From 4c2622755d92efa1818d062d433725553437993c Mon Sep 17 00:00:00 2001 From: me-no-dev Date: Mon, 3 Apr 2017 16:50:12 +0300 Subject: [PATCH] Add AFL fuzz test --- components/mdns/include/mdns.h | 4 + components/mdns/mdns.c | 56 ++++-- components/mdns/test_afl_fuzz_host/Makefile | 35 ++++ components/mdns/test_afl_fuzz_host/README.md | 58 ++++++ .../mdns/test_afl_fuzz_host/esp32_compat.h | 129 ++++++++++++++ .../mdns/test_afl_fuzz_host/in/test-14.bin | Bin 0 -> 568 bytes .../mdns/test_afl_fuzz_host/in/test-15.bin | Bin 0 -> 524 bytes .../mdns/test_afl_fuzz_host/in/test-16.bin | Bin 0 -> 254 bytes .../mdns/test_afl_fuzz_host/in/test-28.bin | Bin 0 -> 62 bytes .../mdns/test_afl_fuzz_host/in/test-29.bin | Bin 0 -> 39 bytes .../mdns/test_afl_fuzz_host/in/test-31.bin | Bin 0 -> 91 bytes .../mdns/test_afl_fuzz_host/in/test-53.bin | Bin 0 -> 140 bytes .../mdns/test_afl_fuzz_host/in/test-56.bin | Bin 0 -> 262 bytes .../mdns/test_afl_fuzz_host/in/test-63.bin | Bin 0 -> 147 bytes .../mdns/test_afl_fuzz_host/in/test-83.bin | Bin 0 -> 105 bytes .../mdns/test_afl_fuzz_host/in/test-88.bin | Bin 0 -> 48 bytes .../mdns/test_afl_fuzz_host/in/test-89.bin | Bin 0 -> 459 bytes .../mdns/test_afl_fuzz_host/in/test-95.bin | Bin 0 -> 286 bytes .../mdns/test_afl_fuzz_host/in/test-96.bin | Bin 0 -> 319 bytes .../mdns/test_afl_fuzz_host/input_packets.txt | 166 ++++++++++++++++++ components/mdns/test_afl_fuzz_host/test.c | 113 ++++++++++++ 21 files changed, 542 insertions(+), 19 deletions(-) create mode 100644 components/mdns/test_afl_fuzz_host/Makefile create mode 100644 components/mdns/test_afl_fuzz_host/README.md create mode 100644 components/mdns/test_afl_fuzz_host/esp32_compat.h create mode 100755 components/mdns/test_afl_fuzz_host/in/test-14.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-15.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-16.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-28.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-29.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-31.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-53.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-56.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-63.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-83.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-88.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-89.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-95.bin create mode 100755 components/mdns/test_afl_fuzz_host/in/test-96.bin create mode 100644 components/mdns/test_afl_fuzz_host/input_packets.txt create mode 100644 components/mdns/test_afl_fuzz_host/test.c diff --git a/components/mdns/include/mdns.h b/components/mdns/include/mdns.h index 58e588e3e6..c0855466a7 100644 --- a/components/mdns/include/mdns.h +++ b/components/mdns/include/mdns.h @@ -18,7 +18,11 @@ extern "C" { #endif +#ifndef MDNS_TEST_MODE #include +#else +#include "esp32_compat.h" +#endif struct mdns_server_s; typedef struct mdns_server_s mdns_server_t; diff --git a/components/mdns/mdns.c b/components/mdns/mdns.c index 6467a55343..39cc018291 100644 --- a/components/mdns/mdns.c +++ b/components/mdns/mdns.c @@ -14,6 +14,7 @@ #include "mdns.h" #include +#ifndef MDNS_TEST_MODE #include "sdkconfig.h" #include "freertos/FreeRTOS.h" #include "freertos/queue.h" @@ -23,6 +24,7 @@ #include "lwip/igmp.h" #include "lwip/udp.h" #include "esp_wifi.h" +#endif #define MDNS_FLAGS_AUTHORITATIVE 0x8400 @@ -162,6 +164,9 @@ static const char * MDNS_DEFAULT_DOMAIN = "local"; static const char * MDNS_SUB_STR = "_sub"; static mdns_server_t * _mdns_servers[TCPIP_ADAPTER_IF_MAX] = {0,0,0}; + +#ifndef MDNS_TEST_MODE + static TaskHandle_t _mdns_service_task_handle = NULL; static QueueSetHandle_t _mdns_queue_set = NULL; @@ -257,6 +262,7 @@ esp_err_t _mdns_server_deinit(mdns_server_t * server) } return ESP_OK; } +#endif /** * @brief send packet over UDP @@ -269,25 +275,28 @@ esp_err_t _mdns_server_deinit(mdns_server_t * server) */ static size_t _mdns_server_write(mdns_server_t * server, uint8_t * data, size_t len) { - struct pbuf* pbt = pbuf_alloc(PBUF_TRANSPORT, len, PBUF_RAM); - if (pbt == NULL) { - return 0; - } - uint8_t* dst = (uint8_t *)pbt->payload; - memcpy(dst, data, len); - err_t err = udp_sendto(server->pcb, pbt, &(server->pcb->remote_ip), server->pcb->remote_port); - pbuf_free(pbt); - if (err) { - return 0; - } - return len; +#ifndef MDNS_TEST_MODE + struct pbuf* pbt = pbuf_alloc(PBUF_TRANSPORT, len, PBUF_RAM); + if (pbt == NULL) { + return 0; + } + uint8_t* dst = (uint8_t *)pbt->payload; + memcpy(dst, data, len); + err_t err = udp_sendto(server->pcb, pbt, &(server->pcb->remote_ip), server->pcb->remote_port); + pbuf_free(pbt); + if (err) { + return 0; + } +#endif + return len; } /* * MDNS Servers * */ -static void _mdns_parse_packet(mdns_server_t * server, const uint8_t * data, size_t len); +#ifndef MDNS_TEST_MODE +void mdns_parse_packet(mdns_server_t * server, const uint8_t * data, size_t len); /** * @brief the main MDNS service task. Packets are received and parsed here @@ -305,7 +314,7 @@ static void _mdns_service_task(void *pvParameters) mdns_server_t * server = _mdns_servers[i]; if (server && server->queue == queue) { MDNS_MUTEX_LOCK(); - _mdns_parse_packet(server, (uint8_t*)pb->payload, pb->len); + mdns_parse_packet(server, (uint8_t*)pb->payload, pb->len); MDNS_MUTEX_UNLOCK(); break; } @@ -314,6 +323,7 @@ static void _mdns_service_task(void *pvParameters) } } } +#endif /** * @brief get the server assigned to particular interface @@ -342,6 +352,7 @@ static mdns_server_t * _mdns_server_get(tcpip_adapter_if_t tcpip_if) */ static esp_err_t _mdns_server_add(mdns_server_t * server) { +#ifndef MDNS_TEST_MODE if (!_mdns_service_semaphore) { _mdns_service_semaphore = xSemaphoreCreateMutex(); if (!_mdns_service_semaphore) { @@ -374,7 +385,7 @@ static esp_err_t _mdns_server_add(mdns_server_t * server) if (err) { return err; } - +#endif _mdns_servers[server->tcpip_if] = server; return ESP_OK; @@ -392,7 +403,7 @@ static esp_err_t _mdns_server_add(mdns_server_t * server) static esp_err_t _mdns_server_remove(mdns_server_t * server) { _mdns_servers[server->tcpip_if] = NULL; - +#ifndef MDNS_TEST_MODE //stop UDP _mdns_server_deinit(server); @@ -417,7 +428,7 @@ static esp_err_t _mdns_server_remove(mdns_server_t * server) } MDNS_SERVICE_UNLOCK(); } - +#endif return ESP_OK; } @@ -1294,7 +1305,7 @@ static inline