mirror of https://github.com/OISF/suricata
fuzz: adds structure aware target
so as not to fuzz libpcap and generate structure aware signaturespull/6004/head
Philippe Antoine
6 years ago
committed by
Victor Julien
parent
0105d4f017
commit
e8415f249b
@ -0,0 +1,178 @@
|
|||||||
|
/**
|
||||||
|
* @file
|
||||||
|
* @author Philippe Antoine <contact@catenacyber.fr>
|
||||||
|
* fuzz target for AppLayerProtoDetectGetProto
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include "suricata-common.h"
|
||||||
|
#include "source-pcap-file.h"
|
||||||
|
#include "detect-engine.h"
|
||||||
|
#include "util-classification-config.h"
|
||||||
|
#include "util-reference-config.h"
|
||||||
|
#include "app-layer.h"
|
||||||
|
#include "tm-queuehandlers.h"
|
||||||
|
#include "util-cidr.h"
|
||||||
|
#include "util-proto-name.h"
|
||||||
|
#include "detect-engine-tag.h"
|
||||||
|
#include "detect-engine-threshold.h"
|
||||||
|
#include "host-bit.h"
|
||||||
|
#include "ippair-bit.h"
|
||||||
|
#include "app-layer-htp.h"
|
||||||
|
#include "detect-fast-pattern.h"
|
||||||
|
#include "util-unittest-helper.h"
|
||||||
|
#include "conf-yaml-loader.h"
|
||||||
|
#include "pkt-var.h"
|
||||||
|
|
||||||
|
#include <fuzz_pcap.h>
|
||||||
|
|
||||||
|
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
|
||||||
|
|
||||||
|
static int initialized = 0;
|
||||||
|
ThreadVars tv;
|
||||||
|
DecodeThreadVars *dtv;
|
||||||
|
// FlowWorkerThreadData
|
||||||
|
void *fwd;
|
||||||
|
SCInstance surifuzz;
|
||||||
|
|
||||||
|
#include "confyaml.c"
|
||||||
|
|
||||||
|
static void SigGenereateAware(const uint8_t *data, size_t size, char *r, size_t *len)
|
||||||
|
{
|
||||||
|
*len = snprintf(r, 511, "alert ip any any -> any any (");
|
||||||
|
for (size_t i = 0; i + 1 < size && *len < 511; i++) {
|
||||||
|
if (data[i] & 0x80) {
|
||||||
|
size_t off = (data[i] & 0x7F + ((data[i + 1] & 0xF) << 7)) %
|
||||||
|
(sizeof(sigmatch_table) / sizeof(SigTableElmt));
|
||||||
|
if (sigmatch_table[off].flags & SIGMATCH_NOOPT ||
|
||||||
|
((data[i + 1] & 0x80) && sigmatch_table[off].flags & SIGMATCH_OPTIONAL_OPT)) {
|
||||||
|
*len += snprintf(r + *len, 511 - *len, "; %s;", sigmatch_table[off].name);
|
||||||
|
} else {
|
||||||
|
*len += snprintf(r + *len, 511 - *len, "; %s:", sigmatch_table[off].name);
|
||||||
|
}
|
||||||
|
i++;
|
||||||
|
} else {
|
||||||
|
r[*len] = data[i];
|
||||||
|
*len = *len + 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (*len < 511) {
|
||||||
|
*len += snprintf(r + *len, 511 - *len, ")");
|
||||||
|
} else {
|
||||||
|
r[511] = 0;
|
||||||
|
*len = 511;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
|
||||||
|
{
|
||||||
|
FPC_buffer_t pkts;
|
||||||
|
const u_char *pkt;
|
||||||
|
struct pcap_pkthdr header;
|
||||||
|
int r;
|
||||||
|
Packet *p;
|
||||||
|
size_t pos;
|
||||||
|
size_t pcap_cnt = 0;
|
||||||
|
|
||||||
|
if (initialized == 0) {
|
||||||
|
// Redirects logs to /dev/null
|
||||||
|
setenv("SC_LOG_OP_IFACE", "file", 0);
|
||||||
|
setenv("SC_LOG_FILE", "/dev/null", 0);
|
||||||
|
|
||||||
|
InitGlobal();
|
||||||
|
|
||||||
|
GlobalsInitPreConfig();
|
||||||
|
run_mode = RUNMODE_PCAP_FILE;
|
||||||
|
// redirect logs to /tmp
|
||||||
|
ConfigSetLogDirectory("/tmp/");
|
||||||
|
