Support for initial fuzzing through oss-fuzz
Roger A. Light
3 years ago
parent
7c8af215ad
commit
5fb4b05d8f
@ -0,0 +1,9 @@
|
||||
.PHONY: all clean
|
||||
|
||||
all:
|
||||
./generate_packet_corpora.py
|
||||
$(MAKE) -C broker $@
|
||||
|
||||
clean:
|
||||
-rm -rf corpora/broker corpora/client corpora/broker_packet_seed_corpus.zip corpora/client_packet_seed_corpus.zip
|
||||
$(MAKE) -C broker $@
|
||||
@ -0,0 +1,26 @@
|
||||
R=../..
|
||||
.PHONY: all clean
|
||||
|
||||
FUZZERS:= \
|
||||
broker_fuzz_initial_packet \
|
||||
broker_fuzz_second_packet
|
||||
|
||||
LOCAL_CPPFLAGS:=$(CPPFLAGS) -I${R}/include/
|
||||
LOCAL_CXXFLAGS:=$(CXXFLAGS) -g -Wall -Werror -pthread
|
||||
LOCAL_LDFLAGS:=$(LDFLAGS)
|
||||
LOCAL_LIBADD:=$(LIBADD) $(LIB_FUZZING_ENGINE) ${R}/src/mosquitto_broker.a -lssl -lcrypto -lcjson
|
||||
|
||||
all: $(FUZZERS)
|
||||
|
||||
broker_fuzz_initial_packet : broker_fuzz_initial_packet.cpp broker_fuzz.cpp
|
||||
$(CXX) $(LOCAL_CXXFLAGS) $(LOCAL_CPPFLAGS) $(LOCAL_LDFLAGS) -o $@ $^ $(LOCAL_LIBADD)
|
||||
install $@ ${OUT}/$@
|
||||
cp ${R}/fuzzing/corpora/broker_packet_seed_corpus.zip $@_seed_corpus.zip
|
||||
|
||||
broker_fuzz_second_packet : broker_fuzz_second_packet.cpp broker_fuzz.cpp
|
||||
$(CXX) $(LOCAL_CXXFLAGS) $(LOCAL_CPPFLAGS) $(LOCAL_LDFLAGS) -o $@ $^ $(LOCAL_LIBADD)
|
||||
install $@ ${OUT}/$@
|
||||
cp ${R}/fuzzing/corpora/broker_packet_seed_corpus.zip $@_seed_corpus.zip
|
||||
|
||||
clean:
|
||||
rm -f *.o $(FUZZERS)
|
||||
@ -0,0 +1,116 @@
|
||||
/*
|
||||
Copyright (c) 2023 Cedalo GmbH
|
||||
|
||||
All rights reserved. This program and the accompanying materials
|
||||
are made available under the terms of the Eclipse Public License 2.0
|
||||
and Eclipse Distribution License v1.0 which accompany this distribution.
|
||||
|
||||
The Eclipse Public License is available at
|
||||
https://www.eclipse.org/legal/epl-2.0/
|
||||
and the Eclipse Distribution License is available at
|
||||
http://www.eclipse.org/org/documents/edl-v10.php.
|
||||
|
||||
SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
|
||||
|
||||
Contributors:
|
||||
Roger Light - initial implementation and documentation.
