2
0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 05:57:52 +00:00

Add dns_rdata_fromtext() fuzzer

... along with dns_rdataclass_fromtext and dns_rdatatype_fromtext

Most of the test binary is modified named-rrchecker. Main differences:
- reads single RR and exists
- does not refuse meta classes and rr types
We actually do have some fromtext code for meta-things so erroring out
in named-rrchecker would prevent us from testing this code.

Corpus has examples of all currently supported RR types. I did not do
any minimization.

In future use command

    diff -U0 \
	<(sed -n -e 's/^.*fromtext_\(.*\)(.*$/\1/p' lib/dns/code.h | \
		sort) \
	<(ls fuzz/dns_rdata_fromtext.in/)

to check for missing RR types.
This commit is contained in:
Petr Špaček 2021-02-18 21:29:33 +01:00
parent 759ad04eb8
commit dc9ba2d3ef
No known key found for this signature in database
GPG Key ID: ABD587CDF06581AE
91 changed files with 244 additions and 10 deletions

1
fuzz/.gitignore vendored
View File

@ -3,6 +3,7 @@
/dns_master_load /dns_master_load
/dns_message_parse /dns_message_parse
/dns_name_fromtext_target /dns_name_fromtext_target
/dns_rdata_fromtext
/dns_rdata_fromwire_text /dns_rdata_fromwire_text
/isc_lex_getmastertoken /isc_lex_getmastertoken
/isc_lex_gettoken /isc_lex_gettoken

View File

@ -22,6 +22,7 @@ check_PROGRAMS = \
dns_master_load \ dns_master_load \
dns_message_parse \ dns_message_parse \
dns_name_fromtext_target \ dns_name_fromtext_target \
dns_rdata_fromtext \
dns_rdata_fromwire_text \ dns_rdata_fromwire_text \
isc_lex_getmastertoken \ isc_lex_getmastertoken \
isc_lex_gettoken isc_lex_gettoken
@ -30,6 +31,7 @@ EXTRA_DIST = \
dns_master_load.in \ dns_master_load.in \
dns_message_parse.in \ dns_message_parse.in \
dns_name_fromtext_target.in \ dns_name_fromtext_target.in \
dns_rdata_fromtext.in \
dns_rdata_fromwire_text.in \ dns_rdata_fromwire_text.in \
isc_lex_getmastertoken.in \ isc_lex_getmastertoken.in \
isc_lex_gettoken.in isc_lex_gettoken.in

View File

@ -24,13 +24,9 @@
bool debug = false; bool debug = false;
static isc_mem_t *mctx = NULL;
int int
LLVMFuzzerInitialize(int *argc __attribute__((unused)), LLVMFuzzerInitialize(int *argc __attribute__((unused)),
char ***argv __attribute__((unused))) { char ***argv __attribute__((unused))) {
isc_mem_create(&mctx);
RUNTIME_CHECK(dst_lib_init(mctx, NULL) == ISC_R_SUCCESS);
return (0); return (0);
} }
@ -40,10 +36,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
isc_result_t result; isc_result_t result;
dns_fixedname_t origin; dns_fixedname_t origin;
if (size < 5) {
return (0);
}
dns_fixedname_init(&origin); dns_fixedname_init(&origin);
isc_buffer_constinit(&buf, data, size); isc_buffer_constinit(&buf, data, size);
@ -52,6 +44,9 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
result = dns_name_fromtext(dns_fixedname_name(&origin), &buf, result = dns_name_fromtext(dns_fixedname_name(&origin), &buf,
dns_rootname, 0, NULL); dns_rootname, 0, NULL);
UNUSED(result); if (debug) {
fprintf(stderr, "dns_name_fromtext: %s\n",
isc_result_totext(result));
}
return (0); return (0);
} }