uint16_t _mdns_read_u16(const uint8_t * packet, uint16_t index) * @param data byte array holding the packet data * @param len length of the byte array */ -static void _mdns_parse_packet(mdns_server_t * server, const uint8_t * data, size_t len) +void mdns_parse_packet(mdns_server_t * server, const uint8_t * data, size_t len) { static mdns_name_t n; static mdns_result_temp_t a; @@ -1401,7 +1412,6 @@ static void _mdns_parse_packet(mdns_server_t * server, const uint8_t * data, siz const uint8_t * data_ptr = content + MDNS_DATA_OFFSET; content = data_ptr + data_len; - if(content > (data + len)){ return; } @@ -1410,18 +1420,22 @@ static void _mdns_parse_packet(mdns_server_t * server, const uint8_t * data, siz if (!_mdns_parse_fqdn(data, data_ptr, name)) { continue;//error } +#ifndef MDNS_TEST_MODE if (server->search.host[0] || (strcmp(name->service, server->search.service) != 0) || (strcmp(name->proto, server->search.proto) != 0)) { continue;//not searching for service or wrong service/proto } +#endif strlcpy(answer->instance, name->host, MDNS_NAME_BUF_LEN); } else if (type == MDNS_TYPE_SRV) { +#ifndef MDNS_TEST_MODE if (server->search.host[0] || (strcmp(name->service, server->search.service) != 0) || (strcmp(name->proto, server->search.proto) != 0)) { continue;//not searching for service or wrong service/proto } +#endif if (answer->instance[0]) { if (strcmp(answer->instance, name->host) != 0) { continue;//instance name is not the same as the one in the PTR record @@ -1468,9 +1482,11 @@ static void _mdns_parse_packet(mdns_server_t * server, const uint8_t * data, siz answer->txt[b] = 0; } else if (type == MDNS_TYPE_AAAA) { if (server->search.host[0]) { +#ifndef MDNS_TEST_MODE if (strcmp(name->host, server->search.host) != 0) { continue;//wrong host } +#endif } else if (!answer->ptr) { strlcpy(answer->host, name->host, MDNS_NAME_BUF_LEN); } else if (strcmp(answer->host, name->host) != 0) { @@ -1479,9 +1495,11 @@ static void _mdns_parse_packet(mdns_server_t * server, const uint8_t * data, siz memcpy(answer->addrv6, data_ptr, sizeof(ip6_addr_t)); } else if (type == MDNS_TYPE_A) { if (server->search.host[0]) { +#ifndef MDNS_TEST_MODE if (strcmp(name->host, server->search.host) != 0) { continue;//wrong host } +#endif } else if (!answer->ptr) { strlcpy(answer->host, name->host, MDNS_NAME_BUF_LEN); } else if (strcmp(answer->host, name->host) != 0) { diff --git a/components/mdns/test_afl_fuzz_host/Makefile b/components/mdns/test_afl_fuzz_host/Makefile new file mode 100644 index 0000000000..65a318ef24 --- /dev/null +++ b/components/mdns/test_afl_fuzz_host/Makefile @@ -0,0 +1,35 @@ +TEST_NAME=test +FUZZ=afl-fuzz +CC=afl-clang-fast +CPP=$(CC) +LD=$(CC) +OBJECTS=mdns.o test.o +CFLAGS=-DMDNS_TEST_MODE -I. -I../include + +OS := $(shell uname) +ifeq ($(OS),Darwin) + LDLIBS= +else + LDLIBS=-lbsd + CFLAGS+=-DUSE_BSD_STRING +endif + +all: $(TEST_NAME) + +%.o: %.c + @echo "[CC] $<" + @$(CC) $(CFLAGS) -c $< -o $@ + +mdns.o: ../mdns.c + @echo "[CC] $<" + @$(CC) $(CFLAGS) -c $< -o $@ + +$(TEST_NAME): $(OBJECTS) + @echo "[LD] $@" + @$(LD) $(LDLIBS) $(OBJECTS) -o $@ + +fuzz: $(TEST_NAME) + @$(FUZZ) -i "in" -o "out" -- ./$(TEST_NAME) + +clean: + @rm -rf *.o *.SYM $(TEST_NAME) out