android.com/ndk/guides/cpu-features Android API level 18 is Android 4.3, or Jelly Bean MR2. Recent versions of the NDK (starting r24, March 2022) don't even support Jelly Bean, i.e. the minimum API level is 19, and the usage statistics in the latest Android Studio stop at KitKat. As far as I know, nothing needs us to support API levels 17 and below anymore. Update-Note: BoringSSL now requires API level 18 or later. Projects needing to support API level of 17 or below will fail to build due to the use of getauxval. If any such projects exist, please contact BoringSSL maintainers. Change-Id: Iedc4836ffd701428ab6d11253d4ebd5a9121e667 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/57506 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2023-02-14Remove global_target from build.David Benjamin1-1/+0
This was added with the generated symbol-prefixing header. But it seems to be sufficient for crypto to have a dependency on the generated header, along with some of the stray bits of delocate. It's a little unclear from CMake documentation how these are processed; normally .o files can be built before libraries are built or linked, only the link step depends on. But, empirically, if A links B, and B has a dependency on C, then CMake seems to run C before building any of A. I tested this by making a small project where the generation step slept for three seconds and running with enough parallelism that we'd have tripped. Interestingly, in the Makefile output, the individual object file targets didn't have that dependency, but the target itself did. But this was true on both A and B, so I think that just might not work. Also fix the dependency in the custom target. The old formulation broke when using an absolute path to the symbols file. Change-Id: I2053d44949f907d465da403a5ec69c191740268f Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/56928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com>
2023-02-14Specify -Iinclude with the crypto target.David Benjamin1-4/+1
It's unclear to me whether doing it target-by-target is an improvement in crypto/fipsmodule, but this otherwise does seem a bit tidier. This aligns with CMake's documentation and "modern CMake" which prefers this pattern. Change-Id: I36c81842bff8b36eeaaf5dd3e0695fb45f3376c9 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/56585 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com>
2023-02-01Remove the last of the broken NEON workaroundDavid Benjamin1-1/+0
All evidence we have points to these devices no longer existing (or at least no longer taking updates) for years. I've kept CRYPTO_has_broken_NEON around for now as there are some older copies of the Chromium measurement code around, but now the function always returns zero. Change-Id: Ib76b68e347749d03611d00caecb6b8b1fdbb37b1 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/56765 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> Auto-Submit: David Benjamin <davidben@google.com>
2023-01-30Add a fuzzer for the config file machinery.David Benjamin150-10/+8965
This fuzzes the config file parser, and the converrsion to X.509 extensions. The initial corpus was computed by: 1. Import every file from OpenSSL 1.1.1 that ends in .cnf. 2. For each section in each such file, add a copy with that section copied to the top (the "default") section. 3. Also add a file for each unit test. 4. Minimize the corpus. While I'm here, sort the targets in fuzz/CMakeLists.txt. Change-Id: I0cfc1ae8e2be3e67dae361605ad19833aec3fe4d Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/56167 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2022-12-21Fuzz x509v3_cache_extensions.David Benjamin1-0/+5
X509 objects do some deferred parsing. Make sure we cover that code with fuzzers. Change-Id: I618e90aaf4d8decbc3af59f36910feb9949a8cd2 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/55751 Auto-Submit: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com>
2022-11-14Define CBS/CBB tags as uint32_t with a typedef.David Benjamin1-1/+1