151
fuzz/dns_rdata_fromtext.c Normal file
View File

@ -0,0 +1,151 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
#include <stdbool.h>
#include <stdlib.h>
#include <isc/attributes.h>
#include <isc/buffer.h>
#include <isc/commandline.h>
#include <isc/lex.h>
#include <isc/mem.h>
#include <isc/print.h>
#include <isc/string.h>
#include <isc/util.h>
#include <dns/fixedname.h>
#include <dns/name.h>
#include <dns/rdata.h>
#include <dns/rdataclass.h>
#include <dns/rdatatype.h>
#include <dns/result.h>
#include "fuzz.h"
bool debug = false;
int
LLVMFuzzerInitialize(int *argc, char ***argv) {
UNUSED(argc);
UNUSED(argv);
return (0);
}
/* following code was copied from named-rrchecker */
isc_lexspecials_t specials = { ['('] = 1, [')'] = 1, ['"'] = 1 };
int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
isc_mem_t *mctx = NULL;
isc_mem_create(&mctx);
isc_lex_t *lex = NULL;
isc_token_t token;
isc_result_t result;
unsigned int options = 0;
dns_rdatatype_t rdtype;
dns_rdataclass_t rdclass;
char wiredata[64 * 1024];
isc_buffer_t wirebuf;
isc_buffer_init(&wirebuf, wiredata, sizeof(wiredata));
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_name_t *name = NULL;
isc_buffer_t inbuf;
isc_buffer_constinit(&inbuf, data, size);
isc_buffer_add(&inbuf, size);
isc_buffer_setactive(&inbuf, size);
RUNTIME_CHECK(isc_lex_create(mctx, 256, &lex) == ISC_R_SUCCESS);
/*
* Set up to lex DNS master file.
*/
isc_lex_setspecials(lex, specials);
options = ISC_LEXOPT_EOL;
isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
RUNTIME_CHECK(isc_lex_openbuffer(lex, &inbuf) == ISC_R_SUCCESS);
result = isc_lex_gettoken(lex, options | ISC_LEXOPT_NUMBER, &token);
if (result != ISC_R_SUCCESS) {
goto cleanup;
}
if (token.type == isc_tokentype_eof) {
goto cleanup;
}
if (token.type == isc_tokentype_eol) {
goto cleanup;
}
/*
* Get class.
*/
if (token.type == isc_tokentype_number) {
if (token.value.as_ulong > 0xffff) {
goto cleanup;
}
rdclass = (dns_rdataclass_t)token.value.as_ulong;
} else if (token.type == isc_tokentype_string) {
result = dns_rdataclass_fromtext(&rdclass,
&token.value.as_textregion);
if (result != ISC_R_SUCCESS) {
goto cleanup;
}
} else {
goto cleanup;
}
result = isc_lex_gettoken(lex, options | ISC_LEXOPT_NUMBER, &token);
if (result != ISC_R_SUCCESS) {
goto cleanup;
}
if (token.type == isc_tokentype_eol) {
goto cleanup;
}
if (token.type == isc_tokentype_eof) {
goto cleanup;
}
/*
* Get type.
*/
if (token.type == isc_tokentype_number) {
if (token.value.as_ulong > 0xffff) {
goto cleanup;
}
rdtype = (dns_rdatatype_t)token.value.as_ulong;
} else if (token.type == isc_tokentype_string) {
result = dns_rdatatype_fromtext(&rdtype,
&token.value.as_textregion);
if (result != ISC_R_SUCCESS) {
goto cleanup;
}
} else {
goto cleanup;
}
result = dns_rdata_fromtext(&rdata, rdclass, rdtype, lex, name, 0, mctx,
&wirebuf, NULL);
if (debug) {
fprintf(stderr, "dns_rdata_fromtext: %s\n",
isc_result_totext(result));
}
cleanup:
isc_lex_close(lex);
isc_lex_destroy(&lex);
isc_mem_destroy(&mctx);
return (0);
}

View File

@ -0,0 +1 @@
IN AFSDB 0 hostname

View File

@ -0,0 +1 @@
IN AMTRELAY 0 0 3 example.net.

