Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(181)

Side by Side Diff: testing/libfuzzer/fuzzers/libsrtp_fuzzer.cc

Issue 2464883004: Revert "Upgrade libsrtp to version 2.0" (Closed)
Patch Set: Created 4 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « DEPS ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2016 The Chromium Authors. All rights reserved. 1 // Copyright 2016 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <assert.h> 5 #include <assert.h>
6 #include <stddef.h> 6 #include <stddef.h>
7 #include <stdint.h> 7 #include <stdint.h>
8 8
9 #include <algorithm> 9 #include <algorithm>
10 #include <vector> 10 #include <vector>
11 11
12 #include "third_party/libsrtp/include/rtp.h" 12 #include "third_party/libsrtp/srtp/include/rtp.h"
13 #include "third_party/libsrtp/include/rtp_priv.h" 13 #include "third_party/libsrtp/srtp/include/rtp_priv.h"
14 #include "third_party/libsrtp/include/srtp.h" 14 #include "third_party/libsrtp/srtp/include/srtp.h"
15 15
16 // TODO(katrielc) Also test the authenticated path, which is what 16 // TODO(katrielc) Also test the authenticated path, which is what
17 // WebRTC uses. This is nontrivial because you need to bypass the MAC 17 // WebRTC uses. This is nontrivial because you need to bypass the MAC
18 // check. Two options: add a UNSAFE_FUZZER_MODE flag to libsrtp (or 18 // check. Two options: add a UNSAFE_FUZZER_MODE flag to libsrtp (or
19 // the chromium fork of it), or compute the HMAC of whatever gibberish 19 // the chromium fork of it), or compute the HMAC of whatever gibberish
20 // the fuzzer produces and write it into the packet manually. 20 // the fuzzer produces and write it into the packet manually.
21 21
22 namespace LibSrtpFuzzer { 22 namespace LibSrtpFuzzer {
23 enum CryptoPolicy { 23 enum CryptoPolicy {
24 NONE, 24 NONE,
25 LIKE_WEBRTC, 25 LIKE_WEBRTC,
26 LIKE_WEBRTC_WITHOUT_AUTH, 26 LIKE_WEBRTC_WITHOUT_AUTH,
27 AES_GCM, 27 AES_GCM,
28 NUMBER_OF_POLICIES, 28 NUMBER_OF_POLICIES,
29 }; 29 };
30 } 30 }
31 31
32 struct Environment { 32 struct Environment {
33 srtp_policy_t GetCryptoPolicy(LibSrtpFuzzer::CryptoPolicy crypto_policy, 33 srtp_policy_t GetCryptoPolicy(LibSrtpFuzzer::CryptoPolicy crypto_policy,
34 const unsigned char* replacement_key) { 34 const unsigned char* replacement_key) {
35 switch (crypto_policy) { 35 switch (crypto_policy) {
36 case LibSrtpFuzzer::NUMBER_OF_POLICIES: 36 case LibSrtpFuzzer::NUMBER_OF_POLICIES:
37 case LibSrtpFuzzer::NONE: 37 case LibSrtpFuzzer::NONE:
38 srtp_crypto_policy_set_null_cipher_null_auth(&policy.rtp); 38 crypto_policy_set_null_cipher_null_auth(&policy.rtp);
39 srtp_crypto_policy_set_null_cipher_null_auth(&policy.rtcp); 39 crypto_policy_set_null_cipher_null_auth(&policy.rtcp);
40 break; 40 break;
41 case LibSrtpFuzzer::LIKE_WEBRTC: 41 case LibSrtpFuzzer::LIKE_WEBRTC:
42 srtp_crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtp); 42 crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtp);
43 srtp_crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtcp); 43 crypto_policy_set_aes_cm_128_hmac_sha1_80(&policy.rtcp);
44 break;
45 case LibSrtpFuzzer::LIKE_WEBRTC_WITHOUT_AUTH: 44 case LibSrtpFuzzer::LIKE_WEBRTC_WITHOUT_AUTH:
46 srtp_crypto_policy_set_aes_cm_128_null_auth(&policy.rtp); 45 crypto_policy_set_aes_cm_128_null_auth(&policy.rtp);
47 srtp_crypto_policy_set_aes_cm_128_null_auth(&policy.rtcp); 46 crypto_policy_set_aes_cm_128_null_auth(&policy.rtcp);
48 break; 47 break;
49 case LibSrtpFuzzer::AES_GCM: 48 case LibSrtpFuzzer::AES_GCM:
50 // There was a security bug in the GCM mode in libsrtp 1.5.2. 49 // There was a security bug in the GCM mode in libsrtp 1.5.2.
