January 2017 - tor-commits - lists.torproject.org

[tor/master] for fuzzing: Add a function to make a buf with given contents
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit fca91a7793f24fc5f2d043167317fd47dd58f1ed Author: teor <teor2345(a)gmail.com> Date: Tue Dec 13 19:13:57 2016 -0500 for fuzzing: Add a function to make a buf with given contents (Teor wrote the code, nick extracted it into a smaller patch.) --- src/or/buffers.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ src/or/buffers.h | 3 +++ 2 files changed, 51 insertions(+) diff --git a/src/or/buffers.c b/src/or/buffers.c index 8981fd2..58ce573 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -281,6 +281,7 @@ buf_pullup(buf_t *buf, size_t bytes) } #ifdef TOR_UNIT_TESTS +/* Return the data from the first chunk of buf in cp, and its length in sz. */ void buf_get_first_chunk_data(const buf_t *buf, const char **cp, size_t *sz) { @@ -292,6 +293,53 @@ buf_get_first_chunk_data(const buf_t *buf, const char **cp, size_t *sz) *sz = buf->head->datalen; } } + +/* Write sz bytes from cp into a newly allocated buffer buf. + * Returns NULL when passed a NULL cp or zero sz. + * Asserts on failure: only for use in unit tests. + * buf must be freed using buf_free(). */ +buf_t * +buf_new_with_data(const char *cp, size_t sz) +{ + /* Validate arguments */ + if (!cp || sz <= 0) { + return NULL; + } + + tor_assert(sz < SSIZE_T_CEILING); + + /* Allocate a buffer */ + buf_t *buf = buf_new_with_capacity(sz); + tor_assert(buf); + assert_buf_ok(buf); + tor_assert(!buf->head); + + /* Allocate a chunk that is sz bytes long */ + buf->head = chunk_new_with_alloc_size(CHUNK_ALLOC_SIZE(sz)); + buf->tail = buf->head; + tor_assert(buf->head); + assert_buf_ok(buf); + tor_assert(buf_allocation(buf) >= sz); + + /* Copy the data and size the buffers */ + tor_assert(sz <= buf_slack(buf)); + tor_assert(sz <= CHUNK_REMAINING_CAPACITY(buf->head)); + memcpy(&buf->head->mem[0], cp, sz); + buf->datalen = sz; + buf->head->datalen = sz; + buf->head->data = &buf->head->mem[0]; + assert_buf_ok(buf); + + /* Make sure everything is large enough */ + tor_assert(buf_allocation(buf) >= sz); + tor_assert(buf_allocation(buf) >= buf_datalen(buf) + buf_slack(buf)); + /* Does the buffer implementation allocate more than the requested size? + * (for example, by rounding up). If so, these checks will fail. */ + tor_assert(buf_datalen(buf) == sz); + tor_assert(buf_slack(buf) == 0); + + return buf; +} #endif /** Remove the first <b>n</b> bytes from buf. */ diff --git a/src/or/buffers.h b/src/or/buffers.h index 52b21d5..08d9471 100644 --- a/src/or/buffers.h +++ b/src/or/buffers.h @@ -64,7 +64,10 @@ void assert_buf_ok(buf_t *buf); #ifdef BUFFERS_PRIVATE STATIC int buf_find_string_offset(const buf_t *buf, const char *s, size_t n); STATIC void buf_pullup(buf_t *buf, size_t bytes); +#ifdef TOR_UNIT_TESTS void buf_get_first_chunk_data(const buf_t *buf, const char **cp, size_t *sz); +buf_t *buf_new_with_data(const char *cp, size_t sz); +#endif STATIC size_t preferred_chunk_size(size_t target); #define DEBUG_CHUNK_ALLOC

