5d5fbe79c1
In order to match NetBSD-style imports of external code, the library has been restructured. The full lwIP source tree is imported, except for a few .git* files in its root directory, into dist/. The MINIX 3 Makefiles and other custom files are located in lib/. Finally, since we need to apply a number of small patches to lwIP, these patches are stored in patches/, in addition to being applied to the lwIP tree. The currently imported version of lwIP is taken from its master branch sometime after the 2.0.1 release, specifically git-7ffe5bf. Change-Id: Ie03c4fa36fa928870263c191205d6d93f652a3cc
35 lines
1.5 KiB
Plaintext
35 lines
1.5 KiB
Plaintext
|
|
Fuzzing the lwIP stack (afl-fuzz requires linux/unix or similar)
|
|
|
|
This directory contains a small app that reads Ethernet frames from stdin and
|
|
processes them. It is used together with the 'american fuzzy lop' tool (found
|
|
at http://lcamtuf.coredump.cx/afl/) and the sample inputs to test how
|
|
unexpected inputs are handled. The afl tool will read the known inputs, and
|
|
try to modify them to exercise as many code paths as possible, by instrumenting
|
|
the code and keeping track of which code is executed.
|
|
|
|
Just running make will produce the test program.
|
|
|
|
Then run afl with:
|
|
|
|
afl-fuzz -i inputs/<INPUT> -o output ./lwip_fuzz
|
|
|
|
and it should start working. It will probably complain about CPU scheduler,
|
|
set AFL_SKIP_CPUFREQ=1 to ignore it.
|
|
If it complains about invalid "/proc/sys/kernel/core_pattern" setting, try
|
|
executing "sudo bash -c 'echo core > /proc/sys/kernel/core_pattern'".
|
|
|
|
The input is split into different subdirectories since they test different
|
|
parts of the code, and since you want to run one instance of afl-fuzz on each
|
|
core.
|
|
|
|
When afl finds a crash or a hang, the input that caused it will be placed in
|
|
the output directory. If you have hexdump and text2pcap tools installed,
|
|
running output_to_pcap.sh <outputdir> will create pcap files for each input
|
|
file to simplify viewing in wireshark.
|
|
|
|
The lwipopts.h file needs to have checksum checking off, otherwise almost every
|
|
packet will be discarded because of that. The other options can be tuned to
|
|
expose different parts of the code.
|
|
|