|
||||
*/
|
||||
|
||||
#include <arpa/inet.h>
|
||||
#include <errno.h>
|
||||
#include <netinet/in.h>
|
||||
#include <pthread.h>
|
||||
#include <signal.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "broker_fuzz.h"
|
||||
|
||||
/* The broker fuzz-only main function. */
|
||||
extern "C" int mosquitto_fuzz_main(int argc, char *argv[]);
|
||||
|
||||
void *run_broker(void *args)
|
||||
{
|
||||
struct fuzz_data *fuzz = (struct fuzz_data *)args;
|
||||
char *argv[4];
|
||||
int argc = 4;
|
||||
char buf[20];
|
||||
|
||||
argv[0] = strdup("mosquitto");
|
||||
argv[1] = strdup("-q");
|
||||
argv[2] = strdup("-p");
|
||||
snprintf(buf, sizeof(buf), "%d", fuzz->port);
|
||||
argv[3] = buf;
|
||||
|
||||
mosquitto_fuzz_main(argc, argv);
|
||||
|
||||
for(int i=0; i<3; i++){
|
||||
free(argv[i]);
|
||||
}
|
||||
|
||||
pthread_exit(NULL);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
void recv_timeout(int sock, void *buf, size_t len, int timeout_us)
|
||||
{
|
||||
struct timeval tv = {0, timeout_us};
|
||||
|
||||
setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, (const char *)&tv, sizeof(tv));
|
||||
(void)recv(sock, buf, len, 0);
|
||||
}
|
||||
|
||||
int connect_retrying(int port)
|
||||
{
|
||||
struct sockaddr_in addr;
|
||||
int sock;
|
||||
int rc;
|
||||
|
||||
memset(&addr, 0, sizeof(addr));
|
||||
addr.sin_family = AF_INET;
|
||||
addr.sin_port = htons(port);
|
||||
addr.sin_addr.s_addr = inet_addr("127.0.0.1");
|
||||
|
||||
sock = socket(AF_INET, SOCK_STREAM, 0);
|
||||
for(int i=0; i<500; i++){ /* 500x10ms = 5 seconds max wait */
|
||||
errno = 0;
|
||||
rc = connect(sock, (struct sockaddr *)&addr, sizeof(addr));
|
||||
if(rc < 0 && errno == ECONNREFUSED){
|
||||
struct timespec ts;
|
||||
ts.tv_sec = 0;
|
||||
ts.tv_nsec = 10000000; /* 10ms */
|
||||
nanosleep(&ts, NULL);
|
||||
}else if(rc < 0){
|
||||
return -1;
|
||||
}else{
|
||||
break;
|
||||
}
|
||||
}
|
||||
return sock;
|
||||
}
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
|
||||
{
|
||||
struct fuzz_data fuzz;
|
||||
pthread_t thread;
|
||||
|
||||
if(size < kMinInputLength || size > kMaxInputLength){
|
||||
return 0;
|
||||
}
|
||||
|
||||
signal(SIGPIPE, SIG_IGN);
|
||||
|
||||
memset(&fuzz, 0, sizeof(fuzz));
|
||||
fuzz.port = 1883;
|
||||
fuzz.size = size;
|
||||
fuzz.data = (uint8_t *)data;
|
||||
|
||||
pthread_create(&thread, NULL, run_broker, &fuzz);
|
||||
run_client(&fuzz);
|
||||
pthread_join(thread, NULL);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@ -0,0 +1,35 @@
|
||||
/*
|
||||
Copyright (c) 2023 Cedalo GmbH
|
||||
|
||||
All rights reserved. This program and the accompanying materials
|
||||
are made available under the terms of the Eclipse Public License 2.0
|
||||
and Eclipse Distribution License v1.0 which accompany this distribution.
|
||||
|
||||
The Eclipse Public License is available at
|
||||
https://www.eclipse.org/legal/epl-2.0/
|
||||
and the Eclipse Distribution License is available at
|
||||
http://www.eclipse.org/org/documents/edl-v10.php.
|
||||
|
||||
SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
|
||||
|
||||
Contributors:
|
||||
Roger Light - initial implementation and documentation.
|
||||
*/
|
||||
#ifndef BROKER_FUZZ_H
|
||||
#define BROKER_FUZZ_H
|
||||
|
||||
#define kMinInputLength 5
|
||||
#define kMaxInputLength 10000
|
||||
|
||||
struct fuzz_data{
|
||||
uint8_t *data;
|
||||
size_t size;
|
||||
uint16_t port;
|
||||
};
|
||||
|
||||
void *run_broker(void *args);
|
||||
void recv_timeout(int sock, void *buf, size_t len, int timeout_us);
|
||||
int connect_retrying(int port);
|
||||
void run_client(struct fuzz_data *fuzz);
|
||||
|
||||
#endif
|
||||
@ -0,0 +1,56 @@
|
||||
/*
|
||||
Copyright (c) 2023 Cedalo GmbH
|
||||
|
||||
All rights reserved. This program and the accompanying materials
|
||||
are made available under the terms of the Eclipse Public License 2.0
|
||||
and Eclipse Distribution License v1.0 which accompany this distribution.
|
||||
|
||||
The Eclipse Public License is available at
|
||||
https://www.eclipse.org/legal/epl-2.0/
|
||||
and the Eclipse Distribution License is available at
|
||||
http://www.eclipse.org/org/documents/edl-v10.php.
|
||||
|
||||
SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
|
||||
|
||||
Contributors:
|
||||
Roger Light - initial implementation and documentation.
