| 1 | # Fuzzing libslirp state and instructions
|
|---|
| 2 |
|
|---|
| 3 | ## Current state
|
|---|
| 4 | We chose to use libFuzzer because of its custom mutator feature, which allows to keep coherent informations inside the packets being sent to libslirp. This ease the process of fuzzing as packets are less likely to be rejected early during processing them.
|
|---|
| 5 |
|
|---|
| 6 | In the current state, the `meson.build` file is not compatible with the original one used by libSlirp main repository but it should be easy to merge them in a clean way. Also **in the current state, it seems that there is a memory leak inside the fuzzing code**, which make it run out of memory. The current goal is to find and get rid of this leak to allow fuzzing for longer without the process being interrupted because of it.
|
|---|
| 7 |
|
|---|
| 8 | Six harness are currently available, more are to be added later to focus on other parts of the code :
|
|---|
| 9 |
|
|---|
| 10 | - **fuzz-ip-header** : the mutator focuses on the ip header field informations,
|
|---|
| 11 | - **fuzz-udp** : the mutator only work on udp packets, mutating the udp header and content, or only one or the other (-h,-d),
|
|---|
| 12 | - **fuzz-tcp** : the mutator targets tcp packets, header+data or only one or the other, or only one or the other (-h,-d),
|
|---|
| 13 | - **fuzz-icmp** : the mutator focuses on icmp packets,
|
|---|
| 14 |
|
|---|
| 15 | These harness should be good starting examples on how to fuzz libslirp using libFuzzer.
|
|---|
| 16 |
|
|---|
| 17 | ## Running the fuzzer
|
|---|
| 18 |
|
|---|
| 19 | Building the fuzzers/harness requires the use of clang as libFuzzer is part of LLVM.
|
|---|
| 20 | You can build it running :
|
|---|
| 21 |
|
|---|
| 22 | `CC=clang meson build && ninja -C build`
|
|---|
| 23 |
|
|---|
| 24 | It will build the fuzzer in the ./build/fuzzing/ directory.
|
|---|
| 25 |
|
|---|
| 26 | A script named `fuzzing/coverage.py` is available to generate coverage informations. **It makes a lot of assumptions on the directory structure** and should be read before use.
|
|---|
| 27 |
|
|---|
| 28 | To run the fuzzer, simply run some of:
|
|---|
| 29 |
|
|---|
| 30 | - `build/fuzzing/fuzz-ip-header fuzzing/IN_ip-header`
|
|---|
| 31 | - `build/fuzzing/fuzz-udp fuzzing/IN_udp`
|
|---|
| 32 | - `build/fuzzing/fuzz-udp-h fuzzing/IN_udp-h`
|
|---|
| 33 | - `build/fuzzing/fuzz-tftp fuzzing/IN_tftp`
|
|---|
| 34 | - `build/fuzzing/fuzz-dhcp fuzzing/IN_dhcp`
|
|---|
| 35 | - `build/fuzzing/fuzz-icmp fuzzing/IN_icmp`
|
|---|
| 36 | - `build/fuzzing/fuzz-tcp fuzzing/IN_tcp`
|
|---|
| 37 |
|
|---|
| 38 | Your current directory should be a separate directory as crashes to it. New inputs found by the fuzzer will go directly in the `IN` folder.
|
|---|
| 39 |
|
|---|
| 40 | # Adding new files to the corpus
|
|---|
| 41 |
|
|---|
| 42 | In its current state, the fuzzing code is taking pcap files as input, we produced some using `tcpdump` on linux inside qemu with default settings.
|
|---|
| 43 | Those files should be captured using the `EN10MB (Ethernet)` data link type, this can be set with the flag `-y` but it seems this can't be done while listening on all interfaces (`-i any`).
|
|---|
| 44 | New files should give new coverage, to ensure a new file is usefull the `coverage.py` script (see next section) can be used to compare the coverage with and without that new file.
|
|---|
| 45 |
|
|---|
| 46 | # Coverage
|
|---|
| 47 |
|
|---|
| 48 | The `coverage.py` script allows to see coverage informations about the corpus. It makes a lot of assumptions on the directory structure so it should be read and probably modified before running it.
|
|---|
| 49 | It must be called with the protocol to cover: `python coverage.py udp report`.
|
|---|
| 50 | To generate coverage informations, the following flags are passed to the fuzzer and libslirp :
|
|---|
| 51 |
|
|---|
| 52 | - g
|
|---|
| 53 | - fsanitize-coverage=edge,indirect-calls,trace-cmp
|
|---|
| 54 | - fprofile-instr-generate
|
|---|
| 55 | - fcoverage-mapping
|
|---|
| 56 |
|
|---|
| 57 | The last 2 arguments should also be passed to the linker.
|
|---|
| 58 |
|
|---|
| 59 | Then the `llvm-profdata` and `llvm-cov` tools can be used to generate a report and a fancy set of HTML files with line-coverage informations.
|
|---|
