From 8daa83a594a2e98f39d764422bfbdbc62c9efd44 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:20:00 +0200 Subject: Adding upstream version 2:4.20.0+dfsg. Signed-off-by: Daniel Baumann --- lib/fuzzing/README.md | 87 ++++++ lib/fuzzing/afl-fuzz-main.c | 66 ++++ lib/fuzzing/decode_ndr_X_crash | 137 +++++++++ lib/fuzzing/fuzz_cli_credentials_parse_string.c | 63 ++++ lib/fuzzing/fuzz_conditional_ace_blob.c | 156 ++++++++++ lib/fuzzing/fuzz_dcerpc_parse_binding.c | 76 +++++ lib/fuzzing/fuzz_ldap_decode.c | 66 ++++ lib/fuzzing/fuzz_ldb_comparison_fold.c | 58 ++++ lib/fuzzing/fuzz_ldb_dn_explode.c | 53 ++++ lib/fuzzing/fuzz_ldb_ldif_read.c | 56 ++++ lib/fuzzing/fuzz_ldb_parse_binary_decode.c | 55 ++++ lib/fuzzing/fuzz_ldb_parse_control.c | 55 ++++ lib/fuzzing/fuzz_ldb_parse_tree.c | 53 ++++ lib/fuzzing/fuzz_lzxpress.c | 35 +++ lib/fuzzing/fuzz_lzxpress_compress.c | 35 +++ lib/fuzzing/fuzz_lzxpress_huffman_compress.c | 58 ++++ lib/fuzzing/fuzz_lzxpress_huffman_decompress.c | 48 +++ lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c | 68 +++++ lib/fuzzing/fuzz_lzxpress_round_trip.c | 56 ++++ lib/fuzzing/fuzz_ndr_X.c | 337 +++++++++++++++++++++ lib/fuzzing/fuzz_nmblib_parse_packet.c | 62 ++++ lib/fuzzing/fuzz_oLschema2ldif.c | 71 +++++ lib/fuzzing/fuzz_parse_lpq_entry.c | 65 ++++ lib/fuzzing/fuzz_reg_parse.c | 46 +++ lib/fuzzing/fuzz_regfio.c | 68 +++++ lib/fuzzing/fuzz_sddl_access_check.c | 206 +++++++++++++ lib/fuzzing/fuzz_sddl_conditional_ace.c | 121 ++++++++ lib/fuzzing/fuzz_sddl_parse.c | 110 +++++++ lib/fuzzing/fuzz_security_token_vs_descriptor.c | 78 +++++ lib/fuzzing/fuzz_sess_crypt_blob.c | 55 ++++ lib/fuzzing/fuzz_stable_sort.c | 88 ++++++ lib/fuzzing/fuzz_stable_sort_r.c | 69 +++++ lib/fuzzing/fuzz_tiniparser.c | 51 ++++ lib/fuzzing/fuzzing.c | 21 ++ lib/fuzzing/fuzzing.h | 30 ++ lib/fuzzing/oss-fuzz/build_image.sh | 7 + lib/fuzzing/oss-fuzz/build_samba.sh | 25 ++ lib/fuzzing/oss-fuzz/check_build.sh | 48 +++ lib/fuzzing/oss-fuzz/do_build.sh | 294 ++++++++++++++++++ lib/fuzzing/patches/collect-access-check-seeds.txt | 256 ++++++++++++++++ lib/fuzzing/wscript_build | 236 +++++++++++++++ 41 files changed, 3625 insertions(+) create mode 100644 lib/fuzzing/README.md create mode 100644 lib/fuzzing/afl-fuzz-main.c create mode 100755 lib/fuzzing/decode_ndr_X_crash create mode 100644 lib/fuzzing/fuzz_cli_credentials_parse_string.c create mode 100644 lib/fuzzing/fuzz_conditional_ace_blob.c create mode 100644 lib/fuzzing/fuzz_dcerpc_parse_binding.c create mode 100644 lib/fuzzing/fuzz_ldap_decode.c create mode 100644 lib/fuzzing/fuzz_ldb_comparison_fold.c create mode 100644 lib/fuzzing/fuzz_ldb_dn_explode.c create mode 100644 lib/fuzzing/fuzz_ldb_ldif_read.c create mode 100644 lib/fuzzing/fuzz_ldb_parse_binary_decode.c create mode 100644 lib/fuzzing/fuzz_ldb_parse_control.c create mode 100644 lib/fuzzing/fuzz_ldb_parse_tree.c create mode 100644 lib/fuzzing/fuzz_lzxpress.c create mode 100644 lib/fuzzing/fuzz_lzxpress_compress.c create mode 100644 lib/fuzzing/fuzz_lzxpress_huffman_compress.c create mode 100644 lib/fuzzing/fuzz_lzxpress_huffman_decompress.c create mode 100644 lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c create mode 100644 lib/fuzzing/fuzz_lzxpress_round_trip.c create mode 100644 lib/fuzzing/fuzz_ndr_X.c create mode 100644 lib/fuzzing/fuzz_nmblib_parse_packet.c create mode 100644 lib/fuzzing/fuzz_oLschema2ldif.c create mode 100644 lib/fuzzing/fuzz_parse_lpq_entry.c create mode 100644 lib/fuzzing/fuzz_reg_parse.c create mode 100644 lib/fuzzing/fuzz_regfio.c create mode 100644 lib/fuzzing/fuzz_sddl_access_check.c create mode 100644 lib/fuzzing/fuzz_sddl_conditional_ace.c create mode 100644 lib/fuzzing/fuzz_sddl_parse.c create mode 100644 lib/fuzzing/fuzz_security_token_vs_descriptor.c create mode 100644 lib/fuzzing/fuzz_sess_crypt_blob.c create mode 100644 lib/fuzzing/fuzz_stable_sort.c create mode 100644 lib/fuzzing/fuzz_stable_sort_r.c create mode 100644 lib/fuzzing/fuzz_tiniparser.c create mode 100644 lib/fuzzing/fuzzing.c create mode 100644 lib/fuzzing/fuzzing.h create mode 100755 lib/fuzzing/oss-fuzz/build_image.sh create mode 100755 lib/fuzzing/oss-fuzz/build_samba.sh create mode 100755 lib/fuzzing/oss-fuzz/check_build.sh create mode 100755 lib/fuzzing/oss-fuzz/do_build.sh create mode 100644 lib/fuzzing/patches/collect-access-check-seeds.txt create mode 100644 lib/fuzzing/wscript_build (limited to 'lib/fuzzing') diff --git a/lib/fuzzing/README.md b/lib/fuzzing/README.md new file mode 100644 index 0000000..d3e34bd --- /dev/null +++ b/lib/fuzzing/README.md @@ -0,0 +1,87 @@ +# Fuzzing Samba + +See also https://wiki.samba.org/index.php/Fuzzing + +Fuzzing supplies valid, invalid, unexpected or random data as input to a piece +of code. Instrumentation, usually compiler-implemented, is used to monitor for +exceptions such as crashes, assertions or memory corruption. + +See [Wikipedia article on fuzzing](https://en.wikipedia.org/wiki/Fuzzing) for +more information. + +# Honggfuzz + +## Configure with fuzzing + +Example command line to build binaries for use with +[honggfuzz](https://github.com/google/honggfuzz/): + +```sh +./configure -C --without-gettext --enable-debug --enable-developer \ + --address-sanitizer --enable-libfuzzer --abi-check-disable \ + CC=.../honggfuzz/hfuzz_cc/hfuzz-clang \ + LINK_CC=.../honggfuzz/hfuzz_cc/hfuzz-clang +``` + + +## Fuzzing tiniparser + +Example for fuzzing `tiniparser` using `honggfuzz` (see `--help` for more +options): + +```sh +make bin/fuzz_tiniparser && \ +.../honggfuzz/honggfuzz --sanitizers --timeout 3 --max_file_size 256 \ + --rlimit_rss 100 -f .../tiniparser-corpus -- bin/fuzz_tiniparser +``` + +# AFL (american fuzzy lop) + +## Configure with fuzzing + +Example command line to build binaries for use with +[afl](http://lcamtuf.coredump.cx/afl/) + +```sh +./configure -C --without-gettext --enable-debug --enable-developer \ + --enable-afl-fuzzer --abi-check-disable \ + CC=afl-gcc +``` + +## Fuzzing tiniparser + +Example for fuzzing `tiniparser` using `afl-fuzz` (see `--help` for more +options): + +```sh +make bin/fuzz_tiniparser build && \ +afl-fuzz -m 200 -i inputdir -o outputdir -- bin/fuzz_tiniparser +``` + +# oss-fuzz + +Samba can be fuzzed by Google's oss-fuzz system. Assuming you have an +oss-fuzz checkout from https://github.com/google/oss-fuzz with Samba's +metadata in projects/samba, the following guides will help: + +## Testing locally + +https://google.github.io/oss-fuzz/getting-started/new-project-guide/#testing-locally + +## Debugging oss-fuzz + +See https://google.github.io/oss-fuzz/advanced-topics/debugging/ + +## Samba-specific hints + +A typical debugging workflow is: + +oss-fuzz$ python infra/helper.py shell samba +git fetch $REMOTE $BRANCH +git checkout FETCH_HEAD +lib/fuzzing/oss-fuzz/build_image.sh +compile + +This will pull in any new Samba deps and build Samba's fuzzers. + +# vim: set sw=8 sts=8 ts=8 tw=79 : diff --git a/lib/fuzzing/afl-fuzz-main.c b/lib/fuzzing/afl-fuzz-main.c new file mode 100644 index 0000000..e0a1d26 --- /dev/null +++ b/lib/fuzzing/afl-fuzz-main.c @@ -0,0 +1,66 @@ +/* + Unix SMB/CIFS implementation. + + Fuzz driver (AFL style) + + Copyright (C) Andrew Bartlett 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "lib/util/samba_util.h" +#include "fuzzing.h" + +int main(int argc, char *argv[]) { + int ret; + size_t size = 0; + int i; + + ret = LLVMFuzzerInitialize(&argc, &argv); + if (ret != 0) { + printf("LLVMFuzzerInitialize returned %d\n", ret); + return ret; + } + + +#ifdef __AFL_LOOP + while (__AFL_LOOP(1000)) +#else + for (i = 1; i < argc; i++) { + uint8_t *buf = (uint8_t *)file_load(argv[i], + &size, + 0, + NULL); + ret = LLVMFuzzerTestOneInput(buf, size); + TALLOC_FREE(buf); + if (ret != 0) { + printf("LLVMFuzzerTestOneInput returned %d on argument %d\n", + ret, i); + return ret; + } + } + if (i == 1) +#endif + { + uint8_t *buf = (uint8_t *)fd_load(0, &size, 0, NULL); + if (buf == NULL) { + exit(1); + } + + ret = LLVMFuzzerTestOneInput(buf, size); + TALLOC_FREE(buf); + } + return ret; +} diff --git a/lib/fuzzing/decode_ndr_X_crash b/lib/fuzzing/decode_ndr_X_crash new file mode 100755 index 0000000..63c3cd7 --- /dev/null +++ b/lib/fuzzing/decode_ndr_X_crash @@ -0,0 +1,137 @@ +#!/usr/bin/env python3 +# +# Interpret a file that crashes an fuzz_ndr_X binary. +# +# Copyright (C) Catalyst IT Ltd. 2019 + + +import sys +import os +from base64 import b64encode +import struct +import argparse +import re + +TYPE_MASK = 3 +TYPES = ['struct', 'in', 'out'] + +FLAGS = [ + (4, 'ndr64', '--ndr64'), +] + + +def print_if_verbose(*args, **kwargs): + if verbose: + print(*args, **kwargs) + + +def process_one_file(f): + print_if_verbose(f.name) + print_if_verbose('-' * len(f.name)) + + b = f.read() + flags, function = struct.unpack('. +*/ +#include "includes.h" +#include "auth/credentials/credentials.h" +#include "fuzzing/fuzzing.h" + +#define MAX_LENGTH (1024 * 10) +char buf[MAX_LENGTH + 1]; + +const enum credentials_obtained obtained = CRED_UNINITIALISED; + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + struct cli_credentials *credentials = NULL; + bool anon; + const char *username; + const char *domain; + + if (len > MAX_LENGTH) { + return 0; + } + + memcpy(buf, input, len); + buf[len] = '\0'; + + mem_ctx = talloc_new(NULL); + credentials = cli_credentials_init(mem_ctx); + + cli_credentials_parse_string(credentials, buf, obtained); + + anon = cli_credentials_is_anonymous(credentials); + + cli_credentials_get_ntlm_username_domain(credentials, + mem_ctx, + &username, + &domain); + + talloc_free(mem_ctx); + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_conditional_ace_blob.c b/lib/fuzzing/fuzz_conditional_ace_blob.c new file mode 100644 index 0000000..ebbd908 --- /dev/null +++ b/lib/fuzzing/fuzz_conditional_ace_blob.c @@ -0,0 +1,156 @@ +/* + Fuzz conditional ace decoding and encoding + Copyright (C) Catalyst IT 2023 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "replace.h" +#include "libcli/security/security.h" +#include "lib/util/attr.