|
1 | 1 | #include "forwarding.h" |
2 | 2 |
|
3 | 3 | #include <cassert> |
| 4 | +#include <cstring> |
4 | 5 | #include <memory> |
| 6 | +#include <optional> |
5 | 7 |
|
6 | 8 | #include "../testing/fuzzing/fuzz_support.h" |
7 | 9 | #include "../testing/fuzzing/fuzz_tox.h" |
8 | 10 |
|
9 | 11 | namespace { |
10 | 12 |
|
| 13 | +std::optional<std::tuple<IP_Port, IP_Port, const uint8_t *, size_t>> prepare(Fuzz_Data &input) |
| 14 | +{ |
| 15 | + CONSUME_OR_RETURN_VAL(const uint8_t *ipp_packed, input, SIZE_IP_PORT, std::nullopt); |
| 16 | + IP_Port ipp; |
| 17 | + unpack_ip_port(&ipp, ipp_packed, SIZE_IP6, true); |
| 18 | + |
| 19 | + CONSUME_OR_RETURN_VAL(const uint8_t *forwarder_packed, input, SIZE_IP_PORT, std::nullopt); |
| 20 | + IP_Port forwarder; |
| 21 | + unpack_ip_port(&forwarder, forwarder_packed, SIZE_IP6, true); |
| 22 | + |
| 23 | + // 2 bytes: size of the request |
| 24 | + CONSUME_OR_RETURN_VAL(const uint8_t *data_size_bytes, input, sizeof(uint16_t), std::nullopt); |
| 25 | + uint16_t data_size; |
| 26 | + std::memcpy(&data_size, data_size_bytes, sizeof(uint16_t)); |
| 27 | + |
| 28 | + // data bytes (max 64K) |
| 29 | + CONSUME_OR_RETURN_VAL(const uint8_t *data, input, data_size, std::nullopt); |
| 30 | + |
| 31 | + return {{ipp, forwarder, data, data_size}}; |
| 32 | +} |
| 33 | + |
11 | 34 | void TestSendForwardRequest(Fuzz_Data &input) |
12 | 35 | { |
13 | | - const Network *ns = system_network(); // TODO(iphydf): fuzz_network |
14 | | - assert(ns != nullptr); |
15 | | - const Memory *mem = system_memory(); // TODO(iphydf): fuzz_memory |
16 | | - assert(mem != nullptr); |
17 | | - |
18 | | - with<Logger>{} >> with<Networking_Core>{input, ns, mem} >> [&input](Ptr<Networking_Core> net) { |
19 | | - with<IP_Port>{input} >> [net = std::move(net), &input](const IP_Port &forwarder) { |
20 | | - CONSUME1_OR_RETURN(const uint16_t chain_length, input); |
21 | | - const uint16_t chain_keys_size = chain_length * CRYPTO_PUBLIC_KEY_SIZE; |
22 | | - CONSUME_OR_RETURN(const uint8_t *chain_keys, input, chain_keys_size); |
23 | | - |
24 | | - send_forward_request( |
25 | | - net.get(), &forwarder, chain_keys, chain_length, input.data, input.size); |
26 | | - }; |
27 | | - }; |
| 36 | + CONSUME1_OR_RETURN(const uint16_t chain_length, input); |
| 37 | + const uint16_t chain_keys_size = chain_length * CRYPTO_PUBLIC_KEY_SIZE; |
| 38 | + CONSUME_OR_RETURN(const uint8_t *chain_keys, input, chain_keys_size); |
| 39 | + |
| 40 | + auto prep = prepare(input); |
| 41 | + if (!prep.has_value()) { |
| 42 | + return; |
| 43 | + } |
| 44 | + auto [ipp, forwarder, data, data_size] = prep.value(); |
| 45 | + |
| 46 | + // rest of the fuzz data is input for malloc and network |
| 47 | + Fuzz_System sys(input); |
| 48 | + |
| 49 | + Ptr<Logger> logger(logger_new(), logger_kill); |
| 50 | + |
| 51 | + Ptr<Networking_Core> net(new_networking_ex(logger.get(), sys.mem.get(), sys.ns.get(), &ipp.ip, |
| 52 | + ipp.port, ipp.port + 100, nullptr), |
| 53 | + kill_networking); |
| 54 | + if (net == nullptr) { |
| 55 | + return; |
| 56 | + } |
| 57 | + |
| 58 | + send_forward_request(net.get(), &forwarder, chain_keys, chain_length, data, data_size); |
28 | 59 | } |
29 | 60 |
|
30 | 61 | void TestForwardReply(Fuzz_Data &input) |
31 | 62 | { |
32 | | - const Network *ns = system_network(); // TODO(iphydf): fuzz_network |
33 | | - assert(ns != nullptr); |
34 | | - const Memory *mem = system_memory(); // TODO(iphydf): fuzz_memory |
35 | | - assert(mem != nullptr); |
36 | | - |
37 | | - with<Logger>{} >> with<Networking_Core>{input, ns, mem} >> [&input](Ptr<Networking_Core> net) { |
38 | | - with<IP_Port>{input} >> [net = std::move(net), &input](const IP_Port &forwarder) { |
39 | | - CONSUME1_OR_RETURN(const uint16_t sendback_length, input); |
40 | | - CONSUME_OR_RETURN(const uint8_t *sendback, input, sendback_length); |
41 | | - |
42 | | - forward_reply(net.get(), &forwarder, sendback, sendback_length, input.data, input.size); |
43 | | - }; |
44 | | - }; |
| 63 | + CONSUME1_OR_RETURN(const uint16_t sendback_length, input); |
| 64 | + CONSUME_OR_RETURN(const uint8_t *sendback, input, sendback_length); |
| 65 | + |
| 66 | + auto prep = prepare(input); |
| 67 | + if (!prep.has_value()) { |
| 68 | + return; |
| 69 | + } |
| 70 | + auto [ipp, forwarder, data, data_size] = prep.value(); |
| 71 | + |
| 72 | + // rest of the fuzz data is input for malloc and network |
| 73 | + Fuzz_System sys(input); |
| 74 | + |
| 75 | + Ptr<Logger> logger(logger_new(), logger_kill); |
| 76 | + |
| 77 | + Ptr<Networking_Core> net(new_networking_ex(logger.get(), sys.mem.get(), sys.ns.get(), &ipp.ip, |
| 78 | + ipp.port, ipp.port + 100, nullptr), |
| 79 | + kill_networking); |
| 80 | + if (net == nullptr) { |
| 81 | + return; |
| 82 | + } |
| 83 | + |
| 84 | + forward_reply(net.get(), &forwarder, sendback, sendback_length, data, data_size); |
45 | 85 | } |
46 | 86 |
|
47 | 87 | } // namespace |
|
0 commit comments