Remove pppd fuzzer Legacy VPNs are removed, pppd is now unused and removed. Bug: 161776767 Test: m Change-Id: I91f95f7d32b856113dc7466bca8d0a4632a003a1
diff --git a/fuzzing/orphans/pppd/Android.bp b/fuzzing/orphans/pppd/Android.bp deleted file mode 100644 index e2b4dc0..0000000 --- a/fuzzing/orphans/pppd/Android.bp +++ /dev/null
@@ -1,35 +0,0 @@ -package { - default_applicable_licenses: ["Android-Apache-2.0"], -} - -cc_fuzz { - name: "eap_pppd_fuzz", - - srcs: [ - "eap_fuzz.proto", - "eap_fuzz.cc", - "eap_fuzz_Cproxy.c", - ], - - static_libs: [ - "libprotobuf-mutator", - "libpppd", - ], - shared_libs: [ - "libprotobuf-cpp-full", - "libdl", - "liblog", - "libcutils", - "libcrypto", - ], - - cflags: [ - "-Wno-unused-parameter", - ], - - ldflags: ["-rdynamic"], - required: [ - "pppol2tp-android", - "pppopptp-android", - ], -}
diff --git a/fuzzing/orphans/pppd/eap_fuzz.cc b/fuzzing/orphans/pppd/eap_fuzz.cc deleted file mode 100644 index 5372e15..0000000 --- a/fuzzing/orphans/pppd/eap_fuzz.cc +++ /dev/null
@@ -1,215 +0,0 @@ -#include <stdint.h> -extern "C" { -#include "eap_fuzz_Cproxy.h" -} - -#include <src/libfuzzer/libfuzzer_macro.h> -#include "eap_fuzz.pb.h" - -#define S_MALLOC(var, size) \ -do { \ - if ((var = (uint8_t *)malloc(size)) == NULL) { \ - return; \ - } \ -} while(0) - -void write_header(uint8_t *packet, uint16_t data_size, uint8_t type) -{ - data_size += EAP_HEADERLEN; - //the packet type - *(packet)++ = type&0xff; - //id - *(packet)++ = 0x0; - //the length as big endian short - *(packet)++ = ((data_size >> 8)&0xff); - *(packet)++ = data_size&0xff; -} - -DEFINE_BINARY_PROTO_FUZZER(const eap_fuzz::proto::PacketSet &packets){ - init(); - - for(const eap_fuzz::proto::Packet& packet: packets.packets()){ - uint8_t *fuzz_packet = NULL; - size_t packet_len = 0; - std::string data = ""; - uint8_t packet_type = -1; - switch(packet.PacketType_case()){ - case eap_fuzz::proto::Packet::kEapRequest: { - packet_type = EAP_REQUEST; - uint8_t eap_request_type = -1; - auto eap_request = packet.eap_request(); - switch(eap_request.EapRequestType_case()){ - case eap_fuzz::proto::EapRequest::kIdentity: { - eap_request_type = EAPT_IDENTITY; - data = eap_request.identity().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+1); - break; - } - case eap_fuzz::proto::EapRequest::kNotification: { - eap_request_type = EAPT_NOTIFICATION; - data = eap_request.notification().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+1); - break; - } - case eap_fuzz::proto::EapRequest::kMd5Chap: { - eap_request_type = EAPT_MD5CHAP; - data = eap_request.md5chap().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+1); - break; - } - case eap_fuzz::proto::EapRequest::kSrp: { - auto request_srp = eap_request.srp(); - eap_request_type = EAPT_SRP; - uint8_t srp_type = -1; - switch(request_srp.EspMessage_case()){ - case eap_fuzz::proto::EaptRequestSRP::kSrpChallenge:{ - data = request_srp.srp_challenge().data(); - srp_type = EAPSRP_CHALLENGE; - break; - } - case eap_fuzz::proto::EaptRequestSRP::kSrpValidator:{ - data = request_srp.srp_validator().data(); - srp_type = EAPSRP_SVALIDATOR; - break; - } - case eap_fuzz::proto::EaptRequestSRP::kSrpKey:{ - data = request_srp.srp_key().data(); - srp_type = EAPSRP_SKEY; - break; - } - case eap_fuzz::proto::EaptRequestSRP::kSrpLwreChallenge:{ - data = request_srp.srp_lwre_challenge().data(); - srp_type = EAPSRP_LWRECHALLENGE; - break; - } - case eap_fuzz::proto::EaptRequestSRP::ESPMESSAGE_NOT_SET:{ - return; - } - - } - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+2); - *(fuzz_packet+EAP_HEADERLEN+1) = srp_type; - packet_len++; - break; - } - case eap_fuzz::proto::EapRequest::EAPREQUESTTYPE_NOT_SET: { - return; - } - } - *(fuzz_packet+EAP_HEADERLEN) = eap_request_type; - ++packet_len; - break; - } - - case eap_fuzz::proto::Packet::kEapResponse: { - packet_type = EAP_RESPONSE; - auto eap_response = packet.eap_response(); - uint8_t eap_response_type = -1; - switch(eap_response.EapResponseType_case()){ - case eap_fuzz::proto::EapResponse::kIdentity: { - eap_response_type = EAPT_IDENTITY; - data = eap_response.identity().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+1); - break; - } - case eap_fuzz::proto::EapResponse::kNotification: { - eap_response_type = EAPT_NOTIFICATION; - data = eap_response.notification().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+1); - break; - } - case eap_fuzz::proto::EapResponse::kMd5Chap: { - eap_response_type = EAPT_MD5CHAP; - data = eap_response.md5chap().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+1); - break; - } - case eap_fuzz::proto::EapResponse::kNak: { - eap_response_type = EAPT_NAK; - auto response_nak = eap_response.nak(); - uint8_t nak_type = -1; - switch(response_nak.EaptResponseNAKType_case()){ - case eap_fuzz::proto::EaptResponseNAK::kSrp:{ - nak_type = EAPT_SRP; - break; - - } - case eap_fuzz::proto::EaptResponseNAK::kMd5Chap:{ - nak_type = EAPT_MD5CHAP; - break; - - } - case eap_fuzz::proto::EaptResponseNAK::EAPTRESPONSENAKTYPE_NOT_SET:{ - return; - } - } - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+2); - *(fuzz_packet+EAP_HEADERLEN+1) = nak_type; - packet_len++; - break; - } - case eap_fuzz::proto::EapResponse::kSrp: { - auto response_srp = eap_response.srp(); - eap_response_type = EAPT_SRP; - uint8_t srp_type = -1; - switch(response_srp.EspMessage_case()){ - case eap_fuzz::proto::EaptResponseSRP::kSrpChallenge:{ - data = response_srp.srp_challenge().data(); - srp_type = EAPSRP_LWRECHALLENGE; - break; - } - case eap_fuzz::proto::EaptResponseSRP::kSrpCvalidator:{ - data = response_srp.srp_cvalidator().data(); - srp_type = EAPSRP_CVALIDATOR; - break; - } - case eap_fuzz::proto::EaptResponseSRP::kSrpCkey:{ - data = response_srp.srp_ckey().data(); - srp_type = EAPSRP_CKEY; - break; - } - case eap_fuzz::proto::EaptResponseSRP::kSrpAck:{ - data = response_srp.srp_ack().data(); - srp_type = EAPSRP_ACK; - break; - } - case eap_fuzz::proto::EaptResponseSRP::ESPMESSAGE_NOT_SET:{ - return; - } - - } - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN+2); - *(fuzz_packet+EAP_HEADERLEN+1) = srp_type; - packet_len++; - break; - } - case eap_fuzz::proto::EapResponse::EAPRESPONSETYPE_NOT_SET: { - return; - } - } - *(fuzz_packet+EAP_HEADERLEN) = eap_response_type; - ++packet_len; - break; - } - case eap_fuzz::proto::Packet::kEapSuccess: { - packet_type = EAP_SUCCESS; - data = packet.eap_success().