From b51a2ac72a3cbd1b470890d0151a46da28e6754e Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Thu, 9 Feb 2023 20:02:12 +0100 Subject: fuzz: some improvements and add two new fuzzers (#1881) Remove `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` define from `fuzz/Makefile.am`; it is already included by the main configure script (when fuzzing). Add a knob to force disabling of AESNI optimizations: this way we can fuzz also no-aesni crypto code. Move CRC32 algorithm into the library. Add some fake traces to extend fuzzing coverage. Note that these traces are hand-made (via scapy/curl) and must not be used as "proof" that the dissectors are really able to identify this kind of traffic. Some small updates to some dissectors: CSGO: remove a wrong rule (never triggered, BTW). Any UDP packet starting with "VS01" will be classified as STEAM (see steam.c around line 111). Googling it, it seems right so. XBOX: XBOX only analyses UDP flows while HTTP only TCP ones; therefore that condition is false. RTP, STUN: removed useless "break"s Zattoo: `flow->zattoo_stage` is never set to any values greater or equal to 5, so these checks are never true. PPStream: `flow->l4.udp.ppstream_stage` is never read. Delete it. TeamSpeak: we check for `flow->packet_counter == 3` just above, so the following check `flow->packet_counter >= 3` is always false. --- fuzz/fuzz_serialization.cpp | 52 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 43 insertions(+), 9 deletions(-) (limited to 'fuzz/fuzz_serialization.cpp') diff --git a/fuzz/fuzz_serialization.cpp b/fuzz/fuzz_serialization.cpp index 45596e742..f1e66399c 100644 --- a/fuzz/fuzz_serialization.cpp +++ b/fuzz/fuzz_serialization.cpp @@ -32,7 +32,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (fmt == ndpi_serialization_format_csv) ndpi_serializer_set_csv_separator(&serializer, ','); - num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 16); + num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 8); for (i = 0; i < num_iteration; i++) { memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */ snprintf(kbuf, sizeof(kbuf), "Key %d", i); @@ -50,15 +50,24 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_serialize_uint32_boolean(&serializer, i, fuzzed_data.ConsumeIntegral()); ndpi_serialize_string_uint32(&serializer, kbuf, fuzzed_data.ConsumeIntegral()); + ndpi_serialize_string_uint32_format(&serializer, kbuf, fuzzed_data.ConsumeIntegral(), "%d"); ndpi_serialize_string_int32(&serializer, kbuf, fuzzed_data.ConsumeIntegral()); ndpi_serialize_string_uint64(&serializer, kbuf, fuzzed_data.ConsumeIntegral()); ndpi_serialize_string_int64(&serializer, kbuf, fuzzed_data.ConsumeIntegral()); ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint(), "%f"); if (fmt != ndpi_serialization_format_tlv) ndpi_serialize_string_double(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint(), "%lf"); + d = fuzzed_data.ConsumeBytes(16); + if (d.size()) + ndpi_serialize_string_binary(&serializer, kbuf, d.data(), d.size()); ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str()); + d = fuzzed_data.ConsumeBytes(16); + if (d.size()) + ndpi_serialize_string_raw(&serializer, kbuf, d.data(), d.size()); ndpi_serialize_string_boolean(&serializer, kbuf, fuzzed_data.ConsumeIntegral()); + if (fuzzed_data.ConsumeBool()) + snprintf(kbuf, sizeof(kbuf), "%d", i); /* To trigger OPTIMIZE_NUMERIC_KEYS */ ndpi_serialize_binary_uint32(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral()); ndpi_serialize_binary_int32(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral()); ndpi_serialize_binary_uint64(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral()); @@ -68,7 +77,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_serialize_binary_double(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeFloatingPoint(), "%lf"); ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral()); d = fuzzed_data.ConsumeBytes(16); - ndpi_serialize_binary_binary(&serializer, kbuf, sizeof(kbuf), d.data(), d.size()); + if (d.size()) + ndpi_serialize_binary_binary(&serializer, kbuf, sizeof(kbuf), d.data(), d.size()); if ((i & 0x3) == 0x3) ndpi_serialize_end_of_record(&serializer); @@ -76,11 +86,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_serializer_create_snapshot(&serializer); + if (fuzzed_data.ConsumeBool()) + ndpi_serializer_skip_header(&serializer); + if (fuzzed_data.ConsumeBool()) { ndpi_serialize_start_of_block(&serializer, "Block"); memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */ snprintf(kbuf, sizeof(kbuf), "K-Ignored"); - ndpi_serialize_uint32_uint32(&serializer, i, fuzzed_data.ConsumeIntegral()); + ndpi_serialize_uint32_uint32(&serializer, fuzzed_data.ConsumeIntegral(), fuzzed_data.ConsumeIntegral()); ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str()); ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint(), "%f"); ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral()); @@ -98,12 +111,19 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_serialize_end_of_block(&serializer); } + if (fmt == ndpi_serialization_format_json) { + if (fuzzed_data.ConsumeBool()) { + d = fuzzed_data.ConsumeBytes(8); + if (d.size()) + ndpi_serialize_raw_record(&serializer, (u_char *)d.data(), d.size()); + } + } + if (fuzzed_data.ConsumeBool()) ndpi_serializer_rollback_snapshot(&serializer); - if (fmt == ndpi_serialization_format_json) { - - ndpi_serialize_start_of_list(&serializer, "List"); + rc = ndpi_serialize_start_of_list(&serializer, "List"); + if (rc == 0) { num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 8); for (i = 0; i < num_iteration; i++) { @@ -117,18 +137,32 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_serialize_end_of_list(&serializer); ndpi_serialize_string_string(&serializer, "Last", "Ok"); - } else if (fmt == ndpi_serialization_format_csv) { + } + + if (fmt == ndpi_serialization_format_csv) { ndpi_serializer_get_header(&serializer, &buffer_len); ndpi_serializer_get_buffer(&serializer, &buffer_len); - } else { + } else if (fmt == ndpi_serialization_format_tlv) { /* Conversion from tlv to json */ rc = ndpi_init_deserializer(&deserializer, &serializer); if (rc == 0) { rc = ndpi_init_serializer_ll(&serializer_cloned, ndpi_serialization_format_json, fuzzed_data.ConsumeIntegralInRange(0, 2048)); if (rc == 0) { ndpi_deserialize_clone_all(&deserializer, &serializer_cloned); + ndpi_serializer_get_format(&serializer_cloned); ndpi_serializer_get_buffer(&serializer_cloned, &buffer_len); - ndpi_term_serializer(&serializer_cloned); + ndpi_serializer_get_buffer_len(&serializer_cloned); + ndpi_serializer_get_internal_buffer_size(&serializer_cloned); + ndpi_term_serializer(&serializer_cloned); + } + } + + rc = ndpi_init_deserializer(&deserializer, &serializer); + if (rc == 0) { + rc = ndpi_init_serializer_ll(&serializer_cloned, ndpi_serialization_format_tlv, fuzzed_data.ConsumeIntegralInRange(0, 2048)); + if (rc == 0) { + ndpi_deserialize_clone_item(&deserializer, &serializer_cloned); + ndpi_term_serializer(&serializer_cloned); } } } -- cgit v1.2.3