mirror of
https://github.com/espressif/esp-idf.git
synced 2024-10-05 20:47:46 -04:00
Merge branch 'bugfix/lwip_remove_afl' into 'master'
lwip: Remove AFL based fuzzer tests See merge request espressif/esp-idf!22805
This commit is contained in:
David Čermák
commit
826c927c09
@ -63,7 +63,6 @@ variables:
|
||||
BOT_DOCKER_IMAGE_TAG: ":latest"
|
||||
|
||||
ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env-v5.1:1"
|
||||
AFL_FUZZER_TEST_IMAGE: "$CI_DOCKER_REGISTRY/afl-fuzzer-test-v5.1:1-1"
|
||||
CLANG_STATIC_ANALYSIS_IMAGE: "${CI_DOCKER_REGISTRY}/clang-static-analysis-v5.1:1-1"
|
||||
ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env-v5.1:1-1"
|
||||
QEMU_IMAGE: "${CI_DOCKER_REGISTRY}/qemu-v5.1:1-20220802"
|
||||
|
||||
@ -82,44 +82,6 @@ test_reproducible_build:
|
||||
- "**/build*/partition_table/*.bin"
|
||||
expire_in: 1 week
|
||||
|
||||
.host_fuzzer_test_template:
|
||||
extends:
|
||||
- .host_test_template
|
||||
- .rules:labels:fuzzer_test-weekend_test
|
||||
image: $AFL_FUZZER_TEST_IMAGE
|
||||
artifacts:
|
||||
when: always
|
||||
paths:
|
||||
- ${FUZZER_TEST_DIR}/out/crashes
|
||||
- ${FUZZER_TEST_DIR}/fuzz_output.txt
|
||||
expire_in: 1 week
|
||||
script:
|
||||
- export AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 && export AFL_SKIP_CPUFREQ=1
|
||||
- cd ${FUZZER_TEST_DIR}
|
||||
# run AFL fuzzer for one hour
|
||||
- ( ( make ${FUZZER_PARAMS} fuzz | tee fuzz_output.txt | grep -v '\(Fuzzing test case\|Entering queue cycle\)' ) || pkill sleep ) &
|
||||
- ( sleep 3600 || mkdir -p out/crashes/env_failed ) && pkill afl-fuz
|
||||
# check no crashes found
|
||||
- test -z "$(ls out/crashes/)" || exit 1
|
||||
|
||||
test_lwip_dns_fuzzer_on_host:
|
||||
extends: .host_fuzzer_test_template
|
||||
variables:
|
||||
FUZZER_TEST_DIR: components/lwip/test_afl_host
|
||||
FUZZER_PARAMS: MODE=dns
|
||||
|
||||
test_lwip_dhcp_fuzzer_on_host:
|
||||
extends: .host_fuzzer_test_template
|
||||
variables:
|
||||
FUZZER_TEST_DIR: components/lwip/test_afl_host
|
||||
FUZZER_PARAMS: MODE=dhcp_client
|
||||
|
||||
test_lwip_dhcps_fuzzer_on_host:
|
||||
extends: .host_fuzzer_test_template
|
||||
variables:
|
||||
FUZZER_TEST_DIR: components/lwip/test_afl_host
|
||||
FUZZER_PARAMS: MODE=dhcp_server
|
||||
|
||||
test_spiffs_on_host:
|
||||
extends: .host_test_template
|
||||
script:
|
||||
|
||||
@ -97,15 +97,6 @@ check_blobs:
|
||||
# Check if Wi-Fi, PHY, BT blobs contain references to specific symbols
|
||||
- bash $IDF_PATH/tools/ci/check_blobs.sh
|
||||
|
||||
check_fuzzer_compilation:
|
||||
extends: .pre_check_template
|
||||
image: $AFL_FUZZER_TEST_IMAGE
|
||||
script:
|
||||
- cd ${IDF_PATH}/components/lwip/test_afl_host
|
||||
- make MODE=dhcp_server
|
||||
- make MODE=dhcp_client
|
||||
- make MODE=dns
|
||||
|
||||
check_public_headers:
|
||||
extends:
|
||||
- .pre_check_template
|
||||
|
||||
@ -1837,13 +1837,6 @@
|
||||
- <<: *if-protected
|
||||
- <<: *if-label-lan8720
|
||||
|
||||
.rules:labels:fuzzer_test-weekend_test:
|
||||
rules:
|
||||
- <<: *if-revert-branch
|
||||
when: never
|
||||
- <<: *if-label-fuzzer_test
|
||||
- <<: *if-label-weekend_test
|
||||
|
||||
.rules:labels:iperf_stress_test:
|
||||
rules:
|
||||
- <<: *if-revert-branch
|
||||
|
||||
@ -1,5 +0,0 @@
|
||||
# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
|
||||
|
||||
components/lwip/test_afl_host:
|
||||
enable:
|
||||
- if: IDF_TARGET == "linux"
|
||||
@ -1,8 +0,0 @@
|
||||
# The following four lines of boilerplate have to be in your project's CMakeLists
|
||||
# in this exact order for cmake to work correctly
|
