diff options
Diffstat (limited to 'fuzz')
-rw-r--r-- | fuzz/fuzz_common_code.c | 5 | ||||
-rw-r--r-- | fuzz/fuzz_common_code.h | 3 | ||||
-rw-r--r-- | fuzz/fuzz_config.cpp | 58 | ||||
-rw-r--r-- | fuzz/fuzz_dga.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_filecfg_categories.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_filecfg_category.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_filecfg_config.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_filecfg_malicious_ja3.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_filecfg_malicious_sha1.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_filecfg_protocols.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_filecfg_risk_domains.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_is_stun.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_ndpi_reader.c | 5 | ||||
-rw-r--r-- | fuzz/fuzz_process_packet.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_quic_get_crypto_data.c | 2 | ||||
-rw-r--r-- | fuzz/fuzz_readerutils_workflow.cpp | 7 | ||||
-rw-r--r-- | fuzz/fuzz_tls_certificate.c | 2 |
17 files changed, 83 insertions, 19 deletions
diff --git a/fuzz/fuzz_common_code.c b/fuzz/fuzz_common_code.c index f0f75514e..08147d635 100644 --- a/fuzz/fuzz_common_code.c +++ b/fuzz/fuzz_common_code.c @@ -34,12 +34,13 @@ void fuzz_set_alloc_callbacks_and_seed(int seed) fuzz_set_alloc_seed(seed); } -void fuzz_init_detection_module(struct ndpi_detection_module_struct **ndpi_info_mod) +void fuzz_init_detection_module(struct ndpi_detection_module_struct **ndpi_info_mod, + struct ndpi_global_context *g_ctx) { NDPI_PROTOCOL_BITMASK all; if(*ndpi_info_mod == NULL) { - *ndpi_info_mod = ndpi_init_detection_module(); + *ndpi_info_mod = ndpi_init_detection_module(g_ctx); ndpi_set_config_u64(*ndpi_info_mod, NULL, "log.level", 3); ndpi_set_config(*ndpi_info_mod, "all", "log", "enable"); diff --git a/fuzz/fuzz_common_code.h b/fuzz/fuzz_common_code.h index c5e4fb9c9..e2a158664 100644 --- a/fuzz/fuzz_common_code.h +++ b/fuzz/fuzz_common_code.h @@ -8,7 +8,8 @@ extern "C" { #endif -void fuzz_init_detection_module(struct ndpi_detection_module_struct **ndpi_info_mod); +void fuzz_init_detection_module(struct ndpi_detection_module_struct **ndpi_info_mod, + struct ndpi_global_context *g_ctx); /* To allow memory allocation failures */ void fuzz_set_alloc_callbacks(void); diff --git a/fuzz/fuzz_config.cpp b/fuzz/fuzz_config.cpp index 6f8ea2b9f..daf2b561c 100644 --- a/fuzz/fuzz_config.cpp +++ b/fuzz/fuzz_config.cpp @@ -27,6 +27,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { struct ndpi_flow_input_info input_info; ndpi_proto p, p2; char out[128]; + struct ndpi_global_context *g_ctx; char log_ts[32]; int value; char cfg_value[32]; @@ -37,7 +38,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_info_mod = ndpi_init_detection_module(); + if(fuzzed_data.ConsumeBool()) + g_ctx = ndpi_global_init(); + else + g_ctx = NULL; + + ndpi_info_mod = ndpi_init_detection_module(g_ctx); set_ndpi_debug_function(ndpi_info_mod, NULL); @@ -271,6 +277,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_set_config(ndpi_info_mod, NULL, "lru.ookla.ttl", cfg_value); } if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.ookla.scope", cfg_value); + } + if(fuzzed_data.ConsumeBool()) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.bittorrent.size", cfg_value); @@ -281,6 +292,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_set_config(ndpi_info_mod, NULL, "lru.bittorrent.ttl", cfg_value); } if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.bittorrent.scope", cfg_value); + } + if(fuzzed_data.ConsumeBool()) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.zoom.size", cfg_value); @@ -291,6 +307,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_set_config(ndpi_info_mod, NULL, "lru.zoom.ttl", cfg_value); } if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.zoom.scope", cfg_value); + } + if(fuzzed_data.ConsumeBool()) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.stun.size", cfg_value); @@ -301,6 +322,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_set_config(ndpi_info_mod, NULL, "lru.stun.ttl", cfg_value); } if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.stun.scope", cfg_value); + } + if(fuzzed_data.ConsumeBool()) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.tls_cert.size", cfg_value); @@ -311,6 +337,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_set_config(ndpi_info_mod, NULL, "lru.tls_cert.ttl", cfg_value); } if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.tls_cert.scope", cfg_value); + } + if(fuzzed_data.ConsumeBool()) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.mining.size", cfg_value); @@ -321,6 +352,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_set_config(ndpi_info_mod, NULL, "lru.mining.ttl", cfg_value); } if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.mining.scope", cfg_value); + } + if(fuzzed_data.ConsumeBool()) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.msteams.size", cfg_value); @@ -331,6 +367,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_set_config(ndpi_info_mod, NULL, "lru.msteams.ttl", cfg_value); } if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.msteams.scope", cfg_value); + } + if(fuzzed_data.ConsumeBool()) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.stun_zoom.size", cfg_value); @@ -340,6 +381,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, "lru.stun_zoom.ttl", cfg_value); } + if(fuzzed_data.ConsumeBool()) { + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, "lru.stun_zoom.scope", cfg_value); + } /* Configure one cache via index */ if(fuzzed_data.ConsumeBool()) { idx = fuzzed_data.ConsumeIntegralInRange(0, static_cast<int>(NDPI_LRUCACHE_MAX)); @@ -347,10 +393,16 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if(name) { value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 / 2); /* max / 2 instead of max + 1 to avoid oom on oss-fuzzer */ sprintf(cfg_param, "lru.%s.size", name); + sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, cfg_param, cfg_value); ndpi_get_config(ndpi_info_mod, NULL, cfg_param, cfg_value, sizeof(cfg_value)); value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 + 1); sprintf(cfg_param, "lru.%s.ttl", name); + sprintf(cfg_value, "%d", value); + ndpi_set_config(ndpi_info_mod, NULL, cfg_param, cfg_value); + value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1); + sprintf(cfg_param, "lru.%s.scope", name); + sprintf(cfg_value, "%d", value); ndpi_set_config(ndpi_info_mod, NULL, cfg_param, cfg_value); ndpi_get_config(ndpi_info_mod, NULL, cfg_param, cfg_value, sizeof(cfg_value)); } @@ -500,7 +552,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* Get some final stats */ for(i = 0; i < NDPI_LRUCACHE_MAX + 1; i++) /* + 1 to test invalid type */ - ndpi_get_lru_cache_stats(ndpi_info_mod, static_cast<lru_cache_type>(i), &lru_stats); + ndpi_get_lru_cache_stats(g_ctx, ndpi_info_mod, static_cast<lru_cache_type>(i), &lru_stats); for(i = 0; i < NDPI_PTREE_MAX + 1; i++) /* + 1 to test invalid type */ ndpi_get_patricia_stats(ndpi_info_mod, static_cast<ptree_type>(i), &patricia_stats); for(i = 0; i < NDPI_AUTOMA_MAX + 1; i++) /* + 1 to test invalid