diff options
| -rw-r--r-- | src/bin/dhcp4/dhcp4_srv.cc | 25 | ||||
| -rw-r--r-- | src/bin/dhcp4/tests/fuzz-data/ack.pkt | bin | 0 -> 277 bytes | |||
| -rw-r--r-- | src/bin/dhcp4/tests/fuzz-data/discover.pkt | bin | 0 -> 262 bytes | |||
| -rw-r--r-- | src/bin/dhcp4/tests/fuzz-data/offer.pkt | bin | 0 -> 277 bytes | |||
| -rw-r--r-- | src/bin/dhcp4/tests/fuzz-data/request.pkt | bin | 0 -> 274 bytes | |||
| -rw-r--r-- | src/bin/dhcp6/dhcp6_srv.cc | 26 | ||||
| -rw-r--r-- | src/bin/dhcp6/tests/fuzz-config/fuzz.json | 61 | ||||
| -rw-r--r-- | src/lib/dhcpsrv/fuzz.cc | 268 | ||||
| -rw-r--r-- | src/lib/dhcpsrv/fuzz.h | 175 | ||||
| -rw-r--r-- | src/lib/dhcpsrv/fuzz_log.cc | 2 | ||||
| -rw-r--r-- | src/lib/dhcpsrv/fuzz_log.h | 2 | ||||
| -rw-r--r-- | src/lib/dhcpsrv/fuzz_messages.cc | 26 | ||||
| -rw-r--r-- | src/lib/dhcpsrv/fuzz_messages.h | 14 | ||||
| -rw-r--r-- | src/lib/dhcpsrv/fuzz_messages.mes | 56 |
14 files changed, 146 insertions, 509 deletions
diff --git a/src/bin/dhcp4/dhcp4_srv.cc b/src/bin/dhcp4/dhcp4_srv.cc index d0a45aa7d1..3740590a41 100644 --- a/src/bin/dhcp4/dhcp4_srv.cc +++ b/src/bin/dhcp4/dhcp4_srv.cc @@ -773,21 +773,18 @@ Dhcpv4Srv::sendPacket(const Pkt4Ptr& packet) { bool Dhcpv4Srv::run() { #ifdef ENABLE_AFL - // AFL fuzzing setup initiated here. At this stage, Kea has loaded its - // config, opened sockets, established DB connections, etc. It is truly - // ready to process packets. Now it's time to initialize AFL. It will set - // up a separate thread that will receive data from fuzzing engine and will - // send it as packets to Kea. Kea is supposed to process them and hopefully - // not crash in the process. Once the packet processing is done, Kea should - // let the know that it's ready for the next packet. This is done further - // down in this loop by a call to the packetProcessed() method. - Fuzz fuzz_controller(4, &shutdown_); + // Set up structures needed for fuzzing. + Fuzz fuzzer(4, server_port_); // // The next line is needed as a signature for AFL to recognise that we are // running persistent fuzzing. This has to be in the main image file. - __AFL_LOOP(0); -#endif // ENABLE_AFL + while (__AFL_LOOP(fuzzer.maxLoopCount())) { + // Read from stdin and put the data read into an address/port on which + // Kea is listening, read for Kea to read it via asynchronous I/O. + fuzzer.transfer(); +#else while (!shutdown_) { +#endif // ENABLE_AFL try { run_one(); getIOService()->poll(); @@ -802,12 +799,6 @@ Dhcpv4Srv::run() { // std::exception. LOG_ERROR(packet4_logger, DHCP4_PACKET_PROCESS_EXCEPTION); } - -#ifdef ENABLE_AFL - // Ok, this particular packet processing is done. If we are fuzzing, - // let AFL know about it. - fuzz_controller.packetProcessed(); -#endif // ENABLE_AFL } return (true); diff --git a/src/bin/dhcp4/tests/fuzz-data/ack.pkt b/src/bin/dhcp4/tests/fuzz-data/ack.pkt Binary files differnew file mode 100644 index 0000000000..9eb1e66aef --- /dev/null +++ b/src/bin/dhcp4/tests/fuzz-data/ack.pkt diff --git a/src/bin/dhcp4/tests/fuzz-data/discover.pkt b/src/bin/dhcp4/tests/fuzz-data/discover.pkt Binary files differnew file mode 100644 index 0000000000..defb10e123 --- /dev/null +++ b/src/bin/dhcp4/tests/fuzz-data/discover.pkt diff --git a/src/bin/dhcp4/tests/fuzz-data/offer.pkt b/src/bin/dhcp4/tests/fuzz-data/offer.pkt Binary files differnew file mode 100644 index 0000000000..af25123d52 --- /dev/null +++ b/src/bin/dhcp4/tests/fuzz-data/offer.pkt diff --git a/src/bin/dhcp4/tests/fuzz-data/request.pkt b/src/bin/dhcp4/tests/fuzz-data/request.pkt Binary files differnew file mode 100644 index 0000000000..c4e617a4fe --- /dev/null +++ b/src/bin/dhcp4/tests/fuzz-data/request.pkt diff --git a/src/bin/dhcp6/dhcp6_srv.cc b/src/bin/dhcp6/dhcp6_srv.cc index 4d28f364c1..3af1ccbaa5 100644 --- a/src/bin/dhcp6/dhcp6_srv.cc +++ b/src/bin/dhcp6/dhcp6_srv.cc @@ -444,22 +444,18 @@ Dhcpv6Srv::initContext(const Pkt6Ptr& pkt, bool Dhcpv6Srv::run() { #ifdef ENABLE_AFL - // AFL fuzzing setup initiated here. At this stage, Kea has loaded its - // config, opened sockets, established DB connections, etc. It is truly - // ready to process packets. Now it's time to initialize AFL. It will set - // up a separate thread that will receive data from fuzzing engine and will - // send it as packets to Kea. Kea is supposed to process them and hopefully - // not crash in the process. Once the packet processing is done, Kea should - // let the know that it's ready for the next packet. This is done further - // down in this loop by a call to the packetProcessed() method. - Fuzz fuzz_controller(6, &shutdown_); + // Set up structures needed for fuzzing. + Fuzz fuzzer(6, server_port_); // // The next line is needed as a signature for AFL to recognise that we are // running persistent fuzzing. This has to be in the main image file. - __AFL_LOOP(0); -#endif // ENABLE_AFL - + while (__AFL_LOOP(fuzzer.maxLoopCount())) { + // Read from stdin and put the data read into an address/port on which + // Kea is listening, read for Kea to read it via asynchronous I/O. + fuzzer.transfer(); +#else while (!shutdown_) { +#endif // ENABLE_AFL try { run_one(); getIOService()->poll(); @@ -474,12 +470,6 @@ bool Dhcpv6Srv::run() { // by more specific catches. LOG_ERROR(packet6_logger, DHCP6_PACKET_PROCESS_EXCEPTION); } - -#ifdef ENABLE_AFL - // Ok, this particular packet processing is done. If we are fuzzing, - // let AFL know about it. - fuzz_controller.packetProcessed(); -#endif // ENABLE_AFL } return (true); diff --git a/src/bin/dhcp6/tests/fuzz-config/fuzz.json b/src/bin/dhcp6/tests/fuzz-config/fuzz.json deleted file mode 100644 index 80d80b7124..0000000000 --- a/src/bin/dhcp6/tests/fuzz-config/fuzz.json +++ /dev/null @@ -1,61 +0,0 @@ -# This is an example configuration file for DHCPv6 server in Kea. -# It's a basic scenario with one IPv6 subnet configured. It is -# assumed that one subnet (2001:db8:1::/64 is available directly -# over ethX interface. - -{ "Dhcp6": - -{ -# Kea is told to listen on ethX interface only. - "interfaces-config": { - "interfaces": [ "eth0" ] - }, - -# We need to specify the the database used to store leases. As of -# September 2016, four database backends are supported: MySQL, -# PostgreSQL, Cassandra, and the in-memory database, Memfile. -# We'll use memfile because it doesn't require any prior set up. - "lease-database": { - "type": "memfile" - }, - -# Addresses will be assigned with preferred and valid lifetimes -# being 3000 and 4000, respectively. Client is told to start -# renewing after 1000 seconds. If the server does not respond -# after 2000 seconds since the lease was granted, client is supposed -# to start REBIND procedure (emergency renewal that allows switching -# to a different server). - "preferred-lifetime": 3000, - "valid-lifetime": 4000, - "renew-timer": 1000, - "rebind-timer": 2000, - -# The following list defines subnets. Each subnet consists of at -# least subnet and pool entries. - "subnet6": [ - { - "pools": [ { "pool": "2001:db8:1::/80" } ], - "subnet": "2001:db8:1::/64", - "interface": "eth0" - } - ] -}, - -# The following configures logging. It assumes that messages with at least -# informational level (info, warn, error and fatal) should be logged to stdout. -"Logging": { - "loggers": [ - { - "name": "kea-dhcp6", - "output_options": [ - { - "output": "/tmp/kea-fuzz.log" - } - ], - "debuglevel": 0, - "severity": "DEBUG" - } - ] -} - -} diff --git a/src/lib/dhcpsrv/fuzz.cc b/src/lib/dhcpsrv/fuzz.cc index cb28389de4..1619c71811 100644 --- a/src/lib/dhcpsrv/fuzz.cc +++ b/src/lib/dhcpsrv/fuzz.cc @@ -1,4 +1,4 @@ -// Copyright (C) 2016 Internet Systems Consortium, Inc. ("ISC") +// Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC") // // This Source Code Form is subject to the terms of the Mozilla Public // License, v. 2.0. If a copy of the MPL was not distributed with this @@ -35,61 +35,31 @@ using namespace std; // Constants defined in the Fuzz class definition. constexpr size_t Fuzz::BUFFER_SIZE; constexpr size_t Fuzz::MAX_SEND_SIZE; -constexpr useconds_t Fuzz::SLEEP_INTERVAL; -constexpr long Fuzz::LOOP_COUNT; - -// FuzzSync methods. FuzSynch is the class that encapsulates the -// synchronization process between the main and fuzzing threads. - -// Constructor -FuzzSync::FuzzSync(const char* name) : ready_(false), name_(name) { -} - -// Wait to be notified when the predicate is true -void -FuzzSync::wait(void) { - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_WAITING).arg(name_); - unique_lock<mutex> lock(mutex_); - cond_.wait(lock, [=]() { return this->ready_; }); - ready_ = false; - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_WAITED).arg(name_); -} - -// Set predicate and notify the waiting thread to continue -void -FuzzSync::notify(void) { - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_SETTING).arg(name_); - unique_lock<mutex> lock(mutex_); - ready_ = true; - cond_.notify_all(); - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_SET).arg(name_); -} - -// Fuzz methods. +constexpr long Fuzz::MAX_LOOP_COUNT; // Constructor -Fuzz::Fuzz(int ipversion, volatile bool* shutdown) : - fuzz_sync_("fuzz_sync"), main_sync_("main_sync"), address_(nullptr), - interface_(nullptr), loop_max_(LOOP_COUNT), port_(0), running_(false), - sockaddr_ptr_(nullptr), sockaddr_len_(0), shutdown_ptr_(nullptr) { +Fuzz::Fuzz(int ipversion, uint16_t port) : + address_(nullptr), interface_(nullptr), loop_max_(MAX_LOOP_COUNT), + port_(port), sockaddr_len_(0), sockaddr_ptr_(nullptr), sockfd_(-1) { try { stringstream reason; // Used to construct exception messages - // Store reference to shutdown flag. When the fuzzing loop has read - // the set number of packets from AFL, it will set this flag to trigger - // a Kea shutdown. - if (shutdown) { - shutdown_ptr_ = shutdown; - } else { - isc_throw(FuzzInitFail, "must pass shutdown flag to kea_fuzz_init"); - } - // Set up address structures. setAddress(ipversion); + // Create the socket through which packets read from stdin will be sent + // to the port on which Kea is listening. This is closed in the + // destructor. + sockfd_ = socket((ipversion == 4) ? AF_INET : AF_INET6, SOCK_DGRAM, 0); + if (sockfd_ < 0) { + LOG_FATAL(fuzz_logger, FUZZ_SOCKET_CREATE_FAIL) + .arg(strerror(errno)); + return; + } + // Check