nclient4: add a fuzz target for BroadcastRawUDPConn.ReadFrom

Fuzzes the raw IPv4/UDP receive path with arbitrary frames and a fuzzed
buffer size. It keeps a small self-contained mock and frame builder so the
target also builds standalone under OSS-Fuzz.

Rather than a few invariants, the target checks ReadFrom against an
independent reference model: for the bytes the socket delivered it
recomputes, from the header fields, whether the frame is accepted and the
exact payload, length, and source, then requires ReadFrom to match. A
rejected frame must surface as an error; an accepted one must return that
exact payload and source, which locks the length and payload semantics
(for example dropping bytes past IP Total Length) and not just the frame
type.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

Author: thc1006

dhcpv4/nclient4/fuzz_test.go

@@ -0,0 +1,164 @@
+// Copyright 2018 the u-root Authors. All rights reserved
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.18 && (darwin || freebsd || linux || netbsd || openbsd || dragonfly)
+
+package nclient4
+
+import (
+	"bytes"
+	"encoding/binary"
+	"io"
+	"net"
+	"testing"
+	"time"
+)
+
+// fuzzFrame builds an IPv4+UDP frame with the given IPv4 total-length field and
+// dhcp payload. It is kept here, not shared with the other tests, so the target
+// builds standalone under OSS-Fuzz's go-118-fuzz-build (which sees only this file).
+func fuzzFrame(ipTotalLen int, dhcp []byte) []byte {
+	pkt := make([]byte, 28+len(dhcp))
+	pkt[0] = 0x45 // IPv4, IHL 5
+	binary.BigEndian.PutUint16(pkt[2:], uint16(ipTotalLen))
+	pkt[9] = byte(udpProtocolNumber)
+	binary.BigEndian.PutUint16(pkt[22:], 68) // UDP destination port
+	binary.BigEndian.PutUint16(pkt[24:], uint16(8+len(dhcp)))
+	copy(pkt[28:], dhcp)
+	return pkt
+}
+
+// fuzzConn hands ReadFrom the fuzz frame once, then reports EOF so the receive
+// loop stops.
+type fuzzConn struct {
+	frame []byte
+	done  bool
+}
+
+func (c *fuzzConn) ReadFrom(p []byte) (int, net.Addr, error) {
+	if c.done {
+		return 0, nil, io.EOF
+	}
+	c.done = true
+	return copy(p, c.frame), &net.UDPAddr{}, nil
+}
+func (c *fuzzConn) WriteTo([]byte, net.Addr) (int, error) { return 0, nil }
+func (c *fuzzConn) Close() error                          { return nil }
+func (c *fuzzConn) LocalAddr() net.Addr                   { return &net.UDPAddr{} }
+func (c *fuzzConn) SetDeadline(time.Time) error           { return nil }
+func (c *fuzzConn) SetReadDeadline(time.Time) error       { return nil }
+func (c *fuzzConn) SetWriteDeadline(time.Time) error      { return nil }
+
+// expectedReadFrom independently recomputes what ReadFrom must return for the
+// bytes the socket actually delivered, so the fuzz target pins the exact length,
+// payload, and source rather than only the frame type. It encodes the base
+// receive-path contract (#583, #292): the payload is the IPv4 payload after the
+// UDP header bounded by IP Total Length, so bytes past Total Length are dropped.
+//
+// It does not yet model the #589 UDP Length bound or the #591 fragment rejection,
+// which live on separate branches. When this target is rebased onto them, also
+// require 8 <= UDP Length <= IP payload, take the payload as
+// delivered[hlen+8 : hlen+udpLen], and reject MF or a non-zero fragment offset.
+func expectedReadFrom(delivered []byte, bufLen int) (accept bool, wantN int, payload []byte, srcIP net.IP, srcPort int) {
+	if len(delivered) < ipv4MinimumSize {
+		return false, 0, nil, nil, 0
+	}
+	hlen := int(delivered[0]&0x0f) * 4
+	tlen := int(binary.BigEndian.Uint16(delivered[2:4]))
+	// isValid: header within [20, total length], total length within the frame.
+	if hlen < ipv4MinimumSize || hlen > tlen || tlen > len(delivered) {
+		return false, 0, nil, nil, 0
+	}