|
||||
*/
|
||||
|
||||
#include <cerrno>
|
||||
#include <cstdint>
|
||||
#include <cstdlib>
|
||||
#include <cstring>
|
||||
#include <sys/socket.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include "broker_fuzz.h"
|
||||
|
||||
/* Set to 0 to cause the broker to exit */
|
||||
extern int g_run;
|
||||
|
||||
/*
|
||||
* This tests the first packet being sent to the broker only, with no authentication.
|
||||
*/
|
||||
void run_client(struct fuzz_data *fuzz)
|
||||
{
|
||||
int sock;
|
||||
uint8_t data[20];
|
||||
size_t len;
|
||||
|
||||
sock = connect_retrying(fuzz->port);
|
||||
if(sock < 0){
|
||||
abort();
|
||||
}
|
||||
|
||||
errno = 0;
|
||||
len = send(sock, fuzz->data, fuzz->size, 0);
|
||||
if(len < fuzz->size){
|
||||
abort();
|
||||
}
|
||||
|
||||
errno = 0;
|
||||
recv_timeout(sock, data, sizeof(data), 100000);
|
||||
close(sock);
|
||||
|
||||
g_run = 0;
|
||||
}
|
||||
@ -0,0 +1,70 @@
|
||||
/*
|
||||
Copyright (c) 2023 Cedalo GmbH
|
||||
|
||||
All rights reserved. This program and the accompanying materials
|
||||
are made available under the terms of the Eclipse Public License 2.0
|
||||
and Eclipse Distribution License v1.0 which accompany this distribution.
|
||||
|
||||
The Eclipse Public License is available at
|
||||
https://www.eclipse.org/legal/epl-2.0/
|
||||
and the Eclipse Distribution License is available at
|
||||
http://www.eclipse.org/org/documents/edl-v10.php.
|
||||
|
||||
SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
|
||||
|
||||
Contributors:
|
||||
Roger Light - initial implementation and documentation.
|
||||
*/
|
||||
#include <cstdlib>
|
||||
#include <cstring>
|
||||
#include <cstdint>
|
||||
#include <cerrno>
|
||||
#include <sys/socket.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include "broker_fuzz.h"
|
||||
|
||||
extern int g_run;
|
||||
|
||||
/*
|
||||
* This tests the second packet sent to the broker after the client has already
|
||||
* connected, with no authentication.
|
||||
*/
|
||||
void run_client(struct fuzz_data *fuzz)
|
||||
{
|
||||
int sock;
|
||||
const uint8_t connect_packet[] = {0x10, 0x0D, 0x00, 0x04, 0x4D, 0x51, 0x54, 0x54, 0x04, 0x02, 0x00, 0x0A, 0x00, 0x01, 0x70};
|
||||
const uint8_t connack_packet[] = {0x20, 0x02, 0x00, 0x00};
|
||||
uint8_t data[20];
|
||||
size_t len;
|
||||
|
||||
sock = connect_retrying(fuzz->port);
|
||||
if(sock < 0){
|
||||
abort();
|
||||
}
|
||||
|
||||
/* Do initial connect */
|
||||
errno = 0;
|
||||
len = send(sock, connect_packet, sizeof(connect_packet), 0);
|
||||
if(len < 0){
|
||||
abort();
|
||||
}
|
||||
|
||||
/* And receive the CONNACK */
|
||||
recv_timeout(sock, data, sizeof(connack_packet), 100000);
|
||||
if(memcmp(data, connack_packet, sizeof(connack_packet))){
|
||||
abort();
|
||||
}
|
||||
|
||||
errno = 0;
|
||||
len = send(sock, fuzz->data, fuzz->size, 0);
|
||||
if(len < fuzz->size){
|
||||
abort();
|
||||
}
|
||||
|
||||
errno = 0;
|
||||
recv_timeout(sock, data, sizeof(data), 100000);
|
||||
close(sock);
|
||||
|
||||
g_run = 0;
|
||||
}
|
||||
@ -0,0 +1,57 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
from collections import deque
|
||||
from os import mkdir,walk
|
||||
from pathlib import Path
|
||||
import json
|
||||
import re
|
||||
import shutil
|
||||
|
||||
def gen_packet_corpus(packet_type, input_path):
|
||||
try:
|
||||
mkdir("corpora")
|
||||
except FileExistsError:
|
||||
pass
|
||||
try:
|
||||
mkdir(f"corpora/{packet_type}")
|
||||
except FileExistsError:
|
||||
pass
|
||||
|
||||
data_path=Path(input_path)
|
||||