||||
cmake_minimum_required(VERSION 3.16)
|
||||
|
||||
set(COMPONENTS lwip)
|
||||
include($ENV{IDF_PATH}/tools/cmake/project.cmake)
|
||||
|
||||
project(fuzz_test_lwip)
|
||||
@ -1,115 +0,0 @@
|
||||
LWIP_COMPONENT_DIR=../
|
||||
FREERTOS_COMPONENT_DIR=$(LWIP_COMPONENT_DIR)/../freertos
|
||||
COMPONENT_DIR=$(LWIP_COMPONENT_DIR)/../
|
||||
MOCKS_DIR=$(LWIP_COMPONENT_DIR)/../../tools/mocks
|
||||
|
||||
CFLAGS=-D IDF_VER=\"v3.1\" \
|
||||
-DESP_PLATFORM \
|
||||
-DLWIP_NO_CTYPE_H=1 \
|
||||
-DWITH_POSIX \
|
||||
-fdata-sections \
|
||||
-ffunction-sections \
|
||||
-ggdb \
|
||||
-MMD \
|
||||
-MP \
|
||||
-nostdlib \
|
||||
-Og \
|
||||
-std=gnu99 \
|
||||
-Wall \
|
||||
-Werror=all \
|
||||
-Wextra \
|
||||
-Wno-address \
|
||||
-Wno-constant-conversion \
|
||||
-Wno-error=deprecated-declarations \
|
||||
-Wno-error=unused-function \
|
||||
-Wno-error=unused-variable \
|
||||
-Wno-incompatible-pointer-types \
|
||||
-Wno-incompatible-pointer-types-discards-qualifiers \
|
||||
-Wno-int-to-pointer-cast \
|
||||
-Wno-macro-redefined \
|
||||
-Wno-sign-compare \
|
||||
-Wno-typedef-redefinition \
|
||||
-Wno-unused-parameter \
|
||||
-Wno-unused-variable
|
||||
|
||||
INC_DIRS=-I . \
|
||||
-I ./build/config \
|
||||
-I $(LWIP_COMPONENT_DIR)/include/apps \
|
||||
-I $(LWIP_COMPONENT_DIR)/include/apps/ping \
|
||||
-I $(LWIP_COMPONENT_DIR)/include/apps/sntp \
|
||||
-I $(LWIP_COMPONENT_DIR)/lwip/src/include \
|
||||
-I $(LWIP_COMPONENT_DIR)/lwip/src/include/netif \
|
||||
-I $(LWIP_COMPONENT_DIR)/lwip/src/include/posix \
|
||||
-I $(LWIP_COMPONENT_DIR)/port/include \
|
||||
-I $(LWIP_COMPONENT_DIR)/port/linux/include \
|
||||
-I $(LWIP_COMPONENT_DIR)/port/freertos/include \
|
||||
-I $(FREERTOS_COMPONENT_DIR)/FreeRTOS-Kernel/include \
|
||||
-I $(FREERTOS_COMPONENT_DIR)/esp_additions/include/freertos \
|
||||
-I $(FREERTOS_COMPONENT_DIR)/FreeRTOS-Kernel/portable/linux/include \
|
||||
-I $(COMPONENT_DIR)/esp_hw_support/include \
|
||||
-I $(COMPONENT_DIR)/linux/include
|
||||
|
||||
TEST_NAME=test
|
||||
FUZZ=afl-fuzz
|
||||
GEN_CFG=generate_config
|
||||
LD=$(CC)
|
||||
ifeq ($(MODE),dhcp_client)
|
||||
DEPENDENCY_INJECTION=-include dhcp_di.h
|
||||
OBJECTS=dhcp.o def.o esp32_mock.o test_dhcp_client.o
|
||||
SAMPLE_PACKETS=in_dhcp_client
|
||||
else ifeq ($(MODE),dhcp_server)
|
||||
DEPENDENCY_INJECTION=-include dhcpserver_di.h
|
||||
OBJECTS=dhcpserver.o def.o esp32_mock.o test_dhcp_server.o
|
||||
SAMPLE_PACKETS=in_dhcp_server
|
||||
else ifeq ($(MODE),dns)
|
||||
CFLAGS+=-DNOT_MOCK_DNS
|
||||
DEPENDENCY_INJECTION=-include dns_di.h
|
||||
OBJECTS=dns.o def.o esp32_mock.o test_dns.o
|
||||
SAMPLE_PACKETS=in_dns
|
||||
else
|
||||
$(error Please specify MODE: dhcp_server, dhcp_client, dns)
|
||||
endif
|
||||
|
||||
ifeq ($(INSTR),off)
|
||||
CC=gcc
|
||||
CFLAGS+=-DINSTR_IS_OFF
|
||||
TEST_NAME=test_sim
|
||||
else
|
||||
CC=afl-clang-fast
|
||||
endif
|
||||
|
||||
CFLAGS+=$(INC_DIRS)
|
||||
|
||||
all: $(TEST_NAME)
|
||||
|
||||
def.o: ../lwip/src/core/def.c $(GEN_CFG)
|
||||
@echo "[CC] $<"
|
||||
@$(CC) $(CFLAGS) -D BUILDING_DEF $(DEPENDENCY_INJECTION) -c $< -o $@
|
||||
|
||||
dns.o: ../lwip/src/core/dns.c $(GEN_CFG)
|
||||
@echo "[CC] $<"
|
||||
@$(CC) $(CFLAGS) $(DEPENDENCY_INJECTION) -c $< -o $@
|
||||
|
||||
dhcp.o: ../lwip/src/core/ipv4/dhcp.c $(GEN_CFG)
|
||||
@echo "[CC] $<"
|
||||
@$(CC) $(CFLAGS) $(DEPENDENCY_INJECTION) -c $< -o $@
|
||||
|
||||
dhcpserver.o: ../apps/dhcpserver/dhcpserver.c $(GEN_CFG)
|
||||
@echo "[CC] $<"
|
||||
@$(CC) $(CFLAGS) $(DEPENDENCY_INJECTION) -c $< -o $@
|
||||
