Coverage Report

Created: 2025-12-31 07:33

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/kea-fuzzer/fuzz_dhcpsrv.cc
Line
Count
Source
1
// Copyright (C) 2025 Ada Logcis Ltd.
2
//
3
// This Source Code Form is subject to the terms of the Mozilla Public
4
// License, v. 2.0. If a copy of the MPL was not distributed with this
5
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
6
////////////////////////////////////////////////////////////////////////////////
7
#include "config.h"
8
#include <fuzzer/FuzzedDataProvider.h>
9
10
#include <string>
11
12
#include <cc/data.h>
13
#include <cc/simple_parser.h>
14
15
#include <dhcpsrv/srv_config.h>
16
#include <dhcpsrv/cfg_option_def.h>
17
#include <dhcpsrv/cfg_option.h>
18
#include <dhcpsrv/cfg_iface.h>
19
#include <dhcpsrv/cfg_duid.h>
20
#include <dhcpsrv/cfg_expiration.h>
21
#include <dhcpsrv/cfg_mac_source.h>
22
#include <dhcpsrv/client_class_def.h>
23
24
#include <dhcpsrv/parsers/dhcp_parsers.h>
25
#include <dhcpsrv/parsers/option_data_parser.h>
26
#include <dhcpsrv/parsers/ifaces_config_parser.h>
27
#include <dhcpsrv/parsers/duid_config_parser.h>
28
#include <dhcpsrv/parsers/multi_threading_config_parser.h>
29
#include <dhcpsrv/parsers/sanity_checks_parser.h>
30
#include <dhcpsrv/parsers/expiration_config_parser.h>
31
#include <dhcpsrv/parsers/client_class_def_parser.h>
32
#include <dhcpsrv/parsers/host_reservation_parser.h>
33
#include <dhcpsrv/parsers/simple_parser4.h>
34
#include <dhcpsrv/parsers/simple_parser6.h>
35
36
#include "helper_func.h"
37
38
using namespace isc;
39
using namespace isc::data;
40
using namespace isc::dhcp;
41
42
7.83k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
43
7.83k
    FuzzedDataProvider fdp(Data, Size);
44
7.83k
    std::string payload = fdp.ConsumeRandomLengthString();
45
46
7.83k
    std::string raw_payload(reinterpret_cast<const char*>(Data), Size);
47
7.83k
    ElementPtr payload_elem =  nullptr;
48
7.83k
    try {
49
7.83k
        payload_elem = Element::fromJSON(payload);
50
7.83k
    } catch (...) {
51
727
        return 0;
52
727
    }
53
54
55
7.11k
    try {
56
        // Simple Parsing
57
7.11k
        SimpleParser4::setAllDefaults(payload_elem);
58
7.11k
        SimpleParser4::deriveParameters(payload_elem);
59
7.11k
        SimpleParser6::setAllDefaults(payload_elem);
60
7.11k
        SimpleParser6::deriveParameters(payload_elem);
61
7.11k
    } catch (const isc::Exception&) {}
62
7.11k
    try {
63
        // Configuration Option definition parsing
64
        //ElementPtr elem = fuzz::parseJSON(payload);
65
7.11k
        CfgOptionDefPtr defs(new CfgOptionDef());
66
7.11k
        OptionDefListParser defp4(AF_INET);
67
7.11k
        defp4.parse(defs, payload_elem);
68
        //elem = fuzz::parseJSON(fdp.ConsumeRandomLengthString());
69
7.11k
        OptionDefListParser defp6(AF_INET6);
70
7.11k
        defp6.parse(defs, payload_elem);
71
7.11k
    } catch (const isc::Exception&) {}
72
7.11k
    try {
73
74
        // Configuration Option data parsing
75
        //ElementPtr elem = fuzz::parseJSON(payload);
76
7.11k
        CfgOptionPtr opts(new CfgOption());
77
7.11k
        CfgOptionDefPtr defs(new CfgOptionDef());
78
7.11k
        OptionDataListParser odlp4(AF_INET, defs);
79
7.11k
        odlp4.parse(opts, payload_elem, fdp.ConsumeBool());
80
        //elem = fuzz::parseJSON(fdp.ConsumeRandomLengthString());
81
7.11k
        OptionDataListParser odlp6(AF_INET6, defs);
82
7.11k
        odlp6.parse(opts, payload_elem, fdp.ConsumeBool());
83
7.11k
    } catch (const isc::Exception&) {}
84
7.11k
    try {
85
86
        // Interfaces configuration parsing
87
        //ElementPtr elem = fuzz::parseJSON(payload);
88
7.11k
        CfgIfacePtr ifcfg(new CfgIface());
89
7.11k
        IfacesConfigParser ifparser4(AF_INET, false);
90
7.11k
        ifparser4.parse(ifcfg, payload_elem);
91
7.11k
    } catch (const isc::Exception&) {}
92
7.11k
    try {
93
        //ElementPtr elem = fuzz::parseJSON(payload);
94
7.11k
        CfgIfacePtr ifcfg(new CfgIface());
95
7.11k
        IfacesConfigParser ifparser6(AF_INET6, false);
96
7.11k
        ifparser6.parse(ifcfg, payload_elem);
97
7.11k
