January 2017 - tor-commits - lists.torproject.org

[tor/master] Add a script for running multiple fuzzing sessions on multiple cores
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 0fb1156e9f0ee62e9b704e9e56ebae3c8d436218 Author: teor <teor2345(a)gmail.com> Date: Tue Dec 13 16:23:12 2016 +1100 Add a script for running multiple fuzzing sessions on multiple cores --- doc/HACKING/Fuzzing.md | 1 + src/test/fuzz_multi.sh | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/doc/HACKING/Fuzzing.md b/doc/HACKING/Fuzzing.md index 7ba7f49..703f028 100644 --- a/doc/HACKING/Fuzzing.md +++ b/doc/HACKING/Fuzzing.md @@ -42,6 +42,7 @@ To Run: ../afl/afl-fuzz -i src/test/fuzz/fuzz_dir_testcase -o src/test/fuzz/fuzz_dir_findings -m <asan-memory-limit> -- src/test/fuzz_dir AFL has a multi-core mode, check the documentation for details. +You might find the included fuzz-multi.sh script useful for this. macOS (OS X) requires slightly more preparation, including: * using afl-clang (or afl-clang-fast from the llvm directory) diff --git a/src/test/fuzz_multi.sh b/src/test/fuzz_multi.sh new file mode 100755 index 0000000..b4a17ed --- /dev/null +++ b/src/test/fuzz_multi.sh @@ -0,0 +1,34 @@ +MEMLIMIT_BYTES=21990500990976 + +N_CPUS=1 +if [ $# -ge 1 ]; then + N_CPUS="$1" + shift +fi + +FILTER=echo + +for i in `seq -w "$N_CPUS"`; do + if [ "$i" -eq 1 ]; then + if [ "$N_CPUS" -eq 1 ]; then + INSTANCE="" + NUMBER="" + else + INSTANCE="-M" + NUMBER="$i" + fi + else + INSTANCE="-S" + NUMBER="$i" + fi + # use whatever remains on the command-line to prefix the fuzzer command + # you have to copy and paste and run these commands yourself + "$FILTER" "$@" \ + ../afl/afl-fuzz \ + -i src/test/fuzz/fuzz_dir_testcase \ + -o src/test/fuzz/fuzz_dir_findings \ + -x src/test/fuzz/fuzz_dir_dictionary/fuzz_dir_http_header.dct \ + -m "$MEMLIMIT_BYTES" \ + "$INSTANCE" "$NUMBER" \ + -- src/test/fuzz_dir +done