We use unsigned, but we actually assume it is 32-bit for the bit-packing strategy. But also introduce a typedef to hint that callers shouldn't treat it as an arbitrary 32-bit integer. A typedef would also allow us to extend to uint64_t in the future, if we ever need to. Update-Note: Some APIs switch from unsigned * to uint32_t * out pointers. This is only source-compatible if unsigned and uint32_t are the exact same type. The CQ suggests this is indeed true. If they are not, replace unsigned with CBS_ASN1_TAG to fix the build. Bug: 525 Change-Id: I45cbe127c1aa252f5f6a169dca2e44d1e6e1d669 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/54986 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2022-06-02Add a fuzzer to check CBS is a DER parser.David Benjamin81-0/+87
ECDSA_verify does a runtime check that our parser round-trips, but that should already be true. Add a fuzzer to ensure it. Change-Id: I396863b8f9ed66c6296cfb16f7197a63ae99e156 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/52733 Reviewed-by: Adam Langley <agl@google.com>
2022-01-05Rename CPU feature files with underscores.David Benjamin1-1/+1
We use underscores everywhere except these files, which use hyphens. Switch them to be consistent. Change-Id: I67eddbdae7caaf8405bdb4a0c1b65e6f3ca43916 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/50808 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2021-09-14Refresh fuzzer corpus for ECH draft-13.David Benjamin709-0/+0
Bug: 275 Change-Id: I3a89bd31b6198c9cb2e40835219fa9f248a69c9b Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/49446 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com>
2021-08-25Merge in OpenSSL's X.509 corpus.David Benjamin454-0/+0
Ran the following command at OpenSSL commit 18622c7625436d7f99c0f51895c4d3cea233c62e: ./build-fuzz/fuzz/cert -merge=1 -max_len=10000 fuzz/cert_corpus/ ~/openssl/fuzz/corpora/x509 Change-Id: I22c4051351138736a0fa0202c0977ca9afc6924c Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/49047 Reviewed-by: Adam Langley <agl@google.com>
2021-08-25Run X509_print in the certificate fuzzer.David Benjamin1-0/+4
Given the error handling issues in the previous CL, we'll probably be chasing down bugs in there for a while. Change-Id: I7a219e0fe2496f602d38b4bd0fcd5585ebd72cb7 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/49046 Reviewed-by: Adam Langley <agl@google.com>
2021-06-11Make ECH server APIs take EVP_HPKE_KEY.David Benjamin1-4/+10
Previously we would extract the KEM ID from the ECHConfig and then parse the private key using the corresponding KEM type. This CL makes it take a pre-pared EVP_HPKE_KEY and checks it matches. This does require the caller pass the key type through externally, which is probably prudent? (On the other hand we are still inferring config from the rest of the ECHConfig... maybe we can add an API to extract the EVP_HPKE_KEM from a serialized ECHConfig if it becomes a problem. I could see runner or tool wanting that out of convenience.) The immediate motivation is to add APIs to programmatically construct ECHConfigs. I'm thinking we can pass a const EVP_HPKE_KEY * to specify the key, at which point it's weird for SSL_ECH_KEYS_add to look different. Bug: 275 Change-Id: I2d424323885103d3fe0a99a9012c160baa8653bd Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/48002 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2021-06-10Rename SSL_ECH_SERVER_CONFIG_LIST to SSL_ECH_KEYS.David Benjamin1-8/+6
The old name was really long and a bit tedious to type out. Bug: 275 Change-Id: Ie24ef811f9288e619148a2bed36ca34b67af0a3a Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/48001 Reviewed-by: Adam Langley <agl@google.com>
2021-05-24Refresh SSL corpora after adding ECH fuzzer mode.Dan McArdle967-0/+0
(cd build_Fuzzer ; cmake -DFUZZ=1 -GNinja .. ; autoninja) (cd build_NoFuzzer ; cmake -DFUZZ=1 -DNO_FUZZER_MODE=1 -GNinja .. ; autoninja) (cd fuzz ; ./refresh_ssl_corpora.sh ../build_Fuzzer ../build_NoFuzzer) Bug: 275 Change-Id: If47c323d07414da290bc492eda41bebc972c01af Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/47724 Reviewed-by: David Benjamin <davidben@google.com>
