1 >From cc9b927f8f29d989ddb8415fe6508a538546abca Mon Sep 17 00:00:00 2001 2 From: Jacob Hoffman-Andrews <github@hoffman-andrews.com> 3 Date: Wed, 2 Jan 2019 22:52:51 -0800 4 Subject: [PATCH] Add unbound-fuzzme. 5 6 This is a small program that simply parses a packet provided on stdout, 7 for the purposes of fuzzing. 8 --- 9 .gitignore | 1 + 10 Makefile.in | 22 ++++++++++++++++++++-- 11 smallapp/unbound-fuzzme.c | 38 ++++++++++++++++++++++++++++++++++++++ 12 3 files changed, 59 insertions(+), 2 deletions(-) 13 create mode 100644 smallapp/unbound-fuzzme.c 14 15 diff --git a/.gitignore b/.gitignore 16 index f4527fd8..6163f905 100644 17 --- a/.gitignore 18 +++ b/.gitignore 19 @@ -24,6 +24,7 @@ 20 /unbound-checkconf 21 /unbound-control 22 /unbound-control-setup 23 +/unbound-fuzzme 24 /unbound-host 25 /unbound.h 26 /asynclook 27 diff --git a/Makefile.in b/Makefile.in 28 index af5b10f6..dacf1ab5 100644 29 --- a/Makefile.in 30 +++ b/Makefile.in 31 @@ -177,6 +177,10 @@ shm_main.lo remote.lo stats.lo unbound.lo \ 32 worker.lo @WIN_DAEMON_OBJ@ 33 DAEMON_OBJ_LINK=$(DAEMON_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \ 34 $(COMPAT_OBJ) @WIN_DAEMON_OBJ_LINK@ 35 +FUZZME_SRC=smallapp/unbound-fuzzme.c 36 +FUZZME_OBJ=unbound-fuzzme.lo 37 +FUZZME_OBJ_LINK=$(FUZZME_OBJ) worker_cb.lo $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \ 38 +$(COMPAT_OBJ) 39 CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c 40 CHECKCONF_OBJ=unbound-checkconf.lo worker_cb.lo 41 CHECKCONF_OBJ_LINK=$(CHECKCONF_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \ 42 @@ -252,6 +256,7 @@ RSRC_OBJ=rsrc_svcinst.o rsrc_svcuninst.o rsrc_anchorupd.o rsrc_unbound.o \ 43 rsrc_unbound_checkconf.o 44 45 ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \ 46 + $(FUZZME_SRC) \ 47 $(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) \ 48 $(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \ 49 $(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \ 50 @@ -259,6 +264,7 @@ ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \ 51 $(PYTHONMOD_SRC) $(PYUNBOUND_SRC) $(WIN_DAEMON_THE_SRC)\ 52 $(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC) $(SLDNS_SRC) 53 ALL_OBJ=$(COMMON_OBJ) $(UNITTEST_OBJ) $(DAEMON_OBJ) \ 54 + $(FUZZME_OBJ) \ 55 $(TESTBOUND_OBJ) $(LOCKVERIFY_OBJ) $(PKTVIEW_OBJ) \ 56 $(MEMSTATS_OBJ) $(CHECKCONF_OBJ) $(LIBUNBOUND_OBJ) $(HOST_OBJ) \ 57 $(ASYNCLOOK_OBJ) $(STREAMTCP_OBJ) $(PERF_OBJ) $(DELAYER_OBJ) \ 58 @@ -274,7 +280,7 @@ LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CPPFLAGS) $(CFL 59 60 all: $(COMMON_OBJ) $(ALLTARGET) 61 62 -alltargets: unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup $(WINAPPS) $(PYUNBOUND_TARGET) 63 +alltargets: unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup unbound-fuzzme$(EXEEXT) $(WINAPPS) $(PYUNBOUND_TARGET) 64 65 # compat with BSD make, register suffix, and an implicit rule to actualise it. 66 .SUFFIXES: .lo 67 @@ -325,6 +331,9 @@ libunbound.la: $(LIBUNBOUND_OBJ_LINK) 68 unbound$(EXEEXT): $(DAEMON_OBJ_LINK) libunbound.la 69 $(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) 70 71 +unbound-fuzzme$(EXEEXT): $(FUZZME_OBJ_LINK) libunbound.la 72 + $(LINK) -o $@ $(FUZZME_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) 