1 0

[tor/master] For fuzzing: Expose directory_handle_command.
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 02068c6391fc5b9febac1f02de7028688c92eee2 Author: teor <teor2345(a)gmail.com> Date: Tue Dec 13 19:12:34 2016 -0500 For fuzzing: Expose directory_handle_command. (Nick extracted this patch from a larger patch by Teor.) --- src/or/directory.c | 4 ++-- src/or/directory.h | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/or/directory.c b/src/or/directory.c index 80f53c2..4581163 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -14,6 +14,7 @@ #include "connection.h" #include "connection_edge.h" #include "control.h" +#define DIRECTORY_PRIVATE #include "directory.h" #include "dirserv.h" #include "dirvote.h" @@ -99,7 +100,6 @@ static void directory_send_command(dir_connection_t *conn, int purpose, int direct, const char *resource, const char *payload, size_t payload_len, time_t if_modified_since); -static int directory_handle_command(dir_connection_t *conn); static int body_is_plausible(const char *body, size_t body_len, int purpose); static char *http_get_header(const char *headers, const char *which); static void http_set_address_origin(const char *headers, connection_t *conn); @@ -3846,7 +3846,7 @@ directory_handle_command_post(dir_connection_t *conn, const char *headers, * from the inbuf, try to process it; otherwise, leave it on the * buffer. Return a 0 on success, or -1 on error. */ -static int +STATIC int directory_handle_command(dir_connection_t *conn) { char *headers=NULL, *body=NULL; diff --git a/src/or/directory.h b/src/or/directory.h index ee0a198..15010d6 100644 --- a/src/or/directory.h +++ b/src/or/directory.h @@ -148,6 +148,7 @@ int purpose_needs_anonymity(uint8_t dir_purpose, uint8_t router_purpose, struct get_handler_args_t; STATIC int handle_get_hs_descriptor_v3(dir_connection_t *conn, const struct get_handler_args_t *args); +STATIC int directory_handle_command(dir_connection_t *conn); #endif

