Coverage Report

Created: 2025-07-23 06:54

/src/fuzz_route.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
#include "config.h"
14
#include "syshead.h"
15
#include "init.h"
16
#include "proxy.h"
17
#include "interval.h"
18
#include "route.h"
19
#include "buffer.h"
20
21
#include "fuzz_randomizer.h"
22
23
2.52k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
24
25
2.52k
  fuzz_random_init(data, size);
26
27
2.52k
  gb_init();
28
29
2.52k
  struct route_option_list *opt;
30
2.52k
  struct route_list rl;
31
32
2.52k
  int route_list_inited = 0;
33
2.52k
  int route_list_ipv6_inited = 0;
34
35
2.52k
  struct context c;
36
2.52k
  memset(&c, 0, sizeof(struct context));
37
2.52k
  gc_init(&c.gc);
38
2.52k
  c.es = env_set_create(&c.gc);
39
2.52k
  init_options(&c.options, true);
40
2.52k
  net_ctx_init(&c, &c.net_ctx);
41
2.52k
  init_verb_mute(&c, IVM_LEVEL_1);
42
43
2.52k
  init_options_dev(&c.options);
44
45
  // options_postprocess(&c.options);
46
2.52k
  pre_setup(&c.options);
47
48
2.52k
  setenv_settings(c.es, &c.options);
49
50
2.52k
  ALLOC_OBJ_CLEAR_GC(c.options.ce.local_list, struct local_list, &c.options.gc);
51
2.52k
  ALLOC_OBJ_CLEAR_GC(c.options.connection_list, struct connection_list,
52
2.52k
                     &c.options.gc);
53
2.52k
  context_init_1(&c);
54
55
2.52k
  in_addr_t remote_host;
56
2.52k
  ssize_t default_metric;
57
58
2.52k
  struct route_ipv6_list rl6;
59
2.52k
  struct route_ipv6_option_list *opt6;
60
61
2.52k
  memset(&rl, 0, sizeof(rl));
62
2.52k
  memset(&rl6, 0, sizeof(rl6));
63
2.52k
  memset(&opt, 0, sizeof(opt));
64
2.52k
  memset(&opt6, 0, sizeof(opt6));
65
66
2.52k
  opt6 = new_route_ipv6_option_list(&c.gc);
67
2.52k
  opt = new_route_option_list(&c.gc);
68
69
2.52k
  int total_to_fuzz = fuzz_randomizer_get_int(1, 20);
70
37.6k
  for (int i = 0; i < total_to_fuzz; i++) {
71
35.1k
    int selector = fuzz_randomizer_get_int(0, 13);
72
35.1k
    switch (selector) {
73
26.7k
    case 0:
74
26.7k
      if (route_list_inited == 0) {
75
2.98k
        const char *remote_endpoint = gb_get_random_string();
76
2.98k
        memset(&rl, 0, sizeof(struct route_list));
77
2.98k
        rl.flags = fuzz_randomizer_get_int(0, 0xffffff);
78
79
2.98k
        init_route_list(&rl, opt, remote_endpoint, default_metric, remote_host,
80
2.98k
                        c.es, &c);
81
2.98k
        route_list_inited = 1;
82
2.98k
      }
83
26.7k
      break;
84
353
    case 1:
85
353
      if (route_list_inited) {
86
253
        in_addr_t addr;
87
253
        route_list_add_vpn_gateway(&rl, c.es, addr);
88
253
      }
89
353
      break;
90
361
    case 2:
91
361
      if (route_list_inited && route_list_ipv6_inited) {
92
232
        struct tuntap tt;
93
232
        memset(&tt, 0, sizeof(tt));
94
232
        add_routes(&rl, &rl6, &tt, 0, c.es, &c);
95
232
      }
96
361
      break;
97
854
    case 3:
98
854
      if (route_list_inited) {
99
736
        setenv_routes(c.es, &rl);
100
736
      }
101
854
      break;
102
178
    case 4:
103
178
      if (route_list_inited) {
104
120
        struct route_ipv4 r;
105
120
        struct route_option ro;
106
120
        ro.network = gb_get_random_string();
107
120
        ro.netmask = gb_get_random_string();
108
120
        ro.gateway = gb_get_random_string();
109
120
        ro.metric = gb_get_random_string();
110
120
        ro.next = NULL;
111
112
120
