etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
README.md (3278B)
      1 # libksba fuzzing
      2 
      3 Fuzzing harnesses for **libksba** (GnuPG's ASN.1/X.509/CMS/OCSP/CRL parser).
      4 Same machine setup as the libusb harness: AFL++ (CLASSIC + laf-intel), a CmpLog
      5 sibling per harness, ASan + UBSan + signed-integer-overflow at `-O0 -g`.
      6 
      7 Why libksba: hand-rolled DER parsing, tiny maintainer team, ubiquitous (every
      8 GnuPG install), **not on OSS-Fuzz**, no fuzz harness in-tree. CRL and OCSP parsing
      9 are reachable **remotely** through `dirmngr` (HTTP/LDAP fetch); cert and CMS
     10 through `gpgsm`. Prior art: CVE-2022-3515 (integer overflow -> heap overflow).
     11 
     12 ## Harnesses
     13 
     14 | harness      | public entrypoint                       | parsers driven                          |
     15 |--------------|-----------------------------------------|-----------------------------------------|
     16 | `fuzz_cert`  | `ksba_cert_init_from_mem` + accessors   | cert.c, dn.c, keyinfo.c, name.c, oid.c, time.c |
     17 | `fuzz_crl`   | `ksba_crl_set_reader` + `ksba_crl_parse`| crl.c, ber-help.c, keyinfo.c, time.c    |
     18 | `fuzz_ocsp`  | `ksba_ocsp_parse_response`              | ocsp.c, time.c                          |
     19 | `fuzz_cms`   | `ksba_cms_set_reader_writer` + `ksba_cms_parse` | cms.c, cms-parser.c             |
     20 
     21 Cert parsing is lazy, so `fuzz_cert` calls the full accessor set to force the
     22 deep parse. All parsers funnel through the BER decoder (`ber-decoder.c`,
     23 `ber-help.c`).
     24 
     25 ## Usage
     26 
     27 ```
     28 bash setup.sh            # deps + AFL++ + instrumented libksba + harnesses + corpus
     29 bash start-fuzzers.sh    # 8 instances in tmux (master + CmpLog secondary per harness)
     30 bash start-fuzzers.sh --status
     31 bash cleanup.sh          # kill + remove artifacts (flags: --keep-corpus --keep-source ...)
     32 ```
     33 
     34 `setup.sh` flags: `--skip-deps` (deps already installed), `--skip-afl` (use a
     35 system afl-clang-fast instead of building AFL++ from source).
     36 
     37 Each harness builds three ways: `H` (AFL persistent), `H.cmplog` (CmpLog), and
     38 `H.repro` (plain clang + ASan, reads files from argv) for crash triage:
     39 
     40 ```
     41 ./fuzz_crl.repro output/master_crl/crashes/id:000000*
     42 ```
     43 
     44 ## Target version
     45 
     46 `setup.sh` defaults to libksba git tip (1.8.x) - bugs there are reportable
     47 upstream immediately. The line distros ship for `dirmngr`/`gpgsm` is older and
     48 missing the 1.7.0 hardening; to fuzz that instead:
     49 
     50 ```
     51 LIBKSBA_TAG=libksba-1.6.6 bash setup.sh
     52 ```
     53 
     54 ## Soft spots flagged during the audit (corpus is seeded toward these)
     55 
     56 - `time.c` `_ksba_asntime_to_iso`: terminator check reads one byte past the time
     57   value when it has no trailing `Z`. Shared by cert/crl/ocsp time fields.
     58 - `dn.c` `append_ucs2_value` / `append_ucs4_value`: odd-length BMPString /
     59   misaligned UniversalString over-read in subject/issuer DN.
     60 
     61 These are 1-byte over-reads that land in decoder slack as shipped; the point of
     62 fuzzing is to find the variant that doesn't.
     63 
     64 ## Notes
     65 
     66 - The `#include`-the-`.c` trick used for libusb is not needed here: the bugs are
     67   reachable through the public API, so harnesses link the instrumented
     68   `libksba.a` and drive it normally.
     69 - `gen_corpus.sh` mints real DER seeds with a throwaway openssl mini-CA
     70   (`conf/ca.cnf`): cert, empty + revoked CRL, signed CMS, OCSP response.
     71 - LLVM-18 caveat carried from libusb: `AFL_LLVM_LAF_ALL=1` needs
     72   `AFL_LLVM_INSTRUMENT=CLASSIC` (PCGUARD miscompiles split comparisons).