mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
9ab0d65fc0
Apart from catching crashes in the actual parsing, we abort if the SD we end up with will not round trip back through SDDL to an identical SD. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
228 lines
7.9 KiB
Python
228 lines
7.9 KiB
Python
#!/usr/bin/env python
|
|
|
|
from waflib import Build
|
|
|
|
bld.SAMBA_SUBSYSTEM('fuzzing',
|
|
source='fuzzing.c',
|
|
deps='talloc')
|
|
|
|
bld.SAMBA_SUBSYSTEM('afl-fuzz-main',
|
|
source='afl-fuzz-main.c',
|
|
deps='samba-util',
|
|
enabled=bld.env.enable_afl_fuzzer
|
|
)
|
|
|
|
bld.SAMBA_BINARY('fuzz_tiniparser',
|
|
source='fuzz_tiniparser.c',
|
|
deps='fuzzing tiniparser talloc afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_parse_lpq_entry',
|
|
source='fuzz_parse_lpq_entry.c',
|
|
deps='fuzzing afl-fuzz-main smbd_base PRINTING',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_oLschema2ldif',
|
|
source='fuzz_oLschema2ldif.c',
|
|
deps='fuzzing oLschema2ldif-lib afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_reg_parse',
|
|
source='fuzz_reg_parse.c',
|
|
deps='fuzzing samba3-util smbconf REGFIO afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_sddl_parse',
|
|
source='fuzz_sddl_parse.c',
|
|
deps='fuzzing samba-security afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_nmblib_parse_packet',
|
|
source='fuzz_nmblib_parse_packet.c',
|
|
deps='fuzzing libsmb afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_regfio',
|
|
source='fuzz_regfio.c',
|
|
deps='fuzzing samba3-util smbconf REGFIO afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_lzxpress',
|
|
source='fuzz_lzxpress.c',
|
|
deps='fuzzing LZXPRESS afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_lzxpress_compress',
|
|
source='fuzz_lzxpress_compress.c',
|
|
deps='fuzzing LZXPRESS afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_lzxpress_round_trip',
|
|
source='fuzz_lzxpress_round_trip.c',
|
|
deps='fuzzing LZXPRESS afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_lzxpress_huffman_decompress',
|
|
source='fuzz_lzxpress_huffman_decompress.c',
|
|
deps='fuzzing LZXPRESS afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_lzxpress_huffman_compress',
|
|
source='fuzz_lzxpress_huffman_compress.c',
|
|
deps='fuzzing LZXPRESS afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_lzxpress_huffman_round_trip',
|
|
source='fuzz_lzxpress_huffman_round_trip.c',
|
|
deps='fuzzing LZXPRESS afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_ldap_decode',
|
|
source='fuzz_ldap_decode.c',
|
|
deps='fuzzing cli-ldap afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_ldb_parse_control',
|
|
source='fuzz_ldb_parse_control.c',
|
|
deps='fuzzing ldb afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_ldb_dn_explode',
|
|
source='fuzz_ldb_dn_explode.c',
|
|
deps='fuzzing ldb afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_ldb_ldif_read',
|
|
source='fuzz_ldb_ldif_read.c',
|
|
deps='fuzzing ldb afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_ldb_parse_binary_decode',
|
|
source='fuzz_ldb_parse_binary_decode.c',
|
|
deps='fuzzing ldb afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_ldb_parse_tree',
|
|
source='fuzz_ldb_parse_tree.c',
|
|
deps='fuzzing ldb afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_dcerpc_parse_binding',
|
|
source='fuzz_dcerpc_parse_binding.c',
|
|
deps='fuzzing dcerpc afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_cli_credentials_parse_string',
|
|
source='fuzz_cli_credentials_parse_string.c',
|
|
deps='fuzzing samba-credentials afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_stable_sort',
|
|
source='fuzz_stable_sort.c',
|
|
deps='fuzzing stable_sort afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
bld.SAMBA_BINARY('fuzz_stable_sort_r',
|
|
source='fuzz_stable_sort_r.c',
|
|
deps='fuzzing stable_sort afl-fuzz-main',
|
|
fuzzer=True)
|
|
|
|
# The fuzz_type and fuzz_function parameters make the built
|
|
# fuzzer take the same input as ndrdump and so the same that
|
|
# could be sent to the client or server as the stub data.
|
|
|
|
def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False,
|
|
fuzz_type=None, fuzz_function=None):
|
|
name = "fuzz_ndr_%s" % (interface.lower())
|
|
fuzz_dir = os.path.join(bld.env.srcdir, 'lib/fuzzing')
|
|
fuzz_reldir = os.path.relpath(fuzz_dir, bld.path.abspath())
|
|
fuzz_src = os.path.join(fuzz_reldir, 'fuzz_ndr_X.c')
|
|
|
|
cflags = "-D FUZZ_PIPE_TABLE=ndr_table_%s" % interface
|
|
if fuzz_type:
|
|
name += "_%s" % (fuzz_type)
|
|
cflags += " -D FUZZ_TYPE=%s " % (fuzz_type)
|
|
if fuzz_type and fuzz_function:
|
|
name += "_%d" % (fuzz_function)
|
|
cflags += " -D FUZZ_FUNCTION=%d" % (fuzz_function)
|
|
|
|
fuzz_named_src = os.path.join(fuzz_reldir,
|
|
'%s.c' % (name))