1 0

[tor/master] Add a fuzzer for the http used in our directory protocol
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit a967d568dcab10d6b1e03d2ffb96743e415393c0 Author: teor <teor2345(a)gmail.com> Date: Tue Dec 13 19:16:03 2016 -0500 Add a fuzzer for the http used in our directory protocol (Teor wrote the code, nick extracted it. It won't compile yet.) --- src/test/fuzz/fuzz_http.c | 174 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 174 insertions(+) diff --git a/src/test/fuzz/fuzz_http.c b/src/test/fuzz/fuzz_http.c new file mode 100644 index 0000000..abf5de8 --- /dev/null +++ b/src/test/fuzz/fuzz_http.c @@ -0,0 +1,174 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +#include "orconfig.h" + +#define BUFFERS_PRIVATE + +#include "or.h" +#include "backtrace.h" +#include "buffers.h" +#include "config.h" +#include "connection.h" +#include "directory.h" +#include "torlog.h" + +/* Silence compiler warnings about a missing extern */ +extern const char tor_git_revision[]; +const char tor_git_revision[] = ""; + +#define MAX_FUZZ_SIZE (2*MAX_HEADERS_SIZE + MAX_DIR_UL_SIZE) + +static int mock_get_options_calls = 0; +static or_options_t *mock_options = NULL; + +static void +reset_options(or_options_t *options, int *get_options_calls) +{ + memset(options, 0, sizeof(or_options_t)); + options->TestingTorNetwork = 1; + + *get_options_calls = 0; +} + +static const or_options_t* +mock_get_options(void) +{ + ++mock_get_options_calls; + tor_assert(mock_options); + return mock_options; +} + +static void +mock_connection_write_to_buf_impl_(const char *string, size_t len, + connection_t *conn, int zlib) +{ + log_debug(LD_GENERAL, "%sResponse:\n%zu\nConnection: %p\n%s\n", + zlib ? "Compressed " : "", len, conn, string); +} + +/* Read a directory command (including HTTP headers) from stdin, parse it, and + * output what tor parsed */ +int +main(int c, char** v) +{ + /* Disable logging by default to speed up fuzzing. */ + int loglevel = LOG_ERR; + + /* Initialise logging first */ + init_logging(1); + configure_backtrace_handler(get_version()); + + for (int i = 1; i < c; ++i) { + if (!strcmp(v[i], "--warn")) { + loglevel = LOG_WARN; + } else if (!strcmp(v[i], "--notice")) { + loglevel = LOG_NOTICE; + } else if (!strcmp(v[i], "--info")) { + loglevel = LOG_INFO; + } else if (!strcmp(v[i], "--debug")) { + loglevel = LOG_DEBUG; + } + } + + { + log_severity_list_t s; + memset(&s, 0, sizeof(s)); + set_log_severity_config(loglevel, LOG_ERR, &s); + /* ALWAYS log bug warnings. */ + s.masks[LOG_WARN-LOG_ERR] |= LD_BUG; + add_stream_log(&s, "", fileno(stdout)); + } + + /* Make BUG() and nonfatal asserts crash */ + tor_set_failed_assertion_callback(abort); + + /* Set up fake variables */ + dir_connection_t dir_conn; + int rv = -1; + ssize_t data_size = -1; + char *stdin_buf = tor_malloc(MAX_FUZZ_SIZE+1); + + /* directory_handle_command checks some tor options + * just make them all 0 */ + mock_options = tor_malloc(sizeof(or_options_t)); + reset_options(mock_options, &mock_get_options_calls); + MOCK(get_options, mock_get_options); + + /* Set up the fake connection */ + memset(&dir_conn, 0, sizeof(dir_connection_t)); + dir_conn.base_.type = CONN_TYPE_DIR; + + /* Set up fake response handler */ + MOCK(connection_write_to_buf_impl_, mock_connection_write_to_buf_impl_); + +/* +afl extension - loop and reset state after parsing +likely needs to reset the allocation data structures and counts as well +#ifdef __AFL_HAVE_MANUAL_CONTROL + while (__AFL_LOOP(1000)) { +#endif +*/ + + /* Initialise the data structures */ + memset(stdin_buf, 0, MAX_FUZZ_SIZE+1); + + /* Apparently tor sets this before directory_handle_command() is called. */ + dir_conn.base_.address = tor_strdup("replace-this-address.example.com"); + +#ifdef __AFL_HAVE_MANUAL_CONTROL + /* Tell AFL to pause and fork here - ignored if not using AFL */ + __AFL_INIT(); +#endif + + /* Read the data */ + data_size = read(STDIN_FILENO, stdin_buf, MAX_FUZZ_SIZE); + tor_assert(data_size != -1); + tor_assert(data_size <= MAX_FUZZ_SIZE); + stdin_buf[data_size] = '\0'; + tor_assert(strlen(stdin_buf) >= 0); + tor_assert(strlen(stdin_buf) <= MAX_FUZZ_SIZE); + + log_debug(LD_GENERAL, "Input-Length:\n%zu\n", data_size); + log_debug(LD_GENERAL, "Input:\n%s\n", stdin_buf); + + /* Copy the stdin data into the buffer */ + tor_assert(data_size >= 0); + dir_conn.base_.inbuf = buf_new_with_data(stdin_buf, (size_t)data_size); + if (!dir_conn.base_.inbuf) { + log_debug(LD_GENERAL, "Zero-Length-Input\n"); + return 0; + } + + /* Parse the headers */ + rv = directory_handle_command(&dir_conn); + + /* TODO: check the output is correctly parsed based on the input */ + + /* Report the parsed origin address */ + if (dir_conn.base_.address) { + log_debug(LD_GENERAL, "Address:\n%s\n", dir_conn.base_.address); + } + + log_debug(LD_GENERAL, "Result:\n%d\n", rv); + + /* Reset */ + tor_free(dir_conn.base_.address); + + buf_free(dir_conn.base_.inbuf); + dir_conn.base_.inbuf = NULL; + +/* +#ifdef __AFL_HAVE_MANUAL_CONTROL + } +#endif +*/ + + /* Cleanup */ + tor_free(mock_options); + UNMOCK(get_options); + + UNMOCK(connection_write_to_buf_impl_); + + tor_free(stdin_buf); +}

1 0

[tor/master] Fuzzing: initialize siphash key, don't init_logging twice.
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit ca657074b9602940c3a45b9c4cfe69d5f078084c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 13 20:24:54 2016 -0500 Fuzzing: initialize siphash key, don't init_logging twice. --- .gitignore | 3 +++ src/test/fuzz/fuzzing_common.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index dc6738c..1491b11 100644 --- a/.gitignore +++ b/.gitignore @@ -196,6 +196,9 @@ uptime-*.json /src/test/test-timers.exe /src/test/test_workqueue.exe +# /src/test/fuzz +/src/test/fuzz/fuzz-* + # /src/tools/ /src/tools/tor-checkkey /src/tools/tor-resolve diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index e17bae3..f2570a1 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -104,7 +104,10 @@ main(int argc, char **argv) size_t size; tor_threads_init(); - init_logging(1); + { + struct sipkey sipkey = { 1337, 7331 }; + siphash_set_global_key(&sipkey); + } /* Disable logging by default to speed up fuzzing. */ int loglevel = LOG_ERR;

