commit 912c7523ea46b5db4da9aecb1574516e239ebbac
| author | 斟酌 鵬兄 <tgckpg@gmail.com> |
|---|
| date | 2026-05-28T23:41:01Z |
|---|
| subject | Fixed stream_conn fuzz (previously tcp_route) |
|---|
commit 912c7523ea46b5db4da9aecb1574516e239ebbac
Author: 斟酌 鵬兄 <tgckpg@gmail.com>
Date: 2026-05-28T23:41:01Z
Fixed stream_conn fuzz (previously tcp_route)
---
fuzz/Makefile | 22 ++++--------
fuzz/{fuzz_tcp_route.c => fuzz_stream_conn.c} | 8 ++---
fuzz/seeds/{tcp_route => stream_conn}/basic | 0
.../seeds/{tcp_route => stream_conn}/chunked_weird | 0
fuzz/seeds/{tcp_route => stream_conn}/ff | 0
fuzz/seeds/{tcp_route => stream_conn}/hex_junk | 0
fuzz/seeds/{tcp_route => stream_conn}/http | 0
.../seeds/{tcp_route => stream_conn}/http2_preface | 0
fuzz/seeds/{tcp_route => stream_conn}/http_connect | 0
fuzz/seeds/{tcp_route => stream_conn}/http_get | 0
fuzz/seeds/{tcp_route => stream_conn}/http_post | 0
.../{tcp_route => stream_conn}/huge_request_line | 0
fuzz/seeds/{tcp_route => stream_conn}/long_header | 0
fuzz/seeds/{tcp_route => stream_conn}/many_headers | 0
fuzz/seeds/{tcp_route => stream_conn}/nuls | Bin
.../percent_encoded_junk | 0
fuzz/seeds/{tcp_route => stream_conn}/proxyish | Bin
.../{tcp_route => stream_conn}/smuggling_shape_1 | 0
fuzz/seeds/{tcp_route => stream_conn}/ssh_banner | 0
.../tls_clienthello_like | Bin
src/stream_conn.c | 37 +++++++++++++++++++++
src/stream_conn.h | 9 +++++
src/stream_route.c | 37 ---------------------
23 files changed, 57 insertions(+), 56 deletions(-)
diff --git a/fuzz/Makefile b/fuzz/Makefile
index 0c55461..c6e0acb 100644
--- a/fuzz/Makefile
+++ b/fuzz/Makefile
@@ -12,9 +12,11 @@ OUT := $(PROJECT_ROOT)/bin/fuzz
CORPUS := $(PROJECT_ROOT)/corpus
SEEDS := seeds
-TARGETS := proxy_v2_build file_conf tcp_route
+TARGETS := proxy_v2_build file_conf stream_conn
BINS := $(addprefix $(OUT)/fuzz_,$(TARGETS))
+PROJECT_SRCS := $(filter-out $(SRC_DIR)/tinyproxy.c,$(wildcard $(SRC_DIR)/*.c))
+
FUZZ_CFLAGS ?= -g -O1 -DFUZZ -fsanitize=fuzzer,address,undefined
FUZZ_LDFLAGS ?= -fsanitize=fuzzer,address,undefined
@@ -51,22 +53,12 @@ $(OUT)/fuzz_file_conf: \
-o $@ \
$(LDFLAGS) $(FUZZ_LDFLAGS) $(LDLIBS)
-$(OUT)/fuzz_tcp_route: \
- fuzz_tcp_route.c \
- $(SRC_DIR)/tcp_route.c \
- $(SRC_DIR)/proxy_proto_v2.c \
- $(SRC_DIR)/klog.c \
- $(LIBEVENT_DEPS) \
- | $(OUT)
+$(OUT)/fuzz_stream_conn: fuzz_stream_conn.c $(PROJECT_SRCS)
$(CC) $(CFLAGS) $(FUZZ_CFLAGS) $(CPPFLAGS) \
- $(SRC_DIR)/tcp_route.c \
- $(SRC_DIR)/proxy_proto_v2.c \
- $(SRC_DIR)/route.c \
- $(SRC_DIR)/x_builtins.c \
- $(SRC_DIR)/klog.c \
- fuzz_tcp_route.c \
+ -I$(SRC_DIR) \
+ $^ \
-o $@ \
- $(LDFLAGS) $(FUZZ_LDFLAGS) $(LDLIBS)
+ $(LDFLAGS) $(LDLIBS)
seed-%: FORCE
mkdir -p $(CORPUS)/$*
diff --git a/fuzz/fuzz_tcp_route.c b/fuzz/fuzz_stream_conn.c
similarity index 94%
rename from fuzz/fuzz_tcp_route.c
rename to fuzz/fuzz_stream_conn.c
index 1e6ac2e..131f2de 100644
--- a/fuzz/fuzz_tcp_route.c
+++ b/fuzz/fuzz_stream_conn.c
@@ -13,8 +13,7 @@
#include <event2/event.h>
#include "route.h"
-#include "tcp_route.h"
-#include "klog.h"
+#include "stream_conn.h"
static void set_nonblock(int fd)
{
@@ -47,7 +46,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
struct route r;
memset(&r, 0, sizeof(r));
- r.proto = PROTO_TCP;
r.line_no = 1;
/*
@@ -56,6 +54,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
r.listen.kind = ENDPOINT_INET;
snprintf(r.listen.host, sizeof(r.listen.host), "127.0.0.1");
r.listen.port = 12345;
+ r.listen.proto = PROTO_TCP;
/*
* Important: this should be something connect_upstream() can handle.
@@ -65,6 +64,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
r.upstream.kind = ENDPOINT_INET;
snprintf(r.upstream.host, sizeof(r.upstream.host), "127.0.0.1");
r.upstream.port = 9;
+ r.upstream.proto = PROTO_TCP;
r.opts.proxy_v2 = (data[0] & 1) != 0;
r.opts.keep_alive = (data[0] & 2) != 0;
@@ -77,7 +77,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
struct sockaddr_un *sun = (struct sockaddr_un *)&peer;
sun->sun_family = AF_UNIX;
- if (tcp_route_adopt_client_for_fuzz(
+ if (stream_route_adopt_client_for_fuzz(
base,
&r,
sv[1],
diff --git a/fuzz/seeds/tcp_route/basic b/fuzz/seeds/stream_conn/basic
similarity index 100%
rename from fuzz/seeds/tcp_route/basic
rename to fuzz/seeds/stream_conn/basic
diff --git a/fuzz/seeds/tcp_route/chunked_weird b/fuzz/seeds/stream_conn/chunked_weird
similarity index 100%
rename from fuzz/seeds/tcp_route/chunked_weird
rename to fuzz/seeds/stream_conn/chunked_weird
diff --git a/fuzz/seeds/tcp_route/ff b/fuzz/seeds/stream_conn/ff
similarity index 100%
rename from fuzz/seeds/tcp_route/ff
rename to fuzz/seeds/stream_conn/ff
diff --git a/fuzz/seeds/tcp_route/hex_junk b/fuzz/seeds/stream_conn/hex_junk
similarity index 100%
rename from fuzz/seeds/tcp_route/hex_junk
rename to fuzz/seeds/stream_conn/hex_junk
diff --git a/fuzz/seeds/tcp_route/http b/fuzz/seeds/stream_conn/http
similarity index 100%
rename from fuzz/seeds/tcp_route/http
rename to fuzz/seeds/stream_conn/http
diff --git a/fuzz/seeds/tcp_route/http2_preface b/fuzz/seeds/stream_conn/http2_preface
similarity index 100%
rename from fuzz/seeds/tcp_route/http2_preface
rename to fuzz/seeds/stream_conn/http2_preface
diff --git a/fuzz/seeds/tcp_route/http_connect b/fuzz/seeds/stream_conn/http_connect
similarity index 100%
rename from fuzz/seeds/tcp_route/http_connect
rename to fuzz/seeds/stream_conn/http_connect
diff --git a/fuzz/seeds/tcp_route/http_get b/fuzz/seeds/stream_conn/http_get
similarity index 100%
rename from fuzz/seeds/tcp_route/http_get
rename to fuzz/seeds/stream_conn/http_get
diff --git a/fuzz/seeds/tcp_route/http_post b/fuzz/seeds/stream_conn/http_post
similarity index 100%
rename from fuzz/seeds/tcp_route/http_post
rename to fuzz/seeds/stream_conn/http_post
diff --git a/fuzz/seeds/tcp_route/huge_request_line b/fuzz/seeds/stream_conn/huge_request_line
similarity index 100%
rename from fuzz/seeds/tcp_route/huge_request_line
rename to fuzz/seeds/stream_conn/huge_request_line
diff --git a/fuzz/seeds/tcp_route/long_header b/fuzz/seeds/stream_conn/long_header
similarity index 100%
rename from fuzz/seeds/tcp_route/long_header
rename to fuzz/seeds/stream_conn/long_header
diff --git a/fuzz/seeds/tcp_route/many_headers b/fuzz/seeds/stream_conn/many_headers
similarity index 100%
rename from fuzz/seeds/tcp_route/many_headers
rename to fuzz/seeds/stream_conn/many_headers
diff --git a/fuzz/seeds/tcp_route/nuls b/fuzz/seeds/stream_conn/nuls
similarity index 100%
rename from fuzz/seeds/tcp_route/nuls
rename to fuzz/seeds/stream_conn/nuls
diff --git a/fuzz/seeds/tcp_route/percent_encoded_junk b/fuzz/seeds/stream_conn/percent_encoded_junk
similarity index 100%
rename from fuzz/seeds/tcp_route/percent_encoded_junk
rename to fuzz/seeds/stream_conn/percent_encoded_junk
diff --git a/fuzz/seeds/tcp_route/proxyish b/fuzz/seeds/stream_conn/proxyish
