# We walk up the tree if necessary to find a commit that builds so that we
# will fuzz something
+ #
+ # When we find a working commit we run the unit tests to create seed data
+ # from the latest versions of the unit tests.
- name: Find a commit that builds
id: pick_commit
run: |
git clean -fxd
done
echo "::set-output name=commit_id::$(git rev-parse --short HEAD)"
+ make test.unit
- name: Run fuzzer tests
run: |
test.fuzzer: $(addprefix test.fuzzer.,$(FUZZER_PROTOCOLS))
+test.fuzzer.merge: $(addsuffix .merge,$(addprefix test.fuzzer.,$(FUZZER_PROTOCOLS)))
+
else
.PHONY: fuzzer.help $(foreach X,${FUZZER_PROTOCOLS},fuzzer.${X})
fuzzer.help $(foreach X,${FUZZER_PROTOCOLS},fuzzer.${X}) test.fuzzer:
# then magically turns into different fuzzers.
#
-TARGET := fuzzer_$(PROTOCOL)
-SOURCES := fuzzer.c
+TARGET := fuzzer_$(PROTOCOL)
+SOURCES := fuzzer.c
-TGT_PREREQS := libfreeradius-$(PROTOCOL).a
+TGT_PREREQS := libfreeradius-$(PROTOCOL).a
-TGT_LDLIBS := $(LIBS)
+TGT_LDLIBS := $(LIBS)
+
+FUZZER_CORPUS_DIR := src/tests/fuzzer-corpus
#
# Ensure that the large data file is copied from git-lfs,
#
.PHONY:src/tests/fuzzer-corpus/$(PROTOCOL)
src/tests/fuzzer-corpus/$(PROTOCOL):
- ${Q}if [ ! -e $@ ]; then \
+ ${Q}if [ ! -e $@ ] || [ ! -e "$@/.extracted" ]; then \
if which flock > /dev/null 2>&1; then flock -F /tmp/git-lfs-mutex git -c 'lfs.fetchexclude=' -c 'lfs.fetchinclude=src/tests/fuzzer-corpus/$(PROTOCOL).tar' lfs pull; \
else git -c 'lfs.fetchexclude=' -c 'lfs.fetchinclude=src/tests/fuzzer-corpus/$(PROTOCOL).tar' lfs pull; fi; \
cd src/tests/fuzzer-corpus; \
tar -xf $(PROTOCOL).tar; \
+ touch "$(PROTOCOL)/.extracted"; \
fi
.PHONY: $(FUZZER_ARTIFACTS)/$(PROTOCOL)
fi
endif
+test.fuzzer.$(PROTOCOL).merge: | src/tests/fuzzer-corpus/$(PROTOCOL)
+ @echo MERGE-FUZZER-CORPUS $(PROTOCOL)
+ ${Q}[ -e "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)_new" ] || mkdir "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)_new"
+ ${Q}$(TEST_BIN)/fuzzer_$(PROTOCOL) \
+ -D share/dictionary \
+ -max_len=512 $(FUZZER_ARGUMENTS) \
+ -merge=1 \
+ "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)_new" "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)"
+ ${Q}[ ! -e "$(FUZZER_CORPUS_DIR)/$(PROTOCOL).tar" ] || rm "$(FUZZER_CORPUS_DIR)/$(PROTOCOL).tar"
+ ${Q}rm -rf "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)"
+ ${Q}mv "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)_new" "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)"
+ ${Q}tar -C "$(FUZZER_CORPUS_DIR)" -c -f "$(FUZZER_CORPUS_DIR)/$(PROTOCOL).tar" "$(PROTOCOL)"
+ ${Q}rm -rf "$(FUZZER_CORPUS_DIR)/$(PROTOCOL)_new"
+
test.fuzzer.$(PROTOCOL).crash: $(wildcard $(BUILD_DIR)/fuzzer/$(PROTOCOL)/crash-*) $(wildcard $(BUILD_DIR)/fuzzer/$(PROTOCOL)/timeout-*) $(wildcard $(BUILD_DIR)/fuzzer/$(PROTOCOL)/slow-unit-*) $(TEST_BIN_DIR)/fuzzer_$(PROTOCOL) | src/tests/fuzzer-corpus/$(PROTOCOL)
$(TEST_BIN)/fuzzer_$(PROTOCOL) \
-artifact_prefix="$(FUZZER_ARTIFACTS)/$(PROTOCOL)/" \
#endif
#include <freeradius-devel/unlang/base.h>
#include <freeradius-devel/unlang/xlat.h>
-#include <freeradius-devel/util/conf.h>
-#include <freeradius-devel/util/syserror.h>
-#include <freeradius-devel/util/log.h>
#include <freeradius-devel/util/atexit.h>
+#include <freeradius-devel/util/base64.h>
+#include <freeradius-devel/util/conf.h>
+#include <freeradius-devel/util/dns.h>
#include <freeradius-devel/util/file.h>
+#include <freeradius-devel/util/log.h>
#include <freeradius-devel/util/pair_legacy.h>
-#include <freeradius-devel/util/dns.h>
+#include <freeradius-devel/util/sha1.h>
+#include <freeradius-devel/util/syserror.h>
#include <ctype.h>
#endif
#include <assert.h>
+#include <fcntl.h>
#include <libgen.h>
#include <limits.h>
+#include <sys/stat.h>
#include <sys/wait.h>
#ifndef HAVE_SANITIZER_LSAN_INTERFACE_H
fr_dict_gctx_t const *dict_gctx; //!< Dictionary gctx to "reset" to.
char const *raddb_dir;
char const *dict_dir;
+ char const *fuzzer_dir; //!< Where to write fuzzer files.
CONF_SECTION *features; //!< Enabled features.
} command_config_t;
fr_dict_t *test_internal_dict; //!< Internal dictionary of test_gctx.
fr_dict_gctx_t const *test_gctx; //!< Dictionary context for test dictionaries.