|
||||
%.o: %.c $(GEN_CFG)
|
||||
@echo "[CC] $<"
|
||||
@$(CC) $(CFLAGS) -c $< -o $@
|
||||
|
||||
.PHONY: $(GEN_CFG)
|
||||
$(GEN_CFG):
|
||||
# Run reconfiguration without potential AFL in PATHs
|
||||
PATH=$(subst $(AFL_PATH):,/:,$(PATH)) idf.py reconfigure
|
||||
|
||||
$(TEST_NAME): $(OBJECTS)
|
||||
@echo "[LD] $@"
|
||||
@$(LD) $(OBJECTS) -o $@ $(LDLIBS)
|
||||
|
||||
fuzz: $(TEST_NAME)
|
||||
@$(FUZZ) -t 5000+ -i "$(SAMPLE_PACKETS)" -o "out" -- ./$(TEST_NAME)
|
||||
@ -1,80 +0,0 @@
|
||||
| Supported Targets | Linux |
|
||||
| ----------------- | ----- |
|
||||
|
||||
## Introduction
|
||||
This test uses [american fuzzy lop](http://lcamtuf.coredump.cx/afl/) to mangle real dns, dhcp client, dhcp server packets and look for exceptions caused by the parser.
|
||||
|
||||
A few actual packets are collected and exported as bins in the ```in_dns, in_dhcp_client, in_dhcp_server``` folders, which is then passed as input to AFL when testing. The setup procedure for the test includes all possible services and scenarios that could be used with the given input packets. The output of the parser before fuzzing can be found in [input_packets.txt](input_packets.txt)
|
||||
|
||||
## Building and running the tests using AFL
|
||||
To build and run the tests using AFL(afl-clang-fast) instrumentation
|
||||
|
||||
```bash
|
||||
cd $IDF_PATH/components/lwip/test_afl_host
|
||||
make fuzz MODE=dns/dhcp_client/dhcp_server
|
||||
```
|
||||
|
||||
(Please note you have to install AFL instrumentation first, check `Installing AFL` section)
|
||||
|
||||
## Building the tests using GCC INSTR(off)
|
||||
To build the tests without AFL instrumentations and instead of that use GCC compiler(In this case it will only check for compilation issues and will not run AFL tests).
|
||||
|
||||
```bash
|
||||
cd $IDF_PATH/components/lwip/test_afl_host
|
||||
make INSTR=off MODE=dns/dhcp_client/dhcp_server
|
||||
```
|
||||
|
||||
## Installing AFL
|
||||
To run the test yourself, you need to download the [latest afl archive](http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz) and extract it to a folder on your computer.
|
||||
|
||||
The rest of the document will refer to that folder as ```PATH_TO_AFL```.
|
||||
|
||||
### Preparation
|
||||
- On Mac, you will need to install the latest Xcode and llvm support from [Homebrew](https://brew.sh)
|
||||
|
||||
```bash
|
||||
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
|
||||
brew install --with-clang --with-lld --HEAD llvm
|
||||
export PATH="/usr/local/opt/llvm/bin:$PATH"
|
||||
```
|
||||
|
||||
- On Ubuntu you need the following packages:
|
||||
|
||||
```bash
|
||||
sudo apt-get install make clang-4.0(or <=4.0) llvm-4.0(or <=4.0) libbsd-dev
|
||||
```
|
||||
|
||||
Please note that if specified package version can't be installed(becouse the system is newer than 2017), you can install it from source.
|
||||
|
||||
### Compile AFL
|
||||
Compiling AFL is as easy as running make:
|
||||
|
||||
```bash
|
||||
cd [PATH_TO_AFL]
|
||||
make
|
||||
cd llvm_mode/
|
||||
make
|
||||
```
|
||||
|
||||
After successful compilation, you can export the following variables to your shell (you can also add them to your profile if you want to use AFL in other projects).
|
||||
|
||||
```bash
|
||||
export AFL_PATH=[PATH_TO_AFL]
|
||||
export PATH="$AFL_PATH:$PATH"
|
||||
```
|
||||
|
||||
Please note LLVM must be <=4.0.0, otherwise afl does not compile, as there are some limitations with building AFL on MacOS/Linux with the latest LLVM. Also, Windows build on cygwin is not fully supported.
