mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-05-03 17:30:18 +00:00
02e7e3c23b
QUIC packets are encrypted/obfuscated; that means that we need to decrypt them before parsing the real (TLS) message. Fuzzing is not effective here, since a random buffer is hardly a valid encrypted QUIC packet. Add a new fuzzer, testing *decrypted* QUIC packets. Add a basic corpus. Fix a few bugs already found by this fuzzer.
34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
name: CIFuzz
|
|
on: [push, pull_request]
|
|
jobs:
|
|
Fuzzing:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
sanitizer: [address, undefined, memory]
|
|
steps:
|
|
- name: Build Fuzzers - ${{ matrix.sanitizer }}
|
|
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
|
|
with:
|
|
oss-fuzz-project-name: 'ndpi'
|
|
dry-run: false
|
|
sanitizer: ${{ matrix.sanitizer }}
|
|
- name: Run Fuzzers - ${{ matrix.sanitizer }}
|
|
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
|
|
with:
|
|
oss-fuzz-project-name: 'ndpi'
|
|
fuzz-seconds: 900
|
|
dry-run: false
|
|
sanitizer: ${{ matrix.sanitizer }}
|
|
- name: Check Crash (fails when a crash is detected)
|
|
# Run Fuzzers return success even when setting dry-run to false.
|
|
# A temporal workaround is to trigger failure manually if we fing crash files.
|
|
run: |
|
|
exit $(ls out/artifacts |wc -l)
|
|
- name: Upload Crash (upload detected crash as artifacts)
|
|
uses: actions/upload-artifact@v1
|
|
if: failure()
|
|
with:
|
|
name: ${{ matrix.sanitizer }}-artifacts
|
|
path: ./out/artifacts
|