OVS Fuzzers

OvS fuzzer test harnesses define the libFuzzer fuzz API. In doing so, they define what is to be done with the input supplied by the fuzzer.

At a minimum, the libfuzzer API is defined as follows:

// input_ is a byte array, size is the length of said byte array
int
LLVMFuzzerTestOneInput(const uint8_t *input, size_t size)
{
    // Input processing
    process_input(input, size);

    // Must always return 0. Non-zero return codes are reserved by libFuzzer.
    return 0;
}

In certain scenarios, it may be necessary to constrain the input supplied by the fuzzer. One scenario is when process_input accepts a C string. One way to do this would be as follows:

// input_ is a byte array, size is the length of said byte array
int
LLVMFuzzerTestOneInput(const uint8_t *input, size_t size)
{
    // Constrain input
    // Check if input is null terminated
    const char *cstring = (const char*) input;
    if (cstring[size - 1] != '\0')
        return 0;

    // Input processing
    process_input(cstring);

    // Must always return 0. Non-zero return codes are reserved by libFuzzer.
    return 0;
}

OvS fuzzer test harnesses are located in the tests/oss-fuzz sub-directory. At the time of writing, there are a total of six harnesses:

  • flow_extract_target.c

  • json_parser_target.c

  • miniflow_target.c

  • odp_target.c

  • ofctl_parse_target.c

  • ofp_print_target.c

flow_extract_target

Extracts flow from and parses fuzzer supplied packet payload.

json_parser_target

Parses fuzzer supplied string as JSON, encoding the parsed JSON into a JSON RPC message, and finally decoding the encoded JSON RPC message back to JSON.

miniflow_target

Extracts flow from fuzzer supplied packet payload, converts flow to a miniflow and performs various miniflow operations.

odp_target

Parses fuzzer supplied string as an ODP flow, and the same string as an ODP action.

ofctl_parse_target

Treats fuzzer supplied input as a <flow_command> followed by a <flow_mod_string>, invoking the parse_ofp_flow_mod_str on the pair.

ofp_print_target

Parses fuzzer supplied data as an Open Flow Protocol buffer.

Security Analysis of OVS Fuzzers ›
‹ OVS Fuzzing Infrastructure
Contents
Browse
Navigation