|
||||
|
||||
## Additional info
|
||||
Apple has a crash reporting service that could interfere with AFL's normal operation. To turn that off, run the following command:
|
||||
|
||||
```bash
|
||||
launchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist
|
||||
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist
|
||||
```
|
||||
|
||||
Ubuntu has a similar service. To turn that off, run as root:
|
||||
|
||||
```bash
|
||||
echo core >/proc/sys/kernel/core_pattern
|
||||
```
|
||||
@ -1,38 +0,0 @@
|
||||
#include "no_warn_host.h"
|
||||
#include <stdlib.h> // For abort()
|
||||
#include <stdio.h> // For printf()
|
||||
#include "lwip/opt.h"
|
||||
#include "lwip/stats.h"
|
||||
#include "lwip/mem.h"
|
||||
#include "lwip/udp.h"
|
||||
#include "lwip/ip_addr.h"
|
||||
#include "lwip/netif.h"
|
||||
#include "lwip/def.h"
|
||||
#include "lwip/dhcp.h"
|
||||
#include "lwip/autoip.h"
|
||||
#include "lwip/dns.h"
|
||||
#include "netif/etharp.h"
|
||||
|
||||
#ifndef BUILDING_DEF
|
||||
|
||||
void __assert_func(const char *file, int line, const char *func, const char *expr)
|
||||
{
|
||||
printf("Assert failed in %s, %s:%d (%s)", func, file, line, expr);
|
||||
abort();
|
||||
}
|
||||
|
||||
static void dhcp_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
|
||||
|
||||
void (*dhcp_test_static_dhcp_recv)(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) = NULL;
|
||||
|
||||
void dhcp_test_init_di(void)
|
||||
{
|
||||
dhcp_test_static_dhcp_recv = dhcp_recv;
|
||||
}
|
||||
|
||||
void dhcp_test_dhcp_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port)
|
||||
{
|
||||
dhcp_test_static_dhcp_recv(arg, pcb, p, addr, port);
|
||||
}
|
||||
|
||||
#endif /* BUILDING_DEF */
|
||||
@ -1,25 +0,0 @@
|
||||
/*
|
||||
* dhcpserver dependecy injection -- preincluded to inject interface test functions into static variables
|
||||
*
|
||||
*/
|
||||
#include "no_warn_host.h"
|
||||
#include "lwip/pbuf.h"
|
||||
#include "lwip/udp.h"
|
||||
|
||||
#ifndef BUILDING_DEF
|
||||
|
||||
static void handle_dhcp(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
|
||||
|
||||
void (*dhcp_test_static_handle_hdcp)(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) = NULL;
|
||||
|
||||
void dhcp_test_init_di(void)
|
||||
{
|
||||
dhcp_test_static_handle_hdcp = handle_dhcp;
|
||||
}
|
||||
|
||||
void dhcp_test_handle_dhcp(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port)
|
||||
{
|
||||
dhcp_test_static_handle_hdcp(arg, pcb, p, addr, port);
|
||||
}
|
||||
|
||||
#endif
|
||||
@ -1,62 +0,0 @@
|
||||
/*
|
||||
* dns.c dependecy injection -- preincluded to inject interface test functions into static variables
|
||||
*
|
||||
*/
|
||||
#include "no_warn_host.h"
|
||||
|
||||
#include "lwip/opt.h"
|
||||
#include "lwip/udp.h"
|
||||
#include "lwip/mem.h"
|
||||
#include "lwip/memp.h"
|
||||
#include "lwip/dns.h"
|
||||
#include "lwip/ip_addr.h"
|
||||
|
||||
#define ipaddr_aton(cp, addr) ip4addr_aton(cp, addr)
|
||||
|
||||
extern uint32_t g_random_numbers[8];
|
||||
extern uint32_t g_random_numbers_cnt;
|
||||
|
||||
#ifndef BUILDING_DEF
|
||||
|
||||
void __assert_func(const char *file, int line, const char *func, const char *expr)
|
||||
{
|
||||
printf("Assert failed in %s, %s:%d (%s)", func, file, line, expr);
|
||||
abort();
|
||||
}
|
||||
|
||||
int ip4addr_aton(const char *cp, ip4_addr_t *addr)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static err_t dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype);
|
||||
static void dns_recv(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
|
||||
|
||||
void (*dns_test_static_dns_recv)(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) = NULL;
|
||||
err_t (*dns_test_static_dns_enqueue)(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype) = NULL;
|
||||
|
||||
void dns_test_init_di(void)
|
||||
{
|
||||
dns_test_static_dns_recv = dns_recv;
|
||||
dns_test_static_dns_enqueue = dns_enqueue;
|
||||
}
|
||||
|
||||
|
||||
err_t dns_test_dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype)
|
||||
{
|
||||
return dns_test_static_dns_enqueue(name, hostnamelen, found, callback_arg, dns_addrtype);
|
