Coverage Report

Created: 2023-05-30 07:03

/src/fuzz_proxy.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
#include "config.h"
14
#include <sys/time.h>
15
#include "syshead.h"
16
#include "interval.h"
17
#include "proxy.h"
18
#include <openssl/err.h>
19
#include <openssl/ssl.h>
20
21
#include "fuzz_randomizer.h"
22
23
int LLVMFuzzerInitialize(int *argc, char ***argv)
24
4
{
25
4
    OPENSSL_malloc_init();
26
4
    SSL_library_init();
27
4
    ERR_load_crypto_strings();
28
29
4
    OpenSSL_add_all_algorithms();
30
4
    OpenSSL_add_ssl_algorithms();
31
4
    OpenSSL_add_all_digests();
32
33
4
    SSL_load_error_strings();
34
4
    return 1;
35
4
}
36
37
38
127
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
39
40
127
  char *tmp = NULL;
41
127
  char *tmp2 = NULL;
42
43
127
  if (size < 500) {
44
17
    return 0;
45
17
  }
46
110
  fuzz_random_init(data, size);
47
48
110
  struct gc_arena gc = gc_new();
49
110
  struct http_proxy_info pi;
50
110
  ssize_t generic_ssizet;
51
110
  int signal_received = 0;
52
110
  struct buffer lookahead = alloc_buf(1024);
53
110
  struct event_timeout evt;
54
55
110
  memset(&evt, 0, sizeof(struct event_timeout));
56
110
  memset(&pi, 0, sizeof(struct http_proxy_info));
57
110
  memset(&pi, 0, sizeof(pi));
58
59
110
  generic_ssizet = 0;
60
110
  char *fuzz_usrnm = fuzz_random_get_string_max_length(USER_PASS_LEN);
61
110
  strcpy(pi.up.username, fuzz_usrnm);
62
110
  if (strlen(pi.up.username) == 0) {
63
40
    gc_free(&gc);
64
40
    free_buf(&lookahead);
65
40
    free(fuzz_usrnm);
66
40
    fuzz_random_destroy();
67
40
    return 0;
68
40
  }
69
70
70
  char *pswd = fuzz_random_get_string_max_length(USER_PASS_LEN);
71
70
  strcpy(pi.up.password, pswd);
72
70
  if (strlen(pi.up.password) == 0) {
73
12
    gc_free(&gc);
74
12
    free_buf(&lookahead);
75
76
12
    free(pswd);
77
12
    free(fuzz_usrnm);
78
12
    fuzz_random_destroy();
79
12
    return 0;
80
12
  }
81
82
58
  generic_ssizet = fuzz_randomizer_get_int(0, 4);
83
58
  switch (generic_ssizet) {
84
40
  case 0:
85
40
    pi.auth_method = HTTP_AUTH_NONE;
86
40
    break;
87
0
  case 1:
88
0
     pi.auth_method = HTTP_AUTH_BASIC;
89
0
    break;
90
0
  case 2:
91
0
    pi.auth_method = HTTP_AUTH_DIGEST;
92
0
    break;
93
0
  case 3:
94
0
    pi.auth_method = HTTP_AUTH_NTLM;
95
0
    break;
96
18
  case 4:
97
18
    pi.auth_method = HTTP_AUTH_NTLM2;
98
18
    break;
99
58
  }
100
58
  pi.options.http_version = "1.1";
101
102
58
  generic_ssizet = fuzz_randomizer_get_int(0, 4);
103
58
  switch (generic_ssizet) {
104
5
  case 0:
105
5
    pi.options.auth_retry = PAR_NO;
106
5
    break;
107
9
  case 1:
108
9
    pi.options.auth_retry = PAR_ALL;
109
9
    break;
110
8
  case 2:
111
8
    pi.options.auth_retry = PAR_NCT;
112
8
    break;
113
58
  }
114
115
58
  char *tmp_authenticate = get_random_string();
116
58
  pi.proxy_authenticate = tmp_authenticate;
117
118
  //if (provider.ConsumeProbability<double>() < 0.5) {
119
    //tmp = get_modifiable_string(provider);
120
58
    tmp = get_random_string();
121
58
    pi.options.custom_headers[0].name = tmp;
122
    //if (provider.ConsumeProbability<double>() < 0.5) {
123
      //tmp2 = get_modifiable_string(provider);
124
58
      tmp2 = get_random_string();
125
58
      pi.options.custom_headers[0].content = tmp2;
126
    //}
127
  //}
128
129
58
  establish_http_proxy_passthru(&pi, 0, "1.2.3.4", "777", &evt, &lookahead,
130
58
                                &signal_received);
131
58
  free(pi.proxy_authenticate);
132
58
  gc_free(&gc);
133
58
  free_buf(&lookahead);
134
135
58
  if (tmp != NULL)  free(tmp);
136
58
  if (tmp2 != NULL) free(tmp2);
137
138
58
    free(pswd);
139
58
    free(fuzz_usrnm);
140
58
  fuzz_random_destroy();
141
142
143
58
  return 0;
144
58
}