        memset(&r, 0, sizeof(struct route_ipv4));
113
120
        r.option = &ro;
114
120
        r.flags = RT_DEFINED;
115
120
        add_route(&r, NULL, 0, NULL, c.es, &c);
116
120
      }
117
178
      break;
118
526
    case 5:
119
526
      if (route_list_inited) {
120
448
        char *s1 = get_random_string();
121
448
        is_special_addr(s1);
122
448
        free(s1);
123
448
      }
124
526
      break;
125
1.47k
    case 6:
126
1.47k
      if (route_list_ipv6_inited == 0) {
127
1.32k
        const char *remote_endpoint = gb_get_random_string();
128
1.32k
        memset(&rl, 0, sizeof(struct route_list));
129
1.32k
        struct in6_addr remote_host;
130
131
1.32k
        rl6.rgi6.flags = fuzz_randomizer_get_int(0, 0xffffff);
132
1.32k
        fuzz_get_random_data(&rl6.rgi6.hwaddr, 6);
133
134
1.32k
        char *t1 = gb_get_random_string();
135
1.32k
        if (strlen(t1) > 16) {
136
69
          memcpy(rl6.rgi6.iface, t1, 16);
137
1.25k
        } else {
138
1.25k
          memcpy(rl6.rgi6.iface, t1, strlen(t1));
139
1.25k
        }
140
141
1.32k
        init_route_ipv6_list(&rl6, opt6, remote_endpoint, 0, &remote_host, c.es,
142
1.32k
                             &c);
143
1.32k
        route_list_ipv6_inited = 1;
144
1.32k
      }
145
1.47k
      break;
146
360
    case 7: {
147
360
      unsigned int flags;
148
360
      struct route_ipv6 r6;
149
360
      struct tuntap tt;
150
360
      memset(&tt, 0, sizeof(tt));
151
360
      tt.actual_name = gb_get_random_string();
152
360
      r6.iface = gb_get_random_string();
153
360
      r6.flags = fuzz_randomizer_get_int(0, 0xfffff);
154
360
      r6.netbits = fuzz_randomizer_get_int(0, 0xfffff);
155
360
      r6.metric = fuzz_randomizer_get_int(0, 0xfffff);
156
157
360
      r6.next = NULL;
158
159
360
      add_route_ipv6(&r6, &tt, 0, c.es, &c);
160
360
    } break;
161
744
    case 8:
162
744
      if (route_list_ipv6_inited && route_list_inited) {
163
545
        delete_routes(&rl, &rl6, NULL, 0, c.es, &c);
164
545
        route_list_ipv6_inited = 0;
165
545
        route_list_inited = 0;
166
545
      }
167
744
      break;
168
581
    case 9:
169
581
      if (route_list_ipv6_inited) {
170
521
        setenv_routes_ipv6(c.es, &rl6);
171
521
      }
172
581
      break;
173
955
    case 10: {
174
955
      add_route_ipv6_to_option_list(opt6,
175
955
                        gb_get_random_string(),
176
955
                                    gb_get_random_string(),
177
955
                                    gb_get_random_string(),
178
955
            fuzz_randomizer_get_int(0, 100));
179
955
    } break;
180
206
    case 11: {
181
206
      print_route_options(opt, M_NONFATAL);
182
206
    } break;
183
1.69k
    case 12: {
184
1.69k
      add_route_to_option_list(opt,
185
1.69k
                   gb_get_random_string(),
186
1.69k
                               gb_get_random_string(),
187
1.69k
             gb_get_random_string(),
188
1.69k
                               gb_get_random_string(),
189
1.69k
             fuzz_randomizer_get_int(0, 100));
190
1.69k
    } break;
191
137
    default:
192
137
      break;
193
35.1k
    }
194
35.1k
  }
195
196
2.52k
  if (route_list_inited) {
197
2.43k
    gc_free(&rl.gc);
198
2.43k
  }
199
2.52k
  env_set_destroy(c.es);
200
2.52k
  context_gc_free(&c);
201
202
2.52k
  fuzz_random_destroy();
203
204
2.52k
  gb_cleanup();
205
206
2.52k
  return 0;
207
2.52k
}