Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/3011 Thanks!
[Music]
all right everyone welcome back our next
talk is fuzzing the fuzzing the TCP IP
stack with Ilia please give him a warm
Round of
[Applause]
Applause great uh thank you for the
introduction uh as it was just mentioned
I will be talking about uh fuzzing BC
going beyond the trivial um just a fair
warning and I'll get into this a bit
later this is a very very early
pre-alpha version uh there is more to
come uh but I have some things to uh
talk about and report and uh hope hoping
to maybe move to the kind of current
state of this a bit
further um right so who am I uh my name
is Ilia um I have been coming to the CC
Congress since 18
C3 uh which is really not a way of
saying I am old and
decrepit
um uh I've in the in in a handful of
those times I've also uh spoken here
before I spoke on some issues with
clearing memory which I called msad I
spoke on some X11 things about a decade
ago I spoke on some window stuff uh I
did a general fuzzing talk about 15 16
years AG go and there were a few others
that I can't really remember cuz I'm old
and my memory sucks um but uh what's
really cool is it's it's really really
glad I'm really glad to be back here
after uh 4 years um yeah right
yeah
absolutely oh man um it was almost H it
was almost going to happen last year and
then I guess something happened it
didn't um but hey here we are uh all
good again hopefully we hopefully you
know we won't have to to wait another 3
or 4 years for the next one um I'm
definitely looking forward to the next
one already um even though I guess we
we're only halfway
through um but yeah that's kind of who I
am um yeah I mean I also I work at a
company called ioactive we do computer
security I do code review and pent test
and fuzzing and all those kind of things
you know I'm a security kind of
consultant SL
engineer um right so uh what am I going
to talk about um basically um I'll have
a slide kind of talking about the
audience that might be interested in
here but if you're here you probably
only know who you are um and then I'll
kind of go into a little bit of the
history of uh doing tcip stack fuzzing
and this like low-level Network fuzzing
um and kind of where the state is today
uh and then kind of move on to uh where
I see it going what I'm what I will be
the Crux of what I'll be presenting and
then sort of the how do we go beyond
that
um and then the the kind of middle part
of my talk is kind of the where I'm at
so uh sort of how I want to do some kind
or I Envision doing sort of the
quotequote next level whatever that
means um of uh TCP stack fuzzing you
know and I'll talk about kind of what I
want to fuzz and how I want to fuzz it
and I'll talk about the setup and I'll
talk about uh certain modifications I
made to network Stacks to try and make
this happen uh I'll uh show how to get
all this thing set up and how to kind of
um the usage of the stuff I've been uh
that I kind of built and then um I'll do
a small
demo um and then after that uh if
anybody's still in the room um I'll take
questions um right so the audience I
mean you know who you are but uh if it
isn't clear if you're if you like
fuzzing this might be interesting if
you're a geek this might be interesting
if you're operating systems guy um this
might be interesting uh if you like
technology you might like this if any
any kind of sort of security network OS
fuzzing um then this may be for you uh
but even if you don't fall in that
category you might still find this
interesting um right so let's let's get
into kind of the history of things right
um so I'm obviously you know not the
very first guy to go hey he you know we
have these DCP stacks and they take
Network packets and they parse bits and
bites and they handle State isn't that
interesting surely that's a tack surface
right in fact um you know you go back to
the 90s and probably before that but you
know I wasn't around before that so um
if you look at kind of the the state
of network stack bugs in the 9s it was
sort of very trivial stuff for those who
were around around um you might remember
like wind nuke and we had things like
sin floods and ping of dead and um you
know Smurf and land and Teardrop and
bonk and all these mutations and boink
and what have you um uh and and I
wouldn't say they were really a result
of fuzzing but they definitely were some
kind of result of some kind of runtime
testing um I think at this time very few
people were actually doing any kind of
targeted code review were fuzzing um but
people were at least you know people
observed certain bugs in the network
stack and um observed that they could
write tools and exploits to um use them
mostly for things like denial of service
um but that's kind of where this starts
sort of mid90s is with these kind of
trivial tools um none of this should
