From 08332a4195956611db80a2cfe3710d760cbd6acf Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Tue, 14 May 2024 01:42:00 +0200 Subject: Initial commit: wireframe packet capture/analysis tool Terminal packet capture and analysis tool built to learn the C++ memory model (byte layout, alignment, endianness, std::span over unowned buffers) via a real capture pipeline. - Hand-rolled L2-L4 decoders (Ethernet, IPv4, IPv6 with extension header walking, TCP, UDP) over std::span, no struct-casting - L7 dissector interface with DNS, HTTP, and TLS SNI implementations - pcapng read/write for Wireshark-compatible capture files - Bounded capture queue: drop-on-backpressure for live capture, blocking push for faithful file replay - Kernel-level BPF filtering (-f) and a separate display-only search (-g / interactive) that doesn't touch what's captured - Replay mode (-r) reads a saved pcapng file back through the same pipeline as live capture, no root or live device needed - pcap_stats() surfaces kernel/interface drops invisible to the capture queue's own counter - Three frontends sharing one CaptureSession setup path: CLI, TUI (FTXUI, primary), GUI (Dear ImGui + SDL3, secondary) - 89 unit tests (doctest) plus 9 libFuzzer harnesses covering every hand-rolled parser; fuzzing found and fixed a real OOM in the pcapng reader (unbounded allocation from an untrusted length field) --- fuzz/fuzz_ipv6.cpp | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 fuzz/fuzz_ipv6.cpp (limited to 'fuzz/fuzz_ipv6.cpp') diff --git a/fuzz/fuzz_ipv6.cpp b/fuzz/fuzz_ipv6.cpp new file mode 100644 index 0000000..1cae072 --- /dev/null +++ b/fuzz/fuzz_ipv6.cpp @@ -0,0 +1,24 @@ +#include +#include + +#include "wireframe/net/ipv6.hpp" + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + auto packet = wireframe::net::parse_ipv6({data, size}); + if (packet) { + // Also exercise the RFC 5952 address formatter - it does its + // own byte manipulation (zero-run detection) independent of + // parse_ipv6, worth fuzzing on whatever bytes made it through. + wireframe::net::ipv6_to_string(packet->header.src); + wireframe::net::ipv6_to_string(packet->header.dst); + + // Extension-header walking: a loop that repeatedly trusts an + // attacker-controlled length field to advance through the + // buffer, over up to 8 iterations - exactly the shape of bug + // most worth fuzzing. header.next_header seeds which branch of + // the walker runs first; the walker's own logic picks whatever + // comes after based on each header's own next_header byte. + wireframe::net::walk_ipv6_extension_headers(packet->header.next_header, packet->payload); + } + return 0; +} -- cgit v1.2.3