ntopng/fuzz/fuzz_zmq_flow.cpp

/*
 *
 * (C) 2013-26 - ntop.org
 *
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 */

#include <unistd.h>

#include "ntop_includes.h"

#ifdef INCLUDE_ONEFILE
#include "onefile.cpp"
#endif

AfterShutdownAction afterShutdownAction = after_shutdown_nop;
NetworkInterface *iface;
ZMQParserInterface *zmq_iface;

constexpr const char *PROG_NAME = "ntopng";
static ndpi_protocol ndpiUnknownProtocol;

bool trace_new_delete = false;

static void cleanup() {
  if (zmq_iface) delete zmq_iface;
  if (iface) delete iface;
  if (ntop) delete ntop;
}

/**
 * Set the CLI args for prefs.
 *
 * The function must be called like this:
 * setCLIArgs(Prefs *prefs, int params, const char * ...)
 */
static void setCLIArgs(Prefs *prefs, int params...) {
  if (params == 0) return;

  va_list args;
  va_start(args, params);

  // Get path of the binary itself. This is needed to get the absolute path of
  // the required directories
  char exePath[MAX_PATH + 1];
  ssize_t pathLen = readlink("/proc/self/exe", exePath, MAX_PATH);
  if (pathLen != -1) {
    exePath[pathLen] = '\0';
    ssize_t len = pathLen;
    while (len > 0 && exePath[len] != '/') len--;
    if (len == 0) {
      std::cerr << "Error while crafting the command line. Relative path "
	"have been used."
		<< std::endl;
      exit(1);
    }
    exePath[len] = '\0';
    pathLen = len;
  } else {
    std::cerr << "Error while crafting the command line. Failed to "
      "retrieve the absolute path of the executable."
	      << std::endl;
    exit(1);
  }

  // Create the new argv
  char *new_argv[params];
  for (int i = 0; i < params; ++i) {
    const char *opt = va_arg(args, const char *);

    if (!strstr(opt, "_PATH_")) {
      new_argv[i] = strdup(opt);
    } else {
      // size = pathLen + / + opt - _PATH_ + \0
      size_t size = pathLen + 1 + strlen(opt) - 6 + 1;
      new_argv[i] = (char *)malloc(size);
      int len = snprintf(new_argv[i], size, "%s/%s", exePath, opt + 6);
      if (len <= 0) {
	std::cerr << "Error while crafting the command line. Wrong "
	  "buffer size."
		  << std::endl;
	exit(1);
      }
    }
  }

  prefs->loadFromCLI(params, new_argv);

  // Free arguments
  for (int k = 0; k < params; ++k) free(new_argv[k]);

  va_end(args);
}

const ndpi_protocol getConstNdpiUnknownProtocol() {
  return((const ndpi_protocol)ndpiUnknownProtocol);
}

extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
  // Final cleanup
  atexit(cleanup);

  Prefs *prefs = NULL;

  if ((ntop = new (std::nothrow) Ntop(PROG_NAME)) == NULL) _exit(1);
  if ((prefs = new (std::nothrow) Prefs(ntop)) == NULL) _exit(1);

  ntop->getTrace()->set_trace_level(0);
  memset((void*)&ndpiUnknownProtocol, 0, sizeof(ndpiUnknownProtocol));

  setCLIArgs(prefs, 11, PROG_NAME, "-1", "_PATH_docs", "-2", "_PATH_scripts",
	     "-3", "_PATH_scripts/callbacks", "-d", "_PATH_data-dir", "-t",
	     "_PATH_install");

  ntop->registerPrefs(prefs, false);

  ntop->loadGeolocation();

  iface = new NetworkInterface("custom");
  iface->allocateStructures();

  zmq_iface = new ZMQParserInterface("custom");

  return 0;
}

// parseJSONCounter and parseSNMPIntefaces iterate the parsed object without a
// type check, so only hand them a JSON object to avoid a NULL deref.
static bool payload_is_json_object(const char *json) {
  json_object *o = json_tokener_parse(json);
  if (o == NULL) return false;
  bool is_object = (json_object_get_type(o) == json_type_object);
  json_object_put(o);
  return is_object;
}

// Feed each top-level key/value into matchField(), like parseSingleJSONFlow
static void fuzz_match_fields(const char *json) {
  json_object *o = json_tokener_parse(json);
  if (o == NULL) return;

  if (json_object_get_type(o) == json_type_object) {
    struct json_object_iterator it = json_object_iter_begin(o);
    struct json_object_iterator itEnd = json_object_iter_end(o);

    while (!json_object_iter_equal(&it, &itEnd)) {
      const char *key = json_object_iter_peek_name(&it);
      json_object *jvalue = json_object_iter_peek_value(&it);

      if (key != NULL && jvalue != NULL) {
	ParsedFlow flow;
	ParsedValue value = {0};

	switch (json_object_get_type(jvalue)) {
	  case json_type_int:
	    value.int_num = json_object_get_int64(jvalue);
	    value.double_num = (double)value.int_num;
	    break;
	  case json_type_double:
	    value.double_num = json_object_get_double(jvalue);
	    break;
	  case json_type_boolean:
	    value.boolean = json_object_get_boolean(jvalue);
	    break;
	  case json_type_string:
	    value.string = json_object_get_string(jvalue);
	    break;
	  default:
	    break;
	}

	zmq_iface->matchField(&flow, key, &value);
      }

      json_object_iter_next(&it);
    }
  }

  json_object_put(o);
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) {
  if (len < 2) return -1;

  // First byte selects the parser entry; the rest is the JSON payload
  uint8_t selector = buf[0];
  size_t payload_len = len - 1;

  char *json = (char *)malloc(payload_len + 1);
  if (json == NULL) return 0;
  memcpy(json, buf + 1, payload_len);
  json[payload_len] = '\0';

  switch (selector % 8) {
    case 0:
      zmq_iface->parseEvent(json, (int)payload_len, false, NULL);
      break;
    case 1:
      if (payload_is_json_object(json))
	zmq_iface->parseJSONCounter(json, (int)payload_len);
      break;
    case 2:
      zmq_iface->parseTemplate(json, (int)payload_len, NULL);
      break;
    case 3:
      zmq_iface->parseOption(json, (int)payload_len, NULL);
      break;
    case 4:
      zmq_iface->parseListeningPorts(json, (int)payload_len, NULL);
      break;
    case 5:
      if (payload_is_json_object(json))
	zmq_iface->parseSNMPIntefaces(json, (int)payload_len, NULL);
      break;
    case 6:
      zmq_iface->parseJSONCustomIE(json, (int)payload_len);
      break;
    case 7:
    default:
      fuzz_match_fields(json);
      break;
  }

  free(json);

  return 0;
}