1 0

[tor/master] Add extrainfo fuzzer
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 81e44c22573e86cdcca6e47a7e68b3c83d4855f1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 10:05:41 2016 -0500 Add extrainfo fuzzer --- src/test/fuzz/dict/extrainfo | 32 +++++++++++++++++++++ src/test/fuzz/fuzz_extrainfo.c | 63 ++++++++++++++++++++++++++++++++++++++++++ src/test/fuzz/include.am | 9 ++++++ 3 files changed, 104 insertions(+) diff --git a/src/test/fuzz/dict/extrainfo b/src/test/fuzz/dict/extrainfo new file mode 100644 index 0000000..eba7a1e --- /dev/null +++ b/src/test/fuzz/dict/extrainfo @@ -0,0 +1,32 @@ +"cell-circuits-per-decile" +"cell-processed-cells" +"cell-queued-cells" +"cell-stats-end" +"cell-time-in-queue" +"dirreq-stats-end" +"dirreq-v2-direct-dl" +"dirreq-v2-ips" +"dirreq-v2-reqs" +"dirreq-v2-resp" +"dirreq-v2-share" +"dirreq-v2-tunneled-dl" +"dirreq-v3-direct-dl" +"dirreq-v3-ips" +"dirreq-v3-reqs" +"dirreq-v3-resp" +"dirreq-v3-share" +"dirreq-v3-tunneled-dl" +"entry-ips" +"entry-stats-end" +"exit-kibibytes-read" +"exit-kibibytes-written" +"exit-stats-end" +"exit-streams-opened" +"extra-info" +"identity-ed25519" +"opt" +"published" +"read-history" +"router-sig-ed25519" +"router-signature" +"write-history" diff --git a/src/test/fuzz/fuzz_extrainfo.c b/src/test/fuzz/fuzz_extrainfo.c new file mode 100644 index 0000000..6bfc425 --- /dev/null +++ b/src/test/fuzz/fuzz_extrainfo.c @@ -0,0 +1,63 @@ +#define ROUTERPARSE_PRIVATE +#include "or.h" +#include "routerparse.h" +#include "routerlist.h" +#include "routerkeys.h" +#include "fuzzing.h" + +static void +mock_dump_desc__nodump(const char *desc, const char *type) +{ + (void)desc; + (void)type; +} + +static int +mock_router_produce_hash_final__nohash(char *digest, + const char *start, size_t len, + digest_algorithm_t alg) +{ + (void)start; + (void)len; + /* we could look at start[..] */ + if (alg == DIGEST_SHA1) + memset(digest, 0x01, 20); + else + memset(digest, 0x02, 32); + return 0; +} + +int +fuzz_init(void) +{ + disable_signature_checking(); + MOCK(dump_desc, mock_dump_desc__nodump); + MOCK(router_compute_hash_final, mock_router_produce_hash_final__nohash); + ed25519_init(); + return 0; +} + +int +fuzz_cleanup(void) +{ + return 0; +} + +int +fuzz_main(const uint8_t *data, size_t sz) +{ + extrainfo_t *ei; + const char *str = (const char*) data; + int again = 0; + ei = extrainfo_parse_entry_from_string((const char *)str, + str+sz, + 0, NULL, &again); + if (ei) { + log_debug(LD_GENERAL, "Parsing okay"); + extrainfo_free(ei); + } else { + log_debug(LD_GENERAL, "Parsing failed"); + } + return 0; +} + diff --git a/src/test/fuzz/include.am b/src/test/fuzz/include.am index 7948b20..7f41318 100644 --- a/src/test/fuzz/include.am +++ b/src/test/fuzz/include.am @@ -39,8 +39,17 @@ src_test_fuzz_fuzz_http_CFLAGS = $(FUZZING_CFLAGS) src_test_fuzz_fuzz_http_LDFLAGS = $(FUZZING_LDFLAG) src_test_fuzz_fuzz_http_LDADD = $(FUZZING_LIBS) +src_test_fuzz_fuzz_extrainfo_SOURCES = \ + src/test/fuzz/fuzzing_common.c \ + src/test/fuzz/fuzz_extrainfo.c +src_test_fuzz_fuzz_extrainfo_CPPFLAGS = $(FUZZING_CPPFLAGS) +src_test_fuzz_fuzz_extrainfo_CFLAGS = $(FUZZING_CFLAGS) +src_test_fuzz_fuzz_extrainfo_LDFLAGS = $(FUZZING_LDFLAG) +src_test_fuzz_fuzz_extrainfo_LDADD = $(FUZZING_LIBS) + FUZZERS = \ src/test/fuzz/fuzz-descriptor \ + src/test/fuzz/fuzz-extrainfo \ src/test/fuzz/fuzz-http # The fuzzers aren't built by default right now. That should change.

1 0

[tor/master] Add a descriptor fuzzing dictionary.
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 949e9827d643f5c84d714482963214744d37495d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 13 20:26:26 2016 -0500 Add a descriptor fuzzing dictionary. --- src/test/fuzz/dict/descriptor | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/src/test/fuzz/dict/descriptor b/src/test/fuzz/dict/descriptor new file mode 100644 index 0000000..110ee3e --- /dev/null +++ b/src/test/fuzz/dict/descriptor @@ -0,0 +1,41 @@ +"reject" +"accept" +"reject6" +"accept6" +"router" +"ipv6-policy" +"signing-key" +"onion-key" +"ntor-onion-key" +"router-signature" +"published" +"uptime" +"fingerprint" +"hibernating" +"platform" +"proto" +"contact" +"read-history" +"write-history" +"extra-info-digest" +"hidden-service-dir" +"identity-ed25519" +"master-key-ed25519" +"router-sig-ed25519" +"onion-key-crosscert" +"ntor-onion-key-crosscert" +"allow-single-hop-exits" +"family" +"caches-extra-info" +"or-address" +"opt" + "bandwidth" +"@purpose" +"tunnelled-dir-server" +"-----BEGIN" +"-----END" +"-----" +"ED25519 CERT" +"RSA PUBLIC KEY" +"CROSSCERT" +"SIGNATURE"

1 0

[tor/master] Addition to test cases: make sure fuzzer binaries allow known cases
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 3c748559343b98f1dd37a0f49bd1e179715bf511 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 15:57:22 2016 -0500 Addition to test cases: make sure fuzzer binaries allow known cases This isn't fuzzing per se, so much as replaying the highlights of past fuzzer runs. --- src/test/fuzz/include.am | 5 +++-- src/test/fuzz_static_testcases.sh | 15 +++++++++++++++ src/test/include.am | 4 +++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/src/test/fuzz/include.am b/src/test/fuzz/include.am index 7f41318..16e5d30 100644 --- a/src/test/fuzz/include.am +++ b/src/test/fuzz/include.am @@ -52,6 +52,7 @@ FUZZERS = \ src/test/fuzz/fuzz-extrainfo \ src/test/fuzz/fuzz-http -# The fuzzers aren't built by default right now. That should change. -EXTRA_PROGRAMS += $(FUZZERS) +noinst_PROGRAMS += $(FUZZERS) fuzzers: $(FUZZERS) + + diff --git a/src/test/fuzz_static_testcases.sh b/src/test/fuzz_static_testcases.sh new file mode 100755 index 0000000..276bc6e --- /dev/null +++ b/src/test/fuzz_static_testcases.sh @@ -0,0 +1,15 @@ +#!/bin/sh + +# Copyright (c) 2016, The Tor Project, Inc. +# See LICENSE for licensing information + +set -e + +for fuzzer in "${builddir:-.}"/src/test/fuzz/fuzz-* ; do + f=`basename $fuzzer` + case="${f#fuzz-}" + echo "Running tests for ${case}" + for entry in ${abs_top_srcdir:-.}/src/test/fuzz/data/${case}/*; do + "${fuzzer}" "--err" < "$entry" + done +done diff --git a/src/test/include.am b/src/test/include.am index d406d6d..9f30443 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -8,7 +8,9 @@ TESTS_ENVIRONMENT = \ export builddir="$(builddir)"; \ export TESTING_TOR_BINARY="$(TESTING_TOR_BINARY)"; -TESTSCRIPTS = src/test/test_zero_length_keys.sh \ +TESTSCRIPTS = \ + src/test/fuzz_static_testcases.sh \ + src/test/test_zero_length_keys.sh \ src/test/test_workqueue_cancel.sh \ src/test/test_workqueue_efd.sh \ src/test/test_workqueue_efd2.sh \

