From c7bb83b1b33e43c915fef970fef3e05b263d2007 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Tue, 18 Nov 2014 20:15:13 -0500 Subject: [PATCH] [test suite] additional AFL support for client fwknoprc file and server fwknopd.conf file --- test/afl/fuzzing-wrappers/client-rc.sh | 22 +++++++++ test/afl/fuzzing-wrappers/fwknop-rc-test.sh | 3 ++ test/afl/fuzzing-wrappers/server-access.sh | 2 +- test/afl/fuzzing-wrappers/spa-pkts.sh | 2 +- test/afl/test-cases/client-rc/fwknoprc | 40 +++++++++++++++++ test/afl/test-cases/server-conf/fwknopd.conf | 47 ++++++++++++++++++++ 6 files changed, 114 insertions(+), 2 deletions(-) create mode 100755 test/afl/fuzzing-wrappers/client-rc.sh create mode 100755 test/afl/fuzzing-wrappers/fwknop-rc-test.sh create mode 100644 test/afl/test-cases/client-rc/fwknoprc create mode 100644 test/afl/test-cases/server-conf/fwknopd.conf diff --git a/test/afl/fuzzing-wrappers/client-rc.sh b/test/afl/fuzzing-wrappers/client-rc.sh new file mode 100755 index 00000000..1817e96e --- /dev/null +++ b/test/afl/fuzzing-wrappers/client-rc.sh @@ -0,0 +1,22 @@ +#!/bin/sh -x + +TOP_DIR="fuzzing-output" +FDIR="client-rc.out" +ARCHIVE_DIR="$TOP_DIR/archive" +OUT_DIR="$TOP_DIR/$FDIR" +IN_DIR="test-cases/client-rc" + +CLIENT="../../client/.libs/fwknop" +LIB_DIR="../../lib/.libs" + +[ ! -d $ARCHIVE_DIR ] && mkdir -p $ARCHIVE_DIR +TS=`date +"%m%d%y%H%M%S"` +[ -d $OUT_DIR ] && mv $OUT_DIR "$ARCHIVE_DIR/$FDIR-$TS" +mkdir $OUT_DIR + +### make sure the client can handle the rc file +./fuzzing-wrappers/fwknop-rc-test.sh || exit + +LD_LIBRARY_PATH=$LIB_DIR afl-fuzz -i $IN_DIR -o $OUT_DIR -f $OUT_DIR/fwknoprc $CLIENT --rc-file $OUT_DIR/fwknoprc + +exit diff --git a/test/afl/fuzzing-wrappers/fwknop-rc-test.sh b/test/afl/fuzzing-wrappers/fwknop-rc-test.sh new file mode 100755 index 00000000..3de9c685 --- /dev/null +++ b/test/afl/fuzzing-wrappers/fwknop-rc-test.sh @@ -0,0 +1,3 @@ +#!/bin/sh -x + +LD_LIBRARY_PATH=../../lib/.libs ../../client/.libs/fwknop --rc-file test-cases/client-rc/fwknoprc -T diff --git a/test/afl/fuzzing-wrappers/server-access.sh b/test/afl/fuzzing-wrappers/server-access.sh index 062f0fc8..a39f57ea 100755 --- a/test/afl/fuzzing-wrappers/server-access.sh +++ b/test/afl/fuzzing-wrappers/server-access.sh @@ -9,7 +9,7 @@ IN_DIR="test-cases/server-access" SERVER="../../server/.libs/fwknopd" LIB_DIR="../../lib/.libs" -[ ! -d $ARCHIVE_DIR ] && echo "[*] $ARCHIVE_DIR does not exist" && exit +[ ! -d $ARCHIVE_DIR ] && mkdir -p $ARCHIVE_DIR TS=`date +"%m%d%y%H%M%S"` [ -d $OUT_DIR ] && mv $OUT_DIR "$ARCHIVE_DIR/$FDIR-$TS" mkdir $OUT_DIR diff --git a/test/afl/fuzzing-wrappers/spa-pkts.sh b/test/afl/fuzzing-wrappers/spa-pkts.sh index 96d1df3e..2ef5f896 100755 --- a/test/afl/fuzzing-wrappers/spa-pkts.sh +++ b/test/afl/fuzzing-wrappers/spa-pkts.sh @@ -9,7 +9,7 @@ IN_DIR="test-cases/spa-pkts" SERVER="../../server/.libs/fwknopd" LIB_DIR="../../lib/.libs" -[ ! -d $ARCHIVE_DIR ] && echo "[*] $ARCHIVE_DIR does not exist" && exit +[ ! -d $ARCHIVE_DIR ] && mkdir -p $ARCHIVE_DIR TS=`date +"%m%d%y%H%M%S"` [ -d $OUT_DIR ] && mv $OUT_DIR "$ARCHIVE_DIR/$FDIR-$TS" mkdir $OUT_DIR diff --git a/test/afl/test-cases/client-rc/fwknoprc b/test/afl/test-cases/client-rc/fwknoprc new file mode 100644 index 00000000..d35e7bde --- /dev/null +++ b/test/afl/test-cases/client-rc/fwknoprc @@ -0,0 +1,40 @@ +[default] +ACCESS tcp/22 +SPA_SERVER 127.0.0.1 +ALLOW_IP 127.0.0.2 +USE_HMAC Y +HMAC_DIGEST_TYPE sha256 +KEY_BASE64 wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg= +HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg== +DIGEST_TYPE sha256 +SPA_SERVER_PROTO udp +SPA_SERVER_PORT 62201 +SPOOF_USER mbrtest +VERBOSE Y +RESOLVE_IP_HTTP N +TIME_OFFSET -1s +ENCRYPTION_MODE CBC +USE_GPG N +USE_GPG_AGENT N + +#RAND_PORT +#SPA_SOURCE_PORT +#FW_TIMEOUT +#GPG_RECIPIENT +#GPG_SIGNER +#GPG_HOMEDIR +#GPG_EXE +#GPG_SIGNING_PW +#GPG_SIGNING_PW_BASE64 +#GPG_NO_SIGNING_PW +#SPOOF_SOURCE_IP +#KEY +#HMAC_KEY +#KEY_FILE +#HMAC_KEY_FILE +#RESOLVE_URL +#NAT_ACCESS +#HTTP_USER_AGENT +#NAT_LOCAL +#NAT_RAND_PORT +#NAT_PORT diff --git a/test/afl/test-cases/server-conf/fwknopd.conf b/test/afl/test-cases/server-conf/fwknopd.conf new file mode 100644 index 00000000..f837fd8f --- /dev/null +++ b/test/afl/test-cases/server-conf/fwknopd.conf @@ -0,0 +1,47 @@ +CONFIG_FILE ../conf/default_fwknopd.conf +OVERRIDE_CONFIG ../conf/default_fwknopd.conf +PCAP_INTF eth0 +PCAP_FILE +ENABLE_PCAP_PROMISC N +PCAP_FILTER udp port 62201 +PCAP_DISPATCH_COUNT 100 +PCAP_LOOP_SLEEP 100000 +ENABLE_PCAP_ANY_DIRECTION +MAX_SNIFF_BYTES 1500 +ENABLE_SPA_PACKET_AGING Y +MAX_SPA_PACKET_AGE 120 +ENABLE_DIGEST_PERSISTENCE Y +CMD_EXEC_TIMEOUT +ENABLE_SPA_OVER_HTTP N +ENABLE_TCP_SERVER N +TCPSERV_PORT 62201 +ENABLE_UDP_SERVER N +UDPSERV_PORT 62201 +UDPSERV_SELECT_TIMEOUT 500000 +LOCALE +SYSLOG_IDENTITY fwknopd +SYSLOG_FACILITY LOG_DAEMON +ENABLE_IPT_FORWARDING N +ENABLE_IPT_LOCAL_NAT Y +ENABLE_IPT_SNAT N +SNAT_TRANSLATE_IP +ENABLE_IPT_OUTPUT N +FLUSH_IPT_AT_INIT Y +FLUSH_IPT_AT_EXIT Y +IPT_INPUT_ACCESS ACCEPT, filter, INPUT, 1, FWKNOP_INPUT, 1 +IPT_OUTPUT_ACCESS ACCEPT, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1 +IPT_FORWARD_ACCESS ACCEPT, filter, FORWARD, 1, FWKNOP_FORWARD, 1 +IPT_DNAT_ACCESS DNAT, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1 +IPT_SNAT_ACCESS SNAT, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1 +IPT_MASQUERADE_ACCESS MASQUERADE, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1 +ENABLE_IPT_COMMENT_CHECK Y +FWKNOP_RUN_DIR /var/run/fwknop +FWKNOP_CONF_DIR /etc/fwknop +ACCESS_FILE ../conf/default_access.conf +FWKNOP_PID_FILE /var/run/fwknop/fwknopd.pid +DIGEST_FILE /var/run/fwknop/digest.cache +GPG_HOME_DIR /root/.gnupg +GPG_EXE /usr/bin/gpg +FIREWALL_EXE /sbin/iptables +VERBOSE +FAULT_INJECTION_TAG