Commit Graph

8 Commits

Author SHA1 Message Date
David Benjamin
58218b63bc Regenerate server_corpus and client_corpus.
Now that client.cc and server.cc run through application data, regenerate the
corpus.

Change-Id: I8278ebfe47fd2ba74f67db6f9b545aabf9fd1f84
Reviewed-on: https://boringssl-review.googlesource.com/7301
Reviewed-by: Adam Langley <agl@google.com>
2016-03-04 19:13:32 +00:00
David Benjamin
d86c8a400b Enable renegotiation in the client fuzzer and read app data.
As long as the HTTP/1.1 client auth hack forces use to support renego, having
it on seems much more useful than having it off for fuzzing purposes. Also read
app data to exercise that code and, on the client, trigger renegotiations as
needed.

Change-Id: I1941ded6ec9bd764abd199d1518420a1075ed1b2
Reviewed-on: https://boringssl-review.googlesource.com/7291
Reviewed-by: Adam Langley <agl@google.com>
2016-03-04 19:13:10 +00:00
David Benjamin
1d34e3c644 Add an option to pick a different build directory in minimise_corpuses.sh.
Also pass set -e instead of chaining things with &&. (One line was missing the
&&.)

Change-Id: Ia04e7f40f46688c9664101efefef1d1ea069de71
Reviewed-on: https://boringssl-review.googlesource.com/7300
Reviewed-by: Adam Langley <agl@google.com>
2016-03-04 19:12:43 +00:00
Adam Langley
80c0fd6746 Update fuzzing corpuses.
This results from running the fuzzers for a little while with both the
8bit-counters change and after taking the transcripts from the runner
tests as seeds for the `client` and `server` fuzzers.

Change-Id: I545a89d8dccd7ef69dd97546ed61610eea4a27a3
Reviewed-on: https://boringssl-review.googlesource.com/7276
Reviewed-by: David Benjamin <davidben@google.com>
2016-03-03 18:33:05 +00:00
David Benjamin
bc5b2a2e22 Add a deterministic PRNG for fuzzing.
If running the stack through a fuzzer, we would like execution to be
completely deterministic. This is gated on a
BORINGSSL_UNSAFE_FUZZER_MODE #ifdef.

For now, this just uses the zero ChaCha20 key and a global counter. As
needed, we can extend this to a thread-local counter and a separate
ChaCha20 stream and counter per input length.

Change-Id: Ic6c9d8a25e70d68e5dc6804e2c234faf48e51395
Reviewed-on: https://boringssl-review.googlesource.com/7286
Reviewed-by: Adam Langley <agl@google.com>
2016-03-03 01:36:19 +00:00
David Benjamin
f48fcaf901 Have fuzz/cert.cc also call X509_get_pubkey.
crypto/x509 parses the SPKI on-demand, so we weren't actually exercising the
SPKI code.

Change-Id: I2e16045bd35dbe04d4b8d8b45939c8885e09a550
Reviewed-on: https://boringssl-review.googlesource.com/7161
Reviewed-by: Adam Langley <agl@google.com>
2016-02-18 00:10:15 +00:00
Adam Langley
3202750a98 Update the fuzz tests for the server.
These seeds are the result of spending more CPU time fuzzing the server.

Change-Id: Iacf889ae6e214056033f4a5f9f3b89e4710c22a5
2015-12-22 16:35:07 -08:00
Adam Langley
9a4beb8ad8 Add four, basic fuzz tests.
This change adds fuzzing tests for:
  ∙ Certificate parsing
  ∙ Private key parsing
  ∙ ClientHello parsing
  ∙ Server first flow (ServerHello, Certificate, etc) parsing.

Change-Id: I5f53282263eaaff69b1a03c819cca73750433653
Reviewed-on: https://boringssl-review.googlesource.com/6460
Reviewed-by: Adam Langley <agl@google.com>
2015-11-10 19:14:01 +00:00