public sealed class UdpTransportTargetThe UDP transport, taking datagrams from anybody who can reach the port.
No guide page documents this yet — the page shows what the code says about itself.
Remarks
The most exposed code in the module, and the last of it to be fuzzed. Everything else in this harness sits above the handshake: a snapshot, a call or an input is only parsed once a connection exists and a client has been admitted. A datagram is parsed before any of that, by a server that is listening on a public port, from a source address that costs nothing to forge.
What that reaches is three layers at once. The packet-kind switch, the four-step connect handshake with its salt and cookie, and — once a connection is up — the reliability layer's sequence windows and the fragment reassembler, which is the one that holds pooled buffers keyed by a number the sender chose.
It establishes a real connection first, and that is what makes the target reach anything. The first version of this did not, and it managed two distinct behaviours in two million cases — every datagram was refused at the handshake, because completing one needs the server's cookie and the cookie is eight random bytes the fuzzer cannot guess. That is the cookie working exactly as designed, and it means the reliability layer and the reassembler — the parts most worth fuzzing — sit behind a door no amount of mutation opens. So the target opens it the way an attacker would: connect properly, then send rubbish. An authenticated client is still an untrusted one.
Where a datagram appears to come from depends on what it claims to be. A message, an acknowledgement, a keep-alive or a disconnect names a connection, so it arrives from the connected peer — from anywhere else it is meaningless and the transport is right to say so in one comparison. Everything else arrives from a stranger whose address varies, which is the shape of every UDP exhaustion attack and is what Held is watching.
Fields and properties (4)
public string NameWhat to call it on a command line and in a report.
public string WhatWhich receive path this is, in one line.
public long HeldHow many connections the server is holding.
public long HeldCapThe most it may hold before that is a finding.
Methods (6)
public UdpTransportTarget()Creates the target with a listening server half and one connected peer.
public long AllowanceFor(int inputLength)How many bytes an input may cause to be allocated.
public void Seed(ICollection<byte[]> corpus)Adds well-formed inputs for the mutator to start from.
public void Maintain()Puts the target back into a state worth fuzzing, before the next case.
public long Run(ReadOnlySpan<byte> input)Pushes one input through the decoder.
public void Dispose()Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.
Used by (1)
- FuzzTargetsVixen.Net.Fuzz