if the hard-coded maximum loop count is being overridden - const char *loop_max_ptr = getenv("FUZZ_AFL_LOOP_MAX"); + const char *loop_max_ptr = getenv("KEA_AFL_LOOP_MAX"); if (loop_max_ptr != 0) { try { loop_max_ = boost::lexical_cast<long>(loop_max_ptr); @@ -100,20 +70,12 @@ Fuzz::Fuzz(int ipversion, volatile bool* shutdown) : } if (loop_max_ <= 0) { - reason << "FUZZ_AFL_LOOP_MAX is " << loop_max_ << ". " + reason << "KEA_AFL_LOOP_MAX is " << loop_max_ << ". " << "It must be an integer greater than zero."; isc_throw(FuzzInitFail, reason.str()); } } - // Start the thread that reads the packets sent by AFL from stdin and - // passes them to the port on which Kea is listening. - fuzzing_thread_ = std::thread(&Fuzz::run, this); - - // Wait for the fuzzing thread to read its first packet from AFL and - // send it to the port on which Kea is listening. - fuzz_sync_.wait(); - } catch (const FuzzInitFail& e) { // AFL tends to make it difficult to find out what exactly has failed: // make sure that the error is logged. @@ -127,11 +89,7 @@ Fuzz::Fuzz(int ipversion, volatile bool* shutdown) : // Destructor Fuzz::~Fuzz() { - // The fuzzing thread should not be running when the fuzzing object - // goes out of scope. - if (running_) { - LOG_ERROR(fuzz_logger, FUZZ_THREAD_NOT_TERMINATED); - } + static_cast<void>(close(sockfd_)); } // Parse IP address/port/interface and set up address structures. @@ -140,49 +98,22 @@ Fuzz::setAddress(int ipversion) { stringstream reason; // Used in error messages // Get the environment for the fuzzing: interface, address and port. - interface_ = getenv("FUZZ_AFL_INTERFACE"); + interface_ = getenv("KEA_AFL_INTERFACE"); if (! interface_) { isc_throw(FuzzInitFail, "no fuzzing interface has been set"); } - // Now the address. - address_ = getenv("FUZZ_AFL_ADDRESS"); + // Now the address. (The port is specified via the "-p" command-line + // switch and passed to this object through the constructor.) + address_ = getenv("KEA_AFL_ADDRESS"); if (address_ == 0) { isc_throw(FuzzInitFail, "no fuzzing address has been set"); } - // ... and the port. - const char *port_ptr = getenv("FUZZ_AFL_PORT"); - if (port_ptr == 0) { - isc_throw(FuzzInitFail, "no fuzzing port has been set"); - } - try { - port_ = boost::lexical_cast<uint16_t>(port_ptr); - } catch (const boost::bad_lexical_cast&) { - reason << "cannot convert port number specification " - << port_ptr << " to an integer"; - isc_throw(FuzzInitFail, reason.str()); - } - - // Decide if the address is an IPv4 or IPv6 address. - if ((strstr(address_, ".") != NULL) && (ipversion == 4)) { - // Assume an IPv4 address - memset(&servaddr4_, 0, sizeof(servaddr4_)); - - servaddr4_.sin_family = AF_INET; - if (inet_pton(AF_INET, address_, &servaddr4_.sin_addr) != 1) { - reason << "inet_pton() failed: can't convert " - << address_ << " to an IPv6 address" << endl; - isc_throw(FuzzInitFail, reason.str()); - } - servaddr4_.sin_port = htons(port_); - - sockaddr_ptr_ = reinterpret_cast<sockaddr*>(&servaddr4_); - sockaddr_len_ = sizeof(servaddr4_); - - } else if ((strstr(address_, ":") != NULL) && (ipversion == 6)) { - - // Set up the IPv6 address structure. + // Set up the appropriate data structure depending on the address given. + if ((strstr(address_, ":") != NULL) && (ipversion == 6)) { + // Expecting IPv6 and the address contains a colon, so assume it is an + // an IPv6 address. memset(&servaddr6_, 0, sizeof (servaddr6_)); servaddr6_.sin6_family = AF_INET6; @@ -203,6 +134,24 @@ Fuzz::setAddress(int ipversion) { sockaddr_ptr_ = reinterpret_cast<sockaddr*>(&servaddr6_); sockaddr_len_ = sizeof(servaddr6_); + + } else if ((strstr(address_, ".") != NULL) && (ipversion == 4)) { + // Expecting an IPv4 address and it contains a dot, so assume it is. + // This check is done after the IPv6 check, as it is possible for an + // IPv4 address to be emnbedded in an IPv6 one. + memset(&servaddr4_, 0, sizeof(servaddr4_)); + + servaddr4_.sin_family = AF_INET; + if (inet_pton(AF_INET, address_, &servaddr4_.sin_addr) != 1) { + reason << "inet_pton() failed: can't convert " + << address_ << " to an IPv6 address" << endl; + isc_throw(FuzzInitFail, reason.str()); + } + servaddr4_.sin_port = htons(port_); + + sockaddr_ptr_ = reinterpret_cast<sockaddr*>(&servaddr4_); + sockaddr_len_ = sizeof(servaddr4_); + } else { reason << "Expected IP version (" << ipversion << ") is not " << "4 or 6, or the given address " << address_ << " does not " @@ -213,127 +162,44 @@ Fuzz::setAddress(int ipversion) { } -// This is the main fuzzing function. It receives data from fuzzing engine. -// That data is received to stdin and then sent over the configured UDP socket. -// It then waits for the main thread to process the packet, the completion of -// that task being signalled by the main thread calling Fuzz::packetProcessed(). +// This is the main fuzzing function. It receives data from fuzzing engine over +// stdin and then sends it to the configured UDP socket. void -Fuzz::run(void) { - running_ = true; - - // Create the socket throw which packets read from stdin will be send - // to the port on which Kea is listening. - int sockfd = socket(AF_INET6, SOCK_DGRAM, 0); - if (sockfd < 0) { - LOG_FATAL(fuzz_logger, FUZZ_SOCKET_CREATE_FAIL).arg(strerror(errno)); - return; - } +Fuzz::transfer(void) { - // Main loop. This runs for a fixed number of iterations, after which - // Kea will be terminated and AFL will restart it. The counting of loop - // iterations is done here with a separate variable (instead of inside - // inside the read loop in the server process using __AFL_LOOP) to ensure - // that thread running this function shuts down properly between each - // restart of Kea. - auto loop = loop_max_; - while (loop-- > 0) { - // Read from stdin and continue reading (albeit after a pause) even - // if there is an error. Do the same if an EOF is received. - char buf[BUFFER_SIZE]; - ssize_t length = read(0, buf, sizeof(buf)); - if (length <= 0) { - // Don't log EOFs received - they may be generated by AFL - if (length != 0) { - LOG_ERROR(fuzz_logger, FUZZ_READ_FAIL).arg(strerror(errno)); - } - usleep(SLEEP_INTERVAL); - continue; - } - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_DATA_READ) - .arg(length); + // Read from stdin. Just return if nothing is read (or there is an error) + // and hope that this does not cause a hang. + char buf[BUFFER_SIZE]; + ssize_t length = read(0, buf, sizeof(buf)); - // Now send the data to the UDP port on which Kea is listening. - // - // The condition variables synchronize the operation: this thread - // will read from stdin and write to the socket. It then blocks until - // the main thread has processed the packet, at which point it can read - // more data from stdin. - // - // Synchronization is required because although the read from stdin is - // blocking, there is no blocking on the sending of data to the port - // from which Kea is reading. It is quite possible to lose packets, - // and AFL seems to get confused in this case. At any rate, without - // some form of synchronization, this approach does not work. + // Save the errno in case there was an error because if debugging is + // enabled, the following LOG_DEBUG call may destroy its value. + int errnum = errno; + LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_DATA_READ) + .arg(length); + if (length > 0) { + // Now send the data to the UDP port on which Kea is listening. // Send the data to the main Kea thread. Limit the size of the // packets that can be sent. size_t send_len = (length < MAX_SEND_SIZE) ? length : MAX_SEND_SIZE; - ssize_t sent = sendto(sockfd, buf, send_len, 0, sockaddr_ptr_, + ssize_t sent = sendto(sockfd_, buf, send_len, 0, sockaddr_ptr_, sockaddr_len_); - if (sent < 0) { - // TODO: If we get here, we may well hang: AFL has sent us a - // packet but by continuing, we are not letting Kea process it - // and trigger AFL to send another. For the time being, we - // are restricting the size of packets Kea can send us. - LOG_ERROR(fuzz_logger, FUZZ_SEND_ERROR).arg(strerror(errno)); - continue; + if (sent > 0) { + LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_SEND).arg(sent); } else if (sent != length) { LOG_WARN(fuzz_logger, FUZZ_SHORT_SEND).arg(length).arg(sent); } else { - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE_DETAIL, FUZZ_SEND).arg(sent); + LOG_ERROR(fuzz_logger, FUZZ_SEND_ERROR).arg(strerror(errno)); } - - if (loop <= 0) { - // If this is the last loop iteration, close everything down. - // This is done before giving permission for the main thread - // to run to avoid a race condition. - *shutdown_ptr_ = true; - close(sockfd); - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE, FUZZ_SHUTDOWN_INITIATED); + } else { + // Read did not get any bytes. A zero-length read (EOF) may have been + // generated by AFL, so don't log that. But otherwise log an error. + if (length != 0) { + LOG_ERROR(fuzz_logger, FUZZ_READ_FAIL).arg(strerror(errnum)); } - - // Tell the main thread to run. - fuzz_sync_.notify(); - - // We now need to synchronize with the main thread. In particular, - // we suspend processing until we know that the processing of the - // packet by Kea has finished and that the completion function has - // raised a SIGSTOP. - main_sync_.wait(); } - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE, FUZZ_LOOP_EXIT); - - // If the main thread is waiting, let it terminate as well. - fuzz_sync_.notify(); - - running_ = false; - return; -} - -// Called by the main thread, this notifies AFL that processing for the -// last packet has finished. -void -Fuzz::packetProcessed(void) { - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE, FUZZ_PACKET_PROCESSED_CALLED); - - // Tell AFL that the processing for this packet has finished. - raise(SIGSTOP); - - // Tell the fuzzing loop that it can continue and wait until it tells - // us that the main thread can continue. - main_sync_.notify(); - fuzz_sync_.wait(); - - // If the fuzzing thread is shutting down, wait for it to terminate. - if (*shutdown_ptr_) { - // We shouldn't need to notify it to continue (the previous call in - // this method should have done that), but it does no harm to be