mirror of https://github.com/OISF/suricata
fuzz: remove obsolete AFL code
Philippe Antoine
7 years ago
parent
19fe8d9894
commit
293eebd999
@ -1,13 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
NAME=$1
|
|
||||||
|
|
||||||
SERIES=$(ls ${NAME}/dump/ |sort|cut -f 1 -d'.'|sort -u)
|
|
||||||
|
|
||||||
for S in $SERIES; do
|
|
||||||
FILEPATH="${NAME}/dump/${S}.999"
|
|
||||||
if [ ! -f $FILEPATH ]; then
|
|
||||||
echo "SERIE $S incomplete, possible crash"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
@ -1,24 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
PROTO=$1
|
|
||||||
|
|
||||||
if [ ! -d $1 ]; then
|
|
||||||
mkdir -p $1/output
|
|
||||||
mkdir -p $1/dump
|
|
||||||
mkdir -p $1/input
|
|
||||||
echo "1" > $1/input/seed.txt
|
|
||||||
else
|
|
||||||
CRASHES=$(ls ${1}/output/crashes|wc -l)
|
|
||||||
if [ $CRASHED -ne "0" ]; then
|
|
||||||
DIRNAME=$(date +%s)
|
|
||||||
mkdir "${1}/$DIRNAME"
|
|
||||||
mv -f ${1}/output/crashes/* ${1}/$DIRNAME/
|
|
||||||
fi
|
|
||||||
mv -f $1/output/queue/id* $1/input/
|
|
||||||
rm -r $1/output/
|
|
||||||
mkdir $1/output
|
|
||||||
fi
|
|
||||||
cd $1
|
|
||||||
export ASAN_OPTIONS="detect_leaks=0 abort_on_error=1 symbolize=0"
|
|
||||||
export AFL_SKIP_CPUFREQ=1
|
|
||||||
/usr/local/bin/afl-fuzz -T ${PROTO} -t 1000 -m none -i input/ -o output/ -- ../../src/suricata --afl-${PROTO}=@@
|
|
||||||
@ -1,183 +0,0 @@
|
|||||||
/* Copyright (C) 2007-2017 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include "suricata-common.h"
|
|
||||||
#include "suricata.h"
|
|
||||||
#include "conf.h"
|
|
||||||
#include "decode.h"
|
|
||||||
#include "util-debug.h"
|
|
||||||
#include "util-mem.h"
|
|
||||||
#include "app-layer-detect-proto.h"
|
|
||||||
#include "app-layer.h"
|
|
||||||
#include "tm-threads.h"
|
|
||||||
#include "util-error.h"
|
|
||||||
#include "util-print.h"
|
|
||||||
#include "tmqh-packetpool.h"
|
|
||||||
#include "util-profiling.h"
|
|
||||||
#include "pkt-var.h"
|
|
||||||
#include "util-mpm-ac.h"
|
|
||||||
|
|
||||||
#include "output.h"
|
|
||||||
#include "output-flow.h"
|
|
||||||
|
|
||||||
#include "defrag.h"
|
|
||||||
#include "flow.h"
|
|
||||||
|
|
||||||
#ifdef AFLFUZZ_DECODER
|
|
||||||
int AFLDecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
||||||
const uint8_t *pkt, uint32_t len)
|
|
||||||
{
|
|
||||||
return DecodeIPV4(tv, dtv, p, pkt, (uint16_t)len);
|
|
||||||
}
|
|
||||||
int AFLDecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
|
|
||||||
const uint8_t *pkt, uint32_t len)
|
|
||||||
{
|
|
||||||
return DecodeIPV6(tv, dtv, p, pkt, (uint16_t)len);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* stateful processing of data as packets. Because AFL in case of a
|
|
||||||
* crash will only safe the last input, we dump all the inputs to a
|
|
||||||
* directory 'dump' with a unique timestamp for the serie and an
|
|
||||||
* incrementing 'id' so that we can 'replay' it in
|
|
||||||
* DecoderParseDataFromFileSerie().
