From 0af57c3dd8524024cd95abc031f72baa7c884448 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 18 Apr 2015 13:42:24 +0300 Subject: [PATCH] tests: Add wnm-fuzzer This program can be used to run fuzzing tests for areas related to WNM frame parsing and processing on the client side. Signed-off-by: Jouni Malinen --- tests/wnm-fuzzer/Makefile | 91 +++++++++++++++++++++++++++ tests/wnm-fuzzer/bss-tm-req.dat | Bin 0 -> 31 bytes tests/wnm-fuzzer/wnm-fuzzer.c | 106 ++++++++++++++++++++++++++++++++ tests/wnm-fuzzer/wnm-notif.dat | Bin 0 -> 56 bytes 4 files changed, 197 insertions(+) create mode 100644 tests/wnm-fuzzer/Makefile create mode 100644 tests/wnm-fuzzer/bss-tm-req.dat create mode 100644 tests/wnm-fuzzer/wnm-fuzzer.c create mode 100644 tests/wnm-fuzzer/wnm-notif.dat diff --git a/tests/wnm-fuzzer/Makefile b/tests/wnm-fuzzer/Makefile new file mode 100644 index 000000000..dede75b1d --- /dev/null +++ b/tests/wnm-fuzzer/Makefile @@ -0,0 +1,91 @@ +all: wnm-fuzzer + +ifndef CC +CC=gcc +endif + +ifndef LDO +LDO=$(CC) +endif + +ifndef CFLAGS +CFLAGS = -MMD -O2 -Wall -g +endif + +SRC=../../src + +CFLAGS += -I$(SRC) +CFLAGS += -DCONFIG_WNM +CFLAGS += -DCONFIG_INTERWORKING +CFLAGS += -DCONFIG_GAS +CFLAGS += -DCONFIG_HS20 +CFLAGS += -DIEEE8021X_EAPOL + +$(SRC)/utils/libutils.a: + $(MAKE) -C $(SRC)/utils + +$(SRC)/common/libcommon.a: + $(MAKE) -C $(SRC)/common + +$(SRC)/crypto/libcrypto.a: + $(MAKE) -C $(SRC)/crypto + +$(SRC)/tls/libtls.a: + $(MAKE) -C $(SRC)/tls + +$(SRC)/rsn_supp/librsn_supp.a: + $(MAKE) -C $(SRC)/rsn_supp + +$(SRC)/eapol_supp/libeapol_supp.a: + $(MAKE) -C $(SRC)/eapol_supp + +$(SRC)/eap_peer/libeap_peer.a: + $(MAKE) -C $(SRC)/eap_peer + +$(SRC)/eap_common/libeap_common.a: + $(MAKE) -C $(SRC)/eap_common + +$(SRC)/l2_packet/libl2_packet.a: + $(MAKE) -C $(SRC)/l2_packet + +LIBS += $(SRC)/common/libcommon.a +LIBS += $(SRC)/crypto/libcrypto.a +LIBS += $(SRC)/tls/libtls.a +LIBS += $(SRC)/rsn_supp/librsn_supp.a +LIBS += $(SRC)/eapol_supp/libeapol_supp.a +LIBS += $(SRC)/eap_peer/libeap_peer.a +LIBS += $(SRC)/eap_common/libeap_common.a +LIBS += $(SRC)/l2_packet/libl2_packet.a +LIBS += $(SRC)/utils/libutils.a + +ELIBS += $(SRC)/crypto/libcrypto.a +ELIBS += $(SRC)/tls/libtls.a + +CFLAGS += -I$(SRC)/utils +OBJS += ../../wpa_supplicant/wnm_sta.o +OBJS += ../../wpa_supplicant/bss.o +OBJS += ../../wpa_supplicant/scan.o +OBJS += ../../wpa_supplicant/notify.o +OBJS += ../../wpa_supplicant/wpa_supplicant.o +OBJS += ../../wpa_supplicant/config.o +OBJS += ../../wpa_supplicant/config_file.o +OBJS += ../../wpa_supplicant/blacklist.o +OBJS += ../../wpa_supplicant/events.o +OBJS += ../../wpa_supplicant/wpas_glue.o +OBJS += ../../wpa_supplicant/wmm_ac.o +OBJS += ../../wpa_supplicant/eap_register.o +OBJS += ../../wpa_supplicant/gas_query.o +OBJS += ../../wpa_supplicant/offchannel.o +OBJS += ../../wpa_supplicant/interworking.o +OBJS += ../../wpa_supplicant/hs20_supplicant.o +OBJS += $(SRC)/drivers/drivers.o +OBJS += $(SRC)/drivers/driver_common.o + +wnm-fuzzer: wnm-fuzzer.o $(OBJS) $(LIBS) + $(LDO) $(LDFLAGS) -o $@ $^ $(LIBS) $(ELIBS) + +clean: + $(MAKE) -C $(SRC) clean + rm -f wnm-fuzzer *~ *.o *.d + +-include $(OBJS:%.o=%.d) diff --git a/tests/wnm-fuzzer/bss-tm-req.dat b/tests/wnm-fuzzer/bss-tm-req.dat new file mode 100644 index 0000000000000000000000000000000000000000..14510bb3ad11f70bd8277a5cc4828e0021f97281 GIT binary patch literal 31 ccmcb>V8zJ900JPA8A=*3aIrJ8a4|3d03#v+XaE2J literal 0 HcmV?d00001 diff --git a/tests/wnm-fuzzer/wnm-fuzzer.c b/tests/wnm-fuzzer/wnm-fuzzer.c new file mode 100644 index 000000000..8efa31155 --- /dev/null +++ b/tests/wnm-fuzzer/wnm-fuzzer.c @@ -0,0 +1,106 @@ +/* + * wpa_supplicant - WNM fuzzer + * Copyright (c) 2015, Jouni Malinen + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + */ + +#include "utils/includes.h" + +#include "utils/common.h" +#include "utils/eloop.h" +#include "common/ieee802_11_defs.h" +#include "rsn_supp/wpa.h" +#include "rsn_supp/wpa_i.h" +#include "../../wpa_supplicant/wpa_supplicant_i.h" +#include "../../wpa_supplicant/bss.h" +#include "../../wpa_supplicant/wnm_sta.h" + + +struct arg_ctx { + const char *fname; + struct wpa_supplicant wpa_s; + struct wpa_bss bss; + struct wpa_driver_ops driver; + struct wpa_sm wpa; +}; + + +static void test_send_wnm(void *eloop_data, void *user_ctx) +{ + struct arg_ctx *ctx = eloop_data; + char *data; + size_t len; + struct ieee80211_mgmt *mgmt; + + wpa_printf(MSG_INFO, "wnm-fuzzer: Send '%s'", ctx->fname); + + data = os_readfile(ctx->fname, &len); + if (!data) { + wpa_printf(MSG_ERROR, "Could not read '%s'", ctx->fname); + goto out; + } + + wpa_hexdump(MSG_MSGDUMP, "fuzzer - WNM", data, len); + + mgmt = (struct ieee80211_mgmt *) data; + ieee802_11_rx_wnm_action(&ctx->wpa_s, mgmt, len); + +out: + os_free(data); + eloop_terminate(); +} + + +static int init_wpa(struct arg_ctx *ctx) +{ + ctx->wpa_s.wpa_state = WPA_COMPLETED; + os_memcpy(ctx->wpa_s.bssid, "\x02\x00\x00\x00\x03\x00", ETH_ALEN); + ctx->wpa_s.current_bss = &ctx->bss; + ctx->wpa_s.driver = &ctx->driver; + ctx->wpa_s.wpa = &ctx->wpa; + + return 0; +} + + +int main(int argc, char *argv[]) +{ + struct arg_ctx ctx; + int ret = -1; + + if (argc < 2) { + printf("usage: %s \n", argv[0]); + return -1; + } + + if (os_program_init()) + return -1; + + wpa_debug_level = 0; + wpa_debug_show_keys = 1; + + if (eloop_init()) { + wpa_printf(MSG_ERROR, "Failed to initialize event loop"); + return -1; + } + + os_memset(&ctx, 0, sizeof(ctx)); + ctx.fname = argv[1]; + if (init_wpa(&ctx)) + goto fail; + + eloop_register_timeout(0, 0, test_send_wnm, &ctx, NULL); + + wpa_printf(MSG_DEBUG, "Starting eloop"); + eloop_run(); + wpa_printf(MSG_DEBUG, "eloop done"); + + ret = 0; +fail: + eloop_destroy(); + os_program_deinit(); + + return ret; +} diff --git a/tests/wnm-fuzzer/wnm-notif.dat b/tests/wnm-fuzzer/wnm-notif.dat new file mode 100644 index 0000000000000000000000000000000000000000..c234d3ad5b69b08d0a4caa217475d1d91391b24c GIT binary patch literal 56 zcmcb>V8zJ900JPA8A=8)a7i&T-jxc-pT!`OQBqP+Y^ATCT9KGrkdvyHoS&=D2ms%~ B3q}9{ literal 0 HcmV?d00001