Google Git
Sign in
boringssl/boringssl.git/94b477cea5057d9372984a311aba9276f737f748^!/.
commit
94b477cea5057d9372984a311aba9276f737f748
[log]
author
David Benjamin <davidben@google.com>
Wed Apr 14 13:32:38 2021 -0400
committer
CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
Wed Apr 14 21:26:18 2021 +0000
tree
41b8ed23fdaeac2d282f8fe76ec03c24a45dd497
parent
5545b61a963d175fd6052c18a4dd6ff242ce32f0 [diff]
Record a fuzzing corpus for the ClientHelloInner decoder.

Also generate a corpus to unblock the Chromium roll. The build tools
expect there to be a corresponding directory somewhere.

Bug: 275
Change-Id: I7a061ba6625ec57c10b0ae17e68b6b0159c539d4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/46826
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>

diff --git a/fuzz/decode_client_hello_inner_corpus/1801ac92348bd90de6d206ca01bd373272452e8e b/fuzz/decode_client_hello_inner_corpus/1801ac92348bd90de6d206ca01bd373272452e8e
new file mode 100644
index 0000000..3e0e4fc
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/1801ac92348bd90de6d206ca01bd373272452e8e
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/1bb5c0f4248499b759d8668e2c4efea8479fd1ee b/fuzz/decode_client_hello_inner_corpus/1bb5c0f4248499b759d8668e2c4efea8479fd1ee
new file mode 100644
index 0000000..3feb7f7
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/1bb5c0f4248499b759d8668e2c4efea8479fd1ee
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/236b709b87a1f139b6006661ec14b4dbf74047c9 b/fuzz/decode_client_hello_inner_corpus/236b709b87a1f139b6006661ec14b4dbf74047c9
new file mode 100644
index 0000000..ec4cb85
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/236b709b87a1f139b6006661ec14b4dbf74047c9
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/291b9c64c834a5b3d7f63bfde1a19b0980a002d3 b/fuzz/decode_client_hello_inner_corpus/291b9c64c834a5b3d7f63bfde1a19b0980a002d3
new file mode 100644
index 0000000..a0e32ae
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/291b9c64c834a5b3d7f63bfde1a19b0980a002d3
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/33c11b74f48ec7dc930428805ee06cda2b1239fe b/fuzz/decode_client_hello_inner_corpus/33c11b74f48ec7dc930428805ee06cda2b1239fe
new file mode 100644
index 0000000..83ab46a
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/33c11b74f48ec7dc930428805ee06cda2b1239fe
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/372c6a89144d282135d3a5f78fbadba2f729ae45 b/fuzz/decode_client_hello_inner_corpus/372c6a89144d282135d3a5f78fbadba2f729ae45
new file mode 100644
index 0000000..0572f3c
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/372c6a89144d282135d3a5f78fbadba2f729ae45
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/49831a9bb8cf8d480ee6348efc0348ac4923e7f2 b/fuzz/decode_client_hello_inner_corpus/49831a9bb8cf8d480ee6348efc0348ac4923e7f2
new file mode 100644
index 0000000..c7bdbfa
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/49831a9bb8cf8d480ee6348efc0348ac4923e7f2
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/5150ba3241ea4e68e0edc18852503482fc2b089f b/fuzz/decode_client_hello_inner_corpus/5150ba3241ea4e68e0edc18852503482fc2b089f
new file mode 100644
index 0000000..ef025c3
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/5150ba3241ea4e68e0edc18852503482fc2b089f
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/6e768d7ebcfdf7ef78cd278c9f56cadb5c3aee2a b/fuzz/decode_client_hello_inner_corpus/6e768d7ebcfdf7ef78cd278c9f56cadb5c3aee2a
new file mode 100644
index 0000000..d011946
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/6e768d7ebcfdf7ef78cd278c9f56cadb5c3aee2a
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/6e7e101d38ae565ddda93bcb347ebe1732b8034b b/fuzz/decode_client_hello_inner_corpus/6e7e101d38ae565ddda93bcb347ebe1732b8034b
new file mode 100644
index 0000000..6ae43b6
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/6e7e101d38ae565ddda93bcb347ebe1732b8034b
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/94bb1431a65a63d11179f16b8f4fd149662353ff b/fuzz/decode_client_hello_inner_corpus/94bb1431a65a63d11179f16b8f4fd149662353ff
new file mode 100644
index 0000000..7e6850d
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/94bb1431a65a63d11179f16b8f4fd149662353ff
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/96329c2abe8341f38f48db8c980cd9b1949246f4 b/fuzz/decode_client_hello_inner_corpus/96329c2abe8341f38f48db8c980cd9b1949246f4
new file mode 100644
index 0000000..d9c1769
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/96329c2abe8341f38f48db8c980cd9b1949246f4
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/ae712740a68e8728c14fa97613e42440c937db6e b/fuzz/decode_client_hello_inner_corpus/ae712740a68e8728c14fa97613e42440c937db6e
new file mode 100644
index 0000000..ebb11b6
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/ae712740a68e8728c14fa97613e42440c937db6e
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/c2bb18319c8702195a0acc9a0f2151b35f6357a7 b/fuzz/decode_client_hello_inner_corpus/c2bb18319c8702195a0acc9a0f2151b35f6357a7
new file mode 100644
index 0000000..ccadfa8
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/c2bb18319c8702195a0acc9a0f2151b35f6357a7
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/de2d121cb0614d83d60ab3604aa12a85b53495cd b/fuzz/decode_client_hello_inner_corpus/de2d121cb0614d83d60ab3604aa12a85b53495cd
new file mode 100644
index 0000000..449f856
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/de2d121cb0614d83d60ab3604aa12a85b53495cd
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/e459531b7ab45bd032c1fc12d3f16479b1d2fe7a b/fuzz/decode_client_hello_inner_corpus/e459531b7ab45bd032c1fc12d3f16479b1d2fe7a
new file mode 100644
index 0000000..da0aaaa
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/e459531b7ab45bd032c1fc12d3f16479b1d2fe7a
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/e4a31c4c2a141aad3dd0ebe33cebc2b3394bba6b b/fuzz/decode_client_hello_inner_corpus/e4a31c4c2a141aad3dd0ebe33cebc2b3394bba6b
new file mode 100644
index 0000000..926dcda
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/e4a31c4c2a141aad3dd0ebe33cebc2b3394bba6b
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/eb55f46bb8041e0bdea984692bbc625ce2b3ae61 b/fuzz/decode_client_hello_inner_corpus/eb55f46bb8041e0bdea984692bbc625ce2b3ae61
new file mode 100644
index 0000000..c3a7c21
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/eb55f46bb8041e0bdea984692bbc625ce2b3ae61
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/f4165ec22d360f534a80e5538d206e8ea3e75074 b/fuzz/decode_client_hello_inner_corpus/f4165ec22d360f534a80e5538d206e8ea3e75074
new file mode 100644
index 0000000..3aab11f
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/f4165ec22d360f534a80e5538d206e8ea3e75074
Binary files differ