sure. - main_sync_.notify(); - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE, FUZZ_THREAD_WAIT); - fuzzing_thread_.join(); - LOG_DEBUG(fuzz_logger, FUZZ_DBG_TRACE, FUZZ_THREAD_TERMINATED); - } } #endif // ENABLE_AFL diff --git a/src/lib/dhcpsrv/fuzz.h b/src/lib/dhcpsrv/fuzz.h index bdcbaf0a09..0c6fd93eaa 100644 --- a/src/lib/dhcpsrv/fuzz.h +++ b/src/lib/dhcpsrv/fuzz.h @@ -1,4 +1,4 @@ -// Copyright (C) 2016 Internet Systems Consortium, Inc. ("ISC") +// Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC") // // This Source Code Form is subject to the terms of the Mozilla Public // License, v. 2.0. If a copy of the MPL was not distributed with this @@ -22,112 +22,87 @@ #include <thread> namespace isc { + -/// @brief Helper class to manage synchronization between fuzzing threads +/// @brief AFL Fuzzing +/// +/// Persistent-mode AFL fuzzing has the AFL fuzzer send packets of data to +/// stdin of the program being tested. The program processes the data and +/// signals to AFL that it is complete. +/// +/// To reduce the code changes required, the scheme adopted for Kea is that +/// the AFL data read from stdin is written to an address/port on which Kea +/// is listening. Kea then reads the data from that port and processes it +/// in the usual way. /// -/// This contains the variables and encapsulates the primitives required -/// to manage the condition variables between the two threads. +/// The Fuzz class handles the transfer of data between AFL and Kea. After +/// suitable initialization, its transfer() method is called in the main +/// processing loop, right before Kea waits for input. The method handles the +/// read from stdin and the write to the selected address port. -class FuzzSync { +class Fuzz { public: - /// @brief Constructor - /// - /// Just set the name of the variable for debug message purposes. + /// @brief size of the buffer used to transfer data between AFL and Kea. /// - /// @param name The name of the object, output in debug messages. - FuzzSync(const char* name); + /// This is much larger than the data that will be sent to Kea (so AFL + /// data may be trimmed). However, it does allow for AFL to send quite + /// large packets without resulting in AFL synchronization problems because + /// Kea has not read all the data sent. + static constexpr size_t BUFFER_SIZE = 256 * 1024; - /// @brief Waits for condition notification - /// - /// Called by a thread, this function will wait for another thread to - /// notify it that it can proceed: in other words, this function calls - /// <condition_variable>.wait() and waits for the other to call - /// <condition_variable>.notify(). - /// - /// As it is possible to miss a notification - if one thread reaches the - /// notification point before the other thread reaches the wait point - - /// the operation is mediated by a predicate (in this case, a boolean - /// variable). If this is set when the waiting thread reaches the wait - /// point, the thread does not wait. If it is not set, the thread will - /// wait until it is notified through the condition variable. At this - /// point, if the variable is still not set, the thread will re-enter the - /// wait state. + /// @brief maximum size of packets fuzzing thread will send to Kea /// - /// In both cases, the predicate variable is cleared on exit. - void wait(void); + /// This is below the maximum size of data that we will allow Kea to put + /// into a single UDP datagram so as to avoid any "data too big" errors + /// when trying to send it to the port on which Kea lsutens. + static constexpr size_t MAX_SEND_SIZE = 64000; - /// @brief Notifies other thread to continue + /// @brief Number of packets Kea will process before shutting down. /// - /// Called by a thread, this function will notify another thread that is - /// waiting on the condition variable that it can continue. As noted - /// in the documentation for wait(), the operation is mediated by a - /// predicate variable; in this case, the variable is explicitly set - /// before the notification is sent. - void notify(void); - -private: - std::condition_variable cond_; - std::mutex mutex_; - volatile bool ready_; - std::string name_; -}; - - -/// @brief AFL Fuzzing Functions + /// After the shutdown, AFL will restart it. This safety switch is here for + /// eliminating cases where Kea goes into a weird state and stops + /// processing packets properly. This can be overridden by setting the + /// environment variable FUZZ_AFL_LOOP_MAX. + static constexpr long MAX_LOOP_COUNT = 1000; -class Fuzz { -public: - /// @brief Constructor - /// - /// Initializes member variables. - Fuzz(); /// @brief Constructor /// - /// Initializes fuzzing object and starts the fuzzing thread. + /// Sets up data structures to access the address/port being used to + /// transfer data from AFL to Kea. /// /// @param ipversion Either 4 or 6 depending on what IP version the /// server responds to. - /// @param shutdown Pointer to boolean flag that will be set to true to - /// trigger the shutdown procedure. - Fuzz(int ipversion, volatile bool* shutdown); + /// @param port Port on which the server is listening, and hence the + /// port to which the fuzzer will send input from