mirror of https://github.com/outbackdingo/firezone.git synced 2026-01-27 10:18:54 +00:00

Files

Thomas Eizinger 69f9a03ee8 refactor(connlib): simplify IpPacket struct (#9795 )

With the removal of the NAT64/46 modules, we can now simplify the
internals of our `IpPacket` struct. The requirements for our `IpPacket`
struct are somewhat delicate.

On the one hand, we don't want to be overly restrictive in our parsing /
validation code because there is a lot of broken software out there that
doesn't necessarily follow RFCs. Hence, we want to be as lenient as
possible in what we accept.

On the other hand, we do need to verify certain aspects of the packet,
like the payload lengths. At the moment, we are somewhat too lenient
there which causes errors on the Gateway where we have to NAT or
otherwise manipulate the packets. See #9567 or #9552 for example.

To fix this, we make the parsing in the `IpPacket` constructor more
restrictive. If it is a UDP, TCP or ICMP packet, we attempt to fully
parse its headers and validate the payload lengths.

This parsing allows us to then rely on the integrity of the packet as
part of the implementation. This does create several code paths that can
in theory panic but in practice, should be impossible to hit. To ensure
that this does in fact not happen, we also tackle an issue that is long
overdue: Fuzzing.

Resolves: #6667 
Resolves: #9567
Resolves: #9552

2025-07-29 04:42:57 +00:00

fuzz_targets

refactor(connlib): simplify IpPacket struct (#9795 )

2025-07-29 04:42:57 +00:00

.gitignore

refactor(connlib): simplify IpPacket struct (#9795 )

2025-07-29 04:42:57 +00:00

Cargo.toml

refactor(connlib): simplify IpPacket struct (#9795 )

2025-07-29 04:42:57 +00:00

README.md

refactor(connlib): simplify IpPacket struct (#9795 )

2025-07-29 04:42:57 +00:00

README.md

Fuzzing

Setup

Install cargo-fuzz
Install cargo-llvm-cov (if you want to see coverage statistics)
Temporarily disable LTO (fuzzing won't work otherwise):
```
export CARGO_PROFILE_RELEASE_LTO=false
```

Run

Runs the fuzzer for the ip_packet fuzz target. Substitute that for other targets that you want to run.

cargo +nightly fuzz run --fuzz-dir tests/fuzz --target-dir ./target ip_packet

Coverage

Clean workspace

cargo +nightly llvm-cov clean --workspace

Fuzz. See command above.

Generate coverage profile

cargo +nightly fuzz coverage --fuzz-dir tests/fuzz --target-dir ./target ip_packet

Copy profile data to place where cargo-llvm-cov can find it
```
cp tests/fuzz/coverage/**/*.profraw ./target
```

Generate coverage report

cargo +nightly llvm-cov report --html --release --target x86_64-unknown-linux-gnu