82 lines
2.8 KiB
Plaintext
82 lines
2.8 KiB
Plaintext
Kadmind Fuzzing Corpus
|
|
======================
|
|
|
|
This directory contains seed inputs for fuzzing kadmind RPC handling.
|
|
|
|
Usage
|
|
-----
|
|
|
|
Run kadmind in fuzzing mode:
|
|
|
|
./kadmind --fuzz-stdin < corpus_file.bin > output.bin
|
|
|
|
Or with a specific realm:
|
|
|
|
./kadmind -r MY.REALM --fuzz-stdin < corpus_file.bin
|
|
|
|
Message Format
|
|
--------------
|
|
|
|
Each corpus file contains a length-prefixed message:
|
|
|
|
[4-byte big-endian length][message payload]
|
|
|
|
The message payload starts with a 4-byte command number (kadm_ops enum):
|
|
|
|
kadm_get = 0 - Get principal
|
|
kadm_delete = 1 - Delete principal
|
|
kadm_create = 2 - Create principal
|
|
kadm_rename = 3 - Rename principal
|
|
kadm_chpass = 4 - Change password
|
|
kadm_modify = 5 - Modify principal
|
|
kadm_randkey = 6 - Randomize keys
|
|
kadm_get_privs = 7 - Get admin privileges
|
|
kadm_get_princs = 8 - List principals
|
|
kadm_chpass_with_key = 9 - Change password with explicit keys
|
|
kadm_nop = 10 - No operation (ping/interrupt)
|
|
kadm_prune = 11 - Prune old keys
|
|
|
|
Corpus Files
|
|
------------
|
|
|
|
Normal operations:
|
|
nop_reply.bin - NOP with reply requested
|
|
nop_noreply.bin - NOP without reply (interrupt)
|
|
get_principal.bin - GET with basic mask
|
|
get_principal_all.bin - GET with all fields
|
|
delete_principal.bin - DELETE principal
|
|
create_principal.bin - CREATE with minimal fields
|
|
create_principal_attrs.bin - CREATE with attributes
|
|
modify_principal.bin - MODIFY principal
|
|
rename_principal.bin - RENAME principal
|
|
chpass_principal.bin - CHPASS
|
|
chpass_principal_keepold.bin - CHPASS keeping old keys
|
|
randkey_principal.bin - RANDKEY simple
|
|
randkey_principal_full.bin - RANDKEY with ks_tuples
|
|
get_privs.bin - GET_PRIVS
|
|
get_princs_all.bin - LIST all principals
|
|
get_princs_expr.bin - LIST with expression
|
|
get_princs_iter.bin - LIST with online iteration
|
|
prune_principal.bin - PRUNE to specific kvno
|
|
prune_principal_all.bin - PRUNE (no kvno)
|
|
chpass_with_key.bin - CHPASS_WITH_KEY
|
|
create_with_tldata.bin - CREATE with TL_DATA
|
|
create_empty_password.bin - CREATE with empty password
|
|
|
|
Edge cases and malformed inputs:
|
|
invalid_cmd.bin - Invalid command number
|
|
truncated_get.bin - GET with missing data
|
|
malformed_principal.bin - Bad principal encoding
|
|
long_principal.bin - Very long principal name
|
|
many_components.bin - Principal with many components
|
|
large_nkeydata.bin - Large n_key_data (overflow test)
|
|
negative_nkeydata.bin - Negative n_key_data
|
|
empty_message.bin - Zero-length message
|
|
|
|
Regenerating
|
|
------------
|
|
|
|
Run gen_corpus.py to regenerate all corpus files:
|
|
|
|
python3 gen_corpus.py
|