Add fuzzing application for gcoap

[nmeum]

Contribution description

Based on #13157, this PR adds a fuzzing application for the gcoap module. Since it's initial implementation in 2019 the gcoap module switched to using sock_async_event. For this reason, this PR also includes an implementation of a fuzzing termination condition for sock_async_event. After the callback has been invoked, the code checks if the previous packet returned by gnrc_sock_recv was the fuzzing packet, if so the fuzzing application is terminated.

Testing procedure

One function tested extensively by this fuzzing application is coap_parse(). As such, this fuzzing application would have been capable of finding #10753. To test this, remove the following code from the coap_parse() function:

RIOT/sys/net/application_layer/nanocoap/nanocoap.c

Lines 111 to 114 in b6be8af

	if (option_count >= CONFIG_NANOCOAP_NOPTS_MAX) {
	DEBUG("nanocoap: max nr of options exceeded\n");
	return -ENOMEM;
	}

Afterwards run:

$ make -C fuzzing/gcoap all-asan
$ make -C fuzzing/gcoap fuzz

AFL should discover a crash, in the modified code branch, within a few minutes.

Issues/PRs references

• Add AFL-based fuzzing setup for network modules #13157
• nanocoap: options buffer overflow #10753

[benpicco]

Looks good!
I like how the more examples will make it easier to write new fuzz tests.

Please add a comment to the sock inserts so they keep doing the right thing should those parts get refactored.

[benpicco]

This is unrelated but I've noticed make -j fuzz will only ever use one core.
Is this a limitation of afl? To me it seems such task would lend itself well to parallelization.

[nmeum]

This is unrelated but I've noticed make -j fuzz will only ever use one core.

AFL has it's own parallel fuzzing setup. See:

• https://github.com/RIOT-OS/RIOT/tree/master/fuzzing#parallel-fuzzing
• https://github.com/google/AFL/blob/master/docs/parallel_fuzzing.txt

[benpicco]

@nmeum ping 😉

[nmeum]

@nmeum ping 😉

Sorry, been very busy with other things lately. Pushed a few additional commits.

[benpicco]

looks good to me

[nmeum]

Having thought about this further commit 7d1cf1d is probably not needed since MODULE_SOCK_ASYNC_EVENT will also cause MODULE_GNRC_SOCK to be defined for fuzzing applications anyhow.

[benpicco]

Well feel free to drop it then 😉