similarity index 100%
rename from fuzz/seeds/tcp_route/proxyish
rename to fuzz/seeds/stream_conn/proxyish
diff --git a/fuzz/seeds/tcp_route/smuggling_shape_1 b/fuzz/seeds/stream_conn/smuggling_shape_1
similarity index 100%
rename from fuzz/seeds/tcp_route/smuggling_shape_1
rename to fuzz/seeds/stream_conn/smuggling_shape_1
diff --git a/fuzz/seeds/tcp_route/ssh_banner b/fuzz/seeds/stream_conn/ssh_banner
similarity index 100%
rename from fuzz/seeds/tcp_route/ssh_banner
rename to fuzz/seeds/stream_conn/ssh_banner
diff --git a/fuzz/seeds/tcp_route/tls_clienthello_like b/fuzz/seeds/stream_conn/tls_clienthello_like
similarity index 100%
rename from fuzz/seeds/tcp_route/tls_clienthello_like
rename to fuzz/seeds/stream_conn/tls_clienthello_like
diff --git a/src/stream_conn.c b/src/stream_conn.c
index 2beb4fd..1f5b4c0 100644
--- a/src/stream_conn.c
+++ b/src/stream_conn.c
@@ -354,3 +354,40 @@ static void worker_adopt_client_fd(struct worker *w, struct accepted_client *ac)
void dispatch_client_fd(struct worker *w, struct accepted_client *ac) {
worker_adopt_client_fd(w, ac);
}
+
+#ifdef FUZZ
+int stream_route_adopt_client_for_fuzz(
+ struct event_base *base,
+ const struct route *r,
+ evutil_socket_t client_fd,
+ const struct sockaddr_storage *peer_addr,
+ socklen_t peer_addr_len
+) {
+ if (base == NULL || r == NULL || client_fd < 0) {
+ return -1;
+ }
+
+ struct worker w;
+ memset(&w, 0, sizeof(w));
+
+ w.base = base;
+ w.id = 0;
+
+ struct accepted_client ac;
+ memset(&ac, 0, sizeof(ac));
+
+ ac.fd = client_fd;
+ ac.route = r;
+
+ if (peer_addr != NULL &&
+ peer_addr_len > 0 &&
+ peer_addr_len <= sizeof(ac.peer_addr)) {
+ memcpy(&ac.peer_addr, peer_addr, peer_addr_len);
+ ac.peer_addr_len = peer_addr_len;
+ }
+
+ worker_adopt_client_fd(&w, &ac);
+
+ return 0;
+}
+#endif
diff --git a/src/stream_conn.h b/src/stream_conn.h
index 827b84a..4465ff4 100644
--- a/src/stream_conn.h
+++ b/src/stream_conn.h
@@ -9,4 +9,13 @@ void free_conn(conn_t *conn);
void set_client_idle_timeout(conn_t *conn, const struct route *r);
void event_cb(struct bufferevent *bev, short events, void *arg);
+#ifdef FUZZ
+int stream_route_adopt_client_for_fuzz(
+ struct event_base *base,
+ const struct route *r,
+ evutil_socket_t client_fd,
+ const struct sockaddr_storage *peer_addr,
+ socklen_t peer_addr_len);
+#endif
+
#endif
diff --git a/src/stream_route.c b/src/stream_route.c
index 1147540..c901d2a 100644
--- a/src/stream_route.c
+++ b/src/stream_route.c
@@ -103,40 +103,3 @@ void stop_stream_route(struct stream_route_ctx *ctx)
memset(ctx, 0, sizeof(*ctx));
}
-
-#ifdef FUZZ
-int stream_route_adopt_client_for_fuzz(
- struct event_base *base,
- const struct route *r,
- evutil_socket_t client_fd,
- const struct sockaddr_storage *peer_addr,
- socklen_t peer_addr_len
-) {
- if (base == NULL || r == NULL || client_fd < 0) {
- return -1;
- }
-
- struct worker w;
- memset(&w, 0, sizeof(w));
-
- w.base = base;
- w.id = 0;
-
- struct accepted_client ac;
- memset(&ac, 0, sizeof(ac));
-
- ac.fd = client_fd;
- ac.route = r;
-
- if (peer_addr != NULL &&
- peer_addr_len > 0 &&
- peer_addr_len <= sizeof(ac.peer_addr)) {
- memcpy(&ac.peer_addr, peer_addr, peer_addr_len);
- ac.peer_addr_len = peer_addr_len;
- }
-
- worker_adopt_client_fd(&w, &ac);
-
- return 0;
-}
-#endif