Fuzzing of native http1 parser

This commit is contained in:
Olof hagsand 2022-02-08 21:26:53 +01:00
parent 4aa74fa1d8
commit 51fd973642
8 changed files with 132 additions and 6 deletions

28
test/fuzz/http1/README.md Normal file
View file

@ -0,0 +1,28 @@
# Clixon http1 fuzzing
This dir contains code for fuzzing the clixon http1 parser. This is normally inside the
native restconf app and need some special compiling to run stand-alone.
Install AFL, see [..](..)
Edit `apps/restconf/restconf_main_native.c` by disabling the regular
main function and replacing it with the unit testing `main`:
```
--- a/apps/restconf/restconf_main_native.c
+++ b/apps/restconf/restconf_main_native.c
@@ -1403,7 +1403,7 @@ usage(clicon_handle h,
/* Enable for normal use
* Disable for unit testing, fuzzing, etc
*/
-#if 1
+#if 0
```
Build and install clixon libraries and restconf statically
```
./configure LINKAGE=static INSTALLFLAGS="" CC=/usr/bin/afl-clang-fast
make
sudo make install
./runfuzz.sh
```

View file

@ -0,0 +1,10 @@
PUT /restconf/data/ietf-interfaces:interfaces/interface=eth%2f0%2f0 HTTP/1.1
Host: 127.0.0.1
Accept: */*
Content-Type: application/yang-data+json
Content-Length: 91
{"ietf-interfaces:interface":{"name":"eth/0/0","type":"clixon-example:eth","enabled":true}}

View file

@ -0,0 +1,5 @@
GET /restconf/data HTTP/1.1
Host: localhost
Accept: application/yang-data+xml

View file

@ -0,0 +1,8 @@
POST /restconf/data/ietf-interfaces:interfaces HTTP/1.1
Host: 127.0.0.1
Accept: application/yang-data+xml
Content-Type: application/yang-data+xml
Content-Length: 138
<interface xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces"><name>eth/0/42</name><type>ex:eth</type><enabled>true</enabled></interface>

View file

@ -0,0 +1,4 @@
DELETE /restconf/data/ietf-interfaces:interfaces HTTP/1.1
Host: 127.0.0.1

25
test/fuzz/http1/runfuzz.sh Executable file
View file

@ -0,0 +1,25 @@
#!/usr/bin/env bash
# Run a fuzzing test using american fuzzy lop
# Add input strings in input
set -eux
if [ $# -ne 0 ]; then
echo "usage: $0"
exit 255
fi
MEGS=500 # memory limit for child process (50 MB)
# remove input and input dirs
#test ! -d input || rm -rf input
test ! -d output || sudo rm -rf output
# create if dirs dont exists
#test -d input || mkdir input
test -d output || mkdir output
# Run script
# CC=/usr/bin/afl-clang
sudo afl-fuzz -i input -o output -d -m $MEGS -- /usr/local/sbin/clixon_restconf