mbedtls/programs/fuzz
Gilles Peskine 9ec14f6dcb programs/fuzz: set sensible default CFLAGS
Running make from programs/fuzz didn't set any optimization flags (running
make from programs or from the root inherited the parent's optimization
flags). Default to -O2.

There were no -W flags. Default to -Wall -Wextra, but not -Werror in line
with the other makefiles.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-11-29 17:23:19 +01:00
..
corpuses
.gitignore pkcs7: provide fuzz harness 2022-09-01 19:45:41 -05:00
CMakeLists.txt pkcs7: provide fuzz harness 2022-09-01 19:45:41 -05:00
common.c Fix requirement mismatch in fuzz/common.c 2022-03-04 05:07:45 -05:00
common.h programs/fuzz: Use build_info.h in common.h 2022-03-04 05:07:45 -05:00
fuzz_client.c Removes MBEDTLS_SSL_TRUNCATED_HMAC code from fuzz programs 2021-06-16 16:19:53 +01:00
fuzz_client.options
fuzz_dtlsclient.c Add MBEDTLS_ALLOW_PRIVATE_ACCESS to test programs 2021-05-21 18:10:44 +02:00
fuzz_dtlsclient.options
fuzz_dtlsserver.c Fix SHA512 vs SHA384 dependencies 2022-10-19 08:35:09 -04:00
fuzz_dtlsserver.options
fuzz_pkcs7.c pkcs7: provide fuzz harness 2022-09-01 19:45:41 -05:00
fuzz_pkcs7.options pkcs7: provide fuzz harness 2022-09-01 19:45:41 -05:00
fuzz_privkey.c Fix fuzz_privkey build without MBEDTLS_ENTROPY_C defined 2022-08-08 13:56:13 +02:00
fuzz_privkey.options
fuzz_pubkey.c Add MBEDTLS_ALLOW_PRIVATE_ACCESS to test programs 2021-05-21 18:10:44 +02:00
fuzz_pubkey.options
fuzz_server.c Fix session tickets related build flags in fuzz_server and ssl_server2 2022-10-10 13:30:43 +02:00
fuzz_server.options
fuzz_x509crl.c Add MBEDTLS_ALLOW_PRIVATE_ACCESS to test programs 2021-05-21 18:10:44 +02:00
fuzz_x509crl.options
fuzz_x509crt.c Add MBEDTLS_ALLOW_PRIVATE_ACCESS to test programs 2021-05-21 18:10:44 +02:00
fuzz_x509crt.options
fuzz_x509csr.c Add MBEDTLS_ALLOW_PRIVATE_ACCESS to test programs 2021-05-21 18:10:44 +02:00
fuzz_x509csr.options
Makefile programs/fuzz: set sensible default CFLAGS 2022-11-29 17:23:19 +01:00
onefile.c Redo of PR#5345. Fixed spelling and typographical errors found by CodeSpell. 2022-05-11 21:25:51 +01:00
README.md Redo of PR#5345. Fixed spelling and typographical errors found by CodeSpell. 2022-05-11 21:25:51 +01:00

What is it?

This directory contains fuzz targets. Fuzz targets are simple codes using the library. They are used with a so-called fuzz driver, which will generate inputs, try to process them with the fuzz target, and alert in case of an unwanted behavior (such as a buffer overflow for instance).

These targets were meant to be used with oss-fuzz but can be used in other contexts.

This code was contributed by Philippe Antoine ( Catena cyber ).

How to run?

To run the fuzz targets like oss-fuzz:

git clone https://github.com/google/oss-fuzz
cd oss-fuzz
python infra/helper.py build_image mbedtls
python infra/helper.py build_fuzzers --sanitizer address mbedtls
python infra/helper.py run_fuzzer mbedtls fuzz_client

You can use undefined sanitizer as well as address sanitizer. And you can run any of the fuzz targets like fuzz_client.

To run the fuzz targets without oss-fuzz, you first need to install one libFuzzingEngine (libFuzzer for instance). Then you need to compile the code with the compiler flags of the wished sanitizer.

perl scripts/config.py set MBEDTLS_PLATFORM_TIME_ALT
mkdir build
cd build
cmake ..
make

Finally, you can run the targets like ./test/fuzz/fuzz_client.

Corpus generation for network traffic targets

These targets use network traffic as inputs :

  • client : simulates a client against (fuzzed) server traffic
  • server : simulates a server against (fuzzed) client traffic
  • dtls_client
  • dtls_server

They also use the last bytes as configuration options.

To generate corpus for these targets, you can do the following, not fully automated steps :

  • Build mbedtls programs ssl_server2 and ssl_client2
  • Run them one against the other with reproducible option turned on while capturing traffic into test.pcap
  • Extract tcp payloads, for instance with tshark : tshark -Tfields -e tcp.dstport -e tcp.payload -r test.pcap > test.txt
  • Run a dummy python script to output either client or server corpus file like python dummy.py test.txt > test.cor
  • Finally, you can add the options by appending the last bytes to the file test.cor

Here is an example of dummy.py for extracting payload from client to server (if we used tcp.dstport in tshark command)

import sys
import binascii

f = open(sys.argv[1])
for l in f.readlines():
    portAndPl=l.split()
    if len(portAndPl) == 2:
        # determine client or server based on port
        if portAndPl[0] == "4433":
            print(binascii.unhexlify(portAndPl[1].replace(":","")))