1*10465441SEvalZero 2*10465441SEvalZeroFuzzing the lwIP stack (afl-fuzz requires linux/unix or similar) 3*10465441SEvalZero 4*10465441SEvalZeroThis directory contains a small app that reads Ethernet frames from stdin and 5*10465441SEvalZeroprocesses them. It is used together with the 'american fuzzy lop' tool (found 6*10465441SEvalZeroat http://lcamtuf.coredump.cx/afl/) and the sample inputs to test how 7*10465441SEvalZerounexpected inputs are handled. The afl tool will read the known inputs, and 8*10465441SEvalZerotry to modify them to exercise as many code paths as possible, by instrumenting 9*10465441SEvalZerothe code and keeping track of which code is executed. 10*10465441SEvalZero 11*10465441SEvalZeroJust running make will produce the test program. 12*10465441SEvalZero 13*10465441SEvalZeroRunning make with parameter 'D=-DLWIP_FUZZ_MULTI_PACKET' will produce a binary 14*10465441SEvalZerothat parses the input data as multiple packets (experimental!). 15*10465441SEvalZero 16*10465441SEvalZeroThen run afl with: 17*10465441SEvalZero 18*10465441SEvalZeroafl-fuzz -i inputs/<INPUT> -o output ./lwip_fuzz 19*10465441SEvalZero 20*10465441SEvalZeroand it should start working. It will probably complain about CPU scheduler, 21*10465441SEvalZeroset AFL_SKIP_CPUFREQ=1 to ignore it. 22*10465441SEvalZeroIf it complains about invalid "/proc/sys/kernel/core_pattern" setting, try 23*10465441SEvalZeroexecuting "sudo bash -c 'echo core > /proc/sys/kernel/core_pattern'". 24*10465441SEvalZero 25*10465441SEvalZeroThe input is split into different subdirectories since they test different 26*10465441SEvalZeroparts of the code, and since you want to run one instance of afl-fuzz on each 27*10465441SEvalZerocore. 28*10465441SEvalZero 29*10465441SEvalZeroWhen afl finds a crash or a hang, the input that caused it will be placed in 30*10465441SEvalZerothe output directory. If you have hexdump and text2pcap tools installed, 31*10465441SEvalZerorunning output_to_pcap.sh <outputdir> will create pcap files for each input 32*10465441SEvalZerofile to simplify viewing in wireshark. 33*10465441SEvalZero 34*10465441SEvalZeroThe lwipopts.h file needs to have checksum checking off, otherwise almost every 35*10465441SEvalZeropacket will be discarded because of that. The other options can be tuned to 36*10465441SEvalZeroexpose different parts of the code. 37*10465441SEvalZero 38