||||
}
|
||||
|
||||
void dns_test_dns_recv(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port)
|
||||
{
|
||||
dns_test_static_dns_recv(s, pcb, p, addr, port);
|
||||
}
|
||||
|
||||
void dns_test_inject_port_and_txid(int port, int txid)
|
||||
{
|
||||
// inject random numbers
|
||||
g_random_numbers[0] = port; //for port
|
||||
g_random_numbers[1] = txid; //for txid
|
||||
g_random_numbers_cnt = 0; // let's start with the port
|
||||
}
|
||||
#endif
|
||||
@ -1,310 +0,0 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#ifndef NOT_MOCK_DNS
|
||||
#include "lwip/dns.h"
|
||||
#endif
|
||||
#include "lwip/etharp.h"
|
||||
#include "lwip/mem.h"
|
||||
#include "lwip/netif.h"
|
||||
#include "lwip/opt.h"
|
||||
#include "lwip/pbuf.h"
|
||||
#include "lwip/timeouts.h"
|
||||
#include "lwip/udp.h"
|
||||
#include "lwip/timeouts.h"
|
||||
#include "no_warn_host.h"
|
||||
|
||||
#define ESP_OK 0
|
||||
|
||||
/* ---------------------------------------------------- Variables ------------------------------------------------------
|
||||
*
|
||||
* ------------------------------------------------------------------------------------------------------------------ */
|
||||
|
||||
// -------------------- LWIP Globals -----------------------
|
||||
|
||||
// ip_addr.h
|
||||
const ip_addr_t ip_addr_any;
|
||||
const ip_addr_t ip_addr_broadcast;
|
||||
const ip_addr_t ip_addr_any_type;
|
||||
// ip.h
|
||||
struct ip_globals ip_data;
|
||||
// netif.h
|
||||
struct netif *netif_list;
|
||||
|
||||
// ---------------- AFL Host Test Globals ------------------
|
||||
|
||||
// dns_di.h
|
||||
uint32_t g_random_numbers[8] = {0};
|
||||
uint32_t g_random_numbers_cnt = 0;
|
||||
|
||||
// ----------------------- Locals --------------------------
|
||||
|
||||
struct udp_pcb mock_pcb;
|
||||
|
||||
/* ---------------------------------------------------- LWIP Mock ------------------------------------------------------
|
||||
*
|
||||
* ------------------------------------------------------------------------------------------------------------------ */
|
||||
|
||||
// --------------------- lwip/dns.h ------------------------
|
||||
|
||||
#ifndef NOT_MOCK_DNS
|
||||
void dns_setserver(u8_t numdns, const ip_addr_t *dnsserver)
|
||||
{
|
||||
}
|
||||
#endif
|
||||
|
||||
// -------------------- lwip/etharp.h ----------------------
|
||||
|
||||
err_t etharp_query(struct netif *netif, const ip4_addr_t *ipaddr, struct pbuf *q)
|
||||
{
|
||||
return ESP_OK;
|
||||
}
|
||||
|
||||
// --------------------- lwip/mem.h ------------------------
|
||||
|
||||
void * mem_malloc(mem_size_t size)
|
||||
{
|
||||
return malloc(size);
|
||||
}
|
||||
|
||||
void * mem_calloc(size_t nr, mem_size_t size)
|
||||
{
|
||||
return calloc(nr, size);
|
||||
}
|
||||
|
||||
void mem_free(void *rmem)
|
||||
{
|
||||
free(rmem);
|
||||
}
|
||||
|
||||
// -------------------- lwip/netif.h -----------------------
|
||||
|
||||
void netif_set_addr(struct netif *netif, const ip4_addr_t *ipaddr, const ip4_addr_t *netmask,
|
||||
const ip4_addr_t *gw)
|
||||
{
|
||||
}
|
||||
|
||||
// --------------------- lwip/pbuf.h -----------------------
|
||||
|
||||
struct pbuf * pbuf_alloc(pbuf_layer layer, u16_t length, pbuf_type type)
|
||||
{
|
||||
struct pbuf * p;
|
||||
p = (struct pbuf *)malloc(MEMP_PBUF_POOL);
|
||||
p->tot_len = length;
|
||||
p->next = NULL;
|
||||
p->type_internal = PBUF_POOL;
|
||||
p->len = length;
|
||||
p->payload = malloc(length);
|
||||
return p;
|
||||
}
|
||||
|
||||
void pbuf_realloc(struct pbuf *p, u16_t size)
|
||||
{
|
||||
if (p != NULL)
|
||||
{
|
||||
uint8_t *buf = malloc(size);
|
||||
free(p->payload);
|
||||
p->payload = buf;
|
||||
p->len = size;
|
||||
p->tot_len = size;
|
||||
}
|
||||
}
|
||||
|
||||
u8_t pbuf_free(struct pbuf *p)
|
||||
{
|
||||
if (p) {
|
||||
if (p->payload) {
|
||||
free(p->payload);
|
||||
p->payload = NULL;
|
||||
}
|
||||
free (p);
|
||||
p = NULL;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
u16_t pbuf_copy_partial(const struct pbuf *buf, void *dataptr, u16_t len, u16_t offset)
|
||||
{
|
||||
struct pbuf *p;
|
||||
u16_t left;
|
||||
u16_t buf_copy_len;
|
||||
