Skip to content

Commit

Permalink
[Cast] Remove fuzzer assertion
Browse files Browse the repository at this point in the history 
Currently, we assert that the input case is what we expected in the cast
auth util fuzzer, but the fuzzing tool sometimes passes bad inputs on
purpose.

This patch removes the check, simply not fuzzing anything in this case.

Bug: 1214436
Change-Id: I4540fe52d8a2082e08d56ec22b5134fde810496f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2946171
Reviewed-by: mark a. foltz <mfoltz@chromium.org>
Commit-Queue: Jordan Bayles <jophba@chromium.org>
Cr-Commit-Position: refs/heads/master@{#891302}
  • Loading branch information
@baylesj
baylesj authored and Chromium LUCI CQ committed Jun 10, 2021
1 parent bf9a07c commit 1b2949f
Showing 1 changed file with 81 additions and 84 deletions.
165 changes: 81 additions & 84 deletions components/cast_channel/cast_auth_util_fuzzer.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -68,98 +68,95 @@ DEFINE_PROTO_FUZZER(CastAuthUtilInputs& input_union) {
static bool init = InitializeOnce();
CHECK(init);

switch (input_union.input_case()) {
case CastAuthUtilInputs::kAuthenticateChallengeReplyInput: {
auto& input = *input_union.mutable_authenticate_challenge_reply_input();

// If we have a DeviceAuthMessage, use it to override the cast_message()
// payload with a more interesting value.
if (input.has_auth_message()) {
// Optimization: if the payload_binary() field is going to be
// overwritten, insist that it has to be empty initially. This cuts
// down on how much time is spent generating identical arguments for
// AuthenticateChallengeReply() from different values of |input|.
if (input.cast_message().has_payload_binary())
return;
if (input_union.input_case() !=
CastAuthUtilInputs::kAuthenticateChallengeReplyInput) {
return;
}

if (!input.auth_message().has_response()) {
// Optimization.
if (input.nonce_ok() || input.response_certs_ok() ||
input.tbs_crls_size() || input.crl_certs_ok() ||
input.crl_signatures_ok()) {
return;
}
} else {
auto& response = *input.mutable_auth_message()->mutable_response();

// Maybe force the nonce to be the correct value.
if (input.nonce_ok()) {
// Optimization.
if (response.has_sender_nonce())
return;

response.set_sender_nonce(input.nonce());
}

// Maybe force the response certs to be valid.
if (input.response_certs_ok()) {
// Optimization.
if (!response.client_auth_certificate().empty() ||
response.intermediate_certificate_size() > 0)
return;

response.set_client_auth_certificate(certs->front());
response.clear_intermediate_certificate();
for (std::size_t i = 1; i < certs->size(); i++) {
response.add_intermediate_certificate(certs->at(i));
}
}

// Maybe replace the crl() field in the response with valid data.
if (input.tbs_crls_size() == 0) {
// Optimization.
if (input.crl_certs_ok() || input.crl_signatures_ok())
return;
} else {
// Optimization.
if (response.has_crl())
return;

cast::certificate::CrlBundle crl_bundle;
for (const auto& tbs_crl : input.tbs_crls()) {
cast::certificate::Crl& crl = *crl_bundle.add_crls();
if (input.crl_certs_ok())
crl.set_signer_cert(certs->at(0));
if (input.crl_signatures_ok())
crl.set_signature("");
tbs_crl.SerializeToString(crl.mutable_tbs_crl());
}
crl_bundle.SerializeToString(response.mutable_crl());
}
}
auto& input = *input_union.mutable_authenticate_challenge_reply_input();

// If we have a DeviceAuthMessage, use it to override the cast_message()
// payload with a more interesting value.
if (input.has_auth_message()) {
// Optimization: if the payload_binary() field is going to be
// overwritten, insist that it has to be empty initially. This cuts
// down on how much time is spent generating identical arguments for
// AuthenticateChallengeReply() from different values of |input|.
if (input.cast_message().has_payload_binary())
return;

if (!input.auth_message().has_response()) {
// Optimization.
if (input.nonce_ok() || input.response_certs_ok() ||
input.tbs_crls_size() || input.crl_certs_ok() ||
input.crl_signatures_ok()) {
return;
}
} else {
auto& response = *input.mutable_auth_message()->mutable_response();

// Maybe force the nonce to be the correct value.
if (input.nonce_ok()) {
// Optimization.
if (response.has_sender_nonce())
return;

input.mutable_cast_message()->set_payload_type(CastMessage::BINARY);
input.auth_message().SerializeToString(
input.mutable_cast_message()->mutable_payload_binary());
response.set_sender_nonce(input.nonce());
}

// Build a well-formed cert with start and expiry times relative to the
// current time. The actual cert doesn't matter for testing purposes
// because validation failures are ignored.
scoped_refptr<net::X509Certificate> peer_cert =
net::X509Certificate::CreateFromBytes(kCertData,
base::size(kCertData));
UpdateTime(input.start_case(), &peer_cert->valid_start(), -1);
UpdateTime(input.expiry_case(), &peer_cert->valid_expiry(), +1);
// Maybe force the response certs to be valid.
if (input.response_certs_ok()) {
// Optimization.
if (!response.client_auth_certificate().empty() ||
response.intermediate_certificate_size() > 0)
return;

AuthContext context = AuthContext::CreateForTest(input.nonce());
response.set_client_auth_certificate(certs->front());
response.clear_intermediate_certificate();
for (std::size_t i = 1; i < certs->size(); i++) {
response.add_intermediate_certificate(certs->at(i));
}
}

AuthenticateChallengeReply(input.cast_message(), *peer_cert, context);
break;
// Maybe replace the crl() field in the response with valid data.
if (input.tbs_crls_size() == 0) {
// Optimization.
if (input.crl_certs_ok() || input.crl_signatures_ok())
return;
} else {
// Optimization.
if (response.has_crl())
return;

cast::certificate::CrlBundle crl_bundle;
for (const auto& tbs_crl : input.tbs_crls()) {
cast::certificate::Crl& crl = *crl_bundle.add_crls();
if (input.crl_certs_ok())
crl.set_signer_cert(certs->at(0));
if (input.crl_signatures_ok())
crl.set_signature("");
tbs_crl.SerializeToString(crl.mutable_tbs_crl());
}
crl_bundle.SerializeToString(response.mutable_crl());
}
}
default:
NOTREACHED();

input.mutable_cast_message()->set_payload_type(CastMessage::BINARY);
input.auth_message().SerializeToString(
input.mutable_cast_message()->mutable_payload_binary());
}

// Build a well-formed cert with start and expiry times relative to the
// current time. The actual cert doesn't matter for testing purposes
// because validation failures are ignored.
scoped_refptr<net::X509Certificate> peer_cert =
net::X509Certificate::CreateFromBytes(kCertData, base::size(kCertData));
UpdateTime(input.start_case(), &peer_cert->valid_start(), -1);
UpdateTime(input.expiry_case(), &peer_cert->valid_expiry(), +1);

AuthContext context = AuthContext::CreateForTest(input.nonce());

AuthenticateChallengeReply(input.cast_message(), *peer_cert, context);
}

} // namespace
Expand Down

0 comments on commit 1b2949f

Please sign in to comment.