work today um but that's that's kind of
the the where where we the history
starts of this um and then we kind of
get into the late ' 90s and in the 2000s
and um you
know we had better we had some libraries
like lipnet and things like that and uh
somebody wrote this tool called um ISC
uh the IP stack Integrity Checker um and
isk is really really cool um somehow
it's one of these tools that not many
people everybody should know about them
but you know I when I talk to people
often times they'll be like what is this
thing and then you go download this
thing that's 20 25 years old and you run
it against Network stack and um
sometimes bugs come out um it was
extremely successful back in its day um
it it would break windows up to Windows
7 there was some nasty bug in UDP
Handler um it's broken the Linux stack
several times uh I mean they twiddle
with your stack often so sometimes stuff
breaks and they fix it and then 2 years
later it breaks again something else and
so on and so on um it's definitely
broken to that be as dtp stack um the
top three I know because I I hit those
bugs too and then kind of the bottom
ones the like checkpoint firewall and
The Gauntlet firewall and the Raptor and
so on uh I didn't I never observed any
of that cuz I don't have access to that
hardware and of course uh that Hardware
I mean this is this is basically from
their trophies file which is from the
late '90s um and so this these These are
kind of products of that time um but
like dot dot dot because this this stuff
this thing really used to break
everything um and on occasion it still
breaks stuff right um and uh the way ISC
really works is it understands the
structure of an IP packet and the
structure of a UDP packet and a TCP
packet and an icmp packet and an
Ethernet frame um and it just you know
bit bangs around and has some options to
go hey do you want to fiddle with these
flags or TCP Flags or do you want to
fiddle with uh IP options or TCP options
and or do you want to mess with a check
some and then it just uh keeps this one
buffer and then has this Loop and it um
just keeps changing a few bits and keeps
firing these things off the speed of ISC
is really pretty bad uh pretty insane
like it's it's fast um but um it it's
it's limited right it it can only it
doesn't understand any kind of
State uh and so it while it finds a
certain amount of bugs there is beyond a
certain point it just it can't get
beyond that it can't find those bugs
right um but even so that's this is this
is kind of where we've been stuck for 20
years right that's so was kind of why I
wanted to do this
presentation um you since you know you
can use scappy and do similar things
with scappy um the reason I like is can
still like it today is because uh it's
it's um it's very simple C code and it's
just blazingly
fast um anyway how do we go beyond this
trivial State we've been stuck here for
20-some years uh it's time to move on
right um as I mentioned before uh it
turns out um TCP which sits on top of Ip
and some other things um has State uh
and um there are and you can ask Network
engineers and uh people that build these
the networks act and so on there are
bugs that sit behind these state that if
you just throw packets at it without
ever get into the state you will never
hit these kind of bugs right
um You can't so you you just can't get
there with crafting packet simple
packets you need to like complete your
three-way handshake and like set up like
uh the right extensions and the right
flags and like I send you this and you
sent me this and I send you this other
thing and you send me this thing and all
of a sudden you get into this weird
state where maybe some bug happens right
um but that's pretty deep that's pretty
deep into like your network protocol if
you're just banging out some bits um you
never get there right um and so um
getting to this point and trying to fuzz
beyond that uh this is hard and it takes
a lot of
time um as I said the state really
hasn't Advanced much Beyond this um
there's been some research last couple
years cuz I kind of Googled around for
these things so there's this m 33 um and
then there's this academic paper TCP
fuzz uh where they kind of use this
uh Network stress SL test tool by uh
Google which isn't really a fuzzer but
you can kind of coax it into like
becoming a fuzzer is called packet
driller um and so they found some
interesting things with that um and I'll
I'll kind of circle back to these things
a bit later
um so uh of course you know with with uh
the enormous success in the last decade
and change of things like AFL and AFL
plus the first thought is aha let's
let's use coverage guided fuzzing
fantastic let's do that um and that
would be great um it turns out it's not
that simple um there there have been
attempts and in principle yes you want
to do coverage guided fuzzing um it's
not easy um there are some problems