1 0

[tor/master] Copy fuzzing instructions by teor
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit f009b13029b57f9c89077a041124066f6e9ba38c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 13 20:29:28 2016 -0500 Copy fuzzing instructions by teor --- doc/HACKING/Fuzzing.md | 90 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/doc/HACKING/Fuzzing.md b/doc/HACKING/Fuzzing.md new file mode 100644 index 0000000..7ba7f49 --- /dev/null +++ b/doc/HACKING/Fuzzing.md @@ -0,0 +1,90 @@ += Fuzzing Tor + +To run the fuzzing test cases in a deterministic fashion, use: + make fuzz + +== Guided Fuzzing with AFL + +There is no HTTPS, hash, or signature for American Fuzzy Lop's source code, so +its integrity can't be verified. That said, you really shouldn't fuzz on a +machine you care about, anyway. + +To Build: + Get AFL from http://lcamtuf.coredump.cx/afl/ and unpack it + cd afl + make + cd ../tor + PATH=$PATH:../afl/ CC="../afl/afl-gcc" ./configure --enable-expensive-hardening + AFL_HARDEN=1 make clean fuzz + +To Find The ASAN Memory Limit: (64-bit only) + +On 64-bit platforms, afl needs to know how much memory ASAN uses. +Or, you can configure tor without --enable-expensive-hardening, then use + make fuzz +to run the generated test cases through an ASAN-enabled fuzz_dir. +Read afl/docs/notes_for_asan.txt for more details. + + Download recidivm from http://jwilk.net/software/recidivm + Download the signature + Check the signature + tar xvzf recidivm*.tar.gz + cd recidivm* + make + /path/to/recidivm -v src/test/fuzz_dir + Use the final "ok" figure as the input to -m when calling afl-fuzz + (Normally, recidivm would output a figure automatically, but in some cases, + the fuzzing harness will hang when the memory limit is too small.) + +To Run: + mkdir -p src/test/fuzz/fuzz_dir_testcase src/test/fuzz/fuzz_dir_findings + echo "dummy" > src/test/fuzz/fuzz_dir_testcase/minimal.case + ../afl/afl-fuzz -i src/test/fuzz/fuzz_dir_testcase -o src/test/fuzz/fuzz_dir_findings -m <asan-memory-limit> -- src/test/fuzz_dir + +AFL has a multi-core mode, check the documentation for details. + +macOS (OS X) requires slightly more preparation, including: +* using afl-clang (or afl-clang-fast from the llvm directory) +* disabling external crash reporting (AFL will guide you through this step) + +AFL may also benefit from using dictionary files for text-based inputs: these +can be placed in src/test/fuzz/fuzz_dir_dictionary/. + +Multiple dictionaries can be used with AFL, you should choose a combination of +dictionaries that targets the code you are fuzzing. + +== Writing Tor fuzzers + +A tor fuzzing harness should: +* read input from standard input (many fuzzing frameworks also accept file + names) +* parse that input +* produce results on standard output (this assists in diagnosing errors) + +Most fuzzing frameworks will produce many invalid inputs - a tor fuzzing +harness should rejecting invalid inputs without crashing or behaving badly. + +But the fuzzing harness should crash if tor fails an assertion, triggers a +bug, or accesses memory it shouldn't. This helps fuzzing frameworks detect +"interesting" cases. + +== Triaging Issues + +Crashes are usually interesting, particularly if using AFL_HARDEN=1 and --enable-expensive-hardening. Sometimes crashes are due to bugs in the harness code. + +Hangs might be interesting, but they might also be spurious machine slowdowns. +Check if a hang is reproducible before reporting it. Sometimes, processing +valid inputs may take a second or so, particularly with the fuzzer and +sanitizers enabled. + +To see what fuzz_dir is doing with a test case, call it like this: + src/test/fuzz_dir --debug < /path/to/test.case + +(Logging is disabled while fuzzing to increase fuzzing speed.) + +== Reporting Issues + +Please report any issues discovered using the process in Tor's security issue +policy: + +https://trac.torproject.org/projects/tor/wiki/org/meetings/2016SummerDevMeeting/Notes/SecurityIssuePolicy

