<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'> <head> <meta content="text/html; charset=US-ASCII" http-equiv="Content-Type"> <title> GitLab </title> <style data-premailer="ignore" type="text/css"> a { color: #1068bf; } </style> <style>img { max-width: 100%; height: auto; } body { font-size: .875rem; } body { -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; } body { font-family: var(--default-regular-font, "GitLab Sans"),-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit; } </style> </head> <body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: var(--default-regular-font, "GitLab Sans"),-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'> <div class="content"> <h3 style="margin-top: 20px; margin-bottom: 10px;"> Samuel Thibault pushed to branch master at <a href="https://gitlab.freedesktop.org/slirp/libslirp">slirp / libslirp</a> </h3> <h4 style="margin-top: 10px; margin-bottom: 10px;"> Commits: </h4> <ul> <li> <strong style="font-weight: 600;"><a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/b5f4b774b161bdfcc818bb49a91fb655a5a775f7">b5f4b774</a></strong> <div> <span> by Marc-André Lureau </span> <i> at 2024-04-25T01:23:00+02:00 </i> </div> <pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: var(--default-mono-font, "GitLab Mono"),"JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Start some fuzzing test You can run the tests over the corpus with a "regular" build, then $ fuzzing/fuzz-input ../fuzzing/IN/* Or building with fuzzing enabled, and running: $ CFLAGS="-fsanitize=fuzzer" CC=clang CXX=clang++ meson -Db_lundef=false $ fuzzing/fuzz-input ../fuzzing/IN I have an initial corpus which was generated by running fuzz-input for a few hours starting with qemu.pkt, which is the first packet sent by qemu. Sadly, it only covers 25%... I tried to increase the coverage manually, see for example tftp-get-blah.pkt, but that's not so simple, as multiple packets may be required to setup a session etc. Neverthess, the fuzzing already found a few issues, so it might be worth to add it in this current form. fuzzing/oss-fuzz.sh is used by oss-fuzz, for Google fuzzing. (see documentation if you want to reproduce the build locally) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> </pre> </li> <li> <strong style="font-weight: 600;"><a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/0e9b0ad45b43e638f9334919cfc7a902a87663e0">0e9b0ad4</a></strong> <div> <span> by jeremy marchand </span> <i> at 2024-04-25T01:23:00+02:00 </i> </div> <pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: var(--default-mono-font, "GitLab Mono"),"JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>First attempt at fuzzing with libFuzzer based on @elmarco work The slirp_fuzz_ip_header harness should be working and is a basic example of a custom mutator focusing on part of the input. The slirp_fuzz_udp harness needs a bit of work to calculate the checksum properly. The code can be built using `meson build` followed by `ninja -C build`, the current meson.build file is not suitable with a general usage. To run the fuzzing code just run `build/fuzzing/fuzz-ip-header fuzzing/IN -detect_leaks=0`, crash will be sent to current folder and new input will go directly in the `IN` folder. The main point to focus on to improve the fuzzing should be generating a better corpus. </pre> </li> <li> <strong style="font-weight: 600;"><a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/884d39ee32509b49f25a74161ce5f6809ccfb422">884d39ee</a></strong> <div> <span> by Maelie CHAN PENG </span> <i> at 2024-04-25T01:23:00+02:00 </i> </div> <pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: var(--default-mono-font, "GitLab