right so first of all AFL and AFL Plus+
work incredibly well when a you have a
file where really all of your state is
maintained in a file or you have a very
simple API where you go here's a here's
data and here's a length and go parse
right um it is it works exceptionally
well for those situations and um a lot
of attack surface is like that um a
network stack doesn't quite quite work
like that right um it's not it's not a
file it's it's a protocol which means
there's things that get to a state that
does isn't like one bit inside of a pack
right so it's it's it's it's this weird
thing that you is like encoded in a
series of things it isn't like
represented by one bit or one bite or
like a length field or something like
that um that's one the other one is um
packet cues um when I mean packet choose
is basically uh so if you let's say if
you have a network uh you have a file
parser usually you have like file parse
function and you have a linked and a
pointer and it parses the thing and it
returns and it does something um when
you do a network stack because it is so
tightly integrated into the bowels of
your operating system um it uh like what
happens is uh a packet comes in and the
Nick kind of sees it and it triggers an
interrupt an interrupt handle kicks in
and goes great and it kind of takes it
from interrupt queue and then it looks
at it and it goes oh this is ethernet
I'm going to put this an Ethernet queue
and then at some point your ethernet
Handler wakes up and he goes oh great
I'm taking out out this queue and he
goes oh this is IP great I'm put this on
the ipq and he goes back that's
something else the ipq at some point
wakes up takes this thing off the queue
and goes oh yeah great this is IP so and
so oh it's TCP yes yeah I have an open
TCP board great I'm going to go put this
on TCP q and then the TCP Q at some
point you know uh TCP threat wakes up
takes it from TCP q and go go yes I know
this guy I've been talking to this guy I
have a userland service that's running
I'm going to take this thing and give it
to the userland guy and the useland guy
just called receive and receive now
return and and so it's you have a uh you
have a bunch of these steps um and and
it's this it's they're not it's not
linear it's not one two three it's one
guy and then somebody else and then
somebody else and then somebody else um
and um while you can instrument that
it's not quite as simple right um as I
mentioned the the other one is issue is
is uh the state can't easily be captured
in in any kind of file or or or set of
data um it's really like a sequence of
things um so that that's where things
get problematic um and there are people
that have you know discussions and
people have tried um and uh
um someone said hey you know we actually
tried with AFL and we got somewhere but
they said you know we ran into problems
which is exactly what I was just talking
about um the the cues the asyn the
asynchron asynchronicity of it all makes
it very difficult uh it it doesn't mean
you can't do coverage guide fuzzing uh
but it means it requires an extra set of
work beyond what we've done
before um and so um I I mean I my
opinion is we have to work towards
getting this um but we are very far away
from it uh getting that done in any kind
of way that is reproducible easy to set
up um doing like a a oneoff where it
works for one guy and then um getting to
some level of fuzzing that's what this
this guy is describing right but getting
that to any kind of level where we can
Repro that and and make it you know not
make your life Mis when you try to set
it up nowhere close to that
um so as I said this is that this is why
like the state fuzzing state is just
hard and timec consuming um and I'm
definitely not here to talk about
coverage guide fuzzing I just wanted to
kind of see where we're going um I'm
basically I'm I'm very I'm I'm a I'm a a
a yeah I write code I do you know I'm
lazy right so um and the thought I had
is instead of doing that uh what we
really want is I want to have my own
network stack that I can fiddle with and
then talk to somebody else Network stack
and I basically you know modified his
Network stack so that it adds fuzzing
and because the network Stack's already
there I get old estate for free cuz the
stack is doing that um but as I said I'm
lazy there's no way I'm building my own
network stack
um but the good news is I don't have to
right um if this was 10 15 20 years ago
um you you would have been out of luck
and you would have had to do that um but
today it turns out we have a number of
usel anti spip Stacks right um and uh
they they're often used for like in
embedded stuff or to test certain things
uh somebody wrote a port Scanner with it
like you can do all sort of things with
it uh but somehow as far as I can tell
no one's ever looked at it and said
great let's go co-opt one of these