diff --git a/components/mdns/test_afl_fuzz_host/README.md b/components/mdns/test_afl_fuzz_host/README.md new file mode 100644 index 0000000000..7d78bab554 --- /dev/null +++ b/components/mdns/test_afl_fuzz_host/README.md @@ -0,0 +1,58 @@ +## Introduction +This test uses [american fuzzy lop](http://lcamtuf.coredump.cx/afl/) to mangle real mdns packets and look for exceptions caused by the parser. + +A few actuall packets are collected and exported as bins in the ```in``` folder, which is then passed as input to AFL when testing. The setup procedure for the test includes all possible services and scenarios that could be used with the given input packets. Output of the parser before fuzzing can be found in [input_packets.txt](input_packets.txt) + +## Installing AFL +To run the test yourself, you need to dounload the [latest afl archive](http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz) and extract it to a folder on your computer. + +The rest of the document will refer to that folder as ```PATH_TO_AFL```. + +### Preparation +- On Mac, you will need to insall the latest Xcode and llvm support from [Homebrew](https://brew.sh) + + ```bash + /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" + brew install --with-clang --with-lld --HEAD llvm + export PATH="/usr/local/opt/llvm/bin:$PATH" + ``` + +- On Ubuntu you need the following packages: + + ```bash + sudo apt-get install make clang llvm libbsd-dev + ``` + +### Compile AFL +Compiling AFL is as easy as running make: + +```bash +cd [PATH_TO_AFL] +make +cd llvm_mode/ +make +``` + +After successful compilation, you can export the following variables to your shell (you can also add them to your profile if you want to use afl in other projects) + +```bash +export AFL_PATH=[PATH_TO_AFL] +export PATH="$AFL_PATH:$PATH" +``` + +## Running the test +Apple has a crash reporting service that could interfere with AFLs normal operation. To turn that off, run the following command: + +```bash +launchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist +sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist +``` + +Ubuntu has a similar service. To turn that off, run as root: + +```bash +echo core >/proc/sys/kernel/core_pattern +``` + +After going through all of the requirements above, you can ```cd``` into this test's folder and simply run ```make fuzz```. + diff --git a/components/mdns/test_afl_fuzz_host/esp32_compat.h b/components/mdns/test_afl_fuzz_host/esp32_compat.h new file mode 100644 index 0000000000..d6a913a3c4 --- /dev/null +++ b/components/mdns/test_afl_fuzz_host/esp32_compat.h @@ -0,0 +1,129 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _ESP32_COMPAT_H_ +#define _ESP32_COMPAT_H_ + +#ifdef MDNS_TEST_MODE + +#ifdef USE_BSD_STRING +#include +#endif +#include +#include +#include +#include +#include +#include +#include + +#define ERR_OK 0 +#define ESP_OK 0 +#define ESP_FAIL -1 + +#define ESP_ERR_NO_MEM 0x101 +#define ESP_ERR_INVALID_ARG 0x102 +#define ESP_ERR_INVALID_STATE 0x103 +#define ESP_ERR_INVALID_SIZE 0x104 +#define ESP_ERR_NOT_FOUND 0x105 +#define ESP_ERR_NOT_SUPPORTED 0x106 +#define ESP_ERR_TIMEOUT 0x107 +#define ESP_ERR_INVALID_RESPONSE 0x108 +#define