blob: ab028ab3a9db43fce2c6dc7c009e418cd0f1911b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
#!/bin/bash
#
# $Id$
# Fuzz-testing script for TShark
#
# This script uses Editcap to add random errors ("fuzz") to a set of
# capture files specified on the command line. It runs TShark on
# each fuzzed file and checks for errors. The files are processed
# repeatedly until an error is found.
# Tweak the following to your liking. Editcap must support "-E".
TSHARK=./tshark
EDITCAP=./editcap
CAPINFOS=./capinfos
# This needs to point to a 'date' that supports %s.
DATE=/bin/date
BASE_NAME=fuzz-`$DATE +%Y-%m-%d`-$$
# Temporary file directory and names.
# (had problems with this on cygwin, tried TMP_DIR=./ which worked)
TMP_DIR=/tmp
TMP_FILE=$BASE_NAME.pcap
ERR_FILE=$BASE_NAME.err
# Loop this many times (< 1 loops forever)
MAX_PASSES=0
# These may be set to your liking
# Stop the child process, if it's running longer than x seconds
MAX_CPU_TIME=900
# Stop the child process, if it's using more than y * 1024 bytes
MAX_VMEM=500000
# Insert z times an error into the capture file (0.02 seems to be a good value to find errors)
ERR_PROB=0.02
# Trigger an abort if a dissector finds a bug.
# Uncomment to disable
WIRESHARK_ABORT_ON_DISSECTOR_BUG="True"
# To do: add options for file names and limits
while getopts ":d:p:" OPTCHAR ; do
case $OPTCHAR in
d) TMP_DIR=$OPTARG ;;
p) MAX_PASSES=$OPTARG ;;
esac
done
shift $(($OPTIND - 1))
# set some limits to the child processes, e.g. stop it if it's running longer then MAX_CPU_TIME seconds
# (ulimit is not supported well on cygwin and probably other platforms, e.g. cygwin shows some warnings)
ulimit -S -t $MAX_CPU_TIME -v $MAX_VMEM
ulimit -c unlimited
### usually you won't have to change anything below this line ###
# TShark arguments (you won't have to change these)
# n Disable network object name resolution
# V Print a view of the details of the packet rather than a one-line summary of the packet
# x Cause TShark to print a hex and ASCII dump of the packet data after printing the summary or details
# r Read packet data from the following infile
TSHARK_ARGS="-nVxr"
NOTFOUND=0
for i in "$TSHARK" "$EDITCAP" "$CAPINFOS" "$DATE" "$TMP_DIR" ; do
if [ ! -x $i ]; then
echo "Couldn't find $i"
NOTFOUND=1
fi
done
if [ $NOTFOUND -eq 1 ]; then
exit 1
fi
# Make sure we have a valid test set
FOUND=0
for CF in "$@" ; do
"$CAPINFOS" "$CF" > /dev/null 2>&1 && FOUND=1
if [ $FOUND -eq 1 ] ; then break ; fi
done
if [ $FOUND -eq 0 ] ; then
cat <<FIN
Error: No valid capture files found.
Usage: `basename $0` [-p passes] [-d work_dir] capture file 1 [capture file 2]...
FIN
exit 1
fi
HOWMANY="forever"
if [ $MAX_PASSES -gt 0 ]; then
HOWMANY="$MAX_PASSES passes"
fi
echo "Running $TSHARK with args: $TSHARK_ARGS ($HOWMANY)"
echo ""
# Not yet - properly handle empty filenames
#trap "rm $TMP_DIR/$TMP_FILE $TMP_DIR/$FUZZ_FILE; exit 1" 1 2 15
# Iterate over our capture files.
PASS=0
while [ $PASS -lt $MAX_PASSES -o $MAX_PASSES -lt 1 ] ; do
PASS=`expr $PASS + 1`
echo "Pass $PASS:"
for CF in "$@" ; do
echo -n " $CF: "
"$CAPINFOS" "$CF" > /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "Not a valid capture file"
continue
fi
DISSECTOR_BUG=0
"$EDITCAP" -E $ERR_PROB "$CF" $TMP_DIR/$TMP_FILE > /dev/null 2>&1
if [ $? -ne 0 ] ; then
"$EDITCAP" -E $ERR_PROB -T ether "$CF" $TMP_DIR/$TMP_FILE \
> /dev/null 2>&1
if [ $? -ne 0 ] ; then
echo "Invalid format for editcap"
continue
fi
fi
"$TSHARK" $TSHARK_ARGS $TMP_DIR/$TMP_FILE \
> /dev/null 2> $TMP_DIR/$ERR_FILE
RETVAL=$?
grep -i "dissector bug" $TMP_DIR/$ERR_FILE \
> /dev/null 2>&1 && DISSECTOR_BUG=1
if [ $RETVAL -ne 0 -o $DISSECTOR_BUG -ne 0 ] ; then
FUZZ_FILE="fuzz-`$DATE +%Y-%m-%d`-$$.pcap"
echo ""
echo " ERROR"
echo -e "Processing failed. Capture info follows:\n"
mv $TMP_DIR/$TMP_FILE $TMP_DIR/$FUZZ_FILE
echo " Output file: $TMP_DIR/$FUZZ_FILE"
if [ $DISSECTOR_BUG -ne 0 ] ; then
echo -e "stderr follows:\n"
cat $TMP_DIR/$ERR_FILE
fi
exit 1
fi
echo " OK"
rm -f $TMP_DIR/$TMP_FILE $TMP_DIR/$ERR_FILE
done
done
|
