From 4561a9590fc9a8c9ef3676b119f04c2e6d0794c0 Mon Sep 17 00:00:00 2001
From: Edznux <edznux@gmail.com>
Date: Thu, 17 Sep 2020 01:29:09 +0200
Subject: [PATCH] WIP. basic state working: submitting statsd metrics (path,
 crashes, hangs)

---
 include/afl-fuzz.h    |  9 +++++
 src/afl-fuzz-run.c    |  5 ++-
 src/afl-fuzz-statsd.c | 87 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100644 src/afl-fuzz-statsd.c

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 1a05f4f4..5fff7feb 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -65,6 +65,8 @@
 #include <dlfcn.h>
 #include <sched.h>
 
+#include <netdb.h>
+
 #include <sys/wait.h>
 #include <sys/time.h>
 #ifndef USEMMAP
@@ -76,6 +78,7 @@
 #include <sys/mman.h>
 #include <sys/ioctl.h>
 #include <sys/file.h>
+#include <sys/types.h>
 
 #if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \
     defined(__NetBSD__) || defined(__DragonFly__)
@@ -951,6 +954,12 @@ void maybe_update_plot_file(afl_state_t *, double, double);
 void show_stats(afl_state_t *);
 void show_init_stats(afl_state_t *);
 
+/* StatsD */
+
+int statsd_init(char *host, int port);
+int send_statsd_metric(afl_state_t *afl);
+void statsd_format_metric(afl_state_t *afl, char *buff, int bufflen);
+
 /* Run */
 
 fsrv_run_result_t fuzz_run_target(afl_state_t *, afl_forkserver_t *fsrv, u32);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index d71ec339..8dc0b334 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -901,7 +901,10 @@ common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
       afl->stage_cur + 1 == afl->stage_max) {
 
     show_stats(afl);
-
+    if(send_statsd_metric(afl)){
+      //Change me to something realistic; don't fail on connection / lookup fail for metrics...
+      exit(1);
+    }
   }
 
   return 0;
diff --git a/src/afl-fuzz-statsd.c b/src/afl-fuzz-statsd.c
new file mode 100644
index 00000000..aa12ca9a
--- /dev/null
+++ b/src/afl-fuzz-statsd.c
@@ -0,0 +1,87 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <string.h>
+#include <sys/types.h>
+#include <netdb.h>
+#include <unistd.h>
+#include "afl-fuzz.h"
+
+
+int sock = 0;
+struct sockaddr_in server;
+int error = 0;
+
+int statsd_init(char *host, int port){
+    if((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1){
+        perror("socket");
+        exit(1);
+    }
+
+    memset(&server, 0, sizeof(server));
+    server.sin_family = AF_INET;
+    server.sin_port = htons(port);
+    
+    struct addrinfo *result;
+    struct addrinfo hints;
+
+    memset(&hints, 0, sizeof(struct addrinfo));
+    hints.ai_family = AF_INET;
+    hints.ai_socktype = SOCK_DGRAM;
+
+    if ( (error = getaddrinfo(host, NULL, &hints, &result)) ) {
+        perror("getaddrinfo");
+        exit(1);
+    }
+
+    memcpy(&(server.sin_addr), &((struct sockaddr_in*)result->ai_addr)->sin_addr, sizeof(struct in_addr));
+    freeaddrinfo(result);
+
+    return 0;
+}
+
+int send_statsd_metric(afl_state_t *afl){
+    u64 cur_ms = get_cur_time();
+    if (cur_ms - afl->stats_last_plot_ms < 1000) {
+        return 0;
+    }
+
+    error = statsd_init("127.0.0.1", 12345);
+    if (error){
+        perror("Failed to init statsd client. Aborting");
+        return -1;
+    }
+    
+    if(!sock){
+        perror("sock");
+        return -1;
+    }
+    char buff[512];
+    statsd_format_metric(afl, buff, 512);
+
+    if (sendto(sock, buff, strlen(buff), 0, (struct sockaddr *) &server, sizeof(server)) == -1) {
+        perror("sendto");
+        return -1;
+    }
+    close(sock);
+    sock=0;
+
+    return 0;
+}
+
+
+void statsd_format_metric(afl_state_t *afl, char *buff, int bufflen){
+    char *format = "fuzzing.afl.cycle_done:%llu|c\n"
+    "fuzzing.afl.total_path:%lu|c\n"
+    "fuzzing.afl.unique_crashes:%llu|c\n"
+    "fuzzing.afl.total_crashes:%llu|c\n"
+    "fuzzing.afl.unique_hangs:%llu|c\n";
+    snprintf(buff, bufflen, format,
+        afl->queue_cycle,
+        afl->queued_paths,
+        afl->unique_crashes,
+        afl->total_crashes,
+        afl->unique_hangs
+    );
+}
\ No newline at end of file