ESP_ERR_INVALID_CRC 0x109 + +#define pdTRUE true +#define pdFALSE false + +#define portMAX_DELAY 0xFFFFFFFF +#define portTICK_PERIOD_MS 1 + +#define xSemaphoreTake(s,d) +#define xSemaphoreGive(s) +#define xSemaphoreCreateMutex() malloc(1) +#define vSemaphoreDelete(s) free(s) +#define xQueueCreate(n,s) malloc((n)*(s)) +#define vQueueDelete(q) free(q) +#define xQueueReceive(q, d, t) (ESP_OK) +#define vTaskDelay(m) usleep((m)*1000) +#define pbuf_free(p) free(p) + +#define tcpip_adapter_get_ip_info(i,d) +#define tcpip_adapter_get_ip6_linklocal(i,d) (ESP_OK) +#define tcpip_adapter_get_hostname(i, n) *(n) = "esp32-0123456789AB" + +#define IP4_ADDR(ipaddr, a,b,c,d) \ + (ipaddr)->addr = ((uint32_t)((d) & 0xff) << 24) | \ + ((uint32_t)((c) & 0xff) << 16) | \ + ((uint32_t)((b) & 0xff) << 8) | \ + (uint32_t)((a) & 0xff) + +typedef uint32_t esp_err_t; + +typedef void * xSemaphoreHandle; +typedef void * xQueueHandle; + +typedef enum { + TCPIP_ADAPTER_IF_STA = 0, /**< ESP32 station interface */ + TCPIP_ADAPTER_IF_AP, /**< ESP32 soft-AP interface */ + TCPIP_ADAPTER_IF_ETH, /**< ESP32 ethernet interface */ + TCPIP_ADAPTER_IF_MAX +} tcpip_adapter_if_t; + +typedef enum { + WIFI_MODE_NULL = 0, /**< null mode */ + WIFI_MODE_STA, /**< WiFi station mode */ + WIFI_MODE_AP, /**< WiFi soft-AP mode */ + WIFI_MODE_APSTA, /**< WiFi station + soft-AP mode */ + WIFI_MODE_MAX +} wifi_mode_t; + +struct udp_pcb { + uint8_t dummy; +}; + +struct ip4_addr { + uint32_t addr; +}; +typedef struct ip4_addr ip4_addr_t; + +struct ip6_addr { + uint32_t addr[4]; +}; +typedef struct ip6_addr ip6_addr_t; + +typedef struct { + ip4_addr_t ip; + ip4_addr_t netmask; + ip4_addr_t gw; +} tcpip_adapter_ip_info_t; + +inline esp_err_t esp_wifi_get_mode(wifi_mode_t * mode) +{ + *mode = WIFI_MODE_APSTA; + return ESP_OK; +} + +inline uint32_t xTaskGetTickCount() +{ + struct timeval tv; + struct timezone tz; + if (gettimeofday(&tv, &tz) == 0) { + return (tv.tv_sec * 1000) + (tv.tv_usec / 1000); + } + return 0; +} + +#endif //MDNS_TEST_MODE + +#endif //_ESP32_COMPAT_H_ diff --git a/components/mdns/test_afl_fuzz_host/in/test-14.bin b/components/mdns/test_afl_fuzz_host/in/test-14.bin new file mode 100755 index 0000000000000000000000000000000000000000..b9d059d8202682602e7232a8505c495a3047e3a4 GIT binary patch literal 568 zcmaiwPfNov7{)Vc-GqW7j)|wjsGcf~S~hRiF&W~a2k#+k0~WgWB}sAnMEe#aev*0f zYnYmKpg5L8@;*Gj_g@gw=M=T;r$cDQq2$scG66d;6PhFBpq5SEqy*Ki;|>9y6_W8k z(juaoD$gKwot!QVViQiwP4*$FL_!N=w2csr$^a@cZR*xs(X_FMHk)!f+~gb+NOM1> zk_yQgof*O+&`j$PkuwH9@N&MeNR@)Rs7LhfhXIZT<8b&C;fD#&geg za3+LG&Fd@xs>KLTNcn;-*5pXh{6Hl3Gf@0Bv?l!J7wTd;niT zpQFAGPvJB)ejMCnH#5JT{b&BO0M9^cBj1M?YNV6sL|5fVbt9Ej+lyF*S{proq+$Y_ zy(EZB<0$aQ0F|dTfW0^Pc%S>15?e0gf=P$9ZRU2E6gBl1yUeqg)y}c?t9peygs&#} z7|j&Zdeo=X8zO0VLkn$-((43yUL=X?$Ick}!j;^kSawken}R!yj@dNbnpQ!IPSfSw z6t(+@>poibXblSGtk>cz>tEHauqc}6a-MwrlizE$|MzI+T(JBX1>O+*nyq$)j zQylnX9d7k~Ow=qiw8BP1a9+~%qG`nQ)xD8Uv1!