lib/fuzzing/fuzz_sddl_conditional_ace.c

   1 /*
   2   Fuzz sddl conditional ace decoding and encoding
   3   Copyright (C) Catalyst IT 2023
   4
   5   This program is free software; you can redistribute it and/or modify
   6   it under the terms of the GNU General Public License as published by
   7   the Free Software Foundation; either version 3 of the License, or
   8   (at your option) any later version.
   9
  10   This program is distributed in the hope that it will be useful,
  11   but WITHOUT ANY WARRANTY; without even the implied warranty of
  12   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13   GNU General Public License for more details.
  14
  15   You should have received a copy of the GNU General Public License
  16   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include "replace.h"
  20 #include "libcli/security/security.h"
  21 #include "lib/util/attr.h"
  22 #include "librpc/gen_ndr/ndr_security.h"
  23 #include "libcli/security/conditional_ace.h"
  24 #include "librpc/gen_ndr/conditional_ace.h"
  25 #include "fuzzing/fuzzing.h"
  26
  27
  28 #define MAX_LENGTH (1024 * 1024 - 1)
  29 static char sddl_string[MAX_LENGTH + 1] = {0};
  30
  31
  32 int LLVMFuzzerInitialize(int *argc, char ***argv)
  33 {
  34         return 0;
  35 }
  36
  37
  38 int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
  39 {
  40         TALLOC_CTX *mem_ctx = NULL;
  41         bool ok;
  42         struct ace_condition_script *s1 = NULL;
  43         struct ace_condition_script *s2 = NULL;
  44         const char *message = NULL;
  45         size_t message_offset;
  46         const char *resddl = NULL;
  47         DATA_BLOB e1, e2, e3;
  48         size_t length;
  49
  50         if (len > MAX_LENGTH) {
  51                 return 0;
  52         }
  53
  54         memcpy(sddl_string, input, len);
  55         sddl_string[len] = '\0';
  56
  57         mem_ctx = talloc_new(NULL);
  58
  59         s1 = ace_conditions_compile_sddl(mem_ctx,
  60                                          ACE_CONDITION_FLAG_ALLOW_DEVICE,
  61                                          sddl_string,
  62                                          &message,
  63                                          &message_offset,
  64                                          &length);
  65         if (s1 == NULL) {
  66                 /* could assert message is non-empty */
  67                 TALLOC_FREE(mem_ctx);
  68                 return 0;
  69         }
  70
  71         ok = conditional_ace_encode_binary(mem_ctx, s1, &e1);
  72         if (! ok) {
  73                 abort();
  74         }
  75
  76         s2 = parse_conditional_ace(mem_ctx, e1);
  77         if (s2 == NULL) {
  78                 abort();
  79         }
  80
  81         ok = conditional_ace_encode_binary(mem_ctx, s2, &e2);
  82         if (! ok) {
  83                 abort();
  84         }
  85         if (data_blob_cmp(&e1, &e2) != 0) {
  86                 abort();
  87         }
  88
  89         /*
  90          * We know now the SDDL representation compiles to a valid structure
  91          * that survives a round trip through serialisation.
  92          *
  93          * A remaining question is whether it can be re-rendered as SDDL that
  94          * compiles to the same blob.
  95          */
  96         resddl = sddl_from_conditional_ace(mem_ctx, s2);
  97         if (resddl == NULL) {
  98                 abort();
  99         }
 100
 101         s2 = ace_conditions_compile_sddl(mem_ctx,
 102                                          ACE_CONDITION_FLAG_ALLOW_DEVICE,
 103                                          resddl,
 104                                          &message,
 105                                          &message_offset,
 106                                          &length);
 107         if (s2 == NULL) {
 108                 abort();
 109         }
 110
 111         ok = conditional_ace_encode_binary(mem_ctx, s2, &e3);
 112         if (! ok) {
 113                 abort();
 114         }
 115         if (data_blob_cmp(&e1, &e3) != 0) {
 116                 abort();
 117         }
 118
 119         TALLOC_FREE(mem_ctx);
 120         return 0;
 121 }