+ int fuzzer_dir; //!< File descriptor pointing to a a directory to
+ ///< write fuzzer output.
command_config_t const *config;
} command_file_ctx_t;
/** Print hex string to buffer
*
*/
-static inline size_t hex_print(char *out, size_t outlen, uint8_t const *in, size_t inlen) CC_HINT(nonnull);
-
-static inline size_t hex_print(char *out, size_t outlen, uint8_t const *in, size_t inlen)
+static inline CC_HINT(nonnull) size_t hex_print(char *out, size_t outlen, uint8_t const *in, size_t inlen)
{
char *p = out;
char *end = p + outlen;
return p - out;
}
+static inline int dump_fuzzer_data(int fd_dir, char const *text, uint8_t const *data, size_t data_len)
+{
+ fr_sha1_ctx ctx;
+ uint8_t digest[SHA1_DIGEST_LENGTH];
+ char digest_str[(SHA1_DIGEST_LENGTH * 2) + 1];
+ int file_fd;
+
+ fr_sha1_init(&ctx);
+ fr_sha1_update(&ctx, (uint8_t const *)text, strlen(text));
+ fr_sha1_final(digest, &ctx);
+
+ /*
+ * We need to use the url alphabet as the standard
+ * one contains forwarded slashes which openat
+ * doesn't like.
+ */
+ fr_base64_encode_nstd(&FR_SBUFF_OUT(digest_str, sizeof(digest_str)), &FR_DBUFF_TMP(digest, sizeof(digest)),
+ false, fr_base64_url_alphabet_encode);
+
+ file_fd = openat(fd_dir, digest_str, O_RDWR | O_CREAT | O_TRUNC);
+ if (file_fd < 0) {
+ fr_strerror_printf("Failed creating corpus input file \"%s\": %s", digest_str, fr_syserror(errno));
+ return -1;
+ }
+
+ if (fchmod(file_fd, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH) < 0) {
+ fr_strerror_printf("Failed setting permissions for \"%s\": %s", digest_str, fr_syserror(errno));
+ return -1;
+ }
+
+ if (write(file_fd, data, data_len) != (ssize_t)data_len) {
+ fr_strerror_printf("Failed writing to corpus input file \"%s\": %s", digest_str, fr_syserror(errno));
+ unlinkat(fd_dir, digest_str, 0);
+ return -1;
+ }
+
+ return 0;
+}
+
/*
* End of hacks for xlat
*
if (next) *next = 0;
}
+ if ((cc->fuzzer_dir >= 0) &&
+ (dump_fuzzer_data(cc->fuzzer_dir, p, cc->buffer_start, enc_p - cc->buffer_start) < 0)) {
+ RETURN_COMMAND_ERROR();
+ }
+
RETURN_OK(hex_print(data, COMMAND_OUTPUT_MAX, cc->buffer_start, enc_p - cc->buffer_start));
}
CLEAR_TEST_POINT(cc);
+ if ((cc->fuzzer_dir >= 0) &&
+ (dump_fuzzer_data(cc->fuzzer_dir, p, cc->buffer_start, enc_p - cc->buffer_start) < 0)) {
+ RETURN_COMMAND_ERROR();
+ }
+
RETURN_OK(hex_print(data, COMMAND_OUTPUT_MAX, cc->buffer_start, enc_p - cc->buffer_start));
}
CLEAR_TEST_POINT(cc);
+ if ((cc->fuzzer_dir >= 0) &&
+ (dump_fuzzer_data(cc->fuzzer_dir, p, cc->buffer_start, slen) < 0)) {
+ RETURN_COMMAND_ERROR();
+ }
+
RETURN_OK(hex_print(data, COMMAND_OUTPUT_MAX, cc->buffer_start, slen));
}
return 0;
}
+/** Enable fuzzer output
+ *
+ * Any commands that produce potentially useful corpus seed data will write that out data
+ * to files in the specified directory, using the md5 of the text input at as the file name.
+ *
+ */
+static size_t command_fuzzer_out(command_result_t *result, command_file_ctx_t *cc,
+ UNUSED char *data, UNUSED size_t data_used, char *in, UNUSED size_t inlen)
+{
+ int fd;
+ struct stat sdir;
+ char *fuzzer_dir;
+
+ /*
+ * Close any open fuzzer output dirs
+ */
+ if (cc->fuzzer_dir >= 0) {
+ close(cc->fuzzer_dir);
+ cc->fuzzer_dir = -1;
+ }
+
+ if (in[0] == '\0') {
+ fr_strerror_const("Missing directory name");
+ RETURN_PARSE_ERROR(0);
+ }
+
+ fuzzer_dir = talloc_asprintf(cc->tmp_ctx, "%s/%s",
+ cc->config->fuzzer_dir ? cc->config->fuzzer_dir : cc->path, in);
+ fd = open(fuzzer_dir, O_RDONLY);
+ if (fd < 0) {
+ if (mkdir(fuzzer_dir, 0777) == 0) {
+ fd = open(fuzzer_dir, O_RDONLY);
+ if (fd >= 0) goto stat;
+ }
+ fr_strerror_printf("fuzzer-out \"%s\" doesn't exit: %s", fuzzer_dir, fr_syserror(errno));
+ RETURN_PARSE_ERROR(0);
+ }
+
+stat:
+ if (fstat(fd, &sdir) < 0) {
+ fr_strerror_printf("failed statting fuzzer-out \"%s\": %s", fuzzer_dir, fr_syserror(errno));
+ RETURN_PARSE_ERROR(0);
+ }
+
+ if (!(sdir.st_mode & S_IFDIR)) {
+ fr_strerror_printf("fuzzer-out \"%s\" is not a directory", fuzzer_dir);
+ RETURN_PARSE_ERROR(0);
+ }
+ cc->fuzzer_dir = fd;
+ talloc_free(fuzzer_dir);
+
+ return 0;
+}
+
/** Exit gracefully with the specified code
*
*/
return fr_sbuff_used(&sbuff);
}
-static size_t command_value_box_normalise(command_result_t *result, UNUSED command_file_ctx_t *cc,
+static size_t command_value_box_normalise(command_result_t *result, command_file_ctx_t *cc,
char *data, UNUSED size_t data_used, char *in, UNUSED size_t inlen)
{
fr_value_box_t *box = talloc_zero(NULL, fr_value_box_t);
RETURN_OK_WITH_ERROR();
}
+ /*
+ * Store <type><value str...>
+ */
+ if (cc->fuzzer_dir >= 0) {
+ char fuzzer_buffer[1024];
+ char *fuzzer_p = fuzzer_buffer, *fuzzer_end = fuzzer_p + sizeof(fuzzer_buffer);
+
+ *fuzzer_p++ = (uint8_t)type; /* Fuzzer uses first byte for type */
+
+ strlcpy(fuzzer_p, data, slen > fuzzer_end - fuzzer_p ? fuzzer_end - fuzzer_p : slen);
+
+ if (dump_fuzzer_data(cc->fuzzer_dir, fuzzer_buffer,
+ (uint8_t *)fuzzer_buffer, strlen(fuzzer_buffer)) < 0) {
+ RETURN_COMMAND_ERROR();
+ }
+ }
+
talloc_free(box2);
talloc_free(box);
RETURN_OK(slen);
.usage = "exit[ <num>]",
.description = "Exit with the specified error number. If no <num> is provided, process will exit with 0"
}},
+ { L("fuzzer-out"), &(command_entry_t){
+ .func = command_fuzzer_out,
+ .usage = "fuzzer-out <dir>",
