bastion 0.53.2

2026-10-20 04:42:14 +00:00
commit e4c9b69b46
471 changed files with 159794 additions and 0 deletions
@@ -0,0 +1,36 @@
+package main
+
+// Fuzz target for the tunnel's one allowed address. host_tunnel_ip arrives in
+// the pairing response and becomes the WireGuard peer's AllowedIPs; whatever
+// the string, the answer is either a refusal or exactly one address.
+
+import (
+	"net/netip"
+	"testing"
+)
+
+func FuzzATunnelAddressIsOneHostOrRefused(f *testing.F) {
+	for _, s := range []string{"2001:db8::e:3", "10.0.0.1", "2001:db8::e:3/64", "::/0", "0.0.0.0/0",
+		"", "::", "2001:db8::e:3%eth0", "::ffff:10.0.0.1", "ff02::1", " 2001:db8::1"} {
+		f.Add(s)
+	}
+	f.Fuzz(func(t *testing.T, s string) {
+		got, err := hostTunnelAllowedIP(s)
+		if err != nil {
+			return
+		}
+		p, perr := netip.ParsePrefix(got)
+		if perr != nil {
+			t.Fatalf("%q -> %q, which is not a prefix: %v", s, got, perr)
+		}
+		if p.Bits() != p.Addr().BitLen() {
+			t.Fatalf("%q -> %q covers more than one address", s, got)
+		}
+		if a, _ := netip.ParseAddr(s); a != p.Addr() {
+			t.Fatalf("%q -> %q is not the address it was given", s, got)
+		}
+		if p.Addr().IsUnspecified() || p.Addr().IsMulticast() {
+			t.Fatalf("%q -> %q is not one host", s, got)
+		}
+	})
+}