|NXD5mA#_QH@&$~uSCEPYe#h+j? zazWa{-WhziU)BS1Dn2W)3#)mrXUl8}NBQ(&0aZF-|Mg&HNV7tR6XMi3VDD9S7@$yYB{2+7P%Rd7x$C@#%O<%mzrEGoz^Dq)E)NiJZ`$xlwq zVPFtw0BRAO!mwg_d7`hQt+|1&xv{RZldhAAuCt}Cld(<_s<4x;fr+lGIY`(DNi{^+ z0x0a4YnzvpS*%-zV0U=oA+vm)V+|Sr{1T8R{fu1*g~=8yw(a(1*I26Ub&|U}#`) F005APLjnK* literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-28.bin b/components/mdns/test_afl_fuzz_host/in/test-28.bin new file mode 100755 index 0000000000000000000000000000000000000000..537352ae67db92f820ff0d1299dae3534eef1f48 GIT binary patch literal 62 zcmZQz00Kr3!N4HuQIuI+lCNH@5R#djs^FYhP+Xdm${nAWR*+woT2zu;z!DE6Sab4| L6LT0C6dM=;y^9dW literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-29.bin b/components/mdns/test_afl_fuzz_host/in/test-29.bin new file mode 100755 index 0000000000000000000000000000000000000000..837737b32e12e3f33ff3f1c3b59f6ff351b05fba GIT binary patch literal 39 qcmZQz00Jfu!N9XCLm_y%+1WpOe@MPsbbB^PfpBXV328G1WHse2>fdR(m)`h7xI6{k-wY= bco-O=ax4c{{1X83^`U$YAe+U3fq?@6q#+cG literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-53.bin b/components/mdns/test_afl_fuzz_host/in/test-53.bin new file mode 100755 index 0000000000000000000000000000000000000000..73181ea8c378d33efed725aa209387113edffdd3 GIT binary patch literal 140 zcmZQz00Jf;1Ok@$;@l*b_>$xT)|~w0#2f|&9tKA7;QX}A%0ykyvc$anvczIt-^666 z{QT?#VhoH7j0bo?Y8V)}zcR>5K~yS0RX%E%S*!q4%mY{WjX^@xqbReuBwxK)AtW<5 PRlzy2ptv+A^#Bh5gdisG literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-56.bin b/components/mdns/test_afl_fuzz_host/in/test-56.bin new file mode 100755 index 0000000000000000000000000000000000000000..980b6516a20908c4b681b1cf3717c7ef35f062b6 GIT binary patch literal 262 zcmZQzXkh>XCLm@L_9)6MF3Eq?Ftb>}H!)cuH#0AjCq5;$EHgP(H#09SpC!H|xqvk% zKRGdnfkA+Qk%2*Q3WJP5ZhlH?jxA6JNQ0S<5m$b3MOkW5v8|yQOMG!|(g9rt9;jk5 zY<3)oKTyCR&;T)xkpak21aTND7=%D>W8BLLGB~X$v!v>P(SfB5GEiB8e+?jc1_lwm xkpDZ5{N)77F+$~74y^bm05nM-YAh#^&C0;gz~BH>1QrAu&jDn!I5049006}!N5=pF literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-63.bin b/components/mdns/test_afl_fuzz_host/in/test-63.bin new file mode 100755 index 0000000000000000000000000000000000000000..883d444ba269c8938aa87f3ba8da53a1305f9763 GIT binary patch literal 147 zcmZQz00Jf;1Oo2(#I%C^vecrIAisgkVmtU4x ztm~VY?3ACMeL$9hk%9354@eEr1V;v0DTqo1sLDqTGm8~qig}O}N{D(CWfqs@s~0PT SWag$SI42eqm*%7%-~j;3q9}|2 literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-83.bin b/components/mdns/test_afl_fuzz_host/in/test-83.bin new file mode 100755 index 0000000000000000000000000000000000000000..c6cc159a2597bc35b4316a796af18534bfee7dc3 GIT binary patch literal 105 zcmZQzXkh>XMj&Pq56(}^tW4DPEKAJGFH0=e^-WB6%FoYc&B;$r%mFHD04b|rU^%ej opU43o1{o+{;9mn!90-_XHvj*(sc11!P9G}A0c5i{Ffecc09-p6=Kufz literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-88.bin b/components/mdns/test_afl_fuzz_host/in/test-88.bin new file mode 100755 index 0000000000000000000000000000000000000000..fcbb384438a28961526215b8b66e32193b6fd0e8 GIT binary patch literal 48 xcmZQz00Jfu!N9;0UzC=_5?_*Bz?zevoS4JFz{9}E5ucb@RFGd(azGHo1pvO@39SGC literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-89.bin b/components/mdns/test_afl_fuzz_host/in/test-89.bin new file mode 100755 index 0000000000000000000000000000000000000000..d60a987cad92fe5e9e86e83ea8d2ee16f7fe93e2 GIT binary patch literal 459 zcmZut!AiqG6nsjH6?&*>t%!