Mono"),"JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>fuzzing: Increase coverage - by adding trace examples - by separating fuzzing different headers / data - by adding an echo TCP server forward - also factorizing code along the way Also-by: JC <luffy33820@gmail.com> Also-by: Alisee Lafontaine <alisee.lafontaine@u-bordeaux.fr> </pre> </li> <li> <strong style="font-weight: 600;"><a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/f045cdc9be609df412c0543c36b457d0b76ba95a">f045cdc9</a></strong> <div> <span> by Marc-André Lureau </span> <i> at 2024-04-25T01:23:00+02:00 </i> </div> <pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: var(--default-mono-font, "GitLab Mono"),"JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>tcp: hack syn/ack We don't know in advance what the trace will have received as sequence number, so when fuzzing tcp, just align on what the trace says </pre> </li> <li> <strong style="font-weight: 600;"><a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/6f28e96e13f00a3d43fc300949d527afdc345bca">6f28e96e</a></strong> <div> <span> by Samuel Thibault </span> <i> at 2024-04-25T01:52:37+02:00 </i> </div> <pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: var(--default-mono-font, "GitLab Mono"),"JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>fuzz: Add ip filtering It's no use sending to the slirp stack the trace packets which are supposed to be generated by the stack. Also no use fuzzing them, then. </pre> </li> <li> <strong style="font-weight: 600;"><a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/ea785a27a2571f2995bac7264755629e7bb9edef">ea785a27</a></strong> <div> <span> by Samuel Thibault </span> <i> at 2024-04-25T01:52:37+02:00 </i> </div> <pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: var(--default-mono-font, "GitLab Mono"),"JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Add fuzzing CI </pre> </li> </ul> <h4 style="margin-top: 10px; margin-bottom: 10px;"> 30 changed files: </h4> <ul> <li class="file-stats"> <a href="#587d266bb27a4dc3022bbed44dfa19849df3044c"> .gitlab-ci.yml </a> </li> <li class="file-stats"> <a href="#dfcebd8f956e05e8e303d9cf3bf000c2f9c73383"> <span class="new-file"> + fuzzing/IN_dhcp/dhcp.pkt </span> </a> </li> <li class="file-stats"> <a href="#c1a788f1bac7e8eaa9a6c43348e3781f82956c49"> <span class="new-file"> + fuzzing/IN_dhcp/dhcp_capture.pcap </span> </a> </li> <li class="file-stats"> <a href="#e2840f89afda6b67f65d939768b01665e671c1a9"> <span class="new-file"> + fuzzing/IN_icmp/icmp_capture.pcap </span> </a> </li> <li class="file-stats"> <a href="#98299c869d9bea54ec2e76a6e6d128a26757a9c8"> <span class="new-file"> + fuzzing/IN_icmp/ping_10-0-2-2.pcap </span> </a> </li> <li class="file-stats"> <a href="#b511e88c90da8f739645acf3627fffb7de1e3717"> <span class="new-file"> + fuzzing/IN_ip-header/DNS_freedesktop_1-1-1-1.pcap </span> </a> </li> <li class="file-stats"> <a href="#4ba63908681f5137a30f5f2206d18be20eb91458"> <span class="new-file"> + fuzzing/IN_ip-header/dhcp.pkt </span> </a> </li> <li class="file-stats"> <a href="#863a1053545f36a7a21cef8118cf27affc7c8530"> <span class="new-file"> + fuzzing/IN_ip-header/dhcp_capture.pcap </span> </a> </li> <li class="file-stats"> <a href="#bba27e3c33aee204847e2dde9b85b3369ec2ad7e"> <span class="new-file"> + fuzzing/IN_ip-header/icmp_capture.pcap </span> </a> </li> <li class="file-stats"> <a href="#97be782441ab73333f38f21dd4697da9dc2ffc58"> <span class="new-file"> + fuzzing/IN_ip-header/nc-10.0.2.2-8080.pcap </span> </a> </li> <li class="file-stats"> <a href="#6a10ada3d08e603a8e5c50afa5f75887d83a751d"> <span class="new-file"> + fuzzing/IN_ip-header/nc-ident.pcap </span> </a> </li> <li class="file-stats"> <a href="#567680340fd165c62df518c27f9b1bf1ccc0feb5"> <span class="new-file"> + fuzzing/IN_ip-header/ping_10-0-2-2.pcap </span> </a> </li> <li class="file-stats"> <a href="#949ca75c6274bdade51e1ccca263225e034ff515"> <span class="new-file"> + fuzzing/IN_ip-header/tcp_qemucapt.pcap </span> </a> </li> <li class="file-stats"> <a href="#023b61c6ecb34e5559f1911df577c4af1373b5f2"> <span class="new-file"> + fuzzing/IN_ip-header/tftp-get-blah.pkt </span> </a> </li> <li class="file-stats"> <a href="#3269bf04a7f424e40d23a7b3b0a3a4e68c0a3d36"> <span class="new-file"> + fuzzing/IN_ip-header/tftp_capture.pcap </span> </a> </li> <li class="file-stats"> <a href="#98563aed6c4e2104e2b879b7d5aec25e8d4fff26"> <span class="new-file"> + fuzzing/IN_ip-header/tftp_get_libslirp-txt.pcap </span> </a> </li> <li class="file-stats"> <a href="#11dcc64c9c4f76244bb7259ded6e641b330754f7"> <span class="new-file"> + fuzzing/IN_tcp-d </span> </a> </li> <li class="file-stats"> <a href="#cda3f2bbd5862f814ee6eb612136becdbba1b9d9"> <span class="new-file"> + fuzzing/IN_tcp-h </span> </a> </li> <li class="file-stats"> <a href="#a18df4a982fe2e913442b240f64bd366bc0b349a"> fuzzing/IN/nc-10.0.2.2-8080.pcap → fuzzing/IN_tcp/nc-10.0.2.2-8080.pcap </a> </li> <li class="file-stats"> <a href="#edefe5b938d96b4d301889034ebcf18bd9e51e0b"> <span class="new-file"> + fuzzing/IN_tcp/nc-ident.pcap </span> </a> </li> <li class="file-stats"> <a href="#a40099eef0508f4ae729d71a97a4d11d5beffe80"> <span class="new-file"> + fuzzing/IN_tcp/tcp_qemucapt.pcap </span> </a> </li> <li class="file-stats"> <a href="#9f1e9a41d9d2187270ba87663c6f956afe4842e1"> <span class="new-file"> + fuzzing/IN_tftp/tftp-get-blah.pkt </span> </a> </li> <li class="file-stats"> <a href="#7ad96324590829178fd7d409f1af5da467a77bbd"> <span class="new-file"> + fuzzing/IN_tftp/tftp_capture.pcap </span> </a> </li> <li class="file-stats"> <a href="#657ebfee9b5fdd17d132a33b3f03cec20bc557c6"> <span class="new-file"> + fuzzing/IN_tftp/tftp_get_libslirp-txt.pcap </span> </a> </li> <li class="file-stats"> <a href="#0f41eedf3e4c1645e6ffd8d539966fc148a07a41"> <span class="new-file"> + fuzzing/IN_udp-h </span> </a> </li> <li class="file-stats"> <a href="#1c5e3ff8a97ad8f7e1bc7d78a96a0b2bebb5d0a6"> <span class="new-file"> + fuzzing/IN_udp/DNS_freedesktop_1-1-1-1.pcap </span> </a> </li> <li class="file-stats"> <a href="#0821121dfe25883470641f014e4fb7216e34e76c"> <span class="new-file"> + fuzzing/IN_udp/dhcp.pkt </span> </a> </li> <li class="file-stats"> <a href="#719f784881ae05130f98fa44b14311a6e6876c0b"> <span class="new-file"> + fuzzing/IN_udp/dhcp_capture.pcap </span> </a> </li> <li class="file-stats"> <a href="#ee7eff77d47c28bdde14a61e8037e5b4720e5608"> <span class="new-file"> + fuzzing/IN_udp/tftp-get-blah.pkt </span> </a> </li> <li class="file-stats"> <a href="#1dae24d959cbbadabe8823dad3189a7755b06571"> <span class="new-file"> + fuzzing/IN_udp/tftp_capture.pcap </span> </a> </li> </ul> <h5 style="margin-top: 10px; margin-bottom: 10px; font-size: .875rem;"> The diff was not included because it is too large. </h5> </div> <div class="footer" style="margin-top: 10px;"> <p style="font-size: small; color: #737278;"> — <br> <a href="https://gitlab.freedesktop.org/slirp/libslirp/-/compare/bdba265ddf1124c4d5475264532254c728b7e78c...ea785a27a2571f2995bac7264755629e7bb9edef">View it on GitLab</a>. <br> You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.freedesktop.org">gitlab.freedesktop.org</a>. <a href="https://gitlab.freedesktop.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.freedesktop.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a> </p> </div> </body> </html>