1#!/usr/bin/env python3
2#
3#  Copyright The Mbed TLS Contributors
4#  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
5#
6
7"""
8Make fuzz like testing for pkcs7 tests
9Given a valid DER pkcs7 file add tests to the test_suite_pkcs7.data file
10 - It is expected that the pkcs7_asn1_fail( data_t *pkcs7_buf )
11    function is defined in test_suite_pkcs7.function
12 - This is not meant to be portable code, if anything it is meant to serve as
13   documentation for showing how those ugly tests in test_suite_pkcs7.data were created
14"""
15
16
17import sys
18from os.path import exists
19
20PKCS7_TEST_FILE = "../suites/test_suite_pkcs7.data"
21
22class Test: # pylint: disable=too-few-public-methods
23    """
24    A instance of a test in test_suite_pkcs7.data
25    """
26    def __init__(self, name, depends, func_call):
27        self.name = name
28        self.depends = depends
29        self.func_call = func_call
30
31    # pylint: disable=no-self-use
32    def to_string(self):
33        return "\n" + self.name + "\n" + self.depends + "\n" + self.func_call + "\n"
34
35class TestData:
36    """
37    Take in test_suite_pkcs7.data file.
38    Allow for new tests to be added.
39    """
40    mandatory_dep = "MBEDTLS_MD_CAN_SHA256"
41    test_name = "PKCS7 Parse Failure Invalid ASN1"
42    test_function = "pkcs7_asn1_fail:"
43    def __init__(self, file_name):
44        self.file_name = file_name
45        self.last_test_num, self.old_tests = self.read_test_file(file_name)
46        self.new_tests = []
47
48    # pylint: disable=no-self-use
49    def read_test_file(self, file):
50        """
51        Parse the test_suite_pkcs7.data file.
52        """
53        tests = []
54        if not exists(file):
55            print(file + " Does not exist")
56            sys.exit()
57        with open(file, "r", encoding='UTF-8') as fp:
58            data = fp.read()
59        lines = [line.strip() for line in data.split('\n') if len(line.strip()) > 1]
60        i = 0
61        while i < len(lines):
62            if "depends" in lines[i+1]:
63                tests.append(Test(lines[i], lines[i+1], lines[i+2]))
64                i += 3
65            else:
66                tests.append(Test(lines[i], None, lines[i+1]))
67                i += 2
68        latest_test_num = float(tests[-1].name.split('#')[1])
69        return latest_test_num, tests
70
71    def add(self, name, func_call):
72        self.last_test_num += 1
73        self.new_tests.append(Test(self.test_name + ": " + name +  " #" + \
74                str(self.last_test_num), "depends_on:" + self.mandatory_dep, \
75                self.test_function + '"' + func_call + '"'))
76
77    def write_changes(self):
78        with open(self.file_name, 'a', encoding='UTF-8') as fw:
79            fw.write("\n")
80            for t in self.new_tests:
81                fw.write(t.to_string())
82
83
84def asn1_mutate(data):
85    """
86    We have been given an asn1 structure representing a pkcs7.
87    We want to return an array of slightly modified versions of this data
88    they should be modified in a way which makes the structure invalid
89
90    We know that asn1 structures are:
91    |---1 byte showing data type---|----byte(s) for length of data---|---data content--|
92    We know that some data types can contain other data types.
93    Return a dictionary of reasons and mutated data types.
94    """
95
96    # off the bat just add bytes to start and end of the buffer
97    mutations = []
98    reasons = []
99    mutations.append(["00"] + data)
100    reasons.append("Add null byte to start")
101    mutations.append(data + ["00"])
102    reasons.append("Add null byte to end")
103    # for every asn1 entry we should attempt to:
104    #    - change the data type tag
105    #    - make the length longer than actual
106    #    - make the length shorter than actual
107    i = 0
108    while i < len(data):
109        tag_i = i
110        leng_i = tag_i + 1
111        data_i = leng_i + 1 + (int(data[leng_i][1], 16) if data[leng_i][0] == '8' else 0)
112        if data[leng_i][0] == '8':
113            length = int(''.join(data[leng_i + 1: data_i]), 16)
114        else:
115            length = int(data[leng_i], 16)
116
117        tag = data[tag_i]
118        print("Looking at ans1: offset " + str(i) + " tag = " + tag + \
119                ", length = " + str(length)+ ":")
120        print(''.join(data[data_i:data_i+length]))
121        # change tag to something else
122        if tag == "02":
123            # turn integers into octet strings
124            new_tag = "04"
125        else:
126            # turn everything else into an integer
127            new_tag = "02"
128        mutations.append(data[:tag_i] + [new_tag] + data[leng_i:])
129        reasons.append("Change tag " + tag + " to " + new_tag)
130
131        # change lengths to too big
132        # skip any edge cases which would cause carry over
133        if int(data[data_i - 1], 16) < 255:
134            new_length = str(hex(int(data[data_i - 1], 16) + 1))[2:]
135            if len(new_length) == 1:
136                new_length = "0"+new_length
137            mutations.append(data[:data_i -1] + [new_length] + data[data_i:])
138            reasons.append("Change length from " + str(length) + " to " \
139                    + str(length + 1))
140            # we can add another test here for tags that contain other tags \
141            # where they have more data than there containing tags account for
142            if tag in ["30", "a0", "31"]:
143                mutations.append(data[:data_i -1] + [new_length] + \
144                        data[data_i:data_i + length] + ["00"] + \
145                        data[data_i + length:])
146                reasons.append("Change contents of tag " + tag + " to contain \
147                        one unaccounted extra byte")
148        # change lengths to too small
149        if int(data[data_i - 1], 16) > 0:
150            new_length = str(hex(int(data[data_i - 1], 16) - 1))[2:]
151            if len(new_length) == 1:
152                new_length = "0"+new_length
153            mutations.append(data[:data_i -1] + [new_length] + data[data_i:])
154            reasons.append("Change length from " + str(length) + " to " + str(length - 1))
155
156        # some tag types contain other tag types so we should iterate into the data
157        if tag in ["30", "a0", "31"]:
158            i = data_i
159        else:
160            i = data_i + length
161
162    return list(zip(reasons, mutations))
163
164if __name__ == "__main__":
165    if len(sys.argv) < 2:
166        print("USAGE: " + sys.argv[0] + " <pkcs7_der_file>")
167        sys.exit()
168
169    DATA_FILE = sys.argv[1]
170    TEST_DATA = TestData(PKCS7_TEST_FILE)
171    with open(DATA_FILE, 'rb') as f:
172        DATA_STR = f.read().hex()
173    # make data an array of byte strings eg ['de','ad','be','ef']
174    HEX_DATA = list(map(''.join, [[DATA_STR[i], DATA_STR[i+1]] for i in range(0, len(DATA_STR), \
175            2)]))
176    # returns tuples of test_names and modified data buffers
177    MUT_ARR = asn1_mutate(HEX_DATA)
178
179    print("made " + str(len(MUT_ARR)) + " new tests")
180    for new_test in MUT_ARR:
181        TEST_DATA.add(new_test[0], ''.join(new_test[1]))
182
183    TEST_DATA.write_changes()
184