Network stacks and and turn them into a
fuzzer um and that was kind of the idea
I had that's kind of the Crux of this
presentation um and so um one of the
things I did is uh looked around and
said okay what's what's out there right
and it turns out there's quite a few um
there's libuet which is a port of the
BSD Network stack to userland um it's
fairly old it hasn't been touched in 8
years I have no idea what its current
state is um I I just looked at it the
the the time stamp I was like ah this I
don't want to mess with this uh it might
just be too painful uh there's ptcp
which is a fully functioning Network
stack in
Python um I considered using that it was
a bit too painful for what I had in mind
it it does like it comes with its own uh
like DHCP server and things like that
and that's that's too much I I don't
want that I just want an nwork stack um
so there's a few others um I looked at
net stack which is is uh Google made
this as part of their giser um products
offering whatever um and um net stack
used to be a separate thing uh and then
it somehow got moved into giser um like
the repo um and trying to separate one
from the other I'm sure there's a way to
do it I tried um couldn't quite get
there and I didn't spend much time on it
but I'd say couldn't get it done within
an hour and I was kind of like okay
you're out I need something easier
um there's lwip which I know is used in
a few places um there's small TCP which
is uh TCP us LP stack entirely written
in Rust which is very exciting um picot
TCP uip there's a bunch of others um I
settled on piot TCP and I'll talk about
that in a
minute um before I get to like the
actual implementation kind of testing I
did um what do we actually want to fuzz
um this this this isn't really a hard
question but you know we we we should
determine this before we actually set
out to to fuzz this thing right um so
yes the idea is we take a US line tpip
stack we modify it um to fuzz the right
things we get the state for free because
the TCP stack already does that but what
do we then want to fuz right and the
answer then is okay let's go look at the
protocols and see what's there and where
we know there is State and where we know
things go wrong and where we know things
have gone wrong in the past right
basically stuff where there's complexity
right um and if you're looking at for
example TCP like obviously your flags
they tend to Signal uh things and cause
transitions in States uh you know
obviously a sin or synac
or um that those kind of things tend to
cause transitions in state um window
sizes are interesting they've definitely
they're kind of subtle they seem trivial
uh but they've caused problems in the
past so messing with window size is a
great idea um check
shouldn't be a problem uh but I have
seen problems where checkm functions
will read out of bound by one or two
bytes so on occasion checksums are a
problem um obviously the size of packets
is interesting right if um you know what
happens if you get a zero siiz packet
right is that even legal um spoiler
turns out for UDP it is legal for TCP it
is not
um uh what if you send really large
packets what if they're larger than the
MTU what if you use frames and so on
some of this triggers fragmentation some
of it doesn't um and obviously the
obvious one is length field right can we
mess with linked
Fields um and then obviously
fragmentation is uh interesting right we
know there have been plenty of bugs with
fragmentation in the past we know
there's going to be bugs in the future
with fragmentation so that's that's
definitely something you you would want
to fuzz um and you get into all sorts of
is it too big or too small or too many
or not enough or out of order some stuff
timed out or some duplicates or you set
a don't fragment flag but you fragment
anyway you know you had all of these
weird uh fragmentation things um and
then sort of lastly uh is you know
options right so ipv4 options TP options
IPv6 extension headers right um
insertion truncation removal out of
order any of combination of these could
be interesting could lead to some kind
of issues um in state or or a
combination of both um so that's stuff
that we would want to
fuzz
um so as all of these may or may not
relate to State um I I care in the sense
that I want to get to state but I also
don't really care in the sense that um
CU I already have a a US lcip stack it
does the state for me so I just kind of
piggyback off of
that um and then of course you can just
build on upon it right it's like okay
well what about icmp what about STP what
about igmp and so on um for SCP it's
like okay PCP doesn't support it I
wanted to use yinet but I never got that
far so um ultimately I want to get there
but um not not even close to it um satp
by the way is one of these weird things
where like if you're a network nerd
you've probably heard of it but you