+ .description = "Write encode-pair, encode-proto, and encode-dns-label output, and value input as separate files in the specified directory. Text input will be sha1 hashed and base64 encoded to create the filename",
+ }},
{ L("load-dictionary "),&(command_entry_t){
.func = command_load_dictionary,
.usage = "load-dictionary <name> [<dir>]",
fr_perror("unit_test_attribute");
return -1;
}
+ if (cc->fuzzer_dir >= 0) {
+ close(cc->fuzzer_dir);
+ cc->fuzzer_dir = -1;
+ }
return 0;
}
fr_dict_global_ctx_dir_set(cc->path); /* Load new dictionaries relative to the test file */
fr_dict_global_ctx_set(cc->config->dict_gctx);
+ cc->fuzzer_dir = -1;
+
return cc;
}
if (fr_dict_internal_afrom_file(&cc->test_internal_dict, FR_DICTIONARY_INTERNAL_DIR, __FILE__) < 0) {
fr_perror("Failed loading test dict_gctx internal dictionary");
}
+
+ if (cc->fuzzer_dir >= 0) {
+ close(cc->fuzzer_dir);
+ cc->fuzzer_dir = -1;
+ }
}
static int process_file(bool *exit_now, TALLOC_CTX *ctx, command_config_t const *config,
default_log.fd = STDOUT_FILENO;
default_log.print_level = false;
- while ((c = getopt(argc, argv, "cd:D:fxMhr:")) != -1) switch (c) {
+ while ((c = getopt(argc, argv, "cd:D:F:fxMhr:")) != -1) switch (c) {
case 'c':
do_commands = true;
break;
config.dict_dir = optarg;
break;
+ case 'F':
+ config.fuzzer_dir = optarg;
+ break;
+
case 'f':
do_features = true;
break;
$(OUTPUT)/%: $(DIR)/% $(TEST_BIN_DIR)/unit_test_attribute
$(eval DIR:=${top_srcdir}/src/tests/unit)
@echo "UNIT-TEST $(lastword $(subst /, ,$(dir $@))) $(basename $(notdir $@))"
- ${Q}if ! $(TEST_BIN)/unit_test_attribute -D ./share/dictionary -d $(DIR) -r "$@" $<; then \
- echo "TZ=GMT $(TEST_BIN)/unit_test_attribute -D ./share/dictionary -d $(DIR) -r \"$@\" $<"; \
+ ${Q}if ! $(TEST_BIN)/unit_test_attribute -F ./src/tests/fuzzer-corpus -D ./share/dictionary -d $(DIR) -r "$@" $<; then \
+ echo "TZ=GMT $(TEST_BIN)/unit_test_attribute -F ./src/tests/fuzzer-corpus -D ./share/dictionary -d $(DIR) -r \"$@\" $<"; \
rm -f $(BUILD_DIR)/tests/test.unit; \
exit 1; \
fi
+fuzzer-out util
+
#
# Parse / print data types
#
#date 2019-08-21T07:40:31-04:00
#data foo
+#
+# Switch fuzzer output to DNS corpus
+#
+fuzzer-out dns
+
#
# DNS labels
#
match Invalid character 0x5f in label
count
-match 116
+match 118
#
proto dhcpv4
proto-dictionary dhcpv4
+fuzzer-out dhcpv4
#
# DHCP TLV types
match Relay-Agent-Information.Circuit-Id = 0x3132333435363738396131323334353637383962313233343536373839633132333435363738396431323334353637383965313233343536373839663132333435363738396731323334353637383968313233343536373839613132333435363738396131323334353637383961313233343536373839613132333435363738396131323334353637383961313233343536373839613132333435363738396131323334353637383961313233343536373839613132333435363738396131323334353637383961313233343536373839613132333435363738396131323334353637383961313233343536373839613132333435363738396178797a
count
-match 44
+match 45
#
proto dhcpv4
proto-dictionary dhcpv4
+fuzzer-out dhcpv4
decode-pair 7d 7d 7d 7d 7d 7d 7d 7d 37 37 37 37 37 37 37 37 3f 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 37 be 37 37 37 2a 30 30 30 30 30 74 30 30 30 30 30 30 32 1d 00 37 31 37 38 30 38 32 35 37 33 30 36 31 37 00 04 00 00 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 00 00 00 00 20 00 37 37 37 37 37 37 37 37 00 00 1a 29 00 00 00 00 63 00 01 00 00
match raw.V-I-Vendor-Specific.2105376125.125 = 0x7d7d37373737373737373f37373737373737373737373737373737373737373737373737be3737372a303030303074303030303030321d00373137383038323537333036313700040000370000000000000000000000000000000000fa000000000000002000373737373737373700001a2900000000630001
match raw.Router-Address = 0x7f0000017f0000
count
-match 20
+match 21
#
proto dhcpv4
proto-dictionary dhcpv4
+fuzzer-out dhcpv4
encode-proto Opcode = Client-Message, Hardware-Type = Ethernet, Hardware-Address-Length = 6, Hop-Count = 0, Transaction-Id = 0, Number-of-Seconds = 0, Flags = 0, Client-IP-Address = 0.0.0.0, Your-IP-Address = 0.0.0.0, Server-IP-Address = 0.0.0.0, Gateway-IP-Address = 10.11.19.3, Client-Hardware-Address = 44:48:42:66:00:5a, Message-Type = Discover, Network-Subnet = 10.11.19.3/32
match 01 01 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 0b 13 03 44 48 42 66 00 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
match Opcode = Client-Message, Hardware-Type = Ethernet, Hardware-Address-Length = 6, Hop-Count = 0, Transaction-Id = 0, Number-of-Seconds = 0, Flags = 0, Client-IP-Address = 0.0.0.0, Your-IP-Address = 0.0.0.0, Server-IP-Address = 0.0.0.0, Gateway-IP-Address = 10.11.19.3, Client-Hardware-Address = 44:48:42:66:00:5a, Message-Type = Discover, Network-Subnet = 10.11.19.3/32
count
-match 6
+match 7
#
proto dhcpv4
proto-dictionary dhcpv4
+fuzzer-out dhcpv4
encode-pair V-I-Vendor-Specific.Cisco.Indirect-Image-Filename = "aa.txt"
match 7d 0d 00 00 00 09 08 05 06 61 61 2e 74 78 74
#
# PEN + option_len, where option_len 09 > end of attribute
-#
+#
decode-pair 7d 0d 00 00 00 09 09 05 06 61 61 2e 74 78 74
match raw.V-I-Vendor-Specific.Cisco.5 = 0x09050661612e747874
count
-match 14
+match 15
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Encode ipv6address
match Unicast = 2001:db8:85a3:cade:cafe:8a2e:370:7334
count
-match 42
+match 43
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# True values are encoded by using an empty attribute.