1 0

[tor/master] Restrict fuzzing to the directory headers
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 584d723e04751330a677e7ce3673fc665713ea0a Author: teor <teor2345(a)gmail.com> Date: Mon Dec 12 22:53:11 2016 +1100 Restrict fuzzing to the directory headers --- src/or/directory.c | 12 ++++++------ src/or/directory.h | 12 ++++++++---- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/src/or/directory.c b/src/or/directory.c index 4581163..012d440 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -2895,9 +2895,9 @@ static const url_table_ent_t url_table[] = { * conn-\>outbuf. If the request is unrecognized, send a 404. * Return 0 if we handled this successfully, or -1 if we need to close * the connection. */ -STATIC int -directory_handle_command_get(dir_connection_t *conn, const char *headers, - const char *req_body, size_t req_body_len) +MOCK_IMPL(STATIC int, +directory_handle_command_get,(dir_connection_t *conn, const char *headers, + const char *req_body, size_t req_body_len)) { char *url, *url_mem, *header; time_t if_modified_since = 0; @@ -3705,9 +3705,9 @@ handle_post_hs_descriptor(const char *url, const char *body) * service descriptor. On finding one, process it and write a * response into conn-\>outbuf. If the request is unrecognized, send a * 400. Always return 0. */ -static int -directory_handle_command_post(dir_connection_t *conn, const char *headers, - const char *body, size_t body_len) +MOCK_IMPL(STATIC int, +directory_handle_command_post,(dir_connection_t *conn, const char *headers, + const char *body, size_t body_len)) { char *url = NULL; const or_options_t *options = get_options(); diff --git a/src/or/directory.h b/src/or/directory.h index 15010d6..8be1f8e 100644 --- a/src/or/directory.h +++ b/src/or/directory.h @@ -158,10 +158,14 @@ STATIC int directory_handle_command(dir_connection_t *conn); STATIC int parse_http_url(const char *headers, char **url); STATIC dirinfo_type_t dir_fetch_type(int dir_purpose, int router_purpose, const char *resource); -STATIC int directory_handle_command_get(dir_connection_t *conn, - const char *headers, - const char *req_body, - size_t req_body_len); +MOCK_DECL(STATIC int, directory_handle_command_get,(dir_connection_t *conn, + const char *headers, + const char *req_body, + size_t req_body_len)); +MOCK_DECL(STATIC int, directory_handle_command_post,(dir_connection_t *conn, + const char *headers, + const char *body, + size_t body_len)); STATIC int download_status_schedule_get_delay(download_status_t *dls, const smartlist_t *schedule, int min_delay, int max_delay,