never seen it because nobody nobody use
SCP except when you get to the telal
world and then everybody uses STP right
so it's one of these really large niches
uh but outside of that nobody nobody
really uses
it
um right so that's kind of okay when I
want to fuzz and how I want to fuzz uh
let's let's talk practical things
because I did I kind of built this
fuzzer right it does this thing um so
how does that work right so well the
first thing you do is as I said you pick
one so I I I chose Pick O TCP uh and
I'll get into that in a moment um your
steps for setup are relatively easy
um essentially you set up a ton tap
interface you play around with like a
bridge and like add if and brctl and so
on um and then you need something to
drive traffic and so what I did is I
created a simple echos service in an
echo client and that obviously you do
that in a loop and it kind of ends up
driving traffic till the end of time
which is great because now I can just
hook into the network stack and and sort
messing with things um and because the
the you know Echo client server just
keep sending data back forth and back
forth and back and forth it'll just that
just drives fuzzing right um and then
the last step in setup is yes you need
to modify your tcpip stack and add
fuzzing to normal
traffic um so yeah as I said um I used
picot TCP and here's why um so I
evaluate a bunch of these things uh
initially I wanted to go with
ptcp um it I just didn't it was a a
little bit too hairy for what I wanted
to do uh but it it it does work um I was
like okay PB looks great um I used to
write a ton of C code I haven't touched
much C in the last couple of years um
but it was nice because I got I now have
an excuse to write some C code uh and
picot TCP is um it it's pretty simple C
code it's not very complicated uh it's
easy to get started with it it's easy to
integrate into uh into your own userland
program it's easy to read the code it is
easy to modify and best of all it's open
source and free software it's entirely
GPL um so that means I can do whatever
the hell I want with
it um sweet so um yeah I should have put
one in in in in in this slide but
essentially I don't know if you can read
the code from how far but essentially
one of the cool things about PP is that
it um it comes with very simple very
easy apis and so I built a simple Echo
client using the
apis um and so essentially you kind of
go and say yeah I want a stack to have
this IP you know um I want to you know
um create a socket and then go connect
with somebody else on on that
socket um and that that's that's just I
mean it it's the API are really really
simple um sweet so uh with that um um I
uh I'll do a demo uh I'll I'll say this
though what expectations um I uh I
didn't quite get as far as I wanted to
the The fuzzer Works uh just barely
though but it works um I didn't
Implement everything I wanted to
implement um there's lots of to-dos um
the fragmentation for example I'm not
there yet um in terms of trophies not
really any significant crashes yet I did
find a minor denal service in like
Dominic Street Network stack where if
I'm throwing packets at it something
else at some point can't connect to it
until you kind of stop throwing packets
at it um I don't know if that's really a
state thing that may just be that the
stack is so slow it can't keep up uh
even though I'm not throwing packets at
it that
fast um but yeah let me let me do a
little
demo um sweet so here I have an openbsd
machine which is running my echo demon
uh and
here I have my uh my fuzzer this runs uh
yeah Linux machine uh so this is this
one is
one2 1681 do I think 131 or 130 and then
thez machine is
132 um and so you'll see traffic here in
a second and uh should have
yeah sweet
okay so kind of Drive traffic from here
and it goes like yeah yeah I'm fuzzing
I'm fuzzing I'm fuzzing I'm
fuzzing and then uh we goes yeah I see
your packets and you're kind of fuzzing
and I'm echoing some things but it's
dropping a lot because there's all sorts
of things it doesn't like um and then
like if you go through this stuff
there's you'll see whole bunch of like
retransmissions and like some broken
packets and all sorts of things um like
it's it's it's not it's it's good enough
that um packets get through and get
processed and make it past the threeway
handshake and they get echoed back it's
broken enough that a lot of the stuff
doesn't get through and get stuck
somewhere and my hope is somewhere in
there it it will find bugs
um uh this coach started working this
morning at about 6:00 a.m. uh
uh yeah
[Applause]
[Music]
so um the the downside is I I I hope to
find a bug or two uh not yet uh which is
kind of annoying uh but uh this this is
about as far as as I go with that
um so yeah it's Bas it's a pre-alpha
version there's work to be done uh as I
said it works but just
barely uh as I said I can force back
