1 /*
2 american fuzzy lop++ - afl-network-client
3 ---------------------------------------
4
5 Written by Marc Heuse <mh@mh-sec.de>
6
7 Copyright 2019-2022 AFLplusplus Project. All rights reserved.
8
9 Licensed under the Apache License, Version 2.0 (the "License");
10 you may not use this file except in compliance with the License.
11 You may obtain a copy of the License at:
12
13 http://www.apache.org/licenses/LICENSE-2.0
14
15 */
16
17 #ifdef __ANDROID__
18 #include "android-ashmem.h"
19 #endif
20 #include "config.h"
21 #include "types.h"
22 #include "debug.h"
23
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <signal.h>
27 #include <unistd.h>
28 #include <string.h>
29 #include <assert.h>
30 #include <stdint.h>
31 #include <errno.h>
32
33 #include <netinet/in.h>
34 #include <netinet/ip6.h>
35 #include <arpa/inet.h>
36 #include <sys/mman.h>
37 #ifndef USEMMAP
38 #include <sys/shm.h>
39 #endif
40 #include <sys/wait.h>
41 #include <sys/types.h>
42 #include <sys/socket.h>
43 #include <netdb.h>
44 #include <fcntl.h>
45
46 #ifdef USE_DEFLATE
47 #include <libdeflate.h>
48 #endif
49
50 u8 *__afl_area_ptr;
51
52 #ifdef __ANDROID__
53 u32 __afl_map_size = MAP_SIZE;
54 #else
55 __thread u32 __afl_map_size = MAP_SIZE;
56 #endif
57
58 /* Error reporting to forkserver controller */
59
send_forkserver_error(int error)60 void send_forkserver_error(int error) {
61
62 u32 status;
63 if (!error || error > 0xffff) return;
64 status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
65 if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
66
67 }
68
69 /* SHM setup. */
70
__afl_map_shm(void)71 static void __afl_map_shm(void) {
72
73 char *id_str = getenv(SHM_ENV_VAR);
74 char *ptr;
75
76 if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
77
78 u32 val = atoi(ptr);
79 if (val > 0) __afl_map_size = val;
80
81 }
82
83 if (__afl_map_size > MAP_SIZE) {
84
85 if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
86
87 fprintf(stderr,
88 "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
89 "be able to run this instrumented program!\n",
90 __afl_map_size);
91 if (id_str) {
92
93 send_forkserver_error(FS_ERROR_MAP_SIZE);
94 exit(-1);
95
96 }
97
98 } else {
99
100 fprintf(stderr,
101 "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
102 "be able to run this instrumented program!\n",
103 __afl_map_size);
104
105 }
106
107 }
108
109 if (id_str) {
110
111 #ifdef USEMMAP
112 const char * shm_file_path = id_str;
113 int shm_fd = -1;
114 unsigned char *shm_base = NULL;
115
116 /* create the shared memory segment as if it was a file */
117 shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
118 if (shm_fd == -1) {
119
120 fprintf(stderr, "shm_open() failed\n");
121 send_forkserver_error(FS_ERROR_SHM_OPEN);
122 exit(1);
123
124 }
125
126 /* map the shared memory segment to the address space of the process */
127 shm_base =
128 mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
129
130 if (shm_base == MAP_FAILED) {
131
132 close(shm_fd);
133 shm_fd = -1;
134
135 fprintf(stderr, "mmap() failed\n");
136 send_forkserver_error(FS_ERROR_MMAP);
137 exit(2);
138
139 }
140
141 __afl_area_ptr = shm_base;
142 #else
143 u32 shm_id = atoi(id_str);
144
145 __afl_area_ptr = shmat(shm_id, 0, 0);
146
147 #endif
148
149 if (__afl_area_ptr == (void *)-1) {
150
151 send_forkserver_error(FS_ERROR_SHMAT);
152 exit(1);
153
154 }
155
156 /* Write something into the bitmap so that the parent doesn't give up */
157
158 __afl_area_ptr[0] = 1;
159
160 }
161
162 }
163
164 /* Fork server logic. */
165
__afl_start_forkserver(void)166 static void __afl_start_forkserver(void) {
167
168 u8 tmp[4] = {0, 0, 0, 0};
169 u32 status = 0;
170
171 if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