+	if delivered[0]>>4 != 4 { // IPv4 version
+		return false, 0, nil, nil, 0
+	}
+	if delivered[9] != byte(udpProtocolNumber) {
+		return false, 0, nil, nil, 0
+	}
+	ipPayloadLen := tlen - hlen
+	if ipPayloadLen < udpMinimumSize { // #583: room for a UDP header
+		return false, 0, nil, nil, 0
+	}
+	// tlen <= len(delivered) and ipPayloadLen >= 8 together put the UDP header
+	// and the payload up to Total Length within the delivered bytes.
+	if binary.BigEndian.Uint16(delivered[hlen+2:hlen+4]) != 68 { // destination port
+		return false, 0, nil, nil, 0
+	}
+	payload = delivered[hlen+udpMinimumSize : tlen] // bytes past Total Length dropped (#292)
+	wantN = ipPayloadLen - udpMinimumSize
+	if wantN > bufLen {
+		wantN = bufLen
+	}
+	srcIP = net.IP(delivered[srcAddr : srcAddr+ipv4AddressSize])
+	srcPort = int(binary.BigEndian.Uint16(delivered[hlen : hlen+2]))
+	return true, wantN, payload, srcIP, srcPort
+}
+
+// FuzzBroadcastRawUDPConnReadFrom feeds arbitrary bytes as one raw frame into
+// ReadFrom with a fuzzed buffer size and checks the result against an
+// independent model: a rejected frame must surface as an error, and an accepted
+// frame must return exactly the payload, length, and source the model derives.
+func FuzzBroadcastRawUDPConnReadFrom(f *testing.F) {
+	dhcp := []byte("hello world dhcp payload")
+	seeds := [][]byte{
+		fuzzFrame(20, nil),                                // IPv4 payload 0, below the UDP header (#583)
+		fuzzFrame(27, nil),                                // IPv4 payload 7, below the UDP header (#583)
+		fuzzFrame(28, []byte{1, 2, 3}),                    // IPv4 payload 8, empty datagram
+		fuzzFrame(28+len(dhcp), dhcp),                     // a valid reply
+		fuzzFrame(28, []byte("trailing data past total")), // total length stops at the header (#292)
+		{0x45, 0, 0, 40},                                  // header claims 40 bytes, frame truncated (#455)
+		{0x4f, 0, 0, 60},                                  // IHL 15 header with nothing after it (#507)
+		{0x45},                                            // truncated IPv4 header
+		{},                                                // empty frame
+	}
+	for _, s := range seeds {
+		f.Add(s, uint16(512))
+	}
+	f.Add(fuzzFrame(28+len(dhcp), dhcp), uint16(0)) // a valid reply into an empty buffer
+	f.Add(fuzzFrame(28+len(dhcp), dhcp), uint16(4)) // ... and one too small to hold it
+
+	f.Fuzz(func(t *testing.T, raw []byte, bufLen uint16) {
+		b := make([]byte, int(bufLen%2048))
+		upc := &BroadcastRawUDPConn{
+			PacketConn: &fuzzConn{frame: raw},
+			boundAddr:  &net.UDPAddr{Port: 68},
+		}
+		n, addr, err := upc.ReadFrom(b)
+
+		// The socket copies raw into a fixed-size receive buffer, so ReadFrom only
+		// ever parses this prefix.
+		maxRecv := ipv4MaximumHeaderSize + udpMinimumSize + len(b)
+		delivered := raw
+		if len(delivered) > maxRecv {
+			delivered = delivered[:maxRecv]
+		}
+		accept, wantN, payload, srcIP, srcPort := expectedReadFrom(delivered, len(b))
+
+		if !accept {
+			if err == nil {
+				t.Fatalf("accepted a frame the model rejects: n=%d delivered=%x", n, delivered)
+			}
+			return
+		}
+		if err != nil {
+			t.Fatalf("rejected a frame the model accepts: err=%v delivered=%x", err, delivered)
+		}
+		if n != wantN || n < 0 || n > len(b) {
+			t.Fatalf("ReadFrom n=%d, want %d (buffer %d)", n, wantN, len(b))
+		}
+		if !bytes.Equal(b[:n], payload[:wantN]) {
+			t.Fatalf("ReadFrom payload=%x, want %x", b[:n], payload[:wantN])
+		}
+		ua, ok := addr.(*net.UDPAddr)
+		if !ok || ua == nil {
+			t.Fatalf("ReadFrom addr=%v, want *net.UDPAddr", addr)
+		}
+		if !ua.IP.Equal(srcIP) {
+			t.Fatalf("ReadFrom source IP=%v, want %v", ua.IP, srcIP)
+		}
+		if ua.Port != srcPort {
+			t.Fatalf("ReadFrom source port=%d, want %d", ua.Port, srcPort)
+		}
+	})
+}