Fuzzing tcpdump and netdissect

[catenacyber]

For use with oss-fuzz

[infrastation]

Could you address the missing header issue with AppVeyor and make this change ready for merging (even if it does not make it into OSS-Fuzz)?

[guyharris]

Could you address the missing header issue with AppVeyor

...which, as with libpcap, means "don't build the fuzz subdirectory on Windows unless you port fuzz-pcap.c to Windows".

[catenacyber]

Thanks for your review

I think there are benefits to both paths

I totally agree I guess I took the lazy solution

This makes it harder to create a corpus You can maybe use tshark See for instance what I did for HTTP : https://github.com/catenacyber/libhtp/commit/58e1db27808d976a960fba9169c102bfa9e86e3c

[fenner]

This makes it harder to create a corpus You can maybe use tshark

I ended up using scapy and a short python script to take the existing pcap files and turn them into individual per-fuzzer corpora, and another script to do the inverse to convert the kind of file that oss-fuzz would provide with a bug report into a pcap file.

[catenacyber]

Looks great. Can you share these scripts ?

[fenner]

Looks great. Can you share these scripts ?

Sorry, I thought I had posted a link. https://github.com/fenner/tcpdump/tree/fuzz/fuzz

I still want to move some of the build.sh to the tcpdump repo, but for now I added this to the oss-fuzz one that you wrote:

$CC $CFLAGS -I.. -I. -c ../fuzz/common.c -o common.o

for p in ip ip6 ether bgp
do 
   $CC $CFLAGS -I.. -I. -c ../fuzz/${p}_print_fuzzer.c -o ${p}_print_fuzzer.o
   $CXX $CXXFLAGS ${p}_print_fuzzer.o common.o -o $OUT/${p}_print_fuzzer libnetdissect.a ../../libpcap/build/libpcap.a -lFuzzingEngine
done

mkdir corpus
cd corpus
$SRC/tcpdump/fuzz/corpus/pcap2corpus $SRC/tcpdump/tests/*.pcap
for d in *
do
   zip -r $OUT/${d}_print_fuzzer_seed_corpus.zip $d/*
done

cd ..

and added python and scapy to the list of packages installed.