LLVMFuzzerInitialize: 46| 2|int LLVMFuzzerInitialize(int *argc, char ***argv) { 47| 2| (void)argc; 48| 2| (void)argv; 49| | 50| 2|#if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && !defined(LIBRESSL_VERSION_NUMBER) 51| | /* 52| | * Keep fuzzing deterministic and avoid MSan reports from OpenSSL's 53| | * environment-dependent config file loading in unsanitized libcrypto. 54| | */ 55| 2| OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG, NULL); 56| 2|#endif 57| | 58| 2| seed_addr_mappings(); 59| | 60| 2| return 0; 61| 2|} FuzzOpenSSLInit.c:seed_addr_mappings: 29| 2|static void seed_addr_mappings(void) { 30| 2| ioa_addr pub4 = {0}; 31| 2| ioa_addr priv4 = {0}; 32| 2| ioa_addr pub6 = {0}; 33| 2| ioa_addr priv6 = {0}; 34| | 35| 2| if (make_ioa_addr((const uint8_t *)"192.0.2.1", 0, &pub4) == 0 && ------------------ | Branch (35:7): [True: 2, False: 0] ------------------ 36| 2| make_ioa_addr((const uint8_t *)"10.0.0.1", 0, &priv4) == 0) { ------------------ | Branch (36:7): [True: 2, False: 0] ------------------ 37| 2| ioa_addr_add_mapping(&pub4, &priv4); 38| 2| } 39| | 40| 2| if (make_ioa_addr((const uint8_t *)"2001:db8::1", 0, &pub6) == 0 && ------------------ | Branch (40:7): [True: 2, False: 0] ------------------ 41| 2| make_ioa_addr((const uint8_t *)"fd00::1", 0, &priv6) == 0) { ------------------ | Branch (41:7): [True: 2, False: 0] ------------------ 42| 2| ioa_addr_add_mapping(&pub6, &priv6); 43| 2| } 44| 2|} LLVMFuzzerTestOneInput: 598| 1.70k|extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { 599| 1.70k| harness_integrity_sha1(Data, Size); 600| 1.70k| harness_integrity_multi(Data, Size); 601| 1.70k| harness_attr_iter(Data, Size); 602| 1.70k| harness_attr_add(Data, Size); 603| 1.70k| harness_old_stun(Data, Size); 604| 1.70k| harness_challenge_response_builder(Data, Size); 605| 1.70k| harness_full_addr_parser(Data, Size); 606| 1.70k| harness_integrity_attr_add(Data, Size); 607| 1.70k| return 0; 608| 1.70k|} FuzzStun.c:harness_integrity_sha1: 49| 1.70k|static void harness_integrity_sha1(const uint8_t *Data, size_t Size) { 50| 1.70k| if (Size < 10 || Size > 5120) { ------------------ | Branch (50:7): [True: 78, False: 1.63k] | Branch (50:20): [True: 84, False: 1.54k] ------------------ 51| 162| return; 52| 162| } 53| | 54| 1.54k| stun_is_command_message_full_check_str((uint8_t *)Data, Size, 1, NULL); 55| | 56| 1.54k| uint8_t uname[STUN_MAX_USERNAME_SIZE + 1] = "fuzzuser"; 57| 1.54k| uint8_t realm[STUN_MAX_REALM_SIZE + 1] = "fuzz.realm"; 58| 1.54k| uint8_t upwd[STUN_MAX_PWD_SIZE + 1] = "VOkJxbRl1RmTxUk/WvJxBt"; 59| | 60| 1.54k| stun_check_message_integrity_str(TURN_CREDENTIALS_SHORT_TERM, (uint8_t *)Data, Size, uname, realm, upwd, 61| 1.54k| SHATYPE_SHA1); 62| 1.54k| stun_check_message_integrity_str(TURN_CREDENTIALS_LONG_TERM, (uint8_t *)Data, Size, uname, realm, upwd, 63| 1.54k| SHATYPE_SHA256); 64| 1.54k|} FuzzStun.c:harness_integrity_multi: 69| 1.70k|static void harness_integrity_multi(const uint8_t *Data, size_t Size) { 70| 1.70k| if (Size < STUN_HEADER_LENGTH || Size > 5120) { ------------------ | | 46| 3.41k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (70:7): [True: 89, False: 1.61k] | Branch (70:36): [True: 84, False: 1.53k] ------------------ 71| 173| return; 72| 173| } 73| | 74| 1.53k| uint8_t buf[5120]; 75| 1.53k| uint8_t uname[STUN_MAX_USERNAME_SIZE + 1] = "fuzzuser"; 76| 1.53k| uint8_t realm[STUN_MAX_REALM_SIZE + 1] = "fuzz.realm"; 77| 1.53k| uint8_t upwd[STUN_MAX_PWD_SIZE + 1] = "VOkJxbRl1RmTxUk/WvJxBt"; 78| | 79| 1.53k| static const SHATYPE sha_types[] = {SHATYPE_SHA1, SHATYPE_SHA256, SHATYPE_SHA384, SHATYPE_SHA512}; 80| 1.53k| const size_t num_sha = sizeof(sha_types) / sizeof(sha_types[0]); 81| | 82| 7.67k| for (size_t s = 0; s < num_sha; s++) { ------------------ | Branch (82:22): [True: 6.14k, False: 1.53k] ------------------ 83| 6.14k| memcpy(buf, Data, Size); 84| 6.14k| stun_is_command_message_full_check_str(buf, Size, 1, NULL); 85| 6.14k| stun_check_message_integrity_str(TURN_CREDENTIALS_SHORT_TERM, buf, Size, uname, realm, upwd, sha_types[s]); 86| | 87| 6.14k| memcpy(buf, Data, Size); 88| 6.14k| stun_check_message_integrity_str(TURN_CREDENTIALS_LONG_TERM, buf, Size, uname, realm, upwd, sha_types[s]); 89| 6.14k| } 90| 1.53k|} FuzzStun.c:harness_attr_iter: 148| 1.70k|static void harness_attr_iter(const uint8_t *Data, size_t Size) { 149| 1.70k| if (Size < STUN_HEADER_LENGTH || Size > 8192) { ------------------ | | 46| 3.41k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (149:7): [True: 89, False: 1.61k] | Branch (149:36): [True: 70, False: 1.54k] ------------------ 150| 159| return; 151| 159| } 152| | 153| 1.54k| uint8_t buf[8192]; 154| 1.54k| memcpy(buf, Data, Size); 155| | 156| 1.54k| if (!stun_is_command_message_str(buf, Size)) { ------------------ | Branch (156:7): [True: 444, False: 1.10k] ------------------ 157| 444| return; 158| 444| } 159| | 160| 1.10k| stun_attr_ref sar = stun_attr_get_first_str(buf, Size); 161| 26.0k| while (sar) { ------------------ | Branch (161:10): [True: 24.9k, False: 1.10k] ------------------ 162| 24.9k| (void)stun_attr_get_type(sar); 163| 24.9k| (void)stun_attr_get_len(sar); 164| 24.9k| (void)stun_attr_get_value(sar); 165| 24.9k| (void)stun_attr_is_addr(sar); 166| 24.9k| sar = stun_attr_get_next_str(buf, Size, sar); 167| 24.9k| } 168| | 169| 1.10k| ioa_addr addr; 170| 1.10k| const size_t num_addr_attrs = sizeof(kAddrAttrs) / sizeof(kAddrAttrs[0]); 171| 9.94k| for (size_t i = 0; i < num_addr_attrs; i++) { ------------------ | Branch (171:22): [True: 8.84k, False: 1.10k] ------------------ 172| 8.84k| sar = stun_attr_get_first_by_type_str(buf, Size, kAddrAttrs[i]); 173| 8.84k| if (sar) { ------------------ | Branch (173:9): [True: 1.34k, False: 7.49k] ------------------ 174| 1.34k| memset(&addr, 0, sizeof(addr)); 175| 1.34k| stun_attr_get_addr_str(buf, Size, sar, &addr, NULL); 176| 1.34k| } 177| 8.84k| memset(&addr, 0, sizeof(addr)); 178| 8.84k| stun_attr_get_first_addr_str(buf, Size, kAddrAttrs[i], &addr, NULL); 179| 8.84k| } 180| | 181| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_CHANNEL_NUMBER); ------------------ | | 113| 1.10k|#define STUN_ATTRIBUTE_CHANNEL_NUMBER (0x000C) ------------------ 182| 1.10k| if (sar) { ------------------ | Branch (182:7): [True: 188, False: 917] ------------------ 183| 188| (void)stun_attr_get_channel_number(sar); 184| 188| } 185| 1.10k| (void)stun_attr_get_first_channel_number_str(buf, Size); 186| | 187| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY); ------------------ | | 104| 1.10k|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY (0x0017) ------------------ 188| 1.10k| if (sar) { ------------------ | Branch (188:7): [True: 25, False: 1.08k] ------------------ 189| 25| (void)stun_get_requested_address_family(sar); 190| 25| } 191| | 192| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_ADDITIONAL_ADDRESS_FAMILY); ------------------ | | 140| 1.10k|#define STUN_ATTRIBUTE_ADDITIONAL_ADDRESS_FAMILY (0x8000) ------------------ 193| 1.10k| if (sar) { ------------------ | Branch (193:7): [True: 92, False: 1.01k] ------------------ 194| 92| (void)stun_get_requested_address_family(sar); 195| 92| } 196| | 197| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_EVEN_PORT); ------------------ | | 119| 1.10k|#define STUN_ATTRIBUTE_EVEN_PORT (0x0018) ------------------ 198| 1.10k| if (sar) { ------------------ | Branch (198:7): [True: 40, False: 1.06k] ------------------ 199| 40| (void)stun_attr_get_even_port(sar); 200| 40| } 201| | 202| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_BANDWIDTH); ------------------ | | 115| 1.10k|#define STUN_ATTRIBUTE_BANDWIDTH (0x0010) ------------------ 203| 1.10k| if (sar) { ------------------ | Branch (203:7): [True: 57, False: 1.04k] ------------------ 204| 57| (void)stun_attr_get_bandwidth(sar); 205| 57| } 206| | 207| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_NEW_BANDWIDTH); ------------------ | | 52| 1.10k|#define STUN_ATTRIBUTE_NEW_BANDWIDTH (0x8000 + STUN_ATTRIBUTE_BANDWIDTH) | | ------------------ | | | | 115| 1.10k|#define STUN_ATTRIBUTE_BANDWIDTH (0x0010) | | ------------------ ------------------ 208| 1.10k| if (sar) { ------------------ | Branch (208:7): [True: 19, False: 1.08k] ------------------ 209| 19| (void)stun_attr_get_bandwidth(sar); 210| 19| } 211| | 212| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_RESERVATION_TOKEN); ------------------ | | 123| 1.10k|#define STUN_ATTRIBUTE_RESERVATION_TOKEN (0x0022) ------------------ 213| 1.10k| if (sar) { ------------------ | Branch (213:7): [True: 24, False: 1.08k] ------------------ 214| 24| (void)stun_attr_get_reservation_token_value(sar); 215| 24| } 216| | 217| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_CHANGE_REQUEST); ------------------ | | 93| 1.10k|#define STUN_ATTRIBUTE_CHANGE_REQUEST (0x0003) ------------------ 218| 1.10k| if (sar) { ------------------ | Branch (218:7): [True: 58, False: 1.04k] ------------------ 219| 58| bool change_ip = false, change_port = false; 220| 58| stun_attr_get_change_request_str(sar, &change_ip, &change_port); 221| 58| } 222| | 223| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_RESPONSE_PORT); ------------------ | | 131| 1.10k|#define STUN_ATTRIBUTE_RESPONSE_PORT (0x0027) ------------------ 224| 1.10k| if (sar) { ------------------ | Branch (224:7): [True: 28, False: 1.07k] ------------------ 225| 28| (void)stun_attr_get_response_port_str(sar); 226| 28| } 227| | 228| 1.10k| sar = stun_attr_get_first_by_type_str(buf, Size, STUN_ATTRIBUTE_PADDING); ------------------ | | 130| 1.10k|#define STUN_ATTRIBUTE_PADDING (0x0026) ------------------ 229| 1.10k| if (sar) { ------------------ | Branch (229:7): [True: 19, False: 1.08k] ------------------ 230| 19| (void)stun_attr_get_padding_len_str(sar); 231| 19| } 232| | 233| 1.10k| { 234| 1.10k| int err_code = 0; 235| 1.10k| uint8_t err_msg[1024] = {0}; 236| 1.10k| stun_is_error_response_str(buf, Size, &err_code, err_msg, sizeof(err_msg)); 237| 1.10k| } 238| 1.10k| { 239| 1.10k| int err_code = 0; 240| 1.10k| uint8_t err_msg[1024] = {0}; 241| 1.10k| uint8_t chal_realm[STUN_MAX_REALM_SIZE + 1] = {0}; 242| 1.10k| uint8_t chal_nonce[STUN_MAX_NONCE_SIZE + 1] = {0}; 243| 1.10k| uint8_t server_name[STUN_MAX_SERVER_NAME_SIZE + 1] = {0}; 244| 1.10k| bool oauth = false; 245| 1.10k| stun_is_challenge_response_str(buf, Size, &err_code, err_msg, sizeof(err_msg), chal_realm, chal_nonce, server_name, 246| 1.10k| &oauth); 247| 1.10k| } 248| | 249| 1.10k| const size_t num_all_attrs = sizeof(kAllAttrTypes) / sizeof(kAllAttrTypes[0]); 250| 49.7k| for (size_t i = 0; i < num_all_attrs; i++) { ------------------ | Branch (250:22): [True: 48.6k, False: 1.10k] ------------------ 251| 48.6k| sar = stun_attr_get_first_by_type_str(buf, Size, kAllAttrTypes[i]); 252| 48.6k| if (sar) { ------------------ | Branch (252:9): [True: 2.65k, False: 45.9k] ------------------ 253| 2.65k| (void)stun_attr_get_type(sar); 254| 2.65k| (void)stun_attr_get_len(sar); 255| 2.65k| (void)stun_attr_get_value(sar); 256| 2.65k| } 257| 48.6k| } 258| 1.10k|} FuzzStun.c:harness_attr_add: 263| 1.70k|static void harness_attr_add(const uint8_t *Data, size_t Size) { 264| 1.70k| if (Size < STUN_HEADER_LENGTH || Size > 4096) { ------------------ | | 46| 3.41k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (264:7): [True: 89, False: 1.61k] | Branch (264:36): [True: 120, False: 1.49k] ------------------ 265| 209| return; 266| 209| } 267| | 268| 1.49k| uint8_t buf[MAX_STUN_MESSAGE_SIZE] = {0}; 269| 1.49k| memcpy(buf, Data, Size); 270| 1.49k| size_t len = Size; 271| | 272| 1.49k| if (!stun_is_command_message_str(buf, len)) { ------------------ | Branch (272:7): [True: 412, False: 1.08k] ------------------ 273| 412| return; 274| 412| } 275| | 276| 1.08k| uint8_t test_uname[] = "fuzzuser@fuzz.realm"; 277| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_USERNAME, test_uname, (int)(sizeof(test_uname) - 1)); ------------------ | | 96| 1.08k|#define STUN_ATTRIBUTE_USERNAME (0x0006) ------------------ 278| | 279| 1.08k| uint8_t test_realm[] = "fuzz.realm"; 280| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_REALM, test_realm, (int)(sizeof(test_realm) - 1)); ------------------ | | 102| 1.08k|#define STUN_ATTRIBUTE_REALM (0x0014) ------------------ 281| | 282| 1.08k| uint8_t test_nonce[] = "fuzznonce0123456789abcdef"; 283| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_NONCE, test_nonce, (int)(sizeof(test_nonce) - 1)); ------------------ | | 103| 1.08k|#define STUN_ATTRIBUTE_NONCE (0x0015) ------------------ 284| | 285| 1.08k| uint8_t test_sw[] = "coturn-fuzz/1.0"; 286| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_SOFTWARE, test_sw, (int)(sizeof(test_sw) - 1)); ------------------ | | 108| 1.08k|#define STUN_ATTRIBUTE_SOFTWARE (0x8022) ------------------ 287| | 288| 1.08k| uint8_t lifetime_val[4] = {0x00, 0x00, 0x02, 0x58}; 289| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_LIFETIME, lifetime_val, 4); ------------------ | | 114| 1.08k|#define STUN_ATTRIBUTE_LIFETIME (0x000D) ------------------ 290| | 291| 1.08k| uint8_t transport_val[4] = {STUN_ATTRIBUTE_TRANSPORT_UDP_VALUE, 0x00, 0x00, 0x00}; ------------------ | | 157| 1.08k|#define STUN_ATTRIBUTE_TRANSPORT_UDP_VALUE (17) ------------------ 292| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_REQUESTED_TRANSPORT, transport_val, 4); ------------------ | | 120| 1.08k|#define STUN_ATTRIBUTE_REQUESTED_TRANSPORT (0x0019) ------------------ 293| | 294| 1.08k| uint8_t af_val[4] = {STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV4, 0x00, 0x00, 0x00}; ------------------ | | 149| 1.08k|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV4 (0x01) ------------------ 295| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY, af_val, 4); ------------------ | | 104| 1.08k|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY (0x0017) ------------------ 296| | 297| 1.08k| uint8_t even_port_val[1] = {0x80}; 298| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_EVEN_PORT, even_port_val, 1); ------------------ | | 119| 1.08k|#define STUN_ATTRIBUTE_EVEN_PORT (0x0018) ------------------ 299| | 300| 1.08k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_DONT_FRAGMENT, NULL, 0); ------------------ | | 121| 1.08k|#define STUN_ATTRIBUTE_DONT_FRAGMENT (0x001A) ------------------ 301| | 302| 1.08k| stun_attr_add_channel_number_str(buf, &len, 0x4001); 303| | 304| 1.08k| stun_attr_add_bandwidth_str(buf, &len, 1000000); 305| | 306| 1.08k| ioa_addr addr4 = {0}; 307| 1.08k| addr4.s4.sin_family = AF_INET; 308| 1.08k| addr4.s4.sin_port = htons(12345); 309| 1.08k| addr4.s4.sin_addr.s_addr = htonl(0xC0A80001); 310| 1.08k| stun_attr_add_addr_str(buf, &len, STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, &addr4); ------------------ | | 105| 1.08k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ 311| 1.08k| stun_attr_add_addr_str(buf, &len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &addr4); ------------------ | | 116| 1.08k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 312| 1.08k| stun_attr_add_addr_str(buf, &len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &addr4); ------------------ | | 118| 1.08k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 313| 1.08k| stun_attr_add_addr_str(buf, &len, STUN_ATTRIBUTE_MAPPED_ADDRESS, &addr4); ------------------ | | 91| 1.08k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 314| | 315| 1.08k| ioa_addr addr6 = {0}; 316| 1.08k| addr6.s6.sin6_family = AF_INET6; 317| 1.08k| addr6.s6.sin6_port = htons(54321); 318| 1.08k| addr6.s6.sin6_addr.s6_addr[15] = 1; 319| 1.08k| stun_attr_add_addr_str(buf, &len, STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, &addr6); ------------------ | | 105| 1.08k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ 320| 1.08k| stun_attr_add_addr_str(buf, &len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &addr6); ------------------ | | 118| 1.08k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 321| | 322| 1.08k| stun_attr_add_address_error_code(buf, &len, STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6, 440); ------------------ | | 150| 1.08k|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6 (0x02) ------------------ 323| | 324| 1.08k| stun_attr_add_change_request_str(buf, &len, true, true); 325| 1.08k| stun_attr_add_response_port_str(buf, &len, 3479); 326| 1.08k| stun_attr_add_padding_str(buf, &len, 64); 327| | 328| 1.08k| if (Size > STUN_HEADER_LENGTH + 4) { ------------------ | | 46| 1.08k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (328:7): [True: 968, False: 119] ------------------ 329| 968| int data_len = (int)(Size - STUN_HEADER_LENGTH); ------------------ | | 46| 968|#define STUN_HEADER_LENGTH (20) ------------------ 330| 968| if (data_len > 1024) { ------------------ | Branch (330:9): [True: 106, False: 862] ------------------ 331| 106| data_len = 1024; 332| 106| } 333| 968| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_DATA, Data + STUN_HEADER_LENGTH, data_len); ------------------ | | 117| 968|#define STUN_ATTRIBUTE_DATA (0x0013) ------------------ stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_DATA, Data + STUN_HEADER_LENGTH, data_len); ------------------ | | 46| 968|#define STUN_HEADER_LENGTH (20) ------------------ 334| 968| } 335| | 336| 1.08k| stun_attr_add_fingerprint_str(buf, &len); 337| 1.08k|} FuzzStun.c:harness_old_stun: 342| 1.70k|static void harness_old_stun(const uint8_t *Data, size_t Size) { 343| 1.70k| if (Size < STUN_HEADER_LENGTH || Size > 5120) { ------------------ | | 46| 3.41k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (343:7): [True: 89, False: 1.61k] | Branch (343:36): [True: 84, False: 1.53k] ------------------ 344| 173| return; 345| 173| } 346| | 347| 1.53k| uint8_t buf[5120]; 348| 1.53k| memcpy(buf, Data, Size); 349| | 350| 1.53k| uint32_t cookie = 0; 351| 1.53k| bool is_old = old_stun_is_command_message_str(buf, Size, &cookie); 352| 1.53k| (void)stun_is_command_message_str(buf, Size); 353| | 354| 1.53k| if (is_old) { ------------------ | Branch (354:7): [True: 184, False: 1.35k] ------------------ 355| 184| (void)stun_get_msg_type_str(buf, Size); 356| 184| (void)stun_get_method_str(buf, Size); 357| | 358| 184| stun_is_request_str(buf, Size); 359| 184| stun_is_indication_str(buf, Size); 360| 184| stun_is_success_response_str(buf, Size); 361| | 362| 184| int err_code = 0; 363| 184| uint8_t err_msg[256] = {0}; 364| 184| stun_is_error_response_str(buf, Size, &err_code, err_msg, sizeof(err_msg)); 365| | 366| 184| int fp_present = 0; 367| 184| stun_is_command_message_full_check_str(buf, Size, 1, &fp_present); 368| 184| stun_is_command_message_full_check_str(buf, Size, 0, &fp_present); 369| | 370| 184| stun_is_binding_request_str(buf, Size, 0); 371| 184| stun_is_binding_response_str(buf, Size); 372| | 373| 184| stun_attr_ref sar = stun_attr_get_first_str(buf, Size); 374| 1.68k| while (sar) { ------------------ | Branch (374:12): [True: 1.50k, False: 184] ------------------ 375| 1.50k| (void)stun_attr_get_type(sar); 376| 1.50k| (void)stun_attr_get_len(sar); 377| 1.50k| sar = stun_attr_get_next_str(buf, Size, sar); 378| 1.50k| } 379| 184| } 380| 1.53k|} FuzzStun.c:harness_challenge_response_builder: 404| 1.70k|static void harness_challenge_response_builder(const uint8_t *Data, size_t Size) { 405| 1.70k| if (!Size) { ------------------ | Branch (405:7): [True: 0, False: 1.70k] ------------------ 406| 0| return; 407| 0| } 408| | 409| 1.70k| static const uint16_t kMethods[] = { 410| 1.70k| STUN_METHOD_ALLOCATE, ------------------ | | 78| 1.70k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ 411| 1.70k| STUN_METHOD_BINDING, ------------------ | | 77| 1.70k|#define STUN_METHOD_BINDING (0x0001) ------------------ 412| 1.70k| STUN_METHOD_REFRESH, ------------------ | | 79| 1.70k|#define STUN_METHOD_REFRESH (0x0004) ------------------ 413| 1.70k| STUN_METHOD_CHANNEL_BIND, ------------------ | | 83| 1.70k|#define STUN_METHOD_CHANNEL_BIND (0x0009) ------------------ 414| 1.70k| }; 415| 1.70k| const uint16_t method = kMethods[Data[0] % (sizeof(kMethods) / sizeof(kMethods[0]))]; 416| | 417| | /* Length of each variable-length string is taken from a single fuzz byte 418| | * so libFuzzer still varies the inputs across iterations. Floors keep the 419| | * attribute non-empty so the inner copies in stun_is_challenge_response_str 420| | * actually populate the output buffers. */ 421| 1.70k| const size_t realm_len = 1 + (Size > 1 ? (Data[1] % 16) : 0); ------------------ | Branch (421:33): [True: 1.67k, False: 38] ------------------ 422| 1.70k| const size_t nonce_len = 1 + (Size > 2 ? (Data[2] % 16) : 0); ------------------ | Branch (422:33): [True: 1.65k, False: 54] ------------------ 423| 1.70k| const size_t server_len = 1 + (Size > 3 ? (Data[3] % 16) : 0); ------------------ | Branch (423:34): [True: 1.64k, False: 63] ------------------ 424| | 425| 1.70k| uint8_t realm_buf[STUN_MAX_REALM_SIZE + 1] = {0}; 426| 1.70k| uint8_t nonce_buf[STUN_MAX_NONCE_SIZE + 1] = {0}; 427| 1.70k| uint8_t server_buf[STUN_MAX_SERVER_NAME_SIZE + 1] = {0}; 428| 12.3k| for (size_t i = 0; i < realm_len; ++i) { ------------------ | Branch (428:22): [True: 10.6k, False: 1.70k] ------------------ 429| 10.6k| realm_buf[i] = (uint8_t)('a' + (i % 26)); 430| 10.6k| } 431| 6.71k| for (size_t i = 0; i < nonce_len; ++i) { ------------------ | Branch (431:22): [True: 5.00k, False: 1.70k] ------------------ 432| 5.00k| nonce_buf[i] = (uint8_t)('0' + (i % 10)); 433| 5.00k| } 434| 12.2k| for (size_t i = 0; i < server_len; ++i) { ------------------ | Branch (434:22): [True: 10.5k, False: 1.70k] ------------------ 435| 10.5k| server_buf[i] = (uint8_t)('A' + (i % 26)); 436| 10.5k| } 437| | 438| 1.70k| stun_tid tid = {0}; 439| 22.2k| for (size_t i = 0; i < STUN_TID_SIZE; ++i) { ------------------ | | 53| 22.2k|#define STUN_TID_SIZE (12) ------------------ | Branch (439:22): [True: 20.4k, False: 1.70k] ------------------ 440| 20.4k| tid.tsx_id[i] = (uint8_t)(Size > i + 4 ? Data[i + 4] : (uint8_t)i); ------------------ | Branch (440:31): [True: 19.5k, False: 948] ------------------ 441| 20.4k| } 442| | 443| | /* Each variant builds a fresh error response and runs it through the 444| | * predicate so the inner attribute lookups fire. */ 445| 1.70k| static const struct { 446| 1.70k| uint16_t err_code; 447| 1.70k| bool include_realm; 448| 1.70k| bool include_nonce; 449| 1.70k| bool include_third_party_auth; 450| 1.70k| } kVariants[] = { 451| 1.70k| {401, true, true, false}, /* canonical 401 challenge: REALM + NONCE */ 452| 1.70k| {401, true, true, true}, /* same + THIRD-PARTY-AUTHORIZATION (OAuth branch) */ 453| 1.70k| {438, true, true, false}, /* covers the (*err_code) == 438 disjunct */ 454| 1.70k| {401, true, false, false}, /* REALM present, NONCE missing — negative inner path */ 455| 1.70k| {401, false, false, false}, /* err_code matches but no REALM — outer negative path */ 456| 1.70k| {400, true, true, false}, /* err_code does not match 401/438 — early-out path */ 457| 1.70k| }; 458| | 459| 11.9k| for (size_t v = 0; v < sizeof(kVariants) / sizeof(kVariants[0]); ++v) { ------------------ | Branch (459:22): [True: 10.2k, False: 1.70k] ------------------ 460| 10.2k| uint8_t buf[MAX_STUN_MESSAGE_SIZE] = {0}; 461| 10.2k| size_t len = 0; 462| 10.2k| stun_init_error_response_str(method, buf, &len, kVariants[v].err_code, (const uint8_t *)"unauthorized", &tid, true); 463| | 464| 10.2k| if (kVariants[v].include_realm) { ------------------ | Branch (464:9): [True: 8.54k, False: 1.70k] ------------------ 465| 8.54k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_REALM, realm_buf, (int)realm_len); ------------------ | | 102| 8.54k|#define STUN_ATTRIBUTE_REALM (0x0014) ------------------ 466| 8.54k| } 467| 10.2k| if (kVariants[v].include_third_party_auth) { ------------------ | Branch (467:9): [True: 1.70k, False: 8.54k] ------------------ 468| 1.70k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_THIRD_PARTY_AUTHORIZATION, server_buf, (int)server_len); ------------------ | | 208| 1.70k|#define STUN_ATTRIBUTE_THIRD_PARTY_AUTHORIZATION (0x802E) ------------------ 469| 1.70k| } 470| 10.2k| if (kVariants[v].include_nonce) { ------------------ | Branch (470:9): [True: 6.83k, False: 3.41k] ------------------ 471| 6.83k| stun_attr_add_str(buf, &len, STUN_ATTRIBUTE_NONCE, nonce_buf, (int)nonce_len); ------------------ | | 103| 6.83k|#define STUN_ATTRIBUTE_NONCE (0x0015) ------------------ 472| 6.83k| } 473| | 474| 10.2k| int err_code = 0; 475| 10.2k| uint8_t err_msg[1024] = {0}; 476| 10.2k| uint8_t out_realm[STUN_MAX_REALM_SIZE + 1] = {0}; 477| 10.2k| uint8_t out_nonce[STUN_MAX_NONCE_SIZE + 1] = {0}; 478| 10.2k| uint8_t out_server[STUN_MAX_SERVER_NAME_SIZE + 1] = {0}; 479| 10.2k| bool oauth = false; 480| 10.2k| (void)stun_is_challenge_response_str(buf, len, &err_code, err_msg, sizeof(err_msg), out_realm, out_nonce, 481| 10.2k| out_server, &oauth); 482| | 483| | /* Also exercise the NULL-oauth-pointer branch, which is reachable from 484| | * other call sites in the codebase. */ 485| 10.2k| (void)stun_is_challenge_response_str(buf, len, &err_code, err_msg, sizeof(err_msg), out_realm, out_nonce, 486| | out_server, NULL); 487| 10.2k| } 488| 1.70k|} FuzzStun.c:harness_full_addr_parser: 493| 1.70k|static void harness_full_addr_parser(const uint8_t *Data, size_t Size) { 494| 1.70k| ioa_addr addr; 495| 1.70k| const uint16_t default_port = fuzz_u16(Data, Size, 0); 496| 1.70k| const uint16_t explicit_port = fuzz_u16(Data, Size, 2); 497| | 498| 1.70k| char ipv4_plain[MAX_IOA_ADDR_STRING]; 499| 1.70k| char ipv4_with_port[MAX_IOA_ADDR_STRING]; 500| 1.70k| char ipv6_bracketed[MAX_IOA_ADDR_STRING]; 501| 1.70k| char ipv6_with_port[MAX_IOA_ADDR_STRING]; 502| 1.70k| char ipv4_spaced[MAX_IOA_ADDR_STRING]; 503| | 504| 1.70k| snprintf(ipv4_plain, sizeof(ipv4_plain), "%u.%u.%u.%u", fuzz_byte(Data, Size, 4), fuzz_byte(Data, Size, 5), 505| 1.70k| fuzz_byte(Data, Size, 6), fuzz_byte(Data, Size, 7)); 506| 1.70k| snprintf(ipv4_with_port, sizeof(ipv4_with_port), "%u.%u.%u.%u:%u", fuzz_byte(Data, Size, 8), fuzz_byte(Data, Size, 9), 507| 1.70k| fuzz_byte(Data, Size, 10), fuzz_byte(Data, Size, 11), explicit_port); 508| 1.70k| snprintf(ipv6_bracketed, sizeof(ipv6_bracketed), "[2001:db8:%x:%x::%x]", fuzz_u16(Data, Size, 12), 509| 1.70k| fuzz_u16(Data, Size, 14), fuzz_u16(Data, Size, 16)); 510| 1.70k| snprintf(ipv6_with_port, sizeof(ipv6_with_port), "[2001:db8:%x:%x::%x]:%u", fuzz_u16(Data, Size, 18), 511| 1.70k| fuzz_u16(Data, Size, 20), fuzz_u16(Data, Size, 22), explicit_port); 512| 1.70k| snprintf(ipv4_spaced, sizeof(ipv4_spaced), " %u.%u.%u.%u:%u", fuzz_byte(Data, Size, 24), fuzz_byte(Data, Size, 25), 513| 1.70k| fuzz_byte(Data, Size, 26), fuzz_byte(Data, Size, 27), explicit_port); 514| | 515| 1.70k| static const char *kFixedInputs[] = { 516| 1.70k| "", "0.0.0.0", "127.0.0.1:3478", "192.0.2.1:", "[::1]", "[::1]:5349", "[2001:db8::1] ", "::1", 517| 1.70k| }; 518| | 519| 15.3k| for (size_t i = 0; i < sizeof(kFixedInputs) / sizeof(kFixedInputs[0]); ++i) { ------------------ | Branch (519:22): [True: 13.6k, False: 1.70k] ------------------ 520| 13.6k| memset(&addr, 0, sizeof(addr)); 521| 13.6k| (void)make_ioa_addr_from_full_string((const uint8_t *)kFixedInputs[i], default_port, &addr); 522| 13.6k| } 523| | 524| 1.70k| const char *generated[] = {ipv4_plain, ipv4_with_port, ipv6_bracketed, ipv6_with_port, ipv4_spaced}; 525| 10.2k| for (size_t i = 0; i < sizeof(generated) / sizeof(generated[0]); ++i) { ------------------ | Branch (525:22): [True: 8.54k, False: 1.70k] ------------------ 526| 8.54k| memset(&addr, 0, sizeof(addr)); 527| 8.54k| (void)make_ioa_addr_from_full_string((const uint8_t *)generated[i], default_port, &addr); 528| 8.54k| } 529| | 530| | (void)make_ioa_addr_from_full_string((const uint8_t *)ipv4_plain, default_port, NULL); 531| 1.70k|} FuzzStun.c:fuzz_u16: 29| 13.6k|static uint16_t fuzz_u16(const uint8_t *Data, size_t Size, size_t idx) { 30| 13.6k| return (uint16_t)(((uint16_t)fuzz_byte(Data, Size, idx) << 8) | (uint16_t)fuzz_byte(Data, Size, idx + 1)); 31| 13.6k|} FuzzStun.c:fuzz_byte: 27| 565k|static uint8_t fuzz_byte(const uint8_t *Data, size_t Size, size_t idx) { return Size ? Data[idx % Size] : 0; } ------------------ | Branch (27:81): [True: 565k, False: 0] ------------------ FuzzStun.c:harness_integrity_attr_add: 536| 1.70k|static void harness_integrity_attr_add(const uint8_t *Data, size_t Size) { 537| 1.70k| static const SHATYPE kShaTypes[] = {SHATYPE_SHA1, SHATYPE_SHA256, SHATYPE_SHA384, SHATYPE_SHA512}; 538| 1.70k| const SHATYPE shatype = kShaTypes[fuzz_byte(Data, Size, 0) % (sizeof(kShaTypes) / sizeof(kShaTypes[0]))]; 539| | 540| 1.70k| uint8_t uname[STUN_MAX_USERNAME_SIZE + 1] = {0}; 541| 1.70k| uint8_t realm[STUN_MAX_REALM_SIZE + 1] = {0}; 542| 1.70k| uint8_t nonce[STUN_MAX_NONCE_SIZE + 1] = {0}; 543| 1.70k| uint8_t upwd[STUN_MAX_PWD_SIZE + 1] = {0}; 544| 1.70k| password_t pwd = {0}; 545| 1.70k| hmackey_t key = {0}; 546| | 547| 1.70k| fuzz_printable_string(Data, Size, 1, uname, sizeof(uname)); 548| 1.70k| fuzz_printable_string(Data, Size, 1 + sizeof(uname), realm, sizeof(realm)); 549| 1.70k| fuzz_printable_string(Data, Size, 1 + sizeof(uname) + sizeof(realm), nonce, sizeof(nonce)); 550| 1.70k| fuzz_printable_string(Data, Size, 1 + sizeof(uname) + sizeof(realm) + sizeof(nonce), upwd, sizeof(upwd)); 551| 1.70k| fuzz_printable_string(Data, Size, 1 + sizeof(uname) + sizeof(realm) + sizeof(nonce) + sizeof(upwd), pwd, sizeof(pwd)); 552| | 553| 1.70k| if (!uname[0]) { ------------------ | Branch (553:7): [True: 203, False: 1.50k] ------------------ 554| 203| memcpy(uname, "fuzzuser", sizeof("fuzzuser")); 555| 203| } 556| 1.70k| if (!realm[0]) { ------------------ | Branch (556:7): [True: 802, False: 906] ------------------ 557| 802| memcpy(realm, "fuzz.realm", sizeof("fuzz.realm")); 558| 802| } 559| 1.70k| if (!nonce[0]) { ------------------ | Branch (559:7): [True: 963, False: 745] ------------------ 560| 963| memcpy(nonce, "fuzznonce", sizeof("fuzznonce")); 561| 963| } 562| 1.70k| if (!upwd[0]) { ------------------ | Branch (562:7): [True: 1.03k, False: 669] ------------------ 563| 1.03k| memcpy(upwd, "fuzzpassword", sizeof("fuzzpassword")); 564| 1.03k| } 565| 1.70k| if (!pwd[0]) { ------------------ | Branch (565:7): [True: 657, False: 1.05k] ------------------ 566| 657| memcpy(pwd, "shortterm", sizeof("shortterm")); 567| 657| } 568| | 569| 111k| for (size_t i = 0; i < sizeof(key); ++i) { ------------------ | Branch (569:22): [True: 109k, False: 1.70k] ------------------ 570| 109k| key[i] = fuzz_byte(Data, Size, 32 + i); 571| 109k| } 572| | 573| 1.70k| uint8_t buf[MAX_STUN_MESSAGE_SIZE]; 574| 1.70k| size_t len = 0; 575| 1.70k| stun_init_request_str(STUN_METHOD_BINDING, buf, &len); ------------------ | | 77| 1.70k|#define STUN_METHOD_BINDING (0x0001) ------------------ 576| 1.70k| (void)stun_attr_add_integrity_by_key_str(buf, &len, uname, realm, key, nonce, shatype); 577| | 578| 1.70k| len = 0; 579| 1.70k| stun_init_request_str(STUN_METHOD_ALLOCATE, buf, &len); ------------------ | | 78| 1.70k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ 580| 1.70k| (void)stun_attr_add_integrity_by_user_str(buf, &len, uname, realm, upwd, nonce, shatype); 581| | 582| 1.70k| len = 0; 583| 1.70k| stun_init_request_str(STUN_METHOD_REFRESH, buf, &len); ------------------ | | 79| 1.70k|#define STUN_METHOD_REFRESH (0x0004) ------------------ 584| 1.70k| (void)stun_attr_add_integrity_by_user_short_term_str(buf, &len, uname, pwd, shatype); 585| | 586| 1.70k| len = 0; 587| 1.70k| stun_init_request_str(STUN_METHOD_CHANNEL_BIND, buf, &len); ------------------ | | 83| 1.70k|#define STUN_METHOD_CHANNEL_BIND (0x0009) ------------------ 588| 1.70k| (void)stun_attr_add_integrity_str(TURN_CREDENTIALS_SHORT_TERM, buf, &len, key, pwd, shatype); 