2021-05-19fuzz/minimise_corpora.sh: Add shebang and chmod +xDan McArdle1-0/+1
The script now matches fuzz/refresh_ssl_corpora.sh. Change-Id: I0089c5091e3e21c5590a73909b05e066fefe4a34 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/47604 Reviewed-by: Adam Langley <agl@google.com>
2021-04-14Record a fuzzing corpus for the ClientHelloInner decoder.David Benjamin21-0/+2
Also generate a corpus to unblock the Chromium roll. The build tools expect there to be a corresponding directory somewhere. Bug: 275 Change-Id: I7a061ba6625ec57c10b0ae17e68b6b0159c539d4 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/46826 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com>
2021-04-14Use a consistent plural for 'corpus'.David Benjamin1-0/+0
'corpora' seems to be more common than 'corpuses' in Chromium code search, including in libFuzzer's source itself. Change-Id: I6489b57a4608f47274c4400aac135cbfb991953a Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/46825 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2021-04-12Add ECH server config API to ssl_ctx_api fuzzerDan McArdle1-0/+19
Bug: 275 Change-Id: I4ccf7e8385d708326c71a855585583908e82bb2d Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/46744 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2021-04-08Add ECH server (draft-ietf-tls-esni-09).Daniel McArdle2-0/+53
This CL adds an initial implementation of the ECH server, with pieces of the client in BoGo as necessary for testing. In particular, the server supports ClientHelloInner compression with ech_outer_extensions. When ECH decryption fails, it can send retry_configs back to the client. This server passes the "ech-accept" and "ech-reject" test cases in tls-interop-runner[0] when tested against both the cloudflare-go and nss clients. For reproducibility, I started with the main branch at commit 707604c262d8bcf3e944ed1d5a675077304732ce and updated the endpoint's script to pass the server's ECHConfig and private key to the boringssl tool. Follow-up CLs will update HPKE to the latest draft and catch us up to draft-10. [0]: https://github.com/xvzcf/tls-interop-runner Bug: 275 Change-Id: I49be35af46d1fd5dd9c62252f07d0bae179381ab Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/45285 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2020-02-06Restore fuzz/cert_corpus.David Benjamin687-0/+39
This was accidentally deleted in https://boringssl-review.googlesource.com/c/boringssl/+/39805 Change-Id: Iba1ee7b03e0e531a4aa86ec6c048523d87bd2c72 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39884 Reviewed-by: Adam Langley <agl@google.com>
2020-02-05Refresh corpora due to TLS 1.3 changes in handoff serialization.Matthew Braithwaite1227-39/+7
Along the way, update |refresh_ssl_corpora.sh| to use the right handshaker path. How to: (rm -rf build-fuzz && mkdir build-fuzz && cd build-fuzz && CC=clang CXX=clang++ cmake -GNinja -DFUZZ=1 .. && ninja all) (rm -rf build-no-fuzzer-mode && mkdir build-no-fuzzer-mode && cd build-no-fuzzer-mode && CC=clang CXX=clang++ cmake -GNinja -DFUZZ=1 -DNO_FUZZER_MODE=1 .. && ninja all) (cd ~/boringssl/fuzz && ../fuzz/refresh_ssl_corpora.sh ../build-fuzz ../build-no-fuzzer-mode ) 2>&1 | tee /tmp/refresh-log Change-Id: I1115dfe45d25bd74ace1048c80d614afb26223ee Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39805 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: Matt Braithwaite <mab@google.com>
2019-10-21Reenable bn_div fuzzer.David Van Cleve1-0/+1
It looks like the bn_div fuzzer was inadvertently removed from fuzz/'s CMakeLists during an earlier refactor [1]. This change adds it back. [1]: https://boringssl-review.googlesource.com/c/boringssl/+/31324/ Change-Id: I8bb4b224eedff60cc5cd6df7fa39d9c39d499a56 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/38424 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2019-09-27Bound the number of API calls in ssl_ctx_api.cc.David Benjamin1-1/+2
