diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index cdf1bb4dd7..e5a782e617 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -63,7 +63,6 @@ variables: BOT_DOCKER_IMAGE_TAG: ":latest" ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env-v5.1:1" - AFL_FUZZER_TEST_IMAGE: "$CI_DOCKER_REGISTRY/afl-fuzzer-test-v5.1:1-1" CLANG_STATIC_ANALYSIS_IMAGE: "${CI_DOCKER_REGISTRY}/clang-static-analysis-v5.1:1-1" ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env-v5.1:1-1" QEMU_IMAGE: "${CI_DOCKER_REGISTRY}/qemu-v5.1:1-20220802" diff --git a/.gitlab/ci/host-test.yml b/.gitlab/ci/host-test.yml index e74aae876f..9ac10721a7 100644 --- a/.gitlab/ci/host-test.yml +++ b/.gitlab/ci/host-test.yml @@ -82,44 +82,6 @@ test_reproducible_build: - "**/build*/partition_table/*.bin" expire_in: 1 week -.host_fuzzer_test_template: - extends: - - .host_test_template - - .rules:labels:fuzzer_test-weekend_test - image: $AFL_FUZZER_TEST_IMAGE - artifacts: - when: always - paths: - - ${FUZZER_TEST_DIR}/out/crashes - - ${FUZZER_TEST_DIR}/fuzz_output.txt - expire_in: 1 week - script: - - export AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 && export AFL_SKIP_CPUFREQ=1 - - cd ${FUZZER_TEST_DIR} - # run AFL fuzzer for one hour - - ( ( make ${FUZZER_PARAMS} fuzz | tee fuzz_output.txt | grep -v '\(Fuzzing test case\|Entering queue cycle\)' ) || pkill sleep ) & - - ( sleep 3600 || mkdir -p out/crashes/env_failed ) && pkill afl-fuz - # check no crashes found - - test -z "$(ls out/crashes/)" || exit 1 - -test_lwip_dns_fuzzer_on_host: - extends: .host_fuzzer_test_template - variables: - FUZZER_TEST_DIR: components/lwip/test_afl_host - FUZZER_PARAMS: MODE=dns - -test_lwip_dhcp_fuzzer_on_host: - extends: .host_fuzzer_test_template - variables: - FUZZER_TEST_DIR: components/lwip/test_afl_host - FUZZER_PARAMS: MODE=dhcp_client - -test_lwip_dhcps_fuzzer_on_host: - extends: .host_fuzzer_test_template - variables: - FUZZER_TEST_DIR: components/lwip/test_afl_host - FUZZER_PARAMS: MODE=dhcp_server - test_spiffs_on_host: extends: .host_test_template script: diff --git a/.gitlab/ci/pre_check.yml b/.gitlab/ci/pre_check.yml index 11804b7ea7..5f536d4693 100644 --- a/.gitlab/ci/pre_check.yml +++ b/.gitlab/ci/pre_check.yml @@ -97,15 +97,6 @@ check_blobs: # Check if Wi-Fi, PHY, BT blobs contain references to specific symbols - bash $IDF_PATH/tools/ci/check_blobs.sh -check_fuzzer_compilation: - extends: .pre_check_template - image: $AFL_FUZZER_TEST_IMAGE - script: - - cd ${IDF_PATH}/components/lwip/test_afl_host - - make MODE=dhcp_server - - make MODE=dhcp_client - - make MODE=dns - check_public_headers: extends: - .pre_check_template diff --git a/.gitlab/ci/rules.yml b/.gitlab/ci/rules.yml index b1d3591857..31691ea1d8 100644 --- a/.gitlab/ci/rules.yml +++ b/.gitlab/ci/rules.yml @@ -1837,13 +1837,6 @@ - <<: *if-protected - <<: *if-label-lan8720 -.rules:labels:fuzzer_test-weekend_test: - rules: - - <<: *if-revert-branch - when: never - - <<: *if-label-fuzzer_test - - <<: *if-label-weekend_test - .rules:labels:iperf_stress_test: rules: - <<: *if-revert-branch diff --git a/components/lwip/test_afl_host/.build-test-rules.yml b/components/lwip/test_afl_host/.build-test-rules.yml deleted file mode 100644 index e27405999e..0000000000 --- a/components/lwip/test_afl_host/.build-test-rules.yml +++ /dev/null @@ -1,5 +0,0 @@ -# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps - -components/lwip/test_afl_host: - enable: - - if: IDF_TARGET == "linux" diff --git a/components/lwip/test_afl_host/CMakeLists.txt b/components/lwip/test_afl_host/CMakeLists.txt deleted file mode 100644 index f52de94b90..0000000000 --- a/components/lwip/test_afl_host/CMakeLists.txt +++ /dev/null @@ -1,8 +0,0 @@ -# The following four lines of boilerplate have to be in your project's CMakeLists -# in this exact order for cmake to work correctly -cmake_minimum_required(VERSION 3.16) - -set(COMPONENTS lwip) -include($ENV{IDF_PATH}/tools/cmake/project.cmake) - -project(fuzz_test_lwip) diff --git a/components/lwip/test_afl_host/Makefile b/components/lwip/test_afl_host/Makefile deleted file mode 100644 index e8fcda9877..0000000000 --- a/components/lwip/test_afl_host/Makefile +++ /dev/null @@ -1,115 +0,0 @@ -LWIP_COMPONENT_DIR=../ -FREERTOS_COMPONENT_DIR=$(LWIP_COMPONENT_DIR)/../freertos -COMPONENT_DIR=$(LWIP_COMPONENT_DIR)/../ -MOCKS_DIR=$(LWIP_COMPONENT_DIR)/../../tools/mocks - -CFLAGS=-D IDF_VER=\"v3.1\" \ - -DESP_PLATFORM \ - -DLWIP_NO_CTYPE_H=1 \ - -DWITH_POSIX \ - -fdata-sections \ - -ffunction-sections \ - -ggdb \ - -MMD \ - -MP \ - -nostdlib \ - -Og \ - -std=gnu99 \ - -Wall \ - -Werror=all \ - -Wextra \ - -Wno-address \ - -Wno-constant-conversion \ - -Wno-error=deprecated-declarations \ - -Wno-error=unused-function \ - -Wno-error=unused-variable \ - -Wno-incompatible-pointer-types \ - -Wno-incompatible-pointer-types-discards-qualifiers \ - -Wno-int-to-pointer-cast \ - -Wno-macro-redefined \ - -Wno-sign-compare \ - -Wno-typedef-redefinition \ - -Wno-unused-parameter \ - -Wno-unused-variable - -INC_DIRS=-I . \ - -I ./build/config \ - -I $(LWIP_COMPONENT_DIR)/include/apps \ - -I $(LWIP_COMPONENT_DIR)/include/apps/ping \ - -I $(LWIP_COMPONENT_DIR)/include/apps/sntp \ - -I $(LWIP_COMPONENT_DIR)/lwip/src/include \ - -I $(LWIP_COMPONENT_DIR)/lwip/src/include/netif \ - -I $(LWIP_COMPONENT_DIR)/lwip/src/include/posix \ - -I $(LWIP_COMPONENT_DIR)/port/include \ - -I $(LWIP_COMPONENT_DIR)/port/linux/include \ - -I $(LWIP_COMPONENT_DIR)/port/freertos/include \ - -I $(FREERTOS_COMPONENT_DIR)/FreeRTOS-Kernel/include \ - -I $(FREERTOS_COMPONENT_DIR)/esp_additions/include/freertos \ - -I $(FREERTOS_COMPONENT_DIR)/FreeRTOS-Kernel/portable/linux/include \ - -I $(COMPONENT_DIR)/esp_hw_support/include \ - -I $(COMPONENT_DIR)/linux/include - -TEST_NAME=test -FUZZ=afl-fuzz -GEN_CFG=generate_config -LD=$(CC) -ifeq ($(MODE),dhcp_client) - DEPENDENCY_INJECTION=-include dhcp_di.h - OBJECTS=dhcp.o def.o esp32_mock.o test_dhcp_client.o - SAMPLE_PACKETS=in_dhcp_client -else ifeq ($(MODE),dhcp_server) - DEPENDENCY_INJECTION=-include dhcpserver_di.h - OBJECTS=dhcpserver.o def.o esp32_mock.o test_dhcp_server.o - SAMPLE_PACKETS=in_dhcp_server -else ifeq ($(MODE),dns) - CFLAGS+=-DNOT_MOCK_DNS - DEPENDENCY_INJECTION=-include dns_di.h - OBJECTS=dns.o def.o esp32_mock.o test_dns.o - SAMPLE_PACKETS=in_dns -else - $(error Please specify MODE: dhcp_server, dhcp_client, dns) -endif - -ifeq ($(INSTR),off) - CC=gcc - CFLAGS+=-DINSTR_IS_OFF - TEST_NAME=test_sim -else - CC=afl-clang-fast -endif - -CFLAGS+=$(INC_DIRS) - -all: $(TEST_NAME) - -def.o: ../lwip/src/core/def.c $(GEN_CFG) - @echo "[CC] $<" - @$(CC) $(CFLAGS) -D BUILDING_DEF $(DEPENDENCY_INJECTION) -c $< -o $@ - -dns.o: ../lwip/src/core/dns.c $(GEN_CFG) - @echo "[CC] $<" - @$(CC) $(CFLAGS) $(DEPENDENCY_INJECTION) -c $< -o $@ - -dhcp.o: ../lwip/src/core/ipv4/dhcp.c $(GEN_CFG) - @echo "[CC] $<" - @$(CC) $(CFLAGS) $(DEPENDENCY_INJECTION) -c $< -o $@ - -dhcpserver.o: ../apps/dhcpserver/dhcpserver.c $(GEN_CFG) - @echo "[CC] $<" - @$(CC) $(CFLAGS) $(DEPENDENCY_INJECTION) -c $< -o $@ - -%.o: %.c $(GEN_CFG) - @echo "[CC] $<" - @$(CC) $(CFLAGS) -c $< -o $@ - -.PHONY: $(GEN_CFG) -$(GEN_CFG): -# Run reconfiguration without potential AFL in PATHs - PATH=$(subst $(AFL_PATH):,/:,$(PATH)) idf.py reconfigure - -$(TEST_NAME): $(OBJECTS) - @echo "[LD] $@" - @$(LD) $(OBJECTS) -o $@ $(LDLIBS) - -fuzz: $(TEST_NAME) - @$(FUZZ) -t 5000+ -i "$(SAMPLE_PACKETS)" -o "out" -- ./$(TEST_NAME) diff --git a/components/lwip/test_afl_host/README.md b/components/lwip/test_afl_host/README.md deleted file mode 100644 index 81ec59e3aa..0000000000 --- a/components/lwip/test_afl_host/README.md +++ /dev/null @@ -1,80 +0,0 @@ -| Supported Targets | Linux | -| ----------------- | ----- | - -## Introduction -This test uses [american fuzzy lop](http://lcamtuf.coredump.cx/afl/) to mangle real dns, dhcp client, dhcp server packets and look for exceptions caused by the parser. - -A few actual packets are collected and exported as bins in the ```in_dns, in_dhcp_client, in_dhcp_server``` folders, which is then passed as input to AFL when testing. The setup procedure for the test includes all possible services and scenarios that could be used with the given input packets. The output of the parser before fuzzing can be found in [input_packets.txt](input_packets.txt) - -## Building and running the tests using AFL -To build and run the tests using AFL(afl-clang-fast) instrumentation - -```bash -cd $IDF_PATH/components/lwip/test_afl_host -make fuzz MODE=dns/dhcp_client/dhcp_server -``` - -(Please note you have to install AFL instrumentation first, check `Installing AFL` section) - -## Building the tests using GCC INSTR(off) -To build the tests without AFL instrumentations and instead of that use GCC compiler(In this case it will only check for compilation issues and will not run AFL tests). - -```bash -cd $IDF_PATH/components/lwip/test_afl_host -make INSTR=off MODE=dns/dhcp_client/dhcp_server -``` - -## Installing AFL -To run the test yourself, you need to download the [latest afl