pets through the stack do the three-way
handshake uh and sometimes the the echos
service acknowledges and sends it back
to me which is great um sometimes my
echo client crashes and that's why I
have a bash loop around it um as I said
it it's it's it's it's ugly but it works
um and I said I haven't implemented
fragmentation yet um so lots of work to
be done the code is incredibly ugly um
but given and and I wanted to get
further than I did today um but it does
work um some somewhat um and I put it on
on on on GitHub so if you want to if you
want to play around with it you
can expect updates in the next couple of
days and weeks uh I hope to get this in
a much better State um it is really ugly
by the way um and um it currently I
don't actually have a full PCP code in
there I just took a diff and the diff is
kind of screwed up so I do need to fix
it um but everything if you really want
to get working everything is there uh
but I'll in the next couple days I will
clean it up and make it easier to work
with um but if you want to get going to
like right now it's going to take you
some effort uh but it's there um but if
you hold on for a few more days maybe a
week um I I will make sure it works it's
it be
easier um yeah I'm kind of out of time
but last thing I kind of wanted to uh
talk about is um why stop at one fuzzer
right one of the really cool things I
like about e++ is it's integration with
other fuzzers and I think that's
something we should start doing in
everything we fuzz it's like why stop at
one fuzzer if there's something else
find a way to make them work together to
cooperate and collaborate and so so on
uh I mentioned uh package ruler before
like you could definitely get some
package ruler in there uh why not throw
some istic in there um there's the IPv6
toolkit there's a few others um so I'd
say don't just stop one fuzer combine a
bunch of things
uh yeah talked about some previous
research um yeah as for conclusion I
don't really have much of a conclusion
except for I uh I should have started
this earlier and gotten
further um I I I I do have longterm
goals and a call to action right to to
me it's clear that um using USP stack
will move the state Beyond where we are
today with um just using ISC for example
right um ISC still finds bug but you
know it's 25 years old we let's have a
better approach right and so I think
using using us stack is seems very
promising to me I think it's a good move
forward um it's not the end goal right
ultimately we do want coverage guided
fuzzing um and but I don't think those
are mutually exclusive in fact I think
both will work well together um as I
said doing this currently is very
difficult um I'm I'm hoping to you know
find other people that will want to work
on this as well and my my my goal here
is really just to get things moving and
get some ideas going really um yeah I
guess I'm one minute over time but
that's that's essentially my
[Applause]
presentation thank you all right we have
eight minutes for questions so if you
have any questions um please line up at
the microphones and we will take them
and if you're on the
stream uh you can also ask questions on
the internet and someone already did so
please go ahead yes thank you um thank
you for the great talk and the great
effort and getting it ready for today um
one question from the internet here is
um where do you see like what else do
you see that that could be done like
fing um icmp or or so on is like good
user land tools also available here just
what a general thoughts on the landscape
yeah that's a really good question um
icmp I think is a good one CU I mean
that's one of these things where usually
um i i p is generally don't come out of
nowhere they tend to come out of
something in the state went wrong like
you're talking to the TCP thing and all
a sudden the port closes then you get an
icmp going hey you know Port closed or
something um so that's definitely stuff
you can do um to some extent I have that
implement it in the sense that um I
don't I don't I haven't don't have any
code that explicitly evokes
icmp uh uh packets which is something
that I think should be added but I do
have code that says hey if the network
stack generates icmp messages I will go
first that so that is
implemented um but icmp is is a really
good one um there's definitely more work
to be done there um I mentioned some of
these things before
um so it's yeah um so definitely IPv6
which I haven't implemented yet the
extensions I think is interesting um
yeah I MP here igmp is not a one STP I
mean the the the um the opportunities
are really boundless and endless right
so um I think it's a great question I
don't have the answer to all of them um
I think I enumerated some there's
definitely more um it it it would make
sense as an exercise to to Really dive
deep into kind of every possible thing