diff --git a/fuzz/decode_client_hello_inner_corpus/f6d419ff34a20222303aa7b58f0025ca751fc2ad b/fuzz/decode_client_hello_inner_corpus/f6d419ff34a20222303aa7b58f0025ca751fc2ad
new file mode 100644
index 0000000..54b07f0
--- /dev/null
+++ b/fuzz/decode_client_hello_inner_corpus/f6d419ff34a20222303aa7b58f0025ca751fc2ad
Binary files differ

diff --git a/fuzz/refresh_ssl_corpora.sh b/fuzz/refresh_ssl_corpora.sh
index cbc5e87..d2601c2 100755
--- a/fuzz/refresh_ssl_corpora.sh
+++ b/fuzz/refresh_ssl_corpora.sh

@@ -113,6 +113,7 @@
 minimize_corpus "$no_fuzzer_mode_build_dir/fuzz/server" server_corpus_no_fuzzer_mode
 minimize_corpus "$fuzzer_mode_build_dir/fuzz/dtls_client" dtls_client_corpus
 minimize_corpus "$fuzzer_mode_build_dir/fuzz/dtls_server" dtls_server_corpus
+minimize_corpus "$fuzzer_mode_build_dir/fuzz/decode_client_hello_inner" decode_client_hello_inner_corpus
 
