fuzz: some improvements and add two new fuzzers (#1881)

Remove `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` define from
`fuzz/Makefile.am`; it is already included by the main configure script
(when fuzzing).

Add a knob to force disabling of AESNI optimizations: this way we can
fuzz also no-aesni crypto code.

Move CRC32 algorithm into the library.

Add some fake traces to extend fuzzing coverage. Note that these traces
are hand-made (via scapy/curl) and must not be used as "proof" that the
dissectors are really able to identify this kind of traffic.

Some small updates to some dissectors:

CSGO: remove a wrong rule (never triggered, BTW). Any UDP packet starting
with "VS01" will be classified as STEAM (see steam.c around line 111).
Googling it, it seems right so.

XBOX: XBOX only analyses UDP flows while HTTP only TCP ones; therefore
that condition is false.

RTP, STUN: removed useless "break"s

Zattoo: `flow->zattoo_stage` is never set to any values greater or equal
to 5, so these checks are never true.

PPStream: `flow->l4.udp.ppstream_stage` is never read. Delete it.

TeamSpeak: we check for `flow->packet_counter == 3` just above, so the
following check `flow->packet_counter >= 3` is always false.

1 files changed, 43 insertions, 9 deletions

diff --git a/fuzz/fuzz_serialization.cpp b/fuzz/fuzz_serialization.cpp
index 45596e742..f1e66399c 100644
--- a/fuzz/fuzz_serialization.cpp
+++ b/fuzz/fuzz_serialization.cpp
@@ -32,7 +32,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   if (fmt == ndpi_serialization_format_csv)
     ndpi_serializer_set_csv_separator(&serializer, ',');
 
-  num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 16);
+  num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 8);
   for (i = 0; i < num_iteration; i++) {
     memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */
     snprintf(kbuf, sizeof(kbuf), "Key %d", i);
@@ -50,15 +50,24 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     ndpi_serialize_uint32_boolean(&serializer, i, fuzzed_data.ConsumeIntegral<int8_t>());
 
     ndpi_serialize_string_uint32(&serializer, kbuf, fuzzed_data.ConsumeIntegral<u_int32_t>());
+    ndpi_serialize_string_uint32_format(&serializer, kbuf, fuzzed_data.ConsumeIntegral<u_int32_t>(), "%d");
     ndpi_serialize_string_int32(&serializer, kbuf, fuzzed_data.ConsumeIntegral<int32_t>());
     ndpi_serialize_string_uint64(&serializer, kbuf, fuzzed_data.ConsumeIntegral<u_int64_t>());
     ndpi_serialize_string_int64(&serializer, kbuf, fuzzed_data.ConsumeIntegral<int64_t>());
     ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
     if (fmt != ndpi_serialization_format_tlv)
       ndpi_serialize_string_double(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<double>(), "%lf");
+    d = fuzzed_data.ConsumeBytes<char>(16);
+    if (d.size())
+      ndpi_serialize_string_binary(&serializer, kbuf, d.data(), d.size());
     ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str());
+    d = fuzzed_data.ConsumeBytes<char>(16);
+    if (d.size())
+      ndpi_serialize_string_raw(&serializer, kbuf, d.data(), d.size());
     ndpi_serialize_string_boolean(&serializer, kbuf, fuzzed_data.ConsumeIntegral<int8_t>());
 
+    if (fuzzed_data.ConsumeBool())
+      snprintf(kbuf, sizeof(kbuf), "%d", i); /* To trigger OPTIMIZE_NUMERIC_KEYS */
     ndpi_serialize_binary_uint32(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<u_int32_t>());
     ndpi_serialize_binary_int32(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int32_t>());
     ndpi_serialize_binary_uint64(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<u_int64_t>());
@@ -68,7 +77,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
       ndpi_serialize_binary_double(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeFloatingPoint<double>(), "%lf");
     ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int8_t>());
     d = fuzzed_data.ConsumeBytes<char>(16);
-    ndpi_serialize_binary_binary(&serializer, kbuf, sizeof(kbuf), d.data(), d.size());
+    if (d.size())
+      ndpi_serialize_binary_binary(&serializer, kbuf, sizeof(kbuf), d.data(), d.size());
 
     if ((i & 0x3) == 0x3)
       ndpi_serialize_end_of_record(&serializer);
@@ -76,11 +86,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
   ndpi_serializer_create_snapshot(&serializer);
 