match Rapid-Commit = yes
encode-pair Rapid-Commit = no
-match
+match
# And we can't decode nothing...
count
-match 8
+match 9
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Date. Like a 32bit unix timestamp but starts from 1st Jan 2000 instead of 1st Jan 2000
match Failover-Expiration-Time = "Jan 1 2000 00:00:01 UTC"
count
-match 20
+match 21
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
encode-pair SIP-Server-Domain-Name-List = "foo.ca"
match 00 15 00 08 03 66 6f 6f 02 63 61 00
match SIP-Server-Domain-Name-List = "www.example.com", SIP-Server-Domain-Name-List = "ftp.example.com", SIP-Server-Domain-Name-List = "ns.example.com"
count
-match 18
+match 19
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Array of 16bit integers
match SIP-Server-Address = 2001:db8:85a3::8a2e:370:7334, SIP-Server-Address = 2001:db8:85a3::8a2e:370:7335, SIP-Server-Address = 2001:4860:4860::8888
count
-match 18
+match 19
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1 byte unsigned integer (uint8)
match Information-Refresh-Time = 99
count
-match 18
+match 19
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Microsoft VSAs. We have no idea what the contents are, and the documentation doesn't say.
match Vendor-Opts.Microsoft.Rogue-Detection-Request = 0x00
count
-match 6
+match 7
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
encode-pair IA-Addr.IPv6-Address = 2001:db8::c:78eb, IA-Addr.Valid-Lifetime = 3600
match 00 05 00 18 20 01 0d b8 00 00 00 00 00 00 00 00 00 0c 78 eb 00 00 00 00 00 00 0e 10
match Packet-Type = Request, Transaction-ID = 0xabcdef, Client-ID.DUID = UUID, Client-ID.DUID.UUID.Value = 0x000102030405060708090a0b0c0d0e0f
count
-match 18
+match 19
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1.
match 07 1e 29 1d 00 19 00 29 02 03 04 05 00 00 00 96 00 00 00 fa 00 1a 00 19 00 00 00 fa 00 00 01 2c 38 2a 00 00 01 00 01 01 00 00 00 00 00 00 00 00 00 00 01 00 0a 00 03 00 01 00 01 02 03 04 05 00 02 00 0e 00 01 00 01 18 3f 4e f0 00 11 22 33 44 55 00 07 00 01 0a 00 17 00 10 2a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 40 00 18 09 61 66 74 72 2d 6e 61 6d 65 08 6d 79 64 6f 6d 61 69 6e 03 6e 65 74 00
count
-match 18
+match 19
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Client <-> Server
match Packet-Type = Reply, Transaction-ID = 0x00b33f, Client-ID.DUID = UUID, Client-ID.DUID.UUID.Value = 0x000102030405060708090a0b0c0d0e0f, Server-ID.DUID = UUID, Server-ID.DUID.UUID.Value = 0x000102030405060708090a0b0c0d0e0f, Status-Code.Value = Success, Status-Code.Message = "Release received."
count
-match 26
+match 27
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1.
match 07 aa 56 ce 00 01 00 0e 00 01 00 01 18 f0 0b 3f 00 0c 29 38 f3 68 00 02 00 0e 00 01 00 01 18 ef 95 1b 00 0c 29 9b a1 53 00 18 00 31 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 05 73 61 6c 65 73 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 03 65 6e 67 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00
count
-match 6
+match 7
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1.
match Packet-Type = Reply, Transaction-ID = 0x2ffdd1, IA-NA.IAID = 33752069, IA-NA.T1 = 3600, IA-NA.T2 = 5400, IA-NA.Options = { IA-Addr.IPv6-Address = 2a00:1:1:200:38e6:b22e:c440:acdf, IA-Addr.Preferred-Lifetime = 4500, IA-Addr.Valid-Lifetime = 7200 }, Client-ID.DUID = LL, Client-ID.DUID.LL.Hardware-Type = Ethernet, Client-ID.DUID.LL.Hardware-Type.Ethernet.Address = 00:01:02:03:04:05, Server-ID.DUID = LLT, Server-ID.DUID.LLT.Hardware-Type = Ethernet, Server-ID.DUID.LLT.Time = "Nov 26 2012 15:34:36 UTC", Server-ID.DUID.LLT.Hardware-Type.Ethernet.Address = 00:11:22:33:44:55
count
-match 10
+match 11
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1.
match 07 12 b0 8a 00 19 00 29 02 03 04 05 00 00 0e 10 00 00 15 18 00 1a 00 19 00 00 11 94 00 00 1c 20 38 2a 00 00 01 00 01 01 00 00 00 00 00 00 00 00 00 00 01 00 0a 00 03 00 01 00 01 02 03 04 05 00 02 00 0e 00 01 00 01 18 46 49 99 00 11 22 33 44 55
count
-match 18
+match 19
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1.
match 07 2b 0e 45 00 04 00 20 02 03 04 05 00 05 00 18 2a 00 00 01 00 01 02 00 5d a2 f9 20 84 c4 88 cc 00 00 11 94 00 00 1c 20 00 01 00 0a 00 03 00 01 00 01 02 03 04 05 00 02 00 0e 00 01 00 01 18 46 47 f0 00 11 22 33 44 55
count
-match 18
+match 19
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1.
match 07 f6 9b 57 00 01 00 0e 00 01 00 01 18 f0 0b 3f 00 0c 29 38 f3 68 00 02 00 0e 00 01 00 01 18 ef 95 1b 00 0c 29 9b a1 53 00 38 00 3d 00 01 00 10 2a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 02 00 10 ff 05 00 00 00 00 00 00 00 00 00 00 00 00 01 01 00 03 00 11 03 6e 74 70 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00
count
-match 6
+match 7
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 1.