1 0

[tor/master] Add microdesc format fuzzer.
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 4afb155db2d9aaafe8dd1517e9619e6bd9c95751 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 17:03:54 2016 -0500 Add microdesc format fuzzer. --- src/test/fuzz/dict/microdesc | 7 +++++++ src/test/fuzz/fuzz_microdesc.c | 45 ++++++++++++++++++++++++++++++++++++++++++ src/test/fuzz/include.am | 12 ++++++++++- 3 files changed, 63 insertions(+), 1 deletion(-) diff --git a/src/test/fuzz/dict/microdesc b/src/test/fuzz/dict/microdesc new file mode 100644 index 0000000..fdd0567 --- /dev/null +++ b/src/test/fuzz/dict/microdesc @@ -0,0 +1,7 @@ +"onion-key" +"ntor-onion-key" +"id" +"a" +"family" +"p" +"p6" diff --git a/src/test/fuzz/fuzz_microdesc.c b/src/test/fuzz/fuzz_microdesc.c new file mode 100644 index 0000000..bb94459 --- /dev/null +++ b/src/test/fuzz/fuzz_microdesc.c @@ -0,0 +1,45 @@ +#define ROUTERPARSE_PRIVATE +#include "or.h" +#include "routerparse.h" +#include "microdesc.h" +#include "fuzzing.h" + +static void +mock_dump_desc__nodump(const char *desc, const char *type) +{ + (void)desc; + (void)type; +} + +int +fuzz_init(void) +{ + disable_signature_checking(); + MOCK(dump_desc, mock_dump_desc__nodump); + ed25519_init(); + return 0; +} + +int +fuzz_cleanup(void) +{ + return 0; +} + +int +fuzz_main(const uint8_t *data, size_t sz) +{ + const char *str = (const char*) data; + smartlist_t *result = microdescs_parse_from_string((const char *)str, + str+sz, + 0, SAVED_NOWHERE, NULL); + if (result) { + log_debug(LD_GENERAL, "Parsing okay: %d", smartlist_len(result)); + SMARTLIST_FOREACH(result, microdesc_t *, md, microdesc_free(md)); + smartlist_free(result); + } else { + log_debug(LD_GENERAL, "Parsing failed"); + } + return 0; +} + diff --git a/src/test/fuzz/include.am b/src/test/fuzz/include.am index 16e5d30..bfe3808 100644 --- a/src/test/fuzz/include.am +++ b/src/test/fuzz/include.am @@ -47,12 +47,22 @@ src_test_fuzz_fuzz_extrainfo_CFLAGS = $(FUZZING_CFLAGS) src_test_fuzz_fuzz_extrainfo_LDFLAGS = $(FUZZING_LDFLAG) src_test_fuzz_fuzz_extrainfo_LDADD = $(FUZZING_LIBS) +src_test_fuzz_fuzz_microdesc_SOURCES = \ + src/test/fuzz/fuzzing_common.c \ + src/test/fuzz/fuzz_microdesc.c +src_test_fuzz_fuzz_microdesc_CPPFLAGS = $(FUZZING_CPPFLAGS) +src_test_fuzz_fuzz_microdesc_CFLAGS = $(FUZZING_CFLAGS) +src_test_fuzz_fuzz_microdesc_LDFLAGS = $(FUZZING_LDFLAG) +src_test_fuzz_fuzz_microdesc_LDADD = $(FUZZING_LIBS) + FUZZERS = \ src/test/fuzz/fuzz-descriptor \ src/test/fuzz/fuzz-extrainfo \ - src/test/fuzz/fuzz-http + src/test/fuzz/fuzz-http \ + src/test/fuzz/fuzz-microdesc noinst_PROGRAMS += $(FUZZERS) fuzzers: $(FUZZERS) +

1 0

[tor/master] oss_fuzz also requires no PIE
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 99d4faf6d35b5923daf48605da0d9da2e7de1824 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 11:26:27 2017 -0500 oss_fuzz also requires no PIE --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index aff41ae..f643806 100644 --- a/configure.ac +++ b/configure.ac @@ -765,7 +765,7 @@ m4_ifdef([AS_VAR_IF],[ AS_VAR_POPDEF([can_compile]) TOR_CHECK_CFLAGS(-Wstack-protector) TOR_CHECK_CFLAGS(--param ssp-buffer-size=1) - if test "$bwin32" = "false" && test "$enable_libfuzzer" != "yes"; then + if test "$bwin32" = "false" && test "$enable_libfuzzer" != "yes" && test "$enable_oss_fuzz" != "yes"; then TOR_CHECK_CFLAGS(-fPIE) TOR_CHECK_LDFLAGS(-pie, "$all_ldflags_for_check", "$all_libs_for_check") fi

1 0

[tor/master] Tools for working with directories of fuzzed stuff.
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 83e9918107dba1b969a226b79e1d37a852339e45 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 16 10:24:36 2016 -0500 Tools for working with directories of fuzzed stuff. --- src/test/fuzz/fixup_filenames.sh | 19 +++++++++++++++++++ src/test/fuzz/minimize.sh | 14 ++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/src/test/fuzz/fixup_filenames.sh b/src/test/fuzz/fixup_filenames.sh new file mode 100755 index 0000000..68efc1a --- /dev/null +++ b/src/test/fuzz/fixup_filenames.sh @@ -0,0 +1,19 @@ +#!/bin/sh + +set -e + +if [ ! -d "$1" ] ; then + echo "I need a directory" + exit 1 +fi + +for fn in "$1"/* ; do + prev=`basename "$fn"` + post=`sha256sum "$fn" | sed -e 's/ .*//;'` + if [ "$prev" == "$post" ] ; then + echo "OK $prev" + else + echo "mv $prev $post" + mv "$fn" "$1/$post" + fi +done diff --git a/src/test/fuzz/minimize.sh b/src/test/fuzz/minimize.sh new file mode 100755 index 0000000..87d3dda --- /dev/null +++ b/src/test/fuzz/minimize.sh @@ -0,0 +1,14 @@ +#!/bin/sh + +set -e + +if [ ! -d "$1" ] ; then + echo "I need a directory" + exit 1 +fi + +which=`basename "$1"` + +mkdir "$1.out" +afl-cmin -i "$1" -o "$1.out" -m none "./src/test/fuzz/fuzz-${which}" +

