/src/openthread/tests/fuzz/icmp6.cpp
Line | Count | Source |
1 | | /* |
2 | | * Copyright (c) 2025, The OpenThread Authors. |
3 | | * All rights reserved. |
4 | | * |
5 | | * Redistribution and use in source and binary forms, with or without |
6 | | * modification, are permitted provided that the following conditions are met: |
7 | | * 1. Redistributions of source code must retain the above copyright |
8 | | * notice, this list of conditions and the following disclaimer. |
9 | | * 2. Redistributions in binary form must reproduce the above copyright |
10 | | * notice, this list of conditions and the following disclaimer in the |
11 | | * documentation and/or other materials provided with the distribution. |
12 | | * 3. Neither the name of the copyright holder nor the |
13 | | * names of its contributors may be used to endorse or promote products |
14 | | * derived from this software without specific prior written permission. |
15 | | * |
16 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
17 | | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
18 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
19 | | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE |
20 | | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
21 | | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
22 | | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
23 | | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
24 | | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
25 | | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
26 | | * POSSIBILITY OF SUCH DAMAGE. |
27 | | */ |
28 | | |
29 | | #include <stdarg.h> |
30 | | #include <stdio.h> |
31 | | #include <stdlib.h> |
32 | | #include <string.h> |
33 | | |
34 | | #include "platform/nexus_core.hpp" |
35 | | #include "platform/nexus_node.hpp" |
36 | | |
37 | | namespace ot { |
38 | | namespace Nexus { |
39 | | |
40 | | class FuzzDataProvider |
41 | | { |
42 | | public: |
43 | | FuzzDataProvider(const uint8_t *aData, size_t aSize) |
44 | 24.7k | : mData(aData) |
45 | 24.7k | , mSize(aSize) |
46 | 24.7k | { |
47 | 24.7k | } |
48 | | |
49 | | void ConsumeData(void *aBuf, size_t aLength) |
50 | 56.0k | { |
51 | 56.0k | assert(aLength <= mSize); |
52 | 56.0k | memcpy(aBuf, mData, aLength); |
53 | 56.0k | mData += aLength; |
54 | 56.0k | mSize -= aLength; |
55 | 56.0k | } |
56 | | |
57 | | uint8_t *ConsumeRemainingBytes(void) |
58 | 19.4k | { |
59 | 19.4k | uint8_t *buf = static_cast<uint8_t *>(malloc(mSize)); |
60 | 19.4k | memcpy(buf, mData, mSize); |
61 | 19.4k | mSize = 0; |
62 | 19.4k | return buf; |
63 | 19.4k | } |
64 | | |
65 | 13.9k | size_t RemainingBytes(void) { return mSize; } |
66 | | |
67 | | private: |
68 | | const uint8_t *mData; |
69 | | size_t mSize; |
70 | | }; |
71 | | |
72 | | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
73 | 1.77k | { |
74 | 1.77k | const uint16_t kMaxMessageSize = 2048; |
75 | | |
76 | 1.77k | FuzzDataProvider fdp(data, size); |
77 | | |
78 | 1.77k | unsigned int seed; |
79 | 1.77k | uint32_t ifIndex; |
80 | 1.77k | otIp6Address srcAddress; |
81 | 1.77k | uint8_t *buffer; |
82 | 1.77k | uint16_t bufferLength; |
83 | | |
84 | 1.77k | if (size < sizeof(seed) + sizeof(ifIndex) + sizeof(srcAddress)) |
85 | 8 | { |
86 | 8 | return 0; |
87 | 8 | } |
88 | | |
89 | 1.76k | if (size > sizeof(seed) + sizeof(ifIndex) + sizeof(srcAddress) + kMaxMessageSize) |
90 | 14 | { |
91 | 14 | return 0; |
92 | 14 | } |
93 | | |
94 | 1.75k | fdp.ConsumeData(&seed, sizeof(seed)); |
95 | 1.75k | srand(seed); |
96 | | |
97 | 1.75k | Core nexus; |
98 | | |
99 | 1.75k | Node &node = nexus.CreateNode(); |
100 | | |
101 | 1.75k | node.GetInstance().SetLogLevel(kLogLevelInfo); |
102 | | |
103 | 1.75k | node.GetInstance().Get<BorderRouter::InfraIf>().Init(/* aInfraIfIndex */ 1, /* aInfraIfIsRunning */ true); |
104 | 1.75k | node.GetInstance().Get<BorderRouter::RoutingManager>().SetEnabled(true); |
105 | 1.75k | node.GetInstance().Get<Srp::Server>().SetAutoEnableMode(true); |
106 | 1.75k | node.GetInstance().Get<BorderRouter::RoutingManager>().SetDhcp6PdEnabled(true); |
107 | 1.75k | node.GetInstance().Get<BorderRouter::RoutingManager>().SetNat64PrefixManagerEnabled(true); |
108 | 1.75k | node.GetInstance().Get<Nat64::Translator>().SetEnabled(true); |
109 | | |
110 | 1.75k | Log("---------------------------------------------------------------------------------------"); |
111 | 1.75k | Log("Form network"); |
112 | | |
113 | 1.75k | node.Form(); |
114 | 1.75k | nexus.AdvanceTime(60 * 1000); |
115 | 1.75k | VerifyOrQuit(node.Get<Mle::Mle>().IsLeader()); |
116 | 1.75k | VerifyOrQuit(node.Get<Srp::Server>().GetState() == Srp::Server::kStateRunning); |
117 | | |
118 | 1.75k | Log("---------------------------------------------------------------------------------------"); |
119 | 1.75k | Log("Fuzz"); |
120 | | |
121 | 1.75k | fdp.ConsumeData(&ifIndex, sizeof(ifIndex)); |
122 | 1.75k | fdp.ConsumeData(&srcAddress, sizeof(srcAddress)); |
123 | 1.75k | bufferLength = fdp.RemainingBytes(); |
124 | 1.75k | buffer = fdp.ConsumeRemainingBytes(); |
125 | | |
126 | 1.75k | otPlatInfraIfRecvIcmp6Nd(&node.GetInstance(), ifIndex, &srcAddress, buffer, bufferLength); |
127 | | |
128 | 1.75k | nexus.AdvanceTime(10 * 1000); |
129 | | |
130 | 1.75k | if (buffer) |
131 | 1.75k | { |
132 | 1.75k | free(buffer); |
133 | 1.75k | } |
134 | | |
135 | 1.75k | return 0; |
136 | 1.75k | } |
137 | | |
138 | | } // namespace Nexus |
139 | | } // namespace ot |