589| | 590| 1.70k| len = 0; 591| 1.70k| stun_init_request_str(STUN_METHOD_BINDING, buf, &len); ------------------ | | 77| 1.70k|#define STUN_METHOD_BINDING (0x0001) ------------------ 592| 1.70k| (void)stun_attr_add_integrity_str(TURN_CREDENTIALS_LONG_TERM, buf, &len, key, pwd, shatype); 593| 1.70k|} FuzzStun.c:fuzz_printable_string: 33| 8.54k|static void fuzz_printable_string(const uint8_t *Data, size_t Size, size_t idx, uint8_t *out, size_t out_size) { 34| 8.54k| if (!out_size) { ------------------ | Branch (34:7): [True: 0, False: 8.54k] ------------------ 35| 0| return; 36| 0| } 37| | 38| 8.54k| const size_t max_len = out_size - 1; 39| 8.54k| const size_t len = max_len ? (size_t)(fuzz_byte(Data, Size, idx) % (max_len + 1)) : 0; ------------------ | Branch (39:22): [True: 8.54k, False: 0] ------------------ 40| 406k| for (size_t i = 0; i < len; ++i) { ------------------ | Branch (40:22): [True: 397k, False: 8.54k] ------------------ 41| 397k| out[i] = (uint8_t)(33 + (fuzz_byte(Data, Size, idx + 1 + i) % 94)); 42| 397k| } 43| 8.54k| out[len] = 0; 44| 8.54k|} turn_malloc_impl: 685| 9.40k|void *turn_malloc_impl(size_t sz, const char *file, int line) { 686| 9.40k| void *ptr = malloc(sz); 687| 9.40k| if (!ptr && sz) { ------------------ | Branch (687:7): [True: 0, False: 9.40k] | Branch (687:15): [True: 0, False: 0] ------------------ 688| 0| turn_out_of_memory(file, line, "malloc", sz); 689| 0| } 690| 9.40k| return ptr; 691| 9.40k|} turn_realloc_impl: 701| 8|void *turn_realloc_impl(void *ptr, size_t sz, const char *file, int line) { 702| 8| void *newptr = realloc(ptr, sz); 703| 8| if (!newptr && sz) { ------------------ | Branch (703:7): [True: 0, False: 8] | Branch (703:18): [True: 0, False: 0] ------------------ 704| 0| turn_out_of_memory(file, line, "realloc", sz); 705| 0| } 706| 8| return newptr; 707| 8|} turn_strdup_impl: 709| 22.2k|char *turn_strdup_impl(const char *s, const char *file, int line) { 710| 22.2k| if (!s) { ------------------ | Branch (710:7): [True: 0, False: 22.2k] ------------------ 711| 0| return NULL; 712| 0| } 713| 22.2k| char *ptr = strdup(s); 714| 22.2k| if (!ptr) { ------------------ | Branch (714:7): [True: 0, False: 22.2k] ------------------ 715| 0| turn_out_of_memory(file, line, "strdup", strlen(s) + 1); 716| 0| } 717| 22.2k| return ptr; 718| 22.2k|} addr_set_any: 48| 20.8k|void addr_set_any(ioa_addr *addr) { 49| 20.8k| if (addr) { ------------------ | Branch (49:7): [True: 20.8k, False: 0] ------------------ 50| 20.8k| memset(addr, 0, sizeof(ioa_addr)); 51| 20.8k| } 52| 20.8k|} addr_eq_no_port: 180| 14.8k|int addr_eq_no_port(const ioa_addr *a1, const ioa_addr *a2) { 181| | 182| 14.8k| if (!a1) { ------------------ | Branch (182:7): [True: 0, False: 14.8k] ------------------ 183| 0| return (!a2); 184| 14.8k| } else if (!a2) { ------------------ | Branch (184:14): [True: 0, False: 14.8k] ------------------ 185| 0| return (!a1); 186| 0| } 187| | 188| 14.8k| if (a1->ss.sa_family == a2->ss.sa_family) { ------------------ | Branch (188:7): [True: 7.44k, False: 7.42k] ------------------ 189| 7.44k| if (a1->ss.sa_family == AF_INET) { ------------------ | Branch (189:9): [True: 5.02k, False: 2.41k] ------------------ 190| 5.02k| if ((int)a1->s4.sin_addr.s_addr == (int)a2->s4.sin_addr.s_addr) { ------------------ | Branch (190:11): [True: 19, False: 5.01k] ------------------ 191| 19| return 1; 192| 19| } 193| 5.02k| } else if (a1->ss.sa_family == AF_INET6) { ------------------ | Branch (193:16): [True: 2.41k, False: 0] ------------------ 194| 2.41k| if (memcmp(&(a1->s6.sin6_addr), &(a2->s6.sin6_addr), sizeof(struct in6_addr)) == 0) { ------------------ | Branch (194:11): [True: 16, False: 2.40k] ------------------ 195| 16| return 1; 196| 16| } 197| 2.41k| } 198| 7.44k| } 199| 14.8k| return 0; 200| 14.8k|} make_ioa_addr: 202| 22.2k|int make_ioa_addr(const uint8_t *saddr0, uint16_t port, ioa_addr *addr) { 203| | 204| 22.2k| if (!saddr0 || !addr) { ------------------ | Branch (204:7): [True: 0, False: 22.2k] | Branch (204:18): [True: 0, False: 22.2k] ------------------ 205| 0| return -1; 206| 0| } 207| | 208| 22.2k| char ssaddr[257]; 209| 22.2k| STRCPY(ssaddr, saddr0); ------------------ | | 198| 22.2k| do { \ | | 199| 22.2k| if ((const char *)(dst) != (const char *)(src)) { \ | | ------------------ | | | Branch (199:9): [True: 22.2k, False: 0] | | ------------------ | | 200| 22.2k| if (sizeof(dst) == sizeof(char *)) \ | | ------------------ | | | Branch (200:11): [Folded, False: 22.2k] | | ------------------ | | 201| 22.2k| strcpy(((char *)(dst)), (const char *)(src)); \ | | 202| 22.2k| else { \ | | 203| 22.2k| size_t szdst = sizeof((dst)); \ | | 204| 22.2k| strncpy((char *)(dst), (const char *)(src), szdst); \ | | 205| 22.2k| ((char *)(dst))[szdst - 1] = 0; \ | | 206| 22.2k| } \ | | 207| 22.2k| } \ | | 208| 22.2k| } while (0) | | ------------------ | | | Branch (208:12): [Folded, False: 22.2k] | | ------------------ ------------------ 210| | 211| 22.2k| char *saddr = ssaddr; 212| 22.2k| while (*saddr == ' ') { ------------------ | Branch (212:10): [True: 0, False: 22.2k] ------------------ 213| 0| ++saddr; 214| 0| } 215| | 216| 22.2k| size_t len = strlen(saddr); 217| 22.2k| while (len > 0) { ------------------ | Branch (217:10): [True: 18.7k, False: 3.41k] ------------------ 218| 18.7k| if (saddr[len - 1] == ' ') { ------------------ | Branch (218:9): [True: 0, False: 18.7k] ------------------ 219| 0| saddr[len - 1] = 0; 220| 0| --len; 221| 18.7k| } else { 222| 18.7k| break; 223| 18.7k| } 224| 18.7k| } 225| | 226| 22.2k| memset(addr, 0, sizeof(ioa_addr)); 227| 22.2k| if ((len == 0) || (inet_pton(AF_INET, saddr, &addr->s4.sin_addr) == 1)) { ------------------ | Branch (227:7): [True: 3.41k, False: 18.7k] | Branch (227:21): [True: 10.2k, False: 8.54k] ------------------ 228| 13.6k| addr->s4.sin_family = AF_INET; 229| |#if defined(TURN_HAS_SIN_LEN) /* tested when configured */ 230| | addr->s4.sin_len = sizeof(struct sockaddr_in); 231| |#endif 232| 13.6k| addr->s4.sin_port = nswap16(port); ------------------ | | 86| 13.6k|#define nswap16(s) ntohs(s) ------------------ 233| 13.6k| } else if (inet_pton(AF_INET6, saddr, &addr->s6.sin6_addr) == 1) { ------------------ | Branch (233:14): [True: 8.54k, False: 0] ------------------ 234| 8.54k| addr->s6.sin6_family = AF_INET6; 235| |#if defined(SIN6_LEN) /* this define is required by IPv6 if used */ 236| | addr->s6.sin6_len = sizeof(struct sockaddr_in6); 237| |#endif 238| 8.54k| addr->s6.sin6_port = nswap16(port); ------------------ | | 86| 8.54k|#define nswap16(s) ntohs(s) ------------------ 239| 8.54k| } else { 240| 0| struct addrinfo addr_hints; 241| 0| struct addrinfo *addr_result = NULL; 242| 0| int err; 243| | 244| 0| memset(&addr_hints, 0, sizeof(struct addrinfo)); 245| 0| addr_hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */ 246| 0| addr_hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */ 247| 0| addr_hints.ai_flags = AI_PASSIVE; /* For wildcard IP address */ 248| 0| addr_hints.ai_protocol = 0; /* Any protocol */ 249| 0| addr_hints.ai_canonname = NULL; 250| 0| addr_hints.ai_addr = NULL; 251| 0| addr_hints.ai_next = NULL; 252| | 253| 0| err = getaddrinfo(saddr, NULL, &addr_hints, &addr_result); 254| 0| if ((err != 0) || (!addr_result)) { ------------------ | Branch (254:9): [True: 0, False: 0] | Branch (254:23): [True: 0, False: 0] ------------------ 255| 0| fprintf(stderr, "error resolving '%s' hostname: %s\n", saddr, gai_strerror(err)); 256| 0| return -1; 257| 0| } 258| | 259| 0| int family = AF_INET; 260| 0| struct addrinfo *addr_result_orig = addr_result; 261| 0| int found = 0; 262| | 263| 0| beg_af: 264| | 265| 0| while (addr_result) { ------------------ | Branch (265:12): [True: 0, False: 0] ------------------ 266| | 267| 0| if (addr_result->ai_family == family) { ------------------ | Branch (267:11): [True: 0, False: 0] ------------------ 268| 0| if (addr_result->ai_family == AF_INET) { ------------------ | Branch (268:13): [True: 0, False: 0] ------------------ 269| 0| memcpy(addr, addr_result->ai_addr, addr_result->ai_addrlen); 270| 0| addr->s4.sin_port = nswap16(port); ------------------ | | 86| 0|#define nswap16(s) ntohs(s) ------------------ 271| |#if defined(TURN_HAS_SIN_LEN) /* tested when configured */ 272| | addr->s4.sin_len = sizeof(struct sockaddr_in); 273| |#endif 274| 0| found = 1; 275| 0| break; 276| 0| } else if (addr_result->ai_family == AF_INET6) { ------------------ | Branch (276:20): [True: 0, False: 0] ------------------ 277| 0| memcpy(addr, addr_result->ai_addr, addr_result->ai_addrlen); 278| 0| addr->s6.sin6_port = nswap16(port); ------------------ | | 86| 0|#define nswap16(s) ntohs(s) ------------------ 279| |#if defined(SIN6_LEN) /* this define is required by IPv6 if used */ 280| | addr->s6.sin6_len = sizeof(struct sockaddr_in6); 281| |#endif 282| 0| found = 1; 283| 0| break; 284| 0| } 285| 0| } 286| | 287| 0| addr_result = addr_result->ai_next; 288| 0| } 289| | 290| 0| if (!found && family == AF_INET) { ------------------ | Branch (290:9): [True: 0, False: 0] | Branch (290:19): [True: 0, False: 0] ------------------ 291| 0| family = AF_INET6; 292| 0| addr_result = addr_result_orig; 293| 0| goto beg_af; 294| 0| } 295| | 296| 0| freeaddrinfo(addr_result_orig); 297| 0| } 298| | 299| 22.2k| return 0; 300| 22.2k|} make_ioa_addr_from_full_string: 340| 23.9k|int make_ioa_addr_from_full_string(const uint8_t *saddr, uint16_t default_port, ioa_addr *addr) { 341| 23.9k| if (!addr) { ------------------ | Branch (341:7): [True: 1.70k, False: 22.2k] ------------------ 342| 1.70k| return -1; 343| 1.70k| } 344| | 345| 22.2k| int ret = -1; 346| 22.2k| uint16_t port = 0; 347| 22.2k| char *s = turn_strdup((const char *)saddr); ------------------ | | 122| 22.2k|#define turn_strdup(s) turn_strdup_impl((s), __FILE__, __LINE__) ------------------ 348| 22.2k| char *sa = get_addr_string_and_port(s, &port); 349| 22.2k| if (sa) { ------------------ | Branch (349:7): [True: 22.2k, False: 0] ------------------ 350| 22.2k| if (port < 1) { ------------------ | Branch (350:9): [True: 14.0k, False: 8.18k] ------------------ 351| 14.0k| port = default_port; 352| 14.0k| } 353| 22.2k| ret = make_ioa_addr((uint8_t *)sa, port, addr); 354| 22.2k| } 355| 22.2k| free(s); 356| 22.2k| return ret; 357| 23.9k|} addr_set_port: 407| 35|void addr_set_port(ioa_addr *addr, uint16_t port) { 408| 35| if (addr) { ------------------ | Branch (408:7): [True: 35, False: 0] ------------------ 409| 35| if (addr->s4.sin_family == AF_INET) { ------------------ | Branch (409:9): [True: 19, False: 16] ------------------ 410| 19| addr->s4.sin_port = nswap16(port); ------------------ | | 86| 19|#define nswap16(s) ntohs(s) ------------------ 411| 19| } else if (addr->s6.sin6_family == AF_INET6) { ------------------ | Branch (411:16): [True: 16, False: 0] ------------------ 412| | addr->s6.sin6_port = nswap16(port); ------------------ | | 86| 16|#define nswap16(s) ntohs(s) ------------------ 413| 16| } 414| 35| } 415| 35|} addr_get_port: 417| 35|uint16_t addr_get_port(const ioa_addr *addr) { 418| 35| if (!addr) { ------------------ | Branch (418:7): [True: 0, False: 35] ------------------ 419| 0| return 0; 420| 0| } 421| | 422| 35| if (addr->s4.sin_family == AF_INET) { ------------------ | Branch (422:7): [True: 19, False: 16] ------------------ 423| 19| return nswap16(addr->s4.sin_port); ------------------ | | 86| 19|#define nswap16(s) ntohs(s) ------------------ 424| 19| } else if (addr->s6.sin6_family == AF_INET6) { ------------------ | Branch (424:14): [True: 16, False: 0] ------------------ 425| 16| return nswap16(addr->s6.sin6_port); ------------------ | | 86| 16|#define nswap16(s) ntohs(s) ------------------ 426| 16| } 427| 0| return 0; 428| 35|} ioa_addr_add_mapping: 679| 4|void ioa_addr_add_mapping(ioa_addr *apub, ioa_addr *apriv) { 680| 4| const size_t new_size = msz + sizeof(ioa_addr *); 681| 4| public_addrs = (ioa_addr **)turn_realloc(public_addrs, new_size); ------------------ | | 121| 4|#define turn_realloc(ptr, sz) turn_realloc_impl((ptr), (sz), __FILE__, __LINE__) ------------------ 682| 4| private_addrs = (ioa_addr **)turn_realloc(private_addrs, new_size); ------------------ | | 121| 4|#define turn_realloc(ptr, sz) turn_realloc_impl((ptr), (sz), __FILE__, __LINE__) ------------------ 683| 4| public_addrs[mcount] = (ioa_addr *)turn_malloc(sizeof(ioa_addr)); ------------------ | | 119| 4|#define turn_malloc(sz) turn_malloc_impl((sz), __FILE__, __LINE__) ------------------ 684| 4| private_addrs[mcount] = (ioa_addr *)turn_malloc(sizeof(ioa_addr)); ------------------ | | 119| 4|#define turn_malloc(sz) turn_malloc_impl((sz), __FILE__, __LINE__) ------------------ 685| 4| addr_cpy(public_addrs[mcount], apub); 686| 4| addr_cpy(private_addrs[mcount], apriv); 687| 4| ++mcount; 688| 4| msz += sizeof(ioa_addr *); 689| 4|} map_addr_from_public_to_private: 691| 924|void map_addr_from_public_to_private(const ioa_addr *public_addr, ioa_addr *private_addr) { 692| 924| size_t i; 693| 2.71k| for (i = 0; i < mcount; ++i) { ------------------ | Branch (693:15): [True: 1.82k, False: 889] ------------------ 694| 1.82k| if (addr_eq_no_port(public_addr, public_addrs[i])) { ------------------ | Branch (694:9): [True: 35, False: 1.79k] ------------------ 695| 35| addr_cpy(private_addr, private_addrs[i]); 696| 35| addr_set_port(private_addr, addr_get_port(public_addr)); 697| 35| return; 698| 35| } 699| 1.82k| } 700| 889| addr_cpy(private_addr, public_addr); 701| 889|} map_addr_from_private_to_public: 703| 6.52k|void map_addr_from_private_to_public(const ioa_addr *private_addr, ioa_addr *public_addr) { 704| 6.52k| size_t i; 705| 19.5k| for (i = 0; i < mcount; ++i) { ------------------ | Branch (705:15): [True: 13.0k, False: 6.52k] ------------------ 706| 13.0k| if (addr_eq_no_port(private_addr, private_addrs[i])) { ------------------ | Branch (706:9): [True: 0, False: 13.0k] ------------------ 707| 0| addr_cpy(public_addr, public_addrs[i]); 708| 0| addr_set_port(public_addr, addr_get_port(private_addr)); 709| 0| return; 710| 0| } 711| 13.0k| } 712| 6.52k| addr_cpy(public_addr, private_addr); 713| 6.52k|} ns_turn_ioaddr.c:get_addr_string_and_port: 302| 22.2k|static char *get_addr_string_and_port(char *s0, uint16_t *port) { 303| 22.2k| char *s = s0; 304| 25.6k| while (*s && (*s == ' ')) { ------------------ | Branch (304:10): [True: 23.9k, False: 1.70k] | Branch (304:16): [True: 3.41k, False: 20.4k] ------------------ 305| 3.41k| ++s; 306| 3.41k| } 307| 22.2k| if (*s == '[') { ------------------ | Branch (307:7): [True: 8.54k, False: 13.6k] ------------------ 308| 8.54k| ++s; 309| 8.54k| char *tail = strstr(s, "]"); 310| 8.54k| if (tail) { ------------------ | Branch (310:9): [True: 8.54k, False: 0] ------------------ 311| 8.54k| *tail = 0; 312| 8.54k| ++tail; 313| 11.9k| while (*tail && (*tail == ' ')) { ------------------ | Branch (313:14): [True: 6.83k, False: 5.12k] | Branch (313:23): [True: 3.41k, False: 3.41k] ------------------ 314| 3.41k| ++tail; 315| 3.41k| } 316| 8.54k| if (*tail == ':') { ------------------ | Branch (316:11): [True: 3.41k, False: 5.12k] ------------------ 317| 3.41k| ++tail; 318| 3.41k| *port = atoi(tail); 319| 3.41k| return s; 320| 5.12k| } else if (*tail == 0) { ------------------ | Branch (320:18): [True: 5.12k, False: 0] ------------------ 321| 5.12k| *port = 0; 322| 5.12k| return s; 323| 5.12k| } 324| 8.54k| } 325| 13.6k| } else { 326| 13.6k| char *tail = strstr(s, ":"); 327| 13.6k| if (tail) { ------------------ | Branch (327:9): [True: 8.54k, False: 5.12k] ------------------ 328| 8.54k| *tail = 0; 329| 8.54k| ++tail; 330| 8.54k| *port = atoi(tail); 331| 8.54k| return s; 332| 8.54k| } else { 333| 5.12k| *port = 0; 334| 5.12k| return s; 335| 5.12k| } 336| 13.6k| } 337| 0| return NULL; 338| 22.2k|} ns_turn_ioaddr.c:addr_cpy: 87| 7.45k|static inline void addr_cpy(ioa_addr *dst, const ioa_addr *src) { 88| 7.45k| if (dst && src) { ------------------ | Branch (88:7): [True: 7.45k, False: 0] | Branch (88:14): [True: 7.45k, False: 0] ------------------ 89| 7.45k| memcpy(dst, src, sizeof(ioa_addr)); 90| 7.45k| } 91| 7.45k|} turn_random_number: 123| 56.3k|long turn_random_number(void) { 124| 56.3k| long ret = 0; 125| 56.3k|#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION) 126| 56.3k| ret = (long)fuzz_prng_next(); 127| |#else 128| | if (!RAND_bytes((unsigned char *)&ret, sizeof(ret))) 129| |#if defined(WINDOWS) 130| | ret = rand(); 131| |#else 132| | ret = random(); 133| |#endif 134| |#endif 135| 56.3k| return ret; 136| 56.3k|} stun_calculate_hmac: 172| 7.13k| unsigned int *hmac_len, SHATYPE shatype) { 173| 7.13k| ERR_clear_error(); 174| 7.13k| UNUSED_ARG(shatype); ------------------ | | 174| 7.13k| do { \ | | 175| 7.13k| A = A; \ | | 176| 7.13k| } while (0) | | ------------------ | | | Branch (176:12): [Folded, False: 7.13k] | | ------------------ ------------------ 175| | 176| 7.13k| if (shatype == SHATYPE_SHA256) { ------------------ | Branch (176:7): [True: 2.57k, False: 4.55k] ------------------ 177| 2.57k|#if !defined(OPENSSL_NO_SHA256) && defined(SHA256_DIGEST_LENGTH) 178| 2.57k| if (!HMAC(EVP_sha256(), key, (int)keylen, buf, len, hmac, hmac_len)) { ------------------ | Branch (178:9): [True: 0, False: 2.57k] ------------------ 179| 0| return false; 180| 0| } 181| |#else 182| | fprintf(stderr, "SHA256 is not supported\n"); 183| | return false; 184| |#endif 185| 4.55k| } else if (shatype == SHATYPE_SHA384) { ------------------ | Branch (185:14): [True: 994, False: 3.55k] ------------------ 186| 994|#if !defined(OPENSSL_NO_SHA384) && defined(SHA384_DIGEST_LENGTH) 187| 994| if (!HMAC(EVP_sha384(), key, (int)keylen, buf, len, hmac, hmac_len)) { ------------------ | Branch (187:9): [True: 0, False: 994] ------------------ 188| 0| return false; 189| 0| } 190| |#else 191| | fprintf(stderr, "SHA384 is not supported\n"); 192| | return false; 193| |#endif 194| 3.55k| } else if (shatype == SHATYPE_SHA512) { ------------------ | Branch (194:14): [True: 1.16k, False: 2.39k] ------------------ 195| 1.16k|#if !defined(OPENSSL_NO_SHA512) && defined(SHA512_DIGEST_LENGTH) 196| 1.16k| if (!HMAC(EVP_sha512(), key, (int)keylen, buf, len, hmac, hmac_len)) { ------------------ | Branch (196:9): [True: 0, False: 1.16k] ------------------ 197| 0| return false; 198| 0| } 199| |#else 200| | fprintf(stderr, "SHA512 is not supported\n"); 201| | return false; 202| |#endif 203| 2.39k| } else if (!HMAC(EVP_sha1(), key, (int)keylen, buf, len, hmac, hmac_len)) { ------------------ | Branch (203:14): [True: 0, False: 2.39k] ------------------ 204| 0| return false; 205| 0| } 206| | 207| 7.13k| return true; 208| 7.13k|} stun_produce_integrity_key_str: 211| 9.39k| SHATYPE shatype) { 212| 9.39k| bool ret; 213| | 214| 9.39k| ERR_clear_error(); 215| 9.39k| UNUSED_ARG(shatype); ------------------ | | 174| 9.39k| do { \ | | 175| 9.39k| A = A; \ | | 176| 9.39k| } while (0) | | ------------------ | | | Branch (176:12): [Folded, False: 9.39k] | | ------------------ ------------------ 216| | 217| 9.39k| const size_t ulen = strlen((const char *)uname); 218| 9.39k| const size_t rlen = strlen((const char *)realm); 219| 9.39k| const size_t plen = strlen((const char *)upwd); 220| 9.39k| const size_t sz = ulen + 1 + rlen + 1 + plen + 1 + 10; 221| 9.39k| const size_t strl = ulen + 1 + rlen + 1 + plen; 222| 9.39k| uint8_t *str = (uint8_t *)turn_malloc(sz + 1); ------------------ | | 119| 9.39k|#define turn_malloc(sz) turn_malloc_impl((sz), __FILE__, __LINE__) ------------------ 223| | 224| 9.39k| strncpy((char *)str, (const char *)uname, sz); 225| 9.39k| str[ulen] = ':'; 226| 9.39k| strncpy((char *)str + ulen + 1, (const char *)realm, sz - ulen - 1); 227| 9.39k| str[ulen + 1 + rlen] = ':'; 228| 9.39k| strncpy((char *)str + ulen + 1 + rlen + 1, (const char *)upwd, sz - ulen - 1 - rlen - 1); 229| 9.39k| str[strl] = 0; 230| | 231| 9.39k| if (shatype == SHATYPE_SHA256) { ------------------ | Branch (231:7): [True: 3.72k, False: 5.67k] ------------------ 232| 3.72k|#if !defined(OPENSSL_NO_SHA256) && defined(SHA256_DIGEST_LENGTH) 233| 3.72k| unsigned int keylen = 0; 234| 3.72k| EVP_MD_CTX *ctx = EVP_MD_CTX_new(); 235| 3.72k| EVP_DigestInit(ctx, EVP_sha256()); 236| 3.72k| EVP_DigestUpdate(ctx, str, strl); 237| 3.72k| EVP_DigestFinal(ctx, key, &keylen); 238| 3.72k| EVP_MD_CTX_free(ctx); 239| 3.72k| ret = true; 240| |#else 241| | fprintf(stderr, "SHA256 is not supported\n"); 242| | ret = false; 243| |#endif 244| 5.67k| } else if (shatype == SHATYPE_SHA384) { ------------------ | Branch (244:14): [True: 1.78k, False: 3.89k] ------------------ 245| 1.78k|#if !defined(OPENSSL_NO_SHA384) && defined(SHA384_DIGEST_LENGTH) 246| 1.78k| unsigned int keylen = 0; 247| 1.78k| EVP_MD_CTX *ctx = EVP_MD_CTX_new(); 248| 1.78k| EVP_DigestInit(ctx, EVP_sha384()); 249| 1.78k| EVP_DigestUpdate(ctx, str, strl); 250| 1.78k| EVP_DigestFinal(ctx, key, &keylen); 251| 1.78k| EVP_MD_CTX_free(ctx); 252| 1.78k| ret = true; 253| |#else 254| | fprintf(stderr, "SHA384 is not supported\n"); 255| | ret = false; 256| |#endif 257| 3.89k| } else if (shatype == SHATYPE_SHA512) { ------------------ | Branch (257:14): [True: 1.82k, False: 2.07k] ------------------ 258| 1.82k|#if !defined(OPENSSL_NO_SHA512) && defined(SHA512_DIGEST_LENGTH) 259| 1.82k| unsigned int keylen = 0; 260| 1.82k| EVP_MD_CTX *ctx = EVP_MD_CTX_new(); 261| 1.82k| EVP_DigestInit(ctx, EVP_sha512()); 262| 1.82k| EVP_DigestUpdate(ctx, str, strl); 263| 1.82k| EVP_DigestFinal(ctx, key, &keylen); 264| 1.82k| EVP_MD_CTX_free(ctx); 265| 1.82k| ret = true; 266| |#else 267| | fprintf(stderr, "SHA512 is not supported\n"); 268| | ret = false; 269| |#endif 270| 2.07k| } else { 271| 2.07k|#if OPENSSL_VERSION_NUMBER >= 0x30000000L 272| 2.07k| unsigned int keylen = 0; 273| 2.07k| EVP_MD_CTX *ctx = EVP_MD_CTX_new(); 274| 2.07k| if (EVP_default_properties_is_fips_enabled(NULL)) { ------------------ | Branch (274:9): [True: 0, False: 2.07k] ------------------ 275| 0| EVP_default_properties_enable_fips(NULL, 0); 276| 0| } 277| 2.07k| EVP_DigestInit_ex(ctx, EVP_md5(), NULL); 278| 2.07k| EVP_DigestUpdate(ctx, str, strl); 279| 2.07k| EVP_DigestFinal(ctx, key, &keylen); 280| 2.07k| EVP_MD_CTX_free(ctx); 281| |#else // OPENSSL_VERSION_NUMBER < 0x30000000L 282| | unsigned int keylen = 0; 283| | EVP_MD_CTX *ctx = EVP_MD_CTX_new(); 284| |#if defined EVP_MD_CTX_FLAG_NON_FIPS_ALLOW && !defined(LIBRESSL_VERSION_NUMBER) 285| | if (FIPS_mode()) { 286| | EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); 287| | } 288| |#endif 289| | EVP_DigestInit_ex(ctx, EVP_md5(), NULL); 290| | EVP_DigestUpdate(ctx, str, strl); 291| | EVP_DigestFinal(ctx, key, &keylen); 292| | EVP_MD_CTX_free(ctx); 293| |#endif // OPENSSL_VERSION_NUMBER >= 0X30000000L 294| 2.07k| ret = true; 295| 2.07k| } 296| | 297| 9.39k| free(str); 298| | 299| 9.39k| return ret; 300| 9.39k|} stun_get_command_message_len_str: 394| 2.18M|int stun_get_command_message_len_str(const uint8_t *buf, size_t len) { 395| 2.18M| if (len < STUN_HEADER_LENGTH) { ------------------ | | 46| 2.18M|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (395:7): [True: 22, False: 2.18M] ------------------ 396| 22| return -1; 397| 22| } 398| | 399| | /* Validate the size the buffer claims to be */ 400| 2.18M| const size_t bufLen = (size_t)(nswap16(((const uint16_t *)(buf))[1]) + STUN_HEADER_LENGTH); ------------------ | | 86| 2.18M|#define nswap16(s) ntohs(s) ------------------ const size_t bufLen = (size_t)(nswap16(((const uint16_t *)(buf))[1]) + STUN_HEADER_LENGTH); ------------------ | | 46| 2.18M|#define STUN_HEADER_LENGTH (20) ------------------ 401| 2.18M| if (bufLen > len) { ------------------ | Branch (401:7): [True: 940, False: 2.18M] ------------------ 402| 940| return -1; 403| 940| } 404| | 405| 2.18M| return bufLen; 406| 2.18M|} stun_make_type: 418| 18.7k|uint16_t stun_make_type(uint16_t method) { 419| 18.7k| method = method & 0x0FFF; 420| 18.7k| return ((method & 0x000F) | ((method & 0x0070) << 1) | ((method & 0x0380) << 2) | ((method & 0x0C00) << 2)); 421| 18.7k|} stun_get_method_str: 423| 5.07k|uint16_t stun_get_method_str(const uint8_t *buf, size_t len) { 424| 5.07k| if (!buf || len < 2) { ------------------ | Branch (424:7): [True: 0, False: 5.07k] | Branch (424:15): [True: 0, False: 5.07k] ------------------ 425| 0| return (uint16_t)-1; 426| 0| } 427| | 428| 5.07k| const uint16_t tt = nswap16(((const uint16_t *)buf)[0]); ------------------ | | 86| 5.07k|#define nswap16(s) ntohs(s) ------------------ 429| | 430| 5.07k| return (tt & 0x000F) | ((tt & 0x00E0) >> 1) | ((tt & 0x0E00) >> 2) | ((tt & 0x3000) >> 2); 431| 5.07k|} stun_get_msg_type_str: 433| 23.6k|uint16_t stun_get_msg_type_str(const uint8_t *buf, size_t len) { 434| 23.6k| if (!buf || len < 2) { ------------------ | Branch (434:7): [True: 0, False: 23.6k] | Branch (434:15): [True: 0, False: 23.6k] ------------------ 435| 0| return (uint16_t)-1; 436| 0| } 437| 23.6k| return ((nswap16(((const uint16_t *)buf)[0])) & 0x3FFF); ------------------ | | 86| 23.6k|#define nswap16(s) ntohs(s) ------------------ 438| 23.6k|} is_channel_msg_str: 440| 23.4k|bool is_channel_msg_str(const uint8_t *buf, size_t blen) { 441| 23.4k| return (buf && blen >= 4 && STUN_VALID_CHANNEL(nswap16(((const uint16_t *)buf)[0]))); ------------------ | | 144| 23.4k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (144:34): [True: 0, False: 23.4k] | | | Branch (144:53): [True: 0, False: 0] | | ------------------ ------------------ | Branch (441:11): [True: 23.4k, False: 0] | Branch (441:18): [True: 23.4k, False: 0] ------------------ 442| 23.4k|} stun_is_command_message_str: 446| 13.0k|bool stun_is_command_message_str(const uint8_t *buf, size_t blen) { 447| 13.0k| if (buf && blen >= STUN_HEADER_LENGTH) { ------------------ | | 46| 13.0k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (447:7): [True: 13.0k, False: 0] | Branch (447:14): [True: 12.9k, False: 11] ------------------ 448| 12.9k| if (!STUN_VALID_CHANNEL(nswap16(((const uint16_t *)buf)[0]))) { ------------------ | | 144| 12.9k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (144:34): [True: 344, False: 12.6k] | | | Branch (144:53): [True: 64, False: 280] | | ------------------ ------------------ 449| 12.9k| if ((((uint8_t)buf[0]) & ((uint8_t)(0xC0))) == 0) { ------------------ | Branch (449:11): [True: 12.6k, False: 280] ------------------ 450| 12.6k| if (nswap32(((const uint32_t *)(buf))[1]) == STUN_MAGIC_COOKIE) { ------------------ | | 87| 12.6k|#define nswap32(ul) ntohl(ul) ------------------ if (nswap32(((const uint32_t *)(buf))[1]) == STUN_MAGIC_COOKIE) { ------------------ | | 56| 12.6k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (450:13): [True: 9.37k, False: 3.27k] ------------------ 451| 9.37k| const uint16_t len = nswap16(((const uint16_t *)(buf))[1]); ------------------ | | 86| 9.37k|#define nswap16(s) ntohs(s) ------------------ 452| 9.37k| if ((len & 0x0003) == 0) { ------------------ | Branch (452:15): [True: 9.28k, False: 86] ------------------ 453| 9.28k| if ((size_t)(len + STUN_HEADER_LENGTH) == blen) { ------------------ | | 46| 9.28k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (453:17): [True: 8.79k, False: 494] ------------------ 454| 8.79k| return true; 455| 8.79k| } 456| 9.28k| } 457| 9.37k| } 458| 12.6k| } 459| 12.9k| } 460| 12.9k| } 461| 4.21k| return false; 462| 13.0k|} old_stun_is_command_message_str: 464| 1.53k|bool old_stun_is_command_message_str(const uint8_t *buf, size_t blen, uint32_t *cookie) { 465| 1.53k| if (buf && blen >= STUN_HEADER_LENGTH) { ------------------ | | 46| 1.53k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (465:7): [True: 1.53k, False: 0] | Branch (465:14): [True: 1.53k, False: 0] ------------------ 466| 1.53k| if (!STUN_VALID_CHANNEL(nswap16(((const uint16_t *)buf)[0]))) { ------------------ | | 144| 1.53k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (144:34): [True: 43, False: 1.49k] | | | Branch (144:53): [True: 8, False: 35] | | ------------------ ------------------ 467| 1.52k| if ((((uint8_t)buf[0]) & ((uint8_t)(0xC0))) == 0) { ------------------ | Branch (467:11): [True: 1.49k, False: 35] ------------------ 468| 1.49k| if (nswap32(((const uint32_t *)(buf))[1]) != STUN_MAGIC_COOKIE) { ------------------ | | 87| 1.49k|#define nswap32(ul) ntohl(ul) ------------------ if (nswap32(((const uint32_t *)(buf))[1]) != STUN_MAGIC_COOKIE) { ------------------ | | 56| 1.49k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (468:13): [True: 319, False: 1.17k] ------------------ 469| 319| const uint16_t len = nswap16(((const uint16_t *)(buf))[1]); ------------------ | | 86| 319|#define nswap16(s) ntohs(s) ------------------ 470| 319| if ((len & 0x0003) == 0) { ------------------ | Branch (470:15): [True: 261, False: 58] ------------------ 471| 261| if ((size_t)(len + STUN_HEADER_LENGTH) == blen) { ------------------ | | 46| 261|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (471:17): [True: 184, False: 77] ------------------ 472| 184| *cookie = nswap32(((const uint32_t *)(buf))[1]); ------------------ | | 87| 184|#define nswap32(ul) ntohl(ul) ------------------ 473| 184| return true; 474| 184| } 475| 261| } 476| 319| } 477| 1.49k| } 478| 1.52k| } 479| 1.53k| } 480| 1.35k| return false; 481| 1.53k|} stun_is_command_message_full_check_str: 484| 8.05k| int *fingerprint_present) { 485| 8.05k| if (!stun_is_command_message_str(buf, blen)) { ------------------ | Branch (485:7): [True: 2.55k, False: 5.50k] ------------------ 486| 2.55k| return false; 487| 2.55k| } 488| 5.50k| stun_attr_ref sar = stun_attr_get_first_by_type_str(buf, blen, STUN_ATTRIBUTE_FINGERPRINT); ------------------ | | 111| 5.50k|#define STUN_ATTRIBUTE_FINGERPRINT (0x8028) ------------------ 489| 5.50k| if (!sar) { ------------------ | Branch (489:7): [True: 4.89k, False: 605] ------------------ 490| 4.89k| if (fingerprint_present) { ------------------ | Branch (490:9): [True: 0, False: 4.89k] ------------------ 491| 0| *fingerprint_present = 0; 492| 0| } 493| 4.89k| if (stun_get_method_str(buf, blen) == STUN_METHOD_BINDING) { ------------------ | | 77| 4.89k|#define STUN_METHOD_BINDING (0x0001) ------------------ | Branch (493:9): [True: 160, False: 4.73k] ------------------ 494| 160| return true; 495| 160| } 496| 4.73k| return !must_check_fingerprint; 497| 4.89k| } 498| 605| if (stun_attr_get_len(sar) != 4) { ------------------ | Branch (498:7): [True: 140, False: 465] ------------------ 499| 140| return false; 500| 140| } 501| 465| const uint32_t *fingerprint = (const uint32_t *)stun_attr_get_value(sar); 502| 465| if (!fingerprint) { ------------------ | Branch (502:7): [True: 0, False: 465] ------------------ 503| 0| return !must_check_fingerprint; 504| 0| } 505| 465| const uint32_t crc32len = (uint32_t)((((const uint8_t *)fingerprint) - buf) - 4); 506| 465| const bool ret = (*fingerprint == nswap32(ns_crc32(buf, crc32len) ^ ((uint32_t)FINGERPRINT_XOR))); ------------------ | | 87| 465|#define nswap32(ul) ntohl(ul) ------------------ 507| 465| if (ret && fingerprint_present) { ------------------ | Branch (507:7): [True: 5, False: 460] | Branch (507:14): [True: 0, False: 5] ------------------ 508| 0| *fingerprint_present = ret; 509| 0| } 510| 465| return ret; 511| 465|} stun_is_request_str: 513| 184|bool stun_is_request_str(const uint8_t *buf, size_t len) { 514| 184| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (514:7): [True: 0, False: 184] ------------------ 515| 0| return false; 516| 0| } 517| 184| return IS_STUN_REQUEST(stun_get_msg_type_str(buf, len)); ------------------ | | 58| 184|#define IS_STUN_REQUEST(msg_type) (((msg_type)&0x0110) == 0x0000) ------------------ 518| 184|} stun_is_success_response_str: 520| 184|bool stun_is_success_response_str(const uint8_t *buf, size_t len) { 521| 184| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (521:7): [True: 0, False: 184] ------------------ 522| 0| return false; 523| 0| } 524| 184| return IS_STUN_SUCCESS_RESP(stun_get_msg_type_str(buf, len)); ------------------ | | 60| 184|#define IS_STUN_SUCCESS_RESP(msg_type) (((msg_type)&0x0110) == 0x0100) ------------------ 525| 184|} stun_is_error_response_str: 527| 22.8k|bool stun_is_error_response_str(const uint8_t *buf, size_t len, int *err_code, uint8_t *err_msg, size_t err_msg_size) { 528| 22.8k| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (528:7): [True: 0, False: 22.8k] ------------------ 529| 0| return false; 530| 0| } 531| 22.8k| if (IS_STUN_ERR_RESP(stun_get_msg_type_str(buf, len))) { ------------------ | | 61| 22.8k|#define IS_STUN_ERR_RESP(msg_type) (((msg_type)&0x0110) == 0x0110) | | ------------------ | | | Branch (61:36): [True: 21.2k, False: 1.68k] | | ------------------ ------------------ 532| 21.2k| if (err_code) { ------------------ | Branch (532:9): [True: 21.2k, False: 0] ------------------ 533| 21.2k| stun_attr_ref sar = stun_attr_get_first_by_type_str(buf, len, STUN_ATTRIBUTE_ERROR_CODE); ------------------ | | 99| 21.2k|#define STUN_ATTRIBUTE_ERROR_CODE (0x0009) ------------------ 534| 21.2k| if (sar) { ------------------ | Branch (534:11): [True: 20.7k, False: 465] ------------------ 535| 20.7k| if (stun_attr_get_len(sar) >= 4) { ------------------ | Branch (535:13): [True: 20.7k, False: 22] ------------------ 536| 20.7k| const uint8_t *val = (const uint8_t *)stun_attr_get_value(sar); 537| 20.7k| *err_code = (int)(val[2] * 100 + val[3]); 538| 20.7k| if (err_msg && err_msg_size > 0) { ------------------ | Branch (538:15): [True: 20.7k, False: 0] | Branch (538:26): [True: 20.7k, False: 0] ------------------ 539| 20.7k| err_msg[0] = 0; 540| 20.7k| if (stun_attr_get_len(sar) > 4) { ------------------ | Branch (540:17): [True: 20.6k, False: 85] ------------------ 541| 20.6k| size_t msg_len = stun_attr_get_len(sar) - 4; 542| 20.6k| if (msg_len > (err_msg_size - 1)) { ------------------ | Branch (542:19): [True: 20, False: 20.6k] ------------------ 543| 20| msg_len = err_msg_size - 1; 544| 20| } 545| 20.6k| memcpy(err_msg, val + 4, msg_len); 546| 20.6k| err_msg[msg_len] = 0; 547| 20.6k| } 548| 20.7k| } 549| 20.7k| } 550| 20.7k| } 551| 21.2k| } 552| 21.2k| return true; 553| 21.2k| } 554| 1.68k| return false; 555| 22.8k|} stun_is_challenge_response_str: 559| 21.6k| bool *oauth) { 560| 21.6k| const bool ret = stun_is_error_response_str(buf, len, err_code, err_msg, err_msg_size); 561| | 562| 21.6k| if (ret && (((*err_code) == 401) || ((*err_code) == 438))) { ------------------ | Branch (562:7): [True: 20.8k, False: 790] | Branch (562:15): [True: 13.7k, False: 7.10k] | Branch (562:39): [True: 3.42k, False: 3.68k] ------------------ 563| 17.1k| stun_attr_ref sar = stun_attr_get_first_by_type_str(buf, len, STUN_ATTRIBUTE_REALM); ------------------ | | 102| 17.1k|#define STUN_ATTRIBUTE_REALM (0x0014) ------------------ 564| 17.1k| if (sar) { ------------------ | Branch (564:9): [True: 13.7k, False: 3.42k] ------------------ 565| 13.7k| bool found_oauth = false; 566| | 567| 13.7k| const uint8_t *value = stun_attr_get_value(sar); 568| 13.7k| if (value) { ------------------ | Branch (568:11): [True: 13.7k, False: 1] ------------------ 569| 13.7k| size_t vlen = (size_t)stun_attr_get_len(sar); 570| 13.7k| vlen = min(vlen, (size_t)STUN_MAX_REALM_SIZE); ------------------ | | 138| 13.7k|#define min(a, b) ((a) <= (b) ? (a) : (b)) | | ------------------ | | | Branch (138:20): [True: 13.6k, False: 13] | | ------------------ ------------------ 571| 13.7k| memcpy(realm, value, vlen); 572| 13.7k| realm[vlen] = 0; 573| 13.7k| { 574| 13.7k| sar = stun_attr_get_first_by_type_str(buf, len, STUN_ATTRIBUTE_THIRD_PARTY_AUTHORIZATION); ------------------ | | 208| 13.7k|#define STUN_ATTRIBUTE_THIRD_PARTY_AUTHORIZATION (0x802E) ------------------ 575| 13.7k| if (sar) { ------------------ | Branch (575:15): [True: 3.43k, False: 10.2k] ------------------ 576| 3.43k| value = stun_attr_get_value(sar); 577| 3.43k| if (value) { ------------------ | Branch (577:17): [True: 3.43k, False: 2] ------------------ 578| 3.43k| vlen = (size_t)stun_attr_get_len(sar); 579| 3.43k| vlen = min(vlen, (size_t)STUN_MAX_SERVER_NAME_SIZE); ------------------ | | 138| 3.43k|#define min(a, b) ((a) <= (b) ? (a) : (b)) | | ------------------ | | | Branch (138:20): [True: 3.43k, False: 3] | | ------------------ ------------------ 580| 3.43k| if (vlen > 0) { ------------------ | Branch (580:19): [True: 3.43k, False: 0] ------------------ 581| 3.43k| if (server_name) { ------------------ | Branch (581:21): [True: 3.43k, False: 0] ------------------ 582| 3.43k| memcpy(server_name, value, vlen); 583| 3.43k| server_name[vlen] = 0; 584| 3.43k| } 585| 3.43k| found_oauth = true; 586| 3.43k| } 587| 3.43k| } 588| 3.43k| } 589| 13.7k| } 590| | 591| 13.7k| sar = stun_attr_get_first_by_type_str(buf, len, STUN_ATTRIBUTE_NONCE); ------------------ | | 103| 13.7k|#define STUN_ATTRIBUTE_NONCE (0x0015) ------------------ 592| 13.7k| if (sar) { ------------------ | Branch (592:13): [True: 10.2k, False: 3.44k] ------------------ 593| 10.2k| value = stun_attr_get_value(sar); 594| 10.2k| if (value) { ------------------ | Branch (594:15): [True: 10.2k, False: 4] ------------------ 595| 10.2k| vlen = (size_t)stun_attr_get_len(sar); 596| 10.2k| vlen = min(vlen, (size_t)STUN_MAX_NONCE_SIZE); ------------------ | | 138| 10.2k|#define min(a, b) ((a) <= (b) ? (a) : (b)) | | ------------------ | | | Branch (138:20): [True: 10.2k, False: 3] | | ------------------ ------------------ 597| 10.2k| memcpy(nonce, value, vlen); 598| 10.2k| nonce[vlen] = 0; 599| 10.2k| if (oauth) { ------------------ | Branch (599:17): [True: 5.13k, False: 5.12k] ------------------ 600| 5.13k| *oauth = found_oauth; 601| 5.13k| } 602| 10.2k| return true; 603| 10.2k| } 604| 10.2k| } 605| 13.7k| } 606| 13.7k| } 607| 17.1k| } 608| | 609| 11.3k| return false; 610| 21.6k|} stun_is_indication_str: 625| 184|bool stun_is_indication_str(const uint8_t *buf, size_t len) { 626| 184| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (626:7): [True: 0, False: 184] ------------------ 627| 0| return false; 628| 0| } 629| 184| return IS_STUN_INDICATION(stun_get_msg_type_str(buf, len)); ------------------ | | 59| 184|#define IS_STUN_INDICATION(msg_type) (((msg_type)&0x0110) == 0x0010) ------------------ 630| 184|} stun_make_request: 632| 8.54k|uint16_t stun_make_request(uint16_t method) { return GET_STUN_REQUEST(stun_make_type(method)); } ------------------ | | 63| 8.54k|#define GET_STUN_REQUEST(msg_type) (msg_type & 0xFEEF) ------------------ stun_make_error_response: 638| 10.2k|uint16_t stun_make_error_response(uint16_t method) { return GET_STUN_ERR_RESP(stun_make_type(method)); } ------------------ | | 66| 10.2k|#define GET_STUN_ERR_RESP(msg_type) (msg_type | 0x0110) ------------------ stun_init_buffer_str: 642| 18.7k|void stun_init_buffer_str(uint8_t *buf, size_t *len) { 643| 18.7k| *len = STUN_HEADER_LENGTH; ------------------ | | 46| 18.7k|#define STUN_HEADER_LENGTH (20) ------------------ 644| 18.7k| memset(buf, 0, *len); 645| 18.7k|} stun_init_command_str: 647| 18.7k|void stun_init_command_str(uint16_t message_type, uint8_t *buf, size_t *len) { 648| 18.7k| stun_init_buffer_str(buf, len); 649| 18.7k| message_type &= (uint16_t)(0x3FFF); 650| 18.7k| ((uint16_t *)buf)[0] = nswap16(message_type); ------------------ | | 86| 18.7k|#define nswap16(s) ntohs(s) ------------------ 651| 18.7k| ((uint16_t *)buf)[1] = 0; 652| 18.7k| ((uint32_t *)buf)[1] = nswap32(STUN_MAGIC_COOKIE); ------------------ | | 87| 18.7k|#define nswap32(ul) ntohl(ul) ------------------ 653| | stun_tid_generate_in_message_str(buf, NULL); 654| 18.7k|} stun_init_request_str: 665| 8.54k|void stun_init_request_str(uint16_t method, uint8_t *buf, size_t *len) { 666| 8.54k| stun_init_command_str(stun_make_request(method), buf, len); 667| 8.54k|} get_default_reason: 687| 1.08k|const uint8_t *get_default_reason(int error_code) { 688| 1.08k| const char *reason = "Unknown error"; 689| | 690| 1.08k| switch (error_code) { 691| 0| case 300: ------------------ | Branch (691:3): [True: 0, False: 1.08k] ------------------ 692| 0| reason = "Try Alternate"; 693| 0| break; 694| 0| case 400: ------------------ | Branch (694:3): [True: 0, False: 1.08k] ------------------ 695| 0| reason = "Bad Request"; 696| 0| break; 697| 0| case 401: ------------------ | Branch (697:3): [True: 0, False: 1.08k] ------------------ 698| 0| reason = "Unauthorized"; 699| 0| break; 700| 0| case 403: ------------------ | Branch (700:3): [True: 0, False: 1.08k] ------------------ 701| 0| reason = "Forbidden"; 702| 0| break; 703| 0| case 404: ------------------ | Branch (703:3): [True: 0, False: 1.08k] ------------------ 704| 0| reason = "Not Found"; 705| 0| break; 706| 0| case 420: ------------------ | Branch (706:3): [True: 0, False: 1.08k] ------------------ 707| 0| reason = "Unknown Attribute"; 708| 0| break; 709| 0| case 437: ------------------ | Branch (709:3): [True: 0, False: 1.08k] ------------------ 710| 0| reason = "Allocation Mismatch"; 711| 0| break; 712| 0| case 438: ------------------ | Branch (712:3): [True: 0, False: 1.08k] ------------------ 713| 0| reason = "Stale Nonce"; 714| 0| break; 715| 1.08k| case 440: ------------------ | Branch (715:3): [True: 1.08k, False: 0] ------------------ 716| 1.08k| reason = "Address Family not Supported"; 717| 1.08k| break; 718| 0| case 441: ------------------ | Branch (718:3): [True: 0, False: 1.08k] ------------------ 719| 0| reason = "Wrong Credentials"; 720| 0| break; 721| 0| case 442: ------------------ | Branch (721:3): [True: 0, False: 1.08k] ------------------ 722| 0| reason = "Unsupported Transport Protocol"; 723| 0| break; 724| 0| case 443: ------------------ | Branch (724:3): [True: 0, False: 1.08k] ------------------ 725| 0| reason = "Peer Address Family Mismatch"; 726| 0| break; 727| 0| case 446: ------------------ | Branch (727:3): [True: 0, False: 1.08k] ------------------ 728| 0| reason = "Connection Already Exists"; 729| 0| break; 730| 0| case 447: ------------------ | Branch (730:3): [True: 0, False: 1.08k] ------------------ 731| 0| reason = "Connection Timeout or Failure"; 732| 0| break; 733| 0| case 486: ------------------ | Branch (733:3): [True: 0, False: 1.08k] ------------------ 734| 0| reason = "Allocation Quota Reached"; 735| 0| break; 736| 0| case 487: ------------------ | Branch (736:3): [True: 0, False: 1.08k] ------------------ 737| 0| reason = "Role Conflict"; 738| 0| break; 739| 0| case 500: ------------------ | Branch (739:3): [True: 0, False: 1.08k] ------------------ 740| 0| reason = "Server Error"; 741| 0| break; 742| 0| case 508: ------------------ | Branch (742:3): [True: 0, False: 1.08k] ------------------ 743| 0| reason = "Insufficient Capacity"; 744| 0| break; 745| 0| default:; ------------------ | Branch (745:3): [True: 0, False: 1.08k] ------------------ 746| 1.08k| }; 747| | 748| 1.08k| return (const uint8_t *)reason; 749| 1.08k|} stun_init_error_response_str: 794| 10.2k| const uint8_t *reason, stun_tid *id, bool include_reason_string) { 795| | 796| 10.2k| stun_init_command_str(stun_make_error_response(method), buf, len); 797| | 798| 10.2k| stun_init_error_response_common_str(buf, len, error_code, reason, id, include_reason_string); 799| 10.2k|} stun_is_binding_request_str: 1238| 184|bool stun_is_binding_request_str(const uint8_t *buf, size_t len, size_t offset) { 1239| 184| if (offset < len) { ------------------ | Branch (1239:7): [True: 184, False: 0] ------------------ 1240| 184| buf += offset; 1241| 184| len -= offset; 1242| 184| if (stun_is_command_message_str(buf, len)) { ------------------ | Branch (1242:9): [True: 0, False: 184] ------------------ 1243| 0| if (stun_is_request_str(buf, len) && (stun_get_method_str(buf, len) == STUN_METHOD_BINDING)) { ------------------ | | 77| 0|#define STUN_METHOD_BINDING (0x0001) ------------------ | Branch (1243:11): [True: 0, False: 0] | Branch (1243:44): [True: 0, False: 0] ------------------ 1244| 0| return true; 1245| 0| } 1246| 0| } 1247| 184| } 1248| 184| return false; 1249| 184|} stun_is_binding_response_str: 1251| 184|bool stun_is_binding_response_str(const uint8_t *buf, size_t len) { 1252| 184| if (stun_is_command_message_str(buf, len) && (stun_get_method_str(buf, len) == STUN_METHOD_BINDING)) { ------------------ | | 77| 0|#define STUN_METHOD_BINDING (0x0001) ------------------ | Branch (1252:7): [True: 0, False: 184] | Branch (1252:48): [True: 0, False: 0] ------------------ 1253| 0| if (stun_is_response_str(buf, len)) { ------------------ | Branch (1253:9): [True: 0, False: 0] ------------------ 1254| 0| return true; 1255| 0| } 1256| 0| } 1257| 184| return false; 1258| 184|} stun_tid_from_message_str: 1296| 16.9k|void stun_tid_from_message_str(const uint8_t *buf, size_t len, stun_tid *id) { 1297| 16.9k| UNUSED_ARG(len); ------------------ | | 174| 16.9k| do { \ | | 175| 16.9k| A = A; \ | | 176| 16.9k| } while (0) | | ------------------ | | | Branch (176:12): [Folded, False: 16.9k] | | ------------------ ------------------ 1298| 16.9k| stun_tid_from_string(buf + 8, id); 1299| 16.9k|} stun_tid_message_cpy: 1301| 29.0k|void stun_tid_message_cpy(uint8_t *buf, const stun_tid *id) { 1302| 29.0k| if (buf && id) { ------------------ | Branch (1302:7): [True: 29.0k, False: 0] | Branch (1302:14): [True: 29.0k, False: 0] ------------------ 1303| 29.0k| stun_tid_string_cpy(buf + 8, id); 1304| 29.0k| } 1305| 29.0k|} stun_tid_generate: 1307| 18.7k|void stun_tid_generate(stun_tid *id) { 1308| 18.7k| if (id) { ------------------ | Branch (1308:7): [True: 18.7k, False: 0] ------------------ 1309| 18.7k| turn_random_tid_size(id->tsx_id); 1310| 18.7k| } 1311| 18.7k|} stun_tid_generate_in_message_str: 1313| 18.7k|void stun_tid_generate_in_message_str(uint8_t *buf, stun_tid *id) { 1314| 18.7k| stun_tid tmp; 1315| 18.7k| if (!id) { ------------------ | Branch (1315:7): [True: 18.7k, False: 0] ------------------ 1316| 18.7k| id = &tmp; 1317| 18.7k| } 1318| 18.7k| stun_tid_generate(id); 1319| 18.7k| stun_tid_message_cpy(buf, id); 1320| 18.7k|} stun_attr_get_type: 1344| 2.13M|int stun_attr_get_type(stun_attr_ref attr) { 1345| 2.13M| if (attr) { ------------------ | Branch (1345:7): [True: 2.13M, False: 0] ------------------ 1346| 2.13M| uint16_t val; 1347| 2.13M| memcpy(&val, attr, sizeof(val)); 1348| 2.13M| return (int)(nswap16(val)); ------------------ | | 86| 2.13M|#define nswap16(s) ntohs(s) ------------------ 1349| 2.13M| } 1350| 0| return -1; 1351| 2.13M|} stun_attr_get_len: 1353| 4.10M|int stun_attr_get_len(stun_attr_ref attr) { 1354| 4.10M| if (attr) { ------------------ | Branch (1354:7): [True: 4.10M, False: 0] ------------------ 1355| 4.10M| uint16_t val; 1356| 4.10M| memcpy(&val, (const uint8_t *)attr + 2, sizeof(val)); 1357| 4.10M| return (int)(nswap16(val)); ------------------ | | 86| 4.10M|#define nswap16(s) ntohs(s) ------------------ 1358| 4.10M| } 1359| 0| return -1; 1360| 4.10M|} stun_attr_get_value: 1362| 90.0k|const uint8_t *stun_attr_get_value(stun_attr_ref attr) { 1363| 90.0k| if (attr) { ------------------ | Branch (1363:7): [True: 90.0k, False: 0] ------------------ 1364| 90.0k| uint16_t val; 1365| 90.0k| memcpy(&val, (const uint8_t *)attr + 2, sizeof(val)); 1366| 90.0k| const int len = (int)(nswap16(val)); ------------------ | | 86| 90.0k|#define nswap16(s) ntohs(s) ------------------ 1367| 90.0k| if (len < 1) { ------------------ | Branch (1367:9): [True: 26.1k, False: 63.8k] ------------------ 1368| 26.1k| return NULL; 1369| 26.1k| } 1370| 63.8k| return ((const uint8_t *)attr) + 4; 1371| 90.0k| } 1372| 0| return NULL; 1373| 90.0k|} stun_get_requested_address_family: 1375| 117|int stun_get_requested_address_family(stun_attr_ref attr) { 1376| 117| if (attr) { ------------------ | Branch (1376:7): [True: 117, False: 0] ------------------ 1377| 117| uint16_t raw_len; 1378| 