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/conditional_ace.h" +#include "librpc/gen_ndr/conditional_ace.h" +#include "fuzzing/fuzzing.h" + + +#define MAX_LENGTH (1024 * 1024 - 1) + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + bool ok; + struct ace_condition_script *s1 = NULL; + struct ace_condition_script *s2 = NULL; + const char *message = NULL; + size_t message_offset; + const char *sddl = NULL; + DATA_BLOB e1, e2; + size_t length; + + if (len > MAX_LENGTH) { + return 0; + } + + /* + * In this one we are treating the input data as an ACE blob, + * and decoding it into the structure and thence SDDL. + * + * This doesn't run the conditional ACE, for which we would + * need a security token. + */ + + e1.data = input; + e1.length = len; + + mem_ctx = talloc_new(NULL); + + s1 = parse_conditional_ace(mem_ctx, e1); + if (s1 == NULL) { + /* no worries, it was nonsense */ + TALLOC_FREE(mem_ctx); + return 0; + } + + /* back to blob form */ + ok = conditional_ace_encode_binary(mem_ctx, s1, &e2); + if (! ok) { + if (e1.length == CONDITIONAL_ACE_MAX_LENGTH) { + /* + * This is an edge case where the encoder and + * decoder treat the boundary slightly + * differently, and the encoder refuses to + * encode to the maximum length. This is not + * an issue in the real world. + */ + TALLOC_FREE(mem_ctx); + return 0; + } + abort(); + } + + if (data_blob_cmp(&e1, &e2) != 0) { + abort(); + } + + sddl = sddl_from_conditional_ace(mem_ctx, s1); + if (sddl == NULL) { + /* + * we can't call this a failure, because the blob + * could easily have nonsensical programs that the + * SDDL decompiler is unwilling to countenance. For + * example, it could have an operator that requires + * arguments as the first token, when of course the + * arguments need to come first. + */ + TALLOC_FREE(mem_ctx); + return 0; + } + + s2 = ace_conditions_compile_sddl(mem_ctx, + ACE_CONDITION_FLAG_ALLOW_DEVICE, + sddl, + &message, + &message_offset, + &length); + if (s2 == NULL) { + /* + * We also don't complain when the SDDL decompiler + * produces an uncompilable program, because the + * decompiler is meant to be a display tool, not a + * verifier in itself. + */ + TALLOC_FREE(mem_ctx); + return 0; + } + + ok = conditional_ace_encode_binary(mem_ctx, s2, &e2); + if (! ok) { + abort(); + } + + /* + * It would be nice here to go: + * + * if (data_blob_cmp(&e1, &e2) != 0) { + * abort(); + * } + * + * but that isn't really fair. The decompilation into SDDL + * does not make thorough sanity checks because that is not + * its job -- it is just trying to depict what is there -- and + * there are many ambiguous decompilations. + * + * For example, a blob with a single literal integer token, + * say 42, can only really be shown in the SDDL syntax as + * "(42)", but when the compiler reads that it knows that a + * literal number is invalid except in a RHS argument, so it + * assumes "42" is a local attribute name. + * + * Even if the decompiler was a perfect verifier, a round trip + * through SDDL could not be guaranteed because, for example, + * an 8 bit integer can only be displayed in SDDL in the form + * that compiles to a 64 bit integer. + */ + + TALLOC_FREE(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/fuzz_dcerpc_parse_binding.c b/lib/fuzzing/fuzz_dcerpc_parse_binding.c new file mode 100644 index 0000000..dcbf440 --- /dev/null +++ b/lib/fuzzing/fuzz_dcerpc_parse_binding.c @@ -0,0 +1,76 @@ +/* + Fuzz dcerpc_parse_binding + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "librpc/gen_ndr/ndr_epmapper.h" +#include "librpc/rpc/dcerpc.h" +#include "fuzzing/fuzzing.h" + +#define MAX_LENGTH (1024 * 10) +char buf[MAX_LENGTH + 1]; + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + struct dcerpc_binding *binding = NULL; + struct dcerpc_binding *dup = NULL; + struct epm_tower tower; + NTSTATUS status; + struct GUID guid; + + if (len > MAX_LENGTH) { + return 0; + } + + memcpy(buf, input, len); + buf[len] = '\0'; + + mem_ctx = talloc_new(NULL); + status = dcerpc_parse_binding(mem_ctx, buf, &binding); + + if (! NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return 0; + } + + /* If the string parses, we try manipulating it a bit */ + + dcerpc_binding_string(mem_ctx, binding); + dcerpc_binding_get_abstract_syntax(binding); + dup = dcerpc_binding_dup(mem_ctx, binding); + + status = dcerpc_binding_build_tower(mem_ctx, + binding, + &tower); + if (NT_STATUS_IS_OK(status)) { + status = dcerpc_binding_from_tower(mem_ctx, + &tower, + &dup); + } + + guid = dcerpc_binding_get_object(binding); + + talloc_free(mem_ctx); + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_ldap_decode.c b/lib/fuzzing/fuzz_ldap_decode.c new file mode 100644 index 0000000..be286ea --- /dev/null +++ b/lib/fuzzing/fuzz_ldap_decode.c @@ -0,0 +1,66 @@ +/* + Fuzzing for ldap_decode. + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "lib/util/asn1.h" +#include "libcli/ldap/ldap_message.h" +#include "libcli/ldap/ldap_proto.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__); + struct asn1_data *asn1; + struct ldap_message *ldap_msg; + struct ldap_request_limits limits = { + /* + * The default size is currently 256000 bytes + */ + .max_search_size = 256000 + }; + NTSTATUS status; + + /* + * Need to limit the max parse tree depth to 250 to prevent + * ASAN detecting stack overflows. + */ + asn1 = asn1_init(mem_ctx, 250); + if (!asn1) { + goto out; + } + + asn1_load_nocopy(asn1, buf, len); + + ldap_msg = talloc(mem_ctx, struct ldap_message); + if (!ldap_msg) { + goto out; + } + + status = ldap_decode( + asn1, &limits, samba_ldap_control_handlers(), ldap_msg); + +out: + talloc_free(mem_ctx); + + return 0; +} diff --git a/lib/fuzzing/fuzz_ldb_comparison_fold.c b/lib/fuzzing/fuzz_ldb_comparison_fold.c new file mode 100644 index 0000000..08b2f59 --- /dev/null +++ b/lib/fuzzing/fuzz_ldb_comparison_fold.c @@ -0,0 +1,58 @@ +/* + Fuzzing ldb_comparison_fold() + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "lib/ldb/include/ldb.h" +#include "lib/ldb/include/ldb_handlers.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + struct ldb_val v1, v2; + struct ldb_context *ldb = NULL; + + if (len < 2) { + return 0; + } + + v1.length = PULL_LE_U16(input, 0); + if (v1.length > len - 2) { + /* the exact case of v2.length == 0 is still available */ + return 0; + } + len -= 2; + input += 2; + + ldb = ldb_init(NULL, NULL); + if (ldb == NULL) { + return 0; + } + + v1.data = talloc_memdup(ldb, input, v1.length); + v2.length = len - v1.length; + v2.data = talloc_memdup(ldb, input + v1.length, v2.length); + + ldb_comparison_fold(ldb, ldb, &v1, &v2); + talloc_free(ldb); + return 0; +} diff --git a/lib/fuzzing/fuzz_ldb_dn_explode.c b/lib/fuzzing/fuzz_ldb_dn_explode.c new file mode 100644 index 0000000..0e1560e --- /dev/null +++ b/lib/fuzzing/fuzz_ldb_dn_explode.c @@ -0,0 +1,53 @@ +/* + Fuzzing ldb_dn_explode + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "ldb.h" + + +#define MAX_LENGTH (2 * 1024 * 1024 - 1) +char buf[MAX_LENGTH + 1] = {0}; + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + struct ldb_dn *dn = NULL; + struct ldb_context *ldb = ldb_init(NULL, NULL); + if (ldb == NULL) { + return 0; + } + /* + * We copy the buffer in order to NUL-terminate, because running off + * the end of the string would be an uninteresting crash. + */ + if (len > MAX_LENGTH) { + len = MAX_LENGTH; + } + memcpy(buf, input, len); + buf[len] = 0; + + dn = ldb_dn_new(ldb, ldb, buf); + ldb_dn_validate(dn); + TALLOC_FREE(ldb); + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_ldb_ldif_read.c b/lib/fuzzing/fuzz_ldb_ldif_read.c new file mode 100644 index 0000000..3c48b6a --- /dev/null +++ b/lib/fuzzing/fuzz_ldb_ldif_read.c @@ -0,0 +1,56 @@ +/* + Fuzzing ldb_ldif_read_string + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "ldb_private.h" + + +#define MAX_LENGTH (2 * 1024 * 1024 - 1) +char buf[MAX_LENGTH + 1] = {0}; + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + struct ldb_ldif *ldif = NULL; + const char *s = NULL; + struct ldb_context *ldb = ldb_init(NULL, NULL); + if (ldb == NULL) { + return 0; + } + + if (len > MAX_LENGTH) { + len = MAX_LENGTH; + } + memcpy(buf, input, len); + buf[len] = 0; + s = buf; + + ldif = ldb_ldif_read_string(ldb, &s); + + if(ldif != NULL) { + ldb_ldif_write_string(ldb, ldb, ldif); + ldb_ldif_write_redacted_trace_string(ldb, ldb, ldif); + } + TALLOC_FREE(ldb); + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_ldb_parse_binary_decode.c b/lib/fuzzing/fuzz_ldb_parse_binary_decode.c new file mode 100644 index 0000000..ac2e436 --- /dev/null +++ b/lib/fuzzing/fuzz_ldb_parse_binary_decode.c @@ -0,0 +1,55 @@ +/* + Fuzzing ldb_binary_decode and ldb_binary_encode_string + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "ldb_private.h" + + +#define MAX_LENGTH (2 * 1024 * 1024 - 1) +char buf[MAX_LENGTH + 1] = {0}; + +static char * possibly_truncate(uint8_t *input, size_t len) +{ + if (len > MAX_LENGTH) { + len = MAX_LENGTH; + } + memcpy(buf, input, len); + buf[len] = 0; + return buf; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__); + struct ldb_val val = {0}; + const char *s = possibly_truncate(input, len); + + /* we treat the same string to encoding and decoding, not + * round-tripping. */ + val = ldb_binary_decode(mem_ctx, s); + ldb_binary_encode_string(mem_ctx, s); + TALLOC_FREE(mem_ctx); + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_ldb_parse_control.c b/lib/fuzzing/fuzz_ldb_parse_control.c new file mode 100644 index 0000000..722d9f9 --- /dev/null +++ b/lib/fuzzing/fuzz_ldb_parse_control.c @@ -0,0 +1,55 @@ +/* + Fuzzing ldb_parse_control_from_string + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "ldb_private.h" + + +#define MAX_LENGTH (2 * 1024 * 1024 - 1) +char buf[MAX_LENGTH + 1] = {0}; + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + struct ldb_control *control = NULL; + struct ldb_context *ldb = ldb_init(NULL, NULL); + if (ldb == NULL) { + return 0; + } + /* + * We copy the buffer in order to NUL-terminate, because running off + * the end of the string would be an uninteresting crash. + */ + if (len > MAX_LENGTH) { + len = MAX_LENGTH; + } + memcpy(buf, input, len); + buf[len] = 0; + + control = ldb_parse_control_from_string(ldb, ldb, buf); + if (control != NULL) { + ldb_control_to_string(ldb, control); + } + TALLOC_FREE(ldb); + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_ldb_parse_tree.c b/lib/fuzzing/fuzz_ldb_parse_tree.c new file mode 100644 index 0000000..1e64940 --- /dev/null +++ b/lib/fuzzing/fuzz_ldb_parse_tree.c @@ -0,0 +1,53 @@ +/* + Fuzzing for ldb_parse_tree + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "ldb.h" +#include "ldb_module.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__); + struct ldb_parse_tree *tree; + char *filter; + + if (len < 1) { + goto out; + } + + filter = talloc_strndup(mem_ctx, (const char*)buf, len); + + if (filter == NULL) { + goto out; + } + + tree = ldb_parse_tree(mem_ctx, filter); + + (void)ldb_filter_from_tree(mem_ctx, tree); + +out: + talloc_free(mem_ctx); + + return 0; +} diff --git a/lib/fuzzing/fuzz_lzxpress.c b/lib/fuzzing/fuzz_lzxpress.c new file mode 100644 index 0000000..ddc7aa0 --- /dev/null +++ b/lib/fuzzing/fuzz_lzxpress.c @@ -0,0 +1,35 @@ +/* + Fuzzing for lzxpress_decompress + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "lzxpress.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + static uint8_t output[1024 * 1024] = {0}; + + lzxpress_decompress(buf, len, output, sizeof(output)); + + return 0; +} diff --git a/lib/fuzzing/fuzz_lzxpress_compress.c b/lib/fuzzing/fuzz_lzxpress_compress.c new file mode 100644 index 0000000..9e5c647 --- /dev/null +++ b/lib/fuzzing/fuzz_lzxpress_compress.c @@ -0,0 +1,35 @@ +/* + Fuzzing for lzxpress_decompress + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "lzxpress.