archive](http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz) and extract it to a folder on your computer. - -The rest of the document will refer to that folder as ```PATH_TO_AFL```. - -### Preparation -- On Mac, you will need to install the latest Xcode and llvm support from [Homebrew](https://brew.sh) - - ```bash - /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" - brew install --with-clang --with-lld --HEAD llvm - export PATH="/usr/local/opt/llvm/bin:$PATH" - ``` - -- On Ubuntu you need the following packages: - - ```bash - sudo apt-get install make clang-4.0(or <=4.0) llvm-4.0(or <=4.0) libbsd-dev - ``` - -Please note that if specified package version can't be installed(becouse the system is newer than 2017), you can install it from source. - -### Compile AFL -Compiling AFL is as easy as running make: - -```bash -cd [PATH_TO_AFL] -make -cd llvm_mode/ -make -``` - -After successful compilation, you can export the following variables to your shell (you can also add them to your profile if you want to use AFL in other projects). - -```bash -export AFL_PATH=[PATH_TO_AFL] -export PATH="$AFL_PATH:$PATH" -``` - -Please note LLVM must be <=4.0.0, otherwise afl does not compile, as there are some limitations with building AFL on MacOS/Linux with the latest LLVM. Also, Windows build on cygwin is not fully supported. - -## Additional info -Apple has a crash reporting service that could interfere with AFL's normal operation. To turn that off, run the following command: - -```bash -launchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist -sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist -``` - -Ubuntu has a similar service. To turn that off, run as root: - -```bash -echo core >/proc/sys/kernel/core_pattern -``` diff --git a/components/lwip/test_afl_host/dhcp_di.h b/components/lwip/test_afl_host/dhcp_di.h deleted file mode 100644 index eeaff9c4ce..0000000000 --- a/components/lwip/test_afl_host/dhcp_di.h +++ /dev/null @@ -1,38 +0,0 @@ -#include "no_warn_host.h" -#include // For abort() -#include // For printf() -#include "lwip/opt.h" -#include "lwip/stats.h" -#include "lwip/mem.h" -#include "lwip/udp.h" -#include "lwip/ip_addr.h" -#include "lwip/netif.h" -#include "lwip/def.h" -#include "lwip/dhcp.h" -#include "lwip/autoip.h" -#include "lwip/dns.h" -#include "netif/etharp.h" - -#ifndef BUILDING_DEF - -void __assert_func(const char *file, int line, const char *func, const char *expr) -{ - printf("Assert failed in %s, %s:%d (%s)", func, file, line, expr); - abort(); -} - -static void dhcp_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port); - -void (*dhcp_test_static_dhcp_recv)(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) = NULL; - -void dhcp_test_init_di(void) -{ - dhcp_test_static_dhcp_recv = dhcp_recv; -} - -void dhcp_test_dhcp_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) -{ - dhcp_test_static_dhcp_recv(arg, pcb, p, addr, port); -} - -#endif /* BUILDING_DEF */ diff --git a/components/lwip/test_afl_host/dhcpserver_di.h b/components/lwip/test_afl_host/dhcpserver_di.h deleted file mode 100644 index 82702d6c6c..0000000000 --- a/components/lwip/test_afl_host/dhcpserver_di.h +++ /dev/null @@ -1,25 +0,0 @@ -/* - * dhcpserver dependecy injection -- preincluded to inject interface test functions into static variables - * - */ -#include "no_warn_host.h" -#include "lwip/pbuf.h" -#include "lwip/udp.h" - -#ifndef BUILDING_DEF - -static void handle_dhcp(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port); - -void (*dhcp_test_static_handle_hdcp)(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) = NULL; - -void dhcp_test_init_di(void) -{ - dhcp_test_static_handle_hdcp = handle_dhcp; -} - -void dhcp_test_handle_dhcp(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) -{ - dhcp_test_static_handle_hdcp(arg, pcb, p, addr, port); -} - -#endif diff --git a/components/lwip/test_afl_host/dns_di.h b/components/lwip/test_afl_host/dns_di.h deleted file mode 100644 index fd17e47bd1..0000000000 --- a/components/lwip/test_afl_host/dns_di.h +++ /dev/null @@ -1,62 +0,0 @@ -/* - * dns.c dependecy injection -- preincluded to inject interface test functions into static variables - * - */ -#include "no_warn_host.h" - -#include "lwip/opt.h" -#include "lwip/udp.h" -#include "lwip/mem.h" -#include "lwip/memp.h" -#include "lwip/dns.h" -#include "lwip/ip_addr.h" - -#define ipaddr_aton(cp, addr) ip4addr_aton(cp, addr) - -extern uint32_t g_random_numbers[8]; -extern uint32_t g_random_numbers_cnt; - -#ifndef BUILDING_DEF - -void __assert_func(const