|
|
||||||
*/
|
|
||||||
int DecoderParseDataFromFile(char *filename, DecoderFunc Decoder)
|
|
||||||
{
|
|
||||||
bool do_dump = (getenv("SC_AFL_DUMP_FILES") != NULL);
|
|
||||||
uint8_t buffer[65536];
|
|
||||||
struct timeval ts;
|
|
||||||
memset(&ts, 0, sizeof(ts));
|
|
||||||
gettimeofday(&ts, NULL);
|
|
||||||
|
|
||||||
uint32_t cnt = 0;
|
|
||||||
|
|
||||||
DefragInit();
|
|
||||||
FlowInitConfig(FLOW_QUIET);
|
|
||||||
|
|
||||||
ThreadVars tv;
|
|
||||||
memset(&tv, 0, sizeof(tv));
|
|
||||||
DecodeThreadVars *dtv = DecodeThreadVarsAlloc(&tv);
|
|
||||||
DecodeRegisterPerfCounters(dtv, &tv);
|
|
||||||
StatsSetupPrivate(&tv);
|
|
||||||
PacketQueue pq;
|
|
||||||
memset(&pq, 0, sizeof(pq));
|
|
||||||
|
|
||||||
#ifdef AFLFUZZ_PERSISTANT_MODE
|
|
||||||
while (__AFL_LOOP(1000)) {
|
|
||||||
/* reset state */
|
|
||||||
memset(buffer, 0, sizeof(buffer));
|
|
||||||
#endif /* AFLFUZZ_PERSISTANT_MODE */
|
|
||||||
|
|
||||||
FILE *fp = fopen(filename, "r");
|
|
||||||
BUG_ON(fp == NULL);
|
|
||||||
|
|
||||||
size_t size = fread(&buffer, 1, sizeof(buffer), fp);
|
|
||||||
if (do_dump) {
|
|
||||||
char outfilename[256];
|
|
||||||
snprintf(outfilename, sizeof(outfilename), "dump/%u-%u.%u",
|
|
||||||
(unsigned int)ts.tv_sec, (unsigned int)ts.tv_usec, cnt);
|
|
||||||
FILE *out_fp = fopen(outfilename, "w");
|
|
||||||
BUG_ON(out_fp == NULL);
|
|
||||||
(void)fwrite(buffer, size, 1, out_fp);
|
|
||||||
fclose(out_fp);
|
|
||||||
}
|
|
||||||
|
|
||||||
Packet *p = PacketGetFromAlloc();
|
|
||||||
if (p != NULL) {
|
|
||||||
PacketSetData(p, buffer, size);
|
|
||||||
(void) Decoder (&tv, dtv, p, buffer, size);
|
|
||||||
while (1) {
|
|
||||||
Packet *extra_p = PacketDequeueNoLock(&tv.decode_pq);
|
|
||||||
if (unlikely(extra_p == NULL))
|
|
||||||
break;
|
|
||||||
PacketFree(extra_p);
|
|
||||||
}
|
|
||||||
PacketFree(p);
|
|
||||||
}
|
|
||||||
fclose(fp);
|
|
||||||
cnt++;
|
|
||||||
|
|
||||||
#ifdef AFLFUZZ_PERSISTANT_MODE
|
|
||||||
}
|
|
||||||
#endif /* AFLFUZZ_PERSISTANT_MODE */
|
|
||||||
|
|
||||||
/* if we get here there was no crash, so we can remove our files */
|
|
||||||
if (do_dump) {
|
|
||||||
for (uint32_t x = 0; x < cnt; x++) {
|
|
||||||
char rmfilename[256];
|
|
||||||
snprintf(rmfilename, sizeof(rmfilename), "dump/%u-%u.%u",
|
|
||||||
(unsigned int)ts.tv_sec, (unsigned int)ts.tv_usec, x);
|
|
||||||
unlink(rmfilename);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
DecodeThreadVarsFree(&tv, dtv);
|
|
||||||
FlowShutdown();
|
|
||||||
DefragDestroy();
|
|
||||||
StatsThreadCleanup(&tv);
|
|
||||||
StatsReleaseResources();
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* load a serie of files generated by DecoderParseDataFromFile() in
|
|
||||||
* the same order as it was produced. */
|
|
||||||
int DecoderParseDataFromFileSerie(char *fileprefix, DecoderFunc Decoder)
|
|
||||||
{
|
|
||||||
uint8_t buffer[65536];
|
|
||||||
uint32_t cnt = 0;
|
|
||||||
|
|
||||||
DefragInit();
|
|
||||||
FlowInitConfig(FLOW_QUIET);
|
|
||||||
ThreadVars tv;
|
|
||||||
memset(&tv, 0, sizeof(tv));
|
|
||||||
DecodeThreadVars *dtv = DecodeThreadVarsAlloc(&tv);
|
|
||||||
DecodeRegisterPerfCounters(dtv, &tv);
|
|
||||||
StatsSetupPrivate(&tv);
|
|
||||||
PacketQueue pq;
|
|
||||||
memset(&pq, 0, sizeof(pq));
|
|
||||||
|
|
||||||
char filename[256];
|
|
||||||
snprintf(filename, sizeof(filename), "dump/%s.%u", fileprefix, cnt);
|
|
||||||
FILE *fp;
|
|
||||||
while ((fp = fopen(filename, "r")) != NULL)
|
|
||||||
{
|
|
||||||
memset(buffer, 0, sizeof(buffer));
|
|
||||||
|
|
||||||
size_t size = fread(&buffer, 1, sizeof(buffer), fp);
|
|
||||||
|
|
||||||
Packet *p = PacketGetFromAlloc();
|
|
||||||
if (p != NULL) {
|
|
||||||
PacketSetData(p, buffer, size);
|
|
||||||
(void) Decoder (&tv, dtv, p, buffer, size);
|
|
||||||
while (1) {
|
|
||||||
Packet *extra_p = PacketDequeueNoLock(&tv.decode_pq);
|
|
||||||
if (unlikely(extra_p == NULL))
|
|
||||||
break;
|
|
||||||
PacketFree(extra_p);
|
|
||||||
}
|
|
||||||
PacketFree(p);
|
|
||||||
}
|
|
||||||
fclose(fp);
|
|
||||||
cnt++;
|
|
||||||
snprintf(filename, sizeof(filename), "dump/%s.%u", fileprefix, cnt);
|
|
||||||
}
|
|
||||||
DecodeThreadVarsFree(&tv, dtv);
|
|
||||||
FlowShutdown();
|
|
||||||
DefragDestroy();
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
#endif /* AFLFUZZ_DECODER */
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue