openssh: add sshconfig_fuzz support and authkeys_fuzz seed corpus#15585
openssh: add sshconfig_fuzz support and authkeys_fuzz seed corpus#15585XananasX7 wants to merge 1 commit into
Conversation
- Wire in sshconfig_fuzz: the new SSH client config parser harness (openssh/openssh-portable#680) exercises readconf.c's process_config_line_depth() across all config directives including Match blocks, ProxyCommand, and IdentityFile patterns. - Add authkeys_fuzz seed corpus: authkeys_fuzz.cc exists in the openssh repo and is built by the Makefile but had no seed corpus setup in this build.sh. Add inline seed generation covering plain authorized_keys lines, restricted-key options, and cert entries. - Add sshconfig_fuzz seed corpus: three representative ssh_config snippets (basic Host block, Match block, wildcard Host *) plus the shipped system ssh_config when available.
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
XananasX7 is a new contributor to projects/openssh. The PR must be approved by known contributors before it can be merged. The past contributors are: arthurscchan, hunsche, daztucker, djmdjm, DonggeLiu, inferno-chromium, cvediver, Dor1s |
|
I have read the CLA Document and I hereby sign the CLA |
|
CLA is signed via the Google CLA portal. This PR adds a |
|
Closing this PR — |
Summary
Two improvements to the openssh OSS-Fuzz project:
1. Wire in
sshconfig_fuzz(SSH client config parser)A new harness
sshconfig_fuzz.cchas been added upstream (openssh/openssh-portable#680) coveringreadconf.c— the SSH client configuration file parser. This file is 3957 lines and handles complex, security-sensitive directives:Matchblocks with multi-criteria evaluationProxyCommand/ProxyJumpargument parsingIdentityFile/CertificateFilepath expansionThis parser is exercised every time
sshreads~/.ssh/configbut has had no OSS-Fuzz coverage until now.The build.sh already auto-discovers all
*_fuzz.ccharnesses via:FUZZER_TARGETS=$(cd regress/misc/fuzz-harness && ls *_fuzz.cc | grep -v sntrup761 | ...)This PR adds the seed corpus generation for
sshconfig_fuzz.2. Add missing
authkeys_fuzzseed corpusauthkeys_fuzz.ccexists in the openssh repo and is listed in the upstream Makefile'sTARGETS, but the build.sh had no seed corpus setup for it. This PR adds inline seed generation:authorized_keysentryfrom=,command=restrictionsno-pty,no-x11-forwarding,no-agent-forwardingoptionsTesting
Seed corpus generation uses only
mkdir,printf,cat, andzip— same pattern as other seed sections in this build.sh.