match 07 68 90 d8 00 01 00 0e 00 01 00 01 18 f0 0b 3f 00 0c 29 38 f3 68 00 02 00 0e 00 01 00 01 18 ef 95 1b 00 0c 29 9b a1 53 00 15 00 3e 04 73 69 70 31 09 6d 79 2d 64 6f 6d 61 69 6e 03 6e 65 74 00 04 73 69 70 32 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 04 73 69 70 33 03 73 75 62 09 6d 79 2d 64 6f 6d 61 69 6e 03 6f 72 67 00
count
-match 6
+match 7
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
decode-proto 0c0126058600000680000000000000000000fe80000000000000025056fffea353fe000900c40c0000000000000000000000000000000000fe80000000000000025056fffea353fe0012001c4c41424f4c54322065746820312f312f30352f30312f32382f312f310009007e011141d70001000e0001000126b1b7f1005056a353fe0012001c4c41424f4c54322065746820312f312f30352f30312f32382f312f310006000200180008000200000003002856a353fe00000e1000001518000500182605860000064000000000000000000100001c2000002a300019000c56a353fe00000e1000001518002500120000197f0001000126b1b7f1005056a353fe0011002a0000197f0001000a4c41424f4c54322d6e610002000a4c41424f4c54322d7064000300013f0004000140
match Packet-Type = Relay-Forward, Hop-Count = 1, Relay-Link-Address = 2605:8600:6:8000::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Relay-Message = { Packet-Type = Relay-Forward, Hop-Count = 0, Relay-Link-Address = ::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Interface-ID = 0x4c41424f4c54322065746820312f312f30352f30312f32382f312f31, Relay-Message = { Packet-Type = Solicit, Transaction-ID = 0x1141d7, Client-ID.DUID = LLT, Client-ID.DUID.LLT.Hardware-Type = Ethernet, Client-ID.DUID.LLT.Time = "Jul 27 2020 16:06:09 UTC", Client-ID.DUID.LLT.Hardware-Type.Ethernet.Address = 00:50:56:a3:53:fe, Interface-ID = 0x4c41424f4c54322065746820312f312f30352f30312f32382f312f31, Option-Request = Domain-List, Elapsed-Time = 0, IA-NA.IAID = 1453544446, IA-NA.T1 = 3600, IA-NA.T2 = 5400, IA-NA.Options = { IA-Addr.IPv6-Address = 2605:8600:6:4000::1, IA-Addr.Preferred-Lifetime = 7200, IA-Addr.Valid-Lifetime = 10800 }, IA-PD.IAID = 1453544446, IA-PD.T1 = 3600, IA-PD.T2 = 5400 } }, Relay-Agent-Remote-ID.Vendor = 6527, Relay-Agent-Remote-ID.Value = 0x0001000126b1b7f1005056a353fe, Vendor-Opts.Nokia-SR.WAN-Pool = "LABOLT2-na", Vendor-Opts.Nokia-SR.PFX-Pool = "LABOLT2-pd", Vendor-Opts.Nokia-SR.PFX-Len = 63, Vendor-Opts.Nokia-SR.Reserved-NA-Len = 64
match Packet-Type = Relay-Forward, Hop-Count = 1, Relay-Link-Address = 2605:8600:6:8000::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Relay-Message = { Packet-Type = Relay-Forward, Hop-Count = 0, Relay-Link-Address = ::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Interface-ID = 0x4c41424f4c54322065746820312f312f30352f30312f32382f312f31, Relay-Message = { Packet-Type = Solicit, Transaction-ID = 0x1141d7, Client-ID.DUID = LLT, Client-ID.DUID.LLT.Hardware-Type = Ethernet, Client-ID.DUID.LLT.Time = "Jul 27 2020 16:06:09 UTC", Client-ID.DUID.LLT.Hardware-Type.Ethernet.Address = 00:50:56:a3:53:fe, Interface-ID = 0x4c41424f4c54322065746820312f312f30352f30312f32382f312f31, Option-Request = Domain-List, Elapsed-Time = 0, IA-NA.IAID = 1453544446, IA-NA.T1 = 3600, IA-NA.T2 = 5400, IA-NA.Options = { IA-Addr.IPv6-Address = 2605:8600:6:4000::1, IA-Addr.Preferred-Lifetime = 7200, IA-Addr.Valid-Lifetime = 10800 }, IA-PD.IAID = 1453544446, IA-PD.T1 = 3600, IA-PD.T2 = 5400 } }, Relay-Agent-Remote-ID.Vendor = 6527, Relay-Agent-Remote-ID.Value = 0x0001000126b1b7f1005056a353fe, Vendor-Opts.Nokia-SR.WAN-Pool = "LABOLT2-na", Vendor-Opts.Nokia-SR.PFX-Pool = "LABOLT2-pd", Vendor-Opts.Nokia-SR.PFX-Len = 63, Vendor-Opts.Nokia-SR.Reserved-NA-Len = 64
count
-match 8
+match 9
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
encode-proto Packet-Type = Relay-Reply, Hop-Count = 1, Relay-Link-Address = 2605:8600:6:8000::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Interface-ID = 0x6c61672d373a3130352e313238, Relay-Message = { Packet-Type = Relay-Reply, Hop-Count = 0, Relay-Link-Address = ::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Interface-ID = 0x4c41424f4c54322065746820312f312f30352f30312f32382f312f31, Relay-Message = { Packet-Type = Advertise, Transaction-ID = 0x950806, Client-ID.DUID = LLT, Client-ID.DUID.LLT.Hardware-Type = Ethernet, Client-ID.DUID.LLT.Time = "Jul 27 2020 16:06:09 UTC", Client-ID.DUID.LLT.Hardware-Type.Ethernet.Address = 00:50:56:a3:53:fe } }
match 0d 01 26 05 86 00 00 06 80 00 00 00 00 00 00 00 00 00 fe 80 00 00 00 00 00 00 02 50 56 ff fe a3 53 fe 00 12 00 0d 6c 61 67 2d 37 3a 31 30 35 2e 31 32 38 00 09 00 5c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 80 00 00 00 00 00 00 02 50 56 ff fe a3 53 fe 00 12 00 1c 4c 41 42 4f 4c 54 32 20 65 74 68 20 31 2f 31 2f 30 35 2f 30 31 2f 32 38 2f 31 2f 31 00 09 00 16 02 95 08 06 00 01 00 0e 00 01 00 01 26 b1 b7 f1 00 50 56 a3 53 fe
match Packet-Type = Relay-Reply, Hop-Count = 1, Relay-Link-Address = 2605:8600:6:8000::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Interface-ID = 0x6c61672d373a3130352e313238, Relay-Message = { Packet-Type = Relay-Reply, Hop-Count = 0, Relay-Link-Address = ::, Relay-Peer-Address = fe80::250:56ff:fea3:53fe, Interface-ID = 0x4c41424f4c54322065746820312f312f30352f30312f32382f312f31, Relay-Message = { Packet-Type = Advertise, Transaction-ID = 0x950806, Client-ID.DUID = LLT, Client-ID.DUID.LLT.Hardware-Type = Ethernet, Client-ID.DUID.LLT.Time = "Jul 27 2020 16:06:09 UTC", Client-ID.DUID.LLT.Hardware-Type.Ethernet.Address = 00:50:56:a3:53:fe } }
