Extend the fuzzing harnesses for broader coverage#2
Open
tc-agent wants to merge 2 commits into
Open
Conversation
Rework fuzz_gss so that it forges a self-contained krb5 service ticket (random service key in an in-memory keytab, matching ticket in an in-memory credential cache) and drives full krb5 and SPNEGO context establishment. With both an initiator and an acceptor credential available the fuzz input now exercises the complete gss_accept_sec_context() token decoder and the established-context message paths (gss_unwrap, gss_unwrap_iov, gss_init_sec_context) instead of stopping at the first credential lookup. The harness also exercises the per-message, IOV, credential, name and mechanism interfaces against the established contexts. Add fuzz_initcreds, which drives the client AS and TGS exchanges (krb5_get_init_creds_password / krb5_get_init_creds_keytab / krb5_get_credentials). A KDC send hook installed with krb5_set_kdc_send_hook answers every request with the fuzz input, so the input drives the AS-REP / TGS-REP / KRB-ERROR decoders and the preauthentication response handling without contacting a real KDC. Add fuzz_ccache, which exercises the FILE credential cache parser.
Fuzzing Coverage ReportTested: project
Per-harness
Same harness config applied to both sides (baseline = base source + PR harness). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This extends the in-tree OSS-Fuzz harnesses under
src/tests/fuzzingsothat they reach security-relevant code the current harnesses do not. Per
the Fuzz Introspector report
the project's line coverage is roughly 22%, with the GSS-API mechanism
code and the client ticket-acquisition code largely unreached.
fuzz_gss (reworked)
The previous version called
gss_accept_sec_context()with no acceptorcredential, so every input stopped at the first credential lookup. The
reworked harness forges a self-contained krb5 service ticket (a fixed
service key in an in-memory keytab, a matching ticket encrypted with it
in an in-memory credential cache) and establishes one krb5 security
context at startup; no KDC is required. With both an initiator and an
acceptor credential available, the per-input function then drives the
attacker-controlled GSS-API surfaces: the acceptor token decoder
(
gss_accept_sec_context), the initiator's reply-token handling(
gss_init_sec_contextcontinuation), the per-message decoders on theestablished context (
gss_unwrap,gss_verify_mic,gss_process_context_token) and the deserialization routines(
gss_import_sec_context,gss_import_cred,gss_import_name).The input is copied to a private buffer first because some GSS decoders
rewrite the token buffer in place.
fuzz_initcreds (new)
Drives the client side of the AS and TGS exchanges
(
krb5_get_init_creds_password,krb5_get_init_creds_keytab,krb5_get_credentials). A KDC send hook installed withkrb5_set_kdc_send_hook()answers every request with the fuzz input, sothe input drives the AS-REP / TGS-REP / KRB-ERROR decoders and the
preauthentication response handling in
lib/krb5/krb— the code thatprocesses replies from a potentially malicious or spoofed KDC — without
contacting a real KDC.
fuzz_ccache (new)
Exercises the FILE credential cache parser (
lib/krb5/ccache/cc_file.c).A credential cache path is commonly taken from the
KRB5CCNAMEenvironment variable, so the parser routinely reads attacker-influenced
files.
Seed corpora
fuzz_initcredsreuses three encoded KDC-reply structures already presentin the repository's
fuzz_asnseed corpus (an AS-REP, a TGS-REP and anencrypted KDC-reply part).
fuzz_ccacheships one seed produced byemitting the documented version-4 FILE credential cache layout: the
two-byte version, a tagged header, a default principal and a single
credential with a 32-byte key.
Coverage
A local five-minute run of the full harness set raises measured line
coverage from the ~22% Fuzz Introspector baseline to ~32%. The gain is
concentrated in
lib/gssapiandlib/krb5/krb.These changes belong upstream rather than in the OSS-Fuzz repository
because krb5 hosts its own fuzz harnesses in
src/tests/fuzzingand buildsthem via
src/tests/fuzzing/oss-fuzz.sh.