char *file, int line, const char *func, const char *expr) -{ - printf("Assert failed in %s, %s:%d (%s)", func, file, line, expr); - abort(); -} - -int ip4addr_aton(const char *cp, ip4_addr_t *addr) -{ - return 0; -} - -static err_t dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype); -static void dns_recv(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port); - -void (*dns_test_static_dns_recv)(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) = NULL; -err_t (*dns_test_static_dns_enqueue)(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype) = NULL; - -void dns_test_init_di(void) -{ - dns_test_static_dns_recv = dns_recv; - dns_test_static_dns_enqueue = dns_enqueue; -} - - -err_t dns_test_dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype) -{ - return dns_test_static_dns_enqueue(name, hostnamelen, found, callback_arg, dns_addrtype); -} - -void dns_test_dns_recv(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) -{ - dns_test_static_dns_recv(s, pcb, p, addr, port); -} - -void dns_test_inject_port_and_txid(int port, int txid) -{ - // inject random numbers - g_random_numbers[0] = port; //for port - g_random_numbers[1] = txid; //for txid - g_random_numbers_cnt = 0; // let's start with the port -} -#endif diff --git a/components/lwip/test_afl_host/esp32_mock.c b/components/lwip/test_afl_host/esp32_mock.c deleted file mode 100644 index 7f24fe03e8..0000000000 --- a/components/lwip/test_afl_host/esp32_mock.c +++ /dev/null @@ -1,310 +0,0 @@ -/* - * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD - * - * SPDX-License-Identifier: Apache-2.0 - */ -#include -#include -#include -#ifndef NOT_MOCK_DNS -#include "lwip/dns.h" -#endif -#include "lwip/etharp.h" -#include "lwip/mem.h" -#include "lwip/netif.h" -#include "lwip/opt.h" -#include "lwip/pbuf.h" -#include "lwip/timeouts.h" -#include "lwip/udp.h" -#include "lwip/timeouts.h" -#include "no_warn_host.h" - -#define ESP_OK 0 - -/* ---------------------------------------------------- Variables ------------------------------------------------------ - * - * ------------------------------------------------------------------------------------------------------------------ */ - -// -------------------- LWIP Globals ----------------------- - -// ip_addr.h -const ip_addr_t ip_addr_any; -const ip_addr_t ip_addr_broadcast; -const ip_addr_t ip_addr_any_type; -// ip.h -struct ip_globals ip_data; -// netif.h -struct netif *netif_list; - -// ---------------- AFL Host Test Globals ------------------ - -// dns_di.h -uint32_t g_random_numbers[8] = {0}; -uint32_t g_random_numbers_cnt = 0; - -// ----------------------- Locals -------------------------- - -struct udp_pcb mock_pcb; - -/* ---------------------------------------------------- LWIP Mock ------------------------------------------------------ - * - * ------------------------------------------------------------------------------------------------------------------ */ - -// --------------------- lwip/dns.h ------------------------ - -#ifndef NOT_MOCK_DNS -void dns_setserver(u8_t numdns, const ip_addr_t *dnsserver) -{ -} -#endif - -// -------------------- lwip/etharp.h ---------------------- - -err_t etharp_query(struct netif *netif, const ip4_addr_t *ipaddr, struct pbuf *q) -{ - return ESP_OK; -} - -// --------------------- lwip/mem.h ------------------------ - -void * mem_malloc(mem_size_t size) -{ - return malloc(size); -} - -void * mem_calloc(size_t nr, mem_size_t size) -{ - return calloc(nr, size); -} - -void mem_free(void *rmem) -{ - free(rmem); -} - -// -------------------- lwip/netif.h ----------------------- - -void netif_set_addr(struct netif *netif, const ip4_addr_t *ipaddr, const ip4_addr_t *netmask, - const ip4_addr_t *gw) -{ -} - -// --------------------- lwip/pbuf.h ----------------------- - -struct pbuf * pbuf_alloc(pbuf_layer layer, u16_t length, pbuf_type type) -{ - struct pbuf * p; - p = (struct pbuf *)malloc(MEMP_PBUF_POOL); - p->tot_len = length; - p->next = NULL; - p->type_internal = PBUF_POOL; - p->len = length; - p->payload = malloc(length); - return p; -} - -void pbuf_realloc(struct pbuf *p, u16_t size) -{ - if (p != NULL) - { - uint8_t *buf = malloc(size); - free(p->payload); - p->payload = buf; - p->len = size; - p->tot_len = size; - } -} - -u8_t pbuf_free(struct pbuf *p) -{ - if (p) { - if (p->payload) { - free(p->payload); - p->payload = NULL; - } - free (p); - p = NULL; - } - return 1; -} - -u16_t pbuf_copy_partial(const struct pbuf *buf, void *dataptr, u16_t len, u16_t offset) -{ - struct pbuf *p; - u16_t