src/libsystemd-network/fuzz-dhcp6-client.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <unistd.h>
   4
   5 #include "sd-dhcp6-client.h"
   6 #include "sd-event.h"
   7
   8 #include "dhcp6-internal.h"
   9 #include "dhcp6-protocol.h"
  10 #include "fd-util.h"
  11 #include "fuzz.h"
  12
  13 static int test_dhcp_fd[2] = { -1, -1 };
  14
  15 int dhcp6_network_send_udp_socket(int s, struct in6_addr *server_address,
  16                                   const void *packet, size_t len) {
  17         return len;
  18 }
  19
  20 int dhcp6_network_bind_udp_socket(int index, struct in6_addr *local_address) {
  21         assert_se(socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 0, test_dhcp_fd) >= 0);
  22         return test_dhcp_fd[0];
  23 }
  24
  25 static void fuzz_client(const uint8_t *data, size_t size, bool is_information_request_enabled) {
  26         _cleanup_(sd_event_unrefp) sd_event *e = NULL;
  27         _cleanup_(sd_dhcp6_client_unrefp) sd_dhcp6_client *client = NULL;
  28         struct in6_addr address = { { { 0xfe, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01 } } };
  29
  30         assert_se(sd_event_new(&e) >= 0);
  31         assert_se(sd_dhcp6_client_new(&client) >= 0);
  32         assert_se(sd_dhcp6_client_attach_event(client, e, 0) >= 0);
  33         assert_se(sd_dhcp6_client_set_ifindex(client, 42) == 0);
  34         assert_se(sd_dhcp6_client_set_local_address(client, &address) >= 0);
  35         assert_se(sd_dhcp6_client_set_information_request(client, is_information_request_enabled) == 0);
  36         dhcp6_client_set_test_mode(client, true);
  37
  38         assert_se(sd_dhcp6_client_start(client) >= 0);
  39
  40         if (size >= sizeof(DHCP6Message))
  41                 assert_se(sd_dhcp6_client_set_transaction_id(client, htobe32(0x00ffffff) & ((const DHCP6Message *) data)->transaction_id) == 0);
  42
  43         assert_se(write(test_dhcp_fd[1], data, size) == (ssize_t) size);
  44
  45         sd_event_run(e, UINT64_MAX);
  46
  47         assert_se(sd_dhcp6_client_stop(client) >= 0);
  48
  49         test_dhcp_fd[1] = safe_close(test_dhcp_fd[1]);
  50 }
  51
  52 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  53         if (size > 65536)
  54                 return 0;
  55
  56         /* This triggers client_receive_advertise */
  57         fuzz_client(data, size, false);
  58
  59         /* This triggers client_receive_reply */
  60         fuzz_client(data, size, true);
  61
  62         return 0;
  63 }