By spamming just two bytes, this fuzzer can bounce between SSL_CTX_use_certificate and SSL_CTX_get0_certificate, which continually runs d2i_X509 on some certificate. Doing that nearly 400,000 times is not particularly useful. Bound the number of API calls. Start with 10,000 and see if the fuzzers are still unhappy. Bug: oss-fuzz:17748 Change-Id: I074fa08475fffcb86c02e64dcb9c5c7c69bcda71 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/37765 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-08Refresh fuzzer corpus.David Benjamin823-0/+0
Change-Id: If5239e701f4e0a01758e17e58ede1ef6c00293b2 Reviewed-on: https://boringssl-review.googlesource.com/c/34204 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com>
2019-01-07Update tools.David Benjamin1-1/+6
Unfortunately, this requires partially reverting https://boringssl-review.googlesource.com/31324. This is a mess. While clang proper includes a fuzzer driver, Chromium doesn't use it. Chromium builds exclusively with fuzzer-no-link and links to its own copy of the fuzzer runtime[1]. As of [2], Chromium's clang (which we use on bots) no longer includes the driver, so we must mimic them. However, Chromium's setup is somewhat questionable because fuzzer-no-link pulls in libclang_rt.fuzzer_no_main which still includes most of libclang_rt.fuzzer, just not the one main function[3]. It appears Chromium is actually linking two copies of libclang_rt.fuzzer_no_main. Hopefully this mostly works out as Chromium's clang and libFuzzer should be relatively aligned, but it's not a good assumption for our build, which can take other Clangs too. Thus, if you pass -DFUZZ=1 as-is, we will assume you are using a "normal" Clang with all its relevant runtimes intact. If, however, you are using Chromium clang, you must drop the matching libFuzzer where the bots expected it and build with -DLIBFUZZER_FROM_DEPS=1. This involves no changes to the bots because we never actually unwound all the LIBFUZZER_FROM_DEPS bits before. [1] https://cs.chromium.org/chromium/src/testing/libfuzzer/BUILD.gn?rcl=d21c49585f262e851e2984f96f52905782706325&l=14 [2] https://chromium.googlesource.com/chromium/src/+/c79bf2ea4cf65431dccb57cb2a44528c284645a1 [3] https://github.com/llvm-mirror/compiler-rt/blob/8ebc3668b07fc5cca6010265cd4795443f1c1bea/lib/fuzzer/CMakeLists.txt#L93-L107 https://github.com/llvm-mirror/compiler-rt/blob/8ebc3668b07fc5cca6010265cd4795443f1c1bea/lib/fuzzer/FuzzerMain.cpp Change-Id: I946b3c821c3d7e6def7e07f1381f58241611ba3d Reviewed-on: https://boringssl-review.googlesource.com/c/34184 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2018-11-06Refresh fuzzer corpora for changes to split-handshake serialization.Matthew Braithwaite1069-0/+0
Change-Id: I7922b4b26dabb6875e800472ee8453ca4a9922e0 Reviewed-on: https://boringssl-review.googlesource.com/c/32845 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2018-09-06Support symbol prefixesJoshua Liebow-Feeser1-0/+1
- In base.h, if BORINGSSL_PREFIX is defined, include boringssl_prefix_symbols.h - In all .S files, if BORINGSSL_PREFIX is defined, include boringssl_prefix_symbols_asm.h - In base.h, BSSL_NAMESPACE_BEGIN and BSSL_NAMESPACE_END are defined with appropriate values depending on whether BORINGSSL_PREFIX is defined; these macros are used in place of 'namespace bssl {' and '}' - Add util/make_prefix_headers.go, which takes a list of symbols and auto-generates the header files mentioned above - In CMakeLists.txt, if BORINGSSL_PREFIX and BORINGSSL_PREFIX_SYMBOLS are defined, run util/make_prefix_headers.go to generate header files - In various CMakeLists.txt files, add "global_target" that all targets depend on to give us a place to hook logic that must run before all other targets (in particular, the header file generation logic) - Document this in BUILDING.md, including the fact that it is the caller's responsibility to provide the symbol list and keep it up to date - Note that this scheme has not been tested on Windows, and likely does not work on it; Windows support will need to be added in a future commit Change-Id: If66a7157f46b5b66230ef91e15826b910cf979a2 Reviewed-on: https://boringssl-review.googlesource.com/31364 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-09-05Fix corner case in cpuinfo parser.David Benjamin7-0/+167