AFL. + Fuzz(int ipversion, uint16_t port); /// @brief Destructor /// - /// Does some basic checks when going out of scope. The purpose of these - /// checks is to aid diagnosis in the event of problems with the fuzzing. + /// Closes the socket used for transferring data from stdin to the selected + /// interface. ~Fuzz(); - /// @brief Main Kea Fuzzing Function - /// - /// This is the main Kea fuzzing method. It is the entry point for the - /// thread that handles the interface between AFL and Kea. The method - /// receives data from the fuzzing engine via stdin, and then sends it to - /// the configured UDP socket. The main thread of Kea reads it from there, - /// processes it and when processing is complete, calls the - /// packetProcessed() method to notify the fuzzing thread that processing - /// of the packet is complete. + /// @brief Transfer Data /// - /// After a given number of packets, this method will set the flag shut - /// down Kea. This is recommended by the AFL documentation as it avoids - /// any resource leaks (which are not caught by AFL) from getting too large - /// and interfering with the fuzzing. AFL will automatically restart the - /// program to continue fuzzing. - void run(void); - - /// @brief Notify fuzzing thread that processing is complete + /// Called immediately prior to Kea reading data, this reads stdin (where + /// AFL will have sent the packet being tested) and copies the data to the + /// interface on which Kea is listening. + void transfer(void); + + /// @brief Return Max Loop Count /// - /// This function is called by the Kea processing loop running in the main - /// thread when it has finished processing a packet. It raises a SIGSTOP - /// signal, which tells the AFL fuzzer that processing for the data it has - /// just sent has finished; this causes it to send another fuzzed packet - /// to stdin. It also sets a condition variable, so releasing the fuzzing - /// thread to read the next data from AFL. + /// Returns the maximum number of loops (i.e. AFL packets processed) before + /// Kea exits. This is the value of the environment variable + /// FUZZ_AFL_LOOP_MAX, or the class constant MAX_LOOP_COUNT if that is not + /// defined. /// - /// If a shutdown has been initiated, this method waits for the fuzzing - /// thread to exit before allowing the shutdown to continue. - void packetProcessed(void); + /// @return Maximum loop count + long maxLoopCount() const { + return loop_max_; + } +private: /// @brief Populate address structures /// /// Decodes the environment variables used to pass address/port information @@ -140,48 +115,16 @@ public: /// format. void setAddress(int ipversion); - /// @brief size of the buffer used to transfer data between AFL and Kea. - /// - /// This is much larger than the data that will be sent to Kea (so AFL - /// data being trimmed). However, it does allow for AFL to send quite - /// large packets without resulting in timeouts or synchronization - /// problems with the fuzzing thread. - static constexpr size_t BUFFER_SIZE = 128000; - - /// @brief maximum size of packets fuzzing thread will send to Kea - /// - /// This is below the maximum size of data that can be put into a - /// single UDP datagram. - static constexpr size_t MAX_SEND_SIZE = 64000; - - /// @brief Delay before rereading if read from stdin returns an error (us) - static constexpr useconds_t SLEEP_INTERVAL = 50000; - - /// @brief Number of many packets Kea will process until shutting down. - /// - /// After the shutdown, AFL will restart it. This safety switch is here for - /// eliminating cases where Kea goes into a weird state and stops - /// processing packets properly. - static constexpr long LOOP_COUNT = 1000; - - // Condition/mutex variables. The fuzz_XX_ variables are set by the - // fuzzing thread and waited on by the main thread. The main_XX_ variables - // are set by the main thread and waited on by the fuzzing thread. - FuzzSync fuzz_sync_; // Set by fuzzing thread - FuzzSync main_sync_; // Set by main thread - // Other member variables. const char* address_; //< Pointer to address string - std::thread fuzzing_thread_;//< Holds the thread ID const char* interface_; //< Pointer to interface string long loop_max_; //< Maximum number of loop iterations uint16_t port_; //< Port number to use - volatile bool running_; //< Set if the thread is running - struct sockaddr* sockaddr_ptr_; //< Pointer to structure used size_t sockaddr_len_; //< Length of the structure + struct sockaddr* sockaddr_ptr_; //< Pointer to structure used struct sockaddr_in servaddr4_; //< IPv6 address information struct sockaddr_in6 servaddr6_; //< IPv6 address information - volatile bool* shutdown_ptr_; //< Pointer to shutdown flag + int sockfd_; //< Socket used to transfer data }; diff --git a/src/lib/dhcpsrv/fuzz_log.cc b/src/lib/dhcpsrv/fuzz_log.cc index e214aa0a2d..53b860a819 100644 --- a/src/lib/dhcpsrv/fuzz_log.cc +++ b/src/lib/dhcpsrv/fuzz_log.cc @@ -1,4 +1,4 @@ -// Copyright (C) 2015-2018 Internet Systems Consortium, Inc. ("ISC") +// Copyright (C) 2015-2019 Internet Systems Consortium, Inc. ("ISC") // // This Source Code Form