1 0

[tor/master] Add more tweaks from teor's http fuzzing code.
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 56b61d18311998210f07c3d4b4f21a497bc04d48 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 08:05:22 2016 -0500 Add more tweaks from teor's http fuzzing code. Move option-manipulation code to fuzzing_common. --- src/test/fuzz/fuzz_http.c | 76 +++++++++++++++++++++++++++++------------- src/test/fuzz/fuzzing_common.c | 14 ++++++++ 2 files changed, 67 insertions(+), 23 deletions(-) diff --git a/src/test/fuzz/fuzz_http.c b/src/test/fuzz/fuzz_http.c index ea63e83..15d3726 100644 --- a/src/test/fuzz/fuzz_http.c +++ b/src/test/fuzz/fuzz_http.c @@ -16,51 +16,81 @@ #include "fuzzing.h" -static int mock_get_options_calls = 0; -static or_options_t *mock_options = NULL; - static void -reset_options(or_options_t *options, int *get_options_calls) +mock_connection_write_to_buf_impl_(const char *string, size_t len, + connection_t *conn, int zlib) { - memset(options, 0, sizeof(or_options_t)); - options->TestingTorNetwork = 1; - - *get_options_calls = 0; + log_debug(LD_GENERAL, "%sResponse:\n%zu\nConnection: %p\n%s\n", + zlib ? "Compressed " : "", len, conn, string); } -static const or_options_t* -mock_get_options(void) +static int +mock_directory_handle_command_get(dir_connection_t *conn, + const char *headers, + const char *body, + size_t body_len) { - ++mock_get_options_calls; - tor_assert(mock_options); - return mock_options; + (void)conn; + + log_debug(LD_GENERAL, "Method:\nGET\n"); + + if (headers) { + log_debug(LD_GENERAL, "Header-Length:\n%zu\n", strlen(headers)); + log_debug(LD_GENERAL, "Headers:\n%s\n", headers); + + } + + log_debug(LD_GENERAL, "Body-Length:\n%zu\n", body_len); + if (body) { + log_debug(LD_GENERAL, "Body:\n%s\n", body); + } + + /* Always tell the caller we succeeded */ + return 0; } -static void -mock_connection_write_to_buf_impl_(const char *string, size_t len, - connection_t *conn, int zlib) +static int +mock_directory_handle_command_post(dir_connection_t *conn, + const char *headers, + const char *body, + size_t body_len) { - log_debug(LD_GENERAL, "%sResponse:\n%zu\nConnection: %p\n%s\n", - zlib ? "Compressed " : "", len, conn, string); + (void)conn; + + log_debug(LD_GENERAL, "Method:\nPOST\n"); + + if (headers) { + log_debug(LD_GENERAL, "Header-Length:\n%zu\n", strlen(headers)); + log_debug(LD_GENERAL, "Headers:\n%s\n", headers); + } + + log_debug(LD_GENERAL, "Body-Length:\n%zu\n", body_len); + if (body) { + log_debug(LD_GENERAL, "Body:\n%s\n", body); + } + + /* Always tell the caller we succeeded */ + return 0; } int fuzz_init(void) { - mock_options = tor_malloc(sizeof(or_options_t)); - reset_options(mock_options, &mock_get_options_calls); - MOCK(get_options, mock_get_options); /* Set up fake response handler */ MOCK(connection_write_to_buf_impl_, mock_connection_write_to_buf_impl_); + /* Set up the fake handler functions */ + MOCK(directory_handle_command_get, mock_directory_handle_command_get); + MOCK(directory_handle_command_post, mock_directory_handle_command_post); + return 0; } int fuzz_cleanup(void) { - tor_free(mock_options); - UNMOCK(get_options); UNMOCK(connection_write_to_buf_impl_); + UNMOCK(directory_handle_command_get); + UNMOCK(directory_handle_command_post); return 0; } diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index f2570a1..54a7923 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -10,6 +10,13 @@ extern const char tor_git_revision[]; const char tor_git_revision[] = ""; +static or_options_t *mock_options = NULL; +static const or_options_t * +mock_get_options(void) +{ + return mock_options; +} + static int mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to, size_t tolen, @@ -116,6 +123,10 @@ main(int argc, char **argv) init_logging(1); configure_backtrace_handler(get_version()); + /* set up the options. */ + mock_options = tor_malloc(sizeof(or_options_t)); + MOCK(get_options, mock_get_options); + for (int i = 1; i < argc; ++i) { if (!strcmp(argv[i], "--warn")) { loglevel = LOG_WARN; @@ -156,6 +167,9 @@ main(int argc, char **argv) if (fuzz_cleanup() < 0) abort(); + + tor_free(mock_options); + UNMOCK(get_options); return 0; }

1 0

[tor/master] Guide fuzzing by adding standard tor GET and POST testcases
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 416e2f6b283801190f087445d295b391e08cc902 Author: teor <teor2345(a)gmail.com> Date: Mon Dec 12 22:55:18 2016 +1100 Guide fuzzing by adding standard tor GET and POST testcases --- src/test/fuzz/dict/http | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/src/test/fuzz/dict/http b/src/test/fuzz/dict/http new file mode 100644 index 0000000..1a7b61e --- /dev/null +++ b/src/test/fuzz/dict/http @@ -0,0 +1,24 @@ +# +# AFL dictionary for the Tor Directory protocol's HTTP headers +# ------------------------------------------------------------ +# +# Extracted from directory_handle_command() in the tor source code +# +# Copyright (c) 2016, The Tor Project, Inc. +# See LICENSE for licensing information +# +# Usage: +# Select the dictionaries relevant to the part of the directory protocol you +# are fuzzing, and feed them to your fuzzer (if it supports dictionaries). + +http_header_body_delimiter = "\x0d\x0a\x0d\x0a" +http_header_header_delimiter = "\x0d\x0a" +# multi-character tokens only +#http_header_value_delimiter = " " + +content_length_header = "Content-Length:" +forwarded_for_header = "Forwarded-For:" +x_forwarded_for_header = "X-Forwarded-For:" + +get_command = "GET" +post_command = "POST"