count
-match 6
+match 7
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Encoding an option header:
match Server-ID.DUID = LL, raw.Server-ID.DUID.LL = 0x00ffd34d00c0ffee
count
-match 28
+match 29
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 3.1 SIP Servers Domain Name List
match SIP-Server-Address = 2001:db8:85a3::8a2e:370:7334, SIP-Server-Address = 2001:db8:85a3::8a2e:370:7335, SIP-Server-Address = 2001:4860:4860::8888
count
-match 30
+match 31
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
encode-pair IA-PD.IAID = 0, IA-PD.T1 = 0, IA-PD.T2 = 0, IA-PD.Options = { Preference = 1 }
match 00 19 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 01 01
match IA-PD.IAID = 0, IA-PD.T1 = 0, IA-PD.T2 = 0, IA-PD.Options = { IA-PD-Prefix.Preferred-Lifetime = 4500, IA-PD-Prefix.Valid-Lifetime = 7200, IA-PD-Prefix.IPv6-Prefix = 2a00:1:1:100::/56 }
count
-match 10
+match 11
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Encoding an option header:
match 00 18 00 31 09 6d 79 64 6f 6d 61 69 6e 31 03 63 6f 6d 00 09 6d 79 64 6f 6d 61 69 6e 32 03 6c 61 6e 00 04 63 6f 72 70 09 6d 79 64 6f 6d 61 69 6e 33 02 63 6f 00
count
-match 6
+match 7
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 4. The DHCPv6 Client FQDN Option
match Client-FQDN.Reserved = 0, Client-FQDN.No-Server-Update = yes, Client-FQDN.Server-Override = no, Client-FQDN.Server-Update = no, Client-FQDN.Domain-Name = "tapioca01"
count
-match 10
+match 11
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# A1 = "ON"
#match Geoconf-Civic = { What = Client-Location, Country-Code = "CA", Civic-Address-Elements = 0x01024f4e }
count
-match 6
+match 7
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
encode-pair MOD-Address-List.IS = ::1
match 00 36 00 14 00 01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
match 00 36 00 28 00 01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
count
-match 12
+match 13
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# The format of the DHCPv6 [RFC3315] GeoLoc Option is as follows:
decode-pair -
match Geolocation.Latitude-Uncertainty = 1, Geolocation.Latitude = 1110814630, Geolocation.Longitude-Uncertainty = 1, Geolocation.Longitude = 3264701686, Geolocation.Altitude-Type = Meters, Geolocation.Altitude-Uncertainty = 1, Geolocation.Altitude = 99, Geolocation.Version = 1, Geolocation.Reserved = 0, Geolocation.Datum = NAD83-NAVD88
count
-match 6
+match 7
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Encoding an option header:
match Server-ID.DUID = UUID, raw.Server-ID.DUID.UUID = 0x000102030405060708090a0b0c0d
count
-match 36
+match 37
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
# 0 1 2 3
# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
match RDNSS-Selection.DNS-Recursive-Name-Server = ::1, RDNSS-Selection.Preference = High, RDNSS-Selection.FQDN = "ns1.example.com", RDNSS-Selection.FQDN = "ns2.example.com"
count
-match 10
+match 11
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 4. DHCPv6 Client Link-Layer Address Option
#
# type: Ethernet
-encode-pair Client-Link-Layer.Type = Ethernet, Client-Link-Layer.Type.Ethernet.Address = c0:ff:ee:c0:ff:ee
+encode-pair Client-Link-Layer.Type = Ethernet, Client-Link-Layer.Type.Ethernet.Address = c0:ff:ee:c0:ff:ee
match 00 4f 00 08 00 01 c0 ff ee c0 ff ee
decode-pair 00 4f 00 08 00 01 c0 ff ee c0 ff ee
match Client-Link-Layer.Type = Lanstar, Client-Link-Layer.Type.Lanstar.Address = 0xc0ffeec0ffee
count
-match 10
+match 11
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 2. Address Selection Options
match Address-Selection.Reserved = 0, Address-Selection.Automatic-Row-Addition = no, Address-Selection.Privacy-Reference = yes, Address-Selection.Table-Rows = { Address-Selection-Table.Label = 17, Address-Selection-Table.Precedence = 8, Address-Selection-Table.Prefix = ::ffff:0.0.0.16/128 }
count
-match 6
+match 7
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 0 1 2 3
match IP4RD-Non-Map-Rule.Traffic-Class-Provided = yes, IP4RD-Non-Map-Rule.Reserved = 0, IP4RD-Non-Map-Rule.Hub-And-Spoke = yes, IP4RD-Non-Map-Rule.Domain-PMTU = 31
count
-match 14
+match 15
#
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# 8. Client/Server Message Formats
match INF-Max-RT = 86400
count
-match 90
+match 91
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Sub-structures are children of the "key" field. Sorry. :(
match Client-ID.DUID = LL, Client-ID.DUID.LL.Hardware-Type = Ethernet, Client-ID.DUID.LL.Hardware-Type.Ethernet.Address = 00:01:02:03:04:05
count
-match 20
+match 21
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Simple string type
match Subscriber-ID = ""
count
-match 14
+match 15
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# TLV with array type values
