mirror of
https://github.com/soypat/lneto.git
synced 2026-08-17 05:13:27 +00:00
Add fuzz tests, rename fuzz tests and fix panic found by fuzzing (#72)
* begin adding better fuzz test * finish adding working fuzzer * implement mutateipv4 * fuzzer finds a panic in ICMP client on receive empty payload * rename fuzz tests to reflect fuzz methodology
This commit is contained in:
Pat Whittingslow
GitHub
@@ -5,11 +5,13 @@ import (
|
||||
"math/rand"
|
||||
|
||||
"github.com/soypat/lneto"
|
||||
"github.com/soypat/lneto/arp"
|
||||
"github.com/soypat/lneto/ethernet"
|
||||
"github.com/soypat/lneto/internal"
|
||||
"github.com/soypat/lneto/ipv4"
|
||||
"github.com/soypat/lneto/ipv4/icmpv4"
|
||||
"github.com/soypat/lneto/tcp"
|
||||
"github.com/soypat/lneto/udp"
|
||||
)
|
||||
|
||||
const (
|
||||
@@ -231,3 +233,418 @@ func (gen *PacketGen) AppendIPv4ICMPEcho(dst []byte, cfg ICMPEchoConfig) []byte
|
||||
func sizeWord(l int) uint8 {
|
||||
return uint8((l + 3) / 4)
|
||||
}
|
||||
|
||||
// PacketMut mutates existing packet bytes in-place for fuzz testing.
|
||||
// All Mutate methods use bitmapMut to select which fields to mutate:
|
||||
// each candidate field consumes 1 bit from LSB. Bit=1 means mutate using seed.
|
||||
// Addresses and ports are never mutated. CRCs are recomputed after mutation.
|
||||
// Methods return remaining seed and bitmapMut for chaining across layers.
|
||||
type PacketMut struct{}
|
||||
|
||||
// MutateEthernet mutates an Ethernet+IPv4+transport packet top-to-bottom.
|
||||
// Dispatches to [PacketMut.MutateIPv4] for the IP layer and transport.
|
||||
func (pm PacketMut) MutateEthernet(pkt []byte, seed, bitmapMut int64) int {
|
||||
efrm, err := ethernet.NewFrame(pkt)
|
||||
if err != nil {
|
||||
return 0
|
||||
}
|
||||
fields := 0
|
||||
etype := efrm.EtherTypeOrSize()
|
||||
seed, bitmapMut = mutate16(seed, bitmapMut, func(v uint16) { efrm.SetEtherType(ethernet.Type(v)) }, uint16(etype))
|
||||
fields++
|
||||
var n int
|
||||
switch etype {
|
||||
case ethernet.TypeIPv4:
|
||||
n, _, _ = pm.MutateIPv4(efrm.Payload(), seed, bitmapMut)
|
||||
case ethernet.TypeARP:
|
||||
n, _, _ = pm.MutateARP(efrm.Payload(), seed, bitmapMut)
|
||||
}
|
||||
return fields + n
|
||||
}
|
||||
|
||||
// MutateIPv4 mutates IPv4 header fields (IHL, ToS, TotalLength, TTL, Protocol)
|
||||
// and optionally injects IP options, fixes IP CRC, then dispatches to the
|
||||
// appropriate transport mutator.
|
||||
func (pm PacketMut) MutateIPv4(ipBuf []byte, seed, bitmapMut int64) (fields int, seedOut, bitmapOut int64) {
|
||||
ifrm, err := ipv4.NewFrame(ipBuf)
|
||||
if err != nil {
|
||||
return 0, seed, bitmapMut
|
||||
}
|
||||
v, ihl := ifrm.VersionAndIHL()
|
||||
if v != 4 || ihl < 5 {
|
||||
return 0, seed, bitmapMut
|
||||
}
|
||||
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { ifrm.SetVersionAndIHL(4, v&0xf) }, ihl)
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { ifrm.SetToS(ipv4.ToS(v)) }, uint8(ifrm.ToS()))
|
||||
seed, bitmapMut = mutate16(seed, bitmapMut, ifrm.SetTotalLength, ifrm.TotalLength())
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, ifrm.SetTTL, ifrm.TTL())
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { ifrm.SetProtocol(lneto.IPProto(v)) }, uint8(ifrm.Protocol()))
|
||||
fields = 5
|
||||
|
||||
// IP option injection: 2 bits consumed (inject + variant selector).