1 0

[tor/master] Try to tweak fuzzing.md to correspond to my changes
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 44fa14c0e28ac26a551169d5621648db9bc08da9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 08:12:41 2016 -0500 Try to tweak fuzzing.md to correspond to my changes --- doc/HACKING/Fuzzing.md | 36 +++++++++++++++++++----------------- src/test/fuzz/fuzz_multi.sh | 34 ++++++++++++++++++++++++++++++++++ src/test/fuzz_multi.sh | 34 ---------------------------------- 3 files changed, 53 insertions(+), 51 deletions(-) diff --git a/doc/HACKING/Fuzzing.md b/doc/HACKING/Fuzzing.md index 703f028..36f0fc4 100644 --- a/doc/HACKING/Fuzzing.md +++ b/doc/HACKING/Fuzzing.md @@ -3,6 +3,11 @@ To run the fuzzing test cases in a deterministic fashion, use: make fuzz + [I've turned this off for now. - NM] + +To build the fuzzing harness binaries, use: + make fuzzers + == Guided Fuzzing with AFL There is no HTTPS, hash, or signature for American Fuzzy Lop's source code, so @@ -22,7 +27,7 @@ To Find The ASAN Memory Limit: (64-bit only) On 64-bit platforms, afl needs to know how much memory ASAN uses. Or, you can configure tor without --enable-expensive-hardening, then use make fuzz -to run the generated test cases through an ASAN-enabled fuzz_dir. +to run the generated test cases through an ASAN-enabled fuzz-http. Read afl/docs/notes_for_asan.txt for more details. Download recidivm from http://jwilk.net/software/recidivm @@ -36,10 +41,14 @@ Read afl/docs/notes_for_asan.txt for more details. (Normally, recidivm would output a figure automatically, but in some cases, the fuzzing harness will hang when the memory limit is too small.) +You could also just say "none" instead of the memory limit below, if you +don't care about memory limits. + + To Run: - mkdir -p src/test/fuzz/fuzz_dir_testcase src/test/fuzz/fuzz_dir_findings - echo "dummy" > src/test/fuzz/fuzz_dir_testcase/minimal.case - ../afl/afl-fuzz -i src/test/fuzz/fuzz_dir_testcase -o src/test/fuzz/fuzz_dir_findings -m <asan-memory-limit> -- src/test/fuzz_dir + mkdir -p src/test/fuzz/fuzz_http_findings + ../afl/afl-fuzz -i src/test/fuzz/data/http -x src/test/fuzz/dict/http -o src/test/fuzz/fuzz_http_findings -m <asan-memory-limit> -- src/test/fuzz_dir + AFL has a multi-core mode, check the documentation for details. You might find the included fuzz-multi.sh script useful for this. @@ -48,19 +57,12 @@ macOS (OS X) requires slightly more preparation, including: * using afl-clang (or afl-clang-fast from the llvm directory) * disabling external crash reporting (AFL will guide you through this step) -AFL may also benefit from using dictionary files for text-based inputs: these -can be placed in src/test/fuzz/fuzz_dir_dictionary/. - -Multiple dictionaries can be used with AFL, you should choose a combination of -dictionaries that targets the code you are fuzzing. - == Writing Tor fuzzers -A tor fuzzing harness should: -* read input from standard input (many fuzzing frameworks also accept file - names) -* parse that input -* produce results on standard output (this assists in diagnosing errors) +A tor fuzzing harness should have: +* a fuzz_init() function to set up any necessary global state. +* a fuzz_main() function to receive input and pass it to a parser. +* a fuzz_cleanup() function to clear global state. Most fuzzing frameworks will produce many invalid inputs - a tor fuzzing harness should rejecting invalid inputs without crashing or behaving badly. @@ -78,8 +80,8 @@ Check if a hang is reproducible before reporting it. Sometimes, processing valid inputs may take a second or so, particularly with the fuzzer and sanitizers enabled. -To see what fuzz_dir is doing with a test case, call it like this: - src/test/fuzz_dir --debug < /path/to/test.case +To see what fuzz-http is doing with a test case, call it like this: + src/test/fuzz/fuzz-http --debug < /path/to/test.case (Logging is disabled while fuzzing to increase fuzzing speed.) diff --git a/src/test/fuzz/fuzz_multi.sh b/src/test/fuzz/fuzz_multi.sh new file mode 100755 index 0000000..b4a17ed --- /dev/null +++ b/src/test/fuzz/fuzz_multi.sh @@ -0,0 +1,34 @@ +MEMLIMIT_BYTES=21990500990976 + +N_CPUS=1 +if [ $# -ge 1 ]; then + N_CPUS="$1" + shift +fi + +FILTER=echo + +for i in `seq -w "$N_CPUS"`; do + if [ "$i" -eq 1 ]; then + if [ "$N_CPUS" -eq 1 ]; then + INSTANCE="" + NUMBER="" + else + INSTANCE="-M" + NUMBER="$i" + fi + else + INSTANCE="-S" + NUMBER="$i" + fi + # use whatever remains on the command-line to prefix the fuzzer command + # you have to copy and paste and run these commands yourself + "$FILTER" "$@" \ + ../afl/afl-fuzz \ + -i src/test/fuzz/fuzz_dir_testcase \ + -o src/test/fuzz/fuzz_dir_findings \ + -x src/test/fuzz/fuzz_dir_dictionary/fuzz_dir_http_header.dct \ + -m "$MEMLIMIT_BYTES" \ + "$INSTANCE" "$NUMBER" \ + -- src/test/fuzz_dir +done diff --git a/src/test/fuzz_multi.sh b/src/test/fuzz_multi.sh deleted file mode 100755 index b4a17ed..0000000 --- a/src/test/fuzz_multi.sh +++ /dev/null @@ -1,34 +0,0 @@ -MEMLIMIT_BYTES=21990500990976 - -N_CPUS=1 -if [ $# -ge 1 ]; then - N_CPUS="$1" - shift -fi - -FILTER=echo - -for i in `seq -w "$N_CPUS"`; do - if [ "$i" -eq 1 ]; then - if [ "$N_CPUS" -eq 1 ]; then - INSTANCE="" - NUMBER="" - else - INSTANCE="-M" - NUMBER="$i" - fi - else - INSTANCE="-S" - NUMBER="$i" - fi - # use whatever remains on the command-line to prefix the fuzzer command - # you have to copy and paste and run these commands yourself - "$FILTER" "$@" \ - ../afl/afl-fuzz \ - -i src/test/fuzz/fuzz_dir_testcase \ - -o src/test/fuzz/fuzz_dir_findings \ - -x src/test/fuzz/fuzz_dir_dictionary/fuzz_dir_http_header.dct \ - -m "$MEMLIMIT_BYTES" \ - "$INSTANCE" "$NUMBER" \ - -- src/test/fuzz_dir -done