match NTP-Server.Address = 2001:db8:85a3::8a2e:370:7334
count
-match 18
+match 19
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Simple data types
match MIP6-Home-Net-Prefix = 2a00:1:1::/55
count
-match 14
+match 15
proto dhcpv6
proto-dictionary dhcpv6
+fuzzer-out dhcpv6
#
# Array of strings, each substring should have a 16bit length field containing its length
match User-Class = 0x, User-Class = 0x
count
-match 30
+match 31
proto dns
proto-dictionary dns
+fuzzer-out dns
#
# 1.
match b4 33 81 a0 00 01 00 01 00 00 00 01 00 00 06 00 01 00 00 06 00 01 00 01 4e fe 00 40 01 61 0c 72 6f 6f 74 2d 73 65 72 76 65 72 73 03 6e 65 74 00 05 6e 73 74 6c 64 0c 76 65 72 69 73 69 67 6e 2d 67 72 73 03 63 6f 6d 00 78 57 d1 92 00 00 07 08 00 00 03 84 00 09 3a 80 00 01 51 80 00 00 29 10 00 00 00 00 00 00 1c 00 0a 00 18 36 bf 11 1f ef 2e 01 09 0a 2f 9d a2 5c 63 6f fb 49 c3 5b b1 4f a4 28 b4
count
-match 18
+match 19
#
proto dns
proto-dictionary dns
+fuzzer-out dns
# 16 bits of ID 0
# Query, all other bits are clear
# 1 answer
# 0 nscount
# 0 arcount
-#
+#
# A record of '.', class Internet, TTL 16
# length 4, with 127.0.0.1 as the IP address
match packet = { id = 0, query = response, opcode = query, authoritative = no, truncated-response = no, recursion-desired = no, recursion-available = no, reserved = no, authentic-data = no, checking-disabled = no, rcode = no-error, qdcount = 0, ancount = 3, nscount = 0, arcount = 0 }, rr = { name = "www.example.com", type = a, class = 1, ttl = 16, type.a = { ip-address = 127.0.0.1 } }, rr = { name = "ftp.example.com", type = a, class = 1, ttl = 16, type.a = { ip-address = 127.0.0.1 } }, rr = { name = "ns.example.com", type = a, class = 1, ttl = 16, type.a = { ip-address = 127.0.0.1 } }
count
-match 22
+match 23
#
proto dns
proto-dictionary dns
+fuzzer-out dns
# 0x6000 questions
decode-proto 44 81 9a 97 00 00 00 00 60 00 00 00 00 00 01 00 2d 00 00 dc dc 23
match DNS packet malformed - more resource records than indicated in header
-#
+#
decode-proto 44 81 9a 97 00 00 00 00 00 01 00 00 01 00 00 00 2d 00 00 dc dc 23
match DNS packet malformed - more resource records than indicated in header
match DNS packet malformed - more resource records than indicated in header
count
-match 12
+match 13
#
proto dns
proto-dictionary dns
+fuzzer-out dns
decode-proto f6 ab 01 20 00 01 00 00 00 00 00 01 00 00 06 00 01 00 00 29 10 00 00 00 00 00 00 0c 00 0a 00 08 36 bf 11 1f ef 2e 01 09
match packet = { id = 63147, query = query, opcode = query, authoritative = no, truncated-response = no, recursion-desired = yes, recursion-available = no, reserved = no, authentic-data = yes, checking-disabled = no, rcode = no-error, qdcount = 1, ancount = 0, nscount = 0, arcount = 1 }, question = { qname = ".", qtype = 6, qclass = internet }, ar = { name = ".", type = opt, class = 4096, ttl = 0, type.opt = { options = { cookie = { client = 0x36bf111fef2e0109 } } } }
match f6 ab 01 20 00 01 00 00 00 00 00 01 00 00 06 00 01 00 00 29 10 00 00 00 00 00 00 0c 00 0a 00 08 36 bf 11 1f ef 2e 01 09
count
-match 6
+match 7
proto radius
proto-dictionary radius
+fuzzer-out radius
encode-pair Vendor-Specific.Ascend.Data-Filter = "ip in drop tcp dstport > 1023"
match 1a 28 00 00 02 11 f2 22 01 00 01 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 03 ff 00 03 00 00 00 00 00 00 00 00 00 00
match Vendor-Specific.Ascend.Send-Secret = "foo 56789abcdef0"
count
-match 22
+match 23
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# See share/dictionary/radius/dictionary.iana for these attributes.
count
-match 14
+match 15
#
proto radius
proto-dictionary radius
+fuzzer-out radius
encode-pair Unit-TLV = { Test-Enum-Integer64 = one }
match fe 0c 0c 0a 00 00 00 00 00 00 00 01
match Unit-TLV = { Test-Enum-Integer32 = one }
count
-match 10
+match 11
#
proto radius
proto-dictionary radius
+fuzzer-out radius
decode-pair 01 04 00
match fr_radius_decode_pair: Insufficient data
match fr_radius_decode_pair: Insufficient data
count
-match 6
+match 7
# Load libfreeradius-radius
proto radius
proto-dictionary radius
+fuzzer-out radius
# Example attributes as used in RFC 6929
raw 241.1 "bob"
match Extended-Attribute-5.Extended-Vendor-Specific-5.1.6 = 0x0101
count
-match 60
+match 61
proto radius
proto-dictionary radius
+fuzzer-out radius
encode-pair Vendor-Specific.Lucent.Max-Shared-Users = 1
match 1a 0d 00 00 12 ee 00 02 07 00 00 00 01
match 1a 0d 00 00 12 ee ff 02 07 00 00 00 01
count
-match 10
+match 11
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# 1.
match Packet-Type = CoA-Request, Packet-Authentication-Vector = 0x7fbf02c6662b5990838a5e6e331b3ff0, User-Name = "bob"
count
-match 4
+match 5
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# 1.
match Packet-Type = Access-Accept, Packet-Authentication-Vector = 0xfbba6a784c7decb314caf0f27944a37b, Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Reply-Message = "Hello, John.McGuirk", EAP-Message = 0x03010004, Message-Authenticator = 0xb9c4ae6213a71d32125ef7ca4e4c6360, User-Name = "John.McGuirk"
count
-match 10
+match 11
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# 1.