is subject to the terms of the Mozilla Public // License, v. 2.0. If a copy of the MPL was not distributed with this diff --git a/src/lib/dhcpsrv/fuzz_log.h b/src/lib/dhcpsrv/fuzz_log.h index 89a3820d2d..3c0a627439 100644 --- a/src/lib/dhcpsrv/fuzz_log.h +++ b/src/lib/dhcpsrv/fuzz_log.h @@ -1,4 +1,4 @@ -// Copyright (C) 2015-2018 Internet Systems Consortium, Inc. ("ISC") +// Copyright (C) 2015-2019 Internet Systems Consortium, Inc. ("ISC") // // This Source Code Form is subject to the terms of the Mozilla Public // License, v. 2.0. If a copy of the MPL was not distributed with this diff --git a/src/lib/dhcpsrv/fuzz_messages.cc b/src/lib/dhcpsrv/fuzz_messages.cc index 65dfe4de2d..de3e115040 100644 --- a/src/lib/dhcpsrv/fuzz_messages.cc +++ b/src/lib/dhcpsrv/fuzz_messages.cc @@ -1,4 +1,4 @@ -// File created from ../../../src/lib/dhcpsrv/fuzz_messages.mes on Sun Jun 16 2019 18:13 +// File created from ../../../src/lib/dhcpsrv/fuzz_messages.mes on Mon Jul 01 2019 12:28 #include <cstddef> #include <log/message_types.h> @@ -10,23 +10,11 @@ namespace dhcp { extern const isc::log::MessageID FUZZ_DATA_READ = "FUZZ_DATA_READ"; extern const isc::log::MessageID FUZZ_INIT_COMPLETE = "FUZZ_INIT_COMPLETE"; extern const isc::log::MessageID FUZZ_INIT_FAIL = "FUZZ_INIT_FAIL"; -extern const isc::log::MessageID FUZZ_INTERFACE = "FUZZ_INTERFACE"; -extern const isc::log::MessageID FUZZ_LOOP_EXIT = "FUZZ_LOOP_EXIT"; -extern const isc::log::MessageID FUZZ_LOOP_MAX = "FUZZ_LOOP_MAX"; -extern const isc::log::MessageID FUZZ_PACKET_PROCESSED_CALLED = "FUZZ_PACKET_PROCESSED_CALLED"; extern const isc::log::MessageID FUZZ_READ_FAIL = "FUZZ_READ_FAIL"; extern const isc::log::MessageID FUZZ_SEND = "FUZZ_SEND"; extern const isc::log::MessageID FUZZ_SEND_ERROR = "FUZZ_SEND_ERROR"; -extern const isc::log::MessageID FUZZ_SET = "FUZZ_SET"; -extern const isc::log::MessageID FUZZ_SETTING = "FUZZ_SETTING"; extern const isc::log::MessageID FUZZ_SHORT_SEND = "FUZZ_SHORT_SEND"; -extern const isc::log::MessageID FUZZ_SHUTDOWN_INITIATED = "FUZZ_SHUTDOWN_INITIATED"; extern const isc::log::MessageID FUZZ_SOCKET_CREATE_FAIL = "FUZZ_SOCKET_CREATE_FAIL"; -extern const isc::log::MessageID FUZZ_THREAD_NOT_TERMINATED = "FUZZ_THREAD_NOT_TERMINATED"; -extern const isc::log::MessageID FUZZ_THREAD_TERMINATED = "FUZZ_THREAD_TERMINATED"; -extern const isc::log::MessageID FUZZ_THREAD_WAIT = "FUZZ_THREAD_WAIT"; -extern const isc::log::MessageID FUZZ_WAITED = "FUZZ_WAITED"; -extern const isc::log::MessageID FUZZ_WAITING = "FUZZ_WAITING"; } // namespace dhcp } // namespace isc @@ -37,23 +25,11 @@ const char* values[] = { "FUZZ_DATA_READ", "read %1 byte(s) from AFL via stdin", "FUZZ_INIT_COMPLETE", "fuzz initialization complete: interface %1, address %2, port %3, max loops %4", "FUZZ_INIT_FAIL", "fuzz initialization failure, reason: %1", - "FUZZ_INTERFACE", "fuzzing will use interface %1 (address %2, port %3)", - "FUZZ_LOOP_EXIT", "fuzzing loop has exited, shutting down Kea", - "FUZZ_LOOP_MAX", "fuzzing loop will run %1 time(s) before exiting", - "FUZZ_PACKET_PROCESSED_CALLED", "packetProcessed has been called", "FUZZ_READ_FAIL", "error reading input from fuzzer: %1", "FUZZ_SEND", "sent %1 byte(s) to the socket connected to the Kea interface", "FUZZ_SEND_ERROR", "failed to send data to Kea input socket: %1", - "FUZZ_SET", "successfully set %1 condition variable", - "FUZZ_SETTING", "setting %1 condition variable", "FUZZ_SHORT_SEND", "expected to send %d bytes to Kea input socket but only sent %2", - "FUZZ_SHUTDOWN_INITIATED", "shutdown initated, shutdown flag is set", "FUZZ_SOCKET_CREATE_FAIL", "failed to crease socket for use by fuzzing thread: %1", - "FUZZ_THREAD_NOT_TERMINATED", "fuzzing thread has not terminated", - "FUZZ_THREAD_TERMINATED", "fuzzing thread has terminated", - "FUZZ_THREAD_WAIT", "waiting for fuzzing thread to terminate", - "FUZZ_WAITED", "successfully waited for for %1 condition variable to be set", - "FUZZ_WAITING", "waiting for %1 condition variable to be set", NULL }; diff --git a/src/lib/dhcpsrv/fuzz_messages.h b/src/lib/dhcpsrv/fuzz_messages.h index 6dea5b1871..c1194aabdc 100644 --- a/src/lib/dhcpsrv/fuzz_messages.h +++ b/src/lib/dhcpsrv/fuzz_messages.h @@ -1,4 +1,4 @@ -// File created from ../../../src/lib/dhcpsrv/fuzz_messages.mes on Sun Jun 16 2019 18:13 +// File created from ../../../src/lib/dhcpsrv/fuzz_messages.mes on Mon Jul 01 2019 12:28 #ifndef FUZZ_MESSAGES_H #define FUZZ_MESSAGES_H @@ -11,23 +11,11 @@ namespace dhcp { extern const isc::log::MessageID FUZZ_DATA_READ; extern const isc::log::MessageID FUZZ_INIT_COMPLETE; extern const isc::log::MessageID FUZZ_INIT_FAIL; -extern const isc::log::MessageID FUZZ_INTERFACE; -extern const isc::log::MessageID FUZZ_LOOP_EXIT; -extern const isc::log::MessageID FUZZ_LOOP_MAX; -extern const isc::log::MessageID FUZZ_PACKET_PROCESSED_CALLED; extern const isc::log::MessageID FUZZ_READ_FAIL; extern const isc::log::MessageID FUZZ_SEND; extern const isc::log::MessageID FUZZ_SEND_ERROR; -extern const isc::log::MessageID FUZZ_SET; -extern const isc::log::MessageID FUZZ_SETTING; extern const isc::log::MessageID FUZZ_SHORT_SEND; -extern