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN); - break; - } - case eap_fuzz::proto::Packet::kEapFailure: { - packet_type = EAP_FAILURE; - data = packet.eap_failure().data(); - S_MALLOC(fuzz_packet, data.size()+EAP_HEADERLEN); - break; - } - case eap_fuzz::proto::Packet::PACKETTYPE_NOT_SET: { - return; - } - } - write_header(fuzz_packet, data.size()+packet_len, packet_type); - memcpy(fuzz_packet+EAP_HEADERLEN+packet_len, data.data(), data.size()); - proxy_packet(fuzz_packet, data.size()+EAP_HEADERLEN+packet_len); - free(fuzz_packet); - } -}
diff --git a/fuzzing/orphans/pppd/eap_fuzz.proto b/fuzzing/orphans/pppd/eap_fuzz.proto deleted file mode 100644 index 6d41214..0000000 --- a/fuzzing/orphans/pppd/eap_fuzz.proto +++ /dev/null
@@ -1,133 +0,0 @@ -syntax = "proto2"; -package eap_fuzz.proto; - -message PacketSet{ - repeated Packet packets = 1; -} - -message Packet{ - oneof PacketType { - EapRequest eap_request = 1; - EapResponse eap_response = 2; - EapSuccess eap_success = 3; - EapFailure eap_failure = 4; - } -} - -message EapRequest{ - oneof EapRequestType{ - EaptRequestIdentity identity = 1; - EsptRequestNotification notification = 2; - EaptRequestMD5Chap md5chap = 3; - EaptRequestSRP srp = 4; - } - -} - -message EaptRequestIdentity{ - required bytes data = 1; -} - -message EsptRequestNotification{ - required bytes data = 1; -} - -message EaptRequestMD5Chap{ - required bytes data = 2; -} -message EaptRequestSRP{ - oneof EspMessage { - EapRequestSRPChallenge srp_challenge = 1; - EapRequestSRPKey srp_key = 2; - EapRequestSRPValidator srp_validator = 3; - EapRequestSRPLWREChallenge srp_lwre_challenge = 4; - } -} - -message EapRequestSRPChallenge{ - required bytes data = 1; -} - -message EapRequestSRPKey{ - required bytes data = 1; -} - -message EapRequestSRPValidator { - required bytes data = 1; -} - -message EapRequestSRPLWREChallenge{ - required bytes data = 1; -} - -message EapResponse{ - oneof EapResponseType{ - EaptResponseIdentity identity = 1; - EsptResponseNotification notification = 2; - EaptResponseNAK nak = 3; - EaptResponseMD5Chap md5chap = 4; - EaptResponseSRP srp = 5; - } -} - -message EaptResponseIdentity{ - required bytes data = 1; -} - -message EsptResponseNotification{ - required bytes data = 1; -} - -message EaptResponseNAK{ - oneof EaptResponseNAKType{ - EaptResponseNAKSRP srp = 1; - EaptResponseNAKMD5Chap md5_chap = 2; - } -} - - -message EaptResponseNAKSRP{ - required bytes data = 1; -} - -message EaptResponseNAKMD5Chap { - required bytes data = 1; -} - -message EaptResponseMD5Chap { - required bytes data = 1; -} - -message EaptResponseSRP{ - oneof EspMessage { - EapResponseSRPCKey srp_ckey = 1; - EapResponseSRPCValidator srp_cvalidator = 2; - EapResponseSRPACK srp_ack = 3; - EapResponseSRPLWEChallenge srp_challenge = 4; - } -} - -message EapResponseSRPCKey { - required bytes data = 1; -} - -message EapResponseSRPCValidator{ - required bytes data = 1; -} - -message EapResponseSRPACK{ - required bytes data = 1; -} - -message EapResponseSRPLWEChallenge{ - required bytes data = 1; -} - -message EapSuccess{ - required bytes data = 1; -} - -message EapFailure{ - required bytes data = 1; -} -
