Merge pull request #17572 from arthurscchan/new-fuzzer-2

OSS-Fuzz: Add new fuzzer for dns packet processing

Author: rgacogne

meson.build

@@ -975,6 +975,7 @@ if get_option('fuzz-targets')
   endif
 
   fuzz_targets = [
+    'dnspacketroundtrip',
     'moadnsparser',
     'packetcache',
     'proxyprotocol',

pdns/Makefile.am

@@ -1590,7 +1590,8 @@ fuzz_targets_programs =  \
 	fuzz_target_dnslabeltext_parseRFC1035CharString \
 	fuzz_target_yahttp \
 	fuzz_target_zoneparsertng \
-	fuzz_target_recordcontent
+	fuzz_target_recordcontent \
+	fuzz_target_dnspacketroundtrip
 
 fuzz_targets: $(ARC4RANDOM_LIBS) $(fuzz_targets_programs)
 
@@ -1634,6 +1635,32 @@ fuzz_target_moadnsparser_DEPENDENCIES = $(fuzz_targets_deps)
 fuzz_target_moadnsparser_LDFLAGS = $(fuzz_targets_ldflags)
 fuzz_target_moadnsparser_LDADD = $(fuzz_targets_libs)
 
+fuzz_target_dnspacketroundtrip_SOURCES = \
+	base32.cc base32.hh \
+	base64.cc base64.hh \
+	dnslabeltext.cc \
+	dnsname.cc dnsname.hh \
+	dnsparser.cc dnsparser.hh \
+	dnsrecords.cc dnsrecords.hh \
+	dnswriter.cc dnswriter.hh \
+	ednsoptions.cc ednsoptions.hh \
+	fuzz_dnspacketroundtrip.cc \
+	logger.cc logger.hh \
+	logging.cc logging.hh \
+	misc.cc misc.hh \
+	nsecrecords.cc  \
+	qtype.cc qtype.hh \
+	rcpgenerator.cc rcpgenerator.hh \
+	sillyrecords.cc \
+	statbag.cc statbag.hh \
+	svc-records.cc svc-records.hh \
+	unix_utility.cc \
+	utility.hh
+
+fuzz_target_dnspacketroundtrip_DEPENDENCIES = $(fuzz_targets_deps)
+fuzz_target_dnspacketroundtrip_LDFLAGS = $(fuzz_targets_ldflags)
+fuzz_target_dnspacketroundtrip_LDADD = $(fuzz_targets_libs)
+
 fuzz_target_recordcontent_SOURCES = \
 	base32.cc base32.hh \
 	base64.cc base64.hh \

pdns/fuzz_dnspacketroundtrip.cc

@@ -0,0 +1,148 @@
+/*
+ * This file is part of PowerDNS or dnsdist.
+ * Copyright -- PowerDNS.COM B.V. and its contributors
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * In addition, for the avoidance of any doubt, permission is granted to
+ * link this program with OpenSSL and to (re)distribute the binaries
+ * produced as the result of such linking.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <array>
+
+#include "dnsparser.hh"
+#include "dnsrecords.hh"
+#include "dnswriter.hh"
+#include "dnsname.hh"
+#include "ednsoptions.hh"
+#include "qtype.hh"
+#include "statbag.hh"
+
+// NOLINTNEXTLINE(readability-identifier-length,bugprone-throwing-static-initialization)
+StatBag S;
+
+bool g_slogStructured{false};
+
+static void init()
+{
+  reportAllTypes();
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size);
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+  static bool initialized = false;
+
+  if (!initialized) {
+    init();
+    initialized = true;
+  }
+
+  if (size > std::numeric_limits<uint16_t>::max()) {
+    return 0;
+  }
+
+  // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
+  const char* chars = reinterpret_cast<const char*>(data);
+
+  try {
+    // 1) Feed the raw, untrusted bytes straight to the EDNS OPT option parsers:
+    //    the option TLV decoder in ednsoptions.cc is otherwise unreached.
+    EDNSOptionViewMap viewOptions;
+    (void)getEDNSOptions(chars, size, viewOptions);
+
+    std::vector<std::pair<uint16_t, std::string>> options;
+    (void)getEDNSOptionsFromContent(std::string(chars, size), options);
+
+    // 2) Drive DNSPacketWriter with attacker-controlled structures (several
+    //    records, attacker rdata, name compression, EDNS OPT writing), the
+    //    full-packet writer paths that the parse/record fuzzers never reach.
+    size_t pos = 0;
+    // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic)
+    const auto getU8 = [&]() -> uint8_t { return pos < size ? data[pos++] : 0; };
+    const auto getU16 = [&]() -> uint16_t {
+      const uint16_t highV = getU8();
+      return static_cast<uint16_t>((highV << 8) | getU8());
+    };
+
+    const uint16_t qtype = getU16();
+    const DNSName qname(".");
+    std::vector<uint8_t> packet;
+    DNSPacketWriter writer(packet, qname, qtype);
+
+    static const std::array<const char*, 4> suffixes{".", "example.com.", "a.example.com.", "powerdns.com."};
+
+    const unsigned int records = getU8() % 8U;
+    for (unsigned int i = 0; i < records && pos < size; ++i) {
+      // A valid name sharing one of a few suffixes (so the name-compression
+      // paths fire) with an attacker-controlled first label.
+      const uint8_t labelLen = getU8() % 32U;
+      std::string label;
+      for (uint8_t j = 0; j < labelLen && pos < size; ++j) {
+        label.push_back(static_cast<char>('a' + (getU8() % 26)));
+      }
+      const std::string suffix = suffixes.at(getU8() % suffixes.size());
+      DNSName name{};
+      try {
+        if (label.empty()) {
+          name = DNSName(suffix);
+        }
+        else {
+          label.append(".");
+          label.append(suffix);
+          name = DNSName(label);
+        }
+      }
+      catch (...) {
+        name = qname;
+      }
+
+      const uint16_t rtype = getU16();
+      const uint16_t rdlen = getU16();
+      std::string rdata;
+      for (uint16_t j = 0; j < rdlen && pos < size; ++j) {
+        rdata.push_back(static_cast<char>(getU8()));
+      }
+
+      writer.startRecord(name, rtype);
+      writer.xfrBlob(rdata);
+    }
+
+    // EDNS OPT writing fed with the attacker-parsed option vector.
+    if (!options.empty()) {
+      DNSPacketWriter::optvect_t optvect;
+      for (const auto& option : options) {
+        optvect.emplace_back(option.first, option.second);
+      }
+      writer.addOpt(1232, 0, 0, optvect);
+    }
+    writer.commit();
+
+    // Re-parse the writer's own output.
+    if (!packet.empty()) {
+      // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
+      MOADNSParser reparse(false, reinterpret_cast<const char*>(packet.data()), packet.size());
+    }
+  }
+  // NOLINTNEXTLINE(bugprone-empty-catch)
+  catch (const std::exception& e) {
+  }
+  // NOLINTNEXTLINE(bugprone-empty-catch)
+  catch (const PDNSException& e) {
+  }
+
+  return 0;
+}