/src/openthread/tests/fuzz/ip6.cpp
Line | Count | Source |
1 | | /* |
2 | | * Copyright (c) 2025, The OpenThread Authors. |
3 | | * All rights reserved. |
4 | | * |
5 | | * Redistribution and use in source and binary forms, with or without |
6 | | * modification, are permitted provided that the following conditions are met: |
7 | | * 1. Redistributions of source code must retain the above copyright |
8 | | * notice, this list of conditions and the following disclaimer. |
9 | | * 2. Redistributions in binary form must reproduce the above copyright |
10 | | * notice, this list of conditions and the following disclaimer in the |
11 | | * documentation and/or other materials provided with the distribution. |
12 | | * 3. Neither the name of the copyright holder nor the |
13 | | * names of its contributors may be used to endorse or promote products |
14 | | * derived from this software without specific prior written permission. |
15 | | * |
16 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
17 | | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
18 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
19 | | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE |
20 | | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
21 | | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
22 | | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
23 | | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
24 | | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
25 | | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
26 | | * POSSIBILITY OF SUCH DAMAGE. |
27 | | */ |
28 | | |
29 | | #include <stdarg.h> |
30 | | #include <stdio.h> |
31 | | #include <stdlib.h> |
32 | | #include <string.h> |
33 | | |
34 | | #include "platform/nexus_core.hpp" |
35 | | #include "platform/nexus_node.hpp" |
36 | | |
37 | | namespace ot { |
38 | | namespace Nexus { |
39 | | |
40 | | class FuzzDataProvider |
41 | | { |
42 | | public: |
43 | | FuzzDataProvider(const uint8_t *aData, size_t aSize) |
44 | 22.0k | : mData(aData) |
45 | 22.0k | , mSize(aSize) |
46 | 22.0k | { |
47 | 22.0k | } |
48 | | |
49 | | void ConsumeData(void *aBuf, size_t aLength) |
50 | 51.6k | { |
51 | 51.6k | assert(aLength <= mSize); |
52 | 51.6k | memcpy(aBuf, mData, aLength); |
53 | 51.6k | mData += aLength; |
54 | 51.6k | mSize -= aLength; |
55 | 51.6k | } |
56 | | |
57 | | otError ConsumeRemainingBytes(otMessage *aMessage) |
58 | 2.71k | { |
59 | 2.71k | otError error; |
60 | | |
61 | 2.71k | SuccessOrExit(error = otMessageAppend(aMessage, mData, static_cast<uint16_t>(mSize))); |
62 | 2.71k | mSize = 0; |
63 | | |
64 | 2.71k | exit: |
65 | 2.71k | return error; |
66 | 2.71k | } |
67 | | |
68 | | bool ConsumeBool(void) |
69 | 4.45k | { |
70 | 4.45k | assert(mSize > 0); |
71 | | |
72 | 4.45k | uint8_t result; |
73 | | |
74 | 4.45k | ConsumeData(&result, sizeof(result)); |
75 | | |
76 | 4.45k | return result & 1; |
77 | 4.45k | } |
78 | | |
79 | | size_t RemainingBytes(void) { return mSize; } |
80 | | |
81 | | private: |
82 | | const uint8_t *mData; |
83 | | size_t mSize; |
84 | | }; |
85 | | |
86 | | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
87 | 3.02k | { |
88 | 3.02k | const uint16_t kMaxMessageSize = 2048; |
89 | | |
90 | 3.02k | FuzzDataProvider fdp(data, size); |
91 | | |
92 | 3.02k | unsigned int seed; |
93 | 3.02k | otMessage *message; |
94 | 3.02k | otMessageSettings settings; |
95 | | |
96 | 3.02k | if (size < sizeof(seed) + sizeof(settings.mLinkSecurityEnabled) + sizeof(settings.mPriority)) |
97 | 4 | { |
98 | 4 | return 0; |
99 | 4 | } |
100 | | |
101 | 3.01k | if (size > sizeof(seed) + sizeof(settings.mLinkSecurityEnabled) + sizeof(settings.mPriority) + kMaxMessageSize) |
102 | 14 | { |
103 | 14 | return 0; |
104 | 14 | } |
105 | | |
106 | 3.00k | fdp.ConsumeData(&seed, sizeof(seed)); |
107 | 3.00k | srand(seed); |
108 | | |
109 | 3.00k | Core nexus; |
110 | | |
111 | 3.00k | Node &node = nexus.CreateNode(); |
112 | | |
113 | 3.00k | node.GetInstance().SetLogLevel(kLogLevelInfo); |
114 | | |
115 | 3.00k | node.GetInstance().Get<BorderRouter::RoutingManager>().Init(/* aInfraIfIndex */ 1, /* aInfraIfIsRunning */ true); |
116 | 3.00k | node.GetInstance().Get<BorderRouter::RoutingManager>().SetEnabled(true); |
117 | 3.00k | node.GetInstance().Get<Srp::Server>().SetAutoEnableMode(true); |
118 | 3.00k | node.GetInstance().Get<BorderRouter::RoutingManager>().SetDhcp6PdEnabled(true); |
119 | 3.00k | node.GetInstance().Get<BorderRouter::RoutingManager>().SetNat64PrefixManagerEnabled(true); |
120 | 3.00k | node.GetInstance().Get<Nat64::Translator>().SetEnabled(true); |
121 | | |
122 | 3.00k | Log("---------------------------------------------------------------------------------------"); |
123 | 3.00k | Log("Form network"); |
124 | | |
125 | 3.00k | node.Form(); |
126 | 3.00k | nexus.AdvanceTime(60 * 1000); |
127 | 3.00k | VerifyOrQuit(node.Get<Mle::Mle>().IsLeader()); |
128 | 3.00k | VerifyOrQuit(node.Get<Srp::Server>().GetState() == Srp::Server::kStateRunning); |
129 | | |
130 | 3.00k | Log("---------------------------------------------------------------------------------------"); |
131 | 3.00k | Log("Fuzz"); |
132 | | |
133 | 3.00k | memset(&settings, 0, sizeof(settings)); |
134 | 3.00k | settings.mLinkSecurityEnabled = fdp.ConsumeBool(); |
135 | 3.00k | fdp.ConsumeData(&settings.mPriority, sizeof(settings.mPriority)); |
136 | | |
137 | 3.00k | message = otIp6NewMessage(&node.GetInstance(), &settings); |
138 | 3.00k | VerifyOrExit(message != nullptr); |
139 | | |
140 | 2.71k | SuccessOrQuit(fdp.ConsumeRemainingBytes(message)); |
141 | | |
142 | 2.71k | otIp6Send(&node.GetInstance(), message); |
143 | | |
144 | 2.71k | nexus.AdvanceTime(10 * 1000); |
145 | | |
146 | 3.00k | exit: |
147 | 3.00k | return 0; |
148 | 2.71k | } |
149 | | |
150 | | } // namespace Nexus |
151 | | } // namespace ot |