Update comments in s2n_hybrid_ecdhe_sike_fuzz_test
* permissions and limitations under the License.
*/
-#include <pq-crypto/sike/sike_p503_kem.h>
#include "crypto/s2n_crypto.h"
#include "crypto/s2n_drbg.h"
#include "crypto/s2n_hash.h"
#include "crypto/s2n_openssl.h"
-
+#include "error/s2n_errno.h"
+#include "pq-crypto/sike/sike_p503_kem.h"
#include "stuffer/s2n_stuffer.h"
-
#include "tests/s2n_test.h"
-
#include "tests/testlib/s2n_testlib.h"
-
#include "tests/unit/s2n_nist_kats.h"
-
#include "tls/s2n_kex.h"
#include "tls/s2n_kem.h"
#include "tls/s2n_tls.h"
-
#include "utils/s2n_random.h"
#include "utils/s2n_safety.h"
#include "utils/s2n_safety.h"
#include "tls/s2n_cipher_suites.h"
-#include "error/s2n_errno.h"
-
-
static struct s2n_kem_keypair server_kem_keys = {.negotiated_kem = &s2n_sike_supported_params[0]};
+/* Setup the connection in a state for a fuzz test run, s2n_client_key_recv modifies the state of the connection
+ * along the way and gets cleaned up at the end of each fuzz test.
+ * - Connection needs cipher suite, curve, and kem setup
+ * - Connection needs a ecdhe key and a kem private key, this would normally be setup when the server calls s2n_server_send_key
+ * */
static int setup_connection(struct s2n_connection *server_conn)
{
server_conn->actual_protocol_version = S2N_TLS12;
@@ -50,8 +47,8 @@ static int setup_connection(struct s2n_connection *server_conn)
server_conn->secure.conn_hash_alg = S2N_HASH_SHA384;
GUARD(s2n_dup(&server_kem_keys.private_key, &server_conn->secure.s2n_kem_keys.private_key));
- /* s2n_ecdhe_client_key_recv will free the server's point so it needs to be recreated every run */
GUARD(s2n_ecc_generate_ephemeral_key(&server_conn->secure.server_ecc_params));
+
return 0;
}
@@ -85,6 +82,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
GUARD(s2n_stuffer_write_bytes(&server_conn->handshake.io, buf, len));
}
+ /* The missing GUARD is because s2n_client_key_recv might fail due to bad input which is okay, the connection
+ * must still be cleaned up. Don't return s2n_client_key_recv's result because the the test still passes as long as
+ * s2n_client_key_recv does not leak/contaminate any memory, the fuzz input is most likely not valid and will fail
+ * to be recv'd successfully. */
s2n_client_key_recv(server_conn);
GUARD(s2n_connection_free(server_conn));