rc = 0
|
||||
sequences = []
|
||||
for (_, _, filenames) in walk(data_path):
|
||||
sequences.extend(filenames)
|
||||
break
|
||||
|
||||
written_packets = {}
|
||||
for seq in sorted(sequences):
|
||||
if seq[-5:] != ".json":
|
||||
continue
|
||||
|
||||
with open(data_path/seq, "r") as f:
|
||||
test_file = json.load(f)
|
||||
|
||||
for g in test_file:
|
||||
group_name = g["group"]
|
||||
tests = g["tests"]
|
||||
|
||||
for t in tests:
|
||||
tname = group_name + " " + t["name"]
|
||||
|
||||
fuzzi = 1
|
||||
for m in t["msgs"]:
|
||||
if m["type"] == "send" or m["type"] == "recv":
|
||||
fname = re.sub(r'[ \[\]\(\)]+', '-', tname) + str(fuzzi) + ".raw"
|
||||
payload = m["payload"].replace(" ", "")
|
||||
|
||||
# No duplicates please
|
||||
if payload not in written_packets:
|
||||
written_packets[payload] = 1
|
||||
with open(f"corpora/{packet_type}/{fname}", "wb") as f:
|
||||
f.write(bytes.fromhex(payload))
|
||||
fuzzi += 1
|
||||
shutil.make_archive(f"corpora/{packet_type}_packet_seed_corpus", 'zip', f"corpora/{packet_type}")
|
||||
|
||||
gen_packet_corpus("broker", "../test/broker/data")
|
||||
gen_packet_corpus("client", "../test/lib/data")
|
||||
@ -0,0 +1,30 @@
|
||||
#!/bin/bash -eu
|
||||
#
|
||||
# Copyright (c) 2023 Cedalo GmbH
|
||||
#
|
||||
# All rights reserved. This program and the accompanying materials
|
||||
# are made available under the terms of the Eclipse Public License 2.0
|
||||
# and Eclipse Distribution License v1.0 which accompany this distribution.
|
||||
#
|
||||
# The Eclipse Public License is available at
|
||||
# https://www.eclipse.org/legal/epl-2.0/
|
||||
# and the Eclipse Distribution License is available at
|
||||
# http://www.eclipse.org/org/documents/edl-v10.php.
|
||||
#
|
||||
# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
|
||||
#
|
||||
# Contributors:
|
||||
# Roger Light - initial implementation and documentation.
|
||||
|
||||
|
||||
# Build direct broker dependency - cJSON
|
||||
# Note that other dependencies, i.e. sqlite are not yet built because they are
|
||||
# only used by plugins and not currently otherwise used.
|
||||
cd ${SRC}/cJSON
|
||||
cmake -DBUILD_SHARED_LIBS=OFF -DENABLE_CJSON_TEST=OFF -DCMAKE_C_FLAGS=-fPIC .
|
||||
make
|
||||
make install
|
||||
|
||||
# Build broker and library static libraries
|
||||
cd ${SRC}/mosquitto
|
||||
make WITH_STATIC_LIBRARIES=yes WITH_DOCS=no WITH_FUZZING=yes
|
||||
@ -0,0 +1,24 @@
|
||||
#!/bin/bash -eu
|
||||
#
|
||||
# Copyright (c) 2023 Cedalo GmbH
|
||||
#
|
||||
# All rights reserved. This program and the accompanying materials
|
||||
# are made available under the terms of the Eclipse Public License 2.0
|
||||
# and Eclipse Distribution License v1.0 which accompany this distribution.
|
||||
#
|
||||
# The Eclipse Public License is available at
|
||||
# https://www.eclipse.org/legal/epl-2.0/
|
||||
# and the Eclipse Distribution License is available at
|
||||
# http://www.eclipse.org/org/documents/edl-v10.php.
|
||||
#
|
||||
# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
|
||||
#
|
||||
# Contributors:
|
||||
# Roger Light - initial implementation and documentation.
|
||||
|
||||
|
||||
# Note that sqlite3 is required as a build dep of a plugin which is not
|
||||
# currently part of fuzz testing. Once it is part of fuzz testing, sqlite will
|
||||
# need to be built statically.
|
||||
apt-get update && apt-get install -y libtool-bin make libsqlite3-dev
|
||||
git clone https://github.com/DaveGamble/cJSON ${SRC}/cJSON
|
||||
Loading…
Reference in New Issue