Skip to content

Commit

Permalink
fuzz: Provide correct MAC tag to assist v2 transport fuzzing
Browse files Browse the repository at this point in the history
before commit:
121218 REDUCE cov: 1889 ft: 2574 corp: 36/2305b lim: 877 exec/s: 939 rss: 442Mb L: 345/345

after commit:
119632 REDUCE cov: 2692 ft: 3657 corp: 57/8816b lim: 1021 exec/s: 61 rss: 478Mb L: 1000/1013
  • Loading branch information
dhruv committed Nov 8, 2021
1 parent 932c9df commit 2f42113
Showing 1 changed file with 19 additions and 6 deletions.
25 changes: 19 additions & 6 deletions src/test/fuzz/p2p_v2_transport_serialization.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

#include <compat/endian.h>
#include <crypto/chacha_poly_aead.h>
#include <crypto/poly1305.h>
#include <key.h>
#include <net.h>
#include <netmessagemaker.h>
Expand All @@ -14,21 +15,33 @@

FUZZ_TARGET(p2p_v2_transport_serialization)
{
const CPrivKey k1(32, 0);
const CPrivKey k2(32, 0);
const CPrivKey k1(CHACHA20_POLY1305_AEAD_KEY_LEN, 0);
const CPrivKey k2(CHACHA20_POLY1305_AEAD_KEY_LEN, 0);

// Construct deserializer, with a dummy NodeId
V2TransportDeserializer deserializer{(NodeId)0, k1, k2};
V2TransportSerializer serializer{k1, k2};
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};

bool length_assist = fuzzed_data_provider.ConsumeBool();
bool mac_assist = fuzzed_data_provider.ConsumeBool();
auto payload_bytes = fuzzed_data_provider.ConsumeRemainingBytes<uint8_t>();

if (length_assist && payload_bytes.size() >= CHACHA20_POLY1305_AEAD_AAD_LEN + CHACHA20_POLY1305_AEAD_TAG_LEN) {
uint32_t packet_length = payload_bytes.size() - CHACHA20_POLY1305_AEAD_AAD_LEN - CHACHA20_POLY1305_AEAD_TAG_LEN;
packet_length = htole32(packet_length);
memcpy(payload_bytes.data(), &packet_length, 3);
if (payload_bytes.size() >= CHACHA20_POLY1305_AEAD_AAD_LEN + CHACHA20_POLY1305_AEAD_TAG_LEN) {
if (length_assist) {
uint32_t packet_length = payload_bytes.size() - CHACHA20_POLY1305_AEAD_AAD_LEN - CHACHA20_POLY1305_AEAD_TAG_LEN;
packet_length = htole32(packet_length);
memcpy(payload_bytes.data(), &packet_length, 3);
}

if (mac_assist) {
unsigned char pseudorandom_bytes[CHACHA20_POLY1305_AEAD_AAD_LEN + POLY1305_KEYLEN];
memset(pseudorandom_bytes, 0, sizeof(pseudorandom_bytes));
ChaCha20Forward4064 chacha{k1.data(), CHACHA20_POLY1305_AEAD_KEY_LEN};
chacha.Crypt(pseudorandom_bytes, pseudorandom_bytes, CHACHA20_POLY1305_AEAD_AAD_LEN + POLY1305_KEYLEN);

poly1305_auth(payload_bytes.data() + (payload_bytes.size() - POLY1305_TAGLEN), payload_bytes.data(), (payload_bytes.size() - POLY1305_TAGLEN), pseudorandom_bytes + CHACHA20_POLY1305_AEAD_AAD_LEN);
}
}

Span<const uint8_t> msg_bytes{payload_bytes};
Expand Down

0 comments on commit 2f42113

Please sign in to comment.