/src/dns_message_fuzzer.cc
Line | Count | Source |
1 | | // Copyright 2026 Google LLC |
2 | | // |
3 | | // Licensed under the Apache License, Version 2.0 (the "License"); |
4 | | // you may not use this file except in compliance with the License. |
5 | | // You may obtain a copy of the License at |
6 | | // |
7 | | // http://www.apache.org/licenses/LICENSE-2.0 |
8 | | // |
9 | | // Unless required by applicable law or agreed to in writing, software |
10 | | // distributed under the License is distributed on an "AS IS" BASIS, |
11 | | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
12 | | // See the License for the specific language governing permissions and |
13 | | // limitations under the License. |
14 | | |
15 | | #include <cstddef> |
16 | | #include <cstdint> |
17 | | #include <cstring> |
18 | | #include <sys/socket.h> |
19 | | #include <netinet/in.h> |
20 | | #include <arpa/inet.h> |
21 | | #include <unistd.h> |
22 | | |
23 | | #include "event2/event.h" |
24 | | #include "event2/dns.h" |
25 | | |
26 | | // Callback for DNS server - just respond to every request and drop it |
27 | 0 | static void dns_server_cb(struct evdns_server_request *req, void *data) { |
28 | | // Respond with NOERROR to exercise the response path too |
29 | 0 | evdns_server_request_respond(req, 0); |
30 | 0 | } |
31 | | |
32 | | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
33 | | if (size < 12 || size > 1500) |
34 | | return 0; |
35 | | |
36 | | // Create a UDP socketpair |
37 | | int fds[2]; |
38 | | if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds) < 0) |
39 | | return 0; |
40 | | |
41 | | struct event_base *base = event_base_new(); |
42 | | if (!base) { |
43 | | close(fds[0]); |
44 | | close(fds[1]); |
45 | | return 0; |
46 | | } |
47 | | |
48 | | // Create DNS server port on fds[0] |
49 | | struct evdns_server_port *port = |
50 | | evdns_add_server_port_with_base(base, fds[0], 0, dns_server_cb, nullptr); |
51 | | if (!port) { |
52 | | event_base_free(base); |
53 | | close(fds[0]); |
54 | | close(fds[1]); |
55 | | return 0; |
56 | | } |
57 | | |
58 | | // Send the fuzz data as a DNS packet to the server via fds[1] |
59 | | send(fds[1], data, size, 0); |
60 | | |
61 | | // Run the event loop briefly to process the packet |
62 | | event_base_loop(base, EVLOOP_NONBLOCK); |
63 | | |
64 | | // Clean up |
65 | | evdns_close_server_port(port); |
66 | | event_base_free(base); |
67 | | close(fds[0]); |
68 | | close(fds[1]); |
69 | | |
70 | | return 0; |
71 | | } |