4.10.PRE

fuzz/backend/README.md

@@ -0,0 +1,59 @@
+# Clixon fuzzing
+
+This dir contains code for fuzzing clixon backend. 
+
+It requires the preeny package to change sockets to stdio. 
+
+## Prereqs
+
+Preeny has a "desocketizing" module necessary to map stdio to the internal sockets that the backend uses. Install preeny example:
+```
+  sudo apt install libini-config-dev # debian/ubuntu
+  sudo apt install libseccomp-dev # debian/ubuntu
+  git clone https://github.com/zardus/preeny.git
+  cd preeny
+  make
+  sudo cp x86_64-linux-gnu/desock.so /usr/local/lib/ # install
+```
+
+See [AFL docs](https://afl-1.readthedocs.io/en/latest) for installing afl.
+On ubuntu this may be enough:
+```
+  sudo apt install afl
+```
+
+You may have to change cpu frequency:
+```
+  cd /sys/devices/system/cpu
+  echo performance | tee cpu?/cpufreq/scaling_governor
+```
+
+And possibly change core behaviour:
+```
+  echo core >/proc/sys/kernel/core_pattern
+```
+
+## Build
+
+Make a modification to how Clixon sends internal messages in `include/clixon_custom.h`:
+```
+  #define CLIXON_PROTO_PLAIN
+```
+
+Build clixon statically with the afl-clang compiler:
+```
+  CC=/usr/bin/afl-clang-fast LINKAGE=static ./configure --with-restconf=evhtp
+  make clean
+  make
+  sudo make install
+```
+
+## Run tests
+
+Populate the input/ dir with input usecases, there are two examples already in this dir that can be modified.
+Use the script `runfuzz.sh` to run one test:
+```
+  ./runfuzz.sh
+```
+
+After (or during) the test, investigate results in the output dir.

fuzz/backend/input/1.xml

@@ -0,0 +1 @@
+<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="42" username="olof"><edit-config><target><candidate/></target><default-operation>none</default-operation><test-option>test-then-set</test-option><error-option>stop-on-error</error-option><config><interfaces xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces"><interface><name>eth/0/0</name></interface></interfaces></config></edit-config></rpc>]]>]]>

fuzz/backend/input/2.xml

@@ -0,0 +1 @@
+<hello username="olof" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="42"><capabilities><capability>urn:ietf:params:netconf:base:1.0</capability></capabilities></hello>]]>]]>

fuzz/backend/runfuzz.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Run a fuzzing test using american fuzzy lop
+# Add input strings in input
+set -eux
+
+if [ $# -ne 0 ]; then 
+    echo "usage: $0 \n"
+    exit 255
+fi
+
+if [ ! -x /usr/local/lib/desock.so ] ; then
+    echo "preeny desock.so not found"
+    exit 255
+fi
+
+MEGS=500 # memory limit for child process (50 MB)
+
+# remove input and input dirs
+#test ! -d input || rm -rf input
+test ! -d output || sudo rm -rf output
+
+# create if dirs dont exists
+#test -d input || mkdir input
+test -d output || mkdir output
+
+APPNAME=example
+cfg=conf.xml
+
+cat <<EOF > $cfg
+<clixon-config xmlns="http://clicon.org/config">
+  <CLICON_CONFIGFILE>$cfg</CLICON_CONFIGFILE>
+  <CLICON_FEATURE>*:*</CLICON_FEATURE>
+  <CLICON_YANG_DIR>/usr/local/share/clixon</CLICON_YANG_DIR>
+  <CLICON_YANG_MODULE_MAIN>clixon-example</CLICON_YANG_MODULE_MAIN>
+  <CLICON_SOCK_FAMILY>IPv4</CLICON_SOCK_FAMILY>
+  <CLICON_SOCK_PORT>4535</CLICON_SOCK_PORT>
+  <CLICON_SOCK>127.0.0.1</CLICON_SOCK>
+  <CLICON_CLISPEC_DIR>/usr/local/lib/$APPNAME/clispec</CLICON_CLISPEC_DIR>
+  <CLICON_CLI_DIR>/usr/local/lib/$APPNAME/cli</CLICON_CLI_DIR>
+  <CLICON_CLI_MODE>$APPNAME</CLICON_CLI_MODE>
+  <CLICON_BACKEND_PIDFILE>/usr/local/var/$APPNAME/$APPNAME.pidfile</CLICON_BACKEND_PIDFILE>
+  <CLICON_XMLDB_DIR>/usr/local/var/$APPNAME</CLICON_XMLDB_DIR>
+  <CLICON_STARTUP_MODE>init</CLICON_STARTUP_MODE>
+  <CLICON_MODULE_LIBRARY_RFC7895>false</CLICON_MODULE_LIBRARY_RFC7895>
+</clixon-config>
+EOF
+
+# Run script 
+#  CC=/usr/bin/afl-clang 
+sudo LD_PRELOAD="/usr/local/lib/desock.so" afl-fuzz -i input -o output -d -m $MEGS -- /usr/local/sbin/clixon_backend -Fs init -f $cfg
+
+# Dryrun without afl:
+#echo "sudo LD_PRELOAD=\"/usr/local/lib/desock.so\" /usr/local/sbin/clixon_backend -Fs init -f ./conf.xml < input/1.xml"
+#sudo LD_PRELOAD="/usr/local/lib/desock.so" /usr/local/sbin/clixon_backend -Fs init -f ./conf.xml < input/1.xml