u16_t copied_total = 0;
|
||||
|
||||
LWIP_ERROR("pbuf_copy_partial: invalid buf", (buf != NULL), return 0;);
|
||||
LWIP_ERROR("pbuf_copy_partial: invalid dataptr", (dataptr != NULL), return 0;);
|
||||
|
||||
left = 0;
|
||||
|
||||
if ((buf == NULL) || (dataptr == NULL)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Note some systems use byte copy if dataptr or one of the pbuf payload pointers are unaligned. */
|
||||
for (p = buf; len != 0 && p != NULL; p = p->next) {
|
||||
if ((offset != 0) && (offset >= p->len)) {
|
||||
/* don't copy from this buffer -> on to the next */
|
||||
offset -= p->len;
|
||||
} else {
|
||||
/* copy from this buffer. maybe only partially. */
|
||||
buf_copy_len = p->len - offset;
|
||||
if (buf_copy_len > len)
|
||||
buf_copy_len = len;
|
||||
/* copy the necessary parts of the buffer */
|
||||
MEMCPY(&((char*)dataptr)[left], &((char*)p->payload)[offset], buf_copy_len);
|
||||
copied_total += buf_copy_len;
|
||||
left += buf_copy_len;
|
||||
len -= buf_copy_len;
|
||||
offset = 0;
|
||||
}
|
||||
}
|
||||
return copied_total;
|
||||
}
|
||||
|
||||
err_t pbuf_take(struct pbuf *buf, const void *dataptr, u16_t len)
|
||||
{
|
||||
return ERR_OK;
|
||||
}
|
||||
|
||||
err_t pbuf_take_at(struct pbuf *buf, const void *dataptr, u16_t len, u16_t offset)
|
||||
{
|
||||
return ERR_OK;
|
||||
}
|
||||
|
||||
struct pbuf* pbuf_skip(struct pbuf* in, u16_t in_offset, u16_t* out_offset)
|
||||
{
|
||||
u16_t offset_left = in_offset;
|
||||
struct pbuf* q = in;
|
||||
|
||||
/* get the correct pbuf */
|
||||
while ((q != NULL) && (q->len <= offset_left)) {
|
||||
offset_left -= q->len;
|
||||
q = q->next;
|
||||
}
|
||||
if (out_offset != NULL) {
|
||||
*out_offset = offset_left;
|
||||
}
|
||||
return q;
|
||||
}
|
||||
|
||||
u8_t pbuf_get_at(const struct pbuf* p, u16_t offset)
|
||||
{
|
||||
u16_t q_idx;
|
||||
struct pbuf* q = pbuf_skip(p, offset, &q_idx);
|
||||
|
||||
/* return requested data if pbuf is OK */
|
||||
if ((q != NULL) && (q->len > q_idx)) {
|
||||
return ((u8_t*)q->payload)[q_idx];
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int pbuf_try_get_at(const struct pbuf* p, u16_t offset)
|
||||
{
|
||||
u16_t q_idx;
|
||||
struct pbuf* q = pbuf_skip(p, offset, &q_idx);
|
||||
|
||||
/* return requested data if pbuf is OK */
|
||||
if ((q != NULL) && (q->len > q_idx)) {
|
||||
return ((u8_t*)q->payload)[q_idx];
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
void pbuf_put_at(struct pbuf* p, u16_t offset, u8_t data)
|
||||
{
|
||||
u16_t q_idx;
|
||||
struct pbuf* q = pbuf_skip(p, offset, &q_idx);
|
||||
|
||||
/* write requested data if pbuf is OK */
|
||||
if ((q != NULL) && (q->len > q_idx)) {
|
||||
((u8_t*)q->payload)[q_idx] = data;
|
||||
}
|
||||
}
|
||||
|
||||
// ------------------- lwip/timeouts.h ---------------------
|
||||
|
||||
void sys_timeout(u32_t msecs, sys_timeout_handler handler, void *arg)
|
||||
{
|
||||
}
|
||||
|
||||
void sys_untimeout(sys_timeout_handler handler, void *arg)
|
||||
{
|
||||
}
|
||||
|
||||
// --------------------- lwip/udp.h ------------------------
|
||||
|
||||
struct udp_pcb *udp_new(void)
|
||||
{
|
||||
return malloc(sizeof(struct udp_pcb));
|
||||
}
|
||||
|
||||
struct udp_pcb * udp_new_ip_type(u8_t type)
|
||||
{
|
||||
return &mock_pcb;
|
||||
}
|
||||
|
||||
void udp_remove(struct udp_pcb *pcb)
|
||||
{
|
||||
if (pcb == NULL)
|
||||
{
|
||||
free(pcb);
|
||||
}
|
||||
}
|
||||
|
||||
err_t udp_bind(struct udp_pcb *pcb, const ip_addr_t *ipaddr, u16_t port)
|
||||
{
|
||||
return ESP_OK;
|
||||
}
|
||||
|
||||
err_t udp_connect(struct udp_pcb *pcb, const ip_addr_t *ipaddr, u16_t port)
|
||||
{
|
||||
return ESP_OK;
|
||||
}
|
||||
|
||||
err_t udp_sendto(struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *dst_ip, u16_t dst_port)
|
||||
{
|
||||
return ESP_OK;
|
||||
}
|
||||
|
||||
void udp_disconnect(struct udp_pcb *pcb)
|
||||
{
|
||||
}
|
||||
|
||||
void udp_recv(struct udp_pcb *pcb, udp_recv_fn recv, void *recv_arg)
|
||||
{
|
||||
}
|
||||
|
||||
err_t udp_sendto_if(struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *dst_ip, u16_t dst_port, struct netif *netif)
|
||||
