proftpd: add netacl, logfmt, ftpaccess, and cmd fuzz harnesses

[tc-agent]

Adds four libFuzzer harnesses alongside the existing bundled json_fuzzer, targeting attacker-influenced inputs across proftpd's parsing surface.

What is fuzzed

• netacl_fuzzer — drives pr_netacl_create() over ACL strings (ALL, none, IPv4/IPv6 literals, CIDR, netmask, glob, DNS suffix, negation). These flow through <Allow>/<Deny> directives and represent the parsed form of operator-supplied access rules.
• logfmt_fuzzer — drives pr_jot_parse_logfmt() plus pr_jot_filters_create() across all three filter types (COMMANDS_WITH_CLASSES, COMMANDS, CLASSES) for LogFormat / jot filter strings.
• ftpaccess_fuzzer — runs pr_parser_parse_file() with PR_PARSER_FL_DYNAMIC_CONFIG, the flag proftpd uses for .ftpaccess files. Those are per-directory configuration drops that can land in user-writable directories, which is the attacker-influenced parser entry point. Static modules are registered via modules_init() so each directive dispatches into the conftab handlers of mod_core, mod_auth, mod_xfer, mod_ls, mod_log, mod_delay, mod_ctrls etc.
• cmd_fuzzer — tokenizes the input into a cmd_rec and runs the command-recognition path: pr_cmd_get_id, pr_cmd_is_http/smtp/ssh2, pr_cmd_get_displayable_str, and pr_cmd_cmp against every FTP verb id. This is the pre-auth slice every connected client reaches; it does not call pr_cmd_dispatch_phase because that path reaches for response queues / scoreboard / proctitle / per-handler auth state that can't be faithfully stubbed without re-implementing fork_server.

All harnesses follow the existing json_fuzzer build pattern (reusing fuzz_lib.a, src/scoreboard.o, lib/prbase.a).

Coverage

Per Fuzz Introspector, the existing single json_fuzzer covers 1.30% of project lines (769 / 58945).

After 5 minutes of concurrent fuzzing across all five harnesses (a 300s libFuzzer run per harness over the seed corpora below):

• fuzzer (json): 769 / 58945 = 1.3%
• netacl_fuzzer: 1076 / 58943 = 1.8%
• logfmt_fuzzer: 895 / 58957 = 1.5%
• ftpaccess_fuzzer: 5863 / 58951 = 9.9%
• cmd_fuzzer: 914 / 59008 = 1.5%
• Global (union): 7446 / 59210 = 12.6%

The 12.6% global is a 5-minute local measurement; the prior-state 1.30% baseline is sourced from Fuzz Introspector at the link above. The per-file figures below are also from the same local 5-minute run.

• proftpd/modules/mod_core.c: 18.2% (896 / 4920)
• proftpd/modules/mod_xfer.c: 8.6%
• proftpd/modules/mod_auth.c: 8.5%
• src/jot.c: 25.2%
• src/netaddr.c: 22.0%
• src/netacl.c: 54.8%
• src/parser.c: 46.8%
• src/configdb.c: 31.2%
• src/stash.c: 52.2%

Seeds

All seed corpora are human-readable text files (no binaries):

• netacl_seeds/: nine ACL literals (CIDR, netmask, glob, IPv6, DNS).
• logfmt_seeds/: short-var, long-var, env/note/var, comma-separated commands, pipe-separated classes.
• ftpaccess_seeds/: eighteen layered configurations covering <Anonymous>, <Directory>, <Limit>, <Class>, <Global>, <VirtualHost>, <IfModule>, plus auth/logfmt/RLimit/regex/nested-block examples.
• cmd_seeds/: pre-auth FTP commands with arguments (USER anonymous, PORT 192,168,1,1,4,5, EPRT |1|...|, LIST -la /tmp, SITE CHMOD 0755 file, AUTH TLS, etc.), plus HTTP / SMTP / SSH banners to exercise the protocol-sniffing branch.

A libFuzzer dictionary (ftpaccess_fuzzer.dict) lists every directive name extracted from the modules' conftabs and the eight section markers, to help mutations stay near the grammar.

[github-actions]

Fuzzing Coverage Report

Tested: project proftpd · base d6faa1f → head a8cf930 · 300s total fuzz budget · updated 2026-05-28 01:24 UTC · workflow run

Metric	Before	After	Delta
Static reachability	18.6% (357/1921)	21.9% (421/1925)	+3.3%
Line coverage	1.3% (769/58956)	13.8% (8157/59178)	+960.7%
Branch coverage	1.4% (368/26837)	12.8% (3450/26917)	+837.5%
Function coverage	2.9% (56/1923)	24.5% (473/1931)	+744.6%

Per-harness

Harness	Lines before	Lines after	Δ
cmd_fuzzer	0%	1.6% (933/59018)	new
ftpaccess_fuzzer	0%	11.4% (6745/58962)	new
fuzzer	1.3% (769/58956)	1.3% (769/58956)	+0.0%
logfmt_fuzzer	0%	1.5% (895/58968)	new
netacl_fuzzer	0%	2.0% (1166/58954)	new

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}