51 srtp_crypto_policy_set_aes_gcm_128_8_auth(&policy.rtp); 50 crypto_policy_set_aes_gcm_128_8_auth(&policy.rtp);
52 srtp_crypto_policy_set_aes_gcm_128_8_auth(&policy.rtcp); 51 crypto_policy_set_aes_gcm_128_8_auth(&policy.rtcp);
53 break; 52 break;
54 } 53 }
55 54
56 memcpy(key, replacement_key, SRTP_MASTER_KEY_LEN); 55 memcpy(key, replacement_key, SRTP_MASTER_KEY_LEN);
57 return policy; 56 return policy;
58 }; 57 };
59 58
60 Environment() { 59 Environment() {
61 srtp_init(); 60 srtp_init();
62 61
63 memset(&policy, 0, sizeof(policy)); 62 memset(&policy, 0, sizeof(policy));
64 policy.allow_repeat_tx = 1; 63 policy.allow_repeat_tx = 1;
65 policy.ekt = nullptr; 64 policy.ekt = nullptr;
66 policy.key = key; 65 policy.key = key;
67 policy.next = nullptr; 66 policy.next = nullptr;
68 policy.ssrc.type = ssrc_any_inbound; 67 policy.ssrc.type = ssrc_any_inbound;
69 policy.ssrc.value = 0xdeadbeef; 68 policy.ssrc.value = 0xdeadbeef;
70 policy.window_size = 1024; 69 policy.window_size = 1024;
71 } 70 }
72 71
73 private: 72 private:
74 srtp_policy_t policy; 73 srtp_policy_t policy;
75 unsigned char key[SRTP_MASTER_KEY_LEN] = {0}; 74 unsigned char key[SRTP_MASTER_KEY_LEN] = {0};
76 75
77 static void srtp_crypto_policy_set_null_cipher_null_auth( 76 static void crypto_policy_set_null_cipher_null_auth(crypto_policy_t* p) {
78 srtp_crypto_policy_t* p) { 77 p->cipher_type = NULL_CIPHER;
79 p->cipher_type = SRTP_NULL_CIPHER;
80 p->cipher_key_len = 0; 78 p->cipher_key_len = 0;
81 p->auth_type = SRTP_NULL_AUTH; 79 p->auth_type = NULL_AUTH;
82 p->auth_key_len = 0; 80 p->auth_key_len = 0;
83 p->auth_tag_len = 0; 81 p->auth_tag_len = 0;
84 p->sec_serv = sec_serv_none; 82 p->sec_serv = sec_serv_none;
85 }; 83 };
86 }; 84 };
87 85
88 size_t ReadLength(const uint8_t* data, size_t size) { 86 size_t ReadLength(const uint8_t* data, size_t size) {
89 // Read one byte of input and interpret it as a length to read from 87 // Read one byte of input and interpret it as a length to read from
90 // data. Don't return more bytes than are available. 88 // data. Don't return more bytes than are available.
91 size_t n = static_cast<size_t>(data[0]); 89 size_t n = static_cast<size_t>(data[0]);
(...skipping 12 matching lines...) Expand all
104 size -= 1; 102 size -= 1;
105 103
106 // Read some more bytes to use as a key. 104 // Read some more bytes to use as a key.
107 if (size <= SRTP_MASTER_KEY_LEN) 105 if (size <= SRTP_MASTER_KEY_LEN)
108 return 0; 106 return 0;
109 srtp_policy_t srtp_policy = env->GetCryptoPolicy(policy, data); 107 srtp_policy_t srtp_policy = env->GetCryptoPolicy(policy, data);
110 data += SRTP_MASTER_KEY_LEN; 108 data += SRTP_MASTER_KEY_LEN;
111 size -= SRTP_MASTER_KEY_LEN; 109 size -= SRTP_MASTER_KEY_LEN;
112 110
113 srtp_t session; 111 srtp_t session;
114 srtp_err_status_t error = srtp_create(&session, &srtp_policy); 112 err_status_t error = srtp_create(&session, &srtp_policy);
115 if (error != srtp_err_status_ok) { 113 assert(error == err_status_ok);
116 assert(false);
117 return 0;
118 }
119 114
120 // Read one byte as a packet length N, then feed the next N bytes 115 // Read one byte as a packet length N, then feed the next N bytes
121 // into srtp_unprotect. Keep going until we run out of data. 116 // into srtp_unprotect. Keep going until we run out of data.
122 size_t packet_size; 117 size_t packet_size;
123 while (size > 0 && (packet_size = ReadLength(data, size)) > 0) { 118 while (size > 0 && (packet_size = ReadLength(data, size)) > 0) {
124 // One byte was used by ReadLength. 119 // One byte was used by ReadLength.
125 data++; 120 data++;
126 size--; 121 size--;
127 122
128 size_t header_size = std::min(sizeof(srtp_hdr_t), packet_size); 123 size_t header_size = std::min(sizeof(srtp_hdr_t), packet_size);
129 size_t body_size = packet_size - header_size; 124 size_t body_size = packet_size - header_size;
130 125
131 // We deliberately do not initialise this struct. MSAN will catch 126 // We deliberately do not initialise this struct. MSAN will catch
132 // usage of the uninitialised memory. 127 // usage of the uninitialised memory.
133 rtp_msg_t message; 128 rtp_msg_t message;
134 memcpy(&message.header, data, header_size); 129 memcpy(&message.header, data, header_size);
135 memcpy(&message.body, data + header_size, body_size); 130 memcpy(&message.body, data + header_size, body_size);
136 131
137 int out_len = static_cast<int>(packet_size); 132 int out_len = static_cast<int>(packet_size);
138 srtp_unprotect(session, &message, &out_len); 133 srtp_unprotect(session, &message, &out_len);
139 134
140 // |packet_size| bytes were used above. 135 // |packet_size| bytes were used above.
141 data += packet_size; 136 data += packet_size;
142 size -= packet_size; 137 size -= packet_size;
143 } 138 }
144 139
145 srtp_dealloc(session); 140 srtp_dealloc(session);
146 return 0; 141 return 0;
147 } 142 }
OLDNEW
« no previous file with comments | « DEPS ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698