{
|
||||
return ESP_OK;
|
||||
}
|
||||
|
||||
err_t udp_sendto_if_src(struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *dst_ip, u16_t dst_port, struct netif *netif, const ip_addr_t *src_ip)
|
||||
{
|
||||
return ESP_OK;
|
||||
}
|
||||
|
||||
/* ------------------------------------------------- ESP32 Port Mock ---------------------------------------------------
|
||||
*
|
||||
* ------------------------------------------------------------------------------------------------------------------ */
|
||||
|
||||
// --------------------- lwipopts.h ------------------------
|
||||
|
||||
uint32_t esp_random(void)
|
||||
{
|
||||
// Preparation for injecting favorable random numbers
|
||||
return g_random_numbers[g_random_numbers_cnt++ % 8];
|
||||
}
|
||||
|
||||
void dhcp_parse_extra_opts(struct dhcp *dhcp, uint8_t state, uint8_t option, uint8_t len, struct pbuf* p, uint16_t offset)
|
||||
{
|
||||
}
|
||||
|
||||
void dhcp_append_extra_opts(struct netif *netif, uint8_t state, struct dhcp_msg *msg_out, uint16_t *options_out_len)
|
||||
{
|
||||
}
|
||||
@ -1,2 +0,0 @@
|
||||
#pragma once
|
||||
#define IRAM_ATTR
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -1,6 +0,0 @@
|
||||
// Note: these undefs and defines are used to suppress warnings and errors when compiling esp32 idf on host gcc/clang
|
||||
#undef __nonnull
|
||||
#define __warning__ deprecated
|
||||
#define IRAM_ATTR
|
||||
#define __ESP_ATTR_H__
|
||||
#include <features.h>
|
||||
@ -1,6 +0,0 @@
|
||||
CONFIG_LWIP_TCPIP_CORE_LOCKING=n
|
||||
CONFIG_LWIP_CHECK_THREAD_SAFETY=n
|
||||
CONFIG_LWIP_DNS_SUPPORT_MDNS_QUERIES=n
|
||||
CONFIG_FREERTOS_SMP=n
|
||||
CONFIG_IDF_TARGET="linux"
|
||||
CONFIG_UNITY_ENABLE_IDF_TEST_RUNNER=n
|
||||
@ -1,84 +0,0 @@
|
||||
#include "no_warn_host.h"
|
||||
#include "lwip/opt.h"
|
||||
#include "lwip/stats.h"
|
||||
#include "lwip/mem.h"
|
||||
#include "lwip/udp.h"
|
||||
#include "lwip/ip_addr.h"
|
||||
#include "lwip/netif.h"
|
||||
#include "lwip/def.h"
|
||||
#include "lwip/dhcp.h"
|
||||
#include "lwip/autoip.h"
|
||||
#include "lwip/dns.h"
|
||||
#include "netif/etharp.h"
|
||||
#include <string.h>
|
||||
|
||||
const ip_addr_t ip_addr_any;
|
||||
const ip_addr_t ip_addr_broadcast;
|
||||
struct ip_globals ip_data;
|
||||
struct netif *netif_list;
|
||||
struct netif mynetif;
|
||||
ip4_addr_t server_ip;
|
||||
|
||||
//
|
||||
// Dependency injected test functions
|
||||
void dhcp_test_dhcp_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
|
||||
void dhcp_test_init_di(void);
|
||||
|
||||
//
|
||||
// Test starts here
|
||||
//
|
||||
int main(int argc, char** argv)
|
||||
{
|
||||
uint8_t *buf;
|
||||
struct pbuf *p;
|
||||
FILE *file;
|
||||
size_t len = 1460;
|
||||
|
||||
dhcp_test_init_di();
|
||||
|
||||
mynetif.flags = NETIF_FLAG_UP | NETIF_FLAG_ETHARP;
|
||||
mynetif.mtu = 576;
|
||||
|
||||
|
||||
IP4_ADDR(&server_ip, 192,168,4,1);
|
||||
dhcp_start(&mynetif);
|
||||
|
||||
ip_data.current_input_netif = &mynetif;
|
||||
ip_data.current_netif = &mynetif;
|
||||
|
||||
#ifdef INSTR_IS_OFF
|
||||
p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
|
||||
buf = p->payload;
|
||||
memset(buf, 0, 1460);
|
||||
if (argc != 2)
|
||||
{
|
||||
printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n");
|
||||
return 1;
|
||||
}
|
||||
//
|
||||
// Note: parameter1 is a file (mangled packet) which caused the crash
|
||||
file = fopen(argv[1], "r");
|
||||
if (file) {
|
||||
len = fread(buf, 1, 1460, file);
|
||||
}
|
||||
fclose(file);
|
||||
int i;
|
||||
for (i=0; i<1; i++) {
|
||||
#else
|
||||
while (__AFL_LOOP(1000)) {
|
||||
p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
|
||||
buf = p->payload;
|
||||
memset(buf, 0, 1460);
|
||||
size_t len = read(0, buf, 1460);
|
||||
#endif
|
||||
p->len = len;
|
||||
p->tot_len = len;
|
||||
p->next = NULL;
|
||||
|
||||
dhcp_test_dhcp_recv(NULL, NULL, p, &ip_addr_any, 0);
|
||||
}
|
||||
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
@ -1,71 +0,0 @@
|
||||
#include "no_warn_host.h"
|
||||
#include "lwip/pbuf.h"
|
||||
#include "lwip/udp.h"
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include "dhcpserver/dhcpserver.h"
