1*62c56f98SSadaf EbrahimiWhat is it? 2*62c56f98SSadaf Ebrahimi------ 3*62c56f98SSadaf Ebrahimi 4*62c56f98SSadaf EbrahimiThis directory contains fuzz targets. 5*62c56f98SSadaf EbrahimiFuzz targets are simple codes using the library. 6*62c56f98SSadaf EbrahimiThey are used with a so-called fuzz driver, which will generate inputs, try to process them with the fuzz target, and alert in case of an unwanted behavior (such as a buffer overflow for instance). 7*62c56f98SSadaf Ebrahimi 8*62c56f98SSadaf EbrahimiThese targets were meant to be used with oss-fuzz but can be used in other contexts. 9*62c56f98SSadaf Ebrahimi 10*62c56f98SSadaf EbrahimiThis code was contributed by Philippe Antoine ( Catena cyber ). 11*62c56f98SSadaf Ebrahimi 12*62c56f98SSadaf EbrahimiHow to run? 13*62c56f98SSadaf Ebrahimi------ 14*62c56f98SSadaf Ebrahimi 15*62c56f98SSadaf EbrahimiTo run the fuzz targets like oss-fuzz: 16*62c56f98SSadaf Ebrahimi``` 17*62c56f98SSadaf Ebrahimigit clone https://github.com/google/oss-fuzz 18*62c56f98SSadaf Ebrahimicd oss-fuzz 19*62c56f98SSadaf Ebrahimipython infra/helper.py build_image mbedtls 20*62c56f98SSadaf Ebrahimipython infra/helper.py build_fuzzers --sanitizer address mbedtls 21*62c56f98SSadaf Ebrahimipython infra/helper.py run_fuzzer mbedtls fuzz_client 22*62c56f98SSadaf Ebrahimi``` 23*62c56f98SSadaf EbrahimiYou can use `undefined` sanitizer as well as `address` sanitizer. 24*62c56f98SSadaf EbrahimiAnd you can run any of the fuzz targets like `fuzz_client`. 25*62c56f98SSadaf Ebrahimi 26*62c56f98SSadaf EbrahimiTo run the fuzz targets without oss-fuzz, you first need to install one libFuzzingEngine (libFuzzer for instance). 27*62c56f98SSadaf EbrahimiThen you need to compile the code with the compiler flags of the wished sanitizer. 28*62c56f98SSadaf Ebrahimi``` 29*62c56f98SSadaf Ebrahimiperl scripts/config.py set MBEDTLS_PLATFORM_TIME_ALT 30*62c56f98SSadaf Ebrahimimkdir build 31*62c56f98SSadaf Ebrahimicd build 32*62c56f98SSadaf Ebrahimicmake .. 33*62c56f98SSadaf Ebrahimimake 34*62c56f98SSadaf Ebrahimi``` 35*62c56f98SSadaf EbrahimiFinally, you can run the targets like `./test/fuzz/fuzz_client`. 36*62c56f98SSadaf Ebrahimi 37*62c56f98SSadaf Ebrahimi 38*62c56f98SSadaf EbrahimiCorpus generation for network traffic targets 39*62c56f98SSadaf Ebrahimi------ 40*62c56f98SSadaf Ebrahimi 41*62c56f98SSadaf EbrahimiThese targets use network traffic as inputs : 42*62c56f98SSadaf Ebrahimi* client : simulates a client against (fuzzed) server traffic 43*62c56f98SSadaf Ebrahimi* server : simulates a server against (fuzzed) client traffic 44*62c56f98SSadaf Ebrahimi* dtls_client 45*62c56f98SSadaf Ebrahimi* dtls_server 46*62c56f98SSadaf Ebrahimi 47*62c56f98SSadaf EbrahimiThey also use the last bytes as configuration options. 48*62c56f98SSadaf Ebrahimi 49*62c56f98SSadaf EbrahimiTo generate corpus for these targets, you can do the following, not fully automated steps : 50*62c56f98SSadaf Ebrahimi* Build mbedtls programs ssl_server2 and ssl_client2 51*62c56f98SSadaf Ebrahimi* Run them one against the other with `reproducible` option turned on while capturing traffic into test.pcap 52*62c56f98SSadaf Ebrahimi* Extract tcp payloads, for instance with tshark : `tshark -Tfields -e tcp.dstport -e tcp.payload -r test.pcap > test.txt` 53*62c56f98SSadaf Ebrahimi* Run a dummy python script to output either client or server corpus file like `python dummy.py test.txt > test.cor` 54*62c56f98SSadaf Ebrahimi* Finally, you can add the options by appending the last bytes to the file test.cor 55*62c56f98SSadaf Ebrahimi 56*62c56f98SSadaf EbrahimiHere is an example of dummy.py for extracting payload from client to server (if we used `tcp.dstport` in tshark command) 57*62c56f98SSadaf Ebrahimi``` 58*62c56f98SSadaf Ebrahimiimport sys 59*62c56f98SSadaf Ebrahimiimport binascii 60*62c56f98SSadaf Ebrahimi 61*62c56f98SSadaf Ebrahimif = open(sys.argv[1]) 62*62c56f98SSadaf Ebrahimifor l in f.readlines(): 63*62c56f98SSadaf Ebrahimi portAndPl=l.split() 64*62c56f98SSadaf Ebrahimi if len(portAndPl) == 2: 65*62c56f98SSadaf Ebrahimi # determine client or server based on port 66*62c56f98SSadaf Ebrahimi if portAndPl[0] == "4433": 67*62c56f98SSadaf Ebrahimi print(binascii.unhexlify(portAndPl[1].replace(":",""))) 68*62c56f98SSadaf Ebrahimi``` 69