117| memcpy(&raw_len, (const uint8_t *)attr + 2, sizeof(raw_len)); 1379| 117| const int len = (int)(nswap16(raw_len)); ------------------ | | 86| 117|#define nswap16(s) ntohs(s) ------------------ 1380| 117| if (len != 4) { ------------------ | Branch (1380:9): [True: 97, False: 20] ------------------ 1381| 97| return STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_INVALID; ------------------ | | 152| 97|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_INVALID (-1) ------------------ 1382| 97| } 1383| 20| const int val = ((const uint8_t *)attr)[4]; 1384| 20| switch (val) { 1385| 2| case STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV4: ------------------ | | 149| 2|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV4 (0x01) ------------------ | Branch (1385:5): [True: 2, False: 18] ------------------ 1386| 4| case STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6: ------------------ | | 150| 4|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6 (0x02) ------------------ | Branch (1386:5): [True: 2, False: 18] ------------------ 1387| 4| return val; 1388| 16| default: ------------------ | Branch (1388:5): [True: 16, False: 4] ------------------ 1389| 16| return STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_INVALID; ------------------ | | 152| 16|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_INVALID (-1) ------------------ 1390| 20| }; 1391| 0| } 1392| 0| return STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_DEFAULT; ------------------ | | 151| 0|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_DEFAULT (0x00) ------------------ 1393| 117|} stun_attr_get_channel_number: 1395| 2.94k|uint16_t stun_attr_get_channel_number(stun_attr_ref attr) { 1396| 2.94k| if (attr) { ------------------ | Branch (1396:7): [True: 2.94k, False: 0] ------------------ 1397| 2.94k| const uint8_t *value = stun_attr_get_value(attr); 1398| 2.94k| if (value && (stun_attr_get_len(attr) >= 2)) { ------------------ | Branch (1398:9): [True: 1.89k, False: 1.05k] | Branch (1398:18): [True: 1.40k, False: 486] ------------------ 1399| 1.40k| const uint16_t cn = nswap16(((const uint16_t *)value)[0]); ------------------ | | 86| 1.40k|#define nswap16(s) ntohs(s) ------------------ 1400| 1.40k| if (STUN_VALID_CHANNEL(cn)) { ------------------ | | 144| 1.40k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (144:34): [True: 610, False: 796] | | | Branch (144:53): [True: 36, False: 574] | | ------------------ ------------------ 1401| 36| return cn; 1402| 36| } 1403| 1.40k| } 1404| 2.94k| } 1405| 2.91k| return 0; 1406| 2.94k|} stun_attr_get_bandwidth: 1408| 76|band_limit_t stun_attr_get_bandwidth(stun_attr_ref attr) { 1409| 76| if (attr) { ------------------ | Branch (1409:7): [True: 76, False: 0] ------------------ 1410| 76| const uint8_t *value = stun_attr_get_value(attr); 1411| 76| if (value && (stun_attr_get_len(attr) >= 4)) { ------------------ | Branch (1411:9): [True: 40, False: 36] | Branch (1411:18): [True: 32, False: 8] ------------------ 1412| 32| const uint32_t bps = nswap32(((const uint32_t *)value)[0]); ------------------ | | 87| 32|#define nswap32(ul) ntohl(ul) ------------------ 1413| 32| return (band_limit_t)(bps << 7); 1414| 32| } 1415| 76| } 1416| 44| return 0; 1417| 76|} stun_attr_get_reservation_token_value: 1419| 24|uint64_t stun_attr_get_reservation_token_value(stun_attr_ref attr) { 1420| 24| if (attr) { ------------------ | Branch (1420:7): [True: 24, False: 0] ------------------ 1421| 24| const uint8_t *value = stun_attr_get_value(attr); 1422| 24| if (value && (stun_attr_get_len(attr) == 8)) { ------------------ | Branch (1422:9): [True: 19, False: 5] | Branch (1422:18): [True: 1, False: 18] ------------------ 1423| 1| uint64_t token; 1424| 1| memcpy(&token, value, sizeof(uint64_t)); 1425| 1| return nswap64(token); ------------------ | | 88| 1|#define nswap64(ull) ioa_ntoh64(ull) | | ------------------ | | | | 115| 1|#define ioa_ntoh64 _ioa_ntoh64 | | ------------------ ------------------ 1426| 1| } 1427| 24| } 1428| 23| return 0; 1429| 24|} stun_attr_is_addr: 1431| 215k|bool stun_attr_is_addr(stun_attr_ref attr) { 1432| | 1433| 215k| if (attr) { ------------------ | Branch (1433:7): [True: 215k, False: 0] ------------------ 1434| 215k| switch (stun_attr_get_type(attr)) { 1435| 14.4k| case STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS: ------------------ | | 105| 14.4k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1435:5): [True: 14.4k, False: 200k] ------------------ 1436| 25.6k| case STUN_ATTRIBUTE_XOR_PEER_ADDRESS: ------------------ | | 116| 25.6k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1436:5): [True: 11.2k, False: 204k] ------------------ 1437| 39.6k| case STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS: ------------------ | | 118| 39.6k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1437:5): [True: 14.0k, False: 201k] ------------------ 1438| 59.2k| case STUN_ATTRIBUTE_MAPPED_ADDRESS: ------------------ | | 91| 59.2k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ | Branch (1438:5): [True: 19.6k, False: 195k] ------------------ 1439| 67.1k| case STUN_ATTRIBUTE_ALTERNATE_SERVER: ------------------ | | 110| 67.1k|#define STUN_ATTRIBUTE_ALTERNATE_SERVER (0x8023) ------------------ | Branch (1439:5): [True: 7.85k, False: 207k] ------------------ 1440| 72.3k| case OLD_STUN_ATTRIBUTE_RESPONSE_ADDRESS: ------------------ | | 92| 72.3k|#define OLD_STUN_ATTRIBUTE_RESPONSE_ADDRESS (0x0002) ------------------ | Branch (1440:5): [True: 5.15k, False: 210k] ------------------ 1441| 82.1k| case OLD_STUN_ATTRIBUTE_SOURCE_ADDRESS: ------------------ | | 94| 82.1k|#define OLD_STUN_ATTRIBUTE_SOURCE_ADDRESS (0x0004) ------------------ | Branch (1441:5): [True: 9.87k, False: 205k] ------------------ 1442| 86.0k| case OLD_STUN_ATTRIBUTE_CHANGED_ADDRESS: ------------------ | | 95| 86.0k|#define OLD_STUN_ATTRIBUTE_CHANGED_ADDRESS (0x0005) ------------------ | Branch (1442:5): [True: 3.90k, False: 211k] ------------------ 1443| 90.0k| case OLD_STUN_ATTRIBUTE_REFLECTED_FROM: ------------------ | | 101| 90.0k|#define OLD_STUN_ATTRIBUTE_REFLECTED_FROM (0x000B) ------------------ | Branch (1443:5): [True: 3.93k, False: 211k] ------------------ 1444| 97.7k| case STUN_ATTRIBUTE_RESPONSE_ORIGIN: ------------------ | | 132| 97.7k|#define STUN_ATTRIBUTE_RESPONSE_ORIGIN (0x802B) ------------------ | Branch (1444:5): [True: 7.76k, False: 207k] ------------------ 1445| 106k| case STUN_ATTRIBUTE_OTHER_ADDRESS: ------------------ | | 133| 106k|#define STUN_ATTRIBUTE_OTHER_ADDRESS (0x802C) ------------------ | Branch (1445:5): [True: 8.40k, False: 206k] ------------------ 1446| 106k| return true; 1447| 0| break; 1448| 109k| default:; ------------------ | Branch (1448:5): [True: 109k, False: 106k] ------------------ 1449| 215k| }; 1450| 109k| } 1451| 109k| return false; 1452| 215k|} stun_attr_get_even_port: 1454| 40|uint8_t stun_attr_get_even_port(stun_attr_ref attr) { 1455| 40| if (attr) { ------------------ | Branch (1455:7): [True: 40, False: 0] ------------------ 1456| 40| const uint8_t *value = stun_attr_get_value(attr); 1457| 40| if (value) { ------------------ | Branch (1457:9): [True: 26, False: 14] ------------------ 1458| 26| if ((uint8_t)(value[0]) > 0x7F) { ------------------ | Branch (1458:11): [True: 12, False: 14] ------------------ 1459| 12| return 1; 1460| 12| } 1461| 26| } 1462| 40| } 1463| 28| return 0; 1464| 40|} stun_attr_get_first_by_type_str: 1466| 155k|stun_attr_ref stun_attr_get_first_by_type_str(const uint8_t *buf, size_t len, uint16_t attr_type) { 1467| 155k| stun_attr_ref attr = stun_attr_get_first_str(buf, len); 1468| 1.86M| while (attr) { ------------------ | Branch (1468:10): [True: 1.76M, False: 100k] ------------------ 1469| 1.76M| if (stun_attr_get_type(attr) == attr_type) { ------------------ | Branch (1469:9): [True: 54.6k, False: 1.70M] ------------------ 1470| 54.6k| return attr; 1471| 54.6k| } 1472| 1.70M| attr = stun_attr_get_next_str(buf, len, attr); 1473| 1.70M| } 1474| | 1475| 100k| return NULL; 1476| 155k|} stun_attr_get_first_str: 1499| 166k|stun_attr_ref stun_attr_get_first_str(const uint8_t *buf, size_t len) { 1500| 166k| const int bufLen = stun_get_command_message_len_str(buf, len); 1501| 166k| if (bufLen > STUN_HEADER_LENGTH) { ------------------ | | 46| 166k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (1501:7): [True: 163k, False: 3.08k] ------------------ 1502| 163k| stun_attr_ref attr = (stun_attr_ref)(buf + STUN_HEADER_LENGTH); ------------------ | | 46| 163k|#define STUN_HEADER_LENGTH (20) ------------------ 1503| 163k| return stun_attr_check_valid(attr, bufLen - STUN_HEADER_LENGTH); ------------------ | | 46| 163k|#define STUN_HEADER_LENGTH (20) ------------------ 1504| 163k| } 1505| | 1506| 3.08k| return NULL; 1507| 166k|} stun_attr_get_next_str: 1509| 1.94M|stun_attr_ref stun_attr_get_next_str(const uint8_t *buf, size_t len, stun_attr_ref prev) { 1510| 1.94M| if (!prev) { ------------------ | Branch (1510:7): [True: 0, False: 1.94M] ------------------ 1511| 0| return stun_attr_get_first_str(buf, len); 1512| 1.94M| } else { 1513| 1.94M| const uint8_t *end = buf + stun_get_command_message_len_str(buf, len); 1514| 1.94M| int attrlen = stun_attr_get_len(prev); 1515| 1.94M| const uint16_t rem4 = ((uint16_t)attrlen) & 0x0003; 1516| 1.94M| if (rem4) { ------------------ | Branch (1516:9): [True: 372k, False: 1.57M] ------------------ 1517| 372k| attrlen = attrlen + 4 - (int)rem4; 1518| 372k| } 1519| | /* Note the order here: operations on attrlen are untrusted as they may overflow */ 1520| 1.94M| if (attrlen < end - (const uint8_t *)prev - 4) { ------------------ | Branch (1520:9): [True: 1.86M, False: 80.2k] ------------------ 1521| 1.86M| const uint8_t *attr_end = (const uint8_t *)prev + 4 + attrlen; 1522| 1.86M| return stun_attr_check_valid(attr_end, end - attr_end); 1523| 1.86M| } 1524| 80.2k| return NULL; 1525| 1.94M| } 1526| 1.94M|} stun_attr_add_str: 1528| 70.9k|bool stun_attr_add_str(uint8_t *buf, size_t *len, uint16_t attr, const uint8_t *avalue, int alen) { 1529| 70.9k| if (alen < 0) { ------------------ | Branch (1529:7): [True: 0, False: 70.9k] ------------------ 1530| 0| alen = 0; 1531| 0| } 1532| 70.9k| uint8_t tmp[1]; 1533| 70.9k| if (!avalue) { ------------------ | Branch (1533:7): [True: 1.08k, False: 69.9k] ------------------ 1534| 1.08k| alen = 0; 1535| 1.08k| avalue = tmp; 1536| 1.08k| } 1537| 70.9k| const int clen = stun_get_command_message_len_str(buf, *len); 1538| 70.9k| int newlen = clen + 4 + alen; 1539| 70.9k| const int newlenrem4 = newlen & 0x00000003; 1540| 70.9k| int paddinglen = 0; 1541| 70.9k| if (newlenrem4) { ------------------ | Branch (1541:7): [True: 28.8k, False: 42.1k] ------------------ 1542| 28.8k| paddinglen = 4 - newlenrem4; 1543| 28.8k| newlen = newlen + paddinglen; 1544| 28.8k| } 1545| | 1546| 70.9k| if (newlen >= MAX_STUN_MESSAGE_SIZE) { ------------------ | | 179| 70.9k|#define MAX_STUN_MESSAGE_SIZE (65507) ------------------ | Branch (1546:7): [True: 0, False: 70.9k] ------------------ 1547| 0| return false; 1548| 0| } 1549| | 1550| 70.9k| uint8_t *attr_start = buf + clen; 1551| | 1552| 70.9k| uint16_t *attr_start_16t = (uint16_t *)attr_start; 1553| | 1554| 70.9k| stun_set_command_message_len_str(buf, newlen); 1555| 70.9k| *len = newlen; 1556| | 1557| 70.9k| attr_start_16t[0] = nswap16(attr); ------------------ | | 86| 70.9k|#define nswap16(s) ntohs(s) ------------------ 1558| 70.9k| attr_start_16t[1] = nswap16(alen); ------------------ | | 86| 70.9k|#define nswap16(s) ntohs(s) ------------------ 1559| 70.9k| if (alen > 0) { ------------------ | Branch (1559:7): [True: 69.9k, False: 1.08k] ------------------ 1560| 69.9k| memcpy(attr_start + 4, avalue, alen); 1561| 69.9k| } 1562| | 1563| | // Write 0 padding to not leak data 1564| 70.9k| memset(attr_start + 4 + alen, 0, paddinglen); 1565| | 1566| | return true; 1567| 70.9k|} stun_attr_add_addr_str: 1569| 6.52k|bool stun_attr_add_addr_str(uint8_t *buf, size_t *len, uint16_t attr_type, const ioa_addr *ca) { 1570| | 1571| 6.52k| stun_tid tid; 1572| 6.52k| stun_tid_from_message_str(buf, *len, &tid); 1573| | 1574| 6.52k| int xor_ed = 0; 1575| 6.52k| switch (attr_type) { 1576| 2.17k| case STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS: ------------------ | | 105| 2.17k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1576:3): [True: 2.17k, False: 4.34k] ------------------ 1577| 3.26k| case STUN_ATTRIBUTE_XOR_PEER_ADDRESS: ------------------ | | 116| 3.26k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1577:3): [True: 1.08k, False: 5.43k] ------------------ 1578| 5.43k| case STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS: ------------------ | | 118| 5.43k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1578:3): [True: 2.17k, False: 4.34k] ------------------ 1579| 5.43k| xor_ed = 1; 1580| 5.43k| break; 1581| 1.08k| default:; ------------------ | Branch (1581:3): [True: 1.08k, False: 5.43k] ------------------ 1582| 6.52k| }; 1583| | 1584| 6.52k| ioa_addr public_addr; 1585| 6.52k| map_addr_from_private_to_public(ca, &public_addr); 1586| | 1587| 6.52k| uint8_t cfield[64]; 1588| 6.52k| int clen = 0; 1589| 6.52k| if (stun_addr_encode(&public_addr, cfield, &clen, xor_ed, STUN_MAGIC_COOKIE, tid.tsx_id) < 0) { ------------------ | | 56| 6.52k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (1589:7): [True: 0, False: 6.52k] ------------------ 1590| 0| return false; 1591| 0| } 1592| | 1593| 6.52k| if (!stun_attr_add_str(buf, len, attr_type, (uint8_t *)(&cfield), clen)) { ------------------ | Branch (1593:7): [True: 0, False: 6.52k] ------------------ 1594| 0| return false; 1595| 0| } 1596| | 1597| 6.52k| return true; 1598| 6.52k|} stun_attr_get_addr_str: 1601| 10.4k| const ioa_addr *default_addr) { 1602| 10.4k| stun_tid tid; 1603| 10.4k| stun_tid_from_message_str(buf, len, &tid); 1604| 10.4k| ioa_addr public_addr; 1605| | 1606| 10.4k| addr_set_any(ca); 1607| 10.4k| addr_set_any(&public_addr); 1608| | 1609| 10.4k| const int attr_type = stun_attr_get_type(attr); 1610| 10.4k| if (attr_type < 0) { ------------------ | Branch (1610:7): [True: 0, False: 10.4k] ------------------ 1611| 0| return false; 1612| 0| } 1613| | 1614| 10.4k| int xor_ed = 0; 1615| 10.4k| switch (attr_type) { 1616| 1.77k| case STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS: ------------------ | | 105| 1.77k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1616:3): [True: 1.77k, False: 8.65k] ------------------ 1617| 3.20k| case STUN_ATTRIBUTE_XOR_PEER_ADDRESS: ------------------ | | 116| 3.20k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1617:3): [True: 1.43k, False: 8.99k] ------------------ 1618| 4.94k| case STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS: ------------------ | | 118| 4.94k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1618:3): [True: 1.73k, False: 8.69k] ------------------ 1619| 4.94k| xor_ed = 1; 1620| 4.94k| break; 1621| 5.48k| default:; ------------------ | Branch (1621:3): [True: 5.48k, False: 4.94k] ------------------ 1622| 10.4k| }; 1623| | 1624| 10.4k| const uint8_t *cfield = stun_attr_get_value(attr); 1625| 10.4k| if (!cfield) { ------------------ | Branch (1625:7): [True: 6.74k, False: 3.68k] ------------------ 1626| 6.74k| return false; 1627| 6.74k| } 1628| | 1629| 3.68k| if (stun_addr_decode(&public_addr, cfield, stun_attr_get_len(attr), xor_ed, STUN_MAGIC_COOKIE, tid.tsx_id) < 0) { ------------------ | | 56| 3.68k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (1629:7): [True: 2.75k, False: 924] ------------------ 1630| 2.75k| return false; 1631| 2.75k| } 1632| | 1633| 924| map_addr_from_public_to_private(&public_addr, ca); 1634| | 1635| 924| if (default_addr && addr_any_no_port(ca) && !addr_any_no_port(default_addr)) { ------------------ | Branch (1635:7): [True: 0, False: 924] | Branch (1635:23): [True: 0, False: 0] | Branch (1635:47): [True: 0, False: 0] ------------------ 1636| 0| const uint16_t port = addr_get_port(ca); 1637| 0| addr_cpy(ca, default_addr); 1638| 0| addr_set_port(ca, port); 1639| 0| } 1640| | 1641| | return true; 1642| 3.68k|} stun_attr_get_first_addr_str: 1645| 8.84k| const ioa_addr *default_addr) { 1646| 8.84k| stun_attr_ref attr = stun_attr_get_first_str(buf, len); 1647| | 1648| 198k| while (attr) { ------------------ | Branch (1648:10): [True: 190k, False: 8.36k] ------------------ 1649| 190k| if (stun_attr_is_addr(attr) && (attr_type == stun_attr_get_type(attr))) { ------------------ | Branch (1649:9): [True: 93.9k, False: 96.3k] | Branch (1649:36): [True: 9.08k, False: 84.8k] ------------------ 1650| 9.08k| if (stun_attr_get_addr_str(buf, len, attr, ca, default_addr)) { ------------------ | Branch (1650:11): [True: 480, False: 8.60k] ------------------ 1651| 480| return true; 1652| 480| } 1653| 9.08k| } 1654| 189k| attr = stun_attr_get_next_str(buf, len, attr); 1655| 189k| } 1656| | 1657| 8.36k| return false; 1658| 8.84k|} stun_attr_add_channel_number_str: 1660| 1.08k|bool stun_attr_add_channel_number_str(uint8_t *buf, size_t *len, uint16_t chnumber) { 1661| | 1662| 1.08k| uint16_t field[2]; 1663| 1.08k| field[0] = nswap16(chnumber); ------------------ | | 86| 1.08k|#define nswap16(s) ntohs(s) ------------------ 1664| 1.08k| field[1] = 0; 1665| | 1666| 1.08k| return stun_attr_add_str(buf, len, STUN_ATTRIBUTE_CHANNEL_NUMBER, (uint8_t *)(field), sizeof(field)); ------------------ | | 113| 1.08k|#define STUN_ATTRIBUTE_CHANNEL_NUMBER (0x000C) ------------------ 1667| 1.08k|} stun_attr_add_bandwidth_str: 1669| 1.08k|bool stun_attr_add_bandwidth_str(uint8_t *buf, size_t *len, band_limit_t bps0) { 1670| | 1671| 1.08k| const uint32_t bps = (uint32_t)(band_limit_t)(bps0 >> 7); 1672| | 1673| 1.08k| uint32_t field = nswap32(bps); ------------------ | | 87| 1.08k|#define nswap32(ul) ntohl(ul) ------------------ 1674| | 1675| 1.08k| return stun_attr_add_str(buf, len, STUN_ATTRIBUTE_NEW_BANDWIDTH, (uint8_t *)(&field), sizeof(field)); ------------------ | | 52| 1.08k|#define STUN_ATTRIBUTE_NEW_BANDWIDTH (0x8000 + STUN_ATTRIBUTE_BANDWIDTH) | | ------------------ | | | | 115| 1.08k|#define STUN_ATTRIBUTE_BANDWIDTH (0x0010) | | ------------------ ------------------ 1676| 1.08k|} stun_attr_add_address_error_code: 1678| 1.08k|bool stun_attr_add_address_error_code(uint8_t *buf, size_t *len, int requested_address_family, int error_code) { 1679| 1.08k| const uint8_t *reason = get_default_reason(error_code); 1680| | 1681| 1.08k| uint8_t avalue[513]; 1682| 1.08k| avalue[0] = (uint8_t)requested_address_family; 1683| 1.08k| avalue[1] = 0; 1684| 1.08k| avalue[2] = (uint8_t)(error_code / 100); 1685| 1.08k| avalue[3] = (uint8_t)(error_code % 100); 1686| 1.08k| strncpy((char *)(avalue + 4), (const char *)reason, sizeof(avalue) - 4); 1687| 1.08k| avalue[sizeof(avalue) - 1] = 0; 1688| 1.08k| int alen = 4 + (int)strlen((const char *)(avalue + 4)); 1689| | 1690| | //"Manual" padding for compatibility with classic old stun: 1691| 1.08k| { 1692| 1.08k| const int rem = alen % 4; 1693| 1.08k| if (rem) { ------------------ | Branch (1693:9): [True: 0, False: 1.08k] ------------------ 1694| 0| alen += (4 - rem); 1695| 0| } 1696| 1.08k| } 1697| | 1698| 1.08k| return stun_attr_add_str(buf, len, STUN_ATTRIBUTE_ADDRESS_ERROR_CODE, (uint8_t *)avalue, alen); ------------------ | | 141| 1.08k|#define STUN_ATTRIBUTE_ADDRESS_ERROR_CODE (0x8001) ------------------ 1699| 1.08k|} stun_attr_get_first_channel_number_str: 1701| 1.10k|uint16_t stun_attr_get_first_channel_number_str(const uint8_t *buf, size_t len) { 1702| | 1703| 1.10k| stun_attr_ref attr = stun_attr_get_first_str(buf, len); 1704| 25.8k| while (attr) { ------------------ | Branch (1704:10): [True: 24.7k, False: 1.08k] ------------------ 1705| 24.7k| if (stun_attr_get_type(attr) == STUN_ATTRIBUTE_CHANNEL_NUMBER) { ------------------ | | 113| 24.7k|#define STUN_ATTRIBUTE_CHANNEL_NUMBER (0x000C) ------------------ | Branch (1705:9): [True: 2.75k, False: 22.0k] ------------------ 1706| 2.75k| const uint16_t ret = stun_attr_get_channel_number(attr); 1707| 2.75k| if (STUN_VALID_CHANNEL(ret)) { ------------------ | | 144| 2.75k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (144:34): [True: 19, False: 2.74k] | | | Branch (144:53): [True: 19, False: 0] | | ------------------ ------------------ 1708| 19| return ret; 1709| 19| } 1710| 2.75k| } 1711| 24.7k| attr = stun_attr_get_next_str(buf, len, attr); 1712| 24.7k| } 1713| | 1714| 1.08k| return 0; 1715| 1.10k|} stun_attr_add_fingerprint_str: 1719| 1.08k|bool stun_attr_add_fingerprint_str(uint8_t *buf, size_t *len) { 1720| 1.08k| uint32_t crc32 = 0; 1721| 1.08k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_FINGERPRINT, (uint8_t *)&crc32, 4)) { ------------------ | | 111| 1.08k|#define STUN_ATTRIBUTE_FINGERPRINT (0x8028) ------------------ | Branch (1721:7): [True: 0, False: 1.08k] ------------------ 1722| 0| return false; 1723| 0| } 1724| 1.08k| crc32 = ns_crc32(buf, (int)*len - 8); 1725| 1.08k| *((uint32_t *)(buf + *len - 4)) = nswap32(crc32 ^ ((uint32_t)FINGERPRINT_XOR)); ------------------ | | 87| 1.08k|#define nswap32(ul) ntohl(ul) ------------------ 1726| | return true; 1727| 1.08k|} get_hmackey_size: 1820| 5.23k|size_t get_hmackey_size(SHATYPE shatype) { 1821| 5.23k| if (shatype == SHATYPE_SHA256) { ------------------ | Branch (1821:7): [True: 1.93k, False: 3.30k] ------------------ 1822| 1.93k| return 32; 1823| 1.93k| } 1824| 3.30k| if (shatype == SHATYPE_SHA384) { ------------------ | Branch (1824:7): [True: 742, False: 2.56k] ------------------ 1825| 742| return 48; 1826| 742| } 1827| 2.56k| if (shatype == SHATYPE_SHA512) { ------------------ | Branch (1827:7): [True: 870, False: 1.69k] ------------------ 1828| 870| return 64; 1829| 870| } 1830| 1.69k| return 16; 1831| 2.56k|} stun_attr_add_integrity_str: 1842| 6.83k| SHATYPE shatype) { 1843| 6.83k| uint8_t hmac[MAXSHASIZE] = {0}; 1844| | 1845| 6.83k| unsigned int shasize; 1846| | 1847| 6.83k| switch (shatype) { 1848| 2.56k| case SHATYPE_SHA256: ------------------ | Branch (1848:3): [True: 2.56k, False: 4.27k] ------------------ 1849| 2.56k| shasize = SHA256SIZEBYTES; ------------------ | | 165| 2.56k|#define SHA256SIZEBYTES (32) ------------------ 1850| 2.56k| break; 1851| 980| case SHATYPE_SHA384: ------------------ | Branch (1851:3): [True: 980, False: 5.85k] ------------------ 1852| 980| shasize = SHA384SIZEBYTES; ------------------ | | 166| 980|#define SHA384SIZEBYTES (48) ------------------ 1853| 980| break; 1854| 1.15k| case SHATYPE_SHA512: ------------------ | Branch (1854:3): [True: 1.15k, False: 5.68k] ------------------ 1855| 1.15k| shasize = SHA512SIZEBYTES; ------------------ | | 167| 1.15k|#define SHA512SIZEBYTES (64) ------------------ 1856| 1.15k| break; 1857| 2.14k| default: ------------------ | Branch (1857:3): [True: 2.14k, False: 4.69k] ------------------ 1858| 2.14k| shasize = SHA1SIZEBYTES; ------------------ | | 164| 2.14k|#define SHA1SIZEBYTES (20) ------------------ 1859| 6.83k| }; 1860| | 1861| 6.83k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_MESSAGE_INTEGRITY, hmac, shasize)) { ------------------ | | 98| 6.83k|#define STUN_ATTRIBUTE_MESSAGE_INTEGRITY (0x0008) ------------------ | Branch (1861:7): [True: 0, False: 6.83k] ------------------ 1862| 0| return false; 1863| 0| } 1864| | 1865| 6.83k| if (ct == TURN_CREDENTIALS_SHORT_TERM) { ------------------ | Branch (1865:7): [True: 1.70k, False: 5.12k] ------------------ 1866| 1.70k| return stun_calculate_hmac(buf, *len - 4 - shasize, pwd, strlen((char *)pwd), buf + *len - shasize, &shasize, 1867| 1.70k| shatype); 1868| 5.12k| } else { 1869| 5.12k| return stun_calculate_hmac(buf, *len - 4 - shasize, key, get_hmackey_size(shatype), buf + *len - shasize, &shasize, 1870| 5.12k| shatype); 1871| 5.12k| } 1872| 6.83k|} stun_attr_add_integrity_by_key_str: 1875| 3.41k| hmackey_t key, const uint8_t *nonce, SHATYPE shatype) { 1876| 3.41k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_USERNAME, uname, (int)strlen((const char *)uname))) { ------------------ | | 96| 3.41k|#define STUN_ATTRIBUTE_USERNAME (0x0006) ------------------ | Branch (1876:7): [True: 0, False: 3.41k] ------------------ 1877| 0| return false; 1878| 0| } 1879| | 1880| 3.41k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_NONCE, nonce, (int)strlen((const char *)nonce))) { ------------------ | | 103| 3.41k|#define STUN_ATTRIBUTE_NONCE (0x0015) ------------------ | Branch (1880:7): [True: 0, False: 3.41k] ------------------ 1881| 0| return false; 1882| 0| } 1883| | 1884| 3.41k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_REALM, realm, (int)strlen((const char *)realm))) { ------------------ | | 102| 3.41k|#define STUN_ATTRIBUTE_REALM (0x0014) ------------------ | Branch (1884:7): [True: 0, False: 3.41k] ------------------ 1885| 0| return false; 1886| 0| } 1887| | 1888| 3.41k| password_t p; 1889| 3.41k| return stun_attr_add_integrity_str(TURN_CREDENTIALS_LONG_TERM, buf, len, key, p, shatype); 1890| 3.41k|} stun_attr_add_integrity_by_user_str: 1893| 1.70k| const uint8_t *upwd, const uint8_t *nonce, SHATYPE shatype) { 1894| 1.70k| hmackey_t key; 1895| | 1896| 1.70k| if (!stun_produce_integrity_key_str(uname, realm, upwd, key, shatype)) { ------------------ | Branch (1896:7): [True: 0, False: 1.70k] ------------------ 1897| 0| return false; 1898| 0| } 1899| | 1900| 1.70k| return stun_attr_add_integrity_by_key_str(buf, len, uname, realm, key, nonce, shatype); 1901| 1.70k|} stun_attr_add_integrity_by_user_short_term_str: 1904| 1.70k| SHATYPE shatype) { 1905| 1.70k| if (stun_attr_add_str(buf, len, STUN_ATTRIBUTE_USERNAME, uname, (int)strlen((const char *)uname))) { ------------------ | | 96| 1.70k|#define STUN_ATTRIBUTE_USERNAME (0x0006) ------------------ | Branch (1905:7): [True: 1.70k, False: 0] ------------------ 1906| 1.70k| return false; 1907| 1.70k| } 1908| | 1909| 0| hmackey_t key; 1910| 0| return stun_attr_add_integrity_str(TURN_CREDENTIALS_SHORT_TERM, buf, len, key, pwd, shatype); 1911| 1.70k|} stun_check_message_integrity_by_key_str: 1917| 15.3k| password_t pwd, SHATYPE shatype) { 1918| 15.3k| stun_attr_ref sar = stun_attr_get_first_by_type_str(buf, len, STUN_ATTRIBUTE_MESSAGE_INTEGRITY); ------------------ | | 98| 15.3k|#define STUN_ATTRIBUTE_MESSAGE_INTEGRITY (0x0008) ------------------ 1919| 15.3k| if (!sar) { ------------------ | Branch (1919:7): [True: 13.9k, False: 1.38k] ------------------ 1920| 13.9k| return -1; 1921| 13.9k| } 1922| | 1923| 1.38k| unsigned int shasize = 0; 1924| 1.38k| switch (stun_attr_get_len(sar)) { 1925| 60| case SHA256SIZEBYTES: ------------------ | | 165| 60|#define SHA256SIZEBYTES (32) ------------------ | Branch (1925:3): [True: 60, False: 1.32k] ------------------ 1926| 60| shasize = SHA256SIZEBYTES; ------------------ | | 165| 60|#define SHA256SIZEBYTES (32) ------------------ 1927| 60| if (shatype != SHATYPE_SHA256) { ------------------ | Branch (1927:9): [True: 42, False: 18] ------------------ 1928| 42| return -1; 1929| 42| } 1930| 18| break; 1931| 70| case SHA384SIZEBYTES: ------------------ | | 166| 70|#define SHA384SIZEBYTES (48) ------------------ | Branch (1931:3): [True: 70, False: 1.31k] ------------------ 1932| 70| shasize = SHA384SIZEBYTES; ------------------ | | 166| 70|#define SHA384SIZEBYTES (48) ------------------ 1933| 70| if (shatype != SHATYPE_SHA384) { ------------------ | Branch (1933:9): [True: 56, False: 14] ------------------ 1934| 56| return -1; 1935| 56| } 1936| 14| break; 1937| 60| case SHA512SIZEBYTES: ------------------ | | 167| 60|#define SHA512SIZEBYTES (64) ------------------ | Branch (1937:3): [True: 60, False: 1.32k] ------------------ 1938| 60| shasize = SHA512SIZEBYTES; ------------------ | | 167| 60|#define SHA512SIZEBYTES (64) ------------------ 1939| 60| if (shatype != SHATYPE_SHA512) { ------------------ | Branch (1939:9): [True: 48, False: 12] ------------------ 1940| 48| return -1; 1941| 48| } 1942| 12| break; 1943| 850| case SHA1SIZEBYTES: ------------------ | | 164| 850|#define SHA1SIZEBYTES (20) ------------------ | Branch (1943:3): [True: 850, False: 530] ------------------ 1944| 850| shasize = SHA1SIZEBYTES; ------------------ | | 164| 850|#define SHA1SIZEBYTES (20) ------------------ 1945| 850| if (shatype != SHATYPE_SHA1) { ------------------ | Branch (1945:9): [True: 595, False: 255] ------------------ 1946| 595| return -1; 1947| 595| } 1948| 255| break; 1949| 340| default: ------------------ | Branch (1949:3): [True: 340, False: 1.04k] ------------------ 1950| 340| return -1; 1951| 1.38k| }; 1952| | 1953| 299| const int orig_len = stun_get_command_message_len_str(buf, len); 1954| 299| if (orig_len < 0) { ------------------ | Branch (1954:7): [True: 0, False: 299] ------------------ 1955| 0| return -1; 1956| 0| } 1957| | 1958| 299| const int new_len = (int)((const uint8_t *)sar - buf) + 4 + shasize; 1959| 299| if (new_len > orig_len) { ------------------ | Branch (1959:7): [True: 0, False: 299] ------------------ 1960| 0| return -1; 1961| 0| } 1962| | 1963| 299| if (!stun_set_command_message_len_str(buf, new_len)) { ------------------ | Branch (1963:7): [True: 0, False: 299] ------------------ 1964| 0| return -1; 1965| 0| } 1966| | 1967| 299| int res = 0; 1968| 299| uint8_t new_hmac[MAXSHASIZE] = {0}; 1969| 299| if (ct == TURN_CREDENTIALS_SHORT_TERM) { ------------------ | Branch (1969:7): [True: 189, False: 110] ------------------ 1970| 189| if (!stun_calculate_hmac(buf, (size_t)new_len - 4 - shasize, pwd, strlen((char *)pwd), new_hmac, &shasize, ------------------ | Branch (1970:9): [True: 0, False: 189] ------------------ 1971| 189| shatype)) { 1972| 0| res = -1; 1973| 189| } else { 1974| 189| res = 0; 1975| 189| } 1976| 189| } else { 1977| 110| if (!stun_calculate_hmac(buf, (size_t)new_len - 4 - shasize, key, get_hmackey_size(shatype), new_hmac, &shasize, ------------------ | Branch (1977:9): [True: 0, False: 110] ------------------ 1978| 110| shatype)) { 1979| 0| res = -1; 1980| 110| } else { 1981| 110| res = 0; 1982| 110| } 1983| 110| } 1984| | 1985| 299| stun_set_command_message_len_str(buf, orig_len); 1986| 299| if (res < 0) { ------------------ | Branch (1986:7): [True: 0, False: 299] ------------------ 1987| 0| return -1; 1988| 0| } 1989| | 1990| 299| const uint8_t *old_hmac = stun_attr_get_value(sar); 1991| 299| if (!old_hmac) { ------------------ | Branch (1991:7): [True: 0, False: 299] ------------------ 1992| 0| return -1; 1993| 0| } 1994| | 1995| | /* Use constant-time comparison: a short-circuiting memcmp leaks the matching prefix 1996| | length via response timing, allowing byte-by-byte HMAC recovery. */ 1997| 299| if (0 != CRYPTO_memcmp(old_hmac, new_hmac, shasize)) { ------------------ | Branch (1997:7): [True: 295, False: 4] ------------------ 1998| 295| return 0; 1999| 295| } 2000| | 2001| 4| return +1; 2002| 299|} stun_check_message_integrity_str: 2008| 15.3k| const uint8_t *realm, const uint8_t *upwd, SHATYPE shatype) { 2009| 15.3k| hmackey_t key; 2010| 15.3k| password_t pwd; 2011| | 2012| 15.3k| if (ct == TURN_CREDENTIALS_SHORT_TERM) { ------------------ | Branch (2012:7): [True: 7.68k, False: 7.68k] ------------------ 2013| 7.68k| strncpy((char *)pwd, (const char *)upwd, sizeof(password_t) - 1); 2014| 7.68k| pwd[sizeof(password_t) - 1] = 0; 2015| 7.68k| } else if (!stun_produce_integrity_key_str(uname, realm, upwd, key, shatype)) { ------------------ | Branch (2015:14): [True: 0, False: 7.68k] ------------------ 2016| 0| return -1; 2017| 0| } 2018| | 2019| 15.3k| return stun_check_message_integrity_by_key_str(ct, buf, len, key, pwd, shatype); 2020| 15.3k|} stun_attr_get_change_request_str: 2024| 58|bool stun_attr_get_change_request_str(stun_attr_ref attr, bool *change_ip, bool *change_port) { 2025| 58| if (stun_attr_get_len(attr) == 4) { ------------------ | Branch (2025:7): [True: 22, False: 