fuzz

README

Fuzzing Targets for slayers

This package contains the fuzzing targets for the slayers package. There are multiple targets defined. The default Fuzz target fuzzes a full SCION packet decoding run. FuzzLayers fuzzes individual layers. Which layer that is fuzzed is determined by the first byte of the input. Furthermore, there is one target per layer for individual fuzzing.

Installation

To run fuzzing in your local environment, you need to have go-fuzz and go-fuzz-build available in your path.

See: go-fuzz

Start fuzzing

To start fuzzing, navigate to this directory and run:

go-fuzz-build --func Fuzz
cp -r ../../testdata corpus
go-fuzz

To run a different target, run:

go-fuzz --func FuzzSCION

Debugging crashers

Crashers will be stored in the crashers directory. Per crash, there are three files. The .output file contains the panic information. The .quoted file contains the quoted input data that lead to the crash.

Copy the string of the .quoted file and replace the input data in the appropriate testing function in fuzz_test.go. Now, you have a unit test that panics and can be debugged.

Documentation

Index

• func Fuzz(data []byte) int
• func FuzzEndToEndExtn(data []byte) int
• func FuzzHopByHopExtn(data []byte) int
• func FuzzLayers(data []byte) int
• func FuzzSCION(data []byte) int
• func FuzzSCMP(data []byte) int
• func FuzzSCMPEcho(data []byte) int
• func FuzzSCMPExternalInterfaceDown(data []byte) int
• func FuzzSCMPInternalConnectivityDown(data []byte) int
• func FuzzSCMPTraceroute(data []byte) int
• func FuzzUDP(data []byte) int

Functions

func Fuzz

func Fuzz(data []byte) int

Fuzz fuzzes a SCION packet.

func FuzzEndToEndExtn

func FuzzEndToEndExtn(data []byte) int

FuzzEndToEndExtn is the fuzzing target for the EndToEnd extension.

func FuzzHopByHopExtn

func FuzzHopByHopExtn(data []byte) int

FuzzHopByHopExtn is the fuzzing target for the HopByHop extension.

func FuzzLayers

func FuzzLayers(data []byte) int

FuzzLayers is the target that fuzzes all layers. The layer to fuzz is determined by the first byte in the input.

func FuzzSCION

func FuzzSCION(data []byte) int

FuzzSCION is the fuzzing target for the SCION header.

func FuzzSCMP

func FuzzSCMP(data []byte) int

FuzzSCMP is the fuzzing target for the SCMP header.

func FuzzSCMPEcho

func FuzzSCMPEcho(data []byte) int

FuzzSCMPEcho is the fuzzing target for SCMP Echo.

func FuzzSCMPExternalInterfaceDown

func FuzzSCMPExternalInterfaceDown(data []byte) int

FuzzSCMPExternalInterfaceDown is the fuzzing target for SCMP ExternalInterfaceDown.

func FuzzSCMPInternalConnectivityDown

func FuzzSCMPInternalConnectivityDown(data []byte) int

FuzzSCMPInternalConnectivityDown is the fuzzing target for SCMP InternalConnectivityDown.

func FuzzSCMPTraceroute

func FuzzSCMPTraceroute(data []byte) int

FuzzSCMPTraceroute is the fuzzing target for SCMP Traceroute.

func FuzzUDP

func FuzzUDP(data []byte) int

FuzzUDP is the fuzzing target for the UDP/SCION header.