1 0

[tor/master] Add a script for running multiple fuzzing sessions on multiple cores
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 0fb1156e9f0ee62e9b704e9e56ebae3c8d436218 Author: teor <teor2345(a)gmail.com> Date: Tue Dec 13 16:23:12 2016 +1100 Add a script for running multiple fuzzing sessions on multiple cores --- doc/HACKING/Fuzzing.md | 1 + src/test/fuzz_multi.sh | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/doc/HACKING/Fuzzing.md b/doc/HACKING/Fuzzing.md index 7ba7f49..703f028 100644 --- a/doc/HACKING/Fuzzing.md +++ b/doc/HACKING/Fuzzing.md @@ -42,6 +42,7 @@ To Run: ../afl/afl-fuzz -i src/test/fuzz/fuzz_dir_testcase -o src/test/fuzz/fuzz_dir_findings -m <asan-memory-limit> -- src/test/fuzz_dir AFL has a multi-core mode, check the documentation for details. +You might find the included fuzz-multi.sh script useful for this. macOS (OS X) requires slightly more preparation, including: * using afl-clang (or afl-clang-fast from the llvm directory) diff --git a/src/test/fuzz_multi.sh b/src/test/fuzz_multi.sh new file mode 100755 index 0000000..b4a17ed --- /dev/null +++ b/src/test/fuzz_multi.sh @@ -0,0 +1,34 @@ +MEMLIMIT_BYTES=21990500990976 + +N_CPUS=1 +if [ $# -ge 1 ]; then + N_CPUS="$1" + shift +fi + +FILTER=echo + +for i in `seq -w "$N_CPUS"`; do + if [ "$i" -eq 1 ]; then + if [ "$N_CPUS" -eq 1 ]; then + INSTANCE="" + NUMBER="" + else + INSTANCE="-M" + NUMBER="$i" + fi + else + INSTANCE="-S" + NUMBER="$i" + fi + # use whatever remains on the command-line to prefix the fuzzer command + # you have to copy and paste and run these commands yourself + "$FILTER" "$@" \ + ../afl/afl-fuzz \ + -i src/test/fuzz/fuzz_dir_testcase \ + -o src/test/fuzz/fuzz_dir_findings \ + -x src/test/fuzz/fuzz_dir_dictionary/fuzz_dir_http_header.dct \ + -m "$MEMLIMIT_BYTES" \ + "$INSTANCE" "$NUMBER" \ + -- src/test/fuzz_dir +done

1 0