diff options
author | Allen Webb <allenwebb@google.com> | 2018-08-21 12:11:38 -0700 |
---|---|---|
committer | chrome-bot <chrome-bot@chromium.org> | 2018-12-03 12:43:22 -0800 |
commit | a5e1a639e55d1c6382b4d690c6b78f6f85e8fbc9 (patch) | |
tree | 04ea72cd9750bc6b3e792550f7fd9515186a3636 /fuzz/pinweaver_model.h | |
parent | b343c963b38b03df97a1bc57f201e26640c89e47 (diff) | |
download | chrome-ec-a5e1a639e55d1c6382b4d690c6b78f6f85e8fbc9.tar.gz |
cr50_fuzz: Add libprotobuf-mutator support.
This uses protocol buffers to model what actions can be taken with
pinweaver at a higher level of abstraction than the raw requests to
greatly increase the coverage that can be achieved by fuzzing, while
still allowing for invalid inputs to be checked.
BRANCH=none
BUG=chromium:876582
TEST=sudo emerge libprotobuf-mutator &&
make -j buildfuzztests && ./build/host/cr50_fuzz/cr50_fuzz.exe
Change-Id: Ie7ce569650ca06866f277f36eae61df2684de60c
Signed-off-by: Allen Webb <allenwebb@google.com>
Reviewed-on: https://chromium-review.googlesource.com/1184107
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Diffstat (limited to 'fuzz/pinweaver_model.h')
-rw-r--r-- | fuzz/pinweaver_model.h | 123 |
1 files changed, 123 insertions, 0 deletions
diff --git a/fuzz/pinweaver_model.h b/fuzz/pinweaver_model.h new file mode 100644 index 0000000000..84508786f3 --- /dev/null +++ b/fuzz/pinweaver_model.h @@ -0,0 +1,123 @@ +// Copyright 2018 The Chromium OS Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Pinweaver specific model to facilitate fuzzing. + +#ifndef __FUZZ_PINWEAVER_MODEL_H +#define __FUZZ_PINWEAVER_MODEL_H + +#include <deque> +#include <memory> +#include <unordered_map> + +#define HIDE_EC_STDLIB +#include "fuzz/cr50_fuzz.pb.h" +#include "fuzz/mem_hash_tree.h" +#include "fuzz/span.h" +#include "include/pinweaver.h" +#include "include/pinweaver_types.h" + +// Provides enough state tracking to send valid PinWeaver requests. This is +// necessary because of the authentication dependent fields used by the Merkle +// tree such as HMACs and a set of sibling path hashes that must be correct to +// reach some parts of the PinWeaver code. +class PinweaverModel { + public: + PinweaverModel(); + + void SendBuffer(fuzz::span<uint8_t> buffer); + + // Converts the logical representation of a request used in fuzzing into bytes + // that can be processed by the pinweaver code for fuzzing. + size_t SerializeRequest(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + + // Executes a request in the form of a fuzz::pinweaver::Request proto, and + // updates the model, so that future requests will be valid. + uint32_t ApplyRequest(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer); + + // Clears any state. This shoudl be called at the beginning of each fuzzing + // iteration. + void Reset(); + + private: + static constexpr uint8_t kNullRootHash[PW_HASH_SIZE] = {}; + + struct LeafData { + std::vector<uint8_t> wrapped_data; + std::array<uint8_t, PW_SECRET_SIZE> low_entropy_secret; + std::array<uint8_t, PW_SECRET_SIZE> reset_secret; + }; + + // Functions for retrieving the current state of the metadata. + void GetHmac(const std::string& fuzzer_hmac, + uint64_t label, + fuzz::span<uint8_t> hmac) const; + size_t CopyMetadata(uint64_t label, + const LeafData& leaf_data, + unimported_leaf_data_t* unimported_leaf_data, + fuzz::span<uint8_t> buffer) const; + size_t GetMetadata(uint64_t label, + unimported_leaf_data_t* unimported_leaf_data, + fuzz::span<uint8_t> buffer) const; + size_t GetPath(const std::string& fuzzer_hashes, + uint64_t label, + fuzz::span<uint8_t> path_hashes) const; + + // Store copies of the root hash of the Merkle tree, and label of the leaf + // associated with a request so that valid get log requests can be generated. + void LogRootHash(fuzz::span<const uint8_t> root_hash, uint64_t label); + // Retrieve a root hash from the log at the given index. + fuzz::span<const uint8_t> GetRootHashFromLog(size_t index) const; + // Retrieve a leaf label from the log at the given index. + uint64_t GetLabelFromLog(size_t index) const; + + // Helper functions used by SerializePinweaver to convert + size_t SerializeResetTree(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + size_t SerializeInsertLeaf(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + size_t SerializeRemoveLeaf(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + size_t SerializeTryAuth(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + size_t SerializeResetAuth(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + size_t SerializeGetLog(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + size_t SerializeLogReplay(const fuzz::pinweaver::Request& pinweaver, + fuzz::span<uint8_t> buffer) const; + + // Updates the metadata storage for a particular leaf. |leaf_data| is only + // required for insert operations so the metadata, low_entropy_secret, + // and reset_secret for the leaf can be retrieved to generate valid + // authentication requests. + void UpdateMetadata(uint64_t label, + const pw_response_header_t& header, + const unimported_leaf_data_t* unimported_leaf_data, + size_t unimported_leaf_data_length, + const LeafData* leaf_data); + + // Helper functions for updating the state when responses are received. + void ApplyResetTree(); + void ApplyInsertLeaf(const fuzz::pinweaver::Request& pinweaver, + const pw_response_t& response, + const LeafData* leaf_data); + void ApplyRemoveLeaf(const fuzz::pinweaver::Request& pinweaver, + const pw_response_t& response); + void ApplyTryAuth(const fuzz::pinweaver::Request& pinweaver, + const pw_response_t& response); + void ApplyResetAuth(const fuzz::pinweaver::Request& pinweaver, + const pw_response_t& response); + + merkle_tree_t merkle_tree_; + + MemHashTree mem_hash_tree_; + std::deque<std::pair<std::array<uint8_t, PW_HASH_SIZE>, uint64_t>> + root_history_; + std::unordered_map<uint64_t, LeafData> leaf_metadata_; +}; + +#endif // __FUZZ_PINWEAVER_MODEL_H |