 
 # Incorporate the new transcripts.
@@ -123,3 +124,4 @@
 "$no_fuzzer_mode_build_dir/fuzz/server" -max_len=50000 -merge=1 server_corpus_no_fuzzer_mode "${no_fuzzer_mode_transcripts}/tls/server"
 "$fuzzer_mode_build_dir/fuzz/dtls_client" -max_len=50000 -merge=1 dtls_client_corpus "${fuzzer_mode_transcripts}/dtls/client"
 "$fuzzer_mode_build_dir/fuzz/dtls_server" -max_len=50000 -merge=1 dtls_server_corpus "${fuzzer_mode_transcripts}/dtls/server"
+"$fuzzer_mode_build_dir/fuzz/decode_client_hello_inner" -max_len=50000 -merge=1 decode_client_hello_inner_corpus "${fuzzer_mode_transcripts}/decode_client_hello_inner"

diff --git a/ssl/test/runner/common.go b/ssl/test/runner/common.go
index 50d38d1..02a5a62 100644
--- a/ssl/test/runner/common.go
+++ b/ssl/test/runner/common.go

@@ -932,6 +932,11 @@
 	// success.
 	MinimalClientHelloOuter bool
 
+	// RecordClientHelloInner, when non-nil, is called whenever the client
+	// generates an encrypted ClientHello. The byte strings do not include the
+	// ClientHello header.
+	RecordClientHelloInner func(encodedInner, outer []byte) error
+
 	// SwapNPNAndALPN switches the relative order between NPN and ALPN in
 	// both ClientHello and ServerHello.
 	SwapNPNAndALPN bool

diff --git a/ssl/test/runner/handshake_client.go b/ssl/test/runner/handshake_client.go
index 74e9407..93a169b 100644
--- a/ssl/test/runner/handshake_client.go
+++ b/ssl/test/runner/handshake_client.go

@@ -882,7 +882,8 @@
 	aad.addU16LengthPrefixed().addBytes(enc)
 	hello.marshalForOuterAAD(aad.addU24LengthPrefixed())
 
-	payload := hs.echHPKEContext.Seal(innerHello.marshalForEncodedInner(), aad.finish())
+	encodedInner := innerHello.marshalForEncodedInner()
+	payload := hs.echHPKEContext.Seal(encodedInner, aad.finish())
 
 	// Place the ECH extension in the outer CH.
 	hello.clientECH = &clientECH{
@@ -893,6 +894,15 @@
 		payload:  payload,
 	}
 
+	if c.config.Bugs.RecordClientHelloInner != nil {
+		if err := c.config.Bugs.RecordClientHelloInner(encodedInner, hello.marshal()[4:]); err != nil {
+			return err
+		}
+		// ECH is normally the last extension added to |hello|, but, when
+		// OfferSessionInClientHelloOuter is enabled, we may modify it again.
+		hello.raw = nil
+	}
+
 	return nil
 }
 

diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index e076e3c..be934fe 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go

@@ -804,6 +804,21 @@
 					panic("transcripts are out of sync")
 				}
 			}()
+
+			// Record ClientHellos for the decode_client_hello_inner fuzzer.
+			var clientHelloCount int
+			config.Bugs.RecordClientHelloInner = func(encodedInner, outer []byte) error {
+				name := fmt.Sprintf("%s-%d-%d", test.name, num, clientHelloCount)
+				clientHelloCount++
+				dir := filepath.Join(*transcriptDir, "decode_client_hello_inner")
+				if err := os.MkdirAll(dir, 0755); err != nil {
+					return err
+				}
+				bb := newByteBuilder()
+				bb.addU24LengthPrefixed().addBytes(encodedInner)
+				bb.addBytes(outer)
+				return ioutil.WriteFile(filepath.Join(dir, name), bb.finish(), 0644)
+			}
 		}
 
 		if config.Bugs.PacketAdaptor != nil {