+  if (fuzzed_data.ConsumeBool())
+    ndpi_serializer_skip_header(&serializer);
+
   if (fuzzed_data.ConsumeBool()) {
     ndpi_serialize_start_of_block(&serializer, "Block");
     memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */
     snprintf(kbuf, sizeof(kbuf), "K-Ignored");
-    ndpi_serialize_uint32_uint32(&serializer, i, fuzzed_data.ConsumeIntegral<u_int32_t>());
+    ndpi_serialize_uint32_uint32(&serializer, fuzzed_data.ConsumeIntegral<u_int32_t>(), fuzzed_data.ConsumeIntegral<u_int32_t>());
     ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str());
     ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
     ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int8_t>());
@@ -98,12 +111,19 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     ndpi_serialize_end_of_block(&serializer);
   }
 
+  if (fmt == ndpi_serialization_format_json) {
+    if (fuzzed_data.ConsumeBool()) {
+      d = fuzzed_data.ConsumeBytes<char>(8);
+      if (d.size())
+        ndpi_serialize_raw_record(&serializer, (u_char *)d.data(), d.size());
+    }
+  }
+
   if (fuzzed_data.ConsumeBool())
     ndpi_serializer_rollback_snapshot(&serializer);
 
-  if (fmt == ndpi_serialization_format_json) {
-
-    ndpi_serialize_start_of_list(&serializer, "List");
+  rc = ndpi_serialize_start_of_list(&serializer, "List");
+  if (rc == 0) {
 
     num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 8);
     for (i = 0; i < num_iteration; i++) {
@@ -117,18 +137,32 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
     ndpi_serialize_end_of_list(&serializer);
     ndpi_serialize_string_string(&serializer, "Last", "Ok");
-  } else if (fmt == ndpi_serialization_format_csv) {
+  }
+
+  if (fmt == ndpi_serialization_format_csv) {
     ndpi_serializer_get_header(&serializer, &buffer_len);
     ndpi_serializer_get_buffer(&serializer, &buffer_len);
-  } else {
+  } else if (fmt == ndpi_serialization_format_tlv) {
     /* Conversion from tlv to json */
     rc = ndpi_init_deserializer(&deserializer, &serializer);
     if (rc == 0) {
       rc = ndpi_init_serializer_ll(&serializer_cloned, ndpi_serialization_format_json, fuzzed_data.ConsumeIntegralInRange(0, 2048));
       if (rc == 0) {
         ndpi_deserialize_clone_all(&deserializer, &serializer_cloned);
+	ndpi_serializer_get_format(&serializer_cloned);
         ndpi_serializer_get_buffer(&serializer_cloned, &buffer_len);
-        ndpi_term_serializer(&serializer_cloned);
+	ndpi_serializer_get_buffer_len(&serializer_cloned);
+	ndpi_serializer_get_internal_buffer_size(&serializer_cloned);
+	ndpi_term_serializer(&serializer_cloned);
+      }
+    }
+
+    rc = ndpi_init_deserializer(&deserializer, &serializer);
+    if (rc == 0) {
+      rc = ndpi_init_serializer_ll(&serializer_cloned, ndpi_serialization_format_tlv, fuzzed_data.ConsumeIntegralInRange(0, 2048));
+      if (rc == 0) {
+        ndpi_deserialize_clone_item(&deserializer, &serializer_cloned);
+	ndpi_term_serializer(&serializer_cloned);
       }
     }
   }