|
|
# Work around an issue that WAF is invoked from up to 3 different
|
|
# directories so doesn't create a unique name for the multiple .o
|
|
# files like it would if called from just one place.
|
|
bld.SAMBA_GENERATOR(fuzz_named_src,
|
|
source=fuzz_src,
|
|
target=fuzz_named_src,
|
|
rule='cp ${SRC} ${TGT}')
|
|
|
|
if auto_deps:
|
|
deps = "afl-fuzz-main talloc ndr NDR_%s" % interface.upper()
|
|
else:
|
|
deps = "afl-fuzz-main ndr-table NDR_DCERPC"
|
|
|
|
bld.SAMBA_BINARY(name, source=fuzz_named_src,
|
|
cflags = cflags,
|
|
deps = deps,
|
|
fuzzer=True)
|
|
|
|
Build.BuildContext.SAMBA_NDR_FUZZ = SAMBA_NDR_FUZZ
|
|
|
|
# fuzz_ndr_X is generated from the list if IDL fed to PIDL
|
|
# however there are exceptions to the normal pattern
|
|
bld.SAMBA_NDR_FUZZ('IOXIDResolver') # oxidresolver.idl
|
|
bld.SAMBA_NDR_FUZZ('IRemoteActivation') # remact.idl
|
|
bld.SAMBA_NDR_FUZZ('iremotewinspool') # winspool.idl
|
|
bld.SAMBA_NDR_FUZZ('FileServerVssAgent') # fsvrp.idl
|
|
bld.SAMBA_NDR_FUZZ('lsarpc') # lsa.idl
|
|
bld.SAMBA_NDR_FUZZ('netdfs') # dfs.idl
|
|
bld.SAMBA_NDR_FUZZ('nfs4acl_interface') # nfs4acl.idl
|
|
bld.SAMBA_NDR_FUZZ('rpcecho') # echo.idl
|
|
|
|
# quota.idl
|
|
bld.SAMBA_NDR_FUZZ('file_quota')
|
|
bld.SAMBA_NDR_FUZZ('smb2_query_quota')
|
|
bld.SAMBA_NDR_FUZZ('smb1_nt_transact_query_quota')
|
|
|
|
# ioctl.idl
|
|
bld.SAMBA_NDR_FUZZ('copychunk')
|
|
bld.SAMBA_NDR_FUZZ('compression')
|
|
bld.SAMBA_NDR_FUZZ('netinterface')
|
|
bld.SAMBA_NDR_FUZZ('sparse')
|
|
bld.SAMBA_NDR_FUZZ('resiliency')
|
|
bld.SAMBA_NDR_FUZZ('trim')
|
|
|
|
# WMI tables
|
|
bld.SAMBA_NDR_FUZZ('IWbemClassObject')
|
|
bld.SAMBA_NDR_FUZZ('IWbemServices')
|
|
bld.SAMBA_NDR_FUZZ('IEnumWbemClassObject')
|
|
bld.SAMBA_NDR_FUZZ('IWbemContext')
|
|
bld.SAMBA_NDR_FUZZ('IWbemLevel1Login')
|
|
bld.SAMBA_NDR_FUZZ('IWbemWCOSmartEnum')
|
|
bld.SAMBA_NDR_FUZZ('IWbemFetchSmartEnum')
|
|
bld.SAMBA_NDR_FUZZ('IWbemCallResult')
|
|
bld.SAMBA_NDR_FUZZ('IWbemObjectSink')
|
|
|
|
# DCOM tables
|
|
bld.SAMBA_NDR_FUZZ('dcom_Unknown')
|
|
bld.SAMBA_NDR_FUZZ('IUnknown')
|
|
bld.SAMBA_NDR_FUZZ('IClassFactory')
|
|
bld.SAMBA_NDR_FUZZ('IRemUnknown')
|
|
bld.SAMBA_NDR_FUZZ('IClassActivator')
|
|
bld.SAMBA_NDR_FUZZ('ISCMLocalActivator')
|
|
bld.SAMBA_NDR_FUZZ('IMachineLocalActivator')
|
|
bld.SAMBA_NDR_FUZZ('ILocalObjectExporter')
|
|
bld.SAMBA_NDR_FUZZ('ISystemActivator')
|
|
bld.SAMBA_NDR_FUZZ('IRemUnknown2')
|
|
bld.SAMBA_NDR_FUZZ('IDispatch')
|
|
bld.SAMBA_NDR_FUZZ('IMarshal')
|
|
bld.SAMBA_NDR_FUZZ('ICoffeeMachine')
|
|
bld.SAMBA_NDR_FUZZ('IStream')
|
|
|
|
# Specific struct or function on the interface
|
|
|
|
bld.SAMBA_NDR_FUZZ('spoolss',
|
|
auto_deps=True,
|
|
fuzz_type="TYPE_IN",
|
|
fuzz_function=65)
|