Skip to content

Commit 776360c

Browse files
scaprilescaprile
committed
fix fuzzers for IPv6
1 parent af76024 commit 776360c

File tree

4 files changed

+50
-41
lines changed

4 files changed

+50
-41
lines changed

‎src/printf.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,11 @@
33
#include "util.h"
44

55
size_t mg_queue_vprintf(struct mg_queue *q, const char *fmt, va_list *ap) {
6+
char *buf;
7+
size_t len;
68
va_list ap_copy;
79
va_copy(ap_copy, *ap);
8-
size_t len = mg_vsnprintf(NULL, 0, fmt, &ap_copy);
9-
char *buf;
10+
len = mg_vsnprintf(NULL, 0, fmt, &ap_copy);
1011
if (len == 0 || mg_queue_book(q, &buf, len + 1) < len + 1) {
1112
len = 0; // Nah. Not enough space
1213
} else {

‎test/fuzz.c‎

Lines changed: 34 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
100100
memcpy(pkt, data, size);
101101
if (size > sizeof(*eth)) {
102102
static size_t i;
103-
uint16_t eth_types[] = {0x800, 0x806, 0x86dd}; // IPv4, ARP, IPv6
103+
// uint16_t eth_types[] = {0x800, 0x806, 0x86dd}; // IPv4, ARP, IPv6
104+
uint16_t eth_types[] = {0x800, 0x806}; // IPv4, ARP, skip IPv6 until we merge it ***
104105
memcpy(eth->dst, mif.mac, 6); // Set valid destination MAC
105106
// send all handled eth types, then 2 random ones
106107
if (i >= (sizeof(eth_types) / sizeof(eth_types[0]) + 2)) i = 0;
@@ -111,31 +112,49 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
111112
uint8_t ip_protos[] = {1, 6, 17}; // ICMP, TCP, UDP
112113
struct ip *ip4 = (struct ip *) (eth + 1);
113114
ip4->ver = (ip4->ver & ~0xf0) | (4 << 4);
114-
// send all handled ip protos, then 2 random ones
115+
// send all handled IP protos, then 2 random ones
115116
if (j >= (sizeof(ip_protos) / sizeof(ip_protos[0]) + 2)) j = 0;
116117
if (j < (sizeof(ip_protos) / sizeof(ip_protos[0]))) ip4->proto = (ip_protos[j++]);
117118
if (ip4->proto == 1) { // ICMP
118119
} else if (ip4->proto == 6) { // TCP
119-
} else if (ip4->proto == 17 && size > (sizeof(*eth) + sizeof(struct ip) + sizeof(struct udp))) { // UDP
120-
static size_t k;
121-
uint16_t udp_ports[] = {67, 68}; // DHCP server and client
122-
struct udp *udp = (struct udp *) (ip4 + 1);
123-
// send all handled udp ports, then 2 random ones
124-
if (k >= (sizeof(udp_ports) / sizeof(udp_ports[0]) + 2)) k = 0;
125-
if (k < (sizeof(udp_ports) / sizeof(udp_ports[0]))) udp->dport = mg_htons(udp_ports[k++]);
120+
} else if (ip4->proto == 17) { // UDP
121+
if (size > (sizeof(*eth) + sizeof(struct ip) + sizeof(struct udp))) {
122+
static size_t k;
123+
uint16_t udp_ports[] = {67, 68}; // DHCP server and client
124+
struct udp *udp = (struct udp *) (ip4 + 1);
125+
// send all handled UDP ports, then 2 random ones
126+
if (k >= (sizeof(udp_ports) / sizeof(udp_ports[0]) + 2)) k = 0;
127+
if (k < (sizeof(udp_ports) / sizeof(udp_ports[0]))) udp->dport = mg_htons(udp_ports[k++]);
128+
}
126129
}
127130
} else if (eth->type == mg_htons(0x806)) { // ARP
131+
#if 0
128132
} else if (eth->type == mg_htons(0x86dd) && size > (sizeof(*eth) + sizeof(struct ip6))) { // IPv6
129133
static size_t j;
130-
uint8_t ip6_protos[] = {6, 17}; // TCP, UDP
134+
uint8_t ip6_protos[] = {6, 17, 58}; // TCP, UDP, ICMPv6
131135
struct ip6 *ip6 = (struct ip6 *) (eth + 1);
132136
ip6->ver = (ip6->ver & ~0xf0) | (6 << 4);
133-
// send all handled ip6 "next headers", then 2 random ones
137+
// send all handled IPv6 "next headers", then 2 random ones
134138
if (j >= (sizeof(ip6_protos) / sizeof(ip6_protos[0]) + 2)) j = 0;
135-
if (j < (sizeof(ip6_protos) / sizeof(ip6_protos[0]))) ip6->proto = (ip6_protos[j++]);
136-
if (ip6->proto == 6) { // TCP
137-
} else if (ip6->proto == 17) { // UDP
138-
}
139+
if (j < (sizeof(ip6_protos) / sizeof(ip6_protos[0]))) ip6->next = (ip6_protos[j++]);
140+
if (ip6->next == 6) { // TCP
141+
} else if (ip6->next == 17) { // UDP
142+
} else if (ip6->next == 58) { // ICMPv6
143+
if (size >= (sizeof(*eth) + sizeof(struct ip6) + sizeof(struct icmp6))) {
144+
static size_t k;
145+
uint16_t icmp6_types[] = {128, 134, 135, 136}; // Echo Request, RA, NS, NA
146+
struct icmp6 *icmp6 = (struct icmp6 *) (ip6 + 1);
147+
// send all handled ICMPv6 types, then 2 random ones
148+
if (k >= (sizeof(icmp6_types) / sizeof(icmp6_types[0]) + 2)) k = 0;
149+
if (k < (sizeof(icmp6_types) / sizeof(icmp6_types[0]))) icmp6->type = mg_htons(icmp6_types[k++]);
150+
}
151+
}
152+
#else
153+
} else if (eth->type == mg_htons(0x86dd)) { // IPv6
154+
free(pkt);
155+
mg_mgr_free(&mgr);
156+
return 0;
157+
#endif
139158
}
140159
}
141160