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + static uint8_t output[1024 * 1024] = {0}; + + lzxpress_compress(buf, len, output, sizeof(output)); + + return 0; +} diff --git a/lib/fuzzing/fuzz_lzxpress_huffman_compress.c b/lib/fuzzing/fuzz_lzxpress_huffman_compress.c new file mode 100644 index 0000000..165244c --- /dev/null +++ b/lib/fuzzing/fuzz_lzxpress_huffman_compress.c @@ -0,0 +1,58 @@ +/* + Fuzzing for lzxpress_huffman_compress_talloc + Copyright (C) Michael Hanselmann 2019 + Copyright (C) Douglas Bagnall 2022 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "compression/lzxpress_huffman.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +#define MAX_SIZE (1024 * 1024) + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + static uint8_t *output; + size_t output_len; + TALLOC_CTX *mem_ctx = NULL; + struct lzxhuff_compressor_mem cmp_mem; + + /* + * The round-trip fuzzer checks the compressor with an unconstrained + * output buffer; here we see what happens if the buffer is possibly too + * small. + */ + if (len < 3) { + return 0; + } + output_len = MIN(MAX_SIZE, buf[0] | (buf[1] << 8) | (buf[2] << 16)); + buf += 3; + len -= 3; + mem_ctx = talloc_new(NULL); + + output = talloc_array(mem_ctx, uint8_t, output_len); + + lzxpress_huffman_compress(&cmp_mem, buf, len, output, output_len); + + talloc_free(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/fuzz_lzxpress_huffman_decompress.c b/lib/fuzzing/fuzz_lzxpress_huffman_decompress.c new file mode 100644 index 0000000..d475ff6 --- /dev/null +++ b/lib/fuzzing/fuzz_lzxpress_huffman_decompress.c @@ -0,0 +1,48 @@ +/* + Fuzzing for lzxpress_decompress + Copyright (C) Michael Hanselmann 2019 + Copyright (C) Douglas Bagnall 2022 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "compression/lzxpress_huffman.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +static uint8_t output[1024 * 1024] = {0}; + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + size_t target_len; + if (len < 4) { + return 0; + } + /* + * An exact target length is required, which we store in the first 24 + * bits. + */ + target_len = MIN(sizeof(output), buf[0] | (buf[1] << 8) | (buf[2] << 16)); + buf += 3; + len -= 3; + + lzxpress_huffman_decompress(buf, len, output, target_len); + + return 0; +} diff --git a/lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c b/lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c new file mode 100644 index 0000000..adb8fbf --- /dev/null +++ b/lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c @@ -0,0 +1,68 @@ +/* + Fuzzing for lzxpress_huffman{_decompress,_compress} round trip + Copyright (C) Michael Hanselmann 2019 + Copyright (C) Douglas Bagnall 2022 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "compression/lzxpress_huffman.h" + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + /* + * we allow compressed to be 25% bigger than decompressed. + */ + static uint8_t compressed[1024 * (1024 + 256)]; + static uint8_t decompressed[1024 * 1024]; + ssize_t compressed_size; + ssize_t decompressed_size; + struct lzxhuff_compressor_mem cmp; + + if (len > sizeof(decompressed) || len == 0) { + return 0; + } + + compressed_size = lzxpress_huffman_compress(&cmp, + buf, + len, + compressed, + sizeof(compressed)); + if (compressed_size < 0) { + abort(); + } + + decompressed_size = lzxpress_huffman_decompress(compressed, + compressed_size, + decompressed, + len); + + if (decompressed_size != len) { + abort(); + } + if (memcmp(buf, decompressed, len) != 0) { + abort(); + } + + return 0; +} diff --git a/lib/fuzzing/fuzz_lzxpress_round_trip.c b/lib/fuzzing/fuzz_lzxpress_round_trip.c new file mode 100644 index 0000000..a4043c2 --- /dev/null +++ b/lib/fuzzing/fuzz_lzxpress_round_trip.c @@ -0,0 +1,56 @@ +/* + Fuzzing for lzxpress_decompress + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "lzxpress.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + static uint8_t compressed[1024 * 1280] = {0}; + static uint8_t decompressed[1024 * 1024] = {0}; + ssize_t compressed_size; + ssize_t decompressed_size; + + if (len > sizeof(decompressed)) { + return 0; + } + + compressed_size = lzxpress_compress(buf, len, + compressed, sizeof(compressed)); + if (compressed_size < 0) { + abort(); + } + + decompressed_size = lzxpress_decompress(compressed, compressed_size, + decompressed, sizeof(decompressed)); + + if (decompressed_size != len) { + abort(); + } + if (memcmp(buf, decompressed, len) != 0) { + abort(); + } + + return 0; +} diff --git a/lib/fuzzing/fuzz_ndr_X.c b/lib/fuzzing/fuzz_ndr_X.c new file mode 100644 index 0000000..16109cc --- /dev/null +++ b/lib/fuzzing/fuzz_ndr_X.c @@ -0,0 +1,337 @@ +/* + Unix SMB/CIFS implementation. + Fuzzer for pidl-generated NDR pipes. + Copyright (C) Andrew Tridgell 2003 + Copyright (C) Jelmer Vernooij 2006 + Copyright (C) Andrew Bartlett 2019 + Copyright (C) Catalyst.NET Ltd 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "system/filesys.h" +#include "system/locale.h" +#include "librpc/ndr/libndr.h" +#include "librpc/gen_ndr/ndr_dcerpc.h" +#include "util/byteorder.h" +#include "fuzzing/fuzzing.h" + +extern const struct ndr_interface_table FUZZ_PIPE_TABLE; + +#define FLAG_NDR64 4 + +enum { + TYPE_STRUCT = 0, + TYPE_IN, + TYPE_OUT +}; + +/* + * header design (little endian): + * + * struct { + * uint16_t flags; + * uint16_t function_or_struct_no; + * }; + */ + +/* + * We want an even number here to ensure 4-byte alignment later + * not just for efficiency but because the fuzzers are known to guess + * that numbers will be 4-byte aligned + */ +#define HEADER_SIZE 4 + +#define INVALID_FLAGS (~(FLAG_NDR64 | 3)) + +static const struct ndr_interface_call *find_function( + const struct ndr_interface_table *p, + unsigned int function_no) +{ + if (function_no >= p->num_calls) { + return NULL; + } + return &p->calls[function_no]; +} + +/* + * Get a public structure by number and return it as if it were + * a function. + */ +static const struct ndr_interface_call *find_struct( + const struct ndr_interface_table *p, + unsigned int struct_no, + struct ndr_interface_call *out_buffer) +{ + const struct ndr_interface_public_struct *s = NULL; + + if (struct_no >= p->num_public_structs) { + return NULL; + } + + s = &p->public_structs[struct_no]; + + *out_buffer = (struct ndr_interface_call) { + .name = s->name, + .struct_size = s->struct_size, + .ndr_pull = s->ndr_pull, + .ndr_push = s->ndr_push, + .ndr_print = s->ndr_print + }; + return out_buffer; +} + + +static NTSTATUS pull_chunks(struct ndr_pull *ndr_pull, + const struct ndr_interface_call_pipes *pipes) +{ + enum ndr_err_code ndr_err; + uint32_t i; + + for (i=0; i < pipes->num_pipes; i++) { + while (true) { + void *saved_mem_ctx; + uint32_t *count; + void *c; + + c = talloc_zero_size(ndr_pull, pipes->pipes[i].chunk_struct_size); + if (c == NULL) { + return NT_STATUS_NO_MEMORY; + } + /* + * Note: the first struct member is always + * 'uint32_t count;' + */ + count = (uint32_t *)c; + + saved_mem_ctx = ndr_pull->current_mem_ctx; + ndr_pull->current_mem_ctx = c; + ndr_err = pipes->pipes[i].ndr_pull(ndr_pull, NDR_SCALARS, c); + ndr_pull->current_mem_ctx = saved_mem_ctx; + + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + talloc_free(c); + return ndr_map_error2ntstatus(ndr_err); + } + if (*count == 0) { + talloc_free(c); + break; + } + talloc_free(c); + } + } + + return NT_STATUS_OK; +} + +static void ndr_print_nothing(struct ndr_print *ndr, const char *format, ...) +{ + /* + * This is here so that we walk the tree but don't output anything. + * This helps find buggy ndr_print routines + */ + + /* + * TODO: consider calling snprinf() to find strings without NULL + * terminators (for example) + */ +} + + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + uint8_t type; + ndr_flags_type pull_push_print_flags; + uint16_t fuzz_packet_flags, function; + TALLOC_CTX *mem_ctx = NULL; + libndr_flags ndr_flags = 0; + struct ndr_push *ndr_push; + enum ndr_err_code ndr_err; + struct ndr_interface_call f_buffer; + const struct ndr_interface_call *f = NULL; + NTSTATUS status; + +/* + * This allows us to build binaries to fuzz just one target function + * + * In this mode the input becomes the 'stub data', there is no prefix. + * + * There is no NDR64 support in this mode at this time. + */ +#if defined(FUZZ_TYPE) && defined(FUZZ_FUNCTION) +#undef HEADER_SIZE +#define HEADER_SIZE 0 + fuzz_packet_flags = 0; + type = FUZZ_TYPE; + function = FUZZ_FUNCTION; +#else + if (size < HEADER_SIZE) { + /* + * the first few bytes decide what is being fuzzed -- + * if they aren't all there we do nothing. + */ + return 0; + } + + fuzz_packet_flags = SVAL(data, 0); + if (fuzz_packet_flags & INVALID_FLAGS) { + return 0; + } + + function = SVAL(data, 2); + + type = fuzz_packet_flags & 3; + +#ifdef FUZZ_TYPE + /* + * Fuzz targets should have as small an interface as possible. + * This allows us to create 3 binaries for most pipes, + * TYPE_IN, TYPE_OUT and TYPE_STRUCT + * + * We keep the header format, and just exit early if it does + * not match. + */ + if (type != FUZZ_TYPE) { + return 0; + } +#endif +#endif + + switch (type) { + case TYPE_STRUCT: + pull_push_print_flags = NDR_SCALARS|NDR_BUFFERS; + f = find_struct(&FUZZ_PIPE_TABLE, function, &f_buffer); + break; + case TYPE_IN: + pull_push_print_flags = NDR_IN; + f = find_function(&FUZZ_PIPE_TABLE, function); + break; + case TYPE_OUT: + pull_push_print_flags = NDR_OUT; + f = find_function(&FUZZ_PIPE_TABLE, function); + break; + default: + return 0; + } + + if (f == NULL) { + return 0; + } + if (fuzz_packet_flags & FLAG_NDR64) { + ndr_flags |= LIBNDR_FLAG_NDR64; + } + + mem_ctx = talloc_init("ndrfuzz"); + + { + /* + * f->struct_size is well-controlled, it is essentially + * defined in the IDL + */ + uint8_t st[f->struct_size]; + + DATA_BLOB blob = data_blob_const(data + HEADER_SIZE, + size - HEADER_SIZE); + struct ndr_pull *ndr_pull = ndr_pull_init_blob(&blob, + mem_ctx); + + if (ndr_pull == NULL) { + perror("ndr_pull_init_blob"); + TALLOC_FREE(mem_ctx); + return 0; + } + + /* + * We must initialise the buffer (even if we would + * prefer not to for the sake of eg valgrind) as + * otherwise the special handler for 'out pointer with + * [size_is()] refers to in value with [ref]' fails to + * trigger + */ + memset(st, '\0', sizeof(st)); + + ndr_pull->flags |= LIBNDR_FLAG_REF_ALLOC; + ndr_pull->global_max_recursion = 128; + + if (type == TYPE_OUT) { + status = pull_chunks(ndr_pull, + &f->out_pipes); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(mem_ctx); + return 0; + } + } + + ndr_err = f->ndr_pull(ndr_pull, + pull_push_print_flags, + st); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + TALLOC_FREE(mem_ctx); + return 0; + } + + if (type == TYPE_IN) { + status = pull_chunks(ndr_pull, + &f->in_pipes); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(mem_ctx); + return 0; + } + } + + ndr_push = ndr_push_init_ctx(mem_ctx); + if (ndr_push == NULL) { + TALLOC_FREE(mem_ctx); + return 0; + } + + ndr_push->flags |= ndr_flags; + + /* + * Now push what was pulled, just in case we generated an + * invalid structure in memory, this should notice + */ + ndr_err = f->ndr_push(ndr_push, + pull_push_print_flags, + st); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + TALLOC_FREE(mem_ctx); + return 0; + } + + { + struct ndr_print *ndr_print = talloc_zero(mem_ctx, struct ndr_print); + ndr_print->print = ndr_print_nothing; + ndr_print->depth = 1; + + /* + * Finally print (to nowhere) the structure, this may also + * notice invalid memory + */ + f->ndr_print(ndr_print, + f->name, + pull_push_print_flags, + st); + } + } + TALLOC_FREE(mem_ctx); + + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_nmblib_parse_packet.c b/lib/fuzzing/fuzz_nmblib_parse_packet.c new file mode 100644 index 0000000..c8a2d03 --- /dev/null +++ b/lib/fuzzing/fuzz_nmblib_parse_packet.c @@ -0,0 +1,62 @@ +/* + Fuzz NMB parse_packet + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "../../source3/include/includes.h" +#include "libsmb/libsmb.h" +#include "libsmb/nmblib.h" +#include "fuzzing/fuzzing.h" + +#define PORT 138 +#define MAX_LENGTH (1024 * 1024) +char buf[MAX_LENGTH + 1]; + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + struct packet_struct *p = NULL; + struct in_addr ip = { + 0x0100007f /* 127.0.0.1 */ + }; + + p = parse_packet((char *)input, + len, + NMB_PACKET, + ip, + PORT); + /* + * We expect NULL (parse failure) most of the time. + * + * When it is not NULL we want to ensure the parsed packet is + * reasonably sound. + */ + + if (p != NULL) { + struct nmb_packet *nmb = &p->packet.nmb; + pull_ascii_nstring(buf, MAX_LENGTH, + nmb->question.question_name.name); + build_packet(buf, MAX_LENGTH, p); + free_packet(p); + } + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_oLschema2ldif.c b/lib/fuzzing/fuzz_oLschema2ldif.c new file mode 100644 index 0000000..3bff8cf --- /dev/null +++ b/lib/fuzzing/fuzz_oLschema2ldif.c @@ -0,0 +1,71 @@ +/* + Fuzzing for oLschema2ldif + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing.h" +#include "utils/oLschema2ldif/lib.h" + +static FILE *devnull; + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + devnull = fopen("/dev/null", "w"); + + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + TALLOC_CTX *mem_ctx; + struct conv_options opt; + + if (len == 0) { + /* + * Otherwise fmemopen() will return null and set errno + * to EINVAL + */ + return 0; + } + + mem_ctx = talloc_init(__FUNCTION__); + if (mem_ctx == NULL) { + return 0; + } + + opt.in = fmemopen(buf, len, "r"); + opt.out = devnull; + opt.ldb_ctx = ldb_init(mem_ctx, NULL); + if (opt.ldb_ctx == NULL || opt.in == NULL) { + talloc_free(mem_ctx); + return 0; + } + + opt.basedn = ldb_dn_new(mem_ctx, opt.ldb_ctx, ""); + if (opt.basedn == NULL) { + talloc_free(mem_ctx); + return 0; + } + + process_file(mem_ctx, &opt); + + fclose(opt.in); + + talloc_free(mem_ctx); + + return 0; +} diff --git a/lib/fuzzing/fuzz_parse_lpq_entry.c b/lib/fuzzing/fuzz_parse_lpq_entry.c new file mode 100644 index 0000000..3537ce5 --- /dev/null +++ b/lib/fuzzing/fuzz_parse_lpq_entry.c @@ -0,0 +1,65 @@ +/* + Fuzzing parse_lpq_entry + Copyright (C) Douglas Bagnall 2021 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "../../source3/include/includes.h" +#include "printing.h" +#include "fuzzing/fuzzing.h" + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +#define MAX_LENGTH (1024 * 1024) +char line[MAX_LENGTH + 1]; + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + enum printing_types printing_type; + print_queue_struct pq_buf = {0}; + print_status_struct status = {0}; + bool first; + unsigned x; + TALLOC_CTX *frame = NULL; + + if (len < 1 || len > MAX_LENGTH) { + return 0; + } + + x = input[0]; + input++; + len--; + + /* There are 14 types, default goes to bsd */ + printing_type = x & 15; + first = (x & 16) ? true : false; + + memcpy(line, input, len); + line[len] = '\0'; + + /* parse_lpq_bsd requires a stackframe */ + frame = talloc_stackframe(); + + parse_lpq_entry(printing_type, + line, + &pq_buf, /* out */ + &status, /* out */ + first); + talloc_free(frame); + return 0; +} diff --git a/lib/fuzzing/fuzz_reg_parse.c b/lib/fuzzing/fuzz_reg_parse.c new file mode 100644 index 0000000..bbc62ea --- /dev/null +++ b/lib/fuzzing/fuzz_reg_parse.c @@ -0,0 +1,46 @@ +/* + * Fuzzing for reg_parse + * Copyright (C) Michael Hanselmann 2019 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "lib/util/fault.h" +#include "registry.h" +#include "registry/reg_parse.h" + +static FILE *fp; + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + fp = tmpfile(); + + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + const reg_parse_callback cb = {0}; + + rewind(fp); + (void)fwrite(buf, len, 1, fp); + (void)fflush(fp); + rewind(fp); + + (void)reg_parse_fd(fileno(fp), &cb, ""); + + return 0; +} diff --git a/lib/fuzzing/fuzz_regfio.c b/lib/fuzzing/fuzz_regfio.c new file mode 100644 index 0000000..588efb0 --- /dev/null +++ b/lib/fuzzing/fuzz_regfio.c @@ -0,0 +1,68 @@ +/* + * Unix SMB/CIFS implementation. + * Windows NT registry I/O library + * Copyright (C) Michael Hanselmann 2019 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "system/filesys.h" +#include "lib/util/fault.h" +#include "registry/reg_objects.h" +#include "registry/regfio.h" + +static FILE *fp; +static char filename[128]; + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + fp = tmpfile(); + + (void)snprintf(filename, sizeof(filename), "/proc/self/fd/%d", fileno(fp)); + + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + REGF_FILE* regfile; + REGF_NK_REC *nk, *subkey; + + rewind(fp); + (void)fwrite(buf, len, 1, fp); + (void)fflush(fp); + + regfile = regfio_open(filename, O_RDONLY, 0600); + if (!regfile) { + goto out; + } + + regfile->ignore_checksums = true; + + nk = regfio_rootkey(regfile); + if (nk != NULL) { + nk->subkey_index = 0; + while ((subkey = regfio_fetch_subkey(regfile, nk))) { + } + } + +out: + if (regfile != NULL) { + regfio_close(regfile); + } + + return 0; +} diff --git a/lib/fuzzing/fuzz_sddl_access_check.c b/lib/fuzzing/fuzz_sddl_access_check.c new file mode 100644 index 0000000..a7bf7b3 --- /dev/null +++ b/lib/fuzzing/fuzz_sddl_access_check.c @@ -0,0 +1,206 @@ +/* + Fuzz access check using SDDL strings and a known token + Copyright (C) Catalyst IT 2023 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "replace.h" +#include "libcli/security/security.h" +#include "libcli/security/conditional_ace.h" +#include "libcli/security/claims-conversions.h" +#include "lib/util/attr.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "librpc/gen_ndr/ndr_conditional_ace.h" +#include "lib/util/bytearray.h" +#include "fuzzing/fuzzing.h" + + +static struct security_token token = {0}; + +static struct dom_sid dom_sid = {0}; + +/* + * For this one we initialise a security token to have a few claims + * and SIDs. The fuzz strings contain SDDL that will be tested against + * this token in se_access_check() or sec_access_check_ds() -- + * supposing they compile. + */ + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + size_t i; + TALLOC_CTX *mem_ctx = talloc_new(NULL); + struct dom_sid *sid = NULL; + + struct claim_def { + const char *type; + const char *name; + const char *claim_sddl; + } claims[] = { + { + "user", + "shoe size", + "44" + }, + { + "user", + "©", + "{\"unknown\", \"\", \" ←ā\"}" + }, + { + "device", + "©", + "{\"unknown\", \" \", \" ←ā\"}" + }, + { + "device", + "least favourite groups", + "{SID(S-1-1-0),SID(S-1-5-3),SID(S-1-57777-333-33-33-2)}" + }, + { + "local", + "birds", + "{\"tern\"}" + }, + }; + + const char * device_sids[] = { + "S-1-1-0", + "S-1-333-66", + "S-1-2-3-4-5-6-7-8-9", + }; + const char * user_sids[] = { + "S-1-333-66", + "S-1-16-8448", + "S-1-9-8-7", + }; + + for (i = 0; i < ARRAY_SIZE(user_sids); i++) { + sid = sddl_decode_sid(mem_ctx, &user_sids[i], NULL); + if (sid == NULL) { + abort(); + } + add_sid_to_array(mem_ctx, sid, + &token.sids, + &token.num_sids); + } + + for (i = 0; i < ARRAY_SIZE(device_sids); i++) { + sid = sddl_decode_sid(mem_ctx, &device_sids[i], NULL); + if (sid == NULL) { + abort(); + } + add_sid_to_array(mem_ctx, sid, + &token.device_sids, + &token.num_device_sids); + } + + for (i = 0; i < ARRAY_SIZE(claims); i++) { + struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *claim = NULL; + struct claim_def c = claims[i]; + + claim = parse_sddl_literal_as_claim(mem_ctx, + c.name, + c.claim_sddl); + if (claim == NULL) { + abort(); + } + add_claim_to_token(mem_ctx, &token, claim, c.type); + } + + /* we also need a global domain SID */ + string_to_sid(&dom_sid, device_sids[2]); + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + struct security_descriptor *sd = NULL; + uint32_t access_desired; + uint32_t access_granted; + const char *sddl; + ssize_t i; + if (len < 5) { + return 0; + } + access_desired = PULL_LE_U32(input + len - 4, 0); + + /* + * check there is a '\0'. + * + * Note this allows double-dealing for the last 4 bytes: they are used + * as the access_desired mask (see just above) but also *could* be + * part of the sddl string. But this doesn't matter, for three + * reasons: + * + * 1. the desired access mask doesn't usually matter much. + * + * 2. the final '\0' is rarely the operative one. Usually the + * effective string ends a long time before the end of the input, and + * the tail is just junk that comes along for the ride. + * + * 3. Even if there is a case where the end of the SDDL is part of the + * mask, the evolution strategy is very likely to try a different mask, + * because it likes to add junk on the end. + * + * But still, you ask, WHY? So that the seeds from here can be shared + * back and forth with the fuzz_sddl_parse seeds, which have the same + * form of a null-terminated-string-with-trailing-junk. If we started + * the loop at `len - 5` instead of `len - 1`, there might be + * interesting seeds that are valid there that would fail here. That's + * all. + */ + for (i = len - 1; i >= 0; i--) { + if (input[i] == 0) { + break; + } + } + if (i < 0) { + return 0; + } + + sddl = (const char *)input; + mem_ctx = talloc_new(NULL); + + sd = sddl_decode(mem_ctx, sddl, &dom_sid); + if (sd == NULL) { + goto end; + } + +#ifdef FUZZ_SEC_ACCESS_CHECK_DS + /* + * The sec_access_check_ds() function has two arguments not found in + * se_access_check, and also not found in our fuzzing examples. + * + * One is a struct object_tree, which is used for object ACE types. + * The other is a SID, which is used as a default if an ACE lacks a + * SID. + */ + sec_access_check_ds(sd, + &token, + access_desired, + &access_granted, + NULL, + NULL); +#else + se_access_check(sd, &token, access_desired, &access_granted); +#endif + +end: + talloc_free(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/fuzz_sddl_conditional_ace.c b/lib/fuzzing/fuzz_sddl_conditional_ace.c new file mode 100644 index 0000000..636ebf1 --- /dev/null +++ b/lib/fuzzing/fuzz_sddl_conditional_ace.c @@ -0,0 +1,121 @@ +/* + Fuzz sddl conditional ace decoding and encoding + Copyright (C) Catalyst IT 2023 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "replace.h" +#include "libcli/security/security.h" +#include "lib/util/attr.