Add the AFL++ persistent mode fuzz loop to passt.c main().
The loop uses __AFL_LOOP() for in-process iteration and
__AFL_FUZZ_TESTCASE_BUF for shared memory fuzzing.
Each iteration:
- Resets deterministic clock, flow table, and epoll instance.
- Drains stale data from the TAP socket.
- Reads an epoll event from the AFL++ buffer.
- For TAP events: constructs a packet with fixed L2/L3/L4
headers and injects it via tap_add_packet() + tap_handler().
- Exchanges a turn flag with the test server for
bidirectional flow over the UNIX socket.
- Calls passt_worker() to process the event.
- Polls for host-side TCP events via epoll_wait().
- Runs post_handler() for deferred work.
Added the 'make fuzz' target which builds passt with
afl-clang-fast, -DFUZZING, -DNDEBUG, and AddressSanitizer.
Signed-off-by: Anshu Kumari
---
Makefile | 8 +++
passt.c | 189 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 197 insertions(+)
diff --git a/Makefile b/Makefile
index fe1df58..8e4121e 100644
--- a/Makefile
+++ b/Makefile
@@ -123,6 +123,14 @@ valgrind: BASE_CPPFLAGS += -DVALGRIND
valgrind: BASE_CFLAGS += -g
valgrind: all
+FUZZ_CC ?= afl-clang-fast
+
+.PHONY: fuzz
+
+fuzz:
+ $(MAKE) clean
+ $(MAKE) CC="$(FUZZ_CC)" CPPFLAGS="-DFUZZING -DNDEBUG" CFLAGS="-g -fsanitize=address" passt
+
.PHONY: clean
clean:
$(RM) $(BIN) *~ *.o seccomp.h seccomp_repair.h seccomp_pesto.h pasta.1 \
diff --git a/passt.c b/passt.c
index 5054551..e026eb2 100644
--- a/passt.c
+++ b/passt.c
@@ -35,6 +35,7 @@
#include
#include
#include
+#include
#include "util.h"
#include "passt.h"
@@ -54,12 +55,56 @@
#include "repair.h"
#include "netlink.h"
#include "epoll_ctl.h"
+#include "flow_table.h"
+#include "fuzz.h"
#define NUM_EPOLL_EVENTS 8
#define TIMER_INTERVAL_ MIN(TCP_TIMER_INTERVAL, FWD_PORT_SCAN_INTERVAL)
#define TIMER_INTERVAL MIN(TIMER_INTERVAL_, FLOW_TIMER_INTERVAL)
+#ifdef FUZZING
+
+/* AFL++ persistent mode / shared memory fuzzing compatibility macros. */
+#ifndef __AFL_FUZZ_TESTCASE_LEN
+ ssize_t fuzz_len;
+ unsigned char fuzz_buf[1024 * 1024];
+# define __AFL_FUZZ_TESTCASE_LEN fuzz_len
+# define __AFL_FUZZ_TESTCASE_BUF fuzz_buf
+# define __AFL_FUZZ_INIT() void sync(void)
+# define __AFL_LOOP(x) \
+ ((fuzz_len = read(0, fuzz_buf, sizeof(fuzz_buf))) > 0 ? 1 : 0)
+# define __AFL_INIT() sync()
+#endif
+
+#ifdef __AFL_HAVE_MANUAL_CONTROL
+ __AFL_FUZZ_INIT();
+#endif
+
+static struct fuzz_turn *fuzz_turn_ptr;
+
+/**
+ * fuzz_turn_connect() - Map the turn flag shared memory
+ *
+ * Return: pointer to mapped turn flag, or NULL on failure
+ */
+static struct fuzz_turn *fuzz_turn_connect(void)
+{
+ struct fuzz_turn *t;
+ int fd;
+
+ fd = open(FUZZ_TURN_PATH, O_RDWR);
+ if (fd < 0)
+ return NULL;
+
+ t = mmap(NULL, sizeof(*t), PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+ close(fd);
+
+ return (t == MAP_FAILED) ? NULL : t;
+}
+
+#endif
+
char pkt_buf[PKT_BUF_BYTES] __attribute__ ((aligned(PAGE_SIZE)));
struct ctx passt_ctx = {
@@ -282,9 +327,17 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events)
icmp_sock_handler(c, ref, &now);
break;
case EPOLL_TYPE_VHOST_CMD:
+#ifdef FUZZING
+ if (!c->vdev)
+ break;
+#endif
vu_control_handler(c->vdev, c->fd_tap, eventmask);
break;
case EPOLL_TYPE_VHOST_KICK:
+#ifdef FUZZING
+ if (!c->vdev)
+ break;
+#endif
vu_kick_cb(c->vdev, ref, &now);
break;
case EPOLL_TYPE_REPAIR_LISTEN:
@@ -450,6 +503,141 @@ int main(int argc, char **argv)
timer_init(c, &now);
+#ifdef FUZZING
+ fuzz_turn_ptr = fuzz_turn_connect();
+
+#define FUZZ_LOOP_ITERATIONS 10000
+#define FUZZ_DRAIN_BUF_SIZE 1600
+
+#ifdef __AFL_HAVE_MANUAL_CONTROL
+ __AFL_INIT();
+#endif
+ {
+ unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
+
+ while (__AFL_LOOP(FUZZ_LOOP_ITERATIONS)) {
+ int len = __AFL_FUZZ_TESTCASE_LEN;
+ int injected = 0;
+ int pkt_len, round;
+ struct epoll_event ev;
+ union epoll_ref ref;
+ int min_pkt = sizeof(struct ethhdr) +
+ sizeof(struct iphdr) +
+ sizeof(struct tcphdr);
+
+ if (len < (int)sizeof(ev))
+ continue;
+
+ /* Reset clock, flow table and epoll for each
+ * AFL++ iteration.