left; - u16_t buf_copy_len; - u16_t copied_total = 0; - - LWIP_ERROR("pbuf_copy_partial: invalid buf", (buf != NULL), return 0;); - LWIP_ERROR("pbuf_copy_partial: invalid dataptr", (dataptr != NULL), return 0;); - - left = 0; - - if ((buf == NULL) || (dataptr == NULL)) { - return 0; - } - - /* Note some systems use byte copy if dataptr or one of the pbuf payload pointers are unaligned. */ - for (p = buf; len != 0 && p != NULL; p = p->next) { - if ((offset != 0) && (offset >= p->len)) { - /* don't copy from this buffer -> on to the next */ - offset -= p->len; - } else { - /* copy from this buffer. maybe only partially. */ - buf_copy_len = p->len - offset; - if (buf_copy_len > len) - buf_copy_len = len; - /* copy the necessary parts of the buffer */ - MEMCPY(&((char*)dataptr)[left], &((char*)p->payload)[offset], buf_copy_len); - copied_total += buf_copy_len; - left += buf_copy_len; - len -= buf_copy_len; - offset = 0; - } - } - return copied_total; -} - -err_t pbuf_take(struct pbuf *buf, const void *dataptr, u16_t len) -{ - return ERR_OK; -} - -err_t pbuf_take_at(struct pbuf *buf, const void *dataptr, u16_t len, u16_t offset) -{ - return ERR_OK; -} - -struct pbuf* pbuf_skip(struct pbuf* in, u16_t in_offset, u16_t* out_offset) -{ - u16_t offset_left = in_offset; - struct pbuf* q = in; - - /* get the correct pbuf */ - while ((q != NULL) && (q->len <= offset_left)) { - offset_left -= q->len; - q = q->next; - } - if (out_offset != NULL) { - *out_offset = offset_left; - } - return q; -} - -u8_t pbuf_get_at(const struct pbuf* p, u16_t offset) -{ - u16_t q_idx; - struct pbuf* q = pbuf_skip(p, offset, &q_idx); - - /* return requested data if pbuf is OK */ - if ((q != NULL) && (q->len > q_idx)) { - return ((u8_t*)q->payload)[q_idx]; - } - return 0; -} - -int pbuf_try_get_at(const struct pbuf* p, u16_t offset) -{ - u16_t q_idx; - struct pbuf* q = pbuf_skip(p, offset, &q_idx); - - /* return requested data if pbuf is OK */ - if ((q != NULL) && (q->len > q_idx)) { - return ((u8_t*)q->payload)[q_idx]; - } - return -1; -} - -void pbuf_put_at(struct pbuf* p, u16_t offset, u8_t data) -{ - u16_t q_idx; - struct pbuf* q = pbuf_skip(p, offset, &q_idx); - - /* write requested data if pbuf is OK */ - if ((q != NULL) && (q->len > q_idx)) { - ((u8_t*)q->payload)[q_idx] = data; - } -} - -// ------------------- lwip/timeouts.h --------------------- - -void sys_timeout(u32_t msecs, sys_timeout_handler handler, void *arg) -{ -} - -void sys_untimeout(sys_timeout_handler handler, void *arg) -{ -} - -// --------------------- lwip/udp.h ------------------------ - -struct udp_pcb *udp_new(void) -{ - return malloc(sizeof(struct udp_pcb)); -} - -struct udp_pcb * udp_new_ip_type(u8_t type) -{ - return &mock_pcb; -} - -void udp_remove(struct udp_pcb *pcb) -{ - if (pcb == NULL) - { - free(pcb); - } -} - -err_t udp_bind(struct udp_pcb *pcb, const ip_addr_t *ipaddr, u16_t port) -{ - return ESP_OK; -} - -err_t udp_connect(struct udp_pcb *pcb, const ip_addr_t *ipaddr, u16_t port) -{ - return ESP_OK; -} - -err_t udp_sendto(struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *dst_ip, u16_t dst_port) -{ - return ESP_OK; -} - -void udp_disconnect(struct udp_pcb *pcb) -{ -} - -void udp_recv(struct udp_pcb *pcb, udp_recv_fn recv, void *recv_arg) -{ -} - -err_t udp_sendto_if(struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *dst_ip, u16_t dst_port, struct netif *netif) -{ - return ESP_OK; -} - -err_t udp_sendto_if_src(struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *dst_ip, u16_t dst_port, struct netif *netif, const ip_addr_t *src_ip) -{ - return ESP_OK; -} - -/* ------------------------------------------------- ESP32 Port Mock --------------------------------------------------- - * - * ------------------------------------------------------------------------------------------------------------------ */ - -// --------------------- lwipopts.h ------------------------ - -uint32_t esp_random(void) -{ - // Preparation for injecting favorable random numbers - return g_random_numbers[g_random_numbers_cnt++ % 8]; -} - -void dhcp_parse_extra_opts(struct dhcp *dhcp, uint8_t state, uint8_t option, uint8_t len, struct pbuf* p, uint16_t offset) -{ -} - -void dhcp_append_extra_opts(struct netif *netif, uint8_t state, struct dhcp_msg *msg_out, uint16_t *options_out_len) -{ -} diff --git a/components/lwip/test_afl_host/esp_attr.h b/components/lwip/test_afl_host/esp_attr.h deleted file mode 100644 index 40794b5655..0000000000 --- a/components/lwip/test_afl_host/esp_attr.h +++ /dev/null @@ -1,2 +0,0 @@ -#pragma once -#define IRAM_ATTR diff --git a/components/lwip/test_afl_host/esp_task.h b/components/lwip/test_afl_host/esp_task.h deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/components/lwip/test_afl_host/in_dhcp_client/data0.bin b/components/lwip/test_afl_host/in_dhcp_client/data0.bin deleted file mode 100644 index afd14b5305..