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/conditional_ace.h" +#include "librpc/gen_ndr/conditional_ace.h" +#include "fuzzing/fuzzing.h" + + +#define MAX_LENGTH (1024 * 1024 - 1) +static char sddl_string[MAX_LENGTH + 1] = {0}; + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + bool ok; + struct ace_condition_script *s1 = NULL; + struct ace_condition_script *s2 = NULL; + const char *message = NULL; + size_t message_offset; + const char *resddl = NULL; + DATA_BLOB e1, e2, e3; + size_t length; + + if (len > MAX_LENGTH) { + return 0; + } + + memcpy(sddl_string, input, len); + sddl_string[len] = '\0'; + + mem_ctx = talloc_new(NULL); + + s1 = ace_conditions_compile_sddl(mem_ctx, + ACE_CONDITION_FLAG_ALLOW_DEVICE, + sddl_string, + &message, + &message_offset, + &length); + if (s1 == NULL) { + /* could assert message is non-empty */ + TALLOC_FREE(mem_ctx); + return 0; + } + + ok = conditional_ace_encode_binary(mem_ctx, s1, &e1); + if (! ok) { + abort(); + } + + s2 = parse_conditional_ace(mem_ctx, e1); + if (s2 == NULL) { + abort(); + } + + ok = conditional_ace_encode_binary(mem_ctx, s2, &e2); + if (! ok) { + abort(); + } + if (data_blob_cmp(&e1, &e2) != 0) { + abort(); + } + + /* + * We know now the SDDL representation compiles to a valid structure + * that survives a round trip through serialisation. + * + * A remaining question is whether it can be re-rendered as SDDL that + * compiles to the same blob. + */ + resddl = sddl_from_conditional_ace(mem_ctx, s2); + if (resddl == NULL) { + abort(); + } + + s2 = ace_conditions_compile_sddl(mem_ctx, + ACE_CONDITION_FLAG_ALLOW_DEVICE, + resddl, + &message, + &message_offset, + &length); + if (s2 == NULL) { + abort(); + } + + ok = conditional_ace_encode_binary(mem_ctx, s2, &e3); + if (! ok) { + abort(); + } + if (data_blob_cmp(&e1, &e3) != 0) { + abort(); + } + + TALLOC_FREE(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/fuzz_sddl_parse.c b/lib/fuzzing/fuzz_sddl_parse.c new file mode 100644 index 0000000..05900b0 --- /dev/null +++ b/lib/fuzzing/fuzz_sddl_parse.c @@ -0,0 +1,110 @@ +/* + Fuzz sddl decoding and encoding + Copyright (C) Catalyst IT 2023 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "libcli/security/security.h" +#include "librpc/gen_ndr/conditional_ace.h" +#include "fuzzing/fuzzing.h" +#include "util/charset/charset.h" + +#define MAX_LENGTH (100 * 1024 - 1) +static char sddl_string[MAX_LENGTH + 1] = {0}; +static struct dom_sid dom_sid = {0}; + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + string_to_sid(&dom_sid, + "S-1-5-21-2470180966-3899876309-2637894779"); + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + struct security_descriptor *sd1 = NULL; + struct security_descriptor *sd2 = NULL; + char *result = NULL; + bool ok; + + if (len > MAX_LENGTH) { + return 0; + } + + memcpy(sddl_string, input, len); + sddl_string[len] = '\0'; + + mem_ctx = talloc_new(NULL); + + sd1 = sddl_decode(mem_ctx, sddl_string, &dom_sid); + if (sd1 == NULL) { + goto end; + } + result = sddl_encode(mem_ctx, sd1, &dom_sid); + if (result == NULL) { + /* + * Because Samba currently doesn't enforce strict + * utf-8 parsing, illegal utf-8 sequences in + * sddl_string could have ferried bad characters + * through into the security descriptor conditions + * that we then find we can't encode. + * + * The proper solution is strict UTF-8 enforcement in + * sddl_decode, but for now we forgive unencodable + * security descriptors made from bad utf-8. + */ + size_t byte_len, char_len, utf16_len; + ok = utf8_check(sddl_string, len, + &byte_len, &char_len, &utf16_len); + if (!ok) { + goto end; + } + /* utf-8 was fine, but we couldn't encode! */ + abort(); + } + + sd2 = sddl_decode(mem_ctx, result, &dom_sid); + if (sd2 == NULL) { + if (strlen(result) > CONDITIONAL_ACE_MAX_LENGTH) { + /* + * This could fail if a unicode string or + * attribute name that contains escapable + * bytes (e.g '\x0b') in an unescaped form in + * the original string ends up with them in + * the escaped form ("%000b") in the result + * string, making the entire attribute name + * too long for the arbitrary limit we set for + * SDDL attribute names. + * + * We could increase that arbitrary limit (to, + * say, CONDITIONAL_ACE_MAX_LENGTH * 5), but + * that is getting very far from real world + * needs. + */ + goto end; + } + abort(); + } + ok = security_descriptor_equal(sd1, sd2); + if (!ok) { + abort(); + } +end: + talloc_free(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/fuzz_security_token_vs_descriptor.c b/lib/fuzzing/fuzz_security_token_vs_descriptor.c new file mode 100644 index 0000000..f9b2552 --- /dev/null +++ b/lib/fuzzing/fuzz_security_token_vs_descriptor.c @@ -0,0 +1,78 @@ +/* + Fuzz a security token and descriptor through an access check + Copyright (C) Catalyst IT 2023 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "replace.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" +#include "fuzzing/fuzzing.h" + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + struct security_token_descriptor_fuzzing_pair p = {0}; + enum ndr_err_code ndr_err; + uint32_t access_granted; + + DATA_BLOB blob = { + .data = input, + .length = len + }; + + mem_ctx = talloc_new(NULL); + + ndr_err = ndr_pull_struct_blob( + &blob, mem_ctx, &p, + (ndr_pull_flags_fn_t)ndr_pull_security_token_descriptor_fuzzing_pair); + + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + goto end; + } + +#ifdef FUZZ_SEC_ACCESS_CHECK_DS + /* + * The sec_access_check_ds() function has two arguments not found in + * se_access_check, and also not found in our fuzzing examples. + * + * One is a struct object_tree, which is used for object ACE types. + * The other is a SID, which is used as a default if an ACE lacks a + * SID. + */ + sec_access_check_ds(&p.sd, + &p.token, + p.access_desired, + &access_granted, + NULL, + NULL); +#else + se_access_check(&p.sd, + &p.token, + p.access_desired, + &access_granted); +#endif + +end: + talloc_free(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/fuzz_sess_crypt_blob.c b/lib/fuzzing/fuzz_sess_crypt_blob.c new file mode 100644 index 0000000..bed697e --- /dev/null +++ b/lib/fuzzing/fuzz_sess_crypt_blob.c @@ -0,0 +1,55 @@ +/* + Fuzzing sess_*crypt_blob + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "libcli/auth/libcli_auth.h" +#include "session.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + DATA_BLOB blob, session_key, out; + size_t slen; + if (len < 1) { + return 0; + } + + slen = input[0]; + if (len < slen + 1) { + return 0; + } + + session_key.data = input + 1; + session_key.length = slen; + blob.data = input + 1 + slen; + blob.length = len - slen - 1; + + mem_ctx = talloc_new(NULL); + + out = sess_encrypt_blob(mem_ctx, &blob, &session_key); + sess_decrypt_blob(mem_ctx, &blob, &session_key, &out); + + TALLOC_FREE(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/fuzz_stable_sort.c b/lib/fuzzing/fuzz_stable_sort.c new file mode 100644 index 0000000..e2195cb --- /dev/null +++ b/lib/fuzzing/fuzz_stable_sort.c @@ -0,0 +1,88 @@ +/* + Fuzzing for stable_sort + Copyright © Catalyst IT + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "talloc.h" +#include "util/stable_sort.h" + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +#define CMP_FN(type) static int cmp_ ## type (type *a, type *b) \ +{\ + if (*a > *b) {\ + return 1;\ + }\ + if (*a < *b) {\ + return -1;\ + }\ + return 0;\ +} + +CMP_FN(uint8_t) +CMP_FN(uint16_t) +CMP_FN(uint32_t) +CMP_FN(uint64_t) + +#define MAX_SIZE (1024 * 1024) + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + samba_compare_fn_t fn; + size_t s, i; + uint8_t buf2[MAX_SIZE]; + + if (len < 1 || len > MAX_SIZE) { + return 0; + } + s = 1 << (buf[0] & 3); + if (s == 1) { + fn = (samba_compare_fn_t)cmp_uint8_t; + } else if (s == 2) { + fn = (samba_compare_fn_t)cmp_uint16_t; + } else if (s == 4) { + fn = (samba_compare_fn_t)cmp_uint32_t; + } else { + fn = (samba_compare_fn_t)cmp_uint64_t; + } + buf++; + len--; + len -= len & (s - 1); + + mem_ctx = talloc_new(NULL); + memcpy(buf2, buf, len); + + stable_sort_talloc(mem_ctx, buf2, len / s, s, fn); + + talloc_free(mem_ctx); + + for (i = s; i < len; i += s) { + int c = fn(&buf2[i - s], &buf2[i]); + if (c > 0) { + abort(); + } + } + + return 0; +} diff --git a/lib/fuzzing/fuzz_stable_sort_r.c b/lib/fuzzing/fuzz_stable_sort_r.c new file mode 100644 index 0000000..68be73b --- /dev/null +++ b/lib/fuzzing/fuzz_stable_sort_r.c @@ -0,0 +1,69 @@ +/* + Fuzzing for stable_sort + Copyright © Catalyst IT + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "util/stable_sort.h" + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +/* + * For a "context" we use a byte that the values are XORed with before + * comparison, for a non-obvious but stable sort order. + */ +static int cmp_int8(int8_t *a, int8_t *b, int8_t *c) +{ + return (*a ^ *c) - (*b ^ *c); +} + + +#define MAX_SIZE (1024 * 1024) + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + size_t i; + int8_t buf2[MAX_SIZE]; + int8_t aux[MAX_SIZE]; + int8_t context; + + if (len < 1 || len > MAX_SIZE) { + return 0; + } + context = (int8_t)buf[0]; + buf++; + len--; + + memcpy(buf2, buf, len); + + stable_sort_r(buf2, aux, len, 1, + (samba_compare_with_context_fn_t)cmp_int8, + &context); + + for (i = 1; i < len; i++) { + int c = cmp_int8(&buf2[i - 1], &buf2[i], &context); + if (c > 0) { + abort(); + } + } + + return 0; +} diff --git a/lib/fuzzing/fuzz_tiniparser.c b/lib/fuzzing/fuzz_tiniparser.c new file mode 100644 index 0000000..a5c9310 --- /dev/null +++ b/lib/fuzzing/fuzz_tiniparser.c @@ -0,0 +1,51 @@ +/* + Fuzzing for trivial smb.conf parsing code. + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing.h" +#include "lib/util/tiniparser.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + FILE *fp = NULL; + struct tiniparser_dictionary *d = NULL; + + if (len == 0) { + /* + * Otherwise fmemopen() will return null and set errno + * to EINVAL + */ + return 0; + } + + fp = fmemopen(buf, len, "r"); + + d = tiniparser_load_stream(fp); + if (d != NULL) { + tiniparser_freedict(d); + } + + fclose(fp); + + return 0; +} diff --git a/lib/fuzzing/fuzzing.c b/lib/fuzzing/fuzzing.c new file mode 100644 index 0000000..f0d7fb4 --- /dev/null +++ b/lib/fuzzing/fuzzing.c @@ -0,0 +1,21 @@ +/* + Unix SMB/CIFS implementation. + Fuzzing utility functions + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "fuzzing/fuzzing.h" diff --git a/lib/fuzzing/fuzzing.h b/lib/fuzzing/fuzzing.h new file mode 100644 index 0000000..0d3cb70 --- /dev/null +++ b/lib/fuzzing/fuzzing.h @@ -0,0 +1,30 @@ +/* + Unix SMB/CIFS implementation. + Fuzzing utility functions + Copyright (C) Michael Hanselmann 2019 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#ifndef _SAMBA_FUZZING_H +#define _SAMBA_FUZZING_H + +#include +#include + +/* Prototypes for fuzzing interface */ +int LLVMFuzzerInitialize(int *argc, char ***argv); +int LLVMFuzzerTestOneInput(const uint8_t * buf, size_t len); + +#endif /* _SAMBA_FUZZING_H */ diff --git a/lib/fuzzing/oss-fuzz/build_image.sh b/lib/fuzzing/oss-fuzz/build_image.sh new file mode 100755 index 0000000..62a626b --- /dev/null +++ b/lib/fuzzing/oss-fuzz/build_image.sh @@ -0,0 +1,7 @@ +#!