Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add libfuzzer based fuzzer. #1117

Merged
merged 19 commits into from
May 27, 2022
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Cleanup fuzzer code
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
  • Loading branch information
Alan Jowett authored and dthaler committed May 26, 2022
commit d0c1f4180c148ba8b160d0f866f811ae6080e6fc
5 changes: 3 additions & 2 deletions tests/libfuzzer/bpf2c/bpf2c_fuzzer.vcxproj
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
Expand All @@ -63,7 +63,7 @@
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;NO_CATCH;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalOptions>/fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div %(AdditionalOptions)</AdditionalOptions>
</ClCompile>
<Link>
Expand All @@ -80,6 +80,7 @@
<ClInclude Include="..\..\..\tools\bpf2c\bpf_code_generator.h" />
<ClInclude Include="..\..\libs\thunk\mock\mock.h" />
<ClInclude Include="..\end_to_end\test_helper.hpp" />
<ClInclude Include="..\include\libfuzzer.h" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\..\..\external\ebpf-verifier\build\ebpfverifier.vcxproj">
Expand Down
3 changes: 3 additions & 0 deletions tests/libfuzzer/bpf2c/bpf2c_fuzzer.vcxproj.filters
Original file line number Diff line number Diff line change
Expand Up @@ -36,5 +36,8 @@
<ClInclude Include="..\..\..\tools\bpf2c\bpf_code_generator.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="..\include\libfuzzer.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
</Project>
20 changes: 1 addition & 19 deletions tests/libfuzzer/bpf2c/libfuzz_harness.cpp
Original file line number Diff line number Diff line change
@@ -1,34 +1,16 @@
// Copyright (c) Microsoft Corporation
// SPDX-License-Identifier: MIT

#include <Windows.h>

#include <chrono>
#include <cstdlib>
#include <fstream>
#include <iostream>
#include <filesystem>
#include <map>
#include <ranges>
#include <sstream>
#include <thread>
#include <vector>

#undef max
#include "bpf_code_generator.h"

#if defined(_DEBUG)
#pragma comment(lib, "clang_rt.fuzzer_MTd-x86_64.lib")
#pragma comment(lib, "sancovd.lib")
#else
#pragma comment(lib, "clang_rt.fuzzer_MD-x86_64.lib")
#pragma comment(lib, "libsancov.lib")
#endif

#ifdef __cplusplus
#define FUZZ_EXPORT extern "C" __declspec(dllexport)
#else #define FUZZ_EXPORT __declspec(dllexport)
#endif
#include "libfuzzer.h"

FUZZ_EXPORT int __cdecl LLVMFuzzerInitialize(int*, char***) { return 0; }

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<AdditionalIncludeDirectories>$(SolutionDir)libs\api_common;$(SolutionDir)include;$(SolutionDir)libs\api;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)libs\service;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)libs\api_common;$(SolutionDir)include;$(SolutionDir)libs\api;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)libs\service;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
Expand All @@ -70,7 +70,7 @@
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;NO_CATCH;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<AdditionalIncludeDirectories>$(SolutionDir)libs\api_common;$(SolutionDir)include;$(SolutionDir)libs\api;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)libs\service;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)libs\api_common;$(SolutionDir)include;$(SolutionDir)libs\api;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)libs\service;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalOptions>/fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div %(AdditionalOptions)</AdditionalOptions>
</ClCompile>
<Link>
Expand Down
50 changes: 18 additions & 32 deletions tests/libfuzzer/execution_context/libfuzz_harness.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,8 @@
#include <Windows.h>

#include <chrono>
#include <cstdlib>
#include <fstream>
#include <iostream>
#include <filesystem>
#include <map>
#include <ranges>
#include <thread>
#include <vector>

#define REQUIRE(X) \
Expand All @@ -22,31 +17,19 @@
#include "ebpf_core.h"
#include "ebpf_program.h"
#include "helpers.h"
#include "libfuzzer.h"
#include "platform.h"
#include <ebpf_handle.h>

#if defined(_DEBUG)
#pragma comment(lib, "clang_rt.fuzzer_MTd-x86_64.lib")
#pragma comment(lib, "sancovd.lib")
#else
#pragma comment(lib, "clang_rt.fuzzer_MD-x86_64.lib")
#pragma comment(lib, "libsancov.lib")
#endif

#ifdef __cplusplus
#define FUZZ_EXPORT extern "C" __declspec(dllexport)
#else #define FUZZ_EXPORT __declspec(dllexport)
#endif

std::vector<std::unique_ptr<_program_info_provider>> _program_information_providers;
std::vector<GUID> _program_types = {


static std::vector<std::unique_ptr<_program_info_provider>> _program_information_providers;
static std::vector<GUID> _program_types = {
EBPF_PROGRAM_TYPE_XDP,
EBPF_PROGRAM_TYPE_BIND,
EBPF_PROGRAM_TYPE_CGROUP_SOCK_ADDR,
EBPF_PROGRAM_TYPE_SOCK_OPS,
EBPF_PROGRAM_TYPE_SAMPLE};

std::map<std::string, ebpf_map_definition_in_memory_t> _map_definitions = {
static std::map<std::string, ebpf_map_definition_in_memory_t> _map_definitions = {
{
"BPF_MAP_TYPE_HASH",
{
Expand Down Expand Up @@ -167,8 +150,12 @@ std::map<std::string, ebpf_map_definition_in_memory_t> _map_definitions = {
};

void
create_various_objects()
fuzz_initiate()
{
ebpf_core_initiate();
for (const auto& type : _program_types) {
_program_information_providers.push_back(std::make_unique<_program_info_provider>(type));
}
for (const auto& type : _program_types) {
std::string name = "program name";
std::string file = "file name";
Expand All @@ -190,15 +177,10 @@ create_various_objects()
}
}