type */ @@ -523,5 +575,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_exit_detection_module(ndpi_info_mod); + ndpi_global_deinit(g_ctx); + return 0; } diff --git a/fuzz/fuzz_dga.c b/fuzz/fuzz_dga.c index 3b09550ff..2635e64f5 100644 --- a/fuzz/fuzz_dga.c +++ b/fuzz/fuzz_dga.c @@ -13,7 +13,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { char *name; if (ndpi_struct == NULL) { - fuzz_init_detection_module(&ndpi_struct); + fuzz_init_detection_module(&ndpi_struct, NULL); ndpi_flow = ndpi_calloc(1, sizeof(struct ndpi_flow_struct)); } diff --git a/fuzz/fuzz_filecfg_categories.c b/fuzz/fuzz_filecfg_categories.c index 00e922c2f..9e24b6c03 100644 --- a/fuzz/fuzz_filecfg_categories.c +++ b/fuzz/fuzz_filecfg_categories.c @@ -10,7 +10,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_struct = ndpi_init_detection_module(); + ndpi_struct = ndpi_init_detection_module(NULL); NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all); diff --git a/fuzz/fuzz_filecfg_category.c b/fuzz/fuzz_filecfg_category.c index 757ada01f..3e6de6edd 100644 --- a/fuzz/fuzz_filecfg_category.c +++ b/fuzz/fuzz_filecfg_category.c @@ -10,7 +10,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_struct = ndpi_init_detection_module(); + ndpi_struct = ndpi_init_detection_module(NULL); NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all); diff --git a/fuzz/fuzz_filecfg_config.c b/fuzz/fuzz_filecfg_config.c index 6a096d75e..f9af6a59e 100644 --- a/fuzz/fuzz_filecfg_config.c +++ b/fuzz/fuzz_filecfg_config.c @@ -10,7 +10,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_struct = ndpi_init_detection_module(); + ndpi_struct = ndpi_init_detection_module(NULL); NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all); diff --git a/fuzz/fuzz_filecfg_malicious_ja3.c b/fuzz/fuzz_filecfg_malicious_ja3.c index 9c32fc227..3d7b4e70b 100644 --- a/fuzz/fuzz_filecfg_malicious_ja3.c +++ b/fuzz/fuzz_filecfg_malicious_ja3.c @@ -10,7 +10,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_struct = ndpi_init_detection_module(); + ndpi_struct = ndpi_init_detection_module(NULL); NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all); diff --git a/fuzz/fuzz_filecfg_malicious_sha1.c b/fuzz/fuzz_filecfg_malicious_sha1.c index ef056f9c8..6685b5d6e 100644 --- a/fuzz/fuzz_filecfg_malicious_sha1.c +++ b/fuzz/fuzz_filecfg_malicious_sha1.c @@ -10,7 +10,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_struct = ndpi_init_detection_module(); + ndpi_struct = ndpi_init_detection_module(NULL); NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all); diff --git a/fuzz/fuzz_filecfg_protocols.c b/fuzz/fuzz_filecfg_protocols.c index 9a5bba43c..b42cb6524 100644 --- a/fuzz/fuzz_filecfg_protocols.c +++ b/fuzz/fuzz_filecfg_protocols.c @@ -10,7 +10,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_struct = ndpi_init_detection_module(); + ndpi_struct = ndpi_init_detection_module(NULL); NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all); diff --git a/fuzz/fuzz_filecfg_risk_domains.c b/fuzz/fuzz_filecfg_risk_domains.c index 4e482c783..bb3677c16 100644 --- a/fuzz/fuzz_filecfg_risk_domains.c +++ b/fuzz/fuzz_filecfg_risk_domains.c @@ -10,7 +10,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* To allow memory allocation failures */ fuzz_set_alloc_callbacks_and_seed(size); - ndpi_struct = ndpi_init_detection_module(); + ndpi_struct = ndpi_init_detection_module(NULL); NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all); diff --git a/fuzz/fuzz_is_stun.c b/fuzz/fuzz_is_stun.c index dc1c98f07..76576f100 100644 --- a/fuzz/fuzz_is_stun.c +++ b/fuzz/fuzz_is_stun.c @@ -21,7 +21,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { struct ndpi_packet_struct *packet; if (ndpi_struct == NULL) { - fuzz_init_detection_module(&ndpi_struct); + fuzz_init_detection_module(&ndpi_struct, NULL); } packet = &ndpi_struct->packet; diff --git a/fuzz/fuzz_ndpi_reader.c b/fuzz/fuzz_ndpi_reader.c index 7b0268eed..9d53918e3 100644 --- a/fuzz/fuzz_ndpi_reader.c +++ b/fuzz/fuzz_ndpi_reader.c @@ -10,6 +10,7 @@ struct ndpi_workflow_prefs *prefs = NULL; struct ndpi_workflow *workflow = NULL; +struct ndpi_global_context *g_ctx; u_int8_t enable_payload_analyzer = 0; u_int8_t enable_flow_stats = 1; @@ -48,7 +49,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { fuzz_set_alloc_callbacks(); #endif - workflow = ndpi_workflow_init(prefs, NULL /* pcap handler will be set later */, 0, ndpi_serialization_format_json); + g_ctx = ndpi_global_init(); + + workflow = ndpi_workflow_init(prefs, NULL /* pcap handler will be set later */, 0, ndpi_serialization_format_json, g_ctx); ndpi_set_config(workflow->ndpi_struct, NULL, "log.level", "3"); ndpi_set_config(workflow->ndpi_struct, "all", "log", "1"); diff --git a/fuzz/fuzz_process_packet.c b/fuzz/fuzz_process_packet.c index 2098f4fd1..c570c3fd6 100644 --- a/fuzz/fuzz_process_packet.c +++ b/fuzz/fuzz_process_packet.c @@ -13,7 +13,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { uint8_t protocol_was_guessed; if (ndpi_info_mod == NULL) { - fuzz_init_detection_module(&ndpi_info_mod); + fuzz_init_detection_module(&ndpi_info_mod, NULL); ndpi_init_serializer(&json_serializer, ndpi_serialization_format_json); ndpi_init_serializer(&csv_serializer, ndpi_serialization_format_csv); diff --git a/fuzz/fuzz_quic_get_crypto_data.c b/fuzz/fuzz_quic_get_crypto_data.c index 86a2ec32f..16c95ab47 100644 --- a/fuzz/fuzz_quic_get_crypto_data.c +++ b/fuzz/fuzz_quic_get_crypto_data.c @@ -14,7 +14,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { u_int32_t first_int, version = 0; if(ndpi_info_mod == NULL) { - fuzz_init_detection_module(&ndpi_info_mod); + fuzz_init_detection_module(&ndpi_info_mod, NULL); flow = ndpi_calloc(1, SIZEOF_FLOW_STRUCT); } diff --git a/fuzz/fuzz_readerutils_workflow.cpp b/fuzz/fuzz_readerutils_workflow.cpp index a3aea2e11..9087a72c1 100644 --- a/fuzz/fuzz_readerutils_workflow.cpp +++ b/fuzz/fuzz_readerutils_workflow.cpp @@ -17,6 +17,7 @@ int malloc_size_stats = 0; extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { FuzzedDataProvider fuzzed_data(data, size); ndpi_workflow *w; + struct ndpi_global_context *g_ctx; struct ndpi_workflow_prefs prefs; pcap_t *pcap_handle; ndpi_serialization_format serialization_format; @@ -82,7 +83,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { return 0; } - w = ndpi_workflow_init(&prefs, pcap_handle, 1, serialization_format); + g_ctx = ndpi_global_init(); + + w = ndpi_workflow_init(&prefs, pcap_handle, 1, serialization_format, g_ctx); if(w) { NDPI_BITMASK_SET_ALL(enabled_bitmask); rc = ndpi_set_protocol_detection_bitmask2(w->ndpi_struct, &enabled_bitmask); @@ -101,6 +104,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { } pcap_close(pcap_handle); + ndpi_global_deinit(g_ctx); + ndpi_free(_debug_protocols); return 0; diff --git a/fuzz/fuzz_tls_certificate.c b/fuzz/fuzz_tls_certificate.c index 0843a30fe..9f38dd52c 100644 --- a/fuzz/fuzz_tls_certificate.c +++ b/fuzz/fuzz_tls_certificate.c @@ -17,7 +17,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { int is_ipv6; if (ndpi_struct == NULL) { - fuzz_init_detection_module(&ndpi_struct); + fuzz_init_detection_module(&ndpi_struct, NULL); ndpi_flow = ndpi_calloc(1, sizeof(struct ndpi_flow_struct)); } |