1 /*
2 * Copyright (C) 2017-2019 Felix Weinrank
3 *
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of the project nor the names of its contributors
15 * may be used to endorse or promote products derived from this software
16 * without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <usrsctp.h>
35 #include <openssl/sha.h>
36 #include "../programs/programs_helper.h"
37
38 #define FUZZ_FAST 1
39
40 #ifdef FUZZ_VERBOSE
41 #define fuzzer_printf(...) \
42 do { \
43 fprintf(stderr, "[P]"); \
44 debug_printf_runtime(); \
45 fprintf(stderr, __VA_ARGS__); \
46 } while (0)
47 #else
48 #define fuzzer_printf(...)
49 #endif
50
51 struct sockaddr_conn sconn;
52 struct socket *s_l;
53
54 static int
conn_output(void * addr,void * buf,size_t length,uint8_t tos,uint8_t set_df)55 conn_output(void *addr, void *buf, size_t length, uint8_t tos, uint8_t set_df)
56 {
57 (void) addr;
58 (void) buf;
59 (void) length;
60 (void) tos;
61 (void) set_df;
62 #if 0
63 char *dump_buf;
64 if ((dump_buf = usrsctp_dumppacket(buf, length, SCTP_DUMP_OUTBOUND)) != NULL) {
65 fprintf(stderr, "%s", dump_buf);
66 usrsctp_freedumpbuffer(dump_buf);
67 }
68 #endif
69 return (0);
70 }
71
72 static void
handle_upcall(struct socket * sock,void * arg,int flgs)73 handle_upcall(struct socket *sock, void *arg, int flgs)
74 {
75 (void) sock;
76 (void) arg;
77 (void) flgs;
78 fuzzer_printf("Listening socket established, implement logic!\n");
79 exit(EXIT_FAILURE);
80 }
81
82 int
init_fuzzer(void)83 init_fuzzer(void) {
84 static uint8_t initialized = 0;
85 struct sctp_event event;
86 uint16_t event_types[] = {
87 SCTP_ASSOC_CHANGE,
88 SCTP_PEER_ADDR_CHANGE,
89 SCTP_SEND_FAILED_EVENT,
90 SCTP_REMOTE_ERROR,
91 SCTP_SHUTDOWN_EVENT,
92 SCTP_ADAPTATION_INDICATION,
93 SCTP_PARTIAL_DELIVERY_EVENT};
94 unsigned long i;
95
96 #if defined(FUZZ_FAST)
97 if (initialized) {
98 return 0;
99 }
100 #endif
101
102 #ifdef FUZZ_VERBOSE
103 usrsctp_init(0, conn_output, debug_printf_stack);
104 #else
105 usrsctp_init(0, conn_output, NULL);
106 #endif
107
108 usrsctp_enable_crc32c_offload();
109
110 #ifdef SCTP_DEBUG
111 usrsctp_sysctl_set_sctp_debug_on(SCTP_DEBUG_ALL);
112 #endif
113 usrsctp_register_address((void *)1);
114
115 if ((s_l = usrsctp_socket(AF_CONN, SOCK_STREAM, IPPROTO_SCTP, NULL, NULL, 0, 0)) == NULL) {
116 perror("usrsctp_socket");
117 exit(EXIT_FAILURE);
118 }
119 usrsctp_set_non_blocking(s_l, 1);
120
121 /* Bind the server side. */
122 memset(&sconn, 0, sizeof(struct sockaddr_conn));
123 sconn.sconn_family = AF_CONN;
124 #ifdef HAVE_SCONN_LEN
125 sconn.sconn_len = sizeof(struct sockaddr_conn);
126 #endif
127 sconn.sconn_port = htons(5001);
128 sconn.sconn_addr = (void *)1;
129 if (usrsctp_bind(s_l, (struct sockaddr *)&sconn, sizeof(struct sockaddr_conn)) < 0) {
130 perror("usrsctp_bind");
131 exit(EXIT_FAILURE);
132 }
133
134 memset(&event, 0, sizeof(event));
135 event.se_assoc_id = SCTP_FUTURE_ASSOC;
136 event.se_on = 1;
137 for (i = 0; i < sizeof(event_types)/sizeof(uint16_t); i++) {
138 event.se_type = event_types[i];
139 if (usrsctp_setsockopt(s_l, IPPROTO_SCTP, SCTP_EVENT, &event, sizeof(event)) < 0) {
140 perror("setsockopt SCTP_EVENT s_l");
141 exit(EXIT_FAILURE);
142 }
143 }
144
145 /* Make server side passive... */
146 if (usrsctp_listen(s_l, 1) < 0) {
147 perror("usrsctp_listen");
148 exit(EXIT_FAILURE);
149 }
150
151 usrsctp_set_upcall(s_l, handle_upcall, NULL);
152
153 initialized = 1;
154
155 return (0);
156 }
157
158 int
LLVMFuzzerTestOneInput(const uint8_t * data,size_t data_size)159 LLVMFuzzerTestOneInput(const uint8_t* data, size_t data_size)
160 {
161 init_fuzzer();
162
163 if (data_size < 8 || data_size > 65535) {
164 // Skip too small and too large packets
165 return (0);
166 }
167 usrsctp_conninput((void *)1, data, data_size, 0);
168
169 #if !defined(FUZZ_FAST)
170 usrsctp_close(s_l);
171 while (usrsctp_finish() != 0) {
172 //sleep(1);
173 }
174 #endif
175
176 return (0);
177 }
178
179