Add dns_message_parse() fuzzer

Previously, the bin/system/wire_test.c was optionally used as a fuzzer,
this commit extracts the parts relevant to the fuzzing into a
specialized fuzzer that can be used in oss-fuzz project.

The fuzzer parses the input as UDP DNS message, then prints parsed DNS
message, then renders the DNS message and then prints the rendered DNS
message.  No part of the code should cause a assertion failure.

diff --git a/fuzz/.gitignore b/fuzz/.gitignore
index 7f88801a32e772691d02d3fe81326e3d73d81cf4..8a24d62c2a3ebaf3cee9d7a1800cf4f894488c61 100644 (file)
--- a/fuzz/.gitignore
+++ b/fuzz/.gitignore
@@ -1,5 +1,6 @@
 /*.dSYM/
 /*.out/
+/dns_message_parse
 /dns_name_fromtext_target
 /dns_rdata_fromwire_text
 /isc_lex_getmastertoken

diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am
index 9eecd6111cd469be2f038c19bfcdb708271462d5..4ba24e40296d770222254528fd2ea5df37a3c6b4 100644 (file)
--- a/fuzz/Makefile.am
+++ b/fuzz/Makefile.am
@@ -19,12 +19,14 @@ libfuzzmain_la_SOURCES =            \
        main.c
 
 check_PROGRAMS =                       \
+       dns_message_parse               \
        dns_name_fromtext_target        \
        dns_rdata_fromwire_text         \
        isc_lex_getmastertoken          \
        isc_lex_gettoken
 
 EXTRA_DIST =                           \
+       dns_message_parse.in            \
        dns_name_fromtext_target.in     \
        dns_rdata_fromwire_text.in      \
        isc_lex_getmastertoken.in       \

diff --git a/fuzz/dns_message_parse.c b/fuzz/dns_message_parse.c
new file mode 100644 (file)
index 0000000..3c1c678
--- /dev/null
+++ b/fuzz/dns_message_parse.c
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdlib.h>
+
+#include <isc/buffer.h>
+#include <isc/commandline.h>
+#include <isc/file.h>
+#include <isc/mem.h>
+#include <isc/print.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/message.h>
+#include <dns/result.h>
+
+#include "fuzz.h"
+
+bool debug = false;
+
+static isc_mem_t *mctx = NULL;
+static uint8_t *output = NULL;
+static size_t output_len = 1024;
+static uint8_t *render_buf[64 * 1024];
+
+int
+LLVMFuzzerInitialize(int *argc __attribute__((unused)),
+                    char ***argv __attribute__((unused))) {
+       isc_mem_create(&mctx);
+       output = isc_mem_get(mctx, output_len);
+
+       return (0);
+}
+
+static isc_result_t
+parse_message(isc_buffer_t *input, dns_message_t **messagep) {
+       isc_result_t result;
+       dns_message_t *message = NULL;
+
+       result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &message);
+       if (result != ISC_R_SUCCESS) {
+               return (result);
+       }
+
+       result = dns_message_parse(message, input, DNS_MESSAGEPARSE_BESTEFFORT);
+       if (result == DNS_R_RECOVERABLE) {
+               result = ISC_R_SUCCESS;
+       }
+
+       if (result == ISC_R_SUCCESS && messagep != NULL) {
+               *messagep = message;
+       } else {
+               dns_message_destroy(&message);
+       }
+
+       return (result);
+}
+
+static isc_result_t
+print_message(dns_message_t *message) {
+       isc_result_t result;
+       isc_buffer_t buffer;
+
+       do {
+               isc_buffer_init(&buffer, output, output_len);
+               result = dns_message_totext(message, &dns_master_style_debug, 0,
+                                           &buffer);
+               if (result == ISC_R_NOSPACE) {
+                       isc_mem_put(mctx, output, output_len);
+                       output_len *= 2;
+                       output = isc_mem_get(mctx, output_len);
+                       continue;
+               }
+       } while (result == ISC_R_NOSPACE);
+
+       return (result);
+}
+
+#define CHECKRESULT(r, f)                 \
+       {                                 \
+               r = (f);                  \
+               if (r != ISC_R_SUCCESS) { \
+                       return (r);       \
+               }                         \
+       }
+
+static isc_result_t
+render_message(dns_message_t **messagep) {
+       isc_result_t result;
+       dns_message_t *message = *messagep;
+       isc_buffer_t buffer;
+       dns_compress_t cctx;
+
+       isc_buffer_constinit(&buffer, render_buf, sizeof(render_buf));
+
+       message->from_to_wire = DNS_MESSAGE_INTENTRENDER;
+       for (size_t i = 0; i < DNS_SECTION_MAX; i++) {
+               message->counts[i] = 0;
+       }
+
+       CHECKRESULT(result, dns_compress_init(&cctx, -1, mctx));
+       CHECKRESULT(result, dns_message_renderbegin(message, &cctx, &buffer));
+
+       CHECKRESULT(result, dns_message_rendersection(message,
+                                                     DNS_SECTION_QUESTION, 0));
+
+       CHECKRESULT(result,
+                   dns_message_rendersection(message, DNS_SECTION_ANSWER, 0));
+       CHECKRESULT(result, dns_message_rendersection(
+                                   message, DNS_SECTION_AUTHORITY, 0));
+
+       CHECKRESULT(result, dns_message_rendersection(
+                                   message, DNS_SECTION_ADDITIONAL, 0));
+
+       dns_message_renderend(message);
+
+       dns_compress_invalidate(&cctx);
+
+       message->from_to_wire = DNS_MESSAGE_INTENTPARSE;
+
+       dns_message_destroy(messagep);
+
+       result = parse_message(&buffer, messagep);
+
+       return (result);
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+       isc_buffer_t buffer;
+       isc_result_t result;
+       dns_message_t *message = NULL;
+
+       if (size > 65535) {
+               return (0);
+       }
+
+       isc_buffer_constinit(&buffer, data, size);
+       isc_buffer_add(&buffer, size);
+       isc_buffer_setactive(&buffer, size);
+
+       result = parse_message(&buffer, &message);
+       if (result != ISC_R_SUCCESS) {
+               goto cleanup;
+       }
+
+       result = print_message(message);
+       if (result != ISC_R_SUCCESS) {
+               goto cleanup;
+       }
+
+       result = render_message(&message);
+       if (result != ISC_R_SUCCESS) {
+               goto cleanup;
+       }
+
+       result = print_message(message);
+       if (result != ISC_R_SUCCESS) {
+               goto cleanup;
+       }
+
+cleanup:
+       if (message != NULL) {
+               dns_message_destroy(&message);
+       }
+
+       return (0);
+}

diff --git a/util/copyrights b/util/copyrights
index c9f22cb0c2336a4ccfb9d6b9dd925ba11674fdb2..53b2b35e763eacb14aa73df70dc36e253ef103d8 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -1239,6 +1239,7 @@
 ./docutil/patch-db2latex-nested-param-bug      X       2007,2018,2019,2020
 ./docutil/patch-db2latex-xsltproc-title-bug    X       2007,2018,2019,2020
 ./fuzz/afl.sh                                  SH      2020
+./fuzz/dns_message_parse.c                     C       2020
 ./fuzz/dns_name_fromtext_target.c              C       2018,2019,2020
 ./fuzz/dns_rdata_fromwire_text.c               C       2019,2020
 ./fuzz/fuzz.h                                  C       2018,2019,2020