Fuzzing with AFL

Clixon can be fuzzed with american fuzzy lop but not without pain.

So far the backend and cli can be fuzzed.

Some issues are as follows:

Static linking. Fuzzing requires static linking. You can statically link clixon using: LINKAGE=static ./configure but that does not work with Clixon plugins (at least yet). Therefore fuzzing has been made with no plugins using the hello example only.
Multiple processes. Only the backend can run stand-alone, cli/netconf/restconf requires a backend. When you fuzz eg clixon_cli, the backend must be running and it will be slow due to IPC. Possibly one could link them together and run as a monolith by making a threaded image.

Restconf also has the extra problem of running TLS sockets.

Prereqs

See AFL docs for installing afl. On ubuntu this may be enough:

  sudo apt install afl

You may have to change cpu frequency:

  cd /sys/devices/system/cpu
  echo performance | tee cpu?/cpufreq/scaling_governor

And possibly change core behaviour:

  echo core >/proc/sys/kernel/core_pattern

backend/restconf

Backend and restconf requires the preeny package to change sockets to stdio.

Preeny has a "desocketizing" module necessary to map stdio to the internal sockets that the backend uses. Install preeny example:

  sudo apt install libini-config-dev # debian/ubuntu
  sudo apt install libseccomp-dev # debian/ubuntu
  git clone https://github.com/zardus/preeny.git
  cd preeny
  make
  sudo cp x86_64-linux-gnu/desock.so /usr/local/lib/ # install

1.6 KiB Raw Blame History

Fuzzing with AFL

Prereqs

backend/restconf

1.6 KiB

Raw Blame History