[PATCH 3/5] fuzz: Bypass isolation and adapt sockets for AFL++

[Anshu Kumari <anskuma@redhat.com>]

Few components which needs to be disabled to support AFL++
to work:

- isolation.c: Skip isolation and seccomp sandboxing that breaks AFL++
  pipes, namespaces, and ASan mmap/mprotect operations.
- util.c / tap.c: Switch UNIX socket to SOCK_SEQPACKET to preserve frame
  boundaries, simplifying tap_passt_input() to a single recv() and removing
  vnet_len framing.
- passt.h: Use /tmp/passt_fuzz_%i.socket to avoid path collisions with
  production instances.
- tcp_buf.c: Include fuzz.h to route recvmsg() through deterministic wrappers.

Signed-off-by: Anshu Kumari <anskuma@redhat.com>
---
 isolation.c | 11 +++++++++++
 passt.h     |  4 ++++
 tap.c       | 21 +++++++++++++++++++++
 tcp_buf.c   |  1 +
 util.c      | 10 ++++++++++
 5 files changed, 47 insertions(+)

diff --git a/isolation.c b/isolation.c
index a30b329..61fc76a 100644
--- a/isolation.c
+++ b/isolation.c
@@ -208,6 +208,9 @@ static int move_root(void)
  */
 void isolate_initial(void)
 {
+#ifdef FUZZING
+	return;
+#endif
 	uint64_t keep;
 
 	/* We want to keep CAP_NET_BIND_SERVICE in the initial
@@ -389,6 +392,10 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
  */
 int isolate_prefork(const struct ctx *c)
 {
+#ifdef FUZZING
+	(void)c;
+	return 0;
+#endif
 	int flags = CLONE_NEWIPC | CLONE_NEWNS | CLONE_NEWUTS;
 	uint64_t ns_caps = 0;
 
@@ -466,6 +473,10 @@ int isolate_prefork(const struct ctx *c)
  */
 void isolate_postfork(const struct ctx *c)
 {
+#ifdef FUZZING
+	(void)c;
+	return;
+#endif
 	struct sock_fprog prog;
 
 	prctl(PR_SET_DUMPABLE, 0);
diff --git a/passt.h b/passt.h
index 51ccd4f..141c9f8 100644
--- a/passt.h
+++ b/passt.h
@@ -7,7 +7,11 @@
 #define PASST_H
 
 #define UNIX_SOCK_MAX		100
+#ifdef FUZZING
+#define UNIX_SOCK_PATH		"/tmp/passt_fuzz_%i.socket"
+#else
 #define UNIX_SOCK_PATH		"/tmp/passt_%i.socket"
+#endif
 
 union epoll_ref;
 
diff --git a/tap.c b/tap.c
index dfa66c7..f32c9ad 100644
--- a/tap.c
+++ b/tap.c
@@ -14,6 +14,7 @@
  */
 
 #include <sched.h>
+#include <time.h>
 #include <unistd.h>
 #include <signal.h>
 #include <stdio.h>
@@ -61,6 +62,7 @@
 #include "vhost_user.h"
 #include "vu_common.h"
 #include "epoll_ctl.h"
+#include "fuzz.h"
 
 /* Maximum allowed frame lengths (including L2 header) */
 
@@ -144,8 +146,10 @@ void tap_send_single(const struct ctx *c, const void *data, size_t l2len)
 
 	switch (c->mode) {
 	case MODE_PASST:
+#ifndef FUZZING
 		iov[iovcnt] = IOV_OF_LVALUE(vnet_len);
 		iovcnt++;
+#endif
 		/* fall through */
 	case MODE_PASTA:
 		iov[iovcnt].iov_base = (void *)data;
@@ -1231,6 +1235,22 @@ static void tap_passt_input(struct ctx *c, const struct timespec *now)
 
 	tap_flush_pools();
 
+#ifdef FUZZING
+	/* SOCK_SEQPACKET: each recv returns exactly one frame */
+	do {
+		n = recv(c->fd_tap, pkt_buf, sizeof(pkt_buf), MSG_DONTWAIT);
+	} while ((n < 0) && errno == EINTR);
+
+	if (n > 0 && n >= (ssize_t)sizeof(struct ethhdr)) {
+		struct iov_tail data;
+
+		data = IOV_TAIL_FROM_BUF(pkt_buf, n, 0);
+		tap_add_packet(c, &data, now);
+	} else if (n < 0 && errno != EAGAIN && errno != EWOULDBLOCK) {
+		tap_sock_reset(c);
+		return;
+	}
+#else
 	if (partial_len) {
 		/* We have a partial frame from an earlier pass.  Move it to the
 		 * start of the buffer, top up with new data, then process all
@@ -1281,6 +1301,7 @@ static void tap_passt_input(struct ctx *c, const struct timespec *now)
 
 	partial_len = n;
 	partial_frame = p;
+#endif
 
 	tap_handler(c, now);
 }
diff --git a/tcp_buf.c b/tcp_buf.c
index 72c4541..eb28abe 100644
--- a/tcp_buf.c
+++ b/tcp_buf.c
@@ -32,6 +32,7 @@
 #include "tcp_conn.h"
 #include "tcp_internal.h"
 #include "tcp_buf.h"
+#include "fuzz.h"
 
 #define TCP_FRAMES_MEM			128
 #define TCP_FRAMES							   \
diff --git a/util.c b/util.c
index 28c32e4..7f29c3b 100644
--- a/util.c
+++ b/util.c
@@ -36,6 +36,7 @@
 #include "epoll_ctl.h"
 #include "pasta.h"
 #include "serialise.h"
+#include "fuzz.h"
 #ifdef HAS_GETRANDOM
 #include <sys/random.h>
 #endif
@@ -229,7 +230,11 @@ int sock_l4_dualstack_any(const struct ctx *c, enum epoll_type type,
  */
 int sock_unix(char *sock_path)
 {
+#ifdef FUZZING
+	int fd = socket(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC, 0);
+#else
 	int fd = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
+#endif
 	struct sockaddr_un addr = {
 		.sun_family = AF_UNIX,
 	};
@@ -248,8 +253,13 @@ int sock_unix(char *sock_path)
 					UNIX_SOCK_PATH, i))
 			die_perror("Can't build UNIX domain socket path");
 
+#ifdef FUZZING
+		ex = socket(AF_UNIX, SOCK_SEQPACKET | SOCK_NONBLOCK | SOCK_CLOEXEC,
+			    0);
+#else
 		ex = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK | SOCK_CLOEXEC,
 			    0);
+#endif
 		if (ex < 0)
 			die_perror("Failed to check for UNIX domain conflicts");
 
-- 
2.55.0