// disables checksums validation for fuzzing
|
||||||
|
if (ConfYamlLoadString(configNoChecksum, strlen(configNoChecksum)) != 0) {
|
||||||
|
abort();
|
||||||
|
}
|
||||||
|
// do not load rules before reproducible DetectEngineReload
|
||||||
|
remove("/tmp/fuzz.rules");
|
||||||
|
surifuzz.sig_file = strdup("/tmp/fuzz.rules");
|
||||||
|
surifuzz.sig_file_exclusive = 1;
|
||||||
|
// loads rules after init
|
||||||
|
surifuzz.delayed_detect = 1;
|
||||||
|
|
||||||
|
PostConfLoadedSetup(&surifuzz);
|
||||||
|
PreRunPostPrivsDropInit(run_mode);
|
||||||
|
PostConfLoadedDetectSetup(&surifuzz);
|
||||||
|
|
||||||
|
memset(&tv, 0, sizeof(tv));
|
||||||
|
tv.flow_queue = FlowQueueNew();
|
||||||
|
if (tv.flow_queue == NULL)
|
||||||
|
abort();
|
||||||
|
dtv = DecodeThreadVarsAlloc(&tv);
|
||||||
|
DecodeRegisterPerfCounters(dtv, &tv);
|
||||||
|
tmm_modules[TMM_FLOWWORKER].ThreadInit(&tv, NULL, &fwd);
|
||||||
|
StatsSetupPrivate(&tv);
|
||||||
|
|
||||||
|
extern intmax_t max_pending_packets;
|
||||||
|
max_pending_packets = 128;
|
||||||
|
PacketPoolInit();
|
||||||
|
initialized = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (size < 1 + FPC0_HEADER_LEN) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
for (pos = 0; pos < size - FPC0_HEADER_LEN; pos++) {
|
||||||
|
if (data[pos] == 0) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// initialize FPC with the buffer
|
||||||
|
if (FPC_init(&pkts, data + pos + 1, size - pos - 1) < 0) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
// dump signatures to a file so as to reuse SigLoadSignatures
|
||||||
|
char sigaware[512];
|
||||||
|
size_t len;
|
||||||
|
SigGenereateAware(data, pos + 1, sigaware, &len);
|
||||||
|
if (TestHelperBufferToFile(surifuzz.sig_file, (uint8_t *)sigaware, len) < 0) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (DetectEngineReload(&surifuzz) < 0) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
// loop over packets
|
||||||
|
r = FPC_next(&pkts, &header, &pkt);
|
||||||
|
p = PacketGetFromAlloc();
|
||||||
|
p->ts.tv_sec = header.ts.tv_sec;
|
||||||
|
p->ts.tv_usec = header.ts.tv_usec;
|
||||||
|
p->datalink = pkts.datalink;
|
||||||
|
while (r > 0) {
|
||||||
|
if (PacketCopyData(p, pkt, header.caplen) == 0) {
|
||||||
|
// DecodePcapFile
|
||||||
|
TmEcode ecode = tmm_modules[TMM_DECODEPCAPFILE].Func(&tv, p, dtv);
|
||||||
|
if (ecode == TM_ECODE_FAILED) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
Packet *extra_p = PacketDequeueNoLock(&tv.decode_pq);
|
||||||
|
while (extra_p != NULL) {
|
||||||
|
PacketFreeOrRelease(extra_p);
|
||||||
|
extra_p = PacketDequeueNoLock(&tv.decode_pq);
|
||||||
|
}
|
||||||
|
tmm_modules[TMM_FLOWWORKER].Func(&tv, p, fwd);
|
||||||
|
extra_p = PacketDequeueNoLock(&tv.decode_pq);
|
||||||
|
while (extra_p != NULL) {
|
||||||
|
PacketFreeOrRelease(extra_p);
|
||||||
|
extra_p = PacketDequeueNoLock(&tv.decode_pq);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
r = FPC_next(&pkts, &header, &pkt);
|
||||||
|
PACKET_RECYCLE(p);
|
||||||
|
p->ts.tv_sec = header.ts.tv_sec;
|
||||||
|
p->ts.tv_usec = header.ts.tv_usec;
|
||||||
|
p->datalink = pkts.datalink;
|
||||||
|
pcap_cnt++;
|
||||||
|
p->pcap_cnt = pcap_cnt;
|
||||||
|
}
|
||||||
|
PacketFree(p);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue