Coverage Report

Created: 2025-12-31 06:13

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/fuzz_proxy.c
Line
Count
Source
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
#include "config.h"
14
#include <sys/time.h>
15
#include "syshead.h"
16
#include "interval.h"
17
#include "proxy.h"
18
#include <openssl/err.h>
19
#include <openssl/ssl.h>
20
#include "sig.h"
21
22
#include "fuzz_randomizer.h"
23
24
int LLVMFuzzerInitialize(int *argc, char ***argv)
25
4
{
26
4
    OPENSSL_malloc_init();
27
4
    SSL_library_init();
28
4
    ERR_load_crypto_strings();
29
30
4
    OpenSSL_add_all_algorithms();
31
4
    OpenSSL_add_ssl_algorithms();
32
4
    OpenSSL_add_all_digests();
33
34
4
    SSL_load_error_strings();
35
4
    return 1;
36
4
}
37
38
39
435
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
40
41
435
  char *tmp = NULL;
42
435
  char *tmp2 = NULL;
43
44
435
  if (size < 500) {
45
17
    return 0;
46
17
  }
47
418
  fuzz_random_init(data, size);
48
49
418
  struct gc_arena gc = gc_new();
50
418
  struct http_proxy_info pi;
51
418
  ssize_t generic_ssizet;
52
418
  struct signal_info signal_received = {0};
53
  // TODO: This coul be randomized
54
418
  register_signal(&signal_received, SIGUSR1, "remote-exit");
55
418
  struct buffer lookahead = alloc_buf(1024);
56
418
  struct event_timeout evt;
57
58
418
  memset(&evt, 0, sizeof(struct event_timeout));
59
418
  memset(&pi, 0, sizeof(struct http_proxy_info));
60
418
  memset(&pi, 0, sizeof(pi));
61
62
418
  generic_ssizet = 0;
63
418
  char *fuzz_usrnm = fuzz_random_get_string_max_length(USER_PASS_LEN);
64
418
  strcpy(pi.up.username, fuzz_usrnm);
65
418
  if (strlen(pi.up.username) == 0) {
66
4
    gc_free(&gc);
67
4
    free_buf(&lookahead);
68
4
    free(fuzz_usrnm);
69
4
    fuzz_random_destroy();
70
4
    return 0;
71
4
  }
72
73
414
  char *pswd = fuzz_random_get_string_max_length(USER_PASS_LEN);
74
414
  strcpy(pi.up.password, pswd);
75
414
  if (strlen(pi.up.password) == 0) {
76
1
    gc_free(&gc);
77
1
    free_buf(&lookahead);
78
79
1
    free(pswd);
80
1
    free(fuzz_usrnm);
81
1
    fuzz_random_destroy();
82
1
    return 0;
83
1
  }
84
85
413
  generic_ssizet = fuzz_randomizer_get_int(0, 3);
86
413
  switch (generic_ssizet) {
87
128
  case 0:
88
128
    pi.auth_method = HTTP_AUTH_NONE;
89
128
    break;
90
41
  case 1:
91
41
     pi.auth_method = HTTP_AUTH_BASIC;
92
41
    break;
93
224
  case 2:
94
224
    pi.auth_method = HTTP_AUTH_DIGEST;
95
224
    break;
96
20
  case 3:
97
20
    pi.auth_method = HTTP_AUTH_NTLM2;
98
20
    break;
99
413
  }
100
413
  pi.options.http_version = "1.1";
101
102
413
  generic_ssizet = fuzz_randomizer_get_int(0, 2);
103
413
  switch (generic_ssizet) {
104
182
  case 0:
105
182
    pi.options.auth_retry = PAR_NO;
106
182
    break;
107
116
  case 1:
108
116
    pi.options.auth_retry = PAR_ALL;
109
116
    break;
110
115
  case 2:
111
115
    pi.options.auth_retry = PAR_NCT;
112
115
    break;
113
413
  }
114
115
413
  char *tmp_authenticate = get_random_string();
116
413
  pi.proxy_authenticate = tmp_authenticate;
117
118
  //if (provider.ConsumeProbability<double>() < 0.5) {
119
    //tmp = get_modifiable_string(provider);
120
413
    tmp = get_random_string();
121
413
    pi.options.custom_headers[0].name = tmp;
122
    //if (provider.ConsumeProbability<double>() < 0.5) {
123
      //tmp2 = get_modifiable_string(provider);
124
413
      tmp2 = get_random_string();
125
413
      pi.options.custom_headers[0].content = tmp2;
126
    //}
127
  //}
128
129
413
  establish_http_proxy_passthru(&pi, 0, "1.2.3.4", "777", &evt, &lookahead,
130
413
                                &signal_received);
131
413
  free(pi.proxy_authenticate);
132
413
  gc_free(&gc);
133
413
  free_buf(&lookahead);
134
135
413
  if (tmp != NULL)  free(tmp);
136
413
  if (tmp2 != NULL) free(tmp2);
137
138
413
    free(pswd);
139
413
    free(fuzz_usrnm);
140
413
  fuzz_random_destroy();
141
142
143
413
  return 0;
144
413
}