1 0

[tor/master] fuzzing: Add copyright notices and whitespace fixes
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 301eff0e90a727005d364ebc2e9a7ffaecd0a3ef Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 17:11:26 2016 -0500 fuzzing: Add copyright notices and whitespace fixes --- Makefile.am | 1 + src/test/fuzz/fuzz_descriptor.c | 2 ++ src/test/fuzz/fuzz_extrainfo.c | 2 ++ src/test/fuzz/fuzz_http.c | 2 +- src/test/fuzz/fuzz_microdesc.c | 2 ++ src/test/fuzz/fuzzing.h | 3 +++ src/test/fuzz/fuzzing_common.c | 6 ++++-- 7 files changed, 15 insertions(+), 3 deletions(-) diff --git a/Makefile.am b/Makefile.am index 2e853d4..5204830 100644 --- a/Makefile.am +++ b/Makefile.am @@ -190,6 +190,7 @@ if USE_PERL $(top_srcdir)/src/common/*.[ch] \ $(top_srcdir)/src/or/*.[ch] \ $(top_srcdir)/src/test/*.[ch] \ + $(top_srcdir)/src/test/*/*.[ch] \ $(top_srcdir)/src/tools/*.[ch] endif diff --git a/src/test/fuzz/fuzz_descriptor.c b/src/test/fuzz/fuzz_descriptor.c index 563787b..d19386d 100644 --- a/src/test/fuzz/fuzz_descriptor.c +++ b/src/test/fuzz/fuzz_descriptor.c @@ -1,3 +1,5 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ #define ROUTERPARSE_PRIVATE #include "or.h" #include "routerparse.h" diff --git a/src/test/fuzz/fuzz_extrainfo.c b/src/test/fuzz/fuzz_extrainfo.c index 6bfc425..6251e60 100644 --- a/src/test/fuzz/fuzz_extrainfo.c +++ b/src/test/fuzz/fuzz_extrainfo.c @@ -1,3 +1,5 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ #define ROUTERPARSE_PRIVATE #include "or.h" #include "routerparse.h" diff --git a/src/test/fuzz/fuzz_http.c b/src/test/fuzz/fuzz_http.c index 15d3726..f069900 100644 --- a/src/test/fuzz/fuzz_http.c +++ b/src/test/fuzz/fuzz_http.c @@ -37,7 +37,6 @@ mock_directory_handle_command_get(dir_connection_t *conn, if (headers) { log_debug(LD_GENERAL, "Header-Length:\n%zu\n", strlen(headers)); log_debug(LD_GENERAL, "Headers:\n%s\n", headers); - } log_debug(LD_GENERAL, "Body-Length:\n%zu\n", body_len); @@ -130,3 +129,4 @@ fuzz_main(const uint8_t *stdin_buf, size_t data_size) return 0; } + diff --git a/src/test/fuzz/fuzz_microdesc.c b/src/test/fuzz/fuzz_microdesc.c index bb94459..bb89546 100644 --- a/src/test/fuzz/fuzz_microdesc.c +++ b/src/test/fuzz/fuzz_microdesc.c @@ -1,3 +1,5 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ #define ROUTERPARSE_PRIVATE #include "or.h" #include "routerparse.h" diff --git a/src/test/fuzz/fuzzing.h b/src/test/fuzz/fuzzing.h index a8cbb1d..4295743 100644 --- a/src/test/fuzz/fuzzing.h +++ b/src/test/fuzz/fuzzing.h @@ -1,3 +1,5 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ #ifndef FUZZING_H #define FUZZING_H @@ -8,3 +10,4 @@ int fuzz_main(const uint8_t *data, size_t sz); void disable_signature_checking(void); #endif /* FUZZING_H */ + diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index 54a7923..57c3cf5 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -1,3 +1,5 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ #define CRYPTO_ED25519_PRIVATE #include "orconfig.h" #include "or.h" @@ -78,7 +80,6 @@ mock_ed25519_impl_spot_check__nocheck(void) return 0; } - void disable_signature_checking(void) { @@ -93,7 +94,8 @@ disable_signature_checking(void) #ifdef LLVM_FUZZ int -LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { +LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) +{ static int initialized = 0; if (!initialized) { if (fuzz_init() < 0)

