/src/net-snmp/testing/fuzzing/snmp_transport_fuzzer.c
Line | Count | Source |
1 | | /* |
2 | | * Copyright (c) 2021, Net-snmp authors |
3 | | * All rights reserved. |
4 | | * |
5 | | * Redistribution and use in source and binary forms, with or without |
6 | | * modification, are permitted provided that the following conditions are met: |
7 | | * |
8 | | * * Redistributions of source code must retain the above copyright notice, this |
9 | | * list of conditions and the following disclaimer. |
10 | | * |
11 | | * * Redistributions in binary form must reproduce the above copyright notice, |
12 | | * this list of conditions and the following disclaimer in the documentation |
13 | | * and/or other materials provided with the distribution. |
14 | | * |
15 | | * * Neither the name of the copyright holder nor the names of its |
16 | | * contributors may be used to endorse or promote products derived from |
17 | | * this software without specific prior written permission. |
18 | | * |
19 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
20 | | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
21 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
22 | | * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE |
23 | | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
24 | | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR |
25 | | * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
26 | | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, |
27 | | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
28 | | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
29 | | */ |
30 | | #include <net-snmp/net-snmp-config.h> |
31 | | #include <net-snmp/net-snmp-includes.h> |
32 | | #include "../../snmplib/transports/snmpIPBaseDomain.h" |
33 | | #include <net-snmp/library/snmpIPXDomain.h> |
34 | | #include <net-snmp/library/snmpUDPDomain.h> |
35 | | #include <net-snmp/library/snmpUDPIPv6Domain.h> |
36 | | #include <net-snmp/library/snmpUnixDomain.h> |
37 | | #include <stddef.h> |
38 | | #include <stdint.h> |
39 | | #include <stdlib.h> |
40 | | #include "ada_fuzz_header.h" |
41 | | |
42 | | int |
43 | | LLVMFuzzerInitialize(int *argc, char ***argv) |
44 | 31 | { |
45 | 31 | if (getenv("NETSNMP_DEBUGGING") != NULL) { |
46 | | /* |
47 | | * Turn on all debugging, to help understand what |
48 | | * bits of the parser are running. |
49 | | */ |
50 | 0 | snmp_enable_stderrlog(); |
51 | 0 | snmp_set_do_debugging(1); |
52 | 0 | debug_register_tokens(""); |
53 | 0 | } |
54 | 31 | return 0; |
55 | 31 | } |
56 | | |
57 | | int |
58 | | LLVMFuzzerTestOneInput(const uint8_t * data, size_t size) |
59 | 816 | { |
60 | | /* |
61 | | * Force the fuzzer to create larger strings as we use |
62 | | * a lot of the data. |
63 | | */ |
64 | 816 | if (size < 550) { |
65 | 19 | return 0; |
66 | 19 | } |
67 | 797 | af_gb_init(); |
68 | | |
69 | 797 | const uint8_t *data2 = data; |
70 | 797 | size_t size2 = size; |
71 | | |
72 | 797 | netsnmp_ds_set_string(NETSNMP_DS_LIBRARY_ID, NETSNMP_DS_LIB_APPTYPE, |
73 | 797 | "testprog"); |
74 | | |
75 | 797 | init_snmp_transport(); |
76 | 797 | netsnmp_tdomain_init(); |
77 | | |
78 | | /* |
79 | | * Main fuzzing logic |
80 | | */ |
81 | 797 | char *prefix = af_gb_get_null_terminated(&data2, &size2); |
82 | 797 | char *fmt_data = af_gb_get_null_terminated(&data2, &size2); |
83 | 797 | netsnmp_transport *t2 = NULL; |
84 | 797 | if (prefix && fmt_data) { |
85 | 797 | free(netsnmp_ipv6_fmtaddr(prefix, t2, fmt_data, strlen(fmt_data))); |
86 | | |
87 | 797 | struct sockaddr_in6 addr; |
88 | 797 | if (!netsnmp_sockaddr_in6(&addr, prefix, 5123)) |
89 | 24 | goto cleanup; |
90 | 797 | } |
91 | | |
92 | | /* |
93 | | * Security parsing routines. |
94 | | */ |
95 | 773 | char *udp6_token = af_gb_get_null_terminated(&data2, &size2); |
96 | 773 | char *udp6_param = af_gb_get_null_terminated(&data2, &size2); |
97 | 773 | if (udp6_token && udp6_param) { |
98 | 773 | netsnmp_udp6_parse_security(udp6_token, udp6_param); |
99 | 773 | } |
100 | | |
101 | 773 | char *udp_token = af_gb_get_null_terminated(&data2, &size2); |
102 | 773 | char *udp_param = af_gb_get_null_terminated(&data2, &size2); |
103 | 773 | if (udp_token && udp_param) { |
104 | 773 | netsnmp_udp_parse_security(udp_token, udp_param); |
105 | 773 | } |
106 | | |
107 | 773 | struct netsnmp_ep_str ep_str = { }; |
108 | 773 | char *endpoint = af_gb_get_null_terminated(&data2, &size2); |
109 | 773 | if (endpoint && !netsnmp_parse_ep_str(&ep_str, endpoint)) |
110 | 90 | goto cleanup; |
111 | | |
112 | 683 | char *unix_token = af_gb_get_null_terminated(&data2, &size2); |
113 | 683 | char *unix_param = af_gb_get_null_terminated(&data2, &size2); |
114 | 683 | if (unix_token && unix_param) { |
115 | 213 | netsnmp_unix_parse_security(unix_token, unix_param); |
116 | 213 | } |
117 | | |
118 | | /* |
119 | | * Cleanup |
120 | | */ |
121 | 683 | free(ep_str.addr); |
122 | 797 | cleanup: |
123 | 797 | netsnmp_clear_tdomain_list(); |
124 | 797 | shutdown_snmp_transport(); |
125 | | |
126 | 797 | af_gb_cleanup(); |
127 | 797 | return 0; |
128 | 683 | } |