Coverage Report

Created: 2025-12-08 07:54

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/kea-fuzzer/fuzz_dhcpsrv.cc
Line
Count
Source
1
// Copyright (C) 2025 Ada Logcis Ltd.
2
//
3
// This Source Code Form is subject to the terms of the Mozilla Public
4
// License, v. 2.0. If a copy of the MPL was not distributed with this
5
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
6
////////////////////////////////////////////////////////////////////////////////
7
#include "config.h"
8
#include <fuzzer/FuzzedDataProvider.h>
9
10
#include <string>
11
12
#include <cc/data.h>
13
#include <cc/simple_parser.h>
14
15
#include <dhcpsrv/srv_config.h>
16
#include <dhcpsrv/cfg_option_def.h>
17
#include <dhcpsrv/cfg_option.h>
18
#include <dhcpsrv/cfg_iface.h>
19
#include <dhcpsrv/cfg_duid.h>
20
#include <dhcpsrv/cfg_expiration.h>
21
#include <dhcpsrv/cfg_mac_source.h>
22
#include <dhcpsrv/client_class_def.h>
23
24
#include <dhcpsrv/parsers/dhcp_parsers.h>
25
#include <dhcpsrv/parsers/option_data_parser.h>
26
#include <dhcpsrv/parsers/ifaces_config_parser.h>
27
#include <dhcpsrv/parsers/duid_config_parser.h>
28
#include <dhcpsrv/parsers/multi_threading_config_parser.h>
29
#include <dhcpsrv/parsers/sanity_checks_parser.h>
30
#include <dhcpsrv/parsers/expiration_config_parser.h>
31
#include <dhcpsrv/parsers/client_class_def_parser.h>
32
#include <dhcpsrv/parsers/host_reservation_parser.h>
33
#include <dhcpsrv/parsers/simple_parser4.h>
34
#include <dhcpsrv/parsers/simple_parser6.h>
35
36
#include "helper_func.h"
37
38
using namespace isc;
39
using namespace isc::data;
40
using namespace isc::dhcp;
41
42
6.47k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
43
6.47k
    FuzzedDataProvider fdp(Data, Size);
44
6.47k
    std::string payload = fdp.ConsumeRandomLengthString();
45
46
6.47k
    std::string raw_payload(reinterpret_cast<const char*>(Data), Size);
47
6.47k
    ElementPtr payload_elem =  nullptr;
48
6.47k
    try {
49
6.47k
        payload_elem = Element::fromJSON(payload);
50
6.47k
    } catch (...) {
51
736
        return 0;
52
736
    }
53
54
55
5.74k
    try {
56
        // Simple Parsing
57
5.74k
        SimpleParser4::setAllDefaults(payload_elem);
58
5.74k
        SimpleParser4::deriveParameters(payload_elem);
59
5.74k
        SimpleParser6::setAllDefaults(payload_elem);
60
5.74k
        SimpleParser6::deriveParameters(payload_elem);
61
5.74k
    } catch (const isc::Exception&) {}
62
5.74k
    try {
63
        // Configuration Option definition parsing
64
        //ElementPtr elem = fuzz::parseJSON(payload);
65
5.74k
        CfgOptionDefPtr defs(new CfgOptionDef());
66
5.74k
        OptionDefListParser defp4(AF_INET);
67
5.74k
        defp4.parse(defs, payload_elem);
68
        //elem = fuzz::parseJSON(fdp.ConsumeRandomLengthString());
69
5.74k
        OptionDefListParser defp6(AF_INET6);
70
5.74k
        defp6.parse(defs, payload_elem);
71
5.74k
    } catch (const isc::Exception&) {}
72
5.74k
    try {
73
74
        // Configuration Option data parsing
75
        //ElementPtr elem = fuzz::parseJSON(payload);
76
5.74k
        CfgOptionPtr opts(new CfgOption());
77
5.74k
        CfgOptionDefPtr defs(new CfgOptionDef());
78
5.74k
        OptionDataListParser odlp4(AF_INET, defs);
79
5.74k
        odlp4.parse(opts, payload_elem, fdp.ConsumeBool());
80
        //elem = fuzz::parseJSON(fdp.ConsumeRandomLengthString());
81
5.74k
        OptionDataListParser odlp6(AF_INET6, defs);
82
5.74k
        odlp6.parse(opts, payload_elem, fdp.ConsumeBool());
83
5.74k
    } catch (const isc::Exception&) {}
84
5.74k
    try {
85
86
        // Interfaces configuration parsing
87
        //ElementPtr elem = fuzz::parseJSON(payload);
88
5.74k
        CfgIfacePtr ifcfg(new CfgIface());
89
5.74k
        IfacesConfigParser ifparser4(AF_INET, false);
90
5.74k
        ifparser4.parse(ifcfg, payload_elem);
91
5.74k
    } catch (const isc::Exception&) {}
92
5.74k
    try {
93
        //ElementPtr elem = fuzz::parseJSON(payload);
94
5.74k
        CfgIfacePtr ifcfg(new CfgIface());
95
5.74k
        IfacesConfigParser ifparser6(AF_INET6, false);
96
5.74k
        ifparser6.parse(ifcfg, payload_elem);
97
5.74k