‎test/fuzz_tls.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *, size_t);
2020
_(mg_tls_server_recv_hello) \
2121
//_(mg_tls_client_recv_hello) \
2222
//_(mg_tls_client_recv_ext ) \
23-
//_(mg_tls_client_recv_cert) \
24-
//_(mg_tls_client_recv_cert_verify) \
23+
//_(mg_tls_recv_cert) \
24+
//_(mg_tls_recv_cert_verify) \
2525
// ...
2626

2727
struct f {

‎tutorials/stm32/portenta-h7-cube-baremetal-builtin/CM7/Core/Src/main.c‎

Lines changed: 11 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -203,23 +203,15 @@ static const struct mg_tcpip_driver_cyw_firmware fw = {
203203
// mif user states
204204
enum {AP, SCANNING, STOPPING_AP, CONNECTING, READY};
205205
static unsigned int state;
206-
static uint32_t s_ip, s_mask;
207206

208207

209208
static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
210-
// TODO(): should we include this inside ifp ? add an fn_data ?
211209
if (ev == MG_TCPIP_EV_ST_CHG) {
212210
MG_INFO(("State change: %u", *(uint8_t *) ev_data));
213211
}
214212
switch(state) {
215213
case AP: // we are in AP mode, wait for a user connection to trigger a scan or a connection to a network
216-
if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_UP) {
217-
MG_INFO(("Access Point started"));
218-
s_ip = ifp->ip, ifp->ip = MG_IPV4(192, 168, 169, 1);
219-
s_mask = ifp->mask, ifp->mask = MG_IPV4(255, 255, 255, 0);
220-
ifp->enable_dhcp_client = false;
221-
ifp->enable_dhcp_server = true;
222-
} else if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_READY) {
214+
if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_READY) {
223215
MG_INFO(("Access Point READY !"));
224216