View File

@ -0,0 +1 @@
ANY TSIG SAMPLE-ALG.EXAMPLE. 853804800 300 4 MTIzNA== 666 0 2 MDA=

View File

@ -0,0 +1 @@
IN AVC foo:bar

View File

@ -0,0 +1 @@
IN CAA 128 tbs "Unknown"

View File

@ -0,0 +1 @@
IN CDNSKEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )

View File

@ -0,0 +1 @@
IN CDS 30795 1 1 ( 310D27F4D82C1FC2400704EA9939FE6E1CEA A3B9 )

View File

@ -0,0 +1 @@
IN CERT 65534 65535 254 ( MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )

View File

@ -0,0 +1 @@
CH A hostname. 1234

View File

@ -0,0 +1 @@
CLASS1234 TYPE65533 \# 6 010203040506

View File

@ -0,0 +1 @@
IN CNAME cname-target

View File

@ -0,0 +1 @@
IN CSYNC 0 0 A NS AAAA

View File

@ -0,0 +1 @@
IN DLV 30795 1 1 ( 310D27F4D82C1FC2400704EA9939FE6E1CEA A3B9 )

View File

@ -0,0 +1 @@
IN DNAME dname-target.

View File

@ -0,0 +1 @@
IN DNSKEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )

View File

@ -0,0 +1 @@
IN DOA 0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=

View File

@ -0,0 +1 @@
IN DS 12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390

View File

@ -0,0 +1 @@
IN EUI48 01-23-45-67-89-ab

View File

@ -0,0 +1 @@
IN EUI64 01-23-45-67-89-ab-cd-ef

View File

@ -0,0 +1 @@
IN GID \# 1 03

View File

@ -0,0 +1 @@
IN GPOS -22.6882 116.8652 250.0

View File

@ -0,0 +1 @@
IN HINFO "Generic PC clone" "NetBSD-1.4"

View File

@ -0,0 +1 @@
IN HIP ( 2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D )

View File

@ -0,0 +1 @@
HS A 192.0.2.1

View File

@ -0,0 +1 @@
IN A 255.255.255.255

View File

@ -0,0 +1 @@
IN A6 127 ::1 foo.

View File

@ -0,0 +1 @@
IN AAAA fd92:7065:b8e:ffff::5

View File

@ -0,0 +1 @@
IN APL !1:10.0.0.1/32 1:10.0.0.0/24

View File

@ -0,0 +1 @@
IN ATMA +61.2.0000.0000

View File

@ -0,0 +1 @@
IN DHCID ( AAABxLmlskllE0MVjd57zHcWmEH3pCQ6V ytcKD//7es/deY= )

View File

@ -0,0 +1 @@
IN EID 12 89 AB

View File

@ -0,0 +1 @@
IN KX 10 kdc

View File

@ -0,0 +1 @@
IN NIMLOC 12 89 AB

View File

@ -0,0 +1 @@
IN NSAP 0x47.0005.80.005a00.0000.0001.e133.ffffff000164.00

View File

@ -0,0 +1 @@
IN NSAP-PTR foo.

View File

@ -0,0 +1 @@
IN PX 65535 foo. bar.

View File

@ -0,0 +1 @@
IN SRV 65535 65535 65535 old-slow-box

View File

@ -0,0 +1 @@
IN WKS 10.0.0.1 tcp telnet ftp 0 1 2

View File

@ -0,0 +1 @@
IN IPSECKEY ( 10 3 2 mygateway.example.com. AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )

View File

@ -0,0 +1 @@
IN ISDN "isdn-address" "subaddress"

View File

@ -0,0 +1 @@
IN KEY 512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )

View File

@ -0,0 +1 @@
IN KEYDATA 20210101000000 20380101000000 20380101000000 KSK DNSSEC ED448 ZXh0cmE=

View File

@ -0,0 +1 @@
IN L32 10 1.2.3.4

View File

@ -0,0 +1 @@
IN L64 10 0014:4fff:ff20:ee64

View File

@ -0,0 +1 @@
IN LOC 60 09 00.000 N 24 39 00.000 E 10.00m 20.00m ( 2000.00m 20.00m )

View File

@ -0,0 +1 @@
IN LP 10 example.net.

View File

@ -0,0 +1 @@
IN MB madname.

View File

@ -0,0 +1 @@
IN MD madname

View File

@ -0,0 +1 @@
IN MF madname

View File

@ -0,0 +1 @@
IN MG mgmname

View File

@ -0,0 +1 @@
IN MINFO rmailbx emailbx

View File

@ -0,0 +1 @@
IN MR mrname

View File

@ -0,0 +1 @@
IN MX 10 mail

View File

@ -0,0 +1 @@
IN NAPTR 65535 65535 "blurgh" "blorf" "blllbb" foo.

