fuzz/fuzz_pb_tnc.c

   1 /*
   2  * Copyright (C) 2018 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <library.h>
  17 #include <batch/pb_tnc_batch.h>
  18 #include <messages/ietf/pb_error_msg.h>
  19 #include <state_machine/pb_tnc_state_machine.h>
  20 #include <utils/debug.h>
  21
  22
  23 int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
  24 {
  25         pb_tnc_batch_t *batch;
  26         pb_tnc_state_machine_t *state;
  27         pb_tnc_msg_t *msg;
  28         pb_error_msg_t *error;
  29         enumerator_t *enumerator;
  30         bool from_server;
  31         chunk_t chunk;
  32
  33         dbg_default_set_level(-1);
  34         library_init(NULL, "fuzz_pb_tnc");
  35         plugin_loader_add_plugindirs(PLUGINDIR, PLUGINS);
  36         if (!lib->plugins->load(lib->plugins, PLUGINS))
  37         {
  38                 return 1;
  39         }
  40         chunk = chunk_create((u_char*)buf, len);
  41
  42         INIT(state,
  43                 .receive_batch = (void*)return_true,
  44                 .set_empty_cdata = (void*)nop,
  45         );
  46
  47         /* parse incoming PB-TNC batch */
  48         batch = pb_tnc_batch_create_from_data(chunk);
  49         if (batch->process_header(batch, TRUE, FALSE, &from_server) == SUCCESS ||
  50                 batch->process_header(batch, TRUE, TRUE, &from_server) == SUCCESS)
  51         {
  52                 batch->process(batch, state);
  53         }
  54
  55         /* enumerate correctly decoded PB-TNC messages */
  56         enumerator = batch->create_msg_enumerator(batch);
  57         while (enumerator->enumerate(enumerator, &msg))
  58         {
  59                 msg->get_type(msg);
  60         }
  61         enumerator->destroy(enumerator);
  62
  63         /* enumerate errors detected while parsing PB-TNC batch and messages */
  64         enumerator = batch->create_error_enumerator(batch);
  65         while (enumerator->enumerate(enumerator, &msg))
  66         {
  67                 error = (pb_error_msg_t*)msg;
  68                 error->get_error_code(error);
  69         }
  70         enumerator->destroy(enumerator);
  71
  72         batch->destroy(batch);
  73
  74         free(state);
  75         lib->plugins->unload(lib->plugins);
  76         library_deinit();
  77         return 0;
  78 }