36] ------------------ 2026| 22| const uint8_t *value = stun_attr_get_value(attr); 2027| 22| if (value) { ------------------ | Branch (2027:9): [True: 22, False: 0] ------------------ 2028| 22| *change_ip = (value[3] & 0x04); 2029| 22| *change_port = (value[3] & 0x02); 2030| 22| return true; 2031| 22| } 2032| 22| } 2033| 36| return false; 2034| 58|} stun_attr_add_change_request_str: 2036| 1.08k|bool stun_attr_add_change_request_str(uint8_t *buf, size_t *len, bool change_ip, bool change_port) { 2037| 1.08k| uint8_t avalue[4] = {0, 0, 0, 0}; 2038| | 2039| 1.08k| if (change_ip) { ------------------ | Branch (2039:7): [True: 1.08k, False: 0] ------------------ 2040| 1.08k| if (change_port) { ------------------ | Branch (2040:9): [True: 1.08k, False: 0] ------------------ 2041| 1.08k| avalue[3] = 0x06; 2042| 1.08k| } else { 2043| 0| avalue[3] = 0x04; 2044| 0| } 2045| 1.08k| } else if (change_port) { ------------------ | Branch (2045:14): [True: 0, False: 0] ------------------ 2046| 0| avalue[3] = 0x02; 2047| 0| } 2048| | 2049| 1.08k| return stun_attr_add_str(buf, len, STUN_ATTRIBUTE_CHANGE_REQUEST, avalue, 4); ------------------ | | 93| 1.08k|#define STUN_ATTRIBUTE_CHANGE_REQUEST (0x0003) ------------------ 2050| 1.08k|} stun_attr_get_response_port_str: 2052| 28|int stun_attr_get_response_port_str(stun_attr_ref attr) { 2053| 28| if (stun_attr_get_len(attr) >= 2) { ------------------ | Branch (2053:7): [True: 16, False: 12] ------------------ 2054| 16| const uint8_t *value = stun_attr_get_value(attr); 2055| 16| if (value) { ------------------ | Branch (2055:9): [True: 16, False: 0] ------------------ 2056| 16| return nswap16(((const uint16_t *)value)[0]); ------------------ | | 86| 16|#define nswap16(s) ntohs(s) ------------------ 2057| 16| } 2058| 16| } 2059| 12| return -1; 2060| 28|} stun_attr_add_response_port_str: 2062| 1.08k|bool stun_attr_add_response_port_str(uint8_t *buf, size_t *len, uint16_t port) { 2063| 1.08k| uint8_t avalue[4] = {0, 0, 0, 0}; 2064| 1.08k| uint16_t *port_ptr = (uint16_t *)avalue; 2065| | 2066| 1.08k| *port_ptr = nswap16(port); ------------------ | | 86| 1.08k|#define nswap16(s) ntohs(s) ------------------ 2067| | 2068| 1.08k| return stun_attr_add_str(buf, len, STUN_ATTRIBUTE_RESPONSE_PORT, avalue, 4); ------------------ | | 131| 1.08k|#define STUN_ATTRIBUTE_RESPONSE_PORT (0x0027) ------------------ 2069| 1.08k|} stun_attr_get_padding_len_str: 2071| 19|int stun_attr_get_padding_len_str(stun_attr_ref attr) { 2072| 19| const int len = stun_attr_get_len(attr); 2073| 19| if (len < 0) { ------------------ | Branch (2073:7): [True: 0, False: 19] ------------------ 2074| 0| return -1; 2075| 0| } 2076| 19| return (uint16_t)len; 2077| 19|} stun_attr_add_padding_str: 2079| 1.08k|bool stun_attr_add_padding_str(uint8_t *buf, size_t *len, uint16_t padding_len) { 2080| 1.08k| uint8_t avalue[0xFFFF]; 2081| 1.08k| memset(avalue, 0, padding_len); 2082| | 2083| 1.08k| return stun_attr_add_str(buf, len, STUN_ATTRIBUTE_PADDING, avalue, padding_len); ------------------ | | 130| 1.08k|#define STUN_ATTRIBUTE_PADDING (0x0026) ------------------ 2084| 1.08k|} ns_turn_msg.c:fuzz_prng_next: 112| 56.3k|static uint64_t fuzz_prng_next(void) { 113| 56.3k| static uint64_t state = UINT64_C(0x9e3779b97f4a7c15); 114| | 115| 56.3k| state += UINT64_C(0x9e3779b97f4a7c15); 116| 56.3k| uint64_t z = state; 117| 56.3k| z = (z ^ (z >> 30)) * UINT64_C(0xbf58476d1ce4e5b9); 118| | z = (z ^ (z >> 27)) * UINT64_C(0x94d049bb133111eb); 119| 56.3k| return z ^ (z >> 31); 120| 56.3k|} ns_turn_msg.c:stun_init_error_response_common_str: 752| 10.2k| stun_tid *id, bool include_reason_string) { 753| | 754| 10.2k| if (include_reason_string && (!reason || !strcmp((const char *)reason, "Unknown error"))) { ------------------ | Branch (754:7): [True: 10.2k, False: 0] | Branch (754:33): [True: 0, False: 10.2k] | Branch (754:44): [True: 0, False: 10.2k] ------------------ 755| 0| reason = get_default_reason(error_code); 756| 0| } 757| | 758| 10.2k| uint8_t avalue[513]; 759| 10.2k| memset(avalue, 0, sizeof(avalue)); 760| 10.2k| avalue[0] = 0; 761| 10.2k| avalue[1] = 0; 762| 10.2k| avalue[2] = (uint8_t)(error_code / 100); 763| 10.2k| avalue[3] = (uint8_t)(error_code % 100); 764| 10.2k| if (include_reason_string) { ------------------ | Branch (764:7): [True: 10.2k, False: 0] ------------------ 765| 10.2k| strncpy((char *)(avalue + 4), (const char *)reason, sizeof(avalue) - 4); 766| 10.2k| } 767| 10.2k| avalue[sizeof(avalue) - 1] = 0; 768| 10.2k| int alen = 4 + (int)strlen((const char *)(avalue + 4)); 769| | 770| | //"Manual" padding for compatibility with classic old stun: 771| 10.2k| { 772| 10.2k| const int rem = alen % 4; 773| 10.2k| if (rem) { ------------------ | Branch (773:9): [True: 0, False: 10.2k] ------------------ 774| 0| alen += (4 - rem); 775| 0| } 776| 10.2k| } 777| | 778| 10.2k| stun_attr_add_str(buf, len, STUN_ATTRIBUTE_ERROR_CODE, (uint8_t *)avalue, alen); ------------------ | | 99| 10.2k|#define STUN_ATTRIBUTE_ERROR_CODE (0x0009) ------------------ 779| 10.2k| if (id) { ------------------ | Branch (779:7): [True: 10.2k, False: 0] ------------------ 780| 10.2k| stun_tid_message_cpy(buf, id); 781| 10.2k| } 782| 10.2k|} ns_turn_msg.c:stun_tid_from_string: 1290| 16.9k|static void stun_tid_from_string(const uint8_t *s, stun_tid *id) { 1291| 16.9k| if (s && id) { ------------------ | Branch (1291:7): [True: 16.9k, False: 0] | Branch (1291:12): [True: 16.9k, False: 0] ------------------ 1292| 16.9k| memcpy(id->tsx_id, s, STUN_TID_SIZE); ------------------ | | 53| 16.9k|#define STUN_TID_SIZE (12) ------------------ 1293| 16.9k| } 1294| 16.9k|} ns_turn_msg.c:stun_tid_string_cpy: 1284| 29.0k|static void stun_tid_string_cpy(uint8_t *s, const stun_tid *id) { 1285| 29.0k| if (s && id) { ------------------ | Branch (1285:7): [True: 29.0k, False: 0] | Branch (1285:12): [True: 29.0k, False: 0] ------------------ 1286| 29.0k| memcpy(s, id->tsx_id, STUN_TID_SIZE); ------------------ | | 53| 29.0k|#define STUN_TID_SIZE (12) ------------------ 1287| 29.0k| } 1288| 29.0k|} ns_turn_msg.c:turn_random_tid_size: 154| 18.7k|static void turn_random_tid_size(void *id) { 155| 18.7k| uint32_t *ar = (uint32_t *)id; 156| 18.7k|#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION) 157| 18.7k| if (ar) { ------------------ | Branch (157:7): [True: 18.7k, False: 0] ------------------ 158| 75.1k| for (size_t i = 0; i < 3; ++i) { ------------------ | Branch (158:24): [True: 56.3k, False: 18.7k] ------------------ 159| 56.3k| ar[i] = (uint32_t)turn_random_number(); 160| 56.3k| } 161| 18.7k| } 162| |#else 163| | if (!RAND_bytes((unsigned char *)ar, 12)) { 164| | for (size_t i = 0; i < 3; ++i) { 165| | ar[i] = (uint32_t)turn_random_number(); 166| | } 167| | } 168| |#endif 169| 18.7k|} ns_turn_msg.c:stun_attr_check_valid: 1478| 2.03M|static stun_attr_ref stun_attr_check_valid(stun_attr_ref attr, size_t remaining) { 1479| 2.03M| if (remaining >= 4) { ------------------ | Branch (1479:7): [True: 2.03M, False: 90] ------------------ 1480| | /* Read the size of the attribute */ 1481| 2.03M| size_t attrlen = stun_attr_get_len(attr); 1482| 2.03M| remaining -= 4; 1483| | 1484| | /* Round to boundary */ 1485| 2.03M| const uint16_t rem4 = ((uint16_t)attrlen) & 0x0003; 1486| 2.03M| if (rem4) { ------------------ | Branch (1486:9): [True: 412k, False: 1.61M] ------------------ 1487| 412k| attrlen = attrlen + 4 - (int)rem4; 1488| 412k| } 1489| | 1490| | /* Check that there's enough space remaining */ 1491| 2.03M| if (attrlen <= remaining) { ------------------ | Branch (1491:9): [True: 2.00M, False: 27.8k] ------------------ 1492| 2.00M| return attr; 1493| 2.00M| } 1494| 2.03M| } 1495| | 1496| 27.8k| return NULL; 1497| 2.03M|} ns_turn_msg.c:stun_set_command_message_len_str: 408| 71.5k|static bool stun_set_command_message_len_str(uint8_t *buf, int len) { 409| 71.5k| if (len < STUN_HEADER_LENGTH) { ------------------ | | 46| 71.5k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (409:7): [True: 0, False: 71.5k] ------------------ 410| 0| return false; 411| 0| } 412| 71.5k| ((uint16_t *)buf)[1] = nswap16((uint16_t)(len - STUN_HEADER_LENGTH)); ------------------ | | 86| 71.5k|#define nswap16(s) ntohs(s) ------------------ 413| | return true; 414| 71.5k|} ns_turn_msg.c:ns_crc32: 1766| 1.55k|static uint32_t ns_crc32(const uint8_t *buffer, uint32_t len) { 1767| 1.55k| uint32_t crc = CRC_MASK; ------------------ | | 1730| 1.55k|#define CRC_MASK 0xFFFFFFFFUL ------------------ 1768| 1.26M| while (len--) { ------------------ | Branch (1768:10): [True: 1.25M, False: 1.55k] ------------------ 1769| 1.25M| UPDATE_CRC(crc, *buffer++); ------------------ | | 1732| 1.25M|#define UPDATE_CRC(crc, c) crc = crctable[(uint8_t)crc ^ (uint8_t)(c)] ^ (crc >> 8) ------------------ 1770| 1.25M| } 1771| 1.55k| return (~crc); 1772| 1.55k|} stun_addr_encode: 42| 6.52k|int stun_addr_encode(const ioa_addr *ca, uint8_t *cfield, int *clen, int xor_ed, uint32_t mc, const uint8_t *tsx_id) { 43| | 44| 6.52k| if (!cfield || !clen || !ca || !tsx_id) { ------------------ | Branch (44:7): [True: 0, False: 6.52k] | Branch (44:18): [True: 0, False: 6.52k] | Branch (44:27): [True: 0, False: 6.52k] | Branch (44:34): [True: 0, False: 6.52k] ------------------ 45| 0| return -1; 46| 0| } 47| | 48| 6.52k| if (ca->ss.sa_family == AF_INET || ca->ss.sa_family == 0) { ------------------ | Branch (48:7): [True: 4.34k, False: 2.17k] | Branch (48:38): [True: 0, False: 2.17k] ------------------ 49| | 50| | /* IPv4 address */ 51| | 52| 4.34k| *clen = 8; 53| | 54| 4.34k| cfield[0] = 0; 55| 4.34k| cfield[1] = 1; // IPv4 family 56| | 57| 4.34k| if (xor_ed) { ------------------ | Branch (57:9): [True: 3.26k, False: 1.08k] ------------------ 58| | 59| | /* Port */ 60| 3.26k| ((uint16_t *)cfield)[1] = (ca->s4.sin_port) ^ nswap16(mc >> 16); ------------------ | | 86| 3.26k|#define nswap16(s) ntohs(s) ------------------ 61| | 62| | /* Address */ 63| 3.26k| ((uint32_t *)cfield)[1] = (ca->s4.sin_addr.s_addr) ^ nswap32(mc); ------------------ | | 87| 3.26k|#define nswap32(ul) ntohl(ul) ------------------ 64| | 65| 3.26k| } else { 66| | 67| | /* Port */ 68| 1.08k| ((uint16_t *)cfield)[1] = ca->s4.sin_port; 69| | 70| | /* Address */ 71| 1.08k| ((uint32_t *)cfield)[1] = ca->s4.sin_addr.s_addr; 72| 1.08k| } 73| | 74| 4.34k| } else if (ca->ss.sa_family == AF_INET6) { ------------------ | Branch (74:14): [True: 2.17k, False: 0] ------------------ 75| | 76| | /* IPv6 address */ 77| | 78| 2.17k| *clen = 20; 79| | 80| 2.17k| cfield[0] = 0; 81| 2.17k| cfield[1] = 2; // IPv6 family 82| | 83| 2.17k| if (xor_ed) { ------------------ | Branch (83:9): [True: 2.17k, False: 0] ------------------ 84| | 85| 2.17k| unsigned int i; 86| 2.17k| uint8_t *dst = ((uint8_t *)cfield) + 4; 87| 2.17k| const uint8_t *src = (const uint8_t *)&(ca->s6.sin6_addr); 88| 2.17k| uint32_t magic = nswap32(mc); ------------------ | | 87| 2.17k|#define nswap32(ul) ntohl(ul) ------------------ 89| | 90| | /* Port */ 91| 2.17k| ((uint16_t *)cfield)[1] = ca->s6.sin6_port ^ nswap16(mc >> 16); ------------------ | | 86| 2.17k|#define nswap16(s) ntohs(s) ------------------ 92| | 93| | /* Address */ 94| | 95| 10.8k| for (i = 0; i < 4; ++i) { ------------------ | Branch (95:19): [True: 8.69k, False: 2.17k] ------------------ 96| 8.69k| dst[i] = (uint8_t)(src[i] ^ ((const uint8_t *)&magic)[i]); 97| 8.69k| } 98| 28.2k| for (i = 0; i < 12; ++i) { ------------------ | Branch (98:19): [True: 26.0k, False: 2.17k] ------------------ 99| 26.0k| dst[i + 4] = (uint8_t)(src[i + 4] ^ tsx_id[i]); 100| 26.0k| } 101| | 102| 2.17k| } else { 103| | 104| | /* Port */ 105| 0| ((uint16_t *)cfield)[1] = ca->s6.sin6_port; 106| | 107| | /* Address */ 108| 0| memcpy(((uint8_t *)cfield) + 4, &ca->s6.sin6_addr, 16); 109| 0| } 110| | 111| 2.17k| } else { 112| 0| return -1; 113| 0| } 114| | 115| 6.52k| return 0; 116| 6.52k|} stun_addr_decode: 118| 3.68k|int stun_addr_decode(ioa_addr *ca, const uint8_t *cfield, int len, int xor_ed, uint32_t mc, const uint8_t *tsx_id) { 119| | 120| 3.68k| if (!cfield || !len || !ca || !tsx_id || (len < 8)) { ------------------ | Branch (120:7): [True: 0, False: 3.68k] | Branch (120:18): [True: 0, False: 3.68k] | Branch (120:26): [True: 0, False: 3.68k] | Branch (120:33): [True: 0, False: 3.68k] | Branch (120:44): [True: 1.29k, False: 2.38k] ------------------ 121| 1.29k| return -1; 122| 1.29k| } 123| | 124| 2.38k| if (cfield[0] != 0) { ------------------ | Branch (124:7): [True: 396, False: 1.99k] ------------------ 125| 396| return -1; 126| 396| } 127| | 128| 1.99k| int sa_family; 129| | 130| 1.99k| if (cfield[1] == 1) { ------------------ | Branch (130:7): [True: 1.10k, False: 886] ------------------ 131| 1.10k| sa_family = AF_INET; 132| 1.10k| } else if (cfield[1] == 2) { ------------------ | Branch (132:14): [True: 377, False: 509] ------------------ 133| 377| sa_family = AF_INET6; 134| 509| } else { 135| 509| return -1; 136| 509| } 137| | 138| 1.48k| ca->ss.sa_family = sa_family; 139| | 140| 1.48k| if (sa_family == AF_INET) { ------------------ | Branch (140:7): [True: 1.10k, False: 377] ------------------ 141| | 142| 1.10k| if (len != 8) { ------------------ | Branch (142:9): [True: 423, False: 681] ------------------ 143| 423| return -1; 144| 423| } 145| | 146| | /* IPv4 address */ 147| | 148| | /* Port */ 149| 681| ca->s4.sin_port = ((const uint16_t *)cfield)[1]; 150| | 151| | /* Address */ 152| 681| ca->s4.sin_addr.s_addr = ((const uint32_t *)cfield)[1]; 153| | 154| 681| if (xor_ed) { ------------------ | Branch (154:9): [True: 249, False: 432] ------------------ 155| 249| ca->s4.sin_port ^= nswap16(mc >> 16); ------------------ | | 86| 249|#define nswap16(s) ntohs(s) ------------------ 156| 249| ca->s4.sin_addr.s_addr ^= nswap32(mc); ------------------ | | 87| 249|#define nswap32(ul) ntohl(ul) ------------------ 157| 249| } 158| | 159| 681| } else if (sa_family == AF_INET6) { ------------------ | Branch (159:14): [True: 377, False: 0] ------------------ 160| | 161| | /* IPv6 address */ 162| | 163| 377| if (len != 20) { ------------------ | Branch (163:9): [True: 134, False: 243] ------------------ 164| 134| return -1; 165| 134| } 166| | 167| | /* Port */ 168| 243| ca->s6.sin6_port = ((const uint16_t *)cfield)[1]; 169| | 170| | /* Address */ 171| 243| memcpy(&ca->s6.sin6_addr, ((const uint8_t *)cfield) + 4, 16); 172| | 173| 243| if (xor_ed) { ------------------ | Branch (173:9): [True: 50, False: 193] ------------------ 174| | 175| 50| unsigned int i; 176| 50| uint8_t *dst; 177| 50| const uint8_t *src; 178| 50| uint32_t magic = nswap32(mc); ------------------ | | 87| 50|#define nswap32(ul) ntohl(ul) ------------------ 179| | 180| | /* Port */ 181| 50| ca->s6.sin6_port ^= nswap16(mc >> 16); ------------------ | | 86| 50|#define nswap16(s) ntohs(s) ------------------ 182| | 183| | /* Address */ 184| 50| src = ((const uint8_t *)cfield) + 4; 185| 50| dst = (uint8_t *)&ca->s6.sin6_addr; 186| 250| for (i = 0; i < 4; ++i) { ------------------ | Branch (186:19): [True: 200, False: 50] ------------------ 187| 200| dst[i] = (uint8_t)(src[i] ^ ((const uint8_t *)&magic)[i]); 188| 200| } 189| 650| for (i = 0; i < 12; ++i) { ------------------ | Branch (189:19): [True: 600, False: 50] ------------------ 190| 600| dst[i + 4] = (uint8_t)(src[i + 4] ^ tsx_id[i]); 191| 600| } 192| 50| } 193| | 194| 243| } else { 195| 0| return -1; 196| 0| } 197| | 198| 924| return 0; 199| 1.48k|} ns_turn_msg.c:_ioa_ntoh64: 90| 1|static inline uint64_t _ioa_ntoh64(uint64_t v) { 91| 1|#if BYTE_ORDER == LITTLE_ENDIAN 92| 1| uint8_t *src = (uint8_t *)&v; 93| 1| uint8_t *dst = src + 7; 94| 5| while (src < dst) { ------------------ | Branch (94:10): [True: 4, False: 1] ------------------ 95| 4| uint8_t vdst = *dst; 96| 4| *(dst--) = *src; 97| 4| *(src++) = vdst; 98| 4| } 99| |#elif BYTE_ORDER == BIG_ENDIAN 100| | /* OK */ 101| |#else 102| |#error WRONG BYTE_ORDER SETTING 103| |#endif 104| 1| return v; 105| 1|}