Rayhaan JaufeerallyandClaude Fable 5.1
39632e3c38
Property tests (run by `cargo test`): - crates/packet/tests/properties.rs: every kind of message, generated, must be written, be as long as wire_len says, and read back equal; and noise, noise behind a valid header, and valid messages with bytes damaged must never do more than return an error. Anything the decoder accepts must be showable and survive being written and read again. - IpPrefix: text round trip, noise as text, `contains` against a bitwise model. - The session's framing: a stream of messages yields the same messages however it is cut into reads. Fuzz targets (fuzz/, cargo-fuzz on nightly, a minute each in CI): raw messages, message bodies behind a valid header, prefix text, the configuration file. Bugs found, each with a named regression test: - A prefix longer than its address family (e.g. an IPv4 NLRI of length 99) was accepted, and showing it panicked. The session logs every route, so one UPDATE from a peer ended the session task. Such a prefix is now malformed, and showing a prefix cannot fail. - Bits past a prefix's length were kept, so the same prefix sent with stray bits was a different key in the RIB. Prefixes now have one form. - An opaque extended community was read as seven octets instead of eight, putting every community after it out of step. - AGGREGATOR could be neither read from nor written to a peer with two-octet AS numbers. - The Outbound Route Filter and Long-Lived Graceful Restart capabilities were written differently from how they are read. - A capability value or unknown attribute too long for its length field was written with the length wrapped around; it is now an error, or for the attribute the two-octet length. Also: ROUTE-REFRESH carries its AFI and SAFI instead of being modelled as an empty message, and one with a body of the wrong length is refused. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
55 lines
1003 B
TOML
55 lines
1003 B
TOML
# Coverage-guided fuzz targets, run with cargo-fuzz on a nightly toolchain.
|
|
# See README.md in this directory.
|
|
[package]
|
|
name = "bgp-fuzz"
|
|
version = "0.0.0"
|
|
edition = "2024"
|
|
license = "Apache-2.0"
|
|
publish = false
|
|
|
|
[package.metadata]
|
|
cargo-fuzz = true
|
|
|
|
# Not part of the main workspace: libfuzzer needs nightly, the workspace
|
|
# builds on stable.
|
|
[workspace]
|
|
|
|
[dependencies]
|
|
bgp-packet = { path = "../crates/packet" }
|
|
bgp-primitives = { path = "../crates/primitives" }
|
|
bgp-server = { path = "../crates/server" }
|
|
bytes = "1.10.1"
|
|
libfuzzer-sys = "0.4"
|
|
protobuf = "3.7.2"
|
|
|
|
[lib]
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "message"
|
|
path = "fuzz_targets/message.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|
|
|
|
[[bin]]
|
|
name = "message_body"
|
|
path = "fuzz_targets/message_body.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|
|
|
|
[[bin]]
|
|
name = "prefix_text"
|
|
path = "fuzz_targets/prefix_text.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|
|
|
|
[[bin]]
|
|
name = "config"
|
|
path = "fuzz_targets/config.rs"
|
|
test = false
|
|
doc = false
|
|
bench = false
|