    } catch (const isc::Exception&) {}
98
7.11k
    try {
99
100
        // DUID configuration parsing
101
7.11k
        ElementPtr elem = fuzz::parseJSON(payload);
102
7.11k
        CfgDUIDPtr duid(new CfgDUID());
103
7.11k
        DUIDConfigParser duidp;
104
7.11k
        duidp.parse(duid, elem);
105
7.11k
    } catch (const isc::Exception&) {}
106
7.11k
    try {
107
108
        // Configuration expiration parsing
109
        //ElementPtr elem = fuzz::parseJSON(payload);
110
7.11k
        CfgExpirationPtr exp(new CfgExpiration());
111
7.11k
        ExpirationConfigParser expp;
112
7.11k
        expp.parse(payload_elem, exp);
113
7.11k
    } catch (const isc::Exception&) {}
114
7.11k
    try {
115
116
        // MAC list parsing
117
7.11k
        CfgMACSource macs;
118
7.11k
        MACSourcesListConfigParser macp;
119
        //ElementPtr elem = fuzz::parseJSON(payload);
120
7.11k
        macp.parse(macs, payload_elem);
121
7.11k
    } catch (const isc::Exception&) {}
122
7.11k
    try {
123
124
        // Multi-Threading configuration parsing
125
7.11k
        SrvConfig srv;
126
        //ElementPtr elem = fuzz::parseJSON(payload);
127
7.11k
        MultiThreadingConfigParser mtcp;
128
7.11k
        mtcp.parse(srv, payload_elem);
129
7.11k
    } catch (const isc::Exception&) {}
130
131
7.11k
    try {
132
133
        // Sanity Check parsing
134
7.11k
        SrvConfig srv;
135
        //ElementPtr elem = fuzz::parseJSON(payload);
136
7.11k
        SanityChecksParser scp;
137
7.11k
        scp.parse(srv, payload_elem);
138
7.11k
    } catch (const isc::Exception&) {}
139
7.11k
    try {
140
141
        // Client Class definition parsing
142
        // ElementPtr elem = fuzz::parseJSON(payload);
143
7.11k
        ClientClassDictionaryPtr dict(new ClientClassDictionary());
144
7.11k
        ClientClassDefParser ccdp;
145
7.11k
        ccdp.parse(dict, payload_elem, AF_INET);
146
7.11k
        ccdp.parse(dict, payload_elem, AF_INET6);
147
7.11k
    } catch (const isc::Exception&) {
148
        // Slient exceptions
149
7.11k
    }
150
151
152
7.11k
    try {
153
        // SubnetConfigParser parsing
154
        //ElementPtr elem = fuzz::parseJSON(payload);
155
7.11k
        Subnet4ConfigParser scf(fdp.ConsumeBool());
156
7.11k
        scf.parse(payload_elem, fdp.ConsumeBool());
157
7.11k
    }
158
7.11k
    catch (const isc::Exception&) {
159
        // Slient exceptions
160
7.11k
    }
161
162
163
    // ControlSocketsParser
164
7.11k
    try {
165
7.11k
        ElementPtr elem = fuzz::parseJSON(payload);
166
7.11k
        SrvConfig srv;
167
7.11k
        ControlSocketsParser csp;
168
7.11k
        csp.parse(srv, elem);
169
7.11k
    } catch (const isc::Exception&) {
170
        // Slient exceptions
171
7.09k
    }
172
173
7.11k
    try {
174
        // Subnet6ConfigParser parsing
175
7.11k
        ElementPtr elem = fuzz::parseJSON(payload);
176
7.11k
        Subnet6ConfigParser scf(fdp.ConsumeBool());
177
7.11k
        scf.parse(elem, fdp.ConsumeBool());
178
7.11k
    } catch (const isc::Exception&) {
179
        // Slient exceptions
180
7.11k
    }
181
182
7.11k
    try {
183
        // D2ClientConfigParser parsing
184
7.11k
        ElementPtr elem = fuzz::parseJSON(payload);
185
7.11k
        D2ClientConfigParser d2p;
186
7.11k
        d2p.parse(elem);
187
7.11k
    } catch (const isc::Exception&) {
188
        // Slient exceptions
189
7.11k
    }
190
191
    // Host Reservation parsing
192
7.11k
    try {
193
        // Host Reservation parsing
194
7.11k
        ElementPtr elem = fuzz::parseJSON(payload);
195
7.11k
        HostReservationParser4 hrp;
196
7.11k
        hrp.parse(SubnetID(10), elem, fdp.ConsumeBool());
197
7.11k
    } catch (const isc::Exception&) {
198
        // Slient exceptions
199
6.99k
    }
200
201
7.11k
    try {
202
        // Host Reservation parsing
203
7.11k
        ElementPtr elem = fuzz::parseJSON(payload);
204
7.11k
        HostReservationParser6 hrp;
205
7.11k
        hrp.parse(SubnetID(10), elem, fdp.ConsumeBool());
206
7.11k
    } catch (const isc::Exception&) {
207
        // Slient exceptions
208
7.04k
    }    
209
 
210
7.11k
    return 0;
211
7.11k
}