172 status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
173 if (status) status |= (FS_OPT_ENABLED);
174 memcpy(tmp, &status, 4);
175
176 /* Phone home and tell the parent that we're OK. */
177
178 if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
179
180 }
181
__afl_next_testcase(u8 * buf,u32 max_len)182 static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
183
184 s32 status, res = 0x0fffffff; // res is a dummy pid
185
186 /* Wait for parent by reading from the pipe. Abort if read fails. */
187 if (read(FORKSRV_FD, &status, 4) != 4) return 0;
188
189 /* we have a testcase - read it */
190 status = read(0, buf, max_len);
191
192 /* report that we are starting the target */
193 if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
194
195 if (status < 1)
196 return 0;
197 else
198 return status;
199
200 }
201
__afl_end_testcase(int status)202 static void __afl_end_testcase(int status) {
203
204 if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
205
206 }
207
208 /* you just need to modify the while() loop in this main() */
209
main(int argc,char * argv[])210 int main(int argc, char *argv[]) {
211
212 u8 * interface, *buf, *ptr;
213 s32 s = -1;
214 struct addrinfo hints, *hres, *aip;
215 u32 * lenptr, max_len = 65536;
216 #ifdef USE_DEFLATE
217 u8 * buf2;
218 u32 * lenptr1, *lenptr2, buf2_len, compress_len;
219 size_t decompress_len;
220 #endif
221
222 if (argc < 3 || argc > 4) {
223
224 printf("Syntax: %s host port [max-input-size]\n\n", argv[0]);
225 printf("Requires host and port of the remote afl-proxy-server instance.\n");
226 printf(
227 "IPv4 and IPv6 are supported, also binding to an interface with "
228 "\"%%\"\n");
229 printf("The max-input-size default is %u.\n", max_len);
230 printf(
231 "The default map size is %u and can be changed with setting "
232 "AFL_MAP_SIZE.\n",
233 __afl_map_size);
234 exit(-1);
235
236 }
237
238 if ((interface = strchr(argv[1], '%')) != NULL) *interface++ = 0;
239
240 if (argc > 3)
241 if ((max_len = atoi(argv[3])) < 0)
242 FATAL("max-input-size may not be negative or larger than 2GB: %s",
243 argv[3]);
244
245 if ((ptr = getenv("AFL_MAP_SIZE")) != NULL)
246 if ((__afl_map_size = atoi(ptr)) < 8)
247 FATAL("illegal map size, may not be < 8 or >= 2^30: %s", ptr);
248
249 if ((buf = malloc(max_len + 4)) == NULL)
250 PFATAL("can not allocate %u memory", max_len + 4);
251 lenptr = (u32 *)buf;
252
253 #ifdef USE_DEFLATE
254 buf2_len = (max_len > __afl_map_size ? max_len : __afl_map_size);
255 if ((buf2 = malloc(buf2_len + 8)) == NULL)
256 PFATAL("can not allocate %u memory", buf2_len + 8);
257 lenptr1 = (u32 *)buf2;
258 lenptr2 = (u32 *)(buf2 + 4);
259 #endif
260
261 memset(&hints, 0, sizeof(hints));
262 hints.ai_socktype = SOCK_STREAM;
263 hints.ai_family = PF_UNSPEC;
264
265 if (getaddrinfo(argv[1], argv[2], &hints, &hres) != 0)
266 PFATAL("could not resolve target %s", argv[1]);
267
268 for (aip = hres; aip != NULL && s == -1; aip = aip->ai_next) {
269
270 if ((s = socket(aip->ai_family, aip->ai_socktype, aip->ai_protocol)) >= 0) {
271
272 #ifdef SO_BINDTODEVICE
273 if (interface != NULL)
274 if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, interface,
275 strlen(interface) + 1) < 0)
276 fprintf(stderr, "Warning: could not bind to device %s\n", interface);
277 #else
278 fprintf(stderr,
279 "Warning: binding to interface is not supported for your OS\n");
280 #endif
281
282 #ifdef SO_PRIORITY
283 int priority = 7;
284 if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
285 0) {
286
287 priority = 6;
288 if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority,
289 sizeof(priority)) < 0)
290 WARNF("could not set priority on socket");
291
292 }
293
294 #endif
295
296 if (connect(s, aip->ai_addr, aip->ai_addrlen) == -1) s = -1;
297
298 }
299
300 }
301
