Repository navigation
Add systemd unit + install target - issue #20 - #26
Merged
Merged
Conversation
Add a libFuzzer target for packet.c's untrusted frame parser, which reads variable-length Ethernet/IPv6 headers and walks a bounded IPv6 extension header chain - classic out-of-bounds-read territory. - tests/fuzz/fuzz_pkt_parse.cc: LLVMFuzzerTestOneInput feeds arbitrary bytes to pkt_parse(); first byte selects the link layer so both the Ethernet-II and loopback entry paths are exercised. - tests/fuzz/seed_check.c: plain-C smoke runner that drives every seed through pkt_parse (libFuzzer's runtime isn't on every host). - tests/fuzz/make_seeds.py + corpus/pkt_parse/: 12 seeds covering IPv4, IPv6, the fragment (nh=44) and multi extension-header walks, loopback, and truncated/garbage frames. - Makefile: `make fuzz-build` / `make fuzz` (clang, -fsanitize=fuzzer, address, 60s bound) and `make fuzz-seeds`. - ci.yml: bounded fuzz run on ubuntu (Linux-only: libFuzzer runtime). Also fixes a real bug surfaced by the fragment seed: ipv6_l4() read the Fragment header's Next Header at offset +6, but per RFC 8200 it is at offset 0, so any IPv6 fragment-encapsulated packet was silently dropped.
Crank-Git
force-pushed
the
feature/systemd-install
branch
from
October 25, 2026 05:05
f230345 to
34f693e
Compare
Crank-Git
force-pushed
the
feature/systemd-install
branch
from
October 25, 2026 05:48
34f693e to
7e0ebc4
Compare
pkt_parse() read buf[ip_off] without checking ip_off < len. A 14-byte Ethernet frame (dst+src+ethertype 0x0800, no L3 payload) passed the 'len < 14' guard, then buf[14] read one byte past the end -> ASan heap-buffer-overflow under libFuzzer. Add an 'ip_off >= len -> return 0' guard covering both link layers, and a regression seed (header_only_ipv4.eth). Also reformat the extern "C" wrapper in fuzz_pkt_parse.cc to Allman style so make check-format passes.
Ship a systemd unit and a per-instance template so sourceknock can be run and supervised the standard way instead of by hand. - contrib/systemd/sourceknock.service: runs the daemon as the unprivileged 'sourceknock' user, granted only CAP_NET_RAW + CAP_NET_ADMIN (not root), logs to journald, restarts on failure. - contrib/systemd/sourceknock@.service: template unit; 'sourceknock@myconf' runs /etc/sourceknock/myconf.conf. - Makefile: 'make install' / 'make uninstall' place the binary and units (overridable PREFIX/BINDIR/SYSDIR/CONFDIR, DESTDIR-aware) and reload systemd. - README: documents direct run + systemd install/enable/disable. Units validated as well-formed INI; 'make test' still green.
The systemd install target was inserted over the explicit %.o: %.c rule, leaving make to fall back to its built-in implicit rule (no -Isrc), which broke header resolution for src/*.o and the test objects. Restores the rule so make test is green again.
Crank-Git
force-pushed
the
feature/systemd-install
branch
from
October 25, 2026 05:56
7e0ebc4 to
a237b84
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
issue #20: systemd unit + install target
sourceknockis a root daemon with no service unit, so users had to figure outhow to run and supervise it by hand. This adds a systemd unit (plus a
per-instance template) and a
make install/make uninstallpath.What's here
unprivileged
sourceknockuser, granted onlyCAP_NET_RAW+CAP_NET_ADMIN(not root), logs to journald,Restart=on-failure.systemctl start sourceknock@myconfruns/etc/sourceknock/myconf.conf.make install/make uninstallplace the binary and units(overridable
PREFIX/BINDIR/SYSDIR/CONFDIR,DESTDIR-aware) andreload systemd.
Notes
sourceknockuser (standard for static unit files);the README shows how to create that system user.
make installneeds root.make testis stillgreen. Full install/enable was not exercised (no systemd on this host).