fasthttp/ipv6_test.go

package fasthttp

import (
	"bytes"
	"net"
	"testing"
)

// oracleValid replicates the original function's semantics using net.ParseIP:
// - Input must start with '['
// - There must be a closing ']' and a non-empty address between
// - Optional %zone allowed but must not be empty
// - Zone is stripped before checking with net.ParseIP
// - Must contain a ':' to be IPv6 (prevents raw IPv4-in-brackets).
func oracleValid(host []byte) bool {
	if len(host) == 0 || host[0] != '[' {
		// Original function: non-bracketed hosts return nil (treated as valid/no-op).
		return true
	}

	end := bytes.IndexByte(host, ']')
	if end < 0 {
		return false
	}
	addr := host[1:end]
	if len(addr) == 0 {
		return false
	}

	// Split off %zone (if present).
	if zi := bytes.IndexByte(addr, '%'); zi >= 0 {
		// Zone must not be empty.
		if zi == len(addr)-1 {
			return false
		}
		addr = addr[:zi]
	}

	// Must contain ':' to be IPv6.
	if bytes.IndexByte(addr, ':') < 0 {
		return false
	}

	// Use net.ParseIP on the de-zoned address (this was the original check).
	if ip := net.ParseIP(string(addr)); ip == nil {
		return false
	}
	return true
}

func FuzzValidateIPv6Literal(f *testing.F) {
	seeds := [][]byte{
		[]byte(""),            // non-bracketed => valid (no-op)
		[]byte("example.com"), // non-bracketed => valid (no-op)
		[]byte("["),           // unterminated
		[]byte("[]"),          // empty
		[]byte("[::]"),
		[]byte("[::1]"),
		[]byte("[2001:db8::1]"),
		[]byte("[2001:db8::]"),
		[]byte("[::ffff:192.168.0.1]"),
		[]byte("[fe80::1%eth0]"),
		[]byte("[fe80::1%]"),         // empty zone
		[]byte("[1234]"),             // no colon
		[]byte("[2001:db8:zzzz::1]"), // invalid hex
		[]byte("[::ffff:256.0.0.1]"), // invalid v4 tail
		[]byte("[2001:db8:::1]"),     // triple colon
		[]byte("[::1]:443"),          // trailing port outside ']' is ignored by validator
		[]byte("[2001:db8:0:0:0:0:2:1]"),
		[]byte("[2001:db8:0:0:0:0:2:1%en0]"),
	}
	for _, s := range seeds {
		f.Add(s)
	}

	f.Fuzz(func(t *testing.T, host []byte) {
		gotErr := validateIPv6Literal(host)
		wantValid := oracleValid(host)

		if (gotErr == nil) != wantValid {
			t.Fatalf("mismatch for %q: validateIPv6Literal err=%v, oracleValid=%v",
				b2s(host), gotErr, wantValid)
		}
	})
}