    } catch (const isc::Exception&) {}
98
5.74k
    try {
99
100
        // DUID configuration parsing
101
5.74k
        ElementPtr elem = fuzz::parseJSON(payload);
102
5.74k
        CfgDUIDPtr duid(new CfgDUID());
103
5.74k
        DUIDConfigParser duidp;
104
5.74k
        duidp.parse(duid, elem);
105
5.74k
    } catch (const isc::Exception&) {}
106
5.74k
    try {
107
108
        // Configuration expiration parsing
109
        //ElementPtr elem = fuzz::parseJSON(payload);
110
5.74k
        CfgExpirationPtr exp(new CfgExpiration());
111
5.74k
        ExpirationConfigParser expp;
112
5.74k
        expp.parse(payload_elem, exp);
113
5.74k
    } catch (const isc::Exception&) {}
114
5.74k
    try {
115
116
        // MAC list parsing
117
5.74k
        CfgMACSource macs;
118
5.74k
        MACSourcesListConfigParser macp;
119
        //ElementPtr elem = fuzz::parseJSON(payload);
120
5.74k
        macp.parse(macs, payload_elem);
121
5.74k
    } catch (const isc::Exception&) {}
122
5.74k
    try {
123
124
        // Multi-Threading configuration parsing
125
5.74k
        SrvConfig srv;
126
        //ElementPtr elem = fuzz::parseJSON(payload);
127
5.74k
        MultiThreadingConfigParser mtcp;
128
5.74k
        mtcp.parse(srv, payload_elem);
129
5.74k
    } catch (const isc::Exception&) {}
130
131
5.74k
    try {
132
133
        // Sanity Check parsing
134
5.74k
        SrvConfig srv;
135
        //ElementPtr elem = fuzz::parseJSON(payload);
136
5.74k
        SanityChecksParser scp;
137
5.74k
        scp.parse(srv, payload_elem);
138
5.74k
    } catch (const isc::Exception&) {}
139
5.74k
    try {
140
141
        // Client Class definition parsing
142
        // ElementPtr elem = fuzz::parseJSON(payload);
143
5.74k
        ClientClassDictionaryPtr dict(new ClientClassDictionary());
144
5.74k
        ClientClassDefParser ccdp;
145
5.74k
        ccdp.parse(dict, payload_elem, AF_INET);
146
5.74k
        ccdp.parse(dict, payload_elem, AF_INET6);
147
5.74k
    } catch (const isc::Exception&) {
148
        // Slient exceptions
149
5.74k
    }
150
151
152
5.74k
    try {
153
        // SubnetConfigParser parsing
154
        //ElementPtr elem = fuzz::parseJSON(payload);
155
5.74k
        Subnet4ConfigParser scf(fdp.ConsumeBool());
156
5.74k
        scf.parse(payload_elem, fdp.ConsumeBool());
157
5.74k
    }
158
5.74k
    catch (const isc::Exception&) {
159
        // Slient exceptions
160
5.74k
    }
161
162
163
    // ControlSocketsParser
164
5.74k
    try {
165
5.74k
        ElementPtr elem = fuzz::parseJSON(payload);
166
5.74k
        SrvConfig srv;
167
5.74k
        ControlSocketsParser csp;
168
5.74k
        csp.parse(srv, elem);
169
5.74k
    } catch (const isc::Exception&) {
170
        // Slient exceptions
171
5.72k
    }
172
173
5.74k
    try {
174
        // Subnet6ConfigParser parsing
175
5.74k
        ElementPtr elem = fuzz::parseJSON(payload);
176
5.74k
        Subnet6ConfigParser scf(fdp.ConsumeBool());
177
5.74k
        scf.parse(elem, fdp.ConsumeBool());
178
5.74k
    } catch (const isc::Exception&) {
179
        // Slient exceptions
180
5.74k
    }
181
182
5.74k
    try {
183
        // D2ClientConfigParser parsing
184
5.74k
        ElementPtr elem = fuzz::parseJSON(payload);
185
5.74k
        D2ClientConfigParser d2p;
186
5.74k
        d2p.parse(elem);
187
5.74k
    } catch (const isc::Exception&) {
188
        // Slient exceptions
189
5.74k
    }
190
191
    // Host Reservation parsing
192
5.74k
    try {
193
        // Host Reservation parsing
194
5.74k
        ElementPtr elem = fuzz::parseJSON(payload);
195
5.74k
        HostReservationParser4 hrp;
196
5.74k
        hrp.parse(SubnetID(10), elem, fdp.ConsumeBool());
197
5.74k
    } catch (const isc::Exception&) {
198
        // Slient exceptions
199
5.65k
    }
200
201
5.74k
    try {
202
        // Host Reservation parsing
203
5.74k
        ElementPtr elem = fuzz::parseJSON(payload);
204
5.74k
        HostReservationParser6 hrp;
205
5.74k
        hrp.parse(SubnetID(10), elem, fdp.ConsumeBool());
206
5.74k
    } catch (const isc::Exception&) {
207
        // Slient exceptions
208
5.68k
    }    
209
 
210
5.74k
    return 0;
211
5.74k
}