diff --git a/test/afl/README b/test/afl/README deleted file mode 100644 index 6ba1c7f6..00000000 --- a/test/afl/README +++ /dev/null @@ -1,77 +0,0 @@ - -# Fuzzing fwknop With American Fuzzy Lop (AFL) - -## Quick Start - -To get going with AFL fuzzing against fwknop: - - $ ./compile/afl-compile.sh - $ ./fuzzing-wrappers/spa-pkts.sh - -Fuzzing results will be placed in fuzzing-output/server-conf.out/. For more -information, read on. - -## Introduction - -The fwknop project supports various fuzzing strategies, and one of the most -important is usage of the 'American Fuzzy Lop' (AFL) fuzzer written by Michal -Zalewski (see: [http://lcamtuf.coredump.cx/afl/]). Because AFL is not designed to -handle encryption schemes (see the README included in the AFL sources for more -information on this), a special --enable-afl-fuzzing command line switch is -available in the fwknop autoconf configure script. This argument allows -encryption and base64 encoding to be bypassed when feeding SPA packet data to -fwknopd via stdin. It is this feature that enables AFL fuzzing. One exception -to this is made when using AFL to fuzz the fwknoprc file that is leveraged by -the fwknop client - in this case, fwknop should not be compiled with ---enable-afl-fuzzing (use the compile/afl-compile-no-enable-arg.sh script). - -The top level directory contains enabling scripts in order to make it easy to -fuzz fwknop with AFL. It is assumed that AFL is installed and in your path. The -files are in this directory are organized as follows: - -fuzzing-wrappers/ - Directory that contains wrapper scripts for running AFL - against fwknop. All interaction with AFL should be done - with these scripts, and they should be executed from the - test/afl/ directory, e.g. "./fuzzing-wrappers/client-rc.sh" - -test-cases/ - Directory for ALF test cases used by the wrapper scripts. - There are four areas in fwknop that are fuzzed: SPA packet - encoding/decoding, server access.conf and fwknopd.conf - parsing, and client fwknoprc file parsing. - -compile/ - Directory for compilation scripts to ensure fwknop is - compiled underneath afl-gcc. - -fuzzing-output/ - Results directory that is made underneath an AFL fuzzing - cycle. - -Here is an example of what fwknopd produces when compiled for AFL support when -a dummy SPA packet is provided in non-encoded/encrypted form via fwknopd's -stdin: - - $ ./fuzzing-wrappers/helpers/fwknopd-stdin-test.sh - + SPA_PKT=1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA - + LD_LIBRARY_PATH=../../lib/.libs ../../server/.libs/fwknopd -c ../conf/default_fwknopd.conf -a ../conf/default_access.conf -A -f -t - + echo -n 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA - Warning: REQUIRE_SOURCE_ADDRESS not enabled for access stanza source: 'ANY' - SPA Field Values: - ================= - Random Value: 1716411011200157 - Username: root - Timestamp: 1397329899 - FKO Version: 2.0.1 - Message Type: 1 (Access msg) - Message String: 127.0.0.2,tcp/22 - Nat Access: - Server Auth: - Client Timeout: 0 - Digest Type: 3 (SHA256) - HMAC Type: 0 (None) - Encryption Type: 1 (Rijndael) - Encryption Mode: 2 (CBC) - Encoded Data: 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22 - SPA Data Digest: AAAAA - HMAC: - Final SPA Data: 200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA - - SPA packet decode: Success diff --git a/test/afl/README b/test/afl/README new file mode 120000 index 00000000..42061c01 --- /dev/null +++ b/test/afl/README @@ -0,0 +1 @@ +README.md \ No newline at end of file diff --git a/test/afl/README.md b/test/afl/README.md new file mode 100644 index 00000000..6ba1c7f6 --- /dev/null +++ b/test/afl/README.md @@ -0,0 +1,77 @@ + +# Fuzzing fwknop With American Fuzzy Lop (AFL) + +## Quick Start + +To get going with AFL fuzzing against fwknop: + + $ ./compile/afl-compile.sh + $ ./fuzzing-wrappers/spa-pkts.sh + +Fuzzing results will be placed in fuzzing-output/server-conf.out/. For more +information, read on. + +## Introduction + +The fwknop project supports various fuzzing strategies, and one of the most +important is usage of the 'American Fuzzy Lop' (AFL) fuzzer written by Michal +Zalewski (see: [http://lcamtuf.coredump.cx/afl/]). Because AFL is not designed to +handle encryption schemes (see the README included in the AFL sources for more +information on this), a special --enable-afl-fuzzing command line switch is +available in the fwknop autoconf configure script. This argument allows +encryption and base64 encoding to be bypassed when feeding SPA packet data to +fwknopd via stdin. It is this feature that enables AFL fuzzing. One exception +to this is made when using AFL to fuzz the fwknoprc file that is leveraged by +the fwknop client - in this case, fwknop should not be compiled with +--enable-afl-fuzzing (use the compile/afl-compile-no-enable-arg.sh script). + +The top level directory contains enabling scripts in order to make it easy to +fuzz fwknop with AFL. It is assumed that AFL is installed and in your path. The +files are in this directory are organized as follows: + +fuzzing-wrappers/ - Directory that contains wrapper scripts for running AFL + against fwknop. All interaction with AFL should be done + with these scripts, and they should be executed from the + test/afl/ directory, e.g. "./fuzzing-wrappers/client-rc.sh" + +test-cases/ - Directory for ALF test cases used by the wrapper scripts. + There are four areas in fwknop that are fuzzed: SPA packet + encoding/decoding, server access.conf and fwknopd.conf + parsing, and client fwknoprc file parsing. + +compile/ - Directory for compilation scripts to ensure fwknop is + compiled underneath afl-gcc. + +fuzzing-output/ - Results directory that is made underneath an AFL fuzzing + cycle. + +Here is an example of what fwknopd produces when compiled for AFL support when +a dummy SPA packet is provided in non-encoded/encrypted form via fwknopd's +stdin: + + $ ./fuzzing-wrappers/helpers/fwknopd-stdin-test.sh + + SPA_PKT=1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA + + LD_LIBRARY_PATH=../../lib/.libs ../../server/.libs/fwknopd -c ../conf/default_fwknopd.conf -a ../conf/default_access.conf -A -f -t + + echo -n 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA + Warning: REQUIRE_SOURCE_ADDRESS not enabled for access stanza source: 'ANY' + SPA Field Values: + ================= + Random Value: 1716411011200157 + Username: root + Timestamp: 1397329899 + FKO Version: 2.0.1 + Message Type: 1 (Access msg) + Message String: 127.0.0.2,tcp/22 + Nat Access: + Server Auth: + Client Timeout: 0 + Digest Type: 3 (SHA256) + HMAC Type: 0 (None) + Encryption Type: 1 (Rijndael) + Encryption Mode: 2 (CBC) + Encoded Data: 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22 + SPA Data Digest: AAAAA + HMAC: + Final SPA Data: 200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA + + SPA packet decode: Success