Crude websocket fuzz mode

Probably I also need a flag to fake already being upgraded, because otherwise we never get passed the complicated websocket handshake.

Crude websocket fuzz mode
Probably I also need a flag to fake already being upgraded, because otherwise we never get passed the complicated websocket handshake.
Wiebe Cazemier
1 parent ddf2b612
Showing 8 changed files with 30 additions and 2 deletions
fuzztestsplainwebsocket/plainwebsocketpacket1.dat
fuzztestsplainwebsocket/plainwebsocketpacket2.dat
fuzztestsplainwebsocket/plainwebsocketpacket3.dat
fuzztestsplainwebsocket/plainwebsocketpacket4.dat
fuzztestsplainwebsocket/plainwebsocketpacket5.dat
fuzztestsplainwebsocket/websocket5packets.dat
mainapp.cpp
mainapp.h
+GET /mqtt HTTP/1.1
+Host: localhost:8080
+Upgrade: websocket
+Connection: Upgrade
+Origin: https://localhost:8080
+Sec-WebSocket-Key: t0gTTkLcTIeCWbst7pmP3A==
+Sec-Websocket-Version: 13
+Sec-Websocket-Protocol: mqtt
+
+¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡ÀT°«ÄP´¯È\²©ÂV¶ÆRº¡
 \ No newline at end of file
@@ -187,6 +187,9 @@ void MainApp::doHelp(const char *arg)
     puts(" -t, --test-config                    Test configuration file.");
 #ifndef NDEBUG
     puts(" -z, --fuzz-file <inputdata.dat>      For fuzzing, provides the bytes that would be sent by a client.");
+    puts(" -W, --fuzz-websockets                Mark the client as websockets for fuzzing. The handshaking process makes");
+    puts("                                      it a less useful though, because the fuzzer is not able to handle");
+    puts("                                      replies from the server, which would change the internal state.");
 #endif
     puts(" -V, --version                        Show version");
     puts(" -l, --license                        Show license");
@@ -264,6 +267,11 @@ void MainApp::setFuzzFile(const std::string &amp;fuzzFilePath)
     this->fuzzFilePath = fuzzFilePath;
 }
  
+void MainApp::setFuzzWebsockets(bool val)
+{
+    this->fuzzWebsockets = val;
+}
+
 void MainApp::initMainApp(int argc, char *argv[])
 {
     if (instance != nullptr)
@@ -275,6 +283,7 @@ void MainApp::initMainApp(int argc, char *argv[])
         {"config-file", required_argument, nullptr, 'c'},
         {"test-config", no_argument, nullptr, 't'},
         {"fuzz-file", required_argument, nullptr, 'z'},
+        {"fuzz-websockets", no_argument, nullptr, 'W'},
         {"version", no_argument, nullptr, 'V'},
         {"license", no_argument, nullptr, 'l'},
         {nullptr, 0, nullptr, 0}
@@ -282,11 +291,12 @@ void MainApp::initMainApp(int argc, char *argv[])
  
     std::string configFile;
     std::string fuzzFile;
+    bool fuzzWebsockets = false;
  
     int option_index = 0;
     int opt;
     bool testConfig = false;
-    while((opt = getopt_long(argc, argv, "hc:Vltz:", long_options, &option_index)) != -1)
+    while((opt = getopt_long(argc, argv, "hc:Vltz:W", long_options, &option_index)) != -1)
     {
         switch(opt)
         {
@@ -302,6 +312,9 @@ void MainApp::initMainApp(int argc, char *argv[])
         case 'z':
             fuzzFile = optarg;
             break;
+        case 'W':
+            fuzzWebsockets = true;
+            break;
         case 'h':
             MainApp::doHelp(argv[0]);
             exit(16);
@@ -339,6 +352,7 @@ void MainApp::initMainApp(int argc, char *argv[])
  
     instance = new MainApp(configFile);
     instance->setFuzzFile(fuzzFile);
+    instance->setFuzzWebsockets(fuzzWebsockets);
 }
  
  
@@ -392,7 +406,7 @@ void MainApp::start()
         {
             std::vector<MqttPacket> packetQueueIn;
  
-            Client_p client(new Client(fd, threads[0], nullptr, false, settings, true));
+            Client_p client(new Client(fd, threads[0], nullptr, fuzzWebsockets, settings, true));
             client->readFdIntoBuffer();
             client->bufferToMqttPackets(packetQueueIn, client);
  
@@ -40,6 +40,7 @@ class MainApp
     std::list<std::shared_ptr<Listener>> listeners;
     std::mutex quitMutex;
     std::string fuzzFilePath;
+    bool fuzzWebsockets = false;
  
     Logger *logger = Logger::getInstance();
  
@@ -51,6 +52,7 @@ class MainApp
     void wakeUpThread();
     void queueKeepAliveCheckAtAllThreads();
     void setFuzzFile(const std::string &fuzzFilePath);
+    void setFuzzWebsockets(bool val);
  
     MainApp(const std::string &configFilePath);
 public: