fuzzed_socket.h 5.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SOCKET_FUZZED_SOCKET_H_
  5. #define NET_SOCKET_FUZZED_SOCKET_H_
  6. #include <stdint.h>
  7. #include "base/memory/weak_ptr.h"
  8. #include "base/strings/string_piece.h"
  9. #include "net/base/completion_once_callback.h"
  10. #include "net/base/ip_endpoint.h"
  11. #include "net/base/net_errors.h"
  12. #include "net/log/net_log_with_source.h"
  13. #include "net/socket/transport_client_socket.h"
  14. #include "net/traffic_annotation/network_traffic_annotation.h"
  15. class FuzzedDataProvider;
  16. namespace net {
  17. class IPEndPoint;
  18. class IOBuffer;
  19. class NetLog;
  20. // A StreamSocket that uses a FuzzedDataProvider to generate responses. Writes
  21. // can succeed synchronously or asynchronously, can write some or all of the
  22. // provided data, and can fail with several different errors. Reads can do the
  23. // same, but the read data is also generated from the FuzzedDataProvider. The
  24. // number of bytes written/read from a single call is currently capped at 255
  25. // bytes.
  26. //
  27. // Reads and writes are executed independently of one another, so to guarantee
  28. // the fuzzer behaves the same across repeated runs with the same input, the
  29. // reads and writes must be done in a deterministic order and for a
  30. // deterministic number of bytes, every time the fuzzer is run with the same
  31. // data.
  32. class FuzzedSocket : public TransportClientSocket {
  33. public:
  34. // |data_provider| is used as to determine behavior of the FuzzedSocket. It
  35. // must remain valid until after the FuzzedSocket is destroyed.
  36. FuzzedSocket(FuzzedDataProvider* data_provider, net::NetLog* net_log);
  37. FuzzedSocket(const FuzzedSocket&) = delete;
  38. FuzzedSocket& operator=(const FuzzedSocket&) = delete;
  39. ~FuzzedSocket() override;
  40. // If set to true, the socket will fuzz the result of the Connect() call.
  41. // It can fail or succeed, and return synchronously or asynchronously. If
  42. // false, Connect() succeeds synchronously. Defaults to false.
  43. void set_fuzz_connect_result(bool fuzz_connect_result) {
  44. fuzz_connect_result_ = fuzz_connect_result;
  45. }
  46. // Sets the remote address the socket claims to be using.
  47. void set_remote_address(const IPEndPoint& remote_address) {
  48. remote_address_ = remote_address;
  49. }
  50. // Socket implementation:
  51. int Read(IOBuffer* buf,
  52. int buf_len,
  53. CompletionOnceCallback callback) override;
  54. int Write(IOBuffer* buf,
  55. int buf_len,
  56. CompletionOnceCallback callback,
  57. const NetworkTrafficAnnotationTag& traffic_annotation) override;
  58. int SetReceiveBufferSize(int32_t size) override;
  59. int SetSendBufferSize(int32_t size) override;
  60. // TransportClientSocket implementation:
  61. int Bind(const net::IPEndPoint& local_addr) override;
  62. // StreamSocket implementation:
  63. int Connect(CompletionOnceCallback callback) override;
  64. void Disconnect() override;
  65. bool IsConnected() const override;
  66. bool IsConnectedAndIdle() const override;
  67. int GetPeerAddress(IPEndPoint* address) const override;
  68. int GetLocalAddress(IPEndPoint* address) const override;
  69. const NetLogWithSource& NetLog() const override;
  70. bool WasEverUsed() const override;
  71. bool WasAlpnNegotiated() const override;
  72. NextProto GetNegotiatedProtocol() const override;
  73. bool GetSSLInfo(SSLInfo* ssl_info) override;
  74. int64_t GetTotalReceivedBytes() const override;
  75. void ApplySocketTag(const net::SocketTag& tag) override;
  76. private:
  77. // Returns a net::Error that can be returned by a read or a write. Reads and
  78. // writes return basically the same set of errors, at the TCP socket layer.
  79. Error ConsumeReadWriteErrorFromData();
  80. void OnReadComplete(CompletionOnceCallback callback, int result);
  81. void OnWriteComplete(CompletionOnceCallback callback, int result);
  82. void OnConnectComplete(CompletionOnceCallback callback, int result);
  83. // Returns whether all operations should be synchronous. Starts returning
  84. // true once there have been too many async reads and writes, as spinning the
  85. // message loop too often tends to cause fuzzers to time out.
  86. // See https://crbug.com/823012
  87. bool ForceSync() const;
  88. FuzzedDataProvider* data_provider_;
  89. // If true, the result of the Connect() call is fuzzed - it can succeed or
  90. // fail with a variety of connection errors, and it can complete synchronously
  91. // or asynchronously.
  92. bool fuzz_connect_result_ = false;
  93. bool connect_pending_ = false;
  94. bool read_pending_ = false;
  95. bool write_pending_ = false;
  96. // This is true when the first callback returning an error is pending in the
  97. // message queue. If true, the socket acts like it's connected until that task
  98. // is run (Or Disconnect() is called), and reads / writes will return the same
  99. // error asynchronously, until it becomes false, at which point they'll return
  100. // it synchronously.
  101. bool error_pending_ = false;
  102. // If this is not OK, all reads/writes will fail with this error.
  103. int net_error_ = ERR_CONNECTION_CLOSED;
  104. int64_t total_bytes_read_ = 0;
  105. int64_t total_bytes_written_ = 0;
  106. int num_async_reads_and_writes_ = 0;
  107. NetLogWithSource net_log_;
  108. IPEndPoint remote_address_;
  109. base::WeakPtrFactory<FuzzedSocket> weak_factory_{this};
  110. };
  111. } // namespace net
  112. #endif // NET_SOCKET_FUZZED_SOCKET_H_