+ */
+ fuzz_clock_reset();
+ clock_gettime(CLOCK_MONOTONIC, &now);
+ timer_init(c, &now);
+
+ flow_init();
+
+ /* Recreate epoll instance */
+ close(c->epollfd);
+ c->epollfd = epoll_create1(EPOLL_CLOEXEC);
+ flow_epollid_register(EPOLLFD_ID_DEFAULT, c->epollfd);
+
+ if (c->fd_tap >= 0) {
+ union epoll_ref tref = {
+ .type = EPOLL_TYPE_TAP_PASST,
+ .fd = c->fd_tap
+ };
+ epoll_add(c->epollfd,
+ EPOLLIN | EPOLLRDHUP, tref);
+
+ /* Drain stale socket data */
+ char drain[FUZZ_DRAIN_BUF_SIZE];
+ while (recv(c->fd_tap, drain, sizeof(drain),
+ MSG_DONTWAIT) > 0);
+ }
+
+ /* Read epoll event from AFL++ buffer */
+ memcpy(&ev, buf, sizeof(ev));
+ ref = *((union epoll_ref *)&ev.data.u64);
+
+ /* Set recv payload in AFL++ shared memory */
+ fuzz_recv_data = buf + FUZZ_RECV_OFF;
+ fuzz_recv_data_len =
+ (len > FUZZ_RECV_OFF + FUZZ_RECV_MAX)
+ ? FUZZ_RECV_MAX
+ : ((len > FUZZ_RECV_OFF)
+ ? len - FUZZ_RECV_OFF : 0);
+
+ /* Inject fuzz packet for TAP events */
+ if (ref.type == EPOLL_TYPE_TAP_PASST ||
+ ref.type == EPOLL_TYPE_TAP_PASTA) {
+ struct iov_tail data;
+ struct ethhdr *eh;
+ struct iphdr *iph;
+ struct tcphdr *th;
+
+ tap_flush_pools();
+ memset(pkt_buf, 0, min_pkt);
+
+ pkt_len = len - (int)sizeof(ev);
+ if (pkt_len > 0)
+ memcpy(pkt_buf, buf + sizeof(ev),
+ pkt_len);
+ if (pkt_len < min_pkt)
+ pkt_len = min_pkt;
+
+ /* construct ethernet header */
+ eh = (struct ethhdr *)pkt_buf;
+ memcpy(eh->h_dest, c->our_tap_mac, ETH_ALEN);
+ memcpy(eh->h_source, c->guest_mac, ETH_ALEN);
+ eh->h_proto = htons(ETH_P_IP);
+
+ /* construct IPv4 header */
+ iph = (struct iphdr *)(pkt_buf + sizeof(*eh));
+ iph->version = 4;
+ iph->ihl = 5;
+ iph->protocol = IPPROTO_TCP;
+ iph->saddr = c->ip4.addr.s_addr;
+ iph->daddr = c->ip4.guest_gw.s_addr;
+ iph->tot_len = htons(pkt_len - sizeof(*eh));
+
+ /* Fix TCP Header */
+ th = (struct tcphdr *)(pkt_buf + sizeof(*eh) +
+ sizeof(*iph));
+ th->dest = htons(9999);
+ if (th->doff < 5)
+ th->doff = 5;
+
+ data = IOV_TAIL_FROM_BUF(pkt_buf, pkt_len, 0);
+ tap_add_packet(c, &data, &now);
+ tap_handler(c, &now);
+ injected = 1;
+ }
+
+ /* Turn exchange -- only if data was sent */
+ if (injected && fuzz_turn_ptr) {
+ __atomic_store_n(&fuzz_turn_ptr->turn, 1,
+ __ATOMIC_RELEASE);
+ while (__atomic_load_n(&fuzz_turn_ptr->turn,
+ __ATOMIC_ACQUIRE) != 0);
+ }
+
+ passt_worker(c, 1, &ev);
+
+ /* Process host-side TCP events */
+ for (round = 0; round < 4; round++) {
+ nfds = epoll_wait(c->epollfd, events,
+ NUM_EPOLL_EVENTS, 0);
+ if (nfds <= 0)
+ break;
+ passt_worker(c, nfds, events);
+ }
+
+ post_handler(c, &now);
+ }
+ }
+ return 0;
+#else
loop:
/* NOLINTBEGIN(bugprone-branch-clone): intervals can be the same */
/* cppcheck-suppress [duplicateValueTernary, unmatchedSuppression] */
@@ -461,4 +649,5 @@ loop:
passt_worker(c, nfds, events);
goto loop;
+#endif /* FUZZING */
}
--
2.55.0