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data0.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data1.bin b/components/lwip/test_afl_host/in_dhcp_client/data1.bin deleted file mode 100644 index 4f92add08e..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data1.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data2.bin b/components/lwip/test_afl_host/in_dhcp_client/data2.bin deleted file mode 100644 index f8891fb784..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data2.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data3.bin b/components/lwip/test_afl_host/in_dhcp_client/data3.bin deleted file mode 100644 index d97ab4eda8..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data3.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data4.bin b/components/lwip/test_afl_host/in_dhcp_client/data4.bin deleted file mode 100644 index e56a6833d2..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data4.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data5.bin b/components/lwip/test_afl_host/in_dhcp_client/data5.bin deleted file mode 100644 index a007ed8395..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data5.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data6.bin b/components/lwip/test_afl_host/in_dhcp_client/data6.bin deleted file mode 100644 index 65695216c9..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data6.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data7.bin b/components/lwip/test_afl_host/in_dhcp_client/data7.bin deleted file mode 100644 index 6e26d917cc..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data7.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_client/data8.bin b/components/lwip/test_afl_host/in_dhcp_client/data8.bin deleted file mode 100644 index 7f52ba28e2..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_client/data8.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_server/data0.bin b/components/lwip/test_afl_host/in_dhcp_server/data0.bin deleted file mode 100644 index 2875ab855f..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_server/data0.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_server/data1.bin b/components/lwip/test_afl_host/in_dhcp_server/data1.bin deleted file mode 100644 index 17c8877f8f..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_server/data1.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_server/data2.bin b/components/lwip/test_afl_host/in_dhcp_server/data2.bin deleted file mode 100644 index b1c32b9bde..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_server/data2.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_server/data3.bin b/components/lwip/test_afl_host/in_dhcp_server/data3.bin deleted file mode 100644 index 6c6a7ae2d9..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_server/data3.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_server/data4.bin b/components/lwip/test_afl_host/in_dhcp_server/data4.bin deleted file mode 100644 index 6d10ed9bd7..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_server/data4.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_server/data5.bin b/components/lwip/test_afl_host/in_dhcp_server/data5.bin deleted file mode 100644 index 51f77595fb..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_server/data5.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dhcp_server/data6.bin b/components/lwip/test_afl_host/in_dhcp_server/data6.bin deleted file mode 100644 index 636fb41014..0000000000 Binary files a/components/lwip/test_afl_host/in_dhcp_server/data6.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out0.bin b/components/lwip/test_afl_host/in_dns/out0.bin deleted file mode 100644 index 8a68ce6635..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out0.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out10.bin b/components/lwip/test_afl_host/in_dns/out10.bin deleted file mode 100644 index e9f8c73fcb..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out10.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out28.bin b/components/lwip/test_afl_host/in_dns/out28.bin deleted file mode 100644 index 92ed4c510b..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out28.