]>
Commit | Line | Data |
---|---|---|
d89a400e EV |
1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
2 | ||
3 | #include <unistd.h> | |
4 | ||
5 | #include "sd-dhcp6-client.h" | |
6 | #include "sd-event.h" | |
7 | ||
8 | #include "dhcp6-internal.h" | |
9 | #include "dhcp6-protocol.h" | |
10 | #include "fd-util.h" | |
11 | #include "fuzz.h" | |
12 | ||
f2a500eb | 13 | static int test_dhcp_fd[2] = { -1, -1 }; |
d89a400e EV |
14 | |
15 | int dhcp6_network_send_udp_socket(int s, struct in6_addr *server_address, | |
16 | const void *packet, size_t len) { | |
17 | return len; | |
18 | } | |
19 | ||
20 | int dhcp6_network_bind_udp_socket(int index, struct in6_addr *local_address) { | |
804a6a17 | 21 | assert_se(socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 0, test_dhcp_fd) >= 0); |
d89a400e EV |
22 | return test_dhcp_fd[0]; |
23 | } | |
24 | ||
25 | static void fuzz_client(const uint8_t *data, size_t size, bool is_information_request_enabled) { | |
26 | _cleanup_(sd_event_unrefp) sd_event *e; | |
27 | _cleanup_(sd_dhcp6_client_unrefp) sd_dhcp6_client *client = NULL; | |
28 | struct in6_addr address = { { { 0xfe, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01 } } }; | |
29 | ||
30 | assert_se(sd_event_new(&e) >= 0); | |
31 | assert_se(sd_dhcp6_client_new(&client) >= 0); | |
32 | assert_se(sd_dhcp6_client_attach_event(client, e, 0) >= 0); | |
33 | assert_se(sd_dhcp6_client_set_ifindex(client, 42) == 0); | |
34 | assert_se(sd_dhcp6_client_set_local_address(client, &address) >= 0); | |
35 | assert_se(sd_dhcp6_client_set_information_request(client, is_information_request_enabled) == 0); | |
36 | ||
37 | assert_se(sd_dhcp6_client_start(client) >= 0); | |
38 | ||
39 | if (size >= sizeof(DHCP6Message)) | |
40 | assert_se(sd_dhcp6_client_set_transaction_id(client, htobe32(0x00ffffff) & ((const DHCP6Message *) data)->transaction_id) == 0); | |
41 | ||
42 | assert_se(write(test_dhcp_fd[1], data, size) == (ssize_t) size); | |
43 | ||
44 | sd_event_run(e, (uint64_t) -1); | |
45 | ||
46 | assert_se(sd_dhcp6_client_stop(client) >= 0); | |
47 | ||
48 | test_dhcp_fd[1] = safe_close(test_dhcp_fd[1]); | |
49 | } | |
50 | ||
51 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { | |
55ac7b63 YW |
52 | if (size > 65536) |
53 | return 0; | |
54 | ||
d89a400e EV |
55 | /* This triggers client_receive_advertise */ |
56 | fuzz_client(data, size, false); | |
57 | ||
58 | /* This triggers client_receive_reply */ | |
59 | fuzz_client(data, size, true); | |
60 | ||
61 | return 0; | |
62 | } |