73 + 74 unbound-checkconf$(EXEEXT): $(CHECKCONF_OBJ_LINK) libunbound.la 75 $(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) 76 77 @@ -447,7 +456,7 @@ util/configparser.c util/configparser.h: $(srcdir)/util/configparser.y 78 79 clean: 80 rm -f *.o *.d *.lo *~ tags 81 - rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h 82 + rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-fuzzme$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h 83 rm -f $(ALL_SRC:.c=.lint) 84 rm -f _unbound.la libunbound/python/libunbound_wrap.c libunbound/python/unbound.py pythonmod/interface.h pythonmod/unboundmodule.py 85 rm -rf autom4te.cache .libs build doc/html doc/xml 86 @@ -1183,6 +1192,15 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s 87 $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \ 88 $(srcdir)/util/rtt.h $(srcdir)/services/authzone.h $(srcdir)/validator/val_kcache.h \ 89 $(srcdir)/validator/val_neg.h 90 +unbound-fuzzme.lo unbound-fuzzme.o: $(srcdir)/smallapp/unbound-fuzzme.c \ 91 + $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \ 92 + $(srcdir)/daemon/remote.h $(srcdir)/util/config_file.h \ 93 + $(srcdir)/util/storage/slabhash.h $(srcdir)/util/storage/lruhash.h $(srcdir)/services/listen_dnsport.h \ 94 + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/services/cache/rrset.h \ 95 + $(srcdir)/util/data/packed_rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h \ 96 + $(srcdir)/util/rbtree.h $(srcdir)/util/rtt.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h \ 97 + $(srcdir)/util/module.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h \ 98 + $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/util/net_help.h $(srcdir)/util/ub_event.h 99 unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $(srcdir)/daemon/daemon.h \ 100 $(srcdir)/util/locks.h $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \ 101 $(srcdir)/daemon/remote.h \ 102 diff --git a/smallapp/unbound-fuzzme.c b/smallapp/unbound-fuzzme.c 103 new file mode 100644 104 index 00000000..74ae5204 105 --- /dev/null 106 +++ b/smallapp/unbound-fuzzme.c 107 @@ -0,0 +1,38 @@ 108 +/* 109 + * unbound-fuzzme.c - parse a packet provided on stdin (for fuzzing). 110 + * 111 + */ 112 +#include "config.h" 113 +#include "util/regional.h" 114 +#include "util/fptr_wlist.h" 115 +#include "sldns/sbuffer.h" 116 + 117 +#define SZ 10000 118 + 119 +int main() { 120 + char buffer[SZ]; 121 + size_t n_read = fread(buffer, 1, SZ, stdin); 122 + if (n_read == SZ) { 123 + printf("input too big\n"); 124 + return 1; 125 + } 126 + sldns_buffer *pkt = sldns_buffer_new(n_read); 127 + sldns_buffer_init_frm_data(pkt, buffer, n_read); 128 + 129 + struct regional *region = regional_create(); 130 + 131 + struct msg_parse* prs; 132 + struct edns_data edns; 133 + prs = (struct msg_parse*)malloc(sizeof(struct msg_parse)); 134 + if(!prs) { 135 + printf("out of memory on incoming message\n"); 136 + return 1; 137 + } 138 + memset(prs, 0, sizeof(*prs)); 139 + memset(&edns, 0, sizeof(edns)); 140 + sldns_buffer_set_position(pkt, 0); 141 + if(parse_packet(pkt, prs, region) != LDNS_RCODE_NOERROR) { 142 + printf("parse error\n"); 143 + return 1; 144 + } 145 +} 146 -- 147 2.17.1 148 149