|
||||
if bitmapMut&1 != 0 && ifrm.HeaderLength() >= 20 && ifrm.HeaderLength() <= len(ipBuf) {
|
||||
opts := ifrm.Options()
|
||||
if len(opts) > 0 {
|
||||
seed = mutateIPOptions(opts, seed, bitmapMut>>1)
|
||||
fields++
|
||||
bitmapMut >>= 1 // extra bit for variant
|
||||
}
|
||||
}
|
||||
bitmapMut >>= 1
|
||||
fields++
|
||||
|
||||
ifrm.SetCRC(0)
|
||||
ifrm.SetCRC(ifrm.CalculateHeaderCRC())
|
||||
|
||||
tl := ifrm.TotalLength()
|
||||
if int(tl) > len(ipBuf) {
|
||||
tl = uint16(len(ipBuf))
|
||||
}
|
||||
_, ihl = ifrm.VersionAndIHL()
|
||||
hl := uint16(ihl) * 4
|
||||
if hl > tl {
|
||||
return fields, seed, bitmapMut
|
||||
}
|
||||
transportBuf := ipBuf[hl:tl]
|
||||
|
||||
var n int
|
||||
switch ifrm.Protocol() {
|
||||
case lneto.IPProtoTCP:
|
||||
n, seed, bitmapMut = pm.MutateTCP(transportBuf, ifrm, seed, bitmapMut)
|
||||
case lneto.IPProtoUDP:
|
||||
n, seed, bitmapMut = pm.MutateUDP(transportBuf, ifrm, seed, bitmapMut)
|
||||
case lneto.IPProtoICMP:
|
||||
n, seed, bitmapMut = pm.MutateICMP(transportBuf, seed, bitmapMut)
|
||||
}
|
||||
return fields + n, seed, bitmapMut
|
||||
}
|
||||
|
||||
// mutateIPOptions writes adversarial IP option bytes into the options region.
|
||||
// Strategies selected by seed bits:
|
||||
// - 0: All NOPs (padding that shouldn't affect parsing but inflates IHL)
|
||||
// - 1: Record Route with claimed length exceeding option space
|
||||
// - 2: Garbage bytes (random option kinds with random lengths)
|
||||
// - 3: Option with length=0 (infinite loop in naive parsers)
|
||||
// - 4: Option with length=1 (length includes kind but not length byte itself)
|
||||
// - 5: Nested contradictions: valid kind, absurd length crossing into transport
|
||||
// - 6: Single option claiming entire IP packet as option data
|
||||
// - 7: Fill with End-of-Options (0x00) — parser should stop immediately
|
||||
func mutateIPOptions(opts []byte, seed int64, variant int64) int64 {
|
||||
strategy := variant & 0x7
|
||||
switch strategy {
|
||||
case 0: // All NOPs.
|
||||
for i := range opts {
|
||||
opts[i] = 1 // NOP
|
||||
}
|
||||
case 1: // Record Route (type 7) with oversize length.
|
||||
if len(opts) >= 3 {
|
||||
opts[0] = 7 // Record Route
|
||||
opts[1] = byte(len(opts)) + 40 // length way past option space
|
||||
opts[2] = 4 // pointer
|
||||
for i := 3; i < len(opts); i++ {
|
||||
opts[i] = byte(seed >> uint(i%8))
|
||||
}
|
||||
}
|
||||
case 2: // Garbage: random kind + random length pairs.
|
||||
for i := 0; i < len(opts); {
|
||||
opts[i] = byte(seed)
|
||||
seed >>= 3
|
||||
if i+1 < len(opts) {
|
||||
opts[i+1] = byte(seed) // random length field
|
||||
seed >>= 4
|
||||
}
|
||||
i += 2
|
||||
}
|
||||
case 3: // Option with length=0 (infinite loop trap).
|
||||
if len(opts) >= 2 {
|
||||
opts[0] = 68 // Timestamp option kind
|
||||
opts[1] = 0 // length=0: parser that loops on length will hang
|
||||
for i := 2; i < len(opts); i++ {
|
||||
opts[i] = 0
|
||||
}
|
||||
}
|
||||
case 4: // Option with length=1 (only covers kind byte).
|
||||
if len(opts) >= 2 {
|
||||
opts[0] = 7 // Record Route
|
||||
opts[1] = 1 // length=1: doesn't even cover the length byte
|
||||
for i := 2; i < len(opts); i++ {
|
||||
opts[i] = 1 // NOP fill
|
||||
}
|
||||
}
|
||||
case 5: // Valid kind, length extends into transport header.
|
||||
if len(opts) >= 2 {
|
||||
opts[0] = 68 // Timestamp
|
||||
opts[1] = byte(len(opts) + 20) // extends 20 bytes into transport
|
||||
for i := 2; i < len(opts); i++ {
|
||||
opts[i] = byte(seed)
|
||||
seed >>= 3
|
||||
}
|
||||
}
|
||||
case 6: // Single option claiming huge data.
