Kadmind Fuzzing Corpus
======================

This directory contains seed inputs for fuzzing kadmind RPC handling.

Usage
-----

Run kadmind in fuzzing mode:

    ./kadmind --fuzz-stdin < corpus_file.bin > output.bin

Or with a specific realm:

    ./kadmind -r MY.REALM --fuzz-stdin < corpus_file.bin

Message Format
--------------

Each corpus file contains a length-prefixed message:

    [4-byte big-endian length][message payload]

The message payload starts with a 4-byte command number (kadm_ops enum):

    kadm_get           = 0   - Get principal
    kadm_delete        = 1   - Delete principal
    kadm_create        = 2   - Create principal
    kadm_rename        = 3   - Rename principal
    kadm_chpass        = 4   - Change password
    kadm_modify        = 5   - Modify principal
    kadm_randkey       = 6   - Randomize keys
    kadm_get_privs     = 7   - Get admin privileges
    kadm_get_princs    = 8   - List principals
    kadm_chpass_with_key = 9 - Change password with explicit keys
    kadm_nop           = 10  - No operation (ping/interrupt)
    kadm_prune         = 11  - Prune old keys

Corpus Files
------------

Normal operations:
  nop_reply.bin              - NOP with reply requested
  nop_noreply.bin            - NOP without reply (interrupt)
  get_principal.bin          - GET with basic mask
  get_principal_all.bin      - GET with all fields
  delete_principal.bin       - DELETE principal
  create_principal.bin       - CREATE with minimal fields
  create_principal_attrs.bin - CREATE with attributes
  modify_principal.bin       - MODIFY principal
  rename_principal.bin       - RENAME principal
  chpass_principal.bin       - CHPASS
  chpass_principal_keepold.bin - CHPASS keeping old keys
  randkey_principal.bin      - RANDKEY simple
  randkey_principal_full.bin - RANDKEY with ks_tuples
  get_privs.bin              - GET_PRIVS
  get_princs_all.bin         - LIST all principals
  get_princs_expr.bin        - LIST with expression
  get_princs_iter.bin        - LIST with online iteration
  prune_principal.bin        - PRUNE to specific kvno
  prune_principal_all.bin    - PRUNE (no kvno)
  chpass_with_key.bin        - CHPASS_WITH_KEY
  create_with_tldata.bin     - CREATE with TL_DATA
  create_empty_password.bin  - CREATE with empty password

Edge cases and malformed inputs:
  invalid_cmd.bin            - Invalid command number
  truncated_get.bin          - GET with missing data
  malformed_principal.bin    - Bad principal encoding
  long_principal.bin         - Very long principal name
  many_components.bin        - Principal with many components
  large_nkeydata.bin         - Large n_key_data (overflow test)
  negative_nkeydata.bin      - Negative n_key_data
  empty_message.bin          - Zero-length message

Regenerating
------------

Run gen_corpus.py to regenerate all corpus files:

    python3 gen_corpus.py