const isc::log::MessageID FUZZ_SHUTDOWN_INITIATED; extern const isc::log::MessageID FUZZ_SOCKET_CREATE_FAIL; -extern const isc::log::MessageID FUZZ_THREAD_NOT_TERMINATED; -extern const isc::log::MessageID FUZZ_THREAD_TERMINATED; -extern const isc::log::MessageID FUZZ_THREAD_WAIT; -extern const isc::log::MessageID FUZZ_WAITED; -extern const isc::log::MessageID FUZZ_WAITING; } // namespace dhcp } // namespace isc diff --git a/src/lib/dhcpsrv/fuzz_messages.mes b/src/lib/dhcpsrv/fuzz_messages.mes index 7e011f74f9..f4f43839a9 100644 --- a/src/lib/dhcpsrv/fuzz_messages.mes +++ b/src/lib/dhcpsrv/fuzz_messages.mes @@ -10,10 +10,6 @@ $NAMESPACE isc::dhcp A debug message output to indicate how much data has been received from the fuzzer via stdin -% FUZZ_INTERFACE fuzzing will use interface %1 (address %2, port %3) -An informational message output during fuzzing initialization, this reports -the details of the interface to be used for fuzzing. - % FUZZ_INIT_COMPLETE fuzz initialization complete: interface %1, address %2, port %3, max loops %4 An informational message output when the fuzzing initialization function has completed successfully. The parameters listed are those which must be/can be @@ -23,23 +19,6 @@ set via environment variables. An error message reported if the fuzzing initialization failed. The reason for the failure is given in the message. -% FUZZ_LOOP_EXIT fuzzing loop has exited, shutting down Kea -This debug message is output when Kea has processed the number of packets -given by the hard-coded variable Fuzz::LOOP_COUNT. Kea is shutting -itself down and will be restarted by AFL. This is recommended by the AFL -documentation as a way of avoiding issues if Kea gets itself into a funny -state after running for a long time. - -% FUZZ_LOOP_MAX fuzzing loop will run %1 time(s) before exiting -A debug message noting how many loops (i.e. packets from the fuzzer) the code -will process before Kea exits and the fuzzer restarts it. The hard-coded -value can be overridden by setting the environment variable FUZZ_AFL_LOOP_MAX. - -% FUZZ_PACKET_PROCESSED_CALLED packetProcessed has been called -A debug message indicating that the processing of a packet by Kea has -finished and that the Fuzz::packetProcessed() method has been called. This -raises a SIGSTOP informing AFL that Kea is ready to receive another packet. - % FUZZ_READ_FAIL error reading input from fuzzer: %1 This error is reported if the read of data from the fuzzer (which is received over stdin) fails, or if a read returns zero bytes. If this @@ -57,49 +36,14 @@ sends data received from AFL to the socket on which Kea is listening) fails. The reason for the failure is given in the message. The fuzzing code will attempt to continue from this, but it may cause the fuzzing process to fail. -% FUZZ_SET successfully set %1 condition variable -A debug message stating the named condition variable has been be set. - -% FUZZ_SETTING setting %1 condition variable -A debug message stating the named condition variable is to be set. - % FUZZ_SHORT_SEND expected to send %d bytes to Kea input socket but only sent %2 A warning message that is output if the sendto() call (used to send data from the fuzzing thread to the main Kea processing) did not send as much data as that read from AFL. This may indicate a problem in the underlying communications between the fuzzing thread and the main Kea processing. -% FUZZ_SHUTDOWN_INITIATED shutdown initated, shutdown flag is set -A debug message output when the fuzzing thread has reached the maximum number -of iterations. At this point, the shutdown flag is set, Kea will exit and -the fuzzer will restart it. Periodic shutdowns of the program being fuzzed -are recommended in the AFL documentation as a way of overcoming memory leaks -of odd conditions that a program can get into after an extended period of -running. - % FUZZ_SOCKET_CREATE_FAIL failed to crease socket for use by fuzzing thread: %1 An error message output when the fuzzing code has failed to create a socket through which is will copy data received on stdin from the AFL fuzzer to the port on which Kea is listening. The program will most likely hang if this occurs. - -% FUZZ_THREAD_NOT_TERMINATED fuzzing thread has not terminated -An error message output in the destructor of the fuzzing object should the -object go out of scope with the fuzzing thread running. This message is -for diagnosing problems in the fuzzing code. - -% FUZZ_THREAD_TERMINATED fuzzing thread has terminated -A debug message, output when the main thread has detected that the fuzzing -thread has terminated. - -% FUZZ_THREAD_WAIT waiting for fuzzing thread to terminate -A debug message, output when the main thread is waiting for the fuzzing thread -to terminate. - -% FUZZ_WAITED successfully waited for for %1 condition variable to be set -A debug message stating the the condition variable for which the originating -thread was waiting has been set and that the wait has completed. - -% FUZZ_WAITING waiting for %1 condition variable to be set -A debug message stating the condition variable for which the originating -thread is waiting. |