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out29.bin b/components/lwip/test_afl_host/in_dns/out29.bin deleted file mode 100644 index 40dc982a03..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out29.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out30.bin b/components/lwip/test_afl_host/in_dns/out30.bin deleted file mode 100644 index d7eff8b989..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out30.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out31.bin b/components/lwip/test_afl_host/in_dns/out31.bin deleted file mode 100644 index 4ed67b7360..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out31.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out32.bin b/components/lwip/test_afl_host/in_dns/out32.bin deleted file mode 100644 index 84afda7a6c..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out32.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out33.bin b/components/lwip/test_afl_host/in_dns/out33.bin deleted file mode 100644 index dc5b666c7d..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out33.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out34.bin b/components/lwip/test_afl_host/in_dns/out34.bin deleted file mode 100644 index 55e9f0c3d8..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out34.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out35.bin b/components/lwip/test_afl_host/in_dns/out35.bin deleted file mode 100644 index 8d7c652e0a..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out35.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out36.bin b/components/lwip/test_afl_host/in_dns/out36.bin deleted file mode 100644 index 0b6580fb58..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out36.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out37.bin b/components/lwip/test_afl_host/in_dns/out37.bin deleted file mode 100644 index 9c06a7b292..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out37.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/in_dns/out38.bin b/components/lwip/test_afl_host/in_dns/out38.bin deleted file mode 100644 index 31bf8c2da5..0000000000 Binary files a/components/lwip/test_afl_host/in_dns/out38.bin and /dev/null differ diff --git a/components/lwip/test_afl_host/no_warn_host.h b/components/lwip/test_afl_host/no_warn_host.h deleted file mode 100644 index 8d75837192..0000000000 --- a/components/lwip/test_afl_host/no_warn_host.h +++ /dev/null @@ -1,6 +0,0 @@ -// Note: these undefs and defines are used to suppress warnings and errors when compiling esp32 idf on host gcc/clang -#undef __nonnull -#define __warning__ deprecated -#define IRAM_ATTR -#define __ESP_ATTR_H__ -#include diff --git a/components/lwip/test_afl_host/sdkconfig.defaults b/components/lwip/test_afl_host/sdkconfig.defaults deleted file mode 100644 index 2b408fc611..0000000000 --- a/components/lwip/test_afl_host/sdkconfig.defaults +++ /dev/null @@ -1,6 +0,0 @@ -CONFIG_LWIP_TCPIP_CORE_LOCKING=n -CONFIG_LWIP_CHECK_THREAD_SAFETY=n -CONFIG_LWIP_DNS_SUPPORT_MDNS_QUERIES=n -CONFIG_FREERTOS_SMP=n -CONFIG_IDF_TARGET="linux" -CONFIG_UNITY_ENABLE_IDF_TEST_RUNNER=n diff --git a/components/lwip/test_afl_host/test_dhcp_client.c b/components/lwip/test_afl_host/test_dhcp_client.c deleted file mode 100644 index 9d62d29aa2..0000000000 --- a/components/lwip/test_afl_host/test_dhcp_client.c +++ /dev/null @@ -1,84 +0,0 @@ -#include "no_warn_host.h" -#include "lwip/opt.h" -#include "lwip/stats.h" -#include "lwip/mem.h" -#include "lwip/udp.h" -#include "lwip/ip_addr.h" -#include "lwip/netif.h" -#include "lwip/def.h" -#include "lwip/dhcp.h" -#include "lwip/autoip.h" -#include "lwip/dns.h" -#include "netif/etharp.h" -#include - -const ip_addr_t ip_addr_any; -const ip_addr_t ip_addr_broadcast; -struct ip_globals ip_data; -struct netif *netif_list; -struct netif mynetif; -ip4_addr_t server_ip; - -// -// Dependency injected test functions -void dhcp_test_dhcp_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port); -void dhcp_test_init_di(void); - -// -// Test starts here -// -int main(int argc, char** argv) -{ - uint8_t *buf; - struct pbuf *p; - FILE *file; - size_t len = 1460; - - dhcp_test_init_di(); - - mynetif.flags = NETIF_FLAG_UP | NETIF_FLAG_ETHARP; - mynetif.mtu = 576; - - - IP4_ADDR(&server_ip, 192,168,4,1); - dhcp_start(&mynetif); - - ip_data.current_input_netif = &mynetif; - ip_data.current_netif = &mynetif; - -#ifdef INSTR_IS_OFF - p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL); - buf = p->payload; - memset(buf, 0, 1460); - if (argc != 2) - { - printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n"); - return 1; - } - // - // Note: parameter1 is a file (mangled packet) which caused the crash - file = fopen(argv[1], "r"); - if (file) { - len = fread(buf, 1, 1460, file); - } - fclose(file); - int i; - for (i=0; i<1; i++) { -#else - while (__AFL_LOOP(1000)) { - p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL); - buf = p->payload; - memset(buf, 0, 1460); - size_t len = read(0, buf, 1460); -#endif - p->len = len; - p->tot_len = len; - p->next = NULL; - - dhcp_test_dhcp_recv(NULL, NULL, p, &ip_addr_any, 0); - } - - - - return 0; -} diff --git a/components/lwip/test_afl_host/test_dhcp_server.c b/components/lwip/test_afl_host/test_dhcp_server.c deleted file mode 100644 index 54084ee55a..0000000000 --- a/components/lwip/test_afl_host/test_dhcp_server.c +++ /dev/null @@ -1,71 +0,0 @@ -#include "no_warn_host.h" -#include "lwip/pbuf.h" -#include "lwip/udp.h" -#include -#include -#include "dhcpserver/dhcpserver.h" - -const ip_addr_t ip_addr_any; -ip4_addr_t server_ip; -struct netif mynetif; - -// dhcps callback -void dhcp_test_dhcps_cb (void* cb_arg, u8_t client_ip[4], u8_t client_mac[6]) {} - -// Dependency injected static function to pass the packet into parser -void dhcp_test_handle_dhcp(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port); -void dhcp_test_init_di(void); - -// -// Test starts here -// -int main(int argc, char** argv) -{ - uint8_t *buf; - struct pbuf *p; - FILE *file; - size_t len = 1460; - - dhcp_test_init_di(); - - IP4_ADDR(&server_ip, 192,168,4,1); - dhcps_t *dhcps = dhcps_new(); - dhcps_set_new_lease_cb(dhcps, dhcp_test_dhcps_cb, NULL); - dhcps_start(dhcps, &mynetif, server_ip); - -#ifdef INSTR_IS_OFF - p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL); - buf = p->payload; - memset(buf, 0, 1460); - if (argc != 2) - { - printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n"); - return 1; - } - // - // Note: parameter1 is a file (mangled packet) which caused the crash - file = fopen(argv[1], "r"); - if (file) { - len = fread(buf, 1, 1460, file); - } - fclose(file); - - int i; - for (i=0; i<1; i++) { -#else - while (__AFL_LOOP(1000)) { - p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL); - buf = p->payload; - memset(buf, 0, 1460); - size_t len = read(0, buf, 1460); -#endif - p->len = len; - p->tot_len = len; - p->next = NULL; - - dhcp_test_handle_dhcp(dhcps, NULL, p, &ip_addr_any, 0); - } - dhcps_stop(dhcps, &mynetif); - dhcps_delete(dhcps); - return 0; -} diff --git a/components/lwip/test_afl_host/test_dns.c b/components/lwip/test_afl_host/test_dns.c deleted file mode 100644 index 3e240aec27..0000000000 --- a/components/lwip/test_afl_host/test_dns.c +++ /dev/null @@ -1,81 +0,0 @@ -#include "no_warn_host.h" - -#include "lwip/opt.h" -#include "lwip/udp.h" -#include "lwip/mem.h" -#include "lwip/memp.h" -#include "lwip/dns.h" -#include "lwip/ip_addr.h" - -#include - -const ip_addr_t ip_addr_any; -const ip_addr_t ip_addr_broadcast; -struct ip_globals ip_data; -struct netif *netif_list; -struct netif mynetif; -ip4_addr_t server_ip; - -// -// Dependency injected test functions -void dns_test_dns_recv(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port); -void dns_test_inject_port_and_txid(int port, int txid); - -void dns_test_init_di(void); -err_t dns_test_dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype); - -// -// Test starts here -// -int main(int argc, char** argv) -{ - uint8_t *buf; - struct pbuf *p; - FILE *file; - size_t len = 1460; - - dns_test_init_di(); - -#ifdef INSTR_IS_OFF - p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL); - buf = p->payload; - memset(buf, 0, 1460); - if (argc != 2) - { - printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n"); - return 1; - } - // - // Note: parameter1 is a file (mangled packet) which caused the crash - file = fopen(argv[1], "r"); - if (file) { - len = fread(buf, 1, 1460, file); - } - fclose(file); - int i; - for (i=0; i<1; i++) { -#else - while (__AFL_LOOP(1000)) { - p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL); - buf = p->payload; - memset(buf, 0, 1460); - size_t len = read(0, buf, 1460); -#endif - p->len = len; - p->tot_len = len; - p->next = NULL; - - // Pretend that the response is from our pending querries - IP4_ADDR(&server_ip, 8, 8, 8, 8); - dns_setserver(0, &server_ip); - dns_test_inject_port_and_txid(1024, (buf[0]<<8) + buf[1]); - dns_test_dns_enqueue("test", 4, NULL, NULL, 0); - - // Process the packet - dns_test_dns_recv(NULL, NULL, p, &ip_addr_any, 0); - } - - - - return 0; -}