|
||||
if len(opts) >= 2 {
|
||||
opts[0] = 130 // Security option kind
|
||||
opts[1] = 255 // max possible length
|
||||
for i := 2; i < len(opts); i++ {
|
||||
opts[i] = 0xCC
|
||||
}
|
||||
}
|
||||
case 7: // All End-of-Options.
|
||||
for i := range opts {
|
||||
opts[i] = 0
|
||||
}
|
||||
}
|
||||
return seed
|
||||
}
|
||||
|
||||
// MutateTCP mutates TCP fields: Seq, Ack, Flags, WindowSize, DataOffset and
|
||||
// optionally injects adversarial TCP options.
|
||||
// ifrm is needed for pseudo-header CRC recalculation.
|
||||
func (pm PacketMut) MutateTCP(transportBuf []byte, ifrm ipv4.Frame, seed, bitmapMut int64) (fields int, seedOut, bitmapOut int64) {
|
||||
tfrm, err := tcp.NewFrame(transportBuf)
|
||||
if err != nil {
|
||||
return 0, seed, bitmapMut
|
||||
}
|
||||
off, flags := tfrm.OffsetAndFlags()
|
||||
|
||||
seed, bitmapMut = mutate32(seed, bitmapMut, func(v uint32) { tfrm.SetSeq(tcp.Value(v)) }, uint32(tfrm.Seq()))
|
||||
seed, bitmapMut = mutate32(seed, bitmapMut, func(v uint32) { tfrm.SetAck(tcp.Value(v)) }, uint32(tfrm.Ack()))
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { tfrm.SetOffsetAndFlags(off, tcp.Flags(v).Mask()) }, uint8(flags))
|
||||
seed, bitmapMut = mutate16(seed, bitmapMut, tfrm.SetWindowSize, tfrm.WindowSize())
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { tfrm.SetOffsetAndFlags(v&0xf, flags) }, off)
|
||||
fields = 5
|
||||
|
||||
// TCP option injection: 2 bits consumed (inject + variant selector).
|
||||
if bitmapMut&1 != 0 && tfrm.HeaderLength() >= 20 && tfrm.HeaderLength() <= len(transportBuf) {
|
||||
opts := tfrm.Options()
|
||||
if len(opts) > 0 {
|
||||
seed = mutateTCPOptions(opts, seed, bitmapMut>>1)
|
||||
fields++
|
||||
bitmapMut >>= 1
|
||||
}
|
||||
}
|
||||
bitmapMut >>= 1
|
||||
fields++
|
||||
|
||||
tfrm.SetCRC(0)
|
||||
var crc lneto.CRC791
|
||||
ifrm.CRCWriteTCPPseudo(&crc)
|
||||
tfrm.SetCRC(crc.PayloadSum16(transportBuf))
|
||||
return fields, seed, bitmapMut
|
||||
}
|
||||
|
||||
// mutateTCPOptions writes adversarial TCP option bytes into the options region.
|
||||
// Strategies selected by seed bits:
|
||||
// - 0: MSS with extreme value (1 or 65535)
|
||||
// - 1: Window Scale with huge shift (>14, RFC max is 14)
|
||||
// - 2: Option with length=0 (infinite loop trap)
|
||||
// - 3: Option length exceeds remaining space (truncated option)
|
||||
// - 4: SACK blocks with impossible ranges (garbage SACK data)
|
||||
// - 5: Duplicate MSS options (which one wins?)
|
||||
// - 6: Valid-looking options followed by garbage past End marker
|
||||
// - 7: All NOPs (max padding, no real options)
|
||||
func mutateTCPOptions(opts []byte, seed int64, variant int64) int64 {
|
||||
strategy := variant & 0x7
|
||||
switch strategy {
|
||||
case 0: // MSS extreme values.
|
||||
if len(opts) >= 4 {
|
||||
opts[0] = byte(tcp.OptMaxSegmentSize) // kind=2
|
||||
opts[1] = 4 // length=4
|
||||
if seed&1 != 0 {
|
||||
opts[2], opts[3] = 0xFF, 0xFF // MSS=65535
|
||||
} else {
|
||||
opts[2], opts[3] = 0x00, 0x01 // MSS=1
|
||||
}
|
||||
seed = internal.Prand64(seed)
|
||||
for i := 4; i < len(opts); i++ {
|
||||
opts[i] = 0 // End
|
||||
}
|
||||
}
|
||||
case 1: // Window Scale with illegal shift.