|
||||
|
||||
const ip_addr_t ip_addr_any;
|
||||
ip4_addr_t server_ip;
|
||||
struct netif mynetif;
|
||||
|
||||
// dhcps callback
|
||||
void dhcp_test_dhcps_cb (void* cb_arg, u8_t client_ip[4], u8_t client_mac[6]) {}
|
||||
|
||||
// Dependency injected static function to pass the packet into parser
|
||||
void dhcp_test_handle_dhcp(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
|
||||
void dhcp_test_init_di(void);
|
||||
|
||||
//
|
||||
// Test starts here
|
||||
//
|
||||
int main(int argc, char** argv)
|
||||
{
|
||||
uint8_t *buf;
|
||||
struct pbuf *p;
|
||||
FILE *file;
|
||||
size_t len = 1460;
|
||||
|
||||
dhcp_test_init_di();
|
||||
|
||||
IP4_ADDR(&server_ip, 192,168,4,1);
|
||||
dhcps_t *dhcps = dhcps_new();
|
||||
dhcps_set_new_lease_cb(dhcps, dhcp_test_dhcps_cb, NULL);
|
||||
dhcps_start(dhcps, &mynetif, server_ip);
|
||||
|
||||
#ifdef INSTR_IS_OFF
|
||||
p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
|
||||
buf = p->payload;
|
||||
memset(buf, 0, 1460);
|
||||
if (argc != 2)
|
||||
{
|
||||
printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n");
|
||||
return 1;
|
||||
}
|
||||
//
|
||||
// Note: parameter1 is a file (mangled packet) which caused the crash
|
||||
file = fopen(argv[1], "r");
|
||||
if (file) {
|
||||
len = fread(buf, 1, 1460, file);
|
||||
}
|
||||
fclose(file);
|
||||
|
||||
int i;
|
||||
for (i=0; i<1; i++) {
|
||||
#else
|
||||
while (__AFL_LOOP(1000)) {
|
||||
p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
|
||||
buf = p->payload;
|
||||
memset(buf, 0, 1460);
|
||||
size_t len = read(0, buf, 1460);
|
||||
#endif
|
||||
p->len = len;
|
||||
p->tot_len = len;
|
||||
p->next = NULL;
|
||||
|
||||
dhcp_test_handle_dhcp(dhcps, NULL, p, &ip_addr_any, 0);
|
||||
}
|
||||
dhcps_stop(dhcps, &mynetif);
|
||||
dhcps_delete(dhcps);
|
||||
return 0;
|
||||
}
|
||||
@ -1,81 +0,0 @@
|
||||
#include "no_warn_host.h"
|
||||
|
||||
#include "lwip/opt.h"
|
||||
#include "lwip/udp.h"
|
||||
#include "lwip/mem.h"
|
||||
#include "lwip/memp.h"
|
||||
#include "lwip/dns.h"
|
||||
#include "lwip/ip_addr.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
const ip_addr_t ip_addr_any;
|
||||
const ip_addr_t ip_addr_broadcast;
|
||||
struct ip_globals ip_data;
|
||||
struct netif *netif_list;
|
||||
struct netif mynetif;
|
||||
ip4_addr_t server_ip;
|
||||
|
||||
//
|
||||
// Dependency injected test functions
|
||||
void dns_test_dns_recv(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
|
||||
void dns_test_inject_port_and_txid(int port, int txid);
|
||||
|
||||
void dns_test_init_di(void);
|
||||
err_t dns_test_dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype);
|
||||
|
||||
//
|
||||
// Test starts here
|
||||
//
|
||||
int main(int argc, char** argv)
|
||||
{
|
||||
uint8_t *buf;
|
||||
struct pbuf *p;
|
||||
FILE *file;
|
||||
size_t len = 1460;
|
||||
|
||||
dns_test_init_di();
|
||||
|
||||
#ifdef INSTR_IS_OFF
|
||||
p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
|
||||
buf = p->payload;
|
||||
memset(buf, 0, 1460);
|
||||
if (argc != 2)
|
||||
{
|
||||
printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n");
|
||||
return 1;
|
||||
}
|
||||
//
|
||||
// Note: parameter1 is a file (mangled packet) which caused the crash
|
||||
file = fopen(argv[1], "r");
|
||||
if (file) {
|
||||
len = fread(buf, 1, 1460, file);
|
||||
}
|
||||
fclose(file);
|
||||
int i;
|
||||
for (i=0; i<1; i++) {
|
||||
#else
|
||||
while (__AFL_LOOP(1000)) {
|
||||
p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
|
||||
buf = p->payload;
|
||||
memset(buf, 0, 1460);
|
||||
size_t len = read(0, buf, 1460);
|
||||
#endif
|
||||
p->len = len;
|
||||
p->tot_len = len;
|
||||
p->next = NULL;
|
||||
|
||||
// Pretend that the response is from our pending querries
|
||||
IP4_ADDR(&server_ip, 8, 8, 8, 8);
|
||||
dns_setserver(0, &server_ip);
|
||||
dns_test_inject_port_and_txid(1024, (buf[0]<<8) + buf[1]);
|
||||
dns_test_dns_enqueue("test", 4, NULL, NULL, 0);
|
||||
|
||||
// Process the packet
|
||||
dns_test_dns_recv(NULL, NULL, p, &ip_addr_any, 0);
|
||||
}
|
||||
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user