I realized looking at the sigalgs parser that I messed up the space-splitting logic slightly. If the CPU features are "foo bar baz", it would not parse "baz". This doesn't particular matter (the last one is "crc32"), but better to parse it correctly. Fix this and add a unit test. While I'm here, may as well add a fuzzer too. Change-Id: Ifc1603b8f70d975f391d10e51ede95deec31a83d Reviewed-on: https://boringssl-review.googlesource.com/31464 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-08-27Switch to Clang 6.0's fuzzer support.Adam Langley1-41/+19
With Clang 6.0, libFuzzer is now included and there's a new -fsanitize=fuzzer command to enable the needed compiler actions. Change-Id: If8c0d649f494655c5bb1e55ebdbf39450940c75b Reviewed-on: https://boringssl-review.googlesource.com/31324 Reviewed-by: David Benjamin <davidben@google.com>
2018-08-10Fix SSL_CTX_set1_sigalgs fuzzer and make them all more type-safe.David Benjamin1-43/+48
The size of an int is 4, not 2. To avoid worrying about this, add a GetVector counterpart to GetString that handles all this. Apply this uniformly to avoid all the pointer casts. This is less important for vector<uint8_t>, but even then we'll now notice a 1-byte OOB read since std::string is NUL-terminated. Also it's shorter. Change-Id: Ie96591cb8d8d52742f5fd30d70b6af0511109585 Reviewed-on: https://boringssl-review.googlesource.com/30864 Reviewed-by: Adam Langley <agl@google.com>
2018-08-10Fix SSL_CTX_set1_sigalgs_list fuzzer.David Benjamin1-1/+5
SSL_CTX_set1_sigalgs_list wants a NUL-terminated string, so we need to use GetString to give it one. Bug: oss-fuzz:9808 Change-Id: Id7f676aa514c36de9dea900763db3cbbf5c79a4c Reviewed-on: https://boringssl-review.googlesource.com/30804 Reviewed-by: Adam Langley <agl@google.com>
2018-08-09Support OpenSSL APIs SSL[_CTX]_set1_sigalgs[_list].Adam Langley1-0/+6
These functions can be used to configure the signature algorithms. One of them is a string mini-languaging parsing function, which we generally dislike because it defeats static analysis. However, some dependent projects (in this case TensorFlow) need it and we also dislike making people patch. Change-Id: I13f990c896a7f7332d78b1c351357d418ade8d11 Reviewed-on: https://boringssl-review.googlesource.com/30304 Reviewed-by: Steven Valdez <svaldez@google.com>
2018-07-05Add “bssl::” prefix to |UpRef| and |PushToStack| in fuzzer code.Adam Langley1-1/+1
Change-Id: Ie3ed310869f3068d5be8292448a27679fa91a7a7 Reviewed-on: https://boringssl-review.googlesource.com/29624 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-07-03Add bssl::UpRef.David Benjamin1-3/+1
bssl::UniquePtr and FOO_up_ref do not play well together. Add a helper to simplify this. This allows us to write things like: foo->cert = UpRef(bar->cert); instead of: if (bar->cert) { X509_up_ref(bar->cert.get()); } foo->cert.reset(bar->cert.get()); This also plays well with PushToStack. To append something to a stack while taking a reference, it's just: PushToStack(certs, UpRef(cert)) Change-Id: I99ae8de22b837588a2d8ffb58f86edc1d03ed46a Reviewed-on: https://boringssl-review.googlesource.com/29584 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-05-15Add a PKCS#12 fuzzer.David Benjamin6-111/+57
Change-Id: Iee3a3d46d283bd6cbb46940e630916aacdd71db6 Reviewed-on: https://boringssl-review.googlesource.com/28552 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-05-14Refresh TLS fuzzer corpora.David Benjamin287-0/+0
Change-Id: I2a1db17aa667c98a7de66ff5af5c76e13c5b8976 Reviewed-on: https://boringssl-review.googlesource.com/28504 Reviewed-by: David Benjamin <davidben@google.com>
2018-05-10Refresh TLS fuzzer corpora.Matthew Braithwaite911-0/+0
Change-Id: I3c013d10f0dbd2a46c5e7d62ecff40e6b7e2be8a Reviewed-on: https://boringssl-review.googlesource.com/28144 Reviewed-by: David Benjamin <davidben@google.com>
generated by cgit v1.1 at 2024-06-29 00:39:16 +0000