1 0

[tor/master] Try to refactor OSS fuzzers into static libraries.
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 92679d90d54d6bde28124fd56e443c02f89b4e52 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 12:25:28 2017 -0500 Try to refactor OSS fuzzers into static libraries. --- src/test/fuzz/include.am | 87 +++++++++++++++++++----------------------------- 1 file changed, 35 insertions(+), 52 deletions(-) diff --git a/src/test/fuzz/include.am b/src/test/fuzz/include.am index bb92c87..b73139f 100644 --- a/src/test/fuzz/include.am +++ b/src/test/fuzz/include.am @@ -178,79 +178,62 @@ endif if OSS_FUZZ_ENABLED OSS_FUZZ_CPPFLAGS = $(FUZZING_CPPFLAGS) -DLLVM_FUZZ OSS_FUZZ_CFLAGS = $(FUZZING_CFLAGS) -OSS_FUZZ_LDFLAG = $(FUZZING_LDFLAG) -OSS_FUZZ_LIBS = $(FUZZING_LIBS) -lFuzzingEngine -lstdc++ -src_test_fuzz_oss_fuzz_consensus_SOURCES = \ +src_test_fuzz_oss_fuzz_consensus_a_SOURCES = \ $(src_test_fuzz_fuzz_consensus_SOURCES) -src_test_fuzz_oss_fuzz_consensus_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_consensus_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_consensus_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_consensus_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_consensus_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_consensus_a_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_descriptor_SOURCES = \ +src_test_fuzz_oss_fuzz_descriptor_a_SOURCES = \ $(src_test_fuzz_fuzz_descriptor_SOURCES) -src_test_fuzz_oss_fuzz_descriptor_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_descriptor_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_descriptor_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_descriptor_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_descriptor_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_descriptor_a_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_extrainfo_SOURCES = \ +src_test_fuzz_oss_fuzz_extrainfo_a_SOURCES = \ $(src_test_fuzz_fuzz_extrainfo_SOURCES) -src_test_fuzz_oss_fuzz_extrainfo_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_extrainfo_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_extrainfo_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_extrainfo_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_extrainfo_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_extrainfo_a_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_http_SOURCES = \ +src_test_fuzz_oss_fuzz_http_a_SOURCES = \ $(src_test_fuzz_fuzz_http_SOURCES) -src_test_fuzz_oss_fuzz_http_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_http_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_http_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_http_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_http_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_http_a_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_hsdescv2_SOURCES = \ +src_test_fuzz_oss_fuzz_hsdescv2_a_SOURCES = \ $(src_test_fuzz_fuzz_hsdescv2_SOURCES) -src_test_fuzz_oss_fuzz_hsdescv2_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_hsdescv2_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_hsdescv2_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_hsdescv2_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_hsdescv2_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_hsdescv2_a_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_iptsv2_SOURCES = \ +src_test_fuzz_oss_fuzz_iptsv2_a_SOURCES = \ $(src_test_fuzz_fuzz_iptsv2_SOURCES) -src_test_fuzz_oss_fuzz_iptsv2_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_iptsv2_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_iptsv2_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_iptsv2_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_iptsv2_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_iptsv2_a_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_microdesc_SOURCES = \ +src_test_fuzz_oss_fuzz_microdesc_a_SOURCES = \ $(src_test_fuzz_fuzz_microdesc_SOURCES) -src_test_fuzz_oss_fuzz_microdesc_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_microdesc_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_microdesc_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_microdesc_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_microdesc_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_microdesc_a_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_vrs_SOURCES = \ +src_test_fuzz_oss_fuzz_vrs_a_a_SOURCES = \ $(src_test_fuzz_fuzz_vrs_SOURCES) -src_test_fuzz_oss_fuzz_vrs_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) -src_test_fuzz_oss_fuzz_vrs_CFLAGS = $(OSS_FUZZ_CFLAGS) -src_test_fuzz_oss_fuzz_vrs_LDFLAGS = $(OSS_FUZZ_LDFLAG) -src_test_fuzz_oss_fuzz_vrs_LDADD = $(OSS_FUZZ_LIBS) +src_test_fuzz_oss_fuzz_vrs_a_a_CPPFLAGS = $(OSS_FUZZ_CPPFLAGS) +src_test_fuzz_oss_fuzz_vrs_a_a_CFLAGS = $(OSS_FUZZ_CFLAGS) OSS_FUZZ_FUZZERS = \ - src/test/fuzz/oss-fuzz-consensus \ - src/test/fuzz/oss-fuzz-descriptor \ - src/test/fuzz/oss-fuzz-extrainfo \ - src/test/fuzz/oss-fuzz-http \ - src/test/fuzz/oss-fuzz-hsdescv2 \ - src/test/fuzz/oss-fuzz-iptsv2 \ - src/test/fuzz/oss-fuzz-microdesc \ - src/test/fuzz/oss-fuzz-vrs + src/test/fuzz/oss-fuzz-consensus.a \ + src/test/fuzz/oss-fuzz-descriptor.a \ + src/test/fuzz/oss-fuzz-extrainfo.a \ + src/test/fuzz/oss-fuzz-http.a \ + src/test/fuzz/oss-fuzz-hsdescv2.a \ + src/test/fuzz/oss-fuzz-iptsv2.a \ + src/test/fuzz/oss-fuzz-microdesc.a \ + src/test/fuzz/oss-fuzz-vrs.a else -OSS_FUZZ_FUZZERS +OSS_FUZZ_FUZZERS = endif -noinst_PROGRAMS += $(FUZZERS) $(LIBFUZZER_FUZZERS) $(OSS_FUZZ_FUZZERS) +noinst_PROGRAMS += $(FUZZERS) $(LIBFUZZER_FUZZERS) +noinst_LIBRARIES += $(OSS_FUZZ_FUZZERS) oss-fuzz-fuzzers: $(OSS_FUZZ_FUZZERS) fuzzers: $(FUZZERS) $(LIBFUZZER_FUZZERS)