you can have in in your state in DCP
stack ex enumerate and then go kind of
like this goal oriented approach where
you go have I implemented this no how do
I do it have I imp this have this as I
said I kind of ran out of time um I'd
like to do this I haven't done that
yet all right we take mic number two
please hello thank you um I wasn't quite
clear are you fuzzing PCP or are you
just using PCP to take care of a bunch
of stuff that you are too lazy to do
that's exactly it I I'm not I mean you
you can fuzz PP with this too it's not
what I'm doing right I'm using PCP to be
my TCP stack right that means I don't
have to write it and then what I did is
I basically um the way PP works is is
like it's not a library that in the
sense that like it's on the system it's
a it's a library in the sense that it's
part of your application I compile it
with me and so um because of that I can
like the S the pp source code is part of
my program so I literally just add hooks
in a bunch of places in PCP and go oh
before you sent this out if it's IP do
IP fuzzing if it's TCP do TCP fuzzing if
it's icmp do icmp fuzzing uh add
extensions mutate extensions that kind
of stuff so you're fussing the remote
system correct yes all right thank you
all right do we have any further
questions in the room no internet
go yes um another one um how do you
meter kind of like the underlying Stacks
how do you look at Branch coverage and
so on are you doing that already and how
are you doing it yep that is a great
question um that's coverage guided
fuzzing um I am currently not doing that
right I I spoke about that a little bit
um I we need to move in that
direction um it it's definitely I I
think that's the end goal really um the
problem some of the problems I discussed
is is that it's not quite as easy um as
it's made out to be um you're dealing
with a lowlevel operating system so it's
not as simple as instrumenting uh us L
program um you're dealing with cues
instead of uh files or like one file
parser um so dealing with cues is a pain
in the ass um and then you're dealing
with state right which means uh a lot of
things don't necessarily encode to one
bit or one bite but it's really a
combination of you sent this and then I
sent that and then this sent and then so
on and and this you seven or eight
different things lining up that then
causes a state transition right um and
so it's there's at least from where I'm
standing right now there's no easy way
to do this um as I said we need to go
there uh that's the end goal um how we
go there there there are certain gaps
that need to be filled were you in
yesterday's talk about the qo fing
unfortunately no um I had code to WR I
think that's a good good start all right
mic number three please hi great talk uh
I wanted to ask if if may be possible to
integrate fuzzing into the Linux kernel
itself to fuzz its tcpip
stack uh yes you can um so when you get
to like a net filter um There Are Places
there that you can use um to to to fuzz
with um I looked into it it's one of the
things I wanted to do um it was on my
to-do list once I get done with you know
where I get with picot TCP and some
other things um and again it's one of
these things it doesn't have to one or
the other right you can combine these
things um so that is a great approach I
thought about it I want to do it um I
haven't gotten there yet that's 10 steps
away from where I'm now I hope that
anwers your question but I it's it's
it's I think it's a great question and
the answer is yes we we should do that
all right thanks all right do we have
any further questions from the
internet have yes we have one and I
think it's it's very general um so the
question here is um have you have used
considered using rust for the fuzer
itself like um the hyper HP library or
something like this yeah um so I did I
mentioned small TCP so the the uh given
that there's a network sack for it you
can use rust um I haven't I didn't use
that um I I'm I'm I like rust I think
it's it's it's a a great programming
language um I think it's uh at some
point hopefully it'll replace all or
most of our C or C++ code um I I have
many great things to say about rust um I
am not a great rust developer I've
written a little bit of rust code but I
I have a large learning curve um and for
that reason and only that reason I
didn't go with rust or small TCP uh it's
just it's my own limitations um I wish I
had known more rust uh but you know life
happens and I I I I didn't I haven't had
a good opportunity yet to to write a
bunch of rust code uh some somay I hope
to get better at writing rust code and I
I would love to do some of this stuff in
Rust but the only reason I didn't uh
touch anything in Rust here was I wasn't
confident I would have gotten anything
done in
time all
right then we will simply end the talk
perfectly on time thank you very much
[Music]
[Applause]
IIA
[Music]
la