esp-idf/components/lwip/test_afl_host
David Cermak 29b8a00c0a esp_netif/lwip: Fix core-locking config (v4.4)
* Fix thread safety issues in non-core locking
* Add option to verify thread safety issues in lwip (core-lock assertion)
* Make esp_sntp.h thread safe API
* Fix sntp example
(v4.4 - fixes minor merge issue that duplicated
DHCP_DEFINE_CUSTOM_TIMEOUTS and DHCP_REQUEST_TIMEOUT_SEQUENCE)

Closes https://github.com/espressif/esp-idf/issues/9908
Closes https://github.com/espressif/esp-idf/issues/10502
Closes https://github.com/espressif/esp-idf/issues/10466
2023-03-21 10:31:20 +01:00
..
in_dhcp_client DnsFuzzer: Added fuzzer test for exercising lwip/dns receiving DNS responses 2018-05-18 15:54:08 +02:00
in_dhcp_server DnsFuzzer: Added fuzzer test for exercising lwip/dns receiving DNS responses 2018-05-18 15:54:08 +02:00
in_dns DnsFuzzer: Added fuzzer test for exercising lwip/dns receiving DNS responses 2018-05-18 15:54:08 +02:00
CMakeLists.txt Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
dhcp_di.h Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
dhcpserver_di.h Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
dns_di.h Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
esp_attr.h CI: Add a test to pre-check fuzzer tests compilation before weekly run 2020-10-20 13:57:00 +00:00
esp_netif_loopback_mock.c Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
Makefile freertos: updated the location of FreeRTOSConfig.h 2021-09-14 08:46:01 +05:30
network_mock.c Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
no_warn_host.h DhcpFuzzer: dhcp client addded 2018-05-16 14:52:42 +02:00
README.md Docs: Added README.md for lwip fuzzer tests 2021-05-18 17:52:07 +04:00
sdkconfig.defaults esp_netif/lwip: Fix core-locking config (v4.4) 2023-03-21 10:31:20 +01:00
test_dhcp_client.c Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00
test_dhcp_server.c tools: Mass fixing of empty prototypes (for -Wstrict-prototypes) 2019-08-01 16:28:56 +07:00
test_dns.c Whitespace: Automated whitespace fixes (large commit) 2020-11-11 07:36:35 +00:00

Introduction

This test uses american fuzzy lop to mangle real dns, dhcp client, dhcp server packets and look for exceptions caused by the parser.

A few actual packets are collected and exported as bins in the in_dns, in_dhcp_client, in_dhcp_server folders, which is then passed as input to AFL when testing. The setup procedure for the test includes all possible services and scenarios that could be used with the given input packets. The output of the parser before fuzzing can be found in input_packets.txt

Building and running the tests using AFL

To build and run the tests using AFL(afl-clang-fast) instrumentation

cd $IDF_PATH/components/lwip/test_afl_host
make fuzz MODE=dns/dhcp_client/dhcp_server

(Please note you have to install AFL instrumentation first, check Installing AFL section)

Building the tests using GCC INSTR(off)

To build the tests without AFL instrumentations and instead of that use GCC compiler(In this case it will only check for compilation issues and will not run AFL tests).

cd $IDF_PATH/components/lwip/test_afl_host
make INSTR=off MODE=dns/dhcp_client/dhcp_server

Installing AFL

To run the test yourself, you need to download the latest afl archive and extract it to a folder on your computer.

The rest of the document will refer to that folder as PATH_TO_AFL.

Preparation

  • On Mac, you will need to install the latest Xcode and llvm support from Homebrew

    /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
    brew install --with-clang --with-lld --HEAD llvm
    export PATH="/usr/local/opt/llvm/bin:$PATH"
    
  • On Ubuntu you need the following packages:

    sudo apt-get install make clang-4.0(or <=4.0) llvm-4.0(or <=4.0) libbsd-dev
    

Please note that if specified package version can't be installed(becouse the system is newer than 2017), you can install it from source.

Compile AFL

Compiling AFL is as easy as running make:

cd [PATH_TO_AFL]
make
cd llvm_mode/
make

After successful compilation, you can export the following variables to your shell (you can also add them to your profile if you want to use AFL in other projects).

export AFL_PATH=[PATH_TO_AFL]
export PATH="$AFL_PATH:$PATH"

Please note LLVM must be <=4.0.0, otherwise afl does not compile, as there are some limitations with building AFL on MacOS/Linux with the latest LLVM. Also, Windows build on cygwin is not fully supported.

Additional info

Apple has a crash reporting service that could interfere with AFL's normal operation. To turn that off, run the following command:

launchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist

Ubuntu has a similar service. To turn that off, run as root:

echo core >/proc/sys/kernel/core_pattern