/bin/sh -e + +DIST=ubuntu2004 +SCRIPT_DIR=$(dirname $0) + +$SCRIPT_DIR/../../../bootstrap/generated-dists/$DIST/bootstrap.sh +$SCRIPT_DIR/../../../bootstrap/generated-dists/$DIST/locale.sh diff --git a/lib/fuzzing/oss-fuzz/build_samba.sh b/lib/fuzzing/oss-fuzz/build_samba.sh new file mode 100755 index 0000000..90c1733 --- /dev/null +++ b/lib/fuzzing/oss-fuzz/build_samba.sh @@ -0,0 +1,25 @@ +#!/bin/sh +# +# This is not a general-purpose build script, but instead one specific +# to the Google oss-fuzz compile environment. +# +# https://google.github.io/oss-fuzz/getting-started/new-project-guide/#Requirements +# +# https://github.com/google/oss-fuzz/blob/master/infra/base-images/base-builder/README.md#provided-environment-variables +# +# This file is run by +# https://github.com/google/oss-fuzz/blob/master/projects/samba/build.sh +# which does nothing else. +# +# Additional arguments are passed to configure, to allow this to be +# tested in autobuild.py +# + +# Ensure we give good trace info, fail right away and fail with unset +# variables +set -e +set -x +set -u + +"$(dirname "${0}")"/do_build.sh "$@" +"$(dirname "${0}")"/check_build.sh "${OUT}" \ No newline at end of file diff --git a/lib/fuzzing/oss-fuzz/check_build.sh b/lib/fuzzing/oss-fuzz/check_build.sh new file mode 100755 index 0000000..487addf --- /dev/null +++ b/lib/fuzzing/oss-fuzz/check_build.sh @@ -0,0 +1,48 @@ +#!/bin/sh -eux +# +# A very simple check script to confirm we still provide binaries +# that look like the targets oss-fuzz wants. +# +# A much stronger check is available in oss-fuzz via +# infra/helper.py check_build samba +# + +# oss-fuzz provides an OUT variable, so for clarity this script +# uses the same. See build_samba.sh +OUT=$1 + +# build_samba.sh will have put a non-zero number of fuzzers here. If +# there are none, this will fail as it becomes literally fuzz_* + +seeds_found=no + +for bin in $OUT/fuzz_*; do + # we only want to look at the elf files, not the zips + if [ ${bin%_seed_corpus.zip} != $bin ]; then + continue + fi + # Confirm that the chrpath was reset to lib/ in the same directory + # as the binary. RPATH (not RUNPATH) is critical, otherwise + # libraries used by libraries won't be found on the oss-fuzz + # target host. + chrpath -l $bin | grep 'RPATH=$ORIGIN/lib' + + # Confirm that we link to at least some libraries in this + # directory (shows that the libraries were found and copied). + ldd $bin | grep "$OUT/lib" + num_libs=$(ldd $bin | grep -v ld-linux | grep -v linux-vdso | grep -v "$OUT/lib" | wc -l) + + if [ 0$num_libs -ne 0 ]; then + echo "some libraries not linked to $ORIGIN/lib, oss-fuzz will fail!" + exit 1 + fi + + if [ -f ${bin}_seed_corpus.zip ]; then + seeds_found=yes + fi +done + +if [ $seeds_found = no ]; then + echo "no seed zip files were found!" + exit 1 +fi diff --git a/lib/fuzzing/oss-fuzz/do_build.sh b/lib/fuzzing/oss-fuzz/do_build.sh new file mode 100755 index 0000000..29a6ceb --- /dev/null +++ b/lib/fuzzing/oss-fuzz/do_build.sh @@ -0,0 +1,294 @@ +#!/bin/sh +# +# This is not a general-purpose build script, but instead one specific +# to the Google oss-fuzz compile environment. +# +# https://google.github.io/oss-fuzz/getting-started/new-project-guide/#Requirements +# +# https://github.com/google/oss-fuzz/blob/master/infra/base-images/base-builder/README.md#provided-environment-variables +# +# This file is run by build_samba.sh, which is run by +# https://github.com/google/oss-fuzz/blob/master/projects/samba/build.sh +# which does nothing else. +# +# We have to push to oss-fuzz CFLAGS into the waf ADDITIONAL_CFLAGS +# as otherwise waf's configure fails linking the first test binary +# +# CFLAGS are supplied by the caller, eg the oss-fuzz compile command +# +# Additional arguments are passed to configure, to allow this to be +# tested in autobuild.py +# + +# Ensure we give good trace info, fail right away and fail with unset +# variables +set -e +set -x +set -u + +# It is critical that this script, just as the rest of Samba's GitLab +# CI docker has LANG set to en_US.utf8 (oss-fuzz fails to set this) +if [ -f /etc/default/locale ]; then + . /etc/default/locale +elif [ -f /etc/locale.conf ]; then + . /etc/locale.conf +fi +export LANG +export LC_ALL + +ADDITIONAL_CFLAGS="$CFLAGS" +export ADDITIONAL_CFLAGS +CFLAGS="" +export CFLAGS +LD="$CXX" +export LD + +# Use the system Python, not the OSS-Fuzz provided statically linked +# and instrumented Python, because we can't statically link. + +PYTHON=/usr/bin/python3 +export PYTHON + +# $SANITIZER is provided by the oss-fuzz "compile" command +# +# We need to add the waf configure option as otherwise when we also +# get (eg) -fsanitize=address via the CFLAGS we will fail to link +# correctly + +case "$SANITIZER" in +address) + SANITIZER_ARG='--address-sanitizer' + ;; +undefined) + SANITIZER_ARG='--undefined-sanitizer' + ;; +coverage) + # Thankfully clang operating as ld has no objection to the + # cc style options, so we can just set ADDITIONAL_LDFLAGS + # to ensure the coverage build is done, despite waf splitting + # the compile and link phases. + ADDITIONAL_LDFLAGS="${ADDITIONAL_LDFLAGS:-} $COVERAGE_FLAGS" + export ADDITIONAL_LDFLAGS + + SANITIZER_ARG='' + ;; +esac + +# $LIB_FUZZING_ENGINE is provided by the oss-fuzz "compile" command +# + +# --disable-new-dtags linker flag creates fuzzer binaries with RPATH +# header instead of RUNPATH header. Modern linkers use RUNPATH by +# default. +./configure -C --without-gettext --enable-debug --enable-developer \ + --enable-libfuzzer \ + $SANITIZER_ARG \ + --disable-warnings-as-errors \ + --abi-check-disable \ + "--fuzz-target-ldflags=-Wl,--disable-new-dtags $LIB_FUZZING_ENGINE" \ + --nonshared-binary=ALL \ + "$@" \ + LINK_CC="$CXX" + +make -j + +# Make a directory for the system shared libraries to be copied into +mkdir -p $OUT/lib + +# oss-fuzz would prefer for all the binaries put into $OUT to be +# statically linked. +# +# We can't static link to all the system libs with waf, so copy the +# libraries we need to $OUT/lib and set the rpath to point there. +# This is similar to how firefox handles this. +# +# NOTE on RPATH vs RUNPATH: +# +# RUNPATH appears to be the more modern version, and so modern ld.bfd +# and ld.gold only set RUNPATH. RUNPATH makes sense on most systems, +# but not for our hack. +# +# If we use RUNPATH, we can get an error like this: +# Step #6: Error occurred while running fuzz_nmblib_parse_packet: +# Step #6: /workspace/out/coverage/fuzz_nmblib_parse_packet: error while loading shared libraries: libavahi-common.so.3: cannot open shared object file: No such file or directory +# +# This is because the full contents of $OUT are copied to yet another +# host, which otherwise does not have much of linux at all. oss-fuzz +# prefers a static binary because that will 'just work', but we can't +# do that, so we need to use linker tricks. +# +# If the linker used RUNPATH (eg ld.bfd on Ubuntu 18.04 and later, ld.gold): +# * bin=fuzz_nmblib_parse_packet +# * OUT=/tmp/3/b12207/prefix/samba-fuzz +# * chrpath -r '$ORIGIN/lib' $OUT/$bin' +# * ldd $OUT/$bin +# linux-vdso.so.1 (0x00007ffd4b7a5000) +# libasan.so.5 => /tmp/3/b12207/prefix/samba-fuzz/lib/libasan.so.5 (0x00007ff25bdd0000) +# libldap_r-2.4.so.2 => /tmp/3/b12207/prefix/samba-fuzz/lib/libldap_r-2.4.so.2 (0x00007ff25bd7a000) +# liblber-2.4.so.2 => /tmp/3/b12207/prefix/samba-fuzz/lib/liblber-2.4.so.2 (0x00007ff25bd69000) +# libunwind-x86_64.so.8 => /tmp/3/b12207/prefix/samba-fuzz/lib/libunwind-x86_64.so.8 (0x00007ff25bd47000) +# libunwind.so.8 => /tmp/3/b12207/prefix/samba-fuzz/lib/libunwind.so.8 (0x00007ff25bd2a000) +# libgnutls.so.30 => /tmp/3/b12207/prefix/samba-fuzz/lib/libgnutls.so.30 (0x00007ff25bb54000) +# libdl.so.2 => /tmp/3/b12207/prefix/samba-fuzz/lib/libdl.so.2 (0x00007ff25bb4c000) +# libz.so.1 => /tmp/3/b12207/prefix/samba-fuzz/lib/libz.so.1 (0x00007ff25bb30000) +# libjansson.so.4 => /tmp/3/b12207/prefix/samba-fuzz/lib/libjansson.so.4 (0x00007ff25bb21000) +# libresolv.so.2 => /tmp/3/b12207/prefix/samba-fuzz/lib/libresolv.so.2 (0x00007ff25bb05000) +# libsystemd.so.0 => /tmp/3/b12207/prefix/samba-fuzz/lib/libsystemd.so.0 (0x00007ff25ba58000) +# libpthread.so.0 => /tmp/3/b12207/prefix/samba-fuzz/lib/libpthread.so.0 (0x00007ff25ba35000) +# libicuuc.so.66 => /tmp/3/b12207/prefix/samba-fuzz/lib/libicuuc.so.66 (0x00007ff25b84d000) +# libicui18n.so.66 => /tmp/3/b12207/prefix/samba-fuzz/lib/libicui18n.so.66 (0x00007ff25b54e000) +# libcap.so.2 => /tmp/3/b12207/prefix/samba-fuzz/lib/libcap.so.2 (0x00007ff25b545000) +# libbsd.so.0 => /tmp/3/b12207/prefix/samba-fuzz/lib/libbsd.so.0 (0x00007ff25b52b000) +# libnsl.so.1 => /tmp/3/b12207/prefix/samba-fuzz/lib/libnsl.so.1 (0x00007ff25b50e000) +# libc.so.6 => /tmp/3/b12207/prefix/samba-fuzz/lib/libc.so.6 (0x00007ff25b31c000) +# librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007ff25b2f2000) +# libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007ff25b1a3000) +# libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007ff25b188000) +# libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007ff25b16b000) +# libgssapi.so.3 => /usr/lib/x86_64-linux-gnu/libgssapi.so.3 (0x00007ff25b126000) +# liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007ff25b0fd000) +# /lib64/ld-linux-x86-64.so.2 (0x00007ff25ea0c000) +# libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007ff25afc5000) +# libidn2.so.0 => /usr/lib/x86_64-linux-gnu/libidn2.so.0 (0x00007ff25afa4000) +# libunistring.so.2 => /usr/lib/x86_64-linux-gnu/libunistring.so.2 (0x00007ff25ae22000) +# libtasn1.so.6 => /usr/lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007ff25ae0c000) +# libnettle.so.7 => /usr/lib/x86_64-linux-gnu/libnettle.so.7 (0x00007ff25add2000) +# libhogweed.so.5 => /usr/lib/x86_64-linux-gnu/libhogweed.so.5 (0x00007ff25ad9a000) +# libgmp.so.10 => /usr/lib/x86_64-linux-gnu/libgmp.so.10 (0x00007ff25ad14000) +# liblz4.so.1 => /usr/lib/x86_64-linux-gnu/liblz4.so.1 (0x00007ff25acf3000) +# libgcrypt.so.20 => /usr/lib/x86_64-linux-gnu/libgcrypt.so.20 (0x00007ff25abd5000) +# libicudata.so.66 => /usr/lib/x86_64-linux-gnu/libicudata.so.66 (0x00007ff259114000) +# libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007ff258f33000) +# libheimntlm.so.0 => /usr/lib/x86_64-linux-gnu/libheimntlm.so.0 (0x00007ff258f25000) +# libkrb5.so.26 => /usr/lib/x86_64-linux-gnu/libkrb5.so.26 (0x00007ff258e92000) +# libasn1.so.8 => /usr/lib/x86_64-linux-gnu/libasn1.so.8 (0x00007ff258deb000) +# libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007ff258de4000) +# libhcrypto.so.4 => /usr/lib/x86_64-linux-gnu/libhcrypto.so.4 (0x00007ff258dac000) +# libroken.so.18 => /usr/lib/x86_64-linux-gnu/libroken.so.18 (0x00007ff258d93000) +# libffi.so.7 => /usr/lib/x86_64-linux-gnu/libffi.so.7 (0x00007ff258d85000) +# libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007ff258d62000) +# libwind.so.0 => /usr/lib/x86_64-linux-gnu/libwind.so.0 (0x00007ff258d38000) +# libheimbase.so.1 => /usr/lib/x86_64-linux-gnu/libheimbase.so.1 (0x00007ff258d26000) +# libhx509.so.5 => /usr/lib/x86_64-linux-gnu/libhx509.so.5 (0x00007ff258cd8000) +# libsqlite3.so.0 => /usr/lib/x86_64-linux-gnu/libsqlite3.so.0 (0x00007ff258bad000) +# libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007ff258b72000) +# +# Note how all the dependencies of libc and gnutls are not forced to +# $OUT/lib (via the magic $ORIGIN variable, meaning the directory of +# the binary). These will not be found on the target system! +# +# If the linker used RPATH however +# * bin=fuzz_nmblib_parse_packet +# * OUT=/tmp/3/b22/prefix/samba-fuzz +# * chrpath -r '$ORIGIN/lib' $OUT/$bin' +# * ldd $OUT/$bin +# linux-vdso.so.1 => (0x00007ffef85c7000) +# libasan.