302 #ifdef USE_DEFLATE
303 struct libdeflate_compressor *compressor;
304 compressor = libdeflate_alloc_compressor(1);
305 struct libdeflate_decompressor *decompressor;
306 decompressor = libdeflate_alloc_decompressor();
307 fprintf(stderr, "Compiled with compression support\n");
308 #endif
309
310 if (s == -1)
311 FATAL("could not connect to target tcp://%s:%s", argv[1], argv[2]);
312 else
313 fprintf(stderr, "Connected to target tcp://%s:%s\n", argv[1], argv[2]);
314
315 /* we initialize the shared memory map and start the forkserver */
316 __afl_map_shm();
317 __afl_start_forkserver();
318
319 int i = 1, j, status, ret, received;
320
321 // fprintf(stderr, "Waiting for first testcase\n");
322 while ((*lenptr = __afl_next_testcase(buf + 4, max_len)) > 0) {
323
324 // fprintf(stderr, "Sending testcase with len %u\n", *lenptr);
325 #ifdef USE_DEFLATE
326 #ifdef COMPRESS_TESTCASES
327 // we only compress the testcase if it does not fit in the TCP packet
328 if (*lenptr > 1500 - 20 - 32 - 4) {
329
330 // set highest byte to signify compression
331 *lenptr1 = (*lenptr | 0xff000000);
332 *lenptr2 = (u32)libdeflate_deflate_compress(compressor, buf + 4, *lenptr,
333 buf2 + 8, buf2_len);
334 if (send(s, buf2, *lenptr2 + 8, 0) != *lenptr2 + 8)
335 PFATAL("sending test data failed");
336 // fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
337 // for (u32 i = 0; i < *lenptr; i++)
338 // fprintf(stderr, "%02x", buf[i + 4]);
339 // fprintf(stderr, "\n");
340 // for (u32 i = 0; i < *lenptr2; i++)
341 // fprintf(stderr, "%02x", buf2[i + 8]);
342 // fprintf(stderr, "\n");
343
344 } else {
345
346 #endif
347 #endif
348 if (send(s, buf, *lenptr + 4, 0) != *lenptr + 4)
349 PFATAL("sending test data failed");
350 #ifdef USE_DEFLATE
351 #ifdef COMPRESS_TESTCASES
352 // fprintf(stderr, "unCOMPRESS (%u)\n", *lenptr);
353
354 }
355
356 #endif
357 #endif
358
359 received = 0;
360 while (received < 4 &&
361 (ret = recv(s, &status + received, 4 - received, 0)) > 0)
362 received += ret;
363 if (received != 4)
364 FATAL("did not receive waitpid data (%d, %d)", received, ret);
365 // fprintf(stderr, "Received status\n");
366
367 received = 0;
368 #ifdef USE_DEFLATE
369 while (received < 4 &&
370 (ret = recv(s, &compress_len + received, 4 - received, 0)) > 0)
371 received += ret;
372 if (received != 4)
373 FATAL("did not receive compress_len (%d, %d)", received, ret);
374 // fprintf(stderr, "Received status\n");
375
376 received = 0;
377 while (received < compress_len &&
378 (ret = recv(s, buf2 + received, buf2_len - received, 0)) > 0)
379 received += ret;
380 if (received != compress_len)
381 FATAL("did not receive coverage data (%d, %d)", received, ret);
382
383 if (libdeflate_deflate_decompress(decompressor, buf2, compress_len,
384 __afl_area_ptr, __afl_map_size,
385 &decompress_len) != LIBDEFLATE_SUCCESS ||
386 decompress_len != __afl_map_size)
387 FATAL("decompression failed");
388 // fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
389 // for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
390 // __afl_area_ptr[i]); fprintf(stderr, "\n");
391 #else
392 while (received < __afl_map_size &&
393 (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
394 0)) > 0)
395 received += ret;
396 if (received != __afl_map_size)
397 FATAL("did not receive coverage data (%d, %d)", received, ret);
398 #endif
399 // fprintf(stderr, "Received coverage\n");
400
401 /* report the test case is done and wait for the next */
402 __afl_end_testcase(status);
403 // fprintf(stderr, "Waiting for next testcase %d\n", ++i);
404
405 }
406
407 #ifdef USE_DEFLATE
408 libdeflate_free_compressor(compressor);
409 libdeflate_free_decompressor(decompressor);
410 free(buf2);
411 #endif
412 free(buf);
413
414 return 0;
415
416 }
417
418