FUZZ_EXPORT int __cdecl LLVMFuzzerInitialize(int*, char***)
void
fuzz_terminate()
{
ebpf_core_initiate();
for (const auto& type : _program_types) {
_program_information_providers.push_back(std::make_unique<_program_info_provider>(type));
}
create_various_objects();

return 0;
ebpf_core_terminate();
}

void
Expand All @@ -207,6 +189,7 @@ fuzz_async_completion(void*, size_t, ebpf_result_t){};
void
fuzz_ioctl(std::vector<uint8_t>& random_buffer)
{
fuzz_initiate();
bool async = false;
std::vector<uint8_t> reply;
if (random_buffer.size() < sizeof(ebpf_operation_header_t)) {
Expand Down Expand Up @@ -238,8 +221,11 @@ fuzz_ioctl(std::vector<uint8_t>& random_buffer)
if (result == EBPF_PENDING) {
ebpf_core_cancel_protocol_handler(&async);
}
fuzz_terminate();
}

FUZZ_EXPORT int __cdecl LLVMFuzzerInitialize(int*, char***) { return 0; }

FUZZ_EXPORT int __cdecl LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
std::vector<uint8_t> random_buffer(size);
Expand Down
15 changes: 15 additions & 0 deletions tests/libfuzzer/include/libfuzzer.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// Copyright (c) Microsoft Corporation
// SPDX-License-Identifier: MIT

#if defined(_DEBUG)
#pragma comment(lib, "clang_rt.fuzzer_MDd-x86_64.lib")
#pragma comment(lib, "libsancov.lib")
#else
#pragma comment(lib, "clang_rt.fuzzer_MD-x86_64.lib")
#pragma comment(lib, "libsancov.lib")
#endif

#ifdef __cplusplus
#define FUZZ_EXPORT extern "C" __declspec(dllexport)
#else #define FUZZ_EXPORT __declspec(dllexport)
#endif
33 changes: 5 additions & 28 deletions tests/libfuzzer/verifier/libfuzz_harness.cpp
Original file line number Diff line number Diff line change
@@ -1,46 +1,23 @@
// Copyright (c) Microsoft Corporation
// SPDX-License-Identifier: MIT

#include <Windows.h>

#include <chrono>
#include <cstdlib>
#include <fstream>
#include <iostream>
#include <filesystem>
#include <map>
#include <ranges>
#include <sstream>
#include <thread>
#include <vector>
#include <ebpf_api.h>
#include "libfuzzer.h"

#undef max

#if defined(_DEBUG)
#pragma comment(lib, "clang_rt.fuzzer_MDd-x86_64.lib")
#pragma comment(lib, "libsancov.lib")
#else
#pragma comment(lib, "clang_rt.fuzzer_MD-x86_64.lib")
#pragma comment(lib, "libsancov.lib")
#endif

#ifdef __cplusplus
#define FUZZ_EXPORT extern "C" __declspec(dllexport)
#else #define FUZZ_EXPORT __declspec(dllexport)
#endif
//#undef max
Alan-Jowett marked this conversation as resolved.
Show resolved Hide resolved

FUZZ_EXPORT int __cdecl LLVMFuzzerInitialize(int*, char***) { return 0; }

FUZZ_EXPORT int __cdecl LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
try {
const char* report = nullptr;
;
const char* error_message = nullptr;
ebpf_api_elf_verify_section_from_memory((const char*)data, size, "", false, &report, &error_message, nullptr);
free((void*)report);
free((void*)error_message);
ebpf_api_elf_verify_section_from_memory(reinterpret_cast<const char*>(data), size, "", false, &report, &error_message, nullptr);
free(const_cast<char*>(report));
free(const_cast<char*>(error_message));
} catch (std::runtime_error&) {
}

Expand Down
4 changes: 2 additions & 2 deletions tests/libfuzzer/verifier/verifier_fuzzer.vcxproj
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;$(SolutionDir)libs\service;$(SolutionDir)libs\api;$(SolutionDir)libs\api_common;$(SolutionDir)libs\platform;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;$(SolutionDir)libs\service;$(SolutionDir)libs\api;$(SolutionDir)libs\api_common;$(SolutionDir)libs\platform;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
Expand All @@ -64,7 +64,7 @@
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;NO_CATCH;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;$(SolutionDir)libs\service;$(SolutionDir)libs\api;$(SolutionDir)libs\api_common;$(SolutionDir)libs\platform;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;$(SolutionDir)libs\service;$(SolutionDir)libs\api;$(SolutionDir)libs\api_common;$(SolutionDir)libs\platform;$(SolutionDir)libs\ebpfnetsh;$(SolutionDir)tests\libs\util;$(SolutionDir)tests\libs\common;$(SolutionDir)rpc_interface;$(SolutionDir)libs\platform\user;$(SolutionDir)libs\execution_context;$(SolutionDir)tests\end_to_end;$(SolutionDir)tests\sample;$(SolutionDir)tests\sample\ext\inc;$(SolutionDir)\tests\xdp;$(SolutionDir)tools\encode_program_info;$(SolutionDir)libs\thunk;$(SolutionDir)libs\thunk\mock;$(SolutionDir)\netebpfext;$(SolutionDir)external\catch2\src;$(SolutionDir)external\catch2\build\generated-includes;$(SolutionDir)external\bpftool;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<AdditionalOptions>/fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div %(AdditionalOptions)</AdditionalOptions>
</ClCompile>
<Link>
Expand Down