http_proxy_client_socket_fuzzer.cc 3.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/http/http_proxy_client_socket.h"
  5. #include <stddef.h>
  6. #include <stdint.h>
  7. #include <fuzzer/FuzzedDataProvider.h>
  8. #include <memory>
  9. #include <string>
  10. #include "base/check_op.h"
  11. #include "base/strings/utf_string_conversions.h"
  12. #include "net/base/address_list.h"
  13. #include "net/base/auth.h"
  14. #include "net/base/host_port_pair.h"
  15. #include "net/base/network_isolation_key.h"
  16. #include "net/base/test_completion_callback.h"
  17. #include "net/http/http_auth_cache.h"
  18. #include "net/http/http_auth_handler_basic.h"
  19. #include "net/http/http_auth_handler_digest.h"
  20. #include "net/http/http_auth_handler_factory.h"
  21. #include "net/http/http_auth_preferences.h"
  22. #include "net/http/http_auth_scheme.h"
  23. #include "net/log/net_log.h"
  24. #include "net/log/test_net_log.h"
  25. #include "net/socket/fuzzed_socket.h"
  26. #include "net/socket/next_proto.h"
  27. #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
  28. // Fuzzer for HttpProxyClientSocket only tests establishing a connection when
  29. // using the proxy as a tunnel.
  30. //
  31. // |data| is used to create a FuzzedSocket to fuzz reads and writes, see that
  32. // class for details.
  33. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  34. FuzzedDataProvider data_provider(data, size);
  35. // Including an observer; even though the recorded results aren't currently
  36. // used, it'll ensure the netlogging code is fuzzed as well.
  37. net::RecordingNetLogObserver net_log_observer;
  38. net::TestCompletionCallback callback;
  39. auto fuzzed_socket =
  40. std::make_unique<net::FuzzedSocket>(&data_provider, net::NetLog::Get());
  41. CHECK_EQ(net::OK, fuzzed_socket->Connect(callback.callback()));
  42. // Create auth handler supporting basic and digest schemes. Other schemes can
  43. // make system calls, which doesn't seem like a great idea.
  44. net::HttpAuthCache auth_cache(
  45. false /* key_server_entries_by_network_isolation_key */);
  46. net::HttpAuthPreferences http_auth_preferences;
  47. http_auth_preferences.set_allowed_schemes(
  48. std::set<std::string>{net::kBasicAuthScheme, net::kDigestAuthScheme});
  49. net::HttpAuthHandlerRegistryFactory auth_handler_factory(
  50. &http_auth_preferences);
  51. scoped_refptr<net::HttpAuthController> auth_controller(
  52. base::MakeRefCounted<net::HttpAuthController>(
  53. net::HttpAuth::AUTH_PROXY, GURL("http://proxy:42/"),
  54. net::NetworkIsolationKey(), &auth_cache, &auth_handler_factory,
  55. nullptr));
  56. // Determine if the HttpProxyClientSocket should be told the underlying socket
  57. // is HTTPS.
  58. net::HttpProxyClientSocket socket(
  59. std::move(fuzzed_socket), "Bond/007", net::HostPortPair("foo", 80),
  60. net::ProxyServer(net::ProxyServer::SCHEME_HTTP,
  61. net::HostPortPair("proxy", 42)),
  62. auth_controller.get(), nullptr /* proxy_delegate */,
  63. TRAFFIC_ANNOTATION_FOR_TESTS);
  64. int result = socket.Connect(callback.callback());
  65. result = callback.GetResult(result);
  66. // Repeatedly try to log in with the same credentials.
  67. while (result == net::ERR_PROXY_AUTH_REQUESTED) {
  68. if (!auth_controller->HaveAuth()) {
  69. auth_controller->ResetAuth(net::AuthCredentials(u"user", u"pass"));
  70. }
  71. result = socket.RestartWithAuth(callback.callback());
  72. result = callback.GetResult(result);
  73. }
  74. return 0;
  75. }