|
||||
if len(opts) >= 3 {
|
||||
opts[0] = byte(tcp.OptWindowScale) // kind=3
|
||||
opts[1] = 3 // length=3
|
||||
opts[2] = byte(seed&0x1F) | 0x10 // shift 16-31, RFC max=14
|
||||
seed >>= 5
|
||||
for i := 3; i < len(opts); i++ {
|
||||
opts[i] = 1 // NOP
|
||||
}
|
||||
}
|
||||
case 2: // Option with length=0.
|
||||
if len(opts) >= 2 {
|
||||
opts[0] = byte(tcp.OptMaxSegmentSize)
|
||||
opts[1] = 0 // length=0: naive parser loops forever
|
||||
for i := 2; i < len(opts); i++ {
|
||||
opts[i] = 0
|
||||
}
|
||||
}
|
||||
case 3: // Option length exceeds remaining space.
|
||||
if len(opts) >= 2 {
|
||||
opts[0] = byte(tcp.OptSACK)
|
||||
opts[1] = byte(len(opts) + 10) // extends past option region
|
||||
for i := 2; i < len(opts); i++ {
|
||||
opts[i] = byte(seed)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
}
|
||||
case 4: // SACK with garbage block data.
|
||||
if len(opts) >= 10 {
|
||||
opts[0] = byte(tcp.OptSACK) // kind=5
|
||||
sackLen := len(opts)
|
||||
if sackLen > 34 {
|
||||
sackLen = 34 // max 4 SACK blocks
|
||||
}
|
||||
opts[1] = byte(sackLen)
|
||||
for i := 2; i < sackLen; i++ {
|
||||
opts[i] = byte(seed)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
for i := sackLen; i < len(opts); i++ {
|
||||
opts[i] = 0
|
||||
}
|
||||
}
|
||||
case 5: // Duplicate MSS options (parser picks first? last? panics?).
|
||||
for i := 0; i+4 <= len(opts); i += 4 {
|
||||
opts[i] = byte(tcp.OptMaxSegmentSize)
|
||||
opts[i+1] = 4
|
||||
mss := uint16(seed & 0xFFFF)
|
||||
opts[i+2] = byte(mss >> 8)
|
||||
opts[i+3] = byte(mss)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
case 6: // Valid option then garbage after End marker.
|
||||
if len(opts) >= 6 {
|
||||
opts[0] = byte(tcp.OptWindowScale)
|
||||
opts[1] = 3
|
||||
opts[2] = 7 // valid shift
|
||||
opts[3] = 0 // End-of-Options
|
||||
// Garbage after End — should be ignored but tests parser bounds.
|
||||
for i := 4; i < len(opts); i++ {
|
||||
opts[i] = byte(seed) | 0x80 // high-bit kinds (undefined)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
}
|
||||
case 7: // All NOPs — maximum padding, option parser iterates through each.
|
||||
for i := range opts {
|
||||
opts[i] = 1
|
||||
}
|
||||
}
|
||||
return seed
|
||||
}
|
||||
|
||||
// MutateUDP mutates the UDP Length field.
|
||||
// ifrm is needed for pseudo-header CRC recalculation.
|
||||
func (pm PacketMut) MutateUDP(transportBuf []byte, ifrm ipv4.Frame, seed, bitmapMut int64) (fields int, seedOut, bitmapOut int64) {
|
||||
ufrm, err := udp.NewFrame(transportBuf)
|
||||
if err != nil {
|
||||
return 0, seed, bitmapMut
|
||||
}
|
||||
|
||||
seed, bitmapMut = mutate16(seed, bitmapMut, ufrm.SetLength, ufrm.Length())
|
||||
|
||||
ufrm.SetCRC(0)
|
||||
var crc lneto.CRC791
|
||||
ifrm.CRCWriteUDPPseudo(&crc, ufrm.Length())
|
||||
ufrm.SetCRC(crc.PayloadSum16(transportBuf))
|
||||
return 1, seed, bitmapMut
|
||||
}
|
||||
|
||||
// MutateICMP mutates ICMP Type and Code fields.
|
||||
func (pm PacketMut) MutateICMP(transportBuf []byte, seed, bitmapMut int64) (fields int, seedOut, bitmapOut int64) {
|
||||
frm, err := icmpv4.NewFrame(transportBuf)
|
||||
if err != nil {
|
||||
return 0, seed, bitmapMut
|
||||
}
|
||||
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { frm.SetType(icmpv4.Type(v)) }, uint8(frm.Type()))
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, frm.SetCode, frm.Code())
|
||||
|
||||
frm.SetCRC(0)
|
||||
var crc lneto.CRC791
|
||||
frm.SetCRC(crc.PayloadSum16(transportBuf))
|
||||
return 2, seed, bitmapMut
|
||||
}
|
||||
|
||||
// MutateARP mutates ARP frame fields: Operation, hardware type/length,
|
||||
// protocol type/length, and sender/target addresses.
|
||||
func (pm PacketMut) MutateARP(arpBuf []byte, seed, bitmapMut int64) (fields int, seedOut, bitmapOut int64) {
|
||||
afrm, err := arp.NewFrame(arpBuf)
|
||||
if err != nil {
|
||||
return 0, seed, bitmapMut
|
||||
}
|
||||
|
||||
// Field: Operation (Request/Reply/garbage).
|
||||
seed, bitmapMut = mutate16(seed, bitmapMut, func(v uint16) { afrm.SetOperation(arp.Operation(v)) }, uint16(afrm.Operation()))
|
||||
|
||||
htype, hlen := afrm.Hardware()
|
||||
ptype, plen := afrm.Protocol()
|
||||
|
||||
// Mutate sender/target protocol addresses BEFORE length fields,
|
||||
// since length mutations shift where Sender/Target point.
|
||||
_, senderProto := afrm.Sender()
|
||||
if len(senderProto) > 0 && bitmapMut&1 != 0 {
|
||||
for i := range senderProto {
|
||||
senderProto[i] = byte(seed)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
}
|
||||
bitmapMut >>= 1
|
||||
|
||||
_, targetProto := afrm.Target()
|
||||
if len(targetProto) > 0 && bitmapMut&1 != 0 {
|
||||
for i := range targetProto {
|
||||
targetProto[i] = byte(seed)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
}
|
||||
bitmapMut >>= 1
|
||||
|
||||
// Field: Hardware type (wrong htype → mismatch).
|
||||
seed, bitmapMut = mutate16(seed, bitmapMut, func(v uint16) { afrm.SetHardware(v, hlen) }, htype)
|
||||
// Field: Hardware length (wrong hlen shifts all subsequent field offsets).
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { afrm.SetHardware(htype, v) }, hlen)
|
||||
// Field: Protocol type (wrong proto → mismatch).
|
||||
seed, bitmapMut = mutate16(seed, bitmapMut, func(v uint16) { afrm.SetProtocol(ethernet.Type(v), plen) }, uint16(ptype))
|
||||
// Field: Protocol length (wrong plen shifts target field offsets).
|
||||
seed, bitmapMut = mutate8(seed, bitmapMut, func(v uint8) { afrm.SetProtocol(ptype, v) }, plen)
|
||||
fields = 7
|
||||
|
||||
return fields, seed, bitmapMut
|
||||
}
|
||||
|
||||
func mutate8(seed, bitmapMut int64, set func(uint8), cur uint8) (int64, int64) {
|
||||
if bitmapMut&1 != 0 {
|
||||
v := uint8(seed) ^ cur
|
||||
if v == cur {
|
||||
v++
|
||||
}
|
||||
set(v)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
return seed, bitmapMut >> 1
|
||||
}
|
||||
|
||||
func mutate16(seed, bitmapMut int64, set func(uint16), cur uint16) (int64, int64) {
|
||||
if bitmapMut&1 != 0 {
|
||||
v := uint16(seed) ^ cur
|
||||
if v == cur {
|
||||
v++
|
||||
}
|
||||
set(v)
|
||||
seed = internal.Prand64(seed)
|
||||
|
||||
}
|
||||
return seed, bitmapMut >> 1
|
||||
}
|
||||
|
||||
func mutate32(seed, bitmapMut int64, set func(uint32), cur uint32) (int64, int64) {
|
||||
if bitmapMut&1 != 0 {
|
||||
v := uint32(seed) ^ cur
|
||||
if v == cur {
|
||||
v++
|
||||
}
|
||||
set(v)
|
||||
seed = internal.Prand64(seed)
|
||||
}
|
||||
return seed, bitmapMut >> 1
|
||||
}
|
||||
|
||||
+1
-1
@@ -19,7 +19,7 @@ func Prand32[T ~uint32](seed T) T {
|
||||
}
|
||||
|
||||
// Prand32 generates a pseudo random number from a seed.
|
||||
func Prand64[T ~uint64](seed T) T {
|
||||
func Prand64[T ~uint64 | ~int64](seed T) T {
|
||||
seed ^= seed << 13
|
||||
seed ^= seed >> 7
|
||||
seed ^= seed << 17
|
||||
|
||||
Reference in New Issue
Block a user