1 0

[tor/master] routerstatus fuzzing
by nickm＠torproject.org 30 Jan '17

30 Jan '17

commit 024fa9d4d76d21d1a51b0a362552bcbff4159b3a Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Dec 31 15:09:11 2016 -0500 routerstatus fuzzing --- src/test/fuzz/fuzz_vrs.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++++ src/test/fuzz/include.am | 23 ++++++++++++-- 2 files changed, 98 insertions(+), 3 deletions(-) diff --git a/src/test/fuzz/fuzz_vrs.c b/src/test/fuzz/fuzz_vrs.c new file mode 100644 index 0000000..1c4e5e2 --- /dev/null +++ b/src/test/fuzz/fuzz_vrs.c @@ -0,0 +1,78 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ +#define ROUTERPARSE_PRIVATE +#define NETWORKSTATUS_PRIVATE +#include "or.h" +#include "routerparse.h" +#include "memarea.h" +#include "microdesc.h" +#include "networkstatus.h" +#include "fuzzing.h" + +static void +mock_dump_desc__nodump(const char *desc, const char *type) +{ + (void)desc; + (void)type; +} + +static networkstatus_t *dummy_vote = NULL; +static memarea_t *area = NULL; + +int +fuzz_init(void) +{ + disable_signature_checking(); + MOCK(dump_desc, mock_dump_desc__nodump); + ed25519_init(); + area = memarea_new(); + dummy_vote = tor_malloc_zero(sizeof(*dummy_vote)); + dummy_vote->known_flags = smartlist_new(); + smartlist_split_string(dummy_vote->known_flags, + "Authority BadExit Exit Fast Guard HSDir " + "NoEdConsensus Running Stable V2Dir Valid", + " ", 0, 0); + return 0; +} + +int +fuzz_cleanup(void) +{ + tor_free(dummy_vote); + return 0; +} + +int +fuzz_main(const uint8_t *data, size_t sz) +{ + const char *str = tor_memdup_nulterm(data, sz), *s; + routerstatus_t *rs_ns = NULL, *rs_md = NULL, *rs_vote = NULL; + vote_routerstatus_t *vrs = tor_malloc_zero(sizeof(*vrs)); + smartlist_t *tokens = smartlist_new(); + + s = str; + rs_ns = routerstatus_parse_entry_from_string(area, &s, tokens, + NULL, NULL, 26, FLAV_NS); + tor_assert(smartlist_len(tokens) == 0); + + s = str; + rs_md = routerstatus_parse_entry_from_string(area, &s, tokens, + NULL, NULL, 26, FLAV_MICRODESC); + tor_assert(smartlist_len(tokens) == 0); + + s = str; + rs_vote = routerstatus_parse_entry_from_string(area, &s, tokens, + dummy_vote, vrs, 26, FLAV_NS); + tor_assert(smartlist_len(tokens) == 