diff --git a/fuzzing/orphans/pppd/eap_fuzz_Cproxy.c b/fuzzing/orphans/pppd/eap_fuzz_Cproxy.c deleted file mode 100644 index e2b7d98..0000000 --- a/fuzzing/orphans/pppd/eap_fuzz_Cproxy.c +++ /dev/null
@@ -1,28 +0,0 @@ -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#include <unistd.h> -#include <stdint.h> -#include <pwd.h> -#include <sys/types.h> -#include <sys/stat.h> -#include <fcntl.h> -#include <assert.h> -#include <errno.h> - -#include "pppd.h" -#include "pathnames.h" -#include "md5.h" -#include "eap.h" -#include "magic.h" - -void init() -{ - eap_protent.init(0); -} - - -void proxy_packet(uint8_t *data, int len) -{ - eap_protent.input(0, data, len); -}
diff --git a/fuzzing/orphans/pppd/eap_fuzz_Cproxy.h b/fuzzing/orphans/pppd/eap_fuzz_Cproxy.h deleted file mode 100644 index 6846f5e..0000000 --- a/fuzzing/orphans/pppd/eap_fuzz_Cproxy.h +++ /dev/null
@@ -1,56 +0,0 @@ -//from pppd.h, can't include it directly in the fuzzer because C -> C++ issues -#define EAP_HEADERLEN 4 - -/* EAP message codes. */ -#define EAP_REQUEST 1 -#define EAP_RESPONSE 2 -#define EAP_SUCCESS 3 -#define EAP_FAILURE 4 - -/* EAP types */ -#define EAPT_IDENTITY 1 -#define EAPT_NOTIFICATION 2 -#define EAPT_NAK 3 /* (response only) */ -#define EAPT_MD5CHAP 4 -#define EAPT_OTP 5 /* One-Time Password; RFC 1938 */ -#define EAPT_TOKEN 6 /* Generic Token Card */ -/* 7 and 8 are unassigned. */ -#define EAPT_RSA 9 /* RSA Public Key Authentication */ -#define EAPT_DSS 10 /* DSS Unilateral */ -#define EAPT_KEA 11 /* KEA */ -#define EAPT_KEA_VALIDATE 12 /* KEA-VALIDATE */ -#define EAPT_TLS 13 /* EAP-TLS */ -#define EAPT_DEFENDER 14 /* Defender Token (AXENT) */ -#define EAPT_W2K 15 /* Windows 2000 EAP */ -#define EAPT_ARCOT 16 /* Arcot Systems */ -#define EAPT_CISCOWIRELESS 17 /* Cisco Wireless */ -#define EAPT_NOKIACARD 18 /* Nokia IP smart card */ -#define EAPT_SRP 19 /* Secure Remote Password */ -/* 20 is deprecated */ - -/* EAP SRP-SHA1 Subtypes */ -#define EAPSRP_CHALLENGE 1 /* Request 1 - Challenge */ -#define EAPSRP_CKEY 1 /* Response 1 - Client Key */ -#define EAPSRP_SKEY 2 /* Request 2 - Server Key */ -#define EAPSRP_CVALIDATOR 2 /* Response 2 - Client Validator */ -#define EAPSRP_SVALIDATOR 3 /* Request 3 - Server Validator */ -#define EAPSRP_ACK 3 /* Response 3 - final ack */ -#define EAPSRP_LWRECHALLENGE 4 /* Req/resp 4 - Lightweight rechal */ - -#define SRPVAL_EBIT 0x00000001 /* Use shared key for ECP */ - -#define SRP_PSEUDO_ID "pseudo_" -#define SRP_PSEUDO_LEN 7 - -#define MD5_SIGNATURE_SIZE 16 -#define MIN_CHALLENGE_LENGTH 16 -#define MAX_CHALLENGE_LENGTH 24 - -void init(); -void proxy_packet(uint8_t *data, int len); - -//override output so we don't write to a broken fd -void output (int unit, unsigned char *p, int len) -{ - -}