diff --git a/meson.build b/meson.build index e37c00305..fa21c03b4 100644 --- a/meson.build +++ b/meson.build @@ -131,6 +131,11 @@ if build_tests subdir('tests') endif +# Check if the 'fuzzing' option is defined +if get_option('fuzzing') + subdir('tests/fuzzing') +endif + message('\n'.join([ '', ' prefix: ' + prefix, diff --git a/meson_options.txt b/meson_options.txt new file mode 100644 index 000000000..2acd9beab --- /dev/null +++ b/meson_options.txt @@ -0,0 +1,2 @@ +option('fuzzing', type: 'boolean', value: false, description: 'Enable fuzzing tests') +option('lib_fuzzing_engine', type : 'string', value : '', description : 'Path to the libFuzzer engine library') diff --git a/tests/fuzzing/fuzzing.h b/tests/fuzzing/fuzzing.h new file mode 100644 index 000000000..cf6ee9d4f --- /dev/null +++ b/tests/fuzzing/fuzzing.h @@ -0,0 +1,34 @@ +/* + * Copyright (C) 2019-2023 by Sukchan Lee + * + * This file is part of Open5GS. + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ +#include "ogs-core.h" +#include "core/abts.h" + +static int initialized = 0; + +void initialize(void) { + + ogs_pkbuf_config_t config; + + ogs_core_initialize(); + + ogs_pkbuf_default_init(&config); + ogs_pkbuf_default_create(&config); + + initialized = 1; +} diff --git a/tests/fuzzing/gtp-message-fuzz.c b/tests/fuzzing/gtp-message-fuzz.c new file mode 100644 index 000000000..38f6c0272 --- /dev/null +++ b/tests/fuzzing/gtp-message-fuzz.c @@ -0,0 +1,58 @@ +/* + * Copyright (C) 2019-2023 by Sukchan Lee + * + * This file is part of Open5GS. + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include +#include + +#include "fuzzing.h" +#include "ogs-gtp.h" + +#define kMinInputLength 5 +#define kMaxInputLength 1024 + +extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) +{ /* open5gs/tests/unit/gtp-message-test.c */ + + if (Size < kMinInputLength || Size > kMaxInputLength) { + return 1; + } + + if (!initialized) { + initialize(); + ogs_log_install_domain(&__ogs_gtp_domain, "gtp", OGS_LOG_NONE); + ogs_log_install_domain(&__ogs_tlv_domain, "tlv", OGS_LOG_NONE); + } + + int result; + ogs_pkbuf_t *pkbuf; + ogs_gtp2_create_session_request_t req; + + pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN); + if (pkbuf == NULL) { + return 1; + } + + ogs_pkbuf_put_data(pkbuf, Data, Size); + + ogs_tlv_parse_msg(&req, &ogs_gtp2_tlv_desc_create_session_request, pkbuf, OGS_TLV_MODE_T1_L2_I1); + + ogs_pkbuf_free(pkbuf); + + return 0; +} diff --git a/tests/fuzzing/gtp_message_fuzz_seed_corpus.zip b/tests/fuzzing/gtp_message_fuzz_seed_corpus.zip new file mode 100644 index 000000000..1ddaad275 Binary files /dev/null and b/tests/fuzzing/gtp_message_fuzz_seed_corpus.zip differ diff --git a/tests/fuzzing/meson.build b/tests/fuzzing/meson.build new file mode 100644 index 000000000..325570209 --- /dev/null +++ b/tests/fuzzing/meson.build @@ -0,0 +1,41 @@ +# Copyright (C) 2019 by Sukchan Lee + +# This file is part of Open5GS. + +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + + +# Get the lib_fuzzing_engine build option. +lib_fuzzing_engine = get_option('lib_fuzzing_engine') + +# All fuzzer sources. +gtp_message_source = files('gtp-message-fuzz.c') +nas_message_source = files('nas-message-fuzz.c') + +# Build all executable +executable( + 'gtp_message_fuzz', + sources : gtp_message_source, + c_args : [testunit_core_cc_flags, sbi_cc_flags], + dependencies : [libgtp_dep], + link_args: lib_fuzzing_engine +) + +executable( + 'nas_message_fuzz', + sources : nas_message_source, + c_args : [testunit_core_cc_flags, sbi_cc_flags], + dependencies : [libnas_eps_dep], + link_args: lib_fuzzing_engine +) diff --git a/tests/fuzzing/nas-message-fuzz.c b/tests/fuzzing/nas-message-fuzz.c new file mode 100644 index 000000000..58fcc4d40 --- /dev/null +++ b/tests/fuzzing/nas-message-fuzz.c @@ -0,0 +1,57 @@ +/* + * Copyright (C) 2019-2023 by Sukchan Lee + * + * This file is part of Open5GS. + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include +#include + +#include "fuzzing.h" +#include "ogs-nas-eps.h" + +#define kMinInputLength 5 +#define kMaxInputLength 1024 + +extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) +{ /* open5gs/tests/unit/nas-message-test.c */ + + if (Size < kMinInputLength || Size > kMaxInputLength) { + return 1; + } + + if (!initialized) { + initialize(); + ogs_log_install_domain(&__ogs_nas_domain, "nas", OGS_LOG_NONE); + } + + int result; + ogs_pkbuf_t *pkbuf; + ogs_nas_eps_message_t message; + + pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN); + if (pkbuf == NULL) { + return 1; + } + + ogs_pkbuf_put_data(pkbuf, Data, Size); + + result = ogs_nas_emm_decode(&message, pkbuf); + + ogs_pkbuf_free(pkbuf); + + return result; +} diff --git a/tests/fuzzing/nas_message_fuzz_seed_corpus.zip b/tests/fuzzing/nas_message_fuzz_seed_corpus.zip new file mode 100644 index 000000000..679bf8046 Binary files /dev/null and b/tests/fuzzing/nas_message_fuzz_seed_corpus.zip differ