225217
// simulate user request to scan for networks
@@ -233,7 +225,6 @@ static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
233225
struct mg_wifi_scan_bss_data *bss = (struct mg_wifi_scan_bss_data *) ev_data;
234226
MG_INFO(("BSS: %.*s (%u) (%M) %d dBm %u", bss->SSID.len, bss->SSID.buf, bss->channel, mg_print_mac, bss->BSSID, (int) bss->RSSI, bss->security));
235227
} else if (ev == MG_TCPIP_EV_WIFI_SCAN_END) {
236-
// struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
237228
MG_INFO(("Wi-Fi scan finished"));
238229

239230
// simulate user selection of a network (1/2: stop AP)
@@ -245,18 +236,14 @@ static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
245236
break;
246237
case STOPPING_AP:
247238
if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_DOWN) {
248-
struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
249-
d->apmode = false;
239+
struct mg_wifi_data *wifi = &((struct mg_tcpip_driver_cyw_data *) ifp->driver_data)->wifi;
240+
wifi->apmode = false;
250241

251242
// simulate user selection of a network (2/2: actual connect)
252-
bool res = mg_wifi_connect(d->ssid, d->pass);
243+
bool res = mg_wifi_connect(wifi);
253244
MG_INFO(("Manually connecting: %s", res ? "OK":"FAIL"));
254245
if (res) {
255246
state = CONNECTING;
256-
ifp->ip = s_ip;
257-
ifp->mask = s_mask;
258-
if (ifp->ip == 0) ifp->enable_dhcp_client = true;
259-
ifp->enable_dhcp_server = false;
260247
} // else manually start AP as below
261248
}
262249
break;
@@ -276,13 +263,13 @@ static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
276263
case READY:
277264
// go back to AP mode after a disconnection (simulation 2/2), you could retry
278265
if (ev == MG_TCPIP_EV_ST_CHG && *(uint8_t *) ev_data == MG_TCPIP_STATE_DOWN) {
279-
struct mg_tcpip_driver_cyw_data *d = (struct mg_tcpip_driver_cyw_data *) ifp->driver_data;
280-
bool res = mg_wifi_ap_start(d->apssid, d->appass, d->apchannel);
266+
struct mg_wifi_data *wifi = &((struct mg_tcpip_driver_cyw_data *) ifp->driver_data)->wifi;
267+
bool res = mg_wifi_ap_start(wifi);
281268
MG_INFO(("Disconnected"));
282269
MG_INFO(("Manually starting AP: %s", res ? "OK":"FAIL"));
283270
if (res) {
284271
state = AP;
285-
d->apmode = true;
272+
wifi->apmode = true;
286273
}
287274
}
288275
break;
@@ -291,7 +278,7 @@ static void mif_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {
291278

292279

293280
static struct mg_tcpip_driver_cyw_data d = {
294-
(void *)&sdio, (struct mg_tcpip_driver_cyw_firmware *)&fw, WIFI_SSID, WIFI_PASS, "mongoose", "mongoose", 0, 0, 10, true, false};
281+
{WIFI_SSID, WIFI_PASS, "mongoose", "mongoose", 0, 0, 0, 0, 10, true}, (void *)&sdio, (struct mg_tcpip_driver_cyw_firmware *)&fw, false};
295282

296283

297284
/* USER CODE END 0 */
@@ -359,7 +346,9 @@ Error_Handler();
359346
/* USER CODE BEGIN 2 */
360347
hwspecific_sdio_init();
361348

362-
state = d.apmode ? AP : CONNECTING;
349+
d.wifi.apip = MG_IPV4(192, 168, 169, 1),
350+
d.wifi.apmask = MG_IPV4(255, 255, 255, 0),
351+
state = d.wifi.apmode ? AP : CONNECTING;
363352

364353
struct mg_mgr mgr; // Initialise Mongoose event manager
365354
mg_mgr_init(&mgr); // and attach it to the interface

0 commit comments

Comments
 (0)