[server] add AFL support for fuzzing SPA Rijndael decryption routine directly with --afl-pkt-file

server/cmd_opts.h

@@ -127,6 +127,9 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
     "GPG_EXE",
     "FIREWALL_EXE",
     "VERBOSE",
+#if AFL_FUZZING
+    "AFL_PKT_FILE",
+#endif
     "FAULT_INJECTION_TAG"
 };
 
@@ -137,6 +140,7 @@ enum {
     FW_LIST         = 0x200,
     FW_LIST_ALL,
     FW_FLUSH,
+    AFL_PKT_FILE,
     GPG_HOME_DIR,
     GPG_EXE_PATH,
     FIREWD_DISABLE_CHECK_SUPPORT,
@@ -161,6 +165,7 @@ static struct option cmd_opts[] =
 {
     {"access-file",          1, NULL, 'a'},
     {"afl-fuzzing",          0, NULL, 'A'},
+    {"afl-pkt-file",         1, NULL, AFL_PKT_FILE },
     {"config-file",          1, NULL, 'c'},
     {"packet-limit",         1, NULL, 'C'},
     {"digest-file",          1, NULL, 'd'},

server/config_init.c

@@ -1036,6 +1036,15 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
 #else
                 log_msg(LOG_ERR, "[*] fwknopd not compiled with AFL fuzzing support");
                 clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
+#endif
+                break;
+            case AFL_PKT_FILE:
+#if AFL_FUZZING
+                opts->afl_fuzzing = 1;
+                set_config_entry(opts, CONF_AFL_PKT_FILE, optarg);
+#else
+                log_msg(LOG_ERR, "[*] fwknopd not compiled with AFL fuzzing support");
+                clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
 #endif
                 break;
             case 'a':

server/fwknopd.c

@@ -59,6 +59,7 @@ static void init_digest_cache(fko_srv_options_t *opts);
 static void set_locale(fko_srv_options_t *opts);
 static pid_t get_running_pid(const fko_srv_options_t *opts);
 #if AFL_FUZZING
+static void afl_enc_pkt_from_file(fko_srv_options_t *opts);
 static void afl_pkt_from_stdin(fko_srv_options_t *opts);
 #endif
 
@@ -187,7 +188,16 @@ main(int argc, char **argv)
 #if AFL_FUZZING
         /* SPA data from STDIN. */
         if(opts.afl_fuzzing)
-            afl_pkt_from_stdin(&opts);
+        {
+            if(opts.config[CONF_AFL_PKT_FILE] != 0x0)
+            {
+                afl_enc_pkt_from_file(&opts);
+            }
+            else
+            {
+                afl_pkt_from_stdin(&opts);
+            }
+        }
 #endif
 
         /* Prepare the firewall - i.e. flush any old rules and (for iptables)
@@ -290,6 +300,61 @@ static void set_locale(fko_srv_options_t *opts)
 }
 
 #if AFL_FUZZING
+static void afl_enc_pkt_from_file(fko_srv_options_t *opts)
+{
+    FILE                *fp = NULL;
+    fko_ctx_t           decrypt_ctx = NULL;
+    unsigned char       enc_spa_pkt[AFL_MAX_PKT_SIZE] = {0}, rc;
+    int                 res = 0, es = EXIT_SUCCESS, enc_msg_len;
+    char                dump_buf[AFL_DUMP_CTX_SIZE];
+
+    fp = fopen(opts->config[CONF_AFL_PKT_FILE], "rb");
+    if(fp != NULL)
+    {
+        enc_msg_len = 0;
+        while(fread(&rc, 1, 1, fp))
+        {
+            enc_spa_pkt[enc_msg_len] = rc;
+            enc_msg_len++;
+            if(enc_msg_len == AFL_MAX_PKT_SIZE-1)
+                break;
+        }
+        fclose(fp);
+
+        fko_new(&decrypt_ctx);
+
+        res = fko_afl_set_spa_data(decrypt_ctx, (const char *)enc_spa_pkt,
+                enc_msg_len);
+        if(res == FKO_SUCCESS)
+            res = fko_decrypt_spa_data(decrypt_ctx, "fwknoptest",
+                    strlen("fwknoptest"));
+        if(res == FKO_SUCCESS)
+            res = dump_ctx_to_buffer(decrypt_ctx, dump_buf, sizeof(dump_buf));
+        if(res == FKO_SUCCESS)
+            log_msg(LOG_INFO, "%s", dump_buf);
+        else
+            log_msg(LOG_ERR, "Error (%d): %s", res, fko_errstr(res));
+
+        fko_destroy(decrypt_ctx);
+
+        if(res == FKO_SUCCESS)
+        {
+            log_msg(LOG_INFO, "SPA packet decode: %s", fko_errstr(res));
+            es = EXIT_SUCCESS;
+        }
+        else
+        {
+            log_msg(LOG_ERR, "Could not decode SPA packet: %s", fko_errstr(res));
+            es = EXIT_FAILURE;
+        }
+    }
+    else
+        log_msg(LOG_ERR, "Could not acquire SPA packet from file: %s.",
+                opts->config[CONF_AFL_PKT_FILE]);
+
+    clean_exit(opts, NO_FW_CLEANUP, es);
+}
+
 static void afl_pkt_from_stdin(fko_srv_options_t *opts)
 {
     FILE                *fp = NULL;

server/fwknopd_common.h

@@ -305,6 +305,9 @@ enum {
     CONF_GPG_EXE,
     CONF_FIREWALL_EXE,
     CONF_VERBOSE,
+#if AFL_FUZZING
+    CONF_AFL_PKT_FILE,
+#endif
     CONF_FAULT_INJECTION_TAG,
 
     NUMBER_OF_CONFIG_ENTRIES  /* Marks the end and number of entries */

server/replay_cache.c

@@ -677,10 +677,16 @@ add_replay_dbm_cache(fko_srv_options_t *opts, char *digest)
 void
 free_replay_list(fko_srv_options_t *opts)
 {
+    struct digest_cache_list *digest_list_ptr = NULL, *digest_tmp = NULL;
+
 #ifdef NO_DIGEST_CACHE
     return;
 #endif
-    struct digest_cache_list *digest_list_ptr = NULL, *digest_tmp = NULL;
+
+#if AFL_FUZZING
+    if(opts->afl_fuzzing)
+        return;
+#endif
 
     if (opts->digest_cache == NULL)
         return;