You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
134 lines
2.5 KiB
C
134 lines
2.5 KiB
C
/*
|
|
* EAP-AKA peer fuzzer
|
|
* Copyright (c) 2019, Jouni Malinen <j@w1.fi>
|
|
*
|
|
* This software may be distributed under the terms of the BSD license.
|
|
* See README for more details.
|
|
*/
|
|
|
|
#include "utils/includes.h"
|
|
|
|
#include "utils/common.h"
|
|
#include "eap_peer/eap_methods.h"
|
|
#include "eap_peer/eap_config.h"
|
|
#include "eap_peer/eap_i.h"
|
|
#include "../fuzzer-common.h"
|
|
|
|
int eap_peer_sim_register(void);
|
|
|
|
struct eap_method * registered_eap_method = NULL;
|
|
|
|
|
|
struct eap_method * eap_peer_method_alloc(int version, int vendor,
|
|
enum eap_type method,
|
|
const char *name)
|
|
{
|
|
struct eap_method *eap;
|
|
eap = os_zalloc(sizeof(*eap));
|
|
if (!eap)
|
|
return NULL;
|
|
eap->version = version;
|
|
eap->vendor = vendor;
|
|
eap->method = method;
|
|
eap->name = name;
|
|
return eap;
|
|
}
|
|
|
|
|
|
int eap_peer_method_register(struct eap_method *method)
|
|
{
|
|
registered_eap_method = method;
|
|
return 0;
|
|
}
|
|
|
|
|
|
static struct eap_peer_config eap_aka_config = {
|
|
.identity = (u8 *) "0232010000000000",
|
|
.identity_len = 16,
|
|
.password = (u8 *) "90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
|
|
.password_len = 78,
|
|
};
|
|
|
|
struct eap_peer_config * eap_get_config(struct eap_sm *sm)
|
|
{
|
|
return &eap_aka_config;
|
|
}
|
|
|
|
|
|
const u8 * eap_get_config_identity(struct eap_sm *sm, size_t *len)
|
|
{
|
|
static const char *id = "0232010000000000";
|
|
|
|
*len = os_strlen(id);
|
|
return (const u8 *) id;
|
|
}
|
|
|
|
|
|
const char * eap_get_config_phase1(struct eap_sm *sm)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
|
|
void eap_set_anon_id(struct eap_sm *sm, const u8 *id, size_t len)
|
|
{
|
|
}
|
|
|
|
|
|
void eap_sm_request_identity(struct eap_sm *sm)
|
|
{
|
|
}
|
|
|
|
|
|
void eap_sm_request_sim(struct eap_sm *sm, const char *req)
|
|
{
|
|
}
|
|
|
|
|
|
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
|
|
{
|
|
const u8 *pos, *end;
|
|
struct eap_sm *sm;
|
|
void *priv;
|
|
struct eap_method_ret ret;
|
|
unsigned int count = 0;
|
|
|
|
wpa_fuzzer_set_debug_level();
|
|
|
|
eap_peer_aka_register();
|
|
sm = os_zalloc(sizeof(*sm));
|
|
if (!sm)
|
|
return 0;
|
|
priv = registered_eap_method->init(sm);
|
|
os_memset(&ret, 0, sizeof(ret));
|
|
|
|
pos = data;
|
|
end = pos + size;
|
|
|
|
while (end - pos > 2 && count < 100) {
|
|
u16 flen;
|
|
struct wpabuf *buf, *req;
|
|
|
|
flen = WPA_GET_BE16(pos);
|
|
pos += 2;
|
|
if (end - pos < flen)
|
|
break;
|
|
req = wpabuf_alloc_copy(pos, flen);
|
|
if (!req)
|
|
break;
|
|
wpa_hexdump_buf(MSG_MSGDUMP, "fuzzer - request", req);
|
|
buf = registered_eap_method->process(sm, priv, &ret, req);
|
|
wpa_hexdump_buf(MSG_MSGDUMP, "fuzzer - local response", buf);
|
|
wpabuf_free(req);
|
|
wpabuf_free(buf);
|
|
pos += flen;
|
|
count++;
|
|
}
|
|
|
|
registered_eap_method->deinit(sm, priv);
|
|
os_free(registered_eap_method);
|
|
os_free(sm);
|
|
|
|
return 0;
|
|
}
|