0); + + log_debug(LD_GENERAL, + "ns=%p, md=%p, vote=%p", rs_ns, rs_md, rs_vote); + + routerstatus_free(rs_md); + routerstatus_free(rs_ns); + vote_routerstatus_free(vrs); + memarea_clear(area); + smartlist_free(tokens); + return 0; +} + diff --git a/src/test/fuzz/include.am b/src/test/fuzz/include.am index c716889..2bfdaf3 100644 --- a/src/test/fuzz/include.am +++ b/src/test/fuzz/include.am @@ -79,6 +79,14 @@ src_test_fuzz_fuzz_microdesc_CFLAGS = $(FUZZING_CFLAGS) src_test_fuzz_fuzz_microdesc_LDFLAGS = $(FUZZING_LDFLAG) src_test_fuzz_fuzz_microdesc_LDADD = $(FUZZING_LIBS) +src_test_fuzz_fuzz_vrs_SOURCES = \ + src/test/fuzz/fuzzing_common.c \ + src/test/fuzz/fuzz_vrs.c +src_test_fuzz_fuzz_vrs_CPPFLAGS = $(FUZZING_CPPFLAGS) +src_test_fuzz_fuzz_vrs_CFLAGS = $(FUZZING_CFLAGS) +src_test_fuzz_fuzz_vrs_LDFLAGS = $(FUZZING_LDFLAG) +src_test_fuzz_fuzz_vrs_LDADD = $(FUZZING_LIBS) + FUZZERS = \ src/test/fuzz/fuzz-consensus \ src/test/fuzz/fuzz-descriptor \ @@ -86,7 +94,9 @@ FUZZERS = \ src/test/fuzz/fuzz-http \ src/test/fuzz/fuzz-hsdescv2 \ src/test/fuzz/fuzz-iptsv2 \ - src/test/fuzz/fuzz-microdesc + src/test/fuzz/fuzz-microdesc \ + src/test/fuzz/fuzz-vrs + LIBFUZZER = /home/nickm/build/libfuzz/libFuzzer.a LIBFUZZER_CPPFLAGS = $(FUZZING_CPPFLAGS) -DLLVM_FUZZ @@ -144,6 +154,13 @@ src_test_fuzz_lf_fuzz_microdesc_CFLAGS = $(LIBFUZZER_CFLAGS) src_test_fuzz_lf_fuzz_microdesc_LDFLAGS = $(LIBFUZZER_LDFLAG) src_test_fuzz_lf_fuzz_microdesc_LDADD = $(LIBFUZZER_LIBS) +src_test_fuzz_lf_fuzz_vrs_SOURCES = \ + $(src_test_fuzz_fuzz_vrs_SOURCES) +src_test_fuzz_lf_fuzz_vrs_CPPFLAGS = $(LIBFUZZER_CPPFLAGS) +src_test_fuzz_lf_fuzz_vrs_CFLAGS = $(LIBFUZZER_CFLAGS) +src_test_fuzz_lf_fuzz_vrs_LDFLAGS = $(LIBFUZZER_LDFLAG) +src_test_fuzz_lf_fuzz_vrs_LDADD = $(LIBFUZZER_LIBS) + LIBFUZZER_FUZZERS = \ src/test/fuzz/lf-fuzz-consensus \ src/test/fuzz/lf-fuzz-descriptor \ @@ -151,7 +168,8 @@ LIBFUZZER_FUZZERS = \ src/test/fuzz/lf-fuzz-http \ src/test/fuzz/lf-fuzz-hsdescv2 \ src/test/fuzz/lf-fuzz-iptsv2 \ - src/test/fuzz/lf-fuzz-microdesc + src/test/fuzz/lf-fuzz-microdesc \ + src/test/fuzz/lf-fuzz-vrs else LIBFUZZER_FUZZERS = @@ -160,4 +178,3 @@ endif noinst_PROGRAMS += $(FUZZERS) $(LIBFUZZER_FUZZERS) fuzzers: $(FUZZERS) $(LIBFUZZER_FUZZERS) -

1 0