View File

@ -0,0 +1 @@
IN NID 10 0014:4fff:ff20:ee64

View File

@ -0,0 +1 @@
IN NINFO "foo\032bar"

View File

@ -0,0 +1 @@
IN NS ns43

View File

@ -0,0 +1 @@
IN NSEC a.secure.nil. ( NS SOA MX RRSIG DNSKEY LOC NSEC )

View File

@ -0,0 +1 @@
IN NSEC3 1 0 10 D2CF0294C020CE6C 8FPNS2UCT7FBS643THP2B77PEQ77K6IU A NS SOA MX AAAA RRSIG DNSKEY NSEC3PARAM

View File

@ -0,0 +1 @@
IN NSEC3PARAM 1 0 1 868BCF7ED4108929

View File

@ -0,0 +1 @@
IN NULL

View File

@ -0,0 +1 @@
IN NXT a.secure.nil. ( NS SOA MX RRSIG KEY LOC NXT )

View File

@ -0,0 +1 @@
IN OPENPGPKEY ( AQMFD5raczCJHViKtLYhWGz8hMY 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )

View File

@ -0,0 +1 @@
ANY OPT unsupported

View File

@ -0,0 +1 @@
IN PTR @

View File

@ -0,0 +1 @@
IN RKEY 0 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY 9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )

View File

@ -0,0 +1 @@
IN RP mbox-dname txt-dname

View File

@ -0,0 +1 @@
IN RRSIG NSEC 1 3 ( 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )

View File

@ -0,0 +1 @@
IN RT 0 intermediate-host

View File

@ -0,0 +1 @@
IN SIG NXT 1 3 ( 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )

View File

@ -0,0 +1 @@
IN SINK 8 0 2 l4ik

View File

@ -0,0 +1 @@
IN SMIMEA ( 1 1 2 92003ba34942dc74152e2f2c408d29ec a5a520e7f2e06bb944f4dca346baf63c 1b177615d466f6c4b71c216a50292bd5 8c9ebdd2f74e38fe51ffd48c43326cbc )

View File

@ -0,0 +1 @@
IN SOA a.test. hostmaster.null. 1613723740 900 300 604800 900

View File

@ -0,0 +1 @@
IN SPF "v=spf1" " -all"

View File

@ -0,0 +1 @@
IN SSHFP 4 2 C76D8329954DA2835751E371544E963EFDA099080D6C58DD2BFD9A31 6E162C83

View File

@ -0,0 +1 @@
IN TA 30795 1 1 ( 310D27F4D82C1FC2400704EA9939FE6E1CEA A3B9 )

View File

@ -0,0 +1 @@
IN TALINK . talink1

View File

@ -0,0 +1 @@
IN TKEY algo.test. 0 0 0 0 2 MjI= 1 MQ==

View File

@ -0,0 +1 @@
IN TLSA ( 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

View File

@ -0,0 +1 @@
IN TXT "\"foo\010bar\""

View File

@ -0,0 +1 @@
IN UID \# 1 02

View File

@ -0,0 +1 @@
IN UINFO \# 1 01

View File

@ -0,0 +1 @@
IN UNSPEC \# 1 04

View File

@ -0,0 +1 @@
IN URI 10 20 "https://www.isc.org/"

View File

@ -0,0 +1 @@
IN X25 "123456789"

View File

@ -0,0 +1 @@
IN ZONEMD 2019020700 1 0 ( C220B8A6ED5728A971902F7E3D4FD93A DEEA88B0453C2E8E8C863D465AB06CF3 4EB95B266398C98B59124FA239CB7EEB )

View File

@ -47,7 +47,6 @@ LLVMFuzzerInitialize(int *argc __attribute__((unused)),
isc_lexspecials_t specials; isc_lexspecials_t specials;
isc_mem_create(&mctx); isc_mem_create(&mctx);
RUNTIME_CHECK(dst_lib_init(mctx, NULL) == ISC_R_SUCCESS);
CHECK(isc_lex_create(mctx, 64, &lex)); CHECK(isc_lex_create(mctx, 64, &lex));
memset(specials, 0, sizeof(specials)); memset(specials, 0, sizeof(specials));