From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Tue, 16 Apr 2024 06:17:50 +0000 (+0900)
Subject: fuzz-ndisc-rs: also test packets with sd-radv
X-Git-Tag: v256-rc1~163
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=54a4ffc077066dea5ba5a8a33adf388abdc63ec3;p=thirdparty%2Fsystemd.git

fuzz-ndisc-rs: also test packets with sd-radv

Addresses https://github.com/systemd/systemd/pull/32267#discussion_r1566715787.

Suggested-by: Evgeny Vereshchagin <evvers@ya.ru>
---

diff --git a/src/libsystemd-network/fuzz-ndisc-rs.c b/src/libsystemd-network/fuzz-ndisc-rs.c
index 54737e4a060..780a5d7f5a9 100644
--- a/src/libsystemd-network/fuzz-ndisc-rs.c
+++ b/src/libsystemd-network/fuzz-ndisc-rs.c
@@ -5,6 +5,7 @@
 #include <unistd.h>
 
 #include "sd-ndisc.h"
+#include "sd-radv.h"
 
 #include "alloc-util.h"
 #include "fd-util.h"
@@ -31,7 +32,30 @@ static void test_with_sd_ndisc(const uint8_t *data, size_t size) {
         assert_se(write(test_fd[1], data, size) == (ssize_t) size);
         (void) sd_event_run(e, UINT64_MAX);
         assert_se(sd_ndisc_stop(nd) >= 0);
-        close(test_fd[1]);
+        test_fd[1] = safe_close(test_fd[1]);
+        TAKE_FD(test_fd[0]); /* It should be already closed by sd_ndisc_stop(). */
+}
+
+static void test_with_sd_radv(const uint8_t *data, size_t size) {
+        struct ether_addr mac_addr = {
+                .ether_addr_octet = {'A', 'B', 'C', '1', '2', '3'}
+        };
+        _cleanup_(sd_event_unrefp) sd_event *e = NULL;
+        _cleanup_(sd_radv_unrefp) sd_radv *ra = NULL;
+
+        assert_se(socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC | SOCK_NONBLOCK, 0, test_fd) >= 0);
+
+        assert_se(sd_event_new(&e) >= 0);
+        assert_se(sd_radv_new(&ra) >= 0);
+        assert_se(sd_radv_attach_event(ra, e, 0) >= 0);
+        assert_se(sd_radv_set_ifindex(ra, 42) >= 0);
+        assert_se(sd_radv_set_mac(ra, &mac_addr) >= 0);
+        assert_se(sd_radv_start(ra) >= 0);
+        assert_se(write(test_fd[0], data, size) == (ssize_t) size);
+        (void) sd_event_run(e, UINT64_MAX);
+        assert_se(sd_radv_stop(ra) >= 0);
+        test_fd[0] = safe_close(test_fd[0]);
+        TAKE_FD(test_fd[1]); /* It should be already closed by sd_radv_stop(). */
 }
 
 static void test_with_icmp6_packet(const uint8_t *data, size_t size) {
@@ -68,6 +92,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         fuzz_setup_logging();
 
         test_with_sd_ndisc(data, size);
+        test_with_sd_radv(data, size);
         test_with_icmp6_packet(data, size);
         return 0;
 }