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/libasan.so.2 (0x00007f3668b4f000) +# libldap_r-2.4.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/libldap_r-2.4.so.2 (0x00007f36688fe000) +# liblber-2.4.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/liblber-2.4.so.2 (0x00007f36686ef000) +# libunwind-x86_64.so.8 => /tmp/3/b22/prefix/samba-fuzz/lib/libunwind-x86_64.so.8 (0x00007f36684d0000) +# libunwind.so.8 => /tmp/3/b22/prefix/samba-fuzz/lib/libunwind.so.8 (0x00007f36682b5000) +# libgnutls.so.30 => /tmp/3/b22/prefix/samba-fuzz/lib/libgnutls.so.30 (0x00007f3667f85000) +# libdl.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/libdl.so.2 (0x00007f3667d81000) +# libz.so.1 => /tmp/3/b22/prefix/samba-fuzz/lib/libz.so.1 (0x00007f3667b67000) +# libjansson.so.4 => /tmp/3/b22/prefix/samba-fuzz/lib/libjansson.so.4 (0x00007f366795a000) +# libresolv.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/libresolv.so.2 (0x00007f366773f000) +# libsystemd.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libsystemd.so.0 (0x00007f366be2f000) +# libpthread.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libpthread.so.0 (0x00007f3667522000) +# libicuuc.so.55 => /tmp/3/b22/prefix/samba-fuzz/lib/libicuuc.so.55 (0x00007f366718e000) +# libicui18n.so.55 => /tmp/3/b22/prefix/samba-fuzz/lib/libicui18n.so.55 (0x00007f3666d2c000) +# libcap.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/libcap.so.2 (0x00007f3666b26000) +# libbsd.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libbsd.so.0 (0x00007f3666911000) +# libnsl.so.1 => /tmp/3/b22/prefix/samba-fuzz/lib/libnsl.so.1 (0x00007f36666f8000) +# libc.so.6 => /tmp/3/b22/prefix/samba-fuzz/lib/libc.so.6 (0x00007f366632e000) +# libm.so.6 => /tmp/3/b22/prefix/samba-fuzz/lib/libm.so.6 (0x00007f3666025000) +# libgcc_s.so.1 => /tmp/3/b22/prefix/samba-fuzz/lib/libgcc_s.so.1 (0x00007f3665e0f000) +# libsasl2.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/libsasl2.so.2 (0x00007f3665bf4000) +# libgssapi.so.3 => /tmp/3/b22/prefix/samba-fuzz/lib/libgssapi.so.3 (0x00007f36659b3000) +# liblzma.so.5 => /tmp/3/b22/prefix/samba-fuzz/lib/liblzma.so.5 (0x00007f3665791000) +# /lib64/ld-linux-x86-64.so.2 (0x00007f366bc93000) +# libp11-kit.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libp11-kit.so.0 (0x00007f366552d000) +# libidn.so.11 => /tmp/3/b22/prefix/samba-fuzz/lib/libidn.so.11 (0x00007f36652fa000) +# libtasn1.so.6 => /tmp/3/b22/prefix/samba-fuzz/lib/libtasn1.so.6 (0x00007f36650e7000) +# libnettle.so.6 => /tmp/3/b22/prefix/samba-fuzz/lib/libnettle.so.6 (0x00007f3664eb1000) +# libhogweed.so.4 => /tmp/3/b22/prefix/samba-fuzz/lib/libhogweed.so.4 (0x00007f3664c7e000) +# libgmp.so.10 => /tmp/3/b22/prefix/samba-fuzz/lib/libgmp.so.10 (0x00007f36649fe000) +# libselinux.so.1 => /tmp/3/b22/prefix/samba-fuzz/lib/libselinux.so.1 (0x00007f36647dc000) +# librt.so.1 => /tmp/3/b22/prefix/samba-fuzz/lib/librt.so.1 (0x00007f36645d4000) +# libgcrypt.so.20 => /tmp/3/b22/prefix/samba-fuzz/lib/libgcrypt.so.20 (0x00007f36642f3000) +# libicudata.so.55 => /tmp/3/b22/prefix/samba-fuzz/lib/libicudata.so.55 (0x00007f366283c000) +# libstdc++.so.6 => /tmp/3/b22/prefix/samba-fuzz/lib/libstdc++.so.6 (0x00007f36624ba000) +# libheimntlm.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libheimntlm.so.0 (0x00007f36622b1000) +# libkrb5.so.26 => /tmp/3/b22/prefix/samba-fuzz/lib/libkrb5.so.26 (0x00007f3662027000) +# libasn1.so.8 => /tmp/3/b22/prefix/samba-fuzz/lib/libasn1.so.8 (0x00007f3661d85000) +# libcom_err.so.2 => /tmp/3/b22/prefix/samba-fuzz/lib/libcom_err.so.2 (0x00007f3661b81000) +# libhcrypto.so.4 => /tmp/3/b22/prefix/samba-fuzz/lib/libhcrypto.so.4 (0x00007f366194e000) +# libroken.so.18 => /tmp/3/b22/prefix/samba-fuzz/lib/libroken.so.18 (0x00007f3661738000) +# libffi.so.6 => /tmp/3/b22/prefix/samba-fuzz/lib/libffi.so.6 (0x00007f3661530000) +# libpcre.so.3 => /tmp/3/b22/prefix/samba-fuzz/lib/libpcre.so.3 (0x00007f36612c0000) +# libgpg-error.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libgpg-error.so.0 (0x00007f36610ac000) +# libwind.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libwind.so.0 (0x00007f3660e83000) +# libheimbase.so.1 => /tmp/3/b22/prefix/samba-fuzz/lib/libheimbase.so.1 (0x00007f3660c74000) +# libhx509.so.5 => /tmp/3/b22/prefix/samba-fuzz/lib/libhx509.so.5 (0x00007f3660a29000) +# libsqlite3.so.0 => /tmp/3/b22/prefix/samba-fuzz/lib/libsqlite3.so.0 (0x00007f3660754000) +# libcrypt.so.1 => /tmp/3/b22/prefix/samba-fuzz/lib/libcrypt.so.1 (0x00007f366051c000) +# +# See how the runtime linker seems to honour the RPATH for +# dependencies of dependencies in this case. This helps us us lot. + +for x in bin/fuzz_*; do + # Copy any system libraries needed by this fuzzer to $OUT/lib. + + # We run ldd on $x, the fuzz_binary in bin/ which has not yet had + # the RPATH altered. This is clearer for debugging in local + # development builds as $OUT is not cleaned between runs. + # + # Otherwise trying to re-run this can see cp can fail with: + # cp: '/out/lib/libgcc_s.so.1' and '/out/lib/libgcc_s.so.1' are the same file + # which is really confusing! + + # The cut for ( and ' ' removes the special case references to: + # linux-vdso.so.1 => (0x00007ffe8f2b2000) + # /lib64/ld-linux-x86-64.so.2 (0x00007fc63ea6f000) + + ldd $x | cut -f 2 -d '>' | cut -f 1 -d \( | cut -f 2 -d ' ' | xargs -i cp \{\} $OUT/lib/ + + cp $x $OUT/ + bin=$(basename $x) + + # This means the copied libraries are found on the runner. + # + # The binaries should we built with RPATH, not RUNPATH, to allow + # libraries used by libraries to be found. This command retains the + # RPATH/RUNPATH header and only changes the path. We later verify this + # in the check_build.sh script. + chrpath -r '$ORIGIN/lib' $OUT/$bin + + # Truncate the original binary to save space + echo -n >$x + +done + +# Strip RUNPATH: or RPATH: entries from shared libraries copied over to $OUT/lib. +# When those libraries get loaded and have further dependencies, a RUNPATH: header +# will cause the dynamic linker to search in the runpath, and not in $OUT/lib, +# and there's no way it will be found in the fuzzing env. +# +# So how is the indirect dependency found in $OUT/lib? Well, suppose the fuzzer binary +# links library A which links library B. During linking, both A and B as listed in the +# executable file's runtime dependencies (This was pioneered in Fedora 13 in 2010, but +# is common behavior now). So we have the fuzzer binary with RPATH set to $OUT/lib, and +# a dependency on library B, and it will therefore find library B in $OUT/lib. On the +# hand, if we keep the RUNPATH in library A, and load A first, it will try loading +# library B as a dependency of A from the wrong place. +chrpath -d $OUT/lib/* + +# Grab the seeds dictionary from github and put the seed zips in place +# beside their executables. + +wget https://gitlab.com/samba-team/samba-fuzz-seeds/-/jobs/artifacts/master/download?job=zips \ + -O seeds.zip + +# We might not have unzip, but we do have python +$PYTHON -mzipfile -e seeds.zip $OUT +rm -f seeds.zip diff --git a/lib/fuzzing/patches/collect-access-check-seeds.txt b/lib/fuzzing/patches/collect-access-check-seeds.txt new file mode 100644 index 0000000..db85f40 --- /dev/null +++ b/lib/fuzzing/patches/collect-access-check-seeds.txt @@ -0,0 +1,256 @@ +From b461fdf28c71b54ad5ebe663ea09212856e61973 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Mon, 17 Jul 2023 16:17:16 +1200 +Subject: [PATCH 1/2] libcli/security: save access check attempts for fuzz + examples + +If this patch is applied to a Samba tree, and the +SAMBA_SAVE_ACCESS_CHECK_DIR environment variable points to a +directory, the tokens and descriptors of all access checks will be +stored in that directory in the form used by +fuzz_security_token_vs_descriptor. This can be used to build up a +corpus of seeds for the fuzzer. + +The steps to create the corpus go something like this: + +$ export SAMBA_SAVE_ACCESS_CHECK_DIR=/tmp/samba-seeds +$ mkdir $SAMBA_SAVE_ACCESS_CHECK_DIR +$ mkdir /tmp/final-seeds-go-here +$ make test + +at this point you'd want to do something like this: + +$ for f in $SAMBA_SAVE_ACCESS_CHECK_DIR/*; do \ + cp -n $f /tmp/final-seeds-go-here/$(md5sum $f | cut -d' ' -f 1) \ + done + +but it takes way too long, so use the script in the second patch in +this series, like so: + +$ script/find-unique-access-seeds \ + $SAMBA_SAVE_ACCESS_CHECK_DIR \ + /tmp/final-seeds-go-here/ + +Think before applying this patch in production. It won't slow things +down much, but it will capture your SIDs and ACLs. + +Signed-off-by: Douglas Bagnall +--- + libcli/security/access_check.c | 79 ++++++++++++++++++++++++++++++++++ + 1 file changed, 79 insertions(+) + +diff --git a/libcli/security/access_check.c b/libcli/security/access_check.c +index 1364a15f4dd..d79a247455a 100644 +--- a/libcli/security/access_check.c ++++ b/libcli/security/access_check.c +@@ -26,6 +26,8 @@ + #include "libcli/security/security.h" + #include "librpc/gen_ndr/conditional_ace.h" + #include "libcli/security/conditional_ace.h" ++#include "ndr/libndr.h" ++#include "gen_ndr/ndr_security.h" + + /* Map generic access rights to object specific rights. This technique is + used to give meaning to assigning read, write, execute and all access to +@@ -105,6 +107,77 @@ void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mappi + } + } + ++ ++static bool write_token_and_descriptor(const struct security_descriptor *sd, ++ const struct security_token *token, ++ uint32_t access_desired) ++{ ++ /* ++ * You should not be seeing this function in master or a release ++ * branch! It should only be here if you have patched Samba to ++ * generate fuzz seeds for fuzz_security_token_vs_descriptor. ++ * ++ * It hooks into access_check functions, saving copies of each access ++ * request in a structure for use as a fuzz seed, into the directory ++ * specified by the SAMBA_SAVE_ACCESS_CHECK_DIR environment variable. ++ * ++ * If the environment variable is not set, nothing will happen. ++ * ++ * A full `make test` saves about four million files, but only about ++ * forty thousand of them are unique. ++ */ ++ FILE *f = NULL; ++ char buf[200]; ++ int len; ++ DATA_BLOB blob = {0}; ++ uint pid; ++ struct security_token_descriptor_fuzzing_pair p = { ++ .token = *token, ++ .sd = *sd, ++ .access_desired = access_desired ++ }; ++ static size_t n = 0; ++ enum ndr_err_code ndr_err; ++ static const char *dir = NULL; ++ TALLOC_CTX *tmp_ctx = NULL; ++ ++ if (dir == NULL) { ++ if (n == SIZE_MAX) { ++ return true; ++ } ++ dir = getenv("SAMBA_SAVE_ACCESS_CHECK_DIR"); ++ if (dir == NULL) { ++ n = SIZE_MAX; ++ return false; ++ } ++ } ++ tmp_ctx = talloc_new(NULL); ++ if (tmp_ctx == NULL) { ++ return false; ++ } ++ ++ n++; ++ ndr_err = ndr_push_struct_blob( ++ &blob, tmp_ctx, &p, ++ (ndr_push_flags_fn_t)ndr_push_security_token_descriptor_fuzzing_pair); ++ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { ++ TALLOC_FREE(tmp_ctx); ++ return false; ++ } ++ pid = getpid(); ++ len = snprintf(buf, sizeof(buf), "%s/%08u-%05zu.seed", dir, pid, n); ++ if (len >= sizeof(buf)) { ++ TALLOC_FREE(tmp_ctx); ++ return false; ++ } ++ f = fopen(buf, "w"); ++ fwrite(blob.data, 1, blob.length, f); ++ fclose(f); ++ TALLOC_FREE(tmp_ctx); ++ return true; ++} ++ ++ + /* + perform a SEC_FLAG_MAXIMUM_ALLOWED access check + */ +@@ -117,6 +190,8 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd, + bool have_owner_rights_ace = false; + unsigned i; + ++ write_token_and_descriptor(sd, token, SEC_FLAG_MAXIMUM_ALLOWED); ++ + if (sd->dacl == NULL) { + if (security_token_has_sid(token, sd->owner_sid)) { + switch (implicit_owner_rights) { +@@ -222,6 +297,8 @@ static NTSTATUS se_access_check_implicit_owner(const struct security_descriptor + bool am_owner = false; + bool have_owner_rights_ace = false; + ++ write_token_and_descriptor(sd, token, access_desired); ++ + *access_granted = access_desired; + bits_remaining = access_desired; + +@@ -613,6 +690,8 @@ NTSTATUS sec_access_check_ds_implicit_owner(const struct security_descriptor *sd + uint32_t bits_remaining; + struct dom_sid self_sid; + ++ write_token_and_descriptor(sd, token, access_desired); ++ + dom_sid_parse(SID_NT_SELF, &self_sid); + + *access_granted = access_desired; +-- +2.34.1 + + +From 12bf242cece202658fe61f1c7408709d092632ea Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Tue, 18 Jul 2023 16:07:11 +1200 +Subject: [PATCH 2/2] scripts: a script for deduplicating fuzz-seeds + +The previous patch adds a way to collect two million fuzz seeds, only +a few thousand of which are unique. This script finds the unique ones. + +Some fuzzers like seeds to have names based on md5 hashes, so we do that. + +The naive technique takes ages. + +Signed-off-by: Douglas Bagnall +--- + script/find-unique-access-seeds | 66 +++++++++++++++++++++++++++++++++ + 1 file changed, 66 insertions(+) + create mode 100755 script/find-unique-access-seeds + +diff --git a/script/find-unique-access-seeds b/script/find-unique-access-seeds +new file mode 100755 +index 00000000000..174e811ecd0 +--- /dev/null ++++ b/script/find-unique-access-seeds +@@ -0,0 +1,66 @@ ++#!/usr/bin/env python3 ++# ++# Copyright (C) Catalyst IT Ltd. 2023 ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++"""USAGE: find-unique-access-seeds SRCDIR DESTDIR ++ ++Copy the files in SRCDIR to DESTDIR with the name set to the ++md5sum of the contents. DESTDIR will thus have no duplicates. ++ ++This is the same as going: ++ ++ for f in $SRC/*; do ++ cp $f $DEST/$(md5sum $f | cut -d' ' -f 1) ++ done ++ ++but much more efficient. ++""" ++ ++ ++import sys ++import os ++from pathlib import Path ++from hashlib import md5 ++ ++ ++def usage(ret): ++ print(__doc__) ++ exit(ret) ++ ++ ++def main(): ++ if {'-h', '--help'}.intersection(sys.argv): ++ usage(0) ++ if len(sys.argv) != 3: ++ usage(1) ++ ++ src, dest = sys.argv[1:] ++ sp = Path(src) ++ dp = Path(dest) ++ ++ strings = set() ++ ++ for filename in sp.iterdir(): ++ with open(filename, 'rb') as f: ++ strings.add(f.read()) ++ ++ for s in strings: ++ name = md5(s).hexdigest() ++ with open(dp / name, "wb") as f: ++ f.write(s) ++ ++ ++main() +-- +2.34.1 + diff --git a/lib/fuzzing/wscript_build b/lib/fuzzing/wscript_build new file mode 100644 index 0000000..5a98013 --- /dev/null +++ b/lib/fuzzing/wscript_build @@ -0,0 +1,236 @@ +#!/usr/bin/env python + +from waflib import Build + +bld.SAMBA_SUBSYSTEM('fuzzing', + source='fuzzing.c', + deps='talloc') + +bld.SAMBA_SUBSYSTEM('afl-fuzz-main', + source='afl-fuzz-main.c', + deps='samba-util', + enabled=bld.env.enable_afl_fuzzer + ) + +bld.SAMBA_BINARY('fuzz_tiniparser', + source='fuzz_tiniparser.c', + deps='fuzzing tiniparser talloc afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_parse_lpq_entry', + source='fuzz_parse_lpq_entry.c', + deps='fuzzing afl-fuzz-main smbd_base PRINTING', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_oLschema2ldif', + source='fuzz_oLschema2ldif.c', + deps='fuzzing oLschema2ldif-lib afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_reg_parse', + source='fuzz_reg_parse.c', + deps='fuzzing samba3-util smbconf REGFIO afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_sddl_parse', + source='fuzz_sddl_parse.c', + deps='fuzzing samba-security afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_sess_crypt_blob', + source='fuzz_sess_crypt_blob.c', + deps='fuzzing samba-security LIBCLI_AUTH NDR_DSSETUP afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_conditional_ace_blob', + source='fuzz_conditional_ace_blob.c', + deps='fuzzing samba-security afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_nmblib_parse_packet', + source='fuzz_nmblib_parse_packet.c', + deps='fuzzing libsmb afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_sddl_access_check', + source='fuzz_sddl_access_check.c', + deps='fuzzing samba-security afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_sddl_access_check_ds', + cflags='-DFUZZ_SEC_ACCESS_CHECK_DS=1', + source='fuzz_sddl_access_check.c', + deps='fuzzing samba-security afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_regfio', + source='fuzz_regfio.c', + deps='fuzzing samba3-util smbconf REGFIO afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_lzxpress', + source='fuzz_lzxpress.c', + deps='fuzzing LZXPRESS afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_lzxpress_compress', + source='fuzz_lzxpress_compress.c', + deps='fuzzing LZXPRESS afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_lzxpress_round_trip', + source='fuzz_lzxpress_round_trip.c', + deps='fuzzing LZXPRESS afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_lzxpress_huffman_decompress', + source='fuzz_lzxpress_huffman_decompress.c', + deps='fuzzing LZXPRESS afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_lzxpress_huffman_compress', + source='fuzz_lzxpress_huffman_compress.c', + deps='fuzzing LZXPRESS afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_lzxpress_huffman_round_trip', + source='fuzz_lzxpress_huffman_round_trip.c', + deps='fuzzing LZXPRESS afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_ldap_decode', + source='fuzz_ldap_decode.c', + deps='fuzzing cli-ldap afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_ldb_parse_control', + source='fuzz_ldb_parse_control.c', + deps='fuzzing ldb afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_ldb_dn_explode', + source='fuzz_ldb_dn_explode.c', + deps='fuzzing ldb afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_ldb_ldif_read', + source='fuzz_ldb_ldif_read.c', + deps='fuzzing ldb afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_ldb_parse_binary_decode', + source='fuzz_ldb_parse_binary_decode.c', + deps='fuzzing ldb afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_ldb_parse_tree', + source='fuzz_ldb_parse_tree.c', + deps='fuzzing ldb afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_ldb_comparison_fold', + source='fuzz_ldb_comparison_fold.c', + deps='fuzzing ldb afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_dcerpc_parse_binding', + source='fuzz_dcerpc_parse_binding.c', + deps='fuzzing dcerpc afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_cli_credentials_parse_string', + source='fuzz_cli_credentials_parse_string.c', + deps='fuzzing samba-credentials afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_stable_sort', + source='fuzz_stable_sort.c', + deps='fuzzing stable_sort afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_stable_sort_r', + source='fuzz_stable_sort_r.c', + deps='fuzzing stable_sort afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_security_token_vs_descriptor', + source='fuzz_security_token_vs_descriptor.c', + deps='fuzzing samba-security afl-fuzz-main', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_security_token_vs_descriptor_ds', + cflags='-DFUZZ_SEC_ACCESS_CHECK_DS=1', + source='fuzz_security_token_vs_descriptor.c', + deps='fuzzing samba-security afl-fuzz-main', + fuzzer=True) + + +# The fuzz_type and fuzz_function parameters make the built +# fuzzer take the same input as ndrdump and so the same that +# could be sent to the client or server as the stub data. + +def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False, + fuzz_type=None, fuzz_function=None): + name = "fuzz_ndr_%s" % (interface.lower()) + fuzz_dir = os.path.join(bld.env.srcdir, 'lib/fuzzing') + fuzz_reldir = os.path.relpath(fuzz_dir, bld.path.abspath()) + fuzz_src = os.path.join(fuzz_reldir, 'fuzz_ndr_X.c') + + cflags = "-D FUZZ_PIPE_TABLE=ndr_table_%s" % interface + if fuzz_type: + name += "_%s" % (fuzz_type) + cflags += " -D FUZZ_TYPE=%s " % (fuzz_type) + if fuzz_type and fuzz_function: + name += "_%d" % (fuzz_function) + cflags += " -D FUZZ_FUNCTION=%d" % (fuzz_function) + + fuzz_named_src = os.path.join(fuzz_reldir, + '%s.c' % (name)) + # Work around an issue that WAF is invoked from up to 3 different + # directories so doesn't create a unique name for the multiple .o + # files like it would if called from just one place. + bld.SAMBA_GENERATOR(fuzz_named_src, + source=fuzz_src, + target=fuzz_named_src, + rule='cp ${SRC} ${TGT}') + + if auto_deps: + deps = "afl-fuzz-main talloc ndr NDR_%s" % interface.upper() + else: + deps = "afl-fuzz-main ndr-table NDR_DCERPC" + + bld.SAMBA_BINARY(name, source=fuzz_named_src, + cflags = cflags, + deps = deps, + fuzzer=True) + +Build.BuildContext.SAMBA_NDR_FUZZ = SAMBA_NDR_FUZZ + +# fuzz_ndr_X is generated from the list of IDL fed to PIDL +# however there are exceptions to the normal pattern +bld.SAMBA_NDR_FUZZ('iremotewinspool') # winspool.idl +bld.SAMBA_NDR_FUZZ('FileServerVssAgent') # fsvrp.idl +bld.SAMBA_NDR_FUZZ('lsarpc') # lsa.idl +bld.SAMBA_NDR_FUZZ('netdfs') # dfs.idl +bld.SAMBA_NDR_FUZZ('nfs4acl_interface') # nfs4acl.idl +bld.SAMBA_NDR_FUZZ('rpcecho') # echo.idl + +# quota.idl +bld.SAMBA_NDR_FUZZ('file_quota') +bld.SAMBA_NDR_FUZZ('smb2_query_quota') +bld.SAMBA_NDR_FUZZ('smb1_nt_transact_query_quota') + +# ioctl.idl +bld.SAMBA_NDR_FUZZ('copychunk') +bld.SAMBA_NDR_FUZZ('compression') +bld.SAMBA_NDR_FUZZ('netinterface') +bld.SAMBA_NDR_FUZZ('sparse') +bld.SAMBA_NDR_FUZZ('resiliency') +bld.SAMBA_NDR_FUZZ('trim') + +# Specific struct or function on the interface + +bld.SAMBA_NDR_FUZZ('spoolss', + auto_deps=True, + fuzz_type="TYPE_IN", + fuzz_function=65) -- cgit v1.2.3