1/*
2 * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License").  You may not use
5 * this file except in compliance with the License.  You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/*
11 * Test CMP DER parsing.
12 */
13
14#include <openssl/bio.h>
15#include <openssl/cmp.h>
16#include "../crypto/cmp/cmp_local.h"
17#include <openssl/err.h>
18#include "fuzzer.h"
19
20int FuzzerInitialize(int *argc, char ***argv)
21{
22    FuzzerSetRand();
23    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
24    ERR_clear_error();
25    CRYPTO_free_ex_index(0, -1);
26    return 1;
27}
28
29static int num_responses;
30
31static OSSL_CMP_MSG *transfer_cb(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *req)
32{
33    if (num_responses++ > 2)
34        return NULL; /* prevent loops due to repeated pollRep */
35    return OSSL_CMP_MSG_dup((OSSL_CMP_MSG *)
36                            OSSL_CMP_CTX_get_transfer_cb_arg(ctx));
37}
38
39static int print_noop(const char *func, const char *file, int line,
40                      OSSL_CMP_severity level, const char *msg)
41{
42    return 1;
43}
44
45static int allow_unprotected(const OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *rep,
46                             int invalid_protection, int expected_type)
47{
48    return 1;
49}
50
51static void cmp_client_process_response(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
52{
53    X509_NAME *name = X509_NAME_new();
54    ASN1_INTEGER *serial = ASN1_INTEGER_new();
55
56    ctx->unprotectedSend = 1; /* satisfy ossl_cmp_msg_protect() */
57    ctx->disableConfirm = 1; /* check just one response message */
58    ctx->popoMethod = OSSL_CRMF_POPO_NONE; /* satisfy ossl_cmp_certReq_new() */
59    ctx->oldCert = X509_new(); /* satisfy crm_new() and ossl_cmp_rr_new() */
60    if (!OSSL_CMP_CTX_set1_secretValue(ctx, (unsigned char *)"",
61                                       0) /* prevent too unspecific error */
62            || ctx->oldCert == NULL
63            || name == NULL || !X509_set_issuer_name(ctx->oldCert, name)
64            || serial == NULL || !X509_set_serialNumber(ctx->oldCert, serial))
65        goto err;
66
67    (void)OSSL_CMP_CTX_set_transfer_cb(ctx, transfer_cb);
68    (void)OSSL_CMP_CTX_set_transfer_cb_arg(ctx, msg);
69    (void)OSSL_CMP_CTX_set_log_cb(ctx, print_noop);
70    num_responses = 0;
71    switch (msg->body != NULL ? msg->body->type : -1) {
72    case OSSL_CMP_PKIBODY_IP:
73        (void)OSSL_CMP_exec_IR_ses(ctx);
74        break;
75    case OSSL_CMP_PKIBODY_CP:
76        (void)OSSL_CMP_exec_CR_ses(ctx);
77        (void)OSSL_CMP_exec_P10CR_ses(ctx);
78        break;
79    case OSSL_CMP_PKIBODY_KUP:
80        (void)OSSL_CMP_exec_KUR_ses(ctx);
81        break;
82    case OSSL_CMP_PKIBODY_POLLREP:
83        ctx->status = OSSL_CMP_PKISTATUS_waiting;
84        (void)OSSL_CMP_try_certreq(ctx, OSSL_CMP_PKIBODY_CR, NULL, NULL);
85        break;
86    case OSSL_CMP_PKIBODY_RP:
87        (void)OSSL_CMP_exec_RR_ses(ctx);
88        break;
89    case OSSL_CMP_PKIBODY_GENP:
90        sk_OSSL_CMP_ITAV_pop_free(OSSL_CMP_exec_GENM_ses(ctx),
91                                  OSSL_CMP_ITAV_free);
92        break;
93    default:
94        (void)ossl_cmp_msg_check_update(ctx, msg, allow_unprotected, 0);
95        break;
96    }
97 err:
98    X509_NAME_free(name);
99    ASN1_INTEGER_free(serial);
100}
101
102static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
103                                            const OSSL_CMP_MSG *cert_req,
104                                            int certReqId,
105                                            const OSSL_CRMF_MSG *crm,
106                                            const X509_REQ *p10cr,
107                                            X509 **certOut,
108                                            STACK_OF(X509) **chainOut,
109                                            STACK_OF(X509) **caPubs)
110{
111    ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
112    return NULL;
113}
114
115static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
116                                  const OSSL_CMP_MSG *rr,
117                                  const X509_NAME *issuer,
118                                  const ASN1_INTEGER *serial)
119{
120    ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
121    return NULL;
122}
123
124static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
125                        const OSSL_CMP_MSG *genm,
126                        const STACK_OF(OSSL_CMP_ITAV) *in,
127                        STACK_OF(OSSL_CMP_ITAV) **out)
128{
129    ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
130    return 0;
131}
132
133static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
134                          const OSSL_CMP_PKISI *statusInfo,
135                          const ASN1_INTEGER *errorCode,
136                          const OSSL_CMP_PKIFREETEXT *errorDetails)
137{
138    ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
139}
140
141static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
142                            const OSSL_CMP_MSG *certConf, int certReqId,
143                            const ASN1_OCTET_STRING *certHash,
144                            const OSSL_CMP_PKISI *si)
145{
146    ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
147    return 0;
148}
149
150static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
151                           const OSSL_CMP_MSG *pollReq, int certReqId,
152                           OSSL_CMP_MSG **certReq, int64_t *check_after)
153{
154    ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
155    return 0;
156}
157
158int FuzzerTestOneInput(const uint8_t *buf, size_t len)
159{
160    OSSL_CMP_MSG *msg;
161    BIO *in;
162
163    if (len == 0)
164        return 0;
165
166    in = BIO_new(BIO_s_mem());
167    OPENSSL_assert((size_t)BIO_write(in, buf, len) == len);
168    msg = d2i_OSSL_CMP_MSG_bio(in, NULL);
169    if (msg != NULL) {
170        BIO *out = BIO_new(BIO_s_null());
171        OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_SRV_CTX_new(NULL, NULL);
172        OSSL_CMP_CTX *client_ctx = OSSL_CMP_CTX_new(NULL, NULL);
173
174        i2d_OSSL_CMP_MSG_bio(out, msg);
175        ASN1_item_print(out, (ASN1_VALUE *)msg, 4,
176                        ASN1_ITEM_rptr(OSSL_CMP_MSG), NULL);
177        BIO_free(out);
178
179        if (client_ctx != NULL)
180            cmp_client_process_response(client_ctx, msg);
181        if (srv_ctx != NULL
182            && OSSL_CMP_CTX_set_log_cb(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx),
183                                       print_noop)
184            && OSSL_CMP_SRV_CTX_init(srv_ctx, NULL, process_cert_request,
185                                     process_rr, process_genm, process_error,
186                                     process_certConf, process_pollReq))
187            OSSL_CMP_MSG_free(OSSL_CMP_SRV_process_request(srv_ctx, msg));
188
189        OSSL_CMP_CTX_free(client_ctx);
190        OSSL_CMP_SRV_CTX_free(srv_ctx);
191        OSSL_CMP_MSG_free(msg);
192    }
193
194    BIO_free(in);
195    ERR_clear_error();
196
197    return 0;
198}
199
200void FuzzerCleanup(void)
201{
202    FuzzerClearRand();
203}
204