match Packet-Type = Access-Request, Packet-Authentication-Vector = 0x2afdb090418ac6365298fbbb15e0fd2e, User-Name = "bob", User-Password = "hello", NAS-IPv6-Address = 2001:db8:a0b:12f0::1, Framed-IPv6-Prefix = 2001:db8:a0b:12f0::/64, Framed-IPv6-Prefix = 2001:db8:a0b:12f0::/64, Framed-IPv6-Prefix = ::/0, raw.Framed-IPv6-Prefix = 0x00, raw.Framed-IPv6-Prefix = 0x004020010db80a0b12f0000000000000000000, raw.Framed-IPv6-Prefix = 0x008120010db80a0b12f00000000000000001
count
-match 8
+match 9
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# 1.
match Packet-Type = Access-Accept, Packet-Authentication-Vector = 0xfbaa7d05d009953514d00697da4d1dfc, Egress-VLANID = 855638139, Ingress-Filters = 3, Egress-VLAN-Name = "3vlanname"
count
-match 14
+match 15
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# 1.
match Packet-Type = Access-Request, Packet-Authentication-Vector = 0xbc6e7022445e359835692c8c121c1985, User-Name = "bob", User-Password = "\204\032\0225\365\360\3048\204\356\351\370b\321\377\210", Error-Cause = Residual-Context-Removed, Error-Cause = 209
count
-match 4
+match 5
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# 1.
match Packet-Type = CoA-NAK, Packet-Authentication-Vector = 0x40f21bdee27a87a5d757a30bfed62f28, Message-Authenticator = 0x852579e8e2e5dcbd781a9007266a06a7
count
-match 14
+match 15
#
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# 1.
match Packet-Type = Access-Accept, Packet-Authentication-Vector = 0xf8ee562ed9f55c3a6681982499070d57, Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobson-TCP-IP
count
-match 40
+match 41
proto radius
proto-dictionary radius
+fuzzer-out radius
decode-pair 05 04 01 02
match raw.NAS-Port = 0x0102
match 05 04 01 02
count
-match 8
+match 9
proto radius
proto-dictionary radius
+fuzzer-out radius
encode-pair User-Name = "bob"
match 01 05 62 6f 62
match EAP-Message = 0x78787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787861
count
-match 72
+match 73
# Load libfreeradius-radius
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# The salt is taken from fr_fast_rand(), with a seed set
match Tunnel-Client-Endpoint = "\001\002\003"
count
-match 44
+match 45
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# RFC 4849 NAS-Filter-Rule
match NAS-Filter-Rule = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
count
-match 30
+match 31
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# RADIUS does not (yet) support nested TLVs.
match Extended-Attribute-1.IP-Port-Range = { Type = 1, Limit = 2 }
count
-match 14
+match 15
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# Structs in RADIUS
match ff 0d 02 00 00 1a 99 ff fe fd fc fb fa
count
-match 32
+match 33
#
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# Time delta in milliseconds.
match Unit-TLV = { Delta-MSec-int32 = 2147483647 }
count
-match 64
+match 65
#
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# Torture tests for various types
match -36
count
-match 20
+match 21
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# We can't look at the data here, because the encode-paird Tunnel-Password has a 2 byte
match -1
count
-match 63
+match 64
# Load libfreeradius-radius
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# And using the dictionaries
# that format instead of guessing.
#
-encode-pair Extended-Attribute-1.Unit-Ext-241-TLV.Unit-TLV-Integer = 1, Extended-Attribute-1.Unit-Ext-241-TLV.Unit-TLV-Integer = 2
+encode-pair Extended-Attribute-1.Unit-Ext-241-TLV.Unit-TLV-Integer = 1, Extended-Attribute-1.Unit-Ext-241-TLV.Unit-TLV-Integer = 2
match f1 0f f3 01 06 00 00 00 01 01 06 00 00 00 02
decode-pair -
match Unit-TLV.Milliseconds = "2019-08-21T03:40:31.123Z"
count
-match 32
+match 33
proto radius
proto-dictionary radius
+fuzzer-out radius
load-dictionary dictionary
match 1a 0b 00 00 00 09 01 05 66 6f 6f 1a 0b 00 00 00 09 01 05 62 61 72
count
-match 51
+match 52
proto radius
proto-dictionary radius
+fuzzer-out radius
#
# Test vectors for WiMAX attributes.
#
# We copied enums, too
-#
+#
encode-pair Vendor-Specific.WiMAX.Packet-Flow-Descriptor.Classifier.Src-Spec.Assigned = Src-Assigned
match 1a 10 00 00 60 b5 1c 0a 00 0b 07 05 05 07 03 01
match Vendor-Specific.Telrad.TSDF-Table = { TSDF-Parameters = { Reference-QOS-Profile-Name = "garbage" } }
count
-match 126
+match 127
#
proto tacacs
proto-dictionary tacacs
+fuzzer-out tacacs
# ./pam_tacplus/tacc -TRA -u bob -p hello -s 172.17.0.2 -r 1.1.1.1 -k testing123 -S ppp -P ip -L pap
# N.B. decrypted and unencrypted flag has been set
match 'Argument-List' argument 3 length 32 overflows the remaining data (0) in the packet
count
-match 28
+match 29
#
proto tacacs
proto-dictionary tacacs
+fuzzer-out tacacs
#
# These are the same test packets as for base.txt. Instead of using the crappy format of
match c0 03 01 00 07 9b 35 d9 00 00 00 5a 7c 8a 99 d6 88 f9 32 3c ed 21 75 25 89 18 7f d0 9f 53 64 c6 9a 0c a7 d8 37 59 ff 5b 8a 0f 08 16 bf 67 9d 02 9e 62 6b 0c e1 9e b4 a3 77 0c 23 c4 d5 5b d0 19 f2 3d 07 57 98 e4 2d f1 4d ef 5e b2 2f 84 d4 9e 5d 8f 13 05 f0 09 6a 44 66 ad 3a fb 59 0c 1d 7a d0 d5 0a 4c 3e 11
count
-match 15
+match 16
#
proto tftp
proto-dictionary tftp
+fuzzer-out tftp
#
# Client -> Server (Read-Request) - Without block-size
match 00 05 00 04 4b 61 6c 6f 73 20 46 61 75 6c 74 00
count
-match 26
+match 27
#
proto tftp
proto-dictionary tftp
+fuzzer-out tftp
#
# Invalid blksize
match Invalid TFTP opcode 0000
count
-match 18
+match 19
#
proto vmps
proto-dictionary vmps
+fuzzer-out vmps
#
# decode Join-Request
match 01 02 00 02 00 00 12 34 00 00 0c 03 00 08 4d 69 72 61 6b 75 6c 6f 00 00 0c 08 00 06 ca fe ca fe ca fe
count
-match 10
+match 11