Fuzzing of native http1 parser
This commit is contained in:
parent
4aa74fa1d8
commit
51fd973642
8 changed files with 132 additions and 6 deletions
28
test/fuzz/http1/README.md
Normal file
28
test/fuzz/http1/README.md
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# Clixon http1 fuzzing
|
||||
|
||||
This dir contains code for fuzzing the clixon http1 parser. This is normally inside the
|
||||
native restconf app and need some special compiling to run stand-alone.
|
||||
|
||||
Install AFL, see [..](..)
|
||||
|
||||
Edit `apps/restconf/restconf_main_native.c` by disabling the regular
|
||||
main function and replacing it with the unit testing `main`:
|
||||
```
|
||||
--- a/apps/restconf/restconf_main_native.c
|
||||
+++ b/apps/restconf/restconf_main_native.c
|
||||
@@ -1403,7 +1403,7 @@ usage(clicon_handle h,
|
||||
/* Enable for normal use
|
||||
* Disable for unit testing, fuzzing, etc
|
||||
*/
|
||||
-#if 1
|
||||
+#if 0
|
||||
```
|
||||
|
||||
Build and install clixon libraries and restconf statically
|
||||
```
|
||||
./configure LINKAGE=static INSTALLFLAGS="" CC=/usr/bin/afl-clang-fast
|
||||
make
|
||||
sudo make install
|
||||
./runfuzz.sh
|
||||
```
|
||||
|
||||
10
test/fuzz/http1/input/1.http
Normal file
10
test/fuzz/http1/input/1.http
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
PUT /restconf/data/ietf-interfaces:interfaces/interface=eth%2f0%2f0 HTTP/1.1
|
||||
Host: 127.0.0.1
|
||||
Accept: */*
|
||||
Content-Type: application/yang-data+json
|
||||
Content-Length: 91
|
||||
|
||||
{"ietf-interfaces:interface":{"name":"eth/0/0","type":"clixon-example:eth","enabled":true}}
|
||||
|
||||
|
||||
|
||||
5
test/fuzz/http1/input/2.http
Normal file
5
test/fuzz/http1/input/2.http
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
GET /restconf/data HTTP/1.1
|
||||
Host: localhost
|
||||
Accept: application/yang-data+xml
|
||||
|
||||
|
||||
8
test/fuzz/http1/input/3.http
Normal file
8
test/fuzz/http1/input/3.http
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
POST /restconf/data/ietf-interfaces:interfaces HTTP/1.1
|
||||
Host: 127.0.0.1
|
||||
Accept: application/yang-data+xml
|
||||
Content-Type: application/yang-data+xml
|
||||
Content-Length: 138
|
||||
|
||||
<interface xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces"><name>eth/0/42</name><type>ex:eth</type><enabled>true</enabled></interface>
|
||||
|
||||
4
test/fuzz/http1/input/4.http
Normal file
4
test/fuzz/http1/input/4.http
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
DELETE /restconf/data/ietf-interfaces:interfaces HTTP/1.1
|
||||
Host: 127.0.0.1
|
||||
|
||||
|
||||
25
test/fuzz/http1/runfuzz.sh
Executable file
25
test/fuzz/http1/runfuzz.sh
Executable file
|
|
@ -0,0 +1,25 @@
|
|||
#!/usr/bin/env bash
|
||||
# Run a fuzzing test using american fuzzy lop
|
||||
# Add input strings in input
|
||||
set -eux
|
||||
|
||||
if [ $# -ne 0 ]; then
|
||||
echo "usage: $0"
|
||||
exit 255
|
||||
fi
|
||||
|
||||
MEGS=500 # memory limit for child process (50 MB)
|
||||
|
||||
# remove input and input dirs
|
||||
#test ! -d input || rm -rf input
|
||||
test ! -d output || sudo rm -rf output
|
||||
|
||||
# create if dirs dont exists
|
||||
#test -d input || mkdir input
|
||||
test -d output || mkdir output
|
||||
|
||||
# Run script
|
||||
# CC=/usr/bin/afl-clang
|
||||
sudo afl-fuzz -i input -o output -d -m $MEGS -- /usr/local/sbin/clixon_restconf
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue