src/fuzz/fuzz-dhcp-server.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <fcntl.h>
   4 #include <sys/stat.h>
   5 #include <sys/types.h>
   6
   7 #include "fuzz.h"
   8
   9 #include "sd-dhcp-server.c"
  10
  11 /* stub out network so that the server doesn't send */
  12 ssize_t sendto(int sockfd, const void *buf, size_t len, int flags, const struct sockaddr *dest_addr, socklen_t addrlen) {
  13         return len;
  14 }
  15
  16 ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags) {
  17         return 0;
  18 }
  19
  20 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  21         _cleanup_(sd_dhcp_server_unrefp) sd_dhcp_server *server = NULL;
  22         struct in_addr address = {.s_addr = htobe32(UINT32_C(10) << 24 | UINT32_C(1))};
  23         static const uint8_t chaddr[] = {3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3};
  24         uint8_t *client_id;
  25         DHCPLease *lease;
  26         int pool_offset;
  27
  28         if (size < sizeof(DHCPMessage))
  29                 return 0;
  30
  31         assert_se(sd_dhcp_server_new(&server, 1) >= 0);
  32         server->fd = open("/dev/null", O_RDWR|O_CLOEXEC|O_NOCTTY);
  33         assert_se(server->fd >= 0);
  34         assert_se(sd_dhcp_server_configure_pool(server, &address, 24, 0, 0) >= 0);
  35
  36         /* add a lease to the pool to expose additional code paths */
  37         client_id = malloc(2);
  38         assert_se(client_id);
  39         client_id[0] = 2;
  40         client_id[1] = 2;
  41         lease = new0(DHCPLease, 1);
  42         assert_se(lease);
  43         lease->client_id.length = 2;
  44         lease->client_id.data = client_id;
  45         lease->address = htobe32(UINT32_C(10) << 24 | UINT32_C(2));
  46         lease->gateway = htobe32(UINT32_C(10) << 24 | UINT32_C(1));
  47         lease->expiration = UINT64_MAX;
  48         memcpy(lease->chaddr, chaddr, 16);
  49         pool_offset = get_pool_offset(server, lease->address);
  50         server->bound_leases[pool_offset] = lease;
  51         assert_se(hashmap_put(server->leases_by_client_id, &lease->client_id, lease) >= 0);
  52
  53         (void) dhcp_server_handle_message(server, (DHCPMessage*)data, size);
  54
  55         return 0;
  56 }