$uQZQS0laj>4LYts?QG|-ulBSVH(x&XjT5mmg=~3_> ztY`gzT*ZHizSvY0e6Z}id9$-S3-AC~%eYnwZO0eGP(-mV!P{&eAgrX;5v-UP|9p7oBgos1w8f0EOdo2ePiw} zNje}4^KDp~;Po(uTs%uyd;q1i$LGwR@0_zHHz+YQVq3(j6Z?o*nj-$v7NK==Y^1dM zOFgGeq|f_&(D5aSJQ-nY_c&vUuzMxFc@pCZ#o|bZ%N*uF-f3J6VQOGQliZLVkQEZ||>|XE&P_Qhxn0o}&II^Gj0M Z$Nq4kL7Zy<6!6?PhySpOI1ey^#uu&jeZK$z literal 0 HcmV?d00001 diff --git a/components/mdns/test_afl_fuzz_host/in/test-95.bin b/components/mdns/test_afl_fuzz_host/in/test-95.bin new file mode 100755 index 0000000000000000000000000000000000000000..26553090fa6d7cddb5fb7c748fc72d8d20c77364 GIT binary patch literal 286 zcmZQz00L$PHW0-fpO{vVUzS=_l3c(N4XCLm@O^(e|LF3DFfRtU+=O;vDCEGRC`N#%)8NiEAvPSwrKOUq}8FG((7 z&B;$r%wb>1yv^6)dGB>tzcCvCZv2wPwax&IQObK(dHK;H&FfedS$u_cu z^DV$~ezs8iK?*}{O-<7hlaefwbQ8^tlXOi@Obm4`EzC`H%~Dg6Obtv@lZ*`#fi^3G pY-XrnkOhSV1E&Zi7>ad4{?UaRc)$dxP#@| +#include +#include +#include +#include + +#include "mdns.h" + +void mdns_parse_packet(mdns_server_t * server, const uint8_t * data, size_t len); + +int main(int argc, char** argv) +{ + const char * mdns_hostname = "minifritz"; + const char * mdns_instance = "Hristo's Time Capsule"; + const char * arduTxtData[4] = { + "board=esp32", + "tcp_check=no", + "ssh_upload=no", + "auth_upload=no" + }; + const uint8_t mac[6] = {0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x32}; + + mdns_server_t * mdns = NULL; + uint8_t buf[1460]; + char winstance[21+strlen(mdns_hostname)]; + + sprintf(winstance, "%s [%02x:%02x:%02x:%02x:%02x:%02x]", mdns_hostname, mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); + + if (mdns_init(TCPIP_ADAPTER_IF_ETH, &mdns)) { + abort(); + } + + if (mdns_set_hostname(mdns, mdns_hostname)) { + abort(); + } + + if (mdns_set_instance(mdns, mdns_instance)) { + abort(); + } + + if (mdns_service_add(mdns, "_workstation", "_tcp", 9)) { + abort(); + } + + if (mdns_service_instance_set(mdns, "_workstation", "_tcp", winstance)) { + abort(); + } + + if (mdns_service_add(mdns, "_arduino", "_tcp", 3232)) { + abort(); + } + + if (mdns_service_txt_set(mdns, "_arduino", "_tcp", 4, arduTxtData)) { + abort(); + } + + if (mdns_service_add(mdns, "_http", "_tcp", 80)) { + abort(); + } + + if (mdns_service_instance_set(mdns, "_http", "_tcp", "ESP WebServer")) { + abort(); + } + + if ( + mdns_service_add(mdns, "_afpovertcp", "_tcp", 548) + || mdns_service_add(mdns, "_rfb", "_tcp", 885) + || mdns_service_add(mdns, "_smb", "_tcp", 885) + || mdns_service_add(mdns, "_adisk", "_tcp", 885) + || mdns_service_add(mdns, "_airport", "_tcp", 885) + || mdns_service_add(mdns, "_printer", "_tcp", 885) + || mdns_service_add(mdns, "_airplay", "_tcp", 885) + || mdns_service_add(mdns, "_raop", "_tcp", 885) + || mdns_service_add(mdns, "_uscan", "_tcp", 885) + || mdns_service_add(mdns, "_uscans", "_tcp", 885) + || mdns_service_add(mdns, "_ippusb", "_tcp", 885) + || mdns_service_add(mdns, "_scanner", "_tcp", 885) + || mdns_service_add(mdns, "_ipp", "_tcp", 885) + || mdns_service_add(mdns, "_ipps", "_tcp", 885) + || mdns_service_add(mdns, "_pdl-datastream", "_tcp", 885) + || mdns_service_add(mdns, "_ptp", "_tcp", 885) + || mdns_service_add(mdns, "_sleep-proxy", "_udp", 885)) + { + abort(); + } + + while (__AFL_LOOP(1000)) { + memset(buf, 0, 1460); + size_t len = read(0, buf, 1460); + mdns_query(mdns, "_afpovertcp", "_tcp", 0); + mdns_parse_packet(mdns, buf, len); + mdns_query_end(mdns); + } + return 0; +} + +#endif -- 2.40.0