Coverage Report

Created: 2025-07-23 06:54

/src/fuzz_proxy.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
#include "config.h"
14
#include <sys/time.h>
15
#include "syshead.h"
16
#include "interval.h"
17
#include "proxy.h"
18
#include <openssl/err.h>
19
#include <openssl/ssl.h>
20
#include "sig.h"
21
22
#include "fuzz_randomizer.h"
23
24
int LLVMFuzzerInitialize(int *argc, char ***argv)
25
4
{
26
4
    OPENSSL_malloc_init();
27
4
    SSL_library_init();
28
4
    ERR_load_crypto_strings();
29
30
4
    OpenSSL_add_all_algorithms();
31
4
    OpenSSL_add_ssl_algorithms();
32
4
    OpenSSL_add_all_digests();
33
34
4
    SSL_load_error_strings();
35
4
    return 1;
36
4
}
37
38
39
453
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
40
41
453
  char *tmp = NULL;
42
453
  char *tmp2 = NULL;
43
44
453
  if (size < 500) {
45
17
    return 0;
46
17
  }
47
436
  fuzz_random_init(data, size);
48
49
436
  struct gc_arena gc = gc_new();
50
436
  struct http_proxy_info pi;
51
436
  ssize_t generic_ssizet;
52
436
  struct signal_info signal_received = {0};
53
  // TODO: This coul be randomized
54
436
  register_signal(&signal_received, SIGUSR1, "remote-exit");
55
436
  struct buffer lookahead = alloc_buf(1024);
56
436
  struct event_timeout evt;
57
58
436
  memset(&evt, 0, sizeof(struct event_timeout));
59
436
  memset(&pi, 0, sizeof(struct http_proxy_info));
60
436
  memset(&pi, 0, sizeof(pi));
61
62
436
  generic_ssizet = 0;
63
436
  char *fuzz_usrnm = fuzz_random_get_string_max_length(USER_PASS_LEN);
64
436
  strcpy(pi.up.username, fuzz_usrnm);
65
436
  if (strlen(pi.up.username) == 0) {
66
4
    gc_free(&gc);
67
4
    free_buf(&lookahead);
68
4
    free(fuzz_usrnm);
69
4
    fuzz_random_destroy();
70
4
    return 0;
71
4
  }
72
73
432
  char *pswd = fuzz_random_get_string_max_length(USER_PASS_LEN);
74
432
  strcpy(pi.up.password, pswd);
75
432
  if (strlen(pi.up.password) == 0) {
76
4
    gc_free(&gc);
77
4
    free_buf(&lookahead);
78
79
4
    free(pswd);
80
4
    free(fuzz_usrnm);
81
4
    fuzz_random_destroy();
82
4
    return 0;
83
4
  }
84
85
428
  generic_ssizet = fuzz_randomizer_get_int(0, 3);
86
428
  switch (generic_ssizet) {
87
149
  case 0:
88
149
    pi.auth_method = HTTP_AUTH_NONE;
89
149
    break;
90
25
  case 1:
91
25
     pi.auth_method = HTTP_AUTH_BASIC;
92
25
    break;
93
233
  case 2:
94
233
    pi.auth_method = HTTP_AUTH_DIGEST;
95
233
    break;
96
21
  case 3:
97
21
    pi.auth_method = HTTP_AUTH_NTLM2;
98
21
    break;
99
428
  }
100
428
  pi.options.http_version = "1.1";
101
102
428
  generic_ssizet = fuzz_randomizer_get_int(0, 2);
103
428
  switch (generic_ssizet) {
104
114
  case 0:
105
114
    pi.options.auth_retry = PAR_NO;
106
114
    break;
107
207
  case 1:
108
207
    pi.options.auth_retry = PAR_ALL;
109
207
    break;
110
107
  case 2:
111
107
    pi.options.auth_retry = PAR_NCT;
112
107
    break;
113
428
  }
114
115
428
  char *tmp_authenticate = get_random_string();
116
428
  pi.proxy_authenticate = tmp_authenticate;
117
118
  //if (provider.ConsumeProbability<double>() < 0.5) {
119
    //tmp = get_modifiable_string(provider);
120
428
    tmp = get_random_string();
121
428
    pi.options.custom_headers[0].name = tmp;
122
    //if (provider.ConsumeProbability<double>() < 0.5) {
123
      //tmp2 = get_modifiable_string(provider);
124
428
      tmp2 = get_random_string();
125
428
      pi.options.custom_headers[0].content = tmp2;
126
    //}
127
  //}
128
129
428
  establish_http_proxy_passthru(&pi, 0, "1.2.3.4", "777", &evt, &lookahead,
130
428
                                &signal_received);
131
428
  free(pi.proxy_authenticate);
132
428
  gc_free(&gc);
133
428
  free_buf(&lookahead);
134
135
428
  if (tmp != NULL)  free(tmp);
136
428
  if (tmp2 != NULL) free(tmp2);
137
138
428
    free(pswd);
139
428
    free(fuzz_usrnm);
140
428
  fuzz_random_destroy();
141
142
143
428
  return 0;
144
428
}